agent-shim 8.3.0 → 8.4.0

package/dist/types/index.d.ts

@@ -1370,6 +1370,8 @@ interface CapturedRequestShape {
 /** The callbacks one piped request's forwarding drives, all optional callers except, so a fake or a partial observer fits the same seam. */
 interface PassthroughObserver {
     readonly onRequestChunk: (chunk: Buffer) => void;
+    /** The request body ended, when the observer cares about the body as a whole (the Remote Control tracker's adapter); optional because the capture, which records chunk excerpts as they arrive, never needs it. */
+    readonly onRequestEnd?: () => void;
     readonly onResponse: (status: number, headers: IncomingHttpHeaders) => void;
     readonly onResponseChunk: (chunk: Buffer) => void;
     readonly onEnd: () => void;
@@ -1658,11 +1660,11 @@ interface FrontDoorRoute {
 }
 
 /**
- * Remote Control session tracking and prompt injection: the front door's record of the `cse_` sessions whose traffic crosses its terminated API-host session, and the client-half write that delivers a prompt to one of them.
+ * Remote Control session tracking and the client-half writes the front door performs: the record of the `cse_` sessions whose traffic crosses its terminated API-host session, the prompt injected into one, and the answer delivered to one of its pending control requests.
  *
- * The tracker is observational: the door already terminates the API host's TLS, so it sees the CLI's own `POST /v1/code/sessions` (whose answer carries the new session's `cse_` id) and every recurring `/v1/code/sessions/...` call (heartbeat, presence), each carrying the session's Authorization bearer and the protocol headers a client-half replay needs. Per session the tracker retains the latest of each, because those calls recur and the freshest value is the live one. Everything is held in this process's memory only: nothing here is written to a log, to the capture, or to disk, and the summary the control surface lists never includes the credential. The capture's existing redaction is untouched; a capture and this tracker observe the same exchanges through entirely separate paths.
+ * The tracker is observational: the door already terminates the API host's TLS, so it sees the CLI's own `POST /v1/code/sessions` (whose answer carries the new session's `cse_` id) and every recurring `/v1/code/sessions/...` call (heartbeat, presence), each carrying the session's Authorization bearer and the protocol headers a client-half replay needs. Per session the tracker retains the latest of each, because those calls recur and the freshest value is the live one. It also reads the request bodies of the exchanges whose payloads matter: the worker's event batches (whose `control_request` payloads, `can_use_tool` above all, are the approvals awaiting an answer), the worker heartbeats (whose bodies carry `idle_seconds`), the worker registration (whose body carries the worker state), and the client-half event writes (whose `control_response` payloads complete a pending request). Everything is held in this process's memory only: nothing here is written to a log, to the capture, or to disk, and the summary the control surface lists never includes the credential. The capture's existing redaction is untouched; a capture and this tracker observe the same exchanges through entirely separate paths.
  *
- * Injection replays the protocol's documented client half rather than splicing frames into any relayed stream: `POST /v1/code/sessions/{id}/events` with one user-message payload event, authenticated by the observed bearer and the observed protocol headers, sent from the door over its own interception-proof dials. Sequence numbers therefore come from the real service and the event is mirrored to every attached client, exactly as a message typed into claude.ai would be.
+ * Both writes replay the protocol's documented client half rather than splicing frames into any relayed stream: `POST /v1/code/sessions/{id}/events` with one payload event (a user message, or a `control_response` answering an observed request by echoing its id), authenticated by the observed bearer and the observed protocol headers, sent from the door over its own interception-proof dials. Sequence numbers therefore come from the real service and the event is mirrored to every attached client, exactly as a message typed into claude.ai would be.
  */
 /** Every Remote Control exchange on the API host sits under this path prefix. */
 declare const RC_SESSIONS_PATH_PREFIX = "/v1/code/sessions";
@@ -1670,6 +1672,40 @@ declare const RC_SESSIONS_PATH_PREFIX = "/v1/code/sessions";
  * How long an entry survives without any observed exchange for its session. Derived from the protocol's own liveness, not chosen: the worker heartbeats every 20 s (the `current_interval_seconds` our own captured heartbeat body carries), so a live session produces observable traffic at least that often, and the transport's documented liveness bound is the 45 s stream timeout, which outlasts two missed heartbeat intervals (40 s) precisely so a momentarily quiet session is not dropped. An entry idle past 45 s therefore names a session the protocol itself has given up on, which makes 45 s the exact bound where retaining it stops describing anything live.
  */
 declare const RC_IDLE_EXPIRY_MS = 45000;
+/**
+ * How long a control request stays answerable once observed. The protocol's own permission round-trip is documented at roughly 10 to 14 seconds end to end, so the ceiling of that window is the exact bound after which the worker has already given up waiting: answering later would write a `control_response` nothing is waiting for. A request exactly at the bound is already too late, which is why expiry is `>=` and not `>`.
+ */
+declare const RC_PENDING_DEADLINE_MS = 14000;
+/**
+ * How much of one request body the tracker ever holds while parsing it. The protocol's own batch cap is 10 MiB, but that bound exists to admit bulk transcript events the tracker has no use for; what it reads out of a body (the control requests, the heartbeat's idle, the worker's state) is one control exchange's worth of JSON, the same notion of "a full exchange's body" the capture's per-exchange budget (`STREAM_LOG_CAP_BYTES`, 256 KiB) was sized for, so one budget serves both here. A body past it is skipped, never failed: the exchange flows on untouched and simply records nothing.
+ */
+declare const RC_REQUEST_PARSE_CAP_BYTES = 262144;
+/** One pending control request as the control surface lists it: identification, type, summary and timing, never any credential. */
+interface RcPendingRequestSummary {
+    readonly sessionId: string;
+    /** The id a matching `control_response` must echo: the payload's `request_id`, the field the protocol's trust rule names. */
+    readonly requestId: string;
+    /** The request's subtype (`can_use_tool` and kin), or the payload discriminator when the subtype is absent. */
+    readonly type: string;
+    /** A short human-readable sketch: the tool name and a bounded excerpt of its input for `can_use_tool`. */
+    readonly summary: string;
+    /** When the request was observed, in epoch milliseconds from the injected clock. */
+    readonly observedAt: number;
+}
+/** One observed fact about the worker, with the instant of the exchange that carried it. */
+interface RcWorkerFact<T> {
+    readonly value: T;
+    readonly observedAt: number;
+}
+/** One observed session as the status surface reports it: the list summary plus what the worker's own exchanges carried and the requests awaiting an answer, never the credential. */
+interface RcSessionStatus extends RcSessionSummary {
+    /** The worker state the latest worker registration (`PUT /{id}/worker`) named, when one was observed. */
+    readonly workerState: RcWorkerFact<string> | undefined;
+    /** The idle the latest heartbeat carried, when one was observed. */
+    readonly workerIdleSeconds: RcWorkerFact<number> | undefined;
+    /** The session's control requests awaiting an answer, oldest-observed first. */
+    readonly pending: readonly RcPendingRequestSummary[];
+}
 /** One observed session as the control surface lists it: the identification and timing only, never the credential. */
 interface RcSessionSummary {
     readonly id: string;
@@ -1684,8 +1720,12 @@ interface RcObservedRequest {
     readonly url?: string;
     readonly headers: Readonly<IncomingHttpHeaders>;
 }
-/** What one observed exchange's response drives, in arrival order: the head, each body chunk, then the end exactly once. */
+/** What one observed exchange drives, in arrival order: the request body chunks and their end (present only for the exchanges whose request payloads the tracker reads), then the response's head, each body chunk, and the end exactly once. */
 interface RcExchangeObserver {
+    /** Feeds one request body chunk, when this exchange's request body carries something the tracker reads; absent otherwise, so an adapter never attaches a body listener for the exchanges that do not. */
+    readonly onRequestChunk?: (chunk: Uint8Array) => void;
+    /** The request body ended: the buffered body is parsed here, and its facts filed once the response is known to be a success. */
+    readonly onRequestEnd?: () => void;
     readonly onResponse: (status: number, headers: Readonly<IncomingHttpHeaders>) => void;
     readonly onBodyChunk: (chunk: Uint8Array) => void;
     readonly onEnd: () => void;
@@ -1698,19 +1738,25 @@ interface RcSessionTrackerDeps {
 }
 /** The live record of observed Remote Control sessions. */
 interface RcSessionTracker {
-    /** Feeds one request/response exchange in: returns the observer its response drives when the request belongs to the Remote Control surface, or undefined when it does not, in which case nothing is retained and the response needs no observing. */
+    /** Feeds one request/response exchange in: returns the observer its request and response drive when the request belongs to the Remote Control surface, or undefined when it does not, in which case nothing is retained and neither side needs observing. */
     readonly observeExchange: (request: RcObservedRequest) => RcExchangeObserver | undefined;
     /** Every live entry, idle ones expired first, sorted oldest-created first. */
     readonly list: () => readonly RcSessionSummary[];
-    /** The observed credential and protocol headers for one session, the inject path's accessor: present only while the session is tracked, and never surfaced anywhere a summary, log or capture goes. */
+    /** Every live entry as the status surface reports it, with the same sweeping and order as `list`, filtered to one session when named. */
+    readonly statusOf: (sessionId?: string) => readonly RcSessionStatus[];
+    /** Every control request awaiting an answer, deadline-expired ones dropped first, oldest-observed first, filtered to one session when named. */
+    readonly pendingOf: (sessionId?: string) => readonly RcPendingRequestSummary[];
+    /** The observed credential and protocol headers for one session, the client-half writes' accessor: present only while the session is tracked, and never surfaced anywhere a summary, log or capture goes. */
     readonly credentialOf: (sessionId: string) => RcObservedCredential | undefined;
+    /** Retires one pending control request as answered: what a successful answer write calls, so the request stops being listed the moment it is answered. */
+    readonly completePending: (sessionId: string, requestId: string) => void;
     /** Stops the idle sweep timer. The entries themselves are unreachable the moment the door drops them. */
     readonly close: () => void;
 }
 /** Creates the tracker. One per door process; everything it holds dies with it. */
 declare function createRcSessionTracker(deps: RcSessionTrackerDeps): RcSessionTracker;
 /**
- * Wraps one route so the tracker sees every exchange the route serves: the request's facts are handed over first, and when they are Remote Control facts the response the route writes is teed to the tracker's observer while flowing on unchanged. Used on the door's route resolution, so the bare `/v1/` pass-through an OAuth session's Remote Control calls ride is where observation happens.
+ * Wraps one route so the tracker sees every exchange the route serves: the request's facts are handed over first, and when they are Remote Control facts the request's body chunks and the response the route writes are teed to the tracker's observer while flowing on unchanged. Used on the door's route resolution, so the bare `/v1/` pass-through an OAuth session's Remote Control calls ride is where observation happens.
  */
 declare function observingRoutedRoute(route: FrontDoorRoute, tracker: RcSessionTracker): FrontDoorRoute;
 /** Adapts the tracker's exchange observer to the passthrough forwarding's observer shape, so the connect test world (which forwards rather than routes) observes through the same tracker. */
@@ -1721,33 +1767,33 @@ declare function rcObserverAsPassthrough(observer: RcExchangeObserver): Passthro
 declare function buildRcUserMessagePayload(uuid: string, sessionId: string, text: string): Record<string, unknown>;
 /** Wraps payload event(s) in the write body the endpoint takes: `{"events": [{"payload": {...}}]}`. */
 declare function buildRcEventWriteBody(payload: Record<string, unknown>): Record<string, unknown>;
-/** The headers injection sends: the observed credential and protocol values, replayed verbatim, never invented. */
-interface RcInjectHeaders {
+/** The headers a client-half write sends: the observed credential and protocol values, replayed verbatim, never invented. */
+interface RcWriteHeaders {
     readonly authorization: string | undefined;
     readonly anthropicVersion: string | undefined;
     readonly anthropicClientPlatform: string | undefined;
 }
-/** One answer from the API host the inject path dials: the status and the whole body. This dial only ever reads small JSON answers, never a stream, so the body needs no cap of its own. */
+/** One answer from the API host the write path dials: the status and the whole body. This dial only ever reads small JSON answers, never a stream, so the body needs no cap of its own. */
 interface RcDialAnswer {
     readonly status: number;
     readonly body: string;
 }
-/** The one network effect injection performs, injected so the pure logic runs against fakes: POST the write body to the session's events endpoint. Production dials the real API host over the door's interception-proof agent; tests redirect to a local stand-in. */
+/** The one network effect a client-half write performs, injected so the pure logic runs against fakes: POST the write body to the session's events endpoint. Production dials the real API host over the door's interception-proof agent; tests redirect to a local stand-in. */
 interface RcEventDial {
     readonly writeEvents: (sessionId: string, headers: Readonly<Record<string, string>>, body: string) => Promise<RcDialAnswer>;
 }
-/** What one injection attempt produced: the sequence numbers the real service assigned, or a verbose failure message ready to show a user. */
-type RcInjectResult = {
+/** What one client-half write produced: the sequence numbers the real service assigned, or a verbose failure message ready to show a user. */
+type RcEventWriteResult = {
     readonly ok: true;
     readonly sequenceNums: readonly number[];
 } | {
     readonly ok: false;
     readonly message: string;
 };
-/** Maps one dial answer to the inject result: an accepted write yields its sequence numbers; anything else yields a verbose message, with the 401 case naming the stale observed bearer as the cause. */
-declare function rcInjectResultFromAnswer(answer: RcDialAnswer): RcInjectResult;
-/** The credential and protocol headers the tracker holds for one session, the inject path's accessor: present only while the session is tracked, and never surfaced anywhere a summary, log or capture goes. */
-type RcObservedCredential = RcInjectHeaders;
+/** Maps one dial answer to the write result: an accepted write yields its sequence numbers; anything else yields a verbose message, with the 401 case naming the stale observed bearer as the cause. */
+declare function rcEventWriteResultFromAnswer(answer: RcDialAnswer): RcEventWriteResult;
+/** The credential and protocol headers the tracker holds for one session, the client-half writes' accessor: present only while the session is tracked, and never surfaced anywhere a summary, log or capture goes. */
+type RcObservedCredential = RcWriteHeaders;
 /** Everything one injection needs, injected so the decision logic runs against fakes in unit tests. */
 interface RcInjectDeps {
     /** Reads the observed credential for a session: the tracker's accessor, in production. */
@@ -1760,7 +1806,32 @@ interface RcInjectDeps {
 /**
  * Injects one user-message prompt into an observed session: the documented client-half write, `POST /v1/code/sessions/{id}/events`, authenticated by the observed bearer and carrying the observed protocol headers. The result is the sequence numbers the real service assigned, or a verbose failure. A dial that cannot reach the API host is reported rather than thrown, so a caller with no exception handling still shows the user exactly what failed.
  */
-declare function injectRcUserMessage(deps: RcInjectDeps, sessionId: string, text: string): Promise<RcInjectResult>;
+declare function injectRcUserMessage(deps: RcInjectDeps, sessionId: string, text: string): Promise<RcEventWriteResult>;
+/** The decision an answer carries: approve or deny, with the message a denial shows the worker (the protocol's allow result has no text field, so an approval carries none). */
+interface RcAnswerDecision {
+    readonly approve: boolean;
+    /** The denial message; undefined means the protocol's empty default. Present only with a denial. */
+    readonly message: string | undefined;
+}
+/**
+ * Builds the `control_response` payload event for one answer: the SDK's response envelope, `subtype: "success"` with the request's id echoed in `request_id`, carrying the permission result the worker is waiting for (`behavior: "allow"`, or `"deny"` with its message).
+ */
+declare function buildRcControlResponsePayload(requestId: string, decision: RcAnswerDecision): Record<string, unknown>;
+/** Everything one answer needs, injected so the decision logic runs against fakes in unit tests. */
+interface RcAnswerDeps {
+    /** Reads the observed credential for a session: the tracker's accessor, in production. */
+    readonly credentialOf: (sessionId: string) => RcObservedCredential | undefined;
+    /** Reads the session's pending control requests: the tracker's accessor, in production, so an answer is refused unless the request is still waiting. */
+    readonly pendingOf: (sessionId: string) => readonly RcPendingRequestSummary[];
+    /** Retires a pending request as answered: the tracker's accessor, in production, called only once the write is confirmed delivered. */
+    readonly completePending: (sessionId: string, requestId: string) => void;
+    /** The dial to the real API host. */
+    readonly dial: RcEventDial;
+}
+/**
+ * Answers one pending control request on an observed session: the same documented client-half write the inject path performs, carrying a `control_response` that echoes the request's id, authenticated by the observed bearer and protocol headers. The request must still be pending (an answered or deadline-expired request is refused verbosely, since writing a response nothing waits for would mislead the caller), and a successful write retires it. A dial that cannot reach the API host is reported rather than thrown.
+ */
+declare function answerRcControlRequest(deps: RcAnswerDeps, sessionId: string, requestId: string, decision: RcAnswerDecision): Promise<RcEventWriteResult>;
 
 /** Where the Remote Control inject path dials: the API host's own address by default, over TLS with the door's interception-proof agent (real-name DNS resolution and the pf-exempt source-port range), so an injected event cannot be looped back into the door's own transparent surface. A test redirects the dial at a local stand-in presenting the host's name, exactly as the forwarding targets are redirected. */
 interface RcDialTarget {
@@ -1780,9 +1851,9 @@ declare function realRcEventDial(target?: RcDialTarget): RcEventDial;
 declare function realConnectEffects(): ConnectEffects;
 
 /**
- * The Remote Control control surface: the small HTTP namespace the serving door answers on its provider listener, next to `/healthz`, through which `agent-shim frontdoor rc` lists the observed sessions and injects a prompt into one.
+ * The Remote Control control surface: the small HTTP namespace the serving door answers on its provider listener, next to `/healthz`, through which `agent-shim frontdoor rc` lists the observed sessions, reports each one's status and pending control requests, injects a prompt into one, and answers one of its pending requests.
  *
- * This rides the listener `frontdoor status` already knows the door by (its address comes from the same state file, its trust anchor from the same CA path) rather than any second channel. The routes sit under one prefix the routed pipeline never serves, and every request must present the serving generation's control token as a Bearer credential: a fresh random value per door start, written owner-only under the front door's state directory so only this user's CLI can read it, and checked in constant time like every other capability the door accepts. An inject request is carried out by the door itself over its interception-proof dials, which is the whole point: the CLI never dials the API host directly, so nothing about the injection depends on the caller's own network path.
+ * This rides the listener `frontdoor status` already knows the door by (its address comes from the same state file, its trust anchor from the same CA path) rather than any second channel. The routes sit under one prefix the routed pipeline never serves, and every request must present the serving generation's control token as a Bearer credential: a fresh random value per door start, written owner-only under the front door's state directory so only this user's CLI can read it, and checked in constant time like every other capability the door accepts. An inject or answer request is carried out by the door itself over its interception-proof dials, which is the whole point: the CLI never dials the API host directly, so nothing about the write depends on the caller's own network path.
  */
 /** The one path prefix every Remote Control control route sits under, answered before the routed pipeline like `/healthz` is. */
 declare const CONTROL_PATH_PREFIX = "/__agent-shim/rc";
@@ -1792,11 +1863,17 @@ interface RcControlHandlerDeps {
     readonly expectedToken: string;
     /** The observed sessions as the tracker lists them. */
     readonly list: () => readonly RcSessionSummary[];
+    /** The observed sessions as the tracker reports their status, filtered to one when named. */
+    readonly statusOf: (sessionId?: string) => readonly RcSessionStatus[];
+    /** The control requests awaiting an answer, filtered to one session when named. */
+    readonly pendingOf: (sessionId?: string) => readonly RcPendingRequestSummary[];
     /** The inject operation, already wired to the tracker and the door's API-host dial. */
-    readonly inject: (sessionId: string, text: string) => Promise<RcInjectResult>;
+    readonly inject: (sessionId: string, text: string) => Promise<RcEventWriteResult>;
+    /** The answer operation, already wired to the tracker and the door's API-host dial. */
+    readonly answer: (sessionId: string, requestId: string, decision: RcAnswerDecision) => Promise<RcEventWriteResult>;
 }
 /**
- * Builds the control handler the provider listener serves under `CONTROL_PATH_PREFIX`. Every route demands the generation's control token first, so nothing about the sessions (their ids, their timing, and most of all the prompts injected into them) is reachable by a process that did not read the owner-only token file.
+ * Builds the control handler the provider listener serves under `CONTROL_PATH_PREFIX`. Every route demands the generation's control token first, so nothing about the sessions (their ids, their timing, and most of all the prompts and approvals carried into them) is reachable by a process that did not read the owner-only token file.
  */
 declare function createRcControlHandler(deps: RcControlHandlerDeps): (request: IncomingMessage, response: ServerResponse) => void;
 /** One answer from the door's control listener. */
@@ -1815,12 +1892,18 @@ interface RcControlTransport {
 }
 /** The real transport: HTTPS to the door's provider listener on loopback, trusting only the CA file the door's own state names, so a process merely holding the port cannot answer as the door. */
 declare function realRcControlTransport(port: number, ca: string): RcControlTransport;
-/** The door-facing client the `frontdoor rc` verbs use: the session list and the inject operation, over the injected transport. */
+/** The door-facing client the `frontdoor rc` verbs use: the session list, the status and pending reads, and the inject and answer operations, over the injected transport. */
 interface FrontDoorRcControl {
     /** The observed sessions, oldest-created first. Throws with the door's verbose reason when the list cannot be had. */
     readonly listSessions: () => Promise<readonly RcSessionSummary[]>;
+    /** The observed sessions' status, oldest-created first and filtered to one when named. Throws with the door's verbose reason when the read cannot be had, including a named session the door has not observed. */
+    readonly statusOf: (sessionId?: string) => Promise<readonly RcSessionStatus[]>;
+    /** The control requests awaiting an answer, oldest-observed first and filtered to one session when named. Throws with the door's verbose reason when the read cannot be had. */
+    readonly pendingOf: (sessionId?: string) => Promise<readonly RcPendingRequestSummary[]>;
     /** Injects one prompt, returning the sequence numbers the real service assigned or the verbose failure. */
-    readonly sendPrompt: (sessionId: string, text: string) => Promise<RcInjectResult>;
+    readonly sendPrompt: (sessionId: string, text: string) => Promise<RcEventWriteResult>;
+    /** Answers one pending control request, returning the sequence numbers the real service assigned or the verbose failure. */
+    readonly answerRequest: (sessionId: string, requestId: string, decision: RcAnswerDecision) => Promise<RcEventWriteResult>;
 }
 /** Builds the control client: every request presents the control token, and a non-2xx answer becomes the verbose message the door sent with it. */
 declare function frontDoorRcControl(transport: RcControlTransport, token: string): FrontDoorRcControl;
@@ -3042,5 +3125,5 @@ interface PrepareClaudeLaunchOptions {
  */
 declare function prepareClaudeLaunch(options: PrepareClaudeLaunchOptions): LaunchPlan;
 
-export { AMBIENT_CREDENTIAL_VARS, CONNECT_INTERCEPT_HOST, CONNECT_INTERCEPT_HOSTS, CONNECT_LIMITS, CONTROL_PATH_PREFIX, CategoryClassificationOverlaySchema, CategoryClassificationSchema, CategoryMapSchema, CliError, ConfigProfileSchema, CredentialCacheSchema, CredentialSchema, CredentialSourceSchema, DirectoryRuleAlreadyExistsError, DirectoryRuleMissingTargetError, DirectoryRuleNotFoundError, DirectoryRuleSchema, DirectoryRulesSchema, EXIT_FAILURE, EXIT_USAGE, EntryValueSchema, FARM_MANIFEST_FILENAME, FrontDoorStartError, GlobalConfigSchema, HeadroomStartError, IdentityAlreadyExistsError, IdentityNotFoundError, IdentitySchema, InvalidCategoryNameError, InvalidIdentityNameError, InvalidProviderNameError, LaunchRefusedError, LegacyProviderFileError, PoolNameSchema, PoolNotFoundError, PoolSchema, PortableConfigSchema, ProfileAlreadyExistsError, ProfileNotFoundError, ProviderAlreadyExistsError, ProviderKindMismatchError, ProviderNotFoundError, ProviderSchema, RC_IDLE_EXPIRY_MS, RC_SESSIONS_PATH_PREFIX, ROUTED_PATH_PREFIX, UsageError, UsageSnapshotError, UsageSnapshotSchema, WhenSchema, addDirectoryRule, addIdentity, addPool, addProvider, buildEntryFacts, buildLayoutPaths, buildRcEventWriteBody, buildRcUserMessagePayload, carryOver, checkReportHasWarnings, checkReportToJson, collectCheckReport, collectDoctorReport, createLeafCache, createProfile, createRcControlHandler, createRcSessionTracker, describeProviderEndpoint, detectAmbientCredential, ensureCa, ensureFrontDoor, ensureHeadroom, evaluateAmbientCredentialGuard, formatAmbientCredentialGuardMessage, formatCheckReport, formatDoctorReport, forwardableHeaders, frontDoorRcControl, generateCa, identityExists, injectRcUserMessage, isIdentityDirectoryName, isInterceptedHost, listDirectoryRules, listIdentities, listProfiles, listProviders, listUsageSnapshots, mintLeaf, observingRoutedRoute, parseConnectTarget, prepareClaudeLaunch, prepareLaunch, profileExists, providerExists, rcInjectResultFromAnswer, rcObserverAsPassthrough, readActiveIdentity, readDirectoryRules, readFarmManifest, readGlobalConfig, readIdentity, readPools, readProfile, readProvider, readUsageSnapshot, realConnectCertStore, realConnectEffects, realRcControlTransport, realRcEventDial, recoverFarm, recoveryDiagnostics, removeDirectoryRule, removeIdentity, removePool, removeProfile, removeProvider, requirePool, resolveAgentShimHome, resolveClaudeHome, resolveDecisions, resolveLayoutPaths, resolveSupervisorConfig, resyncFarm, runCheck, runDoctor, runFrontDoorSupervisor, runSupervisor, servedByPipeline, setAllowAmbientCredential, setDefaultConfigProfile, setGlobalDefaultProfile, setIdentityCredential, setPool, setProfileCategories, setProfileEntries, setProfileLaunchFlags, setProfileMetadata, snapshotPath, startConnectServer, topLevelNames, updateDirectoryRule, updateProvider, useIdentity, writeDirectoryRules };
-export type { AddDirectoryRuleOptions, AddProviderInput, AmbientCredentialDetection, AmbientCredentialGuardResult, AmbientCredentialVar, BuildEntryFactsParams, CaMaterial, CarryOverParams, CarryOverResult, CategoryMap, CheckReport, CollectCheckReportParams, CollectDoctorReportParams, CompiledRule, ConfigProfile, ConnectCertStore, ConnectEffects, ConnectLimits, ConnectServerConfig, ConnectServerHandle, ConnectTarget, Credential, CredentialSource, Decision, Diagnostic, DirectoryRule, DirectoryRules, DoctorReport, EliminatedRule, EnsureFrontDoorPorts, EnsureHeadroomPorts, EntryFact, EntryFacts, EntryValue, EvaluateAmbientCredentialGuardParams, FlattenedCascade, FrontDoorRcControl, FrontDoorSupervisorPorts, GlobalConfig, HeadroomSupervisorConfig, Identity, IdentityCredentialChange, IdentityListEntry, IdentityListing, InjectedCredential, LaunchPlan, Layer, LayerId, LayoutPaths, LeafCert, Pool, PortableConfig, PrepareClaudeLaunchOptions, PrepareLaunchParams, ProfileListEntry, Provider, ProviderListEntry, RcControlAnswer, RcControlHandlerDeps, RcControlTransport, RcDialAnswer, RcDialTarget, RcEventDial, RcExchangeObserver, RcInjectDeps, RcInjectHeaders, RcInjectResult, RcObservedCredential, RcObservedRequest, RcSessionSummary, RcSessionTracker, RcSessionTrackerDeps, RecoverFarmParams, RecoveryResult, ResolveDecisionsInput, ResolvedState, ResyncFarmParams, ResyncFarmResult, RunCheckParams, RunDoctorParams, RunFrontDoorSupervisorOptions, RunSupervisorOptions, SupervisorPorts, UnreadableIdentityListEntry, UpdateDirectoryRuleOptions, UpdateProviderInput, UsageReadFs, UsageSnapshot, WhenCondition };
+export { AMBIENT_CREDENTIAL_VARS, CONNECT_INTERCEPT_HOST, CONNECT_INTERCEPT_HOSTS, CONNECT_LIMITS, CONTROL_PATH_PREFIX, CategoryClassificationOverlaySchema, CategoryClassificationSchema, CategoryMapSchema, CliError, ConfigProfileSchema, CredentialCacheSchema, CredentialSchema, CredentialSourceSchema, DirectoryRuleAlreadyExistsError, DirectoryRuleMissingTargetError, DirectoryRuleNotFoundError, DirectoryRuleSchema, DirectoryRulesSchema, EXIT_FAILURE, EXIT_USAGE, EntryValueSchema, FARM_MANIFEST_FILENAME, FrontDoorStartError, GlobalConfigSchema, HeadroomStartError, IdentityAlreadyExistsError, IdentityNotFoundError, IdentitySchema, InvalidCategoryNameError, InvalidIdentityNameError, InvalidProviderNameError, LaunchRefusedError, LegacyProviderFileError, PoolNameSchema, PoolNotFoundError, PoolSchema, PortableConfigSchema, ProfileAlreadyExistsError, ProfileNotFoundError, ProviderAlreadyExistsError, ProviderKindMismatchError, ProviderNotFoundError, ProviderSchema, RC_IDLE_EXPIRY_MS, RC_PENDING_DEADLINE_MS, RC_REQUEST_PARSE_CAP_BYTES, RC_SESSIONS_PATH_PREFIX, ROUTED_PATH_PREFIX, UsageError, UsageSnapshotError, UsageSnapshotSchema, WhenSchema, addDirectoryRule, addIdentity, addPool, addProvider, answerRcControlRequest, buildEntryFacts, buildLayoutPaths, buildRcControlResponsePayload, buildRcEventWriteBody, buildRcUserMessagePayload, carryOver, checkReportHasWarnings, checkReportToJson, collectCheckReport, collectDoctorReport, createLeafCache, createProfile, createRcControlHandler, createRcSessionTracker, describeProviderEndpoint, detectAmbientCredential, ensureCa, ensureFrontDoor, ensureHeadroom, evaluateAmbientCredentialGuard, formatAmbientCredentialGuardMessage, formatCheckReport, formatDoctorReport, forwardableHeaders, frontDoorRcControl, generateCa, identityExists, injectRcUserMessage, isIdentityDirectoryName, isInterceptedHost, listDirectoryRules, listIdentities, listProfiles, listProviders, listUsageSnapshots, mintLeaf, observingRoutedRoute, parseConnectTarget, prepareClaudeLaunch, prepareLaunch, profileExists, providerExists, rcEventWriteResultFromAnswer, rcObserverAsPassthrough, readActiveIdentity, readDirectoryRules, readFarmManifest, readGlobalConfig, readIdentity, readPools, readProfile, readProvider, readUsageSnapshot, realConnectCertStore, realConnectEffects, realRcControlTransport, realRcEventDial, recoverFarm, recoveryDiagnostics, removeDirectoryRule, removeIdentity, removePool, removeProfile, removeProvider, requirePool, resolveAgentShimHome, resolveClaudeHome, resolveDecisions, resolveLayoutPaths, resolveSupervisorConfig, resyncFarm, runCheck, runDoctor, runFrontDoorSupervisor, runSupervisor, servedByPipeline, setAllowAmbientCredential, setDefaultConfigProfile, setGlobalDefaultProfile, setIdentityCredential, setPool, setProfileCategories, setProfileEntries, setProfileLaunchFlags, setProfileMetadata, snapshotPath, startConnectServer, topLevelNames, updateDirectoryRule, updateProvider, useIdentity, writeDirectoryRules };
+export type { AddDirectoryRuleOptions, AddProviderInput, AmbientCredentialDetection, AmbientCredentialGuardResult, AmbientCredentialVar, BuildEntryFactsParams, CaMaterial, CarryOverParams, CarryOverResult, CategoryMap, CheckReport, CollectCheckReportParams, CollectDoctorReportParams, CompiledRule, ConfigProfile, ConnectCertStore, ConnectEffects, ConnectLimits, ConnectServerConfig, ConnectServerHandle, ConnectTarget, Credential, CredentialSource, Decision, Diagnostic, DirectoryRule, DirectoryRules, DoctorReport, EliminatedRule, EnsureFrontDoorPorts, EnsureHeadroomPorts, EntryFact, EntryFacts, EntryValue, EvaluateAmbientCredentialGuardParams, FlattenedCascade, FrontDoorRcControl, FrontDoorSupervisorPorts, GlobalConfig, HeadroomSupervisorConfig, Identity, IdentityCredentialChange, IdentityListEntry, IdentityListing, InjectedCredential, LaunchPlan, Layer, LayerId, LayoutPaths, LeafCert, Pool, PortableConfig, PrepareClaudeLaunchOptions, PrepareLaunchParams, ProfileListEntry, Provider, ProviderListEntry, RcAnswerDecision, RcAnswerDeps, RcControlAnswer, RcControlHandlerDeps, RcControlTransport, RcDialAnswer, RcDialTarget, RcEventDial, RcEventWriteResult, RcExchangeObserver, RcInjectDeps, RcObservedCredential, RcObservedRequest, RcPendingRequestSummary, RcSessionStatus, RcSessionSummary, RcSessionTracker, RcSessionTrackerDeps, RcWorkerFact, RcWriteHeaders, RecoverFarmParams, RecoveryResult, ResolveDecisionsInput, ResolvedState, ResyncFarmParams, ResyncFarmResult, RunCheckParams, RunDoctorParams, RunFrontDoorSupervisorOptions, RunSupervisorOptions, SupervisorPorts, UnreadableIdentityListEntry, UpdateDirectoryRuleOptions, UpdateProviderInput, UsageReadFs, UsageSnapshot, WhenCondition };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-shim",
-  "version": "8.3.0",
+  "version": "8.4.0",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",