agent-shim 7.13.2 → 7.14.0

package/dist/cli.cjs

@@ -15625,7 +15625,7 @@ var require_agent = __commonJS({
     function defaultFactory(origin, opts) {
       return opts && opts.connections === 1 ? new Client(origin, opts) : new Pool(origin, opts);
     }
-    var Agent7 = class extends DispatcherBase {
+    var Agent5 = class extends DispatcherBase {
       constructor({ factory = defaultFactory, maxOrigins = Infinity, connect: connect3, ...options } = {}) {
         if (typeof factory !== "function") {
           throw new InvalidArgumentError2("factory must be a function.");
@@ -15734,7 +15734,7 @@ var require_agent = __commonJS({
         return allClientStats;
       }
     };
-    module2.exports = Agent7;
+    module2.exports = Agent5;
   }
 });
 
@@ -16440,7 +16440,7 @@ var require_proxy_agent = __commonJS({
   "node_modules/.pnpm/undici@7.29.1/node_modules/undici/lib/dispatcher/proxy-agent.js"(exports2, module2) {
     "use strict";
     var { kProxy, kClose, kDestroy, kDispatch } = require_symbols();
-    var Agent7 = require_agent();
+    var Agent5 = require_agent();
     var Pool = require_pool();
     var DispatcherBase = require_dispatcher_base();
     var { InvalidArgumentError: InvalidArgumentError2, RequestAbortedError, SecureProxyConnectionError } = require_errors();
@@ -16571,7 +16571,7 @@ var require_proxy_agent = __commonJS({
         } else {
           this[kClient] = clientFactory(url2, { connect: connect3 });
         }
-        this[kAgent] = new Agent7({
+        this[kAgent] = new Agent5({
           ...opts,
           factory,
           connect: async (opts2, callback) => {
@@ -16699,7 +16699,7 @@ var require_env_http_proxy_agent = __commonJS({
     var DispatcherBase = require_dispatcher_base();
     var { kClose, kDestroy, kClosed, kDestroyed, kDispatch, kNoProxyAgent, kHttpProxyAgent, kHttpsProxyAgent } = require_symbols();
     var ProxyAgent = require_proxy_agent();
-    var Agent7 = require_agent();
+    var Agent5 = require_agent();
     var DEFAULT_PORTS = {
       "http:": 80,
       "https:": 443
@@ -16712,7 +16712,7 @@ var require_env_http_proxy_agent = __commonJS({
         super();
         this.#opts = opts;
         const { httpProxy, httpsProxy, noProxy, ...agentOpts } = opts;
-        this[kNoProxyAgent] = new Agent7(agentOpts);
+        this[kNoProxyAgent] = new Agent5(agentOpts);
         const HTTP_PROXY = httpProxy ?? process.env.http_proxy ?? process.env.HTTP_PROXY;
         if (HTTP_PROXY) {
           this[kHttpProxyAgent] = new ProxyAgent({ ...agentOpts, uri: HTTP_PROXY });
@@ -19410,7 +19410,7 @@ var require_mock_agent = __commonJS({
   "node_modules/.pnpm/undici@7.29.1/node_modules/undici/lib/mock/mock-agent.js"(exports2, module2) {
     "use strict";
     var { kClients } = require_symbols();
-    var Agent7 = require_agent();
+    var Agent5 = require_agent();
     var {
       kAgent,
       kMockAgentSet,
@@ -19448,7 +19448,7 @@ var require_mock_agent = __commonJS({
         if (opts?.agent && typeof opts.agent.dispatch !== "function") {
           throw new InvalidArgumentError2("Argument opts.agent must implement Agent");
         }
-        const agent = opts?.agent ? opts.agent : new Agent7(opts);
+        const agent = opts?.agent ? opts.agent : new Agent5(opts);
         this[kAgent] = agent;
         this[kClients] = agent[kClients];
         this[kOptions] = mockOptions;
@@ -20055,7 +20055,7 @@ var require_snapshot_recorder = __commonJS({
 var require_snapshot_agent = __commonJS({
   "node_modules/.pnpm/undici@7.29.1/node_modules/undici/lib/mock/snapshot-agent.js"(exports2, module2) {
     "use strict";
-    var Agent7 = require_agent();
+    var Agent5 = require_agent();
     var MockAgent = require_mock_agent();
     var { SnapshotRecorder } = require_snapshot_recorder();
     var WrapHandler = require_wrap_handler();
@@ -20106,7 +20106,7 @@ var require_snapshot_agent = __commonJS({
         });
         this[kSnapshotLoaded] = false;
         if (this[kSnapshotMode] === "record" || this[kSnapshotMode] === "update" || this[kSnapshotMode] === "playback" && opts.excludeUrls && opts.excludeUrls.length > 0) {
-          this[kRealAgent] = new Agent7(opts);
+          this[kRealAgent] = new Agent5(opts);
         }
         if ((this[kSnapshotMode] === "playback" || this[kSnapshotMode] === "update") && this[kSnapshotPath]) {
           this.loadSnapshots().catch(() => {
@@ -20345,9 +20345,9 @@ var require_global2 = __commonJS({
     var globalDispatcher = /* @__PURE__ */ Symbol.for("undici.globalDispatcher.2");
     var legacyGlobalDispatcher = /* @__PURE__ */ Symbol.for("undici.globalDispatcher.1");
     var { InvalidArgumentError: InvalidArgumentError2 } = require_errors();
-    var Agent7 = require_agent();
+    var Agent5 = require_agent();
     if (getGlobalDispatcher() === void 0) {
-      setGlobalDispatcher(new Agent7());
+      setGlobalDispatcher(new Agent5());
     }
     function setGlobalDispatcher(agent) {
       if (!agent || typeof agent.dispatch !== "function") {
@@ -20817,7 +20817,7 @@ var require_dump = __commonJS({
 var require_dns = __commonJS({
   "node_modules/.pnpm/undici@7.29.1/node_modules/undici/lib/interceptor/dns.js"(exports2, module2) {
     "use strict";
-    var { isIP } = require("node:net");
+    var { isIP: isIP2 } = require("node:net");
     var { lookup } = require("node:dns");
     var DecoratorHandler = require_decorator_handler();
     var { InvalidArgumentError: InvalidArgumentError2, InformationalError } = require_errors();
@@ -21223,7 +21223,7 @@ var require_dns = __commonJS({
       return (dispatch) => {
         return function dnsInterceptor(origDispatchOpts, handler) {
           const origin = origDispatchOpts.origin.constructor === URL ? origDispatchOpts.origin : new URL(origDispatchOpts.origin);
-          if (isIP(origin.hostname) !== 0) {
+          if (isIP2(origin.hostname) !== 0) {
             return dispatch(origDispatchOpts, handler);
           }
           instance.runLookup(origin, origDispatchOpts, (err, newOrigin) => {
@@ -31562,7 +31562,7 @@ var require_undici = __commonJS({
     var Pool = require_pool();
     var BalancedPool = require_balanced_pool();
     var RoundRobinPool = require_round_robin_pool();
-    var Agent7 = require_agent();
+    var Agent5 = require_agent();
     var ProxyAgent = require_proxy_agent();
     var Socks5ProxyAgent = require_socks5_proxy_agent();
     var EnvHttpProxyAgent = require_env_http_proxy_agent();
@@ -31589,7 +31589,7 @@ var require_undici = __commonJS({
     module2.exports.Pool = Pool;
     module2.exports.BalancedPool = BalancedPool;
     module2.exports.RoundRobinPool = RoundRobinPool;
-    module2.exports.Agent = Agent7;
+    module2.exports.Agent = Agent5;
     module2.exports.ProxyAgent = ProxyAgent;
     module2.exports.Socks5ProxyAgent = Socks5ProxyAgent;
     module2.exports.EnvHttpProxyAgent = EnvHttpProxyAgent;
@@ -61032,7 +61032,7 @@ function registerIdentityCommand(program2, deps) {
 // package.json
 var package_default = {
   name: "agent-shim",
-  version: "7.13.2",
+  version: "7.14.0",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -64833,13 +64833,63 @@ function realConnectCertStore(paths) {
 }
 
 // src/frontdoor/connectEffects.ts
+var dns = __toESM(require("node:dns"), 1);
 var http = __toESM(require("node:http"), 1);
 var https = __toESM(require("node:https"), 1);
 var net3 = __toESM(require("node:net"), 1);
 var tls = __toESM(require("node:tls"), 1);
+var UPSTREAM_LOCAL_PORT_START = 47900;
+var UPSTREAM_LOCAL_PORT_END = 47919;
+var nextUpstreamLocalPort = UPSTREAM_LOCAL_PORT_START;
+function upstreamLocalPort() {
+  const port = nextUpstreamLocalPort;
+  nextUpstreamLocalPort = nextUpstreamLocalPort === UPSTREAM_LOCAL_PORT_END ? UPSTREAM_LOCAL_PORT_START : nextUpstreamLocalPort + 1;
+  return port;
+}
+var realAddressLookup = (host, _options, callback) => {
+  if (net3.isIP(host) !== 0) {
+    callback(null, [{ address: host, family: net3.isIP(host) }]);
+    return;
+  }
+  dns.resolve4(host, (error62, addresses) => {
+    const first = addresses[0];
+    if (error62 !== null || first === void 0) {
+      callback(error62 ?? new Error(`no A record for ${host}`), [{ address: "", family: 4 }]);
+      return;
+    }
+    callback(null, [{ address: first, family: 4 }]);
+  });
+};
+var HTTP_PORT = 80;
+function exemptDial(options, defaultPort) {
+  const host = typeof options.host === "string" ? options.host : "";
+  const port = typeof options.port === "number" ? options.port : defaultPort;
+  return net3.connect(net3.isIP(host) === 0 ? { host, port, localPort: upstreamLocalPort(), lookup: realAddressLookup } : { host, port });
+}
+function requestServername(options, fallback) {
+  return "servername" in options && typeof options.servername === "string" && options.servername !== "" ? options.servername : fallback;
+}
+var ExemptHttpAgent = class extends http.Agent {
+  createConnection(options) {
+    return exemptDial(options, HTTP_PORT);
+  }
+};
+var ExemptTlsAgent = class extends https.Agent {
+  createConnection(options) {
+    const host = typeof options.host === "string" ? options.host : "";
+    const tlsOptions = { socket: exemptDial(options, HTTPS_PORT), servername: requestServername(options, host) };
+    if ("ca" in options && Array.isArray(options.ca)) {
+      tlsOptions.ca = options.ca;
+    }
+    if ("rejectUnauthorized" in options && typeof options.rejectUnauthorized === "boolean") {
+      tlsOptions.rejectUnauthorized = options.rejectUnauthorized;
+    }
+    return tls.connect(tlsOptions);
+  }
+};
 function realConnectEffects() {
-  const plainAgent = new http.Agent({ keepAlive: true });
-  const tlsAgent = new https.Agent({ keepAlive: true });
+  const plainAgent = new ExemptHttpAgent();
+  const tlsAgent = new ExemptTlsAgent();
   const listenOnce = async (port, onSocket) => await new Promise((resolve, reject) => {
     const accepted = /* @__PURE__ */ new Set();
     const server = net3.createServer((socket) => {
@@ -64925,11 +64975,23 @@ function realConnectEffects() {
       };
     },
     connectTlsUpstream: async (host, port, clientAlpn) => await new Promise((resolve, reject) => {
-      const socket = tls.connect({ host, port, servername: host, ...clientAlpn === void 0 ? {} : { ALPNProtocols: [clientAlpn] } });
-      socket.once("secureConnect", () => {
-        resolve(socket);
-      });
-      socket.once("error", reject);
+      const dial = (localPort) => {
+        const raw = net3.connect({ host, port, localPort, lookup: realAddressLookup });
+        return tls.connect({ socket: raw, servername: host, ...clientAlpn === void 0 ? {} : { ALPNProtocols: [clientAlpn] } });
+      };
+      const settle2 = (candidate) => {
+        candidate.once("secureConnect", () => {
+          resolve(candidate);
+        });
+        candidate.once("error", (error62) => {
+          if ("code" in error62 && error62.code === "EADDRINUSE") {
+            settle2(dial(upstreamLocalPort()));
+            return;
+          }
+          reject(error62);
+        });
+      };
+      settle2(dial(upstreamLocalPort()));
     }),
     connectTcp: async (host, port) => await new Promise((resolve, reject) => {
       const socket = net3.connect({ host, port });
@@ -64943,6 +65005,7 @@ function realConnectEffects() {
       const options = {
         host: target.host,
         port: target.port,
+        lookup: realAddressLookup,
         method: request6.method,
         path: request6.url,
         headers,
@@ -66222,7 +66285,7 @@ function createPassthroughRoute(name, target) {
   const base = new URL(target.baseUrl);
   const tls2 = base.protocol === "https:";
   const basePath = base.pathname.replace(/\/+$/, "");
-  const agent = tls2 ? new https3.Agent({ keepAlive: true }) : new http4.Agent({ keepAlive: true });
+  const agent = tls2 ? new ExemptTlsAgent() : new ExemptHttpAgent();
   return {
     name,
     headroomEligible: true,
@@ -68281,11 +68344,13 @@ var READY_FETCH_TIMEOUT_MS = 2e3;
 function headroomPidRunning(pid) {
   return !exitedHeadroom.has(pid) && realIsProcessRunning(pid);
 }
-function headroomSpawnEnv(parentEnv, allowlist, settings2) {
+function headroomSpawnEnv(parentEnv, allowlist, settings2, caBundle) {
   return {
     ...parentEnv,
     HEADROOM_ALLOWED_BASE_URLS: allowlist.join(","),
     HEADROOM_HTTP2: parentEnv.HEADROOM_HTTP2 ?? "0",
+    // A transparent-interception deployment redirects the API host's address machine-wide, so headroom's own Python dials reach the front door's leaf instead of the origin's public certificate, and Python trusts only the system store: point its two trust variables (urllib3/httpx read both) at the door's combined bundle, which carries the system-equivalent anchors alongside the door's CA. An explicit value in the parent environment always wins, exactly like HEADROOM_HTTP2.
+    ...caBundle === void 0 || parentEnv.REQUESTS_CA_BUNDLE !== void 0 || parentEnv.SSL_CERT_FILE !== void 0 ? {} : { REQUESTS_CA_BUNDLE: caBundle, SSL_CERT_FILE: caBundle },
     ...settingsEnv(settings2)
   };
 }
@@ -68324,13 +68389,14 @@ function realSupervisorPorts(paths) {
     isPortFree: realIsPortFree,
     readConfig: () => resolveSupervisorConfig(readGlobalConfig(paths)?.headroom ?? {}),
     spawnHeadroom: (port, allowlist, settings2) => {
+      const caBundle = import_node_fs15.default.existsSync(paths.frontdoorCaCertFile) ? import_node_fs15.default.readFileSync(paths.frontdoorCaCertFile, "utf8") : void 0;
       import_node_fs15.default.mkdirSync(paths.logsDir, { recursive: true });
       const logFd = import_node_fs15.default.openSync(paths.headroomLogPath, "a");
       try {
         const child = (0, import_node_child_process5.spawn)("headroom", ["proxy", "--host", "127.0.0.1", "--port", String(port), ...settingsArgs(settings2)], {
           detached: true,
           stdio: ["ignore", logFd, logFd],
-          env: headroomSpawnEnv(process.env, allowlist, settings2)
+          env: headroomSpawnEnv(process.env, allowlist, settings2, caBundle)
         });
         if (child.pid === void 0) {
           throw new Error("spawning headroom returned no pid");

package/dist/index.cjs

@@ -3209,13 +3209,63 @@ function realConnectCertStore(paths) {
 }
 
 // src/frontdoor/connectEffects.ts
+var dns = __toESM(require("node:dns"), 1);
 var http = __toESM(require("node:http"), 1);
 var https = __toESM(require("node:https"), 1);
 var net2 = __toESM(require("node:net"), 1);
 var tls = __toESM(require("node:tls"), 1);
+var UPSTREAM_LOCAL_PORT_START = 47900;
+var UPSTREAM_LOCAL_PORT_END = 47919;
+var nextUpstreamLocalPort = UPSTREAM_LOCAL_PORT_START;
+function upstreamLocalPort() {
+  const port = nextUpstreamLocalPort;
+  nextUpstreamLocalPort = nextUpstreamLocalPort === UPSTREAM_LOCAL_PORT_END ? UPSTREAM_LOCAL_PORT_START : nextUpstreamLocalPort + 1;
+  return port;
+}
+var realAddressLookup = (host, _options, callback) => {
+  if (net2.isIP(host) !== 0) {
+    callback(null, [{ address: host, family: net2.isIP(host) }]);
+    return;
+  }
+  dns.resolve4(host, (error, addresses) => {
+    const first = addresses[0];
+    if (error !== null || first === void 0) {
+      callback(error ?? new Error(`no A record for ${host}`), [{ address: "", family: 4 }]);
+      return;
+    }
+    callback(null, [{ address: first, family: 4 }]);
+  });
+};
+var HTTP_PORT = 80;
+function exemptDial(options, defaultPort) {
+  const host = typeof options.host === "string" ? options.host : "";
+  const port = typeof options.port === "number" ? options.port : defaultPort;
+  return net2.connect(net2.isIP(host) === 0 ? { host, port, localPort: upstreamLocalPort(), lookup: realAddressLookup } : { host, port });
+}
+function requestServername(options, fallback) {
+  return "servername" in options && typeof options.servername === "string" && options.servername !== "" ? options.servername : fallback;
+}
+var ExemptHttpAgent = class extends http.Agent {
+  createConnection(options) {
+    return exemptDial(options, HTTP_PORT);
+  }
+};
+var ExemptTlsAgent = class extends https.Agent {
+  createConnection(options) {
+    const host = typeof options.host === "string" ? options.host : "";
+    const tlsOptions = { socket: exemptDial(options, HTTPS_PORT), servername: requestServername(options, host) };
+    if ("ca" in options && Array.isArray(options.ca)) {
+      tlsOptions.ca = options.ca;
+    }
+    if ("rejectUnauthorized" in options && typeof options.rejectUnauthorized === "boolean") {
+      tlsOptions.rejectUnauthorized = options.rejectUnauthorized;
+    }
+    return tls.connect(tlsOptions);
+  }
+};
 function realConnectEffects() {
-  const plainAgent = new http.Agent({ keepAlive: true });
-  const tlsAgent = new https.Agent({ keepAlive: true });
+  const plainAgent = new ExemptHttpAgent();
+  const tlsAgent = new ExemptTlsAgent();
   const listenOnce = async (port, onSocket) => await new Promise((resolve, reject) => {
     const accepted = /* @__PURE__ */ new Set();
     const server = net2.createServer((socket) => {
@@ -3301,11 +3351,23 @@ function realConnectEffects() {
       };
     },
     connectTlsUpstream: async (host, port, clientAlpn) => await new Promise((resolve, reject) => {
-      const socket = tls.connect({ host, port, servername: host, ...clientAlpn === void 0 ? {} : { ALPNProtocols: [clientAlpn] } });
-      socket.once("secureConnect", () => {
-        resolve(socket);
-      });
-      socket.once("error", reject);
+      const dial = (localPort) => {
+        const raw = net2.connect({ host, port, localPort, lookup: realAddressLookup });
+        return tls.connect({ socket: raw, servername: host, ...clientAlpn === void 0 ? {} : { ALPNProtocols: [clientAlpn] } });
+      };
+      const settle = (candidate) => {
+        candidate.once("secureConnect", () => {
+          resolve(candidate);
+        });
+        candidate.once("error", (error) => {
+          if ("code" in error && error.code === "EADDRINUSE") {
+            settle(dial(upstreamLocalPort()));
+            return;
+          }
+          reject(error);
+        });
+      };
+      settle(dial(upstreamLocalPort()));
     }),
     connectTcp: async (host, port) => await new Promise((resolve, reject) => {
       const socket = net2.connect({ host, port });
@@ -3319,6 +3381,7 @@ function realConnectEffects() {
       const options = {
         host: target.host,
         port: target.port,
+        lookup: realAddressLookup,
         method: request3.method,
         path: request3.url,
         headers,

package/dist/index.mjs

@@ -3043,13 +3043,63 @@ function realConnectCertStore(paths) {
 }
 
 // src/frontdoor/connectEffects.ts
+import * as dns from "node:dns";
 import * as http from "node:http";
 import * as https from "node:https";
 import * as net2 from "node:net";
 import * as tls from "node:tls";
+var UPSTREAM_LOCAL_PORT_START = 47900;
+var UPSTREAM_LOCAL_PORT_END = 47919;
+var nextUpstreamLocalPort = UPSTREAM_LOCAL_PORT_START;
+function upstreamLocalPort() {
+  const port = nextUpstreamLocalPort;
+  nextUpstreamLocalPort = nextUpstreamLocalPort === UPSTREAM_LOCAL_PORT_END ? UPSTREAM_LOCAL_PORT_START : nextUpstreamLocalPort + 1;
+  return port;
+}
+var realAddressLookup = (host, _options, callback) => {
+  if (net2.isIP(host) !== 0) {
+    callback(null, [{ address: host, family: net2.isIP(host) }]);
+    return;
+  }
+  dns.resolve4(host, (error, addresses) => {
+    const first = addresses[0];
+    if (error !== null || first === void 0) {
+      callback(error ?? new Error(`no A record for ${host}`), [{ address: "", family: 4 }]);
+      return;
+    }
+    callback(null, [{ address: first, family: 4 }]);
+  });
+};
+var HTTP_PORT = 80;
+function exemptDial(options, defaultPort) {
+  const host = typeof options.host === "string" ? options.host : "";
+  const port = typeof options.port === "number" ? options.port : defaultPort;
+  return net2.connect(net2.isIP(host) === 0 ? { host, port, localPort: upstreamLocalPort(), lookup: realAddressLookup } : { host, port });
+}
+function requestServername(options, fallback) {
+  return "servername" in options && typeof options.servername === "string" && options.servername !== "" ? options.servername : fallback;
+}
+var ExemptHttpAgent = class extends http.Agent {
+  createConnection(options) {
+    return exemptDial(options, HTTP_PORT);
+  }
+};
+var ExemptTlsAgent = class extends https.Agent {
+  createConnection(options) {
+    const host = typeof options.host === "string" ? options.host : "";
+    const tlsOptions = { socket: exemptDial(options, HTTPS_PORT), servername: requestServername(options, host) };
+    if ("ca" in options && Array.isArray(options.ca)) {
+      tlsOptions.ca = options.ca;
+    }
+    if ("rejectUnauthorized" in options && typeof options.rejectUnauthorized === "boolean") {
+      tlsOptions.rejectUnauthorized = options.rejectUnauthorized;
+    }
+    return tls.connect(tlsOptions);
+  }
+};
 function realConnectEffects() {
-  const plainAgent = new http.Agent({ keepAlive: true });
-  const tlsAgent = new https.Agent({ keepAlive: true });
+  const plainAgent = new ExemptHttpAgent();
+  const tlsAgent = new ExemptTlsAgent();
   const listenOnce = async (port, onSocket) => await new Promise((resolve, reject) => {
     const accepted = /* @__PURE__ */ new Set();
     const server = net2.createServer((socket) => {
@@ -3135,11 +3185,23 @@ function realConnectEffects() {
       };
     },
     connectTlsUpstream: async (host, port, clientAlpn) => await new Promise((resolve, reject) => {
-      const socket = tls.connect({ host, port, servername: host, ...clientAlpn === void 0 ? {} : { ALPNProtocols: [clientAlpn] } });
-      socket.once("secureConnect", () => {
-        resolve(socket);
-      });
-      socket.once("error", reject);
+      const dial = (localPort) => {
+        const raw = net2.connect({ host, port, localPort, lookup: realAddressLookup });
+        return tls.connect({ socket: raw, servername: host, ...clientAlpn === void 0 ? {} : { ALPNProtocols: [clientAlpn] } });
+      };
+      const settle = (candidate) => {
+        candidate.once("secureConnect", () => {
+          resolve(candidate);
+        });
+        candidate.once("error", (error) => {
+          if ("code" in error && error.code === "EADDRINUSE") {
+            settle(dial(upstreamLocalPort()));
+            return;
+          }
+          reject(error);
+        });
+      };
+      settle(dial(upstreamLocalPort()));
     }),
     connectTcp: async (host, port) => await new Promise((resolve, reject) => {
       const socket = net2.connect({ host, port });
@@ -3153,6 +3215,7 @@ function realConnectEffects() {
       const options = {
         host: target.host,
         port: target.port,
+        lookup: realAddressLookup,
         method: request3.method,
         path: request3.url,
         headers,

package/dist/types/index.d.ts

@@ -1583,7 +1583,6 @@ declare function realConnectCertStore(paths: {
     readonly frontdoorCaKeyFile: string;
 }): ConnectCertStore;
 
-/** The real `ConnectEffects` over node's own net, tls, and http. `connectTcp` opens real connections to the CONNECTed host, so tests that want a blind tunnel redirect it. */
 declare function realConnectEffects(): ConnectEffects;
 
 /** The filesystem operations headroom coordination needs: the same shape as `FarmFs`, injected so every decision over state, sessions, and the start lock runs against an in-memory fake in tests. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-shim",
-  "version": "7.13.2",
+  "version": "7.14.0",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",