refactor(launcher): use process.channel instead of filtering relayed stderr

Two simplifications, both measured before applying.

The launcher was line-buffering the proxy's stderr and stripping the
wiring recipe with a regex — 20 lines to remove text it had caused. The
server can tell directly: process.channel is set exactly when fork()
created the process, and the launcher is the only fork() site (the
`server` subcommand uses spawn, and a service manager runs it bare).
Measured: fork -> channel set, standalone -> undefined. So the recipe is
now gated at the source and the relay is a plain pass-through again.

And bundleCarriesOurCA no longer normalizes CRLF. `$` in a /m regex
matches before a `\r`, and the END search is anchored on the leading
`\n`, so both halves already read a CRLF file the same as an LF one.
Measured across 102 shapes (34 bundle layouts x LF/CRLF/mixed):
identical verdicts with and without the replace, and 0 false accepts
against a real handshake.

No behavior change: standalone still prints the full recipe, the
launcher still prints the mode line and not the recipe, and the guard's
verdicts are unchanged. Mutating the new gate to false fails exactly one
test, and all five guard-clause mutations are still caught.

-16 net production lines. Full suite 1503 pass / 0 fail.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: codeslake

bin/ca-trust.mjs

@@ -18,14 +18,18 @@ import { X509Certificate } from "node:crypto";
 //
 // It stays a pre-flight guard, never proof: it establishes the file parses and
 // carries us, never that node will verify a given leaf with it.
-export function bundleCarriesOurCA(merged, ourCaPem) {
-  const text = merged.replace(/\r\n/g, "\n");
+export function bundleCarriesOurCA(text, ourCaPem) {
   const ourDer = new X509Certificate(ourCaPem).raw;
   // Line-anchored. openssl only honours a marker that begins a line, so a
   // marker quoted inside prose is not a block. The previous count-based check
   // read the raw file and rejected any bundle whose provenance header happened
   // to name the marker — measured: `# see -----BEGIN CERTIFICATE-----` ahead of
   // a healthy CA was refused while node authorized the same bytes.
+  //
+  // No CRLF normalization: `$` in a /m regex matches before a `\r`, and the END
+  // search below is anchored on the leading `\n`, so both halves already read a
+  // CRLF file the same as an LF one. Measured across 102 shapes (34 bundle
+  // layouts x LF/CRLF/mixed): identical verdicts with and without the replace.
   const marker = /^-----BEGIN ([A-Z0-9 ]*)-----$/gm;
   let carriesUs = false;
   for (let m; (m = marker.exec(text)); ) {

bin/claude-via-proxy.mjs

@@ -158,28 +158,8 @@ proxyProc.on("exit", (code) => {
   }
 });
 
-// The proxy's "wire the client" recipe is correct standalone advice and exactly
-// wrong relayed from here: we have already wired claude via ca-trust.d and the
-// merged bundle, so an `export NODE_EXTRA_CA_CERTS=<our ca.pem>` printed right
-// after that work tells the operator to undo it — the variable takes one file,
-// so pinning it to our CA alone silently untrusts every other MITM on the host.
-// Dropped here rather than suppressed at the source: the launcher is the one
-// with the context, and a new env var to carry it would be permanent surface
-// area for a presentation detail. Only the recipe goes; the mode line stays, so
-// forward-proxy mode is still visible in the output.
-const WIRING_RECIPE = /^\s*(export (HTTPS_PROXY|NODE_EXTRA_CA_CERTS)=|\(if anything else on this host|\s*`claude-via-proxy --remote-control`|\s*one file, so setting it here)/;
-let stderrTail = "";
 proxyProc.stderr.on("data", (chunk) => {
-  const text = stderrTail + chunk.toString();
-  // Keep a trailing partial line for the next chunk so a recipe line split
-  // across two reads is still matched whole.
-  const nl = text.lastIndexOf("\n");
-  stderrTail = nl === -1 ? text : text.slice(nl + 1);
-  const complete = nl === -1 ? "" : text.slice(0, nl + 1);
-  if (!complete) return;
-  const kept = complete.split("\n").filter((l, i, a) =>
-    !(i === a.length - 1 && l === "") && !WIRING_RECIPE.test(l));
-  if (kept.length) process.stderr.write(kept.join("\n") + "\n");
+  process.stderr.write(chunk);
 });
 
 function waitForReady() {

proxy/server.mjs

@@ -614,20 +614,20 @@ export async function startProxy(options = {}) {
 
   const addr = server.address();
   if (forwardProxyCA) {
-    // The caveat is part of the recipe, not a footnote: NODE_EXTRA_CA_CERTS
-    // takes exactly one file, so an operator who follows these two lines on a
-    // host where something else also MITMs api.anthropic.com silently untrusts
-    // that component. --remote-control exists precisely to avoid that, and the
-    // launcher filters this recipe out of its relayed stderr since it has
-    // already wired the client via ca-trust.d.
-    process.stderr.write(
-      "[cache-fix] forward-proxy: on. Wire the client (leave ANTHROPIC_BASE_URL UNSET so Remote Control stays enabled):\n" +
-      `  export HTTPS_PROXY=http://${addr.address}:${addr.port}\n` +
-      `  export NODE_EXTRA_CA_CERTS=${forwardProxyCA}\n` +
-      "  (if anything else on this host also MITMs api.anthropic.com, use\n" +
-      "   `claude-via-proxy --remote-control` instead — that variable takes\n" +
-      "   one file, so setting it here would untrust the other CA)\n",
-    );
+    const wiredByLauncher = process.channel !== undefined;
+    // Only when the operator is the one wiring. process.channel is set exactly
+    // when our launcher fork()ed us, and it has already wired claude via
+    // ca-trust.d — printing `export NODE_EXTRA_CA_CERTS=<our ca.pem>` into its
+    // relayed stderr tells the operator to undo that: the variable takes one
+    // file, so pinning it to our CA alone untrusts every other MITM on the host.
+    process.stderr.write(wiredByLauncher
+      ? "[cache-fix] forward-proxy: on. Client wired by the launcher (ca-trust.d).\n"
+      : "[cache-fix] forward-proxy: on. Wire the client (leave ANTHROPIC_BASE_URL UNSET so Remote Control stays enabled):\n" +
+        `  export HTTPS_PROXY=http://${addr.address}:${addr.port}\n` +
+        `  export NODE_EXTRA_CA_CERTS=${forwardProxyCA}\n` +
+        "  (if anything else on this host also MITMs api.anthropic.com, use\n" +
+        "   `claude-via-proxy --remote-control` instead — that variable takes\n" +
+        "   one file, so setting it here would untrust the other CA)\n");
   }
   let closed = false;
   return {