claude-use 7.5.0 → 7.6.1

package/README.md

@@ -63,8 +63,8 @@ Every top-level entry in `~/.claude` is classified into one of five categories,
 
 | Category | Default shared? | Example entries |
 |---|---|---|
-| `secret` | **Never** — hardcoded, cannot be overridden by any configuration layer | `.credentials.json`, `backups` |
-| `runtime` | No | `daemon*`, `.git*`, `.DS_Store`, `mcp-needs-auth-cache.json`, `shell-snapshots`, `statsig`, `telemetry`, `stats-cache.json`, `usage-data`, `ide`, `cache`, `scheduled_tasks.lock` |
+| `secret` | **Never** — hardcoded, cannot be overridden by any configuration layer | `.credentials.json`, `backups`, `settings.json.bak*` |
+| `runtime` | No | `daemon*`, `.git*`, `.DS_Store`, `mcp-needs-auth-cache.json`, `codex-quota.json`, `file-transfers`, `shell-snapshots`, `statsig`, `telemetry`, `stats-cache.json`, `usage-data`, `ide`, `cache`, `scheduled_tasks.lock` |
 | `history` | Yes | `projects`, `sessions`, `session-env`, `teams`, `tasks`, `todos`, `history.jsonl`, `transcripts`, `paste-cache`, `file-history`, `plans`, `workflows`, `jobs`, `debug`, `downloads`, `chrome` |
 | `knowledge` | Yes | `skills`, `agents`, `rules`, `memory`, `commands`, `plugins`, `hooks`, `AGENTS.md`, `CLAUDE.md`, `README.md` |
 | `settings` | Yes | `settings.json`, `settings.local.json` |

package/dist/cli.cjs

@@ -8756,7 +8756,7 @@ var require_connect = __commonJS({
       const sessionCache = new SessionCache(maxCachedSessions == null ? 100 : maxCachedSessions);
       timeout = timeout == null ? 1e4 : timeout;
       allowH2 = allowH2 != null ? allowH2 : false;
-      return function connect2({ hostname: hostname3, host, protocol, port, servername, localAddress, httpSocket }, callback) {
+      return function connect3({ hostname: hostname3, host, protocol, port, servername, localAddress, httpSocket }, callback) {
         let socket;
         if (protocol === "https:") {
           if (!tls2) {
@@ -14554,7 +14554,7 @@ var require_client = __commonJS({
         tls: tls2,
         strictContentLength,
         maxCachedSessions,
-        connect: connect3,
+        connect: connect4,
         maxRequestsPerClient,
         localAddress,
         maxResponseSize,
@@ -14612,7 +14612,7 @@ var require_client = __commonJS({
         if (bodyTimeout != null && (!Number.isInteger(bodyTimeout) || bodyTimeout < 0)) {
           throw new InvalidArgumentError2("bodyTimeout must be a positive integer or zero");
         }
-        if (connect3 != null && typeof connect3 !== "function" && typeof connect3 !== "object") {
+        if (connect4 != null && typeof connect4 !== "function" && typeof connect4 !== "object") {
           throw new InvalidArgumentError2("connect must be a function or an object");
         }
         if (maxRequestsPerClient != null && (!Number.isInteger(maxRequestsPerClient) || maxRequestsPerClient < 0)) {
@@ -14646,8 +14646,8 @@ var require_client = __commonJS({
           throw new InvalidArgumentError2("pingInterval must be a positive integer, greater or equal to 0");
         }
         super({ webSocket });
-        if (typeof connect3 !== "function") {
-          connect3 = buildConnector({
+        if (typeof connect4 !== "function") {
+          connect4 = buildConnector({
             ...tls2,
             maxCachedSessions,
             allowH2,
@@ -14655,18 +14655,18 @@ var require_client = __commonJS({
             socketPath,
             timeout: connectTimeout,
             ...typeof autoSelectFamily === "boolean" ? { autoSelectFamily, autoSelectFamilyAttemptTimeout } : void 0,
-            ...connect3
+            ...connect4
           });
         } else {
-          const customConnect = connect3;
-          connect3 = (opts, callback) => customConnect({
+          const customConnect = connect4;
+          connect4 = (opts, callback) => customConnect({
             ...opts,
             ...socketPath != null ? { socketPath } : null,
             ...allowH2 != null ? { allowH2 } : null
           }, callback);
         }
         this[kUrl] = util.parseOrigin(url2);
-        this[kConnector] = connect3;
+        this[kConnector] = connect4;
         this[kPipelining] = pipelining != null ? pipelining : 1;
         this[kMaxHeadersSize] = maxHeaderSize;
         this[kKeepAliveDefaultTimeout] = keepAliveTimeout == null ? 4e3 : keepAliveTimeout;
@@ -14724,7 +14724,7 @@ var require_client = __commonJS({
         );
       }
       [kConnect](cb) {
-        connect2(this);
+        connect3(this);
         this.once("connect", cb);
       }
       [kDispatch](opts, handler) {
@@ -14790,7 +14790,7 @@ var require_client = __commonJS({
         assert2(client[kSize] === 0);
       }
     }
-    function connect2(client) {
+    function connect3(client) {
       assert2(!client[kConnecting]);
       assert2(!client[kHTTPContext]);
       let { host, hostname: hostname3, protocol, port } = client[kUrl];
@@ -14969,7 +14969,7 @@ var require_client = __commonJS({
           return;
         }
         if (!client[kHTTPContext]) {
-          connect2(client);
+          connect3(client);
           return;
         }
         if (client[kHTTPContext].destroyed) {
@@ -15265,7 +15265,7 @@ var require_pool = __commonJS({
       constructor(origin, {
         connections,
         factory = defaultFactory,
-        connect: connect2,
+        connect: connect3,
         connectTimeout,
         tls: tls2,
         maxCachedSessions,
@@ -15282,24 +15282,24 @@ var require_pool = __commonJS({
         if (typeof factory !== "function") {
           throw new InvalidArgumentError2("factory must be a function.");
         }
-        if (connect2 != null && typeof connect2 !== "function" && typeof connect2 !== "object") {
+        if (connect3 != null && typeof connect3 !== "function" && typeof connect3 !== "object") {
           throw new InvalidArgumentError2("connect must be a function or an object");
         }
-        if (typeof connect2 !== "function") {
-          connect2 = buildConnector({
+        if (typeof connect3 !== "function") {
+          connect3 = buildConnector({
             ...tls2,
             maxCachedSessions,
             allowH2,
             socketPath,
             timeout: connectTimeout,
             ...typeof autoSelectFamily === "boolean" ? { autoSelectFamily, autoSelectFamilyAttemptTimeout } : void 0,
-            ...connect2
+            ...connect3
           });
         }
         super(options);
         this[kConnections] = connections || null;
         this[kUrl] = util.parseOrigin(origin);
-        this[kOptions] = { ...util.deepClone(options), connect: connect2, allowH2, clientTtl, socketPath };
+        this[kOptions] = { ...util.deepClone(options), connect: connect3, allowH2, clientTtl, socketPath };
         this[kOptions].interceptors = options.interceptors ? { ...options.interceptors } : void 0;
         this[kFactory] = factory;
         this.on("connect", (origin2, targets) => {
@@ -15378,14 +15378,14 @@ var require_balanced_pool = __commonJS({
       return new Pool(origin, opts);
     }
     var BalancedPool = class extends PoolBase {
-      constructor(upstreams = [], { factory = defaultFactory, connect: connect2, tls: tls2, ...opts } = {}) {
+      constructor(upstreams = [], { factory = defaultFactory, connect: connect3, tls: tls2, ...opts } = {}) {
         if (typeof factory !== "function") {
           throw new InvalidArgumentError2("factory must be a function.");
         }
         super(opts);
-        if (connect2 && typeof connect2 !== "function") connect2 = { ...connect2 };
+        if (connect3 && typeof connect3 !== "function") connect3 = { ...connect3 };
         if (tls2 && typeof tls2 !== "function") tls2 = { ...tls2 };
-        this[kOptions] = { ...util.deepClone(opts), connect: connect2, tls: tls2 };
+        this[kOptions] = { ...util.deepClone(opts), connect: connect3, tls: tls2 };
         this[kOptions].interceptors = opts.interceptors ? { ...opts.interceptors } : void 0;
         this[kIndex] = -1;
         this[kCurrentWeight] = 0;
@@ -15518,7 +15518,7 @@ var require_round_robin_pool = __commonJS({
       constructor(origin, {
         connections,
         factory = defaultFactory,
-        connect: connect2,
+        connect: connect3,
         connectTimeout,
         tls: tls2,
         maxCachedSessions,
@@ -15535,24 +15535,24 @@ var require_round_robin_pool = __commonJS({
         if (typeof factory !== "function") {
           throw new InvalidArgumentError2("factory must be a function.");
         }
-        if (connect2 != null && typeof connect2 !== "function" && typeof connect2 !== "object") {
+        if (connect3 != null && typeof connect3 !== "function" && typeof connect3 !== "object") {
           throw new InvalidArgumentError2("connect must be a function or an object");
         }
-        if (typeof connect2 !== "function") {
-          connect2 = buildConnector({
+        if (typeof connect3 !== "function") {
+          connect3 = buildConnector({
             ...tls2,
             maxCachedSessions,
             allowH2,
             socketPath,
             timeout: connectTimeout,
             ...typeof autoSelectFamily === "boolean" ? { autoSelectFamily, autoSelectFamilyAttemptTimeout } : void 0,
-            ...connect2
+            ...connect3
           });
         }
         super();
         this[kConnections] = connections || null;
         this[kUrl] = util.parseOrigin(origin);
-        this[kOptions] = { ...util.deepClone(options), connect: connect2, allowH2, clientTtl, socketPath };
+        this[kOptions] = { ...util.deepClone(options), connect: connect3, allowH2, clientTtl, socketPath };
         this[kOptions].interceptors = options.interceptors ? { ...options.interceptors } : void 0;
         this[kFactory] = factory;
         this[kIndex] = -1;
@@ -15626,21 +15626,21 @@ var require_agent = __commonJS({
       return opts && opts.connections === 1 ? new Client(origin, opts) : new Pool(origin, opts);
     }
     var Agent6 = class extends DispatcherBase {
-      constructor({ factory = defaultFactory, maxOrigins = Infinity, connect: connect2, ...options } = {}) {
+      constructor({ factory = defaultFactory, maxOrigins = Infinity, connect: connect3, ...options } = {}) {
         if (typeof factory !== "function") {
           throw new InvalidArgumentError2("factory must be a function.");
         }
-        if (connect2 != null && typeof connect2 !== "function" && typeof connect2 !== "object") {
+        if (connect3 != null && typeof connect3 !== "function" && typeof connect3 !== "object") {
           throw new InvalidArgumentError2("connect must be a function or an object");
         }
         if (typeof maxOrigins !== "number" || Number.isNaN(maxOrigins) || maxOrigins <= 0) {
           throw new InvalidArgumentError2("maxOrigins must be a number greater than 0");
         }
         super(options);
-        if (connect2 && typeof connect2 !== "function") {
-          connect2 = { ...connect2 };
+        if (connect3 && typeof connect3 !== "function") {
+          connect3 = { ...connect3 };
         }
-        this[kOptions] = { ...util.deepClone(options), maxOrigins, connect: connect2 };
+        this[kOptions] = { ...util.deepClone(options), maxOrigins, connect: connect3 };
         this[kFactory] = factory;
         this[kClients] = /* @__PURE__ */ new Map();
         this[kOrigins] = /* @__PURE__ */ new Set();
@@ -16471,16 +16471,16 @@ var require_proxy_agent = __commonJS({
     }
     var Http1ProxyWrapper = class extends DispatcherBase {
       #client;
-      constructor(proxyUrl, { headers = {}, connect: connect2, factory }) {
+      constructor(proxyUrl, { headers = {}, connect: connect3, factory }) {
         if (!proxyUrl) {
           throw new InvalidArgumentError2("Proxy URL is mandatory");
         }
         super();
         this[kProxyHeaders] = headers;
         if (factory) {
-          this.#client = factory(proxyUrl, { connect: connect2 });
+          this.#client = factory(proxyUrl, { connect: connect3 });
         } else {
-          this.#client = new Client(proxyUrl, { connect: connect2 });
+          this.#client = new Client(proxyUrl, { connect: connect3 });
         }
       }
       [kDispatch](opts, handler) {
@@ -16541,7 +16541,7 @@ var require_proxy_agent = __commonJS({
         } else if (username && password) {
           this[kProxyHeaders]["proxy-authorization"] = `Basic ${Buffer.from(`${decodeURIComponent(username)}:${decodeURIComponent(password)}`).toString("base64")}`;
         }
-        const connect2 = buildConnector({ ...opts.proxyTls });
+        const connect3 = buildConnector({ ...opts.proxyTls });
         this[kConnectEndpoint] = buildConnector({ ...opts.requestTls });
         const agentFactory = opts.factory || defaultAgentFactory;
         const factory = (origin2, options) => {
@@ -16549,7 +16549,7 @@ var require_proxy_agent = __commonJS({
           if (this[kProxy].protocol === "socks5:" || this[kProxy].protocol === "socks:") {
             return new Socks5ProxyAgent(this[kProxy].uri, {
               headers: this[kProxyHeaders],
-              connect: connect2,
+              connect: connect3,
               factory: agentFactory,
               username: opts.username || username,
               password: opts.password || password,
@@ -16560,7 +16560,7 @@ var require_proxy_agent = __commonJS({
           if (!this[kTunnelProxy] && protocol2 === "http:" && this[kProxy].protocol === "http:") {
             return new Http1ProxyWrapper(this[kProxy].uri, {
               headers: this[kProxyHeaders],
-              connect: connect2,
+              connect: connect3,
               factory: agentFactory
             });
           }
@@ -16569,7 +16569,7 @@ var require_proxy_agent = __commonJS({
         if (protocol === "socks5:" || protocol === "socks:") {
           this[kClient] = null;
         } else {
-          this[kClient] = clientFactory(url2, { connect: connect2 });
+          this[kClient] = clientFactory(url2, { connect: connect3 });
         }
         this[kAgent] = new Agent6({
           ...opts,
@@ -18402,10 +18402,10 @@ var require_api_connect = __commonJS({
         }
       }
     };
-    function connect2(opts, callback) {
+    function connect3(opts, callback) {
       if (callback === void 0) {
         return new Promise((resolve, reject) => {
-          connect2.call(this, opts, (err, data) => {
+          connect3.call(this, opts, (err, data) => {
             return err ? reject(err) : resolve(data);
           });
         });
@@ -18422,7 +18422,7 @@ var require_api_connect = __commonJS({
         queueMicrotask(() => callback(err, { opaque }));
       }
     }
-    module2.exports = connect2;
+    module2.exports = connect3;
   }
 });
 
@@ -57330,12 +57330,14 @@ var import_picomatch = __toESM(require_picomatch2(), 1);
 
 // src/config/categories.default.json
 var categories_default_default = {
-  secret: [".credentials.json", "backups"],
+  secret: [".credentials.json", "backups", "settings.json.bak*"],
   runtime: [
     "daemon*",
     ".git*",
     ".DS_Store",
     "mcp-needs-auth-cache.json",
+    "codex-quota.json",
+    "file-transfers",
     "shell-snapshots",
     "statsig",
     "telemetry",
@@ -61051,7 +61053,7 @@ function resolveLaunchIdentity(paths, cwd) {
 // package.json
 var package_default = {
   name: "claude-use",
-  version: "7.5.0",
+  version: "7.6.1",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -63789,8 +63791,13 @@ var import_node_path27 = __toESM(require("node:path"), 1);
 
 // src/frontdoor/state.ts
 var import_node_path26 = __toESM(require("node:path"), 1);
+var FRONT_DOOR_PROTOCOL = 1;
 var FrontDoorSessionSchema = external_exports.strictObject({ pid: external_exports.number().int().positive(), startedAt: external_exports.number(), token: external_exports.string().min(1) });
 var FrontDoorStateSchema = external_exports.strictObject({
+  /**
+   * The launcher-to-door wire protocol this supervisor speaks, written once it is serving; absent in state written by a release that predates the field, which `ensureFrontDoor` reads as protocol 0. A launcher replaces a door whose protocol is lower than its own (see `FRONT_DOOR_PROTOCOL`).
+   */
+  protocol: external_exports.number().int().nonnegative().optional(),
   /** The supervisor process serving the front door. Alive means both listeners are up in that process. */
   supervisorPid: external_exports.number().int().positive().optional(),
   /** The loopback port the HTTPS provider listener serves on. Absent until the listener has bound and answered its health probe, so "port is set" is itself the ready signal a launcher polls for. */
@@ -64450,6 +64457,39 @@ function createFileCapture(file2, now = () => /* @__PURE__ */ new Date()) {
     upgrade: (request6) => {
       append({ kind: "upgrade", method: request6.method ?? "?", url: request6.url ?? "?", headers: redactHeaders(request6.headers) });
     },
+    tapStream: (host) => {
+      nextId += 1;
+      const id = nextId;
+      append({ kind: "stream", id, host });
+      const stored = { "client-to-server": 0, "server-to-client": 0 };
+      const sequences = { "client-to-server": 0, "server-to-client": 0 };
+      return {
+        onChunk: (direction, chunk) => {
+          sequences[direction] += 1;
+          const budget = STREAM_LOG_CAP_BYTES - stored[direction];
+          if (budget <= 0) {
+            return;
+          }
+          const excerpt = chunk.subarray(0, Math.min(CHUNK_LOG_CAP_BYTES, budget));
+          stored[direction] += excerpt.length;
+          const text2 = excerpt.toString("utf8");
+          const faithful = Buffer.from(text2, "utf8").equals(excerpt);
+          append({
+            kind: "stream-chunk",
+            id,
+            dir: direction,
+            seq: sequences[direction],
+            bytes: chunk.length,
+            stored: excerpt.length,
+            truncated: excerpt.length < chunk.length,
+            ...faithful ? { body: redactText(text2) } : { b64: excerpt.toString("base64") }
+          });
+        },
+        onEnd: () => {
+          append({ kind: "stream-end", id, clientToServerCapped: stored["client-to-server"] >= STREAM_LOG_CAP_BYTES, serverToClientCapped: stored["server-to-client"] >= STREAM_LOG_CAP_BYTES });
+        }
+      };
+    },
     observePassthrough: (request6) => {
       nextId += 1;
       const id = nextId;
@@ -64495,10 +64535,6 @@ function createFileCapture(file2, now = () => /* @__PURE__ */ new Date()) {
 // src/frontdoor/connect.ts
 var import_node_crypto10 = require("node:crypto");
 var fs12 = __toESM(require("node:fs"), 1);
-var http = __toESM(require("node:http"), 1);
-var https = __toESM(require("node:https"), 1);
-var net3 = __toESM(require("node:net"), 1);
-var tls = __toESM(require("node:tls"), 1);
 
 // src/frontdoor/x509.ts
 var import_node_crypto9 = require("node:crypto");
@@ -64771,6 +64807,54 @@ function issueLeafCertificate(ca, names, notBefore, notAfter) {
   return { certPem: toPem("CERTIFICATE", der), keyPem: keyPem(privateKey) };
 }
 
+// src/frontdoor/tap.ts
+function pumpTapSession(secure, openUpstream, tap) {
+  let upstream;
+  let ended = false;
+  const end = () => {
+    if (!ended) {
+      ended = true;
+      tap?.onEnd();
+    }
+  };
+  const drop = () => {
+    end();
+    secure.destroy();
+    upstream?.destroy();
+  };
+  secure.once("close", () => {
+    end();
+    upstream?.destroy();
+  });
+  secure.once("error", drop);
+  const clientAlpn = "alpnProtocol" in secure && typeof secure.alpnProtocol === "string" ? secure.alpnProtocol : void 0;
+  void (async () => {
+    try {
+      upstream = await openUpstream(clientAlpn);
+    } catch {
+      drop();
+      return;
+    }
+    if (secure.destroyed) {
+      end();
+      upstream.destroy();
+      return;
+    }
+    if (tap !== void 0) {
+      secure.on("data", (chunk) => {
+        tap.onChunk("client-to-server", chunk);
+      });
+      upstream.on("data", (chunk) => {
+        tap.onChunk("server-to-client", chunk);
+      });
+    }
+    secure.pipe(upstream);
+    upstream.pipe(secure);
+    upstream.once("close", drop);
+    upstream.once("error", drop);
+  })();
+}
+
 // src/frontdoor/supervisor.ts
 var FRONTDOOR_SUPERVISOR_STILL_RUNNING = -1;
 var FRONTDOOR_POLL_MS = 1e3;
@@ -64805,23 +64889,23 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
   }
   lastPort = http5.port;
   const previousStickyConnect = lastConnectPort;
-  let connect2;
+  let connect3;
   try {
-    connect2 = await ports.startConnectListener(lastConnectPort);
+    connect3 = await ports.startConnectListener(lastConnectPort);
   } catch (error62) {
     await http5.close();
     return fail(`could not start the CONNECT surface: ${error62 instanceof Error ? error62.message : String(error62)}`);
   }
-  if (previousStickyConnect !== void 0 && connect2.port !== previousStickyConnect) {
-    ports.log(`agent-shim frontdoor supervisor: sticky CONNECT port ${String(previousStickyConnect)} was occupied; moving to ${String(connect2.port)} (OAuth sessions launched against the old port are stale until they relaunch)`);
+  if (previousStickyConnect !== void 0 && connect3.port !== previousStickyConnect) {
+    ports.log(`agent-shim frontdoor supervisor: sticky CONNECT port ${String(previousStickyConnect)} was occupied; moving to ${String(connect3.port)} (OAuth sessions launched against the old port are stale until they relaunch)`);
   }
-  lastConnectPort = connect2.port;
+  lastConnectPort = connect3.port;
   const previousStickyDirect = lastDirectPort;
   let direct;
   try {
     direct = await ports.startDirectListener(lastDirectPort);
   } catch (error62) {
-    await connect2.close();
+    await connect3.close();
     await http5.close();
     return fail(`could not start the direct listener: ${error62 instanceof Error ? error62.message : String(error62)}`);
   }
@@ -64829,9 +64913,9 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     ports.log(`agent-shim frontdoor supervisor: sticky direct port ${String(previousStickyDirect)} was occupied; moving to ${String(direct.port)} (headroom must be restarted to admit the new address)`);
   }
   lastDirectPort = direct.port;
-  writeFrontDoorState(fs18, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, port: http5.port, connectPort: connect2.port, directPort: direct.port, ...sticky() });
+  writeFrontDoorState(fs18, paths.frontdoorStateFile, { protocol: FRONT_DOOR_PROTOCOL, supervisorPid: ports.ownPid, port: http5.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
   fs18.removeRecursive(paths.frontdoorLockFile);
-  ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http5.port)}, CONNECT surface on 127.0.0.1:${String(connect2.port)}`);
+  ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http5.port)}, CONNECT surface on 127.0.0.1:${String(connect3.port)}`);
   let idleSince;
   let ticks = 0;
   for (; ; ) {
@@ -64845,7 +64929,7 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
       if (ports.now() - idleSince >= idleShutdownMinutes * MS_PER_MINUTE) {
         ports.log(`agent-shim frontdoor supervisor: no sessions for ${String(idleShutdownMinutes)} minute(s); closing the front door and exiting`);
         await direct.close();
-        await connect2.close();
+        await connect3.close();
         await http5.close();
         writeFrontDoorState(fs18, paths.frontdoorStateFile, sticky());
         return 0;
@@ -64860,6 +64944,7 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
 // src/frontdoor/connect.ts
 var CONNECT_INTERCEPT_HOST = "api.anthropic.com";
 var CONNECT_INTERCEPT_HOSTS = [CONNECT_INTERCEPT_HOST, "platform.claude.com"];
+var CONNECT_TAP_HOSTS = ["platform.claude.com"];
 var ROUTED_PATH_PREFIX = "/v1/";
 var HTTPS_PORT = 443;
 var MAX_PORT = 65535;
@@ -64967,9 +65052,20 @@ function caParses(ca) {
     return false;
   }
 }
+var TAP_ALPN_PROTOCOLS = ["h2", "http/1.1"];
 async function startConnectServer(config2, effects, preferredPort) {
   const onUpgrade = config2.capture === void 0 ? void 0 : (request6) => config2.capture?.upgrade(request6);
   const sessions = config2.interceptHosts.map((host) => {
+    if (config2.tapHosts.includes(host)) {
+      const tlsAcceptor2 = effects.createTlsAcceptor(
+        config2.leafFor(host),
+        (secure) => {
+          pumpTapSession(secure, async (clientAlpn) => await effects.connectTlsUpstream(host, HTTPS_PORT, clientAlpn), config2.capture?.tapStream?.(host));
+        },
+        TAP_ALPN_PROTOCOLS
+      );
+      return { host, tlsAcceptor: tlsAcceptor2 };
+    }
     const handler = (request6, response) => {
       if (host === config2.routedHost && servedByPipeline(request6.url)) {
         config2.serveRouted(request6, response);
@@ -64994,7 +65090,7 @@ async function startConnectServer(config2, effects, preferredPort) {
       await listener.close();
       for (const { httpSession, tlsAcceptor } of sessions) {
         tlsAcceptor.close();
-        httpSession.close();
+        httpSession?.close();
       }
     }
   };
@@ -65170,6 +65266,40 @@ async function blindTunnel(socket, target, effects) {
     socket.destroy();
   });
 }
+function isEnoent5(error62) {
+  return typeof error62 === "object" && error62 !== null && "code" in error62 && error62.code === "ENOENT";
+}
+function realConnectCertStore(paths) {
+  const read = (file2) => {
+    try {
+      return fs12.readFileSync(file2, "utf8");
+    } catch (error62) {
+      if (isEnoent5(error62)) {
+        return void 0;
+      }
+      throw error62;
+    }
+  };
+  return {
+    loadCa: () => {
+      const certPem = read(paths.frontdoorCaCertFile);
+      const keyPem2 = read(paths.frontdoorCaKeyFile);
+      return certPem === void 0 || keyPem2 === void 0 ? void 0 : { certPem, keyPem: keyPem2 };
+    },
+    writeCa: (ca) => {
+      fs12.mkdirSync(paths.frontdoorCaDir, { recursive: true });
+      fs12.writeFileSync(paths.frontdoorCaCertFile, ca.certPem, "utf8");
+      fs12.writeFileSync(paths.frontdoorCaKeyFile, ca.keyPem, { encoding: "utf8", mode: CA_KEY_FILE_MODE });
+      fs12.chmodSync(paths.frontdoorCaKeyFile, CA_KEY_FILE_MODE);
+    }
+  };
+}
+
+// src/frontdoor/connectEffects.ts
+var http = __toESM(require("node:http"), 1);
+var https = __toESM(require("node:https"), 1);
+var net3 = __toESM(require("node:net"), 1);
+var tls = __toESM(require("node:tls"), 1);
 function realConnectEffects() {
   const plainAgent = new http.Agent({ keepAlive: true });
   const tlsAgent = new https.Agent({ keepAlive: true });
@@ -65215,10 +65345,13 @@ function realConnectEffects() {
       }
       return await listenOnce(0, onSocket);
     },
-    createTlsAcceptor: (leaf, onSecure) => {
-      const server = tls.createServer({ key: leaf.keyPem, cert: leaf.certPem }, (secure) => {
-        onSecure(secure);
-      });
+    createTlsAcceptor: (leaf, onSecure, alpnProtocols) => {
+      const server = tls.createServer(
+        { key: leaf.keyPem, cert: leaf.certPem, ...alpnProtocols === void 0 ? {} : { ALPNProtocols: [...alpnProtocols] } },
+        (secure) => {
+          onSecure(secure);
+        }
+      );
       server.on("clientError", (_error, socket) => {
         socket.destroy();
       });
@@ -65253,6 +65386,13 @@ function realConnectEffects() {
         }
       };
     },
+    connectTlsUpstream: async (host, port, clientAlpn) => await new Promise((resolve, reject) => {
+      const socket = tls.connect({ host, port, servername: host, ...clientAlpn === void 0 ? {} : { ALPNProtocols: [clientAlpn] } });
+      socket.once("secureConnect", () => {
+        resolve(socket);
+      });
+      socket.once("error", reject);
+    }),
     connectTcp: async (host, port) => await new Promise((resolve, reject) => {
       const socket = net3.connect({ host, port });
       socket.once("connect", () => {
@@ -65316,34 +65456,6 @@ function realConnectEffects() {
     }
   };
 }
-function isEnoent5(error62) {
-  return typeof error62 === "object" && error62 !== null && "code" in error62 && error62.code === "ENOENT";
-}
-function realConnectCertStore(paths) {
-  const read = (file2) => {
-    try {
-      return fs12.readFileSync(file2, "utf8");
-    } catch (error62) {
-      if (isEnoent5(error62)) {
-        return void 0;
-      }
-      throw error62;
-    }
-  };
-  return {
-    loadCa: () => {
-      const certPem = read(paths.frontdoorCaCertFile);
-      const keyPem2 = read(paths.frontdoorCaKeyFile);
-      return certPem === void 0 || keyPem2 === void 0 ? void 0 : { certPem, keyPem: keyPem2 };
-    },
-    writeCa: (ca) => {
-      fs12.mkdirSync(paths.frontdoorCaDir, { recursive: true });
-      fs12.writeFileSync(paths.frontdoorCaCertFile, ca.certPem, "utf8");
-      fs12.writeFileSync(paths.frontdoorCaKeyFile, ca.keyPem, { encoding: "utf8", mode: CA_KEY_FILE_MODE });
-      fs12.chmodSync(paths.frontdoorCaKeyFile, CA_KEY_FILE_MODE);
-    }
-  };
-}
 
 // src/frontdoor/ensure.ts
 var import_node_crypto11 = require("node:crypto");
@@ -65359,6 +65471,7 @@ function ensureFrontDoor(params) {
   const { paths, ports } = params;
   const deadline = ports.now() + FRONTDOOR_START_TIMEOUT_MS;
   let spawned = false;
+  let replaced = false;
   const distrusted = /* @__PURE__ */ new Set();
   let lastRejection;
   for (; ; ) {
@@ -65367,6 +65480,17 @@ function ensureFrontDoor(params) {
     if (supervisorPid !== void 0 && !distrusted.has(supervisorPid) && ports.isRunning(supervisorPid)) {
       if (state?.port !== void 0 && state.connectPort !== void 0) {
         const verdict = ports.verifyListener(state.port);
+        if (verdict.ok && (state.protocol ?? 0) < FRONT_DOOR_PROTOCOL && !replaced) {
+          ports.stopSupervisor(supervisorPid);
+          while (ports.isRunning(supervisorPid)) {
+            if (ports.now() >= deadline) {
+              throw new FrontDoorStartError(`agent-shim: the front door (pid ${String(supervisorPid)}, protocol ${String(state.protocol ?? 0)}) is older than this launcher (protocol ${String(FRONT_DOOR_PROTOCOL)}) and did not exit when asked. Daemon log: ${paths.frontdoorLogPath}`);
+            }
+            ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
+          }
+          replaced = true;
+          continue;
+        }
         if (verdict.ok) {
           const token = (0, import_node_crypto11.randomUUID)();
           writeFrontDoorSession(ports.fs, paths.frontdoorSessionsDir, { pid: params.launcherPid, startedAt: ports.now(), token });
@@ -66973,6 +67097,7 @@ function realFrontDoorSupervisorPorts(paths) {
       const server = await startConnectServer(
         {
           interceptHosts: CONNECT_INTERCEPT_HOSTS,
+          tapHosts: CONNECT_TAP_HOSTS,
           routedHost: CONNECT_INTERCEPT_HOST,
           serveRouted: (request6, response) => {
             const abort = new AbortController();
@@ -67044,6 +67169,9 @@ function realFrontDoorPort(paths) {
           now: () => Date.now(),
           sleep: realSleepSync,
           spawnSupervisor: (layout) => spawnDetachedSupervisor(layout, "__frontdoor-supervisor", layout.frontdoorLogPath),
+          stopSupervisor: (pid) => {
+            process.kill(pid, "SIGTERM");
+          },
           // Read fresh for each probe: a replacement supervisor may have regenerated an unparseable CA, and the probe must trust exactly what the serving door's leaf chains to.
           verifyListener: (port) => probeFrontDoorSync(port, import_node_fs11.default.readFileSync(paths.frontdoorCaCertFile, "utf8"))
         }