agent-shim 8.22.0 → 8.24.0

package/dist/index.cjs

@@ -93,10 +93,12 @@ __export(index_exports, {
   ProviderKindMismatchError: () => ProviderKindMismatchError,
   ProviderNotFoundError: () => ProviderNotFoundError,
   ProviderSchema: () => ProviderSchema,
+  RC_CONTEXT_USAGE_DETAILS: () => RC_CONTEXT_USAGE_DETAILS,
   RC_IDLE_EXPIRY_MS: () => RC_IDLE_EXPIRY_MS,
   RC_ORPC_PATH_PREFIX: () => RC_ORPC_PATH_PREFIX,
   RC_PENDING_DEADLINE_MS: () => RC_PENDING_DEADLINE_MS,
   RC_PERMISSION_MODES: () => RC_PERMISSION_MODES,
+  RC_READ_FILE_ENCODINGS: () => RC_READ_FILE_ENCODINGS,
   RC_REQUEST_PARSE_CAP_BYTES: () => RC_REQUEST_PARSE_CAP_BYTES,
   RC_SELF_HOST_ENV: () => RC_SELF_HOST_ENV,
   RC_SELF_HOST_KEEPALIVE_MS: () => RC_SELF_HOST_KEEPALIVE_MS,
@@ -127,11 +129,23 @@ __export(index_exports, {
   addPool: () => addPool,
   addProvider: () => addProvider,
   answerRcControlRequest: () => answerRcControlRequest,
+  authenticateRcSessionMcpServer: () => authenticateRcSessionMcpServer,
   buildEntryFacts: () => buildEntryFacts,
   buildLayoutPaths: () => buildLayoutPaths,
+  buildRcControlRequestPayload: () => buildRcControlRequestPayload,
   buildRcControlResponsePayload: () => buildRcControlResponsePayload,
+  buildRcEndSessionPayload: () => buildRcEndSessionPayload,
   buildRcEventWriteBody: () => buildRcEventWriteBody,
+  buildRcFileSuggestionsPayload: () => buildRcFileSuggestionsPayload,
+  buildRcGetContextUsagePayload: () => buildRcGetContextUsagePayload,
+  buildRcGetUsagePayload: () => buildRcGetUsagePayload,
   buildRcInterruptPayload: () => buildRcInterruptPayload,
+  buildRcKeepAlivePayload: () => buildRcKeepAlivePayload,
+  buildRcMcpAuthenticatePayload: () => buildRcMcpAuthenticatePayload,
+  buildRcMcpOAuthCallbackUrlPayload: () => buildRcMcpOAuthCallbackUrlPayload,
+  buildRcMcpReconnectPayload: () => buildRcMcpReconnectPayload,
+  buildRcMcpStatusPayload: () => buildRcMcpStatusPayload,
+  buildRcReadFilePayload: () => buildRcReadFilePayload,
   buildRcSetModelPayload: () => buildRcSetModelPayload,
   buildRcSetPermissionModePayload: () => buildRcSetPermissionModePayload,
   buildRcUserMessagePayload: () => buildRcUserMessagePayload,
@@ -164,6 +178,7 @@ __export(index_exports, {
   doorApiAuth: () => doorApiAuth,
   doorApiNodeHandlerOf: () => doorApiNodeHandlerOf,
   effectiveWindow: () => effectiveWindow,
+  endRcSession: () => endRcSession,
   ensureCa: () => ensureCa,
   ensureFrontDoor: () => ensureFrontDoor,
   ensureHeadroom: () => ensureHeadroom,
@@ -180,6 +195,9 @@ __export(index_exports, {
   frontDoorRcApiClient: () => frontDoorRcApiClient,
   frontDoorRcControl: () => frontDoorRcControl,
   generateCa: () => generateCa,
+  getRcSessionContextUsage: () => getRcSessionContextUsage,
+  getRcSessionMcpStatus: () => getRcSessionMcpStatus,
+  getRcSessionUsage: () => getRcSessionUsage,
   headroomSocketTarget: () => headroomSocketTarget,
   identityExists: () => identityExists,
   injectRcUserMessage: () => injectRcUserMessage,
@@ -187,7 +205,9 @@ __export(index_exports, {
   isIdentityDirectoryName: () => isIdentityDirectoryName,
   isInterceptedHost: () => isInterceptedHost,
   isPrivateAddress: () => isPrivateAddress,
+  isRcContextUsageDetail: () => isRcContextUsageDetail,
   isRcPermissionMode: () => isRcPermissionMode,
+  isRcReadFileEncoding: () => isRcReadFileEncoding,
   lateRcEventDial: () => lateRcEventDial,
   lateRcStreamDial: () => lateRcStreamDial,
   listDirectoryRules: () => listDirectoryRules,
@@ -221,6 +241,7 @@ __export(index_exports, {
   readProfile: () => readProfile,
   readProvider: () => readProvider,
   readRcSelfHostRecord: () => readRcSelfHostRecord,
+  readRcSessionFile: () => readRcSessionFile,
   readUsageSnapshot: () => readUsageSnapshot,
   realConnectCertStore: () => realConnectCertStore,
   realConnectEffects: () => realConnectEffects,
@@ -228,6 +249,7 @@ __export(index_exports, {
   realRcEventDial: () => realRcEventDial,
   realRcStreamDial: () => realRcStreamDial,
   realRcWebFetch: () => realRcWebFetch,
+  reconnectRcSessionMcpServer: () => reconnectRcSessionMcpServer,
   recoverFarm: () => recoverFarm,
   recoveryDiagnostics: () => recoveryDiagnostics,
   removeDirectoryRule: () => removeDirectoryRule,
@@ -247,6 +269,7 @@ __export(index_exports, {
   runFrontDoorSupervisor: () => runFrontDoorSupervisor,
   runLauncher: () => runLauncher,
   runSupervisor: () => runSupervisor,
+  sendRcKeepAlive: () => sendRcKeepAlive,
   servedByPipeline: () => servedByPipeline,
   setAllowAmbientCredential: () => setAllowAmbientCredential,
   setDefaultConfigProfile: () => setDefaultConfigProfile,
@@ -262,6 +285,8 @@ __export(index_exports, {
   snapshotPath: () => snapshotPath,
   spawnClaude: () => spawnClaude,
   startConnectServer: () => startConnectServer,
+  submitRcSessionMcpOAuthCallbackUrl: () => submitRcSessionMcpOAuthCallbackUrl,
+  suggestRcSessionFiles: () => suggestRcSessionFiles,
   topLevelNames: () => topLevelNames,
   updateDirectoryRule: () => updateDirectoryRule,
   updateProvider: () => updateProvider,
@@ -640,6 +665,11 @@ var FrontDoorGlobalConfigSchema = import_zod.z.strictObject({
   /** How long the front door may sit with no registered sessions before it closes and exits. Defaults to FRONTDOOR_DEFAULT_IDLE_SHUTDOWN_MINUTES. */
   idleShutdownMinutes: import_zod.z.number().int().positive().optional()
 });
+var UPDATE_MODES = ["off", "notify", "auto"];
+var UpdateGlobalConfigSchema = import_zod.z.strictObject({
+  /** What a launch does about a newer release of agent-shim itself; see `UPDATE_MODES`. Absent means `off`. */
+  mode: import_zod.z.enum(UPDATE_MODES).optional()
+});
 var GlobalConfigSchema = import_zod.z.strictObject({
   $schema: import_zod.z.string().optional(),
   defaultConfigProfile: import_zod.z.string().min(1).optional(),
@@ -649,6 +679,7 @@ var GlobalConfigSchema = import_zod.z.strictObject({
   launch: LaunchSchema.optional(),
   headroom: HeadroomGlobalConfigSchema.optional(),
   frontdoor: FrontDoorGlobalConfigSchema.optional(),
+  update: UpdateGlobalConfigSchema.optional(),
   pools: import_zod.z.record(PoolNameSchema, PoolSchema).optional()
 });
 var IdentitySchema = import_zod.z.strictObject({
@@ -3896,6 +3927,8 @@ function rcObserverAsPassthrough(observer) {
     }
   };
 }
+
+// src/frontdoor/rcWrites.ts
 function buildRcUserMessagePayload(uuid, sessionId, text) {
   return {
     type: "user",
@@ -3996,14 +4029,55 @@ var RC_PERMISSION_MODES = ["default", "acceptEdits", "bypassPermissions", "plan"
 function isRcPermissionMode(value) {
   return RC_PERMISSION_MODES.some((mode) => mode === value);
 }
+function buildRcControlRequestPayload(requestId, request4) {
+  return { type: "control_request", request_id: requestId, request: request4 };
+}
 function buildRcInterruptPayload(requestId) {
-  return { type: "control_request", request_id: requestId, request: { subtype: "interrupt" } };
+  return buildRcControlRequestPayload(requestId, { subtype: "interrupt" });
 }
 function buildRcSetModelPayload(requestId, model) {
-  return { type: "control_request", request_id: requestId, request: { subtype: "set_model", model } };
+  return buildRcControlRequestPayload(requestId, { subtype: "set_model", model });
 }
 function buildRcSetPermissionModePayload(requestId, mode) {
-  return { type: "control_request", request_id: requestId, request: { subtype: "set_permission_mode", mode } };
+  return buildRcControlRequestPayload(requestId, { subtype: "set_permission_mode", mode });
+}
+function buildRcEndSessionPayload(requestId, reason) {
+  return buildRcControlRequestPayload(requestId, { subtype: "end_session", ...reason === void 0 ? {} : { reason } });
+}
+function buildRcGetUsagePayload(requestId, skipBehaviors) {
+  return buildRcControlRequestPayload(requestId, { subtype: "get_usage", ...skipBehaviors === true ? { skip_behaviors: true } : {} });
+}
+var RC_CONTEXT_USAGE_DETAILS = ["summary", "full"];
+function isRcContextUsageDetail(value) {
+  return RC_CONTEXT_USAGE_DETAILS.some((detail) => detail === value);
+}
+function buildRcGetContextUsagePayload(requestId, detail) {
+  return buildRcControlRequestPayload(requestId, { subtype: "get_context_usage", ...detail === void 0 ? {} : { detail } });
+}
+var RC_READ_FILE_ENCODINGS = ["utf-8", "base64"];
+function isRcReadFileEncoding(value) {
+  return RC_READ_FILE_ENCODINGS.some((encoding) => encoding === value);
+}
+function buildRcReadFilePayload(requestId, path32, options) {
+  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path32, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
+}
+function buildRcFileSuggestionsPayload(requestId, query) {
+  return buildRcControlRequestPayload(requestId, { subtype: "file_suggestions", query });
+}
+function buildRcMcpStatusPayload(requestId) {
+  return buildRcControlRequestPayload(requestId, { subtype: "mcp_status" });
+}
+function buildRcMcpReconnectPayload(requestId, serverName) {
+  return buildRcControlRequestPayload(requestId, { subtype: "mcp_reconnect", serverName });
+}
+function buildRcMcpAuthenticatePayload(requestId, serverName, redirectUri) {
+  return buildRcControlRequestPayload(requestId, { subtype: "mcp_authenticate", serverName, redirectUri });
+}
+function buildRcMcpOAuthCallbackUrlPayload(requestId, serverName, callbackUrl) {
+  return buildRcControlRequestPayload(requestId, { subtype: "mcp_oauth_callback_url", serverName, callbackUrl });
+}
+function buildRcKeepAlivePayload() {
+  return { type: "keep_alive" };
 }
 async function answerRcControlRequest(deps, sessionId, requestId, decision) {
   const credential = deps.credentialOf(sessionId);
@@ -4030,7 +4104,7 @@ async function answerRcControlRequest(deps, sessionId, requestId, decision) {
   }
   return result;
 }
-async function interruptRcSession(deps, sessionId) {
+async function deliverRcClientPayload(deps, sessionId, payload, action) {
   const credential = deps.credentialOf(sessionId);
   if (credential === void 0) {
     return { ok: false, message: rcSessionNotObservedMessage(sessionId) };
@@ -4038,12 +4112,12 @@ async function interruptRcSession(deps, sessionId) {
   if (credential.authorization === void 0) {
     return noOAuthCredentialResult(sessionId);
   }
-  const body = JSON.stringify(buildRcEventWriteBody(buildRcInterruptPayload(deps.newUuid())));
+  const body = JSON.stringify(buildRcEventWriteBody(payload));
   let answer;
   try {
     answer = await deps.dial.writeEvents(sessionId, rcWriteHeaders(credential), body);
   } catch (error) {
-    return { ok: false, message: `the door could not reach the API host to interrupt session ${sessionId}: ${error instanceof Error ? error.message : String(error)}` };
+    return { ok: false, message: `the door could not reach the API host to ${action}: ${error instanceof Error ? error.message : String(error)}` };
   }
   const result = rcEventWriteResultFromAnswer(answer);
   if (result.ok) {
@@ -4051,50 +4125,89 @@ async function interruptRcSession(deps, sessionId) {
   }
   return result;
 }
+async function interruptRcSession(deps, sessionId) {
+  const requestId = deps.newUuid();
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcInterruptPayload(requestId), `interrupt session ${sessionId}`);
+  return result.ok ? { ...result, requestId } : result;
+}
 async function setRcSessionModel(deps, sessionId, model) {
   if (model === "") {
     return { ok: false, message: "a set-model write needs a non-empty model id: the SDK's own field treats an omitted or null value as a reset to the session default, which this operation never sends, and an empty string is neither" };
   }
-  const credential = deps.credentialOf(sessionId);
-  if (credential === void 0) {
-    return { ok: false, message: rcSessionNotObservedMessage(sessionId) };
-  }
-  if (credential.authorization === void 0) {
-    return noOAuthCredentialResult(sessionId);
+  const requestId = deps.newUuid();
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcSetModelPayload(requestId, model), `set the model on session ${sessionId}`);
+  return result.ok ? { ...result, requestId } : result;
+}
+async function setRcSessionPermissionMode(deps, sessionId, mode) {
+  const requestId = deps.newUuid();
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcSetPermissionModePayload(requestId, mode), `set the permission mode on session ${sessionId}`);
+  return result.ok ? { ...result, requestId } : result;
+}
+async function endRcSession(deps, sessionId, reason) {
+  if (reason === "") {
+    return { ok: false, message: "an end-session write needs either no reason or a non-empty one: the worker reads an absent reason as its own unspecified form, and an empty string is neither" };
   }
-  const body = JSON.stringify(buildRcEventWriteBody(buildRcSetModelPayload(deps.newUuid(), model)));
-  let answer;
-  try {
-    answer = await deps.dial.writeEvents(sessionId, rcWriteHeaders(credential), body);
-  } catch (error) {
-    return { ok: false, message: `the door could not reach the API host to set the model on session ${sessionId}: ${error instanceof Error ? error.message : String(error)}` };
+  const requestId = deps.newUuid();
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcEndSessionPayload(requestId, reason), `end session ${sessionId}`);
+  return result.ok ? { ...result, requestId } : result;
+}
+async function getRcSessionUsage(deps, sessionId, skipBehaviors) {
+  const requestId = deps.newUuid();
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcGetUsagePayload(requestId, skipBehaviors), `request the usage of session ${sessionId}`);
+  return result.ok ? { ...result, requestId } : result;
+}
+async function getRcSessionContextUsage(deps, sessionId, detail) {
+  const requestId = deps.newUuid();
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcGetContextUsagePayload(requestId, detail), `request the context usage of session ${sessionId}`);
+  return result.ok ? { ...result, requestId } : result;
+}
+async function readRcSessionFile(deps, sessionId, path32, options) {
+  if (path32 === "") {
+    return { ok: false, message: "a read-file write needs a non-empty path: the SDK's own field names the file the worker resolves against the session's cwd, and an empty string names none" };
   }
-  const result = rcEventWriteResultFromAnswer(answer);
-  if (result.ok) {
-    deps.noteSequenceNums(sessionId, result.sequenceNums);
+  if (options?.maxBytes !== void 0 && (!Number.isInteger(options.maxBytes) || options.maxBytes <= 0)) {
+    return { ok: false, message: "a read-file write's max-bytes is a positive whole number of bytes: the SDK's own field caps the read, and a zero or negative cap reads nothing" };
   }
-  return result;
+  const requestId = deps.newUuid();
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path32, options), `read ${path32} from session ${sessionId}`);
+  return result.ok ? { ...result, requestId } : result;
 }
-async function setRcSessionPermissionMode(deps, sessionId, mode) {
-  const credential = deps.credentialOf(sessionId);
-  if (credential === void 0) {
-    return { ok: false, message: rcSessionNotObservedMessage(sessionId) };
-  }
-  if (credential.authorization === void 0) {
-    return noOAuthCredentialResult(sessionId);
+async function suggestRcSessionFiles(deps, sessionId, query) {
+  const requestId = deps.newUuid();
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcFileSuggestionsPayload(requestId, query), `request file suggestions from session ${sessionId}`);
+  return result.ok ? { ...result, requestId } : result;
+}
+async function getRcSessionMcpStatus(deps, sessionId) {
+  const requestId = deps.newUuid();
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcMcpStatusPayload(requestId), `request the MCP status of session ${sessionId}`);
+  return result.ok ? { ...result, requestId } : result;
+}
+async function reconnectRcSessionMcpServer(deps, sessionId, serverName) {
+  if (serverName === "") {
+    return { ok: false, message: "an mcp-reconnect write needs a non-empty server name: the SDK's own field names the server as mcp_status reports it, and an empty string names none" };
   }
-  const body = JSON.stringify(buildRcEventWriteBody(buildRcSetPermissionModePayload(deps.newUuid(), mode)));
-  let answer;
-  try {
-    answer = await deps.dial.writeEvents(sessionId, rcWriteHeaders(credential), body);
-  } catch (error) {
-    return { ok: false, message: `the door could not reach the API host to set the permission mode on session ${sessionId}: ${error instanceof Error ? error.message : String(error)}` };
+  const requestId = deps.newUuid();
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcMcpReconnectPayload(requestId, serverName), `reconnect MCP server ${serverName} on session ${sessionId}`);
+  return result.ok ? { ...result, requestId } : result;
+}
+async function authenticateRcSessionMcpServer(deps, sessionId, serverName, redirectUri) {
+  if (serverName === "" || redirectUri === "") {
+    return { ok: false, message: "an mcp-authenticate write needs a non-empty server name and redirect URI: the CLI's own request names the server and where its OAuth flow redirects back to, and an empty string names neither" };
   }
-  const result = rcEventWriteResultFromAnswer(answer);
-  if (result.ok) {
-    deps.noteSequenceNums(sessionId, result.sequenceNums);
+  const requestId = deps.newUuid();
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcMcpAuthenticatePayload(requestId, serverName, redirectUri), `authenticate MCP server ${serverName} on session ${sessionId}`);
+  return result.ok ? { ...result, requestId } : result;
+}
+async function submitRcSessionMcpOAuthCallbackUrl(deps, sessionId, serverName, callbackUrl) {
+  if (serverName === "" || callbackUrl === "") {
+    return { ok: false, message: "an mcp-oauth-callback-url write needs a non-empty server name and callback URL: the CLI's own request names the server and the URL its OAuth flow landed on, and an empty string names neither" };
   }
-  return result;
+  const requestId = deps.newUuid();
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcMcpOAuthCallbackUrlPayload(requestId, serverName, callbackUrl), `hand MCP server ${serverName}'s OAuth callback to session ${sessionId}`);
+  return result.ok ? { ...result, requestId } : result;
+}
+async function sendRcKeepAlive(deps, sessionId) {
+  return await deliverRcClientPayload(deps, sessionId, buildRcKeepAlivePayload(), `keep session ${sessionId} alive`);
 }
 
 // src/frontdoor/rcControl.ts
@@ -4106,6 +4219,25 @@ function answerJson(response, status, body) {
   response.writeHead(status, { "content-type": "application/json", "content-length": String(Buffer.byteLength(text, "utf8")) });
   response.end(text);
 }
+function isJsonObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function bodyString(body, field) {
+  const value = body[field];
+  return typeof value === "string" && value !== "" ? value : void 0;
+}
+function bodyStringAllowingEmpty(body, field) {
+  const value = body[field];
+  return typeof value === "string" ? value : void 0;
+}
+function bodyBoolean(body, field) {
+  const value = body[field];
+  return typeof value === "boolean" ? value : void 0;
+}
+function bodyPositiveInteger(body, field) {
+  const value = body[field];
+  return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : void 0;
+}
 async function readBody(request4) {
   return await new Promise((resolve, reject) => {
     const chunks = [];
@@ -4133,9 +4265,127 @@ function createRcControlHandler(deps) {
   const pendingPath = `${CONTROL_PATH_PREFIX}/pending`;
   const injectPath = `${CONTROL_PATH_PREFIX}/inject`;
   const answerPath = `${CONTROL_PATH_PREFIX}/answer`;
-  const interruptPath = `${CONTROL_PATH_PREFIX}/interrupt`;
-  const setModelPath = `${CONTROL_PATH_PREFIX}/set-model`;
-  const setPermissionModePath = `${CONTROL_PATH_PREFIX}/set-permission-mode`;
+  const controlWrites = [
+    {
+      name: "interrupt",
+      path: "interrupt",
+      read: (body) => {
+        const session = bodyString(body, "session");
+        return session === void 0 ? { error: "the interrupt body must be JSON naming a non-empty session id" } : { session, run: async () => await deps.interrupt(session) };
+      }
+    },
+    {
+      name: "set-model",
+      path: "set-model",
+      read: (body) => {
+        const session = bodyString(body, "session");
+        const model = bodyString(body, "model");
+        return session === void 0 || model === void 0 ? { error: "the set-model body must be JSON naming a non-empty session id and model id" } : { session, run: async () => await deps.setModel(session, model) };
+      }
+    },
+    {
+      name: "set-permission-mode",
+      path: "set-permission-mode",
+      read: (body) => {
+        const session = bodyString(body, "session");
+        const mode = body.mode;
+        return session === void 0 || !isRcPermissionMode(mode) ? { error: `the set-permission-mode body must be JSON naming a non-empty session id and a mode the SDK's own type permits (${RC_PERMISSION_MODE_LIST})` } : { session, run: async () => await deps.setPermissionMode(session, mode) };
+      }
+    },
+    {
+      name: "end-session",
+      path: "end-session",
+      read: (body) => {
+        const session = bodyString(body, "session");
+        const reason = "reason" in body ? bodyString(body, "reason") : void 0;
+        return session === void 0 || "reason" in body && reason === void 0 ? { error: "the end-session body must be JSON naming a non-empty session id, and a reason only as a non-empty string or absent" } : { session, run: async () => await deps.endSession(session, reason) };
+      }
+    },
+    {
+      name: "get-usage",
+      path: "get-usage",
+      read: (body) => {
+        const session = bodyString(body, "session");
+        const skipBehaviors = "skipBehaviors" in body ? bodyBoolean(body, "skipBehaviors") : void 0;
+        return session === void 0 || "skipBehaviors" in body && skipBehaviors === void 0 ? { error: "the get-usage body must be JSON naming a non-empty session id, and skipBehaviors only as a boolean or absent" } : { session, run: async () => await deps.getUsage(session, skipBehaviors) };
+      }
+    },
+    {
+      name: "get-context-usage",
+      path: "get-context-usage",
+      read: (body) => {
+        const session = bodyString(body, "session");
+        const detail = "detail" in body && isRcContextUsageDetail(body.detail) ? body.detail : void 0;
+        return session === void 0 || "detail" in body && detail === void 0 ? { error: `the get-context-usage body must be JSON naming a non-empty session id, and a detail level the SDK's own type permits (${RC_CONTEXT_USAGE_DETAILS.join(", ")}) or none` } : { session, run: async () => await deps.getContextUsage(session, detail) };
+      }
+    },
+    {
+      name: "read-file",
+      path: "read-file",
+      read: (body) => {
+        const session = bodyString(body, "session");
+        const path32 = bodyString(body, "path");
+        const maxBytes = "maxBytes" in body ? bodyPositiveInteger(body, "maxBytes") : void 0;
+        const encoding = "encoding" in body && isRcReadFileEncoding(body.encoding) ? body.encoding : void 0;
+        const refused2 = session === void 0 || path32 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
+        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path32, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
+      }
+    },
+    {
+      name: "file-suggestions",
+      path: "file-suggestions",
+      read: (body) => {
+        const session = bodyString(body, "session");
+        const query = bodyStringAllowingEmpty(body, "query");
+        return session === void 0 || query === void 0 ? { error: "the file-suggestions body must be JSON naming a non-empty session id and a query string, which may be empty" } : { session, run: async () => await deps.fileSuggestions(session, query) };
+      }
+    },
+    {
+      name: "keep-alive",
+      path: "keep-alive",
+      read: (body) => {
+        const session = bodyString(body, "session");
+        return session === void 0 ? { error: "the keep-alive body must be JSON naming a non-empty session id" } : { session, run: async () => await deps.keepAlive(session) };
+      }
+    },
+    {
+      name: "mcp-status",
+      path: "mcp-status",
+      read: (body) => {
+        const session = bodyString(body, "session");
+        return session === void 0 ? { error: "the mcp-status body must be JSON naming a non-empty session id" } : { session, run: async () => await deps.mcpStatus(session) };
+      }
+    },
+    {
+      name: "mcp-reconnect",
+      path: "mcp-reconnect",
+      read: (body) => {
+        const session = bodyString(body, "session");
+        const serverName = bodyString(body, "serverName");
+        return session === void 0 || serverName === void 0 ? { error: "the mcp-reconnect body must be JSON naming a non-empty session id and server name" } : { session, run: async () => await deps.mcpReconnect(session, serverName) };
+      }
+    },
+    {
+      name: "mcp-authenticate",
+      path: "mcp-authenticate",
+      read: (body) => {
+        const session = bodyString(body, "session");
+        const serverName = bodyString(body, "serverName");
+        const redirectUri = bodyString(body, "redirectUri");
+        return session === void 0 || serverName === void 0 || redirectUri === void 0 ? { error: "the mcp-authenticate body must be JSON naming a non-empty session id, server name, and redirect URI" } : { session, run: async () => await deps.mcpAuthenticate(session, serverName, redirectUri) };
+      }
+    },
+    {
+      name: "mcp-oauth-callback-url",
+      path: "mcp-oauth-callback-url",
+      read: (body) => {
+        const session = bodyString(body, "session");
+        const serverName = bodyString(body, "serverName");
+        const callbackUrl = bodyString(body, "callbackUrl");
+        return session === void 0 || serverName === void 0 || callbackUrl === void 0 ? { error: "the mcp-oauth-callback-url body must be JSON naming a non-empty session id, server name, and callback URL" } : { session, run: async () => await deps.mcpOAuthCallbackUrl(session, serverName, callbackUrl) };
+      }
+    }
+  ];
   return (request4, response) => {
     const presented = request4.headers.authorization;
     const bearerPrefix = "bearer ".length;
@@ -4220,73 +4470,33 @@ function createRcControlHandler(deps) {
         answerJson(response, HTTP_STATUS.badGateway, { error: result.message });
         return;
       }
-      if (url.pathname === interruptPath) {
-        if (request4.method !== "POST") {
-          answerJson(response, HTTP_STATUS.methodNotAllowed, { error: "the interrupt operation is a POST" });
-          return;
-        }
-        let parsed;
-        try {
-          parsed = JSON.parse(await readBody(request4));
-        } catch {
-          answerJson(response, HTTP_STATUS.badRequest, { error: "the interrupt body is not readable JSON within the control body cap" });
-          return;
-        }
-        if (typeof parsed !== "object" || parsed === null || !("session" in parsed) || typeof parsed.session !== "string" || parsed.session === "") {
-          answerJson(response, HTTP_STATUS.badRequest, { error: "the interrupt body must be JSON naming a non-empty session id" });
-          return;
-        }
-        const result = await deps.interrupt(parsed.session);
-        if (result.ok) {
-          answerJson(response, HTTP_STATUS.ok, { session: parsed.session, sequenceNums: result.sequenceNums });
-          return;
+      for (const route of controlWrites) {
+        if (url.pathname !== `${CONTROL_PATH_PREFIX}/${route.path}`) {
+          continue;
         }
-        answerJson(response, HTTP_STATUS.badGateway, { error: result.message });
-        return;
-      }
-      if (url.pathname === setModelPath) {
         if (request4.method !== "POST") {
-          answerJson(response, HTTP_STATUS.methodNotAllowed, { error: "the set-model operation is a POST" });
+          answerJson(response, HTTP_STATUS.methodNotAllowed, { error: `the ${route.name} operation is a POST` });
           return;
         }
         let parsed;
         try {
           parsed = JSON.parse(await readBody(request4));
         } catch {
-          answerJson(response, HTTP_STATUS.badRequest, { error: "the set-model body is not readable JSON within the control body cap" });
-          return;
-        }
-        if (typeof parsed !== "object" || parsed === null || !("session" in parsed) || !("model" in parsed) || typeof parsed.session !== "string" || typeof parsed.model !== "string" || parsed.session === "" || parsed.model === "") {
-          answerJson(response, HTTP_STATUS.badRequest, { error: "the set-model body must be JSON naming a non-empty session id and model id" });
+          answerJson(response, HTTP_STATUS.badRequest, { error: `the ${route.name} body is not readable JSON within the control body cap` });
           return;
         }
-        const result = await deps.setModel(parsed.session, parsed.model);
-        if (result.ok) {
-          answerJson(response, HTTP_STATUS.ok, { session: parsed.session, model: parsed.model, sequenceNums: result.sequenceNums });
-          return;
-        }
-        answerJson(response, HTTP_STATUS.badGateway, { error: result.message });
-        return;
-      }
-      if (url.pathname === setPermissionModePath) {
-        if (request4.method !== "POST") {
-          answerJson(response, HTTP_STATUS.methodNotAllowed, { error: "the set-permission-mode operation is a POST" });
+        if (!isJsonObject(parsed)) {
+          answerJson(response, HTTP_STATUS.badRequest, { error: `the ${route.name} body must be a JSON object` });
           return;
         }
-        let parsed;
-        try {
-          parsed = JSON.parse(await readBody(request4));
-        } catch {
-          answerJson(response, HTTP_STATUS.badRequest, { error: "the set-permission-mode body is not readable JSON within the control body cap" });
+        const read = route.read(parsed);
+        if ("error" in read) {
+          answerJson(response, HTTP_STATUS.badRequest, { error: read.error });
           return;
         }
-        if (typeof parsed !== "object" || parsed === null || !("session" in parsed) || !("mode" in parsed) || typeof parsed.session !== "string" || parsed.session === "" || !isRcPermissionMode(parsed.mode)) {
-          answerJson(response, HTTP_STATUS.badRequest, { error: `the set-permission-mode body must be JSON naming a non-empty session id and a mode the SDK's own type permits (${RC_PERMISSION_MODE_LIST})` });
-          return;
-        }
-        const result = await deps.setPermissionMode(parsed.session, parsed.mode);
+        const result = await read.run();
         if (result.ok) {
-          answerJson(response, HTTP_STATUS.ok, { session: parsed.session, mode: parsed.mode, sequenceNums: result.sequenceNums });
+          answerJson(response, HTTP_STATUS.ok, { session: read.session, ...result.requestId === void 0 ? {} : { request: result.requestId }, sequenceNums: result.sequenceNums });
           return;
         }
         answerJson(response, HTTP_STATUS.badGateway, { error: result.message });
@@ -4404,6 +4614,19 @@ function sequenceNumsOfBody(body) {
   }
   return sequenceNums;
 }
+function requestIdOfBody(body) {
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return void 0;
+  }
+  if (typeof parsed !== "object" || parsed === null || !("request" in parsed)) {
+    return void 0;
+  }
+  const value = parsed.request;
+  return typeof value === "string" && value !== "" ? value : void 0;
+}
 function frontDoorRcControl(transport, token) {
   const headers = { authorization: `Bearer ${token}` };
   const listAnswerOf = async (path32, what) => {
@@ -4492,7 +4715,8 @@ function frontDoorRcControl(transport, token) {
       if (sequenceNums === void 0) {
         return { ok: false, message: `the door accepted the event but its answer named no sequence numbers: ${answer.body}` };
       }
-      return { ok: true, sequenceNums };
+      const requestId = requestIdOfBody(answer.body);
+      return requestId === void 0 ? { ok: true, sequenceNums } : { ok: true, sequenceNums, requestId };
     }
     return { ok: false, message: describeFailure(answer.status, controlErrorOf(answer.body) ?? answer.body) };
   };
@@ -4509,7 +4733,21 @@ function frontDoorRcControl(transport, token) {
     ),
     interruptSession: async (sessionId) => await writeOf(`${CONTROL_PATH_PREFIX}/interrupt`, JSON.stringify({ session: sessionId }), (status, message) => `interrupting ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     setModel: async (sessionId, model) => await writeOf(`${CONTROL_PATH_PREFIX}/set-model`, JSON.stringify({ session: sessionId, model }), (status, message) => `setting the model on ${sessionId} failed (HTTP ${String(status)}): ${message}`),
-    setPermissionMode: async (sessionId, mode) => await writeOf(`${CONTROL_PATH_PREFIX}/set-permission-mode`, JSON.stringify({ session: sessionId, mode }), (status, message) => `setting the permission mode on ${sessionId} failed (HTTP ${String(status)}): ${message}`)
+    setPermissionMode: async (sessionId, mode) => await writeOf(`${CONTROL_PATH_PREFIX}/set-permission-mode`, JSON.stringify({ session: sessionId, mode }), (status, message) => `setting the permission mode on ${sessionId} failed (HTTP ${String(status)}): ${message}`),
+    endSession: async (sessionId, reason) => await writeOf(`${CONTROL_PATH_PREFIX}/end-session`, JSON.stringify({ session: sessionId, ...reason === void 0 ? {} : { reason } }), (status, message) => `ending ${sessionId} failed (HTTP ${String(status)}): ${message}`),
+    getUsage: async (sessionId, skipBehaviors) => await writeOf(`${CONTROL_PATH_PREFIX}/get-usage`, JSON.stringify({ session: sessionId, ...skipBehaviors === void 0 ? {} : { skipBehaviors } }), (status, message) => `requesting the usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
+    getContextUsage: async (sessionId, detail) => await writeOf(`${CONTROL_PATH_PREFIX}/get-context-usage`, JSON.stringify({ session: sessionId, ...detail === void 0 ? {} : { detail } }), (status, message) => `requesting the context usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
+    readFile: async (sessionId, path32, options) => await writeOf(
+      `${CONTROL_PATH_PREFIX}/read-file`,
+      JSON.stringify({ session: sessionId, path: path32, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
+      (status, message) => `reading ${path32} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
+    ),
+    fileSuggestions: async (sessionId, query) => await writeOf(`${CONTROL_PATH_PREFIX}/file-suggestions`, JSON.stringify({ session: sessionId, query }), (status, message) => `requesting file suggestions from ${sessionId} failed (HTTP ${String(status)}): ${message}`),
+    keepAlive: async (sessionId) => await writeOf(`${CONTROL_PATH_PREFIX}/keep-alive`, JSON.stringify({ session: sessionId }), (status, message) => `keeping ${sessionId} alive failed (HTTP ${String(status)}): ${message}`),
+    mcpStatus: async (sessionId) => await writeOf(`${CONTROL_PATH_PREFIX}/mcp-status`, JSON.stringify({ session: sessionId }), (status, message) => `requesting the MCP status of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
+    mcpReconnect: async (sessionId, serverName) => await writeOf(`${CONTROL_PATH_PREFIX}/mcp-reconnect`, JSON.stringify({ session: sessionId, serverName }), (status, message) => `reconnecting MCP server ${serverName} on ${sessionId} failed (HTTP ${String(status)}): ${message}`),
+    mcpAuthenticate: async (sessionId, serverName, redirectUri) => await writeOf(`${CONTROL_PATH_PREFIX}/mcp-authenticate`, JSON.stringify({ session: sessionId, serverName, redirectUri }), (status, message) => `authenticating MCP server ${serverName} on ${sessionId} failed (HTTP ${String(status)}): ${message}`),
+    mcpOAuthCallbackUrl: async (sessionId, serverName, callbackUrl) => await writeOf(`${CONTROL_PATH_PREFIX}/mcp-oauth-callback-url`, JSON.stringify({ session: sessionId, serverName, callbackUrl }), (status, message) => `handing MCP server ${serverName}'s OAuth callback to ${sessionId} failed (HTTP ${String(status)}): ${message}`)
   };
 }
 
@@ -5131,6 +5369,48 @@ var RcSetPermissionModeInputSchema = import_zod4.z.strictObject({
   session: import_zod4.z.string().min(1),
   mode: RcPermissionModeSchema
 });
+var RcEndSessionInputSchema = import_zod4.z.strictObject({
+  session: import_zod4.z.string().min(1),
+  reason: import_zod4.z.string().min(1).optional()
+});
+var RcGetUsageInputSchema = import_zod4.z.strictObject({
+  session: import_zod4.z.string().min(1),
+  skipBehaviors: import_zod4.z.boolean().optional()
+});
+var RcGetContextUsageInputSchema = import_zod4.z.strictObject({
+  session: import_zod4.z.string().min(1),
+  detail: import_zod4.z.enum(RC_CONTEXT_USAGE_DETAILS).optional()
+});
+var RcReadFileInputSchema = import_zod4.z.strictObject({
+  session: import_zod4.z.string().min(1),
+  path: import_zod4.z.string().min(1),
+  maxBytes: import_zod4.z.number().int().positive().optional(),
+  encoding: import_zod4.z.enum(RC_READ_FILE_ENCODINGS).optional()
+});
+var RcFileSuggestionsInputSchema = import_zod4.z.strictObject({
+  session: import_zod4.z.string().min(1),
+  query: import_zod4.z.string()
+});
+var RcKeepAliveInputSchema = import_zod4.z.strictObject({
+  session: import_zod4.z.string().min(1)
+});
+var RcMcpStatusInputSchema = import_zod4.z.strictObject({
+  session: import_zod4.z.string().min(1)
+});
+var RcMcpReconnectInputSchema = import_zod4.z.strictObject({
+  session: import_zod4.z.string().min(1),
+  serverName: import_zod4.z.string().min(1)
+});
+var RcMcpAuthenticateInputSchema = import_zod4.z.strictObject({
+  session: import_zod4.z.string().min(1),
+  serverName: import_zod4.z.string().min(1),
+  redirectUri: import_zod4.z.string().min(1)
+});
+var RcMcpOAuthCallbackUrlInputSchema = import_zod4.z.strictObject({
+  session: import_zod4.z.string().min(1),
+  serverName: import_zod4.z.string().min(1),
+  callbackUrl: import_zod4.z.string().min(1)
+});
 var RcListOutputSchema = import_zod4.z.strictObject({ sessions: import_zod4.z.readonly(import_zod4.z.array(RcSessionSummarySchema)) });
 var RcStatusOutputSchema = import_zod4.z.strictObject({ statuses: import_zod4.z.readonly(import_zod4.z.array(RcSessionStatusSchema)) });
 var RcPendingOutputSchema = import_zod4.z.strictObject({ pending: import_zod4.z.readonly(import_zod4.z.array(RcPendingRequestSummarySchema)) });
@@ -5138,6 +5418,11 @@ var RcWriteOutputSchema = import_zod4.z.strictObject({
   session: import_zod4.z.string(),
   sequenceNums: import_zod4.z.readonly(import_zod4.z.array(import_zod4.z.number()))
 });
+var RcControlWriteOutputSchema = import_zod4.z.strictObject({
+  session: import_zod4.z.string(),
+  request: import_zod4.z.string(),
+  sequenceNums: import_zod4.z.readonly(import_zod4.z.array(import_zod4.z.number()))
+});
 var RcAnswerOutputSchema = import_zod4.z.strictObject({
   session: import_zod4.z.string(),
   request: import_zod4.z.string(),
@@ -5166,6 +5451,15 @@ function createRcApiRouter(deps) {
     }
     return result.sequenceNums;
   };
+  const deliveredControl = (sessionId, result) => {
+    if (!result.ok) {
+      throw new import_client.ORPCError("BAD_GATEWAY", { message: result.message });
+    }
+    if (result.requestId === void 0) {
+      throw new import_client.ORPCError("INTERNAL_SERVER_ERROR", { message: "the control request was delivered but the door cannot name the request id it minted, so the worker's answer cannot be matched" });
+    }
+    return { request: result.requestId, sequenceNums: result.sequenceNums };
+  };
   return {
     rc: {
       list: authed.output(RcListOutputSchema).handler(() => ({ sessions: deps.list() })),
@@ -5188,9 +5482,19 @@ function createRcApiRouter(deps) {
         const decision = { approve: input.approve, message: input.approve || input.text === void 0 ? void 0 : input.text };
         return { session: input.session, request: input.request, sequenceNums: delivered(input.session, await deps.answer(input.session, input.request, decision)) };
       }),
-      interrupt: authed.input(RcInterruptInputSchema).output(RcWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, sequenceNums: delivered(input.session, await deps.interrupt(input.session)) })),
-      setModel: authed.input(RcSetModelInputSchema).output(RcWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, sequenceNums: delivered(input.session, await deps.setModel(input.session, input.model)) })),
-      setPermissionMode: authed.input(RcSetPermissionModeInputSchema).output(RcWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, sequenceNums: delivered(input.session, await deps.setPermissionMode(input.session, input.mode)) })),
+      interrupt: authed.input(RcInterruptInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.interrupt(input.session)) })),
+      setModel: authed.input(RcSetModelInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.setModel(input.session, input.model)) })),
+      setPermissionMode: authed.input(RcSetPermissionModeInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.setPermissionMode(input.session, input.mode)) })),
+      endSession: authed.input(RcEndSessionInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.endSession(input.session, input.reason)) })),
+      getUsage: authed.input(RcGetUsageInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.getUsage(input.session, input.skipBehaviors)) })),
+      getContextUsage: authed.input(RcGetContextUsageInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.getContextUsage(input.session, input.detail)) })),
+      readFile: authed.input(RcReadFileInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.readFile(input.session, input.path, { ...input.maxBytes === void 0 ? {} : { maxBytes: input.maxBytes }, ...input.encoding === void 0 ? {} : { encoding: input.encoding } })) })),
+      fileSuggestions: authed.input(RcFileSuggestionsInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.fileSuggestions(input.session, input.query)) })),
+      keepAlive: authed.input(RcKeepAliveInputSchema).output(RcWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, sequenceNums: delivered(input.session, await deps.keepAlive(input.session)) })),
+      mcpStatus: authed.input(RcMcpStatusInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpStatus(input.session)) })),
+      mcpReconnect: authed.input(RcMcpReconnectInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpReconnect(input.session, input.serverName)) })),
+      mcpAuthenticate: authed.input(RcMcpAuthenticateInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpAuthenticate(input.session, input.serverName, input.redirectUri)) })),
+      mcpOAuthCallbackUrl: authed.input(RcMcpOAuthCallbackUrlInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpOAuthCallbackUrl(input.session, input.serverName, input.callbackUrl)) })),
       subscribe: authed.input(RcSessionQuerySchema).output((0, import_server2.eventIterator)(RcStreamEventSchema)).handler(async function* ({ input, signal }) {
         const queue = [];
         let wake;
@@ -11457,6 +11761,106 @@ function removeDirectoryRule(paths, rulePath) {
 var import_node_crypto10 = require("node:crypto");
 var import_node_path30 = __toESM(require("node:path"), 1);
 
+// package.json
+var package_default = {
+  name: "agent-shim",
+  version: "8.24.0",
+  description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
+  license: "MIT",
+  author: "Joseph Mearman <joseph@mearman.co.uk>",
+  repository: {
+    type: "git",
+    url: "git+https://github.com/ExaDev/agent-shim.git"
+  },
+  homepage: "https://github.com/ExaDev/agent-shim#readme",
+  bugs: "https://github.com/ExaDev/agent-shim/issues",
+  keywords: [
+    "claude-code",
+    "claude",
+    "cli"
+  ],
+  packageManager: "pnpm@12.4.1+sha512.2e81e399d73fe8390dab25e06aa788ab7a5908248d2f5a370f82b481147a6a7a367bf8048f9a6fdb6460f21a66f0542dedb8b94ca2c8723596741920b1656d4c",
+  type: "module",
+  engines: {
+    node: "^22.18 || >=24"
+  },
+  bin: {
+    "agent-shim": "dist/cli.cjs",
+    "claude-use": "dist/cli.cjs"
+  },
+  files: [
+    "dist/cli.cjs",
+    "dist/index.mjs",
+    "dist/index.cjs",
+    "dist/types"
+  ],
+  scripts: {
+    prepare: "husky && node scripts/build.mts --bundle-only",
+    typecheck: "turbo run _typecheck",
+    _typecheck: "tsc --noEmit",
+    lint: "turbo run _lint",
+    _lint: "eslint . --cache --cache-location .eslintcache --max-warnings 0",
+    test: "turbo run _test",
+    _test: "vitest run",
+    "test:coverage": "turbo run _test:coverage",
+    "_test:coverage": "vitest run --coverage",
+    knip: "turbo run _knip",
+    _knip: "knip --cache",
+    build: "turbo run _build",
+    _build: "node scripts/build.mts",
+    "build:bundle": "node scripts/build.mts --bundle-only",
+    prepublishOnly: "pnpm build:bundle",
+    schema: "node scripts/gen-schema.mts"
+  },
+  dependencies: {
+    "@clack/prompts": "^1.8.0",
+    "@orpc/client": "1.15.4",
+    "@orpc/server": "1.15.4",
+    commander: "^15.0.0",
+    cosmiconfig: "^10.0.1",
+    picomatch: "^4.0.7",
+    undici: "7.29.1",
+    zod: "^4.6.1"
+  },
+  devDependencies: {
+    "@commitlint/cli": "^21.2.2",
+    "@commitlint/config-conventional": "^21.2.2",
+    "@exadev/eslint-config": "2.12.1",
+    "@semantic-release/changelog": "^7.0.0",
+    "@semantic-release/git": "^11.0.1",
+    "@semantic-release/npm": "^13.1.5",
+    "@types/node": "^26.5.1",
+    "@types/picomatch": "^4.0.3",
+    "@vitest/coverage-v8": "^4.1.11",
+    "conventional-changelog-conventionalcommits": "^10.4.0",
+    esbuild: "^0.28.2",
+    eslint: "^10.10.0",
+    globals: "^17.12.0",
+    husky: "^9.1.7",
+    jiti: "^2.7.0",
+    knip: "^6.35.1",
+    "lint-staged": "^17.5.0",
+    rollup: "4.64.0",
+    "rollup-plugin-dts": "6.5.1",
+    "semantic-release": "^25.0.9",
+    turbo: "^2.11.5",
+    typescript: "^6.0.3",
+    "typescript-eslint": "^8.70.0",
+    vitest: "^4.1.11"
+  },
+  main: "dist/index.cjs",
+  module: "dist/index.mjs",
+  types: "dist/types/index.d.ts",
+  exports: {
+    ".": {
+      types: "./dist/types/index.d.ts",
+      import: "./dist/index.mjs",
+      require: "./dist/index.cjs"
+    },
+    "./package.json": "./package.json"
+  }
+};
+
 // src/launcher/argv.ts
 var ConflictingIdentityError = class extends UsageError {
   constructor(positional, flag) {
@@ -11929,6 +12333,88 @@ function spawnClaude(params) {
   return params.proc.exit(exitCodeFor(result));
 }
 
+// src/update/update.ts
+var LATEST_RELEASE_URL = "https://github.com/ExaDev/agent-shim/releases/latest";
+function compareVersions3(left, right) {
+  const parse = (version) => {
+    const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(version);
+    if (match === null) {
+      throw new Error(`not a plain release version: ${version}`);
+    }
+    return [Number(match[1]), Number(match[2]), Number(match[3])];
+  };
+  const leftParts = parse(left);
+  const rightParts = parse(right);
+  return leftParts.map((part, index) => part - (rightParts[index] ?? 0)).find((difference) => difference !== 0) ?? 0;
+}
+function releaseTagFromUrl(url) {
+  const segment = url.split("?")[0]?.split("/").at(-1);
+  const candidate = segment?.startsWith("v") === true ? segment.slice(1) : void 0;
+  return candidate !== void 0 && /^\d+\.\d+\.\d+$/.test(candidate) ? candidate : void 0;
+}
+
+// src/update/launchHook.ts
+var UPDATE_CHECK_COOLDOWN_MS = 864e5;
+function resolveUpdateMode(globalConfig) {
+  return globalConfig?.update?.mode ?? "off";
+}
+function updateCheckDue(contents, nowMs, cooldownMs = UPDATE_CHECK_COOLDOWN_MS) {
+  if (contents === void 0) {
+    return true;
+  }
+  const checkedAt = Date.parse(contents.trim());
+  if (Number.isNaN(checkedAt)) {
+    return true;
+  }
+  const age = nowMs - checkedAt;
+  return age < 0 || age >= cooldownMs;
+}
+var NOOP_HANDLE = { markChildStarted: () => void 0 };
+function updateNotifyLine(currentVersion, latest) {
+  return `agent-shim: update available: ${currentVersion} -> ${latest} (run \`agent-shim update\` to install it)`;
+}
+function runLaunchUpdateCheck(params) {
+  const { mode, checkPath, currentVersion, port } = params;
+  if (mode === "off" || port === void 0) {
+    return NOOP_HANDLE;
+  }
+  let childStarted = false;
+  try {
+    if (!updateCheckDue(port.readStamp(checkPath), port.now())) {
+      return NOOP_HANDLE;
+    }
+    port.writeStamp(checkPath, new Date(port.now()).toISOString());
+  } catch {
+    return NOOP_HANDLE;
+  }
+  const answer = (url) => {
+    try {
+      const latest = releaseTagFromUrl(url);
+      if (latest === void 0 || compareVersions3(latest, currentVersion) <= 0) {
+        return;
+      }
+      if (mode === "auto") {
+        port.spawnDetached(["update"]);
+      }
+      if (!childStarted) {
+        port.writeErr(updateNotifyLine(currentVersion, latest));
+      }
+    } catch {
+    }
+  };
+  port.effectiveUrl(LATEST_RELEASE_URL).then(
+    (url) => {
+      answer(url);
+    },
+    () => void 0
+  );
+  return {
+    markChildStarted: () => {
+      childStarted = true;
+    }
+  };
+}
+
 // src/launcher.ts
 function resolveIdentityCredential(identity, credential, env, port) {
   if (port === void 0) {
@@ -12094,6 +12580,12 @@ function prepareLaunch(params) {
   log.info(
     `agent-shim: identity ${identityDecision.name ?? "(none)"} (${identityDecision.source}${poolExplanation === void 0 ? "" : `, ${poolExplanation}`}), config profile ${configProfileDecision.name ?? "(none)"} (${configProfileDecision.source})` + (resolvedProvider === void 0 ? "" : `, provider ${resolvedProvider.name} (credential ${resolvedProvider.credential.target} from ${describeSource(resolvedProvider.credential.source)})`) + (identityCredential === void 0 ? "" : `, identity credential ${identityCredential.target} from ${describeSource(identityCredential.source)}`)
   );
+  const updateCheck = runLaunchUpdateCheck({
+    mode: params.updateMode ?? "off",
+    checkPath: import_node_path30.default.join(paths.root, "update.check"),
+    currentVersion: package_default.version,
+    port: params.update
+  });
   let cascadeLaunch;
   if (farmContext !== void 0) {
     const { farm: resyncFarmRuntime, identity: resyncIdentity, cascade } = farmContext;
@@ -12199,11 +12691,12 @@ function prepareLaunch(params) {
       registered();
     }
   };
-  return { bin: discovered.path, args: finalArgv, env: finalEnv, release };
+  return { bin: discovered.path, args: finalArgv, env: finalEnv, release, markChildStarted: updateCheck.markChildStarted };
 }
 function runLauncher(params) {
   const plan = prepareLaunch(params);
   try {
+    plan.markChildStarted();
     spawnClaude({ bin: plan.bin, args: plan.args, env: plan.env, spawn: params.spawn, proc: params.proc, beforeExit: plan.release });
   } finally {
     plan.release();
@@ -12366,6 +12859,7 @@ function buildFarmRuntime(paths, cwd) {
   const loaded = loadCascadeInput({ paths, home, cwd, read });
   const selections = readDirectorySelections(loaded);
   const git = resolveGitBranch(realRunPort, cwd);
+  const updateMode = resolveUpdateMode(loaded.globalConfig);
   return {
     runtime: {
       fs: realFarmFs,
@@ -12391,7 +12885,8 @@ function buildFarmRuntime(paths, cwd) {
     ...selections.identity === void 0 ? {} : { directoryIdentity: selections.identity },
     ...selections.configProfile === void 0 ? {} : { directoryConfigProfile: selections.configProfile },
     ...loaded.globalConfig?.defaultConfigProfile === void 0 ? {} : { globalDefaultConfigProfile: loaded.globalConfig.defaultConfigProfile },
-    ...loaded.globalConfig?.pools === void 0 ? {} : { pools: loaded.globalConfig.pools }
+    ...loaded.globalConfig?.pools === void 0 ? {} : { pools: loaded.globalConfig.pools },
+    ...updateMode === "off" ? {} : { updateMode }
   };
 }
 function realClaudeBinaryResolver(paths) {
@@ -12413,6 +12908,7 @@ function realPrepareLaunchParams(paths, options) {
     ...farm.directoryConfigProfile === void 0 ? {} : { directoryRuleConfigProfile: farm.directoryConfigProfile },
     ...farm.globalDefaultConfigProfile === void 0 ? {} : { globalDefaultConfigProfile: farm.globalDefaultConfigProfile },
     ...farm.pools === void 0 ? {} : { pools: farm.pools },
+    ...farm.updateMode === void 0 ? {} : { updateMode: farm.updateMode },
     ...options.allowMissingConfigProfile === void 0 ? {} : { allowMissingConfigProfile: options.allowMissingConfigProfile }
   };
 }
@@ -12511,10 +13007,12 @@ function prepareClaudeLaunch(options) {
   ProviderKindMismatchError,
   ProviderNotFoundError,
   ProviderSchema,
+  RC_CONTEXT_USAGE_DETAILS,
   RC_IDLE_EXPIRY_MS,
   RC_ORPC_PATH_PREFIX,
   RC_PENDING_DEADLINE_MS,
   RC_PERMISSION_MODES,
+  RC_READ_FILE_ENCODINGS,
   RC_REQUEST_PARSE_CAP_BYTES,
   RC_SELF_HOST_ENV,
   RC_SELF_HOST_KEEPALIVE_MS,
@@ -12545,11 +13043,23 @@ function prepareClaudeLaunch(options) {
   addPool,
   addProvider,
   answerRcControlRequest,
+  authenticateRcSessionMcpServer,
   buildEntryFacts,
   buildLayoutPaths,
+  buildRcControlRequestPayload,
   buildRcControlResponsePayload,
+  buildRcEndSessionPayload,
   buildRcEventWriteBody,
+  buildRcFileSuggestionsPayload,
+  buildRcGetContextUsagePayload,
+  buildRcGetUsagePayload,
   buildRcInterruptPayload,
+  buildRcKeepAlivePayload,
+  buildRcMcpAuthenticatePayload,
+  buildRcMcpOAuthCallbackUrlPayload,
+  buildRcMcpReconnectPayload,
+  buildRcMcpStatusPayload,
+  buildRcReadFilePayload,
   buildRcSetModelPayload,
   buildRcSetPermissionModePayload,
   buildRcUserMessagePayload,
@@ -12582,6 +13092,7 @@ function prepareClaudeLaunch(options) {
   doorApiAuth,
   doorApiNodeHandlerOf,
   effectiveWindow,
+  endRcSession,
   ensureCa,
   ensureFrontDoor,
   ensureHeadroom,
@@ -12598,6 +13109,9 @@ function prepareClaudeLaunch(options) {
   frontDoorRcApiClient,
   frontDoorRcControl,
   generateCa,
+  getRcSessionContextUsage,
+  getRcSessionMcpStatus,
+  getRcSessionUsage,
   headroomSocketTarget,
   identityExists,
   injectRcUserMessage,
@@ -12605,7 +13119,9 @@ function prepareClaudeLaunch(options) {
   isIdentityDirectoryName,
   isInterceptedHost,
   isPrivateAddress,
+  isRcContextUsageDetail,
   isRcPermissionMode,
+  isRcReadFileEncoding,
   lateRcEventDial,
   lateRcStreamDial,
   listDirectoryRules,
@@ -12639,6 +13155,7 @@ function prepareClaudeLaunch(options) {
   readProfile,
   readProvider,
   readRcSelfHostRecord,
+  readRcSessionFile,
   readUsageSnapshot,
   realConnectCertStore,
   realConnectEffects,
@@ -12646,6 +13163,7 @@ function prepareClaudeLaunch(options) {
   realRcEventDial,
   realRcStreamDial,
   realRcWebFetch,
+  reconnectRcSessionMcpServer,
   recoverFarm,
   recoveryDiagnostics,
   removeDirectoryRule,
@@ -12665,6 +13183,7 @@ function prepareClaudeLaunch(options) {
   runFrontDoorSupervisor,
   runLauncher,
   runSupervisor,
+  sendRcKeepAlive,
   servedByPipeline,
   setAllowAmbientCredential,
   setDefaultConfigProfile,
@@ -12680,6 +13199,8 @@ function prepareClaudeLaunch(options) {
   snapshotPath,
   spawnClaude,
   startConnectServer,
+  submitRcSessionMcpOAuthCallbackUrl,
+  suggestRcSessionFiles,
   topLevelNames,
   updateDirectoryRule,
   updateProvider,