agent-shim 11.80.0 → 11.81.0

package/README.md

@@ -85,7 +85,7 @@ agent-shim <noun> <verb> [name] [options]      # nouns: identity, profile, pool,
 agent-shim identity add <name> [--json]
 agent-shim identity list [--json]
 agent-shim identity show <name> [--json]
-agent-shim identity set <name> [--default-profile <profile> | --no-default-profile] [--provider <provider> | --no-provider] [--[no-]allow-ambient-credential] [--json]
+agent-shim identity set <name> [--label <text> | --no-label] [--default-profile <profile> | --no-default-profile] [--provider <provider> | --no-provider] [--[no-]allow-ambient-credential] [--json]
 agent-shim identity set <name> [--credential <source>]... [--credential-target <bearer|apiKey|oauthToken>] [--no-credential] [--json]
 agent-shim identity set <name> [--anchor <days>@<HH:MM>[/<zone>]]... [--no-anchor] [--json]
 agent-shim identity remove <name> [--yes] [--json]

package/dist/cli.cjs

@@ -25123,7 +25123,7 @@ function providerFilePath(directory, name, source) {
   }
   return import_node_path4.default.join(directory, `${name}.json`);
 }
-var import_node_path4, FILESYSTEM_COMPONENT_BYTES, MAX_PID_DIGITS, UUID_CHARS, ATOMIC_WRITE_OVERHEAD_BYTES, FARM_SWAP_OVERHEAD_BYTES, MAX_NAME_BYTES, FILE_NAME_PATTERN, FILE_NAME, FILE_NAME_RULE, STORED_NAME_RULE, FileNameSchema, StoredNameSchema, UnsafeNameError, InvalidProviderNameError;
+var import_node_path4, FILESYSTEM_COMPONENT_BYTES, MAX_PID_DIGITS, UUID_CHARS, ATOMIC_WRITE_OVERHEAD_BYTES, FARM_SWAP_OVERHEAD_BYTES, MAX_NAME_BYTES, FILE_NAME_PATTERN, FILE_NAME, FILE_NAME_RULE, STORED_NAME_RULE, FileNameSchema, StoredNameSchema, LABEL_FORBIDDEN, IDENTITY_LABEL_RULE, IdentityLabelSchema, UnsafeNameError, InvalidProviderNameError;
 var init_names = __esm({
   "src/config/names.ts"() {
     "use strict";
@@ -25142,6 +25142,9 @@ var init_names = __esm({
     STORED_NAME_RULE = `must be non-empty, at most ${String(MAX_NAME_BYTES)} bytes, not "." or "..", and contain no path separator or NUL`;
     FileNameSchema = external_exports.string().min(1).regex(FILE_NAME, FILE_NAME_RULE);
     StoredNameSchema = external_exports.string().min(1).max(MAX_NAME_BYTES).refine(isStoredName, STORED_NAME_RULE);
+    LABEL_FORBIDDEN = /[\p{Cc}\p{Zl}\p{Zp}]/u;
+    IDENTITY_LABEL_RULE = `must be non-empty single-line text of at most ${String(MAX_NAME_BYTES)} characters, with no control characters and no leading or trailing whitespace`;
+    IdentityLabelSchema = external_exports.string().min(1).max(MAX_NAME_BYTES).refine((label2) => label2 === label2.trim() && !LABEL_FORBIDDEN.test(label2), IDENTITY_LABEL_RULE);
     UnsafeNameError = class extends CliError {
       constructor(attemptedName, kind, rule = STORED_NAME_RULE, source) {
         super(`${source === void 0 ? "" : `${source}: `}${JSON.stringify(attemptedName)} is not a valid ${kind} name: a name ${rule}.`);
@@ -28489,6 +28492,8 @@ var init_schema = __esm({
     IdentitySchema = external_exports.strictObject({
       $schema: external_exports.string().optional(),
       name: FileNameSchema,
+      /** What the identity is for, in the person's words, drawn beside its name in `identity list` and `show`, the launch banner and the statusline. Display only: the name stays the key for lookup, paths, keychain service names and pools. */
+      label: IdentityLabelSchema.optional(),
       defaultConfigProfile: StoredNameSchema.optional(),
       /** The provider this identity exists for: a launch on the identity routes through it unless `--provider`, `--no-provider` or a cascade layer's `launch.provider` says otherwise. Its sessions run on the provider's credential, so the identity needs no stored login. */
       provider: StoredNameSchema.optional(),
@@ -38280,7 +38285,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "agent-shim",
-      version: "11.80.0",
+      version: "11.81.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -68108,9 +68113,15 @@ function movedRows(facts) {
   }
   return [];
 }
+function identityText(facts) {
+  if (facts.identity === void 0) {
+    return "(none)";
+  }
+  return facts.identityLabel === void 0 ? facts.identity : `${facts.identity} (${facts.identityLabel})`;
+}
 function decisionRows(facts) {
   return [
-    { label: "identity", value: facts.identity ?? "(none)", detail: facts.identitySource },
+    { label: "identity", value: identityText(facts), detail: facts.identitySource },
     ...facts.pool === void 0 ? [] : [
       {
         label: "pool",
@@ -70276,6 +70287,7 @@ function decideLaunch(params, readOnly) {
   return {
     parsedArgv,
     identityDecision,
+    identityLabel: loadedIdentity?.config.label,
     poolPick,
     poolRanking,
     lastRanAs,
@@ -70306,6 +70318,7 @@ function prepareLaunch(params) {
   const rows = [
     ...decisionRows({
       identity: identityDecision.name,
+      identityLabel: decided.identityLabel,
       identitySource: identityDecision.source,
       pool: poolPick,
       ranking: resolvedFlags.explain ? poolRanking : void 0,
@@ -116668,6 +116681,12 @@ function setIdentityProvider(paths, identityName, providerName) {
   }
   return applyPatch(identityJsonPath(paths, identityName), IdentitySchema, { provider: providerName });
 }
+function setIdentityLabel(paths, identityName, label2) {
+  if (!identityExists(paths, identityName)) {
+    throw new IdentityNotFoundError(identityName);
+  }
+  return applyPatch(identityJsonPath(paths, identityName), IdentitySchema, { label: label2 });
+}
 function setAllowAmbientCredential(paths, identityName, allow) {
   if (!identityExists(paths, identityName)) {
     throw new IdentityNotFoundError(identityName);
@@ -117812,6 +117831,7 @@ function registerProfileCommand(program2, deps) {
 }
 
 // src/identityManager.ts
+init_names();
 init_providersStore();
 init_identity();
 init_realPorts();
@@ -117887,6 +117907,7 @@ function toIdentityView(paths, { entry, read }, sharesLoginWith) {
     active: entry.isActive,
     directory: import_node_path25.default.join(paths.identitiesDir, entry.name),
     ...entry.problem === void 0 ? {
+      ...entry.identity.label === void 0 ? {} : { label: entry.identity.label },
       ...entry.identity.defaultConfigProfile === void 0 ? {} : { defaultConfigProfile: entry.identity.defaultConfigProfile },
       ...entry.identity.provider === void 0 ? {} : { provider: entry.identity.provider },
       allowAmbientCredential: entry.identity.allowAmbientCredential,
@@ -117914,11 +117935,12 @@ function formatIdentityLine(entry, view) {
   if (entry.problem !== void 0) {
     return `${marker}${entry.name} [unreadable: ${entry.problem}]${account}${accountProblem}`;
   }
+  const label2 = entry.identity.label === void 0 ? "" : ` (label: ${entry.identity.label})`;
   const defaultProfile = entry.identity.defaultConfigProfile === void 0 ? "" : ` (default profile: ${entry.identity.defaultConfigProfile})`;
   const provider = entry.identity.provider === void 0 ? "" : ` (provider: ${entry.identity.provider})`;
   const ambient = entry.identity.allowAmbientCredential ? " [allows ambient credential]" : "";
   const credential = entry.identity.credential === void 0 ? "" : ` [credential ${describeCredential(entry.identity.credential)}]`;
-  return `${marker}${entry.name}${defaultProfile}${provider}${ambient}${credential}${account}${accountProblem}`;
+  return `${marker}${entry.name}${label2}${defaultProfile}${provider}${ambient}${credential}${account}${accountProblem}`;
 }
 function registerIdentityCommand(program2, deps) {
   const { paths } = deps;
@@ -117990,6 +118012,7 @@ function registerIdentityCommand(program2, deps) {
         console.log(`Unreadable: ${view.problem}`);
         return;
       }
+      console.log(`Label: ${view.label ?? "(none)"}`);
       console.log(`Default configuration profile: ${view.defaultConfigProfile ?? "(none)"}`);
       console.log(`Provider: ${view.provider ?? "(none)"}`);
       console.log(`Allows ambient credential: ${view.allowAmbientCredential === true ? "yes" : "no"}`);
@@ -117998,7 +118021,7 @@ function registerIdentityCommand(program2, deps) {
     }),
     ["agent-shim identity show work", "agent-shim identity show work --json"]
   );
-  const identitySet = identity.command("set <name>").description("Update an identity's settings.").option("--json", "Print the result as JSON.").option("--default-profile <profile>", "Configuration profile this identity uses when nothing more specific selects one.").option("--no-default-profile", "Clear this identity's default configuration profile.").option("--provider <provider>", "Provider this identity exists for: a launch on it routes through the provider unless a flag, directory rule or profile selects another, and doctor expects no stored login.").option("--no-provider", "Clear this identity's provider.").option("--allow-ambient-credential", "Allow this identity to launch even with an ambient credential env var set.").option("--no-allow-ambient-credential", "Disallow ambient credential env vars for this identity (the default).").option(
+  const identitySet = identity.command("set <name>").description("Update an identity's settings.").option("--json", "Print the result as JSON.").option("--label <text>", "Free text shown beside this identity's name in `identity list` and `show`, the launch banner and the statusline. Display only: the name stays the key.").option("--no-label", "Clear this identity's label.").option("--default-profile <profile>", "Configuration profile this identity uses when nothing more specific selects one.").option("--no-default-profile", "Clear this identity's default configuration profile.").option("--provider <provider>", "Provider this identity exists for: a launch on it routes through the provider unless a flag, directory rule or profile selects another, and doctor expects no stored login.").option("--no-provider", "Clear this identity's provider.").option("--allow-ambient-credential", "Allow this identity to launch even with an ambient credential env var set.").option("--no-allow-ambient-credential", "Disallow ambient credential env vars for this identity (the default).").option(
     "--credential <source>",
     `Authenticate this identity from a token instead of its stored login, replacing any existing sources (repeatable, in the order tried): ${CREDENTIAL_SOURCE_SYNTAX}.`,
     collectCredentialSource
@@ -118018,16 +118041,25 @@ function registerIdentityCommand(program2, deps) {
       const { json: json2, ...options } = allOptions;
       if (Object.entries(allOptions).every(([key, value2]) => key === "json" || value2 === void 0)) {
         throw new UsageError(
-          "Nothing to change: pass --default-profile, --no-default-profile, --provider, --no-provider, --allow-ambient-credential, --no-allow-ambient-credential, --credential, --no-credential, --credential-target, --anchor, --no-anchor or a --credential-cache option."
+          "Nothing to change: pass --label, --no-label, --default-profile, --no-default-profile, --provider, --no-provider, --allow-ambient-credential, --no-allow-ambient-credential, --credential, --no-credential, --credential-target, --anchor, --no-anchor or a --credential-cache option."
         );
       }
       if (!identityExists(paths, name)) {
         throw new IdentityNotFoundError(name);
       }
+      const label2 = typeof options.label === "string" ? IdentityLabelSchema.safeParse(options.label) : void 0;
+      if (label2?.success === false) {
+        throw new UsageError(`Identity label ${JSON.stringify(options.label)} ${IDENTITY_LABEL_RULE}.`);
+      }
       if (typeof options.provider === "string") {
         requireProviderExists(paths, options.provider);
       }
       const messages = [];
+      if (options.label !== void 0) {
+        const labelText = options.label === false ? void 0 : options.label;
+        setIdentityLabel(paths, name, labelText);
+        messages.push(labelText === void 0 ? `Identity "${name}" no longer has a label.` : `Identity "${name}" is now labelled ${JSON.stringify(labelText)}.`);
+      }
       if (options.defaultProfile !== void 0) {
         const profileName = options.defaultProfile === false ? void 0 : options.defaultProfile;
         if (profileName !== void 0) {
@@ -118072,6 +118104,7 @@ function registerIdentityCommand(program2, deps) {
       });
     }),
     [
+      'agent-shim identity set work --label "Example Org"',
       "agent-shim identity set work --default-profile client-acme",
       "agent-shim identity set minimax --provider minimax",
       "agent-shim identity set work --allow-ambient-credential",
@@ -133252,6 +133285,7 @@ init_providersStore();
 // src/frontdoor/configSchemas.ts
 init_zod();
 init_schema();
+init_names();
 init_statusline();
 var RemovalConfirmationSchema = external_exports.boolean();
 var CredentialWriteSchema = (targets) => external_exports.strictObject({
@@ -133277,6 +133311,7 @@ var mutationOutput = (kind, action) => external_exports.strictObject({ action: e
 var storedMutationOutput = (kind, action, value2) => external_exports.strictObject({ action: external_exports.literal(action), kind: external_exports.literal(kind), name: external_exports.string(), value: value2 });
 var IdentityValueSchema = external_exports.strictObject({
   name: external_exports.string(),
+  label: external_exports.string().optional(),
   defaultConfigProfile: external_exports.string().optional(),
   provider: external_exports.string().optional(),
   allowAmbientCredential: external_exports.boolean(),
@@ -133297,6 +133332,8 @@ var ConfigNameInputSchema = external_exports.strictObject({ name: external_expor
 var ConfigIdentityAddOutputSchema = storedMutationOutput("identity", "created", IdentityValueSchema);
 var ConfigIdentitySetInputSchema = external_exports.strictObject({
   name: external_exports.string().min(1),
+  /** The identity's display label; `false` clears it. */
+  label: external_exports.union([IdentityLabelSchema, external_exports.literal(false)]).optional(),
   defaultConfigProfile: external_exports.union([external_exports.string().min(1), external_exports.literal(false)]).optional(),
   /** The provider the identity exists for; `false` clears it. */
   provider: external_exports.union([external_exports.string().min(1), external_exports.literal(false)]).optional(),
@@ -133443,6 +133480,7 @@ function identityValue(name, paths) {
   }
   return {
     name: identity.name,
+    ...identity.label === void 0 ? {} : { label: identity.label },
     ...identity.defaultConfigProfile === void 0 ? {} : { defaultConfigProfile: identity.defaultConfigProfile },
     ...identity.provider === void 0 ? {} : { provider: identity.provider },
     allowAmbientCredential: identity.allowAmbientCredential,
@@ -133477,9 +133515,9 @@ function createConfigApiRouter(deps) {
             return { action: "created", kind: "identity", name: input2.name, value: identityValue(input2.name, paths) };
           })
         ),
-        set: route("/rest/config/identity/set", "Update an identity's default profile, provider, ambient-credential setting, credential or anchors").input(ConfigIdentitySetInputSchema).output(ConfigIdentitySetOutputSchema).handler(
+        set: route("/rest/config/identity/set", "Update an identity's label, default profile, provider, ambient-credential setting, credential or anchors").input(ConfigIdentitySetInputSchema).output(ConfigIdentitySetOutputSchema).handler(
           ({ input: input2 }) => guarded(() => {
-            requireChange(input2.defaultConfigProfile !== void 0 || input2.provider !== void 0 || input2.allowAmbientCredential !== void 0 || input2.credential !== void 0 || input2.anchors !== void 0, "defaultConfigProfile, provider, allowAmbientCredential, credential or anchors");
+            requireChange(input2.label !== void 0 || input2.defaultConfigProfile !== void 0 || input2.provider !== void 0 || input2.allowAmbientCredential !== void 0 || input2.credential !== void 0 || input2.anchors !== void 0, "label, defaultConfigProfile, provider, allowAmbientCredential, credential or anchors");
             if (!identityExists(paths, input2.name)) {
               throw new IdentityNotFoundError(input2.name);
             }
@@ -133489,6 +133527,9 @@ function createConfigApiRouter(deps) {
             if (typeof input2.provider === "string") {
               requireProviderExists(paths, input2.provider);
             }
+            if (input2.label !== void 0) {
+              setIdentityLabel(paths, input2.name, input2.label === false ? void 0 : input2.label);
+            }
             if (input2.defaultConfigProfile !== void 0) {
               setDefaultConfigProfile(paths, input2.name, input2.defaultConfigProfile === false ? void 0 : input2.defaultConfigProfile);
             }
@@ -141027,6 +141068,7 @@ function enrichStatuslinePayload(params) {
   const account = clientEmail === void 0 ? params.account : void 0;
   let summary = {
     identity,
+    identityLabel: params.identityLabel,
     provider: params.env.AGENT_SHIM_PROVIDER === void 0 || params.env.AGENT_SHIM_PROVIDER === "" ? void 0 : params.env.AGENT_SHIM_PROVIDER,
     providerAccountEmail: void 0,
     providerAccountSub: void 0,
@@ -142349,7 +142391,13 @@ function headroomSegment({ summary, t: t10 }) {
 
 // src/statusline/elements/header/identity.ts
 function identitySegment({ summary }) {
-  if (summary.identity !== void 0 && summary.provider !== void 0 && summary.identity !== summary.providerAccountEmail && summary.identity !== summary.loginAccountEmail) {
+  if (summary.identity === void 0) {
+    return void 0;
+  }
+  if (summary.identityLabel !== void 0) {
+    return `${summary.identity} (${summary.identityLabel})`;
+  }
+  if (summary.provider !== void 0 && summary.identity !== summary.providerAccountEmail && summary.identity !== summary.loginAccountEmail) {
     return summary.identity;
   }
   return void 0;
@@ -145383,7 +145431,13 @@ function registerStatuslineCommand(program2, deps) {
       const identity = identityOf(process.env);
       let snapshot;
       let account;
+      let identityLabel;
       if (identity !== void 0) {
+        try {
+          identityLabel = readIdentity(deps.paths, identity)?.label;
+        } catch {
+          identityLabel = void 0;
+        }
         try {
           snapshot = readUsageSnapshot(realFarmFs, deps.paths.usageSnapshotsDir, identity);
         } catch {
@@ -145435,7 +145489,7 @@ function registerStatuslineCommand(program2, deps) {
         }
       }
       const clientPayload = parseClientPayload(payload);
-      const enrichParams = { payload, env: process.env, snapshot, account, providerName, nowMs, headroom, routedTarget, ...modelChoice === void 0 ? {} : { modelChoice } };
+      const enrichParams = { payload, env: process.env, identityLabel, snapshot, account, providerName, nowMs, headroom, routedTarget, ...modelChoice === void 0 ? {} : { modelChoice } };
       const renderer = process.env.AGENT_SHIM_STATUSLINE_CMD;
       if (renderer !== void 0 && renderer !== "") {
         const child = (0, import_node_child_process9.spawn)("/bin/sh", ["-c", renderer], { stdio: ["pipe", "inherit", "inherit"] });

package/dist/index.cjs

@@ -183,7 +183,7 @@ function providerFilePath(directory, name, source) {
   }
   return import_node_path.default.join(directory, `${name}.json`);
 }
-var import_node_path, import_zod, FILESYSTEM_COMPONENT_BYTES, MAX_PID_DIGITS, UUID_CHARS, ATOMIC_WRITE_OVERHEAD_BYTES, FARM_SWAP_OVERHEAD_BYTES, MAX_NAME_BYTES, FILE_NAME_PATTERN, FILE_NAME, FILE_NAME_RULE, STORED_NAME_RULE, FileNameSchema, StoredNameSchema, UnsafeNameError, InvalidProviderNameError;
+var import_node_path, import_zod, FILESYSTEM_COMPONENT_BYTES, MAX_PID_DIGITS, UUID_CHARS, ATOMIC_WRITE_OVERHEAD_BYTES, FARM_SWAP_OVERHEAD_BYTES, MAX_NAME_BYTES, FILE_NAME_PATTERN, FILE_NAME, FILE_NAME_RULE, STORED_NAME_RULE, FileNameSchema, StoredNameSchema, LABEL_FORBIDDEN, IDENTITY_LABEL_RULE, IdentityLabelSchema, UnsafeNameError, InvalidProviderNameError;
 var init_names = __esm({
   "src/config/names.ts"() {
     "use strict";
@@ -202,6 +202,9 @@ var init_names = __esm({
     STORED_NAME_RULE = `must be non-empty, at most ${String(MAX_NAME_BYTES)} bytes, not "." or "..", and contain no path separator or NUL`;
     FileNameSchema = import_zod.z.string().min(1).regex(FILE_NAME, FILE_NAME_RULE);
     StoredNameSchema = import_zod.z.string().min(1).max(MAX_NAME_BYTES).refine(isStoredName, STORED_NAME_RULE);
+    LABEL_FORBIDDEN = /[\p{Cc}\p{Zl}\p{Zp}]/u;
+    IDENTITY_LABEL_RULE = `must be non-empty single-line text of at most ${String(MAX_NAME_BYTES)} characters, with no control characters and no leading or trailing whitespace`;
+    IdentityLabelSchema = import_zod.z.string().min(1).max(MAX_NAME_BYTES).refine((label) => label === label.trim() && !LABEL_FORBIDDEN.test(label), IDENTITY_LABEL_RULE);
     UnsafeNameError = class extends CliError {
       constructor(attemptedName, kind, rule = STORED_NAME_RULE, source) {
         super(`${source === void 0 ? "" : `${source}: `}${JSON.stringify(attemptedName)} is not a valid ${kind} name: a name ${rule}.`);
@@ -1228,6 +1231,8 @@ var init_schema = __esm({
     IdentitySchema = import_zod3.z.strictObject({
       $schema: import_zod3.z.string().optional(),
       name: FileNameSchema,
+      /** What the identity is for, in the person's words, drawn beside its name in `identity list` and `show`, the launch banner and the statusline. Display only: the name stays the key for lookup, paths, keychain service names and pools. */
+      label: IdentityLabelSchema.optional(),
       defaultConfigProfile: StoredNameSchema.optional(),
       /** The provider this identity exists for: a launch on the identity routes through it unless `--provider`, `--no-provider` or a cascade layer's `launch.provider` says otherwise. Its sessions run on the provider's credential, so the identity needs no stored login. */
       provider: StoredNameSchema.optional(),
@@ -4764,7 +4769,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "agent-shim",
-      version: "11.80.0",
+      version: "11.81.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -11594,9 +11599,15 @@ function movedRows(facts) {
   }
   return [];
 }
+function identityText(facts) {
+  if (facts.identity === void 0) {
+    return "(none)";
+  }
+  return facts.identityLabel === void 0 ? facts.identity : `${facts.identity} (${facts.identityLabel})`;
+}
 function decisionRows(facts) {
   return [
-    { label: "identity", value: facts.identity ?? "(none)", detail: facts.identitySource },
+    { label: "identity", value: identityText(facts), detail: facts.identitySource },
     ...facts.pool === void 0 ? [] : [
       {
         label: "pool",
@@ -12122,6 +12133,7 @@ function decideLaunch(params, readOnly) {
   return {
     parsedArgv,
     identityDecision,
+    identityLabel: loadedIdentity?.config.label,
     poolPick,
     poolRanking,
     lastRanAs,
@@ -12152,6 +12164,7 @@ function prepareLaunch(params) {
   const rows = [
     ...decisionRows({
       identity: identityDecision.name,
+      identityLabel: decided.identityLabel,
       identitySource: identityDecision.source,
       pool: poolPick,
       ranking: resolvedFlags.explain ? poolRanking : void 0,
@@ -17137,6 +17150,12 @@ function setIdentityProvider(paths, identityName, providerName) {
   }
   return applyPatch(identityJsonPath(paths, identityName), IdentitySchema, { provider: providerName });
 }
+function setIdentityLabel(paths, identityName, label) {
+  if (!identityExists(paths, identityName)) {
+    throw new IdentityNotFoundError(identityName);
+  }
+  return applyPatch(identityJsonPath(paths, identityName), IdentitySchema, { label });
+}
 function setAllowAmbientCredential(paths, identityName, allow) {
   if (!identityExists(paths, identityName)) {
     throw new IdentityNotFoundError(identityName);
@@ -18531,6 +18550,7 @@ init_providersStore();
 // src/frontdoor/configSchemas.ts
 var import_zod30 = require("zod");
 init_schema();
+init_names();
 init_statusline();
 var RemovalConfirmationSchema = import_zod30.z.boolean();
 var CredentialWriteSchema = (targets) => import_zod30.z.strictObject({
@@ -18556,6 +18576,7 @@ var mutationOutput = (kind, action) => import_zod30.z.strictObject({ action: imp
 var storedMutationOutput = (kind, action, value) => import_zod30.z.strictObject({ action: import_zod30.z.literal(action), kind: import_zod30.z.literal(kind), name: import_zod30.z.string(), value });
 var IdentityValueSchema = import_zod30.z.strictObject({
   name: import_zod30.z.string(),
+  label: import_zod30.z.string().optional(),
   defaultConfigProfile: import_zod30.z.string().optional(),
   provider: import_zod30.z.string().optional(),
   allowAmbientCredential: import_zod30.z.boolean(),
@@ -18576,6 +18597,8 @@ var ConfigNameInputSchema = import_zod30.z.strictObject({ name: import_zod30.z.s
 var ConfigIdentityAddOutputSchema = storedMutationOutput("identity", "created", IdentityValueSchema);
 var ConfigIdentitySetInputSchema = import_zod30.z.strictObject({
   name: import_zod30.z.string().min(1),
+  /** The identity's display label; `false` clears it. */
+  label: import_zod30.z.union([IdentityLabelSchema, import_zod30.z.literal(false)]).optional(),
   defaultConfigProfile: import_zod30.z.union([import_zod30.z.string().min(1), import_zod30.z.literal(false)]).optional(),
   /** The provider the identity exists for; `false` clears it. */
   provider: import_zod30.z.union([import_zod30.z.string().min(1), import_zod30.z.literal(false)]).optional(),
@@ -18722,6 +18745,7 @@ function identityValue(name, paths) {
   }
   return {
     name: identity.name,
+    ...identity.label === void 0 ? {} : { label: identity.label },
     ...identity.defaultConfigProfile === void 0 ? {} : { defaultConfigProfile: identity.defaultConfigProfile },
     ...identity.provider === void 0 ? {} : { provider: identity.provider },
     allowAmbientCredential: identity.allowAmbientCredential,
@@ -18756,9 +18780,9 @@ function createConfigApiRouter(deps) {
             return { action: "created", kind: "identity", name: input.name, value: identityValue(input.name, paths) };
           })
         ),
-        set: route("/rest/config/identity/set", "Update an identity's default profile, provider, ambient-credential setting, credential or anchors").input(ConfigIdentitySetInputSchema).output(ConfigIdentitySetOutputSchema).handler(
+        set: route("/rest/config/identity/set", "Update an identity's label, default profile, provider, ambient-credential setting, credential or anchors").input(ConfigIdentitySetInputSchema).output(ConfigIdentitySetOutputSchema).handler(
           ({ input }) => guarded(() => {
-            requireChange(input.defaultConfigProfile !== void 0 || input.provider !== void 0 || input.allowAmbientCredential !== void 0 || input.credential !== void 0 || input.anchors !== void 0, "defaultConfigProfile, provider, allowAmbientCredential, credential or anchors");
+            requireChange(input.label !== void 0 || input.defaultConfigProfile !== void 0 || input.provider !== void 0 || input.allowAmbientCredential !== void 0 || input.credential !== void 0 || input.anchors !== void 0, "label, defaultConfigProfile, provider, allowAmbientCredential, credential or anchors");
             if (!identityExists(paths, input.name)) {
               throw new IdentityNotFoundError(input.name);
             }
@@ -18768,6 +18792,9 @@ function createConfigApiRouter(deps) {
             if (typeof input.provider === "string") {
               requireProviderExists(paths, input.provider);
             }
+            if (input.label !== void 0) {
+              setIdentityLabel(paths, input.name, input.label === false ? void 0 : input.label);
+            }
             if (input.defaultConfigProfile !== void 0) {
               setDefaultConfigProfile(paths, input.name, input.defaultConfigProfile === false ? void 0 : input.defaultConfigProfile);
             }

package/dist/index.mjs

@@ -163,7 +163,7 @@ function providerFilePath(directory, name, source) {
   }
   return path.join(directory, `${name}.json`);
 }
-var FILESYSTEM_COMPONENT_BYTES, MAX_PID_DIGITS, UUID_CHARS, ATOMIC_WRITE_OVERHEAD_BYTES, FARM_SWAP_OVERHEAD_BYTES, MAX_NAME_BYTES, FILE_NAME_PATTERN, FILE_NAME, FILE_NAME_RULE, STORED_NAME_RULE, FileNameSchema, StoredNameSchema, UnsafeNameError, InvalidProviderNameError;
+var FILESYSTEM_COMPONENT_BYTES, MAX_PID_DIGITS, UUID_CHARS, ATOMIC_WRITE_OVERHEAD_BYTES, FARM_SWAP_OVERHEAD_BYTES, MAX_NAME_BYTES, FILE_NAME_PATTERN, FILE_NAME, FILE_NAME_RULE, STORED_NAME_RULE, FileNameSchema, StoredNameSchema, LABEL_FORBIDDEN, IDENTITY_LABEL_RULE, IdentityLabelSchema, UnsafeNameError, InvalidProviderNameError;
 var init_names = __esm({
   "src/config/names.ts"() {
     "use strict";
@@ -180,6 +180,9 @@ var init_names = __esm({
     STORED_NAME_RULE = `must be non-empty, at most ${String(MAX_NAME_BYTES)} bytes, not "." or "..", and contain no path separator or NUL`;
     FileNameSchema = z.string().min(1).regex(FILE_NAME, FILE_NAME_RULE);
     StoredNameSchema = z.string().min(1).max(MAX_NAME_BYTES).refine(isStoredName, STORED_NAME_RULE);
+    LABEL_FORBIDDEN = /[\p{Cc}\p{Zl}\p{Zp}]/u;
+    IDENTITY_LABEL_RULE = `must be non-empty single-line text of at most ${String(MAX_NAME_BYTES)} characters, with no control characters and no leading or trailing whitespace`;
+    IdentityLabelSchema = z.string().min(1).max(MAX_NAME_BYTES).refine((label) => label === label.trim() && !LABEL_FORBIDDEN.test(label), IDENTITY_LABEL_RULE);
     UnsafeNameError = class extends CliError {
       constructor(attemptedName, kind, rule = STORED_NAME_RULE, source) {
         super(`${source === void 0 ? "" : `${source}: `}${JSON.stringify(attemptedName)} is not a valid ${kind} name: a name ${rule}.`);
@@ -1206,6 +1209,8 @@ var init_schema = __esm({
     IdentitySchema = z3.strictObject({
       $schema: z3.string().optional(),
       name: FileNameSchema,
+      /** What the identity is for, in the person's words, drawn beside its name in `identity list` and `show`, the launch banner and the statusline. Display only: the name stays the key for lookup, paths, keychain service names and pools. */
+      label: IdentityLabelSchema.optional(),
       defaultConfigProfile: StoredNameSchema.optional(),
       /** The provider this identity exists for: a launch on the identity routes through it unless `--provider`, `--no-provider` or a cascade layer's `launch.provider` says otherwise. Its sessions run on the provider's credential, so the identity needs no stored login. */
       provider: StoredNameSchema.optional(),
@@ -4740,7 +4745,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "agent-shim",
-      version: "11.80.0",
+      version: "11.81.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -11566,9 +11571,15 @@ function movedRows(facts) {
   }
   return [];
 }
+function identityText(facts) {
+  if (facts.identity === void 0) {
+    return "(none)";
+  }
+  return facts.identityLabel === void 0 ? facts.identity : `${facts.identity} (${facts.identityLabel})`;
+}
 function decisionRows(facts) {
   return [
-    { label: "identity", value: facts.identity ?? "(none)", detail: facts.identitySource },
+    { label: "identity", value: identityText(facts), detail: facts.identitySource },
     ...facts.pool === void 0 ? [] : [
       {
         label: "pool",
@@ -12097,6 +12108,7 @@ function decideLaunch(params, readOnly) {
   return {
     parsedArgv,
     identityDecision,
+    identityLabel: loadedIdentity?.config.label,
     poolPick,
     poolRanking,
     lastRanAs,
@@ -12127,6 +12139,7 @@ function prepareLaunch(params) {
   const rows = [
     ...decisionRows({
       identity: identityDecision.name,
+      identityLabel: decided.identityLabel,
       identitySource: identityDecision.source,
       pool: poolPick,
       ranking: resolvedFlags.explain ? poolRanking : void 0,
@@ -16722,6 +16735,12 @@ function setIdentityProvider(paths, identityName, providerName) {
   }
   return applyPatch(identityJsonPath(paths, identityName), IdentitySchema, { provider: providerName });
 }
+function setIdentityLabel(paths, identityName, label) {
+  if (!identityExists(paths, identityName)) {
+    throw new IdentityNotFoundError(identityName);
+  }
+  return applyPatch(identityJsonPath(paths, identityName), IdentitySchema, { label });
+}
 function setAllowAmbientCredential(paths, identityName, allow) {
   if (!identityExists(paths, identityName)) {
     throw new IdentityNotFoundError(identityName);
@@ -18115,6 +18134,7 @@ init_providersStore();
 
 // src/frontdoor/configSchemas.ts
 init_schema();
+init_names();
 init_statusline();
 import { z as z30 } from "zod";
 var RemovalConfirmationSchema = z30.boolean();
@@ -18141,6 +18161,7 @@ var mutationOutput = (kind, action) => z30.strictObject({ action: z30.literal(ac
 var storedMutationOutput = (kind, action, value) => z30.strictObject({ action: z30.literal(action), kind: z30.literal(kind), name: z30.string(), value });
 var IdentityValueSchema = z30.strictObject({
   name: z30.string(),
+  label: z30.string().optional(),
   defaultConfigProfile: z30.string().optional(),
   provider: z30.string().optional(),
   allowAmbientCredential: z30.boolean(),
@@ -18161,6 +18182,8 @@ var ConfigNameInputSchema = z30.strictObject({ name: z30.string().min(1) });
 var ConfigIdentityAddOutputSchema = storedMutationOutput("identity", "created", IdentityValueSchema);
 var ConfigIdentitySetInputSchema = z30.strictObject({
   name: z30.string().min(1),
+  /** The identity's display label; `false` clears it. */
+  label: z30.union([IdentityLabelSchema, z30.literal(false)]).optional(),
   defaultConfigProfile: z30.union([z30.string().min(1), z30.literal(false)]).optional(),
   /** The provider the identity exists for; `false` clears it. */
   provider: z30.union([z30.string().min(1), z30.literal(false)]).optional(),
@@ -18307,6 +18330,7 @@ function identityValue(name, paths) {
   }
   return {
     name: identity.name,
+    ...identity.label === void 0 ? {} : { label: identity.label },
     ...identity.defaultConfigProfile === void 0 ? {} : { defaultConfigProfile: identity.defaultConfigProfile },
     ...identity.provider === void 0 ? {} : { provider: identity.provider },
     allowAmbientCredential: identity.allowAmbientCredential,
@@ -18341,9 +18365,9 @@ function createConfigApiRouter(deps) {
             return { action: "created", kind: "identity", name: input.name, value: identityValue(input.name, paths) };
           })
         ),
-        set: route("/rest/config/identity/set", "Update an identity's default profile, provider, ambient-credential setting, credential or anchors").input(ConfigIdentitySetInputSchema).output(ConfigIdentitySetOutputSchema).handler(
+        set: route("/rest/config/identity/set", "Update an identity's label, default profile, provider, ambient-credential setting, credential or anchors").input(ConfigIdentitySetInputSchema).output(ConfigIdentitySetOutputSchema).handler(
           ({ input }) => guarded(() => {
-            requireChange(input.defaultConfigProfile !== void 0 || input.provider !== void 0 || input.allowAmbientCredential !== void 0 || input.credential !== void 0 || input.anchors !== void 0, "defaultConfigProfile, provider, allowAmbientCredential, credential or anchors");
+            requireChange(input.label !== void 0 || input.defaultConfigProfile !== void 0 || input.provider !== void 0 || input.allowAmbientCredential !== void 0 || input.credential !== void 0 || input.anchors !== void 0, "label, defaultConfigProfile, provider, allowAmbientCredential, credential or anchors");
             if (!identityExists(paths, input.name)) {
               throw new IdentityNotFoundError(input.name);
             }
@@ -18353,6 +18377,9 @@ function createConfigApiRouter(deps) {
             if (typeof input.provider === "string") {
               requireProviderExists(paths, input.provider);
             }
+            if (input.label !== void 0) {
+              setIdentityLabel(paths, input.name, input.label === false ? void 0 : input.label);
+            }
             if (input.defaultConfigProfile !== void 0) {
               setDefaultConfigProfile(paths, input.name, input.defaultConfigProfile === false ? void 0 : input.defaultConfigProfile);
             }

package/dist/types/index.d.ts

@@ -5412,6 +5412,7 @@ type GlobalConfig = z.infer<typeof GlobalConfigSchema>;
 declare const IdentitySchema: z.ZodObject<{
     $schema: z.ZodOptional<z.ZodString>;
     name: z.ZodString;
+    label: z.ZodOptional<z.ZodString>;
     defaultConfigProfile: z.ZodOptional<z.ZodString>;
     provider: z.ZodOptional<z.ZodString>;
     allowAmbientCredential: z.ZodDefault<z.ZodBoolean>;
@@ -9476,6 +9477,7 @@ declare function createConfigApiRouter(deps: ConfigApiDeps): {
                 name: zod.ZodString;
                 value: zod.ZodObject<{
                     name: zod.ZodString;
+                    label: zod.ZodOptional<zod.ZodString>;
                     defaultConfigProfile: zod.ZodOptional<zod.ZodString>;
                     provider: zod.ZodOptional<zod.ZodString>;
                     allowAmbientCredential: zod.ZodBoolean;
@@ -9529,6 +9531,7 @@ declare function createConfigApiRouter(deps: ConfigApiDeps): {
             }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
             set: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
                 name: zod.ZodString;
+                label: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodString, zod.ZodLiteral<false>]>>;
                 defaultConfigProfile: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodString, zod.ZodLiteral<false>]>>;
                 provider: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodString, zod.ZodLiteral<false>]>>;
                 allowAmbientCredential: zod.ZodOptional<zod.ZodBoolean>;
@@ -9583,6 +9586,7 @@ declare function createConfigApiRouter(deps: ConfigApiDeps): {
                 name: zod.ZodString;
                 value: zod.ZodObject<{
                     name: zod.ZodString;
+                    label: zod.ZodOptional<zod.ZodString>;
                     defaultConfigProfile: zod.ZodOptional<zod.ZodString>;
                     provider: zod.ZodOptional<zod.ZodString>;
                     allowAmbientCredential: zod.ZodBoolean;
@@ -16548,6 +16552,7 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                 name: zod.ZodString;
                 value: zod.ZodObject<{
                     name: zod.ZodString;
+                    label: zod.ZodOptional<zod.ZodString>;
                     defaultConfigProfile: zod.ZodOptional<zod.ZodString>;
                     provider: zod.ZodOptional<zod.ZodString>;
                     allowAmbientCredential: zod.ZodBoolean;
@@ -16601,6 +16606,7 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
             }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
             set: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
                 name: zod.ZodString;
+                label: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodString, zod.ZodLiteral<false>]>>;
                 defaultConfigProfile: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodString, zod.ZodLiteral<false>]>>;
                 provider: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodString, zod.ZodLiteral<false>]>>;
                 allowAmbientCredential: zod.ZodOptional<zod.ZodBoolean>;
@@ -16655,6 +16661,7 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                 name: zod.ZodString;
                 value: zod.ZodObject<{
                     name: zod.ZodString;
+                    label: zod.ZodOptional<zod.ZodString>;
                     defaultConfigProfile: zod.ZodOptional<zod.ZodString>;
                     provider: zod.ZodOptional<zod.ZodString>;
                     allowAmbientCredential: zod.ZodBoolean;
@@ -21074,6 +21081,7 @@ declare const ConfigIdentityAddOutputSchema: z.ZodObject<{
     name: z.ZodString;
     value: z.ZodObject<{
         name: z.ZodString;
+        label: z.ZodOptional<z.ZodString>;
         defaultConfigProfile: z.ZodOptional<z.ZodString>;
         provider: z.ZodOptional<z.ZodString>;
         allowAmbientCredential: z.ZodBoolean;
@@ -21128,6 +21136,7 @@ declare const ConfigIdentityAddOutputSchema: z.ZodObject<{
 /** `defaultConfigProfile: false` clears it; `credential: false` removes the credential block, returning the identity to its stored login. At least one field must be present. */
 declare const ConfigIdentitySetInputSchema: z.ZodObject<{
     name: z.ZodString;
+    label: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodLiteral<false>]>>;
     defaultConfigProfile: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodLiteral<false>]>>;
     provider: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodLiteral<false>]>>;
     allowAmbientCredential: z.ZodOptional<z.ZodBoolean>;
@@ -21183,6 +21192,7 @@ declare const ConfigIdentitySetOutputSchema: z.ZodObject<{
     name: z.ZodString;
     value: z.ZodObject<{
         name: z.ZodString;
+        label: z.ZodOptional<z.ZodString>;
         defaultConfigProfile: z.ZodOptional<z.ZodString>;
         provider: z.ZodOptional<z.ZodString>;
         allowAmbientCredential: z.ZodBoolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-shim",
-  "version": "11.80.0",
+  "version": "11.81.0",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",