agent-shim 8.17.0 → 8.18.0

package/README.md

@@ -73,7 +73,7 @@ Sharing composes through a cascade (shipped defaults, then a user-global overrid
 
 `claude` refuses to launch while `ANTHROPIC_API_KEY`, `ANTHROPIC_AUTH_TOKEN`, `CLAUDE_CODE_OAUTH_TOKEN` or a `CLAUDE_CODE_USE_BEDROCK`/`VERTEX`/`FOUNDRY` variable is set in the environment, because those outrank every identity's stored credential and would make all identities authenticate as the same account. Opt in deliberately with `AGENT_SHIM_ALLOW_AMBIENT_CREDENTIAL=1` for one launch or `agent-shim identity set <name> --allow-ambient-credential`.
 
-Providers and identities take their token from one `credential` block: an ordered list of sources (`env`, `file`, `command`, and the `op` and `keychain` presets, plus a `literal` placeholder for a local proxy), tried in turn, and a target (`bearer`, `apiKey`, or `oauthToken` for an identity). The token reaches the child's environment only; `check`, `doctor` and `--json` report the source kind and target, never the value.
+Providers and identities take their token from one `credential` block: an ordered list of sources (`env`, `file`, `command`, and the `op` and `keychain` presets, plus a `literal` placeholder for a local proxy), tried in turn, and a target (`bearer`, `apiKey`, or `oauthToken` for an identity). An identity's token reaches the child's environment only; a provider's never reaches the child at all (the front door attaches it at the provider's route, which is also what lets provider inference and Remote Control share one session). `check`, `doctor` and `--json` report the source kind and target, never the value.
 
 The full mechanics, including the credential block, the merge algorithm, conditional sharing rules (age, size, git branch, environment), the ambient-credential launch guard, and how `~/.claude/projects/` history is pattern-matched, are in [docs/configuration-model.md](docs/configuration-model.md). Worked examples are in [docs/examples.md](docs/examples.md).
 

package/dist/cli.cjs

@@ -55589,7 +55589,7 @@ function ensureHeadroom(params) {
 
 // src/frontdoor/state.ts
 var import_node_path6 = __toESM(require("node:path"), 1);
-var FRONT_DOOR_PROTOCOL = 2;
+var FRONT_DOOR_PROTOCOL = 3;
 var FrontDoorSessionSchema = external_exports.strictObject({ pid: external_exports.number().int().positive(), startedAt: external_exports.number(), token: external_exports.string().min(1) });
 var FrontDoorStateSchema = external_exports.strictObject({
   /**
@@ -61749,7 +61749,7 @@ function registerIdentityCommand(program2, deps) {
 // package.json
 var package_default = {
   name: "agent-shim",
-  version: "8.17.0",
+  version: "8.18.0",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -62124,6 +62124,7 @@ var INTERNAL_HEADER_NAMES = [
   "x-agent-shim-session",
   "x-agent-shim-headroom",
   "x-agent-shim-auth",
+  "x-agent-shim-provider",
   "x-agent-shim-hop",
   "x-agent-shim-hop-id",
   "x-headroom-project-id",
@@ -62131,6 +62132,7 @@ var INTERNAL_HEADER_NAMES = [
 ];
 var IDENTITY_HEADER = "x-agent-shim-identity";
 var SESSION_HEADER = "x-agent-shim-session";
+var PROVIDER_HEADER = "x-agent-shim-provider";
 var HEADROOM_FLAG_HEADER = "x-agent-shim-headroom";
 var PROJECT_ID_HEADER = "x-headroom-project-id";
 var HEADROOM_BASE_URL_HEADER = "x-headroom-base-url";
@@ -62166,6 +62168,7 @@ function identifyRequest(headers) {
     session: {
       identity: internalHeaderValue(headers, IDENTITY_HEADER),
       sessionId: internalHeaderValue(headers, SESSION_HEADER),
+      provider: internalHeaderValue(headers, PROVIDER_HEADER),
       headroom: internalHeaderValue(headers, HEADROOM_FLAG_HEADER) === "1",
       projectId: internalHeaderValue(headers, PROJECT_ID_HEADER)
     },
@@ -62173,9 +62176,6 @@ function identifyRequest(headers) {
   };
 }
 var PROVIDER_PATH_PREFIX = "/providers/";
-function providerBaseUrl(port, provider) {
-  return `https://127.0.0.1:${String(port)}${PROVIDER_PATH_PREFIX}${encodeURIComponent(provider)}`;
-}
 function directOrigin(port) {
   return `http://127.0.0.1:${String(port)}`;
 }
@@ -65050,7 +65050,7 @@ function admitHop(hopSecret, custody) {
       return { ok: false, message: "agent-shim front door: the direct listener serves only this door's own headroom hop" };
     }
     const hopId = singleValue(request7.headers[HOP_ID_HEADER]);
-    const provider = parseProviderPath(new URL(request7.url, "http://127.0.0.1").pathname)?.provider;
+    const provider = parseProviderPath(new URL(request7.url, "http://127.0.0.1").pathname)?.provider ?? internalHeaderValue(request7.headers, PROVIDER_HEADER);
     const credentials = hopId === void 0 || provider === void 0 ? void 0 : custody.redeem(hopId, provider);
     if (credentials === void 0) {
       return { ok: false, message: "agent-shim front door: this request names no live headroom hop for its provider" };
@@ -67820,7 +67820,7 @@ function pushProvider(push, entry, cacheEnv, signIn) {
   const cache = cacheClause(cacheEnv, `provider ${entry.name}`, validated2.data.credential);
   push("provider", cache.unreadable ? "fail" : "pass", `${entry.name} is valid (${describeProviderEndpoint(validated2.data)}, credential ${describeCredential(validated2.data.credential)})${cache.text}.`, entry.name);
   if (validated2.data.env?.ENABLE_TOOL_SEARCH === void 0) {
-    push("provider", "warn", `${entry.name} does not set ENABLE_TOOL_SEARCH: a session on this provider loads MCP tools upfront rather than deferring them, because its base URL is the front door, which Claude Code treats as a non-first-party host. Set ENABLE_TOOL_SEARCH in the provider's env block to restore deferred loading, when the upstream backend supports the tool_reference payloads it sends.`, entry.name);
+    push("provider", "warn", `${entry.name} does not set ENABLE_TOOL_SEARCH: a session on this provider keeps Claude Code's own API as its base URL, so it defers MCP tool loading and sends tool_reference payloads the upstream backend must understand. Set ENABLE_TOOL_SEARCH=false in the provider's env block to load tools upfront instead, when the backend does not support them.`, entry.name);
   }
   if (signIn !== void 0 && isCodexProvider(validated2.data) && validated2.data.codex?.login === "chatgpt-sign-in") {
     const problem = signInProblem(signIn);
@@ -72125,7 +72125,7 @@ async function applyHeadroomHop(request7, response, upstream, deps) {
   let headers = forwardableHeaders(request7.headers);
   let hopId;
   if (upstream !== void 0) {
-    const provider = parseProviderPath(new URL(request7.url, "http://127.0.0.1").pathname)?.provider;
+    const provider = parseProviderPath(new URL(request7.url, "http://127.0.0.1").pathname)?.provider ?? request7.session.provider;
     if (provider === void 0) {
       throw new Error(`headroom hop for ${request7.url} names an upstream but no provider`);
     }
@@ -72135,6 +72135,9 @@ async function applyHeadroomHop(request7, response, upstream, deps) {
     headers[HOP_ID_HEADER] = hopId;
     headers[HEADROOM_BASE_URL_HEADER] = upstream;
   }
+  if (request7.session.provider !== void 0) {
+    headers[PROVIDER_HEADER] = request7.session.provider;
+  }
   if (request7.session.projectId !== void 0) {
     headers[PROJECT_ID_HEADER] = request7.session.projectId;
   }
@@ -73289,6 +73292,9 @@ function createProviderRouteResolver(deps) {
       if (deps.rcSelfHostRoute !== void 0 && isRcSelfHostPath(path44)) {
         return { ok: true, route: deps.rcSelfHostRoute };
       }
+      if (request7.session.provider !== void 0 && path44.startsWith("/v1/") && !isRcSelfHostPath(path44)) {
+        return resolve({ ...request7, url: `${PROVIDER_PATH_PREFIX}${encodeURIComponent(request7.session.provider)}${request7.url}` });
+      }
       return path44.startsWith("/v1/") ? { ok: true, route: oauthRoute } : { ok: false, status: HTTP_STATUS.notFound, message: `no such endpoint: ${path44}` };
     }
     const { provider } = scoped;
@@ -73318,15 +73324,40 @@ function createProviderRouteResolver(deps) {
     const httpProvider = definition;
     return {
       ok: true,
-      route: passthroughFor(`http:${provider}`, {
-        baseUrl: httpProvider.baseUrl,
-        stripPrefix: `${PROVIDER_PATH_PREFIX}${encodeURIComponent(provider)}`,
-        headroomUpstream: directOrigin(deps.directPort())
-      })
+      route: attachingProviderCredential(
+        passthroughFor(`http:${provider}`, {
+          baseUrl: httpProvider.baseUrl,
+          stripPrefix: `${PROVIDER_PATH_PREFIX}${encodeURIComponent(provider)}`,
+          headroomUpstream: directOrigin(deps.directPort())
+        }),
+        { provider, credential: httpProvider.credential, env: deps.env, port: deps.credentials }
+      )
     };
   };
   return async (request7) => await Promise.resolve(resolve(request7));
 }
+function providerCredentialHeaders(credential) {
+  return credential.target === "apiKey" ? { "x-api-key": credential.token } : { authorization: `Bearer ${credential.token}` };
+}
+function attachingProviderCredential(route, deps) {
+  return {
+    name: route.name,
+    headroomEligible: route.headroomEligible,
+    headroomUpstream: route.headroomUpstream,
+    serve: async (request7, response) => {
+      const resolution = resolveCredential({ credential: deps.credential, env: deps.env, port: deps.port, subject: `provider ${deps.provider}` });
+      if (!resolution.ok) {
+        response.start(HTTP_STATUS.badGateway, { "Content-Type": "application/json" });
+        await response.write(
+          JSON.stringify({ type: "error", error: { type: "api_error", message: `provider ${deps.provider} has no usable credential for the front door to attach: ${resolution.message}` } })
+        );
+        response.end();
+        return;
+      }
+      await route.serve({ ...request7, headers: restoreCredentials(request7.headers, providerCredentialHeaders(resolution.credential)) }, response);
+    }
+  };
+}
 
 // src/frontdoor/rcCredentialStore.ts
 var import_node_path34 = __toESM(require("node:path"), 1);
@@ -73716,6 +73747,7 @@ function startPage(heldToken) {
   refreshPending();
   window.setInterval(function () { refreshSessions(); refreshPending(); }, 4000);
   runFeed();
+  document.getElementById('door-state').textContent = 'connected';
 }
 
 function boot() {
@@ -73790,7 +73822,7 @@ var RC_CLIENT_PAGE_HTML = `<!doctype html>
 <body data-agent-shim-rc-client>
 <header>
   <h1>agent-shim Remote Control</h1>
-  <span class="state" id="door-state">not connected</span>
+  <span class="state" id="door-state">connecting</span>
   <span class="state" id="stream-state"></span>
 </header>
 <div id="token-form">
@@ -75238,7 +75270,16 @@ function realFrontDoorSupervisorPorts(paths) {
   });
   const rcControlToken = (0, import_node_crypto14.randomUUID)();
   const resolveRoute = rcObservingResolver(
-    createProviderRouteResolver({ fs: realFsPort, providersDir: paths.providersDir, codexPorts, directPort: () => directPort, ...rcSelfHostSurface === void 0 ? {} : { rcSelfHostRoute: rcSelfHostSurface.route } }),
+    createProviderRouteResolver({
+      fs: realFsPort,
+      providersDir: paths.providersDir,
+      codexPorts,
+      directPort: () => directPort,
+      // The same port (cache included) the launcher resolves a launch's provider with, so the credential the door attaches at the route and the one the launcher handed the child are the same resolution of the same block.
+      env: process.env,
+      credentials: { ...realCredentialPort, cache: realCredentialCacheEnv(paths) },
+      ...rcSelfHostSurface === void 0 ? {} : { rcSelfHostRoute: rcSelfHostSurface.route }
+    }),
     rcTracker,
     rcHub
   );
@@ -77467,15 +77508,6 @@ function buildFlagArgs(flags) {
 function buildArgv(params) {
   return [...params.toolFlags, ...params.extraFlags, ...params.passthrough];
 }
-var LOOPBACK_HOSTS = ["127.0.0.1", "localhost", "::1"];
-function isLoopbackUrl(baseUrl) {
-  const host = new URL(baseUrl).hostname.replace(/^\[|\]$/g, "");
-  return LOOPBACK_HOSTS.some((loopback) => loopback === host);
-}
-function withLoopbackHosts(existing) {
-  const listed = (existing ?? "").split(",").map((entry) => entry.trim()).filter((entry) => entry !== "");
-  return [...listed, ...LOOPBACK_HOSTS.filter((host) => !listed.includes(host))].join(",");
-}
 function buildEnv(params) {
   const env = { ...params.baseEnv };
   const parentCustomHeaders = params.baseEnv.ANTHROPIC_CUSTOM_HEADERS;
@@ -77486,19 +77518,18 @@ function buildEnv(params) {
   if (params.provider !== void 0) {
     const providerEnv = params.provider.definition.env ?? {};
     providerCustomHeaders = providerEnv.ANTHROPIC_CUSTOM_HEADERS;
-    env.ANTHROPIC_BASE_URL = params.provider.baseUrl;
-    if (isLoopbackUrl(params.provider.baseUrl)) {
-      env.NO_PROXY = withLoopbackHosts(params.baseEnv.NO_PROXY);
-      env.no_proxy = withLoopbackHosts(params.baseEnv.no_proxy);
-    }
+    env.ANTHROPIC_BASE_URL = void 0;
     env.AGENT_SHIM_PROVIDER = params.provider.definition.displayName;
     for (const [key, value2] of Object.entries(providerEnv)) {
       env[key] = value2;
     }
   }
-  const credential = params.provider?.credential ?? params.identityCredential;
-  if (credential !== void 0) {
-    for (const [variable, value2] of Object.entries(credentialVariables(credential.target, credential.token))) {
+  if (params.provider !== void 0) {
+    env.ANTHROPIC_AUTH_TOKEN = void 0;
+    env.ANTHROPIC_API_KEY = void 0;
+    env.CLAUDE_CODE_OAUTH_TOKEN = void 0;
+  } else if (params.identityCredential !== void 0) {
+    for (const [variable, value2] of Object.entries(credentialVariables(params.identityCredential.target, params.identityCredential.token))) {
       env[variable] = value2;
     }
   }
@@ -77512,6 +77543,7 @@ function buildEnv(params) {
         ...params.resolvedIdentityName === void 0 ? [] : [{ name: IDENTITY_HEADER, value: params.resolvedIdentityName }],
         { name: SESSION_HEADER, value: params.sessionId },
         { name: AUTH_HEADER, value: params.frontdoor.sessionToken },
+        ...params.provider === void 0 ? [] : [{ name: PROVIDER_HEADER, value: params.provider.name }],
         ...params.headroom === void 0 ? [] : [
           { name: HEADROOM_FLAG_HEADER, value: "1" },
           { name: PROJECT_ID_HEADER, value: params.headroom.projectId }
@@ -77519,9 +77551,7 @@ function buildEnv(params) {
       ]
     );
     env.NODE_EXTRA_CA_CERTS = params.frontdoor.trustBundlePath;
-    if (params.provider === void 0) {
-      env.HTTPS_PROXY = connectProxyUrl(params.frontdoor.connectPort, params.frontdoor.sessionToken);
-    }
+    env.HTTPS_PROXY = connectProxyUrl(params.frontdoor.connectPort, params.frontdoor.sessionToken);
   }
   return env;
 }
@@ -77796,10 +77826,6 @@ function prepareLaunch(params) {
   if (frontDoor?.trustWarning !== void 0) {
     log.warn(frontDoor.trustWarning);
   }
-  let routedProvider;
-  if (resolvedProvider !== void 0 && frontDoor !== void 0) {
-    routedProvider = { ...resolvedProvider, baseUrl: providerBaseUrl(frontDoor.port, resolvedProvider.name) };
-  }
   let headroom;
   const headroomPort = params.headroom;
   if (resolvedFlags.headroom && headroomPort !== void 0) {
@@ -77823,7 +77849,7 @@ function prepareLaunch(params) {
     configDirEscapeHatch: configDirEscapeHatchApplies,
     resolvedIdentityName: identityDecision.name,
     identitiesDir: paths.identitiesDir,
-    ...routedProvider === void 0 ? {} : { provider: routedProvider },
+    ...resolvedProvider === void 0 ? {} : { provider: resolvedProvider },
     ...identityCredential === void 0 ? {} : { identityCredential },
     ...frontDoor === void 0 ? {} : { frontdoor: frontDoor },
     ...headroom === void 0 ? {} : { headroom },

package/dist/index.cjs

@@ -2852,18 +2852,15 @@ function isLiveCapability(presented, live) {
 // src/frontdoor/route.ts
 var IDENTITY_HEADER = "x-agent-shim-identity";
 var SESSION_HEADER = "x-agent-shim-session";
+var PROVIDER_HEADER = "x-agent-shim-provider";
 var HEADROOM_FLAG_HEADER = "x-agent-shim-headroom";
 var PROJECT_ID_HEADER = "x-headroom-project-id";
 var AUTH_HEADER = "x-agent-shim-auth";
-var PROVIDER_PATH_PREFIX = "/providers/";
-function providerBaseUrl(port, provider) {
-  return `https://127.0.0.1:${String(port)}${PROVIDER_PATH_PREFIX}${encodeURIComponent(provider)}`;
-}
 
 // src/frontdoor/state.ts
 var import_node_path8 = __toESM(require("node:path"), 1);
 var import_zod3 = require("zod");
-var FRONT_DOOR_PROTOCOL = 2;
+var FRONT_DOOR_PROTOCOL = 3;
 var FrontDoorSessionSchema = import_zod3.z.strictObject({ pid: import_zod3.z.number().int().positive(), startedAt: import_zod3.z.number(), token: import_zod3.z.string().min(1) });
 var FrontDoorStateSchema = import_zod3.z.strictObject({
   /**
@@ -9118,7 +9115,7 @@ function pushProvider(push, entry, cacheEnv, signIn) {
   const cache = cacheClause(cacheEnv, `provider ${entry.name}`, validated2.data.credential);
   push("provider", cache.unreadable ? "fail" : "pass", `${entry.name} is valid (${describeProviderEndpoint(validated2.data)}, credential ${describeCredential(validated2.data.credential)})${cache.text}.`, entry.name);
   if (validated2.data.env?.ENABLE_TOOL_SEARCH === void 0) {
-    push("provider", "warn", `${entry.name} does not set ENABLE_TOOL_SEARCH: a session on this provider loads MCP tools upfront rather than deferring them, because its base URL is the front door, which Claude Code treats as a non-first-party host. Set ENABLE_TOOL_SEARCH in the provider's env block to restore deferred loading, when the upstream backend supports the tool_reference payloads it sends.`, entry.name);
+    push("provider", "warn", `${entry.name} does not set ENABLE_TOOL_SEARCH: a session on this provider keeps Claude Code's own API as its base URL, so it defers MCP tool loading and sends tool_reference payloads the upstream backend must understand. Set ENABLE_TOOL_SEARCH=false in the provider's env block to load tools upfront instead, when the backend does not support them.`, entry.name);
   }
   if (signIn !== void 0 && isCodexProvider(validated2.data) && validated2.data.codex?.login === "chatgpt-sign-in") {
     const problem = signInProblem(signIn);
@@ -11339,15 +11336,6 @@ function buildFlagArgs(flags) {
 function buildArgv(params) {
   return [...params.toolFlags, ...params.extraFlags, ...params.passthrough];
 }
-var LOOPBACK_HOSTS = ["127.0.0.1", "localhost", "::1"];
-function isLoopbackUrl(baseUrl) {
-  const host = new URL(baseUrl).hostname.replace(/^\[|\]$/g, "");
-  return LOOPBACK_HOSTS.some((loopback) => loopback === host);
-}
-function withLoopbackHosts(existing) {
-  const listed = (existing ?? "").split(",").map((entry) => entry.trim()).filter((entry) => entry !== "");
-  return [...listed, ...LOOPBACK_HOSTS.filter((host) => !listed.includes(host))].join(",");
-}
 function buildEnv(params) {
   const env = { ...params.baseEnv };
   const parentCustomHeaders = params.baseEnv.ANTHROPIC_CUSTOM_HEADERS;
@@ -11358,19 +11346,18 @@ function buildEnv(params) {
   if (params.provider !== void 0) {
     const providerEnv = params.provider.definition.env ?? {};
     providerCustomHeaders = providerEnv.ANTHROPIC_CUSTOM_HEADERS;
-    env.ANTHROPIC_BASE_URL = params.provider.baseUrl;
-    if (isLoopbackUrl(params.provider.baseUrl)) {
-      env.NO_PROXY = withLoopbackHosts(params.baseEnv.NO_PROXY);
-      env.no_proxy = withLoopbackHosts(params.baseEnv.no_proxy);
-    }
+    env.ANTHROPIC_BASE_URL = void 0;
     env.AGENT_SHIM_PROVIDER = params.provider.definition.displayName;
     for (const [key, value] of Object.entries(providerEnv)) {
       env[key] = value;
     }
   }
-  const credential = params.provider?.credential ?? params.identityCredential;
-  if (credential !== void 0) {
-    for (const [variable, value] of Object.entries(credentialVariables(credential.target, credential.token))) {
+  if (params.provider !== void 0) {
+    env.ANTHROPIC_AUTH_TOKEN = void 0;
+    env.ANTHROPIC_API_KEY = void 0;
+    env.CLAUDE_CODE_OAUTH_TOKEN = void 0;
+  } else if (params.identityCredential !== void 0) {
+    for (const [variable, value] of Object.entries(credentialVariables(params.identityCredential.target, params.identityCredential.token))) {
       env[variable] = value;
     }
   }
@@ -11384,6 +11371,7 @@ function buildEnv(params) {
         ...params.resolvedIdentityName === void 0 ? [] : [{ name: IDENTITY_HEADER, value: params.resolvedIdentityName }],
         { name: SESSION_HEADER, value: params.sessionId },
         { name: AUTH_HEADER, value: params.frontdoor.sessionToken },
+        ...params.provider === void 0 ? [] : [{ name: PROVIDER_HEADER, value: params.provider.name }],
         ...params.headroom === void 0 ? [] : [
           { name: HEADROOM_FLAG_HEADER, value: "1" },
           { name: PROJECT_ID_HEADER, value: params.headroom.projectId }
@@ -11391,9 +11379,7 @@ function buildEnv(params) {
       ]
     );
     env.NODE_EXTRA_CA_CERTS = params.frontdoor.trustBundlePath;
-    if (params.provider === void 0) {
-      env.HTTPS_PROXY = connectProxyUrl(params.frontdoor.connectPort, params.frontdoor.sessionToken);
-    }
+    env.HTTPS_PROXY = connectProxyUrl(params.frontdoor.connectPort, params.frontdoor.sessionToken);
   }
   return env;
 }
@@ -11668,10 +11654,6 @@ function prepareLaunch(params) {
   if (frontDoor?.trustWarning !== void 0) {
     log.warn(frontDoor.trustWarning);
   }
-  let routedProvider;
-  if (resolvedProvider !== void 0 && frontDoor !== void 0) {
-    routedProvider = { ...resolvedProvider, baseUrl: providerBaseUrl(frontDoor.port, resolvedProvider.name) };
-  }
   let headroom;
   const headroomPort = params.headroom;
   if (resolvedFlags.headroom && headroomPort !== void 0) {
@@ -11695,7 +11677,7 @@ function prepareLaunch(params) {
     configDirEscapeHatch: configDirEscapeHatchApplies,
     resolvedIdentityName: identityDecision.name,
     identitiesDir: paths.identitiesDir,
-    ...routedProvider === void 0 ? {} : { provider: routedProvider },
+    ...resolvedProvider === void 0 ? {} : { provider: resolvedProvider },
     ...identityCredential === void 0 ? {} : { identityCredential },
     ...frontDoor === void 0 ? {} : { frontdoor: frontDoor },
     ...headroom === void 0 ? {} : { headroom },

package/dist/index.mjs

@@ -2588,18 +2588,15 @@ function isLiveCapability(presented, live) {
 // src/frontdoor/route.ts
 var IDENTITY_HEADER = "x-agent-shim-identity";
 var SESSION_HEADER = "x-agent-shim-session";
+var PROVIDER_HEADER = "x-agent-shim-provider";
 var HEADROOM_FLAG_HEADER = "x-agent-shim-headroom";
 var PROJECT_ID_HEADER = "x-headroom-project-id";
 var AUTH_HEADER = "x-agent-shim-auth";
-var PROVIDER_PATH_PREFIX = "/providers/";
-function providerBaseUrl(port, provider) {
-  return `https://127.0.0.1:${String(port)}${PROVIDER_PATH_PREFIX}${encodeURIComponent(provider)}`;
-}
 
 // src/frontdoor/state.ts
 import path8 from "node:path";
 import { z as z3 } from "zod";
-var FRONT_DOOR_PROTOCOL = 2;
+var FRONT_DOOR_PROTOCOL = 3;
 var FrontDoorSessionSchema = z3.strictObject({ pid: z3.number().int().positive(), startedAt: z3.number(), token: z3.string().min(1) });
 var FrontDoorStateSchema = z3.strictObject({
   /**
@@ -8854,7 +8851,7 @@ function pushProvider(push, entry, cacheEnv, signIn) {
   const cache = cacheClause(cacheEnv, `provider ${entry.name}`, validated2.data.credential);
   push("provider", cache.unreadable ? "fail" : "pass", `${entry.name} is valid (${describeProviderEndpoint(validated2.data)}, credential ${describeCredential(validated2.data.credential)})${cache.text}.`, entry.name);
   if (validated2.data.env?.ENABLE_TOOL_SEARCH === void 0) {
-    push("provider", "warn", `${entry.name} does not set ENABLE_TOOL_SEARCH: a session on this provider loads MCP tools upfront rather than deferring them, because its base URL is the front door, which Claude Code treats as a non-first-party host. Set ENABLE_TOOL_SEARCH in the provider's env block to restore deferred loading, when the upstream backend supports the tool_reference payloads it sends.`, entry.name);
+    push("provider", "warn", `${entry.name} does not set ENABLE_TOOL_SEARCH: a session on this provider keeps Claude Code's own API as its base URL, so it defers MCP tool loading and sends tool_reference payloads the upstream backend must understand. Set ENABLE_TOOL_SEARCH=false in the provider's env block to load tools upfront instead, when the backend does not support them.`, entry.name);
   }
   if (signIn !== void 0 && isCodexProvider(validated2.data) && validated2.data.codex?.login === "chatgpt-sign-in") {
     const problem = signInProblem(signIn);
@@ -11075,15 +11072,6 @@ function buildFlagArgs(flags) {
 function buildArgv(params) {
   return [...params.toolFlags, ...params.extraFlags, ...params.passthrough];
 }
-var LOOPBACK_HOSTS = ["127.0.0.1", "localhost", "::1"];
-function isLoopbackUrl(baseUrl) {
-  const host = new URL(baseUrl).hostname.replace(/^\[|\]$/g, "");
-  return LOOPBACK_HOSTS.some((loopback) => loopback === host);
-}
-function withLoopbackHosts(existing) {
-  const listed = (existing ?? "").split(",").map((entry) => entry.trim()).filter((entry) => entry !== "");
-  return [...listed, ...LOOPBACK_HOSTS.filter((host) => !listed.includes(host))].join(",");
-}
 function buildEnv(params) {
   const env = { ...params.baseEnv };
   const parentCustomHeaders = params.baseEnv.ANTHROPIC_CUSTOM_HEADERS;
@@ -11094,19 +11082,18 @@ function buildEnv(params) {
   if (params.provider !== void 0) {
     const providerEnv = params.provider.definition.env ?? {};
     providerCustomHeaders = providerEnv.ANTHROPIC_CUSTOM_HEADERS;
-    env.ANTHROPIC_BASE_URL = params.provider.baseUrl;
-    if (isLoopbackUrl(params.provider.baseUrl)) {
-      env.NO_PROXY = withLoopbackHosts(params.baseEnv.NO_PROXY);
-      env.no_proxy = withLoopbackHosts(params.baseEnv.no_proxy);
-    }
+    env.ANTHROPIC_BASE_URL = void 0;
     env.AGENT_SHIM_PROVIDER = params.provider.definition.displayName;
     for (const [key, value] of Object.entries(providerEnv)) {
       env[key] = value;
     }
   }
-  const credential = params.provider?.credential ?? params.identityCredential;
-  if (credential !== void 0) {
-    for (const [variable, value] of Object.entries(credentialVariables(credential.target, credential.token))) {
+  if (params.provider !== void 0) {
+    env.ANTHROPIC_AUTH_TOKEN = void 0;
+    env.ANTHROPIC_API_KEY = void 0;
+    env.CLAUDE_CODE_OAUTH_TOKEN = void 0;
+  } else if (params.identityCredential !== void 0) {
+    for (const [variable, value] of Object.entries(credentialVariables(params.identityCredential.target, params.identityCredential.token))) {
       env[variable] = value;
     }
   }
@@ -11120,6 +11107,7 @@ function buildEnv(params) {
         ...params.resolvedIdentityName === void 0 ? [] : [{ name: IDENTITY_HEADER, value: params.resolvedIdentityName }],
         { name: SESSION_HEADER, value: params.sessionId },
         { name: AUTH_HEADER, value: params.frontdoor.sessionToken },
+        ...params.provider === void 0 ? [] : [{ name: PROVIDER_HEADER, value: params.provider.name }],
         ...params.headroom === void 0 ? [] : [
           { name: HEADROOM_FLAG_HEADER, value: "1" },
           { name: PROJECT_ID_HEADER, value: params.headroom.projectId }
@@ -11127,9 +11115,7 @@ function buildEnv(params) {
       ]
     );
     env.NODE_EXTRA_CA_CERTS = params.frontdoor.trustBundlePath;
-    if (params.provider === void 0) {
-      env.HTTPS_PROXY = connectProxyUrl(params.frontdoor.connectPort, params.frontdoor.sessionToken);
-    }
+    env.HTTPS_PROXY = connectProxyUrl(params.frontdoor.connectPort, params.frontdoor.sessionToken);
   }
   return env;
 }
@@ -11404,10 +11390,6 @@ function prepareLaunch(params) {
   if (frontDoor?.trustWarning !== void 0) {
     log.warn(frontDoor.trustWarning);
   }
-  let routedProvider;
-  if (resolvedProvider !== void 0 && frontDoor !== void 0) {
-    routedProvider = { ...resolvedProvider, baseUrl: providerBaseUrl(frontDoor.port, resolvedProvider.name) };
-  }
   let headroom;
   const headroomPort = params.headroom;
   if (resolvedFlags.headroom && headroomPort !== void 0) {
@@ -11431,7 +11413,7 @@ function prepareLaunch(params) {
     configDirEscapeHatch: configDirEscapeHatchApplies,
     resolvedIdentityName: identityDecision.name,
     identitiesDir: paths.identitiesDir,
-    ...routedProvider === void 0 ? {} : { provider: routedProvider },
+    ...resolvedProvider === void 0 ? {} : { provider: resolvedProvider },
     ...identityCredential === void 0 ? {} : { identityCredential },
     ...frontDoor === void 0 ? {} : { frontdoor: frontDoor },
     ...headroom === void 0 ? {} : { headroom },

package/dist/types/index.d.ts

@@ -1687,6 +1687,8 @@ interface SessionIdentity {
     readonly identity: string | undefined;
     /** The per-launch session id, when the launcher injected one. */
     readonly sessionId: string | undefined;
+    /** The provider this launch selected, when it selected one: the door routes the session's API traffic to that provider whatever host the child believes it is dialling. */
+    readonly provider: string | undefined;
     /** Whether this launch resolved headroom on, so its requests must pass through the headroom hop before their route. */
     readonly headroom: boolean;
     /** The project identity headroom scopes memory to, re-set on the headroom hop and sent nowhere else. */
@@ -2832,7 +2834,7 @@ interface EvaluateAmbientCredentialGuardParams {
     /** The active identity's name, for the message's persistent-opt-in command. Undefined when no identity is known. */
     readonly identityName?: string;
     /**
-     * True when this launch routes through an API provider. The guard inspects the PARENT environment, before `buildEnv` runs; a provider launch has its `ANTHROPIC_AUTH_TOKEN` injected and its `ANTHROPIC_API_KEY` cleared by `buildEnv` itself, so an ambient credential in the parent environment never reaches the child and there is nothing left for this guard to protect against. Everything else about the guard (including `IdentitySchema.allowAmbientCredential`) is unchanged by this flag.
+     * True when this launch routes through an API provider. The guard inspects the PARENT environment, before `buildEnv` runs; a provider launch has every credential variable removed by `buildEnv` itself (the door attaches the provider's credential at its route, so the child presents nothing), so an ambient credential in the parent environment never reaches the child and there is nothing left for this guard to protect against. Everything else about the guard (including `IdentitySchema.allowAmbientCredential`) is unchanged by this flag.
      */
     readonly providerSelected?: boolean;
     /** The launching identity's own credential, when its credential block resolved: see `detectAmbientCredential`. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-shim",
-  "version": "8.17.0",
+  "version": "8.18.0",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",