subconscious-cli 6.3.1 → 7.0.0

package/README.md

@@ -351,8 +351,11 @@ subc opencode uninstall
 ```
 
 `subc claude uninstall` and `subc opencode uninstall` only clean leftover files
-from older overwrite-style setup. Launch those agents with `subc claude` /
-`subc opencode`; they do not need install.
+from older overwrite-style setup. `subc claude` writes nothing persistent: it
+passes routing, credentials and the model picker through the launch env and
+`--settings`, and sessions use your own Claude config (~/.claude, or your
+CLAUDE_CONFIG_DIR). Launch those agents with `subc claude` / `subc opencode`;
+they do not need install.
 
 Inspect a persistent integration with `subc <agent> status`. A one-off
 `--api-key` passed to install takes precedence for that command but is not

package/bin/agent-launch.js

@@ -1,7 +1,6 @@
-import path from 'node:path';
 import { agentInputs, agentKeyName } from './agent-data.js';
 import { openCodeConfigFromEnv } from './opencode-provider.js';
-import { configDir, isUnsetSetting } from './profiles.js';
+import { isUnsetSetting } from './profiles.js';
 
 // One pass, so a substituted value (a prompt, a settings document) is never
 // scanned again for placeholders.
@@ -9,9 +8,6 @@ const PLACEHOLDER = /\$\{([A-Z_][A-Z0-9_]*)\}(\/)?|\{([A-Za-z][A-Za-z0-9]*)\}/g;
 const present = (value) =>
   value !== undefined && value !== null && value !== '';
 
-// CLAUDE_CODE_ISOLATE values that stop Claude Code config isolation.
-const ISOLATE_OFF = new Set(['off', '0', 'false', 'no']);
-
 function tokensFor(agent, env, extra) {
   const baseUrl = String(env.GATEWAY_URL ?? '').replace(/\/+$/, '');
   const keyName = agentKeyName(agent);
@@ -23,26 +19,6 @@ function tokensFor(agent, env, extra) {
     // Left for the runbook, which writes the file and substitutes its path.
     tempFile: '{tempFile}',
     opencodeConfig: () => JSON.stringify(openCodeConfigFromEnv(env)),
-    // Claude Code config isolation: subc sessions keep their Claude config
-    // (settings, sessions, plugins, credentials) under the subc config dir
-    // instead of ~/.claude, so session state cannot bleed into a plain
-    // `claude` installation. Empty when CLAUDE_CODE_ISOLATE opts out.
-    claudeConfigDir: () => {
-      const setting = String(env.CLAUDE_CODE_ISOLATE ?? '')
-        .trim()
-        .toLowerCase();
-      // Opted out: the user's own folder, as plain `claude` would use it.
-      if (ISOLATE_OFF.has(setting)) {
-        return String(
-          env.SUBC_CLAUDE_CONFIG_SOURCE || env.CLAUDE_CONFIG_DIR || '',
-        ).trim();
-      }
-      const base = String(env.SUBC_CONFIG_DIR ?? '').trim() || configDir();
-      // A relative base would put the config, MCP tokens included, in the
-      // current directory; use ~/.claude unchanged instead.
-      if (!path.isAbsolute(base)) return '';
-      return path.join(base, 'claude-code');
-    },
     ...extra,
   };
 }

package/bin/agents.js

@@ -19,7 +19,6 @@ import {
 import { launchPlan, resolveInputs } from './agent-launch.js';
 import { planCommand, runCommand, scriptCommand } from './agent-spawn.js';
 import { getApiKey } from './auth.js';
-import { prepareClaudeLaunch } from './claude-config.js';
 import {
   applyClaudePickerCatalog,
   CLAUDE_PICKER_ENV_DESCRIPTION,
@@ -37,6 +36,7 @@ import {
   PUBLIC_CATALOG_FALLBACK_MESSAGE,
   resolveModelCatalog,
 } from './models.js';
+import { describeFailure } from './network.js';
 import { isUnsetSetting, resolvedModelSetting } from './profiles.js';
 import { runWindowsAgent } from './windows/agents.js';
 
@@ -372,7 +372,7 @@ async function resolvedModelsForLaunch(profile, apiKey, selectedModel) {
     console.error(
       `  ${c.yellow}Could not fetch the live model catalog; using packaged defaults.${c.reset}`,
     );
-    console.error(`  ${c.dim}${catalog.error.message}${c.reset}\n`);
+    console.error(`  ${c.dim}${describeFailure(catalog.error)}${c.reset}\n`);
   }
   return catalog;
 }
@@ -546,22 +546,5 @@ async function launchAgent(agent, argv, profile, headless) {
   // The headless endpoint is the one endpoint for every harness, Claude too.
   const launchEnv = headless ? { ...env, CLAUDE_GATEWAY_URL: '' } : env;
   const plan = launchPlan(agent, { env: launchEnv, ...headlessParts(rest) });
-  if (agent.id === CLAUDE_CODE) {
-    const {
-      warnings,
-      refused,
-      env: sourceEnv,
-    } = prepareClaudeLaunch(agent, plan.env, launchEnv);
-    const color = refused ? c.red : c.yellow;
-    for (const warning of warnings) {
-      console.error(`  ${color}${warning}${c.reset}`);
-    }
-    if (refused) {
-      process.exitCode = 1;
-      return 1;
-    }
-    const prepared = { ...plan, env: { ...plan.env, ...sourceEnv } };
-    return runCommand(planCommand(agent, prepared, binDir));
-  }
   return runCommand(planCommand(agent, plan, binDir));
 }

package/bin/auth.js

@@ -16,6 +16,12 @@ import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { c } from './colors.js';
+import {
+  describeFetchError,
+  proxyAwareFetch,
+  proxyHint,
+  tlsTrustHint,
+} from './network.js';
 import {
   clearProfileApiKey,
   DEFAULT_PROFILE,
@@ -128,7 +134,10 @@ function terminalLink(url) {
   return `\u001b]8;;${url}\u0007${url}\u001b]8;;\u0007`;
 }
 
-export async function registerDeviceLogin(platformUrl, fetchImpl = fetch) {
+export async function registerDeviceLogin(
+  platformUrl,
+  fetchImpl = proxyAwareFetch,
+) {
   const res = await fetchImpl(`${platformUrl}/api/cli/device/register`, {
     method: 'POST',
     signal: AbortSignal.timeout(8000),
@@ -146,7 +155,7 @@ export async function registerDeviceLogin(platformUrl, fetchImpl = fetch) {
 export async function pollDeviceLogin(
   platformUrl,
   deviceCode,
-  fetchImpl = fetch,
+  fetchImpl = proxyAwareFetch,
 ) {
   const res = await fetchImpl(`${platformUrl}/api/cli/device/token`, {
     method: 'POST',
@@ -180,10 +189,25 @@ function printDeviceInstructions(platformUrl, userCode) {
 
 function printLoginFallback() {
   console.error(
-    `  ${c.dim}You can also copy an API key from the dashboard and run${c.reset} ${c.cyan}subc update-key <your-api-key>${c.reset}${c.dim}.${c.reset}`,
+    `  ${c.dim}You can also copy an API key from the dashboard and run${c.reset} ${c.cyan}subc update-key <your-api-key>${c.reset}${c.dim}, which needs no network.${c.reset}`,
   );
 }
 
+// Render a login failure with the real underlying network cause. Node's fetch
+// reports every connection problem as a bare "fetch failed"; the diagnostic
+// (`ENOTFOUND`, `ECONNREFUSED`, `ETIMEDOUT`, TLS, proxy) lives on `cause`.
+function printLoginFailure(platformUrl, error) {
+  const message = describeFetchError(error);
+  console.error(`  ${c.red}✗ ${message}${c.reset}`);
+  const hint = tlsTrustHint(error);
+  if (hint) {
+    console.error(`  ${c.yellow}${hint}${c.reset}`);
+    return;
+  }
+  const proxy = proxyHint(error, platformUrl);
+  if (proxy) console.error(`  ${c.dim}${proxy}${c.reset}`);
+}
+
 async function saveLoginKey(profileName, token) {
   if (profileName === DEFAULT_PROFILE) {
     const config = await loadConfig();
@@ -196,7 +220,7 @@ async function saveLoginKey(profileName, token) {
 export async function loginCommand(_argv = [], options = {}) {
   const profileName = options.profileName || DEFAULT_PROFILE;
   const existing = await getApiKey(options.profile);
-  const fetchImpl = options.fetchImpl || fetch;
+  const fetchImpl = options.fetchImpl || proxyAwareFetch;
 
   if (existing) {
     const profile = await ensureProfile(profileName, existing.key);
@@ -225,7 +249,7 @@ export async function loginCommand(_argv = [], options = {}) {
   try {
     registered = await registerDeviceLogin(platformUrl, fetchImpl);
   } catch (error) {
-    console.error(`  ${c.red}✗ ${error.message}${c.reset}`);
+    printLoginFailure(platformUrl, error);
     printLoginFallback();
     console.log();
     process.exitCode = 1;
@@ -299,7 +323,7 @@ export async function loginCommand(_argv = [], options = {}) {
   } catch (error) {
     clearInterval(spinner);
     process.stdout.write(`\r${' '.repeat(50)}\r`);
-    console.error(`  ${c.red}✗ ${error.message}${c.reset}`);
+    printLoginFailure(platformUrl, error);
     printLoginFallback();
     console.log();
     process.exitCode = 1;
@@ -380,7 +404,7 @@ export async function whoamiCommand(_argv = [], options = {}) {
 
   // Validate the key against the server; falls back to offline display if unreachable
   try {
-    const res = await fetch(
+    const res = await proxyAwareFetch(
       `${getPlatformUrl(options.profile)}/api/cli/whoami`,
       {
         headers: { Authorization: `Bearer ${key}` },