agent-shim 8.34.0 → 8.35.0

package/dist/cli.cjs

@@ -18047,7 +18047,7 @@ var require_api_pipeline = __commonJS({
     var {
       Readable: Readable2,
       Duplex,
-      PassThrough
+      PassThrough: PassThrough2
     } = require("node:stream");
     var assert2 = require("node:assert");
     var { AsyncResource } = require("node:async_hooks");
@@ -18234,7 +18234,7 @@ var require_api_pipeline = __commonJS({
         this.dispatch({ ...opts, body: pipelineHandler.req }, pipelineHandler);
         return pipelineHandler.ret;
       } catch (err) {
-        return new PassThrough().destroy(err);
+        return new PassThrough2().destroy(err);
       }
     }
     module2.exports = pipeline;
@@ -57101,13 +57101,21 @@ var CodexProviderConfigSchema = external_exports.strictObject({
   /** Which login the upstream call is made with; see `CODEX_LOGINS`. */
   login: external_exports.enum(CODEX_LOGINS).optional()
 });
+var ProviderRouteSchema = external_exports.strictObject({
+  /** The condition, the same `when` union a configuration cascade entry takes: the object form or a trilean predicate tree over the request facts the door resolves (`request.model` and kin). */
+  when: WhenSchema,
+  /** The provider a matching request is sent to, by the name a provider file carries. */
+  provider: external_exports.string().min(1)
+});
 var HttpProviderSchema = external_exports.strictObject({
   $schema: external_exports.string().optional(),
   kind: external_exports.literal("http").optional(),
   displayName: external_exports.string().min(1),
   baseUrl: external_exports.url(),
   credential: ProviderCredentialSchema,
-  env: ProviderEnvSchema.optional()
+  env: ProviderEnvSchema.optional(),
+  /** Per-request routing: when present, each request this provider would serve is matched against the list in order, and the first definite match is sent to that entry's provider instead (itself resolved exactly as a directly dialled request would be). Unmatched requests stay on this provider. */
+  routes: external_exports.array(ProviderRouteSchema).optional()
 });
 var CodexProviderSchema = external_exports.strictObject({
   $schema: external_exports.string().optional(),
@@ -60930,7 +60938,9 @@ function resolversOf(context) {
     ...pool?.sevenDay === void 0 ? {} : { "quota.sevenDay.remaining": pool.sevenDay.remaining, "quota.sevenDay.utilization": pool.sevenDay.utilization, "quota.sevenDay.hoursUntilReset": pool.sevenDay.hoursUntilReset },
     ...pool?.burnPerHour === void 0 ? {} : { "quota.burnPerHour": pool.burnPerHour },
     ...pool?.resuming === void 0 ? {} : { "session.resuming": pool.resuming },
-    ...pool?.lastPickHoursAgo === void 0 ? {} : { "session.lastPickHoursAgo": pool.lastPickHoursAgo }
+    ...pool?.lastPickHoursAgo === void 0 ? {} : { "session.lastPickHoursAgo": pool.lastPickHoursAgo },
+    ...context.request?.model === void 0 ? {} : { "request.model": context.request.model },
+    ...context.request?.hasImage === void 0 ? {} : { "request.hasImage": context.request.hasImage }
   };
   return {
     resolveValue: (key) => {
@@ -63665,7 +63675,7 @@ function registerIdentityCommand(program2, deps) {
 // package.json
 var package_default = {
   name: "agent-shim",
-  version: "8.34.0",
+  version: "8.35.0",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -77382,6 +77392,74 @@ function createPassthroughRoute(name, target) {
   };
 }
 
+// src/frontdoor/requestScan.ts
+var import_node_stream2 = require("node:stream");
+var BYTES_PER_KIB = 1024;
+var SCAN_KIB = 64;
+var REQUEST_SCAN_CAP_BYTES = SCAN_KIB * BYTES_PER_KIB;
+async function scanRequestHead(request7) {
+  const body = request7.body;
+  const head = [];
+  let seen = 0;
+  let text2 = "";
+  let decided = false;
+  let ended = false;
+  let error62;
+  const replay = new import_node_stream2.PassThrough();
+  const modelIn = () => /"model"\s*:\s*"([^"]+)"/.exec(text2)?.[1];
+  const settled = new Promise((resolve) => {
+    const settle2 = () => {
+      const model = modelIn();
+      const hasImage = /"type"\s*:\s*"image"/.test(text2);
+      for (const chunk of head) {
+        replay.write(chunk);
+      }
+      resolve({ ...model === void 0 ? {} : { model }, hasImage, replayed: { ...request7, body: replay } });
+    };
+    body.on("data", (chunk) => {
+      if (decided) {
+        if (!replay.write(chunk)) {
+          body.pause();
+          replay.once("drain", () => {
+            body.resume();
+          });
+        }
+        return;
+      }
+      head.push(chunk);
+      seen += chunk.length;
+      text2 += chunk.toString("utf8");
+      if (modelIn() !== void 0 || seen >= REQUEST_SCAN_CAP_BYTES) {
+        decided = true;
+        body.pause();
+        replay.once("resume", () => {
+          body.resume();
+        });
+        settle2();
+      }
+    });
+    body.on("end", () => {
+      ended = true;
+      if (!decided) {
+        decided = true;
+        settle2();
+      }
+      replay.end();
+    });
+    body.on("error", (cause) => {
+      error62 = cause;
+      replay.destroy(cause);
+    });
+    body.on("close", () => {
+      if (!decided && !ended && error62 === void 0) {
+        decided = true;
+        settle2();
+      }
+    });
+  });
+  return await settled;
+}
+
 // src/frontdoor/providerRoute.ts
 function createProviderRouteResolver(deps) {
   const isRcSelfHostPath = (path46) => path46 === "/v1/code/sessions" || path46.startsWith("/v1/code/sessions/") || path46 === "/v1/sessions" || path46.startsWith("/v1/sessions/");
@@ -77446,7 +77524,64 @@ function createProviderRouteResolver(deps) {
       )
     };
   };
-  return async (request7) => await Promise.resolve(resolve(request7));
+  const servingRewritten = (route, url2, body) => ({
+    name: route.name,
+    headroomEligible: route.headroomEligible,
+    headroomUpstream: route.headroomUpstream,
+    // The pipeline serves the route with the request it received; the routing layer's decisions (the rewritten target path, the replayed body) are substituted here, so the route sees exactly the request the resolution acted on.
+    serve: async (request7, response) => {
+      await route.serve({ ...request7, url: url2, body }, response);
+    }
+  });
+  return async (request7) => {
+    let current = request7;
+    let replay;
+    const visited = /* @__PURE__ */ new Set();
+    for (; ; ) {
+      const path46 = new URL(current.url, "http://127.0.0.1").pathname;
+      const scoped = parseProviderPath(path46);
+      const providerName = scoped?.provider ?? current.session.provider;
+      if (providerName !== void 0 && visited.has(providerName)) {
+        return { ok: false, status: HTTP_STATUS.internalServerError, message: `provider routing cycle: ${[...visited, providerName].join(" -> ")}` };
+      }
+      if (providerName !== void 0) {
+        visited.add(providerName);
+      }
+      let routes;
+      try {
+        const definition = providerName === void 0 ? void 0 : loadProvider(deps.providersDir, providerName, deps.fs);
+        routes = definition === void 0 || isCodexProvider(definition) ? void 0 : definition.routes;
+      } catch {
+        routes = void 0;
+      }
+      if (routes === void 0 || routes.length === 0) {
+        const resolution = resolve(current);
+        return resolution.ok && replay !== void 0 ? { ok: true, route: servingRewritten(resolution.route, current.url, replay.body) } : resolution;
+      }
+      const scan = await scanRequestHead(current);
+      if (scan.replayed === void 0) {
+        const resolution = resolve(current);
+        return resolution.ok && replay !== void 0 ? { ok: true, route: servingRewritten(resolution.route, current.url, replay.body) } : resolution;
+      }
+      replay = scan.replayed;
+      const context = { nowMs: Date.now(), env: deps.env, ...scan.model === void 0 && scan.hasImage === void 0 ? {} : { request: { ...scan.model === void 0 ? {} : { model: scan.model }, hasImage: scan.hasImage } } };
+      let matched;
+      for (const entry of routes) {
+        const verdict = evaluateWhen(entry.when, context);
+        if (verdict.status === "definite" && verdict.passed) {
+          matched = entry.provider;
+          break;
+        }
+      }
+      if (matched === void 0) {
+        const resolution = resolve(current);
+        return resolution.ok ? { ok: true, route: servingRewritten(resolution.route, current.url, replay.body) } : resolution;
+      }
+      const rest = scoped === void 0 ? path46 : path46.slice(`${PROVIDER_PATH_PREFIX}${encodeURIComponent(scoped.provider)}`.length);
+      const query = current.url.includes("?") ? current.url.slice(current.url.indexOf("?")) : "";
+      current = { ...current, url: `${PROVIDER_PATH_PREFIX}${encodeURIComponent(matched)}${rest}${query}`, body: replay.body };
+    }
+  };
 }
 function providerCredentialHeaders(credential) {
   return credential.target === "apiKey" ? { "x-api-key": credential.token } : { authorization: `Bearer ${credential.token}` };

package/dist/index.cjs

@@ -589,13 +589,21 @@ var CodexProviderConfigSchema = import_zod.z.strictObject({
   /** Which login the upstream call is made with; see `CODEX_LOGINS`. */
   login: import_zod.z.enum(CODEX_LOGINS).optional()
 });
+var ProviderRouteSchema = import_zod.z.strictObject({
+  /** The condition, the same `when` union a configuration cascade entry takes: the object form or a trilean predicate tree over the request facts the door resolves (`request.model` and kin). */
+  when: WhenSchema,
+  /** The provider a matching request is sent to, by the name a provider file carries. */
+  provider: import_zod.z.string().min(1)
+});
 var HttpProviderSchema = import_zod.z.strictObject({
   $schema: import_zod.z.string().optional(),
   kind: import_zod.z.literal("http").optional(),
   displayName: import_zod.z.string().min(1),
   baseUrl: import_zod.z.url(),
   credential: ProviderCredentialSchema,
-  env: ProviderEnvSchema.optional()
+  env: ProviderEnvSchema.optional(),
+  /** Per-request routing: when present, each request this provider would serve is matched against the list in order, and the first definite match is sent to that entry's provider instead (itself resolved exactly as a directly dialled request would be). Unmatched requests stay on this provider. */
+  routes: import_zod.z.array(ProviderRouteSchema).optional()
 });
 var CodexProviderSchema = import_zod.z.strictObject({
   $schema: import_zod.z.string().optional(),
@@ -1018,7 +1026,9 @@ function resolversOf(context) {
     ...pool?.sevenDay === void 0 ? {} : { "quota.sevenDay.remaining": pool.sevenDay.remaining, "quota.sevenDay.utilization": pool.sevenDay.utilization, "quota.sevenDay.hoursUntilReset": pool.sevenDay.hoursUntilReset },
     ...pool?.burnPerHour === void 0 ? {} : { "quota.burnPerHour": pool.burnPerHour },
     ...pool?.resuming === void 0 ? {} : { "session.resuming": pool.resuming },
-    ...pool?.lastPickHoursAgo === void 0 ? {} : { "session.lastPickHoursAgo": pool.lastPickHoursAgo }
+    ...pool?.lastPickHoursAgo === void 0 ? {} : { "session.lastPickHoursAgo": pool.lastPickHoursAgo },
+    ...context.request?.model === void 0 ? {} : { "request.model": context.request.model },
+    ...context.request?.hasImage === void 0 ? {} : { "request.hasImage": context.request.hasImage }
   };
   return {
     resolveValue: (key) => {
@@ -5399,7 +5409,7 @@ var import_undici = require("undici");
 // package.json
 var package_default = {
   name: "agent-shim",
-  version: "8.34.0",
+  version: "8.35.0",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",

package/dist/index.mjs

@@ -277,13 +277,21 @@ var CodexProviderConfigSchema = z.strictObject({
   /** Which login the upstream call is made with; see `CODEX_LOGINS`. */
   login: z.enum(CODEX_LOGINS).optional()
 });
+var ProviderRouteSchema = z.strictObject({
+  /** The condition, the same `when` union a configuration cascade entry takes: the object form or a trilean predicate tree over the request facts the door resolves (`request.model` and kin). */
+  when: WhenSchema,
+  /** The provider a matching request is sent to, by the name a provider file carries. */
+  provider: z.string().min(1)
+});
 var HttpProviderSchema = z.strictObject({
   $schema: z.string().optional(),
   kind: z.literal("http").optional(),
   displayName: z.string().min(1),
   baseUrl: z.url(),
   credential: ProviderCredentialSchema,
-  env: ProviderEnvSchema.optional()
+  env: ProviderEnvSchema.optional(),
+  /** Per-request routing: when present, each request this provider would serve is matched against the list in order, and the first definite match is sent to that entry's provider instead (itself resolved exactly as a directly dialled request would be). Unmatched requests stay on this provider. */
+  routes: z.array(ProviderRouteSchema).optional()
 });
 var CodexProviderSchema = z.strictObject({
   $schema: z.string().optional(),
@@ -706,7 +714,9 @@ function resolversOf(context) {
     ...pool?.sevenDay === void 0 ? {} : { "quota.sevenDay.remaining": pool.sevenDay.remaining, "quota.sevenDay.utilization": pool.sevenDay.utilization, "quota.sevenDay.hoursUntilReset": pool.sevenDay.hoursUntilReset },
     ...pool?.burnPerHour === void 0 ? {} : { "quota.burnPerHour": pool.burnPerHour },
     ...pool?.resuming === void 0 ? {} : { "session.resuming": pool.resuming },
-    ...pool?.lastPickHoursAgo === void 0 ? {} : { "session.lastPickHoursAgo": pool.lastPickHoursAgo }
+    ...pool?.lastPickHoursAgo === void 0 ? {} : { "session.lastPickHoursAgo": pool.lastPickHoursAgo },
+    ...context.request?.model === void 0 ? {} : { "request.model": context.request.model },
+    ...context.request?.hasImage === void 0 ? {} : { "request.hasImage": context.request.hasImage }
   };
   return {
     resolveValue: (key) => {
@@ -5087,7 +5097,7 @@ import { Agent as Agent3, fetch as undiciFetch } from "undici";
 // package.json
 var package_default = {
   name: "agent-shim",
-  version: "8.34.0",
+  version: "8.35.0",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",

package/dist/types/index.d.ts

@@ -4,7 +4,7 @@ import * as zod from 'zod';
 import { z } from 'zod';
 import { IncomingHttpHeaders, IncomingMessage, ServerResponse } from 'node:http';
 import * as net from 'node:net';
-import { Duplex } from 'node:stream';
+import { Duplex, Readable } from 'node:stream';
 import * as _orpc_client from '@orpc/client';
 import * as zod_v4_core from 'zod/v4/core';
 import * as _orpc_server from '@orpc/server';
@@ -446,6 +446,81 @@ declare const ProviderSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         }>>;
     }, z.core.$strict>;
     env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    routes: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        when: z.ZodUnion<readonly [z.ZodObject<{
+            newerThan: z.ZodOptional<z.ZodString>;
+            olderThan: z.ZodOptional<z.ZodString>;
+            maxSizeBytes: z.ZodOptional<z.ZodInt>;
+            branch: z.ZodOptional<z.ZodString>;
+            env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, z.core.$strict>, z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"not">;
+            operand: typeof PredicateNodeSchema;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"and">;
+            left: typeof PredicateNodeSchema;
+            right: typeof PredicateNodeSchema;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"or">;
+            left: typeof PredicateNodeSchema;
+            right: typeof PredicateNodeSchema;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"allOf">;
+            operands: z.ZodArray<typeof PredicateNodeSchema>;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"anyOf">;
+            operands: z.ZodArray<typeof PredicateNodeSchema>;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"compare">;
+            op: z.ZodEnum<{
+                gt: "gt";
+                gte: "gte";
+                lt: "lt";
+                lte: "lte";
+                eq: "eq";
+                neq: "neq";
+            }>;
+            left: typeof trilean.ExpressionNodeSchema;
+            right: typeof trilean.ExpressionNodeSchema;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"textCompare">;
+            op: z.ZodEnum<{
+                equals: "equals";
+                notEquals: "notEquals";
+                matches: "matches";
+                notMatches: "notMatches";
+                portableMatches: "portableMatches";
+                portableNotMatches: "portableNotMatches";
+            }>;
+            left: typeof trilean.ExpressionNodeSchema;
+            right: typeof trilean.ExpressionNodeSchema;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"memberOf">;
+            op: z.ZodEnum<{
+                in: "in";
+                notIn: "notIn";
+            }>;
+            operand: typeof trilean.ExpressionNodeSchema;
+            candidates: z.ZodArray<typeof trilean.ExpressionNodeSchema>;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"exists">;
+            operand: typeof trilean.ExpressionNodeSchema;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"some">;
+            collection: z.ZodType<trilean.JsonValue, unknown, z.core.$ZodTypeInternals<trilean.JsonValue, unknown>>;
+            item: typeof PredicateNodeSchema;
+            filter: z.ZodOptional<typeof PredicateNodeSchema>;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"every">;
+            collection: z.ZodType<trilean.JsonValue, unknown, z.core.$ZodTypeInternals<trilean.JsonValue, unknown>>;
+            item: typeof PredicateNodeSchema;
+            filter: z.ZodOptional<typeof PredicateNodeSchema>;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"treeReference">;
+            key: z.ZodType<trilean.JsonValue, unknown, z.core.$ZodTypeInternals<trilean.JsonValue, unknown>>;
+        }, z.core.$strip>], "kind">]>;
+        provider: z.ZodString;
+    }, z.core.$strict>>>;
 }, z.core.$strict>, z.ZodObject<{
     $schema: z.ZodOptional<z.ZodString>;
     kind: z.ZodLiteral<"codex">;
@@ -2665,8 +2740,8 @@ interface RoutedRequest {
     readonly url: string;
     /** The request's headers with every internal header already stripped: exactly what a route may forward onwards. */
     readonly headers: IncomingHttpHeaders;
-    /** The request's body stream: a route either pipes it onward untouched or reads it whole, never both. */
-    readonly body: IncomingMessage;
+    /** The request's body stream: a route either pipes it onward untouched or reads it whole, never both. A readable, not the socket-bound type the pipeline received it as, because the routing layer's scan hands routes a replayed body (the scanned head re-emitted in front of the unread remainder) that is a plain stream. */
+    readonly body: Readable;
     /** Aborted the moment the client goes away; a route aborts its own upstream work with it. */
     readonly signal: AbortSignal;
     readonly session: SessionIdentity;
@@ -5378,12 +5453,12 @@ declare function createControlApiRouter(deps: ControlApiDeps): {
                     identity: "identity";
                     provider: "provider";
                     pool: "pool";
+                    keychain: "keychain";
                     "ambient-credential": "ambient-credential";
                     "binary-discovery": "binary-discovery";
                     "claude-shim": "claude-shim";
                     "path-resolution": "path-resolution";
                     "legacy-name": "legacy-name";
-                    keychain: "keychain";
                     "directory-rules": "directory-rules";
                     "categories-local": "categories-local";
                     "active-identity": "active-identity";
@@ -5959,12 +6034,12 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                     identity: "identity";
                     provider: "provider";
                     pool: "pool";
+                    keychain: "keychain";
                     "ambient-credential": "ambient-credential";
                     "binary-discovery": "binary-discovery";
                     "claude-shim": "claude-shim";
                     "path-resolution": "path-resolution";
                     "legacy-name": "legacy-name";
-                    keychain: "keychain";
                     "directory-rules": "directory-rules";
                     "categories-local": "categories-local";
                     "active-identity": "active-identity";
@@ -6449,12 +6524,12 @@ declare const DoctorFindingSchema: z.ZodObject<{
         identity: "identity";
         provider: "provider";
         pool: "pool";
+        keychain: "keychain";
         "ambient-credential": "ambient-credential";
         "binary-discovery": "binary-discovery";
         "claude-shim": "claude-shim";
         "path-resolution": "path-resolution";
         "legacy-name": "legacy-name";
-        keychain: "keychain";
         "directory-rules": "directory-rules";
         "categories-local": "categories-local";
         "active-identity": "active-identity";
@@ -6478,12 +6553,12 @@ declare const DoctorRunOutputSchema: z.ZodObject<{
             identity: "identity";
             provider: "provider";
             pool: "pool";
+            keychain: "keychain";
             "ambient-credential": "ambient-credential";
             "binary-discovery": "binary-discovery";
             "claude-shim": "claude-shim";
             "path-resolution": "path-resolution";
             "legacy-name": "legacy-name";
-            keychain: "keychain";
             "directory-rules": "directory-rules";
             "categories-local": "categories-local";
             "active-identity": "active-identity";
@@ -7033,6 +7108,13 @@ interface ConditionContext {
         readonly resuming?: boolean;
         readonly lastPickHoursAgo?: number;
     };
+    /**
+     * The request facts a provider's route condition reads, present only when the condition routes a request the door is resolving: `request.model` (the Messages body's own model field) and `request.hasImage` (an image block anywhere in the scanned head of the body). A request the door could not read that far carries neither, so a condition naming them is indeterminate and the routing falls through, never to a cheaper provider by accident.
+     */
+    readonly request?: {
+        readonly model?: string;
+        readonly hasImage?: boolean;
+    };
 }
 /**
  * The result of evaluating one `when`: definite, with which condition fields were present and which of those did not hold, or indeterminate, when a datum the condition needed is missing. Indeterminate is not false: a missing fact has not failed the condition, it has left it undecided, and the consumer decides what an undecided entry does (the resolver keeps today's behaviour of not passing it, so nothing changes for existing configurations; the pool ranking of #258 instead keeps such a member but ranks it last, naming the missing fact).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-shim",
-  "version": "8.34.0",
+  "version": "8.35.0",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",