config: verify.sh discovers the proxy port instead of defaulting it

The proxy-live check read ~/.claude.json for CLAUDE_CODE_CACHE_FIX_PORT. No
such key exists — the launcher variable is CACHE_FIX_PROXY_PORT and it lives
in the proxy process env, not that file. Measured on all three machines: 0
matches, so the sed produced nothing and ${port:-9901} supplied the default
on every run the check has ever made.

That is exactly the assumption its own comment forbids ("rather than assuming
9901 ... asserting the default would pass while every live session dialled a
dead one"). It would have reported OK about a dead port on any machine whose
proxy had moved.

Now discovers <TMPDIR-or-/tmp>/cachefix-<port>, the same source cc-check-ccf
uses, and probes every one it finds. No run dir is a FAIL, never a default —
a check that cannot find its subject has not looked.

Mutation-verified: no run dir -> FAIL exit 1; run dir with a dead port ->
FAIL exit 1; real machine -> OK on the discovered 9901.

Author: codeslake

.claude/deploy.sh

@@ -0,0 +1,57 @@
+#!/bin/bash
+# CCF — put THIS machine on origin/integrated.
+#
+# Contract: exit 0 = on the branch; non-zero = not, reason on stdout; one line
+# naming the host and the sha.
+set -eu
+D="$HOME/.local/share/cache-fix-fork"
+
+[ -d "$D/.git" ] || { echo "REFUSE: $(hostname -s):$D is not a checkout"; exit 1; }
+
+# Refuse rather than resolve. `reset --hard` would answer a wrong-branch tree by
+# discarding whatever is there, and on this machine that tree is what every live
+# session's launcher runs from.
+branch=$(git -C "$D" rev-parse --abbrev-ref HEAD)
+[ "$branch" = "integrated" ] || {
+  echo "REFUSE: $(hostname -s):$D is on '$branch' — a human decides this"; exit 1; }
+
+git -C "$D" fetch origin integrated --quiet
+# reset, not merge --ff-only: the rebuild force-pushes `integrated` (it is
+# rebuilt from upstream/main every time, never patched), so the deployed copy is
+# routinely NOT a fast-forward from its own HEAD. --ff-only would refuse every
+# rebuild that dropped a merged PR. Safe here because nothing edits this tree by
+# hand — the wrong-branch guard above is what protects the case that matters.
+git -C "$D" reset --hard -q origin/integrated
+echo "$(hostname -s) @ $(git -C "$D" rev-parse --short HEAD)"
+
+# Re-apply the usage-log opt-in. `usage-log` ships enabled:false in its own
+# export default — upstream's deliberate opt-in, activated by an entry in
+# proxy/extensions.json. That file is TRACKED, so the reset above reverts it and
+# the extension goes quiet with nothing to say it did.
+#
+# Measured 2026-08-01: ~/.claude/usage.jsonl last written 2026-07-04 — four weeks
+# of per-call token accounting missing while the proxy itself was healthy at 96%
+# cache hit rate, so /check-usage could not attribute a 5h window that had
+# reached 85%. Then measured again the same day: running the one-line
+# `reset --hard` deploy took usage-log from {"enabled":true} back to absent.
+# This block is why deploy is a script and not a conf string.
+python3 - "$D/proxy/extensions.json" <<'PY' || echo "WARN: $(hostname -s) could not enable usage-log (accounting only, proxy unaffected)"
+import json, sys
+p = sys.argv[1]
+with open(p) as f:
+    cfg = json.load(f)
+if cfg.get("usage-log", {}).get("enabled") is not True:
+    cfg["usage-log"] = {"enabled": True, "order": 650}
+    with open(p, "w") as f:
+        json.dump(cfg, f, indent=2)
+        f.write("\n")
+PY
+
+# Extensions are read ONCE at proxy boot and hot-reload is opt-in and off, so
+# flipping usage-log on disk does nothing for a proxy already running. Report it;
+# restarting drops in-flight requests for every session on that port and is a
+# separate, confirmed step.
+pgrep -f 'cache-fix-fork/proxy/server.mjs' >/dev/null 2>&1 &&
+  echo "NOTE: $(hostname -s) has a live proxy holding pre-deploy code — it keeps it until relaunch"
+
+exit 0

.claude/integrated.conf

@@ -0,0 +1,29 @@
+# CCF — <repo>/.claude/integrated.conf
+#
+# Committed on `integrated-config`, the first input to every rebuild. Reaches
+# upstream never: every PR branch is cut from upstream/main, so there is no path
+# for this file onto one. Measured before relying on it —
+#   git ls-tree ca-trust-guard .claude/   -> agent-name, github-app only
+#   git reset --hard upstream/main        -> a conf committed on `integrated`
+#                                            is DESTROYED, which is why it lives
+#                                            on its own branch instead.
+
+UPSTREAM_REPO=cnighswonger/claude-code-cache-fix
+UPSTREAM_REMOTE=upstream
+UPSTREAM_BRANCH=main
+FORK_REMOTE=origin
+
+INTEGRATED_BRANCH=integrated
+
+PR_AUTHOR=codeslake
+
+# The proxy prefix is load-bearing, not decoration: without it a test in
+# test/proxy-server.test.mjs makes a real api.anthropic.com request and hangs on
+# this network until it times out.
+TEST_CMD='HTTPS_PROXY=http://127.0.0.1:8118 NO_PROXY=localhost,127.0.0.1,::1 npm test'
+
+TEST_CAVEAT='EMFILE in test/proxy-server.test.mjs is fs.inotify.max_user_instances (128 on lmd42), not a regression — confirm it fails identically at the merge base before calling it ours'
+
+DEPLOY_HOSTS='lmd42-docker via-work-mac via-personal-mac'
+
+POLL=300

.claude/verify.sh

@@ -0,0 +1,89 @@
+#!/bin/bash
+# CCF — is the deploy actually LIVE on this machine?
+# One line per check: <name>\tOK|FAIL\t<detail>. Non-zero exit if any FAIL.
+set -u
+D="$HOME/.local/share/cache-fix-fork"
+CFG="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
+fail=0
+say() { printf '%s\t%s\t%s\n' "$1" "$2" "$3"; [ "$2" = FAIL ] && fail=1; return 0; }
+
+# 1. The launcher parses at all. A tree that cannot even be loaded is the one
+#    failure that makes every other probe meaningless.
+launcher="$D/bin/claude-via-proxy.mjs"
+if [ ! -r "$launcher" ]; then say launcher FAIL "absent: $launcher"
+elif out=$(node --check "$launcher" 2>&1); then say launcher OK "parses"
+else say launcher FAIL "${out:-parse failed}"; fi
+
+# 2. The guard agrees with this machine's LIVE bundle.
+#
+#    This is the check that earns its place: the bundle is written by a third
+#    component (cc-wrapper's cachefix-ensure) from inputs neither this repo nor
+#    the deploy controls, so a tree that is correct can still meet a bundle it
+#    refuses. Probing bin/ca-trust.mjs — the module the launcher imports, not a
+#    copy — is the point of it living in its own file.
+#
+#    Absent bundle is OK, not FAIL: a host with no builder is a supported state
+#    and the launcher falls back to its own CA. Absent CA is FAIL — forward-proxy
+#    mode cannot work without one.
+if [ ! -r "$CFG/cache-fix-ca/ca.pem" ]; then
+  say ca-trust FAIL "no proxy CA at $CFG/cache-fix-ca/ca.pem"
+elif [ ! -s "$CFG/ca-trust.pem" ]; then
+  say ca-trust OK "no merged bundle on this host — launcher uses its own CA"
+else
+  out=$(node -e '
+    import(process.argv[1] + "/bin/ca-trust.mjs").then(async m => {
+      const fs = await import("node:fs");
+      const cfg = process.argv[2];
+      const ca = fs.readFileSync(cfg + "/cache-fix-ca/ca.pem");
+      const merged = fs.readFileSync(cfg + "/ca-trust.pem", "utf8");
+      const n = (merged.match(/^-----BEGIN CERTIFICATE-----$/gm) || []).length;
+      const v = m.bundleCarriesOurCA(merged, ca);
+      console.log(n + " certs: " + (v.ok ? "accepted" : "REFUSED — " + v.reason));
+      process.exit(v.ok ? 0 : 1);
+    }).catch(e => { console.log("threw: " + e.message); process.exit(1); });
+  ' "$D" "$CFG" 2>&1)
+  if [ $? -eq 0 ]; then say ca-trust OK "$out"; else say ca-trust FAIL "$out"; fi
+fi
+
+# 3. A proxy answers, on the port the sessions were actually built against —
+#    a session that started during a reload window baked whatever port it got,
+#    and asserting the default would pass while every live session dialled a
+#    dead one.
+#
+#    The run dir `<TMPDIR-or-/tmp>/cachefix-<port>` is where that port is
+#    recorded; it is the same discovery cc-check-ccf's probe uses. This read
+#    ~/.claude.json for CLAUDE_CODE_CACHE_FIX_PORT until 2026-08-01, and no
+#    such key exists — the launcher's variable is CACHE_FIX_PROXY_PORT and it
+#    lives in the proxy's own env. Measured on all three machines: 0 matches,
+#    so the sed produced nothing and `${port:-9901}` supplied the default every
+#    single run. The check asserted precisely the assumption the paragraph
+#    above forbids, and would have said OK about a dead port on any machine
+#    whose proxy had moved.
+#
+#    No run dir ⇒ FAIL, never a default. A check that cannot find its subject
+#    has not looked; reporting that as OK is the whole failure mode.
+tmp=${TMPDIR:-/tmp}; tmp=${tmp%/}
+ports=$(for d in "$tmp"/cachefix-* /tmp/cachefix-*; do
+          [ -d "$d" ] || continue
+          p=${d##*cachefix-}
+          case "$p" in ''|*[!0-9]*) continue ;; esac
+          echo "$p"
+        done | sort -un)
+if [ -z "$ports" ]; then
+  say proxy-live FAIL "no cachefix-<port> run dir under $tmp or /tmp — nothing to probe"
+else
+  for port in $ports; do
+    if out=$(curl -sf --max-time 3 --noproxy '*' "http://127.0.0.1:$port/health" 2>&1); then
+      case "$out" in
+        *'"forward_proxy":true'*) say proxy-live OK "port $port: $out" ;;
+        # Answering in reverse-proxy mode is not "up": that mode sets
+        # ANTHROPIC_BASE_URL, which is what disables Remote Control.
+        *) say proxy-live FAIL "port $port answers but forward_proxy is not true: $out" ;;
+      esac
+    else
+      say proxy-live FAIL "run dir $tmp/cachefix-$port exists but nothing answers 127.0.0.1:$port"
+    fi
+  done
+fi
+
+exit $fail