fix(proxy): clean up temp launch settings

tests/unit/targets/settings-profile-browser-launch.test.ts

@@ -92,6 +92,8 @@ describe('settings profile browser launch', () => {
   let fakeClaudePath = '';
   let claudeArgsLogPath = '';
   let claudeEnvLogPath = '';
+  let claudeSettingsPathLogPath = '';
+  let claudeSettingsSnapshotPath = '';
   let browserProfileDir = '';
   let devtoolsServer: ChildProcess | undefined;
   let baseEnv: NodeJS.ProcessEnv;
@@ -107,6 +109,8 @@ describe('settings profile browser launch', () => {
     fakeClaudePath = path.join(tmpHome, 'fake-claude.sh');
     claudeArgsLogPath = path.join(tmpHome, 'claude-args.txt');
     claudeEnvLogPath = path.join(tmpHome, 'claude-env.txt');
+    claudeSettingsPathLogPath = path.join(tmpHome, 'claude-settings-path.txt');
+    claudeSettingsSnapshotPath = path.join(tmpHome, 'claude-settings-snapshot.json');
     browserProfileDir = path.join(tmpHome, 'chrome-user-data');
 
     fs.mkdirSync(ccsDir, { recursive: true });
@@ -138,6 +142,19 @@ describe('settings profile browser launch', () => {
       fakeClaudePath,
       `#!/bin/sh
 printf "%s\n" "$@" > "${claudeArgsLogPath}"
+settings_path=""
+prev=""
+for arg in "$@"; do
+  if [ "$prev" = "--settings" ]; then
+    settings_path="$arg"
+    break
+  fi
+  prev="$arg"
+done
+printf "%s" "$settings_path" > "${claudeSettingsPathLogPath}"
+if [ -n "$settings_path" ] && [ -f "$settings_path" ]; then
+  cat "$settings_path" > "${claudeSettingsSnapshotPath}"
+fi
 {
   printf "userDataDir=%s\n" "$CCS_BROWSER_USER_DATA_DIR"
   printf "legacyProfileDir=%s\n" "$CCS_BROWSER_PROFILE_DIR"
@@ -308,7 +325,7 @@ exit 0
     expect(launchSettingsPath).not.toBe(settingsPath);
 
     const persistedLaunchSettings = JSON.parse(
-      fs.readFileSync(launchSettingsPath as string, 'utf8')
+      fs.readFileSync(claudeSettingsSnapshotPath, 'utf8')
     ) as {
       env?: Record<string, string>;
       hooks?: {
@@ -333,6 +350,8 @@ exit 0
     expect(launchedEnv).not.toContain('anthropicBaseUrl=https://api.openai.com/v1');
     expect(launchedEnv).toContain('anthropicModel=gpt-5.4');
     expect(launchedEnv).toContain('maxOutputTokens=12345');
+    expect(fs.readFileSync(claudeSettingsPathLogPath, 'utf8')).toBe(launchSettingsPath);
+    expect(fs.existsSync(launchSettingsPath as string)).toBe(false);
   });
 
   it('does not auto-enable browser reuse for settings-profile launches from env overrides alone', async () => {

tests/unit/utils/claudecode-env-stripping.test.ts

@@ -31,6 +31,7 @@ const STEERING_PROMPT_SNIPPET =
   'prefer the CCS MCP tool WebSearch instead of Bash/curl/http fetches';
 const spawnCalls: SpawnCall[] = [];
 const spawnSyncCalls: SpawnSyncCall[] = [];
+const launchSettingsSnapshots: Array<{ path: string; content: string }> = [];
 const originalPlatform = process.platform;
 let baselineSigintListeners: Array<(...args: unknown[]) => void> = [];
 let baselineSigtermListeners: Array<(...args: unknown[]) => void> = [];
@@ -99,6 +100,16 @@ function registerChildProcessMock(): void {
       }
 
       spawnCalls.push({ command, args, options });
+      const settingsIndex = args.indexOf('--settings');
+      if (settingsIndex >= 0) {
+        const settingsPath = args[settingsIndex + 1];
+        if (settingsPath && fs.existsSync(settingsPath)) {
+          launchSettingsSnapshots.push({
+            path: settingsPath,
+            content: fs.readFileSync(settingsPath, 'utf8'),
+          });
+        }
+      }
 
       const child = createMockChild();
       setTimeout(() => child.emit('close', 0), 0);
@@ -193,6 +204,7 @@ describe('CLAUDECODE environment stripping', () => {
   beforeEach(() => {
     spawnCalls.length = 0;
     spawnSyncCalls.length = 0;
+    launchSettingsSnapshots.length = 0;
     process.env.CCS_QUIET = '1';
 
     // Save original env values for restoration in afterEach
@@ -695,8 +707,12 @@ describe('CLAUDECODE environment stripping', () => {
     const launchSettingsPath = args[settingsIndex + 1];
     expect(launchSettingsPath).toBeDefined();
     expect(launchSettingsPath).not.toBe(path.join(ccsDir, 'bridge.settings.json'));
+    const launchSettingsSnapshot = launchSettingsSnapshots.find(
+      (snapshot) => snapshot.path === launchSettingsPath
+    );
+    expect(launchSettingsSnapshot).toBeDefined();
 
-    const persistedLaunchSettings = JSON.parse(fs.readFileSync(launchSettingsPath, 'utf8')) as {
+    const persistedLaunchSettings = JSON.parse(launchSettingsSnapshot?.content || '{}') as {
       env?: Record<string, string>;
       hooks?: {
         PreToolUse?: Array<{
@@ -713,6 +729,7 @@ describe('CLAUDECODE environment stripping', () => {
     expect(
       persistedLaunchSettings.hooks?.PreToolUse?.[0]?.hooks?.[0]?.command
     ).toBe('echo headless-bridge-hook');
+    expect(fs.existsSync(launchSettingsPath)).toBe(false);
   });
 
   it('headless executor prepares image-analysis MCP and suppresses the legacy hook on healthy launches', async () => {