agent-shim 11.86.4 → 11.87.0

package/dist/types/index.d.ts

@@ -5417,6 +5417,10 @@ type GlobalConfig = z.infer<typeof GlobalConfigSchema>;
  * An identity's own `identity.json`. `credential`, when present, authenticates the identity from a token instead of (or ahead of) its stored login: the launcher resolves it and exports it as its target (typically `oauthToken`, a `claude setup-token` token) in the child's environment only. Without it the identity uses the login stored in its own directory.
  */
 declare const IdentitySchema: z.ZodObject<{
+    agent: z.ZodOptional<z.ZodEnum<{
+        claude: "claude";
+        codex: "codex";
+    }>>;
     $schema: z.ZodOptional<z.ZodString>;
     name: z.ZodString;
     label: z.ZodOptional<z.ZodString>;
@@ -8171,6 +8175,14 @@ declare function readCodexRateLimits(port: CodexAppServerPort, options: Readonly
 /** The real app-server port: `codex app-server` as a child process speaking one JSON message per line on standard input and output, with `CODEX_HOME` set for it alone. */
 declare const realCodexAppServerPort: CodexAppServerPort;
 
+type CodexCredentialGuardResult = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly variable: string;
+    readonly message: string;
+};
+
 /**
  * The Zod schema of `agent-shim check --json`'s output: one definition of the report's wire shape, so the JSON conversion (`checkReportToJson`, whose return type is this schema's inferred type, which makes the compiler prove the two agree) and every programmatic consumer of the report (the front door's `check.run` procedure above all) validate through the same source. A plain Zod leaf mirroring the shapes the report's own modules define; the vocabularies it switches on (layer kinds, decision routes, diagnostic codes and severities, decision sources) are imported as const arrays from those modules rather than restated here, so a vocabulary added there is a compile error here until this schema names it.
  */
@@ -8799,6 +8811,7 @@ interface CredentialReport {
 }
 /** Inputs to `runCheck` — everything already loaded/injected, exactly like the resolver core and the launcher: nothing in this function touches a real filesystem, git repository, clock, or environment itself. */
 interface RunCheckParams {
+    readonly agent?: "claude" | "codex";
     readonly cwd: string;
     readonly home: string;
     readonly claudeHome: string;
@@ -8848,7 +8861,7 @@ interface CheckReport {
     readonly resolved: ResolvedState;
     readonly decisionLines: readonly string[];
     readonly projectEncodingAmbiguities: readonly EncodingAmbiguity[];
-    readonly ambientCredential: AmbientCredentialGuardResult;
+    readonly ambientCredential: AmbientCredentialGuardResult | CodexCredentialGuardResult;
     readonly keychain?: KeychainLookupResult;
     readonly settingsExposure: readonly SettingsExposureReport[];
     readonly credential: CredentialReport;
@@ -8881,6 +8894,7 @@ declare function checkReportToJson(report: CheckReport): CheckReportJson;
 declare function checkReportHasWarnings(report: CheckReport): boolean;
 /** What `collectCheckReport` needs from its caller. */
 interface CollectCheckReportParams {
+    readonly agent?: "claude" | "codex";
     readonly paths: LayoutPaths;
     /** The directory a launch would run in; resolved against the working directory by the caller. */
     readonly cwd: string;
@@ -9187,6 +9201,7 @@ declare function readIdentity(paths: LayoutPaths, name: string): Identity | unde
 declare function readIdentityById(paths: LayoutPaths, id: string): Identity | undefined;
 /** How `addIdentity` reaches what it needs beyond the files: the identity names lock, and, for an add whose id was checked before the lock was taken (`requireIdentityAddable`), that id. */
 interface AddIdentityOptions {
+    readonly agent?: "claude" | "codex";
     readonly namesLock?: IdentityNamesLockPorts;
     readonly checkedId?: string;
 }
@@ -11611,8 +11626,8 @@ declare function createConfigApiRouter(deps: ConfigApiDeps): {
             add: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
                 name: zod.ZodString;
                 kind: zod.ZodOptional<zod.ZodEnum<{
-                    http: "http";
                     codex: "codex";
+                    http: "http";
                     antigravity: "antigravity";
                     router: "router";
                 }>>;
@@ -11675,8 +11690,8 @@ declare function createConfigApiRouter(deps: ConfigApiDeps): {
                 value: zod.ZodObject<{
                     name: zod.ZodString;
                     kind: zod.ZodEnum<{
-                        http: "http";
                         codex: "codex";
+                        http: "http";
                         antigravity: "antigravity";
                         router: "router";
                     }>;
@@ -11798,8 +11813,8 @@ declare function createConfigApiRouter(deps: ConfigApiDeps): {
                 value: zod.ZodObject<{
                     name: zod.ZodString;
                     kind: zod.ZodEnum<{
-                        http: "http";
                         codex: "codex";
+                        http: "http";
                         antigravity: "antigravity";
                         router: "router";
                     }>;
@@ -18799,8 +18814,8 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
             add: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
                 name: zod.ZodString;
                 kind: zod.ZodOptional<zod.ZodEnum<{
-                    http: "http";
                     codex: "codex";
+                    http: "http";
                     antigravity: "antigravity";
                     router: "router";
                 }>>;
@@ -18863,8 +18878,8 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                 value: zod.ZodObject<{
                     name: zod.ZodString;
                     kind: zod.ZodEnum<{
-                        http: "http";
                         codex: "codex";
+                        http: "http";
                         antigravity: "antigravity";
                         router: "router";
                     }>;
@@ -18986,8 +19001,8 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                 value: zod.ZodObject<{
                     name: zod.ZodString;
                     kind: zod.ZodEnum<{
-                        http: "http";
                         codex: "codex";
+                        http: "http";
                         antigravity: "antigravity";
                         router: "router";
                     }>;
@@ -23337,8 +23352,8 @@ declare const ConfigPoolUseOutputSchema: z.ZodObject<{
 declare const ConfigProviderAddInputSchema: z.ZodObject<{
     name: z.ZodString;
     kind: z.ZodOptional<z.ZodEnum<{
-        http: "http";
         codex: "codex";
+        http: "http";
         antigravity: "antigravity";
         router: "router";
     }>>;
@@ -23402,8 +23417,8 @@ declare const ConfigProviderAddOutputSchema: z.ZodObject<{
     value: z.ZodObject<{
         name: z.ZodString;
         kind: z.ZodEnum<{
-            http: "http";
             codex: "codex";
+            http: "http";
             antigravity: "antigravity";
             router: "router";
         }>;
@@ -23527,8 +23542,8 @@ declare const ConfigProviderSetOutputSchema: z.ZodObject<{
     value: z.ZodObject<{
         name: z.ZodString;
         kind: z.ZodEnum<{
-            http: "http";
             codex: "codex";
+            http: "http";
             antigravity: "antigravity";
             router: "router";
         }>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-shim",
-  "version": "11.86.4",
+  "version": "11.87.0",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",