ccprofiles-core 0.10.0 → 0.10.2

package/dist/delegate.d.ts

@@ -8,7 +8,7 @@
  * so a Claude session cannot dispatch a native subagent onto Kimi, GLM, or Codex.
  */
 /** Env that pins a session to one account/provider. Must never survive into a delegate. */
-export declare const PROVIDER_ENV_KEYS: readonly ["CLAUDE_CONFIG_DIR", "CODEX_HOME", "ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_BASE_URL", "ANTHROPIC_MODEL", "ANTHROPIC_SMALL_FAST_MODEL", "ANTHROPIC_DEFAULT_OPUS_MODEL", "ANTHROPIC_DEFAULT_SONNET_MODEL", "ANTHROPIC_DEFAULT_HAIKU_MODEL"];
+export declare const PROVIDER_ENV_KEYS: readonly ["CLAUDE_CONFIG_DIR", "CODEX_HOME", "ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_BASE_URL", "ANTHROPIC_CUSTOM_HEADERS", "ANTHROPIC_MODEL", "ANTHROPIC_SMALL_FAST_MODEL", "ANTHROPIC_DEFAULT_OPUS_MODEL", "ANTHROPIC_DEFAULT_SONNET_MODEL", "ANTHROPIC_DEFAULT_HAIKU_MODEL", "CLAUDE_CODE_USE_BEDROCK", "CLAUDE_CODE_USE_VERTEX", "CLAUDE_CODE_SKIP_BEDROCK_AUTH", "CLAUDE_CODE_SKIP_VERTEX_AUTH", "AWS_BEARER_TOKEN_BEDROCK", "ANTHROPIC_BEDROCK_BASE_URL", "ANTHROPIC_VERTEX_BASE_URL", "ANTHROPIC_VERTEX_PROJECT_ID", "CLOUD_ML_REGION", "OPENAI_API_KEY", "OPENAI_BASE_URL"];
 export interface DelegateLaunch {
     command: string;
     args: string[];

package/dist/delegate.js

@@ -13,12 +13,29 @@ export const PROVIDER_ENV_KEYS = [
     'CODEX_HOME',
     'ANTHROPIC_API_KEY',
     'ANTHROPIC_AUTH_TOKEN',
+    // a direct auth override — left in place, the delegate authenticates as the *parent* account
+    'CLAUDE_CODE_OAUTH_TOKEN',
     'ANTHROPIC_BASE_URL',
+    // gateways route and bill on these, so they re-point a delegate as surely as a base URL
+    'ANTHROPIC_CUSTOM_HEADERS',
     'ANTHROPIC_MODEL',
     'ANTHROPIC_SMALL_FAST_MODEL',
     'ANTHROPIC_DEFAULT_OPUS_MODEL',
     'ANTHROPIC_DEFAULT_SONNET_MODEL',
     'ANTHROPIC_DEFAULT_HAIKU_MODEL',
+    // alternate backends: these switch the provider wholesale, ignoring ANTHROPIC_BASE_URL
+    'CLAUDE_CODE_USE_BEDROCK',
+    'CLAUDE_CODE_USE_VERTEX',
+    'CLAUDE_CODE_SKIP_BEDROCK_AUTH',
+    'CLAUDE_CODE_SKIP_VERTEX_AUTH',
+    'AWS_BEARER_TOKEN_BEDROCK',
+    'ANTHROPIC_BEDROCK_BASE_URL',
+    'ANTHROPIC_VERTEX_BASE_URL',
+    'ANTHROPIC_VERTEX_PROJECT_ID',
+    'CLOUD_ML_REGION',
+    // codex targets pin on the OpenAI pair, the exact mirror of the Anthropic leak
+    'OPENAI_API_KEY',
+    'OPENAI_BASE_URL',
 ];
 /**
  * Parent env minus every provider pin, plus the target's own.
@@ -55,7 +72,9 @@ export function buildDelegateLaunch(opts) {
     // codex resolves its workspace from --cd, not the spawn cwd
     if (codex)
         args.push('-C', opts.cwd);
-    args.push(opts.prompt);
+    // `--` or a prompt like "-fix the tests" is parsed as an option by the child and the whole
+    // delegation fails. Both `claude` (commander) and `codex exec` (clap) honour the separator.
+    args.push('--', opts.prompt);
     return {
         command: codex ? 'codex' : 'claude',
         args,

package/dist/handoff.d.ts

@@ -1,5 +1,13 @@
 import type { ProjectSessions, SessionTranscript } from './sessions.js';
-export declare function findLastSessionForCwd(scanned: ProjectSessions[], cwd: string, scope: string, agent: 'claude' | 'codex'): {
+import type { OsKind } from './platform.js';
+/**
+ * Compare two absolute paths the way the OS would. Windows is case-insensitive and mixes
+ * separators freely (`C:\p` / `c:/p` are one path), so a strict === there silently fails to
+ * match a session against its own project. POSIX is case-sensitive — normalizing it would
+ * merge genuinely distinct paths, so it stays exact.
+ */
+export declare function samePath(a: string, b: string, os: OsKind): boolean;
+export declare function findLastSessionForCwd(scanned: ProjectSessions[], cwd: string, scope: string, agent: 'claude' | 'codex', os?: OsKind): {
     scope: string;
     id: string;
 } | null;

package/dist/handoff.js

@@ -1,7 +1,19 @@
-export function findLastSessionForCwd(scanned, cwd, scope, agent) {
+/**
+ * Compare two absolute paths the way the OS would. Windows is case-insensitive and mixes
+ * separators freely (`C:\p` / `c:/p` are one path), so a strict === there silently fails to
+ * match a session against its own project. POSIX is case-sensitive — normalizing it would
+ * merge genuinely distinct paths, so it stays exact.
+ */
+export function samePath(a, b, os) {
+    if (os !== 'win32')
+        return a === b;
+    const norm = (p) => p.replace(/[\\/]+/g, '\\').replace(/(.)\\+$/, '$1').toLowerCase();
+    return norm(a) === norm(b);
+}
+export function findLastSessionForCwd(scanned, cwd, scope, agent, os = 'linux') {
     let newest = null;
     for (const p of scanned) {
-        if (p.project !== cwd || p.scope !== scope || p.agent !== agent)
+        if (!samePath(p.project, cwd, os) || p.scope !== scope || p.agent !== agent)
             continue;
         for (const s of p.sessions)
             if (!newest || s.mtime > newest.mtime)

package/dist/index.d.ts

@@ -17,5 +17,6 @@ export * from './bundle.js';
 export * from './sessions.js';
 export * from './handoff.js';
 export * from './delegate.js';
+export * from './scope.js';
 export * from './plugins.js';
 export * from './provider.js';

package/dist/index.js

@@ -17,5 +17,6 @@ export * from './bundle.js';
 export * from './sessions.js';
 export * from './handoff.js';
 export * from './delegate.js';
+export * from './scope.js';
 export * from './plugins.js';
 export * from './provider.js';

package/dist/scope.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Path-lane enforcement for parallel delegation.
+ *
+ * Running two agents at once is only safe while they touch disjoint files. A scope stated in
+ * the prompt is a request, not a constraint — models drift the moment a task turns out to need
+ * a shared type or config. These helpers turn "they probably stayed in their lane" into a
+ * checkable fact after the run.
+ */
+/**
+ * Glob → RegExp for the subset that matters here: `**` (any depth, may be empty), `*` (one
+ * segment), `?` (one char). Everything else is escaped literally. Deliberately not a full
+ * globbing implementation — a scope is a coarse directory lane, not a filter language.
+ */
+export declare function globToRegExp(glob: string): RegExp;
+/**
+ * A lane written as a bare directory (`src/web` or `src/web/`) means everything under it.
+ * Taken literally it would match exactly zero files and flag every in-lane edit as a
+ * violation — a footgun that makes the check useless in precisely the way that looks broken.
+ */
+export declare function normalizeScope(scope: string): string;
+/** True when `file` falls inside any lane. An empty scope list means "no lane declared". */
+export declare function inScope(file: string, scopes: string[]): boolean;
+export interface ScopeReport {
+    touched: string[];
+    violations: string[];
+}
+/**
+ * Which files the delegate touched, and which of those left the lane.
+ *
+ * `before`/`after` map a repo-relative path to a change fingerprint (see snapshotChanges).
+ * A path counts as touched if its fingerprint appeared, vanished, or moved — the vanish case
+ * matters because a delegate that reverts your edit or deletes your untracked file would
+ * otherwise be invisible.
+ *
+ * `committed` carries paths from commits the delegate made, which leave the working tree clean
+ * and so never show up in either snapshot at all.
+ */
+export declare function scopeReport(before: Map<string, string>, after: Map<string, string>, scopes: string[], committed?: string[]): ScopeReport;

package/dist/scope.js

@@ -0,0 +1,83 @@
+/**
+ * Path-lane enforcement for parallel delegation.
+ *
+ * Running two agents at once is only safe while they touch disjoint files. A scope stated in
+ * the prompt is a request, not a constraint — models drift the moment a task turns out to need
+ * a shared type or config. These helpers turn "they probably stayed in their lane" into a
+ * checkable fact after the run.
+ */
+/**
+ * Glob → RegExp for the subset that matters here: `**` (any depth, may be empty), `*` (one
+ * segment), `?` (one char). Everything else is escaped literally. Deliberately not a full
+ * globbing implementation — a scope is a coarse directory lane, not a filter language.
+ */
+export function globToRegExp(glob) {
+    let re = '';
+    for (let i = 0; i < glob.length; i++) {
+        const c = glob[i];
+        if (c === '*') {
+            if (glob[i + 1] === '*') {
+                i++;
+                if (glob[i + 1] === '/') {
+                    // mid-pattern `a/**/b` must also match `a/b`, so the whole group is optional
+                    i++;
+                    re += '(?:.*/)?';
+                }
+                else {
+                    // trailing `a/**` is "everything under a/", files included
+                    re += '.*';
+                }
+            }
+            else {
+                re += '[^/]*';
+            }
+        }
+        else if (c === '?') {
+            re += '[^/]';
+        }
+        else {
+            re += c.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+        }
+    }
+    return new RegExp(`^${re}$`);
+}
+/**
+ * A lane written as a bare directory (`src/web` or `src/web/`) means everything under it.
+ * Taken literally it would match exactly zero files and flag every in-lane edit as a
+ * violation — a footgun that makes the check useless in precisely the way that looks broken.
+ */
+export function normalizeScope(scope) {
+    const s = scope.replace(/\\/g, '/').replace(/\/+$/, '');
+    return /[*?]/.test(s) ? s : `${s}/**`;
+}
+/** True when `file` falls inside any lane. An empty scope list means "no lane declared". */
+export function inScope(file, scopes) {
+    if (!scopes.length)
+        return true;
+    const normalized = file.replace(/\\/g, '/');
+    return scopes.some(s => globToRegExp(normalizeScope(s)).test(normalized));
+}
+/**
+ * Which files the delegate touched, and which of those left the lane.
+ *
+ * `before`/`after` map a repo-relative path to a change fingerprint (see snapshotChanges).
+ * A path counts as touched if its fingerprint appeared, vanished, or moved — the vanish case
+ * matters because a delegate that reverts your edit or deletes your untracked file would
+ * otherwise be invisible.
+ *
+ * `committed` carries paths from commits the delegate made, which leave the working tree clean
+ * and so never show up in either snapshot at all.
+ */
+export function scopeReport(before, after, scopes, committed = []) {
+    const touched = new Set(committed.map(f => f.replace(/\\/g, '/')));
+    for (const [file, fp] of after) {
+        if (before.get(file) !== fp)
+            touched.add(file);
+    }
+    for (const file of before.keys()) {
+        if (!after.has(file))
+            touched.add(file); // reverted or deleted
+    }
+    const list = [...touched].sort();
+    return { touched: list, violations: list.filter(f => !inScope(f, scopes)) };
+}

package/dist/sessions.d.ts

@@ -36,8 +36,18 @@ export declare function sessionScanCacheStats(): {
     hits: number;
     misses: number;
 };
-/** Best-effort decode of Claude Code's project dir name (cwd from a record is preferred). */
+/**
+ * Last resort only — lossy, and unfixably so. Claude Code encodes a project path by replacing
+ * every '/' with '-', so a segment that legitimately contains a hyphen (`/Users/lp-stf00543`)
+ * cannot be told apart from a separator on the way back. Prefer the `cwd` recorded inside the
+ * session file; `headCwd` exists so that stays available even for files we decline to read.
+ */
 export declare function decodeProjectDir(name: string): string;
+/**
+ * First cwd found in a head slice. A slice cut mid-record leaves a partial trailing line, which
+ * simply fails JSON.parse and is skipped — no need to guess which line is incomplete.
+ */
+export declare function headCwd(head: string, pick: (rec: any) => string | undefined): string | null;
 export declare function scanSessions(opts: {
     sharedRoot: string;
     profiles: {

package/dist/sessions.js

@@ -1,4 +1,4 @@
-import { readdir, readFile, stat, lstat } from 'node:fs/promises';
+import { readdir, readFile, stat, lstat, open } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 const SAFE_SESSION_ID = /^[A-Za-z0-9_-]{1,160}$/;
@@ -7,6 +7,8 @@ const claudeSessionCache = new Map();
 const codexSessionCache = new Map();
 /** Per-file cap: a transcript above this size is summarized without reading its content. */
 const MAX_FILE_SCAN_BYTES = 10 * 1024 * 1024;
+// enough to reach the first record carrying cwd, without reading a multi-MB transcript
+const HEAD_SCAN_BYTES = 64 * 1024;
 /** Per-request cap: once this many bytes have been read from disk in one scanSessions() call,
  *  remaining (uncached) files are summarized without reading their content either. */
 const MAX_TOTAL_SCAN_BYTES = 50 * 1024 * 1024;
@@ -17,10 +19,52 @@ let scanCacheMisses = 0;
 export function sessionScanCacheStats() {
     return { hits: scanCacheHits, misses: scanCacheMisses };
 }
-/** Best-effort decode of Claude Code's project dir name (cwd from a record is preferred). */
+/**
+ * Last resort only — lossy, and unfixably so. Claude Code encodes a project path by replacing
+ * every '/' with '-', so a segment that legitimately contains a hyphen (`/Users/lp-stf00543`)
+ * cannot be told apart from a separator on the way back. Prefer the `cwd` recorded inside the
+ * session file; `headCwd` exists so that stays available even for files we decline to read.
+ */
 export function decodeProjectDir(name) {
     return name.replace(/^-/, '/').replace(/-/g, '/');
 }
+/** First `bytes` of a file, for cheap field recovery without reading a multi-MB transcript. */
+async function readHead(file, bytes = HEAD_SCAN_BYTES) {
+    let fh = null;
+    try {
+        fh = await open(file, 'r');
+        const buf = Buffer.alloc(bytes);
+        const { bytesRead } = await fh.read(buf, 0, bytes, 0);
+        return buf.subarray(0, bytesRead).toString('utf8');
+    }
+    catch {
+        return '';
+    }
+    finally {
+        await fh?.close().catch(() => { });
+    }
+}
+/**
+ * First cwd found in a head slice. A slice cut mid-record leaves a partial trailing line, which
+ * simply fails JSON.parse and is skipped — no need to guess which line is incomplete.
+ */
+export function headCwd(head, pick) {
+    for (const line of head.split('\n')) {
+        if (!line.trim())
+            continue;
+        let rec;
+        try {
+            rec = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        const v = pick(rec);
+        if (typeof v === 'string' && v)
+            return v;
+    }
+    return null;
+}
 /**
  * Shared mtime+size cache lookup for the two session-file formats. `parseFull` runs only on a
  * cache miss with a fresh read; `makeTruncated` builds a summary-only result when the file is
@@ -43,12 +87,12 @@ async function cachedParse(file, cache, budget, parseFull, makeTruncated) {
     }
     scanCacheMisses++;
     if (st.size > MAX_FILE_SCAN_BYTES) {
-        const result = makeTruncated(st);
+        const result = makeTruncated(st, await readHead(file));
         cache.set(file, { mtimeMs: st.mtimeMs, size: st.size, result });
         return result;
     }
     if (st.size > budget.bytesLeft)
-        return makeTruncated(st); // not cached — budget is per-request
+        return makeTruncated(st, await readHead(file)); // not cached — budget is per-request
     let raw;
     try {
         raw = await readFile(file, 'utf8');
@@ -90,7 +134,7 @@ async function parseClaudeSession(file, budget) {
                 break;
         }
         return { meta: { id, mtime: st.mtimeMs, messageCount: lines.length, firstPrompt, gitBranch, model, sizeBytes: st.size }, cwd };
-    }, st => ({ meta: { id, mtime: st.mtimeMs, messageCount: 0, firstPrompt: null, gitBranch: null, model: null, sizeBytes: st.size, truncated: true }, cwd: null }));
+    }, (st, head) => ({ meta: { id, mtime: st.mtimeMs, messageCount: 0, firstPrompt: null, gitBranch: null, model: null, sizeBytes: st.size, truncated: true }, cwd: headCwd(head, r => r.cwd) }));
 }
 async function scanProjectsDir(projectsDir, scope, budget) {
     if (!existsSync(projectsDir))
@@ -314,7 +358,7 @@ async function parseCodexSession(file, budget) {
         }
         id ??= fallbackId;
         return { meta: { id, mtime: st.mtimeMs, messageCount: messageCount || lines.length, firstPrompt, gitBranch, model, sizeBytes: st.size }, cwd };
-    }, st => ({ meta: { id: fallbackId, mtime: st.mtimeMs, messageCount: 0, firstPrompt: null, gitBranch: null, model: null, sizeBytes: st.size, truncated: true }, cwd: null }));
+    }, (st, head) => ({ meta: { id: fallbackId, mtime: st.mtimeMs, messageCount: 0, firstPrompt: null, gitBranch: null, model: null, sizeBytes: st.size, truncated: true }, cwd: headCwd(head, r => r?.payload?.cwd) }));
 }
 async function codexSessionFiles(dir) {
     let entries;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccprofiles-core",
-  "version": "0.10.0",
+  "version": "0.10.2",
   "description": "Core library for ccprofiles — discovery, manifest, secrets, apply, and LAN sync for Claude Code multi-account setups",
   "type": "module",
   "main": "./dist/index.js",