claude-use 7.10.1 → 7.11.0

package/dist/cli.cjs

@@ -60955,7 +60955,7 @@ function registerIdentityCommand(program2, deps) {
 // package.json
 var package_default = {
   name: "claude-use",
-  version: "7.10.1",
+  version: "7.11.0",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -64534,11 +64534,17 @@ ${request6.rawHeaders.reduce((accumulated, value, index) => index % 2 === 0 ? `$
   const listener = await effects.listenLoopback(preferredPort, (socket) => {
     handleConnect(socket, { config: config2, effects, sessions, ledger });
   });
+  const apiSession = sessions.find((session) => session.host === config2.routedHost);
+  const transparent = config2.transparentPort === void 0 || apiSession === void 0 ? void 0 : await effects.listenLoopback(config2.transparentPort, (socket) => {
+    apiSession.tlsAcceptor.accept(socket, config2.transparentCapability ?? "");
+  });
   return {
     port: listener.port,
+    ...transparent === void 0 ? {} : { transparentPort: transparent.port },
     close: async () => {
       ledger.close();
       await listener.close();
+      await transparent?.close();
       for (const { httpSession, tlsAcceptor } of sessions) {
         tlsAcceptor.close();
         httpSession?.close();
@@ -64666,7 +64672,6 @@ function routeConnect(socket, head, context) {
   const credential = proxyAuthorizationOf(head);
   const capability = credential === void 0 ? void 0 : capabilityFromProxyAuthorization(credential);
   if (capability === void 0 || !config2.isLiveCapability(capability)) {
-    console.error(`[upg-dbg] refused CONNECT to ${head.split("\r\n", 1)[0]?.split(" ")[1] ?? "?"} (credential ${credential === void 0 ? "absent" : "present but dead"})`);
     refuse(socket, REFUSAL.proxyAuthenticationRequired, [`Proxy-Authenticate: Basic realm="${CONNECT_PROXY_REALM}"`]);
     return;
   }
@@ -66780,6 +66785,11 @@ function realFrontDoorSupervisorPorts(paths) {
       return { port: handle.port, close: handle.close };
     },
     startConnectListener: async (preferredPort) => {
+      const transparentPort = process.env.AGENT_SHIM_TRANSPARENT_SURFACE === void 0 ? void 0 : Number(process.env.AGENT_SHIM_TRANSPARENT_SURFACE);
+      const transparentCapability = transparentPort === void 0 || Number.isNaN(transparentPort) ? void 0 : (0, import_node_crypto13.randomUUID)();
+      if (transparentCapability !== void 0) {
+        writeFrontDoorSession(realFarmFs, paths.frontdoorSessionsDir, { pid: process.pid, startedAt: Date.now(), token: transparentCapability });
+      }
       const leafFor = createLeafCache(loadCa(), () => /* @__PURE__ */ new Date());
       const capture = captureFromEnv(process.env, paths.logsDir);
       if (capture !== void 0) {
@@ -66812,6 +66822,7 @@ function realFrontDoorSupervisorPorts(paths) {
           leafFor,
           upstreamFor: (host) => ({ host, port: HTTPS_PORT, tls: true }),
           isLiveCapability: isLiveToken,
+          ...transparentPort === void 0 || Number.isNaN(transparentPort) ? {} : { transparentPort, ...transparentCapability === void 0 ? {} : { transparentCapability } },
           limits: CONNECT_LIMITS,
           ...capture === void 0 ? {} : { capture }
         },

package/dist/index.cjs

@@ -2940,11 +2940,17 @@ ${request3.rawHeaders.reduce((accumulated, value, index) => index % 2 === 0 ? `$
   const listener = await effects.listenLoopback(preferredPort, (socket) => {
     handleConnect(socket, { config, effects, sessions, ledger });
   });
+  const apiSession = sessions.find((session) => session.host === config.routedHost);
+  const transparent = config.transparentPort === void 0 || apiSession === void 0 ? void 0 : await effects.listenLoopback(config.transparentPort, (socket) => {
+    apiSession.tlsAcceptor.accept(socket, config.transparentCapability ?? "");
+  });
   return {
     port: listener.port,
+    ...transparent === void 0 ? {} : { transparentPort: transparent.port },
     close: async () => {
       ledger.close();
       await listener.close();
+      await transparent?.close();
       for (const { httpSession, tlsAcceptor } of sessions) {
         tlsAcceptor.close();
         httpSession?.close();
@@ -3072,7 +3078,6 @@ function routeConnect(socket, head, context) {
   const credential = proxyAuthorizationOf(head);
   const capability = credential === void 0 ? void 0 : capabilityFromProxyAuthorization(credential);
   if (capability === void 0 || !config.isLiveCapability(capability)) {
-    console.error(`[upg-dbg] refused CONNECT to ${head.split("\r\n", 1)[0]?.split(" ")[1] ?? "?"} (credential ${credential === void 0 ? "absent" : "present but dead"})`);
     refuse(socket, REFUSAL.proxyAuthenticationRequired, [`Proxy-Authenticate: Basic realm="${CONNECT_PROXY_REALM}"`]);
     return;
   }

package/dist/index.mjs

@@ -2777,11 +2777,17 @@ ${request3.rawHeaders.reduce((accumulated, value, index) => index % 2 === 0 ? `$
   const listener = await effects.listenLoopback(preferredPort, (socket) => {
     handleConnect(socket, { config, effects, sessions, ledger });
   });
+  const apiSession = sessions.find((session) => session.host === config.routedHost);
+  const transparent = config.transparentPort === void 0 || apiSession === void 0 ? void 0 : await effects.listenLoopback(config.transparentPort, (socket) => {
+    apiSession.tlsAcceptor.accept(socket, config.transparentCapability ?? "");
+  });
   return {
     port: listener.port,
+    ...transparent === void 0 ? {} : { transparentPort: transparent.port },
     close: async () => {
       ledger.close();
       await listener.close();
+      await transparent?.close();
       for (const { httpSession, tlsAcceptor } of sessions) {
         tlsAcceptor.close();
         httpSession?.close();
@@ -2909,7 +2915,6 @@ function routeConnect(socket, head, context) {
   const credential = proxyAuthorizationOf(head);
   const capability = credential === void 0 ? void 0 : capabilityFromProxyAuthorization(credential);
   if (capability === void 0 || !config.isLiveCapability(capability)) {
-    console.error(`[upg-dbg] refused CONNECT to ${head.split("\r\n", 1)[0]?.split(" ")[1] ?? "?"} (credential ${credential === void 0 ? "absent" : "present but dead"})`);
     refuse(socket, REFUSAL.proxyAuthenticationRequired, [`Proxy-Authenticate: Basic realm="${CONNECT_PROXY_REALM}"`]);
     return;
   }

package/dist/types/frontdoor/connect.d.ts

@@ -171,6 +171,14 @@ export interface ConnectServerConfig {
     readonly upstreamFor: (host: string) => ConnectForwardTarget;
     /** Whether a capability presented as a CONNECT request's proxy credential belongs to a live launch: the same constant-time check against the same registry the routed pipeline's admission makes, read fresh on every call because launches come and go. */
     readonly isLiveCapability: (token: string) => boolean;
+    /**
+     * Binds a second listener that serves the intercept hosts' sessions to connections arriving pre-established, with no CONNECT handshake to authenticate: what an operating-system redirect (a pf rule sending the real hosts' address to this port) delivers. Only the API host's session is reachable this way, never a tap host's, because a redirect can name only addresses and the control plane shares the API host's address today; if that ever splits, the transparent listener must not follow it blindly. There is no capability to check on this surface: the connection carried no proxy credential, so every request rides the pipeline anonymously, admitted the way a tunnel's own header-less requests are (by nothing, which is exactly what they present), and the surface exists solely for clients that ignore proxies and would otherwise be invisible to the door entirely.
+     */
+    readonly transparentPort?: number;
+    /**
+     * The capability the transparent surface's sessions carry: a real, registered token minted by the door for its own pid, so header-less traffic that arrives by redirect is admitted and attributed like any launch's instead of being refused for a credential it cannot possibly present. Absent along with `transparentPort`.
+     */
+    readonly transparentCapability?: string;
     /** The intercept hosts that are never HTTP-parsed: terminated, tapped at the byte level, and pumped to their real host. */
     readonly tapHosts: readonly string[];
     /** The connection deadlines and caps; production passes `CONNECT_LIMITS`. */
@@ -181,6 +189,8 @@ export interface ConnectServerConfig {
 /** A running connect surface. */
 export interface ConnectServerHandle {
     readonly port: number;
+    /** The transparent listener's port, when one was requested: what an operating-system redirect should point at. */
+    readonly transparentPort?: number;
     /** Stops the listener, drops every live tunnel and terminated session, and resolves once the port is released. */
     readonly close: () => Promise<void>;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-use",
-  "version": "7.10.1",
+  "version": "7.11.0",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",