agent-shim 11.55.0 → 11.56.0

package/dist/cli.cjs

@@ -29545,11 +29545,59 @@ function hasDesktopSession() {
     const result = (0, import_node_child_process2.spawnSync)("launchctl", ["managername"], { encoding: "utf8" });
     return result.status === 0 && result.stdout.trim() === MACOS_GUI_SESSION_MANAGER;
   }
+  return hasDisplayServer();
+}
+function hasDisplayServer() {
   if (process.platform === "win32") {
     return false;
   }
   return (process.env.DISPLAY ?? "") !== "" || (process.env.WAYLAND_DISPLAY ?? "") !== "";
 }
+async function hasDesktopSessionAsync() {
+  if (process.platform !== "darwin") {
+    return hasDisplayServer();
+  }
+  return await new Promise((resolve2) => {
+    (0, import_node_child_process2.execFile)("launchctl", ["managername"], { encoding: "utf8" }, (error63, stdout2) => {
+      resolve2(error63 === null && stdout2.trim() === MACOS_GUI_SESSION_MANAGER);
+    });
+  });
+}
+async function runCredentialCommand(argv, options) {
+  const [command, ...args] = argv;
+  return await new Promise((resolve2) => {
+    const child = (0, import_node_child_process2.spawn)(command, args, { stdio: options.interactive ? ["inherit", "pipe", "inherit"] : ["ignore", "pipe", "pipe"] });
+    let stdout2 = "";
+    let stderr = "";
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill();
+    }, options.timeoutMs);
+    let settled = false;
+    const settle2 = (result) => {
+      if (!settled) {
+        settled = true;
+        clearTimeout(timer);
+        resolve2(result);
+      }
+    };
+    child.stdout?.setEncoding("utf8");
+    child.stdout?.on("data", (chunk2) => {
+      stdout2 += chunk2;
+    });
+    child.stderr?.setEncoding("utf8");
+    child.stderr?.on("data", (chunk2) => {
+      stderr += chunk2;
+    });
+    child.once("error", (error63) => {
+      settle2({ status: null, stdout: "", stderr: error63.message, timedOut: false });
+    });
+    child.once("close", (status) => {
+      settle2(timedOut ? { status: null, stdout: "", stderr: "", timedOut: true } : { status, stdout: stdout2, stderr: options.interactive ? "" : stderr, timedOut: false });
+    });
+  });
+}
 function resolveGitBranch(run, cwd) {
   const result = run.run("git", ["-C", cwd, "rev-parse", "--abbrev-ref", "HEAD"]);
   if (result.status !== 0) {
@@ -29746,7 +29794,7 @@ function realResolveClaudeBinary(isOwnBinary) {
 function realInstalledClaudeVersions() {
   return installedVersions(listVersionsDir(defaultVersionsDir()));
 }
-var import_node_child_process2, import_node_crypto4, import_node_fs3, import_node_os2, import_node_path9, import_node_sea, realFsPort, OWNER_ONLY_DIR_MODE, OWNER_ONLY_FILE_MODE, PERMISSION_BITS, realFarmFs, INT32_BYTE_LENGTH, KEY_POLL_MS, CTRL_C_BYTE, realHoldPort, LINE_FEED, UTF8_CONTINUATION_MASK, UTF8_CONTINUATION_BITS, PS_TIMEOUT_MS, realRunPort, MACOS_GUI_SESSION_MANAGER, realCredentialPort, SOCKET_PERMISSION_BITS, realHeadroomSocketTrust, realSpawnPort, realProcPort, realLogPort, EXECUTE_BITS_MASK, WINDOWS_DEFAULT_PATHEXT;
+var import_node_child_process2, import_node_crypto4, import_node_fs3, import_node_os2, import_node_path9, import_node_sea, realFsPort, OWNER_ONLY_DIR_MODE, OWNER_ONLY_FILE_MODE, PERMISSION_BITS, realFarmFs, INT32_BYTE_LENGTH, KEY_POLL_MS, CTRL_C_BYTE, realHoldPort, LINE_FEED, UTF8_CONTINUATION_MASK, UTF8_CONTINUATION_BITS, PS_TIMEOUT_MS, realRunPort, MACOS_GUI_SESSION_MANAGER, realCredentialPort, realAsyncCredentialPort, SOCKET_PERMISSION_BITS, realHeadroomSocketTrust, realSpawnPort, realProcPort, realLogPort, EXECUTE_BITS_MASK, WINDOWS_DEFAULT_PATHEXT;
 var init_realPorts = __esm({
   "src/realPorts.ts"() {
     "use strict";
@@ -29962,6 +30010,11 @@ var init_realPorts = __esm({
       },
       personPresent: () => process.stdin.isTTY || hasDesktopSession()
     };
+    realAsyncCredentialPort = {
+      readSecretFile: (filePath) => realCredentialPort.readSecretFile(filePath),
+      runCommand: runCredentialCommand,
+      personPresent: async () => process.stdin.isTTY || await hasDesktopSessionAsync()
+    };
     SOCKET_PERMISSION_BITS = 4095;
     realHeadroomSocketTrust = {
       platform: process.platform,
@@ -35365,51 +35418,87 @@ function unpackKeyringToken(raw) {
   }
   return trimmed;
 }
-function trySource(source, params) {
-  const none = (reason, warn = false) => ({ ok: false, reason, warn });
+function declined(reason, warn = false) {
+  return { ok: false, reason, warn };
+}
+function isCommandBacked(source) {
+  return "command" in source || "op" in source || "keychain" in source;
+}
+function immediateOutcome(source, params) {
   if ("env" in source) {
     const value2 = params.env[source.env];
-    return value2 === void 0 || value2 === "" ? none("is unset or empty") : { ok: true, token: unpackKeyringToken(value2) };
+    return value2 === void 0 || value2 === "" ? declined("is unset or empty") : { ok: true, token: unpackKeyringToken(value2) };
   }
   if ("literal" in source) {
     return { ok: true, token: source.literal };
   }
-  if ("file" in source) {
-    const read = params.port.readSecretFile(source.file);
-    if (!read.found) {
-      return none("does not exist");
-    }
-    if (read.mode !== void 0 && (read.mode & GROUP_OTHER_PERMISSION_BITS) !== 0) {
-      return none(
-        `is readable or writable by group or others (mode ${(read.mode & PERMISSION_BITS2).toString(OCTAL_RADIX2)}); run \`chmod 600 ${source.file}\``,
-        true
-      );
-    }
-    const token2 = unpackKeyringToken(read.content.trim());
-    return token2 === "" ? none("is empty") : { ok: true, token: token2 };
+  const read = params.port.readSecretFile(source.file);
+  if (!read.found) {
+    return declined("does not exist");
   }
-  const argv = commandArgv(source);
-  const interactive = isInteractiveSource(source, params.env);
-  if (interactive && !params.port.personPresent()) {
-    return none("needs a person to approve it, but there is no terminal or desktop session");
+  if (read.mode !== void 0 && (read.mode & GROUP_OTHER_PERMISSION_BITS) !== 0) {
+    return declined(
+      `is readable or writable by group or others (mode ${(read.mode & PERMISSION_BITS2).toString(OCTAL_RADIX2)}); run \`chmod 600 ${source.file}\``,
+      true
+    );
   }
-  const timeoutMs = source.timeoutMs ?? (interactive ? CREDENTIAL_INTERACTIVE_TIMEOUT_MS : CREDENTIAL_COMMAND_TIMEOUT_MS);
-  const result = params.port.runCommand(argv, { timeoutMs, interactive });
+  const token = unpackKeyringToken(read.content.trim());
+  return token === "" ? declined("is empty") : { ok: true, token };
+}
+function commandRunOf(source, env) {
+  const interactive = isInteractiveSource(source, env);
+  return { argv: commandArgv(source), interactive, timeoutMs: source.timeoutMs ?? (interactive ? CREDENTIAL_INTERACTIVE_TIMEOUT_MS : CREDENTIAL_COMMAND_TIMEOUT_MS) };
+}
+function commandOutcome(result, timeoutMs) {
   if (result.timedOut) {
-    return none(`timed out after ${String(timeoutMs)}ms`);
+    return declined(`timed out after ${String(timeoutMs)}ms`);
   }
   if (result.status !== 0) {
     const stderr = result.stderr.trim();
     const outcome = result.status === null ? "could not be run or was killed by a signal" : `exited with status ${String(result.status)}`;
-    return none(`${outcome}${stderr === "" ? "" : `: ${stderr}`}`);
+    return declined(`${outcome}${stderr === "" ? "" : `: ${stderr}`}`);
   }
   const token = unpackKeyringToken(result.stdout.trim());
-  return token === "" ? none("printed no token") : { ok: true, token };
+  return token === "" ? declined("printed no token") : { ok: true, token };
+}
+function trySource(source, params) {
+  if (!isCommandBacked(source)) {
+    return immediateOutcome(source, params);
+  }
+  const run = commandRunOf(source, params.env);
+  if (run.interactive && !params.port.personPresent()) {
+    return declined(NO_PERSON_REASON);
+  }
+  return commandOutcome(params.port.runCommand(run.argv, { timeoutMs: run.timeoutMs, interactive: run.interactive }), run.timeoutMs);
+}
+async function trySourceAsync(source, params) {
+  if (!isCommandBacked(source)) {
+    return immediateOutcome(source, params);
+  }
+  const run = commandRunOf(source, params.env);
+  if (run.interactive && !await params.port.personPresent()) {
+    return declined(NO_PERSON_REASON);
+  }
+  return commandOutcome(await params.port.runCommand(run.argv, { timeoutMs: run.timeoutMs, interactive: run.interactive }), run.timeoutMs);
 }
 function warmCommandFor(subject) {
   const [kind, name] = subject.split(" ");
   return kind === "provider" ? `agent-shim credential warm --provider ${name ?? ""}` : `agent-shim credential warm ${name ?? ""}`;
 }
+function cachedResolution(target, entry) {
+  return { ok: true, credential: { target, token: entry.token, source: entry.source, warnings: [], cachedAt: entry.fetchedAt } };
+}
+function liveResolution(target, token, source, warnings) {
+  return { ok: true, credential: { target, token, source, warnings } };
+}
+function unresolved(subject, cacheBlock, attempts) {
+  const hint = cacheBlock === void 0 ? "" : `; fill the cache from a terminal with \`${warmCommandFor(subject)}\``;
+  return { ok: false, message: `agent-shim: ${subject} has no usable credential: ${attempts.join("; ")}${hint}` };
+}
+function declinedLine(source, outcome, subject) {
+  const attempt = `${describeSource(source)} ${outcome.reason}`;
+  return { attempt, warning: outcome.warn ? `agent-shim: ${subject}: skipped ${attempt}` : void 0 };
+}
 function resolveCredential(params) {
   const target = params.credential.target ?? "bearer";
   const cacheBlock = params.credential.cache;
@@ -35418,7 +35507,7 @@ function resolveCredential(params) {
   if (cacheBlock !== void 0 && cache !== void 0 && store !== void 0 && params.refresh !== true) {
     const entry = cache.port.read(store, params.subject);
     if (entry !== void 0 && isFresh(entry, cacheBlock, cache.now())) {
-      return { ok: true, credential: { target, token: entry.token, source: entry.source, warnings: [], cachedAt: entry.fetchedAt } };
+      return cachedResolution(target, entry);
     }
   }
   const attempts = [];
@@ -35429,16 +35518,59 @@ function resolveCredential(params) {
       if (cache !== void 0 && store !== void 0) {
         cache.port.write(store, params.subject, { token: outcome.token, fetchedAt: cache.now(), source });
       }
-      return { ok: true, credential: { target, token: outcome.token, source, warnings } };
+      return liveResolution(target, outcome.token, source, warnings);
+    }
+    const line = declinedLine(source, outcome, params.subject);
+    attempts.push(line.attempt);
+    if (line.warning !== void 0) {
+      warnings.push(line.warning);
+    }
+  }
+  return unresolved(params.subject, cacheBlock, attempts);
+}
+async function resolveCredentialAsync(params) {
+  const target = params.credential.target ?? "bearer";
+  const cacheBlock = params.credential.cache;
+  const cache = cacheBlock === void 0 ? void 0 : params.port.cache;
+  const store = cacheBlock === void 0 || cache === void 0 ? void 0 : effectiveStore(cacheBlock, cache.platform);
+  if (cacheBlock !== void 0 && cache !== void 0 && store !== void 0 && params.refresh !== true) {
+    const entry = await cache.port.read(store, params.subject);
+    if (entry !== void 0 && isFresh(entry, cacheBlock, cache.now())) {
+      return cachedResolution(target, entry);
+    }
+  }
+  const attempts = [];
+  const warnings = [];
+  for (const source of params.credential.sources) {
+    const outcome = await trySourceAsync(source, params);
+    if (outcome.ok) {
+      if (cache !== void 0 && store !== void 0) {
+        await cache.port.write(store, params.subject, { token: outcome.token, fetchedAt: cache.now(), source });
+      }
+      return liveResolution(target, outcome.token, source, warnings);
     }
-    const line = `${describeSource(source)} ${outcome.reason}`;
-    attempts.push(line);
-    if (outcome.warn) {
-      warnings.push(`agent-shim: ${params.subject}: skipped ${line}`);
+    const line = declinedLine(source, outcome, params.subject);
+    attempts.push(line.attempt);
+    if (line.warning !== void 0) {
+      warnings.push(line.warning);
     }
   }
-  const hint = cacheBlock === void 0 ? "" : `; fill the cache from a terminal with \`${warmCommandFor(params.subject)}\``;
-  return { ok: false, message: `agent-shim: ${params.subject} has no usable credential: ${attempts.join("; ")}${hint}` };
+  return unresolved(params.subject, cacheBlock, attempts);
+}
+function shareInFlightResolutions(resolve2) {
+  const inFlight = /* @__PURE__ */ new Map();
+  return async (params) => {
+    const key = JSON.stringify([params.subject, params.credential, params.refresh === true]);
+    const running = inFlight.get(key);
+    if (running !== void 0) {
+      return await running;
+    }
+    const started = resolve2(params).finally(() => {
+      inFlight.delete(key);
+    });
+    inFlight.set(key, started);
+    return await started;
+  };
 }
 function credentialVariables(target, token) {
   return {
@@ -35447,7 +35579,7 @@ function credentialVariables(target, token) {
     CLAUDE_CODE_OAUTH_TOKEN: target === "oauthToken" ? token : void 0
   };
 }
-var CREDENTIAL_UNAVAILABLE_EXIT, CREDENTIAL_COMMAND_TIMEOUT_MS, CREDENTIAL_INTERACTIVE_TIMEOUT_MS, GROUP_OTHER_PERMISSION_BITS, PERMISSION_BITS2, OCTAL_RADIX2, GO_KEYRING_BASE64_PREFIX;
+var CREDENTIAL_UNAVAILABLE_EXIT, CREDENTIAL_COMMAND_TIMEOUT_MS, CREDENTIAL_INTERACTIVE_TIMEOUT_MS, GROUP_OTHER_PERMISSION_BITS, PERMISSION_BITS2, OCTAL_RADIX2, GO_KEYRING_BASE64_PREFIX, NO_PERSON_REASON;
 var init_credential = __esm({
   "src/credential.ts"() {
     "use strict";
@@ -35459,6 +35591,7 @@ var init_credential = __esm({
     PERMISSION_BITS2 = 511;
     OCTAL_RADIX2 = 8;
     GO_KEYRING_BASE64_PREFIX = "go-keyring-base64:";
+    NO_PERSON_REASON = "needs a person to approve it, but there is no terminal or desktop session";
   }
 });
 
@@ -36633,7 +36766,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "agent-shim",
-      version: "11.55.0",
+      version: "11.56.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -38070,6 +38203,30 @@ function security(args, stdin2) {
   const result = (0, import_node_child_process3.spawnSync)("security", args, { encoding: "utf8", ...stdin2 === void 0 ? {} : { input: stdin2 }, stdio: ["pipe", "pipe", "ignore"] });
   return { status: result.status, stdout: result.stdout };
 }
+async function securityAsync(args, stdin2) {
+  return await new Promise((resolve2) => {
+    const child = (0, import_node_child_process3.spawn)("security", args, { stdio: ["pipe", "pipe", "ignore"] });
+    let stdout2 = "";
+    let settled = false;
+    const settle2 = (status) => {
+      if (!settled) {
+        settled = true;
+        resolve2({ status, stdout: stdout2 });
+      }
+    };
+    child.stdout.setEncoding("utf8");
+    child.stdout.on("data", (chunk2) => {
+      stdout2 += chunk2;
+    });
+    child.stdin.on("error", () => {
+    });
+    child.stdin.end(stdin2);
+    child.once("error", () => {
+      settle2(null);
+    });
+    child.once("close", settle2);
+  });
+}
 function createRealCredentialCache(root) {
   const dir = import_node_path29.default.join(root, "credential-cache");
   const filePath = (owner) => import_node_path29.default.join(dir, cacheFileNameFor(owner));
@@ -38118,6 +38275,46 @@ function createRealCredentialCache(root) {
 function realCredentialCacheEnv(paths) {
   return { port: createRealCredentialCache(paths.root), platform: process.platform, now: () => Date.now() };
 }
+function createAsyncRealCredentialCache(root) {
+  const dir = import_node_path29.default.join(root, "credential-cache");
+  const filePath = (owner) => import_node_path29.default.join(dir, cacheFileNameFor(owner));
+  return {
+    async read(store, owner) {
+      if (store === "file") {
+        try {
+          return parseEntry(await import_node_fs9.default.promises.readFile(filePath(owner), "utf8"));
+        } catch {
+          return void 0;
+        }
+      }
+      requireKeychain();
+      const result = await securityAsync(["find-generic-password", "-s", KEYCHAIN_CACHE_SERVICE, "-a", owner, "-w"]);
+      return result.status === 0 ? parseEntry(Buffer.from(result.stdout.trim(), "base64").toString("utf8")) : void 0;
+    },
+    async write(store, owner, entry) {
+      const serialised = JSON.stringify(entry);
+      if (store === "file") {
+        await import_node_fs9.default.promises.mkdir(dir, { recursive: true, mode: CACHE_DIR_MODE });
+        await import_node_fs9.default.promises.chmod(dir, CACHE_DIR_MODE);
+        const target = filePath(owner);
+        const temp = `${target}.${String(process.pid)}.tmp`;
+        await import_node_fs9.default.promises.writeFile(temp, serialised, { mode: CACHE_FILE_MODE });
+        await import_node_fs9.default.promises.rename(temp, target);
+        return;
+      }
+      requireKeychain();
+      const encoded = Buffer.from(serialised, "utf8").toString("base64");
+      const result = await securityAsync(["-i"], `add-generic-password -U -s ${KEYCHAIN_CACHE_SERVICE} -a ${JSON.stringify(owner)} -w ${encoded}
+`);
+      if (result.status !== 0) {
+        throw new Error(`could not write the keychain credential cache for ${owner}`);
+      }
+    }
+  };
+}
+function realAsyncCredentialCacheEnv(paths) {
+  return { port: createAsyncRealCredentialCache(paths.root), platform: process.platform, now: () => Date.now() };
+}
 var import_node_child_process3, import_node_fs9, import_node_path29, KEYCHAIN_CACHE_SERVICE, CACHE_DIR_MODE, CACHE_FILE_MODE;
 var init_realCredentialCache = __esm({
   "src/realCredentialCache.ts"() {
@@ -68677,13 +68874,13 @@ function resolveLaunch(params) {
     environment
   };
 }
-function runLaunchPlan(plan, spawn8) {
+function runLaunchPlan(plan, spawn9) {
   try {
     if (plan.hold() === "cancelled") {
       return LAUNCH_CANCELLED_EXIT;
     }
     plan.markChildStarted();
-    const result = spawn8.spawnSync(plan.bin, plan.args, { stdio: "inherit", env: plan.env });
+    const result = spawn9.spawnSync(plan.bin, plan.args, { stdio: "inherit", env: plan.env });
     if (result.error !== void 0) {
       throw result.error;
     }
@@ -69171,7 +69368,7 @@ function createQuotaRefresher(deps) {
   const fetchNow = async (identity, provider, lookup, adapter) => {
     const key = `${identity}\0${provider}`;
     try {
-      const apiKey = lookup.apiKey();
+      const apiKey = await lookup.apiKey();
       const quota = await adapter.fetch(apiKey, deps.http, AbortSignal.timeout(QUOTA_REQUEST_TIMEOUT_MS), deps.now());
       if (!deps.record(identity, provider, quota)) {
         return { status: "no-usage" };
@@ -69241,8 +69438,8 @@ function createProviderLookup(ports) {
     }
     return {
       baseUrl,
-      apiKey: () => {
-        const resolution = resolveCredential({ credential: isRouterProvider(definition) ? { sources: [] } : definition.credential, env: ports.env, port: ports.credentials, subject: `provider ${name}` });
+      apiKey: async () => {
+        const resolution = await resolveCredentialAsync({ credential: isRouterProvider(definition) ? { sources: [] } : definition.credential, env: ports.env, port: ports.credentials, subject: `provider ${name}` });
         if (!resolution.ok) {
           throw new Error(resolution.message);
         }
@@ -132748,7 +132945,7 @@ function createAntigravityRoute(ports) {
         body: JSON.stringify({ type: "error", error: { type: "not_found_error", message: "no provider specified in path" } })
       };
     }
-    const lookup = ports.loadProvider(providerName);
+    const lookup = await ports.loadProvider(providerName);
     if (!lookup.ok) {
       return {
         status: lookup.status,
@@ -133262,6 +133459,7 @@ function resolveAccountTarget(model, models) {
 }
 function createProviderRouteResolver(deps) {
   const oauthRoute = createPassthroughRoute("anthropic", { baseUrl: `https://${CONNECT_INTERCEPT_HOST}:${String(HTTPS_PORT)}`, stripPrefix: void 0, headroomUpstream: void 0 });
+  const resolveCredential2 = shareInFlightResolutions(resolveCredentialAsync);
   const antigravityQuotaSources = /* @__PURE__ */ new Map();
   const antigravityRoutingMemory = /* @__PURE__ */ new Map();
   const definesProvider = (name) => {
@@ -133290,7 +133488,7 @@ function createProviderRouteResolver(deps) {
     const source = createCachedAntigravityQuotaSource({
       now: () => Date.now(),
       fetchSummary: async (nowMs) => {
-        const res = resolveCredential({ credential: definition.credential, env: deps.env, port: deps.credentials, subject: `provider ${provider}` });
+        const res = await resolveCredential2({ credential: definition.credential, env: deps.env, port: deps.credentials, subject: `provider ${provider}` });
         if (!res.ok) {
           return void 0;
         }
@@ -133356,8 +133554,8 @@ function createProviderRouteResolver(deps) {
         ok: true,
         route: createAntigravityRouteMount(
           {
-            loadProvider: () => {
-              const res = resolveCredential({
+            loadProvider: async () => {
+              const res = await resolveCredential2({
                 credential: antigravityProvider.credential,
                 env: deps.env,
                 port: deps.credentials,
@@ -133393,7 +133591,7 @@ function createProviderRouteResolver(deps) {
           stripPrefix: `${PROVIDER_PATH_PREFIX}${encodeURIComponent(provider)}`,
           headroomUpstream: directOrigin2(deps.directPort())
         }),
-        { provider, credential: httpProvider.credential, env: deps.env, port: deps.credentials }
+        { provider, credential: httpProvider.credential, env: deps.env, port: deps.credentials, resolve: resolveCredential2 }
       )
     };
   };
@@ -133539,7 +133737,7 @@ function attachingProviderCredential(route, deps) {
     headroomEligible: route.headroomEligible,
     headroomUpstream: route.headroomUpstream,
     serve: async (request7, response) => {
-      const resolution = resolveCredential({ credential: deps.credential, env: deps.env, port: deps.port, subject: `provider ${deps.provider}` });
+      const resolution = await deps.resolve({ credential: deps.credential, env: deps.env, port: deps.port, subject: `provider ${deps.provider}` });
       if (!resolution.ok) {
         response.start(HTTP_STATUS.badGateway, { "Content-Type": "application/json" });
         await response.write(
@@ -136581,7 +136779,7 @@ init_read();
 function createRealQuotaRefresher(params) {
   const { paths, store, log } = params;
   return createQuotaRefresher({
-    lookup: createProviderLookup({ fs: realFsPort, providersDir: paths.providersDir, env: process.env, credentials: realCredentialPort }),
+    lookup: createProviderLookup({ fs: realFsPort, providersDir: paths.providersDir, env: process.env, credentials: realAsyncCredentialPort }),
     http: realQuotaHttpGet,
     readQuota: (identity, provider) => {
       try {
@@ -136699,7 +136897,7 @@ function realFrontDoorSupervisorPorts(paths, respawnGeneration, retire, trackTun
       directPort: () => directPort,
       // The same port (cache included) the launcher resolves a launch's provider with, so the credential the door attaches at the route and the one the launcher handed the child are the same resolution of the same block.
       env: process.env,
-      credentials: { ...realCredentialPort, cache: realCredentialCacheEnv(paths) },
+      credentials: { ...realAsyncCredentialPort, cache: realAsyncCredentialCacheEnv(paths) },
       usageSnapshotOf: (identity) => identity === void 0 ? void 0 : routingSnapshots.get(identity) ?? readUsageSnapshot(realFarmFs, paths.usageSnapshotsDir, identity),
       // An `acct:` model member is served by relaunch: the door leaves a move request for the session's supervisor (found across every pool's registry, since the door does not know which pool launched the session) and answers the request with what is happening. A session nothing supervises gets the message naming the command to run instead.
       observations: (target) => observations.observation(target),

package/dist/index.cjs

@@ -4450,7 +4450,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "agent-shim",
-      version: "11.55.0",
+      version: "11.56.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -5737,6 +5737,9 @@ function hasDesktopSession() {
     const result = (0, import_node_child_process2.spawnSync)("launchctl", ["managername"], { encoding: "utf8" });
     return result.status === 0 && result.stdout.trim() === MACOS_GUI_SESSION_MANAGER;
   }
+  return hasDisplayServer();
+}
+function hasDisplayServer() {
   if (process.platform === "win32") {
     return false;
   }
@@ -8308,51 +8311,77 @@ function unpackKeyringToken(raw) {
   }
   return trimmed;
 }
-function trySource(source, params) {
-  const none = (reason, warn = false) => ({ ok: false, reason, warn });
+function declined(reason, warn = false) {
+  return { ok: false, reason, warn };
+}
+function isCommandBacked(source) {
+  return "command" in source || "op" in source || "keychain" in source;
+}
+function immediateOutcome(source, params) {
   if ("env" in source) {
     const value = params.env[source.env];
-    return value === void 0 || value === "" ? none("is unset or empty") : { ok: true, token: unpackKeyringToken(value) };
+    return value === void 0 || value === "" ? declined("is unset or empty") : { ok: true, token: unpackKeyringToken(value) };
   }
   if ("literal" in source) {
     return { ok: true, token: source.literal };
   }
-  if ("file" in source) {
-    const read = params.port.readSecretFile(source.file);
-    if (!read.found) {
-      return none("does not exist");
-    }
-    if (read.mode !== void 0 && (read.mode & GROUP_OTHER_PERMISSION_BITS) !== 0) {
-      return none(
-        `is readable or writable by group or others (mode ${(read.mode & PERMISSION_BITS2).toString(OCTAL_RADIX2)}); run \`chmod 600 ${source.file}\``,
-        true
-      );
-    }
-    const token2 = unpackKeyringToken(read.content.trim());
-    return token2 === "" ? none("is empty") : { ok: true, token: token2 };
+  const read = params.port.readSecretFile(source.file);
+  if (!read.found) {
+    return declined("does not exist");
   }
-  const argv = commandArgv(source);
-  const interactive = isInteractiveSource(source, params.env);
-  if (interactive && !params.port.personPresent()) {
-    return none("needs a person to approve it, but there is no terminal or desktop session");
+  if (read.mode !== void 0 && (read.mode & GROUP_OTHER_PERMISSION_BITS) !== 0) {
+    return declined(
+      `is readable or writable by group or others (mode ${(read.mode & PERMISSION_BITS2).toString(OCTAL_RADIX2)}); run \`chmod 600 ${source.file}\``,
+      true
+    );
   }
-  const timeoutMs = source.timeoutMs ?? (interactive ? CREDENTIAL_INTERACTIVE_TIMEOUT_MS : CREDENTIAL_COMMAND_TIMEOUT_MS);
-  const result = params.port.runCommand(argv, { timeoutMs, interactive });
+  const token = unpackKeyringToken(read.content.trim());
+  return token === "" ? declined("is empty") : { ok: true, token };
+}
+function commandRunOf(source, env) {
+  const interactive = isInteractiveSource(source, env);
+  return { argv: commandArgv(source), interactive, timeoutMs: source.timeoutMs ?? (interactive ? CREDENTIAL_INTERACTIVE_TIMEOUT_MS : CREDENTIAL_COMMAND_TIMEOUT_MS) };
+}
+function commandOutcome(result, timeoutMs) {
   if (result.timedOut) {
-    return none(`timed out after ${String(timeoutMs)}ms`);
+    return declined(`timed out after ${String(timeoutMs)}ms`);
   }
   if (result.status !== 0) {
     const stderr = result.stderr.trim();
     const outcome = result.status === null ? "could not be run or was killed by a signal" : `exited with status ${String(result.status)}`;
-    return none(`${outcome}${stderr === "" ? "" : `: ${stderr}`}`);
+    return declined(`${outcome}${stderr === "" ? "" : `: ${stderr}`}`);
   }
   const token = unpackKeyringToken(result.stdout.trim());
-  return token === "" ? none("printed no token") : { ok: true, token };
+  return token === "" ? declined("printed no token") : { ok: true, token };
+}
+function trySource(source, params) {
+  if (!isCommandBacked(source)) {
+    return immediateOutcome(source, params);
+  }
+  const run = commandRunOf(source, params.env);
+  if (run.interactive && !params.port.personPresent()) {
+    return declined(NO_PERSON_REASON);
+  }
+  return commandOutcome(params.port.runCommand(run.argv, { timeoutMs: run.timeoutMs, interactive: run.interactive }), run.timeoutMs);
 }
 function warmCommandFor(subject) {
   const [kind, name] = subject.split(" ");
   return kind === "provider" ? `agent-shim credential warm --provider ${name ?? ""}` : `agent-shim credential warm ${name ?? ""}`;
 }
+function cachedResolution(target, entry) {
+  return { ok: true, credential: { target, token: entry.token, source: entry.source, warnings: [], cachedAt: entry.fetchedAt } };
+}
+function liveResolution(target, token, source, warnings) {
+  return { ok: true, credential: { target, token, source, warnings } };
+}
+function unresolved(subject, cacheBlock, attempts) {
+  const hint = cacheBlock === void 0 ? "" : `; fill the cache from a terminal with \`${warmCommandFor(subject)}\``;
+  return { ok: false, message: `agent-shim: ${subject} has no usable credential: ${attempts.join("; ")}${hint}` };
+}
+function declinedLine(source, outcome, subject) {
+  const attempt = `${describeSource(source)} ${outcome.reason}`;
+  return { attempt, warning: outcome.warn ? `agent-shim: ${subject}: skipped ${attempt}` : void 0 };
+}
 function resolveCredential(params) {
   const target = params.credential.target ?? "bearer";
   const cacheBlock = params.credential.cache;
@@ -8361,7 +8390,7 @@ function resolveCredential(params) {
   if (cacheBlock !== void 0 && cache !== void 0 && store !== void 0 && params.refresh !== true) {
     const entry = cache.port.read(store, params.subject);
     if (entry !== void 0 && isFresh(entry, cacheBlock, cache.now())) {
-      return { ok: true, credential: { target, token: entry.token, source: entry.source, warnings: [], cachedAt: entry.fetchedAt } };
+      return cachedResolution(target, entry);
     }
   }
   const attempts = [];
@@ -8372,16 +8401,15 @@ function resolveCredential(params) {
       if (cache !== void 0 && store !== void 0) {
         cache.port.write(store, params.subject, { token: outcome.token, fetchedAt: cache.now(), source });
       }
-      return { ok: true, credential: { target, token: outcome.token, source, warnings } };
+      return liveResolution(target, outcome.token, source, warnings);
     }
-    const line = `${describeSource(source)} ${outcome.reason}`;
-    attempts.push(line);
-    if (outcome.warn) {
-      warnings.push(`agent-shim: ${params.subject}: skipped ${line}`);
+    const line = declinedLine(source, outcome, params.subject);
+    attempts.push(line.attempt);
+    if (line.warning !== void 0) {
+      warnings.push(line.warning);
     }
   }
-  const hint = cacheBlock === void 0 ? "" : `; fill the cache from a terminal with \`${warmCommandFor(params.subject)}\``;
-  return { ok: false, message: `agent-shim: ${params.subject} has no usable credential: ${attempts.join("; ")}${hint}` };
+  return unresolved(params.subject, cacheBlock, attempts);
 }
 function credentialVariables(target, token) {
   return {
@@ -8390,7 +8418,7 @@ function credentialVariables(target, token) {
     CLAUDE_CODE_OAUTH_TOKEN: target === "oauthToken" ? token : void 0
   };
 }
-var CREDENTIAL_UNAVAILABLE_EXIT, CREDENTIAL_COMMAND_TIMEOUT_MS, CREDENTIAL_INTERACTIVE_TIMEOUT_MS, GROUP_OTHER_PERMISSION_BITS, PERMISSION_BITS2, OCTAL_RADIX2, GO_KEYRING_BASE64_PREFIX;
+var CREDENTIAL_UNAVAILABLE_EXIT, CREDENTIAL_COMMAND_TIMEOUT_MS, CREDENTIAL_INTERACTIVE_TIMEOUT_MS, GROUP_OTHER_PERMISSION_BITS, PERMISSION_BITS2, OCTAL_RADIX2, GO_KEYRING_BASE64_PREFIX, NO_PERSON_REASON;
 var init_credential = __esm({
   "src/credential.ts"() {
     "use strict";
@@ -8402,6 +8430,7 @@ var init_credential = __esm({
     PERMISSION_BITS2 = 511;
     OCTAL_RADIX2 = 8;
     GO_KEYRING_BASE64_PREFIX = "go-keyring-base64:";
+    NO_PERSON_REASON = "needs a person to approve it, but there is no terminal or desktop session";
   }
 });
 
@@ -11498,13 +11527,13 @@ function resolveLaunch(params) {
     environment
   };
 }
-function runLaunchPlan(plan, spawn3) {
+function runLaunchPlan(plan, spawn4) {
   try {
     if (plan.hold() === "cancelled") {
       return LAUNCH_CANCELLED_EXIT;
     }
     plan.markChildStarted();
-    const result = spawn3.spawnSync(plan.bin, plan.args, { stdio: "inherit", env: plan.env });
+    const result = spawn4.spawnSync(plan.bin, plan.args, { stdio: "inherit", env: plan.env });
     if (result.error !== void 0) {
       throw result.error;
     }

package/dist/index.mjs

@@ -4426,7 +4426,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "agent-shim",
-      version: "11.55.0",
+      version: "11.56.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -5718,6 +5718,9 @@ function hasDesktopSession() {
     const result = spawnSync("launchctl", ["managername"], { encoding: "utf8" });
     return result.status === 0 && result.stdout.trim() === MACOS_GUI_SESSION_MANAGER;
   }
+  return hasDisplayServer();
+}
+function hasDisplayServer() {
   if (process.platform === "win32") {
     return false;
   }
@@ -8053,7 +8056,7 @@ var init_credentialCache = __esm({
 });
 
 // src/realCredentialCache.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
+import { spawn as spawn3, spawnSync as spawnSync2 } from "node:child_process";
 import fs6 from "node:fs";
 import path24 from "node:path";
 function cacheFileNameFor(owner) {
@@ -8280,51 +8283,77 @@ function unpackKeyringToken(raw) {
   }
   return trimmed;
 }
-function trySource(source, params) {
-  const none = (reason, warn = false) => ({ ok: false, reason, warn });
+function declined(reason, warn = false) {
+  return { ok: false, reason, warn };
+}
+function isCommandBacked(source) {
+  return "command" in source || "op" in source || "keychain" in source;
+}
+function immediateOutcome(source, params) {
   if ("env" in source) {
     const value = params.env[source.env];
-    return value === void 0 || value === "" ? none("is unset or empty") : { ok: true, token: unpackKeyringToken(value) };
+    return value === void 0 || value === "" ? declined("is unset or empty") : { ok: true, token: unpackKeyringToken(value) };
   }
   if ("literal" in source) {
     return { ok: true, token: source.literal };
   }
-  if ("file" in source) {
-    const read = params.port.readSecretFile(source.file);
-    if (!read.found) {
-      return none("does not exist");
-    }
-    if (read.mode !== void 0 && (read.mode & GROUP_OTHER_PERMISSION_BITS) !== 0) {
-      return none(
-        `is readable or writable by group or others (mode ${(read.mode & PERMISSION_BITS2).toString(OCTAL_RADIX2)}); run \`chmod 600 ${source.file}\``,
-        true
-      );
-    }
-    const token2 = unpackKeyringToken(read.content.trim());
-    return token2 === "" ? none("is empty") : { ok: true, token: token2 };
+  const read = params.port.readSecretFile(source.file);
+  if (!read.found) {
+    return declined("does not exist");
   }
-  const argv = commandArgv(source);
-  const interactive = isInteractiveSource(source, params.env);
-  if (interactive && !params.port.personPresent()) {
-    return none("needs a person to approve it, but there is no terminal or desktop session");
+  if (read.mode !== void 0 && (read.mode & GROUP_OTHER_PERMISSION_BITS) !== 0) {
+    return declined(
+      `is readable or writable by group or others (mode ${(read.mode & PERMISSION_BITS2).toString(OCTAL_RADIX2)}); run \`chmod 600 ${source.file}\``,
+      true
+    );
   }
-  const timeoutMs = source.timeoutMs ?? (interactive ? CREDENTIAL_INTERACTIVE_TIMEOUT_MS : CREDENTIAL_COMMAND_TIMEOUT_MS);
-  const result = params.port.runCommand(argv, { timeoutMs, interactive });
+  const token = unpackKeyringToken(read.content.trim());
+  return token === "" ? declined("is empty") : { ok: true, token };
+}
+function commandRunOf(source, env) {
+  const interactive = isInteractiveSource(source, env);
+  return { argv: commandArgv(source), interactive, timeoutMs: source.timeoutMs ?? (interactive ? CREDENTIAL_INTERACTIVE_TIMEOUT_MS : CREDENTIAL_COMMAND_TIMEOUT_MS) };
+}
+function commandOutcome(result, timeoutMs) {
   if (result.timedOut) {
-    return none(`timed out after ${String(timeoutMs)}ms`);
+    return declined(`timed out after ${String(timeoutMs)}ms`);
   }
   if (result.status !== 0) {
     const stderr = result.stderr.trim();
     const outcome = result.status === null ? "could not be run or was killed by a signal" : `exited with status ${String(result.status)}`;
-    return none(`${outcome}${stderr === "" ? "" : `: ${stderr}`}`);
+    return declined(`${outcome}${stderr === "" ? "" : `: ${stderr}`}`);
   }
   const token = unpackKeyringToken(result.stdout.trim());
-  return token === "" ? none("printed no token") : { ok: true, token };
+  return token === "" ? declined("printed no token") : { ok: true, token };
+}
+function trySource(source, params) {
+  if (!isCommandBacked(source)) {
+    return immediateOutcome(source, params);
+  }
+  const run = commandRunOf(source, params.env);
+  if (run.interactive && !params.port.personPresent()) {
+    return declined(NO_PERSON_REASON);
+  }
+  return commandOutcome(params.port.runCommand(run.argv, { timeoutMs: run.timeoutMs, interactive: run.interactive }), run.timeoutMs);
 }
 function warmCommandFor(subject) {
   const [kind, name] = subject.split(" ");
   return kind === "provider" ? `agent-shim credential warm --provider ${name ?? ""}` : `agent-shim credential warm ${name ?? ""}`;
 }
+function cachedResolution(target, entry) {
+  return { ok: true, credential: { target, token: entry.token, source: entry.source, warnings: [], cachedAt: entry.fetchedAt } };
+}
+function liveResolution(target, token, source, warnings) {
+  return { ok: true, credential: { target, token, source, warnings } };
+}
+function unresolved(subject, cacheBlock, attempts) {
+  const hint = cacheBlock === void 0 ? "" : `; fill the cache from a terminal with \`${warmCommandFor(subject)}\``;
+  return { ok: false, message: `agent-shim: ${subject} has no usable credential: ${attempts.join("; ")}${hint}` };
+}
+function declinedLine(source, outcome, subject) {
+  const attempt = `${describeSource(source)} ${outcome.reason}`;
+  return { attempt, warning: outcome.warn ? `agent-shim: ${subject}: skipped ${attempt}` : void 0 };
+}
 function resolveCredential(params) {
   const target = params.credential.target ?? "bearer";
   const cacheBlock = params.credential.cache;
@@ -8333,7 +8362,7 @@ function resolveCredential(params) {
   if (cacheBlock !== void 0 && cache !== void 0 && store !== void 0 && params.refresh !== true) {
     const entry = cache.port.read(store, params.subject);
     if (entry !== void 0 && isFresh(entry, cacheBlock, cache.now())) {
-      return { ok: true, credential: { target, token: entry.token, source: entry.source, warnings: [], cachedAt: entry.fetchedAt } };
+      return cachedResolution(target, entry);
     }
   }
   const attempts = [];
@@ -8344,16 +8373,15 @@ function resolveCredential(params) {
       if (cache !== void 0 && store !== void 0) {
         cache.port.write(store, params.subject, { token: outcome.token, fetchedAt: cache.now(), source });
       }
-      return { ok: true, credential: { target, token: outcome.token, source, warnings } };
+      return liveResolution(target, outcome.token, source, warnings);
     }
-    const line = `${describeSource(source)} ${outcome.reason}`;
-    attempts.push(line);
-    if (outcome.warn) {
-      warnings.push(`agent-shim: ${params.subject}: skipped ${line}`);
+    const line = declinedLine(source, outcome, params.subject);
+    attempts.push(line.attempt);
+    if (line.warning !== void 0) {
+      warnings.push(line.warning);
     }
   }
-  const hint = cacheBlock === void 0 ? "" : `; fill the cache from a terminal with \`${warmCommandFor(params.subject)}\``;
-  return { ok: false, message: `agent-shim: ${params.subject} has no usable credential: ${attempts.join("; ")}${hint}` };
+  return unresolved(params.subject, cacheBlock, attempts);
 }
 function credentialVariables(target, token) {
   return {
@@ -8362,7 +8390,7 @@ function credentialVariables(target, token) {
     CLAUDE_CODE_OAUTH_TOKEN: target === "oauthToken" ? token : void 0
   };
 }
-var CREDENTIAL_UNAVAILABLE_EXIT, CREDENTIAL_COMMAND_TIMEOUT_MS, CREDENTIAL_INTERACTIVE_TIMEOUT_MS, GROUP_OTHER_PERMISSION_BITS, PERMISSION_BITS2, OCTAL_RADIX2, GO_KEYRING_BASE64_PREFIX;
+var CREDENTIAL_UNAVAILABLE_EXIT, CREDENTIAL_COMMAND_TIMEOUT_MS, CREDENTIAL_INTERACTIVE_TIMEOUT_MS, GROUP_OTHER_PERMISSION_BITS, PERMISSION_BITS2, OCTAL_RADIX2, GO_KEYRING_BASE64_PREFIX, NO_PERSON_REASON;
 var init_credential = __esm({
   "src/credential.ts"() {
     "use strict";
@@ -8374,6 +8402,7 @@ var init_credential = __esm({
     PERMISSION_BITS2 = 511;
     OCTAL_RADIX2 = 8;
     GO_KEYRING_BASE64_PREFIX = "go-keyring-base64:";
+    NO_PERSON_REASON = "needs a person to approve it, but there is no terminal or desktop session";
   }
 });
 
@@ -11472,13 +11501,13 @@ function resolveLaunch(params) {
     environment
   };
 }
-function runLaunchPlan(plan, spawn3) {
+function runLaunchPlan(plan, spawn4) {
   try {
     if (plan.hold() === "cancelled") {
       return LAUNCH_CANCELLED_EXIT;
     }
     plan.markChildStarted();
-    const result = spawn3.spawnSync(plan.bin, plan.args, { stdio: "inherit", env: plan.env });
+    const result = spawn4.spawnSync(plan.bin, plan.args, { stdio: "inherit", env: plan.env });
     if (result.error !== void 0) {
       throw result.error;
     }

package/dist/types/index.d.ts

@@ -283,8 +283,8 @@ declare const LaunchSchema: z.ZodObject<{
     statusline: z.ZodOptional<z.ZodObject<{
         layout: z.ZodOptional<z.ZodObject<{
             header: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-                model: "model";
                 account: "account";
+                model: "model";
                 identity: "identity";
                 provider: "provider";
                 version: "version";
@@ -1316,8 +1316,8 @@ declare const ConfigProfileSchema: z.ZodObject<{
         statusline: z.ZodOptional<z.ZodObject<{
             layout: z.ZodOptional<z.ZodObject<{
                 header: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-                    model: "model";
                     account: "account";
+                    model: "model";
                     identity: "identity";
                     provider: "provider";
                     version: "version";
@@ -1969,8 +1969,8 @@ declare const DirectoryRuleSchema: z.ZodObject<{
         statusline: z.ZodOptional<z.ZodObject<{
             layout: z.ZodOptional<z.ZodObject<{
                 header: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-                    model: "model";
                     account: "account";
+                    model: "model";
                     identity: "identity";
                     provider: "provider";
                     version: "version";
@@ -2549,8 +2549,8 @@ declare const DirectoryRulesSchema: z.ZodObject<{
             statusline: z.ZodOptional<z.ZodObject<{
                 layout: z.ZodOptional<z.ZodObject<{
                     header: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-                        model: "model";
                         account: "account";
+                        model: "model";
                         identity: "identity";
                         provider: "provider";
                         version: "version";
@@ -3130,8 +3130,8 @@ declare const PortableConfigSchema: z.ZodObject<{
         statusline: z.ZodOptional<z.ZodObject<{
             layout: z.ZodOptional<z.ZodObject<{
                 header: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-                    model: "model";
                     account: "account";
+                    model: "model";
                     identity: "identity";
                     provider: "provider";
                     version: "version";
@@ -3690,8 +3690,8 @@ declare const GlobalConfigSchema: z.ZodObject<{
         statusline: z.ZodOptional<z.ZodObject<{
             layout: z.ZodOptional<z.ZodObject<{
                 header: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-                    model: "model";
                     account: "account";
+                    model: "model";
                     identity: "identity";
                     provider: "provider";
                     version: "version";
@@ -8428,6 +8428,7 @@ declare function createConfigApiRouter(deps: ConfigApiDeps): {
                 kind: zod.ZodLiteral<"profile">;
                 name: zod.ZodString;
                 value: zod.ZodObject<{
+                    description: zod.ZodOptional<zod.ZodString>;
                     entries: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnion<readonly [zod.ZodBoolean, zod.ZodObject<{
                         value: zod.ZodBoolean;
                         when: zod.ZodUnion<readonly [zod.ZodObject<{
@@ -8503,7 +8504,6 @@ declare function createConfigApiRouter(deps: ConfigApiDeps): {
                             key: zod.ZodType<trilean.JsonValue, unknown, zod_v4_core.$ZodTypeInternals<trilean.JsonValue, unknown>>;
                         }, zod_v4_core.$strip>], "kind">]>;
                     }, zod_v4_core.$strict>]>>>;
-                    description: zod.ZodOptional<zod.ZodString>;
                     models: zod.ZodOptional<zod.ZodObject<{
                         virtual: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnion<readonly [zod.ZodObject<{
                             mode: zod.ZodEnum<{
@@ -8578,8 +8578,8 @@ declare function createConfigApiRouter(deps: ConfigApiDeps): {
                         statusline: zod.ZodOptional<zod.ZodObject<{
                             layout: zod.ZodOptional<zod.ZodObject<{
                                 header: zod.ZodOptional<zod.ZodArray<zod.ZodEnum<{
-                                    model: "model";
                                     account: "account";
+                                    model: "model";
                                     identity: "identity";
                                     provider: "provider";
                                     version: "version";
@@ -8956,6 +8956,7 @@ declare function createConfigApiRouter(deps: ConfigApiDeps): {
                 kind: zod.ZodLiteral<"profile">;
                 name: zod.ZodString;
                 value: zod.ZodObject<{
+                    description: zod.ZodOptional<zod.ZodString>;
                     entries: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnion<readonly [zod.ZodBoolean, zod.ZodObject<{
                         value: zod.ZodBoolean;
                         when: zod.ZodUnion<readonly [zod.ZodObject<{
@@ -9031,7 +9032,6 @@ declare function createConfigApiRouter(deps: ConfigApiDeps): {
                             key: zod.ZodType<trilean.JsonValue, unknown, zod_v4_core.$ZodTypeInternals<trilean.JsonValue, unknown>>;
                         }, zod_v4_core.$strip>], "kind">]>;
                     }, zod_v4_core.$strict>]>>>;
-                    description: zod.ZodOptional<zod.ZodString>;
                     models: zod.ZodOptional<zod.ZodObject<{
                         virtual: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnion<readonly [zod.ZodObject<{
                             mode: zod.ZodEnum<{
@@ -9106,8 +9106,8 @@ declare function createConfigApiRouter(deps: ConfigApiDeps): {
                         statusline: zod.ZodOptional<zod.ZodObject<{
                             layout: zod.ZodOptional<zod.ZodObject<{
                                 header: zod.ZodOptional<zod.ZodArray<zod.ZodEnum<{
-                                    model: "model";
                                     account: "account";
+                                    model: "model";
                                     identity: "identity";
                                     provider: "provider";
                                     version: "version";
@@ -10110,8 +10110,8 @@ declare function createConfigApiRouter(deps: ConfigApiDeps): {
                         statusline: zod.ZodOptional<zod.ZodObject<{
                             layout: zod.ZodOptional<zod.ZodObject<{
                                 header: zod.ZodOptional<zod.ZodArray<zod.ZodEnum<{
-                                    model: "model";
                                     account: "account";
+                                    model: "model";
                                     identity: "identity";
                                     provider: "provider";
                                     version: "version";
@@ -10695,8 +10695,8 @@ declare function createConfigApiRouter(deps: ConfigApiDeps): {
                         statusline: zod.ZodOptional<zod.ZodObject<{
                             layout: zod.ZodOptional<zod.ZodObject<{
                                 header: zod.ZodOptional<zod.ZodArray<zod.ZodEnum<{
-                                    model: "model";
                                     account: "account";
+                                    model: "model";
                                     identity: "identity";
                                     provider: "provider";
                                     version: "version";
@@ -11369,8 +11369,8 @@ interface CliOverride {
 declare const StatuslineSchema: z.ZodObject<{
     layout: z.ZodOptional<z.ZodObject<{
         header: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-            model: "model";
             account: "account";
+            model: "model";
             identity: "identity";
             provider: "provider";
             version: "version";
@@ -12034,8 +12034,8 @@ declare function createLaunchApiRouter(deps: LaunchApiDeps): {
                 statusline: zod.ZodOptional<zod.ZodObject<{
                     layout: zod.ZodOptional<zod.ZodObject<{
                         header: zod.ZodOptional<zod.ZodArray<zod.ZodEnum<{
-                            model: "model";
                             account: "account";
+                            model: "model";
                             identity: "identity";
                             provider: "provider";
                             version: "version";
@@ -13510,8 +13510,8 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                 statusline: zod.ZodOptional<zod.ZodObject<{
                     layout: zod.ZodOptional<zod.ZodObject<{
                         header: zod.ZodOptional<zod.ZodArray<zod.ZodEnum<{
-                            model: "model";
                             account: "account";
+                            model: "model";
                             identity: "identity";
                             provider: "provider";
                             version: "version";
@@ -14128,6 +14128,7 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                 kind: zod.ZodLiteral<"profile">;
                 name: zod.ZodString;
                 value: zod.ZodObject<{
+                    description: zod.ZodOptional<zod.ZodString>;
                     entries: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnion<readonly [zod.ZodBoolean, zod.ZodObject<{
                         value: zod.ZodBoolean;
                         when: zod.ZodUnion<readonly [zod.ZodObject<{
@@ -14203,7 +14204,6 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                             key: zod.ZodType<trilean.JsonValue, unknown, zod_v4_core.$ZodTypeInternals<trilean.JsonValue, unknown>>;
                         }, zod_v4_core.$strip>], "kind">]>;
                     }, zod_v4_core.$strict>]>>>;
-                    description: zod.ZodOptional<zod.ZodString>;
                     models: zod.ZodOptional<zod.ZodObject<{
                         virtual: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnion<readonly [zod.ZodObject<{
                             mode: zod.ZodEnum<{
@@ -14278,8 +14278,8 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                         statusline: zod.ZodOptional<zod.ZodObject<{
                             layout: zod.ZodOptional<zod.ZodObject<{
                                 header: zod.ZodOptional<zod.ZodArray<zod.ZodEnum<{
-                                    model: "model";
                                     account: "account";
+                                    model: "model";
                                     identity: "identity";
                                     provider: "provider";
                                     version: "version";
@@ -14656,6 +14656,7 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                 kind: zod.ZodLiteral<"profile">;
                 name: zod.ZodString;
                 value: zod.ZodObject<{
+                    description: zod.ZodOptional<zod.ZodString>;
                     entries: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnion<readonly [zod.ZodBoolean, zod.ZodObject<{
                         value: zod.ZodBoolean;
                         when: zod.ZodUnion<readonly [zod.ZodObject<{
@@ -14731,7 +14732,6 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                             key: zod.ZodType<trilean.JsonValue, unknown, zod_v4_core.$ZodTypeInternals<trilean.JsonValue, unknown>>;
                         }, zod_v4_core.$strip>], "kind">]>;
                     }, zod_v4_core.$strict>]>>>;
-                    description: zod.ZodOptional<zod.ZodString>;
                     models: zod.ZodOptional<zod.ZodObject<{
                         virtual: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnion<readonly [zod.ZodObject<{
                             mode: zod.ZodEnum<{
@@ -14806,8 +14806,8 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                         statusline: zod.ZodOptional<zod.ZodObject<{
                             layout: zod.ZodOptional<zod.ZodObject<{
                                 header: zod.ZodOptional<zod.ZodArray<zod.ZodEnum<{
-                                    model: "model";
                                     account: "account";
+                                    model: "model";
                                     identity: "identity";
                                     provider: "provider";
                                     version: "version";
@@ -15810,8 +15810,8 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                         statusline: zod.ZodOptional<zod.ZodObject<{
                             layout: zod.ZodOptional<zod.ZodObject<{
                                 header: zod.ZodOptional<zod.ZodArray<zod.ZodEnum<{
-                                    model: "model";
                                     account: "account";
+                                    model: "model";
                                     identity: "identity";
                                     provider: "provider";
                                     version: "version";
@@ -16395,8 +16395,8 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                         statusline: zod.ZodOptional<zod.ZodObject<{
                             layout: zod.ZodOptional<zod.ZodObject<{
                                 header: zod.ZodOptional<zod.ZodArray<zod.ZodEnum<{
-                                    model: "model";
                                     account: "account";
+                                    model: "model";
                                     identity: "identity";
                                     provider: "provider";
                                     version: "version";
@@ -17871,6 +17871,7 @@ declare const ConfigProfileAddOutputSchema: z.ZodObject<{
     kind: z.ZodLiteral<"profile">;
     name: z.ZodString;
     value: z.ZodObject<{
+        description: z.ZodOptional<z.ZodString>;
         entries: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
             value: z.ZodBoolean;
             when: z.ZodUnion<readonly [z.ZodObject<{
@@ -17946,7 +17947,6 @@ declare const ConfigProfileAddOutputSchema: z.ZodObject<{
                 key: z.ZodType<trilean.JsonValue, unknown, z.core.$ZodTypeInternals<trilean.JsonValue, unknown>>;
             }, z.core.$strip>], "kind">]>;
         }, z.core.$strict>]>>>;
-        description: z.ZodOptional<z.ZodString>;
         models: z.ZodOptional<z.ZodObject<{
             virtual: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
                 mode: z.ZodEnum<{
@@ -18021,8 +18021,8 @@ declare const ConfigProfileAddOutputSchema: z.ZodObject<{
             statusline: z.ZodOptional<z.ZodObject<{
                 layout: z.ZodOptional<z.ZodObject<{
                     header: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-                        model: "model";
                         account: "account";
+                        model: "model";
                         identity: "identity";
                         provider: "provider";
                         version: "version";
@@ -18401,6 +18401,7 @@ declare const ConfigProfileSetOutputSchema: z.ZodObject<{
     kind: z.ZodLiteral<"profile">;
     name: z.ZodString;
     value: z.ZodObject<{
+        description: z.ZodOptional<z.ZodString>;
         entries: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
             value: z.ZodBoolean;
             when: z.ZodUnion<readonly [z.ZodObject<{
@@ -18476,7 +18477,6 @@ declare const ConfigProfileSetOutputSchema: z.ZodObject<{
                 key: z.ZodType<trilean.JsonValue, unknown, z.core.$ZodTypeInternals<trilean.JsonValue, unknown>>;
             }, z.core.$strip>], "kind">]>;
         }, z.core.$strict>]>>>;
-        description: z.ZodOptional<z.ZodString>;
         models: z.ZodOptional<z.ZodObject<{
             virtual: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
                 mode: z.ZodEnum<{
@@ -18551,8 +18551,8 @@ declare const ConfigProfileSetOutputSchema: z.ZodObject<{
             statusline: z.ZodOptional<z.ZodObject<{
                 layout: z.ZodOptional<z.ZodObject<{
                     header: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-                        model: "model";
                         account: "account";
+                        model: "model";
                         identity: "identity";
                         provider: "provider";
                         version: "version";
@@ -19557,8 +19557,8 @@ declare const ConfigRuleAddOutputSchema: z.ZodObject<{
             statusline: z.ZodOptional<z.ZodObject<{
                 layout: z.ZodOptional<z.ZodObject<{
                     header: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-                        model: "model";
                         account: "account";
+                        model: "model";
                         identity: "identity";
                         provider: "provider";
                         version: "version";
@@ -20144,8 +20144,8 @@ declare const ConfigRuleSetOutputSchema: z.ZodObject<{
             statusline: z.ZodOptional<z.ZodObject<{
                 layout: z.ZodOptional<z.ZodObject<{
                     header: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-                        model: "model";
                         account: "account";
+                        model: "model";
                         identity: "identity";
                         provider: "provider";
                         version: "version";
@@ -20988,8 +20988,8 @@ declare const LaunchResolveOutputSchema: z.ZodObject<{
         statusline: z.ZodOptional<z.ZodObject<{
             layout: z.ZodOptional<z.ZodObject<{
                 header: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-                    model: "model";
                     account: "account";
+                    model: "model";
                     identity: "identity";
                     provider: "provider";
                     version: "version";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-shim",
-  "version": "11.55.0",
+  "version": "11.56.0",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",