agent-shim 8.5.2 → 8.5.3

package/dist/index.cjs

@@ -2732,7 +2732,7 @@ function readFrontDoorState(fs12, stateFile) {
 }
 function writeFrontDoorState(fs12, stateFile, state) {
   fs12.mkdirp(import_node_path7.default.dirname(stateFile));
-  fs12.writeFileUtf8(stateFile, `${JSON.stringify(state, null, 2)}
+  fs12.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
 `);
 }
 function frontDoorOrigin(state) {
@@ -3629,6 +3629,11 @@ function singleHeader(headers, name) {
   const value = headers[name];
   return typeof value === "string" ? value : void 0;
 }
+var OAUTH_AUTHORIZATION_PREFIX = "Bearer sk-ant-oat";
+function oauthAuthorizationOf(headers) {
+  const value = singleHeader(headers, "authorization");
+  return value?.startsWith(OAUTH_AUTHORIZATION_PREFIX) === true ? value : void 0;
+}
 function sessionCreateId(body) {
   let parsed;
   try {
@@ -3772,7 +3777,7 @@ function createRcSessionTracker(deps) {
     }
     const tail = path29.slice(RC_SESSIONS_PATH_PREFIX.length);
     const facts = {
-      authorization: singleHeader(request4.headers, "authorization"),
+      oauthAuthorization: oauthAuthorizationOf(request4.headers),
       anthropicVersion: singleHeader(request4.headers, "anthropic-version"),
       anthropicClientPlatform: singleHeader(request4.headers, "anthropic-client-platform")
     };
@@ -3814,7 +3819,7 @@ function createRcSessionTracker(deps) {
     }
     const entry = entries.get(id) ?? birth(id, facts);
     entry.lastSeenAt = deps.now();
-    entry.authorization = facts.authorization ?? entry.authorization;
+    entry.oauthAuthorization = facts.oauthAuthorization ?? entry.oauthAuthorization;
     entry.anthropicVersion = facts.anthropicVersion ?? entry.anthropicVersion;
     entry.anthropicClientPlatform = facts.anthropicClientPlatform ?? entry.anthropicClientPlatform;
     const bodyKind = method === "POST" && rest === `${id}/worker/events` ? "worker-events" : method === "POST" && rest === `${id}/events` ? "client-events" : method === "POST" && rest === `${id}/worker/heartbeat` ? "heartbeat" : method === "PUT" && rest === `${id}/worker` ? "worker-registration" : void 0;
@@ -3902,7 +3907,7 @@ function createRcSessionTracker(deps) {
     },
     credentialOf: (sessionId) => {
       const entry = entries.get(sessionId);
-      return entry === void 0 ? void 0 : { authorization: entry.authorization, anthropicVersion: entry.anthropicVersion, anthropicClientPlatform: entry.anthropicClientPlatform };
+      return entry === void 0 ? void 0 : { authorization: entry.oauthAuthorization, anthropicVersion: entry.anthropicVersion, anthropicClientPlatform: entry.anthropicClientPlatform };
     },
     completePending: (sessionId, requestId) => {
       entries.get(sessionId)?.pending.delete(requestId);
@@ -4025,6 +4030,9 @@ function rcEventWriteResultFromAnswer(answer) {
   }
   return { ok: true, sequenceNums };
 }
+function noOAuthCredentialResult(sessionId) {
+  return { ok: false, message: `no claude.ai OAuth bearer has been observed for session ${sessionId}: only worker calls crossed this door, and the worker JWT they carry is answered 401 on the client half. Reconnect Remote Control through this door and the create's own bearer will be observed` };
+}
 function rcWriteHeaders(credential) {
   const headers = { "content-type": "application/json" };
   if (credential.authorization !== void 0) {
@@ -4043,6 +4051,9 @@ async function injectRcUserMessage(deps, sessionId, text) {
   if (credential === void 0) {
     return { ok: false, message: `the front door has not observed Remote Control session ${sessionId}: it may never have passed through this door, or it ended or expired (an entry lives only a bounded idle period past its last observed traffic)` };
   }
+  if (credential.authorization === void 0) {
+    return noOAuthCredentialResult(sessionId);
+  }
   const body = JSON.stringify(buildRcEventWriteBody(buildRcUserMessagePayload(deps.newUuid(), sessionId, text)));
   let answer;
   try {
@@ -4061,6 +4072,9 @@ async function answerRcControlRequest(deps, sessionId, requestId, decision) {
   if (credential === void 0) {
     return { ok: false, message: `the front door has not observed Remote Control session ${sessionId}: it may never have passed through this door, or it ended or expired (an entry lives only a bounded idle period past its last observed traffic)` };
   }
+  if (credential.authorization === void 0) {
+    return noOAuthCredentialResult(sessionId);
+  }
   if (!deps.pendingOf(sessionId).some((pending) => pending.requestId === requestId)) {
     return { ok: false, message: `the front door has not observed control request ${requestId} pending on session ${sessionId}: it was answered already (by this door or by an attached client), it passed its answer deadline (the protocol's permission round-trip bound), or it never passed through this door` };
   }
@@ -4937,13 +4951,24 @@ function ensureHeadroom(params) {
   const { paths, ports } = params;
   const deadline = ports.now() + HEADROOM_START_TIMEOUT_MS;
   let spawnedSupervisor = false;
+  let awaitingAllowlist = false;
   for (; ; ) {
     const state = readHeadroomState(ports.fs, paths.headroomStateFile);
     if (state?.supervisorPid !== void 0 && ports.isRunning(state.supervisorPid)) {
       const daemonUp = state.socketPath !== void 0 && state.headroomPid !== void 0 && ports.isRunning(state.headroomPid);
       if (daemonUp && state.socketPath !== void 0) {
-        writeSession(ports.fs, paths.headroomSessionsDir, { pid: params.launcherPid, startedAt: ports.now(), supervisorPid: state.supervisorPid });
-        return { socketPath: state.socketPath };
+        const required = params.requiredAllowlistHash?.();
+        if (required === void 0 || state.allowlistHash === required) {
+          writeSession(ports.fs, paths.headroomSessionsDir, { pid: params.launcherPid, startedAt: ports.now(), supervisorPid: state.supervisorPid });
+          return { socketPath: state.socketPath };
+        }
+        const holders = sessionsForSupervisor(ports.fs, paths.headroomSessionsDir, state.supervisorPid).filter((session) => ports.isRunning(session.pid));
+        if (holders.length > 0) {
+          throw new HeadroomStartError(
+            `agent-shim: the running headroom daemon was started before this launch's front door address and would refuse every request this launch sends through it. It restarts once the launches using it end (pid ${holders.map((session) => String(session.pid)).join(", ")}); end them and launch again, or launch with --no-headroom.`
+          );
+        }
+        awaitingAllowlist = true;
       }
       if (state.lastError !== void 0) {
         throw new HeadroomStartError(
@@ -4971,7 +4996,7 @@ function ensureHeadroom(params) {
     if (ports.now() >= deadline) {
       const lastError = state?.lastError;
       throw new HeadroomStartError(
-        `agent-shim: the headroom daemon did not become ready within ${String(HEADROOM_START_TIMEOUT_MS)}ms` + (lastError === void 0 ? "" : ` (last error: ${lastError})`) + `. Daemon log: ${paths.headroomLogPath}`
+        `agent-shim: the headroom daemon did not become ready within ${String(HEADROOM_START_TIMEOUT_MS)}ms` + (lastError === void 0 ? "" : ` (last error: ${lastError})`) + (awaitingAllowlist ? " (the running daemon's allowlist does not admit this launch's front door, and it did not restart)" : "") + `. Daemon log: ${paths.headroomLogPath}`
       );
     }
     ports.sleep(HEADROOM_LAUNCHER_POLL_MS);
@@ -7270,10 +7295,11 @@ var realHeadroomSocketTrust = {
 };
 function realHeadroomPort(paths, options) {
   return {
-    ensure: () => {
+    ensure: ({ routesProvider }) => {
       const up = ensureHeadroom({
         paths,
         launcherPid: process.pid,
+        ...routesProvider ? { requiredAllowlistHash: () => hashAllowlist(currentHeadroomAllowlist(realFarmFs, paths)) } : {},
         ports: {
           fs: realFarmFs,
           // Zombie-aware on purpose: a supervisor that died while still a child of this launcher sits unreaped until the launcher itself exits, and a defunct supervisor answering signal 0 as alive would stretch every launch to the full start timeout.
@@ -8957,7 +8983,7 @@ function prepareLaunch(params) {
   let headroom;
   const headroomPort = params.headroom;
   if (resolvedFlags.headroom && headroomPort !== void 0) {
-    headroom = headroomPort.ensure();
+    headroom = headroomPort.ensure({ routesProvider: resolvedProvider !== void 0 });
     const via = resolvedProvider === void 0 ? `OAuth via the door's CONNECT surface on 127.0.0.1:${String(frontDoor?.connectPort ?? 0)}` : `provider ${resolvedProvider.name}`;
     log.info(`agent-shim: routing through the front door on 127.0.0.1:${String(frontDoor?.port ?? 0)} with headroom on unix socket ${headroom.socketPath} (${via}, project ${headroom.projectId})`);
   } else if (resolvedFlags.headroom) {

package/dist/index.mjs

@@ -2548,7 +2548,7 @@ function readFrontDoorState(fs12, stateFile) {
 }
 function writeFrontDoorState(fs12, stateFile, state) {
   fs12.mkdirp(path7.dirname(stateFile));
-  fs12.writeFileUtf8(stateFile, `${JSON.stringify(state, null, 2)}
+  fs12.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
 `);
 }
 function frontDoorOrigin(state) {
@@ -3445,6 +3445,11 @@ function singleHeader(headers, name) {
   const value = headers[name];
   return typeof value === "string" ? value : void 0;
 }
+var OAUTH_AUTHORIZATION_PREFIX = "Bearer sk-ant-oat";
+function oauthAuthorizationOf(headers) {
+  const value = singleHeader(headers, "authorization");
+  return value?.startsWith(OAUTH_AUTHORIZATION_PREFIX) === true ? value : void 0;
+}
 function sessionCreateId(body) {
   let parsed;
   try {
@@ -3588,7 +3593,7 @@ function createRcSessionTracker(deps) {
     }
     const tail = path29.slice(RC_SESSIONS_PATH_PREFIX.length);
     const facts = {
-      authorization: singleHeader(request4.headers, "authorization"),
+      oauthAuthorization: oauthAuthorizationOf(request4.headers),
       anthropicVersion: singleHeader(request4.headers, "anthropic-version"),
       anthropicClientPlatform: singleHeader(request4.headers, "anthropic-client-platform")
     };
@@ -3630,7 +3635,7 @@ function createRcSessionTracker(deps) {
     }
     const entry = entries.get(id) ?? birth(id, facts);
     entry.lastSeenAt = deps.now();
-    entry.authorization = facts.authorization ?? entry.authorization;
+    entry.oauthAuthorization = facts.oauthAuthorization ?? entry.oauthAuthorization;
     entry.anthropicVersion = facts.anthropicVersion ?? entry.anthropicVersion;
     entry.anthropicClientPlatform = facts.anthropicClientPlatform ?? entry.anthropicClientPlatform;
     const bodyKind = method === "POST" && rest === `${id}/worker/events` ? "worker-events" : method === "POST" && rest === `${id}/events` ? "client-events" : method === "POST" && rest === `${id}/worker/heartbeat` ? "heartbeat" : method === "PUT" && rest === `${id}/worker` ? "worker-registration" : void 0;
@@ -3718,7 +3723,7 @@ function createRcSessionTracker(deps) {
     },
     credentialOf: (sessionId) => {
       const entry = entries.get(sessionId);
-      return entry === void 0 ? void 0 : { authorization: entry.authorization, anthropicVersion: entry.anthropicVersion, anthropicClientPlatform: entry.anthropicClientPlatform };
+      return entry === void 0 ? void 0 : { authorization: entry.oauthAuthorization, anthropicVersion: entry.anthropicVersion, anthropicClientPlatform: entry.anthropicClientPlatform };
     },
     completePending: (sessionId, requestId) => {
       entries.get(sessionId)?.pending.delete(requestId);
@@ -3841,6 +3846,9 @@ function rcEventWriteResultFromAnswer(answer) {
   }
   return { ok: true, sequenceNums };
 }
+function noOAuthCredentialResult(sessionId) {
+  return { ok: false, message: `no claude.ai OAuth bearer has been observed for session ${sessionId}: only worker calls crossed this door, and the worker JWT they carry is answered 401 on the client half. Reconnect Remote Control through this door and the create's own bearer will be observed` };
+}
 function rcWriteHeaders(credential) {
   const headers = { "content-type": "application/json" };
   if (credential.authorization !== void 0) {
@@ -3859,6 +3867,9 @@ async function injectRcUserMessage(deps, sessionId, text) {
   if (credential === void 0) {
     return { ok: false, message: `the front door has not observed Remote Control session ${sessionId}: it may never have passed through this door, or it ended or expired (an entry lives only a bounded idle period past its last observed traffic)` };
   }
+  if (credential.authorization === void 0) {
+    return noOAuthCredentialResult(sessionId);
+  }
   const body = JSON.stringify(buildRcEventWriteBody(buildRcUserMessagePayload(deps.newUuid(), sessionId, text)));
   let answer;
   try {
@@ -3877,6 +3888,9 @@ async function answerRcControlRequest(deps, sessionId, requestId, decision) {
   if (credential === void 0) {
     return { ok: false, message: `the front door has not observed Remote Control session ${sessionId}: it may never have passed through this door, or it ended or expired (an entry lives only a bounded idle period past its last observed traffic)` };
   }
+  if (credential.authorization === void 0) {
+    return noOAuthCredentialResult(sessionId);
+  }
   if (!deps.pendingOf(sessionId).some((pending) => pending.requestId === requestId)) {
     return { ok: false, message: `the front door has not observed control request ${requestId} pending on session ${sessionId}: it was answered already (by this door or by an attached client), it passed its answer deadline (the protocol's permission round-trip bound), or it never passed through this door` };
   }
@@ -4753,13 +4767,24 @@ function ensureHeadroom(params) {
   const { paths, ports } = params;
   const deadline = ports.now() + HEADROOM_START_TIMEOUT_MS;
   let spawnedSupervisor = false;
+  let awaitingAllowlist = false;
   for (; ; ) {
     const state = readHeadroomState(ports.fs, paths.headroomStateFile);
     if (state?.supervisorPid !== void 0 && ports.isRunning(state.supervisorPid)) {
       const daemonUp = state.socketPath !== void 0 && state.headroomPid !== void 0 && ports.isRunning(state.headroomPid);
       if (daemonUp && state.socketPath !== void 0) {
-        writeSession(ports.fs, paths.headroomSessionsDir, { pid: params.launcherPid, startedAt: ports.now(), supervisorPid: state.supervisorPid });
-        return { socketPath: state.socketPath };
+        const required = params.requiredAllowlistHash?.();
+        if (required === void 0 || state.allowlistHash === required) {
+          writeSession(ports.fs, paths.headroomSessionsDir, { pid: params.launcherPid, startedAt: ports.now(), supervisorPid: state.supervisorPid });
+          return { socketPath: state.socketPath };
+        }
+        const holders = sessionsForSupervisor(ports.fs, paths.headroomSessionsDir, state.supervisorPid).filter((session) => ports.isRunning(session.pid));
+        if (holders.length > 0) {
+          throw new HeadroomStartError(
+            `agent-shim: the running headroom daemon was started before this launch's front door address and would refuse every request this launch sends through it. It restarts once the launches using it end (pid ${holders.map((session) => String(session.pid)).join(", ")}); end them and launch again, or launch with --no-headroom.`
+          );
+        }
+        awaitingAllowlist = true;
       }
       if (state.lastError !== void 0) {
         throw new HeadroomStartError(
@@ -4787,7 +4812,7 @@ function ensureHeadroom(params) {
     if (ports.now() >= deadline) {
       const lastError = state?.lastError;
       throw new HeadroomStartError(
-        `agent-shim: the headroom daemon did not become ready within ${String(HEADROOM_START_TIMEOUT_MS)}ms` + (lastError === void 0 ? "" : ` (last error: ${lastError})`) + `. Daemon log: ${paths.headroomLogPath}`
+        `agent-shim: the headroom daemon did not become ready within ${String(HEADROOM_START_TIMEOUT_MS)}ms` + (lastError === void 0 ? "" : ` (last error: ${lastError})`) + (awaitingAllowlist ? " (the running daemon's allowlist does not admit this launch's front door, and it did not restart)" : "") + `. Daemon log: ${paths.headroomLogPath}`
       );
     }
     ports.sleep(HEADROOM_LAUNCHER_POLL_MS);
@@ -7086,10 +7111,11 @@ var realHeadroomSocketTrust = {
 };
 function realHeadroomPort(paths, options) {
   return {
-    ensure: () => {
+    ensure: ({ routesProvider }) => {
       const up = ensureHeadroom({
         paths,
         launcherPid: process.pid,
+        ...routesProvider ? { requiredAllowlistHash: () => hashAllowlist(currentHeadroomAllowlist(realFarmFs, paths)) } : {},
         ports: {
           fs: realFarmFs,
           // Zombie-aware on purpose: a supervisor that died while still a child of this launcher sits unreaped until the launcher itself exits, and a defunct supervisor answering signal 0 as alive would stretch every launch to the full start timeout.
@@ -8773,7 +8799,7 @@ function prepareLaunch(params) {
   let headroom;
   const headroomPort = params.headroom;
   if (resolvedFlags.headroom && headroomPort !== void 0) {
-    headroom = headroomPort.ensure();
+    headroom = headroomPort.ensure({ routesProvider: resolvedProvider !== void 0 });
     const via = resolvedProvider === void 0 ? `OAuth via the door's CONNECT surface on 127.0.0.1:${String(frontDoor?.connectPort ?? 0)}` : `provider ${resolvedProvider.name}`;
     log.info(`agent-shim: routing through the front door on 127.0.0.1:${String(frontDoor?.port ?? 0)} with headroom on unix socket ${headroom.socketPath} (${via}, project ${headroom.projectId})`);
   } else if (resolvedFlags.headroom) {

package/dist/types/index.d.ts

@@ -1171,10 +1171,12 @@ interface HeadroomUp {
 /**
  * Everything the launcher needs from the headroom daemon, injected so its daemon-supervision side effects stay behind a port and the launcher's own logic stays pure over it (`src/realPorts.ts` wires the real one; tests wire fakes).
  *
- * `ensure` brings the daemon up (spawning the detached supervisor when nothing healthy is running) and registers this launch in its session registry; `release` removes that registration when the spawned `claude` exits.
+ * `ensure` brings the daemon up (spawning the detached supervisor when nothing healthy is running) and registers this launch in its session registry; `release` removes that registration when the spawned `claude` exits. `routesProvider` says the launch sends a provider's traffic through the daemon, which needs the daemon to have been started with the front door's current address on its allowlist: `ensure` then waits for a restart that brings it, or refuses when live sessions hold the stale daemon up, instead of registering against a daemon that would reject every request.
  */
 interface HeadroomPort {
-    readonly ensure: () => HeadroomUp;
+    readonly ensure: (options: Readonly<{
+        routesProvider: boolean;
+    }>) => HeadroomUp;
     readonly release: () => void;
 }
 /**
@@ -1767,7 +1769,7 @@ declare function rcObserverAsPassthrough(observer: RcExchangeObserver): Passthro
 declare function buildRcUserMessagePayload(uuid: string, sessionId: string, text: string): Record<string, unknown>;
 /** Wraps payload event(s) in the write body the endpoint takes: `{"events": [{"payload": {...}}]}`. */
 declare function buildRcEventWriteBody(payload: Record<string, unknown>): Record<string, unknown>;
-/** The headers a client-half write sends: the observed credential and protocol values, replayed verbatim, never invented. */
+/** The headers a client-half write sends: the observed OAuth-kind credential and protocol values, replayed verbatim, never invented. */
 interface RcWriteHeaders {
     readonly authorization: string | undefined;
     readonly anthropicVersion: string | undefined;
@@ -2115,6 +2117,10 @@ declare function ensureHeadroom(params: {
     readonly paths: LayoutPaths;
     readonly launcherPid: number;
     readonly ports: EnsureHeadroomPorts;
+    /**
+     * The hash of the allowlist the daemon must have been started with for this launch to work, read fresh on every poll because the front door's address it contains can change while the launch waits. Given for a launch that routes a provider through headroom, whose requests come back to the front door's direct origin and are refused by a daemon that was started without it; absent for a launch that only needs Claude Code's own API, which every daemon admits.
+     */
+    readonly requiredAllowlistHash?: () => string;
 }): {
     readonly socketPath: string;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-shim",
-  "version": "8.5.2",
+  "version": "8.5.3",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",