ccprofiles-core 0.10.1 → 0.10.3

package/README.md

@@ -8,6 +8,9 @@ It provides the discovery, manifest, secrets, apply, and LAN-sync logic used by
 - Applies profile config (launchers, env, links, MCP servers) with surgical, backed-up edits
 - Reads/writes secrets across macOS Keychain, libsecret, and encrypted-file backends
 - Computes MCP server drift across profiles and both agents (Claude + Codex)
+- Builds headless launches that run one profile's agent as a subagent of another session, stripping the caller's provider env so a gateway profile cannot re-point a Claude delegate (`delegate.ts`)
+- Checks which files a delegate touched against a declared path lane, counting created, edited, deleted, reverted, and committed work (`scope.ts`)
+- Mirrors one `statusLine` block into every claude profile, since Claude Code reads it per `CLAUDE_CONFIG_DIR`
 - Drives encrypted, PIN-paired LAN replication between machines
 
 Repo: [github.com/tmfadhlul/claude-code-profile](https://github.com/tmfadhlul/claude-code-profile)

package/dist/delegate.d.ts

@@ -8,7 +8,7 @@
  * so a Claude session cannot dispatch a native subagent onto Kimi, GLM, or Codex.
  */
 /** Env that pins a session to one account/provider. Must never survive into a delegate. */
-export declare const PROVIDER_ENV_KEYS: readonly ["CLAUDE_CONFIG_DIR", "CODEX_HOME", "ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_BASE_URL", "ANTHROPIC_MODEL", "ANTHROPIC_SMALL_FAST_MODEL", "ANTHROPIC_DEFAULT_OPUS_MODEL", "ANTHROPIC_DEFAULT_SONNET_MODEL", "ANTHROPIC_DEFAULT_HAIKU_MODEL"];
+export declare const PROVIDER_ENV_KEYS: readonly ["CLAUDE_CONFIG_DIR", "CODEX_HOME", "ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "CLAUDE_CODE_OAUTH_TOKEN", "ANTHROPIC_BASE_URL", "ANTHROPIC_CUSTOM_HEADERS", "ANTHROPIC_MODEL", "ANTHROPIC_SMALL_FAST_MODEL", "ANTHROPIC_DEFAULT_OPUS_MODEL", "ANTHROPIC_DEFAULT_SONNET_MODEL", "ANTHROPIC_DEFAULT_HAIKU_MODEL", "CLAUDE_CODE_USE_BEDROCK", "CLAUDE_CODE_USE_VERTEX", "CLAUDE_CODE_SKIP_BEDROCK_AUTH", "CLAUDE_CODE_SKIP_VERTEX_AUTH", "AWS_BEARER_TOKEN_BEDROCK", "ANTHROPIC_BEDROCK_BASE_URL", "ANTHROPIC_VERTEX_BASE_URL", "ANTHROPIC_VERTEX_PROJECT_ID", "CLOUD_ML_REGION", "OPENAI_API_KEY", "OPENAI_BASE_URL"];
 export interface DelegateLaunch {
     command: string;
     args: string[];

package/dist/delegate.js

@@ -13,12 +13,29 @@ export const PROVIDER_ENV_KEYS = [
     'CODEX_HOME',
     'ANTHROPIC_API_KEY',
     'ANTHROPIC_AUTH_TOKEN',
+    // a direct auth override — left in place, the delegate authenticates as the *parent* account
+    'CLAUDE_CODE_OAUTH_TOKEN',
     'ANTHROPIC_BASE_URL',
+    // gateways route and bill on these, so they re-point a delegate as surely as a base URL
+    'ANTHROPIC_CUSTOM_HEADERS',
     'ANTHROPIC_MODEL',
     'ANTHROPIC_SMALL_FAST_MODEL',
     'ANTHROPIC_DEFAULT_OPUS_MODEL',
     'ANTHROPIC_DEFAULT_SONNET_MODEL',
     'ANTHROPIC_DEFAULT_HAIKU_MODEL',
+    // alternate backends: these switch the provider wholesale, ignoring ANTHROPIC_BASE_URL
+    'CLAUDE_CODE_USE_BEDROCK',
+    'CLAUDE_CODE_USE_VERTEX',
+    'CLAUDE_CODE_SKIP_BEDROCK_AUTH',
+    'CLAUDE_CODE_SKIP_VERTEX_AUTH',
+    'AWS_BEARER_TOKEN_BEDROCK',
+    'ANTHROPIC_BEDROCK_BASE_URL',
+    'ANTHROPIC_VERTEX_BASE_URL',
+    'ANTHROPIC_VERTEX_PROJECT_ID',
+    'CLOUD_ML_REGION',
+    // codex targets pin on the OpenAI pair, the exact mirror of the Anthropic leak
+    'OPENAI_API_KEY',
+    'OPENAI_BASE_URL',
 ];
 /**
  * Parent env minus every provider pin, plus the target's own.
@@ -55,7 +72,9 @@ export function buildDelegateLaunch(opts) {
     // codex resolves its workspace from --cd, not the spawn cwd
     if (codex)
         args.push('-C', opts.cwd);
-    args.push(opts.prompt);
+    // `--` or a prompt like "-fix the tests" is parsed as an option by the child and the whole
+    // delegation fails. Both `claude` (commander) and `codex exec` (clap) honour the separator.
+    args.push('--', opts.prompt);
     return {
         command: codex ? 'codex' : 'claude',
         args,

package/dist/index.d.ts

@@ -17,5 +17,6 @@ export * from './bundle.js';
 export * from './sessions.js';
 export * from './handoff.js';
 export * from './delegate.js';
+export * from './scope.js';
 export * from './plugins.js';
 export * from './provider.js';

package/dist/index.js

@@ -17,5 +17,6 @@ export * from './bundle.js';
 export * from './sessions.js';
 export * from './handoff.js';
 export * from './delegate.js';
+export * from './scope.js';
 export * from './plugins.js';
 export * from './provider.js';

package/dist/scope.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Path-lane enforcement for parallel delegation.
+ *
+ * Running two agents at once is only safe while they touch disjoint files. A scope stated in
+ * the prompt is a request, not a constraint — models drift the moment a task turns out to need
+ * a shared type or config. These helpers turn "they probably stayed in their lane" into a
+ * checkable fact after the run.
+ */
+/**
+ * Glob → RegExp for the subset that matters here: `**` (any depth, may be empty), `*` (one
+ * segment), `?` (one char). Everything else is escaped literally. Deliberately not a full
+ * globbing implementation — a scope is a coarse directory lane, not a filter language.
+ */
+export declare function globToRegExp(glob: string): RegExp;
+/**
+ * A lane written as a bare directory (`src/web` or `src/web/`) means everything under it.
+ * Taken literally it would match exactly zero files and flag every in-lane edit as a
+ * violation — a footgun that makes the check useless in precisely the way that looks broken.
+ */
+export declare function normalizeScope(scope: string): string;
+/** True when `file` falls inside any lane. An empty scope list means "no lane declared". */
+export declare function inScope(file: string, scopes: string[]): boolean;
+export interface ScopeReport {
+    touched: string[];
+    violations: string[];
+}
+/**
+ * Which files the delegate touched, and which of those left the lane.
+ *
+ * `before`/`after` map a repo-relative path to a change fingerprint (see snapshotChanges).
+ * A path counts as touched if its fingerprint appeared, vanished, or moved — the vanish case
+ * matters because a delegate that reverts your edit or deletes your untracked file would
+ * otherwise be invisible.
+ *
+ * `committed` carries paths from commits the delegate made, which leave the working tree clean
+ * and so never show up in either snapshot at all.
+ */
+export declare function scopeReport(before: Map<string, string>, after: Map<string, string>, scopes: string[], committed?: string[]): ScopeReport;

package/dist/scope.js

@@ -0,0 +1,83 @@
+/**
+ * Path-lane enforcement for parallel delegation.
+ *
+ * Running two agents at once is only safe while they touch disjoint files. A scope stated in
+ * the prompt is a request, not a constraint — models drift the moment a task turns out to need
+ * a shared type or config. These helpers turn "they probably stayed in their lane" into a
+ * checkable fact after the run.
+ */
+/**
+ * Glob → RegExp for the subset that matters here: `**` (any depth, may be empty), `*` (one
+ * segment), `?` (one char). Everything else is escaped literally. Deliberately not a full
+ * globbing implementation — a scope is a coarse directory lane, not a filter language.
+ */
+export function globToRegExp(glob) {
+    let re = '';
+    for (let i = 0; i < glob.length; i++) {
+        const c = glob[i];
+        if (c === '*') {
+            if (glob[i + 1] === '*') {
+                i++;
+                if (glob[i + 1] === '/') {
+                    // mid-pattern `a/**/b` must also match `a/b`, so the whole group is optional
+                    i++;
+                    re += '(?:.*/)?';
+                }
+                else {
+                    // trailing `a/**` is "everything under a/", files included
+                    re += '.*';
+                }
+            }
+            else {
+                re += '[^/]*';
+            }
+        }
+        else if (c === '?') {
+            re += '[^/]';
+        }
+        else {
+            re += c.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+        }
+    }
+    return new RegExp(`^${re}$`);
+}
+/**
+ * A lane written as a bare directory (`src/web` or `src/web/`) means everything under it.
+ * Taken literally it would match exactly zero files and flag every in-lane edit as a
+ * violation — a footgun that makes the check useless in precisely the way that looks broken.
+ */
+export function normalizeScope(scope) {
+    const s = scope.replace(/\\/g, '/').replace(/\/+$/, '');
+    return /[*?]/.test(s) ? s : `${s}/**`;
+}
+/** True when `file` falls inside any lane. An empty scope list means "no lane declared". */
+export function inScope(file, scopes) {
+    if (!scopes.length)
+        return true;
+    const normalized = file.replace(/\\/g, '/');
+    return scopes.some(s => globToRegExp(normalizeScope(s)).test(normalized));
+}
+/**
+ * Which files the delegate touched, and which of those left the lane.
+ *
+ * `before`/`after` map a repo-relative path to a change fingerprint (see snapshotChanges).
+ * A path counts as touched if its fingerprint appeared, vanished, or moved — the vanish case
+ * matters because a delegate that reverts your edit or deletes your untracked file would
+ * otherwise be invisible.
+ *
+ * `committed` carries paths from commits the delegate made, which leave the working tree clean
+ * and so never show up in either snapshot at all.
+ */
+export function scopeReport(before, after, scopes, committed = []) {
+    const touched = new Set(committed.map(f => f.replace(/\\/g, '/')));
+    for (const [file, fp] of after) {
+        if (before.get(file) !== fp)
+            touched.add(file);
+    }
+    for (const file of before.keys()) {
+        if (!after.has(file))
+            touched.add(file); // reverted or deleted
+    }
+    const list = [...touched].sort();
+    return { touched: list, violations: list.filter(f => !inScope(f, scopes)) };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccprofiles-core",
-  "version": "0.10.1",
+  "version": "0.10.3",
   "description": "Core library for ccprofiles — discovery, manifest, secrets, apply, and LAN sync for Claude Code multi-account setups",
   "type": "module",
   "main": "./dist/index.js",