@jiayunxie/aerial 0.2.1 → 0.2.2

package/README.md

@@ -11,7 +11,7 @@ It runs locally on `127.0.0.1:18181`. Your GitHub token and Aerial key stay on y
 
 Requirements:
 
-- Node.js 24+
+- Node.js 20.18.1+
 - A GitHub account with an active Copilot subscription
 - Codex CLI and/or Claude Code installed
 

package/docs/usage.md

@@ -17,7 +17,7 @@ git clone https://github.com/Xiejiayun/aerial.git
 cd aerial
 npm install -g .
 # or run without global install:
-node src/cli.js --help
+node src/cli/index.js --help
 ```
 
 ## 2. Configure Local Clients
@@ -240,7 +240,7 @@ Aerial ships a thin platform wrapper around the user-mode service primitives pro
 - Windows: a Task Scheduler task named `AerialLocalProxy`, `/SC ONLOGON /RL LIMITED`, executes a PowerShell wrapper at `<config-dir>\bin\aerial-service.ps1` (default `%APPDATA%\aerial\bin\aerial-service.ps1`). The wrapper is regenerated on every `aerial service install`. The `/TR` argument is wrapped in escaped quotes so paths that contain spaces or non-ASCII characters work without manual quoting.
 - Linux: not implemented in this release. `aerial service install|start|stop|restart|uninstall` throws an unsupported-platform error and exits 1; `aerial service status --json` still emits a schema-valid document with `"supported": false` and exits 1. Run `aerial start` directly or wrap it in your own init system.
 
-Both wrappers do the same three things before exec-ing the proxy: (1) startup-rotate the captured stdio log (`aerial-stdio.log` → `.1` → `.2` → `.3`) if it has grown beyond the configured cap; (2) export `AERIAL_LOG_FILE=<config-dir>/logs/aerial.log`, plus `AERIAL_LOG_MAX_BYTES` and `AERIAL_LOG_BACKUPS` (default `5242880` / `3`, or whatever value was present in the installer's environment — see below), and — when `AERIAL_CONFIG_DIR` was set at install time — re-export `AERIAL_CONFIG_DIR` so the service sees the same config root as the installer; (3) `exec` `node src/cli.js start --host <host> --port <port>` with stdout and stderr appended to `aerial-stdio.log`. The service wrapper prefers a Node.js 24+ binary; on macOS, if the installer is running under an older Node and Codex's bundled Node 24+ exists at `/Applications/Codex.app/Contents/Resources/node`, Aerial uses that for the generated wrapper. Set `AERIAL_SERVICE_NODE` before `aerial service install` to override this selection explicitly. The structured event log is opt-in via `AERIAL_LOG_FILE`: when this env var is set (always set by the wrapper, never by foreground `aerial start`), structured events go to that file only; when unset, they go to stderr only. There is no double-write.
+Both wrappers do the same three things before exec-ing the proxy: (1) startup-rotate the captured stdio log (`aerial-stdio.log` → `.1` → `.2` → `.3`) if it has grown beyond the configured cap; (2) export `AERIAL_LOG_FILE=<config-dir>/logs/aerial.log`, plus `AERIAL_LOG_MAX_BYTES` and `AERIAL_LOG_BACKUPS` (default `5242880` / `3`, or whatever value was present in the installer's environment — see below), and — when `AERIAL_CONFIG_DIR` was set at install time — re-export `AERIAL_CONFIG_DIR` so the service sees the same config root as the installer; (3) `exec` `node src/cli/index.js start --host <host> --port <port>` with stdout and stderr appended to `aerial-stdio.log`. By default, the service wrapper uses the same Node.js binary that ran `aerial service install`. Set `AERIAL_SERVICE_NODE` before `aerial service install` to override this explicitly, for example when installing from one Node binary but running the service with another. The structured event log is opt-in via `AERIAL_LOG_FILE`: when this env var is set (always set by the wrapper, never by foreground `aerial start`), structured events go to that file only; when unset, they go to stderr only. There is no double-write.
 
 Wrapper env values are baked in at install time. If you set `AERIAL_LOG_MAX_BYTES` and/or `AERIAL_LOG_BACKUPS` in the shell before running `aerial service install`, the generated wrapper hard-codes those values and the next start of the service inherits them. Changing the env in another shell after install has no effect on the already-installed wrapper. To apply new values to an already-managed service, rerun `aerial service install` (which always regenerates the definition, including the wrapper) and then `aerial service restart` to swap the running process onto the regenerated wrapper.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jiayunxie/aerial",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Local GitHub Copilot proxy for Codex CLI and Claude Code with smart HTTP(S)/SOCKS5 upstream proxy support.",
   "type": "module",
   "private": false,
@@ -29,16 +29,16 @@
     "LICENSE"
   ],
   "bin": {
-    "aerial": "src/cli.js"
+    "aerial": "src/cli/index.js"
   },
   "scripts": {
-    "start": "node src/cli.js start",
-    "doctor": "node src/cli.js doctor",
+    "start": "node src/cli/index.js start",
+    "doctor": "node src/cli/index.js doctor",
     "test": "node --test",
     "prepublishOnly": "npm test"
   },
   "engines": {
-    "node": ">=24"
+    "node": ">=20.18.1"
   },
   "license": "MIT",
   "publishConfig": {

package/src/cli/args.js

@@ -0,0 +1,28 @@
+export function argValue(args, name) {
+  const index = args.indexOf(name);
+  return index >= 0 ? args[index + 1] : undefined;
+}
+
+export function requiredArgValue(args, name) {
+  const index = args.indexOf(name);
+  if (index < 0) return undefined;
+  const value = args[index + 1];
+  if (value === undefined || value.startsWith("--")) {
+    throw new Error(`${name} requires a value.`);
+  }
+  return value;
+}
+
+export function parseConfigPort(value) {
+  const text = String(value).trim();
+  if (!/^\d+$/.test(text)) throw new Error("port must be an integer between 1 and 65535");
+  const port = Number(text);
+  if (port < 1 || port > 65535) throw new Error("port must be an integer between 1 and 65535");
+  return port;
+}
+
+export function parseConfigHost(value) {
+  const host = String(value).trim().toLowerCase();
+  if (host === "127.0.0.1" || host === "localhost" || host === "::1") return host;
+  throw new Error("host must be a loopback address: 127.0.0.1, localhost, or ::1");
+}

package/src/cli/config-command.js

@@ -0,0 +1,39 @@
+import { defaultConfig, loadConfig, saveConfig } from "../shared/config.js";
+import { configPath } from "../shared/paths.js";
+import { assertValidEffort } from "../shared/effort.js";
+import { parseConfigHost, parseConfigPort } from "./args.js";
+
+export function runConfigCli(subcommand, rest) {
+  if (subcommand === "reset") {
+    saveConfig(defaultConfig());
+    console.log(`Reset Aerial config: ${configPath()}`);
+    return;
+  }
+  const config = loadConfig();
+  if (subcommand === "set") {
+    const [key, value] = rest;
+    if (!key || value === undefined) throw new Error("Usage: aerial config set <key> <value>");
+    if (!["host", "port", "defaultModel", "defaultEffort", "logLevel", "promptCacheRetention", "promptCacheKey"].includes(key)) throw new Error(`Unsupported config key: ${key}`);
+    if (key === "promptCacheRetention" && !["in_memory", "24h", "off"].includes(value)) throw new Error("promptCacheRetention must be one of: in_memory, 24h, off");
+    if (key === "promptCacheKey" && !value.trim()) throw new Error("promptCacheKey must be auto, off, or a non-empty string");
+    if (key === "host") {
+      config.host = parseConfigHost(value);
+      saveConfig(config);
+      return;
+    }
+    if (key === "port") {
+      config.port = parseConfigPort(value);
+      saveConfig(config);
+      return;
+    }
+    if (key === "defaultEffort") {
+      config.defaultEffort = assertValidEffort(value);
+      saveConfig(config);
+      return;
+    }
+    config[key] = value;
+    saveConfig(config);
+    return;
+  }
+  console.log(JSON.stringify(config, null, 2));
+}

package/src/cli/disable-command.js

@@ -0,0 +1,28 @@
+import { restoreAllClients } from "../setup/index.js";
+import { serviceUninstall } from "../service/index.js";
+import { printRestoreResults } from "./output.js";
+import { printServiceUninstallResult } from "./service-command.js";
+
+export function runDisableCli() {
+  const { ok: restoreOk, results } = restoreAllClients();
+  printRestoreResults(results);
+  if (!restoreOk) {
+    console.log("service uninstall: skipped because client restore reported failures; resolve restore errors then rerun `aerial disable` or `aerial service uninstall`.");
+    process.exitCode = 1;
+    return;
+  }
+  try {
+    const r = serviceUninstall();
+    printServiceUninstallResult(r, { prefix: "service uninstall" });
+    process.exitCode = r.ok ? 0 : 1;
+  } catch (err) {
+    if (/unsupported platform/.test(err.message)) {
+      console.log(`service uninstall: skipped (${err.message})`);
+      process.exitCode = 0;
+    } else {
+      console.log(`service uninstall: FAILED (${err.message})`);
+      console.log(`  Retry with: aerial service uninstall`);
+      process.exitCode = 1;
+    }
+  }
+}

package/src/{doctor.js → cli/doctor.js}

@@ -1,7 +1,7 @@
-import { setupStatus } from "./setup.js";
-import { serviceStatus } from "./service.js";
+import { setupStatus } from "../setup/index.js";
+import { serviceStatus } from "../service/index.js";
 import { computeAppStatus } from "./app-status.js";
-import { readConfigFileStatus } from "./config.js";
+import { readConfigFileStatus } from "../shared/config.js";
 
 const REPAIRS = Object.freeze({
   CONFIG_RESET: Object.freeze({ command: "aerial", args: ["config", "reset"] }),

package/src/cli/help.js

@@ -0,0 +1,23 @@
+export function printHelp() {
+  console.log(`Aerial local Copilot proxy
+
+Usage:
+  aerial --version
+  aerial login
+  aerial setup codex [--model <id>] [--effort <low|medium|high|xhigh|max>]
+  aerial setup claude [--model <id>] [--effort <low|medium|high|xhigh|max>]
+  aerial service install
+  aerial status [--json]
+  aerial proxy status|enable|disable [--json]
+
+Diagnostics and rollback:
+  aerial setup status [--json]
+  aerial setup restore <codex|claude|all> --latest
+  aerial service status [--json]
+  aerial disable
+  aerial doctor
+  aerial probe [--live] [--json]
+
+Debug:
+  aerial start [--host 127.0.0.1] [--port 18181]`);
+}

package/src/cli/index.js

@@ -0,0 +1,92 @@
+#!/usr/bin/env node
+import { printVersion } from "./version.js";
+import { printHelp } from "./help.js";
+import { appStatus } from "./status-command.js";
+import { runConfigCli } from "./config-command.js";
+import { runDisableCli } from "./disable-command.js";
+import { runKeyCli } from "./key-command.js";
+import { runLoginCli } from "./login-command.js";
+import { runProxyCli } from "./proxy-command.js";
+import { runServiceCli } from "./service-command.js";
+import { runSetupCli } from "./setup-command.js";
+import { runStartCli } from "./start-command.js";
+import { doctor, renderDoctorText } from "./doctor.js";
+import { formatProbeReport, runProbe } from "./probe.js";
+
+async function main() {
+  const args = process.argv.slice(2);
+  const [command, subcommand, ...rest] = args;
+  if (!command || command === "--help" || command === "-h") return printHelp();
+  if (command === "--version") return printVersion();
+
+  if (command === "status") {
+    const status = await appStatus({ json: args.includes("--json") });
+    process.exitCode = status.ok ? 0 : 1;
+    return;
+  }
+
+  if (command === "proxy") {
+    await runProxyCli(subcommand, rest);
+    return;
+  }
+
+  if (command === "login") {
+    await runLoginCli(args.slice(1));
+    return;
+  }
+
+  if (command === "key") {
+    if (runKeyCli(subcommand)) return;
+  }
+
+  if (command === "start") {
+    runStartCli(args);
+    return;
+  }
+
+  if (command === "setup") {
+    if (["codex", "claude", "all", "status", "restore"].includes(subcommand)) {
+      await runSetupCli(subcommand, rest);
+      return;
+    }
+  }
+
+  if (command === "disable") {
+    runDisableCli();
+    return;
+  }
+
+  if (command === "service") {
+    await runServiceCli(subcommand, rest);
+    return;
+  }
+
+  if (command === "doctor") {
+    const report = await doctor();
+    if (args.includes("--json")) console.log(JSON.stringify(report, null, 2));
+    else console.log(renderDoctorText(report));
+    process.exitCode = report.ok ? 0 : 1;
+    return;
+  }
+
+  if (command === "probe") {
+    const report = await runProbe({ live: args.includes("--live") });
+    if (args.includes("--json")) console.log(JSON.stringify(report, null, 2));
+    else console.log(formatProbeReport(report));
+    process.exitCode = report.ok ? 0 : 1;
+    return;
+  }
+
+  if (command === "config") {
+    runConfigCli(subcommand, rest);
+    return;
+  }
+
+  printHelp();
+  process.exitCode = 1;
+}
+
+main().catch((error) => {
+  console.error(error.message);
+  process.exitCode = 1;
+});

package/src/cli/key-command.js

@@ -0,0 +1,20 @@
+import { ensureApiKey } from "../shared/config.js";
+
+export function runKeyCli(subcommand) {
+  if (subcommand === "generate") {
+    const result = ensureApiKey();
+    if (result.apiKey) {
+      console.log("Local Aerial key generated and stored privately.");
+    } else {
+      console.log("Aerial API key already configured.");
+    }
+    return true;
+  }
+  if (subcommand === "print") {
+    const result = ensureApiKey();
+    if (result.apiKey) console.log(result.apiKey);
+    else throw new Error("Raw API key is not available. Run: aerial key generate");
+    return true;
+  }
+  return false;
+}

package/src/cli/login-command.js

@@ -0,0 +1,28 @@
+import { gitHubTokenSource, pollDeviceFlow, startDeviceFlow } from "../shared/auth.js";
+
+export async function runLoginCli(args) {
+  const force = args.includes("--force");
+  const source = gitHubTokenSource();
+  if (force && source === "env") {
+    console.error("AERIAL_GITHUB_TOKEN is set; unset it before running `aerial login --force`, otherwise the env value will continue to shadow any new file token.");
+    process.exit(1);
+  }
+  if (!force && source === "env") {
+    console.log("GitHub login is provided by AERIAL_GITHUB_TOKEN (not verified). To use a different account, unset it or run with a different environment.");
+    return;
+  }
+  if (!force && source === "file") {
+    console.log("GitHub login already exists (not verified). To sign in again, run aerial login --force.");
+    return;
+  }
+  if (process.env.AERIAL_TEST_LOGIN_NO_NETWORK === "1") {
+    console.log("AERIAL_TEST_LOGIN_NO_NETWORK=1 set; skipping GitHub device flow (test mode).");
+    return;
+  }
+  const flow = await startDeviceFlow();
+  console.log(`Open: ${flow.verification_uri}`);
+  console.log(`Code: ${flow.user_code}`);
+  console.log("Waiting for GitHub authorization...");
+  await pollDeviceFlow(flow.device_code, flow.interval);
+  console.log("GitHub login saved.");
+}

package/src/{model-selection.js → cli/model-selection.js}

@@ -1,15 +1,15 @@
 import { createInterface } from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
-import { proxyModels } from "./copilot.js";
-import { readJsonSafely } from "./http-utils.js";
-import { modelsForRoute } from "./model-utils.js";
-import { parseNumberChoice } from "./prompt-utils.js";
+import { proxyModels } from "../proxy/index.js";
+import { readJsonSafely } from "../shared/http-utils.js";
+import { modelsForRoute } from "../proxy/model-utils.js";
+import { parseNumberChoice } from "../shared/prompt-utils.js";
 
 const MAX_LISTED_MODELS = 20;
 const GPT_VERSION_RE = /^gpt-(\d+)(?:\.(\d+))?/i;
 const STABLE_GPT_RE = /^gpt-\d+(?:\.\d+)?$/i;
 
-export { modelsForRoute } from "./model-utils.js";
+export { modelsForRoute } from "../proxy/model-utils.js";
 
 function gptVersionScore(id) {
   const match = GPT_VERSION_RE.exec(id);

package/src/cli/output.js

@@ -0,0 +1,75 @@
+export function printSetupCompletionSummary({ heading, cli, model, effort, proxy, configFile, aerialConfigFile, aerialDefaultEffort, backup, auth, notes = [] }) {
+  console.log(heading);
+  console.log(`  cli: ${cli}`);
+  console.log(`  model: ${model}`);
+  console.log(`  effort: ${effort}`);
+  console.log(`  proxy: ${proxy}`);
+  console.log(`  client config: ${configFile}`);
+  console.log(`  aerial config: ${aerialConfigFile}`);
+  console.log(`  aerial defaultEffort: ${aerialDefaultEffort}`);
+  console.log(`  backup: ${backup || "none"}`);
+  console.log(`  auth: ${auth}`);
+  for (const note of notes) console.log(`  note: ${note}`);
+}
+
+export function printSetupSummary(status) {
+  console.log("clients:");
+  for (const client of Object.values(status.clients)) {
+    const model = client.model ? ` model=${client.model}` : "";
+    const effort = ` effort=${client.effort || "missing"}`;
+    console.log(`  ${client.target}: ${client.state}${model}${effort}`);
+  }
+  console.log(`api key: ${status.auth.api_key.exists ? "present" : "missing"}`);
+  const ghSource = status.auth.github_token.source;
+  const ghText = ghSource === "missing" ? "missing" : `present (${ghSource})`;
+  console.log(`github login: ${ghText}`);
+}
+
+export function printServiceSummary(status) {
+  console.log(`service: ${status.summary}`);
+  if (status.supported === false) {
+    console.log(`platform: ${status.platform} (service unsupported)`);
+    return;
+  }
+  const health = status.health?.aerial ? `ok (${status.health.supervisor})`
+    : status.health?.portConflict ? `port conflict (${status.health.conflictReason})`
+    : status.health?.ok ? "ok"
+    : `unreachable (${status.health?.error || `http ${status.health?.status}`})`;
+  console.log(`health: ${health}`);
+}
+
+export function printRestoreResults(results) {
+  for (const r of Object.values(results)) {
+    if (r.restored) {
+      console.log(`Restored ${r.target}: ${r.file} <- ${r.from}`);
+      if (r.snapshot) console.log(`  pre-restore snapshot: ${r.snapshot}`);
+    } else if (r.reason === "no_backup") {
+      console.log(`Restored ${r.target}: no backup to restore`);
+    } else if (r.error) {
+      console.log(`Restored ${r.target}: FAILED  ${r.error}`);
+    }
+  }
+}
+
+export function printServiceDiagnostics(diagnostics) {
+  if (!diagnostics) return;
+  if (diagnostics.stdioLog) console.log(`  stdio log: ${diagnostics.stdioLog}`);
+  if (diagnostics.aerialLog) console.log(`  aerial log: ${diagnostics.aerialLog}`);
+  if (diagnostics.wrapperNode) console.log(`  wrapper node: ${diagnostics.wrapperNode}`);
+  if (diagnostics.health) {
+    const h = diagnostics.health;
+    const tail = h.lastError ? `, last error: ${h.lastError}` : (h.lastStatus !== undefined ? `, last status: ${h.lastStatus}` : "");
+    console.log(`  health probe: ${h.attempts} attempts over ${h.elapsedMs}ms${tail}`);
+  }
+  console.log("  Run: aerial service status --json");
+}
+
+export function printServiceWarning(result) {
+  if (result.warning) console.log(`  WARNING: ${result.warning.message}`);
+}
+
+export function formatEgress(egress) {
+  if (!egress?.ok) return `unavailable (${egress?.error || "unknown"})`;
+  const place = [egress.city, egress.region, egress.country].filter(Boolean).join(", ");
+  return [egress.ip, place].filter(Boolean).join("  ");
+}

package/src/{probe.js → cli/probe.js}

@@ -1,6 +1,6 @@
-import { proxyChatCompletions, proxyMessages, proxyModels, proxyResponses } from "./copilot.js";
-import { readJsonSafely } from "./http-utils.js";
-import { aerialRoutes, usageSummary } from "./model-utils.js";
+import { proxyChatCompletions, proxyMessages, proxyModels, proxyResponses } from "../proxy/index.js";
+import { readJsonSafely } from "../shared/http-utils.js";
+import { aerialRoutes, usageSummary } from "../proxy/model-utils.js";
 
 function modelRoutes(model) {
   return aerialRoutes(model);

package/src/cli/proxy-command.js

@@ -0,0 +1,120 @@
+import { loadConfig } from "../shared/config.js";
+import { disableUpstreamProxy, enableUpstreamProxy, probeEgress, upstreamProxyState } from "../upstream/fetch.js";
+import { redactProxyEndpoint, redactProxySource } from "../upstream/proxy-config.js";
+import { runProbe } from "./probe.js";
+import { formatEgress } from "./output.js";
+
+async function proxyRouteSummary() {
+  try {
+    const report = await runProbe();
+    if (!report.ok) return { ok: false, error: JSON.stringify(report.error) };
+    return {
+      ok: true,
+      models: report.models.length,
+      responses: report.summary.responses,
+      responsesWebSocket: report.summary.websocketResponses,
+      messages: report.summary.messages,
+      chat: report.summary.chat
+    };
+  } catch (err) {
+    return { ok: false, error: err.message };
+  }
+}
+
+async function proxyStatus({ includeRoutes = true } = {}) {
+  const state = upstreamProxyState(loadConfig());
+  const egress = await probeEgress({ endpoint: state.endpoint });
+  return {
+    schema: "aerial.proxy-status.v1",
+    mode: state.mode,
+    enabled: state.enabled,
+    endpoint: state.endpoint,
+    source: state.source,
+    egress,
+    routes: includeRoutes ? await proxyRouteSummary() : undefined
+  };
+}
+
+function publicProxyCandidate(candidate) {
+  if (!candidate || typeof candidate !== "object") return candidate;
+  return {
+    ...candidate,
+    endpoint: redactProxyEndpoint(candidate.endpoint),
+    source: redactProxySource(candidate.source)
+  };
+}
+
+function publicProxyStatus(status) {
+  if (!status || typeof status !== "object") return status;
+  return {
+    ...status,
+    endpoint: redactProxyEndpoint(status.endpoint),
+    source: redactProxySource(status.source)
+  };
+}
+
+function publicProxyEnableResult(result) {
+  if (!result || typeof result !== "object") return result;
+  return {
+    ...result,
+    selected: publicProxyCandidate(result.selected),
+    candidates: Array.isArray(result.candidates) ? result.candidates.map(publicProxyCandidate) : result.candidates,
+    status: publicProxyStatus(result.status)
+  };
+}
+
+function printProxyStatus(status) {
+  const safeStatus = publicProxyStatus(status);
+  console.log(`proxy: ${status.enabled ? `enabled (${status.mode})` : "disabled"}`);
+  console.log(`endpoint: ${status.enabled ? `${safeStatus.endpoint} (${safeStatus.source})` : "direct"}`);
+  console.log(`egress: ${formatEgress(status.egress)}`);
+  if (status.routes) {
+    if (status.routes.ok) {
+      console.log(`copilot routes: responses=${status.routes.responses}, responsesWebSocket=${status.routes.responsesWebSocket}, messages=${status.routes.messages}, chat=${status.routes.chat}`);
+    } else {
+      console.log(`copilot routes: unavailable (${status.routes.error})`);
+    }
+  }
+}
+
+export async function runProxyCli(subcommand, rest) {
+  const json = rest.includes("--json") || subcommand === "--json";
+  if (!subcommand || subcommand === "status" || subcommand === "--json") {
+    const status = await proxyStatus();
+    if (json) console.log(JSON.stringify(publicProxyStatus(status), null, 2));
+    else printProxyStatus(status);
+    return;
+  }
+  if (subcommand === "enable") {
+    const result = await enableUpstreamProxy();
+    if (!result.ok) {
+      if (json) console.log(JSON.stringify(publicProxyEnableResult(result), null, 2));
+      else {
+        console.error(`Proxy enable failed: ${result.error}`);
+        if (result.candidates?.length) {
+          console.error(`Checked: ${result.candidates.map((c) => redactProxyEndpoint(c.endpoint)).join(", ")}`);
+        }
+      }
+      process.exitCode = 1;
+      return;
+    }
+    const status = await proxyStatus();
+    if (json) console.log(JSON.stringify(publicProxyEnableResult({ ...result, status }), null, 2));
+    else {
+      console.log(`Proxy enabled: ${redactProxyEndpoint(result.selected.endpoint)} (${redactProxySource(result.selected.source)})`);
+      printProxyStatus(status);
+    }
+    return;
+  }
+  if (subcommand === "disable") {
+    disableUpstreamProxy();
+    const status = await proxyStatus();
+    if (json) console.log(JSON.stringify(publicProxyStatus(status), null, 2));
+    else {
+      console.log("Proxy disabled.");
+      printProxyStatus(status);
+    }
+    return;
+  }
+  throw new Error("Usage: aerial proxy status|enable|disable [--json]");
+}

package/src/cli/runtime-auth.js

@@ -0,0 +1,21 @@
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const CLI_ENTRY = path.join(path.dirname(fileURLToPath(import.meta.url)), "index.js");
+
+export function codexAuthCommand() {
+  return {
+    command: process.execPath,
+    args: [CLI_ENTRY, "key", "print"],
+    timeout_ms: 5000,
+    refresh_interval_ms: 0
+  };
+}
+
+function quoteCommandPart(value) {
+  return `"${String(value).replace(/"/g, '\\"')}"`;
+}
+
+export function claudeApiKeyHelper() {
+  return [process.execPath, CLI_ENTRY, "key", "print"].map(quoteCommandPart).join(" ");
+}