agent-shim 8.25.0 → 8.27.0

package/dist/index.cjs

@@ -114,11 +114,15 @@ __export(index_exports, {
   RC_WEB_FETCH_MAX_BYTES: () => RC_WEB_FETCH_MAX_BYTES,
   RC_WEB_FETCH_MAX_REDIRECTS: () => RC_WEB_FETCH_MAX_REDIRECTS,
   ROUTED_PATH_PREFIX: () => ROUTED_PATH_PREFIX,
+  RcLiveRateLimitSchema: () => RcLiveRateLimitSchema,
   RcPermissionModeSchema: () => RcPermissionModeSchema,
+  RcRateLimitInfoSchema: () => RcRateLimitInfoSchema,
+  RcRateLimitWindowSchema: () => RcRateLimitWindowSchema,
   RcStreamEnvelopeSchema: () => RcStreamEnvelopeSchema,
   RcStreamEventSchema: () => RcStreamEventSchema,
   UsageError: () => UsageError,
   UsageListOutputSchema: () => UsageListOutputSchema,
+  UsageLiveOutputSchema: () => UsageLiveOutputSchema,
   UsageSnapshotError: () => UsageSnapshotError,
   UsageSnapshotSchema: () => UsageSnapshotSchema,
   UsageWindowsInputSchema: () => UsageWindowsInputSchema,
@@ -170,6 +174,7 @@ __export(index_exports, {
   createRcControlHandler: () => createRcControlHandler,
   createRcCredentialStore: () => createRcCredentialStore,
   createRcEventFanout: () => createRcEventFanout,
+  createRcLiveUsage: () => createRcLiveUsage,
   createRcSelfHostSurface: () => createRcSelfHostSurface,
   createRcSessionTracker: () => createRcSessionTracker,
   createRcStreamHub: () => createRcStreamHub,
@@ -231,6 +236,7 @@ __export(index_exports, {
   rcEventWriteResultFromAnswer: () => rcEventWriteResultFromAnswer,
   rcFanoutOnDoorHub: () => rcFanoutOnDoorHub,
   rcObserverAsPassthrough: () => rcObserverAsPassthrough,
+  rcRateLimitInfoOf: () => rcRateLimitInfoOf,
   rcSelfHostFromEnv: () => rcSelfHostFromEnv,
   rcWebFetchAllowsPrivateFromEnv: () => rcWebFetchAllowsPrivateFromEnv,
   readActiveIdentity: () => readActiveIdentity,
@@ -5373,6 +5379,35 @@ var RcStreamEventSchema = import_zod4.z.strictObject({
   session: import_zod4.z.string(),
   envelope: RcStreamEnvelopeSchema
 });
+var RcRateLimitWindowSchema = import_zod4.z.looseObject({
+  /** The fraction of the window used, usually between 0 and 1, above 1 when usage legitimately runs past the window's cap (the CLI's own field description states both). */
+  utilization: import_zod4.z.number().optional(),
+  /** When the window resets, in unix epoch seconds: the unit is the CLI's own field description, stated in the 2.1.289 bundle's schema. */
+  resetsAt: import_zod4.z.number().optional()
+});
+var RcRateLimitInfoSchema = import_zod4.z.looseObject({
+  /** The limiting window's own status (`allowed`, `allowed_warning`, `rejected`), asserted only as a string because the vocabulary grows with the CLI. */
+  status: import_zod4.z.string(),
+  /** When the limiting window resets, in unix epoch seconds. */
+  resetsAt: import_zod4.z.number().optional(),
+  /** Which window the top-level fields describe (`five_hour`, `seven_day`, and kin), the payload's own name for it. */
+  rateLimitType: import_zod4.z.string().optional(),
+  /** The fraction of the limiting window used, on the same scale the per-window utilizations carry. */
+  utilization: import_zod4.z.number().optional(),
+  /** Whether usage beyond the plan (extra usage) is currently covering the overflow, the payload's own flag for it. */
+  isUsingOverage: import_zod4.z.boolean().optional(),
+  /** The overage's own status, the same vocabulary the limiting window's `status` carries. */
+  overageStatus: import_zod4.z.string().optional(),
+  /** When the overage window resets, in unix epoch seconds. */
+  overageResetsAt: import_zod4.z.number().optional(),
+  /** Each subscription window the account's response headers carried: the session (five-hour), weekly (seven-day), and overage-included weekly windows, each present only when the account's responses carry it. */
+  unifiedWindows: import_zod4.z.looseObject({ five_hour: RcRateLimitWindowSchema.optional(), seven_day: RcRateLimitWindowSchema.optional(), seven_day_overage_included: RcRateLimitWindowSchema.optional() }).optional()
+});
+var RcLiveRateLimitSchema = import_zod4.z.strictObject({
+  session: import_zod4.z.string(),
+  observedAt: import_zod4.z.number(),
+  rateLimit: RcRateLimitInfoSchema
+});
 var RcSessionQuerySchema = import_zod4.z.strictObject({
   session: import_zod4.z.string().min(1).optional()
 });
@@ -9983,6 +10018,12 @@ var UsageWindowsOutputSchema = import_zod19.z.strictObject({
   fiveHour: EffectiveWindowSchema.optional(),
   sevenDay: EffectiveWindowSchema.optional()
 });
+var UsageLiveOutputSchema = import_zod19.z.strictObject({
+  /** The freshest observation the door holds, never narrowed by the read's session filter because it is the door's single latest statement of the account's quota; absent while no rate_limit_event has been filed at all. */
+  latest: RcLiveRateLimitSchema.optional(),
+  /** One observation per session whose stream has filed a rate_limit_event this door generation. */
+  sessions: import_zod19.z.readonly(import_zod19.z.array(RcLiveRateLimitSchema))
+});
 var FrontDoorSessionStatusSchema = import_zod19.z.strictObject({
   pid: import_zod19.z.int().positive(),
   startedAt: import_zod19.z.number(),
@@ -10097,6 +10138,16 @@ function createControlApiRouter(deps) {
           ...unified?.fiveHour === void 0 ? {} : { fiveHour: effectiveWindow(unified.fiveHour, now) },
           ...unified?.sevenDay === void 0 ? {} : { sevenDay: effectiveWindow(unified.sevenDay, now) }
         };
+      }),
+      live: authed.input(RcSessionQuerySchema).output(UsageLiveOutputSchema).handler(({ input }) => {
+        const sessions = deps.liveRateLimits(input.session);
+        if (input.session !== void 0 && sessions.length === 0) {
+          if (deps.list().some((session) => session.id === input.session)) {
+            throw new import_client3.ORPCError("NOT_FOUND", { message: `session ${input.session} has filed no rate_limit_event on its stream yet: the worker emits one only once a turn has completed, so retry after this session's next turn` });
+          }
+          throw new import_client3.ORPCError("NOT_FOUND", { message: rcSessionNotObservedMessage(input.session) });
+        }
+        return { latest: deps.latestRateLimit(), sessions };
       })
     },
     frontdoor: {
@@ -10317,6 +10368,42 @@ function createLaunchEventPublisher(hub, now) {
   };
 }
 
+// src/frontdoor/rcLiveUsage.ts
+var RC_RATE_LIMIT_EVENT_TYPE = "rate_limit_event";
+function isRecord5(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function rcRateLimitInfoOf(event) {
+  const payload = event.envelope.payload;
+  if (!isRecord5(payload) || payload.type !== RC_RATE_LIMIT_EVENT_TYPE) {
+    return void 0;
+  }
+  if (!isRecord5(payload.rate_limit_info)) {
+    return void 0;
+  }
+  const parsed = RcRateLimitInfoSchema.safeParse(payload.rate_limit_info);
+  return parsed.success ? parsed.data : void 0;
+}
+function createRcLiveUsage(deps) {
+  const observed = /* @__PURE__ */ new Map();
+  deps.hub.subscribe([DOOR_EVENT_SOURCE_RC], (event) => {
+    const stream = RcStreamEventSchema.safeParse(event.payload);
+    if (!stream.success) {
+      return;
+    }
+    const rateLimit = rcRateLimitInfoOf(stream.data);
+    if (rateLimit === void 0) {
+      return;
+    }
+    observed.set(stream.data.session, { session: stream.data.session, observedAt: deps.now(), rateLimit });
+  });
+  const sorted = () => [...observed.values()].sort((left, right) => left.observedAt - right.observedAt || (left.session < right.session ? -1 : 1));
+  return {
+    liveOf: (sessionId) => sorted().filter((entry) => sessionId === void 0 || entry.session === sessionId),
+    latestOf: () => sorted().at(-1)
+  };
+}
+
 // src/frontdoor/rcStream.ts
 var RC_STREAM_EVENT_NAME = "client_event";
 var SSE_BYTE_ORDER_MARK = 65279;
@@ -10379,7 +10466,7 @@ function createSseParser() {
     }
   };
 }
-function isRecord5(value) {
+function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function sequenceNumOf(value) {
@@ -10401,7 +10488,7 @@ function parseRcStreamEnvelope(parsed) {
   } catch {
     return void 0;
   }
-  if (!isRecord5(data)) {
+  if (!isRecord6(data)) {
     return void 0;
   }
   const eventType = data.event_type;
@@ -10632,7 +10719,7 @@ function createRcStreamHub(deps) {
 // src/frontdoor/rcSelfHostEndpoints.ts
 var RC_SOURCE_WORKER = "worker";
 var RC_SOURCE_CLIENT = "client";
-function isRecord6(value) {
+function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseJsonObject2(body) {
@@ -10642,7 +10729,7 @@ function parseJsonObject2(body) {
   } catch {
     return void 0;
   }
-  return isRecord6(parsed) ? parsed : void 0;
+  return isRecord7(parsed) ? parsed : void 0;
 }
 function nonEmptyString2(record, field) {
   const value = record === void 0 ? void 0 : record[field];
@@ -10675,7 +10762,7 @@ function pageOfRcChannel(url, rows, idOf, rowOf) {
   return { data: page.map(rowOf), ...last === void 0 ? {} : { next_cursor: idOf(last) } };
 }
 async function serveRcClientChannels(ctx, tail, method, maxBatchEvents) {
-  const { request: request4, response, session } = ctx;
+  const { request: request4, response, host } = ctx;
   if (tail === "client/presence" && method === "POST") {
     const body = parseJsonObject2(await ctx.readBody(request4.body, CONTROL_BODY_CAP_BYTES));
     const clientId = nonEmptyString2(body, "client_id");
@@ -10685,11 +10772,11 @@ async function serveRcClientChannels(ctx, tail, method, maxBatchEvents) {
       return true;
     }
     if (clear === true) {
-      session.clients.delete(clientId);
-      ctx.log?.(`rc selfhost ${session.id}: client ${clientId} cleared its presence`);
+      host.clients.delete(clientId);
+      ctx.log?.(`rc selfhost ${host.id}: client ${clientId} cleared its presence`);
     } else {
-      session.clients.set(clientId, ctx.now());
-      ctx.log?.(`rc selfhost ${session.id}: client ${clientId} announced its presence${session.clients.size === 1 ? "" : ` (${String(session.clients.size)} clients now announced)`}`);
+      host.clients.set(clientId, ctx.now());
+      ctx.log?.(`rc selfhost ${host.id}: client ${clientId} announced its presence${host.clients.size === 1 ? "" : ` (${String(host.clients.size)} clients now announced)`}`);
     }
     await ctx.answerJson(response, HTTP_STATUS.ok, { refresh_after_seconds: ctx.presenceRefreshSeconds });
     return true;
@@ -10702,8 +10789,8 @@ async function serveRcClientChannels(ctx, tail, method, maxBatchEvents) {
       await ctx.answerJson(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "a read receipt is JSON naming the event_id it read or none for the whole session, and client_id only as a non-empty string or absent" } });
       return true;
     }
-    const receipt = ctx.publish(session, clientId ?? RC_SOURCE_CLIENT, { type: "mark_read", ...eventId === void 0 ? {} : { event_id: eventId }, ...clientId === void 0 ? {} : { client_id: clientId } }, true);
-    ctx.log?.(`rc selfhost ${session.id}: ${clientId === void 0 ? "an unnamed client" : `client ${clientId}`} marked ${eventId === void 0 ? "the session read" : `event ${eventId} read`} as sequence ${String(receipt.sequenceNum)}`);
+    const receipt = ctx.publish(host.conversation, host.writer, clientId ?? RC_SOURCE_CLIENT, { type: "mark_read", ...eventId === void 0 ? {} : { event_id: eventId }, ...clientId === void 0 ? {} : { client_id: clientId } });
+    ctx.log?.(`rc selfhost ${host.id}: ${clientId === void 0 ? "an unnamed client" : `client ${clientId}`} marked ${eventId === void 0 ? "the session read" : `event ${eventId} read`} as sequence ${String(receipt.sequenceNum)}`);
     await ctx.answerJson(response, HTTP_STATUS.ok, {});
     return true;
   }
@@ -10716,20 +10803,20 @@ async function serveRcClientChannels(ctx, tail, method, maxBatchEvents) {
     }
     const results = [];
     for (const event of events) {
-      if (!isRecord6(event) || !isRecord6(event.payload)) {
+      if (!isRecord7(event) || !isRecord7(event.payload)) {
         await ctx.answerJson(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "every event in a teleport write is an object carrying one payload object" } });
         return true;
       }
-      const published = ctx.publish(session, RC_SOURCE_CLIENT, event.payload);
+      const published = ctx.publish(host.conversation, host.writer, RC_SOURCE_CLIENT, event.payload);
       results.push({ sequence_num: String(published.sequenceNum), duplicate: published.duplicate });
     }
     ctx.sweep();
-    ctx.log?.(`rc selfhost ${session.id}: teleport write published ${String(results.length)} marker event(s)`);
+    ctx.log?.(`rc selfhost ${host.id}: teleport write published ${String(results.length)} marker event(s)`);
     await ctx.answerJson(response, HTTP_STATUS.ok, { results });
     return true;
   }
   if (tail === "teleport-events" && method === "GET") {
-    const page = pageOfRcChannel(request4.url, session.events, (event) => event.eventId, (event) => ({ event_id: event.eventId, payload: event.payload }));
+    const page = pageOfRcChannel(request4.url, host.conversation.events, (event) => event.eventId, (event) => ({ event_id: event.eventId, payload: event.payload }));
     if ("error" in page) {
       await ctx.answerJson(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: page.error } });
       return true;
@@ -10805,10 +10892,7 @@ async function serveRcCompatSessions(ctx, pathname, compatPath) {
       await ctx.answerJson(response, HTTP_STATUS.ok, compatSessionRow(session, ctx.now));
       return;
     }
-    for (const sink of [...session.workerStreams, ...session.clientStreams]) {
-      sink.retire();
-    }
-    ctx.sessions.delete(session.id);
+    ctx.retireSession(session);
     ctx.log?.(`rc selfhost ${session.id}: archived through the compatibility family`);
     await ctx.answerJson(response, HTTP_STATUS.ok, {});
     return;
@@ -10816,6 +10900,202 @@ async function serveRcCompatSessions(ctx, pathname, compatPath) {
   await ctx.answerJson(response, HTTP_STATUS.notFound, { type: "error", error: { type: "api_error", message: `the compatibility session family serves no path "${compatTail}"` } });
 }
 
+// src/frontdoor/rcSelfHostConversations.ts
+var RC_CONVERSATIONS_PATH_PREFIX = "/v1/code/conversations";
+var RC_CONVERSATION_ID_PREFIX = "conv_";
+function isRecord8(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseJsonObject3(body) {
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return void 0;
+  }
+  return isRecord8(parsed) ? parsed : void 0;
+}
+function nonEmptyString3(record, field) {
+  const value = record === void 0 ? void 0 : record[field];
+  return typeof value === "string" && value !== "" ? value : void 0;
+}
+function newRcSelfHostConversation(newUuid, now) {
+  return { id: `${RC_CONVERSATION_ID_PREFIX}${newUuid()}`, createdAt: now(), sequenceNum: 0, events: [], seenPayloadUuids: /* @__PURE__ */ new Set(), workerStreams: /* @__PURE__ */ new Set(), clientStreams: /* @__PURE__ */ new Set(), clients: /* @__PURE__ */ new Map(), sessionIds: /* @__PURE__ */ new Set(), lastTrafficAt: now() };
+}
+function conversationRow(conversation) {
+  return { id: conversation.id, created_at: new Date(conversation.createdAt).toISOString(), updated_at: new Date(conversation.lastTrafficAt).toISOString(), sessions: [...conversation.sessionIds] };
+}
+async function serveRcConversations(ctx, pathname, method) {
+  const { request: request4, response, conversations } = ctx;
+  const refusal = ctx.credentialRefusal(request4.headers);
+  if (refusal !== void 0) {
+    await ctx.unauthorized(response, refusal);
+    return;
+  }
+  if (pathname === RC_CONVERSATIONS_PATH_PREFIX) {
+    if (method !== "GET") {
+      await ctx.answerJson(response, HTTP_STATUS.methodNotAllowed, { type: "error", error: { type: "api_error", message: "the conversation collection is a GET; a conversation is born from a session create, never here" } });
+      return;
+    }
+    await ctx.answerJson(response, HTTP_STATUS.ok, { data: [...conversations.values()].sort((left, right) => left.createdAt - right.createdAt || (left.id < right.id ? -1 : 1)).map(conversationRow) });
+    return;
+  }
+  const rest = pathname.slice(`${RC_CONVERSATIONS_PATH_PREFIX}/`.length);
+  const slash = rest.indexOf("/");
+  const conversationId = slash === -1 ? rest : rest.slice(0, slash);
+  const tail = slash === -1 ? "" : rest.slice(slash + 1);
+  if (!conversationId.startsWith(RC_CONVERSATION_ID_PREFIX)) {
+    await ctx.answerJson(response, HTTP_STATUS.notFound, { type: "error", error: { type: "api_error", message: "the conversation family names one conv_-prefixed conversation id" } });
+    return;
+  }
+  const conversation = conversations.get(conversationId);
+  if (conversation === void 0) {
+    await ctx.answerJson(response, HTTP_STATUS.notFound, { type: "error", error: { type: "api_error", message: "no such Remote Control conversation on this door" } });
+    return;
+  }
+  conversation.lastTrafficAt = ctx.now();
+  if (tail === "" && method === "GET") {
+    await ctx.answerJson(response, HTTP_STATUS.ok, { conversation: conversationRow(conversation) });
+    return;
+  }
+  if (tail === "events" && method === "POST") {
+    const body = parseJsonObject3(await ctx.readBody(request4.body, CONTROL_BODY_CAP_BYTES));
+    const events = body?.events;
+    if (!Array.isArray(events) || events.length === 0 || events.length > ctx.maxBatchEvents) {
+      await ctx.answerJson(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: `a client event write is a non-empty array of at most ${String(ctx.maxBatchEvents)} events` } });
+      return;
+    }
+    const results = [];
+    for (const event of events) {
+      if (!isRecord8(event) || !isRecord8(event.payload)) {
+        await ctx.answerJson(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "every event in a write is an object carrying one payload object" } });
+        return;
+      }
+      const published = ctx.publish(conversation, { session: void 0, half: "client" }, RC_SOURCE_CLIENT, event.payload);
+      results.push({ sequence_num: String(published.sequenceNum), duplicate: published.duplicate });
+    }
+    ctx.sweep();
+    ctx.log?.(`rc selfhost ${conversation.id}: a conversation client wrote ${String(results.length)} event(s) into the shared space`);
+    await ctx.answerJson(response, HTTP_STATUS.ok, { results });
+    return;
+  }
+  if (tail === "events" && method === "GET") {
+    await ctx.answerJson(response, HTTP_STATUS.ok, { data: conversation.events.map((event) => ({ event_id: event.eventId, event_type: nonEmptyString3(event.payload, "type") ?? "event", sequence_num: event.sequenceNum, source: event.source, payload: event.payload, created_at: event.createdAt })) });
+    return;
+  }
+  if (tail === "events/stream" && method === "GET") {
+    await ctx.holdStream(conversation, conversation.id, "clientStreams", () => true, request4, response);
+    return;
+  }
+  if (await serveRcClientChannels({ request: request4, response, host: { id: conversation.id, clients: conversation.clients, conversation, writer: { session: void 0, half: "client" } }, answerJson: ctx.answerJson, readBody: ctx.readBody, publish: ctx.publish, sweep: ctx.sweep, now: ctx.now, presenceRefreshSeconds: ctx.presenceRefreshSeconds, ...ctx.log === void 0 ? {} : { log: ctx.log } }, tail, method, ctx.maxBatchEvents)) {
+    return;
+  }
+  await ctx.answerJson(response, HTTP_STATUS.notFound, { type: "error", error: { type: "api_error", message: `the conversation family serves no path "${tail}"` } });
+}
+
+// src/frontdoor/rcSelfHostLocal.ts
+var RC_SELF_HOST_OAUTH_HOST = "platform.claude.com";
+var RC_SELF_HOST_SCOPE_LIST = ["user:profile", "user:inference", "user:sessions:claude_code", "user:mcp_servers", "user:file_upload"];
+var RC_SELF_HOST_OAUTH_TOKEN_TTL_SECONDS = 3600;
+var MS_PER_SECOND5 = 1e3;
+var HTTP_SERVICE_UNAVAILABLE = 503;
+function isRecord9(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseJsonObject4(body) {
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return void 0;
+  }
+  return isRecord9(parsed) ? parsed : void 0;
+}
+function growthBookFeatures() {
+  return {
+    tengu_ccr_bridge: { defaultValue: true },
+    tengu_bridge_repl_v2: { defaultValue: true },
+    tengu_bridge_repl_v2_cse_shim_enabled: { defaultValue: true },
+    tengu_bridge_min_version: { defaultValue: { minVersion: "0.0.0" } }
+  };
+}
+var answerServerJson = (response, status, body) => {
+  const text = JSON.stringify(body);
+  response.writeHead(status, { "content-type": "application/json", "content-length": String(Buffer.byteLength(text, "utf8")) });
+  response.end(text);
+};
+function createRcSelfHostLocal(deps) {
+  return {
+    parsesHost: (host) => host === RC_SELF_HOST_OAUTH_HOST,
+    serve: async (host, request4, response) => {
+      const method = (request4.method ?? "").toUpperCase();
+      const pathname = new URL(request4.url ?? "/", "http://127.0.0.1").pathname;
+      if (host === RC_SELF_HOST_OAUTH_HOST) {
+        if (method === "POST" && pathname === "/v1/oauth/token") {
+          const body = parseJsonObject4(await deps.readBody(request4, CONTROL_BODY_CAP_BYTES));
+          const record = deps.credentialRecord();
+          if (record === void 0) {
+            answerServerJson(response, HTTP_SERVICE_UNAVAILABLE, { error: "the front door's self-hosted Remote Control surface is on but no credential has been minted for it" });
+            return true;
+          }
+          if (body?.grant_type !== void 0 && body.grant_type !== "refresh_token") {
+            answerServerJson(response, HTTP_STATUS.badRequest, { error: "unsupported_grant_type" });
+            return true;
+          }
+          answerServerJson(response, HTTP_STATUS.ok, { access_token: record.accessToken, refresh_token: record.refreshToken, expires_in: RC_SELF_HOST_OAUTH_TOKEN_TTL_SECONDS, scope: RC_SELF_HOST_SCOPE_LIST.join(" ") });
+          return true;
+        }
+        if (method === "GET" && pathname === "/v1/oauth/hello") {
+          answerServerJson(response, HTTP_STATUS.ok, {});
+          return true;
+        }
+        return false;
+      }
+      if (method === "POST" && pathname.startsWith("/api/eval/")) {
+        await deps.readBody(request4, CONTROL_BODY_CAP_BYTES);
+        answerServerJson(response, HTTP_STATUS.ok, { features: growthBookFeatures(), dateUpdated: Math.floor(deps.now() / MS_PER_SECOND5) });
+        return true;
+      }
+      if (method === "GET" && pathname === "/api/oauth/profile") {
+        const record = deps.credentialRecord();
+        if (record === void 0) {
+          answerServerJson(response, HTTP_SERVICE_UNAVAILABLE, { error: "the front door's self-hosted Remote Control surface is on but no credential has been minted for it" });
+          return true;
+        }
+        answerServerJson(response, HTTP_STATUS.ok, {
+          account: { uuid: record.accountUuid, display_name: "agent-shim self-hosted", created_at: (/* @__PURE__ */ new Date(0)).toISOString() },
+          organization: { uuid: record.organizationUuid, organization_type: "claude_max" }
+        });
+        return true;
+      }
+      if (method === "GET" && pathname === "/api/claude_code/policy_limits") {
+        answerServerJson(response, HTTP_STATUS.ok, {});
+        return true;
+      }
+      if (method === "POST" && pathname === "/api/oauth/validate") {
+        await deps.readBody(request4, CONTROL_BODY_CAP_BYTES);
+        const record = deps.credentialRecord();
+        if (record === void 0) {
+          answerServerJson(response, HTTP_SERVICE_UNAVAILABLE, { error: "the front door's self-hosted Remote Control surface is on but no credential has been minted for it" });
+          return true;
+        }
+        answerServerJson(response, HTTP_STATUS.ok, { scopes: [...RC_SELF_HOST_SCOPE_LIST], expiresAt: null, subscriptionType: "max", account_uuid: record.accountUuid, organization_uuid: record.organizationUuid });
+        return true;
+      }
+      if (method === "POST" && (pathname === "/api/event_logging/v2/batch" || pathname === "/api/claude_code/metrics" || pathname === "/api/claude_cli_feedback")) {
+        await deps.readBody(request4, CONTROL_BODY_CAP_BYTES);
+        answerServerJson(response, HTTP_STATUS.ok, {});
+        return true;
+      }
+      if (method === "GET" && pathname === "/api/hello") {
+        answerServerJson(response, HTTP_STATUS.ok, {});
+        return true;
+      }
+      return false;
+    }
+  };
+}
+
 // src/frontdoor/rcWebFetch.ts
 var dns2 = __toESM(require("node:dns"), 1);
 var http2 = __toESM(require("node:http"), 1);
@@ -11067,17 +11347,14 @@ var RC_SELF_HOST_ENV = "AGENT_SHIM_FRONTDOOR_RC_SELF_HOST";
 function rcSelfHostFromEnv(env) {
   return env[RC_SELF_HOST_ENV] === "1";
 }
-var RC_SELF_HOST_SCOPE_LIST = ["user:profile", "user:inference", "user:sessions:claude_code", "user:mcp_servers", "user:file_upload"];
 var RC_SESSIONS_PATH_PREFIX2 = "/v1/code/sessions";
 var RC_COMPAT_SESSIONS_PATH = "/v1/sessions";
 var RC_SESSION_ID_PREFIX2 = "cse_";
 var RC_SELF_HOST_API_BASE_URL = "https://api.anthropic.com";
-var RC_SELF_HOST_OAUTH_HOST = "platform.claude.com";
 var HTTP_CONFLICT = 409;
-var MS_PER_SECOND5 = 1e3;
-var HTTP_SERVICE_UNAVAILABLE = 503;
+var MS_PER_SECOND6 = 1e3;
+var HTTP_SERVICE_UNAVAILABLE2 = 503;
 var RC_SELF_HOST_WORKER_JWT_TTL_SECONDS = 46800;
-var RC_SELF_HOST_OAUTH_TOKEN_TTL_SECONDS = 3600;
 var RC_SELF_HOST_KEEPALIVE_MS = 15e3;
 var RC_SELF_HOST_RETENTION_MS = 6e5;
 var RC_PRESENCE_REFRESH_SECONDS = 60;
@@ -11086,13 +11363,13 @@ var RC_SELF_HOST_WORKER_EPOCH = 1;
 var RC_STREAM_EVENT_NAME2 = "client_event";
 var CONFLICT_REASON_HEADER2 = "x-ccr-conflict-reason";
 var CONFLICT_REASON_EPOCH_STALE = "epoch_stale";
-function isRecord7(value) {
+function isRecord10(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isWebSearchRefusal(value) {
   return !Array.isArray(value);
 }
-function nonEmptyString3(record, field) {
+function nonEmptyString4(record, field) {
   const value = record === void 0 ? void 0 : record[field];
   return typeof value === "string" && value !== "" ? value : void 0;
 }
@@ -11163,56 +11440,69 @@ async function readBody2(request4, capBytes) {
     });
   });
 }
-function parseJsonObject3(body) {
+function parseJsonObject5(body) {
   let parsed;
   try {
     parsed = JSON.parse(body);
   } catch {
     return void 0;
   }
-  return isRecord7(parsed) ? parsed : void 0;
+  return isRecord10(parsed) ? parsed : void 0;
 }
 function mintWorkerJwt(randomToken, issuedAt) {
   const encode = (value) => Buffer.from(JSON.stringify(value), "utf8").toString("base64url");
   const header = encode({ alg: "HS256", typ: "JWT" });
-  const payload = encode({ exp: Math.floor((issuedAt + RC_SELF_HOST_WORKER_JWT_TTL_SECONDS * MS_PER_SECOND5) / MS_PER_SECOND5), iat: Math.floor(issuedAt / MS_PER_SECOND5) });
+  const payload = encode({ exp: Math.floor((issuedAt + RC_SELF_HOST_WORKER_JWT_TTL_SECONDS * MS_PER_SECOND6) / MS_PER_SECOND6), iat: Math.floor(issuedAt / MS_PER_SECOND6) });
   return `${header}.${payload}.${Buffer.from(randomToken(), "utf8").toString("base64url")}`;
 }
-function growthBookFeatures() {
-  return {
-    tengu_ccr_bridge: { defaultValue: true },
-    tengu_bridge_repl_v2: { defaultValue: true },
-    tengu_bridge_repl_v2_cse_shim_enabled: { defaultValue: true },
-    tengu_bridge_min_version: { defaultValue: { minVersion: "0.0.0" } }
-  };
-}
 function createRcSelfHostSurface(deps) {
   const sessions = /* @__PURE__ */ new Map();
+  const conversations = /* @__PURE__ */ new Map();
+  const retireSession = (session) => {
+    for (const sink of [...session.conversation.workerStreams, ...session.conversation.clientStreams]) {
+      if (sink.owner === session.id) {
+        sink.retire();
+      }
+    }
+    session.conversation.sessionIds.delete(session.id);
+    sessions.delete(session.id);
+  };
   const sweep = () => {
     const now = deps.now();
     for (const session of sessions.values()) {
-      while (session.events[0] !== void 0 && now - session.events[0].storedAt > RC_SELF_HOST_RETENTION_MS) {
-        const dropped = session.events.shift();
-        const uuid = dropped === void 0 ? void 0 : nonEmptyString3(dropped.payload, "uuid");
+      for (const [clientId, lastSeenAt] of session.clients) {
+        if (now - lastSeenAt > RC_SELF_HOST_RETENTION_MS) {
+          session.clients.delete(clientId);
+        }
+      }
+      const holdsStream = [...session.conversation.workerStreams, ...session.conversation.clientStreams].some((sink) => sink.owner === session.id);
+      if (!holdsStream && now - session.lastTrafficAt > RC_SELF_HOST_RETENTION_MS) {
+        retireSession(session);
+      }
+    }
+    for (const conversation of conversations.values()) {
+      while (conversation.events[0] !== void 0 && now - conversation.events[0].storedAt > RC_SELF_HOST_RETENTION_MS) {
+        const dropped = conversation.events.shift();
+        const uuid = dropped === void 0 ? void 0 : nonEmptyString4(dropped.payload, "uuid");
         if (uuid !== void 0) {
-          session.seenPayloadUuids.delete(uuid);
+          conversation.seenPayloadUuids.delete(uuid);
         }
       }
-      for (const [clientId, lastSeenAt] of session.clients) {
+      for (const [clientId, lastSeenAt] of conversation.clients) {
         if (now - lastSeenAt > RC_SELF_HOST_RETENTION_MS) {
-          session.clients.delete(clientId);
+          conversation.clients.delete(clientId);
         }
       }
-      if (session.workerStreams.size === 0 && session.clientStreams.size === 0 && now - session.lastTrafficAt > RC_SELF_HOST_RETENTION_MS) {
-        sessions.delete(session.id);
+      if (conversation.sessionIds.size === 0 && conversation.workerStreams.size === 0 && conversation.clientStreams.size === 0 && now - conversation.lastTrafficAt > RC_SELF_HOST_RETENTION_MS) {
+        conversations.delete(conversation.id);
       }
     }
   };
   const timer = setInterval(sweep, RC_SELF_HOST_RETENTION_MS);
   timer.unref();
   const keepalive = setInterval(() => {
-    for (const session of sessions.values()) {
-      for (const sink of [...session.workerStreams, ...session.clientStreams]) {
+    for (const conversation of conversations.values()) {
+      for (const sink of [...conversation.workerStreams, ...conversation.clientStreams]) {
         sink.write(": keep-alive\n\n");
       }
     }
@@ -11241,7 +11531,7 @@ function createRcSelfHostSurface(deps) {
   const frameOf = (event) => {
     const envelope = {
       event_id: event.eventId,
-      event_type: nonEmptyString3(event.payload, "type") ?? "event",
+      event_type: nonEmptyString4(event.payload, "type") ?? "event",
       sequence_num: event.sequenceNum,
       source: event.source,
       payload: event.payload,
@@ -11253,14 +11543,16 @@ data: ${JSON.stringify(envelope)}
 
 `;
   };
-  const holdStream = async (session, which, wantsReplay, request4, response) => {
+  const reachesWorkerStream = (event, owner) => !(event.writer.half === "worker" && event.writer.session === owner);
+  const holdStream = async (conversation, owner, which, wantsReplay, request4, response) => {
     const url = new URL(request4.url, "http://127.0.0.1");
     const cursor = numberOf2({ value: url.searchParams.get("from_sequence_num") }, "value") ?? numberOf2({ value: singleHeader2(request4.headers, "last-event-id") }, "value");
-    const replay = cursor === void 0 ? [] : session.events.filter((event) => wantsReplay(event) && event.sequenceNum > cursor);
+    const replay = cursor === void 0 ? [] : conversation.events.filter((event) => wantsReplay(event) && event.sequenceNum > cursor);
     response.start(HTTP_STATUS.ok, { "content-type": "text/event-stream", "cache-control": "no-cache" });
     response.flush();
     let pending = Promise.resolve();
     const sink = {
+      owner,
       write: (frame) => {
         pending = pending.then(async () => {
           await response.write(frame);
@@ -11268,11 +11560,11 @@ data: ${JSON.stringify(envelope)}
         });
       },
       retire: () => {
-        session[which].delete(sink);
+        conversation[which].delete(sink);
       }
     };
-    session[which].add(sink);
-    session.lastTrafficAt = deps.now();
+    conversation[which].add(sink);
+    conversation.lastTrafficAt = deps.now();
     for (const event of replay) {
       sink.write(frameOf(event));
     }
@@ -11284,36 +11576,37 @@ data: ${JSON.stringify(envelope)}
     sink.retire();
     response.end();
   };
-  const publish = (session, source, payload, toWorker = source === RC_SOURCE_CLIENT) => {
-    const uuid = nonEmptyString3(payload, "uuid");
-    const duplicate = uuid !== void 0 && session.seenPayloadUuids.has(uuid);
-    session.sequenceNum += 1;
+  const publish = (conversation, writer, source, payload) => {
+    const uuid = nonEmptyString4(payload, "uuid");
+    const duplicate = uuid !== void 0 && conversation.seenPayloadUuids.has(uuid);
+    conversation.sequenceNum += 1;
     const event = {
-      sequenceNum: session.sequenceNum,
+      sequenceNum: conversation.sequenceNum,
       eventId: uuid ?? deps.newUuid(),
       source,
       // The one enrichment the real service was observed making on the live rig's stream: the wall-clock instant it took the write. The worker's handler ignores it; the door's own parser forwards it verbatim.
       payload: source === RC_SOURCE_WORKER ? payload : { ...payload, server_received_wall_ms: deps.now() },
       createdAt: new Date(deps.now()).toISOString(),
-      toWorker,
+      writer,
       storedAt: deps.now()
     };
-    session.events.push(event);
+    conversation.events.push(event);
     if (uuid !== void 0) {
-      session.seenPayloadUuids.add(uuid);
+      conversation.seenPayloadUuids.add(uuid);
     }
-    session.lastTrafficAt = event.storedAt;
+    conversation.lastTrafficAt = event.storedAt;
     const frame = frameOf(event);
-    if (event.toWorker) {
-      for (const sink of [...session.workerStreams]) {
+    for (const sink of [...conversation.workerStreams]) {
+      if (reachesWorkerStream(event, sink.owner)) {
         sink.write(frame);
       }
     }
-    for (const sink of [...session.clientStreams]) {
+    for (const sink of [...conversation.clientStreams]) {
       sink.write(frame);
     }
     return { sequenceNum: event.sequenceNum, eventId: event.eventId, duplicate };
   };
+  const sessionRow = (session) => ({ id: session.id, title: session.title, created_at: new Date(session.createdAt).toISOString(), status: "active", conversation_id: session.conversation.id });
   const answerJson2 = async (response, status, body, extraHeaders = {}) => {
     const text = JSON.stringify(body);
     response.start(status, { "content-type": "application/json", "content-length": String(Buffer.byteLength(text, "utf8")), ...extraHeaders });
@@ -11321,7 +11614,7 @@ data: ${JSON.stringify(envelope)}
     response.end();
   };
   const noCredential = async (response) => {
-    await answerJson2(response, HTTP_SERVICE_UNAVAILABLE, { type: "error", error: { type: "api_error", message: "the front door's self-hosted Remote Control surface is on but no credential has been minted for it; run agent-shim frontdoor rc selfhost mint first" } });
+    await answerJson2(response, HTTP_SERVICE_UNAVAILABLE2, { type: "error", error: { type: "api_error", message: "the front door's self-hosted Remote Control surface is on but no credential has been minted for it; run agent-shim frontdoor rc selfhost mint first" } });
   };
   const epochStale = async (response) => {
     await answerJson2(response, HTTP_CONFLICT, { type: "error", error: { type: "api_error", message: "worker_epoch does not match the session's live epoch" } }, { [CONFLICT_REASON_HEADER2]: CONFLICT_REASON_EPOCH_STALE });
@@ -11349,8 +11642,8 @@ data: ${JSON.stringify(envelope)}
           await unauthorized(response, refusal);
           return;
         }
-        const body = parseJsonObject3(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
-        const title = nonEmptyString3(body, "title");
+        const body = parseJsonObject5(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
+        const title = nonEmptyString4(body, "title");
         if (title === void 0) {
           await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "a session update is JSON naming a non-empty title" } });
           return;
@@ -11365,7 +11658,7 @@ data: ${JSON.stringify(envelope)}
         await answerJson2(response, HTTP_STATUS.methodNotAllowed, { type: "error", error: { type: "api_error", message: "the session read is a GET, and its update a PATCH or PUT" } });
         return;
       }
-      await answerJson2(response, HTTP_STATUS.ok, { session: { id: session.id, title: session.title, created_at: new Date(session.createdAt).toISOString(), status: "active" } });
+      await answerJson2(response, HTTP_STATUS.ok, { session: sessionRow(session) });
       return;
     }
     if (tail === "bridge" && method === "POST") {
@@ -11386,10 +11679,7 @@ data: ${JSON.stringify(envelope)}
         await unauthorized(response, refusal);
         return;
       }
-      for (const sink of [...session.workerStreams, ...session.clientStreams]) {
-        sink.retire();
-      }
-      sessions.delete(session.id);
+      retireSession(session);
       deps.log?.(`rc selfhost ${session.id}: archived at its client's request`);
       await answerJson2(response, HTTP_STATUS.ok, {});
       return;
@@ -11407,17 +11697,17 @@ data: ${JSON.stringify(envelope)}
         return;
       }
       if (workerTail === "" && method === "PUT") {
-        const body = parseJsonObject3(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
+        const body = parseJsonObject5(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
         const claimedEpoch = numberOf2(body, "worker_epoch");
         if (claimedEpoch !== void 0 && claimedEpoch !== RC_SELF_HOST_WORKER_EPOCH) {
           await epochStale(response);
           return;
         }
-        const status = nonEmptyString3(body, "worker_status");
+        const status = nonEmptyString4(body, "worker_status");
         if (status !== void 0) {
           session.workerStatus = status;
         }
-        if (isRecord7(body?.external_metadata)) {
+        if (isRecord10(body?.external_metadata)) {
           session.externalMetadata = body.external_metadata;
         }
         await answerJson2(response, HTTP_STATUS.ok, {});
@@ -11434,7 +11724,7 @@ data: ${JSON.stringify(envelope)}
         return;
       }
       if (workerTail === "events" && method === "POST") {
-        const body = parseJsonObject3(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
+        const body = parseJsonObject5(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
         const claimedEpoch = numberOf2(body, "worker_epoch");
         if (claimedEpoch !== void 0 && claimedEpoch !== RC_SELF_HOST_WORKER_EPOCH) {
           await epochStale(response);
@@ -11447,11 +11737,11 @@ data: ${JSON.stringify(envelope)}
         }
         const results = [];
         for (const event of events) {
-          if (!isRecord7(event) || !isRecord7(event.payload)) {
+          if (!isRecord10(event) || !isRecord10(event.payload)) {
             await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "every event in a batch is an object carrying one payload object" } });
             return;
           }
-          const published = publish(session, RC_SOURCE_WORKER, event.payload);
+          const published = publish(session.conversation, { session: session.id, half: "worker" }, RC_SOURCE_WORKER, event.payload);
           results.push({ event_id: published.eventId, sequence_num: String(published.sequenceNum) });
         }
         sweep();
@@ -11459,7 +11749,7 @@ data: ${JSON.stringify(envelope)}
         return;
       }
       if (workerTail === "events/stream" && method === "GET") {
-        await holdStream(session, "workerStreams", (event) => event.toWorker, request4, response);
+        await holdStream(session.conversation, session.id, "workerStreams", (event) => reachesWorkerStream(event, session.id), request4, response);
         return;
       }
       if (workerTail === "events/delivery" && method === "POST") {
@@ -11468,7 +11758,7 @@ data: ${JSON.stringify(envelope)}
         return;
       }
       if (workerTail === "internal-events" && method === "POST") {
-        const body = parseJsonObject3(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
+        const body = parseJsonObject5(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
         const claimedEpoch = numberOf2(body, "worker_epoch");
         if (claimedEpoch !== void 0 && claimedEpoch !== RC_SELF_HOST_WORKER_EPOCH) {
           await epochStale(response);
@@ -11480,7 +11770,7 @@ data: ${JSON.stringify(envelope)}
           return;
         }
         for (const event of events) {
-          if (isRecord7(event)) {
+          if (isRecord10(event)) {
             session.internalEvents.push({ eventId: deps.newUuid(), body: event });
           }
         }
@@ -11508,8 +11798,8 @@ data: ${JSON.stringify(envelope)}
         return;
       }
       if (workerTail === "web-fetch" && method === "POST") {
-        const body = parseJsonObject3(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
-        const target = nonEmptyString3(body, "url");
+        const body = parseJsonObject5(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
+        const target = nonEmptyString4(body, "url");
         if (target === void 0) {
           await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "a worker web-fetch carries one url" } });
           return;
@@ -11531,8 +11821,8 @@ data: ${JSON.stringify(envelope)}
         return;
       }
       if (workerTail === "web-search" && method === "POST") {
-        const body = parseJsonObject3(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
-        const query = nonEmptyString3(body, "query");
+        const body = parseJsonObject5(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
+        const query = nonEmptyString4(body, "query");
         if (query === void 0) {
           await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "a worker web-search carries one query" } });
           return;
@@ -11543,7 +11833,7 @@ data: ${JSON.stringify(envelope)}
           await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "the domain filters of a worker web-search are string arrays" } });
           return;
         }
-        const searchProfile = nonEmptyString3(body, "search_profile");
+        const searchProfile = nonEmptyString4(body, "search_profile");
         const backend = deps.webSearch;
         if (backend === void 0) {
           deps.log?.(`rc selfhost ${session.id}: worker web-search of "${query}" refused: no search backend serves this door`);
@@ -11568,7 +11858,7 @@ data: ${JSON.stringify(envelope)}
       return;
     }
     if (tail === "events" && method === "POST") {
-      const body = parseJsonObject3(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
+      const body = parseJsonObject5(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
       const events = body?.events;
       if (!Array.isArray(events) || events.length === 0 || events.length > RC_SELF_HOST_MAX_BATCH_EVENTS) {
         await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: `a client event write is a non-empty array of at most ${String(RC_SELF_HOST_MAX_BATCH_EVENTS)} events` } });
@@ -11576,11 +11866,11 @@ data: ${JSON.stringify(envelope)}
       }
       const results = [];
       for (const event of events) {
-        if (!isRecord7(event) || !isRecord7(event.payload)) {
+        if (!isRecord10(event) || !isRecord10(event.payload)) {
           await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "every event in a write is an object carrying one payload object" } });
           return;
         }
-        const published = publish(session, RC_SOURCE_CLIENT, event.payload);
+        const published = publish(session.conversation, { session: session.id, half: "client" }, RC_SOURCE_CLIENT, event.payload);
         results.push({ sequence_num: String(published.sequenceNum), duplicate: published.duplicate });
       }
       sweep();
@@ -11588,14 +11878,14 @@ data: ${JSON.stringify(envelope)}
       return;
     }
     if (tail === "events" && method === "GET") {
-      await answerJson2(response, HTTP_STATUS.ok, { data: session.events.map((event) => ({ event_id: event.eventId, event_type: nonEmptyString3(event.payload, "type") ?? "event", sequence_num: event.sequenceNum, source: event.source, payload: event.payload, created_at: event.createdAt })) });
+      await answerJson2(response, HTTP_STATUS.ok, { data: session.conversation.events.map((event) => ({ event_id: event.eventId, event_type: nonEmptyString4(event.payload, "type") ?? "event", sequence_num: event.sequenceNum, source: event.source, payload: event.payload, created_at: event.createdAt })) });
       return;
     }
     if (tail === "events/stream" && method === "GET") {
-      await holdStream(session, "clientStreams", () => true, request4, response);
+      await holdStream(session.conversation, session.id, "clientStreams", () => true, request4, response);
       return;
     }
-    if (await serveRcClientChannels({ request: request4, response, session, answerJson: answerJson2, readBody: readBody2, publish, sweep, now: deps.now, presenceRefreshSeconds: RC_PRESENCE_REFRESH_SECONDS, ...deps.log === void 0 ? {} : { log: deps.log } }, tail, method, RC_SELF_HOST_MAX_BATCH_EVENTS)) {
+    if (await serveRcClientChannels({ request: request4, response, host: { id: session.id, clients: session.clients, conversation: session.conversation, writer: { session: session.id, half: "client" } }, answerJson: answerJson2, readBody: readBody2, publish, sweep, now: deps.now, presenceRefreshSeconds: RC_PRESENCE_REFRESH_SECONDS, ...deps.log === void 0 ? {} : { log: deps.log } }, tail, method, RC_SELF_HOST_MAX_BATCH_EVENTS)) {
       return;
     }
     await answerJson2(response, HTTP_STATUS.notFound, { type: "error", error: { type: "api_error", message: `the self-hosted Remote Control surface serves no path "${tail}"` } });
@@ -11613,7 +11903,11 @@ data: ${JSON.stringify(envelope)}
         return;
       }
       if (pathname === RC_COMPAT_SESSIONS_PATH || pathname.startsWith(`${RC_COMPAT_SESSIONS_PATH}/`)) {
-        await serveRcCompatSessions({ request: request4, response, sessions, answerJson: answerJson2, readBody: readBody2, credentialRefusal, unauthorized, now: deps.now, ...deps.log === void 0 ? {} : { log: deps.log } }, pathname, RC_COMPAT_SESSIONS_PATH);
+        await serveRcCompatSessions({ request: request4, response, sessions, retireSession, answerJson: answerJson2, readBody: readBody2, credentialRefusal, unauthorized, now: deps.now, ...deps.log === void 0 ? {} : { log: deps.log } }, pathname, RC_COMPAT_SESSIONS_PATH);
+        return;
+      }
+      if (pathname === RC_CONVERSATIONS_PATH_PREFIX || pathname.startsWith(`${RC_CONVERSATIONS_PATH_PREFIX}/`)) {
+        await serveRcConversations({ request: request4, response, conversations, answerJson: answerJson2, readBody: readBody2, credentialRefusal, unauthorized, publish, holdStream, sweep, now: deps.now, presenceRefreshSeconds: RC_PRESENCE_REFRESH_SECONDS, maxBatchEvents: RC_SELF_HOST_MAX_BATCH_EVENTS, ...deps.log === void 0 ? {} : { log: deps.log } }, pathname, method);
         return;
       }
       if (pathname !== RC_SESSIONS_PATH_PREFIX2 && !pathname.startsWith(`${RC_SESSIONS_PATH_PREFIX2}/`)) {
@@ -11627,26 +11921,36 @@ data: ${JSON.stringify(envelope)}
             await unauthorized(response, createRefusal);
             return;
           }
-          const body = parseJsonObject3(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
+          const body = parseJsonObject5(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
+          const namedConversation = nonEmptyString4(body, "conversation");
+          let conversation;
+          if (namedConversation === void 0) {
+            conversation = newRcSelfHostConversation(deps.newUuid, deps.now);
+            conversations.set(conversation.id, conversation);
+          } else {
+            conversation = conversations.get(namedConversation);
+            if (conversation === void 0) {
+              await answerJson2(response, HTTP_STATUS.notFound, { type: "error", error: { type: "api_error", message: `no such Remote Control conversation on this door: ${namedConversation}` } });
+              return;
+            }
+            conversation.lastTrafficAt = deps.now();
+          }
           const session = {
             id: `${RC_SESSION_ID_PREFIX2}${deps.newUuid()}`,
             createdAt: deps.now(),
-            title: nonEmptyString3(body, "title"),
+            title: nonEmptyString4(body, "title"),
+            conversation,
             workerJwts: /* @__PURE__ */ new Set(),
-            sequenceNum: 0,
-            events: [],
-            seenPayloadUuids: /* @__PURE__ */ new Set(),
-            workerStreams: /* @__PURE__ */ new Set(),
-            clientStreams: /* @__PURE__ */ new Set(),
             internalEvents: [],
             clients: /* @__PURE__ */ new Map(),
             workerStatus: void 0,
             externalMetadata: void 0,
             lastTrafficAt: deps.now()
           };
+          conversation.sessionIds.add(session.id);
           sessions.set(session.id, session);
-          deps.log?.(`rc selfhost ${session.id}: session created on the door's own surface`);
-          await answerJson2(response, HTTP_STATUS.ok, { session: { id: session.id, title: session.title, created_at: new Date(session.createdAt).toISOString(), status: "active" } });
+          deps.log?.(`rc selfhost ${session.id}: session created on the door's own surface, attached to conversation ${conversation.id}${namedConversation === void 0 ? "" : " at its client's request"}`);
+          await answerJson2(response, HTTP_STATUS.ok, { session: sessionRow(session) });
           return;
         }
         if (method === "GET") {
@@ -11655,7 +11959,7 @@ data: ${JSON.stringify(envelope)}
             await unauthorized(response, readRefusal);
             return;
           }
-          await answerJson2(response, HTTP_STATUS.ok, { data: [...sessions.values()].map((session) => ({ id: session.id, title: session.title, created_at: new Date(session.createdAt).toISOString(), updated_at: new Date(session.lastTrafficAt).toISOString(), session_status: "active" })) });
+          await answerJson2(response, HTTP_STATUS.ok, { data: [...sessions.values()].map((session) => ({ id: session.id, title: session.title, created_at: new Date(session.createdAt).toISOString(), updated_at: new Date(session.lastTrafficAt).toISOString(), session_status: "active", conversation_id: session.conversation.id })) });
           return;
         }
         await answerJson2(response, HTTP_STATUS.methodNotAllowed, { type: "error", error: { type: "api_error", message: "the session collection is a POST (create) and a GET (list)" } });
@@ -11672,92 +11976,20 @@ data: ${JSON.stringify(envelope)}
       await serveSessionPath(sessions.get(id), tail, request4, response);
     }
   };
-  const answerServerJson = (response, status, body) => {
-    const text = JSON.stringify(body);
-    response.writeHead(status, { "content-type": "application/json", "content-length": String(Buffer.byteLength(text, "utf8")) });
-    response.end(text);
-  };
-  const local = {
-    parsesHost: (host) => host === RC_SELF_HOST_OAUTH_HOST,
-    serve: async (host, request4, response) => {
-      const method = (request4.method ?? "").toUpperCase();
-      const pathname = new URL(request4.url ?? "/", "http://127.0.0.1").pathname;
-      if (host === RC_SELF_HOST_OAUTH_HOST) {
-        if (method === "POST" && pathname === "/v1/oauth/token") {
-          const body = parseJsonObject3(await readBody2(request4, CONTROL_BODY_CAP_BYTES));
-          const record = deps.credentialRecord();
-          if (record === void 0) {
-            answerServerJson(response, HTTP_SERVICE_UNAVAILABLE, { error: "the front door's self-hosted Remote Control surface is on but no credential has been minted for it" });
-            return true;
-          }
-          if (body?.grant_type !== void 0 && body.grant_type !== "refresh_token") {
-            answerServerJson(response, HTTP_STATUS.badRequest, { error: "unsupported_grant_type" });
-            return true;
-          }
-          answerServerJson(response, HTTP_STATUS.ok, { access_token: record.accessToken, refresh_token: record.refreshToken, expires_in: RC_SELF_HOST_OAUTH_TOKEN_TTL_SECONDS, scope: RC_SELF_HOST_SCOPE_LIST.join(" ") });
-          return true;
-        }
-        if (method === "GET" && pathname === "/v1/oauth/hello") {
-          answerServerJson(response, HTTP_STATUS.ok, {});
-          return true;
-        }
-        return false;
-      }
-      if (method === "POST" && pathname.startsWith("/api/eval/")) {
-        await readBody2(request4, CONTROL_BODY_CAP_BYTES);
-        answerServerJson(response, HTTP_STATUS.ok, { features: growthBookFeatures(), dateUpdated: Math.floor(deps.now() / MS_PER_SECOND5) });
-        return true;
-      }
-      if (method === "GET" && pathname === "/api/oauth/profile") {
-        const record = deps.credentialRecord();
-        if (record === void 0) {
-          answerServerJson(response, HTTP_SERVICE_UNAVAILABLE, { error: "the front door's self-hosted Remote Control surface is on but no credential has been minted for it" });
-          return true;
-        }
-        answerServerJson(response, HTTP_STATUS.ok, {
-          account: { uuid: record.accountUuid, display_name: "agent-shim self-hosted", created_at: (/* @__PURE__ */ new Date(0)).toISOString() },
-          organization: { uuid: record.organizationUuid, organization_type: "claude_max" }
-        });
-        return true;
-      }
-      if (method === "GET" && pathname === "/api/claude_code/policy_limits") {
-        answerServerJson(response, HTTP_STATUS.ok, {});
-        return true;
-      }
-      if (method === "POST" && pathname === "/api/oauth/validate") {
-        await readBody2(request4, CONTROL_BODY_CAP_BYTES);
-        const record = deps.credentialRecord();
-        if (record === void 0) {
-          answerServerJson(response, HTTP_SERVICE_UNAVAILABLE, { error: "the front door's self-hosted Remote Control surface is on but no credential has been minted for it" });
-          return true;
-        }
-        answerServerJson(response, HTTP_STATUS.ok, { scopes: [...RC_SELF_HOST_SCOPE_LIST], expiresAt: null, subscriptionType: "max", account_uuid: record.accountUuid, organization_uuid: record.organizationUuid });
-        return true;
-      }
-      if (method === "POST" && (pathname === "/api/event_logging/v2/batch" || pathname === "/api/claude_code/metrics" || pathname === "/api/claude_cli_feedback")) {
-        await readBody2(request4, CONTROL_BODY_CAP_BYTES);
-        answerServerJson(response, HTTP_STATUS.ok, {});
-        return true;
-      }
-      if (method === "GET" && pathname === "/api/hello") {
-        answerServerJson(response, HTTP_STATUS.ok, {});
-        return true;
-      }
-      return false;
-    }
-  };
+  const local = createRcSelfHostLocal({ now: deps.now, credentialRecord: deps.credentialRecord, readBody: readBody2 });
   return {
     route,
     local,
     close: () => {
       clearInterval(timer);
       clearInterval(keepalive);
-      for (const session of sessions.values()) {
-        for (const sink of [...session.workerStreams, ...session.clientStreams]) {
+      for (const conversation of conversations.values()) {
+        for (const sink of [...conversation.workerStreams, ...conversation.clientStreams]) {
           sink.retire();
         }
       }
       sessions.clear();
+      conversations.clear();
     }
   };
 }
@@ -11770,7 +12002,7 @@ var RC_SELF_HOST_RECORD_DIR = "rc-selfhost";
 var RC_SELF_HOST_RECORD_FILE = "credential.json";
 var SELF_HOST_EMAIL = "selfhost@agent-shim.invalid";
 var SELF_HOST_SUBSCRIPTION_TYPE = "max";
-function isRecord8(value) {
+function isRecord11(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function readJsonObject(fs12, file) {
@@ -11784,7 +12016,7 @@ function readJsonObject(fs12, file) {
   } catch {
     return void 0;
   }
-  return isRecord8(parsed) ? parsed : void 0;
+  return isRecord11(parsed) ? parsed : void 0;
 }
 function readRcSelfHostRecord(fs12, frontdoorDir) {
   const parsed = readJsonObject(fs12, import_node_path28.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
@@ -11808,7 +12040,7 @@ function mintRcSelfHostCredential(deps) {
   const recordFile = import_node_path28.default.join(recordDir, RC_SELF_HOST_RECORD_FILE);
   const previousRecord = readRcSelfHostRecord(deps.fs, deps.frontdoorDir);
   const existingCredentials = readJsonObject(deps.fs, credentialsFile);
-  const existingOauth = isRecord8(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
+  const existingOauth = isRecord11(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
   const existingToken = typeof existingOauth?.accessToken === "string" && existingOauth.accessToken !== "" ? existingOauth.accessToken : void 0;
   const existingIsOwn = existingToken !== void 0 && previousRecord?.accessToken === existingToken;
   if (existingToken !== void 0 && !existingIsOwn && !deps.force) {
@@ -11825,7 +12057,7 @@ function mintRcSelfHostCredential(deps) {
   deps.fs.writeFilePrivate(credentialsFile, `${JSON.stringify({ ...existingCredentials, claudeAiOauth: { accessToken, refreshToken, expiresAt: null, scopes: [...RC_SELF_HOST_SCOPE_LIST], subscriptionType: SELF_HOST_SUBSCRIPTION_TYPE, rateLimitTier: null } }, null, 2)}
 `);
   const claudeJson = readJsonObject(deps.fs, claudeJsonFile) ?? {};
-  const existingBlock = (value) => isRecord8(value) ? value : {};
+  const existingBlock = (value) => isRecord11(value) ? value : {};
   deps.fs.writeFilePrivate(claudeJsonFile, `${JSON.stringify({
     ...claudeJson,
     oauthAccount: {
@@ -12024,7 +12256,7 @@ var import_node_path30 = __toESM(require("node:path"), 1);
 // package.json
 var package_default = {
   name: "agent-shim",
-  version: "8.25.0",
+  version: "8.27.0",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -13288,11 +13520,15 @@ function prepareClaudeLaunch(options) {
   RC_WEB_FETCH_MAX_BYTES,
   RC_WEB_FETCH_MAX_REDIRECTS,
   ROUTED_PATH_PREFIX,
+  RcLiveRateLimitSchema,
   RcPermissionModeSchema,
+  RcRateLimitInfoSchema,
+  RcRateLimitWindowSchema,
   RcStreamEnvelopeSchema,
   RcStreamEventSchema,
   UsageError,
   UsageListOutputSchema,
+  UsageLiveOutputSchema,
   UsageSnapshotError,
   UsageSnapshotSchema,
   UsageWindowsInputSchema,
@@ -13344,6 +13580,7 @@ function prepareClaudeLaunch(options) {
   createRcControlHandler,
   createRcCredentialStore,
   createRcEventFanout,
+  createRcLiveUsage,
   createRcSelfHostSurface,
   createRcSessionTracker,
   createRcStreamHub,
@@ -13405,6 +13642,7 @@ function prepareClaudeLaunch(options) {
   rcEventWriteResultFromAnswer,
   rcFanoutOnDoorHub,
   rcObserverAsPassthrough,
+  rcRateLimitInfoOf,
   rcSelfHostFromEnv,
   rcWebFetchAllowsPrivateFromEnv,
   readActiveIdentity,