agent-shim 8.28.0 → 8.30.0

package/dist/index.cjs

@@ -5333,10 +5333,113 @@ function createRcCredentialStore(fs12, dir) {
 // src/frontdoor/rcApi.ts
 var import_client = require("@orpc/client");
 var import_fetch = require("@orpc/client/fetch");
+var import_openapi = require("@orpc/openapi");
+var import_node = require("@orpc/openapi/node");
 var import_server2 = require("@orpc/server");
-var import_node = require("@orpc/server/node");
+var import_node2 = require("@orpc/server/node");
 var import_undici = require("undici");
 
+// package.json
+var package_default = {
+  name: "agent-shim",
+  version: "8.30.0",
+  description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
+  license: "MIT",
+  author: "Joseph Mearman <joseph@mearman.co.uk>",
+  repository: {
+    type: "git",
+    url: "git+https://github.com/ExaDev/agent-shim.git"
+  },
+  homepage: "https://github.com/ExaDev/agent-shim#readme",
+  bugs: "https://github.com/ExaDev/agent-shim/issues",
+  keywords: [
+    "claude-code",
+    "claude",
+    "cli"
+  ],
+  packageManager: "pnpm@12.4.1+sha512.2e81e399d73fe8390dab25e06aa788ab7a5908248d2f5a370f82b481147a6a7a367bf8048f9a6fdb6460f21a66f0542dedb8b94ca2c8723596741920b1656d4c",
+  type: "module",
+  engines: {
+    node: "^22.18 || >=24"
+  },
+  bin: {
+    "agent-shim": "dist/cli.cjs",
+    "claude-use": "dist/cli.cjs"
+  },
+  files: [
+    "dist/cli.cjs",
+    "dist/index.mjs",
+    "dist/index.cjs",
+    "dist/types"
+  ],
+  scripts: {
+    prepare: "husky && node scripts/build.mts --bundle-only",
+    typecheck: "turbo run _typecheck",
+    _typecheck: "tsc --noEmit",
+    lint: "turbo run _lint",
+    _lint: "eslint . --cache --cache-location .eslintcache --max-warnings 0",
+    test: "turbo run _test",
+    _test: "vitest run",
+    "test:coverage": "turbo run _test:coverage",
+    "_test:coverage": "vitest run --coverage",
+    knip: "turbo run _knip",
+    _knip: "knip --cache",
+    build: "turbo run _build",
+    _build: "node scripts/build.mts",
+    "build:bundle": "node scripts/build.mts --bundle-only",
+    prepublishOnly: "pnpm build:bundle",
+    schema: "node scripts/gen-schema.mts"
+  },
+  dependencies: {
+    "@clack/prompts": "^1.8.0",
+    "@orpc/client": "1.15.4",
+    "@orpc/openapi": "1.15.4",
+    "@orpc/server": "1.15.4",
+    commander: "^15.0.0",
+    cosmiconfig: "^10.0.1",
+    picomatch: "^4.0.7",
+    undici: "7.29.1",
+    zod: "^4.6.1"
+  },
+  devDependencies: {
+    "@commitlint/cli": "^21.2.2",
+    "@commitlint/config-conventional": "^21.2.2",
+    "@exadev/eslint-config": "2.12.1",
+    "@semantic-release/changelog": "^7.0.0",
+    "@semantic-release/git": "^11.0.1",
+    "@semantic-release/npm": "^13.1.5",
+    "@types/node": "^26.5.1",
+    "@types/picomatch": "^4.0.3",
+    "@vitest/coverage-v8": "^4.1.11",
+    "conventional-changelog-conventionalcommits": "^10.4.0",
+    esbuild: "^0.28.2",
+    eslint: "^10.10.0",
+    globals: "^17.12.0",
+    husky: "^9.1.7",
+    jiti: "^2.7.0",
+    knip: "^6.35.1",
+    "lint-staged": "^17.5.0",
+    rollup: "4.64.0",
+    "rollup-plugin-dts": "6.5.1",
+    "semantic-release": "^25.0.9",
+    turbo: "^2.11.5",
+    typescript: "^6.0.3",
+    "typescript-eslint": "^8.70.0",
+    vitest: "^4.1.11"
+  },
+  main: "dist/index.cjs",
+  module: "dist/index.mjs",
+  types: "dist/types/index.d.ts",
+  exports: {
+    ".": {
+      types: "./dist/types/index.d.ts",
+      import: "./dist/index.mjs",
+      require: "./dist/index.cjs"
+    },
+    "./package.json": "./package.json"
+  }
+};
+
 // src/frontdoor/rcSchemas.ts
 var import_zod4 = require("zod");
 var RcPermissionModeSchema = import_zod4.z.enum(RC_PERMISSION_MODES);
@@ -5498,18 +5601,23 @@ var RcAnswerOutputSchema = import_zod4.z.strictObject({
 
 // src/frontdoor/rcApi.ts
 var RC_ORPC_PATH_PREFIX = "/__agent-shim/orpc";
+var RC_OPENAPI_DOC_PATH = "/openapi.json";
 var RC_SUBSCRIBER_BUFFER_EVENTS = 100;
+function doorApiBearer(headers) {
+  const presented = headers.authorization;
+  const bearerPrefix = "bearer ".length;
+  return typeof presented === "string" && presented.slice(0, bearerPrefix).toLowerCase() === "bearer " ? presented.slice(bearerPrefix) : void 0;
+}
 function doorApiAuth(expectedToken) {
   return import_server2.os.$context().use(({ context, next }) => {
-    const presented = context.headers.authorization;
-    const bearerPrefix = "bearer ".length;
-    const token = typeof presented === "string" && presented.slice(0, bearerPrefix).toLowerCase() === "bearer " ? presented.slice(bearerPrefix) : void 0;
+    const token = doorApiBearer(context.headers);
     if (token === void 0 || !isLiveCapability(token, [expectedToken])) {
       throw new import_client.ORPCError("UNAUTHORIZED", { message: "the front door's typed API demands this generation's control token as a Bearer credential" });
     }
     return next();
   });
 }
+var RC_API_TAG = "remote-control";
 function createRcApiRouter(deps) {
   const authed = doorApiAuth(deps.expectedToken);
   const delivered = (sessionId, result) => {
@@ -5529,41 +5637,41 @@ function createRcApiRouter(deps) {
   };
   return {
     rc: {
-      list: authed.output(RcListOutputSchema).handler(() => ({ sessions: deps.list() })),
-      status: authed.input(RcSessionQuerySchema).output(RcStatusOutputSchema).handler(({ input }) => {
+      list: authed.route({ method: "GET", path: "/rest/rc/sessions", summary: "List the observed Remote Control sessions", tags: [RC_API_TAG] }).output(RcListOutputSchema).handler(() => ({ sessions: deps.list() })),
+      status: authed.route({ method: "GET", path: "/rest/rc/status", summary: "Read session status, one session's when named", tags: [RC_API_TAG] }).input(RcSessionQuerySchema).output(RcStatusOutputSchema).handler(({ input }) => {
         const statuses = deps.statusOf(input.session);
         if (input.session !== void 0 && !statuses.some((entry) => entry.id === input.session)) {
           throw new import_client.ORPCError("NOT_FOUND", { message: rcSessionNotObservedMessage(input.session) });
         }
         return { statuses };
       }),
-      pending: authed.input(RcSessionQuerySchema).output(RcPendingOutputSchema).handler(({ input }) => {
+      pending: authed.route({ method: "GET", path: "/rest/rc/pending", summary: "Read the control requests awaiting an answer", tags: [RC_API_TAG] }).input(RcSessionQuerySchema).output(RcPendingOutputSchema).handler(({ input }) => {
         const pending = deps.pendingOf(input.session);
         if (input.session !== void 0 && deps.statusOf(input.session).length === 0) {
           throw new import_client.ORPCError("NOT_FOUND", { message: rcSessionNotObservedMessage(input.session) });
         }
         return { pending };
       }),
-      send: authed.input(RcSendInputSchema).output(RcWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, sequenceNums: delivered(input.session, await deps.inject(input.session, input.text)) })),
-      answer: authed.input(RcAnswerInputSchema).output(RcAnswerOutputSchema).handler(async ({ input }) => {
+      send: authed.route({ method: "POST", path: "/rest/rc/send", summary: "Send one message into a session", tags: [RC_API_TAG] }).input(RcSendInputSchema).output(RcWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, sequenceNums: delivered(input.session, await deps.inject(input.session, input.text)) })),
+      answer: authed.route({ method: "POST", path: "/rest/rc/answer", summary: "Answer one pending control request", tags: [RC_API_TAG] }).input(RcAnswerInputSchema).output(RcAnswerOutputSchema).handler(async ({ input }) => {
         const decision = { approve: input.approve, message: input.approve || input.text === void 0 ? void 0 : input.text };
         return { session: input.session, request: input.request, sequenceNums: delivered(input.session, await deps.answer(input.session, input.request, decision)) };
       }),
-      interrupt: authed.input(RcInterruptInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.interrupt(input.session)) })),
-      setModel: authed.input(RcSetModelInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.setModel(input.session, input.model)) })),
-      setPermissionMode: authed.input(RcSetPermissionModeInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.setPermissionMode(input.session, input.mode)) })),
-      endSession: authed.input(RcEndSessionInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.endSession(input.session, input.reason)) })),
-      getUsage: authed.input(RcGetUsageInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.getUsage(input.session, input.skipBehaviors)) })),
-      getContextUsage: authed.input(RcGetContextUsageInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.getContextUsage(input.session, input.detail)) })),
-      readFile: authed.input(RcReadFileInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.readFile(input.session, input.path, { ...input.maxBytes === void 0 ? {} : { maxBytes: input.maxBytes }, ...input.encoding === void 0 ? {} : { encoding: input.encoding } })) })),
-      fileSuggestions: authed.input(RcFileSuggestionsInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.fileSuggestions(input.session, input.query)) })),
-      keepAlive: authed.input(RcKeepAliveInputSchema).output(RcWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, sequenceNums: delivered(input.session, await deps.keepAlive(input.session)) })),
-      mcpStatus: authed.input(RcMcpStatusInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpStatus(input.session)) })),
-      mcpReconnect: authed.input(RcMcpReconnectInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpReconnect(input.session, input.serverName)) })),
-      mcpAuthenticate: authed.input(RcMcpAuthenticateInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpAuthenticate(input.session, input.serverName, input.redirectUri)) })),
-      mcpOAuthCallbackUrl: authed.input(RcMcpOAuthCallbackUrlInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpOAuthCallbackUrl(input.session, input.serverName, input.callbackUrl)) })),
-      teleport: authed.input(RcTeleportInputSchema).output(RcWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, sequenceNums: delivered(input.session, await deps.teleport(input.session, input.marker)) })),
-      subscribe: authed.input(RcSessionQuerySchema).output((0, import_server2.eventIterator)(RcStreamEventSchema)).handler(async function* ({ input, signal }) {
+      interrupt: authed.route({ method: "POST", path: "/rest/rc/interrupt", summary: "Interrupt a session's running turn", tags: [RC_API_TAG] }).input(RcInterruptInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.interrupt(input.session)) })),
+      setModel: authed.route({ method: "POST", path: "/rest/rc/set-model", summary: "Switch a session's model", tags: [RC_API_TAG] }).input(RcSetModelInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.setModel(input.session, input.model)) })),
+      setPermissionMode: authed.route({ method: "POST", path: "/rest/rc/set-permission-mode", summary: "Switch a session's permission mode", tags: [RC_API_TAG] }).input(RcSetPermissionModeInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.setPermissionMode(input.session, input.mode)) })),
+      endSession: authed.route({ method: "POST", path: "/rest/rc/end-session", summary: "End a session", tags: [RC_API_TAG] }).input(RcEndSessionInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.endSession(input.session, input.reason)) })),
+      getUsage: authed.route({ method: "POST", path: "/rest/rc/get-usage", summary: "Ask a session for its usage snapshot", tags: [RC_API_TAG] }).input(RcGetUsageInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.getUsage(input.session, input.skipBehaviors)) })),
+      getContextUsage: authed.route({ method: "POST", path: "/rest/rc/get-context-usage", summary: "Ask a session for its context usage", tags: [RC_API_TAG] }).input(RcGetContextUsageInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.getContextUsage(input.session, input.detail)) })),
+      readFile: authed.route({ method: "POST", path: "/rest/rc/read-file", summary: "Ask a session to read one file", tags: [RC_API_TAG] }).input(RcReadFileInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.readFile(input.session, input.path, { ...input.maxBytes === void 0 ? {} : { maxBytes: input.maxBytes }, ...input.encoding === void 0 ? {} : { encoding: input.encoding } })) })),
+      fileSuggestions: authed.route({ method: "POST", path: "/rest/rc/file-suggestions", summary: "Ask a session for file-path suggestions", tags: [RC_API_TAG] }).input(RcFileSuggestionsInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.fileSuggestions(input.session, input.query)) })),
+      keepAlive: authed.route({ method: "POST", path: "/rest/rc/keep-alive", summary: "Keep a session's bridge alive", tags: [RC_API_TAG] }).input(RcKeepAliveInputSchema).output(RcWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, sequenceNums: delivered(input.session, await deps.keepAlive(input.session)) })),
+      mcpStatus: authed.route({ method: "POST", path: "/rest/rc/mcp-status", summary: "Ask a session for its MCP servers' status", tags: [RC_API_TAG] }).input(RcMcpStatusInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpStatus(input.session)) })),
+      mcpReconnect: authed.route({ method: "POST", path: "/rest/rc/mcp-reconnect", summary: "Ask a session to reconnect one MCP server", tags: [RC_API_TAG] }).input(RcMcpReconnectInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpReconnect(input.session, input.serverName)) })),
+      mcpAuthenticate: authed.route({ method: "POST", path: "/rest/rc/mcp-authenticate", summary: "Start OAuth for one MCP server on a session", tags: [RC_API_TAG] }).input(RcMcpAuthenticateInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpAuthenticate(input.session, input.serverName, input.redirectUri)) })),
+      mcpOAuthCallbackUrl: authed.route({ method: "POST", path: "/rest/rc/mcp-oauth-callback-url", summary: "Hand a completed MCP OAuth callback to a session", tags: [RC_API_TAG] }).input(RcMcpOAuthCallbackUrlInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpOAuthCallbackUrl(input.session, input.serverName, input.callbackUrl)) })),
+      teleport: authed.route({ method: "POST", path: "/rest/rc/teleport", summary: "Teleport a session to a conversation marker", tags: [RC_API_TAG] }).input(RcTeleportInputSchema).output(RcWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, sequenceNums: delivered(input.session, await deps.teleport(input.session, input.marker)) })),
+      subscribe: authed.route({ method: "GET", path: "/rest/rc/events", summary: "Stream a session's Remote Control events (SSE)", tags: [RC_API_TAG] }).input(RcSessionQuerySchema).output((0, import_server2.eventIterator)(RcStreamEventSchema)).handler(async function* ({ input, signal }) {
         const queue = [];
         let wake;
         const detach = deps.fanout.subscribe(input.session, (event) => {
@@ -5600,15 +5708,44 @@ function createRcApiRouter(deps) {
     }
   };
 }
-function doorApiNodeHandlerOf(router) {
-  const handler = new import_node.RPCHandler(router, { plugins: [new import_node.BodyLimitPlugin({ maxBodySize: CONTROL_BODY_CAP_BYTES })] });
+function doorApiNodeHandlerOf(router, expectedToken) {
+  const plugins = [new import_node2.BodyLimitPlugin({ maxBodySize: CONTROL_BODY_CAP_BYTES })];
+  const rpcHandler = new import_node2.RPCHandler(router, { plugins });
+  const restHandler = new import_node.OpenAPIHandler(router, { plugins });
+  let document;
+  const documentOf = async () => document ??= new import_openapi.OpenAPIGenerator().generate(router, { info: { title: "agent-shim front door API", version: package_default.version } });
   return {
     pathPrefix: RC_ORPC_PATH_PREFIX,
-    handle: async (request4, response) => await handler.handle(request4, response, { context: { headers: request4.headers }, prefix: RC_ORPC_PATH_PREFIX })
+    handle: async (request4, response) => {
+      if (request4.method === "GET" && request4.url === `${RC_ORPC_PATH_PREFIX}${RC_OPENAPI_DOC_PATH}`) {
+        const token = doorApiBearer(request4.headers);
+        if (token === void 0 || !isLiveCapability(token, [expectedToken])) {
+          const refusal = new import_client.ORPCError("UNAUTHORIZED", { message: "the front door's OpenAPI document demands this generation's control token as a Bearer credential" });
+          response.writeHead(HTTP_STATUS.unauthorized, { "content-type": "application/json" });
+          response.end(JSON.stringify(refusal.toJSON()));
+          return { matched: true };
+        }
+        try {
+          const doc = await documentOf();
+          response.writeHead(HTTP_STATUS.ok, { "content-type": "application/json" });
+          response.end(JSON.stringify(doc));
+        } catch (error) {
+          const refusal = new import_client.ORPCError("INTERNAL_SERVER_ERROR", { message: `the OpenAPI document could not be generated from the door's own router: ${error instanceof Error ? error.message : String(error)}` });
+          response.writeHead(HTTP_STATUS.internalServerError, { "content-type": "application/json" });
+          response.end(JSON.stringify(refusal.toJSON()));
+        }
+        return { matched: true };
+      }
+      const rest = await restHandler.handle(request4, response, { context: { headers: request4.headers }, prefix: RC_ORPC_PATH_PREFIX });
+      if (rest.matched) {
+        return rest;
+      }
+      return await rpcHandler.handle(request4, response, { context: { headers: request4.headers }, prefix: RC_ORPC_PATH_PREFIX });
+    }
   };
 }
 function createRcApiNodeHandler(deps) {
-  return doorApiNodeHandlerOf(createRcApiRouter(deps));
+  return doorApiNodeHandlerOf(createRcApiRouter(deps), deps.expectedToken);
 }
 function frontDoorApiLink(port, ca, token) {
   const dispatcher = new import_undici.Agent({ connect: { ca } });
@@ -10043,6 +10180,10 @@ var CheckRunInputSchema = import_zod19.z.strictObject({
   path: import_zod19.z.string().min(1),
   identity: import_zod19.z.string().min(1).optional()
 }).refine((input) => import_node_path27.default.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+var PoolPickInputSchema = import_zod19.z.strictObject({
+  pool: import_zod19.z.string().min(1),
+  path: import_zod19.z.string().min(1)
+}).refine((input) => import_node_path27.default.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
 var DoctorFindingSchema = import_zod19.z.strictObject({
   section: import_zod19.z.enum(DOCTOR_SECTIONS),
   subject: import_zod19.z.string().optional(),
@@ -10080,11 +10221,12 @@ var LaunchLifecycleEventSchema = import_zod20.z.strictObject({
 });
 
 // src/frontdoor/eventsApi.ts
+var EVENTS_API_TAG = "events";
 function createEventsApiRouter(deps) {
   const authed = doorApiAuth(deps.expectedToken);
   return {
     events: {
-      subscribe: authed.input(DoorEventSourceQuerySchema).output((0, import_server3.eventIterator)(DoorEventSchema)).handler(async function* ({ input, signal }) {
+      subscribe: authed.route({ method: "GET", path: "/rest/events", summary: "Stream the door's every event source (SSE)", tags: [EVENTS_API_TAG] }).input(DoorEventSourceQuerySchema).output((0, import_server3.eventIterator)(DoorEventSchema)).handler(async function* ({ input, signal }) {
         if (input.sources !== void 0) {
           const live = deps.events.sources();
           const unknown = input.sources.filter((source) => !live.includes(source));
@@ -10117,12 +10259,17 @@ function createEventsApiRouter(deps) {
 }
 
 // src/frontdoor/controlApi.ts
+var USAGE_API_TAG = "usage";
+var FRONTDOOR_API_TAG = "frontdoor";
+var CHECK_API_TAG = "check";
+var DOCTOR_API_TAG = "doctor";
+var POOL_API_TAG = "pool";
 function createControlApiRouter(deps) {
   const authed = doorApiAuth(deps.expectedToken);
   return {
     usage: {
-      list: authed.output(UsageListOutputSchema).handler(() => ({ snapshots: deps.usageSnapshots() })),
-      effectiveWindow: authed.input(UsageWindowsInputSchema).output(UsageWindowsOutputSchema).handler(({ input }) => {
+      list: authed.route({ method: "GET", path: "/rest/usage/snapshots", summary: "List every identity's usage snapshot", tags: [USAGE_API_TAG] }).output(UsageListOutputSchema).handler(() => ({ snapshots: deps.usageSnapshots() })),
+      effectiveWindow: authed.route({ method: "GET", path: "/rest/usage/windows", summary: "Read one identity's effective quota windows", tags: [USAGE_API_TAG] }).input(UsageWindowsInputSchema).output(UsageWindowsOutputSchema).handler(({ input }) => {
         const snapshot = deps.usageSnapshotOf(input.identity);
         if (snapshot === void 0) {
           throw new import_client3.ORPCError("NOT_FOUND", { message: `identity ${input.identity} has no usage snapshot yet, so no quota window has been observed for it` });
@@ -10139,7 +10286,7 @@ function createControlApiRouter(deps) {
           ...unified?.sevenDay === void 0 ? {} : { sevenDay: effectiveWindow(unified.sevenDay, now) }
         };
       }),
-      live: authed.input(RcSessionQuerySchema).output(UsageLiveOutputSchema).handler(({ input }) => {
+      live: authed.route({ method: "GET", path: "/rest/usage/live", summary: "Read the live rate-limit observations the event backbone files", tags: [USAGE_API_TAG] }).input(RcSessionQuerySchema).output(UsageLiveOutputSchema).handler(({ input }) => {
         const sessions = deps.liveRateLimits(input.session);
         if (input.session !== void 0 && sessions.length === 0) {
           if (deps.list().some((session) => session.id === input.session)) {
@@ -10151,15 +10298,27 @@ function createControlApiRouter(deps) {
       })
     },
     frontdoor: {
-      status: authed.output(FrontDoorStatusOutputSchema).handler(() => deps.frontDoorStatus()),
-      sessions: authed.output(FrontDoorSessionsOutputSchema).handler(() => ({ sessions: deps.frontDoorStatus().sessions }))
+      status: authed.route({ method: "GET", path: "/rest/frontdoor/status", summary: "Read the front door's status", tags: [FRONTDOOR_API_TAG] }).output(FrontDoorStatusOutputSchema).handler(() => deps.frontDoorStatus()),
+      sessions: authed.route({ method: "GET", path: "/rest/frontdoor/sessions", summary: "Read the front door's session registry", tags: [FRONTDOOR_API_TAG] }).output(FrontDoorSessionsOutputSchema).handler(() => ({ sessions: deps.frontDoorStatus().sessions }))
     },
     check: {
       // The report's own JSON shape is the contract (the same one `check --json` prints and `checkReportSchema.ts` defines), so the procedure returns exactly that conversion.
-      run: authed.input(CheckRunInputSchema).output(CheckReportJsonSchema).handler(({ input }) => checkReportToJson(deps.checkReport(input.path, input.identity)))
+      run: authed.route({ method: "GET", path: "/rest/check", summary: "Run the check report for one directory", tags: [CHECK_API_TAG] }).input(CheckRunInputSchema).output(CheckReportJsonSchema).handler(({ input }) => checkReportToJson(deps.checkReport(input.path, input.identity)))
     },
     doctor: {
-      run: authed.output(DoctorRunOutputSchema).handler(() => deps.doctorReport())
+      run: authed.route({ method: "GET", path: "/rest/doctor", summary: "Run the doctor report", tags: [DOCTOR_API_TAG] }).output(DoctorRunOutputSchema).handler(() => deps.doctorReport())
+    },
+    pool: {
+      pick: authed.route({ method: "GET", path: "/rest/pool/pick", summary: "Rank one pool exactly as a launch from a directory would right now", tags: [POOL_API_TAG] }).input(PoolPickInputSchema).output(PoolPickReportSchema).handler(({ input }) => {
+        const report = deps.poolPick(input.pool, input.path);
+        if (report === void 0) {
+          const live = deps.poolNames();
+          throw new import_client3.ORPCError("NOT_FOUND", {
+            message: live.length === 0 ? `no pools are configured, so none is named ${input.pool}` : `no pool is named ${input.pool}; the live pools are ${live.map((name) => `"${name}"`).join(", ")}`
+          });
+        }
+        return report;
+      })
     }
   };
 }
@@ -10167,7 +10326,7 @@ function createDoorApiRouter(deps) {
   return { ...createRcApiRouter(deps), ...createControlApiRouter(deps), ...createEventsApiRouter(deps) };
 }
 function createDoorApiNodeHandler(deps) {
-  return doorApiNodeHandlerOf(createDoorApiRouter(deps));
+  return doorApiNodeHandlerOf(createDoorApiRouter(deps), deps.expectedToken);
 }
 function frontDoorApiClient(port, ca, token) {
   return (0, import_client3.createORPCClient)(frontDoorApiLink(port, ca, token));
@@ -12253,106 +12412,6 @@ function removeDirectoryRule(paths, rulePath) {
 var import_node_crypto10 = require("node:crypto");
 var import_node_path30 = __toESM(require("node:path"), 1);
 
-// package.json
-var package_default = {
-  name: "agent-shim",
-  version: "8.28.0",
-  description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
-  license: "MIT",
-  author: "Joseph Mearman <joseph@mearman.co.uk>",
-  repository: {
-    type: "git",
-    url: "git+https://github.com/ExaDev/agent-shim.git"
-  },
-  homepage: "https://github.com/ExaDev/agent-shim#readme",
-  bugs: "https://github.com/ExaDev/agent-shim/issues",
-  keywords: [
-    "claude-code",
-    "claude",
-    "cli"
-  ],
-  packageManager: "pnpm@12.4.1+sha512.2e81e399d73fe8390dab25e06aa788ab7a5908248d2f5a370f82b481147a6a7a367bf8048f9a6fdb6460f21a66f0542dedb8b94ca2c8723596741920b1656d4c",
-  type: "module",
-  engines: {
-    node: "^22.18 || >=24"
-  },
-  bin: {
-    "agent-shim": "dist/cli.cjs",
-    "claude-use": "dist/cli.cjs"
-  },
-  files: [
-    "dist/cli.cjs",
-    "dist/index.mjs",
-    "dist/index.cjs",
-    "dist/types"
-  ],
-  scripts: {
-    prepare: "husky && node scripts/build.mts --bundle-only",
-    typecheck: "turbo run _typecheck",
-    _typecheck: "tsc --noEmit",
-    lint: "turbo run _lint",
-    _lint: "eslint . --cache --cache-location .eslintcache --max-warnings 0",
-    test: "turbo run _test",
-    _test: "vitest run",
-    "test:coverage": "turbo run _test:coverage",
-    "_test:coverage": "vitest run --coverage",
-    knip: "turbo run _knip",
-    _knip: "knip --cache",
-    build: "turbo run _build",
-    _build: "node scripts/build.mts",
-    "build:bundle": "node scripts/build.mts --bundle-only",
-    prepublishOnly: "pnpm build:bundle",
-    schema: "node scripts/gen-schema.mts"
-  },
-  dependencies: {
-    "@clack/prompts": "^1.8.0",
-    "@orpc/client": "1.15.4",
-    "@orpc/server": "1.15.4",
-    commander: "^15.0.0",
-    cosmiconfig: "^10.0.1",
-    picomatch: "^4.0.7",
-    undici: "7.29.1",
-    zod: "^4.6.1"
-  },
-  devDependencies: {
-    "@commitlint/cli": "^21.2.2",
-    "@commitlint/config-conventional": "^21.2.2",
-    "@exadev/eslint-config": "2.12.1",
-    "@semantic-release/changelog": "^7.0.0",
-    "@semantic-release/git": "^11.0.1",
-    "@semantic-release/npm": "^13.1.5",
-    "@types/node": "^26.5.1",
-    "@types/picomatch": "^4.0.3",
-    "@vitest/coverage-v8": "^4.1.11",
-    "conventional-changelog-conventionalcommits": "^10.4.0",
-    esbuild: "^0.28.2",
-    eslint: "^10.10.0",
-    globals: "^17.12.0",
-    husky: "^9.1.7",
-    jiti: "^2.7.0",
-    knip: "^6.35.1",
-    "lint-staged": "^17.5.0",
-    rollup: "4.64.0",
-    "rollup-plugin-dts": "6.5.1",
-    "semantic-release": "^25.0.9",
-    turbo: "^2.11.5",
-    typescript: "^6.0.3",
-    "typescript-eslint": "^8.70.0",
-    vitest: "^4.1.11"
-  },
-  main: "dist/index.cjs",
-  module: "dist/index.mjs",
-  types: "dist/types/index.d.ts",
-  exports: {
-    ".": {
-      types: "./dist/types/index.d.ts",
-      import: "./dist/index.mjs",
-      require: "./dist/index.cjs"
-    },
-    "./package.json": "./package.json"
-  }
-};
-
 // src/launcher/argv.ts
 var ConflictingIdentityError = class extends UsageError {
   constructor(positional, flag) {