@bman654/clodex 2.12.0 → 2.12.2

package/dist/cli.js

@@ -382,7 +382,7 @@ import { join } from "path";
 // package.json
 var package_default = {
   name: "@bman654/clodex",
-  version: "2.12.0",
+  version: "2.12.2",
   publishConfig: {
     access: "public"
   },
@@ -3884,16 +3884,17 @@ function applyClodexPatches(source, config) {
 // src/patcher.ts
 import { createHash as createHash9 } from "crypto";
 import {
+  chmodSync as chmodSync4,
   copyFileSync,
   existsSync as existsSync5,
   mkdtempSync,
   mkdirSync as mkdirSync5,
   readFileSync as readFileSync10,
-  renameSync as renameSync2,
-  rmSync,
+  renameSync as renameSync3,
+  rmSync as rmSync2,
   statSync as statSync8,
   unlinkSync as unlinkSync3,
-  writeFileSync as writeFileSync5,
+  writeFileSync as writeFileSync6,
   openSync as openSync7,
   closeSync as closeSync7,
   realpathSync as realpathSync2
@@ -4820,16 +4821,19 @@ var pricing_cache_default = {
   ]
 };
 
+// src/data/opencode-go-models.ts
+import { randomUUID as randomUUID2 } from "crypto";
+
 // src/data/opencode-go-models.json
 var opencode_go_models_default = [
   {
     id: "deepseek-v4-flash",
-    name: "DeepSeek V4 Flash (2x usage)",
+    name: "DeepSeek V4 Flash",
     contextWindow: 1e6,
     cost: {
-      input: 0.07,
-      output: 0.14,
-      cache_read: 14e-4
+      input: 0.15,
+      output: 0.6,
+      cache_read: 3e-3
     },
     modelFormat: "openai",
     npm: "@ai-sdk/openai-compatible",
@@ -4857,12 +4861,12 @@ var opencode_go_models_default = [
   },
   {
     id: "deepseek-v4-pro",
-    name: "DeepSeek V4 Pro",
+    name: "DeepSeek V4 Pro (New)",
     contextWindow: 1e6,
     cost: {
-      input: 0.435,
-      output: 0.87,
-      cache_read: 3625e-6
+      input: 0.66,
+      output: 1.98,
+      cache_read: 0.022
     },
     modelFormat: "openai",
     npm: "@ai-sdk/openai-compatible",
@@ -4888,6 +4892,30 @@ var opencode_go_models_default = [
     upstreamModelId: "deepseek-v4-pro",
     family: "deepseek"
   },
+  {
+    id: "deepseek-v4.1-flash",
+    name: "DeepSeek V4.1 Flash",
+    contextWindow: 1e6,
+    cost: {
+      input: 0.15,
+      output: 0.6,
+      cache_read: 3e-3
+    },
+    modelFormat: "anthropic",
+    npm: "@ai-sdk/anthropic",
+    apiUrl: "https://opencode.ai/zen/go",
+    reasoning: true,
+    modalities: [
+      "text",
+      "image"
+    ],
+    compatibility: {
+      supportsCountTokens: false,
+      supportsReasoningEffort: false
+    },
+    upstreamModelId: "deepseek-v4.1-flash",
+    family: "deepseek"
+  },
   {
     id: "glm-5.1",
     name: "GLM-5.1",
@@ -4905,10 +4933,10 @@ var opencode_go_models_default = [
       "text"
     ],
     compatibility: {
+      supportsReasoningEffort: false,
       supportsStore: false,
       supportsDeveloperRole: false,
-      maxTokensField: "max_tokens",
-      supportsReasoningEffort: false
+      maxTokensField: "max_tokens"
     },
     upstreamModelId: "glm-5.1",
     family: "glm"
@@ -4948,13 +4976,13 @@ var opencode_go_models_default = [
   },
   {
     id: "gpt-5.6-luna",
-    name: "GPT-5.6 Luna (2x usage)",
+    name: "GPT-5.6 Luna",
     contextWindow: 105e4,
     cost: {
-      input: 0.1,
-      output: 0.6,
-      cache_read: 0.01,
-      cache_write: 0.125
+      input: 0.2,
+      output: 1.2,
+      cache_read: 0.02,
+      cache_write: 0.25
     },
     modelFormat: "openai",
     npm: "@ai-sdk/openai-compatible",
@@ -4964,8 +4992,6 @@ var opencode_go_models_default = [
       "text",
       "image"
     ],
-    upstreamModelId: "gpt-5.6-luna",
-    family: "gpt",
     compatibility: {
       reasoningEffortMap: {
         off: "none",
@@ -4979,7 +5005,9 @@ var opencode_go_models_default = [
       supportsStore: false,
       supportsDeveloperRole: false,
       maxTokensField: "max_tokens"
-    }
+    },
+    upstreamModelId: "gpt-5.6-luna",
+    family: "gpt"
   },
   {
     id: "hy3",
@@ -5065,10 +5093,10 @@ var opencode_go_models_default = [
       "image"
     ],
     compatibility: {
+      supportsReasoningEffort: false,
       supportsStore: false,
       supportsDeveloperRole: false,
-      maxTokensField: "max_tokens",
-      supportsReasoningEffort: false
+      maxTokensField: "max_tokens"
     },
     upstreamModelId: "kimi-k2.7-code",
     family: "kimi"
@@ -5125,10 +5153,10 @@ var opencode_go_models_default = [
       "image"
     ],
     compatibility: {
+      supportsReasoningEffort: false,
       supportsStore: false,
       supportsDeveloperRole: false,
-      maxTokensField: "max_tokens",
-      supportsReasoningEffort: false
+      maxTokensField: "max_tokens"
     },
     upstreamModelId: "mimo-v2.5",
     family: "mimo"
@@ -5150,10 +5178,10 @@ var opencode_go_models_default = [
       "text"
     ],
     compatibility: {
+      supportsReasoningEffort: false,
       supportsStore: false,
       supportsDeveloperRole: false,
-      maxTokensField: "max_tokens",
-      supportsReasoningEffort: false
+      maxTokensField: "max_tokens"
     },
     upstreamModelId: "mimo-v2.5-pro",
     family: "mimo"
@@ -5175,10 +5203,10 @@ var opencode_go_models_default = [
       "text"
     ],
     compatibility: {
+      supportsReasoningEffort: false,
       supportsStore: false,
       supportsDeveloperRole: false,
-      maxTokensField: "max_tokens",
-      supportsReasoningEffort: false
+      maxTokensField: "max_tokens"
     },
     upstreamModelId: "minimax-m2.7",
     family: "minimax"
@@ -5200,12 +5228,12 @@ var opencode_go_models_default = [
       "text",
       "image"
     ],
-    upstreamModelId: "minimax-m3",
-    family: "minimax",
     compatibility: {
       supportsCountTokens: false,
       supportsReasoningEffort: false
-    }
+    },
+    upstreamModelId: "minimax-m3",
+    family: "minimax"
   },
   {
     id: "qwen3.6-plus",
@@ -5226,10 +5254,6 @@ var opencode_go_models_default = [
       "image"
     ],
     compatibility: {
-      supportsStore: false,
-      supportsDeveloperRole: false,
-      thinkingFormat: "qwen",
-      maxTokensField: "max_tokens",
       reasoningEffortMap: {
         low: "low",
         medium: "medium",
@@ -5238,7 +5262,11 @@ var opencode_go_models_default = [
         max: "max",
         minimal: null,
         off: null
-      }
+      },
+      supportsStore: false,
+      supportsDeveloperRole: false,
+      thinkingFormat: "qwen",
+      maxTokensField: "max_tokens"
     },
     upstreamModelId: "qwen3.6-plus",
     family: "qwen3.6"
@@ -5260,12 +5288,12 @@ var opencode_go_models_default = [
     modalities: [
       "text"
     ],
-    upstreamModelId: "qwen3.7-max",
-    family: "qwen3.7",
     compatibility: {
       supportsCountTokens: false,
       supportsReasoningEffort: false
-    }
+    },
+    upstreamModelId: "qwen3.7-max",
+    family: "qwen3.7"
   },
   {
     id: "qwen3.7-plus",
@@ -5285,12 +5313,12 @@ var opencode_go_models_default = [
       "text",
       "image"
     ],
-    upstreamModelId: "qwen3.7-plus",
-    family: "qwen3.7",
     compatibility: {
       supportsCountTokens: false,
       supportsReasoningEffort: false
-    }
+    },
+    upstreamModelId: "qwen3.7-plus",
+    family: "qwen3.7"
   },
   {
     id: "qwen3.8-max",
@@ -5310,12 +5338,12 @@ var opencode_go_models_default = [
       "text",
       "image"
     ],
-    upstreamModelId: "qwen3.8-max",
-    family: "qwen3.8",
     compatibility: {
       supportsCountTokens: false,
       supportsReasoningEffort: false
-    }
+    },
+    upstreamModelId: "qwen3.8-max",
+    family: "qwen3.8"
   }
 ];
 
@@ -5327,6 +5355,13 @@ var OPENCODE_GO_ANTHROPIC_BASE_URL = "https://opencode.ai/zen/go";
 function buildOpenCodeGoModels() {
   return structuredClone(opencode_go_models_default);
 }
+var OPENCODE_GO_FALLBACK_SESSION_ID = randomUUID2();
+function openCodeGoSessionHeaders(model, claudeSessionId) {
+  const url = String(model.apiBaseUrl ?? model.baseUrl ?? model.apiUrl ?? "");
+  const isGo = model.providerId === OPENCODE_GO_PROVIDER_ID || /^https:\/\/opencode\.ai\/zen\/go(\/|$)/.test(url);
+  if (!isGo) return void 0;
+  return { "x-opencode-session": claudeSessionId ?? OPENCODE_GO_FALLBACK_SESSION_ID };
+}
 
 // src/provider-templates.ts
 async function verifyOpenCodeGoCredential(apiKey) {
@@ -5337,7 +5372,12 @@ async function verifyOpenCodeGoCredential(apiKey) {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
-        Authorization: `Bearer ${apiKey}`
+        Authorization: `Bearer ${apiKey}`,
+        // Go answers `MissingSessionID` to any request without a session header,
+        // and whether it validates the key BEFORE that check is not something we
+        // have observed. Sending the header removes the question: the probe then
+        // cannot mistake a missing-session rejection for a verdict on the key.
+        ...openCodeGoSessionHeaders({ providerId: OPENCODE_GO_PROVIDER_ID }, void 0)
       },
       body: JSON.stringify({ model: model.upstreamModelId ?? model.id }),
       // This is the FIRST thing a user hits after pasting a key, and it runs
@@ -7772,7 +7812,7 @@ function writeAll(fd, bytes, position, path) {
 
 // src/patch-backup.ts
 import { createHash as createHash5 } from "crypto";
-import { existsSync as existsSync4, readFileSync as readFileSync9, readdirSync, statSync as statSync7 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync9, readdirSync, renameSync as renameSync2, rmSync, statSync as statSync7, writeFileSync as writeFileSync5 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join7 } from "path";
 var BACKUP_SHA_PREFIX_LENGTH = 16;
@@ -7790,9 +7830,60 @@ function backupVersionTag(version) {
 function contentAddressedBackupPath(version, sha256, dir = backupDir()) {
   return join7(dir, `claude-${backupVersionTag(version)}-${sha256.slice(0, BACKUP_SHA_PREFIX_LENGTH)}.orig`);
 }
+function legacyBackupPath(version, dir = backupDir()) {
+  return join7(dir, `claude-${backupVersionTag(version)}.orig`);
+}
 function tweakccMirrorBackupPath(dir = backupDir()) {
   return join7(dir, "native-binary.backup");
 }
+function installProvenancePath(backupPath, binaryPath) {
+  const tag = createHash5("sha256").update(binaryPath).digest("hex").slice(0, BACKUP_SHA_PREFIX_LENGTH);
+  return `${backupPath}.for-${tag}.json`;
+}
+function installProvenancePattern(name) {
+  return new RegExp(`^${name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\.for-[0-9a-f]{${BACKUP_SHA_PREFIX_LENGTH}}\\.json$`);
+}
+function readInstallProvenance(path) {
+  let raw;
+  try {
+    raw = readFileSync9(path, "utf8");
+  } catch {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return "damaged";
+  }
+  if (typeof parsed !== "object" || parsed === null) return "damaged";
+  const { install, assumed } = parsed;
+  if (typeof install !== "string" || install === "") return "damaged";
+  if (typeof assumed !== "boolean") return "damaged";
+  return { install, assumed };
+}
+function recordBackupProvenance(backupPath, binaryPath, opts) {
+  const target = installProvenancePath(backupPath, binaryPath);
+  const existing = readInstallProvenance(target);
+  if (existing && existing !== "damaged" && existing.install === binaryPath) {
+    if (existing.assumed === opts.assumed) return existing.assumed ? "assumed" : "established";
+    if (!existing.assumed) return "established";
+  }
+  const record = { install: binaryPath, assumed: opts.assumed };
+  const temp = `${target}.tmp-${process.pid}-${Date.now().toString(36)}`;
+  try {
+    writeFileSync5(temp, `${JSON.stringify(record, null, 2)}
+`);
+    renameSync2(temp, target);
+    return opts.assumed ? "assumed" : "established";
+  } catch (err) {
+    try {
+      rmSync(temp, { force: true });
+    } catch {
+    }
+    throw err;
+  }
+}
 function scanPristineBackups(version, dir = backupDir()) {
   const tag = backupVersionTag(version);
   const pattern = new RegExp(`^claude-${tag.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:-([0-9a-f]{${BACKUP_SHA_PREFIX_LENGTH}}))?\\.orig$`);
@@ -7802,6 +7893,27 @@ function scanPristineBackups(version, dir = backupDir()) {
   } catch {
     return { valid: [], corrupt: [] };
   }
+  const provenanceOf = (name) => {
+    const recordPattern = installProvenancePattern(name);
+    const installs = [];
+    const assumedInstalls = [];
+    const damagedProvenance = [];
+    for (const entry of entries) {
+      if (!recordPattern.test(entry)) continue;
+      const path = join7(dir, entry);
+      const record = readInstallProvenance(path);
+      if (record === null || record === "damaged" || installProvenancePath(join7(dir, name), record.install) !== path) {
+        damagedProvenance.push(path);
+        continue;
+      }
+      (record.assumed ? assumedInstalls : installs).push(record.install);
+    }
+    return {
+      installs: installs.sort(),
+      assumedInstalls: assumedInstalls.sort(),
+      damagedProvenance: damagedProvenance.sort()
+    };
+  };
   const valid = [];
   const corrupt = [];
   for (const entry of entries.sort()) {
@@ -7822,9 +7934,9 @@ function scanPristineBackups(version, dir = backupDir()) {
         corrupt.push(path);
         continue;
       }
-      valid.push({ path, kind: "content-addressed", sha256 });
+      valid.push({ path, kind: "content-addressed", sha256, ...provenanceOf(entry) });
     } else {
-      valid.push({ path, kind: "legacy", sha256 });
+      valid.push({ path, kind: "legacy", sha256, ...provenanceOf(entry) });
     }
   }
   return { valid, corrupt };
@@ -7846,7 +7958,7 @@ function looksLikeLegacyClodexPatch(source) {
 }
 function noBackupMessage(facts) {
   const corrupt = facts.corruptBackups?.length ? ` (${facts.corruptBackups.length} backup file(s) for this version failed integrity checks and were ignored)` : "";
-  return `claude ${facts.version} is already patched and no trustworthy pristine backup for that version exists in ${backupDir()}${corrupt}. Reinstall Claude Code to get a pristine binary, then run \`clodex patch\`.`;
+  return `clodex holds no pristine backup of claude ${facts.version} it can attribute to ${facts.binaryPath}: none was found in ${backupDir()}${corrupt}. If that binary is patched, reinstall Claude Code to get a pristine one and run \`clodex patch\` again. If it was never patched, there is nothing to restore.`;
 }
 function identifiesABackup(manifest) {
   return manifest.pristineSha256 !== void 0 || manifest.backupPath !== void 0;
@@ -7860,8 +7972,26 @@ function recordedBackupGoneMessage(facts, manifest) {
 function otherInstallMessage(facts, otherBinaryPath) {
   return `The patch manifest records a different Claude Code install (${otherBinaryPath}), so nothing establishes that a pristine backup tagged claude ${facts.version} in ${backupDir()} belongs to ${facts.binaryPath}. Two installs of one Claude Code version are different files, so restoring by version tag alone would overwrite this install with another one's bytes. Set TWEAKCC_CC_INSTALLATION_PATH=${otherBinaryPath} to restore that install instead, or reinstall Claude Code to make this one pristine.`;
 }
+function otherInstallProvenanceMessage(facts, recorded) {
+  const owners = [...new Set(recorded.flatMap((backup) => backup.installs))];
+  return `The pristine backup(s) of claude ${facts.version} in ${backupDir()} are recorded as the pristine content of ${owners.join(", ")}, not of ${facts.binaryPath}. Two installs of one Claude Code version are different files, so restoring one of those would overwrite this install with bytes that were never its own. Set TWEAKCC_CC_INSTALLATION_PATH=${owners[0]} to restore that install instead, or reinstall Claude Code to make this one pristine.`;
+}
+function damagedProvenanceMessage(facts, damaged) {
+  return `A pristine backup of claude ${facts.version} in ${backupDir()} carries a provenance record that clodex cannot read (${damaged.join(", ")}). Something recorded which install those bytes belong to and that record is damaged, so clodex will not fall back to matching on the claude version in the file name \u2014 on a machine with more than one install that would hand ${facts.binaryPath} bytes that were never its own. Delete the unreadable record to accept that fallback, or reinstall Claude Code to make this install pristine.`;
+}
+function contradictoryProvenanceMessage(facts, mine) {
+  return `More than one pristine backup of claude ${facts.version} is recorded as the pristine content of ${facts.binaryPath} (${mine.map((backup) => backup.path).join(", ")}), and they do not hold the same bytes, so clodex cannot tell which one that install holds now \u2014 being snapshotted twice, at two different sets of unpatched bytes, reaches this state without either record being wrong. Delete whichever is stale to decide it: ${mine.map((backup) => installProvenancePath(backup.path, facts.binaryPath)).join(", ")}. Or reinstall the Claude Code at ${facts.binaryPath} and delete both.`;
+}
+function manifestContradictsRecordMessage(facts, manifestChoice, recorded) {
+  return `The patch manifest names ${manifestChoice} as the pristine content of ${facts.binaryPath}, but ${recorded.map((backup) => backup.path).join(", ")} is recorded as that install's pristine content and holds different bytes. Nothing establishes which of them the install at that path is now \u2014 an executable replaced in place with a different build of the same claude version reaches exactly this state \u2014 so clodex will not pick one. Delete whichever of these records is stale to decide it: ${recorded.map((backup) => installProvenancePath(backup.path, facts.binaryPath)).join(", ")}. Or reinstall the Claude Code at ${facts.binaryPath} and delete both: a pristine install needs no backup, and \`clodex patch\` will record its own.`;
+}
+function assumedElsewhereMessage(facts, backups) {
+  const others = [...new Set(backups.flatMap((backup) => backup.assumedInstalls))];
+  return `The pristine backup(s) of claude ${facts.version} in ${backupDir()} have already been restored onto ${others.join(", ")} \u2014 not onto ${facts.binaryPath}. That was itself matched on the claude version in a file name, so it is not proof of ownership, but it is a reason not to hand the same bytes to a second install: two installs of one version are different files. Set TWEAKCC_CC_INSTALLATION_PATH=${others[0]} to restore that install, or reinstall Claude Code to make this one pristine.`;
+}
 function selectRestoreSource(facts) {
   const notes = [];
+  let assumedForThisInstall = false;
   const recorded = facts.manifest;
   const speaksForThisVersion = !recorded?.claudeVersion || recorded.claudeVersion === facts.version;
   const manifest = recorded && recorded.binaryPath === facts.binaryPath && speaksForThisVersion ? recorded : null;
@@ -7873,10 +8003,46 @@ function selectRestoreSource(facts) {
   if (!chosen && manifest && identifiesABackup(manifest)) {
     return { action: "error", message: recordedBackupGoneMessage(facts, manifest) };
   }
+  const manifestDescribesLiveBytes = !!manifest?.patchedSha256 && manifest.patchedSha256 === facts.liveSha256;
+  if (chosen && !manifestDescribesLiveBytes) {
+    const manifestChoice = chosen;
+    const contradicting = facts.backups.filter(
+      (backup) => backup.installs.includes(facts.binaryPath) && backup.sha256 !== manifestChoice.sha256
+    );
+    if (contradicting.length) {
+      return {
+        action: "error",
+        message: manifestContradictsRecordMessage(facts, manifestChoice.path, contradicting)
+      };
+    }
+  }
+  if (!chosen) {
+    const mine = facts.backups.filter((backup) => backup.installs.includes(facts.binaryPath));
+    if (mine.length) {
+      if (new Set(mine.map((backup) => backup.sha256)).size > 1) {
+        return { action: "error", message: contradictoryProvenanceMessage(facts, mine) };
+      }
+      chosen = mine.find((backup) => backup.kind === "content-addressed") ?? mine[0];
+    }
+  }
   if (!chosen) {
     if (other) {
       return facts.backups.length ? { action: "error", message: otherInstallMessage(facts, other.binaryPath) } : { action: "error", message: noBackupMessage(facts) };
     }
+    const recordedElsewhere = facts.backups.filter((backup) => backup.installs.length > 0);
+    if (recordedElsewhere.length) {
+      return { action: "error", message: otherInstallProvenanceMessage(facts, recordedElsewhere) };
+    }
+    const damaged = facts.backups.flatMap((backup) => backup.damagedProvenance);
+    if (damaged.length) {
+      return { action: "error", message: damagedProvenanceMessage(facts, damaged) };
+    }
+    const assumedElsewhere = facts.backups.filter(
+      (backup) => backup.assumedInstalls.some((install) => install !== facts.binaryPath)
+    );
+    if (assumedElsewhere.length) {
+      return { action: "error", message: assumedElsewhereMessage(facts, assumedElsewhere) };
+    }
     const distinct = [...new Set(facts.backups.map((backup) => backup.sha256))];
     if (distinct.length > 1) {
       return {
@@ -7886,12 +8052,14 @@ function selectRestoreSource(facts) {
     }
     chosen = facts.backups.find((backup) => backup.kind === "content-addressed") ?? facts.backups[0];
     if (chosen) {
+      assumedForThisInstall = true;
       notes.push(
-        `No patch manifest records ${facts.binaryPath}, so ${chosen.path} is being used as its pristine content on the strength of its claude ${facts.version} version tag alone. On a machine with more than one Claude Code install those bytes may belong to the other one \u2014 a clodex that had recorded this install would have refused rather than guess.`
+        `Neither a patch manifest nor a provenance record ties ${chosen.path} to ${facts.binaryPath}, so it is being used as that install's pristine content on the strength of its claude ${facts.version} version tag alone \u2014 it predates the records clodex now writes. On a machine with more than one Claude Code install those bytes may belong to the other one, and clodex will not record this guess as provenance.`
       );
     }
   }
   if (!chosen) return { action: "error", message: noBackupMessage(facts) };
+  if (manifest?.pristineProvenance === "assumed") assumedForThisInstall = true;
   return {
     action: "restore",
     backupPath: chosen.path,
@@ -7900,6 +8068,7 @@ function selectRestoreSource(facts) {
     // another version's binary, stored under a mislabeled name by an older
     // clodex. Executing it is the only evidence available; require it.
     probeVersion: chosen.kind === "legacy",
+    assumedForThisInstall,
     notes
   };
 }
@@ -8868,16 +9037,64 @@ function responsesWebSocketPartitionKey(wsUrl, payload, options = {}, authorizat
 function inputArray(payload) {
   return Array.isArray(payload.input) ? payload.input : [];
 }
-function normalizeToolCallJson(value) {
-  if (Array.isArray(value)) return value.map(normalizeToolCallJson);
+function toolSchemaDefaults(payload) {
+  const defaults = /* @__PURE__ */ new Map();
+  const add = (tool3) => {
+    if (!tool3 || typeof tool3 !== "object") return;
+    const record = tool3;
+    if (record.type === "namespace" && Array.isArray(record.tools)) {
+      for (const nested of record.tools) add(nested);
+      return;
+    }
+    if (record.type !== "function" || typeof record.name !== "string") return;
+    const parameters = record.parameters;
+    const properties = parameters && typeof parameters === "object" ? parameters.properties : void 0;
+    if (!properties || typeof properties !== "object") return;
+    const perTool = /* @__PURE__ */ new Map();
+    for (const [prop, schema] of Object.entries(properties)) {
+      if (schema && typeof schema === "object" && "default" in schema) {
+        perTool.set(prop, canonicalJson(schema.default));
+      }
+    }
+    if (perTool.size) defaults.set(record.name, perTool);
+  };
+  if (Array.isArray(payload.tools)) for (const tool3 of payload.tools) add(tool3);
+  return defaults;
+}
+function toolSchemaDefaultsFingerprint(defaults) {
+  if (!defaults.size) return "none";
+  const tuples = [...defaults.entries()].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([name, perTool]) => [
+    name,
+    [...perTool.entries()].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)
+  ]);
+  return createHash6("sha256").update(JSON.stringify(tuples)).digest("hex").slice(0, 16);
+}
+function stripSchemaDefaults(name, args, defaults) {
+  if (!defaults) return args;
+  if (typeof name !== "string" || !args || typeof args !== "object" || Array.isArray(args)) return args;
+  const perTool = defaults.get(name);
+  if (!perTool) return args;
+  const out = {};
+  for (const [key, value] of Object.entries(args)) {
+    const expected = perTool.get(key);
+    if (expected !== void 0 && canonicalJson(value) === expected) continue;
+    out[key] = value;
+  }
+  return out;
+}
+function normalizeToolCallJson(value, defaults) {
+  if (Array.isArray(value)) return value.map((item) => normalizeToolCallJson(item, defaults));
   if (!value || typeof value !== "object") return value;
   const record = value;
   const out = {};
-  for (const [key, child] of Object.entries(record)) out[key] = normalizeToolCallJson(child);
+  for (const [key, child] of Object.entries(record)) out[key] = normalizeToolCallJson(child, defaults);
   const jsonField = record.type === "function_call" ? "arguments" : record.type === "custom_tool_call" ? "input" : void 0;
   if (jsonField && typeof record[jsonField] === "string") {
     try {
-      out[jsonField] = canonicalJson(JSON.parse(record[jsonField]));
+      const parsed = JSON.parse(record[jsonField]);
+      out[jsonField] = canonicalJson(
+        jsonField === "arguments" ? stripSchemaDefaults(record.name, parsed, defaults) : parsed
+      );
     } catch {
     }
   }
@@ -8888,8 +9105,8 @@ function normalizeToolCallJson(value) {
   }
   return out;
 }
-function arraysEqual(left, right) {
-  return canonicalJson(normalizeToolCallJson(left)) === canonicalJson(normalizeToolCallJson(right));
+function arraysEqual(left, right, defaults) {
+  return canonicalJson(normalizeToolCallJson(left, defaults)) === canonicalJson(normalizeToolCallJson(right, defaults));
 }
 function conversationItemKind(value) {
   if (!value || typeof value !== "object") return typeof value;
@@ -8898,17 +9115,17 @@ function conversationItemKind(value) {
   if (typeof record.role === "string") return record.role;
   return "object";
 }
-function conversationItemHash(value) {
-  return createHash6("sha256").update(canonicalJson(normalizeToolCallJson(value))).digest("hex").slice(0, 16);
+function conversationItemHash(value, defaults) {
+  return createHash6("sha256").update(canonicalJson(normalizeToolCallJson(value, defaults))).digest("hex").slice(0, 16);
 }
-function reasoningNormalizationGap(expected, actual) {
+function reasoningNormalizationGap(expected, actual, defaults) {
   if (conversationItemKind(expected) !== "reasoning" || conversationItemKind(actual) !== "reasoning") return void 0;
   const left = expected;
   const right = actual;
   const blob = left.encrypted_content;
   if (typeof blob !== "string" || !blob || blob !== right.encrypted_content) return void 0;
-  const normalizedLeft = normalizeToolCallJson(left);
-  const normalizedRight = normalizeToolCallJson(right);
+  const normalizedLeft = normalizeToolCallJson(left, defaults);
+  const normalizedRight = normalizeToolCallJson(right, defaults);
   const fields = [.../* @__PURE__ */ new Set([...Object.keys(normalizedLeft), ...Object.keys(normalizedRight)])].sort().filter((key) => canonicalJson(normalizedLeft[key]) !== canonicalJson(normalizedRight[key]));
   return fields.length ? fields : void 0;
 }
@@ -8956,7 +9173,7 @@ function warnReasoningNormalizationGap(fields, log12) {
     emitParentNotice("clodex: warning: further reasoning-normalization warnings suppressed.");
   }
 }
-function toolArgumentNormalizationGap(expected, actual, requiredProps) {
+function toolArgumentNormalizationGap(expected, actual, defaults, requiredProps) {
   if (conversationItemKind(expected) !== "function_call") return void 0;
   if (conversationItemKind(actual) !== "function_call") return void 0;
   const left = expected;
@@ -8964,7 +9181,7 @@ function toolArgumentNormalizationGap(expected, actual, requiredProps) {
   const callId = left.call_id;
   if (typeof callId !== "string" || !callId || callId !== right.call_id) return void 0;
   if (typeof left.name !== "string" || left.name !== right.name) return void 0;
-  if (canonicalJson(normalizeToolCallJson(left)) === canonicalJson(normalizeToolCallJson(right))) {
+  if (canonicalJson(normalizeToolCallJson(left, defaults)) === canonicalJson(normalizeToolCallJson(right, defaults))) {
     return void 0;
   }
   const required = requiredProps().get(left.name);
@@ -8975,8 +9192,8 @@ function toolArgumentNormalizationGap(expected, actual, requiredProps) {
       const parsed = raw === "" ? {} : JSON.parse(raw);
       if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return void 0;
       return canonicalJson({
-        ...normalizeToolCallJson(item),
-        arguments: canonicalJson(sanitizeToolInput(parsed, required))
+        ...normalizeToolCallJson(item, defaults),
+        arguments: canonicalJson(stripSchemaDefaults(item.name, sanitizeToolInput(parsed, required), defaults))
       });
     } catch {
       return void 0;
@@ -9007,7 +9224,7 @@ function warnToolArgumentNormalizationGap(gap, log12) {
     emitParentNotice("clodex: warning: further tool-argument normalization warnings suppressed.");
   }
 }
-function continuationMismatchDetails(entry, payload, log12, warnOnGap = false, deferWarnings) {
+function continuationMismatchDetails(entry, payload, defaults, log12, warnOnGap = false, deferWarnings) {
   const raise = (warn) => {
     if (deferWarnings) deferWarnings.push(warn);
     else warn();
@@ -9017,14 +9234,14 @@ function continuationMismatchDetails(entry, payload, log12, warnOnGap = false, d
   const comparable = Math.min(full.length, prefix.length);
   let mismatch = comparable;
   for (let index = 0; index < comparable; index += 1) {
-    if (!arraysEqual([full[index]], [prefix[index]])) {
+    if (!arraysEqual([full[index]], [prefix[index]], defaults)) {
       mismatch = index;
       break;
     }
   }
   const expected = mismatch < prefix.length ? prefix[mismatch] : void 0;
   const actual = mismatch < full.length ? full[mismatch] : void 0;
-  const reasoningGap = reasoningNormalizationGap(expected, actual);
+  const reasoningGap = reasoningNormalizationGap(expected, actual, defaults);
   if (reasoningGap && warnOnGap) raise(() => warnReasoningNormalizationGap(reasoningGap, log12));
   let gapExpected = expected;
   if (conversationItemKind(expected) === "reasoning" && conversationItemKind(actual) === "function_call") {
@@ -9040,6 +9257,7 @@ function continuationMismatchDetails(entry, payload, log12, warnOnGap = false, d
     toolArgumentGap = toolArgumentNormalizationGap(
       gapExpected,
       actual,
+      defaults,
       // The head's own schema when it has one; the current turn's tools are only a
       // fallback for a head that predates the snapshot (see headRequiredToolProps).
       () => entry.headRequiredToolProps ?? requiredToolProps(payload)
@@ -9061,8 +9279,8 @@ function continuationMismatchDetails(entry, payload, log12, warnOnGap = false, d
     firstMismatch: mismatch,
     expectedKind: expected === void 0 ? "none" : conversationItemKind(expected),
     actualKind: actual === void 0 ? "none" : conversationItemKind(actual),
-    ...expected !== void 0 ? { expectedHash: conversationItemHash(expected) } : {},
-    ...actual !== void 0 ? { actualHash: conversationItemHash(actual) } : {},
+    ...expected !== void 0 ? { expectedHash: conversationItemHash(expected, defaults) } : {},
+    ...actual !== void 0 ? { actualHash: conversationItemHash(actual, defaults) } : {},
     ...reasoningGap ? {
       reasoningNormalizationGap: reasoningGap,
       reasoningGapShape: reasoningGapShape(
@@ -9076,8 +9294,8 @@ function continuationMismatchDetails(entry, payload, log12, warnOnGap = false, d
     ...toolArgumentGap ? { toolArgumentNormalizationGap: toolArgumentGap } : {}
   };
 }
-function continuationMismatchSummary(entry, payload, log12, mismatchDump = false, precomputedDetails) {
-  const details = precomputedDetails ?? continuationMismatchDetails(entry, payload, log12, true);
+function continuationMismatchSummary(entry, payload, defaults, log12, mismatchDump = false, precomputedDetails) {
+  const details = precomputedDetails ?? continuationMismatchDetails(entry, payload, defaults, log12, true);
   let summary = `full_items=${details.fullItems} expected_prefix_items=${details.expectedPrefixItems} first_mismatch=${details.firstMismatch} expected=${details.expectedKind} actual=${details.actualKind}`;
   if (details.expectedHash || details.actualHash) {
     summary += ` expected_hash=${details.expectedHash ?? "none"} actual_hash=${details.actualHash ?? "none"}`;
@@ -9085,21 +9303,21 @@ function continuationMismatchSummary(entry, payload, log12, mismatchDump = false
       const full = inputArray(payload);
       const prefix = [...entry.requestInput ?? [], ...entry.expectedAssistant ?? []];
       const index = details.firstMismatch;
-      log12(`mismatch dump expected[${index}]: ${mismatchDumpLine(prefix, index)}`);
-      log12(`mismatch dump actual[${index}]: ${mismatchDumpLine(full, index)}`);
+      log12(`mismatch dump expected[${index}]: ${mismatchDumpLine(prefix, index, defaults)}`);
+      log12(`mismatch dump actual[${index}]: ${mismatchDumpLine(full, index, defaults)}`);
     }
   }
   return summary;
 }
-function mismatchDumpLine(items, index) {
+function mismatchDumpLine(items, index, defaults) {
   if (index >= items.length) return "(absent)";
-  const line = canonicalJson(normalizeToolCallJson(items[index]));
+  const line = canonicalJson(normalizeToolCallJson(items[index], defaults));
   const max = 2e3;
   const marker = " [truncated]";
   return line.length <= max ? line : line.slice(0, max - marker.length) + marker;
 }
-function canonicalItemStrings(items) {
-  return items.map((item) => canonicalJson(normalizeToolCallJson([item])));
+function canonicalItemStrings(items, defaults) {
+  return items.map((item) => canonicalJson(normalizeToolCallJson([item], defaults)));
 }
 function isPrefixOrEqual(head, client) {
   if (client.length < head.length) return false;
@@ -9111,16 +9329,24 @@ function isPrefixOrEqual(head, client) {
 function isStrictPrefix(head, client) {
   return client.length > head.length && isPrefixOrEqual(head, client);
 }
-function continuationMatch(entry, payload, clientItems) {
+function continuationMatch(entry, payload, clientItems, defaults, defaultsId) {
   if (!entry.responseId || !entry.requestInput || !entry.expectedAssistant) return void 0;
   const full = inputArray(payload);
-  entry.canonicalPrefix ??= canonicalItemStrings([...entry.requestInput, ...entry.expectedAssistant]);
+  if (entry.canonicalToolDefaultsId !== defaultsId) {
+    entry.canonicalPrefix = void 0;
+    entry.canonicalEchoablePrefix = void 0;
+    entry.canonicalToolDefaultsId = defaultsId;
+  }
+  entry.canonicalPrefix ??= canonicalItemStrings(
+    [...entry.requestInput, ...entry.expectedAssistant],
+    defaults
+  );
   if (isStrictPrefix(entry.canonicalPrefix, clientItems)) {
     return { delta: full.slice(entry.canonicalPrefix.length), mode: "exact" };
   }
   const echoedAssistant = entry.expectedAssistant.filter((item) => conversationItemKind(item) !== "reasoning");
   if (echoedAssistant.length === entry.expectedAssistant.length) return void 0;
-  entry.canonicalEchoablePrefix ??= canonicalItemStrings([...entry.requestInput, ...echoedAssistant]);
+  entry.canonicalEchoablePrefix ??= canonicalItemStrings([...entry.requestInput, ...echoedAssistant], defaults);
   if (!isStrictPrefix(entry.canonicalEchoablePrefix, clientItems)) return void 0;
   return { delta: full.slice(entry.canonicalEchoablePrefix.length), mode: "omitted_reasoning" };
 }
@@ -10029,13 +10255,15 @@ function createResponsesWebSocketFetch(wsUrl, log12, options = {}) {
       authorizationFingerprint,
       claudeAgentId
     );
+    const requestToolDefaults = toolSchemaDefaults(payload);
+    const requestToolDefaultsId = toolSchemaDefaultsFingerprint(requestToolDefaults);
     const promptFingerprint = responsesWebSocketPromptFingerprint(payload);
     const promptFieldHashes = responsesWebSocketPromptFieldHashes(payload);
     const instructionsSnapshot = instructionsFromPayload(payload);
     let now = resolvedOptions.now();
     const evictions = cleanupExpiredConnections(now);
     let canonicalClientItems;
-    const clientItems = () => canonicalClientItems ??= canonicalItemStrings(inputArray(payload));
+    const clientItems = () => canonicalClientItems ??= canonicalItemStrings(inputArray(payload), requestToolDefaults);
     const scanForHeads = () => {
       const scanned = partitionKey ? connectionEntries(partitionKey) : [];
       const idle = scanned.filter((entry) => !entry.inFlight);
@@ -10043,16 +10271,32 @@ function createResponsesWebSocketFetch(wsUrl, log12, options = {}) {
       return {
         candidates: scanned,
         idleCandidates: idle,
-        matches: idle.map((entry) => ({ entry, match: continuationMatch(entry, payload, canonical) })).filter((candidate) => candidate.match !== void 0).sort((left, right) => left.match.delta.length - right.match.delta.length || (left.match.mode === right.match.mode ? 0 : left.match.mode === "exact" ? -1 : 1))
+        matches: idle.map((entry) => ({
+          entry,
+          match: continuationMatch(entry, payload, canonical, requestToolDefaults, requestToolDefaultsId)
+        })).filter((candidate) => candidate.match !== void 0).sort((left, right) => left.match.delta.length - right.match.delta.length || (left.match.mode === right.match.mode ? 0 : left.match.mode === "exact" ? -1 : 1))
       };
     };
     const couldPrecedeThisRequest = (entry) => {
       if (entry.responseId && entry.requestInput && entry.expectedAssistant) {
-        return continuationMatch(entry, payload, clientItems()) !== void 0;
+        return continuationMatch(
+          entry,
+          payload,
+          clientItems(),
+          requestToolDefaults,
+          requestToolDefaultsId
+        ) !== void 0;
       }
       const streaming = entry.current;
       if (!streaming) return true;
-      streaming.canonicalInput ??= canonicalItemStrings(inputArray(streaming.originalPayload));
+      if (streaming.canonicalInputToolDefaultsId !== requestToolDefaultsId) {
+        streaming.canonicalInput = void 0;
+        streaming.canonicalInputToolDefaultsId = requestToolDefaultsId;
+      }
+      streaming.canonicalInput ??= canonicalItemStrings(
+        inputArray(streaming.originalPayload),
+        requestToolDefaults
+      );
       return isPrefixOrEqual(streaming.canonicalInput, clientItems());
     };
     const blockingHead = (entries) => entries.find((entry) => entry.inFlight && couldPrecedeThisRequest(entry));
@@ -10110,6 +10354,7 @@ function createResponsesWebSocketFetch(wsUrl, log12, options = {}) {
       const diagnosticMismatch = continuationMismatchDetails(
         diagnosticEntry,
         payload,
+        requestToolDefaults,
         debug,
         true,
         deferredMismatchWarnings
@@ -10119,13 +10364,21 @@ function createResponsesWebSocketFetch(wsUrl, log12, options = {}) {
         if (candidate === diagnosticEntry) continue;
         candidateMismatchDetails.set(
           candidate,
-          continuationMismatchDetails(candidate, payload, debug, true, deferredMismatchWarnings)
+          continuationMismatchDetails(
+            candidate,
+            payload,
+            requestToolDefaults,
+            debug,
+            true,
+            deferredMismatchWarnings
+          )
         );
       }
       debug(
         `history mismatch starting an additional chain; retained ${candidates.length} existing head(s) (${continuationMismatchSummary(
           diagnosticEntry,
           payload,
+          requestToolDefaults,
           debug,
           mismatchDump,
           diagnosticMismatch
@@ -10249,7 +10502,7 @@ function createResponsesWebSocketFetch(wsUrl, log12, options = {}) {
       input: {
         count: requestInput.length,
         kinds: requestInput.map(conversationItemKind),
-        hashes: requestInput.map(conversationItemHash)
+        hashes: requestInput.map((item) => conversationItemHash(item, requestToolDefaults))
       },
       candidateCount: candidates.length,
       idleCandidateCount: idleCandidates.length,
@@ -10282,7 +10535,7 @@ function createResponsesWebSocketFetch(wsUrl, log12, options = {}) {
         ttlPausedMs: entry.ttlPausedMs,
         idleMs: Math.max(0, now - entry.lastUsedAt),
         promptChanges: changedPromptFields(entry.promptFieldHashes, promptFieldHashes),
-        mismatch: candidateMismatchDetails?.get(entry) ?? continuationMismatchDetails(entry, payload, debug)
+        mismatch: candidateMismatchDetails?.get(entry) ?? continuationMismatchDetails(entry, payload, requestToolDefaults, debug)
       })),
       evictions
     }, diagnosticCorrelation);
@@ -10362,7 +10615,7 @@ function createResponsesWebSocketFetch(wsUrl, log12, options = {}) {
 }
 
 // src/oauth/claude-identity.ts
-import { createHash as createHash7, randomUUID as randomUUID2 } from "crypto";
+import { createHash as createHash7, randomUUID as randomUUID3 } from "crypto";
 var CLAUDE_CODE_CLI_VERSION = "2.1.195";
 var CLAUDE_CODE_USER_AGENT = `claude-cli/${CLAUDE_CODE_CLI_VERSION} (external, cli)`;
 var CLAUDE_CODE_ENTRYPOINT = process.env.CLAUDE_CODE_ENTRYPOINT ?? "cli";
@@ -10371,7 +10624,7 @@ var sessionCache = /* @__PURE__ */ new Map();
 function getOrCreateSessionId(seed) {
   let id = sessionCache.get(seed);
   if (!id) {
-    id = randomUUID2();
+    id = randomUUID3();
     sessionCache.set(seed, id);
   }
   return id;
@@ -11719,7 +11972,7 @@ async function relayAnthropicMessages(res, messagesUrl, body, apiKey, clientWant
 }
 
 // src/proxy.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 
 // src/sdk-adapter.ts
 import { createHash as createHash8 } from "crypto";
@@ -13145,7 +13398,7 @@ function configuredAliasLookupNames(alias) {
   }))].map(normalizeRouteLookupId);
 }
 async function startProxyCatalog(routes, defaultAliasId, debug = false, inferenceLogPath, debugLogPath, webSocketDiagnosticsLogPath, modelAliases) {
-  const proxyToken = randomUUID3();
+  const proxyToken = randomUUID4();
   silenceSdkWarnings();
   if (routes.length === 0) {
     throw new Error("Proxy catalog requires at least one route");
@@ -13309,6 +13562,14 @@ async function startProxyCatalog(routes, defaultAliasId, debug = false, inferenc
         const isOAuth = routeAuthType === "oauth";
         let effectiveBeta = inboundBeta;
         let claudeCodeSessionId;
+        const inboundSessionRaw = req.headers["x-claude-code-session-id"];
+        const goSessionHeaders = openCodeGoSessionHeaders(
+          { providerId: route.providerId, baseUrl: upstreamUrl },
+          extractClaudeSessionId(
+            anthropicBody,
+            Array.isArray(inboundSessionRaw) ? inboundSessionRaw[0] : inboundSessionRaw
+          )
+        );
         if (isOAuth) {
           const seed = route.providerId ?? route.realModelId;
           const identity = injectClaudeIdentity(forwardBody, route.providerData, seed);
@@ -13326,7 +13587,7 @@ async function startProxyCatalog(routes, defaultAliasId, debug = false, inferenc
             authType: routeAuthType,
             log: (message) => plog(message),
             claudeCodeSessionId,
-            extraHeaders: route.headers,
+            extraHeaders: { ...route.headers, ...goSessionHeaders },
             refreshToken: route.refreshToken,
             onTokenRefreshed: (refreshed) => {
               route.apiKey = refreshed;
@@ -13386,6 +13647,11 @@ async function startProxyCatalog(routes, defaultAliasId, debug = false, inferenc
               upstreamModelId: route.realModelId
             }
           });
+          const goSdkSessionHeaders = openCodeGoSessionHeaders(
+            { providerId: route.providerId, baseUrl: route.baseURL },
+            claudeSessionId
+          );
+          if (goSdkSessionHeaders) params.headers = { ...params.headers, ...goSdkSessionHeaders };
           plog(
             () => `sdk: npm=${route.npm} model=${route.realModelId}, stream=${clientWantsStream}, tools=${anthropicBody.tools?.length ?? 0}, msgs=${params.messages.length}`
           );
@@ -13545,7 +13811,7 @@ async function startProxyCatalog(routes, defaultAliasId, debug = false, inferenc
               res,
               upstreamStatus === 500 ? 502 : upstreamStatus,
               clientMessage,
-              contextLengthExceeded ? relayRequestId ?? randomUUID3() : void 0
+              contextLengthExceeded ? relayRequestId ?? randomUUID4() : void 0
             );
           } else {
             const errorType = anthropicErrorType(upstreamStatus, details?.transportCode);
@@ -13553,7 +13819,7 @@ async function startProxyCatalog(routes, defaultAliasId, debug = false, inferenc
 data: ${JSON.stringify({
               type: "error",
               error: { type: errorType, message: clientMessage },
-              ...contextLengthExceeded ? { request_id: relayRequestId ?? randomUUID3() } : {}
+              ...contextLengthExceeded ? { request_id: relayRequestId ?? randomUUID4() } : {}
             })}
 
 `);
@@ -13800,7 +14066,7 @@ function readPatchManifest(path = getPatchManifestPath()) {
 }
 function writePatchManifest(manifest, path = getPatchManifestPath()) {
   mkdirSync5(getAppHome(), { recursive: true, mode: 448 });
-  writeFileSync5(path, `${JSON.stringify(manifest, null, 2)}
+  writeFileSync6(path, `${JSON.stringify(manifest, null, 2)}
 `, { encoding: "utf8", mode: 384 });
 }
 function buildPatchModelConfig(favorites, aliases, modelMetaFor) {
@@ -13958,7 +14224,7 @@ function tryAcquirePatchLock(lockPath = getPatchLockPath(), opts = {}) {
     try {
       const fd = openSync7(lockPath, "wx");
       const content = { pid: process.pid, startedAt: now };
-      writeFileSync5(fd, JSON.stringify(content));
+      writeFileSync6(fd, JSON.stringify(content));
       closeSync7(fd);
       return () => {
         try {
@@ -13983,10 +14249,19 @@ function tryAcquirePatchLock(lockPath = getPatchLockPath(), opts = {}) {
   }
   return null;
 }
+var ignoredLaunchOverride = null;
+function takeIgnoredLaunchOverride() {
+  const ignored = ignoredLaunchOverride;
+  ignoredLaunchOverride = null;
+  return ignored;
+}
 function resolveClaudeBinaryForPatch() {
-  const envOverride = process.env["TWEAKCC_CC_INSTALLATION_PATH"];
+  const envOverride = process.env["TWEAKCC_CC_INSTALLATION_PATH"]?.trim() || null;
   const nativeSymlink = join8(homedir3(), ".local", "bin", "claude");
-  const source = envOverride?.trim() || (existsSync5(nativeSymlink) ? nativeSymlink : null) || findClaudeBinary();
+  if (envOverride && !existsSync5(envOverride)) {
+    return { ok: false, reason: "patch-target-missing", declaredPath: envOverride };
+  }
+  const source = envOverride || (existsSync5(nativeSymlink) ? nativeSymlink : null) || findClaudeBinary();
   if (!source) return { ok: false, reason: "binary-not-found" };
   let resolved;
   try {
@@ -14006,6 +14281,17 @@ function resolveClaudeBinaryForPatch() {
     };
   }
   resolved = followed.path;
+  const launchOverride = process.env["CLODEX_CLAUDE_PATH"]?.trim() || null;
+  let launchOverrideResolved = null;
+  if (launchOverride) {
+    try {
+      const followedOverride = resolveThroughNpmShims(realpathSync2(launchOverride));
+      launchOverrideResolved = followedOverride.ok ? followedOverride.path : realpathSync2(launchOverride);
+    } catch {
+      launchOverrideResolved = launchOverride;
+    }
+  }
+  ignoredLaunchOverride = launchOverrideResolved && launchOverrideResolved !== resolved ? { used: resolved, ignored: launchOverride } : null;
   try {
     if (!statSync8(resolved).isFile()) return { ok: false, reason: "binary-not-found" };
   } catch {
@@ -14029,7 +14315,7 @@ function installScriptCommand(path) {
 }
 function describePatchTargetFailure(target, command = "patch") {
   if (target.reason === "launcher-unresolved") {
-    return `${target.shimPath} starts Claude Code but is not Claude Code itself, and clodex could not follow it: ${target.detail}. clodex will not patch a launcher script \u2014 that fails with "Unable to detect installation type". Set CLODEX_CLAUDE_PATH to the Claude Code program itself (for an npm install on Windows that is node_modules\\@anthropic-ai\\claude-code\\bin\\claude.exe under the directory holding the launcher), then run the command again.`;
+    return `${target.shimPath} starts Claude Code but is not Claude Code itself, and clodex could not follow it: ${target.detail}. clodex will not patch a launcher script \u2014 that fails with "Unable to detect installation type". Set TWEAKCC_CC_INSTALLATION_PATH to the Claude Code program itself (for an npm install on Windows that is node_modules\\@anthropic-ai\\claude-code\\bin\\claude.exe under the directory holding the launcher), then run the command again.`;
   }
   if (target.reason === "native-binary-missing") {
     const installer = installScriptCommand(target.installScriptPath);
@@ -14038,6 +14324,9 @@ function describePatchTargetFailure(target, command = "patch") {
     const restore = command === "restore" ? ` If you need to restore by hand, pristine backups are in ${backupDir()}.` : "";
     return `${target.binaryPath} is Claude Code's npm placeholder, not its native binary, so the npm install is incomplete. ${remedy} ${retry}${restore} If this is a custom wrapper rather than the npm placeholder, set TWEAKCC_CC_INSTALLATION_PATH to the native Claude Code binary.`;
   }
+  if (target.reason === "patch-target-missing") {
+    return `TWEAKCC_CC_INSTALLATION_PATH is set to ${target.declaredPath}, which does not exist. clodex will not look for another Claude Code instead \u2014 patching or restoring a different install than the one you named is how one install's pristine bytes end up over another's. Point it at the Claude Code program, or unset it to let clodex find your install.`;
+  }
   return target.reason === "binary-not-found" ? "claude binary not found. Install Claude Code or set TWEAKCC_CC_INSTALLATION_PATH." : `Could not determine the version of ${target.binaryPath} (\`claude --version\` failed). clodex will not patch a binary whose version it cannot read, because the version selects the pristine backup it patches from. If a previous patch left the install broken, \`clodex patch --restore\` still works \u2014 it reads the version from the patch manifest.`;
 }
 function summarizePatchResults(results) {
@@ -14060,14 +14349,15 @@ function verifyPristineSource(plan, version) {
     message: `Refusing to use ${plan.backupPath} as the pristine source for claude ${version}: it reports ${backupVersion ? `version ${backupVersion}` : "no version at all"}. That backup predates content-addressed backup names and does not hold this version's bytes. Remove it (or reinstall Claude Code), then run \`clodex patch\`.`
   };
 }
-function publishBackupFile(from, to) {
+function publishFileByRename(from, to, mode) {
   const temp = `${to}.tmp-${process.pid}-${Date.now().toString(36)}`;
   try {
     copyFileSync(from, temp);
-    renameSync2(temp, to);
+    if (mode !== void 0) chmodSync4(temp, mode);
+    renameSync3(temp, to);
   } catch (err) {
     try {
-      rmSync(temp, { force: true });
+      rmSync2(temp, { force: true });
     } catch {
     }
     throw err;
@@ -14131,6 +14421,7 @@ async function applyPatch(binaryPath, version, desired, configHash, opts) {
   let patchedSha256;
   let backup;
   let pristineSha256;
+  const pristine = { provenance: "established" };
   try {
     mkdirSync5(backupDir(), { recursive: true });
     const { tryDetectInstallation, readContent, writeContent } = await import("tweakcc");
@@ -14179,6 +14470,18 @@ async function applyPatch(binaryPath, version, desired, configHash, opts) {
     }
     pristineSha256 = plan.pristineSha256;
     backup = plan.backupPath;
+    const inheritsAGuess = (path) => {
+      const existing = readInstallProvenance(installProvenancePath(path, binaryPath));
+      return existing === "damaged" || existing !== null && existing.assumed;
+    };
+    const provenanceAssumed = plan.action === "restore" && plan.assumedForThisInstall || inheritsAGuess(plan.backupPath) || inheritsAGuess(contentAddressedBackupPath(version, plan.pristineSha256)) || inheritsAGuess(legacyBackupPath(version)) || facts.backups.some(
+      (candidate) => candidate.sha256 === plan.pristineSha256 && candidate.assumedInstalls.includes(binaryPath)
+    );
+    const recordProvenance = (path) => {
+      if (recordBackupProvenance(path, binaryPath, { assumed: provenanceAssumed }) === "assumed") {
+        pristine.provenance = "assumed";
+      }
+    };
     if (!loaded) {
       loaded = await seedCandidate(backup);
       if (isPatchedClaudeSource(loaded.source)) {
@@ -14190,17 +14493,22 @@ async function applyPatch(binaryPath, version, desired, configHash, opts) {
           `the patch candidate no longer matches the pristine bytes it was seeded from; refusing to publish it as ${plan.backupPath}`
         );
       }
-      publishBackupFile(candidatePath, plan.backupPath);
+      recordProvenance(plan.backupPath);
+      publishFileByRename(candidatePath, plan.backupPath);
     }
     const canonical = contentAddressedBackupPath(version, pristineSha256);
     if (canonical !== backup) {
+      recordProvenance(backup);
+      recordProvenance(canonical);
       const alreadyStored = facts.backups.some(
         (candidate) => candidate.path === canonical && candidate.sha256 === pristineSha256
       );
-      if (!alreadyStored) publishBackupFile(backup, canonical);
+      if (!alreadyStored) publishFileByRename(backup, canonical);
       backup = canonical;
     }
-    publishBackupFile(backup, tweakccMirrorBackupPath());
+    publishFileByRename(backup, tweakccMirrorBackupPath());
+    recordProvenance(backup);
+    if (plan.backupPath !== backup) recordProvenance(plan.backupPath);
     const builtIn = applyClodexPatches(loaded.source, desired.config);
     results = builtIn.results;
     const failedEffortPatches = requiredEffortPatchFailures(results);
@@ -14267,7 +14575,7 @@ async function applyPatch(binaryPath, version, desired, configHash, opts) {
     else if (publishedBlob) resignMachOBinary(candidatePath);
     patchedSize = statSync8(candidatePath).size;
     patchedSha256 = sha256File(candidatePath);
-    renameSync2(candidatePath, binaryPath);
+    renameSync3(candidatePath, binaryPath);
   } catch (err) {
     const detailLines = err instanceof PatchApplyError ? summarizePatchResults(err.results) : [];
     if (opts.trace && detailLines.length) {
@@ -14282,7 +14590,7 @@ async function applyPatch(binaryPath, version, desired, configHash, opts) {
   } finally {
     if (candidateDir !== void 0) {
       try {
-        rmSync(candidateDir, { recursive: true, force: true });
+        rmSync2(candidateDir, { recursive: true, force: true });
       } catch (err) {
         if (opts.trace) {
           process.stderr.write(
@@ -14305,6 +14613,7 @@ async function applyPatch(binaryPath, version, desired, configHash, opts) {
     patchedSha256,
     backupPath: backup,
     pristineSha256,
+    ...pristine.provenance === "assumed" ? { pristineProvenance: "assumed" } : {},
     patchedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
   writePatchManifest(manifest);
@@ -14318,7 +14627,7 @@ async function applyPatch(binaryPath, version, desired, configHash, opts) {
   };
 }
 function runRestoreCommand(target) {
-  if (!target.ok && (target.reason === "binary-not-found" || target.reason === "native-binary-missing")) {
+  if (!target.ok && (target.reason === "binary-not-found" || target.reason === "patch-target-missing" || target.reason === "native-binary-missing")) {
     p2.log.error(describePatchTargetFailure(target, "restore"));
     return 1;
   }
@@ -14353,16 +14662,65 @@ function runRestoreCommand(target) {
     p2.log.error(verified.message);
     return 1;
   }
-  copyFileSync(plan.backupPath, binaryPath);
+  if (manifest && manifest.backupPath && manifest.binaryPath === binaryPath && manifest.claudeVersion !== version && manifest.backupPath !== plan.backupPath) {
+    try {
+      if (existsSync5(manifest.backupPath)) {
+        recordBackupProvenance(manifest.backupPath, manifest.binaryPath, {
+          assumed: manifest.pristineProvenance === "assumed"
+        });
+      }
+    } catch (err) {
+      p2.log.warn(
+        `Could not record in ${backupDir()} that ${manifest.backupPath} holds the pristine bytes of claude ${manifest.claudeVersion} at ${manifest.binaryPath} (${err instanceof Error ? err.message : String(err)}). That version may need to be reinstalled rather than restored.`
+      );
+    }
+  }
+  let recorded;
   try {
-    unlinkSync3(getPatchManifestPath());
+    recorded = recordBackupProvenance(plan.backupPath, binaryPath, { assumed: plan.assumedForThisInstall });
+  } catch (err) {
+    recorded = "failed";
+    const detail = err instanceof Error ? err.message : String(err);
+    if (plan.assumedForThisInstall) {
+      p2.log.error(
+        `Refusing to restore ${binaryPath} from ${plan.backupPath}: nothing but the claude ${version} version tag ties those bytes to this install, and clodex cannot record that in ${backupDir()} (${detail}). Writing them without that record would leave the machine unable to tell afterwards that the match was a guess. Fix the backup directory, or reinstall Claude Code to make this install pristine.`
+      );
+      return 1;
+    }
+    p2.log.warn(
+      `Could not record in ${backupDir()} that ${plan.backupPath} holds the pristine bytes of ${binaryPath} (${detail}). Restoring anyway and keeping the patch manifest, so that record is not lost \u2014 a later restore would otherwise have nothing tying that backup to this install.`
+    );
+  }
+  let publishedMode;
+  try {
+    publishedMode = statSync8(binaryPath).mode;
   } catch {
   }
+  try {
+    publishFileByRename(plan.backupPath, binaryPath, publishedMode);
+  } catch (err) {
+    p2.log.warn(
+      `Could not replace ${binaryPath} through a new file (${err instanceof Error ? err.message : String(err)}); writing the pristine bytes in place instead. If claude then fails to start with a code-signing error, copy the backup to a new file and move it over the binary by hand.`
+    );
+    copyFileSync(plan.backupPath, binaryPath);
+  }
+  if (recorded === "established" && (!manifest || manifest.binaryPath === binaryPath)) {
+    try {
+      unlinkSync3(getPatchManifestPath());
+    } catch {
+    }
+  }
   p2.log.success(`Restored pristine claude ${version} from ${plan.backupPath}.`);
   return 0;
 }
 async function runPatchCommand(opts = {}) {
   const target = resolveClaudeBinaryForPatch();
+  const ignoredOverride = takeIgnoredLaunchOverride();
+  if (ignoredOverride) {
+    p2.log.warn(
+      `CLODEX_CLAUDE_PATH is set to ${ignoredOverride.ignored}, but it does not choose what gets patched \u2014 ${ignoredOverride.used} does. CLODEX_CLAUDE_PATH selects the claude that gets LAUNCHED; set TWEAKCC_CC_INSTALLATION_PATH to patch a specific install.`
+    );
+  }
   if (opts.restore) return runRestoreCommand(target);
   if (!target.ok) {
     p2.log.error(describePatchTargetFailure(target));
@@ -14405,6 +14763,19 @@ async function runPatchCommand(opts = {}) {
     p2.log.warn("Another clodex process is patching the claude binary right now \u2014 skipped.");
     return 1;
   }
+  if (manifest && manifest.backupPath && (manifest.binaryPath !== binaryPath || manifest.claudeVersion !== version)) {
+    try {
+      if (existsSync5(manifest.backupPath)) {
+        recordBackupProvenance(manifest.backupPath, manifest.binaryPath, {
+          assumed: manifest.pristineProvenance === "assumed"
+        });
+      }
+    } catch (err) {
+      p2.log.warn(
+        `Could not record in ${backupDir()} that ${manifest.backupPath} holds the pristine bytes of ${manifest.binaryPath} before replacing the patch manifest (${err instanceof Error ? err.message : String(err)}). That install may need to be reinstalled rather than restored.`
+      );
+    }
+  }
   try {
     const outcome = await applyPatch(binaryPath, version, desired, configHash, {
       trace: opts.trace ?? false,
@@ -14784,7 +15155,7 @@ function localProvidersToServerModels(localProviders) {
 }
 
 // src/registry/credential-cleanup-journal.ts
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 import {
   closeSync as closeSync8,
   existsSync as existsSync6,
@@ -14794,9 +15165,9 @@ import {
   mkdirSync as mkdirSync6,
   openSync as openSync8,
   readFileSync as readFileSync11,
-  renameSync as renameSync3,
+  renameSync as renameSync4,
   unlinkSync as unlinkSync4,
-  writeFileSync as writeFileSync6
+  writeFileSync as writeFileSync7
 } from "fs";
 import { dirname as dirname6 } from "path";
 var JOURNAL_SCHEMA_VERSION = 1;
@@ -14924,17 +15295,17 @@ function writeJournalUnlocked(journal, path) {
   assertRegistryWriteOwnership(path);
   ensureSecureAppHome();
   mkdirSync6(dirname6(path), { recursive: true, mode: DIR_MODE2 });
-  const tmp = `${path}.${process.pid}.${randomUUID4()}.tmp`;
+  const tmp = `${path}.${process.pid}.${randomUUID5()}.tmp`;
   let fd;
   try {
     fd = openSync8(tmp, "wx", FILE_MODE4);
-    writeFileSync6(fd, `${JSON.stringify(journal, null, 2)}
+    writeFileSync7(fd, `${JSON.stringify(journal, null, 2)}
 `);
     fsyncSync2(fd);
     closeSync8(fd);
     fd = void 0;
     assertRegistryWriteOwnership(path);
-    renameSync3(tmp, path);
+    renameSync4(tmp, path);
     syncParentDirectory(path);
   } finally {
     if (fd !== void 0) closeSync8(fd);
@@ -17817,7 +18188,7 @@ async function askSaveServerPassword() {
 
 // src/server/router.ts
 import { createServer as createServer2 } from "http";
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 
 // src/openai-adapter.ts
 import { tool as tool2, jsonSchema as jsonSchema2, streamText as streamText2, generateText as generateText2 } from "ai";
@@ -18233,7 +18604,7 @@ async function handleAnthropicMessages(req, res, options, modelCache, plog) {
     plog(`model not found: ${body.model}`);
     return;
   }
-  const requestId = randomUUID5();
+  const requestId = randomUUID6();
   const claudeSessionIdHeader = Array.isArray(req.headers["x-claude-code-session-id"]) ? req.headers["x-claude-code-session-id"][0] : req.headers["x-claude-code-session-id"];
   const claudeSessionId = extractClaudeSessionId(body, claudeSessionIdHeader);
   const claudeAgentIds = extractClaudeAgentIds(req.headers);
@@ -18273,6 +18644,7 @@ async function handleAnthropicMessages(req, res, options, modelCache, plog) {
     const forwardBody = { ...body, model: upstreamModelId(model) };
     const authType = model.authType ?? "api";
     const isOAuth = authType === "oauth";
+    const goSessionHeaders = openCodeGoSessionHeaders(model, claudeSessionId);
     auditInference(options, {
       requestId,
       modelId: body.model,
@@ -18303,7 +18675,7 @@ async function handleAnthropicMessages(req, res, options, modelCache, plog) {
         authType,
         log: (message) => plog(message),
         claudeCodeSessionId,
-        extraHeaders: model.headers,
+        extraHeaders: { ...model.headers, ...goSessionHeaders },
         refreshToken,
         onTokenRefreshed: (refreshed) => {
           model.apiKey = refreshed;
@@ -18375,6 +18747,8 @@ async function handleAnthropicMessages(req, res, options, modelCache, plog) {
       maxTools: npmMaxTools,
       log: plog
     });
+    const goSdkSessionHeaders = openCodeGoSessionHeaders(model, claudeSessionId);
+    if (goSdkSessionHeaders) params.headers = { ...params.headers, ...goSdkSessionHeaders };
     const clientWantsStream = Boolean(body.stream);
     const responseModelId = getResponseModelId(body.model, model, options);
     plog(() => `sdk npm=${model.npm} upstream=${upstreamModelId(model)} responseModel=${responseModelId} stream=${clientWantsStream}`);
@@ -18566,6 +18940,8 @@ async function handleOpenAIChatCompletions(req, res, options, modelCache, plog)
   }
   const model = lookupModel(res, options.catalog, body.model);
   if (!model) return;
+  const openAiSessionIdHeader = Array.isArray(req.headers["x-claude-code-session-id"]) ? req.headers["x-claude-code-session-id"][0] : req.headers["x-claude-code-session-id"];
+  const goSessionHeaders = openCodeGoSessionHeaders(model, openAiSessionIdHeader);
   if (supportsDirectOpenAIChatCompletions(model)) {
     if (model.completionsUrl && !/^https?:\/\//i.test(model.completionsUrl)) {
       sendJson(res, 400, { error: { message: `Invalid provider completionsUrl: must be http:// or https://` } });
@@ -18602,7 +18978,7 @@ async function handleOpenAIChatCompletions(req, res, options, modelCache, plog)
     try {
       await relayAnthropicMessages(res, completionsUrl, forwardBody, apiKey2, Boolean(body.stream), {
         authType: model.authType ?? "api",
-        extraHeaders: model.headers,
+        extraHeaders: { ...model.headers, ...goSessionHeaders },
         refreshToken,
         onTokenRefreshed: (refreshed) => {
           model.apiKey = refreshed;
@@ -18647,6 +19023,7 @@ async function handleOpenAIChatCompletions(req, res, options, modelCache, plog)
   const baseURL = model.modelFormat === "anthropic" ? model.baseUrl : model.apiBaseUrl;
   const openAiOAuth = isOpenAiOAuthRoute(model);
   const params = translateOpenAiRequest(body, { openAiOAuth });
+  if (goSessionHeaders) params.headers = { ...params.headers, ...goSessionHeaders };
   const clientWantsStream = Boolean(body.stream);
   const responseModelId = getResponseModelId(body.model, model, options);
   plog(() => `sdk-openai npm=${npm} upstream=${upstreamModelId(model)} responseModel=${responseModelId} stream=${clientWantsStream}`);
@@ -18901,13 +19278,13 @@ import * as http2 from "http";
 import * as https from "https";
 import * as net from "net";
 import { PassThrough } from "stream";
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 import { URL as URL2 } from "url";
 import { createBrotliDecompress, createGunzip, createInflate } from "zlib";
 
 // src/http-proxy/ca.ts
 import { randomBytes as randomBytes2 } from "crypto";
-import { chmodSync as chmodSync4, existsSync as existsSync7, mkdirSync as mkdirSync7, readFileSync as readFileSync12, writeFileSync as writeFileSync7 } from "fs";
+import { chmodSync as chmodSync5, existsSync as existsSync7, mkdirSync as mkdirSync7, readFileSync as readFileSync12, writeFileSync as writeFileSync8 } from "fs";
 import { dirname as dirname7, join as join9, resolve as resolve3 } from "path";
 import forge from "node-forge";
 var CERT_DIR = "http-proxy";
@@ -18934,16 +19311,16 @@ function certPaths() {
   };
 }
 function writePrivate(path, value) {
-  writeFileSync7(path, value, { encoding: "utf8", mode: 384 });
-  chmodSync4(path, 384);
+  writeFileSync8(path, value, { encoding: "utf8", mode: 384 });
+  chmodSync5(path, 384);
 }
 function writePublic(path, value) {
-  writeFileSync7(path, value, { encoding: "utf8", mode: 420 });
-  chmodSync4(path, 420);
+  writeFileSync8(path, value, { encoding: "utf8", mode: 420 });
+  chmodSync5(path, 420);
 }
 function generateCertificates(paths) {
   mkdirSync7(paths.dir, { recursive: true, mode: 448 });
-  chmodSync4(paths.dir, 448);
+  chmodSync5(paths.dir, 448);
   const caKeys = forge.pki.rsa.generateKeyPair(2048);
   const caCert = forge.pki.createCertificate();
   caCert.publicKey = caKeys.publicKey;
@@ -19759,7 +20136,7 @@ async function startHttpProxy(options) {
     }
     const messagesEndpoint = anthropicMessagesEndpoint(req.url);
     if (req.method === "POST" && messagesEndpoint) {
-      const requestId = randomUUID6();
+      const requestId = randomUUID7();
       let parsed = null;
       let route;
       let adapterBody = rawBody;