claude-use 7.5.0 → 7.6.1

package/dist/index.cjs

@@ -1887,10 +1887,6 @@ function recoveryDiagnostics(recovery, identity) {
 // src/frontdoor/connect.ts
 var import_node_crypto3 = require("node:crypto");
 var fs = __toESM(require("node:fs"), 1);
-var http = __toESM(require("node:http"), 1);
-var https = __toESM(require("node:https"), 1);
-var net2 = __toESM(require("node:net"), 1);
-var tls = __toESM(require("node:tls"), 1);
 
 // src/frontdoor/x509.ts
 var import_node_crypto2 = require("node:crypto");
@@ -2163,6 +2159,54 @@ function issueLeafCertificate(ca, names, notBefore, notAfter) {
   return { certPem: toPem("CERTIFICATE", der), keyPem: keyPem(privateKey) };
 }
 
+// src/frontdoor/tap.ts
+function pumpTapSession(secure, openUpstream, tap) {
+  let upstream;
+  let ended = false;
+  const end = () => {
+    if (!ended) {
+      ended = true;
+      tap?.onEnd();
+    }
+  };
+  const drop = () => {
+    end();
+    secure.destroy();
+    upstream?.destroy();
+  };
+  secure.once("close", () => {
+    end();
+    upstream?.destroy();
+  });
+  secure.once("error", drop);
+  const clientAlpn = "alpnProtocol" in secure && typeof secure.alpnProtocol === "string" ? secure.alpnProtocol : void 0;
+  void (async () => {
+    try {
+      upstream = await openUpstream(clientAlpn);
+    } catch {
+      drop();
+      return;
+    }
+    if (secure.destroyed) {
+      end();
+      upstream.destroy();
+      return;
+    }
+    if (tap !== void 0) {
+      secure.on("data", (chunk) => {
+        tap.onChunk("client-to-server", chunk);
+      });
+      upstream.on("data", (chunk) => {
+        tap.onChunk("server-to-client", chunk);
+      });
+    }
+    secure.pipe(upstream);
+    upstream.pipe(secure);
+    upstream.once("close", drop);
+    upstream.once("error", drop);
+  })();
+}
+
 // src/frontdoor/capability.ts
 var CONNECT_PROXY_REALM = "agent-shim front door";
 var BASIC_SCHEME = "basic";
@@ -2184,8 +2228,13 @@ function capabilityFromProxyAuthorization(value) {
 // src/frontdoor/state.ts
 var import_node_path5 = __toESM(require("node:path"), 1);
 var import_zod3 = require("zod");
+var FRONT_DOOR_PROTOCOL = 1;
 var FrontDoorSessionSchema = import_zod3.z.strictObject({ pid: import_zod3.z.number().int().positive(), startedAt: import_zod3.z.number(), token: import_zod3.z.string().min(1) });
 var FrontDoorStateSchema = import_zod3.z.strictObject({
+  /**
+   * The launcher-to-door wire protocol this supervisor speaks, written once it is serving; absent in state written by a release that predates the field, which `ensureFrontDoor` reads as protocol 0. A launcher replaces a door whose protocol is lower than its own (see `FRONT_DOOR_PROTOCOL`).
+   */
+  protocol: import_zod3.z.number().int().nonnegative().optional(),
   /** The supervisor process serving the front door. Alive means both listeners are up in that process. */
   supervisorPid: import_zod3.z.number().int().positive().optional(),
   /** The loopback port the HTTPS provider listener serves on. Absent until the listener has bound and answered its health probe, so "port is set" is itself the ready signal a launcher polls for. */
@@ -2307,23 +2356,23 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
   }
   lastPort = http2.port;
   const previousStickyConnect = lastConnectPort;
-  let connect2;
+  let connect3;
   try {
-    connect2 = await ports.startConnectListener(lastConnectPort);
+    connect3 = await ports.startConnectListener(lastConnectPort);
   } catch (error) {
     await http2.close();
     return fail(`could not start the CONNECT surface: ${error instanceof Error ? error.message : String(error)}`);
   }
-  if (previousStickyConnect !== void 0 && connect2.port !== previousStickyConnect) {
-    ports.log(`agent-shim frontdoor supervisor: sticky CONNECT port ${String(previousStickyConnect)} was occupied; moving to ${String(connect2.port)} (OAuth sessions launched against the old port are stale until they relaunch)`);
+  if (previousStickyConnect !== void 0 && connect3.port !== previousStickyConnect) {
+    ports.log(`agent-shim frontdoor supervisor: sticky CONNECT port ${String(previousStickyConnect)} was occupied; moving to ${String(connect3.port)} (OAuth sessions launched against the old port are stale until they relaunch)`);
   }
-  lastConnectPort = connect2.port;
+  lastConnectPort = connect3.port;
   const previousStickyDirect = lastDirectPort;
   let direct;
   try {
     direct = await ports.startDirectListener(lastDirectPort);
   } catch (error) {
-    await connect2.close();
+    await connect3.close();
     await http2.close();
     return fail(`could not start the direct listener: ${error instanceof Error ? error.message : String(error)}`);
   }
@@ -2331,9 +2380,9 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     ports.log(`agent-shim frontdoor supervisor: sticky direct port ${String(previousStickyDirect)} was occupied; moving to ${String(direct.port)} (headroom must be restarted to admit the new address)`);
   }
   lastDirectPort = direct.port;
-  writeFrontDoorState(fs3, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, port: http2.port, connectPort: connect2.port, directPort: direct.port, ...sticky() });
+  writeFrontDoorState(fs3, paths.frontdoorStateFile, { protocol: FRONT_DOOR_PROTOCOL, supervisorPid: ports.ownPid, port: http2.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
   fs3.removeRecursive(paths.frontdoorLockFile);
-  ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http2.port)}, CONNECT surface on 127.0.0.1:${String(connect2.port)}`);
+  ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http2.port)}, CONNECT surface on 127.0.0.1:${String(connect3.port)}`);
   let idleSince;
   let ticks = 0;
   for (; ; ) {
@@ -2347,7 +2396,7 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
       if (ports.now() - idleSince >= idleShutdownMinutes * MS_PER_MINUTE) {
         ports.log(`agent-shim frontdoor supervisor: no sessions for ${String(idleShutdownMinutes)} minute(s); closing the front door and exiting`);
         await direct.close();
-        await connect2.close();
+        await connect3.close();
         await http2.close();
         writeFrontDoorState(fs3, paths.frontdoorStateFile, sticky());
         return 0;
@@ -2471,9 +2520,20 @@ function caParses(ca) {
     return false;
   }
 }
+var TAP_ALPN_PROTOCOLS = ["h2", "http/1.1"];
 async function startConnectServer(config, effects, preferredPort) {
   const onUpgrade = config.capture === void 0 ? void 0 : (request3) => config.capture?.upgrade(request3);
   const sessions = config.interceptHosts.map((host) => {
+    if (config.tapHosts.includes(host)) {
+      const tlsAcceptor2 = effects.createTlsAcceptor(
+        config.leafFor(host),
+        (secure) => {
+          pumpTapSession(secure, async (clientAlpn) => await effects.connectTlsUpstream(host, HTTPS_PORT, clientAlpn), config.capture?.tapStream?.(host));
+        },
+        TAP_ALPN_PROTOCOLS
+      );
+      return { host, tlsAcceptor: tlsAcceptor2 };
+    }
     const handler = (request3, response) => {
       if (host === config.routedHost && servedByPipeline(request3.url)) {
         config.serveRouted(request3, response);
@@ -2498,7 +2558,7 @@ async function startConnectServer(config, effects, preferredPort) {
       await listener.close();
       for (const { httpSession, tlsAcceptor } of sessions) {
         tlsAcceptor.close();
-        httpSession.close();
+        httpSession?.close();
       }
     }
   };
@@ -2674,6 +2734,40 @@ async function blindTunnel(socket, target, effects) {
     socket.destroy();
   });
 }
+function isEnoent(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+function realConnectCertStore(paths) {
+  const read = (file) => {
+    try {
+      return fs.readFileSync(file, "utf8");
+    } catch (error) {
+      if (isEnoent(error)) {
+        return void 0;
+      }
+      throw error;
+    }
+  };
+  return {
+    loadCa: () => {
+      const certPem = read(paths.frontdoorCaCertFile);
+      const keyPem2 = read(paths.frontdoorCaKeyFile);
+      return certPem === void 0 || keyPem2 === void 0 ? void 0 : { certPem, keyPem: keyPem2 };
+    },
+    writeCa: (ca) => {
+      fs.mkdirSync(paths.frontdoorCaDir, { recursive: true });
+      fs.writeFileSync(paths.frontdoorCaCertFile, ca.certPem, "utf8");
+      fs.writeFileSync(paths.frontdoorCaKeyFile, ca.keyPem, { encoding: "utf8", mode: CA_KEY_FILE_MODE });
+      fs.chmodSync(paths.frontdoorCaKeyFile, CA_KEY_FILE_MODE);
+    }
+  };
+}
+
+// src/frontdoor/connectEffects.ts
+var http = __toESM(require("node:http"), 1);
+var https = __toESM(require("node:https"), 1);
+var net2 = __toESM(require("node:net"), 1);
+var tls = __toESM(require("node:tls"), 1);
 function realConnectEffects() {
   const plainAgent = new http.Agent({ keepAlive: true });
   const tlsAgent = new https.Agent({ keepAlive: true });
@@ -2719,10 +2813,13 @@ function realConnectEffects() {
       }
       return await listenOnce(0, onSocket);
     },
-    createTlsAcceptor: (leaf, onSecure) => {
-      const server = tls.createServer({ key: leaf.keyPem, cert: leaf.certPem }, (secure) => {
-        onSecure(secure);
-      });
+    createTlsAcceptor: (leaf, onSecure, alpnProtocols) => {
+      const server = tls.createServer(
+        { key: leaf.keyPem, cert: leaf.certPem, ...alpnProtocols === void 0 ? {} : { ALPNProtocols: [...alpnProtocols] } },
+        (secure) => {
+          onSecure(secure);
+        }
+      );
       server.on("clientError", (_error, socket) => {
         socket.destroy();
       });
@@ -2757,6 +2854,13 @@ function realConnectEffects() {
         }
       };
     },
+    connectTlsUpstream: async (host, port, clientAlpn) => await new Promise((resolve, reject) => {
+      const socket = tls.connect({ host, port, servername: host, ...clientAlpn === void 0 ? {} : { ALPNProtocols: [clientAlpn] } });
+      socket.once("secureConnect", () => {
+        resolve(socket);
+      });
+      socket.once("error", reject);
+    }),
     connectTcp: async (host, port) => await new Promise((resolve, reject) => {
       const socket = net2.connect({ host, port });
       socket.once("connect", () => {
@@ -2820,34 +2924,6 @@ function realConnectEffects() {
     }
   };
 }
-function isEnoent(error) {
-  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
-}
-function realConnectCertStore(paths) {
-  const read = (file) => {
-    try {
-      return fs.readFileSync(file, "utf8");
-    } catch (error) {
-      if (isEnoent(error)) {
-        return void 0;
-      }
-      throw error;
-    }
-  };
-  return {
-    loadCa: () => {
-      const certPem = read(paths.frontdoorCaCertFile);
-      const keyPem2 = read(paths.frontdoorCaKeyFile);
-      return certPem === void 0 || keyPem2 === void 0 ? void 0 : { certPem, keyPem: keyPem2 };
-    },
-    writeCa: (ca) => {
-      fs.mkdirSync(paths.frontdoorCaDir, { recursive: true });
-      fs.writeFileSync(paths.frontdoorCaCertFile, ca.certPem, "utf8");
-      fs.writeFileSync(paths.frontdoorCaKeyFile, ca.keyPem, { encoding: "utf8", mode: CA_KEY_FILE_MODE });
-      fs.chmodSync(paths.frontdoorCaKeyFile, CA_KEY_FILE_MODE);
-    }
-  };
-}
 
 // src/frontdoor/ensure.ts
 var import_node_crypto5 = require("node:crypto");
@@ -2993,6 +3069,7 @@ function ensureFrontDoor(params) {
   const { paths, ports } = params;
   const deadline = ports.now() + FRONTDOOR_START_TIMEOUT_MS;
   let spawned = false;
+  let replaced = false;
   const distrusted = /* @__PURE__ */ new Set();
   let lastRejection;
   for (; ; ) {
@@ -3001,6 +3078,17 @@ function ensureFrontDoor(params) {
     if (supervisorPid !== void 0 && !distrusted.has(supervisorPid) && ports.isRunning(supervisorPid)) {
       if (state?.port !== void 0 && state.connectPort !== void 0) {
         const verdict = ports.verifyListener(state.port);
+        if (verdict.ok && (state.protocol ?? 0) < FRONT_DOOR_PROTOCOL && !replaced) {
+          ports.stopSupervisor(supervisorPid);
+          while (ports.isRunning(supervisorPid)) {
+            if (ports.now() >= deadline) {
+              throw new FrontDoorStartError(`agent-shim: the front door (pid ${String(supervisorPid)}, protocol ${String(state.protocol ?? 0)}) is older than this launcher (protocol ${String(FRONT_DOOR_PROTOCOL)}) and did not exit when asked. Daemon log: ${paths.frontdoorLogPath}`);
+            }
+            ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
+          }
+          replaced = true;
+          continue;
+        }
         if (verdict.ok) {
           const token = (0, import_node_crypto5.randomUUID)();
           writeFrontDoorSession(ports.fs, paths.frontdoorSessionsDir, { pid: params.launcherPid, startedAt: ports.now(), token });

package/dist/index.mjs

@@ -1787,10 +1787,6 @@ function recoveryDiagnostics(recovery, identity) {
 // src/frontdoor/connect.ts
 import { X509Certificate as X509Certificate2, createPrivateKey as createPrivateKey2 } from "node:crypto";
 import * as fs from "node:fs";
-import * as http from "node:http";
-import * as https from "node:https";
-import * as net2 from "node:net";
-import * as tls from "node:tls";
 
 // src/frontdoor/x509.ts
 import { createHash, createPrivateKey, generateKeyPairSync, randomBytes, sign, X509Certificate } from "node:crypto";
@@ -2063,6 +2059,54 @@ function issueLeafCertificate(ca, names, notBefore, notAfter) {
   return { certPem: toPem("CERTIFICATE", der), keyPem: keyPem(privateKey) };
 }
 
+// src/frontdoor/tap.ts
+function pumpTapSession(secure, openUpstream, tap) {
+  let upstream;
+  let ended = false;
+  const end = () => {
+    if (!ended) {
+      ended = true;
+      tap?.onEnd();
+    }
+  };
+  const drop = () => {
+    end();
+    secure.destroy();
+    upstream?.destroy();
+  };
+  secure.once("close", () => {
+    end();
+    upstream?.destroy();
+  });
+  secure.once("error", drop);
+  const clientAlpn = "alpnProtocol" in secure && typeof secure.alpnProtocol === "string" ? secure.alpnProtocol : void 0;
+  void (async () => {
+    try {
+      upstream = await openUpstream(clientAlpn);
+    } catch {
+      drop();
+      return;
+    }
+    if (secure.destroyed) {
+      end();
+      upstream.destroy();
+      return;
+    }
+    if (tap !== void 0) {
+      secure.on("data", (chunk) => {
+        tap.onChunk("client-to-server", chunk);
+      });
+      upstream.on("data", (chunk) => {
+        tap.onChunk("server-to-client", chunk);
+      });
+    }
+    secure.pipe(upstream);
+    upstream.pipe(secure);
+    upstream.once("close", drop);
+    upstream.once("error", drop);
+  })();
+}
+
 // src/frontdoor/capability.ts
 var CONNECT_PROXY_REALM = "agent-shim front door";
 var BASIC_SCHEME = "basic";
@@ -2084,8 +2128,13 @@ function capabilityFromProxyAuthorization(value) {
 // src/frontdoor/state.ts
 import path5 from "node:path";
 import { z as z3 } from "zod";
+var FRONT_DOOR_PROTOCOL = 1;
 var FrontDoorSessionSchema = z3.strictObject({ pid: z3.number().int().positive(), startedAt: z3.number(), token: z3.string().min(1) });
 var FrontDoorStateSchema = z3.strictObject({
+  /**
+   * The launcher-to-door wire protocol this supervisor speaks, written once it is serving; absent in state written by a release that predates the field, which `ensureFrontDoor` reads as protocol 0. A launcher replaces a door whose protocol is lower than its own (see `FRONT_DOOR_PROTOCOL`).
+   */
+  protocol: z3.number().int().nonnegative().optional(),
   /** The supervisor process serving the front door. Alive means both listeners are up in that process. */
   supervisorPid: z3.number().int().positive().optional(),
   /** The loopback port the HTTPS provider listener serves on. Absent until the listener has bound and answered its health probe, so "port is set" is itself the ready signal a launcher polls for. */
@@ -2207,23 +2256,23 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
   }
   lastPort = http2.port;
   const previousStickyConnect = lastConnectPort;
-  let connect2;
+  let connect3;
   try {
-    connect2 = await ports.startConnectListener(lastConnectPort);
+    connect3 = await ports.startConnectListener(lastConnectPort);
   } catch (error) {
     await http2.close();
     return fail(`could not start the CONNECT surface: ${error instanceof Error ? error.message : String(error)}`);
   }
-  if (previousStickyConnect !== void 0 && connect2.port !== previousStickyConnect) {
-    ports.log(`agent-shim frontdoor supervisor: sticky CONNECT port ${String(previousStickyConnect)} was occupied; moving to ${String(connect2.port)} (OAuth sessions launched against the old port are stale until they relaunch)`);
+  if (previousStickyConnect !== void 0 && connect3.port !== previousStickyConnect) {
+    ports.log(`agent-shim frontdoor supervisor: sticky CONNECT port ${String(previousStickyConnect)} was occupied; moving to ${String(connect3.port)} (OAuth sessions launched against the old port are stale until they relaunch)`);
   }
-  lastConnectPort = connect2.port;
+  lastConnectPort = connect3.port;
   const previousStickyDirect = lastDirectPort;
   let direct;
   try {
     direct = await ports.startDirectListener(lastDirectPort);
   } catch (error) {
-    await connect2.close();
+    await connect3.close();
     await http2.close();
     return fail(`could not start the direct listener: ${error instanceof Error ? error.message : String(error)}`);
   }
@@ -2231,9 +2280,9 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     ports.log(`agent-shim frontdoor supervisor: sticky direct port ${String(previousStickyDirect)} was occupied; moving to ${String(direct.port)} (headroom must be restarted to admit the new address)`);
   }
   lastDirectPort = direct.port;
-  writeFrontDoorState(fs3, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, port: http2.port, connectPort: connect2.port, directPort: direct.port, ...sticky() });
+  writeFrontDoorState(fs3, paths.frontdoorStateFile, { protocol: FRONT_DOOR_PROTOCOL, supervisorPid: ports.ownPid, port: http2.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
   fs3.removeRecursive(paths.frontdoorLockFile);
-  ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http2.port)}, CONNECT surface on 127.0.0.1:${String(connect2.port)}`);
+  ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http2.port)}, CONNECT surface on 127.0.0.1:${String(connect3.port)}`);
   let idleSince;
   let ticks = 0;
   for (; ; ) {
@@ -2247,7 +2296,7 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
       if (ports.now() - idleSince >= idleShutdownMinutes * MS_PER_MINUTE) {
         ports.log(`agent-shim frontdoor supervisor: no sessions for ${String(idleShutdownMinutes)} minute(s); closing the front door and exiting`);
         await direct.close();
-        await connect2.close();
+        await connect3.close();
         await http2.close();
         writeFrontDoorState(fs3, paths.frontdoorStateFile, sticky());
         return 0;
@@ -2371,9 +2420,20 @@ function caParses(ca) {
     return false;
   }
 }
+var TAP_ALPN_PROTOCOLS = ["h2", "http/1.1"];
 async function startConnectServer(config, effects, preferredPort) {
   const onUpgrade = config.capture === void 0 ? void 0 : (request3) => config.capture?.upgrade(request3);
   const sessions = config.interceptHosts.map((host) => {
+    if (config.tapHosts.includes(host)) {
+      const tlsAcceptor2 = effects.createTlsAcceptor(
+        config.leafFor(host),
+        (secure) => {
+          pumpTapSession(secure, async (clientAlpn) => await effects.connectTlsUpstream(host, HTTPS_PORT, clientAlpn), config.capture?.tapStream?.(host));
+        },
+        TAP_ALPN_PROTOCOLS
+      );
+      return { host, tlsAcceptor: tlsAcceptor2 };
+    }
     const handler = (request3, response) => {
       if (host === config.routedHost && servedByPipeline(request3.url)) {
         config.serveRouted(request3, response);
@@ -2398,7 +2458,7 @@ async function startConnectServer(config, effects, preferredPort) {
       await listener.close();
       for (const { httpSession, tlsAcceptor } of sessions) {
         tlsAcceptor.close();
-        httpSession.close();
+        httpSession?.close();
       }
     }
   };
@@ -2574,6 +2634,40 @@ async function blindTunnel(socket, target, effects) {
     socket.destroy();
   });
 }
+function isEnoent(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+function realConnectCertStore(paths) {
+  const read = (file) => {
+    try {
+      return fs.readFileSync(file, "utf8");
+    } catch (error) {
+      if (isEnoent(error)) {
+        return void 0;
+      }
+      throw error;
+    }
+  };
+  return {
+    loadCa: () => {
+      const certPem = read(paths.frontdoorCaCertFile);
+      const keyPem2 = read(paths.frontdoorCaKeyFile);
+      return certPem === void 0 || keyPem2 === void 0 ? void 0 : { certPem, keyPem: keyPem2 };
+    },
+    writeCa: (ca) => {
+      fs.mkdirSync(paths.frontdoorCaDir, { recursive: true });
+      fs.writeFileSync(paths.frontdoorCaCertFile, ca.certPem, "utf8");
+      fs.writeFileSync(paths.frontdoorCaKeyFile, ca.keyPem, { encoding: "utf8", mode: CA_KEY_FILE_MODE });
+      fs.chmodSync(paths.frontdoorCaKeyFile, CA_KEY_FILE_MODE);
+    }
+  };
+}
+
+// src/frontdoor/connectEffects.ts
+import * as http from "node:http";
+import * as https from "node:https";
+import * as net2 from "node:net";
+import * as tls from "node:tls";
 function realConnectEffects() {
   const plainAgent = new http.Agent({ keepAlive: true });
   const tlsAgent = new https.Agent({ keepAlive: true });
@@ -2619,10 +2713,13 @@ function realConnectEffects() {
       }
       return await listenOnce(0, onSocket);
     },
-    createTlsAcceptor: (leaf, onSecure) => {
-      const server = tls.createServer({ key: leaf.keyPem, cert: leaf.certPem }, (secure) => {
-        onSecure(secure);
-      });
+    createTlsAcceptor: (leaf, onSecure, alpnProtocols) => {
+      const server = tls.createServer(
+        { key: leaf.keyPem, cert: leaf.certPem, ...alpnProtocols === void 0 ? {} : { ALPNProtocols: [...alpnProtocols] } },
+        (secure) => {
+          onSecure(secure);
+        }
+      );
       server.on("clientError", (_error, socket) => {
         socket.destroy();
       });
@@ -2657,6 +2754,13 @@ function realConnectEffects() {
         }
       };
     },
+    connectTlsUpstream: async (host, port, clientAlpn) => await new Promise((resolve, reject) => {
+      const socket = tls.connect({ host, port, servername: host, ...clientAlpn === void 0 ? {} : { ALPNProtocols: [clientAlpn] } });
+      socket.once("secureConnect", () => {
+        resolve(socket);
+      });
+      socket.once("error", reject);
+    }),
     connectTcp: async (host, port) => await new Promise((resolve, reject) => {
       const socket = net2.connect({ host, port });
       socket.once("connect", () => {
@@ -2720,34 +2824,6 @@ function realConnectEffects() {
     }
   };
 }
-function isEnoent(error) {
-  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
-}
-function realConnectCertStore(paths) {
-  const read = (file) => {
-    try {
-      return fs.readFileSync(file, "utf8");
-    } catch (error) {
-      if (isEnoent(error)) {
-        return void 0;
-      }
-      throw error;
-    }
-  };
-  return {
-    loadCa: () => {
-      const certPem = read(paths.frontdoorCaCertFile);
-      const keyPem2 = read(paths.frontdoorCaKeyFile);
-      return certPem === void 0 || keyPem2 === void 0 ? void 0 : { certPem, keyPem: keyPem2 };
-    },
-    writeCa: (ca) => {
-      fs.mkdirSync(paths.frontdoorCaDir, { recursive: true });
-      fs.writeFileSync(paths.frontdoorCaCertFile, ca.certPem, "utf8");
-      fs.writeFileSync(paths.frontdoorCaKeyFile, ca.keyPem, { encoding: "utf8", mode: CA_KEY_FILE_MODE });
-      fs.chmodSync(paths.frontdoorCaKeyFile, CA_KEY_FILE_MODE);
-    }
-  };
-}
 
 // src/frontdoor/ensure.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
@@ -2893,6 +2969,7 @@ function ensureFrontDoor(params) {
   const { paths, ports } = params;
   const deadline = ports.now() + FRONTDOOR_START_TIMEOUT_MS;
   let spawned = false;
+  let replaced = false;
   const distrusted = /* @__PURE__ */ new Set();
   let lastRejection;
   for (; ; ) {
@@ -2901,6 +2978,17 @@ function ensureFrontDoor(params) {
     if (supervisorPid !== void 0 && !distrusted.has(supervisorPid) && ports.isRunning(supervisorPid)) {
       if (state?.port !== void 0 && state.connectPort !== void 0) {
         const verdict = ports.verifyListener(state.port);
+        if (verdict.ok && (state.protocol ?? 0) < FRONT_DOOR_PROTOCOL && !replaced) {
+          ports.stopSupervisor(supervisorPid);
+          while (ports.isRunning(supervisorPid)) {
+            if (ports.now() >= deadline) {
+              throw new FrontDoorStartError(`agent-shim: the front door (pid ${String(supervisorPid)}, protocol ${String(state.protocol ?? 0)}) is older than this launcher (protocol ${String(FRONT_DOOR_PROTOCOL)}) and did not exit when asked. Daemon log: ${paths.frontdoorLogPath}`);
+            }
+            ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
+          }
+          replaced = true;
+          continue;
+        }
         if (verdict.ok) {
           const token = randomUUID2();
           writeFrontDoorSession(ports.fs, paths.frontdoorSessionsDir, { pid: params.launcherPid, startedAt: ports.now(), token });

package/dist/types/frontdoor/capture.d.ts

@@ -20,8 +20,17 @@ export interface PassthroughObserver {
     readonly onResponseChunk: (chunk: Buffer) => void;
     readonly onEnd: () => void;
 }
+/** The direction one tapped byte chunk flowed, named from the session's point of view. */
+type StreamDirection = "client-to-server" | "server-to-client";
+/** The byte-level tap for one terminated stream whose protocol the surface does not parse: every chunk both directions, then the end. */
+export interface StreamTap {
+    readonly onChunk: (direction: StreamDirection, chunk: Readonly<Buffer>) => void;
+    readonly onEnd: () => void;
+}
 /** The tap the connect surface drives. `undefined` everywhere means "not capturing"; one object covers the whole door process. */
 export interface ConnectCapture {
+    /** Opens the byte-level tap for one host's terminated stream, whose chunks are recorded verbatim (text, or base64 when not valid UTF-8) under the same caps as piped bodies. Optional because a capture can be stream-silent by construction. */
+    readonly tapStream?: (host: string) => StreamTap;
     /** Records one authenticated CONNECT target: the host and port only, since a blind tunnel's bytes are unreadable by construction. */
     readonly connect: (target: {
         readonly host: string;

package/dist/types/frontdoor/connect.d.ts

@@ -1,5 +1,5 @@
 import type { IncomingHttpHeaders, IncomingMessage, ServerResponse } from "node:http";
-import * as net from "node:net";
+import type * as net from "node:net";
 import type { ConnectCapture, PassthroughObserver } from "./capture";
 /**
  * The front door's CONNECT surface, so an OAuth session can have agent-shim's routing AND Claude Code's Remote Control at once: Remote Control refuses any `ANTHROPIC_BASE_URL` other than the real API, but happily honours `HTTPS_PROXY`, so OAuth launches route at the proxy layer instead.
@@ -14,10 +14,16 @@ export declare const CONNECT_INTERCEPT_HOST = "api.anthropic.com";
  * Every CONNECT host whose TLS this surface terminates, each with its own leaf and its own HTTP parser: the API host above, and `platform.claude.com`, the claude.ai control plane where Remote Control's long-lived channel and its handshake live. Terminating the second one is what makes a Remote Control login rejection observable at all: its bytes cross this surface either way, and blind-tunnelling them hides exactly the exchange that failed. Only the API host's `/v1/` paths ever reach the routed pipeline; everything else on either session is piped to that session's own real upstream, so the pipeline's identification and authorisation are never asked to serve another host's traffic.
  */
 export declare const CONNECT_INTERCEPT_HOSTS: readonly string[];
+/**
+ * The intercept hosts the surface never parses as HTTP: terminated with ALPN for HTTP/2 and HTTP/1.1 both offered, pumped byte for byte to the real host over TLS (offering upstream only the protocol the client negotiated), and teed into the capture's stream tap when capturing is on. The claude.ai control plane's channel mixes an HTTP/1.1-shaped request with binary HTTP/2 frames, so parsing it as either protocol would destroy or distort it; tapping preserves the channel exactly as a blind tunnel served it while making its bytes observable.
+ */
+export declare const CONNECT_TAP_HOSTS: readonly string[];
 /** Paths under this prefix are what the routed pipeline serves; everything else on the terminated session goes to the real upstream. */
 export declare const ROUTED_PATH_PREFIX = "/v1/";
 /** The port HTTPS is served on, both the default when a CONNECT authority names none and the port non-headroom paths are piped to on the real upstream. */
 export declare const HTTPS_PORT = 443;
+/** What the forwarding effect answers with when the upstream is unreachable. */
+export declare const HTTP_BAD_GATEWAY = 502;
 /** Largest CONNECT request head accepted before the connection is refused: a real head is a request line and a few short headers (Host, the proxy credential, a User-Agent), so anything this size is a confused or hostile client. 8 KiB is also the per-header-line limit common HTTP servers apply by default (nginx's `large_client_header_buffers` buffer, Apache's `LimitRequestFieldSize` of 8190 bytes), so no client is built to need a longer line, and a CONNECT head is a few such lines at most. */
 export declare const MAX_CONNECT_HEAD_BYTES = 8192;
 /**
@@ -112,7 +118,7 @@ interface ConnectForwardTarget {
 /** Handles one parsed HTTP request on a terminated TLS session. */
 type ConnectRequestHandler = (request: IncomingMessage, response: ServerResponse) => void;
 /** A bound loopback listener and how to stop it. */
-interface ConnectListenerHandle {
+export interface ConnectListenerHandle {
     readonly port: number;
     /** Stops accepting, ends every live connection, and resolves once the port is released. */
     readonly close: () => Promise<void>;
@@ -135,8 +141,10 @@ interface HttpParserSession {
 export interface ConnectEffects {
     /** Binds a loopback TCP listener; `preferredPort` is tried first and any free port used when it is taken (bind, do not probe: check-then-bind races). Resolves with the bound port and a close handle. */
     readonly listenLoopback: (preferredPort: number | undefined, onSocket: (socket: net.Socket) => void) => Promise<ConnectListenerHandle>;
-    /** Builds the TLS terminator for one leaf, handing each successfully handshaked session to `onSecure`. */
-    readonly createTlsAcceptor: (leaf: LeafCert, onSecure: (secure: net.Socket) => void) => TlsAcceptor;
+    /** Builds the TLS terminator for one leaf, handing each successfully handshaked session to `onSecure`. `alpnProtocols`, when given, is advertised during the handshake, which is how a tap host's session can offer HTTP/2 the way its real server does. */
+    readonly createTlsAcceptor: (leaf: LeafCert, onSecure: (secure: net.Socket) => void, alpnProtocols?: readonly string[]) => TlsAcceptor;
+    /** Opens a TLS connection to a real host, presenting its name as SNI, for a tap session's upstream half. `clientAlpn`, when given, is the protocol the client negotiated with the surface and the only one offered upstream, so the tap never changes the channel's protocol. */
+    readonly connectTlsUpstream: (host: string, port: number, clientAlpn: string | undefined) => Promise<net.Socket>;
     /** Builds the HTTP parser bound to one request handler. `onUpgrade`, when given, sees every HTTP upgrade request arriving on a terminated session; the session destroys the socket afterwards either way, with or without one, matching Node's own no-listener behaviour. */
     readonly createHttpSession: (handler: ConnectRequestHandler, onUpgrade?: (request: IncomingMessage) => void) => HttpParserSession;
     /** Opens a raw TCP connection for a blind tunnel. */
@@ -162,6 +170,8 @@ export interface ConnectServerConfig {
     readonly upstreamFor: (host: string) => ConnectForwardTarget;
     /** Whether a capability presented as a CONNECT request's proxy credential belongs to a live launch: the same constant-time check against the same registry the routed pipeline's admission makes, read fresh on every call because launches come and go. */
     readonly isLiveCapability: (token: string) => boolean;
+    /** The intercept hosts that are never HTTP-parsed: terminated, tapped at the byte level, and pumped to their real host. */
+    readonly tapHosts: readonly string[];
     /** The connection deadlines and caps; production passes `CONNECT_LIMITS`. */
     readonly limits: ConnectLimits;
     /** The diagnostic tap, when capturing is enabled; absent means nothing is recorded. */
@@ -179,8 +189,6 @@ export interface ConnectServerHandle {
  * The connection flow: read the CONNECT head within the deadline (never more of the stream than that, so an early ClientHello glued to the head is pushed back with `unshift` and still seen by whatever consumes the socket next), authenticate it, then either blind-tunnel the target or terminate its TLS and parse HTTP on the session. Every network effect flows through `effects`; nothing here touches the network or filesystem itself.
  */
 export declare function startConnectServer(config: ConnectServerConfig, effects: ConnectEffects, preferredPort: number | undefined): Promise<ConnectServerHandle>;
-/** The real `ConnectEffects` over node's own net, tls, and http. `connectTcp` opens real connections to the CONNECTed host, so tests that want a blind tunnel redirect it. */
-export declare function realConnectEffects(): ConnectEffects;
 /** The real `ConnectCertStore` on the filesystem: `ca.pem` world-readable (it is public material), `ca.key` mode 0600 exactly, chmod'ed after the write because a create's mode bits pass through the process umask. */
 export declare function realConnectCertStore(paths: {
     readonly frontdoorCaDir: string;

package/dist/types/frontdoor/connectEffects.d.ts

@@ -0,0 +1,3 @@
+import { type ConnectEffects } from "./connect";
+/** The real `ConnectEffects` over node's own net, tls, and http. `connectTcp` opens real connections to the CONNECTed host, so tests that want a blind tunnel redirect it. */
+export declare function realConnectEffects(): ConnectEffects;