agent-shim 11.74.0 → 11.76.0

package/dist/index.cjs

@@ -1229,6 +1229,8 @@ var init_schema = __esm({
       $schema: import_zod3.z.string().optional(),
       name: FileNameSchema,
       defaultConfigProfile: StoredNameSchema.optional(),
+      /** The provider this identity exists for: a launch on the identity routes through it unless `--provider`, `--no-provider` or a cascade layer's `launch.provider` says otherwise. Its sessions run on the provider's credential, so the identity needs no stored login. */
+      provider: StoredNameSchema.optional(),
       allowAmbientCredential: import_zod3.z.boolean().default(false),
       credential: CredentialSchema.optional(),
       /** When this identity's five-hour window should be open: the front door opens one at each anchor if none is. Absent, nothing is opened on a schedule. */
@@ -4762,7 +4764,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "agent-shim",
-      version: "11.74.0",
+      version: "11.76.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -9049,6 +9051,12 @@ function providerJsonPath(paths, name) {
 function providerExists(paths, name) {
   return import_node_fs6.default.existsSync(providerJsonPath(paths, name));
 }
+function requireProviderExists(paths, name) {
+  const canonical = canonicalProviderName(name, (candidate) => providerExists(paths, candidate), () => readProviderAliases(paths));
+  if (!providerExists(paths, canonical)) {
+    throw new ProviderNotFoundError(name);
+  }
+}
 function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -9283,18 +9291,18 @@ function removeProvider(paths, name) {
   }
   import_node_fs6.default.rmSync(providerJsonPath(paths, name));
 }
-function cascadeProviderName(cascade) {
+function cascadeProviderName(cascade, identityProvider) {
   let name;
   for (const layer of assembleCascade(cascade).layers) {
     if (layer.launch?.provider !== void 0) {
       name = layer.launch.provider;
     }
   }
-  return name;
+  return name ?? identityProvider;
 }
 function selectProvider(params) {
   const cliName = params.cliProvider !== void 0 && params.cliProvider !== "" ? params.cliProvider : void 0;
-  const named = cliName ?? (params.cascade === void 0 ? void 0 : cascadeProviderName(params.cascade));
+  const named = cliName ?? (params.cascade === void 0 ? params.identityProvider : cascadeProviderName(params.cascade, params.identityProvider));
   if (named === void 0) {
     return void 0;
   }
@@ -9454,6 +9462,9 @@ function decideSignIn(facts) {
   if (facts.hasCredentialBlock) {
     return { state: "token", detail: "supplies its own credential through a credential block, so a stored login is not what a launch uses" };
   }
+  if (facts.provider !== void 0) {
+    return { state: "token", detail: "runs provider sessions with the provider's credential, so a stored login is not what a launch uses" };
+  }
   if (facts.keychainItem === true) {
     return { state: "signed-in", detail: "a login is stored in the macOS Keychain" };
   }
@@ -9466,9 +9477,10 @@ function credentialsFilePath(farmRoot) {
   return import_node_path25.default.join(farmRoot, CREDENTIALS_FILE);
 }
 function identitySignIn(fs14, probe, identity) {
-  const probing = !identity.hasCredentialBlock;
+  const probing = !identity.hasCredentialBlock && identity.provider === void 0;
   return decideSignIn({
     hasCredentialBlock: identity.hasCredentialBlock,
+    provider: identity.provider,
     keychainItem: probing && probe.platform === "darwin" && probe.run !== void 0 ? keychainHasItem(probe.run, identity.farmRoot) : void 0,
     credentialsFile: probing && fs14.lstat(credentialsFilePath(identity.farmRoot)) !== void 0,
     platform: probe.platform
@@ -11731,7 +11743,8 @@ function decideLaunch(params, readOnly) {
     paths,
     port: fs14,
     ...parsedArgv.provider === void 0 || parsedArgv.provider === false ? {} : { cliProvider: parsedArgv.provider },
-    ...farmContext === void 0 ? {} : { cascade: farmContext.cascade }
+    ...farmContext === void 0 ? {} : { cascade: farmContext.cascade },
+    ...loadedIdentity?.config.provider === void 0 ? {} : { identityProvider: loadedIdentity.config.provider }
   };
   let selectedProvider;
   let resolvedProvider;
@@ -12352,7 +12365,7 @@ function realPrepareLaunchParams(paths, options) {
     frontdoor: realFrontDoorPort(paths, options.spawnDaemon),
     credentials: { ...realCredentialPort, cache: realCredentialCacheEnv(paths) },
     hold: realHoldPort,
-    hasStoredLogin: (identity) => identitySignIn(realFarmFs, { platform: process.platform, run: options.run ?? realRunPort }, { farmRoot: import_node_path41.default.join(paths.identitiesDir, identity), hasCredentialBlock: false }).state !== "signed-out",
+    hasStoredLogin: (identity) => identitySignIn(realFarmFs, { platform: process.platform, run: options.run ?? realRunPort }, { farmRoot: import_node_path41.default.join(paths.identitiesDir, identity), hasCredentialBlock: false, provider: void 0 }).state !== "signed-out",
     ...farm.directoryIdentity === void 0 ? {} : { directoryPinnedIdentity: farm.directoryIdentity },
     ...farm.directoryConfigProfile === void 0 ? {} : { directoryRuleConfigProfile: farm.directoryConfigProfile },
     ...farm.globalDefaultConfigProfile === void 0 ? {} : { globalDefaultConfigProfile: farm.globalDefaultConfigProfile },
@@ -16485,7 +16498,7 @@ function collectCheckReport(params) {
     read,
     ...configProfileDecision.name === void 0 ? {} : { baseConfigProfile: configProfileDecision.name }
   }).input;
-  const providerName = cascadeProviderName(cascade);
+  const providerName = cascadeProviderName(cascade, identityConfig?.provider);
   const provider = providerName === void 0 ? void 0 : loadCheckProvider(paths, providerName);
   const farmRoot = identityDecision.name === void 0 ? void 0 : import_node_path26.default.join(paths.identitiesDir, identityDecision.name);
   const settingsFiles = {
@@ -16914,6 +16927,12 @@ function setDefaultConfigProfile(paths, identityName, profileName) {
     defaultConfigProfile: profileName
   });
 }
+function setIdentityProvider(paths, identityName, providerName) {
+  if (!identityExists(paths, identityName)) {
+    throw new IdentityNotFoundError(identityName);
+  }
+  return applyPatch(identityJsonPath(paths, identityName), IdentitySchema, { provider: providerName });
+}
 function setAllowAmbientCredential(paths, identityName, allow) {
   if (!identityExists(paths, identityName)) {
     throw new IdentityNotFoundError(identityName);
@@ -17582,6 +17601,7 @@ function runDoctor(params) {
     }
   }
   const validProfileNames = new Set(profileSources.keys());
+  const validProviderNames = /* @__PURE__ */ new Set([...params.providers.map((entry) => entry.name), ...Object.keys(params.providerAliases ?? {})]);
   const validIdentityNames = /* @__PURE__ */ new Set();
   for (const entry of params.identities) {
     const validated3 = validate(IdentitySchema, entry, "identity", entry.name);
@@ -17591,35 +17611,47 @@ function runDoctor(params) {
     }
     validIdentityNames.add(entry.name);
     const defaultProfile = validated3.data.defaultConfigProfile;
+    let consistent = true;
     if (defaultProfile !== void 0 && !validProfileNames.has(defaultProfile)) {
+      consistent = false;
       push(
         "identity",
         "fail",
         `Identity "${entry.name}" names configuration profile "${defaultProfile}" as its default, but no such profile exists.`,
         entry.name
       );
-    } else {
-      const credential = validated3.data.credential;
-      const cache = credential === void 0 ? { text: "", unreadable: false } : cacheClause(params.credentialCache, `identity ${entry.name}`, credential);
-      push(
-        "identity",
-        cache.unreadable ? "fail" : "pass",
-        `${entry.name} is valid and authenticates with ${credential === void 0 ? "its stored login" : `credential ${describeCredential(credential)}`}${cache.text}.`,
-        entry.name
-      );
-      const signIn = decideSignIn({
-        hasCredentialBlock: credential !== void 0,
-        keychainItem: params.platform === "darwin" && params.run !== void 0 ? keychainHasItem(params.run, entry.farmRoot) : void 0,
-        credentialsFile: entry.credentialsFilePresent,
-        platform: params.platform
-      });
-      push(
-        "sign-in",
-        signIn.state === "signed-out" ? "warn" : "pass",
-        signIn.state === "signed-out" ? `${entry.name} is signed out (${signIn.detail}). Run \`agent-shim run @${entry.name}\` and sign in.` : `${entry.name} ${signIn.state === "token" ? "uses a credential block" : "is signed in"} (${signIn.detail}).`,
-        entry.name
-      );
     }
+    const identityProvider = validated3.data.provider;
+    if (identityProvider !== void 0 && !validProviderNames.has(identityProvider)) {
+      consistent = false;
+      push("identity", "fail", `Identity "${entry.name}" names provider "${identityProvider}" as its provider, but no such provider exists.`, entry.name);
+    }
+    if (!consistent) {
+      continue;
+    }
+    const credential = validated3.data.credential;
+    const cache = credential === void 0 ? { text: "", unreadable: false } : cacheClause(params.credentialCache, `identity ${entry.name}`, credential);
+    const authenticatesWith = credential !== void 0 ? `credential ${describeCredential(credential)}` : identityProvider !== void 0 ? `the credential of provider "${identityProvider}"` : "its stored login";
+    push(
+      "identity",
+      cache.unreadable ? "fail" : "pass",
+      `${entry.name} is valid and authenticates with ${authenticatesWith}${cache.text}.`,
+      entry.name
+    );
+    const standing = credential !== void 0 ? "uses a credential block" : identityProvider !== void 0 ? `exists for provider "${identityProvider}"` : "is signed in";
+    const signIn = decideSignIn({
+      hasCredentialBlock: credential !== void 0,
+      provider: identityProvider,
+      keychainItem: params.platform === "darwin" && params.run !== void 0 ? keychainHasItem(params.run, entry.farmRoot) : void 0,
+      credentialsFile: entry.credentialsFilePresent,
+      platform: params.platform
+    });
+    push(
+      "sign-in",
+      signIn.state === "signed-out" ? "warn" : "pass",
+      signIn.state === "signed-out" ? `${entry.name} is signed out (${signIn.detail}). Run \`agent-shim run @${entry.name}\` and sign in.` : `${entry.name} ${standing} (${signIn.detail}).`,
+      entry.name
+    );
   }
   const validatedGlobalConfig = params.globalConfig.raw === void 0 ? void 0 : validateJson(GlobalConfigSchema, params.globalConfig);
   const pools = validatedGlobalConfig?.ok === true ? validatedGlobalConfig.data.pools ?? {} : {};
@@ -18282,6 +18314,7 @@ var storedMutationOutput = (kind, action, value) => import_zod30.z.strictObject(
 var IdentityValueSchema = import_zod30.z.strictObject({
   name: import_zod30.z.string(),
   defaultConfigProfile: import_zod30.z.string().optional(),
+  provider: import_zod30.z.string().optional(),
   allowAmbientCredential: import_zod30.z.boolean(),
   credential: CredentialSummarySchema2.optional(),
   anchors: import_zod30.z.array(AnchorSchema).optional()
@@ -18301,6 +18334,8 @@ var ConfigIdentityAddOutputSchema = storedMutationOutput("identity", "created",
 var ConfigIdentitySetInputSchema = import_zod30.z.strictObject({
   name: import_zod30.z.string().min(1),
   defaultConfigProfile: import_zod30.z.union([import_zod30.z.string().min(1), import_zod30.z.literal(false)]).optional(),
+  /** The provider the identity exists for; `false` clears it. */
+  provider: import_zod30.z.union([import_zod30.z.string().min(1), import_zod30.z.literal(false)]).optional(),
   allowAmbientCredential: import_zod30.z.boolean().optional(),
   credential: import_zod30.z.union([import_zod30.z.literal(false), CredentialWriteSchema(CREDENTIAL_TARGETS)]).optional(),
   /** `false` removes the anchors; a list replaces them. */
@@ -18445,6 +18480,7 @@ function identityValue(name, paths) {
   return {
     name: identity.name,
     ...identity.defaultConfigProfile === void 0 ? {} : { defaultConfigProfile: identity.defaultConfigProfile },
+    ...identity.provider === void 0 ? {} : { provider: identity.provider },
     allowAmbientCredential: identity.allowAmbientCredential,
     ...identity.credential === void 0 ? {} : { credential: summariseCredential(identity.credential) },
     ...identity.anchors === void 0 ? {} : { anchors: identity.anchors }
@@ -18477,18 +18513,24 @@ function createConfigApiRouter(deps) {
             return { action: "created", kind: "identity", name: input.name, value: identityValue(input.name, paths) };
           })
         ),
-        set: route("/rest/config/identity/set", "Update an identity's default profile, ambient-credential setting, credential or anchors").input(ConfigIdentitySetInputSchema).output(ConfigIdentitySetOutputSchema).handler(
+        set: route("/rest/config/identity/set", "Update an identity's default profile, provider, ambient-credential setting, credential or anchors").input(ConfigIdentitySetInputSchema).output(ConfigIdentitySetOutputSchema).handler(
           ({ input }) => guarded(() => {
-            requireChange(input.defaultConfigProfile !== void 0 || input.allowAmbientCredential !== void 0 || input.credential !== void 0 || input.anchors !== void 0, "defaultConfigProfile, allowAmbientCredential, credential or anchors");
+            requireChange(input.defaultConfigProfile !== void 0 || input.provider !== void 0 || input.allowAmbientCredential !== void 0 || input.credential !== void 0 || input.anchors !== void 0, "defaultConfigProfile, provider, allowAmbientCredential, credential or anchors");
             if (!identityExists(paths, input.name)) {
               throw new IdentityNotFoundError(input.name);
             }
             if (typeof input.defaultConfigProfile === "string") {
               requireProfileExists(paths, input.defaultConfigProfile);
             }
+            if (typeof input.provider === "string") {
+              requireProviderExists(paths, input.provider);
+            }
             if (input.defaultConfigProfile !== void 0) {
               setDefaultConfigProfile(paths, input.name, input.defaultConfigProfile === false ? void 0 : input.defaultConfigProfile);
             }
+            if (input.provider !== void 0) {
+              setIdentityProvider(paths, input.name, input.provider === false ? void 0 : input.provider);
+            }
             if (input.allowAmbientCredential !== void 0) {
               setAllowAmbientCredential(paths, input.name, input.allowAmbientCredential);
             }

package/dist/index.mjs

@@ -1207,6 +1207,8 @@ var init_schema = __esm({
       $schema: z3.string().optional(),
       name: FileNameSchema,
       defaultConfigProfile: StoredNameSchema.optional(),
+      /** The provider this identity exists for: a launch on the identity routes through it unless `--provider`, `--no-provider` or a cascade layer's `launch.provider` says otherwise. Its sessions run on the provider's credential, so the identity needs no stored login. */
+      provider: StoredNameSchema.optional(),
       allowAmbientCredential: z3.boolean().default(false),
       credential: CredentialSchema.optional(),
       /** When this identity's five-hour window should be open: the front door opens one at each anchor if none is. Absent, nothing is opened on a schedule. */
@@ -4738,7 +4740,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "agent-shim",
-      version: "11.74.0",
+      version: "11.76.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -9023,6 +9025,12 @@ function providerJsonPath(paths, name) {
 function providerExists(paths, name) {
   return fs7.existsSync(providerJsonPath(paths, name));
 }
+function requireProviderExists(paths, name) {
+  const canonical = canonicalProviderName(name, (candidate) => providerExists(paths, candidate), () => readProviderAliases(paths));
+  if (!providerExists(paths, canonical)) {
+    throw new ProviderNotFoundError(name);
+  }
+}
 function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -9257,18 +9265,18 @@ function removeProvider(paths, name) {
   }
   fs7.rmSync(providerJsonPath(paths, name));
 }
-function cascadeProviderName(cascade) {
+function cascadeProviderName(cascade, identityProvider) {
   let name;
   for (const layer of assembleCascade(cascade).layers) {
     if (layer.launch?.provider !== void 0) {
       name = layer.launch.provider;
     }
   }
-  return name;
+  return name ?? identityProvider;
 }
 function selectProvider(params) {
   const cliName = params.cliProvider !== void 0 && params.cliProvider !== "" ? params.cliProvider : void 0;
-  const named = cliName ?? (params.cascade === void 0 ? void 0 : cascadeProviderName(params.cascade));
+  const named = cliName ?? (params.cascade === void 0 ? params.identityProvider : cascadeProviderName(params.cascade, params.identityProvider));
   if (named === void 0) {
     return void 0;
   }
@@ -9429,6 +9437,9 @@ function decideSignIn(facts) {
   if (facts.hasCredentialBlock) {
     return { state: "token", detail: "supplies its own credential through a credential block, so a stored login is not what a launch uses" };
   }
+  if (facts.provider !== void 0) {
+    return { state: "token", detail: "runs provider sessions with the provider's credential, so a stored login is not what a launch uses" };
+  }
   if (facts.keychainItem === true) {
     return { state: "signed-in", detail: "a login is stored in the macOS Keychain" };
   }
@@ -9441,9 +9452,10 @@ function credentialsFilePath(farmRoot) {
   return path25.join(farmRoot, CREDENTIALS_FILE);
 }
 function identitySignIn(fs14, probe, identity) {
-  const probing = !identity.hasCredentialBlock;
+  const probing = !identity.hasCredentialBlock && identity.provider === void 0;
   return decideSignIn({
     hasCredentialBlock: identity.hasCredentialBlock,
+    provider: identity.provider,
     keychainItem: probing && probe.platform === "darwin" && probe.run !== void 0 ? keychainHasItem(probe.run, identity.farmRoot) : void 0,
     credentialsFile: probing && fs14.lstat(credentialsFilePath(identity.farmRoot)) !== void 0,
     platform: probe.platform
@@ -11706,7 +11718,8 @@ function decideLaunch(params, readOnly) {
     paths,
     port: fs14,
     ...parsedArgv.provider === void 0 || parsedArgv.provider === false ? {} : { cliProvider: parsedArgv.provider },
-    ...farmContext === void 0 ? {} : { cascade: farmContext.cascade }
+    ...farmContext === void 0 ? {} : { cascade: farmContext.cascade },
+    ...loadedIdentity?.config.provider === void 0 ? {} : { identityProvider: loadedIdentity.config.provider }
   };
   let selectedProvider;
   let resolvedProvider;
@@ -12325,7 +12338,7 @@ function realPrepareLaunchParams(paths, options) {
     frontdoor: realFrontDoorPort(paths, options.spawnDaemon),
     credentials: { ...realCredentialPort, cache: realCredentialCacheEnv(paths) },
     hold: realHoldPort,
-    hasStoredLogin: (identity) => identitySignIn(realFarmFs, { platform: process.platform, run: options.run ?? realRunPort }, { farmRoot: path41.join(paths.identitiesDir, identity), hasCredentialBlock: false }).state !== "signed-out",
+    hasStoredLogin: (identity) => identitySignIn(realFarmFs, { platform: process.platform, run: options.run ?? realRunPort }, { farmRoot: path41.join(paths.identitiesDir, identity), hasCredentialBlock: false, provider: void 0 }).state !== "signed-out",
     ...farm.directoryIdentity === void 0 ? {} : { directoryPinnedIdentity: farm.directoryIdentity },
     ...farm.directoryConfigProfile === void 0 ? {} : { directoryRuleConfigProfile: farm.directoryConfigProfile },
     ...farm.globalDefaultConfigProfile === void 0 ? {} : { globalDefaultConfigProfile: farm.globalDefaultConfigProfile },
@@ -16070,7 +16083,7 @@ function collectCheckReport(params) {
     read,
     ...configProfileDecision.name === void 0 ? {} : { baseConfigProfile: configProfileDecision.name }
   }).input;
-  const providerName = cascadeProviderName(cascade);
+  const providerName = cascadeProviderName(cascade, identityConfig?.provider);
   const provider = providerName === void 0 ? void 0 : loadCheckProvider(paths, providerName);
   const farmRoot = identityDecision.name === void 0 ? void 0 : path26.join(paths.identitiesDir, identityDecision.name);
   const settingsFiles = {
@@ -16499,6 +16512,12 @@ function setDefaultConfigProfile(paths, identityName, profileName) {
     defaultConfigProfile: profileName
   });
 }
+function setIdentityProvider(paths, identityName, providerName) {
+  if (!identityExists(paths, identityName)) {
+    throw new IdentityNotFoundError(identityName);
+  }
+  return applyPatch(identityJsonPath(paths, identityName), IdentitySchema, { provider: providerName });
+}
 function setAllowAmbientCredential(paths, identityName, allow) {
   if (!identityExists(paths, identityName)) {
     throw new IdentityNotFoundError(identityName);
@@ -17167,6 +17186,7 @@ function runDoctor(params) {
     }
   }
   const validProfileNames = new Set(profileSources.keys());
+  const validProviderNames = /* @__PURE__ */ new Set([...params.providers.map((entry) => entry.name), ...Object.keys(params.providerAliases ?? {})]);
   const validIdentityNames = /* @__PURE__ */ new Set();
   for (const entry of params.identities) {
     const validated3 = validate(IdentitySchema, entry, "identity", entry.name);
@@ -17176,35 +17196,47 @@ function runDoctor(params) {
     }
     validIdentityNames.add(entry.name);
     const defaultProfile = validated3.data.defaultConfigProfile;
+    let consistent = true;
     if (defaultProfile !== void 0 && !validProfileNames.has(defaultProfile)) {
+      consistent = false;
       push(
         "identity",
         "fail",
         `Identity "${entry.name}" names configuration profile "${defaultProfile}" as its default, but no such profile exists.`,
         entry.name
       );
-    } else {
-      const credential = validated3.data.credential;
-      const cache = credential === void 0 ? { text: "", unreadable: false } : cacheClause(params.credentialCache, `identity ${entry.name}`, credential);
-      push(
-        "identity",
-        cache.unreadable ? "fail" : "pass",
-        `${entry.name} is valid and authenticates with ${credential === void 0 ? "its stored login" : `credential ${describeCredential(credential)}`}${cache.text}.`,
-        entry.name
-      );
-      const signIn = decideSignIn({
-        hasCredentialBlock: credential !== void 0,
-        keychainItem: params.platform === "darwin" && params.run !== void 0 ? keychainHasItem(params.run, entry.farmRoot) : void 0,
-        credentialsFile: entry.credentialsFilePresent,
-        platform: params.platform
-      });
-      push(
-        "sign-in",
-        signIn.state === "signed-out" ? "warn" : "pass",
-        signIn.state === "signed-out" ? `${entry.name} is signed out (${signIn.detail}). Run \`agent-shim run @${entry.name}\` and sign in.` : `${entry.name} ${signIn.state === "token" ? "uses a credential block" : "is signed in"} (${signIn.detail}).`,
-        entry.name
-      );
     }
+    const identityProvider = validated3.data.provider;
+    if (identityProvider !== void 0 && !validProviderNames.has(identityProvider)) {
+      consistent = false;
+      push("identity", "fail", `Identity "${entry.name}" names provider "${identityProvider}" as its provider, but no such provider exists.`, entry.name);
+    }
+    if (!consistent) {
+      continue;
+    }
+    const credential = validated3.data.credential;
+    const cache = credential === void 0 ? { text: "", unreadable: false } : cacheClause(params.credentialCache, `identity ${entry.name}`, credential);
+    const authenticatesWith = credential !== void 0 ? `credential ${describeCredential(credential)}` : identityProvider !== void 0 ? `the credential of provider "${identityProvider}"` : "its stored login";
+    push(
+      "identity",
+      cache.unreadable ? "fail" : "pass",
+      `${entry.name} is valid and authenticates with ${authenticatesWith}${cache.text}.`,
+      entry.name
+    );
+    const standing = credential !== void 0 ? "uses a credential block" : identityProvider !== void 0 ? `exists for provider "${identityProvider}"` : "is signed in";
+    const signIn = decideSignIn({
+      hasCredentialBlock: credential !== void 0,
+      provider: identityProvider,
+      keychainItem: params.platform === "darwin" && params.run !== void 0 ? keychainHasItem(params.run, entry.farmRoot) : void 0,
+      credentialsFile: entry.credentialsFilePresent,
+      platform: params.platform
+    });
+    push(
+      "sign-in",
+      signIn.state === "signed-out" ? "warn" : "pass",
+      signIn.state === "signed-out" ? `${entry.name} is signed out (${signIn.detail}). Run \`agent-shim run @${entry.name}\` and sign in.` : `${entry.name} ${standing} (${signIn.detail}).`,
+      entry.name
+    );
   }
   const validatedGlobalConfig = params.globalConfig.raw === void 0 ? void 0 : validateJson(GlobalConfigSchema, params.globalConfig);
   const pools = validatedGlobalConfig?.ok === true ? validatedGlobalConfig.data.pools ?? {} : {};
@@ -17867,6 +17899,7 @@ var storedMutationOutput = (kind, action, value) => z30.strictObject({ action: z
 var IdentityValueSchema = z30.strictObject({
   name: z30.string(),
   defaultConfigProfile: z30.string().optional(),
+  provider: z30.string().optional(),
   allowAmbientCredential: z30.boolean(),
   credential: CredentialSummarySchema2.optional(),
   anchors: z30.array(AnchorSchema).optional()
@@ -17886,6 +17919,8 @@ var ConfigIdentityAddOutputSchema = storedMutationOutput("identity", "created",
 var ConfigIdentitySetInputSchema = z30.strictObject({
   name: z30.string().min(1),
   defaultConfigProfile: z30.union([z30.string().min(1), z30.literal(false)]).optional(),
+  /** The provider the identity exists for; `false` clears it. */
+  provider: z30.union([z30.string().min(1), z30.literal(false)]).optional(),
   allowAmbientCredential: z30.boolean().optional(),
   credential: z30.union([z30.literal(false), CredentialWriteSchema(CREDENTIAL_TARGETS)]).optional(),
   /** `false` removes the anchors; a list replaces them. */
@@ -18030,6 +18065,7 @@ function identityValue(name, paths) {
   return {
     name: identity.name,
     ...identity.defaultConfigProfile === void 0 ? {} : { defaultConfigProfile: identity.defaultConfigProfile },
+    ...identity.provider === void 0 ? {} : { provider: identity.provider },
     allowAmbientCredential: identity.allowAmbientCredential,
     ...identity.credential === void 0 ? {} : { credential: summariseCredential(identity.credential) },
     ...identity.anchors === void 0 ? {} : { anchors: identity.anchors }
@@ -18062,18 +18098,24 @@ function createConfigApiRouter(deps) {
             return { action: "created", kind: "identity", name: input.name, value: identityValue(input.name, paths) };
           })
         ),
-        set: route("/rest/config/identity/set", "Update an identity's default profile, ambient-credential setting, credential or anchors").input(ConfigIdentitySetInputSchema).output(ConfigIdentitySetOutputSchema).handler(
+        set: route("/rest/config/identity/set", "Update an identity's default profile, provider, ambient-credential setting, credential or anchors").input(ConfigIdentitySetInputSchema).output(ConfigIdentitySetOutputSchema).handler(
           ({ input }) => guarded(() => {
-            requireChange(input.defaultConfigProfile !== void 0 || input.allowAmbientCredential !== void 0 || input.credential !== void 0 || input.anchors !== void 0, "defaultConfigProfile, allowAmbientCredential, credential or anchors");
+            requireChange(input.defaultConfigProfile !== void 0 || input.provider !== void 0 || input.allowAmbientCredential !== void 0 || input.credential !== void 0 || input.anchors !== void 0, "defaultConfigProfile, provider, allowAmbientCredential, credential or anchors");
             if (!identityExists(paths, input.name)) {
               throw new IdentityNotFoundError(input.name);
             }
             if (typeof input.defaultConfigProfile === "string") {
               requireProfileExists(paths, input.defaultConfigProfile);
             }
+            if (typeof input.provider === "string") {
+              requireProviderExists(paths, input.provider);
+            }
             if (input.defaultConfigProfile !== void 0) {
               setDefaultConfigProfile(paths, input.name, input.defaultConfigProfile === false ? void 0 : input.defaultConfigProfile);
             }
+            if (input.provider !== void 0) {
+              setIdentityProvider(paths, input.name, input.provider === false ? void 0 : input.provider);
+            }
             if (input.allowAmbientCredential !== void 0) {
               setAllowAmbientCredential(paths, input.name, input.allowAmbientCredential);
             }

package/dist/types/index.d.ts

@@ -5413,6 +5413,7 @@ declare const IdentitySchema: z.ZodObject<{
     $schema: z.ZodOptional<z.ZodString>;
     name: z.ZodString;
     defaultConfigProfile: z.ZodOptional<z.ZodString>;
+    provider: z.ZodOptional<z.ZodString>;
     allowAmbientCredential: z.ZodDefault<z.ZodBoolean>;
     credential: z.ZodOptional<z.ZodObject<{
         sources: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
@@ -9472,6 +9473,7 @@ declare function createConfigApiRouter(deps: ConfigApiDeps): {
                 value: zod.ZodObject<{
                     name: zod.ZodString;
                     defaultConfigProfile: zod.ZodOptional<zod.ZodString>;
+                    provider: zod.ZodOptional<zod.ZodString>;
                     allowAmbientCredential: zod.ZodBoolean;
                     credential: zod.ZodOptional<zod.ZodObject<{
                         target: zod.ZodEnum<{
@@ -9524,6 +9526,7 @@ declare function createConfigApiRouter(deps: ConfigApiDeps): {
             set: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
                 name: zod.ZodString;
                 defaultConfigProfile: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodString, zod.ZodLiteral<false>]>>;
+                provider: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodString, zod.ZodLiteral<false>]>>;
                 allowAmbientCredential: zod.ZodOptional<zod.ZodBoolean>;
                 credential: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodLiteral<false>, zod.ZodObject<{
                     sources: zod.ZodOptional<zod.ZodArray<zod.ZodUnion<readonly [zod.ZodObject<{
@@ -9577,6 +9580,7 @@ declare function createConfigApiRouter(deps: ConfigApiDeps): {
                 value: zod.ZodObject<{
                     name: zod.ZodString;
                     defaultConfigProfile: zod.ZodOptional<zod.ZodString>;
+                    provider: zod.ZodOptional<zod.ZodString>;
                     allowAmbientCredential: zod.ZodBoolean;
                     credential: zod.ZodOptional<zod.ZodObject<{
                         target: zod.ZodEnum<{
@@ -16537,6 +16541,7 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                 value: zod.ZodObject<{
                     name: zod.ZodString;
                     defaultConfigProfile: zod.ZodOptional<zod.ZodString>;
+                    provider: zod.ZodOptional<zod.ZodString>;
                     allowAmbientCredential: zod.ZodBoolean;
                     credential: zod.ZodOptional<zod.ZodObject<{
                         target: zod.ZodEnum<{
@@ -16589,6 +16594,7 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
             set: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
                 name: zod.ZodString;
                 defaultConfigProfile: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodString, zod.ZodLiteral<false>]>>;
+                provider: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodString, zod.ZodLiteral<false>]>>;
                 allowAmbientCredential: zod.ZodOptional<zod.ZodBoolean>;
                 credential: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodLiteral<false>, zod.ZodObject<{
                     sources: zod.ZodOptional<zod.ZodArray<zod.ZodUnion<readonly [zod.ZodObject<{
@@ -16642,6 +16648,7 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                 value: zod.ZodObject<{
                     name: zod.ZodString;
                     defaultConfigProfile: zod.ZodOptional<zod.ZodString>;
+                    provider: zod.ZodOptional<zod.ZodString>;
                     allowAmbientCredential: zod.ZodBoolean;
                     credential: zod.ZodOptional<zod.ZodObject<{
                         target: zod.ZodEnum<{
@@ -21060,6 +21067,7 @@ declare const ConfigIdentityAddOutputSchema: z.ZodObject<{
     value: z.ZodObject<{
         name: z.ZodString;
         defaultConfigProfile: z.ZodOptional<z.ZodString>;
+        provider: z.ZodOptional<z.ZodString>;
         allowAmbientCredential: z.ZodBoolean;
         credential: z.ZodOptional<z.ZodObject<{
             target: z.ZodEnum<{
@@ -21113,6 +21121,7 @@ declare const ConfigIdentityAddOutputSchema: z.ZodObject<{
 declare const ConfigIdentitySetInputSchema: z.ZodObject<{
     name: z.ZodString;
     defaultConfigProfile: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodLiteral<false>]>>;
+    provider: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodLiteral<false>]>>;
     allowAmbientCredential: z.ZodOptional<z.ZodBoolean>;
     credential: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodObject<{
         sources: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
@@ -21167,6 +21176,7 @@ declare const ConfigIdentitySetOutputSchema: z.ZodObject<{
     value: z.ZodObject<{
         name: z.ZodString;
         defaultConfigProfile: z.ZodOptional<z.ZodString>;
+        provider: z.ZodOptional<z.ZodString>;
         allowAmbientCredential: z.ZodBoolean;
         credential: z.ZodOptional<z.ZodObject<{
             target: z.ZodEnum<{

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-shim",
-  "version": "11.74.0",
+  "version": "11.76.0",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",