claude-use 7.6.0 → 7.7.0

package/dist/cli.cjs

@@ -61053,7 +61053,7 @@ function resolveLaunchIdentity(paths, cwd) {
 // package.json
 var package_default = {
   name: "claude-use",
-  version: "7.6.0",
+  version: "7.7.0",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -63791,8 +63791,13 @@ var import_node_path27 = __toESM(require("node:path"), 1);
 
 // src/frontdoor/state.ts
 var import_node_path26 = __toESM(require("node:path"), 1);
+var FRONT_DOOR_PROTOCOL = 1;
 var FrontDoorSessionSchema = external_exports.strictObject({ pid: external_exports.number().int().positive(), startedAt: external_exports.number(), token: external_exports.string().min(1) });
 var FrontDoorStateSchema = external_exports.strictObject({
+  /**
+   * The launcher-to-door wire protocol this supervisor speaks, written once it is serving; absent in state written by a release that predates the field, which `ensureFrontDoor` reads as protocol 0. A launcher replaces a door whose protocol is lower than its own (see `FRONT_DOOR_PROTOCOL`).
+   */
+  protocol: external_exports.number().int().nonnegative().optional(),
   /** The supervisor process serving the front door. Alive means both listeners are up in that process. */
   supervisorPid: external_exports.number().int().positive().optional(),
   /** The loopback port the HTTPS provider listener serves on. Absent until the listener has bound and answered its health probe, so "port is set" is itself the ready signal a launcher polls for. */
@@ -64803,7 +64808,7 @@ function issueLeafCertificate(ca, names, notBefore, notAfter) {
 }
 
 // src/frontdoor/tap.ts
-function pumpTapSession(secure, openUpstream, tap) {
+function pumpTapSession(secure, openUpstream, tap, prefix = Buffer.alloc(0)) {
   let upstream;
   let ended = false;
   const end = () => {
@@ -64835,6 +64840,9 @@ function pumpTapSession(secure, openUpstream, tap) {
       upstream.destroy();
       return;
     }
+    if (prefix.length > 0) {
+      upstream.write(prefix);
+    }
     if (tap !== void 0) {
       secure.on("data", (chunk) => {
         tap.onChunk("client-to-server", chunk);
@@ -64908,7 +64916,7 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     ports.log(`agent-shim frontdoor supervisor: sticky direct port ${String(previousStickyDirect)} was occupied; moving to ${String(direct.port)} (headroom must be restarted to admit the new address)`);
   }
   lastDirectPort = direct.port;
-  writeFrontDoorState(fs18, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, port: http5.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
+  writeFrontDoorState(fs18, paths.frontdoorStateFile, { protocol: FRONT_DOOR_PROTOCOL, supervisorPid: ports.ownPid, port: http5.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
   fs18.removeRecursive(paths.frontdoorLockFile);
   ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http5.port)}, CONNECT surface on 127.0.0.1:${String(connect3.port)}`);
   let idleSince;
@@ -65049,7 +65057,19 @@ function caParses(ca) {
 }
 var TAP_ALPN_PROTOCOLS = ["h2", "http/1.1"];
 async function startConnectServer(config2, effects, preferredPort) {
-  const onUpgrade = config2.capture === void 0 ? void 0 : (request6) => config2.capture?.upgrade(request6);
+  const tunnelTokens = /* @__PURE__ */ new WeakMap();
+  const onUpgrade = (host) => (request6, socket, head) => {
+    config2.capture?.upgrade(request6);
+    if (head.length > 0) {
+      socket.pause();
+      socket.unshift(head);
+    }
+    const headText = `${request6.method ?? "GET"} ${request6.url ?? "/"} HTTP/1.1\r
+${request6.rawHeaders.reduce((accumulated, value, index) => index % 2 === 0 ? `${accumulated}${value}: ` : `${accumulated}${value}\r
+`, "")}\r
+`;
+    pumpTapSession(socket, async (clientAlpn) => await effects.connectTlsUpstream(host, HTTPS_PORT, clientAlpn), void 0, Buffer.from(headText, "utf8"));
+  };
   const sessions = config2.interceptHosts.map((host) => {
     if (config2.tapHosts.includes(host)) {
       const tlsAcceptor2 = effects.createTlsAcceptor(
@@ -65063,13 +65083,18 @@ async function startConnectServer(config2, effects, preferredPort) {
     }
     const handler = (request6, response) => {
       if (host === config2.routedHost && servedByPipeline(request6.url)) {
+        const tunnelToken = tunnelTokens.get(request6.socket);
+        if (tunnelToken !== void 0 && request6.headers[AUTH_HEADER] === void 0) {
+          request6.headers[AUTH_HEADER] = tunnelToken;
+        }
         config2.serveRouted(request6, response);
         return;
       }
       effects.forwardHttp(config2.upstreamFor(host), request6, response, config2.capture?.observePassthrough(request6));
     };
-    const httpSession = effects.createHttpSession(handler, onUpgrade);
-    const tlsAcceptor = effects.createTlsAcceptor(config2.leafFor(host), (secure) => {
+    const httpSession = effects.createHttpSession(handler, onUpgrade(host));
+    const tlsAcceptor = effects.createTlsAcceptor(config2.leafFor(host), (secure, context) => {
+      tunnelTokens.set(secure, context);
       httpSession.serve(secure);
     });
     return { host, httpSession, tlsAcceptor };
@@ -65210,6 +65235,7 @@ function routeConnect(socket, head, context) {
   const credential = proxyAuthorizationOf(head);
   const capability = credential === void 0 ? void 0 : capabilityFromProxyAuthorization(credential);
   if (capability === void 0 || !config2.isLiveCapability(capability)) {
+    console.error(`[upg-dbg] refused CONNECT to ${head.split("\r\n", 1)[0]?.split(" ")[1] ?? "?"} (credential ${credential === void 0 ? "absent" : "present but dead"})`);
     refuse(socket, REFUSAL.proxyAuthenticationRequired, [`Proxy-Authenticate: Basic realm="${CONNECT_PROXY_REALM}"`]);
     return;
   }
@@ -65229,7 +65255,7 @@ function routeConnect(socket, head, context) {
   config2.capture?.connect(target, session !== void 0);
   socket.write(CONNECT_ESTABLISHED);
   if (session !== void 0) {
-    session.tlsAcceptor.accept(socket);
+    session.tlsAcceptor.accept(socket, capability);
     return;
   }
   void blindTunnel(socket, target, effects);
@@ -65341,10 +65367,11 @@ function realConnectEffects() {
       return await listenOnce(0, onSocket);
     },
     createTlsAcceptor: (leaf, onSecure, alpnProtocols) => {
+      let pendingContext = "";
       const server = tls.createServer(
         { key: leaf.keyPem, cert: leaf.certPem, ...alpnProtocols === void 0 ? {} : { ALPNProtocols: [...alpnProtocols] } },
         (secure) => {
-          onSecure(secure);
+          onSecure(secure, pendingContext);
         }
       );
       server.on("clientError", (_error, socket) => {
@@ -65352,7 +65379,8 @@ function realConnectEffects() {
       });
       return {
         // tls.Server is a net.Server whose connection listener wraps the raw socket in the TLS handshake, and emitting the event by hand is what runs that listener on a socket this process already owns (the CONNECT half of the connection) rather than one the server accepted itself.
-        accept: (socket) => {
+        accept: (socket, context) => {
+          pendingContext = context;
           server.emit("connection", socket);
         },
         close: () => {
@@ -65366,9 +65394,8 @@ function realConnectEffects() {
         socket.destroy();
       });
       if (onUpgrade !== void 0) {
-        server.on("upgrade", (request6, socket) => {
-          onUpgrade(request6);
-          socket.destroy();
+        server.on("upgrade", (request6, socket, head) => {
+          onUpgrade(request6, socket, head);
         });
       }
       return {
@@ -65466,6 +65493,7 @@ function ensureFrontDoor(params) {
   const { paths, ports } = params;
   const deadline = ports.now() + FRONTDOOR_START_TIMEOUT_MS;
   let spawned = false;
+  let replaced = false;
   const distrusted = /* @__PURE__ */ new Set();
   let lastRejection;
   for (; ; ) {
@@ -65474,6 +65502,17 @@ function ensureFrontDoor(params) {
     if (supervisorPid !== void 0 && !distrusted.has(supervisorPid) && ports.isRunning(supervisorPid)) {
       if (state?.port !== void 0 && state.connectPort !== void 0) {
         const verdict = ports.verifyListener(state.port);
+        if (verdict.ok && (state.protocol ?? 0) < FRONT_DOOR_PROTOCOL && !replaced) {
+          ports.stopSupervisor(supervisorPid);
+          while (ports.isRunning(supervisorPid)) {
+            if (ports.now() >= deadline) {
+              throw new FrontDoorStartError(`agent-shim: the front door (pid ${String(supervisorPid)}, protocol ${String(state.protocol ?? 0)}) is older than this launcher (protocol ${String(FRONT_DOOR_PROTOCOL)}) and did not exit when asked. Daemon log: ${paths.frontdoorLogPath}`);
+            }
+            ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
+          }
+          replaced = true;
+          continue;
+        }
         if (verdict.ok) {
           const token = (0, import_node_crypto11.randomUUID)();
           writeFrontDoorSession(ports.fs, paths.frontdoorSessionsDir, { pid: params.launcherPid, startedAt: ports.now(), token });
@@ -67152,6 +67191,9 @@ function realFrontDoorPort(paths) {
           now: () => Date.now(),
           sleep: realSleepSync,
           spawnSupervisor: (layout) => spawnDetachedSupervisor(layout, "__frontdoor-supervisor", layout.frontdoorLogPath),
+          stopSupervisor: (pid) => {
+            process.kill(pid, "SIGTERM");
+          },
           // Read fresh for each probe: a replacement supervisor may have regenerated an unparseable CA, and the probe must trust exactly what the serving door's leaf chains to.
           verifyListener: (port) => probeFrontDoorSync(port, import_node_fs11.default.readFileSync(paths.frontdoorCaCertFile, "utf8"))
         }

package/dist/index.cjs

@@ -2160,7 +2160,7 @@ function issueLeafCertificate(ca, names, notBefore, notAfter) {
 }
 
 // src/frontdoor/tap.ts
-function pumpTapSession(secure, openUpstream, tap) {
+function pumpTapSession(secure, openUpstream, tap, prefix = Buffer.alloc(0)) {
   let upstream;
   let ended = false;
   const end = () => {
@@ -2192,6 +2192,9 @@ function pumpTapSession(secure, openUpstream, tap) {
       upstream.destroy();
       return;
     }
+    if (prefix.length > 0) {
+      upstream.write(prefix);
+    }
     if (tap !== void 0) {
       secure.on("data", (chunk) => {
         tap.onChunk("client-to-server", chunk);
@@ -2225,11 +2228,19 @@ function capabilityFromProxyAuthorization(value) {
   return password === "" ? void 0 : password;
 }
 
+// src/frontdoor/route.ts
+var AUTH_HEADER = "x-agent-shim-auth";
+
 // src/frontdoor/state.ts
 var import_node_path5 = __toESM(require("node:path"), 1);
 var import_zod3 = require("zod");
+var FRONT_DOOR_PROTOCOL = 1;
 var FrontDoorSessionSchema = import_zod3.z.strictObject({ pid: import_zod3.z.number().int().positive(), startedAt: import_zod3.z.number(), token: import_zod3.z.string().min(1) });
 var FrontDoorStateSchema = import_zod3.z.strictObject({
+  /**
+   * The launcher-to-door wire protocol this supervisor speaks, written once it is serving; absent in state written by a release that predates the field, which `ensureFrontDoor` reads as protocol 0. A launcher replaces a door whose protocol is lower than its own (see `FRONT_DOOR_PROTOCOL`).
+   */
+  protocol: import_zod3.z.number().int().nonnegative().optional(),
   /** The supervisor process serving the front door. Alive means both listeners are up in that process. */
   supervisorPid: import_zod3.z.number().int().positive().optional(),
   /** The loopback port the HTTPS provider listener serves on. Absent until the listener has bound and answered its health probe, so "port is set" is itself the ready signal a launcher polls for. */
@@ -2375,7 +2386,7 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     ports.log(`agent-shim frontdoor supervisor: sticky direct port ${String(previousStickyDirect)} was occupied; moving to ${String(direct.port)} (headroom must be restarted to admit the new address)`);
   }
   lastDirectPort = direct.port;
-  writeFrontDoorState(fs3, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, port: http2.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
+  writeFrontDoorState(fs3, paths.frontdoorStateFile, { protocol: FRONT_DOOR_PROTOCOL, supervisorPid: ports.ownPid, port: http2.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
   fs3.removeRecursive(paths.frontdoorLockFile);
   ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http2.port)}, CONNECT surface on 127.0.0.1:${String(connect3.port)}`);
   let idleSince;
@@ -2517,7 +2528,19 @@ function caParses(ca) {
 }
 var TAP_ALPN_PROTOCOLS = ["h2", "http/1.1"];
 async function startConnectServer(config, effects, preferredPort) {
-  const onUpgrade = config.capture === void 0 ? void 0 : (request3) => config.capture?.upgrade(request3);
+  const tunnelTokens = /* @__PURE__ */ new WeakMap();
+  const onUpgrade = (host) => (request3, socket, head) => {
+    config.capture?.upgrade(request3);
+    if (head.length > 0) {
+      socket.pause();
+      socket.unshift(head);
+    }
+    const headText = `${request3.method ?? "GET"} ${request3.url ?? "/"} HTTP/1.1\r
+${request3.rawHeaders.reduce((accumulated, value, index) => index % 2 === 0 ? `${accumulated}${value}: ` : `${accumulated}${value}\r
+`, "")}\r
+`;
+    pumpTapSession(socket, async (clientAlpn) => await effects.connectTlsUpstream(host, HTTPS_PORT, clientAlpn), void 0, Buffer.from(headText, "utf8"));
+  };
   const sessions = config.interceptHosts.map((host) => {
     if (config.tapHosts.includes(host)) {
       const tlsAcceptor2 = effects.createTlsAcceptor(
@@ -2531,13 +2554,18 @@ async function startConnectServer(config, effects, preferredPort) {
     }
     const handler = (request3, response) => {
       if (host === config.routedHost && servedByPipeline(request3.url)) {
+        const tunnelToken = tunnelTokens.get(request3.socket);
+        if (tunnelToken !== void 0 && request3.headers[AUTH_HEADER] === void 0) {
+          request3.headers[AUTH_HEADER] = tunnelToken;
+        }
         config.serveRouted(request3, response);
         return;
       }
       effects.forwardHttp(config.upstreamFor(host), request3, response, config.capture?.observePassthrough(request3));
     };
-    const httpSession = effects.createHttpSession(handler, onUpgrade);
-    const tlsAcceptor = effects.createTlsAcceptor(config.leafFor(host), (secure) => {
+    const httpSession = effects.createHttpSession(handler, onUpgrade(host));
+    const tlsAcceptor = effects.createTlsAcceptor(config.leafFor(host), (secure, context) => {
+      tunnelTokens.set(secure, context);
       httpSession.serve(secure);
     });
     return { host, httpSession, tlsAcceptor };
@@ -2678,6 +2706,7 @@ function routeConnect(socket, head, context) {
   const credential = proxyAuthorizationOf(head);
   const capability = credential === void 0 ? void 0 : capabilityFromProxyAuthorization(credential);
   if (capability === void 0 || !config.isLiveCapability(capability)) {
+    console.error(`[upg-dbg] refused CONNECT to ${head.split("\r\n", 1)[0]?.split(" ")[1] ?? "?"} (credential ${credential === void 0 ? "absent" : "present but dead"})`);
     refuse(socket, REFUSAL.proxyAuthenticationRequired, [`Proxy-Authenticate: Basic realm="${CONNECT_PROXY_REALM}"`]);
     return;
   }
@@ -2697,7 +2726,7 @@ function routeConnect(socket, head, context) {
   config.capture?.connect(target, session !== void 0);
   socket.write(CONNECT_ESTABLISHED);
   if (session !== void 0) {
-    session.tlsAcceptor.accept(socket);
+    session.tlsAcceptor.accept(socket, capability);
     return;
   }
   void blindTunnel(socket, target, effects);
@@ -2809,10 +2838,11 @@ function realConnectEffects() {
       return await listenOnce(0, onSocket);
     },
     createTlsAcceptor: (leaf, onSecure, alpnProtocols) => {
+      let pendingContext = "";
       const server = tls.createServer(
         { key: leaf.keyPem, cert: leaf.certPem, ...alpnProtocols === void 0 ? {} : { ALPNProtocols: [...alpnProtocols] } },
         (secure) => {
-          onSecure(secure);
+          onSecure(secure, pendingContext);
         }
       );
       server.on("clientError", (_error, socket) => {
@@ -2820,7 +2850,8 @@ function realConnectEffects() {
       });
       return {
         // tls.Server is a net.Server whose connection listener wraps the raw socket in the TLS handshake, and emitting the event by hand is what runs that listener on a socket this process already owns (the CONNECT half of the connection) rather than one the server accepted itself.
-        accept: (socket) => {
+        accept: (socket, context) => {
+          pendingContext = context;
           server.emit("connection", socket);
         },
         close: () => {
@@ -2834,9 +2865,8 @@ function realConnectEffects() {
         socket.destroy();
       });
       if (onUpgrade !== void 0) {
-        server.on("upgrade", (request3, socket) => {
-          onUpgrade(request3);
-          socket.destroy();
+        server.on("upgrade", (request3, socket, head) => {
+          onUpgrade(request3, socket, head);
         });
       }
       return {
@@ -3064,6 +3094,7 @@ function ensureFrontDoor(params) {
   const { paths, ports } = params;
   const deadline = ports.now() + FRONTDOOR_START_TIMEOUT_MS;
   let spawned = false;
+  let replaced = false;
   const distrusted = /* @__PURE__ */ new Set();
   let lastRejection;
   for (; ; ) {
@@ -3072,6 +3103,17 @@ function ensureFrontDoor(params) {
     if (supervisorPid !== void 0 && !distrusted.has(supervisorPid) && ports.isRunning(supervisorPid)) {
       if (state?.port !== void 0 && state.connectPort !== void 0) {
         const verdict = ports.verifyListener(state.port);
+        if (verdict.ok && (state.protocol ?? 0) < FRONT_DOOR_PROTOCOL && !replaced) {
+          ports.stopSupervisor(supervisorPid);
+          while (ports.isRunning(supervisorPid)) {
+            if (ports.now() >= deadline) {
+              throw new FrontDoorStartError(`agent-shim: the front door (pid ${String(supervisorPid)}, protocol ${String(state.protocol ?? 0)}) is older than this launcher (protocol ${String(FRONT_DOOR_PROTOCOL)}) and did not exit when asked. Daemon log: ${paths.frontdoorLogPath}`);
+            }
+            ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
+          }
+          replaced = true;
+          continue;
+        }
         if (verdict.ok) {
           const token = (0, import_node_crypto5.randomUUID)();
           writeFrontDoorSession(ports.fs, paths.frontdoorSessionsDir, { pid: params.launcherPid, startedAt: ports.now(), token });

package/dist/index.mjs

@@ -2060,7 +2060,7 @@ function issueLeafCertificate(ca, names, notBefore, notAfter) {
 }
 
 // src/frontdoor/tap.ts
-function pumpTapSession(secure, openUpstream, tap) {
+function pumpTapSession(secure, openUpstream, tap, prefix = Buffer.alloc(0)) {
   let upstream;
   let ended = false;
   const end = () => {
@@ -2092,6 +2092,9 @@ function pumpTapSession(secure, openUpstream, tap) {
       upstream.destroy();
       return;
     }
+    if (prefix.length > 0) {
+      upstream.write(prefix);
+    }
     if (tap !== void 0) {
       secure.on("data", (chunk) => {
         tap.onChunk("client-to-server", chunk);
@@ -2125,11 +2128,19 @@ function capabilityFromProxyAuthorization(value) {
   return password === "" ? void 0 : password;
 }
 
+// src/frontdoor/route.ts
+var AUTH_HEADER = "x-agent-shim-auth";
+
 // src/frontdoor/state.ts
 import path5 from "node:path";
 import { z as z3 } from "zod";
+var FRONT_DOOR_PROTOCOL = 1;
 var FrontDoorSessionSchema = z3.strictObject({ pid: z3.number().int().positive(), startedAt: z3.number(), token: z3.string().min(1) });
 var FrontDoorStateSchema = z3.strictObject({
+  /**
+   * The launcher-to-door wire protocol this supervisor speaks, written once it is serving; absent in state written by a release that predates the field, which `ensureFrontDoor` reads as protocol 0. A launcher replaces a door whose protocol is lower than its own (see `FRONT_DOOR_PROTOCOL`).
+   */
+  protocol: z3.number().int().nonnegative().optional(),
   /** The supervisor process serving the front door. Alive means both listeners are up in that process. */
   supervisorPid: z3.number().int().positive().optional(),
   /** The loopback port the HTTPS provider listener serves on. Absent until the listener has bound and answered its health probe, so "port is set" is itself the ready signal a launcher polls for. */
@@ -2275,7 +2286,7 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     ports.log(`agent-shim frontdoor supervisor: sticky direct port ${String(previousStickyDirect)} was occupied; moving to ${String(direct.port)} (headroom must be restarted to admit the new address)`);
   }
   lastDirectPort = direct.port;
-  writeFrontDoorState(fs3, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, port: http2.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
+  writeFrontDoorState(fs3, paths.frontdoorStateFile, { protocol: FRONT_DOOR_PROTOCOL, supervisorPid: ports.ownPid, port: http2.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
   fs3.removeRecursive(paths.frontdoorLockFile);
   ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http2.port)}, CONNECT surface on 127.0.0.1:${String(connect3.port)}`);
   let idleSince;
@@ -2417,7 +2428,19 @@ function caParses(ca) {
 }
 var TAP_ALPN_PROTOCOLS = ["h2", "http/1.1"];
 async function startConnectServer(config, effects, preferredPort) {
-  const onUpgrade = config.capture === void 0 ? void 0 : (request3) => config.capture?.upgrade(request3);
+  const tunnelTokens = /* @__PURE__ */ new WeakMap();
+  const onUpgrade = (host) => (request3, socket, head) => {
+    config.capture?.upgrade(request3);
+    if (head.length > 0) {
+      socket.pause();
+      socket.unshift(head);
+    }
+    const headText = `${request3.method ?? "GET"} ${request3.url ?? "/"} HTTP/1.1\r
+${request3.rawHeaders.reduce((accumulated, value, index) => index % 2 === 0 ? `${accumulated}${value}: ` : `${accumulated}${value}\r
+`, "")}\r
+`;
+    pumpTapSession(socket, async (clientAlpn) => await effects.connectTlsUpstream(host, HTTPS_PORT, clientAlpn), void 0, Buffer.from(headText, "utf8"));
+  };
   const sessions = config.interceptHosts.map((host) => {
     if (config.tapHosts.includes(host)) {
       const tlsAcceptor2 = effects.createTlsAcceptor(
@@ -2431,13 +2454,18 @@ async function startConnectServer(config, effects, preferredPort) {
     }
     const handler = (request3, response) => {
       if (host === config.routedHost && servedByPipeline(request3.url)) {
+        const tunnelToken = tunnelTokens.get(request3.socket);
+        if (tunnelToken !== void 0 && request3.headers[AUTH_HEADER] === void 0) {
+          request3.headers[AUTH_HEADER] = tunnelToken;
+        }
         config.serveRouted(request3, response);
         return;
       }
       effects.forwardHttp(config.upstreamFor(host), request3, response, config.capture?.observePassthrough(request3));
     };
-    const httpSession = effects.createHttpSession(handler, onUpgrade);
-    const tlsAcceptor = effects.createTlsAcceptor(config.leafFor(host), (secure) => {
+    const httpSession = effects.createHttpSession(handler, onUpgrade(host));
+    const tlsAcceptor = effects.createTlsAcceptor(config.leafFor(host), (secure, context) => {
+      tunnelTokens.set(secure, context);
       httpSession.serve(secure);
     });
     return { host, httpSession, tlsAcceptor };
@@ -2578,6 +2606,7 @@ function routeConnect(socket, head, context) {
   const credential = proxyAuthorizationOf(head);
   const capability = credential === void 0 ? void 0 : capabilityFromProxyAuthorization(credential);
   if (capability === void 0 || !config.isLiveCapability(capability)) {
+    console.error(`[upg-dbg] refused CONNECT to ${head.split("\r\n", 1)[0]?.split(" ")[1] ?? "?"} (credential ${credential === void 0 ? "absent" : "present but dead"})`);
     refuse(socket, REFUSAL.proxyAuthenticationRequired, [`Proxy-Authenticate: Basic realm="${CONNECT_PROXY_REALM}"`]);
     return;
   }
@@ -2597,7 +2626,7 @@ function routeConnect(socket, head, context) {
   config.capture?.connect(target, session !== void 0);
   socket.write(CONNECT_ESTABLISHED);
   if (session !== void 0) {
-    session.tlsAcceptor.accept(socket);
+    session.tlsAcceptor.accept(socket, capability);
     return;
   }
   void blindTunnel(socket, target, effects);
@@ -2709,10 +2738,11 @@ function realConnectEffects() {
       return await listenOnce(0, onSocket);
     },
     createTlsAcceptor: (leaf, onSecure, alpnProtocols) => {
+      let pendingContext = "";
       const server = tls.createServer(
         { key: leaf.keyPem, cert: leaf.certPem, ...alpnProtocols === void 0 ? {} : { ALPNProtocols: [...alpnProtocols] } },
         (secure) => {
-          onSecure(secure);
+          onSecure(secure, pendingContext);
         }
       );
       server.on("clientError", (_error, socket) => {
@@ -2720,7 +2750,8 @@ function realConnectEffects() {
       });
       return {
         // tls.Server is a net.Server whose connection listener wraps the raw socket in the TLS handshake, and emitting the event by hand is what runs that listener on a socket this process already owns (the CONNECT half of the connection) rather than one the server accepted itself.
-        accept: (socket) => {
+        accept: (socket, context) => {
+          pendingContext = context;
           server.emit("connection", socket);
         },
         close: () => {
@@ -2734,9 +2765,8 @@ function realConnectEffects() {
         socket.destroy();
       });
       if (onUpgrade !== void 0) {
-        server.on("upgrade", (request3, socket) => {
-          onUpgrade(request3);
-          socket.destroy();
+        server.on("upgrade", (request3, socket, head) => {
+          onUpgrade(request3, socket, head);
         });
       }
       return {
@@ -2964,6 +2994,7 @@ function ensureFrontDoor(params) {
   const { paths, ports } = params;
   const deadline = ports.now() + FRONTDOOR_START_TIMEOUT_MS;
   let spawned = false;
+  let replaced = false;
   const distrusted = /* @__PURE__ */ new Set();
   let lastRejection;
   for (; ; ) {
@@ -2972,6 +3003,17 @@ function ensureFrontDoor(params) {
     if (supervisorPid !== void 0 && !distrusted.has(supervisorPid) && ports.isRunning(supervisorPid)) {
       if (state?.port !== void 0 && state.connectPort !== void 0) {
         const verdict = ports.verifyListener(state.port);
+        if (verdict.ok && (state.protocol ?? 0) < FRONT_DOOR_PROTOCOL && !replaced) {
+          ports.stopSupervisor(supervisorPid);
+          while (ports.isRunning(supervisorPid)) {
+            if (ports.now() >= deadline) {
+              throw new FrontDoorStartError(`agent-shim: the front door (pid ${String(supervisorPid)}, protocol ${String(state.protocol ?? 0)}) is older than this launcher (protocol ${String(FRONT_DOOR_PROTOCOL)}) and did not exit when asked. Daemon log: ${paths.frontdoorLogPath}`);
+            }
+            ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
+          }
+          replaced = true;
+          continue;
+        }
         if (verdict.ok) {
           const token = randomUUID2();
           writeFrontDoorSession(ports.fs, paths.frontdoorSessionsDir, { pid: params.launcherPid, startedAt: ports.now(), token });

package/dist/types/frontdoor/connect.d.ts

@@ -1,5 +1,6 @@
 import type { IncomingHttpHeaders, IncomingMessage, ServerResponse } from "node:http";
 import type * as net from "node:net";
+import type { Duplex } from "node:stream";
 import type { ConnectCapture, PassthroughObserver } from "./capture";
 /**
  * The front door's CONNECT surface, so an OAuth session can have agent-shim's routing AND Claude Code's Remote Control at once: Remote Control refuses any `ANTHROPIC_BASE_URL` other than the real API, but happily honours `HTTPS_PROXY`, so OAuth launches route at the proxy layer instead.
@@ -125,8 +126,8 @@ export interface ConnectListenerHandle {
 }
 /** Presents one leaf's server-side TLS on CONNECTed sockets. */
 interface TlsAcceptor {
-    /** Starts the TLS handshake on a socket that has just received its CONNECT response. */
-    readonly accept: (socket: net.Socket) => void;
+    /** Starts the TLS handshake on a socket that has just received its CONNECT response, carrying `context` to the handshake's completion untouched: whatever the caller knows about this connection (its tunnel's capability) reaches `onSecure` without the acceptor interpreting it. */
+    readonly accept: (socket: net.Socket, context: string) => void;
     /** Drops every session this acceptor is terminating. */
     readonly close: () => void;
 }
@@ -141,12 +142,12 @@ interface HttpParserSession {
 export interface ConnectEffects {
     /** Binds a loopback TCP listener; `preferredPort` is tried first and any free port used when it is taken (bind, do not probe: check-then-bind races). Resolves with the bound port and a close handle. */
     readonly listenLoopback: (preferredPort: number | undefined, onSocket: (socket: net.Socket) => void) => Promise<ConnectListenerHandle>;
-    /** Builds the TLS terminator for one leaf, handing each successfully handshaked session to `onSecure`. `alpnProtocols`, when given, is advertised during the handshake, which is how a tap host's session can offer HTTP/2 the way its real server does. */
-    readonly createTlsAcceptor: (leaf: LeafCert, onSecure: (secure: net.Socket) => void, alpnProtocols?: readonly string[]) => TlsAcceptor;
+    /** Builds the TLS terminator for one leaf, handing each successfully handshaked session to `onSecure` together with the context its `accept` call carried. `alpnProtocols`, when given, is advertised during the handshake, which is how a tap host's session can offer HTTP/2 the way its real server does. */
+    readonly createTlsAcceptor: (leaf: LeafCert, onSecure: (secure: net.Socket, context: string) => void, alpnProtocols?: readonly string[]) => TlsAcceptor;
     /** Opens a TLS connection to a real host, presenting its name as SNI, for a tap session's upstream half. `clientAlpn`, when given, is the protocol the client negotiated with the surface and the only one offered upstream, so the tap never changes the channel's protocol. */
     readonly connectTlsUpstream: (host: string, port: number, clientAlpn: string | undefined) => Promise<net.Socket>;
-    /** Builds the HTTP parser bound to one request handler. `onUpgrade`, when given, sees every HTTP upgrade request arriving on a terminated session; the session destroys the socket afterwards either way, with or without one, matching Node's own no-listener behaviour. */
-    readonly createHttpSession: (handler: ConnectRequestHandler, onUpgrade?: (request: IncomingMessage) => void) => HttpParserSession;
+    /** Builds the HTTP parser bound to one request handler. `onUpgrade`, when given, owns every HTTP upgrade request arriving on a terminated session, socket and already-read bytes included; a session without one lets Node destroy the upgrade, its own no-listener behaviour. */
+    readonly createHttpSession: (handler: ConnectRequestHandler, onUpgrade?: (request: IncomingMessage, socket: Duplex, head: Buffer) => void) => HttpParserSession;
     /** Opens a raw TCP connection for a blind tunnel. */
     readonly connectTcp: (host: string, port: number) => Promise<net.Socket>;
     /** Streams one request to `target` and the response back, never buffering a body. When `observer` is given, the forwarding drives it with additive listeners (request and response chunks arrive to both the pipe and the observer) so capturing never changes the forwarding's own flow control. */

package/dist/types/frontdoor/ensure.d.ts

@@ -17,6 +17,8 @@ export interface EnsureFrontDoorPorts {
     readonly spawnSupervisor: (paths: LayoutPaths) => number;
     /** Authenticates the provider listener on `port`: a TLS handshake chaining to agent-shim's CA and a healthy answer, with no capability sent (see `probeFrontDoorSync`). */
     readonly verifyListener: (port: number) => ListenerVerdict;
+    /** Asks a running front-door supervisor to exit, without waiting for it to: the caller polls `isRunning`. Only ever called for a pid whose recorded listener has just authenticated as agent-shim's own. */
+    readonly stopSupervisor: (pid: number) => void;
 }
 /**
  * Brings the front door up for this launch, or finds it serving, and registers this launcher pid in its session registry: the fact that keeps the door from idling out while this session lives, and the record that holds this launch's capability token. The same lock-and-poll coordination as headroom's and the old codex daemon's ensure: the exclusive-create start lock decides which of several concurrent launches spawns the one supervisor, everyone waits on state.json, and a lock whose holder died is removed and retried. Ready means state names a live supervisor and both listeners' ports, which the supervisor writes only after both have bound (and the provider listener has answered its own health probe).

package/dist/types/frontdoor/route.d.ts

@@ -0,0 +1,112 @@
+import type { IncomingHttpHeaders, IncomingMessage } from "node:http";
+/**
+ * The agent-shim-internal headers the launcher injects through `ANTHROPIC_CUSTOM_HEADERS` so the front door can identify and route a request's session. None of them may ever leave the machine: the identity step strips every one before a route sees the request, so no upstream, and not even the headroom hop, learns what they say.
+ */
+export declare const INTERNAL_HEADER_NAMES: readonly ["x-agent-shim-identity", "x-agent-shim-session", "x-agent-shim-headroom", "x-agent-shim-auth", "x-agent-shim-hop", "x-agent-shim-hop-id", "x-headroom-project-id", "x-headroom-base-url"];
+/** Carries the launching identity's name (the `@name` the launch resolved), set by the launcher and stripped at the door. */
+export declare const IDENTITY_HEADER = "x-agent-shim-identity";
+/** Carries one launch's session id, generated by the launcher and stripped at the door; response middleware keys its observations by it. */
+export declare const SESSION_HEADER = "x-agent-shim-session";
+/** Set to `1` when the launch resolved headroom on, so the front door knows this session's requests must take the headroom hop; stripped at the door. */
+export declare const HEADROOM_FLAG_HEADER = "x-agent-shim-headroom";
+/**
+ * Carries the project identity headroom scopes its memory state to (the git repository root of the launch directory). Also injected by the launcher and stripped at the door: the headroom hop re-sets it on its own request, so it reaches headroom and nowhere else.
+ */
+export declare const PROJECT_ID_HEADER = "x-headroom-project-id";
+/**
+ * Headroom's per-request upstream selector, which the child used to carry and the door now owns: the door strips any inbound copy (a leftover from an older launcher's environment would otherwise redirect the daemon behind the door's back) and its hop sets it fresh when a route names an upstream.
+ */
+export declare const HEADROOM_BASE_URL_HEADER = "x-headroom-base-url";
+/**
+ * The per-launch capability a client-facing listener requires before it routes anything: a random token the launcher generates, hands the child through `ANTHROPIC_CUSTOM_HEADERS`, and records in the door's session registry, so a loopback process that never launched through agent-shim cannot spend the session's credentials or quota. Stripped at the door like every internal header.
+ */
+export declare const AUTH_HEADER = "x-agent-shim-auth";
+/**
+ * The capability the direct listener requires: a per-generation random secret held only in the door process's memory, set by the headroom hop on the requests it forwards back. A loopback process that finds the direct port still cannot use it, and nothing on disk ever holds the secret.
+ */
+export declare const HOP_SECRET_HEADER = "x-agent-shim-hop";
+/**
+ * Names the credential custody record one headroom hop holds: a random id the hop sets on the request it hands headroom, alongside placeholders where the real credential headers were. The direct listener exchanges a live id (and only for the provider the record was made for) for the real headers before routing, so the credential itself never crosses headroom or the plain-HTTP leg back.
+ */
+export declare const HOP_ID_HEADER = "x-agent-shim-hop-id";
+/** What the identity step learned about one request from the launcher-injected headers. */
+export interface SessionIdentity {
+    /** The identity name the launch resolved, when it resolved one. */
+    readonly identity: string | undefined;
+    /** The per-launch session id, when the launcher injected one. */
+    readonly sessionId: string | undefined;
+    /** Whether this launch resolved headroom on, so its requests must pass through the headroom hop before their route. */
+    readonly headroom: boolean;
+    /** The project identity headroom scopes memory to, re-set on the headroom hop and sent nowhere else. */
+    readonly projectId: string | undefined;
+}
+/** The outcome of the pipeline's first step: what the session is, and the headers that may actually leave the machine. */
+export interface IdentifiedRequest {
+    readonly session: SessionIdentity;
+    /**
+     * The request's headers with every internal header removed. A route forwards these, and only these, onwards: the identity and session headers are for the front door alone and must never reach an upstream, the headroom hop, or a translator's backend call.
+     */
+    readonly forwardableHeaders: IncomingHttpHeaders;
+}
+/**
+ * The identity step: splits a request's headers into what the front door may learn (the session) and what may leave the machine (everything else). Internal header names are matched case-insensitively, which is how the transport already normalises them.
+ */
+export declare function identifyRequest(headers: Readonly<IncomingHttpHeaders>): IdentifiedRequest;
+/** The path prefix every provider-scoped request sits under: a routed session's base URL is the front door's address plus `/providers/<name>`, so one listener serves any number of providers, each with its own credential and translation settings. */
+export declare const PROVIDER_PATH_PREFIX = "/providers/";
+/** The base URL a provider's sessions are pointed at: HTTPS, because the child sends its provider credential on every request and only a listener presenting a leaf signed by agent-shim's CA may receive it. */
+export declare function providerBaseUrl(port: number, provider: string): string;
+/** The bare origin of a loopback listener, which is what a headroom hop is told to forward to: headroom appends the client's own request path to it. */
+export declare function directOrigin(port: number): string;
+/** Splits `/providers/<name>/<rest>` into the provider name and the rest, or undefined for any other path. */
+export declare function parseProviderPath(path: string): {
+    readonly provider: string;
+    readonly rest: string;
+} | undefined;
+/** One request as a route sees it: the transport's own request and abort signal, plus what the identity step resolved. */
+export interface RoutedRequest {
+    readonly method: string;
+    /** The request target exactly as received, path and query together. */
+    readonly url: string;
+    /** The request's headers with every internal header already stripped: exactly what a route may forward onwards. */
+    readonly headers: IncomingHttpHeaders;
+    /** The request's body stream: a route either pipes it onward untouched or reads it whole, never both. */
+    readonly body: IncomingMessage;
+    /** Aborted the moment the client goes away; a route aborts its own upstream work with it. */
+    readonly signal: AbortSignal;
+    readonly session: SessionIdentity;
+}
+/** The response half a route writes through, so the pipeline can run response middleware at the head and apply backpressure uniformly. */
+export interface RoutedResponse {
+    /** Whether the head has already been written. */
+    readonly headersSent: boolean;
+    /** Writes the response head, running every response observer first. Must be called exactly once, before any write. */
+    readonly start: (status: number, headers: Readonly<Record<string, string>>) => void;
+    /** Sends the head on its way before any body chunk exists: a streaming response's client should see its headers the moment they are known. */
+    readonly flush: () => void;
+    /**
+     * Writes one body chunk, waiting for the socket to take it when the client is slow (backpressure: a slow client slows the route, and its upstream, instead of growing a buffer without bound). Resolves early, without writing, once the client is gone.
+     */
+    readonly write: (chunk: string | Uint8Array) => Promise<void>;
+    /** Ends the response. */
+    readonly end: () => void;
+    /** Drops the connection: an upstream failure after the head went out, where no status can be sent any more. */
+    readonly destroy: () => void;
+}
+/** One pluggable destination the front door routes a request to. */
+export interface FrontDoorRoute {
+    /** The route's name, for logs and for response middleware context. */
+    readonly name: string;
+    /**
+     * Whether the headroom hop may sit in front of this route. Headroom needs the Anthropic-shaped request, so a protocol translator built on an Anthropic-compatible surface opts in, and a route whose request shape headroom could not understand opts out.
+     */
+    readonly headroomEligible: boolean;
+    /**
+     * The upstream headroom is told to use (its per-request base URL header) when the hop sits in front of this route. When defined it is always this door's direct listener, which is what lets the hop keep the route's credential in custody and the direct listener restore it; a route must never name any other address here. Undefined leaves headroom's own default upstream in charge, which is Claude Code's API.
+     */
+    readonly headroomUpstream: string | undefined;
+    /**
+     * Serves the request directly: headroom has already been applied, or does not apply to this route. Writes the response through `response` and resolves once the response has ended.
+     */
+    readonly serve: (request: RoutedRequest, response: RoutedResponse) => Promise<void>;
+}

package/dist/types/frontdoor/state.d.ts

@@ -1,5 +1,11 @@
 import { z } from "zod";
 import type { HeadroomFs } from "../headroom/state";
+/**
+ * The launcher-to-door wire protocol this release speaks: the headers a launch's child presents, the capability registry's record format, and the routes. Bump it when a change would stop a door of this release serving launches made by an older one, or an older door serving this release's launches.
+ *
+ * The rule that makes a bump safe: a door accepts every lower protocol's launches (protocol 1 accepts the former `x-claude-use-*` header names), and a launcher replaces a door whose protocol is lower than its own, never one that is higher. Replacing is safe because restarts are what the door is designed for: the capability registry is on disk and the listeners keep their sticky ports, so launches already running reach the replacement on the addresses they froze at launch.
+ */
+export declare const FRONT_DOOR_PROTOCOL = 1;
 /** The record held in one front-door session-registry file: the launcher's pid plus the per-launch capability token its child presents on every request. */
 declare const FrontDoorSessionSchema: z.ZodObject<{
     pid: z.ZodNumber;
@@ -11,6 +17,7 @@ export type FrontDoorSession = z.infer<typeof FrontDoorSessionSchema>;
  * The front-door supervisor's state.json under `<home>/frontdoor/`. Every field is optional because the file exists in stages, exactly like headroom's and the old codex daemon's: a fresh supervisor writes its own pid before the listener is up, and a shut-down front door leaves only the sticky `lastPort` and any `lastError` worth surfacing.
  */
 declare const FrontDoorStateSchema: z.ZodObject<{
+    protocol: z.ZodOptional<z.ZodNumber>;
     supervisorPid: z.ZodOptional<z.ZodNumber>;
     port: z.ZodOptional<z.ZodNumber>;
     lastPort: z.ZodOptional<z.ZodNumber>;

package/dist/types/frontdoor/tap.d.ts

@@ -1,8 +1,9 @@
 import type * as net from "node:net";
+import type { Duplex } from "node:stream";
 import type { StreamTap } from "./capture";
 /**
  * Pumps one already-TLS-terminated stream byte for byte to its real host over a fresh TLS connection, teeing every chunk in both directions into `tap` when one is given. This is the instrumentation for a host whose protocol the surface does not parse: the claude.ai control plane carries Remote Control on a channel that mixes shapes (observed under capture: an HTTP/1.1-shaped token request first, then binary HTTP/2 frames around it), so parsing it as either protocol would destroy or distort it. Pass everything through unchanged and record, never interpret: the frames are decoded offline, and a protocol the door does not understand keeps working exactly as the blind tunnel served it.
  *
  * Lifecycle mirrors `blindTunnel`: whoever goes away first takes the other side with it, so neither half of a tap session ever outlives its peer. The tap's listeners ride beside the pipes, additive like every other observer in this surface, so a recording failure fails loudly rather than silently stopping a diagnostic.
  */
-export declare function pumpTapSession(secure: net.Socket, openUpstream: (clientAlpn: string | undefined) => Promise<net.Socket>, tap: StreamTap | undefined): void;
+export declare function pumpTapSession(secure: Duplex, openUpstream: (clientAlpn: string | undefined) => Promise<net.Socket>, tap: StreamTap | undefined, prefix?: Readonly<Buffer>): void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-use",
-  "version": "7.6.0",
+  "version": "7.7.0",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",