claude-gpt-launcher 1.0.0

package/.codex/skills/claude-gpt-launcher/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: claude-gpt-launcher
+description: Install, diagnose, open, unregister, or remove Claude GPT Launcher and its Codex MCP bridge. Use when a user asks to set up the launcher, verify prerequisites, manage the claude-gpt-harness MCP, or troubleshoot installation state on an Apple silicon Mac.
+---
+
+# Claude GPT Launcher
+
+Start with a read-only diagnostic:
+
+```zsh
+claude-gpt-launcher doctor --json
+```
+
+If the command is missing, install it from npm:
+
+```zsh
+npm install --global claude-gpt-launcher
+```
+
+Install the backend helper and native app explicitly:
+
+```zsh
+claude-gpt-launcher install
+```
+
+Register the optional Codex bridge only when requested:
+
+```zsh
+claude-gpt-launcher mcp install --enable-edits
+claude-gpt-launcher mcp status --json
+```
+
+For sensitive repositories, pass comma-separated remote substrings:
+
+```zsh
+claude-gpt-launcher mcp install --enable-edits --protected-remotes "company/production,example/private-app"
+```
+
+Use `claude-gpt-launcher open` to open the installed app. Use
+`claude-gpt-launcher mcp remove` to remove only the MCP registration. Run
+`claude-gpt-launcher uninstall` only when the user explicitly asks to remove
+the app, backend helper, and MCP registration.
+
+Never request, print, extract, or pass OAuth tokens through CLI flags. Report
+missing provider authentication and direct the user to the provider-supported
+login flow.

package/.codex/skills/claude-gpt-launcher/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Claude GPT Launcher"
+  short_description: "Install and operate the local harness bridge"
+  default_prompt: "Use $claude-gpt-launcher to verify and manage the local Claude GPT launcher."

package/CONTRIBUTING.md

@@ -0,0 +1,23 @@
+# Contributing
+
+Thanks for helping improve Claude GPT Launcher.
+
+## Before opening a pull request
+
+1. Keep the change focused and avoid unrelated refactors.
+2. Never commit OAuth material, API keys, private repository content, personal
+   paths, or real account identifiers.
+3. Preserve localhost-only networking and explicit edit authorization.
+4. Run the complete validation suite:
+
+```zsh
+npm test
+npm run pack:check
+```
+
+5. Explain the user-facing effect and any security-boundary change.
+
+## Reporting security problems
+
+Follow [SECURITY.md](SECURITY.md). Do not open a public issue containing exploit
+details or credentials.

package/Claude-GPT-Launcher-threat-model.md

@@ -0,0 +1,191 @@
+# Claude GPT Launcher threat model
+
+## Executive summary
+
+The highest residual risks are npm supply-chain compromise and prompt-driven
+access to sensitive local files when processing an untrusted repository. The
+launcher now avoids install-time scripts, publishes through an OIDC-ready
+workflow, notarizes hardened-runtime app archives, pins resolved executable
+paths, selects an unused localhost port, validates real repository paths,
+limits MCP work, and refuses to overwrite unrelated local artifacts. It is still a
+same-user developer tool rather than an OS sandbox, so untrusted repositories
+should run in a disposable account or container.
+
+## Scope and assumptions
+
+- In scope: `npm/`, `script/`, `Sources/ClaudeGPTMCP/`,
+  `Sources/ClaudeGPTLauncher/`, `Resources/`, and npm packaging metadata.
+- Runtime assumption: individual Apple-silicon Mac developer account with
+  Claude Code, Codex, and the proxy installed intentionally.
+- Distribution assumption: public npm package; no lifecycle `postinstall`.
+- Data assumption: repository content and prompts may be confidential; OAuth
+  credentials stay in provider-supported storage.
+- Out of scope: security of Claude Code, Codex, the proxy implementation, model
+  providers, npm itself, and a fully compromised local user account.
+
+Open questions that could change ranking:
+
+- Enterprise or shared-Mac deployment would increase local isolation risk.
+- Automated CI use would require non-interactive credential and artifact rules.
+- Supporting untrusted third-party repositories would make OS sandboxing a
+  release requirement rather than a recommendation.
+
+## System model
+
+### Primary components
+
+- npm CLI: explicit installation, diagnostics, MCP registration, and removal
+  (`npm/cli.mjs`).
+- Native SwiftUI launcher: selects a Git repository and opens Terminal
+  (`Sources/ClaudeGPTLauncher/`).
+- Backend wrapper: starts a loopback proxy and Claude Code process
+  (`script/claude-gpt`).
+- MCP server: validates requests and delegates bounded plan/edit tasks
+  (`Sources/ClaudeGPTMCP/`).
+- Build/package tooling: ad-hoc signs local builds and separately creates a
+  Developer ID signed, notarized, stapled, checksummed release archive
+  (`script/build_and_run.sh`, `script/release_macos.sh`, `package.json`).
+
+### Data flows and trust boundaries
+
+- npm registry → npm CLI: package source and executable scripts; npm integrity
+  metadata applies, but publisher-account compromise remains possible.
+- User → npm CLI: explicit commands and repository-protection patterns; parsed
+  as argument arrays without a shell.
+- Codex → MCP server: newline-delimited JSON-RPC containing repository paths,
+  prompts, models, and edit intent; schema and size controls are applied.
+- MCP server → backend wrapper: validated repository root and fixed CLI flags;
+  environment is reduced to a narrow allowlist.
+- Backend wrapper → loopback proxy: prompts and model traffic over a randomly
+  selected `127.0.0.1` port; an occupied port fails closed.
+- Claude Code → repository: read or edit tools under the user's OS account;
+  tool restrictions and deny patterns apply, but no OS sandbox exists.
+
+#### Diagram
+
+```mermaid
+flowchart LR
+  NPM["npm registry"] --> CLI["npm CLI"]
+  USER["Local user"] --> CLI
+  CLI --> APP["macOS app"]
+  CODEX["Codex"] --> MCP["MCP server"]
+  APP --> WRAP["Backend wrapper"]
+  MCP --> WRAP
+  WRAP --> PROXY["Loopback proxy"]
+  WRAP --> CLAUDE["Claude Code"]
+  CLAUDE --> REPO["Git repository"]
+  PROXY --> PROVIDER["Model provider"]
+```
+
+## Assets and security objectives
+
+| Asset | Why it matters | Security objective (C/I/A) |
+|---|---|---|
+| Repository content | May contain proprietary source and configuration | C/I |
+| OAuth credentials | Account compromise could consume subscription access | C/I |
+| Local filesystem | Same-user processes can access personal developer files | C/I/A |
+| MCP edit authorization | Controls whether delegated changes are permitted | I |
+| npm package and app bundle | Compromise executes code under the installer user | I |
+| Proxy availability | Required for model-backed sessions | A |
+| Logs and MCP output | May contain code, paths, or errors | C |
+
+## Attacker model
+
+### Capabilities
+
+- Publish or substitute a malicious npm package after publisher compromise.
+- Commit prompt-injection content to a repository the user opens.
+- Invoke the local MCP if the attacker already controls a permitted Codex/MCP
+  client under the same user account.
+- Race or occupy local ports and place executables earlier in a hostile `PATH`.
+- Supply malformed paths, symlinks, prompts, and oversized MCP work requests.
+
+### Non-capabilities
+
+- No unauthenticated internet listener is exposed by this repository.
+- A remote attacker cannot directly call the stdio MCP without local process
+  access.
+- The tool does not intentionally read or store OAuth tokens.
+- The model cannot execute Bash through the MCP's declared tool set.
+
+## Entry points and attack surfaces
+
+| Surface | How reached | Trust boundary | Notes | Evidence |
+|---|---|---|---|---|
+| npm CLI arguments | Local shell or `npx` | User → CLI | Explicit write commands; JSON mode | `npm/cli.mjs` command switch |
+| npm package install | npm registry | Registry → local user | No `postinstall`; package still contains executable code | `package.json` scripts and bin |
+| Project picker | Native app | User → app | Resolves selected Git root | `ProjectInspector.swift` |
+| MCP JSON-RPC | Codex stdio | Codex → MCP | Plan and gated edit tools | `ClaudeGPTMCPServer.swift` |
+| Project path | MCP tool argument | Client → filesystem | Symlinks resolved; real root rechecked | `MCPProjectGuard.validate` |
+| Prompt | MCP tool argument | Client/repository → model | Length and turn limits; prompt injection remains | `ClaudeHarnessRunner.run` |
+| Proxy port | Local TCP | Wrapper → proxy | Random loopback port; occupied port rejected | `script/claude-gpt` |
+| Install destinations | Local filesystem | npm CLI → user home | Ownership checks prevent name collisions | installer and uninstall functions |
+
+## Top abuse paths
+
+1. Attacker compromises npm publisher → publishes a trojan release → user runs
+   `npx ... install` → attacker gains same-user code execution.
+2. Malicious repository embeds prompt instructions → Claude reads them during
+   analysis → attempts to read sensitive files outside the repo → content is
+   returned through MCP. Common secret directories are denied, but the OS does
+   not enforce full confinement.
+3. Overbroad user request plus enabled MCP edits → model changes more files than
+   intended → repository integrity is damaged before Codex review.
+4. Local process occupies a chosen proxy port → launcher detects the listener
+   and fails rather than sending prompts to it.
+5. Hostile working environment alters `PATH` → wrapper resolves each dependency
+   before entering the repository and invokes the absolute path.
+6. Unrelated app/helper/MCP uses the same name → install or uninstall checks
+   ownership → operation refuses or skips the unrelated artifact.
+7. Client submits excessive prompt/output work → prompt, output, turn, and time
+   limits terminate the request before unbounded local resource consumption.
+
+## Threat model table
+
+| Threat ID | Threat source | Prerequisites | Threat action | Impact | Impacted assets | Existing controls (evidence) | Gaps | Recommended mitigations | Detection ideas | Likelihood | Impact severity | Priority |
+|---|---|---|---|---|---|---|---|---|---|---|---|---|
+| TM-001 | npm account/package compromise | User installs a malicious release | Execute arbitrary package code | Same-user compromise | Filesystem, credentials, source | No dependencies or postinstall; OIDC-ready publish workflow with provenance; Developer ID signing, notarization, stapling, and checksums for app archives | npm and Apple publisher identities remain external trust anchors | Configure npm trusted publishing, require npm 2FA, protect releases, and sign Git tags | Monitor npm owner/version changes and verify Gatekeeper/checksum results | Low | High | High |
+| TM-002 | Malicious repository content | User delegates analysis of untrusted code | Prompt injection induces out-of-repo reads | Secret or source disclosure | Filesystem, credentials | Tool allowlist and credential-directory deny rules in `ClaudeHarnessRunner.swift` | Claude Code can normally read outside cwd | Recommend container/disposable account; evaluate a real sandbox before claiming untrusted-repo safety | Audit returned paths and provider telemetry | Medium | High | High |
+| TM-003 | Overbroad model action | MCP edits explicitly enabled | Modify unintended in-repo files | Repository integrity loss | Source, Git state | Install-time edit gate, call confirmation, no Bash, Codex diff validation | Confirmation is delegated to client policy | Keep edits off by default; add per-call UI approval if Codex exposes one | Log mode, root, and changed-file summary without content | Medium | Medium | Medium |
+| TM-004 | Same-user local process | Can bind local TCP first | Capture proxy-bound traffic | Prompt/source disclosure | Repository content | Random loopback port and occupied-port fail-closed logic in `script/claude-gpt` | Port allocation still has a small race | Prefer authenticated Unix socket if proxy supports it | Record bind failures without prompt data | Low | High | Medium |
+| TM-005 | Hostile PATH/repository | User launches from manipulated environment | Substitute git, curl, proxy, or Claude binary | Same-user execution | Filesystem, credentials | Absolute executable resolution before `cd` in `script/claude-gpt` | A hostile PATH before launch can still select a malicious binary | Document trusted installation sources; optionally pin known install locations | `doctor` reports resolved paths | Low | High | Medium |
+| TM-006 | Name collision or malicious local artifact | Existing same-name app/helper/MCP | Trick install/uninstall into replacing unrelated data | Local data loss or tool hijack | Filesystem, app integrity | Bundle ID, ownership marker, and MCP-command checks | Marker is not cryptographic | Add manifest hashes for future upgrades | Report every skipped collision | Low | Medium | Low |
+| TM-007 | MCP client/model output | Authorized local call | Return sensitive code or fill disk | Disclosure or local DoS | Logs, source, availability | Private temporary logs, 0600 files, default cleanup, 10 MB output, and 10-minute timeout in `CommandRunner.swift` and `script/claude-gpt` | MCP response intentionally enters Codex chat | Add optional redaction and lower configurable limits | Count failures by reason, never log prompt content | Medium | Medium | Medium |
+| TM-008 | Symlink/path manipulation | Client supplies crafted path | Escape home/repository boundary | Unauthorized local reads/edits | Filesystem | Resolve symlinks and revalidate Git root in `MCPProjectGuard.swift` | Files inside an allowed repo may themselves be symlinks | Treat untrusted repositories as requiring OS isolation | Log rejected canonical root only | Low | High | Medium |
+
+## Criticality calibration
+
+- Critical: remote or package-level compromise that silently extracts provider
+  credentials at scale; arbitrary code execution from a normal read-only call.
+- High: likely disclosure of local secrets from an untrusted repository;
+  malicious npm release executing as the developer.
+- Medium: same-user port race, overbroad in-repo edits, bounded resource abuse,
+  or path attacks requiring a crafted local repository.
+- Low: safe refusal, diagnostic path disclosure to the local user, or collision
+  behavior that skips rather than deletes an artifact.
+
+## Focus paths for security review
+
+| Path | Why it matters | Related Threat IDs |
+|---|---|---|
+| `npm/cli.mjs` | Owns installation, registration, and destructive removal | TM-001, TM-006 |
+| `package.json` | Defines public package execution and release scripts | TM-001 |
+| `script/claude-gpt` | Controls executable resolution, proxy lifecycle, and environment | TM-004, TM-005 |
+| `script/install_backend.sh` | Writes an executable into the user's home | TM-006 |
+| `script/build_and_run.sh` | Replaces and signs the installed app bundle | TM-001, TM-006 |
+| `script/release_macos.sh` | Signs, notarizes, staples, verifies, and checksums public app archives | TM-001 |
+| `.github/workflows/publish-npm.yml` | Defines the tokenless npm publication trust boundary | TM-001 |
+| `Sources/ClaudeGPTMCP/MCPProjectGuard.swift` | Enforces canonical repository boundaries | TM-008 |
+| `Sources/ClaudeGPTMCP/ClaudeHarnessRunner.swift` | Defines tool, prompt, edit, and model policy | TM-002, TM-003 |
+| `Sources/ClaudeGPTMCP/CommandRunner.swift` | Handles environment, temp output, timeout, and subprocesses | TM-005, TM-007 |
+| `Sources/ClaudeGPTMCP/ClaudeGPTMCPServer.swift` | Parses client input and exposes edit capabilities | TM-003, TM-007 |
+| `SECURITY.md` | Sets disclosure expectations and states the non-sandbox boundary | TM-001, TM-002 |
+
+## Quality check
+
+- [x] Covered npm, CLI, app, MCP, subprocess, filesystem, and loopback entry points.
+- [x] Represented every discovered trust boundary in at least one threat.
+- [x] Separated runtime behavior from build, test, and publication behavior.
+- [x] Recorded the assumed individual-developer deployment model and open
+  enterprise/untrusted-repo questions.
+- [x] Distinguished implemented controls from residual risks and recommendations.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Claude GPT Launcher contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/Package.swift

@@ -0,0 +1,25 @@
+// swift-tools-version: 5.9
+import PackageDescription
+
+let package = Package(
+    name: "ClaudeGPTLauncher",
+    platforms: [.macOS(.v14)],
+    products: [
+        .executable(name: "ClaudeGPTLauncher", targets: ["ClaudeGPTLauncher"]),
+        .executable(name: "ClaudeGPTMCP", targets: ["ClaudeGPTMCP"])
+    ],
+    targets: [
+        .executableTarget(
+            name: "ClaudeGPTLauncher",
+            path: "Sources/ClaudeGPTLauncher"
+        ),
+        .executableTarget(
+            name: "ClaudeGPTMCP",
+            path: "Sources/ClaudeGPTMCP"
+        ),
+        .testTarget(
+            name: "ClaudeGPTLauncherTests",
+            dependencies: ["ClaudeGPTLauncher", "ClaudeGPTMCP"]
+        )
+    ]
+)

package/README.md

@@ -0,0 +1,239 @@
+<p align="center">
+  <img src="Resources/AppIcon.png" width="180" alt="Claude GPT Launcher icon">
+</p>
+
+<h1 align="center">Claude GPT Launcher</h1>
+
+<p align="center">
+  <strong>The Claude Code workflow. GPT models. One click.</strong>
+</p>
+
+<p align="center">
+  <img alt="macOS 14+" src="https://img.shields.io/badge/macOS-14%2B-111827?logo=apple">
+  <img alt="Apple silicon" src="https://img.shields.io/badge/Apple%20silicon-native-2563EB">
+  <img alt="Swift" src="https://img.shields.io/badge/Swift-5.9%2B-F05138?logo=swift&logoColor=white">
+  <img alt="MCP" src="https://img.shields.io/badge/MCP-ready-7C3AED">
+  <a href="https://www.npmjs.com/package/claude-gpt-launcher"><img alt="npm" src="https://img.shields.io/npm/v/claude-gpt-launcher?logo=npm"></a>
+  <img alt="MIT license" src="https://img.shields.io/badge/license-MIT-16A34A">
+</p>
+
+Claude GPT Launcher is a tiny native macOS app for developers who enjoy the
+Claude Code terminal experience and want to route it through GPT models exposed
+by a local Codex-compatible proxy.
+
+Pick a repository. Pick a model. Get a real Claude Code session—without copying
+tokens, pasting environment variables, or leaving a proxy running forever.
+
+> [!IMPORTANT]
+> This is an independent community project. It is not affiliated with,
+> endorsed by, or supported by Anthropic or OpenAI. It relies on the third-party
+> [`raine/claude-code-proxy`](https://github.com/raine/claude-code-proxy)
+> project and may be affected by provider policy or protocol changes.
+
+## Why does this exist?
+
+Claude Code has a distinctive interactive harness: project awareness, planning,
+edits, tool calls, and a terminal-first workflow. Codex-backed GPT models offer
+a different model family and subscription path. This project joins those two
+pieces behind a friendly Mac launcher and an optional MCP bridge.
+
+```text
+Native Mac app or Codex chat
+             ↓
+      Claude Code harness
+             ↓
+  localhost compatibility proxy
+             ↓
+       Codex / GPT models
+```
+
+## What you get
+
+| Surface | What it does |
+|---|---|
+| 🖥️ Native app | Pick any Git project and open a configured Claude Code session |
+| ⌨️ `claude-gpt` | Start the same workflow from any terminal |
+| 🔌 Codex MCP | Let a Codex chat consult or edit through the Claude Code harness |
+| 🧭 Model picker | Switch between configured Sol, Terra, and Luna model aliases |
+| 🧹 Owned cleanup | The session stops its own proxy and removes temporary state |
+
+## Quick start
+
+### 1. Install the prerequisites
+
+Install Claude Code using Anthropic's package:
+
+```zsh
+npm install --global @anthropic-ai/claude-code
+```
+
+Install the proxy:
+
+```zsh
+brew install raine/claude-code-proxy/claude-code-proxy
+```
+
+Start the proxy's supported browser OAuth flow:
+
+```zsh
+claude-code-proxy codex auth login
+claude-code-proxy codex auth status
+```
+
+The login result is stored by the proxy in macOS Keychain. Never paste or
+commit the resulting credential.
+
+### 2. Install Claude GPT Launcher
+
+Install and build from npm:
+
+```zsh
+npx claude-gpt-launcher install
+```
+
+Or download the Apple-notarized ZIP from the
+[latest GitHub release](https://github.com/Bennyyy28/claude-gpt-launcher/releases/latest),
+verify its checksum, and move **Claude GPT.app** to Applications:
+
+```zsh
+shasum -a 256 -c Claude-GPT-Launcher-*.zip.sha256
+```
+
+### 3. Open a project
+
+Open **Claude GPT** from `~/Applications`, drag in a Git repository, choose a
+model, and select **Open Claude GPT**.
+
+Or skip the window:
+
+```zsh
+claude-gpt "$HOME/code/my-project"
+```
+
+## Bring the harness into Codex
+
+The installed app bundles a local stdio MCP server:
+
+- `claude_code_plan` performs a read-only harness consultation.
+- `claude_code_edit` performs repository edits without Bash or network tools.
+
+Register it with Codex:
+
+```zsh
+claude-gpt-launcher mcp install --enable-edits
+claude-gpt-launcher mcp status --json
+```
+
+Then open a new Codex chat. The MCP result returns directly to that chat—no
+second terminal and no prompt copy/paste.
+
+To protect sensitive repositories by remote substring:
+
+```zsh
+claude-gpt-launcher mcp install \
+  --enable-edits \
+  --protected-remotes "company/production,example/private-app"
+```
+
+Matching repositories remain denied until a caller explicitly opts in.
+
+## Useful commands
+
+```zsh
+# Check platform, dependencies, app, backend, and MCP state
+claude-gpt-launcher doctor --json
+
+# Open the app
+claude-gpt-launcher open
+
+# Remove only the MCP registration
+claude-gpt-launcher mcp remove
+
+# Remove owned app, helper, and MCP artifacts
+claude-gpt-launcher uninstall
+```
+
+## Safety model
+
+The defaults are intentionally narrow:
+
+- The proxy binds to a randomly selected `127.0.0.1` port.
+- A port collision fails closed instead of reusing an unknown listener.
+- OAuth material is never printed, extracted, or committed by this project.
+- MCP edits require both installation-time enablement and call-time confirmation.
+- The MCP excludes Bash and network tools.
+- Repository roots and symlinks are canonicalized before delegation.
+- Prompts, turns, output, and runtime are bounded.
+- Installation and removal refuse to overwrite unrelated same-name artifacts.
+
+> [!WARNING]
+> Claude Code is not an OS sandbox and can normally read outside its working
+> directory. The MCP adds deny rules for common credential locations, but you
+> should still use a disposable account, container, or VM for untrusted code.
+
+Read the full [security policy](SECURITY.md) and
+[adversarial threat model](Claude-GPT-Launcher-threat-model.md) before enabling
+MCP edits broadly.
+
+## FAQ
+
+<details>
+<summary><strong>Does this extract my subscription token?</strong></summary>
+
+No. Authentication is initiated through the proxy's supported OAuth screen.
+This project never prints or asks you to paste the resulting token.
+
+</details>
+
+<details>
+<summary><strong>Is this an official Anthropic or OpenAI integration?</strong></summary>
+
+No. It is an open-source compatibility project built on another open-source
+proxy. Provider policies and protocols can change, so use it with that risk in
+mind.
+
+</details>
+
+<details>
+<summary><strong>Why not just use Codex directly?</strong></summary>
+
+You absolutely can. This project is specifically for people who prefer the
+Claude Code harness or want Codex to call that harness through MCP.
+
+</details>
+
+<details>
+<summary><strong>Does closing the session stop the proxy?</strong></summary>
+
+Yes. Each launcher session owns a temporary proxy process and cleans it up when
+Claude Code exits.
+
+</details>
+
+## Build from source
+
+```zsh
+./script/install_backend.sh
+./script/build_and_run.sh --install
+npm test
+```
+
+Requirements: Apple-silicon Mac, macOS 14+, Swift 5.9+, Node.js 20+, Claude
+Code, and `claude-code-proxy`.
+
+## Contributing
+
+Issues, focused pull requests, documentation improvements, and security-minded
+reviews are welcome. Start with [CONTRIBUTING.md](CONTRIBUTING.md). Please use
+private vulnerability reporting for security issues.
+
+## Acknowledgements
+
+- [`raine/claude-code-proxy`](https://github.com/raine/claude-code-proxy) for
+  the Anthropic-compatible local proxy.
+- Claude Code and Codex for inspiring a delightfully strange bridge between two
+  excellent developer workflows.
+
+## License
+
+MIT — see [LICENSE](LICENSE).

package/RELEASING.md

@@ -0,0 +1,43 @@
+# Releasing
+
+Releases have two independent artifacts: the npm source package and a notarized
+Apple-silicon app archive. Never put npm, Apple ID, or App Store Connect secrets
+in this repository or in command-line arguments.
+
+## npm
+
+Run the full validation, then publish from a clean release commit:
+
+```zsh
+npm test
+npm run pack:check
+npm publish --access public --provenance
+```
+
+For later releases, configure npm trusted publishing for
+`Bennyyy28/claude-gpt-launcher` and workflow `publish-npm.yml`. The release
+workflow then publishes without a long-lived npm token. Trusted publishing
+requires npm 11.5.1 or newer; the workflow pins a compatible npm release.
+
+## Notarized macOS archive
+
+Create a Keychain-backed `notarytool` profile once. Enter the app-specific
+password only at the interactive prompt:
+
+```zsh
+xcrun notarytool store-credentials claude-gpt-launcher-notary \
+  --apple-id "YOUR_APPLE_ID" \
+  --team-id "YOUR_TEAM_ID"
+```
+
+Build, sign, submit, staple, assess, and checksum the archive:
+
+```zsh
+DEVELOPER_ID_APPLICATION="Developer ID Application: YOUR NAME (YOUR_TEAM_ID)" \
+NOTARYTOOL_PROFILE="claude-gpt-launcher-notary" \
+npm run release:macos
+```
+
+The distributable ZIP and its SHA-256 file are written to `dist/release/`.
+Upload both to the matching GitHub release. The script fails closed unless
+Apple accepts the submission and Gatekeeper accepts the stapled app.

package/Resources/Info.plist

@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>CFBundleExecutable</key>
+    <string>ClaudeGPTLauncher</string>
+    <key>CFBundleIdentifier</key>
+    <string>app.claudegpt.launcher</string>
+    <key>CFBundleName</key>
+    <string>Claude GPT</string>
+    <key>CFBundleDisplayName</key>
+    <string>Claude GPT</string>
+    <key>CFBundleIconFile</key>
+    <string>AppIcon</string>
+    <key>CFBundlePackageType</key>
+    <string>APPL</string>
+    <key>CFBundleShortVersionString</key>
+    <string>1.0.0</string>
+    <key>CFBundleVersion</key>
+    <string>1</string>
+    <key>LSMinimumSystemVersion</key>
+    <string>14.0</string>
+    <key>NSHighResolutionCapable</key>
+    <true/>
+    <key>NSPrincipalClass</key>
+    <string>NSApplication</string>
+</dict>
+</plist>

package/SECURITY.md

@@ -0,0 +1,17 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Use the repository host's private vulnerability-reporting feature. Do not open
+a public issue containing exploit details, credentials, repository contents, or
+OAuth material.
+
+Include the affected version, platform, reproduction steps, impact, and any
+suggested mitigation. Never include live tokens; use clearly fake placeholders.
+
+## Security boundary
+
+Claude GPT Launcher is a local developer tool, not an OS sandbox. It runs under
+the current user's permissions and sends selected repository context through
+the configured model provider. Use disposable environments for untrusted
+repositories and review changes before committing them.