agent-shim 8.33.0 → 8.34.0

package/dist/cli.cjs

@@ -57135,11 +57135,14 @@ var IDENTITY_NAME_PATTERN = "[A-Za-z0-9][A-Za-z0-9._@-]*";
 var PoolNameSchema = external_exports.string().min(1).regex(new RegExp(`^${POOL_NAME_PATTERN}$`));
 var SELECTOR_RE = new RegExp(`^(${POOL_SELECTOR_PREFIX}${POOL_NAME_PATTERN}|${IDENTITY_NAME_PATTERN})$`);
 var IdentitySelectorSchema = external_exports.string().min(1).regex(SELECTOR_RE);
-var PoolMemberSchema = external_exports.string().min(1).regex(SELECTOR_RE);
+var PoolMemberSchema = external_exports.union([external_exports.string().min(1).regex(SELECTOR_RE), external_exports.strictObject({ identity: external_exports.string().min(1).regex(SELECTOR_RE), when: WhenSchema })]);
+function poolMemberIdentity(member) {
+  return typeof member === "string" ? member : member.identity;
+}
 var POOL_PREFERENCES = ["score", "listed"];
 var PoolPreferenceSchema = external_exports.enum(POOL_PREFERENCES);
 var PoolSchema = external_exports.strictObject({
-  identities: external_exports.array(PoolMemberSchema).min(1).refine((members2) => new Set(members2).size === members2.length, { message: "pool members must be unique" }),
+  identities: external_exports.array(PoolMemberSchema).min(1).refine((members2) => new Set(members2.map(poolMemberIdentity)).size === members2.length, { message: "pool members must be unique" }),
   preference: PoolPreferenceSchema.optional()
 });
 var DirectoryRuleSchema = ConfigProfileSchema.omit({ description: true }).extend({
@@ -60153,7 +60156,7 @@ function writePools(paths, pools) {
 function poolCycleOf(pools, name) {
   const walk = (current, path46) => {
     for (const entry of pools[current]?.identities ?? []) {
-      const nested = poolNameOf(entry);
+      const nested = poolNameOf(poolMemberIdentity(entry));
       if (nested === void 0) {
         continue;
       }
@@ -60174,9 +60177,10 @@ function poolCycleOf(pools, name) {
 }
 function validateMembers(pools, name, members2) {
   for (const entry of members2) {
-    const nested = poolNameOf(entry);
+    const identity = poolMemberIdentity(entry);
+    const nested = poolNameOf(identity);
     if (nested !== void 0 && nested !== name && pools[nested] === void 0) {
-      throw new UsageError(`Member "${entry}" of pool "${name}" names a pool that is not defined. Run \`agent-shim pool add ${nested} --identity <name>...\` first.`);
+      throw new UsageError(`Member "${identity}" of pool "${name}" names a pool that is not defined. Run \`agent-shim pool add ${nested} --identity <name>...\` first.`);
     }
   }
   const cycle = poolCycleOf({ ...pools, [name]: { identities: [...members2] } }, name);
@@ -60915,12 +60919,18 @@ function parseDuration(value2) {
 }
 var evaluator = createSyncEvaluator({});
 function resolversOf(context) {
+  const pool = context.pool;
   const values = {
     now: context.nowMs,
     ...context.fact?.latestMtimeMs === void 0 ? {} : { "entry.latestMtimeMs": context.fact.latestMtimeMs },
     ...context.fact?.totalSizeBytes === void 0 ? {} : { "entry.totalSizeBytes": context.fact.totalSizeBytes },
     ...context.branch === void 0 ? {} : { "repo.branch": context.branch },
-    "repo.detached": context.branchDetached ?? false
+    "repo.detached": context.branchDetached ?? false,
+    ...pool?.fiveHour === void 0 ? {} : { "quota.fiveHour.remaining": pool.fiveHour.remaining, "quota.fiveHour.utilization": pool.fiveHour.utilization, "quota.fiveHour.hoursUntilReset": pool.fiveHour.hoursUntilReset },
+    ...pool?.sevenDay === void 0 ? {} : { "quota.sevenDay.remaining": pool.sevenDay.remaining, "quota.sevenDay.utilization": pool.sevenDay.utilization, "quota.sevenDay.hoursUntilReset": pool.sevenDay.hoursUntilReset },
+    ...pool?.burnPerHour === void 0 ? {} : { "quota.burnPerHour": pool.burnPerHour },
+    ...pool?.resuming === void 0 ? {} : { "session.resuming": pool.resuming },
+    ...pool?.lastPickHoursAgo === void 0 ? {} : { "session.lastPickHoursAgo": pool.lastPickHoursAgo }
   };
   return {
     resolveValue: (key) => {
@@ -63655,7 +63665,7 @@ function registerIdentityCommand(program2, deps) {
 // package.json
 var package_default = {
   name: "agent-shim",
-  version: "8.33.0",
+  version: "8.34.0",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -64744,12 +64754,48 @@ function assessIdentity(member, nowMs) {
     ...sevenDayBurn === void 0 ? {} : { sevenDayBurn }
   };
 }
+function poolFactsOf(member, nowMs, resuming, sticky) {
+  const unified = member.snapshot?.providers[ANTHROPIC_PROVIDER]?.rateLimit?.unified;
+  const window = (which) => {
+    const raw = unified?.[which];
+    if (raw?.utilization === void 0) {
+      return void 0;
+    }
+    if (raw.resetsAt === void 0) {
+      return void 0;
+    }
+    return { remaining: Math.max(0, 1 - raw.utilization), utilization: raw.utilization, hoursUntilReset: Math.max(0, (Date.parse(raw.resetsAt) - nowMs) / MS_PER_HOUR) };
+  };
+  const burn = windowBurn(member.records, "fiveHour");
+  return {
+    ...window("fiveHour") === void 0 ? {} : { fiveHour: window("fiveHour") },
+    ...window("sevenDay") === void 0 ? {} : { sevenDay: window("sevenDay") },
+    ...burn === void 0 ? {} : { burnPerHour: burn * MS_PER_HOUR },
+    resuming,
+    ...sticky?.identity === member.identity ? { lastPickHoursAgo: Math.max(0, (nowMs - Date.parse(sticky.at)) / MS_PER_HOUR) } : {}
+  };
+}
 function rankPool(input2) {
   const { members: members2, nowMs } = input2;
-  const assessments = members2.map((member) => assess(member, nowMs));
+  const assessments = members2.map((member) => ({ member, ...assess(member, nowMs) }));
   const demands = assessments.flatMap(({ candidate, burn }) => burn === void 0 ? [] : [burn * capacityOf(candidate.plan)]);
   const sharedDemand = demands.length === 0 ? void 0 : Math.max(...demands);
-  const candidates = assessments.map((assessment) => {
+  const guarded = assessments.map((assessment) => {
+    const { candidate } = assessment;
+    if (candidate.class === "ineligible" || assessment.member.policy === void 0) {
+      return assessment;
+    }
+    const context = { nowMs, env: {}, pool: poolFactsOf(assessment.member, nowMs, input2.resuming, input2.sticky) };
+    const verdict = evaluateWhen(assessment.member.policy, context);
+    if (verdict.status === "indeterminate") {
+      return { ...assessment, candidate: { ...candidate, policyDemoted: true, reasons: [`policy undecided (${verdict.checked.join(", ") === "predicate" ? "predicate" : verdict.checked.join(", ")}): ${verdict.reason}`, ...candidate.reasons] } };
+    }
+    if (verdict.passed) {
+      return assessment;
+    }
+    return { ...assessment, candidate: { ...candidate, class: "ineligible", reasons: [`skipped by policy (${verdict.checked.join(", ")}: did not hold)`, ...candidate.reasons] } };
+  });
+  const candidates = guarded.map((assessment) => {
     const { candidate, fiveHour, burn } = assessment;
     const pace = burn ?? (sharedDemand === void 0 ? void 0 : sharedDemand / capacityOf(candidate.plan));
     const { sevenDay, sevenDayBurn } = assessment;
@@ -64775,7 +64821,7 @@ function rankPool(input2) {
     return { ...candidate, feasible: false, reasons: [...drySpots, ...candidate.reasons] };
   });
   const ordered = input2.preference === "listed" ? [...candidates] : [...candidates].sort(
-    (left, right) => CLASS_ORDER[left.class] - CLASS_ORDER[right.class] || Number(right.feasible) - Number(left.feasible) || (right.score ?? 0) - (left.score ?? 0) || left.identity.localeCompare(right.identity)
+    (left, right) => CLASS_ORDER[left.class] - CLASS_ORDER[right.class] || Number(left.policyDemoted ?? false) - Number(right.policyDemoted ?? false) || Number(right.feasible) - Number(left.feasible) || (right.score ?? 0) - (left.score ?? 0) || left.identity.localeCompare(right.identity)
   );
   const sticky = input2.sticky;
   const stickyIndex = sticky === void 0 ? -1 : ordered.findIndex((candidate) => candidate.identity === sticky.identity);
@@ -65104,27 +65150,27 @@ function rankNamedPool(input2, poolName, stack, sticky) {
     throw new PoolGraphError(`No pool named "${poolName}". Run \`agent-shim pool add ${poolName} --identity <name>...\` first.`);
   }
   const childStack = [...stack, poolName];
-  const direct = pool.identities.filter((entry) => poolNameOf(entry) === void 0);
-  const missing = direct.filter((entry) => !input2.identityExists(entry)).map((identity) => ({ pool: poolName, identity }));
-  const loaded = new Map(loadPoolMembers(input2.fs, input2.paths, direct.filter(input2.identityExists), input2.nowMs).map((member) => [member.identity, member]));
+  const direct = pool.identities.filter((entry) => poolNameOf(poolMemberIdentity(entry)) === void 0);
+  const missing = direct.filter((entry) => !input2.identityExists(poolMemberIdentity(entry))).map((entry) => ({ pool: poolName, identity: poolMemberIdentity(entry) }));
+  const loaded = new Map(loadPoolMembers(input2.fs, input2.paths, direct.filter((entry) => input2.identityExists(poolMemberIdentity(entry))).map(poolMemberIdentity), input2.nowMs).map((member) => [member.identity, member]));
   const members2 = [];
   for (const entry of pool.identities) {
-    const nestedName = poolNameOf(entry);
+    const nestedName = poolNameOf(poolMemberIdentity(entry));
     if (nestedName === void 0) {
-      const member = loaded.get(entry);
+      const member = loaded.get(poolMemberIdentity(entry));
       if (member !== void 0) {
-        members2.push(member);
+        members2.push(typeof entry === "string" ? member : { ...member, policy: entry.when });
       }
       continue;
     }
     if (input2.pools[nestedName] === void 0) {
-      throw new PoolGraphError(`Pool "${poolName}" member "${entry}" names a pool that is not defined.`);
+      throw new PoolGraphError(`Pool "${poolName}" member "${poolMemberIdentity(entry)}" names a pool that is not defined.`);
     }
     if (childStack.includes(nestedName)) {
-      throw new PoolGraphError(`Pool "${poolName}" member "${entry}" closes a cycle: ${[...childStack.slice(childStack.indexOf(nestedName)), nestedName].join(" -> ")}. A pool cannot nest itself, directly or through another pool.`);
+      throw new PoolGraphError(`Pool "${poolName}" member "${poolMemberIdentity(entry)}" closes a cycle: ${[...childStack.slice(childStack.indexOf(nestedName)), nestedName].join(" -> ")}. A pool cannot nest itself, directly or through another pool.`);
     }
     const nested = nestedMember(input2, nestedName, childStack, sticky);
-    members2.push(nested.member);
+    members2.push(typeof entry === "string" ? nested.member : { ...nested.member, policy: entry.when });
     missing.push(...nested.missing);
   }
   const ranking = rankPool({
@@ -70139,16 +70185,16 @@ function runDoctor(params) {
   const validatedGlobalConfig = params.globalConfig.raw === void 0 ? void 0 : validateJson(GlobalConfigSchema, params.globalConfig);
   const pools = validatedGlobalConfig?.ok === true ? validatedGlobalConfig.data.pools ?? {} : {};
   for (const [poolName, pool] of Object.entries(pools)) {
-    const missing = pool.identities.filter((member) => poolNameOf(member) === void 0 && !validIdentityNames.has(member));
+    const missing = pool.identities.filter((member) => poolNameOf(poolMemberIdentity(member)) === void 0 && !validIdentityNames.has(poolMemberIdentity(member)));
     const undefinedPools = pool.identities.flatMap((member) => {
-      const nested = poolNameOf(member);
+      const nested = poolNameOf(poolMemberIdentity(member));
       return nested === void 0 || nested in pools ? [] : [nested];
     });
     if (missing.length === 0 && undefinedPools.length === 0) {
-      push("pool", "pass", `${poolName} is valid (${pool.identities.join(", ")}).`, poolName);
+      push("pool", "pass", `${poolName} is valid (${pool.identities.map(poolMemberIdentity).join(", ")}).`, poolName);
     } else {
       const problems = [
-        ...missing.map((member) => `identity "${member}", which does not exist`),
+        ...missing.map((member) => `identity "${poolMemberIdentity(member)}", which does not exist`),
         ...undefinedPools.map((nested) => `pool "${nested}", which is not defined`)
       ];
       push("pool", "fail", `Pool "${poolName}" names ${problems.join(" and ")}.`, poolName);
@@ -81780,12 +81826,12 @@ function registerPoolCommand(program2, deps) {
       }
       const members2 = options.identity === void 0 ? existing.identities : membersOf(options);
       if (options.identity !== void 0) {
-        requireIdentities(paths, members2);
+        requireIdentities(paths, membersOf(options));
       }
       const preference = options.preference === void 0 ? existing.preference : options.preference === false ? void 0 : options.preference;
       const updated = setPool(paths, name, members2, preference);
       reportMutation(options.json, { action: "updated", kind: "pool", name, value: updated }, () => {
-        console.log(`Pool "${name}" now has ${members2.join(", ")}.`);
+        console.log(`Pool "${name}" now has ${members2.map(poolMemberIdentity).join(", ")}.`);
       });
     }),
     ["agent-shim pool set subs --identity work --identity personal --identity spare", "agent-shim pool set subs --preference listed"]
@@ -81805,7 +81851,7 @@ function registerPoolCommand(program2, deps) {
       }
       for (const name of names) {
         const entry = pools[name];
-        console.log(`${active === `${POOL_SELECTOR_PREFIX}${name}` ? "*" : " "} ${name}: ${(entry?.identities ?? []).join(", ")}${entry?.preference === void 0 ? "" : " (preference: listed)"}`);
+        console.log(`${active === `${POOL_SELECTOR_PREFIX}${name}` ? "*" : " "} ${name}: ${(entry?.identities ?? []).map(poolMemberIdentity).join(", ")}${entry?.preference === void 0 ? "" : " (preference: listed)"}`);
       }
     }),
     ["agent-shim pool list", "agent-shim pool list --json"]
@@ -81818,7 +81864,7 @@ function registerPoolCommand(program2, deps) {
         return;
       }
       console.log(`Pool: ${name}`);
-      console.log(`Members: ${entry.identities.join(", ")}`);
+      console.log(`Members: ${entry.identities.map(poolMemberIdentity).join(", ")}`);
       if (entry.preference !== void 0) {
         console.log(`Preference: ${entry.preference}`);
       }

package/dist/index.cjs

@@ -623,11 +623,14 @@ var IDENTITY_NAME_PATTERN = "[A-Za-z0-9][A-Za-z0-9._@-]*";
 var PoolNameSchema = import_zod.z.string().min(1).regex(new RegExp(`^${POOL_NAME_PATTERN}$`));
 var SELECTOR_RE = new RegExp(`^(${POOL_SELECTOR_PREFIX}${POOL_NAME_PATTERN}|${IDENTITY_NAME_PATTERN})$`);
 var IdentitySelectorSchema = import_zod.z.string().min(1).regex(SELECTOR_RE);
-var PoolMemberSchema = import_zod.z.string().min(1).regex(SELECTOR_RE);
+var PoolMemberSchema = import_zod.z.union([import_zod.z.string().min(1).regex(SELECTOR_RE), import_zod.z.strictObject({ identity: import_zod.z.string().min(1).regex(SELECTOR_RE), when: WhenSchema })]);
+function poolMemberIdentity(member) {
+  return typeof member === "string" ? member : member.identity;
+}
 var POOL_PREFERENCES = ["score", "listed"];
 var PoolPreferenceSchema = import_zod.z.enum(POOL_PREFERENCES);
 var PoolSchema = import_zod.z.strictObject({
-  identities: import_zod.z.array(PoolMemberSchema).min(1).refine((members) => new Set(members).size === members.length, { message: "pool members must be unique" }),
+  identities: import_zod.z.array(PoolMemberSchema).min(1).refine((members) => new Set(members.map(poolMemberIdentity)).size === members.length, { message: "pool members must be unique" }),
   preference: PoolPreferenceSchema.optional()
 });
 var DirectoryRuleSchema = ConfigProfileSchema.omit({ description: true }).extend({
@@ -1004,12 +1007,18 @@ function matchBranch(pattern, branch, detached = false) {
 }
 var evaluator = (0, import_trilean2.createSyncEvaluator)({});
 function resolversOf(context) {
+  const pool = context.pool;
   const values = {
     now: context.nowMs,
     ...context.fact?.latestMtimeMs === void 0 ? {} : { "entry.latestMtimeMs": context.fact.latestMtimeMs },
     ...context.fact?.totalSizeBytes === void 0 ? {} : { "entry.totalSizeBytes": context.fact.totalSizeBytes },
     ...context.branch === void 0 ? {} : { "repo.branch": context.branch },
-    "repo.detached": context.branchDetached ?? false
+    "repo.detached": context.branchDetached ?? false,
+    ...pool?.fiveHour === void 0 ? {} : { "quota.fiveHour.remaining": pool.fiveHour.remaining, "quota.fiveHour.utilization": pool.fiveHour.utilization, "quota.fiveHour.hoursUntilReset": pool.fiveHour.hoursUntilReset },
+    ...pool?.sevenDay === void 0 ? {} : { "quota.sevenDay.remaining": pool.sevenDay.remaining, "quota.sevenDay.utilization": pool.sevenDay.utilization, "quota.sevenDay.hoursUntilReset": pool.sevenDay.hoursUntilReset },
+    ...pool?.burnPerHour === void 0 ? {} : { "quota.burnPerHour": pool.burnPerHour },
+    ...pool?.resuming === void 0 ? {} : { "session.resuming": pool.resuming },
+    ...pool?.lastPickHoursAgo === void 0 ? {} : { "session.lastPickHoursAgo": pool.lastPickHoursAgo }
   };
   return {
     resolveValue: (key) => {
@@ -5390,7 +5399,7 @@ var import_undici = require("undici");
 // package.json
 var package_default = {
   name: "agent-shim",
-  version: "8.33.0",
+  version: "8.34.0",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -6682,12 +6691,48 @@ function assessIdentity(member, nowMs) {
     ...sevenDayBurn === void 0 ? {} : { sevenDayBurn }
   };
 }
+function poolFactsOf(member, nowMs, resuming, sticky) {
+  const unified = member.snapshot?.providers[ANTHROPIC_PROVIDER]?.rateLimit?.unified;
+  const window = (which) => {
+    const raw = unified?.[which];
+    if (raw?.utilization === void 0) {
+      return void 0;
+    }
+    if (raw.resetsAt === void 0) {
+      return void 0;
+    }
+    return { remaining: Math.max(0, 1 - raw.utilization), utilization: raw.utilization, hoursUntilReset: Math.max(0, (Date.parse(raw.resetsAt) - nowMs) / MS_PER_HOUR) };
+  };
+  const burn = windowBurn(member.records, "fiveHour");
+  return {
+    ...window("fiveHour") === void 0 ? {} : { fiveHour: window("fiveHour") },
+    ...window("sevenDay") === void 0 ? {} : { sevenDay: window("sevenDay") },
+    ...burn === void 0 ? {} : { burnPerHour: burn * MS_PER_HOUR },
+    resuming,
+    ...sticky?.identity === member.identity ? { lastPickHoursAgo: Math.max(0, (nowMs - Date.parse(sticky.at)) / MS_PER_HOUR) } : {}
+  };
+}
 function rankPool(input) {
   const { members, nowMs } = input;
-  const assessments = members.map((member) => assess(member, nowMs));
+  const assessments = members.map((member) => ({ member, ...assess(member, nowMs) }));
   const demands = assessments.flatMap(({ candidate, burn }) => burn === void 0 ? [] : [burn * capacityOf(candidate.plan)]);
   const sharedDemand = demands.length === 0 ? void 0 : Math.max(...demands);
-  const candidates = assessments.map((assessment) => {
+  const guarded = assessments.map((assessment) => {
+    const { candidate } = assessment;
+    if (candidate.class === "ineligible" || assessment.member.policy === void 0) {
+      return assessment;
+    }
+    const context = { nowMs, env: {}, pool: poolFactsOf(assessment.member, nowMs, input.resuming, input.sticky) };
+    const verdict = evaluateWhen(assessment.member.policy, context);
+    if (verdict.status === "indeterminate") {
+      return { ...assessment, candidate: { ...candidate, policyDemoted: true, reasons: [`policy undecided (${verdict.checked.join(", ") === "predicate" ? "predicate" : verdict.checked.join(", ")}): ${verdict.reason}`, ...candidate.reasons] } };
+    }
+    if (verdict.passed) {
+      return assessment;
+    }
+    return { ...assessment, candidate: { ...candidate, class: "ineligible", reasons: [`skipped by policy (${verdict.checked.join(", ")}: did not hold)`, ...candidate.reasons] } };
+  });
+  const candidates = guarded.map((assessment) => {
     const { candidate, fiveHour, burn } = assessment;
     const pace = burn ?? (sharedDemand === void 0 ? void 0 : sharedDemand / capacityOf(candidate.plan));
     const { sevenDay, sevenDayBurn } = assessment;
@@ -6713,7 +6758,7 @@ function rankPool(input) {
     return { ...candidate, feasible: false, reasons: [...drySpots, ...candidate.reasons] };
   });
   const ordered = input.preference === "listed" ? [...candidates] : [...candidates].sort(
-    (left, right) => CLASS_ORDER[left.class] - CLASS_ORDER[right.class] || Number(right.feasible) - Number(left.feasible) || (right.score ?? 0) - (left.score ?? 0) || left.identity.localeCompare(right.identity)
+    (left, right) => CLASS_ORDER[left.class] - CLASS_ORDER[right.class] || Number(left.policyDemoted ?? false) - Number(right.policyDemoted ?? false) || Number(right.feasible) - Number(left.feasible) || (right.score ?? 0) - (left.score ?? 0) || left.identity.localeCompare(right.identity)
   );
   const sticky = input.sticky;
   const stickyIndex = sticky === void 0 ? -1 : ordered.findIndex((candidate) => candidate.identity === sticky.identity);
@@ -6884,27 +6929,27 @@ function rankNamedPool(input, poolName, stack, sticky) {
     throw new PoolGraphError(`No pool named "${poolName}". Run \`agent-shim pool add ${poolName} --identity <name>...\` first.`);
   }
   const childStack = [...stack, poolName];
-  const direct = pool.identities.filter((entry) => poolNameOf(entry) === void 0);
-  const missing = direct.filter((entry) => !input.identityExists(entry)).map((identity) => ({ pool: poolName, identity }));
-  const loaded = new Map(loadPoolMembers(input.fs, input.paths, direct.filter(input.identityExists), input.nowMs).map((member) => [member.identity, member]));
+  const direct = pool.identities.filter((entry) => poolNameOf(poolMemberIdentity(entry)) === void 0);
+  const missing = direct.filter((entry) => !input.identityExists(poolMemberIdentity(entry))).map((entry) => ({ pool: poolName, identity: poolMemberIdentity(entry) }));
+  const loaded = new Map(loadPoolMembers(input.fs, input.paths, direct.filter((entry) => input.identityExists(poolMemberIdentity(entry))).map(poolMemberIdentity), input.nowMs).map((member) => [member.identity, member]));
   const members = [];
   for (const entry of pool.identities) {
-    const nestedName = poolNameOf(entry);
+    const nestedName = poolNameOf(poolMemberIdentity(entry));
     if (nestedName === void 0) {
-      const member = loaded.get(entry);
+      const member = loaded.get(poolMemberIdentity(entry));
       if (member !== void 0) {
-        members.push(member);
+        members.push(typeof entry === "string" ? member : { ...member, policy: entry.when });
       }
       continue;
     }
     if (input.pools[nestedName] === void 0) {
-      throw new PoolGraphError(`Pool "${poolName}" member "${entry}" names a pool that is not defined.`);
+      throw new PoolGraphError(`Pool "${poolName}" member "${poolMemberIdentity(entry)}" names a pool that is not defined.`);
     }
     if (childStack.includes(nestedName)) {
-      throw new PoolGraphError(`Pool "${poolName}" member "${entry}" closes a cycle: ${[...childStack.slice(childStack.indexOf(nestedName)), nestedName].join(" -> ")}. A pool cannot nest itself, directly or through another pool.`);
+      throw new PoolGraphError(`Pool "${poolName}" member "${poolMemberIdentity(entry)}" closes a cycle: ${[...childStack.slice(childStack.indexOf(nestedName)), nestedName].join(" -> ")}. A pool cannot nest itself, directly or through another pool.`);
     }
     const nested = nestedMember(input, nestedName, childStack, sticky);
-    members.push(nested.member);
+    members.push(typeof entry === "string" ? nested.member : { ...nested.member, policy: entry.when });
     missing.push(...nested.missing);
   }
   const ranking = rankPool({
@@ -7165,7 +7210,7 @@ function writePools(paths, pools) {
 function poolCycleOf(pools, name) {
   const walk = (current, path32) => {
     for (const entry of pools[current]?.identities ?? []) {
-      const nested = poolNameOf(entry);
+      const nested = poolNameOf(poolMemberIdentity(entry));
       if (nested === void 0) {
         continue;
       }
@@ -7186,9 +7231,10 @@ function poolCycleOf(pools, name) {
 }
 function validateMembers(pools, name, members) {
   for (const entry of members) {
-    const nested = poolNameOf(entry);
+    const identity = poolMemberIdentity(entry);
+    const nested = poolNameOf(identity);
     if (nested !== void 0 && nested !== name && pools[nested] === void 0) {
-      throw new UsageError(`Member "${entry}" of pool "${name}" names a pool that is not defined. Run \`agent-shim pool add ${nested} --identity <name>...\` first.`);
+      throw new UsageError(`Member "${identity}" of pool "${name}" names a pool that is not defined. Run \`agent-shim pool add ${nested} --identity <name>...\` first.`);
     }
   }
   const cycle = poolCycleOf({ ...pools, [name]: { identities: [...members] } }, name);
@@ -9893,16 +9939,16 @@ function runDoctor(params) {
   const validatedGlobalConfig = params.globalConfig.raw === void 0 ? void 0 : validateJson(GlobalConfigSchema, params.globalConfig);
   const pools = validatedGlobalConfig?.ok === true ? validatedGlobalConfig.data.pools ?? {} : {};
   for (const [poolName, pool] of Object.entries(pools)) {
-    const missing = pool.identities.filter((member) => poolNameOf(member) === void 0 && !validIdentityNames.has(member));
+    const missing = pool.identities.filter((member) => poolNameOf(poolMemberIdentity(member)) === void 0 && !validIdentityNames.has(poolMemberIdentity(member)));
     const undefinedPools = pool.identities.flatMap((member) => {
-      const nested = poolNameOf(member);
+      const nested = poolNameOf(poolMemberIdentity(member));
       return nested === void 0 || nested in pools ? [] : [nested];
     });
     if (missing.length === 0 && undefinedPools.length === 0) {
-      push("pool", "pass", `${poolName} is valid (${pool.identities.join(", ")}).`, poolName);
+      push("pool", "pass", `${poolName} is valid (${pool.identities.map(poolMemberIdentity).join(", ")}).`, poolName);
     } else {
       const problems = [
-        ...missing.map((member) => `identity "${member}", which does not exist`),
+        ...missing.map((member) => `identity "${poolMemberIdentity(member)}", which does not exist`),
         ...undefinedPools.map((nested) => `pool "${nested}", which is not defined`)
       ];
       push("pool", "fail", `Pool "${poolName}" names ${problems.join(" and ")}.`, poolName);

package/dist/index.mjs

@@ -311,11 +311,14 @@ var IDENTITY_NAME_PATTERN = "[A-Za-z0-9][A-Za-z0-9._@-]*";
 var PoolNameSchema = z.string().min(1).regex(new RegExp(`^${POOL_NAME_PATTERN}$`));
 var SELECTOR_RE = new RegExp(`^(${POOL_SELECTOR_PREFIX}${POOL_NAME_PATTERN}|${IDENTITY_NAME_PATTERN})$`);
 var IdentitySelectorSchema = z.string().min(1).regex(SELECTOR_RE);
-var PoolMemberSchema = z.string().min(1).regex(SELECTOR_RE);
+var PoolMemberSchema = z.union([z.string().min(1).regex(SELECTOR_RE), z.strictObject({ identity: z.string().min(1).regex(SELECTOR_RE), when: WhenSchema })]);
+function poolMemberIdentity(member) {
+  return typeof member === "string" ? member : member.identity;
+}
 var POOL_PREFERENCES = ["score", "listed"];
 var PoolPreferenceSchema = z.enum(POOL_PREFERENCES);
 var PoolSchema = z.strictObject({
-  identities: z.array(PoolMemberSchema).min(1).refine((members) => new Set(members).size === members.length, { message: "pool members must be unique" }),
+  identities: z.array(PoolMemberSchema).min(1).refine((members) => new Set(members.map(poolMemberIdentity)).size === members.length, { message: "pool members must be unique" }),
   preference: PoolPreferenceSchema.optional()
 });
 var DirectoryRuleSchema = ConfigProfileSchema.omit({ description: true }).extend({
@@ -692,12 +695,18 @@ function matchBranch(pattern, branch, detached = false) {
 }
 var evaluator = createSyncEvaluator({});
 function resolversOf(context) {
+  const pool = context.pool;
   const values = {
     now: context.nowMs,
     ...context.fact?.latestMtimeMs === void 0 ? {} : { "entry.latestMtimeMs": context.fact.latestMtimeMs },
     ...context.fact?.totalSizeBytes === void 0 ? {} : { "entry.totalSizeBytes": context.fact.totalSizeBytes },
     ...context.branch === void 0 ? {} : { "repo.branch": context.branch },
-    "repo.detached": context.branchDetached ?? false
+    "repo.detached": context.branchDetached ?? false,
+    ...pool?.fiveHour === void 0 ? {} : { "quota.fiveHour.remaining": pool.fiveHour.remaining, "quota.fiveHour.utilization": pool.fiveHour.utilization, "quota.fiveHour.hoursUntilReset": pool.fiveHour.hoursUntilReset },
+    ...pool?.sevenDay === void 0 ? {} : { "quota.sevenDay.remaining": pool.sevenDay.remaining, "quota.sevenDay.utilization": pool.sevenDay.utilization, "quota.sevenDay.hoursUntilReset": pool.sevenDay.hoursUntilReset },
+    ...pool?.burnPerHour === void 0 ? {} : { "quota.burnPerHour": pool.burnPerHour },
+    ...pool?.resuming === void 0 ? {} : { "session.resuming": pool.resuming },
+    ...pool?.lastPickHoursAgo === void 0 ? {} : { "session.lastPickHoursAgo": pool.lastPickHoursAgo }
   };
   return {
     resolveValue: (key) => {
@@ -5078,7 +5087,7 @@ import { Agent as Agent3, fetch as undiciFetch } from "undici";
 // package.json
 var package_default = {
   name: "agent-shim",
-  version: "8.33.0",
+  version: "8.34.0",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -6370,12 +6379,48 @@ function assessIdentity(member, nowMs) {
     ...sevenDayBurn === void 0 ? {} : { sevenDayBurn }
   };
 }
+function poolFactsOf(member, nowMs, resuming, sticky) {
+  const unified = member.snapshot?.providers[ANTHROPIC_PROVIDER]?.rateLimit?.unified;
+  const window = (which) => {
+    const raw = unified?.[which];
+    if (raw?.utilization === void 0) {
+      return void 0;
+    }
+    if (raw.resetsAt === void 0) {
+      return void 0;
+    }
+    return { remaining: Math.max(0, 1 - raw.utilization), utilization: raw.utilization, hoursUntilReset: Math.max(0, (Date.parse(raw.resetsAt) - nowMs) / MS_PER_HOUR) };
+  };
+  const burn = windowBurn(member.records, "fiveHour");
+  return {
+    ...window("fiveHour") === void 0 ? {} : { fiveHour: window("fiveHour") },
+    ...window("sevenDay") === void 0 ? {} : { sevenDay: window("sevenDay") },
+    ...burn === void 0 ? {} : { burnPerHour: burn * MS_PER_HOUR },
+    resuming,
+    ...sticky?.identity === member.identity ? { lastPickHoursAgo: Math.max(0, (nowMs - Date.parse(sticky.at)) / MS_PER_HOUR) } : {}
+  };
+}
 function rankPool(input) {
   const { members, nowMs } = input;
-  const assessments = members.map((member) => assess(member, nowMs));
+  const assessments = members.map((member) => ({ member, ...assess(member, nowMs) }));
   const demands = assessments.flatMap(({ candidate, burn }) => burn === void 0 ? [] : [burn * capacityOf(candidate.plan)]);
   const sharedDemand = demands.length === 0 ? void 0 : Math.max(...demands);
-  const candidates = assessments.map((assessment) => {
+  const guarded = assessments.map((assessment) => {
+    const { candidate } = assessment;
+    if (candidate.class === "ineligible" || assessment.member.policy === void 0) {
+      return assessment;
+    }
+    const context = { nowMs, env: {}, pool: poolFactsOf(assessment.member, nowMs, input.resuming, input.sticky) };
+    const verdict = evaluateWhen(assessment.member.policy, context);
+    if (verdict.status === "indeterminate") {
+      return { ...assessment, candidate: { ...candidate, policyDemoted: true, reasons: [`policy undecided (${verdict.checked.join(", ") === "predicate" ? "predicate" : verdict.checked.join(", ")}): ${verdict.reason}`, ...candidate.reasons] } };
+    }
+    if (verdict.passed) {
+      return assessment;
+    }
+    return { ...assessment, candidate: { ...candidate, class: "ineligible", reasons: [`skipped by policy (${verdict.checked.join(", ")}: did not hold)`, ...candidate.reasons] } };
+  });
+  const candidates = guarded.map((assessment) => {
     const { candidate, fiveHour, burn } = assessment;
     const pace = burn ?? (sharedDemand === void 0 ? void 0 : sharedDemand / capacityOf(candidate.plan));
     const { sevenDay, sevenDayBurn } = assessment;
@@ -6401,7 +6446,7 @@ function rankPool(input) {
     return { ...candidate, feasible: false, reasons: [...drySpots, ...candidate.reasons] };
   });
   const ordered = input.preference === "listed" ? [...candidates] : [...candidates].sort(
-    (left, right) => CLASS_ORDER[left.class] - CLASS_ORDER[right.class] || Number(right.feasible) - Number(left.feasible) || (right.score ?? 0) - (left.score ?? 0) || left.identity.localeCompare(right.identity)
+    (left, right) => CLASS_ORDER[left.class] - CLASS_ORDER[right.class] || Number(left.policyDemoted ?? false) - Number(right.policyDemoted ?? false) || Number(right.feasible) - Number(left.feasible) || (right.score ?? 0) - (left.score ?? 0) || left.identity.localeCompare(right.identity)
   );
   const sticky = input.sticky;
   const stickyIndex = sticky === void 0 ? -1 : ordered.findIndex((candidate) => candidate.identity === sticky.identity);
@@ -6572,27 +6617,27 @@ function rankNamedPool(input, poolName, stack, sticky) {
     throw new PoolGraphError(`No pool named "${poolName}". Run \`agent-shim pool add ${poolName} --identity <name>...\` first.`);
   }
   const childStack = [...stack, poolName];
-  const direct = pool.identities.filter((entry) => poolNameOf(entry) === void 0);
-  const missing = direct.filter((entry) => !input.identityExists(entry)).map((identity) => ({ pool: poolName, identity }));
-  const loaded = new Map(loadPoolMembers(input.fs, input.paths, direct.filter(input.identityExists), input.nowMs).map((member) => [member.identity, member]));
+  const direct = pool.identities.filter((entry) => poolNameOf(poolMemberIdentity(entry)) === void 0);
+  const missing = direct.filter((entry) => !input.identityExists(poolMemberIdentity(entry))).map((entry) => ({ pool: poolName, identity: poolMemberIdentity(entry) }));
+  const loaded = new Map(loadPoolMembers(input.fs, input.paths, direct.filter((entry) => input.identityExists(poolMemberIdentity(entry))).map(poolMemberIdentity), input.nowMs).map((member) => [member.identity, member]));
   const members = [];
   for (const entry of pool.identities) {
-    const nestedName = poolNameOf(entry);
+    const nestedName = poolNameOf(poolMemberIdentity(entry));
     if (nestedName === void 0) {
-      const member = loaded.get(entry);
+      const member = loaded.get(poolMemberIdentity(entry));
       if (member !== void 0) {
-        members.push(member);
+        members.push(typeof entry === "string" ? member : { ...member, policy: entry.when });
       }
       continue;
     }
     if (input.pools[nestedName] === void 0) {
-      throw new PoolGraphError(`Pool "${poolName}" member "${entry}" names a pool that is not defined.`);
+      throw new PoolGraphError(`Pool "${poolName}" member "${poolMemberIdentity(entry)}" names a pool that is not defined.`);
     }
     if (childStack.includes(nestedName)) {
-      throw new PoolGraphError(`Pool "${poolName}" member "${entry}" closes a cycle: ${[...childStack.slice(childStack.indexOf(nestedName)), nestedName].join(" -> ")}. A pool cannot nest itself, directly or through another pool.`);
+      throw new PoolGraphError(`Pool "${poolName}" member "${poolMemberIdentity(entry)}" closes a cycle: ${[...childStack.slice(childStack.indexOf(nestedName)), nestedName].join(" -> ")}. A pool cannot nest itself, directly or through another pool.`);
     }
     const nested = nestedMember(input, nestedName, childStack, sticky);
-    members.push(nested.member);
+    members.push(typeof entry === "string" ? nested.member : { ...nested.member, policy: entry.when });
     missing.push(...nested.missing);
   }
   const ranking = rankPool({
@@ -6853,7 +6898,7 @@ function writePools(paths, pools) {
 function poolCycleOf(pools, name) {
   const walk = (current, path32) => {
     for (const entry of pools[current]?.identities ?? []) {
-      const nested = poolNameOf(entry);
+      const nested = poolNameOf(poolMemberIdentity(entry));
       if (nested === void 0) {
         continue;
       }
@@ -6874,9 +6919,10 @@ function poolCycleOf(pools, name) {
 }
 function validateMembers(pools, name, members) {
   for (const entry of members) {
-    const nested = poolNameOf(entry);
+    const identity = poolMemberIdentity(entry);
+    const nested = poolNameOf(identity);
     if (nested !== void 0 && nested !== name && pools[nested] === void 0) {
-      throw new UsageError(`Member "${entry}" of pool "${name}" names a pool that is not defined. Run \`agent-shim pool add ${nested} --identity <name>...\` first.`);
+      throw new UsageError(`Member "${identity}" of pool "${name}" names a pool that is not defined. Run \`agent-shim pool add ${nested} --identity <name>...\` first.`);
     }
   }
   const cycle = poolCycleOf({ ...pools, [name]: { identities: [...members] } }, name);
@@ -9581,16 +9627,16 @@ function runDoctor(params) {
   const validatedGlobalConfig = params.globalConfig.raw === void 0 ? void 0 : validateJson(GlobalConfigSchema, params.globalConfig);
   const pools = validatedGlobalConfig?.ok === true ? validatedGlobalConfig.data.pools ?? {} : {};
   for (const [poolName, pool] of Object.entries(pools)) {
-    const missing = pool.identities.filter((member) => poolNameOf(member) === void 0 && !validIdentityNames.has(member));
+    const missing = pool.identities.filter((member) => poolNameOf(poolMemberIdentity(member)) === void 0 && !validIdentityNames.has(poolMemberIdentity(member)));
     const undefinedPools = pool.identities.flatMap((member) => {
-      const nested = poolNameOf(member);
+      const nested = poolNameOf(poolMemberIdentity(member));
       return nested === void 0 || nested in pools ? [] : [nested];
     });
     if (missing.length === 0 && undefinedPools.length === 0) {
-      push("pool", "pass", `${poolName} is valid (${pool.identities.join(", ")}).`, poolName);
+      push("pool", "pass", `${poolName} is valid (${pool.identities.map(poolMemberIdentity).join(", ")}).`, poolName);
     } else {
       const problems = [
-        ...missing.map((member) => `identity "${member}", which does not exist`),
+        ...missing.map((member) => `identity "${poolMemberIdentity(member)}", which does not exist`),
         ...undefinedPools.map((nested) => `pool "${nested}", which is not defined`)
       ];
       push("pool", "fail", `Pool "${poolName}" names ${problems.join(" and ")}.`, poolName);

package/dist/types/index.d.ts

@@ -630,7 +630,81 @@ type PoolPreference = z.infer<typeof PoolPreferenceSchema>;
  * `preference` decides how the member is chosen, and an absent field means "score". "score" ranks members by plan-size-weighted remaining quota per hour until reset, so the quota closest to expiring is spent first (use-it-or-lose-it). "listed" ranks members strictly in the order the pool lists them, skipping only a member that is currently refused, so a pool can pin one identity first and fall back to the others only while that one is refused.
  */
 declare const PoolSchema: z.ZodObject<{
-    identities: z.ZodArray<z.ZodString>;
+    identities: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        identity: z.ZodString;
+        when: z.ZodUnion<readonly [z.ZodObject<{
+            newerThan: z.ZodOptional<z.ZodString>;
+            olderThan: z.ZodOptional<z.ZodString>;
+            maxSizeBytes: z.ZodOptional<z.ZodInt>;
+            branch: z.ZodOptional<z.ZodString>;
+            env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, z.core.$strict>, z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"not">;
+            operand: typeof PredicateNodeSchema;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"and">;
+            left: typeof PredicateNodeSchema;
+            right: typeof PredicateNodeSchema;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"or">;
+            left: typeof PredicateNodeSchema;
+            right: typeof PredicateNodeSchema;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"allOf">;
+            operands: z.ZodArray<typeof PredicateNodeSchema>;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"anyOf">;
+            operands: z.ZodArray<typeof PredicateNodeSchema>;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"compare">;
+            op: z.ZodEnum<{
+                gt: "gt";
+                gte: "gte";
+                lt: "lt";
+                lte: "lte";
+                eq: "eq";
+                neq: "neq";
+            }>;
+            left: typeof trilean.ExpressionNodeSchema;
+            right: typeof trilean.ExpressionNodeSchema;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"textCompare">;
+            op: z.ZodEnum<{
+                equals: "equals";
+                notEquals: "notEquals";
+                matches: "matches";
+                notMatches: "notMatches";
+                portableMatches: "portableMatches";
+                portableNotMatches: "portableNotMatches";
+            }>;
+            left: typeof trilean.ExpressionNodeSchema;
+            right: typeof trilean.ExpressionNodeSchema;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"memberOf">;
+            op: z.ZodEnum<{
+                in: "in";
+                notIn: "notIn";
+            }>;
+            operand: typeof trilean.ExpressionNodeSchema;
+            candidates: z.ZodArray<typeof trilean.ExpressionNodeSchema>;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"exists">;
+            operand: typeof trilean.ExpressionNodeSchema;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"some">;
+            collection: z.ZodType<trilean.JsonValue, unknown, z.core.$ZodTypeInternals<trilean.JsonValue, unknown>>;
+            item: typeof PredicateNodeSchema;
+            filter: z.ZodOptional<typeof PredicateNodeSchema>;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"every">;
+            collection: z.ZodType<trilean.JsonValue, unknown, z.core.$ZodTypeInternals<trilean.JsonValue, unknown>>;
+            item: typeof PredicateNodeSchema;
+            filter: z.ZodOptional<typeof PredicateNodeSchema>;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"treeReference">;
+            key: z.ZodType<trilean.JsonValue, unknown, z.core.$ZodTypeInternals<trilean.JsonValue, unknown>>;
+        }, z.core.$strip>], "kind">]>;
+    }, z.core.$strict>]>>;
     preference: z.ZodOptional<z.ZodEnum<{
         score: "score";
         listed: "listed";
@@ -1332,7 +1406,81 @@ declare const GlobalConfigSchema: z.ZodObject<{
         }>>;
     }, z.core.$strict>>;
     pools: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-        identities: z.ZodArray<z.ZodString>;
+        identities: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+            identity: z.ZodString;
+            when: z.ZodUnion<readonly [z.ZodObject<{
+                newerThan: z.ZodOptional<z.ZodString>;
+                olderThan: z.ZodOptional<z.ZodString>;
+                maxSizeBytes: z.ZodOptional<z.ZodInt>;
+                branch: z.ZodOptional<z.ZodString>;
+                env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            }, z.core.$strict>, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"not">;
+                operand: typeof PredicateNodeSchema;
+            }, z.core.$strip>, z.ZodObject<{
+                kind: z.ZodLiteral<"and">;
+                left: typeof PredicateNodeSchema;
+                right: typeof PredicateNodeSchema;
+            }, z.core.$strip>, z.ZodObject<{
+                kind: z.ZodLiteral<"or">;
+                left: typeof PredicateNodeSchema;
+                right: typeof PredicateNodeSchema;
+            }, z.core.$strip>, z.ZodObject<{
+                kind: z.ZodLiteral<"allOf">;
+                operands: z.ZodArray<typeof PredicateNodeSchema>;
+            }, z.core.$strip>, z.ZodObject<{
+                kind: z.ZodLiteral<"anyOf">;
+                operands: z.ZodArray<typeof PredicateNodeSchema>;
+            }, z.core.$strip>, z.ZodObject<{
+                kind: z.ZodLiteral<"compare">;
+                op: z.ZodEnum<{
+                    gt: "gt";
+                    gte: "gte";
+                    lt: "lt";
+                    lte: "lte";
+                    eq: "eq";
+                    neq: "neq";
+                }>;
+                left: typeof trilean.ExpressionNodeSchema;
+                right: typeof trilean.ExpressionNodeSchema;
+            }, z.core.$strip>, z.ZodObject<{
+                kind: z.ZodLiteral<"textCompare">;
+                op: z.ZodEnum<{
+                    equals: "equals";
+                    notEquals: "notEquals";
+                    matches: "matches";
+                    notMatches: "notMatches";
+                    portableMatches: "portableMatches";
+                    portableNotMatches: "portableNotMatches";
+                }>;
+                left: typeof trilean.ExpressionNodeSchema;
+                right: typeof trilean.ExpressionNodeSchema;
+            }, z.core.$strip>, z.ZodObject<{
+                kind: z.ZodLiteral<"memberOf">;
+                op: z.ZodEnum<{
+                    in: "in";
+                    notIn: "notIn";
+                }>;
+                operand: typeof trilean.ExpressionNodeSchema;
+                candidates: z.ZodArray<typeof trilean.ExpressionNodeSchema>;
+            }, z.core.$strip>, z.ZodObject<{
+                kind: z.ZodLiteral<"exists">;
+                operand: typeof trilean.ExpressionNodeSchema;
+            }, z.core.$strip>, z.ZodObject<{
+                kind: z.ZodLiteral<"some">;
+                collection: z.ZodType<trilean.JsonValue, unknown, z.core.$ZodTypeInternals<trilean.JsonValue, unknown>>;
+                item: typeof PredicateNodeSchema;
+                filter: z.ZodOptional<typeof PredicateNodeSchema>;
+            }, z.core.$strip>, z.ZodObject<{
+                kind: z.ZodLiteral<"every">;
+                collection: z.ZodType<trilean.JsonValue, unknown, z.core.$ZodTypeInternals<trilean.JsonValue, unknown>>;
+                item: typeof PredicateNodeSchema;
+                filter: z.ZodOptional<typeof PredicateNodeSchema>;
+            }, z.core.$strip>, z.ZodObject<{
+                kind: z.ZodLiteral<"treeReference">;
+                key: z.ZodType<trilean.JsonValue, unknown, z.core.$ZodTypeInternals<trilean.JsonValue, unknown>>;
+            }, z.core.$strip>], "kind">]>;
+        }, z.core.$strict>]>>;
         preference: z.ZodOptional<z.ZodEnum<{
             score: "score";
             listed: "listed";
@@ -5230,12 +5378,12 @@ declare function createControlApiRouter(deps: ControlApiDeps): {
                     identity: "identity";
                     provider: "provider";
                     pool: "pool";
-                    keychain: "keychain";
                     "ambient-credential": "ambient-credential";
                     "binary-discovery": "binary-discovery";
                     "claude-shim": "claude-shim";
                     "path-resolution": "path-resolution";
                     "legacy-name": "legacy-name";
+                    keychain: "keychain";
                     "directory-rules": "directory-rules";
                     "categories-local": "categories-local";
                     "active-identity": "active-identity";
@@ -5811,12 +5959,12 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                     identity: "identity";
                     provider: "provider";
                     pool: "pool";
-                    keychain: "keychain";
                     "ambient-credential": "ambient-credential";
                     "binary-discovery": "binary-discovery";
                     "claude-shim": "claude-shim";
                     "path-resolution": "path-resolution";
                     "legacy-name": "legacy-name";
+                    keychain: "keychain";
                     "directory-rules": "directory-rules";
                     "categories-local": "categories-local";
                     "active-identity": "active-identity";
@@ -6301,12 +6449,12 @@ declare const DoctorFindingSchema: z.ZodObject<{
         identity: "identity";
         provider: "provider";
         pool: "pool";
-        keychain: "keychain";
         "ambient-credential": "ambient-credential";
         "binary-discovery": "binary-discovery";
         "claude-shim": "claude-shim";
         "path-resolution": "path-resolution";
         "legacy-name": "legacy-name";
+        keychain: "keychain";
         "directory-rules": "directory-rules";
         "categories-local": "categories-local";
         "active-identity": "active-identity";
@@ -6330,12 +6478,12 @@ declare const DoctorRunOutputSchema: z.ZodObject<{
             identity: "identity";
             provider: "provider";
             pool: "pool";
-            keychain: "keychain";
             "ambient-credential": "ambient-credential";
             "binary-discovery": "binary-discovery";
             "claude-shim": "claude-shim";
             "path-resolution": "path-resolution";
             "legacy-name": "legacy-name";
+            keychain: "keychain";
             "directory-rules": "directory-rules";
             "categories-local": "categories-local";
             "active-identity": "active-identity";
@@ -6784,6 +6932,8 @@ interface PoolMember {
     readonly records: readonly UsageRecord[];
     /** Present when this member stands for a nested `pool:<name>` entry rather than a direct identity. */
     readonly nested?: NestedContribution;
+    /** The member entry's policy condition, from the object form of a pool member: definite false skips the member as ineligible by policy, indeterminate demotes it to last within its class, naming the missing fact either way. */
+    readonly policy?: WhenCondition;
 }
 /** The member last picked for this directory, kept so a conversation stays on the account whose prompt cache is warm. */
 interface StickyPick {
@@ -6811,6 +6961,8 @@ interface Candidate {
     /** When an `ineligible` candidate can be used again. */
     readonly blockedUntilMs?: number;
     readonly plan: PlanClass;
+    /** True when the member's policy condition could not be decided and it is ranked last within its class, naming the missing fact in its reasons. */
+    readonly policyDemoted?: boolean;
     /** Human-readable facts behind the class and score, in the order they matter. */
     readonly reasons: readonly string[];
 }
@@ -6852,6 +7004,15 @@ declare function collectPoolPick(params: Readonly<{
     nowMs: number;
 }>): PoolPickReport;
 
+/** One quota window's pool-selection facts, in the units a policy reads: fractions of the window, and hours until it resets. */
+interface PoolWindowFacts {
+    /** The fraction of the window still unused, between zero and one. */
+    readonly remaining: number;
+    /** The fraction of the window already used, between zero and one. */
+    readonly utilization: number;
+    /** How long until the window resets, in hours. */
+    readonly hoursUntilReset: number;
+}
 /** Everything a `when` condition can be evaluated against, injected rather than read. */
 interface ConditionContext {
     readonly nowMs: number;
@@ -6862,6 +7023,16 @@ interface ConditionContext {
     /** True when the repository is in detached-HEAD state, in which case no `branch` condition can match. */
     readonly branchDetached?: boolean;
     readonly env: Readonly<Record<string, string | undefined>>;
+    /**
+     * The pool-selection facts a member entry's policy condition reads. Present only when the condition guards a pool member, so the same reference namespace serves the cascade and the pool: `quota.fiveHour.remaining`, `quota.fiveHour.utilization`, `quota.fiveHour.hoursUntilReset`, the same three under `quota.sevenDay`, `quota.burnPerHour` (the five-hour window's observed utilisation pace, in fractions per hour), `session.resuming` (this launch resumes or continues a conversation) and `session.lastPickHoursAgo` (how long ago this directory last picked this member). Conversation context is deliberately not provided: nothing the door holds knows it, so a condition referencing it is indeterminate, naming the missing fact, rather than guessed.
+     */
+    readonly pool?: {
+        readonly fiveHour?: PoolWindowFacts;
+        readonly sevenDay?: PoolWindowFacts;
+        readonly burnPerHour?: number;
+        readonly resuming?: boolean;
+        readonly lastPickHoursAgo?: number;
+    };
 }
 /**
  * The result of evaluating one `when`: definite, with which condition fields were present and which of those did not hold, or indeterminate, when a datum the condition needed is missing. Indeterminate is not false: a missing fact has not failed the condition, it has left it undecided, and the consumer decides what an undecided entry does (the resolver keeps today's behaviour of not passing it, so nothing changes for existing configurations; the pool ranking of #258 instead keeps such a member but ranks it last, naming the missing fact).
@@ -7215,6 +7386,9 @@ declare function updateProvider(paths: LayoutPaths, name: string, input: UpdateP
 /** Deletes a provider definition. Throws `ProviderNotFoundError` when it does not exist. */
 declare function removeProvider(paths: LayoutPaths, name: string): void;
 
+/** One pool member entry, whichever form it takes: the plain selector string, or the object form carrying its policy condition. */
+type PoolMemberEntry = Pool["identities"][number];
+
 /** Raised when a command names a pool that is not defined in the global config. */
 declare class PoolNotFoundError extends CliError {
     readonly poolName: string;
@@ -7225,9 +7399,9 @@ declare function readPools(paths: LayoutPaths): Readonly<Record<string, Pool>>;
 /** The pool named `name`; throws `PoolNotFoundError` when none is defined. */
 declare function requirePool(paths: LayoutPaths, name: string): Pool;
 /** Defines a new pool. Throws `InvalidPoolNameError` for a name `PoolNameSchema` rejects, `PoolAlreadyExistsError` for one already defined, and `UsageError` for a nested member that names an undefined pool or a cycle. */
-declare function addPool(paths: LayoutPaths, name: string, identities: readonly string[], preference?: PoolPreference): Pool;
+declare function addPool(paths: LayoutPaths, name: string, identities: readonly PoolMemberEntry[], preference?: PoolPreference): Pool;
 /** Replaces an existing pool's members and preference. Throws `PoolNotFoundError` when it is not defined, and `UsageError` for a nested member that names an undefined pool or a cycle. */
-declare function setPool(paths: LayoutPaths, name: string, identities: readonly string[], preference?: PoolPreference): Pool;
+declare function setPool(paths: LayoutPaths, name: string, identities: readonly PoolMemberEntry[], preference?: PoolPreference): Pool;
 /** Removes a pool. Throws `PoolNotFoundError` when it is not defined. Anything that selected it (an active-identity file, a directory rule) is left for `doctor` to report, as with a removed identity. */
 declare function removePool(paths: LayoutPaths, name: string): void;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-shim",
-  "version": "8.33.0",
+  "version": "8.34.0",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",