ccqa 0.12.0 → 0.13.1

package/dist/bin/ccqa.mjs

@@ -1168,9 +1168,44 @@ function resolveModel(explicit) {
 	const envModel = process.env["CCQA_MODEL"];
 	return envModel && envModel.length > 0 ? envModel : void 0;
 }
+/**
+* Standard Claude Code environment variables that select the API endpoint and
+* credentials. ccqa forwards whichever of these are set to the underlying
+* Claude Code process; it does not read or interpret their values.
+*
+* - `ANTHROPIC_BASE_URL`      — the API endpoint to send requests to.
+* - `ANTHROPIC_AUTH_TOKEN`    — sent as `Authorization: Bearer <token>`.
+* - `ANTHROPIC_API_KEY`       — API key, when used instead of a token.
+* - `ANTHROPIC_CUSTOM_HEADERS` — extra request headers.
+*/
+const ENDPOINT_ENV_KEYS = [
+	"ANTHROPIC_BASE_URL",
+	"ANTHROPIC_AUTH_TOKEN",
+	"ANTHROPIC_API_KEY",
+	"ANTHROPIC_CUSTOM_HEADERS"
+];
+/**
+* Collects the endpoint/auth variables set in the current process environment
+* so they can be forwarded, verbatim, to every Claude Code invocation. Returns
+* only the keys that are actually set (non-empty), so unset variables never
+* override the SDK's own defaults.
+*/
+function resolveEndpointEnv() {
+	const endpointEnv = {};
+	for (const key of ENDPOINT_ENV_KEYS) {
+		const value = process.env[key];
+		if (value && value.length > 0) endpointEnv[key] = value;
+	}
+	return endpointEnv;
+}
 async function invokeClaudeStreaming(options, onEvent) {
 	const { prompt, systemPrompt, allowedTools, disableBuiltinTools = false, maxTurns, env, model, cwd, onAbAction, onAbActionFailed, silenceBashLog = false, relaxAbConstraints = false } = options;
 	const resolvedModel = resolveModel(model);
+	const hasEndpointEnv = Object.keys(resolveEndpointEnv()).length > 0;
+	const mergedEnv = env || hasEndpointEnv ? {
+		...process.env,
+		...env
+	} : void 0;
 	let lastAbToolUseId = null;
 	const claimAbToolUse = (toolUseId) => {
 		if (toolUseId !== lastAbToolUseId) return false;
@@ -1185,10 +1220,7 @@ async function invokeClaudeStreaming(options, onEvent) {
 		allowDangerouslySkipPermissions: true,
 		...resolvedModel ? { model: resolvedModel } : {},
 		...cwd ? { cwd } : {},
-		...env ? { env: {
-			...process.env,
-			...env
-		} } : {},
+		...mergedEnv ? { env: mergedEnv } : {},
 		...disableBuiltinTools ? { tools: [] } : {},
 		hooks: onAbAction || onAbActionFailed ? {
 			PreToolUse: [{ hooks: [async (input) => {
@@ -3199,6 +3231,44 @@ function resolveProjectOrThrow(project, cwd) {
 */
 const hubUrlOption = ["--hub-url <url>", "ccqa hub base URL (or CCQA_HUB_URL)."];
 const hubTokenOption = ["--hub-token <token>", "ccqa hub bearer token (or CCQA_HUB_TOKEN)."];
+const hubHeaderOption = [
+	"--hub-header <header>",
+	"Extra header sent with every hub request, as \"key:value\" (or CCQA_HUB_HEADER). Repeatable. For infra that gates the hub behind a header check (e.g. a load balancer bypass rule).",
+	collectHubHeader,
+	[]
+];
+/** commander `--hub-header` accumulator: collects repeated flags into an array. */
+function collectHubHeader(value, previous) {
+	return [...previous, value];
+}
+/**
+* Parse `"key:value"` entries (from `--hub-header`, repeatable) into a
+* headers map. The value may itself contain `:` (e.g. a URL), so only the
+* first colon is treated as the separator. Throws on an entry with no colon.
+*/
+function parseHubHeaders(entries) {
+	const headers = {};
+	for (const entry of entries) {
+		const i = entry.indexOf(":");
+		if (i < 0) throw new Error(`invalid --hub-header (expected "key:value"): ${entry}`);
+		const key = entry.slice(0, i).trim();
+		const value = entry.slice(i + 1).trim();
+		if (!key) throw new Error(`invalid --hub-header (expected "key:value"): ${entry}`);
+		headers[key] = value;
+	}
+	return headers;
+}
+/**
+* Resolve custom hub headers from flags, falling back to `CCQA_HUB_HEADER`
+* (a single `"key:value"` entry) when no `--hub-header` flag was given.
+* CI setups typically pass exactly one gateway header via env; `--hub-header`
+* is repeatable for the (rarer) local/multi-header case.
+*/
+function resolveHubHeaders(hubHeader) {
+	if (hubHeader && hubHeader.length > 0) return parseHubHeaders(hubHeader);
+	const envHeader = process.env.CCQA_HUB_HEADER;
+	if (envHeader) return parseHubHeaders([envHeader]);
+}
 /** Thrown by `requireHubClient` when the URL and/or token can't be resolved from flags/env. */
 var HubConnectionError = class extends Error {
 	constructor(message) {
@@ -3215,9 +3285,11 @@ function resolveHubClient(opts) {
 	const baseUrl = opts.hubUrl ?? process.env.CCQA_HUB_URL;
 	const token = opts.hubToken ?? process.env.CCQA_HUB_TOKEN;
 	if (!baseUrl || !token) return null;
+	const headers = resolveHubHeaders(opts.hubHeader);
 	return createHubClient({
 		baseUrl: baseUrl.replace(/\/+$/, ""),
-		token
+		token,
+		...headers ? { headers } : {}
 	});
 }
 /** Same as `resolveHubClient`, but throws `HubConnectionError` instead of returning `null`. */
@@ -3286,7 +3358,7 @@ function addProfileOption(command) {
 * options so help text and behaviour don't drift.
 */
 function addHubOptions(command) {
-	return command.option(...hubUrlOption).option(...hubTokenOption);
+	return command.option(...hubUrlOption).option(...hubTokenOption).option(...hubHeaderOption);
 }
 /**
 * CLI wrapper around `resolveProfileEnv`: on failure, print the error and
@@ -5218,7 +5290,8 @@ async function executeRun(targets, opts) {
 				project: projectForProfile,
 				cwd,
 				hubUrl: opts.hubUrl,
-				hubToken: opts.hubToken
+				hubToken: opts.hubToken,
+				hubHeader: opts.hubHeader
 			});
 		} else await resolveProfileEnv({
 			profile: void 0,
@@ -5236,6 +5309,7 @@ async function executeRun(targets, opts) {
 		hubCtx = resolveHubContext({
 			hubUrl: opts.hubUrl,
 			hubToken: opts.hubToken,
+			hubHeader: opts.hubHeader,
 			project: opts.project,
 			cwd
 		});
@@ -8597,7 +8671,8 @@ const recordCommand = addHubOptions(addProfileOption(addLanguageOption(new Comma
 		project,
 		cwd: cwdForProfile,
 		hubUrl: opts.hubUrl,
-		hubToken: opts.hubToken
+		hubToken: opts.hubToken,
+		hubHeader: opts.hubHeader
 	});
 	else await applyProfileFromOption({
 		profile: void 0,
@@ -8606,7 +8681,8 @@ const recordCommand = addHubOptions(addProfileOption(addLanguageOption(new Comma
 	});
 	const hubClientForTrace = resolveHubClient({
 		hubUrl: opts.hubUrl,
-		hubToken: opts.hubToken
+		hubToken: opts.hubToken,
+		hubHeader: opts.hubHeader
 	});
 	const hubContext = hubClientForTrace && project ? {
 		hub: hubClientForTrace,
@@ -9325,7 +9401,7 @@ Return the spec keys that might be affected by any of the new files. Conservativ
 //#endregion
 //#region src/cli/drift.ts
 const DEFAULT_CONCURRENCY = 3;
-const driftCommand = addLanguageOption(new Command("drift").argument("[feature/spec]", "Optional spec id. If omitted, every spec under .ccqa/features/ is checked.").description("Standalone spec ↔ codebase static audit. Use for PR checks where the browser isn't run. For run-time audit with a structured report, see `ccqa run --report`.").option("--format <fmt>", "Output format: text | json | github", "text").option("--severity <level>", "Exit non-zero on this severity or higher: warn | error", "error").option("--concurrency <n>", `Parallel spec checks (default: ${DEFAULT_CONCURRENCY})`).option("-m, --model <name>", "Claude model alias ('sonnet'|'opus'|'haiku') or full ID. Overrides CCQA_MODEL.").option("--cwd <path>", "Working directory used as both the .ccqa root and the codebase Claude reads. Useful for monorepos. Defaults to process.cwd().").option("--changed", "Restrict drift checks to specs whose relatedPaths intersect the git diff against --base (or, in CI, $GITHUB_BASE_REF, else origin/main). New files are routed to specs via a single lightweight Claude call.").option("--base <ref>", "Base ref to diff against when --changed is set. Defaults to $GITHUB_BASE_REF (CI) or origin/main.").option("--push", "Push the drift result to a ccqa hub as a run (kind: drift).").option("--project <name>", "Logical project name for the pushed run. Defaults to the current directory's name.").option(...hubUrlOption).option(...hubTokenOption)).action(async (specPath, opts) => {
+const driftCommand = addLanguageOption(new Command("drift").argument("[feature/spec]", "Optional spec id. If omitted, every spec under .ccqa/features/ is checked.").description("Standalone spec ↔ codebase static audit. Use for PR checks where the browser isn't run. For run-time audit with a structured report, see `ccqa run --report`.").option("--format <fmt>", "Output format: text | json | github", "text").option("--severity <level>", "Exit non-zero on this severity or higher: warn | error", "error").option("--concurrency <n>", `Parallel spec checks (default: ${DEFAULT_CONCURRENCY})`).option("-m, --model <name>", "Claude model alias ('sonnet'|'opus'|'haiku') or full ID. Overrides CCQA_MODEL.").option("--cwd <path>", "Working directory used as both the .ccqa root and the codebase Claude reads. Useful for monorepos. Defaults to process.cwd().").option("--changed", "Restrict drift checks to specs whose relatedPaths intersect the git diff against --base (or, in CI, $GITHUB_BASE_REF, else origin/main). New files are routed to specs via a single lightweight Claude call.").option("--base <ref>", "Base ref to diff against when --changed is set. Defaults to $GITHUB_BASE_REF (CI) or origin/main.").option("--push", "Push the drift result to a ccqa hub as a run (kind: drift).").option("--project <name>", "Logical project name for the pushed run. Defaults to the current directory's name.").option(...hubUrlOption).option(...hubTokenOption).option(...hubHeaderOption)).action(async (specPath, opts) => {
 	const format = parseFormat(opts.format);
 	const threshold = parseSeverity(opts.severity);
 	const concurrency = parseConcurrency(opts.concurrency);
@@ -11597,7 +11673,7 @@ const CSS = `
      order decides). */
   .chip.kind-chip { color: var(--violet); background: var(--violet-bg); border-color: var(--violet-border); font-family: var(--font); margin-left: 6px; }
   .chip.drift-count-chip { color: var(--amber); background: var(--amber-bg); border-color: var(--amber-border); margin-left: 6px; }
-  .chip.drift-errors-chip { color: var(--fail); background: var(--fail-bg); border-color: var(--fail-border); }
+  .chip.drift-errors-chip { color: var(--fail); background: var(--fail-bg); border-color: var(--fail-border); margin-left: 6px; }
   .drift-meta-box { display: flex; flex-direction: column; gap: 4px; }
   .drift-meta-chips { display: flex; gap: 6px; }
   .specs { display: inline-flex; align-items: center; gap: 9px; }

package/dist/hub-client/index.d.mts

@@ -181,6 +181,12 @@ type LabelsExport = z.infer<typeof LabelsExportSchema>;
 interface HubClientOptions {
   baseUrl: string;
   token: string;
+  /**
+   * Extra headers sent on every request, ahead of any per-call headers and
+   * the `Authorization` header (e.g. an infra gateway/ALB bypass header in
+   * CI — never overrides `Authorization`).
+   */
+  headers?: Record<string, string>;
   /** Override for testing; defaults to the global `fetch`. */
   fetchImpl?: typeof fetch;
 }

package/dist/hub-client/index.mjs

@@ -51,6 +51,7 @@ function createHubClient(opts) {
 					...init,
 					signal,
 					headers: {
+						...opts.headers,
 						...init.headers,
 						Authorization: `Bearer ${opts.token}`
 					}

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccqa",
-  "version": "0.12.0",
+  "version": "0.13.1",
   "type": "module",
   "description": "Browser test recorder powered by Claude Code and agent-browser",
   "repository": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccqa",
-  "version": "0.12.0",
+  "version": "0.13.1",
   "type": "module",
   "description": "Browser test recorder powered by Claude Code and agent-browser",
   "repository": {