agent-shim 8.24.0 → 8.25.0

package/dist/index.cjs

@@ -141,6 +141,7 @@ __export(index_exports, {
   buildRcGetUsagePayload: () => buildRcGetUsagePayload,
   buildRcInterruptPayload: () => buildRcInterruptPayload,
   buildRcKeepAlivePayload: () => buildRcKeepAlivePayload,
+  buildRcMarkReadBody: () => buildRcMarkReadBody,
   buildRcMcpAuthenticatePayload: () => buildRcMcpAuthenticatePayload,
   buildRcMcpOAuthCallbackUrlPayload: () => buildRcMcpOAuthCallbackUrlPayload,
   buildRcMcpReconnectPayload: () => buildRcMcpReconnectPayload,
@@ -287,6 +288,7 @@ __export(index_exports, {
   startConnectServer: () => startConnectServer,
   submitRcSessionMcpOAuthCallbackUrl: () => submitRcSessionMcpOAuthCallbackUrl,
   suggestRcSessionFiles: () => suggestRcSessionFiles,
+  teleportRcSession: () => teleportRcSession,
   topLevelNames: () => topLevelNames,
   updateDirectoryRule: () => updateDirectoryRule,
   updateProvider: () => updateProvider,
@@ -3504,9 +3506,6 @@ var HTTP_STATUS = {
   badGateway: 502
 };
 
-// src/frontdoor/rcControl.ts
-var https = __toESM(require("node:https"), 1);
-
 // src/frontdoor/rcSessions.ts
 var RC_SESSIONS_PATH_PREFIX = "/v1/code/sessions";
 var RC_SESSION_ID_PREFIX = "cse_";
@@ -4104,7 +4103,7 @@ async function answerRcControlRequest(deps, sessionId, requestId, decision) {
   }
   return result;
 }
-async function deliverRcClientPayload(deps, sessionId, payload, action) {
+async function deliverRcClientPayload(deps, sessionId, payload, action, to = "events") {
   const credential = deps.credentialOf(sessionId);
   if (credential === void 0) {
     return { ok: false, message: rcSessionNotObservedMessage(sessionId) };
@@ -4115,7 +4114,7 @@ async function deliverRcClientPayload(deps, sessionId, payload, action) {
   const body = JSON.stringify(buildRcEventWriteBody(payload));
   let answer;
   try {
-    answer = await deps.dial.writeEvents(sessionId, rcWriteHeaders(credential), body);
+    answer = await (to === "teleport-events" ? deps.dial.writeTeleportEvents(sessionId, rcWriteHeaders(credential), body) : deps.dial.writeEvents(sessionId, rcWriteHeaders(credential), body));
   } catch (error) {
     return { ok: false, message: `the door could not reach the API host to ${action}: ${error instanceof Error ? error.message : String(error)}` };
   }
@@ -4209,8 +4208,18 @@ async function submitRcSessionMcpOAuthCallbackUrl(deps, sessionId, serverName, c
 async function sendRcKeepAlive(deps, sessionId) {
   return await deliverRcClientPayload(deps, sessionId, buildRcKeepAlivePayload(), `keep session ${sessionId} alive`);
 }
+async function teleportRcSession(deps, sessionId, marker) {
+  if (marker === "") {
+    return { ok: false, message: "a teleport write needs a non-empty marker: the teleport relay anchors on a marker line's uuid and string content, and an empty string carries neither" };
+  }
+  return await deliverRcClientPayload(deps, sessionId, buildRcUserMessagePayload(deps.newUuid(), sessionId, marker), `teleport a marker into session ${sessionId}`, "teleport-events");
+}
+function buildRcMarkReadBody(eventId) {
+  return eventId === void 0 ? {} : { event_id: eventId };
+}
 
 // src/frontdoor/rcControl.ts
+var https = __toESM(require("node:https"), 1);
 var RC_PERMISSION_MODE_LIST = RC_PERMISSION_MODES.join(", ");
 var CONTROL_PATH_PREFIX = "/__agent-shim/rc";
 var CONTROL_BODY_CAP_BYTES = 10485760;
@@ -4384,6 +4393,15 @@ function createRcControlHandler(deps) {
         const callbackUrl = bodyString(body, "callbackUrl");
         return session === void 0 || serverName === void 0 || callbackUrl === void 0 ? { error: "the mcp-oauth-callback-url body must be JSON naming a non-empty session id, server name, and callback URL" } : { session, run: async () => await deps.mcpOAuthCallbackUrl(session, serverName, callbackUrl) };
       }
+    },
+    {
+      name: "teleport",
+      path: "teleport",
+      read: (body) => {
+        const session = bodyString(body, "session");
+        const marker = bodyString(body, "marker");
+        return session === void 0 || marker === void 0 ? { error: "the teleport body must be JSON naming a non-empty session id and marker" } : { session, run: async () => await deps.teleport(session, marker) };
+      }
     }
   ];
   return (request4, response) => {
@@ -4747,7 +4765,8 @@ function frontDoorRcControl(transport, token) {
     mcpStatus: async (sessionId) => await writeOf(`${CONTROL_PATH_PREFIX}/mcp-status`, JSON.stringify({ session: sessionId }), (status, message) => `requesting the MCP status of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     mcpReconnect: async (sessionId, serverName) => await writeOf(`${CONTROL_PATH_PREFIX}/mcp-reconnect`, JSON.stringify({ session: sessionId, serverName }), (status, message) => `reconnecting MCP server ${serverName} on ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     mcpAuthenticate: async (sessionId, serverName, redirectUri) => await writeOf(`${CONTROL_PATH_PREFIX}/mcp-authenticate`, JSON.stringify({ session: sessionId, serverName, redirectUri }), (status, message) => `authenticating MCP server ${serverName} on ${sessionId} failed (HTTP ${String(status)}): ${message}`),
-    mcpOAuthCallbackUrl: async (sessionId, serverName, callbackUrl) => await writeOf(`${CONTROL_PATH_PREFIX}/mcp-oauth-callback-url`, JSON.stringify({ session: sessionId, serverName, callbackUrl }), (status, message) => `handing MCP server ${serverName}'s OAuth callback to ${sessionId} failed (HTTP ${String(status)}): ${message}`)
+    mcpOAuthCallbackUrl: async (sessionId, serverName, callbackUrl) => await writeOf(`${CONTROL_PATH_PREFIX}/mcp-oauth-callback-url`, JSON.stringify({ session: sessionId, serverName, callbackUrl }), (status, message) => `handing MCP server ${serverName}'s OAuth callback to ${sessionId} failed (HTTP ${String(status)}): ${message}`),
+    teleport: async (sessionId, marker) => await writeOf(`${CONTROL_PATH_PREFIX}/teleport`, JSON.stringify({ session: sessionId, marker }), (status, message) => `teleporting a marker into ${sessionId} failed (HTTP ${String(status)}): ${message}`)
   };
 }
 
@@ -4894,36 +4913,38 @@ function tlsFacts(options) {
 }
 function realRcEventDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  return {
-    writeEvents: async (sessionId, headers, body) => await new Promise((resolve, reject) => {
-      const options = {
-        host: target.host,
-        port: target.port,
-        method: "POST",
-        path: `/v1/code/sessions/${encodeURIComponent(sessionId)}/events`,
-        // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
-        headers: { ...headers, host: target.servername ?? target.host, "content-length": String(Buffer.byteLength(body, "utf8")) },
-        agent
-      };
-      options.servername = target.servername ?? target.host;
-      if (target.ca !== void 0) {
-        options.ca = [...target.ca];
-      }
-      if (target.rejectUnauthorized !== void 0) {
-        options.rejectUnauthorized = target.rejectUnauthorized;
-      }
-      const request4 = https2.request(options, (response) => {
-        const chunks = [];
-        response.on("data", (chunk) => {
-          chunks.push(chunk);
-        });
-        response.on("end", () => {
-          resolve({ status: response.statusCode ?? HTTP_BAD_GATEWAY, body: Buffer.concat(chunks).toString("utf8") });
-        });
+  const post = async (path32, headers, body) => await new Promise((resolve, reject) => {
+    const options = {
+      host: target.host,
+      port: target.port,
+      method: "POST",
+      path: path32,
+      // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
+      headers: { ...headers, host: target.servername ?? target.host, "content-length": String(Buffer.byteLength(body, "utf8")) },
+      agent
+    };
+    options.servername = target.servername ?? target.host;
+    if (target.ca !== void 0) {
+      options.ca = [...target.ca];
+    }
+    if (target.rejectUnauthorized !== void 0) {
+      options.rejectUnauthorized = target.rejectUnauthorized;
+    }
+    const request4 = https2.request(options, (response) => {
+      const chunks = [];
+      response.on("data", (chunk) => {
+        chunks.push(chunk);
       });
-      request4.once("error", reject);
-      request4.end(body);
-    })
+      response.on("end", () => {
+        resolve({ status: response.statusCode ?? HTTP_BAD_GATEWAY, body: Buffer.concat(chunks).toString("utf8") });
+      });
+    });
+    request4.once("error", reject);
+    request4.end(body);
+  });
+  return {
+    writeEvents: async (sessionId, headers, body) => await post(`/v1/code/sessions/${encodeURIComponent(sessionId)}/events`, headers, body),
+    writeTeleportEvents: async (sessionId, headers, body) => await post(`/v1/code/sessions/${encodeURIComponent(sessionId)}/teleport-events`, headers, body)
   };
 }
 var NO_CHUNKS = {
@@ -4941,7 +4962,8 @@ function lateRcEventDial(resolve) {
     return built.dial;
   };
   return {
-    writeEvents: async (sessionId, headers, body) => await dialFor().writeEvents(sessionId, headers, body)
+    writeEvents: async (sessionId, headers, body) => await dialFor().writeEvents(sessionId, headers, body),
+    writeTeleportEvents: async (sessionId, headers, body) => await dialFor().writeTeleportEvents(sessionId, headers, body)
   };
 }
 function lateRcStreamDial(resolve) {
@@ -4954,7 +4976,8 @@ function lateRcStreamDial(resolve) {
     return built.dial;
   };
   return {
-    announcePresence: async (sessionId, headers, clientId) => await dialFor().announcePresence(sessionId, headers, clientId),
+    announcePresence: async (sessionId, headers, clientId, clear) => await dialFor().announcePresence(sessionId, headers, clientId, clear),
+    markRead: async (sessionId, headers, eventId) => await dialFor().markRead(sessionId, headers, eventId),
     openStream: async (sessionId, headers, resume, signal) => await dialFor().openStream(sessionId, headers, resume, signal)
   };
 }
@@ -4996,11 +5019,16 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
     return Buffer.concat(chunks).toString("utf8");
   };
   return {
-    announcePresence: async (sessionId, headers, clientId) => {
-      const body = JSON.stringify({ client_id: clientId, clear: false });
+    announcePresence: async (sessionId, headers, clientId, clear) => {
+      const body = JSON.stringify({ client_id: clientId, clear });
       const { status, response } = await request4("POST", `/v1/code/sessions/${encodeURIComponent(sessionId)}/client/presence`, { ...headers, "content-type": "application/json" }, body, new AbortController().signal);
       return { status, body: await readAll(response) };
     },
+    markRead: async (sessionId, headers, eventId) => {
+      const body = JSON.stringify(buildRcMarkReadBody(eventId));
+      const { status, response } = await request4("POST", `/v1/code/sessions/${encodeURIComponent(sessionId)}/mark_read`, { ...headers, "content-type": "application/json" }, body, new AbortController().signal);
+      return { status, body: await readAll(response) };
+    },
     openStream: async (sessionId, headers, resume, signal) => {
       const path32 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
       const streamHeaders = resume === void 0 ? headers : { ...headers, "last-event-id": String(resume.fromSequenceNum) };
@@ -5411,6 +5439,10 @@ var RcMcpOAuthCallbackUrlInputSchema = import_zod4.z.strictObject({
   serverName: import_zod4.z.string().min(1),
   callbackUrl: import_zod4.z.string().min(1)
 });
+var RcTeleportInputSchema = import_zod4.z.strictObject({
+  session: import_zod4.z.string().min(1),
+  marker: import_zod4.z.string().min(1)
+});
 var RcListOutputSchema = import_zod4.z.strictObject({ sessions: import_zod4.z.readonly(import_zod4.z.array(RcSessionSummarySchema)) });
 var RcStatusOutputSchema = import_zod4.z.strictObject({ statuses: import_zod4.z.readonly(import_zod4.z.array(RcSessionStatusSchema)) });
 var RcPendingOutputSchema = import_zod4.z.strictObject({ pending: import_zod4.z.readonly(import_zod4.z.array(RcPendingRequestSummarySchema)) });
@@ -5495,6 +5527,7 @@ function createRcApiRouter(deps) {
       mcpReconnect: authed.input(RcMcpReconnectInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpReconnect(input.session, input.serverName)) })),
       mcpAuthenticate: authed.input(RcMcpAuthenticateInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpAuthenticate(input.session, input.serverName, input.redirectUri)) })),
       mcpOAuthCallbackUrl: authed.input(RcMcpOAuthCallbackUrlInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpOAuthCallbackUrl(input.session, input.serverName, input.callbackUrl)) })),
+      teleport: authed.input(RcTeleportInputSchema).output(RcWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, sequenceNums: delivered(input.session, await deps.teleport(input.session, input.marker)) })),
       subscribe: authed.input(RcSessionQuerySchema).output((0, import_server2.eventIterator)(RcStreamEventSchema)).handler(async function* ({ input, signal }) {
         const queue = [];
         let wake;
@@ -10451,9 +10484,26 @@ function createRcStreamHub(deps) {
     }
     return headers;
   };
+  let receiptFailureLogged = false;
+  const sendReceipt = (attachment, headers, eventId) => {
+    if (eventId === void 0) {
+      return;
+    }
+    deps.dial.markRead(attachment.sessionId, headers, eventId).then(
+      () => {
+        receiptFailureLogged = false;
+      },
+      (error) => {
+        if (!receiptFailureLogged) {
+          receiptFailureLogged = true;
+          deps.log?.(`rc stream ${attachment.sessionId}: the read receipt for event ${eventId} could not be sent (${error instanceof Error ? error.message : String(error)}); further receipt failures stay quiet until one lands`);
+        }
+      }
+    );
+  };
   const attempt = async (attachment, credential) => {
     const headers = streamHeaders(credential);
-    const presence = await deps.dial.announcePresence(attachment.sessionId, headers, attachment.clientId);
+    const presence = await deps.dial.announcePresence(attachment.sessionId, headers, attachment.clientId, false);
     if (presence.status === HTTP_STATUS.unauthorized) {
       return "unauthorized";
     }
@@ -10473,6 +10523,7 @@ function createRcStreamHub(deps) {
     const parser = createSseParser();
     for await (const chunk of answer.chunks) {
       attachment.controller.signal.throwIfAborted();
+      let lastEventId;
       for (const parsed of parser.write(Buffer.from(chunk).toString("utf8"))) {
         const envelope = parseRcStreamEnvelope(parsed);
         if (envelope === void 0) {
@@ -10480,10 +10531,21 @@ function createRcStreamHub(deps) {
         }
         deps.fileStreamEvent(attachment.sessionId, envelope);
         deps.fanout.publish({ session: attachment.sessionId, envelope });
+        if (typeof envelope.event_id === "string" && envelope.event_type !== "mark_read") {
+          lastEventId = envelope.event_id;
+        }
       }
+      sendReceipt(attachment, headers, lastEventId);
     }
     return "dropped";
   };
+  const clearPresence = (attachment, headers) => {
+    if (headers === void 0) {
+      return;
+    }
+    void deps.dial.announcePresence(attachment.sessionId, headers, attachment.clientId, true).catch(() => {
+    });
+  };
   const runLoop = async (attachment) => {
     let retriedUnauthorized = false;
     for (; ; ) {
@@ -10495,6 +10557,7 @@ function createRcStreamHub(deps) {
       if (!live || credential?.authorization === void 0) {
         deps.log?.(`rc stream ${attachment.sessionId}: the attachment ended (${live ? "the session's client credential is no longer known" : "the tracker gave up on the session"})`);
         persistCursor(attachment.sessionId);
+        clearPresence(attachment, credential === void 0 ? void 0 : streamHeaders(credential));
         if (attachments.get(attachment.sessionId) === attachment) {
           attachments.delete(attachment.sessionId);
         }
@@ -10557,6 +10620,8 @@ function createRcStreamHub(deps) {
     close: () => {
       for (const attachment of attachments.values()) {
         persistCursor(attachment.sessionId);
+        const credential = deps.credentialOf(attachment.sessionId);
+        clearPresence(attachment, credential?.authorization === void 0 ? void 0 : streamHeaders(credential));
         attachment.stop();
       }
       attachments.clear();
@@ -10564,6 +10629,193 @@ function createRcStreamHub(deps) {
   };
 }
 
+// src/frontdoor/rcSelfHostEndpoints.ts
+var RC_SOURCE_WORKER = "worker";
+var RC_SOURCE_CLIENT = "client";
+function isRecord6(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseJsonObject2(body) {
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return void 0;
+  }
+  return isRecord6(parsed) ? parsed : void 0;
+}
+function nonEmptyString2(record, field) {
+  const value = record === void 0 ? void 0 : record[field];
+  return typeof value === "string" && value !== "" ? value : void 0;
+}
+function numberOf(record, field) {
+  const value = record === void 0 ? void 0 : record[field];
+  if (typeof value === "number" && Number.isFinite(value)) {
+    return value;
+  }
+  if (typeof value === "string" && /^[0-9]+$/.test(value)) {
+    return Number(value);
+  }
+  return void 0;
+}
+function pageOfRcChannel(url, rows, idOf, rowOf) {
+  const query = new URL(url, "http://127.0.0.1").searchParams;
+  const anchor = query.get("after_event_id") ?? query.get("cursor");
+  const rawLimit = query.get("limit");
+  const limit = rawLimit === null ? void 0 : numberOf({ value: rawLimit }, "value");
+  if (limit !== void 0 && limit < 1) {
+    return { error: "the limit names a whole number of rows of at least one" };
+  }
+  const from = anchor === null ? 0 : rows.findIndex((row) => idOf(row) === anchor) + 1;
+  if (anchor !== null && from === 0) {
+    return { error: `the anchor names an event id this surface holds no row for: ${anchor}` };
+  }
+  const page = limit === void 0 ? rows.slice(from) : rows.slice(from, from + limit);
+  const last = page[page.length - 1];
+  return { data: page.map(rowOf), ...last === void 0 ? {} : { next_cursor: idOf(last) } };
+}
+async function serveRcClientChannels(ctx, tail, method, maxBatchEvents) {
+  const { request: request4, response, session } = ctx;
+  if (tail === "client/presence" && method === "POST") {
+    const body = parseJsonObject2(await ctx.readBody(request4.body, CONTROL_BODY_CAP_BYTES));
+    const clientId = nonEmptyString2(body, "client_id");
+    const clear = body?.clear;
+    if (clientId === void 0 || clear !== void 0 && typeof clear !== "boolean") {
+      await ctx.answerJson(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "a presence announcement is JSON naming a non-empty client_id, with clear only as a boolean or absent" } });
+      return true;
+    }
+    if (clear === true) {
+      session.clients.delete(clientId);
+      ctx.log?.(`rc selfhost ${session.id}: client ${clientId} cleared its presence`);
+    } else {
+      session.clients.set(clientId, ctx.now());
+      ctx.log?.(`rc selfhost ${session.id}: client ${clientId} announced its presence${session.clients.size === 1 ? "" : ` (${String(session.clients.size)} clients now announced)`}`);
+    }
+    await ctx.answerJson(response, HTTP_STATUS.ok, { refresh_after_seconds: ctx.presenceRefreshSeconds });
+    return true;
+  }
+  if (tail === "mark_read" && method === "POST") {
+    const body = parseJsonObject2(await ctx.readBody(request4.body, CONTROL_BODY_CAP_BYTES));
+    const eventId = nonEmptyString2(body, "event_id");
+    const clientId = nonEmptyString2(body, "client_id");
+    if (body !== void 0 && "event_id" in body && eventId === void 0 || "client_id" in (body ?? {}) && clientId === void 0) {
+      await ctx.answerJson(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "a read receipt is JSON naming the event_id it read or none for the whole session, and client_id only as a non-empty string or absent" } });
+      return true;
+    }
+    const receipt = ctx.publish(session, clientId ?? RC_SOURCE_CLIENT, { type: "mark_read", ...eventId === void 0 ? {} : { event_id: eventId }, ...clientId === void 0 ? {} : { client_id: clientId } }, true);
+    ctx.log?.(`rc selfhost ${session.id}: ${clientId === void 0 ? "an unnamed client" : `client ${clientId}`} marked ${eventId === void 0 ? "the session read" : `event ${eventId} read`} as sequence ${String(receipt.sequenceNum)}`);
+    await ctx.answerJson(response, HTTP_STATUS.ok, {});
+    return true;
+  }
+  if (tail === "teleport-events" && method === "POST") {
+    const body = parseJsonObject2(await ctx.readBody(request4.body, CONTROL_BODY_CAP_BYTES));
+    const events = body?.events;
+    if (!Array.isArray(events) || events.length === 0 || events.length > maxBatchEvents) {
+      await ctx.answerJson(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: `a teleport write is a non-empty array of at most ${String(maxBatchEvents)} events` } });
+      return true;
+    }
+    const results = [];
+    for (const event of events) {
+      if (!isRecord6(event) || !isRecord6(event.payload)) {
+        await ctx.answerJson(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "every event in a teleport write is an object carrying one payload object" } });
+        return true;
+      }
+      const published = ctx.publish(session, RC_SOURCE_CLIENT, event.payload);
+      results.push({ sequence_num: String(published.sequenceNum), duplicate: published.duplicate });
+    }
+    ctx.sweep();
+    ctx.log?.(`rc selfhost ${session.id}: teleport write published ${String(results.length)} marker event(s)`);
+    await ctx.answerJson(response, HTTP_STATUS.ok, { results });
+    return true;
+  }
+  if (tail === "teleport-events" && method === "GET") {
+    const page = pageOfRcChannel(request4.url, session.events, (event) => event.eventId, (event) => ({ event_id: event.eventId, payload: event.payload }));
+    if ("error" in page) {
+      await ctx.answerJson(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: page.error } });
+      return true;
+    }
+    await ctx.answerJson(response, HTTP_STATUS.ok, page);
+    return true;
+  }
+  return false;
+}
+var compatSessionRow = (session, now) => ({ id: session.id, title: session.title, created_at: new Date(session.createdAt).toISOString(), updated_at: new Date(now()).toISOString(), session_status: "active" });
+async function serveRcCompatSessions(ctx, pathname, compatPath) {
+  const { request: request4, response } = ctx;
+  const method = request4.method.toUpperCase();
+  if (pathname === compatPath) {
+    if (method !== "GET") {
+      await ctx.answerJson(response, HTTP_STATUS.methodNotAllowed, { type: "error", error: { type: "api_error", message: "the compatibility session list is a GET" } });
+      return;
+    }
+    const listRefusal = ctx.credentialRefusal(request4.headers);
+    if (listRefusal !== void 0) {
+      await ctx.unauthorized(response, listRefusal);
+      return;
+    }
+    await ctx.answerJson(response, HTTP_STATUS.ok, { data: [...ctx.sessions.values()].map((session2) => compatSessionRow(session2, ctx.now)) });
+    return;
+  }
+  const rest = pathname.slice(`${compatPath}/`.length);
+  const slash = rest.indexOf("/");
+  const address = slash === -1 ? rest : rest.slice(0, slash);
+  const compatTail = slash === -1 ? "" : rest.slice(slash + 1);
+  const refusal = ctx.credentialRefusal(request4.headers);
+  if (refusal !== void 0) {
+    await ctx.unauthorized(response, refusal);
+    return;
+  }
+  const session = ctx.sessions.get(address) ?? ctx.sessions.get(`cse_${address}`);
+  if (compatTail === "") {
+    if (method === "GET") {
+      if (session === void 0) {
+        await ctx.answerJson(response, HTTP_STATUS.notFound, { type: "error", error: { type: "api_error", message: `Session not found: ${address}` } });
+        return;
+      }
+      await ctx.answerJson(response, HTTP_STATUS.ok, compatSessionRow(session, ctx.now));
+      return;
+    }
+    if (method === "PATCH" || method === "PUT") {
+      if (session === void 0) {
+        await ctx.answerJson(response, HTTP_STATUS.notFound, { type: "error", error: { type: "api_error", message: `Session not found: ${address}` } });
+        return;
+      }
+      const body = parseJsonObject2(await ctx.readBody(request4.body, CONTROL_BODY_CAP_BYTES));
+      const title = nonEmptyString2(body, "title");
+      if (title === void 0) {
+        await ctx.answerJson(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "a compatibility session update is JSON naming a non-empty title" } });
+        return;
+      }
+      session.title = title;
+      session.lastTrafficAt = ctx.now();
+      ctx.log?.(`rc selfhost ${session.id}: retitled through the compatibility family`);
+      await ctx.answerJson(response, HTTP_STATUS.ok, compatSessionRow(session, ctx.now));
+      return;
+    }
+    await ctx.answerJson(response, HTTP_STATUS.methodNotAllowed, { type: "error", error: { type: "api_error", message: "the compatibility session read is a GET and its update a PATCH or PUT" } });
+    return;
+  }
+  if ((compatTail === "archive" || compatTail === "unarchive") && method === "POST") {
+    await ctx.readBody(request4.body, CONTROL_BODY_CAP_BYTES);
+    if (session === void 0) {
+      await ctx.answerJson(response, HTTP_STATUS.notFound, { type: "error", error: { type: "api_error", message: `Session not found: ${address}` } });
+      return;
+    }
+    if (compatTail === "unarchive") {
+      await ctx.answerJson(response, HTTP_STATUS.ok, compatSessionRow(session, ctx.now));
+      return;
+    }
+    for (const sink of [...session.workerStreams, ...session.clientStreams]) {
+      sink.retire();
+    }
+    ctx.sessions.delete(session.id);
+    ctx.log?.(`rc selfhost ${session.id}: archived through the compatibility family`);
+    await ctx.answerJson(response, HTTP_STATUS.ok, {});
+    return;
+  }
+  await ctx.answerJson(response, HTTP_STATUS.notFound, { type: "error", error: { type: "api_error", message: `the compatibility session family serves no path "${compatTail}"` } });
+}
+
 // src/frontdoor/rcWebFetch.ts
 var dns2 = __toESM(require("node:dns"), 1);
 var http2 = __toESM(require("node:http"), 1);
@@ -10832,21 +11084,19 @@ var RC_PRESENCE_REFRESH_SECONDS = 60;
 var RC_SELF_HOST_MAX_BATCH_EVENTS = 100;
 var RC_SELF_HOST_WORKER_EPOCH = 1;
 var RC_STREAM_EVENT_NAME2 = "client_event";
-var RC_SOURCE_WORKER = "worker";
-var RC_SOURCE_CLIENT = "client";
 var CONFLICT_REASON_HEADER2 = "x-ccr-conflict-reason";
 var CONFLICT_REASON_EPOCH_STALE = "epoch_stale";
-function isRecord6(value) {
+function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isWebSearchRefusal(value) {
   return !Array.isArray(value);
 }
-function nonEmptyString2(record, field) {
+function nonEmptyString3(record, field) {
   const value = record === void 0 ? void 0 : record[field];
   return typeof value === "string" && value !== "" ? value : void 0;
 }
-function numberOf(record, field) {
+function numberOf2(record, field) {
   const value = record === void 0 ? void 0 : record[field];
   if (typeof value === "number" && Number.isFinite(value)) {
     return value;
@@ -10913,14 +11163,14 @@ async function readBody2(request4, capBytes) {
     });
   });
 }
-function parseJsonObject2(body) {
+function parseJsonObject3(body) {
   let parsed;
   try {
     parsed = JSON.parse(body);
   } catch {
     return void 0;
   }
-  return isRecord6(parsed) ? parsed : void 0;
+  return isRecord7(parsed) ? parsed : void 0;
 }
 function mintWorkerJwt(randomToken, issuedAt) {
   const encode = (value) => Buffer.from(JSON.stringify(value), "utf8").toString("base64url");
@@ -10943,11 +11193,16 @@ function createRcSelfHostSurface(deps) {
     for (const session of sessions.values()) {
       while (session.events[0] !== void 0 && now - session.events[0].storedAt > RC_SELF_HOST_RETENTION_MS) {
         const dropped = session.events.shift();
-        const uuid = dropped === void 0 ? void 0 : nonEmptyString2(dropped.payload, "uuid");
+        const uuid = dropped === void 0 ? void 0 : nonEmptyString3(dropped.payload, "uuid");
         if (uuid !== void 0) {
           session.seenPayloadUuids.delete(uuid);
         }
       }
+      for (const [clientId, lastSeenAt] of session.clients) {
+        if (now - lastSeenAt > RC_SELF_HOST_RETENTION_MS) {
+          session.clients.delete(clientId);
+        }
+      }
       if (session.workerStreams.size === 0 && session.clientStreams.size === 0 && now - session.lastTrafficAt > RC_SELF_HOST_RETENTION_MS) {
         sessions.delete(session.id);
       }
@@ -10986,7 +11241,7 @@ function createRcSelfHostSurface(deps) {
   const frameOf = (event) => {
     const envelope = {
       event_id: event.eventId,
-      event_type: nonEmptyString2(event.payload, "type") ?? "event",
+      event_type: nonEmptyString3(event.payload, "type") ?? "event",
       sequence_num: event.sequenceNum,
       source: event.source,
       payload: event.payload,
@@ -11000,7 +11255,7 @@ data: ${JSON.stringify(envelope)}
   };
   const holdStream = async (session, which, wantsReplay, request4, response) => {
     const url = new URL(request4.url, "http://127.0.0.1");
-    const cursor = numberOf({ value: url.searchParams.get("from_sequence_num") }, "value") ?? numberOf({ value: singleHeader2(request4.headers, "last-event-id") }, "value");
+    const cursor = numberOf2({ value: url.searchParams.get("from_sequence_num") }, "value") ?? numberOf2({ value: singleHeader2(request4.headers, "last-event-id") }, "value");
     const replay = cursor === void 0 ? [] : session.events.filter((event) => wantsReplay(event) && event.sequenceNum > cursor);
     response.start(HTTP_STATUS.ok, { "content-type": "text/event-stream", "cache-control": "no-cache" });
     response.flush();
@@ -11029,8 +11284,8 @@ data: ${JSON.stringify(envelope)}
     sink.retire();
     response.end();
   };
-  const publish = (session, source, payload) => {
-    const uuid = nonEmptyString2(payload, "uuid");
+  const publish = (session, source, payload, toWorker = source === RC_SOURCE_CLIENT) => {
+    const uuid = nonEmptyString3(payload, "uuid");
     const duplicate = uuid !== void 0 && session.seenPayloadUuids.has(uuid);
     session.sequenceNum += 1;
     const event = {
@@ -11038,9 +11293,9 @@ data: ${JSON.stringify(envelope)}
       eventId: uuid ?? deps.newUuid(),
       source,
       // The one enrichment the real service was observed making on the live rig's stream: the wall-clock instant it took the write. The worker's handler ignores it; the door's own parser forwards it verbatim.
-      payload: source === RC_SOURCE_CLIENT ? { ...payload, server_received_wall_ms: deps.now() } : payload,
+      payload: source === RC_SOURCE_WORKER ? payload : { ...payload, server_received_wall_ms: deps.now() },
       createdAt: new Date(deps.now()).toISOString(),
-      toWorker: source === RC_SOURCE_CLIENT,
+      toWorker,
       storedAt: deps.now()
     };
     session.events.push(event);
@@ -11088,8 +11343,26 @@ data: ${JSON.stringify(envelope)}
     }
     session.lastTrafficAt = deps.now();
     if (tail === "") {
+      if (method === "PATCH" || method === "PUT") {
+        const refusal = credentialRefusal(request4.headers);
+        if (refusal !== void 0) {
+          await unauthorized(response, refusal);
+          return;
+        }
+        const body = parseJsonObject3(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
+        const title = nonEmptyString3(body, "title");
+        if (title === void 0) {
+          await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "a session update is JSON naming a non-empty title" } });
+          return;
+        }
+        session.title = title;
+        session.lastTrafficAt = deps.now();
+        deps.log?.(`rc selfhost ${session.id}: retitled at its client's request`);
+        await answerJson2(response, HTTP_STATUS.ok, {});
+        return;
+      }
       if (method !== "GET") {
-        await answerJson2(response, HTTP_STATUS.methodNotAllowed, { type: "error", error: { type: "api_error", message: "the session read is a GET" } });
+        await answerJson2(response, HTTP_STATUS.methodNotAllowed, { type: "error", error: { type: "api_error", message: "the session read is a GET, and its update a PATCH or PUT" } });
         return;
       }
       await answerJson2(response, HTTP_STATUS.ok, { session: { id: session.id, title: session.title, created_at: new Date(session.createdAt).toISOString(), status: "active" } });
@@ -11134,17 +11407,17 @@ data: ${JSON.stringify(envelope)}
         return;
       }
       if (workerTail === "" && method === "PUT") {
-        const body = parseJsonObject2(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
-        const claimedEpoch = numberOf(body, "worker_epoch");
+        const body = parseJsonObject3(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
+        const claimedEpoch = numberOf2(body, "worker_epoch");
         if (claimedEpoch !== void 0 && claimedEpoch !== RC_SELF_HOST_WORKER_EPOCH) {
           await epochStale(response);
           return;
         }
-        const status = nonEmptyString2(body, "worker_status");
+        const status = nonEmptyString3(body, "worker_status");
         if (status !== void 0) {
           session.workerStatus = status;
         }
-        if (isRecord6(body?.external_metadata)) {
+        if (isRecord7(body?.external_metadata)) {
           session.externalMetadata = body.external_metadata;
         }
         await answerJson2(response, HTTP_STATUS.ok, {});
@@ -11161,8 +11434,8 @@ data: ${JSON.stringify(envelope)}
         return;
       }
       if (workerTail === "events" && method === "POST") {
-        const body = parseJsonObject2(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
-        const claimedEpoch = numberOf(body, "worker_epoch");
+        const body = parseJsonObject3(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
+        const claimedEpoch = numberOf2(body, "worker_epoch");
         if (claimedEpoch !== void 0 && claimedEpoch !== RC_SELF_HOST_WORKER_EPOCH) {
           await epochStale(response);
           return;
@@ -11174,7 +11447,7 @@ data: ${JSON.stringify(envelope)}
         }
         const results = [];
         for (const event of events) {
-          if (!isRecord6(event) || !isRecord6(event.payload)) {
+          if (!isRecord7(event) || !isRecord7(event.payload)) {
             await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "every event in a batch is an object carrying one payload object" } });
             return;
           }
@@ -11195,8 +11468,8 @@ data: ${JSON.stringify(envelope)}
         return;
       }
       if (workerTail === "internal-events" && method === "POST") {
-        const body = parseJsonObject2(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
-        const claimedEpoch = numberOf(body, "worker_epoch");
+        const body = parseJsonObject3(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
+        const claimedEpoch = numberOf2(body, "worker_epoch");
         if (claimedEpoch !== void 0 && claimedEpoch !== RC_SELF_HOST_WORKER_EPOCH) {
           await epochStale(response);
           return;
@@ -11207,19 +11480,26 @@ data: ${JSON.stringify(envelope)}
           return;
         }
         for (const event of events) {
-          if (isRecord6(event)) {
-            session.internalEvents.push({ cursor: deps.newUuid(), body: event });
+          if (isRecord7(event)) {
+            session.internalEvents.push({ eventId: deps.newUuid(), body: event });
           }
         }
         await answerJson2(response, HTTP_STATUS.ok, {});
         return;
       }
       if (workerTail === "internal-events" && method === "GET") {
-        const url = new URL(request4.url, "http://127.0.0.1");
-        const cursor = url.searchParams.get("cursor");
-        const from = cursor === null ? 0 : session.internalEvents.findIndex((event) => event.cursor === cursor) + 1;
-        const page = session.internalEvents.slice(from);
-        await answerJson2(response, HTTP_STATUS.ok, { data: page.map((event) => event.body), next_cursor: page.length === 0 ? void 0 : page[page.length - 1]?.cursor });
+        const query = new URL(request4.url, "http://127.0.0.1").searchParams;
+        if (query.get("session_agent_id") !== null || query.get("subagents") !== null) {
+          await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "this surface keeps one internal-events channel per session, so an agent-scoped read has no subset to serve" } });
+          return;
+        }
+        const page = pageOfRcChannel(request4.url, session.internalEvents, (event) => event.eventId, (event) => ({ event_id: event.eventId, payload: event.body }));
+        if ("error" in page) {
+          const anchorUnknown = query.get("after_event_id") !== null && page.error.startsWith("the anchor names an event id");
+          await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: anchorUnknown ? "after_event_id_not_found" : "invalid_request_error", message: page.error } });
+          return;
+        }
+        await answerJson2(response, HTTP_STATUS.ok, page);
         return;
       }
       if (workerTail === "diagnostics" && method === "POST") {
@@ -11228,8 +11508,8 @@ data: ${JSON.stringify(envelope)}
         return;
       }
       if (workerTail === "web-fetch" && method === "POST") {
-        const body = parseJsonObject2(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
-        const target = nonEmptyString2(body, "url");
+        const body = parseJsonObject3(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
+        const target = nonEmptyString3(body, "url");
         if (target === void 0) {
           await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "a worker web-fetch carries one url" } });
           return;
@@ -11251,8 +11531,8 @@ data: ${JSON.stringify(envelope)}
         return;
       }
       if (workerTail === "web-search" && method === "POST") {
-        const body = parseJsonObject2(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
-        const query = nonEmptyString2(body, "query");
+        const body = parseJsonObject3(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
+        const query = nonEmptyString3(body, "query");
         if (query === void 0) {
           await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "a worker web-search carries one query" } });
           return;
@@ -11263,7 +11543,7 @@ data: ${JSON.stringify(envelope)}
           await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "the domain filters of a worker web-search are string arrays" } });
           return;
         }
-        const searchProfile = nonEmptyString2(body, "search_profile");
+        const searchProfile = nonEmptyString3(body, "search_profile");
         const backend = deps.webSearch;
         if (backend === void 0) {
           deps.log?.(`rc selfhost ${session.id}: worker web-search of "${query}" refused: no search backend serves this door`);
@@ -11288,7 +11568,7 @@ data: ${JSON.stringify(envelope)}
       return;
     }
     if (tail === "events" && method === "POST") {
-      const body = parseJsonObject2(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
+      const body = parseJsonObject3(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
       const events = body?.events;
       if (!Array.isArray(events) || events.length === 0 || events.length > RC_SELF_HOST_MAX_BATCH_EVENTS) {
         await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: `a client event write is a non-empty array of at most ${String(RC_SELF_HOST_MAX_BATCH_EVENTS)} events` } });
@@ -11296,7 +11576,7 @@ data: ${JSON.stringify(envelope)}
       }
       const results = [];
       for (const event of events) {
-        if (!isRecord6(event) || !isRecord6(event.payload)) {
+        if (!isRecord7(event) || !isRecord7(event.payload)) {
           await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "every event in a write is an object carrying one payload object" } });
           return;
         }
@@ -11308,26 +11588,14 @@ data: ${JSON.stringify(envelope)}
       return;
     }
     if (tail === "events" && method === "GET") {
-      await answerJson2(response, HTTP_STATUS.ok, { data: session.events.map((event) => ({ event_id: event.eventId, event_type: nonEmptyString2(event.payload, "type") ?? "event", sequence_num: event.sequenceNum, source: event.source, payload: event.payload, created_at: event.createdAt })) });
+      await answerJson2(response, HTTP_STATUS.ok, { data: session.events.map((event) => ({ event_id: event.eventId, event_type: nonEmptyString3(event.payload, "type") ?? "event", sequence_num: event.sequenceNum, source: event.source, payload: event.payload, created_at: event.createdAt })) });
       return;
     }
     if (tail === "events/stream" && method === "GET") {
       await holdStream(session, "clientStreams", () => true, request4, response);
       return;
     }
-    if (tail === "client/presence" && method === "POST") {
-      await readBody2(request4.body, CONTROL_BODY_CAP_BYTES);
-      await answerJson2(response, HTTP_STATUS.ok, { refresh_after_seconds: RC_PRESENCE_REFRESH_SECONDS });
-      return;
-    }
-    if (tail === "mark_read" && method === "POST") {
-      await readBody2(request4.body, CONTROL_BODY_CAP_BYTES);
-      await answerJson2(response, HTTP_STATUS.ok, {});
-      return;
-    }
-    if (tail === "teleport-events" && method === "POST") {
-      await readBody2(request4.body, CONTROL_BODY_CAP_BYTES);
-      await answerJson2(response, HTTP_STATUS.ok, {});
+    if (await serveRcClientChannels({ request: request4, response, session, answerJson: answerJson2, readBody: readBody2, publish, sweep, now: deps.now, presenceRefreshSeconds: RC_PRESENCE_REFRESH_SECONDS, ...deps.log === void 0 ? {} : { log: deps.log } }, tail, method, RC_SELF_HOST_MAX_BATCH_EVENTS)) {
       return;
     }
     await answerJson2(response, HTTP_STATUS.notFound, { type: "error", error: { type: "api_error", message: `the self-hosted Remote Control surface serves no path "${tail}"` } });
@@ -11344,17 +11612,8 @@ data: ${JSON.stringify(envelope)}
         await noCredential(response);
         return;
       }
-      if (pathname === RC_COMPAT_SESSIONS_PATH) {
-        if (method !== "GET") {
-          await answerJson2(response, HTTP_STATUS.methodNotAllowed, { type: "error", error: { type: "api_error", message: "the compatibility session list is a GET" } });
-          return;
-        }
-        const listRefusal = credentialRefusal(request4.headers);
-        if (listRefusal !== void 0) {
-          await unauthorized(response, listRefusal);
-          return;
-        }
-        await answerJson2(response, HTTP_STATUS.ok, { data: [] });
+      if (pathname === RC_COMPAT_SESSIONS_PATH || pathname.startsWith(`${RC_COMPAT_SESSIONS_PATH}/`)) {
+        await serveRcCompatSessions({ request: request4, response, sessions, answerJson: answerJson2, readBody: readBody2, credentialRefusal, unauthorized, now: deps.now, ...deps.log === void 0 ? {} : { log: deps.log } }, pathname, RC_COMPAT_SESSIONS_PATH);
         return;
       }
       if (pathname !== RC_SESSIONS_PATH_PREFIX2 && !pathname.startsWith(`${RC_SESSIONS_PATH_PREFIX2}/`)) {
@@ -11368,11 +11627,11 @@ data: ${JSON.stringify(envelope)}
             await unauthorized(response, createRefusal);
             return;
           }
-          const body = parseJsonObject2(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
+          const body = parseJsonObject3(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
           const session = {
             id: `${RC_SESSION_ID_PREFIX2}${deps.newUuid()}`,
             createdAt: deps.now(),
-            title: nonEmptyString2(body, "title"),
+            title: nonEmptyString3(body, "title"),
             workerJwts: /* @__PURE__ */ new Set(),
             sequenceNum: 0,
             events: [],
@@ -11380,6 +11639,7 @@ data: ${JSON.stringify(envelope)}
             workerStreams: /* @__PURE__ */ new Set(),
             clientStreams: /* @__PURE__ */ new Set(),
             internalEvents: [],
+            clients: /* @__PURE__ */ new Map(),
             workerStatus: void 0,
             externalMetadata: void 0,
             lastTrafficAt: deps.now()
@@ -11424,7 +11684,7 @@ data: ${JSON.stringify(envelope)}
       const pathname = new URL(request4.url ?? "/", "http://127.0.0.1").pathname;
       if (host === RC_SELF_HOST_OAUTH_HOST) {
         if (method === "POST" && pathname === "/v1/oauth/token") {
-          const body = parseJsonObject2(await readBody2(request4, CONTROL_BODY_CAP_BYTES));
+          const body = parseJsonObject3(await readBody2(request4, CONTROL_BODY_CAP_BYTES));
           const record = deps.credentialRecord();
           if (record === void 0) {
             answerServerJson(response, HTTP_SERVICE_UNAVAILABLE, { error: "the front door's self-hosted Remote Control surface is on but no credential has been minted for it" });
@@ -11510,7 +11770,7 @@ var RC_SELF_HOST_RECORD_DIR = "rc-selfhost";
 var RC_SELF_HOST_RECORD_FILE = "credential.json";
 var SELF_HOST_EMAIL = "selfhost@agent-shim.invalid";
 var SELF_HOST_SUBSCRIPTION_TYPE = "max";
-function isRecord7(value) {
+function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function readJsonObject(fs12, file) {
@@ -11524,7 +11784,7 @@ function readJsonObject(fs12, file) {
   } catch {
     return void 0;
   }
-  return isRecord7(parsed) ? parsed : void 0;
+  return isRecord8(parsed) ? parsed : void 0;
 }
 function readRcSelfHostRecord(fs12, frontdoorDir) {
   const parsed = readJsonObject(fs12, import_node_path28.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
@@ -11548,7 +11808,7 @@ function mintRcSelfHostCredential(deps) {
   const recordFile = import_node_path28.default.join(recordDir, RC_SELF_HOST_RECORD_FILE);
   const previousRecord = readRcSelfHostRecord(deps.fs, deps.frontdoorDir);
   const existingCredentials = readJsonObject(deps.fs, credentialsFile);
-  const existingOauth = isRecord7(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
+  const existingOauth = isRecord8(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
   const existingToken = typeof existingOauth?.accessToken === "string" && existingOauth.accessToken !== "" ? existingOauth.accessToken : void 0;
   const existingIsOwn = existingToken !== void 0 && previousRecord?.accessToken === existingToken;
   if (existingToken !== void 0 && !existingIsOwn && !deps.force) {
@@ -11565,7 +11825,7 @@ function mintRcSelfHostCredential(deps) {
   deps.fs.writeFilePrivate(credentialsFile, `${JSON.stringify({ ...existingCredentials, claudeAiOauth: { accessToken, refreshToken, expiresAt: null, scopes: [...RC_SELF_HOST_SCOPE_LIST], subscriptionType: SELF_HOST_SUBSCRIPTION_TYPE, rateLimitTier: null } }, null, 2)}
 `);
   const claudeJson = readJsonObject(deps.fs, claudeJsonFile) ?? {};
-  const existingBlock = (value) => isRecord7(value) ? value : {};
+  const existingBlock = (value) => isRecord8(value) ? value : {};
   deps.fs.writeFilePrivate(claudeJsonFile, `${JSON.stringify({
     ...claudeJson,
     oauthAccount: {
@@ -11764,7 +12024,7 @@ var import_node_path30 = __toESM(require("node:path"), 1);
 // package.json
 var package_default = {
   name: "agent-shim",
-  version: "8.24.0",
+  version: "8.25.0",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -13055,6 +13315,7 @@ function prepareClaudeLaunch(options) {
   buildRcGetUsagePayload,
   buildRcInterruptPayload,
   buildRcKeepAlivePayload,
+  buildRcMarkReadBody,
   buildRcMcpAuthenticatePayload,
   buildRcMcpOAuthCallbackUrlPayload,
   buildRcMcpReconnectPayload,
@@ -13201,6 +13462,7 @@ function prepareClaudeLaunch(options) {
   startConnectServer,
   submitRcSessionMcpOAuthCallbackUrl,
   suggestRcSessionFiles,
+  teleportRcSession,
   topLevelNames,
   updateDirectoryRule,
   updateProvider,