claude-use 2.7.0 → 2.9.0

package/README.md

@@ -77,13 +77,16 @@ claude-use profile set <name> --category <cat>=<bool>[,<cat>=<bool>,...]
 claude-use profile set <name> --entry "<path>"=<bool>[,"<path>"=<bool>,...]
 claude-use profile set <name> [--skip-permissions] [--remote-control] [--headroom]
 
-claude-use provider add <name> --display-name <name> --base-url <url> --token-env <VAR> [--env KEY=VALUE]
+claude-use provider add <name> --display-name <name> --base-url <url> (--token-env <VAR> | --token-command <argv...>) [--auth-scheme <bearer|apiKey>] [--env KEY=VALUE]
 claude-use provider list
 claude-use provider show <name>
 claude-use provider remove <name>
 
 claude-use headroom status
 
+claude @<identity> --headroom            # one launch routed through headroom
+claude --no-headroom                       # one launch routed direct, overriding every layer
+
 claude-use rules add <path> [--profile <name>] [--identity <name>]
 claude-use rules list
 claude-use rules remove <path>

package/dist/cli.cjs

@@ -239649,7 +239649,7 @@ var program = new Command();
 // package.json
 var package_default = {
   name: "claude-use",
-  version: "2.7.0",
+  version: "2.9.0",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "Apache-2.0",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -259498,14 +259498,34 @@ var LaunchSchema = external_exports.strictObject({
   provider: external_exports.string().min(1).optional(),
   headroom: external_exports.boolean().optional()
 });
+var AUTH_SCHEMES = ["bearer", "apiKey"];
 var ProviderSchema = external_exports.strictObject({
   $schema: external_exports.string().optional(),
   displayName: external_exports.string().min(1),
   baseUrl: external_exports.url(),
   tokenEnv: external_exports.string().min(1).optional(),
+  tokenCommand: external_exports.tuple([external_exports.string().min(1)], external_exports.string()).optional(),
+  authScheme: external_exports.enum(AUTH_SCHEMES).optional(),
   env: external_exports.record(external_exports.string().min(1), external_exports.string()).optional()
-}).refine((provider) => provider.tokenEnv !== void 0 || (provider.env?.ANTHROPIC_AUTH_TOKEN ?? "") !== "", {
-  message: "a provider needs either tokenEnv (the name of the environment variable holding its token) or a non-empty env.ANTHROPIC_AUTH_TOKEN"
+}).superRefine((provider, ctx) => {
+  const sources = [
+    provider.tokenEnv !== void 0 ? "tokenEnv" : void 0,
+    provider.tokenCommand !== void 0 ? "tokenCommand" : void 0,
+    (provider.env?.ANTHROPIC_AUTH_TOKEN ?? "") !== "" ? "env.ANTHROPIC_AUTH_TOKEN" : void 0
+  ].filter((source) => source !== void 0);
+  if (sources.length !== 1) {
+    ctx.addIssue({
+      code: "custom",
+      message: sources.length === 0 ? "a provider needs exactly one token source: tokenEnv (the name of the environment variable holding its token), tokenCommand (an argv whose stdout is the token), or a non-empty env.ANTHROPIC_AUTH_TOKEN" : `a provider takes exactly one token source, but this one has ${sources.join(", ")}`
+    });
+  }
+  if (provider.authScheme === "apiKey" && (provider.env?.ANTHROPIC_API_KEY ?? "") !== "") {
+    ctx.addIssue({
+      code: "custom",
+      path: ["env", "ANTHROPIC_API_KEY"],
+      message: 'authScheme "apiKey" exports the token as ANTHROPIC_API_KEY, so env.ANTHROPIC_API_KEY must not be set to a value'
+    });
+  }
 });
 var ConfigProfileSchema = external_exports.strictObject({
   $schema: external_exports.string().optional(),
@@ -266045,6 +266065,13 @@ var READY_FETCH_TIMEOUT_MS = 2e3;
 function headroomPidRunning(pid) {
   return !exitedHeadroom.has(pid) && realIsProcessRunning(pid);
 }
+function headroomSpawnEnv(parentEnv, allowlist) {
+  return {
+    ...parentEnv,
+    HEADROOM_ALLOWED_BASE_URLS: allowlist.join(","),
+    HEADROOM_HTTP2: parentEnv.HEADROOM_HTTP2 ?? "0"
+  };
+}
 function realSupervisorPorts(paths) {
   return {
     fs: realFarmFs,
@@ -266067,7 +266094,7 @@ function realSupervisorPorts(paths) {
         const child = (0, import_node_child_process3.spawn)("headroom", ["proxy", "--host", "127.0.0.1", "--port", String(port)], {
           detached: true,
           stdio: ["ignore", logFd, logFd],
-          env: { ...process.env, HEADROOM_ALLOWED_BASE_URLS: allowlist.join(",") }
+          env: headroomSpawnEnv(process.env, allowlist)
         });
         if (child.pid === void 0) {
           throw new Error("spawning headroom returned no pid");
@@ -266270,6 +266297,8 @@ function addProvider(paths, name, input2) {
     displayName: input2.displayName,
     baseUrl: input2.baseUrl,
     ...input2.tokenEnv === void 0 ? {} : { tokenEnv: input2.tokenEnv },
+    ...input2.tokenCommand === void 0 ? {} : { tokenCommand: input2.tokenCommand },
+    ...input2.authScheme === void 0 ? {} : { authScheme: input2.authScheme },
     ...input2.env === void 0 || Object.keys(input2.env).length === 0 ? {} : { env: input2.env }
   });
   if (!parsed.success) {
@@ -266285,6 +266314,30 @@ function removeProvider(paths, name) {
   import_node_fs10.default.rmSync(providerJsonPath(paths, name));
 }
 var PROVIDER_MISSING_TOKEN_EXIT = 64;
+function obtainToken(name, definition, params) {
+  const unusable = (message) => ({ ok: false, status: PROVIDER_MISSING_TOKEN_EXIT, message });
+  if (definition.tokenCommand !== void 0) {
+    const [command, ...args] = definition.tokenCommand;
+    if (params.run === void 0) {
+      return { ok: false, status: 1, message: `claude-use: provider ${name} needs its token command run, but this launcher has no command runner wired` };
+    }
+    const result = params.run.run(command, args);
+    if (result.status !== 0) {
+      const stderr = result.stderr.trim();
+      const outcome = result.status === null ? "could not be run or was killed by a signal" : `exited with status ${String(result.status)}`;
+      return unusable(`claude-use: provider ${name}: token command ${command} ${outcome}${stderr === "" ? "" : `: ${stderr}`}`);
+    }
+    const token2 = result.stdout.trim();
+    return token2 === "" ? unusable(`claude-use: provider ${name}: token command ${command} printed no token`) : { ok: true, token: token2 };
+  }
+  const token = definition.tokenEnv !== void 0 ? params.env[definition.tokenEnv] : definition.env?.ANTHROPIC_AUTH_TOKEN;
+  if (token === void 0 || token === "") {
+    return unusable(
+      definition.tokenEnv !== void 0 ? `claude-use: provider ${name} needs ${definition.tokenEnv} set in your environment` : `claude-use: provider ${name} has no usable credential: its env.ANTHROPIC_AUTH_TOKEN is empty`
+    );
+  }
+  return { ok: true, token };
+}
 function resolveProvider(params) {
   const cliName = params.cliProvider !== void 0 && params.cliProvider !== "" ? params.cliProvider : void 0;
   let cascadeName;
@@ -266308,14 +266361,11 @@ function resolveProvider(params) {
       message: `claude-use: no provider named "${name}". ` + (known.length > 0 ? `Known providers: ${known.join(", ")}.` : "No providers are defined yet; run `claude-use provider add`.")
     };
   }
-  const token = definition.tokenEnv !== void 0 ? params.env[definition.tokenEnv] : definition.env?.ANTHROPIC_AUTH_TOKEN;
-  if (token === void 0 || token === "") {
-    return {
-      ok: false,
-      status: PROVIDER_MISSING_TOKEN_EXIT,
-      message: definition.tokenEnv !== void 0 ? `claude-use: provider ${name} needs ${definition.tokenEnv} set in your environment` : `claude-use: provider ${name} has no usable credential: its env.ANTHROPIC_AUTH_TOKEN is empty`
-    };
+  const credential = obtainToken(name, definition, params);
+  if (!credential.ok) {
+    return credential;
   }
+  const token = credential.token;
   return { ok: true, provider: { name, definition, token } };
 }
 function collectEnvPairs(value, previous = {}) {
@@ -266332,16 +266382,17 @@ function collectEnvPairs(value, previous = {}) {
 }
 function registerProviderCommand(program2, paths) {
   const provider = program2.command("provider").description("Manage API providers the launcher can route a session through.");
-  provider.command("add <name>").description("Create a new API provider definition.").requiredOption("--display-name <name>", "Human-readable name, exported to the child as CLAUDE_USE_PROVIDER.").requiredOption("--base-url <url>", "Anthropic-compatible base URL the child's requests are sent to.").option("--token-env <var>", "NAME of the environment variable holding the provider's token (never the token itself). Optional only when --env carries ANTHROPIC_AUTH_TOKEN (a local proxy's fixed dummy token).").option("--env <pair>", "Extra KEY=VALUE environment entry for the child (repeatable).", collectEnvPairs).action((name, options) => {
+  provider.command("add <name>").description("Create a new API provider definition.").requiredOption("--display-name <name>", "Human-readable name, exported to the child as CLAUDE_USE_PROVIDER.").requiredOption("--base-url <url>", "Anthropic-compatible base URL the child's requests are sent to.").option("--token-env <var>", "NAME of the environment variable holding the provider's token (never the token itself). Exactly one of --token-env, --token-command or --env ANTHROPIC_AUTH_TOKEN=<fixed dummy token for a local proxy> is required.").option("--token-command <argv...>", "Command (program and arguments) run at launch whose trimmed stdout is the token, e.g. --token-command op read op://vault/item/field. Give it last on the command line, since it consumes every following word.").addOption(new Option("--auth-scheme <scheme>", "How the token reaches Claude Code: bearer sets ANTHROPIC_AUTH_TOKEN (default), apiKey sets ANTHROPIC_API_KEY.").choices(AUTH_SCHEMES)).option("--env <pair>", "Extra KEY=VALUE environment entry for the child (repeatable).", collectEnvPairs).action((name, options) => {
     addProvider(paths, name, {
       displayName: options.displayName,
       baseUrl: options.baseUrl,
       ...options.tokenEnv === void 0 ? {} : { tokenEnv: options.tokenEnv },
+      ...options.tokenCommand === void 0 ? {} : { tokenCommand: options.tokenCommand },
+      ...options.authScheme === void 0 ? {} : { authScheme: options.authScheme },
       ...options.env === void 0 ? {} : { env: options.env }
     });
-    console.log(
-      options.tokenEnv === void 0 ? `Created provider "${name}" (${options.baseUrl}, fixed env credential).` : `Created provider "${name}" (${options.baseUrl}, token from ${options.tokenEnv}).`
-    );
+    const source = options.tokenEnv !== void 0 ? `token from ${options.tokenEnv}` : options.tokenCommand !== void 0 ? `token from ${options.tokenCommand[0]}` : "fixed env credential";
+    console.log(`Created provider "${name}" (${options.baseUrl}, ${source}).`);
   });
   provider.command("list").description("List every API provider.").action(() => {
     const entries = listProviders(paths);
@@ -266394,6 +266445,7 @@ function parseLauncherArgv(argv) {
   const remaining = hasIdentity ? argv.slice(1) : argv;
   let configProfile;
   let provider;
+  let headroom;
   const categoryFlags = [];
   const shareFlags = [];
   const hideFlags = [];
@@ -266403,6 +266455,10 @@ function parseLauncherArgv(argv) {
     if (token === void 0) {
       continue;
     }
+    if (token === "--headroom" || token === "--no-headroom") {
+      headroom = token === "--headroom";
+      continue;
+    }
     const matched = matchValuedFlag(token);
     if (matched === void 0) {
       rest.push(token);
@@ -266436,6 +266492,7 @@ function parseLauncherArgv(argv) {
     ...hasIdentity ? { identity: first.slice(1) } : {},
     ...configProfile === void 0 ? {} : { configProfile },
     ...provider === void 0 ? {} : { provider },
+    ...headroom === void 0 ? {} : { headroom },
     categoryFlags,
     shareFlags,
     hideFlags,
@@ -266557,7 +266614,8 @@ function resolveLaunchFlags(params) {
   return {
     skipPermissions: params.cascade?.skipPermissions === true || isEnvFlagSet(params.env.CLAUDE_USE_SKIP_PERMISSIONS),
     remoteControl: params.cascade?.remoteControl === true || isEnvFlagSet(params.env.CLAUDE_USE_REMOTE_CONTROL),
-    headroom: params.cascade?.headroom === true || isEnvFlagSet(params.env.CLAUDE_USE_HEADROOM)
+    // Precedence: an explicit --headroom/--no-headroom flag decides outright, then the CLAUDE_USE_HEADROOM escape hatch, then the cascade. The flag outranks the environment variable because it is the more deliberate of the two one-off forms (typed on this very command line, not inherited from a shell profile).
+    headroom: params.headroomFlag ?? (isEnvFlagSet(params.env.CLAUDE_USE_HEADROOM) || params.cascade?.headroom === true)
   };
 }
 function buildFlagArgs(flags) {
@@ -266590,6 +266648,10 @@ function buildEnv(params) {
     for (const [key, value] of Object.entries(providerEnv)) {
       env[key] = value;
     }
+    if (params.provider.definition.authScheme === "apiKey") {
+      env.ANTHROPIC_API_KEY = params.provider.token;
+      env.ANTHROPIC_AUTH_TOKEN = "";
+    }
   }
   if (params.headroom !== void 0) {
     env.HEADROOM_PROXY_URL = `http://127.0.0.1:${String(params.headroom.port)}`;
@@ -266718,6 +266780,7 @@ function runLauncher(params) {
     paths,
     port: fs12,
     env,
+    ...params.run === void 0 ? {} : { run: params.run },
     ...parsedArgv.provider === void 0 ? {} : { cliProvider: parsedArgv.provider },
     ...farmContext === void 0 ? {} : { cascade: farmContext.cascade }
   });
@@ -266784,7 +266847,11 @@ function runLauncher(params) {
     cascadeLaunch = flattenLayers(assembleCascade(params.farm.loadCascade(configProfileDecision.name, cliOverride)).layers, { home: params.farm.home }).launch;
   }
   const discovered = params.resolveClaudeBinary();
-  const resolvedFlags = resolveLaunchFlags({ env, ...cascadeLaunch === void 0 ? {} : { cascade: cascadeLaunch } });
+  const resolvedFlags = resolveLaunchFlags({
+    env,
+    ...cascadeLaunch === void 0 ? {} : { cascade: cascadeLaunch },
+    ...parsedArgv.headroom === void 0 ? {} : { headroomFlag: parsedArgv.headroom }
+  });
   let headroom;
   const headroomPort = params.headroom;
   if (resolvedFlags.headroom && headroomPort !== void 0) {
@@ -266926,6 +266993,7 @@ async function runClaude(argvOverride) {
     resolveClaudeBinary: realResolveClaudeBinary(resolveOwnInstallDirs(paths, realOwnExecutablePath())),
     farm: farm.runtime,
     headroom: realHeadroomPort(paths),
+    run: realRunPort,
     ...farm.directoryIdentity === void 0 ? {} : { directoryPinnedIdentity: farm.directoryIdentity },
     ...farm.directoryConfigProfile === void 0 ? {} : { directoryRuleConfigProfile: farm.directoryConfigProfile },
     ...farm.globalDefaultConfigProfile === void 0 ? {} : { globalDefaultConfigProfile: farm.globalDefaultConfigProfile }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-use",
-  "version": "2.7.0",
+  "version": "2.9.0",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "Apache-2.0",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",