agent-shim 8.27.1 → 8.29.0

package/dist/index.mjs

@@ -5028,10 +5028,113 @@ function createRcCredentialStore(fs12, dir) {
 // src/frontdoor/rcApi.ts
 import { createORPCClient, ORPCError } from "@orpc/client";
 import { RPCLink } from "@orpc/client/fetch";
+import { OpenAPIGenerator } from "@orpc/openapi";
+import { OpenAPIHandler } from "@orpc/openapi/node";
 import { eventIterator, os as os2, withEventMeta } from "@orpc/server";
 import { BodyLimitPlugin, RPCHandler } from "@orpc/server/node";
 import { Agent as Agent3, fetch as undiciFetch } from "undici";
 
+// package.json
+var package_default = {
+  name: "agent-shim",
+  version: "8.29.0",
+  description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
+  license: "MIT",
+  author: "Joseph Mearman <joseph@mearman.co.uk>",
+  repository: {
+    type: "git",
+    url: "git+https://github.com/ExaDev/agent-shim.git"
+  },
+  homepage: "https://github.com/ExaDev/agent-shim#readme",
+  bugs: "https://github.com/ExaDev/agent-shim/issues",
+  keywords: [
+    "claude-code",
+    "claude",
+    "cli"
+  ],
+  packageManager: "pnpm@12.4.1+sha512.2e81e399d73fe8390dab25e06aa788ab7a5908248d2f5a370f82b481147a6a7a367bf8048f9a6fdb6460f21a66f0542dedb8b94ca2c8723596741920b1656d4c",
+  type: "module",
+  engines: {
+    node: "^22.18 || >=24"
+  },
+  bin: {
+    "agent-shim": "dist/cli.cjs",
+    "claude-use": "dist/cli.cjs"
+  },
+  files: [
+    "dist/cli.cjs",
+    "dist/index.mjs",
+    "dist/index.cjs",
+    "dist/types"
+  ],
+  scripts: {
+    prepare: "husky && node scripts/build.mts --bundle-only",
+    typecheck: "turbo run _typecheck",
+    _typecheck: "tsc --noEmit",
+    lint: "turbo run _lint",
+    _lint: "eslint . --cache --cache-location .eslintcache --max-warnings 0",
+    test: "turbo run _test",
+    _test: "vitest run",
+    "test:coverage": "turbo run _test:coverage",
+    "_test:coverage": "vitest run --coverage",
+    knip: "turbo run _knip",
+    _knip: "knip --cache",
+    build: "turbo run _build",
+    _build: "node scripts/build.mts",
+    "build:bundle": "node scripts/build.mts --bundle-only",
+    prepublishOnly: "pnpm build:bundle",
+    schema: "node scripts/gen-schema.mts"
+  },
+  dependencies: {
+    "@clack/prompts": "^1.8.0",
+    "@orpc/client": "1.15.4",
+    "@orpc/openapi": "1.15.4",
+    "@orpc/server": "1.15.4",
+    commander: "^15.0.0",
+    cosmiconfig: "^10.0.1",
+    picomatch: "^4.0.7",
+    undici: "7.29.1",
+    zod: "^4.6.1"
+  },
+  devDependencies: {
+    "@commitlint/cli": "^21.2.2",
+    "@commitlint/config-conventional": "^21.2.2",
+    "@exadev/eslint-config": "2.12.1",
+    "@semantic-release/changelog": "^7.0.0",
+    "@semantic-release/git": "^11.0.1",
+    "@semantic-release/npm": "^13.1.5",
+    "@types/node": "^26.5.1",
+    "@types/picomatch": "^4.0.3",
+    "@vitest/coverage-v8": "^4.1.11",
+    "conventional-changelog-conventionalcommits": "^10.4.0",
+    esbuild: "^0.28.2",
+    eslint: "^10.10.0",
+    globals: "^17.12.0",
+    husky: "^9.1.7",
+    jiti: "^2.7.0",
+    knip: "^6.35.1",
+    "lint-staged": "^17.5.0",
+    rollup: "4.64.0",
+    "rollup-plugin-dts": "6.5.1",
+    "semantic-release": "^25.0.9",
+    turbo: "^2.11.5",
+    typescript: "^6.0.3",
+    "typescript-eslint": "^8.70.0",
+    vitest: "^4.1.11"
+  },
+  main: "dist/index.cjs",
+  module: "dist/index.mjs",
+  types: "dist/types/index.d.ts",
+  exports: {
+    ".": {
+      types: "./dist/types/index.d.ts",
+      import: "./dist/index.mjs",
+      require: "./dist/index.cjs"
+    },
+    "./package.json": "./package.json"
+  }
+};
+
 // src/frontdoor/rcSchemas.ts
 import { z as z4 } from "zod";
 var RcPermissionModeSchema = z4.enum(RC_PERMISSION_MODES);
@@ -5193,18 +5296,23 @@ var RcAnswerOutputSchema = z4.strictObject({
 
 // src/frontdoor/rcApi.ts
 var RC_ORPC_PATH_PREFIX = "/__agent-shim/orpc";
+var RC_OPENAPI_DOC_PATH = "/openapi.json";
 var RC_SUBSCRIBER_BUFFER_EVENTS = 100;
+function doorApiBearer(headers) {
+  const presented = headers.authorization;
+  const bearerPrefix = "bearer ".length;
+  return typeof presented === "string" && presented.slice(0, bearerPrefix).toLowerCase() === "bearer " ? presented.slice(bearerPrefix) : void 0;
+}
 function doorApiAuth(expectedToken) {
   return os2.$context().use(({ context, next }) => {
-    const presented = context.headers.authorization;
-    const bearerPrefix = "bearer ".length;
-    const token = typeof presented === "string" && presented.slice(0, bearerPrefix).toLowerCase() === "bearer " ? presented.slice(bearerPrefix) : void 0;
+    const token = doorApiBearer(context.headers);
     if (token === void 0 || !isLiveCapability(token, [expectedToken])) {
       throw new ORPCError("UNAUTHORIZED", { message: "the front door's typed API demands this generation's control token as a Bearer credential" });
     }
     return next();
   });
 }
+var RC_API_TAG = "remote-control";
 function createRcApiRouter(deps) {
   const authed = doorApiAuth(deps.expectedToken);
   const delivered = (sessionId, result) => {
@@ -5224,41 +5332,41 @@ function createRcApiRouter(deps) {
   };
   return {
     rc: {
-      list: authed.output(RcListOutputSchema).handler(() => ({ sessions: deps.list() })),
-      status: authed.input(RcSessionQuerySchema).output(RcStatusOutputSchema).handler(({ input }) => {
+      list: authed.route({ method: "GET", path: "/rest/rc/sessions", summary: "List the observed Remote Control sessions", tags: [RC_API_TAG] }).output(RcListOutputSchema).handler(() => ({ sessions: deps.list() })),
+      status: authed.route({ method: "GET", path: "/rest/rc/status", summary: "Read session status, one session's when named", tags: [RC_API_TAG] }).input(RcSessionQuerySchema).output(RcStatusOutputSchema).handler(({ input }) => {
         const statuses = deps.statusOf(input.session);
         if (input.session !== void 0 && !statuses.some((entry) => entry.id === input.session)) {
           throw new ORPCError("NOT_FOUND", { message: rcSessionNotObservedMessage(input.session) });
         }
         return { statuses };
       }),
-      pending: authed.input(RcSessionQuerySchema).output(RcPendingOutputSchema).handler(({ input }) => {
+      pending: authed.route({ method: "GET", path: "/rest/rc/pending", summary: "Read the control requests awaiting an answer", tags: [RC_API_TAG] }).input(RcSessionQuerySchema).output(RcPendingOutputSchema).handler(({ input }) => {
         const pending = deps.pendingOf(input.session);
         if (input.session !== void 0 && deps.statusOf(input.session).length === 0) {
           throw new ORPCError("NOT_FOUND", { message: rcSessionNotObservedMessage(input.session) });
         }
         return { pending };
       }),
-      send: authed.input(RcSendInputSchema).output(RcWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, sequenceNums: delivered(input.session, await deps.inject(input.session, input.text)) })),
-      answer: authed.input(RcAnswerInputSchema).output(RcAnswerOutputSchema).handler(async ({ input }) => {
+      send: authed.route({ method: "POST", path: "/rest/rc/send", summary: "Send one message into a session", tags: [RC_API_TAG] }).input(RcSendInputSchema).output(RcWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, sequenceNums: delivered(input.session, await deps.inject(input.session, input.text)) })),
+      answer: authed.route({ method: "POST", path: "/rest/rc/answer", summary: "Answer one pending control request", tags: [RC_API_TAG] }).input(RcAnswerInputSchema).output(RcAnswerOutputSchema).handler(async ({ input }) => {
         const decision = { approve: input.approve, message: input.approve || input.text === void 0 ? void 0 : input.text };
         return { session: input.session, request: input.request, sequenceNums: delivered(input.session, await deps.answer(input.session, input.request, decision)) };
       }),
-      interrupt: authed.input(RcInterruptInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.interrupt(input.session)) })),
-      setModel: authed.input(RcSetModelInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.setModel(input.session, input.model)) })),
-      setPermissionMode: authed.input(RcSetPermissionModeInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.setPermissionMode(input.session, input.mode)) })),
-      endSession: authed.input(RcEndSessionInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.endSession(input.session, input.reason)) })),
-      getUsage: authed.input(RcGetUsageInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.getUsage(input.session, input.skipBehaviors)) })),
-      getContextUsage: authed.input(RcGetContextUsageInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.getContextUsage(input.session, input.detail)) })),
-      readFile: authed.input(RcReadFileInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.readFile(input.session, input.path, { ...input.maxBytes === void 0 ? {} : { maxBytes: input.maxBytes }, ...input.encoding === void 0 ? {} : { encoding: input.encoding } })) })),
-      fileSuggestions: authed.input(RcFileSuggestionsInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.fileSuggestions(input.session, input.query)) })),
-      keepAlive: authed.input(RcKeepAliveInputSchema).output(RcWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, sequenceNums: delivered(input.session, await deps.keepAlive(input.session)) })),
-      mcpStatus: authed.input(RcMcpStatusInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpStatus(input.session)) })),
-      mcpReconnect: authed.input(RcMcpReconnectInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpReconnect(input.session, input.serverName)) })),
-      mcpAuthenticate: authed.input(RcMcpAuthenticateInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpAuthenticate(input.session, input.serverName, input.redirectUri)) })),
-      mcpOAuthCallbackUrl: authed.input(RcMcpOAuthCallbackUrlInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpOAuthCallbackUrl(input.session, input.serverName, input.callbackUrl)) })),
-      teleport: authed.input(RcTeleportInputSchema).output(RcWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, sequenceNums: delivered(input.session, await deps.teleport(input.session, input.marker)) })),
-      subscribe: authed.input(RcSessionQuerySchema).output(eventIterator(RcStreamEventSchema)).handler(async function* ({ input, signal }) {
+      interrupt: authed.route({ method: "POST", path: "/rest/rc/interrupt", summary: "Interrupt a session's running turn", tags: [RC_API_TAG] }).input(RcInterruptInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.interrupt(input.session)) })),
+      setModel: authed.route({ method: "POST", path: "/rest/rc/set-model", summary: "Switch a session's model", tags: [RC_API_TAG] }).input(RcSetModelInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.setModel(input.session, input.model)) })),
+      setPermissionMode: authed.route({ method: "POST", path: "/rest/rc/set-permission-mode", summary: "Switch a session's permission mode", tags: [RC_API_TAG] }).input(RcSetPermissionModeInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.setPermissionMode(input.session, input.mode)) })),
+      endSession: authed.route({ method: "POST", path: "/rest/rc/end-session", summary: "End a session", tags: [RC_API_TAG] }).input(RcEndSessionInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.endSession(input.session, input.reason)) })),
+      getUsage: authed.route({ method: "POST", path: "/rest/rc/get-usage", summary: "Ask a session for its usage snapshot", tags: [RC_API_TAG] }).input(RcGetUsageInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.getUsage(input.session, input.skipBehaviors)) })),
+      getContextUsage: authed.route({ method: "POST", path: "/rest/rc/get-context-usage", summary: "Ask a session for its context usage", tags: [RC_API_TAG] }).input(RcGetContextUsageInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.getContextUsage(input.session, input.detail)) })),
+      readFile: authed.route({ method: "POST", path: "/rest/rc/read-file", summary: "Ask a session to read one file", tags: [RC_API_TAG] }).input(RcReadFileInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.readFile(input.session, input.path, { ...input.maxBytes === void 0 ? {} : { maxBytes: input.maxBytes }, ...input.encoding === void 0 ? {} : { encoding: input.encoding } })) })),
+      fileSuggestions: authed.route({ method: "POST", path: "/rest/rc/file-suggestions", summary: "Ask a session for file-path suggestions", tags: [RC_API_TAG] }).input(RcFileSuggestionsInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.fileSuggestions(input.session, input.query)) })),
+      keepAlive: authed.route({ method: "POST", path: "/rest/rc/keep-alive", summary: "Keep a session's bridge alive", tags: [RC_API_TAG] }).input(RcKeepAliveInputSchema).output(RcWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, sequenceNums: delivered(input.session, await deps.keepAlive(input.session)) })),
+      mcpStatus: authed.route({ method: "POST", path: "/rest/rc/mcp-status", summary: "Ask a session for its MCP servers' status", tags: [RC_API_TAG] }).input(RcMcpStatusInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpStatus(input.session)) })),
+      mcpReconnect: authed.route({ method: "POST", path: "/rest/rc/mcp-reconnect", summary: "Ask a session to reconnect one MCP server", tags: [RC_API_TAG] }).input(RcMcpReconnectInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpReconnect(input.session, input.serverName)) })),
+      mcpAuthenticate: authed.route({ method: "POST", path: "/rest/rc/mcp-authenticate", summary: "Start OAuth for one MCP server on a session", tags: [RC_API_TAG] }).input(RcMcpAuthenticateInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpAuthenticate(input.session, input.serverName, input.redirectUri)) })),
+      mcpOAuthCallbackUrl: authed.route({ method: "POST", path: "/rest/rc/mcp-oauth-callback-url", summary: "Hand a completed MCP OAuth callback to a session", tags: [RC_API_TAG] }).input(RcMcpOAuthCallbackUrlInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpOAuthCallbackUrl(input.session, input.serverName, input.callbackUrl)) })),
+      teleport: authed.route({ method: "POST", path: "/rest/rc/teleport", summary: "Teleport a session to a conversation marker", tags: [RC_API_TAG] }).input(RcTeleportInputSchema).output(RcWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, sequenceNums: delivered(input.session, await deps.teleport(input.session, input.marker)) })),
+      subscribe: authed.route({ method: "GET", path: "/rest/rc/events", summary: "Stream a session's Remote Control events (SSE)", tags: [RC_API_TAG] }).input(RcSessionQuerySchema).output(eventIterator(RcStreamEventSchema)).handler(async function* ({ input, signal }) {
         const queue = [];
         let wake;
         const detach = deps.fanout.subscribe(input.session, (event) => {
@@ -5295,15 +5403,44 @@ function createRcApiRouter(deps) {
     }
   };
 }
-function doorApiNodeHandlerOf(router) {
-  const handler = new RPCHandler(router, { plugins: [new BodyLimitPlugin({ maxBodySize: CONTROL_BODY_CAP_BYTES })] });
+function doorApiNodeHandlerOf(router, expectedToken) {
+  const plugins = [new BodyLimitPlugin({ maxBodySize: CONTROL_BODY_CAP_BYTES })];
+  const rpcHandler = new RPCHandler(router, { plugins });
+  const restHandler = new OpenAPIHandler(router, { plugins });
+  let document;
+  const documentOf = async () => document ??= new OpenAPIGenerator().generate(router, { info: { title: "agent-shim front door API", version: package_default.version } });
   return {
     pathPrefix: RC_ORPC_PATH_PREFIX,
-    handle: async (request4, response) => await handler.handle(request4, response, { context: { headers: request4.headers }, prefix: RC_ORPC_PATH_PREFIX })
+    handle: async (request4, response) => {
+      if (request4.method === "GET" && request4.url === `${RC_ORPC_PATH_PREFIX}${RC_OPENAPI_DOC_PATH}`) {
+        const token = doorApiBearer(request4.headers);
+        if (token === void 0 || !isLiveCapability(token, [expectedToken])) {
+          const refusal = new ORPCError("UNAUTHORIZED", { message: "the front door's OpenAPI document demands this generation's control token as a Bearer credential" });
+          response.writeHead(HTTP_STATUS.unauthorized, { "content-type": "application/json" });
+          response.end(JSON.stringify(refusal.toJSON()));
+          return { matched: true };
+        }
+        try {
+          const doc = await documentOf();
+          response.writeHead(HTTP_STATUS.ok, { "content-type": "application/json" });
+          response.end(JSON.stringify(doc));
+        } catch (error) {
+          const refusal = new ORPCError("INTERNAL_SERVER_ERROR", { message: `the OpenAPI document could not be generated from the door's own router: ${error instanceof Error ? error.message : String(error)}` });
+          response.writeHead(HTTP_STATUS.internalServerError, { "content-type": "application/json" });
+          response.end(JSON.stringify(refusal.toJSON()));
+        }
+        return { matched: true };
+      }
+      const rest = await restHandler.handle(request4, response, { context: { headers: request4.headers }, prefix: RC_ORPC_PATH_PREFIX });
+      if (rest.matched) {
+        return rest;
+      }
+      return await rpcHandler.handle(request4, response, { context: { headers: request4.headers }, prefix: RC_ORPC_PATH_PREFIX });
+    }
   };
 }
 function createRcApiNodeHandler(deps) {
-  return doorApiNodeHandlerOf(createRcApiRouter(deps));
+  return doorApiNodeHandlerOf(createRcApiRouter(deps), deps.expectedToken);
 }
 function frontDoorApiLink(port, ca, token) {
   const dispatcher = new Agent3({ connect: { ca } });
@@ -9775,11 +9912,12 @@ var LaunchLifecycleEventSchema = z20.strictObject({
 });
 
 // src/frontdoor/eventsApi.ts
+var EVENTS_API_TAG = "events";
 function createEventsApiRouter(deps) {
   const authed = doorApiAuth(deps.expectedToken);
   return {
     events: {
-      subscribe: authed.input(DoorEventSourceQuerySchema).output(eventIterator2(DoorEventSchema)).handler(async function* ({ input, signal }) {
+      subscribe: authed.route({ method: "GET", path: "/rest/events", summary: "Stream the door's every event source (SSE)", tags: [EVENTS_API_TAG] }).input(DoorEventSourceQuerySchema).output(eventIterator2(DoorEventSchema)).handler(async function* ({ input, signal }) {
         if (input.sources !== void 0) {
           const live = deps.events.sources();
           const unknown = input.sources.filter((source) => !live.includes(source));
@@ -9812,12 +9950,16 @@ function createEventsApiRouter(deps) {
 }
 
 // src/frontdoor/controlApi.ts
+var USAGE_API_TAG = "usage";
+var FRONTDOOR_API_TAG = "frontdoor";
+var CHECK_API_TAG = "check";
+var DOCTOR_API_TAG = "doctor";
 function createControlApiRouter(deps) {
   const authed = doorApiAuth(deps.expectedToken);
   return {
     usage: {
-      list: authed.output(UsageListOutputSchema).handler(() => ({ snapshots: deps.usageSnapshots() })),
-      effectiveWindow: authed.input(UsageWindowsInputSchema).output(UsageWindowsOutputSchema).handler(({ input }) => {
+      list: authed.route({ method: "GET", path: "/rest/usage/snapshots", summary: "List every identity's usage snapshot", tags: [USAGE_API_TAG] }).output(UsageListOutputSchema).handler(() => ({ snapshots: deps.usageSnapshots() })),
+      effectiveWindow: authed.route({ method: "GET", path: "/rest/usage/windows", summary: "Read one identity's effective quota windows", tags: [USAGE_API_TAG] }).input(UsageWindowsInputSchema).output(UsageWindowsOutputSchema).handler(({ input }) => {
         const snapshot = deps.usageSnapshotOf(input.identity);
         if (snapshot === void 0) {
           throw new ORPCError3("NOT_FOUND", { message: `identity ${input.identity} has no usage snapshot yet, so no quota window has been observed for it` });
@@ -9834,7 +9976,7 @@ function createControlApiRouter(deps) {
           ...unified?.sevenDay === void 0 ? {} : { sevenDay: effectiveWindow(unified.sevenDay, now) }
         };
       }),
-      live: authed.input(RcSessionQuerySchema).output(UsageLiveOutputSchema).handler(({ input }) => {
+      live: authed.route({ method: "GET", path: "/rest/usage/live", summary: "Read the live rate-limit observations the event backbone files", tags: [USAGE_API_TAG] }).input(RcSessionQuerySchema).output(UsageLiveOutputSchema).handler(({ input }) => {
         const sessions = deps.liveRateLimits(input.session);
         if (input.session !== void 0 && sessions.length === 0) {
           if (deps.list().some((session) => session.id === input.session)) {
@@ -9846,15 +9988,15 @@ function createControlApiRouter(deps) {
       })
     },
     frontdoor: {
-      status: authed.output(FrontDoorStatusOutputSchema).handler(() => deps.frontDoorStatus()),
-      sessions: authed.output(FrontDoorSessionsOutputSchema).handler(() => ({ sessions: deps.frontDoorStatus().sessions }))
+      status: authed.route({ method: "GET", path: "/rest/frontdoor/status", summary: "Read the front door's status", tags: [FRONTDOOR_API_TAG] }).output(FrontDoorStatusOutputSchema).handler(() => deps.frontDoorStatus()),
+      sessions: authed.route({ method: "GET", path: "/rest/frontdoor/sessions", summary: "Read the front door's session registry", tags: [FRONTDOOR_API_TAG] }).output(FrontDoorSessionsOutputSchema).handler(() => ({ sessions: deps.frontDoorStatus().sessions }))
     },
     check: {
       // The report's own JSON shape is the contract (the same one `check --json` prints and `checkReportSchema.ts` defines), so the procedure returns exactly that conversion.
-      run: authed.input(CheckRunInputSchema).output(CheckReportJsonSchema).handler(({ input }) => checkReportToJson(deps.checkReport(input.path, input.identity)))
+      run: authed.route({ method: "GET", path: "/rest/check", summary: "Run the check report for one directory", tags: [CHECK_API_TAG] }).input(CheckRunInputSchema).output(CheckReportJsonSchema).handler(({ input }) => checkReportToJson(deps.checkReport(input.path, input.identity)))
     },
     doctor: {
-      run: authed.output(DoctorRunOutputSchema).handler(() => deps.doctorReport())
+      run: authed.route({ method: "GET", path: "/rest/doctor", summary: "Run the doctor report", tags: [DOCTOR_API_TAG] }).output(DoctorRunOutputSchema).handler(() => deps.doctorReport())
     }
   };
 }
@@ -9862,7 +10004,7 @@ function createDoorApiRouter(deps) {
   return { ...createRcApiRouter(deps), ...createControlApiRouter(deps), ...createEventsApiRouter(deps) };
 }
 function createDoorApiNodeHandler(deps) {
-  return doorApiNodeHandlerOf(createDoorApiRouter(deps));
+  return doorApiNodeHandlerOf(createDoorApiRouter(deps), deps.expectedToken);
 }
 function frontDoorApiClient(port, ca, token) {
   return createORPCClient2(frontDoorApiLink(port, ca, token));
@@ -11948,106 +12090,6 @@ function removeDirectoryRule(paths, rulePath) {
 import { randomUUID as randomUUID4 } from "node:crypto";
 import path30 from "node:path";
 
-// package.json
-var package_default = {
-  name: "agent-shim",
-  version: "8.27.1",
-  description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
-  license: "MIT",
-  author: "Joseph Mearman <joseph@mearman.co.uk>",
-  repository: {
-    type: "git",
-    url: "git+https://github.com/ExaDev/agent-shim.git"
-  },
-  homepage: "https://github.com/ExaDev/agent-shim#readme",
-  bugs: "https://github.com/ExaDev/agent-shim/issues",
-  keywords: [
-    "claude-code",
-    "claude",
-    "cli"
-  ],
-  packageManager: "pnpm@12.4.1+sha512.2e81e399d73fe8390dab25e06aa788ab7a5908248d2f5a370f82b481147a6a7a367bf8048f9a6fdb6460f21a66f0542dedb8b94ca2c8723596741920b1656d4c",
-  type: "module",
-  engines: {
-    node: "^22.18 || >=24"
-  },
-  bin: {
-    "agent-shim": "dist/cli.cjs",
-    "claude-use": "dist/cli.cjs"
-  },
-  files: [
-    "dist/cli.cjs",
-    "dist/index.mjs",
-    "dist/index.cjs",
-    "dist/types"
-  ],
-  scripts: {
-    prepare: "husky && node scripts/build.mts --bundle-only",
-    typecheck: "turbo run _typecheck",
-    _typecheck: "tsc --noEmit",
-    lint: "turbo run _lint",
-    _lint: "eslint . --cache --cache-location .eslintcache --max-warnings 0",
-    test: "turbo run _test",
-    _test: "vitest run",
-    "test:coverage": "turbo run _test:coverage",
-    "_test:coverage": "vitest run --coverage",
-    knip: "turbo run _knip",
-    _knip: "knip --cache",
-    build: "turbo run _build",
-    _build: "node scripts/build.mts",
-    "build:bundle": "node scripts/build.mts --bundle-only",
-    prepublishOnly: "pnpm build:bundle",
-    schema: "node scripts/gen-schema.mts"
-  },
-  dependencies: {
-    "@clack/prompts": "^1.8.0",
-    "@orpc/client": "1.15.4",
-    "@orpc/server": "1.15.4",
-    commander: "^15.0.0",
-    cosmiconfig: "^10.0.1",
-    picomatch: "^4.0.7",
-    undici: "7.29.1",
-    zod: "^4.6.1"
-  },
-  devDependencies: {
-    "@commitlint/cli": "^21.2.2",
-    "@commitlint/config-conventional": "^21.2.2",
-    "@exadev/eslint-config": "2.12.1",
-    "@semantic-release/changelog": "^7.0.0",
-    "@semantic-release/git": "^11.0.1",
-    "@semantic-release/npm": "^13.1.5",
-    "@types/node": "^26.5.1",
-    "@types/picomatch": "^4.0.3",
-    "@vitest/coverage-v8": "^4.1.11",
-    "conventional-changelog-conventionalcommits": "^10.4.0",
-    esbuild: "^0.28.2",
-    eslint: "^10.10.0",
-    globals: "^17.12.0",
-    husky: "^9.1.7",
-    jiti: "^2.7.0",
-    knip: "^6.35.1",
-    "lint-staged": "^17.5.0",
-    rollup: "4.64.0",
-    "rollup-plugin-dts": "6.5.1",
-    "semantic-release": "^25.0.9",
-    turbo: "^2.11.5",
-    typescript: "^6.0.3",
-    "typescript-eslint": "^8.70.0",
-    vitest: "^4.1.11"
-  },
-  main: "dist/index.cjs",
-  module: "dist/index.mjs",
-  types: "dist/types/index.d.ts",
-  exports: {
-    ".": {
-      types: "./dist/types/index.d.ts",
-      import: "./dist/index.mjs",
-      require: "./dist/index.cjs"
-    },
-    "./package.json": "./package.json"
-  }
-};
-
 // src/launcher/argv.ts
 var ConflictingIdentityError = class extends UsageError {
   constructor(positional, flag) {

package/dist/types/index.d.ts

@@ -2503,6 +2503,8 @@ interface PrePipelineApi {
  * Mounted on the provider listener beside the bespoke namespace, authenticated by the same per-generation owner-only control token as a Bearer credential: a fresh random value per door start, written owner-only under the front door's state directory, and checked in constant time like every other capability the door accepts. `rc.subscribe` streams the client attachment's fan-out: every event the door's held stream produced, SSE-framed by oRPC's event iterator, each carrying its sequence number as the SSE event id so a consumer's own reconnect can resume exactly as the door's does.
  *
  * This module also owns the mount's router-agnostic plumbing, which the control-plane routers (`controlApi.ts`) serve on the same prefix under the same token: the control-token middleware (`doorApiAuth`), the node-handler builder (`doorApiNodeHandlerOf`) and the TLS-pinned client link (`frontDoorApiLink`).
+ *
+ * Every procedure is route-annotated (method, path, summary, tags) under the mount's one REST namespace (`/rest/...`), so the mount serves the same operations twice over: as the oRPC RPC protocol the typed clients and the web client speak, and as plain REST for consumers with no TypeScript client (curl, scripts, other languages), with the OpenAPI document of the whole surface at `RC_OPENAPI_DOC_PATH` under the same token. The two share one router, one token middleware and one Zod schema source, so nothing can drift between them; an annotated (method, path) pair is served REST-shaped and everything else falls through to the RPC handler, and no RPC procedure path begins with `/rest`, so neither address space can ever capture the other.
  */
 /** The one path prefix the typed API is mounted under, answered before the routed pipeline like the bespoke control routes are. */
 declare const RC_ORPC_PATH_PREFIX = "/__agent-shim/orpc";
@@ -2751,9 +2753,9 @@ declare function createRcApiRouter(deps: RcApiDeps): {
 /** The typed API's router, as the CLI-side client's own type is derived from it. */
 type RcApiRouter = ReturnType<typeof createRcApiRouter>;
 /**
- * Builds the node handler that serves one router of the door's typed API under the mount's one prefix: the pre-pipeline surface the provider listener hands every request under `RC_ORPC_PATH_PREFIX`, answering with `matched: false` for a path under the prefix that names no procedure (which the listener itself answers as a 404). Request bodies are bounded by the same protocol cap the bespoke routes apply. Every router the mount serves (Remote Control and the control plane) goes through this one builder, so the prefix, the context and the cap are stated once.
+ * Builds the node handler that serves one router of the door's typed API under the mount's one prefix, twice over: the OpenAPI handler answers every route-annotated (method, path) pair as plain REST (every annotation under `/rest`, which no RPC procedure path begins with, so the RPC protocol's own POSTs always fall through untouched), and everything else falls to the RPC handler, which answers the oRPC protocol the typed clients and the web client speak. The OpenAPI document of the annotated routes is served at `RC_OPENAPI_DOC_PATH`, behind the same per-generation control token the procedures demand, so a consumer with no TypeScript client reads the whole surface from the mount itself. The pre-pipeline surface the provider listener hands every request under `RC_ORPC_PATH_PREFIX`, answering with `matched: false` for a path under the prefix that names no route and no procedure (which the listener itself answers as a 404). Request bodies are bounded by the same protocol cap the bespoke routes apply, on both handlers. Every router the mount serves (Remote Control and the control plane) goes through this one builder, so the prefix, the context and the cap are stated once.
  */
-declare function doorApiNodeHandlerOf(router: AnyRouter): PrePipelineApi;
+declare function doorApiNodeHandlerOf(router: AnyRouter, expectedToken: string): PrePipelineApi;
 /**
  * Builds the typed API's node handler for the Remote Control router alone: the pre-pipeline surface the provider listener hands every request under `RC_ORPC_PATH_PREFIX`.
  */
@@ -4439,13 +4441,13 @@ declare function createControlApiRouter(deps: ControlApiDeps): {
                     "config-profile": "config-profile";
                     identity: "identity";
                     provider: "provider";
-                    pool: "pool";
-                    keychain: "keychain";
                     "ambient-credential": "ambient-credential";
                     "binary-discovery": "binary-discovery";
                     "claude-shim": "claude-shim";
                     "path-resolution": "path-resolution";
                     "legacy-name": "legacy-name";
+                    pool: "pool";
+                    keychain: "keychain";
                     "directory-rules": "directory-rules";
                     "categories-local": "categories-local";
                     "active-identity": "active-identity";
@@ -4974,13 +4976,13 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                     "config-profile": "config-profile";
                     identity: "identity";
                     provider: "provider";
-                    pool: "pool";
-                    keychain: "keychain";
                     "ambient-credential": "ambient-credential";
                     "binary-discovery": "binary-discovery";
                     "claude-shim": "claude-shim";
                     "path-resolution": "path-resolution";
                     "legacy-name": "legacy-name";
+                    pool: "pool";
+                    keychain: "keychain";
                     "directory-rules": "directory-rules";
                     "categories-local": "categories-local";
                     "active-identity": "active-identity";
@@ -5422,13 +5424,13 @@ declare const DoctorFindingSchema: z.ZodObject<{
         "config-profile": "config-profile";
         identity: "identity";
         provider: "provider";
-        pool: "pool";
-        keychain: "keychain";
         "ambient-credential": "ambient-credential";
         "binary-discovery": "binary-discovery";
         "claude-shim": "claude-shim";
         "path-resolution": "path-resolution";
         "legacy-name": "legacy-name";
+        pool: "pool";
+        keychain: "keychain";
         "directory-rules": "directory-rules";
         "categories-local": "categories-local";
         "active-identity": "active-identity";
@@ -5451,13 +5453,13 @@ declare const DoctorRunOutputSchema: z.ZodObject<{
             "config-profile": "config-profile";
             identity: "identity";
             provider: "provider";
-            pool: "pool";
-            keychain: "keychain";
             "ambient-credential": "ambient-credential";
             "binary-discovery": "binary-discovery";
             "claude-shim": "claude-shim";
             "path-resolution": "path-resolution";
             "legacy-name": "legacy-name";
+            pool: "pool";
+            keychain: "keychain";
             "directory-rules": "directory-rules";
             "categories-local": "categories-local";
             "active-identity": "active-identity";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-shim",
-  "version": "8.27.1",
+  "version": "8.29.0",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",
@@ -51,6 +51,7 @@
   "dependencies": {
     "@clack/prompts": "^1.8.0",
     "@orpc/client": "1.15.4",
+    "@orpc/openapi": "1.15.4",
     "@orpc/server": "1.15.4",
     "commander": "^15.0.0",
     "cosmiconfig": "^10.0.1",