agent-shim 8.24.0 → 8.25.0

package/dist/cli.cjs

@@ -61796,7 +61796,7 @@ function registerIdentityCommand(program2, deps) {
 // package.json
 var package_default = {
   name: "agent-shim",
-  version: "8.24.0",
+  version: "8.25.0",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -66142,13 +66142,6 @@ var https3 = __toESM(require("node:https"), 1);
 var net2 = __toESM(require("node:net"), 1);
 var tls = __toESM(require("node:tls"), 1);
 
-// src/frontdoor/server.ts
-var import_node_http2 = __toESM(require("node:http"), 1);
-var import_node_https = __toESM(require("node:https"), 1);
-
-// src/frontdoor/rcControl.ts
-var https = __toESM(require("node:https"), 1);
-
 // src/frontdoor/rcSessions.ts
 var RC_SESSIONS_PATH_PREFIX = "/v1/code/sessions";
 var RC_SESSION_ID_PREFIX = "cse_";
@@ -66725,7 +66718,7 @@ async function answerRcControlRequest(deps, sessionId, requestId, decision) {
   }
   return result;
 }
-async function deliverRcClientPayload(deps, sessionId, payload, action) {
+async function deliverRcClientPayload(deps, sessionId, payload, action, to = "events") {
   const credential = deps.credentialOf(sessionId);
   if (credential === void 0) {
     return { ok: false, message: rcSessionNotObservedMessage(sessionId) };
@@ -66736,7 +66729,7 @@ async function deliverRcClientPayload(deps, sessionId, payload, action) {
   const body = JSON.stringify(buildRcEventWriteBody(payload));
   let answer;
   try {
-    answer = await deps.dial.writeEvents(sessionId, rcWriteHeaders(credential), body);
+    answer = await (to === "teleport-events" ? deps.dial.writeTeleportEvents(sessionId, rcWriteHeaders(credential), body) : deps.dial.writeEvents(sessionId, rcWriteHeaders(credential), body));
   } catch (error62) {
     return { ok: false, message: `the door could not reach the API host to ${action}: ${error62 instanceof Error ? error62.message : String(error62)}` };
   }
@@ -66830,8 +66823,22 @@ async function submitRcSessionMcpOAuthCallbackUrl(deps, sessionId, serverName, c
 async function sendRcKeepAlive(deps, sessionId) {
   return await deliverRcClientPayload(deps, sessionId, buildRcKeepAlivePayload(), `keep session ${sessionId} alive`);
 }
+async function teleportRcSession(deps, sessionId, marker) {
+  if (marker === "") {
+    return { ok: false, message: "a teleport write needs a non-empty marker: the teleport relay anchors on a marker line's uuid and string content, and an empty string carries neither" };
+  }
+  return await deliverRcClientPayload(deps, sessionId, buildRcUserMessagePayload(deps.newUuid(), sessionId, marker), `teleport a marker into session ${sessionId}`, "teleport-events");
+}
+function buildRcMarkReadBody(eventId) {
+  return eventId === void 0 ? {} : { event_id: eventId };
+}
+
+// src/frontdoor/server.ts
+var import_node_http2 = __toESM(require("node:http"), 1);
+var import_node_https = __toESM(require("node:https"), 1);
 
 // src/frontdoor/rcControl.ts
+var https = __toESM(require("node:https"), 1);
 var RC_PERMISSION_MODE_LIST = RC_PERMISSION_MODES.join(", ");
 var CONTROL_PATH_PREFIX = "/__agent-shim/rc";
 var CONTROL_BODY_CAP_BYTES = 10485760;
@@ -67005,6 +67012,15 @@ function createRcControlHandler(deps) {
         const callbackUrl = bodyString(body, "callbackUrl");
         return session === void 0 || serverName === void 0 || callbackUrl === void 0 ? { error: "the mcp-oauth-callback-url body must be JSON naming a non-empty session id, server name, and callback URL" } : { session, run: async () => await deps.mcpOAuthCallbackUrl(session, serverName, callbackUrl) };
       }
+    },
+    {
+      name: "teleport",
+      path: "teleport",
+      read: (body) => {
+        const session = bodyString(body, "session");
+        const marker = bodyString(body, "marker");
+        return session === void 0 || marker === void 0 ? { error: "the teleport body must be JSON naming a non-empty session id and marker" } : { session, run: async () => await deps.teleport(session, marker) };
+      }
     }
   ];
   return (request7, response) => {
@@ -67368,7 +67384,8 @@ function frontDoorRcControl(transport, token) {
     mcpStatus: async (sessionId) => await writeOf(`${CONTROL_PATH_PREFIX}/mcp-status`, JSON.stringify({ session: sessionId }), (status, message) => `requesting the MCP status of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     mcpReconnect: async (sessionId, serverName) => await writeOf(`${CONTROL_PATH_PREFIX}/mcp-reconnect`, JSON.stringify({ session: sessionId, serverName }), (status, message) => `reconnecting MCP server ${serverName} on ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     mcpAuthenticate: async (sessionId, serverName, redirectUri) => await writeOf(`${CONTROL_PATH_PREFIX}/mcp-authenticate`, JSON.stringify({ session: sessionId, serverName, redirectUri }), (status, message) => `authenticating MCP server ${serverName} on ${sessionId} failed (HTTP ${String(status)}): ${message}`),
-    mcpOAuthCallbackUrl: async (sessionId, serverName, callbackUrl) => await writeOf(`${CONTROL_PATH_PREFIX}/mcp-oauth-callback-url`, JSON.stringify({ session: sessionId, serverName, callbackUrl }), (status, message) => `handing MCP server ${serverName}'s OAuth callback to ${sessionId} failed (HTTP ${String(status)}): ${message}`)
+    mcpOAuthCallbackUrl: async (sessionId, serverName, callbackUrl) => await writeOf(`${CONTROL_PATH_PREFIX}/mcp-oauth-callback-url`, JSON.stringify({ session: sessionId, serverName, callbackUrl }), (status, message) => `handing MCP server ${serverName}'s OAuth callback to ${sessionId} failed (HTTP ${String(status)}): ${message}`),
+    teleport: async (sessionId, marker) => await writeOf(`${CONTROL_PATH_PREFIX}/teleport`, JSON.stringify({ session: sessionId, marker }), (status, message) => `teleporting a marker into ${sessionId} failed (HTTP ${String(status)}): ${message}`)
   };
 }
 
@@ -67650,36 +67667,38 @@ function tlsFacts(options) {
 }
 function realRcEventDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  return {
-    writeEvents: async (sessionId, headers, body) => await new Promise((resolve, reject) => {
-      const options = {
-        host: target.host,
-        port: target.port,
-        method: "POST",
-        path: `/v1/code/sessions/${encodeURIComponent(sessionId)}/events`,
-        // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
-        headers: { ...headers, host: target.servername ?? target.host, "content-length": String(Buffer.byteLength(body, "utf8")) },
-        agent
-      };
-      options.servername = target.servername ?? target.host;
-      if (target.ca !== void 0) {
-        options.ca = [...target.ca];
-      }
-      if (target.rejectUnauthorized !== void 0) {
-        options.rejectUnauthorized = target.rejectUnauthorized;
-      }
-      const request7 = https3.request(options, (response) => {
-        const chunks = [];
-        response.on("data", (chunk) => {
-          chunks.push(chunk);
-        });
-        response.on("end", () => {
-          resolve({ status: response.statusCode ?? HTTP_BAD_GATEWAY, body: Buffer.concat(chunks).toString("utf8") });
-        });
+  const post = async (path46, headers, body) => await new Promise((resolve, reject) => {
+    const options = {
+      host: target.host,
+      port: target.port,
+      method: "POST",
+      path: path46,
+      // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
+      headers: { ...headers, host: target.servername ?? target.host, "content-length": String(Buffer.byteLength(body, "utf8")) },
+      agent
+    };
+    options.servername = target.servername ?? target.host;
+    if (target.ca !== void 0) {
+      options.ca = [...target.ca];
+    }
+    if (target.rejectUnauthorized !== void 0) {
+      options.rejectUnauthorized = target.rejectUnauthorized;
+    }
+    const request7 = https3.request(options, (response) => {
+      const chunks = [];
+      response.on("data", (chunk) => {
+        chunks.push(chunk);
       });
-      request7.once("error", reject);
-      request7.end(body);
-    })
+      response.on("end", () => {
+        resolve({ status: response.statusCode ?? HTTP_BAD_GATEWAY, body: Buffer.concat(chunks).toString("utf8") });
+      });
+    });
+    request7.once("error", reject);
+    request7.end(body);
+  });
+  return {
+    writeEvents: async (sessionId, headers, body) => await post(`/v1/code/sessions/${encodeURIComponent(sessionId)}/events`, headers, body),
+    writeTeleportEvents: async (sessionId, headers, body) => await post(`/v1/code/sessions/${encodeURIComponent(sessionId)}/teleport-events`, headers, body)
   };
 }
 var NO_CHUNKS = {
@@ -67697,7 +67716,8 @@ function lateRcEventDial(resolve) {
     return built.dial;
   };
   return {
-    writeEvents: async (sessionId, headers, body) => await dialFor().writeEvents(sessionId, headers, body)
+    writeEvents: async (sessionId, headers, body) => await dialFor().writeEvents(sessionId, headers, body),
+    writeTeleportEvents: async (sessionId, headers, body) => await dialFor().writeTeleportEvents(sessionId, headers, body)
   };
 }
 function lateRcStreamDial(resolve) {
@@ -67710,7 +67730,8 @@ function lateRcStreamDial(resolve) {
     return built.dial;
   };
   return {
-    announcePresence: async (sessionId, headers, clientId) => await dialFor().announcePresence(sessionId, headers, clientId),
+    announcePresence: async (sessionId, headers, clientId, clear) => await dialFor().announcePresence(sessionId, headers, clientId, clear),
+    markRead: async (sessionId, headers, eventId) => await dialFor().markRead(sessionId, headers, eventId),
     openStream: async (sessionId, headers, resume, signal) => await dialFor().openStream(sessionId, headers, resume, signal)
   };
 }
@@ -67752,11 +67773,16 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
     return Buffer.concat(chunks).toString("utf8");
   };
   return {
-    announcePresence: async (sessionId, headers, clientId) => {
-      const body = JSON.stringify({ client_id: clientId, clear: false });
+    announcePresence: async (sessionId, headers, clientId, clear) => {
+      const body = JSON.stringify({ client_id: clientId, clear });
       const { status, response } = await request7("POST", `/v1/code/sessions/${encodeURIComponent(sessionId)}/client/presence`, { ...headers, "content-type": "application/json" }, body, new AbortController().signal);
       return { status, body: await readAll(response) };
     },
+    markRead: async (sessionId, headers, eventId) => {
+      const body = JSON.stringify(buildRcMarkReadBody(eventId));
+      const { status, response } = await request7("POST", `/v1/code/sessions/${encodeURIComponent(sessionId)}/mark_read`, { ...headers, "content-type": "application/json" }, body, new AbortController().signal);
+      return { status, body: await readAll(response) };
+    },
     openStream: async (sessionId, headers, resume, signal) => {
       const path46 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
       const streamHeaders = resume === void 0 ? headers : { ...headers, "last-event-id": String(resume.fromSequenceNum) };
@@ -72074,6 +72100,10 @@ var RcMcpOAuthCallbackUrlInputSchema = external_exports.strictObject({
   serverName: external_exports.string().min(1),
   callbackUrl: external_exports.string().min(1)
 });
+var RcTeleportInputSchema = external_exports.strictObject({
+  session: external_exports.string().min(1),
+  marker: external_exports.string().min(1)
+});
 var RcListOutputSchema = external_exports.strictObject({ sessions: external_exports.readonly(external_exports.array(RcSessionSummarySchema)) });
 var RcStatusOutputSchema = external_exports.strictObject({ statuses: external_exports.readonly(external_exports.array(RcSessionStatusSchema)) });
 var RcPendingOutputSchema = external_exports.strictObject({ pending: external_exports.readonly(external_exports.array(RcPendingRequestSummarySchema)) });
@@ -72158,6 +72188,7 @@ function createRcApiRouter(deps) {
       mcpReconnect: authed.input(RcMcpReconnectInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input: input2 }) => ({ session: input2.session, ...deliveredControl(input2.session, await deps.mcpReconnect(input2.session, input2.serverName)) })),
       mcpAuthenticate: authed.input(RcMcpAuthenticateInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input: input2 }) => ({ session: input2.session, ...deliveredControl(input2.session, await deps.mcpAuthenticate(input2.session, input2.serverName, input2.redirectUri)) })),
       mcpOAuthCallbackUrl: authed.input(RcMcpOAuthCallbackUrlInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input: input2 }) => ({ session: input2.session, ...deliveredControl(input2.session, await deps.mcpOAuthCallbackUrl(input2.session, input2.serverName, input2.callbackUrl)) })),
+      teleport: authed.input(RcTeleportInputSchema).output(RcWriteOutputSchema).handler(async ({ input: input2 }) => ({ session: input2.session, sequenceNums: delivered(input2.session, await deps.teleport(input2.session, input2.marker)) })),
       subscribe: authed.input(RcSessionQuerySchema).output(eventIterator(RcStreamEventSchema)).handler(async function* ({ input: input2, signal }) {
         const queue = [];
         let wake;
@@ -73738,6 +73769,193 @@ var import_node_crypto14 = require("node:crypto");
 // src/frontdoor/rcSelfHostMint.ts
 var import_node_path34 = __toESM(require("node:path"), 1);
 
+// src/frontdoor/rcSelfHostEndpoints.ts
+var RC_SOURCE_WORKER = "worker";
+var RC_SOURCE_CLIENT = "client";
+function isRecord4(value2) {
+  return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+}
+function parseJsonObject2(body) {
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return void 0;
+  }
+  return isRecord4(parsed) ? parsed : void 0;
+}
+function nonEmptyString2(record2, field) {
+  const value2 = record2 === void 0 ? void 0 : record2[field];
+  return typeof value2 === "string" && value2 !== "" ? value2 : void 0;
+}
+function numberOf(record2, field) {
+  const value2 = record2 === void 0 ? void 0 : record2[field];
+  if (typeof value2 === "number" && Number.isFinite(value2)) {
+    return value2;
+  }
+  if (typeof value2 === "string" && /^[0-9]+$/.test(value2)) {
+    return Number(value2);
+  }
+  return void 0;
+}
+function pageOfRcChannel(url2, rows, idOf, rowOf) {
+  const query = new URL(url2, "http://127.0.0.1").searchParams;
+  const anchor2 = query.get("after_event_id") ?? query.get("cursor");
+  const rawLimit = query.get("limit");
+  const limit = rawLimit === null ? void 0 : numberOf({ value: rawLimit }, "value");
+  if (limit !== void 0 && limit < 1) {
+    return { error: "the limit names a whole number of rows of at least one" };
+  }
+  const from = anchor2 === null ? 0 : rows.findIndex((row) => idOf(row) === anchor2) + 1;
+  if (anchor2 !== null && from === 0) {
+    return { error: `the anchor names an event id this surface holds no row for: ${anchor2}` };
+  }
+  const page = limit === void 0 ? rows.slice(from) : rows.slice(from, from + limit);
+  const last = page[page.length - 1];
+  return { data: page.map(rowOf), ...last === void 0 ? {} : { next_cursor: idOf(last) } };
+}
+async function serveRcClientChannels(ctx, tail, method, maxBatchEvents) {
+  const { request: request7, response, session } = ctx;
+  if (tail === "client/presence" && method === "POST") {
+    const body = parseJsonObject2(await ctx.readBody(request7.body, CONTROL_BODY_CAP_BYTES));
+    const clientId = nonEmptyString2(body, "client_id");
+    const clear = body?.clear;
+    if (clientId === void 0 || clear !== void 0 && typeof clear !== "boolean") {
+      await ctx.answerJson(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "a presence announcement is JSON naming a non-empty client_id, with clear only as a boolean or absent" } });
+      return true;
+    }
+    if (clear === true) {
+      session.clients.delete(clientId);
+      ctx.log?.(`rc selfhost ${session.id}: client ${clientId} cleared its presence`);
+    } else {
+      session.clients.set(clientId, ctx.now());
+      ctx.log?.(`rc selfhost ${session.id}: client ${clientId} announced its presence${session.clients.size === 1 ? "" : ` (${String(session.clients.size)} clients now announced)`}`);
+    }
+    await ctx.answerJson(response, HTTP_STATUS.ok, { refresh_after_seconds: ctx.presenceRefreshSeconds });
+    return true;
+  }
+  if (tail === "mark_read" && method === "POST") {
+    const body = parseJsonObject2(await ctx.readBody(request7.body, CONTROL_BODY_CAP_BYTES));
+    const eventId = nonEmptyString2(body, "event_id");
+    const clientId = nonEmptyString2(body, "client_id");
+    if (body !== void 0 && "event_id" in body && eventId === void 0 || "client_id" in (body ?? {}) && clientId === void 0) {
+      await ctx.answerJson(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "a read receipt is JSON naming the event_id it read or none for the whole session, and client_id only as a non-empty string or absent" } });
+      return true;
+    }
+    const receipt = ctx.publish(session, clientId ?? RC_SOURCE_CLIENT, { type: "mark_read", ...eventId === void 0 ? {} : { event_id: eventId }, ...clientId === void 0 ? {} : { client_id: clientId } }, true);
+    ctx.log?.(`rc selfhost ${session.id}: ${clientId === void 0 ? "an unnamed client" : `client ${clientId}`} marked ${eventId === void 0 ? "the session read" : `event ${eventId} read`} as sequence ${String(receipt.sequenceNum)}`);
+    await ctx.answerJson(response, HTTP_STATUS.ok, {});
+    return true;
+  }
+  if (tail === "teleport-events" && method === "POST") {
+    const body = parseJsonObject2(await ctx.readBody(request7.body, CONTROL_BODY_CAP_BYTES));
+    const events = body?.events;
+    if (!Array.isArray(events) || events.length === 0 || events.length > maxBatchEvents) {
+      await ctx.answerJson(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: `a teleport write is a non-empty array of at most ${String(maxBatchEvents)} events` } });
+      return true;
+    }
+    const results = [];
+    for (const event of events) {
+      if (!isRecord4(event) || !isRecord4(event.payload)) {
+        await ctx.answerJson(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "every event in a teleport write is an object carrying one payload object" } });
+        return true;
+      }
+      const published = ctx.publish(session, RC_SOURCE_CLIENT, event.payload);
+      results.push({ sequence_num: String(published.sequenceNum), duplicate: published.duplicate });
+    }
+    ctx.sweep();
+    ctx.log?.(`rc selfhost ${session.id}: teleport write published ${String(results.length)} marker event(s)`);
+    await ctx.answerJson(response, HTTP_STATUS.ok, { results });
+    return true;
+  }
+  if (tail === "teleport-events" && method === "GET") {
+    const page = pageOfRcChannel(request7.url, session.events, (event) => event.eventId, (event) => ({ event_id: event.eventId, payload: event.payload }));
+    if ("error" in page) {
+      await ctx.answerJson(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: page.error } });
+      return true;
+    }
+    await ctx.answerJson(response, HTTP_STATUS.ok, page);
+    return true;
+  }
+  return false;
+}
+var compatSessionRow = (session, now) => ({ id: session.id, title: session.title, created_at: new Date(session.createdAt).toISOString(), updated_at: new Date(now()).toISOString(), session_status: "active" });
+async function serveRcCompatSessions(ctx, pathname, compatPath) {
+  const { request: request7, response } = ctx;
+  const method = request7.method.toUpperCase();
+  if (pathname === compatPath) {
+    if (method !== "GET") {
+      await ctx.answerJson(response, HTTP_STATUS.methodNotAllowed, { type: "error", error: { type: "api_error", message: "the compatibility session list is a GET" } });
+      return;
+    }
+    const listRefusal = ctx.credentialRefusal(request7.headers);
+    if (listRefusal !== void 0) {
+      await ctx.unauthorized(response, listRefusal);
+      return;
+    }
+    await ctx.answerJson(response, HTTP_STATUS.ok, { data: [...ctx.sessions.values()].map((session2) => compatSessionRow(session2, ctx.now)) });
+    return;
+  }
+  const rest = pathname.slice(`${compatPath}/`.length);
+  const slash = rest.indexOf("/");
+  const address = slash === -1 ? rest : rest.slice(0, slash);
+  const compatTail = slash === -1 ? "" : rest.slice(slash + 1);
+  const refusal = ctx.credentialRefusal(request7.headers);
+  if (refusal !== void 0) {
+    await ctx.unauthorized(response, refusal);
+    return;
+  }
+  const session = ctx.sessions.get(address) ?? ctx.sessions.get(`cse_${address}`);
+  if (compatTail === "") {
+    if (method === "GET") {
+      if (session === void 0) {
+        await ctx.answerJson(response, HTTP_STATUS.notFound, { type: "error", error: { type: "api_error", message: `Session not found: ${address}` } });
+        return;
+      }
+      await ctx.answerJson(response, HTTP_STATUS.ok, compatSessionRow(session, ctx.now));
+      return;
+    }
+    if (method === "PATCH" || method === "PUT") {
+      if (session === void 0) {
+        await ctx.answerJson(response, HTTP_STATUS.notFound, { type: "error", error: { type: "api_error", message: `Session not found: ${address}` } });
+        return;
+      }
+      const body = parseJsonObject2(await ctx.readBody(request7.body, CONTROL_BODY_CAP_BYTES));
+      const title = nonEmptyString2(body, "title");
+      if (title === void 0) {
+        await ctx.answerJson(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "a compatibility session update is JSON naming a non-empty title" } });
+        return;
+      }
+      session.title = title;
+      session.lastTrafficAt = ctx.now();
+      ctx.log?.(`rc selfhost ${session.id}: retitled through the compatibility family`);
+      await ctx.answerJson(response, HTTP_STATUS.ok, compatSessionRow(session, ctx.now));
+      return;
+    }
+    await ctx.answerJson(response, HTTP_STATUS.methodNotAllowed, { type: "error", error: { type: "api_error", message: "the compatibility session read is a GET and its update a PATCH or PUT" } });
+    return;
+  }
+  if ((compatTail === "archive" || compatTail === "unarchive") && method === "POST") {
+    await ctx.readBody(request7.body, CONTROL_BODY_CAP_BYTES);
+    if (session === void 0) {
+      await ctx.answerJson(response, HTTP_STATUS.notFound, { type: "error", error: { type: "api_error", message: `Session not found: ${address}` } });
+      return;
+    }
+    if (compatTail === "unarchive") {
+      await ctx.answerJson(response, HTTP_STATUS.ok, compatSessionRow(session, ctx.now));
+      return;
+    }
+    for (const sink of [...session.workerStreams, ...session.clientStreams]) {
+      sink.retire();
+    }
+    ctx.sessions.delete(session.id);
+    ctx.log?.(`rc selfhost ${session.id}: archived through the compatibility family`);
+    await ctx.answerJson(response, HTTP_STATUS.ok, {});
+    return;
+  }
+  await ctx.answerJson(response, HTTP_STATUS.notFound, { type: "error", error: { type: "api_error", message: `the compatibility session family serves no path "${compatTail}"` } });
+}
+
 // src/frontdoor/rcWebFetch.ts
 var dns2 = __toESM(require("node:dns"), 1);
 var http6 = __toESM(require("node:http"), 1);
@@ -74006,21 +74224,19 @@ var RC_PRESENCE_REFRESH_SECONDS = 60;
 var RC_SELF_HOST_MAX_BATCH_EVENTS = 100;
 var RC_SELF_HOST_WORKER_EPOCH = 1;
 var RC_STREAM_EVENT_NAME = "client_event";
-var RC_SOURCE_WORKER = "worker";
-var RC_SOURCE_CLIENT = "client";
 var CONFLICT_REASON_HEADER2 = "x-ccr-conflict-reason";
 var CONFLICT_REASON_EPOCH_STALE = "epoch_stale";
-function isRecord4(value2) {
+function isRecord5(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 }
 function isWebSearchRefusal(value2) {
   return !Array.isArray(value2);
 }
-function nonEmptyString2(record2, field) {
+function nonEmptyString3(record2, field) {
   const value2 = record2 === void 0 ? void 0 : record2[field];
   return typeof value2 === "string" && value2 !== "" ? value2 : void 0;
 }
-function numberOf(record2, field) {
+function numberOf2(record2, field) {
   const value2 = record2 === void 0 ? void 0 : record2[field];
   if (typeof value2 === "number" && Number.isFinite(value2)) {
     return value2;
@@ -74087,14 +74303,14 @@ async function readBody3(request7, capBytes) {
     });
   });
 }
-function parseJsonObject2(body) {
+function parseJsonObject3(body) {
   let parsed;
   try {
     parsed = JSON.parse(body);
   } catch {
     return void 0;
   }
-  return isRecord4(parsed) ? parsed : void 0;
+  return isRecord5(parsed) ? parsed : void 0;
 }
 function mintWorkerJwt(randomToken, issuedAt) {
   const encode3 = (value2) => Buffer.from(JSON.stringify(value2), "utf8").toString("base64url");
@@ -74117,11 +74333,16 @@ function createRcSelfHostSurface(deps) {
     for (const session of sessions.values()) {
       while (session.events[0] !== void 0 && now - session.events[0].storedAt > RC_SELF_HOST_RETENTION_MS) {
         const dropped = session.events.shift();
-        const uuid3 = dropped === void 0 ? void 0 : nonEmptyString2(dropped.payload, "uuid");
+        const uuid3 = dropped === void 0 ? void 0 : nonEmptyString3(dropped.payload, "uuid");
         if (uuid3 !== void 0) {
           session.seenPayloadUuids.delete(uuid3);
         }
       }
+      for (const [clientId, lastSeenAt] of session.clients) {
+        if (now - lastSeenAt > RC_SELF_HOST_RETENTION_MS) {
+          session.clients.delete(clientId);
+        }
+      }
       if (session.workerStreams.size === 0 && session.clientStreams.size === 0 && now - session.lastTrafficAt > RC_SELF_HOST_RETENTION_MS) {
         sessions.delete(session.id);
       }
@@ -74160,7 +74381,7 @@ function createRcSelfHostSurface(deps) {
   const frameOf = (event) => {
     const envelope = {
       event_id: event.eventId,
-      event_type: nonEmptyString2(event.payload, "type") ?? "event",
+      event_type: nonEmptyString3(event.payload, "type") ?? "event",
       sequence_num: event.sequenceNum,
       source: event.source,
       payload: event.payload,
@@ -74174,7 +74395,7 @@ data: ${JSON.stringify(envelope)}
   };
   const holdStream = async (session, which, wantsReplay, request7, response) => {
     const url2 = new URL(request7.url, "http://127.0.0.1");
-    const cursor3 = numberOf({ value: url2.searchParams.get("from_sequence_num") }, "value") ?? numberOf({ value: singleHeader2(request7.headers, "last-event-id") }, "value");
+    const cursor3 = numberOf2({ value: url2.searchParams.get("from_sequence_num") }, "value") ?? numberOf2({ value: singleHeader2(request7.headers, "last-event-id") }, "value");
     const replay = cursor3 === void 0 ? [] : session.events.filter((event) => wantsReplay(event) && event.sequenceNum > cursor3);
     response.start(HTTP_STATUS.ok, { "content-type": "text/event-stream", "cache-control": "no-cache" });
     response.flush();
@@ -74203,8 +74424,8 @@ data: ${JSON.stringify(envelope)}
     sink.retire();
     response.end();
   };
-  const publish = (session, source, payload) => {
-    const uuid3 = nonEmptyString2(payload, "uuid");
+  const publish = (session, source, payload, toWorker = source === RC_SOURCE_CLIENT) => {
+    const uuid3 = nonEmptyString3(payload, "uuid");
     const duplicate = uuid3 !== void 0 && session.seenPayloadUuids.has(uuid3);
     session.sequenceNum += 1;
     const event = {
@@ -74212,9 +74433,9 @@ data: ${JSON.stringify(envelope)}
       eventId: uuid3 ?? deps.newUuid(),
       source,
       // The one enrichment the real service was observed making on the live rig's stream: the wall-clock instant it took the write. The worker's handler ignores it; the door's own parser forwards it verbatim.
-      payload: source === RC_SOURCE_CLIENT ? { ...payload, server_received_wall_ms: deps.now() } : payload,
+      payload: source === RC_SOURCE_WORKER ? payload : { ...payload, server_received_wall_ms: deps.now() },
       createdAt: new Date(deps.now()).toISOString(),
-      toWorker: source === RC_SOURCE_CLIENT,
+      toWorker,
       storedAt: deps.now()
     };
     session.events.push(event);
@@ -74262,8 +74483,26 @@ data: ${JSON.stringify(envelope)}
     }
     session.lastTrafficAt = deps.now();
     if (tail === "") {
+      if (method === "PATCH" || method === "PUT") {
+        const refusal = credentialRefusal(request7.headers);
+        if (refusal !== void 0) {
+          await unauthorized(response, refusal);
+          return;
+        }
+        const body = parseJsonObject3(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
+        const title = nonEmptyString3(body, "title");
+        if (title === void 0) {
+          await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "a session update is JSON naming a non-empty title" } });
+          return;
+        }
+        session.title = title;
+        session.lastTrafficAt = deps.now();
+        deps.log?.(`rc selfhost ${session.id}: retitled at its client's request`);
+        await answerJson2(response, HTTP_STATUS.ok, {});
+        return;
+      }
       if (method !== "GET") {
-        await answerJson2(response, HTTP_STATUS.methodNotAllowed, { type: "error", error: { type: "api_error", message: "the session read is a GET" } });
+        await answerJson2(response, HTTP_STATUS.methodNotAllowed, { type: "error", error: { type: "api_error", message: "the session read is a GET, and its update a PATCH or PUT" } });
         return;
       }
       await answerJson2(response, HTTP_STATUS.ok, { session: { id: session.id, title: session.title, created_at: new Date(session.createdAt).toISOString(), status: "active" } });
@@ -74308,17 +74547,17 @@ data: ${JSON.stringify(envelope)}
         return;
       }
       if (workerTail === "" && method === "PUT") {
-        const body = parseJsonObject2(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
-        const claimedEpoch = numberOf(body, "worker_epoch");
+        const body = parseJsonObject3(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
+        const claimedEpoch = numberOf2(body, "worker_epoch");
         if (claimedEpoch !== void 0 && claimedEpoch !== RC_SELF_HOST_WORKER_EPOCH) {
           await epochStale(response);
           return;
         }
-        const status = nonEmptyString2(body, "worker_status");
+        const status = nonEmptyString3(body, "worker_status");
         if (status !== void 0) {
           session.workerStatus = status;
         }
-        if (isRecord4(body?.external_metadata)) {
+        if (isRecord5(body?.external_metadata)) {
           session.externalMetadata = body.external_metadata;
         }
         await answerJson2(response, HTTP_STATUS.ok, {});
@@ -74335,8 +74574,8 @@ data: ${JSON.stringify(envelope)}
         return;
       }
       if (workerTail === "events" && method === "POST") {
-        const body = parseJsonObject2(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
-        const claimedEpoch = numberOf(body, "worker_epoch");
+        const body = parseJsonObject3(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
+        const claimedEpoch = numberOf2(body, "worker_epoch");
         if (claimedEpoch !== void 0 && claimedEpoch !== RC_SELF_HOST_WORKER_EPOCH) {
           await epochStale(response);
           return;
@@ -74348,7 +74587,7 @@ data: ${JSON.stringify(envelope)}
         }
         const results = [];
         for (const event of events) {
-          if (!isRecord4(event) || !isRecord4(event.payload)) {
+          if (!isRecord5(event) || !isRecord5(event.payload)) {
             await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "every event in a batch is an object carrying one payload object" } });
             return;
           }
@@ -74369,8 +74608,8 @@ data: ${JSON.stringify(envelope)}
         return;
       }
       if (workerTail === "internal-events" && method === "POST") {
-        const body = parseJsonObject2(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
-        const claimedEpoch = numberOf(body, "worker_epoch");
+        const body = parseJsonObject3(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
+        const claimedEpoch = numberOf2(body, "worker_epoch");
         if (claimedEpoch !== void 0 && claimedEpoch !== RC_SELF_HOST_WORKER_EPOCH) {
           await epochStale(response);
           return;
@@ -74381,19 +74620,26 @@ data: ${JSON.stringify(envelope)}
           return;
         }
         for (const event of events) {
-          if (isRecord4(event)) {
-            session.internalEvents.push({ cursor: deps.newUuid(), body: event });
+          if (isRecord5(event)) {
+            session.internalEvents.push({ eventId: deps.newUuid(), body: event });
           }
         }
         await answerJson2(response, HTTP_STATUS.ok, {});
         return;
       }
       if (workerTail === "internal-events" && method === "GET") {
-        const url2 = new URL(request7.url, "http://127.0.0.1");
-        const cursor3 = url2.searchParams.get("cursor");
-        const from = cursor3 === null ? 0 : session.internalEvents.findIndex((event) => event.cursor === cursor3) + 1;
-        const page = session.internalEvents.slice(from);
-        await answerJson2(response, HTTP_STATUS.ok, { data: page.map((event) => event.body), next_cursor: page.length === 0 ? void 0 : page[page.length - 1]?.cursor });
+        const query = new URL(request7.url, "http://127.0.0.1").searchParams;
+        if (query.get("session_agent_id") !== null || query.get("subagents") !== null) {
+          await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "this surface keeps one internal-events channel per session, so an agent-scoped read has no subset to serve" } });
+          return;
+        }
+        const page = pageOfRcChannel(request7.url, session.internalEvents, (event) => event.eventId, (event) => ({ event_id: event.eventId, payload: event.body }));
+        if ("error" in page) {
+          const anchorUnknown = query.get("after_event_id") !== null && page.error.startsWith("the anchor names an event id");
+          await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: anchorUnknown ? "after_event_id_not_found" : "invalid_request_error", message: page.error } });
+          return;
+        }
+        await answerJson2(response, HTTP_STATUS.ok, page);
         return;
       }
       if (workerTail === "diagnostics" && method === "POST") {
@@ -74402,8 +74648,8 @@ data: ${JSON.stringify(envelope)}
         return;
       }
       if (workerTail === "web-fetch" && method === "POST") {
-        const body = parseJsonObject2(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
-        const target = nonEmptyString2(body, "url");
+        const body = parseJsonObject3(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
+        const target = nonEmptyString3(body, "url");
         if (target === void 0) {
           await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "a worker web-fetch carries one url" } });
           return;
@@ -74425,8 +74671,8 @@ data: ${JSON.stringify(envelope)}
         return;
       }
       if (workerTail === "web-search" && method === "POST") {
-        const body = parseJsonObject2(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
-        const query = nonEmptyString2(body, "query");
+        const body = parseJsonObject3(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
+        const query = nonEmptyString3(body, "query");
         if (query === void 0) {
           await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "a worker web-search carries one query" } });
           return;
@@ -74437,7 +74683,7 @@ data: ${JSON.stringify(envelope)}
           await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "the domain filters of a worker web-search are string arrays" } });
           return;
         }
-        const searchProfile = nonEmptyString2(body, "search_profile");
+        const searchProfile = nonEmptyString3(body, "search_profile");
         const backend = deps.webSearch;
         if (backend === void 0) {
           deps.log?.(`rc selfhost ${session.id}: worker web-search of "${query}" refused: no search backend serves this door`);
@@ -74462,7 +74708,7 @@ data: ${JSON.stringify(envelope)}
       return;
     }
     if (tail === "events" && method === "POST") {
-      const body = parseJsonObject2(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
+      const body = parseJsonObject3(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
       const events = body?.events;
       if (!Array.isArray(events) || events.length === 0 || events.length > RC_SELF_HOST_MAX_BATCH_EVENTS) {
         await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: `a client event write is a non-empty array of at most ${String(RC_SELF_HOST_MAX_BATCH_EVENTS)} events` } });
@@ -74470,7 +74716,7 @@ data: ${JSON.stringify(envelope)}
       }
       const results = [];
       for (const event of events) {
-        if (!isRecord4(event) || !isRecord4(event.payload)) {
+        if (!isRecord5(event) || !isRecord5(event.payload)) {
           await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "every event in a write is an object carrying one payload object" } });
           return;
         }
@@ -74482,26 +74728,14 @@ data: ${JSON.stringify(envelope)}
       return;
     }
     if (tail === "events" && method === "GET") {
-      await answerJson2(response, HTTP_STATUS.ok, { data: session.events.map((event) => ({ event_id: event.eventId, event_type: nonEmptyString2(event.payload, "type") ?? "event", sequence_num: event.sequenceNum, source: event.source, payload: event.payload, created_at: event.createdAt })) });
+      await answerJson2(response, HTTP_STATUS.ok, { data: session.events.map((event) => ({ event_id: event.eventId, event_type: nonEmptyString3(event.payload, "type") ?? "event", sequence_num: event.sequenceNum, source: event.source, payload: event.payload, created_at: event.createdAt })) });
       return;
     }
     if (tail === "events/stream" && method === "GET") {
       await holdStream(session, "clientStreams", () => true, request7, response);
       return;
     }
-    if (tail === "client/presence" && method === "POST") {
-      await readBody3(request7.body, CONTROL_BODY_CAP_BYTES);
-      await answerJson2(response, HTTP_STATUS.ok, { refresh_after_seconds: RC_PRESENCE_REFRESH_SECONDS });
-      return;
-    }
-    if (tail === "mark_read" && method === "POST") {
-      await readBody3(request7.body, CONTROL_BODY_CAP_BYTES);
-      await answerJson2(response, HTTP_STATUS.ok, {});
-      return;
-    }
-    if (tail === "teleport-events" && method === "POST") {
-      await readBody3(request7.body, CONTROL_BODY_CAP_BYTES);
-      await answerJson2(response, HTTP_STATUS.ok, {});
+    if (await serveRcClientChannels({ request: request7, response, session, answerJson: answerJson2, readBody: readBody3, publish, sweep, now: deps.now, presenceRefreshSeconds: RC_PRESENCE_REFRESH_SECONDS, ...deps.log === void 0 ? {} : { log: deps.log } }, tail, method, RC_SELF_HOST_MAX_BATCH_EVENTS)) {
       return;
     }
     await answerJson2(response, HTTP_STATUS.notFound, { type: "error", error: { type: "api_error", message: `the self-hosted Remote Control surface serves no path "${tail}"` } });
@@ -74518,17 +74752,8 @@ data: ${JSON.stringify(envelope)}
         await noCredential(response);
         return;
       }
-      if (pathname === RC_COMPAT_SESSIONS_PATH) {
-        if (method !== "GET") {
-          await answerJson2(response, HTTP_STATUS.methodNotAllowed, { type: "error", error: { type: "api_error", message: "the compatibility session list is a GET" } });
-          return;
-        }
-        const listRefusal = credentialRefusal(request7.headers);
-        if (listRefusal !== void 0) {
-          await unauthorized(response, listRefusal);
-          return;
-        }
-        await answerJson2(response, HTTP_STATUS.ok, { data: [] });
+      if (pathname === RC_COMPAT_SESSIONS_PATH || pathname.startsWith(`${RC_COMPAT_SESSIONS_PATH}/`)) {
+        await serveRcCompatSessions({ request: request7, response, sessions, answerJson: answerJson2, readBody: readBody3, credentialRefusal, unauthorized, now: deps.now, ...deps.log === void 0 ? {} : { log: deps.log } }, pathname, RC_COMPAT_SESSIONS_PATH);
         return;
       }
       if (pathname !== RC_SESSIONS_PATH_PREFIX2 && !pathname.startsWith(`${RC_SESSIONS_PATH_PREFIX2}/`)) {
@@ -74542,11 +74767,11 @@ data: ${JSON.stringify(envelope)}
             await unauthorized(response, createRefusal);
             return;
           }
-          const body = parseJsonObject2(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
+          const body = parseJsonObject3(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
           const session = {
             id: `${RC_SESSION_ID_PREFIX2}${deps.newUuid()}`,
             createdAt: deps.now(),
-            title: nonEmptyString2(body, "title"),
+            title: nonEmptyString3(body, "title"),
             workerJwts: /* @__PURE__ */ new Set(),
             sequenceNum: 0,
             events: [],
@@ -74554,6 +74779,7 @@ data: ${JSON.stringify(envelope)}
             workerStreams: /* @__PURE__ */ new Set(),
             clientStreams: /* @__PURE__ */ new Set(),
             internalEvents: [],
+            clients: /* @__PURE__ */ new Map(),
             workerStatus: void 0,
             externalMetadata: void 0,
             lastTrafficAt: deps.now()
@@ -74598,7 +74824,7 @@ data: ${JSON.stringify(envelope)}
       const pathname = new URL(request7.url ?? "/", "http://127.0.0.1").pathname;
       if (host === RC_SELF_HOST_OAUTH_HOST) {
         if (method === "POST" && pathname === "/v1/oauth/token") {
-          const body = parseJsonObject2(await readBody3(request7, CONTROL_BODY_CAP_BYTES));
+          const body = parseJsonObject3(await readBody3(request7, CONTROL_BODY_CAP_BYTES));
           const record2 = deps.credentialRecord();
           if (record2 === void 0) {
             answerServerJson(response, HTTP_SERVICE_UNAVAILABLE, { error: "the front door's self-hosted Remote Control surface is on but no credential has been minted for it" });
@@ -74683,7 +74909,7 @@ var RC_SELF_HOST_RECORD_DIR = "rc-selfhost";
 var RC_SELF_HOST_RECORD_FILE = "credential.json";
 var SELF_HOST_EMAIL = "selfhost@agent-shim.invalid";
 var SELF_HOST_SUBSCRIPTION_TYPE = "max";
-function isRecord5(value2) {
+function isRecord6(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 }
 function readJsonObject(fs20, file2) {
@@ -74697,7 +74923,7 @@ function readJsonObject(fs20, file2) {
   } catch {
     return void 0;
   }
-  return isRecord5(parsed) ? parsed : void 0;
+  return isRecord6(parsed) ? parsed : void 0;
 }
 function readRcSelfHostRecord(fs20, frontdoorDir) {
   const parsed = readJsonObject(fs20, import_node_path34.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
@@ -74721,7 +74947,7 @@ function mintRcSelfHostCredential(deps) {
   const recordFile = import_node_path34.default.join(recordDir, RC_SELF_HOST_RECORD_FILE);
   const previousRecord = readRcSelfHostRecord(deps.fs, deps.frontdoorDir);
   const existingCredentials = readJsonObject(deps.fs, credentialsFile);
-  const existingOauth = isRecord5(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
+  const existingOauth = isRecord6(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
   const existingToken = typeof existingOauth?.accessToken === "string" && existingOauth.accessToken !== "" ? existingOauth.accessToken : void 0;
   const existingIsOwn = existingToken !== void 0 && previousRecord?.accessToken === existingToken;
   if (existingToken !== void 0 && !existingIsOwn && !deps.force) {
@@ -74738,7 +74964,7 @@ function mintRcSelfHostCredential(deps) {
   deps.fs.writeFilePrivate(credentialsFile, `${JSON.stringify({ ...existingCredentials, claudeAiOauth: { accessToken, refreshToken, expiresAt: null, scopes: [...RC_SELF_HOST_SCOPE_LIST], subscriptionType: SELF_HOST_SUBSCRIPTION_TYPE, rateLimitTier: null } }, null, 2)}
 `);
   const claudeJson = readJsonObject(deps.fs, claudeJsonFile) ?? {};
-  const existingBlock = (value2) => isRecord5(value2) ? value2 : {};
+  const existingBlock = (value2) => isRecord6(value2) ? value2 : {};
   deps.fs.writeFilePrivate(claudeJsonFile, `${JSON.stringify({
     ...claudeJson,
     oauthAccount: {
@@ -75037,6 +75263,12 @@ function registerRcCommand(frontdoor, paths) {
     }),
     ["agent-shim frontdoor rc mcp-oauth-callback-url --session cse_00000000-0000-4000-8000-000000000000 --server github --callback-url https://example.com/oauth/callback?code=x"]
   );
+  withExamples(
+    rc.command("teleport").description("Send one teleport marker into an observed session over the teleport-events channel, the write half the cloud UI's ultrapan path owns on the real service. The marker rides the SDK user-message shape, the line the teleport relay anchors on.").requiredOption("--session <id>", "The cse_ session id, as `frontdoor rc list` shows it.").requiredOption("--marker <text>", "The marker text, the string content the teleport relay anchors on.").option("--json", "Print the delivery result as JSON.").action(async (options) => {
+      reportControlWrite(`teleported a marker into the session`, options.session, await frontDoorRcControlFromState(realFarmFs, paths).teleport(options.session, options.marker), options.json, { marker: options.marker });
+    }),
+    ['agent-shim frontdoor rc teleport --session cse_00000000-0000-4000-8000-000000000000 --marker "__ULTRAPAN_TELEPORT_LOCAL__"']
+  );
   withExamples(
     rc.command("watch").description("Print the observed sessions' client read stream events as they arrive, the approvals the door's held stream receives above all, until Ctrl-C leaves. Read-only.").argument("[session]", "One cse_ session id, as `frontdoor rc list` shows it; every observed session when omitted.").option("--json", "Print each event as one JSON line as it arrives.").action(async (session, options) => {
       const client = frontDoorRcApiFromState(realFarmFs, paths);
@@ -75096,11 +75328,11 @@ var import_node_path35 = __toESM(require("node:path"), 1);
 function isSafeSessionId(sessionId) {
   return /^[A-Za-z0-9_-]+$/.test(sessionId);
 }
-function isRecord6(value2) {
+function isRecord7(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 }
 function credentialOfJson(parsed) {
-  if (!isRecord6(parsed)) {
+  if (!isRecord7(parsed)) {
     return void 0;
   }
   const { authorization, anthropicVersion, anthropicClientPlatform } = parsed;
@@ -75130,7 +75362,7 @@ function createRcCredentialStore(fs20, dir) {
     } catch {
       return void 0;
     }
-    return isRecord6(parsed) ? parsed : void 0;
+    return isRecord7(parsed) ? parsed : void 0;
   };
   return {
     read: (sessionId) => {
@@ -75694,7 +75926,7 @@ function createSseParser() {
     }
   };
 }
-function isRecord7(value2) {
+function isRecord8(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 }
 function sequenceNumOf(value2) {
@@ -75716,7 +75948,7 @@ function parseRcStreamEnvelope(parsed) {
   } catch {
     return void 0;
   }
-  if (!isRecord7(data)) {
+  if (!isRecord8(data)) {
     return void 0;
   }
   const eventType = data.event_type;
@@ -75799,9 +76031,26 @@ function createRcStreamHub(deps) {
     }
     return headers;
   };
+  let receiptFailureLogged = false;
+  const sendReceipt = (attachment, headers, eventId) => {
+    if (eventId === void 0) {
+      return;
+    }
+    deps.dial.markRead(attachment.sessionId, headers, eventId).then(
+      () => {
+        receiptFailureLogged = false;
+      },
+      (error62) => {
+        if (!receiptFailureLogged) {
+          receiptFailureLogged = true;
+          deps.log?.(`rc stream ${attachment.sessionId}: the read receipt for event ${eventId} could not be sent (${error62 instanceof Error ? error62.message : String(error62)}); further receipt failures stay quiet until one lands`);
+        }
+      }
+    );
+  };
   const attempt = async (attachment, credential) => {
     const headers = streamHeaders(credential);
-    const presence = await deps.dial.announcePresence(attachment.sessionId, headers, attachment.clientId);
+    const presence = await deps.dial.announcePresence(attachment.sessionId, headers, attachment.clientId, false);
     if (presence.status === HTTP_STATUS.unauthorized) {
       return "unauthorized";
     }
@@ -75821,6 +76070,7 @@ function createRcStreamHub(deps) {
     const parser = createSseParser();
     for await (const chunk of answer.chunks) {
       attachment.controller.signal.throwIfAborted();
+      let lastEventId;
       for (const parsed of parser.write(Buffer.from(chunk).toString("utf8"))) {
         const envelope = parseRcStreamEnvelope(parsed);
         if (envelope === void 0) {
@@ -75828,10 +76078,21 @@ function createRcStreamHub(deps) {
         }
         deps.fileStreamEvent(attachment.sessionId, envelope);
         deps.fanout.publish({ session: attachment.sessionId, envelope });
+        if (typeof envelope.event_id === "string" && envelope.event_type !== "mark_read") {
+          lastEventId = envelope.event_id;
+        }
       }
+      sendReceipt(attachment, headers, lastEventId);
     }
     return "dropped";
   };
+  const clearPresence = (attachment, headers) => {
+    if (headers === void 0) {
+      return;
+    }
+    void deps.dial.announcePresence(attachment.sessionId, headers, attachment.clientId, true).catch(() => {
+    });
+  };
   const runLoop = async (attachment) => {
     let retriedUnauthorized = false;
     for (; ; ) {
@@ -75843,6 +76104,7 @@ function createRcStreamHub(deps) {
       if (!live || credential?.authorization === void 0) {
         deps.log?.(`rc stream ${attachment.sessionId}: the attachment ended (${live ? "the session's client credential is no longer known" : "the tracker gave up on the session"})`);
         persistCursor(attachment.sessionId);
+        clearPresence(attachment, credential === void 0 ? void 0 : streamHeaders(credential));
         if (attachments.get(attachment.sessionId) === attachment) {
           attachments.delete(attachment.sessionId);
         }
@@ -75905,6 +76167,8 @@ function createRcStreamHub(deps) {
     close: () => {
       for (const attachment of attachments.values()) {
         persistCursor(attachment.sessionId);
+        const credential = deps.credentialOf(attachment.sessionId);
+        clearPresence(attachment, credential?.authorization === void 0 ? void 0 : streamHeaders(credential));
         attachment.stop();
       }
       attachments.clear();
@@ -76392,6 +76656,7 @@ function realFrontDoorSupervisorPorts(paths) {
       const rcMcpReconnect = async (sessionId, serverName) => await reconnectRcSessionMcpServer(rcControlRequestDeps, sessionId, serverName);
       const rcMcpAuthenticate = async (sessionId, serverName, redirectUri) => await authenticateRcSessionMcpServer(rcControlRequestDeps, sessionId, serverName, redirectUri);
       const rcMcpOAuthCallbackUrl = async (sessionId, serverName, callbackUrl) => await submitRcSessionMcpOAuthCallbackUrl(rcControlRequestDeps, sessionId, serverName, callbackUrl);
+      const rcTeleport = async (sessionId, marker) => await teleportRcSession(rcControlRequestDeps, sessionId, marker);
       const controlDeps = {
         usageSnapshots: () => listUsageSnapshots(realFarmFs, paths.usageSnapshotsDir),
         usageSnapshotOf: (identity) => readUsageSnapshot(realFarmFs, paths.usageSnapshotsDir, identity),
@@ -76409,7 +76674,7 @@ function realFrontDoorSupervisorPorts(paths) {
         },
         log,
         mintLeaf(authority, LOOPBACK_LEAF_NAMES, /* @__PURE__ */ new Date()),
-        createRcControlHandler({ expectedToken: rcControlToken, list: rcTracker.list, statusOf: rcTracker.statusOf, pendingOf: rcTracker.pendingOf, inject: rcInject, answer: rcAnswer, interrupt: rcInterrupt, setModel: rcSetModel, setPermissionMode: rcSetPermissionMode, endSession: rcEndSession, getUsage: rcGetUsage, getContextUsage: rcGetContextUsage, readFile: rcReadFile, fileSuggestions: rcFileSuggestions, keepAlive: rcKeepAlive, mcpStatus: rcMcpStatus, mcpReconnect: rcMcpReconnect, mcpAuthenticate: rcMcpAuthenticate, mcpOAuthCallbackUrl: rcMcpOAuthCallbackUrl }),
+        createRcControlHandler({ expectedToken: rcControlToken, list: rcTracker.list, statusOf: rcTracker.statusOf, pendingOf: rcTracker.pendingOf, inject: rcInject, answer: rcAnswer, interrupt: rcInterrupt, setModel: rcSetModel, setPermissionMode: rcSetPermissionMode, endSession: rcEndSession, getUsage: rcGetUsage, getContextUsage: rcGetContextUsage, readFile: rcReadFile, fileSuggestions: rcFileSuggestions, keepAlive: rcKeepAlive, mcpStatus: rcMcpStatus, mcpReconnect: rcMcpReconnect, mcpAuthenticate: rcMcpAuthenticate, mcpOAuthCallbackUrl: rcMcpOAuthCallbackUrl, teleport: rcTeleport }),
         [
           createDoorApiNodeHandler({
             expectedToken: rcControlToken,
@@ -76431,6 +76696,7 @@ function realFrontDoorSupervisorPorts(paths) {
             mcpReconnect: rcMcpReconnect,
             mcpAuthenticate: rcMcpAuthenticate,
             mcpOAuthCallbackUrl: rcMcpOAuthCallbackUrl,
+            teleport: rcTeleport,
             fanout: rcFanout,
             ...controlDeps,
             events: doorEvents