Second and final PR for `mosaic [yolo] claudex` — runs GPT models inside the
Claude Code harness via claude-code-proxy (ChatGPT-subscription OAuth). Builds
on the PR-1 preflight/lifecycle library (#793).
New `claudex.ts` (pure / dependency-injected composition):
- resolveClaudexConfigDir / assertIsolatedConfigDir — the isolated
CLAUDE_CONFIG_DIR seam. HARD REQ 1 (provable isolation): canonicalizes both
sides, rejects `~/.claude` and any descendant, ensures the dir 0700, then
re-checks post-create and rejects a symlinked target (TOCTOU). Ambient
CLAUDE_CONFIG_DIR is never inherited. Fails closed on any uncertainty.
- buildClaudexEnv — HARD REQ 2 (zero token leakage): strips the entire
credential-bearing env family (ANTHROPIC_*, *_TOKEN, *_API_KEY, *_SECRET,
CLAUDE_CODE_OAUTH*) and hands Claude Code only ANTHROPIC_AUTH_TOKEN=unused.
Never reads the proxy credential file. Returns a fresh object (no mutation).
- resolveClaudexModels — P3 tier map: primary→gpt-5.6-sol,
small/fast→gpt-5.6-luna; operator env values win.
- buildClaudexBanner / buildClaudexContractNote — P4 EXPERIMENTAL classification
(no token material by construction).
- runClaudexProxyGate — preflight → device reauth (only when needed) → ensure a
trusted-live listener → re-preflight; surfaces non-sensitive problems only.
- launchClaudex — fail-closed DI orchestration: preflight → gate → compose env →
exec; never reaches exec on a gate failure or guard throw. Proxy endpoint
imported from claudex-proxy.ts (single source of truth).
launch.ts wiring:
- execRuntime gains an env parameter.
- `claudex` + `yolo claudex` commander dispatch (keeps the #454 arg-slice fix);
claudexHandler is an injectable seam for the wiring tests.
- launchClaudexProduction glue assembles the real harness adapter.
Tests: 45 claudex specs + 5 launch wiring specs, TDD red-first. New-module
coverage 99% stmts/lines, 93% branch (≥85% gate). Full mosaic suite 1164 green;
typecheck / lint / format:check green.
Refs #790
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
