ab8c9a2d4b
All checks were successful
ci/woodpecker/pr/ci Pipeline was successful
Second and final PR for `mosaic [yolo] claudex` — runs GPT models inside the Claude Code harness via claude-code-proxy (ChatGPT-subscription OAuth). Builds on the PR-1 preflight/lifecycle library (#793). New `claudex.ts` (pure / dependency-injected composition): - resolveClaudexConfigDir / assertIsolatedConfigDir — the isolated CLAUDE_CONFIG_DIR seam. HARD REQ 1 (provable isolation): canonicalizes both sides, rejects `~/.claude` and any descendant, ensures the dir 0700, then re-checks post-create and rejects a symlinked target (TOCTOU). Ambient CLAUDE_CONFIG_DIR is never inherited. Fails closed on any uncertainty. - buildClaudexEnv — HARD REQ 2 (zero token leakage): strips the entire credential-bearing env family (ANTHROPIC_*, *_TOKEN, *_API_KEY, *_SECRET, CLAUDE_CODE_OAUTH*) and hands Claude Code only ANTHROPIC_AUTH_TOKEN=unused. Never reads the proxy credential file. Returns a fresh object (no mutation). - resolveClaudexModels — P3 tier map: primary→gpt-5.6-sol, small/fast→gpt-5.6-luna; operator env values win. - buildClaudexBanner / buildClaudexContractNote — P4 EXPERIMENTAL classification (no token material by construction). - runClaudexProxyGate — preflight → device reauth (only when needed) → ensure a trusted-live listener → re-preflight; surfaces non-sensitive problems only. - launchClaudex — fail-closed DI orchestration: preflight → gate → compose env → exec; never reaches exec on a gate failure or guard throw. Proxy endpoint imported from claudex-proxy.ts (single source of truth). launch.ts wiring: - execRuntime gains an env parameter. - `claudex` + `yolo claudex` commander dispatch (keeps the #454 arg-slice fix); claudexHandler is an injectable seam for the wiring tests. - launchClaudexProduction glue assembles the real harness adapter. Tests: 45 claudex specs + 5 launch wiring specs, TDD red-first. New-module coverage 99% stmts/lines, 93% branch (≥85% gate). Full mosaic suite 1164 green; typecheck / lint / format:check green. Refs #790 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>