agent-shim 11.55.0 → 11.56.1

package/dist/cli.cjs

@@ -29545,11 +29545,59 @@ function hasDesktopSession() {
     const result = (0, import_node_child_process2.spawnSync)("launchctl", ["managername"], { encoding: "utf8" });
     return result.status === 0 && result.stdout.trim() === MACOS_GUI_SESSION_MANAGER;
   }
+  return hasDisplayServer();
+}
+function hasDisplayServer() {
   if (process.platform === "win32") {
     return false;
   }
   return (process.env.DISPLAY ?? "") !== "" || (process.env.WAYLAND_DISPLAY ?? "") !== "";
 }
+async function hasDesktopSessionAsync() {
+  if (process.platform !== "darwin") {
+    return hasDisplayServer();
+  }
+  return await new Promise((resolve2) => {
+    (0, import_node_child_process2.execFile)("launchctl", ["managername"], { encoding: "utf8" }, (error63, stdout2) => {
+      resolve2(error63 === null && stdout2.trim() === MACOS_GUI_SESSION_MANAGER);
+    });
+  });
+}
+async function runCredentialCommand(argv, options) {
+  const [command, ...args] = argv;
+  return await new Promise((resolve2) => {
+    const child = (0, import_node_child_process2.spawn)(command, args, { stdio: options.interactive ? ["inherit", "pipe", "inherit"] : ["ignore", "pipe", "pipe"] });
+    let stdout2 = "";
+    let stderr = "";
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill();
+    }, options.timeoutMs);
+    let settled = false;
+    const settle2 = (result) => {
+      if (!settled) {
+        settled = true;
+        clearTimeout(timer);
+        resolve2(result);
+      }
+    };
+    child.stdout?.setEncoding("utf8");
+    child.stdout?.on("data", (chunk2) => {
+      stdout2 += chunk2;
+    });
+    child.stderr?.setEncoding("utf8");
+    child.stderr?.on("data", (chunk2) => {
+      stderr += chunk2;
+    });
+    child.once("error", (error63) => {
+      settle2({ status: null, stdout: "", stderr: error63.message, timedOut: false });
+    });
+    child.once("close", (status) => {
+      settle2(timedOut ? { status: null, stdout: "", stderr: "", timedOut: true } : { status, stdout: stdout2, stderr: options.interactive ? "" : stderr, timedOut: false });
+    });
+  });
+}
 function resolveGitBranch(run, cwd) {
   const result = run.run("git", ["-C", cwd, "rev-parse", "--abbrev-ref", "HEAD"]);
   if (result.status !== 0) {
@@ -29746,7 +29794,7 @@ function realResolveClaudeBinary(isOwnBinary) {
 function realInstalledClaudeVersions() {
   return installedVersions(listVersionsDir(defaultVersionsDir()));
 }
-var import_node_child_process2, import_node_crypto4, import_node_fs3, import_node_os2, import_node_path9, import_node_sea, realFsPort, OWNER_ONLY_DIR_MODE, OWNER_ONLY_FILE_MODE, PERMISSION_BITS, realFarmFs, INT32_BYTE_LENGTH, KEY_POLL_MS, CTRL_C_BYTE, realHoldPort, LINE_FEED, UTF8_CONTINUATION_MASK, UTF8_CONTINUATION_BITS, PS_TIMEOUT_MS, realRunPort, MACOS_GUI_SESSION_MANAGER, realCredentialPort, SOCKET_PERMISSION_BITS, realHeadroomSocketTrust, realSpawnPort, realProcPort, realLogPort, EXECUTE_BITS_MASK, WINDOWS_DEFAULT_PATHEXT;
+var import_node_child_process2, import_node_crypto4, import_node_fs3, import_node_os2, import_node_path9, import_node_sea, realFsPort, OWNER_ONLY_DIR_MODE, OWNER_ONLY_FILE_MODE, PERMISSION_BITS, realFarmFs, INT32_BYTE_LENGTH, KEY_POLL_MS, CTRL_C_BYTE, realHoldPort, LINE_FEED, UTF8_CONTINUATION_MASK, UTF8_CONTINUATION_BITS, PS_TIMEOUT_MS, realRunPort, MACOS_GUI_SESSION_MANAGER, realCredentialPort, realAsyncCredentialPort, SOCKET_PERMISSION_BITS, realHeadroomSocketTrust, realSpawnPort, realProcPort, realLogPort, EXECUTE_BITS_MASK, WINDOWS_DEFAULT_PATHEXT;
 var init_realPorts = __esm({
   "src/realPorts.ts"() {
     "use strict";
@@ -29962,6 +30010,11 @@ var init_realPorts = __esm({
       },
       personPresent: () => process.stdin.isTTY || hasDesktopSession()
     };
+    realAsyncCredentialPort = {
+      readSecretFile: (filePath) => realCredentialPort.readSecretFile(filePath),
+      runCommand: runCredentialCommand,
+      personPresent: async () => process.stdin.isTTY || await hasDesktopSessionAsync()
+    };
     SOCKET_PERMISSION_BITS = 4095;
     realHeadroomSocketTrust = {
       platform: process.platform,
@@ -35365,51 +35418,87 @@ function unpackKeyringToken(raw) {
   }
   return trimmed;
 }
-function trySource(source, params) {
-  const none = (reason, warn = false) => ({ ok: false, reason, warn });
+function declined(reason, warn = false) {
+  return { ok: false, reason, warn };
+}
+function isCommandBacked(source) {
+  return "command" in source || "op" in source || "keychain" in source;
+}
+function immediateOutcome(source, params) {
   if ("env" in source) {
     const value2 = params.env[source.env];
-    return value2 === void 0 || value2 === "" ? none("is unset or empty") : { ok: true, token: unpackKeyringToken(value2) };
+    return value2 === void 0 || value2 === "" ? declined("is unset or empty") : { ok: true, token: unpackKeyringToken(value2) };
   }
   if ("literal" in source) {
     return { ok: true, token: source.literal };
   }
-  if ("file" in source) {
-    const read = params.port.readSecretFile(source.file);
-    if (!read.found) {
-      return none("does not exist");
-    }
-    if (read.mode !== void 0 && (read.mode & GROUP_OTHER_PERMISSION_BITS) !== 0) {
-      return none(
-        `is readable or writable by group or others (mode ${(read.mode & PERMISSION_BITS2).toString(OCTAL_RADIX2)}); run \`chmod 600 ${source.file}\``,
-        true
-      );
-    }
-    const token2 = unpackKeyringToken(read.content.trim());
-    return token2 === "" ? none("is empty") : { ok: true, token: token2 };
+  const read = params.port.readSecretFile(source.file);
+  if (!read.found) {
+    return declined("does not exist");
   }
-  const argv = commandArgv(source);
-  const interactive = isInteractiveSource(source, params.env);
-  if (interactive && !params.port.personPresent()) {
-    return none("needs a person to approve it, but there is no terminal or desktop session");
+  if (read.mode !== void 0 && (read.mode & GROUP_OTHER_PERMISSION_BITS) !== 0) {
+    return declined(
+      `is readable or writable by group or others (mode ${(read.mode & PERMISSION_BITS2).toString(OCTAL_RADIX2)}); run \`chmod 600 ${source.file}\``,
+      true
+    );
   }
-  const timeoutMs = source.timeoutMs ?? (interactive ? CREDENTIAL_INTERACTIVE_TIMEOUT_MS : CREDENTIAL_COMMAND_TIMEOUT_MS);
-  const result = params.port.runCommand(argv, { timeoutMs, interactive });
+  const token = unpackKeyringToken(read.content.trim());
+  return token === "" ? declined("is empty") : { ok: true, token };
+}
+function commandRunOf(source, env) {
+  const interactive = isInteractiveSource(source, env);
+  return { argv: commandArgv(source), interactive, timeoutMs: source.timeoutMs ?? (interactive ? CREDENTIAL_INTERACTIVE_TIMEOUT_MS : CREDENTIAL_COMMAND_TIMEOUT_MS) };
+}
+function commandOutcome(result, timeoutMs) {
   if (result.timedOut) {
-    return none(`timed out after ${String(timeoutMs)}ms`);
+    return declined(`timed out after ${String(timeoutMs)}ms`);
   }
   if (result.status !== 0) {
     const stderr = result.stderr.trim();
     const outcome = result.status === null ? "could not be run or was killed by a signal" : `exited with status ${String(result.status)}`;
-    return none(`${outcome}${stderr === "" ? "" : `: ${stderr}`}`);
+    return declined(`${outcome}${stderr === "" ? "" : `: ${stderr}`}`);
   }
   const token = unpackKeyringToken(result.stdout.trim());
-  return token === "" ? none("printed no token") : { ok: true, token };
+  return token === "" ? declined("printed no token") : { ok: true, token };
+}
+function trySource(source, params) {
+  if (!isCommandBacked(source)) {
+    return immediateOutcome(source, params);
+  }
+  const run = commandRunOf(source, params.env);
+  if (run.interactive && !params.port.personPresent()) {
+    return declined(NO_PERSON_REASON);
+  }
+  return commandOutcome(params.port.runCommand(run.argv, { timeoutMs: run.timeoutMs, interactive: run.interactive }), run.timeoutMs);
+}
+async function trySourceAsync(source, params) {
+  if (!isCommandBacked(source)) {
+    return immediateOutcome(source, params);
+  }
+  const run = commandRunOf(source, params.env);
+  if (run.interactive && !await params.port.personPresent()) {
+    return declined(NO_PERSON_REASON);
+  }
+  return commandOutcome(await params.port.runCommand(run.argv, { timeoutMs: run.timeoutMs, interactive: run.interactive }), run.timeoutMs);
 }
 function warmCommandFor(subject) {
   const [kind, name] = subject.split(" ");
   return kind === "provider" ? `agent-shim credential warm --provider ${name ?? ""}` : `agent-shim credential warm ${name ?? ""}`;
 }
+function cachedResolution(target, entry) {
+  return { ok: true, credential: { target, token: entry.token, source: entry.source, warnings: [], cachedAt: entry.fetchedAt } };
+}
+function liveResolution(target, token, source, warnings) {
+  return { ok: true, credential: { target, token, source, warnings } };
+}
+function unresolved(subject, cacheBlock, attempts) {
+  const hint = cacheBlock === void 0 ? "" : `; fill the cache from a terminal with \`${warmCommandFor(subject)}\``;
+  return { ok: false, message: `agent-shim: ${subject} has no usable credential: ${attempts.join("; ")}${hint}` };
+}
+function declinedLine(source, outcome, subject) {
+  const attempt = `${describeSource(source)} ${outcome.reason}`;
+  return { attempt, warning: outcome.warn ? `agent-shim: ${subject}: skipped ${attempt}` : void 0 };
+}
 function resolveCredential(params) {
   const target = params.credential.target ?? "bearer";
   const cacheBlock = params.credential.cache;
@@ -35418,7 +35507,7 @@ function resolveCredential(params) {
   if (cacheBlock !== void 0 && cache !== void 0 && store !== void 0 && params.refresh !== true) {
     const entry = cache.port.read(store, params.subject);
     if (entry !== void 0 && isFresh(entry, cacheBlock, cache.now())) {
-      return { ok: true, credential: { target, token: entry.token, source: entry.source, warnings: [], cachedAt: entry.fetchedAt } };
+      return cachedResolution(target, entry);
     }
   }
   const attempts = [];
@@ -35429,16 +35518,59 @@ function resolveCredential(params) {
       if (cache !== void 0 && store !== void 0) {
         cache.port.write(store, params.subject, { token: outcome.token, fetchedAt: cache.now(), source });
       }
-      return { ok: true, credential: { target, token: outcome.token, source, warnings } };
+      return liveResolution(target, outcome.token, source, warnings);
+    }
+    const line = declinedLine(source, outcome, params.subject);
+    attempts.push(line.attempt);
+    if (line.warning !== void 0) {
+      warnings.push(line.warning);
+    }
+  }
+  return unresolved(params.subject, cacheBlock, attempts);
+}
+async function resolveCredentialAsync(params) {
+  const target = params.credential.target ?? "bearer";
+  const cacheBlock = params.credential.cache;
+  const cache = cacheBlock === void 0 ? void 0 : params.port.cache;
+  const store = cacheBlock === void 0 || cache === void 0 ? void 0 : effectiveStore(cacheBlock, cache.platform);
+  if (cacheBlock !== void 0 && cache !== void 0 && store !== void 0 && params.refresh !== true) {
+    const entry = await cache.port.read(store, params.subject);
+    if (entry !== void 0 && isFresh(entry, cacheBlock, cache.now())) {
+      return cachedResolution(target, entry);
+    }
+  }
+  const attempts = [];
+  const warnings = [];
+  for (const source of params.credential.sources) {
+    const outcome = await trySourceAsync(source, params);
+    if (outcome.ok) {
+      if (cache !== void 0 && store !== void 0) {
+        await cache.port.write(store, params.subject, { token: outcome.token, fetchedAt: cache.now(), source });
+      }
+      return liveResolution(target, outcome.token, source, warnings);
     }
-    const line = `${describeSource(source)} ${outcome.reason}`;
-    attempts.push(line);
-    if (outcome.warn) {
-      warnings.push(`agent-shim: ${params.subject}: skipped ${line}`);
+    const line = declinedLine(source, outcome, params.subject);
+    attempts.push(line.attempt);
+    if (line.warning !== void 0) {
+      warnings.push(line.warning);
     }
   }
-  const hint = cacheBlock === void 0 ? "" : `; fill the cache from a terminal with \`${warmCommandFor(params.subject)}\``;
-  return { ok: false, message: `agent-shim: ${params.subject} has no usable credential: ${attempts.join("; ")}${hint}` };
+  return unresolved(params.subject, cacheBlock, attempts);
+}
+function shareInFlightResolutions(resolve2) {
+  const inFlight = /* @__PURE__ */ new Map();
+  return async (params) => {
+    const key = JSON.stringify([params.subject, params.credential, params.refresh === true]);
+    const running = inFlight.get(key);
+    if (running !== void 0) {
+      return await running;
+    }
+    const started = resolve2(params).finally(() => {
+      inFlight.delete(key);
+    });
+    inFlight.set(key, started);
+    return await started;
+  };
 }
 function credentialVariables(target, token) {
   return {
@@ -35447,7 +35579,7 @@ function credentialVariables(target, token) {
     CLAUDE_CODE_OAUTH_TOKEN: target === "oauthToken" ? token : void 0
   };
 }
-var CREDENTIAL_UNAVAILABLE_EXIT, CREDENTIAL_COMMAND_TIMEOUT_MS, CREDENTIAL_INTERACTIVE_TIMEOUT_MS, GROUP_OTHER_PERMISSION_BITS, PERMISSION_BITS2, OCTAL_RADIX2, GO_KEYRING_BASE64_PREFIX;
+var CREDENTIAL_UNAVAILABLE_EXIT, CREDENTIAL_COMMAND_TIMEOUT_MS, CREDENTIAL_INTERACTIVE_TIMEOUT_MS, GROUP_OTHER_PERMISSION_BITS, PERMISSION_BITS2, OCTAL_RADIX2, GO_KEYRING_BASE64_PREFIX, NO_PERSON_REASON;
 var init_credential = __esm({
   "src/credential.ts"() {
     "use strict";
@@ -35459,6 +35591,7 @@ var init_credential = __esm({
     PERMISSION_BITS2 = 511;
     OCTAL_RADIX2 = 8;
     GO_KEYRING_BASE64_PREFIX = "go-keyring-base64:";
+    NO_PERSON_REASON = "needs a person to approve it, but there is no terminal or desktop session";
   }
 });
 
@@ -36633,7 +36766,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "agent-shim",
-      version: "11.55.0",
+      version: "11.56.1",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -38070,6 +38203,30 @@ function security(args, stdin2) {
   const result = (0, import_node_child_process3.spawnSync)("security", args, { encoding: "utf8", ...stdin2 === void 0 ? {} : { input: stdin2 }, stdio: ["pipe", "pipe", "ignore"] });
   return { status: result.status, stdout: result.stdout };
 }
+async function securityAsync(args, stdin2) {
+  return await new Promise((resolve2) => {
+    const child = (0, import_node_child_process3.spawn)("security", args, { stdio: ["pipe", "pipe", "ignore"] });
+    let stdout2 = "";
+    let settled = false;
+    const settle2 = (status) => {
+      if (!settled) {
+        settled = true;
+        resolve2({ status, stdout: stdout2 });
+      }
+    };
+    child.stdout.setEncoding("utf8");
+    child.stdout.on("data", (chunk2) => {
+      stdout2 += chunk2;
+    });
+    child.stdin.on("error", () => {
+    });
+    child.stdin.end(stdin2);
+    child.once("error", () => {
+      settle2(null);
+    });
+    child.once("close", settle2);
+  });
+}
 function createRealCredentialCache(root) {
   const dir = import_node_path29.default.join(root, "credential-cache");
   const filePath = (owner) => import_node_path29.default.join(dir, cacheFileNameFor(owner));
@@ -38118,6 +38275,46 @@ function createRealCredentialCache(root) {
 function realCredentialCacheEnv(paths) {
   return { port: createRealCredentialCache(paths.root), platform: process.platform, now: () => Date.now() };
 }
+function createAsyncRealCredentialCache(root) {
+  const dir = import_node_path29.default.join(root, "credential-cache");
+  const filePath = (owner) => import_node_path29.default.join(dir, cacheFileNameFor(owner));
+  return {
+    async read(store, owner) {
+      if (store === "file") {
+        try {
+          return parseEntry(await import_node_fs9.default.promises.readFile(filePath(owner), "utf8"));
+        } catch {
+          return void 0;
+        }
+      }
+      requireKeychain();
+      const result = await securityAsync(["find-generic-password", "-s", KEYCHAIN_CACHE_SERVICE, "-a", owner, "-w"]);
+      return result.status === 0 ? parseEntry(Buffer.from(result.stdout.trim(), "base64").toString("utf8")) : void 0;
+    },
+    async write(store, owner, entry) {
+      const serialised = JSON.stringify(entry);
+      if (store === "file") {
+        await import_node_fs9.default.promises.mkdir(dir, { recursive: true, mode: CACHE_DIR_MODE });
+        await import_node_fs9.default.promises.chmod(dir, CACHE_DIR_MODE);
+        const target = filePath(owner);
+        const temp = `${target}.${String(process.pid)}.tmp`;
+        await import_node_fs9.default.promises.writeFile(temp, serialised, { mode: CACHE_FILE_MODE });
+        await import_node_fs9.default.promises.rename(temp, target);
+        return;
+      }
+      requireKeychain();
+      const encoded = Buffer.from(serialised, "utf8").toString("base64");
+      const result = await securityAsync(["-i"], `add-generic-password -U -s ${KEYCHAIN_CACHE_SERVICE} -a ${JSON.stringify(owner)} -w ${encoded}
+`);
+      if (result.status !== 0) {
+        throw new Error(`could not write the keychain credential cache for ${owner}`);
+      }
+    }
+  };
+}
+function realAsyncCredentialCacheEnv(paths) {
+  return { port: createAsyncRealCredentialCache(paths.root), platform: process.platform, now: () => Date.now() };
+}
 var import_node_child_process3, import_node_fs9, import_node_path29, KEYCHAIN_CACHE_SERVICE, CACHE_DIR_MODE, CACHE_FILE_MODE;
 var init_realCredentialCache = __esm({
   "src/realCredentialCache.ts"() {
@@ -65190,8 +65387,11 @@ setTimeout(() => { socket.destroy(); finish(failed, "no connection accepted with
 function declareThisProcessTheFrontDoor() {
   declaredPid = process.pid;
 }
+function isDeclaredFrontDoor(pid) {
+  return declaredPid !== void 0 && pid === declaredPid && pid === process.pid;
+}
 function isFrontDoorSupervisorPid(pid, identify) {
-  return declaredPid !== void 0 && pid === declaredPid && pid === process.pid || identify(pid);
+  return isDeclaredFrontDoor(pid) || identify(pid);
 }
 var declaredPid;
 var init_selfIdentity = __esm({
@@ -65242,7 +65442,8 @@ var init_trust = __esm({
 function realEnsurePorts(paths, spawnDaemon) {
   return {
     fs: realFarmFs,
-    isRunning: realIsProcessRunning,
+    // The door plans launches of its own (the usage probe, the window opener, jobs), and asked whether the supervisor the state file names is running, the answer for itself is known: a synchronous `ps` here would hold the loop that answers every session.
+    isRunning: (pid) => isDeclaredFrontDoor(pid) || realIsProcessRunning(pid),
     now: () => Date.now(),
     sleep: realSleepSync,
     spawnSupervisor: (layout) => spawnDaemon(layout, "__frontdoor-supervisor", layout.frontdoorLogPath),
@@ -68677,13 +68878,13 @@ function resolveLaunch(params) {
     environment
   };
 }
-function runLaunchPlan(plan, spawn8) {
+function runLaunchPlan(plan, spawn9) {
   try {
     if (plan.hold() === "cancelled") {
       return LAUNCH_CANCELLED_EXIT;
     }
     plan.markChildStarted();
-    const result = spawn8.spawnSync(plan.bin, plan.args, { stdio: "inherit", env: plan.env });
+    const result = spawn9.spawnSync(plan.bin, plan.args, { stdio: "inherit", env: plan.env });
     if (result.error !== void 0) {
       throw result.error;
     }
@@ -69171,7 +69372,7 @@ function createQuotaRefresher(deps) {
   const fetchNow = async (identity, provider, lookup, adapter) => {
     const key = `${identity}\0${provider}`;
     try {
-      const apiKey = lookup.apiKey();
+      const apiKey = await lookup.apiKey();
       const quota = await adapter.fetch(apiKey, deps.http, AbortSignal.timeout(QUOTA_REQUEST_TIMEOUT_MS), deps.now());
       if (!deps.record(identity, provider, quota)) {
         return { status: "no-usage" };
@@ -69241,8 +69442,8 @@ function createProviderLookup(ports) {
     }
     return {
       baseUrl,
-      apiKey: () => {
-        const resolution = resolveCredential({ credential: isRouterProvider(definition) ? { sources: [] } : definition.credential, env: ports.env, port: ports.credentials, subject: `provider ${name}` });
+      apiKey: async () => {
+        const resolution = await resolveCredentialAsync({ credential: isRouterProvider(definition) ? { sources: [] } : definition.credential, env: ports.env, port: ports.credentials, subject: `provider ${name}` });
         if (!resolution.ok) {
           throw new Error(resolution.message);
         }
@@ -132748,7 +132949,7 @@ function createAntigravityRoute(ports) {
         body: JSON.stringify({ type: "error", error: { type: "not_found_error", message: "no provider specified in path" } })
       };
     }
-    const lookup = ports.loadProvider(providerName);
+    const lookup = await ports.loadProvider(providerName);
     if (!lookup.ok) {
       return {
         status: lookup.status,
@@ -133262,6 +133463,7 @@ function resolveAccountTarget(model, models) {
 }
 function createProviderRouteResolver(deps) {
   const oauthRoute = createPassthroughRoute("anthropic", { baseUrl: `https://${CONNECT_INTERCEPT_HOST}:${String(HTTPS_PORT)}`, stripPrefix: void 0, headroomUpstream: void 0 });
+  const resolveCredential2 = shareInFlightResolutions(resolveCredentialAsync);
   const antigravityQuotaSources = /* @__PURE__ */ new Map();
   const antigravityRoutingMemory = /* @__PURE__ */ new Map();
   const definesProvider = (name) => {
@@ -133290,7 +133492,7 @@ function createProviderRouteResolver(deps) {
     const source = createCachedAntigravityQuotaSource({
       now: () => Date.now(),
       fetchSummary: async (nowMs) => {
-        const res = resolveCredential({ credential: definition.credential, env: deps.env, port: deps.credentials, subject: `provider ${provider}` });
+        const res = await resolveCredential2({ credential: definition.credential, env: deps.env, port: deps.credentials, subject: `provider ${provider}` });
         if (!res.ok) {
           return void 0;
         }
@@ -133356,8 +133558,8 @@ function createProviderRouteResolver(deps) {
         ok: true,
         route: createAntigravityRouteMount(
           {
-            loadProvider: () => {
-              const res = resolveCredential({
+            loadProvider: async () => {
+              const res = await resolveCredential2({
                 credential: antigravityProvider.credential,
                 env: deps.env,
                 port: deps.credentials,
@@ -133393,7 +133595,7 @@ function createProviderRouteResolver(deps) {
           stripPrefix: `${PROVIDER_PATH_PREFIX}${encodeURIComponent(provider)}`,
           headroomUpstream: directOrigin2(deps.directPort())
         }),
-        { provider, credential: httpProvider.credential, env: deps.env, port: deps.credentials }
+        { provider, credential: httpProvider.credential, env: deps.env, port: deps.credentials, resolve: resolveCredential2 }
       )
     };
   };
@@ -133539,7 +133741,7 @@ function attachingProviderCredential(route, deps) {
     headroomEligible: route.headroomEligible,
     headroomUpstream: route.headroomUpstream,
     serve: async (request7, response) => {
-      const resolution = resolveCredential({ credential: deps.credential, env: deps.env, port: deps.port, subject: `provider ${deps.provider}` });
+      const resolution = await deps.resolve({ credential: deps.credential, env: deps.env, port: deps.port, subject: `provider ${deps.provider}` });
       if (!resolution.ok) {
         response.start(HTTP_STATUS.badGateway, { "Content-Type": "application/json" });
         await response.write(
@@ -136581,7 +136783,7 @@ init_read();
 function createRealQuotaRefresher(params) {
   const { paths, store, log } = params;
   return createQuotaRefresher({
-    lookup: createProviderLookup({ fs: realFsPort, providersDir: paths.providersDir, env: process.env, credentials: realCredentialPort }),
+    lookup: createProviderLookup({ fs: realFsPort, providersDir: paths.providersDir, env: process.env, credentials: realAsyncCredentialPort }),
     http: realQuotaHttpGet,
     readQuota: (identity, provider) => {
       try {
@@ -136699,7 +136901,7 @@ function realFrontDoorSupervisorPorts(paths, respawnGeneration, retire, trackTun
       directPort: () => directPort,
       // The same port (cache included) the launcher resolves a launch's provider with, so the credential the door attaches at the route and the one the launcher handed the child are the same resolution of the same block.
       env: process.env,
-      credentials: { ...realCredentialPort, cache: realCredentialCacheEnv(paths) },
+      credentials: { ...realAsyncCredentialPort, cache: realAsyncCredentialCacheEnv(paths) },
       usageSnapshotOf: (identity) => identity === void 0 ? void 0 : routingSnapshots.get(identity) ?? readUsageSnapshot(realFarmFs, paths.usageSnapshotsDir, identity),
       // An `acct:` model member is served by relaunch: the door leaves a move request for the session's supervisor (found across every pool's registry, since the door does not know which pool launched the session) and answers the request with what is happening. A session nothing supervises gets the message naming the command to run instead.
       observations: (target) => observations.observation(target),

package/dist/index.cjs

@@ -4450,7 +4450,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "agent-shim",
-      version: "11.55.0",
+      version: "11.56.1",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -5737,6 +5737,9 @@ function hasDesktopSession() {
     const result = (0, import_node_child_process2.spawnSync)("launchctl", ["managername"], { encoding: "utf8" });
     return result.status === 0 && result.stdout.trim() === MACOS_GUI_SESSION_MANAGER;
   }
+  return hasDisplayServer();
+}
+function hasDisplayServer() {
   if (process.platform === "win32") {
     return false;
   }
@@ -8308,51 +8311,77 @@ function unpackKeyringToken(raw) {
   }
   return trimmed;
 }
-function trySource(source, params) {
-  const none = (reason, warn = false) => ({ ok: false, reason, warn });
+function declined(reason, warn = false) {
+  return { ok: false, reason, warn };
+}
+function isCommandBacked(source) {
+  return "command" in source || "op" in source || "keychain" in source;
+}
+function immediateOutcome(source, params) {
   if ("env" in source) {
     const value = params.env[source.env];
-    return value === void 0 || value === "" ? none("is unset or empty") : { ok: true, token: unpackKeyringToken(value) };
+    return value === void 0 || value === "" ? declined("is unset or empty") : { ok: true, token: unpackKeyringToken(value) };
   }
   if ("literal" in source) {
     return { ok: true, token: source.literal };
   }
-  if ("file" in source) {
-    const read = params.port.readSecretFile(source.file);
-    if (!read.found) {
-      return none("does not exist");
-    }
-    if (read.mode !== void 0 && (read.mode & GROUP_OTHER_PERMISSION_BITS) !== 0) {
-      return none(
-        `is readable or writable by group or others (mode ${(read.mode & PERMISSION_BITS2).toString(OCTAL_RADIX2)}); run \`chmod 600 ${source.file}\``,
-        true
-      );
-    }
-    const token2 = unpackKeyringToken(read.content.trim());
-    return token2 === "" ? none("is empty") : { ok: true, token: token2 };
+  const read = params.port.readSecretFile(source.file);
+  if (!read.found) {
+    return declined("does not exist");
   }
-  const argv = commandArgv(source);
-  const interactive = isInteractiveSource(source, params.env);
-  if (interactive && !params.port.personPresent()) {
-    return none("needs a person to approve it, but there is no terminal or desktop session");
+  if (read.mode !== void 0 && (read.mode & GROUP_OTHER_PERMISSION_BITS) !== 0) {
+    return declined(
+      `is readable or writable by group or others (mode ${(read.mode & PERMISSION_BITS2).toString(OCTAL_RADIX2)}); run \`chmod 600 ${source.file}\``,
+      true
+    );
   }
-  const timeoutMs = source.timeoutMs ?? (interactive ? CREDENTIAL_INTERACTIVE_TIMEOUT_MS : CREDENTIAL_COMMAND_TIMEOUT_MS);
-  const result = params.port.runCommand(argv, { timeoutMs, interactive });
+  const token = unpackKeyringToken(read.content.trim());
+  return token === "" ? declined("is empty") : { ok: true, token };
+}
+function commandRunOf(source, env) {
+  const interactive = isInteractiveSource(source, env);
+  return { argv: commandArgv(source), interactive, timeoutMs: source.timeoutMs ?? (interactive ? CREDENTIAL_INTERACTIVE_TIMEOUT_MS : CREDENTIAL_COMMAND_TIMEOUT_MS) };
+}
+function commandOutcome(result, timeoutMs) {
   if (result.timedOut) {
-    return none(`timed out after ${String(timeoutMs)}ms`);
+    return declined(`timed out after ${String(timeoutMs)}ms`);
   }
   if (result.status !== 0) {
     const stderr = result.stderr.trim();
     const outcome = result.status === null ? "could not be run or was killed by a signal" : `exited with status ${String(result.status)}`;
-    return none(`${outcome}${stderr === "" ? "" : `: ${stderr}`}`);
+    return declined(`${outcome}${stderr === "" ? "" : `: ${stderr}`}`);
   }
   const token = unpackKeyringToken(result.stdout.trim());
-  return token === "" ? none("printed no token") : { ok: true, token };
+  return token === "" ? declined("printed no token") : { ok: true, token };
+}
+function trySource(source, params) {
+  if (!isCommandBacked(source)) {
+    return immediateOutcome(source, params);
+  }
+  const run = commandRunOf(source, params.env);
+  if (run.interactive && !params.port.personPresent()) {
+    return declined(NO_PERSON_REASON);
+  }
+  return commandOutcome(params.port.runCommand(run.argv, { timeoutMs: run.timeoutMs, interactive: run.interactive }), run.timeoutMs);
 }
 function warmCommandFor(subject) {
   const [kind, name] = subject.split(" ");
   return kind === "provider" ? `agent-shim credential warm --provider ${name ?? ""}` : `agent-shim credential warm ${name ?? ""}`;
 }
+function cachedResolution(target, entry) {
+  return { ok: true, credential: { target, token: entry.token, source: entry.source, warnings: [], cachedAt: entry.fetchedAt } };
+}
+function liveResolution(target, token, source, warnings) {
+  return { ok: true, credential: { target, token, source, warnings } };
+}
+function unresolved(subject, cacheBlock, attempts) {
+  const hint = cacheBlock === void 0 ? "" : `; fill the cache from a terminal with \`${warmCommandFor(subject)}\``;
+  return { ok: false, message: `agent-shim: ${subject} has no usable credential: ${attempts.join("; ")}${hint}` };
+}
+function declinedLine(source, outcome, subject) {
+  const attempt = `${describeSource(source)} ${outcome.reason}`;
+  return { attempt, warning: outcome.warn ? `agent-shim: ${subject}: skipped ${attempt}` : void 0 };
+}
 function resolveCredential(params) {
   const target = params.credential.target ?? "bearer";
   const cacheBlock = params.credential.cache;
@@ -8361,7 +8390,7 @@ function resolveCredential(params) {
   if (cacheBlock !== void 0 && cache !== void 0 && store !== void 0 && params.refresh !== true) {
     const entry = cache.port.read(store, params.subject);
     if (entry !== void 0 && isFresh(entry, cacheBlock, cache.now())) {
-      return { ok: true, credential: { target, token: entry.token, source: entry.source, warnings: [], cachedAt: entry.fetchedAt } };
+      return cachedResolution(target, entry);
     }
   }
   const attempts = [];
@@ -8372,16 +8401,15 @@ function resolveCredential(params) {
       if (cache !== void 0 && store !== void 0) {
         cache.port.write(store, params.subject, { token: outcome.token, fetchedAt: cache.now(), source });
       }
-      return { ok: true, credential: { target, token: outcome.token, source, warnings } };
+      return liveResolution(target, outcome.token, source, warnings);
     }
-    const line = `${describeSource(source)} ${outcome.reason}`;
-    attempts.push(line);
-    if (outcome.warn) {
-      warnings.push(`agent-shim: ${params.subject}: skipped ${line}`);
+    const line = declinedLine(source, outcome, params.subject);
+    attempts.push(line.attempt);
+    if (line.warning !== void 0) {
+      warnings.push(line.warning);
     }
   }
-  const hint = cacheBlock === void 0 ? "" : `; fill the cache from a terminal with \`${warmCommandFor(params.subject)}\``;
-  return { ok: false, message: `agent-shim: ${params.subject} has no usable credential: ${attempts.join("; ")}${hint}` };
+  return unresolved(params.subject, cacheBlock, attempts);
 }
 function credentialVariables(target, token) {
   return {
@@ -8390,7 +8418,7 @@ function credentialVariables(target, token) {
     CLAUDE_CODE_OAUTH_TOKEN: target === "oauthToken" ? token : void 0
   };
 }
-var CREDENTIAL_UNAVAILABLE_EXIT, CREDENTIAL_COMMAND_TIMEOUT_MS, CREDENTIAL_INTERACTIVE_TIMEOUT_MS, GROUP_OTHER_PERMISSION_BITS, PERMISSION_BITS2, OCTAL_RADIX2, GO_KEYRING_BASE64_PREFIX;
+var CREDENTIAL_UNAVAILABLE_EXIT, CREDENTIAL_COMMAND_TIMEOUT_MS, CREDENTIAL_INTERACTIVE_TIMEOUT_MS, GROUP_OTHER_PERMISSION_BITS, PERMISSION_BITS2, OCTAL_RADIX2, GO_KEYRING_BASE64_PREFIX, NO_PERSON_REASON;
 var init_credential = __esm({
   "src/credential.ts"() {
     "use strict";
@@ -8402,6 +8430,7 @@ var init_credential = __esm({
     PERMISSION_BITS2 = 511;
     OCTAL_RADIX2 = 8;
     GO_KEYRING_BASE64_PREFIX = "go-keyring-base64:";
+    NO_PERSON_REASON = "needs a person to approve it, but there is no terminal or desktop session";
   }
 });
 
@@ -11498,13 +11527,13 @@ function resolveLaunch(params) {
     environment
   };
 }
-function runLaunchPlan(plan, spawn3) {
+function runLaunchPlan(plan, spawn4) {
   try {
     if (plan.hold() === "cancelled") {
       return LAUNCH_CANCELLED_EXIT;
     }
     plan.markChildStarted();
-    const result = spawn3.spawnSync(plan.bin, plan.args, { stdio: "inherit", env: plan.env });
+    const result = spawn4.spawnSync(plan.bin, plan.args, { stdio: "inherit", env: plan.env });
     if (result.error !== void 0) {
       throw result.error;
     }
@@ -11597,8 +11626,11 @@ var init_doorLog = __esm({
 });
 
 // src/frontdoor/selfIdentity.ts
+function isDeclaredFrontDoor(pid) {
+  return declaredPid !== void 0 && pid === declaredPid && pid === process.pid;
+}
 function isFrontDoorSupervisorPid(pid, identify) {
-  return declaredPid !== void 0 && pid === declaredPid && pid === process.pid || identify(pid);
+  return isDeclaredFrontDoor(pid) || identify(pid);
 }
 var declaredPid;
 var init_selfIdentity = __esm({
@@ -11649,7 +11681,8 @@ var init_trust = __esm({
 function realEnsurePorts(paths, spawnDaemon) {
   return {
     fs: realFarmFs,
-    isRunning: realIsProcessRunning,
+    // The door plans launches of its own (the usage probe, the window opener, jobs), and asked whether the supervisor the state file names is running, the answer for itself is known: a synchronous `ps` here would hold the loop that answers every session.
+    isRunning: (pid) => isDeclaredFrontDoor(pid) || realIsProcessRunning(pid),
     now: () => Date.now(),
     sleep: realSleepSync,
     spawnSupervisor: (layout) => spawnDaemon(layout, "__frontdoor-supervisor", layout.frontdoorLogPath),

package/dist/index.mjs

@@ -4426,7 +4426,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "agent-shim",
-      version: "11.55.0",
+      version: "11.56.1",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -5718,6 +5718,9 @@ function hasDesktopSession() {
     const result = spawnSync("launchctl", ["managername"], { encoding: "utf8" });
     return result.status === 0 && result.stdout.trim() === MACOS_GUI_SESSION_MANAGER;
   }
+  return hasDisplayServer();
+}
+function hasDisplayServer() {
   if (process.platform === "win32") {
     return false;
   }
@@ -8053,7 +8056,7 @@ var init_credentialCache = __esm({
 });
 
 // src/realCredentialCache.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
+import { spawn as spawn3, spawnSync as spawnSync2 } from "node:child_process";
 import fs6 from "node:fs";
 import path24 from "node:path";
 function cacheFileNameFor(owner) {
@@ -8280,51 +8283,77 @@ function unpackKeyringToken(raw) {
   }
   return trimmed;
 }
-function trySource(source, params) {
-  const none = (reason, warn = false) => ({ ok: false, reason, warn });
+function declined(reason, warn = false) {
+  return { ok: false, reason, warn };
+}
+function isCommandBacked(source) {
+  return "command" in source || "op" in source || "keychain" in source;
+}
+function immediateOutcome(source, params) {
   if ("env" in source) {
     const value = params.env[source.env];
-    return value === void 0 || value === "" ? none("is unset or empty") : { ok: true, token: unpackKeyringToken(value) };
+    return value === void 0 || value === "" ? declined("is unset or empty") : { ok: true, token: unpackKeyringToken(value) };
   }
   if ("literal" in source) {
     return { ok: true, token: source.literal };
   }
-  if ("file" in source) {
-    const read = params.port.readSecretFile(source.file);
-    if (!read.found) {
-      return none("does not exist");
-    }
-    if (read.mode !== void 0 && (read.mode & GROUP_OTHER_PERMISSION_BITS) !== 0) {
-      return none(
-        `is readable or writable by group or others (mode ${(read.mode & PERMISSION_BITS2).toString(OCTAL_RADIX2)}); run \`chmod 600 ${source.file}\``,
-        true
-      );
-    }
-    const token2 = unpackKeyringToken(read.content.trim());
-    return token2 === "" ? none("is empty") : { ok: true, token: token2 };
+  const read = params.port.readSecretFile(source.file);
+  if (!read.found) {
+    return declined("does not exist");
   }
-  const argv = commandArgv(source);
-  const interactive = isInteractiveSource(source, params.env);
-  if (interactive && !params.port.personPresent()) {
-    return none("needs a person to approve it, but there is no terminal or desktop session");
+  if (read.mode !== void 0 && (read.mode & GROUP_OTHER_PERMISSION_BITS) !== 0) {
+    return declined(
+      `is readable or writable by group or others (mode ${(read.mode & PERMISSION_BITS2).toString(OCTAL_RADIX2)}); run \`chmod 600 ${source.file}\``,
+      true
+    );
   }
-  const timeoutMs = source.timeoutMs ?? (interactive ? CREDENTIAL_INTERACTIVE_TIMEOUT_MS : CREDENTIAL_COMMAND_TIMEOUT_MS);
-  const result = params.port.runCommand(argv, { timeoutMs, interactive });
+  const token = unpackKeyringToken(read.content.trim());
+  return token === "" ? declined("is empty") : { ok: true, token };
+}
+function commandRunOf(source, env) {
+  const interactive = isInteractiveSource(source, env);
+  return { argv: commandArgv(source), interactive, timeoutMs: source.timeoutMs ?? (interactive ? CREDENTIAL_INTERACTIVE_TIMEOUT_MS : CREDENTIAL_COMMAND_TIMEOUT_MS) };
+}
+function commandOutcome(result, timeoutMs) {
   if (result.timedOut) {
-    return none(`timed out after ${String(timeoutMs)}ms`);
+    return declined(`timed out after ${String(timeoutMs)}ms`);
   }
   if (result.status !== 0) {
     const stderr = result.stderr.trim();
     const outcome = result.status === null ? "could not be run or was killed by a signal" : `exited with status ${String(result.status)}`;
-    return none(`${outcome}${stderr === "" ? "" : `: ${stderr}`}`);
+    return declined(`${outcome}${stderr === "" ? "" : `: ${stderr}`}`);
   }
   const token = unpackKeyringToken(result.stdout.trim());
-  return token === "" ? none("printed no token") : { ok: true, token };
+  return token === "" ? declined("printed no token") : { ok: true, token };
+}
+function trySource(source, params) {
+  if (!isCommandBacked(source)) {
+    return immediateOutcome(source, params);
+  }
+  const run = commandRunOf(source, params.env);
+  if (run.interactive && !params.port.personPresent()) {
+    return declined(NO_PERSON_REASON);
+  }
+  return commandOutcome(params.port.runCommand(run.argv, { timeoutMs: run.timeoutMs, interactive: run.interactive }), run.timeoutMs);
 }
 function warmCommandFor(subject) {
   const [kind, name] = subject.split(" ");
   return kind === "provider" ? `agent-shim credential warm --provider ${name ?? ""}` : `agent-shim credential warm ${name ?? ""}`;
 }
+function cachedResolution(target, entry) {
+  return { ok: true, credential: { target, token: entry.token, source: entry.source, warnings: [], cachedAt: entry.fetchedAt } };
+}
+function liveResolution(target, token, source, warnings) {
+  return { ok: true, credential: { target, token, source, warnings } };
+}
+function unresolved(subject, cacheBlock, attempts) {
+  const hint = cacheBlock === void 0 ? "" : `; fill the cache from a terminal with \`${warmCommandFor(subject)}\``;
+  return { ok: false, message: `agent-shim: ${subject} has no usable credential: ${attempts.join("; ")}${hint}` };
+}
+function declinedLine(source, outcome, subject) {
+  const attempt = `${describeSource(source)} ${outcome.reason}`;
+  return { attempt, warning: outcome.warn ? `agent-shim: ${subject}: skipped ${attempt}` : void 0 };
+}
 function resolveCredential(params) {
   const target = params.credential.target ?? "bearer";
   const cacheBlock = params.credential.cache;
@@ -8333,7 +8362,7 @@ function resolveCredential(params) {
   if (cacheBlock !== void 0 && cache !== void 0 && store !== void 0 && params.refresh !== true) {
     const entry = cache.port.read(store, params.subject);
     if (entry !== void 0 && isFresh(entry, cacheBlock, cache.now())) {
-      return { ok: true, credential: { target, token: entry.token, source: entry.source, warnings: [], cachedAt: entry.fetchedAt } };
+      return cachedResolution(target, entry);
     }
   }
   const attempts = [];
@@ -8344,16 +8373,15 @@ function resolveCredential(params) {
       if (cache !== void 0 && store !== void 0) {
         cache.port.write(store, params.subject, { token: outcome.token, fetchedAt: cache.now(), source });
       }
-      return { ok: true, credential: { target, token: outcome.token, source, warnings } };
+      return liveResolution(target, outcome.token, source, warnings);
     }
-    const line = `${describeSource(source)} ${outcome.reason}`;
-    attempts.push(line);
-    if (outcome.warn) {
-      warnings.push(`agent-shim: ${params.subject}: skipped ${line}`);
+    const line = declinedLine(source, outcome, params.subject);
+    attempts.push(line.attempt);
+    if (line.warning !== void 0) {
+      warnings.push(line.warning);
     }
   }
-  const hint = cacheBlock === void 0 ? "" : `; fill the cache from a terminal with \`${warmCommandFor(params.subject)}\``;
-  return { ok: false, message: `agent-shim: ${params.subject} has no usable credential: ${attempts.join("; ")}${hint}` };
+  return unresolved(params.subject, cacheBlock, attempts);
 }
 function credentialVariables(target, token) {
   return {
@@ -8362,7 +8390,7 @@ function credentialVariables(target, token) {
     CLAUDE_CODE_OAUTH_TOKEN: target === "oauthToken" ? token : void 0
   };
 }
-var CREDENTIAL_UNAVAILABLE_EXIT, CREDENTIAL_COMMAND_TIMEOUT_MS, CREDENTIAL_INTERACTIVE_TIMEOUT_MS, GROUP_OTHER_PERMISSION_BITS, PERMISSION_BITS2, OCTAL_RADIX2, GO_KEYRING_BASE64_PREFIX;
+var CREDENTIAL_UNAVAILABLE_EXIT, CREDENTIAL_COMMAND_TIMEOUT_MS, CREDENTIAL_INTERACTIVE_TIMEOUT_MS, GROUP_OTHER_PERMISSION_BITS, PERMISSION_BITS2, OCTAL_RADIX2, GO_KEYRING_BASE64_PREFIX, NO_PERSON_REASON;
 var init_credential = __esm({
   "src/credential.ts"() {
     "use strict";
@@ -8374,6 +8402,7 @@ var init_credential = __esm({
     PERMISSION_BITS2 = 511;
     OCTAL_RADIX2 = 8;
     GO_KEYRING_BASE64_PREFIX = "go-keyring-base64:";
+    NO_PERSON_REASON = "needs a person to approve it, but there is no terminal or desktop session";
   }
 });
 
@@ -11472,13 +11501,13 @@ function resolveLaunch(params) {
     environment
   };
 }
-function runLaunchPlan(plan, spawn3) {
+function runLaunchPlan(plan, spawn4) {
   try {
     if (plan.hold() === "cancelled") {
       return LAUNCH_CANCELLED_EXIT;
     }
     plan.markChildStarted();
-    const result = spawn3.spawnSync(plan.bin, plan.args, { stdio: "inherit", env: plan.env });
+    const result = spawn4.spawnSync(plan.bin, plan.args, { stdio: "inherit", env: plan.env });
     if (result.error !== void 0) {
       throw result.error;
     }
@@ -11566,8 +11595,11 @@ var init_doorLog = __esm({
 });
 
 // src/frontdoor/selfIdentity.ts
+function isDeclaredFrontDoor(pid) {
+  return declaredPid !== void 0 && pid === declaredPid && pid === process.pid;
+}
 function isFrontDoorSupervisorPid(pid, identify) {
-  return declaredPid !== void 0 && pid === declaredPid && pid === process.pid || identify(pid);
+  return isDeclaredFrontDoor(pid) || identify(pid);
 }
 var declaredPid;
 var init_selfIdentity = __esm({
@@ -11619,7 +11651,8 @@ import fs13 from "node:fs";
 function realEnsurePorts(paths, spawnDaemon) {
   return {
     fs: realFarmFs,
-    isRunning: realIsProcessRunning,
+    // The door plans launches of its own (the usage probe, the window opener, jobs), and asked whether the supervisor the state file names is running, the answer for itself is known: a synchronous `ps` here would hold the loop that answers every session.
+    isRunning: (pid) => isDeclaredFrontDoor(pid) || realIsProcessRunning(pid),
     now: () => Date.now(),
     sleep: realSleepSync,
     spawnSupervisor: (layout) => spawnDaemon(layout, "__frontdoor-supervisor", layout.frontdoorLogPath),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-shim",
-  "version": "11.55.0",
+  "version": "11.56.1",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",