agent-shim 8.26.0 → 8.27.1

package/dist/types/index.d.ts

@@ -5509,6 +5509,18 @@ interface RcLiveUsage {
 /** Creates the live quota state and subscribes it to the backbone, so every rate-limit envelope published from now on is filed the moment it arrives. One per door process; everything it holds dies with it. */
 declare function createRcLiveUsage(deps: RcLiveUsageDeps): RcLiveUsage;
 
+/**
+ * The full scope list the minting writes and the local refresh echoes: the CLI's own claude.ai login scope set (`CLAUDE_AI_OAUTH_SCOPES` in its source), whose `user:inference` and `user:profile` members are exactly the two the Remote Control gate demands. Lives here, beside the refresh that echoes it, and is re-exported by the surface so the library surface it already published is unchanged.
+ */
+declare const RC_SELF_HOST_SCOPE_LIST: readonly string[];
+/** The local surface the self-hosted service hands to the connect surface: which hosts it takes over as HTTP, and the requests it answers itself. */
+interface RcSelfHostLocal {
+    /** The hosts whose terminated sessions this surface needs parsed as HTTP (the control-plane host, normally byte-tapped). */
+    readonly parsesHost: (host: string) => boolean;
+    /** Serves one request locally; resolves false when the surface does not own the path, so routing or piping continues unchanged. */
+    readonly serve: (host: string, request: IncomingMessage, response: ServerResponse) => Promise<boolean>;
+}
+
 /**
  * The worker's web-fetch proxy target side: the URL fetch the CLI delegates to the Remote Control host when its environment sends `CLAUDE_CODE_WEBFETCH_USE_CCR_PROXY`, served by the self-hosted surface so such a session does not break on the first fetch. The wire contract is the one the 2.1.289 CLI's own client half defines (its `THr`/`jPt` functions): a POST of `{url}` to `/{cse}/worker/web-fetch` answered with `{url, destination_url, text, content_type}` or `{error: {error_type, error_message}}`, read under a 12 MiB answer cap and a 40 s per-attempt timeout.
  *
@@ -5574,6 +5586,8 @@ declare function realRcWebFetch(options: {
  *
  * Division of the surface: the session family (`/v1/code/sessions...` and the `/v1/sessions` compatibility list) rides the routed pipeline as a `FrontDoorRoute`, so it flows through the same admission and middleware as any routed request and, above all, through the same observation wrapper that feeds the tracker (the door's own client half learns each session's credential precisely because the create is observed like any other exchange). The non-`/v1/` answers the CLI needs around activation (feature eval, profile, telemetry no-ops) and the OAuth refresh on the control-plane host have no pipeline to ride, so they are served by `local`, which the connect surface consults before routing or piping; that surface also takes over the control-plane host's terminated session as ordinary HTTP (it is normally byte-tapped) because answering `/v1/oauth/token` requires parsing it.
  *
+ * Above the sessions sits the conversation, the native service's own keying as observed through two bridged TUIs holding two distinct `cse_` ids over one live conversation (#238's finding): the event log and its sequence space belong to the conversation, and the `cse_` sessions are attachments to it. A create that names no conversation mints a fresh one, so the single-session shape every door-observed CLI runs keeps exactly its previous behaviour under a wrapper; a create that names one attaches to it, and every write through either attachment numbers in the one shared space and fans to every stream the conversation holds, each worker's own writes excepted (feeding a worker its own writes back would loop its REPL, while the other attachment's worker writes are the other client's half of the conversation, exactly what a second TUI joins to see). No observed wire shape names the link: the create body, the bridge answer and every envelope the captures and the 2.1.289 bundle show carry no conversation id, so the linking vocabulary here (the create body's `conversation` field, the `conv_` id prefix, the session rows' `conversation_id`, and the `/v1/code/conversations` family a sessionless client reads, writes and subscribes through) is this door's own design, named as such; should the real service's shape ever surface, these are the pieces to realign.
+ *
  * The worker family includes the two web proxies the CLI dials only when its environment opts in (`CLAUDE_CODE_WEBFETCH_USE_CCR_PROXY` and `CLAUDE_CODE_WEBSEARCH_USE_CCR_PROXY`, both unset by default and both verified absent from the rig session, so the default session fetches directly and never dials them): `/{cse}/worker/web-fetch` carries the CLI's URL fetch (a POST of `{url}` answered with the fetched facts or a target refusal, both shapes the 2.1.289 client's own schema reads), and `/{cse}/worker/web-search` carries its search. The wire facts the live rig settled beside the source: the session id the proxy URL names comes from a `CLAUDE_CODE_SESSION_ID` latch that only the cloud worker shape provisions (a locally launched bridge never sets it), and the credential the client presents is the session ingress token read from `CLAUDE_SESSION_INGRESS_TOKEN_FILE` or the well-known remote directory, which locally is nothing at all, so a bare local launch sends no Authorization and is refused; when the ingress token is one of this surface's own worker JWTs it authenticates exactly as the worker family's other paths do. The paths also accept the minted credential itself, the shape the client's login-bearer fallback presents, whose principal is the same credential that created the session. The fetch's bounds live in `rcWebFetch.ts`; the search is served as a clear refusal naming that no backend ships, with the injection point a real backend answers through.
  *
  * The one network lever this uses is the bridge response's `api_base_url`: the protocol lets the server name where the worker dials, so the door names the API host it itself terminates, and the worker's `/worker/...` calls arrive straight back at this surface over the same interception that carried the create.
@@ -5584,8 +5598,6 @@ declare function realRcWebFetch(options: {
 declare const RC_SELF_HOST_ENV = "AGENT_SHIM_FRONTDOOR_RC_SELF_HOST";
 /** Whether the environment asked for the self-hosted Remote Control service. */
 declare function rcSelfHostFromEnv(env: NodeJS.ProcessEnv): boolean;
-/** The full scope list the minting writes and the local refresh echoes: the CLI's own claude.ai login scope set (`CLAUDE_AI_OAUTH_SCOPES` in its source), whose `user:inference` and `user:profile` members are exactly the two the Remote Control gate demands. */
-declare const RC_SELF_HOST_SCOPE_LIST: readonly string[];
 /**
  * How long a minted worker JWT is good for. Not a fresh number: 46800 seconds is the `expires_in` the real bridge handed the live rig session (13 hours), so the local surface keeps the CLI's refresh cadence exactly where the real one put it.
  */
@@ -5640,15 +5652,10 @@ interface RcSelfHostDeps {
 }
 /** The self-hosted Remote Control service: the session-family route for the pipeline, and the local answers the connect surface consults before routing or piping. */
 interface RcSelfHostSurface {
-    /** The pipeline route serving the whole `/v1/code/sessions` family and the `/v1/sessions` compatibility list. */
+    /** The pipeline route serving the whole `/v1/code/sessions` family, the `/v1/sessions` compatibility list and the `/v1/code/conversations` family. */
     readonly route: FrontDoorRoute;
     /** The connect surface's local answers: which hosts it takes over as HTTP, and the requests it answers itself. */
-    readonly local: {
-        /** The hosts whose terminated sessions this surface needs parsed as HTTP (the control-plane host, normally byte-tapped). */
-        readonly parsesHost: (host: string) => boolean;
-        /** Serves one request locally; resolves false when the surface does not own the path, so routing or piping continues unchanged. */
-        readonly serve: (host: string, request: IncomingMessage, response: ServerResponse) => Promise<boolean>;
-    };
+    readonly local: RcSelfHostLocal;
     /** Stops the service's timers and retires every open stream. The sessions themselves are unreachable the moment the door drops them. */
     readonly close: () => void;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-shim",
-  "version": "8.26.0",
+  "version": "8.27.1",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",