agent-shim 8.24.0 → 8.26.0

package/dist/cli.cjs

@@ -61796,7 +61796,7 @@ function registerIdentityCommand(program2, deps) {
 // package.json
 var package_default = {
   name: "agent-shim",
-  version: "8.24.0",
+  version: "8.26.0",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -66142,13 +66142,6 @@ var https3 = __toESM(require("node:https"), 1);
 var net2 = __toESM(require("node:net"), 1);
 var tls = __toESM(require("node:tls"), 1);
 
-// src/frontdoor/server.ts
-var import_node_http2 = __toESM(require("node:http"), 1);
-var import_node_https = __toESM(require("node:https"), 1);
-
-// src/frontdoor/rcControl.ts
-var https = __toESM(require("node:https"), 1);
-
 // src/frontdoor/rcSessions.ts
 var RC_SESSIONS_PATH_PREFIX = "/v1/code/sessions";
 var RC_SESSION_ID_PREFIX = "cse_";
@@ -66725,7 +66718,7 @@ async function answerRcControlRequest(deps, sessionId, requestId, decision) {
   }
   return result;
 }
-async function deliverRcClientPayload(deps, sessionId, payload, action) {
+async function deliverRcClientPayload(deps, sessionId, payload, action, to = "events") {
   const credential = deps.credentialOf(sessionId);
   if (credential === void 0) {
     return { ok: false, message: rcSessionNotObservedMessage(sessionId) };
@@ -66736,7 +66729,7 @@ async function deliverRcClientPayload(deps, sessionId, payload, action) {
   const body = JSON.stringify(buildRcEventWriteBody(payload));
   let answer;
   try {
-    answer = await deps.dial.writeEvents(sessionId, rcWriteHeaders(credential), body);
+    answer = await (to === "teleport-events" ? deps.dial.writeTeleportEvents(sessionId, rcWriteHeaders(credential), body) : deps.dial.writeEvents(sessionId, rcWriteHeaders(credential), body));
   } catch (error62) {
     return { ok: false, message: `the door could not reach the API host to ${action}: ${error62 instanceof Error ? error62.message : String(error62)}` };
   }
@@ -66830,8 +66823,22 @@ async function submitRcSessionMcpOAuthCallbackUrl(deps, sessionId, serverName, c
 async function sendRcKeepAlive(deps, sessionId) {
   return await deliverRcClientPayload(deps, sessionId, buildRcKeepAlivePayload(), `keep session ${sessionId} alive`);
 }
+async function teleportRcSession(deps, sessionId, marker) {
+  if (marker === "") {
+    return { ok: false, message: "a teleport write needs a non-empty marker: the teleport relay anchors on a marker line's uuid and string content, and an empty string carries neither" };
+  }
+  return await deliverRcClientPayload(deps, sessionId, buildRcUserMessagePayload(deps.newUuid(), sessionId, marker), `teleport a marker into session ${sessionId}`, "teleport-events");
+}
+function buildRcMarkReadBody(eventId) {
+  return eventId === void 0 ? {} : { event_id: eventId };
+}
+
+// src/frontdoor/server.ts
+var import_node_http2 = __toESM(require("node:http"), 1);
+var import_node_https = __toESM(require("node:https"), 1);
 
 // src/frontdoor/rcControl.ts
+var https = __toESM(require("node:https"), 1);
 var RC_PERMISSION_MODE_LIST = RC_PERMISSION_MODES.join(", ");
 var CONTROL_PATH_PREFIX = "/__agent-shim/rc";
 var CONTROL_BODY_CAP_BYTES = 10485760;
@@ -67005,6 +67012,15 @@ function createRcControlHandler(deps) {
         const callbackUrl = bodyString(body, "callbackUrl");
         return session === void 0 || serverName === void 0 || callbackUrl === void 0 ? { error: "the mcp-oauth-callback-url body must be JSON naming a non-empty session id, server name, and callback URL" } : { session, run: async () => await deps.mcpOAuthCallbackUrl(session, serverName, callbackUrl) };
       }
+    },
+    {
+      name: "teleport",
+      path: "teleport",
+      read: (body) => {
+        const session = bodyString(body, "session");
+        const marker = bodyString(body, "marker");
+        return session === void 0 || marker === void 0 ? { error: "the teleport body must be JSON naming a non-empty session id and marker" } : { session, run: async () => await deps.teleport(session, marker) };
+      }
     }
   ];
   return (request7, response) => {
@@ -67368,7 +67384,8 @@ function frontDoorRcControl(transport, token) {
     mcpStatus: async (sessionId) => await writeOf(`${CONTROL_PATH_PREFIX}/mcp-status`, JSON.stringify({ session: sessionId }), (status, message) => `requesting the MCP status of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     mcpReconnect: async (sessionId, serverName) => await writeOf(`${CONTROL_PATH_PREFIX}/mcp-reconnect`, JSON.stringify({ session: sessionId, serverName }), (status, message) => `reconnecting MCP server ${serverName} on ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     mcpAuthenticate: async (sessionId, serverName, redirectUri) => await writeOf(`${CONTROL_PATH_PREFIX}/mcp-authenticate`, JSON.stringify({ session: sessionId, serverName, redirectUri }), (status, message) => `authenticating MCP server ${serverName} on ${sessionId} failed (HTTP ${String(status)}): ${message}`),
-    mcpOAuthCallbackUrl: async (sessionId, serverName, callbackUrl) => await writeOf(`${CONTROL_PATH_PREFIX}/mcp-oauth-callback-url`, JSON.stringify({ session: sessionId, serverName, callbackUrl }), (status, message) => `handing MCP server ${serverName}'s OAuth callback to ${sessionId} failed (HTTP ${String(status)}): ${message}`)
+    mcpOAuthCallbackUrl: async (sessionId, serverName, callbackUrl) => await writeOf(`${CONTROL_PATH_PREFIX}/mcp-oauth-callback-url`, JSON.stringify({ session: sessionId, serverName, callbackUrl }), (status, message) => `handing MCP server ${serverName}'s OAuth callback to ${sessionId} failed (HTTP ${String(status)}): ${message}`),
+    teleport: async (sessionId, marker) => await writeOf(`${CONTROL_PATH_PREFIX}/teleport`, JSON.stringify({ session: sessionId, marker }), (status, message) => `teleporting a marker into ${sessionId} failed (HTTP ${String(status)}): ${message}`)
   };
 }
 
@@ -67650,36 +67667,38 @@ function tlsFacts(options) {
 }
 function realRcEventDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  return {
-    writeEvents: async (sessionId, headers, body) => await new Promise((resolve, reject) => {
-      const options = {
-        host: target.host,
-        port: target.port,
-        method: "POST",
-        path: `/v1/code/sessions/${encodeURIComponent(sessionId)}/events`,
-        // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
-        headers: { ...headers, host: target.servername ?? target.host, "content-length": String(Buffer.byteLength(body, "utf8")) },
-        agent
-      };
-      options.servername = target.servername ?? target.host;
-      if (target.ca !== void 0) {
-        options.ca = [...target.ca];
-      }
-      if (target.rejectUnauthorized !== void 0) {
-        options.rejectUnauthorized = target.rejectUnauthorized;
-      }
-      const request7 = https3.request(options, (response) => {
-        const chunks = [];
-        response.on("data", (chunk) => {
-          chunks.push(chunk);
-        });
-        response.on("end", () => {
-          resolve({ status: response.statusCode ?? HTTP_BAD_GATEWAY, body: Buffer.concat(chunks).toString("utf8") });
-        });
+  const post = async (path46, headers, body) => await new Promise((resolve, reject) => {
+    const options = {
+      host: target.host,
+      port: target.port,
+      method: "POST",
+      path: path46,
+      // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
+      headers: { ...headers, host: target.servername ?? target.host, "content-length": String(Buffer.byteLength(body, "utf8")) },
+      agent
+    };
+    options.servername = target.servername ?? target.host;
+    if (target.ca !== void 0) {
+      options.ca = [...target.ca];
+    }
+    if (target.rejectUnauthorized !== void 0) {
+      options.rejectUnauthorized = target.rejectUnauthorized;
+    }
+    const request7 = https3.request(options, (response) => {
+      const chunks = [];
+      response.on("data", (chunk) => {
+        chunks.push(chunk);
       });
-      request7.once("error", reject);
-      request7.end(body);
-    })
+      response.on("end", () => {
+        resolve({ status: response.statusCode ?? HTTP_BAD_GATEWAY, body: Buffer.concat(chunks).toString("utf8") });
+      });
+    });
+    request7.once("error", reject);
+    request7.end(body);
+  });
+  return {
+    writeEvents: async (sessionId, headers, body) => await post(`/v1/code/sessions/${encodeURIComponent(sessionId)}/events`, headers, body),
+    writeTeleportEvents: async (sessionId, headers, body) => await post(`/v1/code/sessions/${encodeURIComponent(sessionId)}/teleport-events`, headers, body)
   };
 }
 var NO_CHUNKS = {
@@ -67697,7 +67716,8 @@ function lateRcEventDial(resolve) {
     return built.dial;
   };
   return {
-    writeEvents: async (sessionId, headers, body) => await dialFor().writeEvents(sessionId, headers, body)
+    writeEvents: async (sessionId, headers, body) => await dialFor().writeEvents(sessionId, headers, body),
+    writeTeleportEvents: async (sessionId, headers, body) => await dialFor().writeTeleportEvents(sessionId, headers, body)
   };
 }
 function lateRcStreamDial(resolve) {
@@ -67710,7 +67730,8 @@ function lateRcStreamDial(resolve) {
     return built.dial;
   };
   return {
-    announcePresence: async (sessionId, headers, clientId) => await dialFor().announcePresence(sessionId, headers, clientId),
+    announcePresence: async (sessionId, headers, clientId, clear) => await dialFor().announcePresence(sessionId, headers, clientId, clear),
+    markRead: async (sessionId, headers, eventId) => await dialFor().markRead(sessionId, headers, eventId),
     openStream: async (sessionId, headers, resume, signal) => await dialFor().openStream(sessionId, headers, resume, signal)
   };
 }
@@ -67752,11 +67773,16 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
     return Buffer.concat(chunks).toString("utf8");
   };
   return {
-    announcePresence: async (sessionId, headers, clientId) => {
-      const body = JSON.stringify({ client_id: clientId, clear: false });
+    announcePresence: async (sessionId, headers, clientId, clear) => {
+      const body = JSON.stringify({ client_id: clientId, clear });
       const { status, response } = await request7("POST", `/v1/code/sessions/${encodeURIComponent(sessionId)}/client/presence`, { ...headers, "content-type": "application/json" }, body, new AbortController().signal);
       return { status, body: await readAll(response) };
     },
+    markRead: async (sessionId, headers, eventId) => {
+      const body = JSON.stringify(buildRcMarkReadBody(eventId));
+      const { status, response } = await request7("POST", `/v1/code/sessions/${encodeURIComponent(sessionId)}/mark_read`, { ...headers, "content-type": "application/json" }, body, new AbortController().signal);
+      return { status, body: await readAll(response) };
+    },
     openStream: async (sessionId, headers, resume, signal) => {
       const path46 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
       const streamHeaders = resume === void 0 ? headers : { ...headers, "last-event-id": String(resume.fromSequenceNum) };
@@ -69640,6 +69666,166 @@ var CheckReportJsonSchema = external_exports.strictObject({
 
 // src/frontdoor/controlSchemas.ts
 var import_node_path33 = __toESM(require("node:path"), 1);
+
+// src/frontdoor/rcSchemas.ts
+var RcPermissionModeSchema = external_exports.enum(RC_PERMISSION_MODES);
+var RcSessionSummarySchema = external_exports.strictObject({
+  id: external_exports.string(),
+  createdAt: external_exports.number(),
+  lastSeenAt: external_exports.number()
+});
+function workerFactSchema(value2) {
+  return external_exports.strictObject({ value: value2, observedAt: external_exports.number() });
+}
+var RcPendingRequestSummarySchema = external_exports.strictObject({
+  sessionId: external_exports.string(),
+  requestId: external_exports.string(),
+  type: external_exports.string(),
+  summary: external_exports.string(),
+  observedAt: external_exports.number()
+});
+var RcSessionStatusSchema = external_exports.strictObject({
+  ...RcSessionSummarySchema.shape,
+  workerState: workerFactSchema(external_exports.string()).optional(),
+  workerIdleSeconds: workerFactSchema(external_exports.number()).optional(),
+  pending: external_exports.readonly(external_exports.array(RcPendingRequestSummarySchema))
+});
+var RcStreamEnvelopeSchema = external_exports.looseObject({
+  /** The envelope's own event id, when the host sent one. */
+  event_id: external_exports.string().optional(),
+  /** The envelope's event type, the discriminator a consumer switches on (`control_request`, `user`, and kin). */
+  event_type: external_exports.string(),
+  /** The sequence number the host assigned, the value a resume continues after. */
+  sequence_num: external_exports.int(),
+  /** Who emitted the event (`worker` for the CLI's half, a client id for a client's). */
+  source: external_exports.string(),
+  /** The event's payload, carried verbatim: its shape is the payload family's, narrowed by whichever consumer needs it. Optional in the schema's own type because the door forwards the host's envelope as it arrived, asserting only the fields it relies on itself. */
+  payload: external_exports.unknown().optional(),
+  /** When the host created the event; the protocol's own type for this field is not established here, so it is forwarded rather than asserted. */
+  created_at: external_exports.unknown().optional()
+});
+var RcStreamEventSchema = external_exports.strictObject({
+  session: external_exports.string(),
+  envelope: RcStreamEnvelopeSchema
+});
+var RcRateLimitWindowSchema = external_exports.looseObject({
+  /** The fraction of the window used, usually between 0 and 1, above 1 when usage legitimately runs past the window's cap (the CLI's own field description states both). */
+  utilization: external_exports.number().optional(),
+  /** When the window resets, in unix epoch seconds: the unit is the CLI's own field description, stated in the 2.1.289 bundle's schema. */
+  resetsAt: external_exports.number().optional()
+});
+var RcRateLimitInfoSchema = external_exports.looseObject({
+  /** The limiting window's own status (`allowed`, `allowed_warning`, `rejected`), asserted only as a string because the vocabulary grows with the CLI. */
+  status: external_exports.string(),
+  /** When the limiting window resets, in unix epoch seconds. */
+  resetsAt: external_exports.number().optional(),
+  /** Which window the top-level fields describe (`five_hour`, `seven_day`, and kin), the payload's own name for it. */
+  rateLimitType: external_exports.string().optional(),
+  /** The fraction of the limiting window used, on the same scale the per-window utilizations carry. */
+  utilization: external_exports.number().optional(),
+  /** Whether usage beyond the plan (extra usage) is currently covering the overflow, the payload's own flag for it. */
+  isUsingOverage: external_exports.boolean().optional(),
+  /** The overage's own status, the same vocabulary the limiting window's `status` carries. */
+  overageStatus: external_exports.string().optional(),
+  /** When the overage window resets, in unix epoch seconds. */
+  overageResetsAt: external_exports.number().optional(),
+  /** Each subscription window the account's response headers carried: the session (five-hour), weekly (seven-day), and overage-included weekly windows, each present only when the account's responses carry it. */
+  unifiedWindows: external_exports.looseObject({ five_hour: RcRateLimitWindowSchema.optional(), seven_day: RcRateLimitWindowSchema.optional(), seven_day_overage_included: RcRateLimitWindowSchema.optional() }).optional()
+});
+var RcLiveRateLimitSchema = external_exports.strictObject({
+  session: external_exports.string(),
+  observedAt: external_exports.number(),
+  rateLimit: RcRateLimitInfoSchema
+});
+var RcSessionQuerySchema = external_exports.strictObject({
+  session: external_exports.string().min(1).optional()
+});
+var RcSendInputSchema = external_exports.strictObject({
+  session: external_exports.string().min(1),
+  text: external_exports.string().min(1)
+});
+var RcAnswerInputSchema = external_exports.strictObject({
+  session: external_exports.string().min(1),
+  request: external_exports.string().min(1),
+  approve: external_exports.boolean(),
+  text: external_exports.string().optional()
+}).refine((input2) => !input2.approve || input2.text === void 0 || input2.text === "", { message: "an approval carries no text (the protocol's allow result has no message field); text is the denial message" });
+var RcInterruptInputSchema = external_exports.strictObject({
+  session: external_exports.string().min(1)
+});
+var RcSetModelInputSchema = external_exports.strictObject({
+  session: external_exports.string().min(1),
+  model: external_exports.string().min(1)
+});
+var RcSetPermissionModeInputSchema = external_exports.strictObject({
+  session: external_exports.string().min(1),
+  mode: RcPermissionModeSchema
+});
+var RcEndSessionInputSchema = external_exports.strictObject({
+  session: external_exports.string().min(1),
+  reason: external_exports.string().min(1).optional()
+});
+var RcGetUsageInputSchema = external_exports.strictObject({
+  session: external_exports.string().min(1),
+  skipBehaviors: external_exports.boolean().optional()
+});
+var RcGetContextUsageInputSchema = external_exports.strictObject({
+  session: external_exports.string().min(1),
+  detail: external_exports.enum(RC_CONTEXT_USAGE_DETAILS).optional()
+});
+var RcReadFileInputSchema = external_exports.strictObject({
+  session: external_exports.string().min(1),
+  path: external_exports.string().min(1),
+  maxBytes: external_exports.number().int().positive().optional(),
+  encoding: external_exports.enum(RC_READ_FILE_ENCODINGS).optional()
+});
+var RcFileSuggestionsInputSchema = external_exports.strictObject({
+  session: external_exports.string().min(1),
+  query: external_exports.string()
+});
+var RcKeepAliveInputSchema = external_exports.strictObject({
+  session: external_exports.string().min(1)
+});
+var RcMcpStatusInputSchema = external_exports.strictObject({
+  session: external_exports.string().min(1)
+});
+var RcMcpReconnectInputSchema = external_exports.strictObject({
+  session: external_exports.string().min(1),
+  serverName: external_exports.string().min(1)
+});
+var RcMcpAuthenticateInputSchema = external_exports.strictObject({
+  session: external_exports.string().min(1),
+  serverName: external_exports.string().min(1),
+  redirectUri: external_exports.string().min(1)
+});
+var RcMcpOAuthCallbackUrlInputSchema = external_exports.strictObject({
+  session: external_exports.string().min(1),
+  serverName: external_exports.string().min(1),
+  callbackUrl: external_exports.string().min(1)
+});
+var RcTeleportInputSchema = external_exports.strictObject({
+  session: external_exports.string().min(1),
+  marker: external_exports.string().min(1)
+});
+var RcListOutputSchema = external_exports.strictObject({ sessions: external_exports.readonly(external_exports.array(RcSessionSummarySchema)) });
+var RcStatusOutputSchema = external_exports.strictObject({ statuses: external_exports.readonly(external_exports.array(RcSessionStatusSchema)) });
+var RcPendingOutputSchema = external_exports.strictObject({ pending: external_exports.readonly(external_exports.array(RcPendingRequestSummarySchema)) });
+var RcWriteOutputSchema = external_exports.strictObject({
+  session: external_exports.string(),
+  sequenceNums: external_exports.readonly(external_exports.array(external_exports.number()))
+});
+var RcControlWriteOutputSchema = external_exports.strictObject({
+  session: external_exports.string(),
+  request: external_exports.string(),
+  sequenceNums: external_exports.readonly(external_exports.array(external_exports.number()))
+});
+var RcAnswerOutputSchema = external_exports.strictObject({
+  session: external_exports.string(),
+  request: external_exports.string(),
+  sequenceNums: external_exports.readonly(external_exports.array(external_exports.number()))
+});
+
+// src/frontdoor/controlSchemas.ts
 var UsageListOutputSchema = external_exports.strictObject({ snapshots: external_exports.readonly(external_exports.array(UsageSnapshotSchema)) });
 var UsageWindowsInputSchema = external_exports.strictObject({
   identity: external_exports.string().min(1),
@@ -69663,6 +69849,12 @@ var UsageWindowsOutputSchema = external_exports.strictObject({
   fiveHour: EffectiveWindowSchema.optional(),
   sevenDay: EffectiveWindowSchema.optional()
 });
+var UsageLiveOutputSchema = external_exports.strictObject({
+  /** The freshest observation the door holds, never narrowed by the read's session filter because it is the door's single latest statement of the account's quota; absent while no rate_limit_event has been filed at all. */
+  latest: RcLiveRateLimitSchema.optional(),
+  /** One observation per session whose stream has filed a rate_limit_event this door generation. */
+  sessions: external_exports.readonly(external_exports.array(RcLiveRateLimitSchema))
+});
 var FrontDoorSessionStatusSchema = external_exports.strictObject({
   pid: external_exports.int().positive(),
   startedAt: external_exports.number(),
@@ -71966,133 +72158,6 @@ var RPCHandler = class extends NodeHttpHandler {
 
 // src/frontdoor/rcApi.ts
 var import_undici2 = __toESM(require_undici(), 1);
-
-// src/frontdoor/rcSchemas.ts
-var RcPermissionModeSchema = external_exports.enum(RC_PERMISSION_MODES);
-var RcSessionSummarySchema = external_exports.strictObject({
-  id: external_exports.string(),
-  createdAt: external_exports.number(),
-  lastSeenAt: external_exports.number()
-});
-function workerFactSchema(value2) {
-  return external_exports.strictObject({ value: value2, observedAt: external_exports.number() });
-}
-var RcPendingRequestSummarySchema = external_exports.strictObject({
-  sessionId: external_exports.string(),
-  requestId: external_exports.string(),
-  type: external_exports.string(),
-  summary: external_exports.string(),
-  observedAt: external_exports.number()
-});
-var RcSessionStatusSchema = external_exports.strictObject({
-  ...RcSessionSummarySchema.shape,
-  workerState: workerFactSchema(external_exports.string()).optional(),
-  workerIdleSeconds: workerFactSchema(external_exports.number()).optional(),
-  pending: external_exports.readonly(external_exports.array(RcPendingRequestSummarySchema))
-});
-var RcStreamEnvelopeSchema = external_exports.looseObject({
-  /** The envelope's own event id, when the host sent one. */
-  event_id: external_exports.string().optional(),
-  /** The envelope's event type, the discriminator a consumer switches on (`control_request`, `user`, and kin). */
-  event_type: external_exports.string(),
-  /** The sequence number the host assigned, the value a resume continues after. */
-  sequence_num: external_exports.int(),
-  /** Who emitted the event (`worker` for the CLI's half, a client id for a client's). */
-  source: external_exports.string(),
-  /** The event's payload, carried verbatim: its shape is the payload family's, narrowed by whichever consumer needs it. Optional in the schema's own type because the door forwards the host's envelope as it arrived, asserting only the fields it relies on itself. */
-  payload: external_exports.unknown().optional(),
-  /** When the host created the event; the protocol's own type for this field is not established here, so it is forwarded rather than asserted. */
-  created_at: external_exports.unknown().optional()
-});
-var RcStreamEventSchema = external_exports.strictObject({
-  session: external_exports.string(),
-  envelope: RcStreamEnvelopeSchema
-});
-var RcSessionQuerySchema = external_exports.strictObject({
-  session: external_exports.string().min(1).optional()
-});
-var RcSendInputSchema = external_exports.strictObject({
-  session: external_exports.string().min(1),
-  text: external_exports.string().min(1)
-});
-var RcAnswerInputSchema = external_exports.strictObject({
-  session: external_exports.string().min(1),
-  request: external_exports.string().min(1),
-  approve: external_exports.boolean(),
-  text: external_exports.string().optional()
-}).refine((input2) => !input2.approve || input2.text === void 0 || input2.text === "", { message: "an approval carries no text (the protocol's allow result has no message field); text is the denial message" });
-var RcInterruptInputSchema = external_exports.strictObject({
-  session: external_exports.string().min(1)
-});
-var RcSetModelInputSchema = external_exports.strictObject({
-  session: external_exports.string().min(1),
-  model: external_exports.string().min(1)
-});
-var RcSetPermissionModeInputSchema = external_exports.strictObject({
-  session: external_exports.string().min(1),
-  mode: RcPermissionModeSchema
-});
-var RcEndSessionInputSchema = external_exports.strictObject({
-  session: external_exports.string().min(1),
-  reason: external_exports.string().min(1).optional()
-});
-var RcGetUsageInputSchema = external_exports.strictObject({
-  session: external_exports.string().min(1),
-  skipBehaviors: external_exports.boolean().optional()
-});
-var RcGetContextUsageInputSchema = external_exports.strictObject({
-  session: external_exports.string().min(1),
-  detail: external_exports.enum(RC_CONTEXT_USAGE_DETAILS).optional()
-});
-var RcReadFileInputSchema = external_exports.strictObject({
-  session: external_exports.string().min(1),
-  path: external_exports.string().min(1),
-  maxBytes: external_exports.number().int().positive().optional(),
-  encoding: external_exports.enum(RC_READ_FILE_ENCODINGS).optional()
-});
-var RcFileSuggestionsInputSchema = external_exports.strictObject({
-  session: external_exports.string().min(1),
-  query: external_exports.string()
-});
-var RcKeepAliveInputSchema = external_exports.strictObject({
-  session: external_exports.string().min(1)
-});
-var RcMcpStatusInputSchema = external_exports.strictObject({
-  session: external_exports.string().min(1)
-});
-var RcMcpReconnectInputSchema = external_exports.strictObject({
-  session: external_exports.string().min(1),
-  serverName: external_exports.string().min(1)
-});
-var RcMcpAuthenticateInputSchema = external_exports.strictObject({
-  session: external_exports.string().min(1),
-  serverName: external_exports.string().min(1),
-  redirectUri: external_exports.string().min(1)
-});
-var RcMcpOAuthCallbackUrlInputSchema = external_exports.strictObject({
-  session: external_exports.string().min(1),
-  serverName: external_exports.string().min(1),
-  callbackUrl: external_exports.string().min(1)
-});
-var RcListOutputSchema = external_exports.strictObject({ sessions: external_exports.readonly(external_exports.array(RcSessionSummarySchema)) });
-var RcStatusOutputSchema = external_exports.strictObject({ statuses: external_exports.readonly(external_exports.array(RcSessionStatusSchema)) });
-var RcPendingOutputSchema = external_exports.strictObject({ pending: external_exports.readonly(external_exports.array(RcPendingRequestSummarySchema)) });
-var RcWriteOutputSchema = external_exports.strictObject({
-  session: external_exports.string(),
-  sequenceNums: external_exports.readonly(external_exports.array(external_exports.number()))
-});
-var RcControlWriteOutputSchema = external_exports.strictObject({
-  session: external_exports.string(),
-  request: external_exports.string(),
-  sequenceNums: external_exports.readonly(external_exports.array(external_exports.number()))
-});
-var RcAnswerOutputSchema = external_exports.strictObject({
-  session: external_exports.string(),
-  request: external_exports.string(),
-  sequenceNums: external_exports.readonly(external_exports.array(external_exports.number()))
-});
-
-// src/frontdoor/rcApi.ts
 var RC_ORPC_PATH_PREFIX = "/__agent-shim/orpc";
 var RC_SUBSCRIBER_BUFFER_EVENTS = 100;
 function doorApiAuth(expectedToken) {
@@ -72158,6 +72223,7 @@ function createRcApiRouter(deps) {
       mcpReconnect: authed.input(RcMcpReconnectInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input: input2 }) => ({ session: input2.session, ...deliveredControl(input2.session, await deps.mcpReconnect(input2.session, input2.serverName)) })),
       mcpAuthenticate: authed.input(RcMcpAuthenticateInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input: input2 }) => ({ session: input2.session, ...deliveredControl(input2.session, await deps.mcpAuthenticate(input2.session, input2.serverName, input2.redirectUri)) })),
       mcpOAuthCallbackUrl: authed.input(RcMcpOAuthCallbackUrlInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input: input2 }) => ({ session: input2.session, ...deliveredControl(input2.session, await deps.mcpOAuthCallbackUrl(input2.session, input2.serverName, input2.callbackUrl)) })),
+      teleport: authed.input(RcTeleportInputSchema).output(RcWriteOutputSchema).handler(async ({ input: input2 }) => ({ session: input2.session, sequenceNums: delivered(input2.session, await deps.teleport(input2.session, input2.marker)) })),
       subscribe: authed.input(RcSessionQuerySchema).output(eventIterator(RcStreamEventSchema)).handler(async function* ({ input: input2, signal }) {
         const queue = [];
         let wake;
@@ -72303,6 +72369,16 @@ function createControlApiRouter(deps) {
           ...unified?.fiveHour === void 0 ? {} : { fiveHour: effectiveWindow(unified.fiveHour, now) },
           ...unified?.sevenDay === void 0 ? {} : { sevenDay: effectiveWindow(unified.sevenDay, now) }
         };
+      }),
+      live: authed.input(RcSessionQuerySchema).output(UsageLiveOutputSchema).handler(({ input: input2 }) => {
+        const sessions = deps.liveRateLimits(input2.session);
+        if (input2.session !== void 0 && sessions.length === 0) {
+          if (deps.list().some((session) => session.id === input2.session)) {
+            throw new ORPCError("NOT_FOUND", { message: `session ${input2.session} has filed no rate_limit_event on its stream yet: the worker emits one only once a turn has completed, so retry after this session's next turn` });
+          }
+          throw new ORPCError("NOT_FOUND", { message: rcSessionNotObservedMessage(input2.session) });
+        }
+        return { latest: deps.latestRateLimit(), sessions };
       })
     },
     frontdoor: {
@@ -73735,9 +73811,232 @@ function attachingProviderCredential(route, deps) {
 // src/frontdoor/rcCommands.ts
 var import_node_crypto14 = require("node:crypto");
 
+// src/frontdoor/rcLiveUsage.ts
+var RC_RATE_LIMIT_EVENT_TYPE = "rate_limit_event";
+function isRecord4(value2) {
+  return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+}
+function rcRateLimitInfoOf(event) {
+  const payload = event.envelope.payload;
+  if (!isRecord4(payload) || payload.type !== RC_RATE_LIMIT_EVENT_TYPE) {
+    return void 0;
+  }
+  if (!isRecord4(payload.rate_limit_info)) {
+    return void 0;
+  }
+  const parsed = RcRateLimitInfoSchema.safeParse(payload.rate_limit_info);
+  return parsed.success ? parsed.data : void 0;
+}
+function createRcLiveUsage(deps) {
+  const observed = /* @__PURE__ */ new Map();
+  deps.hub.subscribe([DOOR_EVENT_SOURCE_RC], (event) => {
+    const stream = RcStreamEventSchema.safeParse(event.payload);
+    if (!stream.success) {
+      return;
+    }
+    const rateLimit = rcRateLimitInfoOf(stream.data);
+    if (rateLimit === void 0) {
+      return;
+    }
+    observed.set(stream.data.session, { session: stream.data.session, observedAt: deps.now(), rateLimit });
+  });
+  const sorted = () => [...observed.values()].sort((left, right) => left.observedAt - right.observedAt || (left.session < right.session ? -1 : 1));
+  return {
+    liveOf: (sessionId) => sorted().filter((entry) => sessionId === void 0 || entry.session === sessionId),
+    latestOf: () => sorted().at(-1)
+  };
+}
+
 // src/frontdoor/rcSelfHostMint.ts
 var import_node_path34 = __toESM(require("node:path"), 1);
 
+// src/frontdoor/rcSelfHostEndpoints.ts
+var RC_SOURCE_WORKER = "worker";
+var RC_SOURCE_CLIENT = "client";
+function isRecord5(value2) {
+  return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+}
+function parseJsonObject2(body) {
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return void 0;
+  }
+  return isRecord5(parsed) ? parsed : void 0;
+}
+function nonEmptyString2(record2, field) {
+  const value2 = record2 === void 0 ? void 0 : record2[field];
+  return typeof value2 === "string" && value2 !== "" ? value2 : void 0;
+}
+function numberOf(record2, field) {
+  const value2 = record2 === void 0 ? void 0 : record2[field];
+  if (typeof value2 === "number" && Number.isFinite(value2)) {
+    return value2;
+  }
+  if (typeof value2 === "string" && /^[0-9]+$/.test(value2)) {
+    return Number(value2);
+  }
+  return void 0;
+}
+function pageOfRcChannel(url2, rows, idOf, rowOf) {
+  const query = new URL(url2, "http://127.0.0.1").searchParams;
+  const anchor2 = query.get("after_event_id") ?? query.get("cursor");
+  const rawLimit = query.get("limit");
+  const limit = rawLimit === null ? void 0 : numberOf({ value: rawLimit }, "value");
+  if (limit !== void 0 && limit < 1) {
+    return { error: "the limit names a whole number of rows of at least one" };
+  }
+  const from = anchor2 === null ? 0 : rows.findIndex((row) => idOf(row) === anchor2) + 1;
+  if (anchor2 !== null && from === 0) {
+    return { error: `the anchor names an event id this surface holds no row for: ${anchor2}` };
+  }
+  const page = limit === void 0 ? rows.slice(from) : rows.slice(from, from + limit);
+  const last = page[page.length - 1];
+  return { data: page.map(rowOf), ...last === void 0 ? {} : { next_cursor: idOf(last) } };
+}
+async function serveRcClientChannels(ctx, tail, method, maxBatchEvents) {
+  const { request: request7, response, session } = ctx;
+  if (tail === "client/presence" && method === "POST") {
+    const body = parseJsonObject2(await ctx.readBody(request7.body, CONTROL_BODY_CAP_BYTES));
+    const clientId = nonEmptyString2(body, "client_id");
+    const clear = body?.clear;
+    if (clientId === void 0 || clear !== void 0 && typeof clear !== "boolean") {
+      await ctx.answerJson(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "a presence announcement is JSON naming a non-empty client_id, with clear only as a boolean or absent" } });
+      return true;
+    }
+    if (clear === true) {
+      session.clients.delete(clientId);
+      ctx.log?.(`rc selfhost ${session.id}: client ${clientId} cleared its presence`);
+    } else {
+      session.clients.set(clientId, ctx.now());
+      ctx.log?.(`rc selfhost ${session.id}: client ${clientId} announced its presence${session.clients.size === 1 ? "" : ` (${String(session.clients.size)} clients now announced)`}`);
+    }
+    await ctx.answerJson(response, HTTP_STATUS.ok, { refresh_after_seconds: ctx.presenceRefreshSeconds });
+    return true;
+  }
+  if (tail === "mark_read" && method === "POST") {
+    const body = parseJsonObject2(await ctx.readBody(request7.body, CONTROL_BODY_CAP_BYTES));
+    const eventId = nonEmptyString2(body, "event_id");
+    const clientId = nonEmptyString2(body, "client_id");
+    if (body !== void 0 && "event_id" in body && eventId === void 0 || "client_id" in (body ?? {}) && clientId === void 0) {
+      await ctx.answerJson(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "a read receipt is JSON naming the event_id it read or none for the whole session, and client_id only as a non-empty string or absent" } });
+      return true;
+    }
+    const receipt = ctx.publish(session, clientId ?? RC_SOURCE_CLIENT, { type: "mark_read", ...eventId === void 0 ? {} : { event_id: eventId }, ...clientId === void 0 ? {} : { client_id: clientId } }, true);
+    ctx.log?.(`rc selfhost ${session.id}: ${clientId === void 0 ? "an unnamed client" : `client ${clientId}`} marked ${eventId === void 0 ? "the session read" : `event ${eventId} read`} as sequence ${String(receipt.sequenceNum)}`);
+    await ctx.answerJson(response, HTTP_STATUS.ok, {});
+    return true;
+  }
+  if (tail === "teleport-events" && method === "POST") {
+    const body = parseJsonObject2(await ctx.readBody(request7.body, CONTROL_BODY_CAP_BYTES));
+    const events = body?.events;
+    if (!Array.isArray(events) || events.length === 0 || events.length > maxBatchEvents) {
+      await ctx.answerJson(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: `a teleport write is a non-empty array of at most ${String(maxBatchEvents)} events` } });
+      return true;
+    }
+    const results = [];
+    for (const event of events) {
+      if (!isRecord5(event) || !isRecord5(event.payload)) {
+        await ctx.answerJson(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "every event in a teleport write is an object carrying one payload object" } });
+        return true;
+      }
+      const published = ctx.publish(session, RC_SOURCE_CLIENT, event.payload);
+      results.push({ sequence_num: String(published.sequenceNum), duplicate: published.duplicate });
+    }
+    ctx.sweep();
+    ctx.log?.(`rc selfhost ${session.id}: teleport write published ${String(results.length)} marker event(s)`);
+    await ctx.answerJson(response, HTTP_STATUS.ok, { results });
+    return true;
+  }
+  if (tail === "teleport-events" && method === "GET") {
+    const page = pageOfRcChannel(request7.url, session.events, (event) => event.eventId, (event) => ({ event_id: event.eventId, payload: event.payload }));
+    if ("error" in page) {
+      await ctx.answerJson(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: page.error } });
+      return true;
+    }
+    await ctx.answerJson(response, HTTP_STATUS.ok, page);
+    return true;
+  }
+  return false;
+}
+var compatSessionRow = (session, now) => ({ id: session.id, title: session.title, created_at: new Date(session.createdAt).toISOString(), updated_at: new Date(now()).toISOString(), session_status: "active" });
+async function serveRcCompatSessions(ctx, pathname, compatPath) {
+  const { request: request7, response } = ctx;
+  const method = request7.method.toUpperCase();
+  if (pathname === compatPath) {
+    if (method !== "GET") {
+      await ctx.answerJson(response, HTTP_STATUS.methodNotAllowed, { type: "error", error: { type: "api_error", message: "the compatibility session list is a GET" } });
+      return;
+    }
+    const listRefusal = ctx.credentialRefusal(request7.headers);
+    if (listRefusal !== void 0) {
+      await ctx.unauthorized(response, listRefusal);
+      return;
+    }
+    await ctx.answerJson(response, HTTP_STATUS.ok, { data: [...ctx.sessions.values()].map((session2) => compatSessionRow(session2, ctx.now)) });
+    return;
+  }
+  const rest = pathname.slice(`${compatPath}/`.length);
+  const slash = rest.indexOf("/");
+  const address = slash === -1 ? rest : rest.slice(0, slash);
+  const compatTail = slash === -1 ? "" : rest.slice(slash + 1);
+  const refusal = ctx.credentialRefusal(request7.headers);
+  if (refusal !== void 0) {
+    await ctx.unauthorized(response, refusal);
+    return;
+  }
+  const session = ctx.sessions.get(address) ?? ctx.sessions.get(`cse_${address}`);
+  if (compatTail === "") {
+    if (method === "GET") {
+      if (session === void 0) {
+        await ctx.answerJson(response, HTTP_STATUS.notFound, { type: "error", error: { type: "api_error", message: `Session not found: ${address}` } });
+        return;
+      }
+      await ctx.answerJson(response, HTTP_STATUS.ok, compatSessionRow(session, ctx.now));
+      return;
+    }
+    if (method === "PATCH" || method === "PUT") {
+      if (session === void 0) {
+        await ctx.answerJson(response, HTTP_STATUS.notFound, { type: "error", error: { type: "api_error", message: `Session not found: ${address}` } });
+        return;
+      }
+      const body = parseJsonObject2(await ctx.readBody(request7.body, CONTROL_BODY_CAP_BYTES));
+      const title = nonEmptyString2(body, "title");
+      if (title === void 0) {
+        await ctx.answerJson(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "a compatibility session update is JSON naming a non-empty title" } });
+        return;
+      }
+      session.title = title;
+      session.lastTrafficAt = ctx.now();
+      ctx.log?.(`rc selfhost ${session.id}: retitled through the compatibility family`);
+      await ctx.answerJson(response, HTTP_STATUS.ok, compatSessionRow(session, ctx.now));
+      return;
+    }
+    await ctx.answerJson(response, HTTP_STATUS.methodNotAllowed, { type: "error", error: { type: "api_error", message: "the compatibility session read is a GET and its update a PATCH or PUT" } });
+    return;
+  }
+  if ((compatTail === "archive" || compatTail === "unarchive") && method === "POST") {
+    await ctx.readBody(request7.body, CONTROL_BODY_CAP_BYTES);
+    if (session === void 0) {
+      await ctx.answerJson(response, HTTP_STATUS.notFound, { type: "error", error: { type: "api_error", message: `Session not found: ${address}` } });
+      return;
+    }
+    if (compatTail === "unarchive") {
+      await ctx.answerJson(response, HTTP_STATUS.ok, compatSessionRow(session, ctx.now));
+      return;
+    }
+    for (const sink of [...session.workerStreams, ...session.clientStreams]) {
+      sink.retire();
+    }
+    ctx.sessions.delete(session.id);
+    ctx.log?.(`rc selfhost ${session.id}: archived through the compatibility family`);
+    await ctx.answerJson(response, HTTP_STATUS.ok, {});
+    return;
+  }
+  await ctx.answerJson(response, HTTP_STATUS.notFound, { type: "error", error: { type: "api_error", message: `the compatibility session family serves no path "${compatTail}"` } });
+}
+
 // src/frontdoor/rcWebFetch.ts
 var dns2 = __toESM(require("node:dns"), 1);
 var http6 = __toESM(require("node:http"), 1);
@@ -74006,21 +74305,19 @@ var RC_PRESENCE_REFRESH_SECONDS = 60;
 var RC_SELF_HOST_MAX_BATCH_EVENTS = 100;
 var RC_SELF_HOST_WORKER_EPOCH = 1;
 var RC_STREAM_EVENT_NAME = "client_event";
-var RC_SOURCE_WORKER = "worker";
-var RC_SOURCE_CLIENT = "client";
 var CONFLICT_REASON_HEADER2 = "x-ccr-conflict-reason";
 var CONFLICT_REASON_EPOCH_STALE = "epoch_stale";
-function isRecord4(value2) {
+function isRecord6(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 }
 function isWebSearchRefusal(value2) {
   return !Array.isArray(value2);
 }
-function nonEmptyString2(record2, field) {
+function nonEmptyString3(record2, field) {
   const value2 = record2 === void 0 ? void 0 : record2[field];
   return typeof value2 === "string" && value2 !== "" ? value2 : void 0;
 }
-function numberOf(record2, field) {
+function numberOf2(record2, field) {
   const value2 = record2 === void 0 ? void 0 : record2[field];
   if (typeof value2 === "number" && Number.isFinite(value2)) {
     return value2;
@@ -74087,14 +74384,14 @@ async function readBody3(request7, capBytes) {
     });
   });
 }
-function parseJsonObject2(body) {
+function parseJsonObject3(body) {
   let parsed;
   try {
     parsed = JSON.parse(body);
   } catch {
     return void 0;
   }
-  return isRecord4(parsed) ? parsed : void 0;
+  return isRecord6(parsed) ? parsed : void 0;
 }
 function mintWorkerJwt(randomToken, issuedAt) {
   const encode3 = (value2) => Buffer.from(JSON.stringify(value2), "utf8").toString("base64url");
@@ -74117,11 +74414,16 @@ function createRcSelfHostSurface(deps) {
     for (const session of sessions.values()) {
       while (session.events[0] !== void 0 && now - session.events[0].storedAt > RC_SELF_HOST_RETENTION_MS) {
         const dropped = session.events.shift();
-        const uuid3 = dropped === void 0 ? void 0 : nonEmptyString2(dropped.payload, "uuid");
+        const uuid3 = dropped === void 0 ? void 0 : nonEmptyString3(dropped.payload, "uuid");
         if (uuid3 !== void 0) {
           session.seenPayloadUuids.delete(uuid3);
         }
       }
+      for (const [clientId, lastSeenAt] of session.clients) {
+        if (now - lastSeenAt > RC_SELF_HOST_RETENTION_MS) {
+          session.clients.delete(clientId);
+        }
+      }
       if (session.workerStreams.size === 0 && session.clientStreams.size === 0 && now - session.lastTrafficAt > RC_SELF_HOST_RETENTION_MS) {
         sessions.delete(session.id);
       }
@@ -74160,7 +74462,7 @@ function createRcSelfHostSurface(deps) {
   const frameOf = (event) => {
     const envelope = {
       event_id: event.eventId,
-      event_type: nonEmptyString2(event.payload, "type") ?? "event",
+      event_type: nonEmptyString3(event.payload, "type") ?? "event",
       sequence_num: event.sequenceNum,
       source: event.source,
       payload: event.payload,
@@ -74174,7 +74476,7 @@ data: ${JSON.stringify(envelope)}
   };
   const holdStream = async (session, which, wantsReplay, request7, response) => {
     const url2 = new URL(request7.url, "http://127.0.0.1");
-    const cursor3 = numberOf({ value: url2.searchParams.get("from_sequence_num") }, "value") ?? numberOf({ value: singleHeader2(request7.headers, "last-event-id") }, "value");
+    const cursor3 = numberOf2({ value: url2.searchParams.get("from_sequence_num") }, "value") ?? numberOf2({ value: singleHeader2(request7.headers, "last-event-id") }, "value");
     const replay = cursor3 === void 0 ? [] : session.events.filter((event) => wantsReplay(event) && event.sequenceNum > cursor3);
     response.start(HTTP_STATUS.ok, { "content-type": "text/event-stream", "cache-control": "no-cache" });
     response.flush();
@@ -74203,8 +74505,8 @@ data: ${JSON.stringify(envelope)}
     sink.retire();
     response.end();
   };
-  const publish = (session, source, payload) => {
-    const uuid3 = nonEmptyString2(payload, "uuid");
+  const publish = (session, source, payload, toWorker = source === RC_SOURCE_CLIENT) => {
+    const uuid3 = nonEmptyString3(payload, "uuid");
     const duplicate = uuid3 !== void 0 && session.seenPayloadUuids.has(uuid3);
     session.sequenceNum += 1;
     const event = {
@@ -74212,9 +74514,9 @@ data: ${JSON.stringify(envelope)}
       eventId: uuid3 ?? deps.newUuid(),
       source,
       // The one enrichment the real service was observed making on the live rig's stream: the wall-clock instant it took the write. The worker's handler ignores it; the door's own parser forwards it verbatim.
-      payload: source === RC_SOURCE_CLIENT ? { ...payload, server_received_wall_ms: deps.now() } : payload,
+      payload: source === RC_SOURCE_WORKER ? payload : { ...payload, server_received_wall_ms: deps.now() },
       createdAt: new Date(deps.now()).toISOString(),
-      toWorker: source === RC_SOURCE_CLIENT,
+      toWorker,
       storedAt: deps.now()
     };
     session.events.push(event);
@@ -74262,8 +74564,26 @@ data: ${JSON.stringify(envelope)}
     }
     session.lastTrafficAt = deps.now();
     if (tail === "") {
+      if (method === "PATCH" || method === "PUT") {
+        const refusal = credentialRefusal(request7.headers);
+        if (refusal !== void 0) {
+          await unauthorized(response, refusal);
+          return;
+        }
+        const body = parseJsonObject3(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
+        const title = nonEmptyString3(body, "title");
+        if (title === void 0) {
+          await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "a session update is JSON naming a non-empty title" } });
+          return;
+        }
+        session.title = title;
+        session.lastTrafficAt = deps.now();
+        deps.log?.(`rc selfhost ${session.id}: retitled at its client's request`);
+        await answerJson2(response, HTTP_STATUS.ok, {});
+        return;
+      }
       if (method !== "GET") {
-        await answerJson2(response, HTTP_STATUS.methodNotAllowed, { type: "error", error: { type: "api_error", message: "the session read is a GET" } });
+        await answerJson2(response, HTTP_STATUS.methodNotAllowed, { type: "error", error: { type: "api_error", message: "the session read is a GET, and its update a PATCH or PUT" } });
         return;
       }
       await answerJson2(response, HTTP_STATUS.ok, { session: { id: session.id, title: session.title, created_at: new Date(session.createdAt).toISOString(), status: "active" } });
@@ -74308,17 +74628,17 @@ data: ${JSON.stringify(envelope)}
         return;
       }
       if (workerTail === "" && method === "PUT") {
-        const body = parseJsonObject2(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
-        const claimedEpoch = numberOf(body, "worker_epoch");
+        const body = parseJsonObject3(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
+        const claimedEpoch = numberOf2(body, "worker_epoch");
         if (claimedEpoch !== void 0 && claimedEpoch !== RC_SELF_HOST_WORKER_EPOCH) {
           await epochStale(response);
           return;
         }
-        const status = nonEmptyString2(body, "worker_status");
+        const status = nonEmptyString3(body, "worker_status");
         if (status !== void 0) {
           session.workerStatus = status;
         }
-        if (isRecord4(body?.external_metadata)) {
+        if (isRecord6(body?.external_metadata)) {
           session.externalMetadata = body.external_metadata;
         }
         await answerJson2(response, HTTP_STATUS.ok, {});
@@ -74335,8 +74655,8 @@ data: ${JSON.stringify(envelope)}
         return;
       }
       if (workerTail === "events" && method === "POST") {
-        const body = parseJsonObject2(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
-        const claimedEpoch = numberOf(body, "worker_epoch");
+        const body = parseJsonObject3(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
+        const claimedEpoch = numberOf2(body, "worker_epoch");
         if (claimedEpoch !== void 0 && claimedEpoch !== RC_SELF_HOST_WORKER_EPOCH) {
           await epochStale(response);
           return;
@@ -74348,7 +74668,7 @@ data: ${JSON.stringify(envelope)}
         }
         const results = [];
         for (const event of events) {
-          if (!isRecord4(event) || !isRecord4(event.payload)) {
+          if (!isRecord6(event) || !isRecord6(event.payload)) {
             await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "every event in a batch is an object carrying one payload object" } });
             return;
           }
@@ -74369,8 +74689,8 @@ data: ${JSON.stringify(envelope)}
         return;
       }
       if (workerTail === "internal-events" && method === "POST") {
-        const body = parseJsonObject2(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
-        const claimedEpoch = numberOf(body, "worker_epoch");
+        const body = parseJsonObject3(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
+        const claimedEpoch = numberOf2(body, "worker_epoch");
         if (claimedEpoch !== void 0 && claimedEpoch !== RC_SELF_HOST_WORKER_EPOCH) {
           await epochStale(response);
           return;
@@ -74381,19 +74701,26 @@ data: ${JSON.stringify(envelope)}
           return;
         }
         for (const event of events) {
-          if (isRecord4(event)) {
-            session.internalEvents.push({ cursor: deps.newUuid(), body: event });
+          if (isRecord6(event)) {
+            session.internalEvents.push({ eventId: deps.newUuid(), body: event });
           }
         }
         await answerJson2(response, HTTP_STATUS.ok, {});
         return;
       }
       if (workerTail === "internal-events" && method === "GET") {
-        const url2 = new URL(request7.url, "http://127.0.0.1");
-        const cursor3 = url2.searchParams.get("cursor");
-        const from = cursor3 === null ? 0 : session.internalEvents.findIndex((event) => event.cursor === cursor3) + 1;
-        const page = session.internalEvents.slice(from);
-        await answerJson2(response, HTTP_STATUS.ok, { data: page.map((event) => event.body), next_cursor: page.length === 0 ? void 0 : page[page.length - 1]?.cursor });
+        const query = new URL(request7.url, "http://127.0.0.1").searchParams;
+        if (query.get("session_agent_id") !== null || query.get("subagents") !== null) {
+          await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "this surface keeps one internal-events channel per session, so an agent-scoped read has no subset to serve" } });
+          return;
+        }
+        const page = pageOfRcChannel(request7.url, session.internalEvents, (event) => event.eventId, (event) => ({ event_id: event.eventId, payload: event.body }));
+        if ("error" in page) {
+          const anchorUnknown = query.get("after_event_id") !== null && page.error.startsWith("the anchor names an event id");
+          await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: anchorUnknown ? "after_event_id_not_found" : "invalid_request_error", message: page.error } });
+          return;
+        }
+        await answerJson2(response, HTTP_STATUS.ok, page);
         return;
       }
       if (workerTail === "diagnostics" && method === "POST") {
@@ -74402,8 +74729,8 @@ data: ${JSON.stringify(envelope)}
         return;
       }
       if (workerTail === "web-fetch" && method === "POST") {
-        const body = parseJsonObject2(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
-        const target = nonEmptyString2(body, "url");
+        const body = parseJsonObject3(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
+        const target = nonEmptyString3(body, "url");
         if (target === void 0) {
           await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "a worker web-fetch carries one url" } });
           return;
@@ -74425,8 +74752,8 @@ data: ${JSON.stringify(envelope)}
         return;
       }
       if (workerTail === "web-search" && method === "POST") {
-        const body = parseJsonObject2(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
-        const query = nonEmptyString2(body, "query");
+        const body = parseJsonObject3(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
+        const query = nonEmptyString3(body, "query");
         if (query === void 0) {
           await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "a worker web-search carries one query" } });
           return;
@@ -74437,7 +74764,7 @@ data: ${JSON.stringify(envelope)}
           await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "the domain filters of a worker web-search are string arrays" } });
           return;
         }
-        const searchProfile = nonEmptyString2(body, "search_profile");
+        const searchProfile = nonEmptyString3(body, "search_profile");
         const backend = deps.webSearch;
         if (backend === void 0) {
           deps.log?.(`rc selfhost ${session.id}: worker web-search of "${query}" refused: no search backend serves this door`);
@@ -74462,7 +74789,7 @@ data: ${JSON.stringify(envelope)}
       return;
     }
     if (tail === "events" && method === "POST") {
-      const body = parseJsonObject2(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
+      const body = parseJsonObject3(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
       const events = body?.events;
       if (!Array.isArray(events) || events.length === 0 || events.length > RC_SELF_HOST_MAX_BATCH_EVENTS) {
         await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: `a client event write is a non-empty array of at most ${String(RC_SELF_HOST_MAX_BATCH_EVENTS)} events` } });
@@ -74470,7 +74797,7 @@ data: ${JSON.stringify(envelope)}
       }
       const results = [];
       for (const event of events) {
-        if (!isRecord4(event) || !isRecord4(event.payload)) {
+        if (!isRecord6(event) || !isRecord6(event.payload)) {
           await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "every event in a write is an object carrying one payload object" } });
           return;
         }
@@ -74482,26 +74809,14 @@ data: ${JSON.stringify(envelope)}
       return;
     }
     if (tail === "events" && method === "GET") {
-      await answerJson2(response, HTTP_STATUS.ok, { data: session.events.map((event) => ({ event_id: event.eventId, event_type: nonEmptyString2(event.payload, "type") ?? "event", sequence_num: event.sequenceNum, source: event.source, payload: event.payload, created_at: event.createdAt })) });
+      await answerJson2(response, HTTP_STATUS.ok, { data: session.events.map((event) => ({ event_id: event.eventId, event_type: nonEmptyString3(event.payload, "type") ?? "event", sequence_num: event.sequenceNum, source: event.source, payload: event.payload, created_at: event.createdAt })) });
       return;
     }
     if (tail === "events/stream" && method === "GET") {
       await holdStream(session, "clientStreams", () => true, request7, response);
       return;
     }
-    if (tail === "client/presence" && method === "POST") {
-      await readBody3(request7.body, CONTROL_BODY_CAP_BYTES);
-      await answerJson2(response, HTTP_STATUS.ok, { refresh_after_seconds: RC_PRESENCE_REFRESH_SECONDS });
-      return;
-    }
-    if (tail === "mark_read" && method === "POST") {
-      await readBody3(request7.body, CONTROL_BODY_CAP_BYTES);
-      await answerJson2(response, HTTP_STATUS.ok, {});
-      return;
-    }
-    if (tail === "teleport-events" && method === "POST") {
-      await readBody3(request7.body, CONTROL_BODY_CAP_BYTES);
-      await answerJson2(response, HTTP_STATUS.ok, {});
+    if (await serveRcClientChannels({ request: request7, response, session, answerJson: answerJson2, readBody: readBody3, publish, sweep, now: deps.now, presenceRefreshSeconds: RC_PRESENCE_REFRESH_SECONDS, ...deps.log === void 0 ? {} : { log: deps.log } }, tail, method, RC_SELF_HOST_MAX_BATCH_EVENTS)) {
       return;
     }
     await answerJson2(response, HTTP_STATUS.notFound, { type: "error", error: { type: "api_error", message: `the self-hosted Remote Control surface serves no path "${tail}"` } });
@@ -74518,17 +74833,8 @@ data: ${JSON.stringify(envelope)}
         await noCredential(response);
         return;
       }
-      if (pathname === RC_COMPAT_SESSIONS_PATH) {
-        if (method !== "GET") {
-          await answerJson2(response, HTTP_STATUS.methodNotAllowed, { type: "error", error: { type: "api_error", message: "the compatibility session list is a GET" } });
-          return;
-        }
-        const listRefusal = credentialRefusal(request7.headers);
-        if (listRefusal !== void 0) {
-          await unauthorized(response, listRefusal);
-          return;
-        }
-        await answerJson2(response, HTTP_STATUS.ok, { data: [] });
+      if (pathname === RC_COMPAT_SESSIONS_PATH || pathname.startsWith(`${RC_COMPAT_SESSIONS_PATH}/`)) {
+        await serveRcCompatSessions({ request: request7, response, sessions, answerJson: answerJson2, readBody: readBody3, credentialRefusal, unauthorized, now: deps.now, ...deps.log === void 0 ? {} : { log: deps.log } }, pathname, RC_COMPAT_SESSIONS_PATH);
         return;
       }
       if (pathname !== RC_SESSIONS_PATH_PREFIX2 && !pathname.startsWith(`${RC_SESSIONS_PATH_PREFIX2}/`)) {
@@ -74542,11 +74848,11 @@ data: ${JSON.stringify(envelope)}
             await unauthorized(response, createRefusal);
             return;
           }
-          const body = parseJsonObject2(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
+          const body = parseJsonObject3(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
           const session = {
             id: `${RC_SESSION_ID_PREFIX2}${deps.newUuid()}`,
             createdAt: deps.now(),
-            title: nonEmptyString2(body, "title"),
+            title: nonEmptyString3(body, "title"),
             workerJwts: /* @__PURE__ */ new Set(),
             sequenceNum: 0,
             events: [],
@@ -74554,6 +74860,7 @@ data: ${JSON.stringify(envelope)}
             workerStreams: /* @__PURE__ */ new Set(),
             clientStreams: /* @__PURE__ */ new Set(),
             internalEvents: [],
+            clients: /* @__PURE__ */ new Map(),
             workerStatus: void 0,
             externalMetadata: void 0,
             lastTrafficAt: deps.now()
@@ -74598,7 +74905,7 @@ data: ${JSON.stringify(envelope)}
       const pathname = new URL(request7.url ?? "/", "http://127.0.0.1").pathname;
       if (host === RC_SELF_HOST_OAUTH_HOST) {
         if (method === "POST" && pathname === "/v1/oauth/token") {
-          const body = parseJsonObject2(await readBody3(request7, CONTROL_BODY_CAP_BYTES));
+          const body = parseJsonObject3(await readBody3(request7, CONTROL_BODY_CAP_BYTES));
           const record2 = deps.credentialRecord();
           if (record2 === void 0) {
             answerServerJson(response, HTTP_SERVICE_UNAVAILABLE, { error: "the front door's self-hosted Remote Control surface is on but no credential has been minted for it" });
@@ -74683,7 +74990,7 @@ var RC_SELF_HOST_RECORD_DIR = "rc-selfhost";
 var RC_SELF_HOST_RECORD_FILE = "credential.json";
 var SELF_HOST_EMAIL = "selfhost@agent-shim.invalid";
 var SELF_HOST_SUBSCRIPTION_TYPE = "max";
-function isRecord5(value2) {
+function isRecord7(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 }
 function readJsonObject(fs20, file2) {
@@ -74697,7 +75004,7 @@ function readJsonObject(fs20, file2) {
   } catch {
     return void 0;
   }
-  return isRecord5(parsed) ? parsed : void 0;
+  return isRecord7(parsed) ? parsed : void 0;
 }
 function readRcSelfHostRecord(fs20, frontdoorDir) {
   const parsed = readJsonObject(fs20, import_node_path34.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
@@ -74721,7 +75028,7 @@ function mintRcSelfHostCredential(deps) {
   const recordFile = import_node_path34.default.join(recordDir, RC_SELF_HOST_RECORD_FILE);
   const previousRecord = readRcSelfHostRecord(deps.fs, deps.frontdoorDir);
   const existingCredentials = readJsonObject(deps.fs, credentialsFile);
-  const existingOauth = isRecord5(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
+  const existingOauth = isRecord7(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
   const existingToken = typeof existingOauth?.accessToken === "string" && existingOauth.accessToken !== "" ? existingOauth.accessToken : void 0;
   const existingIsOwn = existingToken !== void 0 && previousRecord?.accessToken === existingToken;
   if (existingToken !== void 0 && !existingIsOwn && !deps.force) {
@@ -74738,7 +75045,7 @@ function mintRcSelfHostCredential(deps) {
   deps.fs.writeFilePrivate(credentialsFile, `${JSON.stringify({ ...existingCredentials, claudeAiOauth: { accessToken, refreshToken, expiresAt: null, scopes: [...RC_SELF_HOST_SCOPE_LIST], subscriptionType: SELF_HOST_SUBSCRIPTION_TYPE, rateLimitTier: null } }, null, 2)}
 `);
   const claudeJson = readJsonObject(deps.fs, claudeJsonFile) ?? {};
-  const existingBlock = (value2) => isRecord5(value2) ? value2 : {};
+  const existingBlock = (value2) => isRecord7(value2) ? value2 : {};
   deps.fs.writeFilePrivate(claudeJsonFile, `${JSON.stringify({
     ...claudeJson,
     oauthAccount: {
@@ -74816,9 +75123,54 @@ function formatRcPendingList(pending) {
 function eventExcerpt(text2) {
   return text2.length <= RC_PENDING_SUMMARY_EXCERPT_CHARS ? text2 : `${text2.slice(0, RC_PENDING_SUMMARY_EXCERPT_CHARS)}...`;
 }
+var PERCENT_SCALE = 100;
+var MS_PER_SECOND8 = 1e3;
+function percentOf(fraction) {
+  return `${String(Math.round(fraction * PERCENT_SCALE))}%`;
+}
+function resetInstantOf(epochSeconds) {
+  return new Date(epochSeconds * MS_PER_SECOND8).toISOString();
+}
+function formatRcRateLimitInfo(info) {
+  const parts = [info.status];
+  if (info.rateLimitType !== void 0) {
+    parts.push(info.rateLimitType);
+  }
+  if (info.utilization !== void 0) {
+    parts.push(percentOf(info.utilization));
+  }
+  if (info.resetsAt !== void 0) {
+    parts.push(`resets ${resetInstantOf(info.resetsAt)}`);
+  }
+  const windows = [];
+  for (const name of ["five_hour", "seven_day", "seven_day_overage_included"]) {
+    const window = info.unifiedWindows?.[name];
+    if (window === void 0) {
+      continue;
+    }
+    const bits = [];
+    if (window.utilization !== void 0) {
+      bits.push(percentOf(window.utilization));
+    }
+    if (window.resetsAt !== void 0) {
+      bits.push(`resets ${resetInstantOf(window.resetsAt)}`);
+    }
+    windows.push(bits.length === 0 ? name : `${name} ${bits.join(" ")}`);
+  }
+  if (windows.length > 0) {
+    parts.push(`windows ${windows.join(", ")}`);
+  }
+  if (info.isUsingOverage === true) {
+    parts.push("overage in use");
+  } else if (info.overageStatus !== void 0) {
+    parts.push(`overage ${info.overageStatus}`);
+  }
+  return parts.join(" ");
+}
 function formatRcStreamEvent(event) {
   const { envelope } = event;
-  const sketch = envelope.payload === void 0 ? "" : `  ${eventExcerpt(JSON.stringify(envelope.payload))}`;
+  const rateLimit = rcRateLimitInfoOf(event);
+  const sketch = rateLimit !== void 0 ? `  ${formatRcRateLimitInfo(rateLimit)}` : envelope.payload === void 0 ? "" : `  ${eventExcerpt(JSON.stringify(envelope.payload))}`;
   return `${event.session}  ${envelope.event_type}  sequence_num ${String(envelope.sequence_num)}  source ${envelope.source}${sketch}`;
 }
 function formatRcSelfHostMint(result) {
@@ -75038,7 +75390,13 @@ function registerRcCommand(frontdoor, paths) {
     ["agent-shim frontdoor rc mcp-oauth-callback-url --session cse_00000000-0000-4000-8000-000000000000 --server github --callback-url https://example.com/oauth/callback?code=x"]
   );
   withExamples(
-    rc.command("watch").description("Print the observed sessions' client read stream events as they arrive, the approvals the door's held stream receives above all, until Ctrl-C leaves. Read-only.").argument("[session]", "One cse_ session id, as `frontdoor rc list` shows it; every observed session when omitted.").option("--json", "Print each event as one JSON line as it arrives.").action(async (session, options) => {
+    rc.command("teleport").description("Send one teleport marker into an observed session over the teleport-events channel, the write half the cloud UI's ultrapan path owns on the real service. The marker rides the SDK user-message shape, the line the teleport relay anchors on.").requiredOption("--session <id>", "The cse_ session id, as `frontdoor rc list` shows it.").requiredOption("--marker <text>", "The marker text, the string content the teleport relay anchors on.").option("--json", "Print the delivery result as JSON.").action(async (options) => {
+      reportControlWrite(`teleported a marker into the session`, options.session, await frontDoorRcControlFromState(realFarmFs, paths).teleport(options.session, options.marker), options.json, { marker: options.marker });
+    }),
+    ['agent-shim frontdoor rc teleport --session cse_00000000-0000-4000-8000-000000000000 --marker "__ULTRAPAN_TELEPORT_LOCAL__"']
+  );
+  withExamples(
+    rc.command("watch").description("Print the observed sessions' client read stream events as they arrive, the approvals the door's held stream receives above all, with each rate_limit_event rendered as the account's quota state. Read-only, until Ctrl-C leaves.").argument("[session]", "One cse_ session id, as `frontdoor rc list` shows it; every observed session when omitted.").option("--json", "Print each event as one JSON line as it arrives.").action(async (session, options) => {
       const client = frontDoorRcApiFromState(realFarmFs, paths);
       const leave = new AbortController();
       const onInterrupt = () => {
@@ -75096,11 +75454,11 @@ var import_node_path35 = __toESM(require("node:path"), 1);
 function isSafeSessionId(sessionId) {
   return /^[A-Za-z0-9_-]+$/.test(sessionId);
 }
-function isRecord6(value2) {
+function isRecord8(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 }
 function credentialOfJson(parsed) {
-  if (!isRecord6(parsed)) {
+  if (!isRecord8(parsed)) {
     return void 0;
   }
   const { authorization, anthropicVersion, anthropicClientPlatform } = parsed;
@@ -75130,7 +75488,7 @@ function createRcCredentialStore(fs20, dir) {
     } catch {
       return void 0;
     }
-    return isRecord6(parsed) ? parsed : void 0;
+    return isRecord8(parsed) ? parsed : void 0;
   };
   return {
     read: (sessionId) => {
@@ -75244,12 +75602,61 @@ function sketch(value, cap) {
   return text.length > cap ? text.slice(0, cap) + '...' : text;
 }
 
-// The headline text of one Remote Control stream event: the assistant and user payloads that carry a content array of text blocks render as their prose, everything else as its type plus a sketch.
+// One utilization fraction as a whole percentage, the same rounding the CLI's own watch line applies.
+function percentOf(fraction) { return String(Math.round(fraction * 100)) + '%'; }
+
+// The reset instant a rate-limit payload states (unix epoch seconds) as an ISO instant; no countdown is derived from it, because a ticking derivation would claim a freshness the event stream never promised.
+function resetInstantOf(epochSeconds) { return new Date(epochSeconds * 1000).toISOString(); }
+
+// Whether one rate-limit payload is readable, narrowed the same way the door's live usage state narrows it: the event type and a rate_limit_info object.
+function rateLimitInfoOf(payload) {
+  if (payload === undefined || payload === null || typeof payload !== 'object' || payload.type !== 'rate_limit_event') { return undefined; }
+  var info = payload.rate_limit_info;
+  if (info === undefined || info === null || typeof info !== 'object' || typeof info.status !== 'string') { return undefined; }
+  return info;
+}
+
+// One rate-limit payload's facts as the quota summary the feed and the header render: the limiting window's status and utilisation, each subscription window, and the overage state, every value the payload's own words.
+function quotaSummary(info) {
+  var parts = [info.status];
+  if (info.rateLimitType !== undefined) { parts.push(info.rateLimitType); }
+  if (typeof info.utilization === 'number') { parts.push(percentOf(info.utilization)); }
+  if (typeof info.resetsAt === 'number') { parts.push('resets ' + resetInstantOf(info.resetsAt)); }
+  if (info.unifiedWindows !== undefined && info.unifiedWindows !== null && typeof info.unifiedWindows === 'object') {
+    var names = ['five_hour', 'seven_day', 'seven_day_overage_included'];
+    var windows = [];
+    for (var i = 0; i < names.length; i++) {
+      var window = info.unifiedWindows[names[i]];
+      if (window === undefined || window === null) { continue; }
+      var bits = [];
+      if (typeof window.utilization === 'number') { bits.push(percentOf(window.utilization)); }
+      if (typeof window.resetsAt === 'number') { bits.push('resets ' + resetInstantOf(window.resetsAt)); }
+      windows.push(bits.length === 0 ? names[i] : names[i] + ' ' + bits.join(' '));
+    }
+    if (windows.length > 0) { parts.push('windows ' + windows.join(', ')); }
+  }
+  if (info.isUsingOverage === true) { parts.push('overage in use'); }
+  else if (typeof info.overageStatus === 'string') { parts.push('overage ' + info.overageStatus); }
+  return parts.join(' ');
+}
+
+// The header's quota text from the door's freshest live observation: the quota summary plus when the door observed it, or the plain statement that none has arrived yet.
+function quotaText(latest) {
+  if (latest === undefined || latest === null) { return 'quota: not observed yet'; }
+  var info = rateLimitInfoOf({ type: 'rate_limit_event', rate_limit_info: latest.rateLimit });
+  if (info === undefined) { return 'quota: not readable'; }
+  return 'quota: ' + quotaSummary(info) + '  observed ' + new Date(latest.observedAt).toLocaleTimeString();
+}
+
+// The headline text of one Remote Control stream event: a rate-limit payload renders as its quota summary, the assistant and user payloads that carry a content array of text blocks render as their prose, everything else as its type plus a sketch.
 function rcLine(event) {
   var envelope = event.envelope;
   var payload = envelope.payload;
   var headline = '';
-  if (payload !== undefined && payload !== null && typeof payload === 'object' && Array.isArray(payload.content)) {
+  var rateLimit = rateLimitInfoOf(payload);
+  if (rateLimit !== undefined) {
+    headline = quotaSummary(rateLimit);
+  } else if (payload !== undefined && payload !== null && typeof payload === 'object' && Array.isArray(payload.content)) {
     var parts = [];
     for (var i = 0; i < payload.content.length; i++) {
       var block = payload.content[i];
@@ -75378,6 +75785,13 @@ function refreshPending() {
   rpc('rc/pending', ui !== null && ui.selected !== null ? { session: ui.selected } : {}).then(function (result) { renderPending(result.pending); }, authOrReport('rc/pending'));
 }
 
+// The header's quota span, fed by the door's live read on the same refresh cycle as the session and pending lists: the freshest rate-limit observation any session's stream has filed, with its observation time so its freshness reads at a glance.
+function refreshQuota() {
+  rpc('usage/live', {}).then(function (result) {
+    if (ui !== null) { ui.quotaState.textContent = quotaText(result.latest); }
+  }, authOrReport('usage/live'));
+}
+
 // The one error path every call shares: a 401 means this token is not this generation's, so the page says so and asks for it again; anything else is reported in the feed.
 function authOrReport(what) {
   return function (error) {
@@ -75465,11 +75879,12 @@ function startPage(heldToken) {
     promptTarget: document.getElementById('prompt-target'),
     send: document.getElementById('send'),
     streamState: document.getElementById('stream-state'),
+    quotaState: document.getElementById('quota-state'),
     selected: null,
   };
   document.getElementById('token-form').classList.add('hidden');
   ui.main.classList.remove('hidden');
-  document.getElementById('refresh').addEventListener('click', function () { refreshSessions(); refreshPending(); });
+  document.getElementById('refresh').addEventListener('click', function () { refreshSessions(); refreshPending(); refreshQuota(); });
   document.getElementById('send').addEventListener('click', sendPrompt);
   document.getElementById('source-filter').addEventListener('change', function () { runFeed(); });
   ui.prompt.addEventListener('keydown', function (event) {
@@ -75477,7 +75892,8 @@ function startPage(heldToken) {
   });
   refreshSessions();
   refreshPending();
-  window.setInterval(function () { refreshSessions(); refreshPending(); }, 4000);
+  refreshQuota();
+  window.setInterval(function () { refreshSessions(); refreshPending(); refreshQuota(); }, 4000);
   runFeed();
   document.getElementById('door-state').textContent = 'connected';
 }
@@ -75556,6 +75972,7 @@ var RC_CLIENT_PAGE_HTML = `<!doctype html>
   <h1>agent-shim Remote Control</h1>
   <span class="state" id="door-state">connecting</span>
   <span class="state" id="stream-state"></span>
+  <span class="state" id="quota-state">quota: not observed yet</span>
 </header>
 <div id="token-form">
   <h2>This door's control token</h2>
@@ -75694,7 +76111,7 @@ function createSseParser() {
     }
   };
 }
-function isRecord7(value2) {
+function isRecord9(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 }
 function sequenceNumOf(value2) {
@@ -75716,7 +76133,7 @@ function parseRcStreamEnvelope(parsed) {
   } catch {
     return void 0;
   }
-  if (!isRecord7(data)) {
+  if (!isRecord9(data)) {
     return void 0;
   }
   const eventType = data.event_type;
@@ -75799,9 +76216,26 @@ function createRcStreamHub(deps) {
     }
     return headers;
   };
+  let receiptFailureLogged = false;
+  const sendReceipt = (attachment, headers, eventId) => {
+    if (eventId === void 0) {
+      return;
+    }
+    deps.dial.markRead(attachment.sessionId, headers, eventId).then(
+      () => {
+        receiptFailureLogged = false;
+      },
+      (error62) => {
+        if (!receiptFailureLogged) {
+          receiptFailureLogged = true;
+          deps.log?.(`rc stream ${attachment.sessionId}: the read receipt for event ${eventId} could not be sent (${error62 instanceof Error ? error62.message : String(error62)}); further receipt failures stay quiet until one lands`);
+        }
+      }
+    );
+  };
   const attempt = async (attachment, credential) => {
     const headers = streamHeaders(credential);
-    const presence = await deps.dial.announcePresence(attachment.sessionId, headers, attachment.clientId);
+    const presence = await deps.dial.announcePresence(attachment.sessionId, headers, attachment.clientId, false);
     if (presence.status === HTTP_STATUS.unauthorized) {
       return "unauthorized";
     }
@@ -75821,6 +76255,7 @@ function createRcStreamHub(deps) {
     const parser = createSseParser();
     for await (const chunk of answer.chunks) {
       attachment.controller.signal.throwIfAborted();
+      let lastEventId;
       for (const parsed of parser.write(Buffer.from(chunk).toString("utf8"))) {
         const envelope = parseRcStreamEnvelope(parsed);
         if (envelope === void 0) {
@@ -75828,10 +76263,21 @@ function createRcStreamHub(deps) {
         }
         deps.fileStreamEvent(attachment.sessionId, envelope);
         deps.fanout.publish({ session: attachment.sessionId, envelope });
+        if (typeof envelope.event_id === "string" && envelope.event_type !== "mark_read") {
+          lastEventId = envelope.event_id;
+        }
       }
+      sendReceipt(attachment, headers, lastEventId);
     }
     return "dropped";
   };
+  const clearPresence = (attachment, headers) => {
+    if (headers === void 0) {
+      return;
+    }
+    void deps.dial.announcePresence(attachment.sessionId, headers, attachment.clientId, true).catch(() => {
+    });
+  };
   const runLoop = async (attachment) => {
     let retriedUnauthorized = false;
     for (; ; ) {
@@ -75843,6 +76289,7 @@ function createRcStreamHub(deps) {
       if (!live || credential?.authorization === void 0) {
         deps.log?.(`rc stream ${attachment.sessionId}: the attachment ended (${live ? "the session's client credential is no longer known" : "the tracker gave up on the session"})`);
         persistCursor(attachment.sessionId);
+        clearPresence(attachment, credential === void 0 ? void 0 : streamHeaders(credential));
         if (attachments.get(attachment.sessionId) === attachment) {
           attachments.delete(attachment.sessionId);
         }
@@ -75905,6 +76352,8 @@ function createRcStreamHub(deps) {
     close: () => {
       for (const attachment of attachments.values()) {
         persistCursor(attachment.sessionId);
+        const credential = deps.credentialOf(attachment.sessionId);
+        clearPresence(attachment, credential?.authorization === void 0 ? void 0 : streamHeaders(credential));
         attachment.stop();
       }
       attachments.clear();
@@ -75972,7 +76421,7 @@ var ProviderQuotaError = class extends Error {
     this.name = "ProviderQuotaError";
   }
 };
-var MS_PER_SECOND8 = 1e3;
+var MS_PER_SECOND9 = 1e3;
 var SECONDS_PER_HOUR = 3600;
 var HOURS_PER_DAY3 = 24;
 var DAYS_PER_MONTH = 30;
@@ -75984,8 +76433,8 @@ var ZAI_QUOTA_URL = `https://${ZAI_HOST}/api/monitor/usage/quota/limit`;
 var ZAI_UNIT_HOURS = 3;
 var ZAI_UNIT_MONTHS = 5;
 var ZAI_UNIT_MS = /* @__PURE__ */ new Map([
-  [ZAI_UNIT_HOURS, SECONDS_PER_HOUR * MS_PER_SECOND8],
-  [ZAI_UNIT_MONTHS, DAYS_PER_MONTH * HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND8]
+  [ZAI_UNIT_HOURS, SECONDS_PER_HOUR * MS_PER_SECOND9],
+  [ZAI_UNIT_MONTHS, DAYS_PER_MONTH * HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND9]
 ]);
 var ZAI_MEASURES = { TOKENS_LIMIT: "tokens", TIME_LIMIT: "tool-calls" };
 var ZaiLimitSchema = external_exports.object({
@@ -76049,7 +76498,7 @@ var OPENROUTER_HOST = "openrouter.ai";
 var OPENROUTER_KEY_URL = `https://${OPENROUTER_HOST}/api/v1/key`;
 var OPENROUTER_CREDITS_URL = `https://${OPENROUTER_HOST}/api/v1/credits`;
 var HTTP_FORBIDDEN = 403;
-var MS_PER_DAY2 = HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND8;
+var MS_PER_DAY2 = HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND9;
 var OpenRouterKeySchema = external_exports.object({
   data: external_exports.object({
     limit: external_exports.number().nonnegative().nullable(),
@@ -76292,6 +76741,7 @@ function realFrontDoorSupervisorPorts(paths) {
   const rcCredentialStore = createRcCredentialStore(realFarmFs, paths.frontdoorRcCredentialsDir);
   const rcTracker = createRcSessionTracker({ now: () => Date.now(), idleMs: RC_IDLE_EXPIRY_MS, credentialStore: rcCredentialStore });
   const doorEvents = createDoorEventHub();
+  const rcLiveUsage = createRcLiveUsage({ now: () => Date.now(), hub: doorEvents });
   const rcFanout = rcFanoutOnDoorHub(createRcEventFanout(), doorEvents);
   const rcHub = createRcStreamHub({
     now: () => Date.now(),
@@ -76392,7 +76842,11 @@ function realFrontDoorSupervisorPorts(paths) {
       const rcMcpReconnect = async (sessionId, serverName) => await reconnectRcSessionMcpServer(rcControlRequestDeps, sessionId, serverName);
       const rcMcpAuthenticate = async (sessionId, serverName, redirectUri) => await authenticateRcSessionMcpServer(rcControlRequestDeps, sessionId, serverName, redirectUri);
       const rcMcpOAuthCallbackUrl = async (sessionId, serverName, callbackUrl) => await submitRcSessionMcpOAuthCallbackUrl(rcControlRequestDeps, sessionId, serverName, callbackUrl);
+      const rcTeleport = async (sessionId, marker) => await teleportRcSession(rcControlRequestDeps, sessionId, marker);
       const controlDeps = {
+        list: rcTracker.list,
+        liveRateLimits: rcLiveUsage.liveOf,
+        latestRateLimit: rcLiveUsage.latestOf,
         usageSnapshots: () => listUsageSnapshots(realFarmFs, paths.usageSnapshotsDir),
         usageSnapshotOf: (identity) => readUsageSnapshot(realFarmFs, paths.usageSnapshotsDir, identity),
         now: () => Date.now(),
@@ -76409,11 +76863,10 @@ function realFrontDoorSupervisorPorts(paths) {
         },
         log,
         mintLeaf(authority, LOOPBACK_LEAF_NAMES, /* @__PURE__ */ new Date()),
-        createRcControlHandler({ expectedToken: rcControlToken, list: rcTracker.list, statusOf: rcTracker.statusOf, pendingOf: rcTracker.pendingOf, inject: rcInject, answer: rcAnswer, interrupt: rcInterrupt, setModel: rcSetModel, setPermissionMode: rcSetPermissionMode, endSession: rcEndSession, getUsage: rcGetUsage, getContextUsage: rcGetContextUsage, readFile: rcReadFile, fileSuggestions: rcFileSuggestions, keepAlive: rcKeepAlive, mcpStatus: rcMcpStatus, mcpReconnect: rcMcpReconnect, mcpAuthenticate: rcMcpAuthenticate, mcpOAuthCallbackUrl: rcMcpOAuthCallbackUrl }),
+        createRcControlHandler({ expectedToken: rcControlToken, list: rcTracker.list, statusOf: rcTracker.statusOf, pendingOf: rcTracker.pendingOf, inject: rcInject, answer: rcAnswer, interrupt: rcInterrupt, setModel: rcSetModel, setPermissionMode: rcSetPermissionMode, endSession: rcEndSession, getUsage: rcGetUsage, getContextUsage: rcGetContextUsage, readFile: rcReadFile, fileSuggestions: rcFileSuggestions, keepAlive: rcKeepAlive, mcpStatus: rcMcpStatus, mcpReconnect: rcMcpReconnect, mcpAuthenticate: rcMcpAuthenticate, mcpOAuthCallbackUrl: rcMcpOAuthCallbackUrl, teleport: rcTeleport }),
         [
           createDoorApiNodeHandler({
             expectedToken: rcControlToken,
-            list: rcTracker.list,
             statusOf: rcTracker.statusOf,
             pendingOf: rcTracker.pendingOf,
             inject: rcInject,
@@ -76431,6 +76884,7 @@ function realFrontDoorSupervisorPorts(paths) {
             mcpReconnect: rcMcpReconnect,
             mcpAuthenticate: rcMcpAuthenticate,
             mcpOAuthCallbackUrl: rcMcpOAuthCallbackUrl,
+            teleport: rcTeleport,
             fanout: rcFanout,
             ...controlDeps,
             events: doorEvents