@rynfar/meridian 1.41.1 → 1.42.1

package/dist/{cli-vdp9s10c.js → cli-cx463q74.js}

@@ -86,6 +86,14 @@ function resolveProfile(profiles, defaultProfile, requestedId) {
   return buildResolvedProfile(profile);
 }
 function buildResolvedProfile(profile) {
+  if (profile.oauthToken || profile.type === "oauth-token") {
+    const env2 = {};
+    if (profile.oauthToken) {
+      env2.CLAUDE_CODE_OAUTH_TOKEN = profile.oauthToken;
+      env2.CLAUDE_CONFIG_DIR = join(homedir(), ".config", "meridian", "profiles", profile.id);
+    }
+    return { id: profile.id, type: "oauth-token", env: env2 };
+  }
   const type = profile.type ?? "claude-max";
   if (type === "api") {
     const env2 = {};

package/dist/cli.js

@@ -1,20 +1,23 @@
 #!/usr/bin/env node
 import {
   startProxyServer
-} from "./cli-51a9sav0.js";
-import"./cli-vdp9s10c.js";
+} from "./cli-8xzxm1cq.js";
+import"./cli-cx463q74.js";
 import"./cli-sry5aqdj.js";
 import"./cli-4rqtm83g.js";
+import {
+  resolveClaudeExecutableAsync
+} from "./cli-3jqvrake.js";
 import"./cli-340h1chz.js";
 import"./cli-rtab0qa6.js";
-import"./cli-e289rj3k.js";
+import"./cli-7k1fcprd.js";
 import {
   __require
 } from "./cli-p9swy5t3.js";
 
 // bin/cli.ts
 import { createRequire } from "module";
-import { exec as execCallback } from "child_process";
+import { exec as execCallback, execFile as execFileCallback } from "child_process";
 import { promisify } from "util";
 var require2 = createRequire(import.meta.url);
 var { version } = require2("../package.json");
@@ -50,12 +53,18 @@ See https://github.com/rynfar/meridian for full documentation.`);
   process.exit(0);
 }
 if (args[0] === "profile") {
-  const { profileAdd, profileList, profileRemove, profileSwitch, profileLogin, profileHelp } = await import("./profileCli-5f15dx7k.js");
+  const { profileAdd, profileAddOauthToken, profileList, profileRemove, profileSwitch, profileLogin, profileHelp } = await import("./profileCli-c7cvkv5q.js");
   const subcommand = args[1];
   const profileId = args[2];
-  if (subcommand === "add" && profileId)
-    profileAdd(profileId);
-  else if (subcommand === "list" || subcommand === "ls")
+  if (subcommand === "add" && profileId) {
+    const oauthFlagIdx = args.indexOf("--oauth-token", 3);
+    if (oauthFlagIdx >= 0) {
+      const tokenArg = args[oauthFlagIdx + 1];
+      await profileAddOauthToken(profileId, tokenArg);
+    } else {
+      profileAdd(profileId);
+    }
+  } else if (subcommand === "list" || subcommand === "ls")
     profileList();
   else if (subcommand === "remove" && profileId)
     profileRemove(profileId);
@@ -89,7 +98,7 @@ Restart OpenCode for the plugin to take effect.`);
   process.exit(0);
 }
 if (args[0] === "refresh-token") {
-  const { refreshOAuthToken } = await import("./tokenRefresh-psq94r54.js");
+  const { refreshOAuthToken } = await import("./tokenRefresh-swetnf89.js");
   const success = await refreshOAuthToken();
   if (success) {
     console.log("Token refreshed successfully");
@@ -100,6 +109,7 @@ if (args[0] === "refresh-token") {
   }
 }
 var exec = promisify(execCallback);
+var execFile = promisify(execFileCallback);
 process.on("uncaughtException", (err) => {
   console.error(`[PROXY] Uncaught exception (recovered): ${err.message}`);
 });
@@ -120,7 +130,10 @@ try {
 } catch (e) {
   console.error(`[meridian] Failed to parse MERIDIAN_PROFILES: ${e instanceof Error ? e.message : e}`);
 }
-async function runCli(start = startProxyServer, runExec = exec) {
+async function runCli(start = startProxyServer, runAuthCheck = async () => {
+  const claudePath = await resolveClaudeExecutableAsync();
+  return execFile(claudePath, ["auth", "status"], { timeout: 5000 });
+}) {
   try {
     const { findOpencodeConfigPath, checkPluginConfigured, findPluginPath } = await import("./setup-v5pnqe04.js");
     const configPath = findOpencodeConfigPath();
@@ -134,7 +147,7 @@ async function runCli(start = startProxyServer, runExec = exec) {
     }
   } catch {}
   try {
-    const { stdout } = await runExec("claude auth status", { timeout: 5000 });
+    const { stdout } = await runAuthCheck();
     const auth = JSON.parse(stdout);
     if (!auth.loggedIn) {
       console.error("\x1B[31m✗ Not logged in to Claude.\x1B[0m Run: claude login");
@@ -147,7 +160,7 @@ async function runCli(start = startProxyServer, runExec = exec) {
     console.error("\x1B[33m⚠ Could not verify Claude auth status. If requests fail, run: claude login\x1B[0m");
   }
   if (!profiles) {
-    const { enableDiskProfileDiscovery } = await import("./profiles-edzz1ffd.js");
+    const { enableDiskProfileDiscovery } = await import("./profiles-rdd84b45.js");
     enableDiskProfileDiscovery();
   }
   const proxy = await start({ port, host, idleTimeoutSeconds, profiles, defaultProfile, version });

package/dist/{profileCli-5f15dx7k.js → profileCli-c7cvkv5q.js}

@@ -1,3 +1,6 @@
+import {
+  resolveClaudeExecutableSync
+} from "./cli-3jqvrake.js";
 import {
   setSetting
 } from "./cli-340h1chz.js";
@@ -6,7 +9,7 @@ import"./cli-p9swy5t3.js";
 // src/proxy/profileCli.ts
 import { mkdirSync, existsSync, rmSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { execSync, spawnSync } from "node:child_process";
+import { execFileSync, spawnSync } from "node:child_process";
 import { homedir } from "node:os";
 var PROFILES_DIR = join(homedir(), ".config", "meridian", "profiles");
 var CONFIG_FILE = join(homedir(), ".config", "meridian", "profiles.json");
@@ -32,8 +35,13 @@ function saveProfileConfig(profiles) {
 `, { mode: 384 });
 }
 function getAuthStatus(configDir) {
+  const resolved = resolveClaudeExecutableSync();
+  if (!resolved) {
+    console.warn(`[meridian] Could not resolve a Claude executable for auth check (set MERIDIAN_CLAUDE_PATH or install @anthropic-ai/claude-code)`);
+    return { loggedIn: false };
+  }
   try {
-    const result = execSync("claude auth status", {
+    const result = execFileSync(resolved.path, ["auth", "status"], {
       timeout: 5000,
       env: { ...process.env, CLAUDE_CONFIG_DIR: configDir },
       stdio: ["pipe", "pipe", "pipe"]
@@ -97,7 +105,13 @@ function profileAdd(id) {
   console.log();
   console.log("  Press Ctrl+C to cancel, or wait for the browser to open...");
   console.log();
-  const result = spawnSync("claude", ["auth", "login"], {
+  const resolvedAuth = resolveClaudeExecutableSync();
+  if (!resolvedAuth) {
+    console.error("\x1B[31m✗ Could not find a Claude executable to run auth login.\x1B[0m");
+    console.error("  Install via: npm install -g @anthropic-ai/claude-code, or set MERIDIAN_CLAUDE_PATH=/path/to/claude");
+    process.exit(1);
+  }
+  const result = spawnSync(resolvedAuth.path, ["auth", "login"], {
     env: { ...process.env, CLAUDE_CONFIG_DIR: configDir },
     stdio: "inherit"
   });
@@ -116,6 +130,33 @@ function profileAdd(id) {
   saveProfileConfig(profiles);
   printEnvHint(profiles);
 }
+async function profileAddOauthToken(id, tokenArg) {
+  if (!id || /[^a-zA-Z0-9_-]/.test(id)) {
+    console.error("\x1B[31m✗ Invalid profile ID.\x1B[0m Use only letters, numbers, hyphens, underscores.");
+    process.exit(1);
+  }
+  const profiles = loadProfileConfig();
+  if (profiles.find((p) => p.id === id)) {
+    console.error(`\x1B[31m✗ Profile "${id}" already exists.\x1B[0m`);
+    console.error(`  Run: meridian profile list`);
+    process.exit(1);
+  }
+  let token = tokenArg?.trim() ?? "";
+  if (!token) {
+    console.log(`\x1B[36mAdding profile: ${id} (OAuth token)\x1B[0m`);
+    console.log(`  Generate a token with: \x1B[1mclaude setup-token\x1B[0m`);
+    console.log();
+    token = promptToken(`Paste OAuth token for "${id}" (input hidden):`);
+  }
+  if (!token) {
+    console.error("\x1B[31m✗ Empty token. Aborted.\x1B[0m");
+    process.exit(1);
+  }
+  profiles.push({ id, type: "oauth-token", oauthToken: token });
+  saveProfileConfig(profiles);
+  console.log(`\x1B[32m✓ Profile "${id}" added (OAuth token).\x1B[0m`);
+  printEnvHint(profiles);
+}
 function profileList() {
   const profiles = loadProfileConfig();
   if (profiles.length === 0) {
@@ -126,6 +167,10 @@ function profileList() {
   console.log(`Profiles:
 `);
   for (const p of profiles) {
+    if (p.oauthToken || p.type === "oauth-token") {
+      console.log(`  ${p.id.padEnd(20)} \x1B[32m✓ OAuth token\x1B[0m`);
+      continue;
+    }
     const auth = getAuthStatus(p.claudeConfigDir ?? "");
     const status = auth.loggedIn ? `\x1B[32m✓ ${auth.email} (${auth.subscriptionType || "unknown"})\x1B[0m` : "\x1B[31m✗ not logged in\x1B[0m";
     console.log(`  ${p.id.padEnd(20)} ${status}`);
@@ -133,6 +178,18 @@ function profileList() {
   console.log();
   printEnvHint(profiles);
 }
+function dirsToRemoveOnProfileRemove(profile, profilesDir) {
+  const dirs = [];
+  if (profile.claudeConfigDir && profile.claudeConfigDir.startsWith(profilesDir)) {
+    dirs.push(profile.claudeConfigDir);
+  }
+  if (profile.oauthToken || profile.type === "oauth-token") {
+    const isolationDir = join(profilesDir, profile.id);
+    if (!dirs.includes(isolationDir))
+      dirs.push(isolationDir);
+  }
+  return dirs;
+}
 function profileRemove(id) {
   const profiles = loadProfileConfig();
   const idx = profiles.findIndex((p) => p.id === id);
@@ -140,11 +197,13 @@ function profileRemove(id) {
     console.error(`\x1B[31m✗ Profile "${id}" not found.\x1B[0m`);
     process.exit(1);
   }
-  const configDir = profiles[idx].claudeConfigDir ?? "";
+  const removed = profiles[idx];
+  const dirsToRemove = dirsToRemoveOnProfileRemove(removed, PROFILES_DIR);
   profiles.splice(idx, 1);
   saveProfileConfig(profiles);
-  if (configDir && existsSync(configDir) && configDir.startsWith(PROFILES_DIR)) {
-    rmSync(configDir, { recursive: true, force: true });
+  for (const dir of dirsToRemove) {
+    if (existsSync(dir))
+      rmSync(dir, { recursive: true, force: true });
   }
   console.log(`\x1B[32m✓ Profile "${id}" removed.\x1B[0m`);
   if (profiles.length > 0) {
@@ -181,11 +240,22 @@ function profileLogin(id) {
     console.error(`\x1B[31m✗ Profile "${id}" not found.\x1B[0m Run: meridian profile add ${id}`);
     process.exit(1);
   }
+  if (profile.oauthToken || profile.type === "oauth-token") {
+    console.error(`\x1B[31m✗ Profile "${id}" uses an OAuth token; \`claude auth login\` does not apply.\x1B[0m`);
+    console.error(`  To replace the token: meridian profile remove ${id} && meridian profile add ${id} --oauth-token`);
+    process.exit(1);
+  }
   console.log(`\x1B[36mRe-authenticating profile: ${id}\x1B[0m`);
   console.log();
   console.log("\x1B[33m⚠ Make sure you're signed into the correct Claude account in your browser.\x1B[0m");
   console.log();
-  const result = spawnSync("claude", ["auth", "login"], {
+  const resolvedLogin = resolveClaudeExecutableSync();
+  if (!resolvedLogin) {
+    console.error("\x1B[31m✗ Could not find a Claude executable to run auth login.\x1B[0m");
+    console.error("  Install via: npm install -g @anthropic-ai/claude-code, or set MERIDIAN_CLAUDE_PATH=/path/to/claude");
+    process.exit(1);
+  }
+  const result = spawnSync(resolvedLogin.path, ["auth", "login"], {
     env: { ...process.env, CLAUDE_CONFIG_DIR: profile.claudeConfigDir },
     stdio: "inherit"
   });
@@ -209,6 +279,41 @@ function promptYesNo(question) {
   const answer = (result.stdout?.toString().trim() ?? "").toLowerCase();
   return answer !== "n" && answer !== "no";
 }
+function promptToken(question) {
+  process.stderr.write(`${question}
+> `);
+  const script = [
+    `const stdin = process.stdin;`,
+    `if (!stdin.isTTY) {`,
+    `  let buf = "";`,
+    `  stdin.setEncoding("utf8");`,
+    `  stdin.on("data", (c) => { buf += c; });`,
+    `  stdin.on("end", () => { process.stdout.write(buf.split(/\\r?\\n/)[0] || ""); process.exit(0); });`,
+    `} else {`,
+    `  stdin.setRawMode(true); stdin.resume(); stdin.setEncoding("utf8");`,
+    `  let input = "";`,
+    `  stdin.on("data", (key) => {`,
+    `    if (key === "\\u0003") { process.stderr.write("\\n"); process.exit(1); }`,
+    `    else if (key === "\\r" || key === "\\n") {`,
+    `      stdin.setRawMode(false); process.stderr.write("\\n");`,
+    `      process.stdout.write(input); process.exit(0);`,
+    `    }`,
+    `    else if (key === "\\u007f" || key === "\\b") {`,
+    `      if (input.length > 0) input = input.slice(0, -1);`,
+    `    }`,
+    `    else { input += key; }`,
+    `  });`,
+    `}`
+  ].join(`
+`);
+  const result = spawnSync("node", ["-e", script], { stdio: ["inherit", "pipe", "inherit"] });
+  if (result.status !== 0) {
+    process.stderr.write(`
+`);
+    process.exit(1);
+  }
+  return (result.stdout?.toString() ?? "").trim();
+}
 function printEnvHint(_profiles) {
   console.log(`\x1B[90mConfig: ${CONFIG_FILE}\x1B[0m`);
   console.log("\x1B[90mProfiles are picked up automatically — no restart needed.\x1B[0m");
@@ -217,17 +322,22 @@ function profileHelp() {
   console.log(`meridian profile — manage Claude account profiles
 
 Commands:
-  meridian profile add <name>       Add a profile and authenticate
-  meridian profile list             List profiles and auth status
-  meridian profile remove <name>    Remove a profile
-  meridian profile switch <name>    Switch the active profile (requires running proxy)
-  meridian profile login <name>     Re-authenticate an existing profile
+  meridian profile add <name>                       Add a profile via browser login
+  meridian profile add <name> --oauth-token [TOKEN] Add a profile from a \`claude setup-token\` value
+                                                    (if TOKEN is omitted, you will be prompted; input is hidden)
+  meridian profile list                             List profiles and auth status
+  meridian profile remove <name>                    Remove a profile
+  meridian profile switch <name>                    Switch the active profile (requires running proxy)
+  meridian profile login <name>                     Re-authenticate an existing profile (claude-max only)
 
 Examples:
-  meridian profile add personal     # Add personal account
-  meridian profile add work         # Add work account
-  meridian profile switch work      # Switch to work account
-  meridian profile list             # Show all profiles`);
+  meridian profile add personal                     # Add personal account (browser login)
+  meridian profile add work                         # Add work account
+  meridian profile add ci --oauth-token             # Add headless CI profile (prompted, no echo)
+  meridian profile add ci --oauth-token sk-ant-oat01-...
+                                                    # Add headless CI profile (token from CLI argument)
+  meridian profile switch work                      # Switch to work account
+  meridian profile list                             # Show all profiles`);
 }
 export {
   profileSwitch,
@@ -235,5 +345,7 @@ export {
   profileLogin,
   profileList,
   profileHelp,
-  profileAdd
+  profileAddOauthToken,
+  profileAdd,
+  dirsToRemoveOnProfileRemove
 };

package/dist/{profiles-edzz1ffd.js → profiles-rdd84b45.js}

@@ -9,7 +9,7 @@ import {
   resolveProfile,
   restoreActiveProfile,
   setActiveProfile
-} from "./cli-vdp9s10c.js";
+} from "./cli-cx463q74.js";
 import"./cli-340h1chz.js";
 import"./cli-p9swy5t3.js";
 export {

package/dist/proxy/cwd.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Resolve the SDK subprocess `cwd:` option, falling back to a known-valid
+ * path on the proxy host when the resolved working directory doesn't exist.
+ *
+ * Background — issue #381:
+ *   When meridian runs on a remote machine (e.g. accessed over Tailscale)
+ *   and the client (OpenCode/Crush/etc.) runs on a different machine, the
+ *   adapter extracts the client's reported working directory and passes it
+ *   to the SDK as `cwd:`. That path doesn't exist on the proxy host, so
+ *   `child_process.spawn(claude, { cwd })` fails with ENOENT — which the
+ *   SDK then reports as the misleading "Claude Code native binary not
+ *   found at ..." error.
+ *
+ *   Falling back to the proxy's own `process.cwd()` lets the SDK spawn
+ *   succeed; `clientWorkingDirectory` is tracked separately (and emitted
+ *   into the model's context via buildCwdNote) so the model still hears
+ *   about the user's real working directory.
+ */
+export interface CwdResolution {
+    /** Path passed to the SDK as `cwd:`. Always exists on the proxy host. */
+    workingDirectory: string;
+    /**
+     * The originally-resolved path before existence validation. May not
+     * exist on the proxy host. Used as `clientWorkingDirectory` for
+     * fingerprint bucketing and the system-prompt cwdNote.
+     */
+    claimedWorkingDirectory: string;
+    /** True if `workingDirectory` differs from `claimedWorkingDirectory`. */
+    fellBack: boolean;
+}
+export interface ResolveCwdOpts {
+    /** MERIDIAN_WORKDIR / CLAUDE_PROXY_WORKDIR (highest precedence). */
+    envOverride: string | undefined;
+    /** Adapter's extracted client working directory. */
+    adapterCwd: string | undefined;
+    /** Last-resort fallback. Must exist; typically `process.cwd()`. */
+    fallback: string;
+    /** Injection point for tests. Defaults to `node:fs`'s existsSync. */
+    exists?: (path: string) => boolean;
+}
+export declare function resolveSdkWorkingDirectory(opts: ResolveCwdOpts): CwdResolution;
+//# sourceMappingURL=cwd.d.ts.map

package/dist/proxy/cwd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cwd.d.ts","sourceRoot":"","sources":["../../src/proxy/cwd.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,MAAM,WAAW,aAAa;IAC5B,yEAAyE;IACzE,gBAAgB,EAAE,MAAM,CAAA;IACxB;;;;OAIG;IACH,uBAAuB,EAAE,MAAM,CAAA;IAC/B,yEAAyE;IACzE,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;IAC/B,oDAAoD;IACpD,UAAU,EAAE,MAAM,GAAG,SAAS,CAAA;IAC9B,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAA;IAChB,qEAAqE;IACrE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAA;CACnC;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,cAAc,GAAG,aAAa,CAO9E"}

package/dist/proxy/errors.d.ts

@@ -15,10 +15,20 @@ export declare function classifyError(errMsg: string): ClassifiedError;
  * Detect errors caused by an expired or missing OAuth access token.
  * Triggers an inline token refresh + retry in server.ts.
  *
- * Two distinct messages from the Claude Code CLI:
- *   - "OAuth token has expired" — CLI sent the token, Anthropic API rejected it
- *   - "Not logged in"           — CLI checked expiresAt locally and refused to try
- * Both are resolved by refreshing the token.
+ * Patterns, in order of specificity:
+ *   - "OAuth token has expired" / "Not logged in" — CLI-emitted (subprocess
+ *     either got 401 with this wording from Anthropic or detected expiry
+ *     locally before sending).
+ *   - "invalid_token" / "token_expired" — RFC 6750 resource-server errors that
+ *     can appear in the API response body.
+ *   - "401" + ("authentication" | "unauthorized" | "invalid") — generic 401
+ *     wrapping. Anthropic's API does not always echo the CLI-specific wording,
+ *     so without this branch a stale access token returns a generic 401 to the
+ *     proxy and refresh-and-retry never fires (caller sees the 401).
+ *
+ * False positives only cost one OAuth round-trip — the refresh is single-shot
+ * per request (gated by `tokenRefreshed` in server.ts) and surfaces the
+ * original error if it doesn't help.
  */
 export declare function isExpiredTokenError(errMsg: string): boolean;
 /**

package/dist/proxy/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/proxy/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,CA+G7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAG3D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAO3D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAGxD;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAGjE;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,WAAW,GAAG,cAAc,GAAG,SAAS,GAAG,SAAS,CAAA;IAC5D,sDAAsD;IACtD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;wCAEoC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAuBD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,CAuCpE;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,CAAC,EAAE,cAAc,EACjB,GAAG,EAAE;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,GACA,MAAM,CAYR"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/proxy/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,CA+G7D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAM3D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAO3D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAGxD;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAGjE;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,WAAW,GAAG,cAAc,GAAG,SAAS,GAAG,SAAS,CAAA;IAC5D,sDAAsD;IACtD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;wCAEoC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAuBD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,CAuCpE;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,CAAC,EAAE,cAAc,EACjB,GAAG,EAAE;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,GACA,MAAM,CAYR"}

package/dist/proxy/models.d.ts

@@ -25,8 +25,12 @@ export declare const CANONICAL_HAIKU_MODEL = "claude-haiku-4-5";
  * Build the ANTHROPIC_DEFAULT_{TYPE}_MODEL env record to apply before the
  * inherited process env, so user-set shell values still win but unset
  * variables get Meridian's canonical pins.
+ *
+ * Accepts an optional `env` arg so unit tests can pass a synthetic env
+ * map instead of mutating process.env (which leaks between parallel
+ * test files).
  */
-export declare function resolveSdkModelDefaults(): Record<string, string>;
+export declare function resolveSdkModelDefaults(env?: NodeJS.ProcessEnv): Record<string, string>;
 export interface ClaudeAuthStatus {
     loggedIn?: boolean;
     subscriptionType?: string;
@@ -71,6 +75,18 @@ export declare function getAuthCacheInfo(profileId?: string): {
  * @param envOverrides - Optional env vars for per-profile auth (e.g. CLAUDE_CONFIG_DIR).
  */
 export declare function getClaudeAuthStatusAsync(profileId?: string, envOverrides?: Record<string, string>): Promise<ClaudeAuthStatus | null>;
+/**
+ * Tag identifying which resolver step produced the path. Surfaced at startup
+ * and in `/health` so users can self-diagnose "wrong claude got picked"
+ * without having to inspect their PATH manually (closes the diagnostic gap
+ * from #478, where a Bun-shimmed `claude` on PATH led to silent failures
+ * that looked indistinguishable from any other SDK error).
+ */
+export type ClaudeExecutableSource = "env" | "bundled" | "platform-package" | "path-lookup" | "legacy-cli-js";
+export interface ClaudeExecutableInfo {
+    path: string;
+    source: ClaudeExecutableSource;
+}
 /**
  * Resolve the Claude executable path asynchronously (non-blocking).
  *
@@ -102,11 +118,48 @@ type ResolverDeps = {
     isBun: boolean;
 };
 /**
- * Pure resolver — runs each step and returns the first hit, or null when
- * all steps miss. Exported for unit tests; production callers use
- * resolveClaudeExecutableAsync, which adds caching on top.
+ * Pure resolver, source-aware variant — runs each step and returns the
+ * first hit (path + source tag), or null when all steps miss.
+ *
+ * Order matters: `env` wins unconditionally (operator escape hatch), then
+ * `bundled` (the path the SDK expects), then `platform-package` (postinstall
+ * fallback), then `path-lookup` (system PATH — most likely to surface
+ * unintended shims, see #478), then `legacy-cli-js` (only matters on stale
+ * Bun installs of SDK < 0.2.98).
+ */
+export declare function resolveClaudeExecutableWithSource(deps?: ResolverDeps): Promise<ClaudeExecutableInfo | null>;
+/**
+ * Pure resolver — returns the path string only. Kept for callers that
+ * don't need the source tag (existing behavior; preserves the existing
+ * test surface in claude-executable-resolver.test.ts).
  */
 export declare function resolveClaudeExecutable(deps?: ResolverDeps): Promise<string | null>;
+/**
+ * Synchronous subset of the resolver. Used by CLI commands
+ * (`meridian profile list`, `profileAdd`, etc.) that can't await before
+ * spawning `claude auth status`.
+ *
+ * Skips two steps that the async resolver runs:
+ *   - `path-lookup` — running `which`/`where` synchronously is awkward
+ *     and platform-fragile; the audit showed bundled + platform-package
+ *     covers every supported install layout (npm-global, npx/bunx
+ *     download, Docker, NixOS).
+ *   - `legacy-cli-js` — only matters for stale Bun installs of SDK < 0.2.98.
+ *
+ * Closes the diagnostic gap from #478: `getAuthStatus` in profileCli.ts
+ * and `getClaudeAuthStatusAsync` in this file previously called
+ * `claude auth status` via shell, which fails when `claude` isn't on
+ * PATH (Stefan's case — bunx-installed meridian under systemd, no
+ * global claude). Both call sites now route through resolved paths.
+ */
+export declare function resolveClaudeExecutableSync(deps?: ResolverDeps): ClaudeExecutableInfo | null;
+/**
+ * Returns the cached resolved-executable info — `null` if
+ * `resolveClaudeExecutableAsync` hasn't run yet. Used by `/health` and the
+ * startup log so the resolver only runs once and both surfaces see the
+ * same answer.
+ */
+export declare function getResolvedClaudeExecutableInfo(): ClaudeExecutableInfo | null;
 export declare function resolveClaudeExecutableAsync(): Promise<string>;
 /** Reset cached path — for testing only */
 export declare function resetCachedClaudePath(): void;

package/dist/proxy/models.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../src/proxy/models.ts"],"names":[],"mappings":"AAAA;;GAEG;AAoBH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,YAAY,GAAG,MAAM,GAAG,UAAU,GAAG,OAAO,CAAA;AAEjF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,oBAAoB,CAAA;AACrD,eAAO,MAAM,sBAAsB,sBAAsB,CAAA;AACzD,eAAO,MAAM,qBAAqB,qBAAqB,CAAA;AAEvD;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMhE;AACD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AA0BD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,WAAW,CA8B7H;AAWD;;;;;;GAMG;AACH,wBAAgB,gCAAgC,IAAI,IAAI,CAEvD;AAED;;;;GAIG;AACH,wBAAgB,iCAAiC,IAAI,OAAO,CAG3D;AAED,0EAA0E;AAC1E,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,WAAW,GAAG,WAAW,CAIpE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAE9D;AAaD;gFACgF;AAChF,wBAAgB,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAOzH;AAWD;;;;GAIG;AACH,wBAAsB,wBAAwB,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAuD1I;AAOD;;;;;;;;;;GAUG;AACH;;;;GAIG;AACH,KAAK,YAAY,GAAG;IAClB,UAAU,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAA;IAClC,QAAQ,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACzC,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAClD,cAAc,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAA;IAC7C,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;IAC5C,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAA;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,OAAO,CAAA;CACf,CAAA;AA4HD;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,GAAE,YAA2B,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAQvG;AAED,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,MAAM,CAAC,CAqBpE;AAED,2CAA2C;AAC3C,wBAAgB,qBAAqB,IAAI,IAAI,CAG5C;AAED,kDAAkD;AAClD,wBAAgB,2BAA2B,IAAI,IAAI,CAOlD;AAED;;6DAE6D;AAC7D,wBAAgB,qBAAqB,IAAI,IAAI,CAO5C;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAG/D"}
+{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../src/proxy/models.ts"],"names":[],"mappings":"AAAA;;GAEG;AAqBH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,YAAY,GAAG,MAAM,GAAG,UAAU,GAAG,OAAO,CAAA;AAEjF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,oBAAoB,CAAA;AACrD,eAAO,MAAM,sBAAsB,sBAAsB,CAAA;AACzD,eAAO,MAAM,qBAAqB,qBAAqB,CAAA;AAEvD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMxB;AACD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AA0BD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,WAAW,CA8B7H;AAWD;;;;;;GAMG;AACH,wBAAgB,gCAAgC,IAAI,IAAI,CAEvD;AAED;;;;GAIG;AACH,wBAAgB,iCAAiC,IAAI,OAAO,CAG3D;AAED,0EAA0E;AAC1E,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,WAAW,GAAG,WAAW,CAIpE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAE9D;AAaD;gFACgF;AAChF,wBAAgB,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAOzH;AAWD;;;;GAIG;AACH,wBAAsB,wBAAwB,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAiE1I;AAID;;;;;;GAMG;AACH,MAAM,MAAM,sBAAsB,GAC9B,KAAK,GACL,SAAS,GACT,kBAAkB,GAClB,aAAa,GACb,eAAe,CAAA;AAEnB,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,sBAAsB,CAAA;CAC/B;AAKD;;;;;;;;;;GAUG;AACH;;;;GAIG;AACH,KAAK,YAAY,GAAG;IAClB,UAAU,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAA;IAClC,QAAQ,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACzC,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAClD,cAAc,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAA;IAC7C,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;IAC5C,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAA;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,OAAO,CAAA;CACf,CAAA;AA4HD;;;;;;;;;GASG;AACH,wBAAsB,iCAAiC,CACrD,IAAI,GAAE,YAA2B,GAChC,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAYtC;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,IAAI,GAAE,YAA2B,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAGvG;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,GAAE,YAA2B,GAChC,oBAAoB,GAAG,IAAI,CAQ7B;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,IAAI,oBAAoB,GAAG,IAAI,CAE7E;AAED,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,MAAM,CAAC,CAqBpE;AAED,2CAA2C;AAC3C,wBAAgB,qBAAqB,IAAI,IAAI,CAG5C;AAED,kDAAkD;AAClD,wBAAgB,2BAA2B,IAAI,IAAI,CAOlD;AAED;;6DAE6D;AAC7D,wBAAgB,qBAAqB,IAAI,IAAI,CAO5C;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAG/D"}

package/dist/proxy/oauthUsage.d.ts

@@ -37,6 +37,19 @@ export interface OAuthUsageSnapshot {
     extraUsage: OAuthExtraUsageInfo | null;
     fetchedAt: number;
 }
+/** Minimal fetch shape used by callAnthropic. Avoids `typeof fetch`'s
+ *  `preconnect` property, which makes test casts unwieldy. */
+type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
+export interface FetchOAuthUsageOpts {
+    ttlMs?: number;
+    force?: boolean;
+    store?: CredentialStore;
+    profileId?: string | null;
+    claudeConfigDir?: string;
+    fetchImpl?: FetchLike;
+}
+/** Test-only setter. Pass `null` to clear. */
+export declare function __setFetchOAuthUsageOverride(fn: ((opts?: FetchOAuthUsageOpts) => Promise<OAuthUsageSnapshot | null>) | null): void;
 /**
  * Fetch latest OAuth usage for a specific profile (or the default OAuth
  * account if none specified). Returns null if no OAuth token is available
@@ -54,14 +67,11 @@ export interface OAuthUsageSnapshot {
  * @param claudeConfigDir When provided, reads credentials from this dir's
  *                        keychain entry (macOS) or `.credentials.json`
  *                        (Linux) instead of the platform default.
+ * @param fetchImpl       Override the fetch implementation (for testing).
+ *                        Defaults to globalThis.fetch.
  */
-export declare function fetchOAuthUsage(opts?: {
-    ttlMs?: number;
-    force?: boolean;
-    store?: CredentialStore;
-    profileId?: string | null;
-    claudeConfigDir?: string;
-}): Promise<OAuthUsageSnapshot | null>;
+export declare function fetchOAuthUsage(opts?: FetchOAuthUsageOpts): Promise<OAuthUsageSnapshot | null>;
 /** Test-only / shutdown helper — clears all cached snapshots and pending fetches. */
 export declare function resetOAuthUsageCache(): void;
+export {};
 //# sourceMappingURL=oauthUsage.d.ts.map

package/dist/proxy/oauthUsage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauthUsage.d.ts","sourceRoot":"","sources":["../../src/proxy/oauthUsage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAoD,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAgCvG,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,OAAO,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,gBAAgB,EAAE,CAAA;IAC3B,UAAU,EAAE,mBAAmB,GAAG,IAAI,CAAA;IACtC,SAAS,EAAE,MAAM,CAAA;CAClB;AA0ED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,eAAe,CAAC,IAAI,CAAC,EAAE;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,KAAK,CAAC,EAAE,eAAe,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAgDrC;AAED,qFAAqF;AACrF,wBAAgB,oBAAoB,IAAI,IAAI,CAG3C"}
+{"version":3,"file":"oauthUsage.d.ts","sourceRoot":"","sources":["../../src/proxy/oauthUsage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAoD,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAgCvG,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,OAAO,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,gBAAgB,EAAE,CAAA;IAC3B,UAAU,EAAE,mBAAmB,GAAG,IAAI,CAAA;IACtC,SAAS,EAAE,MAAM,CAAA;CAClB;AA6DD;8DAC8D;AAC9D,KAAK,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAmBzE,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,KAAK,CAAC,EAAE,eAAe,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,SAAS,CAAC,EAAE,SAAS,CAAA;CACtB;AAcD,8CAA8C;AAC9C,wBAAgB,4BAA4B,CAC1C,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,mBAAmB,KAAK,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,GAC9E,IAAI,CAEN;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,eAAe,CAAC,IAAI,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAOpG;AAqDD,qFAAqF;AACrF,wBAAgB,oBAAoB,IAAI,IAAI,CAG3C"}

package/dist/proxy/plugins/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../src/proxy/plugins/loader.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAgB,YAAY,EAAE,MAAM,SAAS,CAAA;AAStE,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,EAAE,CASnE;AAED,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,YAAY,EAAE,CAAC,CAiIzB;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,SAAS,EAAE,CAIxE"}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../src/proxy/plugins/loader.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAgB,YAAY,EAAE,MAAM,SAAS,CAAA;AAStE,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,WAAW,EAAE,CASnE;AAED,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,YAAY,EAAE,CAAC,CA+IzB;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,SAAS,EAAE,CAIxE"}

package/dist/proxy/profiles.d.ts

@@ -2,8 +2,9 @@
  * Multi-profile support.
  *
  * Allows a single Meridian instance to route requests to different Claude
- * accounts. Each profile is a named auth context (a CLAUDE_CONFIG_DIR for
- * Max subscriptions, or an API key for direct API access).
+ * accounts. Each profile is a named auth context — a CLAUDE_CONFIG_DIR for
+ * Max subscriptions, an Anthropic API key for direct API access, or a
+ * long-lived OAuth token minted by `claude setup-token`.
  *
  * Profile selection priority:
  *   1. x-meridian-profile request header (per-request override)
@@ -18,11 +19,16 @@
  * while avoiding synchronous disk I/O on every request.
  */
 export declare function loadProfilesFromDisk(): ProfileConfig[];
-export type ProfileType = "claude-max" | "api";
+export type ProfileType = "claude-max" | "api" | "oauth-token";
 export interface ProfileConfig {
     /** Unique profile identifier (e.g. "personal", "work") */
     id: string;
-    /** Auth type — "claude-max" uses CLAUDE_CONFIG_DIR, "api" uses ANTHROPIC_API_KEY */
+    /**
+     * Auth type. Inferred from the populated credential field when omitted:
+     *   - `oauthToken`        → "oauth-token" (CLAUDE_CODE_OAUTH_TOKEN)
+     *   - `apiKey`/`baseUrl`  → must be combined with explicit `type: "api"`
+     *   - `claudeConfigDir`   → "claude-max" (CLAUDE_CONFIG_DIR)
+     */
     type?: ProfileType;
     /** Path to .claude config directory (claude-max profiles) */
     claudeConfigDir?: string;
@@ -30,6 +36,8 @@ export interface ProfileConfig {
     apiKey?: string;
     /** Anthropic base URL override (api profiles) */
     baseUrl?: string;
+    /** Long-lived OAuth token from `claude setup-token` (oauth-token profiles) */
+    oauthToken?: string;
 }
 export interface ResolvedProfile {
     id: string;

package/dist/proxy/profiles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../src/proxy/profiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAcH;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,aAAa,EAAE,CAkBtD;AAED,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,KAAK,CAAA;AAE9C,MAAM,WAAW,aAAa;IAC5B,0DAA0D;IAC1D,EAAE,EAAE,MAAM,CAAA;IACV,oFAAoF;IACpF,IAAI,CAAC,EAAE,WAAW,CAAA;IAClB,6DAA6D;IAC7D,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,iDAAiD;IACjD,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,WAAW,CAAA;IACjB,4DAA4D;IAC5D,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC5B;AAOD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAGxD;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAEvD;AAED,+CAA+C;AAC/C,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,cAAc,CAAC,EAAE,aAAa,EAAE,GAAG,IAAI,CAY3E;AAUD;;kEAEkE;AAClE,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AAED,wBAAgB,oBAAoB,CAAC,cAAc,EAAE,aAAa,EAAE,GAAG,SAAS,GAAG,aAAa,EAAE,CAOjG;AAED,0DAA0D;AAC1D,wBAAgB,WAAW,CAAC,cAAc,EAAE,aAAa,EAAE,GAAG,SAAS,GAAG,OAAO,CAEhF;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,aAAa,EAAE,GAAG,SAAS,EACrC,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,WAAW,CAAC,EAAE,MAAM,GACnB,eAAe,CAkBjB;AAqBD;;GAEG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,aAAa,EAAE,GAAG,SAAS,EACrC,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC,CAU7D"}
+{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../src/proxy/profiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAcH;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,aAAa,EAAE,CAkBtD;AAED,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,KAAK,GAAG,aAAa,CAAA;AAE9D,MAAM,WAAW,aAAa;IAC5B,0DAA0D;IAC1D,EAAE,EAAE,MAAM,CAAA;IACV;;;;;OAKG;IACH,IAAI,CAAC,EAAE,WAAW,CAAA;IAClB,6DAA6D;IAC7D,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,iDAAiD;IACjD,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,WAAW,CAAA;IACjB,4DAA4D;IAC5D,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC5B;AAOD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAGxD;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAEvD;AAED,+CAA+C;AAC/C,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,cAAc,CAAC,EAAE,aAAa,EAAE,GAAG,IAAI,CAY3E;AAUD;;kEAEkE;AAClE,wBAAgB,0BAA0B,IAAI,IAAI,CAEjD;AAED,wBAAgB,oBAAoB,CAAC,cAAc,EAAE,aAAa,EAAE,GAAG,SAAS,GAAG,aAAa,EAAE,CAOjG;AAED,0DAA0D;AAC1D,wBAAgB,WAAW,CAAC,cAAc,EAAE,aAAa,EAAE,GAAG,SAAS,GAAG,OAAO,CAEhF;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,aAAa,EAAE,GAAG,SAAS,EACrC,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,WAAW,CAAC,EAAE,MAAM,GACnB,eAAe,CAkBjB;AAkCD;;GAEG;AACH,wBAAgB,YAAY,CAC1B,QAAQ,EAAE,aAAa,EAAE,GAAG,SAAS,EACrC,cAAc,EAAE,MAAM,GAAG,SAAS,GACjC,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC,CAU7D"}