agent-shim 8.15.0 → 8.17.0

package/dist/index.cjs

@@ -46,6 +46,8 @@ __export(index_exports, {
   CredentialCacheSchema: () => CredentialCacheSchema,
   CredentialSchema: () => CredentialSchema,
   CredentialSourceSchema: () => CredentialSourceSchema,
+  DOOR_EVENT_BUFFER_EVENTS: () => DOOR_EVENT_BUFFER_EVENTS,
+  DOOR_EVENT_SOURCE_RC: () => DOOR_EVENT_SOURCE_RC,
   DirectoryRuleAlreadyExistsError: () => DirectoryRuleAlreadyExistsError,
   DirectoryRuleMissingTargetError: () => DirectoryRuleMissingTargetError,
   DirectoryRuleNotFoundError: () => DirectoryRuleNotFoundError,
@@ -53,6 +55,8 @@ __export(index_exports, {
   DirectoryRulesSchema: () => DirectoryRulesSchema,
   DoctorFindingSchema: () => DoctorFindingSchema,
   DoctorRunOutputSchema: () => DoctorRunOutputSchema,
+  DoorEventSchema: () => DoorEventSchema,
+  DoorEventSourceQuerySchema: () => DoorEventSourceQuerySchema,
   EXIT_FAILURE: () => EXIT_FAILURE,
   EXIT_USAGE: () => EXIT_USAGE,
   EffectiveWindowSchema: () => EffectiveWindowSchema,
@@ -72,6 +76,8 @@ __export(index_exports, {
   InvalidCategoryNameError: () => InvalidCategoryNameError,
   InvalidIdentityNameError: () => InvalidIdentityNameError,
   InvalidProviderNameError: () => InvalidProviderNameError,
+  LAUNCH_EVENT_SOURCE: () => LAUNCH_EVENT_SOURCE,
+  LaunchLifecycleEventSchema: () => LaunchLifecycleEventSchema,
   LaunchRefusedError: () => LaunchRefusedError,
   LegacyProviderFileError: () => LegacyProviderFileError,
   PROMPT_CACHE_TTL_MS: () => PROMPT_CACHE_TTL_MS,
@@ -135,6 +141,9 @@ __export(index_exports, {
   createControlApiRouter: () => createControlApiRouter,
   createDoorApiNodeHandler: () => createDoorApiNodeHandler,
   createDoorApiRouter: () => createDoorApiRouter,
+  createDoorEventHub: () => createDoorEventHub,
+  createEventsApiRouter: () => createEventsApiRouter,
+  createLaunchEventPublisher: () => createLaunchEventPublisher,
   createLeafCache: () => createLeafCache,
   createProfile: () => createProfile,
   createRcApiNodeHandler: () => createRcApiNodeHandler,
@@ -193,6 +202,7 @@ __export(index_exports, {
   providerExists: () => providerExists,
   rankPool: () => rankPool,
   rcEventWriteResultFromAnswer: () => rcEventWriteResultFromAnswer,
+  rcFanoutOnDoorHub: () => rcFanoutOnDoorHub,
   rcObserverAsPassthrough: () => rcObserverAsPassthrough,
   rcSelfHostFromEnv: () => rcSelfHostFromEnv,
   readActiveIdentity: () => readActiveIdentity,
@@ -507,6 +517,7 @@ var ProviderEnvSchema = import_zod.z.record(import_zod.z.string().min(1), import
   message: `env may not set ${RESERVED_PROVIDER_ENV_KEYS.join(", ")}: the credential block's target sets one and agent-shim removes the others`
 });
 var CODEX_EFFORTS = ["none", "low", "medium", "high"];
+var CODEX_LOGINS = ["codex-cli", "chatgpt-sign-in"];
 var CODEX_DEFAULT_TIER_MODELS = Object.freeze({
   fable: "gpt-5.6-sol",
   opus: "gpt-5.6-sol",
@@ -524,7 +535,9 @@ var CodexProviderConfigSchema = import_zod.z.strictObject({
     haiku: import_zod.z.string().min(1).optional()
   }).optional(),
   /** The reasoning effort used when the request's own `output_config.effort` is not one the backend accepts. */
-  effort: import_zod.z.enum(CODEX_EFFORTS).optional()
+  effort: import_zod.z.enum(CODEX_EFFORTS).optional(),
+  /** Which login the upstream call is made with; see `CODEX_LOGINS`. */
+  login: import_zod.z.enum(CODEX_LOGINS).optional()
 });
 var HttpProviderSchema = import_zod.z.strictObject({
   $schema: import_zod.z.string().optional(),
@@ -3013,8 +3026,11 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
       return FRONTDOOR_SUPERVISOR_STILL_RUNNING;
     }
     ticks += 1;
-    pruneDeadFrontDoorSessions(fs12, paths.frontdoorSessionsDir, ports.isRunning);
-    if (listFrontDoorSessions(fs12, paths.frontdoorSessionsDir).length === 0) {
+    const listed = listFrontDoorSessions(fs12, paths.frontdoorSessionsDir);
+    const pruned = pruneDeadFrontDoorSessions(fs12, paths.frontdoorSessionsDir, ports.isRunning);
+    ports.observeLaunchRegistry(listed, pruned);
+    const prunedPids = new Set(pruned);
+    if (listed.filter((session) => !prunedPids.has(session.pid)).length === 0) {
       idleSince ??= ports.now();
       if (ports.now() - idleSince >= idleShutdownMinutes * MS_PER_MINUTE) {
         ports.log(`agent-shim frontdoor supervisor: no sessions for ${String(idleShutdownMinutes)} minute(s); closing the front door and exiting`);
@@ -5236,7 +5252,7 @@ function frontDoorRcApiClient(port, ca, token) {
 }
 
 // src/frontdoor/controlApi.ts
-var import_client2 = require("@orpc/client");
+var import_client3 = require("@orpc/client");
 
 // src/checkReport.ts
 var import_node_os4 = __toESM(require("node:os"), 1);
@@ -5586,6 +5602,7 @@ function buildLayoutPaths(root) {
     frontdoorCaCertFile: import_node_path14.default.join(root, "frontdoor", "ca", "ca.pem"),
     frontdoorCaKeyFile: import_node_path14.default.join(root, "frontdoor", "ca", "ca.key"),
     frontdoorCaBundlesDir: import_node_path14.default.join(root, "frontdoor", "ca", "bundles"),
+    chatgptSignInFile: import_node_path14.default.join(root, "codex", "chatgpt-sign-in.json"),
     frontdoorStateFile: import_node_path14.default.join(root, "frontdoor", "state.json"),
     frontdoorLockFile: import_node_path14.default.join(root, "frontdoor", "start.lock"),
     frontdoorControlTokenFile: import_node_path14.default.join(root, "frontdoor", "control-token"),
@@ -7021,7 +7038,7 @@ var ProviderKindMismatchError = class extends UsageError {
   }
 };
 function isEmptyCodexConfig(config) {
-  return config === void 0 || config.defaultModel === void 0 && config.effort === void 0 && (config.models === void 0 || Object.keys(config.models).length === 0);
+  return config === void 0 || config.defaultModel === void 0 && config.effort === void 0 && config.login === void 0 && (config.models === void 0 || Object.keys(config.models).length === 0);
 }
 function addProvider(paths, name, input) {
   if (providerExists(paths, name)) {
@@ -8689,7 +8706,7 @@ var CheckReportJsonSchema = import_zod14.z.strictObject({
 
 // src/frontdoor/controlSchemas.ts
 var import_node_path27 = __toESM(require("node:path"), 1);
-var import_zod16 = require("zod");
+var import_zod19 = require("zod");
 
 // src/claudeShim.ts
 var import_node_fs7 = __toESM(require("node:fs"), 1);
@@ -8893,6 +8910,85 @@ function removeIdentity(paths, name) {
 // src/doctorReport.ts
 var import_node_fs9 = __toESM(require("node:fs"), 1);
 var import_node_path26 = __toESM(require("node:path"), 1);
+
+// src/codex/siwcStore.ts
+var import_zod18 = require("zod");
+
+// src/codex/auth.ts
+var import_zod16 = require("zod");
+var AuthFileSchema = import_zod16.z.looseObject({
+  tokens: import_zod16.z.looseObject({
+    access_token: import_zod16.z.string().optional(),
+    refresh_token: import_zod16.z.string().optional(),
+    id_token: import_zod16.z.string().optional(),
+    account_id: import_zod16.z.string().optional()
+  }).nullish(),
+  last_refresh: import_zod16.z.string().optional()
+});
+var TokenGrantSchema = import_zod16.z.looseObject({
+  access_token: import_zod16.z.string().min(1).optional(),
+  refresh_token: import_zod16.z.string().min(1).optional(),
+  id_token: import_zod16.z.string().min(1).optional(),
+  account_id: import_zod16.z.string().min(1).optional()
+});
+var CodexAuthError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CodexAuthError";
+  }
+};
+
+// src/codex/siwc.ts
+var import_zod17 = require("zod");
+var SIWC_RESOURCE = "https://api.openai.com/v1";
+var SIWC_RESPONSES_URL = `${SIWC_RESOURCE}/responses`;
+var SIWC_PLAN_SCOPE = "chatgpt.tokens.use.direct";
+var TokenResponseSchema = import_zod17.z.looseObject({
+  access_token: import_zod17.z.string().min(1),
+  refresh_token: import_zod17.z.string().min(1).optional(),
+  id_token: import_zod17.z.string().min(1).optional(),
+  expires_in: import_zod17.z.number().positive(),
+  scope: import_zod17.z.string().optional()
+});
+var JwtHeaderSchema = import_zod17.z.looseObject({ alg: import_zod17.z.string(), kid: import_zod17.z.string().optional() });
+var IdTokenClaimsSchema = import_zod17.z.looseObject({
+  iss: import_zod17.z.string(),
+  sub: import_zod17.z.string().min(1),
+  aud: import_zod17.z.union([import_zod17.z.string(), import_zod17.z.array(import_zod17.z.string())]),
+  exp: import_zod17.z.number(),
+  nonce: import_zod17.z.string().optional(),
+  email: import_zod17.z.string().optional()
+});
+var JwksSchema = import_zod17.z.object({ keys: import_zod17.z.array(import_zod17.z.looseObject({ kid: import_zod17.z.string().optional(), kty: import_zod17.z.string() })) });
+
+// src/codex/siwcStore.ts
+var SiwcGrantSchema = import_zod18.z.strictObject({
+  clientId: import_zod18.z.string().min(1),
+  sub: import_zod18.z.string().min(1),
+  email: import_zod18.z.string().optional(),
+  idToken: import_zod18.z.string().min(1),
+  accessToken: import_zod18.z.string().min(1),
+  refreshToken: import_zod18.z.string().min(1),
+  scopes: import_zod18.z.array(import_zod18.z.string()).readonly(),
+  /** When the access token stops working, in milliseconds since the epoch. */
+  expiresAt: import_zod18.z.number()
+});
+var SiwcFileSchema = import_zod18.z.strictObject({ registeredClientId: import_zod18.z.string().min(1).optional(), grant: SiwcGrantSchema.optional() });
+function parseSiwcFile(raw, filePath) {
+  let json;
+  try {
+    json = JSON.parse(raw);
+  } catch {
+    throw new CodexAuthError(`${filePath} is not valid JSON: run \`agent-shim codex login\` again`);
+  }
+  const parsed = SiwcFileSchema.safeParse(json);
+  if (!parsed.success) {
+    throw new CodexAuthError(`${filePath} is not a Sign in with ChatGPT file: run \`agent-shim codex login\` again`);
+  }
+  return parsed.data;
+}
+
+// src/doctorReport.ts
 var DOCTOR_SEVERITIES = ["pass", "warn", "fail"];
 var DOCTOR_SECTIONS = [
   "ambient-credential",
@@ -8983,7 +9079,21 @@ function cacheClause(cacheEnv, owner, block) {
   const state = describeCachedCredential({ port: cacheEnv.port, platform: cacheEnv.platform, owner, cache: block.cache, nowMs: cacheEnv.now() });
   return { text: `; ${formatCachedCredentialState(state)}`, unreadable: state.status === "unreadable" };
 }
-function pushProvider(push, entry, cacheEnv) {
+function signInProblem(signIn) {
+  if (signIn.raw === void 0) {
+    return "nobody is signed in: run `agent-shim codex login`.";
+  }
+  try {
+    const grant = parseSiwcFile(signIn.raw, signIn.path).grant;
+    if (grant === void 0) {
+      return "nobody is signed in: run `agent-shim codex login`.";
+    }
+    return grant.scopes.includes(SIWC_PLAN_SCOPE) ? void 0 : "the login was not given permission to use your ChatGPT plan: run `agent-shim codex login` again and allow it.";
+  } catch (error) {
+    return error instanceof Error ? error.message : String(error);
+  }
+}
+function pushProvider(push, entry, cacheEnv, signIn) {
   if (entry.raw === void 0) {
     push("provider", "fail", `${entry.path} is missing.`, entry.name);
     return;
@@ -9010,6 +9120,12 @@ function pushProvider(push, entry, cacheEnv) {
   if (validated2.data.env?.ENABLE_TOOL_SEARCH === void 0) {
     push("provider", "warn", `${entry.name} does not set ENABLE_TOOL_SEARCH: a session on this provider loads MCP tools upfront rather than deferring them, because its base URL is the front door, which Claude Code treats as a non-first-party host. Set ENABLE_TOOL_SEARCH in the provider's env block to restore deferred loading, when the upstream backend supports the tool_reference payloads it sends.`, entry.name);
   }
+  if (signIn !== void 0 && isCodexProvider(validated2.data) && validated2.data.codex?.login === "chatgpt-sign-in") {
+    const problem = signInProblem(signIn);
+    if (problem !== void 0) {
+      push("provider", "warn", `${entry.name} uses the Sign in with ChatGPT login, but ${problem}`, entry.name);
+    }
+  }
 }
 function pushLegacyName(push, params) {
   const legacyVariables = Object.keys(params.env).filter((name) => name.startsWith(LEGACY_ENV_PREFIX) && params.env[name] !== void 0).sort();
@@ -9134,7 +9250,7 @@ function runDoctor(params) {
     return poolName === void 0 ? validIdentityNames.has(selector) : poolName in pools;
   };
   for (const entry of params.providers) {
-    pushProvider(push, entry, params.credentialCache);
+    pushProvider(push, entry, params.credentialCache, params.chatgptSignIn);
   }
   if (params.platform !== "darwin" || params.run === void 0) {
     push("keychain", "pass", "Skipped (not macOS).");
@@ -9376,6 +9492,7 @@ function collectDoctorReport(params) {
   const report = runDoctor({
     env: params.env,
     credentialCache: realCredentialCacheEnv(paths),
+    chatgptSignIn: { path: paths.chatgptSignInFile, raw: realFsPort.readFileUtf8(paths.chatgptSignInFile) },
     installedClaudeVersions: realInstalledClaudeVersions(),
     identities,
     configProfiles,
@@ -9412,60 +9529,121 @@ function collectDoctorReport(params) {
 }
 
 // src/frontdoor/controlSchemas.ts
-var UsageListOutputSchema = import_zod16.z.strictObject({ snapshots: import_zod16.z.readonly(import_zod16.z.array(UsageSnapshotSchema)) });
-var UsageWindowsInputSchema = import_zod16.z.strictObject({
-  identity: import_zod16.z.string().min(1),
-  provider: import_zod16.z.string().min(1).optional()
+var UsageListOutputSchema = import_zod19.z.strictObject({ snapshots: import_zod19.z.readonly(import_zod19.z.array(UsageSnapshotSchema)) });
+var UsageWindowsInputSchema = import_zod19.z.strictObject({
+  identity: import_zod19.z.string().min(1),
+  provider: import_zod19.z.string().min(1).optional()
 });
-var EffectiveWindowSchema = import_zod16.z.strictObject({
+var EffectiveWindowSchema = import_zod19.z.strictObject({
   /** True when the window's reset time has passed, so the recorded observation describes a window that no longer exists. */
-  reset: import_zod16.z.boolean(),
+  reset: import_zod19.z.boolean(),
   /** The fraction used: 0 for a reset window, otherwise what was last observed, absent when none was reported. */
-  utilization: import_zod16.z.number().optional(),
+  utilization: import_zod19.z.number().optional(),
   /** The reset instant, for a window that has not reset yet and reported one. */
-  resetsAtMs: import_zod16.z.number().optional(),
+  resetsAtMs: import_zod19.z.number().optional(),
   /** The window's own status, for a window that has not reset yet. */
-  status: import_zod16.z.string().optional()
+  status: import_zod19.z.string().optional()
 });
-var UsageWindowsOutputSchema = import_zod16.z.strictObject({
-  identity: import_zod16.z.string(),
-  provider: import_zod16.z.string(),
+var UsageWindowsOutputSchema = import_zod19.z.strictObject({
+  identity: import_zod19.z.string(),
+  provider: import_zod19.z.string(),
   /** When the rate-limit state the windows come from was observed. */
-  observedAt: import_zod16.z.iso.datetime().optional(),
+  observedAt: import_zod19.z.iso.datetime().optional(),
   fiveHour: EffectiveWindowSchema.optional(),
   sevenDay: EffectiveWindowSchema.optional()
 });
-var FrontDoorSessionStatusSchema = import_zod16.z.strictObject({
-  pid: import_zod16.z.int().positive(),
-  startedAt: import_zod16.z.number(),
-  alive: import_zod16.z.boolean()
+var FrontDoorSessionStatusSchema = import_zod19.z.strictObject({
+  pid: import_zod19.z.int().positive(),
+  startedAt: import_zod19.z.number(),
+  alive: import_zod19.z.boolean()
 });
-var HeadroomSocketTargetSchema = import_zod16.z.union([import_zod16.z.strictObject({ socketPath: import_zod16.z.string() }), import_zod16.z.strictObject({ refused: import_zod16.z.string() })]);
-var FrontDoorStatusOutputSchema = import_zod16.z.strictObject({
+var HeadroomSocketTargetSchema = import_zod19.z.union([import_zod19.z.strictObject({ socketPath: import_zod19.z.string() }), import_zod19.z.strictObject({ refused: import_zod19.z.string() })]);
+var FrontDoorStatusOutputSchema = import_zod19.z.strictObject({
   state: FrontDoorStateSchema,
-  supervisorAlive: import_zod16.z.boolean(),
-  sessions: import_zod16.z.readonly(import_zod16.z.array(FrontDoorSessionStatusSchema)),
+  supervisorAlive: import_zod19.z.boolean(),
+  sessions: import_zod19.z.readonly(import_zod19.z.array(FrontDoorSessionStatusSchema)),
   headroomSocket: HeadroomSocketTargetSchema.optional(),
-  logPath: import_zod16.z.string(),
-  logExists: import_zod16.z.boolean()
+  logPath: import_zod19.z.string(),
+  logExists: import_zod19.z.boolean()
 });
-var FrontDoorSessionsOutputSchema = import_zod16.z.strictObject({ sessions: import_zod16.z.readonly(import_zod16.z.array(FrontDoorSessionStatusSchema)) });
-var CheckRunInputSchema = import_zod16.z.strictObject({
-  path: import_zod16.z.string().min(1),
-  identity: import_zod16.z.string().min(1).optional()
+var FrontDoorSessionsOutputSchema = import_zod19.z.strictObject({ sessions: import_zod19.z.readonly(import_zod19.z.array(FrontDoorSessionStatusSchema)) });
+var CheckRunInputSchema = import_zod19.z.strictObject({
+  path: import_zod19.z.string().min(1),
+  identity: import_zod19.z.string().min(1).optional()
 }).refine((input) => import_node_path27.default.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
-var DoctorFindingSchema = import_zod16.z.strictObject({
-  section: import_zod16.z.enum(DOCTOR_SECTIONS),
-  subject: import_zod16.z.string().optional(),
-  severity: import_zod16.z.enum(DOCTOR_SEVERITIES),
-  message: import_zod16.z.string()
+var DoctorFindingSchema = import_zod19.z.strictObject({
+  section: import_zod19.z.enum(DOCTOR_SECTIONS),
+  subject: import_zod19.z.string().optional(),
+  severity: import_zod19.z.enum(DOCTOR_SEVERITIES),
+  message: import_zod19.z.string()
 });
-var DoctorRunOutputSchema = import_zod16.z.strictObject({
+var DoctorRunOutputSchema = import_zod19.z.strictObject({
   /** False exactly when any finding is a `fail`; a `warn` never fails the report on its own. */
-  ok: import_zod16.z.boolean(),
-  findings: import_zod16.z.readonly(import_zod16.z.array(DoctorFindingSchema))
+  ok: import_zod19.z.boolean(),
+  findings: import_zod19.z.readonly(import_zod19.z.array(DoctorFindingSchema))
+});
+
+// src/frontdoor/eventsApi.ts
+var import_client2 = require("@orpc/client");
+var import_server3 = require("@orpc/server");
+
+// src/frontdoor/eventSchemas.ts
+var import_zod20 = require("zod");
+var DOOR_EVENT_SOURCE_RC = "rc";
+var LAUNCH_EVENT_SOURCE = "launch";
+var DoorEventSchema = import_zod20.z.strictObject({
+  source: import_zod20.z.string().min(1),
+  /** A positive integer because the backbone's counters start at one and only ever increase. */
+  sequence: import_zod20.z.number().int().positive(),
+  payload: import_zod20.z.unknown()
+});
+var DoorEventSourceQuerySchema = import_zod20.z.strictObject({
+  sources: import_zod20.z.array(import_zod20.z.string().min(1)).min(1).optional()
+});
+var LaunchLifecycleEventSchema = import_zod20.z.strictObject({
+  kind: import_zod20.z.enum(["registered", "pruned", "ended"]),
+  pid: import_zod20.z.number().int().positive(),
+  startedAt: import_zod20.z.number(),
+  observedAt: import_zod20.z.number()
 });
 
+// src/frontdoor/eventsApi.ts
+function createEventsApiRouter(deps) {
+  const authed = doorApiAuth(deps.expectedToken);
+  return {
+    events: {
+      subscribe: authed.input(DoorEventSourceQuerySchema).output((0, import_server3.eventIterator)(DoorEventSchema)).handler(async function* ({ input, signal }) {
+        if (input.sources !== void 0) {
+          const live = deps.events.sources();
+          const unknown = input.sources.filter((source) => !live.includes(source));
+          if (unknown.length > 0) {
+            throw new import_client2.ORPCError("NOT_FOUND", { message: `the door publishes no event source named ${unknown.map((source) => `"${source}"`).join(", ")}; the live sources are ${live.map((source) => `"${source}"`).join(", ")}` });
+          }
+        }
+        const stream = deps.events.stream(input.sources);
+        const ended = new Promise((resolve) => {
+          signal?.addEventListener("abort", () => {
+            resolve();
+          }, { once: true });
+        });
+        try {
+          for (; ; ) {
+            signal?.throwIfAborted();
+            const next = await Promise.race([stream.next(), ended.then(() => ({ value: void 0, done: true }))]);
+            if (next.done === true) {
+              signal?.throwIfAborted();
+              return;
+            }
+            yield (0, import_server3.withEventMeta)(next.value, { id: String(next.value.sequence) });
+          }
+        } finally {
+          stream.close();
+        }
+      })
+    }
+  };
+}
+
 // src/frontdoor/controlApi.ts
 function createControlApiRouter(deps) {
   const authed = doorApiAuth(deps.expectedToken);
@@ -9475,7 +9653,7 @@ function createControlApiRouter(deps) {
       effectiveWindow: authed.input(UsageWindowsInputSchema).output(UsageWindowsOutputSchema).handler(({ input }) => {
         const snapshot = deps.usageSnapshotOf(input.identity);
         if (snapshot === void 0) {
-          throw new import_client2.ORPCError("NOT_FOUND", { message: `identity ${input.identity} has no usage snapshot yet, so no quota window has been observed for it` });
+          throw new import_client3.ORPCError("NOT_FOUND", { message: `identity ${input.identity} has no usage snapshot yet, so no quota window has been observed for it` });
         }
         const provider = input.provider ?? ANTHROPIC_PROVIDER;
         const rateLimit = snapshot.providers[provider]?.rateLimit;
@@ -9504,13 +9682,13 @@ function createControlApiRouter(deps) {
   };
 }
 function createDoorApiRouter(deps) {
-  return { ...createRcApiRouter(deps), ...createControlApiRouter(deps) };
+  return { ...createRcApiRouter(deps), ...createControlApiRouter(deps), ...createEventsApiRouter(deps) };
 }
 function createDoorApiNodeHandler(deps) {
   return doorApiNodeHandlerOf(createDoorApiRouter(deps));
 }
 function frontDoorApiClient(port, ca, token) {
-  return (0, import_client2.createORPCClient)(frontDoorApiLink(port, ca, token));
+  return (0, import_client3.createORPCClient)(frontDoorApiLink(port, ca, token));
 }
 
 // src/frontdoor/status.ts
@@ -9566,6 +9744,148 @@ function formatFrontDoorStatus(status, caCertPath) {
   return lines;
 }
 
+// src/frontdoor/eventHub.ts
+var DOOR_EVENT_BUFFER_EVENTS = 100;
+function createDoorEventHub() {
+  const sequences = /* @__PURE__ */ new Map();
+  const registered = /* @__PURE__ */ new Set();
+  const every = /* @__PURE__ */ new Set();
+  const bySource = /* @__PURE__ */ new Map();
+  const deliver = (event) => {
+    for (const listener of every) {
+      listener(event);
+    }
+    for (const listener of bySource.get(event.source) ?? []) {
+      listener(event);
+    }
+  };
+  const publish = (source, payload) => {
+    const sequence2 = (sequences.get(source) ?? 0) + 1;
+    sequences.set(source, sequence2);
+    deliver({ source, sequence: sequence2, payload });
+  };
+  const addListener = (sources, listener) => {
+    if (sources === void 0) {
+      every.add(listener);
+      return () => {
+        every.delete(listener);
+      };
+    }
+    const listenersFor = (source) => {
+      const listeners = bySource.get(source) ?? /* @__PURE__ */ new Set();
+      bySource.set(source, listeners);
+      return listeners;
+    };
+    const detachers = sources.map((source) => {
+      const listeners = listenersFor(source);
+      listeners.add(listener);
+      return () => {
+        listeners.delete(listener);
+        if (listeners.size === 0) {
+          bySource.delete(source);
+        }
+      };
+    });
+    return () => {
+      for (const detach of detachers) {
+        detach();
+      }
+    };
+  };
+  return {
+    publisher: (source) => {
+      registered.add(source);
+      return {
+        source,
+        publish: (payload) => {
+          publish(source, payload);
+        }
+      };
+    },
+    subscribe: addListener,
+    stream: (sources) => {
+      const queue = [];
+      let wake;
+      let closed = false;
+      const detach = addListener(sources, (event) => {
+        if (queue.length >= DOOR_EVENT_BUFFER_EVENTS) {
+          queue.shift();
+        }
+        queue.push(event);
+        wake?.();
+      });
+      return {
+        next: async () => {
+          for (; ; ) {
+            const event = queue.shift();
+            if (event !== void 0) {
+              return { value: event, done: false };
+            }
+            if (closed) {
+              return { value: void 0, done: true };
+            }
+            await new Promise((resolve) => {
+              wake = resolve;
+            });
+          }
+        },
+        close: () => {
+          closed = true;
+          detach();
+          wake?.();
+        }
+      };
+    },
+    sources: () => [...registered].sort()
+  };
+}
+function rcFanoutOnDoorHub(fanout, hub) {
+  const publisher = hub.publisher(DOOR_EVENT_SOURCE_RC);
+  return {
+    publish: (event) => {
+      fanout.publish(event);
+      publisher.publish(event);
+    },
+    subscribe: (session, listener) => fanout.subscribe(session, listener)
+  };
+}
+
+// src/frontdoor/launchEvents.ts
+function createLaunchEventPublisher(hub, now) {
+  const publisher = hub.publisher(LAUNCH_EVENT_SOURCE);
+  let known;
+  return {
+    observe: (sessions, pruned) => {
+      const previous = known;
+      const listed = new Map(sessions.map((session) => [session.pid, session]));
+      const prunedSet = new Set(pruned);
+      known = new Map([...listed].filter(([pid]) => !prunedSet.has(pid)));
+      if (previous === void 0) {
+        return;
+      }
+      const emit = (kind, pid, startedAt) => {
+        publisher.publish({ kind, pid, startedAt, observedAt: now() });
+      };
+      for (const pid of pruned) {
+        const session = listed.get(pid);
+        if (session !== void 0) {
+          emit("pruned", pid, session.startedAt);
+        }
+      }
+      for (const [pid, session] of previous) {
+        if (!listed.has(pid) && !prunedSet.has(pid)) {
+          emit("ended", pid, session.startedAt);
+        }
+      }
+      for (const [pid, session] of listed) {
+        if (!previous.has(pid) && !prunedSet.has(pid)) {
+          emit("registered", pid, session.startedAt);
+        }
+      }
+    }
+  };
+}
+
 // src/frontdoor/rcStream.ts
 var RC_STREAM_EVENT_NAME = "client_event";
 var SSE_BYTE_ORDER_MARK = 65279;
@@ -11652,6 +11972,8 @@ function prepareClaudeLaunch(options) {
   CredentialCacheSchema,
   CredentialSchema,
   CredentialSourceSchema,
+  DOOR_EVENT_BUFFER_EVENTS,
+  DOOR_EVENT_SOURCE_RC,
   DirectoryRuleAlreadyExistsError,
   DirectoryRuleMissingTargetError,
   DirectoryRuleNotFoundError,
@@ -11659,6 +11981,8 @@ function prepareClaudeLaunch(options) {
   DirectoryRulesSchema,
   DoctorFindingSchema,
   DoctorRunOutputSchema,
+  DoorEventSchema,
+  DoorEventSourceQuerySchema,
   EXIT_FAILURE,
   EXIT_USAGE,
   EffectiveWindowSchema,
@@ -11678,6 +12002,8 @@ function prepareClaudeLaunch(options) {
   InvalidCategoryNameError,
   InvalidIdentityNameError,
   InvalidProviderNameError,
+  LAUNCH_EVENT_SOURCE,
+  LaunchLifecycleEventSchema,
   LaunchRefusedError,
   LegacyProviderFileError,
   PROMPT_CACHE_TTL_MS,
@@ -11741,6 +12067,9 @@ function prepareClaudeLaunch(options) {
   createControlApiRouter,
   createDoorApiNodeHandler,
   createDoorApiRouter,
+  createDoorEventHub,
+  createEventsApiRouter,
+  createLaunchEventPublisher,
   createLeafCache,
   createProfile,
   createRcApiNodeHandler,
@@ -11799,6 +12128,7 @@ function prepareClaudeLaunch(options) {
   providerExists,
   rankPool,
   rcEventWriteResultFromAnswer,
+  rcFanoutOnDoorHub,
   rcObserverAsPassthrough,
   rcSelfHostFromEnv,
   readActiveIdentity,