agent-shim 8.11.3 → 8.13.0

package/dist/types/index.d.ts

@@ -1149,6 +1149,22 @@ interface FarmFs {
     /** A stable content hash of one file, or undefined when it is missing or is not a regular file. Used only to recognise farm data that has already been adopted into the canonical tree. */
     readonly hashFile: (path: string) => string | undefined;
 }
+/** The outcome of one `spawnSync` call, mirroring Node's own `SpawnSyncReturns` shape narrowly to what the launcher actually reads. */
+interface SpawnResult {
+    /** The child's exit code, or null when it was terminated by a signal instead of exiting normally. */
+    readonly status: number | null;
+    /** The signal that terminated the child, or null when it exited normally. */
+    readonly signal: NodeJS.Signals | null;
+    /** Set when the child process could not even be spawned (e.g. the binary does not exist). */
+    readonly error?: Error;
+}
+/** Runs the real `claude` binary synchronously, injected so no test ever spawns a real process. The Node equivalent of the legacy bash tool's `exec` is `spawnSync` with `stdio: "inherit"` followed by propagating the child's own exit code — see `src/launcher/spawn.ts`. */
+interface SpawnPort {
+    readonly spawnSync: (command: string, args: readonly string[], options: {
+        readonly stdio: "inherit";
+        readonly env: Readonly<Record<string, string | undefined>>;
+    }) => SpawnResult;
+}
 /** The outcome of one synchronous external-command run (distinct from `SpawnPort`, which is specifically for replacing this process with the real `claude` binary — `RunPort` is for auxiliary commands like `git rev-parse` for branch detection, or `security find-generic-password` for the macOS Keychain diagnostic in `check.ts`, whose output this process needs to keep running and read). */
 interface RunResult {
     readonly status: number | null;
@@ -1590,6 +1606,10 @@ interface ConnectServerConfig {
     readonly transparentCapability?: string;
     /** The intercept hosts that are never HTTP-parsed: terminated, tapped at the byte level, and pumped to their real host. */
     readonly tapHosts: readonly string[];
+    /**
+     * The door's local answer surface, consulted before routing or piping on every parsed host's session, and given the parsing of the tap hosts it names: absent (the default, and every door that has not asked for the self-hosted Remote Control mode) nothing about the surface's behaviour changes.
+     */
+    readonly localSurface?: ConnectLocalSurface;
     /** The connection deadlines and caps; production passes `CONNECT_LIMITS`. */
     readonly limits: ConnectLimits;
     /** The diagnostic tap, when capturing is enabled; absent means nothing is recorded. */
@@ -1603,6 +1623,17 @@ interface ConnectServerHandle {
     /** Stops the listener, drops every live tunnel and terminated session, and resolves once the port is released. */
     readonly close: () => Promise<void>;
 }
+/**
+ * A surface the connect layer consults before it routes or pipes anything: the door's self-hosted Remote Control answers (see `rcSelfHost.ts`), which own a fixed set of non-pipeline paths on the API host and the OAuth refresh on the control-plane host. Absent, every request keeps exactly the behaviour it has today.
+ *
+ * A host this surface needs to parse (`parsesHost`) is served as ordinary HTTP even when it is named as a tap host: the tap exists because that host's channel could not be safely parsed, so taking it over is the surface's own explicit decision, made only for the mode whose contract already excludes the traffic the tap protects.
+ */
+interface ConnectLocalSurface {
+    /** Whether this surface needs one host's terminated sessions parsed as HTTP rather than byte-tapped. */
+    readonly parsesHost: (host: string) => boolean;
+    /** Serves one request locally; resolves false when the surface does not own the path, so routing or piping continues unchanged. */
+    readonly serve: (host: string, request: IncomingMessage, response: ServerResponse) => Promise<boolean>;
+}
 /**
  * Starts the connect surface: binds the listener, mints the intercept host's leaf, and wires the per-connection routing. Resolves once the listener is bound.
  *
@@ -2081,6 +2112,14 @@ interface RcDialTarget {
  * The real `RcEventDial`: one keep-alive TLS agent of the door's own exempt kind, so every injected event rides the same interception-proof dials the door's forwarded traffic does. The dial only ever reads small JSON answers (an event write's result, or an error), never a stream.
  */
 declare function realRcEventDial(target?: RcDialTarget): RcEventDial;
+/**
+ * A write dial whose target is resolved at call time rather than construction: the self-hosted Remote Control mode points the door's client half at the door's own transparent surface, whose port is known only once the connect listener has bound, and every other caller keeps the construction-time target (or the default real host when the resolver has nothing yet). The underlying dial is built once per resolved target and reused, so the connection pooling a dial exists for is preserved.
+ */
+declare function lateRcEventDial(resolve: () => RcDialTarget | undefined): RcEventDial;
+/**
+ * The stream dial's own late-targeted sibling, for the same reason: the self-hosted mode's attachment stream dials the door's own transparent surface once its port is bound.
+ */
+declare function lateRcStreamDial(resolve: () => RcDialTarget | undefined): RcStreamDial;
 declare function realRcStreamDial(target?: RcDialTarget): RcStreamDial;
 /** The real effects, dialling upstream from `ports` (the door's own range unless a test injects a private one). */
 declare function realConnectEffects(ports?: SourcePortRange): ConnectEffects;
@@ -2377,6 +2416,107 @@ type RcApiClient = RouterClient<RcApiRouter>;
 /** Builds the typed API's client for the door's provider listener: the same address, CA and per-generation control token the bespoke control client uses. */
 declare function frontDoorRcApiClient(port: number, ca: string, token: string): RcApiClient;
 
+/**
+ * The self-hosted Remote Control service: the door serving, locally, the CCR surface it normally only observes (ExaDev/agent-shim#207). When the mode is on, a Claude Code session activates Remote Control against this surface and is controlled through it with no Anthropic credential anywhere: the door answers the session family itself instead of piping it to the real API host, so the `cse_` sessions, their sequence numbers, their worker and client streams and their event writes all live on this machine.
+ *
+ * The protocol spoken is exactly the one the door already speaks as a client, which is what makes this honest: every path, envelope, sequence rule and resume pair below is the shape the merged client-half machinery (`rcSessions.ts`, `rcStream.ts`, `connectEffects.ts`) dials the real host with, cross-checked against the CLI source (the 2.1.88 source-map dump behind the issue's spike) and live 2.1.289 envelopes captured through the interception rig. The transport is version-unstable (CCRv1 websocket to CCRv2 SSE plus POST within the 2.1.x line), so this surface pins what the rig's pinned CLI speaks and must be re-verified on upgrades; that standing caveat is issue #207's own.
+ *
+ * Division of the surface: the session family (`/v1/code/sessions...` and the `/v1/sessions` compatibility list) rides the routed pipeline as a `FrontDoorRoute`, so it flows through the same admission and middleware as any routed request and, above all, through the same observation wrapper that feeds the tracker (the door's own client half learns each session's credential precisely because the create is observed like any other exchange). The non-`/v1/` answers the CLI needs around activation (feature eval, profile, telemetry no-ops) and the OAuth refresh on the control-plane host have no pipeline to ride, so they are served by `local`, which the connect surface consults before routing or piping; that surface also takes over the control-plane host's terminated session as ordinary HTTP (it is normally byte-tapped) because answering `/v1/oauth/token` requires parsing it.
+ *
+ * The one network lever this uses is the bridge response's `api_base_url`: the protocol lets the server name where the worker dials, so the door names the API host it itself terminates, and the worker's `/worker/...` calls arrive straight back at this surface over the same interception that carried the create.
+ *
+ * Everything is in memory only and dies with the door process: sessions, events, worker JWTs. No credential this door authenticates against is ever written or logged by this module; the minting command owns the files.
+ */
+/** The environment variable that turns the self-hosted Remote Control service on, read once at door start like the door's other mode selections: the door is one process serving every launch, so the mode is a property of the door, not of any one launch. Anything but `1` means off, the same exact-value vocabulary the capture toggle uses. */
+declare const RC_SELF_HOST_ENV = "AGENT_SHIM_FRONTDOOR_RC_SELF_HOST";
+/** Whether the environment asked for the self-hosted Remote Control service. */
+declare function rcSelfHostFromEnv(env: NodeJS.ProcessEnv): boolean;
+/** The full scope list the minting writes and the local refresh echoes: the CLI's own claude.ai login scope set (`CLAUDE_AI_OAUTH_SCOPES` in its source), whose `user:inference` and `user:profile` members are exactly the two the Remote Control gate demands. */
+declare const RC_SELF_HOST_SCOPE_LIST: readonly string[];
+/**
+ * How long a minted worker JWT is good for. Not a fresh number: 46800 seconds is the `expires_in` the real bridge handed the live rig session (13 hours), so the local surface keeps the CLI's refresh cadence exactly where the real one put it.
+ */
+declare const RC_SELF_HOST_WORKER_JWT_TTL_SECONDS = 46800;
+/**
+ * How often the SSE streams send a keepalive comment. Not a fresh number: it is the protocol's own keepalive cadence (the 15 s comments the door's client-half parser documents from live captures), and it must beat the worker transport's 45 s liveness bound (`DIY` in the CLI source), which a 15 s cadence does with two comments to spare.
+ */
+declare const RC_SELF_HOST_KEEPALIVE_MS = 15000;
+/**
+ * How long a session's events are retained for stream resume, and how long a streamless, trafficless session survives. One number serves both because one protocol constant derives them: the worker transport's reconnection budget is 600000 ms (`WIY` in the CLI source), so a resume can only ever name a cursor whose events are at most that old, and a worker that has been gone longer has given up by its own rules.
+ */
+declare const RC_SELF_HOST_RETENTION_MS = 600000;
+/** The whole credential this door's self-hosted mode mints, read back for every authenticated call and never logged: the token pair the identity's Claude Code presents, beside the organisation the minting chose. */
+interface RcSelfHostCredentialRecord {
+    readonly accessToken: string;
+    readonly refreshToken: string;
+    readonly organizationUuid: string;
+    readonly accountUuid: string;
+}
+/** Everything the service needs, injected so the decision logic runs against fakes in unit tests. */
+interface RcSelfHostDeps {
+    readonly now: () => number;
+    /** Mints the session and event ids: a v4 UUID or better in production. */
+    readonly newUuid: () => string;
+    /** Mints opaque token material (the worker JWTs): cryptographically random in production. */
+    readonly randomToken: () => string;
+    /** The minted credential this door authenticates against, read fresh so a re-mint takes effect without restarting the door; undefined while none was ever minted, in which case every authenticated call is refused. */
+    readonly credentialRecord: () => RcSelfHostCredentialRecord | undefined;
+    readonly log?: (line: string) => void;
+}
+/** The self-hosted Remote Control service: the session-family route for the pipeline, and the local answers the connect surface consults before routing or piping. */
+interface RcSelfHostSurface {
+    /** The pipeline route serving the whole `/v1/code/sessions` family and the `/v1/sessions` compatibility list. */
+    readonly route: FrontDoorRoute;
+    /** The connect surface's local answers: which hosts it takes over as HTTP, and the requests it answers itself. */
+    readonly local: {
+        /** The hosts whose terminated sessions this surface needs parsed as HTTP (the control-plane host, normally byte-tapped). */
+        readonly parsesHost: (host: string) => boolean;
+        /** Serves one request locally; resolves false when the surface does not own the path, so routing or piping continues unchanged. */
+        readonly serve: (host: string, request: IncomingMessage, response: ServerResponse) => Promise<boolean>;
+    };
+    /** Stops the service's timers and retires every open stream. The sessions themselves are unreachable the moment the door drops them. */
+    readonly close: () => void;
+}
+/** Creates the self-hosted Remote Control service. One per door process; everything it holds dies with it. */
+declare function createRcSelfHostSurface(deps: RcSelfHostDeps): RcSelfHostSurface;
+
+/** Where the door's own copy of the minted credential lives, under the door's state directory. */
+declare const RC_SELF_HOST_RECORD_DIR = "rc-selfhost";
+/** The door's copy of the minted credential: the record `rcSelfHost.ts` reads fresh on every authenticated call. */
+declare const RC_SELF_HOST_RECORD_FILE = "credential.json";
+/** Everything the minting needs, injected so it runs against an in-memory fake filesystem in unit tests. */
+interface RcSelfHostMintDeps {
+    readonly fs: Pick<FarmFs, "readFileUtf8" | "writeFilePrivate" | "mkdirPrivate">;
+    /** The agent-shim identities directory (the mint writes inside `<identitiesDir>/<identity>/`). */
+    readonly identitiesDir: string;
+    /** The door's state directory (the record is written under `<frontdoorDir>/rc-selfhost/`). */
+    readonly frontdoorDir: string;
+    readonly identity: string;
+    /** Mints ids: a v4 UUID or better in production. */
+    readonly newUuid: () => string;
+    /** Mints token material: cryptographically random bytes in production. */
+    readonly randomToken: () => string;
+    /** Overwrite an existing credential that is not a previous mint of this door's. */
+    readonly force: boolean;
+    readonly now: () => number;
+}
+/** What the minting produced: names and shapes only, never a token. */
+interface RcSelfHostMintResult {
+    readonly identity: string;
+    readonly organizationUuid: string;
+    readonly credentialsFile: string;
+    readonly claudeJsonFile: string;
+    readonly recordFile: string;
+    /** Whether a previous mint of this door's was replaced. */
+    readonly replaced: boolean;
+}
+/** Reads the door's previously minted record, or undefined when none exists (or what exists does not parse). */
+declare function readRcSelfHostRecord(fs: Pick<FarmFs, "readFileUtf8">, frontdoorDir: string): RcSelfHostCredentialRecord | undefined;
+/**
+ * Mints the local credential for one identity and records the door's copy. Refuses, unless `force`, when the identity already holds an OAuth credential this door did not mint (a real claude.ai login): overwriting one silently would sign the identity out, and the mode's own contract is that no Anthropic credential is in play at all.
+ */
+declare function mintRcSelfHostCredential(deps: RcSelfHostMintDeps): RcSelfHostMintResult;
+
 /** The outcome of authenticating the listener a front-door state file names. */
 type ListenerVerdict = {
     readonly ok: true;
@@ -3762,6 +3902,10 @@ interface PrepareLaunchParams {
     /** True when the user was asked on a terminal whether to create the selected configuration profile and chose to launch without it. Without that explicit choice, a selected profile with no file is refused rather than silently skipped. */
     readonly allowMissingConfigProfile?: boolean;
 }
+/** Inputs to `runLauncher`: a launch's inputs plus the port that spawns the child. */
+interface RunLauncherParams extends PrepareLaunchParams {
+    readonly spawn: SpawnPort;
+}
 /**
  * What one launch resolved to, once every effect its child depends on is in place (the identity's farm resynced, the front door and headroom up and this launch registered with them): the real binary, its arguments and its environment.
  */
@@ -3782,6 +3926,32 @@ interface LaunchPlan {
  * The farm resync is skipped when `CLAUDE_CONFIG_DIR` was already set (the escape hatch means the user has named a configuration directory explicitly, and agent-shim manages neither its contents nor its lifetime) and when no identity resolved at all (a bare launch against plain `~/.claude`, matching the legacy tool's own behaviour). In both cases there is no agent-shim-managed farm for a resync to act on.
  */
 declare function prepareLaunch(params: PrepareLaunchParams): LaunchPlan;
+/**
+ * Runs one `claude` launch: `prepareLaunch`, then the child under `params.spawn`, whose exit code becomes this process's.
+ *
+ * The session registrations are released twice by design: `beforeExit` covers the real success path (where `process.exit` never unwinds a `finally`), and the `finally` below covers a thrown spawn error, where it does.
+ */
+declare function runLauncher(params: RunLauncherParams): void;
+
+/** Inputs to `spawnClaude`. */
+interface SpawnClaudeParams {
+    /** Full path to the real `claude` binary to run, as discovered by `src/versionDiscovery.ts`. */
+    readonly bin: string;
+    readonly args: readonly string[];
+    readonly env: Readonly<Record<string, string | undefined>>;
+    readonly spawn: SpawnPort;
+    readonly proc: ProcPort;
+    /**
+     * Runs immediately before the child's exit code propagates. The real `process.exit` never unwinds a `finally` block, so a caller with cleanup to do on the success path (releasing a headroom session registration, say) cannot rely on one; it passes the cleanup here instead.
+     */
+    readonly beforeExit?: () => void;
+}
+/**
+ * Runs the real `claude` binary and propagates its exit code faithfully, the Node equivalent of the legacy bash tool's `exec` (process replacement): `spawnSync(bin, args, { stdio: "inherit" })` followed by `process.exit(status)`.
+ *
+ * Throws when the child could not even be spawned (e.g. `bin` does not exist) rather than silently exiting — a spawn failure is a real problem, not a clean exit code to propagate.
+ */
+declare function spawnClaude(params: SpawnClaudeParams): never;
 
 /** Raised by `prepareClaudeLaunch` when the launch is refused: no identity, a missing profile, an ambient credential, an unresolvable credential and the like. `message` is what the launcher logged; `exitCode` is the status the command line would have exited with. */
 declare class LaunchRefusedError extends CliError {
@@ -3808,5 +3978,5 @@ interface PrepareClaudeLaunchOptions {
  */
 declare function prepareClaudeLaunch(options: PrepareClaudeLaunchOptions): LaunchPlan;
 
-export { AMBIENT_CREDENTIAL_VARS, CONNECT_INTERCEPT_HOST, CONNECT_INTERCEPT_HOSTS, CONNECT_LIMITS, CONTROL_PATH_PREFIX, CategoryClassificationOverlaySchema, CategoryClassificationSchema, CategoryMapSchema, CliError, ConfigProfileSchema, CredentialCacheSchema, CredentialSchema, CredentialSourceSchema, DirectoryRuleAlreadyExistsError, DirectoryRuleMissingTargetError, DirectoryRuleNotFoundError, DirectoryRuleSchema, DirectoryRulesSchema, EXIT_FAILURE, EXIT_USAGE, EntryValueSchema, FARM_MANIFEST_FILENAME, FrontDoorStartError, GlobalConfigSchema, HeadroomStartError, IdentityAlreadyExistsError, IdentityNotFoundError, IdentitySchema, InvalidCategoryNameError, InvalidIdentityNameError, InvalidProviderNameError, LaunchRefusedError, LegacyProviderFileError, PROMPT_CACHE_TTL_MS, PlanClassSchema, PoolNameSchema, PoolNotFoundError, PoolPickReportSchema, PoolSchema, PortableConfigSchema, ProfileAlreadyExistsError, ProfileNotFoundError, ProviderAlreadyExistsError, ProviderKindMismatchError, ProviderNotFoundError, ProviderSchema, RC_IDLE_EXPIRY_MS, RC_ORPC_PATH_PREFIX, RC_PENDING_DEADLINE_MS, RC_PERMISSION_MODES, RC_REQUEST_PARSE_CAP_BYTES, RC_SESSIONS_PATH_PREFIX, RC_STREAM_BACKOFF_MS, ROUTED_PATH_PREFIX, RcPermissionModeSchema, RcStreamEnvelopeSchema, RcStreamEventSchema, UsageError, UsageSnapshotError, UsageSnapshotSchema, WhenSchema, addDirectoryRule, addIdentity, addPool, addProvider, answerRcControlRequest, buildEntryFacts, buildLayoutPaths, buildRcControlResponsePayload, buildRcEventWriteBody, buildRcInterruptPayload, buildRcSetModelPayload, buildRcSetPermissionModePayload, buildRcUserMessagePayload, carryOver, checkReportHasWarnings, checkReportToJson, collectCheckReport, collectDoctorReport, collectPoolPick, createLeafCache, createProfile, createRcApiNodeHandler, createRcApiRouter, createRcControlHandler, createRcCredentialStore, createRcEventFanout, createRcSessionTracker, createRcStreamHub, createSseParser, describeProviderEndpoint, detectAmbientCredential, effectiveWindow, ensureCa, ensureFrontDoor, ensureHeadroom, evaluateAmbientCredentialGuard, evaluateWhen, formatAmbientCredentialGuardMessage, formatCheckReport, formatDoctorReport, forwardableHeaders, frontDoorRcApiClient, frontDoorRcControl, generateCa, identityExists, injectRcUserMessage, interruptRcSession, isIdentityDirectoryName, isInterceptedHost, isRcPermissionMode, listDirectoryRules, listIdentities, listProfiles, listProviders, listUsageSnapshots, matchBranch, mintLeaf, observingRoutedRoute, parseConnectTarget, parseRcStreamEnvelope, planOf, prepareClaudeLaunch, prepareLaunch, profileExists, providerExists, rankPool, rcEventWriteResultFromAnswer, rcObserverAsPassthrough, readActiveIdentity, readDirectoryRules, readFarmManifest, readGlobalConfig, readIdentity, readPools, readProfile, readProvider, readUsageSnapshot, realConnectCertStore, realConnectEffects, realRcControlTransport, realRcEventDial, realRcStreamDial, recoverFarm, recoveryDiagnostics, removeDirectoryRule, removeIdentity, removePool, removeProfile, removeProvider, requirePool, resolveAgentShimHome, resolveClaudeHome, resolveDecisions, resolveLayoutPaths, resolveSupervisorConfig, resyncFarm, runCheck, runDoctor, runFrontDoorSupervisor, runSupervisor, servedByPipeline, setAllowAmbientCredential, setDefaultConfigProfile, setGlobalDefaultProfile, setIdentityCredential, setPool, setProfileCategories, setProfileEntries, setProfileLaunchFlags, setProfileMetadata, setRcSessionModel, setRcSessionPermissionMode, snapshotPath, startConnectServer, topLevelNames, updateDirectoryRule, updateProvider, useIdentity, writeDirectoryRules };
-export type { AddDirectoryRuleOptions, AddProviderInput, AmbientCredentialDetection, AmbientCredentialGuardResult, AmbientCredentialVar, BuildEntryFactsParams, CaMaterial, Candidate, CarryOverParams, CarryOverResult, CategoryMap, CheckReport, CollectCheckReportParams, CollectDoctorReportParams, CompiledRule, ConditionContext, ConfigProfile, ConnectCertStore, ConnectEffects, ConnectLimits, ConnectServerConfig, ConnectServerHandle, ConnectTarget, Credential, CredentialSource, Decision, Diagnostic, DirectoryRule, DirectoryRules, DoctorReport, EffectiveWindow, EliminatedRule, EnsureFrontDoorPorts, EnsureHeadroomPorts, EntryFact, EntryFacts, EntryValue, EvaluateAmbientCredentialGuardParams, FlattenedCascade, FrontDoorRcControl, FrontDoorSupervisorPorts, GlobalConfig, HeadroomSupervisorConfig, Identity, IdentityCredentialChange, IdentityListEntry, IdentityListing, InjectedCredential, LaunchPlan, Layer, LayerId, LayoutPaths, LeafCert, PlanClass, Pool, PoolMember, PoolPickReport, PoolRanking, PortableConfig, PrepareClaudeLaunchOptions, PrepareLaunchParams, ProfileListEntry, Provider, ProviderListEntry, RankPoolInput, RcAnswerDecision, RcAnswerDeps, RcApiClient, RcApiDeps, RcApiRouter, RcControlAnswer, RcControlHandlerDeps, RcControlRequestDeps, RcControlTransport, RcCredentialStore, RcDialAnswer, RcDialTarget, RcEventDial, RcEventFanout, RcEventWriteResult, RcExchangeObserver, RcInjectDeps, RcObservedCredential, RcObservedRequest, RcPendingRequestSummary, RcPermissionMode, RcPresenceAnswer, RcSessionStatus, RcSessionSummary, RcSessionTracker, RcSessionTrackerDeps, RcStreamAnswer, RcStreamDial, RcStreamEnvelope, RcStreamEvent, RcStreamHub, RcStreamHubDeps, RcWorkerFact, RcWriteHeaders, RecoverFarmParams, RecoveryResult, ResolveDecisionsInput, ResolvedState, ResyncFarmParams, ResyncFarmResult, RunCheckParams, RunDoctorParams, RunFrontDoorSupervisorOptions, RunSupervisorOptions, SseParsedEvent, StickyPick, SupervisorPorts, UnreadableIdentityListEntry, UpdateDirectoryRuleOptions, UpdateProviderInput, UsageReadFs, UsageSnapshot, WhenCondition, WhenEvaluation };
+export { AMBIENT_CREDENTIAL_VARS, CONNECT_INTERCEPT_HOST, CONNECT_INTERCEPT_HOSTS, CONNECT_LIMITS, CONTROL_PATH_PREFIX, CategoryClassificationOverlaySchema, CategoryClassificationSchema, CategoryMapSchema, CliError, ConfigProfileSchema, CredentialCacheSchema, CredentialSchema, CredentialSourceSchema, DirectoryRuleAlreadyExistsError, DirectoryRuleMissingTargetError, DirectoryRuleNotFoundError, DirectoryRuleSchema, DirectoryRulesSchema, EXIT_FAILURE, EXIT_USAGE, EntryValueSchema, FARM_MANIFEST_FILENAME, FrontDoorStartError, GlobalConfigSchema, HeadroomStartError, IdentityAlreadyExistsError, IdentityNotFoundError, IdentitySchema, InvalidCategoryNameError, InvalidIdentityNameError, InvalidProviderNameError, LaunchRefusedError, LegacyProviderFileError, PROMPT_CACHE_TTL_MS, PlanClassSchema, PoolNameSchema, PoolNotFoundError, PoolPickReportSchema, PoolSchema, PortableConfigSchema, ProfileAlreadyExistsError, ProfileNotFoundError, ProviderAlreadyExistsError, ProviderKindMismatchError, ProviderNotFoundError, ProviderSchema, RC_IDLE_EXPIRY_MS, RC_ORPC_PATH_PREFIX, RC_PENDING_DEADLINE_MS, RC_PERMISSION_MODES, RC_REQUEST_PARSE_CAP_BYTES, RC_SELF_HOST_ENV, RC_SELF_HOST_KEEPALIVE_MS, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE, RC_SELF_HOST_RETENTION_MS, RC_SELF_HOST_SCOPE_LIST, RC_SELF_HOST_WORKER_JWT_TTL_SECONDS, RC_SESSIONS_PATH_PREFIX, RC_STREAM_BACKOFF_MS, ROUTED_PATH_PREFIX, RcPermissionModeSchema, RcStreamEnvelopeSchema, RcStreamEventSchema, UsageError, UsageSnapshotError, UsageSnapshotSchema, WhenSchema, addDirectoryRule, addIdentity, addPool, addProvider, answerRcControlRequest, buildEntryFacts, buildLayoutPaths, buildRcControlResponsePayload, buildRcEventWriteBody, buildRcInterruptPayload, buildRcSetModelPayload, buildRcSetPermissionModePayload, buildRcUserMessagePayload, carryOver, checkReportHasWarnings, checkReportToJson, collectCheckReport, collectDoctorReport, collectPoolPick, createLeafCache, createProfile, createRcApiNodeHandler, createRcApiRouter, createRcControlHandler, createRcCredentialStore, createRcEventFanout, createRcSelfHostSurface, createRcSessionTracker, createRcStreamHub, createSseParser, describeProviderEndpoint, detectAmbientCredential, effectiveWindow, ensureCa, ensureFrontDoor, ensureHeadroom, evaluateAmbientCredentialGuard, evaluateWhen, formatAmbientCredentialGuardMessage, formatCheckReport, formatDoctorReport, forwardableHeaders, frontDoorRcApiClient, frontDoorRcControl, generateCa, identityExists, injectRcUserMessage, interruptRcSession, isIdentityDirectoryName, isInterceptedHost, isRcPermissionMode, lateRcEventDial, lateRcStreamDial, listDirectoryRules, listIdentities, listProfiles, listProviders, listUsageSnapshots, matchBranch, mintLeaf, mintRcSelfHostCredential, observingRoutedRoute, parseConnectTarget, parseRcStreamEnvelope, planOf, prepareClaudeLaunch, prepareLaunch, profileExists, providerExists, rankPool, rcEventWriteResultFromAnswer, rcObserverAsPassthrough, rcSelfHostFromEnv, readActiveIdentity, readDirectoryRules, readFarmManifest, readGlobalConfig, readIdentity, readPools, readProfile, readProvider, readRcSelfHostRecord, readUsageSnapshot, realConnectCertStore, realConnectEffects, realRcControlTransport, realRcEventDial, realRcStreamDial, recoverFarm, recoveryDiagnostics, removeDirectoryRule, removeIdentity, removePool, removeProfile, removeProvider, requirePool, resolveAgentShimHome, resolveClaudeHome, resolveDecisions, resolveLayoutPaths, resolveSupervisorConfig, resyncFarm, runCheck, runDoctor, runFrontDoorSupervisor, runLauncher, runSupervisor, servedByPipeline, setAllowAmbientCredential, setDefaultConfigProfile, setGlobalDefaultProfile, setIdentityCredential, setPool, setProfileCategories, setProfileEntries, setProfileLaunchFlags, setProfileMetadata, setRcSessionModel, setRcSessionPermissionMode, snapshotPath, spawnClaude, startConnectServer, topLevelNames, updateDirectoryRule, updateProvider, useIdentity, writeDirectoryRules };
+export type { AddDirectoryRuleOptions, AddProviderInput, AmbientCredentialDetection, AmbientCredentialGuardResult, AmbientCredentialVar, BuildEntryFactsParams, CaMaterial, Candidate, CarryOverParams, CarryOverResult, CategoryMap, CheckReport, CollectCheckReportParams, CollectDoctorReportParams, CompiledRule, ConditionContext, ConfigProfile, ConnectCertStore, ConnectEffects, ConnectLimits, ConnectLocalSurface, ConnectServerConfig, ConnectServerHandle, ConnectTarget, Credential, CredentialSource, Decision, Diagnostic, DirectoryRule, DirectoryRules, DoctorReport, EffectiveWindow, EliminatedRule, EnsureFrontDoorPorts, EnsureHeadroomPorts, EntryFact, EntryFacts, EntryValue, EvaluateAmbientCredentialGuardParams, FlattenedCascade, FrontDoorRcControl, FrontDoorSupervisorPorts, GlobalConfig, HeadroomSupervisorConfig, Identity, IdentityCredentialChange, IdentityListEntry, IdentityListing, InjectedCredential, LaunchPlan, Layer, LayerId, LayoutPaths, LeafCert, PlanClass, Pool, PoolMember, PoolPickReport, PoolRanking, PortableConfig, PrepareClaudeLaunchOptions, PrepareLaunchParams, ProfileListEntry, Provider, ProviderListEntry, RankPoolInput, RcAnswerDecision, RcAnswerDeps, RcApiClient, RcApiDeps, RcApiRouter, RcControlAnswer, RcControlHandlerDeps, RcControlRequestDeps, RcControlTransport, RcCredentialStore, RcDialAnswer, RcDialTarget, RcEventDial, RcEventFanout, RcEventWriteResult, RcExchangeObserver, RcInjectDeps, RcObservedCredential, RcObservedRequest, RcPendingRequestSummary, RcPermissionMode, RcPresenceAnswer, RcSelfHostCredentialRecord, RcSelfHostDeps, RcSelfHostMintResult, RcSelfHostSurface, RcSessionStatus, RcSessionSummary, RcSessionTracker, RcSessionTrackerDeps, RcStreamAnswer, RcStreamDial, RcStreamEnvelope, RcStreamEvent, RcStreamHub, RcStreamHubDeps, RcWorkerFact, RcWriteHeaders, RecoverFarmParams, RecoveryResult, ResolveDecisionsInput, ResolvedState, ResyncFarmParams, ResyncFarmResult, RunCheckParams, RunDoctorParams, RunFrontDoorSupervisorOptions, RunLauncherParams, RunSupervisorOptions, SpawnClaudeParams, SseParsedEvent, StickyPick, SupervisorPorts, UnreadableIdentityListEntry, UpdateDirectoryRuleOptions, UpdateProviderInput, UsageReadFs, UsageSnapshot, WhenCondition, WhenEvaluation };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-shim",
-  "version": "8.11.3",
+  "version": "8.13.0",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",