agent-shim 11.79.0 → 11.81.0

package/README.md

@@ -57,7 +57,7 @@ That's it — with no further configuration, everything in `~/.claude` that isn'
 - **An identity** is a login: the thing that owns credentials and daemon state, selected with `agent-shim run @<name>` or, once `agent-shim shim enable` has run, `claude @<name>`.
 - **A configuration profile** is a reusable, named bundle of sharing rules, independent of any identity, resolved per working directory via directory rules or a committed `.agent-shim.json`.
 
-A third, optional thing sits on top of identities: **a pool** is a named list of them. Select `pool:<name>` where an identity name goes (`claude @pool:subs`) and agent-shim picks the member whose unused quota is closest to expiring, skipping any that are refused right now, using the usage it already records. A pool can instead declare `--preference listed`, which tries the members in the order the pool lists them, skipping only one that is refused right now. A member entry may itself name another pool (`pool:<name>`), which is ranked with its own policy and contributes its pick at that position, so "this identity first, then the fleet" nests the fleet rather than copying its member list; cycles are refused. See [docs/configuration-model.md](docs/configuration-model.md#pools-picking-an-account-at-launch). On a terminal, `agent-shim run` asks which identity to run as when none resolves, when a pool pick would change account, or when the identity is refused right now (`--pick` forces the question, `--no-pick` never asks); see [docs/configuration-model.md](docs/configuration-model.md#choosing-the-identity-at-launch-the-picker).
+A third, optional thing sits on top of identities: **a pool** is a named list of them. Select `pool:<name>` where an identity name goes (`claude @pool:subs`) and agent-shim picks the member whose unused quota is closest to expiring, skipping any that are refused right now, using the usage it already records. A pool can instead declare `--preference listed`, which tries the members in the order the pool lists them, skipping only one that is refused right now. A member entry may itself name another pool (`pool:<name>`), which is ranked with its own policy and contributes its pick at that position, so "this identity first, then the fleet" nests the fleet rather than copying its member list; cycles are refused. Members that hold the same login (the same account in the same organisation) share one quota window, so a pool ranks them as one candidate and never fails over from one to the other; `pool add`, `pool set` and `doctor` warn when a pool lists two of them. See [docs/configuration-model.md](docs/configuration-model.md#pools-picking-an-account-at-launch). On a terminal, `agent-shim run` asks which identity to run as when none resolves, when a pool pick would change account, or when the identity is refused right now (`--pick` forces the question, `--no-pick` never asks); see [docs/configuration-model.md](docs/configuration-model.md#choosing-the-identity-at-launch-the-picker).
 
 Every top-level entry in `~/.claude` is classified into one of five categories, shipped as a default map (`config/categories.default.json`):
 
@@ -85,7 +85,7 @@ agent-shim <noun> <verb> [name] [options]      # nouns: identity, profile, pool,
 agent-shim identity add <name> [--json]
 agent-shim identity list [--json]
 agent-shim identity show <name> [--json]
-agent-shim identity set <name> [--default-profile <profile> | --no-default-profile] [--provider <provider> | --no-provider] [--[no-]allow-ambient-credential] [--json]
+agent-shim identity set <name> [--label <text> | --no-label] [--default-profile <profile> | --no-default-profile] [--provider <provider> | --no-provider] [--[no-]allow-ambient-credential] [--json]
 agent-shim identity set <name> [--credential <source>]... [--credential-target <bearer|apiKey|oauthToken>] [--no-credential] [--json]
 agent-shim identity set <name> [--anchor <days>@<HH:MM>[/<zone>]]... [--no-anchor] [--json]
 agent-shim identity remove <name> [--yes] [--json]

package/dist/cli.cjs

@@ -25123,7 +25123,7 @@ function providerFilePath(directory, name, source) {
   }
   return import_node_path4.default.join(directory, `${name}.json`);
 }
-var import_node_path4, FILESYSTEM_COMPONENT_BYTES, MAX_PID_DIGITS, UUID_CHARS, ATOMIC_WRITE_OVERHEAD_BYTES, FARM_SWAP_OVERHEAD_BYTES, MAX_NAME_BYTES, FILE_NAME_PATTERN, FILE_NAME, FILE_NAME_RULE, STORED_NAME_RULE, FileNameSchema, StoredNameSchema, UnsafeNameError, InvalidProviderNameError;
+var import_node_path4, FILESYSTEM_COMPONENT_BYTES, MAX_PID_DIGITS, UUID_CHARS, ATOMIC_WRITE_OVERHEAD_BYTES, FARM_SWAP_OVERHEAD_BYTES, MAX_NAME_BYTES, FILE_NAME_PATTERN, FILE_NAME, FILE_NAME_RULE, STORED_NAME_RULE, FileNameSchema, StoredNameSchema, LABEL_FORBIDDEN, IDENTITY_LABEL_RULE, IdentityLabelSchema, UnsafeNameError, InvalidProviderNameError;
 var init_names = __esm({
   "src/config/names.ts"() {
     "use strict";
@@ -25142,6 +25142,9 @@ var init_names = __esm({
     STORED_NAME_RULE = `must be non-empty, at most ${String(MAX_NAME_BYTES)} bytes, not "." or "..", and contain no path separator or NUL`;
     FileNameSchema = external_exports.string().min(1).regex(FILE_NAME, FILE_NAME_RULE);
     StoredNameSchema = external_exports.string().min(1).max(MAX_NAME_BYTES).refine(isStoredName, STORED_NAME_RULE);
+    LABEL_FORBIDDEN = /[\p{Cc}\p{Zl}\p{Zp}]/u;
+    IDENTITY_LABEL_RULE = `must be non-empty single-line text of at most ${String(MAX_NAME_BYTES)} characters, with no control characters and no leading or trailing whitespace`;
+    IdentityLabelSchema = external_exports.string().min(1).max(MAX_NAME_BYTES).refine((label2) => label2 === label2.trim() && !LABEL_FORBIDDEN.test(label2), IDENTITY_LABEL_RULE);
     UnsafeNameError = class extends CliError {
       constructor(attemptedName, kind, rule = STORED_NAME_RULE, source) {
         super(`${source === void 0 ? "" : `${source}: `}${JSON.stringify(attemptedName)} is not a valid ${kind} name: a name ${rule}.`);
@@ -28489,6 +28492,8 @@ var init_schema = __esm({
     IdentitySchema = external_exports.strictObject({
       $schema: external_exports.string().optional(),
       name: FileNameSchema,
+      /** What the identity is for, in the person's words, drawn beside its name in `identity list` and `show`, the launch banner and the statusline. Display only: the name stays the key for lookup, paths, keychain service names and pools. */
+      label: IdentityLabelSchema.optional(),
       defaultConfigProfile: StoredNameSchema.optional(),
       /** The provider this identity exists for: a launch on the identity routes through it unless `--provider`, `--no-provider` or a cascade layer's `launch.provider` says otherwise. Its sessions run on the provider's credential, so the identity needs no stored login. */
       provider: StoredNameSchema.optional(),
@@ -38192,13 +38197,95 @@ var init_account = __esm({
   }
 });
 
+// src/usage/accountDescription.ts
+function describeAccountOrganisation(account) {
+  const parts = [account.organizationName, account.organizationType].filter((part) => part !== void 0);
+  return parts.length === 0 ? void 0 : parts.join(", ");
+}
+function describeAccountPlan(account) {
+  const parts = [account.billingType === void 0 ? void 0 : `billing ${account.billingType}`, account.seatTier === void 0 ? void 0 : `seat tier ${account.seatTier}`].filter((part) => part !== void 0);
+  return parts.length === 0 ? void 0 : parts.join(", ");
+}
+var init_accountDescription = __esm({
+  "src/usage/accountDescription.ts"() {
+    "use strict";
+  }
+});
+
+// src/identityAccounts.ts
+function readIdentityAccount(fs31, identitiesDir, identity) {
+  try {
+    const account = readAccountMetadata(fs31, identitiesDir, identity);
+    return account === void 0 ? void 0 : { account };
+  } catch (error63) {
+    if (error63 instanceof AccountMetadataError) {
+      return { problem: error63.message };
+    }
+    throw error63;
+  }
+}
+function summariseIdentityAccount(account) {
+  const summary = {
+    ...account.emailAddress === void 0 ? {} : { emailAddress: account.emailAddress },
+    ...account.organizationName === void 0 ? {} : { organizationName: account.organizationName },
+    ...account.organizationType === void 0 ? {} : { organizationType: account.organizationType },
+    ...account.organizationRole === void 0 ? {} : { organizationRole: account.organizationRole },
+    ...account.billingType === void 0 ? {} : { billingType: account.billingType },
+    ...account.seatTier === void 0 ? {} : { seatTier: account.seatTier }
+  };
+  return Object.keys(summary).length === 0 ? void 0 : summary;
+}
+function loginKeyOf(account) {
+  return account.accountUuid === void 0 ? void 0 : JSON.stringify([account.accountUuid, account.organizationUuid ?? null]);
+}
+function collectByLogin(items, loginOf) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const item of items) {
+    const key = loginOf(item) ?? /* @__PURE__ */ Symbol("no login");
+    const group = groups.get(key);
+    if (group === void 0) {
+      groups.set(key, [item]);
+    } else {
+      group.push(item);
+    }
+  }
+  return [...groups.values()];
+}
+function groupByLogin(items, loginOf) {
+  return collectByLogin(items, loginOf).flat();
+}
+function groupSharedLogins(items, loginOf) {
+  return collectByLogin(items, loginOf).filter((group) => group.length > 1);
+}
+function joinNames(names) {
+  const last = names.at(-1);
+  return names.length < 2 || last === void 0 ? names.join("") : `${names.slice(0, -1).join(", ")} and ${last}`;
+}
+function describeAccountHolder(summary) {
+  const organisation = describeAccountOrganisation(summary);
+  if (summary.emailAddress === void 0) {
+    return organisation;
+  }
+  return organisation === void 0 ? summary.emailAddress : `${summary.emailAddress} (${organisation})`;
+}
+function describeIdentityAccount(summary) {
+  return [describeAccountHolder(summary), summary.organizationRole === void 0 ? void 0 : `role ${summary.organizationRole}`, describeAccountPlan(summary)].filter((part) => part !== void 0).join("; ");
+}
+var init_identityAccounts = __esm({
+  "src/identityAccounts.ts"() {
+    "use strict";
+    init_account();
+    init_accountDescription();
+  }
+});
+
 // package.json
 var package_default;
 var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "agent-shim",
-      version: "11.79.0",
+      version: "11.81.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -38918,6 +39005,9 @@ function assessRefusedNested(member, nested, nowMs) {
   };
 }
 function assess(member, nowMs) {
+  if (member.sameLoginAs !== void 0) {
+    return { candidate: { identity: member.identity, class: "ineligible", plan: planOf(member.account), reasons: [`same login as ${member.sameLoginAs}`] } };
+  }
   const nested = member.nested;
   if (nested === void 0) {
     return assessIdentity(member, nowMs);
@@ -39461,6 +39551,29 @@ function loadPoolMembers(fs31, paths, identities, nowMs) {
     }
   });
 }
+function snapshotAgeKey(member) {
+  return member.snapshot === void 0 ? Number.NEGATIVE_INFINITY : Date.parse(member.snapshot.updatedAt);
+}
+function collapseSharedLogins(members2) {
+  const groups = groupSharedLogins(members2, (member) => member.nested === void 0 && member.account !== void 0 ? loginKeyOf(member.account) : void 0);
+  const representativeOf = /* @__PURE__ */ new Map();
+  for (const group of groups) {
+    const representative = group.reduce((freshest, member) => snapshotAgeKey(member) > snapshotAgeKey(freshest) ? member : freshest);
+    for (const member of group) {
+      if (member !== representative) {
+        representativeOf.set(member, representative.identity);
+      }
+    }
+  }
+  return members2.map((member) => {
+    const representative = representativeOf.get(member);
+    return representative === void 0 ? member : { ...member, sameLoginAs: representative };
+  });
+}
+function stickyOnRepresentative(sticky, members2) {
+  const twin = sticky === void 0 ? void 0 : members2.find((member) => member.identity === sticky.identity && member.sameLoginAs !== void 0);
+  return sticky === void 0 || twin?.sameLoginAs === void 0 ? sticky : { ...sticky, identity: twin.sameLoginAs };
+}
 function rankPoolGraph(input2) {
   return rankNamedPool(input2, input2.poolName, [], input2.sticky);
 }
@@ -39488,13 +39601,15 @@ function rankNamedPool(input2, poolName, stack, sticky) {
     members2.push(typeof entry === "string" ? nested.member : { ...nested.member, policy: entry.when });
     missing.push(...nested.missing);
   }
+  const collapsed = collapseSharedLogins(members2);
+  const stickyPick = stickyOnRepresentative(sticky, collapsed);
   const ranking = rankPool({
-    members: members2,
+    members: collapsed,
     nowMs: input2.nowMs,
     resuming: input2.resuming,
     ...input2.resumeContextTokens === void 0 ? {} : { resumeContextTokens: input2.resumeContextTokens },
     ...input2.committedContextTokens === void 0 ? {} : { committedContextTokens: input2.committedContextTokens },
-    ...sticky === void 0 ? {} : { sticky },
+    ...stickyPick === void 0 ? {} : { sticky: stickyPick },
     ...pool.preference === void 0 ? {} : { preference: pool.preference }
   });
   return { ranking, missing };
@@ -39561,6 +39676,7 @@ var init_poolPick = __esm({
     init_cliError();
     init_identity();
     init_schema();
+    init_identityAccounts();
     init_account();
     init_pick();
     init_read();
@@ -67997,9 +68113,15 @@ function movedRows(facts) {
   }
   return [];
 }
+function identityText(facts) {
+  if (facts.identity === void 0) {
+    return "(none)";
+  }
+  return facts.identityLabel === void 0 ? facts.identity : `${facts.identity} (${facts.identityLabel})`;
+}
 function decisionRows(facts) {
   return [
-    { label: "identity", value: facts.identity ?? "(none)", detail: facts.identitySource },
+    { label: "identity", value: identityText(facts), detail: facts.identitySource },
     ...facts.pool === void 0 ? [] : [
       {
         label: "pool",
@@ -70165,6 +70287,7 @@ function decideLaunch(params, readOnly) {
   return {
     parsedArgv,
     identityDecision,
+    identityLabel: loadedIdentity?.config.label,
     poolPick,
     poolRanking,
     lastRanAs,
@@ -70195,6 +70318,7 @@ function prepareLaunch(params) {
   const rows = [
     ...decisionRows({
       identity: identityDecision.name,
+      identityLabel: decided.identityLabel,
       identitySource: identityDecision.source,
       pool: poolPick,
       ranking: resolvedFlags.explain ? poolRanking : void 0,
@@ -116557,6 +116681,12 @@ function setIdentityProvider(paths, identityName, providerName) {
   }
   return applyPatch(identityJsonPath(paths, identityName), IdentitySchema, { provider: providerName });
 }
+function setIdentityLabel(paths, identityName, label2) {
+  if (!identityExists(paths, identityName)) {
+    throw new IdentityNotFoundError(identityName);
+  }
+  return applyPatch(identityJsonPath(paths, identityName), IdentitySchema, { label: label2 });
+}
 function setAllowAmbientCredential(paths, identityName, allow) {
   if (!identityExists(paths, identityName)) {
     throw new IdentityNotFoundError(identityName);
@@ -117701,80 +117831,12 @@ function registerProfileCommand(program2, deps) {
 }
 
 // src/identityManager.ts
+init_names();
 init_providersStore();
 init_identity();
 init_realPorts();
-
-// src/identityAccounts.ts
-init_account();
-
-// src/usage/accountDescription.ts
-function describeAccountOrganisation(account) {
-  const parts = [account.organizationName, account.organizationType].filter((part) => part !== void 0);
-  return parts.length === 0 ? void 0 : parts.join(", ");
-}
-function describeAccountPlan(account) {
-  const parts = [account.billingType === void 0 ? void 0 : `billing ${account.billingType}`, account.seatTier === void 0 ? void 0 : `seat tier ${account.seatTier}`].filter((part) => part !== void 0);
-  return parts.length === 0 ? void 0 : parts.join(", ");
-}
-
-// src/identityAccounts.ts
-function readIdentityAccount(fs31, identitiesDir, identity) {
-  try {
-    const account = readAccountMetadata(fs31, identitiesDir, identity);
-    return account === void 0 ? void 0 : { account };
-  } catch (error63) {
-    if (error63 instanceof AccountMetadataError) {
-      return { problem: error63.message };
-    }
-    throw error63;
-  }
-}
-function summariseIdentityAccount(account) {
-  const summary = {
-    ...account.emailAddress === void 0 ? {} : { emailAddress: account.emailAddress },
-    ...account.organizationName === void 0 ? {} : { organizationName: account.organizationName },
-    ...account.organizationType === void 0 ? {} : { organizationType: account.organizationType },
-    ...account.organizationRole === void 0 ? {} : { organizationRole: account.organizationRole },
-    ...account.billingType === void 0 ? {} : { billingType: account.billingType },
-    ...account.seatTier === void 0 ? {} : { seatTier: account.seatTier }
-  };
-  return Object.keys(summary).length === 0 ? void 0 : summary;
-}
-function loginKeyOf(account) {
-  return account.accountUuid === void 0 ? void 0 : JSON.stringify([account.accountUuid, account.organizationUuid ?? null]);
-}
-function collectByLogin(items, loginOf) {
-  const groups = /* @__PURE__ */ new Map();
-  for (const item of items) {
-    const key = loginOf(item) ?? /* @__PURE__ */ Symbol("no login");
-    const group = groups.get(key);
-    if (group === void 0) {
-      groups.set(key, [item]);
-    } else {
-      group.push(item);
-    }
-  }
-  return [...groups.values()];
-}
-function groupByLogin(items, loginOf) {
-  return collectByLogin(items, loginOf).flat();
-}
-function groupSharedLogins(items, loginOf) {
-  return collectByLogin(items, loginOf).filter((group) => group.length > 1);
-}
-function describeAccountHolder(summary) {
-  const organisation = describeAccountOrganisation(summary);
-  if (summary.emailAddress === void 0) {
-    return organisation;
-  }
-  return organisation === void 0 ? summary.emailAddress : `${summary.emailAddress} (${organisation})`;
-}
-function describeIdentityAccount(summary) {
-  return [describeAccountHolder(summary), summary.organizationRole === void 0 ? void 0 : `role ${summary.organizationRole}`, describeAccountPlan(summary)].filter((part) => part !== void 0).join("; ");
-}
-
-// src/identityManager.ts
+init_identityAccounts();
+init_accountDescription();
 async function runIdentityWizard(prompts, paths, name, options = {}) {
   if (!IdentitySchema.safeParse({ name, allowAmbientCredential: false }).success) {
     throw new InvalidIdentityNameError(name);
@@ -117845,6 +117907,7 @@ function toIdentityView(paths, { entry, read }, sharesLoginWith) {
     active: entry.isActive,
     directory: import_node_path25.default.join(paths.identitiesDir, entry.name),
     ...entry.problem === void 0 ? {
+      ...entry.identity.label === void 0 ? {} : { label: entry.identity.label },
       ...entry.identity.defaultConfigProfile === void 0 ? {} : { defaultConfigProfile: entry.identity.defaultConfigProfile },
       ...entry.identity.provider === void 0 ? {} : { provider: entry.identity.provider },
       allowAmbientCredential: entry.identity.allowAmbientCredential,
@@ -117872,11 +117935,12 @@ function formatIdentityLine(entry, view) {
   if (entry.problem !== void 0) {
     return `${marker}${entry.name} [unreadable: ${entry.problem}]${account}${accountProblem}`;
   }
+  const label2 = entry.identity.label === void 0 ? "" : ` (label: ${entry.identity.label})`;
   const defaultProfile = entry.identity.defaultConfigProfile === void 0 ? "" : ` (default profile: ${entry.identity.defaultConfigProfile})`;
   const provider = entry.identity.provider === void 0 ? "" : ` (provider: ${entry.identity.provider})`;
   const ambient = entry.identity.allowAmbientCredential ? " [allows ambient credential]" : "";
   const credential = entry.identity.credential === void 0 ? "" : ` [credential ${describeCredential(entry.identity.credential)}]`;
-  return `${marker}${entry.name}${defaultProfile}${provider}${ambient}${credential}${account}${accountProblem}`;
+  return `${marker}${entry.name}${label2}${defaultProfile}${provider}${ambient}${credential}${account}${accountProblem}`;
 }
 function registerIdentityCommand(program2, deps) {
   const { paths } = deps;
@@ -117948,6 +118012,7 @@ function registerIdentityCommand(program2, deps) {
         console.log(`Unreadable: ${view.problem}`);
         return;
       }
+      console.log(`Label: ${view.label ?? "(none)"}`);
       console.log(`Default configuration profile: ${view.defaultConfigProfile ?? "(none)"}`);
       console.log(`Provider: ${view.provider ?? "(none)"}`);
       console.log(`Allows ambient credential: ${view.allowAmbientCredential === true ? "yes" : "no"}`);
@@ -117956,7 +118021,7 @@ function registerIdentityCommand(program2, deps) {
     }),
     ["agent-shim identity show work", "agent-shim identity show work --json"]
   );
-  const identitySet = identity.command("set <name>").description("Update an identity's settings.").option("--json", "Print the result as JSON.").option("--default-profile <profile>", "Configuration profile this identity uses when nothing more specific selects one.").option("--no-default-profile", "Clear this identity's default configuration profile.").option("--provider <provider>", "Provider this identity exists for: a launch on it routes through the provider unless a flag, directory rule or profile selects another, and doctor expects no stored login.").option("--no-provider", "Clear this identity's provider.").option("--allow-ambient-credential", "Allow this identity to launch even with an ambient credential env var set.").option("--no-allow-ambient-credential", "Disallow ambient credential env vars for this identity (the default).").option(
+  const identitySet = identity.command("set <name>").description("Update an identity's settings.").option("--json", "Print the result as JSON.").option("--label <text>", "Free text shown beside this identity's name in `identity list` and `show`, the launch banner and the statusline. Display only: the name stays the key.").option("--no-label", "Clear this identity's label.").option("--default-profile <profile>", "Configuration profile this identity uses when nothing more specific selects one.").option("--no-default-profile", "Clear this identity's default configuration profile.").option("--provider <provider>", "Provider this identity exists for: a launch on it routes through the provider unless a flag, directory rule or profile selects another, and doctor expects no stored login.").option("--no-provider", "Clear this identity's provider.").option("--allow-ambient-credential", "Allow this identity to launch even with an ambient credential env var set.").option("--no-allow-ambient-credential", "Disallow ambient credential env vars for this identity (the default).").option(
     "--credential <source>",
     `Authenticate this identity from a token instead of its stored login, replacing any existing sources (repeatable, in the order tried): ${CREDENTIAL_SOURCE_SYNTAX}.`,
     collectCredentialSource
@@ -117976,16 +118041,25 @@ function registerIdentityCommand(program2, deps) {
       const { json: json2, ...options } = allOptions;
       if (Object.entries(allOptions).every(([key, value2]) => key === "json" || value2 === void 0)) {
         throw new UsageError(
-          "Nothing to change: pass --default-profile, --no-default-profile, --provider, --no-provider, --allow-ambient-credential, --no-allow-ambient-credential, --credential, --no-credential, --credential-target, --anchor, --no-anchor or a --credential-cache option."
+          "Nothing to change: pass --label, --no-label, --default-profile, --no-default-profile, --provider, --no-provider, --allow-ambient-credential, --no-allow-ambient-credential, --credential, --no-credential, --credential-target, --anchor, --no-anchor or a --credential-cache option."
         );
       }
       if (!identityExists(paths, name)) {
         throw new IdentityNotFoundError(name);
       }
+      const label2 = typeof options.label === "string" ? IdentityLabelSchema.safeParse(options.label) : void 0;
+      if (label2?.success === false) {
+        throw new UsageError(`Identity label ${JSON.stringify(options.label)} ${IDENTITY_LABEL_RULE}.`);
+      }
       if (typeof options.provider === "string") {
         requireProviderExists(paths, options.provider);
       }
       const messages = [];
+      if (options.label !== void 0) {
+        const labelText = options.label === false ? void 0 : options.label;
+        setIdentityLabel(paths, name, labelText);
+        messages.push(labelText === void 0 ? `Identity "${name}" no longer has a label.` : `Identity "${name}" is now labelled ${JSON.stringify(labelText)}.`);
+      }
       if (options.defaultProfile !== void 0) {
         const profileName = options.defaultProfile === false ? void 0 : options.defaultProfile;
         if (profileName !== void 0) {
@@ -118030,6 +118104,7 @@ function registerIdentityCommand(program2, deps) {
       });
     }),
     [
+      'agent-shim identity set work --label "Example Org"',
       "agent-shim identity set work --default-profile client-acme",
       "agent-shim identity set minimax --provider minimax",
       "agent-shim identity set work --allow-ambient-credential",
@@ -123234,6 +123309,7 @@ init_realPorts();
 var import_node_fs20 = __toESM(require("node:fs"), 1);
 var import_node_path47 = __toESM(require("node:path"), 1);
 init_signIn();
+init_identityAccounts();
 init_load();
 init_unrecognisedKeys();
 init_schema();
@@ -123508,6 +123584,27 @@ init_providerAliases();
 init_providersStore();
 init_guard();
 init_identity();
+
+// src/poolSharedLogins.ts
+init_identityAccounts();
+init_identity();
+function sharedLoginMembers(members2, accountOf) {
+  const known = members2.flatMap((identity) => {
+    const account = poolNameOf(identity) === void 0 ? accountOf(identity) : void 0;
+    return account === void 0 ? [] : [{ identity, account }];
+  });
+  return groupSharedLogins(known, (entry) => loginKeyOf(entry.account)).flatMap((group) => {
+    const first = group[0];
+    return first === void 0 ? [] : [{ members: group.map((entry) => entry.identity), account: first.account }];
+  });
+}
+function describeSharedLoginMembers(poolName, shared) {
+  const summary = summariseIdentityAccount(shared.account);
+  const holder = summary === void 0 ? void 0 : describeAccountHolder(summary);
+  return `Pool "${poolName}" lists ${joinNames(shared.members)}, which hold the same login${holder === void 0 ? "" : ` (${holder})`}, so they share one quota window. A launch ranks them as one candidate and never fails over from one to another; keep one of them in the pool.`;
+}
+
+// src/doctorReport.ts
 init_extends();
 var DOCTOR_SEVERITIES = ["pass", "warn", "fail"];
 var DOCTOR_SECTIONS = [
@@ -123530,10 +123627,6 @@ var DOCTOR_SECTIONS = [
   "frontdoor",
   "models"
 ];
-function joinNames(names) {
-  const last = names.at(-1);
-  return names.length < 2 || last === void 0 ? names.join("") : `${names.slice(0, -1).join(", ")} and ${last}`;
-}
 function refinePathShadow(status, ownExecutablePath, realpath) {
   if (status.status !== "shadowed") {
     return status;
@@ -123846,6 +123939,7 @@ function runDoctor(params) {
   }
   const validatedGlobalConfig = params.globalConfig.raw === void 0 ? void 0 : validateJson(GlobalConfigSchema, params.globalConfig);
   const pools = validatedGlobalConfig?.ok === true ? validatedGlobalConfig.data.pools ?? {} : {};
+  const accountByIdentity = new Map(params.identities.flatMap((entry) => validIdentityNames.has(entry.name) && entry.account !== void 0 ? [[entry.name, entry.account]] : []));
   for (const [poolName, pool] of Object.entries(pools)) {
     const missing = pool.identities.filter((member) => poolNameOf(poolMemberIdentity(member)) === void 0 && !validIdentityNames.has(poolMemberIdentity(member)));
     const undefinedPools = pool.identities.flatMap((member) => {
@@ -123861,6 +123955,9 @@ function runDoctor(params) {
       ];
       push("pool", "fail", `Pool "${poolName}" names ${problems.join(" and ")}.`, poolName);
     }
+    for (const shared of sharedLoginMembers(pool.identities.map(poolMemberIdentity), (identityName) => accountByIdentity.get(identityName))) {
+      push("pool", "warn", describeSharedLoginMembers(poolName, shared), poolName);
+    }
   }
   const reportedCycles = /* @__PURE__ */ new Set();
   for (const poolName of Object.keys(pools).sort()) {
@@ -133188,6 +133285,7 @@ init_providersStore();
 // src/frontdoor/configSchemas.ts
 init_zod();
 init_schema();
+init_names();
 init_statusline();
 var RemovalConfirmationSchema = external_exports.boolean();
 var CredentialWriteSchema = (targets) => external_exports.strictObject({
@@ -133213,6 +133311,7 @@ var mutationOutput = (kind, action) => external_exports.strictObject({ action: e
 var storedMutationOutput = (kind, action, value2) => external_exports.strictObject({ action: external_exports.literal(action), kind: external_exports.literal(kind), name: external_exports.string(), value: value2 });
 var IdentityValueSchema = external_exports.strictObject({
   name: external_exports.string(),
+  label: external_exports.string().optional(),
   defaultConfigProfile: external_exports.string().optional(),
   provider: external_exports.string().optional(),
   allowAmbientCredential: external_exports.boolean(),
@@ -133233,6 +133332,8 @@ var ConfigNameInputSchema = external_exports.strictObject({ name: external_expor
 var ConfigIdentityAddOutputSchema = storedMutationOutput("identity", "created", IdentityValueSchema);
 var ConfigIdentitySetInputSchema = external_exports.strictObject({
   name: external_exports.string().min(1),
+  /** The identity's display label; `false` clears it. */
+  label: external_exports.union([IdentityLabelSchema, external_exports.literal(false)]).optional(),
   defaultConfigProfile: external_exports.union([external_exports.string().min(1), external_exports.literal(false)]).optional(),
   /** The provider the identity exists for; `false` clears it. */
   provider: external_exports.union([external_exports.string().min(1), external_exports.literal(false)]).optional(),
@@ -133379,6 +133480,7 @@ function identityValue(name, paths) {
   }
   return {
     name: identity.name,
+    ...identity.label === void 0 ? {} : { label: identity.label },
     ...identity.defaultConfigProfile === void 0 ? {} : { defaultConfigProfile: identity.defaultConfigProfile },
     ...identity.provider === void 0 ? {} : { provider: identity.provider },
     allowAmbientCredential: identity.allowAmbientCredential,
@@ -133413,9 +133515,9 @@ function createConfigApiRouter(deps) {
             return { action: "created", kind: "identity", name: input2.name, value: identityValue(input2.name, paths) };
           })
         ),
-        set: route("/rest/config/identity/set", "Update an identity's default profile, provider, ambient-credential setting, credential or anchors").input(ConfigIdentitySetInputSchema).output(ConfigIdentitySetOutputSchema).handler(
+        set: route("/rest/config/identity/set", "Update an identity's label, default profile, provider, ambient-credential setting, credential or anchors").input(ConfigIdentitySetInputSchema).output(ConfigIdentitySetOutputSchema).handler(
           ({ input: input2 }) => guarded(() => {
-            requireChange(input2.defaultConfigProfile !== void 0 || input2.provider !== void 0 || input2.allowAmbientCredential !== void 0 || input2.credential !== void 0 || input2.anchors !== void 0, "defaultConfigProfile, provider, allowAmbientCredential, credential or anchors");
+            requireChange(input2.label !== void 0 || input2.defaultConfigProfile !== void 0 || input2.provider !== void 0 || input2.allowAmbientCredential !== void 0 || input2.credential !== void 0 || input2.anchors !== void 0, "label, defaultConfigProfile, provider, allowAmbientCredential, credential or anchors");
             if (!identityExists(paths, input2.name)) {
               throw new IdentityNotFoundError(input2.name);
             }
@@ -133425,6 +133527,9 @@ function createConfigApiRouter(deps) {
             if (typeof input2.provider === "string") {
               requireProviderExists(paths, input2.provider);
             }
+            if (input2.label !== void 0) {
+              setIdentityLabel(paths, input2.name, input2.label === false ? void 0 : input2.label);
+            }
             if (input2.defaultConfigProfile !== void 0) {
               setDefaultConfigProfile(paths, input2.name, input2.defaultConfigProfile === false ? void 0 : input2.defaultConfigProfile);
             }
@@ -140963,6 +141068,7 @@ function enrichStatuslinePayload(params) {
   const account = clientEmail === void 0 ? params.account : void 0;
   let summary = {
     identity,
+    identityLabel: params.identityLabel,
     provider: params.env.AGENT_SHIM_PROVIDER === void 0 || params.env.AGENT_SHIM_PROVIDER === "" ? void 0 : params.env.AGENT_SHIM_PROVIDER,
     providerAccountEmail: void 0,
     providerAccountSub: void 0,
@@ -142285,7 +142391,13 @@ function headroomSegment({ summary, t: t10 }) {
 
 // src/statusline/elements/header/identity.ts
 function identitySegment({ summary }) {
-  if (summary.identity !== void 0 && summary.provider !== void 0 && summary.identity !== summary.providerAccountEmail && summary.identity !== summary.loginAccountEmail) {
+  if (summary.identity === void 0) {
+    return void 0;
+  }
+  if (summary.identityLabel !== void 0) {
+    return `${summary.identity} (${summary.identityLabel})`;
+  }
+  if (summary.provider !== void 0 && summary.identity !== summary.providerAccountEmail && summary.identity !== summary.loginAccountEmail) {
     return summary.identity;
   }
   return void 0;
@@ -145319,7 +145431,13 @@ function registerStatuslineCommand(program2, deps) {
       const identity = identityOf(process.env);
       let snapshot;
       let account;
+      let identityLabel;
       if (identity !== void 0) {
+        try {
+          identityLabel = readIdentity(deps.paths, identity)?.label;
+        } catch {
+          identityLabel = void 0;
+        }
         try {
           snapshot = readUsageSnapshot(realFarmFs, deps.paths.usageSnapshotsDir, identity);
         } catch {
@@ -145371,7 +145489,7 @@ function registerStatuslineCommand(program2, deps) {
         }
       }
       const clientPayload = parseClientPayload(payload);
-      const enrichParams = { payload, env: process.env, snapshot, account, providerName, nowMs, headroom, routedTarget, ...modelChoice === void 0 ? {} : { modelChoice } };
+      const enrichParams = { payload, env: process.env, identityLabel, snapshot, account, providerName, nowMs, headroom, routedTarget, ...modelChoice === void 0 ? {} : { modelChoice } };
       const renderer = process.env.AGENT_SHIM_STATUSLINE_CMD;
       if (renderer !== void 0 && renderer !== "") {
         const child = (0, import_node_child_process9.spawn)("/bin/sh", ["-c", renderer], { stdio: ["pipe", "inherit", "inherit"] });
@@ -156376,6 +156494,7 @@ init_schema();
 init_realPorts();
 init_candidateText();
 init_preflight();
+init_identityAccounts();
 function formatPoolPick(report, nowMs) {
   const head = report.pick === void 0 ? `Pool ${report.pool}: every member is refused right now${report.earliestReturn === void 0 ? "" : `; ${report.earliestReturn.identity} returns at ${report.earliestReturn.at} (in ${formatAge(Date.parse(report.earliestReturn.at) - nowMs)})`}` : `Pool ${report.pool}: a launch from ${report.directory} would run as ${report.pick}`;
   const rows = report.candidates.map((candidate, index) => {
@@ -156384,6 +156503,11 @@ function formatPoolPick(report, nowMs) {
   });
   return [head, ...rows, ...report.missing.map((name) => `  (skipped: ${name} is not an identity)`), ...report.stickyProblem === void 0 ? [] : [`Note: ${report.stickyProblem}; the last-pick record was ignored.`]];
 }
+function warnSharedLogins(paths, poolName, members2) {
+  for (const shared of sharedLoginMembers(members2, (identity) => readIdentityAccount(realFsPort, paths.identitiesDir, identity)?.account)) {
+    console.error(`agent-shim: warning: ${describeSharedLoginMembers(poolName, shared)}`);
+  }
+}
 function policyNotes(entry) {
   const notes = [
     ...entry?.preference === void 0 ? [] : [`preference: ${entry.preference}`],
@@ -156416,6 +156540,7 @@ function registerPoolCommand(program2, deps) {
       reportMutation(options.json, { action: "created", kind: "pool", name, value: created }, () => {
         console.log(`Created pool "${name}" with ${members2.join(", ")}.`);
       });
+      warnSharedLogins(paths, name, created.identities.map(poolMemberIdentity));
     }),
     ["agent-shim pool add subs --identity work --identity personal", "agent-shim pool add client --identity client-main --identity spare --preference listed"]
   );
@@ -156433,6 +156558,7 @@ function registerPoolCommand(program2, deps) {
       reportMutation(options.json, { action: "updated", kind: "pool", name, value: updated }, () => {
         console.log(`Pool "${name}" now has ${updated.identities.map(poolMemberIdentity).join(", ")}.`);
       });
+      warnSharedLogins(paths, name, updated.identities.map(poolMemberIdentity));
     }),
     ["agent-shim pool set subs --identity work --identity personal --identity spare", "agent-shim pool set subs --preference listed", "agent-shim pool set subs --resume-on-limit --compact-before-limit --compact-at-utilisation 85"]
   );
@@ -157481,6 +157607,7 @@ var import_node_path70 = __toESM(require("node:path"), 1);
 init_commandDeps();
 init_realPorts();
 init_account();
+init_accountDescription();
 init_signIn();
 init_resets();
 init_read();
@@ -157839,6 +157966,7 @@ function promptsIdentityPicker(prompts) {
 // src/launcher/runPicker.ts
 init_cliError();
 init_schema();
+init_identityAccounts();
 init_account();
 init_candidateText();
 init_pick();