agent-shim 8.25.0 → 8.26.0

package/dist/index.cjs

@@ -114,11 +114,15 @@ __export(index_exports, {
   RC_WEB_FETCH_MAX_BYTES: () => RC_WEB_FETCH_MAX_BYTES,
   RC_WEB_FETCH_MAX_REDIRECTS: () => RC_WEB_FETCH_MAX_REDIRECTS,
   ROUTED_PATH_PREFIX: () => ROUTED_PATH_PREFIX,
+  RcLiveRateLimitSchema: () => RcLiveRateLimitSchema,
   RcPermissionModeSchema: () => RcPermissionModeSchema,
+  RcRateLimitInfoSchema: () => RcRateLimitInfoSchema,
+  RcRateLimitWindowSchema: () => RcRateLimitWindowSchema,
   RcStreamEnvelopeSchema: () => RcStreamEnvelopeSchema,
   RcStreamEventSchema: () => RcStreamEventSchema,
   UsageError: () => UsageError,
   UsageListOutputSchema: () => UsageListOutputSchema,
+  UsageLiveOutputSchema: () => UsageLiveOutputSchema,
   UsageSnapshotError: () => UsageSnapshotError,
   UsageSnapshotSchema: () => UsageSnapshotSchema,
   UsageWindowsInputSchema: () => UsageWindowsInputSchema,
@@ -170,6 +174,7 @@ __export(index_exports, {
   createRcControlHandler: () => createRcControlHandler,
   createRcCredentialStore: () => createRcCredentialStore,
   createRcEventFanout: () => createRcEventFanout,
+  createRcLiveUsage: () => createRcLiveUsage,
   createRcSelfHostSurface: () => createRcSelfHostSurface,
   createRcSessionTracker: () => createRcSessionTracker,
   createRcStreamHub: () => createRcStreamHub,
@@ -231,6 +236,7 @@ __export(index_exports, {
   rcEventWriteResultFromAnswer: () => rcEventWriteResultFromAnswer,
   rcFanoutOnDoorHub: () => rcFanoutOnDoorHub,
   rcObserverAsPassthrough: () => rcObserverAsPassthrough,
+  rcRateLimitInfoOf: () => rcRateLimitInfoOf,
   rcSelfHostFromEnv: () => rcSelfHostFromEnv,
   rcWebFetchAllowsPrivateFromEnv: () => rcWebFetchAllowsPrivateFromEnv,
   readActiveIdentity: () => readActiveIdentity,
@@ -5373,6 +5379,35 @@ var RcStreamEventSchema = import_zod4.z.strictObject({
   session: import_zod4.z.string(),
   envelope: RcStreamEnvelopeSchema
 });
+var RcRateLimitWindowSchema = import_zod4.z.looseObject({
+  /** The fraction of the window used, usually between 0 and 1, above 1 when usage legitimately runs past the window's cap (the CLI's own field description states both). */
+  utilization: import_zod4.z.number().optional(),
+  /** When the window resets, in unix epoch seconds: the unit is the CLI's own field description, stated in the 2.1.289 bundle's schema. */
+  resetsAt: import_zod4.z.number().optional()
+});
+var RcRateLimitInfoSchema = import_zod4.z.looseObject({
+  /** The limiting window's own status (`allowed`, `allowed_warning`, `rejected`), asserted only as a string because the vocabulary grows with the CLI. */
+  status: import_zod4.z.string(),
+  /** When the limiting window resets, in unix epoch seconds. */
+  resetsAt: import_zod4.z.number().optional(),
+  /** Which window the top-level fields describe (`five_hour`, `seven_day`, and kin), the payload's own name for it. */
+  rateLimitType: import_zod4.z.string().optional(),
+  /** The fraction of the limiting window used, on the same scale the per-window utilizations carry. */
+  utilization: import_zod4.z.number().optional(),
+  /** Whether usage beyond the plan (extra usage) is currently covering the overflow, the payload's own flag for it. */
+  isUsingOverage: import_zod4.z.boolean().optional(),
+  /** The overage's own status, the same vocabulary the limiting window's `status` carries. */
+  overageStatus: import_zod4.z.string().optional(),
+  /** When the overage window resets, in unix epoch seconds. */
+  overageResetsAt: import_zod4.z.number().optional(),
+  /** Each subscription window the account's response headers carried: the session (five-hour), weekly (seven-day), and overage-included weekly windows, each present only when the account's responses carry it. */
+  unifiedWindows: import_zod4.z.looseObject({ five_hour: RcRateLimitWindowSchema.optional(), seven_day: RcRateLimitWindowSchema.optional(), seven_day_overage_included: RcRateLimitWindowSchema.optional() }).optional()
+});
+var RcLiveRateLimitSchema = import_zod4.z.strictObject({
+  session: import_zod4.z.string(),
+  observedAt: import_zod4.z.number(),
+  rateLimit: RcRateLimitInfoSchema
+});
 var RcSessionQuerySchema = import_zod4.z.strictObject({
   session: import_zod4.z.string().min(1).optional()
 });
@@ -9983,6 +10018,12 @@ var UsageWindowsOutputSchema = import_zod19.z.strictObject({
   fiveHour: EffectiveWindowSchema.optional(),
   sevenDay: EffectiveWindowSchema.optional()
 });
+var UsageLiveOutputSchema = import_zod19.z.strictObject({
+  /** The freshest observation the door holds, never narrowed by the read's session filter because it is the door's single latest statement of the account's quota; absent while no rate_limit_event has been filed at all. */
+  latest: RcLiveRateLimitSchema.optional(),
+  /** One observation per session whose stream has filed a rate_limit_event this door generation. */
+  sessions: import_zod19.z.readonly(import_zod19.z.array(RcLiveRateLimitSchema))
+});
 var FrontDoorSessionStatusSchema = import_zod19.z.strictObject({
   pid: import_zod19.z.int().positive(),
   startedAt: import_zod19.z.number(),
@@ -10097,6 +10138,16 @@ function createControlApiRouter(deps) {
           ...unified?.fiveHour === void 0 ? {} : { fiveHour: effectiveWindow(unified.fiveHour, now) },
           ...unified?.sevenDay === void 0 ? {} : { sevenDay: effectiveWindow(unified.sevenDay, now) }
         };
+      }),
+      live: authed.input(RcSessionQuerySchema).output(UsageLiveOutputSchema).handler(({ input }) => {
+        const sessions = deps.liveRateLimits(input.session);
+        if (input.session !== void 0 && sessions.length === 0) {
+          if (deps.list().some((session) => session.id === input.session)) {
+            throw new import_client3.ORPCError("NOT_FOUND", { message: `session ${input.session} has filed no rate_limit_event on its stream yet: the worker emits one only once a turn has completed, so retry after this session's next turn` });
+          }
+          throw new import_client3.ORPCError("NOT_FOUND", { message: rcSessionNotObservedMessage(input.session) });
+        }
+        return { latest: deps.latestRateLimit(), sessions };
       })
     },
     frontdoor: {
@@ -10317,6 +10368,42 @@ function createLaunchEventPublisher(hub, now) {
   };
 }
 
+// src/frontdoor/rcLiveUsage.ts
+var RC_RATE_LIMIT_EVENT_TYPE = "rate_limit_event";
+function isRecord5(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function rcRateLimitInfoOf(event) {
+  const payload = event.envelope.payload;
+  if (!isRecord5(payload) || payload.type !== RC_RATE_LIMIT_EVENT_TYPE) {
+    return void 0;
+  }
+  if (!isRecord5(payload.rate_limit_info)) {
+    return void 0;
+  }
+  const parsed = RcRateLimitInfoSchema.safeParse(payload.rate_limit_info);
+  return parsed.success ? parsed.data : void 0;
+}
+function createRcLiveUsage(deps) {
+  const observed = /* @__PURE__ */ new Map();
+  deps.hub.subscribe([DOOR_EVENT_SOURCE_RC], (event) => {
+    const stream = RcStreamEventSchema.safeParse(event.payload);
+    if (!stream.success) {
+      return;
+    }
+    const rateLimit = rcRateLimitInfoOf(stream.data);
+    if (rateLimit === void 0) {
+      return;
+    }
+    observed.set(stream.data.session, { session: stream.data.session, observedAt: deps.now(), rateLimit });
+  });
+  const sorted = () => [...observed.values()].sort((left, right) => left.observedAt - right.observedAt || (left.session < right.session ? -1 : 1));
+  return {
+    liveOf: (sessionId) => sorted().filter((entry) => sessionId === void 0 || entry.session === sessionId),
+    latestOf: () => sorted().at(-1)
+  };
+}
+
 // src/frontdoor/rcStream.ts
 var RC_STREAM_EVENT_NAME = "client_event";
 var SSE_BYTE_ORDER_MARK = 65279;
@@ -10379,7 +10466,7 @@ function createSseParser() {
     }
   };
 }
-function isRecord5(value) {
+function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function sequenceNumOf(value) {
@@ -10401,7 +10488,7 @@ function parseRcStreamEnvelope(parsed) {
   } catch {
     return void 0;
   }
-  if (!isRecord5(data)) {
+  if (!isRecord6(data)) {
     return void 0;
   }
   const eventType = data.event_type;
@@ -10632,7 +10719,7 @@ function createRcStreamHub(deps) {
 // src/frontdoor/rcSelfHostEndpoints.ts
 var RC_SOURCE_WORKER = "worker";
 var RC_SOURCE_CLIENT = "client";
-function isRecord6(value) {
+function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseJsonObject2(body) {
@@ -10642,7 +10729,7 @@ function parseJsonObject2(body) {
   } catch {
     return void 0;
   }
-  return isRecord6(parsed) ? parsed : void 0;
+  return isRecord7(parsed) ? parsed : void 0;
 }
 function nonEmptyString2(record, field) {
   const value = record === void 0 ? void 0 : record[field];
@@ -10716,7 +10803,7 @@ async function serveRcClientChannels(ctx, tail, method, maxBatchEvents) {
     }
     const results = [];
     for (const event of events) {
-      if (!isRecord6(event) || !isRecord6(event.payload)) {
+      if (!isRecord7(event) || !isRecord7(event.payload)) {
         await ctx.answerJson(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "every event in a teleport write is an object carrying one payload object" } });
         return true;
       }
@@ -11086,7 +11173,7 @@ var RC_SELF_HOST_WORKER_EPOCH = 1;
 var RC_STREAM_EVENT_NAME2 = "client_event";
 var CONFLICT_REASON_HEADER2 = "x-ccr-conflict-reason";
 var CONFLICT_REASON_EPOCH_STALE = "epoch_stale";
-function isRecord7(value) {
+function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isWebSearchRefusal(value) {
@@ -11170,7 +11257,7 @@ function parseJsonObject3(body) {
   } catch {
     return void 0;
   }
-  return isRecord7(parsed) ? parsed : void 0;
+  return isRecord8(parsed) ? parsed : void 0;
 }
 function mintWorkerJwt(randomToken, issuedAt) {
   const encode = (value) => Buffer.from(JSON.stringify(value), "utf8").toString("base64url");
@@ -11417,7 +11504,7 @@ data: ${JSON.stringify(envelope)}
         if (status !== void 0) {
           session.workerStatus = status;
         }
-        if (isRecord7(body?.external_metadata)) {
+        if (isRecord8(body?.external_metadata)) {
           session.externalMetadata = body.external_metadata;
         }
         await answerJson2(response, HTTP_STATUS.ok, {});
@@ -11447,7 +11534,7 @@ data: ${JSON.stringify(envelope)}
         }
         const results = [];
         for (const event of events) {
-          if (!isRecord7(event) || !isRecord7(event.payload)) {
+          if (!isRecord8(event) || !isRecord8(event.payload)) {
             await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "every event in a batch is an object carrying one payload object" } });
             return;
           }
@@ -11480,7 +11567,7 @@ data: ${JSON.stringify(envelope)}
           return;
         }
         for (const event of events) {
-          if (isRecord7(event)) {
+          if (isRecord8(event)) {
             session.internalEvents.push({ eventId: deps.newUuid(), body: event });
           }
         }
@@ -11576,7 +11663,7 @@ data: ${JSON.stringify(envelope)}
       }
       const results = [];
       for (const event of events) {
-        if (!isRecord7(event) || !isRecord7(event.payload)) {
+        if (!isRecord8(event) || !isRecord8(event.payload)) {
           await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "every event in a write is an object carrying one payload object" } });
           return;
         }
@@ -11770,7 +11857,7 @@ var RC_SELF_HOST_RECORD_DIR = "rc-selfhost";
 var RC_SELF_HOST_RECORD_FILE = "credential.json";
 var SELF_HOST_EMAIL = "selfhost@agent-shim.invalid";
 var SELF_HOST_SUBSCRIPTION_TYPE = "max";
-function isRecord8(value) {
+function isRecord9(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function readJsonObject(fs12, file) {
@@ -11784,7 +11871,7 @@ function readJsonObject(fs12, file) {
   } catch {
     return void 0;
   }
-  return isRecord8(parsed) ? parsed : void 0;
+  return isRecord9(parsed) ? parsed : void 0;
 }
 function readRcSelfHostRecord(fs12, frontdoorDir) {
   const parsed = readJsonObject(fs12, import_node_path28.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
@@ -11808,7 +11895,7 @@ function mintRcSelfHostCredential(deps) {
   const recordFile = import_node_path28.default.join(recordDir, RC_SELF_HOST_RECORD_FILE);
   const previousRecord = readRcSelfHostRecord(deps.fs, deps.frontdoorDir);
   const existingCredentials = readJsonObject(deps.fs, credentialsFile);
-  const existingOauth = isRecord8(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
+  const existingOauth = isRecord9(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
   const existingToken = typeof existingOauth?.accessToken === "string" && existingOauth.accessToken !== "" ? existingOauth.accessToken : void 0;
   const existingIsOwn = existingToken !== void 0 && previousRecord?.accessToken === existingToken;
   if (existingToken !== void 0 && !existingIsOwn && !deps.force) {
@@ -11825,7 +11912,7 @@ function mintRcSelfHostCredential(deps) {
   deps.fs.writeFilePrivate(credentialsFile, `${JSON.stringify({ ...existingCredentials, claudeAiOauth: { accessToken, refreshToken, expiresAt: null, scopes: [...RC_SELF_HOST_SCOPE_LIST], subscriptionType: SELF_HOST_SUBSCRIPTION_TYPE, rateLimitTier: null } }, null, 2)}
 `);
   const claudeJson = readJsonObject(deps.fs, claudeJsonFile) ?? {};
-  const existingBlock = (value) => isRecord8(value) ? value : {};
+  const existingBlock = (value) => isRecord9(value) ? value : {};
   deps.fs.writeFilePrivate(claudeJsonFile, `${JSON.stringify({
     ...claudeJson,
     oauthAccount: {
@@ -12024,7 +12111,7 @@ var import_node_path30 = __toESM(require("node:path"), 1);
 // package.json
 var package_default = {
   name: "agent-shim",
-  version: "8.25.0",
+  version: "8.26.0",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -13288,11 +13375,15 @@ function prepareClaudeLaunch(options) {
   RC_WEB_FETCH_MAX_BYTES,
   RC_WEB_FETCH_MAX_REDIRECTS,
   ROUTED_PATH_PREFIX,
+  RcLiveRateLimitSchema,
   RcPermissionModeSchema,
+  RcRateLimitInfoSchema,
+  RcRateLimitWindowSchema,
   RcStreamEnvelopeSchema,
   RcStreamEventSchema,
   UsageError,
   UsageListOutputSchema,
+  UsageLiveOutputSchema,
   UsageSnapshotError,
   UsageSnapshotSchema,
   UsageWindowsInputSchema,
@@ -13344,6 +13435,7 @@ function prepareClaudeLaunch(options) {
   createRcControlHandler,
   createRcCredentialStore,
   createRcEventFanout,
+  createRcLiveUsage,
   createRcSelfHostSurface,
   createRcSessionTracker,
   createRcStreamHub,
@@ -13405,6 +13497,7 @@ function prepareClaudeLaunch(options) {
   rcEventWriteResultFromAnswer,
   rcFanoutOnDoorHub,
   rcObserverAsPassthrough,
+  rcRateLimitInfoOf,
   rcSelfHostFromEnv,
   rcWebFetchAllowsPrivateFromEnv,
   readActiveIdentity,

package/dist/index.mjs

@@ -5074,6 +5074,35 @@ var RcStreamEventSchema = z4.strictObject({
   session: z4.string(),
   envelope: RcStreamEnvelopeSchema
 });
+var RcRateLimitWindowSchema = z4.looseObject({
+  /** The fraction of the window used, usually between 0 and 1, above 1 when usage legitimately runs past the window's cap (the CLI's own field description states both). */
+  utilization: z4.number().optional(),
+  /** When the window resets, in unix epoch seconds: the unit is the CLI's own field description, stated in the 2.1.289 bundle's schema. */
+  resetsAt: z4.number().optional()
+});
+var RcRateLimitInfoSchema = z4.looseObject({
+  /** The limiting window's own status (`allowed`, `allowed_warning`, `rejected`), asserted only as a string because the vocabulary grows with the CLI. */
+  status: z4.string(),
+  /** When the limiting window resets, in unix epoch seconds. */
+  resetsAt: z4.number().optional(),
+  /** Which window the top-level fields describe (`five_hour`, `seven_day`, and kin), the payload's own name for it. */
+  rateLimitType: z4.string().optional(),
+  /** The fraction of the limiting window used, on the same scale the per-window utilizations carry. */
+  utilization: z4.number().optional(),
+  /** Whether usage beyond the plan (extra usage) is currently covering the overflow, the payload's own flag for it. */
+  isUsingOverage: z4.boolean().optional(),
+  /** The overage's own status, the same vocabulary the limiting window's `status` carries. */
+  overageStatus: z4.string().optional(),
+  /** When the overage window resets, in unix epoch seconds. */
+  overageResetsAt: z4.number().optional(),
+  /** Each subscription window the account's response headers carried: the session (five-hour), weekly (seven-day), and overage-included weekly windows, each present only when the account's responses carry it. */
+  unifiedWindows: z4.looseObject({ five_hour: RcRateLimitWindowSchema.optional(), seven_day: RcRateLimitWindowSchema.optional(), seven_day_overage_included: RcRateLimitWindowSchema.optional() }).optional()
+});
+var RcLiveRateLimitSchema = z4.strictObject({
+  session: z4.string(),
+  observedAt: z4.number(),
+  rateLimit: RcRateLimitInfoSchema
+});
 var RcSessionQuerySchema = z4.strictObject({
   session: z4.string().min(1).optional()
 });
@@ -9684,6 +9713,12 @@ var UsageWindowsOutputSchema = z19.strictObject({
   fiveHour: EffectiveWindowSchema.optional(),
   sevenDay: EffectiveWindowSchema.optional()
 });
+var UsageLiveOutputSchema = z19.strictObject({
+  /** The freshest observation the door holds, never narrowed by the read's session filter because it is the door's single latest statement of the account's quota; absent while no rate_limit_event has been filed at all. */
+  latest: RcLiveRateLimitSchema.optional(),
+  /** One observation per session whose stream has filed a rate_limit_event this door generation. */
+  sessions: z19.readonly(z19.array(RcLiveRateLimitSchema))
+});
 var FrontDoorSessionStatusSchema = z19.strictObject({
   pid: z19.int().positive(),
   startedAt: z19.number(),
@@ -9798,6 +9833,16 @@ function createControlApiRouter(deps) {
           ...unified?.fiveHour === void 0 ? {} : { fiveHour: effectiveWindow(unified.fiveHour, now) },
           ...unified?.sevenDay === void 0 ? {} : { sevenDay: effectiveWindow(unified.sevenDay, now) }
         };
+      }),
+      live: authed.input(RcSessionQuerySchema).output(UsageLiveOutputSchema).handler(({ input }) => {
+        const sessions = deps.liveRateLimits(input.session);
+        if (input.session !== void 0 && sessions.length === 0) {
+          if (deps.list().some((session) => session.id === input.session)) {
+            throw new ORPCError3("NOT_FOUND", { message: `session ${input.session} has filed no rate_limit_event on its stream yet: the worker emits one only once a turn has completed, so retry after this session's next turn` });
+          }
+          throw new ORPCError3("NOT_FOUND", { message: rcSessionNotObservedMessage(input.session) });
+        }
+        return { latest: deps.latestRateLimit(), sessions };
       })
     },
     frontdoor: {
@@ -10018,6 +10063,42 @@ function createLaunchEventPublisher(hub, now) {
   };
 }
 
+// src/frontdoor/rcLiveUsage.ts
+var RC_RATE_LIMIT_EVENT_TYPE = "rate_limit_event";
+function isRecord5(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function rcRateLimitInfoOf(event) {
+  const payload = event.envelope.payload;
+  if (!isRecord5(payload) || payload.type !== RC_RATE_LIMIT_EVENT_TYPE) {
+    return void 0;
+  }
+  if (!isRecord5(payload.rate_limit_info)) {
+    return void 0;
+  }
+  const parsed = RcRateLimitInfoSchema.safeParse(payload.rate_limit_info);
+  return parsed.success ? parsed.data : void 0;
+}
+function createRcLiveUsage(deps) {
+  const observed = /* @__PURE__ */ new Map();
+  deps.hub.subscribe([DOOR_EVENT_SOURCE_RC], (event) => {
+    const stream = RcStreamEventSchema.safeParse(event.payload);
+    if (!stream.success) {
+      return;
+    }
+    const rateLimit = rcRateLimitInfoOf(stream.data);
+    if (rateLimit === void 0) {
+      return;
+    }
+    observed.set(stream.data.session, { session: stream.data.session, observedAt: deps.now(), rateLimit });
+  });
+  const sorted = () => [...observed.values()].sort((left, right) => left.observedAt - right.observedAt || (left.session < right.session ? -1 : 1));
+  return {
+    liveOf: (sessionId) => sorted().filter((entry) => sessionId === void 0 || entry.session === sessionId),
+    latestOf: () => sorted().at(-1)
+  };
+}
+
 // src/frontdoor/rcStream.ts
 var RC_STREAM_EVENT_NAME = "client_event";
 var SSE_BYTE_ORDER_MARK = 65279;
@@ -10080,7 +10161,7 @@ function createSseParser() {
     }
   };
 }
-function isRecord5(value) {
+function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function sequenceNumOf(value) {
@@ -10102,7 +10183,7 @@ function parseRcStreamEnvelope(parsed) {
   } catch {
     return void 0;
   }
-  if (!isRecord5(data)) {
+  if (!isRecord6(data)) {
     return void 0;
   }
   const eventType = data.event_type;
@@ -10333,7 +10414,7 @@ function createRcStreamHub(deps) {
 // src/frontdoor/rcSelfHostEndpoints.ts
 var RC_SOURCE_WORKER = "worker";
 var RC_SOURCE_CLIENT = "client";
-function isRecord6(value) {
+function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseJsonObject2(body) {
@@ -10343,7 +10424,7 @@ function parseJsonObject2(body) {
   } catch {
     return void 0;
   }
-  return isRecord6(parsed) ? parsed : void 0;
+  return isRecord7(parsed) ? parsed : void 0;
 }
 function nonEmptyString2(record, field) {
   const value = record === void 0 ? void 0 : record[field];
@@ -10417,7 +10498,7 @@ async function serveRcClientChannels(ctx, tail, method, maxBatchEvents) {
     }
     const results = [];
     for (const event of events) {
-      if (!isRecord6(event) || !isRecord6(event.payload)) {
+      if (!isRecord7(event) || !isRecord7(event.payload)) {
         await ctx.answerJson(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "every event in a teleport write is an object carrying one payload object" } });
         return true;
       }
@@ -10787,7 +10868,7 @@ var RC_SELF_HOST_WORKER_EPOCH = 1;
 var RC_STREAM_EVENT_NAME2 = "client_event";
 var CONFLICT_REASON_HEADER2 = "x-ccr-conflict-reason";
 var CONFLICT_REASON_EPOCH_STALE = "epoch_stale";
-function isRecord7(value) {
+function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isWebSearchRefusal(value) {
@@ -10871,7 +10952,7 @@ function parseJsonObject3(body) {
   } catch {
     return void 0;
   }
-  return isRecord7(parsed) ? parsed : void 0;
+  return isRecord8(parsed) ? parsed : void 0;
 }
 function mintWorkerJwt(randomToken, issuedAt) {
   const encode = (value) => Buffer.from(JSON.stringify(value), "utf8").toString("base64url");
@@ -11118,7 +11199,7 @@ data: ${JSON.stringify(envelope)}
         if (status !== void 0) {
           session.workerStatus = status;
         }
-        if (isRecord7(body?.external_metadata)) {
+        if (isRecord8(body?.external_metadata)) {
           session.externalMetadata = body.external_metadata;
         }
         await answerJson2(response, HTTP_STATUS.ok, {});
@@ -11148,7 +11229,7 @@ data: ${JSON.stringify(envelope)}
         }
         const results = [];
         for (const event of events) {
-          if (!isRecord7(event) || !isRecord7(event.payload)) {
+          if (!isRecord8(event) || !isRecord8(event.payload)) {
             await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "every event in a batch is an object carrying one payload object" } });
             return;
           }
@@ -11181,7 +11262,7 @@ data: ${JSON.stringify(envelope)}
           return;
         }
         for (const event of events) {
-          if (isRecord7(event)) {
+          if (isRecord8(event)) {
             session.internalEvents.push({ eventId: deps.newUuid(), body: event });
           }
         }
@@ -11277,7 +11358,7 @@ data: ${JSON.stringify(envelope)}
       }
       const results = [];
       for (const event of events) {
-        if (!isRecord7(event) || !isRecord7(event.payload)) {
+        if (!isRecord8(event) || !isRecord8(event.payload)) {
           await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "every event in a write is an object carrying one payload object" } });
           return;
         }
@@ -11471,7 +11552,7 @@ var RC_SELF_HOST_RECORD_DIR = "rc-selfhost";
 var RC_SELF_HOST_RECORD_FILE = "credential.json";
 var SELF_HOST_EMAIL = "selfhost@agent-shim.invalid";
 var SELF_HOST_SUBSCRIPTION_TYPE = "max";
-function isRecord8(value) {
+function isRecord9(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function readJsonObject(fs12, file) {
@@ -11485,7 +11566,7 @@ function readJsonObject(fs12, file) {
   } catch {
     return void 0;
   }
-  return isRecord8(parsed) ? parsed : void 0;
+  return isRecord9(parsed) ? parsed : void 0;
 }
 function readRcSelfHostRecord(fs12, frontdoorDir) {
   const parsed = readJsonObject(fs12, path28.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
@@ -11509,7 +11590,7 @@ function mintRcSelfHostCredential(deps) {
   const recordFile = path28.join(recordDir, RC_SELF_HOST_RECORD_FILE);
   const previousRecord = readRcSelfHostRecord(deps.fs, deps.frontdoorDir);
   const existingCredentials = readJsonObject(deps.fs, credentialsFile);
-  const existingOauth = isRecord8(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
+  const existingOauth = isRecord9(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
   const existingToken = typeof existingOauth?.accessToken === "string" && existingOauth.accessToken !== "" ? existingOauth.accessToken : void 0;
   const existingIsOwn = existingToken !== void 0 && previousRecord?.accessToken === existingToken;
   if (existingToken !== void 0 && !existingIsOwn && !deps.force) {
@@ -11526,7 +11607,7 @@ function mintRcSelfHostCredential(deps) {
   deps.fs.writeFilePrivate(credentialsFile, `${JSON.stringify({ ...existingCredentials, claudeAiOauth: { accessToken, refreshToken, expiresAt: null, scopes: [...RC_SELF_HOST_SCOPE_LIST], subscriptionType: SELF_HOST_SUBSCRIPTION_TYPE, rateLimitTier: null } }, null, 2)}
 `);
   const claudeJson = readJsonObject(deps.fs, claudeJsonFile) ?? {};
-  const existingBlock = (value) => isRecord8(value) ? value : {};
+  const existingBlock = (value) => isRecord9(value) ? value : {};
   deps.fs.writeFilePrivate(claudeJsonFile, `${JSON.stringify({
     ...claudeJson,
     oauthAccount: {
@@ -11725,7 +11806,7 @@ import path30 from "node:path";
 // package.json
 var package_default = {
   name: "agent-shim",
-  version: "8.25.0",
+  version: "8.26.0",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -12988,11 +13069,15 @@ export {
   RC_WEB_FETCH_MAX_BYTES,
   RC_WEB_FETCH_MAX_REDIRECTS,
   ROUTED_PATH_PREFIX,
+  RcLiveRateLimitSchema,
   RcPermissionModeSchema,
+  RcRateLimitInfoSchema,
+  RcRateLimitWindowSchema,
   RcStreamEnvelopeSchema,
   RcStreamEventSchema,
   UsageError,
   UsageListOutputSchema,
+  UsageLiveOutputSchema,
   UsageSnapshotError,
   UsageSnapshotSchema,
   UsageWindowsInputSchema,
@@ -13044,6 +13129,7 @@ export {
   createRcControlHandler,
   createRcCredentialStore,
   createRcEventFanout,
+  createRcLiveUsage,
   createRcSelfHostSurface,
   createRcSessionTracker,
   createRcStreamHub,
@@ -13105,6 +13191,7 @@ export {
   rcEventWriteResultFromAnswer,
   rcFanoutOnDoorHub,
   rcObserverAsPassthrough,
+  rcRateLimitInfoOf,
   rcSelfHostFromEnv,
   rcWebFetchAllowsPrivateFromEnv,
   readActiveIdentity,