@georgedong32/ccs 7.67.0 → 8.0.0

package/dist/cliproxy/executor/auth-coordinator.js

@@ -0,0 +1,342 @@
+"use strict";
+/**
+ * Auth Coordinator — Executor-level authentication handoff
+ *
+ * Extracted from executor/index.ts (Phase 06).
+ * Handles:
+ * - --logout early exit
+ * - --import token early exit (Kiro only)
+ * - --auth / forceAuth OAuth flow (single + composite providers)
+ * - Antigravity responsibility gate (run and oauth contexts)
+ * - isAuthenticated checks + automatic OAuth trigger
+ * - Proactive token refresh (multi-provider for composite)
+ * - lastUsedAt touch via touchDefaultAccount
+ * - Preflight quota check
+ * - Account safety guards (cross-provider isolation)
+ * - First-run model configuration
+ *
+ * ORDERING (load-bearing — do not change):
+ *   1. logout/import/forceAuth early exits
+ *   2. Remote-proxy auth skip detection
+ *   3. Antigravity gate (oauth context: remote+forceAuth | run context: else branch)
+ *   4. OAuth check / trigger (single or composite)
+ *   5. Token refresh
+ *   6. lastUsedAt touch
+ *   7. Preflight quota check
+ *   8. Account safety guards
+ *   9. First-run model configuration
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureProviderSettingsFile = exports.ensureModelConfiguration = exports.runAccountSafetyGuards = exports.runPreflightQuotaCheck = exports.ensureProviderAuthentication = exports.runAntigravityGate = exports.resolveSkipLocalAuth = exports.handleImport = exports.handleLogout = void 0;
+const ui_1 = require("../../utils/ui");
+const auth_handler_1 = require("../auth/auth-handler");
+const config_generator_1 = require("../config/config-generator");
+const model_config_1 = require("../config/model-config");
+const codex_plan_compatibility_1 = require("../ai-providers/codex-plan-compatibility");
+const model_catalog_1 = require("../model-catalog");
+const antigravity_responsibility_1 = require("../auth/antigravity-responsibility");
+const retry_handler_1 = require("./retry-handler");
+const account_resolution_1 = require("./account-resolution");
+const quota_manager_1 = require("../quota/quota-manager");
+// ── 1. Special early-exit auth flags (logout / import) ────────────────────────
+/**
+ * Handle --logout: clear auth and exit 0.
+ * Returns true if early exit occurred (caller should return immediately).
+ */
+async function handleLogout(context) {
+    const { provider, parsedFlags } = context;
+    if (!parsedFlags.forceLogout)
+        return false;
+    const providerConfig = (0, config_generator_1.getProviderConfig)(provider);
+    const { clearAuth } = await Promise.resolve().then(() => __importStar(require('../auth/auth-handler')));
+    if (clearAuth(provider)) {
+        console.log((0, ui_1.ok)(`Logged out from ${providerConfig.displayName}`));
+    }
+    else {
+        console.log((0, ui_1.info)(`No authentication found for ${providerConfig.displayName}`));
+    }
+    process.exit(0);
+}
+exports.handleLogout = handleLogout;
+/**
+ * Handle --import: Kiro-only token import flow, exits when done.
+ * Returns true if early exit occurred.
+ */
+async function handleImport(context) {
+    const { provider, parsedFlags, verbose } = context;
+    const { forceImport, forceAuth, forceLogout, kiroAuthMethod, kiroIDCStartUrl, kiroIDCRegion, kiroIDCFlow, setNickname, } = parsedFlags;
+    if (!forceImport)
+        return false;
+    if (provider !== 'kiro') {
+        console.error((0, ui_1.fail)('--import is only available for Kiro'));
+        console.error(`    Run "ccs ${provider} --auth" to authenticate`);
+        process.exit(1);
+    }
+    if (forceAuth) {
+        console.error((0, ui_1.fail)('Cannot use --import with --auth'));
+        console.error('    --import: Import existing token from Kiro IDE');
+        console.error('    --auth: Trigger new OAuth flow in browser');
+        process.exit(1);
+    }
+    if (forceLogout) {
+        console.error((0, ui_1.fail)('Cannot use --import with --logout'));
+        process.exit(1);
+    }
+    const { triggerOAuth } = await Promise.resolve().then(() => __importStar(require('../auth/auth-handler')));
+    const authSuccess = await triggerOAuth(provider, {
+        verbose,
+        import: true,
+        ...(kiroAuthMethod ? { kiroMethod: kiroAuthMethod } : {}),
+        ...(kiroIDCStartUrl ? { kiroIDCStartUrl } : {}),
+        ...(kiroIDCRegion ? { kiroIDCRegion } : {}),
+        ...(kiroIDCFlow ? { kiroIDCFlow } : {}),
+        ...(setNickname ? { nickname: setNickname } : {}),
+    });
+    if (!authSuccess) {
+        console.error((0, ui_1.fail)('Failed to import Kiro token from IDE'));
+        console.error('    Make sure you are logged into Kiro IDE first');
+        process.exit(1);
+    }
+    process.exit(0);
+}
+exports.handleImport = handleImport;
+// ── 2. Remote proxy auth skip ──────────────────────────────────────────────────
+/**
+ * Returns true when a remote proxy with an authToken is active —
+ * local OAuth is not needed in this case.
+ */
+function resolveSkipLocalAuth(remoteAuthToken, useRemoteProxy) {
+    return useRemoteProxy && !!remoteAuthToken?.trim();
+}
+exports.resolveSkipLocalAuth = resolveSkipLocalAuth;
+// ── 3. Antigravity responsibility gate ────────────────────────────────────────
+/**
+ * Runs the Antigravity responsibility gate for the relevant code path.
+ *
+ * Two scenarios (must match original ordering in index.ts):
+ *   A. provider=agy + forceAuth + skipLocalAuth → oauth-context gate; if refused, log and return
+ *      (caller must return early — this function returns { earlyReturn: true })
+ *   B. provider=agy + !forceAuth + (skipLocalAuth || !requiresAuthNow) → run-context gate;
+ *      if refused, log and process.exit(1)
+ *
+ * Returns { earlyReturn: true } when the caller should return immediately (case A refused).
+ */
+async function runAntigravityGate(context, skipLocalAuth) {
+    const { provider, parsedFlags } = context;
+    const { forceAuth, acceptAgyRisk } = parsedFlags;
+    if (provider !== 'agy')
+        return { earlyReturn: false };
+    const providerConfig = (0, config_generator_1.getProviderConfig)(provider);
+    const requiresAuthNow = providerConfig.requiresOAuth && !(0, auth_handler_1.isAuthenticated)(provider);
+    if (forceAuth && skipLocalAuth) {
+        // Case A: remote proxy + forceAuth — gate in oauth context, skip local OAuth
+        const acknowledged = await (0, antigravity_responsibility_1.ensureCliAntigravityResponsibility)({
+            context: 'oauth',
+            acceptedByFlag: acceptAgyRisk,
+        });
+        if (!acknowledged) {
+            throw new Error(`Antigravity auth blocked. Re-run after completing confirmation or pass ${antigravity_responsibility_1.ANTIGRAVITY_ACCEPT_RISK_FLAGS[0]}.`);
+        }
+        console.error((0, ui_1.info)('Remote proxy mode is active; local OAuth flow is skipped in --auth mode.'));
+        return { earlyReturn: true };
+    }
+    if (!forceAuth) {
+        // Case B: run-context gate (only when auth not immediately required)
+        if (skipLocalAuth || !requiresAuthNow) {
+            const acknowledged = await (0, antigravity_responsibility_1.ensureCliAntigravityResponsibility)({
+                context: 'run',
+                acceptedByFlag: acceptAgyRisk,
+            });
+            if (!acknowledged) {
+                console.error((0, ui_1.fail)(`Antigravity session blocked. Re-run after completing confirmation or pass ${antigravity_responsibility_1.ANTIGRAVITY_ACCEPT_RISK_FLAGS[0]}.`));
+                process.exit(1);
+            }
+        }
+    }
+    return { earlyReturn: false };
+}
+exports.runAntigravityGate = runAntigravityGate;
+// ── 4–6. OAuth check / trigger + token refresh + account touch ─────────────────
+/**
+ * Ensure provider(s) are authenticated; trigger OAuth if needed.
+ * Handles both composite (multi-provider) and single-provider flows.
+ * Also runs proactive token refresh and touches lastUsedAt.
+ *
+ * Only called when providerConfig.requiresOAuth && !skipLocalAuth.
+ */
+async function ensureProviderAuthentication(context) {
+    const { provider, compositeProviders, parsedFlags, verbose, log } = context;
+    const { forceAuth, addAccount, acceptAgyRisk, kiroAuthMethod, kiroIDCStartUrl, kiroIDCRegion, kiroIDCFlow, gitlabTokenLogin, gitlabBaseUrl, forceHeadless, setNickname, noIncognito, pasteCallback, portForward, } = parsedFlags;
+    log(`Checking authentication for ${provider}`);
+    // Multi-provider path (composite variants)
+    if (compositeProviders.length > 0) {
+        if (forceAuth) {
+            const { triggerOAuth } = await Promise.resolve().then(() => __importStar(require('../auth/auth-handler')));
+            const failures = [];
+            for (const p of compositeProviders) {
+                const authSuccess = await triggerOAuth(p, {
+                    verbose,
+                    add: addAccount,
+                    ...(acceptAgyRisk ? { acceptAgyRisk: true } : {}),
+                    ...(kiroAuthMethod && p === 'kiro' ? { kiroMethod: kiroAuthMethod } : {}),
+                    ...(kiroIDCStartUrl && p === 'kiro' ? { kiroIDCStartUrl } : {}),
+                    ...(kiroIDCRegion && p === 'kiro' ? { kiroIDCRegion } : {}),
+                    ...(kiroIDCFlow && p === 'kiro' ? { kiroIDCFlow } : {}),
+                    ...(gitlabTokenLogin && p === 'gitlab' ? { gitlabAuthMode: 'pat' } : {}),
+                    ...(gitlabBaseUrl && p === 'gitlab' ? { gitlabBaseUrl } : {}),
+                    ...(forceHeadless ? { headless: true } : {}),
+                    ...(setNickname ? { nickname: setNickname } : {}),
+                    ...(noIncognito ? { noIncognito: true } : {}),
+                    ...(pasteCallback ? { pasteCallback: true } : {}),
+                    ...(portForward ? { portForward: true } : {}),
+                });
+                if (!authSuccess) {
+                    failures.push(p);
+                }
+            }
+            if (failures.length > 0) {
+                const succeeded = compositeProviders.filter((p) => !failures.includes(p));
+                console.error((0, ui_1.fail)(`Auth failed for: ${failures.join(', ')}`));
+                if (succeeded.length > 0) {
+                    console.error((0, ui_1.info)(`Succeeded: ${succeeded.join(', ')}`));
+                }
+                process.exit(1);
+            }
+            process.exit(0);
+        }
+        // Check for unauthenticated providers
+        const unauthenticatedProviders = [];
+        for (const p of compositeProviders) {
+            if (!(0, auth_handler_1.isAuthenticated)(p)) {
+                unauthenticatedProviders.push(p);
+            }
+        }
+        if (unauthenticatedProviders.length > 0) {
+            console.error((0, ui_1.fail)('Composite variant requires authentication for multiple providers:'));
+            for (const p of unauthenticatedProviders) {
+                console.error(`    - ${p} (run "ccs ${p} --auth")`);
+            }
+            process.exit(1);
+        }
+    }
+    else {
+        // Single-provider path
+        if (forceAuth || !(0, auth_handler_1.isAuthenticated)(provider)) {
+            const { triggerOAuth } = await Promise.resolve().then(() => __importStar(require('../auth/auth-handler')));
+            const providerConfig = (0, config_generator_1.getProviderConfig)(provider);
+            const authSuccess = await triggerOAuth(provider, {
+                verbose,
+                add: addAccount,
+                ...(acceptAgyRisk ? { acceptAgyRisk: true } : {}),
+                ...(kiroAuthMethod ? { kiroMethod: kiroAuthMethod } : {}),
+                ...(kiroIDCStartUrl ? { kiroIDCStartUrl } : {}),
+                ...(kiroIDCRegion ? { kiroIDCRegion } : {}),
+                ...(kiroIDCFlow ? { kiroIDCFlow } : {}),
+                ...(gitlabTokenLogin ? { gitlabAuthMode: 'pat' } : {}),
+                ...(gitlabBaseUrl ? { gitlabBaseUrl } : {}),
+                ...(forceHeadless ? { headless: true } : {}),
+                ...(setNickname ? { nickname: setNickname } : {}),
+                ...(noIncognito ? { noIncognito: true } : {}),
+                ...(pasteCallback ? { pasteCallback: true } : {}),
+                ...(portForward ? { portForward: true } : {}),
+            });
+            if (!authSuccess) {
+                throw new Error(`Authentication required for ${providerConfig.displayName}`);
+            }
+            if (forceAuth) {
+                process.exit(0);
+            }
+        }
+        else {
+            log(`${provider} already authenticated`);
+        }
+    }
+    // 3a. Proactive token refresh (multi-provider for composite)
+    if (compositeProviders.length > 0) {
+        for (const p of compositeProviders) {
+            await (0, retry_handler_1.handleTokenExpiration)(p, verbose);
+        }
+    }
+    else {
+        await (0, retry_handler_1.handleTokenExpiration)(provider, verbose);
+    }
+    // 3a-1. Update lastUsedAt
+    (0, account_resolution_1.touchDefaultAccount)(provider);
+}
+exports.ensureProviderAuthentication = ensureProviderAuthentication;
+// ── 7. Preflight quota check ──────────────────────────────────────────────────
+/**
+ * Preflight quota check for providers with quota-based rotation.
+ * Only runs when !skipLocalAuth.
+ */
+async function runPreflightQuotaCheck(provider, compositeProviders) {
+    if (compositeProviders.length > 0) {
+        for (const managedProvider of quota_manager_1.MANAGED_QUOTA_PROVIDERS) {
+            if (compositeProviders.includes(managedProvider)) {
+                await (0, retry_handler_1.handleQuotaCheck)(managedProvider);
+            }
+        }
+    }
+    else {
+        await (0, retry_handler_1.handleQuotaCheck)(provider);
+    }
+}
+exports.runPreflightQuotaCheck = runPreflightQuotaCheck;
+// ── 8. Account safety guards ──────────────────────────────────────────────────
+/**
+ * Enforce cross-provider account isolation. Only runs when !skipLocalAuth.
+ */
+function runAccountSafetyGuards(provider, compositeProviders) {
+    (0, account_resolution_1.applyAccountSafetyGuards)(provider, compositeProviders);
+}
+exports.runAccountSafetyGuards = runAccountSafetyGuards;
+// ── 9. First-run model configuration ─────────────────────────────────────────
+/**
+ * Ensure provider model is configured on first run.
+ * Skipped for composite variants and remote proxy mode.
+ * Also reconciles Codex model for active plan.
+ */
+async function ensureModelConfiguration(provider, cfg, verbose) {
+    if (!cfg.isComposite && (0, model_catalog_1.supportsModelConfig)(provider)) {
+        await (0, model_config_1.configureProviderModel)(provider, false, cfg.customSettingsPath);
+    }
+    if (provider === 'codex' && !cfg.isComposite) {
+        await (0, codex_plan_compatibility_1.reconcileCodexModelForActivePlan)({
+            currentModel: (0, model_config_1.getCurrentModel)(provider, cfg.customSettingsPath),
+            verbose,
+        });
+    }
+}
+exports.ensureModelConfiguration = ensureModelConfiguration;
+// ── Ensure provider settings file ────────────────────────────────────────────
+/**
+ * Ensure the provider settings file exists.
+ */
+function ensureProviderSettingsFile(provider) {
+    (0, config_generator_1.ensureProviderSettings)(provider);
+}
+exports.ensureProviderSettingsFile = ensureProviderSettingsFile;
+//# sourceMappingURL=auth-coordinator.js.map

package/dist/cliproxy/executor/auth-coordinator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-coordinator.js","sourceRoot":"","sources":["../../../src/cliproxy/executor/auth-coordinator.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,uCAAgD;AAChD,uDAAuD;AAEvD,iEAAuF;AACvF,yDAAiF;AACjF,uFAA4F;AAC5F,oDAAuD;AACvD,mFAG4C;AAC5C,mDAA0E;AAC1E,6DAAqF;AACrF,0DAAiE;AAgBjE,iFAAiF;AAEjF;;;GAGG;AACI,KAAK,UAAU,YAAY,CAAC,OAAgC;IACjE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAC1C,IAAI,CAAC,WAAW,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAE3C,MAAM,cAAc,GAAG,IAAA,oCAAiB,EAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,EAAE,SAAS,EAAE,GAAG,wDAAa,sBAAsB,GAAC,CAAC;IAC3D,IAAI,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,IAAA,OAAE,EAAC,mBAAmB,cAAc,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACnE,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,IAAA,SAAI,EAAC,+BAA+B,cAAc,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAZD,oCAYC;AAED;;;GAGG;AACI,KAAK,UAAU,YAAY,CAAC,OAAgC;IACjE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACnD,MAAM,EACJ,WAAW,EACX,SAAS,EACT,WAAW,EACX,cAAc,EACd,eAAe,EACf,aAAa,EACb,WAAW,EACX,WAAW,GACZ,GAAG,WAAW,CAAC;IAEhB,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAE/B,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,IAAA,SAAI,EAAC,qCAAqC,CAAC,CAAC,CAAC;QAC3D,OAAO,CAAC,KAAK,CAAC,gBAAgB,QAAQ,0BAA0B,CAAC,CAAC;QAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,IAAA,SAAI,EAAC,iCAAiC,CAAC,CAAC,CAAC;QACvD,OAAO,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACnE,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,IAAA,SAAI,EAAC,mCAAmC,CAAC,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,EAAE,YAAY,EAAE,GAAG,wDAAa,sBAAsB,GAAC,CAAC;IAC9D,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE;QAC/C,OAAO;QACP,MAAM,EAAE,IAAI;QACZ,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC,CAAC;IACH,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,KAAK,CAAC,IAAA,SAAI,EAAC,sCAAsC,CAAC,CAAC,CAAC;QAC5D,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;QAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AA/CD,oCA+CC;AAED,kFAAkF;AAElF;;;GAGG;AACH,SAAgB,oBAAoB,CAClC,eAAmC,EACnC,cAAuB;IAEvB,OAAO,cAAc,IAAI,CAAC,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;AACrD,CAAC;AALD,oDAKC;AAED,iFAAiF;AAEjF;;;;;;;;;;GAUG;AACI,KAAK,UAAU,kBAAkB,CACtC,OAAgC,EAChC,aAAsB;IAEtB,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAC1C,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,WAAW,CAAC;IAEjD,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAEtD,MAAM,cAAc,GAAG,IAAA,oCAAiB,EAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,eAAe,GAAG,cAAc,CAAC,aAAa,IAAI,CAAC,IAAA,8BAAe,EAAC,QAAQ,CAAC,CAAC;IAEnF,IAAI,SAAS,IAAI,aAAa,EAAE,CAAC;QAC/B,6EAA6E;QAC7E,MAAM,YAAY,GAAG,MAAM,IAAA,+DAAkC,EAAC;YAC5D,OAAO,EAAE,OAAO;YAChB,cAAc,EAAE,aAAa;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,0EAA0E,0DAA6B,CAAC,CAAC,CAAC,GAAG,CAC9G,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,IAAA,SAAI,EAAC,0EAA0E,CAAC,CAAC,CAAC;QAChG,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC/B,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,qEAAqE;QACrE,IAAI,aAAa,IAAI,CAAC,eAAe,EAAE,CAAC;YACtC,MAAM,YAAY,GAAG,MAAM,IAAA,+DAAkC,EAAC;gBAC5D,OAAO,EAAE,KAAK;gBACd,cAAc,EAAE,aAAa;aAC9B,CAAC,CAAC;YACH,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,OAAO,CAAC,KAAK,CACX,IAAA,SAAI,EACF,6EAA6E,0DAA6B,CAAC,CAAC,CAAC,GAAG,CACjH,CACF,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAChC,CAAC;AA9CD,gDA8CC;AAED,kFAAkF;AAElF;;;;;;GAMG;AACI,KAAK,UAAU,4BAA4B,CAChD,OAAgC;IAEhC,MAAM,EAAE,QAAQ,EAAE,kBAAkB,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAC5E,MAAM,EACJ,SAAS,EACT,UAAU,EACV,aAAa,EACb,cAAc,EACd,eAAe,EACf,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,WAAW,EACX,WAAW,EACX,aAAa,EACb,WAAW,GACZ,GAAG,WAAW,CAAC;IAEhB,GAAG,CAAC,+BAA+B,QAAQ,EAAE,CAAC,CAAC;IAE/C,2CAA2C;IAC3C,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,EAAE,YAAY,EAAE,GAAG,wDAAa,sBAAsB,GAAC,CAAC;YAC9D,MAAM,QAAQ,GAAa,EAAE,CAAC;YAC9B,KAAK,MAAM,CAAC,IAAI,kBAAkB,EAAE,CAAC;gBACnC,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE;oBACxC,OAAO;oBACP,GAAG,EAAE,UAAU;oBACf,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjD,GAAG,CAAC,cAAc,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzE,GAAG,CAAC,eAAe,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/D,GAAG,CAAC,aAAa,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3D,GAAG,CAAC,WAAW,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvD,GAAG,CAAC,gBAAgB,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjF,GAAG,CAAC,aAAa,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7D,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5C,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjD,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7C,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjD,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9C,CAAC,CAAC;gBACH,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1E,OAAO,CAAC,KAAK,CAAC,IAAA,SAAI,EAAC,oBAAoB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC/D,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACzB,OAAO,CAAC,KAAK,CAAC,IAAA,SAAI,EAAC,cAAc,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC5D,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,sCAAsC;QACtC,MAAM,wBAAwB,GAAa,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,kBAAkB,EAAE,CAAC;YACnC,IAAI,CAAC,IAAA,8BAAe,EAAC,CAAC,CAAC,EAAE,CAAC;gBACxB,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QACD,IAAI,wBAAwB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,OAAO,CAAC,KAAK,CAAC,IAAA,SAAI,EAAC,mEAAmE,CAAC,CAAC,CAAC;YACzF,KAAK,MAAM,CAAC,IAAI,wBAAwB,EAAE,CAAC;gBACzC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;YACtD,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;SAAM,CAAC;QACN,uBAAuB;QACvB,IAAI,SAAS,IAAI,CAAC,IAAA,8BAAe,EAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,MAAM,EAAE,YAAY,EAAE,GAAG,wDAAa,sBAAsB,GAAC,CAAC;YAC9D,MAAM,cAAc,GAAG,IAAA,oCAAiB,EAAC,QAAQ,CAAC,CAAC;YACnD,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE;gBAC/C,OAAO;gBACP,GAAG,EAAE,UAAU;gBACf,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3C,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3C,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5C,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9C,CAAC,CAAC;YACH,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,+BAA+B,cAAc,CAAC,WAAW,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,QAAQ,wBAAwB,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,6DAA6D;IAC7D,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,kBAAkB,EAAE,CAAC;YACnC,MAAM,IAAA,qCAAqB,EAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,IAAA,qCAAqB,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAED,0BAA0B;IAC1B,IAAA,wCAAmB,EAAC,QAAQ,CAAC,CAAC;AAChC,CAAC;AArHD,oEAqHC;AAED,iFAAiF;AAEjF;;;GAGG;AACI,KAAK,UAAU,sBAAsB,CAC1C,QAA0B,EAC1B,kBAAsC;IAEtC,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,KAAK,MAAM,eAAe,IAAI,uCAAuB,EAAE,CAAC;YACtD,IAAI,kBAAkB,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;gBACjD,MAAM,IAAA,gCAAgB,EAAC,eAAe,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,IAAA,gCAAgB,EAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;AACH,CAAC;AAbD,wDAaC;AAED,iFAAiF;AAEjF;;GAEG;AACH,SAAgB,sBAAsB,CACpC,QAA0B,EAC1B,kBAAsC;IAEtC,IAAA,6CAAwB,EAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;AACzD,CAAC;AALD,wDAKC;AAED,gFAAgF;AAEhF;;;;GAIG;AACI,KAAK,UAAU,wBAAwB,CAC5C,QAA0B,EAC1B,GAAmB,EACnB,OAAgB;IAEhB,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,IAAA,mCAAmB,EAAC,QAAQ,CAAC,EAAE,CAAC;QACtD,MAAM,IAAA,qCAAsB,EAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,QAAQ,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,IAAA,2DAAgC,EAAC;YACrC,YAAY,EAAE,IAAA,8BAAe,EAAC,QAAQ,EAAE,GAAG,CAAC,kBAAkB,CAAC;YAC/D,OAAO;SACR,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAfD,4DAeC;AAED,gFAAgF;AAEhF;;GAEG;AACH,SAAgB,0BAA0B,CAAC,QAA0B;IACnE,IAAA,yCAAsB,EAAC,QAAQ,CAAC,CAAC;AACnC,CAAC;AAFD,gEAEC"}

package/dist/cliproxy/executor/browser-launch-setup.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Browser Launch Setup — Executor-level browser initialization
+ *
+ * Extracted from executor/index.ts (Phase 04).
+ * Handles:
+ * 1. Browser launch flag resolution and override parsing
+ * 2. Browser attach config + exposure resolution + blocked-override warning
+ * 3. Optional browser attach runtime resolution (devtools WebSocket)
+ * 4. Browser MCP ensure + sync-to-config-dir
+ */
+import { type BrowserLaunchOverride } from '../../utils/browser';
+export interface BrowserLaunchSetupResult {
+    /** CLI override flag if --browser-launch / --no-browser-launch was passed */
+    browserLaunchOverride: BrowserLaunchOverride | undefined;
+    /** args list with --browser-launch* flags removed */
+    argsWithoutBrowserFlags: string[];
+    /** Devtools WebSocket env vars if browser attach runtime is active */
+    browserRuntimeEnv: Record<string, string> | undefined;
+}
+/**
+ * Phase 1 — resolve browser CLI flags and attach config.
+ * Call this immediately after resolveExecutorProxy so that
+ * argsWithoutBrowserFlags is available for downstream parsing.
+ *
+ * @returns partial setup result (no async work yet)
+ */
+export declare function resolveBrowserLaunchFlags(argsWithoutProxy: string[]): {
+    browserLaunchOverride: BrowserLaunchOverride | undefined;
+    argsWithoutBrowserFlags: string[];
+};
+/**
+ * Phase 2 — resolve async browser attach runtime and MCP setup.
+ * Must be called AFTER phase-1 and AFTER ensureWebSearchMcpOrThrow().
+ */
+export declare function resolveBrowserRuntime(browserLaunchOverride: BrowserLaunchOverride | undefined, inheritedClaudeConfigDir: string | undefined): Promise<Pick<BrowserLaunchSetupResult, 'browserRuntimeEnv'>>;
+//# sourceMappingURL=browser-launch-setup.d.ts.map

package/dist/cliproxy/executor/browser-launch-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-launch-setup.d.ts","sourceRoot":"","sources":["../../../src/cliproxy/executor/browser-launch-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EACL,KAAK,qBAAqB,EAQ3B,MAAM,qBAAqB,CAAC;AAG7B,MAAM,WAAW,wBAAwB;IACvC,6EAA6E;IAC7E,qBAAqB,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACzD,qDAAqD;IACrD,uBAAuB,EAAE,MAAM,EAAE,CAAC;IAClC,sEAAsE;IACtE,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;CACvD;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,gBAAgB,EAAE,MAAM,EAAE,GAAG;IACrE,qBAAqB,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACzD,uBAAuB,EAAE,MAAM,EAAE,CAAC;CACnC,CA+BA;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,qBAAqB,EAAE,qBAAqB,GAAG,SAAS,EACxD,wBAAwB,EAAE,MAAM,GAAG,SAAS,GAC3C,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE,mBAAmB,CAAC,CAAC,CAkC9D"}

package/dist/cliproxy/executor/browser-launch-setup.js

@@ -0,0 +1,80 @@
+"use strict";
+/**
+ * Browser Launch Setup — Executor-level browser initialization
+ *
+ * Extracted from executor/index.ts (Phase 04).
+ * Handles:
+ * 1. Browser launch flag resolution and override parsing
+ * 2. Browser attach config + exposure resolution + blocked-override warning
+ * 3. Optional browser attach runtime resolution (devtools WebSocket)
+ * 4. Browser MCP ensure + sync-to-config-dir
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveBrowserRuntime = exports.resolveBrowserLaunchFlags = void 0;
+const ui_1 = require("../../utils/ui");
+const browser_1 = require("../../utils/browser");
+const config_loader_facade_1 = require("../../config/config-loader-facade");
+/**
+ * Phase 1 — resolve browser CLI flags and attach config.
+ * Call this immediately after resolveExecutorProxy so that
+ * argsWithoutBrowserFlags is available for downstream parsing.
+ *
+ * @returns partial setup result (no async work yet)
+ */
+function resolveBrowserLaunchFlags(argsWithoutProxy) {
+    let browserLaunchOverride;
+    let argsWithoutBrowserFlags = argsWithoutProxy;
+    try {
+        const browserLaunchFlags = (0, browser_1.resolveBrowserLaunchFlagResolution)(argsWithoutProxy);
+        browserLaunchOverride = browserLaunchFlags.override;
+        argsWithoutBrowserFlags = browserLaunchFlags.argsWithoutFlags;
+    }
+    catch (error) {
+        console.error((0, ui_1.warn)(error.message));
+        process.exit(1);
+        return { browserLaunchOverride: undefined, argsWithoutBrowserFlags };
+    }
+    const browserConfig = (0, config_loader_facade_1.getBrowserConfig)();
+    const browserAttachConfig = (0, browser_1.getEffectiveClaudeBrowserAttachConfig)(browserConfig);
+    const claudeBrowserExposure = (0, browser_1.resolveBrowserExposure)({
+        enabled: browserAttachConfig.enabled,
+        policy: browserConfig.claude.policy,
+    }, browserLaunchOverride);
+    const blockedBrowserOverrideWarning = (0, browser_1.getBlockedBrowserOverrideWarning)('Claude Browser Attach', claudeBrowserExposure);
+    if (blockedBrowserOverrideWarning) {
+        console.error((0, ui_1.warn)(blockedBrowserOverrideWarning));
+    }
+    return { browserLaunchOverride, argsWithoutBrowserFlags };
+}
+exports.resolveBrowserLaunchFlags = resolveBrowserLaunchFlags;
+/**
+ * Phase 2 — resolve async browser attach runtime and MCP setup.
+ * Must be called AFTER phase-1 and AFTER ensureWebSearchMcpOrThrow().
+ */
+async function resolveBrowserRuntime(browserLaunchOverride, inheritedClaudeConfigDir) {
+    const browserConfig = (0, config_loader_facade_1.getBrowserConfig)();
+    const browserAttachConfig = (0, browser_1.getEffectiveClaudeBrowserAttachConfig)(browserConfig);
+    const claudeBrowserExposure = (0, browser_1.resolveBrowserExposure)({
+        enabled: browserAttachConfig.enabled,
+        policy: browserConfig.claude.policy,
+    }, browserLaunchOverride);
+    const browserAttachRuntime = browserAttachConfig.enabled && claudeBrowserExposure.exposeForLaunch
+        ? await (0, browser_1.resolveOptionalBrowserAttachRuntime)(browserAttachConfig)
+        : undefined;
+    const browserRuntimeEnv = browserAttachRuntime?.runtimeEnv;
+    if (browserAttachRuntime?.warning) {
+        process.stderr.write(`${(0, ui_1.warn)(browserAttachRuntime.warning)}\n`);
+    }
+    if (browserRuntimeEnv) {
+        (0, browser_1.ensureBrowserMcpOrThrow)();
+    }
+    // Sync browser MCP config into inherited Claude instance if browser is active
+    if (browserRuntimeEnv && inheritedClaudeConfigDir) {
+        if (!(0, browser_1.syncBrowserMcpToConfigDir)(inheritedClaudeConfigDir)) {
+            throw new Error('Browser MCP is enabled, but CCS could not sync the browser MCP config into the inherited Claude instance.');
+        }
+    }
+    return { browserRuntimeEnv };
+}
+exports.resolveBrowserRuntime = resolveBrowserRuntime;
+//# sourceMappingURL=browser-launch-setup.js.map

package/dist/cliproxy/executor/browser-launch-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-launch-setup.js","sourceRoot":"","sources":["../../../src/cliproxy/executor/browser-launch-setup.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAEH,uCAAsC;AACtC,iDAS6B;AAC7B,4EAAqE;AAWrE;;;;;;GAMG;AACH,SAAgB,yBAAyB,CAAC,gBAA0B;IAIlE,IAAI,qBAAwD,CAAC;IAC7D,IAAI,uBAAuB,GAAG,gBAAgB,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,kBAAkB,GAAG,IAAA,4CAAkC,EAAC,gBAAgB,CAAC,CAAC;QAChF,qBAAqB,GAAG,kBAAkB,CAAC,QAAQ,CAAC;QACpD,uBAAuB,GAAG,kBAAkB,CAAC,gBAAgB,CAAC;IAChE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,IAAA,SAAI,EAAE,KAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,uBAAuB,EAAE,CAAC;IACvE,CAAC;IAED,MAAM,aAAa,GAAG,IAAA,uCAAgB,GAAE,CAAC;IACzC,MAAM,mBAAmB,GAAG,IAAA,+CAAqC,EAAC,aAAa,CAAC,CAAC;IACjF,MAAM,qBAAqB,GAAG,IAAA,gCAAsB,EAClD;QACE,OAAO,EAAE,mBAAmB,CAAC,OAAO;QACpC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM;KACpC,EACD,qBAAqB,CACtB,CAAC;IACF,MAAM,6BAA6B,GAAG,IAAA,0CAAgC,EACpE,uBAAuB,EACvB,qBAAqB,CACtB,CAAC;IACF,IAAI,6BAA6B,EAAE,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,IAAA,SAAI,EAAC,6BAA6B,CAAC,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,CAAC;AAC5D,CAAC;AAlCD,8DAkCC;AAED;;;GAGG;AACI,KAAK,UAAU,qBAAqB,CACzC,qBAAwD,EACxD,wBAA4C;IAE5C,MAAM,aAAa,GAAG,IAAA,uCAAgB,GAAE,CAAC;IACzC,MAAM,mBAAmB,GAAG,IAAA,+CAAqC,EAAC,aAAa,CAAC,CAAC;IACjF,MAAM,qBAAqB,GAAG,IAAA,gCAAsB,EAClD;QACE,OAAO,EAAE,mBAAmB,CAAC,OAAO;QACpC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM;KACpC,EACD,qBAAqB,CACtB,CAAC;IAEF,MAAM,oBAAoB,GACxB,mBAAmB,CAAC,OAAO,IAAI,qBAAqB,CAAC,eAAe;QAClE,CAAC,CAAC,MAAM,IAAA,6CAAmC,EAAC,mBAAmB,CAAC;QAChE,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,iBAAiB,GAAG,oBAAoB,EAAE,UAAU,CAAC;IAC3D,IAAI,oBAAoB,EAAE,OAAO,EAAE,CAAC;QAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAA,SAAI,EAAC,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAA,iCAAuB,GAAE,CAAC;IAC5B,CAAC;IAED,8EAA8E;IAC9E,IAAI,iBAAiB,IAAI,wBAAwB,EAAE,CAAC;QAClD,IAAI,CAAC,IAAA,mCAAyB,EAAC,wBAAwB,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,2GAA2G,CAC5G,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAC/B,CAAC;AArCD,sDAqCC"}

package/dist/cliproxy/executor/claude-launcher.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Claude Launcher — Concern H
+ *
+ * Handles final argument assembly, trace context injection, Windows shell
+ * escaping, spawning the Claude CLI process, starting the runtime quota
+ * monitor, and wiring up cleanup handlers.
+ */
+/// <reference types="node" />
+/// <reference types="bun-types" />
+/// <reference types="node" />
+import { ChildProcess } from 'child_process';
+import { CLIProxyProvider, ExecutorConfig } from '../types';
+import { CodexReasoningProxy } from '../ai-providers/codex-reasoning-proxy';
+import { ToolSanitizationProxy } from '../proxy/tool-sanitization-proxy';
+import { HttpsTunnelProxy } from '../proxy/https-tunnel-proxy';
+export interface ClaudeLaunchContext {
+    /** Path to the Claude CLI executable */
+    claudeCli: string;
+    /** Pre-filtered Claude args (CCS flags already stripped) */
+    claudeArgs: string[];
+    /** Fully assembled environment variables (without trace additions) */
+    env: NodeJS.ProcessEnv;
+    /** Resolved executor config */
+    cfg: ExecutorConfig;
+    /** Active CLIProxy provider */
+    provider: CLIProxyProvider;
+    /** Providers derived from composite tiers (empty for simple providers) */
+    compositeProviders: CLIProxyProvider[];
+    /** Whether local OAuth was skipped (remote proxy auth in use) */
+    skipLocalAuth: boolean;
+    /** Session ID for cleanup tracking */
+    sessionId: string | undefined;
+    /** Whether image analysis MCP is ready */
+    imageAnalysisMcpReady: boolean;
+    /** Browser runtime environment variables (undefined if browser not active) */
+    browserRuntimeEnv: NodeJS.ProcessEnv | undefined;
+    /** Inherited Claude config dir for continuity */
+    inheritedClaudeConfigDir: string | undefined;
+    /** Active Codex reasoning proxy (if any) */
+    codexReasoningProxy: CodexReasoningProxy | null;
+    /** Active tool sanitization proxy (if any) */
+    toolSanitizationProxy: ToolSanitizationProxy | null;
+    /** Active HTTPS tunnel proxy (if any) */
+    httpsTunnel: HttpsTunnelProxy | null;
+    /** Whether verbose logging is enabled */
+    verbose: boolean;
+}
+/**
+ * Assemble final Claude CLI arguments, inject trace context, spawn the process,
+ * start the runtime quota monitor, and wire cleanup handlers.
+ *
+ * @returns The spawned ChildProcess for the Claude CLI.
+ */
+export declare function launchClaude(context: ClaudeLaunchContext): Promise<ChildProcess>;
+//# sourceMappingURL=claude-launcher.d.ts.map

package/dist/cliproxy/executor/claude-launcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-launcher.d.ts","sourceRoot":"","sources":["../../../src/cliproxy/executor/claude-launcher.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;;;;AAEH,OAAO,EAAS,YAAY,EAAE,MAAM,eAAe,CAAC;AAYpD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAU/D,MAAM,WAAW,mBAAmB;IAClC,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,sEAAsE;IACtE,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,+BAA+B;IAC/B,GAAG,EAAE,cAAc,CAAC;IACpB,+BAA+B;IAC/B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,0EAA0E;IAC1E,kBAAkB,EAAE,gBAAgB,EAAE,CAAC;IACvC,iEAAiE;IACjE,aAAa,EAAE,OAAO,CAAC;IACvB,sCAAsC;IACtC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,0CAA0C;IAC1C,qBAAqB,EAAE,OAAO,CAAC;IAC/B,8EAA8E;IAC9E,iBAAiB,EAAE,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC;IACjD,iDAAiD;IACjD,wBAAwB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,4CAA4C;IAC5C,mBAAmB,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAChD,8CAA8C;IAC9C,qBAAqB,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACpD,yCAAyC;IACzC,WAAW,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACrC,yCAAyC;IACzC,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,YAAY,CAAC,CA6GtF"}