@bman654/clodex 2.1.0 → 2.1.2

package/dist/{chunk-QLGIKUKC.js → chunk-OVO6OUZG.js}

@@ -1,17 +1,8 @@
 #!/usr/bin/env node
 
-// src/server-runtime.ts
-import {
-  closeSync,
-  mkdirSync,
-  openSync,
-  readFileSync,
-  renameSync,
-  rmSync,
-  unlinkSync,
-  writeFileSync
-} from "fs";
-import { dirname, join as join2 } from "path";
+// src/config.ts
+import { randomUUID as randomUUID3 } from "crypto";
+import { readFileSync as readFileSync3, renameSync as renameSync2, unlinkSync as unlinkSync3 } from "fs";
 
 // src/paths.ts
 import { homedir } from "os";
@@ -42,233 +33,22 @@ function getLogsPath(env = process.env) {
   return join(getAppHome(env), "logs");
 }
 
-// src/server-runtime.ts
-function getServerRuntimePath(env = process.env) {
-  return join2(getAppHome(env), "server-runtime.json");
-}
-function getServerRuntimeLockPath(env = process.env) {
-  return join2(getAppHome(env), "server-runtime.lock");
-}
-function isDiscoveryDisabled(flag, env = process.env) {
-  if (flag !== void 0) return flag;
-  const raw = env.CLODEX_NO_DISCOVERY?.trim().toLowerCase();
-  return raw === "1" || raw === "true";
-}
-function isPort(value) {
-  return typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= 65535;
-}
-function parseServerRuntimeRecord(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
-  const record = value;
-  const mode = record["mode"];
-  if (mode !== "endpoint" && mode !== "proxy") return null;
-  if (!isPort(record["port"])) return null;
-  const pid = record["pid"];
-  if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0) return null;
-  const startedAt = typeof record["startedAt"] === "string" ? record["startedAt"] : "";
-  const caPath = record["caPath"];
-  if (mode === "proxy") {
-    if (typeof caPath !== "string" || !caPath.trim()) return null;
-    return { mode, port: record["port"], pid, caPath, startedAt };
-  }
-  return { mode, port: record["port"], pid, startedAt };
-}
-function parseServerRuntimeStates(raw) {
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    return [];
-  }
-  const items = Array.isArray(parsed) ? parsed : [parsed];
-  const states = [];
-  for (const item of items) {
-    const state = parseServerRuntimeRecord(item);
-    if (state) states.push(state);
-  }
-  return states;
-}
-function isPidAlive(pid, kill = process.kill.bind(process)) {
-  try {
-    kill(pid, 0);
-    return true;
-  } catch (err) {
-    return err?.code === "EPERM";
-  }
-}
-var RUNTIME_LOCK_STALE_MS = 1e4;
-var RUNTIME_LOCK_WAIT_MS = 500;
-var RUNTIME_LOCK_RETRY_MS = 25;
-function tryAcquireRuntimeLock(lockPath, opts = {}) {
-  const now = opts.now ?? Date.now();
-  const alive = opts.isAlive ?? isPidAlive;
-  mkdirSync(dirname(lockPath), { recursive: true, mode: 448 });
-  for (let attempt = 0; attempt < 2; attempt++) {
-    try {
-      const fd = openSync(lockPath, "wx");
-      const content = { pid: process.pid, startedAt: now };
-      writeFileSync(fd, JSON.stringify(content));
-      closeSync(fd);
-      return () => {
-        try {
-          unlinkSync(lockPath);
-        } catch {
-        }
-      };
-    } catch {
-      let stale = false;
-      try {
-        const existing = JSON.parse(readFileSync(lockPath, "utf8"));
-        stale = !existing.pid || !alive(existing.pid) || typeof existing.startedAt === "number" && now - existing.startedAt > RUNTIME_LOCK_STALE_MS;
-      } catch {
-        stale = true;
-      }
-      if (!stale) return null;
-      try {
-        unlinkSync(lockPath);
-      } catch {
-      }
-    }
-  }
-  return null;
-}
-function sleepSync(ms) {
-  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
-}
-function withRuntimeWriteLock(env, mutate) {
-  const lockPath = getServerRuntimeLockPath(env);
-  let release = null;
-  const deadline = Date.now() + RUNTIME_LOCK_WAIT_MS;
-  for (; ; ) {
-    release = tryAcquireRuntimeLock(lockPath);
-    if (release || Date.now() >= deadline) break;
-    sleepSync(RUNTIME_LOCK_RETRY_MS);
-  }
-  try {
-    mutate();
-  } finally {
-    release?.();
-  }
-}
-function readAllRecords(env) {
-  let raw;
-  try {
-    raw = readFileSync(getServerRuntimePath(env), "utf8");
-  } catch {
-    return [];
-  }
-  return parseServerRuntimeStates(raw);
-}
-function atomicWriteRecords(path, records) {
-  mkdirSync(dirname(path), { recursive: true, mode: 448 });
-  const tmpPath = `${path}.${process.pid}.tmp`;
-  writeFileSync(tmpPath, `${JSON.stringify(records, null, 2)}
-`, { encoding: "utf8", mode: 384 });
-  renameSync(tmpPath, path);
-}
-function registerServerRuntimeState(state, env = process.env, options = {}) {
-  const alive = options.isAlive ?? isPidAlive;
-  try {
-    withRuntimeWriteLock(env, () => {
-      const records = readAllRecords(env).filter(
-        (record) => record.pid !== state.pid && alive(record.pid)
-      );
-      records.push(state);
-      atomicWriteRecords(getServerRuntimePath(env), records);
-    });
-  } catch {
-  }
-}
-function unregisterServerRuntimeState(pid = process.pid, env = process.env, options = {}) {
-  const alive = options.isAlive ?? isPidAlive;
-  try {
-    withRuntimeWriteLock(env, () => {
-      const records = readAllRecords(env).filter(
-        (record) => record.pid !== pid && alive(record.pid)
-      );
-      if (records.length === 0) {
-        rmSync(getServerRuntimePath(env), { force: true });
-      } else {
-        atomicWriteRecords(getServerRuntimePath(env), records);
-      }
-    });
-  } catch {
-  }
-}
-function readLiveServerRuntimeStates(env = process.env, options = {}) {
-  const alive = options.isAlive ?? isPidAlive;
-  return readAllRecords(env).filter((state) => alive(state.pid));
-}
-function orderWrapperServerCandidates(records) {
-  return [...records].sort((a, b) => {
-    if (a.mode !== b.mode) return a.mode === "proxy" ? -1 : 1;
-    return (Date.parse(b.startedAt) || 0) - (Date.parse(a.startedAt) || 0);
-  });
-}
-
-// src/wrapper-env.ts
-var PROXY_ENV_VARS = ["HTTPS_PROXY", "HTTP_PROXY", "https_proxy", "http_proxy"];
-var REQUIRE_SERVER_ENV = "CLODEX_REQUIRE_SERVER";
-function removeAnthropicProxyBypass(env) {
-  const noProxyValues = [env["NO_PROXY"], env["no_proxy"]].filter((value) => value !== void 0);
-  if (noProxyValues.length === 0) return;
-  const filtered = [...new Set(noProxyValues.flatMap((value) => value.split(",")).map((value) => value.trim()).filter(Boolean).filter((value) => {
-    const entry = value.toLowerCase().replace(/^https?:\/\//, "");
-    const host = entry.replace(/:\d+$/, "");
-    if (host === "*") return false;
-    const suffix = host.startsWith("*.") ? host.slice(1) : host;
-    const bypassesAnthropic = suffix.startsWith(".") ? "api.anthropic.com".endsWith(suffix) : "api.anthropic.com" === suffix || "api.anthropic.com".endsWith(`.${suffix}`);
-    return !bypassesAnthropic;
-  }))].join(",");
-  if (filtered) {
-    env["NO_PROXY"] = filtered;
-    env["no_proxy"] = filtered;
-  } else {
-    delete env["NO_PROXY"];
-    delete env["no_proxy"];
-  }
-}
-var LOCAL_GATEWAY_API_KEY = "clodex-local";
-function wrapperRequiresServer(env) {
-  return env[REQUIRE_SERVER_ENV] === "1";
-}
-function computeWrapperEnv(baseEnv, state) {
-  const env = { ...baseEnv };
-  if (!state) return env;
-  if (state.mode === "proxy") {
-    const proxyUrl = `http://127.0.0.1:${state.port}`;
-    delete env["ANTHROPIC_BASE_URL"];
-    for (const name of PROXY_ENV_VARS) env[name] = proxyUrl;
-    if (state.caPath) env["NODE_EXTRA_CA_CERTS"] = state.caPath;
-    removeAnthropicProxyBypass(env);
-    return env;
-  }
-  for (const name of PROXY_ENV_VARS) delete env[name];
-  env["ANTHROPIC_BASE_URL"] = `http://127.0.0.1:${state.port}/anthropic`;
-  env["ANTHROPIC_API_KEY"] = LOCAL_GATEWAY_API_KEY;
-  return env;
-}
-
-// src/config.ts
-import { randomUUID as randomUUID3 } from "crypto";
-import { readFileSync as readFileSync4, renameSync as renameSync3, unlinkSync as unlinkSync4 } from "fs";
-
 // src/registry/io.ts
 import { randomUUID as randomUUID2 } from "crypto";
 import {
   chmodSync,
-  closeSync as closeSync3,
+  closeSync as closeSync2,
   copyFileSync,
   existsSync,
   fsyncSync as fsyncSync2,
-  mkdirSync as mkdirSync3,
-  openSync as openSync3,
-  readFileSync as readFileSync3,
-  renameSync as renameSync2,
-  unlinkSync as unlinkSync3,
+  mkdirSync as mkdirSync2,
+  openSync as openSync2,
+  readFileSync as readFileSync2,
+  renameSync,
+  unlinkSync as unlinkSync2,
   writeSync
 } from "fs";
-import { dirname as dirname3 } from "path";
+import { dirname as dirname2 } from "path";
 
 // src/registry/types.ts
 var REGISTRY_SCHEMA_VERSION = 1;
@@ -277,18 +57,19 @@ var REGISTRY_SCHEMA_VERSION = 1;
 import { AsyncLocalStorage } from "async_hooks";
 import { createHash, randomUUID } from "crypto";
 import {
-  closeSync as closeSync2,
+  closeSync,
   fstatSync,
   fsyncSync,
   linkSync,
-  mkdirSync as mkdirSync2,
-  openSync as openSync2,
-  readFileSync as readFileSync2,
+  mkdirSync,
+  openSync,
+  readFileSync,
   statSync,
-  unlinkSync as unlinkSync2,
-  writeFileSync as writeFileSync2
+  unlinkSync,
+  writeFileSync
 } from "fs";
-import { dirname as dirname2 } from "path";
+import { userInfo } from "os";
+import { dirname, isAbsolute, join as join2 } from "path";
 var DEFAULT_WAIT_MS = 3e4;
 var DEFAULT_CREDENTIAL_MUTATION_WAIT_MS = 15e4;
 var DEFAULT_RETRY_MS = 25;
@@ -302,7 +83,7 @@ var RegistryLockLostError = class extends Error {
 function getRegistryLockPath() {
   return `${getProvidersPath()}.lock`;
 }
-function isPidAlive2(pid) {
+function isPidAlive(pid) {
   try {
     process.kill(pid, 0);
     return true;
@@ -328,8 +109,8 @@ function createLockRecord(lockPath, owner) {
   const tempPath = `${lockPath}.${process.pid}.${owner.token}.tmp`;
   let fd;
   try {
-    fd = openSync2(tempPath, "wx", 384);
-    writeFileSync2(fd, raw);
+    fd = openSync(tempPath, "wx", 384);
+    writeFileSync(fd, raw);
     fsyncSync(fd);
     const stats = fstatSync(fd);
     try {
@@ -345,9 +126,9 @@ function createLockRecord(lockPath, owner) {
       modifiedAt: stats.mtimeMs
     };
   } finally {
-    if (fd !== void 0) closeSync2(fd);
+    if (fd !== void 0) closeSync(fd);
     try {
-      unlinkSync2(tempPath);
+      unlinkSync(tempPath);
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
@@ -356,16 +137,16 @@ function createLockRecord(lockPath, owner) {
 function lockFileMatchesLease(lease) {
   let fd;
   try {
-    fd = openSync2(lease.lockPath, "r");
+    fd = openSync(lease.lockPath, "r");
     const openedStats = fstatSync(fd);
-    const owner = parseLockOwner(readFileSync2(fd, "utf8"));
+    const owner = parseLockOwner(readFileSync(fd, "utf8"));
     const pathStats = statSync(lease.lockPath);
     return owner?.token === lease.token && openedStats.dev === lease.device && openedStats.ino === lease.inode && pathStats.dev === lease.device && pathStats.ino === lease.inode;
   } catch (err) {
     if (err.code === "ENOENT") return false;
     throw err;
   } finally {
-    if (fd !== void 0) closeSync2(fd);
+    if (fd !== void 0) closeSync(fd);
   }
 }
 function createLease(lockPath, owner, snapshot) {
@@ -384,7 +165,7 @@ function createLease(lockPath, owner, snapshot) {
     release: () => {
       if (!lease.active) return;
       lease.active = false;
-      if (lockFileMatchesLease(lease)) unlinkSync2(lockPath);
+      if (lockFileMatchesLease(lease)) unlinkSync(lockPath);
     }
   };
   return lease;
@@ -396,7 +177,7 @@ function assertRegistryWriteOwnership(registryPath = getProvidersPath()) {
   lease.assertOwned();
 }
 function getStaleLockSnapshot(lockPath, alive) {
-  const raw = readFileSync2(lockPath, "utf8");
+  const raw = readFileSync(lockPath, "utf8");
   const stats = statSync(lockPath);
   const snapshot = {
     raw,
@@ -411,12 +192,12 @@ function getStaleLockSnapshot(lockPath, alive) {
 function removeStaleLock(lockPath, expected) {
   try {
     if (expected) {
-      const raw = readFileSync2(lockPath, "utf8");
+      const raw = readFileSync(lockPath, "utf8");
       const stats = statSync(lockPath);
       if (raw !== expected.raw || stats.dev !== expected.device || stats.ino !== expected.inode || stats.mtimeMs !== expected.modifiedAt)
         return false;
     }
-    unlinkSync2(lockPath);
+    unlinkSync(lockPath);
     return true;
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
@@ -452,8 +233,8 @@ function tryAcquireReaperGuard(lockPath, now, alive) {
 }
 function tryAcquireRegistryLock(lockPath = getRegistryLockPath(), options = {}) {
   const now = options.now?.() ?? Date.now();
-  const alive = options.isAlive ?? isPidAlive2;
-  mkdirSync2(dirname2(lockPath), { recursive: true, mode: 448 });
+  const alive = options.isAlive ?? isPidAlive;
+  mkdirSync(dirname(lockPath), { recursive: true, mode: 448 });
   for (let attempt = 0; attempt < 3; attempt += 1) {
     const owner = {
       pid: process.pid,
@@ -496,13 +277,13 @@ function tryAcquireRegistryLock(lockPath = getRegistryLockPath(), options = {})
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
-function sleepSync2(ms) {
+function sleepSync(ms) {
   Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
 function lockTimeoutError(lockPath, waitMs, alive) {
   let owner = null;
   try {
-    owner = parseLockOwner(readFileSync2(lockPath, "utf8"));
+    owner = parseLockOwner(readFileSync(lockPath, "utf8"));
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
   }
@@ -531,7 +312,7 @@ async function withRegistryWriteLock(operation, options = {}) {
     });
     if (lease) break;
     if (now() >= deadline)
-      throw lockTimeoutError(lockPath, waitMs, options.isAlive ?? isPidAlive2);
+      throw lockTimeoutError(lockPath, waitMs, options.isAlive ?? isPidAlive);
     await sleep(retryMs);
   }
   const leases = new Map(inheritedLeases);
@@ -561,8 +342,8 @@ function withRegistryWriteLockSync(operation, options = {}) {
     });
     if (lease) break;
     if (now() >= deadline)
-      throw lockTimeoutError(lockPath, waitMs, options.isAlive ?? isPidAlive2);
-    sleepSync2(retryMs);
+      throw lockTimeoutError(lockPath, waitMs, options.isAlive ?? isPidAlive);
+    sleepSync(retryMs);
   }
   const leases = new Map(inheritedLeases);
   leases.set(lockPath, lease);
@@ -577,7 +358,20 @@ function withRegistryWriteLockSync(operation, options = {}) {
 }
 function getCredentialMutationLockPath(authRef) {
   const digest = createHash("sha256").update("clodex-credential-mutation\0").update(authRef).digest("hex");
-  return `${getProvidersPath()}.credential-${digest}.lock`;
+  return join2(getCredentialLockRoot(), `${digest}.lock`);
+}
+function getNativeCredentialRoot() {
+  const nativeHome = userInfo().homedir;
+  if (!nativeHome || !isAbsolute(nativeHome)) {
+    throw new Error("Could not determine the native user home for credential coordination");
+  }
+  return join2(nativeHome, ".clodex");
+}
+function getCredentialLockRoot() {
+  return join2(getNativeCredentialRoot(), "credential-locks");
+}
+function getCredentialStateRoot() {
+  return join2(getNativeCredentialRoot(), "keyring-state");
 }
 function withCredentialMutationLock(authRef, operation, options = {}) {
   return withRegistryWriteLock(operation, {
@@ -586,6 +380,15 @@ function withCredentialMutationLock(authRef, operation, options = {}) {
     waitMs: options.waitMs ?? DEFAULT_CREDENTIAL_MUTATION_WAIT_MS
   });
 }
+function getProviderMutationLockPath(providerSlot) {
+  const digest = createHash("sha256").update("clodex-provider-mutation\0").update(providerSlot).digest("hex");
+  return `${getProvidersPath()}.provider-${digest}.lock`;
+}
+function withProviderMutationLock(providerSlot, operation) {
+  return withRegistryWriteLock(operation, {
+    lockPath: getProviderMutationLockPath(providerSlot)
+  });
+}
 
 // src/registry/migrate.ts
 function migrateOAuthOpenAiProvider(registry) {
@@ -615,7 +418,7 @@ var DIR_MODE = 448;
 var FILE_MODE = 384;
 function ensureSecureAppHome() {
   const home = getAppHome();
-  mkdirSync3(home, { recursive: true, mode: DIR_MODE });
+  mkdirSync2(home, { recursive: true, mode: DIR_MODE });
   try {
     chmodSync(home, DIR_MODE);
   } catch {
@@ -623,8 +426,8 @@ function ensureSecureAppHome() {
 }
 function writeSecureFile(path, content) {
   ensureSecureAppHome();
-  mkdirSync3(dirname3(path), { recursive: true, mode: DIR_MODE });
-  const fd = openSync3(path, "wx", FILE_MODE);
+  mkdirSync2(dirname2(path), { recursive: true, mode: DIR_MODE });
+  const fd = openSync2(path, "wx", FILE_MODE);
   try {
     const payload = Buffer.from(content);
     let offset = 0;
@@ -637,7 +440,7 @@ function writeSecureFile(path, content) {
     }
     fsyncSync2(fd);
   } finally {
-    closeSync3(fd);
+    closeSync2(fd);
   }
   try {
     chmodSync(path, FILE_MODE);
@@ -647,13 +450,13 @@ function writeSecureFile(path, content) {
 function syncParentDirectory(path) {
   let fd;
   try {
-    fd = openSync3(dirname3(path), "r");
+    fd = openSync2(dirname2(path), "r");
     fsyncSync2(fd);
   } catch (error) {
     const code = error.code;
     if (code !== "EINVAL" && code !== "ENOTSUP" && code !== "EPERM") throw error;
   } finally {
-    if (fd !== void 0) closeSync3(fd);
+    if (fd !== void 0) closeSync2(fd);
   }
 }
 function parseProvider(raw) {
@@ -760,14 +563,14 @@ function parseRegistryStrict(raw) {
   return parseRegistry(raw);
 }
 function readRegistryStrict(path) {
-  return parseRegistryStrict(JSON.parse(readFileSync3(path, "utf8")));
+  return parseRegistryStrict(JSON.parse(readFileSync2(path, "utf8")));
 }
 function loadRegistry(path = getProvidersPath()) {
   if (!existsSync(path)) {
     return { schemaVersion: REGISTRY_SCHEMA_VERSION, providers: [] };
   }
   try {
-    const raw = JSON.parse(readFileSync3(path, "utf8"));
+    const raw = JSON.parse(readFileSync2(path, "utf8"));
     const registry = parseRegistry(raw);
     const migrated = migrateOAuthOpenAiProvider(registry);
     if (migrated) {
@@ -808,11 +611,11 @@ function saveRegistry(registry, path = getProvidersPath()) {
   try {
     writeSecureFile(tmp, payload);
     assertRegistryWriteOwnership(path);
-    renameSync2(tmp, path);
+    renameSync(tmp, path);
     syncParentDirectory(path);
   } finally {
     try {
-      unlinkSync3(tmp);
+      unlinkSync2(tmp);
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
@@ -822,7 +625,7 @@ function saveRegistry(registry, path = getProvidersPath()) {
 // src/config.ts
 function readJsonFile(path) {
   try {
-    const parsed = JSON.parse(readFileSync4(path, "utf8"));
+    const parsed = JSON.parse(readFileSync3(path, "utf8"));
     return parsed && typeof parsed === "object" ? parsed : null;
   } catch {
     return null;
@@ -840,11 +643,11 @@ function writeConfig(config) {
   try {
     writeSecureFile(tmp, payload);
     assertRegistryWriteOwnership(configPath);
-    renameSync3(tmp, configPath);
+    renameSync2(tmp, configPath);
     syncParentDirectory(configPath);
   } finally {
     try {
-      unlinkSync4(tmp);
+      unlinkSync3(tmp);
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
     }
@@ -1129,22 +932,337 @@ function launchClaude(env, model, extraArgs) {
   });
 }
 
+// src/listener-ready.ts
+import { connect } from "net";
+import { setTimeout as delay } from "timers/promises";
+var LISTENER_READY_TIMEOUT_MS = 1e3;
+var LISTENER_READY_RETRY_MS = 5;
+var TCP_PROBE_TIMEOUT_MS = 50;
+function connectHost(address) {
+  if (address === "0.0.0.0") return "127.0.0.1";
+  if (address === "::") return "::1";
+  return address;
+}
+function tcpListenerUrlHost(address) {
+  const host = connectHost(address);
+  return host.includes(":") ? `[${host}]` : host;
+}
+function probeTcpListener(host, port, timeoutMs) {
+  return new Promise((resolve) => {
+    const socket = connect({ host, port });
+    let settled = false;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      socket.destroy();
+      resolve(result);
+    };
+    socket.once("connect", () => finish("ready"));
+    socket.once("error", (error) => {
+      finish(
+        error.code === "ETIMEDOUT" ? "timeout" : "unreachable"
+      );
+    });
+    socket.setTimeout(timeoutMs, () => finish("timeout"));
+  });
+}
+async function waitForTcpListenerCandidate(host, candidates, timeoutMs = LISTENER_READY_TIMEOUT_MS, options = {}) {
+  if (candidates.length === 0) return null;
+  const now = options.now ?? Date.now;
+  const probe = options.probe ?? probeTcpListener;
+  const retryFailure = options.retryFailure ?? (() => true);
+  const wait = options.delay ?? ((ms) => delay(ms));
+  const deadline = now() + timeoutMs;
+  let pendingCandidates = [...candidates];
+  do {
+    const remaining = Math.max(1, deadline - now());
+    const results = await Promise.all(
+      pendingCandidates.map((candidate) => probe(
+        host,
+        candidate.port,
+        Math.min(remaining, TCP_PROBE_TIMEOUT_MS)
+      ))
+    );
+    const readyIndex = results.findIndex((result) => result === "ready");
+    if (readyIndex >= 0) return pendingCandidates[readyIndex] ?? null;
+    pendingCandidates = pendingCandidates.filter((_candidate, index) => {
+      const result = results[index];
+      return result !== void 0 && result !== "ready" && retryFailure(result);
+    });
+    if (pendingCandidates.length === 0) return null;
+    const retryDelay = Math.min(LISTENER_READY_RETRY_MS, deadline - now());
+    if (retryDelay <= 0) return null;
+    await wait(retryDelay);
+  } while (now() < deadline);
+  return null;
+}
+async function waitForTcpListener(host, port, timeoutMs = LISTENER_READY_TIMEOUT_MS, options = {}) {
+  return await waitForTcpListenerCandidate(host, [{ port }], timeoutMs, options) !== null;
+}
+async function closeAfterReadinessFailure(server) {
+  if (!server.listening) return;
+  await new Promise((resolve) => server.close(() => resolve()));
+}
+async function listenTcpServer(server, port, host) {
+  await new Promise((resolve, reject) => {
+    const cleanup = () => server.off("error", onError);
+    const onError = (error) => {
+      cleanup();
+      reject(error);
+    };
+    server.once("error", onError);
+    try {
+      server.listen(port, host, () => {
+        cleanup();
+        resolve();
+      });
+    } catch (error) {
+      cleanup();
+      reject(error);
+    }
+  });
+  const address = server.address();
+  if (!address || typeof address === "string") {
+    await closeAfterReadinessFailure(server);
+    throw new Error("TCP server did not bind to a network address");
+  }
+  const probeHost = connectHost(address.address);
+  if (await waitForTcpListener(probeHost, address.port)) return address;
+  await closeAfterReadinessFailure(server);
+  throw new Error(
+    `TCP listener did not become reachable within ${LISTENER_READY_TIMEOUT_MS}ms: ${probeHost}:${address.port}`
+  );
+}
+
+// src/server-runtime.ts
+import {
+  closeSync as closeSync3,
+  mkdirSync as mkdirSync3,
+  openSync as openSync3,
+  readFileSync as readFileSync4,
+  renameSync as renameSync3,
+  rmSync,
+  unlinkSync as unlinkSync4,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { dirname as dirname3, join as join4 } from "path";
+function getServerRuntimePath(env = process.env) {
+  return join4(getAppHome(env), "server-runtime.json");
+}
+function getServerRuntimeLockPath(env = process.env) {
+  return join4(getAppHome(env), "server-runtime.lock");
+}
+function isDiscoveryDisabled(flag, env = process.env) {
+  if (flag !== void 0) return flag;
+  const raw = env.CLODEX_NO_DISCOVERY?.trim().toLowerCase();
+  return raw === "1" || raw === "true";
+}
+function isPort(value) {
+  return typeof value === "number" && Number.isInteger(value) && value >= 1 && value <= 65535;
+}
+function parseServerRuntimeRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const record = value;
+  const mode = record["mode"];
+  if (mode !== "endpoint" && mode !== "proxy") return null;
+  if (!isPort(record["port"])) return null;
+  const pid = record["pid"];
+  if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0) return null;
+  const startedAt = typeof record["startedAt"] === "string" ? record["startedAt"] : "";
+  const caPath = record["caPath"];
+  if (mode === "proxy") {
+    if (typeof caPath !== "string" || !caPath.trim()) return null;
+    return { mode, port: record["port"], pid, caPath, startedAt };
+  }
+  return { mode, port: record["port"], pid, startedAt };
+}
+function parseServerRuntimeStates(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return [];
+  }
+  const items = Array.isArray(parsed) ? parsed : [parsed];
+  const states = [];
+  for (const item of items) {
+    const state = parseServerRuntimeRecord(item);
+    if (state) states.push(state);
+  }
+  return states;
+}
+function isPidAlive2(pid, kill = process.kill.bind(process)) {
+  try {
+    kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err?.code === "EPERM";
+  }
+}
+var RUNTIME_LOCK_STALE_MS = 1e4;
+var RUNTIME_LOCK_WAIT_MS = 500;
+var RUNTIME_LOCK_RETRY_MS = 25;
+function tryAcquireRuntimeLock(lockPath, opts = {}) {
+  const now = opts.now ?? Date.now();
+  const alive = opts.isAlive ?? isPidAlive2;
+  mkdirSync3(dirname3(lockPath), { recursive: true, mode: 448 });
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      const fd = openSync3(lockPath, "wx");
+      const content = { pid: process.pid, startedAt: now };
+      writeFileSync2(fd, JSON.stringify(content));
+      closeSync3(fd);
+      return () => {
+        try {
+          unlinkSync4(lockPath);
+        } catch {
+        }
+      };
+    } catch {
+      let stale = false;
+      try {
+        const existing = JSON.parse(readFileSync4(lockPath, "utf8"));
+        stale = !existing.pid || !alive(existing.pid) || typeof existing.startedAt === "number" && now - existing.startedAt > RUNTIME_LOCK_STALE_MS;
+      } catch {
+        stale = true;
+      }
+      if (!stale) return null;
+      try {
+        unlinkSync4(lockPath);
+      } catch {
+      }
+    }
+  }
+  return null;
+}
+function sleepSync2(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function withRuntimeWriteLock(env, mutate) {
+  const lockPath = getServerRuntimeLockPath(env);
+  let release = null;
+  const deadline = Date.now() + RUNTIME_LOCK_WAIT_MS;
+  for (; ; ) {
+    release = tryAcquireRuntimeLock(lockPath);
+    if (release || Date.now() >= deadline) break;
+    sleepSync2(RUNTIME_LOCK_RETRY_MS);
+  }
+  try {
+    mutate();
+  } finally {
+    release?.();
+  }
+}
+function readAllRecords(env) {
+  let raw;
+  try {
+    raw = readFileSync4(getServerRuntimePath(env), "utf8");
+  } catch {
+    return [];
+  }
+  return parseServerRuntimeStates(raw);
+}
+function atomicWriteRecords(path, records) {
+  mkdirSync3(dirname3(path), { recursive: true, mode: 448 });
+  const tmpPath = `${path}.${process.pid}.tmp`;
+  writeFileSync2(tmpPath, `${JSON.stringify(records, null, 2)}
+`, { encoding: "utf8", mode: 384 });
+  renameSync3(tmpPath, path);
+}
+function registerServerRuntimeState(state, env = process.env, options = {}) {
+  const alive = options.isAlive ?? isPidAlive2;
+  try {
+    withRuntimeWriteLock(env, () => {
+      const records = readAllRecords(env).filter(
+        (record) => record.pid !== state.pid && alive(record.pid)
+      );
+      records.push(state);
+      atomicWriteRecords(getServerRuntimePath(env), records);
+    });
+  } catch {
+  }
+}
+function unregisterServerRuntimeState(pid = process.pid, env = process.env, options = {}) {
+  const alive = options.isAlive ?? isPidAlive2;
+  try {
+    withRuntimeWriteLock(env, () => {
+      const records = readAllRecords(env).filter(
+        (record) => record.pid !== pid && alive(record.pid)
+      );
+      if (records.length === 0) {
+        rmSync(getServerRuntimePath(env), { force: true });
+      } else {
+        atomicWriteRecords(getServerRuntimePath(env), records);
+      }
+    });
+  } catch {
+  }
+}
+function readLiveServerRuntimeStates(env = process.env, options = {}) {
+  const alive = options.isAlive ?? isPidAlive2;
+  return readAllRecords(env).filter((state) => alive(state.pid));
+}
+function orderWrapperServerCandidates(records) {
+  return [...records].sort((a, b) => {
+    if (a.mode !== b.mode) return a.mode === "proxy" ? -1 : 1;
+    return (Date.parse(b.startedAt) || 0) - (Date.parse(a.startedAt) || 0);
+  });
+}
+
+// src/wrapper-env.ts
+var PROXY_ENV_VARS = ["HTTPS_PROXY", "HTTP_PROXY", "https_proxy", "http_proxy"];
+var REQUIRE_SERVER_ENV = "CLODEX_REQUIRE_SERVER";
+function removeAnthropicProxyBypass(env) {
+  const noProxyValues = [env["NO_PROXY"], env["no_proxy"]].filter((value) => value !== void 0);
+  if (noProxyValues.length === 0) return;
+  const filtered = [...new Set(noProxyValues.flatMap((value) => value.split(",")).map((value) => value.trim()).filter(Boolean).filter((value) => {
+    const entry = value.toLowerCase().replace(/^https?:\/\//, "");
+    const host = entry.replace(/:\d+$/, "");
+    if (host === "*") return false;
+    const suffix = host.startsWith("*.") ? host.slice(1) : host;
+    const bypassesAnthropic = suffix.startsWith(".") ? "api.anthropic.com".endsWith(suffix) : "api.anthropic.com" === suffix || "api.anthropic.com".endsWith(`.${suffix}`);
+    return !bypassesAnthropic;
+  }))].join(",");
+  if (filtered) {
+    env["NO_PROXY"] = filtered;
+    env["no_proxy"] = filtered;
+  } else {
+    delete env["NO_PROXY"];
+    delete env["no_proxy"];
+  }
+}
+var LOCAL_GATEWAY_API_KEY = "clodex-local";
+function wrapperRequiresServer(env) {
+  return env[REQUIRE_SERVER_ENV] === "1";
+}
+function computeWrapperEnv(baseEnv, state) {
+  const env = { ...baseEnv };
+  if (!state) return env;
+  if (state.mode === "proxy") {
+    const proxyUrl = `http://127.0.0.1:${state.port}`;
+    delete env["ANTHROPIC_BASE_URL"];
+    for (const name of PROXY_ENV_VARS) env[name] = proxyUrl;
+    if (state.caPath) env["NODE_EXTRA_CA_CERTS"] = state.caPath;
+    removeAnthropicProxyBypass(env);
+    return env;
+  }
+  for (const name of PROXY_ENV_VARS) delete env[name];
+  env["ANTHROPIC_BASE_URL"] = `http://127.0.0.1:${state.port}/anthropic`;
+  env["ANTHROPIC_API_KEY"] = LOCAL_GATEWAY_API_KEY;
+  return env;
+}
+
 export {
   getAppHome,
   getCredentialCleanupPath,
   getLogsPath,
-  isDiscoveryDisabled,
-  registerServerRuntimeState,
-  unregisterServerRuntimeState,
-  readLiveServerRuntimeStates,
-  orderWrapperServerCandidates,
-  removeAnthropicProxyBypass,
-  wrapperRequiresServer,
-  computeWrapperEnv,
   assertRegistryWriteOwnership,
   withRegistryWriteLock,
   withRegistryWriteLockSync,
+  getCredentialMutationLockPath,
+  getCredentialStateRoot,
   withCredentialMutationLock,
+  withProviderMutationLock,
   isValidProviderId,
   ensureSecureAppHome,
   loadRegistry,
@@ -1166,6 +1284,17 @@ export {
   setServerListenMode,
   findClaudeBinary,
   getInstalledClaudeVersion,
-  launchClaude
+  launchClaude,
+  tcpListenerUrlHost,
+  waitForTcpListenerCandidate,
+  listenTcpServer,
+  isDiscoveryDisabled,
+  registerServerRuntimeState,
+  unregisterServerRuntimeState,
+  readLiveServerRuntimeStates,
+  orderWrapperServerCandidates,
+  removeAnthropicProxyBypass,
+  wrapperRequiresServer,
+  computeWrapperEnv
 };
-//# sourceMappingURL=chunk-QLGIKUKC.js.map
+//# sourceMappingURL=chunk-OVO6OUZG.js.map