agent-shim 8.2.0 → 8.4.0

package/dist/types/index.d.ts

@@ -692,6 +692,10 @@ interface LayoutPaths {
     readonly frontdoorStateFile: string;
     /** Path to the exclusive-create marker guarding "who spawns the front-door supervisor" so concurrent launches start at most one. */
     readonly frontdoorLockFile: string;
+    /**
+     * Path to the serving door's control token, mode 0600: the random bearer capability this generation's Remote Control control routes demand, rewritten on every door start. Only its owner can read it, which is what authenticates a CLI invocation to the door that minted it.
+     */
+    readonly frontdoorControlTokenFile: string;
     /** Directory holding one `<launcher-pid>.json` session-registry entry per live launch routed through the front door. */
     readonly frontdoorSessionsDir: string;
     /** Path to the front door's log: one line per lifecycle event and routed failure, never a token. */
@@ -1366,6 +1370,8 @@ interface CapturedRequestShape {
 /** The callbacks one piped request's forwarding drives, all optional callers except, so a fake or a partial observer fits the same seam. */
 interface PassthroughObserver {
     readonly onRequestChunk: (chunk: Buffer) => void;
+    /** The request body ended, when the observer cares about the body as a whole (the Remote Control tracker's adapter); optional because the capture, which records chunk excerpts as they arrive, never needs it. */
+    readonly onRequestEnd?: () => void;
     readonly onResponse: (status: number, headers: IncomingHttpHeaders) => void;
     readonly onResponseChunk: (chunk: Buffer) => void;
     readonly onEnd: () => void;
@@ -1594,8 +1600,314 @@ declare function realConnectCertStore(paths: {
     readonly frontdoorCaKeyFile: string;
 }): ConnectCertStore;
 
+/** What the identity step learned about one request from the launcher-injected headers. */
+interface SessionIdentity {
+    /** The identity name the launch resolved, when it resolved one. */
+    readonly identity: string | undefined;
+    /** The per-launch session id, when the launcher injected one. */
+    readonly sessionId: string | undefined;
+    /** Whether this launch resolved headroom on, so its requests must pass through the headroom hop before their route. */
+    readonly headroom: boolean;
+    /** The project identity headroom scopes memory to, re-set on the headroom hop and sent nowhere else. */
+    readonly projectId: string | undefined;
+}
+/** One request as a route sees it: the transport's own request and abort signal, plus what the identity step resolved. */
+interface RoutedRequest {
+    readonly method: string;
+    /** The request target exactly as received, path and query together. */
+    readonly url: string;
+    /** The request's headers with every internal header already stripped: exactly what a route may forward onwards. */
+    readonly headers: IncomingHttpHeaders;
+    /** The request's body stream: a route either pipes it onward untouched or reads it whole, never both. */
+    readonly body: IncomingMessage;
+    /** Aborted the moment the client goes away; a route aborts its own upstream work with it. */
+    readonly signal: AbortSignal;
+    readonly session: SessionIdentity;
+}
+/** The response half a route writes through, so the pipeline can run response middleware at the head and apply backpressure uniformly. */
+interface RoutedResponse {
+    /** Whether the head has already been written. */
+    readonly headersSent: boolean;
+    /** Writes the response head, running every response observer first. Must be called exactly once, before any write. */
+    readonly start: (status: number, headers: Readonly<Record<string, string>>) => void;
+    /** Sends the head on its way before any body chunk exists: a streaming response's client should see its headers the moment they are known. */
+    readonly flush: () => void;
+    /**
+     * Writes one body chunk, waiting for the socket to take it when the client is slow (backpressure: a slow client slows the route, and its upstream, instead of growing a buffer without bound). Resolves early, without writing, once the client is gone.
+     */
+    readonly write: (chunk: string | Uint8Array) => Promise<void>;
+    /** Ends the response. */
+    readonly end: () => void;
+    /** Drops the connection: an upstream failure after the head went out, where no status can be sent any more. */
+    readonly destroy: () => void;
+}
+/** One pluggable destination the front door routes a request to. */
+interface FrontDoorRoute {
+    /** The route's name, for logs and for response middleware context. */
+    readonly name: string;
+    /**
+     * Whether the headroom hop may sit in front of this route. Headroom needs the Anthropic-shaped request, so a protocol translator built on an Anthropic-compatible surface opts in, and a route whose request shape headroom could not understand opts out.
+     */
+    readonly headroomEligible: boolean;
+    /**
+     * The upstream headroom is told to use (its per-request base URL header) when the hop sits in front of this route. When defined it is always this door's direct listener, which is what lets the hop keep the route's credential in custody and the direct listener restore it; a route must never name any other address here. Undefined leaves headroom's own default upstream in charge, which is Claude Code's API.
+     */
+    readonly headroomUpstream: string | undefined;
+    /**
+     * Serves the request directly: headroom has already been applied, or does not apply to this route. Writes the response through `response` and resolves once the response has ended.
+     */
+    readonly serve: (request: RoutedRequest, response: RoutedResponse) => Promise<void>;
+}
+
+/**
+ * Remote Control session tracking and the client-half writes the front door performs: the record of the `cse_` sessions whose traffic crosses its terminated API-host session, the prompt injected into one, and the answer delivered to one of its pending control requests.
+ *
+ * The tracker is observational: the door already terminates the API host's TLS, so it sees the CLI's own `POST /v1/code/sessions` (whose answer carries the new session's `cse_` id) and every recurring `/v1/code/sessions/...` call (heartbeat, presence), each carrying the session's Authorization bearer and the protocol headers a client-half replay needs. Per session the tracker retains the latest of each, because those calls recur and the freshest value is the live one. It also reads the request bodies of the exchanges whose payloads matter: the worker's event batches (whose `control_request` payloads, `can_use_tool` above all, are the approvals awaiting an answer), the worker heartbeats (whose bodies carry `idle_seconds`), the worker registration (whose body carries the worker state), and the client-half event writes (whose `control_response` payloads complete a pending request). Everything is held in this process's memory only: nothing here is written to a log, to the capture, or to disk, and the summary the control surface lists never includes the credential. The capture's existing redaction is untouched; a capture and this tracker observe the same exchanges through entirely separate paths.
+ *
+ * Both writes replay the protocol's documented client half rather than splicing frames into any relayed stream: `POST /v1/code/sessions/{id}/events` with one payload event (a user message, or a `control_response` answering an observed request by echoing its id), authenticated by the observed bearer and the observed protocol headers, sent from the door over its own interception-proof dials. Sequence numbers therefore come from the real service and the event is mirrored to every attached client, exactly as a message typed into claude.ai would be.
+ */
+/** Every Remote Control exchange on the API host sits under this path prefix. */
+declare const RC_SESSIONS_PATH_PREFIX = "/v1/code/sessions";
+/**
+ * How long an entry survives without any observed exchange for its session. Derived from the protocol's own liveness, not chosen: the worker heartbeats every 20 s (the `current_interval_seconds` our own captured heartbeat body carries), so a live session produces observable traffic at least that often, and the transport's documented liveness bound is the 45 s stream timeout, which outlasts two missed heartbeat intervals (40 s) precisely so a momentarily quiet session is not dropped. An entry idle past 45 s therefore names a session the protocol itself has given up on, which makes 45 s the exact bound where retaining it stops describing anything live.
+ */
+declare const RC_IDLE_EXPIRY_MS = 45000;
+/**
+ * How long a control request stays answerable once observed. The protocol's own permission round-trip is documented at roughly 10 to 14 seconds end to end, so the ceiling of that window is the exact bound after which the worker has already given up waiting: answering later would write a `control_response` nothing is waiting for. A request exactly at the bound is already too late, which is why expiry is `>=` and not `>`.
+ */
+declare const RC_PENDING_DEADLINE_MS = 14000;
+/**
+ * How much of one request body the tracker ever holds while parsing it. The protocol's own batch cap is 10 MiB, but that bound exists to admit bulk transcript events the tracker has no use for; what it reads out of a body (the control requests, the heartbeat's idle, the worker's state) is one control exchange's worth of JSON, the same notion of "a full exchange's body" the capture's per-exchange budget (`STREAM_LOG_CAP_BYTES`, 256 KiB) was sized for, so one budget serves both here. A body past it is skipped, never failed: the exchange flows on untouched and simply records nothing.
+ */
+declare const RC_REQUEST_PARSE_CAP_BYTES = 262144;
+/** One pending control request as the control surface lists it: identification, type, summary and timing, never any credential. */
+interface RcPendingRequestSummary {
+    readonly sessionId: string;
+    /** The id a matching `control_response` must echo: the payload's `request_id`, the field the protocol's trust rule names. */
+    readonly requestId: string;
+    /** The request's subtype (`can_use_tool` and kin), or the payload discriminator when the subtype is absent. */
+    readonly type: string;
+    /** A short human-readable sketch: the tool name and a bounded excerpt of its input for `can_use_tool`. */
+    readonly summary: string;
+    /** When the request was observed, in epoch milliseconds from the injected clock. */
+    readonly observedAt: number;
+}
+/** One observed fact about the worker, with the instant of the exchange that carried it. */
+interface RcWorkerFact<T> {
+    readonly value: T;
+    readonly observedAt: number;
+}
+/** One observed session as the status surface reports it: the list summary plus what the worker's own exchanges carried and the requests awaiting an answer, never the credential. */
+interface RcSessionStatus extends RcSessionSummary {
+    /** The worker state the latest worker registration (`PUT /{id}/worker`) named, when one was observed. */
+    readonly workerState: RcWorkerFact<string> | undefined;
+    /** The idle the latest heartbeat carried, when one was observed. */
+    readonly workerIdleSeconds: RcWorkerFact<number> | undefined;
+    /** The session's control requests awaiting an answer, oldest-observed first. */
+    readonly pending: readonly RcPendingRequestSummary[];
+}
+/** One observed session as the control surface lists it: the identification and timing only, never the credential. */
+interface RcSessionSummary {
+    readonly id: string;
+    /** When the session's create exchange completed, in epoch milliseconds from the injected clock. */
+    readonly createdAt: number;
+    /** When traffic for this session was last observed, in epoch milliseconds from the injected clock. */
+    readonly lastSeenAt: number;
+}
+/** The request facts one observed exchange arrives with. */
+interface RcObservedRequest {
+    readonly method?: string;
+    readonly url?: string;
+    readonly headers: Readonly<IncomingHttpHeaders>;
+}
+/** What one observed exchange drives, in arrival order: the request body chunks and their end (present only for the exchanges whose request payloads the tracker reads), then the response's head, each body chunk, and the end exactly once. */
+interface RcExchangeObserver {
+    /** Feeds one request body chunk, when this exchange's request body carries something the tracker reads; absent otherwise, so an adapter never attaches a body listener for the exchanges that do not. */
+    readonly onRequestChunk?: (chunk: Uint8Array) => void;
+    /** The request body ended: the buffered body is parsed here, and its facts filed once the response is known to be a success. */
+    readonly onRequestEnd?: () => void;
+    readonly onResponse: (status: number, headers: Readonly<IncomingHttpHeaders>) => void;
+    readonly onBodyChunk: (chunk: Uint8Array) => void;
+    readonly onEnd: () => void;
+}
+/** Everything the tracker needs, injected so its decisions and lifecycle run against fakes in unit tests. */
+interface RcSessionTrackerDeps {
+    readonly now: () => number;
+    /** How long an entry may sit unobserved before it is expired; production passes `RC_IDLE_EXPIRY_MS`, tests pass small values so a deadline is reached in milliseconds. */
+    readonly idleMs: number;
+}
+/** The live record of observed Remote Control sessions. */
+interface RcSessionTracker {
+    /** Feeds one request/response exchange in: returns the observer its request and response drive when the request belongs to the Remote Control surface, or undefined when it does not, in which case nothing is retained and neither side needs observing. */
+    readonly observeExchange: (request: RcObservedRequest) => RcExchangeObserver | undefined;
+    /** Every live entry, idle ones expired first, sorted oldest-created first. */
+    readonly list: () => readonly RcSessionSummary[];
+    /** Every live entry as the status surface reports it, with the same sweeping and order as `list`, filtered to one session when named. */
+    readonly statusOf: (sessionId?: string) => readonly RcSessionStatus[];
+    /** Every control request awaiting an answer, deadline-expired ones dropped first, oldest-observed first, filtered to one session when named. */
+    readonly pendingOf: (sessionId?: string) => readonly RcPendingRequestSummary[];
+    /** The observed credential and protocol headers for one session, the client-half writes' accessor: present only while the session is tracked, and never surfaced anywhere a summary, log or capture goes. */
+    readonly credentialOf: (sessionId: string) => RcObservedCredential | undefined;
+    /** Retires one pending control request as answered: what a successful answer write calls, so the request stops being listed the moment it is answered. */
+    readonly completePending: (sessionId: string, requestId: string) => void;
+    /** Stops the idle sweep timer. The entries themselves are unreachable the moment the door drops them. */
+    readonly close: () => void;
+}
+/** Creates the tracker. One per door process; everything it holds dies with it. */
+declare function createRcSessionTracker(deps: RcSessionTrackerDeps): RcSessionTracker;
+/**
+ * Wraps one route so the tracker sees every exchange the route serves: the request's facts are handed over first, and when they are Remote Control facts the request's body chunks and the response the route writes are teed to the tracker's observer while flowing on unchanged. Used on the door's route resolution, so the bare `/v1/` pass-through an OAuth session's Remote Control calls ride is where observation happens.
+ */
+declare function observingRoutedRoute(route: FrontDoorRoute, tracker: RcSessionTracker): FrontDoorRoute;
+/** Adapts the tracker's exchange observer to the passthrough forwarding's observer shape, so the connect test world (which forwards rather than routes) observes through the same tracker. */
+declare function rcObserverAsPassthrough(observer: RcExchangeObserver): PassthroughObserver;
+/**
+ * Builds the user-message payload event for one injected prompt: the Agent SDK stream-json `user` message shape (`type`, `uuid`, `session_id`, `parent_tool_use_id`, `message` with a `user` role), the same envelope a claude.ai client sends as a turn. The content is the plain string form, which is the shape validated end to end against the real API by the third-party client survey that settled this protocol.
+ */
+declare function buildRcUserMessagePayload(uuid: string, sessionId: string, text: string): Record<string, unknown>;
+/** Wraps payload event(s) in the write body the endpoint takes: `{"events": [{"payload": {...}}]}`. */
+declare function buildRcEventWriteBody(payload: Record<string, unknown>): Record<string, unknown>;
+/** The headers a client-half write sends: the observed credential and protocol values, replayed verbatim, never invented. */
+interface RcWriteHeaders {
+    readonly authorization: string | undefined;
+    readonly anthropicVersion: string | undefined;
+    readonly anthropicClientPlatform: string | undefined;
+}
+/** One answer from the API host the write path dials: the status and the whole body. This dial only ever reads small JSON answers, never a stream, so the body needs no cap of its own. */
+interface RcDialAnswer {
+    readonly status: number;
+    readonly body: string;
+}
+/** The one network effect a client-half write performs, injected so the pure logic runs against fakes: POST the write body to the session's events endpoint. Production dials the real API host over the door's interception-proof agent; tests redirect to a local stand-in. */
+interface RcEventDial {
+    readonly writeEvents: (sessionId: string, headers: Readonly<Record<string, string>>, body: string) => Promise<RcDialAnswer>;
+}
+/** What one client-half write produced: the sequence numbers the real service assigned, or a verbose failure message ready to show a user. */
+type RcEventWriteResult = {
+    readonly ok: true;
+    readonly sequenceNums: readonly number[];
+} | {
+    readonly ok: false;
+    readonly message: string;
+};
+/** Maps one dial answer to the write result: an accepted write yields its sequence numbers; anything else yields a verbose message, with the 401 case naming the stale observed bearer as the cause. */
+declare function rcEventWriteResultFromAnswer(answer: RcDialAnswer): RcEventWriteResult;
+/** The credential and protocol headers the tracker holds for one session, the client-half writes' accessor: present only while the session is tracked, and never surfaced anywhere a summary, log or capture goes. */
+type RcObservedCredential = RcWriteHeaders;
+/** Everything one injection needs, injected so the decision logic runs against fakes in unit tests. */
+interface RcInjectDeps {
+    /** Reads the observed credential for a session: the tracker's accessor, in production. */
+    readonly credentialOf: (sessionId: string) => RcObservedCredential | undefined;
+    /** The dial to the real API host. */
+    readonly dial: RcEventDial;
+    /** Mints the payload event's uuid: a v4 UUID or better in production. */
+    readonly newUuid: () => string;
+}
+/**
+ * Injects one user-message prompt into an observed session: the documented client-half write, `POST /v1/code/sessions/{id}/events`, authenticated by the observed bearer and carrying the observed protocol headers. The result is the sequence numbers the real service assigned, or a verbose failure. A dial that cannot reach the API host is reported rather than thrown, so a caller with no exception handling still shows the user exactly what failed.
+ */
+declare function injectRcUserMessage(deps: RcInjectDeps, sessionId: string, text: string): Promise<RcEventWriteResult>;
+/** The decision an answer carries: approve or deny, with the message a denial shows the worker (the protocol's allow result has no text field, so an approval carries none). */
+interface RcAnswerDecision {
+    readonly approve: boolean;
+    /** The denial message; undefined means the protocol's empty default. Present only with a denial. */
+    readonly message: string | undefined;
+}
+/**
+ * Builds the `control_response` payload event for one answer: the SDK's response envelope, `subtype: "success"` with the request's id echoed in `request_id`, carrying the permission result the worker is waiting for (`behavior: "allow"`, or `"deny"` with its message).
+ */
+declare function buildRcControlResponsePayload(requestId: string, decision: RcAnswerDecision): Record<string, unknown>;
+/** Everything one answer needs, injected so the decision logic runs against fakes in unit tests. */
+interface RcAnswerDeps {
+    /** Reads the observed credential for a session: the tracker's accessor, in production. */
+    readonly credentialOf: (sessionId: string) => RcObservedCredential | undefined;
+    /** Reads the session's pending control requests: the tracker's accessor, in production, so an answer is refused unless the request is still waiting. */
+    readonly pendingOf: (sessionId: string) => readonly RcPendingRequestSummary[];
+    /** Retires a pending request as answered: the tracker's accessor, in production, called only once the write is confirmed delivered. */
+    readonly completePending: (sessionId: string, requestId: string) => void;
+    /** The dial to the real API host. */
+    readonly dial: RcEventDial;
+}
+/**
+ * Answers one pending control request on an observed session: the same documented client-half write the inject path performs, carrying a `control_response` that echoes the request's id, authenticated by the observed bearer and protocol headers. The request must still be pending (an answered or deadline-expired request is refused verbosely, since writing a response nothing waits for would mislead the caller), and a successful write retires it. A dial that cannot reach the API host is reported rather than thrown.
+ */
+declare function answerRcControlRequest(deps: RcAnswerDeps, sessionId: string, requestId: string, decision: RcAnswerDecision): Promise<RcEventWriteResult>;
+
+/** Where the Remote Control inject path dials: the API host's own address by default, over TLS with the door's interception-proof agent (real-name DNS resolution and the pf-exempt source-port range), so an injected event cannot be looped back into the door's own transparent surface. A test redirects the dial at a local stand-in presenting the host's name, exactly as the forwarding targets are redirected. */
+interface RcDialTarget {
+    readonly host: string;
+    readonly port: number;
+    /** The SNI name to present; defaults to `host`. */
+    readonly servername?: string;
+    /** Extra trust anchors for a stand-in's certificate, when it is not system-trusted. */
+    readonly ca?: readonly string[];
+    /** Overrides certificate verification; production leaves it at the Node default. */
+    readonly rejectUnauthorized?: boolean;
+}
+/**
+ * The real `RcEventDial`: one keep-alive TLS agent of the door's own exempt kind, so every injected event rides the same interception-proof dials the door's forwarded traffic does. The dial only ever reads small JSON answers (an event write's result, or an error), never a stream.
+ */
+declare function realRcEventDial(target?: RcDialTarget): RcEventDial;
 declare function realConnectEffects(): ConnectEffects;
 
+/**
+ * The Remote Control control surface: the small HTTP namespace the serving door answers on its provider listener, next to `/healthz`, through which `agent-shim frontdoor rc` lists the observed sessions, reports each one's status and pending control requests, injects a prompt into one, and answers one of its pending requests.
+ *
+ * This rides the listener `frontdoor status` already knows the door by (its address comes from the same state file, its trust anchor from the same CA path) rather than any second channel. The routes sit under one prefix the routed pipeline never serves, and every request must present the serving generation's control token as a Bearer credential: a fresh random value per door start, written owner-only under the front door's state directory so only this user's CLI can read it, and checked in constant time like every other capability the door accepts. An inject or answer request is carried out by the door itself over its interception-proof dials, which is the whole point: the CLI never dials the API host directly, so nothing about the write depends on the caller's own network path.
+ */
+/** The one path prefix every Remote Control control route sits under, answered before the routed pipeline like `/healthz` is. */
+declare const CONTROL_PATH_PREFIX = "/__agent-shim/rc";
+/** Everything the control handler needs, injected so it serves against fakes in unit tests. */
+interface RcControlHandlerDeps {
+    /** This generation's control token: the value the door wrote owner-only for its CLI to present. */
+    readonly expectedToken: string;
+    /** The observed sessions as the tracker lists them. */
+    readonly list: () => readonly RcSessionSummary[];
+    /** The observed sessions as the tracker reports their status, filtered to one when named. */
+    readonly statusOf: (sessionId?: string) => readonly RcSessionStatus[];
+    /** The control requests awaiting an answer, filtered to one session when named. */
+    readonly pendingOf: (sessionId?: string) => readonly RcPendingRequestSummary[];
+    /** The inject operation, already wired to the tracker and the door's API-host dial. */
+    readonly inject: (sessionId: string, text: string) => Promise<RcEventWriteResult>;
+    /** The answer operation, already wired to the tracker and the door's API-host dial. */
+    readonly answer: (sessionId: string, requestId: string, decision: RcAnswerDecision) => Promise<RcEventWriteResult>;
+}
+/**
+ * Builds the control handler the provider listener serves under `CONTROL_PATH_PREFIX`. Every route demands the generation's control token first, so nothing about the sessions (their ids, their timing, and most of all the prompts and approvals carried into them) is reachable by a process that did not read the owner-only token file.
+ */
+declare function createRcControlHandler(deps: RcControlHandlerDeps): (request: IncomingMessage, response: ServerResponse) => void;
+/** One answer from the door's control listener. */
+interface RcControlAnswer {
+    readonly status: number;
+    readonly body: string;
+}
+/** The one transport the control client needs, injected so the client runs against a local plain-HTTP server in tests and the door's real TLS listener in production. */
+interface RcControlTransport {
+    readonly request: (options: {
+        readonly method: "GET" | "POST";
+        readonly path: string;
+        readonly headers: Readonly<Record<string, string>>;
+        readonly body?: string;
+    }) => Promise<RcControlAnswer>;
+}
+/** The real transport: HTTPS to the door's provider listener on loopback, trusting only the CA file the door's own state names, so a process merely holding the port cannot answer as the door. */
+declare function realRcControlTransport(port: number, ca: string): RcControlTransport;
+/** The door-facing client the `frontdoor rc` verbs use: the session list, the status and pending reads, and the inject and answer operations, over the injected transport. */
+interface FrontDoorRcControl {
+    /** The observed sessions, oldest-created first. Throws with the door's verbose reason when the list cannot be had. */
+    readonly listSessions: () => Promise<readonly RcSessionSummary[]>;
+    /** The observed sessions' status, oldest-created first and filtered to one when named. Throws with the door's verbose reason when the read cannot be had, including a named session the door has not observed. */
+    readonly statusOf: (sessionId?: string) => Promise<readonly RcSessionStatus[]>;
+    /** The control requests awaiting an answer, oldest-observed first and filtered to one session when named. Throws with the door's verbose reason when the read cannot be had. */
+    readonly pendingOf: (sessionId?: string) => Promise<readonly RcPendingRequestSummary[]>;
+    /** Injects one prompt, returning the sequence numbers the real service assigned or the verbose failure. */
+    readonly sendPrompt: (sessionId: string, text: string) => Promise<RcEventWriteResult>;
+    /** Answers one pending control request, returning the sequence numbers the real service assigned or the verbose failure. */
+    readonly answerRequest: (sessionId: string, requestId: string, decision: RcAnswerDecision) => Promise<RcEventWriteResult>;
+}
+/** Builds the control client: every request presents the control token, and a non-2xx answer becomes the verbose message the door sent with it. */
+declare function frontDoorRcControl(transport: RcControlTransport, token: string): FrontDoorRcControl;
+
 /** The filesystem operations headroom coordination needs: the same shape as `FarmFs`, injected so every decision over state, sessions, and the start lock runs against an in-memory fake in tests. */
 type HeadroomFs = Pick<FarmFs, "mkdirp" | "mkdirPrivate" | "readFileUtf8" | "writeFileUtf8" | "writeFilePrivate" | "writeFileExclusive" | "readdir" | "removeRecursive">;
 
@@ -2813,5 +3125,5 @@ interface PrepareClaudeLaunchOptions {
  */
 declare function prepareClaudeLaunch(options: PrepareClaudeLaunchOptions): LaunchPlan;
 
-export { AMBIENT_CREDENTIAL_VARS, CONNECT_INTERCEPT_HOST, CONNECT_INTERCEPT_HOSTS, CONNECT_LIMITS, CategoryClassificationOverlaySchema, CategoryClassificationSchema, CategoryMapSchema, CliError, ConfigProfileSchema, CredentialCacheSchema, CredentialSchema, CredentialSourceSchema, DirectoryRuleAlreadyExistsError, DirectoryRuleMissingTargetError, DirectoryRuleNotFoundError, DirectoryRuleSchema, DirectoryRulesSchema, EXIT_FAILURE, EXIT_USAGE, EntryValueSchema, FARM_MANIFEST_FILENAME, FrontDoorStartError, GlobalConfigSchema, HeadroomStartError, IdentityAlreadyExistsError, IdentityNotFoundError, IdentitySchema, InvalidCategoryNameError, InvalidIdentityNameError, InvalidProviderNameError, LaunchRefusedError, LegacyProviderFileError, PoolNameSchema, PoolNotFoundError, PoolSchema, PortableConfigSchema, ProfileAlreadyExistsError, ProfileNotFoundError, ProviderAlreadyExistsError, ProviderKindMismatchError, ProviderNotFoundError, ProviderSchema, ROUTED_PATH_PREFIX, UsageError, UsageSnapshotError, UsageSnapshotSchema, WhenSchema, addDirectoryRule, addIdentity, addPool, addProvider, buildEntryFacts, buildLayoutPaths, carryOver, checkReportHasWarnings, checkReportToJson, collectCheckReport, collectDoctorReport, createLeafCache, createProfile, describeProviderEndpoint, detectAmbientCredential, ensureCa, ensureFrontDoor, ensureHeadroom, evaluateAmbientCredentialGuard, formatAmbientCredentialGuardMessage, formatCheckReport, formatDoctorReport, forwardableHeaders, generateCa, identityExists, isIdentityDirectoryName, isInterceptedHost, listDirectoryRules, listIdentities, listProfiles, listProviders, listUsageSnapshots, mintLeaf, parseConnectTarget, prepareClaudeLaunch, prepareLaunch, profileExists, providerExists, readActiveIdentity, readDirectoryRules, readFarmManifest, readGlobalConfig, readIdentity, readPools, readProfile, readProvider, readUsageSnapshot, realConnectCertStore, realConnectEffects, recoverFarm, recoveryDiagnostics, removeDirectoryRule, removeIdentity, removePool, removeProfile, removeProvider, requirePool, resolveAgentShimHome, resolveClaudeHome, resolveDecisions, resolveLayoutPaths, resolveSupervisorConfig, resyncFarm, runCheck, runDoctor, runFrontDoorSupervisor, runSupervisor, servedByPipeline, setAllowAmbientCredential, setDefaultConfigProfile, setGlobalDefaultProfile, setIdentityCredential, setPool, setProfileCategories, setProfileEntries, setProfileLaunchFlags, setProfileMetadata, snapshotPath, startConnectServer, topLevelNames, updateDirectoryRule, updateProvider, useIdentity, writeDirectoryRules };
-export type { AddDirectoryRuleOptions, AddProviderInput, AmbientCredentialDetection, AmbientCredentialGuardResult, AmbientCredentialVar, BuildEntryFactsParams, CaMaterial, CarryOverParams, CarryOverResult, CategoryMap, CheckReport, CollectCheckReportParams, CollectDoctorReportParams, CompiledRule, ConfigProfile, ConnectCertStore, ConnectEffects, ConnectLimits, ConnectServerConfig, ConnectServerHandle, ConnectTarget, Credential, CredentialSource, Decision, Diagnostic, DirectoryRule, DirectoryRules, DoctorReport, EliminatedRule, EnsureFrontDoorPorts, EnsureHeadroomPorts, EntryFact, EntryFacts, EntryValue, EvaluateAmbientCredentialGuardParams, FlattenedCascade, FrontDoorSupervisorPorts, GlobalConfig, HeadroomSupervisorConfig, Identity, IdentityCredentialChange, IdentityListEntry, IdentityListing, InjectedCredential, LaunchPlan, Layer, LayerId, LayoutPaths, LeafCert, Pool, PortableConfig, PrepareClaudeLaunchOptions, PrepareLaunchParams, ProfileListEntry, Provider, ProviderListEntry, RecoverFarmParams, RecoveryResult, ResolveDecisionsInput, ResolvedState, ResyncFarmParams, ResyncFarmResult, RunCheckParams, RunDoctorParams, RunFrontDoorSupervisorOptions, RunSupervisorOptions, SupervisorPorts, UnreadableIdentityListEntry, UpdateDirectoryRuleOptions, UpdateProviderInput, UsageReadFs, UsageSnapshot, WhenCondition };
+export { AMBIENT_CREDENTIAL_VARS, CONNECT_INTERCEPT_HOST, CONNECT_INTERCEPT_HOSTS, CONNECT_LIMITS, CONTROL_PATH_PREFIX, CategoryClassificationOverlaySchema, CategoryClassificationSchema, CategoryMapSchema, CliError, ConfigProfileSchema, CredentialCacheSchema, CredentialSchema, CredentialSourceSchema, DirectoryRuleAlreadyExistsError, DirectoryRuleMissingTargetError, DirectoryRuleNotFoundError, DirectoryRuleSchema, DirectoryRulesSchema, EXIT_FAILURE, EXIT_USAGE, EntryValueSchema, FARM_MANIFEST_FILENAME, FrontDoorStartError, GlobalConfigSchema, HeadroomStartError, IdentityAlreadyExistsError, IdentityNotFoundError, IdentitySchema, InvalidCategoryNameError, InvalidIdentityNameError, InvalidProviderNameError, LaunchRefusedError, LegacyProviderFileError, PoolNameSchema, PoolNotFoundError, PoolSchema, PortableConfigSchema, ProfileAlreadyExistsError, ProfileNotFoundError, ProviderAlreadyExistsError, ProviderKindMismatchError, ProviderNotFoundError, ProviderSchema, RC_IDLE_EXPIRY_MS, RC_PENDING_DEADLINE_MS, RC_REQUEST_PARSE_CAP_BYTES, RC_SESSIONS_PATH_PREFIX, ROUTED_PATH_PREFIX, UsageError, UsageSnapshotError, UsageSnapshotSchema, WhenSchema, addDirectoryRule, addIdentity, addPool, addProvider, answerRcControlRequest, buildEntryFacts, buildLayoutPaths, buildRcControlResponsePayload, buildRcEventWriteBody, buildRcUserMessagePayload, carryOver, checkReportHasWarnings, checkReportToJson, collectCheckReport, collectDoctorReport, createLeafCache, createProfile, createRcControlHandler, createRcSessionTracker, describeProviderEndpoint, detectAmbientCredential, ensureCa, ensureFrontDoor, ensureHeadroom, evaluateAmbientCredentialGuard, formatAmbientCredentialGuardMessage, formatCheckReport, formatDoctorReport, forwardableHeaders, frontDoorRcControl, generateCa, identityExists, injectRcUserMessage, isIdentityDirectoryName, isInterceptedHost, listDirectoryRules, listIdentities, listProfiles, listProviders, listUsageSnapshots, mintLeaf, observingRoutedRoute, parseConnectTarget, prepareClaudeLaunch, prepareLaunch, profileExists, providerExists, rcEventWriteResultFromAnswer, rcObserverAsPassthrough, readActiveIdentity, readDirectoryRules, readFarmManifest, readGlobalConfig, readIdentity, readPools, readProfile, readProvider, readUsageSnapshot, realConnectCertStore, realConnectEffects, realRcControlTransport, realRcEventDial, recoverFarm, recoveryDiagnostics, removeDirectoryRule, removeIdentity, removePool, removeProfile, removeProvider, requirePool, resolveAgentShimHome, resolveClaudeHome, resolveDecisions, resolveLayoutPaths, resolveSupervisorConfig, resyncFarm, runCheck, runDoctor, runFrontDoorSupervisor, runSupervisor, servedByPipeline, setAllowAmbientCredential, setDefaultConfigProfile, setGlobalDefaultProfile, setIdentityCredential, setPool, setProfileCategories, setProfileEntries, setProfileLaunchFlags, setProfileMetadata, snapshotPath, startConnectServer, topLevelNames, updateDirectoryRule, updateProvider, useIdentity, writeDirectoryRules };
+export type { AddDirectoryRuleOptions, AddProviderInput, AmbientCredentialDetection, AmbientCredentialGuardResult, AmbientCredentialVar, BuildEntryFactsParams, CaMaterial, CarryOverParams, CarryOverResult, CategoryMap, CheckReport, CollectCheckReportParams, CollectDoctorReportParams, CompiledRule, ConfigProfile, ConnectCertStore, ConnectEffects, ConnectLimits, ConnectServerConfig, ConnectServerHandle, ConnectTarget, Credential, CredentialSource, Decision, Diagnostic, DirectoryRule, DirectoryRules, DoctorReport, EliminatedRule, EnsureFrontDoorPorts, EnsureHeadroomPorts, EntryFact, EntryFacts, EntryValue, EvaluateAmbientCredentialGuardParams, FlattenedCascade, FrontDoorRcControl, FrontDoorSupervisorPorts, GlobalConfig, HeadroomSupervisorConfig, Identity, IdentityCredentialChange, IdentityListEntry, IdentityListing, InjectedCredential, LaunchPlan, Layer, LayerId, LayoutPaths, LeafCert, Pool, PortableConfig, PrepareClaudeLaunchOptions, PrepareLaunchParams, ProfileListEntry, Provider, ProviderListEntry, RcAnswerDecision, RcAnswerDeps, RcControlAnswer, RcControlHandlerDeps, RcControlTransport, RcDialAnswer, RcDialTarget, RcEventDial, RcEventWriteResult, RcExchangeObserver, RcInjectDeps, RcObservedCredential, RcObservedRequest, RcPendingRequestSummary, RcSessionStatus, RcSessionSummary, RcSessionTracker, RcSessionTrackerDeps, RcWorkerFact, RcWriteHeaders, RecoverFarmParams, RecoveryResult, ResolveDecisionsInput, ResolvedState, ResyncFarmParams, ResyncFarmResult, RunCheckParams, RunDoctorParams, RunFrontDoorSupervisorOptions, RunSupervisorOptions, SupervisorPorts, UnreadableIdentityListEntry, UpdateDirectoryRuleOptions, UpdateProviderInput, UsageReadFs, UsageSnapshot, WhenCondition };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-shim",
-  "version": "8.2.0",
+  "version": "8.4.0",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",