claude-code-infinite 1.0.35 → 1.0.37

package/dist/https-proxy-mode.js

@@ -0,0 +1,255 @@
+/**
+ * ccc's loopback server as Claude Code's HTTPS_PROXY (opt-in: CCC_HTTPS_PROXY_MODE=1 or
+ * the `httpsProxyMode` config key; https-proxy-session.ts decides and sets it up). Claude
+ * Code then keeps api.anthropic.com as its base URL, and with it Remote Control, while its
+ * model calls still reach ccc and MemTree.
+ *
+ * - A CONNECT without this session's proxy token gets 407: other local users and programs
+ *   can use neither the tunnel nor the interception.
+ * - CONNECT api.anthropic.com:443: TLS is terminated with the session CA's leaf
+ *   (mitm-ca.ts) and the decrypted stream goes to a separate, never-listening http.Server
+ *   that shares ccc's request handler. proxy.ts routes only POST /v1/messages and
+ *   /v1/messages/count_tokens from it to MemTree; every other path (Remote Control's
+ *   bridge, sessions, files, OAuth, telemetry) goes verbatim to api.anthropic.com, and
+ *   ccc's loopback-only routes (hooks, /memtree/*) are not reachable from it.
+ * - Every other CONNECT: a blind TCP tunnel. ccc never decrypts or logs those bytes.
+ * - An HTTP upgrade (WebSocket) on an intercepted stream: piped raw to api.anthropic.com
+ *   over a fresh TLS connection. The loopback server itself gets no upgrade listener, so
+ *   its requests behave exactly as without proxy mode.
+ *
+ * The optional trace (CCC_PROXY_TRACE) records CONNECT targets and, for intercepted
+ * requests, method, path (no query), status and User-Agent: no other header values, no
+ * bodies.
+ */
+import http from "node:http";
+import net from "node:net";
+import tls from "node:tls";
+import { appendFileSync } from "node:fs";
+import { timingSafeEqual } from "node:crypto";
+import { INTERCEPT_HOST } from "./mitm-ca.js";
+/** The user name in HTTPS_PROXY; the session token is its password. */
+export const PROXY_USER = "ccc";
+/** The HTTPS_PROXY value Claude Code gets: the loopback port with the token. */
+export function proxyUrlFor(port, proxyToken) {
+    return `http://${PROXY_USER}:${proxyToken}@127.0.0.1:${port}`;
+}
+export function attachHttpsProxyMode(server, onInterceptedRequest, upstream, opts) {
+    const tunnels = new TunnelSet();
+    const trace = tracer(opts.tracePath);
+    const secureContext = tls.createSecureContext({
+        cert: opts.ca.leafCertPem, key: opts.ca.leafKeyPem,
+    });
+    const intercept = interceptServer(onInterceptedRequest, upstream, tunnels, trace);
+    server.on("connect", (req, socket, head) => {
+        onConnect(req, socket, head, { intercept, secureContext, tunnels, trace, opts });
+    });
+    return {
+        // Drain starts: blind tunnels carry no ccc work, and idle decrypted keep-alive
+        // connections none either (a never-listening server can't close those itself).
+        blind: () => {
+            tunnels.destroyBlind();
+            tunnels.closeIdleIntercepted();
+        },
+        all: () => tunnels.destroyAll(),
+    };
+}
+function onConnect(req, socket, head, ctx) {
+    const target = parseAuthority(req.url ?? "");
+    const mitm = target !== null && target.host === INTERCEPT_HOST && target.port === 443;
+    ctx.trace({ ev: "connect", target: req.url, ua: userAgent(req), mitm });
+    // Before any answer: a reset must not be an unhandled error, and drain must see it.
+    socket.on("error", () => { });
+    if (!ctx.tunnels.track(socket, mitm ? "intercepted" : "blind"))
+        return;
+    if (!target)
+        return refuse(socket, "HTTP/1.1 400 Bad Request\r\n\r\n");
+    if (!authorized(req, ctx.opts.proxyToken)) {
+        ctx.trace({ ev: "connect_refused", target: req.url });
+        return refuse(socket, "HTTP/1.1 407 Proxy Authentication Required\r\n" +
+            `Proxy-Authenticate: Basic realm="${PROXY_USER}"\r\n\r\n`);
+    }
+    if (mitm) {
+        return interceptConnect(ctx.intercept, socket, head, ctx.secureContext, ctx.tunnels, ctx.trace);
+    }
+    tunnelConnect(socket, head, target.host, target.port, ctx.trace);
+}
+/**
+ * The decrypted api.anthropic.com streams' own server: never listening, fed only by
+ * interceptConnect, so nothing on the loopback port can reach it.
+ */
+function interceptServer(onRequest, upstream, tunnels, trace) {
+    const server = http.createServer(onRequest);
+    // Same as the loopback server: long SSE responses and long polls must not be cut.
+    server.requestTimeout = 0;
+    server.headersTimeout = 60_000;
+    server.on("upgrade", (req, socket, head) => {
+        trace({ ev: "upgrade", path: pathOf(req) });
+        socket.on("error", () => { });
+        if (!tunnels.track(socket, "intercepted"))
+            return;
+        tunnels.requestStarted(socket); // a live WebSocket is never idle: only the deadline cuts it
+        upgradeToUpstream(req, socket, head, upstream);
+    });
+    server.on("request", (req, res) => {
+        tunnels.requestStarted(req.socket);
+        res.once("close", () => tunnels.requestEnded(req.socket));
+        const started = Date.now();
+        res.on("finish", () => trace({
+            ev: "request", method: req.method, path: pathOf(req), status: res.statusCode,
+            ms: Date.now() - started, ua: userAgent(req),
+        }));
+    });
+    return server;
+}
+function interceptConnect(intercept, socket, head, secureContext, tunnels, trace) {
+    socket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+    if (head.length > 0)
+        socket.unshift(head);
+    const tlsSocket = new tls.TLSSocket(socket, {
+        isServer: true, secureContext, ALPNProtocols: ["http/1.1"],
+    });
+    tlsSocket.on("error", (err) => {
+        trace({ ev: "tls_error", message: err.message });
+        socket.destroy();
+    });
+    intercept.emit("connection", tlsSocket);
+    return tunnels.trackDecrypted(tlsSocket);
+}
+function tunnelConnect(socket, head, host, port, trace) {
+    let established = false;
+    const upstream = net.connect(port, host, () => {
+        established = true;
+        socket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+        if (head.length > 0)
+            upstream.write(head);
+        upstream.pipe(socket);
+        socket.pipe(upstream);
+    });
+    upstream.on("error", (err) => {
+        trace({ ev: "tunnel_error", host, port, message: err.message });
+        if (socket.destroyed)
+            return;
+        if (established)
+            socket.destroy();
+        else
+            socket.end("HTTP/1.1 502 Bad Gateway\r\n\r\n");
+    });
+    socket.on("close", () => upstream.destroy());
+    upstream.on("close", () => socket.destroy());
+}
+/** Replays the upgrade request upstream byte for byte (headers as sent), then pipes. */
+function upgradeToUpstream(req, socket, head, upstream) {
+    const connected = () => {
+        const lines = [`${req.method} ${req.url} HTTP/1.1`];
+        for (let i = 0; i < req.rawHeaders.length; i += 2) {
+            lines.push(`${req.rawHeaders[i]}: ${req.rawHeaders[i + 1]}`);
+        }
+        up.write(`${lines.join("\r\n")}\r\n\r\n`);
+        if (head.length > 0)
+            up.write(head);
+        up.pipe(socket);
+        socket.pipe(up);
+    };
+    const up = upstream.secure
+        ? tls.connect({ host: upstream.host, port: upstream.port, servername: upstream.host,
+            ALPNProtocols: ["http/1.1"] }, connected)
+        : net.connect(upstream.port, upstream.host, connected);
+    up.on("error", () => socket.destroy());
+    socket.on("close", () => up.destroy());
+    up.on("close", () => socket.destroy());
+}
+/** Answer, then close: a refused client can't hold the socket open. */
+function refuse(socket, response) {
+    socket.end(response);
+    setTimeout(() => socket.destroy(), 1_000).unref();
+}
+function authorized(req, token) {
+    const credentials = Buffer.from(`${PROXY_USER}:${token}`).toString("base64");
+    const expected = Buffer.from(`Basic ${credentials}`);
+    const got = Buffer.from(String(req.headers["proxy-authorization"] ?? ""));
+    return got.length === expected.length && timingSafeEqual(got, expected);
+}
+/** host:port of a CONNECT (IPv6 in brackets); null when malformed. */
+export function parseAuthority(authority) {
+    const m = /^(?:\[([0-9a-fA-F:.]+)\]|([^\s:[\]/@]+)):(\d{1,5})$/.exec(authority);
+    if (!m)
+        return null;
+    const port = Number(m[3]);
+    const host = (m[1] ?? m[2]).toLowerCase();
+    return port > 0 && port < 65536 ? { host, port } : null;
+}
+function pathOf(req) {
+    return (req.url ?? "").split("?")[0];
+}
+function userAgent(req) {
+    return String(req.headers["user-agent"] ?? "");
+}
+function tracer(path) {
+    if (!path)
+        return () => { };
+    return (event) => {
+        try {
+            appendFileSync(path, `${JSON.stringify({ t: Date.now(), ...event })}\n`, { mode: 0o600 });
+        }
+        catch { /* tracing is best effort */ }
+    };
+}
+/**
+ * Raw CONNECT and upgrade sockets, by kind, so drain can close them; and each decrypted
+ * stream's requests in flight, so drain can close the idle ones at once.
+ */
+class TunnelSet {
+    sets = { blind: new Set(), intercepted: new Set() };
+    inFlight = new Map();
+    draining = false;
+    /** false (and the socket destroyed) once drain started: no new tunnels or upgrades. */
+    track(socket, kind) {
+        if (this.draining) {
+            socket.destroy();
+            return false;
+        }
+        const set = this.sets[kind];
+        set.add(socket);
+        socket.once("close", () => set.delete(socket));
+        return true;
+    }
+    trackDecrypted(socket) {
+        this.inFlight.set(socket, 0);
+        socket.once("close", () => this.inFlight.delete(socket));
+        if (this.draining)
+            socket.destroy();
+    }
+    requestStarted(socket) {
+        const n = this.inFlight.get(socket);
+        if (n !== undefined)
+            this.inFlight.set(socket, n + 1);
+    }
+    requestEnded(socket) {
+        const n = this.inFlight.get(socket);
+        if (n === undefined)
+            return;
+        this.inFlight.set(socket, n - 1);
+        if (this.draining && n - 1 <= 0)
+            socket.end();
+    }
+    destroyBlind() {
+        destroyAll(this.sets.blind);
+    }
+    /** Drain started: close idle decrypted streams now, busy ones after their request. */
+    closeIdleIntercepted() {
+        this.draining = true;
+        for (const [socket, n] of this.inFlight)
+            if (n <= 0)
+                socket.end();
+    }
+    destroyAll() {
+        destroyAll(this.sets.blind);
+        destroyAll(this.sets.intercepted);
+    }
+}
+function destroyAll(set) {
+    for (const socket of set)
+        socket.destroy();
+    set.clear();
+}
+//# sourceMappingURL=https-proxy-mode.js.map

package/dist/https-proxy-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"https-proxy-mode.js","sourceRoot":"","sources":["../src/https-proxy-mode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAkB,MAAM,cAAc,CAAC;AAE9D,uEAAuE;AACvE,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC;AA4BhC,gFAAgF;AAChF,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,UAAkB;IAC1D,OAAO,UAAU,UAAU,IAAI,UAAU,cAAc,IAAI,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,MAAmB,EACnB,oBAA0C,EAC1C,QAA2B,EAC3B,IAA2B;IAE3B,MAAM,OAAO,GAAG,IAAI,SAAS,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,aAAa,GAAG,GAAG,CAAC,mBAAmB,CAAC;QAC5C,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,UAAU;KACnD,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,eAAe,CAAC,oBAAoB,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAClF,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAyB,EAAE,MAAkB,EAAE,IAAY,EAAE,EAAE;QACnF,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IACH,OAAO;QACL,+EAA+E;QAC/E,+EAA+E;QAC/E,KAAK,EAAE,GAAG,EAAE;YACV,OAAO,CAAC,YAAY,EAAE,CAAC;YACvB,OAAO,CAAC,oBAAoB,EAAE,CAAC;QACjC,CAAC;QACD,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE;KAChC,CAAC;AACJ,CAAC;AAUD,SAAS,SAAS,CAChB,GAAyB,EAAE,MAAkB,EAAE,IAAY,EAAE,GAAmB;IAEhF,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,IAAI,MAAM,CAAC,IAAI,KAAK,GAAG,CAAC;IACtF,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACxE,oFAAoF;IACpF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC;QAAE,OAAO;IACvE,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,MAAM,EAAE,kCAAkC,CAAC,CAAC;IACvE,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QACtD,OAAO,MAAM,CAAC,MAAM,EAAE,gDAAgD;YACpE,oCAAoC,UAAU,WAAW,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IAClG,CAAC;IACD,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CACtB,SAA+B,EAAE,QAA2B,EAAE,OAAkB,EAChF,KAAY;IAEZ,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IAC5C,kFAAkF;IAClF,MAAM,CAAC,cAAc,GAAG,CAAC,CAAC;IAC1B,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC;IAC/B,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAyB,EAAE,MAAkB,EAAE,IAAY,EAAE,EAAE;QACnF,KAAK,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC;YAAE,OAAO;QAClD,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,4DAA4D;QAC5F,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAyB,EAAE,GAAwB,EAAE,EAAE;QAC3E,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC;YAC3B,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU;YAC5E,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC,GAAG,CAAC;SAC7C,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CACvB,SAAsB,EAAE,MAAkB,EAAE,IAAY,EAAE,aAAgC,EAC1F,OAAkB,EAAE,KAAY;IAEhC,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC5D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;QAC1C,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC,UAAU,CAAC;KAC3D,CAAC,CAAC;IACH,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QAC5B,KAAK,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACxC,OAAO,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,aAAa,CACpB,MAAkB,EAAE,IAAY,EAAE,IAAY,EAAE,IAAY,EAAE,KAAY;IAE1E,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;QAC5C,WAAW,GAAG,IAAI,CAAC;QACnB,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC5D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1C,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IACH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QAC3B,KAAK,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAChE,IAAI,MAAM,CAAC,SAAS;YAAE,OAAO;QAC7B,IAAI,WAAW;YAAE,MAAM,CAAC,OAAO,EAAE,CAAC;;YAC7B,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7C,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,wFAAwF;AACxF,SAAS,iBAAiB,CACxB,GAAyB,EAAE,MAAkB,EAAE,IAAY,EAAE,QAA2B;IAExF,MAAM,SAAS,GAAG,GAAS,EAAE;QAC3B,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC;QACpD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,MAAM,EAAE,GAAe,QAAQ,CAAC,MAAM;QACpC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI;YACjF,aAAa,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,CAAC;QAC3C,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACzD,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACvC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACvC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,uEAAuE;AACvE,SAAS,MAAM,CAAC,MAAkB,EAAE,QAAgB;IAClD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrB,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,GAAyB,EAAE,KAAa;IAC1D,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,IAAI,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,WAAW,EAAE,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1E,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC1E,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,MAAM,CAAC,GAAG,qDAAqD,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAChF,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1C,OAAO,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED,SAAS,MAAM,CAAC,GAAyB;IACvC,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,SAAS,CAAC,GAAyB;IAC1C,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;AACjD,CAAC;AAID,SAAS,MAAM,CAAC,IAAwB;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IAC3B,OAAO,CAAC,KAAK,EAAE,EAAE;QACf,IAAI,CAAC;YACH,cAAc,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5F,CAAC;QAAC,MAAM,CAAC,CAAC,4BAA4B,CAAC,CAAC;IAC1C,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,SAAS;IACI,IAAI,GAAG,EAAE,KAAK,EAAE,IAAI,GAAG,EAAc,EAAE,WAAW,EAAE,IAAI,GAAG,EAAc,EAAE,CAAC;IAC5E,QAAQ,GAAG,IAAI,GAAG,EAAsB,CAAC;IAClD,QAAQ,GAAG,KAAK,CAAC;IAEzB,uFAAuF;IACvF,KAAK,CAAC,MAAkB,EAAE,IAA6B;QACrD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,cAAc,CAAC,MAAqB;QAClC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,QAAQ;YAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACtC,CAAC;IAED,cAAc,CAAC,MAAkB;QAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,YAAY,CAAC,MAAkB;QAC7B,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO;QAC5B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACjC,IAAI,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,EAAE,CAAC;IAChD,CAAC;IAED,YAAY;QACV,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,sFAAsF;IACtF,oBAAoB;QAClB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,GAAG,EAAE,CAAC;IACpE,CAAC;IAED,UAAU;QACR,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACpC,CAAC;CACF;AAED,SAAS,UAAU,CAAC,GAAoB;IACtC,KAAK,MAAM,MAAM,IAAI,GAAG;QAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC3C,GAAG,CAAC,KAAK,EAAE,CAAC;AACd,CAAC"}

package/dist/https-proxy-session.d.ts

@@ -0,0 +1,64 @@
+import { type HttpsProxyModeOptions } from "./https-proxy-mode.js";
+/** What claudeChildEnv sets for proxy mode in place of the base URL. */
+export interface HttpsProxyChild {
+    /** HTTPS_PROXY: the loopback with the per-session token. */
+    proxyUrl: string;
+    /** NODE_EXTRA_CA_CERTS: the user's extra CAs, then the session CA. */
+    caBundlePath: string;
+    /** CLAUDE_ENV_FILE: sourced by Claude Code before each Bash command. */
+    bashEnvPath: string;
+    /** NO_PROXY / no_proxy with api.anthropic.com entries removed (only those set). */
+    noProxy: Partial<Record<NoProxyVar, string>>;
+}
+export interface HttpsProxySession {
+    /** For startProxy's `httpsProxyMode`. */
+    proxyOptions: HttpsProxyModeOptions & {
+        onModelCall: () => void;
+    };
+    /** Writes the Bash env file for the proxy's port; what Claude Code's env needs. */
+    childFor(port: number): HttpsProxyChild;
+    /** A one-time warning when prompts go by with no model call through ccc. */
+    promptLine(): string | undefined;
+    cleanup(): void;
+}
+declare const NO_PROXY_VARS: readonly ["NO_PROXY", "no_proxy"];
+type NoProxyVar = typeof NO_PROXY_VARS[number];
+export declare function startHttpsProxySession(env: NodeJS.ProcessEnv, tracePath?: string, root?: string): HttpsProxySession;
+/**
+ * NO_PROXY / no_proxy for Claude Code: entries that would match api.anthropic.com
+ * (`*`, `anthropic.com`, `.anthropic.com`, `*.anthropic.com`, the host itself, with or
+ * without a port) are dropped, or Claude Code would bypass ccc. Only changed ones.
+ */
+export declare function sanitizedNoProxy(env: NodeJS.ProcessEnv): Partial<Record<NoProxyVar, string>>;
+interface BashEnvInput {
+    parentEnv: NodeJS.ProcessEnv;
+    port: number;
+    bundlePath: string;
+    noProxy: Partial<Record<NoProxyVar, string>>;
+}
+/** The POSIX sh script Claude Code sources before each Bash command (see the header). */
+export declare function bashEnvScript(input: BashEnvInput): string;
+/**
+ * Bash env lines that put back `env`'s HTTPS_PROXY, https_proxy and NODE_EXTRA_CA_CERTS
+ * (or unset them), each only while it still holds ccc's value: the token proxy on `port`
+ * (matched by pattern, so the token is never written) and the CA file `caPath`. Values
+ * Claude Code's sandbox set before the file is sourced are left alone. Shared with the
+ * desktop service's env file (desktop-setup.ts).
+ */
+export declare function cccProxyRestoreLines(port: number, caPath: string, env: NodeJS.ProcessEnv): string[];
+export declare function ifStill(name: string, value: string, then: string): string;
+export declare function shellQuote(value: string): string;
+/**
+ * Settings that change mid-session (a proxy in a settings `env`, the sandbox turned on)
+ * can send Claude Code's model calls past ccc with no error. Two consecutive prompts with
+ * no model call through ccc get one warning, at the next prompt.
+ */
+export declare class ModelCallWatch {
+    private promptsWithoutCall;
+    private warned;
+    modelCall(): void;
+    promptLine(): string | undefined;
+}
+export declare const MODEL_CALLS_MISSING: string;
+export {};
+//# sourceMappingURL=https-proxy-session.d.ts.map

package/dist/https-proxy-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"https-proxy-session.d.ts","sourceRoot":"","sources":["../src/https-proxy-session.ts"],"names":[],"mappings":"AAyBA,OAAO,EAA2B,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAI5F,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,YAAY,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAC;IACpB,mFAAmF;IACnF,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,iBAAiB;IAChC,yCAAyC;IACzC,YAAY,EAAE,qBAAqB,GAAG;QAAE,WAAW,EAAE,MAAM,IAAI,CAAA;KAAE,CAAC;IAClE,mFAAmF;IACnF,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CAAC;IACxC,4EAA4E;IAC5E,UAAU,IAAI,MAAM,GAAG,SAAS,CAAC;IACjC,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,QAAA,MAAM,aAAa,mCAAoC,CAAC;AACxD,KAAK,UAAU,GAAG,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;AAE/C,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,SAA2C,GAC1F,iBAAiB,CAmBnB;AA4BD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAU5F;AAQD,UAAU,YAAY;IACpB,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;CAC9C;AAED,yFAAyF;AACzF,wBAAgB,aAAa,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAgBzD;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GACnD,MAAM,EAAE,CAQV;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzE;AAOD,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;;;GAIG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,MAAM,CAAS;IAEvB,SAAS,IAAI,IAAI;IAIjB,UAAU,IAAI,MAAM,GAAG,SAAS;CAQjC;AAED,eAAO,MAAM,mBAAmB,QAG0C,CAAC"}

package/dist/https-proxy-session.js

@@ -0,0 +1,165 @@
+/**
+ * One ccc session in HTTPS-proxy mode (https-proxy-mode.ts): its CA, proxy token and
+ * temp files, the environment its Claude Code gets, and the Bash env file that gives
+ * programs run from Claude Code's Bash tool what they see today under ccc.
+ *
+ * - The CA (mitm-ca.ts) is made fresh, in memory, at every start; only its public
+ *   certificate goes to disk, in a 0700 dir of its own under ~/.claude-code-infinite/
+ *   https-proxy/, removed when ccc exits (a startup sweep removes ones a killed ccc
+ *   left, once their owner is gone). Not the system temp dir: it can hold hundreds of
+ *   thousands of entries (a 200 ms sweep), and on Linux it is shared with other users.
+ * - Claude Code gets `HTTPS_PROXY=http://ccc:<token>@127.0.0.1:<port>`, the bundle as
+ *   NODE_EXTRA_CA_CERTS (the user's own extra CAs first), no ANTHROPIC_BASE_URL, and
+ *   NO_PROXY without entries that would send api.anthropic.com past ccc.
+ * - Bash commands source CLAUDE_ENV_FILE (bash-env.sh) first: it puts back the user's
+ *   own proxy, CA and NO_PROXY values, each only while it still holds ccc's (Claude
+ *   Code's sandbox sets its own before the file is sourced, and those must survive),
+ *   and exports today's ANTHROPIC_BASE_URL and first-party marker, so scripts, SDK apps,
+ *   `$ANTHROPIC_BASE_URL/memtree/...` and a nested ccc behave as in base-URL mode. The
+ *   proxy token is never written to it: ccc's value is matched by pattern.
+ */
+import { randomBytes } from "node:crypto";
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { INTERCEPT_HOST, createSessionCa, sweepStaleSessionDirs, writeCaBundle } from "./mitm-ca.js";
+import { PROXY_USER, proxyUrlFor } from "./https-proxy-mode.js";
+import { HTTPS_PROXY_MODE_ENV } from "./https-proxy-eligibility.js";
+import { getConfigDir } from "./config.js";
+const NO_PROXY_VARS = ["NO_PROXY", "no_proxy"];
+export function startHttpsProxySession(env, tracePath, root = path.join(getConfigDir(), "https-proxy")) {
+    mkdirSync(root, { recursive: true, mode: 0o700 });
+    chmodSync(root, 0o700);
+    sweepStaleSessionDirs(root);
+    const ca = createSessionCa();
+    const files = writeCaBundle(ca, userExtraCaPem(env), root);
+    const proxyToken = randomBytes(24).toString("hex");
+    const watch = new ModelCallWatch();
+    return {
+        proxyOptions: {
+            ca: { leafCertPem: ca.leafCertPem, leafKeyPem: ca.leafKeyPem },
+            proxyToken,
+            ...(tracePath ? { tracePath } : {}),
+            onModelCall: () => watch.modelCall(),
+        },
+        childFor: (port) => childFor(env, files, port, proxyToken),
+        promptLine: () => watch.promptLine(),
+        cleanup: files.cleanup,
+    };
+}
+function childFor(env, files, port, proxyToken) {
+    const noProxy = sanitizedNoProxy(env);
+    const bashEnvPath = path.join(files.dir, "bash-env.sh");
+    writeFileSync(bashEnvPath, bashEnvScript({
+        parentEnv: env, port, bundlePath: files.bundlePath, noProxy,
+    }), { mode: 0o600 });
+    return {
+        proxyUrl: proxyUrlFor(port, proxyToken),
+        caBundlePath: files.bundlePath,
+        bashEnvPath,
+        noProxy,
+    };
+}
+/** The user's NODE_EXTRA_CA_CERTS file, kept first in the bundle; "" when unreadable. */
+function userExtraCaPem(env) {
+    if (!env.NODE_EXTRA_CA_CERTS)
+        return "";
+    try {
+        return readFileSync(env.NODE_EXTRA_CA_CERTS, "utf8");
+    }
+    catch {
+        return ""; // Claude Code would have warned and ignored it too.
+    }
+}
+/**
+ * NO_PROXY / no_proxy for Claude Code: entries that would match api.anthropic.com
+ * (`*`, `anthropic.com`, `.anthropic.com`, `*.anthropic.com`, the host itself, with or
+ * without a port) are dropped, or Claude Code would bypass ccc. Only changed ones.
+ */
+export function sanitizedNoProxy(env) {
+    const out = {};
+    for (const name of NO_PROXY_VARS) {
+        const value = env[name];
+        if (value === undefined)
+            continue;
+        const entries = value.split(/[\s,]+/).filter(Boolean);
+        const kept = entries.filter((entry) => !noProxyCoversIntercept(entry));
+        if (kept.length !== entries.length)
+            out[name] = kept.join(",");
+    }
+    return out;
+}
+function noProxyCoversIntercept(entry) {
+    const host = entry.trim().toLowerCase()
+        .replace(/:\d+$/, "").replace(/^\*/, "").replace(/^\./, "").replace(/\.$/, "");
+    return host === "" || host === INTERCEPT_HOST || INTERCEPT_HOST.endsWith(`.${host}`);
+}
+/** The POSIX sh script Claude Code sources before each Bash command (see the header). */
+export function bashEnvScript(input) {
+    const { parentEnv, port, bundlePath, noProxy } = input;
+    const restore = (name) => restoreLine(parentEnv, name);
+    const lines = [
+        ...cccProxyRestoreLines(port, bundlePath, parentEnv),
+        ...NO_PROXY_VARS.filter((name) => noProxy[name] !== undefined)
+            .map((name) => ifStill(name, noProxy[name], restore(name))),
+        restore("CLAUDE_ENV_FILE"), restore("CCC_MEMTREE_PROXY"), restore(HTTPS_PROXY_MODE_ENV),
+        `export ANTHROPIC_BASE_URL=${shellQuote(`http://127.0.0.1:${port}`)}`,
+        "export _CLAUDE_CODE_ASSUME_FIRST_PARTY_BASE_URL=1",
+    ];
+    const userFile = parentEnv.CLAUDE_ENV_FILE;
+    if (userFile) {
+        lines.push(`if [ -r ${shellQuote(userFile)} ]; then . ${shellQuote(userFile)}; fi`);
+    }
+    return `${lines.join("\n")}\n`;
+}
+/**
+ * Bash env lines that put back `env`'s HTTPS_PROXY, https_proxy and NODE_EXTRA_CA_CERTS
+ * (or unset them), each only while it still holds ccc's value: the token proxy on `port`
+ * (matched by pattern, so the token is never written) and the CA file `caPath`. Values
+ * Claude Code's sandbox set before the file is sourced are left alone. Shared with the
+ * desktop service's env file (desktop-setup.ts).
+ */
+export function cccProxyRestoreLines(port, caPath, env) {
+    const restore = (name) => restoreLine(env, name);
+    const ours = `http://${PROXY_USER}:*@127.0.0.1:${port}`;
+    return [
+        // ccc removed https_proxy from Claude Code's env exactly when it set HTTPS_PROXY.
+        `case "\${HTTPS_PROXY-}" in ${ours}) ${restore("HTTPS_PROXY")}; ${restore("https_proxy")};; esac`,
+        ifStill("NODE_EXTRA_CA_CERTS", caPath, restore("NODE_EXTRA_CA_CERTS")),
+    ];
+}
+export function ifStill(name, value, then) {
+    return `if [ "\${${name}-}" = ${shellQuote(value)} ]; then ${then}; fi`;
+}
+function restoreLine(env, name) {
+    const value = env[name];
+    return value !== undefined ? `export ${name}=${shellQuote(value)}` : `unset ${name}`;
+}
+export function shellQuote(value) {
+    return `'${value.replace(/'/g, "'\\''")}'`;
+}
+/**
+ * Settings that change mid-session (a proxy in a settings `env`, the sandbox turned on)
+ * can send Claude Code's model calls past ccc with no error. Two consecutive prompts with
+ * no model call through ccc get one warning, at the next prompt.
+ */
+export class ModelCallWatch {
+    promptsWithoutCall = 0;
+    warned = false;
+    modelCall() {
+        this.promptsWithoutCall = 0;
+    }
+    promptLine() {
+        if (this.warned)
+            return undefined;
+        this.promptsWithoutCall++;
+        // Two whole prompts with no call (a prompt a user's hook blocks makes none): at the third.
+        if (this.promptsWithoutCall < 3)
+            return undefined;
+        this.warned = true;
+        return MODEL_CALLS_MISSING;
+    }
+}
+export const MODEL_CALLS_MISSING = "ccc: your last prompt's model calls didn't reach ccc, so MemTree isn't compressing this " +
+    "session. A proxy or the Bash sandbox enabled in Claude Code's settings may be routing " +
+    `them elsewhere: restart ccc, or run it with ${HTTPS_PROXY_MODE_ENV}=0.`;
+//# sourceMappingURL=https-proxy-session.js.map

package/dist/https-proxy-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"https-proxy-session.js","sourceRoot":"","sources":["../src/https-proxy-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC5E,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,qBAAqB,EAAE,aAAa,EACvD,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,WAAW,EAA8B,MAAM,uBAAuB,CAAC;AAC5F,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAwB3C,MAAM,aAAa,GAAG,CAAC,UAAU,EAAE,UAAU,CAAU,CAAC;AAGxD,MAAM,UAAU,sBAAsB,CACpC,GAAsB,EAAE,SAAkB,EAAE,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,aAAa,CAAC;IAE3F,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,EAAE,GAAG,eAAe,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAG,aAAa,CAAC,EAAE,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,IAAI,cAAc,EAAE,CAAC;IACnC,OAAO;QACL,YAAY,EAAE;YACZ,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE;YAC9D,UAAU;YACV,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,WAAW,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE;SACrC;QACD,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC;QAC1D,UAAU,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE;QACpC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CACf,GAAsB,EAAE,KAAqB,EAAE,IAAY,EAAE,UAAkB;IAE/E,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACxD,aAAa,CAAC,WAAW,EAAE,aAAa,CAAC;QACvC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,OAAO;KAC5D,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrB,OAAO;QACL,QAAQ,EAAE,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC;QACvC,YAAY,EAAE,KAAK,CAAC,UAAU;QAC9B,WAAW;QACX,OAAO;KACR,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,SAAS,cAAc,CAAC,GAAsB;IAC5C,IAAI,CAAC,GAAG,CAAC,mBAAmB;QAAE,OAAO,EAAE,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,oDAAoD;IACjE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAsB;IACrD,MAAM,GAAG,GAAwC,EAAE,CAAC;IACpD,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC;QACvE,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa;IAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjF,OAAO,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,cAAc,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;AACvF,CAAC;AASD,yFAAyF;AACzF,MAAM,UAAU,aAAa,CAAC,KAAmB;IAC/C,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IACvD,MAAM,OAAO,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG;QACZ,GAAG,oBAAoB,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,CAAC;QACpD,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;aAC3D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9D,OAAO,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC;QACvF,6BAA6B,UAAU,CAAC,oBAAoB,IAAI,EAAE,CAAC,EAAE;QACrE,mDAAmD;KACpD,CAAC;IACF,MAAM,QAAQ,GAAG,SAAS,CAAC,eAAe,CAAC;IAC3C,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC,WAAW,UAAU,CAAC,QAAQ,CAAC,cAAc,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAY,EAAE,MAAc,EAAE,GAAsB;IAEpD,MAAM,OAAO,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,UAAU,UAAU,gBAAgB,IAAI,EAAE,CAAC;IACxD,OAAO;QACL,kFAAkF;QAClF,8BAA8B,IAAI,KAAK,OAAO,CAAC,aAAa,CAAC,KAAK,OAAO,CAAC,aAAa,CAAC,SAAS;QACjG,OAAO,CAAC,qBAAqB,EAAE,MAAM,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,KAAa,EAAE,IAAY;IAC/D,OAAO,YAAY,IAAI,SAAS,UAAU,CAAC,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC;AAC1E,CAAC;AAED,SAAS,WAAW,CAAC,GAAsB,EAAE,IAAY;IACvD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,cAAc;IACjB,kBAAkB,GAAG,CAAC,CAAC;IACvB,MAAM,GAAG,KAAK,CAAC;IAEvB,SAAS;QACP,IAAI,CAAC,kBAAkB,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,UAAU;QACR,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAClC,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC1B,2FAA2F;QAC3F,IAAI,IAAI,CAAC,kBAAkB,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAClD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,OAAO,mBAAmB,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,CAAC,MAAM,mBAAmB,GAC9B,0FAA0F;IAC1F,wFAAwF;IACxF,+CAA+C,oBAAoB,KAAK,CAAC"}

package/dist/image-tokens.d.ts

@@ -31,7 +31,12 @@ export declare function visualTokens(width: number, height: number, tier?: {
 }): number;
 /** Claude before 4.7 is standard; 4.7+, other and unknown models are high-res. */
 export declare function imageTier(model: string | undefined): typeof HIGH_RES;
-/** Width and height from a PNG, GIF, WebP or JPEG header; undefined when unreadable. */
+/**
+ * Width and height from a PNG, GIF, WebP or JPEG header; undefined when unreadable.
+ * Only the header is decoded (the first HEADER_BASE64_CHARS characters); a JPEG whose
+ * frame header sits past that (large EXIF or ICC segments) is walked segment by
+ * segment, decoding a few bytes at each marker (jpegSizeAt), never the whole image.
+ */
 export declare function imageDimensions(base64: string): [number, number] | undefined;
 export {};
 //# sourceMappingURL=image-tokens.d.ts.map

package/dist/image-tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"image-tokens.d.ts","sourceRoot":"","sources":["../src/image-tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,QAAA,MAAM,QAAQ;;;CAAsC,CAAC;AAOrD,MAAM,WAAW,WAAW;IAC1B,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,WAAW,EAAE,MAAM,CAAC;CACrB;AAOD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAM/E;AAED,4DAA4D;AAC5D,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,WAAW,GAAG,IAAI,CAEjG;AAsBD,yEAAyE;AACzE,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI;;;CAAW,GAAG,MAAM,CAYnF;AAED,kFAAkF;AAClF,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,QAAQ,CAMpE;AAED,wFAAwF;AACxF,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAQ5E"}
+{"version":3,"file":"image-tokens.d.ts","sourceRoot":"","sources":["../src/image-tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,QAAA,MAAM,QAAQ;;;CAAsC,CAAC;AAOrD,MAAM,WAAW,WAAW;IAC1B,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,WAAW,EAAE,MAAM,CAAC;CACrB;AAOD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,WAAW,CAM/E;AAED,4DAA4D;AAC5D,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,WAAW,GAAG,IAAI,CAEjG;AAsBD,yEAAyE;AACzE,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI;;;CAAW,GAAG,MAAM,CAYnF;AAED,kFAAkF;AAClF,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,QAAQ,CAMpE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAS5E"}

package/dist/image-tokens.js

@@ -81,7 +81,12 @@ export function imageTier(model) {
     const minor = match[2] ? Number(match[2]) : 0;
     return major > 4 || (major === 4 && minor >= 7) ? HIGH_RES : STANDARD;
 }
-/** Width and height from a PNG, GIF, WebP or JPEG header; undefined when unreadable. */
+/**
+ * Width and height from a PNG, GIF, WebP or JPEG header; undefined when unreadable.
+ * Only the header is decoded (the first HEADER_BASE64_CHARS characters); a JPEG whose
+ * frame header sits past that (large EXIF or ICC segments) is walked segment by
+ * segment, decoding a few bytes at each marker (jpegSizeAt), never the whole image.
+ */
 export function imageDimensions(base64) {
     let bytes;
     try {
@@ -90,7 +95,8 @@ export function imageDimensions(base64) {
     catch {
         return undefined;
     }
-    return pngSize(bytes) ?? gifSize(bytes) ?? webpSize(bytes) ?? jpegSize(bytes);
+    return pngSize(bytes) ?? gifSize(bytes) ?? webpSize(bytes) ?? jpegSize(bytes) ??
+        (isJpeg(bytes) ? jpegSizeAt(base64) : undefined);
 }
 function addImages(blocks, tier, totals) {
     for (const item of blocks) {
@@ -137,22 +143,77 @@ function webpSize(b) {
 }
 const JPEG_FRAME_MARKERS = new Set([0xc0, 0xc1, 0xc2, 0xc3, 0xc5, 0xc6, 0xc7, 0xc9, 0xca, 0xcb,
     0xcd, 0xce, 0xcf]);
+function isJpeg(b) {
+    return b.length >= 4 && b[0] === 0xff && b[1] === 0xd8;
+}
 function jpegSize(b) {
-    if (b.length < 4 || b[0] !== 0xff || b[1] !== 0xd8)
+    if (!isJpeg(b))
         return undefined;
     let i = 2;
-    for (let steps = 0; steps < 2_048 && i + 9 < b.length; steps++) {
-        if (b[i] !== 0xff)
-            return undefined;
-        const marker = b[i + 1];
-        if (marker === 0xff) {
-            i++;
-            continue;
-        }
-        if (JPEG_FRAME_MARKERS.has(marker))
-            return [b.readUInt16BE(i + 7), b.readUInt16BE(i + 5)];
-        i += 2 + b.readUInt16BE(i + 2);
+    for (let steps = 0; steps < 2_048 && i + 9 <= b.length; steps++) {
+        const step = jpegStep(b.subarray(i, i + 9));
+        if (step === undefined || Array.isArray(step))
+            return step;
+        i += step;
+    }
+    return undefined;
+}
+/**
+ * The same walk as jpegSize over the whole base64 image, decoding 9 bytes per segment.
+ * Only for plain base64 throughout: one whitespace character inside a skipped segment
+ * would shift every later offset and read wrong bytes as a frame header (Codex r1 P2).
+ */
+function jpegSizeAt(base64) {
+    if (!BASE64_RE.test(base64))
+        return undefined;
+    const total = Math.floor(base64.length / 4) * 3;
+    let i = 2;
+    for (let steps = 0; steps < 2_048 && i + 9 <= total; steps++) {
+        const b = base64Slice(base64, i, 9);
+        const step = b && jpegStep(b);
+        if (step === undefined || Array.isArray(step))
+            return step;
+        i += step;
     }
     return undefined;
 }
+/**
+ * One marker of a JPEG walk, from the 9 bytes at it: the frame's [width, height], the
+ * bytes to the next marker, or undefined when the walk must stop. Standalone markers
+ * (TEM, RST0-7) carry no length (Codex r4 P2); SOI, EOI and SOS before any frame header,
+ * a length under 2, or a zero dimension end the walk unreadable (the tier cap applies).
+ */
+function jpegStep(b) {
+    if (b.length < 9 || b[0] !== 0xff)
+        return undefined;
+    const marker = b[1];
+    if (marker === 0xff)
+        return 1;
+    if (marker === 0x01 || (marker >= 0xd0 && marker <= 0xd7))
+        return 2;
+    if (marker === 0x00 || marker === 0xd8 || marker === 0xd9 || marker === 0xda)
+        return undefined;
+    if (JPEG_FRAME_MARKERS.has(marker)) {
+        const width = b.readUInt16BE(7);
+        const height = b.readUInt16BE(5);
+        return width > 0 && height > 0 ? [width, height] : undefined;
+    }
+    const length = b.readUInt16BE(2);
+    return length >= 2 ? 2 + length : undefined;
+}
+const BASE64_RE = /^[A-Za-z0-9+/]*={0,2}$/;
+/**
+ * `length` bytes of the image from byte `offset`, decoded from only the base64 quads that
+ * hold them; undefined when those characters are not plain base64 (whitespace would shift
+ * every later offset, so the walk stops rather than read the wrong bytes).
+ */
+function base64Slice(base64, offset, length) {
+    const start = Math.floor(offset / 3) * 4;
+    const chars = base64.slice(start, Math.ceil((offset + length) / 3) * 4);
+    if (!BASE64_RE.test(chars))
+        return undefined;
+    const skip = offset - (start / 4) * 3;
+    const bytes = Buffer.from(chars, "base64").subarray(skip, skip + length);
+    return bytes.length === length ? bytes : undefined;
+}
 //# sourceMappingURL=image-tokens.js.map