agent-shim 7.3.0 → 7.5.0

package/README.md

@@ -226,6 +226,7 @@ Issues and pull requests are welcome. Please keep the tool itself free of assump
 - [docs/architecture.md](docs/architecture.md): the source layout file by file, error reporting design, schema rationale, and resolver mechanics.
 - [docs/release-process.md](docs/release-process.md): the semantic-release pipeline, the Node SEA build, its macOS x64 limitation, and npm/GitHub Packages publishing.
 - [docs/testing.md](docs/testing.md): the full list of cases the test suites cover.
+- [docs/library.md](docs/library.md): using agent-shim in process: what the library exposes, and what stays CLI-only.
 - [docs/installation.md](docs/installation.md): every install channel in full, with the platform support matrix.
 - [docs/development.md](docs/development.md): test isolation, commit hooks, and the secret-redaction filter rationale.
 

package/dist/cli.cjs

@@ -61051,7 +61051,7 @@ function resolveLaunchIdentity(paths, cwd) {
 // package.json
 var package_default = {
   name: "agent-shim",
-  version: "7.3.0",
+  version: "7.5.0",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -64859,6 +64859,7 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
 
 // src/frontdoor/connect.ts
 var CONNECT_INTERCEPT_HOST = "api.anthropic.com";
+var CONNECT_INTERCEPT_HOSTS = [CONNECT_INTERCEPT_HOST, "platform.claude.com"];
 var ROUTED_PATH_PREFIX = "/v1/";
 var HTTPS_PORT = 443;
 var MAX_PORT = 65535;
@@ -64898,9 +64899,6 @@ function parseConnectTarget(authority) {
   }
   return { host, port };
 }
-function isInterceptedHost(host, interceptHost) {
-  return host === interceptHost;
-}
 function servedByPipeline(path38) {
   return path38?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
@@ -64970,28 +64968,34 @@ function caParses(ca) {
   }
 }
 async function startConnectServer(config2, effects, preferredPort) {
-  const handler = (request6, response) => {
-    if (servedByPipeline(request6.url)) {
-      config2.serveRouted(request6, response);
-      return;
-    }
-    effects.forwardHttp(config2.upstream, request6, response, config2.capture?.observePassthrough(request6));
-  };
-  const httpSession = effects.createHttpSession(handler, config2.capture === void 0 ? void 0 : (request6) => config2.capture?.upgrade(request6));
-  const tlsAcceptor = effects.createTlsAcceptor(config2.leafFor(config2.interceptHost), (secure) => {
-    httpSession.serve(secure);
+  const onUpgrade = config2.capture === void 0 ? void 0 : (request6) => config2.capture?.upgrade(request6);
+  const sessions = config2.interceptHosts.map((host) => {
+    const handler = (request6, response) => {
+      if (host === config2.routedHost && servedByPipeline(request6.url)) {
+        config2.serveRouted(request6, response);
+        return;
+      }
+      effects.forwardHttp(config2.upstreamFor(host), request6, response, config2.capture?.observePassthrough(request6));
+    };
+    const httpSession = effects.createHttpSession(handler, onUpgrade);
+    const tlsAcceptor = effects.createTlsAcceptor(config2.leafFor(host), (secure) => {
+      httpSession.serve(secure);
+    });
+    return { host, httpSession, tlsAcceptor };
   });
   const ledger = createConnectionLedger(config2.limits, config2.isLiveCapability);
   const listener = await effects.listenLoopback(preferredPort, (socket) => {
-    handleConnect(socket, { config: config2, effects, tlsAcceptor, ledger });
+    handleConnect(socket, { config: config2, effects, sessions, ledger });
   });
   return {
     port: listener.port,
     close: async () => {
       ledger.close();
       await listener.close();
-      tlsAcceptor.close();
-      httpSession.close();
+      for (const { httpSession, tlsAcceptor } of sessions) {
+        tlsAcceptor.close();
+        httpSession.close();
+      }
     }
   };
 }
@@ -65111,7 +65115,7 @@ function proxyAuthorizationOf(head) {
   return values.length === 1 ? value : void 0;
 }
 function routeConnect(socket, head, context) {
-  const { config: config2, effects, tlsAcceptor, ledger } = context;
+  const { config: config2, effects, sessions, ledger } = context;
   const credential = proxyAuthorizationOf(head);
   const capability = credential === void 0 ? void 0 : capabilityFromProxyAuthorization(credential);
   if (capability === void 0 || !config2.isLiveCapability(capability)) {
@@ -65130,10 +65134,11 @@ function routeConnect(socket, head, context) {
     refuse(socket, REFUSAL.serviceUnavailable);
     return;
   }
-  config2.capture?.connect(target, isInterceptedHost(target.host, config2.interceptHost));
+  const session = sessions.find((entry) => entry.host === target.host);
+  config2.capture?.connect(target, session !== void 0);
   socket.write(CONNECT_ESTABLISHED);
-  if (isInterceptedHost(target.host, config2.interceptHost)) {
-    tlsAcceptor.accept(socket);
+  if (session !== void 0) {
+    session.tlsAcceptor.accept(socket);
     return;
   }
   void blindTunnel(socket, target, effects);
@@ -66967,7 +66972,8 @@ function realFrontDoorSupervisorPorts(paths) {
       }
       const server = await startConnectServer(
         {
-          interceptHost: CONNECT_INTERCEPT_HOST,
+          interceptHosts: CONNECT_INTERCEPT_HOSTS,
+          routedHost: CONNECT_INTERCEPT_HOST,
           serveRouted: (request6, response) => {
             const abort = new AbortController();
             response.on("close", () => {
@@ -66988,7 +66994,7 @@ function realFrontDoorSupervisorPorts(paths) {
             );
           },
           leafFor,
-          upstream: { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT, tls: true },
+          upstreamFor: (host) => ({ host, port: HTTPS_PORT, tls: true }),
           isLiveCapability: isLiveToken,
           limits: CONNECT_LIMITS,
           ...capture === void 0 ? {} : { capture }