subconscious-cli 6.3.1 → 7.0.0

package/bin/profiles.js

@@ -12,9 +12,11 @@ import os from 'node:os';
 import path from 'node:path';
 import { c } from './colors.js';
 import { PUBLIC_CATALOG_FALLBACK_MESSAGE } from './models.js';
+import { describeFailure } from './network.js';
 import {
   profileTemplate,
   RUNBOOK_DEFAULTS,
+  resolvedProfileValues,
   SUPPORTED_MODELS,
 } from './profile-settings.js';
 
@@ -26,6 +28,10 @@ export {
   SUPPORTED_MODELS,
 } from './profile-settings.js';
 
+export function systemCaEnabledFor(profile) {
+  return String(resolvedProfileValues(profile).SYSTEM_CA ?? '').trim() === 'on';
+}
+
 import { runWindows, windowsEditor } from './windows/process.js';
 
 export const DEFAULT_PROFILE = 'default';
@@ -572,7 +578,7 @@ export function modelsCommand(models = SUPPORTED_MODELS, options = {}) {
     console.error(
       `\n  ${c.yellow}Could not fetch the live model catalog; showing packaged defaults.${c.reset}`,
     );
-    console.error(`  ${c.dim}${options.error.message}${c.reset}`);
+    console.error(`  ${c.dim}${describeFailure(options.error)}${c.reset}`);
   }
   console.log();
 }

package/bin/runbook/claude-code/agent.json

@@ -28,11 +28,14 @@
   },
   "help": {
     "usage": "subc [-p NAME] claude [help|status|uninstall] [Claude arguments...]",
-    "behavior": "Launches Claude Code with the active Subconscious profile and model picker. Sessions run with CLAUDE_CONFIG_DIR=~/.subconscious/claude-code, which shares the setup your plain claude uses (~/.claude, or your CLAUDE_CONFIG_DIR): CLAUDE.md, skills, plugins, hooks, MCP servers and session history. Only the model pick is kept apart, so a /model choice in subc does not change plain Claude. Persistent files are leftover-only: subc claude uninstall.",
+    "behavior": "Launches Claude Code with the active Subconscious profile and model picker, using your own Claude config (~/.claude, or your CLAUDE_CONFIG_DIR) unchanged - plans, sessions, memory, skills and settings stay where plain claude keeps them. Subconscious routing, credentials and model pinning ride the launch env and --settings, which persist nothing. A /model pick inside a subc session changes your Claude default, as it does in plain claude. Persistent files are leftover-only: subc claude uninstall.",
     "options": [
       ["help", "Show this help"],
-      ["status", "Inspect leftover ~/.claude/subconscious-gateway.env"],
-      ["uninstall", "Remove leftover ~/.claude/subconscious-gateway.env"],
+      ["status", "Inspect leftovers: ~/.claude/subconscious-gateway.env"],
+      [
+        "uninstall",
+        "Remove leftover ~/.claude/subconscious-gateway.env from older persistent setup"
+      ],
       ["--model MODEL", "Override the profile model for this launch"]
     ],
     "args": ["-- ARGS...", "Pass remaining arguments to Claude Code"]
@@ -113,18 +116,6 @@
       "type": "integer",
       "min": 1
     },
-    {
-      "name": "CLAUDE_CODE_ISOLATE",
-      "flag": "--no-isolate",
-      "flag_value": "off",
-      "default": "on",
-      "strict": true,
-      "choices": ["on", "off"],
-      "help": "Use ~/.claude directly, so a /model pick in subc also changes plain Claude Code",
-      "label": "Isolated Claude config",
-      "description": "When on, subc claude sessions use ~/.subconscious/claude-code as the Claude config dir. It links back to ~/.claude for CLAUDE.md, skills, hooks and session history, copies the plugin index, rebuilds settings.json from ~/.claude/settings.json on each launch, and keeps only the subc model pick apart.",
-      "comment": "CLAUDE_CODE_ISOLATE=off shares ~/.claude with plain Claude Code."
-    },
     { "name": "MAX_CONCURRENT_SUBAGENTS" },
     {
       "name": "MAX_SUBAGENT_SPAWN_DEPTH",
@@ -159,12 +150,6 @@
       "override": ["ANTHROPIC_SMALL_FAST_MODEL"],
       "description": "Small/fast background model."
     },
-    {
-      "name": "CLAUDE_CONFIG_DIR",
-      "value": "{claudeConfigDir}",
-      "optional": true,
-      "description": "Claude Code config dir for subc sessions, prepared before each launch to share the user's own Claude config (~/.claude, or a CLAUDE_CONFIG_DIR they set, which becomes the source rather than the launch dir). When CLAUDE_CODE_ISOLATE=off, the user's own CLAUDE_CONFIG_DIR is kept, or none is set, so sessions use it directly."
-    },
     {
       "name": "CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY",
       "value": "0",
@@ -251,12 +236,6 @@
       },
       "description": "Replaces the built-in model picker with the live catalog and allowlists only those models."
     },
-    {
-      "kind": "file",
-      "path": "~/.subconscious/claude-code",
-      "lifetime": "persistent",
-      "description": "Claude Code config dir for subc sessions (~/.subconscious/claude-code, honoring $SUBC_CONFIG_DIR), set via CLAUDE_CONFIG_DIR. Each launch links CLAUDE.md, history.jsonl and keybindings.json (when present) and the rules, agents, commands, skills, output-styles, hooks, projects, file-history, todos, plans and ide folders (created in ~/.claude when missing) back to ~/.claude, copies the plugin index files (plugin changes made inside subc stay in subc and reset on the next launch), rebuilds settings.json from ~/.claude/settings.json (keeping the subc model pick, dropping apiKeyHelper and env names subc sets), and copies MCP servers, trust and onboarding state from ~/.claude.json (never login state). Settings or MCP servers changed inside a subc session are replaced on the next launch; that launch names them and saves them in settings.discarded.json or mcp.discarded.json in this dir. subc never deletes it and never writes ~/.claude settings; it refuses to launch when this dir resolves to your own config. To remove it, delete the links first: rm -r with a trailing slash, or PowerShell Remove-Item -Recurse, follows them into ~/.claude. Opt out with CLAUDE_CODE_ISOLATE=off or subc claude --no-isolate."
-    },
     {
       "kind": "file",
       "path": "~/.claude/subconscious-gateway.env",

package/bin/runbook/claude-code/install.sh

@@ -1,8 +1,9 @@
 #!/usr/bin/env bash
 # ── Subconscious API Gateway — Claude Code leftovers ──────────────────────────
 # Claude Code is launch-only: `subc claude` passes everything as env and flags
-# and writes nothing. Older persistent setups wrote
-# ~/.claude/subconscious-gateway.env; this script reports and removes it.
+# and writes nothing persistent. One leftover remains from older releases:
+# the ~/.claude/subconscious-gateway.env file from the first persistent setup.
+# This script reports and removes it.
 #
 #   subc claude status
 #   subc claude uninstall

package/bin/runbook/shared.json

@@ -51,6 +51,16 @@
       "description": "Maximum concurrent Claude/Codex subagent threads.",
       "type": "integer",
       "min": 1
+    },
+    {
+      "name": "SYSTEM_CA",
+      "label": "Trust the OS certificate store",
+      "description": "Trust certificates from the operating system store, for a TLS-inspecting corporate proxy. Off by default.",
+      "type": "choice",
+      "strict": true,
+      "choices": ["off", "on"],
+      "default": "off",
+      "template": false
     }
   ]
 }

package/bin/update-check.js

@@ -6,6 +6,7 @@ import readline from 'node:readline';
 import { fileURLToPath } from 'node:url';
 import { LOGO_ART_SMALL_LINES } from './branding.js';
 import { c, colorEnabled } from './colors.js';
+import { proxyAwareFetch } from './network.js';
 import { spawnWindows } from './windows/process.js';
 
 export const PACKAGE_NAME = 'subconscious-cli';
@@ -162,7 +163,7 @@ export async function currentVersion() {
 }
 
 export async function fetchLatestVersion(options = {}) {
-  const fetchImpl = options.fetchImpl || globalThis.fetch;
+  const fetchImpl = options.fetchImpl || proxyAwareFetch;
   const timeoutMs = options.timeoutMs ?? UPDATE_CHECK_TIMEOUT_MS;
   const signal = options.signal;
   if (typeof fetchImpl !== 'function') throw new Error('fetch is unavailable');

package/bin/upgrade.js

@@ -10,6 +10,7 @@ import fs from 'node:fs/promises';
 import readline from 'node:readline';
 import { fileURLToPath } from 'node:url';
 import { c } from './colors.js';
+import { proxyAwareFetch } from './network.js';
 import {
   compareVersions,
   detectInstallTarget,
@@ -42,7 +43,7 @@ export async function currentCliVersion() {
   return pkg.version;
 }
 
-export async function fetchLatestVersion(fetchImpl = fetch) {
+export async function fetchLatestVersion(fetchImpl = proxyAwareFetch) {
   const res = await fetchImpl(
     `https://registry.npmjs.org/${PACKAGE_NAME}/latest`,
     {

package/bin/usage.js

@@ -4,6 +4,12 @@
 
 import { getApiKey, getPlatformUrl } from './auth.js';
 import { c } from './colors.js';
+import {
+  describeFetchError,
+  proxyAwareFetch,
+  proxyHint,
+  tlsTrustHint,
+} from './network.js';
 import { DEFAULT_PROFILE } from './profiles.js';
 import { printLoginUpgradeWarning } from './upgrade.js';
 
@@ -181,7 +187,11 @@ export function formatUsageDisplay(data) {
   return lines.join('\n');
 }
 
-export async function fetchUsage(apiKey, platformUrl, fetchImpl = fetch) {
+export async function fetchUsage(
+  apiKey,
+  platformUrl,
+  fetchImpl = proxyAwareFetch,
+) {
   const res = await fetchImpl(
     `${platformUrl.replace(/\/$/, '')}${USAGE_API_PATH}`,
     {
@@ -260,10 +270,16 @@ export async function usageCommand(argv = [], options = {}) {
       console.log(
         `\n  ${c.yellow}Could not reach the platform (timed out).${c.reset}`,
       );
-      console.log(`  ${c.dim}Host: ${platformUrl}${c.reset}\n`);
+      console.log(`  ${c.dim}Host: ${platformUrl}${c.reset}`);
+      const proxy = proxyHint(error, platformUrl);
+      if (proxy) console.log(`  ${c.dim}${proxy}${c.reset}`);
+      console.log();
       return;
     }
-    console.error(`\n  ${c.red}${error.message}${c.reset}\n`);
+    console.error(`\n  ${c.red}${describeFetchError(error)}${c.reset}`);
+    const hint = tlsTrustHint(error) || proxyHint(error, platformUrl);
+    if (hint) console.error(`  ${c.yellow}${hint}${c.reset}`);
+    console.error();
     process.exitCode = 1;
   }
 }

package/bin/windows/launch.js

@@ -9,7 +9,6 @@ import {
   resolveInputs,
   takeFlags,
 } from '../agent-launch.js';
-import { prepareClaudeLaunch } from '../claude-config.js';
 import { claudePickerSettings } from '../claude-picker.js';
 import { modelIds, positiveInteger } from '../launch-values.js';
 import { modelSupportsVision } from '../model-capabilities.js';
@@ -62,13 +61,7 @@ function plannedLaunch(agent, argv, env) {
     return { command: plan.argv[0], args: plan.argv.slice(1), env: plan.env };
   }
   const plan = claudeLaunch(agent, argv, env);
-  return {
-    command: plan.argv[0],
-    args: plan.argv.slice(1),
-    env: plan.env,
-    // Runs only when the launch executes, so planning never touches disk.
-    prepare: (options) => prepareClaudeLaunch(agent, plan.env, env, options),
-  };
+  return { command: plan.argv[0], args: plan.argv.slice(1), env: plan.env };
 }
 
 function codexCatalog(env, context, maxContext, compact) {
@@ -274,17 +267,12 @@ export async function windowsLaunch(
   throw new Error(`No native Windows launcher is available for ${id}`);
 }
 
-export async function executeWindowsLaunch(spec, run, prepareOptions) {
+export async function executeWindowsLaunch(spec, run) {
   try {
-    const prepared = spec.prepare?.(prepareOptions);
-    for (const warning of prepared?.warnings ?? []) {
-      console.error(`  ${warning}`);
-    }
-    // Claude Code would write into the user's own config there.
-    if (prepared?.refused) return 1;
-    const env = { ...spec.env, ...prepared?.env };
     const options =
-      spec.input === undefined ? { env } : { env, input: spec.input };
+      spec.input === undefined
+        ? { env: spec.env }
+        : { env: spec.env, input: spec.input };
     return await run(spec.command, spec.args, options);
   } finally {
     await spec.cleanup?.();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "subconscious-cli",
-  "version": "6.3.1",
+  "version": "7.0.0",
   "description": "CLI for Subconscious — run Subconscious Code, Claude Code, Codex, OpenCode, DeepSeek Harness, Copilot, and Pi",
   "bin": {
     "subc": "bin/cli.js"

package/bin/claude-config-drift.js

@@ -1,58 +0,0 @@
-import { isDeepStrictEqual } from 'node:util';
-
-// Each launch rebuilds the subc copies of settings.json and the MCP servers
-// in .claude.json from the user's own files, so anything a subc session
-// changed in those copies is replaced. These helpers find what a session
-// changed, by comparing the copies with what the last launch wrote, so the
-// launch can save it aside and name it instead of losing it silently.
-
-const isObject = (value) =>
-  value !== null && typeof value === 'object' && !Array.isArray(value);
-
-/**
- * Keys of `current` that a session added or changed since `written`.
- * Removed keys are ignored: Claude Code drops keys on its own.
- *
- * @param {Record<string, unknown>} written what the last launch wrote
- * @param {Record<string, unknown>} current what the copy holds now
- * @param {string[]} [ignored] keys subc keeps across launches
- * @returns {string[]}
- */
-export function changedKeys(written, current, ignored = []) {
-  if (!isObject(written) || !isObject(current)) return [];
-  return Object.keys(current).filter(
-    (key) =>
-      !ignored.includes(key) && !isDeepStrictEqual(current[key], written[key]),
-  );
-}
-
-/** The MCP servers of a .claude.json: user scope and each project. */
-export function mcpServersOf(state) {
-  const projects = isObject(state?.projects) ? state.projects : {};
-  return {
-    mcpServers: isObject(state?.mcpServers) ? state.mcpServers : {},
-    projects: Object.fromEntries(
-      Object.entries(projects)
-        .filter(([, project]) => isObject(project?.mcpServers))
-        .map(([name, project]) => [name, project.mcpServers]),
-    ),
-  };
-}
-
-/**
- * MCP server names a session added or changed since `written`, as
- * `name` for user scope and `name (project)` for a project.
- *
- * @param {ReturnType<typeof mcpServersOf>} written
- * @param {ReturnType<typeof mcpServersOf>} current
- * @returns {string[]}
- */
-export function changedMcpServers(written, current) {
-  const changed = changedKeys(written.mcpServers, current.mcpServers);
-  for (const [project, servers] of Object.entries(current.projects)) {
-    for (const name of changedKeys(written.projects[project] ?? {}, servers)) {
-      changed.push(`${name} (${project})`);
-    }
-  }
-  return changed;
-}

package/bin/claude-config-plugins.js

@@ -1,103 +0,0 @@
-import crypto from 'node:crypto';
-import fs from 'node:fs';
-import path from 'node:path';
-
-// Claude Code finds an enabled plugin that installed_plugins.json does not
-// list (a marketplace plugin pinned to a git SHA, for example) by its place
-// in its own cache: <config dir>/plugins/cache/<marketplace>/<plugin>/<version>.
-// The subc config dir never links that cache, so such a plugin, and the MCP
-// servers it ships, would not load. Each missing version is copied once. A
-// copy, unlike a link, cannot carry a cache sweep or orphan marker made in a
-// subc session back into ~/.claude.
-
-// A marketplace or plugin name used as one path segment.
-const SAFE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
-
-/** `[plugin, marketplace]` of an enabledPlugins key, or `undefined`. */
-function parsePluginId(id) {
-  const at = id.lastIndexOf('@');
-  if (at <= 0) return undefined;
-  const plugin = id.slice(0, at);
-  const marketplace = id.slice(at + 1);
-  return SAFE_NAME.test(plugin) && SAFE_NAME.test(marketplace)
-    ? [plugin, marketplace]
-    : undefined;
-}
-
-function copyVersion(from, to) {
-  // A copy is renamed into place only when complete, so a launch stopped
-  // half way never leaves a partial plugin that later launches skip.
-  const temp = `${to}.${crypto.randomBytes(6).toString('hex')}.tmp`;
-  try {
-    fs.cpSync(from, temp, { recursive: true, verbatimSymlinks: true });
-    fs.renameSync(temp, to);
-  } finally {
-    fs.rmSync(temp, { recursive: true, force: true });
-  }
-}
-
-/** Whether `base` or any folder from it down through `parts` is a link. */
-function linkOnPath(base, parts) {
-  let current = base;
-  for (const part of ['', ...parts]) {
-    current = part ? path.join(current, part) : current;
-    try {
-      if (fs.lstatSync(current).isSymbolicLink()) return true;
-    } catch {
-      return false;
-    }
-  }
-  return false;
-}
-
-function directories(dir) {
-  try {
-    return fs
-      .readdirSync(dir, { withFileTypes: true })
-      .filter((entry) => entry.isDirectory() && SAFE_NAME.test(entry.name))
-      .map((entry) => entry.name);
-  } catch {
-    return [];
-  }
-}
-
-/**
- * Copy into `dir`'s plugin cache every cached version of each enabled plugin
- * that the plugin index does not list, unless a copy is already there.
- *
- * @param {{ dir: string, source: string, enabledPlugins: unknown,
- *   indexed: unknown, warnings: string[] }} options
- */
-export function copyUnindexedPlugins({
-  dir,
-  source,
-  enabledPlugins,
-  indexed,
-  warnings,
-}) {
-  if (!enabledPlugins || typeof enabledPlugins !== 'object') return;
-  const listed =
-    indexed && typeof indexed === 'object' ? Object.keys(indexed) : [];
-  for (const [id, enabled] of Object.entries(enabledPlugins)) {
-    if (enabled !== true || listed.includes(id)) continue;
-    const parsed = parsePluginId(id);
-    if (!parsed) continue;
-    const [plugin, marketplace] = parsed;
-    const from = path.join(source, 'plugins', 'cache', marketplace, plugin);
-    const to = path.join(dir, 'plugins', 'cache', marketplace, plugin);
-    // A link here could carry the copy into the user's own cache.
-    if (linkOnPath(path.join(dir, 'plugins'), ['cache', marketplace, plugin])) {
-      warnings.push(`Skipped plugin ${id} for subc: its cache path is a link.`);
-      continue;
-    }
-    for (const version of directories(from)) {
-      if (fs.existsSync(path.join(to, version))) continue;
-      try {
-        fs.mkdirSync(to, { recursive: true });
-        copyVersion(path.join(from, version), path.join(to, version));
-      } catch (error) {
-        warnings.push(`Could not copy plugin ${id} for subc: ${error.message}`);
-      }
-    }
-  }
-}