agent-shim 7.3.0 → 7.4.0

package/dist/cli.cjs

@@ -61051,7 +61051,7 @@ function resolveLaunchIdentity(paths, cwd) {
 // package.json
 var package_default = {
   name: "agent-shim",
-  version: "7.3.0",
+  version: "7.4.0",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -64859,6 +64859,7 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
 
 // src/frontdoor/connect.ts
 var CONNECT_INTERCEPT_HOST = "api.anthropic.com";
+var CONNECT_INTERCEPT_HOSTS = [CONNECT_INTERCEPT_HOST, "platform.claude.com"];
 var ROUTED_PATH_PREFIX = "/v1/";
 var HTTPS_PORT = 443;
 var MAX_PORT = 65535;
@@ -64898,9 +64899,6 @@ function parseConnectTarget(authority) {
   }
   return { host, port };
 }
-function isInterceptedHost(host, interceptHost) {
-  return host === interceptHost;
-}
 function servedByPipeline(path38) {
   return path38?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
@@ -64970,28 +64968,34 @@ function caParses(ca) {
   }
 }
 async function startConnectServer(config2, effects, preferredPort) {
-  const handler = (request6, response) => {
-    if (servedByPipeline(request6.url)) {
-      config2.serveRouted(request6, response);
-      return;
-    }
-    effects.forwardHttp(config2.upstream, request6, response, config2.capture?.observePassthrough(request6));
-  };
-  const httpSession = effects.createHttpSession(handler, config2.capture === void 0 ? void 0 : (request6) => config2.capture?.upgrade(request6));
-  const tlsAcceptor = effects.createTlsAcceptor(config2.leafFor(config2.interceptHost), (secure) => {
-    httpSession.serve(secure);
+  const onUpgrade = config2.capture === void 0 ? void 0 : (request6) => config2.capture?.upgrade(request6);
+  const sessions = config2.interceptHosts.map((host) => {
+    const handler = (request6, response) => {
+      if (host === config2.routedHost && servedByPipeline(request6.url)) {
+        config2.serveRouted(request6, response);
+        return;
+      }
+      effects.forwardHttp(config2.upstreamFor(host), request6, response, config2.capture?.observePassthrough(request6));
+    };
+    const httpSession = effects.createHttpSession(handler, onUpgrade);
+    const tlsAcceptor = effects.createTlsAcceptor(config2.leafFor(host), (secure) => {
+      httpSession.serve(secure);
+    });
+    return { host, httpSession, tlsAcceptor };
   });
   const ledger = createConnectionLedger(config2.limits, config2.isLiveCapability);
   const listener = await effects.listenLoopback(preferredPort, (socket) => {
-    handleConnect(socket, { config: config2, effects, tlsAcceptor, ledger });
+    handleConnect(socket, { config: config2, effects, sessions, ledger });
   });
   return {
     port: listener.port,
     close: async () => {
       ledger.close();
       await listener.close();
-      tlsAcceptor.close();
-      httpSession.close();
+      for (const { httpSession, tlsAcceptor } of sessions) {
+        tlsAcceptor.close();
+        httpSession.close();
+      }
     }
   };
 }
@@ -65111,7 +65115,7 @@ function proxyAuthorizationOf(head) {
   return values.length === 1 ? value : void 0;
 }
 function routeConnect(socket, head, context) {
-  const { config: config2, effects, tlsAcceptor, ledger } = context;
+  const { config: config2, effects, sessions, ledger } = context;
   const credential = proxyAuthorizationOf(head);
   const capability = credential === void 0 ? void 0 : capabilityFromProxyAuthorization(credential);
   if (capability === void 0 || !config2.isLiveCapability(capability)) {
@@ -65130,10 +65134,11 @@ function routeConnect(socket, head, context) {
     refuse(socket, REFUSAL.serviceUnavailable);
     return;
   }
-  config2.capture?.connect(target, isInterceptedHost(target.host, config2.interceptHost));
+  const session = sessions.find((entry) => entry.host === target.host);
+  config2.capture?.connect(target, session !== void 0);
   socket.write(CONNECT_ESTABLISHED);
-  if (isInterceptedHost(target.host, config2.interceptHost)) {
-    tlsAcceptor.accept(socket);
+  if (session !== void 0) {
+    session.tlsAcceptor.accept(socket);
     return;
   }
   void blindTunnel(socket, target, effects);
@@ -66967,7 +66972,8 @@ function realFrontDoorSupervisorPorts(paths) {
       }
       const server = await startConnectServer(
         {
-          interceptHost: CONNECT_INTERCEPT_HOST,
+          interceptHosts: CONNECT_INTERCEPT_HOSTS,
+          routedHost: CONNECT_INTERCEPT_HOST,
           serveRouted: (request6, response) => {
             const abort = new AbortController();
             response.on("close", () => {
@@ -66988,7 +66994,7 @@ function realFrontDoorSupervisorPorts(paths) {
             );
           },
           leafFor,
-          upstream: { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT, tls: true },
+          upstreamFor: (host) => ({ host, port: HTTPS_PORT, tls: true }),
           isLiveCapability: isLiveToken,
           limits: CONNECT_LIMITS,
           ...capture === void 0 ? {} : { capture }

package/dist/index.cjs

@@ -32,6 +32,7 @@ var index_exports = {};
 __export(index_exports, {
   AMBIENT_CREDENTIAL_VARS: () => AMBIENT_CREDENTIAL_VARS,
   CONNECT_INTERCEPT_HOST: () => CONNECT_INTERCEPT_HOST,
+  CONNECT_INTERCEPT_HOSTS: () => CONNECT_INTERCEPT_HOSTS,
   CONNECT_LIMITS: () => CONNECT_LIMITS,
   FARM_MANIFEST_FILENAME: () => FARM_MANIFEST_FILENAME,
   FrontDoorStartError: () => FrontDoorStartError,
@@ -2325,6 +2326,7 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
 
 // src/frontdoor/connect.ts
 var CONNECT_INTERCEPT_HOST = "api.anthropic.com";
+var CONNECT_INTERCEPT_HOSTS = [CONNECT_INTERCEPT_HOST, "platform.claude.com"];
 var ROUTED_PATH_PREFIX = "/v1/";
 var HTTPS_PORT = 443;
 var MAX_PORT = 65535;
@@ -2364,8 +2366,8 @@ function parseConnectTarget(authority) {
   }
   return { host, port };
 }
-function isInterceptedHost(host, interceptHost) {
-  return host === interceptHost;
+function isInterceptedHost(host, interceptHosts) {
+  return interceptHosts.includes(host);
 }
 function servedByPipeline(path8) {
   return path8?.startsWith(ROUTED_PATH_PREFIX) === true;
@@ -2435,28 +2437,34 @@ function caParses(ca) {
   }
 }
 async function startConnectServer(config, effects, preferredPort) {
-  const handler = (request3, response) => {
-    if (servedByPipeline(request3.url)) {
-      config.serveRouted(request3, response);
-      return;
-    }
-    effects.forwardHttp(config.upstream, request3, response, config.capture?.observePassthrough(request3));
-  };
-  const httpSession = effects.createHttpSession(handler, config.capture === void 0 ? void 0 : (request3) => config.capture?.upgrade(request3));
-  const tlsAcceptor = effects.createTlsAcceptor(config.leafFor(config.interceptHost), (secure) => {
-    httpSession.serve(secure);
+  const onUpgrade = config.capture === void 0 ? void 0 : (request3) => config.capture?.upgrade(request3);
+  const sessions = config.interceptHosts.map((host) => {
+    const handler = (request3, response) => {
+      if (host === config.routedHost && servedByPipeline(request3.url)) {
+        config.serveRouted(request3, response);
+        return;
+      }
+      effects.forwardHttp(config.upstreamFor(host), request3, response, config.capture?.observePassthrough(request3));
+    };
+    const httpSession = effects.createHttpSession(handler, onUpgrade);
+    const tlsAcceptor = effects.createTlsAcceptor(config.leafFor(host), (secure) => {
+      httpSession.serve(secure);
+    });
+    return { host, httpSession, tlsAcceptor };
   });
   const ledger = createConnectionLedger(config.limits, config.isLiveCapability);
   const listener = await effects.listenLoopback(preferredPort, (socket) => {
-    handleConnect(socket, { config, effects, tlsAcceptor, ledger });
+    handleConnect(socket, { config, effects, sessions, ledger });
   });
   return {
     port: listener.port,
     close: async () => {
       ledger.close();
       await listener.close();
-      tlsAcceptor.close();
-      httpSession.close();
+      for (const { httpSession, tlsAcceptor } of sessions) {
+        tlsAcceptor.close();
+        httpSession.close();
+      }
     }
   };
 }
@@ -2576,7 +2584,7 @@ function proxyAuthorizationOf(head) {
   return values.length === 1 ? value : void 0;
 }
 function routeConnect(socket, head, context) {
-  const { config, effects, tlsAcceptor, ledger } = context;
+  const { config, effects, sessions, ledger } = context;
   const credential = proxyAuthorizationOf(head);
   const capability = credential === void 0 ? void 0 : capabilityFromProxyAuthorization(credential);
   if (capability === void 0 || !config.isLiveCapability(capability)) {
@@ -2595,10 +2603,11 @@ function routeConnect(socket, head, context) {
     refuse(socket, REFUSAL.serviceUnavailable);
     return;
   }
-  config.capture?.connect(target, isInterceptedHost(target.host, config.interceptHost));
+  const session = sessions.find((entry) => entry.host === target.host);
+  config.capture?.connect(target, session !== void 0);
   socket.write(CONNECT_ESTABLISHED);
-  if (isInterceptedHost(target.host, config.interceptHost)) {
-    tlsAcceptor.accept(socket);
+  if (session !== void 0) {
+    session.tlsAcceptor.accept(socket);
     return;
   }
   void blindTunnel(socket, target, effects);
@@ -3601,6 +3610,7 @@ function evaluateAmbientCredentialGuard(params) {
 0 && (module.exports = {
   AMBIENT_CREDENTIAL_VARS,
   CONNECT_INTERCEPT_HOST,
+  CONNECT_INTERCEPT_HOSTS,
   CONNECT_LIMITS,
   FARM_MANIFEST_FILENAME,
   FrontDoorStartError,

package/dist/index.mjs

@@ -2251,6 +2251,7 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
 
 // src/frontdoor/connect.ts
 var CONNECT_INTERCEPT_HOST = "api.anthropic.com";
+var CONNECT_INTERCEPT_HOSTS = [CONNECT_INTERCEPT_HOST, "platform.claude.com"];
 var ROUTED_PATH_PREFIX = "/v1/";
 var HTTPS_PORT = 443;
 var MAX_PORT = 65535;
@@ -2290,8 +2291,8 @@ function parseConnectTarget(authority) {
   }
   return { host, port };
 }
-function isInterceptedHost(host, interceptHost) {
-  return host === interceptHost;
+function isInterceptedHost(host, interceptHosts) {
+  return interceptHosts.includes(host);
 }
 function servedByPipeline(path8) {
   return path8?.startsWith(ROUTED_PATH_PREFIX) === true;
@@ -2361,28 +2362,34 @@ function caParses(ca) {
   }
 }
 async function startConnectServer(config, effects, preferredPort) {
-  const handler = (request3, response) => {
-    if (servedByPipeline(request3.url)) {
-      config.serveRouted(request3, response);
-      return;
-    }
-    effects.forwardHttp(config.upstream, request3, response, config.capture?.observePassthrough(request3));
-  };
-  const httpSession = effects.createHttpSession(handler, config.capture === void 0 ? void 0 : (request3) => config.capture?.upgrade(request3));
-  const tlsAcceptor = effects.createTlsAcceptor(config.leafFor(config.interceptHost), (secure) => {
-    httpSession.serve(secure);
+  const onUpgrade = config.capture === void 0 ? void 0 : (request3) => config.capture?.upgrade(request3);
+  const sessions = config.interceptHosts.map((host) => {
+    const handler = (request3, response) => {
+      if (host === config.routedHost && servedByPipeline(request3.url)) {
+        config.serveRouted(request3, response);
+        return;
+      }
+      effects.forwardHttp(config.upstreamFor(host), request3, response, config.capture?.observePassthrough(request3));
+    };
+    const httpSession = effects.createHttpSession(handler, onUpgrade);
+    const tlsAcceptor = effects.createTlsAcceptor(config.leafFor(host), (secure) => {
+      httpSession.serve(secure);
+    });
+    return { host, httpSession, tlsAcceptor };
   });
   const ledger = createConnectionLedger(config.limits, config.isLiveCapability);
   const listener = await effects.listenLoopback(preferredPort, (socket) => {
-    handleConnect(socket, { config, effects, tlsAcceptor, ledger });
+    handleConnect(socket, { config, effects, sessions, ledger });
   });
   return {
     port: listener.port,
     close: async () => {
       ledger.close();
       await listener.close();
-      tlsAcceptor.close();
-      httpSession.close();
+      for (const { httpSession, tlsAcceptor } of sessions) {
+        tlsAcceptor.close();
+        httpSession.close();
+      }
     }
   };
 }
@@ -2502,7 +2509,7 @@ function proxyAuthorizationOf(head) {
   return values.length === 1 ? value : void 0;
 }
 function routeConnect(socket, head, context) {
-  const { config, effects, tlsAcceptor, ledger } = context;
+  const { config, effects, sessions, ledger } = context;
   const credential = proxyAuthorizationOf(head);
   const capability = credential === void 0 ? void 0 : capabilityFromProxyAuthorization(credential);
   if (capability === void 0 || !config.isLiveCapability(capability)) {
@@ -2521,10 +2528,11 @@ function routeConnect(socket, head, context) {
     refuse(socket, REFUSAL.serviceUnavailable);
     return;
   }
-  config.capture?.connect(target, isInterceptedHost(target.host, config.interceptHost));
+  const session = sessions.find((entry) => entry.host === target.host);
+  config.capture?.connect(target, session !== void 0);
   socket.write(CONNECT_ESTABLISHED);
-  if (isInterceptedHost(target.host, config.interceptHost)) {
-    tlsAcceptor.accept(socket);
+  if (session !== void 0) {
+    session.tlsAcceptor.accept(socket);
     return;
   }
   void blindTunnel(socket, target, effects);
@@ -3526,6 +3534,7 @@ function evaluateAmbientCredentialGuard(params) {
 export {
   AMBIENT_CREDENTIAL_VARS,
   CONNECT_INTERCEPT_HOST,
+  CONNECT_INTERCEPT_HOSTS,
   CONNECT_LIMITS,
   FARM_MANIFEST_FILENAME,
   FrontDoorStartError,

package/dist/types/frontdoor/connect.d.ts

@@ -6,10 +6,14 @@ import type { ConnectCapture, PassthroughObserver } from "./capture";
  *
  * Nothing is tunnelled or intercepted for a client that has not authenticated: every CONNECT request must present a live launch's capability as its proxy credential (`Proxy-Authorization: Basic`, which clients derive from the credential in the `HTTPS_PROXY` URL the launcher sets), or it is answered 407 before any target is dialled, so the port is no open proxy for other local processes. Pending and authenticated connections are bounded by `ConnectLimits`.
  *
- * Every authenticated CONNECT target is blind-tunnelled byte for byte EXCEPT the intercept host (Claude Code's own API), whose TLS this surface terminates with a leaf certificate signed by a locally generated CA. On the terminated session, the paths the front door routes (`/v1/`) are handed to the same ordered pipeline the provider listener serves (the client's Authorization header passes through untouched), and every other path is piped by this surface to the real upstream over TLS, so Remote Control's streaming, OAuth refreshes, and unknown endpoints bypass the pipeline entirely. When a `capture` is configured, those piped exchanges and every CONNECT target are recorded through it (see `./capture.ts`); the forwarding itself is identical either way.
+ * Every authenticated CONNECT target is blind-tunnelled byte for byte EXCEPT the intercept hosts (Claude Code's own API and the claude.ai control plane), whose TLS this surface terminates with leaf certificates signed by a locally generated CA. On the API host's terminated session, the paths the front door routes (`/v1/`) are handed to the same ordered pipeline the provider listener serves (the client's Authorization header passes through untouched), and every other path there, and every path on the control plane's session, is piped by this surface to that session's own real upstream over TLS, so Remote Control's streaming, OAuth refreshes, and unknown endpoints bypass the pipeline entirely. When a `capture` is configured, those piped exchanges and every CONNECT target are recorded through it (see `./capture.ts`); the forwarding itself is identical either way.
  */
-/** The one CONNECT host whose TLS gets terminated: Claude Code's own API, the upstream every OAuth session is really talking to. */
+/** The API host: Claude Code's own upstream, the one host whose `/v1/` paths the routed pipeline serves. */
 export declare const CONNECT_INTERCEPT_HOST = "api.anthropic.com";
+/**
+ * Every CONNECT host whose TLS this surface terminates, each with its own leaf and its own HTTP parser: the API host above, and `platform.claude.com`, the claude.ai control plane where Remote Control's long-lived channel and its handshake live. Terminating the second one is what makes a Remote Control login rejection observable at all: its bytes cross this surface either way, and blind-tunnelling them hides exactly the exchange that failed. Only the API host's `/v1/` paths ever reach the routed pipeline; everything else on either session is piped to that session's own real upstream, so the pipeline's identification and authorisation are never asked to serve another host's traffic.
+ */
+export declare const CONNECT_INTERCEPT_HOSTS: readonly string[];
 /** Paths under this prefix are what the routed pipeline serves; everything else on the terminated session goes to the real upstream. */
 export declare const ROUTED_PATH_PREFIX = "/v1/";
 /** The port HTTPS is served on, both the default when a CONNECT authority names none and the port non-headroom paths are piped to on the real upstream. */
@@ -52,8 +56,8 @@ export interface ConnectTarget {
 }
 /** Parses a CONNECT authority (`host:port`, or a bare `host` meaning 443), or undefined when it names no host or a non-numeric port. */
 export declare function parseConnectTarget(authority: string): ConnectTarget | undefined;
-/** Whether a CONNECT target's host (port already stripped) is the one whose TLS this proxy terminates. */
-export declare function isInterceptedHost(host: string, interceptHost: string): boolean;
+/** Whether a CONNECT target's host (port already stripped) is one whose TLS this proxy terminates. */
+export declare function isInterceptedHost(host: string, interceptHosts: readonly string[]): boolean;
 /** Whether a request path on the terminated session is one the routed pipeline serves. The query string stays part of the path: `/v1/messages?beta=true` is still the pipeline's. */
 export declare function servedByPipeline(path: string | undefined): boolean;
 /**
@@ -142,16 +146,20 @@ export interface ConnectEffects {
 }
 /** Everything the connect surface needs to route, resolved before it starts. */
 export interface ConnectServerConfig {
-    /** The CONNECT host whose TLS gets terminated. */
-    readonly interceptHost: string;
+    /** The CONNECT hosts whose TLS get terminated, each with its own leaf, its own HTTP parser and its own upstream. */
+    readonly interceptHosts: readonly string[];
+    /**
+     * The one intercept host whose `/v1/` paths `serveRouted` handles: the API host, whose pipeline identification, authorisation and headroom hop are about Anthropic sessions and no other host's traffic.
+     */
+    readonly routedHost: string;
     /**
      * Serves one routed path (`/v1/...`) from the terminated session: the same ordered pipeline the provider listener hands requests to, so an OAuth session and a provider session run identical identification, middleware and routing.
      */
     readonly serveRouted: ConnectRequestHandler;
-    /** The leaf to terminate `interceptHost` with, minted and cached per host. */
+    /** The leaf to terminate each intercept host with, minted and cached per host. */
     readonly leafFor: (host: string) => LeafCert;
-    /** Where non-routed paths on the terminated session are piped: the real upstream over TLS. */
-    readonly upstream: ConnectForwardTarget;
+    /** Where non-routed paths on one host's terminated session are piped: that host's own real upstream over TLS. */
+    readonly upstreamFor: (host: string) => ConnectForwardTarget;
     /** Whether a capability presented as a CONNECT request's proxy credential belongs to a live launch: the same constant-time check against the same registry the routed pipeline's admission makes, read fresh on every call because launches come and go. */
     readonly isLiveCapability: (token: string) => boolean;
     /** The connection deadlines and caps; production passes `CONNECT_LIMITS`. */

package/dist/types/index.d.ts

@@ -11,7 +11,7 @@
 export { resolveDecisions, topLevelNames, type ResolveDecisionsInput, type ResolvedState } from "./resolve/pipeline";
 export type { CompiledRule, Decision, Diagnostic, EliminatedRule, EntryFact, EntryFacts, FlattenedCascade, Layer, LayerId } from "./resolve/types";
 export { buildEntryFacts, carryOver, FARM_MANIFEST_FILENAME, readFarmManifest, recoverFarm, recoveryDiagnostics, resyncFarm, type BuildEntryFactsParams, type CarryOverParams, type CarryOverResult, type RecoverFarmParams, type RecoveryResult, type ResyncFarmParams, type ResyncFarmResult, } from "./launcher/farm";
-export { CONNECT_INTERCEPT_HOST, CONNECT_LIMITS, createLeafCache, ensureCa, forwardableHeaders, generateCa, isInterceptedHost, mintLeaf, parseConnectTarget, realConnectCertStore, realConnectEffects, ROUTED_PATH_PREFIX, servedByPipeline, startConnectServer, type CaMaterial, type ConnectCertStore, type ConnectEffects, type ConnectLimits, type ConnectServerConfig, type ConnectServerHandle, type ConnectTarget, type LeafCert, } from "./frontdoor/connect";
+export { CONNECT_INTERCEPT_HOST, CONNECT_INTERCEPT_HOSTS, CONNECT_LIMITS, createLeafCache, ensureCa, forwardableHeaders, generateCa, isInterceptedHost, mintLeaf, parseConnectTarget, realConnectCertStore, realConnectEffects, ROUTED_PATH_PREFIX, servedByPipeline, startConnectServer, type CaMaterial, type ConnectCertStore, type ConnectEffects, type ConnectLimits, type ConnectServerConfig, type ConnectServerHandle, type ConnectTarget, type LeafCert, } from "./frontdoor/connect";
 export { ensureFrontDoor, FrontDoorStartError, type EnsureFrontDoorPorts } from "./frontdoor/ensure";
 export { runFrontDoorSupervisor, type FrontDoorSupervisorPorts, type RunFrontDoorSupervisorOptions } from "./frontdoor/supervisor";
 export { listUsageSnapshots, readUsageSnapshot, snapshotPath, UsageSnapshotError, type UsageReadFs } from "./usage/read";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-shim",
-  "version": "7.3.0",
+  "version": "7.4.0",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",