@khorsheed/dsh-local-agent-claude-code 0.2.0-rc.1 → 0.2.0-rc.3

package/lib/index.js

@@ -1,87 +1,297 @@
 import z from "@deepseek-ai/schemastery";
-import { LIVE_FLUSH_INTERVAL_MS, LiveFlush, LiveStreamPublisher, ModelDirectoryCache, assertResumeCwdUnchanged, assertResumeScopeUnchanged, containerExecSpawn, containerScopedHome, delegationEnv, establishSubagentCatalogChild, extendModelDirectory, modelDirectoryContextKey, persistChildSession, probeCliVersion, resolveChildCwd, resolveRoundModel, settingsFace, subagentDelegationLabel, vol } from "@khorsheed/dsh-local-agent";
+import { LIVE_FLUSH_INTERVAL_MS, LiveFlush, LiveStreamPublisher, ModelDirectoryCache, assertResumeCwdUnchanged, assertResumeScopeUnchanged, containerExecSpawn, containerScopedHome, delegationEnv, establishSubagentCatalogChild, extendModelDirectory, firstModelOf, modelDirectoryContextKey, persistChildSession, probeCliVersion, readModelList, readModelListSync, resolveChildCwd, resolveRoundModel, settingsFace, subagentDelegationLabel, vol, writeModelList } from "@khorsheed/dsh-local-agent";
 import { MEMBER_BRIDGE_SOCKET_ENV, MEMBER_BRIDGE_TOKEN_ENV, endpointHost } from "@khorsheed/dsh-local-agent/types";
-import { createHash, randomUUID } from "node:crypto";
+import { randomUUID } from "node:crypto";
 import { createAssistantMessage, createToolResultMessage, createUserMessage } from "@deepseek-ai/dsh-llm";
 import { SessionId } from "@deepseek-ai/dsh-session";
-import { NO_START_CAPABILITIES, settleRunResult, subprocessRunHandle } from "@deepseek-ai/dsh-subagent";
-import { dirname, join } from "node:path";
-import { StringDecoder } from "node:string_decoder";
-import { execFile } from "node:child_process";
+import { NO_START_CAPABILITIES, SUBAGENT_DESCRIPTOR_VERSION, settleRunResult, subprocessRunHandle } from "@deepseek-ai/dsh-subagent";
+import { join } from "node:path";
 import { mkdir, open, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
-import { promisify } from "node:util";
-//#region lib/types/control-requests.js
-/** Bounded, correlated Claude stream-json controls, shared by discovery and live sessions. */
-var ClaudeControlRequests = class {
-	send;
-	timeoutMs;
-	sequence = 0;
-	closed = false;
-	pending = /* @__PURE__ */ new Map();
-	constructor(send, timeoutMs = 5e3) {
-		this.send = send;
-		this.timeoutMs = timeoutMs;
+import { StringDecoder } from "node:string_decoder";
+//#region lib/types/endpoint-auth.js
+/**
+* Endpoint-key authentication — the claude-code harness's ONLY auth mode.
+* There is no OAuth anywhere in this package: a delegation round reaches its
+* endpoint with `ANTHROPIC_BASE_URL` plus `ANTHROPIC_API_KEY` (x-api-key) or
+* `ANTHROPIC_AUTH_TOKEN` (Authorization: Bearer), exactly the environment a
+* shell would export for a proxy relay, and `claude -p` needs nothing else
+* (verified against claude 2.1.296: a fresh scoped home with only these
+* variables runs a round and scaffolds `.claude.json` itself — no onboarding
+* or key-approval gate in headless mode).
+*
+* Two layers, merged per field, file over config:
+*
+* - `<scopedHome>/endpoint-auth.json` (mode 0600) — the per-scope credential.
+*   Its name deliberately matches the eval contract hash's credential denylist
+*   (`auth`), so the key material never enters an evaluation's condition
+*   fingerprint; the file's mtime serves as the credential stamp, which makes
+*   "edit the file" the recovery gesture for a `rejected` grade.
+* - The plugin config's `baseUrl` / `apiKey` / `authToken` — the deployment
+*   default every scope without a file shares. Read PER ROUND from the
+*   apply-time snapshot, so a profile edit applies to the next round (and a
+*   host restart clears the in-memory `rejected` mark).
+*
+* The env layer this module emits rides the family's existing plumbing:
+* `delegationEnv` on the host, and `containerExecSpawn`'s name-only `-e`
+* forwarding into a container (the value travels in the docker client's
+* environment, never on an argv). A containerized round therefore
+* authenticates with the same credential as the host — nothing is authorized
+* inside the unit, which is the point.
+* @module @khorsheed/dsh-local-agent-claude-code/endpoint-auth
+*/
+/**
+* The scoped-home credential file's name. Chosen to match the eval contract
+* hash's credential-shaped denylist (`/token|key|credential|secret|password|auth|\.env/i`),
+* so the file is excluded from condition fingerprints by name.
+*/
+const ENDPOINT_AUTH_FILE = "endpoint-auth.json";
+/** Trim and normalize one credential field; blank reads as absent. */
+function field(value) {
+	if (typeof value !== "string") return void 0;
+	const trimmed = value.trim();
+	return trimmed === "" ? void 0 : trimmed;
+}
+/** Whether a resolved endpoint carries a usable credential. */
+function hasEndpointCredential(auth) {
+	return auth !== void 0 && (field(auth.apiKey) !== void 0 || field(auth.authToken) !== void 0);
+}
+/**
+* Read the scope's endpoint-auth.json. Absent or unreadable yields undefined
+* (the caller falls back to the plugin config); malformed JSON or a non-object
+* payload also yields undefined — a torn file must not fail a status read.
+* Non-string fields are dropped, never carried through.
+* @param homeDir - the `claude-code` harness's scoped home.
+* @returns the file's endpoint credential, or undefined.
+*/
+async function readEndpointAuthFile(homeDir) {
+	let text;
+	try {
+		text = await readFile(join(homeDir, ENDPOINT_AUTH_FILE), "utf8");
+	} catch {
+		return;
 	}
-	accept(event) {
-		if (event["type"] !== "control_response") return false;
-		const response = event["response"];
-		const id = response?.["request_id"];
-		if (typeof id !== "string") return true;
-		const pending = this.pending.get(id);
-		if (pending === void 0) return true;
-		if (response?.["subtype"] !== "success") pending.reject(new Error(typeof response?.["error"] === "string" ? response["error"] : "Claude rejected the control request"));
-		else {
-			const result = response["response"];
-			pending.resolve(typeof result === "object" && result !== null ? result : {});
-		}
-		return true;
+	try {
+		const parsed = JSON.parse(text);
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return void 0;
+		const baseUrl = field(parsed["baseUrl"]);
+		const apiKey = field(parsed["apiKey"]);
+		const authToken = field(parsed["authToken"]);
+		return {
+			...baseUrl === void 0 ? {} : { baseUrl },
+			...apiKey === void 0 ? {} : { apiKey },
+			...authToken === void 0 ? {} : { authToken }
+		};
+	} catch {
+		return;
 	}
-	request(request, signal) {
-		if (this.closed || signal?.aborted) return Promise.reject(/* @__PURE__ */ new Error("Claude control channel is closed"));
-		const id = `dsh-control-${++this.sequence}`;
-		return new Promise((resolve, reject) => {
-			const finish = () => {
-				this.pending.delete(id);
-				clearTimeout(timer);
-				signal?.removeEventListener("abort", abort);
-			};
-			const fail = (error) => {
-				finish();
-				reject(error);
-			};
-			const abort = () => {
-				fail(/* @__PURE__ */ new Error("Claude control request cancelled"));
-			};
-			const timer = setTimeout(() => fail(/* @__PURE__ */ new Error(`Claude ${String(request["subtype"])} control timed out`)), this.timeoutMs);
-			timer.unref();
-			this.pending.set(id, {
-				resolve: (value) => {
-					finish();
-					resolve(value);
-				},
-				reject: fail
-			});
-			signal?.addEventListener("abort", abort, { once: true });
-			try {
-				this.send({
-					type: "control_request",
-					request_id: id,
-					request
-				});
-			} catch (error) {
-				fail(error instanceof Error ? error : /* @__PURE__ */ new Error("Claude control write failed"));
-			}
+}
+/**
+* Resolve one scope's effective endpoint credential: the scope's
+* endpoint-auth.json merged FIELD BY FIELD over the plugin config's
+* `baseUrl` / `apiKey` / `authToken` (a file that names only a key rotates
+* the key while keeping the deployment's relay URL). The result may carry no
+* credential at all — {@link hasEndpointCredential} is the judgment, kept
+* separate so the caller can still route/log the resolved baseUrl.
+* @param homeDir - the scope's scoped home.
+* @param config - the plugin config's deployment-level endpoint triple.
+* @returns the merged endpoint auth.
+*/
+async function resolveEndpointAuth(homeDir, config) {
+	const file = await readEndpointAuthFile(homeDir);
+	const configBaseUrl = field(config.baseUrl);
+	const configApiKey = field(config.apiKey);
+	const configAuthToken = field(config.authToken);
+	return {
+		...configBaseUrl === void 0 ? {} : { baseUrl: configBaseUrl },
+		...configApiKey === void 0 ? {} : { apiKey: configApiKey },
+		...configAuthToken === void 0 ? {} : { authToken: configAuthToken },
+		...file
+	};
+}
+/**
+* The spawn-env layer for a resolved endpoint: one entry per defined field,
+* nothing else. Undefined yields an empty layer — the spread then adds no
+* keys at all, byte-identical to the pre-endpoint env.
+* @param auth - the resolved endpoint auth, or undefined.
+* @returns the explicit env entries for the delegation spawn.
+*/
+function endpointAuthEnv(auth) {
+	if (auth === void 0) return {};
+	const baseUrl = field(auth.baseUrl);
+	const apiKey = field(auth.apiKey);
+	const authToken = field(auth.authToken);
+	return {
+		...baseUrl === void 0 ? {} : { ANTHROPIC_BASE_URL: baseUrl },
+		...apiKey === void 0 ? {} : { ANTHROPIC_API_KEY: apiKey },
+		...authToken === void 0 ? {} : { ANTHROPIC_AUTH_TOKEN: authToken }
+	};
+}
+/**
+* The credential marker's modification stamp (epoch ms): the endpoint file's
+* mtime, or undefined when the scope has no file (a config-sourced credential
+* has no marker — rotating it pairs with the profile edit and instance
+* restart that clear the in-memory grade marks). A fresh file write is a
+* fresh stamp, which is how an edited-in key recovers a `rejected` grade.
+* @param homeDir - the scope's scoped home.
+* @returns the stamp, or undefined.
+*/
+async function endpointAuthStamp(homeDir) {
+	try {
+		return (await stat(join(homeDir, ENDPOINT_AUTH_FILE))).mtimeMs;
+	} catch {
+		return;
+	}
+}
+/** Whether the scope carries its own endpoint file at all. */
+async function endpointAuthFileExists(homeDir) {
+	return await endpointAuthStamp(homeDir) !== void 0;
+}
+/**
+* Write the scope's endpoint-auth.json (mode 0600, mkdir -p first), the
+* per-scope provisioning path an evaluation's `conditions provision` (or a
+* person) uses to give one scope its own credential. Whole-file write: the
+* payload is exactly what {@link readEndpointAuthFile} parses back.
+* @param homeDir - the scope's scoped home.
+* @param auth - the endpoint credential to persist.
+*/
+async function writeEndpointAuth(homeDir, auth) {
+	await mkdir(homeDir, { recursive: true });
+	const baseUrl = field(auth.baseUrl);
+	const apiKey = field(auth.apiKey);
+	const authToken = field(auth.authToken);
+	const payload = {
+		...baseUrl === void 0 ? {} : { baseUrl },
+		...apiKey === void 0 ? {} : { apiKey },
+		...authToken === void 0 ? {} : { authToken }
+	};
+	await writeFile(join(homeDir, ENDPOINT_AUTH_FILE), JSON.stringify(payload, void 0, 2) + "\n", { mode: 384 });
+}
+/**
+* Clear the scope's OWN endpoint credential (the endpoint-auth.json file).
+* A deployment-level credential from the plugin config is untouched — the
+* core's logout reply then names the profile row as the place to edit.
+* @param homeDir - the scope's scoped home.
+*/
+async function clearEndpointAuth(homeDir) {
+	await rm(join(homeDir, ENDPOINT_AUTH_FILE), { force: true });
+}
+/** How many served model ids the check reply lists before truncating. */
+const CHECK_MODEL_LIST_LIMIT = 8;
+/** Bound on the error-body excerpt a failed check reports. */
+const CHECK_ERROR_BODY_LIMIT = 200;
+/** The effort levels one served-model entry advertises, oldest-first. */
+function servedEfforts(effort) {
+	if (typeof effort !== "object" || effort === null) return void 0;
+	const levels = [
+		"low",
+		"medium",
+		"high",
+		"xhigh",
+		"max"
+	].filter((level) => effort[level]?.supported === true);
+	return levels.length === 0 ? void 0 : levels;
+}
+/**
+* `GET <baseUrl>/v1/models` with the resolved credential's auth header(s) —
+* the token-free endpoint probe shared by the `/claude-code check` verdict
+* and the model catalog. Anthropic's own API serves this route with
+* `x-api-key`; relays (openproxy verified) proxy it and answer the same
+* shape. Never throws: every failure mode folds into the result.
+* @param endpoint - the resolved endpoint auth (caller checks the credential).
+* @param fetchImpl - the HTTP fetch; default the host's global fetch.
+* @param signal - abort for the whole probe (timeout bundled by the caller).
+* @returns the folded result.
+*/
+async function fetchEndpointModels(endpoint, fetchImpl, signal) {
+	const headers = { "anthropic-version": "2023-06-01" };
+	if (endpoint.apiKey !== void 0) headers["x-api-key"] = endpoint.apiKey;
+	if (endpoint.authToken !== void 0) headers["authorization"] = `Bearer ${endpoint.authToken}`;
+	const fetcher = fetchImpl ?? globalThis.fetch;
+	const url = `${endpoint.baseUrl.replace(/\/+$/, "")}/v1/models`;
+	let response;
+	try {
+		response = await fetcher(url, {
+			headers,
+			signal: signal ?? AbortSignal.timeout(8e3)
 		});
+	} catch (error) {
+		return {
+			kind: "unreachable",
+			message: error instanceof Error ? error.message : String(error)
+		};
 	}
-	close() {
-		if (this.closed) return;
-		this.closed = true;
-		for (const request of [...this.pending.values()]) request.reject(/* @__PURE__ */ new Error("Claude control channel closed before acknowledgement"));
+	if (!response.ok) return {
+		kind: "http",
+		status: response.status,
+		body: (await response.text().catch(() => "")).slice(0, CHECK_ERROR_BODY_LIMIT)
+	};
+	let data;
+	try {
+		data = JSON.parse(await response.text()).data;
+	} catch {
+		return { kind: "malformed" };
+	}
+	if (!Array.isArray(data)) return { kind: "malformed" };
+	const models = [];
+	for (const entry of data) {
+		if (typeof entry !== "object" || entry === null) continue;
+		const record = entry;
+		if (typeof record.id !== "string" || record.id === "") continue;
+		const efforts = servedEfforts(record.effort);
+		models.push({
+			id: record.id,
+			...typeof record.display_name === "string" && record.display_name !== "" ? { displayName: record.display_name } : {},
+			...efforts === void 0 ? {} : { efforts }
+		});
 	}
-};
+	return {
+		kind: "models",
+		models
+	};
+}
+/**
+* Probe the resolved endpoint with a cheap, token-free round-trip: `GET
+* <baseUrl>/v1/models` with the resolved credential's auth header(s). A 200
+* proves both reachability and credential validity — the exact evidence a
+* "verify" button needs — and the served model list rides the reply so the
+* user sees what the endpoint offers (any id can be typed into the model
+* field by hand). One transport-level retry rides along: a local proxy
+* restart (a Surge/clash reload) stalls the first attempt into the timeout
+* and answers the retry immediately. Never throws: every failure mode folds
+* into the reply text, since the reply IS the diagnostic.
+* @param endpoint - the resolved endpoint auth (scope file over settings).
+* @param fetchImpl - the HTTP fetch; default the host's global fetch.
+* @param timeoutMs - one attempt's deadline (two attempts at most).
+* @returns the human-readable verdict for the `/claude-code check` reply.
+*/
+async function checkClaudeEndpoint(endpoint, fetchImpl, timeoutMs = 2e4) {
+	if (!hasEndpointCredential(endpoint)) return "No endpoint credential configured — fill API Key or Auth Token on the settings card (or the profile row) first.";
+	const baseUrl = (endpoint.baseUrl ?? "https://api.anthropic.com").replace(/\/+$/, "");
+	let result = await fetchEndpointModels({
+		...endpoint,
+		baseUrl
+	}, fetchImpl, AbortSignal.timeout(timeoutMs));
+	if (result.kind === "unreachable") result = await fetchEndpointModels({
+		...endpoint,
+		baseUrl
+	}, fetchImpl, AbortSignal.timeout(timeoutMs));
+	if (result.kind === "unreachable") return `Endpoint unreachable (${baseUrl}): ${result.message}`;
+	if (result.kind === "http") return `Endpoint answered HTTP ${String(result.status)} (${baseUrl})${result.body === "" ? "" : `: ${result.body}`}`;
+	if (result.kind === "malformed") return `Endpoint reachable (${baseUrl}) but the model list did not parse — the credential worked, the reply was not /v1/models-shaped.`;
+	if (result.models.length === 0) return `Endpoint reachable (${baseUrl}); it serves no models.`;
+	const ids = result.models.map((model) => model.id);
+	const listed = ids.slice(0, CHECK_MODEL_LIST_LIMIT).join(", ");
+	const more = ids.length > CHECK_MODEL_LIST_LIMIT ? `, … +${String(ids.length - CHECK_MODEL_LIST_LIMIT)} more` : "";
+	return `Endpoint reachable (${baseUrl}): ${String(ids.length)} model(s) served — ${listed}${more}`;
+}
 //#endregion
 //#region lib/types/model-catalog.js
-/** Initialize's native picker vocabulary, not an account entitlement claim. */
+/**
+* Fold the CLI's own `initialize` model vocabulary. Consumed by the LIVE
+* DRIVER's runtime init handling; the catalog no longer reads this — a
+* local list cannot prove anything about the configured endpoint, and
+* showing it made an invalid credential look valid.
+*/
 function claudeDirectory(result) {
 	const models = result["models"];
 	if (models === void 0) return {
@@ -119,7 +329,33 @@ function claudeDirectory(result) {
 		...entries.has("default") ? { defaultModel: "default" } : {}
 	};
 }
-/** Scoped native control probe. Never syncs credentials, writes settings or submits a user turn. */
+/** One directory answer that names why it is empty. */
+function unsupported(reason) {
+	return {
+		entries: [],
+		complete: false,
+		customInput: true,
+		unsupported: true,
+		reason
+	};
+}
+/**
+* The model directory, sourced from the configured ENDPOINT (`GET
+* <baseUrl>/v1/models` with the resolved credential) — never from the local
+* CLI: what the picker lists is exactly what the endpoint serves, so a
+* credential that does not work can never hide behind a locally-known list.
+* The answers are deliberate:
+*
+* - no credential resolved → empty with a "save a key first" reason;
+* - 401/403 → empty with the rejection (definitive — cached as data);
+* - another HTTP status → empty with it (the relay serves no model route);
+* - a transport failure THROWS, so the cache keeps the last good list and
+*   retries on schedule instead of blanking a momentarily-down endpoint.
+*
+* Effort levels ride the served entries' `effort` capability when the
+* endpoint advertises them. Entries carry `source: 'native'` — they are the
+* harness's native vocabulary, just read from the endpoint in force.
+*/
 var ClaudeModelCatalog = class {
 	deps;
 	cache;
@@ -135,22 +371,15 @@ var ClaudeModelCatalog = class {
 		});
 	}
 	key(homeDir, cwd = homeDir) {
-		const files = [
-			join(homeDir, "settings.json"),
-			join(homeDir, ".credentials.json"),
-			join(homeDir, ".claude.json")
-		];
-		for (let directory = cwd;; directory = dirname(directory)) {
-			files.push(join(directory, ".claude", "settings.json"), join(directory, ".claude", "settings.local.json"));
-			if (dirname(directory) === directory) break;
-		}
+		const files = [join(homeDir, "settings.json"), join(homeDir, "endpoint-auth.json")];
+		const endpointLabel = this.deps.endpointLabel?.();
 		return modelDirectoryContextKey({
 			provider: "claude-code",
 			homeDir,
 			cwd,
-			cli: [this.deps.cli ?? "claude"],
+			cli: [],
 			files,
-			...this.deps.baseUrl === void 0 ? {} : { endpoint: this.deps.baseUrl }
+			...endpointLabel === void 0 ? {} : { endpoint: endpointLabel }
 		});
 	}
 	read(homeDir, cwd) {
@@ -168,977 +397,403 @@ var ClaudeModelCatalog = class {
 	dispose() {
 		this.cache.dispose();
 	}
-	async probe(homeDir, cwd, signal) {
-		const child = this.deps.spawn({
-			argv: [
-				this.deps.cli ?? "claude",
-				"-p",
-				"--verbose",
-				"--input-format",
-				"stream-json",
-				"--output-format",
-				"stream-json",
-				"--no-session-persistence",
-				"--settings",
-				"{\"disableAllHooks\":true}",
-				"--strict-mcp-config",
-				"--mcp-config",
-				"{\"mcpServers\":{}}",
-				"--"
-			],
-			cwd,
-			stdio: {
-				stdin: "pipe",
-				stdout: "pipe",
-				stderr: "pipe"
-			},
-			graceMs: 2e3,
-			env: delegationEnv({
-				CLAUDE_CONFIG_DIR: homeDir,
-				...this.deps.baseUrl === void 0 ? {} : { ANTHROPIC_BASE_URL: this.deps.baseUrl }
-			})
-		});
-		const controls = new ClaudeControlRequests((frame) => {
-			if (child.stdin === void 0) throw new Error("Claude discovery stdin is unavailable");
-			child.stdin.write(JSON.stringify(frame) + "\n");
-		}, this.deps.timeoutMs ?? 5e3);
-		const decoder = new StringDecoder("utf8");
-		let buffer = "";
-		child.stdout?.on("data", (chunk) => {
-			buffer += decoder.write(chunk);
-			if (buffer.length > 1048576) {
-				controls.close();
-				child.terminate();
-				return;
-			}
-			let index;
-			while ((index = buffer.indexOf("\n")) >= 0) {
-				const line = buffer.slice(0, index);
-				buffer = buffer.slice(index + 1);
-				let event;
-				try {
-					event = JSON.parse(line);
-				} catch {
-					continue;
-				}
-				if (controls.accept(event)) continue;
-				if (event["type"] === "control_request" && typeof event["request_id"] === "string") child.stdin?.write(JSON.stringify({
-					type: "control_response",
-					response: {
-						subtype: "error",
-						request_id: event["request_id"],
-						error: "Model discovery does not execute tools"
-					}
-				}) + "\n");
-			}
-		});
-		child.stderr?.on("data", () => {});
-		child.done.then(() => controls.close(), () => controls.close());
-		let cleanupTimer;
-		try {
-			return claudeDirectory(await controls.request({
-				subtype: "initialize",
-				hooks: {}
-			}, signal));
-		} finally {
-			controls.close();
-			child.stdin?.end();
-			await Promise.race([child.done.catch(() => {}), new Promise((resolve) => {
-				cleanupTimer = setTimeout(resolve, 1e3);
-				cleanupTimer.unref();
-			})]);
-			if (cleanupTimer !== void 0) clearTimeout(cleanupTimer);
-			child.terminate();
-			await child.waitForExit().catch(() => {});
+	async probe(homeDir, _cwd, signal) {
+		const endpoint = await this.deps.endpoint?.(homeDir);
+		if (!hasEndpointCredential(endpoint)) return unsupported("No endpoint credential configured — the model list loads from the endpoint once an API Key or Auth Token is saved");
+		const result = await fetchEndpointModels({
+			...endpoint,
+			baseUrl: endpoint.baseUrl ?? "https://api.anthropic.com"
+		}, this.deps.fetchImpl, AbortSignal.any([signal, AbortSignal.timeout(this.deps.timeoutMs ?? 2e4)]));
+		if (result.kind === "unreachable") throw new Error(`endpoint unreachable: ${result.message}`);
+		if (result.kind === "malformed") return unsupported("The endpoint answered but the model list did not parse (not /v1/models-shaped)");
+		if (result.kind === "http") {
+			if (result.status === 401 || result.status === 403) return unsupported(`The endpoint rejected the credential (HTTP ${String(result.status)}) — the list loads once a valid key is saved`);
+			return unsupported(`The endpoint does not serve a model list (HTTP ${String(result.status)})`);
 		}
+		const entries = result.models.map((model) => ({
+			value: model.id,
+			label: model.displayName ?? model.id,
+			source: "native",
+			...model.efforts === void 0 ? {} : { reasoning: { options: model.efforts.map((effort) => ({
+				value: effort,
+				label: effort
+			})) } }
+		}));
+		if (entries.length === 0) return unsupported("The endpoint serves no models");
+		return {
+			entries,
+			complete: true,
+			customInput: true
+		};
 	}
 };
 //#endregion
-//#region lib/types/records.js
-/**
-* Claude Code session records adapter: scans the scoped home's `projects/`
-* session files (one JSONL per session under `projects/<cwd-slug>/`, the
-* slug being the workspace path with separators replaced by dashes), plus
-* the transcript model read-back ({@link readClaudeTranscriptModel}) the
-* model broker's `lastObserved` backstop runs on. The
-* slug is a LOSSY encoding of the cwd — different paths can collide on the
-* same slug — so the listed cwd always comes from the file CONTENT (the
-* first `user` event's `cwd` field), never from the directory name. Only the
-* head of each file is read — the first user event carries the id, cwd, and
-* timestamp the listing needs; the rest of the file (conversation) is not
-* parsed. Files are append-only with torn-tail tolerance, and contents are
-* always untrusted input.
-* @module @khorsheed/dsh-local-agent-claude-code/records
-*/
-/** Session files live under this directory inside the scoped home. */
-const PROJECTS_ROOT = "projects";
-/** Bound on the head prefix read from one session file. */
-const HEAD_BYTES = 65536;
-/**
-* Bound on the tail read when extracting a transcript's model. Assistant
-* lines are frequent, so the last window almost always names one; a bigger
-* conversation is never read whole.
-*/
-const TRANSCRIPT_TAIL_BYTES = 262144;
-/** Cap on project directories the transcript reads scan. */
-const TRANSCRIPT_SCAN_DIRS = 200;
-/** Cap on transcript files the harness-level newest-scan stats. */
-const TRANSCRIPT_SCAN_FILES = 500;
-/** Cap on sidechain (`agent-*.jsonl`) candidates inspected for one session id. */
-const TRANSCRIPT_SIDECHAIN_FILES = 100;
-/** How many newest transcripts the harness-level read tries before giving up. */
-const TRANSCRIPT_NEWEST_TRIES = 3;
-/** Test-swappable process exec (the keychain read goes through `security`). */
-const internals = { exec: promisify(execFile) };
-/**
-* The scoped `.claude.json`'s modification stamp (epoch ms), undefined when
-* absent. A completed login rewrites this file, so the stamp distinguishes a
-* fresh login from a leftover marker (a revoked token's record lingers).
-* @param homeDir - the `claude-code` harness's scoped home.
-* @returns the marker's mtime, or undefined when no scoped config exists.
-*/
-async function claudeCredentialStamp(homeDir) {
-	try {
-		return (await stat(join(homeDir, ".claude.json"))).mtimeMs;
-	} catch {
-		return;
+//#region lib/types/control-requests.js
+/** Bounded, correlated Claude stream-json controls, shared by discovery and live sessions. */
+var ClaudeControlRequests = class {
+	send;
+	timeoutMs;
+	sequence = 0;
+	closed = false;
+	pending = /* @__PURE__ */ new Map();
+	constructor(send, timeoutMs = 5e3) {
+		this.send = send;
+		this.timeoutMs = timeoutMs;
 	}
-}
-/**
-* The keychain entry name current claude uses for a non-default config dir:
-* the bare name belongs to `~/.claude`, other dirs get a path-hash suffix.
-* @param homeDir - the `claude-code` harness's scoped home.
-* @returns the macOS keychain service name holding the OAuth credential.
-*/
-function keychainService(homeDir) {
-	return `Claude Code-credentials-${createHash("sha256").update(homeDir).digest("hex").slice(0, 8)}`;
-}
-/**
-* Whether a credential blob is USABLE: the token record nests under
-* `claudeAiOauth`, and a blob whose access AND refresh tokens are both empty
-* is a shell. macOS keeps historical items under the same service (an early
-* claude wrote an `acct=unknown` placeholder with blank tokens and
-* `expiresAt: 0`), and mirroring one into the credentials file makes every
-* delegation report "OAuth session expired and could not be refreshed" —
-* indistinguishable from a real expiry while login looks successful. A
-* non-empty token is the bar for mirroring a blob or keeping a file.
-* @param text - the raw credential JSON.
-* @returns true when the blob carries a non-empty token.
-*/
-function credentialUsable(text) {
-	try {
-		const oauth = JSON.parse(text).claudeAiOauth;
-		return typeof oauth?.accessToken === "string" && oauth.accessToken !== "" || typeof oauth?.refreshToken === "string" && oauth.refreshToken !== "";
-	} catch {
-		return false;
+	accept(event) {
+		if (event["type"] !== "control_response") return false;
+		const response = event["response"];
+		const id = response?.["request_id"];
+		if (typeof id !== "string") return true;
+		const pending = this.pending.get(id);
+		if (pending === void 0) return true;
+		if (response?.["subtype"] !== "success") pending.reject(new Error(typeof response?.["error"] === "string" ? response["error"] : "Claude rejected the control request"));
+		else {
+			const result = response["response"];
+			pending.resolve(typeof result === "object" && result !== null ? result : {});
+		}
+		return true;
 	}
-}
-/**
-* A `security dump-keychain` timedate as epoch ms; undefined when the shape is
-* not recognized (the item then sorts as oldest).
-*
-* The shape that matters is the COMPACT Zulu stamp `20260916040855Z`, because
-* that is what the tool actually prints — with the attribute's trailing NUL
-* rendered as a literal `\000` after the closing digit, so the match must not
-* anchor at the end. Only the spaced `2026-09-01 02:03:04 +0000` form was
-* parsed before, which no `security` build was observed to emit: every item
-* fell to the `?? 0` default, the newest-first sort over all-equal keys
-* degenerated to the dump's own order (a stable sort), and
-* `readKeychainCredential` returned whichever usable item the dump happened to
-* list first. A scoped home that had been logged in twice then kept serving the
-* SUPERSEDED credential — the fresh login sat unread in the keychain while the
-* runtime ran on a generation whose refresh token was already spent. The
-* spaced form is still accepted in case some build does emit it.
-* @param text - the quoted timedate string from the dump.
-* @returns the epoch milliseconds, or undefined.
-*/
-function keychainTimestamp(text) {
-	const trimmed = text.trim();
-	const compact = /^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})Z/.exec(trimmed);
-	if (compact !== null) {
-		const at = (index) => Number(compact[index]);
-		const ms = Date.UTC(at(1), at(2) - 1, at(3), at(4), at(5), at(6));
-		return Number.isFinite(ms) ? ms : void 0;
-	}
-	const spaced = /^(\d{4})-(\d{2})-(\d{2}) (\d{2}):(\d{2}):(\d{2}) ([+-])(\d{2})(\d{2})$/.exec(trimmed);
-	if (spaced === null) return void 0;
-	const part = (index) => Number(spaced[index]);
-	const offsetMinutes = (part(8) * 60 + part(9)) * (spaced[7] === "+" ? 1 : -1);
-	const ms = Date.UTC(part(1), part(2) - 1, part(3), part(4), part(5), part(6)) - offsetMinutes * 6e4;
-	return Number.isFinite(ms) ? ms : void 0;
-}
-/**
-* Every account holding an item under the service, newest write first. macOS
-* allows SEVERAL items per service, and an unscoped `find-generic-password
-* -w` returns the FIRST match — which can be a historical empty shell (see
-* `credentialUsable`) — so the sync enumerates instead of trusting the first
-* hit. The dump prints metadata only (no secrets); a failing dump or a parse
-* miss yields an empty list, and the caller then falls back to the unscoped
-* read.
-* @param service - the keychain service name.
-* @returns the accounts, newest modification first.
-*/
-async function keychainItems(service) {
-	let stdout;
-	try {
-		({stdout} = await internals.exec("security", ["dump-keychain"]));
-	} catch {
-		return [];
-	}
-	const items = [];
-	let svce;
-	let acct;
-	let mdat = 0;
-	const flush = () => {
-		if (svce === service && acct !== void 0) items.push({
-			acct,
-			mdat
+	request(request, signal) {
+		if (this.closed || signal?.aborted) return Promise.reject(/* @__PURE__ */ new Error("Claude control channel is closed"));
+		const id = `dsh-control-${++this.sequence}`;
+		return new Promise((resolve, reject) => {
+			const finish = () => {
+				this.pending.delete(id);
+				clearTimeout(timer);
+				signal?.removeEventListener("abort", abort);
+			};
+			const fail = (error) => {
+				finish();
+				reject(error);
+			};
+			const abort = () => {
+				fail(/* @__PURE__ */ new Error("Claude control request cancelled"));
+			};
+			const timer = setTimeout(() => fail(/* @__PURE__ */ new Error(`Claude ${String(request["subtype"])} control timed out`)), this.timeoutMs);
+			timer.unref();
+			this.pending.set(id, {
+				resolve: (value) => {
+					finish();
+					resolve(value);
+				},
+				reject: fail
+			});
+			signal?.addEventListener("abort", abort, { once: true });
+			try {
+				this.send({
+					type: "control_request",
+					request_id: id,
+					request
+				});
+			} catch (error) {
+				fail(error instanceof Error ? error : /* @__PURE__ */ new Error("Claude control write failed"));
+			}
 		});
-		svce = void 0;
-		acct = void 0;
-		mdat = 0;
-	};
-	for (const line of stdout.split("\n")) {
-		if (line.startsWith("keychain:")) {
-			flush();
-			continue;
-		}
-		const trimmed = line.trim();
-		const svceMatch = /^"svce"<blob>="(.*)"$/.exec(trimmed);
-		if (svceMatch !== null) {
-			svce = svceMatch[1];
-			continue;
-		}
-		const acctMatch = /^"acct"<blob>="(.*)"$/.exec(trimmed);
-		if (acctMatch !== null) {
-			acct = acctMatch[1];
-			continue;
-		}
-		const mdatMatch = /^"mdat"<timedate>=0x[0-9a-fA-F]+\s+"(.*)"$/.exec(trimmed);
-		if (mdatMatch !== null) mdat = keychainTimestamp(mdatMatch[1] ?? "") ?? 0;
-	}
-	flush();
-	return items.sort((a, b) => b.mdat - a.mdat);
-}
-/**
-* One keychain read: the item for `acct` when given, else the first match.
-* Returns the raw blob only when it is USABLE (non-empty token); anything
-* else — missing item, unreadable payload, an empty shell — is undefined.
-* @param service - the keychain service name.
-* @param acct - the account to read, or undefined for the unscoped first match.
-* @returns the credential blob, or undefined.
-*/
-async function readKeychainEntry(service, acct) {
-	try {
-		const args = [
-			"find-generic-password",
-			"-s",
-			service
-		];
-		if (acct !== void 0) args.push("-a", acct);
-		args.push("-w");
-		const { stdout } = await internals.exec("security", args);
-		const blob = stdout.trim();
-		return credentialUsable(blob) ? blob : void 0;
-	} catch {
-		return;
 	}
-}
-/**
-* The usable credential blob for this scoped home, or undefined. Every
-* account under the service is tried newest-write-first and the first
-* non-empty token wins; when enumeration itself is unavailable (not macOS, a
-* failing dump) the legacy unscoped read still runs, held to the same
-* non-empty-token bar.
-* @param homeDir - the `claude-code` harness's scoped home.
-* @returns the credential blob, or undefined when nothing usable is stored.
-*/
-async function readKeychainCredential(homeDir) {
-	const service = keychainService(homeDir);
-	const items = await keychainItems(service);
-	for (const item of items) {
-		const blob = await readKeychainEntry(service, item.acct);
-		if (blob !== void 0) return blob;
-	}
-	return items.length > 0 ? void 0 : readKeychainEntry(service, void 0);
-}
-/**
-* The stored credential's expiry (epoch ms), read from the USABLE macOS
-* keychain item for this scoped home (see `readKeychainCredential`);
-* undefined when no usable item exists or it carries no expiry (presence
-* alone then decides, as before). The READ side takes the LATER of the
-* access-token and refresh-token expiries: the CLI refreshes on use, so a
-* live refresh token means the credential still works.
-* @param homeDir - the `claude-code` harness's scoped home.
-* @returns the expiry, or undefined when unknown.
-*/
-async function readCredentialExpiry(homeDir) {
-	const blob = await readKeychainCredential(homeDir);
-	return blob === void 0 ? void 0 : credentialFileExpiry(blob);
-}
-/**
-* The ACCESS-token expiry (epoch ms) of a credential blob — the freshness key
-* the sync compares the two stores on. Deliberately not
-* {@link credentialFileExpiry}: that one answers "is this credential still
-* usable" and takes the LATER of the two expiries, so two generations of one
-* grant share a refresh expiry and compare equal. A refresh always mints a
-* later ACCESS expiry, which is exactly what tells the generations apart.
-* @param text - the raw credential JSON.
-* @returns the access-token expiry, or undefined when absent or unparseable.
-*/
-function credentialAccessExpiry(text) {
-	try {
-		const access = JSON.parse(text).claudeAiOauth?.expiresAt;
-		return typeof access === "number" ? access : void 0;
-	} catch {
-		return;
+	close() {
+		if (this.closed) return;
+		this.closed = true;
+		for (const request of [...this.pending.values()]) request.reject(/* @__PURE__ */ new Error("Claude control channel closed before acknowledgement"));
 	}
-}
+};
+//#endregion
+//#region lib/types/live-driver.js
 /**
-* Reconcile the keychain credential with `<homeDir>/.credentials.json`,
-* NEWER WINS. Claude 2.1.236 on macOS WRITES the scoped login to the hashed
-* keychain entry but READS the credentials file at runtime (the same
-* write/read split as the Linux #47661 bug) — a login that lands only in the
-* keychain still answers "Not logged in", so the file has to be kept current.
+* The claude provider's live driver: one resident Claude Code stream-json
+* process per member (child session), driven over the vendor's
+* `--input-format stream-json --output-format stream-json` realtime mode
+* (protocol-probed against claude 2.1.236; the Agent SDK's streaming-input
+* mode is this same channel, driven here directly so no SDK dependency
+* lands). A delegation round is one `user` message on the resident process's
+* stdin instead of a fresh `claude -p` — which buys what the process boundary
+* could not: runtime-level graceful interrupt (`control_request
+* {subtype:'interrupt'}`; the process survives and the session stays
+* continuable) and the same-shape push stream folded live per turn.
 *
-* The file is not this process's private mirror, though: a containerized
-* round bind-mounts this very directory read-write (the unit has no keychain,
-* so the CLI inside it reads and writes the file), and the pre-spawn sync runs
-* against the HOST path moments before the unit reads it through the mount.
-* An unconditional mirror therefore makes this function the one participant
-* that can move the credential chain BACKWARD: it hands the next run a refresh
-* token the other writer already spent, the endpoint rejects it, and the CLI
-* answers by CLEARING the file — which logs the instance out, because that
-* file is the instance's credential. So the keychain blob is written only when
-* it is not older than the file's. Undefined expiry on either side keeps the
-* pre-newer-wins behavior (the keychain writes), and a file that is not USABLE
-* never wins.
+* Auth discipline (a hard requirement): the resident process runs under the
+* family's scoped `CLAUDE_CONFIG_DIR` plus the resolved endpoint credential's
+* `ANTHROPIC_*` variables (the scope's endpoint-auth.json over the plugin
+* config — the exec path's exact env rule, resolved per spawn). The driver
+* never touches the user's global `~/.claude` and never runs any `auth` verb.
 *
-* Only a USABLE blob (non-empty token, see `readKeychainCredential`) is
-* mirrored; with none in the keychain, a file holding an empty-token shell —
-* debris from an earlier first-match read, or a cleared credential — is
-* REMOVED, so the runtime says "Not logged in" instead of the misleading
-* "OAuth session expired". Idempotent and content-compare before write.
-* @param homeDir - the `claude-code` harness's scoped home.
-* @param log - warn channel for the two decisions that used to be silent.
-* @returns true when a usable credential is in the file after the call.
+* Protocol facts (all probed): the first stdin `user` message triggers
+* `system/init` carrying the server-assigned session id (EVERY turn emits a
+* fresh init — the delegation records the first one); each turn closes with
+* a `result` event (`is_error`, usage, session id); the interrupt control
+* request answers with a `control_response` success; a new process with
+* `--resume <session_id>` reattaches the on-disk session in the same mode
+* (crash recovery); stdin EOF quiesces the process (the reclaim ladder).
+*
+* Fold: the resident stream speaks the exec path's exact event vocabulary
+* (`system`/`assistant`/`user`/`result`), so each turn folds through the
+* shared `ClaudeStreamParser` with the exec live mirror's hold-back rule (the
+* volatile last line waits for `result`, which carries the round's usage).
+* Every line folds 1:1. The always-enabled
+* `--include-partial-messages` adds incremental output on top: each `stream_event` partial accumulates into its kind's
+* stream (native message id + block index, with ordered legacy fallback),
+* which reserves a (turn, step) at its first delta and
+* appends throttled snapshot `assistant/message`s there — the host folds
+* repeated settles at one coordinate into one live-updating chat node, the
+* only streaming channel left after 0.1.5 retired the durable per-chunk
+* event. A streamed line's completion folds at its stream's reserved step and
+* finalizes it (no duplicated content); a stream whose completion never
+* arrives is force-finalized at settle (interrupted on a non-completed round,
+* so a cancelled turn reads 已停止 legitimately), the last one carrying the
+* round's usage when no folded line did.
+*
+* Lifecycle mirrors M1–M3's discipline: lazy spawn, one in-flight spawn per
+* member, idle-timeout reclaim (stdin EOF → grace → SIGTERM ladder), crash
+* re-spawn with `--resume`, a channel breaker with cooldown, `disposeAll` on
+* unload, and cancellation honored in every window (abort listener before
+* any await; the init wait races the abort signal).
+*
+* Two member-aware additions on top: the spawn binds the member's EFFECTIVE
+* model (session-level override, then the round's delegation model, then the
+* settings key — resolved by the config callback per spawn, scratched into
+* the scoped settings.json because a `--resume` respawn honors the file over
+* the flag), and a runtime whose bound model no longer matches is retired so
+* the round respawns onto the right one; and server→client control requests
+* (a `permissionMode: 'normal'` spawn's `can_use_tool` approval surface) are
+* auto-answered so an unattended runtime never hangs on a permission prompt.
+* @module @khorsheed/dsh-local-agent-claude-code/live-driver
 */
-async function syncClaudeCredentialFile(homeDir, log) {
-	const file = join(homeDir, ".credentials.json");
-	let existing;
-	try {
-		existing = await readFile(file, "utf8");
-	} catch {}
-	const fileUsable = existing !== void 0 && credentialUsable(existing);
-	const blob = await readKeychainCredential(homeDir);
-	if (blob === void 0) {
-		if (existing !== void 0 && !fileUsable) await rm(file, { force: true });
-		return fileUsable;
-	}
-	if (existing !== void 0 && existing.trim() === blob) return true;
-	if (fileUsable) {
-		const fileExpiry = credentialAccessExpiry(existing);
-		const blobExpiry = credentialAccessExpiry(blob);
-		if (fileExpiry !== void 0 && blobExpiry !== void 0 && fileExpiry > blobExpiry) {
-			log?.(`local-agent-claude-code: ${homeDir}/.credentials.json is AHEAD of the keychain (file access expiry ${new Date(fileExpiry).toISOString()}, keychain ${new Date(blobExpiry).toISOString()}) — keeping the file; something else refreshed this grant (a containerized round mounts this directory read-write)`);
-			return true;
-		}
-	}
-	if (existing !== void 0 && !fileUsable) log?.(`local-agent-claude-code: ${homeDir}/.credentials.json held a cleared credential (both tokens empty) and is being restored from the keychain (access expiry ${new Date(credentialAccessExpiry(blob) ?? 0).toISOString()}); if the next round fails to authenticate, this grant was already spent and the scope needs a fresh login`);
-	await writeFile(file, blob, { mode: 384 });
-	return true;
-}
+/** Default idle lifetime of an unused resident runtime before reclaim. */
+const DEFAULT_LIVE_IDLE_MS = 18e5;
+/** Default timeout for the turn's system/init ack (a cold boot can be slow). */
+const DEFAULT_LIVE_INIT_TIMEOUT_MS = 6e4;
+/** Bounded wait for an interrupted turn to converge while a run disposes. */
+const DEFAULT_LIVE_DISPOSE_CONVERGE_MS = 5e3;
+/** How long a tripped channel breaker stays on the exec fallback. */
+const DEFAULT_LIVE_CHANNEL_RETRY_MS = 3e5;
+/** Grace between stdin EOF and SIGTERM when reclaiming a stream-json process. */
+const RECLAIM_EOF_GRACE_MS = 1e3;
+/** Default minimum interval between one streaming kind's snapshot messages. */
+const DEFAULT_SNAPSHOT_MIN_INTERVAL_MS = LIVE_FLUSH_INTERVAL_MS;
 /**
-* The expiry (epoch ms) from a `.credentials.json` payload; the token record
-* nests under `claudeAiOauth`. Returns the LATER of the access-token and
-* refresh-token expiries — the CLI refreshes on use, so a live refresh token
-* keeps the credential usable past the access expiry. Undefined when
-* absent/unparseable.
-* @param text - the file contents.
-* @returns the expiry, or undefined.
+* The stream-json channel could not come up (spawn failure or the first
+* turn's init never arrived). The provider catches exactly this and falls
+* back to the exec one-shot; any other error is a real round failure.
 */
-function credentialFileExpiry(text) {
-	try {
-		const parsed = JSON.parse(text);
-		const access = parsed.claudeAiOauth?.expiresAt;
-		const refresh = parsed.claudeAiOauth?.refreshTokenExpiresAt;
-		const accessMs = typeof access === "number" ? access : void 0;
-		const refreshMs = typeof refresh === "number" ? refresh : void 0;
-		if (accessMs === void 0 && refreshMs === void 0) return void 0;
-		return Math.max(accessMs ?? 0, refreshMs ?? 0);
-	} catch {
-		return;
+var LiveChannelUnavailableError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "LiveChannelUnavailableError";
 	}
+};
+const DEFAULT_TIMEOUTS = {
+	initMs: DEFAULT_LIVE_INIT_TIMEOUT_MS,
+	convergeMs: DEFAULT_LIVE_DISPOSE_CONVERGE_MS,
+	channelRetryMs: DEFAULT_LIVE_CHANNEL_RETRY_MS
+};
+function thrown$1(value) {
+	return value instanceof Error ? value : new Error(String(value));
 }
-/**
-* Whether the scoped home holds usable Claude Code credentials: the scoped
-* `.claude.json` carries an `oauthAccount` record once a device-code login
-* has completed, AND the keychain credential is not past its stored expiry
-* (when the expiry is readable — a server-side REVOCATION is not visible
-* locally; providers report those through `localAgent.reportAuthFailure`).
-* The real credential lives in the macOS keychain under a hashed entry
-* (`Claude Code-credentials-<sha256(path)[:8]>`, hashed from the config-dir
-* path) or in the default `~/.claude/.credentials.json` on Linux (upstream
-* bug #47661: `CLAUDE_CONFIG_DIR` does not isolate the credentials file
-* there — it writes the scoped dir but READS the default home, so Linux
-* credentials may exist even when the scoped home has none). Spawning the
-* CLI to probe auth is avoided; the platform differences are documented in
-* the README.
-* @param homeDir - the `claude-code` harness's scoped home.
-* @param log - warn channel handed to the credential reconcile below.
-* @returns true when a completed login is recorded and not locally expired.
-*/
-async function claudeAuthenticated(homeDir, log) {
-	await syncClaudeCredentialFile(homeDir, log);
-	let fileExpiry;
-	let filePresent = false;
-	try {
-		fileExpiry = credentialFileExpiry(await readFile(join(homeDir, ".credentials.json"), "utf8"));
-		filePresent = true;
-	} catch {}
-	if (filePresent) return fileExpiry === void 0 || fileExpiry > Date.now();
-	let text;
-	try {
-		text = await readFile(join(homeDir, ".claude.json"), "utf8");
-	} catch (error) {
-		if (error.code === "ENOENT") return false;
-		throw error;
-	}
-	let config;
-	try {
-		config = JSON.parse(text);
-	} catch {
-		return false;
-	}
-	if (config.oauthAccount === void 0 || config.oauthAccount === null) return false;
-	const expiry = await readCredentialExpiry(homeDir);
-	return expiry === void 0 || expiry > Date.now();
+function delay(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 /**
-* Parse the head of a session file for the listing fields. The first `user`
-* event carries `sessionId`, `cwd`, and `timestamp`; its `cwd` is the only
-* trustworthy workspace source (the directory slug is lossy). Unknown or
-* malformed values yield an undefined record rather than failing the list.
-* @param text - the raw session file head (only the head is read).
-* @returns the record, or undefined when no user event is found.
+* One resident stream-json process: the NDJSON frame pump, the session id it
+* carries, the per-session turn chain (one turn at a time — claude queues
+* stdin user messages, but the cancelled turn's result must land before the
+* next turn's message goes out, keeping the stop-then-rephrase gesture's
+* streams unambiguous), and the reclaim ladder (stdin EOF → grace → SIGTERM).
 */
-function projectRecord(text) {
-	for (const raw of text.split("\n")) {
-		const line = raw.trim();
-		if (line === "") continue;
-		let event;
-		try {
-			event = JSON.parse(line);
-		} catch {
-			continue;
-		}
-		if (event.type !== "user") continue;
-		if (typeof event.sessionId !== "string" || event.sessionId === "") return void 0;
-		if (typeof event.cwd !== "string") return void 0;
-		const record = {
-			id: event.sessionId,
-			workDir: event.cwd
-		};
-		const startedAt = typeof event.timestamp === "string" ? Date.parse(event.timestamp) : void 0;
-		if (startedAt !== void 0 && Number.isFinite(startedAt)) record.startedAt = startedAt;
-		return record;
+var ClaudeLiveRuntime = class {
+	child;
+	warn;
+	dead = false;
+	reclaimed = false;
+	/** The member's claude session id (first turn's system/init). */
+	sessionId;
+	/** The model this runtime's process was spawned with (undefined = no flag). */
+	configurationKey;
+	model;
+	/** Serializes turns per member (converge-before-next-message). */
+	turnChain = Promise.resolve();
+	/** The active round's event sink; installed per round, cleared at settle. */
+	onEvent;
+	controls = new ClaudeControlRequests((message) => this.send(message));
+	onDead;
+	buffer = "";
+	decoder = new StringDecoder("utf8");
+	stderrTail = "";
+	stderrDecoder = new StringDecoder("utf8");
+	constructor(child, warn) {
+		this.child = child;
+		this.warn = warn;
+		child.stdout?.on("data", (chunk) => {
+			this.feed(this.decoder.write(chunk));
+		});
+		child.stderr?.on("data", (chunk) => {
+			this.stderrTail = (this.stderrTail + this.stderrDecoder.write(chunk)).slice(-4096);
+		});
+		child.done.then(() => {
+			this.markDead();
+		}, () => {
+			this.markDead();
+		});
 	}
-}
-/**
-* Read the scoped home's session files. The listing walks the projects
-* directory and reads each jsonl head; a torn or malformed file is skipped
-* rather than failing the whole list.
-* @param homeDir - the `claude-code` harness's scoped home.
-* @returns the parsed records, empty when no sessions exist yet.
-*/
-async function listClaudeSessions(homeDir) {
-	const records = [];
-	let projectDirs;
-	try {
-		projectDirs = await readdir(join(homeDir, PROJECTS_ROOT));
-	} catch (error) {
-		if (error.code === "ENOENT") return [];
-		throw error;
+	get diagnostics() {
+		return this.stderrTail.trim();
 	}
-	for (const projectDir of projectDirs) {
-		let files;
-		try {
-			files = await readdir(join(homeDir, PROJECTS_ROOT, projectDir));
-		} catch {
-			continue;
-		}
-		for (const name of files) {
-			if (!name.endsWith(".jsonl")) continue;
+	feed(text) {
+		this.buffer += text;
+		let index = this.buffer.indexOf("\n");
+		while (index >= 0) {
+			const line = this.buffer.slice(0, index);
+			this.buffer = this.buffer.slice(index + 1);
+			index = this.buffer.indexOf("\n");
+			if (line.trim() === "") continue;
+			let event;
 			try {
-				const handle = await open(join(homeDir, PROJECTS_ROOT, projectDir, name), "r");
-				let text;
-				try {
-					const buffer = Buffer.alloc(HEAD_BYTES);
-					const { bytesRead } = await handle.read(buffer, 0, HEAD_BYTES, 0);
-					text = buffer.subarray(0, bytesRead).toString("utf8");
-				} finally {
-					await handle.close();
-				}
-				const record = projectRecord(text);
-				if (record !== void 0) records.push(record);
+				event = JSON.parse(line);
 			} catch {
+				this.warn("subagent-claude live: ignored a malformed stream line");
 				continue;
 			}
+			try {
+				this.dispatchEvent(event);
+			} catch (error) {
+				this.warn(`subagent-claude live: stream handler failed: ${thrown$1(error).message}`);
+			}
 		}
 	}
-	return records;
-}
-/**
-* Extract the model one transcript names, reading its TAIL (bounded, never
-* the whole conversation) from the newest line backward: the first line
-* carrying a model wins — the top-level `model` of the stream-json init
-* event's shape, or the nested `message.model` of an assistant line. Newest
-* first because a session's later rounds may run a different model than its
-* first, and "what ran last" is the question the caller asks. A torn final
-* line is skipped, never failed on.
-* @param path - the transcript file.
-* @returns the model identifier, or undefined when the window names none.
-*/
-async function transcriptFileModel(path) {
-	let text;
-	try {
-		const handle = await open(path, "r");
-		try {
-			const { size } = await handle.stat();
-			const length = Math.min(size, TRANSCRIPT_TAIL_BYTES);
-			const buffer = Buffer.alloc(length);
-			const { bytesRead } = await handle.read(buffer, 0, length, Math.max(0, size - length));
-			text = buffer.subarray(0, bytesRead).toString("utf8");
-		} finally {
-			await handle.close();
+	dispatchEvent(event) {
+		if (this.controls.accept(event)) return;
+		if (event["type"] === "control_request") {
+			this.answerControlRequest(event);
+			return;
 		}
-	} catch {
-		return;
+		this.onEvent?.(event);
 	}
-	const lines = text.split("\n");
-	for (let index = lines.length - 1; index >= 0; index -= 1) {
-		const line = lines[index].trim();
-		if (line === "") continue;
-		let event;
-		try {
-			event = JSON.parse(line);
-		} catch {
-			continue;
+	/**
+	* Answer a server→client control request so the runtime never hangs on
+	* one. A `permissionMode: 'normal'` spawn omits
+	* `--dangerously-skip-permissions`, so the CLI routes its approval surface
+	* (`can_use_tool`) here — and a subagent has no human to approve. The
+	* auto-allow mirrors the exec path's effective behavior (its one-shot
+	* spawns pre-allow the member bridge tool and otherwise run the same
+	* unattended policy) and the kimi live driver's auto-allow of
+	* `session/request_permission`. Any other subtype answers with an error so
+	* the CLI's own fallback path runs instead of waiting forever.
+	*/
+	answerControlRequest(event) {
+		const requestId = event["request_id"];
+		if (typeof requestId !== "string") return;
+		const request = event["request"];
+		const subtype = request?.["subtype"];
+		if (subtype === "can_use_tool") {
+			const input = request?.["input"];
+			this.send({
+				type: "control_response",
+				response: {
+					subtype: "success",
+					request_id: requestId,
+					response: {
+						behavior: "allow",
+						updatedInput: typeof input === "object" && input !== null ? input : {}
+					}
+				}
+			});
+			return;
 		}
-		if (typeof event.model === "string" && event.model !== "") return event.model;
-		if (typeof event.message?.model === "string" && event.message.model !== "") return event.message.model;
+		this.send({
+			type: "control_response",
+			response: {
+				subtype: "error",
+				request_id: requestId,
+				error: `subagent-claude live: unsupported control request ${String(subtype)}`
+			}
+		});
 	}
-}
-/** The project directories under one scoped home, capped; empty on any failure. */
-async function projectDirs(homeDir) {
-	try {
-		return (await readdir(join(homeDir, PROJECTS_ROOT))).slice(0, TRANSCRIPT_SCAN_DIRS);
-	} catch {
-		return [];
+	/** Write one stdin frame. */
+	send(message) {
+		this.child.stdin?.write(JSON.stringify(message) + "\n");
 	}
-}
-/** The jsonl file names inside one project directory; empty on any failure. */
-async function projectFiles(homeDir, projectDir) {
-	try {
-		return (await readdir(join(homeDir, PROJECTS_ROOT, projectDir))).filter((name) => name.endsWith(".jsonl"));
-	} catch {
-		return [];
+	/** Native initialization and model binding precede any user prompt. */
+	async configure(configuration, signal) {
+		const entry = claudeDirectory(await this.controls.request({
+			subtype: "initialize",
+			hooks: {}
+		}, signal)).entries.find((entry) => entry.value === configuration.model || entry.resolvedModel === configuration.model);
+		if (configuration.effort !== void 0 && !entry?.reasoning?.options.some((option) => option.value === configuration.effort)) throw new Error("The running Claude CLI does not advertise the requested model/effort combination");
+		if (configuration.model !== void 0) await this.controls.request({
+			subtype: "set_model",
+			model: configuration.model
+		}, signal);
 	}
-}
-/**
-* Whether a sidechain (`agent-*.jsonl`) transcript belongs to one session:
-* its head lines carry the PARENT session's id (`isSidechain: true`). Only
-* the bounded head is read.
-*/
-async function sidechainSessionMatches(path, cliSessionId) {
-	let text;
-	try {
-		const handle = await open(path, "r");
-		try {
-			const buffer = Buffer.alloc(HEAD_BYTES);
-			const { bytesRead } = await handle.read(buffer, 0, HEAD_BYTES, 0);
-			text = buffer.subarray(0, bytesRead).toString("utf8");
-		} finally {
-			await handle.close();
-		}
-	} catch {
-		return false;
+	/** The graceful runtime interrupt, bounded and checked for an actual success ack. */
+	async interrupt() {
+		if (this.dead) return;
+		await this.controls.request({ subtype: "interrupt" });
 	}
-	for (const raw of text.split("\n")) {
-		const line = raw.trim();
-		if (line === "") continue;
-		try {
-			if (JSON.parse(line).sessionId === cliSessionId) return true;
-		} catch {
-			continue;
-		}
+	markDead() {
+		if (this.dead) return;
+		this.dead = true;
+		this.controls.close();
+		this.onDead?.();
 	}
-	return false;
-}
-/**
-* The model a member's OWN CLI transcript names — the history backstop for
-* the broker's `lastObserved` when no delegation record observed one (every
-* member whose rounds predate the live-settle report). The live-settle
-* channel remains primary (the record's `observedModel` wins when present);
-* this reader only answers "what did this session last run" from the CLI's
-* own files, read-only — nothing is backfilled into `delegations.jsonl`.
-*
-* Location rule: with `cliSessionId`, the main transcript
-* `projects/<cwd-slug>/<cliSessionId>.jsonl` (found by NAME across the
-* project dirs — the slug is lossy, so it is never computed); when it is
-* absent, a sidechain `agent-*.jsonl` whose head names the session id
-* (bounded candidate count) answers instead. Without `cliSessionId` (the
-* settings card's memberless read), the NEWEST transcript across the
-* projects tree (mtime, bounded dir/file scan) answers; a newest file that
-* names no model yields to the next, up to a few tries. Every failure —
-* missing tree, unreadable file, no model in the read window — is
-* `undefined`, never a throw.
-* @param homeDir - the `claude-code` harness's scoped home.
-* @param cliSessionId - the delegation record's CLI session id, when the
-*   member's own transcript is wanted.
-* @returns the model identifier, or undefined.
-*/
-async function readClaudeTranscriptModel(homeDir, cliSessionId) {
-	if (cliSessionId !== void 0) {
-		let main;
-		const sidechains = [];
-		for (const projectDir of await projectDirs(homeDir)) for (const name of await projectFiles(homeDir, projectDir)) {
-			if (name === `${cliSessionId}.jsonl` && main === void 0) {
-				main = join(homeDir, PROJECTS_ROOT, projectDir, name);
-				continue;
-			}
-			if (name.startsWith("agent-") && sidechains.length < TRANSCRIPT_SIDECHAIN_FILES) sidechains.push(join(homeDir, PROJECTS_ROOT, projectDir, name));
-		}
-		if (main !== void 0) {
-			const model = await transcriptFileModel(main);
-			if (model !== void 0) return model;
+	/** Graceful teardown: EOF stdin, grace, then the terminate ladder. */
+	async reclaim() {
+		if (this.reclaimed) return;
+		this.reclaimed = true;
+		if (!this.dead) {
+			this.child.stdin?.end();
+			await Promise.race([this.child.done.catch(() => {}), delay(RECLAIM_EOF_GRACE_MS)]);
 		}
-		for (const path of sidechains) if (await sidechainSessionMatches(path, cliSessionId)) {
-			const model = await transcriptFileModel(path);
-			if (model !== void 0) return model;
+		if (!this.dead) {
+			this.child.terminate();
+			await this.child.waitForExit();
 		}
-		return;
+		await this.child.done.catch(() => {});
+		this.markDead();
 	}
-	const candidates = [];
-	let scanned = 0;
-	for (const projectDir of await projectDirs(homeDir)) for (const name of await projectFiles(homeDir, projectDir)) {
-		if (scanned >= TRANSCRIPT_SCAN_FILES) break;
-		scanned += 1;
-		const path = join(homeDir, PROJECTS_ROOT, projectDir, name);
-		try {
-			candidates.push({
-				path,
-				mtimeMs: (await stat(path)).mtimeMs
-			});
-		} catch {
-			continue;
-		}
-	}
-	candidates.sort((a, b) => b.mtimeMs - a.mtimeMs);
-	for (const candidate of candidates.slice(0, TRANSCRIPT_NEWEST_TRIES)) {
-		const model = await transcriptFileModel(candidate.path);
-		if (model !== void 0) return model;
-	}
-}
-//#endregion
-//#region lib/types/live-driver.js
-/**
-* The claude provider's live driver: one resident Claude Code stream-json
-* process per member (child session), driven over the vendor's
-* `--input-format stream-json --output-format stream-json` realtime mode
-* (protocol-probed against claude 2.1.236; the Agent SDK's streaming-input
-* mode is this same channel, driven here directly so no SDK dependency
-* lands). A delegation round is one `user` message on the resident process's
-* stdin instead of a fresh `claude -p` — which buys what the process boundary
-* could not: runtime-level graceful interrupt (`control_request
-* {subtype:'interrupt'}`; the process survives and the session stays
-* continuable) and the same-shape push stream folded live per turn.
-*
-* Auth discipline (a hard requirement): the resident process runs under the
-* family's scoped `CLAUDE_CONFIG_DIR` and nothing else — the OAuth marker in
-* the scoped `.claude.json` and the keychain entry hashed to that path are
-* exactly what the exec mode's one-shot processes already use. The driver
-* never touches the user's global `~/.claude`, never runs any `auth` verb,
-* and only adds `ANTHROPIC_BASE_URL` when the plugin config supplies it (the
-* exec path's exact env rule).
-*
-* Protocol facts (all probed): the first stdin `user` message triggers
-* `system/init` carrying the server-assigned session id (EVERY turn emits a
-* fresh init — the delegation records the first one); each turn closes with
-* a `result` event (`is_error`, usage, session id); the interrupt control
-* request answers with a `control_response` success; a new process with
-* `--resume <session_id>` reattaches the on-disk session in the same mode
-* (crash recovery); stdin EOF quiesces the process (the reclaim ladder).
-*
-* Fold: the resident stream speaks the exec path's exact event vocabulary
-* (`system`/`assistant`/`user`/`result`), so each turn folds through the
-* shared `ClaudeStreamParser` with the exec live mirror's hold-back rule (the
-* volatile last line waits for `result`, which carries the round's usage).
-* Every line folds 1:1. The always-enabled
-* `--include-partial-messages` adds incremental output on top: each `stream_event` partial accumulates into its kind's
-* stream (native message id + block index, with ordered legacy fallback),
-* which reserves a (turn, step) at its first delta and
-* appends throttled snapshot `assistant/message`s there — the host folds
-* repeated settles at one coordinate into one live-updating chat node, the
-* only streaming channel left after 0.1.5 retired the durable per-chunk
-* event. A streamed line's completion folds at its stream's reserved step and
-* finalizes it (no duplicated content); a stream whose completion never
-* arrives is force-finalized at settle (interrupted on a non-completed round,
-* so a cancelled turn reads 已停止 legitimately), the last one carrying the
-* round's usage when no folded line did.
-*
-* Lifecycle mirrors M1–M3's discipline: lazy spawn, one in-flight spawn per
-* member, idle-timeout reclaim (stdin EOF → grace → SIGTERM ladder), crash
-* re-spawn with `--resume`, a channel breaker with cooldown, `disposeAll` on
-* unload, and cancellation honored in every window (abort listener before
-* any await; the init wait races the abort signal).
-*
-* Two member-aware additions on top: the spawn binds the member's EFFECTIVE
-* model (session-level override, then the round's delegation model, then the
-* settings key — resolved by the config callback per spawn, scratched into
-* the scoped settings.json because a `--resume` respawn honors the file over
-* the flag), and a runtime whose bound model no longer matches is retired so
-* the round respawns onto the right one; and server→client control requests
-* (a `permissionMode: 'normal'` spawn's `can_use_tool` approval surface) are
-* auto-answered so an unattended runtime never hangs on a permission prompt.
-* @module @khorsheed/dsh-local-agent-claude-code/live-driver
-*/
-/** Default idle lifetime of an unused resident runtime before reclaim. */
-const DEFAULT_LIVE_IDLE_MS = 18e5;
-/** Default timeout for the turn's system/init ack (a cold boot can be slow). */
-const DEFAULT_LIVE_INIT_TIMEOUT_MS = 6e4;
-/** Bounded wait for an interrupted turn to converge while a run disposes. */
-const DEFAULT_LIVE_DISPOSE_CONVERGE_MS = 5e3;
-/** How long a tripped channel breaker stays on the exec fallback. */
-const DEFAULT_LIVE_CHANNEL_RETRY_MS = 3e5;
-/** Grace between stdin EOF and SIGTERM when reclaiming a stream-json process. */
-const RECLAIM_EOF_GRACE_MS = 1e3;
-/** Default minimum interval between one streaming kind's snapshot messages. */
-const DEFAULT_SNAPSHOT_MIN_INTERVAL_MS = LIVE_FLUSH_INTERVAL_MS;
-/**
-* The stream-json channel could not come up (spawn failure or the first
-* turn's init never arrived). The provider catches exactly this and falls
-* back to the exec one-shot; any other error is a real round failure.
-*/
-var LiveChannelUnavailableError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "LiveChannelUnavailableError";
-	}
-};
-const DEFAULT_TIMEOUTS = {
-	initMs: DEFAULT_LIVE_INIT_TIMEOUT_MS,
-	convergeMs: DEFAULT_LIVE_DISPOSE_CONVERGE_MS,
-	channelRetryMs: DEFAULT_LIVE_CHANNEL_RETRY_MS
 };
-function thrown$1(value) {
-	return value instanceof Error ? value : new Error(String(value));
-}
-function delay(ms) {
-	return new Promise((resolve) => setTimeout(resolve, ms));
-}
 /**
-* One resident stream-json process: the NDJSON frame pump, the session id it
-* carries, the per-session turn chain (one turn at a time — claude queues
-* stdin user messages, but the cancelled turn's result must land before the
-* next turn's message goes out, keeping the stop-then-rephrase gesture's
-* streams unambiguous), and the reclaim ladder (stdin EOF → grace → SIGTERM).
+* The claude live driver owns every resident stream-json runtime of this
+* provider generation. Created only when `live: true`; disposed with the
+* plugin.
 */
-var ClaudeLiveRuntime = class {
-	child;
-	warn;
-	dead = false;
-	reclaimed = false;
-	/** The member's claude session id (first turn's system/init). */
-	sessionId;
-	/** The model this runtime's process was spawned with (undefined = no flag). */
-	configurationKey;
-	model;
-	/** Serializes turns per member (converge-before-next-message). */
-	turnChain = Promise.resolve();
-	/** The active round's event sink; installed per round, cleared at settle. */
-	onEvent;
-	controls = new ClaudeControlRequests((message) => this.send(message));
-	onDead;
-	buffer = "";
-	decoder = new StringDecoder("utf8");
-	stderrTail = "";
-	stderrDecoder = new StringDecoder("utf8");
-	constructor(child, warn) {
-		this.child = child;
-		this.warn = warn;
-		child.stdout?.on("data", (chunk) => {
-			this.feed(this.decoder.write(chunk));
-		});
-		child.stderr?.on("data", (chunk) => {
-			this.stderrTail = (this.stderrTail + this.stderrDecoder.write(chunk)).slice(-4096);
-		});
-		child.done.then(() => {
-			this.markDead();
-		}, () => {
-			this.markDead();
-		});
-	}
-	get diagnostics() {
-		return this.stderrTail.trim();
+var ClaudeLiveDriver = class {
+	ctx;
+	config;
+	timeouts;
+	runtimes = /* @__PURE__ */ new Map();
+	ensuring = /* @__PURE__ */ new Map();
+	idleTimers = /* @__PURE__ */ new Map();
+	/** Per-member round serialization (the resume lock covers resume-vs-resume only). */
+	roundChains = /* @__PURE__ */ new Map();
+	channelBrokenAt;
+	disposed = false;
+	/**
+	* Set by drain() (a settings-driven generation handoff): new rounds are
+	* refused so the provider falls back to exec, while in-flight rounds finish
+	* on their runtime undisturbed. Unlike `disposed`, the driver still serves
+	* what it already accepted.
+	*/
+	draining = false;
+	disposeController = new AbortController();
+	constructor(ctx, config, timeouts = DEFAULT_TIMEOUTS) {
+		this.ctx = ctx;
+		this.config = config;
+		this.timeouts = timeouts;
 	}
-	feed(text) {
-		this.buffer += text;
-		let index = this.buffer.indexOf("\n");
-		while (index >= 0) {
-			const line = this.buffer.slice(0, index);
-			this.buffer = this.buffer.slice(index + 1);
-			index = this.buffer.indexOf("\n");
-			if (line.trim() === "") continue;
-			let event;
-			try {
-				event = JSON.parse(line);
-			} catch {
-				this.warn("subagent-claude live: ignored a malformed stream line");
-				continue;
-			}
-			try {
-				this.dispatchEvent(event);
-			} catch (error) {
-				this.warn(`subagent-claude live: stream handler failed: ${thrown$1(error).message}`);
-			}
-		}
+	/** Whether the channel is in its post-failure cooldown (rounds fall back to exec). */
+	get disabled() {
+		return this.channelBrokenAt !== void 0 && Date.now() - this.channelBrokenAt < (this.timeouts.channelRetryMs ?? 3e5);
 	}
-	dispatchEvent(event) {
-		if (this.controls.accept(event)) return;
-		if (event["type"] === "control_request") {
-			this.answerControlRequest(event);
-			return;
-		}
-		this.onEvent?.(event);
+	/** Count of resident runtimes currently registered (zombie accounting in tests). */
+	get liveCount() {
+		return this.runtimes.size;
 	}
 	/**
-	* Answer a server→client control request so the runtime never hangs on
-	* one. A `permissionMode: 'normal'` spawn omits
-	* `--dangerously-skip-permissions`, so the CLI routes its approval surface
-	* (`can_use_tool`) here — and a subagent has no human to approve. The
-	* auto-allow mirrors the exec path's effective behavior (its one-shot
-	* spawns pre-allow the member bridge tool and otherwise run the same
-	* unattended policy) and the kimi live driver's auto-allow of
-	* `session/request_permission`. Any other subtype answers with an error so
-	* the CLI's own fallback path runs instead of waiting forever.
+	* True while the member's runtime exists or is being spawned. The settings
+	* controller gates a new generation on this: a fresh driver must not serve
+	* a member whose retiring generation still hosts the (same) claude session.
 	*/
-	answerControlRequest(event) {
-		const requestId = event["request_id"];
-		if (typeof requestId !== "string") return;
-		const request = event["request"];
-		const subtype = request?.["subtype"];
-		if (subtype === "can_use_tool") {
-			const input = request?.["input"];
-			this.send({
-				type: "control_response",
-				response: {
-					subtype: "success",
-					request_id: requestId,
-					response: {
-						behavior: "allow",
-						updatedInput: typeof input === "object" && input !== null ? input : {}
-					}
-				}
-			});
-			return;
-		}
-		this.send({
-			type: "control_response",
-			response: {
-				subtype: "error",
-				request_id: requestId,
-				error: `subagent-claude live: unsupported control request ${String(subtype)}`
-			}
-		});
-	}
-	/** Write one stdin frame. */
-	send(message) {
-		this.child.stdin?.write(JSON.stringify(message) + "\n");
-	}
-	/** Native initialization and model binding precede any user prompt. */
-	async configure(configuration, signal) {
-		const entry = claudeDirectory(await this.controls.request({
-			subtype: "initialize",
-			hooks: {}
-		}, signal)).entries.find((entry) => entry.value === configuration.model || entry.resolvedModel === configuration.model);
-		if (configuration.effort !== void 0 && !entry?.reasoning?.options.some((option) => option.value === configuration.effort)) throw new Error("The running Claude CLI does not advertise the requested model/effort combination");
-		if (configuration.model !== void 0) await this.controls.request({
-			subtype: "set_model",
-			model: configuration.model
-		}, signal);
-	}
-	/** The graceful runtime interrupt, bounded and checked for an actual success ack. */
-	async interrupt() {
-		if (this.dead) return;
-		await this.controls.request({ subtype: "interrupt" });
-	}
-	markDead() {
-		if (this.dead) return;
-		this.dead = true;
-		this.controls.close();
-		this.onDead?.();
-	}
-	/** Graceful teardown: EOF stdin, grace, then the terminate ladder. */
-	async reclaim() {
-		if (this.reclaimed) return;
-		this.reclaimed = true;
-		if (!this.dead) {
-			this.child.stdin?.end();
-			await Promise.race([this.child.done.catch(() => {}), delay(RECLAIM_EOF_GRACE_MS)]);
-		}
-		if (!this.dead) {
-			this.child.terminate();
-			await this.child.waitForExit();
-		}
-		await this.child.done.catch(() => {});
-		this.markDead();
-	}
-};
-/**
-* The claude live driver owns every resident stream-json runtime of this
-* provider generation. Created only when `live: true`; disposed with the
-* plugin.
-*/
-var ClaudeLiveDriver = class {
-	ctx;
-	config;
-	timeouts;
-	runtimes = /* @__PURE__ */ new Map();
-	ensuring = /* @__PURE__ */ new Map();
-	idleTimers = /* @__PURE__ */ new Map();
-	/** Per-member round serialization (the resume lock covers resume-vs-resume only). */
-	roundChains = /* @__PURE__ */ new Map();
-	channelBrokenAt;
-	disposed = false;
-	/**
-	* Set by drain() (a settings-driven generation handoff): new rounds are
-	* refused so the provider falls back to exec, while in-flight rounds finish
-	* on their runtime undisturbed. Unlike `disposed`, the driver still serves
-	* what it already accepted.
-	*/
-	draining = false;
-	disposeController = new AbortController();
-	constructor(ctx, config, timeouts = DEFAULT_TIMEOUTS) {
-		this.ctx = ctx;
-		this.config = config;
-		this.timeouts = timeouts;
-	}
-	/** Whether the channel is in its post-failure cooldown (rounds fall back to exec). */
-	get disabled() {
-		return this.channelBrokenAt !== void 0 && Date.now() - this.channelBrokenAt < (this.timeouts.channelRetryMs ?? 3e5);
-	}
-	/** Count of resident runtimes currently registered (zombie accounting in tests). */
-	get liveCount() {
-		return this.runtimes.size;
-	}
-	/**
-	* True while the member's runtime exists or is being spawned. The settings
-	* controller gates a new generation on this: a fresh driver must not serve
-	* a member whose retiring generation still hosts the (same) claude session.
-	*/
-	hasRuntime(key) {
-		return this.runtimes.has(key) || this.ensuring.has(key);
+	hasRuntime(key) {
+		return this.runtimes.has(key) || this.ensuring.has(key);
 	}
 	/** @deprecated Compatibility no-op: live output is always incremental. */
 	setLiveMirrorGranularity(_granularity) {}
@@ -1238,9 +893,7 @@ var ClaudeLiveDriver = class {
 	async spawnRuntime(spec, signal) {
 		const key = String(spec.childSession.id);
 		if (this.disposed) throw new LiveChannelUnavailableError("the live driver is disposed");
-		await syncClaudeCredentialFile(spec.homeDir, (message) => {
-			this.ctx.logger.warn(message);
-		}).catch(() => false);
+		const endpoint = await this.config.endpoint?.(spec.homeDir);
 		const member = registerClaudeMemberRun(this.ctx, String(spec.childSession.id), spec.parentSessionId);
 		const model = this.spawnModel(key, spec);
 		if (spec.configuration === void 0 && this.config.provisionModel !== void 0) await this.config.provisionModel(spec.homeDir, model).catch(() => void 0);
@@ -1275,7 +928,7 @@ var ClaudeLiveDriver = class {
 			env: delegationEnv({
 				CLAUDE_CONFIG_DIR: spec.homeDir,
 				...spec.configuration === void 0 ? {} : { CLAUDE_CODE_EFFORT_LEVEL: spec.configuration.effort ?? "auto" },
-				...this.config.baseUrl === void 0 ? {} : { ANTHROPIC_BASE_URL: this.config.baseUrl }
+				...endpointAuthEnv(endpoint)
 			})
 		};
 		let child;
@@ -1795,7 +1448,7 @@ var ClaudeLiveDriver = class {
 		});
 		await Promise.race([accepted, abortBranch.catch(() => void 0)]);
 		return subprocessRunHandle({
-			id: childSession.id,
+			id: SessionId(randomUUID()),
 			result,
 			signal: request.signal,
 			onAbort,
@@ -1829,10 +1482,13 @@ var ClaudeLiveDriver = class {
 const DEFAULT_DISPOSE_GRACE_MS = 3e3;
 /**
 * Auth-shaped failure signatures in claude's result error or stderr: the
-* endpoint rejected the credential (401/403, revoked token). Narrow on
-* purpose — matched against provider-controlled error strings only.
+* endpoint rejected the credential (401/403, revoked key). Matches the CLI's
+* own phrasing ("Failed to authenticate. API Error: 401 …", the
+* `authentication_failed` error tag) plus the relay phrasings seen in the
+* wild ("invalid x-api-key" and friends). Narrow on purpose — matched against
+* provider-controlled error strings only.
 */
-const CLAUDE_AUTH_FAILURE = /failed to authenticate|authentication_failed|oauth access token/i;
+const CLAUDE_AUTH_FAILURE = /failed to authenticate|authentication_failed|oauth access token|invalid (x-api-key|api key|authentication token)|api error: 40[13]/i;
 /** Register one member run with the channel; see {@link ClaudeMemberRunHandle}. */
 function registerClaudeMemberRun(ctx, childSessionId, parentSessionId) {
 	const registry = ctx.localAgent;
@@ -1907,7 +1563,7 @@ function claudeCliVersion(ctx, homeDir) {
 var ClaudeCliProvider = class {
 	ctx;
 	permissionMode;
-	baseUrl;
+	endpoint;
 	live;
 	model;
 	name = "claude-local";
@@ -1918,6 +1574,11 @@ var ClaudeCliProvider = class {
 	*   generation's driver per member (the settings toggle swaps generations;
 	*   a resolver may return undefined to steer one member's round to exec
 	*   while a retiring generation still hosts it).
+	* @param endpoint - resolver for the round's endpoint credential (endpoint-auth.ts:
+	*   the scope's endpoint-auth.json over the plugin config triple), read PER
+	*   ROUND against the round's scoped home, so a key rotation or a profile
+	*   edit takes effect on the next delegation without a reload. Absent, no
+	*   `ANTHROPIC_*` variables reach the child at all.
 	* @param model - resolver for the member's effective model, read PER ROUND
 	*   so a settings-card write or a composer switch takes effect on the next
 	*   delegation without a reload. Receives the member (the child session id)
@@ -1926,10 +1587,10 @@ var ClaudeCliProvider = class {
 	*   resolver not passed), the delegation's own model still rides, exactly
 	*   as before the key existed.
 	*/
-	constructor(ctx, permissionMode = "skip", baseUrl, live, model) {
+	constructor(ctx, permissionMode = "skip", endpoint, live, model) {
 		this.ctx = ctx;
 		this.permissionMode = permissionMode;
-		this.baseUrl = baseUrl;
+		this.endpoint = endpoint;
 		this.live = live;
 		this.model = model;
 	}
@@ -1971,7 +1632,7 @@ var ClaudeCliProvider = class {
 				...record?.configurationLock === void 0 ? {} : { configurationLock: record.configurationLock }
 			}, (configuration) => this.startClaudeResume(request, intent, cwd, homeDir, exec, scope, record?.model, configuration), request.signal, intent?.onAdmitted);
 		}
-		const childSessionId = SessionId(intent?.preparedMemberId ?? randomUUID());
+		const childSessionId = SessionId(intent?.preparedMemberId ?? intent?.childSessionId ?? randomUUID());
 		if (typeof this.ctx.localAgent.withMemberConfigurationRound !== "function") {
 			if (intent?.effort !== void 0) throw new Error("Claude effort requires the configuration admission core");
 			return this.startClaudeFresh(request, cwd, homeDir, exec, scope, intent?.model, childSessionId);
@@ -2000,18 +1661,22 @@ var ClaudeCliProvider = class {
 				delegationDepth: (request.parent.session.header.delegationDepth ?? 0) + 1
 			} });
 			const harness = this.ctx.localAgent.get("claude-code");
-			const label = subagentDelegationLabel(harness?.displayName ?? "Claude Code", request.descriptor.label);
+			const label = subagentDelegationLabel(harness?.displayName ?? "Claude Code", request.label || void 0);
 			childSession.append("subagent/descriptor", {
-				...request.descriptor,
+				version: SUBAGENT_DESCRIPTOR_VERSION,
+				mode: "one-shot",
+				provider: this.name,
 				label
 			});
 			establishSubagentCatalogChild(request.parent.session, childSession.header, label);
 		} catch (error) {
 			this.ctx.logger.warn(`subagent-claude: subagent session record failed: ${error instanceof Error ? error.message : String(error)}`);
 		}
-		const effectiveBaseUrl = this.baseUrl ?? process.env.ANTHROPIC_BASE_URL;
+		const endpoint = await this.endpoint?.(homeDir);
+		const effectiveBaseUrl = endpoint?.baseUrl;
 		this.ctx.logger.info(`subagent-claude: delegating via ${effectiveBaseUrl ?? "claude default endpoint"}`);
 		const live = exec === void 0 ? this.liveDriver(runId) : void 0;
+		const round = configuration?.resolved ?? this.roundModel(runId, requestedModel);
 		if (live !== void 0 && childSession !== void 0 && !live.disabled) try {
 			return await live.startRound(request, {
 				cwd,
@@ -2028,7 +1693,7 @@ var ClaudeCliProvider = class {
 						cliSessionId: sessionId,
 						cwd,
 						...scope === void 0 ? {} : { scope },
-						...requestedModel === void 0 ? {} : { model: requestedModel }
+						...round.model === void 0 ? {} : { model: round.model }
 					});
 				}
 			});
@@ -2042,12 +1707,12 @@ var ClaudeCliProvider = class {
 				cwd,
 				env: delegationEnv({
 					CLAUDE_CONFIG_DIR: homeDir,
-					...this.baseUrl === void 0 ? {} : { ANTHROPIC_BASE_URL: this.baseUrl }
+					...endpointAuthEnv(endpoint)
 				}),
 				...exec === void 0 ? {} : { exec },
 				endpointLabel: effectiveBaseUrl,
 				permissionMode: this.permissionMode,
-				...configuration?.resolved ?? this.roundModel(runId, requestedModel),
+				...round,
 				...configuration === void 0 ? {} : { controlled: true },
 				disposeGraceMs: DEFAULT_DISPOSE_GRACE_MS,
 				spawn: (spec) => this.ctx.subprocess.spawn(spec),
@@ -2076,7 +1741,7 @@ var ClaudeCliProvider = class {
 						cliSessionId: sessionId,
 						cwd,
 						...scope === void 0 ? {} : { scope },
-						...requestedModel === void 0 ? {} : { model: requestedModel }
+						...round.model === void 0 ? {} : { model: round.model }
 					});
 				},
 				onRoundSettled: (round) => {
@@ -2121,7 +1786,8 @@ var ClaudeCliProvider = class {
 				if (!(error instanceof LiveChannelUnavailableError) || request.signal.aborted) throw error;
 				this.ctx.logger.warn(`subagent-claude: live driver unavailable, using the exec one-shot: ${error.message}`);
 			}
-			const effectiveBaseUrl = this.baseUrl ?? process.env.ANTHROPIC_BASE_URL;
+			const endpoint = await this.endpoint?.(homeDir);
+			const effectiveBaseUrl = endpoint?.baseUrl;
 			this.ctx.logger.info(`subagent-claude: resuming via ${effectiveBaseUrl ?? "claude default endpoint"}`);
 			const member = exec === void 0 ? this.memberRun(intent.childSessionId, request.parent.session.id) : void 0;
 			let run;
@@ -2130,7 +1796,7 @@ var ClaudeCliProvider = class {
 					cwd,
 					env: delegationEnv({
 						CLAUDE_CONFIG_DIR: homeDir,
-						...this.baseUrl === void 0 ? {} : { ANTHROPIC_BASE_URL: this.baseUrl }
+						...endpointAuthEnv(endpoint)
 					}),
 					...exec === void 0 ? {} : { exec },
 					endpointLabel: effectiveBaseUrl,
@@ -2644,10 +2310,6 @@ function usageFromClaude(usage) {
 async function startClaudeCliRun(request, spec) {
 	const task = textTask(request.prompt);
 	if (request.signal.aborted) throw new Error("subagent-claude: request was aborted before the CLI started");
-	const configDir = spec.env["CLAUDE_CONFIG_DIR"];
-	if (configDir !== void 0) await syncClaudeCredentialFile(configDir, (message) => {
-		spec.ctx?.logger.warn(message);
-	}).catch(() => false);
 	const turn = spec.resume?.turn ?? 1;
 	const memberArgv = spec.member === void 0 ? [] : [
 		"--mcp-config",
@@ -2824,7 +2486,7 @@ async function startClaudeCliRun(request, spec) {
 		return mirrorClaudeAfterExit(spec, task, turn, output, liveMirror);
 	}, () => {});
 	return Promise.resolve(subprocessRunHandle({
-		id: spec.childSession?.id ?? SessionId(randomUUID()),
+		id: SessionId(randomUUID()),
 		result,
 		signal: request.signal,
 		onAbort,
@@ -3036,503 +2698,787 @@ async function appendClaudeResponse(spec, task, turn, parsed, fromLines = 0, use
 		});
 		step += 1;
 	}
-	if (parsed.usage !== void 0 && usageIndex !== -1 && usageIndex < fromLines) spec.ctx.logger.warn(`subagent-claude: round ${turn} usage arrived after its carrier line was mirrored; the accounting is dropped`);
-	await persistChildSession(spec.ctx, childSession);
-	localAgent?.reportRunProgress(childSession.id, {
-		kind: "mirror",
-		mirroredLines: parsed.lines.length
-	});
-}
-/**
-* Mirror the claude stream-json into the child session AFTER the CLI process
-* has exited, whatever its stop reason. A cancelled or failed round still
-* preserves the events the stream already emitted (thinking, tool calls with
-* results, replies, usage) instead of leaving the child blank — the run result
-* settles 'aborted'/'error' at the cancel moment, but claude may have produced
-* content before the kill landed. Also records the session id (fresh rounds)
-* so a later resume can continue the partial session.
-* @param spec - the run spec carrying the child session and host context.
-* @param task - the one-shot task text (the user prompt).
-* @param turn - the round's turn number.
-* @param output - the collected stream-json stdout.
-*/
-async function mirrorClaudeAfterExit(spec, task, turn, output, live) {
-	if (spec.childSession === void 0 || spec.ctx === void 0) return;
-	const childSession = spec.childSession;
-	const work = async () => {
-		const parsed = parseClaudeStreamJson(output);
-		if (spec.resume === void 0) spec.onSessionId?.(parsed.sessionId);
-		if (parsed.todoSkew === true) spec.ctx?.logger.warn("subagent-claude: a TodoWrite call missed the documented input shape; folded as a plain tool line");
-		if (parsed.todos !== void 0) appendTodosIfChanged(childSession, parsed.todos);
-		const fromLines = live?.mirroredLines ?? 0;
-		const userMirrored = live?.userMirrored ?? false;
-		const cliVersion = parsed.cliVersion ?? await spec.cliVersion?.();
-		spec.onRoundSettled?.({
-			...parsed.model === void 0 ? {} : { observedModel: parsed.model },
-			...cliVersion === void 0 ? {} : { cliVersion },
-			...parsed.usage === void 0 ? {} : { usage: parsed.usage },
-			...parsed.toolCalls === void 0 ? {} : { toolCalls: parsed.toolCalls }
-		});
-		if (parsed.lines.length === 0 && !userMirrored) return;
-		const trimmed = parsed.text?.trim();
-		await appendClaudeResponse(spec, task, turn, {
-			lines: parsed.lines,
-			output: trimmed === void 0 || trimmed === "" ? [] : [{
-				type: "text",
-				text: trimmed
-			}],
-			...parsed.usage === void 0 ? {} : { usage: parsed.usage }
-		}, fromLines, userMirrored);
-	};
-	try {
-		if (live === void 0) await work();
-		else await live.enqueue(work);
-	} catch (error) {
-		spec.onError?.(thrown(error), "error");
+	if (parsed.usage !== void 0 && usageIndex !== -1 && usageIndex < fromLines) spec.ctx.logger.warn(`subagent-claude: round ${turn} usage arrived after its carrier line was mirrored; the accounting is dropped`);
+	await persistChildSession(spec.ctx, childSession);
+	localAgent?.reportRunProgress(childSession.id, {
+		kind: "mirror",
+		mirroredLines: parsed.lines.length
+	});
+}
+/**
+* Mirror the claude stream-json into the child session AFTER the CLI process
+* has exited, whatever its stop reason. A cancelled or failed round still
+* preserves the events the stream already emitted (thinking, tool calls with
+* results, replies, usage) instead of leaving the child blank — the run result
+* settles 'aborted'/'error' at the cancel moment, but claude may have produced
+* content before the kill landed. Also records the session id (fresh rounds)
+* so a later resume can continue the partial session.
+* @param spec - the run spec carrying the child session and host context.
+* @param task - the one-shot task text (the user prompt).
+* @param turn - the round's turn number.
+* @param output - the collected stream-json stdout.
+*/
+async function mirrorClaudeAfterExit(spec, task, turn, output, live) {
+	if (spec.childSession === void 0 || spec.ctx === void 0) return;
+	const childSession = spec.childSession;
+	const work = async () => {
+		const parsed = parseClaudeStreamJson(output);
+		if (spec.resume === void 0) spec.onSessionId?.(parsed.sessionId);
+		if (parsed.todoSkew === true) spec.ctx?.logger.warn("subagent-claude: a TodoWrite call missed the documented input shape; folded as a plain tool line");
+		if (parsed.todos !== void 0) appendTodosIfChanged(childSession, parsed.todos);
+		const fromLines = live?.mirroredLines ?? 0;
+		const userMirrored = live?.userMirrored ?? false;
+		const cliVersion = parsed.cliVersion ?? await spec.cliVersion?.();
+		spec.onRoundSettled?.({
+			...parsed.model === void 0 ? {} : { observedModel: parsed.model },
+			...cliVersion === void 0 ? {} : { cliVersion },
+			...parsed.usage === void 0 ? {} : { usage: parsed.usage },
+			...parsed.toolCalls === void 0 ? {} : { toolCalls: parsed.toolCalls }
+		});
+		if (parsed.lines.length === 0 && !userMirrored) return;
+		const trimmed = parsed.text?.trim();
+		await appendClaudeResponse(spec, task, turn, {
+			lines: parsed.lines,
+			output: trimmed === void 0 || trimmed === "" ? [] : [{
+				type: "text",
+				text: trimmed
+			}],
+			...parsed.usage === void 0 ? {} : { usage: parsed.usage }
+		}, fromLines, userMirrored);
+	};
+	try {
+		if (live === void 0) await work();
+		else await live.enqueue(work);
+	} catch (error) {
+		spec.onError?.(thrown(error), "error");
+	}
+}
+//#endregion
+//#region lib/types/live-switch.js
+/**
+* The settings-driven live-driver switch: owns the active driver generation
+* and retires old ones on a settings change, without a plugin reload.
+*
+* Toggle OFF (or unload): the retiring generation is DRAINED, not killed —
+* new rounds are refused (the provider's catch falls back to exec), in-flight
+* rounds finish on their runtime, idle runtimes are reclaimed at once.
+* Toggling ON builds the next generation lazily (no process until the first
+* round). Legacy granularity settings are ignored.
+*
+* @module @khorsheed/dsh-local-agent-claude-code — internal, unit-tested directly.
+*/
+var LiveDriverSwitch = class {
+	ctx;
+	driverBase;
+	liveOn = false;
+	active;
+	/** Retiring generations still draining their in-flight rounds. */
+	draining = /* @__PURE__ */ new Set();
+	unwatch;
+	constructor(ctx, face, driverBase) {
+		this.ctx = ctx;
+		this.driverBase = driverBase;
+		this.apply(face.get());
+		this.unwatch = face.watch((next) => {
+			this.apply(next);
+		});
+	}
+	/**
+	* Resolve the live driver for one round's member (the provider's call
+	* site). A retiring generation still hosting the member gates the new one —
+	* the round falls back to exec rather than double-loading the same claude
+	* session into two processes.
+	*/
+	resolve = (childSessionId) => {
+		if (this.active === void 0) return void 0;
+		for (const retiring of this.draining) if (retiring.hasRuntime(childSessionId)) return void 0;
+		return this.active;
+	};
+	/**
+	* The generation currently hosting the member's runtime — the active one,
+	* or a retiring generation still draining it (the model broker retires the
+	* member's runtime through whichever generation owns it on a model switch).
+	*/
+	hostingDriver(childSessionId) {
+		if (this.active?.hasRuntime(childSessionId) === true) return this.active;
+		for (const retiring of this.draining) if (retiring.hasRuntime(childSessionId)) return retiring;
+	}
+	/** Mirror the resolved settings into the driver generation. */
+	apply(next) {
+		if (next.live === this.liveOn) return;
+		this.liveOn = next.live;
+		const retiring = this.active;
+		this.active = next.live ? new ClaudeLiveDriver(this.ctx, { ...this.driverBase }) : void 0;
+		if (retiring !== void 0) {
+			this.draining.add(retiring);
+			retiring.drain().then(() => {
+				this.draining.delete(retiring);
+			}, (error) => {
+				this.draining.delete(retiring);
+				this.ctx.logger.warn(`local-agent-claude-code: live driver drain failed: ${error instanceof Error ? error.message : String(error)}`);
+			});
+		}
+	}
+	/** Plugin unload: interrupt whatever survives (disposeAll, not drain). */
+	dispose() {
+		this.unwatch();
+		this.active?.disposeAll();
+		for (const retiring of this.draining) retiring.disposeAll();
+		this.draining.clear();
+	}
+};
+//#endregion
+//#region lib/types/provision.js
+/**
+* Claude Code scoped-home provisioning. The harness authenticates by
+* endpoint key (see endpoint-auth.ts), so a scoped home needs nothing beyond
+* the directory itself: `claude -p` scaffolds `.claude.json` on its first
+* run, and the endpoint credential arrives per round through the spawn env
+* (resolved from the scope's endpoint-auth.json over the plugin config).
+* When `proxyUrl` is configured, the scoped `settings.json` gains an env
+* block pointing the CLI's own traffic at it — claude reads proxy settings
+* from this file, so the child works even when the host process environment
+* carries no proxy (a supervisor-spawned instance's env is not the user's
+* shell env).
+* @module @khorsheed/dsh-local-agent-claude-code/provision
+*/
+/** The scoped settings file carrying the CLI's env block. */
+const SCOPED_SETTINGS = "settings.json";
+/**
+* Provision the scoped home directory. Claude creates it lazily on first
+* use, but creating it eagerly keeps the harness's homeDir contract uniform
+* with the other harnesses. Two maintenance duties run here:
+*
+* - Legacy OAuth sweep: the endpoint-key era never reads `.credentials.json`
+*   or the `.claude.json` `oauthAccount` marker — both are deleted so a
+*   pre-migration scoped home carries no dead grant (measured: claude
+*   2.1.296 prefers the env credential over a stored one anyway; the sweep
+*   is hygiene, not priority repair). Other `.claude.json` keys survive.
+* - When `proxyUrl` is configured, the scoped `settings.json` gains an env
+*   block pointing the CLI's own traffic at it — claude reads proxy settings
+*   from this file, so the child works even when the host process environment
+*   carries no proxy (a supervisor-spawned instance's env is not the user's
+*   shell env). An existing settings file is merged, not overwritten; only
+*   the two proxy keys are managed.
+* @param homeDir - the `claude-code` harness's scoped home.
+* @param proxyUrl - optional HTTP proxy URL for the child CLI's traffic.
+*/
+async function provisionClaudeHome(homeDir, proxyUrl) {
+	await mkdir(homeDir, { recursive: true });
+	await sweepLegacyOauth(homeDir);
+	if (proxyUrl === void 0) return;
+	const path = join(homeDir, SCOPED_SETTINGS);
+	let settings = {};
+	try {
+		settings = JSON.parse(await readFile(path, "utf8"));
+	} catch {}
+	const env = settings.env ?? {};
+	if (env.https_proxy === proxyUrl && env.http_proxy === proxyUrl) return;
+	env.https_proxy = proxyUrl;
+	env.http_proxy = proxyUrl;
+	settings.env = env;
+	await writeFile(path, JSON.stringify(settings, void 0, 2) + "\n");
+}
+/**
+* Remove the OAuth era's artifacts from the scoped home: the
+* `.credentials.json` grant file outright, and the `oauthAccount` marker key
+* from `.claude.json` (the file itself carries live CLI state and stays).
+* Idempotent and best-effort per file — a missing or malformed file is
+* simply not a sweep target. The macOS keychain entry is deliberately left
+* alone: the CLI never consults it once an env credential rides the spawn,
+* and keychain writes are outside the harness's file-based contract.
+* @param homeDir - the `claude-code` harness's scoped home.
+*/
+async function sweepLegacyOauth(homeDir) {
+	await rm(join(homeDir, ".credentials.json"), { force: true });
+	const configPath = join(homeDir, ".claude.json");
+	let config;
+	try {
+		config = JSON.parse(await readFile(configPath, "utf8"));
+	} catch {
+		return;
+	}
+	if (typeof config !== "object" || config === null || !("oauthAccount" in config)) return;
+	delete config["oauthAccount"];
+	await writeFile(configPath, JSON.stringify(config, void 0, 2) + "\n");
+}
+/**
+* Read the scoped settings' configured model: the `model` key of
+* `<homeDir>/settings.json` — the model a delegation round pins when the
+* scoped settings name one at all. Claude's own default model is decided by
+* the CLI and is deliberately NOT guessed here. Only the scoped file is
+* consulted (never the host's `~/.claude`); absent or malformed content
+* yields undefined.
+* @param homeDir - the `claude-code` harness's scoped home.
+* @returns the configured model identifier, or undefined when none is set.
+*/
+async function readClaudeConfiguredModel(homeDir) {
+	let text;
+	try {
+		text = await readFile(join(homeDir, SCOPED_SETTINGS), "utf8");
+	} catch {
+		return;
+	}
+	try {
+		const settings = JSON.parse(text);
+		return typeof settings.model === "string" && settings.model !== "" ? settings.model : void 0;
+	} catch {
+		return;
+	}
+}
+/** Read the scoped native effort setting without changing the settings file. */
+async function readClaudeConfiguredEffort(homeDir) {
+	try {
+		const settings = JSON.parse(await readFile(join(homeDir, SCOPED_SETTINGS), "utf8"));
+		return typeof settings.effortLevel === "string" && settings.effortLevel.trim() !== "" ? settings.effortLevel.trim() : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Write (or, with undefined, remove) the scoped settings.json `model` key,
+* merging the rest of the file exactly as {@link provisionClaudeHome} merges
+* its env block. Only the live driver calls this: a resident runtime needs
+* its member's effective model IN THE FILE, because a `--resume` respawn
+* restores the session's own stored model over the `--model` flag. The exec
+* path never calls it — its `--model` flag always applies, and the file
+* stays exactly as the person edited it.
+* @param homeDir - the `claude-code` harness's scoped home.
+* @param model - the model to scratch in, or undefined to remove the key.
+*/
+async function writeClaudeScopedModel(homeDir, model) {
+	const path = join(homeDir, SCOPED_SETTINGS);
+	let settings = {};
+	try {
+		settings = JSON.parse(await readFile(path, "utf8"));
+	} catch {}
+	if (model === void 0) {
+		if (!("model" in settings)) return;
+		delete settings["model"];
+	} else {
+		if (settings["model"] === model) return;
+		settings["model"] = model;
+	}
+	await writeFile(path, JSON.stringify(settings, void 0, 2) + "\n");
+}
+//#endregion
+//#region lib/types/model-broker.js
+/**
+* The claude-code harness's model broker: the family gateway routes
+* `harnessModel` / `memberModel` / `setMemberModel` here, and the broker
+* answers the family's fixed resolution order — the session-level override
+* (the composer's picker), the delegation's recorded model, the plugin-config
+* `model` key (the settings card), the scoped settings.json's own `model`,
+* and last the CLI's built-in default, which names nothing.
+*
+* The override map is IN-MEMORY by design (it deliberately does not survive a
+* host restart) and SHARED: index.ts hands the same map to the provider's and
+* the live driver's model resolvers, so a composer switch reaches the next
+* round through every drive. With the live driver on, switching to a
+* DIFFERENT model retires the member's resident runtime so the next round
+* respawns onto the new model — the CLI session itself resumes on disk, so
+* the conversation carries over. A switch while a round is in flight is
+* refused: retiring a runtime mid-round would kill the run.
+*
+* `lastObserved` (the cli-builtin layer's display hint): the delegation
+* record's `observedModel` answers when the live-settle channel reported
+* one; the member's own CLI transcript (`transcriptModel`, a bounded read of
+* the projects tree) is the history backstop for rounds that predate that
+* channel — read-only, TTL-cached, never a write into `delegations.jsonl`.
+*
+* @module @khorsheed/dsh-local-agent-claude-code/model-broker — internal, unit-tested directly.
+*/
+/**
+* The scoped settings.json `model` key across live-spawn scratch writes. The
+* live driver writes a member's effective model into the file before a
+* resident spawn (a `--resume` respawn restores the session's stored model
+* over the `--model` flag), and this memory keeps the person's own configured
+* value straight across those writes: what the file held before our first
+* write is the `cli-config` layer, and a spawn with NO effective model
+* restores that value instead of leaking the previous member's model into
+* the next runtime. In-memory on purpose: a restart re-reads the file as it
+* stands. Writes serialize on an internal queue so concurrent member spawns
+* cannot lose each other's read-modify-write.
+*/
+var ClaudeScopedModelMemory = class {
+	/** The value we last scratched in and believe the file still holds. */
+	written;
+	/** What the file held before our first write; null = it named no model. */
+	previous = null;
+	queue = Promise.resolve();
+	/**
+	* Bring the scoped settings.json's `model` key to the effective model a
+	* spawn is about to bind — writing it, or restoring the person's value when
+	* the spawn binds none and the file still holds our earlier scratch.
+	* @param homeDir - the scoped home the spawn runs against.
+	* @param model - the spawn's effective model, or undefined for none.
+	*/
+	provision(homeDir, model) {
+		const run = this.queue.then(() => this.provisionLocked(homeDir, model));
+		this.queue = run.catch(() => void 0);
+		return run;
+	}
+	/**
+	* The person's configured model — the `cli-config` layer. A file value we
+	* did not write reports as read; our own scratch value reports what the
+	* file held before we wrote it.
+	* @param homeDir - the scoped home to read.
+	* @returns the person's configured model, or undefined when none.
+	*/
+	async cliDefault(homeDir) {
+		const file = await readClaudeConfiguredModel(homeDir);
+		if (file !== this.written) {
+			this.previous = file ?? null;
+			this.written = void 0;
+			return file;
+		}
+		return this.previous ?? void 0;
+	}
+	async provisionLocked(homeDir, model) {
+		const file = await readClaudeConfiguredModel(homeDir);
+		if (file !== this.written) {
+			this.previous = file ?? null;
+			this.written = void 0;
+		}
+		if (model === void 0) {
+			if (this.written === void 0) return;
+			await writeClaudeScopedModel(homeDir, this.previous ?? void 0);
+			this.written = void 0;
+			return;
+		}
+		if (file === model) return;
+		await writeClaudeScopedModel(homeDir, model);
+		this.written = model;
+	}
+};
+var ClaudeModelBroker = class {
+	deps;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	configurationAdapter(binding) {
+		const context = this.deps.configurationContext?.(binding);
+		if (context === void 0) throw new Error("Claude member configuration context is unavailable");
+		const resolve = async (selection) => {
+			let directory = await context.directory();
+			if (directory.status === "loading") directory = await context.directory(true);
+			const model = selection.model.mode === "value" ? selection.model.value : (selection.model.mode === "inherit" ? binding.model : void 0) ?? this.deps.settingsModel(binding.scope) ?? await readClaudeConfiguredModel(context.home) ?? directory.defaultModel;
+			const entry = directory.entries.find((entry) => entry.value === model || entry.resolvedModel === model);
+			const effort = (selection.effort.mode === "value" ? selection.effort.value : selection.effort.mode === "inherit" ? binding.effort : void 0) ?? await readClaudeConfiguredEffort(context.home) ?? entry?.reasoning?.default;
+			if (effort !== void 0 && !entry?.reasoning?.options.some((option) => option.value === effort)) throw new Error("Claude has not advertised this reasoning effort for the selected model");
+			return {
+				...model === void 0 ? {} : { model },
+				...effort === void 0 ? {} : { effort }
+			};
+		};
+		const retire = async () => {
+			await this.deps.liveSwitch.hostingDriver(binding.childSessionId)?.retireRuntime(binding.childSessionId);
+		};
+		return {
+			validate: async (selection) => {
+				await resolve(selection);
+			},
+			prepare: resolve,
+			apply: async (selection) => {
+				const resolved = await resolve(selection);
+				await retire();
+				return resolved;
+			},
+			reconcile: async (state) => {
+				if (this.deps.localAgent.isDelegationActive(binding.childSessionId)) return {
+					active: true,
+					matches: "unknown",
+					resolved: {}
+				};
+				await retire();
+				return {
+					active: false,
+					matches: "current",
+					resolved: await resolve(state.current.selection)
+				};
+			}
+		};
+	}
+	async modelDirectory(childSessionId, refresh = false) {
+		if (refresh) await this.deps.directory?.(childSessionId, true);
+		return (await this.modelInfo(childSessionId, childSessionId === void 0 ? void 0 : this.deps.localAgent.getDelegation(childSessionId)?.model)).directory ?? {
+			entries: [],
+			complete: false,
+			customInput: true,
+			status: "unsupported",
+			refreshing: false,
+			revision: 0
+		};
 	}
-}
-//#endregion
-//#region lib/types/live-switch.js
-/**
-* The settings-driven live-driver switch: owns the active driver generation
-* and retires old ones on a settings change, without a plugin reload.
-*
-* Toggle OFF (or unload): the retiring generation is DRAINED, not killed —
-* new rounds are refused (the provider's catch falls back to exec), in-flight
-* rounds finish on their runtime, idle runtimes are reclaimed at once.
-* Toggling ON builds the next generation lazily (no process until the first
-* round). Legacy granularity settings are ignored.
-*
-* @module @khorsheed/dsh-local-agent-claude-code — internal, unit-tested directly.
-*/
-var LiveDriverSwitch = class {
-	ctx;
-	driverBase;
-	liveOn = false;
-	active;
-	/** Retiring generations still draining their in-flight rounds. */
-	draining = /* @__PURE__ */ new Set();
-	unwatch;
-	constructor(ctx, face, driverBase) {
-		this.ctx = ctx;
-		this.driverBase = driverBase;
-		this.apply(face.get());
-		this.unwatch = face.watch((next) => {
-			this.apply(next);
-		});
+	async *followModelDirectory(childSessionId, signal) {
+		if (this.deps.followDirectory === void 0) {
+			yield await this.modelDirectory(childSessionId);
+			return;
+		}
+		for await (const _snapshot of this.deps.followDirectory(childSessionId, signal)) yield await this.modelDirectory(childSessionId);
 	}
 	/**
-	* Resolve the live driver for one round's member (the provider's call
-	* site). A retiring generation still hosting the member gates the new one —
-	* the round falls back to exec rather than double-loading the same claude
-	* session into two processes.
+	* The `lastObserved` cache: childSessionId (empty key = the memberless
+	* harness read) → the answer and when it was read. A miss is cached too —
+	* a member with no transcript yet should not pay a rescan per card open.
 	*/
-	resolve = (childSessionId) => {
-		if (this.active === void 0) return void 0;
-		for (const retiring of this.draining) if (retiring.hasRuntime(childSessionId)) return void 0;
-		return this.active;
-	};
+	observedCache = /* @__PURE__ */ new Map();
 	/**
-	* The generation currently hosting the member's runtime — the active one,
-	* or a retiring generation still draining it (the model broker retires the
-	* member's runtime through whichever generation owns it on a model switch).
+	* The last model the member (or the harness) was observed running. The
+	* live-settle channel is primary — a record whose latest round reported
+	* `observedModel` answers without touching disk; the CLI's own transcripts
+	* are the history backstop for every round that predates it.
 	*/
-	hostingDriver(childSessionId) {
-		if (this.active?.hasRuntime(childSessionId) === true) return this.active;
-		for (const retiring of this.draining) if (retiring.hasRuntime(childSessionId)) return retiring;
+	async lastObserved(childSessionId) {
+		const record = childSessionId === void 0 ? void 0 : this.deps.localAgent.getDelegation(childSessionId);
+		if (childSessionId !== void 0 && record === void 0) return void 0;
+		if (record?.observedModel !== void 0 && record.observedModel.trim() !== "") return record.observedModel;
+		const key = childSessionId ?? "";
+		const hit = this.observedCache.get(key);
+		if (hit !== void 0 && Date.now() - hit.at < 6e4) return hit.model;
+		const model = await this.deps.transcriptModel(record?.cliSessionId, childSessionId).catch(() => void 0);
+		this.observedCache.set(key, {
+			at: Date.now(),
+			model
+		});
+		return model;
 	}
-	/** Mirror the resolved settings into the driver generation. */
-	apply(next) {
-		if (next.live === this.liveOn) return;
-		this.liveOn = next.live;
-		const retiring = this.active;
-		this.active = next.live ? new ClaudeLiveDriver(this.ctx, { ...this.driverBase }) : void 0;
-		if (retiring !== void 0) {
-			this.draining.add(retiring);
-			retiring.drain().then(() => {
-				this.draining.delete(retiring);
-			}, (error) => {
-				this.draining.delete(retiring);
-				this.ctx.logger.warn(`local-agent-claude-code: live driver drain failed: ${error instanceof Error ? error.message : String(error)}`);
-			});
-		}
+	/**
+	* Read the model surface in the family's fixed order. Without a member the
+	* override and delegation layers stay absent — the settings card's "what
+	* would a round run with" read.
+	*/
+	async modelInfo(childSessionId, delegationModel) {
+		const record = childSessionId === void 0 ? void 0 : this.deps.localAgent.getDelegation(childSessionId);
+		const override = childSessionId === void 0 ? void 0 : this.deps.overrides.get(childSessionId);
+		const delegation = delegationModel?.trim() === "" ? void 0 : delegationModel?.trim();
+		const settings = this.deps.settingsModel(record?.scope);
+		const cliDefault = await this.deps.cliDefault(childSessionId);
+		const native = await this.deps.directory?.(childSessionId);
+		const [effective, source] = override !== void 0 ? [override, "override"] : delegation !== void 0 ? [delegation, "delegation"] : settings !== void 0 ? [settings, "settings"] : cliDefault !== void 0 ? [cliDefault, "cli-config"] : [native?.defaultModel, "cli-builtin"];
+		const curated = this.deps.modelList?.(record?.scope) ?? [];
+		const choices = curated.length > 0 ? [...curated] : [...new Set([
+			settings,
+			cliDefault,
+			...native?.entries.filter((entry) => !entry.hidden).map((entry) => entry.value) ?? [],
+			...this.deps.recentModels()
+		].filter((value) => value !== void 0))];
+		const lastObserved = await this.lastObserved(childSessionId);
+		const active = childSessionId !== void 0 && this.deps.localAgent.isDelegationActive(childSessionId);
+		return {
+			...effective === void 0 ? {} : { effective },
+			source,
+			...override === void 0 ? {} : { override },
+			...delegation === void 0 ? {} : { delegation },
+			...settings === void 0 ? {} : { settings },
+			...cliDefault === void 0 ? {} : { cliDefault },
+			...lastObserved === void 0 ? {} : { lastObserved },
+			choices,
+			...native === void 0 ? {} : { directory: extendModelDirectory(native, [settings, cliDefault], curated.length > 0 ? [] : [...this.deps.recentModels(), lastObserved]) },
+			live: this.deps.live(),
+			switchable: !active,
+			...active ? { reason: "该成员有进行中的委派轮次，等其完成后再切换模型 (a delegation round is in flight)" } : {}
+		};
 	}
-	/** Plugin unload: interrupt whatever survives (disposeAll, not drain). */
-	dispose() {
-		this.unwatch();
-		this.active?.disposeAll();
-		for (const retiring of this.draining) retiring.disposeAll();
-		this.draining.clear();
+	/**
+	* Set or clear a member's session-level override. Throws while a round is
+	* in flight for the member; a same-model set is a no-op; a real change
+	* retires the member's resident runtime when its bound model is no longer
+	* what the next round would spawn with (the CLI session resumes on the
+	* respawn, so the conversation carries over).
+	*/
+	async setMemberModel(childSessionId, model) {
+		if (this.deps.localAgent.setMemberModel !== void 0) return this.deps.localAgent.setMemberModel(childSessionId, model);
+		if (this.deps.localAgent.isDelegationActive(childSessionId)) throw new Error(`subagent-claude: 成员 ${childSessionId} 有进行中的委派轮次，等其完成后再切换模型 (a delegation round is in flight for this member)`);
+		const trimmed = model?.trim();
+		const next = trimmed === void 0 || trimmed === "" ? void 0 : trimmed;
+		if (next === this.deps.overrides.get(childSessionId)) return;
+		if (next === void 0) this.deps.overrides.delete(childSessionId);
+		else this.deps.overrides.set(childSessionId, next);
+		const record = this.deps.localAgent.getDelegation(childSessionId);
+		const delegation = record?.model?.trim();
+		const spawnModel = next ?? (delegation === void 0 || delegation === "" ? void 0 : delegation) ?? this.deps.settingsModel(record?.scope);
+		const host = this.deps.liveSwitch.hostingDriver(childSessionId);
+		if (host !== void 0 && host.runtimeModel(childSessionId) !== spawnModel) await host.retireRuntime(childSessionId);
 	}
 };
 //#endregion
-//#region lib/types/provision.js
+//#region lib/types/records.js
+/**
+* Claude Code session records adapter: scans the scoped home's `projects/`
+* session files (one JSONL per session under `projects/<cwd-slug>/`, the
+* slug being the workspace path with separators replaced by dashes), plus
+* the transcript model read-back ({@link readClaudeTranscriptModel}) the
+* model broker's `lastObserved` backstop runs on. The
+* slug is a LOSSY encoding of the cwd — different paths can collide on the
+* same slug — so the listed cwd always comes from the file CONTENT (the
+* first `user` event's `cwd` field), never from the directory name. Only the
+* head of each file is read — the first user event carries the id, cwd, and
+* timestamp the listing needs; the rest of the file (conversation) is not
+* parsed. Files are append-only with torn-tail tolerance, and contents are
+* always untrusted input.
+*
+* Credentials are NOT this module's business: the harness authenticates by
+* endpoint key only (see endpoint-auth.ts), which needs no keychain read,
+* no `.credentials.json` reconcile, and no OAuth marker probe.
+* @module @khorsheed/dsh-local-agent-claude-code/records
+*/
+/** Session files live under this directory inside the scoped home. */
+const PROJECTS_ROOT = "projects";
+/** Bound on the head prefix read from one session file. */
+const HEAD_BYTES = 65536;
+/**
+* Bound on the tail read when extracting a transcript's model. Assistant
+* lines are frequent, so the last window almost always names one; a bigger
+* conversation is never read whole.
+*/
+const TRANSCRIPT_TAIL_BYTES = 262144;
+/** Cap on project directories the transcript reads scan. */
+const TRANSCRIPT_SCAN_DIRS = 200;
+/** Cap on transcript files the harness-level newest-scan stats. */
+const TRANSCRIPT_SCAN_FILES = 500;
+/** Cap on sidechain (`agent-*.jsonl`) candidates inspected for one session id. */
+const TRANSCRIPT_SIDECHAIN_FILES = 100;
+/** How many newest transcripts the harness-level read tries before giving up. */
+const TRANSCRIPT_NEWEST_TRIES = 3;
 /**
-* Claude Code scoped-home provisioning. Unlike codex (whose credential store
-* must be pinned to a file) and kimi (which needs a provider config),
-* claude's `CLAUDE_CONFIG_DIR` scoped home needs nothing beyond the
-* directory itself: login via `claude auth login` writes `.claude.json`
-* (with the `oauthAccount` record) into it, and the real credential lands in
-* the macOS keychain under a hashed entry or — on Linux, despite upstream
-* bug #47661 — in the default `~/.claude/.credentials.json` while the config
-* stays scoped. Sign-out removes the scoped config so `status` reports not
-* authenticated; the keychain entry on macOS persists until the CLI removes
-* it, which the framework's file-based logout cannot reach.
-* @module @khorsheed/dsh-local-agent-claude-code/provision
+* Parse the head of a session file for the listing fields. The first `user`
+* event carries `sessionId`, `cwd`, and `timestamp`; its `cwd` is the only
+* trustworthy workspace source (the directory slug is lossy). Unknown or
+* malformed values yield an undefined record rather than failing the list.
+* @param text - the raw session file head (only the head is read).
+* @returns the record, or undefined when no user event is found.
 */
-/** The scoped config file holding the oauthAccount auth marker. */
-const SCOPED_CONFIG = ".claude.json";
-/** The scoped settings file carrying the CLI's env block. */
-const SCOPED_SETTINGS = "settings.json";
+function projectRecord(text) {
+	for (const raw of text.split("\n")) {
+		const line = raw.trim();
+		if (line === "") continue;
+		let event;
+		try {
+			event = JSON.parse(line);
+		} catch {
+			continue;
+		}
+		if (event.type !== "user") continue;
+		if (typeof event.sessionId !== "string" || event.sessionId === "") return void 0;
+		if (typeof event.cwd !== "string") return void 0;
+		const record = {
+			id: event.sessionId,
+			workDir: event.cwd
+		};
+		const startedAt = typeof event.timestamp === "string" ? Date.parse(event.timestamp) : void 0;
+		if (startedAt !== void 0 && Number.isFinite(startedAt)) record.startedAt = startedAt;
+		return record;
+	}
+}
 /**
-* Provision the scoped home directory. Claude creates it lazily on first
-* use, but creating it eagerly keeps the harness's homeDir contract uniform
-* with the other harnesses. When `proxyUrl` is configured, the scoped
-* `settings.json` gains an env block pointing the CLI's own traffic at it —
-* claude reads proxy settings from this file, so the child works even when
-* the host process environment carries no proxy (a supervisor-spawned
-* instance's env is not the user's shell env). An existing settings file is
-* merged, not overwritten; only the two proxy keys are managed.
+* Read the scoped home's session files. The listing walks the projects
+* directory and reads each jsonl head; a torn or malformed file is skipped
+* rather than failing the whole list.
 * @param homeDir - the `claude-code` harness's scoped home.
-* @param proxyUrl - optional HTTP proxy URL for the child CLI's traffic.
+* @returns the parsed records, empty when no sessions exist yet.
 */
-async function provisionClaudeHome(homeDir, proxyUrl) {
-	await mkdir(homeDir, { recursive: true });
-	if (proxyUrl === void 0) return;
-	const path = join(homeDir, SCOPED_SETTINGS);
-	let settings = {};
+async function listClaudeSessions(homeDir) {
+	const records = [];
+	let projectDirs;
 	try {
-		settings = JSON.parse(await readFile(path, "utf8"));
-	} catch {}
-	const env = settings.env ?? {};
-	if (env.https_proxy === proxyUrl && env.http_proxy === proxyUrl) return;
-	env.https_proxy = proxyUrl;
-	env.http_proxy = proxyUrl;
-	settings.env = env;
-	await writeFile(path, JSON.stringify(settings, void 0, 2) + "\n");
+		projectDirs = await readdir(join(homeDir, PROJECTS_ROOT));
+	} catch (error) {
+		if (error.code === "ENOENT") return [];
+		throw error;
+	}
+	for (const projectDir of projectDirs) {
+		let files;
+		try {
+			files = await readdir(join(homeDir, PROJECTS_ROOT, projectDir));
+		} catch {
+			continue;
+		}
+		for (const name of files) {
+			if (!name.endsWith(".jsonl")) continue;
+			try {
+				const handle = await open(join(homeDir, PROJECTS_ROOT, projectDir, name), "r");
+				let text;
+				try {
+					const buffer = Buffer.alloc(HEAD_BYTES);
+					const { bytesRead } = await handle.read(buffer, 0, HEAD_BYTES, 0);
+					text = buffer.subarray(0, bytesRead).toString("utf8");
+				} finally {
+					await handle.close();
+				}
+				const record = projectRecord(text);
+				if (record !== void 0) records.push(record);
+			} catch {
+				continue;
+			}
+		}
+	}
+	return records;
 }
 /**
-* Read the scoped settings' configured model: the `model` key of
-* `<homeDir>/settings.json` — the model a delegation round pins when the
-* scoped settings name one at all. Claude's own default model is decided by
-* the CLI and is deliberately NOT guessed here. Only the scoped file is
-* consulted (never the host's `~/.claude`); absent or malformed content
-* yields undefined.
-* @param homeDir - the `claude-code` harness's scoped home.
-* @returns the configured model identifier, or undefined when none is set.
+* Extract the model one transcript names, reading its TAIL (bounded, never
+* the whole conversation) from the newest line backward: the first line
+* carrying a model wins — the top-level `model` of the stream-json init
+* event's shape, or the nested `message.model` of an assistant line. Newest
+* first because a session's later rounds may run a different model than its
+* first, and "what ran last" is the question the caller asks. A torn final
+* line is skipped, never failed on.
+* @param path - the transcript file.
+* @returns the model identifier, or undefined when the window names none.
 */
-async function readClaudeConfiguredModel(homeDir) {
+async function transcriptFileModel(path) {
 	let text;
 	try {
-		text = await readFile(join(homeDir, SCOPED_SETTINGS), "utf8");
+		const handle = await open(path, "r");
+		try {
+			const { size } = await handle.stat();
+			const length = Math.min(size, TRANSCRIPT_TAIL_BYTES);
+			const buffer = Buffer.alloc(length);
+			const { bytesRead } = await handle.read(buffer, 0, length, Math.max(0, size - length));
+			text = buffer.subarray(0, bytesRead).toString("utf8");
+		} finally {
+			await handle.close();
+		}
 	} catch {
 		return;
 	}
-	try {
-		const settings = JSON.parse(text);
-		return typeof settings.model === "string" && settings.model !== "" ? settings.model : void 0;
-	} catch {
-		return;
+	const lines = text.split("\n");
+	for (let index = lines.length - 1; index >= 0; index -= 1) {
+		const line = lines[index].trim();
+		if (line === "") continue;
+		let event;
+		try {
+			event = JSON.parse(line);
+		} catch {
+			continue;
+		}
+		if (typeof event.model === "string" && event.model !== "") return event.model;
+		if (typeof event.message?.model === "string" && event.message.model !== "") return event.message.model;
 	}
 }
-/** Read the scoped native effort setting without changing the settings file. */
-async function readClaudeConfiguredEffort(homeDir) {
+/** The project directories under one scoped home, capped; empty on any failure. */
+async function projectDirs(homeDir) {
 	try {
-		const settings = JSON.parse(await readFile(join(homeDir, SCOPED_SETTINGS), "utf8"));
-		return typeof settings.effortLevel === "string" && settings.effortLevel.trim() !== "" ? settings.effortLevel.trim() : void 0;
+		return (await readdir(join(homeDir, PROJECTS_ROOT))).slice(0, TRANSCRIPT_SCAN_DIRS);
 	} catch {
-		return;
+		return [];
 	}
 }
-/**
-* Write (or, with undefined, remove) the scoped settings.json `model` key,
-* merging the rest of the file exactly as {@link provisionClaudeHome} merges
-* its env block. Only the live driver calls this: a resident runtime needs
-* its member's effective model IN THE FILE, because a `--resume` respawn
-* restores the session's own stored model over the `--model` flag. The exec
-* path never calls it — its `--model` flag always applies, and the file
-* stays exactly as the person edited it.
-* @param homeDir - the `claude-code` harness's scoped home.
-* @param model - the model to scratch in, or undefined to remove the key.
-*/
-async function writeClaudeScopedModel(homeDir, model) {
-	const path = join(homeDir, SCOPED_SETTINGS);
-	let settings = {};
+/** The jsonl file names inside one project directory; empty on any failure. */
+async function projectFiles(homeDir, projectDir) {
 	try {
-		settings = JSON.parse(await readFile(path, "utf8"));
-	} catch {}
-	if (model === void 0) {
-		if (!("model" in settings)) return;
-		delete settings["model"];
-	} else {
-		if (settings["model"] === model) return;
-		settings["model"] = model;
+		return (await readdir(join(homeDir, PROJECTS_ROOT, projectDir))).filter((name) => name.endsWith(".jsonl"));
+	} catch {
+		return [];
 	}
-	await writeFile(path, JSON.stringify(settings, void 0, 2) + "\n");
-}
-/**
-* Sign out of the scoped account: remove the scoped config file, so
-* `/<name> status` reports not authenticated and the next login authorizes
-* a fresh account. The macOS keychain entry (a hashed
-* `Claude Code-credentials-<sha256(path)[:8]>` record keyed to the scoped
-* home path) is NOT removed — the CLI's `claude auth logout` owns that, and
-* the harness logout contract is file-based; the stale entry is harmless
-* because a fresh login rewrites the same hashed slot.
-* @param homeDir - the `claude-code` harness's scoped home.
-*/
-async function claudeLogout(homeDir) {
-	await rm(join(homeDir, SCOPED_CONFIG), { force: true });
 }
-//#endregion
-//#region lib/types/model-broker.js
-/**
-* The claude-code harness's model broker: the family gateway routes
-* `harnessModel` / `memberModel` / `setMemberModel` here, and the broker
-* answers the family's fixed resolution order — the session-level override
-* (the composer's picker), the delegation's recorded model, the plugin-config
-* `model` key (the settings card), the scoped settings.json's own `model`,
-* and last the CLI's built-in default, which names nothing.
-*
-* The override map is IN-MEMORY by design (it deliberately does not survive a
-* host restart) and SHARED: index.ts hands the same map to the provider's and
-* the live driver's model resolvers, so a composer switch reaches the next
-* round through every drive. With the live driver on, switching to a
-* DIFFERENT model retires the member's resident runtime so the next round
-* respawns onto the new model — the CLI session itself resumes on disk, so
-* the conversation carries over. A switch while a round is in flight is
-* refused: retiring a runtime mid-round would kill the run.
-*
-* `lastObserved` (the cli-builtin layer's display hint): the delegation
-* record's `observedModel` answers when the live-settle channel reported
-* one; the member's own CLI transcript (`transcriptModel`, a bounded read of
-* the projects tree) is the history backstop for rounds that predate that
-* channel — read-only, TTL-cached, never a write into `delegations.jsonl`.
-*
-* @module @khorsheed/dsh-local-agent-claude-code/model-broker — internal, unit-tested directly.
-*/
 /**
-* The scoped settings.json `model` key across live-spawn scratch writes. The
-* live driver writes a member's effective model into the file before a
-* resident spawn (a `--resume` respawn restores the session's stored model
-* over the `--model` flag), and this memory keeps the person's own configured
-* value straight across those writes: what the file held before our first
-* write is the `cli-config` layer, and a spawn with NO effective model
-* restores that value instead of leaking the previous member's model into
-* the next runtime. In-memory on purpose: a restart re-reads the file as it
-* stands. Writes serialize on an internal queue so concurrent member spawns
-* cannot lose each other's read-modify-write.
-*/
-var ClaudeScopedModelMemory = class {
-	/** The value we last scratched in and believe the file still holds. */
-	written;
-	/** What the file held before our first write; null = it named no model. */
-	previous = null;
-	queue = Promise.resolve();
-	/**
-	* Bring the scoped settings.json's `model` key to the effective model a
-	* spawn is about to bind — writing it, or restoring the person's value when
-	* the spawn binds none and the file still holds our earlier scratch.
-	* @param homeDir - the scoped home the spawn runs against.
-	* @param model - the spawn's effective model, or undefined for none.
-	*/
-	provision(homeDir, model) {
-		const run = this.queue.then(() => this.provisionLocked(homeDir, model));
-		this.queue = run.catch(() => void 0);
-		return run;
-	}
-	/**
-	* The person's configured model — the `cli-config` layer. A file value we
-	* did not write reports as read; our own scratch value reports what the
-	* file held before we wrote it.
-	* @param homeDir - the scoped home to read.
-	* @returns the person's configured model, or undefined when none.
-	*/
-	async cliDefault(homeDir) {
-		const file = await readClaudeConfiguredModel(homeDir);
-		if (file !== this.written) {
-			this.previous = file ?? null;
-			this.written = void 0;
-			return file;
+* Whether a sidechain (`agent-*.jsonl`) transcript belongs to one session:
+* its head lines carry the PARENT session's id (`isSidechain: true`). Only
+* the bounded head is read.
+*/
+async function sidechainSessionMatches(path, cliSessionId) {
+	let text;
+	try {
+		const handle = await open(path, "r");
+		try {
+			const buffer = Buffer.alloc(HEAD_BYTES);
+			const { bytesRead } = await handle.read(buffer, 0, HEAD_BYTES, 0);
+			text = buffer.subarray(0, bytesRead).toString("utf8");
+		} finally {
+			await handle.close();
 		}
-		return this.previous ?? void 0;
+	} catch {
+		return false;
 	}
-	async provisionLocked(homeDir, model) {
-		const file = await readClaudeConfiguredModel(homeDir);
-		if (file !== this.written) {
-			this.previous = file ?? null;
-			this.written = void 0;
-		}
-		if (model === void 0) {
-			if (this.written === void 0) return;
-			await writeClaudeScopedModel(homeDir, this.previous ?? void 0);
-			this.written = void 0;
-			return;
+	for (const raw of text.split("\n")) {
+		const line = raw.trim();
+		if (line === "") continue;
+		try {
+			if (JSON.parse(line).sessionId === cliSessionId) return true;
+		} catch {
+			continue;
 		}
-		if (file === model) return;
-		await writeClaudeScopedModel(homeDir, model);
-		this.written = model;
-	}
-};
-var ClaudeModelBroker = class {
-	deps;
-	constructor(deps) {
-		this.deps = deps;
 	}
-	configurationAdapter(binding) {
-		const context = this.deps.configurationContext?.(binding);
-		if (context === void 0) throw new Error("Claude member configuration context is unavailable");
-		const resolve = async (selection) => {
-			let directory = await context.directory();
-			if (directory.status === "loading") directory = await context.directory(true);
-			const model = selection.model.mode === "value" ? selection.model.value : (selection.model.mode === "inherit" ? binding.model : void 0) ?? this.deps.settingsModel() ?? await readClaudeConfiguredModel(context.home) ?? directory.defaultModel;
-			const entry = directory.entries.find((entry) => entry.value === model || entry.resolvedModel === model);
-			const effort = (selection.effort.mode === "value" ? selection.effort.value : selection.effort.mode === "inherit" ? binding.effort : void 0) ?? await readClaudeConfiguredEffort(context.home) ?? entry?.reasoning?.default;
-			if (effort !== void 0 && !entry?.reasoning?.options.some((option) => option.value === effort)) throw new Error("Claude has not advertised this reasoning effort for the selected model");
-			return {
-				...model === void 0 ? {} : { model },
-				...effort === void 0 ? {} : { effort }
-			};
-		};
-		const retire = async () => {
-			await this.deps.liveSwitch.hostingDriver(binding.childSessionId)?.retireRuntime(binding.childSessionId);
-		};
-		return {
-			validate: async (selection) => {
-				await resolve(selection);
-			},
-			prepare: resolve,
-			apply: async (selection) => {
-				const resolved = await resolve(selection);
-				await retire();
-				return resolved;
-			},
-			reconcile: async (state) => {
-				if (this.deps.localAgent.isDelegationActive(binding.childSessionId)) return {
-					active: true,
-					matches: "unknown",
-					resolved: {}
-				};
-				await retire();
-				return {
-					active: false,
-					matches: "current",
-					resolved: await resolve(state.current.selection)
-				};
+	return false;
+}
+/**
+* The model a member's OWN CLI transcript names — the history backstop for
+* the broker's `lastObserved` when no delegation record observed one (every
+* member whose rounds predate the live-settle report). The live-settle
+* channel remains primary (the record's `observedModel` wins when present);
+* this reader only answers "what did this session last run" from the CLI's
+* own files, read-only — nothing is backfilled into `delegations.jsonl`.
+*
+* Location rule: with `cliSessionId`, the main transcript
+* `projects/<cwd-slug>/<cliSessionId>.jsonl` (found by NAME across the
+* project dirs — the slug is lossy, so it is never computed); when it is
+* absent, a sidechain `agent-*.jsonl` whose head names the session id
+* (bounded candidate count) answers instead. Without `cliSessionId` (the
+* settings card's memberless read), the NEWEST transcript across the
+* projects tree (mtime, bounded dir/file scan) answers; a newest file that
+* names no model yields to the next, up to a few tries. Every failure —
+* missing tree, unreadable file, no model in the read window — is
+* `undefined`, never a throw.
+* @param homeDir - the `claude-code` harness's scoped home.
+* @param cliSessionId - the delegation record's CLI session id, when the
+*   member's own transcript is wanted.
+* @returns the model identifier, or undefined.
+*/
+async function readClaudeTranscriptModel(homeDir, cliSessionId) {
+	if (cliSessionId !== void 0) {
+		let main;
+		const sidechains = [];
+		for (const projectDir of await projectDirs(homeDir)) for (const name of await projectFiles(homeDir, projectDir)) {
+			if (name === `${cliSessionId}.jsonl` && main === void 0) {
+				main = join(homeDir, PROJECTS_ROOT, projectDir, name);
+				continue;
 			}
-		};
-	}
-	async modelDirectory(childSessionId, refresh = false) {
-		if (refresh) await this.deps.directory?.(childSessionId, true);
-		return (await this.modelInfo(childSessionId, childSessionId === void 0 ? void 0 : this.deps.localAgent.getDelegation(childSessionId)?.model)).directory ?? {
-			entries: [],
-			complete: false,
-			customInput: true,
-			status: "unsupported",
-			refreshing: false,
-			revision: 0
-		};
-	}
-	async *followModelDirectory(childSessionId, signal) {
-		if (this.deps.followDirectory === void 0) {
-			yield await this.modelDirectory(childSessionId);
-			return;
+			if (name.startsWith("agent-") && sidechains.length < TRANSCRIPT_SIDECHAIN_FILES) sidechains.push(join(homeDir, PROJECTS_ROOT, projectDir, name));
 		}
-		for await (const _snapshot of this.deps.followDirectory(childSessionId, signal)) yield await this.modelDirectory(childSessionId);
-	}
-	/**
-	* The `lastObserved` cache: childSessionId (empty key = the memberless
-	* harness read) → the answer and when it was read. A miss is cached too —
-	* a member with no transcript yet should not pay a rescan per card open.
-	*/
-	observedCache = /* @__PURE__ */ new Map();
-	/**
-	* The last model the member (or the harness) was observed running. The
-	* live-settle channel is primary — a record whose latest round reported
-	* `observedModel` answers without touching disk; the CLI's own transcripts
-	* are the history backstop for every round that predates it.
-	*/
-	async lastObserved(childSessionId) {
-		const record = childSessionId === void 0 ? void 0 : this.deps.localAgent.getDelegation(childSessionId);
-		if (childSessionId !== void 0 && record === void 0) return void 0;
-		if (record?.observedModel !== void 0 && record.observedModel.trim() !== "") return record.observedModel;
-		const key = childSessionId ?? "";
-		const hit = this.observedCache.get(key);
-		if (hit !== void 0 && Date.now() - hit.at < 6e4) return hit.model;
-		const model = await this.deps.transcriptModel(record?.cliSessionId, childSessionId).catch(() => void 0);
-		this.observedCache.set(key, {
-			at: Date.now(),
-			model
-		});
-		return model;
+		if (main !== void 0) {
+			const model = await transcriptFileModel(main);
+			if (model !== void 0) return model;
+		}
+		for (const path of sidechains) if (await sidechainSessionMatches(path, cliSessionId)) {
+			const model = await transcriptFileModel(path);
+			if (model !== void 0) return model;
+		}
+		return;
 	}
-	/**
-	* Read the model surface in the family's fixed order. Without a member the
-	* override and delegation layers stay absent — the settings card's "what
-	* would a round run with" read.
-	*/
-	async modelInfo(childSessionId, delegationModel) {
-		const override = childSessionId === void 0 ? void 0 : this.deps.overrides.get(childSessionId);
-		const delegation = delegationModel?.trim() === "" ? void 0 : delegationModel?.trim();
-		const settings = this.deps.settingsModel();
-		const cliDefault = await this.deps.cliDefault(childSessionId);
-		const native = await this.deps.directory?.(childSessionId);
-		const [effective, source] = override !== void 0 ? [override, "override"] : delegation !== void 0 ? [delegation, "delegation"] : settings !== void 0 ? [settings, "settings"] : cliDefault !== void 0 ? [cliDefault, "cli-config"] : [native?.defaultModel, "cli-builtin"];
-		const choices = [...new Set([
-			settings,
-			cliDefault,
-			...native?.entries.filter((entry) => !entry.hidden).map((entry) => entry.value) ?? [],
-			...this.deps.recentModels()
-		].filter((value) => value !== void 0))];
-		const lastObserved = await this.lastObserved(childSessionId);
-		const active = childSessionId !== void 0 && this.deps.localAgent.isDelegationActive(childSessionId);
-		return {
-			...effective === void 0 ? {} : { effective },
-			source,
-			...override === void 0 ? {} : { override },
-			...delegation === void 0 ? {} : { delegation },
-			...settings === void 0 ? {} : { settings },
-			...cliDefault === void 0 ? {} : { cliDefault },
-			...lastObserved === void 0 ? {} : { lastObserved },
-			choices,
-			...native === void 0 ? {} : { directory: extendModelDirectory(native, [settings, cliDefault], [...this.deps.recentModels(), lastObserved]) },
-			live: this.deps.live(),
-			switchable: !active,
-			...active ? { reason: "该成员有进行中的委派轮次，等其完成后再切换模型 (a delegation round is in flight)" } : {}
-		};
+	const candidates = [];
+	let scanned = 0;
+	for (const projectDir of await projectDirs(homeDir)) for (const name of await projectFiles(homeDir, projectDir)) {
+		if (scanned >= TRANSCRIPT_SCAN_FILES) break;
+		scanned += 1;
+		const path = join(homeDir, PROJECTS_ROOT, projectDir, name);
+		try {
+			candidates.push({
+				path,
+				mtimeMs: (await stat(path)).mtimeMs
+			});
+		} catch {
+			continue;
+		}
 	}
-	/**
-	* Set or clear a member's session-level override. Throws while a round is
-	* in flight for the member; a same-model set is a no-op; a real change
-	* retires the member's resident runtime when its bound model is no longer
-	* what the next round would spawn with (the CLI session resumes on the
-	* respawn, so the conversation carries over).
-	*/
-	async setMemberModel(childSessionId, model) {
-		if (this.deps.localAgent.setMemberModel !== void 0) return this.deps.localAgent.setMemberModel(childSessionId, model);
-		if (this.deps.localAgent.isDelegationActive(childSessionId)) throw new Error(`subagent-claude: 成员 ${childSessionId} 有进行中的委派轮次，等其完成后再切换模型 (a delegation round is in flight for this member)`);
-		const trimmed = model?.trim();
-		const next = trimmed === void 0 || trimmed === "" ? void 0 : trimmed;
-		if (next === this.deps.overrides.get(childSessionId)) return;
-		if (next === void 0) this.deps.overrides.delete(childSessionId);
-		else this.deps.overrides.set(childSessionId, next);
-		const delegation = this.deps.localAgent.getDelegation(childSessionId)?.model?.trim();
-		const spawnModel = next ?? (delegation === void 0 || delegation === "" ? void 0 : delegation) ?? this.deps.settingsModel();
-		const host = this.deps.liveSwitch.hostingDriver(childSessionId);
-		if (host !== void 0 && host.runtimeModel(childSessionId) !== spawnModel) await host.retireRuntime(childSessionId);
+	candidates.sort((a, b) => b.mtimeMs - a.mtimeMs);
+	for (const candidate of candidates.slice(0, TRANSCRIPT_NEWEST_TRIES)) {
+		const model = await transcriptFileModel(candidate.path);
+		if (model !== void 0) return model;
 	}
-};
+}
 //#endregion
 //#region lib/types/index.js
 /**
 * Claude Code harness instantiation of the local-agent family. Registers the
 * `claude-code` harness into the core registry: scoped home under the shared
-* homes root (`CLAUDE_CONFIG_DIR`), login as a manual handoff (claude ≥2.1
-* prints no OAuth URL off a TTY, so `/login` replies with the exact terminal
-* command and the registry watches for the credential), and project-file
-* session records. Delegation mounts through the `claude-local` provider
-* (one-shot `claude -p --output-format json` under the scoped home); the
-* bundle patch's `tool-subagent-claude-code-local` row puts the tool on the
-* profile root, so every agent preset can delegate.
+* homes root (`CLAUDE_CONFIG_DIR`), endpoint-key authentication (the scope's
+* `endpoint-auth.json` over the plugin config's `baseUrl`/`apiKey`/
+* `authToken` triple — no OAuth, no browser flow, nothing to authorize inside
+* a container), and project-file session records. Delegation mounts through
+* the `claude-local` provider (one-shot `claude -p` under the scoped home);
+* the bundle patch's `tool-subagent-claude-code-local` row puts the tool on
+* the profile root, so every agent preset can delegate.
 *
 * @module @khorsheed/dsh-local-agent-claude-code
 */
@@ -3547,7 +3493,8 @@ const inject = [
 ];
 /**
 * The settings fields (`live`, `liveMirrorGranularity`, `model`,
-* `recentModels`) ride the plugin Config, marked `.volatile()` where the
+* `recentModels`, and the endpoint credential `baseUrl`/`apiKey`/`authToken`)
+* ride the plugin Config, marked `.volatile()` where the
 * host's schemastery has it (3.18.4+, the rc.1 line — probed, never sniffed):
 * there the SettingsForms writes hot-track the running fiber's Volatile
 * references without a remount, and the official one-shot import moves an old
@@ -3572,6 +3519,8 @@ const Config = z.object({
 	permissionMode: z.union([z.const("skip"), z.const("normal")]),
 	model: volatilize(SETTINGS_FIELDS.model),
 	baseUrl: z.string(),
+	apiKey: z.string(),
+	authToken: z.string(),
 	proxyUrl: z.string(),
 	live: volatilize(SETTINGS_FIELDS.live),
 	liveIdleMs: z.number().default(DEFAULT_LIVE_IDLE_MS),
@@ -3599,7 +3548,6 @@ const CLAUDE_SETTINGS_SCHEMA = z.object(SETTINGS_FIELDS);
 function apply(ctx, config) {
 	ctx.effect(() => {
 		const permissionMode = config.permissionMode ?? "skip";
-		const baseUrl = config.baseUrl;
 		const homeDir = ctx.localAgent.homeDir("claude-code");
 		provisionClaudeHome(homeDir, config.proxyUrl).catch((error) => {
 			ctx.logger.warn(`local-agent-claude-code: scoped home provisioning failed: ${error instanceof Error ? error.message : String(error)}`);
@@ -3629,10 +3577,17 @@ function apply(ctx, config) {
 			legacyBase,
 			read: readSettings
 		});
-		const resolveModel = () => {
+		const endpointConfig = {
+			...config.baseUrl === void 0 ? {} : { baseUrl: config.baseUrl },
+			...config.apiKey === void 0 ? {} : { apiKey: config.apiKey },
+			...config.authToken === void 0 ? {} : { authToken: config.authToken }
+		};
+		const resolveEndpoint = (scopeHome) => resolveEndpointAuth(scopeHome, endpointConfig);
+		const settingsModelKey = () => {
 			const model = face.get().model?.trim();
 			return model === void 0 || model === "" ? void 0 : model;
 		};
+		const resolveModel = (scope) => firstModelOf(readModelListSync(ctx.localAgent.homeDir("claude-code", scope))) ?? settingsModelKey();
 		const overrides = /* @__PURE__ */ new Map();
 		const scopedModelMemory = new ClaudeScopedModelMemory();
 		const effectiveModel = (childSessionId, delegationModel) => {
@@ -3640,18 +3595,19 @@ function apply(ctx, config) {
 			if (own !== void 0 && own !== "") return own;
 			const named = delegationModel?.trim();
 			if (named !== void 0 && named !== "") return named;
-			return resolveModel();
+			const record = ctx.localAgent.memberBinding?.(childSessionId) ?? ctx.localAgent.getDelegation(childSessionId);
+			return resolveModel(record?.scope);
 		};
 		const liveSwitch = new LiveDriverSwitch(ctx, face, {
 			...config.permissionMode === void 0 ? {} : { permissionMode: config.permissionMode },
-			...config.baseUrl === void 0 ? {} : { baseUrl: config.baseUrl },
+			endpoint: resolveEndpoint,
 			...config.liveIdleMs === void 0 ? {} : { liveIdleMs: config.liveIdleMs },
 			model: effectiveModel,
 			provisionModel: (home, model) => scopedModelMemory.provision(home, model)
 		});
 		const modelCatalog = new ClaudeModelCatalog({
-			spawn: (spec) => ctx.subprocess.spawn(spec),
-			...config.baseUrl === void 0 ? {} : { baseUrl: config.baseUrl },
+			endpoint: resolveEndpoint,
+			endpointLabel: () => config.baseUrl,
 			warn: (message) => ctx.logger.warn(message)
 		});
 		const modelContext = (childSessionId) => {
@@ -3671,6 +3627,7 @@ function apply(ctx, config) {
 				};
 			},
 			settingsModel: resolveModel,
+			modelList: (scope) => readModelListSync(ctx.localAgent.homeDir("claude-code", scope)),
 			cliDefault: (childSessionId) => {
 				const context = modelContext(childSessionId);
 				return context.home === homeDir ? scopedModelMemory.cliDefault(homeDir) : readClaudeConfiguredModel(context.home);
@@ -3689,7 +3646,7 @@ function apply(ctx, config) {
 			liveSwitch,
 			transcriptModel: (cliSessionId, childSessionId) => readClaudeTranscriptModel(modelContext(childSessionId).home, cliSessionId)
 		});
-		const disposeProvider = ctx.subagents.registerProvider(new ClaudeCliProvider(ctx, permissionMode, baseUrl, liveSwitch.resolve, effectiveModel));
+		const disposeProvider = ctx.subagents.registerProvider(new ClaudeCliProvider(ctx, permissionMode, resolveEndpoint, liveSwitch.resolve, effectiveModel));
 		const disposeHarness = ctx.localAgent.register({
 			prepareMember: async ({ binding, childSession, configuration, signal }) => {
 				const driver = liveSwitch.resolve(binding.childSessionId);
@@ -3706,46 +3663,53 @@ function apply(ctx, config) {
 			displayName: "Claude Code",
 			homeEnvVar: "CLAUDE_CONFIG_DIR",
 			delegationProvider: "claude-local",
-			login: {
-				pty: {
-					command: "env",
-					args: (scopedHome) => [
-						"-u",
-						"ANTHROPIC_API_KEY",
-						"-u",
-						"ANTHROPIC_BASE_URL",
-						`CLAUDE_CONFIG_DIR=${scopedHome}`,
-						"claude",
-						"auth",
-						"login"
-					]
+			records: { listSessions: (homeDir) => listClaudeSessions(homeDir) },
+			provision: (scopedHome) => provisionClaudeHome(scopedHome, config.proxyUrl).then(() => {}),
+			isAuthenticated: (home) => resolveEndpoint(home).then((endpoint) => hasEndpointCredential(endpoint)),
+			checkEndpoint: (home) => resolveEndpoint(home).then((endpoint) => checkClaudeEndpoint(endpoint)),
+			endpointAuth: {
+				read: async (home) => {
+					const endpoint = await resolveEndpoint(home);
+					return {
+						...endpoint.baseUrl === void 0 ? {} : { baseUrl: endpoint.baseUrl },
+						apiKeySet: endpoint.apiKey !== void 0,
+						authTokenSet: endpoint.authToken !== void 0
+					};
 				},
-				watch: async (home) => {
-					await syncClaudeCredentialFile(home, (message) => {
-						ctx.logger.warn(message);
-					});
-					return claudeAuthenticated(home, (message) => {
-						ctx.logger.warn(message);
-					});
+				write: async (home, fields) => {
+					const next = { ...await readEndpointAuthFile(home) ?? {} };
+					for (const [field, value] of Object.entries(fields)) {
+						if (value === void 0) continue;
+						const trimmed = typeof value === "string" ? value.trim() : "";
+						if (value === null || trimmed === "") delete next[field];
+						else next[field] = trimmed;
+					}
+					if (Object.keys(next).length === 0) await clearEndpointAuth(home);
+					else await writeEndpointAuth(home, next);
 				}
 			},
-			records: { listSessions: (homeDir) => listClaudeSessions(homeDir) },
-			provision: (scopedHome) => provisionClaudeHome(scopedHome, config.proxyUrl).then(() => {}),
-			isAuthenticated: (home) => claudeAuthenticated(home, (message) => {
-				ctx.logger.warn(message);
-			}),
-			credentialStamp: claudeCredentialStamp,
-			logout: claudeLogout,
+			credentialStamp: endpointAuthStamp,
+			logout: async (home) => {
+				if (await endpointAuthFileExists(home)) {
+					await clearEndpointAuth(home);
+					return;
+				}
+				throw new Error("claude-code has no scoped endpoint-auth.json to clear — the credential comes from the settings card or the profile row (baseUrl/apiKey/authToken); clear it there instead");
+			},
 			modelBroker,
+			modelList: {
+				read: (home) => readModelList(home),
+				write: (home, models) => writeModelList(home, models)
+			},
 			effectiveSettings: async (scopedHome) => {
-				const effectiveBaseUrl = baseUrl ?? process.env.ANTHROPIC_BASE_URL;
-				const baseUrlHost = effectiveBaseUrl !== void 0 ? endpointHost(effectiveBaseUrl) : void 0;
+				const endpoint = await resolveEndpoint(scopedHome);
+				const baseUrlHost = endpoint.baseUrl !== void 0 ? endpointHost(endpoint.baseUrl) : void 0;
 				const [scopedModel, cliVersion] = await Promise.all([readClaudeConfiguredModel(scopedHome).catch(() => void 0), claudeCliVersion(ctx, scopedHome).catch(() => void 0)]);
 				const model = resolveModel() ?? scopedModel;
 				return {
 					drive: face.get().live ? "live" : "exec",
 					permissionMode,
-					baseUrlSet: effectiveBaseUrl !== void 0,
+					baseUrlSet: endpoint.baseUrl !== void 0,
 					...baseUrlHost !== void 0 ? { baseUrlHost } : {},
 					...model !== void 0 ? { model } : {},
 					...cliVersion !== void 0 ? { cliVersion } : {}
@@ -3757,6 +3721,13 @@ function apply(ctx, config) {
 					kind: "success",
 					text: records.length === 0 ? "No claude sessions in the scoped home yet." : records.map((r) => `${r.id} ${r.workDir}`).join("\n")
 				}));
+				if (verb === "check") {
+					const scopeHome = invocation.agent.ctx.localAgent.homeDir("claude-code");
+					return resolveEndpoint(scopeHome).then((endpoint) => checkClaudeEndpoint(endpoint)).then((text) => ({
+						kind: "success",
+						text
+					}));
+				}
 			}
 		});
 		return () => {