@bman654/clodex 2.18.8 → 2.18.10

package/dist/cli.js

@@ -346,7 +346,7 @@ import { join } from "path";
 // package.json
 var package_default = {
   name: "@bman654/clodex",
-  version: "2.18.8",
+  version: "2.18.10",
   publishConfig: {
     access: "public"
   },
@@ -3439,7 +3439,7 @@ function savedStopsAfter(current, assignments) {
 }
 
 // src/patch-transforms.ts
-var PATCH_TRANSFORMS_VERSION = 14;
+var PATCH_TRANSFORMS_VERSION = 15;
 var NATIVE_EFFORT_LEVELS = ["low", "medium", "high", "xhigh", "max"];
 var BASE_EFFORT_LEVELS = ["low", "medium", "high"];
 function projectNativeEffort(effort) {
@@ -3842,14 +3842,14 @@ function applyClodexPatches(source, config) {
       }
       return -1;
     };
-    const passthroughSites = source.includes(marker) ? 1 : (source.match(/\)return process\.env;let [\w$]+=\{/g) ?? []).length;
+    const passthroughSites = source.includes(marker) ? 1 : (source.match(/\)return process\.env;let (?:(?:[^;{}]|\{[^;{}]*\})*?,)??[\w$]+=\{/g) ?? []).length;
     if (passthroughSites !== 1) {
       log13("FAIL", patchName, "child env passthrough appears " + passthroughSites + " times (expected 1)");
       fail("clodex patch: required patch failed: " + patchName);
     }
     applyOnce(
       patchName,
-      /(function [\w$]+\(\)\{)(let[ {[](?:[^;{}]|\{[^;{}]*\})*?(?:\{[^;{}]*)?(?:getAgentProxyEnv|[\w$]+\(process\.env\.CLAUDE_CODE_REMOTE\)\?)(?:(?!\}\s*function )[\s\S])*?\)return process\.env;let ([\w$]+)=\{(?:(?!\}\s*function )[\s\S])*?return \3)(\})/,
+      /(function [\w$]+\(\)\{)(let[ {[](?:[^;{}]|\{[^;{}]*\})*?(?:\{[^;{}]*)?(?:getAgentProxyEnv|[\w$]+\(process\.env\.CLAUDE_CODE_REMOTE\)\?)(?:(?!\}\s*function )[\s\S])*?\)return process\.env;let (?:(?:[^;{}]|\{[^;{}]*\})*?,)??([\w$]+)=\{(?:(?!\}\s*function )[\s\S])*?return \3)(\})/,
       (match, head, body, _copyVar, tail) => {
         const at = js.indexOf(match);
         const closingBrace = at < 0 ? -1 : blockEndIndex(js, at + head.length - 1);
@@ -19906,7 +19906,7 @@ var CA_KEY_FILE = "clodex-ca-key.pem";
 var SERVER_CERT_FILE = "api.anthropic.com.pem";
 var SERVER_KEY_FILE = "api.anthropic.com-key.pem";
 var CERT_VERSION_FILE = "version";
-var CERT_VERSION = "1\n";
+var CERT_VERSION = "2\n";
 function serialNumber() {
   const bytes = randomBytes2(16);
   bytes[0] &= 127;
@@ -19931,6 +19931,31 @@ function writePublic(path, value) {
   writeFileSync7(path, value, { encoding: "utf8", mode: 420 });
   chmodSync5(path, 420);
 }
+function generateServerCertificate(paths, caCert, caKey) {
+  const caKeyId = caCert.getExtension("subjectKeyIdentifier")?.subjectKeyIdentifier;
+  const serverKeys = forge.pki.rsa.generateKeyPair(2048);
+  const serverCert = forge.pki.createCertificate();
+  serverCert.publicKey = serverKeys.publicKey;
+  serverCert.serialNumber = serialNumber();
+  serverCert.validity.notBefore = new Date(Date.now() - 24 * 60 * 60 * 1e3);
+  serverCert.validity.notAfter = new Date(Date.now() + 825 * 24 * 60 * 60 * 1e3);
+  serverCert.setSubject([{ name: "commonName", value: "api.anthropic.com" }]);
+  serverCert.setIssuer(caCert.subject.attributes);
+  serverCert.setExtensions([
+    { name: "basicConstraints", cA: false, critical: true },
+    { name: "keyUsage", digitalSignature: true, keyEncipherment: true, critical: true },
+    { name: "extKeyUsage", serverAuth: true },
+    { name: "subjectAltName", altNames: [{ type: 2, value: "api.anthropic.com" }] },
+    { name: "subjectKeyIdentifier" },
+    {
+      name: "authorityKeyIdentifier",
+      keyIdentifier: caKeyId ? forge.util.hexToBytes(caKeyId) : caCert.generateSubjectKeyIdentifier().getBytes()
+    }
+  ]);
+  serverCert.sign(caKey, forge.md.sha256.create());
+  writePrivate(paths.serverKey, forge.pki.privateKeyToPem(serverKeys.privateKey));
+  writePublic(paths.serverCert, forge.pki.certificateToPem(serverCert));
+}
 function generateCertificates(paths) {
   mkdirSync7(paths.dir, { recursive: true, mode: 448 });
   chmodSync5(paths.dir, 448);
@@ -19949,35 +19974,37 @@ function generateCertificates(paths) {
     { name: "subjectKeyIdentifier" }
   ]);
   caCert.sign(caKeys.privateKey, forge.md.sha256.create());
-  const serverKeys = forge.pki.rsa.generateKeyPair(2048);
-  const serverCert = forge.pki.createCertificate();
-  serverCert.publicKey = serverKeys.publicKey;
-  serverCert.serialNumber = serialNumber();
-  serverCert.validity.notBefore = new Date(Date.now() - 24 * 60 * 60 * 1e3);
-  serverCert.validity.notAfter = new Date(Date.now() + 825 * 24 * 60 * 60 * 1e3);
-  serverCert.setSubject([{ name: "commonName", value: "api.anthropic.com" }]);
-  serverCert.setIssuer(caCert.subject.attributes);
-  serverCert.setExtensions([
-    { name: "basicConstraints", cA: false, critical: true },
-    { name: "keyUsage", digitalSignature: true, keyEncipherment: true, critical: true },
-    { name: "extKeyUsage", serverAuth: true },
-    { name: "subjectAltName", altNames: [{ type: 2, value: "api.anthropic.com" }] },
-    { name: "subjectKeyIdentifier" }
-  ]);
-  serverCert.sign(caKeys.privateKey, forge.md.sha256.create());
   writePrivate(paths.caKey, forge.pki.privateKeyToPem(caKeys.privateKey));
   writePublic(paths.caCert, forge.pki.certificateToPem(caCert));
-  writePrivate(paths.serverKey, forge.pki.privateKeyToPem(serverKeys.privateKey));
-  writePublic(paths.serverCert, forge.pki.certificateToPem(serverCert));
+  generateServerCertificate(paths, caCert, caKeys.privateKey);
   writePublic(paths.version, CERT_VERSION);
 }
+var RENEWAL_BUFFER_MS = 7 * 24 * 60 * 60 * 1e3;
+function staysValid(cert, now) {
+  return cert.validity.notBefore.getTime() <= now && cert.validity.notAfter.getTime() > now + RENEWAL_BUFFER_MS;
+}
+function keyMatchesCertificate(cert, key) {
+  return cert.publicKey.n.compareTo(key.n) === 0;
+}
+function loadCurrentCa(paths) {
+  try {
+    const caCert = forge.pki.certificateFromPem(readFileSync12(paths.caCert, "utf8"));
+    const caKey = forge.pki.privateKeyFromPem(readFileSync12(paths.caKey, "utf8"));
+    if (!staysValid(caCert, Date.now())) return null;
+    if (!caCert.verify(caCert)) return null;
+    if (!keyMatchesCertificate(caCert, caKey)) return null;
+    return { caCert, caKey };
+  } catch {
+    return null;
+  }
+}
 function storedCertificatesAreCurrent(paths) {
   try {
     const ca = forge.pki.certificateFromPem(readFileSync12(paths.caCert, "utf8"));
     const server = forge.pki.certificateFromPem(readFileSync12(paths.serverCert, "utf8"));
+    const serverKey = forge.pki.privateKeyFromPem(readFileSync12(paths.serverKey, "utf8"));
     const now = Date.now();
-    const renewalBuffer = 7 * 24 * 60 * 60 * 1e3;
-    return ca.validity.notBefore.getTime() <= now && ca.validity.notAfter.getTime() > now + renewalBuffer && server.validity.notBefore.getTime() <= now && server.validity.notAfter.getTime() > now + renewalBuffer && ca.verify(ca) && ca.verify(server);
+    return staysValid(ca, now) && staysValid(server, now) && ca.verify(ca) && ca.verify(server) && keyMatchesCertificate(server, serverKey);
   } catch {
     return false;
   }
@@ -19986,7 +20013,15 @@ function ensureHttpProxyCertificates() {
   const paths = certPaths();
   const required = [paths.caCert, paths.caKey, paths.serverCert, paths.serverKey, paths.version];
   const current = required.every(existsSync6) && readFileSync12(paths.version, "utf8") === CERT_VERSION && storedCertificatesAreCurrent(paths);
-  if (!current) generateCertificates(paths);
+  if (!current) {
+    const ca = loadCurrentCa(paths);
+    if (ca) {
+      generateServerCertificate(paths, ca.caCert, ca.caKey);
+      writePublic(paths.version, CERT_VERSION);
+    } else {
+      generateCertificates(paths);
+    }
+  }
   return {
     caCertPath: paths.caCert,
     caCert: readFileSync12(paths.caCert, "utf8"),