@bman654/clodex 2.5.1 → 2.5.2

package/dist/cli.js

@@ -374,7 +374,7 @@ import { join } from "path";
 // package.json
 var package_default = {
   name: "@bman654/clodex",
-  version: "2.5.1",
+  version: "2.5.2",
   publishConfig: {
     access: "public"
   },
@@ -15600,11 +15600,11 @@ import {
   readFileSync as readFileSync10,
   renameSync as renameSync3,
   rmSync,
-  statSync as statSync5,
+  statSync as statSync6,
   unlinkSync as unlinkSync4,
   writeFileSync as writeFileSync7,
-  openSync as openSync4,
-  closeSync as closeSync4,
+  openSync as openSync5,
+  closeSync as closeSync5,
   realpathSync
 } from "fs";
 import { homedir as homedir3 } from "os";
@@ -15987,9 +15987,152 @@ function builtInPatchProofsChanged(source, proofs) {
   );
 }
 
+// src/bun-entry-module.ts
+import { closeSync as closeSync4, openSync as openSync4, readSync, statSync as statSync4, writeSync as writeSync3 } from "fs";
+import { execFileSync } from "child_process";
+var BUN_TRAILER = Buffer.from("\n---- Bun! ----\n");
+var BUN_OFFSETS_BYTES = 32;
+var TAIL_SCAN_BYTES = 16 * 1024 * 1024;
+var MODULE_STRUCT_BYTES_CURRENT = 52;
+var MODULE_STRUCT_BYTES_LEGACY = 36;
+var MAX_MODULE_NAME_BYTES = 4096;
+var MIN_SHIMMABLE_NAME_BYTES = 7;
+function tweakccRecognizesModuleName(name) {
+  return name.endsWith("/claude") || name === "claude" || name.endsWith("/claude.exe") || name === "claude.exe" || name.endsWith("/src/entrypoints/cli.js") || name === "src/entrypoints/cli.js";
+}
+function entryModuleShimName(byteLength) {
+  if (byteLength < MIN_SHIMMABLE_NAME_BYTES) return null;
+  const padding = byteLength - MIN_SHIMMABLE_NAME_BYTES;
+  return "/clodex".padEnd(padding, "-").slice(0, padding) + "/claude";
+}
+function readAt(fd, length, position) {
+  if (length <= 0 || position < 0) return null;
+  const buffer = Buffer.alloc(length);
+  const read = readSync(fd, buffer, 0, length, position);
+  return read === length ? buffer : null;
+}
+function readBunModuleNames(fd, fileSize) {
+  const tailLength = Math.min(fileSize, TAIL_SCAN_BYTES);
+  const tail = readAt(fd, tailLength, fileSize - tailLength);
+  if (!tail) return null;
+  const tailAt = fileSize - tailLength;
+  for (let searchFrom = tail.length - 1; searchFrom >= 0; ) {
+    const trailerInTail = tail.lastIndexOf(BUN_TRAILER, searchFrom);
+    if (trailerInTail < 0) return null;
+    const parsed = parseBunModuleNamesAt(fd, tailAt + trailerInTail - BUN_OFFSETS_BYTES);
+    if (parsed) return parsed;
+    searchFrom = trailerInTail - 1;
+  }
+  return null;
+}
+function parseBunModuleNamesAt(fd, offsetsAt) {
+  try {
+    return parseBunModuleNamesAtUnchecked(fd, offsetsAt);
+  } catch {
+    return null;
+  }
+}
+function parseBunModuleNamesAtUnchecked(fd, offsetsAt) {
+  const offsets = readAt(fd, BUN_OFFSETS_BYTES, offsetsAt);
+  if (!offsets) return null;
+  const byteCount = offsets.readBigUInt64LE(0);
+  const modulesOffset = offsets.readUInt32LE(8);
+  const modulesLength = offsets.readUInt32LE(12);
+  const entryPointId = offsets.readUInt32LE(16);
+  if (byteCount <= 0n || byteCount > BigInt(offsetsAt)) return null;
+  const blobAt = offsetsAt - Number(byteCount);
+  if (modulesLength <= 0 || BigInt(modulesOffset) + BigInt(modulesLength) > byteCount) return null;
+  const structBytes = modulesLength % MODULE_STRUCT_BYTES_LEGACY === 0 && modulesLength % MODULE_STRUCT_BYTES_CURRENT !== 0 ? MODULE_STRUCT_BYTES_LEGACY : MODULE_STRUCT_BYTES_CURRENT;
+  const moduleCount = Math.floor(modulesLength / structBytes);
+  if (moduleCount <= 0 || entryPointId >= moduleCount) return null;
+  const modules = readAt(fd, moduleCount * structBytes, blobAt + modulesOffset);
+  if (!modules) return null;
+  const names = [];
+  const nameOffsets = [];
+  for (let index = 0; index < moduleCount; index++) {
+    const nameOffset = modules.readUInt32LE(index * structBytes);
+    const nameLength = modules.readUInt32LE(index * structBytes + 4);
+    if (nameLength <= 0 || nameLength > MAX_MODULE_NAME_BYTES) return null;
+    if (BigInt(nameOffset) + BigInt(nameLength) > byteCount) return null;
+    const bytes = readAt(fd, nameLength + 1, blobAt + nameOffset);
+    if (!bytes || bytes[nameLength] !== 0) return null;
+    const name = bytes.subarray(0, nameLength).toString("utf8");
+    if (!/^[\x20-\x7e]+$/.test(name)) return null;
+    names.push(name);
+    nameOffsets.push(blobAt + nameOffset);
+  }
+  return { names, entryPointId, offsets: nameOffsets };
+}
+function assertShimGone(fd, fileSize, marker) {
+  const needle = Buffer.from(marker);
+  const chunkBytes = 8 * 1024 * 1024;
+  let carry = Buffer.alloc(0);
+  for (let position = 0; position < fileSize; ) {
+    const length = Math.min(chunkBytes, fileSize - position);
+    const chunk = readAt(fd, length, position);
+    if (!chunk) throw new Error("could not re-read the candidate to verify the entry-module name");
+    const window = carry.length > 0 ? Buffer.concat([carry, chunk]) : chunk;
+    if (window.includes(needle)) {
+      throw new Error(`the entry-module stand-in ${marker} survived restoration`);
+    }
+    carry = Buffer.from(window.subarray(Math.max(0, window.length - (needle.length - 1))));
+    position += length;
+  }
+}
+function writeNameBytes(fd, name, offset) {
+  const bytes = Buffer.from(name);
+  const written = writeSync3(fd, bytes, 0, bytes.length, offset);
+  if (written !== bytes.length) {
+    throw new Error(`wrote ${written} of ${bytes.length} entry-module name bytes at ${offset}`);
+  }
+}
+function isMachO(fd) {
+  const magic = readAt(fd, 4, 0);
+  if (!magic) return false;
+  const value = magic.readUInt32BE(0);
+  return value === 4277009102 || value === 4277009103 || value === 3472551422 || value === 3489328638 || value === 3405691582 || value === 3405691583;
+}
+function shimEntryModuleName(path) {
+  const fd = openSync4(path, "r+");
+  try {
+    const parsed = readBunModuleNames(fd, statSync4(path).size);
+    if (!parsed) return null;
+    if (parsed.names.some(tweakccRecognizesModuleName)) return null;
+    const original = parsed.names[parsed.entryPointId];
+    const offset = parsed.offsets[parsed.entryPointId];
+    const marker = entryModuleShimName(Buffer.byteLength(original));
+    if (marker === null) return null;
+    writeNameBytes(fd, marker, offset);
+    return { offset, original, marker };
+  } finally {
+    closeSync4(fd);
+  }
+}
+function restoreEntryModuleName(path, shim, { resign }) {
+  const fd = openSync4(path, "r+");
+  let machO;
+  try {
+    const parsed = readBunModuleNames(fd, statSync4(path).size);
+    const offset = parsed?.offsets[parsed.entryPointId];
+    if (!parsed || offset === void 0 || parsed.names[parsed.entryPointId] !== shim.marker) {
+      throw new Error(
+        `expected the entry module of ${path} to be named ${shim.marker}, found ${parsed ? JSON.stringify(parsed.names[parsed.entryPointId]) : "no readable Bun module list"}`
+      );
+    }
+    writeNameBytes(fd, shim.original, offset);
+    assertShimGone(fd, statSync4(path).size, shim.marker);
+    machO = resign && isMachO(fd);
+  } finally {
+    closeSync4(fd);
+  }
+  if (machO && process.platform === "darwin") {
+    execFileSync("codesign", ["-s", "-", "-f", path], { stdio: "ignore" });
+  }
+}
+
 // src/patch-backup.ts
 import { createHash as createHash8 } from "crypto";
-import { existsSync as existsSync6, readFileSync as readFileSync9, readdirSync, statSync as statSync4 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync9, readdirSync, statSync as statSync5 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join7 } from "path";
 var BACKUP_SHA_PREFIX_LENGTH = 16;
@@ -16027,7 +16170,7 @@ function scanPristineBackups(version, dir = backupDir()) {
     const path = join7(dir, entry);
     let sha256;
     try {
-      if (!statSync4(path).isFile()) continue;
+      if (!statSync5(path).isFile()) continue;
       sha256 = sha256File(path);
     } catch {
       corrupt.push(path);
@@ -16619,10 +16762,10 @@ function tryAcquirePatchLock(lockPath = getPatchLockPath(), opts = {}) {
   mkdirSync7(join8(lockPath, ".."), { recursive: true, mode: 448 });
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
-      const fd = openSync4(lockPath, "wx");
+      const fd = openSync5(lockPath, "wx");
       const content = { pid: process.pid, startedAt: now };
       writeFileSync7(fd, JSON.stringify(content));
-      closeSync4(fd);
+      closeSync5(fd);
       return () => {
         try {
           unlinkSync4(lockPath);
@@ -16658,7 +16801,7 @@ function resolveClaudeBinaryForPatch() {
     return { ok: false, reason: "binary-not-found" };
   }
   try {
-    if (!statSync5(resolved).isFile()) return { ok: false, reason: "binary-not-found" };
+    if (!statSync6(resolved).isFile()) return { ok: false, reason: "binary-not-found" };
   } catch {
     return { ok: false, reason: "binary-not-found" };
   }
@@ -16767,8 +16910,11 @@ async function applyPatch(binaryPath, version, desired, configHash, opts) {
     const candidatePath = join8(candidateDir, basename(binaryPath));
     const seedCandidate = async (from) => {
       copyFileSync(from, candidatePath);
+      const shim = shimEntryModuleName(candidatePath);
       const installation = await tryDetectInstallation({ path: candidatePath });
-      return { installation, source: await readContent(installation) };
+      const source = await readContent(installation);
+      if (shim) restoreEntryModuleName(candidatePath, shim, { resign: false });
+      return { installation, source };
     };
     const facts = collectPristineFacts({
       version,
@@ -16805,6 +16951,11 @@ async function applyPatch(binaryPath, version, desired, configHash, opts) {
         return { ok: false, message: describePoisonedPristineSource(backup, version) };
       }
     } else if (plan.action === "snapshot") {
+      if (sha256File(candidatePath) !== plan.pristineSha256) {
+        throw new Error(
+          `the patch candidate no longer matches the pristine bytes it was seeded from; refusing to publish it as ${plan.backupPath}`
+        );
+      }
       publishBackupFile(candidatePath, plan.backupPath);
     }
     const canonical = contentAddressedBackupPath(version, pristineSha256);
@@ -16855,8 +17006,10 @@ async function applyPatch(binaryPath, version, desired, configHash, opts) {
       local = discardLocalPatchOutcome(builtIn.content, local.results);
     }
     results = [...results, ...local.results];
+    const writeShim = shimEntryModuleName(candidatePath);
     await writeContent(loaded.installation, local.content);
-    patchedSize = statSync5(candidatePath).size;
+    if (writeShim) restoreEntryModuleName(candidatePath, writeShim, { resign: true });
+    patchedSize = statSync6(candidatePath).size;
     patchedSha256 = sha256File(candidatePath);
     renameSync3(candidatePath, binaryPath);
   } catch (err) {
@@ -16981,7 +17134,7 @@ async function runPatchCommand(opts = {}) {
     binaryPath,
     claudeVersion: version,
     configHash,
-    binarySize: statSync5(binaryPath).size
+    binarySize: statSync6(binaryPath).size
   });
   if (state === "current") {
     p11.log.success(`claude ${version} is already patched with the current model config \u2014 nothing to do.`);
@@ -17037,7 +17190,7 @@ async function runLaunchPatchCheck(opts = {}) {
       binaryPath: resolved.binaryPath,
       claudeVersion: resolved.version,
       configHash,
-      binarySize: statSync5(resolved.binaryPath).size
+      binarySize: statSync6(resolved.binaryPath).size
     });
     if (state === "current") return;
     const interactive = !opts.dryRun && !opts.agentStdout && process.stdin.isTTY === true && process.stdout.isTTY === true;