@bman654/clodex 2.11.5 → 2.11.7

package/dist/cli.js

@@ -382,7 +382,7 @@ import { join } from "path";
 // package.json
 var package_default = {
   name: "@bman654/clodex",
-  version: "2.11.5",
+  version: "2.11.7",
   publishConfig: {
     access: "public"
   },
@@ -3888,18 +3888,18 @@ import {
   existsSync as existsSync5,
   mkdtempSync,
   mkdirSync as mkdirSync5,
-  readFileSync as readFileSync9,
+  readFileSync as readFileSync10,
   renameSync as renameSync2,
   rmSync,
-  statSync as statSync7,
+  statSync as statSync8,
   unlinkSync as unlinkSync3,
   writeFileSync as writeFileSync5,
-  openSync as openSync6,
-  closeSync as closeSync6,
+  openSync as openSync7,
+  closeSync as closeSync7,
   realpathSync as realpathSync2
 } from "fs";
 import { homedir as homedir3 } from "os";
-import { basename, dirname as dirname4, join as join7 } from "path";
+import { basename, dirname as dirname5, join as join8 } from "path";
 import pc3 from "picocolors";
 import * as p2 from "@clack/prompts";
 
@@ -6974,8 +6974,103 @@ function resolveThroughNpmShims(startPath) {
   };
 }
 
+// src/claude-native-placeholder.ts
+import { spawnSync } from "child_process";
+import {
+  closeSync as closeSync2,
+  fstatSync,
+  openSync as openSync2,
+  readFileSync as readFileSync8,
+  readSync,
+  statSync as statSync5
+} from "fs";
+import { createRequire } from "module";
+import { arch } from "os";
+import { dirname as dirname4, join as join6 } from "path";
+var MAX_PLACEHOLDER_BYTES = 64 * 1024;
+var CLAUDE_PACKAGE = "@anthropic-ai/claude-code";
+var MISSING_BINARY_MARKER = "claude native binary not installed";
+var INSTALL_SCRIPT_MARKER = "node_modules/@anthropic-ai/claude-code/install.cjs";
+var OMIT_OPTIONAL_MARKER = "--omit=optional";
+var IGNORE_SCRIPTS_MARKER = "--ignore-scripts";
+function detectMusl() {
+  if (process.platform !== "linux") return false;
+  const report = typeof process.report?.getReport === "function" ? process.report.getReport() : null;
+  return report != null && report.header?.glibcVersionRuntime === void 0;
+}
+function getPlatformKey() {
+  const platform = process.platform;
+  let cpu = arch();
+  if (platform === "android") return `linux-${cpu}-android`;
+  if (platform === "linux") return `linux-${cpu}${detectMusl() ? "-musl" : ""}`;
+  if (platform === "darwin" && cpu === "x64") {
+    const translated = spawnSync("sysctl", ["-n", "sysctl.proc_translated"], {
+      encoding: "utf8"
+    });
+    if (translated.stdout?.trim() === "1") cpu = "arm64";
+  }
+  return `${platform}-${cpu}`;
+}
+function inspectNativePackage(binaryPath) {
+  const packageRoot = dirname4(dirname4(binaryPath));
+  const packageJsonPath = join6(packageRoot, "package.json");
+  const installScriptPath = join6(packageRoot, "install.cjs");
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync8(packageJsonPath, "utf8"));
+    if (manifest.name !== CLAUDE_PACKAGE || !statSync5(installScriptPath).isFile()) {
+      return { nativePackageState: "unknown", installScriptPath: null };
+    }
+  } catch {
+    return { nativePackageState: "unknown", installScriptPath: null };
+  }
+  const nativePackage = `${CLAUDE_PACKAGE}-${getPlatformKey()}`;
+  if (manifest.optionalDependencies === null || typeof manifest.optionalDependencies !== "object" || typeof manifest.optionalDependencies[nativePackage] !== "string") {
+    return { nativePackageState: "unknown", installScriptPath };
+  }
+  try {
+    createRequire(installScriptPath).resolve(`${nativePackage}/package.json`);
+    return { nativePackageState: "present", installScriptPath };
+  } catch {
+    return { nativePackageState: "missing", installScriptPath };
+  }
+}
+function inspectClaudeNativeBinaryPlaceholder(path) {
+  let fd;
+  try {
+    fd = openSync2(path, "r");
+    const size = fstatSync(fd).size;
+    if (size <= 0 || size > MAX_PLACEHOLDER_BYTES) return null;
+    const bytes = Buffer.allocUnsafe(size);
+    let offset = 0;
+    while (offset < size) {
+      const bytesRead = readSync(fd, bytes, offset, size - offset, offset);
+      if (bytesRead === 0) break;
+      offset += bytesRead;
+    }
+    if (offset !== size) return null;
+    const text5 = bytes.toString("utf8");
+    const signals = [
+      text5.includes(MISSING_BINARY_MARKER),
+      text5.includes(INSTALL_SCRIPT_MARKER),
+      text5.includes(OMIT_OPTIONAL_MARKER) && text5.includes(IGNORE_SCRIPTS_MARKER)
+    ];
+    if (signals.filter(Boolean).length < 2) return null;
+    return inspectNativePackage(path);
+  } catch {
+    return null;
+  } finally {
+    if (fd !== void 0) {
+      try {
+        closeSync2(fd);
+      } catch {
+      }
+    }
+  }
+}
+
 // src/bun-entry-module.ts
-import { closeSync as closeSync2, openSync as openSync2, readSync, statSync as statSync5, writeSync as writeSync2 } from "fs";
+import { closeSync as closeSync3, openSync as openSync3, readSync as readSync2, statSync as statSync6, writeSync as writeSync2 } from "fs";
 import { execFileSync } from "child_process";
 var BUN_TRAILER = Buffer.from("\n---- Bun! ----\n");
 var BUN_OFFSETS_BYTES = 32;
@@ -7012,7 +7107,7 @@ function entryModuleShimName(byteLength) {
 function readAt(fd, length, position) {
   if (length <= 0 || position < 0) return null;
   const buffer = Buffer.alloc(length);
-  const read = readSync(fd, buffer, 0, length, position);
+  const read = readSync2(fd, buffer, 0, length, position);
   return read === length ? buffer : null;
 }
 function readBunModuleNames(fd, fileSize) {
@@ -7152,17 +7247,17 @@ function isMachO(fd) {
   return value === 4277009102 || value === 4277009103 || value === 3472551422 || value === 3489328638 || value === 3405691582 || value === 3405691583;
 }
 function readBunModuleTable(path) {
-  const fd = openSync2(path, "r");
+  const fd = openSync3(path, "r");
   try {
-    return readBunModuleNames(fd, statSync5(path).size);
+    return readBunModuleNames(fd, statSync6(path).size);
   } finally {
-    closeSync2(fd);
+    closeSync3(fd);
   }
 }
 function readBunJavaScriptModules(path) {
-  const fd = openSync2(path, "r");
+  const fd = openSync3(path, "r");
   try {
-    const parsed = readBunModuleNames(fd, statSync5(path).size);
+    const parsed = readBunModuleNames(fd, statSync6(path).size);
     if (!parsed) return null;
     const modules = [];
     for (let index = 0; index < parsed.names.length; index++) {
@@ -7182,33 +7277,33 @@ function readBunJavaScriptModules(path) {
     }
     return modules;
   } finally {
-    closeSync2(fd);
+    closeSync3(fd);
   }
 }
 function shimEntryModuleName(path) {
-  const fd = openSync2(path, "r+");
+  const fd = openSync3(path, "r+");
   try {
-    const parsed = readBunModuleNames(fd, statSync5(path).size);
+    const parsed = readBunModuleNames(fd, statSync6(path).size);
     if (!parsed) return null;
     if (parsed.names.some(tweakccRecognizesModuleName)) return null;
     const original = parsed.names[parsed.entryPointId];
     const offset = parsed.offsets[parsed.entryPointId];
     const marker = entryModuleShimName(Buffer.byteLength(original));
     if (marker === null) return null;
-    if (findStandIn(fd, statSync5(path).size, marker).some((offset2) => isModuleNameAt(fd, offset2, marker))) {
+    if (findStandIn(fd, statSync6(path).size, marker).some((offset2) => isModuleNameAt(fd, offset2, marker))) {
       return null;
     }
     writeNameBytes(fd, marker, offset);
     return { offset, original, marker };
   } finally {
-    closeSync2(fd);
+    closeSync3(fd);
   }
 }
 function restoreEntryModuleName(path, shim, { resign }) {
-  const fd = openSync2(path, "r+");
+  const fd = openSync3(path, "r+");
   let machO;
   try {
-    const parsed = readBunModuleNames(fd, statSync5(path).size);
+    const parsed = readBunModuleNames(fd, statSync6(path).size);
     const offset = parsed?.offsets[parsed.entryPointId];
     if (!parsed || offset === void 0 || parsed.names[parsed.entryPointId] !== shim.marker) {
       throw new Error(
@@ -7216,20 +7311,20 @@ function restoreEntryModuleName(path, shim, { resign }) {
       );
     }
     writeNameBytes(fd, shim.original, offset);
-    restoreEveryStandIn(fd, statSync5(path).size, shim);
+    restoreEveryStandIn(fd, statSync6(path).size, shim);
     machO = resign;
   } finally {
-    closeSync2(fd);
+    closeSync3(fd);
   }
   if (machO) resignMachOBinary(path);
 }
 function resignMachOBinary(path) {
-  const fd = openSync2(path, "r");
+  const fd = openSync3(path, "r");
   let machO;
   try {
     machO = isMachO(fd);
   } finally {
-    closeSync2(fd);
+    closeSync3(fd);
   }
   if (machO && process.platform === "darwin") {
     execFileSync("codesign", ["-s", "-", "-f", path], { stdio: "ignore" });
@@ -7237,7 +7332,7 @@ function resignMachOBinary(path) {
 }
 
 // src/bun-compiled-pointer.ts
-import { closeSync as closeSync3, fstatSync, openSync as openSync3, readSync as readSync2, writeSync as writeSync3 } from "fs";
+import { closeSync as closeSync4, fstatSync as fstatSync2, openSync as openSync4, readSync as readSync3, writeSync as writeSync3 } from "fs";
 var TWEAKCC_SCAN_STRIDE = 16384n;
 var SCAN_CHUNK = 1 << 20;
 var ELF_MAGIC = 1179403647;
@@ -7249,7 +7344,7 @@ function readAt2(fd, length, position) {
   const buf = Buffer.alloc(length);
   let read = 0;
   while (read < length) {
-    const n = readSync2(fd, buf, read, length - read, position + read);
+    const n = readSync3(fd, buf, read, length - read, position + read);
     if (n <= 0) break;
     read += n;
   }
@@ -7269,7 +7364,7 @@ function readElfLayout(fd) {
   const shstrndx = ident.readUInt16LE(62);
   if (shnum === 0 || phnum === 65535) return null;
   if (shstrndx >= shnum || shentsize < 64 || phentsize < 56) return null;
-  const fileSize = fstatSync(fd).size;
+  const fileSize = fstatSync2(fd).size;
   const fits = (offset, length) => Number.isSafeInteger(offset) && offset >= 0 && length >= 0 && offset + length <= fileSize;
   if (!fits(Number(shoff), shnum * shentsize)) return null;
   const shTable = readAt2(fd, shnum * shentsize, Number(shoff));
@@ -7358,7 +7453,7 @@ function scanForNeedle(fd, from, to, needle, skipFrom, skipTo) {
   return hits;
 }
 function shimBunCompiledPointer(path) {
-  const fd = openSync3(path, "r+");
+  const fd = openSync4(path, "r+");
   try {
     const layout = readElfLayout(fd);
     if (!layout) return null;
@@ -7408,11 +7503,11 @@ function shimBunCompiledPointer(path) {
     writeSync3(fd, needle, 0, 8, standInOffset);
     return { pointerVaddr, standInVaddr, displaced, bunVaddr: bun.addr };
   } finally {
-    closeSync3(fd);
+    closeSync4(fd);
   }
 }
 function restoreBunCompiledPointer(path, shim) {
-  const fd = openSync3(path, "r+");
+  const fd = openSync4(path, "r+");
   try {
     const layout = readElfLayout(fd);
     if (!layout) throw new Error("the repacked binary is no longer a 64-bit little-endian ELF");
@@ -7449,12 +7544,12 @@ function restoreBunCompiledPointer(path, shim) {
       throw new Error("the bytes the stand-in displaced were not restored");
     }
   } finally {
-    closeSync3(fd);
+    closeSync4(fd);
   }
 }
 
 // src/bun-bundle.ts
-import { closeSync as closeSync4, openSync as openSync4, readSync as readSync3, writeSync as writeSync4 } from "fs";
+import { closeSync as closeSync5, openSync as openSync5, readSync as readSync4, writeSync as writeSync4 } from "fs";
 function writableModuleIndex(path) {
   const table = readBunModuleTable(path);
   if (!table) return null;
@@ -7570,18 +7665,18 @@ function placeholderOf(byteLength) {
   return PLACEHOLDER_TEXT.repeat(Math.ceil(byteLength / PLACEHOLDER_TEXT.length)).slice(0, byteLength);
 }
 function readBlobData(path, table, into) {
-  const fd = openSync4(path, "r");
+  const fd = openSync5(path, "r");
   try {
     let read = 0;
     while (read < table.byteCount) {
-      const got = readSync3(fd, into, read, table.byteCount - read, table.blobAt + read);
+      const got = readSync4(fd, into, read, table.byteCount - read, table.blobAt + read);
       if (got <= 0) {
         throw new Error(`read ${read} of the ${table.byteCount} blob bytes of ${path}`);
       }
       read += got;
     }
   } finally {
-    closeSync4(fd);
+    closeSync5(fd);
   }
 }
 function repointModule(data, table, append) {
@@ -7633,7 +7728,7 @@ function applyBundleWritePlan(path, plan) {
   }
   const offsets = Buffer.from(plan.offsets);
   offsets.writeBigUInt64LE(BigInt(byteCount), 0);
-  const fd = openSync4(path, "r+");
+  const fd = openSync5(path, "r+");
   try {
     writeAll(fd, plan.data, repacked.blobAt, path);
     const padding = byteCount - plan.data.length;
@@ -7641,7 +7736,7 @@ function applyBundleWritePlan(path, plan) {
     writeAll(fd, offsets, repacked.blobAt + byteCount, path);
     writeAll(fd, BUN_TRAILER2, repacked.blobAt + byteCount + BUN_OFFSETS_BYTES2, path);
   } finally {
-    closeSync4(fd);
+    closeSync5(fd);
   }
   const published = readBunModuleTable(path);
   if (!published) throw new Error(`cannot re-read the Bun module table of ${path} after publishing its blob`);
@@ -7677,15 +7772,15 @@ function writeAll(fd, bytes, position, path) {
 
 // src/patch-backup.ts
 import { createHash as createHash5 } from "crypto";
-import { existsSync as existsSync4, readFileSync as readFileSync8, readdirSync, statSync as statSync6 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync9, readdirSync, statSync as statSync7 } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 var BACKUP_SHA_PREFIX_LENGTH = 16;
 function backupDir() {
-  return process.env["TWEAKCC_CONFIG_DIR"]?.trim() || join6(homedir2(), ".tweakcc");
+  return process.env["TWEAKCC_CONFIG_DIR"]?.trim() || join7(homedir2(), ".tweakcc");
 }
 function sha256File(path) {
-  return createHash5("sha256").update(readFileSync8(path)).digest("hex");
+  return createHash5("sha256").update(readFileSync9(path)).digest("hex");
 }
 function backupVersionTag(version) {
   const tag = version.trim().replace(/[^\w.-]+/g, "_");
@@ -7693,10 +7788,10 @@ function backupVersionTag(version) {
   return tag;
 }
 function contentAddressedBackupPath(version, sha256, dir = backupDir()) {
-  return join6(dir, `claude-${backupVersionTag(version)}-${sha256.slice(0, BACKUP_SHA_PREFIX_LENGTH)}.orig`);
+  return join7(dir, `claude-${backupVersionTag(version)}-${sha256.slice(0, BACKUP_SHA_PREFIX_LENGTH)}.orig`);
 }
 function tweakccMirrorBackupPath(dir = backupDir()) {
-  return join6(dir, "native-binary.backup");
+  return join7(dir, "native-binary.backup");
 }
 function scanPristineBackups(version, dir = backupDir()) {
   const tag = backupVersionTag(version);
@@ -7712,10 +7807,10 @@ function scanPristineBackups(version, dir = backupDir()) {
   for (const entry of entries.sort()) {
     const match = pattern.exec(entry);
     if (!match) continue;
-    const path = join6(dir, entry);
+    const path = join7(dir, entry);
     let sha256;
     try {
-      if (!statSync6(path).isFile()) continue;
+      if (!statSync7(path).isFile()) continue;
       sha256 = sha256File(path);
     } catch {
       corrupt.push(path);
@@ -7753,25 +7848,48 @@ function noBackupMessage(facts) {
   const corrupt = facts.corruptBackups?.length ? ` (${facts.corruptBackups.length} backup file(s) for this version failed integrity checks and were ignored)` : "";
   return `claude ${facts.version} is already patched and no trustworthy pristine backup for that version exists in ${backupDir()}${corrupt}. Reinstall Claude Code to get a pristine binary, then run \`clodex patch\`.`;
 }
+function identifiesABackup(manifest) {
+  return manifest.pristineSha256 !== void 0 || manifest.backupPath !== void 0;
+}
+function recordedBackupGoneMessage(facts, manifest) {
+  const named = manifest.backupPath ?? `the backup holding sha256 ${manifest.pristineSha256}`;
+  const corrupt = facts.corruptBackups?.length ? ` (${facts.corruptBackups.length} backup file(s) for this version failed integrity checks and were ignored)` : "";
+  const others = facts.backups.length ? `The ${facts.backups.length} other pristine backup(s) tagged claude ${facts.version} there were made for some other install \u2014 two installs of one Claude Code version are different files, so restoring one of them would overwrite this install with bytes that were never its own. ` : "";
+  return `The patch manifest records ${named} as the pristine content of ${facts.binaryPath}, and clodex cannot use it: it is missing from ${backupDir()}, failed its integrity check, or holds a different claude version${corrupt}. ${others}Reinstall Claude Code to get a pristine binary, then run \`clodex patch\`.`;
+}
+function otherInstallMessage(facts, otherBinaryPath) {
+  return `The patch manifest records a different Claude Code install (${otherBinaryPath}), so nothing establishes that a pristine backup tagged claude ${facts.version} in ${backupDir()} belongs to ${facts.binaryPath}. Two installs of one Claude Code version are different files, so restoring by version tag alone would overwrite this install with another one's bytes. Set TWEAKCC_CC_INSTALLATION_PATH=${otherBinaryPath} to restore that install instead, or reinstall Claude Code to make this one pristine.`;
+}
 function selectRestoreSource(facts) {
   const notes = [];
-  const manifest = facts.manifest && facts.manifest.binaryPath === facts.binaryPath ? facts.manifest : null;
+  const recorded = facts.manifest;
+  const speaksForThisVersion = !recorded?.claudeVersion || recorded.claudeVersion === facts.version;
+  const manifest = recorded && recorded.binaryPath === facts.binaryPath && speaksForThisVersion ? recorded : null;
+  const other = recorded && recorded.binaryPath !== facts.binaryPath && speaksForThisVersion ? recorded : null;
   let chosen = manifest?.pristineSha256 ? facts.backups.find((backup) => backup.sha256 === manifest.pristineSha256) : void 0;
   if (!chosen && manifest?.backupPath) {
     chosen = facts.backups.find((backup) => backup.path === manifest.backupPath);
-    if (!chosen) {
-      notes.push(`Recorded pristine backup ${manifest.backupPath} is missing, corrupt, or belongs to another claude version \u2014 ignoring it.`);
-    }
+  }
+  if (!chosen && manifest && identifiesABackup(manifest)) {
+    return { action: "error", message: recordedBackupGoneMessage(facts, manifest) };
   }
   if (!chosen) {
+    if (other) {
+      return facts.backups.length ? { action: "error", message: otherInstallMessage(facts, other.binaryPath) } : { action: "error", message: noBackupMessage(facts) };
+    }
     const distinct = [...new Set(facts.backups.map((backup) => backup.sha256))];
     if (distinct.length > 1) {
       return {
         action: "error",
-        message: `Found conflicting pristine backups for claude ${facts.version}: ${facts.backups.map((backup) => backup.path).join(", ")}. They do not hold the same bytes, so clodex cannot tell which one is pristine. Remove the wrong one (or reinstall Claude Code), then run \`clodex patch\`.`
+        message: `Found conflicting pristine backups for claude ${facts.version}: ${facts.backups.map((backup) => backup.path).join(", ")}. They do not hold the same bytes, so clodex cannot tell which one is pristine. If this machine has more than one Claude Code install, both are probably genuine \u2014 one per install \u2014 and deleting either one is a guess. Reinstall the Claude Code at ${facts.binaryPath} instead: a pristine install needs no backup, and \`clodex patch\` will record its own.`
       };
     }
     chosen = facts.backups.find((backup) => backup.kind === "content-addressed") ?? facts.backups[0];
+    if (chosen) {
+      notes.push(
+        `No patch manifest records ${facts.binaryPath}, so ${chosen.path} is being used as its pristine content on the strength of its claude ${facts.version} version tag alone. On a machine with more than one Claude Code install those bytes may belong to the other one \u2014 a clodex that had recorded this install would have refused rather than guess.`
+      );
+    }
   }
   if (!chosen) return { action: "error", message: noBackupMessage(facts) };
   return {
@@ -8599,8 +8717,8 @@ var FAILURE_EVENT_TYPES = /* @__PURE__ */ new Set(["error", "response.failed", "
 var RESPONSES_WS_HARD_TTL_MS = 55 * 6e4;
 var RESPONSES_WS_IDLE_TTL_MS = 30 * 6e4;
 var RESPONSES_WS_NURSERY_IDLE_TTL_MS = 5 * 6e4;
-var RESPONSES_WS_MAX_CONNECTIONS = 32;
-var RESPONSES_WS_MAX_NURSERY_CONNECTIONS = 8;
+var RESPONSES_WS_MAX_CONNECTIONS = 64;
+var RESPONSES_WS_MAX_NURSERY_CONNECTIONS = 48;
 var diagnosticContext = new AsyncLocalStorage();
 function withResponsesWebSocketDiagnosticContext(context, fn) {
   return diagnosticContext.run(context, fn);
@@ -8982,13 +9100,16 @@ function mismatchDumpLine(items, index) {
 function canonicalItemStrings(items) {
   return items.map((item) => canonicalJson(normalizeToolCallJson([item])));
 }
-function isStrictPrefix(head, client) {
-  if (client.length <= head.length) return false;
+function isPrefixOrEqual(head, client) {
+  if (client.length < head.length) return false;
   for (let index = 0; index < head.length; index += 1) {
     if (head[index] !== client[index]) return false;
   }
   return true;
 }
+function isStrictPrefix(head, client) {
+  return client.length > head.length && isPrefixOrEqual(head, client);
+}
 function continuationMatch(entry, payload, clientItems) {
   if (!entry.responseId || !entry.requestInput || !entry.expectedAssistant) return void 0;
   const full = inputArray(payload);
@@ -9481,11 +9602,16 @@ function evictOldestIdleGeneration(generation, maxConnections, reason) {
   while (connectionCountByGeneration(generation) >= maxConnections && idle.length) {
     const oldest = idle.shift();
     if (oldest) {
+      const idleMs = Math.max(0, oldest.options.now() - oldest.lastUsedAt);
+      oldest.debug(
+        `evicting the oldest idle ${generation} connection to stay within its cap: connection=${oldest.debugId} idle_ms=${idleMs} cap=${maxConnections} reason=${reason}`
+      );
       evictions.push({
         connectionId: oldest.debugId,
         partitionKey: oldest.key,
         generation: oldest.generation,
-        reason
+        reason,
+        idleMs
       });
       deleteEntry(oldest);
     }
@@ -9905,16 +10031,28 @@ function createResponsesWebSocketFetch(wsUrl, log12, options = {}) {
     const diagnosticCorrelation = diagnosticContext.getStore();
     let now = resolvedOptions.now();
     const evictions = cleanupExpiredConnections(now);
+    let canonicalClientItems;
+    const clientItems = () => canonicalClientItems ??= canonicalItemStrings(inputArray(payload));
     const scanForHeads = () => {
       const scanned = partitionKey ? connectionEntries(partitionKey) : [];
       const idle = scanned.filter((entry) => !entry.inFlight);
-      const clientItems = idle.length ? canonicalItemStrings(inputArray(payload)) : [];
+      const canonical = idle.length ? clientItems() : [];
       return {
         candidates: scanned,
         idleCandidates: idle,
-        matches: idle.map((entry) => ({ entry, match: continuationMatch(entry, payload, clientItems) })).filter((candidate) => candidate.match !== void 0).sort((left, right) => left.match.delta.length - right.match.delta.length || (left.match.mode === right.match.mode ? 0 : left.match.mode === "exact" ? -1 : 1))
+        matches: idle.map((entry) => ({ entry, match: continuationMatch(entry, payload, canonical) })).filter((candidate) => candidate.match !== void 0).sort((left, right) => left.match.delta.length - right.match.delta.length || (left.match.mode === right.match.mode ? 0 : left.match.mode === "exact" ? -1 : 1))
       };
     };
+    const couldPrecedeThisRequest = (entry) => {
+      if (entry.responseId && entry.requestInput && entry.expectedAssistant) {
+        return continuationMatch(entry, payload, clientItems()) !== void 0;
+      }
+      const streaming = entry.current;
+      if (!streaming) return true;
+      streaming.canonicalInput ??= canonicalItemStrings(inputArray(streaming.originalPayload));
+      return isPrefixOrEqual(streaming.canonicalInput, clientItems());
+    };
+    const blockingHead = (entries) => entries.find((entry) => entry.inFlight && couldPrecedeThisRequest(entry));
     let { candidates, idleCandidates, matches } = scanForHeads();
     let selected = matches[0]?.entry;
     let selectedMatch = matches[0]?.match;
@@ -9957,9 +10095,10 @@ function createResponsesWebSocketFetch(wsUrl, log12, options = {}) {
       );
       return "continuation";
     };
+    let arrivalBlockingHead = selected ? void 0 : blockingHead(candidates);
     if (selected && selectedDelta) {
       decision = continueOnHead(selected, selectedMatch);
-    } else if (candidates.some((entry) => entry.inFlight)) {
+    } else if (arrivalBlockingHead) {
       selected = void 0;
       persistent = false;
       decision = "parallel_isolated";
@@ -10058,11 +10197,15 @@ function createResponsesWebSocketFetch(wsUrl, log12, options = {}) {
           pacingRescanOutcome = "no_change";
         }
       }
-      if (!selected && persistent && partitionKey && connectionEntries(partitionKey).some((entry) => entry.inFlight)) {
-        persistent = false;
-        decision = "parallel_isolated";
-        debug("parallel request using an isolated socket after pacing");
-        if (pacingRescanOutcome === "no_change") pacingRescanOutcome = "parallel_isolated";
+      if (!selected && persistent && partitionKey) {
+        const blocked = blockingHead(connectionEntries(partitionKey));
+        if (blocked) {
+          arrivalBlockingHead = blocked;
+          persistent = false;
+          decision = "parallel_isolated";
+          debug("parallel request using an isolated socket after pacing");
+          if (pacingRescanOutcome === "no_change") pacingRescanOutcome = "parallel_isolated";
+        }
       }
     }
     let suppressedMismatchWarnings;
@@ -10118,6 +10261,10 @@ function createResponsesWebSocketFetch(wsUrl, log12, options = {}) {
       createdConnectionId: selected ? void 0 : nextConnectionDebugId,
       ...pacingWaitedMs !== void 0 ? { pacingWaitedMs } : {},
       ...pacingRescanOutcome !== void 0 ? { pacingRescanOutcome } : {},
+      // Which busy head this request could not be told apart from. Without it an
+      // isolated turn reads as unexplained, and isolation is the single largest
+      // source of uncached prompt tokens on this transport.
+      ...decision === "parallel_isolated" && arrivalBlockingHead ? { isolatedByConnectionId: arrivalBlockingHead.debugId } : {},
       ...suppressedMismatchWarnings !== void 0 ? { suppressedMismatchWarnings } : {},
       createdGeneration: selected ? void 0 : persistent ? "nursery" : "isolated",
       incrementalInputItems: selectedDelta?.length,
@@ -11143,7 +11290,7 @@ function thinkingProviderOptions(npm) {
 
 // src/proxy.ts
 import { createServer } from "http";
-import { appendFileSync as appendFileSync2, openSync as openSync5, writeSync as writeSync5, closeSync as closeSync5 } from "fs";
+import { appendFileSync as appendFileSync2, openSync as openSync6, writeSync as writeSync5, closeSync as closeSync6 } from "fs";
 
 // src/http-utils.ts
 import * as zlib from "zlib";
@@ -11709,45 +11856,125 @@ function resolveUpstreamTools(tools, messages) {
 
 // src/tool-schema-sanitize.ts
 function isCompatiblePattern(pattern) {
+  let inClass = false;
   for (let i = 0; i < pattern.length; i++) {
-    if (pattern[i] === "\\") {
+    const ch = pattern[i];
+    if (ch === "\\") {
       const next = pattern[i + 1];
-      if ((next === "p" || next === "P") && pattern[i + 2] === "{") return false;
+      if ((next === "p" || next === "P" || next === "u" || next === "x") && pattern[i + 2] === "{") return false;
       if (next === "k" && pattern[i + 2] === "<") return false;
       i++;
       continue;
     }
-    if (pattern[i] === "(" && pattern[i + 1] === "?" && pattern[i + 2] === "<" && pattern[i + 3] !== "=" && pattern[i + 3] !== "!") return false;
+    if (inClass) {
+      if (ch === "]") inClass = false;
+      continue;
+    }
+    if (ch === "[") {
+      inClass = true;
+      continue;
+    }
+    if (ch === "(" && pattern[i + 1] === "?" && pattern[i + 2] === "<" && pattern[i + 3] !== "=" && pattern[i + 3] !== "!") return false;
   }
   return true;
 }
+var SUBSCHEMA_KEYWORDS = /* @__PURE__ */ new Set([
+  "items",
+  "prefixItems",
+  "additionalItems",
+  "unevaluatedItems",
+  "additionalProperties",
+  "unevaluatedProperties",
+  "propertyNames",
+  "contains",
+  "anyOf",
+  "oneOf",
+  "allOf",
+  "not",
+  "if",
+  "then",
+  "else",
+  "contentSchema"
+]);
+var SUBSCHEMA_MAP_KEYWORDS = /* @__PURE__ */ new Set([
+  "properties",
+  "$defs",
+  "definitions",
+  "dependentSchemas",
+  "dependencies"
+]);
 function sanitizeToolSchema(schema) {
-  if (Array.isArray(schema)) {
+  return sanitizeSchema(schema);
+}
+function sanitizeSchema(node) {
+  if (Array.isArray(node)) {
     let changed2 = false;
-    const out2 = schema.map((entry) => {
-      const next = sanitizeToolSchema(entry);
+    const out = node.map((entry) => {
+      const next = sanitizeSchema(entry);
       changed2 ||= next !== entry;
       return next;
     });
-    return changed2 ? out2 : schema;
+    return changed2 ? out : node;
   }
-  if (!schema || typeof schema !== "object") return schema;
+  if (!node || typeof node !== "object") return node;
+  const record = node;
+  const patternProps = "patternProperties" in record ? sanitizePatternProperties(record.patternProperties) : void 0;
+  const openClosure = patternProps?.dropped === true;
   let changed = false;
-  const out = {};
-  for (const [key, value] of Object.entries(schema)) {
-    if (key === "pattern" && typeof value === "string") {
-      if (!isCompatiblePattern(value)) {
+  const entries = [];
+  for (const [key, value] of Object.entries(record)) {
+    if (key === "patternProperties" && patternProps) {
+      changed ||= patternProps.value !== value;
+      entries.push([key, patternProps.value]);
+      continue;
+    }
+    if (openClosure && value !== true && (key === "additionalProperties" || key === "unevaluatedProperties")) {
+      changed = true;
+      continue;
+    }
+    if (key === "pattern") {
+      if (typeof value === "string" && !isCompatiblePattern(value)) {
         changed = true;
         continue;
       }
-      out[key] = value;
+      entries.push([key, value]);
       continue;
     }
-    const next = sanitizeToolSchema(value);
+    let next = value;
+    if (SUBSCHEMA_KEYWORDS.has(key)) next = sanitizeSchema(value);
+    else if (SUBSCHEMA_MAP_KEYWORDS.has(key)) next = sanitizeSchemaMap(value);
     changed ||= next !== value;
-    out[key] = next;
+    entries.push([key, next]);
   }
-  return changed ? out : schema;
+  return changed ? Object.fromEntries(entries) : node;
+}
+function sanitizeSchemaMap(node) {
+  if (!node || typeof node !== "object" || Array.isArray(node)) return node;
+  let changed = false;
+  const entries = [];
+  for (const [key, value] of Object.entries(node)) {
+    const next = sanitizeSchema(value);
+    changed ||= next !== value;
+    entries.push([key, next]);
+  }
+  return changed ? Object.fromEntries(entries) : node;
+}
+function sanitizePatternProperties(node) {
+  if (!node || typeof node !== "object" || Array.isArray(node)) return { value: node, dropped: false };
+  let changed = false;
+  let dropped = false;
+  const entries = [];
+  for (const [key, value] of Object.entries(node)) {
+    if (!isCompatiblePattern(key)) {
+      changed = true;
+      dropped = true;
+      continue;
+    }
+    const next = sanitizeSchema(value);
+    changed ||= next !== value;
+    entries.push([key, next]);
+  }
+  return { value: changed ? Object.fromEntries(entries) : node, dropped };
 }
 
 // src/upstream-attempts.ts
@@ -12849,12 +13076,12 @@ function createTranslationLifecycle(logPath, requestId, claudeSessionId, modelId
 function appendSecureLog(logPath, line) {
   const redacted = redactTraceLine(line);
   try {
-    const fd = openSync5(logPath, "a", 384);
+    const fd = openSync6(logPath, "a", 384);
     try {
       writeSync5(fd, `${(/* @__PURE__ */ new Date()).toISOString()} ${redacted}
 `);
     } finally {
-      closeSync5(fd);
+      closeSync6(fd);
     }
   } catch {
     try {
@@ -13538,14 +13765,14 @@ function buildHttpProxyRoutes(providers, favorites, modelAliases = void 0, max =
 
 // src/patcher.ts
 function getPatchManifestPath() {
-  return join7(getAppHome(), "patch-state.json");
+  return join8(getAppHome(), "patch-state.json");
 }
 function getPatchLockPath() {
-  return join7(getAppHome(), "patch.lock");
+  return join8(getAppHome(), "patch.lock");
 }
 function readPatchManifest(path = getPatchManifestPath()) {
   try {
-    const parsed = JSON.parse(readFileSync9(path, "utf8"));
+    const parsed = JSON.parse(readFileSync10(path, "utf8"));
     if (parsed && typeof parsed.binaryPath === "string" && typeof parsed.configHash === "string") {
       return parsed;
     }
@@ -13708,13 +13935,13 @@ function pidIsAlive(pid) {
 function tryAcquirePatchLock(lockPath = getPatchLockPath(), opts = {}) {
   const now = opts.now ?? Date.now();
   const isAlive = opts.isAlive ?? pidIsAlive;
-  mkdirSync5(join7(lockPath, ".."), { recursive: true, mode: 448 });
+  mkdirSync5(join8(lockPath, ".."), { recursive: true, mode: 448 });
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
-      const fd = openSync6(lockPath, "wx");
+      const fd = openSync7(lockPath, "wx");
       const content = { pid: process.pid, startedAt: now };
       writeFileSync5(fd, JSON.stringify(content));
-      closeSync6(fd);
+      closeSync7(fd);
       return () => {
         try {
           unlinkSync3(lockPath);
@@ -13724,7 +13951,7 @@ function tryAcquirePatchLock(lockPath = getPatchLockPath(), opts = {}) {
     } catch {
       let stale = false;
       try {
-        const existing = JSON.parse(readFileSync9(lockPath, "utf8"));
+        const existing = JSON.parse(readFileSync10(lockPath, "utf8"));
         stale = !existing.pid || !isAlive(existing.pid) || typeof existing.startedAt === "number" && now - existing.startedAt > PATCH_LOCK_STALE_MS;
       } catch {
         stale = true;
@@ -13740,7 +13967,7 @@ function tryAcquirePatchLock(lockPath = getPatchLockPath(), opts = {}) {
 }
 function resolveClaudeBinaryForPatch() {
   const envOverride = process.env["TWEAKCC_CC_INSTALLATION_PATH"];
-  const nativeSymlink = join7(homedir3(), ".local", "bin", "claude");
+  const nativeSymlink = join8(homedir3(), ".local", "bin", "claude");
   const source = envOverride?.trim() || (existsSync5(nativeSymlink) ? nativeSymlink : null) || findClaudeBinary();
   if (!source) return { ok: false, reason: "binary-not-found" };
   let resolved;
@@ -13762,18 +13989,37 @@ function resolveClaudeBinaryForPatch() {
   }
   resolved = followed.path;
   try {
-    if (!statSync7(resolved).isFile()) return { ok: false, reason: "binary-not-found" };
+    if (!statSync8(resolved).isFile()) return { ok: false, reason: "binary-not-found" };
   } catch {
     return { ok: false, reason: "binary-not-found" };
   }
+  const placeholder = inspectClaudeNativeBinaryPlaceholder(resolved);
+  if (placeholder) {
+    return {
+      ok: false,
+      reason: "native-binary-missing",
+      binaryPath: resolved,
+      ...placeholder
+    };
+  }
   const version = getClaudeVersionForBinary(resolved);
   if (!version) return { ok: false, reason: "version-unknown", binaryPath: resolved };
   return { ok: true, binaryPath: resolved, version };
 }
-function describePatchTargetFailure(target) {
+function installScriptCommand(path) {
+  return path === null ? "`node node_modules/@anthropic-ai/claude-code/install.cjs` (adjust the path for a local or global install)" : `\`node "${path}"\``;
+}
+function describePatchTargetFailure(target, command = "patch") {
   if (target.reason === "launcher-unresolved") {
     return `${target.shimPath} starts Claude Code but is not Claude Code itself, and clodex could not follow it: ${target.detail}. clodex will not patch a launcher script \u2014 that fails with "Unable to detect installation type". Set CLODEX_CLAUDE_PATH to the Claude Code program itself (for an npm install on Windows that is node_modules\\@anthropic-ai\\claude-code\\bin\\claude.exe under the directory holding the launcher), then run the command again.`;
   }
+  if (target.reason === "native-binary-missing") {
+    const installer = installScriptCommand(target.installScriptPath);
+    const remedy = target.nativePackageState === "present" ? `The platform-native package is installed, so run ${installer} to finish the installation.` : target.nativePackageState === "missing" ? "The platform-native optional package is missing, so `install.cjs` cannot repair this state. Reinstall Claude Code without `--ignore-scripts` / `--omit=optional`." : `clodex could not determine whether the platform-native package is installed. If it is, run ${installer}; otherwise reinstall Claude Code without \`--ignore-scripts\` / \`--omit=optional\`.`;
+    const retry = command === "restore" ? "Then run `clodex patch --restore` again." : command === "launch" ? "Then run the command again." : "Then run `clodex patch` again.";
+    const restore = command === "restore" ? ` If you need to restore by hand, pristine backups are in ${backupDir()}.` : "";
+    return `${target.binaryPath} is Claude Code's npm placeholder, not its native binary, so the npm install is incomplete. ${remedy} ${retry}${restore} If this is a custom wrapper rather than the npm placeholder, set TWEAKCC_CC_INSTALLATION_PATH to the native Claude Code binary.`;
+  }
   return target.reason === "binary-not-found" ? "claude binary not found. Install Claude Code or set TWEAKCC_CC_INSTALLATION_PATH." : `Could not determine the version of ${target.binaryPath} (\`claude --version\` failed). clodex will not patch a binary whose version it cannot read, because the version selects the pristine backup it patches from. If a previous patch left the install broken, \`clodex patch --restore\` still works \u2014 it reads the version from the patch manifest.`;
 }
 function summarizePatchResults(results) {
@@ -13870,8 +14116,8 @@ async function applyPatch(binaryPath, version, desired, configHash, opts) {
   try {
     mkdirSync5(backupDir(), { recursive: true });
     const { tryDetectInstallation, readContent, writeContent } = await import("tweakcc");
-    candidateDir = mkdtempSync(join7(dirname4(binaryPath), ".clodex-patch-"));
-    const candidatePath = join7(candidateDir, basename(binaryPath));
+    candidateDir = mkdtempSync(join8(dirname5(binaryPath), ".clodex-patch-"));
+    const candidatePath = join8(candidateDir, basename(binaryPath));
     const seedCandidate = async (from) => {
       copyFileSync(from, candidatePath);
       const shim = shimEntryModuleName(candidatePath);
@@ -14001,7 +14247,7 @@ async function applyPatch(binaryPath, version, desired, configHash, opts) {
     }
     if (writeShim) restoreEntryModuleName(candidatePath, writeShim, { resign: true });
     else if (publishedBlob) resignMachOBinary(candidatePath);
-    patchedSize = statSync7(candidatePath).size;
+    patchedSize = statSync8(candidatePath).size;
     patchedSha256 = sha256File(candidatePath);
     renameSync2(candidatePath, binaryPath);
   } catch (err) {
@@ -14054,12 +14300,12 @@ async function applyPatch(binaryPath, version, desired, configHash, opts) {
   };
 }
 function runRestoreCommand(target) {
-  if (!target.ok && target.reason === "binary-not-found") {
-    p2.log.error(describePatchTargetFailure(target));
+  if (!target.ok && (target.reason === "binary-not-found" || target.reason === "native-binary-missing")) {
+    p2.log.error(describePatchTargetFailure(target, "restore"));
     return 1;
   }
   if (!target.ok && target.reason === "launcher-unresolved" && target.declaredTarget === null) {
-    p2.log.error(describePatchTargetFailure(target));
+    p2.log.error(describePatchTargetFailure(target, "restore"));
     return 1;
   }
   const binaryPath = target.binaryPath;
@@ -14130,7 +14376,7 @@ async function runPatchCommand(opts = {}) {
     binaryPath,
     claudeVersion: version,
     configHash,
-    binarySize: statSync7(binaryPath).size
+    binarySize: statSync8(binaryPath).size
   });
   if (state === "current") {
     p2.log.success(`claude ${version} is already patched with the current model config \u2014 nothing to do.`);
@@ -14168,7 +14414,7 @@ async function runLaunchPatchCheck(opts = {}) {
     const target = resolveClaudeBinaryForPatch();
     if (!target.ok) {
       if (target.reason !== "binary-not-found" && !opts.agentStdout) {
-        console.error(pc3.dim(`clodex: ${describePatchTargetFailure(target)}`));
+        console.error(pc3.dim(`clodex: ${describePatchTargetFailure(target, "launch")}`));
       }
       return;
     }
@@ -14186,7 +14432,7 @@ async function runLaunchPatchCheck(opts = {}) {
       binaryPath: resolved.binaryPath,
       claudeVersion: resolved.version,
       configHash,
-      binarySize: statSync7(resolved.binaryPath).size
+      binarySize: statSync8(resolved.binaryPath).size
     });
     if (state === "current") return;
     const interactive = !opts.dryRun && !opts.agentStdout && process.stdin.isTTY === true && process.stdout.isTTY === true;
@@ -14522,19 +14768,19 @@ function localProvidersToServerModels(localProviders) {
 // src/registry/credential-cleanup-journal.ts
 import { randomUUID as randomUUID4 } from "crypto";
 import {
-  closeSync as closeSync7,
+  closeSync as closeSync8,
   existsSync as existsSync6,
-  fstatSync as fstatSync2,
+  fstatSync as fstatSync3,
   fsyncSync as fsyncSync2,
   lstatSync,
   mkdirSync as mkdirSync6,
-  openSync as openSync7,
-  readFileSync as readFileSync10,
+  openSync as openSync8,
+  readFileSync as readFileSync11,
   renameSync as renameSync3,
   unlinkSync as unlinkSync4,
   writeFileSync as writeFileSync6
 } from "fs";
-import { dirname as dirname5 } from "path";
+import { dirname as dirname6 } from "path";
 var JOURNAL_SCHEMA_VERSION = 1;
 var DIR_MODE2 = 448;
 var FILE_MODE4 = 384;
@@ -14620,8 +14866,8 @@ function readJournalUnlocked(path) {
     if (before.isSymbolicLink() || !before.isFile()) {
       throw new Error("Credential cleanup journal must be a regular file.");
     }
-    fd = openSync7(path, "r");
-    const opened = fstatSync2(fd);
+    fd = openSync8(path, "r");
+    const opened = fstatSync3(fd);
     if (before.dev !== opened.dev || before.ino !== opened.ino) {
       throw new Error("Credential cleanup journal changed while opening.");
     }
@@ -14636,44 +14882,44 @@ function readJournalUnlocked(path) {
     if (opened.size > MAX_JOURNAL_BYTES) {
       throw new Error("Credential cleanup journal is too large.");
     }
-    return parseJournal(JSON.parse(readFileSync10(fd, "utf8")));
+    return parseJournal(JSON.parse(readFileSync11(fd, "utf8")));
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     throw new Error(`Could not read credential cleanup journal: ${message}`);
   } finally {
-    if (fd !== void 0) closeSync7(fd);
+    if (fd !== void 0) closeSync8(fd);
   }
 }
 function syncParentDirectory(path) {
   let fd;
   try {
-    fd = openSync7(dirname5(path), "r");
+    fd = openSync8(dirname6(path), "r");
     fsyncSync2(fd);
   } catch (error) {
     const code = error.code;
     if (code !== "EINVAL" && code !== "ENOTSUP" && code !== "EPERM") throw error;
   } finally {
-    if (fd !== void 0) closeSync7(fd);
+    if (fd !== void 0) closeSync8(fd);
   }
 }
 function writeJournalUnlocked(journal, path) {
   assertRegistryWriteOwnership(path);
   ensureSecureAppHome();
-  mkdirSync6(dirname5(path), { recursive: true, mode: DIR_MODE2 });
+  mkdirSync6(dirname6(path), { recursive: true, mode: DIR_MODE2 });
   const tmp = `${path}.${process.pid}.${randomUUID4()}.tmp`;
   let fd;
   try {
-    fd = openSync7(tmp, "wx", FILE_MODE4);
+    fd = openSync8(tmp, "wx", FILE_MODE4);
     writeFileSync6(fd, `${JSON.stringify(journal, null, 2)}
 `);
     fsyncSync2(fd);
-    closeSync7(fd);
+    closeSync8(fd);
     fd = void 0;
     assertRegistryWriteOwnership(path);
     renameSync3(tmp, path);
     syncParentDirectory(path);
   } finally {
-    if (fd !== void 0) closeSync7(fd);
+    if (fd !== void 0) closeSync8(fd);
     try {
       unlinkSync4(tmp);
     } catch (error) {
@@ -18642,8 +18888,8 @@ import { createBrotliDecompress, createGunzip, createInflate } from "zlib";
 
 // src/http-proxy/ca.ts
 import { randomBytes as randomBytes2 } from "crypto";
-import { chmodSync as chmodSync4, existsSync as existsSync7, mkdirSync as mkdirSync7, readFileSync as readFileSync11, writeFileSync as writeFileSync7 } from "fs";
-import { dirname as dirname6, join as join8, resolve as resolve3 } from "path";
+import { chmodSync as chmodSync4, existsSync as existsSync7, mkdirSync as mkdirSync7, readFileSync as readFileSync12, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname7, join as join9, resolve as resolve3 } from "path";
 import forge from "node-forge";
 var CERT_DIR = "http-proxy";
 var CA_CERT_FILE = "clodex-ca.pem";
@@ -18658,14 +18904,14 @@ function serialNumber() {
   return bytes.toString("hex");
 }
 function certPaths() {
-  const dir = join8(getAppHome(), CERT_DIR);
+  const dir = join9(getAppHome(), CERT_DIR);
   return {
     dir,
-    caCert: join8(dir, CA_CERT_FILE),
-    caKey: join8(dir, CA_KEY_FILE),
-    serverCert: join8(dir, SERVER_CERT_FILE),
-    serverKey: join8(dir, SERVER_KEY_FILE),
-    version: join8(dir, CERT_VERSION_FILE)
+    caCert: join9(dir, CA_CERT_FILE),
+    caKey: join9(dir, CA_KEY_FILE),
+    serverCert: join9(dir, SERVER_CERT_FILE),
+    serverKey: join9(dir, SERVER_KEY_FILE),
+    version: join9(dir, CERT_VERSION_FILE)
   };
 }
 function writePrivate(path, value) {
@@ -18718,8 +18964,8 @@ function generateCertificates(paths) {
 }
 function storedCertificatesAreCurrent(paths) {
   try {
-    const ca = forge.pki.certificateFromPem(readFileSync11(paths.caCert, "utf8"));
-    const server = forge.pki.certificateFromPem(readFileSync11(paths.serverCert, "utf8"));
+    const ca = forge.pki.certificateFromPem(readFileSync12(paths.caCert, "utf8"));
+    const server = forge.pki.certificateFromPem(readFileSync12(paths.serverCert, "utf8"));
     const now = Date.now();
     const renewalBuffer = 7 * 24 * 60 * 60 * 1e3;
     return ca.validity.notBefore.getTime() <= now && ca.validity.notAfter.getTime() > now + renewalBuffer && server.validity.notBefore.getTime() <= now && server.validity.notAfter.getTime() > now + renewalBuffer && ca.verify(ca) && ca.verify(server);
@@ -18730,13 +18976,13 @@ function storedCertificatesAreCurrent(paths) {
 function ensureHttpProxyCertificates() {
   const paths = certPaths();
   const required = [paths.caCert, paths.caKey, paths.serverCert, paths.serverKey, paths.version];
-  const current = required.every(existsSync7) && readFileSync11(paths.version, "utf8") === CERT_VERSION && storedCertificatesAreCurrent(paths);
+  const current = required.every(existsSync7) && readFileSync12(paths.version, "utf8") === CERT_VERSION && storedCertificatesAreCurrent(paths);
   if (!current) generateCertificates(paths);
   return {
     caCertPath: paths.caCert,
-    caCert: readFileSync11(paths.caCert, "utf8"),
-    serverCert: readFileSync11(paths.serverCert, "utf8"),
-    serverKey: readFileSync11(paths.serverKey, "utf8")
+    caCert: readFileSync12(paths.caCert, "utf8"),
+    serverCert: readFileSync12(paths.serverCert, "utf8"),
+    serverKey: readFileSync12(paths.serverKey, "utf8")
   };
 }
 function ensureHttpProxyCaBundle(relayCaCertPath, additionalCaCertPath, onWarning) {
@@ -18750,7 +18996,7 @@ function ensureHttpProxyCaBundle(relayCaCertPath, additionalCaCertPath, onWarnin
   let additionalCa;
   try {
     if (resolve3(additionalCaCertPath) === resolve3(relayCaCertPath)) return relayCaCertPath;
-    additionalCa = readFileSync11(additionalCaCertPath, "utf8").trim();
+    additionalCa = readFileSync12(additionalCaCertPath, "utf8").trim();
   } catch (err) {
     return warn(
       `NODE_EXTRA_CA_CERTS=${additionalCaCertPath} cannot be read (${err instanceof Error ? err.message : String(err)}), so it is not part of the proxy CA bundle. Where node reports this itself it says only "Ignoring extra certs ... load failed", without naming the variable. Clear or correct it.`
@@ -18760,15 +19006,15 @@ function ensureHttpProxyCaBundle(relayCaCertPath, additionalCaCertPath, onWarnin
     return warn(`NODE_EXTRA_CA_CERTS=${additionalCaCertPath} is empty, so it adds nothing.`);
   }
   try {
-    const relayCa = readFileSync11(relayCaCertPath, "utf8").trimEnd();
-    const combinedPath = join8(dirname6(relayCaCertPath), "combined-ca.pem");
+    const relayCa = readFileSync12(relayCaCertPath, "utf8").trimEnd();
+    const combinedPath = join9(dirname7(relayCaCertPath), "combined-ca.pem");
     writePublic(combinedPath, `${relayCa}
 ${additionalCa}
 `);
     return combinedPath;
   } catch (err) {
     return warn(
-      `clodex could not build the combined CA bundle in ${dirname6(relayCaCertPath)} (${err instanceof Error ? err.message : String(err)}), so the readable, non-empty NODE_EXTRA_CA_CERTS=${additionalCaCertPath} was left out of it. Fix the reported error and restart clodex.`
+      `clodex could not build the combined CA bundle in ${dirname7(relayCaCertPath)} (${err instanceof Error ? err.message : String(err)}), so the readable, non-empty NODE_EXTRA_CA_CERTS=${additionalCaCertPath} was left out of it. Fix the reported error and restart clodex.`
     );
   }
 }