fix(image-analysis): harden runtime and provisioning

src/copilot/copilot-executor.ts

@@ -31,6 +31,7 @@ import {
 import {
   applyImageAnalysisRuntimeOverrides,
   getImageAnalysisHookEnv,
+  resolveImageAnalysisRuntimeConnection,
   resolveImageAnalysisRuntimeStatus,
 } from '../utils/hooks';
 import { stripClaudeCodeEnv } from '../utils/shell-executor';
@@ -153,13 +154,17 @@ export async function resolveCopilotImageAnalysisEnv(
     }
   }
 
+  const runtimeConnection = resolveImageAnalysisRuntimeConnection();
   return {
     env: applyImageAnalysisRuntimeOverrides(env, {
       backendId: status.backendId,
       model: status.model,
       runtimePath: status.runtimePath,
-      baseUrl: `http://127.0.0.1:${CLIPROXY_DEFAULT_PORT}`,
-      apiKey: resolvedDeps.getLocalRuntimeApiKey(),
+      baseUrl: runtimeConnection.baseUrl,
+      apiKey: runtimeConnection.proxyTarget.isRemote
+        ? runtimeConnection.apiKey
+        : resolvedDeps.getLocalRuntimeApiKey(),
+      allowSelfSigned: runtimeConnection.allowSelfSigned,
     }),
     warning: null,
   };
@@ -252,11 +257,25 @@ export async function executeCopilotProfile(
   // Get global env vars (DISABLE_TELEMETRY, etc.) for third-party profiles
   const globalEnvConfig = getGlobalEnvConfig();
   const globalEnv = globalEnvConfig.enabled ? globalEnvConfig.env : {};
+  const imageAnalysisMcpReady = ensureImageAnalysisMcpOrThrow();
+  syncWebSearchMcpToConfigDir(claudeConfigDir);
+  syncImageAnalysisMcpToConfigDir(claudeConfigDir);
 
   // Merge with current environment (global env first, copilot overrides, then hook env vars)
   const webSearchEnv = getWebSearchHookEnv();
-  const { env: imageAnalysisEnv, warning: imageAnalysisWarning } =
-    await resolveCopilotImageAnalysisEnv();
+  const imageAnalysisResolution = await resolveCopilotImageAnalysisEnv();
+  const imageAnalysisProvisioningFailed =
+    !imageAnalysisMcpReady && imageAnalysisResolution.env.CCS_IMAGE_ANALYSIS_ENABLED === '1';
+  const imageAnalysisWarning = imageAnalysisProvisioningFailed
+    ? 'ImageAnalysis MCP provisioning failed. This session will use native Read.'
+    : imageAnalysisResolution.warning;
+  const imageAnalysisEnv = imageAnalysisProvisioningFailed
+    ? {
+        ...imageAnalysisResolution.env,
+        CCS_CURRENT_PROVIDER: '',
+        CCS_IMAGE_ANALYSIS_SKIP: '1',
+      }
+    : imageAnalysisResolution.env;
   const env = stripClaudeCodeEnv({
     ...process.env,
     ...globalEnv,
@@ -272,15 +291,12 @@ export async function executeCopilotProfile(
   }
   console.log('');
 
-  ensureImageAnalysisMcpOrThrow();
-  syncWebSearchMcpToConfigDir(claudeConfigDir);
-  syncImageAnalysisMcpToConfigDir(claudeConfigDir);
-
   // Spawn Claude CLI
   return new Promise((resolve) => {
-    const launchArgs = appendThirdPartyWebSearchToolArgs(
-      appendThirdPartyImageAnalysisToolArgs(claudeArgs)
-    );
+    const imageAnalysisArgs = imageAnalysisMcpReady
+      ? appendThirdPartyImageAnalysisToolArgs(claudeArgs)
+      : claudeArgs;
+    const launchArgs = appendThirdPartyWebSearchToolArgs(imageAnalysisArgs);
     const traceEnv = createWebSearchTraceContext({
       launcher: 'copilot.executor',
       args: launchArgs,