agent-shim 8.2.0 → 8.3.0

package/dist/types/index.d.ts

@@ -692,6 +692,10 @@ interface LayoutPaths {
     readonly frontdoorStateFile: string;
     /** Path to the exclusive-create marker guarding "who spawns the front-door supervisor" so concurrent launches start at most one. */
     readonly frontdoorLockFile: string;
+    /**
+     * Path to the serving door's control token, mode 0600: the random bearer capability this generation's Remote Control control routes demand, rewritten on every door start. Only its owner can read it, which is what authenticates a CLI invocation to the door that minted it.
+     */
+    readonly frontdoorControlTokenFile: string;
     /** Directory holding one `<launcher-pid>.json` session-registry entry per live launch routed through the front door. */
     readonly frontdoorSessionsDir: string;
     /** Path to the front door's log: one line per lifecycle event and routed failure, never a token. */
@@ -1594,8 +1598,233 @@ declare function realConnectCertStore(paths: {
     readonly frontdoorCaKeyFile: string;
 }): ConnectCertStore;
 
+/** What the identity step learned about one request from the launcher-injected headers. */
+interface SessionIdentity {
+    /** The identity name the launch resolved, when it resolved one. */
+    readonly identity: string | undefined;
+    /** The per-launch session id, when the launcher injected one. */
+    readonly sessionId: string | undefined;
+    /** Whether this launch resolved headroom on, so its requests must pass through the headroom hop before their route. */
+    readonly headroom: boolean;
+    /** The project identity headroom scopes memory to, re-set on the headroom hop and sent nowhere else. */
+    readonly projectId: string | undefined;
+}
+/** One request as a route sees it: the transport's own request and abort signal, plus what the identity step resolved. */
+interface RoutedRequest {
+    readonly method: string;
+    /** The request target exactly as received, path and query together. */
+    readonly url: string;
+    /** The request's headers with every internal header already stripped: exactly what a route may forward onwards. */
+    readonly headers: IncomingHttpHeaders;
+    /** The request's body stream: a route either pipes it onward untouched or reads it whole, never both. */
+    readonly body: IncomingMessage;
+    /** Aborted the moment the client goes away; a route aborts its own upstream work with it. */
+    readonly signal: AbortSignal;
+    readonly session: SessionIdentity;
+}
+/** The response half a route writes through, so the pipeline can run response middleware at the head and apply backpressure uniformly. */
+interface RoutedResponse {
+    /** Whether the head has already been written. */
+    readonly headersSent: boolean;
+    /** Writes the response head, running every response observer first. Must be called exactly once, before any write. */
+    readonly start: (status: number, headers: Readonly<Record<string, string>>) => void;
+    /** Sends the head on its way before any body chunk exists: a streaming response's client should see its headers the moment they are known. */
+    readonly flush: () => void;
+    /**
+     * Writes one body chunk, waiting for the socket to take it when the client is slow (backpressure: a slow client slows the route, and its upstream, instead of growing a buffer without bound). Resolves early, without writing, once the client is gone.
+     */
+    readonly write: (chunk: string | Uint8Array) => Promise<void>;
+    /** Ends the response. */
+    readonly end: () => void;
+    /** Drops the connection: an upstream failure after the head went out, where no status can be sent any more. */
+    readonly destroy: () => void;
+}
+/** One pluggable destination the front door routes a request to. */
+interface FrontDoorRoute {
+    /** The route's name, for logs and for response middleware context. */
+    readonly name: string;
+    /**
+     * Whether the headroom hop may sit in front of this route. Headroom needs the Anthropic-shaped request, so a protocol translator built on an Anthropic-compatible surface opts in, and a route whose request shape headroom could not understand opts out.
+     */
+    readonly headroomEligible: boolean;
+    /**
+     * The upstream headroom is told to use (its per-request base URL header) when the hop sits in front of this route. When defined it is always this door's direct listener, which is what lets the hop keep the route's credential in custody and the direct listener restore it; a route must never name any other address here. Undefined leaves headroom's own default upstream in charge, which is Claude Code's API.
+     */
+    readonly headroomUpstream: string | undefined;
+    /**
+     * Serves the request directly: headroom has already been applied, or does not apply to this route. Writes the response through `response` and resolves once the response has ended.
+     */
+    readonly serve: (request: RoutedRequest, response: RoutedResponse) => Promise<void>;
+}
+
+/**
+ * Remote Control session tracking and prompt injection: the front door's record of the `cse_` sessions whose traffic crosses its terminated API-host session, and the client-half write that delivers a prompt to one of them.
+ *
+ * The tracker is observational: the door already terminates the API host's TLS, so it sees the CLI's own `POST /v1/code/sessions` (whose answer carries the new session's `cse_` id) and every recurring `/v1/code/sessions/...` call (heartbeat, presence), each carrying the session's Authorization bearer and the protocol headers a client-half replay needs. Per session the tracker retains the latest of each, because those calls recur and the freshest value is the live one. Everything is held in this process's memory only: nothing here is written to a log, to the capture, or to disk, and the summary the control surface lists never includes the credential. The capture's existing redaction is untouched; a capture and this tracker observe the same exchanges through entirely separate paths.
+ *
+ * Injection replays the protocol's documented client half rather than splicing frames into any relayed stream: `POST /v1/code/sessions/{id}/events` with one user-message payload event, authenticated by the observed bearer and the observed protocol headers, sent from the door over its own interception-proof dials. Sequence numbers therefore come from the real service and the event is mirrored to every attached client, exactly as a message typed into claude.ai would be.
+ */
+/** Every Remote Control exchange on the API host sits under this path prefix. */
+declare const RC_SESSIONS_PATH_PREFIX = "/v1/code/sessions";
+/**
+ * How long an entry survives without any observed exchange for its session. Derived from the protocol's own liveness, not chosen: the worker heartbeats every 20 s (the `current_interval_seconds` our own captured heartbeat body carries), so a live session produces observable traffic at least that often, and the transport's documented liveness bound is the 45 s stream timeout, which outlasts two missed heartbeat intervals (40 s) precisely so a momentarily quiet session is not dropped. An entry idle past 45 s therefore names a session the protocol itself has given up on, which makes 45 s the exact bound where retaining it stops describing anything live.
+ */
+declare const RC_IDLE_EXPIRY_MS = 45000;
+/** One observed session as the control surface lists it: the identification and timing only, never the credential. */
+interface RcSessionSummary {
+    readonly id: string;
+    /** When the session's create exchange completed, in epoch milliseconds from the injected clock. */
+    readonly createdAt: number;
+    /** When traffic for this session was last observed, in epoch milliseconds from the injected clock. */
+    readonly lastSeenAt: number;
+}
+/** The request facts one observed exchange arrives with. */
+interface RcObservedRequest {
+    readonly method?: string;
+    readonly url?: string;
+    readonly headers: Readonly<IncomingHttpHeaders>;
+}
+/** What one observed exchange's response drives, in arrival order: the head, each body chunk, then the end exactly once. */
+interface RcExchangeObserver {
+    readonly onResponse: (status: number, headers: Readonly<IncomingHttpHeaders>) => void;
+    readonly onBodyChunk: (chunk: Uint8Array) => void;
+    readonly onEnd: () => void;
+}
+/** Everything the tracker needs, injected so its decisions and lifecycle run against fakes in unit tests. */
+interface RcSessionTrackerDeps {
+    readonly now: () => number;
+    /** How long an entry may sit unobserved before it is expired; production passes `RC_IDLE_EXPIRY_MS`, tests pass small values so a deadline is reached in milliseconds. */
+    readonly idleMs: number;
+}
+/** The live record of observed Remote Control sessions. */
+interface RcSessionTracker {
+    /** Feeds one request/response exchange in: returns the observer its response drives when the request belongs to the Remote Control surface, or undefined when it does not, in which case nothing is retained and the response needs no observing. */
+    readonly observeExchange: (request: RcObservedRequest) => RcExchangeObserver | undefined;
+    /** Every live entry, idle ones expired first, sorted oldest-created first. */
+    readonly list: () => readonly RcSessionSummary[];
+    /** The observed credential and protocol headers for one session, the inject path's accessor: present only while the session is tracked, and never surfaced anywhere a summary, log or capture goes. */
+    readonly credentialOf: (sessionId: string) => RcObservedCredential | undefined;
+    /** Stops the idle sweep timer. The entries themselves are unreachable the moment the door drops them. */
+    readonly close: () => void;
+}
+/** Creates the tracker. One per door process; everything it holds dies with it. */
+declare function createRcSessionTracker(deps: RcSessionTrackerDeps): RcSessionTracker;
+/**
+ * Wraps one route so the tracker sees every exchange the route serves: the request's facts are handed over first, and when they are Remote Control facts the response the route writes is teed to the tracker's observer while flowing on unchanged. Used on the door's route resolution, so the bare `/v1/` pass-through an OAuth session's Remote Control calls ride is where observation happens.
+ */
+declare function observingRoutedRoute(route: FrontDoorRoute, tracker: RcSessionTracker): FrontDoorRoute;
+/** Adapts the tracker's exchange observer to the passthrough forwarding's observer shape, so the connect test world (which forwards rather than routes) observes through the same tracker. */
+declare function rcObserverAsPassthrough(observer: RcExchangeObserver): PassthroughObserver;
+/**
+ * Builds the user-message payload event for one injected prompt: the Agent SDK stream-json `user` message shape (`type`, `uuid`, `session_id`, `parent_tool_use_id`, `message` with a `user` role), the same envelope a claude.ai client sends as a turn. The content is the plain string form, which is the shape validated end to end against the real API by the third-party client survey that settled this protocol.
+ */
+declare function buildRcUserMessagePayload(uuid: string, sessionId: string, text: string): Record<string, unknown>;
+/** Wraps payload event(s) in the write body the endpoint takes: `{"events": [{"payload": {...}}]}`. */
+declare function buildRcEventWriteBody(payload: Record<string, unknown>): Record<string, unknown>;
+/** The headers injection sends: the observed credential and protocol values, replayed verbatim, never invented. */
+interface RcInjectHeaders {
+    readonly authorization: string | undefined;
+    readonly anthropicVersion: string | undefined;
+    readonly anthropicClientPlatform: string | undefined;
+}
+/** One answer from the API host the inject path dials: the status and the whole body. This dial only ever reads small JSON answers, never a stream, so the body needs no cap of its own. */
+interface RcDialAnswer {
+    readonly status: number;
+    readonly body: string;
+}
+/** The one network effect injection performs, injected so the pure logic runs against fakes: POST the write body to the session's events endpoint. Production dials the real API host over the door's interception-proof agent; tests redirect to a local stand-in. */
+interface RcEventDial {
+    readonly writeEvents: (sessionId: string, headers: Readonly<Record<string, string>>, body: string) => Promise<RcDialAnswer>;
+}
+/** What one injection attempt produced: the sequence numbers the real service assigned, or a verbose failure message ready to show a user. */
+type RcInjectResult = {
+    readonly ok: true;
+    readonly sequenceNums: readonly number[];
+} | {
+    readonly ok: false;
+    readonly message: string;
+};
+/** Maps one dial answer to the inject result: an accepted write yields its sequence numbers; anything else yields a verbose message, with the 401 case naming the stale observed bearer as the cause. */
+declare function rcInjectResultFromAnswer(answer: RcDialAnswer): RcInjectResult;
+/** The credential and protocol headers the tracker holds for one session, the inject path's accessor: present only while the session is tracked, and never surfaced anywhere a summary, log or capture goes. */
+type RcObservedCredential = RcInjectHeaders;
+/** Everything one injection needs, injected so the decision logic runs against fakes in unit tests. */
+interface RcInjectDeps {
+    /** Reads the observed credential for a session: the tracker's accessor, in production. */
+    readonly credentialOf: (sessionId: string) => RcObservedCredential | undefined;
+    /** The dial to the real API host. */
+    readonly dial: RcEventDial;
+    /** Mints the payload event's uuid: a v4 UUID or better in production. */
+    readonly newUuid: () => string;
+}
+/**
+ * Injects one user-message prompt into an observed session: the documented client-half write, `POST /v1/code/sessions/{id}/events`, authenticated by the observed bearer and carrying the observed protocol headers. The result is the sequence numbers the real service assigned, or a verbose failure. A dial that cannot reach the API host is reported rather than thrown, so a caller with no exception handling still shows the user exactly what failed.
+ */
+declare function injectRcUserMessage(deps: RcInjectDeps, sessionId: string, text: string): Promise<RcInjectResult>;
+
+/** Where the Remote Control inject path dials: the API host's own address by default, over TLS with the door's interception-proof agent (real-name DNS resolution and the pf-exempt source-port range), so an injected event cannot be looped back into the door's own transparent surface. A test redirects the dial at a local stand-in presenting the host's name, exactly as the forwarding targets are redirected. */
+interface RcDialTarget {
+    readonly host: string;
+    readonly port: number;
+    /** The SNI name to present; defaults to `host`. */
+    readonly servername?: string;
+    /** Extra trust anchors for a stand-in's certificate, when it is not system-trusted. */
+    readonly ca?: readonly string[];
+    /** Overrides certificate verification; production leaves it at the Node default. */
+    readonly rejectUnauthorized?: boolean;
+}
+/**
+ * The real `RcEventDial`: one keep-alive TLS agent of the door's own exempt kind, so every injected event rides the same interception-proof dials the door's forwarded traffic does. The dial only ever reads small JSON answers (an event write's result, or an error), never a stream.
+ */
+declare function realRcEventDial(target?: RcDialTarget): RcEventDial;
 declare function realConnectEffects(): ConnectEffects;
 
+/**
+ * The Remote Control control surface: the small HTTP namespace the serving door answers on its provider listener, next to `/healthz`, through which `agent-shim frontdoor rc` lists the observed sessions and injects a prompt into one.
+ *
+ * This rides the listener `frontdoor status` already knows the door by (its address comes from the same state file, its trust anchor from the same CA path) rather than any second channel. The routes sit under one prefix the routed pipeline never serves, and every request must present the serving generation's control token as a Bearer credential: a fresh random value per door start, written owner-only under the front door's state directory so only this user's CLI can read it, and checked in constant time like every other capability the door accepts. An inject request is carried out by the door itself over its interception-proof dials, which is the whole point: the CLI never dials the API host directly, so nothing about the injection depends on the caller's own network path.
+ */
+/** The one path prefix every Remote Control control route sits under, answered before the routed pipeline like `/healthz` is. */
+declare const CONTROL_PATH_PREFIX = "/__agent-shim/rc";
+/** Everything the control handler needs, injected so it serves against fakes in unit tests. */
+interface RcControlHandlerDeps {
+    /** This generation's control token: the value the door wrote owner-only for its CLI to present. */
+    readonly expectedToken: string;
+    /** The observed sessions as the tracker lists them. */
+    readonly list: () => readonly RcSessionSummary[];
+    /** The inject operation, already wired to the tracker and the door's API-host dial. */
+    readonly inject: (sessionId: string, text: string) => Promise<RcInjectResult>;
+}
+/**
+ * Builds the control handler the provider listener serves under `CONTROL_PATH_PREFIX`. Every route demands the generation's control token first, so nothing about the sessions (their ids, their timing, and most of all the prompts injected into them) is reachable by a process that did not read the owner-only token file.
+ */
+declare function createRcControlHandler(deps: RcControlHandlerDeps): (request: IncomingMessage, response: ServerResponse) => void;
+/** One answer from the door's control listener. */
+interface RcControlAnswer {
+    readonly status: number;
+    readonly body: string;
+}
+/** The one transport the control client needs, injected so the client runs against a local plain-HTTP server in tests and the door's real TLS listener in production. */
+interface RcControlTransport {
+    readonly request: (options: {
+        readonly method: "GET" | "POST";
+        readonly path: string;
+        readonly headers: Readonly<Record<string, string>>;
+        readonly body?: string;
+    }) => Promise<RcControlAnswer>;
+}
+/** The real transport: HTTPS to the door's provider listener on loopback, trusting only the CA file the door's own state names, so a process merely holding the port cannot answer as the door. */
+declare function realRcControlTransport(port: number, ca: string): RcControlTransport;
+/** The door-facing client the `frontdoor rc` verbs use: the session list and the inject operation, over the injected transport. */
+interface FrontDoorRcControl {
+    /** The observed sessions, oldest-created first. Throws with the door's verbose reason when the list cannot be had. */
+    readonly listSessions: () => Promise<readonly RcSessionSummary[]>;
+    /** Injects one prompt, returning the sequence numbers the real service assigned or the verbose failure. */
+    readonly sendPrompt: (sessionId: string, text: string) => Promise<RcInjectResult>;
+}
+/** Builds the control client: every request presents the control token, and a non-2xx answer becomes the verbose message the door sent with it. */
+declare function frontDoorRcControl(transport: RcControlTransport, token: string): FrontDoorRcControl;
+
 /** The filesystem operations headroom coordination needs: the same shape as `FarmFs`, injected so every decision over state, sessions, and the start lock runs against an in-memory fake in tests. */
 type HeadroomFs = Pick<FarmFs, "mkdirp" | "mkdirPrivate" | "readFileUtf8" | "writeFileUtf8" | "writeFilePrivate" | "writeFileExclusive" | "readdir" | "removeRecursive">;
 
@@ -2813,5 +3042,5 @@ interface PrepareClaudeLaunchOptions {
  */
 declare function prepareClaudeLaunch(options: PrepareClaudeLaunchOptions): LaunchPlan;
 
-export { AMBIENT_CREDENTIAL_VARS, CONNECT_INTERCEPT_HOST, CONNECT_INTERCEPT_HOSTS, CONNECT_LIMITS, CategoryClassificationOverlaySchema, CategoryClassificationSchema, CategoryMapSchema, CliError, ConfigProfileSchema, CredentialCacheSchema, CredentialSchema, CredentialSourceSchema, DirectoryRuleAlreadyExistsError, DirectoryRuleMissingTargetError, DirectoryRuleNotFoundError, DirectoryRuleSchema, DirectoryRulesSchema, EXIT_FAILURE, EXIT_USAGE, EntryValueSchema, FARM_MANIFEST_FILENAME, FrontDoorStartError, GlobalConfigSchema, HeadroomStartError, IdentityAlreadyExistsError, IdentityNotFoundError, IdentitySchema, InvalidCategoryNameError, InvalidIdentityNameError, InvalidProviderNameError, LaunchRefusedError, LegacyProviderFileError, PoolNameSchema, PoolNotFoundError, PoolSchema, PortableConfigSchema, ProfileAlreadyExistsError, ProfileNotFoundError, ProviderAlreadyExistsError, ProviderKindMismatchError, ProviderNotFoundError, ProviderSchema, ROUTED_PATH_PREFIX, UsageError, UsageSnapshotError, UsageSnapshotSchema, WhenSchema, addDirectoryRule, addIdentity, addPool, addProvider, buildEntryFacts, buildLayoutPaths, carryOver, checkReportHasWarnings, checkReportToJson, collectCheckReport, collectDoctorReport, createLeafCache, createProfile, describeProviderEndpoint, detectAmbientCredential, ensureCa, ensureFrontDoor, ensureHeadroom, evaluateAmbientCredentialGuard, formatAmbientCredentialGuardMessage, formatCheckReport, formatDoctorReport, forwardableHeaders, generateCa, identityExists, isIdentityDirectoryName, isInterceptedHost, listDirectoryRules, listIdentities, listProfiles, listProviders, listUsageSnapshots, mintLeaf, parseConnectTarget, prepareClaudeLaunch, prepareLaunch, profileExists, providerExists, readActiveIdentity, readDirectoryRules, readFarmManifest, readGlobalConfig, readIdentity, readPools, readProfile, readProvider, readUsageSnapshot, realConnectCertStore, realConnectEffects, recoverFarm, recoveryDiagnostics, removeDirectoryRule, removeIdentity, removePool, removeProfile, removeProvider, requirePool, resolveAgentShimHome, resolveClaudeHome, resolveDecisions, resolveLayoutPaths, resolveSupervisorConfig, resyncFarm, runCheck, runDoctor, runFrontDoorSupervisor, runSupervisor, servedByPipeline, setAllowAmbientCredential, setDefaultConfigProfile, setGlobalDefaultProfile, setIdentityCredential, setPool, setProfileCategories, setProfileEntries, setProfileLaunchFlags, setProfileMetadata, snapshotPath, startConnectServer, topLevelNames, updateDirectoryRule, updateProvider, useIdentity, writeDirectoryRules };
-export type { AddDirectoryRuleOptions, AddProviderInput, AmbientCredentialDetection, AmbientCredentialGuardResult, AmbientCredentialVar, BuildEntryFactsParams, CaMaterial, CarryOverParams, CarryOverResult, CategoryMap, CheckReport, CollectCheckReportParams, CollectDoctorReportParams, CompiledRule, ConfigProfile, ConnectCertStore, ConnectEffects, ConnectLimits, ConnectServerConfig, ConnectServerHandle, ConnectTarget, Credential, CredentialSource, Decision, Diagnostic, DirectoryRule, DirectoryRules, DoctorReport, EliminatedRule, EnsureFrontDoorPorts, EnsureHeadroomPorts, EntryFact, EntryFacts, EntryValue, EvaluateAmbientCredentialGuardParams, FlattenedCascade, FrontDoorSupervisorPorts, GlobalConfig, HeadroomSupervisorConfig, Identity, IdentityCredentialChange, IdentityListEntry, IdentityListing, InjectedCredential, LaunchPlan, Layer, LayerId, LayoutPaths, LeafCert, Pool, PortableConfig, PrepareClaudeLaunchOptions, PrepareLaunchParams, ProfileListEntry, Provider, ProviderListEntry, RecoverFarmParams, RecoveryResult, ResolveDecisionsInput, ResolvedState, ResyncFarmParams, ResyncFarmResult, RunCheckParams, RunDoctorParams, RunFrontDoorSupervisorOptions, RunSupervisorOptions, SupervisorPorts, UnreadableIdentityListEntry, UpdateDirectoryRuleOptions, UpdateProviderInput, UsageReadFs, UsageSnapshot, WhenCondition };
+export { AMBIENT_CREDENTIAL_VARS, CONNECT_INTERCEPT_HOST, CONNECT_INTERCEPT_HOSTS, CONNECT_LIMITS, CONTROL_PATH_PREFIX, CategoryClassificationOverlaySchema, CategoryClassificationSchema, CategoryMapSchema, CliError, ConfigProfileSchema, CredentialCacheSchema, CredentialSchema, CredentialSourceSchema, DirectoryRuleAlreadyExistsError, DirectoryRuleMissingTargetError, DirectoryRuleNotFoundError, DirectoryRuleSchema, DirectoryRulesSchema, EXIT_FAILURE, EXIT_USAGE, EntryValueSchema, FARM_MANIFEST_FILENAME, FrontDoorStartError, GlobalConfigSchema, HeadroomStartError, IdentityAlreadyExistsError, IdentityNotFoundError, IdentitySchema, InvalidCategoryNameError, InvalidIdentityNameError, InvalidProviderNameError, LaunchRefusedError, LegacyProviderFileError, PoolNameSchema, PoolNotFoundError, PoolSchema, PortableConfigSchema, ProfileAlreadyExistsError, ProfileNotFoundError, ProviderAlreadyExistsError, ProviderKindMismatchError, ProviderNotFoundError, ProviderSchema, RC_IDLE_EXPIRY_MS, RC_SESSIONS_PATH_PREFIX, ROUTED_PATH_PREFIX, UsageError, UsageSnapshotError, UsageSnapshotSchema, WhenSchema, addDirectoryRule, addIdentity, addPool, addProvider, buildEntryFacts, buildLayoutPaths, buildRcEventWriteBody, buildRcUserMessagePayload, carryOver, checkReportHasWarnings, checkReportToJson, collectCheckReport, collectDoctorReport, createLeafCache, createProfile, createRcControlHandler, createRcSessionTracker, describeProviderEndpoint, detectAmbientCredential, ensureCa, ensureFrontDoor, ensureHeadroom, evaluateAmbientCredentialGuard, formatAmbientCredentialGuardMessage, formatCheckReport, formatDoctorReport, forwardableHeaders, frontDoorRcControl, generateCa, identityExists, injectRcUserMessage, isIdentityDirectoryName, isInterceptedHost, listDirectoryRules, listIdentities, listProfiles, listProviders, listUsageSnapshots, mintLeaf, observingRoutedRoute, parseConnectTarget, prepareClaudeLaunch, prepareLaunch, profileExists, providerExists, rcInjectResultFromAnswer, rcObserverAsPassthrough, readActiveIdentity, readDirectoryRules, readFarmManifest, readGlobalConfig, readIdentity, readPools, readProfile, readProvider, readUsageSnapshot, realConnectCertStore, realConnectEffects, realRcControlTransport, realRcEventDial, recoverFarm, recoveryDiagnostics, removeDirectoryRule, removeIdentity, removePool, removeProfile, removeProvider, requirePool, resolveAgentShimHome, resolveClaudeHome, resolveDecisions, resolveLayoutPaths, resolveSupervisorConfig, resyncFarm, runCheck, runDoctor, runFrontDoorSupervisor, runSupervisor, servedByPipeline, setAllowAmbientCredential, setDefaultConfigProfile, setGlobalDefaultProfile, setIdentityCredential, setPool, setProfileCategories, setProfileEntries, setProfileLaunchFlags, setProfileMetadata, snapshotPath, startConnectServer, topLevelNames, updateDirectoryRule, updateProvider, useIdentity, writeDirectoryRules };
+export type { AddDirectoryRuleOptions, AddProviderInput, AmbientCredentialDetection, AmbientCredentialGuardResult, AmbientCredentialVar, BuildEntryFactsParams, CaMaterial, CarryOverParams, CarryOverResult, CategoryMap, CheckReport, CollectCheckReportParams, CollectDoctorReportParams, CompiledRule, ConfigProfile, ConnectCertStore, ConnectEffects, ConnectLimits, ConnectServerConfig, ConnectServerHandle, ConnectTarget, Credential, CredentialSource, Decision, Diagnostic, DirectoryRule, DirectoryRules, DoctorReport, EliminatedRule, EnsureFrontDoorPorts, EnsureHeadroomPorts, EntryFact, EntryFacts, EntryValue, EvaluateAmbientCredentialGuardParams, FlattenedCascade, FrontDoorRcControl, FrontDoorSupervisorPorts, GlobalConfig, HeadroomSupervisorConfig, Identity, IdentityCredentialChange, IdentityListEntry, IdentityListing, InjectedCredential, LaunchPlan, Layer, LayerId, LayoutPaths, LeafCert, Pool, PortableConfig, PrepareClaudeLaunchOptions, PrepareLaunchParams, ProfileListEntry, Provider, ProviderListEntry, RcControlAnswer, RcControlHandlerDeps, RcControlTransport, RcDialAnswer, RcDialTarget, RcEventDial, RcExchangeObserver, RcInjectDeps, RcInjectHeaders, RcInjectResult, RcObservedCredential, RcObservedRequest, RcSessionSummary, RcSessionTracker, RcSessionTrackerDeps, RecoverFarmParams, RecoveryResult, ResolveDecisionsInput, ResolvedState, ResyncFarmParams, ResyncFarmResult, RunCheckParams, RunDoctorParams, RunFrontDoorSupervisorOptions, RunSupervisorOptions, SupervisorPorts, UnreadableIdentityListEntry, UpdateDirectoryRuleOptions, UpdateProviderInput, UsageReadFs, UsageSnapshot, WhenCondition };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-shim",
-  "version": "8.2.0",
+  "version": "8.3.0",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",