claude-use 4.5.0 → 5.0.0

package/dist/index.cjs

@@ -31,15 +31,18 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var index_exports = {};
 __export(index_exports, {
   AMBIENT_CREDENTIAL_VARS: () => AMBIENT_CREDENTIAL_VARS,
+  CONNECT_INTERCEPT_HOST: () => CONNECT_INTERCEPT_HOST,
+  CONNECT_LIMITS: () => CONNECT_LIMITS,
   FARM_MANIFEST_FILENAME: () => FARM_MANIFEST_FILENAME,
-  HEADROOM_SERVED_PATH_PREFIX: () => HEADROOM_SERVED_PATH_PREFIX,
+  FrontDoorStartError: () => FrontDoorStartError,
   HeadroomStartError: () => HeadroomStartError,
-  MITM_INTERCEPT_HOST: () => MITM_INTERCEPT_HOST,
+  ROUTED_PATH_PREFIX: () => ROUTED_PATH_PREFIX,
   buildEntryFacts: () => buildEntryFacts,
   carryOver: () => carryOver,
   createLeafCache: () => createLeafCache,
   detectAmbientCredential: () => detectAmbientCredential,
   ensureCa: () => ensureCa,
+  ensureFrontDoor: () => ensureFrontDoor,
   ensureHeadroom: () => ensureHeadroom,
   evaluateAmbientCredentialGuard: () => evaluateAmbientCredentialGuard,
   formatAmbientCredentialGuardMessage: () => formatAmbientCredentialGuardMessage,
@@ -49,16 +52,17 @@ __export(index_exports, {
   mintLeaf: () => mintLeaf,
   parseConnectTarget: () => parseConnectTarget,
   readFarmManifest: () => readFarmManifest,
-  realMitmCertStore: () => realMitmCertStore,
-  realMitmEffects: () => realMitmEffects,
+  realConnectCertStore: () => realConnectCertStore,
+  realConnectEffects: () => realConnectEffects,
   recoverFarm: () => recoverFarm,
   recoveryDiagnostics: () => recoveryDiagnostics,
   resolveDecisions: () => resolveDecisions,
   resolveSupervisorConfig: () => resolveSupervisorConfig,
   resyncFarm: () => resyncFarm,
+  runFrontDoorSupervisor: () => runFrontDoorSupervisor,
   runSupervisor: () => runSupervisor,
-  servedByHeadroom: () => servedByHeadroom,
-  startMitmServer: () => startMitmServer,
+  servedByPipeline: () => servedByPipeline,
+  startConnectServer: () => startConnectServer,
   topLevelNames: () => topLevelNames
 });
 module.exports = __toCommonJS(index_exports);
@@ -1798,15 +1802,213 @@ function recoveryDiagnostics(recovery, identity) {
   ];
 }
 
-// src/headroom/mitm.ts
+// src/frontdoor/connect.ts
 var fs = __toESM(require("node:fs"), 1);
 var http = __toESM(require("node:http"), 1);
 var https = __toESM(require("node:https"), 1);
 var net = __toESM(require("node:net"), 1);
 var tls = __toESM(require("node:tls"), 1);
 var import_node_forge = __toESM(require("node-forge"), 1);
-var MITM_INTERCEPT_HOST = "api.anthropic.com";
-var HEADROOM_SERVED_PATH_PREFIX = "/v1/";
+
+// src/frontdoor/capability.ts
+var CONNECT_PROXY_REALM = "claude-use front door";
+var BASIC_SCHEME = "basic";
+function capabilityFromProxyAuthorization(value) {
+  const trimmed = value.trim();
+  const space = trimmed.indexOf(" ");
+  if (space === -1 || trimmed.slice(0, space).toLowerCase() !== BASIC_SCHEME) {
+    return void 0;
+  }
+  const userPass = Buffer.from(trimmed.slice(space + 1).trim(), "base64").toString("utf8");
+  const colon = userPass.indexOf(":");
+  if (colon === -1) {
+    return void 0;
+  }
+  const password = userPass.slice(colon + 1);
+  return password === "" ? void 0 : password;
+}
+
+// src/frontdoor/state.ts
+var import_node_path5 = __toESM(require("node:path"), 1);
+var import_zod3 = require("zod");
+var FrontDoorSessionSchema = import_zod3.z.strictObject({ pid: import_zod3.z.number().int().positive(), startedAt: import_zod3.z.number(), token: import_zod3.z.string().min(1) });
+var FrontDoorStateSchema = import_zod3.z.strictObject({
+  /** The supervisor process serving the front door. Alive means both listeners are up in that process. */
+  supervisorPid: import_zod3.z.number().int().positive().optional(),
+  /** The loopback port the HTTPS provider listener serves on. Absent until the listener has bound and answered its health probe, so "port is set" is itself the ready signal a launcher polls for. */
+  port: import_zod3.z.number().int().positive().optional(),
+  /**
+   * The sticky port preference for the provider listener: kept across crashes, restarts and idle shutdowns so every provider session, whose base URL was frozen at launch, keeps finding the front door at the same address.
+   */
+  lastPort: import_zod3.z.number().int().positive().optional(),
+  /**
+   * The loopback port the CONNECT surface listens on. Absent whenever no supervisor is serving it, so "connectPort is set" is the ready signal an OAuth launch polls for alongside `port`.
+   */
+  connectPort: import_zod3.z.number().int().positive().optional(),
+  /**
+   * The sticky port preference for the CONNECT surface, the exact analogue of `lastPort` for the second listener: it survives every shutdown, because every OAuth session's environment was frozen at launch with HTTPS_PROXY pointing at this address and a restart that moves strands them.
+   */
+  lastConnectPort: import_zod3.z.number().int().positive().optional(),
+  /**
+   * The loopback port the direct listener serves on: the listener a headroom hop tells the daemon to forward routed traffic back to. Sticky like the others, because headroom's allowlist admits its exact origin and an ephemeral port would invalidate the allowlist on every restart.
+   */
+  directPort: import_zod3.z.number().int().positive().optional(),
+  /** The sticky port preference for the direct listener, for the reason `directPort` gives. */
+  lastDirectPort: import_zod3.z.number().int().positive().optional(),
+  /** The last fatal error, kept across shutdowns so `frontdoor status` can explain a front door that is not running. */
+  lastError: import_zod3.z.string().optional()
+});
+function readFrontDoorState(fs2, stateFile) {
+  let raw;
+  try {
+    raw = fs2.readFileUtf8(stateFile);
+  } catch {
+    return void 0;
+  }
+  if (raw === void 0 || raw.trim() === "") {
+    return void 0;
+  }
+  try {
+    const parsed = FrontDoorStateSchema.safeParse(JSON.parse(raw));
+    return parsed.success ? parsed.data : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function writeFrontDoorState(fs2, stateFile, state) {
+  fs2.mkdirp(import_node_path5.default.dirname(stateFile));
+  fs2.writeFileUtf8(stateFile, `${JSON.stringify(state, null, 2)}
+`);
+}
+function frontDoorOrigin(state) {
+  const port = state?.directPort ?? state?.lastDirectPort;
+  return port === void 0 ? void 0 : `http://127.0.0.1:${String(port)}`;
+}
+function writeFrontDoorSession(fs2, sessionsDir, session) {
+  fs2.mkdirPrivate(sessionsDir);
+  fs2.writeFilePrivate(import_node_path5.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
+`);
+}
+function listFrontDoorSessions(fs2, sessionsDir) {
+  const sessions = [];
+  for (const name of fs2.readdir(sessionsDir)) {
+    if (!name.endsWith(".json")) {
+      continue;
+    }
+    try {
+      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs2.readFileUtf8(import_node_path5.default.join(sessionsDir, name)) ?? ""));
+      if (parsed.success) {
+        sessions.push({ pid: parsed.data.pid, startedAt: parsed.data.startedAt });
+      }
+    } catch {
+      continue;
+    }
+  }
+  return sessions.sort((a, b) => a.pid - b.pid);
+}
+function removeFrontDoorSession(fs2, sessionsDir, pid) {
+  fs2.removeRecursive(import_node_path5.default.join(sessionsDir, `${String(pid)}.json`));
+}
+function pruneDeadFrontDoorSessions(fs2, sessionsDir, isRunning) {
+  const removed = [];
+  for (const session of listFrontDoorSessions(fs2, sessionsDir)) {
+    if (!isRunning(session.pid)) {
+      removeFrontDoorSession(fs2, sessionsDir, session.pid);
+      removed.push(session.pid);
+    }
+  }
+  return removed;
+}
+
+// src/frontdoor/supervisor.ts
+var FRONTDOOR_SUPERVISOR_STILL_RUNNING = -1;
+var FRONTDOOR_POLL_MS = 1e3;
+var MS_PER_MINUTE = 6e4;
+async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {}) {
+  const { fs: fs2, paths } = ports;
+  const previous = readFrontDoorState(fs2, paths.frontdoorStateFile);
+  let lastPort = previous?.lastPort;
+  let lastConnectPort = previous?.lastConnectPort;
+  let lastDirectPort = previous?.lastDirectPort;
+  const sticky = () => ({
+    ...lastPort === void 0 ? {} : { lastPort },
+    ...lastConnectPort === void 0 ? {} : { lastConnectPort },
+    ...lastDirectPort === void 0 ? {} : { lastDirectPort }
+  });
+  const fail = (message) => {
+    writeFrontDoorState(fs2, paths.frontdoorStateFile, { lastError: message, ...sticky() });
+    fs2.removeRecursive(paths.frontdoorLockFile);
+    ports.log(`claude-use frontdoor supervisor: ${message}`);
+    return 1;
+  };
+  writeFrontDoorState(fs2, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, ...sticky() });
+  const previousSticky = lastPort;
+  let http2;
+  try {
+    http2 = await ports.startProviderListener(lastPort);
+  } catch (error) {
+    return fail(`could not start the provider listener: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  if (previousSticky !== void 0 && http2.port !== previousSticky) {
+    ports.log(`claude-use frontdoor supervisor: sticky port ${String(previousSticky)} was occupied; moving to ${String(http2.port)} (sessions launched against the old port are stale until they relaunch)`);
+  }
+  lastPort = http2.port;
+  const previousStickyConnect = lastConnectPort;
+  let connect2;
+  try {
+    connect2 = await ports.startConnectListener(lastConnectPort);
+  } catch (error) {
+    await http2.close();
+    return fail(`could not start the CONNECT surface: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  if (previousStickyConnect !== void 0 && connect2.port !== previousStickyConnect) {
+    ports.log(`claude-use frontdoor supervisor: sticky CONNECT port ${String(previousStickyConnect)} was occupied; moving to ${String(connect2.port)} (OAuth sessions launched against the old port are stale until they relaunch)`);
+  }
+  lastConnectPort = connect2.port;
+  const previousStickyDirect = lastDirectPort;
+  let direct;
+  try {
+    direct = await ports.startDirectListener(lastDirectPort);
+  } catch (error) {
+    await connect2.close();
+    await http2.close();
+    return fail(`could not start the direct listener: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  if (previousStickyDirect !== void 0 && direct.port !== previousStickyDirect) {
+    ports.log(`claude-use frontdoor supervisor: sticky direct port ${String(previousStickyDirect)} was occupied; moving to ${String(direct.port)} (headroom must be restarted to admit the new address)`);
+  }
+  lastDirectPort = direct.port;
+  writeFrontDoorState(fs2, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, port: http2.port, connectPort: connect2.port, directPort: direct.port, ...sticky() });
+  fs2.removeRecursive(paths.frontdoorLockFile);
+  ports.log(`claude-use frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http2.port)}, CONNECT surface on 127.0.0.1:${String(connect2.port)}`);
+  let idleSince;
+  let ticks = 0;
+  for (; ; ) {
+    if (options.tickLimit !== void 0 && ticks >= options.tickLimit) {
+      return FRONTDOOR_SUPERVISOR_STILL_RUNNING;
+    }
+    ticks += 1;
+    pruneDeadFrontDoorSessions(fs2, paths.frontdoorSessionsDir, ports.isRunning);
+    if (listFrontDoorSessions(fs2, paths.frontdoorSessionsDir).length === 0) {
+      idleSince ??= ports.now();
+      if (ports.now() - idleSince >= idleShutdownMinutes * MS_PER_MINUTE) {
+        ports.log(`claude-use frontdoor supervisor: no sessions for ${String(idleShutdownMinutes)} minute(s); closing the front door and exiting`);
+        await direct.close();
+        await connect2.close();
+        await http2.close();
+        writeFrontDoorState(fs2, paths.frontdoorStateFile, sticky());
+        return 0;
+      }
+    } else {
+      idleSince = void 0;
+    }
+    await ports.sleep(FRONTDOOR_POLL_MS);
+  }
+}
+
+// src/frontdoor/connect.ts
+var CONNECT_INTERCEPT_HOST = "api.anthropic.com";
+var ROUTED_PATH_PREFIX = "/v1/";
 var HTTPS_PORT = 443;
 var MAX_PORT = 65535;
 var SERIAL_NUMBER_BYTES = 16;
@@ -1816,9 +2018,22 @@ var CONNECT_LINE_TOKENS = 3;
 var HEAD_TERMINATOR = "\r\n\r\n";
 var MAX_CONNECT_HEAD_BYTES = 8192;
 var CONNECT_ESTABLISHED = "HTTP/1.1 200 Connection Established\r\n\r\n";
+var REFUSAL = {
+  badRequest: "400 Bad Request",
+  proxyAuthenticationRequired: "407 Proxy Authentication Required",
+  requestTimeout: "408 Request Timeout",
+  headTooLarge: "431 Request Header Fields Too Large",
+  serviceUnavailable: "503 Service Unavailable"
+};
+var CONNECT_LIMITS = {
+  headDeadlineMs: 1e4,
+  maxPendingHeads: 64,
+  maxTunnels: 1024,
+  revalidateMs: FRONTDOOR_POLL_MS
+};
 var CA_VALIDITY_DAYS = 3650;
 var LEAF_VALIDITY_DAYS = 397;
-var CA_SUBJECT_COMMON_NAME = "claude-use headroom CA";
+var CA_SUBJECT_COMMON_NAME = "claude-use front door CA";
 var MS_PER_DAY = 864e5;
 function parseConnectTarget(authority) {
   const colon = authority.lastIndexOf(":");
@@ -1836,8 +2051,8 @@ function parseConnectTarget(authority) {
 function isInterceptedHost(host, interceptHost) {
   return host === interceptHost;
 }
-function servedByHeadroom(path6) {
-  return path6?.startsWith(HEADROOM_SERVED_PATH_PREFIX) === true;
+function servedByPipeline(path7) {
+  return path7?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
   "connection",
@@ -1885,7 +2100,13 @@ function generateCa(now) {
   cert.sign(keys.privateKey, import_node_forge.default.md.sha256.create());
   return { certPem: import_node_forge.default.pki.certificateToPem(cert), keyPem: import_node_forge.default.pki.privateKeyToPem(keys.privateKey) };
 }
-function mintLeaf(ca, host, now) {
+var SAN_TYPE_DNS = 2;
+var SAN_TYPE_IP = 7;
+function mintLeaf(ca, names, now) {
+  const [commonName] = names;
+  if (commonName === void 0) {
+    throw new Error("a leaf certificate needs at least one name");
+  }
   const caCert = import_node_forge.default.pki.certificateFromPem(ca.certPem);
   const caKey = import_node_forge.default.pki.privateKeyFromPem(ca.keyPem);
   const keys = import_node_forge.default.pki.rsa.generateKeyPair({ bits: 2048 });
@@ -1894,13 +2115,13 @@ function mintLeaf(ca, host, now) {
   cert.serialNumber = import_node_forge.default.util.bytesToHex(import_node_forge.default.random.getBytesSync(SERIAL_NUMBER_BYTES));
   cert.validity.notBefore = new Date(now.getTime() - MS_PER_DAY);
   cert.validity.notAfter = new Date(now.getTime() + LEAF_VALIDITY_DAYS * MS_PER_DAY);
-  cert.setSubject([{ name: "commonName", value: host }]);
+  cert.setSubject([{ name: "commonName", value: commonName }]);
   cert.setIssuer(caCert.subject.attributes);
   cert.setExtensions([
     { name: "basicConstraints", cA: false, critical: true },
     { name: "keyUsage", digitalSignature: true, keyEncipherment: true, critical: true },
     { name: "extKeyUsage", serverAuth: true },
-    { name: "subjectAltName", altNames: [{ type: 2, value: host }] },
+    { name: "subjectAltName", altNames: names.map((name) => net.isIP(name) === 0 ? { type: SAN_TYPE_DNS, value: name } : { type: SAN_TYPE_IP, ip: name }) },
     { name: "subjectKeyIdentifier" },
     { name: "authorityKeyIdentifier", keyLocatorFields: [] }
   ]);
@@ -1914,7 +2135,7 @@ function createLeafCache(ca, now) {
     if (existing !== void 0) {
       return existing;
     }
-    const minted = mintLeaf(ca, host, now());
+    const minted = mintLeaf(ca, [host], now());
     cache.set(host, minted);
     return minted;
   };
@@ -1937,17 +2158,10 @@ function caParses(ca) {
     return false;
   }
 }
-async function startMitmServer(config, effects, preferredPort) {
+async function startConnectServer(config, effects, preferredPort) {
   const handler = (request3, response) => {
-    if (servedByHeadroom(request3.url)) {
-      const daemonPort = config.headroomPort();
-      if (daemonPort === void 0) {
-        const body = "claude-use headroom: the daemon is restarting";
-        response.writeHead(HTTP_BAD_GATEWAY, { "content-type": "text/plain", "content-length": String(body.length) });
-        response.end(body);
-        return;
-      }
-      effects.forwardHttp({ host: "127.0.0.1", port: daemonPort, tls: false }, request3, response);
+    if (servedByPipeline(request3.url)) {
+      config.serveRouted(request3, response);
       return;
     }
     effects.forwardHttp(config.upstream, request3, response);
@@ -1956,50 +2170,153 @@ async function startMitmServer(config, effects, preferredPort) {
   const tlsAcceptor = effects.createTlsAcceptor(config.leafFor(config.interceptHost), (secure) => {
     httpSession.serve(secure);
   });
+  const ledger = createConnectionLedger(config.limits, config.isLiveCapability);
   const listener = await effects.listenLoopback(preferredPort, (socket) => {
-    handleConnect(socket, config, effects, tlsAcceptor);
+    handleConnect(socket, { config, effects, tlsAcceptor, ledger });
   });
   return {
     port: listener.port,
     close: async () => {
+      ledger.close();
       await listener.close();
       tlsAcceptor.close();
       httpSession.close();
     }
   };
 }
-function handleConnect(socket, config, effects, tlsAcceptor) {
+function createConnectionLedger(limits, isLiveCapability) {
+  const pending = /* @__PURE__ */ new Map();
+  const authenticated = /* @__PURE__ */ new Map();
+  let tunnels = 0;
+  const leavePending = (socket) => {
+    const deadline = pending.get(socket);
+    if (deadline !== void 0) {
+      clearTimeout(deadline);
+      pending.delete(socket);
+    }
+  };
+  const revalidation = setInterval(() => {
+    for (const [capability, sockets] of authenticated) {
+      if (!isLiveCapability(capability)) {
+        for (const socket of sockets) {
+          socket.destroy();
+        }
+      }
+    }
+  }, limits.revalidateMs);
+  revalidation.unref();
+  return {
+    accept: (socket) => {
+      const [oldest] = pending.keys();
+      if (pending.size >= limits.maxPendingHeads && oldest !== void 0) {
+        leavePending(oldest);
+        refuse(oldest, REFUSAL.requestTimeout);
+      }
+      pending.set(
+        socket,
+        setTimeout(() => {
+          leavePending(socket);
+          refuse(socket, REFUSAL.requestTimeout);
+        }, limits.headDeadlineMs)
+      );
+      socket.once("close", () => {
+        leavePending(socket);
+      });
+    },
+    headReceived: leavePending,
+    establish: (socket, capability) => {
+      if (tunnels >= limits.maxTunnels) {
+        return false;
+      }
+      tunnels += 1;
+      const sockets = authenticated.get(capability) ?? /* @__PURE__ */ new Set();
+      sockets.add(socket);
+      authenticated.set(capability, sockets);
+      socket.once("close", () => {
+        tunnels -= 1;
+        sockets.delete(socket);
+        if (sockets.size === 0 && authenticated.get(capability) === sockets) {
+          authenticated.delete(capability);
+        }
+      });
+      return true;
+    },
+    close: () => {
+      clearInterval(revalidation);
+      for (const deadline of pending.values()) {
+        clearTimeout(deadline);
+      }
+      pending.clear();
+    }
+  };
+}
+function refuse(socket, status, headers = []) {
+  socket.removeAllListeners("data");
+  socket.pause();
+  if (socket.destroyed || socket.writableEnded) {
+    return;
+  }
+  socket.end(`HTTP/1.1 ${status}\r
+${headers.map((header) => `${header}\r
+`).join("")}content-length: 0\r
+connection: close\r
+\r
+`, () => {
+    socket.destroy();
+  });
+}
+function handleConnect(socket, context) {
+  socket.on("error", () => {
+    socket.destroy();
+  });
+  context.ledger.accept(socket);
   let buffer = Buffer.alloc(0);
   const onData = (chunk) => {
     buffer = Buffer.concat([buffer, chunk]);
     const headEnd = buffer.indexOf(HEAD_TERMINATOR);
+    if (headEnd === -1 ? buffer.length > MAX_CONNECT_HEAD_BYTES : headEnd > MAX_CONNECT_HEAD_BYTES) {
+      context.ledger.headReceived(socket);
+      refuse(socket, REFUSAL.headTooLarge);
+      return;
+    }
     if (headEnd === -1) {
-      if (buffer.length > MAX_CONNECT_HEAD_BYTES) {
-        socket.removeListener("data", onData);
-        socket.pause();
-        socket.destroy();
-      }
       return;
     }
     socket.removeListener("data", onData);
     socket.pause();
+    context.ledger.headReceived(socket);
     const head = buffer.subarray(0, headEnd).toString("utf8");
     socket.unshift(buffer.subarray(headEnd + HEAD_TERMINATOR.length));
-    routeConnect(socket, head, config, effects, tlsAcceptor);
+    routeConnect(socket, head, context);
   };
   socket.on("data", onData);
-  socket.on("error", () => {
-    socket.destroy();
-  });
 }
-function routeConnect(socket, head, config, effects, tlsAcceptor) {
+function proxyAuthorizationOf(head) {
+  const values = head.split("\r\n").slice(1).flatMap((line) => {
+    const colon = line.indexOf(":");
+    return colon > 0 && line.slice(0, colon).trim().toLowerCase() === "proxy-authorization" ? [line.slice(colon + 1)] : [];
+  });
+  const [value] = values;
+  return values.length === 1 ? value : void 0;
+}
+function routeConnect(socket, head, context) {
+  const { config, effects, tlsAcceptor, ledger } = context;
+  const credential = proxyAuthorizationOf(head);
+  const capability = credential === void 0 ? void 0 : capabilityFromProxyAuthorization(credential);
+  if (capability === void 0 || !config.isLiveCapability(capability)) {
+    refuse(socket, REFUSAL.proxyAuthenticationRequired, [`Proxy-Authenticate: Basic realm="${CONNECT_PROXY_REALM}"`]);
+    return;
+  }
   const requestLine = head.split("\r\n", 1)[0] ?? "";
   const parts = requestLine.split(" ");
   const authority = parts.length === CONNECT_LINE_TOKENS && parts[0]?.toUpperCase() === "CONNECT" ? parts[1] ?? "" : void 0;
   const target = authority === void 0 ? void 0 : parseConnectTarget(authority);
   if (target === void 0) {
-    socket.write("HTTP/1.1 400 Bad Request\r\ncontent-length: 0\r\n\r\n");
-    socket.destroy();
+    refuse(socket, REFUSAL.badRequest);
+    return;
+  }
+  if (!ledger.establish(socket, capability)) {
+    refuse(socket, REFUSAL.serviceUnavailable);
     return;
   }
   socket.write(CONNECT_ESTABLISHED);
@@ -2017,6 +2334,10 @@ async function blindTunnel(socket, target, effects) {
     socket.destroy();
     return;
   }
+  if (socket.destroyed) {
+    upstream.destroy();
+    return;
+  }
   socket.pipe(upstream);
   upstream.pipe(socket);
   const drop = () => {
@@ -2032,7 +2353,7 @@ async function blindTunnel(socket, target, effects) {
     socket.destroy();
   });
 }
-function realMitmEffects() {
+function realConnectEffects() {
   const plainAgent = new http.Agent({ keepAlive: true });
   const tlsAgent = new https.Agent({ keepAlive: true });
   const listenOnce = async (port, onSocket) => await new Promise((resolve, reject) => {
@@ -2161,7 +2482,7 @@ function realMitmEffects() {
 function isEnoent(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 }
-function realMitmCertStore(paths) {
+function realConnectCertStore(paths) {
   const read = (file) => {
     try {
       return fs.readFileSync(file, "utf8");
@@ -2174,54 +2495,49 @@ function realMitmCertStore(paths) {
   };
   return {
     loadCa: () => {
-      const certPem = read(paths.headroomCaCertFile);
-      const keyPem = read(paths.headroomCaKeyFile);
+      const certPem = read(paths.frontdoorCaCertFile);
+      const keyPem = read(paths.frontdoorCaKeyFile);
       return certPem === void 0 || keyPem === void 0 ? void 0 : { certPem, keyPem };
     },
     writeCa: (ca) => {
-      fs.mkdirSync(paths.headroomCaDir, { recursive: true });
-      fs.writeFileSync(paths.headroomCaCertFile, ca.certPem, "utf8");
-      fs.writeFileSync(paths.headroomCaKeyFile, ca.keyPem, { encoding: "utf8", mode: CA_KEY_FILE_MODE });
-      fs.chmodSync(paths.headroomCaKeyFile, CA_KEY_FILE_MODE);
+      fs.mkdirSync(paths.frontdoorCaDir, { recursive: true });
+      fs.writeFileSync(paths.frontdoorCaCertFile, ca.certPem, "utf8");
+      fs.writeFileSync(paths.frontdoorCaKeyFile, ca.keyPem, { encoding: "utf8", mode: CA_KEY_FILE_MODE });
+      fs.chmodSync(paths.frontdoorCaKeyFile, CA_KEY_FILE_MODE);
     }
   };
 }
 
+// src/frontdoor/ensure.ts
+var import_node_crypto3 = require("node:crypto");
+
 // src/headroom/state.ts
 var import_node_crypto2 = require("node:crypto");
-var import_node_path5 = __toESM(require("node:path"), 1);
-var import_zod3 = require("zod");
+var import_node_path6 = __toESM(require("node:path"), 1);
+var import_zod4 = require("zod");
 var HEADROOM_ANTHROPIC_UPSTREAM = "https://api.anthropic.com";
-var HeadroomStateSchema = import_zod3.z.strictObject({
+var HeadroomStateSchema = import_zod4.z.strictObject({
   /** The supervisor process owning the daemon. Alive means someone is keeping headroom running. */
-  supervisorPid: import_zod3.z.number().int().positive().optional(),
+  supervisorPid: import_zod4.z.number().int().positive().optional(),
   /** The headroom proxy process itself. Absent while the supervisor is between restarts. */
-  headroomPid: import_zod3.z.number().int().positive().optional(),
+  headroomPid: import_zod4.z.number().int().positive().optional(),
   /** The loopback port the proxy listens on. Absent until the proxy has passed its readiness check, so "port is set" is itself the ready signal a launcher polls for. */
-  port: import_zod3.z.number().int().positive().optional(),
-  /**
-   * The loopback port the supervisor's in-process MITM CONNECT proxy listens on. Absent whenever no supervisor is serving it, so "mitmPort is set" is the ready signal an OAuth launch polls for alongside `port`.
-   */
-  mitmPort: import_zod3.z.number().int().positive().optional(),
-  /**
-   * The sticky MITM port preference, the exact analogue of `lastPort` for the second server: it survives every shutdown, because every OAuth session's environment was frozen at launch with HTTPS_PROXY pointing at this address and a restart that moves strands them.
-   */
-  lastMitmPort: import_zod3.z.number().int().positive().optional(),
+  port: import_zod4.z.number().int().positive().optional(),
   /**
-   * The sticky port preference: the address the daemon last served on, kept across crashes, restarts, and idle shutdowns so the next start reuses it. Distinct from `port` on purpose: `port` is the ready signal (absent whenever nothing is serving), while `lastPort` survives every shutdown, because every live session's environment was frozen at launch pointing at this address and a restart that moves strands them.
+   * The sticky port preference: the address the daemon last served on, kept across crashes, restarts, and idle shutdowns so the next start reuses it. Distinct from `port` on purpose: `port` is the ready signal (absent whenever nothing is serving), while `lastPort` survives every shutdown, because the front door (which routes sessions through this daemon) reads it live and follows a restart to whichever address it lands on.
    */
-  lastPort: import_zod3.z.number().int().positive().optional(),
+  lastPort: import_zod4.z.number().int().positive().optional(),
   /** The `headroom --version` output of the running install. */
-  version: import_zod3.z.string().optional(),
+  version: import_zod4.z.string().optional(),
   /** Hash of the allowlist the running proxy was started with, so a provider-file change is detected as drift. */
-  allowlistHash: import_zod3.z.string().optional(),
+  allowlistHash: import_zod4.z.string().optional(),
   /** The install spec the running install was last installed from, so a `source` config change is detected as drift. */
-  installedSource: import_zod3.z.string().optional(),
+  installedSource: import_zod4.z.string().optional(),
   /** The last fatal error, kept across shutdowns so `headroom status` can explain a daemon that is not running. */
-  lastError: import_zod3.z.string().optional()
+  lastError: import_zod4.z.string().optional()
 });
-var HeadroomSessionSchema = import_zod3.z.strictObject({ pid: import_zod3.z.number().int().positive(), startedAt: import_zod3.z.number() });
-var HeadroomLockSchema = import_zod3.z.strictObject({ pid: import_zod3.z.number().int().positive(), at: import_zod3.z.number() });
+var HeadroomSessionSchema = import_zod4.z.strictObject({ pid: import_zod4.z.number().int().positive(), startedAt: import_zod4.z.number() });
+var HeadroomLockSchema = import_zod4.z.strictObject({ pid: import_zod4.z.number().int().positive(), at: import_zod4.z.number() });
 function parseJson(raw, schema) {
   if (raw === void 0 || raw.trim() === "") {
     return void 0;
@@ -2237,7 +2553,7 @@ function readHeadroomState(fs2, stateFile) {
   }
 }
 function writeHeadroomState(fs2, stateFile, state) {
-  fs2.mkdirp(import_node_path5.default.dirname(stateFile));
+  fs2.mkdirp(import_node_path6.default.dirname(stateFile));
   fs2.writeFileUtf8(stateFile, `${JSON.stringify(state, null, 2)}
 `);
 }
@@ -2249,16 +2565,8 @@ function headroomAllowlist(providers) {
   return [...urls].sort();
 }
 function headroomUpstreams(providers, frontDoorOrigin2) {
-  const upstreams = [];
-  let hasCodex = false;
-  for (const provider of providers) {
-    if (isCodexProvider(provider)) {
-      hasCodex = true;
-    } else {
-      upstreams.push({ baseUrl: provider.baseUrl });
-    }
-  }
-  if (hasCodex && frontDoorOrigin2 !== void 0) {
+  const upstreams = providers.filter((provider) => !isCodexProvider(provider)).map((provider) => ({ baseUrl: provider.baseUrl }));
+  if (providers.length > 0 && frontDoorOrigin2 !== void 0) {
     upstreams.push({ baseUrl: frontDoorOrigin2 });
   }
   return upstreams;
@@ -2273,7 +2581,7 @@ function readAllProviders(fs2, providersDir) {
       continue;
     }
     try {
-      const parsed = parseJson(fs2.readFileUtf8(import_node_path5.default.join(providersDir, name)), ProviderSchema);
+      const parsed = parseJson(fs2.readFileUtf8(import_node_path6.default.join(providersDir, name)), ProviderSchema);
       if (parsed !== void 0) {
         result.push({ name: name.slice(0, -".json".length), provider: parsed });
       }
@@ -2285,11 +2593,11 @@ function readAllProviders(fs2, providersDir) {
 }
 function writeSession(fs2, sessionsDir, session) {
   fs2.mkdirp(sessionsDir);
-  fs2.writeFileUtf8(import_node_path5.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
+  fs2.writeFileUtf8(import_node_path6.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
 `);
 }
 function removeSession(fs2, sessionsDir, pid) {
-  fs2.removeRecursive(import_node_path5.default.join(sessionsDir, `${String(pid)}.json`));
+  fs2.removeRecursive(import_node_path6.default.join(sessionsDir, `${String(pid)}.json`));
 }
 function listSessions(fs2, sessionsDir) {
   const sessions = [];
@@ -2298,7 +2606,7 @@ function listSessions(fs2, sessionsDir) {
       continue;
     }
     try {
-      const parsed = parseJson(fs2.readFileUtf8(import_node_path5.default.join(sessionsDir, name)), HeadroomSessionSchema);
+      const parsed = parseJson(fs2.readFileUtf8(import_node_path6.default.join(sessionsDir, name)), HeadroomSessionSchema);
       if (parsed !== void 0) {
         sessions.push(parsed);
       }
@@ -2326,6 +2634,67 @@ function readStartLock(fs2, lockFile) {
   }
 }
 
+// src/frontdoor/ensure.ts
+var FRONTDOOR_START_TIMEOUT_MS = 3e4;
+var FRONTDOOR_LAUNCHER_POLL_MS = 100;
+var FrontDoorStartError = class extends CliError {
+  constructor(message) {
+    super(message);
+    this.name = "FrontDoorStartError";
+  }
+};
+function ensureFrontDoor(params) {
+  const { paths, ports } = params;
+  const deadline = ports.now() + FRONTDOOR_START_TIMEOUT_MS;
+  let spawned = false;
+  const distrusted = /* @__PURE__ */ new Set();
+  let lastRejection;
+  for (; ; ) {
+    const state = readFrontDoorState(ports.fs, paths.frontdoorStateFile);
+    const supervisorPid = state?.supervisorPid;
+    if (supervisorPid !== void 0 && !distrusted.has(supervisorPid) && ports.isRunning(supervisorPid)) {
+      if (state?.port !== void 0 && state.connectPort !== void 0) {
+        const verdict = ports.verifyListener(state.port);
+        if (verdict.ok) {
+          const token = (0, import_node_crypto3.randomUUID)();
+          writeFrontDoorSession(ports.fs, paths.frontdoorSessionsDir, { pid: params.launcherPid, startedAt: ports.now(), token });
+          return { port: state.port, connectPort: state.connectPort, token };
+        }
+        lastRejection = `the listener on 127.0.0.1:${String(state.port)} (recorded for pid ${String(supervisorPid)}) failed authentication: ${verdict.reason}`;
+        if (spawned) {
+          throw new FrontDoorStartError(`claude-use: ${lastRejection}; refusing to send this session's credentials to it. Daemon log: ${paths.frontdoorLogPath}`);
+        }
+        distrusted.add(supervisorPid);
+        continue;
+      }
+      if (state?.lastError !== void 0) {
+        throw new FrontDoorStartError(`claude-use: the front door reported a fatal error and is not serving: ${state.lastError} (daemon log: ${paths.frontdoorLogPath})`);
+      }
+    } else if (!spawned) {
+      ports.fs.mkdirp(paths.frontdoorDir);
+      const created = ports.fs.writeFileExclusive(paths.frontdoorLockFile, `${JSON.stringify({ pid: params.launcherPid, at: ports.now() })}
+`);
+      if (created) {
+        ports.spawnSupervisor(paths);
+        spawned = true;
+      } else {
+        const lock = readStartLock(ports.fs, paths.frontdoorLockFile);
+        if (lock === void 0 || !ports.isRunning(lock.pid)) {
+          ports.fs.removeRecursive(paths.frontdoorLockFile);
+          continue;
+        }
+      }
+    }
+    if (ports.now() >= deadline) {
+      const lastError = state?.lastError;
+      throw new FrontDoorStartError(
+        `claude-use: the front door did not become ready within ${String(FRONTDOOR_START_TIMEOUT_MS)}ms` + (lastError === void 0 ? "" : ` (last error: ${lastError})`) + (lastRejection === void 0 ? "" : ` (${lastRejection})`) + `. Daemon log: ${paths.frontdoorLogPath}`
+      );
+    }
+    ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
+  }
+}
+
 // src/headroom/ensure.ts
 var HEADROOM_START_TIMEOUT_MS = 12e4;
 var HEADROOM_LAUNCHER_POLL_MS = 250;
@@ -2342,10 +2711,10 @@ function ensureHeadroom(params) {
   for (; ; ) {
     const state = readHeadroomState(ports.fs, paths.headroomStateFile);
     if (state?.supervisorPid !== void 0 && ports.isRunning(state.supervisorPid)) {
-      const daemonUp = state.port !== void 0 && state.mitmPort !== void 0 && state.headroomPid !== void 0 && ports.isRunning(state.headroomPid);
-      if (daemonUp && state.port !== void 0 && state.mitmPort !== void 0) {
+      const daemonUp = state.port !== void 0 && state.headroomPid !== void 0 && ports.isRunning(state.headroomPid);
+      if (daemonUp && state.port !== void 0) {
         writeSession(ports.fs, paths.headroomSessionsDir, { pid: params.launcherPid, startedAt: ports.now() });
-        return { port: state.port, mitmPort: state.mitmPort };
+        return { port: state.port };
       }
       if (state.lastError !== void 0) {
         throw new HeadroomStartError(
@@ -2380,42 +2749,6 @@ function ensureHeadroom(params) {
   }
 }
 
-// src/frontdoor/state.ts
-var import_zod4 = require("zod");
-var FrontDoorStateSchema = import_zod4.z.strictObject({
-  /** The supervisor process serving the front door. Alive means the listener is up in that process. */
-  supervisorPid: import_zod4.z.number().int().positive().optional(),
-  /** The loopback port the front-door listener serves on. Absent until the listener has bound and answered its health probe, so "port is set" is itself the ready signal a launcher polls for. */
-  port: import_zod4.z.number().int().positive().optional(),
-  /**
-   * The sticky port preference: kept across crashes, restarts and idle shutdowns so every session, whose base URL was frozen at launch, keeps finding the front door at the same address.
-   */
-  lastPort: import_zod4.z.number().int().positive().optional(),
-  /** The last fatal error, kept across shutdowns so `frontdoor status` can explain a front door that is not running. */
-  lastError: import_zod4.z.string().optional()
-});
-function readFrontDoorState(fs2, stateFile) {
-  let raw;
-  try {
-    raw = fs2.readFileUtf8(stateFile);
-  } catch {
-    return void 0;
-  }
-  if (raw === void 0 || raw.trim() === "") {
-    return void 0;
-  }
-  try {
-    const parsed = FrontDoorStateSchema.safeParse(JSON.parse(raw));
-    return parsed.success ? parsed.data : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function frontDoorOrigin(state) {
-  const port = state?.port ?? state?.lastPort;
-  return port === void 0 ? void 0 : `http://127.0.0.1:${String(port)}`;
-}
-
 // src/headroom/supervisor.ts
 function resolveSupervisorConfig(configured) {
   return {
@@ -2428,7 +2761,7 @@ var HEADROOM_BACKOFF_CAP_MS = 3e4;
 var HEADROOM_START_RETRY_BUDGET = 5;
 var HEADROOM_READY_TIMEOUT_MS = 15e3;
 var HEADROOM_POLL_MS = 1e3;
-var MS_PER_MINUTE = 6e4;
+var MS_PER_MINUTE2 = 6e4;
 function backoffForAttempt(attempt) {
   return Math.min(HEADROOM_BACKOFF_CAP_MS, HEADROOM_BACKOFF_BASE_MS * 2 ** (attempt - 1));
 }
@@ -2488,13 +2821,7 @@ async function runSupervisor(config, ports, options = {}) {
   const previousState = readHeadroomState(fs2, paths.headroomStateFile);
   let installedSource = previousState?.installedSource;
   let lastPort = previousState?.lastPort;
-  let lastMitmPort = previousState?.lastMitmPort;
-  let daemonPort;
-  const sticky = () => ({
-    ...lastPort === void 0 ? {} : { lastPort },
-    ...lastMitmPort === void 0 ? {} : { lastMitmPort }
-  });
-  let mitm;
+  const sticky = () => lastPort === void 0 ? {} : { lastPort };
   const fail = (message) => {
     writeHeadroomState(fs2, paths.headroomStateFile, {
       lastError: message,
@@ -2523,18 +2850,7 @@ async function runSupervisor(config, ports, options = {}) {
     return fail(`could not install headroom from ${config.source}: install failed (is uv installed and on PATH?)`);
   }
   const version = ports.headroomVersion() ?? "unknown";
-  try {
-    mitm = await ports.startMitm(lastMitmPort, () => daemonPort);
-  } catch (error) {
-    return fail(`could not start the MITM proxy: ${error instanceof Error ? error.message : String(error)}`);
-  }
-  lastMitmPort = mitm.port;
-  if (previousState?.lastMitmPort !== void 0 && mitm.port !== previousState.lastMitmPort) {
-    ports.log(
-      `claude-use headroom supervisor: sticky MITM port ${String(previousState.lastMitmPort)} was occupied; moving to ${String(mitm.port)} (OAuth sessions launched against the old port are stale until they relaunch)`
-    );
-  }
-  writeHeadroomState(fs2, paths.headroomStateFile, { supervisorPid: ports.ownPid, version, installedSource, mitmPort: mitm.port, ...sticky() });
+  writeHeadroomState(fs2, paths.headroomStateFile, { supervisorPid: ports.ownPid, version, installedSource, ...sticky() });
   ports.log(`claude-use headroom supervisor ${String(ports.ownPid)}: managing headroom on allowlist [${allowlistOf(ports).join(", ")}]`);
   const orphanPid = previousState?.headroomPid;
   if (orphanPid !== void 0 && ports.isRunning(orphanPid)) {
@@ -2559,13 +2875,11 @@ async function runSupervisor(config, ports, options = {}) {
       if (crashed) {
         ports.log(`claude-use headroom supervisor: headroom pid ${String(headroomPid)} died`);
         headroomPid = void 0;
-        daemonPort = void 0;
         runningHash = void 0;
         writeHeadroomState(fs2, paths.headroomStateFile, {
           supervisorPid: ports.ownPid,
           version,
           installedSource,
-          mitmPort: mitm.port,
           ...sticky()
         });
       }
@@ -2582,7 +2896,6 @@ async function runSupervisor(config, ports, options = {}) {
       if (ready) {
         consecutiveFailures = 0;
         headroomPid = pid;
-        daemonPort = port;
         runningHash = allowlistHash;
         lastPort = port;
         if (previousSticky !== void 0 && port !== previousSticky) {
@@ -2594,7 +2907,6 @@ async function runSupervisor(config, ports, options = {}) {
           supervisorPid: ports.ownPid,
           headroomPid: pid,
           port,
-          mitmPort: mitm.port,
           version,
           allowlistHash,
           installedSource: config.source,
@@ -2618,7 +2930,6 @@ async function runSupervisor(config, ports, options = {}) {
           ports.log("claude-use headroom supervisor: configuration drifted and no sessions are live; restarting headroom");
           ports.stopProcess(headroomPid);
           headroomPid = void 0;
-          daemonPort = void 0;
           runningHash = void 0;
           continue;
         }
@@ -2627,13 +2938,11 @@ async function runSupervisor(config, ports, options = {}) {
       if (sessions.length === 0) {
         idleSince ??= ports.now();
         const idleMs = ports.now() - idleSince;
-        if (idleMs >= config.idleShutdownMinutes * MS_PER_MINUTE) {
+        if (idleMs >= config.idleShutdownMinutes * MS_PER_MINUTE2) {
           ports.log(
-            `claude-use headroom supervisor: no sessions for ${String(config.idleShutdownMinutes)} minute(s); stopping headroom and the MITM proxy, and exiting`
+            `claude-use headroom supervisor: no sessions for ${String(config.idleShutdownMinutes)} minute(s); stopping headroom and exiting`
           );
           ports.stopProcess(headroomPid);
-          daemonPort = void 0;
-          await mitm.close();
           writeHeadroomState(fs2, paths.headroomStateFile, {
             version,
             ...sticky()
@@ -2716,15 +3025,18 @@ function evaluateAmbientCredentialGuard(params) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AMBIENT_CREDENTIAL_VARS,
+  CONNECT_INTERCEPT_HOST,
+  CONNECT_LIMITS,
   FARM_MANIFEST_FILENAME,
-  HEADROOM_SERVED_PATH_PREFIX,
+  FrontDoorStartError,
   HeadroomStartError,
-  MITM_INTERCEPT_HOST,
+  ROUTED_PATH_PREFIX,
   buildEntryFacts,
   carryOver,
   createLeafCache,
   detectAmbientCredential,
   ensureCa,
+  ensureFrontDoor,
   ensureHeadroom,
   evaluateAmbientCredentialGuard,
   formatAmbientCredentialGuardMessage,
@@ -2734,15 +3046,16 @@ function evaluateAmbientCredentialGuard(params) {
   mintLeaf,
   parseConnectTarget,
   readFarmManifest,
-  realMitmCertStore,
-  realMitmEffects,
+  realConnectCertStore,
+  realConnectEffects,
   recoverFarm,
   recoveryDiagnostics,
   resolveDecisions,
   resolveSupervisorConfig,
   resyncFarm,
+  runFrontDoorSupervisor,
   runSupervisor,
-  servedByHeadroom,
-  startMitmServer,
+  servedByPipeline,
+  startConnectServer,
   topLevelNames
 });