Merge remote-tracking branch 'origin/master' into claude/unified-environment-credentials-c8841a

# Conflicts:
#	apps/cli/src/profile-boot.ts
#	apps/cli/src/web.ts

apps/cli/src/profile-boot.ts

@@ -96,6 +96,9 @@ export function prepareProfile(name: string, userLayer = true): Profile {
   return profile
 }
 
+/** Read-only row index of a profile composition before launcher flag patches. */
+export type ProfileRows = ReadonlyMap<string, { name?: string; config?: unknown }>
+
 /** One profile's patch layers (application order) and the row index of its pre-flag composition. */
 interface ComposedProfile {
   profile: Profile
@@ -110,7 +113,7 @@ interface ComposedProfile {
    * for flag merges and row checks. Flag patches must not insert rows the
    * launcher consults here (they only override values and insert dev glue).
    */
-  rows: Map<string, { name?: string; config?: unknown }>
+  rows: ProfileRows
 }
 
 /** The full patch stack of one composed profile, in application order. */
@@ -156,11 +159,11 @@ export interface RunProfileOptions {
   /** `--patch` overlay paths, in argv order. */
   patchFiles: readonly string[]
   /** Launcher hook turning the pre-flag composed rows into flag patches (the web alias's flag family). */
-  deriveFlagPatches?: (rows: ComposedProfile['rows']) => PatchOptions[]
+  deriveFlagPatches?: (rows: ProfileRows) => PatchOptions[]
   /** One-shot task text; requires the composition to mount the headless runner row. */
   task?: string
   /** Surface setup registered after Loader installation and before any config-tree entry mounts. */
-  prepare?: (ctx: Context) => Promise<void> | void
+  prepare?: (ctx: Context, rows: ProfileRows) => Promise<void> | void
   /** This run's frozen environment snapshot, provided to the tree before any entry mounts. */
   environment: EnvironmentSnapshot
 }
@@ -237,7 +240,7 @@ export async function runProfile(options: RunProfileOptions): Promise<{ ctx: Con
       }
       hostCtx.provide('headlessIo', io)
     }
-    await options.prepare?.(hostCtx)
+    await options.prepare?.(hostCtx, composed.rows)
   })
   app.current = ctx
   // A surface can dispose the whole tree while startup was still in flight