@bman654/clodex 2.8.0 → 2.8.2

package/README.md

@@ -205,6 +205,10 @@ Enabling this feature executes that JavaScript with your full user permissions;
 
 The module must default-export an array. Each site has a unique lowercase `id` and an `apply` function that returns the complete source and emits the generated `marker` exactly once when it applies:
 
+The `source` your `apply` receives is every JavaScript module in the binary joined together, with a ``/*clodex:module-boundary`;{}"]*/`` line between them. This is true of every Claude Code version — a pre-2.1.242 binary carries the bundle plus five small helper modules; a 2.1.242-or-later one carries the bundle split across roughly 1,370. Match and replace as you always have; just do not add or remove one of those lines, or the whole patch is refused. (The punctuation in the marker is there so that a wildcard bounded by a character class cannot run across a module boundary.)
+
+If your transform works by **position** rather than by matching an anchor, mind where it lands: text prepended to `source` goes into the first module and text appended to it goes into the last, and neither is necessarily the module that runs at startup. Anchor your edit to text you match, the way the examples below do.
+
 ```js
 export default [
   {

package/dist/cli.js

@@ -382,7 +382,7 @@ import { join } from "path";
 // package.json
 var package_default = {
   name: "@bman654/clodex",
-  version: "2.8.0",
+  version: "2.8.2",
   publishConfig: {
     access: "public"
   },
@@ -924,6 +924,7 @@ async function startCallbackServer(options) {
   let codeResolve;
   let codeReject;
   let buffered;
+  let ignoredStateMismatchCount = 0;
   const { path, redirectHost } = options;
   const server = http.createServer((req, res) => {
     const u = new URL(req.url ?? "/", "http://localhost");
@@ -936,6 +937,7 @@ async function startCallbackServer(options) {
     const state = u.searchParams.get("state") ?? "";
     const error = u.searchParams.get("error") ?? "";
     if (options.expectedState !== void 0 && state !== options.expectedState) {
+      ignoredStateMismatchCount++;
       res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" });
       res.end("Invalid OAuth state");
       return;
@@ -976,7 +978,9 @@ async function startCallbackServer(options) {
           return;
         }
         const timer = setTimeout(
-          () => reject(new Error("OAuth timeout \u2014 browser closed without completing sign-in")),
+          () => reject(new Error(
+            ignoredStateMismatchCount > 0 ? `OAuth timeout \u2014 ignored ${ignoredStateMismatchCount} callback(s) carrying a different sign-in state; you probably completed an older browser tab. Run the command again and use the newest tab.` : "OAuth timeout \u2014 browser closed without completing sign-in"
+          )),
           timeoutMs
         );
         codeResolve = (params) => {
@@ -1136,7 +1140,7 @@ async function runOpenAiBrowserFlow(onAuthorizeUrl, opts) {
   } catch (error) {
     if (error.code === "EADDRINUSE") {
       throw new Error(
-        `Ports ${ports.join(" and ")} are in use \u2014 close any other OpenAI sign-in (e.g. codex login) and try again.`
+        `Ports ${ports.join(" and ")} are in use \u2014 browser sign-in needs one free. Check for another OpenAI sign-in (e.g. \`codex login\`), or any other process holding them, then try again.`
       );
     }
     throw new Error(
@@ -3419,7 +3423,7 @@ function savedStopsAfter(current, assignments) {
 }
 
 // src/patch-transforms.ts
-var PATCH_TRANSFORMS_VERSION = 8;
+var PATCH_TRANSFORMS_VERSION = 10;
 var NATIVE_EFFORT_LEVELS = ["low", "medium", "high", "xhigh", "max"];
 var BASE_EFFORT_LEVELS = ["low", "medium", "high"];
 function projectNativeEffort(effort) {
@@ -3622,7 +3626,7 @@ function applyClodexPatches(source, config) {
     }).join("; ");
     applyOnce(
       "PATCH 4: Agent tool model description",
-      /(describe\(`Optional model override for this agent[^`]*?)(`\))/,
+      /(describe\(`Optional model override for this agent(?:[^`\\]|\\.)*?)(`)/,
       (_m, body, close) => body.includes("Additional custom models") ? body + close : body + " Additional custom models: " + listing + "." + close,
       { required: false, noopIsSkip: true }
     );
@@ -3840,8 +3844,8 @@ import {
   statSync as statSync6,
   unlinkSync as unlinkSync3,
   writeFileSync as writeFileSync5,
-  openSync as openSync4,
-  closeSync as closeSync4,
+  openSync as openSync5,
+  closeSync as closeSync5,
   realpathSync
 } from "fs";
 import { homedir as homedir3 } from "os";
@@ -4169,7 +4173,7 @@ function captureBuiltInPatchProofs(source, config, results) {
   );
   addPattern(
     "PATCH 4: Agent tool model description",
-    /describe\(`Optional model override for this agent[^`]*?`\)/
+    /describe\(`Optional model override for this agent(?:[^`\\]|\\.)*?`/
   );
   const aliases = configuredAliases(config);
   if (protectsResult(results, "PATCH 6: alias resolver switch")) {
@@ -6800,6 +6804,23 @@ var BUN_OFFSETS_BYTES = 32;
 var TAIL_SCAN_BYTES = 16 * 1024 * 1024;
 var MODULE_STRUCT_BYTES_CURRENT = 52;
 var MODULE_STRUCT_BYTES_LEGACY = 36;
+var CONTENTS_FIELD_AT = 8;
+var SOURCEMAP_FIELD_AT = 16;
+var BYTECODE_FIELD_AT = 24;
+var MODULE_INFO_FIELD_AT = 32;
+var BYTECODE_ORIGIN_PATH_FIELD_AT = 40;
+var BUN_BLOB_FLAGS = {
+  /** Every module's source text lies in one run no other region falls inside. */
+  SOURCE_TEXT_CONTIGUOUS: 1 << 4,
+  /** A `[u32; modules]` of each module's source hash follows the module table. */
+  HAS_SOURCE_HASHES: 1 << 5,
+  /** After the source hashes: `u32 count`, then `count` x `{ u32 id, offset, length }`. */
+  HAS_BUILTIN_BYTECODE: 1 << 6,
+  /** After the builtin-bytecode table: one `{ offset, length }` for the shared string table. */
+  HAS_BYTECODE_STRING_TABLE: 1 << 7
+};
+var LOADER_FROM_END = 3;
+var BUN_JAVASCRIPT_LOADER = 1;
 var MAX_MODULE_NAME_BYTES = 4096;
 var MIN_SHIMMABLE_NAME_BYTES = 7;
 function tweakccRecognizesModuleName(name) {
@@ -6844,6 +6865,9 @@ function parseBunModuleNamesAtUnchecked(fd, offsetsAt) {
   const modulesOffset = offsets.readUInt32LE(8);
   const modulesLength = offsets.readUInt32LE(12);
   const entryPointId = offsets.readUInt32LE(16);
+  const compileExecArgvOffset = offsets.readUInt32LE(20);
+  const compileExecArgvLength = offsets.readUInt32LE(24);
+  const flags = offsets.readUInt32LE(28);
   if (byteCount <= 0n || byteCount > BigInt(offsetsAt)) return null;
   const blobAt = offsetsAt - Number(byteCount);
   if (modulesLength <= 0 || BigInt(modulesOffset) + BigInt(modulesLength) > byteCount) return null;
@@ -6854,6 +6878,12 @@ function parseBunModuleNamesAtUnchecked(fd, offsetsAt) {
   if (!modules) return null;
   const names = [];
   const nameOffsets = [];
+  const contents = [];
+  const sourcemap = [];
+  const bytecode = [];
+  const moduleInfo = [];
+  const bytecodeOriginPath = [];
+  const loaders = [];
   for (let index = 0; index < moduleCount; index++) {
     const nameOffset = modules.readUInt32LE(index * structBytes);
     const nameLength = modules.readUInt32LE(index * structBytes + 4);
@@ -6865,8 +6895,39 @@ function parseBunModuleNamesAtUnchecked(fd, offsetsAt) {
     if (!/^[\x20-\x7e]+$/.test(name)) return null;
     names.push(name);
     nameOffsets.push(blobAt + nameOffset);
+    const pairAt = (field) => ({
+      offset: modules.readUInt32LE(index * structBytes + field),
+      length: modules.readUInt32LE(index * structBytes + field + 4)
+    });
+    contents.push(pairAt(CONTENTS_FIELD_AT));
+    sourcemap.push(pairAt(SOURCEMAP_FIELD_AT));
+    bytecode.push(pairAt(BYTECODE_FIELD_AT));
+    const current = structBytes === MODULE_STRUCT_BYTES_CURRENT;
+    moduleInfo.push(current ? pairAt(MODULE_INFO_FIELD_AT) : { offset: 0, length: 0 });
+    bytecodeOriginPath.push(
+      current ? pairAt(BYTECODE_ORIGIN_PATH_FIELD_AT) : { offset: 0, length: 0 }
+    );
+    loaders.push(modules.readUInt8(index * structBytes + structBytes - LOADER_FROM_END));
   }
-  return { names, entryPointId, offsets: nameOffsets };
+  return {
+    names,
+    entryPointId,
+    offsets: nameOffsets,
+    contents,
+    sourcemap,
+    bytecode,
+    moduleInfo,
+    bytecodeOriginPath,
+    loaders,
+    blobAt,
+    modulesAt: blobAt + modulesOffset,
+    modulesOffset,
+    modulesLength,
+    structBytes,
+    byteCount: Number(byteCount),
+    compileExecArgv: { offset: compileExecArgvOffset, length: compileExecArgvLength },
+    flags
+  };
 }
 function findStandIn(fd, fileSize, marker) {
   const needle = Buffer.from(marker);
@@ -6912,6 +6973,40 @@ function isMachO(fd) {
   const value = magic.readUInt32BE(0);
   return value === 4277009102 || value === 4277009103 || value === 3472551422 || value === 3489328638 || value === 3405691582 || value === 3405691583;
 }
+function readBunModuleTable(path) {
+  const fd = openSync2(path, "r");
+  try {
+    return readBunModuleNames(fd, statSync4(path).size);
+  } finally {
+    closeSync2(fd);
+  }
+}
+function readBunJavaScriptModules(path) {
+  const fd = openSync2(path, "r");
+  try {
+    const parsed = readBunModuleNames(fd, statSync4(path).size);
+    if (!parsed) return null;
+    const modules = [];
+    for (let index = 0; index < parsed.names.length; index++) {
+      if (parsed.loaders[index] !== BUN_JAVASCRIPT_LOADER) continue;
+      const range = parsed.contents[index];
+      if (range.offset < 0 || range.length < 0 || range.offset + range.length > parsed.byteCount) {
+        return null;
+      }
+      const bytes = range.length === 0 ? Buffer.alloc(0) : readAt(fd, range.length, parsed.blobAt + range.offset);
+      if (!bytes) return null;
+      modules.push({
+        index,
+        name: parsed.names[index],
+        source: bytes.toString("utf8"),
+        byteLength: bytes.length
+      });
+    }
+    return modules;
+  } finally {
+    closeSync2(fd);
+  }
+}
 function shimEntryModuleName(path) {
   const fd = openSync2(path, "r+");
   try {
@@ -6944,7 +7039,17 @@ function restoreEntryModuleName(path, shim, { resign }) {
     }
     writeNameBytes(fd, shim.original, offset);
     restoreEveryStandIn(fd, statSync4(path).size, shim);
-    machO = resign && isMachO(fd);
+    machO = resign;
+  } finally {
+    closeSync2(fd);
+  }
+  if (machO) resignMachOBinary(path);
+}
+function resignMachOBinary(path) {
+  const fd = openSync2(path, "r");
+  let machO;
+  try {
+    machO = isMachO(fd);
   } finally {
     closeSync2(fd);
   }
@@ -6953,6 +7058,228 @@ function restoreEntryModuleName(path, shim, { resign }) {
   }
 }
 
+// src/bun-bundle.ts
+import { closeSync as closeSync3, openSync as openSync3, readSync as readSync2, writeSync as writeSync3 } from "fs";
+function writableModuleIndex(path) {
+  const table = readBunModuleTable(path);
+  if (!table) return null;
+  const index = table.names.findIndex(tweakccRecognizesModuleName);
+  return index < 0 ? null : index;
+}
+var BUNDLE_MODULE_SEPARATOR = '\n/*clodex:module-boundary`;{}"]*/\n';
+function readClaudeBundle(path) {
+  const modules = readBunJavaScriptModules(path);
+  if (!modules || modules.length === 0) return null;
+  if (modules.some((module) => module.source.includes(BUNDLE_MODULE_SEPARATOR))) return null;
+  if (modules.some((module) => !roundTripsAsUtf8(module.source, module.byteLength))) return null;
+  return { modules, source: modules.map((module) => module.source).join(BUNDLE_MODULE_SEPARATOR) };
+}
+function roundTripsAsUtf8(source, byteLength) {
+  return Buffer.byteLength(source, "utf8") === byteLength && !source.includes("\uFFFD");
+}
+function splitBundleSource(bundle, patched) {
+  const parts = patched.split(BUNDLE_MODULE_SEPARATOR);
+  if (parts.length !== bundle.modules.length) {
+    throw new Error(
+      `the patched bundle has ${parts.length} module boundaries, expected ${bundle.modules.length}`
+    );
+  }
+  return parts;
+}
+var BUN_TRAILER2 = Buffer.from("\n---- Bun! ----\n");
+var BUN_OFFSETS_BYTES2 = 32;
+var PLACEHOLDER_SLACK_BYTES = 64 * 1024;
+var BYTECODE_ALIGNMENT = 128;
+var APPEND_ALIGNMENT = 8;
+function repackedBlobBytes(table, writableIndex, contentBytes) {
+  let total = 0;
+  for (let index = 0; index < table.names.length; index++) {
+    const fields = [
+      Buffer.byteLength(table.names[index], "utf8"),
+      index === writableIndex ? contentBytes : table.contents[index].length,
+      table.sourcemap[index].length,
+      table.bytecode[index].length
+    ];
+    if (table.structBytes === 52) {
+      fields.push(table.moduleInfo[index].length, table.bytecodeOriginPath[index].length);
+    }
+    for (const length of fields) total += length + 1;
+  }
+  return total + table.modulesLength + table.compileExecArgv.length + 1 + BUN_OFFSETS_BYTES2 + BUN_TRAILER2.length;
+}
+function planBundleWrite(path, bundle, patchedSources, writableIndex) {
+  if (patchedSources.length !== bundle.modules.length) {
+    throw new Error(
+      `expected ${bundle.modules.length} patched module sources, got ${patchedSources.length}`
+    );
+  }
+  const table = readBunModuleTable(path);
+  if (!table) throw new Error(`cannot read the Bun module table of ${path}`);
+  const recognized = table.names.filter(tweakccRecognizesModuleName);
+  if (recognized.length !== 1) {
+    throw new Error(
+      `${path} has ${recognized.length} modules tweakcc would write to; the patch was planned around exactly one`
+    );
+  }
+  if (!table.names[writableIndex] || !tweakccRecognizesModuleName(table.names[writableIndex])) {
+    throw new Error(`module ${writableIndex} of ${path} is not the one tweakcc writes to`);
+  }
+  const appends = [];
+  const sources = [];
+  let cursor = table.byteCount;
+  for (let at = 0; at < bundle.modules.length; at++) {
+    const module = bundle.modules[at];
+    const source = patchedSources[at];
+    if (source === module.source) continue;
+    cursor += (APPEND_ALIGNMENT - cursor % APPEND_ALIGNMENT) % APPEND_ALIGNMENT;
+    const bytes = Buffer.from(source, "utf8");
+    appends.push({ index: module.index, range: { offset: cursor, length: bytes.length }, expected: source });
+    sources.push(bytes);
+    cursor += bytes.length + 1;
+  }
+  if (cursor > 4294967295) {
+    throw new Error(`the patched blob of ${path} would be ${cursor} bytes, past the 4 GiB a Bun offset can address`);
+  }
+  const data = Buffer.alloc(cursor);
+  readBlobData(path, table, data);
+  appends.forEach((append, at) => sources[at].copy(data, append.range.offset));
+  for (const append of appends) repointModule(data, table, append);
+  const offsets = Buffer.alloc(BUN_OFFSETS_BYTES2);
+  offsets.writeUInt32LE(table.modulesOffset, 8);
+  offsets.writeUInt32LE(table.modulesLength, 12);
+  offsets.writeUInt32LE(table.entryPointId, 16);
+  offsets.writeUInt32LE(table.compileExecArgv.offset, 20);
+  offsets.writeUInt32LE(table.compileExecArgv.length, 24);
+  offsets.writeUInt32LE(table.flags & ~BUN_BLOB_FLAGS.SOURCE_TEXT_CONTIGUOUS, 28);
+  const wanted = data.length + BUN_OFFSETS_BYTES2 + BUN_TRAILER2.length + PLACEHOLDER_SLACK_BYTES;
+  const empty = repackedBlobBytes(table, writableIndex, 0);
+  if (wanted < empty) {
+    throw new Error(
+      `repacking ${path} is predicted to make a blob of at least ${empty} bytes, more than the ${wanted} the placeholder is sized against; clodex is reading overlapping payload ranges out of this binary's module table`
+    );
+  }
+  return {
+    content: placeholderOf(wanted - empty),
+    data,
+    offsets,
+    writableIndex,
+    names: table.names,
+    entryPointId: table.entryPointId,
+    flags: table.flags & ~BUN_BLOB_FLAGS.SOURCE_TEXT_CONTIGUOUS,
+    blobAt: table.blobAt,
+    appends
+  };
+}
+var PLACEHOLDER_TEXT = "/*clodex:placeholder*/\n";
+function placeholderOf(byteLength) {
+  return PLACEHOLDER_TEXT.repeat(Math.ceil(byteLength / PLACEHOLDER_TEXT.length)).slice(0, byteLength);
+}
+function readBlobData(path, table, into) {
+  const fd = openSync3(path, "r");
+  try {
+    let read = 0;
+    while (read < table.byteCount) {
+      const got = readSync2(fd, into, read, table.byteCount - read, table.blobAt + read);
+      if (got <= 0) {
+        throw new Error(`read ${read} of the ${table.byteCount} blob bytes of ${path}`);
+      }
+      read += got;
+    }
+  } finally {
+    closeSync3(fd);
+  }
+}
+function repointModule(data, table, append) {
+  const structAt = table.modulesOffset + append.index * table.structBytes;
+  data.writeUInt32LE(append.range.offset, structAt + 8);
+  data.writeUInt32LE(append.range.length, structAt + 12);
+  data.writeUInt32LE(0, structAt + 24);
+  data.writeUInt32LE(0, structAt + 28);
+  if (table.structBytes === 52) {
+    data.writeUInt32LE(0, structAt + 32);
+    data.writeUInt32LE(0, structAt + 36);
+    data.writeUInt32LE(0, structAt + 40);
+    data.writeUInt32LE(0, structAt + 44);
+  }
+  if ((table.flags & BUN_BLOB_FLAGS.HAS_SOURCE_HASHES) === 0) return;
+  const hashAt = table.modulesOffset + table.modulesLength + append.index * 4;
+  if (hashAt + 4 > table.byteCount) {
+    throw new Error(
+      `the blob claims a source hash per module but the table is followed by only ${table.byteCount - table.modulesOffset - table.modulesLength} bytes`
+    );
+  }
+  data.writeUInt32LE(0, hashAt);
+}
+function applyBundleWritePlan(path, plan) {
+  const repacked = readBunModuleTable(path);
+  if (!repacked) throw new Error(`cannot read the Bun module table of ${path} after repacking`);
+  const placeholderBytes = Buffer.byteLength(plan.content, "utf8");
+  const written = repacked.contents[plan.writableIndex];
+  if (!written || written.length !== placeholderBytes) {
+    throw new Error(
+      `${path} holds ${written ? written.length : "no"} bytes where the ${placeholderBytes} bytes clodex wrote should be; refusing to publish a blob addressed against it`
+    );
+  }
+  if (repacked.names.length !== plan.names.length || repacked.names.some((name, index) => name !== plan.names[index])) {
+    throw new Error(
+      `${path} exposes a different module table after repacking than the patch was planned around`
+    );
+  }
+  if (repacked.blobAt % BYTECODE_ALIGNMENT !== plan.blobAt % BYTECODE_ALIGNMENT) {
+    throw new Error(
+      `repacking ${path} moved its Bun blob from ${plan.blobAt} to ${repacked.blobAt}, which is a different offset modulo ${BYTECODE_ALIGNMENT}; every unpatched module's cached bytecode would be misaligned`
+    );
+  }
+  const byteCount = repacked.byteCount;
+  if (byteCount < plan.data.length) {
+    throw new Error(
+      `repacking ${path} left ${byteCount} bytes for a blob that needs ${plan.data.length}; refusing to publish a truncated one`
+    );
+  }
+  const offsets = Buffer.from(plan.offsets);
+  offsets.writeBigUInt64LE(BigInt(byteCount), 0);
+  const fd = openSync3(path, "r+");
+  try {
+    writeAll(fd, plan.data, repacked.blobAt, path);
+    const padding = byteCount - plan.data.length;
+    if (padding > 0) writeAll(fd, Buffer.alloc(padding), repacked.blobAt + plan.data.length, path);
+    writeAll(fd, offsets, repacked.blobAt + byteCount, path);
+    writeAll(fd, BUN_TRAILER2, repacked.blobAt + byteCount + BUN_OFFSETS_BYTES2, path);
+  } finally {
+    closeSync3(fd);
+  }
+  const published = readBunModuleTable(path);
+  if (!published) throw new Error(`cannot re-read the Bun module table of ${path} after publishing its blob`);
+  if (published.byteCount !== byteCount || published.entryPointId !== plan.entryPointId || published.flags !== plan.flags || published.names.length !== plan.names.length || published.names.some((name, index) => name !== plan.names[index])) {
+    throw new Error(`the blob published into ${path} does not read back as the one that was planned`);
+  }
+  const after = readBunJavaScriptModules(path);
+  if (!after) throw new Error(`cannot re-read the modules of ${path} after publishing its blob`);
+  const expected = new Map(plan.appends.map((append) => [append.index, append.expected]));
+  let matched = 0;
+  for (const module of after) {
+    const want = expected.get(module.index);
+    if (want === void 0) continue;
+    if (module.source !== want) {
+      throw new Error(`module ${module.index} of ${path} did not read back as the patched source`);
+    }
+    matched++;
+  }
+  if (matched !== expected.size) {
+    throw new Error(
+      `${matched} of the ${expected.size} patched modules of ${path} came back as JavaScript Bun will execute`
+    );
+  }
+}
+function writeAll(fd, bytes, position, path) {
+  let written = 0;
+  while (written < bytes.length) {
+    const wrote = writeSync3(fd, bytes, written, bytes.length - written, position + written);
+    if (wrote <= 0) throw new Error(`wrote ${written} of ${bytes.length} blob bytes to ${path}`);
+    written += wrote;
+  }
+}
+
 // src/patch-backup.ts
 import { createHash as createHash5 } from "crypto";
 import { existsSync as existsSync4, readFileSync as readFileSync7, readdirSync, statSync as statSync5 } from "fs";
@@ -9832,7 +10159,7 @@ function thinkingProviderOptions(npm) {
 
 // src/proxy.ts
 import { createServer } from "http";
-import { appendFileSync as appendFileSync2, openSync as openSync3, writeSync as writeSync3, closeSync as closeSync3 } from "fs";
+import { appendFileSync as appendFileSync2, openSync as openSync4, writeSync as writeSync4, closeSync as closeSync4 } from "fs";
 
 // src/http-utils.ts
 import * as zlib from "zlib";
@@ -11286,12 +11613,12 @@ function createTranslationLifecycle(logPath, requestId, claudeSessionId, modelId
 function appendSecureLog(logPath, line) {
   const redacted = redactTraceLine(line);
   try {
-    const fd = openSync3(logPath, "a", 384);
+    const fd = openSync4(logPath, "a", 384);
     try {
-      writeSync3(fd, `${(/* @__PURE__ */ new Date()).toISOString()} ${redacted}
+      writeSync4(fd, `${(/* @__PURE__ */ new Date()).toISOString()} ${redacted}
 `);
     } finally {
-      closeSync3(fd);
+      closeSync4(fd);
     }
   } catch {
     try {
@@ -12154,10 +12481,10 @@ function tryAcquirePatchLock(lockPath = getPatchLockPath(), opts = {}) {
   mkdirSync5(join7(lockPath, ".."), { recursive: true, mode: 448 });
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
-      const fd = openSync4(lockPath, "wx");
+      const fd = openSync5(lockPath, "wx");
       const content = { pid: process.pid, startedAt: now };
       writeFileSync5(fd, JSON.stringify(content));
-      closeSync4(fd);
+      closeSync5(fd);
       return () => {
         try {
           unlinkSync3(lockPath);
@@ -12304,9 +12631,15 @@ async function applyPatch(binaryPath, version, desired, configHash, opts) {
       copyFileSync(from, candidatePath);
       const shim = shimEntryModuleName(candidatePath);
       const installation = await tryDetectInstallation({ path: candidatePath });
-      const source = await readContent(installation);
+      const bundle = readClaudeBundle(candidatePath);
+      if (!bundle && installation.kind === "native") {
+        p2.log.warn(
+          `Could not read ${candidatePath} as a Bun module table, so only the module tweakcc names is being patched. On Claude Code 2.1.242 and later that module is a stub holding none of the code clodex patches, and the patch below will fail at its first required site \u2014 the cause is this read, not a changed anchor.`
+        );
+      }
+      const source = bundle ? bundle.source : await readContent(installation);
       if (shim) restoreEntryModuleName(candidatePath, shim, { resign: false });
-      return { installation, source };
+      return { installation, source, bundle };
     };
     const facts = collectPristineFacts({
       version,
@@ -12399,8 +12732,26 @@ async function applyPatch(binaryPath, version, desired, configHash, opts) {
     }
     results = [...results, ...local.results];
     const writeShim = shimEntryModuleName(candidatePath);
-    await writeContent(loaded.installation, local.content);
+    let publishedBlob = false;
+    if (loaded.bundle) {
+      const writable = writableModuleIndex(candidatePath);
+      if (writable === null) {
+        throw new Error("no module of the patch candidate carries a name tweakcc can write to");
+      }
+      const plan2 = planBundleWrite(
+        candidatePath,
+        loaded.bundle,
+        splitBundleSource(loaded.bundle, local.content),
+        writable
+      );
+      await writeContent(loaded.installation, plan2.content);
+      applyBundleWritePlan(candidatePath, plan2);
+      publishedBlob = true;
+    } else {
+      await writeContent(loaded.installation, local.content);
+    }
     if (writeShim) restoreEntryModuleName(candidatePath, writeShim, { resign: true });
+    else if (publishedBlob) resignMachOBinary(candidatePath);
     patchedSize = statSync6(candidatePath).size;
     patchedSha256 = sha256File(candidatePath);
     renameSync2(candidatePath, binaryPath);
@@ -12918,13 +13269,13 @@ function localProvidersToServerModels(localProviders) {
 // src/registry/credential-cleanup-journal.ts
 import { randomUUID as randomUUID4 } from "crypto";
 import {
-  closeSync as closeSync5,
+  closeSync as closeSync6,
   existsSync as existsSync6,
   fstatSync,
   fsyncSync as fsyncSync2,
   lstatSync,
   mkdirSync as mkdirSync6,
-  openSync as openSync5,
+  openSync as openSync6,
   readFileSync as readFileSync9,
   renameSync as renameSync3,
   unlinkSync as unlinkSync4,
@@ -13016,7 +13367,7 @@ function readJournalUnlocked(path) {
     if (before.isSymbolicLink() || !before.isFile()) {
       throw new Error("Credential cleanup journal must be a regular file.");
     }
-    fd = openSync5(path, "r");
+    fd = openSync6(path, "r");
     const opened = fstatSync(fd);
     if (before.dev !== opened.dev || before.ino !== opened.ino) {
       throw new Error("Credential cleanup journal changed while opening.");
@@ -13037,19 +13388,19 @@ function readJournalUnlocked(path) {
     const message = error instanceof Error ? error.message : String(error);
     throw new Error(`Could not read credential cleanup journal: ${message}`);
   } finally {
-    if (fd !== void 0) closeSync5(fd);
+    if (fd !== void 0) closeSync6(fd);
   }
 }
 function syncParentDirectory(path) {
   let fd;
   try {
-    fd = openSync5(dirname4(path), "r");
+    fd = openSync6(dirname4(path), "r");
     fsyncSync2(fd);
   } catch (error) {
     const code = error.code;
     if (code !== "EINVAL" && code !== "ENOTSUP" && code !== "EPERM") throw error;
   } finally {
-    if (fd !== void 0) closeSync5(fd);
+    if (fd !== void 0) closeSync6(fd);
   }
 }
 function writeJournalUnlocked(journal, path) {
@@ -13059,17 +13410,17 @@ function writeJournalUnlocked(journal, path) {
   const tmp = `${path}.${process.pid}.${randomUUID4()}.tmp`;
   let fd;
   try {
-    fd = openSync5(tmp, "wx", FILE_MODE4);
+    fd = openSync6(tmp, "wx", FILE_MODE4);
     writeFileSync6(fd, `${JSON.stringify(journal, null, 2)}
 `);
     fsyncSync2(fd);
-    closeSync5(fd);
+    closeSync6(fd);
     fd = void 0;
     assertRegistryWriteOwnership(path);
     renameSync3(tmp, path);
     syncParentDirectory(path);
   } finally {
-    if (fd !== void 0) closeSync5(fd);
+    if (fd !== void 0) closeSync6(fd);
     try {
       unlinkSync4(tmp);
     } catch (error) {