@uva-mcintire/ai-launcher
v0.5.18
Published
McIntire managed launchers for Claude Code and Codex on Azure AI Foundry.
Readme
McIntire AI Launcher
Managed McIntire launchers for Claude Code and Codex on Azure AI Foundry.
Setup
Install McIntire AI from a terminal. The installer uses a user-local npm global folder, installs the launcher, registers the tray at sign-in, and opens the tray for profile sign-in.
Windows
On a fresh computer, first install Node.js 20 LTS:
winget install OpenJS.NodeJS.LTSClose PowerShell, open a new PowerShell window as the normal user, then install and set up McIntire AI:
npx.cmd -y -p @uva-mcintire/ai-launcher@latest -- mcintire-ai-install --setupThe installer runs user setup as the current Windows user. When it reaches the Claude Desktop machine policy step, Windows may ask for administrator approval so the installer can write the HKLM policy. Do not start the whole install from an elevated/admin PowerShell unless that administrator account is also the person who will use McIntire AI.
macOS
On a fresh computer, first install Node.js 20 LTS:
brew install nodeThen install and set up McIntire AI:
npx -y -p @uva-mcintire/ai-launcher@latest -- mcintire-ai-install --setupStart or Check
If the tray did not open:
mcintire-aiCheck the active profile and budget:
mcintire-ai statusIT-Managed Claude Desktop Policy
The Windows setup command above requests administrator approval for the machine-wide Claude Desktop gateway policy. IT can also deploy that policy separately through Intune, Group Policy, or an elevated terminal:
mcintire-claude-desktop --managed-policy --no-launchThat writes the stable machine policy under HKLM:\SOFTWARE\Policies\Claude. Users still sign in, choose profiles, and launch apps from the tray.
Tray-First Use
The McIntire AI tray is the primary user experience. It shows the current budget profile, profile budget status, token counts, and launch buttons for:
- Claude Desktop
- Claude Code CLI
- Codex Desktop
- Codex CLI
Users can switch profiles in the tray before launching an app. Direct CLI commands remain available for power users and support.
Direct Commands
mcintire-ai claude
mcintire-ai codex
mcintire-ai claude-desktop
mcintire-ai codex-desktopmcintire-claude
mcintire-codex
mcintire-claude-desktop
mcintire-codex-desktopConfigure and launch the Codex desktop app:
mcintire-codex-desktopCheck live profile budget and token status:
mcintire-ai-status
mcintire-ai-status --allStart the desktop tray budget monitor:
mcintire-ai-trayConfigure Claude Desktop for the McIntire APIM gateway:
mcintire-claude-desktopStart a Named Profile
mcintire-claude --profile "Teaching Pilot"
mcintire-codex --profile "Teaching Pilot"Skip Update Check
mcintire-claude --skip-claude-update-check
mcintire-codex --skip-codex-update-checkCodex Model Selection
mcintire-codex --model gpt-5-5
mcintire-codex --model gpt-5-4What It Does
- Provides
mcintire-aias the tray-first product entrypoint. - Provides
mcintire-ai setupto install/check desktop apps, CLI tools, Microsoft Entra sign-in, and startup registration. - Uses MSAL browser sign-in through the launcher; Azure CLI is not required.
- Checks that Claude Code is installed.
- Checks that Codex CLI is installed when launching
mcintire-codex. - If Claude Code or Codex CLI is missing, asks before installing it with npm.
- Can install Claude Desktop on Windows with
winget install --id Anthropic.Claudeand on macOS withbrew install --cask claude. - Can install Codex Desktop on Windows with
winget install --id 9PLM9XGG6VKS --source msstore; on macOS, Codex desktop is launched through the installed Codex app/CLI path. - Registers the tray at sign-in with a Windows Startup shortcut or a macOS LaunchAgent.
- Checks npm for a newer Claude Code or Codex version and asks before updating.
- Signs the user into Microsoft Entra ID.
- Does not ask users to select an Azure subscription.
- Loads approved McIntire profiles from the managed proxy.
- Saves the selected active profile back to the McIntire gateway so APIM/proxy owns profile routing and budget enforcement.
- Shows period-to-date budget usage.
- Records the last selected profile locally so
mcintire-ai-statuscan show the current profile and live budget/token counts. - Starts an optional Electron tray monitor with a UVA Rotunda budget-ring icon and a profile budget popover.
- Launches Claude Desktop, Claude Code, Codex Desktop, and Codex CLI from the tray after profile selection.
- Starts Claude Code through the stable McIntire Anthropic gateway path.
- Starts Claude Code in managed profile mode, ignoring user-level Claude provider settings such as old personal Foundry resources or API keys.
- Configures Codex CLI in an isolated launcher-owned
CODEX_HOMEunder~/.mcintire-ai-launcher/codex-cli-homeand starts Codex through the stable McIntire OpenAI gateway path. - Configures the Codex desktop app to use the selected McIntire profile as the default
~/.codex/config.tomlprofile, so the app provider label shows the profile name instead of a generic provider name. - Launches Claude Desktop only when the managed McIntire gateway policy is already present.
Budget Status
The status command reads the last selected profile from:
~/.mcintire-ai-launcher/current-profile.jsonIt then reloads live profile data from the managed proxy, including period-to-date estimated spend, remaining budget, token counts, and request counts. --notify makes a best-effort desktop notification on platforms with native notification tooling available.
Tray Monitor
mcintire-ai-tray
mcintire-ai-tray --refresh-seconds 60The tray monitor is an Electron helper that reads ~/.mcintire-ai-launcher/current-profile.json, refreshes live profile data from the managed proxy, and shows a UVA Rotunda icon with a circular budget progress ring. The ring is green below 90%, yellow from 90% to under 100%, and red at or above the budget cap.
Click the tray icon to open a small budget window with the current profile, allocation ID, period spend, cap, remaining budget, request count, and input/output/total token counts. Right-click the tray icon to open help, refresh, or quit. The app uses MSAL browser sign-in for the current user's Entra token.
By default, MSAL requests the McIntire-owned delegated gateway scope:
api://c8a4dc06-6d38-4846-976a-39dd0d8fe6ce/access_as_userThe launcher app registration should request only this McIntire Gateway API delegated permission. Do not add the Azure Machine Learning user_impersonation permission to the launcher app; the tray only needs a signed-in-user token for the McIntire gateway/proxy, and the gateway owns ledger/APIM authorization.
To reset the Entra app registrations to the intended shape:
.\infra\scripts\configure-entra-gateway-apps.ps1That script exposes the gateway API scope, pre-authorizes the launcher, and replaces the launcher app's API permissions with the single McIntire Gateway access_as_user scope by default.
Claude Desktop
mcintire-claude-desktop
mcintire-claude-desktop --allocation test-mcintire-aiThe user-facing Claude Desktop path is managed setup plus tray profile selection:
Claude Desktop policy: stable McIntire gateway URL
Tray/profile API: active APIM allocation for the signed-in user
APIM/proxy: profile routing and hard-stop budget enforcementThe managed Claude Desktop policy should point to the stable gateway, not to a profile-specific URL:
https://ca-fac-aiusage-proxy-eu2.orangegrass-d094b369.eastus2.azurecontainerapps.io/anthropicUsers switch budget/worktag profiles in the tray. The tray calls /profiles/current, and the gateway resolves that selected profile on each Claude Desktop request. This avoids asking end users to enable Developer Mode and avoids pinning Claude Desktop to one allocation in the registry.
The managed policy uses inferenceCredentialHelper instead of storing a static inferenceGatewayApiKey. The helper is installed at first setup and refreshes the current user's Entra token through the launcher MSAL cache, so normal profile switching and token refresh do not require elevation after the first managed policy write.
For admin/evaluation use, Windows policy mode can write the stable gateway policy:
mcintire-claude-desktop --managed-policyManaged policy mode writes machine policy values under HKLM:\SOFTWARE\Policies\Claude by default. This requires elevation or deployment by IT through Intune, Group Policy, or an elevated installer. It writes only the stable gateway and credential helper; it does not write a profile or allocation ID.
For silent first-install policy deployment without opening Claude Desktop immediately:
mcintire-claude-desktop --managed-policy --no-launchFor pilot/dev testing only, user policy can be written with:
mcintire-claude-desktop --managed-policy --user-policyThe local third-party inference config library path is still useful for admin testing, but it is not the normal end-user experience because it requires Claude Desktop Developer Mode.
Codex Desktop
mcintire-codex-desktop
mcintire-codex-desktop --profile "Teaching Pilot"Codex desktop uses ~/.codex/config.toml, not a Claude-style Windows registry policy path. The configurator writes a managed McIntire model provider and profile, sets profile = "<selected profile>" as the default, and launches the installed Codex app on Windows.
The configured model provider name is the selected McIntire profile label, so the Codex chat bar can show a profile-specific label such as mcintire-test-ai instead of Azure OpenAI.
Codex CLI is isolated from the user's normal Codex config by default. mcintire-codex writes ~/.mcintire-ai-launcher/codex-cli-home/config.toml, sets CODEX_HOME only for the managed child process, and injects the current Entra token through MCINTIRE_AI_TOKEN. Use mcintire-codex --use-user-codex-home --configure-only only when intentionally configuring the user's normal Codex profile.
Publish
First publish:
npm login
npm publish --access publicPatch release:
npm version patch
npm publish --access public