agent-shim 11.77.0 → 11.79.0

package/README.md

@@ -57,7 +57,7 @@ That's it — with no further configuration, everything in `~/.claude` that isn'
 - **An identity** is a login: the thing that owns credentials and daemon state, selected with `agent-shim run @<name>` or, once `agent-shim shim enable` has run, `claude @<name>`.
 - **A configuration profile** is a reusable, named bundle of sharing rules, independent of any identity, resolved per working directory via directory rules or a committed `.agent-shim.json`.
 
-A third, optional thing sits on top of identities: **a pool** is a named list of them. Select `pool:<name>` where an identity name goes (`claude @pool:subs`) and agent-shim picks the member whose unused quota is closest to expiring, skipping any that are refused right now, using the usage it already records. A pool can instead declare `--preference listed`, which tries the members in the order the pool lists them, skipping only one that is refused right now. A member entry may itself name another pool (`pool:<name>`), which is ranked with its own policy and contributes its pick at that position, so "this identity first, then the fleet" nests the fleet rather than copying its member list; cycles are refused. See [docs/configuration-model.md](docs/configuration-model.md#pools-picking-an-account-at-launch).
+A third, optional thing sits on top of identities: **a pool** is a named list of them. Select `pool:<name>` where an identity name goes (`claude @pool:subs`) and agent-shim picks the member whose unused quota is closest to expiring, skipping any that are refused right now, using the usage it already records. A pool can instead declare `--preference listed`, which tries the members in the order the pool lists them, skipping only one that is refused right now. A member entry may itself name another pool (`pool:<name>`), which is ranked with its own policy and contributes its pick at that position, so "this identity first, then the fleet" nests the fleet rather than copying its member list; cycles are refused. See [docs/configuration-model.md](docs/configuration-model.md#pools-picking-an-account-at-launch). On a terminal, `agent-shim run` asks which identity to run as when none resolves, when a pool pick would change account, or when the identity is refused right now (`--pick` forces the question, `--no-pick` never asks); see [docs/configuration-model.md](docs/configuration-model.md#choosing-the-identity-at-launch-the-picker).
 
 Every top-level entry in `~/.claude` is classified into one of five categories, shipped as a default map (`config/categories.default.json`):
 
@@ -200,6 +200,7 @@ agent-shim run [@<identity>] [launch flags] [claude arguments]
   #   --claude-version <version>   run exactly this installed Claude Code version
   #   --delay <duration>   wait this long after the launcher's own output before starting claude; --[no-]pause waits for a key press instead
   #   --[no-]explain   with @pool:<name>, list every member the pick ranked and why, not only the one picked
+  #   --[no-]pick   on a terminal, ask which identity to run as, even when one resolved (--no-pick never asks); a launch also asks by itself when no identity resolves, a pool pick would change account or organisation, or the identity is refused right now
   #   --native   run the real claude with nothing from agent-shim applied; cannot be combined with the flags above
 claude @<identity> ...                      # the same, once `agent-shim shim enable` has run
 ```

package/dist/cli.cjs

@@ -38198,7 +38198,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "agent-shim",
-      version: "11.77.0",
+      version: "11.79.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -67175,7 +67175,8 @@ var init_argv = __esm({
       { flag: "--remote-control", key: "remoteControl" },
       { flag: "--wait", key: "wait" },
       { flag: "--pause", key: "pause" },
-      { flag: "--explain", key: "explain" }
+      { flag: "--explain", key: "explain" },
+      { flag: "--pick", key: "pick" }
     ];
     LAUNCHER_FLAG_NAMES = [
       ...VALUED_FLAGS,
@@ -69956,7 +69957,7 @@ function decideLaunch(params, readOnly) {
   const configDirEscapeHatchApplies = env.CLAUDE_CONFIG_DIR !== void 0 && env.CLAUDE_CONFIG_DIR !== "";
   const decidedIdentity = decideIdentity({
     env,
-    argv0Identity: parsedArgv.identity,
+    argv0Identity: params.pickedIdentity ?? parsedArgv.identity,
     directoryPinnedIdentity: params.directoryPinnedIdentity,
     readActiveIdentityFile: () => {
       const raw = fs31.readFileUtf8(paths.activeIdentityFile);
@@ -117743,7 +117744,7 @@ function summariseIdentityAccount(account) {
 function loginKeyOf(account) {
   return account.accountUuid === void 0 ? void 0 : JSON.stringify([account.accountUuid, account.organizationUuid ?? null]);
 }
-function groupByLogin(items, loginOf) {
+function collectByLogin(items, loginOf) {
   const groups = /* @__PURE__ */ new Map();
   for (const item of items) {
     const key = loginOf(item) ?? /* @__PURE__ */ Symbol("no login");
@@ -117754,7 +117755,13 @@ function groupByLogin(items, loginOf) {
       group.push(item);
     }
   }
-  return [...groups.values()].flat();
+  return [...groups.values()];
+}
+function groupByLogin(items, loginOf) {
+  return collectByLogin(items, loginOf).flat();
+}
+function groupSharedLogins(items, loginOf) {
+  return collectByLogin(items, loginOf).filter((group) => group.length > 1);
 }
 function describeAccountHolder(summary) {
   const organisation = describeAccountOrganisation(summary);
@@ -123523,6 +123530,10 @@ var DOCTOR_SECTIONS = [
   "frontdoor",
   "models"
 ];
+function joinNames(names) {
+  const last = names.at(-1);
+  return names.length < 2 || last === void 0 ? names.join("") : `${names.slice(0, -1).join(", ")} and ${last}`;
+}
 function refinePathShadow(status, ownExecutablePath, realpath) {
   if (status.status !== "shadowed") {
     return status;
@@ -123770,6 +123781,7 @@ function runDoctor(params) {
   const validProfileNames = new Set(profileSources.keys());
   const validProviderNames = /* @__PURE__ */ new Set([...params.providers.map((entry) => entry.name), ...Object.keys(params.providerAliases ?? {})]);
   const validIdentityNames = /* @__PURE__ */ new Set();
+  const signedInAccounts = [];
   for (const entry of params.identities) {
     const validated2 = validate3(IdentitySchema, entry, "identity", entry.name);
     if (!validated2.ok) {
@@ -123819,6 +123831,18 @@ function runDoctor(params) {
       signIn.state === "signed-out" ? `${entry.name} is signed out (${signIn.detail}). Run \`agent-shim run @${entry.name}\` and sign in.` : `${entry.name} ${standing} (${signIn.detail}).`,
       entry.name
     );
+    if (signIn.state === "signed-in" && entry.account !== void 0) {
+      signedInAccounts.push({ name: entry.name, account: entry.account });
+    }
+  }
+  for (const group of groupSharedLogins(signedInAccounts, (entry) => loginKeyOf(entry.account))) {
+    const names = group.map((entry) => entry.name);
+    const holder = group.map((entry) => summariseIdentityAccount(entry.account)).map((summary) => summary === void 0 ? void 0 : describeAccountHolder(summary)).find((described) => described !== void 0);
+    push(
+      "sign-in",
+      "warn",
+      `Identities ${joinNames(names)} hold the same login${holder === void 0 ? "" : ` (${holder})`}, so they share one quota window and all but one are redundant. Remove the redundant ones with \`agent-shim identity remove <name>\`.`
+    );
   }
   const validatedGlobalConfig = params.globalConfig.raw === void 0 ? void 0 : validateJson(GlobalConfigSchema, params.globalConfig);
   const pools = validatedGlobalConfig?.ok === true ? validatedGlobalConfig.data.pools ?? {} : {};
@@ -124107,7 +124131,7 @@ function collectDoctorReport(params) {
   const identities = identityNames.map((name) => {
     const farmRoot = import_node_path47.default.join(paths.identitiesDir, name);
     const identityPath = import_node_path47.default.join(farmRoot, "identity.json");
-    return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot, credentialsFilePresent: import_node_fs20.default.existsSync(credentialsFilePath(farmRoot)) };
+    return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot, credentialsFilePresent: import_node_fs20.default.existsSync(credentialsFilePath(farmRoot)), account: readIdentityAccount(realFsPort, paths.identitiesDir, name)?.account };
   });
   const profileNames = import_node_fs20.default.existsSync(paths.configProfilesDir) ? import_node_fs20.default.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const configProfiles = profileNames.map((name) => {
@@ -157797,6 +157821,241 @@ function buildProgram(deps) {
 // src/runClaude.ts
 init_cliError();
 init_configProfilesStore();
+
+// src/launcher/pickerPrompt.ts
+function promptsIdentityPicker(prompts) {
+  return {
+    pick: async (request7) => {
+      const answer = await prompts.select({
+        message: request7.message,
+        options: request7.entries.map((entry) => ({ value: entry.value, label: entry.label })),
+        ...request7.initial === void 0 ? {} : { initialValue: request7.initial }
+      });
+      return prompts.isCancel(answer) ? { kind: "cancelled" } : { kind: "picked", value: answer };
+    }
+  };
+}
+
+// src/launcher/runPicker.ts
+init_cliError();
+init_schema();
+init_account();
+init_candidateText();
+init_pick();
+init_poolPick();
+init_identity();
+init_launchReport();
+init_hold();
+
+// src/launcher/pickerEntries.ts
+var PART_SEPARATOR = " | ";
+function pickerLabel(facts) {
+  const name = [facts.rank === void 0 ? void 0 : `${String(facts.rank)}.`, facts.identity, facts.heading, facts.picked === true ? "(picked)" : void 0].filter((part) => part !== void 0).join(" ");
+  return [name, facts.detail, facts.account, facts.quota].filter((part) => part !== void 0).join(PART_SEPARATOR);
+}
+
+// src/launcher/pickerDecision.ts
+init_claudeSubcommand();
+function decidePicker(facts) {
+  if (!facts.interactive || facts.configDirEscapeHatch || facts.pick === false) {
+    return void 0;
+  }
+  if (facts.pick === true) {
+    return "requested";
+  }
+  if (facts.unattended) {
+    return void 0;
+  }
+  const { selection } = facts;
+  switch (selection.kind) {
+    case "none":
+      return "no-identity";
+    case "identity":
+      return selection.limited ? "no-eligible-identity" : void 0;
+    case "pool":
+      if (selection.outcome === "none-eligible") {
+        return facts.waiting ? void 0 : "no-eligible-identity";
+      }
+      return selection.outcome === "changes-account" ? "account-change" : void 0;
+    default:
+      return selection;
+  }
+}
+var TERMINATOR4 = "--";
+var UNATTENDED_FLAGS = /* @__PURE__ */ new Set(["-p", "--print", "--bg"]);
+function isUnattendedLaunch(passthrough) {
+  const end = passthrough.indexOf(TERMINATOR4);
+  const head = end === -1 ? passthrough : passthrough.slice(0, end);
+  return head.some((token) => UNATTENDED_FLAGS.has(token)) || isClaudeSubcommand(passthrough);
+}
+
+// src/launcher/runPicker.ts
+init_pool();
+var IdentityPickerCancelledError = class extends CliError {
+  exitCode = LAUNCH_CANCELLED_EXIT;
+  constructor() {
+    super("launch cancelled at the identity picker: no identity was chosen.");
+    this.name = "IdentityPickerCancelledError";
+  }
+};
+function memberTexts(member, nowMs) {
+  if (member === void 0) {
+    return {};
+  }
+  const billing = { login: member.account, snapshot: member.snapshot, provider: void 0, nowMs };
+  const account = accountRows(billing)[0]?.value;
+  const quotaRow2 = quotaRows(billing)[0];
+  return {
+    ...account === void 0 ? {} : { account },
+    ...quotaRow2 === void 0 ? {} : { quota: quotaRow2.detail === void 0 ? quotaRow2.value : `${quotaRow2.value} (${quotaRow2.detail})` }
+  };
+}
+function refusalOf(candidate) {
+  return candidate.class === "ineligible" ? candidate.reasons[0] : void 0;
+}
+function accountsDiffer(members2, left, right) {
+  const keyOf3 = (identity) => {
+    const account = members2.find((member) => member.identity === identity)?.account;
+    return account === void 0 ? void 0 : loginKeyOf(account);
+  };
+  const leftKey = keyOf3(left);
+  const rightKey = keyOf3(right);
+  return leftKey !== void 0 && rightKey !== void 0 && leftKey !== rightKey;
+}
+function poolContext(params, poolName, resuming, nowMs) {
+  const { paths, usageFs } = params;
+  const { sticky } = readStickyPick(usageFs, paths.usagePicksFile, params.cwd);
+  const { ranking } = rankPoolGraph({
+    fs: usageFs,
+    paths,
+    pools: params.pools ?? {},
+    poolName,
+    nowMs,
+    resuming,
+    identityExists: (name) => loadIdentity(paths.identitiesDir, name, params.fs) !== void 0,
+    ...sticky === void 0 ? {} : { sticky }
+  });
+  const pick2 = ranking.pick?.identity;
+  const named = [.../* @__PURE__ */ new Set([...ranking.candidates.map((candidate) => candidate.identity), ...sticky === void 0 ? [] : [sticky.identity]])].filter(isIdentityName);
+  const members2 = loadPoolMembers(usageFs, paths, named, nowMs);
+  const changes = pick2 !== void 0 && sticky !== void 0 && sticky.identity !== pick2 && accountsDiffer(members2, sticky.identity, pick2);
+  return {
+    selection: { kind: "pool", outcome: pick2 === void 0 ? "none-eligible" : changes ? "changes-account" : "keeps-account" },
+    entries: ranking.candidates.map((candidate, index) => ({
+      value: candidate.identity,
+      label: pickerLabel({
+        identity: candidate.identity,
+        rank: index + 1,
+        heading: candidateHeading(candidate),
+        picked: candidate.identity === pick2,
+        detail: refusalOf(candidate),
+        ...memberTexts(members2.find((member) => member.identity === candidate.identity), nowMs)
+      })
+    })),
+    initial: pick2,
+    poolPick: pick2,
+    message: (reason) => poolMessage(reason, poolName, pick2, sticky)
+  };
+}
+function poolMessage(reason, poolName, pick2, sticky) {
+  switch (reason) {
+    case "account-change":
+      return `Pool "${poolName}" would run this launch as ${pick2 ?? "(none)"}, a different account from ${sticky?.identity ?? "(none)"}, which this directory last ran as. Which identity should it run as?`;
+    case "no-eligible-identity":
+      return `Every member of pool "${poolName}" is refused right now. Which identity should this launch run as?`;
+    case "requested":
+    case "no-identity":
+      return `Pool "${poolName}" is selected for this launch. Which identity should it run as?`;
+    default:
+      return reason;
+  }
+}
+function identityContext(params, resuming, nowMs) {
+  const { paths, usageFs } = params;
+  const members2 = loadPoolMembers(usageFs, paths, params.identityNames(), nowMs);
+  const { candidates } = rankPool({ members: members2, nowMs, resuming, preference: "listed" });
+  const named = params.decision.name;
+  const limited = named !== void 0 && candidates.some((candidate) => candidate.identity === named && candidate.class === "ineligible");
+  const identityEntries = candidates.map((candidate) => ({
+    value: candidate.identity,
+    label: pickerLabel({ identity: candidate.identity, detail: refusalOf(candidate), ...memberTexts(members2.find((member) => member.identity === candidate.identity), nowMs) })
+  }));
+  const poolEntries = Object.entries(params.pools ?? {}).map(([name, pool]) => ({
+    value: `pool:${name}`,
+    label: pickerLabel({ identity: `pool:${name}`, detail: `members ${pool.identities.map(poolMemberIdentity).join(", ")}` })
+  }));
+  return {
+    selection: named === void 0 ? { kind: "none" } : { kind: "identity", limited },
+    entries: [...identityEntries, ...poolEntries],
+    initial: named,
+    poolPick: void 0,
+    message: (reason) => {
+      switch (reason) {
+        case "no-identity":
+          return "No identity is selected for this launch. Which identity should it run as?";
+        case "no-eligible-identity":
+          return `${named ?? "The selected identity"} is refused right now. Which identity should this launch run as?`;
+        case "requested":
+        case "account-change":
+          return "Which identity should this launch run as?";
+        default:
+          return reason;
+      }
+    }
+  };
+}
+async function runIdentityPicker(params) {
+  if (!params.interactive) {
+    return { kind: "unchanged" };
+  }
+  const nowMs = params.now();
+  const resuming = isResuming(params.parsed.rest);
+  const context = params.decision.pool === void 0 ? identityContext(params, resuming, nowMs) : poolContext(params, params.decision.pool, resuming, nowMs);
+  const reason = decidePicker({
+    interactive: params.interactive,
+    unattended: isUnattendedLaunch(params.parsed.rest),
+    pick: params.parsed.pick,
+    configDirEscapeHatch: params.decision.configDirEscapeHatch,
+    waiting: params.parsed.wait === true,
+    selection: context.selection
+  });
+  if (reason === void 0) {
+    return { kind: "unchanged" };
+  }
+  const request7 = { message: context.message(reason), entries: context.entries, ...context.initial === void 0 ? {} : { initial: context.initial } };
+  const answer = await params.picker.pick(request7);
+  if (answer.kind === "cancelled") {
+    return { kind: "cancelled" };
+  }
+  const chosen = answer.value;
+  if (chosen === (params.decision.pool === void 0 ? params.decision.name : context.poolPick)) {
+    return { kind: "unchanged" };
+  }
+  if (params.decision.pool !== void 0 && poolNameOf(chosen) === void 0) {
+    recordStickyPick(params.usageFs, params.paths.usagePicksFile, params.cwd, chosen, nowMs);
+  }
+  return { kind: "selected", selector: chosen };
+}
+
+// src/launchPicker.ts
+init_realPorts();
+async function pickLaunchIdentity(params) {
+  return await runIdentityPicker({
+    parsed: params.parsed,
+    decision: params.decision,
+    interactive: process.stdin.isTTY && process.stdout.isTTY,
+    paths: params.paths,
+    fs: realFsPort,
+    usageFs: params.farm.runtime.fs,
+    pools: params.farm.pools,
+    cwd: params.farm.runtime.cwd,
+    now: params.farm.runtime.now,
+    identityNames: () => listIdentities(params.paths).flatMap((listing) => "problem" in listing ? [] : [listing.name]),
+    picker: promptsIdentityPicker(realPromptsPort)
+  });
+}
+
+// src/runClaude.ts
 init_launchWiring();
 init_paths();
 
@@ -158566,6 +158825,7 @@ function otherLaunchFlags(parsed) {
     ...parsed.skipPermissions === void 0 ? [] : ["--[no-]skip-permissions"],
     ...parsed.remoteControl === void 0 ? [] : ["--[no-]remote-control"],
     ...parsed.wait === void 0 ? [] : ["--[no-]wait"],
+    ...parsed.pick === void 0 ? [] : ["--[no-]pick"],
     ...parsed.categoryFlags.length === 0 ? [] : ["--category"],
     ...parsed.shareFlags.length === 0 ? [] : ["--share"],
     ...parsed.hideFlags.length === 0 ? [] : ["--hide"]
@@ -158631,13 +158891,19 @@ async function runClaude(argvOverride) {
       }
     }
   }
-  await refreshPools({
-    paths,
-    cwd: process.cwd(),
-    poolNames: identityDecision.pool === void 0 ? [] : [identityDecision.pool],
-    spawnDaemon: spawnDetachedSupervisor,
-    log: realLogPort.warn
-  });
+  const refreshUsage = async (poolName2) => {
+    await refreshPools({ paths, cwd: process.cwd(), poolNames: poolName2 === void 0 ? [] : [poolName2], spawnDaemon: spawnDetachedSupervisor, log: realLogPort.warn });
+  };
+  await refreshUsage(identityDecision.pool);
+  const picked = await pickLaunchIdentity({ paths, farm, parsed: nativeArgv, decision: identityDecision });
+  if (picked.kind === "cancelled") {
+    throw new IdentityPickerCancelledError();
+  }
+  const pickedIdentity = picked.kind === "selected" ? picked.selector : void 0;
+  const launchDecision = pickedIdentity === void 0 ? identityDecision : decideIdentity({ env: procForDecision.env, argv0Identity: pickedIdentity, readActiveIdentityFile: () => void 0 });
+  if (launchDecision.pool !== identityDecision.pool) {
+    await refreshUsage(launchDecision.pool);
+  }
   const prepareParams = {
     ...realPrepareLaunchParams(paths, {
       proc: argvOverride === void 0 ? realProcPort : { ...realProcPort, argv: argvOverride },
@@ -158646,10 +158912,11 @@ async function runClaude(argvOverride) {
       farm,
       allowMissingConfigProfile
     }),
+    ...pickedIdentity === void 0 ? {} : { pickedIdentity },
     // Wired here rather than in realPrepareLaunchParams because the port re-invokes this very binary: correct for the agent-shim command line, wrong for a library host whose own executable is not agent-shim.
     update: realLaunchUpdatePort(paths)
   };
-  const poolName = identityDecision.pool;
+  const poolName = launchDecision.pool;
   if (poolName !== void 0 && farm.pools !== void 0 && supervisesLaunch(farm.pools[poolName], nativeArgv.rest)) {
     const code = await runSupervised({
       paths,

package/dist/index.cjs

@@ -4764,7 +4764,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "agent-shim",
-      version: "11.77.0",
+      version: "11.79.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -10726,7 +10726,8 @@ var init_argv = __esm({
       { flag: "--remote-control", key: "remoteControl" },
       { flag: "--wait", key: "wait" },
       { flag: "--pause", key: "pause" },
-      { flag: "--explain", key: "explain" }
+      { flag: "--explain", key: "explain" },
+      { flag: "--pick", key: "pick" }
     ];
     LAUNCHER_FLAG_NAMES = [
       ...VALUED_FLAGS,
@@ -11812,7 +11813,7 @@ function decideLaunch(params, readOnly) {
   const configDirEscapeHatchApplies = env.CLAUDE_CONFIG_DIR !== void 0 && env.CLAUDE_CONFIG_DIR !== "";
   const decidedIdentity = decideIdentity({
     env,
-    argv0Identity: parsedArgv.identity,
+    argv0Identity: params.pickedIdentity ?? parsedArgv.identity,
     directoryPinnedIdentity: params.directoryPinnedIdentity,
     readActiveIdentityFile: () => {
       const raw = fs14.readFileUtf8(paths.activeIdentityFile);
@@ -17084,6 +17085,65 @@ var import_node_fs10 = __toESM(require("node:fs"), 1);
 var import_node_path29 = __toESM(require("node:path"), 1);
 init_signIn();
 
+// src/identityAccounts.ts
+init_account();
+
+// src/usage/accountDescription.ts
+function describeAccountOrganisation(account) {
+  const parts = [account.organizationName, account.organizationType].filter((part) => part !== void 0);
+  return parts.length === 0 ? void 0 : parts.join(", ");
+}
+
+// src/identityAccounts.ts
+function readIdentityAccount(fs14, identitiesDir, identity) {
+  try {
+    const account = readAccountMetadata(fs14, identitiesDir, identity);
+    return account === void 0 ? void 0 : { account };
+  } catch (error) {
+    if (error instanceof AccountMetadataError) {
+      return { problem: error.message };
+    }
+    throw error;
+  }
+}
+function summariseIdentityAccount(account) {
+  const summary = {
+    ...account.emailAddress === void 0 ? {} : { emailAddress: account.emailAddress },
+    ...account.organizationName === void 0 ? {} : { organizationName: account.organizationName },
+    ...account.organizationType === void 0 ? {} : { organizationType: account.organizationType },
+    ...account.organizationRole === void 0 ? {} : { organizationRole: account.organizationRole },
+    ...account.billingType === void 0 ? {} : { billingType: account.billingType },
+    ...account.seatTier === void 0 ? {} : { seatTier: account.seatTier }
+  };
+  return Object.keys(summary).length === 0 ? void 0 : summary;
+}
+function loginKeyOf(account) {
+  return account.accountUuid === void 0 ? void 0 : JSON.stringify([account.accountUuid, account.organizationUuid ?? null]);
+}
+function collectByLogin(items, loginOf) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const item of items) {
+    const key = loginOf(item) ?? /* @__PURE__ */ Symbol("no login");
+    const group = groups.get(key);
+    if (group === void 0) {
+      groups.set(key, [item]);
+    } else {
+      group.push(item);
+    }
+  }
+  return [...groups.values()];
+}
+function groupSharedLogins(items, loginOf) {
+  return collectByLogin(items, loginOf).filter((group) => group.length > 1);
+}
+function describeAccountHolder(summary) {
+  const organisation = describeAccountOrganisation(summary);
+  if (summary.emailAddress === void 0) {
+    return organisation;
+  }
+  return organisation === void 0 ? summary.emailAddress : `${summary.emailAddress} (${organisation})`;
+}
+
 // src/codex/siwcStore.ts
 var import_zod26 = require("zod");
 
@@ -17458,6 +17518,10 @@ var DOCTOR_SECTIONS = [
   "frontdoor",
   "models"
 ];
+function joinNames(names) {
+  const last = names.at(-1);
+  return names.length < 2 || last === void 0 ? names.join("") : `${names.slice(0, -1).join(", ")} and ${last}`;
+}
 function refinePathShadow(status, ownExecutablePath, realpath) {
   if (status.status !== "shadowed") {
     return status;
@@ -17705,6 +17769,7 @@ function runDoctor(params) {
   const validProfileNames = new Set(profileSources.keys());
   const validProviderNames = /* @__PURE__ */ new Set([...params.providers.map((entry) => entry.name), ...Object.keys(params.providerAliases ?? {})]);
   const validIdentityNames = /* @__PURE__ */ new Set();
+  const signedInAccounts = [];
   for (const entry of params.identities) {
     const validated3 = validate(IdentitySchema, entry, "identity", entry.name);
     if (!validated3.ok) {
@@ -17754,6 +17819,18 @@ function runDoctor(params) {
       signIn.state === "signed-out" ? `${entry.name} is signed out (${signIn.detail}). Run \`agent-shim run @${entry.name}\` and sign in.` : `${entry.name} ${standing} (${signIn.detail}).`,
       entry.name
     );
+    if (signIn.state === "signed-in" && entry.account !== void 0) {
+      signedInAccounts.push({ name: entry.name, account: entry.account });
+    }
+  }
+  for (const group of groupSharedLogins(signedInAccounts, (entry) => loginKeyOf(entry.account))) {
+    const names = group.map((entry) => entry.name);
+    const holder = group.map((entry) => summariseIdentityAccount(entry.account)).map((summary) => summary === void 0 ? void 0 : describeAccountHolder(summary)).find((described) => described !== void 0);
+    push(
+      "sign-in",
+      "warn",
+      `Identities ${joinNames(names)} hold the same login${holder === void 0 ? "" : ` (${holder})`}, so they share one quota window and all but one are redundant. Remove the redundant ones with \`agent-shim identity remove <name>\`.`
+    );
   }
   const validatedGlobalConfig = params.globalConfig.raw === void 0 ? void 0 : validateJson(GlobalConfigSchema, params.globalConfig);
   const pools = validatedGlobalConfig?.ok === true ? validatedGlobalConfig.data.pools ?? {} : {};
@@ -18042,7 +18119,7 @@ function collectDoctorReport(params) {
   const identities = identityNames.map((name) => {
     const farmRoot = import_node_path29.default.join(paths.identitiesDir, name);
     const identityPath = import_node_path29.default.join(farmRoot, "identity.json");
-    return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot, credentialsFilePresent: import_node_fs10.default.existsSync(credentialsFilePath(farmRoot)) };
+    return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot, credentialsFilePresent: import_node_fs10.default.existsSync(credentialsFilePath(farmRoot)), account: readIdentityAccount(realFsPort, paths.identitiesDir, name)?.account };
   });
   const profileNames = import_node_fs10.default.existsSync(paths.configProfilesDir) ? import_node_fs10.default.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const configProfiles = profileNames.map((name) => {

package/dist/index.mjs

@@ -4740,7 +4740,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "agent-shim",
-      version: "11.77.0",
+      version: "11.79.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -10699,7 +10699,8 @@ var init_argv = __esm({
       { flag: "--remote-control", key: "remoteControl" },
       { flag: "--wait", key: "wait" },
       { flag: "--pause", key: "pause" },
-      { flag: "--explain", key: "explain" }
+      { flag: "--explain", key: "explain" },
+      { flag: "--pick", key: "pick" }
     ];
     LAUNCHER_FLAG_NAMES = [
       ...VALUED_FLAGS,
@@ -11787,7 +11788,7 @@ function decideLaunch(params, readOnly) {
   const configDirEscapeHatchApplies = env.CLAUDE_CONFIG_DIR !== void 0 && env.CLAUDE_CONFIG_DIR !== "";
   const decidedIdentity = decideIdentity({
     env,
-    argv0Identity: parsedArgv.identity,
+    argv0Identity: params.pickedIdentity ?? parsedArgv.identity,
     directoryPinnedIdentity: params.directoryPinnedIdentity,
     readActiveIdentityFile: () => {
       const raw = fs14.readFileUtf8(paths.activeIdentityFile);
@@ -16669,6 +16670,65 @@ import fs11 from "node:fs";
 import path29 from "node:path";
 init_signIn();
 
+// src/identityAccounts.ts
+init_account();
+
+// src/usage/accountDescription.ts
+function describeAccountOrganisation(account) {
+  const parts = [account.organizationName, account.organizationType].filter((part) => part !== void 0);
+  return parts.length === 0 ? void 0 : parts.join(", ");
+}
+
+// src/identityAccounts.ts
+function readIdentityAccount(fs14, identitiesDir, identity) {
+  try {
+    const account = readAccountMetadata(fs14, identitiesDir, identity);
+    return account === void 0 ? void 0 : { account };
+  } catch (error) {
+    if (error instanceof AccountMetadataError) {
+      return { problem: error.message };
+    }
+    throw error;
+  }
+}
+function summariseIdentityAccount(account) {
+  const summary = {
+    ...account.emailAddress === void 0 ? {} : { emailAddress: account.emailAddress },
+    ...account.organizationName === void 0 ? {} : { organizationName: account.organizationName },
+    ...account.organizationType === void 0 ? {} : { organizationType: account.organizationType },
+    ...account.organizationRole === void 0 ? {} : { organizationRole: account.organizationRole },
+    ...account.billingType === void 0 ? {} : { billingType: account.billingType },
+    ...account.seatTier === void 0 ? {} : { seatTier: account.seatTier }
+  };
+  return Object.keys(summary).length === 0 ? void 0 : summary;
+}
+function loginKeyOf(account) {
+  return account.accountUuid === void 0 ? void 0 : JSON.stringify([account.accountUuid, account.organizationUuid ?? null]);
+}
+function collectByLogin(items, loginOf) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const item of items) {
+    const key = loginOf(item) ?? /* @__PURE__ */ Symbol("no login");
+    const group = groups.get(key);
+    if (group === void 0) {
+      groups.set(key, [item]);
+    } else {
+      group.push(item);
+    }
+  }
+  return [...groups.values()];
+}
+function groupSharedLogins(items, loginOf) {
+  return collectByLogin(items, loginOf).filter((group) => group.length > 1);
+}
+function describeAccountHolder(summary) {
+  const organisation = describeAccountOrganisation(summary);
+  if (summary.emailAddress === void 0) {
+    return organisation;
+  }
+  return organisation === void 0 ? summary.emailAddress : `${summary.emailAddress} (${organisation})`;
+}
+
 // src/codex/siwcStore.ts
 import { z as z26 } from "zod";
 
@@ -17043,6 +17103,10 @@ var DOCTOR_SECTIONS = [
   "frontdoor",
   "models"
 ];
+function joinNames(names) {
+  const last = names.at(-1);
+  return names.length < 2 || last === void 0 ? names.join("") : `${names.slice(0, -1).join(", ")} and ${last}`;
+}
 function refinePathShadow(status, ownExecutablePath, realpath) {
   if (status.status !== "shadowed") {
     return status;
@@ -17290,6 +17354,7 @@ function runDoctor(params) {
   const validProfileNames = new Set(profileSources.keys());
   const validProviderNames = /* @__PURE__ */ new Set([...params.providers.map((entry) => entry.name), ...Object.keys(params.providerAliases ?? {})]);
   const validIdentityNames = /* @__PURE__ */ new Set();
+  const signedInAccounts = [];
   for (const entry of params.identities) {
     const validated3 = validate(IdentitySchema, entry, "identity", entry.name);
     if (!validated3.ok) {
@@ -17339,6 +17404,18 @@ function runDoctor(params) {
       signIn.state === "signed-out" ? `${entry.name} is signed out (${signIn.detail}). Run \`agent-shim run @${entry.name}\` and sign in.` : `${entry.name} ${standing} (${signIn.detail}).`,
       entry.name
     );
+    if (signIn.state === "signed-in" && entry.account !== void 0) {
+      signedInAccounts.push({ name: entry.name, account: entry.account });
+    }
+  }
+  for (const group of groupSharedLogins(signedInAccounts, (entry) => loginKeyOf(entry.account))) {
+    const names = group.map((entry) => entry.name);
+    const holder = group.map((entry) => summariseIdentityAccount(entry.account)).map((summary) => summary === void 0 ? void 0 : describeAccountHolder(summary)).find((described) => described !== void 0);
+    push(
+      "sign-in",
+      "warn",
+      `Identities ${joinNames(names)} hold the same login${holder === void 0 ? "" : ` (${holder})`}, so they share one quota window and all but one are redundant. Remove the redundant ones with \`agent-shim identity remove <name>\`.`
+    );
   }
   const validatedGlobalConfig = params.globalConfig.raw === void 0 ? void 0 : validateJson(GlobalConfigSchema, params.globalConfig);
   const pools = validatedGlobalConfig?.ok === true ? validatedGlobalConfig.data.pools ?? {} : {};
@@ -17627,7 +17704,7 @@ function collectDoctorReport(params) {
   const identities = identityNames.map((name) => {
     const farmRoot = path29.join(paths.identitiesDir, name);
     const identityPath = path29.join(farmRoot, "identity.json");
-    return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot, credentialsFilePresent: fs11.existsSync(credentialsFilePath(farmRoot)) };
+    return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot, credentialsFilePresent: fs11.existsSync(credentialsFilePath(farmRoot)), account: readIdentityAccount(realFsPort, paths.identitiesDir, name)?.account };
   });
   const profileNames = fs11.existsSync(paths.configProfilesDir) ? fs11.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const configProfiles = profileNames.map((name) => {

package/dist/types/index.d.ts

@@ -8876,6 +8876,180 @@ type PathShadowStatus = {
     readonly by: string;
 };
 
+/** One routed request, appended to the usage log when its response has finished. */
+declare const UsageRecordSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    at: z.ZodISODateTime;
+    identity: z.ZodOptional<z.ZodString>;
+    provider: z.ZodString;
+    sessionId: z.ZodOptional<z.ZodString>;
+    clientSessionId: z.ZodOptional<z.ZodString>;
+    project: z.ZodOptional<z.ZodString>;
+    viaHeadroom: z.ZodOptional<z.ZodBoolean>;
+    route: z.ZodString;
+    method: z.ZodString;
+    endpoint: z.ZodString;
+    model: z.ZodOptional<z.ZodString>;
+    requestedModel: z.ZodOptional<z.ZodString>;
+    candidateProviders: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    status: z.ZodNumber;
+    latencyMs: z.ZodNumber;
+    durationMs: z.ZodNumber;
+    outcome: z.ZodEnum<{
+        completed: "completed";
+        aborted: "aborted";
+    }>;
+    usage: z.ZodOptional<z.ZodObject<{
+        inputTokens: z.ZodOptional<z.ZodNumber>;
+        outputTokens: z.ZodOptional<z.ZodNumber>;
+        cacheCreationInputTokens: z.ZodOptional<z.ZodNumber>;
+        cacheReadInputTokens: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+    rateLimitHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    limit: z.ZodOptional<z.ZodObject<{
+        kind: z.ZodEnum<{
+            "rate-limited": "rate-limited";
+            "quota-exhausted": "quota-exhausted";
+        }>;
+        retryAfterSeconds: z.ZodOptional<z.ZodNumber>;
+        resetAt: z.ZodOptional<z.ZodISODateTime>;
+        window: z.ZodOptional<z.ZodString>;
+        evidence: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>;
+    requestId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+type UsageRecord = z.infer<typeof UsageRecordSchema>;
+/** One quota window from Anthropic's unified rate-limit headers. */
+declare const QuotaWindowSchema: z.ZodObject<{
+    utilization: z.ZodOptional<z.ZodNumber>;
+    resetsAt: z.ZodOptional<z.ZodISODateTime>;
+    status: z.ZodOptional<z.ZodString>;
+    graceUtilization: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+type QuotaWindow = z.infer<typeof QuotaWindowSchema>;
+/**
+ * The account fields copied from an identity's stored Claude login (`oauthAccount` in the identity's `.claude.json`): who the account is and which plan and tier it is on. Never the token, which Claude Code keeps elsewhere. Each field is present only when the stored login has it; a setup-token identity has no profile scope and so none of them (see issue #44).
+ */
+declare const AccountMetadataSchema: z.ZodObject<{
+    accountUuid: z.ZodOptional<z.ZodString>;
+    emailAddress: z.ZodOptional<z.ZodString>;
+    displayName: z.ZodOptional<z.ZodString>;
+    organizationUuid: z.ZodOptional<z.ZodString>;
+    organizationName: z.ZodOptional<z.ZodString>;
+    organizationType: z.ZodOptional<z.ZodString>;
+    organizationRole: z.ZodOptional<z.ZodString>;
+    workspaceRole: z.ZodOptional<z.ZodString>;
+    billingType: z.ZodOptional<z.ZodString>;
+    seatTier: z.ZodOptional<z.ZodString>;
+    organizationRateLimitTier: z.ZodOptional<z.ZodString>;
+    userRateLimitTier: z.ZodOptional<z.ZodString>;
+    hasExtraUsageEnabled: z.ZodOptional<z.ZodBoolean>;
+    subscriptionCreatedAt: z.ZodOptional<z.ZodString>;
+    accountCreatedAt: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+type AccountMetadata = z.infer<typeof AccountMetadataSchema>;
+/**
+ * The latest state for one identity, rewritten atomically after each recorded response: the snapshot file other tools read (`~/.agent-shim/usage/snapshots/<identity>.json`) without shelling out to `agent-shim`.
+ */
+declare const UsageSnapshotSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    identity: z.ZodString;
+    updatedAt: z.ZodISODateTime;
+    account: z.ZodOptional<z.ZodObject<{
+        accountUuid: z.ZodOptional<z.ZodString>;
+        emailAddress: z.ZodOptional<z.ZodString>;
+        displayName: z.ZodOptional<z.ZodString>;
+        organizationUuid: z.ZodOptional<z.ZodString>;
+        organizationName: z.ZodOptional<z.ZodString>;
+        organizationType: z.ZodOptional<z.ZodString>;
+        organizationRole: z.ZodOptional<z.ZodString>;
+        workspaceRole: z.ZodOptional<z.ZodString>;
+        billingType: z.ZodOptional<z.ZodString>;
+        seatTier: z.ZodOptional<z.ZodString>;
+        organizationRateLimitTier: z.ZodOptional<z.ZodString>;
+        userRateLimitTier: z.ZodOptional<z.ZodString>;
+        hasExtraUsageEnabled: z.ZodOptional<z.ZodBoolean>;
+        subscriptionCreatedAt: z.ZodOptional<z.ZodString>;
+        accountCreatedAt: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    providers: z.ZodRecord<z.ZodString, z.ZodObject<{
+        lastRequestAt: z.ZodOptional<z.ZodISODateTime>;
+        lastStatus: z.ZodOptional<z.ZodNumber>;
+        lastModel: z.ZodOptional<z.ZodString>;
+        rateLimit: z.ZodOptional<z.ZodObject<{
+            observedAt: z.ZodISODateTime;
+            headers: z.ZodRecord<z.ZodString, z.ZodString>;
+            unified: z.ZodOptional<z.ZodObject<{
+                status: z.ZodOptional<z.ZodString>;
+                fiveHour: z.ZodOptional<z.ZodObject<{
+                    utilization: z.ZodOptional<z.ZodNumber>;
+                    resetsAt: z.ZodOptional<z.ZodISODateTime>;
+                    status: z.ZodOptional<z.ZodString>;
+                    graceUtilization: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$strict>>;
+                sevenDay: z.ZodOptional<z.ZodObject<{
+                    utilization: z.ZodOptional<z.ZodNumber>;
+                    resetsAt: z.ZodOptional<z.ZodISODateTime>;
+                    status: z.ZodOptional<z.ZodString>;
+                    graceUtilization: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$strict>>;
+                sevenDayOverageIncluded: z.ZodOptional<z.ZodObject<{
+                    utilization: z.ZodOptional<z.ZodNumber>;
+                    resetsAt: z.ZodOptional<z.ZodISODateTime>;
+                    status: z.ZodOptional<z.ZodString>;
+                    graceUtilization: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$strict>>;
+                representativeClaim: z.ZodOptional<z.ZodString>;
+                resetAt: z.ZodOptional<z.ZodISODateTime>;
+                overageStatus: z.ZodOptional<z.ZodString>;
+                overageUtilization: z.ZodOptional<z.ZodNumber>;
+                overageResetsAt: z.ZodOptional<z.ZodISODateTime>;
+                overageDisabledReason: z.ZodOptional<z.ZodString>;
+                overageInUse: z.ZodOptional<z.ZodBoolean>;
+                extraUsageSpend: z.ZodOptional<z.ZodObject<{
+                    usedMinor: z.ZodNumber;
+                    limitMinor: z.ZodOptional<z.ZodNumber>;
+                    currency: z.ZodString;
+                }, z.core.$strict>>;
+                fallbackAvailable: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>>;
+            planWindowsUnavailableAt: z.ZodOptional<z.ZodISODateTime>;
+        }, z.core.$strict>>;
+        lastLimit: z.ZodOptional<z.ZodObject<{
+            kind: z.ZodEnum<{
+                "rate-limited": "rate-limited";
+                "quota-exhausted": "quota-exhausted";
+            }>;
+            retryAfterSeconds: z.ZodOptional<z.ZodNumber>;
+            resetAt: z.ZodOptional<z.ZodISODateTime>;
+            window: z.ZodOptional<z.ZodString>;
+            evidence: z.ZodArray<z.ZodString>;
+            observedAt: z.ZodISODateTime;
+            status: z.ZodNumber;
+        }, z.core.$strict>>;
+        quota: z.ZodOptional<z.ZodObject<{
+            observedAt: z.ZodISODateTime;
+            source: z.ZodString;
+            level: z.ZodOptional<z.ZodString>;
+            account: z.ZodOptional<z.ZodObject<{
+                email: z.ZodOptional<z.ZodString>;
+                accountId: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
+            windows: z.ZodArray<z.ZodObject<{
+                measures: z.ZodString;
+                periodMs: z.ZodOptional<z.ZodNumber>;
+                period: z.ZodOptional<z.ZodString>;
+                utilization: z.ZodNumber;
+                resetsAt: z.ZodOptional<z.ZodISODateTime>;
+                limit: z.ZodOptional<z.ZodNumber>;
+                used: z.ZodOptional<z.ZodNumber>;
+                remaining: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+type UsageSnapshot = z.infer<typeof UsageSnapshotSchema>;
+
 /**
  * How the allowlist the headroom daemon serves lags the allowlist computed now. The daemon re-reads its allowlist file on every request that follows a change to it, and its supervisor rewrites the file and records the hash in the same tick, so a lag that lasts beyond one tick means the supervisor is not running or cannot write the file. A daemon started by an earlier release reads no file, and is reported as such instead.
  */
@@ -9085,6 +9259,8 @@ interface DoctorIdentityInput {
     readonly farmRoot: string;
     /** Whether the identity's `.credentials.json` exists, pre-resolved by the wiring layer since it is a file-existence check. */
     readonly credentialsFilePresent: boolean;
+    /** The account metadata of the identity's stored login, pre-resolved by the wiring layer since it is a read of the identity's `.claude.json`. Undefined when the identity has no stored login or its metadata cannot be read. */
+    readonly account: AccountMetadata | undefined;
 }
 /** One configuration profile's raw `<name>.json`, unparsed. */
 interface DoctorConfigProfileInput {
@@ -9192,180 +9368,6 @@ interface CollectDoctorReportParams {
  */
 declare function collectDoctorReport(params: CollectDoctorReportParams): DoctorReport;
 
-/** One routed request, appended to the usage log when its response has finished. */
-declare const UsageRecordSchema: z.ZodObject<{
-    schemaVersion: z.ZodLiteral<1>;
-    at: z.ZodISODateTime;
-    identity: z.ZodOptional<z.ZodString>;
-    provider: z.ZodString;
-    sessionId: z.ZodOptional<z.ZodString>;
-    clientSessionId: z.ZodOptional<z.ZodString>;
-    project: z.ZodOptional<z.ZodString>;
-    viaHeadroom: z.ZodOptional<z.ZodBoolean>;
-    route: z.ZodString;
-    method: z.ZodString;
-    endpoint: z.ZodString;
-    model: z.ZodOptional<z.ZodString>;
-    requestedModel: z.ZodOptional<z.ZodString>;
-    candidateProviders: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    status: z.ZodNumber;
-    latencyMs: z.ZodNumber;
-    durationMs: z.ZodNumber;
-    outcome: z.ZodEnum<{
-        completed: "completed";
-        aborted: "aborted";
-    }>;
-    usage: z.ZodOptional<z.ZodObject<{
-        inputTokens: z.ZodOptional<z.ZodNumber>;
-        outputTokens: z.ZodOptional<z.ZodNumber>;
-        cacheCreationInputTokens: z.ZodOptional<z.ZodNumber>;
-        cacheReadInputTokens: z.ZodOptional<z.ZodNumber>;
-    }, z.core.$strict>>;
-    rateLimitHeaders: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    limit: z.ZodOptional<z.ZodObject<{
-        kind: z.ZodEnum<{
-            "rate-limited": "rate-limited";
-            "quota-exhausted": "quota-exhausted";
-        }>;
-        retryAfterSeconds: z.ZodOptional<z.ZodNumber>;
-        resetAt: z.ZodOptional<z.ZodISODateTime>;
-        window: z.ZodOptional<z.ZodString>;
-        evidence: z.ZodArray<z.ZodString>;
-    }, z.core.$strict>>;
-    requestId: z.ZodOptional<z.ZodString>;
-}, z.core.$strict>;
-type UsageRecord = z.infer<typeof UsageRecordSchema>;
-/** One quota window from Anthropic's unified rate-limit headers. */
-declare const QuotaWindowSchema: z.ZodObject<{
-    utilization: z.ZodOptional<z.ZodNumber>;
-    resetsAt: z.ZodOptional<z.ZodISODateTime>;
-    status: z.ZodOptional<z.ZodString>;
-    graceUtilization: z.ZodOptional<z.ZodNumber>;
-}, z.core.$strict>;
-type QuotaWindow = z.infer<typeof QuotaWindowSchema>;
-/**
- * The account fields copied from an identity's stored Claude login (`oauthAccount` in the identity's `.claude.json`): who the account is and which plan and tier it is on. Never the token, which Claude Code keeps elsewhere. Each field is present only when the stored login has it; a setup-token identity has no profile scope and so none of them (see issue #44).
- */
-declare const AccountMetadataSchema: z.ZodObject<{
-    accountUuid: z.ZodOptional<z.ZodString>;
-    emailAddress: z.ZodOptional<z.ZodString>;
-    displayName: z.ZodOptional<z.ZodString>;
-    organizationUuid: z.ZodOptional<z.ZodString>;
-    organizationName: z.ZodOptional<z.ZodString>;
-    organizationType: z.ZodOptional<z.ZodString>;
-    organizationRole: z.ZodOptional<z.ZodString>;
-    workspaceRole: z.ZodOptional<z.ZodString>;
-    billingType: z.ZodOptional<z.ZodString>;
-    seatTier: z.ZodOptional<z.ZodString>;
-    organizationRateLimitTier: z.ZodOptional<z.ZodString>;
-    userRateLimitTier: z.ZodOptional<z.ZodString>;
-    hasExtraUsageEnabled: z.ZodOptional<z.ZodBoolean>;
-    subscriptionCreatedAt: z.ZodOptional<z.ZodString>;
-    accountCreatedAt: z.ZodOptional<z.ZodString>;
-}, z.core.$strict>;
-type AccountMetadata = z.infer<typeof AccountMetadataSchema>;
-/**
- * The latest state for one identity, rewritten atomically after each recorded response: the snapshot file other tools read (`~/.agent-shim/usage/snapshots/<identity>.json`) without shelling out to `agent-shim`.
- */
-declare const UsageSnapshotSchema: z.ZodObject<{
-    schemaVersion: z.ZodLiteral<1>;
-    identity: z.ZodString;
-    updatedAt: z.ZodISODateTime;
-    account: z.ZodOptional<z.ZodObject<{
-        accountUuid: z.ZodOptional<z.ZodString>;
-        emailAddress: z.ZodOptional<z.ZodString>;
-        displayName: z.ZodOptional<z.ZodString>;
-        organizationUuid: z.ZodOptional<z.ZodString>;
-        organizationName: z.ZodOptional<z.ZodString>;
-        organizationType: z.ZodOptional<z.ZodString>;
-        organizationRole: z.ZodOptional<z.ZodString>;
-        workspaceRole: z.ZodOptional<z.ZodString>;
-        billingType: z.ZodOptional<z.ZodString>;
-        seatTier: z.ZodOptional<z.ZodString>;
-        organizationRateLimitTier: z.ZodOptional<z.ZodString>;
-        userRateLimitTier: z.ZodOptional<z.ZodString>;
-        hasExtraUsageEnabled: z.ZodOptional<z.ZodBoolean>;
-        subscriptionCreatedAt: z.ZodOptional<z.ZodString>;
-        accountCreatedAt: z.ZodOptional<z.ZodString>;
-    }, z.core.$strict>>;
-    providers: z.ZodRecord<z.ZodString, z.ZodObject<{
-        lastRequestAt: z.ZodOptional<z.ZodISODateTime>;
-        lastStatus: z.ZodOptional<z.ZodNumber>;
-        lastModel: z.ZodOptional<z.ZodString>;
-        rateLimit: z.ZodOptional<z.ZodObject<{
-            observedAt: z.ZodISODateTime;
-            headers: z.ZodRecord<z.ZodString, z.ZodString>;
-            unified: z.ZodOptional<z.ZodObject<{
-                status: z.ZodOptional<z.ZodString>;
-                fiveHour: z.ZodOptional<z.ZodObject<{
-                    utilization: z.ZodOptional<z.ZodNumber>;
-                    resetsAt: z.ZodOptional<z.ZodISODateTime>;
-                    status: z.ZodOptional<z.ZodString>;
-                    graceUtilization: z.ZodOptional<z.ZodNumber>;
-                }, z.core.$strict>>;
-                sevenDay: z.ZodOptional<z.ZodObject<{
-                    utilization: z.ZodOptional<z.ZodNumber>;
-                    resetsAt: z.ZodOptional<z.ZodISODateTime>;
-                    status: z.ZodOptional<z.ZodString>;
-                    graceUtilization: z.ZodOptional<z.ZodNumber>;
-                }, z.core.$strict>>;
-                sevenDayOverageIncluded: z.ZodOptional<z.ZodObject<{
-                    utilization: z.ZodOptional<z.ZodNumber>;
-                    resetsAt: z.ZodOptional<z.ZodISODateTime>;
-                    status: z.ZodOptional<z.ZodString>;
-                    graceUtilization: z.ZodOptional<z.ZodNumber>;
-                }, z.core.$strict>>;
-                representativeClaim: z.ZodOptional<z.ZodString>;
-                resetAt: z.ZodOptional<z.ZodISODateTime>;
-                overageStatus: z.ZodOptional<z.ZodString>;
-                overageUtilization: z.ZodOptional<z.ZodNumber>;
-                overageResetsAt: z.ZodOptional<z.ZodISODateTime>;
-                overageDisabledReason: z.ZodOptional<z.ZodString>;
-                overageInUse: z.ZodOptional<z.ZodBoolean>;
-                extraUsageSpend: z.ZodOptional<z.ZodObject<{
-                    usedMinor: z.ZodNumber;
-                    limitMinor: z.ZodOptional<z.ZodNumber>;
-                    currency: z.ZodString;
-                }, z.core.$strict>>;
-                fallbackAvailable: z.ZodOptional<z.ZodBoolean>;
-            }, z.core.$strict>>;
-            planWindowsUnavailableAt: z.ZodOptional<z.ZodISODateTime>;
-        }, z.core.$strict>>;
-        lastLimit: z.ZodOptional<z.ZodObject<{
-            kind: z.ZodEnum<{
-                "rate-limited": "rate-limited";
-                "quota-exhausted": "quota-exhausted";
-            }>;
-            retryAfterSeconds: z.ZodOptional<z.ZodNumber>;
-            resetAt: z.ZodOptional<z.ZodISODateTime>;
-            window: z.ZodOptional<z.ZodString>;
-            evidence: z.ZodArray<z.ZodString>;
-            observedAt: z.ZodISODateTime;
-            status: z.ZodNumber;
-        }, z.core.$strict>>;
-        quota: z.ZodOptional<z.ZodObject<{
-            observedAt: z.ZodISODateTime;
-            source: z.ZodString;
-            level: z.ZodOptional<z.ZodString>;
-            account: z.ZodOptional<z.ZodObject<{
-                email: z.ZodOptional<z.ZodString>;
-                accountId: z.ZodOptional<z.ZodString>;
-            }, z.core.$strict>>;
-            windows: z.ZodArray<z.ZodObject<{
-                measures: z.ZodString;
-                periodMs: z.ZodOptional<z.ZodNumber>;
-                period: z.ZodOptional<z.ZodString>;
-                utilization: z.ZodNumber;
-                resetsAt: z.ZodOptional<z.ZodISODateTime>;
-                limit: z.ZodOptional<z.ZodNumber>;
-                used: z.ZodOptional<z.ZodNumber>;
-                remaining: z.ZodOptional<z.ZodNumber>;
-            }, z.core.$strict>>;
-        }, z.core.$strict>>;
-    }, z.core.$strict>>;
-}, z.core.$strict>;
-type UsageSnapshot = z.infer<typeof UsageSnapshotSchema>;
-
 /** How a sign-out went: whether OpenAI was told, so the person knows the grant is dead on its side too. */
 interface SiwcLogoutResult {
     readonly hadGrant: boolean;
@@ -14030,6 +14032,8 @@ interface PrepareLaunchParams {
     readonly log: LogPort;
     /** Discovers the real `claude` binary to spawn. Injected so `runLauncher` never depends on `src/versionDiscovery.ts`'s own filesystem/PATH inputs directly — the caller (`src/cli.ts`) wires the real discovery, tests wire a fake that returns a fixed path. */
     readonly resolveClaudeBinary: ClaudeBinaryResolver;
+    /** The identity (or `pool:<name>`) the person chose at the identity picker, which takes the place of whatever the arguments named: the question was asked because that choice was not settled. */
+    readonly pickedIdentity?: string;
     /** An identity pinned to `$PWD` by a directory rule. Accepted as an already-resolved value — the rules-loading code that produces it lands in Phase 4/5. */
     readonly directoryPinnedIdentity?: string;
     /** A directory rule's `configProfile` selection for `$PWD`. Accepted as an already-resolved value for the same reason. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-shim",
-  "version": "11.77.0",
+  "version": "11.79.0",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",