npm - agent-shim - Versions diffs - 11.86.4 → 11.87.0 - Mend

agent-shim 11.86.4 → 11.87.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (6) hide show

package/dist/index.mjs CHANGED Viewed

@@ -1212,6 +1212,8 @@ var init_schema = __esm({
       jobs: z3.record(PoolNameSchema, JobSchema).optional()
     });
     IdentitySchema = z3.strictObject({
+      /** The CLI this login belongs to; absent means Claude Code for backwards compatibility. */
+      agent: z3.enum(["claude", "codex"]).optional(),
       $schema: z3.string().optional(),
       name: FileNameSchema,
       /** What the identity is for, in the person's words, drawn beside its name in `identity list` and `show`, the launch banner and the statusline. Display only: the name stays the key for lookup and for the references to the identity (pools, rules, jobs, model refs), and the id for paths and Keychain service names. */
@@ -1283,7 +1285,7 @@ function parseIgnoringUnrecognisedKeys(schema, raw) {
   return second.success ? { success: true, data: second.data, ignored } : { success: false, issues: second.error.issues };
 }
 function describeIgnoredKeys(filePath, ignored) {
-  const places = ignored.map(({ path: path53, keys }) => `${path53.length === 0 ? "" : `${path53.map(String).join(".")}.`}${keys.join(", ")}`);
+  const places = ignored.map(({ path: path54, keys }) => `${path54.length === 0 ? "" : `${path54.map(String).join(".")}.`}${keys.join(", ")}`);
   return `${filePath} has settings this version of agent-shim does not know and ignores: ${places.join("; ")}. A newer release may read them.`;
 }
 function noteIgnoredKeys(filePath, ignored) {
@@ -1305,9 +1307,9 @@ function restoreIgnoredKeys(filePath, value) {
     return value;
   }
   const restored = structuredClone(value);
-  for (const { path: path53, values } of ignored) {
+  for (const { path: path54, values } of ignored) {
     let holder = restored;
-    for (const step of path53) {
+    for (const step of path54) {
       holder = isRecord(holder) ? holder[step] : void 0;
     }
     if (isRecord(holder)) {
@@ -4701,8 +4703,8 @@ function parseConnectTarget(authority) {
 function isInterceptedHost(host, interceptHosts) {
   return interceptHosts.includes(host);
 }
-function servedByPipeline(path53) {
-  return path53?.startsWith(ROUTED_PATH_PREFIX) === true;
+function servedByPipeline(path54) {
+  return path54?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 function forwardableHeaders(headers) {
   const connectionTokens = new Set(
@@ -5146,7 +5148,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "agent-shim",
-      version: "11.86.4",
+      version: "11.87.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -6972,19 +6974,68 @@ var init_realPorts = __esm({
   }
 });
+// src/cli/bool.ts
+function parseBoolWord(input) {
+  switch (input) {
+    case "true":
+    case "1":
+      return true;
+    case "false":
+    case "0":
+      return false;
+    default:
+      return void 0;
+  }
+}
+var init_bool = __esm({
+  "src/cli/bool.ts"() {
+    "use strict";
+  }
+});
+// src/cli/envBool.ts
+function parseEnvBool(variable, value) {
+  if (value === void 0 || value === "") {
+    return void 0;
+  }
+  const parsed = parseBoolWord(value);
+  if (parsed === void 0) {
+    throw new InvalidEnvBoolError(variable, value);
+  }
+  return parsed;
+}
+var InvalidEnvBoolError;
+var init_envBool = __esm({
+  "src/cli/envBool.ts"() {
+    "use strict";
+    init_cliError();
+    init_bool();
+    InvalidEnvBoolError = class extends UsageError {
+      constructor(variable, value) {
+        super(`${variable} must be one of true, false, 1 or 0, got "${value}".`);
+        this.variable = variable;
+        this.value = value;
+        this.name = "InvalidEnvBoolError";
+      }
+      variable;
+      value;
+    };
+  }
+});
 // src/pathNorm.ts
-import path20 from "node:path";
+import path21 from "node:path";
 function expandTilde(value, home) {
   if (value === "~") {
     return home;
   }
   if (value.startsWith("~/")) {
-    return path20.join(home, value.slice(2));
+    return path21.join(home, value.slice(2));
   }
   return value;
 }
 function normaliseRulePath(rulePath, home) {
-  return path20.resolve(expandTilde(rulePath, home));
+  return path21.resolve(expandTilde(rulePath, home));
 }
 var init_pathNorm = __esm({
   "src/pathNorm.ts"() {
@@ -6993,7 +7044,7 @@ var init_pathNorm = __esm({
 });
 // src/launcher/cascade.ts
-import path21 from "node:path";
+import path22 from "node:path";
 function loadCascadeInput(params) {
   const globalConfig = loadConfigFile(params.paths.globalConfigFile, GlobalConfigSchema, params.read);
   const directoryRules = loadConfigFile(params.paths.directoryRulesFile, DirectoryRulesSchema, params.read);
@@ -7013,8 +7064,8 @@ function loadCascadeInput(params) {
   });
   const levels = [];
   for (const dir of dirs) {
-    const portable = loadConfigFile(path21.join(dir, PORTABLE_CONFIG_FILENAME), PortableConfigSchema, params.read) ?? loadConfigFile(path21.join(dir, LEGACY_PORTABLE_CONFIG_FILENAME), PortableConfigSchema, params.read);
-    const portableLocal = loadConfigFile(path21.join(dir, PORTABLE_LOCAL_CONFIG_FILENAME), PortableConfigSchema, params.read) ?? loadConfigFile(path21.join(dir, LEGACY_PORTABLE_LOCAL_CONFIG_FILENAME), PortableConfigSchema, params.read);
+    const portable = loadConfigFile(path22.join(dir, PORTABLE_CONFIG_FILENAME), PortableConfigSchema, params.read) ?? loadConfigFile(path22.join(dir, LEGACY_PORTABLE_CONFIG_FILENAME), PortableConfigSchema, params.read);
+    const portableLocal = loadConfigFile(path22.join(dir, PORTABLE_LOCAL_CONFIG_FILENAME), PortableConfigSchema, params.read) ?? loadConfigFile(path22.join(dir, LEGACY_PORTABLE_LOCAL_CONFIG_FILENAME), PortableConfigSchema, params.read);
     const rules = (directoryRules?.config.rules ?? []).map((rule, index) => ({ rule, index })).filter(({ rule }) => normaliseRulePath(rule.path, params.home) === dir).map(({ rule, index }) => {
       const entryOrder = directoryRules?.ruleEntryOrders[index];
       return {
@@ -7077,7 +7128,7 @@ var init_cascade = __esm({
 });
 // src/launcher/identity.ts
-import path22 from "node:path";
+import path23 from "node:path";
 function poolNameOf(selector) {
   return selector.startsWith(POOL_SELECTOR_PREFIX) ? selector.slice(POOL_SELECTOR_PREFIX.length) : void 0;
 }
@@ -7166,7 +7217,7 @@ function loadIdentity(identitiesDir, name, fs17) {
     throw new UnsafeNameError(name, "identity", FILE_NAME_RULE);
   }
   const id = resolveIdentityId(identitiesDir, name, fs17);
-  return id === void 0 ? void 0 : loadConfigFile(path22.join(identitiesDir, id, "identity.json"), IdentitySchema, fs17.readConfigFile);
+  return id === void 0 ? void 0 : loadConfigFile(path23.join(identitiesDir, id, "identity.json"), IdentitySchema, fs17.readConfigFile);
 }
 var IDENTITY_DECISION_SOURCES, IDENTITY_SOURCE_LABELS, CONFIG_PROFILE_DECISION_SOURCES;
 var init_identity = __esm({
@@ -7412,7 +7463,7 @@ var init_schema2 = __esm({
 });
 // src/usage/account.ts
-import path23 from "node:path";
+import path24 from "node:path";
 function isObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -7431,7 +7482,7 @@ function requireIdentityDirectoryId(id) {
   }
 }
 function claudeJsonPath(identitiesDir, identity) {
-  return path23.join(identitiesDir, identity, CLAUDE_JSON);
+  return path24.join(identitiesDir, identity, CLAUDE_JSON);
 }
 function readAccountMetadata(fs17, identitiesDir, identity) {
   requireIdentityDirectoryId(identity);
@@ -8157,7 +8208,7 @@ var init_pick = __esm({
 });
 // src/usage/read.ts
-import path24 from "node:path";
+import path25 from "node:path";
 function segmentDay(epochMs) {
   return new Date(epochMs).toISOString().slice(0, "YYYY-MM-DD".length);
 }
@@ -8197,7 +8248,7 @@ function readUsageLog(fs17, logDir, options = {}) {
   return { records, invalidLines };
 }
 function readSegment(fs17, logDir, segment) {
-  const contents = fs17.readFileUtf8(path24.join(logDir, segment.name));
+  const contents = fs17.readFileUtf8(path25.join(logDir, segment.name));
   if (contents === void 0) {
     return void 0;
   }
@@ -8227,7 +8278,7 @@ function readSegment(fs17, logDir, segment) {
 }
 function snapshotPath(snapshotsDir, identity) {
   requireIdentityDirectoryId(identity);
-  return path24.join(snapshotsDir, `${identity}.json`);
+  return path25.join(snapshotsDir, `${identity}.json`);
 }
 function readUsageSnapshot(fs17, snapshotsDir, identity) {
   const file = snapshotPath(snapshotsDir, identity);
@@ -8280,12 +8331,12 @@ var init_read = __esm({
 });
 // src/usage/store.ts
-import path25 from "node:path";
+import path26 from "node:path";
 function pruneUsageLog(fs17, logDir, nowMs) {
   const cutoff = nowMs - USAGE_RETENTION_MS;
   for (const segment of listLogSegments(fs17, logDir)) {
     if (segment.endsAt <= cutoff) {
-      fs17.removeRecursive(path25.join(logDir, segment.name));
+      fs17.removeRecursive(path26.join(logDir, segment.name));
     }
   }
 }
@@ -8367,7 +8418,7 @@ function createUsageStore(deps) {
         pruneUsageLog(fs17, paths.usageLogDir, nowMs);
         prunedDay = day;
       }
-      fs17.appendFilePrivate(path25.join(paths.usageLogDir, segmentName(day, deps.pid)), `${JSON.stringify(record)}
+      fs17.appendFilePrivate(path26.join(paths.usageLogDir, segmentName(day, deps.pid)), `${JSON.stringify(record)}
 `);
       deps.onRecord?.(record);
       if (record.identity !== void 0) {
@@ -8406,7 +8457,7 @@ var init_store2 = __esm({
 });
 // src/usage/poolPick.ts
-import path26 from "node:path";
+import path27 from "node:path";
 import { z as z17 } from "zod";
 function errorMessage(error) {
   return error instanceof Error ? error.message : String(error);
@@ -8585,7 +8636,7 @@ function recordStickyPick(fs17, picksFile, directory, identity, nowMs) {
   const current = readPicksFile(fs17, picksFile).file.picks;
   const kept = Object.entries(current).filter(([, entry]) => nowMs - Date.parse(entry.at) <= USAGE_RETENTION_MS);
   const next = { schemaVersion: SCHEMA_VERSION, picks: { ...Object.fromEntries(kept), [directory]: { identity, at: new Date(nowMs).toISOString() } } };
-  fs17.mkdirPrivate(path26.dirname(picksFile));
+  fs17.mkdirPrivate(path27.dirname(picksFile));
   fs17.writeFilePrivate(picksFile, `${JSON.stringify(next, null, 2)}
 `);
 }
@@ -8619,9 +8670,9 @@ var init_poolPick = __esm({
 // src/statusline/keys.ts
 import { z as z18 } from "zod";
-function valueAt(source, path53) {
+function valueAt(source, path54) {
   let current = source;
-  for (const part of path53) {
+  for (const part of path54) {
     if (!isPlainObject(current)) {
       return void 0;
     }
@@ -8629,14 +8680,14 @@ function valueAt(source, path53) {
   }
   return current;
 }
-function acceptsNull(path53) {
-  const layer = path53.reduceRight((inner, part) => ({ [part]: inner }), null);
+function acceptsNull(path54) {
+  const layer = path54.reduceRight((inner, part) => ({ [part]: inner }), null);
   return StatuslineSchema.safeParse(layer).success;
 }
-function keyOf(path53, declared) {
+function keyOf(path54, declared) {
   const optional = declared instanceof z18.ZodOptional;
   const leaf = optional ? declared.unwrap() : declared;
-  const common = { path: path53.join("."), description: declared.description ?? "", defaultValue: valueAt(STATUSLINE_DEFAULTS, path53), optional, unsettable: acceptsNull(path53) };
+  const common = { path: path54.join("."), description: declared.description ?? "", defaultValue: valueAt(STATUSLINE_DEFAULTS, path54), optional, unsettable: acceptsNull(path54) };
   if (leaf instanceof z18.ZodNumber) {
     return { ...common, kind: "integer", choices: [] };
   }
@@ -8661,7 +8712,7 @@ function keyOf(path53, declared) {
   if (leaf instanceof z18.ZodArray && leaf.element instanceof z18.ZodString) {
     return { ...common, kind: "textList", choices: [] };
   }
-  throw new TypeError(`statusline setting ${path53.join(".")} has a kind the key listing does not describe`);
+  throw new TypeError(`statusline setting ${path54.join(".")} has a kind the key listing does not describe`);
 }
 function walk(shape, prefix) {
   return Object.entries(shape).flatMap(([name, schema]) => schema instanceof z18.ZodObject ? walk(schema.shape, [...prefix, name]) : [keyOf([...prefix, name], schema)]);
@@ -8677,15 +8728,15 @@ var init_keys = __esm({
 });
 // src/statusline/change.ts
-function keyNamed(path53) {
-  const found = statuslineKeys().find((key) => key.path === path53);
+function keyNamed(path54) {
+  const found = statuslineKeys().find((key) => key.path === path54);
   if (found === void 0) {
-    throw new UsageError(`"${path53}" is not a statusline setting; \`agent-shim statusline keys\` lists them.`);
+    throw new UsageError(`"${path54}" is not a statusline setting; \`agent-shim statusline keys\` lists them.`);
   }
   return found;
 }
-function setAt(target, path53, value) {
-  const [head, ...rest] = path53;
+function setAt(target, path54, value) {
+  const [head, ...rest] = path54;
   if (head === void 0) {
     return;
   }
@@ -8698,8 +8749,8 @@ function setAt(target, path53, value) {
   target[head] = next;
   setAt(next, rest, value);
 }
-function removeAt(target, path53) {
-  const [head, ...rest] = path53;
+function removeAt(target, path54) {
+  const [head, ...rest] = path54;
   if (head === void 0) {
     return;
   }
@@ -8717,13 +8768,13 @@ function removeAt(target, path53) {
 }
 function applyStatuslineChange(existing, change) {
   const draft = structuredClone(existing ?? {});
-  for (const [path53, value] of Object.entries(change.set ?? {})) {
-    keyNamed(path53);
-    setAt(draft, path53.split("."), value);
+  for (const [path54, value] of Object.entries(change.set ?? {})) {
+    keyNamed(path54);
+    setAt(draft, path54.split("."), value);
   }
-  for (const path53 of change.unset ?? []) {
-    keyNamed(path53);
-    removeAt(draft, path53.split("."));
+  for (const path54 of change.unset ?? []) {
+    keyNamed(path54);
+    removeAt(draft, path54.split("."));
   }
   const result = StatuslineSchema.safeParse(draft);
   if (!result.success) {
@@ -8959,19 +9010,19 @@ function writePools(paths, pools) {
   applyPatch(paths.globalConfigFile, GlobalConfigSchema, { pools }, { defaults: {} });
 }
 function poolCycleOf(pools, name) {
-  const walk2 = (current, path53) => {
+  const walk2 = (current, path54) => {
     for (const entry of pools[current]?.identities ?? []) {
       const nested = poolNameOf(poolMemberIdentity(entry));
       if (nested === void 0) {
         continue;
       }
       if (nested === name) {
-        return [...path53, nested];
+        return [...path54, nested];
       }
-      if (path53.includes(nested)) {
+      if (path54.includes(nested)) {
         continue;
       }
-      const found = walk2(nested, [...path53, nested]);
+      const found = walk2(nested, [...path54, nested]);
       if (found !== void 0) {
         return found;
       }
@@ -9081,14 +9132,14 @@ var init_poolStore = __esm({
 // src/paths.ts
 import fs6 from "node:fs";
 import os5 from "node:os";
-import path27 from "node:path";
+import path28 from "node:path";
 function resolveAgentShimHome(env = process.env, home = os5.homedir(), isDirectory = isExistingDirectory) {
   const fromEnv = env.AGENT_SHIM_HOME;
   if (fromEnv !== void 0 && fromEnv !== "") {
     return fromEnv;
   }
-  const current = path27.join(home, HOME_DIRNAME);
-  const legacy = path27.join(home, LEGACY_HOME_DIRNAME);
+  const current = path28.join(home, HOME_DIRNAME);
+  const legacy = path28.join(home, LEGACY_HOME_DIRNAME);
   return !isDirectory(current) && isDirectory(legacy) ? legacy : current;
 }
 function isExistingDirectory(candidate) {
@@ -9099,59 +9150,59 @@ function resolveClaudeHome() {
   if (fromEnv !== void 0 && fromEnv !== "") {
     return fromEnv;
   }
-  return path27.join(os5.homedir(), ".claude");
+  return path28.join(os5.homedir(), ".claude");
 }
 function buildLayoutPaths(root) {
   return {
     root,
-    identitiesDir: path27.join(root, "identities"),
-    configProfilesDir: path27.join(root, "config-profiles"),
-    providersDir: path27.join(root, "providers"),
-    providerAliasesFile: path27.join(root, "provider-aliases.json"),
-    directoryRulesFile: path27.join(root, "directory-rules.json"),
-    activeIdentityFile: path27.join(root, "active-identity"),
-    globalConfigFile: path27.join(root, "config.json"),
-    categoriesLocalFile: path27.join(root, "categories.local.json"),
-    claudeShimFile: path27.join(root, "claude-shim.json"),
-    headroomDir: path27.join(root, "headroom"),
-    headroomStateFile: path27.join(root, "headroom", "state.json"),
-    headroomRoutingFile: path27.join(root, "headroom", "routing.json"),
-    headroomLegacyStateFile: path27.join(root, "headroom", "state.v2.json"),
-    headroomAllowlistFile: path27.join(root, "headroom", "run", "allowlist.txt"),
-    headroomSocketDir: path27.join(root, "headroom", "run"),
-    headroomLockFile: path27.join(root, "headroom", "start.lock"),
-    headroomSessionsDir: path27.join(root, "headroom", "sessions"),
-    logsDir: path27.join(root, "logs"),
-    headroomLogPath: path27.join(root, "logs", "headroom.log"),
-    frontdoorDir: path27.join(root, "frontdoor"),
-    frontdoorCaDir: path27.join(root, "frontdoor", "ca"),
-    frontdoorCaCertFile: path27.join(root, "frontdoor", "ca", "ca.pem"),
-    frontdoorCaKeyFile: path27.join(root, "frontdoor", "ca", "ca.key"),
-    frontdoorCaBundlesDir: path27.join(root, "frontdoor", "ca", "bundles"),
-    chatgptSignInFile: path27.join(root, "codex", "chatgpt-sign-in.json"),
-    frontdoorStateFile: path27.join(root, "frontdoor", "state.json"),
-    frontdoorLockFile: path27.join(root, "frontdoor", "start.lock"),
-    frontdoorControlTokenFile: path27.join(root, "frontdoor", "control-token"),
-    frontdoorSessionsDir: path27.join(root, "frontdoor", "sessions"),
-    frontdoorDirectRecordsDir: path27.join(root, "frontdoor", "direct"),
-    frontdoorDrainingDir: path27.join(root, "frontdoor", "draining"),
-    frontdoorRcCredentialsDir: path27.join(root, "frontdoor", "rc-credentials"),
-    frontdoorLogPath: path27.join(root, "logs", "frontdoor.log"),
-    usageDir: path27.join(root, "usage"),
-    usageLogDir: path27.join(root, "usage", "log"),
-    usageSnapshotsDir: path27.join(root, "usage", "snapshots"),
-    statuslineDir: path27.join(root, "statusline"),
-    catalogueDir: path27.join(root, "catalogues"),
-    usagePicksFile: path27.join(root, "usage", "picks.json"),
-    usageAnchorsFile: path27.join(root, "usage", "anchors.json"),
-    usageJobsFile: path27.join(root, "usage", "jobs.json"),
-    jobLogsDir: path27.join(root, "logs", "jobs"),
-    identityRenamesDir: path27.join(root, "identity-renames"),
-    identityNameRenamesDir: path27.join(root, "identity-name-renames"),
-    launchesDir: path27.join(root, "launches"),
-    superviseDir: path27.join(root, "supervise"),
-    modelMovesDir: path27.join(root, "model-moves"),
-    mcpPermissionsFile: path27.join(root, "mcp", "permissions.json")
+    identitiesDir: path28.join(root, "identities"),
+    configProfilesDir: path28.join(root, "config-profiles"),
+    providersDir: path28.join(root, "providers"),
+    providerAliasesFile: path28.join(root, "provider-aliases.json"),
+    directoryRulesFile: path28.join(root, "directory-rules.json"),
+    activeIdentityFile: path28.join(root, "active-identity"),
+    globalConfigFile: path28.join(root, "config.json"),
+    categoriesLocalFile: path28.join(root, "categories.local.json"),
+    claudeShimFile: path28.join(root, "claude-shim.json"),
+    headroomDir: path28.join(root, "headroom"),
+    headroomStateFile: path28.join(root, "headroom", "state.json"),
+    headroomRoutingFile: path28.join(root, "headroom", "routing.json"),
+    headroomLegacyStateFile: path28.join(root, "headroom", "state.v2.json"),
+    headroomAllowlistFile: path28.join(root, "headroom", "run", "allowlist.txt"),
+    headroomSocketDir: path28.join(root, "headroom", "run"),
+    headroomLockFile: path28.join(root, "headroom", "start.lock"),
+    headroomSessionsDir: path28.join(root, "headroom", "sessions"),
+    logsDir: path28.join(root, "logs"),
+    headroomLogPath: path28.join(root, "logs", "headroom.log"),
+    frontdoorDir: path28.join(root, "frontdoor"),
+    frontdoorCaDir: path28.join(root, "frontdoor", "ca"),
+    frontdoorCaCertFile: path28.join(root, "frontdoor", "ca", "ca.pem"),
+    frontdoorCaKeyFile: path28.join(root, "frontdoor", "ca", "ca.key"),
+    frontdoorCaBundlesDir: path28.join(root, "frontdoor", "ca", "bundles"),
+    chatgptSignInFile: path28.join(root, "codex", "chatgpt-sign-in.json"),
+    frontdoorStateFile: path28.join(root, "frontdoor", "state.json"),
+    frontdoorLockFile: path28.join(root, "frontdoor", "start.lock"),
+    frontdoorControlTokenFile: path28.join(root, "frontdoor", "control-token"),
+    frontdoorSessionsDir: path28.join(root, "frontdoor", "sessions"),
+    frontdoorDirectRecordsDir: path28.join(root, "frontdoor", "direct"),
+    frontdoorDrainingDir: path28.join(root, "frontdoor", "draining"),
+    frontdoorRcCredentialsDir: path28.join(root, "frontdoor", "rc-credentials"),
+    frontdoorLogPath: path28.join(root, "logs", "frontdoor.log"),
+    usageDir: path28.join(root, "usage"),
+    usageLogDir: path28.join(root, "usage", "log"),
+    usageSnapshotsDir: path28.join(root, "usage", "snapshots"),
+    statuslineDir: path28.join(root, "statusline"),
+    catalogueDir: path28.join(root, "catalogues"),
+    usagePicksFile: path28.join(root, "usage", "picks.json"),
+    usageAnchorsFile: path28.join(root, "usage", "anchors.json"),
+    usageJobsFile: path28.join(root, "usage", "jobs.json"),
+    jobLogsDir: path28.join(root, "logs", "jobs"),
+    identityRenamesDir: path28.join(root, "identity-renames"),
+    identityNameRenamesDir: path28.join(root, "identity-name-renames"),
+    launchesDir: path28.join(root, "launches"),
+    superviseDir: path28.join(root, "supervise"),
+    modelMovesDir: path28.join(root, "model-moves"),
+    mcpPermissionsFile: path28.join(root, "mcp", "permissions.json")
   };
 }
 function resolveLayoutPaths() {
@@ -9166,7 +9217,7 @@ var init_paths = __esm({
 // src/usage/signIn.ts
 import { createHash as createHash6 } from "node:crypto";
-import path28 from "node:path";
+import path29 from "node:path";
 function claudeCodeKeychainService(configDir) {
   return `${KEYCHAIN_SERVICE_PREFIX}-${createHash6("sha256").update(configDir).digest("hex").slice(0, KEYCHAIN_SERVICE_HASH_DIGITS)}`;
 }
@@ -9189,7 +9240,7 @@ function decideSignIn(facts) {
   return { state: "signed-out", detail: facts.platform === "darwin" ? `no Keychain item and no ${CREDENTIALS_FILE}` : `no ${CREDENTIALS_FILE}` };
 }
 function credentialsFilePath(farmRoot) {
-  return path28.join(farmRoot, CREDENTIALS_FILE);
+  return path29.join(farmRoot, CREDENTIALS_FILE);
 }
 function identitySignIn(fs17, probe, identity) {
   const probing = !identity.hasCredentialBlock && identity.provider === void 0;
@@ -9405,7 +9456,7 @@ var init_keychainLogin = __esm({
 // src/realCredentialCache.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
 import fs7 from "node:fs";
-import path29 from "node:path";
+import path30 from "node:path";
 function keychainCacheDeleteArgs(owner) {
   return ["delete-generic-password", "-s", KEYCHAIN_CACHE_SERVICE, "-a", owner];
 }
@@ -9420,7 +9471,7 @@ function serialisedFor(entry, owner) {
   return JSON.stringify({ owner, ...withoutOwner(entry) });
 }
 function tempPathFor(target) {
-  return path29.join(path29.dirname(target), `${TEMP_PREFIX}${String(process.pid)}-${randomUUID3()}`);
+  return path30.join(path30.dirname(target), `${TEMP_PREFIX}${String(process.pid)}-${randomUUID3()}`);
 }
 function processRuns(pid) {
   try {
@@ -9438,7 +9489,7 @@ function abandonedTempFiles(entries) {
 }
 function sweepAbandonedTempFiles(dir) {
   for (const entry of abandonedTempFiles(fs7.existsSync(dir) ? fs7.readdirSync(dir) : [])) {
-    fs7.rmSync(path29.join(dir, entry), { force: true });
+    fs7.rmSync(path30.join(dir, entry), { force: true });
   }
 }
 function storedEntry(store, entry, owner) {
@@ -9477,8 +9528,8 @@ function security(args, stdin) {
   return { status: result.status, stdout: result.stdout };
 }
 function createRealCredentialCache(root, keychain = { run: security, platform: process.platform }) {
-  const dir = path29.join(root, "credential-cache");
-  const filePath = (owner) => path29.join(dir, cacheFileNameFor(owner));
+  const dir = path30.join(root, "credential-cache");
+  const filePath = (owner) => path30.join(dir, cacheFileNameFor(owner));
   return {
     read(store, owner) {
       if (store === "file") {
@@ -10449,62 +10500,13 @@ var init_providersStore = __esm({
   }
 });
-// src/cli/bool.ts
-function parseBoolWord(input) {
-  switch (input) {
-    case "true":
-    case "1":
-      return true;
-    case "false":
-    case "0":
-      return false;
-    default:
-      return void 0;
-  }
-}
-var init_bool = __esm({
-  "src/cli/bool.ts"() {
-    "use strict";
-  }
-});
-// src/cli/envBool.ts
-function parseEnvBool(variable, value) {
-  if (value === void 0 || value === "") {
-    return void 0;
-  }
-  const parsed = parseBoolWord(value);
-  if (parsed === void 0) {
-    throw new InvalidEnvBoolError(variable, value);
-  }
-  return parsed;
-}
-var InvalidEnvBoolError;
-var init_envBool = __esm({
-  "src/cli/envBool.ts"() {
-    "use strict";
-    init_cliError();
-    init_bool();
-    InvalidEnvBoolError = class extends UsageError {
-      constructor(variable, value) {
-        super(`${variable} must be one of true, false, 1 or 0, got "${value}".`);
-        this.variable = variable;
-        this.value = value;
-        this.name = "InvalidEnvBoolError";
-      }
-      variable;
-      value;
-    };
-  }
-});
 // src/identityToken.ts
-import path30 from "node:path";
+import path31 from "node:path";
 function identityTokenDir(paths) {
-  return path30.join(paths.root, "credentials");
+  return path31.join(paths.root, "credentials");
 }
 function identityTokenPath(paths, identityId) {
-  return path30.join(identityTokenDir(paths), `${identityId}.token`);
+  return path31.join(identityTokenDir(paths), `${identityId}.token`);
 }
 var init_identityToken = __esm({
   "src/identityToken.ts"() {
@@ -10728,7 +10730,7 @@ var init_readableConfig = __esm({
 // src/identityRenameJournal.ts
 import { createHash as createHash7 } from "node:crypto";
-import path31 from "node:path";
+import path32 from "node:path";
 import { z as z21 } from "zod";
 function renamePairFileName(from, to, suffix) {
   return `${createHash7("sha256").update(`${from}\0${to}`).digest("hex").slice(0, FILE_NAME_HASH_DIGITS)}${suffix}`;
@@ -10757,7 +10759,7 @@ function listRenameJournals(fs17, directory) {
     if (!name.endsWith(JOURNAL_SUFFIX)) {
       continue;
     }
-    const file = path31.join(directory, name);
+    const file = path32.join(directory, name);
     try {
       const journal = readRenameJournal(fs17, file);
       if (journal !== void 0) {
@@ -10845,7 +10847,7 @@ var init_identityRenameJournal = __esm({
 // src/identityNameRenameRecord.ts
 import fs9 from "node:fs";
-import path32 from "node:path";
+import path33 from "node:path";
 import { z as z22 } from "zod";
 function readRecordFiles(paths) {
   if (!fs9.existsSync(paths.identityNameRenamesDir)) {
@@ -10855,7 +10857,7 @@ function readRecordFiles(paths) {
     if (!entry.endsWith(RECORD_SUFFIX)) {
       return [];
     }
-    const file = path32.join(paths.identityNameRenamesDir, entry);
+    const file = path33.join(paths.identityNameRenamesDir, entry);
     let parsed;
     try {
       parsed = JSON.parse(fs9.readFileSync(file, "utf8"));
@@ -10867,7 +10869,7 @@ function readRecordFiles(paths) {
   });
 }
 function isFiledForItsPair(entry) {
-  return path32.basename(entry.file) === renamePairFileName(entry.record.from, entry.record.to, RECORD_SUFFIX);
+  return path33.basename(entry.file) === renamePairFileName(entry.record.from, entry.record.to, RECORD_SUFFIX);
 }
 function readNameRenameRecords(paths) {
   return readRecordFiles(paths).filter(isFiledForItsPair).map((entry) => entry.record);
@@ -10959,17 +10961,17 @@ var init_identityNameRenameRecord = __esm({
 });
 // src/launcher/launchRecords.ts
-import path33 from "node:path";
+import path34 from "node:path";
 import { randomUUID as randomUUID4 } from "node:crypto";
 import { z as z23 } from "zod";
 function recordFile(directory, pid) {
-  return path33.join(directory, `${String(pid)}.${randomUUID4()}${RECORD_SUFFIX2}`);
+  return path34.join(directory, `${String(pid)}.${randomUUID4()}${RECORD_SUFFIX2}`);
 }
 function readRecord(fs17, directory, name) {
   if (!name.endsWith(RECORD_SUFFIX2)) {
     return void 0;
   }
-  const raw = fs17.readFileUtf8(path33.join(directory, name));
+  const raw = fs17.readFileUtf8(path34.join(directory, name));
   if (raw === void 0) {
     return void 0;
   }
@@ -10987,7 +10989,7 @@ function registerLaunch(fs17, directory, owner, isRunning) {
   for (const name of fs17.readdir(directory)) {
     const record2 = readRecord(fs17, directory, name);
     if (record2 !== void 0 && !isRunning(record2.pid)) {
-      fs17.removeRecursive(path33.join(directory, name));
+      fs17.removeRecursive(path34.join(directory, name));
     }
   }
   const file = recordFile(directory, owner.pid);
@@ -11020,7 +11022,7 @@ var init_launchRecords = __esm({
 // src/identityStore.ts
 import fs10 from "node:fs";
-import path34 from "node:path";
+import path35 from "node:path";
 function displacedIdentity(paths, verb, name, id) {
   return new DisplacedIdentityError(verb, name, id, fs10.existsSync(identityDirectory(paths, id)));
 }
@@ -11051,13 +11053,13 @@ function identityNameOf(paths, id) {
   return identityNameIn(identityRecords(paths), id);
 }
 function identityDirectory(paths, id) {
-  return path34.join(paths.identitiesDir, id);
+  return path35.join(paths.identitiesDir, id);
 }
 function identityJsonPath(paths, id) {
   if (!isStoredName(id)) {
     throw new UnsafeNameError(id, "identity");
   }
-  return path34.join(identityDirectory(paths, id), IDENTITY_FILE);
+  return path35.join(identityDirectory(paths, id), IDENTITY_FILE);
 }
 function requireIdentityNames(paths, names) {
   const existing = new Set(listIdentities(paths).map((entry) => entry.name));
@@ -11081,7 +11083,7 @@ function readIdentityById(paths, id) {
   return readJson(identityJsonPath(paths, id), IdentitySchema);
 }
 function idKeyedFiles(paths, id) {
-  return [identityTokenPath(paths, id), path34.join(paths.root, "credential-cache", cacheFileNameFor(identityCacheKey(id))), snapshotPath(paths.usageSnapshotsDir, id)];
+  return [identityTokenPath(paths, id), path35.join(paths.root, "credential-cache", cacheFileNameFor(identityCacheKey(id))), snapshotPath(paths.usageSnapshotsDir, id)];
 }
 function loggedIdentityIds(paths) {
   let logged;
@@ -11111,7 +11113,7 @@ function stateFiledUnder(paths, id, allocation, moving) {
   const folded = id.toLowerCase();
   const entry = (fs10.existsSync(paths.identitiesDir) ? fs10.readdirSync(paths.identitiesDir) : []).find((candidate) => candidate !== moving?.lockEntry && belongsToIdentity(candidate.toLowerCase(), folded));
   if (entry !== void 0) {
-    return `${path34.join(paths.identitiesDir, entry)} exists${entry.toLowerCase() === folded && entry !== id ? `, and an id that differs from "${id}" only in case is the same directory on a filesystem that ignores case` : ""}`;
+    return `${path35.join(paths.identitiesDir, entry)} exists${entry.toLowerCase() === folded && entry !== id ? `, and an id that differs from "${id}" only in case is the same directory on a filesystem that ignores case` : ""}`;
   }
   const sharing = allocation.recordIds().find((other) => other.toLowerCase() !== folded && other !== moving?.id && foldedCacheFile(other) === foldedCacheFile(id));
   if (sharing !== void 0) {
@@ -11119,12 +11121,12 @@ function stateFiledUnder(paths, id, allocation, moving) {
     const sharingFile = cacheFileNameFor(identityCacheKey(sharing));
     return `the credential cache would file it in ${file}, ${file === sharingFile ? `the file of identities/${sharing}` : `which differs only in case from the file of identities/${sharing}, ${sharingFile}`}`;
   }
-  const cacheDir = path34.join(paths.root, "credential-cache");
+  const cacheDir = path35.join(paths.root, "credential-cache");
   const ownCacheFile = moving !== void 0 && createRealCredentialCache(paths.root).read("file", identityCacheKey(moving.id)) !== void 0 ? cacheFileNameFor(identityCacheKey(moving.id)) : void 0;
   for (const candidate of idKeyedFiles(paths, id)) {
-    const onDisk = entriesOf(path34.dirname(candidate)).find((spelled) => spelled.toLowerCase() === path34.basename(candidate).toLowerCase() && !(path34.dirname(candidate) === cacheDir && spelled === ownCacheFile));
+    const onDisk = entriesOf(path35.dirname(candidate)).find((spelled) => spelled.toLowerCase() === path35.basename(candidate).toLowerCase() && !(path35.dirname(candidate) === cacheDir && spelled === ownCacheFile));
     if (onDisk !== void 0) {
-      return `${path34.join(path34.dirname(candidate), onDisk)} exists${onDisk === path34.basename(candidate) ? "" : `, and a file name that differs from ${path34.basename(candidate)} only in case is the same file on a filesystem that ignores case`}`;
+      return `${path35.join(path35.dirname(candidate), onDisk)} exists${onDisk === path35.basename(candidate) ? "" : `, and a file name that differs from ${path35.basename(candidate)} only in case is the same file on a filesystem that ignores case`}`;
     }
   }
   if (allocation.keychain !== void 0 && keychainCacheEntryExists(allocation.keychain, identityCacheKey(id))) {
@@ -11168,7 +11170,7 @@ function addIdentity(paths, name, options = {}) {
     if (checkedId !== void 0 && idTaken(paths, checkedId, allocation)) {
       throw new CheckedIdTakenError(name, checkedId);
     }
-    const identity = IdentitySchema.parse({ name, allowAmbientCredential: false });
+    const identity = IdentitySchema.parse({ name, allowAmbientCredential: false, ...options.agent === void 0 ? {} : { agent: options.agent } });
     writeJsonAtomic(identityJsonPath(paths, id()), identity);
     return identity;
   });
@@ -11229,7 +11231,7 @@ function listIdentityDirectories(paths) {
       if (!isIdentityDirectoryName(entry.name)) {
         continue;
       }
-      const entryPath = path34.join(paths.identitiesDir, entry.name);
+      const entryPath = path35.join(paths.identitiesDir, entry.name);
       const followed = entry.isDirectory() ? "directory" : entry.isSymbolicLink() ? followedLink(entryPath) : "other";
       if (followed === "other") {
         continue;
@@ -11339,7 +11341,7 @@ function isFarmEntry(entry, name) {
   return entry === name || new RegExp(`^\\.${escapedForPattern(name)}${FARM_SUFFIX_PATTERN}$`, "u").test(entry);
 }
 function belongsToIdentity(entry, name) {
-  return isFarmEntry(entry, name) || entry === path34.basename(identityLockPath("", name));
+  return isFarmEntry(entry, name) || entry === path35.basename(identityLockPath("", name));
 }
 function requireNewIdentityName(name) {
   if (!FileNameSchema.safeParse(name).success) {
@@ -11347,7 +11349,7 @@ function requireNewIdentityName(name) {
   }
 }
 function sameIdentityName(paths, first, second) {
-  return sameDirectory(path34.join(paths.identitiesDir, first), path34.join(paths.identitiesDir, second)) || first.toLowerCase() === second.toLowerCase() && ignoresCase(paths.identitiesDir);
+  return sameDirectory(path35.join(paths.identitiesDir, first), path35.join(paths.identitiesDir, second)) || first.toLowerCase() === second.toLowerCase() && ignoresCase(paths.identitiesDir);
 }
 function requireNoUnfinishedRenameNaming(paths, name, action) {
   requireNameFreeOfUnfinishedRename({ readFileUtf8: nodeStoreFs.readFileUtf8, readdir: (directory) => fs10.existsSync(directory) ? fs10.readdirSync(directory) : [] }, paths.identityRenamesDir, name, action, (first, second) => sameIdentityName(paths, first, second), (identity) => identityIdExists(paths, identity));
@@ -11377,17 +11379,17 @@ function removeIdentityWithLockHeld(paths, name, namesLock) {
   }
   const resync = acquireRemovalLock(paths, name, id, namesLock);
   try {
-    const lockFile = path34.basename(resync.path);
+    const lockFile = path35.basename(resync.path);
     for (const file of idKeyedFiles(paths, id).filter((candidate) => fs10.existsSync(candidate))) {
-      fs10.accessSync(path34.dirname(file), fs10.constants.W_OK | fs10.constants.X_OK);
+      fs10.accessSync(path35.dirname(file), fs10.constants.W_OK | fs10.constants.X_OK);
     }
-    const links = fs10.readdirSync(paths.identitiesDir).filter((entry) => !entry.startsWith(".") && entry !== id && sameDirectory(path34.join(paths.identitiesDir, entry), path34.join(paths.identitiesDir, id)));
+    const links = fs10.readdirSync(paths.identitiesDir).filter((entry) => !entry.startsWith(".") && entry !== id && sameDirectory(path35.join(paths.identitiesDir, entry), path35.join(paths.identitiesDir, id)));
     for (const entry of fs10.readdirSync(paths.identitiesDir)) {
       if (links.includes(entry) || entry !== lockFile && belongsToIdentity(entry, id)) {
-        fs10.rmSync(path34.join(paths.identitiesDir, entry), { recursive: true, force: true });
+        fs10.rmSync(path35.join(paths.identitiesDir, entry), { recursive: true, force: true });
       }
     }
-    const cacheFile = path34.join(paths.root, "credential-cache", cacheFileNameFor(identityCacheKey(id)));
+    const cacheFile = path35.join(paths.root, "credential-cache", cacheFileNameFor(identityCacheKey(id)));
     for (const file of idKeyedFiles(paths, id).filter((candidate) => candidate !== cacheFile)) {
       fs10.rmSync(file, { force: true });
     }
@@ -11633,17 +11635,17 @@ var init_commandDeps = __esm({
 // src/claudeShim.ts
 import fs11 from "node:fs";
-import path36 from "node:path";
+import path37 from "node:path";
 import { z as z28 } from "zod";
 function commandFilename(ownExecutablePath, commandName) {
   return ownExecutablePath.toLowerCase().endsWith(".exe") ? `${commandName}.exe` : commandName;
 }
 function resolveOwnBinaryCheck(paths, contentSourcePath) {
   const state = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-  const recordedTarget = state === void 0 ? void 0 : path36.resolve(state.targetPath);
+  const recordedTarget = state === void 0 ? void 0 : path37.resolve(state.targetPath);
   let ownStat;
   return (candidate) => {
-    if (recordedTarget !== void 0 && path36.resolve(candidate) === recordedTarget) {
+    if (recordedTarget !== void 0 && path37.resolve(candidate) === recordedTarget) {
       return true;
     }
     ownStat ??= statOrUndefined(contentSourcePath);
@@ -11666,15 +11668,15 @@ function statOrUndefined(target) {
   }
 }
 function findPathShadow(params) {
-  const resolvedTargetDir = path36.resolve(params.targetDir);
+  const resolvedTargetDir = path37.resolve(params.targetDir);
   for (const dir of params.pathDirs) {
     const found = params.findExecutableInDir(dir, params.targetFilename);
     if (found === void 0) {
       continue;
     }
-    return path36.resolve(dir) === resolvedTargetDir ? { status: "ok" } : { status: "shadowed", by: found };
+    return path37.resolve(dir) === resolvedTargetDir ? { status: "ok" } : { status: "shadowed", by: found };
   }
-  return params.pathDirs.some((dir) => path36.resolve(dir) === resolvedTargetDir) ? { status: "ok" } : { status: "not-on-path" };
+  return params.pathDirs.some((dir) => path37.resolve(dir) === resolvedTargetDir) ? { status: "ok" } : { status: "not-on-path" };
 }
 var ClaudeShimStateSchema, nodeLinkFs;
 var init_claudeShim = __esm({
@@ -11843,7 +11845,7 @@ var init_modelsStore = __esm({
 // src/codex/catalogueCredential.ts
 import { createHash as createHash8 } from "node:crypto";
-import path39 from "node:path";
+import path40 from "node:path";
 import { z as z32 } from "zod";
 function parseCatalogueBinding(raw) {
   if (raw === void 0) return void 0;
@@ -11877,8 +11879,8 @@ function signInCatalogueFingerprint(raw, filePath) {
 function savedCatalogueFingerprint(provider, paths, env, home, read) {
   if (provider.codex?.login === "chatgpt-sign-in") return signInCatalogueFingerprint(read(paths.chatgptSignInFile), paths.chatgptSignInFile);
   const configuredHome = env.CODEX_HOME;
-  const codexHome = configuredHome === void 0 || configuredHome === "" ? path39.join(home, ".codex") : configuredHome;
-  return cliCatalogueFingerprint(read(path39.join(codexHome, "auth.json")));
+  const codexHome = configuredHome === void 0 || configuredHome === "" ? path40.join(home, ".codex") : configuredHome;
+  return cliCatalogueFingerprint(read(path40.join(codexHome, "auth.json")));
 }
 var CatalogueBindingSchema;
 var init_catalogueCredential = __esm({
@@ -13055,7 +13057,7 @@ var init_settings2 = __esm({
 });
 // src/launcher/flags.ts
-import path47 from "node:path";
+import path48 from "node:path";
 function resolveLaunchFlags(params) {
   const statusline = resolveStatuslineSettings(params);
   return {
@@ -13111,7 +13113,7 @@ function buildEnv(params) {
   const parentCustomHeaders = params.baseEnv.ANTHROPIC_CUSTOM_HEADERS;
   let providerCustomHeaders;
   if (!params.configDirEscapeHatch && params.identityId !== void 0) {
-    env.CLAUDE_CONFIG_DIR = path47.join(params.identitiesDir, params.identityId);
+    env.CLAUDE_CONFIG_DIR = path48.join(params.identitiesDir, params.identityId);
   }
   if (params.provider !== void 0) {
     const providerEnv = params.provider.definition.kind !== void 0 && params.provider.definition.kind !== "http" ? {} : params.provider.definition.env ?? {};
@@ -13203,7 +13205,7 @@ var init_extraFlags = __esm({
 });
 // src/usage/resumeContext.ts
-import path48 from "node:path";
+import path49 from "node:path";
 function projectDirNameOf(cwd) {
   return cwd.replace(/[^A-Za-z0-9]/g, "-");
 }
@@ -13261,7 +13263,7 @@ function newestTranscript(fs17, projectDir) {
     if (!name.endsWith(".jsonl")) {
       continue;
     }
-    const candidate = path48.join(projectDir, name);
+    const candidate = path49.join(projectDir, name);
     const stat = fs17.lstat(candidate);
     if (stat?.kind === "file" && stat.mtimeMs > newestMs) {
       newestMs = stat.mtimeMs;
@@ -13275,8 +13277,8 @@ function resumedContextTokens(fs17, params) {
   if (target === void 0) {
     return void 0;
   }
-  const projectDir = path48.join(params.claudeHome, "projects", projectDirNameOf(params.cwd));
-  const file = target.kind === "id" ? path48.join(projectDir, `${target.id}.jsonl`) : newestTranscript(fs17, projectDir);
+  const projectDir = path49.join(params.claudeHome, "projects", projectDirNameOf(params.cwd));
+  const file = target.kind === "id" ? path49.join(projectDir, `${target.id}.jsonl`) : newestTranscript(fs17, projectDir);
   const text = file === void 0 ? void 0 : fs17.readFileUtf8(file);
   return text === void 0 ? void 0 : contextTokensOfTranscript(text);
 }
@@ -13874,7 +13876,7 @@ var init_launchHook = __esm({
 import { randomUUID as randomUUID6 } from "node:crypto";
 import os9 from "node:os";
 import { isDeepStrictEqual } from "node:util";
-import path49 from "node:path";
+import path50 from "node:path";
 function resolveIdentityCredential(identity, credential, env, port) {
   if (port === void 0) {
     return { ok: false, status: 1, message: `agent-shim: identity ${identity.name} needs its credential resolved, but this launcher has no credential port wired` };
@@ -13980,6 +13982,10 @@ function decideLaunch(params, readOnly, onRecorded) {
         proc.exit(1);
       }
     }
+    if (loadedIdentity?.config.agent === "codex") {
+      log.error(`Identity "${identityDecision.name ?? ""}" belongs to Codex. Use agent-shim run --agent codex @${identityDecision.name ?? ""}.`);
+      proc.exit(1);
+    }
     const configProfileDecision = decideConfigProfile({
       env,
       cliFlagConfigProfile: params.cliFlagConfigProfile ?? parsedArgv.configProfile,
@@ -14130,8 +14136,8 @@ function decideLaunch(params, readOnly, onRecorded) {
           if (definition.kind === "codex" && readOnly && cache !== void 0) {
             const binding = parseCatalogueBinding(params.fs.readFileUtf8(catalogueBindingPath(paths, name, catalogueOwner, generation)));
             const configuredHome = catalogueEnv.CODEX_HOME;
-            const home = configuredHome === void 0 || configuredHome === "" ? path49.join(os9.homedir(), ".codex") : configuredHome;
-            const source = definition.codex?.login === "chatgpt-sign-in" ? paths.chatgptSignInFile : path49.resolve(home, "auth.json");
+            const home = configuredHome === void 0 || configuredHome === "" ? path50.join(os9.homedir(), ".codex") : configuredHome;
+            const source = definition.codex?.login === "chatgpt-sign-in" ? paths.chatgptSignInFile : path50.resolve(home, "auth.json");
             const revision = params.fs.fileRevision?.(source);
             if (binding === void 0 || binding.fingerprint !== cache.credentialFingerprint || binding.source !== source || revision === void 0 || revision !== binding.revision) return [];
           }
@@ -14152,7 +14158,7 @@ function decideLaunch(params, readOnly, onRecorded) {
       return { args: args2, pickerSuppressed: startsSession && pickerSettings !== void 0 && callerSettings };
     };
     const args = argsForSupervisor().args;
-    const configDir = configDirEscapeHatchApplies || farmIdentity === void 0 ? env.CLAUDE_CONFIG_DIR : path49.join(paths.identitiesDir, farmIdentity);
+    const configDir = configDirEscapeHatchApplies || farmIdentity === void 0 ? env.CLAUDE_CONFIG_DIR : path50.join(paths.identitiesDir, farmIdentity);
     const decision = {
       identitySource: identityDecision.source,
       configDirEscapeHatch: identityDecision.configDirEscapeHatch,
@@ -14239,7 +14245,7 @@ function prepareRegisteredLaunch(params, onRecorded) {
   let warnings = [];
   const updateCheck = runLaunchUpdateCheck({
     mode: params.updateMode ?? "off",
-    checkPath: path49.join(paths.root, "update.check"),
+    checkPath: path50.join(paths.root, "update.check"),
     currentVersion: package_default.version,
     port: params.update
   });
@@ -14262,7 +14268,7 @@ function prepareRegisteredLaunch(params, onRecorded) {
         classification: resyncFarmRuntime.classification,
         now: resyncFarmRuntime.now,
         uniqueSuffix: resyncFarmRuntime.uniqueSuffix,
-        identityExists: () => params.fs.readConfigFile(path49.join(paths.identitiesDir, resyncIdentity, IDENTITY_FILE)) !== void 0,
+        identityExists: () => params.fs.readConfigFile(path50.join(paths.identitiesDir, resyncIdentity, IDENTITY_FILE)) !== void 0,
         lock: resyncFarmRuntime.lock
       });
     } catch (error) {
@@ -14451,12 +14457,12 @@ var init_launcher = __esm({
 });
 // src/ownCli.ts
-import path50 from "node:path";
+import path51 from "node:path";
 function agentShimCliPath(distDir = typeof __AGENT_SHIM_DIST_DIR__ === "string" ? __AGENT_SHIM_DIST_DIR__ : void 0) {
   if (distDir === void 0) {
     throw new OwnCliPathUnknownError();
   }
-  return path50.join(distDir, OWN_CLI_FILE_NAME);
+  return path51.join(distDir, OWN_CLI_FILE_NAME);
 }
 var OWN_CLI_FILE_NAME, OwnCliPathUnknownError;
 var init_ownCli = __esm({
@@ -14512,10 +14518,10 @@ var init_selfIdentity = __esm({
 // src/frontdoor/trust.ts
 import { createHash as createHash9 } from "node:crypto";
-import path51 from "node:path";
+import path52 from "node:path";
 function resolveTrustBundle(params) {
   const { caCertFile, bundlesDir, variable, inherited, fs: fs17 } = params;
-  if (inherited === void 0 || inherited === "" || path51.resolve(inherited) === path51.resolve(caCertFile)) {
+  if (inherited === void 0 || inherited === "" || path52.resolve(inherited) === path52.resolve(caCertFile)) {
     return { path: caCertFile };
   }
   const caPem = fs17.readFileUtf8(caCertFile);
@@ -14533,7 +14539,7 @@ function resolveTrustBundle(params) {
   }
   const combined = `${inheritedPem.trimEnd()}
 ${caPem}`;
-  const bundle = path51.join(bundlesDir, `${createHash9("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
+  const bundle = path52.join(bundlesDir, `${createHash9("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
   if (!fs17.exists(bundle)) {
     fs17.mkdirp(bundlesDir);
     fs17.writeFileAtomic(bundle, combined);
@@ -14677,7 +14683,7 @@ var init_realFrontDoorPort = __esm({
 // src/launchWiring.ts
 import os11 from "node:os";
-import path52 from "node:path";
+import path53 from "node:path";
 import { randomUUID as randomUUID7 } from "node:crypto";
 function buildFarmRuntime(paths, cwd, run = realRunPort) {
   const home = os11.homedir();
@@ -14732,7 +14738,7 @@ function realPrepareLaunchParams(paths, options) {
     frontdoor: realFrontDoorPort(paths, options.spawnDaemon),
     credentials: { ...realCredentialPort, cache: realCredentialCacheEnv(paths) },
     hold: realHoldPort,
-    hasStoredLogin: (identity) => identitySignIn(realFarmFs, { platform: process.platform, run: options.run ?? realRunPort }, { farmRoot: path52.join(paths.identitiesDir, identity), hasCredentialBlock: false, provider: void 0 }).state !== "signed-out",
+    hasStoredLogin: (identity) => identitySignIn(realFarmFs, { platform: process.platform, run: options.run ?? realRunPort }, { farmRoot: path53.join(paths.identitiesDir, identity), hasCredentialBlock: false, provider: void 0 }).state !== "signed-out",
     ...farm.directoryIdentity === void 0 ? {} : { directoryPinnedIdentity: farm.directoryIdentity },
     ...farm.directoryConfigProfile === void 0 ? {} : { directoryRuleConfigProfile: farm.directoryConfigProfile },
     ...farm.globalDefaultConfigProfile === void 0 ? {} : { globalDefaultConfigProfile: farm.globalDefaultConfigProfile },
@@ -15472,8 +15478,8 @@ function pathnameOf(url) {
   return new URL(url ?? "/", "http://127.0.0.1").pathname;
 }
 function isRcSessionExchange(url) {
-  const path53 = pathnameOf(url);
-  return path53 === RC_SESSIONS_PATH_PREFIX || path53.startsWith(`${RC_SESSIONS_PATH_PREFIX}/`);
+  const path54 = pathnameOf(url);
+  return path54 === RC_SESSIONS_PATH_PREFIX || path54.startsWith(`${RC_SESSIONS_PATH_PREFIX}/`);
 }
 var RC_SESSION_ID_PREFIX = "cse_";
 var RC_IDLE_EXPIRY_MS = 45e3;
@@ -16032,8 +16038,8 @@ var RC_READ_FILE_ENCODINGS = ["utf-8", "base64"];
 function isRcReadFileEncoding(value) {
   return RC_READ_FILE_ENCODINGS.some((encoding) => encoding === value);
 }
-function buildRcReadFilePayload(requestId, path53, options) {
-  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path53, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
+function buildRcReadFilePayload(requestId, path54, options) {
+  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path54, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
 }
 function buildRcFileSuggestionsPayload(requestId, query) {
   return buildRcControlRequestPayload(requestId, { subtype: "file_suggestions", query });
@@ -16135,15 +16141,15 @@ async function getRcSessionContextUsage(deps, sessionId, detail) {
   const result = await deliverRcClientPayload(deps, sessionId, buildRcGetContextUsagePayload(requestId, detail), `request the context usage of session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
-async function readRcSessionFile(deps, sessionId, path53, options) {
-  if (path53 === "") {
+async function readRcSessionFile(deps, sessionId, path54, options) {
+  if (path54 === "") {
     return { ok: false, message: "a read-file write needs a non-empty path: the SDK's own field names the file the worker resolves against the session's cwd, and an empty string names none" };
   }
   if (options?.maxBytes !== void 0 && (!Number.isInteger(options.maxBytes) || options.maxBytes <= 0)) {
     return { ok: false, message: "a read-file write's max-bytes is a positive whole number of bytes: the SDK's own field caps the read, and a zero or negative cap reads nothing" };
   }
   const requestId = deps.newUuid();
-  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path53, options), `read ${path53} from session ${sessionId}`);
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path54, options), `read ${path54} from session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
 async function suggestRcSessionFiles(deps, sessionId, query) {
@@ -16312,11 +16318,11 @@ function createRcControlHandler(deps) {
       path: "read-file",
       read: (body) => {
         const session = bodyString(body, "session");
-        const path53 = bodyString(body, "path");
+        const path54 = bodyString(body, "path");
         const maxBytes = "maxBytes" in body ? bodyPositiveInteger(body, "maxBytes") : void 0;
         const encoding = "encoding" in body && isRcReadFileEncoding(body.encoding) ? body.encoding : void 0;
-        const refused2 = session === void 0 || path53 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
-        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path53, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
+        const refused2 = session === void 0 || path54 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
+        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path54, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
       }
     },
     {
@@ -16626,9 +16632,9 @@ function requestIdOfBody(body) {
 }
 function frontDoorRcControl(transport, token) {
   const headers = { authorization: `Bearer ${token}` };
-  const listAnswerOf = async (path53, what) => {
+  const listAnswerOf = async (path54, what) => {
     try {
-      return await transport.request({ method: "GET", path: path53, headers });
+      return await transport.request({ method: "GET", path: path54, headers });
     } catch (error) {
       throw new Error(`${what}: could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
     }
@@ -16700,10 +16706,10 @@ function frontDoorRcControl(transport, token) {
     }
     return pending;
   };
-  const writeOf = async (path53, body, describeFailure2) => {
+  const writeOf = async (path54, body, describeFailure2) => {
     let answer;
     try {
-      answer = await transport.request({ method: "POST", path: path53, headers: { ...headers, "content-type": "application/json" }, body });
+      answer = await transport.request({ method: "POST", path: path54, headers: { ...headers, "content-type": "application/json" }, body });
     } catch (error) {
       return { ok: false, message: `could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}` };
     }
@@ -16734,10 +16740,10 @@ function frontDoorRcControl(transport, token) {
     endSession: async (sessionId, reason) => await writeOf(`${CONTROL_PATH_PREFIX}/end-session`, JSON.stringify({ session: sessionId, ...reason === void 0 ? {} : { reason } }), (status, message) => `ending ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getUsage: async (sessionId, skipBehaviors) => await writeOf(`${CONTROL_PATH_PREFIX}/get-usage`, JSON.stringify({ session: sessionId, ...skipBehaviors === void 0 ? {} : { skipBehaviors } }), (status, message) => `requesting the usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getContextUsage: async (sessionId, detail) => await writeOf(`${CONTROL_PATH_PREFIX}/get-context-usage`, JSON.stringify({ session: sessionId, ...detail === void 0 ? {} : { detail } }), (status, message) => `requesting the context usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
-    readFile: async (sessionId, path53, options) => await writeOf(
+    readFile: async (sessionId, path54, options) => await writeOf(
       `${CONTROL_PATH_PREFIX}/read-file`,
-      JSON.stringify({ session: sessionId, path: path53, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
-      (status, message) => `reading ${path53} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
+      JSON.stringify({ session: sessionId, path: path54, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
+      (status, message) => `reading ${path54} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
     ),
     fileSuggestions: async (sessionId, query) => await writeOf(`${CONTROL_PATH_PREFIX}/file-suggestions`, JSON.stringify({ session: sessionId, query }), (status, message) => `requesting file suggestions from ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     keepAlive: async (sessionId) => await writeOf(`${CONTROL_PATH_PREFIX}/keep-alive`, JSON.stringify({ session: sessionId }), (status, message) => `keeping ${sessionId} alive failed (HTTP ${String(status)}): ${message}`),
@@ -16896,12 +16902,12 @@ function tlsFacts(options) {
 }
 function realRcEventDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const post = async (path53, headers, body) => await new Promise((resolve, reject) => {
+  const post = async (path54, headers, body) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method: "POST",
-      path: path53,
+      path: path54,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, "content-length": String(Buffer.byteLength(body, "utf8")) },
       agent
@@ -16966,12 +16972,12 @@ function lateRcStreamDial(resolve) {
 }
 function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const request4 = async (method, path53, headers, body, signal) => await new Promise((resolve, reject) => {
+  const request4 = async (method, path54, headers, body, signal) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method,
-      path: path53,
+      path: path54,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, ...body === void 0 ? {} : { "content-length": String(Buffer.byteLength(body, "utf8")) } },
       agent,
@@ -17013,9 +17019,9 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
       return { status, body: await readAll(response) };
     },
     openStream: async (sessionId, headers, resume, signal) => {
-      const path53 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
+      const path54 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
       const streamHeaders = resume === void 0 ? headers : { ...headers, "last-event-id": String(resume.fromSequenceNum) };
-      const { status, response } = await request4("GET", path53, streamHeaders, void 0, signal);
+      const { status, response } = await request4("GET", path54, streamHeaders, void 0, signal);
       if (!isSuccessful2(status)) {
         await readAll(response);
         return { status, chunks: NO_CHUNKS };
@@ -17914,10 +17920,35 @@ init_realPorts();
 import { createORPCClient as createORPCClient2, ORPCError as ORPCError7 } from "@orpc/client";
 import { openapi as openapi8 } from "@orpc/openapi";
+// src/checkReport.ts
+init_cliError();
+import os6 from "node:os";
+// src/codex/categories.ts
+var CODEX_CATEGORIES = {
+  secret: ["auth.json", "auth.json.*", "*.sqlite*", "*.db*", "identity.json", "cap_sid", "credentials*", "secrets*"],
+  runtime: [".git*", ".DS_Store", "log", "logs", "tmp", "cache", "shell_snapshots", "models_cache.json", "version.json", "packages", "bin", "state", "otel"],
+  history: ["sessions", "archived_sessions", "history.jsonl", "session_index.jsonl", "memories"],
+  knowledge: ["AGENTS.md", "AGENTS.override.md", "skills", "rules", "agents", "prompts"],
+  settings: ["config.toml", "*.config.toml"]
+};
+// src/codex/identity.ts
+init_envBool();
+import path20 from "node:path";
+var CODEX_AMBIENT_CREDENTIALS = ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_ACCESS_TOKEN", "OPENAI_IDENTITY_TOKEN_FILE", "OPENAI_FEDERATION_RULE_ID"];
+function canonicalCodexHome(env, home) {
+  return path20.resolve(env.AGENT_SHIM_CODEX_HOME === void 0 || env.AGENT_SHIM_CODEX_HOME === "" ? path20.join(home, ".codex") : env.AGENT_SHIM_CODEX_HOME);
+}
+function codexCredentialGuard(env, allowAmbientCredential) {
+  const variable = CODEX_AMBIENT_CREDENTIALS.find((key) => (env[key] ?? "") !== "");
+  if (variable === void 0 || allowAmbientCredential || parseEnvBool("AGENT_SHIM_ALLOW_AMBIENT_CREDENTIAL", env.AGENT_SHIM_ALLOW_AMBIENT_CREDENTIAL) === true) return { ok: true };
+  return { ok: false, variable, message: `Ambient Codex credential variable ${variable} overrides the selected login. Unset it or explicitly allow ambient credentials with AGENT_SHIM_ALLOW_AMBIENT_CREDENTIAL=1 or identity set <name> --allow-ambient-credential.` };
+}
 // src/checkReport.ts
 init_classify();
 init_load();
-import os6 from "node:os";
 // src/launchSelection.ts
 init_load();
@@ -18029,7 +18060,7 @@ init_guard();
 init_providersStore();
 init_projects();
 init_pipeline();
-import path35 from "node:path";
+import path36 from "node:path";
 import { z as z24 } from "zod";
 var HISTORY_PROJECTS_KEY_PREFIX = "history/projects/";
 function projectFragmentOf(rawKey) {
@@ -18187,6 +18218,7 @@ function buildClaudeVersionReport(params, cascadePin) {
   };
 }
 function runCheck(params) {
+  const isCodex = params.agent === "codex" || params.identity?.agent === "codex";
   const facts = buildEntryFacts({
     fs: params.farmFs,
     claudeHome: params.claudeHome,
@@ -18201,7 +18233,7 @@ function runCheck(params) {
   const resolved = resolveDecisions({ facts, cascade: params.cascade, classification: params.classification });
   const decisionLines = [...resolved.decisions.values()].slice().sort((a, b) => a.relPath < b.relPath ? -1 : a.relPath > b.relPath ? 1 : 0).map(formatDecision);
   const projectEncodingAmbiguities = flagAmbiguousEncodings(resolved.flattened, facts);
-  const ambientCredential = evaluateAmbientCredentialGuard({
+  const ambientCredential = isCodex ? codexCredentialGuard(params.env, params.identity?.allowAmbientCredential ?? false) : evaluateAmbientCredentialGuard({
     env: params.env,
     allowAmbientCredential: params.identity?.allowAmbientCredential ?? false,
     allowAmbientCredentialOverride: parseEnvBool("AGENT_SHIM_ALLOW_AMBIENT_CREDENTIAL", params.env.AGENT_SHIM_ALLOW_AMBIENT_CREDENTIAL) === true,
@@ -18209,8 +18241,8 @@ function runCheck(params) {
   });
   const settingsShared = resolved.flattened.categories.get("settings") ?? SHIPPED_CATEGORY_DEFAULTS.settings;
   const settingsExposure = inspectSettingsExposure({ settingsShared, files: params.settingsFiles });
-  const keychain = params.platform === "darwin" && params.run !== void 0 && params.farmRoot !== void 0 ? lookupKeychainService(params.run, params.farmRoot) : void 0;
-  const claudeVersion = buildClaudeVersionReport(params, resolved.flattened.launch.claudeVersion);
+  const keychain = !isCodex && params.platform === "darwin" && params.run !== void 0 && params.farmRoot !== void 0 ? lookupKeychainService(params.run, params.farmRoot) : void 0;
+  const claudeVersion = isCodex ? void 0 : buildClaudeVersionReport(params, resolved.flattened.launch.claudeVersion);
   return {
     ...params.identityName === void 0 ? {} : { identityName: params.identityName },
     identitySource: params.identitySource,
@@ -18241,7 +18273,7 @@ function formatCheckReport(report) {
   }
   lines.push("", "Resolved entries:");
   if (report.decisionLines.length === 0) {
-    lines.push("  (nothing under ~/.claude to report)");
+    lines.push("  (nothing in the canonical home to report)");
   }
   for (const line of report.decisionLines) {
     lines.push(`  ${line}`);
@@ -18344,13 +18376,15 @@ function loadCheckProvider(paths, name) {
 function collectCheckReport(params) {
   const { paths, cwd } = params;
   const home = os6.homedir();
-  const claudeHome = resolveClaudeHome();
   const read = cosmiconfigReader();
-  const classification = loadClassification(paths);
   const loaded = loadCascadeInput({ paths, home, cwd, read });
   const git = resolveGitBranch(realRunPort, cwd);
-  const { selection, identityConfig } = selectLaunch({ paths, cwd, env: params.env, ...params.identity === void 0 ? {} : { identity: params.identity } }, loaded);
+  const { selection, identityConfig } = selectLaunch({ paths, cwd, env: params.agent === "codex" ? { ...params.env, CLAUDE_CONFIG_DIR: void 0 } : params.env, ...params.identity === void 0 ? {} : { identity: params.identity } }, loaded);
   const { identity: identityDecision, poolPick, configProfile: configProfileDecision } = selection;
+  const isCodex = identityConfig?.agent === "codex" || params.agent === "codex";
+  if (identityConfig !== void 0 && params.agent !== void 0 && (identityConfig.agent ?? "claude") !== params.agent) throw new UsageError("The selected identity belongs to a different agent.");
+  const claudeHome = isCodex ? canonicalCodexHome(params.env, home) : resolveClaudeHome();
+  const classification = isCodex ? { defaults: CODEX_CATEGORIES } : loadClassification(paths);
   const cascade = loadCascadeInput({
     paths,
     home,
@@ -18361,12 +18395,13 @@ function collectCheckReport(params) {
   const providerName = cascadeProviderName(cascade, identityConfig?.provider);
   const provider = providerName === void 0 ? void 0 : loadCheckProvider(paths, providerName);
   const identityId = identityDecision.name === void 0 ? void 0 : identityIdOf(paths, identityDecision.name);
-  const farmRoot = identityId === void 0 ? void 0 : path35.join(paths.identitiesDir, identityId);
-  const settingsFiles = {
-    "settings.json": realFsPort.readFileUtf8(path35.join(claudeHome, "settings.json")),
-    "settings.local.json": realFsPort.readFileUtf8(path35.join(claudeHome, "settings.local.json"))
+  const farmRoot = identityId === void 0 ? void 0 : path36.join(paths.identitiesDir, identityId);
+  const settingsFiles = isCodex ? {} : {
+    "settings.json": realFsPort.readFileUtf8(path36.join(claudeHome, "settings.json")),
+    "settings.local.json": realFsPort.readFileUtf8(path36.join(claudeHome, "settings.local.json"))
   };
   const report = runCheck({
+    ...isCodex ? { agent: "codex" } : {},
     cwd,
     home,
     claudeHome,
@@ -18387,7 +18422,7 @@ function collectCheckReport(params) {
     settingsFiles,
     run: realRunPort,
     credentialCache: realCredentialCacheEnv(paths),
-    installedClaudeVersions: realInstalledClaudeVersions(),
+    ...isCodex ? {} : { installedClaudeVersions: realInstalledClaudeVersions() },
     ...farmRoot === void 0 ? {} : { farmRoot },
     platform: process.platform,
     ...provider === void 0 ? {} : { provider }
@@ -18608,9 +18643,18 @@ var ResetRowSchema = z27.strictObject({
 var ResetScheduleSchema = z27.strictObject({ resets: z27.readonly(z27.array(ResetRowSchema)) });
 // src/frontdoor/controlSchemas.ts
-import path41 from "node:path";
+import path42 from "node:path";
 import { z as z34 } from "zod";
+// src/codex/doctor.ts
+function codexIdentityFindings(entry, identity) {
+  const incompatible = identity.provider !== void 0 || identity.credential !== void 0 || identity.anchors !== void 0;
+  return [
+    { section: "identity", severity: incompatible ? "fail" : "pass", subject: entry.name, message: incompatible ? `${entry.name} is a Codex identity with Claude-only provider, credential or anchor settings.` : `${entry.name} is a valid Codex identity; its home is ${entry.farmRoot}.` },
+    { section: "sign-in", severity: "warn", subject: entry.name, message: `Codex login not queried. Run agent-shim run --agent codex @${entry.name} login status to validate its isolated login.` }
+  ];
+}
 // src/doctorReport.ts
 init_claudeShim();
 init_readableConfig();
@@ -18621,13 +18665,13 @@ init_identityRecords();
 // src/doctorIdentityRecords.ts
 init_identityRecords();
-import path37 from "node:path";
+import path38 from "node:path";
 function identityRecordFindings(records, displaced, nameRenames, strayNameRenameFiles) {
   return [
     ...strayNameRenameFiles.map((file) => ({
       severity: "warn",
       message: `${file} holds the record of a rename of an identity's name, but not under the file name that rename keeps it in, so nothing reads it or removes it. Remove it.`,
-      subject: path37.basename(file)
+      subject: path38.basename(file)
     })),
     ...nameRenames.map(({ from, description }) => ({ severity: "fail", message: description, subject: from })),
     ...duplicateIdentityNames(records).map(({ name, ids }) => ({
@@ -18652,7 +18696,7 @@ import fs14 from "node:fs";
 init_blockingSpawn();
 init_realPorts();
 import fs12 from "node:fs";
-import path38 from "node:path";
+import path39 from "node:path";
 function realpathOrSelf(target) {
   try {
     return fs12.realpathSync(target);
@@ -18663,14 +18707,14 @@ function realpathOrSelf(target) {
 var MAX_FORWARDING_SCRIPT_BYTES = 8192;
 function resolveMiseDispatcher(target, pathDirs, env, trustedExecutable) {
   const executable = realpathOrSelf(target);
-  const trustedMise = path38.join(path38.dirname(trustedExecutable), "mise");
-  if (path38.basename(executable) !== "mise" || realpathOrSelf(trustedMise) !== executable) return void 0;
-  const result = spawnSyncBlocking("a mise shim lookup", executable, ["which", path38.basename(target)], { encoding: "utf8", env });
+  const trustedMise = path39.join(path39.dirname(trustedExecutable), "mise");
+  if (path39.basename(executable) !== "mise" || realpathOrSelf(trustedMise) !== executable) return void 0;
+  const result = spawnSyncBlocking("a mise shim lookup", executable, ["which", path39.basename(target)], { encoding: "utf8", env });
   if (result.error !== void 0) return void 0;
   if (result.status === 0 && result.stdout.trim() !== "") return result.stdout.trim();
   if (!result.stderr.includes("not currently active")) return void 0;
   for (const dir of pathDirs) {
-    const candidate = findExecutableInDir(dir, path38.basename(target));
+    const candidate = findExecutableInDir(dir, path39.basename(target));
     if (candidate !== void 0 && realpathOrSelf(candidate) !== executable) {
       try {
         const script = fs12.statSync(candidate).size <= MAX_FORWARDING_SCRIPT_BYTES ? realFsPort.readFileUtf8(candidate) : void 0;
@@ -18685,7 +18729,7 @@ function resolveMiseDispatcher(target, pathDirs, env, trustedExecutable) {
 }
 // src/doctorReport.ts
-import path40 from "node:path";
+import path41 from "node:path";
 init_signIn();
 init_identityAccounts();
 init_read();
@@ -19120,7 +19164,7 @@ function tcpPortEraRecord(raw) {
   return (has("port") || has("lastPort")) && !has("socketPath");
 }
 function pushPathResolution(push, resolution) {
-  const ownDir = path40.dirname(resolution.ownExecutablePath);
+  const ownDir = path41.dirname(resolution.ownExecutablePath);
   switch (resolution.agentShim.status) {
     case "ok":
       push("path-resolution", "pass", `\`agent-shim\` on PATH resolves to this running executable, ${resolution.ownExecutablePath}.`, "agent-shim");
@@ -19240,14 +19284,14 @@ function pushProvider(push, entry, cacheEnv, signIn) {
 }
 function pushLegacyName(push, params) {
   const legacyVariables = Object.keys(params.env).filter((name) => name.startsWith(LEGACY_ENV_PREFIX) && params.env[name] !== void 0).sort();
-  if (legacyVariables.length === 0 && path40.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
+  if (legacyVariables.length === 0 && path41.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
     push("legacy-name", "pass", "Nothing here still uses the former `claude-use` name.");
     return;
   }
   for (const name of legacyVariables) {
     push("legacy-name", "warn", `${name} is the former name of ${name.replace(LEGACY_ENV_PREFIX, ENV_PREFIX)}. Rename it; the old name still works but is only a fallback.`, name);
   }
-  if (path40.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
+  if (path41.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
     push(
       "legacy-name",
       "warn",
@@ -19341,9 +19385,9 @@ function runDoctor(params) {
     push("identity", "warn", `identities/${name} cannot be reached (${code}), so it is not counted as an identity. Repair the permissions of the directory or of what a symlink points through, or remove the entry.`, name);
   }
   for (const { file, detail } of params.renameJournals?.unreadable ?? []) {
-    push("identity", "fail", `${file} is not a rename journal this agent-shim can read (${detail}), so no identity can be renamed until it is fixed or removed, and it may be the trace of a rename that was left unfinished.`, path40.basename(file));
+    push("identity", "fail", `${file} is not a rename journal this agent-shim can read (${detail}), so no identity can be renamed until it is fixed or removed, and it may be the trace of a rename that was left unfinished.`, path41.basename(file));
   }
-  const validIdentityNames = /* @__PURE__ */ new Set();
+  const validIdentityAgents = /* @__PURE__ */ new Map();
   const signedInAccounts = [];
   for (const entry of params.identities) {
     const validated3 = validate(IdentitySchema, entry, "identity", entry.name);
@@ -19351,7 +19395,7 @@ function runDoctor(params) {
       push("identity", "fail", validated3.message, entry.name);
       continue;
     }
-    validIdentityNames.add(entry.name);
+    validIdentityAgents.set(entry.name, validated3.data.agent ?? "claude");
     const defaultProfile = validated3.data.defaultConfigProfile;
     let consistent = true;
     if (defaultProfile !== void 0 && !validProfileNames.has(defaultProfile)) {
@@ -19371,6 +19415,10 @@ function runDoctor(params) {
     if (!consistent) {
       continue;
     }
+    if (validated3.data.agent === "codex") {
+      findings.push(...codexIdentityFindings(entry, validated3.data));
+      continue;
+    }
     const credential = validated3.data.credential;
     const cache = credential === void 0 ? { text: "", unreadable: false } : cacheClause(params.credentialCache, identityCacheKey(entry.id), credential);
     const authenticatesWith = credential !== void 0 ? `credential ${describeCredential(credential)}` : identityProvider !== void 0 ? `the credential of provider "${identityProvider}"` : "its stored login";
@@ -19409,9 +19457,9 @@ function runDoctor(params) {
   }
   const validatedGlobalConfig = params.globalConfig.raw === void 0 ? void 0 : validateJson(GlobalConfigSchema, params.globalConfig);
   const pools = validatedGlobalConfig?.ok === true ? validatedGlobalConfig.data.pools ?? {} : {};
-  const accountByIdentity = new Map(params.identities.flatMap((entry) => validIdentityNames.has(entry.name) && entry.account !== void 0 ? [[entry.name, entry.account]] : []));
+  const accountByIdentity = new Map(params.identities.flatMap((entry) => validIdentityAgents.has(entry.name) && entry.account !== void 0 ? [[entry.name, entry.account]] : []));
   for (const [poolName, pool] of Object.entries(pools)) {
-    const missing = pool.identities.filter((member) => poolNameOf(poolMemberIdentity(member)) === void 0 && !validIdentityNames.has(poolMemberIdentity(member)));
+    const missing = pool.identities.filter((member) => poolNameOf(poolMemberIdentity(member)) === void 0 && !validIdentityAgents.has(poolMemberIdentity(member)));
     const undefinedPools = pool.identities.flatMap((member) => {
       const nested = poolNameOf(poolMemberIdentity(member));
       return nested === void 0 || nested in pools ? [] : [nested];
@@ -19455,7 +19503,7 @@ function runDoctor(params) {
   }
   const selectionExists = (selector) => {
     const poolName = poolNameOf(selector);
-    return poolName === void 0 ? validIdentityNames.has(selector) : poolName in pools;
+    return poolName === void 0 ? validIdentityAgents.has(selector) : poolName in pools;
   };
   for (const entry of params.providers) {
     if (!pushNameFinding(push, "provider", "provider", entry)) {
@@ -19471,6 +19519,7 @@ function runDoctor(params) {
     push("keychain", "pass", "Skipped (not macOS).");
   } else {
     for (const entry of params.identities) {
+      if (validIdentityAgents.get(entry.name) === "codex") continue;
       const result = lookupKeychainService(params.run, entry.farmRoot);
       push("keychain", "pass", result.found ? result.note : `${result.note} The sign-in section reports whether a login is stored elsewhere.`, entry.name);
     }
@@ -19701,9 +19750,9 @@ function collectDoctorReport(params) {
   const { names: identityNames, unreachable: unreachableIdentities } = listIdentityDirectories(paths);
   const records = identityRecords(paths);
   const displacedIdentities = records.filter((record) => !identityIdExists(paths, record.id) && !unreachableIdentities.some((entry) => entry.name === record.id));
-  const identities = identityNames.filter((id) => (records.some((record) => record.id === id) || !fs14.existsSync(path40.join(paths.identitiesDir, id, "identity.json"))) && !displacedIdentities.some((record) => record.id === id)).map((id) => {
-    const farmRoot = path40.join(paths.identitiesDir, id);
-    const identityPath = path40.join(farmRoot, "identity.json");
+  const identities = identityNames.filter((id) => (records.some((record) => record.id === id) || !fs14.existsSync(path41.join(paths.identitiesDir, id, "identity.json"))) && !displacedIdentities.some((record) => record.id === id)).map((id) => {
+    const farmRoot = path41.join(paths.identitiesDir, id);
+    const identityPath = path41.join(farmRoot, "identity.json");
     return { name: identityNameIn(records, id) ?? id, id, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot, credentialsFilePresent: fs14.existsSync(credentialsFilePath(farmRoot)), account: readIdentityAccount(realFsPort, paths.identitiesDir, id)?.account };
   });
   const usageSnapshots = {};
@@ -19721,12 +19770,12 @@ function collectDoctorReport(params) {
   }
   const profileNames = fs14.existsSync(paths.configProfilesDir) ? fs14.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const configProfiles = profileNames.map((name) => {
-    const profilePath = path40.join(paths.configProfilesDir, `${name}.json`);
+    const profilePath = path41.join(paths.configProfilesDir, `${name}.json`);
     return { name, path: profilePath, raw: realFsPort.readFileUtf8(profilePath) };
   });
   const providerNames = fs14.existsSync(paths.providersDir) ? fs14.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const providers = providerNames.map((name) => {
-    const providerPath = path40.join(paths.providersDir, `${name}.json`);
+    const providerPath = path41.join(paths.providersDir, `${name}.json`);
     return { name, path: providerPath, raw: realFsPort.readFileUtf8(providerPath) };
   });
   const ownExecutablePath = realOwnExecutablePath();
@@ -19738,12 +19787,12 @@ function collectDoctorReport(params) {
     binaryDiscovery = { ok: false, message: error instanceof Error ? error.message : String(error) };
   }
   const shimState = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-  const pathDirs = (params.env.PATH ?? "").split(path40.delimiter).filter((dir) => dir !== "");
+  const pathDirs = (params.env.PATH ?? "").split(path41.delimiter).filter((dir) => dir !== "");
   const claudeShimShadow = shimState === void 0 ? void 0 : refinePathShadow(
     findPathShadow({
       pathDirs,
-      targetDir: path40.dirname(shimState.targetPath),
-      targetFilename: path40.basename(shimState.targetPath),
+      targetDir: path41.dirname(shimState.targetPath),
+      targetFilename: path41.basename(shimState.targetPath),
       findExecutableInDir
     }),
     shimState.targetPath,
@@ -19769,7 +19818,7 @@ function collectDoctorReport(params) {
     providerAliases: readProviderAliases(paths),
     renameJournals: listRenameJournals(realFarmFs, paths.identityRenamesDir),
     unreachableIdentities,
-    identityRecords: { all: records, displaced: displacedIdentities.map((record) => ({ ...record, directoryPresent: fs14.existsSync(path40.join(paths.identitiesDir, record.id)) })), nameRenames: unfinishedNameRenames(paths).map((record) => ({ from: record.from, description: describeInterruptedNameRename(paths, record) })), strayNameRenameFiles: strayNameRenameRecordFiles(paths) },
+    identityRecords: { all: records, displaced: displacedIdentities.map((record) => ({ ...record, directoryPresent: fs14.existsSync(path41.join(paths.identitiesDir, record.id)) })), nameRenames: unfinishedNameRenames(paths).map((record) => ({ from: record.from, description: describeInterruptedNameRename(paths, record) })), strayNameRenameFiles: strayNameRenameRecordFiles(paths) },
     directoryRules: { path: paths.directoryRulesFile, raw: realFsPort.readFileUtf8(paths.directoryRulesFile) },
     globalConfig: { path: paths.globalConfigFile, raw: realFsPort.readFileUtf8(paths.globalConfigFile) },
     models: readableOr(() => readGlobalConfig(paths)?.models, void 0),
@@ -19784,7 +19833,7 @@ function collectDoctorReport(params) {
       agentShim: refinePathShadow(
         findPathShadow({
           pathDirs,
-          targetDir: path40.dirname(ownExecutablePath),
+          targetDir: path41.dirname(ownExecutablePath),
           targetFilename: commandFilename(ownExecutablePath, "agent-shim"),
           findExecutableInDir
         }),
@@ -19875,11 +19924,11 @@ var FrontDoorSessionsOutputSchema = z34.strictObject({ sessions: z34.readonly(z3
 var CheckRunInputSchema = z34.strictObject({
   path: z34.string().min(1),
   identity: z34.string().min(1).optional()
-}).refine((input) => path41.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+}).refine((input) => path42.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
 var PoolPickInputSchema = z34.strictObject({
   pool: z34.string().min(1),
   path: z34.string().min(1)
-}).refine((input) => path41.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+}).refine((input) => path42.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
 var DoctorFindingSchema = z34.strictObject({
   section: z34.enum(DOCTOR_SECTIONS),
   subject: z34.string().optional(),
@@ -20215,7 +20264,7 @@ function profileValue(name, paths) {
 function createConfigApiRouter(deps) {
   const authed = doorApiAuth(deps.expectedToken);
   const { paths } = deps;
-  const route = (path53, summary) => authed.meta(openapi3({ method: "POST", path: path53, summary, tags: [CONFIG_API_TAG] }));
+  const route = (path54, summary) => authed.meta(openapi3({ method: "POST", path: path54, summary, tags: [CONFIG_API_TAG] }));
   return {
     config: {
       identity: {
@@ -20617,7 +20666,7 @@ import { ORPCError as ORPCError5 } from "@orpc/client";
 import { openapi as openapi6 } from "@orpc/openapi";
 // src/frontdoor/launchSchemas.ts
-import path42 from "node:path";
+import path43 from "node:path";
 import { z as z38 } from "zod";
 init_statusline();
 init_claudeVersion();
@@ -20628,7 +20677,7 @@ var LaunchResolveInputSchema = z38.strictObject({
   argv: z38.readonly(z38.array(z38.string())).optional(),
   /** The launch's inherited environment. Absent means an empty one: the door's own environment is never a substitute for the caller's, so a caller that wants `AGENT_SHIM_*` switches or a `CLAUDE_CONFIG_DIR` considered names them here. Values are read, never reported. */
   env: z38.record(z38.string(), z38.string()).optional()
-}).refine((input) => path42.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+}).refine((input) => path43.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
 var LaunchPoolDecisionSchema = z38.strictObject({
   name: z38.string(),
   reasons: z38.readonly(z38.array(z38.string())),
@@ -22811,7 +22860,7 @@ data: ${JSON.stringify(envelope)}
 // src/frontdoor/rcSelfHostMint.ts
 init_identityRecords();
 init_account();
-import path43 from "node:path";
+import path44 from "node:path";
 var CREDENTIALS_FILE2 = ".credentials.json";
 var CLAUDE_JSON2 = ".claude.json";
 var RC_SELF_HOST_RECORD_DIR = "rc-selfhost";
@@ -22835,7 +22884,7 @@ function readJsonObject(fs17, file) {
   return isRecord14(parsed) ? parsed : void 0;
 }
 function readRcSelfHostRecord(fs17, frontdoorDir) {
-  const parsed = readJsonObject(fs17, path43.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
+  const parsed = readJsonObject(fs17, path44.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
   if (parsed === void 0) {
     return void 0;
   }
@@ -22853,11 +22902,11 @@ function mintRcSelfHostCredential(deps) {
   if (id === void 0) {
     throw new Error(`No identity named "${deps.identity}".`);
   }
-  const identityDir = path43.join(deps.identitiesDir, id);
-  const credentialsFile = path43.join(identityDir, CREDENTIALS_FILE2);
-  const claudeJsonFile = path43.join(identityDir, CLAUDE_JSON2);
-  const recordDir = path43.join(deps.frontdoorDir, RC_SELF_HOST_RECORD_DIR);
-  const recordFile2 = path43.join(recordDir, RC_SELF_HOST_RECORD_FILE);
+  const identityDir = path44.join(deps.identitiesDir, id);
+  const credentialsFile = path44.join(identityDir, CREDENTIALS_FILE2);
+  const claudeJsonFile = path44.join(identityDir, CLAUDE_JSON2);
+  const recordDir = path44.join(deps.frontdoorDir, RC_SELF_HOST_RECORD_DIR);
+  const recordFile2 = path44.join(recordDir, RC_SELF_HOST_RECORD_FILE);
   const previousRecord = readRcSelfHostRecord(deps.fs, deps.frontdoorDir);
   const existingCredentials = readJsonObject(deps.fs, credentialsFile);
   const existingOauth = isRecord14(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
@@ -22873,7 +22922,7 @@ function mintRcSelfHostCredential(deps) {
   const organizationUuid = deps.newUuid();
   const accountUuid = deps.newUuid();
   const mintedAt = new Date(deps.now()).toISOString();
-  deps.fs.mkdirPrivate(path43.dirname(credentialsFile));
+  deps.fs.mkdirPrivate(path44.dirname(credentialsFile));
   deps.fs.writeFilePrivate(credentialsFile, `${JSON.stringify({ ...existingCredentials, claudeAiOauth: { accessToken, refreshToken, expiresAt: null, scopes: [...RC_SELF_HOST_SCOPE_LIST], subscriptionType: SELF_HOST_SUBSCRIPTION_TYPE, rateLimitTier: null } }, null, 2)}
 `);
   const claudeJson = readJsonObject(deps.fs, claudeJsonFile) ?? {};
@@ -22911,7 +22960,7 @@ init_ensure2();
 // src/frontdoor/liveSessionRegistry.ts
 init_capability();
 init_state();
-import path44 from "node:path";
+import path45 from "node:path";
 function sameStat(recorded, current) {
   return recorded?.mtimeMs === current.mtimeMs && recorded.sizeBytes === current.sizeBytes;
 }
@@ -22929,7 +22978,7 @@ function createLiveSessionRegistry(ports) {
   const load = (name, stat) => {
     known.set(name, { stat: { mtimeMs: stat.mtimeMs, sizeBytes: stat.sizeBytes }, record: readFrontDoorSessionRecord(fs17, sessionsDir, name) });
   };
-  const statOf = (name) => fs17.lstat(path44.join(sessionsDir, name));
+  const statOf = (name) => fs17.lstat(path45.join(sessionsDir, name));
   const reconcile = () => {
     const names = new Set(recordNames());
     let changed = false;
@@ -22996,7 +23045,7 @@ init_plan2();
 init_poolPick();
 // src/agents/read.ts
-import path45 from "node:path";
+import path46 from "node:path";
 import { z as z40 } from "zod";
 var PROJECTS_DIR = "projects";
 var TASKS_DIR = "tasks";
@@ -23022,15 +23071,15 @@ function parseEntry2(project, entry) {
 }
 function listSessions2(fs17, configDir) {
   const found = [];
-  for (const project of fs17.readdir(path45.join(configDir, PROJECTS_DIR))) {
-    const projectDir = path45.join(configDir, PROJECTS_DIR, project);
+  for (const project of fs17.readdir(path46.join(configDir, PROJECTS_DIR))) {
+    const projectDir = path46.join(configDir, PROJECTS_DIR, project);
     const entries = /* @__PURE__ */ new Set();
     for (const name of fs17.readdir(projectDir)) {
       if (name.endsWith(TRANSCRIPT_SUFFIX)) {
         entries.add(name.slice(0, -TRANSCRIPT_SUFFIX.length));
         continue;
       }
-      const children = fs17.readdir(path45.join(projectDir, name));
+      const children = fs17.readdir(path46.join(projectDir, name));
       if (children.includes(SUBAGENTS_DIR) || children.includes(WORKFLOWS_DIR)) {
         entries.add(name);
       }
@@ -23050,8 +23099,8 @@ function locateAgents(fs17, configDir, relativeDir, workflowRunId, report) {
     const id = name.slice(AGENT_FILE_PREFIX.length, -META_SUFFIX.length);
     located.push({
       id,
-      metaPath: path45.join(relativeDir, name),
-      transcriptPath: path45.join(relativeDir, `${AGENT_FILE_PREFIX}${id}${TRANSCRIPT_SUFFIX}`),
+      metaPath: path46.join(relativeDir, name),
+      transcriptPath: path46.join(relativeDir, `${AGENT_FILE_PREFIX}${id}${TRANSCRIPT_SUFFIX}`),
       workflowRunId
     });
   }
@@ -23094,7 +23143,7 @@ function describeFailure(error) {
 }
 function readFileOrReport(fs17, configDir, relative, report) {
   try {
-    return fs17.readFileUtf8(path45.join(configDir, relative));
+    return fs17.readFileUtf8(path46.join(configDir, relative));
   } catch (error) {
     report({ path: relative, reason: `could not be read: ${describeFailure(error)}` });
     return void 0;
@@ -23102,7 +23151,7 @@ function readFileOrReport(fs17, configDir, relative, report) {
 }
 function listDirOrReport(fs17, configDir, relative, report) {
   try {
-    return fs17.readdir(path45.join(configDir, relative));
+    return fs17.readdir(path46.join(configDir, relative));
   } catch (error) {
     report({ path: relative, reason: `could not be listed: ${describeFailure(error)}` });
     return [];
@@ -23126,18 +23175,18 @@ var WorkflowRunFileSchema = z40.object({
   summary: z40.string().optional()
 });
 function summariseSession(fs17, configDir, ref) {
-  const sessionRelative = path45.join(PROJECTS_DIR, ref.project, ref.entry);
-  const subagentsRelative = path45.join(sessionRelative, SUBAGENTS_DIR);
-  const workflowsUnderSubagents = path45.join(subagentsRelative, WORKFLOWS_DIR);
+  const sessionRelative = path46.join(PROJECTS_DIR, ref.project, ref.entry);
+  const subagentsRelative = path46.join(sessionRelative, SUBAGENTS_DIR);
+  const workflowsUnderSubagents = path46.join(subagentsRelative, WORKFLOWS_DIR);
   const isMeta = (name) => name.startsWith(AGENT_FILE_PREFIX) && name.endsWith(META_SUFFIX);
-  let agentCount = fs17.readdir(path45.join(configDir, subagentsRelative)).filter(isMeta).length;
-  for (const runDir of fs17.readdir(path45.join(configDir, workflowsUnderSubagents))) {
+  let agentCount = fs17.readdir(path46.join(configDir, subagentsRelative)).filter(isMeta).length;
+  for (const runDir of fs17.readdir(path46.join(configDir, workflowsUnderSubagents))) {
     if (runDir.startsWith(WORKFLOW_RUN_PREFIX)) {
-      agentCount += fs17.readdir(path45.join(configDir, workflowsUnderSubagents, runDir)).filter(isMeta).length;
+      agentCount += fs17.readdir(path46.join(configDir, workflowsUnderSubagents, runDir)).filter(isMeta).length;
     }
   }
-  const workflowRunCount = fs17.readdir(path45.join(configDir, sessionRelative, WORKFLOWS_DIR)).filter((name) => name.startsWith(WORKFLOW_RUN_PREFIX) && name.endsWith(JSON_SUFFIX)).length;
-  const transcript = fs17.lstat(path45.join(configDir, PROJECTS_DIR, ref.project, `${ref.entry}${TRANSCRIPT_SUFFIX}`));
+  const workflowRunCount = fs17.readdir(path46.join(configDir, sessionRelative, WORKFLOWS_DIR)).filter((name) => name.startsWith(WORKFLOW_RUN_PREFIX) && name.endsWith(JSON_SUFFIX)).length;
+  const transcript = fs17.lstat(path46.join(configDir, PROJECTS_DIR, ref.project, `${ref.entry}${TRANSCRIPT_SUFFIX}`));
   return { ...ref, agentCount, workflowRunCount, ...transcript === void 0 ? {} : { updatedAt: new Date(transcript.mtimeMs).toISOString() } };
 }
 function readSessionAgentTree(fs17, configDir, ref, options = {}) {
@@ -23145,13 +23194,13 @@ function readSessionAgentTree(fs17, configDir, ref, options = {}) {
   const report = (problem) => {
     problems.push(problem);
   };
-  const sessionRelative = path45.join(PROJECTS_DIR, ref.project, ref.entry);
-  const subagentsRelative = path45.join(sessionRelative, SUBAGENTS_DIR);
-  const workflowsUnderSubagents = path45.join(subagentsRelative, WORKFLOWS_DIR);
+  const sessionRelative = path46.join(PROJECTS_DIR, ref.project, ref.entry);
+  const subagentsRelative = path46.join(sessionRelative, SUBAGENTS_DIR);
+  const workflowsUnderSubagents = path46.join(subagentsRelative, WORKFLOWS_DIR);
   const located = locateAgents(fs17, configDir, subagentsRelative, void 0, report);
   for (const runDir of listDirOrReport(fs17, configDir, workflowsUnderSubagents, report)) {
     if (runDir.startsWith(WORKFLOW_RUN_PREFIX)) {
-      located.push(...locateAgents(fs17, configDir, path45.join(workflowsUnderSubagents, runDir), runDir, report));
+      located.push(...locateAgents(fs17, configDir, path46.join(workflowsUnderSubagents, runDir), runDir, report));
     }
   }
   const agents = /* @__PURE__ */ new Map();
@@ -23192,7 +23241,7 @@ function readSessionAgentTree(fs17, configDir, ref, options = {}) {
     superseded: ref.superseded,
     agents: roots.sort().map(build),
     tasks: readTasks(fs17, configDir, ownTaskLists(ref.sessionId), [.../* @__PURE__ */ new Set([...teamNames, ...options.taskListIds ?? []])].filter((id) => !ownTaskLists(ref.sessionId).includes(id)), report),
-    workflowRuns: readWorkflowRuns(fs17, configDir, path45.join(sessionRelative, WORKFLOWS_DIR), report),
+    workflowRuns: readWorkflowRuns(fs17, configDir, path46.join(sessionRelative, WORKFLOWS_DIR), report),
     problems
   };
 }
@@ -23257,12 +23306,12 @@ function ownTaskLists(sessionId) {
 function readTasks(fs17, configDir, ownLists, sharedLists, report) {
   const tasks = [];
   [...ownLists, ...sharedLists].forEach((scope, index) => {
-    const relativeDir = path45.join(TASKS_DIR, scope);
+    const relativeDir = path46.join(TASKS_DIR, scope);
     for (const name of [...listDirOrReport(fs17, configDir, relativeDir, report)].sort()) {
       if (name.startsWith(".") || !name.endsWith(JSON_SUFFIX)) {
         continue;
       }
-      const relative = path45.join(relativeDir, name);
+      const relative = path46.join(relativeDir, name);
       const text = readFileOrReport(fs17, configDir, relative, report);
       const parsed = TaskFileSchema.safeParse(text === void 0 ? void 0 : parseJson2(text));
       if (parsed.success) {
@@ -23280,7 +23329,7 @@ function readWorkflowRuns(fs17, configDir, relativeDir, report) {
     if (!name.startsWith(WORKFLOW_RUN_PREFIX) || !name.endsWith(JSON_SUFFIX)) {
       continue;
     }
-    const relative = path45.join(relativeDir, name);
+    const relative = path46.join(relativeDir, name);
     const text = readFileOrReport(fs17, configDir, relative, report);
     const parsed = WorkflowRunFileSchema.safeParse(text === void 0 ? void 0 : parseJson2(text));
     if (!parsed.success) {
@@ -23297,7 +23346,7 @@ function readWorkflowRuns(fs17, configDir, relativeDir, report) {
 // src/agents/sessions.ts
 init_cliError();
-import path46 from "node:path";
+import path47 from "node:path";
 var SessionLookupError = class extends CliError {
   constructor(message) {
     super(message);
@@ -23308,7 +23357,7 @@ function historyStores(fs17, configDirOf, identities) {
   const byRealPath = /* @__PURE__ */ new Map();
   for (const identity of identities) {
     const configDir = configDirOf(identity);
-    const real = fs17.realpath(path46.join(configDir, "projects"));
+    const real = fs17.realpath(path47.join(configDir, "projects"));
     if (real === void 0) {
       continue;
     }