@hanamorilabs/tab 0.1.10 → 0.1.12

package/README.md

@@ -93,7 +93,7 @@ tab use              pick or change the Agent this folder runs as (.flocktab)
 tab agent create <name> --subscription|--api   a new Agent of that kind (--cap 50)
 tab agent kind <agent> api|subscription        change it
 tab accounts         accounts your subscription Agents were seen on: plan, price, quota used
-tab pool             several logins of one vendor: add claude|codex <name>, at <percent>, swap auto|launch
+tab pool             several logins of one vendor: add claude|codex|grok|kimi <name>, at [vendor] <percent>, swap auto|launch
 tab alias setup <name>...   make plain `codex` run `tab codex` (shims in ~/.flocktab/bin)
 tab alias remove <name>...  undo that; `tab alias list` shows them
 tab status           flock, folder Agent, proxy health, provider key state
@@ -161,3 +161,19 @@ plan    team
 kind    api (the flock's provider key, metered on the tab)
 byok    provider keys on this box
 ```
+
+## Trying a change before it is released
+
+`tabdev` is this checkout's CLI run from source, beside the `tab` npm
+installed. It keeps everything of its own: `~/.flocktabdev` for the login,
+keys, pool and proxy files, and `.flocktabdev` as the per-folder file. Nothing
+it does touches the production `tab`. Log it in once with `tabdev login`, and
+give its folders Agents of their own: choosing an Agent that production
+already holds a key for would replace that key (it asks first).
+
+```
+node apps/tab/scripts/link-dev.mjs            # writes ~/.local/bin/tabdev
+tabdev version                                # "0.1.x + dev (this checkout's source)"
+tabdev claude                                 # exactly what the next release would do
+node apps/tab/scripts/link-dev.mjs --remove
+```

package/dist/alias.js

@@ -65,10 +65,12 @@ export function shimDirOnPath(env = process.env, platform = process.platform) {
 /** PATH for the child agent: everything except the shim folder. */
 export function pathWithoutShims(env = process.env, platform = process.platform) {
     const sep = platform === "win32" ? ";" : ":";
-    const dir = path.resolve(shimDir(env));
+    // Also the default home's shims: a CLI run with FLOCKTAB_HOME elsewhere (tabdev)
+    // must not spawn a production `claude` shim that re-enters the other tab.
+    const dirs = new Set([path.resolve(shimDir(env)), path.resolve(shimDir({}))]);
     return (env.PATH ?? "")
         .split(sep)
-        .filter((p) => p && path.resolve(p) !== dir)
+        .filter((p) => p && !dirs.has(path.resolve(p)))
         .join(sep);
 }
 /** The line to add to a shell rc so the shims win. */

package/dist/cli.js

@@ -32,12 +32,14 @@ import { bold, box, cyan, dim, green, heading, line, rows, underline, yellow } f
 import { envFor, knownClients, subscriptionVendorFor } from "./clients.js";
 import { describeLogin, localLogin } from "./logins.js";
 import { prepareCodexHome } from "./codex-home.js";
-import { addMember, loadPool, memberEnv, poolVendorFor, prepareClaudeMember, removeMember, savePool, usedPct } from "./pool.js";
+import { addMember, loadPool, memberEnv, memberHome, POOL_VENDORS, poolVendorFor, prepareClaudeMember, prepareSharedSessions, removeMember, savePool, setThreshold, thresholdFor, usedPct } from "./pool.js";
 import { runPooled } from "./pool-run.js";
+import { renderPool } from "./pool-view.js";
 import { ConsoleApiError, createAgent, issueAgentKey, listAgents } from "./console-api.js";
 import { consoleUrlFor, DeviceLoginError, startDeviceLogin, waitForApproval } from "./device-login.js";
 import { clearConfig, configDir, configPath, HOSTED_PROXY, isLocalProxy, loadConfig, LOCAL_PROXY, normalizeProxyUrl, presentedKey, saveConfig, } from "./config.js";
 import { reportFolder } from "./folder.js";
+import { whoami } from "./proxy-identity.js";
 import { listAliases, pathLine, pathWithoutShims, removeAlias, shimDir, shimDirOnPath, validAliasName, writeAlias } from "./alias.js";
 import * as manage from "./manage.js";
 import { agentNameFor, projectRoot, readProject, writeProject } from "./project.js";
@@ -64,8 +66,8 @@ function usage() {
         cmd("agent kind <agent> api|subscription", "change it"),
         cmd("accounts", "accounts your subscription Agents were seen on: plan, price, quota used"),
         cmd("pool", "several logins of one vendor; tab claude runs as the one with most room"),
-        cmd("pool add claude|codex <name>", "sign another login in (its own folder; --dir <path> to use one you have)"),
-        cmd("pool at <percent>", "move to another login once this much of a window is used (default 80)"),
+        cmd("pool add claude|codex|grok|kimi <name>", "sign another login in through the browser (--email to prefill, --dir <path> to use a folder you have)"),
+        cmd("pool at [claude|codex|grok|kimi] <percent>", "move to another login once this much of a window is used (default 80); per vendor if named"),
         cmd("alias setup <name>...", "make plain `codex` run `tab codex` (shims in ~/.flocktab/bin)"),
         cmd("alias remove <name>...", "undo that; `tab alias list` shows them"),
         cmd("status", "which flock, which Agent here, is the proxy up"),
@@ -95,22 +97,6 @@ function usage() {
     say(`
 ${dim("Config")} ${configPath()}  ${dim("or FLOCKTAB_PROXY_URL, FLOCKTAB_KEY, FLOCKTAB_UNLOCK")}`);
 }
-async function whoami(proxyUrl, login) {
-    try {
-        const response = await fetch(`${proxyUrl}/v1/whoami`, {
-            headers: { authorization: `Bearer ${presentedKey(login)}` },
-        });
-        const body = (await response.json().catch(() => ({})));
-        if (!response.ok) {
-            const message = body.error?.message;
-            return { error: message ?? `whoami returned ${response.status}` };
-        }
-        return body;
-    }
-    catch {
-        return { error: "proxy unreachable" };
-    }
-}
 /**
  * Without a terminal (CI, a script, `printf ... | tab up`) every answer
  * comes from stdin, read once and handed out line by line; closing a
@@ -474,7 +460,9 @@ async function version() {
     const bin = proxyBinPath();
     const installed = await proxyInstalled();
     const where = packaged ? `packaged, ${packaged}` : installed ? `downloaded, ${bin}` : "not installed; tab up fetches it";
-    say(rows([["tab", TAB_VERSION], ["proxy", `${PROXY_VERSION}  ${dim(`(${where})`)}`]], 0));
+    // `tabdev` (scripts/link-dev.mjs) runs this checkout's source, not the npm install.
+    const tabVersion = process.env.FLOCKTAB_DEV ? `${TAB_VERSION} + dev ${dim("(this checkout's source)")}` : TAB_VERSION;
+    say(rows([["tab", tabVersion], ["proxy", `${PROXY_VERSION}  ${dim(`(${where})`)}`]], 0));
     return 0;
 }
 async function status() {
@@ -539,17 +527,28 @@ function takePoolFlags(argv) {
     }
     return { args, noPool, asked: asked || pinned !== undefined, ...(pinned ? { pinned } : {}) };
 }
+/** The login a member's folder holds, read from the harness's own files (account fields only). */
+function memberLogin(vendor, member) {
+    const home = memberHome(vendor, member);
+    return localLogin(vendor, vendor === "anthropic" ? { claudeConfigDir: home } : vendor === "openai" ? { codexHome: home } : vendor === "xai" ? { grokHome: home } : { kimiShareDir: home });
+}
+const VENDOR_NAMES = { anthropic: "Claude", openai: "ChatGPT (Codex)", xai: "Grok", kimi: "Kimi" };
+const VENDOR_HARNESS = { anthropic: "claude", openai: "codex", xai: "grok", kimi: "kimi" };
 async function flockAccounts(config) {
     return (await manage.api(config)("GET", "/api/cli/accounts")).accounts;
 }
 /** Each member with the login its folder holds and how used the vendor last said that account is. */
-async function poolStandings(config, vendor, members) {
-    const accounts = await flockAccounts(config).catch(() => []);
+async function poolStandings(config, vendor, members, known) {
+    const accounts = known ?? (await flockAccounts(config).catch(() => []));
     return Promise.all(members.map(async (member) => {
-        const login = await localLogin(vendor, vendor === "anthropic" ? { claudeConfigDir: member.dir } : { codexHome: path.join(member.dir, "codex") });
+        const login = await memberLogin(vendor, member);
         const email = login?.email;
-        const account = email ? accounts.find((a) => a.provider === vendor && a.email?.toLowerCase() === email.toLowerCase()) : undefined;
-        return { member, used: account ? usedPct(account.quota) : undefined, ...(email ? { email } : {}) };
+        // By email where the vendor names one, else by the account id the proxy files calls under.
+        const account = accounts.find((a) => a.provider === vendor && ((email && a.email?.toLowerCase() === email.toLowerCase()) || (login?.accountId && a.externalId === login.accountId)));
+        const shown = email ?? (login?.accountId ? `account ${login.accountId.slice(0, 12)}` : undefined);
+        // The vendor's plan name once seen on the wire; before that, what the harness's own file says.
+        const plan = account?.planLabel ?? login?.plan?.replace(/^default_/, "").replaceAll("_", " ");
+        return { member, used: account ? usedPct(account.quota) : undefined, ...(shown ? { email: shown } : {}), ...(plan ? { plan } : {}), ...(account ? { windows: account.quota } : {}) };
     }));
 }
 /** Quiet: no call of this Agent in flight, and no reply from the vendor in the last 20 seconds. */
@@ -566,7 +565,8 @@ async function runAgent(name, argv) {
     const config = await ensureLogin();
     if (!config)
         return 2;
-    if (!(await ensureProxy(config)))
+    // Hosted whoami below proves readiness and current Agent kind in one round trip.
+    if (config.mode === "self-hosted" && !(await ensureProxy(config)))
         return 1;
     const agent = await resolveAgent(config);
     if (!agent)
@@ -578,6 +578,10 @@ async function runAgent(name, argv) {
     // consumer plan, is metered with the flock's key.
     const vendor = subscriptionVendorFor(name);
     const me = await whoami(config.proxyUrl, { key: agent.key, unlock: config.unlock });
+    if (config.mode === "hosted" && "error" in me) {
+        fail(me.error);
+        return 1;
+    }
     let kind = !("error" in me) && me.kind === "subscription" ? "subscription" : "api";
     // A proxy older than 0.1.7 answers whoami without the kind. Guessing api
     // would hand a subscription Agent's harness the tab key, so ask the console.
@@ -653,7 +657,10 @@ async function runAgent(name, argv) {
     };
     if (!pooled || !poolVendor || !pool)
         return launch(args, env).done;
-    // Codex members each need their own home written before the first launch.
+    // Codex members each need their own home written before the first launch;
+    // Codex, Grok and Kimi members share one conversations folder.
+    for (const member of members)
+        await prepareSharedSessions(poolVendor, member);
     if (poolVendor === "openai") {
         for (const member of members) {
             await prepareCodexHome({ baseDir: member.dir, proxyUrl: config.proxyUrl, presentedKey: key, mode: config.mode, auth, userCodexHome: path.join(member.dir, "no-personal-login") });
@@ -661,7 +668,7 @@ async function runAgent(name, argv) {
     }
     return runPooled(args, {
         harness: name,
-        at: pool.at,
+        at: thresholdFor(pool, poolVendor),
         swap: pool.swap,
         ...(pinned ? { pinned } : {}),
         standings: () => poolStandings(config, poolVendor, members),
@@ -686,14 +693,33 @@ async function poolCommand(argv) {
     const [sub, ...rest] = argv;
     const pool = await loadPool();
     const vendorOf = (word) => poolVendorFor(word === "chatgpt" ? "codex" : (word ?? ""));
+    const HARNESSES = "claude|codex|grok|kimi";
     if (sub === "at") {
-        const pct = Number(rest[0]);
-        if (!Number.isFinite(pct) || pct < 1 || pct > 100) {
-            fail("tab pool at <percent>, from 1 to 100.");
+        // `tab pool at 80` for everyone; `tab pool at claude 70` for one vendor; `tab pool at claude default` to clear it.
+        const vendor = rest.length > 1 ? vendorOf(rest[0]) : undefined;
+        const value = rest.length > 1 ? rest[1] : rest[0];
+        const clear = vendor !== undefined && (value === "default" || value === "reset");
+        if ((rest.length > 1 && !vendor) || (!clear && !/^\d{1,3}$/.test(value ?? ""))) {
+            fail(`tab pool at <percent>, or tab pool at claude|codex|grok|kimi <percent>|default. ${dim("A percent is 1 to 100.")}`);
             return 2;
         }
-        await savePool({ ...pool, at: Math.round(pct) });
-        ok(`The pool moves to another login at ${Math.round(pct)}% used.`);
+        let next;
+        try {
+            next = setThreshold(pool, clear ? undefined : Number(value), vendor);
+        }
+        catch (err) {
+            fail(err.message);
+            return 2;
+        }
+        await savePool(next);
+        if (!vendor) {
+            const own = POOL_VENDORS.filter((v) => next.atByVendor[v] !== undefined).map((v) => `${VENDOR_HARNESS[v]} ${next.atByVendor[v]}%`);
+            ok(`The pool moves to another login at ${next.at}% used.${own.length > 0 ? dim(` Still their own: ${own.join(", ")}.`) : ""}`);
+        }
+        else if (clear)
+            ok(`${VENDOR_NAMES[vendor]} logins move at the shared ${next.at}% again.`);
+        else
+            ok(`${VENDOR_NAMES[vendor]} logins move at ${thresholdFor(next, vendor)}% used. ${dim(`Everyone else at ${next.at}%.`)}`);
         return 0;
     }
     if (sub === "swap") {
@@ -710,7 +736,7 @@ async function poolCommand(argv) {
         const flags = manage.parseFlags(rest.slice(1));
         const memberName = flags.args[0];
         if (!vendor || !memberName) {
-            fail(`tab pool ${sub} claude|codex <name>${sub === "add" ? " [--dir <folder>]" : ""}`);
+            fail(`tab pool ${sub} ${HARNESSES} <name>${sub === "add" ? " [--dir <folder>] [--email <address>]" : ""}`);
             return 2;
         }
         if (sub !== "add") {
@@ -727,30 +753,44 @@ async function poolCommand(argv) {
             return 2;
         }
         const member = next.members[vendor].at(-1);
-        const loginOf = () => localLogin(vendor, vendor === "anthropic" ? { claudeConfigDir: member.dir } : { codexHome: path.join(member.dir, "codex") });
+        const loginOf = () => memberLogin(vendor, member);
+        const signedIn = async () => {
+            const l = await loginOf();
+            return Boolean(l?.email ?? l?.accountId);
+        };
         if (!flags.opts.dir && vendor === "anthropic")
             await prepareClaudeMember(member.dir);
-        if (vendor === "openai")
-            await mkdir(path.join(member.dir, "codex"), { recursive: true, mode: 0o700 });
-        if (!(await loginOf())?.email) {
-            const harness = vendor === "anthropic" ? "claude" : "codex";
-            say(dim(vendor === "anthropic" ? `Opening Claude Code in ${member.dir}. Sign in as the account for ${memberName} (/login), then /exit.` : `Signing Codex in for ${memberName}.`));
+        await mkdir(memberHome(vendor, member), { recursive: true, mode: 0o700 });
+        if (!flags.opts.dir)
+            await prepareSharedSessions(vendor, member);
+        if (!(await signedIn())) {
+            const harness = VENDOR_HARNESS[vendor];
+            // `claude auth login` does the browser sign-in and exits: no session to open, no /login, no /exit.
+            const email = flags.opts.email ?? (memberName.includes("@") ? memberName : undefined);
+            say(dim(`Signing ${harness} in for ${memberName}. Your browser opens; pick the account for this login.`));
             // Plain launch: no proxy, no tab key. This only creates the login, in the harness's own store.
             const loginEnv = { ...process.env, ...memberEnv(vendor, member), PATH: pathWithoutShims() };
-            for (const k of ["ANTHROPIC_BASE_URL", "ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "OPENAI_BASE_URL", "OPENAI_API_KEY"])
+            for (const k of ["ANTHROPIC_BASE_URL", "ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "OPENAI_BASE_URL", "OPENAI_API_KEY", "XAI_API_KEY", "GROK_XAI_API_BASE_URL", "KIMI_API_KEY", "KIMI_BASE_URL", "KIMI_CODE_BASE_URL"])
                 delete loginEnv[k];
-            const code = await new Promise((resolve) => {
-                const child = spawn(harness, vendor === "anthropic" ? [] : ["login"], { stdio: "inherit", env: loginEnv });
+            const run = (argv) => new Promise((resolve) => {
+                const child = spawn(harness, argv, { stdio: "inherit", env: loginEnv });
                 child.on("error", () => resolve(127));
                 child.on("close", (c) => resolve(c ?? 1));
             });
+            // Every one of them has its own sign-in command that opens the browser and exits.
+            let code = await run(vendor === "anthropic" ? ["auth", "login", "--claudeai", ...(email ? ["--email", email] : [])] : ["login"]);
+            if (vendor === "anthropic" && code !== 0 && code !== 127 && !(await signedIn())) {
+                // A Claude Code too old for `auth login`: sign in from inside it.
+                say(dim("That did not sign in. Opening Claude Code instead: /login as this account, then /exit."));
+                code = await run([]);
+            }
             if (code === 127) {
                 fail(`${harness} is not installed.`);
                 return 127;
             }
         }
         const login = await loginOf();
-        if (!login?.email) {
+        if (!(await signedIn())) {
             fail(`No login found in ${member.dir}. Nothing was added; run the same command again to retry.`);
             return 1;
         }
@@ -758,27 +798,22 @@ async function poolCommand(argv) {
         ok(`${bold(memberName)} is in the pool as ${describeLogin(login)}.`);
         return 0;
     }
-    if (sub && sub !== "list" && sub !== "ls") {
+    if (sub && sub !== "list" && sub !== "ls" && sub !== "--paths") {
         fail(`Unknown: tab pool ${sub}. ${dim("tab pool | add | remove | at | swap")}`);
         return 2;
     }
     const config = await ensureLogin();
     if (!config)
         return 2;
-    const vendors = ["anthropic", "openai"].filter((v) => (pool.members[v] ?? []).length > 0);
+    const vendors = POOL_VENDORS.filter((v) => (pool.members[v] ?? []).length > 0);
     if (vendors.length === 0) {
         say(dim(`No logins in the pool. ${bold("tab pool add claude work")} signs one in; then ${bold("tab claude")} runs as whichever has most room.`));
         return 0;
     }
-    for (const vendor of vendors) {
-        const standings = await poolStandings(config, vendor, pool.members[vendor]);
-        say(heading(vendor === "anthropic" ? "Claude" : "ChatGPT (Codex)"));
-        say(rows(standings.map((s) => [
-            s.member.name,
-            `${s.email ?? yellow("not signed in")}  ${s.used === undefined ? dim("not seen yet") : s.used >= pool.at ? yellow(`${Math.round(s.used)}% used`) : green(`${Math.round(s.used)}% used`)}  ${dim(s.member.dir)}`,
-        ]), 0));
-    }
-    say(dim(`Moves at ${pool.at}% used (${pool.swap === "auto" ? "also while running, when idle" : "at launch only"}). tab claude --as <name> pins one; --no-pool uses your usual login.`));
+    // One read of the accounts for every vendor.
+    const accounts = await flockAccounts(config).catch(() => []);
+    const sections = await Promise.all(vendors.map(async (vendor) => ({ vendor, title: VENDOR_NAMES[vendor], harness: VENDOR_HARNESS[vendor], at: thresholdFor(pool, vendor), standings: await poolStandings(config, vendor, pool.members[vendor], accounts) })));
+    say(renderPool(sections, { at: pool.at, swap: pool.swap, paths: argv.includes("--paths") }));
     return 0;
 }
 /**

package/dist/clients.js

@@ -128,7 +128,11 @@ export function envFor(input) {
                 delete env.XAI_API_KEY;
             }
             if (spec.provider === "moonshot") {
-                env.KIMI_BASE_URL = `${passthroughBase(input.proxyUrl, input.presentedKey, "kimi")}/coding/v1`;
+                // Kimi Code (the `~/.kimi-code` CLI) reads its plan endpoint from KIMI_CODE_BASE_URL;
+                // the older kimi-cli reads KIMI_BASE_URL. Its sign-in host is separate and untouched.
+                const kimiBase = `${passthroughBase(input.proxyUrl, input.presentedKey, "kimi")}/coding/v1`;
+                env.KIMI_CODE_BASE_URL = kimiBase;
+                env.KIMI_BASE_URL = kimiBase;
                 delete env.KIMI_API_KEY;
             }
             return;

package/dist/console-api.js

@@ -3,6 +3,7 @@
  * make one, key one. All three are `/api/cli/*` with `Bearer ft_cli_...`.
  * Injectable fetch so the folder picker is testable without a console.
  */
+import { requestJson } from "./network.js";
 export class ConsoleApiError extends Error {
     status;
     constructor(message, status) {
@@ -12,11 +13,10 @@ export class ConsoleApiError extends Error {
     }
 }
 async function call(consoleUrl, token, path, init, fetchImpl) {
-    const response = await fetchImpl(`${consoleUrl}${path}`, {
+    const { response, body } = await requestJson(`${consoleUrl}${path}`, {
         ...init,
         headers: { authorization: `Bearer ${token}`, "content-type": "application/json", ...(init.headers ?? {}) },
-    });
-    const body = (await response.json().catch(() => ({})));
+    }, fetchImpl);
     if (!response.ok) {
         const detail = body.error ?? `console answered ${response.status}`;
         throw new ConsoleApiError(body.hint ? `${detail} (${body.hint})` : detail, response.status);

package/dist/folder.js

@@ -1,4 +1,5 @@
 import { execFileSync } from "node:child_process";
+import { requestJson } from "./network.js";
 function parseGitRepo(remote) {
     const trimmed = remote.trim();
     const ssh = /^git@github\.com:([^/]+)\/(.+?)(?:\.git)?$/i.exec(trimmed);
@@ -34,14 +35,14 @@ export function gitRepoFromCwd(cwd) {
 export function reportFolder(proxyUrl, presentedKey) {
     const cwd = process.cwd();
     const git = gitRepoFromCwd(cwd);
-    void fetch(`${proxyUrl}/v1/here`, {
+    void requestJson(`${proxyUrl}/v1/here`, {
         method: "POST",
         headers: {
             authorization: `Bearer ${presentedKey}`,
             "content-type": "application/json",
         },
         body: JSON.stringify({ cwd, git }),
-    }).catch(() => {
+    }, fetch, 5_000).catch(() => {
         // The Agent still runs if this misses.
     });
 }

package/dist/logins.js

@@ -38,8 +38,8 @@ function jwtClaims(token) {
 /**
  * Claude Code keeps the signed-in account (not the token) in `~/.claude.json`
  * under `oauthAccount`; Codex keeps its ChatGPT login in `auth.json` under
- * the home it runs with. Grok Build and Kimi Code are asked nothing: their
- * accounts are read off the wire by the proxy.
+ * the home it runs with; Grok Build keeps email and id in `auth.json`; Kimi
+ * Code's account is the subject of its login token.
  */
 export async function localLogin(vendor, opts = {}) {
     const home = opts.home ?? homedir();
@@ -66,6 +66,29 @@ export async function localLogin(vendor, opts = {}) {
         const accountId = str(tokens.account_id) ?? str(authClaims?.chatgpt_account_id);
         return { ...(email ? { email } : {}), ...(plan ? { plan } : {}), ...(accountId ? { accountId } : {}) };
     }
+    if (vendor === "xai") {
+        // Grok Build: `auth.json` is one entry per issuer, with the account's email and id beside the token.
+        const auth = await jsonFile(path.join(opts.grokHome ?? path.join(home, ".grok"), "auth.json"));
+        const entry = Object.values(auth ?? {}).find((v) => Boolean(v) && typeof v === "object");
+        if (!entry)
+            return undefined;
+        const email = str(entry.email);
+        const accountId = str(entry.user_id);
+        return email || accountId ? { ...(email ? { email } : {}), ...(accountId ? { accountId } : {}) } : undefined;
+    }
+    if (vendor === "kimi") {
+        // Kimi Code names no email; the login token's subject is the account the proxy files calls under.
+        // Kimi Code keeps its home in `~/.kimi-code`, the older kimi-cli in `~/.kimi`; same file inside.
+        const homes = opts.kimiShareDir ? [opts.kimiShareDir] : [path.join(home, ".kimi-code"), path.join(home, ".kimi")];
+        let cred;
+        for (const dir of homes) {
+            cred = await jsonFile(path.join(dir, "credentials", "kimi-code.json"));
+            if (cred)
+                break;
+        }
+        const accountId = str(jwtClaims(cred?.access_token)?.sub);
+        return accountId ? { accountId } : undefined;
+    }
     return undefined;
 }
 /** "me@x.com (Claude Max 20x)" or nothing worth saying. */

package/dist/manage.js

@@ -8,6 +8,7 @@ import { spawn } from "node:child_process";
 import { readProject } from "./project.js";
 import { saveConfig } from "./config.js";
 import { ConsoleApiError } from "./console-api.js";
+import { requestJson, watch } from "./network.js";
 import { bold, dim, green, money, red, rows, table, yellow } from "./ui.js";
 export class ManageError extends Error {
 }
@@ -17,13 +18,13 @@ export function api(config, fetchImpl = fetch) {
     const token = config.token;
     if (!base || !token)
         throw new ManageError("This machine is not logged in. Run tab login.");
-    return async (method, path, body) => {
-        const res = await fetchImpl(`${base}${path}`, {
+    return async (method, path, body, signal) => {
+        const { response: res, body: json } = await requestJson(`${base}${path}`, {
             method,
+            ...(signal ? { signal } : {}),
             headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
             ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
-        });
-        const json = (await res.json().catch(() => ({})));
+        }, fetchImpl);
         if (!res.ok) {
             const detail = json.error ?? `console answered ${res.status}`;
             throw new ConsoleApiError(res.status === 401 ? "Session expired. Run tab login." : json.hint ? `${detail} (${json.hint})` : detail, res.status);
@@ -65,13 +66,13 @@ async function tabsOf(call) {
 }
 /** Slug or name (case-insensitive); omitted means this folder's Agent. */
 export async function resolveSlug(call, given, cwd = process.cwd()) {
-    const tabs = await tabsOf(call);
     if (!given) {
         const project = await readProject(cwd);
         if (!project)
             throw new ManageError("No Agent named and this folder has none yet (tab use), so say which: tab <command> <agent>.");
         return project.agent;
     }
+    const tabs = await tabsOf(call);
     const want = given.trim().toLowerCase();
     const hit = tabs.find((t) => t.slug.toLowerCase() === want) ?? tabs.find((t) => t.name.toLowerCase() === want);
     if (!hit)
@@ -310,48 +311,79 @@ export function logLine(r) {
  * machine, one condensed line per call, hosted or self-hosted alike because
  * it is the ledger's own record. `-f` follows it; `--all` is the whole flock.
  */
-export async function log(config, flags, follow) {
+export async function log(config, flags, follow, signal) {
     const call = api(config);
-    const limit = Math.min(500, Math.max(1, Number(flags.opts.lines ?? 30) || 30));
-    const mine = new Set(Object.values(config.agents ?? {}).map((a) => a.agentName.toLowerCase()));
-    const wanted = (r) => flags.opts.all !== undefined || mine.size === 0 || mine.has(r.agent.toLowerCase());
-    const fetchRows = async () => (await call("GET", `/api/cli/ledger?limit=${flags.opts.all !== undefined ? limit : limit * 4}`)).rows.filter(wanted).slice(0, limit);
-    const first = await fetchRows();
+    const limit = Math.min(500, Math.max(1, Math.floor(Number(flags.opts.lines ?? 30) || 30)));
+    const mine = [...new Set(Object.values(config.agents ?? {}).map((a) => a.agentId).filter(Boolean))].sort();
+    const all = flags.opts.all !== undefined;
+    if (!all && mine.length > 200)
+        throw new ManageError("This machine has more than 200 Agents. Use tab ledger <agent>, or --all explicitly for the flock.");
+    if (!all && mine.length === 0) {
+        out(flags.json ? JSON.stringify({ rows: [] }) : dim("No Agent IDs saved on this machine. Run tab use, or add --all for the flock."));
+        return 0;
+    }
+    const params = new URLSearchParams({ limit: String(limit) });
+    if (!all)
+        for (const id of mine)
+            params.append("agentId", id);
+    if (follow)
+        params.set("incremental", "1");
+    let cursor;
+    const fetchPage = async (requestSignal) => {
+        const query = new URLSearchParams(params);
+        if (cursor)
+            query.set("cursor", cursor);
+        const page = await call("GET", `/api/cli/ledger?${query}`, undefined, requestSignal);
+        if (follow && !page.cursor)
+            throw new ManageError("The console does not support incremental logs yet. Use tab ledger until it is updated.");
+        if (page.hasMore && page.cursor === cursor)
+            throw new ManageError("The ledger cursor did not advance.");
+        cursor = page.cursor;
+        return page;
+    };
+    const first = (await fetchPage(signal)).rows;
     if (flags.json && !follow) {
         out(JSON.stringify({ rows: first }, null, 2));
         return 0;
     }
     if (first.length === 0 && !follow)
         out(dim("Nothing yet. Run tab claude or tab codex in a project folder."));
-    const seen = new Set();
-    for (const r of [...first].reverse()) {
-        seen.add(r.id);
-        out(flags.json ? JSON.stringify(r) : logLine(r));
-    }
+    const seen = new Map();
+    const print = (r) => {
+        const fingerprint = JSON.stringify(r);
+        if (seen.get(r.id) === fingerprint)
+            return;
+        seen.delete(r.id);
+        seen.set(r.id, fingerprint);
+        if (seen.size > 2_000)
+            seen.delete(seen.keys().next().value);
+        out(flags.json ? fingerprint : logLine(r));
+    };
+    for (const r of [...first].reverse())
+        print(r);
     if (!follow)
         return 0;
-    for (;;) {
-        await new Promise((resolve) => setTimeout(resolve, 2000));
-        let rows;
+    await watch(async (requestSignal) => {
+        const bootstrap = !cursor;
         try {
-            rows = await fetchRows();
-        }
-        catch {
-            continue;
+            const page = await fetchPage(requestSignal);
+            for (const row of bootstrap ? [...page.rows].reverse() : page.rows)
+                print(row);
+            return page.hasMore === true;
         }
-        for (const r of [...rows].reverse()) {
-            if (seen.has(r.id))
-                continue;
-            seen.add(r.id);
-            out(flags.json ? JSON.stringify(r) : logLine(r));
+        catch (error) {
+            if (error instanceof ConsoleApiError && error.status === 400)
+                cursor = undefined;
+            throw error;
         }
-    }
+    }, 2_000, { ...(signal ? { signal } : {}), onError: (error) => console.error(dim(error instanceof Error ? error.message : String(error))) });
+    return 0;
 }
 export async function ledger(config, flags) {
     const call = api(config);
     const params = new URLSearchParams();
     if (flags.args[0])
-        params.set("agent", await resolveSlug(call, flags.args[0]));
+        params.set("agent", flags.args[0].trim());
     if (flags.opts.limit)
         params.set("limit", flags.opts.limit);
     if (flags.opts.blocked !== undefined)
@@ -408,34 +440,25 @@ export async function outside(config, flags) {
     });
     return 0;
 }
-export async function live(config, flags) {
+export async function live(config, flags, signal) {
     const call = api(config);
-    const once = async () => {
-        const feed = await call("GET", "/api/cli/live");
+    const once = async (requestSignal) => {
+        const feed = await call("GET", flags.json ? "/api/cli/live" : "/api/cli/live?view=summary", undefined, requestSignal);
         emit(flags.json, feed, () => `${dim("active")} ${feed.totals.active}  ${dim("calls/min")} ${feed.totals.callsPerMinute}  ${dim("blocked 5m")} ${feed.totals.blocked}  ${dim("spend 5m")} ${money(feed.totals.windowCents)}\n` +
             table(["agent", "pulse", "calls/min", "blocked", "5m", "last"], feed.agents.map((a) => [a.slug, a.pulse, String(a.callsPerMinute), String(a.blocked), money(a.windowCents), a.lastDecision ? `${a.lastDecision.toLowerCase()} ${dim(a.lastReason ?? "")}` : dim("-")]), { right: [2, 3, 4] }));
     };
-    await once();
+    await once(signal);
     if (flags.opts.watch === undefined)
         return 0;
-    const every = Math.max(2, Number(flags.opts.watch) || 4) * 1000;
-    await new Promise((resolve) => {
-        const timer = setInterval(() => {
-            out("");
-            once().catch((err) => out(red(String(err instanceof Error ? err.message : err))));
-        }, every);
-        process.on("SIGINT", () => {
-            clearInterval(timer);
-            resolve();
-        });
-    });
+    const every = Math.min(60, Math.max(2, Number(flags.opts.watch) || 4)) * 1000;
+    await watch(once, every, { ...(signal ? { signal } : {}), onError: (error) => console.error(red(error instanceof Error ? error.message : String(error))) });
     return 0;
 }
 /** `tab web [agent]`: this folder's Agent in the console. */
 export async function web(config, flags) {
     const call = api(config);
-    const slug = flags.args[0] || (await readProject(process.cwd()))?.agent;
-    const url = slug ? `${config.consoleUrl}/console/tabs/${encodeURIComponent(await resolveSlug(call, slug))}` : `${config.consoleUrl}/console`;
+    const slug = flags.args[0] ? await resolveSlug(call, flags.args[0]) : (await readProject(process.cwd()))?.agent;
+    const url = slug ? `${config.consoleUrl}/console/tabs/${encodeURIComponent(slug)}` : `${config.consoleUrl}/console`;
     const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
     const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
     try {

package/dist/network.js

@@ -0,0 +1,78 @@
+function pause(ms, signal) {
+    signal.throwIfAborted();
+    return new Promise((resolve, reject) => {
+        const aborted = () => {
+            clearTimeout(timer);
+            reject(signal.reason);
+        };
+        const timer = setTimeout(() => {
+            signal.removeEventListener("abort", aborted);
+            resolve();
+        }, ms);
+        signal.addEventListener("abort", aborted, { once: true });
+    });
+}
+/** Use Node's shared fetch pool; bound both headers and body, including cancellation. */
+export async function requestJson(url, init = {}, fetchImpl = fetch, timeoutMs = 15_000) {
+    const controller = new AbortController();
+    const signal = init.signal
+        ? AbortSignal.any([init.signal, controller.signal])
+        : controller.signal;
+    signal.throwIfAborted();
+    const timer = setTimeout(() => controller.abort(new DOMException("Console request timed out", "TimeoutError")), timeoutMs);
+    let onAbort;
+    const cancelled = new Promise((_resolve, reject) => {
+        onAbort = () => reject(signal.reason);
+        signal.addEventListener("abort", onAbort, { once: true });
+    });
+    try {
+        return await Promise.race([
+            (async () => {
+                const response = await fetchImpl(url, { ...init, signal });
+                const body = (await response.json().catch(() => ({})));
+                return { response, body };
+            })(),
+            cancelled,
+        ]);
+    }
+    finally {
+        clearTimeout(timer);
+        signal.removeEventListener("abort", onAbort);
+    }
+}
+/** Completion-based watch loop. A true result drains the next cursor page immediately. */
+export async function watch(task, intervalMs, options = {}) {
+    const controller = new AbortController();
+    const signal = options.signal ?? controller.signal;
+    const stop = () => controller.abort();
+    if (!options.signal) {
+        process.once("SIGINT", stop);
+        process.once("SIGTERM", stop);
+    }
+    let delay = intervalMs;
+    try {
+        while (!signal.aborted) {
+            await pause(delay, signal);
+            try {
+                const more = await task(signal);
+                delay = more ? 0 : intervalMs;
+            }
+            catch (error) {
+                if (signal.aborted)
+                    break;
+                options.onError?.(error);
+                delay = Math.min(Math.max(delay, intervalMs) * 2, 60_000);
+            }
+        }
+    }
+    catch (error) {
+        if (!signal.aborted)
+            throw error;
+    }
+    finally {
+        if (!options.signal) {
+            process.removeListener("SIGINT", stop);
+            process.removeListener("SIGTERM", stop);
+        }
+    }
+}

package/dist/pool-view.js

@@ -0,0 +1,88 @@
+/**
+ * `tab pool`, drawn: one table per vendor. Who each login is, its plan, how
+ * used the vendor last said it is (a bar, then each window with when it
+ * resets), and an arrow on the login the next launch would run as.
+ */
+import { pickMember } from "./pool.js";
+import { bold, dim, green, red, table, width, yellow } from "./ui.js";
+const BAR = 10;
+/** "2h 10m", "3d 4h", "12m": how long until a window resets. */
+export function until(resetsAt, now) {
+    if (!resetsAt)
+        return undefined;
+    const ms = new Date(resetsAt).getTime() - now.getTime();
+    if (!Number.isFinite(ms) || ms <= 0)
+        return undefined;
+    const minutes = Math.round(ms / 60_000);
+    if (minutes < 60)
+        return `${Math.max(1, minutes)}m`;
+    const hours = Math.floor(minutes / 60);
+    if (hours < 24)
+        return `${hours}h ${String(minutes % 60).padStart(2, "0")}m`;
+    return `${Math.floor(hours / 24)}d ${hours % 24}h`;
+}
+function paint(pct, at) {
+    return pct >= at ? red : pct >= at * 0.75 ? yellow : green;
+}
+export function usageBar(pct, at) {
+    if (pct === undefined)
+        return dim("·".repeat(BAR));
+    const filled = Math.min(BAR, Math.max(0, Math.round((pct / 100) * BAR)));
+    return `${paint(pct, at)("█".repeat(filled))}${dim("░".repeat(BAR - filled))}`;
+}
+/** `5h` before `7d`: the window that bites soonest comes first. */
+function minutes(window) {
+    const m = /^(\d+)([mhd])$/.exec(window);
+    return m ? Number(m[1]) * (m[2] === "d" ? 1440 : m[2] === "h" ? 60 : 1) : Number.MAX_SAFE_INTEGER;
+}
+/** "claude max 20x" and "pro" as the harness files spell them, in the vendor's capitals. */
+export function planName(plan) {
+    if (!plan)
+        return undefined;
+    return plan.replace(/\b[a-z]/g, (c) => c.toUpperCase()).replace(/\b(\d+)X\b/g, "$1x");
+}
+function windowsLine(windows, at, now) {
+    const live = [...(windows ?? [])].sort((a, b) => minutes(a.window) - minutes(b.window)).filter((w) => !w.resetsAt || new Date(w.resetsAt).getTime() > now.getTime());
+    if (!windows || windows.length === 0)
+        return dim("no call through FlockTab yet");
+    if (live.length === 0)
+        return dim("every window has reset");
+    return live
+        .map((w) => {
+        const left = until(w.resetsAt, now);
+        return `${w.window} ${paint(w.usedPct, at)(`${Math.round(w.usedPct)}%`)}${left ? dim(` resets in ${left}`) : ""}`;
+    })
+        .join(dim("  ·  "));
+}
+export function renderPool(sections, opts) {
+    const now = opts.now ?? new Date();
+    const out = [];
+    // One width for the login and plan columns, so the vendors line up under each other.
+    const whoOf = (s) => (s.email && s.email !== s.member.name ? `${s.member.name} ${dim(`(${s.email})`)}` : s.member.name);
+    const all = sections.flatMap((x) => x.standings);
+    const loginWidth = Math.max(5, ...all.map((s) => width(s.email ? whoOf(s) : `${whoOf(s)} not signed in`)));
+    const planWidth = Math.max(4, ...all.map((s) => width(planName(s.plan) ?? "-")));
+    for (const section of sections) {
+        const at = section.at ?? opts.at;
+        const next = pickMember(section.standings, at)?.member.name;
+        const over = section.standings.filter((s) => (s.used ?? 0) >= at).length;
+        const count = `${section.standings.length} ${section.standings.length === 1 ? "login" : "logins"}`;
+        out.push(`${bold(section.title)}  ${dim(`${count} · moves at ${at}%${over > 0 ? ` · ${over} over` : ""} · tab ${section.harness}`)}`);
+        out.push(table(["", "login".padEnd(loginWidth), "plan".padEnd(planWidth), "used", "", "windows", ...(opts.paths ? ["folder"] : [])], section.standings.map((s) => {
+            const who = whoOf(s);
+            return [
+                s.member.name === next ? green("→") : " ",
+                s.email ? who : `${who} ${yellow("not signed in")}`,
+                planName(s.plan) ?? dim("-"),
+                usageBar(s.used, at),
+                s.used === undefined ? dim("   -") : paint(s.used, at)(`${String(Math.round(s.used)).padStart(3)}%`),
+                windowsLine(s.windows, at, now),
+                ...(opts.paths ? [dim(s.member.dir)] : []),
+            ];
+        }), { indent: 1 }));
+        out.push("");
+    }
+    out.push(dim(`${green("→")} runs next. A login over its vendor's threshold gives way to the one with most room${opts.swap === "auto" ? ", also while running when idle" : ", at launch only"}.`));
+    out.push(dim("--as <login> pins one · --no-pool uses your usual login · tab pool at [claude|codex|grok|kimi] <percent> · --paths shows folders"));
+    return out.join("\n");
+}

package/dist/pool.js

@@ -12,6 +12,7 @@ import { chmod, mkdir, readdir, readFile, symlink, writeFile, lstat } from "node
 import { homedir } from "node:os";
 import path from "node:path";
 import { configDir } from "./config.js";
+export const POOL_VENDORS = ["anthropic", "openai", "xai", "kimi"];
 export const DEFAULT_AT = 80;
 export function poolPath(env = process.env) {
     return path.join(configDir(env), "pool.json");
@@ -21,20 +22,29 @@ export function poolVendorFor(harness) {
         return "anthropic";
     if (harness === "codex")
         return "openai";
+    if (harness === "grok")
+        return "xai";
+    if (harness === "kimi")
+        return "kimi";
     return undefined;
 }
 export async function loadPool(env = process.env) {
-    const empty = { at: DEFAULT_AT, swap: "auto", members: {} };
+    const empty = { at: DEFAULT_AT, atByVendor: {}, swap: "auto", members: {} };
     try {
         const raw = JSON.parse(await readFile(poolPath(env), "utf8"));
-        const at = typeof raw.at === "number" && raw.at >= 1 && raw.at <= 100 ? raw.at : DEFAULT_AT;
+        const valid = (n) => typeof n === "number" && n >= 1 && n <= 100;
+        const at = valid(raw.at) ? raw.at : DEFAULT_AT;
         const members = {};
-        for (const vendor of ["anthropic", "openai"]) {
+        const atByVendor = {};
+        for (const vendor of POOL_VENDORS) {
+            const own = raw.atByVendor?.[vendor];
+            if (valid(own))
+                atByVendor[vendor] = own;
             const list = raw.members?.[vendor];
             if (Array.isArray(list))
                 members[vendor] = list.filter((m) => typeof m?.name === "string" && typeof m?.dir === "string").map((m) => ({ name: m.name, dir: m.dir }));
         }
-        return { at, swap: raw.swap === "launch" ? "launch" : "auto", members };
+        return { at, atByVendor, swap: raw.swap === "launch" ? "launch" : "auto", members };
     }
     catch {
         return empty;
@@ -47,6 +57,26 @@ export async function savePool(pool, env = process.env) {
     await chmod(file, 0o600);
     return file;
 }
+/** The threshold one vendor's logins move at: its own, else the shared one. */
+export function thresholdFor(pool, vendor) {
+    return pool.atByVendor[vendor] ?? pool.at;
+}
+/** Set the shared threshold, or one vendor's; `undefined` for a vendor clears its override. */
+export function setThreshold(pool, pct, vendor) {
+    if (pct !== undefined && (!Number.isFinite(pct) || pct < 1 || pct > 100))
+        throw new Error("A threshold is a percent from 1 to 100.");
+    if (!vendor) {
+        if (pct === undefined)
+            throw new Error("A threshold is a percent from 1 to 100.");
+        return { ...pool, at: Math.round(pct) };
+    }
+    const atByVendor = { ...pool.atByVendor };
+    if (pct === undefined)
+        delete atByVendor[vendor];
+    else
+        atByVendor[vendor] = Math.round(pct);
+    return { ...pool, atByVendor };
+}
 export function addMember(pool, vendor, name, dir, env = process.env) {
     if (!/^[A-Za-z0-9][A-Za-z0-9._@-]{0,63}$/.test(name))
         throw new Error("A member name is letters, digits, dot, dash, underscore or @, up to 64.");
@@ -59,9 +89,39 @@ export function addMember(pool, vendor, name, dir, env = process.env) {
 export function removeMember(pool, vendor, name) {
     return { ...pool, members: { ...pool.members, [vendor]: (pool.members[vendor] ?? []).filter((m) => m.name !== name) } };
 }
-/** The env that makes a harness use this member's login folder. */
+/** The folder the harness itself treats as home for this member. */
+export function memberHome(vendor, member) {
+    return vendor === "openai" ? path.join(member.dir, "codex") : member.dir;
+}
+/** The env that makes a harness use this member's login folder. Each name is the harness's own. */
 export function memberEnv(vendor, member) {
-    return vendor === "anthropic" ? { CLAUDE_CONFIG_DIR: member.dir } : { CODEX_HOME: path.join(member.dir, "codex") };
+    const home = memberHome(vendor, member);
+    if (vendor === "anthropic")
+        return { CLAUDE_CONFIG_DIR: home };
+    if (vendor === "openai")
+        return { CODEX_HOME: home };
+    if (vendor === "xai")
+        return { GROK_HOME: home };
+    // Two CLIs answer to `kimi`: Kimi Code reads KIMI_CODE_HOME, the older kimi-cli KIMI_SHARE_DIR.
+    return { KIMI_CODE_HOME: home, KIMI_SHARE_DIR: home };
+}
+/**
+ * Codex, Grok Build and Kimi Code keep conversations in `sessions` inside
+ * their home. Members of one vendor link that to one shared folder, so the
+ * login that takes over finds the conversation the other was in. A home
+ * that already has its own `sessions` is left as it is.
+ */
+export async function prepareSharedSessions(vendor, member, env = process.env) {
+    if (vendor === "anthropic")
+        return;
+    const home = memberHome(vendor, member);
+    const link = path.join(home, "sessions");
+    if (await lstat(link).then(() => true, () => false))
+        return;
+    const shared = path.join(configDir(env), "pool", vendor, ".shared", "sessions");
+    await mkdir(shared, { recursive: true, mode: 0o700 });
+    await mkdir(home, { recursive: true, mode: 0o700 });
+    await symlink(shared, link);
 }
 /** How used an account is: its fullest window that has not reset yet. */
 export function usedPct(quota, now = new Date()) {
@@ -95,7 +155,7 @@ export function relaunchArgs(harness, args) {
     const kept = [];
     for (let i = 0; i < args.length; i += 1) {
         const a = args[i];
-        if (a === "--continue" || a === "-c")
+        if (a === "--continue" || a === "-c" || a === "-C")
             continue;
         // One-shot and resume arguments belong to the first launch only.
         if (a === "--resume" || a === "-r" || a === "-p" || a === "--print") {

package/dist/project.js

@@ -8,6 +8,14 @@
 import { access, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
 export const PROJECT_FILE = ".flocktab";
+/**
+ * The file's name. `tabdev` sets `FLOCKTAB_PROJECT_FILE=.flocktabdev` so a
+ * checkout under test never rewrites the folder's real `.flocktab`.
+ */
+export function projectFileName(env = process.env) {
+    const name = env.FLOCKTAB_PROJECT_FILE?.trim();
+    return name && /^\.[A-Za-z0-9._-]{1,40}$/.test(name) ? name : PROJECT_FILE;
+}
 async function exists(file) {
     try {
         await access(file);
@@ -21,7 +29,7 @@ async function exists(file) {
 export async function findProjectFile(cwd) {
     let dir = path.resolve(cwd);
     for (;;) {
-        const candidate = path.join(dir, PROJECT_FILE);
+        const candidate = path.join(dir, projectFileName());
         if (await exists(candidate))
             return candidate;
         if (await exists(path.join(dir, ".git")))
@@ -60,7 +68,7 @@ export async function projectRoot(cwd) {
     }
 }
 export async function writeProject(dir, config) {
-    const file = path.join(dir, PROJECT_FILE);
+    const file = path.join(dir, projectFileName());
     await writeFile(file, `${JSON.stringify(config)}\n`);
     return file;
 }

package/dist/proxy-bin.js

@@ -13,7 +13,7 @@ import { createRequire } from "node:module";
 import path from "node:path";
 import { configDir } from "./config.js";
 /** The proxy release `tab up` fetches. Bump with each proxy tag. */
-export const PROXY_VERSION = "0.1.7";
+export const PROXY_VERSION = "0.1.8";
 export const RELEASES = "https://github.com/joseairosa/flocktab/releases/download";
 export function targetFor(platform = process.platform, arch = process.arch) {
     if (platform === "darwin")

package/dist/proxy-identity.js

@@ -0,0 +1,32 @@
+import { presentedKey } from "./config.js";
+import { requestJson } from "./network.js";
+/** A fresh authenticated identity also proves the hosted proxy is ready for this Agent. */
+export async function whoami(proxyUrl, login, fetchImpl = fetch) {
+    try {
+        const { response, body } = await requestJson(`${proxyUrl}/v1/whoami`, {
+            headers: { authorization: `Bearer ${presentedKey(login)}` },
+        }, fetchImpl);
+        if (!response.ok)
+            return {
+                error: body.error?.message ?? `whoami returned ${response.status}`,
+            };
+        if (!body.agent?.id ||
+            typeof body.agent.name !== "string" ||
+            typeof body.flock?.plan !== "string" ||
+            typeof body.byok !== "boolean") {
+            return { error: "proxy returned an invalid identity" };
+        }
+        if (body.kind !== undefined &&
+            body.kind !== "api" &&
+            body.kind !== "subscription")
+            return { error: "proxy returned an invalid Agent kind" };
+        return body;
+    }
+    catch (error) {
+        return {
+            error: error instanceof DOMException && error.name === "TimeoutError"
+                ? "proxy timed out"
+                : "proxy unreachable",
+        };
+    }
+}

package/dist/version.js

@@ -1,2 +1,2 @@
 /** Written by scripts/write-version.mjs from package.json at build; `tab version` prints it. */
-export const TAB_VERSION = "0.1.10";
+export const TAB_VERSION = "0.1.12";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hanamorilabs/tab",
-  "version": "0.1.10",
+  "version": "0.1.12",
   "description": "Run any AI agent on a FlockTab tab: tab claude, tab codex, tab <command>.",
   "license": "MIT",
   "type": "module",
@@ -22,11 +22,11 @@
     "prepublishOnly": "pnpm build"
   },
   "optionalDependencies": {
-    "@hanamorilabs/flocktab-proxy-darwin-arm64": "0.1.7",
-    "@hanamorilabs/flocktab-proxy-darwin-x64": "0.1.7",
-    "@hanamorilabs/flocktab-proxy-linux-x64": "0.1.7",
-    "@hanamorilabs/flocktab-proxy-linux-arm64": "0.1.7",
-    "@hanamorilabs/flocktab-proxy-win-x64": "0.1.7"
+    "@hanamorilabs/flocktab-proxy-darwin-arm64": "0.1.8",
+    "@hanamorilabs/flocktab-proxy-darwin-x64": "0.1.8",
+    "@hanamorilabs/flocktab-proxy-linux-x64": "0.1.8",
+    "@hanamorilabs/flocktab-proxy-linux-arm64": "0.1.8",
+    "@hanamorilabs/flocktab-proxy-win-x64": "0.1.8"
   },
   "devDependencies": {
     "@types/node": "^22.18.6",