agent-shim 8.0.0 → 8.0.2

package/dist/cli.cjs

@@ -61039,7 +61039,7 @@ function registerIdentityCommand(program2, deps) {
 // package.json
 var package_default = {
   name: "agent-shim",
-  version: "8.0.0",
+  version: "8.0.2",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -64665,14 +64665,11 @@ ${request6.rawHeaders.reduce((accumulated, value, index) => index % 2 === 0 ? `$
   };
   const sessions = config2.interceptHosts.map((host) => {
     if (config2.tapHosts.includes(host)) {
-      const tlsAcceptor2 = effects.createTlsAcceptor(
-        config2.leafFor(host),
-        (secure) => {
-          pumpTapSession(secure, async (clientAlpn) => await effects.connectTlsUpstream(host, HTTPS_PORT, clientAlpn), config2.capture?.tapStream?.(host));
-        },
-        TAP_ALPN_PROTOCOLS
-      );
-      return { host, tlsAcceptor: tlsAcceptor2 };
+      const serveSecure2 = (secure) => {
+        pumpTapSession(secure, async (clientAlpn) => await effects.connectTlsUpstream(host, HTTPS_PORT, clientAlpn), config2.capture?.tapStream?.(host));
+      };
+      const tlsAcceptor2 = effects.createTlsAcceptor(config2.leafFor(host), serveSecure2, TAP_ALPN_PROTOCOLS);
+      return { host, serveSecure: serveSecure2, tlsAcceptor: tlsAcceptor2 };
     }
     const handler = (request6, response) => {
       if (host === config2.routedHost && servedByPipeline(request6.url)) {
@@ -64686,19 +64683,29 @@ ${request6.rawHeaders.reduce((accumulated, value, index) => index % 2 === 0 ? `$
       effects.forwardHttp(config2.upstreamFor(host), request6, response, config2.capture?.observePassthrough(request6));
     };
     const httpSession = effects.createHttpSession(handler, onUpgrade(host));
-    const tlsAcceptor = effects.createTlsAcceptor(config2.leafFor(host), (secure, context) => {
-      tunnelTokens.set(secure, context);
+    const serveSecure = (secure, capability) => {
+      tunnelTokens.set(secure, capability);
       httpSession.serve(secure);
-    });
-    return { host, httpSession, tlsAcceptor };
+    };
+    const tlsAcceptor = effects.createTlsAcceptor(config2.leafFor(host), serveSecure);
+    return { host, serveSecure, httpSession, tlsAcceptor };
   });
   const ledger = createConnectionLedger(config2.limits, config2.isLiveCapability);
   const listener = await effects.listenLoopback(preferredPort, (socket) => {
     handleConnect(socket, { config: config2, effects, sessions, ledger });
   });
   const apiSession = sessions.find((session) => session.host === config2.routedHost);
+  const sessionByHost = new Map(sessions.map((session) => [session.host, session]));
+  const sniAcceptor = effects.createSniTlsAcceptor(config2.interceptHosts, config2.leafFor, (secure, host) => {
+    const session = sessionByHost.get(host);
+    if (session === void 0) {
+      secure.destroy();
+      return;
+    }
+    session.serveSecure(secure, config2.transparentCapability ?? "");
+  });
   const transparent = config2.transparentPort === void 0 || apiSession === void 0 ? void 0 : await effects.listenLoopback(config2.transparentPort, (socket) => {
-    apiSession.tlsAcceptor.accept(socket, config2.transparentCapability ?? "");
+    sniAcceptor.accept(socket);
   });
   return {
     port: listener.port,
@@ -64707,6 +64714,7 @@ ${request6.rawHeaders.reduce((accumulated, value, index) => index % 2 === 0 ? `$
       ledger.close();
       await listener.close();
       await transparent?.close();
+      sniAcceptor.close();
       for (const { httpSession, tlsAcceptor } of sessions) {
         tlsAcceptor.close();
         httpSession?.close();
@@ -65036,6 +65044,38 @@ function realConnectEffects() {
         }
       };
     },
+    createSniTlsAcceptor: (hosts, leafFor, onSecure) => {
+      const contexts = new Map(
+        hosts.map((host) => {
+          const leaf = leafFor(host);
+          return [host, tls.createSecureContext({ key: leaf.keyPem, cert: leaf.certPem })];
+        })
+      );
+      const server = tls.createServer(
+        {
+          // No default key or cert exists, so the SNI selection is the only source of credentials: an unserved name fails its handshake here, and a client that sent no SNI at all never reaches the selection and fails for want of any certificate, which is exactly the fail-closed shape this surface wants.
+          SNICallback: (servername, callback) => {
+            const context = contexts.get(servername);
+            callback(context === void 0 ? new Error(`the transparent surface serves no host named ${servername}`) : null, context);
+          }
+        },
+        (secure) => {
+          onSecure(secure, typeof secure.servername === "string" ? secure.servername : "");
+        }
+      );
+      server.on("clientError", (_error, socket) => {
+        socket.destroy();
+      });
+      return {
+        // The same hand-off the single-leaf acceptor uses: emitting the connection event runs the TLS server's own connection listener on a socket this process already owns (the redirect half of the connection) rather than one the server accepted itself.
+        accept: (socket) => {
+          server.emit("connection", socket);
+        },
+        close: () => {
+          server.close();
+        }
+      };
+    },
     createHttpSession: (handler, onUpgrade) => {
       const server = http.createServer(handler);
       server.on("clientError", (_error, socket) => {
@@ -68037,13 +68077,231 @@ function registerDoctorCommand(program2, deps) {
 }
 
 // src/headroom/commands.ts
-var import_node_fs15 = __toESM(require("node:fs"), 1);
+var import_node_fs16 = __toESM(require("node:fs"), 1);
 var import_node_http2 = __toESM(require("node:http"), 1);
-var import_node_path35 = __toESM(require("node:path"), 1);
+var import_node_path36 = __toESM(require("node:path"), 1);
 var import_node_child_process5 = require("node:child_process");
 
-// src/headroom/settings.ts
+// src/frontdoor/realFrontDoorPort.ts
+var import_node_fs15 = __toESM(require("node:fs"), 1);
+
+// src/frontdoor/ensure.ts
 var import_node_crypto12 = require("node:crypto");
+var FRONTDOOR_START_TIMEOUT_MS = 3e4;
+var FRONTDOOR_LAUNCHER_POLL_MS = 100;
+var FrontDoorStartError = class extends CliError {
+  constructor(message) {
+    super(message);
+    this.name = "FrontDoorStartError";
+  }
+};
+function ensureFrontDoor(params) {
+  const { paths, ports } = params;
+  const deadline = ports.now() + FRONTDOOR_START_TIMEOUT_MS;
+  let spawned = false;
+  let replaced = false;
+  const distrusted = /* @__PURE__ */ new Set();
+  let lastRejection;
+  for (; ; ) {
+    const state = readFrontDoorState(ports.fs, paths.frontdoorStateFile);
+    const supervisorPid = state?.supervisorPid;
+    if (supervisorPid !== void 0 && !distrusted.has(supervisorPid) && ports.isRunning(supervisorPid)) {
+      if (state?.port !== void 0 && state.connectPort !== void 0) {
+        const verdict = ports.verifyListener(state.port);
+        if (verdict.ok && (state.protocol ?? 0) < FRONT_DOOR_PROTOCOL && !replaced) {
+          ports.stopSupervisor(supervisorPid);
+          while (ports.isRunning(supervisorPid)) {
+            if (ports.now() >= deadline) {
+              throw new FrontDoorStartError(`agent-shim: the front door (pid ${String(supervisorPid)}, protocol ${String(state.protocol ?? 0)}) is older than this launcher (protocol ${String(FRONT_DOOR_PROTOCOL)}) and did not exit when asked. Daemon log: ${paths.frontdoorLogPath}`);
+            }
+            ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
+          }
+          replaced = true;
+          continue;
+        }
+        if (verdict.ok) {
+          const token = (0, import_node_crypto12.randomUUID)();
+          writeFrontDoorSession(ports.fs, paths.frontdoorSessionsDir, { pid: params.launcherPid, startedAt: ports.now(), token });
+          return { port: state.port, connectPort: state.connectPort, token };
+        }
+        lastRejection = `the listener on 127.0.0.1:${String(state.port)} (recorded for pid ${String(supervisorPid)}) failed authentication: ${verdict.reason}`;
+        if (spawned) {
+          throw new FrontDoorStartError(`agent-shim: ${lastRejection}; refusing to send this session's credentials to it. Daemon log: ${paths.frontdoorLogPath}`);
+        }
+        distrusted.add(supervisorPid);
+        continue;
+      }
+      if (state?.lastError !== void 0) {
+        throw new FrontDoorStartError(`agent-shim: the front door reported a fatal error and is not serving: ${state.lastError} (daemon log: ${paths.frontdoorLogPath})`);
+      }
+    } else if (!spawned) {
+      ports.fs.mkdirp(paths.frontdoorDir);
+      const created = ports.fs.writeFileExclusive(paths.frontdoorLockFile, `${JSON.stringify({ pid: params.launcherPid, at: ports.now() })}
+`);
+      if (created) {
+        ports.spawnSupervisor(paths);
+        spawned = true;
+      } else {
+        const lock = readStartLock(ports.fs, paths.frontdoorLockFile);
+        if (lock === void 0 || !ports.isRunning(lock.pid)) {
+          ports.fs.removeRecursive(paths.frontdoorLockFile);
+          continue;
+        }
+      }
+    }
+    if (ports.now() >= deadline) {
+      const lastError = state?.lastError;
+      throw new FrontDoorStartError(
+        `agent-shim: the front door did not become ready within ${String(FRONTDOOR_START_TIMEOUT_MS)}ms` + (lastError === void 0 ? "" : ` (last error: ${lastError})`) + (lastRejection === void 0 ? "" : ` (${lastRejection})`) + `. Daemon log: ${paths.frontdoorLogPath}`
+      );
+    }
+    ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
+  }
+}
+
+// src/frontdoor/probe.ts
+var import_node_worker_threads = require("node:worker_threads");
+var PROBE_TIMEOUT_MS = 2e3;
+var PROBE_WAIT_MARGIN_MS = 1e3;
+var REASON_BYTES = 1024;
+var HEADER_SLOTS = 2;
+var INT32_BYTES = 4;
+var VERDICT_PENDING = 0;
+var VERDICT_OK = 1;
+var VERDICT_FAILED = 2;
+var PROBE_SOURCE = `
+const { workerData } = require("node:worker_threads");
+const https = require("node:https");
+const { port, ca, timeoutMs, shared, ok, failed, headerSlots } = workerData;
+const header = new Int32Array(shared, 0, headerSlots);
+const reason = new Uint8Array(shared, headerSlots * 4);
+let done = false;
+const finish = (verdict, message) => {
+  if (done) return;
+  done = true;
+  const bytes = Buffer.from(String(message), "utf8").subarray(0, reason.length);
+  reason.set(bytes);
+  Atomics.store(header, 1, bytes.length);
+  Atomics.store(header, 0, verdict);
+  Atomics.notify(header, 0);
+};
+const request = https.get({ host: "127.0.0.1", port, path: "/healthz", ca: [ca], agent: false }, (response) => {
+  let body = "";
+  response.setEncoding("utf8");
+  response.on("data", (chunk) => { body += chunk; });
+  response.on("end", () => {
+    if (response.statusCode === 200 && body === "ok") finish(ok, "");
+    else finish(failed, "the listener answered its health probe with HTTP " + String(response.statusCode));
+  });
+  response.on("error", (error) => finish(failed, error.message));
+});
+// A hard deadline over the whole exchange, handshake included: a listener that accepts the connection and then says nothing must still fail the probe.
+setTimeout(() => { request.destroy(new Error("no answer within " + String(timeoutMs) + "ms")); }, timeoutMs);
+request.on("error", (error) => finish(failed, (error.code ? error.code + ": " : "") + error.message));
+`;
+function probeFrontDoorSync(port, caPem) {
+  const shared = new SharedArrayBuffer(HEADER_SLOTS * INT32_BYTES + REASON_BYTES);
+  const header = new Int32Array(shared, 0, HEADER_SLOTS);
+  const worker = new import_node_worker_threads.Worker(PROBE_SOURCE, {
+    eval: true,
+    workerData: { port, ca: caPem, timeoutMs: PROBE_TIMEOUT_MS, shared, ok: VERDICT_OK, failed: VERDICT_FAILED, headerSlots: HEADER_SLOTS }
+  });
+  worker.unref();
+  try {
+    const waited = Atomics.wait(header, 0, VERDICT_PENDING, PROBE_TIMEOUT_MS + PROBE_WAIT_MARGIN_MS);
+    const verdict = Atomics.load(header, 0);
+    if (waited === "timed-out" || verdict === VERDICT_PENDING) {
+      return { ok: false, reason: `the probe did not finish within ${String(PROBE_TIMEOUT_MS + PROBE_WAIT_MARGIN_MS)}ms` };
+    }
+    if (verdict === VERDICT_OK) {
+      return { ok: true };
+    }
+    const length = Atomics.load(header, 1);
+    return { ok: false, reason: Buffer.from(new Uint8Array(shared, HEADER_SLOTS * INT32_BYTES, length)).toString("utf8") };
+  } finally {
+    void worker.terminate();
+  }
+}
+
+// src/frontdoor/trust.ts
+var import_node_crypto13 = require("node:crypto");
+var import_node_path35 = __toESM(require("node:path"), 1);
+var BUNDLE_NAME_HEX_DIGITS = 16;
+function resolveTrustBundle(params) {
+  const { caCertFile, bundlesDir, variable, inherited, fs: fs19 } = params;
+  if (inherited === void 0 || inherited === "" || import_node_path35.default.resolve(inherited) === import_node_path35.default.resolve(caCertFile)) {
+    return { path: caCertFile };
+  }
+  const caPem = fs19.readFileUtf8(caCertFile);
+  let inheritedPem;
+  try {
+    inheritedPem = fs19.readFileUtf8(inherited);
+  } catch (error62) {
+    return {
+      path: caCertFile,
+      warning: `agent-shim: ${variable} names ${inherited}, which could not be read (${error62 instanceof Error ? error62.message : String(error62)}); the child trusts agent-shim's front-door CA on top of the system store, and nothing from that file`
+    };
+  }
+  if (inheritedPem.includes(caPem.trim())) {
+    return { path: inherited };
+  }
+  const combined = `${inheritedPem.trimEnd()}
+${caPem}`;
+  const bundle = import_node_path35.default.join(bundlesDir, `${(0, import_node_crypto13.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
+  if (!fs19.exists(bundle)) {
+    fs19.mkdirp(bundlesDir);
+    fs19.writeFileAtomic(bundle, combined);
+  }
+  return { path: bundle };
+}
+
+// src/frontdoor/realFrontDoorPort.ts
+var realTrustBundleFs = {
+  readFileUtf8: (file2) => import_node_fs15.default.readFileSync(file2, "utf8"),
+  exists: (file2) => import_node_fs15.default.existsSync(file2),
+  mkdirp: (dir) => {
+    import_node_fs15.default.mkdirSync(dir, { recursive: true });
+  },
+  writeFileAtomic: (file2, contents) => {
+    realFarmFs.writeFilePrivate(file2, contents);
+  }
+};
+function realFrontDoorPort(paths, spawnDaemon) {
+  return {
+    ensure: (inheritedExtraCaCerts) => {
+      const up = ensureFrontDoor({
+        paths,
+        launcherPid: process.pid,
+        ports: {
+          fs: realFarmFs,
+          isRunning: realIsProcessRunning,
+          now: () => Date.now(),
+          sleep: realSleepSync,
+          spawnSupervisor: (layout) => spawnDaemon(layout, "__frontdoor-supervisor", layout.frontdoorLogPath),
+          stopSupervisor: (pid) => {
+            process.kill(pid, "SIGTERM");
+          },
+          // Read fresh for each probe: a replacement supervisor may have regenerated an unparseable CA, and the probe must trust exactly what the serving door's leaf chains to.
+          verifyListener: (port) => probeFrontDoorSync(port, import_node_fs15.default.readFileSync(paths.frontdoorCaCertFile, "utf8"))
+        }
+      });
+      const trust = resolveTrustBundle({ caCertFile: paths.frontdoorCaCertFile, bundlesDir: paths.frontdoorCaBundlesDir, variable: "NODE_EXTRA_CA_CERTS", inherited: inheritedExtraCaCerts, fs: realTrustBundleFs });
+      return {
+        port: up.port,
+        connectPort: up.connectPort,
+        trustBundlePath: trust.path,
+        ...trust.warning === void 0 ? {} : { trustWarning: trust.warning },
+        sessionToken: up.token
+      };
+    },
+    release: () => {
+      removeFrontDoorSession(realFarmFs, paths.frontdoorSessionsDir, process.pid);
+    }
+  };
+}
+
+// src/headroom/settings.ts
+var import_node_crypto14 = require("node:crypto");
 function settingsOf(config2) {
   return {
     ...config2.mode === void 0 ? {} : { mode: config2.mode },
@@ -68068,7 +68326,7 @@ function settingsEnv(settings2) {
   return settings2.rolloutChannel === void 0 ? {} : { HEADROOM_ROLLOUT_CHANNEL: settings2.rolloutChannel };
 }
 function hashSettings(settings2) {
-  return (0, import_node_crypto12.createHash)("sha256").update(JSON.stringify([...settingsArgs(settings2), JSON.stringify(settingsEnv(settings2))])).digest("hex");
+  return (0, import_node_crypto14.createHash)("sha256").update(JSON.stringify([...settingsArgs(settings2), JSON.stringify(settingsEnv(settings2))])).digest("hex");
 }
 
 // src/headroom/supervisor.ts
@@ -68413,7 +68671,14 @@ var READY_FETCH_TIMEOUT_MS = 2e3;
 function headroomPidRunning(pid) {
   return !exitedHeadroom.has(pid) && realIsProcessRunning(pid);
 }
-function headroomSpawnEnv(parentEnv, allowlist, settings2, caBundle) {
+var HEADROOM_CA_BUNDLE = "HEADROOM_CA_BUNDLE";
+function resolveHeadroomTrustBundle(params) {
+  if (!params.fs.exists(params.caCertFile)) {
+    return void 0;
+  }
+  return resolveTrustBundle({ ...params, variable: HEADROOM_CA_BUNDLE });
+}
+function headroomSpawnEnv(parentEnv, allowlist, settings2, trustBundlePath) {
   const inherited = { ...parentEnv };
   delete inherited.HEADROOM_HOST;
   delete inherited.HEADROOM_PORT;
@@ -68421,8 +68686,8 @@ function headroomSpawnEnv(parentEnv, allowlist, settings2, caBundle) {
     ...inherited,
     HEADROOM_ALLOWED_BASE_URLS: allowlist.join(","),
     HEADROOM_HTTP2: parentEnv.HEADROOM_HTTP2 ?? "0",
-    // A transparent-interception deployment redirects the API host's address machine-wide, so headroom's own Python dials reach the front door's leaf instead of the origin's public certificate, and Python trusts only the system store: point its two trust variables (urllib3/httpx read both) at the door's combined bundle, which carries the system-equivalent anchors alongside the door's CA. An explicit value in the parent environment always wins, exactly like HEADROOM_HTTP2.
-    ...caBundle === void 0 || parentEnv.REQUESTS_CA_BUNDLE !== void 0 || parentEnv.SSL_CERT_FILE !== void 0 ? {} : { REQUESTS_CA_BUNDLE: caBundle, SSL_CERT_FILE: caBundle },
+    // The bundle already holds any inherited HEADROOM_CA_BUNDLE's certificates, so replacing the variable loses nothing. An inherited SSL_CERT_FILE or REQUESTS_CA_BUNDLE passes through untouched and, by headroom's own precedence, still replaces everything: an explicit choice in the parent environment wins.
+    ...trustBundlePath === void 0 ? {} : { [HEADROOM_CA_BUNDLE]: trustBundlePath },
     ...settingsEnv(settings2)
   };
 }
@@ -68449,12 +68714,12 @@ function readInstalledHeadroomCommit() {
   if (toolDir.status !== 0) {
     return void 0;
   }
-  const libDir = import_node_path35.default.join(toolDir.stdout.trim(), HEADROOM_TOOL_NAME, "lib");
+  const libDir = import_node_path36.default.join(toolDir.stdout.trim(), HEADROOM_TOOL_NAME, "lib");
   for (const python of realFarmFs.readdir(libDir)) {
-    const sitePackages = import_node_path35.default.join(libDir, python, "site-packages");
+    const sitePackages = import_node_path36.default.join(libDir, python, "site-packages");
     for (const entry of realFarmFs.readdir(sitePackages)) {
       if (entry.startsWith("headroom_ai-") && entry.endsWith(".dist-info")) {
-        const directUrl = realFarmFs.readFileUtf8(import_node_path35.default.join(sitePackages, entry, "direct_url.json"));
+        const directUrl = realFarmFs.readFileUtf8(import_node_path36.default.join(sitePackages, entry, "direct_url.json"));
         return directUrl === void 0 ? void 0 : parseInstalledCommit(directUrl);
       }
     }
@@ -68477,14 +68742,18 @@ function realSupervisorPorts(paths) {
     socketTrust: realHeadroomSocketTrust,
     readConfig: () => resolveSupervisorConfig(readGlobalConfig(paths)?.headroom ?? {}),
     spawnHeadroom: (socketPath, allowlist, settings2) => {
-      const caBundle = import_node_fs15.default.existsSync(paths.frontdoorCaCertFile) ? import_node_fs15.default.readFileSync(paths.frontdoorCaCertFile, "utf8") : void 0;
-      import_node_fs15.default.mkdirSync(paths.logsDir, { recursive: true });
-      const logFd = import_node_fs15.default.openSync(paths.headroomLogPath, "a");
+      const trust = resolveHeadroomTrustBundle({ caCertFile: paths.frontdoorCaCertFile, bundlesDir: paths.frontdoorCaBundlesDir, inherited: process.env[HEADROOM_CA_BUNDLE], fs: realTrustBundleFs });
+      import_node_fs16.default.mkdirSync(paths.logsDir, { recursive: true });
+      if (trust?.warning !== void 0) {
+        import_node_fs16.default.appendFileSync(paths.headroomLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${trust.warning}
+`);
+      }
+      const logFd = import_node_fs16.default.openSync(paths.headroomLogPath, "a");
       try {
         const child = (0, import_node_child_process5.spawn)("headroom", headroomProxyArgs(socketPath, settings2), {
           detached: true,
           stdio: ["ignore", logFd, logFd],
-          env: headroomSpawnEnv(process.env, allowlist, settings2, caBundle)
+          env: headroomSpawnEnv(process.env, allowlist, settings2, trust?.path)
         });
         if (child.pid === void 0) {
           throw new Error("spawning headroom returned no pid");
@@ -68494,12 +68763,12 @@ function realSupervisorPorts(paths) {
         child.once("exit", (code, signal) => {
           ownedHeadroom.delete(pid);
           exitedHeadroom.add(pid);
-          import_node_fs15.default.appendFileSync(paths.headroomLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} agent-shim headroom supervisor: headroom exited (${signal ?? `code ${String(code)}`})
+          import_node_fs16.default.appendFileSync(paths.headroomLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} agent-shim headroom supervisor: headroom exited (${signal ?? `code ${String(code)}`})
 `);
         });
         return pid;
       } finally {
-        import_node_fs15.default.closeSync(logFd);
+        import_node_fs16.default.closeSync(logFd);
       }
     },
     stopProcess: (pid) => {
@@ -68512,7 +68781,7 @@ function realSupervisorPorts(paths) {
         now: () => Date.now()
       });
       if (outcome === "still-running") {
-        import_node_fs15.default.appendFileSync(
+        import_node_fs16.default.appendFileSync(
           paths.headroomLogPath,
           `${(/* @__PURE__ */ new Date()).toISOString()} agent-shim headroom supervisor: pid ${String(pid)} survived SIGKILL within its grace; it is stuck uninterruptibly
 `
@@ -68526,10 +68795,10 @@ function realSupervisorPorts(paths) {
         return { ok: false, error: `uv is not installed or not on PATH (${result.error.message})` };
       }
       if (result.stdout !== "") {
-        import_node_fs15.default.appendFileSync(paths.headroomLogPath, result.stdout);
+        import_node_fs16.default.appendFileSync(paths.headroomLogPath, result.stdout);
       }
       if (result.stderr !== "") {
-        import_node_fs15.default.appendFileSync(paths.headroomLogPath, result.stderr);
+        import_node_fs16.default.appendFileSync(paths.headroomLogPath, result.stderr);
       }
       return result.status === 0 ? { ok: true } : { ok: false, error: `uv tool install exited ${String(result.status)}` };
     },
@@ -68539,8 +68808,8 @@ function realSupervisorPorts(paths) {
     },
     installedCommit: readInstalledHeadroomCommit,
     log: (line) => {
-      import_node_fs15.default.mkdirSync(paths.logsDir, { recursive: true });
-      import_node_fs15.default.appendFileSync(paths.headroomLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+      import_node_fs16.default.mkdirSync(paths.logsDir, { recursive: true });
+      import_node_fs16.default.appendFileSync(paths.headroomLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
 `);
     }
   };
@@ -69253,224 +69522,6 @@ function buildProgram(deps) {
 var import_node_os8 = __toESM(require("node:os"), 1);
 var import_node_crypto16 = require("node:crypto");
 
-// src/frontdoor/realFrontDoorPort.ts
-var import_node_fs16 = __toESM(require("node:fs"), 1);
-
-// src/frontdoor/ensure.ts
-var import_node_crypto13 = require("node:crypto");
-var FRONTDOOR_START_TIMEOUT_MS = 3e4;
-var FRONTDOOR_LAUNCHER_POLL_MS = 100;
-var FrontDoorStartError = class extends CliError {
-  constructor(message) {
-    super(message);
-    this.name = "FrontDoorStartError";
-  }
-};
-function ensureFrontDoor(params) {
-  const { paths, ports } = params;
-  const deadline = ports.now() + FRONTDOOR_START_TIMEOUT_MS;
-  let spawned = false;
-  let replaced = false;
-  const distrusted = /* @__PURE__ */ new Set();
-  let lastRejection;
-  for (; ; ) {
-    const state = readFrontDoorState(ports.fs, paths.frontdoorStateFile);
-    const supervisorPid = state?.supervisorPid;
-    if (supervisorPid !== void 0 && !distrusted.has(supervisorPid) && ports.isRunning(supervisorPid)) {
-      if (state?.port !== void 0 && state.connectPort !== void 0) {
-        const verdict = ports.verifyListener(state.port);
-        if (verdict.ok && (state.protocol ?? 0) < FRONT_DOOR_PROTOCOL && !replaced) {
-          ports.stopSupervisor(supervisorPid);
-          while (ports.isRunning(supervisorPid)) {
-            if (ports.now() >= deadline) {
-              throw new FrontDoorStartError(`agent-shim: the front door (pid ${String(supervisorPid)}, protocol ${String(state.protocol ?? 0)}) is older than this launcher (protocol ${String(FRONT_DOOR_PROTOCOL)}) and did not exit when asked. Daemon log: ${paths.frontdoorLogPath}`);
-            }
-            ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
-          }
-          replaced = true;
-          continue;
-        }
-        if (verdict.ok) {
-          const token = (0, import_node_crypto13.randomUUID)();
-          writeFrontDoorSession(ports.fs, paths.frontdoorSessionsDir, { pid: params.launcherPid, startedAt: ports.now(), token });
-          return { port: state.port, connectPort: state.connectPort, token };
-        }
-        lastRejection = `the listener on 127.0.0.1:${String(state.port)} (recorded for pid ${String(supervisorPid)}) failed authentication: ${verdict.reason}`;
-        if (spawned) {
-          throw new FrontDoorStartError(`agent-shim: ${lastRejection}; refusing to send this session's credentials to it. Daemon log: ${paths.frontdoorLogPath}`);
-        }
-        distrusted.add(supervisorPid);
-        continue;
-      }
-      if (state?.lastError !== void 0) {
-        throw new FrontDoorStartError(`agent-shim: the front door reported a fatal error and is not serving: ${state.lastError} (daemon log: ${paths.frontdoorLogPath})`);
-      }
-    } else if (!spawned) {
-      ports.fs.mkdirp(paths.frontdoorDir);
-      const created = ports.fs.writeFileExclusive(paths.frontdoorLockFile, `${JSON.stringify({ pid: params.launcherPid, at: ports.now() })}
-`);
-      if (created) {
-        ports.spawnSupervisor(paths);
-        spawned = true;
-      } else {
-        const lock = readStartLock(ports.fs, paths.frontdoorLockFile);
-        if (lock === void 0 || !ports.isRunning(lock.pid)) {
-          ports.fs.removeRecursive(paths.frontdoorLockFile);
-          continue;
-        }
-      }
-    }
-    if (ports.now() >= deadline) {
-      const lastError = state?.lastError;
-      throw new FrontDoorStartError(
-        `agent-shim: the front door did not become ready within ${String(FRONTDOOR_START_TIMEOUT_MS)}ms` + (lastError === void 0 ? "" : ` (last error: ${lastError})`) + (lastRejection === void 0 ? "" : ` (${lastRejection})`) + `. Daemon log: ${paths.frontdoorLogPath}`
-      );
-    }
-    ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
-  }
-}
-
-// src/frontdoor/probe.ts
-var import_node_worker_threads = require("node:worker_threads");
-var PROBE_TIMEOUT_MS = 2e3;
-var PROBE_WAIT_MARGIN_MS = 1e3;
-var REASON_BYTES = 1024;
-var HEADER_SLOTS = 2;
-var INT32_BYTES = 4;
-var VERDICT_PENDING = 0;
-var VERDICT_OK = 1;
-var VERDICT_FAILED = 2;
-var PROBE_SOURCE = `
-const { workerData } = require("node:worker_threads");
-const https = require("node:https");
-const { port, ca, timeoutMs, shared, ok, failed, headerSlots } = workerData;
-const header = new Int32Array(shared, 0, headerSlots);
-const reason = new Uint8Array(shared, headerSlots * 4);
-let done = false;
-const finish = (verdict, message) => {
-  if (done) return;
-  done = true;
-  const bytes = Buffer.from(String(message), "utf8").subarray(0, reason.length);
-  reason.set(bytes);
-  Atomics.store(header, 1, bytes.length);
-  Atomics.store(header, 0, verdict);
-  Atomics.notify(header, 0);
-};
-const request = https.get({ host: "127.0.0.1", port, path: "/healthz", ca: [ca], agent: false }, (response) => {
-  let body = "";
-  response.setEncoding("utf8");
-  response.on("data", (chunk) => { body += chunk; });
-  response.on("end", () => {
-    if (response.statusCode === 200 && body === "ok") finish(ok, "");
-    else finish(failed, "the listener answered its health probe with HTTP " + String(response.statusCode));
-  });
-  response.on("error", (error) => finish(failed, error.message));
-});
-// A hard deadline over the whole exchange, handshake included: a listener that accepts the connection and then says nothing must still fail the probe.
-setTimeout(() => { request.destroy(new Error("no answer within " + String(timeoutMs) + "ms")); }, timeoutMs);
-request.on("error", (error) => finish(failed, (error.code ? error.code + ": " : "") + error.message));
-`;
-function probeFrontDoorSync(port, caPem) {
-  const shared = new SharedArrayBuffer(HEADER_SLOTS * INT32_BYTES + REASON_BYTES);
-  const header = new Int32Array(shared, 0, HEADER_SLOTS);
-  const worker = new import_node_worker_threads.Worker(PROBE_SOURCE, {
-    eval: true,
-    workerData: { port, ca: caPem, timeoutMs: PROBE_TIMEOUT_MS, shared, ok: VERDICT_OK, failed: VERDICT_FAILED, headerSlots: HEADER_SLOTS }
-  });
-  worker.unref();
-  try {
-    const waited = Atomics.wait(header, 0, VERDICT_PENDING, PROBE_TIMEOUT_MS + PROBE_WAIT_MARGIN_MS);
-    const verdict = Atomics.load(header, 0);
-    if (waited === "timed-out" || verdict === VERDICT_PENDING) {
-      return { ok: false, reason: `the probe did not finish within ${String(PROBE_TIMEOUT_MS + PROBE_WAIT_MARGIN_MS)}ms` };
-    }
-    if (verdict === VERDICT_OK) {
-      return { ok: true };
-    }
-    const length = Atomics.load(header, 1);
-    return { ok: false, reason: Buffer.from(new Uint8Array(shared, HEADER_SLOTS * INT32_BYTES, length)).toString("utf8") };
-  } finally {
-    void worker.terminate();
-  }
-}
-
-// src/frontdoor/trust.ts
-var import_node_crypto14 = require("node:crypto");
-var import_node_path36 = __toESM(require("node:path"), 1);
-var BUNDLE_NAME_HEX_DIGITS = 16;
-function resolveTrustBundle(params) {
-  const { caCertFile, bundlesDir, inherited, fs: fs19 } = params;
-  if (inherited === void 0 || inherited === "" || import_node_path36.default.resolve(inherited) === import_node_path36.default.resolve(caCertFile)) {
-    return { path: caCertFile };
-  }
-  const caPem = fs19.readFileUtf8(caCertFile);
-  let inheritedPem;
-  try {
-    inheritedPem = fs19.readFileUtf8(inherited);
-  } catch (error62) {
-    return {
-      path: caCertFile,
-      warning: `agent-shim: NODE_EXTRA_CA_CERTS names ${inherited}, which could not be read (${error62 instanceof Error ? error62.message : String(error62)}); the child trusts agent-shim's front-door CA on top of the system store, and nothing from that file`
-    };
-  }
-  if (inheritedPem.includes(caPem.trim())) {
-    return { path: inherited };
-  }
-  const combined = `${inheritedPem.trimEnd()}
-${caPem}`;
-  const bundle = import_node_path36.default.join(bundlesDir, `${(0, import_node_crypto14.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
-  if (!fs19.exists(bundle)) {
-    fs19.mkdirp(bundlesDir);
-    fs19.writeFileAtomic(bundle, combined);
-  }
-  return { path: bundle };
-}
-
-// src/frontdoor/realFrontDoorPort.ts
-var realTrustBundleFs = {
-  readFileUtf8: (file2) => import_node_fs16.default.readFileSync(file2, "utf8"),
-  exists: (file2) => import_node_fs16.default.existsSync(file2),
-  mkdirp: (dir) => {
-    import_node_fs16.default.mkdirSync(dir, { recursive: true });
-  },
-  writeFileAtomic: (file2, contents) => {
-    realFarmFs.writeFilePrivate(file2, contents);
-  }
-};
-function realFrontDoorPort(paths, spawnDaemon) {
-  return {
-    ensure: (inheritedExtraCaCerts) => {
-      const up = ensureFrontDoor({
-        paths,
-        launcherPid: process.pid,
-        ports: {
-          fs: realFarmFs,
-          isRunning: realIsProcessRunning,
-          now: () => Date.now(),
-          sleep: realSleepSync,
-          spawnSupervisor: (layout) => spawnDaemon(layout, "__frontdoor-supervisor", layout.frontdoorLogPath),
-          stopSupervisor: (pid) => {
-            process.kill(pid, "SIGTERM");
-          },
-          // Read fresh for each probe: a replacement supervisor may have regenerated an unparseable CA, and the probe must trust exactly what the serving door's leaf chains to.
-          verifyListener: (port) => probeFrontDoorSync(port, import_node_fs16.default.readFileSync(paths.frontdoorCaCertFile, "utf8"))
-        }
-      });
-      const trust = resolveTrustBundle({ caCertFile: paths.frontdoorCaCertFile, bundlesDir: paths.frontdoorCaBundlesDir, inherited: inheritedExtraCaCerts, fs: realTrustBundleFs });
-      return {
-        port: up.port,
-        connectPort: up.connectPort,
-        trustBundlePath: trust.path,
-        ...trust.warning === void 0 ? {} : { trustWarning: trust.warning },
-        sessionToken: up.token
-      };
-    },
-    release: () => {
-      removeFrontDoorSession(realFarmFs, paths.frontdoorSessionsDir, process.pid);
-    }
-  };
-}
-
 // src/launcher.ts
 var import_node_crypto15 = require("node:crypto");
 var import_node_path38 = __toESM(require("node:path"), 1);

package/dist/index.cjs

@@ -2959,14 +2959,11 @@ ${request3.rawHeaders.reduce((accumulated, value, index) => index % 2 === 0 ? `$
   };
   const sessions = config.interceptHosts.map((host) => {
     if (config.tapHosts.includes(host)) {
-      const tlsAcceptor2 = effects.createTlsAcceptor(
-        config.leafFor(host),
-        (secure) => {
-          pumpTapSession(secure, async (clientAlpn) => await effects.connectTlsUpstream(host, HTTPS_PORT, clientAlpn), config.capture?.tapStream?.(host));
-        },
-        TAP_ALPN_PROTOCOLS
-      );
-      return { host, tlsAcceptor: tlsAcceptor2 };
+      const serveSecure2 = (secure) => {
+        pumpTapSession(secure, async (clientAlpn) => await effects.connectTlsUpstream(host, HTTPS_PORT, clientAlpn), config.capture?.tapStream?.(host));
+      };
+      const tlsAcceptor2 = effects.createTlsAcceptor(config.leafFor(host), serveSecure2, TAP_ALPN_PROTOCOLS);
+      return { host, serveSecure: serveSecure2, tlsAcceptor: tlsAcceptor2 };
     }
     const handler = (request3, response) => {
       if (host === config.routedHost && servedByPipeline(request3.url)) {
@@ -2980,19 +2977,29 @@ ${request3.rawHeaders.reduce((accumulated, value, index) => index % 2 === 0 ? `$
       effects.forwardHttp(config.upstreamFor(host), request3, response, config.capture?.observePassthrough(request3));
     };
     const httpSession = effects.createHttpSession(handler, onUpgrade(host));
-    const tlsAcceptor = effects.createTlsAcceptor(config.leafFor(host), (secure, context) => {
-      tunnelTokens.set(secure, context);
+    const serveSecure = (secure, capability) => {
+      tunnelTokens.set(secure, capability);
       httpSession.serve(secure);
-    });
-    return { host, httpSession, tlsAcceptor };
+    };
+    const tlsAcceptor = effects.createTlsAcceptor(config.leafFor(host), serveSecure);
+    return { host, serveSecure, httpSession, tlsAcceptor };
   });
   const ledger = createConnectionLedger(config.limits, config.isLiveCapability);
   const listener = await effects.listenLoopback(preferredPort, (socket) => {
     handleConnect(socket, { config, effects, sessions, ledger });
   });
   const apiSession = sessions.find((session) => session.host === config.routedHost);
+  const sessionByHost = new Map(sessions.map((session) => [session.host, session]));
+  const sniAcceptor = effects.createSniTlsAcceptor(config.interceptHosts, config.leafFor, (secure, host) => {
+    const session = sessionByHost.get(host);
+    if (session === void 0) {
+      secure.destroy();
+      return;
+    }
+    session.serveSecure(secure, config.transparentCapability ?? "");
+  });
   const transparent = config.transparentPort === void 0 || apiSession === void 0 ? void 0 : await effects.listenLoopback(config.transparentPort, (socket) => {
-    apiSession.tlsAcceptor.accept(socket, config.transparentCapability ?? "");
+    sniAcceptor.accept(socket);
   });
   return {
     port: listener.port,
@@ -3001,6 +3008,7 @@ ${request3.rawHeaders.reduce((accumulated, value, index) => index % 2 === 0 ? `$
       ledger.close();
       await listener.close();
       await transparent?.close();
+      sniAcceptor.close();
       for (const { httpSession, tlsAcceptor } of sessions) {
         tlsAcceptor.close();
         httpSession?.close();
@@ -3330,6 +3338,38 @@ function realConnectEffects() {
         }
       };
     },
+    createSniTlsAcceptor: (hosts, leafFor, onSecure) => {
+      const contexts = new Map(
+        hosts.map((host) => {
+          const leaf = leafFor(host);
+          return [host, tls.createSecureContext({ key: leaf.keyPem, cert: leaf.certPem })];
+        })
+      );
+      const server = tls.createServer(
+        {
+          // No default key or cert exists, so the SNI selection is the only source of credentials: an unserved name fails its handshake here, and a client that sent no SNI at all never reaches the selection and fails for want of any certificate, which is exactly the fail-closed shape this surface wants.
+          SNICallback: (servername, callback) => {
+            const context = contexts.get(servername);
+            callback(context === void 0 ? new Error(`the transparent surface serves no host named ${servername}`) : null, context);
+          }
+        },
+        (secure) => {
+          onSecure(secure, typeof secure.servername === "string" ? secure.servername : "");
+        }
+      );
+      server.on("clientError", (_error, socket) => {
+        socket.destroy();
+      });
+      return {
+        // The same hand-off the single-leaf acceptor uses: emitting the connection event runs the TLS server's own connection listener on a socket this process already owns (the redirect half of the connection) rather than one the server accepted itself.
+        accept: (socket) => {
+          server.emit("connection", socket);
+        },
+        close: () => {
+          server.close();
+        }
+      };
+    },
     createHttpSession: (handler, onUpgrade) => {
       const server = http.createServer(handler);
       server.on("clientError", (_error, socket) => {
@@ -8142,7 +8182,7 @@ var import_node_crypto10 = require("node:crypto");
 var import_node_path28 = __toESM(require("node:path"), 1);
 var BUNDLE_NAME_HEX_DIGITS = 16;
 function resolveTrustBundle(params) {
-  const { caCertFile, bundlesDir, inherited, fs: fs12 } = params;
+  const { caCertFile, bundlesDir, variable, inherited, fs: fs12 } = params;
   if (inherited === void 0 || inherited === "" || import_node_path28.default.resolve(inherited) === import_node_path28.default.resolve(caCertFile)) {
     return { path: caCertFile };
   }
@@ -8153,7 +8193,7 @@ function resolveTrustBundle(params) {
   } catch (error) {
     return {
       path: caCertFile,
-      warning: `agent-shim: NODE_EXTRA_CA_CERTS names ${inherited}, which could not be read (${error instanceof Error ? error.message : String(error)}); the child trusts agent-shim's front-door CA on top of the system store, and nothing from that file`
+      warning: `agent-shim: ${variable} names ${inherited}, which could not be read (${error instanceof Error ? error.message : String(error)}); the child trusts agent-shim's front-door CA on top of the system store, and nothing from that file`
     };
   }
   if (inheritedPem.includes(caPem.trim())) {
@@ -8199,7 +8239,7 @@ function realFrontDoorPort(paths, spawnDaemon) {
           verifyListener: (port) => probeFrontDoorSync(port, import_node_fs10.default.readFileSync(paths.frontdoorCaCertFile, "utf8"))
         }
       });
-      const trust = resolveTrustBundle({ caCertFile: paths.frontdoorCaCertFile, bundlesDir: paths.frontdoorCaBundlesDir, inherited: inheritedExtraCaCerts, fs: realTrustBundleFs });
+      const trust = resolveTrustBundle({ caCertFile: paths.frontdoorCaCertFile, bundlesDir: paths.frontdoorCaBundlesDir, variable: "NODE_EXTRA_CA_CERTS", inherited: inheritedExtraCaCerts, fs: realTrustBundleFs });
       return {
         port: up.port,
         connectPort: up.connectPort,

package/dist/index.mjs

@@ -2793,14 +2793,11 @@ ${request3.rawHeaders.reduce((accumulated, value, index) => index % 2 === 0 ? `$
   };
   const sessions = config.interceptHosts.map((host) => {
     if (config.tapHosts.includes(host)) {
-      const tlsAcceptor2 = effects.createTlsAcceptor(
-        config.leafFor(host),
-        (secure) => {
-          pumpTapSession(secure, async (clientAlpn) => await effects.connectTlsUpstream(host, HTTPS_PORT, clientAlpn), config.capture?.tapStream?.(host));
-        },
-        TAP_ALPN_PROTOCOLS
-      );
-      return { host, tlsAcceptor: tlsAcceptor2 };
+      const serveSecure2 = (secure) => {
+        pumpTapSession(secure, async (clientAlpn) => await effects.connectTlsUpstream(host, HTTPS_PORT, clientAlpn), config.capture?.tapStream?.(host));
+      };
+      const tlsAcceptor2 = effects.createTlsAcceptor(config.leafFor(host), serveSecure2, TAP_ALPN_PROTOCOLS);
+      return { host, serveSecure: serveSecure2, tlsAcceptor: tlsAcceptor2 };
     }
     const handler = (request3, response) => {
       if (host === config.routedHost && servedByPipeline(request3.url)) {
@@ -2814,19 +2811,29 @@ ${request3.rawHeaders.reduce((accumulated, value, index) => index % 2 === 0 ? `$
       effects.forwardHttp(config.upstreamFor(host), request3, response, config.capture?.observePassthrough(request3));
     };
     const httpSession = effects.createHttpSession(handler, onUpgrade(host));
-    const tlsAcceptor = effects.createTlsAcceptor(config.leafFor(host), (secure, context) => {
-      tunnelTokens.set(secure, context);
+    const serveSecure = (secure, capability) => {
+      tunnelTokens.set(secure, capability);
       httpSession.serve(secure);
-    });
-    return { host, httpSession, tlsAcceptor };
+    };
+    const tlsAcceptor = effects.createTlsAcceptor(config.leafFor(host), serveSecure);
+    return { host, serveSecure, httpSession, tlsAcceptor };
   });
   const ledger = createConnectionLedger(config.limits, config.isLiveCapability);
   const listener = await effects.listenLoopback(preferredPort, (socket) => {
     handleConnect(socket, { config, effects, sessions, ledger });
   });
   const apiSession = sessions.find((session) => session.host === config.routedHost);
+  const sessionByHost = new Map(sessions.map((session) => [session.host, session]));
+  const sniAcceptor = effects.createSniTlsAcceptor(config.interceptHosts, config.leafFor, (secure, host) => {
+    const session = sessionByHost.get(host);
+    if (session === void 0) {
+      secure.destroy();
+      return;
+    }
+    session.serveSecure(secure, config.transparentCapability ?? "");
+  });
   const transparent = config.transparentPort === void 0 || apiSession === void 0 ? void 0 : await effects.listenLoopback(config.transparentPort, (socket) => {
-    apiSession.tlsAcceptor.accept(socket, config.transparentCapability ?? "");
+    sniAcceptor.accept(socket);
   });
   return {
     port: listener.port,
@@ -2835,6 +2842,7 @@ ${request3.rawHeaders.reduce((accumulated, value, index) => index % 2 === 0 ? `$
       ledger.close();
       await listener.close();
       await transparent?.close();
+      sniAcceptor.close();
       for (const { httpSession, tlsAcceptor } of sessions) {
         tlsAcceptor.close();
         httpSession?.close();
@@ -3164,6 +3172,38 @@ function realConnectEffects() {
         }
       };
     },
+    createSniTlsAcceptor: (hosts, leafFor, onSecure) => {
+      const contexts = new Map(
+        hosts.map((host) => {
+          const leaf = leafFor(host);
+          return [host, tls.createSecureContext({ key: leaf.keyPem, cert: leaf.certPem })];
+        })
+      );
+      const server = tls.createServer(
+        {
+          // No default key or cert exists, so the SNI selection is the only source of credentials: an unserved name fails its handshake here, and a client that sent no SNI at all never reaches the selection and fails for want of any certificate, which is exactly the fail-closed shape this surface wants.
+          SNICallback: (servername, callback) => {
+            const context = contexts.get(servername);
+            callback(context === void 0 ? new Error(`the transparent surface serves no host named ${servername}`) : null, context);
+          }
+        },
+        (secure) => {
+          onSecure(secure, typeof secure.servername === "string" ? secure.servername : "");
+        }
+      );
+      server.on("clientError", (_error, socket) => {
+        socket.destroy();
+      });
+      return {
+        // The same hand-off the single-leaf acceptor uses: emitting the connection event runs the TLS server's own connection listener on a socket this process already owns (the redirect half of the connection) rather than one the server accepted itself.
+        accept: (socket) => {
+          server.emit("connection", socket);
+        },
+        close: () => {
+          server.close();
+        }
+      };
+    },
     createHttpSession: (handler, onUpgrade) => {
       const server = http.createServer(handler);
       server.on("clientError", (_error, socket) => {
@@ -7976,7 +8016,7 @@ import { createHash as createHash5 } from "node:crypto";
 import path28 from "node:path";
 var BUNDLE_NAME_HEX_DIGITS = 16;
 function resolveTrustBundle(params) {
-  const { caCertFile, bundlesDir, inherited, fs: fs12 } = params;
+  const { caCertFile, bundlesDir, variable, inherited, fs: fs12 } = params;
   if (inherited === void 0 || inherited === "" || path28.resolve(inherited) === path28.resolve(caCertFile)) {
     return { path: caCertFile };
   }
@@ -7987,7 +8027,7 @@ function resolveTrustBundle(params) {
   } catch (error) {
     return {
       path: caCertFile,
-      warning: `agent-shim: NODE_EXTRA_CA_CERTS names ${inherited}, which could not be read (${error instanceof Error ? error.message : String(error)}); the child trusts agent-shim's front-door CA on top of the system store, and nothing from that file`
+      warning: `agent-shim: ${variable} names ${inherited}, which could not be read (${error instanceof Error ? error.message : String(error)}); the child trusts agent-shim's front-door CA on top of the system store, and nothing from that file`
     };
   }
   if (inheritedPem.includes(caPem.trim())) {
@@ -8033,7 +8073,7 @@ function realFrontDoorPort(paths, spawnDaemon) {
           verifyListener: (port) => probeFrontDoorSync(port, fs11.readFileSync(paths.frontdoorCaCertFile, "utf8"))
         }
       });
-      const trust = resolveTrustBundle({ caCertFile: paths.frontdoorCaCertFile, bundlesDir: paths.frontdoorCaBundlesDir, inherited: inheritedExtraCaCerts, fs: realTrustBundleFs });
+      const trust = resolveTrustBundle({ caCertFile: paths.frontdoorCaCertFile, bundlesDir: paths.frontdoorCaBundlesDir, variable: "NODE_EXTRA_CA_CERTS", inherited: inheritedExtraCaCerts, fs: realTrustBundleFs });
       return {
         port: up.port,
         connectPort: up.connectPort,

package/dist/types/index.d.ts

@@ -686,7 +686,7 @@ interface LayoutPaths {
     readonly frontdoorCaCertFile: string;
     /** Path to the front door's CA private key, mode 0600: whoever can read it can impersonate the door to every routed child. */
     readonly frontdoorCaKeyFile: string;
-    /** Directory of combined CA bundles: a parent environment's own NODE_EXTRA_CA_CERTS file plus the front door's CA, one file per distinct combination, for children that must keep trusting both. */
+    /** Directory of combined CA bundles: a parent environment's own NODE_EXTRA_CA_CERTS (for a routed child) or HEADROOM_CA_BUNDLE (for the headroom daemon) file plus the front door's CA, one file per distinct combination, for processes that must keep trusting both. */
     readonly frontdoorCaBundlesDir: string;
     /** Path to the front door's state.json: its supervisor pid, its port, and the sticky port it last served on. */
     readonly frontdoorStateFile: string;
@@ -1470,7 +1470,7 @@ declare function mintLeaf(ca: CaMaterial, names: readonly string[], now: Readonl
 /** Mints each host's leaf once from the CA and reuses it, because generating a 2048-bit RSA keypair costs noticeable time and nothing about the certificate changes between sessions. */
 declare function createLeafCache(ca: CaMaterial, now: () => Date): (host: string) => LeafCert;
 /**
- * Persistence for the CA: generated once on the machine's first headroom start and reused forever after, because regenerating it would invalidate every child's `NODE_EXTRA_CA_CERTS` pointing at the old file. The real implementation writes the key with mode 0600; injected fakes keep it in memory.
+ * Persistence for the CA: generated once on the machine's first front-door start and reused forever after, because regenerating it would invalidate every child's `NODE_EXTRA_CA_CERTS` pointing at the old file. The real implementation writes the key with mode 0600; injected fakes keep it in memory.
  */
 interface ConnectCertStore {
     /** The persisted CA, or undefined when none exists yet (or only half of it does: a cert without its key can sign nothing, so it counts as absent). */
@@ -1509,6 +1509,13 @@ interface TlsAcceptor {
     /** Drops every session this acceptor is terminating. */
     readonly close: () => void;
 }
+/** Presents every served host's leaf on one handshake, selected by the SNI name the client sent: the transparent surface's terminator, answering each redirected connection as the host it named. */
+interface SniTlsAcceptor {
+    /** Starts the TLS handshake on a redirected socket; a handshake that completes for a served host hands its secure session to the acceptor's `onSecure` with that host's name. */
+    readonly accept: (socket: net.Socket) => void;
+    /** Drops every session this acceptor is terminating. */
+    readonly close: () => void;
+}
 /** Parses HTTP over terminated sockets and serves each request through the handler, keep-alive included. */
 interface HttpParserSession {
     readonly serve: (socket: net.Socket) => void;
@@ -1522,6 +1529,8 @@ interface ConnectEffects {
     readonly listenLoopback: (preferredPort: number | undefined, onSocket: (socket: net.Socket) => void) => Promise<ConnectListenerHandle>;
     /** Builds the TLS terminator for one leaf, handing each successfully handshaked session to `onSecure` together with the context its `accept` call carried. `alpnProtocols`, when given, is advertised during the handshake, which is how a tap host's session can offer HTTP/2 the way its real server does. */
     readonly createTlsAcceptor: (leaf: LeafCert, onSecure: (secure: net.Socket, context: string) => void, alpnProtocols?: readonly string[]) => TlsAcceptor;
+    /** Builds the transparent surface's TLS terminator: one handshake whose SNI name selects which served host's leaf answers it, so a connection redirected from any of the hosts sharing the redirected address is terminated as the host it named. A name the surface does not serve is answered with no certificate at all (a client that sends no SNI never reaches the selection and finds no default certificate either), because the only leaf that could answer such a name is another host's, which the client's own hostname check would reject anyway. No ALPN is offered: node's TLS server negotiates ALPN from the listener's own options and ignores protocols named on an SNI-selected secure context, and the API host's terminated session is parsed as HTTP/1.1, which a negotiated `h2` would strand. */
+    readonly createSniTlsAcceptor: (hosts: readonly string[], leafFor: (host: string) => LeafCert, onSecure: (secure: net.Socket, host: string) => void) => SniTlsAcceptor;
     /** Opens a TLS connection to a real host, presenting its name as SNI, for a tap session's upstream half. `clientAlpn`, when given, is the protocol the client negotiated with the surface and the only one offered upstream, so the tap never changes the channel's protocol. */
     readonly connectTlsUpstream: (host: string, port: number, clientAlpn: string | undefined) => Promise<net.Socket>;
     /** Builds the HTTP parser bound to one request handler. `onUpgrade`, when given, owns every HTTP upgrade request arriving on a terminated session, socket and already-read bytes included; a session without one lets Node destroy the upgrade, its own no-listener behaviour. */
@@ -1550,7 +1559,7 @@ interface ConnectServerConfig {
     /** Whether a capability presented as a CONNECT request's proxy credential belongs to a live launch: the same constant-time check against the same registry the routed pipeline's admission makes, read fresh on every call because launches come and go. */
     readonly isLiveCapability: (token: string) => boolean;
     /**
-     * Binds a second listener that serves the intercept hosts' sessions to connections arriving pre-established, with no CONNECT handshake to authenticate: what an operating-system redirect (a pf rule sending the real hosts' address to this port) delivers. Only the API host's session is reachable this way, never a tap host's, because a redirect can name only addresses and the control plane shares the API host's address today; if that ever splits, the transparent listener must not follow it blindly. There is no capability to check on this surface: the connection carried no proxy credential, so every request rides the pipeline anonymously, admitted the way a tunnel's own header-less requests are (by nothing, which is exactly what they present), and the surface exists solely for clients that ignore proxies and would otherwise be invisible to the door entirely.
+     * Binds a second listener that terminates redirected connections per host, with no CONNECT handshake to authenticate: what an operating-system redirect (a pf rule sending the real hosts' address to this port) delivers, pre-established. A redirect names addresses, and several real hosts share the API host's, so the client's TLS SNI name is what says which host arrived: each intercept host is served with its own leaf and its own session exactly as a CONNECT-tunnelled connection to that host is (the API host's `/v1/` rides the routed pipeline, a tap host's stream is pumped to its real host), and a name outside the intercept set, or a connection presenting none, is refused with no certificate at all, because the only leaf that could answer it is another host's. There is no capability to check on this surface: the connection carried no proxy credential, so every request rides the pipeline anonymously, admitted the way a tunnel's own header-less requests are (by nothing, which is exactly what they present), and the surface exists solely for clients that ignore proxies and would otherwise be invisible to the door entirely.
      */
     readonly transparentPort?: number;
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-shim",
-  "version": "8.0.0",
+  "version": "8.0.2",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",