agent-shim 8.21.0 → 8.22.0

package/dist/index.cjs

@@ -10577,6 +10577,17 @@ function bearerOf(headers) {
   }
   return presented.slice(0, "bearer ".length).toLowerCase() === "bearer " ? presented.slice("bearer ".length) : void 0;
 }
+function presentationRefusal(headers) {
+  const presented = singleHeader2(headers, "authorization");
+  if (presented === void 0) {
+    return "absent";
+  }
+  if (presented.slice(0, "bearer ".length).toLowerCase() !== "bearer ") {
+    return "not-a-bearer";
+  }
+  const bearer = presented.slice("bearer ".length);
+  return bearer.slice(0, "bearer ".length).toLowerCase() === "bearer " ? "doubled-scheme-word" : "unrecognised";
+}
 async function readBody2(request4, capBytes) {
   return await new Promise((resolve, reject) => {
     const chunks = [];
@@ -10665,6 +10676,9 @@ function createRcSelfHostSurface(deps) {
     }
     return false;
   };
+  const credentialRefusal = (headers) => presentsCredential(headers) ? void 0 : presentationRefusal(headers);
+  const workerRefusal = (headers, session) => presentsWorkerJwt(headers, session) ? void 0 : presentationRefusal(headers);
+  const workerOrCredentialRefusal = (headers, session) => presentsWorkerJwt(headers, session) || presentsCredential(headers) ? void 0 : presentationRefusal(headers);
   const frameOf = (event) => {
     const envelope = {
       event_id: event.eventId,
@@ -10753,8 +10767,14 @@ data: ${JSON.stringify(envelope)}
   const epochStale = async (response) => {
     await answerJson2(response, HTTP_CONFLICT, { type: "error", error: { type: "api_error", message: "worker_epoch does not match the session's live epoch" } }, { [CONFLICT_REASON_HEADER2]: CONFLICT_REASON_EPOCH_STALE });
   };
-  const unauthorized = async (response) => {
-    await answerJson2(response, HTTP_STATUS.unauthorized, { type: "error", error: { type: "authentication_error", message: "the self-hosted Remote Control surface did not recognise the presented credential" } });
+  const refusalMessages = {
+    absent: "the self-hosted Remote Control surface authenticates by the Authorization header, and this call carried none",
+    "not-a-bearer": "the self-hosted Remote Control surface reads a Bearer authorization, and this call's Authorization header did not carry the Bearer scheme word",
+    "doubled-scheme-word": "the self-hosted Remote Control surface reads one Bearer scheme word, and this call's Authorization header carried it twice: a persisted session record holds the whole header value with the scheme word included, so prefixing Bearer onto it presents a different credential",
+    unrecognised: "the self-hosted Remote Control surface did not recognise the presented credential"
+  };
+  const unauthorized = async (response, refusal) => {
+    await answerJson2(response, HTTP_STATUS.unauthorized, { type: "error", error: { type: "authentication_error", message: refusalMessages[refusal] } });
   };
   const serveSessionPath = async (session, tail, request4, response) => {
     const method = request4.method.toUpperCase();
@@ -10772,8 +10792,9 @@ data: ${JSON.stringify(envelope)}
       return;
     }
     if (tail === "bridge" && method === "POST") {
-      if (!presentsCredential(request4.headers)) {
-        await unauthorized(response);
+      const refusal = credentialRefusal(request4.headers);
+      if (refusal !== void 0) {
+        await unauthorized(response, refusal);
         return;
       }
       const workerJwt = mintWorkerJwt(deps.randomToken, deps.now());
@@ -10783,8 +10804,9 @@ data: ${JSON.stringify(envelope)}
       return;
     }
     if (tail === "archive" && method === "POST") {
-      if (!presentsCredential(request4.headers)) {
-        await unauthorized(response);
+      const refusal = credentialRefusal(request4.headers);
+      if (refusal !== void 0) {
+        await unauthorized(response, refusal);
         return;
       }
       for (const sink of [...session.workerStreams, ...session.clientStreams]) {
@@ -10798,8 +10820,9 @@ data: ${JSON.stringify(envelope)}
     if (tail === "worker" || tail.startsWith("worker/")) {
       const workerTail = tail === "worker" ? "" : tail.slice("worker/".length);
       const webProxy = workerTail === "web-fetch" || workerTail === "web-search";
-      if (!(webProxy ? presentsCredential(request4.headers) || presentsWorkerJwt(request4.headers, session) : presentsWorkerJwt(request4.headers, session))) {
-        await unauthorized(response);
+      const refusal = webProxy ? workerOrCredentialRefusal(request4.headers, session) : workerRefusal(request4.headers, session);
+      if (refusal !== void 0) {
+        await unauthorized(response, refusal);
         return;
       }
       if (workerTail === "" && method === "GET") {
@@ -10955,8 +10978,9 @@ data: ${JSON.stringify(envelope)}
       await answerJson2(response, HTTP_STATUS.notFound, { type: "error", error: { type: "api_error", message: `the self-hosted Remote Control surface serves no worker path "${workerTail}"` } });
       return;
     }
-    if (!presentsCredential(request4.headers)) {
-      await unauthorized(response);
+    const clientRefusal = credentialRefusal(request4.headers);
+    if (clientRefusal !== void 0) {
+      await unauthorized(response, clientRefusal);
       return;
     }
     if (tail === "events" && method === "POST") {
@@ -11021,8 +11045,9 @@ data: ${JSON.stringify(envelope)}
           await answerJson2(response, HTTP_STATUS.methodNotAllowed, { type: "error", error: { type: "api_error", message: "the compatibility session list is a GET" } });
           return;
         }
-        if (!presentsCredential(request4.headers)) {
-          await unauthorized(response);
+        const listRefusal = credentialRefusal(request4.headers);
+        if (listRefusal !== void 0) {
+          await unauthorized(response, listRefusal);
           return;
         }
         await answerJson2(response, HTTP_STATUS.ok, { data: [] });
@@ -11034,8 +11059,9 @@ data: ${JSON.stringify(envelope)}
       }
       if (pathname === RC_SESSIONS_PATH_PREFIX2) {
         if (method === "POST") {
-          if (!presentsCredential(request4.headers)) {
-            await unauthorized(response);
+          const createRefusal = credentialRefusal(request4.headers);
+          if (createRefusal !== void 0) {
+            await unauthorized(response, createRefusal);
             return;
           }
           const body = parseJsonObject2(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
@@ -11060,8 +11086,9 @@ data: ${JSON.stringify(envelope)}
           return;
         }
         if (method === "GET") {
-          if (!presentsCredential(request4.headers)) {
-            await unauthorized(response);
+          const readRefusal = credentialRefusal(request4.headers);
+          if (readRefusal !== void 0) {
+            await unauthorized(response, readRefusal);
             return;
           }
           await answerJson2(response, HTTP_STATUS.ok, { data: [...sessions.values()].map((session) => ({ id: session.id, title: session.title, created_at: new Date(session.createdAt).toISOString(), updated_at: new Date(session.lastTrafficAt).toISOString(), session_status: "active" })) });

package/dist/index.mjs

@@ -10305,6 +10305,17 @@ function bearerOf(headers) {
   }
   return presented.slice(0, "bearer ".length).toLowerCase() === "bearer " ? presented.slice("bearer ".length) : void 0;
 }
+function presentationRefusal(headers) {
+  const presented = singleHeader2(headers, "authorization");
+  if (presented === void 0) {
+    return "absent";
+  }
+  if (presented.slice(0, "bearer ".length).toLowerCase() !== "bearer ") {
+    return "not-a-bearer";
+  }
+  const bearer = presented.slice("bearer ".length);
+  return bearer.slice(0, "bearer ".length).toLowerCase() === "bearer " ? "doubled-scheme-word" : "unrecognised";
+}
 async function readBody2(request4, capBytes) {
   return await new Promise((resolve, reject) => {
     const chunks = [];
@@ -10393,6 +10404,9 @@ function createRcSelfHostSurface(deps) {
     }
     return false;
   };
+  const credentialRefusal = (headers) => presentsCredential(headers) ? void 0 : presentationRefusal(headers);
+  const workerRefusal = (headers, session) => presentsWorkerJwt(headers, session) ? void 0 : presentationRefusal(headers);
+  const workerOrCredentialRefusal = (headers, session) => presentsWorkerJwt(headers, session) || presentsCredential(headers) ? void 0 : presentationRefusal(headers);
   const frameOf = (event) => {
     const envelope = {
       event_id: event.eventId,
@@ -10481,8 +10495,14 @@ data: ${JSON.stringify(envelope)}
   const epochStale = async (response) => {
     await answerJson2(response, HTTP_CONFLICT, { type: "error", error: { type: "api_error", message: "worker_epoch does not match the session's live epoch" } }, { [CONFLICT_REASON_HEADER2]: CONFLICT_REASON_EPOCH_STALE });
   };
-  const unauthorized = async (response) => {
-    await answerJson2(response, HTTP_STATUS.unauthorized, { type: "error", error: { type: "authentication_error", message: "the self-hosted Remote Control surface did not recognise the presented credential" } });
+  const refusalMessages = {
+    absent: "the self-hosted Remote Control surface authenticates by the Authorization header, and this call carried none",
+    "not-a-bearer": "the self-hosted Remote Control surface reads a Bearer authorization, and this call's Authorization header did not carry the Bearer scheme word",
+    "doubled-scheme-word": "the self-hosted Remote Control surface reads one Bearer scheme word, and this call's Authorization header carried it twice: a persisted session record holds the whole header value with the scheme word included, so prefixing Bearer onto it presents a different credential",
+    unrecognised: "the self-hosted Remote Control surface did not recognise the presented credential"
+  };
+  const unauthorized = async (response, refusal) => {
+    await answerJson2(response, HTTP_STATUS.unauthorized, { type: "error", error: { type: "authentication_error", message: refusalMessages[refusal] } });
   };
   const serveSessionPath = async (session, tail, request4, response) => {
     const method = request4.method.toUpperCase();
@@ -10500,8 +10520,9 @@ data: ${JSON.stringify(envelope)}
       return;
     }
     if (tail === "bridge" && method === "POST") {
-      if (!presentsCredential(request4.headers)) {
-        await unauthorized(response);
+      const refusal = credentialRefusal(request4.headers);
+      if (refusal !== void 0) {
+        await unauthorized(response, refusal);
         return;
       }
       const workerJwt = mintWorkerJwt(deps.randomToken, deps.now());
@@ -10511,8 +10532,9 @@ data: ${JSON.stringify(envelope)}
       return;
     }
     if (tail === "archive" && method === "POST") {
-      if (!presentsCredential(request4.headers)) {
-        await unauthorized(response);
+      const refusal = credentialRefusal(request4.headers);
+      if (refusal !== void 0) {
+        await unauthorized(response, refusal);
         return;
       }
       for (const sink of [...session.workerStreams, ...session.clientStreams]) {
@@ -10526,8 +10548,9 @@ data: ${JSON.stringify(envelope)}
     if (tail === "worker" || tail.startsWith("worker/")) {
       const workerTail = tail === "worker" ? "" : tail.slice("worker/".length);
       const webProxy = workerTail === "web-fetch" || workerTail === "web-search";
-      if (!(webProxy ? presentsCredential(request4.headers) || presentsWorkerJwt(request4.headers, session) : presentsWorkerJwt(request4.headers, session))) {
-        await unauthorized(response);
+      const refusal = webProxy ? workerOrCredentialRefusal(request4.headers, session) : workerRefusal(request4.headers, session);
+      if (refusal !== void 0) {
+        await unauthorized(response, refusal);
         return;
       }
       if (workerTail === "" && method === "GET") {
@@ -10683,8 +10706,9 @@ data: ${JSON.stringify(envelope)}
       await answerJson2(response, HTTP_STATUS.notFound, { type: "error", error: { type: "api_error", message: `the self-hosted Remote Control surface serves no worker path "${workerTail}"` } });
       return;
     }
-    if (!presentsCredential(request4.headers)) {
-      await unauthorized(response);
+    const clientRefusal = credentialRefusal(request4.headers);
+    if (clientRefusal !== void 0) {
+      await unauthorized(response, clientRefusal);
       return;
     }
     if (tail === "events" && method === "POST") {
@@ -10749,8 +10773,9 @@ data: ${JSON.stringify(envelope)}
           await answerJson2(response, HTTP_STATUS.methodNotAllowed, { type: "error", error: { type: "api_error", message: "the compatibility session list is a GET" } });
           return;
         }
-        if (!presentsCredential(request4.headers)) {
-          await unauthorized(response);
+        const listRefusal = credentialRefusal(request4.headers);
+        if (listRefusal !== void 0) {
+          await unauthorized(response, listRefusal);
           return;
         }
         await answerJson2(response, HTTP_STATUS.ok, { data: [] });
@@ -10762,8 +10787,9 @@ data: ${JSON.stringify(envelope)}
       }
       if (pathname === RC_SESSIONS_PATH_PREFIX2) {
         if (method === "POST") {
-          if (!presentsCredential(request4.headers)) {
-            await unauthorized(response);
+          const createRefusal = credentialRefusal(request4.headers);
+          if (createRefusal !== void 0) {
+            await unauthorized(response, createRefusal);
             return;
           }
           const body = parseJsonObject2(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
@@ -10788,8 +10814,9 @@ data: ${JSON.stringify(envelope)}
           return;
         }
         if (method === "GET") {
-          if (!presentsCredential(request4.headers)) {
-            await unauthorized(response);
+          const readRefusal = credentialRefusal(request4.headers);
+          if (readRefusal !== void 0) {
+            await unauthorized(response, readRefusal);
             return;
           }
           await answerJson2(response, HTTP_STATUS.ok, { data: [...sessions.values()].map((session) => ({ id: session.id, title: session.title, created_at: new Date(session.createdAt).toISOString(), updated_at: new Date(session.lastTrafficAt).toISOString(), session_status: "active" })) });

package/dist/types/index.d.ts

@@ -3998,13 +3998,13 @@ declare function createControlApiRouter(deps: ControlApiDeps): {
                     "config-profile": "config-profile";
                     identity: "identity";
                     provider: "provider";
-                    pool: "pool";
-                    keychain: "keychain";
                     "ambient-credential": "ambient-credential";
                     "binary-discovery": "binary-discovery";
                     "claude-shim": "claude-shim";
                     "path-resolution": "path-resolution";
                     "legacy-name": "legacy-name";
+                    pool: "pool";
+                    keychain: "keychain";
                     "directory-rules": "directory-rules";
                     "categories-local": "categories-local";
                     "active-identity": "active-identity";
@@ -4475,13 +4475,13 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                     "config-profile": "config-profile";
                     identity: "identity";
                     provider: "provider";
-                    pool: "pool";
-                    keychain: "keychain";
                     "ambient-credential": "ambient-credential";
                     "binary-discovery": "binary-discovery";
                     "claude-shim": "claude-shim";
                     "path-resolution": "path-resolution";
                     "legacy-name": "legacy-name";
+                    pool: "pool";
+                    keychain: "keychain";
                     "directory-rules": "directory-rules";
                     "categories-local": "categories-local";
                     "active-identity": "active-identity";
@@ -4769,13 +4769,13 @@ declare const DoctorFindingSchema: z.ZodObject<{
         "config-profile": "config-profile";
         identity: "identity";
         provider: "provider";
-        pool: "pool";
-        keychain: "keychain";
         "ambient-credential": "ambient-credential";
         "binary-discovery": "binary-discovery";
         "claude-shim": "claude-shim";
         "path-resolution": "path-resolution";
         "legacy-name": "legacy-name";
+        pool: "pool";
+        keychain: "keychain";
         "directory-rules": "directory-rules";
         "categories-local": "categories-local";
         "active-identity": "active-identity";
@@ -4798,13 +4798,13 @@ declare const DoctorRunOutputSchema: z.ZodObject<{
             "config-profile": "config-profile";
             identity: "identity";
             provider: "provider";
-            pool: "pool";
-            keychain: "keychain";
             "ambient-credential": "ambient-credential";
             "binary-discovery": "binary-discovery";
             "claude-shim": "claude-shim";
             "path-resolution": "path-resolution";
             "legacy-name": "legacy-name";
+            pool: "pool";
+            keychain: "keychain";
             "directory-rules": "directory-rules";
             "categories-local": "categories-local";
             "active-identity": "active-identity";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-shim",
-  "version": "8.21.0",
+  "version": "8.22.0",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",