u-chan-secrets 5.0.0 → 5.1.0

package/dist/cli.js

@@ -7,15 +7,27 @@ import { fileURLToPath } from 'node:url';
 import { IpcClient } from './ipc/client.js';
 import { defaultEndpoint } from './ipc/endpoint.js';
 import { MAX_FRAME, encode } from './ipc/protocol.js';
-import { runDoctor, doctorExitCode, checkPlaywrightNow, chromeState, safeVersion, SERVICE_DIAGNOSTIC_TIMEOUT_MS } from './core/doctor.js';
+import { runDoctor, doctorExitCode, bounded, checkPlaywrightNow, chromeState, safeVersion, SERVICE_DIAGNOSTIC_TIMEOUT_MS } from './core/doctor.js';
 import { loadConfig } from './core/config.js';
 import { execFile } from 'node:child_process';
 import { join } from 'node:path';
 import { configureCodex, isElevated } from './client/codex-setup.js';
-import { runSetup, setupExitCode } from './client/setup.js';
+import { configureClaude } from './client/claude-setup.js';
+import { combineClients, runSetup, setupExitCode, SETUP_CLIENT_NAMES } from './client/setup.js';
 import { parseAllowArgs } from './client/allow.js';
 import { saveBrowserChoice } from './client/browser-choice.js';
-const USAGE = 'usage: u-chan install [--mode <easy|hardcore>] [--phrase <phrase>] | uninstall | unlock | lock | mode <easy|hardcore> | import-v1 [path] | audit [limit] | update | doctor [--json] | manage';
+import { configureWindowsCommand } from './client/windows-command.js';
+import { runDiscordCli } from './client/discord.js';
+import { runCoordinatedUpdate } from './client/update.js';
+import { desktopUpdateAdapter } from './client/update-package.js';
+import { runGithubCli } from './client/github.js';
+const USAGE = 'usage: u-chan start | install [--mode <easy|hardcore>] [--phrase <phrase>] | uninstall | unlock | lock | mode <easy|hardcore> | import-v1 [path] | audit [limit] | update | doctor [--json] | manage';
+/** AI client CLIs on PATH. Detection only runs `where`/`which`; it never executes the clients themselves. */
+export function detectClients(platform = process.platform) {
+    const finder = platform === 'win32' ? 'where.exe' : 'which';
+    const found = (name) => new Promise(resolve => execFile(finder, [name], { timeout: 5000, windowsHide: true, maxBuffer: 64 * 1024 }, err => resolve(!err)));
+    return Promise.all(['codex', 'claude'].map(async (c) => (await found(c)) ? [c] : [])).then(r => r.flat());
+}
 /** import-v1 shows one approval window per entry, each open for up to 2 minutes, one after another. */
 export const IMPORT_PROMPT_MS = 120000;
 export const IMPORT_MARGIN_MS = 60000;
@@ -27,6 +39,35 @@ function defaultV1Path(env, platform) {
 }
 /** Returns the process exit code: 0 on success, 1 on failure or bad usage. */
 export async function main(argv, d) {
+    if (argv[0] === 'github') {
+        const result = await runGithubCli(argv.slice(1), d.connect({ timeoutMs: 240000 }), d.readFile);
+        if (result.ok)
+            d.out(result.message);
+        else
+            d.err(result.message);
+        return result.ok ? 0 : 1;
+    }
+    if (argv[0] === 'update') {
+        if (argv.length > 2 || (argv.length === 2 && argv[1] !== '--check')) {
+            d.err('usage: u-chan update [--check]');
+            return 1;
+        }
+        const checkOnly = argv[1] === '--check';
+        const result = d.update ? await d.update(checkOnly) : await runCoordinatedUpdate({ checkOnly }, { client: d.connect({ timeoutMs: 180000 }), desktop: desktopUpdateAdapter(d.env), progress: (phase, seconds) => d.out(`Update: ${phase} (${seconds}s)`) });
+        if (result.ok)
+            d.out(result.message);
+        else
+            d.err(result.message);
+        return result.ok ? 0 : 1;
+    }
+    if (argv[0] === 'discord') {
+        const result = await runDiscordCli(argv.slice(1), d.connect({ timeoutMs: 240000 }), d.readFile);
+        if (result.ok)
+            d.out(result.message);
+        else
+            d.err(result.message);
+        return result.ok ? 0 : 1;
+    }
     const [cmd, arg, ...rest] = argv;
     let call;
     let diagnosticEnv = d.env;
@@ -58,6 +99,7 @@ export async function main(argv, d) {
             return state === 'ok' ? 'pass' : state === 'missing' ? 'fail' : 'unknown';
         },
     }));
+    const startBrowser = d.startBrowser ?? launchBrowser;
     const printDoctor = (r) => d.out(r.checks.map(c => `${c.state.toUpperCase()} ${c.id}: ${c.message}${c.nextAction ? ' ' + c.nextAction : ''}`).join('\n'));
     if (cmd === 'allow') {
         const proposal = parseAllowArgs(argv.slice(1));
@@ -79,6 +121,7 @@ export async function main(argv, d) {
         const args = argv.slice(1), seen = new Set();
         let valid = true;
         let browser;
+        let client = 'auto';
         for (let i = 0; i < args.length; i++) {
             const flag = args[i];
             if (seen.has(flag) || !['--client', '--browser', '--apply', '--replace-existing', '--start-browser', '--json'].includes(flag)) {
@@ -86,9 +129,14 @@ export async function main(argv, d) {
                 break;
             }
             seen.add(flag);
-            if (flag === '--client' && args[++i] !== 'codex') {
-                valid = false;
-                break;
+            if (flag === '--client') {
+                const value = args[++i];
+                if (value !== 'codex' && value !== 'claude' && value !== 'all') {
+                    valid = false;
+                    break;
+                }
+                ;
+                client = value;
             }
             if (flag === '--browser') {
                 const value = args[++i];
@@ -101,27 +149,73 @@ export async function main(argv, d) {
             }
         }
         if (!valid || (seen.has('--replace-existing') && !seen.has('--apply'))) {
-            d.err('usage: u-chan setup [--client codex] [--browser chrome|edge] [--apply] [--replace-existing] [--start-browser] [--json]');
+            d.err('usage: u-chan setup [--client codex|claude|all] [--browser chrome|edge] [--apply] [--replace-existing] [--start-browser] [--json]');
             return 1;
         }
         const options = { apply: seen.has('--apply'), replaceExisting: seen.has('--replace-existing'), startBrowser: seen.has('--start-browser'), ...(browser ? { browser } : {}) };
         if (browser)
             diagnosticEnv = { ...d.env, U_CHAN_BROWSER: browser };
         const cfg = loadConfig(diagnosticEnv, d.platform), endpoint = cfg.cdpEndpoint;
-        const r = d.setup ? await d.setup(options) : await runSetup(options, {
-            platform: d.platform, endpoint, browser: cfg.browser, elevated: isElevated, doctor,
-            selectBrowser: choice => saveBrowserChoice(cfg.browserChoicePath, choice),
-            configure: opts => configureCodex({ ...opts, browser: cfg.browser, endpoint, ipcEndpoint: defaultEndpoint(d.env, d.platform), nodePath: process.execPath, entryPath: fileURLToPath(new URL('./index.js', import.meta.url)), configDir: d.env.CODEX_HOME ?? join(homedir(), '.codex') }),
-            startBrowser: () => new Promise(resolve => {
-                execFile('powershell.exe', ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-File', fileURLToPath(new URL('../scripts/start-browser.ps1', import.meta.url)), '-Browser', cfg.browser, '-Background'], { timeout: 24000, windowsHide: true, env: diagnosticEnv, maxBuffer: 65536 }, err => resolve(!err));
-            }),
-        });
+        const entryPath = fileURLToPath(new URL('./index.js', import.meta.url)), claudeDir = d.env.CLAUDE_CONFIG_DIR ?? join(homedir(), '.claude');
+        const configureFor = (c) => (opts) => c === 'claude'
+            ? configureClaude({ ...opts, browser: cfg.browser, endpoint, ipcEndpoint: defaultEndpoint(d.env, d.platform), nodePath: process.execPath, entryPath, configDir: claudeDir, configPath: d.env.CLAUDE_CONFIG_DIR ? join(claudeDir, '.claude.json') : join(homedir(), '.claude.json') })
+            : configureCodex({ ...opts, browser: cfg.browser, endpoint, ipcEndpoint: defaultEndpoint(d.env, d.platform), nodePath: process.execPath, entryPath, configDir: d.env.CODEX_HOME ?? join(homedir(), '.codex') });
+        let r;
+        if (d.setup)
+            r = await d.setup(options, client);
+        else {
+            const clients = client === 'all' ? ['codex', 'claude'] : client === 'auto' ? await (d.detectClients ?? detectClients)() : [client];
+            const combined = combineClients(clients.map(c => ({ client: c, configure: configureFor(c) })));
+            r = await runSetup(options, {
+                platform: d.platform, endpoint, browser: cfg.browser, elevated: isElevated, doctor, clientName: combined.clientName,
+                configureShell: apply => configureWindowsCommand(apply, d.env.PATH ?? d.env.Path ?? ''),
+                selectBrowser: choice => saveBrowserChoice(cfg.browserChoicePath, choice),
+                configure: combined.configure,
+                startBrowser: () => startBrowser(cfg.browser, diagnosticEnv, true),
+            });
+            if (clients.length > 1 && combined.results().length)
+                r.clients = combined.results();
+        }
         if (seen.has('--json'))
             d.out(JSON.stringify(r));
         else
-            d.out([`Setup: ${r.state}; sharing: ${r.sharing}; restart required: ${r.restartRequired}`, ...r.actions.map(a => a.message), ...(r.backupPath ? ['Configuration backup: ' + r.backupPath] : [])].join('\n'));
+            d.out([`Setup: ${r.state}; sharing: ${r.sharing}; restart required: ${r.restartRequired}`, ...(r.clients ?? []).map(c => `${SETUP_CLIENT_NAMES[c.client]}: ${c.state}. ${c.message}`), ...r.actions.map(a => a.message), ...(r.backupPath ? ['Configuration backup: ' + r.backupPath] : [])].join('\n'));
         return setupExitCode(r);
     }
+    if (cmd === 'start' && arg === undefined) {
+        // Daily routine: dedicated browser, vault unlock through the protected prompt, then a doctor summary.
+        if (d.platform !== 'win32') {
+            d.err('u-chan start supports Windows only; start the browser and run u-chan unlock manually.');
+            return 1;
+        }
+        const cfg = loadConfig(d.env, d.platform);
+        if (await chromeState(cfg.cdpEndpoint) === 'pass')
+            d.out('Browser: ready.');
+        else if (await bounded(() => startBrowser(cfg.browser, d.env, false), false, 25000))
+            d.out('Browser: started.');
+        else
+            d.err('Browser: could not start the dedicated browser; run u-chan doctor.');
+        let vault;
+        try {
+            const r = await d.connect({ timeoutMs: SERVICE_DIAGNOSTIC_TIMEOUT_MS }).diagnose();
+            vault = r.ok ? JSON.parse(r.message)?.vault : undefined;
+        }
+        catch {
+            vault = undefined;
+        }
+        if (vault === 'unlocked')
+            d.out('Vault: unlocked.');
+        else if (vault === 'locked') {
+            const r = await d.connect({}).unlock();
+            if (r.ok)
+                d.out('Vault: ' + r.message);
+            else
+                d.err('Vault: ' + r.message);
+        }
+        const report = await doctor();
+        printDoctor(report);
+        return doctorExitCode(report) === 1 || report.checks.some(c => c.id === 'vault' && c.nextAction === 'Run u-chan unlock.') ? 1 : 0;
+    }
     if (cmd === 'doctor' && (arg === undefined || arg === '--json') && rest.length === 0) {
         const r = await doctor();
         if (arg === '--json')
@@ -233,9 +327,6 @@ export async function main(argv, d) {
         }
         call = () => d.connect({}).audit(limit);
     }
-    else if (cmd === 'update' && arg === undefined) {
-        call = () => d.connect({ timeoutMs: 120000 }).update();
-    }
     else if (cmd === 'manage' && arg === undefined) {
         call = () => d.connect({ timeoutMs: 15 * 60_000 }).manage();
     }
@@ -252,6 +343,11 @@ export async function main(argv, d) {
         printDoctor(await doctor());
     return r.ok ? 0 : 1;
 }
+function launchBrowser(browser, env, background) {
+    return new Promise(resolve => {
+        execFile('powershell.exe', ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-File', fileURLToPath(new URL('../scripts/start-browser.ps1', import.meta.url)), '-Browser', browser, ...(background ? ['-Background'] : [])], { timeout: 24000, windowsHide: true, env, maxBuffer: 65536 }, err => resolve(!err));
+    });
+}
 const isEntry = (() => {
     try {
         return !!process.argv[1] && realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url));

package/dist/client/claude-setup.js

@@ -0,0 +1,97 @@
+import { execFile } from 'node:child_process';
+import { readFile } from 'node:fs/promises';
+import { basename, join } from 'node:path';
+import { safeCdpOrigin } from '../core/doctor.js';
+import { defaultEndpoint } from '../ipc/endpoint.js';
+import { browserKind } from './browser-choice.js';
+import { backupFile, isElevated } from './codex-setup.js';
+function simple(entry, name) {
+    if (!entry || typeof entry !== 'object' || Array.isArray(entry))
+        return false;
+    if (Object.keys(entry).some(k => !['type', 'command', 'args', 'env'].includes(k)) || (entry.type ?? 'stdio') !== 'stdio')
+        return false;
+    if (typeof entry.command !== 'string' || !Array.isArray(entry.args) || !entry.args.every((a) => typeof a === 'string'))
+        return false;
+    if (entry.env != null && (typeof entry.env !== 'object' || Array.isArray(entry.env) || Object.entries(entry.env).some(([key, value]) => name !== 'u-chan-secrets' || (key === 'U_CHAN_BROWSER' ? value !== 'chrome' && value !== 'edge' : key === 'U_CHAN_CDP' ? !safeCdpOrigin(value) : true))))
+        return false;
+    const command = basename(entry.command.replaceAll('\\', '/')).toLowerCase();
+    if (name === 'u-chan-secrets')
+        return ['node', 'node.exe'].includes(command) && entry.args.length === 1 && /(?:^|[\\/])index\.js$/.test(entry.args[0]);
+    return ['npx', 'npx.cmd', 'npx.exe'].includes(command) && /^@playwright\/mcp(?:@[^\s]+)?$/.test(entry.args[0] ?? '')
+        && (entry.args.length === 1 || (entry.args.length === 3 && entry.args[1] === '--cdp-endpoint' && !!safeCdpOrigin(entry.args[2])));
+}
+/** Inspect Claude Code's user-scope JSON read-only; every change goes through the official `claude mcp` CLI. */
+export async function configureClaude(o, injected) {
+    let changed = false, backupPath;
+    const result = (state, message) => ({ state, changed, ...(backupPath ? { backupPath } : {}), message });
+    const d = injected ?? { elevated: isElevated, read: path => readFile(path, 'utf8'), exec: args => new Promise(resolve => {
+            execFile('claude', args, { timeout: 30000, windowsHide: true, maxBuffer: 1024 * 1024 }, (err, stdout, stderr) => resolve({ code: err ? 1 : 0, stdout, stderr }));
+        }) };
+    try {
+        const origin = safeCdpOrigin(o.endpoint);
+        if (!origin || (o.replaceExisting && !o.apply))
+            return result('manual', 'Use a safe loopback browser target and explicit apply flags.');
+        if (o.browser !== undefined)
+            browserKind(o.browser);
+        if (await d.elevated())
+            return result('unavailable', 'Run setup from a non-administrator desktop terminal.');
+        let servers = {};
+        try {
+            const text = await d.read(o.configPath);
+            const parsed = JSON.parse(text.charCodeAt(0) === 0xfeff ? text.slice(1) : text);
+            if (!parsed || typeof parsed !== 'object')
+                return result('unavailable', 'Could not inspect Claude Code registrations.');
+            servers = parsed.mcpServers && typeof parsed.mcpServers === 'object' ? parsed.mcpServers : {};
+        }
+        catch (err) {
+            if (err.code !== 'ENOENT')
+                return result('unavailable', 'Could not inspect Claude Code registrations.');
+        }
+        const env = o.browser ? { U_CHAN_BROWSER: o.browser, U_CHAN_CDP: origin } : {};
+        const desired = [
+            { name: 'u-chan-secrets', server: { type: 'stdio', command: o.nodePath, args: [o.entryPath], env } },
+            { name: 'playwright', server: { type: 'stdio', command: 'npx', args: ['@playwright/mcp@latest', '--cdp-endpoint', origin], env: {} } },
+        ];
+        const ipc = o.ipcEndpoint ?? defaultEndpoint(process.env, process.platform);
+        const pending = [];
+        for (const { name, server } of desired) {
+            const current = servers[name];
+            if (current === undefined) {
+                pending.push({ name, server, replace: false });
+                continue;
+            }
+            const curEnv = current?.env && typeof current.env === 'object' ? current.env : {};
+            if (Object.keys(curEnv).some(key => {
+                const k = key.toUpperCase();
+                return k === 'U_CHAN_CDP' ? safeCdpOrigin(curEnv[key]) !== origin : k === 'U_CHAN_IPC' && curEnv[key] !== ipc;
+            }))
+                return result('manual', 'Custom target environment preserved; align browser and service targets manually.');
+            if ((current?.type ?? 'stdio') === 'stdio' && current?.command === server.command && JSON.stringify(current.args) === JSON.stringify(server.args)
+                && (name !== 'u-chan-secrets' || o.browser === undefined || (curEnv.U_CHAN_BROWSER === o.browser && safeCdpOrigin(curEnv.U_CHAN_CDP) === origin)))
+                continue;
+            if (!simple(current, name))
+                return result('manual', 'Custom Claude Code settings preserved; configure this registration manually.');
+            pending.push({ name, server, replace: true });
+        }
+        if (pending.length === 0)
+            return result('ready', 'Claude Code registrations match; active session ownership is unverified.');
+        const replaces = pending.some(p => p.replace);
+        if (!o.apply || (replaces && !o.replaceExisting))
+            return result(replaces ? 'needs_update' : 'missing', 'Explicit setup apply is required; replacements also require --replace-existing.');
+        backupPath = await backupFile(o.configPath, join(o.configDir, '#0 backup'), '.json');
+        for (const { name, server, replace } of pending) {
+            if (replace) {
+                if ((await d.exec(['mcp', 'remove', '--scope', 'user', name])).code !== 0)
+                    return result('unavailable', 'Claude Code change failed; inspect configuration before retrying.');
+                changed = true;
+            }
+            if ((await d.exec(['mcp', 'add-json', '--scope', 'user', name, JSON.stringify(server)])).code !== 0)
+                return result('unavailable', 'Claude Code change failed; completed changes and backup were retained.');
+            changed = true;
+        }
+        return result('ready', 'Claude Code registrations saved. Restart the AI session; active ownership remains unverified.');
+    }
+    catch {
+        return result('unavailable', 'Claude Code setup unavailable; inspect configuration and any retained backup before retrying.');
+    }
+}

package/dist/client/codex-setup.js

@@ -43,7 +43,10 @@ async function backup(configDir) {
     const info = await lstat(root);
     if (!info.isDirectory() || info.isSymbolicLink() || (await realpath(root)).toLowerCase() !== root.toLowerCase())
         throw new Error('redirected config');
-    const config = join(root, 'config.toml');
+    return backupFile(join(root, 'config.toml'), join(root, '#0 backup'), '.toml');
+}
+/** Copy a regular config file into a non-redirected backup directory; undefined when the file does not exist. */
+export async function backupFile(config, dir, ext) {
     try {
         const file = await lstat(config);
         if (!file.isFile() || file.isSymbolicLink())
@@ -54,13 +57,11 @@ async function backup(configDir) {
             return undefined;
         throw err;
     }
-    const dir = join(root, '#0 backup');
-    await mkdir(dir, { mode: 0o700 }).catch(err => { if (err.code !== 'EEXIST')
-        throw err; });
+    await mkdir(dir, { recursive: true, mode: 0o700 });
     const target = await lstat(dir);
     if (!target.isDirectory() || target.isSymbolicLink() || (await realpath(dir)).toLowerCase() !== dir.toLowerCase())
         throw new Error('redirected backup');
-    const path = join(dir, `u-chan-setup-${randomUUID()}.toml`);
+    const path = join(dir, `u-chan-setup-${randomUUID()}${ext}`);
     await copyFile(config, path, constants.COPYFILE_EXCL);
     await chmod(path, 0o600);
     return path;

package/dist/client/discord.js

@@ -0,0 +1,67 @@
+import { z } from 'zod';
+import { aliasSchema, batchSchema, connectionRequestSchema, snowflake } from '../discord/policy.js';
+const connectionResult = z.object({ guild: z.object({ id: snowflake }), totals: z.object({ channels: z.number().int().min(0).max(1000), roles: z.number().int().min(0).max(1000) }) });
+/** Reuse approved metadata inspection; return only a bounded health summary, never raw metadata. */
+export async function testDiscordConnection(client, alias) {
+    if (!aliasSchema.safeParse(alias).success)
+        return { ok: false, message: 'invalid Discord alias' };
+    if (!client.discordInspect)
+        return { ok: false, message: 'Discord broker unavailable; update the local client' };
+    let result;
+    try {
+        result = await client.discordInspect(alias);
+    }
+    catch {
+        return { ok: false, message: 'Discord connection test unavailable; check service and vault status' };
+    }
+    if (!result.ok)
+        return result;
+    try {
+        const data = connectionResult.parse(JSON.parse(result.message));
+        return { ok: true, message: JSON.stringify({ connection: alias, status: 'connected', readOnly: true, serverId: data.guild.id, channels: data.totals.channels, roles: data.totals.roles }) };
+    }
+    catch {
+        return { ok: false, message: 'Discord connection test received an invalid service response' };
+    }
+}
+export const DISCORD_USAGE = 'usage: u-chan discord allow <connection.json> | list | test <alias> | inspect <alias> [member-id] [--page <0..999>] | apply <alias> <operations.json> | revoke <alias>';
+export async function runDiscordCli(args, client, read) {
+    const [cmd, arg, third] = args;
+    const invalid = { ok: false, message: DISCORD_USAGE };
+    try {
+        if (cmd === 'test' && args.length === 2)
+            return await testDiscordConnection(client, arg);
+        if (cmd === 'list' && args.length === 1)
+            return await client.discordListAllowed?.() ?? invalid;
+        if (cmd === 'revoke' && args.length === 2 && aliasSchema.safeParse(arg).success)
+            return await client.discordRevoke?.(arg) ?? invalid;
+        if (cmd === 'inspect' && aliasSchema.safeParse(arg).success) {
+            let member, page = 0;
+            const extra = args.slice(2);
+            if (extra[0] && extra[0] !== '--page') {
+                member = extra.shift();
+                if (!snowflake.safeParse(member).success)
+                    return invalid;
+            }
+            if (extra.length) {
+                if (extra.length !== 2 || extra[0] !== '--page' || !/^(0|[1-9][0-9]{0,2})$/.test(extra[1]))
+                    return invalid;
+                page = Number(extra[1]);
+            }
+            return await client.discordInspect?.(arg, member, page) ?? invalid;
+        }
+        if ((cmd === 'allow' && args.length === 2) || (cmd === 'apply' && args.length === 3 && aliasSchema.safeParse(arg).success)) {
+            const raw = await read(cmd === 'allow' ? arg : third);
+            if (Buffer.byteLength(raw) > 16384)
+                return { ok: false, message: 'Discord input file is too large' };
+            const data = JSON.parse(raw);
+            if (cmd === 'allow')
+                return connectionRequestSchema.safeParse(data).success ? await client.discordRequestAllow?.(data) ?? invalid : invalid;
+            return batchSchema.safeParse(data).success ? await client.discordApply?.(arg, data) ?? invalid : invalid;
+        }
+        return invalid;
+    }
+    catch {
+        return { ok: false, message: 'Discord command failed; check input JSON and service availability' };
+    }
+}

package/dist/client/github.js

@@ -0,0 +1,28 @@
+import { aliasSchema, githubProposalSchema, githubReadSchema, githubCreateSchema } from '../github/policy.js';
+export const GITHUB_USAGE = 'usage: u-chan github allow <connection.json> | list | test <alias> | read <alias> <request.json> | create <alias> <operation.json> | revoke <alias>';
+export async function runGithubCli(args, client, read) {
+    const [command, alias, file] = args, invalid = { ok: false, message: GITHUB_USAGE };
+    try {
+        if (command === 'list' && args.length === 1)
+            return await client.githubListAllowed?.() ?? invalid;
+        if (command === 'revoke' && args.length === 2 && aliasSchema.safeParse(alias).success)
+            return await client.githubRevoke?.(alias) ?? invalid;
+        if (command === 'test' && args.length === 2 && aliasSchema.safeParse(alias).success)
+            return await client.githubRead?.(alias, { resource: 'repository' }) ?? invalid;
+        if ((command === 'allow' && args.length === 2) || (['read', 'create'].includes(command) && args.length === 3 && aliasSchema.safeParse(alias).success)) {
+            const raw = await read(command === 'allow' ? alias : file);
+            if (Buffer.byteLength(raw) > 16384)
+                return { ok: false, message: 'GitHub input file is too large' };
+            const data = JSON.parse(raw);
+            if (command === 'allow')
+                return githubProposalSchema.safeParse(data).success ? await client.githubRequestAllow?.(data) ?? invalid : invalid;
+            if (command === 'read')
+                return githubReadSchema.safeParse(data).success ? await client.githubRead?.(alias, data) ?? invalid : invalid;
+            return githubCreateSchema.safeParse(data).success ? await client.githubCreate?.(alias, data) ?? invalid : invalid;
+        }
+        return invalid;
+    }
+    catch {
+        return { ok: false, message: 'GitHub command failed; check JSON input and service availability' };
+    }
+}

package/dist/client/setup.js

@@ -2,6 +2,7 @@ import { bounded, safeCdpOrigin } from '../core/doctor.js';
 export async function runSetup(o, d) {
     const r = { version: 1, state: 'needs_attention', sharing: 'unobserved', restartRequired: false, checks: [], actions: [], client: 'unavailable', changed: false };
     const action = (id, message, required = true) => r.actions.push({ id, message, required });
+    const clientName = d.clientName ?? 'Codex';
     if (d.browser || o.browser)
         r.browser = o.browser ?? d.browser;
     try {
@@ -15,10 +16,15 @@ export async function runSetup(o, d) {
         }
         r.checks = (await d.doctor()).checks;
         if (d.platform !== 'win32') {
-            action('configure_mcp', 'Automatic setup supports Windows and Codex only; configure other platforms manually.');
+            action('configure_mcp', `Automatic ${clientName} setup supports Windows only; configure other platforms manually.`);
             r.client = 'manual';
             return r;
         }
+        if (d.configureShell) {
+            r.shell = await d.configureShell(o.apply);
+            r.changed = r.shell.changed;
+            action('configure_shell', r.shell.message, !r.shell.ready);
+        }
         if (r.checks.some(c => c.id === 'browser_target' && c.state === 'fail')) {
             r.sharing = 'mismatch';
             action('configure_mcp', 'Align the desktop and service loopback browser targets before applying setup.');
@@ -26,9 +32,9 @@ export async function runSetup(o, d) {
         }
         const configured = await d.configure({ apply: o.apply, replaceExisting: o.replaceExisting, ...(o.browser ? { browser: o.browser } : {}) });
         r.client = configured.state;
-        r.changed = configured.changed;
+        r.changed ||= configured.changed;
         r.backupPath = configured.backupPath;
-        r.restartRequired = r.changed;
+        r.restartRequired = configured.changed;
         if (o.browser && o.apply && r.client === 'ready') {
             if (!d.selectBrowser)
                 throw new Error('browser selection unavailable');
@@ -48,7 +54,7 @@ export async function runSetup(o, d) {
         const pw = r.checks.find(c => c.id === 'playwright');
         const mismatch = r.checks.some(c => c.id === 'browser_target' && c.state === 'fail');
         r.sharing = mismatch || pw?.state === 'fail' ? 'mismatch' : pw?.state === 'pass' ? 'process_configured' : 'unobserved';
-        r.restartRequired = r.changed || pw?.state === 'fail';
+        r.restartRequired ||= pw?.state === 'fail';
         const ids = { registration: 'install_service', service: 'install_service', ipc: 'install_service',
             version: 'update_service', assets: 'repair_permissions', permissions: 'repair_permissions', service_browser: 'start_browser', chrome: 'start_browser',
             browser_target: 'configure_mcp', browser_identity: 'start_browser', playwright: 'configure_mcp', uac: 'review_uac' };
@@ -58,14 +64,14 @@ export async function runSetup(o, d) {
                 action(id, c.nextAction, c.required && c.state !== 'pass');
             }
         if (r.client !== 'ready')
-            action('configure_mcp', 'Inspect Codex configuration; apply missing registrations explicitly and preserve custom settings.');
+            action('configure_mcp', `Inspect ${clientName} configuration; apply missing registrations explicitly and preserve custom settings.`);
         if (!started)
             action('start_browser', 'Selected dedicated browser is unavailable or mismatched. Close only the previous dedicated U-Chan instance before switching, then run setup again.');
         if (r.restartRequired)
             action('restart_client', 'Restart the AI session to load saved MCP registrations.', false);
         action('configure_mcp', 'Active AI-session browser ownership is unverified; check the current client browser connection.', false);
         const requiredOk = r.checks.length > 0 && r.checks.filter(c => c.required).every(c => c.state === 'pass');
-        if (requiredOk && r.client === 'ready' && started && !mismatch)
+        if (requiredOk && r.client === 'ready' && started && !mismatch && r.shell?.ready !== false)
             r.state = 'configured';
         return r;
     }
@@ -77,3 +83,31 @@ export async function runSetup(o, d) {
 export function setupExitCode(r) {
     return r.state === 'needs_attention' ? 1 : r.restartRequired ? 2 : 0;
 }
+export const SETUP_CLIENT_NAMES = { codex: 'Codex', claude: 'Claude Code' };
+const STATE_RANK = ['ready', 'missing', 'needs_update', 'manual', 'unavailable'];
+/** Configure several AI clients in order; the combined state is the least ready one, and every client is attempted. */
+export function combineClients(entries) {
+    let last = [];
+    return {
+        clientName: entries.length ? entries.map(e => SETUP_CLIENT_NAMES[e.client]).join(' and ') : 'Codex or Claude Code',
+        results: () => last,
+        configure: async (options) => {
+            last = [];
+            if (entries.length === 0)
+                return { state: 'unavailable', changed: false, message: 'No Codex or Claude Code CLI found on PATH; install one or pass --client.' };
+            for (const e of entries) {
+                let r;
+                try {
+                    r = await e.configure(options);
+                }
+                catch {
+                    r = { state: 'unavailable', changed: false, message: `${SETUP_CLIENT_NAMES[e.client]} setup unavailable.` };
+                }
+                last.push({ client: e.client, ...r });
+            }
+            const state = last.reduce((w, r) => STATE_RANK.indexOf(r.state) > STATE_RANK.indexOf(w) ? r.state : w, 'ready');
+            const backups = last.flatMap(r => r.backupPath ? [r.backupPath] : []);
+            return { state, changed: last.some(r => r.changed), ...(backups.length ? { backupPath: backups.join('; ') } : {}), message: last.map(r => `${SETUP_CLIENT_NAMES[r.client]}: ${r.message}`).join(' ') };
+        },
+    };
+}