banto 5.2.2__py3-none-any.whl

banto/broker.py

@@ -0,0 +1,314 @@
+"""One macOS process owns Keychain operations; clients receive results only.
+
+The Unix socket is a same-user boundary, not an app-signature sandbox. There is
+deliberately no get-secret, arbitrary URL, shell, import, or environment API.
+"""
+from __future__ import annotations
+
+import argparse
+import asyncio
+import contextvars
+import fcntl
+import inspect
+import json
+import os
+from pathlib import Path
+import plistlib
+import socket
+import socketserver
+import struct
+import subprocess
+import sys
+import time
+import urllib.error
+import urllib.request
+
+from .broker_client import (BrokerClient, BrokerError, MAX_MESSAGE, check_private,
+                            encode_message, read_message, runtime_dir, socket_path)
+
+IN_SERVICE = False
+_observed = contextvars.ContextVar("banto_broker_secrets", default=None)
+LABEL = "work.allnew.banto.broker"
+MCP_OPERATIONS = (
+    "banto_sync_status", "banto_sync_push", "banto_sync_audit", "banto_validate",
+    "banto_validate_keychain", "banto_budget_status", "banto_sync_setup",
+    "banto_register_key", "banto_lease_list", "banto_lease_cleanup",
+    "banto_sealed_create_key", "banto_sealed_export_pubkey", "banto_sealed_sign",
+    "banto_sealed_list",
+)
+
+
+def require_service() -> None:
+    """Fail closed for legacy library calls once this machine enables the broker.
+
+    This prevents accidental direct reads, not hostile code under the same UID.
+    """
+    if not IN_SERVICE and (runtime_dir() / "required").exists():
+        raise BrokerError("direct_keychain_disabled; use BrokerClient operations or banto register")
+
+
+def observe_secret(value: str) -> None:
+    values = _observed.get()
+    if values is not None:
+        values.add(value)
+
+
+class NoRedirect(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        return None
+
+
+def api_request(provider: str, payload: dict) -> dict:
+    """Non-streaming generation at fixed official endpoints; no caller auth/URL."""
+    if provider not in ("openai", "anthropic") or not isinstance(payload, dict):
+        raise BrokerError("unsupported_request")
+    allowed = ({"model", "input", "instructions", "max_output_tokens", "temperature",
+                "top_p", "reasoning", "text", "store"} if provider == "openai" else
+               {"model", "messages", "max_tokens", "system", "temperature", "top_p",
+                "top_k", "stop_sequences", "thinking"})
+    if set(payload) - allowed or not isinstance(payload.get("model"), str):
+        raise BrokerError("unsupported_payload_fields")
+    from .vault import SecureVault
+    if SecureVault().budget_enabled:
+        raise BrokerError("budget_enabled; generation adapter must support hold/settle before use")
+    from .keychain import KeychainStore
+    from .sync.config import SyncConfig
+    key = KeychainStore(service_prefix=SyncConfig.load().keychain_service).get(provider)
+    if not key:
+        raise BrokerError("key_unavailable; register or approve access locally")
+    headers = {"Content-Type": "application/json"}
+    if provider == "openai":
+        url = "https://api.openai.com/v1/responses"
+        headers["Authorization"] = "Bearer " + key
+        payload = {**payload, "store": False}
+    else:
+        url = "https://api.anthropic.com/v1/messages"
+        headers.update({"x-api-key": key, "anthropic-version": "2023-06-01"})
+    # Ignore ambient proxy settings and never forward auth through redirects.
+    opener = urllib.request.build_opener(urllib.request.ProxyHandler({}), NoRedirect())
+    request = urllib.request.Request(url, json.dumps(payload).encode(), headers, method="POST")
+    try:
+        with opener.open(request, timeout=120) as response:
+            raw = response.read(MAX_MESSAGE + 1)
+        if len(raw) > MAX_MESSAGE:
+            raise BrokerError("upstream_response_too_large")
+        result = json.loads(raw)
+        # Filter after decoding, so JSON escapes cannot defeat redaction.
+        return redact(result, {key})
+    except urllib.error.HTTPError as error:
+        error.close()
+        return {"error": "upstream_http_error", "status": error.code}
+    except (OSError, ValueError):
+        raise BrokerError("upstream_failed_or_outcome_unknown") from None
+
+
+def redact(value, values: set[str]):
+    if isinstance(value, str):
+        for secret in sorted(values, key=len, reverse=True):
+            if secret:
+                value = value.replace(secret, "[REDACTED]")
+        return value
+    if isinstance(value, dict):
+        return {redact(k, values): redact(v, values) for k, v in value.items()}
+    if isinstance(value, list):
+        return [redact(v, values) for v in value]
+    return value
+
+
+def _dispatch(operation: str, arguments: dict) -> dict:
+    if operation == "kimaru_evaluation_azure_preflight" and not arguments:
+        from .kimaru_evaluation import azure_preflight
+        return azure_preflight()
+    if operation == "kimaru_evaluation_preflight" and not arguments:
+        from .kimaru_evaluation import preflight
+        return preflight()
+    if operation == "kimaru_evaluation_capabilities" and not arguments:
+        from .kimaru_evaluation import capabilities
+        return capabilities()
+    if operation == "kimaru_evaluation_prepare":
+        if set(arguments) != {"candidate_sha", "limit_usd", "expires_at", "owner_confirm", "gemini_paid_tier_confirmed"}:
+            raise BrokerError("kimaru_evaluation_arguments_invalid")
+        from .kimaru_evaluation import prepare
+        return prepare(**arguments)
+    if operation == "kimaru_evaluation_generate":
+        if set(arguments) != {"provider", "payload", "request_id", "case_id", "candidate_sha"}:
+            raise BrokerError("kimaru_evaluation_arguments_invalid")
+        from .kimaru_evaluation import generate
+        return generate(**arguments)
+    if operation == "kimaru_material_capabilities" and not arguments:
+        from .kimaru_material import capabilities
+        return capabilities()
+    if operation == "kimaru_material_provision":
+        if set(arguments) != {"environment", "purpose", "candidate_sha", "approved_region", "owner_confirm"}:
+            raise BrokerError("kimaru_material_arguments_invalid")
+        from .kimaru_material import provision
+        return provision(**arguments)
+    if operation == "health" and not arguments:
+        return {"status": "ready", "pid": os.getpid(), "python": sys.executable,
+                "python_realpath": str(Path(sys.executable).resolve()),
+                "protocol": 1, "direct_banto_access_blocked": (runtime_dir() / "required").exists()}
+    if operation == "api_request":
+        return api_request(**arguments)
+    if operation in ("register_asc", "register_x_oauth") and not arguments:
+        from . import register_popup
+        name = "serve_asc_register_popup" if operation == "register_asc" else "serve_x_oauth_register_popup"
+        return {"url": getattr(register_popup, name)(blocking=False), "status": "popup_opened"}
+    if operation not in MCP_OPERATIONS:
+        raise BrokerError("operation_not_allowed")
+    from . import mcp_server
+    function = getattr(mcp_server, operation)
+    inspect.signature(function).bind(**arguments)
+    return asyncio.run(function(**arguments))
+
+
+def dispatch(operation: str, arguments: dict) -> dict:
+    values: set[str] = set()
+    token = _observed.set(values)
+    try:
+        return redact(_dispatch(operation, arguments), values)
+    finally:
+        _observed.reset(token)
+        values.clear()
+
+
+def peer_uid(connection) -> int:
+    if sys.platform == "darwin":
+        # LOCAL_PEERCRED (SOL_LOCAL=0), struct xucred: version, uid, groups.
+        raw = connection.getsockopt(0, 1, 80)
+        version, uid = struct.unpack_from("=II", raw)
+        if version != 0:
+            raise BrokerError("unsupported_peer_credentials")
+        return uid
+    raw = connection.getsockopt(socket.SOL_SOCKET, socket.SO_PEERCRED, 12)
+    return struct.unpack("3i", raw)[1]
+
+
+class Handler(socketserver.StreamRequestHandler):
+    def handle(self):
+        self.connection.settimeout(180)
+        try:
+            if peer_uid(self.connection) != os.getuid():
+                raise BrokerError("peer_denied")
+            request = read_message(self.rfile)
+            if set(request) != {"operation", "arguments"} or not isinstance(request["arguments"], dict):
+                raise BrokerError("invalid_request")
+            # Serialized execution keeps existing sync/rotation state safe.
+            result = self.server.dispatch(request["operation"], request["arguments"])
+            response = {"ok": True, "result": result}
+        except BrokerError as error:
+            response = {"ok": False, "error": str(error)}
+        except Exception:
+            # Exceptions can contain credentials or upstream response bodies.
+            response = {"ok": False, "error": "operation_failed"}
+        try:
+            self.wfile.write(encode_message(response))
+        except (OSError, BrokerError):
+            pass
+
+
+class Server(socketserver.UnixStreamServer):
+    dispatch = staticmethod(dispatch)
+
+    def handle_error(self, request, client_address):
+        pass  # Never emit request data or exception tracebacks.
+
+
+def serve(path: Path | None = None) -> None:
+    global IN_SERVICE
+    path = path or socket_path()
+    path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+    check_private(path.parent, directory=True)
+    lock_fd = os.open(path.parent / "service.lock", os.O_CREAT | os.O_RDWR | os.O_NOFOLLOW, 0o600)
+    try:
+        fcntl.flock(lock_fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
+        if path.exists() or path.is_symlink():
+            check_private(path)
+            path.unlink()
+        IN_SERVICE = True
+        old_umask = os.umask(0o077)
+        try:
+            server = Server(str(path), Handler)
+        finally:
+            os.umask(old_umask)
+        with server:
+            try:
+                server.serve_forever()
+            finally:
+                path.unlink(missing_ok=True)
+    finally:
+        IN_SERVICE = False
+        os.close(lock_fd)
+
+
+def install() -> None:
+    """Install a user LaunchAgent with one absolute Python path; no Keychain read."""
+    if sys.platform != "darwin":
+        raise BrokerError("macos_required")
+    # Validate dependencies without importing/reading user credentials.
+    import mcp  # noqa: F401
+    directory = runtime_dir()
+    directory.mkdir(parents=True, exist_ok=True, mode=0o700)
+    check_private(directory, directory=True)
+    plist_path = Path.home() / "Library" / "LaunchAgents" / (LABEL + ".plist")
+    plist_path.parent.mkdir(parents=True, exist_ok=True)
+    if plist_path.exists():
+        raise BrokerError("launch_agent_already_exists; inspect before replacing")
+    spec = {"Label": LABEL, "ProgramArguments": [sys.executable, "-m", "banto.broker", "serve"],
+            "WorkingDirectory": str(Path(__file__).resolve().parent.parent),
+            "RunAtLoad": True, "KeepAlive": True, "Umask": 0o077,
+            "StandardOutPath": "/dev/null", "StandardErrorPath": "/dev/null"}
+    with plist_path.open("xb") as target:
+        plistlib.dump(spec, target)
+    os.chmod(plist_path, 0o600)
+    result = subprocess.run(["launchctl", "bootstrap", f"gui/{os.getuid()}", str(plist_path)], capture_output=True)
+    if result.returncode:
+        plist_path.unlink()
+        raise BrokerError("launch_agent_bootstrap_failed")
+    result = subprocess.run(["launchctl", "kickstart", f"gui/{os.getuid()}/{LABEL}"], capture_output=True)
+    if result.returncode:
+        raise BrokerError("launch_agent_installed_but_start_failed")
+    deadline = time.monotonic() + 10
+    while True:
+        try:
+            BrokerClient(timeout=0.5).call("health")
+            break
+        except BrokerError:
+            if time.monotonic() >= deadline:
+                raise BrokerError("launch_agent_installed_but_not_ready") from None
+            time.sleep(0.1)
+    print(json.dumps({"installed": True, "plist": str(plist_path), "python": sys.executable}))
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("command", choices=["serve", "install", "health", "enable", "disable", "call"])
+    parser.add_argument("operation", nargs="?")
+    args = parser.parse_args()
+    try:
+        if args.command == "serve":
+            # -m executes this file as __main__; use the canonical module so
+            # Keychain's guard sees the same IN_SERVICE flag.
+            from . import broker
+            broker.serve()
+        elif args.command == "install":
+            install()
+        elif args.command == "enable":
+            BrokerClient().call("health")
+            (runtime_dir() / "required").touch(mode=0o600)
+            print('{"direct_banto_access_blocked": true}')
+        elif args.command == "disable":
+            (runtime_dir() / "required").unlink(missing_ok=True)
+            print('{"direct_banto_access_blocked": false, "restart_mcp_clients": true}')
+        else:
+            operation = "health" if args.command == "health" else args.operation
+            if not operation:
+                parser.error("call requires an operation; arguments are a JSON object on stdin")
+            arguments = {} if args.command == "health" else json.load(sys.stdin)
+            print(json.dumps(BrokerClient().call(operation, **arguments), ensure_ascii=False))
+    except (BrokerError, OSError, ValueError, TypeError):
+        print("Broker command failed; no direct Keychain fallback. Check service and operation arguments.", file=sys.stderr)
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()

banto/broker_cli.py

@@ -0,0 +1,40 @@
+"""Route supported legacy CLI commands through the installed broker."""
+import json
+
+from .broker_client import BrokerClient, BrokerError, runtime_dir
+
+
+def route_if_enabled(args: list[str]) -> bool:
+    if not (runtime_dir() / "required").exists():
+        return False
+    operation = None
+    arguments = {}
+    if args[0] == "register" and len(args) <= 2:
+        operation = "banto_register_key"
+        arguments = {"provider": args[1] if len(args) == 2 else ""}
+    elif args in (["register-asc"], ["asc-register"]):
+        operation = "register_asc"
+    elif args == ["register-x-oauth"]:
+        operation = "register_x_oauth"
+    elif args[0] == "sync":
+        if args[1:] == ["status"]:
+            operation = "banto_sync_status"
+        elif args[1:] == ["audit"]:
+            operation = "banto_sync_audit"
+        elif args[1:] == ["validate"]:
+            operation = "banto_validate"
+        elif args[1:] == ["validate", "--keychain"]:
+            operation = "banto_validate_keychain"
+        elif args[1:] == ["push"]:
+            operation = "banto_sync_push"
+    if operation:
+        try:
+            print(json.dumps(BrokerClient().call(operation, **arguments), ensure_ascii=False))
+        except BrokerError:
+            raise SystemExit("Broker operation failed; no direct Keychain fallback. Check service status.") from None
+        return True
+    # Existing metadata and Secure Enclave commands keep their behavior. Other
+    # legacy commands need explicit migration, rather than a silent bypass.
+    if args[0] in {"store", "delete", "sync", "lease"}:
+        raise SystemExit("This legacy command is disabled in broker mode. Use banto register or an allowlisted broker operation.")
+    return False

banto/broker_client.py

@@ -0,0 +1,69 @@
+"""Local operation client. This module never imports or reads Keychain."""
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+import socket
+import stat
+
+MAX_MESSAGE = 8 * 1024 * 1024
+
+
+class BrokerError(RuntimeError):
+    pass
+
+
+def runtime_dir() -> Path:
+    return Path.home() / "Library" / "Application Support" / "banto" / "broker"
+
+
+def socket_path() -> Path:
+    return runtime_dir() / "broker.sock"
+
+
+def read_message(stream) -> dict:
+    line = stream.readline(MAX_MESSAGE + 1)
+    if len(line) > MAX_MESSAGE or not line.endswith(b"\n"):
+        raise BrokerError("invalid_message")
+    value = json.loads(line)
+    if not isinstance(value, dict):
+        raise BrokerError("invalid_message")
+    return value
+
+
+def encode_message(value: dict) -> bytes:
+    data = json.dumps(value, ensure_ascii=True, allow_nan=False).encode() + b"\n"
+    if len(data) > MAX_MESSAGE:
+        raise BrokerError("message_too_large")
+    return data
+
+
+def check_private(path: Path, *, directory: bool = False) -> None:
+    info = path.lstat()
+    expected = stat.S_ISDIR if directory else stat.S_ISSOCK
+    if not expected(info.st_mode) or info.st_uid != os.getuid() or info.st_mode & 0o077:
+        raise BrokerError("unsafe_broker_path")
+
+
+class BrokerClient:
+    def __init__(self, path: Path | None = None, *, timeout: float = 180):
+        self.path = path or socket_path()
+        self.timeout = timeout
+
+    def call(self, operation: str, **arguments) -> dict:
+        """Invoke an allowlisted operation. No automatic retry or direct fallback."""
+        try:
+            check_private(self.path.parent, directory=True)
+            check_private(self.path)
+            with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as connection:
+                connection.settimeout(self.timeout)
+                connection.connect(str(self.path))
+                connection.sendall(encode_message({"operation": operation, "arguments": arguments}))
+                with connection.makefile("rb") as stream:
+                    result = read_message(stream)
+        except (OSError, ValueError):
+            raise BrokerError("broker_unavailable_or_outcome_unknown; do not retry mutations blindly") from None
+        if not result.get("ok"):
+            raise BrokerError(result.get("error", "operation_failed"))
+        return result["result"]

banto/broker_mcp.py

@@ -0,0 +1,54 @@
+"""MCP transport bridge. All operations execute in the common local broker."""
+from __future__ import annotations
+
+import asyncio
+import functools
+import sys
+
+from mcp.server.fastmcp import FastMCP
+
+from .broker import MCP_OPERATIONS
+from .broker_client import BrokerClient
+
+
+def bridge(function):
+    @functools.wraps(function)
+    async def forwarded(*args, **kwargs):
+        import inspect
+        arguments = inspect.signature(function).bind(*args, **kwargs)
+        arguments.apply_defaults()
+        return await asyncio.to_thread(BrokerClient().call, function.__name__, **arguments.arguments)
+    return forwarded
+
+
+def build_mcp() -> FastMCP:
+    from . import mcp_server
+    server = FastMCP("banto")
+    for name in MCP_OPERATIONS:
+        # Preserve each tool's existing annotations and schema.
+        original = mcp_server.mcp._tool_manager.get_tool(name)
+        server.add_tool(bridge(getattr(mcp_server, name)), annotations=original.annotations)
+
+    @server.tool(annotations={"readOnlyHint": False, "destructiveHint": False, "openWorldHint": True})
+    async def banto_api_request(provider: str, payload: dict) -> dict:
+        """Call OpenAI Responses or Anthropic Messages without exposing the key.
+
+        This incurs provider API usage. Supply the model explicitly. No arbitrary
+        URLs, auth headers, streaming, remote tools, or secret-return operations.
+        """
+        return await asyncio.to_thread(BrokerClient().call, "api_request", provider=provider, payload=payload)
+
+    @server.tool(annotations={"readOnlyHint": True, "openWorldHint": False})
+    async def banto_broker_health() -> dict:
+        """Check the common process without reading secrets or contacting providers."""
+        return await asyncio.to_thread(BrokerClient().call, "health")
+
+    return server
+
+
+def main() -> None:
+    # Only a local stdio bridge is exposed here. Remote HTTP ingress needs its
+    # own authenticated gateway, not an unauthenticated loopback MCP endpoint.
+    if sys.argv[1:] not in ([], ["--transport", "stdio"]):
+        raise SystemExit("Broker MCP supports local stdio only. Use a separately authenticated gateway for remote clients.")
+    build_mcp().run(transport="stdio")

banto/broker_setup.py

@@ -0,0 +1,121 @@
+"""Configure agent defaults without exposing existing config contents.
+
+Only the banto entry and an explicit managed instruction block are changed.
+Other tools, credentials, models, approval settings and reasoning are preserved.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+from pathlib import Path
+import tempfile
+
+START = "<!-- BEGIN banto-broker-default -->"
+END = "<!-- END banto-broker-default -->"
+RULE = """## Keychain利用の既定経路
+
+Keychainに登録済みの秘密値を利用・登録する場合は、共通bantoサービスを既定とする。
+- MCPの `banto` ツール、または `banto.broker_client.BrokerClient` から操作を依頼する。
+- 秘密値そのものを返す操作、`get_key()` / `KeychainStore.get()`、`security ... -w`、
+  Security.frameworkの直接呼び出し、環境変数への秘密値の取り出しを使用しない。
+- 登録は `banto_register_key` の本人用ローカル画面を使う。チャットに秘密値を入力させない。
+- 未対応の操作はbantoの許可された操作として実装・検証してから利用する。
+  banto停止・未対応・認証エラー時に直接読み取りへ迂回しない。
+- API送信・課金・外部変更は元の承認範囲と予算を守る。登録されたキーの一覧・値を一括取得しない。
+- macOSのパスワード、Touch ID、MFA等の本人確認はユーザーが操作する。
+"""
+
+
+def update_rules(text: str) -> str:
+    block = START + "\n" + RULE + END
+    if START in text or END in text:
+        if text.count(START) != 1 or text.count(END) != 1 or text.index(START) > text.index(END):
+            raise ValueError("invalid managed instruction block")
+        return text[:text.index(START)] + block + text[text.index(END) + len(END):]
+    return text.rstrip() + "\n\n" + block + "\n"
+
+
+def json_update(text: str, entry: dict) -> str:
+    data = json.loads(text) if text.strip() else {}
+    if not isinstance(data, dict) or not isinstance(data.get("mcpServers", {}), dict):
+        raise ValueError("invalid MCP configuration")
+    data.setdefault("mcpServers", {})["banto"] = entry
+    return json.dumps(data, ensure_ascii=False, indent=2) + "\n"
+
+
+def toml_update(text: str, command: str) -> str:
+    import tomllib
+    parsed = tomllib.loads(text)
+    entry = {"command": command, "args": [], "enabled": True}
+    existing = parsed.get("mcp_servers", {}).get("banto")
+    if existing == entry:
+        return text
+    if existing is not None:
+        # Never discard auth headers or nested tables from an existing entry.
+        raise ValueError("existing Codex banto entry differs; review it before replacing")
+    block = '\n[mcp_servers.banto]\ncommand = ' + json.dumps(command) + '\nargs = []\nenabled = true\n'
+    result = text.rstrip() + "\n" + block
+    assert tomllib.loads(result)["mcp_servers"]["banto"] == entry
+    return result
+
+
+def plan(home: Path, workspace: Path, command: Path, *, claude_config_dir: Path | None = None) -> dict[Path, str]:
+    if not command.is_absolute():
+        raise ValueError("launcher must be absolute")
+    entry = {"command": str(command), "args": []}
+    changes = {}
+    json_paths = [workspace / "mcp/.mcp.json", workspace / ".gemini/settings.json",
+                  workspace / "mcp_config.json", home / ".claude.json",
+                  home / ".gemini/settings.json", home / ".gemini/antigravity/mcp_config.json"]
+    if claude_config_dir is not None:
+        json_paths.append(claude_config_dir / ".claude.json")
+    for path in json_paths:
+        old = path.read_text() if path.exists() else ""
+        # Work on the resolved path so symlinked configs retain their aliases.
+        changes[path.resolve()] = json_update(old, entry)
+    path = home / ".codex/config.toml"
+    changes[path.resolve()] = toml_update(path.read_text() if path.exists() else "", str(command))
+    rule_paths = [home / rel for rel in (".codex/AGENTS.md", ".claude/CLAUDE.md", ".gemini/GEMINI.md")]
+    if claude_config_dir is not None:
+        rule_paths.append(claude_config_dir / "CLAUDE.md")
+    for path in rule_paths:
+        changes[path.resolve()] = update_rules(path.read_text() if path.exists() else "")
+    return {path: text for path, text in changes.items() if not path.exists() or path.read_text() != text}
+
+
+def apply(changes: dict[Path, str]) -> None:
+    for path, text in changes.items():
+        path.parent.mkdir(parents=True, exist_ok=True)
+        mode = path.stat().st_mode & 0o777 if path.exists() else 0o600
+        fd, name = tempfile.mkstemp(prefix=".banto-config-", dir=path.parent)
+        try:
+            with os.fdopen(fd, "w") as stream:
+                stream.write(text)
+            os.chmod(name, mode)
+            os.replace(name, path)
+        finally:
+            Path(name).unlink(missing_ok=True)
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--workspace", type=Path, required=True)
+    parser.add_argument("--launcher", type=Path, required=True)
+    parser.add_argument("--apply", action="store_true")
+    args = parser.parse_args()
+    try:
+        override = os.environ.get("CLAUDE_CONFIG_DIR")
+        claude_dir = Path(override).expanduser().resolve() if override else None
+        changes = plan(Path.home(), args.workspace, args.launcher, claude_config_dir=claude_dir)
+        if args.apply:
+            if not args.launcher.is_file() or not os.access(args.launcher, os.X_OK):
+                raise ValueError("launcher not executable")
+            apply(changes)
+        print(json.dumps({"applied": args.apply, "paths": [str(p) for p in changes]}, ensure_ascii=False))
+    except (ValueError, OSError):
+        raise SystemExit("Default configuration failed; config values suppressed. Review the target structure.") from None
+
+
+if __name__ == "__main__":
+    main()