@bman654/clodex 2.8.3 → 2.8.4

package/dist/cli.js

@@ -382,7 +382,7 @@ import { join } from "path";
 // package.json
 var package_default = {
   name: "@bman654/clodex",
-  version: "2.8.3",
+  version: "2.8.4",
   publishConfig: {
     access: "public"
   },
@@ -3423,7 +3423,7 @@ function savedStopsAfter(current, assignments) {
 }
 
 // src/patch-transforms.ts
-var PATCH_TRANSFORMS_VERSION = 10;
+var PATCH_TRANSFORMS_VERSION = 11;
 var NATIVE_EFFORT_LEVELS = ["low", "medium", "high", "xhigh", "max"];
 var BASE_EFFORT_LEVELS = ["low", "medium", "high"];
 function projectNativeEffort(effort) {
@@ -3633,19 +3633,19 @@ function applyClodexPatches(source, config) {
   }
   if (Object.keys(CONTEXT_BY_KEY).length) {
     const MARKER = "/*ccpatch:ctx*/";
-    const SNIPPET = MARKER + "var _ccw=(" + JSON.stringify(CONTEXT_BY_KEY) + ')[String(e||"").trim().toLowerCase()];if(_ccw!==void 0)return _ccw;';
+    const snippetFor = (modelParam) => MARKER + "var _ccw=(" + JSON.stringify(CONTEXT_BY_KEY) + ")[String(" + modelParam + '||"").trim().toLowerCase()];if(_ccw!==void 0)return _ccw;';
     if (js.includes(MARKER)) {
       applyOnce(
         "PATCH 7: per-model context window (refresh)",
-        /\/\*ccpatch:ctx\*\/var _ccw=\(\{[^{}]*\}\)\[[^\]]*\];if\(_ccw!==void 0\)return _ccw;/,
-        () => SNIPPET,
+        /\/\*ccpatch:ctx\*\/var _ccw=\(\{[^{}]*\}\)\[String\(([\w$]+)\|\|""\)\.trim\(\)\.toLowerCase\(\)\];if\(_ccw!==void 0\)return _ccw;/,
+        (_m, modelParam) => snippetFor(modelParam),
         { required: true, noopIsSkip: true }
       );
     } else {
       applyOnce(
         "PATCH 7: per-model context window",
-        /(function [\w$]+\(e,t\)\{)(let [\w$]+=[\w$]+\(\);if\([\w$]+!==void 0\)return [\w$]+;if\([\w$]+\(e,t\)\)return [\w$]+;return [\w$]+\(e,t\)\})/,
-        (_m, head, body) => head + SNIPPET + body,
+        /(function [\w$]+\(([\w$]+),([\w$]+)\)\{)(let [\w$]+=[\w$]+\(\);if\([\w$]+!==void 0\)return [\w$]+;if\([\w$]+\(\2,\3\)\)return [\w$]+;return [\w$]+\(\2,\3\)\})/,
+        (_m, head, modelParam, _windowParam, body) => head + snippetFor(modelParam) + body,
         { required: true }
       );
     }
@@ -3727,15 +3727,15 @@ function applyClodexPatches(source, config) {
     const marker = "/*ccpatch:child-network-env*/";
     const contractVar = q(NETWORK_ENV_CONTRACT_VAR);
     const networkVars = JSON.stringify(CHILD_NETWORK_ENV_VARS);
-    const requiredBodyLiterals = [
-      "{...process.env",
-      "CLAUDE_CODE_REMOTE",
+    const requiredBodyLiterals = ["{...process.env"];
+    const scrubbedEnvNames = [
       "CLAUDE_CODE_OAUTH_TOKEN",
       "CLAUDE_CODE_SUBSCRIPTION_TYPE",
       "CLAUDE_BG_PTY_AUTH",
       '"OTEL_"',
       "CLAUDE_CODE_OTEL_DIAG_STDERR"
     ];
+    const MIN_SCRUBBED_ENV_NAMES = 1;
     const blockEndIndex = (text5, open2) => {
       const depths = [0];
       const templates = [false];
@@ -3815,11 +3815,15 @@ function applyClodexPatches(source, config) {
       /(function [\w$]+\(\)\{)(let (?:[^;{}]|\{[^;{}]*\})*?[\w$]+\(process\.env\.CLAUDE_CODE_REMOTE\)\?(?:(?!\}\s*function )[\s\S])*?\)return process\.env;let ([\w$]+)=\{(?:(?!\}\s*function )[\s\S])*?return \3)(\})/,
       (match, head, body, _copyVar, tail) => {
         const at = js.indexOf(match);
-        const bound = at < 0 ? -1 : blockEndIndex(js, at + head.length - 1) - at - (match.length - 1);
-        const targetIsValid = requiredBodyLiterals.every((literal) => body.includes(literal)) && !/\bfunction\s*[\w$]*\(/.test(body) && bound === 0;
-        if (!targetIsValid) {
-          log12("FAIL", patchName, "target validation failed");
-          fail("clodex patch: child network environment target validation failed");
+        const closingBrace = at < 0 ? -1 : blockEndIndex(js, at + head.length - 1);
+        const braceScanFailed = at < 0 || closingBrace < 0;
+        const bound = braceScanFailed ? 0 : closingBrace - at - (match.length - 1);
+        const missingLiteral = requiredBodyLiterals.find((literal) => !body.includes(literal));
+        const scrubbedSeen = scrubbedEnvNames.filter((name) => body.includes(name));
+        const why = missingLiteral !== void 0 ? "body does not contain " + missingLiteral : scrubbedSeen.length < MIN_SCRUBBED_ENV_NAMES ? "body scrubs only " + scrubbedSeen.length + " of the " + scrubbedEnvNames.length + " known child-env names (expected at least " + MIN_SCRUBBED_ENV_NAMES + ")" : /\bfunction\s*[\w$]*\(/.test(body) ? "body declares a nested function" : braceScanFailed ? "the brace walk never reached the function's closing brace" : bound !== 0 ? "match ends " + bound + " characters from the function it started in" : void 0;
+        if (why !== void 0) {
+          log12("FAIL", patchName, "target validation failed: " + why);
+          fail("clodex patch: child network environment target validation failed: " + why);
         }
         const restoredBody = body.replace(/process\.env/g, "_clodexChildEnv");
         const restore = marker + "let _clodexChildEnv=process.env,_clodexNetworkRaw=_clodexChildEnv[" + contractVar + "];if(_clodexNetworkRaw!==void 0){_clodexChildEnv={..._clodexChildEnv};delete _clodexChildEnv[" + contractVar + '];try{let _clodexNetwork=JSON.parse(_clodexNetworkRaw);if(_clodexNetwork&&typeof _clodexNetwork==="object"&&!Array.isArray(_clodexNetwork)&&_clodexNetwork.version===1&&_clodexNetwork.original&&typeof _clodexNetwork.original==="object"&&!Array.isArray(_clodexNetwork.original)&&_clodexNetwork.injected&&typeof _clodexNetwork.injected==="object"&&!Array.isArray(_clodexNetwork.injected)&&Object.keys(_clodexNetwork.original).every(_clodexKey=>' + networkVars + '.includes(_clodexKey)&&(typeof _clodexNetwork.original[_clodexKey]==="string"||_clodexNetwork.original[_clodexKey]===null)&&Object.prototype.hasOwnProperty.call(_clodexNetwork.injected,_clodexKey))&&Object.keys(_clodexNetwork.injected).every(_clodexKey=>' + networkVars + '.includes(_clodexKey)&&(typeof _clodexNetwork.injected[_clodexKey]==="string"||_clodexNetwork.injected[_clodexKey]===null)&&Object.prototype.hasOwnProperty.call(_clodexNetwork.original,_clodexKey)))for(let _clodexKey of ' + networkVars + '){if(Object.prototype.hasOwnProperty.call(_clodexNetwork.original,_clodexKey)&&Object.prototype.hasOwnProperty.call(_clodexNetwork.injected,_clodexKey)){let _clodexOriginal=_clodexNetwork.original[_clodexKey],_clodexInjected=_clodexNetwork.injected[_clodexKey],_clodexCurrent=_clodexChildEnv[_clodexKey]===void 0?null:_clodexChildEnv[_clodexKey];if((typeof _clodexOriginal==="string"||_clodexOriginal===null)&&(typeof _clodexInjected==="string"||_clodexInjected===null)&&_clodexCurrent===_clodexInjected){if(_clodexOriginal===null)delete _clodexChildEnv[_clodexKey];else _clodexChildEnv[_clodexKey]=_clodexOriginal}}}}catch(_clodexError){}}';
@@ -3844,8 +3848,8 @@ import {
   statSync as statSync6,
   unlinkSync as unlinkSync3,
   writeFileSync as writeFileSync5,
-  openSync as openSync5,
-  closeSync as closeSync5,
+  openSync as openSync6,
+  closeSync as closeSync6,
   realpathSync
 } from "fs";
 import { homedir as homedir3 } from "os";
@@ -6201,6 +6205,7 @@ function writeInferenceResponseLifecycleLog(path, entry) {
   const outputTokens = nonNegativeInteger(entry.outputTokens);
   const cacheCreationInputTokens = nonNegativeInteger(entry.cacheCreationInputTokens);
   const cacheReadInputTokens = nonNegativeInteger(entry.cacheReadInputTokens);
+  const attempt = nonNegativeInteger(entry.attempt);
   writeSecureLogLine(path, JSON.stringify({
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
     event: entry.event,
@@ -6231,7 +6236,9 @@ function writeInferenceResponseLifecycleLog(path, entry) {
     ...entry.errorCode ? { errorCode: compactLogValue(entry.errorCode, 100) } : {},
     ...entry.errorSignature ? { errorSignature: compactLogValue(entry.errorSignature, 100) } : {},
     ...entry.failureSource ? { failureSource: entry.failureSource } : {},
-    ...entry.terminationSource ? { terminationSource: entry.terminationSource } : {}
+    ...entry.terminationSource ? { terminationSource: entry.terminationSource } : {},
+    ...attempt !== void 0 ? { attempt } : {},
+    ...entry.reusedSocket !== void 0 ? { reusedSocket: entry.reusedSocket } : {}
   }));
 }
 function writeProxyLifecycleLog(path, entry) {
@@ -7058,8 +7065,208 @@ function resignMachOBinary(path) {
   }
 }
 
-// src/bun-bundle.ts
+// src/bun-compiled-pointer.ts
 import { closeSync as closeSync3, openSync as openSync3, readSync as readSync2, writeSync as writeSync3 } from "fs";
+var TWEAKCC_SCAN_STRIDE = 16384n;
+var SCAN_CHUNK = 1 << 20;
+var ELF_MAGIC = 1179403647;
+var ELFCLASS64 = 2;
+var ELFDATA2LSB = 1;
+var PT_LOAD = 1;
+var PF_W = 2;
+function readAt2(fd, length, position) {
+  const buf = Buffer.alloc(length);
+  let read = 0;
+  while (read < length) {
+    const n = readSync2(fd, buf, read, length - read, position + read);
+    if (n <= 0) break;
+    read += n;
+  }
+  return read === length ? buf : buf.subarray(0, read);
+}
+function readElfLayout(fd) {
+  const ident = readAt2(fd, 64, 0);
+  if (ident.length < 64) return null;
+  if (ident.readUInt32LE(0) !== ELF_MAGIC) return null;
+  if (ident[4] !== ELFCLASS64 || ident[5] !== ELFDATA2LSB) return null;
+  const phoff = ident.readBigUInt64LE(32);
+  const shoff = ident.readBigUInt64LE(40);
+  const phentsize = ident.readUInt16LE(54);
+  const phnum = ident.readUInt16LE(56);
+  const shentsize = ident.readUInt16LE(58);
+  const shnum = ident.readUInt16LE(60);
+  const shstrndx = ident.readUInt16LE(62);
+  if (shnum === 0 || phnum === 65535) return null;
+  if (shstrndx >= shnum || shentsize < 64 || phentsize < 56) return null;
+  const shTable = readAt2(fd, shnum * shentsize, Number(shoff));
+  if (shTable.length !== shnum * shentsize) return null;
+  const raw = [];
+  for (let i = 0; i < shnum; i++) {
+    const at = i * shentsize;
+    raw.push({
+      nameOffset: shTable.readUInt32LE(at),
+      addr: shTable.readBigUInt64LE(at + 16),
+      offset: shTable.readBigUInt64LE(at + 24),
+      size: shTable.readBigUInt64LE(at + 32)
+    });
+  }
+  const strtab = raw[shstrndx];
+  const names = readAt2(fd, Number(strtab.size), Number(strtab.offset));
+  const sections = raw.map((section) => {
+    const start = section.nameOffset;
+    let end = start;
+    while (end < names.length && names[end] !== 0) end++;
+    return {
+      name: names.toString("utf8", start, end),
+      addr: section.addr,
+      offset: section.offset,
+      size: section.size
+    };
+  });
+  const phTable = readAt2(fd, phnum * phentsize, Number(phoff));
+  if (phTable.length !== phnum * phentsize) return null;
+  const segments = [];
+  for (let i = 0; i < phnum; i++) {
+    const at = i * phentsize;
+    segments.push({
+      type: phTable.readUInt32LE(at),
+      flags: phTable.readUInt32LE(at + 4),
+      offset: phTable.readBigUInt64LE(at + 8),
+      vaddr: phTable.readBigUInt64LE(at + 16),
+      filesz: phTable.readBigUInt64LE(at + 32)
+    });
+  }
+  return { sections, segments };
+}
+function alignUp(value, to) {
+  return (value + to - 1n) / to * to;
+}
+function writableLoad(layout) {
+  return layout.segments.find((segment) => segment.type === PT_LOAD && (segment.flags & PF_W) !== 0);
+}
+function fileOffsetOf(layout, vaddr, length) {
+  let found = null;
+  for (const segment of layout.segments) {
+    if (segment.type !== PT_LOAD) continue;
+    if (vaddr < segment.vaddr) continue;
+    if (vaddr + length > segment.vaddr + segment.filesz) continue;
+    if (found !== null) return null;
+    found = Number(segment.offset + (vaddr - segment.vaddr));
+  }
+  return found;
+}
+function tweakccWouldFind(fd, segment, needle) {
+  const first = alignUp(segment.vaddr, TWEAKCC_SCAN_STRIDE);
+  const last = segment.vaddr + segment.filesz - 8n;
+  for (let vaddr = first; vaddr <= last; vaddr += TWEAKCC_SCAN_STRIDE) {
+    const at = Number(segment.offset + (vaddr - segment.vaddr));
+    if (readAt2(fd, 8, at).equals(needle)) return vaddr;
+  }
+  return null;
+}
+function scanForNeedle(fd, from, to, needle, skipFrom, skipTo) {
+  const hits = [];
+  for (let start = from; start < to; start += SCAN_CHUNK - 7) {
+    const length = Math.min(SCAN_CHUNK, to - start);
+    if (length < 8) break;
+    const chunk = readAt2(fd, length, start);
+    let at = 0;
+    for (; ; ) {
+      const found = chunk.indexOf(needle, at);
+      if (found < 0) break;
+      const offset = start + found;
+      if (offset < skipFrom || offset >= skipTo) hits.push(offset);
+      at = found + 1;
+    }
+  }
+  return hits;
+}
+function shimBunCompiledPointer(path) {
+  const fd = openSync3(path, "r+");
+  try {
+    const layout = readElfLayout(fd);
+    if (!layout) return null;
+    const bun = layout.sections.find((section) => section.name === ".bun");
+    if (!bun || bun.size === 0n) return null;
+    const segment = writableLoad(layout);
+    if (!segment) return null;
+    const needle = Buffer.alloc(8);
+    needle.writeBigUInt64LE(bun.addr);
+    if (tweakccWouldFind(fd, segment, needle) !== null) return null;
+    const segmentStart = Number(segment.offset);
+    const segmentEnd = Number(segment.offset + segment.filesz);
+    const bunStart = Number(bun.offset);
+    const bunEnd = Number(bun.offset + bun.size);
+    const candidates = scanForNeedle(fd, segmentStart, segmentEnd, needle, bunStart, bunEnd);
+    if (candidates.length !== 1) {
+      throw new Error(
+        `cannot locate Bun's blob pointer: ${candidates.length} candidates in the writable segment (expected 1). Refusing to repack a binary whose Bun global would be left stale.`
+      );
+    }
+    const pointerOffset = candidates[0];
+    const pointerVaddr = segment.vaddr + BigInt(pointerOffset) - segment.offset;
+    const first = alignUp(segment.vaddr, TWEAKCC_SCAN_STRIDE);
+    const last = segment.vaddr + segment.filesz - 8n;
+    let standInVaddr = null;
+    for (let vaddr = first; vaddr <= last; vaddr += TWEAKCC_SCAN_STRIDE) {
+      const at = Number(segment.offset + (vaddr - segment.vaddr));
+      if (at + 8 > bunStart && at < bunEnd) continue;
+      if (at + 8 > pointerOffset && at < pointerOffset + 8) continue;
+      standInVaddr = vaddr;
+      break;
+    }
+    if (standInVaddr === null) {
+      throw new Error("no address tweakcc's ELF repack scans is usable for Bun's blob pointer");
+    }
+    const standInOffset = Number(segment.offset + (standInVaddr - segment.vaddr));
+    const displaced = readAt2(fd, 8, standInOffset);
+    if (displaced.length !== 8) throw new Error("could not read the bytes Bun's blob pointer displaces");
+    writeSync3(fd, needle, 0, 8, standInOffset);
+    return { pointerVaddr, standInVaddr, displaced, bunVaddr: bun.addr };
+  } finally {
+    closeSync3(fd);
+  }
+}
+function restoreBunCompiledPointer(path, shim) {
+  const fd = openSync3(path, "r+");
+  try {
+    const layout = readElfLayout(fd);
+    if (!layout) throw new Error("the repacked binary is no longer a 64-bit little-endian ELF");
+    const bun = layout.sections.find((section) => section.name === ".bun");
+    if (!bun) throw new Error("the repacked binary has no .bun section");
+    const standInOffset = fileOffsetOf(layout, shim.standInVaddr, 8n);
+    const pointerOffset = fileOffsetOf(layout, shim.pointerVaddr, 8n);
+    if (standInOffset === null || pointerOffset === null) {
+      throw new Error(
+        "the repack left Bun's blob pointer outside the loaded image, or in more than one segment of it"
+      );
+    }
+    const written = readAt2(fd, 8, standInOffset).readBigUInt64LE(0);
+    if (written === shim.bunVaddr) {
+      throw new Error("the repack did not rewrite Bun's blob pointer \u2014 the stand-in was not used");
+    }
+    if (written !== bun.addr) {
+      throw new Error(
+        `the repack pointed Bun at 0x${written.toString(16)} but put .bun at 0x${bun.addr.toString(16)}`
+      );
+    }
+    const value = Buffer.alloc(8);
+    value.writeBigUInt64LE(written);
+    writeSync3(fd, value, 0, 8, pointerOffset);
+    writeSync3(fd, shim.displaced, 0, 8, standInOffset);
+    if (!readAt2(fd, 8, pointerOffset).equals(value)) {
+      throw new Error("Bun's blob pointer did not take the repacked address");
+    }
+    if (!readAt2(fd, 8, standInOffset).equals(shim.displaced)) {
+      throw new Error("the bytes the stand-in displaced were not restored");
+    }
+  } finally {
+    closeSync3(fd);
+  }
+}
+
+// src/bun-bundle.ts
+import { closeSync as closeSync4, openSync as openSync4, readSync as readSync3, writeSync as writeSync4 } from "fs";
 function writableModuleIndex(path) {
   const table = readBunModuleTable(path);
   if (!table) return null;
@@ -7175,18 +7382,18 @@ function placeholderOf(byteLength) {
   return PLACEHOLDER_TEXT.repeat(Math.ceil(byteLength / PLACEHOLDER_TEXT.length)).slice(0, byteLength);
 }
 function readBlobData(path, table, into) {
-  const fd = openSync3(path, "r");
+  const fd = openSync4(path, "r");
   try {
     let read = 0;
     while (read < table.byteCount) {
-      const got = readSync2(fd, into, read, table.byteCount - read, table.blobAt + read);
+      const got = readSync3(fd, into, read, table.byteCount - read, table.blobAt + read);
       if (got <= 0) {
         throw new Error(`read ${read} of the ${table.byteCount} blob bytes of ${path}`);
       }
       read += got;
     }
   } finally {
-    closeSync3(fd);
+    closeSync4(fd);
   }
 }
 function repointModule(data, table, append) {
@@ -7238,7 +7445,7 @@ function applyBundleWritePlan(path, plan) {
   }
   const offsets = Buffer.from(plan.offsets);
   offsets.writeBigUInt64LE(BigInt(byteCount), 0);
-  const fd = openSync3(path, "r+");
+  const fd = openSync4(path, "r+");
   try {
     writeAll(fd, plan.data, repacked.blobAt, path);
     const padding = byteCount - plan.data.length;
@@ -7246,7 +7453,7 @@ function applyBundleWritePlan(path, plan) {
     writeAll(fd, offsets, repacked.blobAt + byteCount, path);
     writeAll(fd, BUN_TRAILER2, repacked.blobAt + byteCount + BUN_OFFSETS_BYTES2, path);
   } finally {
-    closeSync3(fd);
+    closeSync4(fd);
   }
   const published = readBunModuleTable(path);
   if (!published) throw new Error(`cannot re-read the Bun module table of ${path} after publishing its blob`);
@@ -7274,7 +7481,7 @@ function applyBundleWritePlan(path, plan) {
 function writeAll(fd, bytes, position, path) {
   let written = 0;
   while (written < bytes.length) {
-    const wrote = writeSync3(fd, bytes, written, bytes.length - written, position + written);
+    const wrote = writeSync4(fd, bytes, written, bytes.length - written, position + written);
     if (wrote <= 0) throw new Error(`wrote ${written} of ${bytes.length} blob bytes to ${path}`);
     written += wrote;
   }
@@ -10160,7 +10367,7 @@ function thinkingProviderOptions(npm) {
 
 // src/proxy.ts
 import { createServer } from "http";
-import { appendFileSync as appendFileSync2, openSync as openSync4, writeSync as writeSync4, closeSync as closeSync4 } from "fs";
+import { appendFileSync as appendFileSync2, openSync as openSync5, writeSync as writeSync5, closeSync as closeSync5 } from "fs";
 
 // src/http-utils.ts
 import * as zlib from "zlib";
@@ -10736,6 +10943,18 @@ function upstreamMaxRetries(env = process.env, warn = (message) => emitParentNot
   }
   return value;
 }
+var CLIENT_MAX_RETRIES_ENV = "CLAUDE_CODE_MAX_RETRIES";
+var DEFAULT_PASSTHROUGH_RETRIES = 1;
+function passthroughUpstreamRetries(env = process.env) {
+  const explicit = upstreamMaxRetries(env);
+  if (explicit !== void 0) return explicit;
+  const raw = env[CLIENT_MAX_RETRIES_ENV]?.trim();
+  if (raw !== void 0 && raw !== "") {
+    const clientRetries = Number(raw);
+    if (Number.isFinite(clientRetries) && clientRetries === 0) return 0;
+  }
+  return DEFAULT_PASSTHROUGH_RETRIES;
+}
 
 // src/sdk-adapter.ts
 function sdkTranslationErrorSignature(error) {
@@ -11635,12 +11854,12 @@ function createTranslationLifecycle(logPath, requestId, claudeSessionId, modelId
 function appendSecureLog(logPath, line) {
   const redacted = redactTraceLine(line);
   try {
-    const fd = openSync4(logPath, "a", 384);
+    const fd = openSync5(logPath, "a", 384);
     try {
-      writeSync4(fd, `${(/* @__PURE__ */ new Date()).toISOString()} ${redacted}
+      writeSync5(fd, `${(/* @__PURE__ */ new Date()).toISOString()} ${redacted}
 `);
     } finally {
-      closeSync4(fd);
+      closeSync5(fd);
     }
   } catch {
     try {
@@ -12503,10 +12722,10 @@ function tryAcquirePatchLock(lockPath = getPatchLockPath(), opts = {}) {
   mkdirSync5(join7(lockPath, ".."), { recursive: true, mode: 448 });
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
-      const fd = openSync5(lockPath, "wx");
+      const fd = openSync6(lockPath, "wx");
       const content = { pid: process.pid, startedAt: now };
       writeFileSync5(fd, JSON.stringify(content));
-      closeSync5(fd);
+      closeSync6(fd);
       return () => {
         try {
           unlinkSync3(lockPath);
@@ -12766,11 +12985,15 @@ async function applyPatch(binaryPath, version, desired, configHash, opts) {
         splitBundleSource(loaded.bundle, local.content),
         writable
       );
+      const bunPointerShim = shimBunCompiledPointer(candidatePath);
       await writeContent(loaded.installation, plan2.content);
+      if (bunPointerShim) restoreBunCompiledPointer(candidatePath, bunPointerShim);
       applyBundleWritePlan(candidatePath, plan2);
       publishedBlob = true;
     } else {
+      const bunPointerShim = shimBunCompiledPointer(candidatePath);
       await writeContent(loaded.installation, local.content);
+      if (bunPointerShim) restoreBunCompiledPointer(candidatePath, bunPointerShim);
     }
     if (writeShim) restoreEntryModuleName(candidatePath, writeShim, { resign: true });
     else if (publishedBlob) resignMachOBinary(candidatePath);
@@ -13291,13 +13514,13 @@ function localProvidersToServerModels(localProviders) {
 // src/registry/credential-cleanup-journal.ts
 import { randomUUID as randomUUID4 } from "crypto";
 import {
-  closeSync as closeSync6,
+  closeSync as closeSync7,
   existsSync as existsSync6,
   fstatSync,
   fsyncSync as fsyncSync2,
   lstatSync,
   mkdirSync as mkdirSync6,
-  openSync as openSync6,
+  openSync as openSync7,
   readFileSync as readFileSync9,
   renameSync as renameSync3,
   unlinkSync as unlinkSync4,
@@ -13389,7 +13612,7 @@ function readJournalUnlocked(path) {
     if (before.isSymbolicLink() || !before.isFile()) {
       throw new Error("Credential cleanup journal must be a regular file.");
     }
-    fd = openSync6(path, "r");
+    fd = openSync7(path, "r");
     const opened = fstatSync(fd);
     if (before.dev !== opened.dev || before.ino !== opened.ino) {
       throw new Error("Credential cleanup journal changed while opening.");
@@ -13410,19 +13633,19 @@ function readJournalUnlocked(path) {
     const message = error instanceof Error ? error.message : String(error);
     throw new Error(`Could not read credential cleanup journal: ${message}`);
   } finally {
-    if (fd !== void 0) closeSync6(fd);
+    if (fd !== void 0) closeSync7(fd);
   }
 }
 function syncParentDirectory(path) {
   let fd;
   try {
-    fd = openSync6(dirname4(path), "r");
+    fd = openSync7(dirname4(path), "r");
     fsyncSync2(fd);
   } catch (error) {
     const code = error.code;
     if (code !== "EINVAL" && code !== "ENOTSUP" && code !== "EPERM") throw error;
   } finally {
-    if (fd !== void 0) closeSync6(fd);
+    if (fd !== void 0) closeSync7(fd);
   }
 }
 function writeJournalUnlocked(journal, path) {
@@ -13432,17 +13655,17 @@ function writeJournalUnlocked(journal, path) {
   const tmp = `${path}.${process.pid}.${randomUUID4()}.tmp`;
   let fd;
   try {
-    fd = openSync6(tmp, "wx", FILE_MODE4);
+    fd = openSync7(tmp, "wx", FILE_MODE4);
     writeFileSync6(fd, `${JSON.stringify(journal, null, 2)}
 `);
     fsyncSync2(fd);
-    closeSync6(fd);
+    closeSync7(fd);
     fd = void 0;
     assertRegistryWriteOwnership(path);
     renameSync3(tmp, path);
     syncParentDirectory(path);
   } finally {
-    if (fd !== void 0) closeSync6(fd);
+    if (fd !== void 0) closeSync7(fd);
     try {
       unlinkSync4(tmp);
     } catch (error) {
@@ -17391,20 +17614,37 @@ function ensureHttpProxyCertificates() {
     serverKey: readFileSync10(paths.serverKey, "utf8")
   };
 }
-function ensureHttpProxyCaBundle(relayCaCertPath, additionalCaCertPath) {
+function ensureHttpProxyCaBundle(relayCaCertPath, additionalCaCertPath, onWarning) {
   if (!additionalCaCertPath?.trim()) return relayCaCertPath;
+  const warn = (detail) => {
+    onWarning?.(
+      `${detail} The CA bundle handed to the child is ${relayCaCertPath}; node's built-in roots are unaffected.`
+    );
+    return relayCaCertPath;
+  };
+  let additionalCa;
   try {
     if (resolve2(additionalCaCertPath) === resolve2(relayCaCertPath)) return relayCaCertPath;
+    additionalCa = readFileSync10(additionalCaCertPath, "utf8").trim();
+  } catch (err) {
+    return warn(
+      `NODE_EXTRA_CA_CERTS=${additionalCaCertPath} cannot be read (${err instanceof Error ? err.message : String(err)}), so it is not part of the proxy CA bundle. Where node reports this itself it says only "Ignoring extra certs ... load failed", without naming the variable. Clear or correct it.`
+    );
+  }
+  if (!additionalCa) {
+    return warn(`NODE_EXTRA_CA_CERTS=${additionalCaCertPath} is empty, so it adds nothing.`);
+  }
+  try {
     const relayCa = readFileSync10(relayCaCertPath, "utf8").trimEnd();
-    const additionalCa = readFileSync10(additionalCaCertPath, "utf8").trim();
-    if (!additionalCa) return relayCaCertPath;
     const combinedPath = join8(dirname5(relayCaCertPath), "combined-ca.pem");
     writePublic(combinedPath, `${relayCa}
 ${additionalCa}
 `);
     return combinedPath;
-  } catch {
-    return relayCaCertPath;
+  } catch (err) {
+    return warn(
+      `clodex could not build the combined CA bundle in ${dirname5(relayCaCertPath)} (${err instanceof Error ? err.message : String(err)}), so the readable, non-empty NODE_EXTRA_CA_CERTS=${additionalCaCertPath} was left out of it. Fix the reported error and restart clodex.`
+    );
   }
 }
 
@@ -17413,6 +17653,16 @@ var ANTHROPIC_HOST = "api.anthropic.com";
 var MAX_BODY_BYTES = 50 * 1024 * 1024;
 var MAX_ERROR_BODY_BYTES = 64 * 1024;
 var MAX_USAGE_SSE_BLOCK_BYTES = 64 * 1024;
+var RETRYABLE_PASSTHROUGH_CODE = "ECONNRESET";
+function upstreamUnreachableDetail(err) {
+  return err.message || err.code || err.name || "connection failed";
+}
+function createPassthroughAgent() {
+  return new https.Agent({
+    keepAlive: true,
+    timeout: https.globalAgent.options.timeout ?? 5e3
+  });
+}
 function numericUsage(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : void 0;
 }
@@ -17561,6 +17811,7 @@ function requestHeadersWithoutProxyHeaders(req) {
 function forwardRawAnthropicRequest(req, res, rawBody, origin, rejectUnauthorized, agent, onErrorResponse, onResponseUsage, lifecycle, isLocalShutdown = () => false) {
   return new Promise((resolve3) => {
     const startedAt = Date.now();
+    const retryBudget = passthroughUpstreamRetries();
     let lastActivityAt = startedAt;
     let headersReceived = false;
     let firstByteAt;
@@ -17610,42 +17861,91 @@ function forwardRawAnthropicRequest(req, res, rawBody, origin, rejectUnauthorize
       resolve3();
     };
     const errorType = (err) => err.code ?? err.name;
-    const upstream = https.request({
-      protocol: "https:",
-      hostname: origin.hostname,
-      port: origin.port || 443,
-      method: req.method,
-      path: req.url,
-      headers: requestHeadersWithoutProxyHeaders(req),
-      servername: net.isIP(origin.hostname) ? void 0 : origin.hostname,
-      rejectUnauthorized,
-      agent
-    }, (upstreamRes) => {
-      headersReceived = true;
-      statusCode = upstreamRes.statusCode ?? 502;
-      lastActivityAt = Date.now();
-      upstreamRes.on("data", (chunk) => {
-        const now = Date.now();
-        if (firstByteAt === void 0) {
-          firstByteAt = now;
-          writeLifecycle("response_started", {
+    let upstream;
+    let attempt = 0;
+    const isRetryableUpstreamFailure = (err, request3) => attempt <= retryBudget && !headersReceived && !failed && !clientDisconnected && !isLocalShutdown() && request3.reusedSocket === true && err.code === RETRYABLE_PASSTHROUGH_CODE;
+    const sendAttempt = () => {
+      attempt += 1;
+      const request3 = https.request({
+        protocol: "https:",
+        hostname: origin.hostname,
+        port: origin.port || 443,
+        method: req.method,
+        path: req.url,
+        headers: requestHeadersWithoutProxyHeaders(req),
+        servername: net.isIP(origin.hostname) ? void 0 : origin.hostname,
+        rejectUnauthorized,
+        agent
+      }, (upstreamRes) => {
+        headersReceived = true;
+        statusCode = upstreamRes.statusCode ?? 502;
+        lastActivityAt = Date.now();
+        upstreamRes.on("data", (chunk) => {
+          const now = Date.now();
+          if (firstByteAt === void 0) {
+            firstByteAt = now;
+            writeLifecycle("response_started", {
+              statusCode,
+              durationMs: now - startedAt,
+              timeToFirstByteMs: now - startedAt,
+              ...attempt > 1 ? { attempt } : {}
+            });
+          }
+          lastActivityAt = now;
+          bytes += chunk.length;
+          chunks += 1;
+        });
+        copyResponse(upstreamRes, res, onErrorResponse, onResponseUsage);
+        upstreamRes.once("end", () => {
+          responseEnded = true;
+          lastActivityAt = Date.now();
+          done();
+        });
+        upstreamRes.once("error", (err) => {
+          if (clientDisconnected || failed) {
+            done();
+            return;
+          }
+          failed = true;
+          stopProgress();
+          const now = Date.now();
+          writeLifecycle("response_failed", {
             statusCode,
+            phase: responsePhase(),
             durationMs: now - startedAt,
-            timeToFirstByteMs: now - startedAt
+            ...firstByteAt !== void 0 ? { timeToFirstByteMs: firstByteAt - startedAt } : {},
+            idleMs: now - lastActivityAt,
+            bytes,
+            chunks,
+            errorType: errorType(err),
+            terminationSource: "upstream_failure",
+            attempt
           });
-        }
-        lastActivityAt = now;
-        bytes += chunk.length;
-        chunks += 1;
-      });
-      copyResponse(upstreamRes, res, onErrorResponse, onResponseUsage);
-      upstreamRes.once("end", () => {
-        responseEnded = true;
-        lastActivityAt = Date.now();
-        done();
+          done();
+        });
       });
-      upstreamRes.once("error", (err) => {
-        if (clientDisconnected || failed) {
+      upstream = request3;
+      request3.once("error", (err) => {
+        if (clientDisconnected) {
+          done();
+          return;
+        }
+        if (isRetryableUpstreamFailure(err, request3)) {
+          const retriedAt = Date.now();
+          writeLifecycle("response_retried", {
+            phase: responsePhase(),
+            durationMs: retriedAt - startedAt,
+            idleMs: retriedAt - lastActivityAt,
+            errorType: errorType(err),
+            terminationSource: "upstream_failure",
+            attempt,
+            reusedSocket: true
+          });
+          lastActivityAt = retriedAt;
+          sendAttempt();
+          return;
+        }
+        if (failed) {
           done();
           return;
         }
@@ -17653,19 +17953,25 @@ function forwardRawAnthropicRequest(req, res, rawBody, origin, rejectUnauthorize
         stopProgress();
         const now = Date.now();
         writeLifecycle("response_failed", {
-          statusCode,
+          statusCode: 502,
           phase: responsePhase(),
           durationMs: now - startedAt,
-          ...firstByteAt !== void 0 ? { timeToFirstByteMs: firstByteAt - startedAt } : {},
           idleMs: now - lastActivityAt,
           bytes,
           chunks,
           errorType: errorType(err),
-          terminationSource: "upstream_failure"
+          terminationSource: isLocalShutdown() ? "local_shutdown" : "upstream_failure",
+          attempt,
+          reusedSocket: request3.reusedSocket === true
         });
+        const detail = upstreamUnreachableDetail(err);
+        onErrorResponse?.(502, `Anthropic upstream unreachable: ${detail}`);
+        if (!res.headersSent) res.writeHead(502, { "Content-Type": "text/plain" });
+        res.end(`Anthropic upstream unreachable: ${detail}`);
         done();
       });
-    });
+      request3.end(rawBody);
+    };
     res.once("finish", () => {
       stopProgress();
       if (failed || clientDisconnected) return;
@@ -17675,7 +17981,8 @@ function forwardRawAnthropicRequest(req, res, rawBody, origin, rejectUnauthorize
         durationMs: now - startedAt,
         ...firstByteAt !== void 0 ? { timeToFirstByteMs: firstByteAt - startedAt } : {},
         bytes,
-        chunks
+        chunks,
+        ...attempt > 1 ? { attempt } : {}
       });
     });
     res.once("close", () => {
@@ -17693,33 +18000,10 @@ function forwardRawAnthropicRequest(req, res, rawBody, origin, rejectUnauthorize
         chunks,
         terminationSource: isLocalShutdown() ? "local_shutdown" : "downstream_client"
       });
-      upstream.destroy(new Error("Client disconnected"));
-      done();
-    });
-    upstream.once("error", (err) => {
-      if (clientDisconnected) {
-        done();
-        return;
-      }
-      failed = true;
-      stopProgress();
-      const now = Date.now();
-      writeLifecycle("response_failed", {
-        statusCode: 502,
-        phase: responsePhase(),
-        durationMs: now - startedAt,
-        idleMs: now - lastActivityAt,
-        bytes,
-        chunks,
-        errorType: errorType(err),
-        terminationSource: "upstream_failure"
-      });
-      onErrorResponse?.(502, `Anthropic upstream unreachable: ${err.message}`);
-      if (!res.headersSent) res.writeHead(502, { "Content-Type": "text/plain" });
-      res.end(`Anthropic upstream unreachable: ${err.message}`);
+      upstream?.destroy(new Error("Client disconnected"));
       done();
     });
-    upstream.end(rawBody);
+    sendAttempt();
   });
 }
 function forwardToAdapter(req, res, rawBody, adapter, adapterRequest = http2.request, adapterAgent, lifecycle, isLocalShutdown = () => false) {
@@ -18196,6 +18480,7 @@ async function startHttpProxy(options) {
   } else {
     anthropicAgent = outboundHttpProxyAgent(anthropicOrigin.href);
   }
+  anthropicAgent ??= createPassthroughAgent();
   return {
     host: options.host ?? "127.0.0.1",
     port: address.port,
@@ -18329,11 +18614,15 @@ async function startConfiguredHttpProxy(port, debug = false, inferenceLogPath =
     debugLogPath,
     webSocketDiagnosticsLogPath
   ));
+  let caWarning;
   handle.caCertPath = ensureHttpProxyCaBundle(
     handle.caCertPath,
-    process.env["NODE_EXTRA_CA_CERTS"]
+    process.env["NODE_EXTRA_CA_CERTS"],
+    (message) => {
+      caWarning = message;
+    }
   );
-  return { handle, loaded };
+  return { handle, loaded, ...caWarning ? { caWarning } : {} };
 }
 function waitForShutdown() {
   return new Promise((resolve3) => {
@@ -18362,7 +18651,7 @@ async function runHttpProxyServerCommand(debug = false, webSocketDiagnostics = f
     p9.log.error(`Failed to start HTTP proxy: ${err instanceof Error ? err.message : String(err)}`);
     return 1;
   }
-  const { handle, loaded } = started;
+  const { handle, loaded, caWarning } = started;
   writeProxyLifecycleLog(inferenceLogPath, {
     event: "proxy_started",
     pid: process.pid,
@@ -18374,6 +18663,10 @@ async function runHttpProxyServerCommand(debug = false, webSocketDiagnostics = f
   console.log(pc10.bold(pc10.green("clodex proxy-mode server running")));
   for (const line of formatHttpProxyEnvironmentLines(handle)) console.log(line);
   console.log(`  Request log: ${handle.inferenceLogPath}`);
+  if (caWarning) {
+    console.log("");
+    console.log(pc10.yellow(`  clodex: ${caWarning}`));
+  }
   if (handle.webSocketDiagnosticsLogPath) {
     console.log(`  WebSocket diagnostics: ${handle.webSocketDiagnosticsLogPath}`);
     console.log(pc10.yellow("  Diagnostic mode records request headers and metadata; credential headers are redacted."));
@@ -19959,7 +20252,11 @@ async function runClaudeHttpProxyCommand(parsed, claudeArgs, agentStdout) {
     p12.log.error(`Failed to start proxy: ${err instanceof Error ? err.message : String(err)}`);
     return 1;
   }
-  const { handle, loaded } = started;
+  const { handle, loaded, caWarning } = started;
+  if (caWarning) {
+    if (agentStdout) emitParentNotice(`clodex: ${caWarning}`);
+    else p12.log.warn(caWarning);
+  }
   const inheritedProxyPort = (() => {
     const value = process.env["HTTPS_PROXY"] ?? process.env["HTTP_PROXY"] ?? process.env["https_proxy"] ?? process.env["http_proxy"];
     if (!value) return void 0;