@bman654/clodex 2.8.1 → 2.8.2

package/dist/cli.js

@@ -382,7 +382,7 @@ import { join } from "path";
 // package.json
 var package_default = {
   name: "@bman654/clodex",
-  version: "2.8.1",
+  version: "2.8.2",
   publishConfig: {
     access: "public"
   },
@@ -924,6 +924,7 @@ async function startCallbackServer(options) {
   let codeResolve;
   let codeReject;
   let buffered;
+  let ignoredStateMismatchCount = 0;
   const { path, redirectHost } = options;
   const server = http.createServer((req, res) => {
     const u = new URL(req.url ?? "/", "http://localhost");
@@ -936,6 +937,7 @@ async function startCallbackServer(options) {
     const state = u.searchParams.get("state") ?? "";
     const error = u.searchParams.get("error") ?? "";
     if (options.expectedState !== void 0 && state !== options.expectedState) {
+      ignoredStateMismatchCount++;
       res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" });
       res.end("Invalid OAuth state");
       return;
@@ -976,7 +978,9 @@ async function startCallbackServer(options) {
           return;
         }
         const timer = setTimeout(
-          () => reject(new Error("OAuth timeout \u2014 browser closed without completing sign-in")),
+          () => reject(new Error(
+            ignoredStateMismatchCount > 0 ? `OAuth timeout \u2014 ignored ${ignoredStateMismatchCount} callback(s) carrying a different sign-in state; you probably completed an older browser tab. Run the command again and use the newest tab.` : "OAuth timeout \u2014 browser closed without completing sign-in"
+          )),
           timeoutMs
         );
         codeResolve = (params) => {
@@ -1136,7 +1140,7 @@ async function runOpenAiBrowserFlow(onAuthorizeUrl, opts) {
   } catch (error) {
     if (error.code === "EADDRINUSE") {
       throw new Error(
-        `Ports ${ports.join(" and ")} are in use \u2014 close any other OpenAI sign-in (e.g. codex login) and try again.`
+        `Ports ${ports.join(" and ")} are in use \u2014 browser sign-in needs one free. Check for another OpenAI sign-in (e.g. \`codex login\`), or any other process holding them, then try again.`
       );
     }
     throw new Error(
@@ -3419,7 +3423,7 @@ function savedStopsAfter(current, assignments) {
 }
 
 // src/patch-transforms.ts
-var PATCH_TRANSFORMS_VERSION = 9;
+var PATCH_TRANSFORMS_VERSION = 10;
 var NATIVE_EFFORT_LEVELS = ["low", "medium", "high", "xhigh", "max"];
 var BASE_EFFORT_LEVELS = ["low", "medium", "high"];
 function projectNativeEffort(effort) {
@@ -3840,8 +3844,8 @@ import {
   statSync as statSync6,
   unlinkSync as unlinkSync3,
   writeFileSync as writeFileSync5,
-  openSync as openSync4,
-  closeSync as closeSync4,
+  openSync as openSync5,
+  closeSync as closeSync5,
   realpathSync
 } from "fs";
 import { homedir as homedir3 } from "os";
@@ -6801,6 +6805,20 @@ var TAIL_SCAN_BYTES = 16 * 1024 * 1024;
 var MODULE_STRUCT_BYTES_CURRENT = 52;
 var MODULE_STRUCT_BYTES_LEGACY = 36;
 var CONTENTS_FIELD_AT = 8;
+var SOURCEMAP_FIELD_AT = 16;
+var BYTECODE_FIELD_AT = 24;
+var MODULE_INFO_FIELD_AT = 32;
+var BYTECODE_ORIGIN_PATH_FIELD_AT = 40;
+var BUN_BLOB_FLAGS = {
+  /** Every module's source text lies in one run no other region falls inside. */
+  SOURCE_TEXT_CONTIGUOUS: 1 << 4,
+  /** A `[u32; modules]` of each module's source hash follows the module table. */
+  HAS_SOURCE_HASHES: 1 << 5,
+  /** After the source hashes: `u32 count`, then `count` x `{ u32 id, offset, length }`. */
+  HAS_BUILTIN_BYTECODE: 1 << 6,
+  /** After the builtin-bytecode table: one `{ offset, length }` for the shared string table. */
+  HAS_BYTECODE_STRING_TABLE: 1 << 7
+};
 var LOADER_FROM_END = 3;
 var BUN_JAVASCRIPT_LOADER = 1;
 var MAX_MODULE_NAME_BYTES = 4096;
@@ -6847,6 +6865,9 @@ function parseBunModuleNamesAtUnchecked(fd, offsetsAt) {
   const modulesOffset = offsets.readUInt32LE(8);
   const modulesLength = offsets.readUInt32LE(12);
   const entryPointId = offsets.readUInt32LE(16);
+  const compileExecArgvOffset = offsets.readUInt32LE(20);
+  const compileExecArgvLength = offsets.readUInt32LE(24);
+  const flags = offsets.readUInt32LE(28);
   if (byteCount <= 0n || byteCount > BigInt(offsetsAt)) return null;
   const blobAt = offsetsAt - Number(byteCount);
   if (modulesLength <= 0 || BigInt(modulesOffset) + BigInt(modulesLength) > byteCount) return null;
@@ -6858,6 +6879,10 @@ function parseBunModuleNamesAtUnchecked(fd, offsetsAt) {
   const names = [];
   const nameOffsets = [];
   const contents = [];
+  const sourcemap = [];
+  const bytecode = [];
+  const moduleInfo = [];
+  const bytecodeOriginPath = [];
   const loaders = [];
   for (let index = 0; index < moduleCount; index++) {
     const nameOffset = modules.readUInt32LE(index * structBytes);
@@ -6870,10 +6895,18 @@ function parseBunModuleNamesAtUnchecked(fd, offsetsAt) {
     if (!/^[\x20-\x7e]+$/.test(name)) return null;
     names.push(name);
     nameOffsets.push(blobAt + nameOffset);
-    contents.push({
-      offset: modules.readUInt32LE(index * structBytes + CONTENTS_FIELD_AT),
-      length: modules.readUInt32LE(index * structBytes + CONTENTS_FIELD_AT + 4)
+    const pairAt = (field) => ({
+      offset: modules.readUInt32LE(index * structBytes + field),
+      length: modules.readUInt32LE(index * structBytes + field + 4)
     });
+    contents.push(pairAt(CONTENTS_FIELD_AT));
+    sourcemap.push(pairAt(SOURCEMAP_FIELD_AT));
+    bytecode.push(pairAt(BYTECODE_FIELD_AT));
+    const current = structBytes === MODULE_STRUCT_BYTES_CURRENT;
+    moduleInfo.push(current ? pairAt(MODULE_INFO_FIELD_AT) : { offset: 0, length: 0 });
+    bytecodeOriginPath.push(
+      current ? pairAt(BYTECODE_ORIGIN_PATH_FIELD_AT) : { offset: 0, length: 0 }
+    );
     loaders.push(modules.readUInt8(index * structBytes + structBytes - LOADER_FROM_END));
   }
   return {
@@ -6881,11 +6914,19 @@ function parseBunModuleNamesAtUnchecked(fd, offsetsAt) {
     entryPointId,
     offsets: nameOffsets,
     contents,
+    sourcemap,
+    bytecode,
+    moduleInfo,
+    bytecodeOriginPath,
     loaders,
     blobAt,
     modulesAt: blobAt + modulesOffset,
+    modulesOffset,
+    modulesLength,
     structBytes,
-    byteCount: Number(byteCount)
+    byteCount: Number(byteCount),
+    compileExecArgv: { offset: compileExecArgvOffset, length: compileExecArgvLength },
+    flags
   };
 }
 function findStandIn(fd, fileSize, marker) {
@@ -6935,10 +6976,7 @@ function isMachO(fd) {
 function readBunModuleTable(path) {
   const fd = openSync2(path, "r");
   try {
-    const parsed = readBunModuleNames(fd, statSync4(path).size);
-    if (!parsed) return null;
-    const { names, loaders, contents, entryPointId, blobAt, modulesAt, structBytes, byteCount } = parsed;
-    return { names, loaders, contents, entryPointId, blobAt, modulesAt, structBytes, byteCount };
+    return readBunModuleNames(fd, statSync4(path).size);
   } finally {
     closeSync2(fd);
   }
@@ -6969,33 +7007,6 @@ function readBunJavaScriptModules(path) {
     closeSync2(fd);
   }
 }
-function repointBunModuleContents(path, edits) {
-  if (edits.length === 0) return;
-  const fd = openSync2(path, "r+");
-  try {
-    const parsed = readBunModuleNames(fd, statSync4(path).size);
-    if (!parsed) throw new Error(`cannot read the Bun module table of ${path}`);
-    for (const { index, range } of edits) {
-      if (index < 0 || index >= parsed.names.length) {
-        throw new Error(`module ${index} is outside the ${parsed.names.length}-module table of ${path}`);
-      }
-      if (range.offset < 0 || range.length < 0 || range.offset + range.length > parsed.byteCount) {
-        throw new Error(
-          `module ${index} would point at ${range.offset}+${range.length}, outside the ${parsed.byteCount}-byte blob of ${path}`
-        );
-      }
-      const at = parsed.modulesAt + index * parsed.structBytes + CONTENTS_FIELD_AT;
-      const pair = Buffer.alloc(8);
-      pair.writeUInt32LE(range.offset, 0);
-      pair.writeUInt32LE(range.length, 4);
-      if (writeSync2(fd, pair, 0, pair.length, at) !== pair.length) {
-        throw new Error(`short write repointing module ${index} of ${path}`);
-      }
-    }
-  } finally {
-    closeSync2(fd);
-  }
-}
 function shimEntryModuleName(path) {
   const fd = openSync2(path, "r+");
   try {
@@ -7048,6 +7059,7 @@ function resignMachOBinary(path) {
 }
 
 // src/bun-bundle.ts
+import { closeSync as closeSync3, openSync as openSync3, readSync as readSync2, writeSync as writeSync3 } from "fs";
 function writableModuleIndex(path) {
   const table = readBunModuleTable(path);
   if (!table) return null;
@@ -7074,69 +7086,197 @@ function splitBundleSource(bundle, patched) {
   }
   return parts;
 }
-function planBundleWrite(bundle, patchedSources, writableIndex) {
+var BUN_TRAILER2 = Buffer.from("\n---- Bun! ----\n");
+var BUN_OFFSETS_BYTES2 = 32;
+var PLACEHOLDER_SLACK_BYTES = 64 * 1024;
+var BYTECODE_ALIGNMENT = 128;
+var APPEND_ALIGNMENT = 8;
+function repackedBlobBytes(table, writableIndex, contentBytes) {
+  let total = 0;
+  for (let index = 0; index < table.names.length; index++) {
+    const fields = [
+      Buffer.byteLength(table.names[index], "utf8"),
+      index === writableIndex ? contentBytes : table.contents[index].length,
+      table.sourcemap[index].length,
+      table.bytecode[index].length
+    ];
+    if (table.structBytes === 52) {
+      fields.push(table.moduleInfo[index].length, table.bytecodeOriginPath[index].length);
+    }
+    for (const length of fields) total += length + 1;
+  }
+  return total + table.modulesLength + table.compileExecArgv.length + 1 + BUN_OFFSETS_BYTES2 + BUN_TRAILER2.length;
+}
+function planBundleWrite(path, bundle, patchedSources, writableIndex) {
   if (patchedSources.length !== bundle.modules.length) {
     throw new Error(
       `expected ${bundle.modules.length} patched module sources, got ${patchedSources.length}`
     );
   }
-  const writable = bundle.modules.findIndex((module) => module.index === writableIndex);
-  if (writable < 0) {
-    throw new Error(`module ${writableIndex} is not one of this binary's JavaScript modules`);
-  }
-  const changed = bundle.modules.map((module, at) => at).filter((at) => at !== writable && patchedSources[at] !== bundle.modules[at].source);
-  if (changed.length === 0) return { content: patchedSources[writable], repoints: [] };
-  const order = [writable, ...changed];
-  const repoints = [];
-  let content = "";
-  let start = 0;
-  for (const at of order) {
+  const table = readBunModuleTable(path);
+  if (!table) throw new Error(`cannot read the Bun module table of ${path}`);
+  const recognized = table.names.filter(tweakccRecognizesModuleName);
+  if (recognized.length !== 1) {
+    throw new Error(
+      `${path} has ${recognized.length} modules tweakcc would write to; the patch was planned around exactly one`
+    );
+  }
+  if (!table.names[writableIndex] || !tweakccRecognizesModuleName(table.names[writableIndex])) {
+    throw new Error(`module ${writableIndex} of ${path} is not the one tweakcc writes to`);
+  }
+  const appends = [];
+  const sources = [];
+  let cursor = table.byteCount;
+  for (let at = 0; at < bundle.modules.length; at++) {
+    const module = bundle.modules[at];
     const source = patchedSources[at];
-    const length = Buffer.byteLength(source, "utf8");
-    repoints.push({ index: bundle.modules[at].index, start, length, expected: source });
-    content += source + "\0";
-    start += length + 1;
+    if (source === module.source) continue;
+    cursor += (APPEND_ALIGNMENT - cursor % APPEND_ALIGNMENT) % APPEND_ALIGNMENT;
+    const bytes = Buffer.from(source, "utf8");
+    appends.push({ index: module.index, range: { offset: cursor, length: bytes.length }, expected: source });
+    sources.push(bytes);
+    cursor += bytes.length + 1;
+  }
+  if (cursor > 4294967295) {
+    throw new Error(`the patched blob of ${path} would be ${cursor} bytes, past the 4 GiB a Bun offset can address`);
+  }
+  const data = Buffer.alloc(cursor);
+  readBlobData(path, table, data);
+  appends.forEach((append, at) => sources[at].copy(data, append.range.offset));
+  for (const append of appends) repointModule(data, table, append);
+  const offsets = Buffer.alloc(BUN_OFFSETS_BYTES2);
+  offsets.writeUInt32LE(table.modulesOffset, 8);
+  offsets.writeUInt32LE(table.modulesLength, 12);
+  offsets.writeUInt32LE(table.entryPointId, 16);
+  offsets.writeUInt32LE(table.compileExecArgv.offset, 20);
+  offsets.writeUInt32LE(table.compileExecArgv.length, 24);
+  offsets.writeUInt32LE(table.flags & ~BUN_BLOB_FLAGS.SOURCE_TEXT_CONTIGUOUS, 28);
+  const wanted = data.length + BUN_OFFSETS_BYTES2 + BUN_TRAILER2.length + PLACEHOLDER_SLACK_BYTES;
+  const empty = repackedBlobBytes(table, writableIndex, 0);
+  if (wanted < empty) {
+    throw new Error(
+      `repacking ${path} is predicted to make a blob of at least ${empty} bytes, more than the ${wanted} the placeholder is sized against; clodex is reading overlapping payload ranges out of this binary's module table`
+    );
+  }
+  return {
+    content: placeholderOf(wanted - empty),
+    data,
+    offsets,
+    writableIndex,
+    names: table.names,
+    entryPointId: table.entryPointId,
+    flags: table.flags & ~BUN_BLOB_FLAGS.SOURCE_TEXT_CONTIGUOUS,
+    blobAt: table.blobAt,
+    appends
+  };
+}
+var PLACEHOLDER_TEXT = "/*clodex:placeholder*/\n";
+function placeholderOf(byteLength) {
+  return PLACEHOLDER_TEXT.repeat(Math.ceil(byteLength / PLACEHOLDER_TEXT.length)).slice(0, byteLength);
+}
+function readBlobData(path, table, into) {
+  const fd = openSync3(path, "r");
+  try {
+    let read = 0;
+    while (read < table.byteCount) {
+      const got = readSync2(fd, into, read, table.byteCount - read, table.blobAt + read);
+      if (got <= 0) {
+        throw new Error(`read ${read} of the ${table.byteCount} blob bytes of ${path}`);
+      }
+      read += got;
+    }
+  } finally {
+    closeSync3(fd);
+  }
+}
+function repointModule(data, table, append) {
+  const structAt = table.modulesOffset + append.index * table.structBytes;
+  data.writeUInt32LE(append.range.offset, structAt + 8);
+  data.writeUInt32LE(append.range.length, structAt + 12);
+  data.writeUInt32LE(0, structAt + 24);
+  data.writeUInt32LE(0, structAt + 28);
+  if (table.structBytes === 52) {
+    data.writeUInt32LE(0, structAt + 32);
+    data.writeUInt32LE(0, structAt + 36);
+    data.writeUInt32LE(0, structAt + 40);
+    data.writeUInt32LE(0, structAt + 44);
+  }
+  if ((table.flags & BUN_BLOB_FLAGS.HAS_SOURCE_HASHES) === 0) return;
+  const hashAt = table.modulesOffset + table.modulesLength + append.index * 4;
+  if (hashAt + 4 > table.byteCount) {
+    throw new Error(
+      `the blob claims a source hash per module but the table is followed by only ${table.byteCount - table.modulesOffset - table.modulesLength} bytes`
+    );
   }
-  return { content, repoints };
+  data.writeUInt32LE(0, hashAt);
 }
 function applyBundleWritePlan(path, plan) {
-  const table = readBunModuleTable(path);
-  if (!table) {
-    if (plan.repoints.length === 0) return;
-    throw new Error(`cannot read the Bun module table of ${path} after repacking`);
+  const repacked = readBunModuleTable(path);
+  if (!repacked) throw new Error(`cannot read the Bun module table of ${path} after repacking`);
+  const placeholderBytes = Buffer.byteLength(plan.content, "utf8");
+  const written = repacked.contents[plan.writableIndex];
+  if (!written || written.length !== placeholderBytes) {
+    throw new Error(
+      `${path} holds ${written ? written.length : "no"} bytes where the ${placeholderBytes} bytes clodex wrote should be; refusing to publish a blob addressed against it`
+    );
   }
-  const recognized = table.names.filter(tweakccRecognizesModuleName);
-  if (recognized.length !== 1) {
+  if (repacked.names.length !== plan.names.length || repacked.names.some((name, index) => name !== plan.names[index])) {
     throw new Error(
-      `${path} has ${recognized.length} modules tweakcc would write to; the patch was planned around exactly one`
+      `${path} exposes a different module table after repacking than the patch was planned around`
     );
   }
-  if (plan.repoints.length === 0) return;
-  const writable = table.names.findIndex(tweakccRecognizesModuleName);
-  if (writable !== plan.repoints[0].index) {
+  if (repacked.blobAt % BYTECODE_ALIGNMENT !== plan.blobAt % BYTECODE_ALIGNMENT) {
     throw new Error(
-      `${path} exposes module ${writable} to tweakcc, but the patch was planned around module ${plan.repoints[0].index}`
+      `repacking ${path} moved its Bun blob from ${plan.blobAt} to ${repacked.blobAt}, which is a different offset modulo ${BYTECODE_ALIGNMENT}; every unpatched module's cached bytecode would be misaligned`
     );
   }
-  const written = table.contents[writable];
-  const expectedBytes = Buffer.byteLength(plan.content, "utf8");
-  if (written.length !== expectedBytes) {
+  const byteCount = repacked.byteCount;
+  if (byteCount < plan.data.length) {
     throw new Error(
-      `${path} holds ${written.length} bytes where the ${expectedBytes} bytes clodex wrote should be; refusing to repoint its modules`
+      `repacking ${path} left ${byteCount} bytes for a blob that needs ${plan.data.length}; refusing to publish a truncated one`
     );
   }
-  const edits = plan.repoints.map((repoint) => ({
-    index: repoint.index,
-    range: { offset: written.offset + repoint.start, length: repoint.length }
-  }));
-  repointBunModuleContents(path, edits);
+  const offsets = Buffer.from(plan.offsets);
+  offsets.writeBigUInt64LE(BigInt(byteCount), 0);
+  const fd = openSync3(path, "r+");
+  try {
+    writeAll(fd, plan.data, repacked.blobAt, path);
+    const padding = byteCount - plan.data.length;
+    if (padding > 0) writeAll(fd, Buffer.alloc(padding), repacked.blobAt + plan.data.length, path);
+    writeAll(fd, offsets, repacked.blobAt + byteCount, path);
+    writeAll(fd, BUN_TRAILER2, repacked.blobAt + byteCount + BUN_OFFSETS_BYTES2, path);
+  } finally {
+    closeSync3(fd);
+  }
+  const published = readBunModuleTable(path);
+  if (!published) throw new Error(`cannot re-read the Bun module table of ${path} after publishing its blob`);
+  if (published.byteCount !== byteCount || published.entryPointId !== plan.entryPointId || published.flags !== plan.flags || published.names.length !== plan.names.length || published.names.some((name, index) => name !== plan.names[index])) {
+    throw new Error(`the blob published into ${path} does not read back as the one that was planned`);
+  }
   const after = readBunJavaScriptModules(path);
-  if (!after) throw new Error(`cannot re-read the modules of ${path} after repointing them`);
-  const byIndex = new Map(after.map((module) => [module.index, module.source]));
-  for (const repoint of plan.repoints) {
-    if (byIndex.get(repoint.index) !== repoint.expected) {
-      throw new Error(`module ${repoint.index} of ${path} did not read back as the patched source`);
-    }
+  if (!after) throw new Error(`cannot re-read the modules of ${path} after publishing its blob`);
+  const expected = new Map(plan.appends.map((append) => [append.index, append.expected]));
+  let matched = 0;
+  for (const module of after) {
+    const want = expected.get(module.index);
+    if (want === void 0) continue;
+    if (module.source !== want) {
+      throw new Error(`module ${module.index} of ${path} did not read back as the patched source`);
+    }
+    matched++;
+  }
+  if (matched !== expected.size) {
+    throw new Error(
+      `${matched} of the ${expected.size} patched modules of ${path} came back as JavaScript Bun will execute`
+    );
+  }
+}
+function writeAll(fd, bytes, position, path) {
+  let written = 0;
+  while (written < bytes.length) {
+    const wrote = writeSync3(fd, bytes, written, bytes.length - written, position + written);
+    if (wrote <= 0) throw new Error(`wrote ${written} of ${bytes.length} blob bytes to ${path}`);
+    written += wrote;
   }
 }
 
@@ -10019,7 +10159,7 @@ function thinkingProviderOptions(npm) {
 
 // src/proxy.ts
 import { createServer } from "http";
-import { appendFileSync as appendFileSync2, openSync as openSync3, writeSync as writeSync3, closeSync as closeSync3 } from "fs";
+import { appendFileSync as appendFileSync2, openSync as openSync4, writeSync as writeSync4, closeSync as closeSync4 } from "fs";
 
 // src/http-utils.ts
 import * as zlib from "zlib";
@@ -11473,12 +11613,12 @@ function createTranslationLifecycle(logPath, requestId, claudeSessionId, modelId
 function appendSecureLog(logPath, line) {
   const redacted = redactTraceLine(line);
   try {
-    const fd = openSync3(logPath, "a", 384);
+    const fd = openSync4(logPath, "a", 384);
     try {
-      writeSync3(fd, `${(/* @__PURE__ */ new Date()).toISOString()} ${redacted}
+      writeSync4(fd, `${(/* @__PURE__ */ new Date()).toISOString()} ${redacted}
 `);
     } finally {
-      closeSync3(fd);
+      closeSync4(fd);
     }
   } catch {
     try {
@@ -12341,10 +12481,10 @@ function tryAcquirePatchLock(lockPath = getPatchLockPath(), opts = {}) {
   mkdirSync5(join7(lockPath, ".."), { recursive: true, mode: 448 });
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
-      const fd = openSync4(lockPath, "wx");
+      const fd = openSync5(lockPath, "wx");
       const content = { pid: process.pid, startedAt: now };
       writeFileSync5(fd, JSON.stringify(content));
-      closeSync4(fd);
+      closeSync5(fd);
       return () => {
         try {
           unlinkSync3(lockPath);
@@ -12592,25 +12732,26 @@ async function applyPatch(binaryPath, version, desired, configHash, opts) {
     }
     results = [...results, ...local.results];
     const writeShim = shimEntryModuleName(candidatePath);
-    let repointed = false;
+    let publishedBlob = false;
     if (loaded.bundle) {
       const writable = writableModuleIndex(candidatePath);
       if (writable === null) {
         throw new Error("no module of the patch candidate carries a name tweakcc can write to");
       }
       const plan2 = planBundleWrite(
+        candidatePath,
         loaded.bundle,
         splitBundleSource(loaded.bundle, local.content),
         writable
       );
       await writeContent(loaded.installation, plan2.content);
       applyBundleWritePlan(candidatePath, plan2);
-      repointed = plan2.repoints.length > 0;
+      publishedBlob = true;
     } else {
       await writeContent(loaded.installation, local.content);
     }
     if (writeShim) restoreEntryModuleName(candidatePath, writeShim, { resign: true });
-    else if (repointed) resignMachOBinary(candidatePath);
+    else if (publishedBlob) resignMachOBinary(candidatePath);
     patchedSize = statSync6(candidatePath).size;
     patchedSha256 = sha256File(candidatePath);
     renameSync2(candidatePath, binaryPath);
@@ -13128,13 +13269,13 @@ function localProvidersToServerModels(localProviders) {
 // src/registry/credential-cleanup-journal.ts
 import { randomUUID as randomUUID4 } from "crypto";
 import {
-  closeSync as closeSync5,
+  closeSync as closeSync6,
   existsSync as existsSync6,
   fstatSync,
   fsyncSync as fsyncSync2,
   lstatSync,
   mkdirSync as mkdirSync6,
-  openSync as openSync5,
+  openSync as openSync6,
   readFileSync as readFileSync9,
   renameSync as renameSync3,
   unlinkSync as unlinkSync4,
@@ -13226,7 +13367,7 @@ function readJournalUnlocked(path) {
     if (before.isSymbolicLink() || !before.isFile()) {
       throw new Error("Credential cleanup journal must be a regular file.");
     }
-    fd = openSync5(path, "r");
+    fd = openSync6(path, "r");
     const opened = fstatSync(fd);
     if (before.dev !== opened.dev || before.ino !== opened.ino) {
       throw new Error("Credential cleanup journal changed while opening.");
@@ -13247,19 +13388,19 @@ function readJournalUnlocked(path) {
     const message = error instanceof Error ? error.message : String(error);
     throw new Error(`Could not read credential cleanup journal: ${message}`);
   } finally {
-    if (fd !== void 0) closeSync5(fd);
+    if (fd !== void 0) closeSync6(fd);
   }
 }
 function syncParentDirectory(path) {
   let fd;
   try {
-    fd = openSync5(dirname4(path), "r");
+    fd = openSync6(dirname4(path), "r");
     fsyncSync2(fd);
   } catch (error) {
     const code = error.code;
     if (code !== "EINVAL" && code !== "ENOTSUP" && code !== "EPERM") throw error;
   } finally {
-    if (fd !== void 0) closeSync5(fd);
+    if (fd !== void 0) closeSync6(fd);
   }
 }
 function writeJournalUnlocked(journal, path) {
@@ -13269,17 +13410,17 @@ function writeJournalUnlocked(journal, path) {
   const tmp = `${path}.${process.pid}.${randomUUID4()}.tmp`;
   let fd;
   try {
-    fd = openSync5(tmp, "wx", FILE_MODE4);
+    fd = openSync6(tmp, "wx", FILE_MODE4);
     writeFileSync6(fd, `${JSON.stringify(journal, null, 2)}
 `);
     fsyncSync2(fd);
-    closeSync5(fd);
+    closeSync6(fd);
     fd = void 0;
     assertRegistryWriteOwnership(path);
     renameSync3(tmp, path);
     syncParentDirectory(path);
   } finally {
-    if (fd !== void 0) closeSync5(fd);
+    if (fd !== void 0) closeSync6(fd);
     try {
       unlinkSync4(tmp);
     } catch (error) {