claude-use 4.5.0 → 5.0.1

package/dist/types/launcher/ports.d.ts

@@ -42,6 +42,10 @@ export interface FarmFs {
     readonly readFileUtf8: (path: string) => string | undefined;
     /** Writes a file's full contents as UTF-8 text, creating or truncating it. */
     readonly writeFileUtf8: (path: string, contents: string) => void;
+    /** Creates a directory (and any missing parents) readable only by its owner: mode 0700, enforced on the leaf even when it already existed with a wider mode. For a directory holding capabilities another local account must never read. */
+    readonly mkdirPrivate: (path: string) => void;
+    /** Writes a file's full contents as UTF-8 text readable only by its owner (mode 0600), atomically: a temporary sibling is written at that mode and renamed into place, so no reader ever sees a partial file or a wider mode. */
+    readonly writeFilePrivate: (path: string, contents: string) => void;
     /** Creates a file only if it does not already exist, returning false when it does. This is the exclusive-create the identity lock depends on for its mutual exclusion — a read-then-write pair would race. */
     readonly writeFileExclusive: (path: string, contents: string) => boolean;
     /** A stable content hash of one file, or undefined when it is missing or is not a regular file. Used only to recognise farm data that has already been adopted into the canonical tree. */
@@ -89,14 +93,10 @@ export interface LogPort {
     readonly warn: (message: string) => void;
     readonly error: (message: string) => void;
 }
-/** The running headroom daemon one launch routed through, as `HeadroomPort.ensure` reports it. */
+/** The running headroom daemon one launch routed through, as `HeadroomPort.ensure` reports it. The front door owns the session's routing; this names the daemon the door's headroom hop forwards to, and the project identity headroom scopes memory to. */
 export interface HeadroomUp {
-    /** The loopback port the local headroom proxy listens on. */
+    /** The loopback port the headroom daemon listens on: what the door's headroom hop reads live and `HEADROOM_PROXY_URL` names for anything else that wants the daemon. */
     readonly port: number;
-    /** The loopback port the supervisor's MITM CONNECT proxy listens on: what an OAuth launch points HTTPS_PROXY at. */
-    readonly mitmPort: number;
-    /** Path to the MITM proxy's CA certificate, what an OAuth launch points NODE_EXTRA_CA_CERTS at so the child trusts the terminated TLS. */
-    readonly caCertPath: string;
     /** The project identity headroom scopes memory state to: the git repo root of the launch directory, or the directory itself outside a repository. */
     readonly projectId: string;
 }
@@ -110,12 +110,24 @@ export interface HeadroomPort {
     readonly release: () => void;
 }
 /**
- * Everything the launcher needs from the front-door daemon, injected like `HeadroomPort`: `ensure` brings the door up (spawning its detached supervisor when nothing healthy is serving), registers this launch in its session registry and returns the listener's loopback port; `release` removes that registration when the spawned `claude` exits.
+ * Everything the launcher needs from the front-door daemon, injected like `HeadroomPort`: `ensure` brings the door up (spawning its detached supervisor when nothing authenticated is serving), registers this launch in its session registry and returns both listeners' loopback ports plus the CA bundle the child must trust; `release` removes that registration when the spawned `claude` exits.
  */
 export interface FrontDoorPort {
-    readonly ensure: () => {
-        readonly port: number;
-    };
+    /** `inheritedExtraCaCerts` is the parent environment's own `NODE_EXTRA_CA_CERTS`, which the returned trust bundle keeps (see `resolveTrustBundle`). */
+    readonly ensure: (inheritedExtraCaCerts: string | undefined) => FrontDoorUp;
     readonly release: () => void;
 }
+/** The running front door one launch routed through, as `FrontDoorPort.ensure` reports it. */
+export interface FrontDoorUp {
+    /** The loopback port the provider listener serves HTTPS on: the base URL every provider session points at. */
+    readonly port: number;
+    /** The loopback port the CONNECT surface listens on: what an OAuth launch points HTTPS_PROXY at. */
+    readonly connectPort: number;
+    /** The CA bundle every routed child points NODE_EXTRA_CA_CERTS at: claude-use's CA (which signs both the provider listener's leaf and the CONNECT surface's), plus whatever the parent environment already trusted that way. */
+    readonly trustBundlePath: string;
+    /** Why the trust bundle dropped something the parent environment named, when it did; the launcher logs it. */
+    readonly trustWarning?: string;
+    /** This launch's capability token, injected alongside the session headers and required by the door before it routes anything. */
+    readonly sessionToken: string;
+}
 export {};

package/dist/types/paths.d.ts

@@ -24,12 +24,6 @@ export interface LayoutPaths {
     readonly claudeShimFile: string;
     /** Directory holding the headroom daemon's coordination state: state.json, the start lock, and the session registry. */
     readonly headroomDir: string;
-    /** Directory holding the MITM proxy's certificate authority: ca.pem (public, handed to children as NODE_EXTRA_CA_CERTS) and ca.key (mode 0600). */
-    readonly headroomCaDir: string;
-    /** Path to the MITM proxy's CA certificate, generated once and stable across restarts so children keep trusting it. */
-    readonly headroomCaCertFile: string;
-    /** Path to the MITM proxy's CA private key, mode 0600. */
-    readonly headroomCaKeyFile: string;
     /** Path to the headroom supervisor's state.json: pids, port, version, allowlist hash, last error. */
     readonly headroomStateFile: string;
     /** Path to the exclusive-create marker guarding "who spawns the supervisor" so concurrent launches start at most one. */
@@ -42,6 +36,14 @@ export interface LayoutPaths {
     readonly headroomLogPath: string;
     /** Directory holding the front-door daemon's coordination state: state.json, the start lock, and the session registry. */
     readonly frontdoorDir: string;
+    /** Directory holding the front door's certificate authority, which signs both the provider listener's loopback leaf and the CONNECT surface's intercept leaf: ca.pem (public, handed to children through NODE_EXTRA_CA_CERTS) and ca.key (mode 0600). */
+    readonly frontdoorCaDir: string;
+    /** Path to the front door's CA certificate, generated once and stable across restarts so children keep trusting it. */
+    readonly frontdoorCaCertFile: string;
+    /** Path to the front door's CA private key, mode 0600: whoever can read it can impersonate the door to every routed child. */
+    readonly frontdoorCaKeyFile: string;
+    /** Directory of combined CA bundles: a parent environment's own NODE_EXTRA_CA_CERTS file plus the front door's CA, one file per distinct combination, for children that must keep trusting both. */
+    readonly frontdoorCaBundlesDir: string;
     /** Path to the front door's state.json: its supervisor pid, its port, and the sticky port it last served on. */
     readonly frontdoorStateFile: string;
     /** Path to the exclusive-create marker guarding "who spawns the front-door supervisor" so concurrent launches start at most one. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-use",
-  "version": "4.5.0",
+  "version": "5.0.1",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "Apache-2.0",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",

package/dist/types/headroom/mitm.d.ts

@@ -1,138 +0,0 @@
-import type { IncomingHttpHeaders, IncomingMessage, ServerResponse } from "node:http";
-import * as net from "node:net";
-/**
- * A CONNECT proxy the headroom supervisor runs as a second server in its own process, so an OAuth session can have headroom's compression AND Claude Code's Remote Control at once: Remote Control refuses any `ANTHROPIC_BASE_URL` other than the real API, but happily honours `HTTPS_PROXY`, so OAuth launches route at the proxy layer instead.
- *
- * Every CONNECT target is blind-tunnelled byte for byte EXCEPT the intercept host (Claude Code's own API), whose TLS this proxy terminates with a leaf certificate signed by a locally generated CA. On the terminated session, paths headroom serves are forwarded to headroom's existing loopback port over plain HTTP (compression, per-session stats, and upstream auth unchanged; the client's Authorization header passes through untouched), and every other path is piped by this proxy to the real upstream over TLS, so Remote Control's streaming, OAuth refreshes, and unknown endpoints bypass headroom entirely.
- */
-/** The one CONNECT host whose TLS gets terminated: Claude Code's own API, the upstream headroom compresses. */
-export declare const MITM_INTERCEPT_HOST = "api.anthropic.com";
-/** Paths under this prefix are what headroom serves; everything else on the terminated session goes to the real upstream. */
-export declare const HEADROOM_SERVED_PATH_PREFIX = "/v1/";
-/** The port HTTPS is served on, both the default when a CONNECT authority names none and the port non-headroom paths are piped to on the real upstream. */
-export declare const HTTPS_PORT = 443;
-/** One parsed CONNECT authority, the host lowercased and the port defaulted. */
-export interface ConnectTarget {
-    readonly host: string;
-    readonly port: number;
-}
-/** Parses a CONNECT authority (`host:port`, or a bare `host` meaning 443), or undefined when it names no host or a non-numeric port. */
-export declare function parseConnectTarget(authority: string): ConnectTarget | undefined;
-/** Whether a CONNECT target's host (port already stripped) is the one whose TLS this proxy terminates. */
-export declare function isInterceptedHost(host: string, interceptHost: string): boolean;
-/** Whether a request path on the terminated session is one headroom serves. The query string stays part of the path: `/v1/messages?beta=true` is still headroom's. */
-export declare function servedByHeadroom(path: string | undefined): boolean;
-/**
- * Headers a forwarded HTTP message keeps: everything except the hop-by-hop set, which belongs to whichever connection carried it and must not leak onto the next one. The `Connection` header's own value can name further hop-by-hop headers (RFC 9110 section 7.6.1), so those go too. Returns a fresh object; the input is the live parser's map and is never mutated.
- */
-export declare function forwardableHeaders(headers: Readonly<IncomingHttpHeaders>): IncomingHttpHeaders;
-/** A CA certificate and its private key, both as PEM. */
-export interface CaMaterial {
-    readonly certPem: string;
-    readonly keyPem: string;
-}
-/** A TLS leaf certificate and its private key, both as PEM. */
-export interface LeafCert {
-    readonly certPem: string;
-    readonly keyPem: string;
-}
-/** Generates the local CA: one RSA keypair, self-signed, CA-only by basicConstraints and keyUsage, with a random serial. Pure node-forge, no openssl, so the same code works on every platform claude-use ships to. */
-export declare function generateCa(now: Readonly<Date>): CaMaterial;
-/** Mints the TLS leaf for one host, signed by the CA: its own RSA keypair, the host in the SAN, server-auth usage only. */
-export declare function mintLeaf(ca: CaMaterial, host: string, now: Readonly<Date>): LeafCert;
-/** Mints each host's leaf once from the CA and reuses it, because a 2048-bit keypair in pure JS costs seconds and nothing about the certificate changes between sessions. */
-export declare function createLeafCache(ca: CaMaterial, now: () => Date): (host: string) => LeafCert;
-/**
- * Persistence for the CA: generated once on the machine's first headroom start and reused forever after, because regenerating it would invalidate every child's `NODE_EXTRA_CA_CERTS` pointing at the old file. The real implementation writes the key with mode 0600; injected fakes keep it in memory.
- */
-export interface MitmCertStore {
-    /** The persisted CA, or undefined when none exists yet (or only half of it does: a cert without its key can sign nothing, so it counts as absent). */
-    readonly loadCa: () => CaMaterial | undefined;
-    /** Persists both halves of the CA, the key unreadable to other users. */
-    readonly writeCa: (ca: CaMaterial) => void;
-}
-/**
- * Loads the persisted CA, generating and persisting one when no usable CA exists. A stored pair that node-forge cannot parse is treated as absent and replaced: a truncated write is the one failure mode a regeneration can actually repair, and every child that trusted the old file needs a new `NODE_EXTRA_CA_CERTS` anyway once its CA stops parsing.
- */
-export declare function ensureCa(store: MitmCertStore, generate: () => CaMaterial): CaMaterial;
-/** Where one forwarded request goes, and how. Headroom's loopback port is plain HTTP; the real upstream is TLS. */
-interface MitmForwardTarget {
-    readonly host: string;
-    readonly port: number;
-    readonly tls: boolean;
-    /** The SNI name to present; defaults to `host`. Separated so a test can connect to a local fake while presenting the production hostname. */
-    readonly servername?: string;
-    /** Extra trust anchors for the target's certificate, when it is not system-trusted (a test's local fake upstream). */
-    readonly ca?: readonly string[];
-    /** Overrides certificate verification; production leaves it at the Node default (verify against system trust or `ca`). */
-    readonly rejectUnauthorized?: boolean;
-}
-/** Handles one parsed HTTP request on a terminated TLS session. */
-type MitmRequestHandler = (request: IncomingMessage, response: ServerResponse) => void;
-/** A bound loopback listener and how to stop it. */
-interface MitmListenerHandle {
-    readonly port: number;
-    /** Stops accepting, ends every live connection, and resolves once the port is released. */
-    readonly close: () => Promise<void>;
-}
-/** Presents one leaf's server-side TLS on CONNECTed sockets. */
-interface TlsAcceptor {
-    /** Starts the TLS handshake on a socket that has just received its CONNECT response. */
-    readonly accept: (socket: net.Socket) => void;
-    /** Drops every session this acceptor is terminating. */
-    readonly close: () => void;
-}
-/** Parses HTTP over terminated sockets and serves each request through the handler, keep-alive included. */
-interface HttpParserSession {
-    readonly serve: (socket: net.Socket) => void;
-    readonly close: () => void;
-}
-/**
- * Every effect the MITM proxy performs, injected so the routing decisions and lifecycle run against fakes in unit tests (the SupervisorPorts pattern): TCP listening, TLS termination, HTTP parsing, plain TCP tunnels, and request forwarding. The real implementation is `realMitmEffects`; the TLS round-trip test uses it with redirected targets.
- */
-export interface MitmEffects {
-    /** Binds a loopback TCP listener; `preferredPort` is tried first and any free port used when it is taken (bind, do not probe: check-then-bind races). Resolves with the bound port and a close handle. */
-    readonly listenLoopback: (preferredPort: number | undefined, onSocket: (socket: net.Socket) => void) => Promise<MitmListenerHandle>;
-    /** Builds the TLS terminator for one leaf, handing each successfully handshaked session to `onSecure`. */
-    readonly createTlsAcceptor: (leaf: LeafCert, onSecure: (secure: net.Socket) => void) => TlsAcceptor;
-    /** Builds the HTTP parser bound to one request handler. */
-    readonly createHttpSession: (handler: MitmRequestHandler) => HttpParserSession;
-    /** Opens a raw TCP connection for a blind tunnel. */
-    readonly connectTcp: (host: string, port: number) => Promise<net.Socket>;
-    /** Streams one request to `target` and the response back, never buffering a body. */
-    readonly forwardHttp: (target: MitmForwardTarget, request: IncomingMessage, response: ServerResponse) => void;
-}
-/** Everything the proxy needs to route, resolved before it starts. */
-export interface MitmServerConfig {
-    /** The CONNECT host whose TLS gets terminated. */
-    readonly interceptHost: string;
-    /**
-     * Headroom's loopback port, read per request rather than captured at start-up: the daemon can crash and restart on a different port while this proxy keeps listening, and headroom-served paths must follow it. While it reads undefined (the restart window), headroom-served paths fail fast with 502 rather than silently bypassing headroom to the real upstream.
-     */
-    readonly headroomPort: () => number | undefined;
-    /** The leaf to terminate `interceptHost` with, minted and cached per host. */
-    readonly leafFor: (host: string) => LeafCert;
-    /** Where non-headroom paths on the terminated session are piped: the real upstream over TLS. */
-    readonly upstream: MitmForwardTarget;
-}
-/** A running MITM proxy. */
-export interface MitmServerHandle {
-    readonly port: number;
-    /** Stops the listener, drops every live tunnel and terminated session, and resolves once the port is released. */
-    readonly close: () => Promise<void>;
-}
-/**
- * Starts the MITM proxy: binds the listener, mints the intercept host's leaf, and wires the per-connection routing. Resolves once the listener is bound.
- *
- * The connection flow: read the CONNECT head (never more of the stream than that, so an early ClientHello glued to the head is pushed back with `unshift` and still seen by whatever consumes the socket next), then either blind-tunnel the target or terminate its TLS and parse HTTP on the session. Every effect flows through `effects`; nothing here touches the network or filesystem itself.
- */
-export declare function startMitmServer(config: MitmServerConfig, effects: MitmEffects, preferredPort: number | undefined): Promise<MitmServerHandle>;
-/** The real `MitmEffects` over node's own net, tls, and http. `connectTcp` opens real connections to the CONNECTed host, so tests that want a blind tunnel redirect it. */
-export declare function realMitmEffects(): MitmEffects;
-/** The real `MitmCertStore` on the filesystem: `ca.pem` world-readable (it is public material), `ca.key` mode 0600 exactly, chmod'ed after the write because a create's mode bits pass through the process umask. */
-export declare function realMitmCertStore(paths: {
-    readonly headroomCaDir: string;
-    readonly headroomCaCertFile: string;
-    readonly headroomCaKeyFile: string;
-}): MitmCertStore;
-export {};