agent-shim 8.5.6 → 8.7.0

package/dist/types/index.d.ts

@@ -1662,11 +1662,11 @@ interface FrontDoorRoute {
 }
 
 /**
- * Remote Control session tracking and the client-half writes the front door performs: the record of the `cse_` sessions whose traffic crosses its terminated API-host session, the prompt injected into one, and the answer delivered to one of its pending control requests.
+ * Remote Control session tracking and the client-half writes the front door performs: the record of the `cse_` sessions whose traffic crosses its terminated API-host session, the prompt injected into one, the answer delivered to one of its pending control requests, and the client-originated control requests sent into one (interrupt, set_model, set_permission_mode).
  *
  * The tracker is observational: the door already terminates the API host's TLS, so it sees the CLI's own `POST /v1/code/sessions` (whose answer carries the new session's `cse_` id) and every recurring `/v1/code/sessions/...` call (heartbeat, presence), each carrying the session's Authorization bearer and the protocol headers a client-half replay needs. Per session the tracker retains the latest of each, because those calls recur and the freshest value is the live one. It also reads the request bodies of the exchanges whose payloads matter: the worker's event batches (whose `control_request` payloads, `can_use_tool` above all, are the approvals awaiting an answer), the worker heartbeats (whose bodies carry `idle_seconds`), the worker registration (whose body carries the worker state), and the client-half event writes (whose `control_response` payloads complete a pending request). Everything is held in this process's memory only: nothing here is written to a log, to the capture, or to disk, and the summary the control surface lists never includes the credential. The capture's existing redaction is untouched; a capture and this tracker observe the same exchanges through entirely separate paths.
  *
- * Both writes replay the protocol's documented client half rather than splicing frames into any relayed stream: `POST /v1/code/sessions/{id}/events` with one payload event (a user message, or a `control_response` answering an observed request by echoing its id), authenticated by the observed bearer and the observed protocol headers, sent from the door over its own interception-proof dials. Sequence numbers therefore come from the real service and the event is mirrored to every attached client, exactly as a message typed into claude.ai would be.
+ * Every write replays the protocol's documented client half rather than splicing frames into any relayed stream: `POST /v1/code/sessions/{id}/events` with one payload event (a user message, a `control_response` answering an observed request by echoing its id, or a `control_request` a client originates), authenticated by the observed bearer and the observed protocol headers, sent from the door over its own interception-proof dials. Sequence numbers therefore come from the real service and the event is mirrored to every attached client, exactly as a message typed into claude.ai would be.
  */
 /** Every Remote Control exchange on the API host sits under this path prefix. */
 declare const RC_SESSIONS_PATH_PREFIX = "/v1/code/sessions";
@@ -1819,6 +1819,26 @@ interface RcAnswerDecision {
  * Builds the `control_response` payload event for one answer: the SDK's response envelope, `subtype: "success"` with the request's id echoed in `request_id`, carrying the permission result the worker is waiting for (`behavior: "allow"`, or `"deny"` with its message).
  */
 declare function buildRcControlResponsePayload(requestId: string, decision: RcAnswerDecision): Record<string, unknown>;
+/**
+ * The permission modes the SDK's own `set_permission_mode` control request accepts: exactly the strings its `PermissionMode` type declares (`@anthropic-ai/claude-agent-sdk` `sdk.d.ts`), nothing looser. A runtime list as well as a type, because the CLI and the control route both narrow untrusted strings through it before a write is ever attempted.
+ */
+declare const RC_PERMISSION_MODES: readonly ["default", "acceptEdits", "bypassPermissions", "plan", "dontAsk", "auto"];
+/** One permission mode the SDK's `set_permission_mode` control request accepts. */
+type RcPermissionMode = (typeof RC_PERMISSION_MODES)[number];
+/** Whether a value is one of the SDK's own permission modes, the narrowing the CLI and the control route apply to untrusted input. */
+declare function isRcPermissionMode(value: unknown): value is RcPermissionMode;
+/**
+ * Builds the `control_request` payload event for one interrupt: the SDK's request envelope (`SDKControlRequest`: `type`, `request_id`, `request`), carrying the `interrupt` subtype's own shape (`subtype` alone; its optional `cancel_queued` is absent, which the SDK reads as false, so queued commands survive the interrupt exactly as a plain stop button's would). The request id is the caller's minted uuid, the id the worker's `control_response` echoes.
+ */
+declare function buildRcInterruptPayload(requestId: string): Record<string, unknown>;
+/**
+ * Builds the `control_request` payload event for one model switch: the SDK's request envelope carrying the `set_model` subtype's own shape, whose one field is the `model` id string (its omitted and null forms mean a reset to the session default, which this builder never sends; the operation refuses an empty id for the same reason).
+ */
+declare function buildRcSetModelPayload(requestId: string, model: string): Record<string, unknown>;
+/**
+ * Builds the `control_request` payload event for one permission-mode change: the SDK's request envelope carrying the `set_permission_mode` subtype's own shape, whose one field is the `mode` from the SDK's own `PermissionMode` enum (`RC_PERMISSION_MODES`).
+ */
+declare function buildRcSetPermissionModePayload(requestId: string, mode: RcPermissionMode): Record<string, unknown>;
 /** Everything one answer needs, injected so the decision logic runs against fakes in unit tests. */
 interface RcAnswerDeps {
     /** Reads the observed credential for a session: the tracker's accessor, in production. */
@@ -1834,6 +1854,27 @@ interface RcAnswerDeps {
  * Answers one pending control request on an observed session: the same documented client-half write the inject path performs, carrying a `control_response` that echoes the request's id, authenticated by the observed bearer and protocol headers. The request must still be pending (an answered or deadline-expired request is refused verbosely, since writing a response nothing waits for would mislead the caller), and a successful write retires it. A dial that cannot reach the API host is reported rather than thrown.
  */
 declare function answerRcControlRequest(deps: RcAnswerDeps, sessionId: string, requestId: string, decision: RcAnswerDecision): Promise<RcEventWriteResult>;
+/** Everything one client-originated control request needs, injected so the decision logic runs against fakes in unit tests. */
+interface RcControlRequestDeps {
+    /** Reads the observed credential for a session: the tracker's accessor, in production. */
+    readonly credentialOf: (sessionId: string) => RcObservedCredential | undefined;
+    /** The dial to the real API host. */
+    readonly dial: RcEventDial;
+    /** Mints the request's id: a v4 UUID or better in production, the id the worker's `control_response` echoes. */
+    readonly newUuid: () => string;
+}
+/**
+ * Interrupts one observed session's running turn: the same documented client-half write the inject and answer paths perform, carrying the SDK's `control_request` envelope for the `interrupt` subtype, authenticated by the observed bearer and protocol headers. The result is the sequence numbers the real service assigned, or a verbose failure. A dial that cannot reach the API host is reported rather than thrown, so a caller with no exception handling still shows the user exactly what failed.
+ */
+declare function interruptRcSession(deps: RcControlRequestDeps, sessionId: string): Promise<RcEventWriteResult>;
+/**
+ * Sets the model one observed session's subsequent turns use: the same documented client-half write the inject and answer paths perform, carrying the SDK's `control_request` envelope for the `set_model` subtype with the model id its own field names. The id is validated only as non-empty, because the SDK's field gives the empty-free forms their own meaning (omitted or null resets to the session default) and this operation sends neither. The result is the sequence numbers the real service assigned, or a verbose failure.
+ */
+declare function setRcSessionModel(deps: RcControlRequestDeps, sessionId: string, model: string): Promise<RcEventWriteResult>;
+/**
+ * Sets one observed session's permission mode: the same documented client-half write the inject and answer paths perform, carrying the SDK's `control_request` envelope for the `set_permission_mode` subtype with a mode from the SDK's own enum (`RC_PERMISSION_MODES`; the type accepts nothing looser, and the CLI and control route narrow untrusted strings through `isRcPermissionMode` before they ever reach this operation). The result is the sequence numbers the real service assigned, or a verbose failure.
+ */
+declare function setRcSessionPermissionMode(deps: RcControlRequestDeps, sessionId: string, mode: RcPermissionMode): Promise<RcEventWriteResult>;
 
 /** Where the Remote Control inject path dials: the API host's own address by default, over TLS with the door's interception-proof agent (real-name DNS resolution and the pf-exempt source-port range), so an injected event cannot be looped back into the door's own transparent surface. A test redirects the dial at a local stand-in presenting the host's name, exactly as the forwarding targets are redirected. */
 interface RcDialTarget {
@@ -1853,9 +1894,9 @@ declare function realRcEventDial(target?: RcDialTarget): RcEventDial;
 declare function realConnectEffects(): ConnectEffects;
 
 /**
- * The Remote Control control surface: the small HTTP namespace the serving door answers on its provider listener, next to `/healthz`, through which `agent-shim frontdoor rc` lists the observed sessions, reports each one's status and pending control requests, injects a prompt into one, and answers one of its pending requests.
+ * The Remote Control control surface: the small HTTP namespace the serving door answers on its provider listener, next to `/healthz`, through which `agent-shim frontdoor rc` lists the observed sessions, reports each one's status and pending control requests, injects a prompt into one, answers one of its pending requests, and sends its own control requests into one (interrupt, set-model, set-permission-mode).
  *
- * This rides the listener `frontdoor status` already knows the door by (its address comes from the same state file, its trust anchor from the same CA path) rather than any second channel. The routes sit under one prefix the routed pipeline never serves, and every request must present the serving generation's control token as a Bearer credential: a fresh random value per door start, written owner-only under the front door's state directory so only this user's CLI can read it, and checked in constant time like every other capability the door accepts. An inject or answer request is carried out by the door itself over its interception-proof dials, which is the whole point: the CLI never dials the API host directly, so nothing about the write depends on the caller's own network path.
+ * This rides the listener `frontdoor status` already knows the door by (its address comes from the same state file, its trust anchor from the same CA path) rather than any second channel. The routes sit under one prefix the routed pipeline never serves, and every request must present the serving generation's control token as a Bearer credential: a fresh random value per door start, written owner-only under the front door's state directory so only this user's CLI can read it, and checked in constant time like every other capability the door accepts. An inject, answer or control request is carried out by the door itself over its interception-proof dials, which is the whole point: the CLI never dials the API host directly, so nothing about the write depends on the caller's own network path.
  */
 /** The one path prefix every Remote Control control route sits under, answered before the routed pipeline like `/healthz` is. */
 declare const CONTROL_PATH_PREFIX = "/__agent-shim/rc";
@@ -1873,6 +1914,12 @@ interface RcControlHandlerDeps {
     readonly inject: (sessionId: string, text: string) => Promise<RcEventWriteResult>;
     /** The answer operation, already wired to the tracker and the door's API-host dial. */
     readonly answer: (sessionId: string, requestId: string, decision: RcAnswerDecision) => Promise<RcEventWriteResult>;
+    /** The interrupt operation, already wired to the tracker and the door's API-host dial. */
+    readonly interrupt: (sessionId: string) => Promise<RcEventWriteResult>;
+    /** The set-model operation, already wired to the tracker and the door's API-host dial. */
+    readonly setModel: (sessionId: string, model: string) => Promise<RcEventWriteResult>;
+    /** The set-permission-mode operation, already wired to the tracker and the door's API-host dial. */
+    readonly setPermissionMode: (sessionId: string, mode: RcPermissionMode) => Promise<RcEventWriteResult>;
 }
 /**
  * Builds the control handler the provider listener serves under `CONTROL_PATH_PREFIX`. Every route demands the generation's control token first, so nothing about the sessions (their ids, their timing, and most of all the prompts and approvals carried into them) is reachable by a process that did not read the owner-only token file.
@@ -1894,7 +1941,7 @@ interface RcControlTransport {
 }
 /** The real transport: HTTPS to the door's provider listener on loopback, trusting only the CA file the door's own state names, so a process merely holding the port cannot answer as the door. */
 declare function realRcControlTransport(port: number, ca: string): RcControlTransport;
-/** The door-facing client the `frontdoor rc` verbs use: the session list, the status and pending reads, and the inject and answer operations, over the injected transport. */
+/** The door-facing client the `frontdoor rc` verbs use: the session list, the status and pending reads, the inject and answer operations, and the door's own control requests (interrupt, set-model, set-permission-mode), over the injected transport. */
 interface FrontDoorRcControl {
     /** The observed sessions, oldest-created first. Throws with the door's verbose reason when the list cannot be had. */
     readonly listSessions: () => Promise<readonly RcSessionSummary[]>;
@@ -1906,6 +1953,12 @@ interface FrontDoorRcControl {
     readonly sendPrompt: (sessionId: string, text: string) => Promise<RcEventWriteResult>;
     /** Answers one pending control request, returning the sequence numbers the real service assigned or the verbose failure. */
     readonly answerRequest: (sessionId: string, requestId: string, decision: RcAnswerDecision) => Promise<RcEventWriteResult>;
+    /** Interrupts one session's running turn, returning the sequence numbers the real service assigned or the verbose failure. */
+    readonly interruptSession: (sessionId: string) => Promise<RcEventWriteResult>;
+    /** Sets the model one session's subsequent turns use, returning the sequence numbers the real service assigned or the verbose failure. */
+    readonly setModel: (sessionId: string, model: string) => Promise<RcEventWriteResult>;
+    /** Sets one session's permission mode, returning the sequence numbers the real service assigned or the verbose failure. */
+    readonly setPermissionMode: (sessionId: string, mode: RcPermissionMode) => Promise<RcEventWriteResult>;
 }
 /** Builds the control client: every request presents the control token, and a non-2xx answer becomes the verbose message the door sent with it. */
 declare function frontDoorRcControl(transport: RcControlTransport, token: string): FrontDoorRcControl;
@@ -2444,6 +2497,24 @@ interface CredentialCachePort {
     readonly write: (store: CredentialCacheStore, owner: string, entry: CachedCredential) => void;
     readonly remove: (store: CredentialCacheStore, owner: string) => void;
 }
+/**
+ * What the cache holds for one credential, without the token: whether there is an entry, how old it is, and whether it is still within the block's TTL. `expiresInMs` is absent for a block with no expiry.
+ */
+type CachedCredentialState = {
+    readonly store: CredentialCacheStore;
+    readonly status: "empty";
+}
+/** The store cannot be read here (the keychain store configured on a platform without a Keychain): reported with its reason rather than failing the whole report. */
+ | {
+    readonly store: CredentialCacheStore;
+    readonly status: "unreadable";
+    readonly reason: string;
+} | {
+    readonly store: CredentialCacheStore;
+    readonly status: "fresh" | "expired";
+    readonly ageMs: number;
+    readonly expiresInMs?: number;
+};
 
 /** What reading one `file` source found: nothing at that path, or its contents and permission bits. `mode` is undefined on a platform with no POSIX permission bits (Windows), where the looseness check cannot apply. */
 type SecretFileRead = {
@@ -2797,8 +2868,11 @@ interface CredentialReport {
         readonly name: string;
         readonly credential?: CredentialSummary;
         readonly problem?: string;
+        readonly cached?: CachedCredentialState;
     };
     readonly identity?: CredentialSummary;
+    /** What the identity's own credential cache holds, when its block caches and the cache could be read. */
+    readonly identityCached?: CachedCredentialState;
 }
 /** Inputs to `runCheck` — everything already loaded/injected, exactly like the resolver core and the launcher: nothing in this function touches a real filesystem, git repository, clock, or environment itself. */
 interface RunCheckParams {
@@ -2834,6 +2908,8 @@ interface RunCheckParams {
     readonly platform: string;
     /** The provider a launch here would route through (`launch.provider` in the cascade), when one is selected. */
     readonly provider?: CheckProviderInput;
+    /** Where cached credentials live. Omit to skip reporting a credential cache's age; with it, a block that caches reports whether it holds an entry, how old it is and whether it has expired, never the token. */
+    readonly credentialCache?: CredentialCacheEnv;
 }
 /** Everything `agent-shim check` reports about one directory/identity, without touching the farm or spawning anything. */
 interface CheckReport {
@@ -2968,6 +3044,8 @@ interface DoctorPathResolution {
 /** Everything `runDoctor` needs, all of it already loaded/injected — nothing in `runDoctor` itself reads a file, shells out, or touches the farm. */
 interface RunDoctorParams {
     readonly env: Readonly<Record<string, string | undefined>>;
+    /** Where cached credentials live. Omit to leave a credential cache's age out of the identity and provider findings; with it, a block that caches reports whether it holds an entry, how old it is and whether it has expired, never the token. */
+    readonly credentialCache?: CredentialCacheEnv;
     readonly identities: readonly DoctorIdentityInput[];
     readonly configProfiles: readonly DoctorConfigProfileInput[];
     readonly providers: readonly DoctorProviderInput[];
@@ -3131,5 +3209,5 @@ interface PrepareClaudeLaunchOptions {
  */
 declare function prepareClaudeLaunch(options: PrepareClaudeLaunchOptions): LaunchPlan;
 
-export { AMBIENT_CREDENTIAL_VARS, CONNECT_INTERCEPT_HOST, CONNECT_INTERCEPT_HOSTS, CONNECT_LIMITS, CONTROL_PATH_PREFIX, CategoryClassificationOverlaySchema, CategoryClassificationSchema, CategoryMapSchema, CliError, ConfigProfileSchema, CredentialCacheSchema, CredentialSchema, CredentialSourceSchema, DirectoryRuleAlreadyExistsError, DirectoryRuleMissingTargetError, DirectoryRuleNotFoundError, DirectoryRuleSchema, DirectoryRulesSchema, EXIT_FAILURE, EXIT_USAGE, EntryValueSchema, FARM_MANIFEST_FILENAME, FrontDoorStartError, GlobalConfigSchema, HeadroomStartError, IdentityAlreadyExistsError, IdentityNotFoundError, IdentitySchema, InvalidCategoryNameError, InvalidIdentityNameError, InvalidProviderNameError, LaunchRefusedError, LegacyProviderFileError, PoolNameSchema, PoolNotFoundError, PoolSchema, PortableConfigSchema, ProfileAlreadyExistsError, ProfileNotFoundError, ProviderAlreadyExistsError, ProviderKindMismatchError, ProviderNotFoundError, ProviderSchema, RC_IDLE_EXPIRY_MS, RC_PENDING_DEADLINE_MS, RC_REQUEST_PARSE_CAP_BYTES, RC_SESSIONS_PATH_PREFIX, ROUTED_PATH_PREFIX, UsageError, UsageSnapshotError, UsageSnapshotSchema, WhenSchema, addDirectoryRule, addIdentity, addPool, addProvider, answerRcControlRequest, buildEntryFacts, buildLayoutPaths, buildRcControlResponsePayload, buildRcEventWriteBody, buildRcUserMessagePayload, carryOver, checkReportHasWarnings, checkReportToJson, collectCheckReport, collectDoctorReport, createLeafCache, createProfile, createRcControlHandler, createRcSessionTracker, describeProviderEndpoint, detectAmbientCredential, ensureCa, ensureFrontDoor, ensureHeadroom, evaluateAmbientCredentialGuard, formatAmbientCredentialGuardMessage, formatCheckReport, formatDoctorReport, forwardableHeaders, frontDoorRcControl, generateCa, identityExists, injectRcUserMessage, isIdentityDirectoryName, isInterceptedHost, listDirectoryRules, listIdentities, listProfiles, listProviders, listUsageSnapshots, mintLeaf, observingRoutedRoute, parseConnectTarget, prepareClaudeLaunch, prepareLaunch, profileExists, providerExists, rcEventWriteResultFromAnswer, rcObserverAsPassthrough, readActiveIdentity, readDirectoryRules, readFarmManifest, readGlobalConfig, readIdentity, readPools, readProfile, readProvider, readUsageSnapshot, realConnectCertStore, realConnectEffects, realRcControlTransport, realRcEventDial, recoverFarm, recoveryDiagnostics, removeDirectoryRule, removeIdentity, removePool, removeProfile, removeProvider, requirePool, resolveAgentShimHome, resolveClaudeHome, resolveDecisions, resolveLayoutPaths, resolveSupervisorConfig, resyncFarm, runCheck, runDoctor, runFrontDoorSupervisor, runSupervisor, servedByPipeline, setAllowAmbientCredential, setDefaultConfigProfile, setGlobalDefaultProfile, setIdentityCredential, setPool, setProfileCategories, setProfileEntries, setProfileLaunchFlags, setProfileMetadata, snapshotPath, startConnectServer, topLevelNames, updateDirectoryRule, updateProvider, useIdentity, writeDirectoryRules };
-export type { AddDirectoryRuleOptions, AddProviderInput, AmbientCredentialDetection, AmbientCredentialGuardResult, AmbientCredentialVar, BuildEntryFactsParams, CaMaterial, CarryOverParams, CarryOverResult, CategoryMap, CheckReport, CollectCheckReportParams, CollectDoctorReportParams, CompiledRule, ConfigProfile, ConnectCertStore, ConnectEffects, ConnectLimits, ConnectServerConfig, ConnectServerHandle, ConnectTarget, Credential, CredentialSource, Decision, Diagnostic, DirectoryRule, DirectoryRules, DoctorReport, EliminatedRule, EnsureFrontDoorPorts, EnsureHeadroomPorts, EntryFact, EntryFacts, EntryValue, EvaluateAmbientCredentialGuardParams, FlattenedCascade, FrontDoorRcControl, FrontDoorSupervisorPorts, GlobalConfig, HeadroomSupervisorConfig, Identity, IdentityCredentialChange, IdentityListEntry, IdentityListing, InjectedCredential, LaunchPlan, Layer, LayerId, LayoutPaths, LeafCert, Pool, PortableConfig, PrepareClaudeLaunchOptions, PrepareLaunchParams, ProfileListEntry, Provider, ProviderListEntry, RcAnswerDecision, RcAnswerDeps, RcControlAnswer, RcControlHandlerDeps, RcControlTransport, RcDialAnswer, RcDialTarget, RcEventDial, RcEventWriteResult, RcExchangeObserver, RcInjectDeps, RcObservedCredential, RcObservedRequest, RcPendingRequestSummary, RcSessionStatus, RcSessionSummary, RcSessionTracker, RcSessionTrackerDeps, RcWorkerFact, RcWriteHeaders, RecoverFarmParams, RecoveryResult, ResolveDecisionsInput, ResolvedState, ResyncFarmParams, ResyncFarmResult, RunCheckParams, RunDoctorParams, RunFrontDoorSupervisorOptions, RunSupervisorOptions, SupervisorPorts, UnreadableIdentityListEntry, UpdateDirectoryRuleOptions, UpdateProviderInput, UsageReadFs, UsageSnapshot, WhenCondition };
+export { AMBIENT_CREDENTIAL_VARS, CONNECT_INTERCEPT_HOST, CONNECT_INTERCEPT_HOSTS, CONNECT_LIMITS, CONTROL_PATH_PREFIX, CategoryClassificationOverlaySchema, CategoryClassificationSchema, CategoryMapSchema, CliError, ConfigProfileSchema, CredentialCacheSchema, CredentialSchema, CredentialSourceSchema, DirectoryRuleAlreadyExistsError, DirectoryRuleMissingTargetError, DirectoryRuleNotFoundError, DirectoryRuleSchema, DirectoryRulesSchema, EXIT_FAILURE, EXIT_USAGE, EntryValueSchema, FARM_MANIFEST_FILENAME, FrontDoorStartError, GlobalConfigSchema, HeadroomStartError, IdentityAlreadyExistsError, IdentityNotFoundError, IdentitySchema, InvalidCategoryNameError, InvalidIdentityNameError, InvalidProviderNameError, LaunchRefusedError, LegacyProviderFileError, PoolNameSchema, PoolNotFoundError, PoolSchema, PortableConfigSchema, ProfileAlreadyExistsError, ProfileNotFoundError, ProviderAlreadyExistsError, ProviderKindMismatchError, ProviderNotFoundError, ProviderSchema, RC_IDLE_EXPIRY_MS, RC_PENDING_DEADLINE_MS, RC_PERMISSION_MODES, RC_REQUEST_PARSE_CAP_BYTES, RC_SESSIONS_PATH_PREFIX, ROUTED_PATH_PREFIX, UsageError, UsageSnapshotError, UsageSnapshotSchema, WhenSchema, addDirectoryRule, addIdentity, addPool, addProvider, answerRcControlRequest, buildEntryFacts, buildLayoutPaths, buildRcControlResponsePayload, buildRcEventWriteBody, buildRcInterruptPayload, buildRcSetModelPayload, buildRcSetPermissionModePayload, buildRcUserMessagePayload, carryOver, checkReportHasWarnings, checkReportToJson, collectCheckReport, collectDoctorReport, createLeafCache, createProfile, createRcControlHandler, createRcSessionTracker, describeProviderEndpoint, detectAmbientCredential, ensureCa, ensureFrontDoor, ensureHeadroom, evaluateAmbientCredentialGuard, formatAmbientCredentialGuardMessage, formatCheckReport, formatDoctorReport, forwardableHeaders, frontDoorRcControl, generateCa, identityExists, injectRcUserMessage, interruptRcSession, isIdentityDirectoryName, isInterceptedHost, isRcPermissionMode, listDirectoryRules, listIdentities, listProfiles, listProviders, listUsageSnapshots, mintLeaf, observingRoutedRoute, parseConnectTarget, prepareClaudeLaunch, prepareLaunch, profileExists, providerExists, rcEventWriteResultFromAnswer, rcObserverAsPassthrough, readActiveIdentity, readDirectoryRules, readFarmManifest, readGlobalConfig, readIdentity, readPools, readProfile, readProvider, readUsageSnapshot, realConnectCertStore, realConnectEffects, realRcControlTransport, realRcEventDial, recoverFarm, recoveryDiagnostics, removeDirectoryRule, removeIdentity, removePool, removeProfile, removeProvider, requirePool, resolveAgentShimHome, resolveClaudeHome, resolveDecisions, resolveLayoutPaths, resolveSupervisorConfig, resyncFarm, runCheck, runDoctor, runFrontDoorSupervisor, runSupervisor, servedByPipeline, setAllowAmbientCredential, setDefaultConfigProfile, setGlobalDefaultProfile, setIdentityCredential, setPool, setProfileCategories, setProfileEntries, setProfileLaunchFlags, setProfileMetadata, setRcSessionModel, setRcSessionPermissionMode, snapshotPath, startConnectServer, topLevelNames, updateDirectoryRule, updateProvider, useIdentity, writeDirectoryRules };
+export type { AddDirectoryRuleOptions, AddProviderInput, AmbientCredentialDetection, AmbientCredentialGuardResult, AmbientCredentialVar, BuildEntryFactsParams, CaMaterial, CarryOverParams, CarryOverResult, CategoryMap, CheckReport, CollectCheckReportParams, CollectDoctorReportParams, CompiledRule, ConfigProfile, ConnectCertStore, ConnectEffects, ConnectLimits, ConnectServerConfig, ConnectServerHandle, ConnectTarget, Credential, CredentialSource, Decision, Diagnostic, DirectoryRule, DirectoryRules, DoctorReport, EliminatedRule, EnsureFrontDoorPorts, EnsureHeadroomPorts, EntryFact, EntryFacts, EntryValue, EvaluateAmbientCredentialGuardParams, FlattenedCascade, FrontDoorRcControl, FrontDoorSupervisorPorts, GlobalConfig, HeadroomSupervisorConfig, Identity, IdentityCredentialChange, IdentityListEntry, IdentityListing, InjectedCredential, LaunchPlan, Layer, LayerId, LayoutPaths, LeafCert, Pool, PortableConfig, PrepareClaudeLaunchOptions, PrepareLaunchParams, ProfileListEntry, Provider, ProviderListEntry, RcAnswerDecision, RcAnswerDeps, RcControlAnswer, RcControlHandlerDeps, RcControlRequestDeps, RcControlTransport, RcDialAnswer, RcDialTarget, RcEventDial, RcEventWriteResult, RcExchangeObserver, RcInjectDeps, RcObservedCredential, RcObservedRequest, RcPendingRequestSummary, RcPermissionMode, RcSessionStatus, RcSessionSummary, RcSessionTracker, RcSessionTrackerDeps, RcWorkerFact, RcWriteHeaders, RecoverFarmParams, RecoveryResult, ResolveDecisionsInput, ResolvedState, ResyncFarmParams, ResyncFarmResult, RunCheckParams, RunDoctorParams, RunFrontDoorSupervisorOptions, RunSupervisorOptions, SupervisorPorts, UnreadableIdentityListEntry, UpdateDirectoryRuleOptions, UpdateProviderInput, UsageReadFs, UsageSnapshot, WhenCondition };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-shim",
-  "version": "8.5.6",
+  "version": "8.7.0",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",