refactor(guard): pass the body to isBase64Body; cover the quanta rule

Three cuts, no behaviour change, plus one coverage hole they exposed.

isBase64Body took (block, endMarker) and re-derived the body by slicing
between the first newline and the last END marker — arithmetic the caller
had already done to build the block. It now takes the body itself, which
the caller has in hand as text.slice(m.index + m[0].length, end). Verified
equivalent under both LF and CRLF before applying: the BEGIN match
excludes the \r, so the two slices normalize to the same bytes.

The two `if (remoteControl)` lines merged into one block, and a comment
restating the line below it dropped.

The hole: mutating away the `length % 4` check left the suite GREEN. No
fixture had an alphabet-valid body of the wrong length, so a clause my
previous commit message claimed was covered was not. Two rows added — a
one-character body and `A===` — and both base64 clauses now fail exactly
one test when removed.

175 measured shapes across six sweeps, 0 false accepts, identical to
before the cuts. Full suite 1504 pass / 2 fail (EMFILE, same at the merge
base).

net: -8 lines.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: codeslake

bin/ca-trust.mjs

@@ -15,13 +15,9 @@ import { X509Certificate } from "node:crypto";
 // A body containing `-` reads as damaged here even though node accepts it
 // (openssl stops at the dash), which is the conservative direction and the only
 // measured disagreement.
-function isBase64Body(block, endMarker) {
-  const bodyStart = block.indexOf("\n") + 1;
-  const bodyEnd = block.lastIndexOf(endMarker);
-  if (bodyStart === 0 || bodyEnd < bodyStart) return false;
-  const body = block.slice(bodyStart, bodyEnd).replace(/\s+/g, "");
-  if (body.length === 0 || body.length % 4 !== 0) return false;
-  return /^[A-Za-z0-9+/]+={0,2}$/.test(body);
+function isBase64Body(body) {
+  const b = body.replace(/\s+/g, "");
+  return b.length > 0 && b.length % 4 === 0 && /^[A-Za-z0-9+/]+={0,2}$/.test(b);
 }
 
 // Is this merged CA bundle safe to hand claude as NODE_EXTRA_CA_CERTS?
@@ -123,7 +119,7 @@ export function bundleCarriesOurCA(text, ourCaPem) {
       try { der = new X509Certificate(block).raw; }
       catch { return { ok: false, reason: "undecodable CERTIFICATE block" }; }
       if (der.equals(ourDer)) carriesUs = true;
-    } else if (!isBase64Body(block, endMarker)) {
+    } else if (!isBase64Body(text.slice(m.index + m[0].length, end))) {
       return { ok: false, reason: `undecodable ${label} block` };
     }
   }

bin/claude-via-proxy.mjs

@@ -133,11 +133,13 @@ if (proxyUpstream) proxyEnv.CACHE_FIX_PROXY_UPSTREAM = proxyUpstream;
 // Forward-proxy mode: the spawned proxy must attach the CONNECT/MITM handler,
 // or the HTTPS_PROXY wiring below would tunnel to a proxy that only speaks
 // reverse-proxy and never terminates TLS for the upstream host.
-if (remoteControl) proxyEnv.CACHE_FIX_FORWARD_PROXY = "on";
-// Tell the proxy we will wire claude ourselves, so it does not print a recipe
-// that would undo that. Internal handshake between these two files, deliberately
-// not documented as an operator knob — see the banner in proxy/server.mjs.
-if (remoteControl) proxyEnv.CACHE_FIX_WIRED_BY_LAUNCHER = "1";
+if (remoteControl) {
+  proxyEnv.CACHE_FIX_FORWARD_PROXY = "on";
+  // ...and tell it we will wire claude ourselves, so it does not print a recipe
+  // that would undo that. Internal handshake between these two files,
+  // deliberately not an operator knob — see the banner in proxy/server.mjs.
+  proxyEnv.CACHE_FIX_WIRED_BY_LAUNCHER = "1";
+}
 
 const proxyProc = fork(SERVER_PATH, [], {
   stdio: ["ignore", "pipe", "pipe", "ipc"],

test/proxy-forward-ca.test.mjs

@@ -391,6 +391,13 @@ test("ca-trust: the bundle guard never accepts a bundle NODE_EXTRA_CA_CERTS cann
       // every non-CERTIFICATE block outright waved these through: measured,
       // guard=accept while the handshake failed UNABLE_TO_VERIFY_LEAF_SIGNATURE.
       ["corrupt PUBLIC KEY ahead", `-----BEGIN PUBLIC KEY-----\n!!!not base64!!!\n-----END PUBLIC KEY-----\n${ours}`, false],
+      // Alphabet-valid but not whole 4-char quanta. Every character is legal
+      // base64, so an alphabet-only test called this decodable — measured, node
+      // reported `bad base64 decode` and loaded zero extra CAs. Without this row
+      // the length check can be deleted with the suite still green.
+      ["PUBLIC KEY body of one char", `-----BEGIN PUBLIC KEY-----\nA\n-----END PUBLIC KEY-----\n${ours}`, false],
+      // Padding is positional, not merely present: `AAA=` loads, `A===` does not.
+      ["PUBLIC KEY body with misplaced padding", `-----BEGIN PUBLIC KEY-----\nA===\n-----END PUBLIC KEY-----\n${ours}`, false],
       ["corrupt X509 CRL ahead", `-----BEGIN X509 CRL-----\n!!!not base64!!!\n-----END X509 CRL-----\n${ours}`, false],
       // ...but a WELL-FORMED one must still be accepted, or the fix above turns
       // into the over-strict guard this PR set out to remove.