@rynfar/meridian 1.53.0 → 1.54.0

package/README.md

@@ -667,6 +667,47 @@ Run several configurations of the same adapter side by side — e.g. a passthrou
 
 Built-in adapter names are reserved and can't be shadowed. With no instances configured, detection is exactly the built-in chain. Config file changes apply within ~5s, no restart needed.
 
+### Claude Design MCP
+
+Meridian proxies the Claude Design MCP API (`api.anthropic.com/v1/design/*`), so MCP clients can use Claude Design tools through your local endpoint.
+
+**1. Add the MCP server.** For Claude Code:
+
+```bash
+claude mcp add -s user --transport http claude-design http://127.0.0.1:3456/v1/design/mcp
+```
+
+Any other MCP client: point it at `http://127.0.0.1:3456/v1/design/mcp` (streamable HTTP).
+
+**2. Grant Claude Design consent (one time, per Anthropic account).** Tool calls return a `needs_consent` error until you enable it: open [claude.ai/design/settings](https://claude.ai/design/settings), find **"Claude product access"** ("Let other Claude products, like Claude Code, read and edit your Design projects"), and switch it **On**. This is a setting on the Anthropic account itself — with multiple Meridian profiles, the account behind the *profile handling the request* is the one that needs the toggle.
+
+That's it — your existing Claude Max login covers auth (`initialize`, `tools/list`, and tool calls are all verified working with a plain Max token). Verify with a quick handshake:
+
+```bash
+curl -s -X POST http://127.0.0.1:3456/v1/design/mcp -H 'content-type: application/json' \
+  -d '{"jsonrpc":"2.0","method":"tools/list","id":1}'
+```
+
+**Multiple profiles:** design requests use the active profile by default. To pin design traffic to a specific profile regardless of which is active, register the server with a profile header:
+
+```bash
+claude mcp add -s user --transport http --header "x-meridian-profile: personal" \
+  claude-design http://127.0.0.1:3456/v1/design/mcp
+```
+
+**Fallback OAuth flow:** if the upstream ever rejects your token with an `auth_error` (scope enforcement has varied over time), `/design-login` obtains a dedicated token with the `user:design:read`/`user:design:write` scopes:
+
+```bash
+curl http://127.0.0.1:3456/design-login          # returns an authorize URL — open it in your browser
+curl -X POST http://127.0.0.1:3456/design-login \
+  -H 'content-type: application/json' \
+  -d '{"code": "<code-from-browser>"}'           # paste the code you were shown
+```
+
+The design token is stored at `~/.config/meridian/design-token.json` (mode `0600`, global across profiles) and refreshed automatically when it expires.
+
+> Contributed by [@sittitep](https://github.com/sittitep) (#543).
+
 ### Any Anthropic-compatible tool
 
 ```bash
@@ -834,6 +875,8 @@ ANTHROPIC_API_KEY=your-secret-key ANTHROPIC_BASE_URL=http://meridian-host:3456 o
 | `POST /v1/chat/completions` | OpenAI-compatible chat completions |
 | `POST /v1/responses` | OpenAI Responses API (Codex CLI ≥ 0.96) |
 | `GET /v1/models` | OpenAI-compatible model list |
+| `GET/POST /v1/design/*` | Claude Design MCP proxy (see [Claude Design MCP](#claude-design-mcp)) |
+| `GET/POST /design-login` | OAuth flow for the design scopes |
 | `GET /health` | Auth status, mode, plugin status |
 | `POST /auth/refresh` | Manually refresh the OAuth token |
 | `GET /telemetry` | Performance dashboard |

package/dist/{profileCli-s1h4vh8w.js → cli-jhm27q0x.js}

@@ -1,22 +1,347 @@
-import {
-  resolveClaudeExecutableSync
-} from "./cli-vjeftz4z.js";
 import {
   setSetting
 } from "./cli-340h1chz.js";
 import {
   createPlatformCredentialStore
 } from "./cli-aq5zz92m.js";
-import"./cli-p9swy5t3.js";
+import {
+  __esm
+} from "./cli-p9swy5t3.js";
+
+// src/env.ts
+function env(suffix) {
+  return process.env[`MERIDIAN_${suffix}`] ?? process.env[`CLAUDE_PROXY_${suffix}`];
+}
+function envBool(suffix) {
+  const val = env(suffix);
+  return val === "1" || val === "true" || val === "yes";
+}
+function resolvePassthrough(defaultValue) {
+  const val = env("PASSTHROUGH");
+  if (val === "1" || val === "true" || val === "yes")
+    return true;
+  if (val === "0" || val === "false" || val === "no")
+    return false;
+  return defaultValue;
+}
+function envInt(suffix, defaultValue) {
+  const val = env(suffix);
+  if (!val)
+    return defaultValue;
+  const parsed = parseInt(val, 10);
+  return Number.isFinite(parsed) ? parsed : defaultValue;
+}
+var init_env = () => {};
 
 // src/proxy/profileCli.ts
 import { execFileSync, spawnSync } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
-import { mkdirSync, readFileSync, rmSync, writeFileSync, existsSync } from "node:fs";
+import { mkdirSync, readFileSync, rmSync, writeFileSync, existsSync as existsSync2 } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
-var PROFILES_DIR = join(homedir(), ".config", "meridian", "profiles");
-var CONFIG_FILE = join(homedir(), ".config", "meridian", "profiles.json");
+import { join as join2 } from "node:path";
+
+// src/proxy/models.ts
+init_env();
+import { exec as execCallback, execFile as execFileCallback } from "child_process";
+import { existsSync, statSync } from "fs";
+import { fileURLToPath } from "url";
+import { join, dirname } from "path";
+import { promisify } from "util";
+var exec = promisify(execCallback);
+var execFile = promisify(execFileCallback);
+var STUB_SIZE_THRESHOLD = 4096;
+var CANONICAL_FABLE_MODEL = "claude-fable-5";
+var CANONICAL_OPUS_MODEL = "claude-opus-4-8";
+var CANONICAL_SONNET_MODEL = "claude-sonnet-5";
+var CANONICAL_HAIKU_MODEL = "claude-haiku-4-5";
+function resolveSdkModelDefaults(env2 = process.env) {
+  return {
+    ANTHROPIC_DEFAULT_FABLE_MODEL: env2.MERIDIAN_DEFAULT_FABLE_MODEL ?? CANONICAL_FABLE_MODEL,
+    ANTHROPIC_DEFAULT_OPUS_MODEL: env2.MERIDIAN_DEFAULT_OPUS_MODEL ?? CANONICAL_OPUS_MODEL,
+    ANTHROPIC_DEFAULT_SONNET_MODEL: env2.MERIDIAN_DEFAULT_SONNET_MODEL ?? CANONICAL_SONNET_MODEL,
+    ANTHROPIC_DEFAULT_HAIKU_MODEL: env2.MERIDIAN_DEFAULT_HAIKU_MODEL ?? CANONICAL_HAIKU_MODEL
+  };
+}
+function explicitModelPin(requestedModel) {
+  const base = requestedModel.trim().toLowerCase().replace(/\[1m\]$/, "");
+  const match = /^claude-(sonnet|opus|haiku|fable|mythos)-\d[\w.-]*$/.exec(base);
+  if (!match)
+    return;
+  const tier = match[1] === "mythos" ? "FABLE" : match[1].toUpperCase();
+  return { [`ANTHROPIC_DEFAULT_${tier}_MODEL`]: base };
+}
+var AUTH_STATUS_CACHE_TTL_MS = 60000;
+var AUTH_STATUS_FAILURE_TTL_MS = 5000;
+var cachedAuthStatus = null;
+var lastKnownGoodAuthStatus = null;
+var cachedAuthStatusAt = 0;
+var cachedAuthStatusIsFailure = false;
+var cachedAuthStatusPromise = null;
+function supports1mContext(model) {
+  const override = env("1M_CONTEXT_SUPPORT");
+  if (override === "0" || override === "false" || override === "no")
+    return false;
+  if (model.includes("4-5") || model.includes("4.5"))
+    return false;
+  return true;
+}
+function mapModelToClaudeModel(model, subscriptionType, agentMode) {
+  if (model.includes("haiku"))
+    return "haiku";
+  const use1m = supports1mContext(model);
+  const isSubagent = agentMode === "subagent";
+  if (model.includes("fable") || model.includes("mythos")) {
+    if (use1m && !isSubagent && !isExtendedContextKnownUnavailable())
+      return "fable[1m]";
+    return "fable";
+  }
+  if (model.includes("opus")) {
+    if (use1m && !isSubagent && !isExtendedContextKnownUnavailable())
+      return "opus[1m]";
+    return "opus";
+  }
+  const sonnetOverride = process.env.MERIDIAN_SONNET_MODEL ?? process.env.CLAUDE_PROXY_SONNET_MODEL;
+  if (sonnetOverride === "sonnet[1m]") {
+    if (!use1m || isSubagent || isExtendedContextKnownUnavailable())
+      return "sonnet";
+    return "sonnet[1m]";
+  }
+  return "sonnet";
+}
+var EXTRA_USAGE_RETRY_MS = 60 * 60 * 1000;
+var extraUsageUnavailableAt = 0;
+function recordExtendedContextUnavailable() {
+  extraUsageUnavailableAt = Date.now();
+}
+function isExtendedContextKnownUnavailable() {
+  return extraUsageUnavailableAt > 0 && Date.now() - extraUsageUnavailableAt < EXTRA_USAGE_RETRY_MS;
+}
+function stripExtendedContext(model) {
+  if (model === "opus[1m]")
+    return "opus";
+  if (model === "sonnet[1m]")
+    return "sonnet";
+  if (model === "fable[1m]")
+    return "fable";
+  return model;
+}
+function hasExtendedContext(model) {
+  return model.endsWith("[1m]");
+}
+var profileAuthCaches = new Map;
+function getAuthCacheInfo(profileId) {
+  if (!profileId) {
+    return { lastCheckedAt: cachedAuthStatusAt, lastSuccessAt: cachedAuthStatusIsFailure ? 0 : cachedAuthStatusAt, isFailure: cachedAuthStatusIsFailure };
+  }
+  const cache = profileAuthCaches.get(profileId);
+  if (!cache)
+    return { lastCheckedAt: 0, lastSuccessAt: 0, isFailure: false };
+  return { lastCheckedAt: cache.at, lastSuccessAt: cache.lastSuccessAt, isFailure: cache.isFailure };
+}
+function getAuthCache(key) {
+  let cache = profileAuthCaches.get(key);
+  if (!cache) {
+    cache = { status: null, lastKnownGood: null, at: 0, isFailure: false, promise: null, lastSuccessAt: 0 };
+    profileAuthCaches.set(key, cache);
+  }
+  return cache;
+}
+async function getClaudeAuthStatusAsync(profileId, envOverrides) {
+  const isDefault = !profileId;
+  const cache = isDefault ? null : getAuthCache(profileId);
+  const c_status = cache ? cache.status : cachedAuthStatus;
+  const c_lastKnownGood = cache ? cache.lastKnownGood : lastKnownGoodAuthStatus;
+  const c_at = cache ? cache.at : cachedAuthStatusAt;
+  const c_isFailure = cache ? cache.isFailure : cachedAuthStatusIsFailure;
+  let c_promise = cache ? cache.promise : cachedAuthStatusPromise;
+  const ttl = c_isFailure ? AUTH_STATUS_FAILURE_TTL_MS : AUTH_STATUS_CACHE_TTL_MS;
+  if (c_at > 0 && Date.now() - c_at < ttl) {
+    return c_status ?? c_lastKnownGood;
+  }
+  if (c_promise)
+    return c_promise;
+  c_promise = (async () => {
+    try {
+      const claudePath = await resolveClaudeExecutableAsync();
+      const { stdout } = await execFile(claudePath, ["auth", "status"], {
+        timeout: 5000,
+        ...envOverrides ? { env: { ...process.env, ...envOverrides } } : {}
+      });
+      const parsed = JSON.parse(stdout);
+      if (cache) {
+        cache.status = parsed;
+        cache.lastKnownGood = parsed;
+        cache.at = Date.now();
+        cache.isFailure = false;
+        cache.lastSuccessAt = Date.now();
+      } else {
+        cachedAuthStatus = parsed;
+        lastKnownGoodAuthStatus = parsed;
+        cachedAuthStatusAt = Date.now();
+        cachedAuthStatusIsFailure = false;
+      }
+      return parsed;
+    } catch {
+      if (cache) {
+        cache.isFailure = true;
+        cache.at = Date.now();
+        cache.status = null;
+        return cache.lastKnownGood;
+      } else {
+        cachedAuthStatusIsFailure = true;
+        cachedAuthStatusAt = Date.now();
+        cachedAuthStatus = null;
+        return lastKnownGoodAuthStatus;
+      }
+    }
+  })();
+  if (cache)
+    cache.promise = c_promise;
+  else
+    cachedAuthStatusPromise = c_promise;
+  try {
+    return await c_promise;
+  } finally {
+    if (cache)
+      cache.promise = null;
+    else
+      cachedAuthStatusPromise = null;
+  }
+}
+var cachedClaudeInfo = null;
+var cachedClaudePathPromise = null;
+var DEFAULT_DEPS = {
+  existsSync,
+  statSync: (p) => statSync(p),
+  exec,
+  resolvePackage: (specifier) => fileURLToPath(import.meta.resolve(specifier)),
+  envGet: (name) => process.env[name],
+  platform: process.platform,
+  arch: process.arch,
+  isBun: typeof process.versions.bun !== "undefined"
+};
+function tryEnvOverride(deps) {
+  const explicit = deps.envGet("MERIDIAN_CLAUDE_PATH");
+  if (!explicit)
+    return null;
+  return deps.existsSync(explicit) ? explicit : null;
+}
+function tryBundledBinary(deps) {
+  try {
+    const pkgPath = deps.resolvePackage("@anthropic-ai/claude-code/package.json");
+    const bundled = join(dirname(pkgPath), "bin", "claude.exe");
+    if (!deps.existsSync(bundled))
+      return null;
+    const size = deps.statSync(bundled).size;
+    if (size <= STUB_SIZE_THRESHOLD)
+      return null;
+    return bundled;
+  } catch {
+    return null;
+  }
+}
+function tryPlatformPackage(deps) {
+  const binName = deps.platform === "win32" ? "claude.exe" : "claude";
+  const candidates = [`@anthropic-ai/claude-code-${deps.platform}-${deps.arch}`];
+  if (deps.platform === "linux") {
+    candidates.push(`@anthropic-ai/claude-code-${deps.platform}-${deps.arch}-musl`);
+  }
+  for (const pkg of candidates) {
+    try {
+      const pkgJson = deps.resolvePackage(`${pkg}/package.json`);
+      const candidate = join(dirname(pkgJson), binName);
+      if (deps.existsSync(candidate))
+        return candidate;
+    } catch {}
+  }
+  return null;
+}
+async function tryPathLookup(deps) {
+  const cmd = deps.platform === "win32" ? "where claude" : "which claude";
+  try {
+    const { stdout } = await deps.exec(cmd);
+    const candidates = stdout.split(/\r?\n/).map((s) => s.trim()).filter(Boolean);
+    for (const candidate of candidates) {
+      if (deps.platform === "win32" && candidate.startsWith("/"))
+        continue;
+      if (deps.existsSync(candidate))
+        return candidate;
+    }
+  } catch {}
+  return null;
+}
+function tryLegacySdkCliJs(deps) {
+  if (!deps.isBun)
+    return null;
+  try {
+    const sdkPath = deps.resolvePackage("@anthropic-ai/claude-agent-sdk");
+    const cliJs = join(dirname(sdkPath), "cli.js");
+    return deps.existsSync(cliJs) ? cliJs : null;
+  } catch {
+    return null;
+  }
+}
+async function resolveClaudeExecutableWithSource(deps = DEFAULT_DEPS) {
+  const env2 = tryEnvOverride(deps);
+  if (env2)
+    return { path: env2, source: "env" };
+  const bundled = tryBundledBinary(deps);
+  if (bundled)
+    return { path: bundled, source: "bundled" };
+  const platformPkg = tryPlatformPackage(deps);
+  if (platformPkg)
+    return { path: platformPkg, source: "platform-package" };
+  const pathLookup = await tryPathLookup(deps);
+  if (pathLookup)
+    return { path: pathLookup, source: "path-lookup" };
+  const legacy = tryLegacySdkCliJs(deps);
+  if (legacy)
+    return { path: legacy, source: "legacy-cli-js" };
+  return null;
+}
+function resolveClaudeExecutableSync(deps = DEFAULT_DEPS) {
+  const env2 = tryEnvOverride(deps);
+  if (env2)
+    return { path: env2, source: "env" };
+  const bundled = tryBundledBinary(deps);
+  if (bundled)
+    return { path: bundled, source: "bundled" };
+  const platformPkg = tryPlatformPackage(deps);
+  if (platformPkg)
+    return { path: platformPkg, source: "platform-package" };
+  return null;
+}
+function getResolvedClaudeExecutableInfo() {
+  return cachedClaudeInfo;
+}
+async function resolveClaudeExecutableAsync() {
+  if (cachedClaudeInfo)
+    return cachedClaudeInfo.path;
+  if (cachedClaudePathPromise)
+    return cachedClaudePathPromise;
+  cachedClaudePathPromise = (async () => {
+    const resolved = await resolveClaudeExecutableWithSource();
+    if (resolved) {
+      cachedClaudeInfo = resolved;
+      return resolved.path;
+    }
+    throw new Error("Could not find Claude Code executable. Install via: npm install -g @anthropic-ai/claude-code, " + "or set MERIDIAN_CLAUDE_PATH=/path/to/claude to point at an existing binary.");
+  })();
+  try {
+    return await cachedClaudePathPromise;
+  } finally {
+    cachedClaudePathPromise = null;
+  }
+}
+function isClosedControllerError(error) {
+  if (!(error instanceof Error))
+    return false;
+  return error.message.includes("Controller is already closed");
+}
+
+// src/proxy/profileCli.ts
+var PROFILES_DIR = join2(homedir(), ".config", "meridian", "profiles");
+var CONFIG_FILE = join2(homedir(), ".config", "meridian", "profiles.json");
 var OAUTH_AUTHORIZE_URL = "https://claude.com/cai/oauth/authorize";
 var OAUTH_TOKEN_URL = "https://platform.claude.com/v1/oauth/token";
 var OAUTH_CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
@@ -33,18 +358,19 @@ function ensureProfilesDir() {
   mkdirSync(PROFILES_DIR, { recursive: true });
 }
 function getProfileDir(id) {
-  return join(PROFILES_DIR, id);
+  return join2(PROFILES_DIR, id);
 }
 function buildAuthLoginEnv(configDir, _options = {}, baseEnv = process.env) {
-  const env = { ...baseEnv };
+  const env2 = { ...baseEnv };
   if (configDir)
-    env.CLAUDE_CONFIG_DIR = configDir;
-  return env;
+    env2.CLAUDE_CONFIG_DIR = configDir;
+  return env2;
 }
 function base64Url(bytes) {
   return bytes.toString("base64url");
 }
-function createManualOAuthSession() {
+function createManualOAuthSession(scopes) {
+  const scopeList = scopes ?? OAUTH_SCOPES;
   const codeVerifier = base64Url(randomBytes(32));
   const state = base64Url(randomBytes(32));
   const codeChallenge = createHash("sha256").update(codeVerifier).digest("base64url");
@@ -53,7 +379,7 @@ function createManualOAuthSession() {
   url.searchParams.set("client_id", OAUTH_CLIENT_ID);
   url.searchParams.set("response_type", "code");
   url.searchParams.set("redirect_uri", OAUTH_REDIRECT_URI);
-  url.searchParams.set("scope", OAUTH_SCOPES.join(" "));
+  url.searchParams.set("scope", scopeList.join(" "));
   url.searchParams.set("code_challenge", codeChallenge);
   url.searchParams.set("code_challenge_method", "S256");
   url.searchParams.set("state", state);
@@ -78,7 +404,7 @@ function parseAuthorizationCodeInput(input) {
   return code ? { code, state } : null;
 }
 function loadProfileConfig() {
-  if (!existsSync(CONFIG_FILE))
+  if (!existsSync2(CONFIG_FILE))
     return [];
   try {
     return JSON.parse(readFileSync(CONFIG_FILE, "utf-8"));
@@ -186,7 +512,7 @@ async function profileAdd(id, options = {}) {
     console.error(`  Run: meridian profile list`);
     process.exit(1);
   }
-  const defaultClaudeDir = join(homedir(), ".claude");
+  const defaultClaudeDir = join2(homedir(), ".claude");
   const alreadyImported = profiles.some((p) => p.claudeConfigDir === defaultClaudeDir);
   if (!alreadyImported) {
     const defaultAuth = getAuthStatus(defaultClaudeDir);
@@ -317,7 +643,7 @@ function dirsToRemoveOnProfileRemove(profile, profilesDir) {
     dirs.push(profile.claudeConfigDir);
   }
   if (profile.oauthToken || profile.type === "oauth-token") {
-    const isolationDir = join(profilesDir, profile.id);
+    const isolationDir = join2(profilesDir, profile.id);
     if (!dirs.includes(isolationDir))
       dirs.push(isolationDir);
   }
@@ -339,7 +665,7 @@ function profileRemove(id) {
   profiles.splice(idx, 1);
   saveProfileConfig(profiles);
   for (const dir of dirsToRemove) {
-    if (existsSync(dir))
+    if (existsSync2(dir))
       rmSync(dir, { recursive: true, force: true });
   }
   console.log(`\x1B[32m✓ Profile "${id}" removed.\x1B[0m`);
@@ -498,16 +824,5 @@ Examples:
   meridian profile switch work                      # Switch to work account
   meridian profile list                             # Show all profiles`);
 }
-export {
-  profileSwitch,
-  profileRemove,
-  profileLogin,
-  profileList,
-  profileHelp,
-  profileAddOauthToken,
-  profileAdd,
-  parseAuthorizationCodeInput,
-  dirsToRemoveOnProfileRemove,
-  createManualOAuthSession,
-  buildAuthLoginEnv
-};
+
+export { env, envBool, resolvePassthrough, envInt, init_env, CANONICAL_SONNET_MODEL, resolveSdkModelDefaults, explicitModelPin, mapModelToClaudeModel, recordExtendedContextUnavailable, stripExtendedContext, hasExtendedContext, getAuthCacheInfo, getClaudeAuthStatusAsync, getResolvedClaudeExecutableInfo, resolveClaudeExecutableAsync, isClosedControllerError, OAUTH_TOKEN_URL, OAUTH_CLIENT_ID, OAUTH_REDIRECT_URI, buildAuthLoginEnv, createManualOAuthSession, parseAuthorizationCodeInput, profileAdd, profileAddOauthToken, profileList, dirsToRemoveOnProfileRemove, profileRemove, profileSwitch, profileLogin, profileHelp };