agent-shim 8.25.0 → 8.26.0

package/dist/cli.cjs

@@ -61796,7 +61796,7 @@ function registerIdentityCommand(program2, deps) {
 // package.json
 var package_default = {
   name: "agent-shim",
-  version: "8.25.0",
+  version: "8.26.0",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -69666,6 +69666,166 @@ var CheckReportJsonSchema = external_exports.strictObject({
 
 // src/frontdoor/controlSchemas.ts
 var import_node_path33 = __toESM(require("node:path"), 1);
+
+// src/frontdoor/rcSchemas.ts
+var RcPermissionModeSchema = external_exports.enum(RC_PERMISSION_MODES);
+var RcSessionSummarySchema = external_exports.strictObject({
+  id: external_exports.string(),
+  createdAt: external_exports.number(),
+  lastSeenAt: external_exports.number()
+});
+function workerFactSchema(value2) {
+  return external_exports.strictObject({ value: value2, observedAt: external_exports.number() });
+}
+var RcPendingRequestSummarySchema = external_exports.strictObject({
+  sessionId: external_exports.string(),
+  requestId: external_exports.string(),
+  type: external_exports.string(),
+  summary: external_exports.string(),
+  observedAt: external_exports.number()
+});
+var RcSessionStatusSchema = external_exports.strictObject({
+  ...RcSessionSummarySchema.shape,
+  workerState: workerFactSchema(external_exports.string()).optional(),
+  workerIdleSeconds: workerFactSchema(external_exports.number()).optional(),
+  pending: external_exports.readonly(external_exports.array(RcPendingRequestSummarySchema))
+});
+var RcStreamEnvelopeSchema = external_exports.looseObject({
+  /** The envelope's own event id, when the host sent one. */
+  event_id: external_exports.string().optional(),
+  /** The envelope's event type, the discriminator a consumer switches on (`control_request`, `user`, and kin). */
+  event_type: external_exports.string(),
+  /** The sequence number the host assigned, the value a resume continues after. */
+  sequence_num: external_exports.int(),
+  /** Who emitted the event (`worker` for the CLI's half, a client id for a client's). */
+  source: external_exports.string(),
+  /** The event's payload, carried verbatim: its shape is the payload family's, narrowed by whichever consumer needs it. Optional in the schema's own type because the door forwards the host's envelope as it arrived, asserting only the fields it relies on itself. */
+  payload: external_exports.unknown().optional(),
+  /** When the host created the event; the protocol's own type for this field is not established here, so it is forwarded rather than asserted. */
+  created_at: external_exports.unknown().optional()
+});
+var RcStreamEventSchema = external_exports.strictObject({
+  session: external_exports.string(),
+  envelope: RcStreamEnvelopeSchema
+});
+var RcRateLimitWindowSchema = external_exports.looseObject({
+  /** The fraction of the window used, usually between 0 and 1, above 1 when usage legitimately runs past the window's cap (the CLI's own field description states both). */
+  utilization: external_exports.number().optional(),
+  /** When the window resets, in unix epoch seconds: the unit is the CLI's own field description, stated in the 2.1.289 bundle's schema. */
+  resetsAt: external_exports.number().optional()
+});
+var RcRateLimitInfoSchema = external_exports.looseObject({
+  /** The limiting window's own status (`allowed`, `allowed_warning`, `rejected`), asserted only as a string because the vocabulary grows with the CLI. */
+  status: external_exports.string(),
+  /** When the limiting window resets, in unix epoch seconds. */
+  resetsAt: external_exports.number().optional(),
+  /** Which window the top-level fields describe (`five_hour`, `seven_day`, and kin), the payload's own name for it. */
+  rateLimitType: external_exports.string().optional(),
+  /** The fraction of the limiting window used, on the same scale the per-window utilizations carry. */
+  utilization: external_exports.number().optional(),
+  /** Whether usage beyond the plan (extra usage) is currently covering the overflow, the payload's own flag for it. */
+  isUsingOverage: external_exports.boolean().optional(),
+  /** The overage's own status, the same vocabulary the limiting window's `status` carries. */
+  overageStatus: external_exports.string().optional(),
+  /** When the overage window resets, in unix epoch seconds. */
+  overageResetsAt: external_exports.number().optional(),
+  /** Each subscription window the account's response headers carried: the session (five-hour), weekly (seven-day), and overage-included weekly windows, each present only when the account's responses carry it. */
+  unifiedWindows: external_exports.looseObject({ five_hour: RcRateLimitWindowSchema.optional(), seven_day: RcRateLimitWindowSchema.optional(), seven_day_overage_included: RcRateLimitWindowSchema.optional() }).optional()
+});
+var RcLiveRateLimitSchema = external_exports.strictObject({
+  session: external_exports.string(),
+  observedAt: external_exports.number(),
+  rateLimit: RcRateLimitInfoSchema
+});
+var RcSessionQuerySchema = external_exports.strictObject({
+  session: external_exports.string().min(1).optional()
+});
+var RcSendInputSchema = external_exports.strictObject({
+  session: external_exports.string().min(1),
+  text: external_exports.string().min(1)
+});
+var RcAnswerInputSchema = external_exports.strictObject({
+  session: external_exports.string().min(1),
+  request: external_exports.string().min(1),
+  approve: external_exports.boolean(),
+  text: external_exports.string().optional()
+}).refine((input2) => !input2.approve || input2.text === void 0 || input2.text === "", { message: "an approval carries no text (the protocol's allow result has no message field); text is the denial message" });
+var RcInterruptInputSchema = external_exports.strictObject({
+  session: external_exports.string().min(1)
+});
+var RcSetModelInputSchema = external_exports.strictObject({
+  session: external_exports.string().min(1),
+  model: external_exports.string().min(1)
+});
+var RcSetPermissionModeInputSchema = external_exports.strictObject({
+  session: external_exports.string().min(1),
+  mode: RcPermissionModeSchema
+});
+var RcEndSessionInputSchema = external_exports.strictObject({
+  session: external_exports.string().min(1),
+  reason: external_exports.string().min(1).optional()
+});
+var RcGetUsageInputSchema = external_exports.strictObject({
+  session: external_exports.string().min(1),
+  skipBehaviors: external_exports.boolean().optional()
+});
+var RcGetContextUsageInputSchema = external_exports.strictObject({
+  session: external_exports.string().min(1),
+  detail: external_exports.enum(RC_CONTEXT_USAGE_DETAILS).optional()
+});
+var RcReadFileInputSchema = external_exports.strictObject({
+  session: external_exports.string().min(1),
+  path: external_exports.string().min(1),
+  maxBytes: external_exports.number().int().positive().optional(),
+  encoding: external_exports.enum(RC_READ_FILE_ENCODINGS).optional()
+});
+var RcFileSuggestionsInputSchema = external_exports.strictObject({
+  session: external_exports.string().min(1),
+  query: external_exports.string()
+});
+var RcKeepAliveInputSchema = external_exports.strictObject({
+  session: external_exports.string().min(1)
+});
+var RcMcpStatusInputSchema = external_exports.strictObject({
+  session: external_exports.string().min(1)
+});
+var RcMcpReconnectInputSchema = external_exports.strictObject({
+  session: external_exports.string().min(1),
+  serverName: external_exports.string().min(1)
+});
+var RcMcpAuthenticateInputSchema = external_exports.strictObject({
+  session: external_exports.string().min(1),
+  serverName: external_exports.string().min(1),
+  redirectUri: external_exports.string().min(1)
+});
+var RcMcpOAuthCallbackUrlInputSchema = external_exports.strictObject({
+  session: external_exports.string().min(1),
+  serverName: external_exports.string().min(1),
+  callbackUrl: external_exports.string().min(1)
+});
+var RcTeleportInputSchema = external_exports.strictObject({
+  session: external_exports.string().min(1),
+  marker: external_exports.string().min(1)
+});
+var RcListOutputSchema = external_exports.strictObject({ sessions: external_exports.readonly(external_exports.array(RcSessionSummarySchema)) });
+var RcStatusOutputSchema = external_exports.strictObject({ statuses: external_exports.readonly(external_exports.array(RcSessionStatusSchema)) });
+var RcPendingOutputSchema = external_exports.strictObject({ pending: external_exports.readonly(external_exports.array(RcPendingRequestSummarySchema)) });
+var RcWriteOutputSchema = external_exports.strictObject({
+  session: external_exports.string(),
+  sequenceNums: external_exports.readonly(external_exports.array(external_exports.number()))
+});
+var RcControlWriteOutputSchema = external_exports.strictObject({
+  session: external_exports.string(),
+  request: external_exports.string(),
+  sequenceNums: external_exports.readonly(external_exports.array(external_exports.number()))
+});
+var RcAnswerOutputSchema = external_exports.strictObject({
+  session: external_exports.string(),
+  request: external_exports.string(),
+  sequenceNums: external_exports.readonly(external_exports.array(external_exports.number()))
+});
+
+// src/frontdoor/controlSchemas.ts
 var UsageListOutputSchema = external_exports.strictObject({ snapshots: external_exports.readonly(external_exports.array(UsageSnapshotSchema)) });
 var UsageWindowsInputSchema = external_exports.strictObject({
   identity: external_exports.string().min(1),
@@ -69689,6 +69849,12 @@ var UsageWindowsOutputSchema = external_exports.strictObject({
   fiveHour: EffectiveWindowSchema.optional(),
   sevenDay: EffectiveWindowSchema.optional()
 });
+var UsageLiveOutputSchema = external_exports.strictObject({
+  /** The freshest observation the door holds, never narrowed by the read's session filter because it is the door's single latest statement of the account's quota; absent while no rate_limit_event has been filed at all. */
+  latest: RcLiveRateLimitSchema.optional(),
+  /** One observation per session whose stream has filed a rate_limit_event this door generation. */
+  sessions: external_exports.readonly(external_exports.array(RcLiveRateLimitSchema))
+});
 var FrontDoorSessionStatusSchema = external_exports.strictObject({
   pid: external_exports.int().positive(),
   startedAt: external_exports.number(),
@@ -71992,137 +72158,6 @@ var RPCHandler = class extends NodeHttpHandler {
 
 // src/frontdoor/rcApi.ts
 var import_undici2 = __toESM(require_undici(), 1);
-
-// src/frontdoor/rcSchemas.ts
-var RcPermissionModeSchema = external_exports.enum(RC_PERMISSION_MODES);
-var RcSessionSummarySchema = external_exports.strictObject({
-  id: external_exports.string(),
-  createdAt: external_exports.number(),
-  lastSeenAt: external_exports.number()
-});
-function workerFactSchema(value2) {
-  return external_exports.strictObject({ value: value2, observedAt: external_exports.number() });
-}
-var RcPendingRequestSummarySchema = external_exports.strictObject({
-  sessionId: external_exports.string(),
-  requestId: external_exports.string(),
-  type: external_exports.string(),
-  summary: external_exports.string(),
-  observedAt: external_exports.number()
-});
-var RcSessionStatusSchema = external_exports.strictObject({
-  ...RcSessionSummarySchema.shape,
-  workerState: workerFactSchema(external_exports.string()).optional(),
-  workerIdleSeconds: workerFactSchema(external_exports.number()).optional(),
-  pending: external_exports.readonly(external_exports.array(RcPendingRequestSummarySchema))
-});
-var RcStreamEnvelopeSchema = external_exports.looseObject({
-  /** The envelope's own event id, when the host sent one. */
-  event_id: external_exports.string().optional(),
-  /** The envelope's event type, the discriminator a consumer switches on (`control_request`, `user`, and kin). */
-  event_type: external_exports.string(),
-  /** The sequence number the host assigned, the value a resume continues after. */
-  sequence_num: external_exports.int(),
-  /** Who emitted the event (`worker` for the CLI's half, a client id for a client's). */
-  source: external_exports.string(),
-  /** The event's payload, carried verbatim: its shape is the payload family's, narrowed by whichever consumer needs it. Optional in the schema's own type because the door forwards the host's envelope as it arrived, asserting only the fields it relies on itself. */
-  payload: external_exports.unknown().optional(),
-  /** When the host created the event; the protocol's own type for this field is not established here, so it is forwarded rather than asserted. */
-  created_at: external_exports.unknown().optional()
-});
-var RcStreamEventSchema = external_exports.strictObject({
-  session: external_exports.string(),
-  envelope: RcStreamEnvelopeSchema
-});
-var RcSessionQuerySchema = external_exports.strictObject({
-  session: external_exports.string().min(1).optional()
-});
-var RcSendInputSchema = external_exports.strictObject({
-  session: external_exports.string().min(1),
-  text: external_exports.string().min(1)
-});
-var RcAnswerInputSchema = external_exports.strictObject({
-  session: external_exports.string().min(1),
-  request: external_exports.string().min(1),
-  approve: external_exports.boolean(),
-  text: external_exports.string().optional()
-}).refine((input2) => !input2.approve || input2.text === void 0 || input2.text === "", { message: "an approval carries no text (the protocol's allow result has no message field); text is the denial message" });
-var RcInterruptInputSchema = external_exports.strictObject({
-  session: external_exports.string().min(1)
-});
-var RcSetModelInputSchema = external_exports.strictObject({
-  session: external_exports.string().min(1),
-  model: external_exports.string().min(1)
-});
-var RcSetPermissionModeInputSchema = external_exports.strictObject({
-  session: external_exports.string().min(1),
-  mode: RcPermissionModeSchema
-});
-var RcEndSessionInputSchema = external_exports.strictObject({
-  session: external_exports.string().min(1),
-  reason: external_exports.string().min(1).optional()
-});
-var RcGetUsageInputSchema = external_exports.strictObject({
-  session: external_exports.string().min(1),
-  skipBehaviors: external_exports.boolean().optional()
-});
-var RcGetContextUsageInputSchema = external_exports.strictObject({
-  session: external_exports.string().min(1),
-  detail: external_exports.enum(RC_CONTEXT_USAGE_DETAILS).optional()
-});
-var RcReadFileInputSchema = external_exports.strictObject({
-  session: external_exports.string().min(1),
-  path: external_exports.string().min(1),
-  maxBytes: external_exports.number().int().positive().optional(),
-  encoding: external_exports.enum(RC_READ_FILE_ENCODINGS).optional()
-});
-var RcFileSuggestionsInputSchema = external_exports.strictObject({
-  session: external_exports.string().min(1),
-  query: external_exports.string()
-});
-var RcKeepAliveInputSchema = external_exports.strictObject({
-  session: external_exports.string().min(1)
-});
-var RcMcpStatusInputSchema = external_exports.strictObject({
-  session: external_exports.string().min(1)
-});
-var RcMcpReconnectInputSchema = external_exports.strictObject({
-  session: external_exports.string().min(1),
-  serverName: external_exports.string().min(1)
-});
-var RcMcpAuthenticateInputSchema = external_exports.strictObject({
-  session: external_exports.string().min(1),
-  serverName: external_exports.string().min(1),
-  redirectUri: external_exports.string().min(1)
-});
-var RcMcpOAuthCallbackUrlInputSchema = external_exports.strictObject({
-  session: external_exports.string().min(1),
-  serverName: external_exports.string().min(1),
-  callbackUrl: external_exports.string().min(1)
-});
-var RcTeleportInputSchema = external_exports.strictObject({
-  session: external_exports.string().min(1),
-  marker: external_exports.string().min(1)
-});
-var RcListOutputSchema = external_exports.strictObject({ sessions: external_exports.readonly(external_exports.array(RcSessionSummarySchema)) });
-var RcStatusOutputSchema = external_exports.strictObject({ statuses: external_exports.readonly(external_exports.array(RcSessionStatusSchema)) });
-var RcPendingOutputSchema = external_exports.strictObject({ pending: external_exports.readonly(external_exports.array(RcPendingRequestSummarySchema)) });
-var RcWriteOutputSchema = external_exports.strictObject({
-  session: external_exports.string(),
-  sequenceNums: external_exports.readonly(external_exports.array(external_exports.number()))
-});
-var RcControlWriteOutputSchema = external_exports.strictObject({
-  session: external_exports.string(),
-  request: external_exports.string(),
-  sequenceNums: external_exports.readonly(external_exports.array(external_exports.number()))
-});
-var RcAnswerOutputSchema = external_exports.strictObject({
-  session: external_exports.string(),
-  request: external_exports.string(),
-  sequenceNums: external_exports.readonly(external_exports.array(external_exports.number()))
-});
-
-// src/frontdoor/rcApi.ts
 var RC_ORPC_PATH_PREFIX = "/__agent-shim/orpc";
 var RC_SUBSCRIBER_BUFFER_EVENTS = 100;
 function doorApiAuth(expectedToken) {
@@ -72334,6 +72369,16 @@ function createControlApiRouter(deps) {
           ...unified?.fiveHour === void 0 ? {} : { fiveHour: effectiveWindow(unified.fiveHour, now) },
           ...unified?.sevenDay === void 0 ? {} : { sevenDay: effectiveWindow(unified.sevenDay, now) }
         };
+      }),
+      live: authed.input(RcSessionQuerySchema).output(UsageLiveOutputSchema).handler(({ input: input2 }) => {
+        const sessions = deps.liveRateLimits(input2.session);
+        if (input2.session !== void 0 && sessions.length === 0) {
+          if (deps.list().some((session) => session.id === input2.session)) {
+            throw new ORPCError("NOT_FOUND", { message: `session ${input2.session} has filed no rate_limit_event on its stream yet: the worker emits one only once a turn has completed, so retry after this session's next turn` });
+          }
+          throw new ORPCError("NOT_FOUND", { message: rcSessionNotObservedMessage(input2.session) });
+        }
+        return { latest: deps.latestRateLimit(), sessions };
       })
     },
     frontdoor: {
@@ -73766,13 +73811,49 @@ function attachingProviderCredential(route, deps) {
 // src/frontdoor/rcCommands.ts
 var import_node_crypto14 = require("node:crypto");
 
+// src/frontdoor/rcLiveUsage.ts
+var RC_RATE_LIMIT_EVENT_TYPE = "rate_limit_event";
+function isRecord4(value2) {
+  return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+}
+function rcRateLimitInfoOf(event) {
+  const payload = event.envelope.payload;
+  if (!isRecord4(payload) || payload.type !== RC_RATE_LIMIT_EVENT_TYPE) {
+    return void 0;
+  }
+  if (!isRecord4(payload.rate_limit_info)) {
+    return void 0;
+  }
+  const parsed = RcRateLimitInfoSchema.safeParse(payload.rate_limit_info);
+  return parsed.success ? parsed.data : void 0;
+}
+function createRcLiveUsage(deps) {
+  const observed = /* @__PURE__ */ new Map();
+  deps.hub.subscribe([DOOR_EVENT_SOURCE_RC], (event) => {
+    const stream = RcStreamEventSchema.safeParse(event.payload);
+    if (!stream.success) {
+      return;
+    }
+    const rateLimit = rcRateLimitInfoOf(stream.data);
+    if (rateLimit === void 0) {
+      return;
+    }
+    observed.set(stream.data.session, { session: stream.data.session, observedAt: deps.now(), rateLimit });
+  });
+  const sorted = () => [...observed.values()].sort((left, right) => left.observedAt - right.observedAt || (left.session < right.session ? -1 : 1));
+  return {
+    liveOf: (sessionId) => sorted().filter((entry) => sessionId === void 0 || entry.session === sessionId),
+    latestOf: () => sorted().at(-1)
+  };
+}
+
 // src/frontdoor/rcSelfHostMint.ts
 var import_node_path34 = __toESM(require("node:path"), 1);
 
 // src/frontdoor/rcSelfHostEndpoints.ts
 var RC_SOURCE_WORKER = "worker";
 var RC_SOURCE_CLIENT = "client";
-function isRecord4(value2) {
+function isRecord5(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 }
 function parseJsonObject2(body) {
@@ -73782,7 +73863,7 @@ function parseJsonObject2(body) {
   } catch {
     return void 0;
   }
-  return isRecord4(parsed) ? parsed : void 0;
+  return isRecord5(parsed) ? parsed : void 0;
 }
 function nonEmptyString2(record2, field) {
   const value2 = record2 === void 0 ? void 0 : record2[field];
@@ -73856,7 +73937,7 @@ async function serveRcClientChannels(ctx, tail, method, maxBatchEvents) {
     }
     const results = [];
     for (const event of events) {
-      if (!isRecord4(event) || !isRecord4(event.payload)) {
+      if (!isRecord5(event) || !isRecord5(event.payload)) {
         await ctx.answerJson(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "every event in a teleport write is an object carrying one payload object" } });
         return true;
       }
@@ -74226,7 +74307,7 @@ var RC_SELF_HOST_WORKER_EPOCH = 1;
 var RC_STREAM_EVENT_NAME = "client_event";
 var CONFLICT_REASON_HEADER2 = "x-ccr-conflict-reason";
 var CONFLICT_REASON_EPOCH_STALE = "epoch_stale";
-function isRecord5(value2) {
+function isRecord6(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 }
 function isWebSearchRefusal(value2) {
@@ -74310,7 +74391,7 @@ function parseJsonObject3(body) {
   } catch {
     return void 0;
   }
-  return isRecord5(parsed) ? parsed : void 0;
+  return isRecord6(parsed) ? parsed : void 0;
 }
 function mintWorkerJwt(randomToken, issuedAt) {
   const encode3 = (value2) => Buffer.from(JSON.stringify(value2), "utf8").toString("base64url");
@@ -74557,7 +74638,7 @@ data: ${JSON.stringify(envelope)}
         if (status !== void 0) {
           session.workerStatus = status;
         }
-        if (isRecord5(body?.external_metadata)) {
+        if (isRecord6(body?.external_metadata)) {
           session.externalMetadata = body.external_metadata;
         }
         await answerJson2(response, HTTP_STATUS.ok, {});
@@ -74587,7 +74668,7 @@ data: ${JSON.stringify(envelope)}
         }
         const results = [];
         for (const event of events) {
-          if (!isRecord5(event) || !isRecord5(event.payload)) {
+          if (!isRecord6(event) || !isRecord6(event.payload)) {
             await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "every event in a batch is an object carrying one payload object" } });
             return;
           }
@@ -74620,7 +74701,7 @@ data: ${JSON.stringify(envelope)}
           return;
         }
         for (const event of events) {
-          if (isRecord5(event)) {
+          if (isRecord6(event)) {
             session.internalEvents.push({ eventId: deps.newUuid(), body: event });
           }
         }
@@ -74716,7 +74797,7 @@ data: ${JSON.stringify(envelope)}
       }
       const results = [];
       for (const event of events) {
-        if (!isRecord5(event) || !isRecord5(event.payload)) {
+        if (!isRecord6(event) || !isRecord6(event.payload)) {
           await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "every event in a write is an object carrying one payload object" } });
           return;
         }
@@ -74909,7 +74990,7 @@ var RC_SELF_HOST_RECORD_DIR = "rc-selfhost";
 var RC_SELF_HOST_RECORD_FILE = "credential.json";
 var SELF_HOST_EMAIL = "selfhost@agent-shim.invalid";
 var SELF_HOST_SUBSCRIPTION_TYPE = "max";
-function isRecord6(value2) {
+function isRecord7(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 }
 function readJsonObject(fs20, file2) {
@@ -74923,7 +75004,7 @@ function readJsonObject(fs20, file2) {
   } catch {
     return void 0;
   }
-  return isRecord6(parsed) ? parsed : void 0;
+  return isRecord7(parsed) ? parsed : void 0;
 }
 function readRcSelfHostRecord(fs20, frontdoorDir) {
   const parsed = readJsonObject(fs20, import_node_path34.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
@@ -74947,7 +75028,7 @@ function mintRcSelfHostCredential(deps) {
   const recordFile = import_node_path34.default.join(recordDir, RC_SELF_HOST_RECORD_FILE);
   const previousRecord = readRcSelfHostRecord(deps.fs, deps.frontdoorDir);
   const existingCredentials = readJsonObject(deps.fs, credentialsFile);
-  const existingOauth = isRecord6(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
+  const existingOauth = isRecord7(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
   const existingToken = typeof existingOauth?.accessToken === "string" && existingOauth.accessToken !== "" ? existingOauth.accessToken : void 0;
   const existingIsOwn = existingToken !== void 0 && previousRecord?.accessToken === existingToken;
   if (existingToken !== void 0 && !existingIsOwn && !deps.force) {
@@ -74964,7 +75045,7 @@ function mintRcSelfHostCredential(deps) {
   deps.fs.writeFilePrivate(credentialsFile, `${JSON.stringify({ ...existingCredentials, claudeAiOauth: { accessToken, refreshToken, expiresAt: null, scopes: [...RC_SELF_HOST_SCOPE_LIST], subscriptionType: SELF_HOST_SUBSCRIPTION_TYPE, rateLimitTier: null } }, null, 2)}
 `);
   const claudeJson = readJsonObject(deps.fs, claudeJsonFile) ?? {};
-  const existingBlock = (value2) => isRecord6(value2) ? value2 : {};
+  const existingBlock = (value2) => isRecord7(value2) ? value2 : {};
   deps.fs.writeFilePrivate(claudeJsonFile, `${JSON.stringify({
     ...claudeJson,
     oauthAccount: {
@@ -75042,9 +75123,54 @@ function formatRcPendingList(pending) {
 function eventExcerpt(text2) {
   return text2.length <= RC_PENDING_SUMMARY_EXCERPT_CHARS ? text2 : `${text2.slice(0, RC_PENDING_SUMMARY_EXCERPT_CHARS)}...`;
 }
+var PERCENT_SCALE = 100;
+var MS_PER_SECOND8 = 1e3;
+function percentOf(fraction) {
+  return `${String(Math.round(fraction * PERCENT_SCALE))}%`;
+}
+function resetInstantOf(epochSeconds) {
+  return new Date(epochSeconds * MS_PER_SECOND8).toISOString();
+}
+function formatRcRateLimitInfo(info) {
+  const parts = [info.status];
+  if (info.rateLimitType !== void 0) {
+    parts.push(info.rateLimitType);
+  }
+  if (info.utilization !== void 0) {
+    parts.push(percentOf(info.utilization));
+  }
+  if (info.resetsAt !== void 0) {
+    parts.push(`resets ${resetInstantOf(info.resetsAt)}`);
+  }
+  const windows = [];
+  for (const name of ["five_hour", "seven_day", "seven_day_overage_included"]) {
+    const window = info.unifiedWindows?.[name];
+    if (window === void 0) {
+      continue;
+    }
+    const bits = [];
+    if (window.utilization !== void 0) {
+      bits.push(percentOf(window.utilization));
+    }
+    if (window.resetsAt !== void 0) {
+      bits.push(`resets ${resetInstantOf(window.resetsAt)}`);
+    }
+    windows.push(bits.length === 0 ? name : `${name} ${bits.join(" ")}`);
+  }
+  if (windows.length > 0) {
+    parts.push(`windows ${windows.join(", ")}`);
+  }
+  if (info.isUsingOverage === true) {
+    parts.push("overage in use");
+  } else if (info.overageStatus !== void 0) {
+    parts.push(`overage ${info.overageStatus}`);
+  }
+  return parts.join(" ");
+}
 function formatRcStreamEvent(event) {
   const { envelope } = event;
-  const sketch = envelope.payload === void 0 ? "" : `  ${eventExcerpt(JSON.stringify(envelope.payload))}`;
+  const rateLimit = rcRateLimitInfoOf(event);
+  const sketch = rateLimit !== void 0 ? `  ${formatRcRateLimitInfo(rateLimit)}` : envelope.payload === void 0 ? "" : `  ${eventExcerpt(JSON.stringify(envelope.payload))}`;
   return `${event.session}  ${envelope.event_type}  sequence_num ${String(envelope.sequence_num)}  source ${envelope.source}${sketch}`;
 }
 function formatRcSelfHostMint(result) {
@@ -75270,7 +75396,7 @@ function registerRcCommand(frontdoor, paths) {
     ['agent-shim frontdoor rc teleport --session cse_00000000-0000-4000-8000-000000000000 --marker "__ULTRAPAN_TELEPORT_LOCAL__"']
   );
   withExamples(
-    rc.command("watch").description("Print the observed sessions' client read stream events as they arrive, the approvals the door's held stream receives above all, until Ctrl-C leaves. Read-only.").argument("[session]", "One cse_ session id, as `frontdoor rc list` shows it; every observed session when omitted.").option("--json", "Print each event as one JSON line as it arrives.").action(async (session, options) => {
+    rc.command("watch").description("Print the observed sessions' client read stream events as they arrive, the approvals the door's held stream receives above all, with each rate_limit_event rendered as the account's quota state. Read-only, until Ctrl-C leaves.").argument("[session]", "One cse_ session id, as `frontdoor rc list` shows it; every observed session when omitted.").option("--json", "Print each event as one JSON line as it arrives.").action(async (session, options) => {
       const client = frontDoorRcApiFromState(realFarmFs, paths);
       const leave = new AbortController();
       const onInterrupt = () => {
@@ -75328,11 +75454,11 @@ var import_node_path35 = __toESM(require("node:path"), 1);
 function isSafeSessionId(sessionId) {
   return /^[A-Za-z0-9_-]+$/.test(sessionId);
 }
-function isRecord7(value2) {
+function isRecord8(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 }
 function credentialOfJson(parsed) {
-  if (!isRecord7(parsed)) {
+  if (!isRecord8(parsed)) {
     return void 0;
   }
   const { authorization, anthropicVersion, anthropicClientPlatform } = parsed;
@@ -75362,7 +75488,7 @@ function createRcCredentialStore(fs20, dir) {
     } catch {
       return void 0;
     }
-    return isRecord7(parsed) ? parsed : void 0;
+    return isRecord8(parsed) ? parsed : void 0;
   };
   return {
     read: (sessionId) => {
@@ -75476,12 +75602,61 @@ function sketch(value, cap) {
   return text.length > cap ? text.slice(0, cap) + '...' : text;
 }
 
-// The headline text of one Remote Control stream event: the assistant and user payloads that carry a content array of text blocks render as their prose, everything else as its type plus a sketch.
+// One utilization fraction as a whole percentage, the same rounding the CLI's own watch line applies.
+function percentOf(fraction) { return String(Math.round(fraction * 100)) + '%'; }
+
+// The reset instant a rate-limit payload states (unix epoch seconds) as an ISO instant; no countdown is derived from it, because a ticking derivation would claim a freshness the event stream never promised.
+function resetInstantOf(epochSeconds) { return new Date(epochSeconds * 1000).toISOString(); }
+
+// Whether one rate-limit payload is readable, narrowed the same way the door's live usage state narrows it: the event type and a rate_limit_info object.
+function rateLimitInfoOf(payload) {
+  if (payload === undefined || payload === null || typeof payload !== 'object' || payload.type !== 'rate_limit_event') { return undefined; }
+  var info = payload.rate_limit_info;
+  if (info === undefined || info === null || typeof info !== 'object' || typeof info.status !== 'string') { return undefined; }
+  return info;
+}
+
+// One rate-limit payload's facts as the quota summary the feed and the header render: the limiting window's status and utilisation, each subscription window, and the overage state, every value the payload's own words.
+function quotaSummary(info) {
+  var parts = [info.status];
+  if (info.rateLimitType !== undefined) { parts.push(info.rateLimitType); }
+  if (typeof info.utilization === 'number') { parts.push(percentOf(info.utilization)); }
+  if (typeof info.resetsAt === 'number') { parts.push('resets ' + resetInstantOf(info.resetsAt)); }
+  if (info.unifiedWindows !== undefined && info.unifiedWindows !== null && typeof info.unifiedWindows === 'object') {
+    var names = ['five_hour', 'seven_day', 'seven_day_overage_included'];
+    var windows = [];
+    for (var i = 0; i < names.length; i++) {
+      var window = info.unifiedWindows[names[i]];
+      if (window === undefined || window === null) { continue; }
+      var bits = [];
+      if (typeof window.utilization === 'number') { bits.push(percentOf(window.utilization)); }
+      if (typeof window.resetsAt === 'number') { bits.push('resets ' + resetInstantOf(window.resetsAt)); }
+      windows.push(bits.length === 0 ? names[i] : names[i] + ' ' + bits.join(' '));
+    }
+    if (windows.length > 0) { parts.push('windows ' + windows.join(', ')); }
+  }
+  if (info.isUsingOverage === true) { parts.push('overage in use'); }
+  else if (typeof info.overageStatus === 'string') { parts.push('overage ' + info.overageStatus); }
+  return parts.join(' ');
+}
+
+// The header's quota text from the door's freshest live observation: the quota summary plus when the door observed it, or the plain statement that none has arrived yet.
+function quotaText(latest) {
+  if (latest === undefined || latest === null) { return 'quota: not observed yet'; }
+  var info = rateLimitInfoOf({ type: 'rate_limit_event', rate_limit_info: latest.rateLimit });
+  if (info === undefined) { return 'quota: not readable'; }
+  return 'quota: ' + quotaSummary(info) + '  observed ' + new Date(latest.observedAt).toLocaleTimeString();
+}
+
+// The headline text of one Remote Control stream event: a rate-limit payload renders as its quota summary, the assistant and user payloads that carry a content array of text blocks render as their prose, everything else as its type plus a sketch.
 function rcLine(event) {
   var envelope = event.envelope;
   var payload = envelope.payload;
   var headline = '';
-  if (payload !== undefined && payload !== null && typeof payload === 'object' && Array.isArray(payload.content)) {
+  var rateLimit = rateLimitInfoOf(payload);
+  if (rateLimit !== undefined) {
+    headline = quotaSummary(rateLimit);
+  } else if (payload !== undefined && payload !== null && typeof payload === 'object' && Array.isArray(payload.content)) {
     var parts = [];
     for (var i = 0; i < payload.content.length; i++) {
       var block = payload.content[i];
@@ -75610,6 +75785,13 @@ function refreshPending() {
   rpc('rc/pending', ui !== null && ui.selected !== null ? { session: ui.selected } : {}).then(function (result) { renderPending(result.pending); }, authOrReport('rc/pending'));
 }
 
+// The header's quota span, fed by the door's live read on the same refresh cycle as the session and pending lists: the freshest rate-limit observation any session's stream has filed, with its observation time so its freshness reads at a glance.
+function refreshQuota() {
+  rpc('usage/live', {}).then(function (result) {
+    if (ui !== null) { ui.quotaState.textContent = quotaText(result.latest); }
+  }, authOrReport('usage/live'));
+}
+
 // The one error path every call shares: a 401 means this token is not this generation's, so the page says so and asks for it again; anything else is reported in the feed.
 function authOrReport(what) {
   return function (error) {
@@ -75697,11 +75879,12 @@ function startPage(heldToken) {
     promptTarget: document.getElementById('prompt-target'),
     send: document.getElementById('send'),
     streamState: document.getElementById('stream-state'),
+    quotaState: document.getElementById('quota-state'),
     selected: null,
   };
   document.getElementById('token-form').classList.add('hidden');
   ui.main.classList.remove('hidden');
-  document.getElementById('refresh').addEventListener('click', function () { refreshSessions(); refreshPending(); });
+  document.getElementById('refresh').addEventListener('click', function () { refreshSessions(); refreshPending(); refreshQuota(); });
   document.getElementById('send').addEventListener('click', sendPrompt);
   document.getElementById('source-filter').addEventListener('change', function () { runFeed(); });
   ui.prompt.addEventListener('keydown', function (event) {
@@ -75709,7 +75892,8 @@ function startPage(heldToken) {
   });
   refreshSessions();
   refreshPending();
-  window.setInterval(function () { refreshSessions(); refreshPending(); }, 4000);
+  refreshQuota();
+  window.setInterval(function () { refreshSessions(); refreshPending(); refreshQuota(); }, 4000);
   runFeed();
   document.getElementById('door-state').textContent = 'connected';
 }
@@ -75788,6 +75972,7 @@ var RC_CLIENT_PAGE_HTML = `<!doctype html>
   <h1>agent-shim Remote Control</h1>
   <span class="state" id="door-state">connecting</span>
   <span class="state" id="stream-state"></span>
+  <span class="state" id="quota-state">quota: not observed yet</span>
 </header>
 <div id="token-form">
   <h2>This door's control token</h2>
@@ -75926,7 +76111,7 @@ function createSseParser() {
     }
   };
 }
-function isRecord8(value2) {
+function isRecord9(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 }
 function sequenceNumOf(value2) {
@@ -75948,7 +76133,7 @@ function parseRcStreamEnvelope(parsed) {
   } catch {
     return void 0;
   }
-  if (!isRecord8(data)) {
+  if (!isRecord9(data)) {
     return void 0;
   }
   const eventType = data.event_type;
@@ -76236,7 +76421,7 @@ var ProviderQuotaError = class extends Error {
     this.name = "ProviderQuotaError";
   }
 };
-var MS_PER_SECOND8 = 1e3;
+var MS_PER_SECOND9 = 1e3;
 var SECONDS_PER_HOUR = 3600;
 var HOURS_PER_DAY3 = 24;
 var DAYS_PER_MONTH = 30;
@@ -76248,8 +76433,8 @@ var ZAI_QUOTA_URL = `https://${ZAI_HOST}/api/monitor/usage/quota/limit`;
 var ZAI_UNIT_HOURS = 3;
 var ZAI_UNIT_MONTHS = 5;
 var ZAI_UNIT_MS = /* @__PURE__ */ new Map([
-  [ZAI_UNIT_HOURS, SECONDS_PER_HOUR * MS_PER_SECOND8],
-  [ZAI_UNIT_MONTHS, DAYS_PER_MONTH * HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND8]
+  [ZAI_UNIT_HOURS, SECONDS_PER_HOUR * MS_PER_SECOND9],
+  [ZAI_UNIT_MONTHS, DAYS_PER_MONTH * HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND9]
 ]);
 var ZAI_MEASURES = { TOKENS_LIMIT: "tokens", TIME_LIMIT: "tool-calls" };
 var ZaiLimitSchema = external_exports.object({
@@ -76313,7 +76498,7 @@ var OPENROUTER_HOST = "openrouter.ai";
 var OPENROUTER_KEY_URL = `https://${OPENROUTER_HOST}/api/v1/key`;
 var OPENROUTER_CREDITS_URL = `https://${OPENROUTER_HOST}/api/v1/credits`;
 var HTTP_FORBIDDEN = 403;
-var MS_PER_DAY2 = HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND8;
+var MS_PER_DAY2 = HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND9;
 var OpenRouterKeySchema = external_exports.object({
   data: external_exports.object({
     limit: external_exports.number().nonnegative().nullable(),
@@ -76556,6 +76741,7 @@ function realFrontDoorSupervisorPorts(paths) {
   const rcCredentialStore = createRcCredentialStore(realFarmFs, paths.frontdoorRcCredentialsDir);
   const rcTracker = createRcSessionTracker({ now: () => Date.now(), idleMs: RC_IDLE_EXPIRY_MS, credentialStore: rcCredentialStore });
   const doorEvents = createDoorEventHub();
+  const rcLiveUsage = createRcLiveUsage({ now: () => Date.now(), hub: doorEvents });
   const rcFanout = rcFanoutOnDoorHub(createRcEventFanout(), doorEvents);
   const rcHub = createRcStreamHub({
     now: () => Date.now(),
@@ -76658,6 +76844,9 @@ function realFrontDoorSupervisorPorts(paths) {
       const rcMcpOAuthCallbackUrl = async (sessionId, serverName, callbackUrl) => await submitRcSessionMcpOAuthCallbackUrl(rcControlRequestDeps, sessionId, serverName, callbackUrl);
       const rcTeleport = async (sessionId, marker) => await teleportRcSession(rcControlRequestDeps, sessionId, marker);
       const controlDeps = {
+        list: rcTracker.list,
+        liveRateLimits: rcLiveUsage.liveOf,
+        latestRateLimit: rcLiveUsage.latestOf,
         usageSnapshots: () => listUsageSnapshots(realFarmFs, paths.usageSnapshotsDir),
         usageSnapshotOf: (identity) => readUsageSnapshot(realFarmFs, paths.usageSnapshotsDir, identity),
         now: () => Date.now(),
@@ -76678,7 +76867,6 @@ function realFrontDoorSupervisorPorts(paths) {
         [
           createDoorApiNodeHandler({
             expectedToken: rcControlToken,
-            list: rcTracker.list,
             statusOf: rcTracker.statusOf,
             pendingOf: rcTracker.pendingOf,
             inject: rcInject,