agent-shim 7.1.2 → 7.2.0

package/dist/index.cjs

@@ -2440,9 +2440,9 @@ async function startConnectServer(config, effects, preferredPort) {
       config.serveRouted(request3, response);
       return;
     }
-    effects.forwardHttp(config.upstream, request3, response);
+    effects.forwardHttp(config.upstream, request3, response, config.capture?.observePassthrough(request3));
   };
-  const httpSession = effects.createHttpSession(handler);
+  const httpSession = effects.createHttpSession(handler, config.capture === void 0 ? void 0 : (request3) => config.capture?.upgrade(request3));
   const tlsAcceptor = effects.createTlsAcceptor(config.leafFor(config.interceptHost), (secure) => {
     httpSession.serve(secure);
   });
@@ -2595,6 +2595,7 @@ function routeConnect(socket, head, context) {
     refuse(socket, REFUSAL.serviceUnavailable);
     return;
   }
+  config.capture?.connect(target, isInterceptedHost(target.host, config.interceptHost));
   socket.write(CONNECT_ESTABLISHED);
   if (isInterceptedHost(target.host, config.interceptHost)) {
     tlsAcceptor.accept(socket);
@@ -2691,11 +2692,17 @@ function realConnectEffects() {
         }
       };
     },
-    createHttpSession: (handler) => {
+    createHttpSession: (handler, onUpgrade) => {
       const server = http.createServer(handler);
       server.on("clientError", (_error, socket) => {
         socket.destroy();
       });
+      if (onUpgrade !== void 0) {
+        server.on("upgrade", (request3, socket) => {
+          onUpgrade(request3);
+          socket.destroy();
+        });
+      }
       return {
         serve: (socket) => {
           server.emit("connection", socket);
@@ -2713,7 +2720,7 @@ function realConnectEffects() {
       });
       socket.once("error", reject);
     }),
-    forwardHttp: (target, request3, response) => {
+    forwardHttp: (target, request3, response, observer) => {
       const headers = forwardableHeaders(request3.headers);
       const options = {
         host: target.host,
@@ -2733,8 +2740,14 @@ function realConnectEffects() {
         }
       }
       const onUpstreamResponse = (upstreamResponse) => {
+        observer?.onResponse(upstreamResponse.statusCode ?? HTTP_BAD_GATEWAY, upstreamResponse.headers);
         response.writeHead(upstreamResponse.statusCode ?? HTTP_BAD_GATEWAY, forwardableHeaders(upstreamResponse.headers));
         response.flushHeaders();
+        if (observer !== void 0) {
+          upstreamResponse.on("data", (chunk) => {
+            observer.onResponseChunk(chunk);
+          });
+        }
         upstreamResponse.pipe(response);
       };
       const upstream = target.tls ? https.request(options, onUpstreamResponse) : http.request(options, onUpstreamResponse);
@@ -2747,6 +2760,14 @@ function realConnectEffects() {
         response.writeHead(HTTP_BAD_GATEWAY, { "content-type": "text/plain", "content-length": String(body.length) });
         response.end(body);
       });
+      if (observer !== void 0) {
+        request3.on("data", (chunk) => {
+          observer.onRequestChunk(chunk);
+        });
+        response.on("close", () => {
+          observer.onEnd();
+        });
+      }
       request3.pipe(upstream);
       request3.socket.setNoDelay(true);
       upstream.on("socket", (socket) => {

package/dist/index.mjs

@@ -2366,9 +2366,9 @@ async function startConnectServer(config, effects, preferredPort) {
       config.serveRouted(request3, response);
       return;
     }
-    effects.forwardHttp(config.upstream, request3, response);
+    effects.forwardHttp(config.upstream, request3, response, config.capture?.observePassthrough(request3));
   };
-  const httpSession = effects.createHttpSession(handler);
+  const httpSession = effects.createHttpSession(handler, config.capture === void 0 ? void 0 : (request3) => config.capture?.upgrade(request3));
   const tlsAcceptor = effects.createTlsAcceptor(config.leafFor(config.interceptHost), (secure) => {
     httpSession.serve(secure);
   });
@@ -2521,6 +2521,7 @@ function routeConnect(socket, head, context) {
     refuse(socket, REFUSAL.serviceUnavailable);
     return;
   }
+  config.capture?.connect(target, isInterceptedHost(target.host, config.interceptHost));
   socket.write(CONNECT_ESTABLISHED);
   if (isInterceptedHost(target.host, config.interceptHost)) {
     tlsAcceptor.accept(socket);
@@ -2617,11 +2618,17 @@ function realConnectEffects() {
         }
       };
     },
-    createHttpSession: (handler) => {
+    createHttpSession: (handler, onUpgrade) => {
       const server = http.createServer(handler);
       server.on("clientError", (_error, socket) => {
         socket.destroy();
       });
+      if (onUpgrade !== void 0) {
+        server.on("upgrade", (request3, socket) => {
+          onUpgrade(request3);
+          socket.destroy();
+        });
+      }
       return {
         serve: (socket) => {
           server.emit("connection", socket);
@@ -2639,7 +2646,7 @@ function realConnectEffects() {
       });
       socket.once("error", reject);
     }),
-    forwardHttp: (target, request3, response) => {
+    forwardHttp: (target, request3, response, observer) => {
       const headers = forwardableHeaders(request3.headers);
       const options = {
         host: target.host,
@@ -2659,8 +2666,14 @@ function realConnectEffects() {
         }
       }
       const onUpstreamResponse = (upstreamResponse) => {
+        observer?.onResponse(upstreamResponse.statusCode ?? HTTP_BAD_GATEWAY, upstreamResponse.headers);
         response.writeHead(upstreamResponse.statusCode ?? HTTP_BAD_GATEWAY, forwardableHeaders(upstreamResponse.headers));
         response.flushHeaders();
+        if (observer !== void 0) {
+          upstreamResponse.on("data", (chunk) => {
+            observer.onResponseChunk(chunk);
+          });
+        }
         upstreamResponse.pipe(response);
       };
       const upstream = target.tls ? https.request(options, onUpstreamResponse) : http.request(options, onUpstreamResponse);
@@ -2673,6 +2686,14 @@ function realConnectEffects() {
         response.writeHead(HTTP_BAD_GATEWAY, { "content-type": "text/plain", "content-length": String(body.length) });
         response.end(body);
       });
+      if (observer !== void 0) {
+        request3.on("data", (chunk) => {
+          observer.onRequestChunk(chunk);
+        });
+        response.on("close", () => {
+          observer.onEnd();
+        });
+      }
       request3.pipe(upstream);
       request3.socket.setNoDelay(true);
       upstream.on("socket", (socket) => {

package/dist/types/frontdoor/capture.d.ts

@@ -0,0 +1,45 @@
+import type { IncomingHttpHeaders } from "node:http";
+/**
+ * How much of any one chunk is logged. A chunk excerpt only has to identify what the traffic is and carry the first frames of a stream, and 8 KiB is already the head budget this surface applies elsewhere (`MAX_CONNECT_HEAD_BYTES`), so one budget serves both notions of "a diagnostic excerpt".
+ */
+export declare const CHUNK_LOG_CAP_BYTES = 8192;
+/**
+ * How many body bytes each direction of one request may log in total. Enough to hold a full Remote Control handshake and a long run of its frames, while bounding the file against an unbounded SSE stream that could otherwise grow it without limit. Bytes past the cap are counted, never stored.
+ */
+export declare const STREAM_LOG_CAP_BYTES = 262144;
+/** The request facts a capture sees, shaped so both a real `IncomingMessage` and a test's plain object satisfy it. */
+interface CapturedRequestShape {
+    readonly method?: string;
+    readonly url?: string;
+    readonly headers: IncomingHttpHeaders;
+}
+/** The callbacks one piped request's forwarding drives, all optional callers except, so a fake or a partial observer fits the same seam. */
+export interface PassthroughObserver {
+    readonly onRequestChunk: (chunk: Buffer) => void;
+    readonly onResponse: (status: number, headers: IncomingHttpHeaders) => void;
+    readonly onResponseChunk: (chunk: Buffer) => void;
+    readonly onEnd: () => void;
+}
+/** The tap the connect surface drives. `undefined` everywhere means "not capturing"; one object covers the whole door process. */
+export interface ConnectCapture {
+    /** Records one authenticated CONNECT target: the host and port only, since a blind tunnel's bytes are unreadable by construction. */
+    readonly connect: (target: {
+        readonly host: string;
+        readonly port: number;
+    }, intercepted: boolean) => void;
+    /** Records one non-routed request's head and returns the observer its forwarding drives, so the capture correlates every later chunk with the request it belongs to. */
+    readonly observePassthrough: (request: CapturedRequestShape) => PassthroughObserver;
+    /** Records one HTTP upgrade request arriving on a terminated session. The surface destroys the socket afterwards either way, with or without a capture, matching Node's own no-listener behaviour exactly. */
+    readonly upgrade: (request: CapturedRequestShape) => void;
+}
+/** Replaces every header value whose name looks like a credential with a marker, keeping every other header verbatim. Returns a fresh object. */
+export declare function redactHeaders(headers: Readonly<IncomingHttpHeaders>): IncomingHttpHeaders;
+/**
+ * Redacts one body excerpt for the capture file. A body that parses as JSON is redacted structurally (key-named credentials go even when their shape matches no pattern); anything else gets the substring patterns, which still catch the bearer and JWT forms an OAuth refresh or a Remote Control frame carries. Invalid UTF-8 decodes with replacement characters, which is fine: the excerpt exists to be read, not to be re-encoded.
+ */
+export declare function redactBody(chunk: Readonly<Buffer>): string;
+/**
+ * Builds the file-backed capture: one JSON object per line, appended to `file` (conventionally `logs/frontdoor-capture.jsonl`), never read back by the door itself. The directory is created up front rather than per record, so a capture started against a fresh state root cannot race its own first append.
+ */
+export declare function createFileCapture(file: string, now?: () => Date): ConnectCapture;
+export {};

package/dist/types/frontdoor/connect.d.ts

@@ -1,11 +1,12 @@
 import type { IncomingHttpHeaders, IncomingMessage, ServerResponse } from "node:http";
 import * as net from "node:net";
+import type { ConnectCapture, PassthroughObserver } from "./capture";
 /**
  * The front door's CONNECT surface, so an OAuth session can have agent-shim's routing AND Claude Code's Remote Control at once: Remote Control refuses any `ANTHROPIC_BASE_URL` other than the real API, but happily honours `HTTPS_PROXY`, so OAuth launches route at the proxy layer instead.
  *
  * Nothing is tunnelled or intercepted for a client that has not authenticated: every CONNECT request must present a live launch's capability as its proxy credential (`Proxy-Authorization: Basic`, which clients derive from the credential in the `HTTPS_PROXY` URL the launcher sets), or it is answered 407 before any target is dialled, so the port is no open proxy for other local processes. Pending and authenticated connections are bounded by `ConnectLimits`.
  *
- * Every authenticated CONNECT target is blind-tunnelled byte for byte EXCEPT the intercept host (Claude Code's own API), whose TLS this surface terminates with a leaf certificate signed by a locally generated CA. On the terminated session, the paths the front door routes (`/v1/`) are handed to the same ordered pipeline the provider listener serves (the client's Authorization header passes through untouched), and every other path is piped by this surface to the real upstream over TLS, so Remote Control's streaming, OAuth refreshes, and unknown endpoints bypass the pipeline entirely.
+ * Every authenticated CONNECT target is blind-tunnelled byte for byte EXCEPT the intercept host (Claude Code's own API), whose TLS this surface terminates with a leaf certificate signed by a locally generated CA. On the terminated session, the paths the front door routes (`/v1/`) are handed to the same ordered pipeline the provider listener serves (the client's Authorization header passes through untouched), and every other path is piped by this surface to the real upstream over TLS, so Remote Control's streaming, OAuth refreshes, and unknown endpoints bypass the pipeline entirely. When a `capture` is configured, those piped exchanges and every CONNECT target are recorded through it (see `./capture.ts`); the forwarding itself is identical either way.
  */
 /** The one CONNECT host whose TLS gets terminated: Claude Code's own API, the upstream every OAuth session is really talking to. */
 export declare const CONNECT_INTERCEPT_HOST = "api.anthropic.com";
@@ -132,12 +133,12 @@ export interface ConnectEffects {
     readonly listenLoopback: (preferredPort: number | undefined, onSocket: (socket: net.Socket) => void) => Promise<ConnectListenerHandle>;
     /** Builds the TLS terminator for one leaf, handing each successfully handshaked session to `onSecure`. */
     readonly createTlsAcceptor: (leaf: LeafCert, onSecure: (secure: net.Socket) => void) => TlsAcceptor;
-    /** Builds the HTTP parser bound to one request handler. */
-    readonly createHttpSession: (handler: ConnectRequestHandler) => HttpParserSession;
+    /** Builds the HTTP parser bound to one request handler. `onUpgrade`, when given, sees every HTTP upgrade request arriving on a terminated session; the session destroys the socket afterwards either way, with or without one, matching Node's own no-listener behaviour. */
+    readonly createHttpSession: (handler: ConnectRequestHandler, onUpgrade?: (request: IncomingMessage) => void) => HttpParserSession;
     /** Opens a raw TCP connection for a blind tunnel. */
     readonly connectTcp: (host: string, port: number) => Promise<net.Socket>;
-    /** Streams one request to `target` and the response back, never buffering a body. */
-    readonly forwardHttp: (target: ConnectForwardTarget, request: IncomingMessage, response: ServerResponse) => void;
+    /** Streams one request to `target` and the response back, never buffering a body. When `observer` is given, the forwarding drives it with additive listeners (request and response chunks arrive to both the pipe and the observer) so capturing never changes the forwarding's own flow control. */
+    readonly forwardHttp: (target: ConnectForwardTarget, request: IncomingMessage, response: ServerResponse, observer?: PassthroughObserver) => void;
 }
 /** Everything the connect surface needs to route, resolved before it starts. */
 export interface ConnectServerConfig {
@@ -155,6 +156,8 @@ export interface ConnectServerConfig {
     readonly isLiveCapability: (token: string) => boolean;
     /** The connection deadlines and caps; production passes `CONNECT_LIMITS`. */
     readonly limits: ConnectLimits;
+    /** The diagnostic tap, when capturing is enabled; absent means nothing is recorded. */
+    readonly capture?: ConnectCapture;
 }
 /** A running connect surface. */
 export interface ConnectServerHandle {

package/dist/types/usage/schema.d.ts

@@ -45,8 +45,8 @@ export declare const UsageRecordSchema: z.ZodObject<{
     latencyMs: z.ZodNumber;
     durationMs: z.ZodNumber;
     outcome: z.ZodEnum<{
-        completed: "completed";
         aborted: "aborted";
+        completed: "completed";
     }>;
     usage: z.ZodOptional<z.ZodObject<{
         inputTokens: z.ZodOptional<z.ZodNumber>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-shim",
-  "version": "7.1.2",
+  "version": "7.2.0",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",