agent-shim 8.5.0 → 8.5.1

package/dist/cli.cjs

@@ -61040,7 +61040,7 @@ function registerIdentityCommand(program2, deps) {
 // package.json
 var package_default = {
   name: "agent-shim",
-  version: "8.5.0",
+  version: "8.5.1",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -64924,13 +64924,14 @@ function realConnectCertStore(paths) {
 }
 
 // src/frontdoor/connectEffects.ts
-var dns = __toESM(require("node:dns"), 1);
+var import_node_dns = __toESM(require("node:dns"), 1);
 var http = __toESM(require("node:http"), 1);
 var https = __toESM(require("node:https"), 1);
 var net2 = __toESM(require("node:net"), 1);
 var tls = __toESM(require("node:tls"), 1);
 var UPSTREAM_LOCAL_PORT_START = 47900;
 var UPSTREAM_LOCAL_PORT_END = 47919;
+var UPSTREAM_LOCAL_PORT_COUNT = UPSTREAM_LOCAL_PORT_END - UPSTREAM_LOCAL_PORT_START + 1;
 var nextUpstreamLocalPort = UPSTREAM_LOCAL_PORT_START;
 function upstreamLocalPort() {
   const port = nextUpstreamLocalPort;
@@ -64942,42 +64943,93 @@ var realAddressLookup = (host, _options, callback) => {
     callback(null, [{ address: host, family: net2.isIP(host) }]);
     return;
   }
-  dns.resolve4(host, (error62, addresses) => {
+  import_node_dns.default.resolve4(host, (error62, addresses) => {
+    if (error62 !== null) {
+      callback(error62, [{ address: "", family: 4 }]);
+      return;
+    }
     const first = addresses[0];
-    if (error62 !== null || first === void 0) {
-      callback(error62 ?? new Error(`no A record for ${host}`), [{ address: "", family: 4 }]);
+    if (first === void 0) {
+      callback(new Error(`no A record for ${host}`), [{ address: "", family: 4 }]);
       return;
     }
     callback(null, [{ address: first, family: 4 }]);
   });
 };
 var HTTP_PORT = 80;
-function exemptDial(options, defaultPort) {
-  const host = typeof options.host === "string" ? options.host : "";
-  const port = typeof options.port === "number" ? options.port : defaultPort;
-  return net2.connect(net2.isIP(host) === 0 ? { host, port, localPort: upstreamLocalPort(), lookup: realAddressLookup } : { host, port });
+var HELD_PORT_ERRNOS = /* @__PURE__ */ new Set(["EADDRINUSE", "EADDRNOTAVAIL"]);
+async function dialOnce(connectOptions) {
+  return await new Promise((resolve) => {
+    const socket = net2.connect(connectOptions);
+    socket.once("connect", () => {
+      resolve({ error: null, socket });
+    });
+    socket.once("error", (error62) => {
+      resolve({ error: error62, socket });
+    });
+  });
+}
+function dialTarget(options, defaultPort) {
+  return { host: typeof options.host === "string" ? options.host : "", port: typeof options.port === "number" ? options.port : defaultPort };
+}
+function literalDial(target) {
+  return net2.connect({ host: target.host, port: target.port });
+}
+async function reservedDial(target) {
+  for (let attempt = 0; ; attempt += 1) {
+    const outcome = await dialOnce({ host: target.host, port: target.port, localPort: upstreamLocalPort(), lookup: realAddressLookup });
+    if (outcome.error === null) {
+      return outcome;
+    }
+    const held = outcome.error.code !== void 0 && HELD_PORT_ERRNOS.has(outcome.error.code);
+    if (!held || attempt === UPSTREAM_LOCAL_PORT_COUNT - 1) {
+      return outcome;
+    }
+  }
 }
 function requestServername(options, fallback) {
   return "servername" in options && typeof options.servername === "string" && options.servername !== "" ? options.servername : fallback;
 }
 var ExemptHttpAgent = class extends http.Agent {
-  createConnection(options) {
-    return exemptDial(options, HTTP_PORT);
+  // A reserved-port dial that has to retry cannot produce its socket synchronously, so it settles first and arrives through the callback (node's documented asynchronous createConnection form); a literal dial has nothing to retry and keeps node's own synchronous shape.
+  createConnection(options, oncreate) {
+    const target = dialTarget(options, HTTP_PORT);
+    if (net2.isIP(target.host) !== 0) {
+      return literalDial(target);
+    }
+    void reservedDial(target).then((outcome) => {
+      oncreate?.(outcome.error, outcome.socket);
+    });
+    return void 0;
   }
 };
 var ExemptTlsAgent = class extends https.Agent {
-  createConnection(options) {
-    const host = typeof options.host === "string" ? options.host : "";
-    const tlsOptions = { socket: exemptDial(options, HTTPS_PORT), servername: requestServername(options, host) };
-    if ("ca" in options && Array.isArray(options.ca)) {
-      tlsOptions.ca = options.ca;
-    }
-    if ("rejectUnauthorized" in options && typeof options.rejectUnauthorized === "boolean") {
-      tlsOptions.rejectUnauthorized = options.rejectUnauthorized;
-    }
-    return tls.connect(tlsOptions);
+  // The same split as the plain sibling: a literal dial wraps TLS around the socket node's own agent would have returned, a reserved dial settles (retries included) first and arrives through the callback, which is exactly where node's own agent wraps its own dials.
+  createConnection(options, oncreate) {
+    const target = dialTarget(options, HTTPS_PORT);
+    if (net2.isIP(target.host) !== 0) {
+      return tls.connect({ socket: literalDial(target), servername: requestServername(options, target.host), ...tlsFacts(options) });
+    }
+    void reservedDial(target).then((outcome) => {
+      if (outcome.error !== null) {
+        oncreate?.(outcome.error, outcome.socket);
+        return;
+      }
+      oncreate?.(null, tls.connect({ socket: outcome.socket, servername: requestServername(options, target.host), ...tlsFacts(options) }));
+    });
+    return void 0;
   }
 };
+function tlsFacts(options) {
+  const facts = {};
+  if ("ca" in options && Array.isArray(options.ca)) {
+    facts.ca = options.ca;
+  }
+  if ("rejectUnauthorized" in options && typeof options.rejectUnauthorized === "boolean") {
+    facts.rejectUnauthorized = options.rejectUnauthorized;
+  }
+  return facts;
+}
 function realRcEventDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
   return {

package/dist/index.cjs

@@ -3248,13 +3248,14 @@ function realConnectCertStore(paths) {
 }
 
 // src/frontdoor/connectEffects.ts
-var dns = __toESM(require("node:dns"), 1);
+var import_node_dns = __toESM(require("node:dns"), 1);
 var http = __toESM(require("node:http"), 1);
 var https = __toESM(require("node:https"), 1);
 var net2 = __toESM(require("node:net"), 1);
 var tls = __toESM(require("node:tls"), 1);
 var UPSTREAM_LOCAL_PORT_START = 47900;
 var UPSTREAM_LOCAL_PORT_END = 47919;
+var UPSTREAM_LOCAL_PORT_COUNT = UPSTREAM_LOCAL_PORT_END - UPSTREAM_LOCAL_PORT_START + 1;
 var nextUpstreamLocalPort = UPSTREAM_LOCAL_PORT_START;
 function upstreamLocalPort() {
   const port = nextUpstreamLocalPort;
@@ -3266,42 +3267,93 @@ var realAddressLookup = (host, _options, callback) => {
     callback(null, [{ address: host, family: net2.isIP(host) }]);
     return;
   }
-  dns.resolve4(host, (error, addresses) => {
+  import_node_dns.default.resolve4(host, (error, addresses) => {
+    if (error !== null) {
+      callback(error, [{ address: "", family: 4 }]);
+      return;
+    }
     const first = addresses[0];
-    if (error !== null || first === void 0) {
-      callback(error ?? new Error(`no A record for ${host}`), [{ address: "", family: 4 }]);
+    if (first === void 0) {
+      callback(new Error(`no A record for ${host}`), [{ address: "", family: 4 }]);
       return;
     }
     callback(null, [{ address: first, family: 4 }]);
   });
 };
 var HTTP_PORT = 80;
-function exemptDial(options, defaultPort) {
-  const host = typeof options.host === "string" ? options.host : "";
-  const port = typeof options.port === "number" ? options.port : defaultPort;
-  return net2.connect(net2.isIP(host) === 0 ? { host, port, localPort: upstreamLocalPort(), lookup: realAddressLookup } : { host, port });
+var HELD_PORT_ERRNOS = /* @__PURE__ */ new Set(["EADDRINUSE", "EADDRNOTAVAIL"]);
+async function dialOnce(connectOptions) {
+  return await new Promise((resolve) => {
+    const socket = net2.connect(connectOptions);
+    socket.once("connect", () => {
+      resolve({ error: null, socket });
+    });
+    socket.once("error", (error) => {
+      resolve({ error, socket });
+    });
+  });
+}
+function dialTarget(options, defaultPort) {
+  return { host: typeof options.host === "string" ? options.host : "", port: typeof options.port === "number" ? options.port : defaultPort };
+}
+function literalDial(target) {
+  return net2.connect({ host: target.host, port: target.port });
+}
+async function reservedDial(target) {
+  for (let attempt = 0; ; attempt += 1) {
+    const outcome = await dialOnce({ host: target.host, port: target.port, localPort: upstreamLocalPort(), lookup: realAddressLookup });
+    if (outcome.error === null) {
+      return outcome;
+    }
+    const held = outcome.error.code !== void 0 && HELD_PORT_ERRNOS.has(outcome.error.code);
+    if (!held || attempt === UPSTREAM_LOCAL_PORT_COUNT - 1) {
+      return outcome;
+    }
+  }
 }
 function requestServername(options, fallback) {
   return "servername" in options && typeof options.servername === "string" && options.servername !== "" ? options.servername : fallback;
 }
 var ExemptHttpAgent = class extends http.Agent {
-  createConnection(options) {
-    return exemptDial(options, HTTP_PORT);
+  // A reserved-port dial that has to retry cannot produce its socket synchronously, so it settles first and arrives through the callback (node's documented asynchronous createConnection form); a literal dial has nothing to retry and keeps node's own synchronous shape.
+  createConnection(options, oncreate) {
+    const target = dialTarget(options, HTTP_PORT);
+    if (net2.isIP(target.host) !== 0) {
+      return literalDial(target);
+    }
+    void reservedDial(target).then((outcome) => {
+      oncreate?.(outcome.error, outcome.socket);
+    });
+    return void 0;
   }
 };
 var ExemptTlsAgent = class extends https.Agent {
-  createConnection(options) {
-    const host = typeof options.host === "string" ? options.host : "";
-    const tlsOptions = { socket: exemptDial(options, HTTPS_PORT), servername: requestServername(options, host) };
-    if ("ca" in options && Array.isArray(options.ca)) {
-      tlsOptions.ca = options.ca;
-    }
-    if ("rejectUnauthorized" in options && typeof options.rejectUnauthorized === "boolean") {
-      tlsOptions.rejectUnauthorized = options.rejectUnauthorized;
-    }
-    return tls.connect(tlsOptions);
+  // The same split as the plain sibling: a literal dial wraps TLS around the socket node's own agent would have returned, a reserved dial settles (retries included) first and arrives through the callback, which is exactly where node's own agent wraps its own dials.
+  createConnection(options, oncreate) {
+    const target = dialTarget(options, HTTPS_PORT);
+    if (net2.isIP(target.host) !== 0) {
+      return tls.connect({ socket: literalDial(target), servername: requestServername(options, target.host), ...tlsFacts(options) });
+    }
+    void reservedDial(target).then((outcome) => {
+      if (outcome.error !== null) {
+        oncreate?.(outcome.error, outcome.socket);
+        return;
+      }
+      oncreate?.(null, tls.connect({ socket: outcome.socket, servername: requestServername(options, target.host), ...tlsFacts(options) }));
+    });
+    return void 0;
   }
 };
+function tlsFacts(options) {
+  const facts = {};
+  if ("ca" in options && Array.isArray(options.ca)) {
+    facts.ca = options.ca;
+  }
+  if ("rejectUnauthorized" in options && typeof options.rejectUnauthorized === "boolean") {
+    facts.rejectUnauthorized = options.rejectUnauthorized;
+  }
+  return facts;
+}
 function realRcEventDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
   return {

package/dist/index.mjs

@@ -3064,13 +3064,14 @@ function realConnectCertStore(paths) {
 }
 
 // src/frontdoor/connectEffects.ts
-import * as dns from "node:dns";
+import dns from "node:dns";
 import * as http from "node:http";
 import * as https from "node:https";
 import * as net2 from "node:net";
 import * as tls from "node:tls";
 var UPSTREAM_LOCAL_PORT_START = 47900;
 var UPSTREAM_LOCAL_PORT_END = 47919;
+var UPSTREAM_LOCAL_PORT_COUNT = UPSTREAM_LOCAL_PORT_END - UPSTREAM_LOCAL_PORT_START + 1;
 var nextUpstreamLocalPort = UPSTREAM_LOCAL_PORT_START;
 function upstreamLocalPort() {
   const port = nextUpstreamLocalPort;
@@ -3083,41 +3084,92 @@ var realAddressLookup = (host, _options, callback) => {
     return;
   }
   dns.resolve4(host, (error, addresses) => {
+    if (error !== null) {
+      callback(error, [{ address: "", family: 4 }]);
+      return;
+    }
     const first = addresses[0];
-    if (error !== null || first === void 0) {
-      callback(error ?? new Error(`no A record for ${host}`), [{ address: "", family: 4 }]);
+    if (first === void 0) {
+      callback(new Error(`no A record for ${host}`), [{ address: "", family: 4 }]);
       return;
     }
     callback(null, [{ address: first, family: 4 }]);
   });
 };
 var HTTP_PORT = 80;
-function exemptDial(options, defaultPort) {
-  const host = typeof options.host === "string" ? options.host : "";
-  const port = typeof options.port === "number" ? options.port : defaultPort;
-  return net2.connect(net2.isIP(host) === 0 ? { host, port, localPort: upstreamLocalPort(), lookup: realAddressLookup } : { host, port });
+var HELD_PORT_ERRNOS = /* @__PURE__ */ new Set(["EADDRINUSE", "EADDRNOTAVAIL"]);
+async function dialOnce(connectOptions) {
+  return await new Promise((resolve) => {
+    const socket = net2.connect(connectOptions);
+    socket.once("connect", () => {
+      resolve({ error: null, socket });
+    });
+    socket.once("error", (error) => {
+      resolve({ error, socket });
+    });
+  });
+}
+function dialTarget(options, defaultPort) {
+  return { host: typeof options.host === "string" ? options.host : "", port: typeof options.port === "number" ? options.port : defaultPort };
+}
+function literalDial(target) {
+  return net2.connect({ host: target.host, port: target.port });
+}
+async function reservedDial(target) {
+  for (let attempt = 0; ; attempt += 1) {
+    const outcome = await dialOnce({ host: target.host, port: target.port, localPort: upstreamLocalPort(), lookup: realAddressLookup });
+    if (outcome.error === null) {
+      return outcome;
+    }
+    const held = outcome.error.code !== void 0 && HELD_PORT_ERRNOS.has(outcome.error.code);
+    if (!held || attempt === UPSTREAM_LOCAL_PORT_COUNT - 1) {
+      return outcome;
+    }
+  }
 }
 function requestServername(options, fallback) {
   return "servername" in options && typeof options.servername === "string" && options.servername !== "" ? options.servername : fallback;
 }
 var ExemptHttpAgent = class extends http.Agent {
-  createConnection(options) {
-    return exemptDial(options, HTTP_PORT);
+  // A reserved-port dial that has to retry cannot produce its socket synchronously, so it settles first and arrives through the callback (node's documented asynchronous createConnection form); a literal dial has nothing to retry and keeps node's own synchronous shape.
+  createConnection(options, oncreate) {
+    const target = dialTarget(options, HTTP_PORT);
+    if (net2.isIP(target.host) !== 0) {
+      return literalDial(target);
+    }
+    void reservedDial(target).then((outcome) => {
+      oncreate?.(outcome.error, outcome.socket);
+    });
+    return void 0;
   }
 };
 var ExemptTlsAgent = class extends https.Agent {
-  createConnection(options) {
-    const host = typeof options.host === "string" ? options.host : "";
-    const tlsOptions = { socket: exemptDial(options, HTTPS_PORT), servername: requestServername(options, host) };
-    if ("ca" in options && Array.isArray(options.ca)) {
-      tlsOptions.ca = options.ca;
-    }
-    if ("rejectUnauthorized" in options && typeof options.rejectUnauthorized === "boolean") {
-      tlsOptions.rejectUnauthorized = options.rejectUnauthorized;
-    }
-    return tls.connect(tlsOptions);
+  // The same split as the plain sibling: a literal dial wraps TLS around the socket node's own agent would have returned, a reserved dial settles (retries included) first and arrives through the callback, which is exactly where node's own agent wraps its own dials.
+  createConnection(options, oncreate) {
+    const target = dialTarget(options, HTTPS_PORT);
+    if (net2.isIP(target.host) !== 0) {
+      return tls.connect({ socket: literalDial(target), servername: requestServername(options, target.host), ...tlsFacts(options) });
+    }
+    void reservedDial(target).then((outcome) => {
+      if (outcome.error !== null) {
+        oncreate?.(outcome.error, outcome.socket);
+        return;
+      }
+      oncreate?.(null, tls.connect({ socket: outcome.socket, servername: requestServername(options, target.host), ...tlsFacts(options) }));
+    });
+    return void 0;
   }
 };
+function tlsFacts(options) {
+  const facts = {};
+  if ("ca" in options && Array.isArray(options.ca)) {
+    facts.ca = options.ca;
+  }
+  if ("rejectUnauthorized" in options && typeof options.rejectUnauthorized === "boolean") {
+    facts.rejectUnauthorized = options.rejectUnauthorized;
+  }
+  return facts;
+}
 function realRcEventDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
   return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-shim",
-  "version": "8.5.0",
+  "version": "8.5.1",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",