@xortex/xcode 3.0.0

package/utils/mailbox.ts

@@ -0,0 +1,73 @@
+import { createSignal } from './signal.js'
+
+export type MessageSource = 'user' | 'teammate' | 'system' | 'tick' | 'task'
+
+export type Message = {
+  id: string
+  source: MessageSource
+  content: string
+  from?: string
+  color?: string
+  timestamp: string
+}
+
+type Waiter = {
+  fn: (msg: Message) => boolean
+  resolve: (msg: Message) => void
+}
+
+export class Mailbox {
+  private queue: Message[] = []
+  private waiters: Waiter[] = []
+  private changed = createSignal()
+  private _revision = 0
+
+  get length(): number {
+    return this.queue.length
+  }
+
+  get revision(): number {
+    return this._revision
+  }
+
+  send(msg: Message): void {
+    this._revision++
+    const idx = this.waiters.findIndex(w => w.fn(msg))
+    if (idx !== -1) {
+      const waiter = this.waiters.splice(idx, 1)[0]
+      if (waiter) {
+        waiter.resolve(msg)
+        this.notify()
+        return
+      }
+    }
+    this.queue.push(msg)
+    this.notify()
+  }
+
+  poll(fn: (msg: Message) => boolean = () => true): Message | undefined {
+    const idx = this.queue.findIndex(fn)
+    if (idx === -1) return undefined
+    return this.queue.splice(idx, 1)[0]
+  }
+
+  receive(fn: (msg: Message) => boolean = () => true): Promise<Message> {
+    const idx = this.queue.findIndex(fn)
+    if (idx !== -1) {
+      const msg = this.queue.splice(idx, 1)[0]
+      if (msg) {
+        this.notify()
+        return Promise.resolve(msg)
+      }
+    }
+    return new Promise<Message>(resolve => {
+      this.waiters.push({ fn, resolve })
+    })
+  }
+
+  subscribe = this.changed.subscribe
+
+  private notify(): void {
+    this.changed.emit()
+  }
+}

package/utils/managedEnv.ts

@@ -0,0 +1,199 @@
+import { isRemoteManagedSettingsEligible } from '../services/remoteManagedSettings/syncCache.js'
+import { clearCACertsCache } from './caCerts.js'
+import { getGlobalConfig } from './config.js'
+import { isEnvTruthy } from './envUtils.js'
+import {
+  isProviderManagedEnvVar,
+  SAFE_ENV_VARS,
+} from './managedEnvConstants.js'
+import { clearMTLSCache } from './mtls.js'
+import { clearProxyCache, configureGlobalAgents } from './proxy.js'
+import { isSettingSourceEnabled } from './settings/constants.js'
+import {
+  getSettings_DEPRECATED,
+  getSettingsForSource,
+} from './settings/settings.js'
+
+/**
+ * `claude ssh` remote: ANTHROPIC_UNIX_SOCKET routes auth through a -R forwarded
+ * socket to a local proxy, and the launcher sets a handful of placeholder auth
+ * env vars that the remote's ~/.claude settings.env MUST NOT clobber (see
+ * isAnthropicAuthEnabled). Strip them from any settings-sourced env object.
+ */
+function withoutSSHTunnelVars(
+  env: Record<string, string> | undefined,
+): Record<string, string> {
+  if (!env || !process.env.ANTHROPIC_UNIX_SOCKET) return env || {}
+  const {
+    ANTHROPIC_UNIX_SOCKET: _1,
+    ANTHROPIC_BASE_URL: _2,
+    ANTHROPIC_API_KEY: _3,
+    ANTHROPIC_AUTH_TOKEN: _4,
+    CLAUDE_CODE_OAUTH_TOKEN: _5,
+    ...rest
+  } = env
+  return rest
+}
+
+/**
+ * When the host owns inference routing (sets
+ * CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST in spawn env), strip
+ * provider-selection / model-default vars from settings-sourced env so a
+ * user's ~/.claude/settings.json can't redirect requests away from the
+ * host-configured provider.
+ */
+function withoutHostManagedProviderVars(
+  env: Record<string, string> | undefined,
+): Record<string, string> {
+  if (!env) return {}
+  if (!isEnvTruthy(process.env.CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST)) {
+    return env
+  }
+  const out: Record<string, string> = {}
+  for (const [key, value] of Object.entries(env)) {
+    if (!isProviderManagedEnvVar(key)) {
+      out[key] = value
+    }
+  }
+  return out
+}
+
+/**
+ * Snapshot of env keys present before any settings.env is applied — for CCD,
+ * these are the keys the desktop host set to orchestrate the subprocess.
+ * Settings must not override them (OTEL_LOGS_EXPORTER=console would corrupt
+ * the stdio JSON-RPC transport). Keys added LATER by user/project settings
+ * are not in this set, so mid-session settings.json changes still apply.
+ * Lazy-captured on first applySafeConfigEnvironmentVariables() call.
+ */
+let ccdSpawnEnvKeys: Set<string> | null | undefined
+
+function withoutCcdSpawnEnvKeys(
+  env: Record<string, string> | undefined,
+): Record<string, string> {
+  if (!env || !ccdSpawnEnvKeys) return env || {}
+  const out: Record<string, string> = {}
+  for (const [key, value] of Object.entries(env)) {
+    if (!ccdSpawnEnvKeys.has(key)) out[key] = value
+  }
+  return out
+}
+
+/**
+ * Compose the strip filters applied to every settings-sourced env object.
+ */
+function filterSettingsEnv(
+  env: Record<string, string> | undefined,
+): Record<string, string> {
+  return withoutCcdSpawnEnvKeys(
+    withoutHostManagedProviderVars(withoutSSHTunnelVars(env)),
+  )
+}
+
+/**
+ * Trusted setting sources whose env vars can be applied before the trust dialog.
+ *
+ * - userSettings (~/.claude/settings.json): controlled by the user, not project-specific
+ * - flagSettings (--settings CLI flag or SDK inline settings): explicitly passed by the user
+ * - policySettings (managed settings from enterprise API or local managed-settings.json):
+ *   controlled by IT/admin (highest priority, cannot be overridden)
+ *
+ * Project-scoped sources (projectSettings, localSettings) are excluded because they live
+ * inside the project directory and could be committed by a malicious actor to redirect
+ * traffic (e.g., ANTHROPIC_BASE_URL) to an attacker-controlled server.
+ */
+const TRUSTED_SETTING_SOURCES = [
+  'userSettings',
+  'flagSettings',
+  'policySettings',
+] as const
+
+/**
+ * Apply environment variables from trusted sources to process.env.
+ * Called before the trust dialog so that user/enterprise env vars like
+ * ANTHROPIC_BASE_URL take effect during first-run/onboarding.
+ *
+ * For trusted sources (user settings, managed settings, CLI flags), ALL env vars
+ * are applied — including ones like ANTHROPIC_BASE_URL that would be dangerous
+ * from project-scoped settings.
+ *
+ * For project-scoped sources (projectSettings, localSettings), only safe env vars
+ * from the SAFE_ENV_VARS allowlist are applied. These are applied after trust is
+ * fully established via applyConfigEnvironmentVariables().
+ */
+export function applySafeConfigEnvironmentVariables(): void {
+  // Capture CCD spawn-env keys before any settings.env is applied (once).
+  if (ccdSpawnEnvKeys === undefined) {
+    ccdSpawnEnvKeys =
+      process.env.CLAUDE_CODE_ENTRYPOINT === 'claude-desktop'
+        ? new Set(Object.keys(process.env))
+        : null
+  }
+
+  // Global config (~/.claude.json) is user-controlled. In CCD mode,
+  // filterSettingsEnv strips keys that were in the spawn env snapshot so
+  // the desktop host's operational vars (OTEL, etc.) are not overridden.
+  Object.assign(process.env, filterSettingsEnv(getGlobalConfig().env))
+
+  // Apply ALL env vars from trusted setting sources, policySettings last.
+  // Gate on isSettingSourceEnabled so SDK settingSources: [] (isolation mode)
+  // doesn't get clobbered by ~/.claude/settings.json env (gh#217). policy/flag
+  // sources are always enabled, so this only ever filters userSettings.
+  for (const source of TRUSTED_SETTING_SOURCES) {
+    if (source === 'policySettings') continue
+    if (!isSettingSourceEnabled(source)) continue
+    Object.assign(
+      process.env,
+      filterSettingsEnv(getSettingsForSource(source)?.env),
+    )
+  }
+
+  // Compute remote-managed-settings eligibility now, with userSettings and
+  // flagSettings env applied. Eligibility reads CLAUDE_CODE_USE_BEDROCK,
+  // ANTHROPIC_BASE_URL — both settable via settings.env.
+  // getSettingsForSource('policySettings') below consults the remote cache,
+  // which guards on this. The two-phase structure makes the ordering
+  // dependency visible: non-policy env → eligibility → policy env.
+  isRemoteManagedSettingsEligible()
+
+  Object.assign(
+    process.env,
+    filterSettingsEnv(getSettingsForSource('policySettings')?.env),
+  )
+
+  // Apply only safe env vars from the fully-merged settings (which includes
+  // project-scoped sources). For safe vars that also exist in trusted sources,
+  // the merged value (which may come from a higher-priority project source)
+  // will overwrite the trusted value — this is acceptable since these vars are
+  // in the safe allowlist. Only policySettings values are guaranteed to survive
+  // unchanged (it has the highest merge priority in both loops) — except
+  // provider-routing vars, which filterSettingsEnv strips from every source
+  // when CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST is set.
+  const settingsEnv = filterSettingsEnv(getSettings_DEPRECATED()?.env)
+  for (const [key, value] of Object.entries(settingsEnv)) {
+    if (SAFE_ENV_VARS.has(key.toUpperCase())) {
+      process.env[key] = value
+    }
+  }
+}
+
+/**
+ * Apply environment variables from settings to process.env.
+ * This applies ALL environment variables (except provider-routing vars when
+ * CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST is set — see filterSettingsEnv) and
+ * should only be called after trust is established. This applies potentially
+ * dangerous environment variables such as LD_PRELOAD, PATH, etc.
+ */
+export function applyConfigEnvironmentVariables(): void {
+  Object.assign(process.env, filterSettingsEnv(getGlobalConfig().env))
+
+  Object.assign(process.env, filterSettingsEnv(getSettings_DEPRECATED()?.env))
+
+  // Clear caches so agents are rebuilt with the new env vars
+  clearCACertsCache()
+  clearMTLSCache()
+  clearProxyCache()
+
+  // Reconfigure proxy/mTLS agents to pick up any proxy env vars from settings
+  configureGlobalAgents()
+}

package/utils/managedEnvConstants.ts

@@ -0,0 +1,191 @@
+/**
+ * Environment variables that control inference routing: which provider to use,
+ * which endpoint to hit, and which model IDs to send.
+ *
+ * When CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST is truthy in the spawn env, these
+ * are stripped from settings-sourced env so the host's routing config isn't
+ * overridden by a user's ~/.claude/settings.json — e.g. a Bedrock setup for
+ * terminal CLI that would break a host that only supports first-party auth.
+ *
+ * @[MODEL LAUNCH]: New models usually don't need changes here —
+ * VERTEX_REGION_CLAUDE_* is prefix-matched. New providers or new routing
+ * config vars (endpoint, project, region, auth) do.
+ */
+const PROVIDER_MANAGED_ENV_VARS = new Set([
+  // The flag itself — settings can't unset it once the host set it
+  'CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST',
+  // Provider selection
+  'CLAUDE_CODE_USE_BEDROCK',
+  'CLAUDE_CODE_USE_VERTEX',
+  'CLAUDE_CODE_USE_FOUNDRY',
+  // Endpoint config (base URLs, project/resource identifiers)
+  'ANTHROPIC_BASE_URL',
+  'ANTHROPIC_BEDROCK_BASE_URL',
+  'ANTHROPIC_VERTEX_BASE_URL',
+  'ANTHROPIC_FOUNDRY_BASE_URL',
+  'ANTHROPIC_FOUNDRY_RESOURCE',
+  'ANTHROPIC_VERTEX_PROJECT_ID',
+  // Region routing (per-model VERTEX_REGION_CLAUDE_* handled by prefix below)
+  'CLOUD_ML_REGION',
+  // Auth
+  'ANTHROPIC_API_KEY',
+  'ANTHROPIC_AUTH_TOKEN',
+  'CLAUDE_CODE_OAUTH_TOKEN',
+  'AWS_BEARER_TOKEN_BEDROCK',
+  'ANTHROPIC_FOUNDRY_API_KEY',
+  'CLAUDE_CODE_SKIP_BEDROCK_AUTH',
+  'CLAUDE_CODE_SKIP_VERTEX_AUTH',
+  'CLAUDE_CODE_SKIP_FOUNDRY_AUTH',
+  // Model defaults — often set to provider-specific ID formats
+  'ANTHROPIC_MODEL',
+  'ANTHROPIC_DEFAULT_HAIKU_MODEL',
+  'ANTHROPIC_DEFAULT_HAIKU_MODEL_DESCRIPTION',
+  'ANTHROPIC_DEFAULT_HAIKU_MODEL_NAME',
+  'ANTHROPIC_DEFAULT_HAIKU_MODEL_SUPPORTED_CAPABILITIES',
+  'ANTHROPIC_DEFAULT_OPUS_MODEL',
+  'ANTHROPIC_DEFAULT_OPUS_MODEL_DESCRIPTION',
+  'ANTHROPIC_DEFAULT_OPUS_MODEL_NAME',
+  'ANTHROPIC_DEFAULT_OPUS_MODEL_SUPPORTED_CAPABILITIES',
+  'ANTHROPIC_DEFAULT_SONNET_MODEL',
+  'ANTHROPIC_DEFAULT_SONNET_MODEL_DESCRIPTION',
+  'ANTHROPIC_DEFAULT_SONNET_MODEL_NAME',
+  'ANTHROPIC_DEFAULT_SONNET_MODEL_SUPPORTED_CAPABILITIES',
+  'ANTHROPIC_SMALL_FAST_MODEL',
+  'ANTHROPIC_SMALL_FAST_MODEL_AWS_REGION',
+  'CLAUDE_CODE_SUBAGENT_MODEL',
+])
+
+const PROVIDER_MANAGED_ENV_PREFIXES = [
+  // Per-model Vertex region overrides — scales with model releases, so
+  // prefix-matched to avoid drift on each launch.
+  'VERTEX_REGION_CLAUDE_',
+]
+
+export function isProviderManagedEnvVar(key: string): boolean {
+  const upper = key.toUpperCase()
+  return (
+    PROVIDER_MANAGED_ENV_VARS.has(upper) ||
+    PROVIDER_MANAGED_ENV_PREFIXES.some(p => upper.startsWith(p))
+  )
+}
+
+/**
+ * Dangerous shell settings that can execute arbitrary shell code
+ */
+export const DANGEROUS_SHELL_SETTINGS = [
+  'apiKeyHelper',
+  'awsAuthRefresh',
+  'awsCredentialExport',
+  'gcpAuthRefresh',
+  'otelHeadersHelper',
+  'statusLine',
+] as const
+
+/**
+ * Safe environment variables that can be applied before trust dialog.
+ * These are Claude Code specific settings that don't pose security risks.
+ *
+ * IMPORTANT: This is the source of truth for which env vars are safe.
+ * Any env var NOT in this list is considered dangerous and will trigger
+ * a security dialog when set via remote managed settings.
+ *
+ * Dangerous env vars (NOT in this list):
+ *
+ * === REDIRECT TO ATTACKER-CONTROLLED SERVER ===
+ * - ANTHROPIC_BASE_URL, ANTHROPIC_BEDROCK_BASE_URL, ANTHROPIC_FOUNDRY_BASE_URL, ANTHROPIC_VERTEX_BASE_URL
+ * - HTTP_PROXY, HTTPS_PROXY, NO_PROXY, http_proxy, https_proxy, no_proxy
+ * - OTEL_EXPORTER_OTLP_ENDPOINT, OTEL_EXPORTER_OTLP_LOGS_ENDPOINT, OTEL_EXPORTER_OTLP_METRICS_ENDPOINT
+ *
+ * === TRUST ATTACKER-CONTROLLED SERVER ===
+ * - NODE_TLS_REJECT_UNAUTHORIZED
+ * - NODE_EXTRA_CA_CERTS
+ *
+ * === SWITCH TO ATTACKER-CONTROLLED PROJECT ===
+ * - ANTHROPIC_FOUNDRY_RESOURCE
+ * - ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN
+ * - AWS_BEARER_TOKEN_BEDROCK
+ */
+export const SAFE_ENV_VARS = new Set([
+  'ANTHROPIC_CUSTOM_HEADERS',
+  'ANTHROPIC_CUSTOM_MODEL_OPTION',
+  'ANTHROPIC_CUSTOM_MODEL_OPTION_DESCRIPTION',
+  'ANTHROPIC_CUSTOM_MODEL_OPTION_NAME',
+  'ANTHROPIC_DEFAULT_HAIKU_MODEL',
+  'ANTHROPIC_DEFAULT_HAIKU_MODEL_DESCRIPTION',
+  'ANTHROPIC_DEFAULT_HAIKU_MODEL_NAME',
+  'ANTHROPIC_DEFAULT_HAIKU_MODEL_SUPPORTED_CAPABILITIES',
+  'ANTHROPIC_DEFAULT_OPUS_MODEL',
+  'ANTHROPIC_DEFAULT_OPUS_MODEL_DESCRIPTION',
+  'ANTHROPIC_DEFAULT_OPUS_MODEL_NAME',
+  'ANTHROPIC_DEFAULT_OPUS_MODEL_SUPPORTED_CAPABILITIES',
+  'ANTHROPIC_DEFAULT_SONNET_MODEL',
+  'ANTHROPIC_DEFAULT_SONNET_MODEL_DESCRIPTION',
+  'ANTHROPIC_DEFAULT_SONNET_MODEL_NAME',
+  'ANTHROPIC_DEFAULT_SONNET_MODEL_SUPPORTED_CAPABILITIES',
+  'ANTHROPIC_FOUNDRY_API_KEY',
+  'ANTHROPIC_MODEL',
+  'ANTHROPIC_SMALL_FAST_MODEL_AWS_REGION',
+  'ANTHROPIC_SMALL_FAST_MODEL',
+  'AWS_DEFAULT_REGION',
+  'AWS_PROFILE',
+  'AWS_REGION',
+  'BASH_DEFAULT_TIMEOUT_MS',
+  'BASH_MAX_OUTPUT_LENGTH',
+  'BASH_MAX_TIMEOUT_MS',
+  'CLAUDE_BASH_MAINTAIN_PROJECT_WORKING_DIR',
+  'CLAUDE_CODE_API_KEY_HELPER_TTL_MS',
+  'CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS',
+  'CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC',
+  'CLAUDE_CODE_DISABLE_TERMINAL_TITLE',
+  'CLAUDE_CODE_ENABLE_TELEMETRY',
+  'CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS',
+  'CLAUDE_CODE_IDE_SKIP_AUTO_INSTALL',
+  'CLAUDE_CODE_MAX_OUTPUT_TOKENS',
+  'CLAUDE_CODE_SKIP_BEDROCK_AUTH',
+  'CLAUDE_CODE_SKIP_FOUNDRY_AUTH',
+  'CLAUDE_CODE_SKIP_VERTEX_AUTH',
+  'CLAUDE_CODE_SUBAGENT_MODEL',
+  'CLAUDE_CODE_USE_BEDROCK',
+  'CLAUDE_CODE_USE_FOUNDRY',
+  'CLAUDE_CODE_USE_VERTEX',
+  'DISABLE_AUTOUPDATER',
+  'DISABLE_BUG_COMMAND',
+  'DISABLE_COST_WARNINGS',
+  'DISABLE_ERROR_REPORTING',
+  'DISABLE_FEEDBACK_COMMAND',
+  'DISABLE_TELEMETRY',
+  'ENABLE_TOOL_SEARCH',
+  'MAX_MCP_OUTPUT_TOKENS',
+  'MAX_THINKING_TOKENS',
+  'MCP_TIMEOUT',
+  'MCP_TOOL_TIMEOUT',
+  'OTEL_EXPORTER_OTLP_HEADERS',
+  'OTEL_EXPORTER_OTLP_LOGS_HEADERS',
+  'OTEL_EXPORTER_OTLP_LOGS_PROTOCOL',
+  'OTEL_EXPORTER_OTLP_METRICS_CLIENT_CERTIFICATE',
+  'OTEL_EXPORTER_OTLP_METRICS_CLIENT_KEY',
+  'OTEL_EXPORTER_OTLP_METRICS_HEADERS',
+  'OTEL_EXPORTER_OTLP_METRICS_PROTOCOL',
+  'OTEL_EXPORTER_OTLP_PROTOCOL',
+  'OTEL_EXPORTER_OTLP_TRACES_HEADERS',
+  'OTEL_LOG_TOOL_DETAILS',
+  'OTEL_LOG_USER_PROMPTS',
+  'OTEL_LOGS_EXPORT_INTERVAL',
+  'OTEL_LOGS_EXPORTER',
+  'OTEL_METRIC_EXPORT_INTERVAL',
+  'OTEL_METRICS_EXPORTER',
+  'OTEL_METRICS_INCLUDE_ACCOUNT_UUID',
+  'OTEL_METRICS_INCLUDE_SESSION_ID',
+  'OTEL_METRICS_INCLUDE_VERSION',
+  'OTEL_RESOURCE_ATTRIBUTES',
+  'USE_BUILTIN_RIPGREP',
+  'VERTEX_REGION_CLAUDE_3_5_HAIKU',
+  'VERTEX_REGION_CLAUDE_3_5_SONNET',
+  'VERTEX_REGION_CLAUDE_3_7_SONNET',
+  'VERTEX_REGION_CLAUDE_4_0_OPUS',
+  'VERTEX_REGION_CLAUDE_4_0_SONNET',
+  'VERTEX_REGION_CLAUDE_4_1_OPUS',
+  'VERTEX_REGION_CLAUDE_4_5_SONNET',
+  'VERTEX_REGION_CLAUDE_4_6_SONNET',
+  'VERTEX_REGION_CLAUDE_HAIKU_4_5',
+])