config: fork-local inputs for /watch-pr-and-manage-integrated

Author: codeslake

.claude/deploy.sh

@@ -0,0 +1,57 @@
+#!/bin/bash
+# CCF — put THIS machine on origin/integrated.
+#
+# Contract: exit 0 = on the branch; non-zero = not, reason on stdout; one line
+# naming the host and the sha.
+set -eu
+D="$HOME/.local/share/cache-fix-fork"
+
+[ -d "$D/.git" ] || { echo "REFUSE: $(hostname -s):$D is not a checkout"; exit 1; }
+
+# Refuse rather than resolve. `reset --hard` would answer a wrong-branch tree by
+# discarding whatever is there, and on this machine that tree is what every live
+# session's launcher runs from.
+branch=$(git -C "$D" rev-parse --abbrev-ref HEAD)
+[ "$branch" = "integrated" ] || {
+  echo "REFUSE: $(hostname -s):$D is on '$branch' — a human decides this"; exit 1; }
+
+git -C "$D" fetch origin integrated --quiet
+# reset, not merge --ff-only: the rebuild force-pushes `integrated` (it is
+# rebuilt from upstream/main every time, never patched), so the deployed copy is
+# routinely NOT a fast-forward from its own HEAD. --ff-only would refuse every
+# rebuild that dropped a merged PR. Safe here because nothing edits this tree by
+# hand — the wrong-branch guard above is what protects the case that matters.
+git -C "$D" reset --hard -q origin/integrated
+echo "$(hostname -s) @ $(git -C "$D" rev-parse --short HEAD)"
+
+# Re-apply the usage-log opt-in. `usage-log` ships enabled:false in its own
+# export default — upstream's deliberate opt-in, activated by an entry in
+# proxy/extensions.json. That file is TRACKED, so the reset above reverts it and
+# the extension goes quiet with nothing to say it did.
+#
+# Measured 2026-08-01: ~/.claude/usage.jsonl last written 2026-07-04 — four weeks
+# of per-call token accounting missing while the proxy itself was healthy at 96%
+# cache hit rate, so /check-usage could not attribute a 5h window that had
+# reached 85%. Then measured again the same day: running the one-line
+# `reset --hard` deploy took usage-log from {"enabled":true} back to absent.
+# This block is why deploy is a script and not a conf string.
+python3 - "$D/proxy/extensions.json" <<'PY' || echo "WARN: $(hostname -s) could not enable usage-log (accounting only, proxy unaffected)"
+import json, sys
+p = sys.argv[1]
+with open(p) as f:
+    cfg = json.load(f)
+if cfg.get("usage-log", {}).get("enabled") is not True:
+    cfg["usage-log"] = {"enabled": True, "order": 650}
+    with open(p, "w") as f:
+        json.dump(cfg, f, indent=2)
+        f.write("\n")
+PY
+
+# Extensions are read ONCE at proxy boot and hot-reload is opt-in and off, so
+# flipping usage-log on disk does nothing for a proxy already running. Report it;
+# restarting drops in-flight requests for every session on that port and is a
+# separate, confirmed step.
+pgrep -f 'cache-fix-fork/proxy/server.mjs' >/dev/null 2>&1 &&
+  echo "NOTE: $(hostname -s) has a live proxy holding pre-deploy code — it keeps it until relaunch"
+
+exit 0

.claude/integrated.conf

@@ -0,0 +1,29 @@
+# CCF — <repo>/.claude/integrated.conf
+#
+# Committed on `integrated-config`, the first input to every rebuild. Reaches
+# upstream never: every PR branch is cut from upstream/main, so there is no path
+# for this file onto one. Measured before relying on it —
+#   git ls-tree ca-trust-guard .claude/   -> agent-name, github-app only
+#   git reset --hard upstream/main        -> a conf committed on `integrated`
+#                                            is DESTROYED, which is why it lives
+#                                            on its own branch instead.
+
+UPSTREAM_REPO=cnighswonger/claude-code-cache-fix
+UPSTREAM_REMOTE=upstream
+UPSTREAM_BRANCH=main
+FORK_REMOTE=origin
+
+INTEGRATED_BRANCH=integrated
+
+PR_AUTHOR=codeslake
+
+# The proxy prefix is load-bearing, not decoration: without it a test in
+# test/proxy-server.test.mjs makes a real api.anthropic.com request and hangs on
+# this network until it times out.
+TEST_CMD='HTTPS_PROXY=http://127.0.0.1:8118 NO_PROXY=localhost,127.0.0.1,::1 npm test'
+
+TEST_CAVEAT='EMFILE in test/proxy-server.test.mjs is fs.inotify.max_user_instances (128 on lmd42), not a regression — confirm it fails identically at the merge base before calling it ours'
+
+DEPLOY_HOSTS='lmd42-docker via-work-mac via-personal-mac'
+
+POLL=300

.claude/verify.sh

@@ -0,0 +1,65 @@
+#!/bin/bash
+# CCF — is the deploy actually LIVE on this machine?
+# One line per check: <name>\tOK|FAIL\t<detail>. Non-zero exit if any FAIL.
+set -u
+D="$HOME/.local/share/cache-fix-fork"
+CFG="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
+fail=0
+say() { printf '%s\t%s\t%s\n' "$1" "$2" "$3"; [ "$2" = FAIL ] && fail=1; return 0; }
+
+# 1. The launcher parses at all. A tree that cannot even be loaded is the one
+#    failure that makes every other probe meaningless.
+launcher="$D/bin/claude-via-proxy.mjs"
+if [ ! -r "$launcher" ]; then say launcher FAIL "absent: $launcher"
+elif out=$(node --check "$launcher" 2>&1); then say launcher OK "parses"
+else say launcher FAIL "${out:-parse failed}"; fi
+
+# 2. The guard agrees with this machine's LIVE bundle.
+#
+#    This is the check that earns its place: the bundle is written by a third
+#    component (cc-wrapper's cachefix-ensure) from inputs neither this repo nor
+#    the deploy controls, so a tree that is correct can still meet a bundle it
+#    refuses. Probing bin/ca-trust.mjs — the module the launcher imports, not a
+#    copy — is the point of it living in its own file.
+#
+#    Absent bundle is OK, not FAIL: a host with no builder is a supported state
+#    and the launcher falls back to its own CA. Absent CA is FAIL — forward-proxy
+#    mode cannot work without one.
+if [ ! -r "$CFG/cache-fix-ca/ca.pem" ]; then
+  say ca-trust FAIL "no proxy CA at $CFG/cache-fix-ca/ca.pem"
+elif [ ! -s "$CFG/ca-trust.pem" ]; then
+  say ca-trust OK "no merged bundle on this host — launcher uses its own CA"
+else
+  out=$(node -e '
+    import(process.argv[1] + "/bin/ca-trust.mjs").then(async m => {
+      const fs = await import("node:fs");
+      const cfg = process.argv[2];
+      const ca = fs.readFileSync(cfg + "/cache-fix-ca/ca.pem");
+      const merged = fs.readFileSync(cfg + "/ca-trust.pem", "utf8");
+      const n = (merged.match(/^-----BEGIN CERTIFICATE-----$/gm) || []).length;
+      const v = m.bundleCarriesOurCA(merged, ca);
+      console.log(n + " certs: " + (v.ok ? "accepted" : "REFUSED — " + v.reason));
+      process.exit(v.ok ? 0 : 1);
+    }).catch(e => { console.log("threw: " + e.message); process.exit(1); });
+  ' "$D" "$CFG" 2>&1)
+  if [ $? -eq 0 ]; then say ca-trust OK "$out"; else say ca-trust FAIL "$out"; fi
+fi
+
+# 3. A proxy answers. Read the port the sessions were actually built against
+#    rather than assuming 9901 — a session that started during a reload window
+#    baked whatever port it got, and asserting the default would pass while
+#    every live session dialled a dead one.
+port=$(sed -n 's/.*"CLAUDE_CODE_CACHE_FIX_PORT" *: *"\([0-9]*\)".*/\1/p' "$HOME/.claude.json" 2>/dev/null | head -1)
+port=${port:-9901}
+if out=$(curl -sf --max-time 3 --noproxy '*' "http://127.0.0.1:$port/health" 2>&1); then
+  case "$out" in
+    *'"forward_proxy":true'*) say proxy-live OK "port $port: $out" ;;
+    # Answering in reverse-proxy mode is not "up": that mode sets
+    # ANTHROPIC_BASE_URL, which is what disables Remote Control.
+    *) say proxy-live FAIL "port $port answers but forward_proxy is not true: $out" ;;
+  esac
+else
+  say proxy-live FAIL "nothing on 127.0.0.1:$port"
+fi
+
+exit $fail