agent-shim 8.0.1 → 8.0.2

package/dist/cli.cjs

@@ -61039,7 +61039,7 @@ function registerIdentityCommand(program2, deps) {
 // package.json
 var package_default = {
   name: "agent-shim",
-  version: "8.0.1",
+  version: "8.0.2",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -64665,14 +64665,11 @@ ${request6.rawHeaders.reduce((accumulated, value, index) => index % 2 === 0 ? `$
   };
   const sessions = config2.interceptHosts.map((host) => {
     if (config2.tapHosts.includes(host)) {
-      const tlsAcceptor2 = effects.createTlsAcceptor(
-        config2.leafFor(host),
-        (secure) => {
-          pumpTapSession(secure, async (clientAlpn) => await effects.connectTlsUpstream(host, HTTPS_PORT, clientAlpn), config2.capture?.tapStream?.(host));
-        },
-        TAP_ALPN_PROTOCOLS
-      );
-      return { host, tlsAcceptor: tlsAcceptor2 };
+      const serveSecure2 = (secure) => {
+        pumpTapSession(secure, async (clientAlpn) => await effects.connectTlsUpstream(host, HTTPS_PORT, clientAlpn), config2.capture?.tapStream?.(host));
+      };
+      const tlsAcceptor2 = effects.createTlsAcceptor(config2.leafFor(host), serveSecure2, TAP_ALPN_PROTOCOLS);
+      return { host, serveSecure: serveSecure2, tlsAcceptor: tlsAcceptor2 };
     }
     const handler = (request6, response) => {
       if (host === config2.routedHost && servedByPipeline(request6.url)) {
@@ -64686,19 +64683,29 @@ ${request6.rawHeaders.reduce((accumulated, value, index) => index % 2 === 0 ? `$
       effects.forwardHttp(config2.upstreamFor(host), request6, response, config2.capture?.observePassthrough(request6));
     };
     const httpSession = effects.createHttpSession(handler, onUpgrade(host));
-    const tlsAcceptor = effects.createTlsAcceptor(config2.leafFor(host), (secure, context) => {
-      tunnelTokens.set(secure, context);
+    const serveSecure = (secure, capability) => {
+      tunnelTokens.set(secure, capability);
       httpSession.serve(secure);
-    });
-    return { host, httpSession, tlsAcceptor };
+    };
+    const tlsAcceptor = effects.createTlsAcceptor(config2.leafFor(host), serveSecure);
+    return { host, serveSecure, httpSession, tlsAcceptor };
   });
   const ledger = createConnectionLedger(config2.limits, config2.isLiveCapability);
   const listener = await effects.listenLoopback(preferredPort, (socket) => {
     handleConnect(socket, { config: config2, effects, sessions, ledger });
   });
   const apiSession = sessions.find((session) => session.host === config2.routedHost);
+  const sessionByHost = new Map(sessions.map((session) => [session.host, session]));
+  const sniAcceptor = effects.createSniTlsAcceptor(config2.interceptHosts, config2.leafFor, (secure, host) => {
+    const session = sessionByHost.get(host);
+    if (session === void 0) {
+      secure.destroy();
+      return;
+    }
+    session.serveSecure(secure, config2.transparentCapability ?? "");
+  });
   const transparent = config2.transparentPort === void 0 || apiSession === void 0 ? void 0 : await effects.listenLoopback(config2.transparentPort, (socket) => {
-    apiSession.tlsAcceptor.accept(socket, config2.transparentCapability ?? "");
+    sniAcceptor.accept(socket);
   });
   return {
     port: listener.port,
@@ -64707,6 +64714,7 @@ ${request6.rawHeaders.reduce((accumulated, value, index) => index % 2 === 0 ? `$
       ledger.close();
       await listener.close();
       await transparent?.close();
+      sniAcceptor.close();
       for (const { httpSession, tlsAcceptor } of sessions) {
         tlsAcceptor.close();
         httpSession?.close();
@@ -65036,6 +65044,38 @@ function realConnectEffects() {
         }
       };
     },
+    createSniTlsAcceptor: (hosts, leafFor, onSecure) => {
+      const contexts = new Map(
+        hosts.map((host) => {
+          const leaf = leafFor(host);
+          return [host, tls.createSecureContext({ key: leaf.keyPem, cert: leaf.certPem })];
+        })
+      );
+      const server = tls.createServer(
+        {
+          // No default key or cert exists, so the SNI selection is the only source of credentials: an unserved name fails its handshake here, and a client that sent no SNI at all never reaches the selection and fails for want of any certificate, which is exactly the fail-closed shape this surface wants.
+          SNICallback: (servername, callback) => {
+            const context = contexts.get(servername);
+            callback(context === void 0 ? new Error(`the transparent surface serves no host named ${servername}`) : null, context);
+          }
+        },
+        (secure) => {
+          onSecure(secure, typeof secure.servername === "string" ? secure.servername : "");
+        }
+      );
+      server.on("clientError", (_error, socket) => {
+        socket.destroy();
+      });
+      return {
+        // The same hand-off the single-leaf acceptor uses: emitting the connection event runs the TLS server's own connection listener on a socket this process already owns (the redirect half of the connection) rather than one the server accepted itself.
+        accept: (socket) => {
+          server.emit("connection", socket);
+        },
+        close: () => {
+          server.close();
+        }
+      };
+    },
     createHttpSession: (handler, onUpgrade) => {
       const server = http.createServer(handler);
       server.on("clientError", (_error, socket) => {

package/dist/index.cjs

@@ -2959,14 +2959,11 @@ ${request3.rawHeaders.reduce((accumulated, value, index) => index % 2 === 0 ? `$
   };
   const sessions = config.interceptHosts.map((host) => {
     if (config.tapHosts.includes(host)) {
-      const tlsAcceptor2 = effects.createTlsAcceptor(
-        config.leafFor(host),
-        (secure) => {
-          pumpTapSession(secure, async (clientAlpn) => await effects.connectTlsUpstream(host, HTTPS_PORT, clientAlpn), config.capture?.tapStream?.(host));
-        },
-        TAP_ALPN_PROTOCOLS
-      );
-      return { host, tlsAcceptor: tlsAcceptor2 };
+      const serveSecure2 = (secure) => {
+        pumpTapSession(secure, async (clientAlpn) => await effects.connectTlsUpstream(host, HTTPS_PORT, clientAlpn), config.capture?.tapStream?.(host));
+      };
+      const tlsAcceptor2 = effects.createTlsAcceptor(config.leafFor(host), serveSecure2, TAP_ALPN_PROTOCOLS);
+      return { host, serveSecure: serveSecure2, tlsAcceptor: tlsAcceptor2 };
     }
     const handler = (request3, response) => {
       if (host === config.routedHost && servedByPipeline(request3.url)) {
@@ -2980,19 +2977,29 @@ ${request3.rawHeaders.reduce((accumulated, value, index) => index % 2 === 0 ? `$
       effects.forwardHttp(config.upstreamFor(host), request3, response, config.capture?.observePassthrough(request3));
     };
     const httpSession = effects.createHttpSession(handler, onUpgrade(host));
-    const tlsAcceptor = effects.createTlsAcceptor(config.leafFor(host), (secure, context) => {
-      tunnelTokens.set(secure, context);
+    const serveSecure = (secure, capability) => {
+      tunnelTokens.set(secure, capability);
       httpSession.serve(secure);
-    });
-    return { host, httpSession, tlsAcceptor };
+    };
+    const tlsAcceptor = effects.createTlsAcceptor(config.leafFor(host), serveSecure);
+    return { host, serveSecure, httpSession, tlsAcceptor };
   });
   const ledger = createConnectionLedger(config.limits, config.isLiveCapability);
   const listener = await effects.listenLoopback(preferredPort, (socket) => {
     handleConnect(socket, { config, effects, sessions, ledger });
   });
   const apiSession = sessions.find((session) => session.host === config.routedHost);
+  const sessionByHost = new Map(sessions.map((session) => [session.host, session]));
+  const sniAcceptor = effects.createSniTlsAcceptor(config.interceptHosts, config.leafFor, (secure, host) => {
+    const session = sessionByHost.get(host);
+    if (session === void 0) {
+      secure.destroy();
+      return;
+    }
+    session.serveSecure(secure, config.transparentCapability ?? "");
+  });
   const transparent = config.transparentPort === void 0 || apiSession === void 0 ? void 0 : await effects.listenLoopback(config.transparentPort, (socket) => {
-    apiSession.tlsAcceptor.accept(socket, config.transparentCapability ?? "");
+    sniAcceptor.accept(socket);
   });
   return {
     port: listener.port,
@@ -3001,6 +3008,7 @@ ${request3.rawHeaders.reduce((accumulated, value, index) => index % 2 === 0 ? `$
       ledger.close();
       await listener.close();
       await transparent?.close();
+      sniAcceptor.close();
       for (const { httpSession, tlsAcceptor } of sessions) {
         tlsAcceptor.close();
         httpSession?.close();
@@ -3330,6 +3338,38 @@ function realConnectEffects() {
         }
       };
     },
+    createSniTlsAcceptor: (hosts, leafFor, onSecure) => {
+      const contexts = new Map(
+        hosts.map((host) => {
+          const leaf = leafFor(host);
+          return [host, tls.createSecureContext({ key: leaf.keyPem, cert: leaf.certPem })];
+        })
+      );
+      const server = tls.createServer(
+        {
+          // No default key or cert exists, so the SNI selection is the only source of credentials: an unserved name fails its handshake here, and a client that sent no SNI at all never reaches the selection and fails for want of any certificate, which is exactly the fail-closed shape this surface wants.
+          SNICallback: (servername, callback) => {
+            const context = contexts.get(servername);
+            callback(context === void 0 ? new Error(`the transparent surface serves no host named ${servername}`) : null, context);
+          }
+        },
+        (secure) => {
+          onSecure(secure, typeof secure.servername === "string" ? secure.servername : "");
+        }
+      );
+      server.on("clientError", (_error, socket) => {
+        socket.destroy();
+      });
+      return {
+        // The same hand-off the single-leaf acceptor uses: emitting the connection event runs the TLS server's own connection listener on a socket this process already owns (the redirect half of the connection) rather than one the server accepted itself.
+        accept: (socket) => {
+          server.emit("connection", socket);
+        },
+        close: () => {
+          server.close();
+        }
+      };
+    },
     createHttpSession: (handler, onUpgrade) => {
       const server = http.createServer(handler);
       server.on("clientError", (_error, socket) => {

package/dist/index.mjs

@@ -2793,14 +2793,11 @@ ${request3.rawHeaders.reduce((accumulated, value, index) => index % 2 === 0 ? `$
   };
   const sessions = config.interceptHosts.map((host) => {
     if (config.tapHosts.includes(host)) {
-      const tlsAcceptor2 = effects.createTlsAcceptor(
-        config.leafFor(host),
-        (secure) => {
-          pumpTapSession(secure, async (clientAlpn) => await effects.connectTlsUpstream(host, HTTPS_PORT, clientAlpn), config.capture?.tapStream?.(host));
-        },
-        TAP_ALPN_PROTOCOLS
-      );
-      return { host, tlsAcceptor: tlsAcceptor2 };
+      const serveSecure2 = (secure) => {
+        pumpTapSession(secure, async (clientAlpn) => await effects.connectTlsUpstream(host, HTTPS_PORT, clientAlpn), config.capture?.tapStream?.(host));
+      };
+      const tlsAcceptor2 = effects.createTlsAcceptor(config.leafFor(host), serveSecure2, TAP_ALPN_PROTOCOLS);
+      return { host, serveSecure: serveSecure2, tlsAcceptor: tlsAcceptor2 };
     }
     const handler = (request3, response) => {
       if (host === config.routedHost && servedByPipeline(request3.url)) {
@@ -2814,19 +2811,29 @@ ${request3.rawHeaders.reduce((accumulated, value, index) => index % 2 === 0 ? `$
       effects.forwardHttp(config.upstreamFor(host), request3, response, config.capture?.observePassthrough(request3));
     };
     const httpSession = effects.createHttpSession(handler, onUpgrade(host));
-    const tlsAcceptor = effects.createTlsAcceptor(config.leafFor(host), (secure, context) => {
-      tunnelTokens.set(secure, context);
+    const serveSecure = (secure, capability) => {
+      tunnelTokens.set(secure, capability);
       httpSession.serve(secure);
-    });
-    return { host, httpSession, tlsAcceptor };
+    };
+    const tlsAcceptor = effects.createTlsAcceptor(config.leafFor(host), serveSecure);
+    return { host, serveSecure, httpSession, tlsAcceptor };
   });
   const ledger = createConnectionLedger(config.limits, config.isLiveCapability);
   const listener = await effects.listenLoopback(preferredPort, (socket) => {
     handleConnect(socket, { config, effects, sessions, ledger });
   });
   const apiSession = sessions.find((session) => session.host === config.routedHost);
+  const sessionByHost = new Map(sessions.map((session) => [session.host, session]));
+  const sniAcceptor = effects.createSniTlsAcceptor(config.interceptHosts, config.leafFor, (secure, host) => {
+    const session = sessionByHost.get(host);
+    if (session === void 0) {
+      secure.destroy();
+      return;
+    }
+    session.serveSecure(secure, config.transparentCapability ?? "");
+  });
   const transparent = config.transparentPort === void 0 || apiSession === void 0 ? void 0 : await effects.listenLoopback(config.transparentPort, (socket) => {
-    apiSession.tlsAcceptor.accept(socket, config.transparentCapability ?? "");
+    sniAcceptor.accept(socket);
   });
   return {
     port: listener.port,
@@ -2835,6 +2842,7 @@ ${request3.rawHeaders.reduce((accumulated, value, index) => index % 2 === 0 ? `$
       ledger.close();
       await listener.close();
       await transparent?.close();
+      sniAcceptor.close();
       for (const { httpSession, tlsAcceptor } of sessions) {
         tlsAcceptor.close();
         httpSession?.close();
@@ -3164,6 +3172,38 @@ function realConnectEffects() {
         }
       };
     },
+    createSniTlsAcceptor: (hosts, leafFor, onSecure) => {
+      const contexts = new Map(
+        hosts.map((host) => {
+          const leaf = leafFor(host);
+          return [host, tls.createSecureContext({ key: leaf.keyPem, cert: leaf.certPem })];
+        })
+      );
+      const server = tls.createServer(
+        {
+          // No default key or cert exists, so the SNI selection is the only source of credentials: an unserved name fails its handshake here, and a client that sent no SNI at all never reaches the selection and fails for want of any certificate, which is exactly the fail-closed shape this surface wants.
+          SNICallback: (servername, callback) => {
+            const context = contexts.get(servername);
+            callback(context === void 0 ? new Error(`the transparent surface serves no host named ${servername}`) : null, context);
+          }
+        },
+        (secure) => {
+          onSecure(secure, typeof secure.servername === "string" ? secure.servername : "");
+        }
+      );
+      server.on("clientError", (_error, socket) => {
+        socket.destroy();
+      });
+      return {
+        // The same hand-off the single-leaf acceptor uses: emitting the connection event runs the TLS server's own connection listener on a socket this process already owns (the redirect half of the connection) rather than one the server accepted itself.
+        accept: (socket) => {
+          server.emit("connection", socket);
+        },
+        close: () => {
+          server.close();
+        }
+      };
+    },
     createHttpSession: (handler, onUpgrade) => {
       const server = http.createServer(handler);
       server.on("clientError", (_error, socket) => {

package/dist/types/index.d.ts

@@ -1509,6 +1509,13 @@ interface TlsAcceptor {
     /** Drops every session this acceptor is terminating. */
     readonly close: () => void;
 }
+/** Presents every served host's leaf on one handshake, selected by the SNI name the client sent: the transparent surface's terminator, answering each redirected connection as the host it named. */
+interface SniTlsAcceptor {
+    /** Starts the TLS handshake on a redirected socket; a handshake that completes for a served host hands its secure session to the acceptor's `onSecure` with that host's name. */
+    readonly accept: (socket: net.Socket) => void;
+    /** Drops every session this acceptor is terminating. */
+    readonly close: () => void;
+}
 /** Parses HTTP over terminated sockets and serves each request through the handler, keep-alive included. */
 interface HttpParserSession {
     readonly serve: (socket: net.Socket) => void;
@@ -1522,6 +1529,8 @@ interface ConnectEffects {
     readonly listenLoopback: (preferredPort: number | undefined, onSocket: (socket: net.Socket) => void) => Promise<ConnectListenerHandle>;
     /** Builds the TLS terminator for one leaf, handing each successfully handshaked session to `onSecure` together with the context its `accept` call carried. `alpnProtocols`, when given, is advertised during the handshake, which is how a tap host's session can offer HTTP/2 the way its real server does. */
     readonly createTlsAcceptor: (leaf: LeafCert, onSecure: (secure: net.Socket, context: string) => void, alpnProtocols?: readonly string[]) => TlsAcceptor;
+    /** Builds the transparent surface's TLS terminator: one handshake whose SNI name selects which served host's leaf answers it, so a connection redirected from any of the hosts sharing the redirected address is terminated as the host it named. A name the surface does not serve is answered with no certificate at all (a client that sends no SNI never reaches the selection and finds no default certificate either), because the only leaf that could answer such a name is another host's, which the client's own hostname check would reject anyway. No ALPN is offered: node's TLS server negotiates ALPN from the listener's own options and ignores protocols named on an SNI-selected secure context, and the API host's terminated session is parsed as HTTP/1.1, which a negotiated `h2` would strand. */
+    readonly createSniTlsAcceptor: (hosts: readonly string[], leafFor: (host: string) => LeafCert, onSecure: (secure: net.Socket, host: string) => void) => SniTlsAcceptor;
     /** Opens a TLS connection to a real host, presenting its name as SNI, for a tap session's upstream half. `clientAlpn`, when given, is the protocol the client negotiated with the surface and the only one offered upstream, so the tap never changes the channel's protocol. */
     readonly connectTlsUpstream: (host: string, port: number, clientAlpn: string | undefined) => Promise<net.Socket>;
     /** Builds the HTTP parser bound to one request handler. `onUpgrade`, when given, owns every HTTP upgrade request arriving on a terminated session, socket and already-read bytes included; a session without one lets Node destroy the upgrade, its own no-listener behaviour. */
@@ -1550,7 +1559,7 @@ interface ConnectServerConfig {
     /** Whether a capability presented as a CONNECT request's proxy credential belongs to a live launch: the same constant-time check against the same registry the routed pipeline's admission makes, read fresh on every call because launches come and go. */
     readonly isLiveCapability: (token: string) => boolean;
     /**
-     * Binds a second listener that serves the intercept hosts' sessions to connections arriving pre-established, with no CONNECT handshake to authenticate: what an operating-system redirect (a pf rule sending the real hosts' address to this port) delivers. Only the API host's session is reachable this way, never a tap host's, because a redirect can name only addresses and the control plane shares the API host's address today; if that ever splits, the transparent listener must not follow it blindly. There is no capability to check on this surface: the connection carried no proxy credential, so every request rides the pipeline anonymously, admitted the way a tunnel's own header-less requests are (by nothing, which is exactly what they present), and the surface exists solely for clients that ignore proxies and would otherwise be invisible to the door entirely.
+     * Binds a second listener that terminates redirected connections per host, with no CONNECT handshake to authenticate: what an operating-system redirect (a pf rule sending the real hosts' address to this port) delivers, pre-established. A redirect names addresses, and several real hosts share the API host's, so the client's TLS SNI name is what says which host arrived: each intercept host is served with its own leaf and its own session exactly as a CONNECT-tunnelled connection to that host is (the API host's `/v1/` rides the routed pipeline, a tap host's stream is pumped to its real host), and a name outside the intercept set, or a connection presenting none, is refused with no certificate at all, because the only leaf that could answer it is another host's. There is no capability to check on this surface: the connection carried no proxy credential, so every request rides the pipeline anonymously, admitted the way a tunnel's own header-less requests are (by nothing, which is exactly what they present), and the surface exists solely for clients that ignore proxies and would otherwise be invisible to the door entirely.
      */
     readonly transparentPort?: number;
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-shim",
-  "version": "8.0.1",
+  "version": "8.0.2",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",