agent-shim 8.6.0 → 8.7.0

package/dist/index.mjs

@@ -5834,6 +5834,56 @@ import path16 from "node:path";
 
 // src/credentialCache.ts
 import { z as z7 } from "zod";
+
+// src/usage/preflight.ts
+var MS_PER_SECOND2 = 1e3;
+var SECONDS_PER_MINUTE = 60;
+var MINUTES_PER_HOUR = 60;
+var HOURS_PER_DAY = 24;
+var WARNING_STATUSES = /* @__PURE__ */ new Set(["allowed_warning", "rejected"]);
+function formatAge(ms) {
+  const minutes = Math.floor(ms / (MS_PER_SECOND2 * SECONDS_PER_MINUTE));
+  if (minutes < MINUTES_PER_HOUR) {
+    return `${String(Math.max(minutes, 0))}m`;
+  }
+  const hours = Math.floor(minutes / MINUTES_PER_HOUR);
+  return hours < HOURS_PER_DAY ? `${String(hours)}h` : `${String(Math.floor(hours / HOURS_PER_DAY))}d`;
+}
+function effectiveWindow(window, nowMs) {
+  const resetsAtMs = window.resetsAt === void 0 ? void 0 : Date.parse(window.resetsAt);
+  if (resetsAtMs !== void 0 && resetsAtMs <= nowMs) {
+    return { reset: true, utilization: 0 };
+  }
+  return {
+    reset: false,
+    ...window.utilization === void 0 ? {} : { utilization: window.utilization },
+    ...resetsAtMs === void 0 ? {} : { resetsAtMs },
+    ...window.status === void 0 ? {} : { status: window.status }
+  };
+}
+function quotaWarnings(snapshot, provider, nowMs) {
+  const rateLimit = snapshot?.providers[provider]?.rateLimit;
+  const unified = rateLimit?.unified;
+  if (snapshot === void 0 || rateLimit === void 0 || unified === void 0) {
+    return [];
+  }
+  const age = formatAge(nowMs - Date.parse(rateLimit.observedAt));
+  const windows = [
+    { name: "five-hour", window: unified.fiveHour },
+    { name: "seven-day", window: unified.sevenDay }
+  ];
+  return windows.flatMap(({ name, window }) => {
+    const effective = window === void 0 ? void 0 : effectiveWindow(window, nowMs);
+    if (window === void 0 || effective?.status === void 0 || !WARNING_STATUSES.has(effective.status)) {
+      return [];
+    }
+    const reset = window.resetsAt === void 0 ? "" : `, resets ${window.resetsAt}`;
+    const verdict = effective.status === "rejected" ? "exhausted" : "nearly used";
+    return [`agent-shim: identity ${snapshot.identity}: the ${name} quota is ${verdict}${reset} (last seen ${age} ago)`];
+  });
+}
+
+// src/credentialCache.ts
 var MS_PER_UNIT = { s: 1e3, m: 6e4, h: 36e5, d: 864e5 };
 var CachedCredentialSchema = z7.strictObject({
   token: z7.string().min(1),
@@ -5860,6 +5910,45 @@ function isFresh(entry, cache, now) {
   }
   return limit === void 0 || now - entry.fetchedAt < limit;
 }
+function cacheAgeMs(entry, now) {
+  return Math.max(0, now - entry.fetchedAt);
+}
+function describeCachedCredential(params) {
+  const store = effectiveStore(params.cache, params.platform);
+  let entry;
+  try {
+    entry = params.port.read(store, params.owner);
+  } catch (error) {
+    return { store, status: "unreadable", reason: error instanceof Error ? error.message : String(error) };
+  }
+  if (entry === void 0) {
+    return { store, status: "empty" };
+  }
+  const limit = ttlMs(params.cache);
+  const ageMs = cacheAgeMs(entry, params.nowMs);
+  return {
+    store,
+    status: isFresh(entry, params.cache, params.nowMs) ? "fresh" : "expired",
+    ageMs,
+    ...limit === void 0 ? {} : { expiresInMs: limit - ageMs }
+  };
+}
+function formatCachedCredentialState(state) {
+  if (state.status === "empty") {
+    return `no cached entry in the ${state.store} store yet`;
+  }
+  if (state.status === "unreadable") {
+    return `the ${state.store} store cannot be read here: ${state.reason}`;
+  }
+  if (state.status === "expired" && (state.expiresInMs === void 0 || state.expiresInMs > 0)) {
+    return "cached with a timestamp in the future, treated as expired";
+  }
+  const age = `cached ${formatAge(state.ageMs)} ago`;
+  if (state.expiresInMs === void 0) {
+    return `${age}, no expiry`;
+  }
+  return state.status === "fresh" ? `${age}, expires in ${formatAge(state.expiresInMs)}` : `${age}, expired ${formatAge(-state.expiresInMs)} ago`;
+}
 
 // src/credential.ts
 var CREDENTIAL_UNAVAILABLE_EXIT = 64;
@@ -6475,54 +6564,6 @@ function readDirectorySelections(loaded) {
   return { ...identity === void 0 ? {} : { identity }, ...configProfile === void 0 ? {} : { configProfile } };
 }
 
-// src/usage/preflight.ts
-var MS_PER_SECOND2 = 1e3;
-var SECONDS_PER_MINUTE = 60;
-var MINUTES_PER_HOUR = 60;
-var HOURS_PER_DAY = 24;
-var WARNING_STATUSES = /* @__PURE__ */ new Set(["allowed_warning", "rejected"]);
-function formatAge(ms) {
-  const minutes = Math.floor(ms / (MS_PER_SECOND2 * SECONDS_PER_MINUTE));
-  if (minutes < MINUTES_PER_HOUR) {
-    return `${String(Math.max(minutes, 0))}m`;
-  }
-  const hours = Math.floor(minutes / MINUTES_PER_HOUR);
-  return hours < HOURS_PER_DAY ? `${String(hours)}h` : `${String(Math.floor(hours / HOURS_PER_DAY))}d`;
-}
-function effectiveWindow(window, nowMs) {
-  const resetsAtMs = window.resetsAt === void 0 ? void 0 : Date.parse(window.resetsAt);
-  if (resetsAtMs !== void 0 && resetsAtMs <= nowMs) {
-    return { reset: true, utilization: 0 };
-  }
-  return {
-    reset: false,
-    ...window.utilization === void 0 ? {} : { utilization: window.utilization },
-    ...resetsAtMs === void 0 ? {} : { resetsAtMs },
-    ...window.status === void 0 ? {} : { status: window.status }
-  };
-}
-function quotaWarnings(snapshot, provider, nowMs) {
-  const rateLimit = snapshot?.providers[provider]?.rateLimit;
-  const unified = rateLimit?.unified;
-  if (snapshot === void 0 || rateLimit === void 0 || unified === void 0) {
-    return [];
-  }
-  const age = formatAge(nowMs - Date.parse(rateLimit.observedAt));
-  const windows = [
-    { name: "five-hour", window: unified.fiveHour },
-    { name: "seven-day", window: unified.sevenDay }
-  ];
-  return windows.flatMap(({ name, window }) => {
-    const effective = window === void 0 ? void 0 : effectiveWindow(window, nowMs);
-    if (window === void 0 || effective?.status === void 0 || !WARNING_STATUSES.has(effective.status)) {
-      return [];
-    }
-    const reset = window.resetsAt === void 0 ? "" : `, resets ${window.resetsAt}`;
-    const verdict = effective.status === "rejected" ? "exhausted" : "nearly used";
-    return [`agent-shim: identity ${snapshot.identity}: the ${name} quota is ${verdict}${reset} (last seen ${age} ago)`];
-  });
-}
-
 // src/usage/poolPick.ts
 import path19 from "node:path";
 import { z as z9 } from "zod";
@@ -6918,19 +6959,97 @@ function collectPoolPick(params) {
   };
 }
 
+// src/realCredentialCache.ts
+import { spawnSync } from "node:child_process";
+import fs7 from "node:fs";
+import path20 from "node:path";
+var KEYCHAIN_CACHE_SERVICE = "agent-shim-credential-cache";
+var CACHE_DIR_MODE = 448;
+var CACHE_FILE_MODE = 384;
+function cacheFileNameFor(owner) {
+  return `${owner.replace(/[^A-Za-z0-9._-]/g, "_")}.json`;
+}
+function parseEntry(raw) {
+  let json;
+  try {
+    json = JSON.parse(raw);
+  } catch {
+    return void 0;
+  }
+  const parsed = CachedCredentialSchema.safeParse(json);
+  return parsed.success ? parsed.data : void 0;
+}
+function requireKeychain() {
+  if (process.platform !== "darwin") {
+    throw new Error("the keychain credential store needs macOS; use --credential-cache-store file");
+  }
+}
+function security(args, stdin) {
+  const result = spawnSync("security", args, { encoding: "utf8", ...stdin === void 0 ? {} : { input: stdin }, stdio: ["pipe", "pipe", "ignore"] });
+  return { status: result.status, stdout: result.stdout };
+}
+function createRealCredentialCache(root) {
+  const dir = path20.join(root, "credential-cache");
+  const filePath = (owner) => path20.join(dir, cacheFileNameFor(owner));
+  return {
+    read(store, owner) {
+      if (store === "file") {
+        try {
+          return parseEntry(fs7.readFileSync(filePath(owner), "utf8"));
+        } catch {
+          return void 0;
+        }
+      }
+      requireKeychain();
+      const result = security(["find-generic-password", "-s", KEYCHAIN_CACHE_SERVICE, "-a", owner, "-w"]);
+      return result.status === 0 ? parseEntry(Buffer.from(result.stdout.trim(), "base64").toString("utf8")) : void 0;
+    },
+    write(store, owner, entry) {
+      const serialised = JSON.stringify(entry);
+      if (store === "file") {
+        fs7.mkdirSync(dir, { recursive: true, mode: CACHE_DIR_MODE });
+        fs7.chmodSync(dir, CACHE_DIR_MODE);
+        const target = filePath(owner);
+        const temp = `${target}.${String(process.pid)}.tmp`;
+        fs7.writeFileSync(temp, serialised, { mode: CACHE_FILE_MODE });
+        fs7.renameSync(temp, target);
+        return;
+      }
+      requireKeychain();
+      const encoded = Buffer.from(serialised, "utf8").toString("base64");
+      const result = security(["-i"], `add-generic-password -U -s ${KEYCHAIN_CACHE_SERVICE} -a ${JSON.stringify(owner)} -w ${encoded}
+`);
+      if (result.status !== 0) {
+        throw new Error(`could not write the keychain credential cache for ${owner}`);
+      }
+    },
+    remove(store, owner) {
+      if (store === "file") {
+        fs7.rmSync(filePath(owner), { force: true });
+        return;
+      }
+      requireKeychain();
+      security(["delete-generic-password", "-s", KEYCHAIN_CACHE_SERVICE, "-a", owner]);
+    }
+  };
+}
+function realCredentialCacheEnv(paths) {
+  return { port: createRealCredentialCache(paths.root), platform: process.platform, now: () => Date.now() };
+}
+
 // src/realPorts.ts
-import { spawn, spawnSync } from "node:child_process";
+import { spawn, spawnSync as spawnSync2 } from "node:child_process";
 import { createHash as createHash5 } from "node:crypto";
-import fs7 from "node:fs";
+import fs8 from "node:fs";
 import os3 from "node:os";
-import path21 from "node:path";
+import path22 from "node:path";
 import { isSea } from "node:sea";
 
 // src/versionDiscovery.ts
 import os2 from "node:os";
-import path20 from "node:path";
+import path21 from "node:path";
 function defaultVersionsDir() {
-  return path20.join(os2.homedir(), ".local", "share", "claude", "versions");
+  return path21.join(os2.homedir(), ".local", "share", "claude", "versions");
 }
 var NUMERIC_DOTTED_VERSION_RE = /^\d+(?:\.\d+)*$/;
 function isNumericDottedVersion(name) {
@@ -6972,7 +7091,7 @@ function discoverClaudeBinary(options) {
   const highestVersion = pickHighestVersion(entries);
   if (highestVersion !== void 0) {
     return {
-      path: path20.join(versionsDir, highestVersion),
+      path: path21.join(versionsDir, highestVersion),
       source: "versions-dir",
       version: highestVersion
     };
@@ -6995,7 +7114,7 @@ function isEnoent3(error) {
 var realFsPort = {
   readFileUtf8(filePath) {
     try {
-      return fs7.readFileSync(filePath, "utf8");
+      return fs8.readFileSync(filePath, "utf8");
     } catch (error) {
       if (isEnoent3(error)) {
         return void 0;
@@ -7006,7 +7125,7 @@ var realFsPort = {
   readConfigFile: cosmiconfigReader(),
   readdir(dirPath) {
     try {
-      return fs7.readdirSync(dirPath);
+      return fs8.readdirSync(dirPath);
     } catch (error) {
       if (isEnoent3(error)) {
         return [];
@@ -7025,7 +7144,7 @@ var realFarmFs = {
   lstat(filePath) {
     let stat;
     try {
-      stat = fs7.lstatSync(filePath);
+      stat = fs8.lstatSync(filePath);
     } catch (error) {
       if (isEnoent3(error)) {
         return void 0;
@@ -7037,7 +7156,7 @@ var realFarmFs = {
   },
   readdir(dirPath) {
     try {
-      return fs7.readdirSync(dirPath);
+      return fs8.readdirSync(dirPath);
     } catch (error) {
       if (isEnoent3(error) || isErrorWithCode(error, "ENOTDIR")) {
         return [];
@@ -7046,23 +7165,23 @@ var realFarmFs = {
     }
   },
   mkdirp(dirPath) {
-    fs7.mkdirSync(dirPath, { recursive: true });
+    fs8.mkdirSync(dirPath, { recursive: true });
   },
   symlink(target, linkPath) {
-    fs7.symlinkSync(target, linkPath);
+    fs8.symlinkSync(target, linkPath);
   },
   rename(from, to) {
-    fs7.renameSync(from, to);
+    fs8.renameSync(from, to);
   },
   removeRecursive(targetPath) {
-    fs7.rmSync(targetPath, { recursive: true, force: true });
+    fs8.rmSync(targetPath, { recursive: true, force: true });
   },
   copyRecursive(from, to) {
-    fs7.cpSync(from, to, { recursive: true, force: true, verbatimSymlinks: true });
+    fs8.cpSync(from, to, { recursive: true, force: true, verbatimSymlinks: true });
   },
   readFileUtf8(filePath) {
     try {
-      return fs7.readFileSync(filePath, "utf8");
+      return fs8.readFileSync(filePath, "utf8");
     } catch (error) {
       if (isEnoent3(error)) {
         return void 0;
@@ -7071,36 +7190,36 @@ var realFarmFs = {
     }
   },
   writeFileUtf8(filePath, contents) {
-    fs7.writeFileSync(filePath, contents, "utf8");
+    fs8.writeFileSync(filePath, contents, "utf8");
   },
   mkdirPrivate(dirPath) {
-    fs7.mkdirSync(dirPath, { recursive: true, mode: OWNER_ONLY_DIR_MODE });
-    fs7.chmodSync(dirPath, OWNER_ONLY_DIR_MODE);
+    fs8.mkdirSync(dirPath, { recursive: true, mode: OWNER_ONLY_DIR_MODE });
+    fs8.chmodSync(dirPath, OWNER_ONLY_DIR_MODE);
   },
   writeFilePrivate(filePath, contents) {
     const temp = `${filePath}.${String(process.pid)}.tmp`;
-    fs7.writeFileSync(temp, contents, { encoding: "utf8", mode: OWNER_ONLY_FILE_MODE });
-    fs7.chmodSync(temp, OWNER_ONLY_FILE_MODE);
-    fs7.renameSync(temp, filePath);
+    fs8.writeFileSync(temp, contents, { encoding: "utf8", mode: OWNER_ONLY_FILE_MODE });
+    fs8.chmodSync(temp, OWNER_ONLY_FILE_MODE);
+    fs8.renameSync(temp, filePath);
   },
   appendFilePrivate(filePath, contents) {
-    const descriptor = fs7.openSync(filePath, "a", OWNER_ONLY_FILE_MODE);
+    const descriptor = fs8.openSync(filePath, "a", OWNER_ONLY_FILE_MODE);
     try {
-      if ((fs7.fstatSync(descriptor).mode & PERMISSION_BITS2) !== OWNER_ONLY_FILE_MODE) {
-        fs7.fchmodSync(descriptor, OWNER_ONLY_FILE_MODE);
+      if ((fs8.fstatSync(descriptor).mode & PERMISSION_BITS2) !== OWNER_ONLY_FILE_MODE) {
+        fs8.fchmodSync(descriptor, OWNER_ONLY_FILE_MODE);
       }
       const bytes = Buffer.from(contents, "utf8");
       let written = 0;
       while (written < bytes.length) {
-        written += fs7.writeSync(descriptor, bytes, written, bytes.length - written);
+        written += fs8.writeSync(descriptor, bytes, written, bytes.length - written);
       }
     } finally {
-      fs7.closeSync(descriptor);
+      fs8.closeSync(descriptor);
     }
   },
   writeFileExclusive(filePath, contents) {
     try {
-      fs7.writeFileSync(filePath, contents, { encoding: "utf8", flag: "wx" });
+      fs8.writeFileSync(filePath, contents, { encoding: "utf8", flag: "wx" });
       return true;
     } catch (error) {
       if (isErrorWithCode(error, "EEXIST")) {
@@ -7111,7 +7230,7 @@ var realFarmFs = {
   },
   hashFile(filePath) {
     try {
-      return createHash5("sha256").update(fs7.readFileSync(filePath)).digest("hex");
+      return createHash5("sha256").update(fs8.readFileSync(filePath)).digest("hex");
     } catch (error) {
       if (isEnoent3(error) || isErrorWithCode(error, "EISDIR")) {
         return void 0;
@@ -7133,7 +7252,7 @@ function realIsProcessAlive(pid) {
   }
 }
 function realIsProcessZombie(pid) {
-  const result = spawnSync("ps", ["-o", "stat=", "-p", String(pid)], { encoding: "utf8" });
+  const result = spawnSync2("ps", ["-o", "stat=", "-p", String(pid)], { encoding: "utf8" });
   return result.status === 0 && result.stdout.trim().startsWith("Z");
 }
 function realIsProcessRunning(pid) {
@@ -7141,17 +7260,17 @@ function realIsProcessRunning(pid) {
 }
 var realRunPort = {
   run(command, args) {
-    const result = spawnSync(command, [...args], { encoding: "utf8" });
+    const result = spawnSync2(command, [...args], { encoding: "utf8" });
     return { status: result.status, stdout: result.stdout, stderr: result.stderr };
   }
 };
 function expandHome2(filePath) {
-  return filePath.startsWith("~/") ? path21.join(os3.homedir(), filePath.slice(1)) : filePath;
+  return filePath.startsWith("~/") ? path22.join(os3.homedir(), filePath.slice(1)) : filePath;
 }
 var MACOS_GUI_SESSION_MANAGER = "Aqua";
 function hasDesktopSession() {
   if (process.platform === "darwin") {
-    const result = spawnSync("launchctl", ["managername"], { encoding: "utf8" });
+    const result = spawnSync2("launchctl", ["managername"], { encoding: "utf8" });
     return result.status === 0 && result.stdout.trim() === MACOS_GUI_SESSION_MANAGER;
   }
   if (process.platform === "win32") {
@@ -7165,8 +7284,8 @@ var realCredentialPort = {
     let content;
     let stat;
     try {
-      stat = fs7.statSync(resolved);
-      content = fs7.readFileSync(resolved, "utf8");
+      stat = fs8.statSync(resolved);
+      content = fs8.readFileSync(resolved, "utf8");
     } catch (error) {
       if (isEnoent3(error)) {
         return { found: false };
@@ -7177,7 +7296,7 @@ var realCredentialPort = {
   },
   runCommand(argv, options) {
     const [command, ...args] = argv;
-    const result = spawnSync(command, args, {
+    const result = spawnSync2(command, args, {
       encoding: "utf8",
       timeout: options.timeoutMs,
       stdio: options.interactive ? ["inherit", "pipe", "inherit"] : ["ignore", "pipe", "pipe"]
@@ -7219,8 +7338,8 @@ function spawnDaemonThrough(executable) {
   return (paths, subcommand, logPath) => spawnDetachedDaemon({ command: executable, args: [subcommand] }, paths, subcommand, logPath);
 }
 function spawnDetachedDaemon(invocation, paths, subcommand, logPath) {
-  fs7.mkdirSync(path21.dirname(logPath), { recursive: true });
-  const logFd = fs7.openSync(logPath, "a");
+  fs8.mkdirSync(path22.dirname(logPath), { recursive: true });
+  const logFd = fs8.openSync(logPath, "a");
   try {
     const child = spawn(invocation.command, invocation.args, detachedDaemonSpawnOptions(logFd, { ...process.env, AGENT_SHIM_HOME: paths.root }));
     child.unref();
@@ -7229,7 +7348,7 @@ function spawnDetachedDaemon(invocation, paths, subcommand, logPath) {
     }
     return child.pid;
   } finally {
-    fs7.closeSync(logFd);
+    fs8.closeSync(logFd);
   }
 }
 function spawnHeadroomSupervisor(paths, spawnDaemon) {
@@ -7247,7 +7366,7 @@ var realHeadroomSocketTrust = {
   lstat: (target) => {
     let stat;
     try {
-      stat = fs7.lstatSync(target);
+      stat = fs8.lstatSync(target);
     } catch (error) {
       if (isEnoent3(error)) {
         return void 0;
@@ -7293,7 +7412,7 @@ var EXECUTE_BITS_MASK = 73;
 function listVersionsDir(dir) {
   let entries;
   try {
-    entries = fs7.readdirSync(dir, { withFileTypes: true });
+    entries = fs8.readdirSync(dir, { withFileTypes: true });
   } catch (error) {
     if (isEnoent3(error)) {
       return [];
@@ -7301,8 +7420,8 @@ function listVersionsDir(dir) {
     throw error;
   }
   return entries.filter((entry) => entry.isFile()).map((entry) => {
-    const fullPath = path21.join(dir, entry.name);
-    const stat = fs7.statSync(fullPath);
+    const fullPath = path22.join(dir, entry.name);
+    const stat = fs8.statSync(fullPath);
     return {
       name: entry.name,
       isFile: true,
@@ -7316,7 +7435,7 @@ function windowsPathExtensions(pathext) {
   return (pathext ?? WINDOWS_DEFAULT_PATHEXT).split(";").map((ext) => ext.trim()).filter((ext) => ext.length > 0);
 }
 function resolveExecutableCandidate(dir, name, env) {
-  const candidate = path21.join(dir, name);
+  const candidate = path22.join(dir, name);
   if (env.platform === "win32") {
     const extensions = windowsPathExtensions(env.pathext);
     const alreadyHasRecognisedExtension = extensions.some((ext) => candidate.toLowerCase().endsWith(ext.toLowerCase()));
@@ -7336,7 +7455,7 @@ function resolveExecutableCandidate(dir, name, env) {
 }
 function realStatFileMode(candidate) {
   try {
-    const stat = fs7.statSync(candidate);
+    const stat = fs8.statSync(candidate);
     return stat.isFile() ? stat.mode : void 0;
   } catch (error) {
     if (isEnoent3(error)) {
@@ -7365,13 +7484,13 @@ function resolveOwnExecutablePath(env) {
   if (env.argv1 !== void 0 && !env.argv1.includes("/") && !env.argv1.includes("\\")) {
     return searchPathForExecutable(env.pathDirs, env.argv1, env.findExecutableInDir) ?? env.execPath;
   }
-  const candidate = env.argv1 === void 0 ? env.execPath : path21.resolve(env.cwd, env.argv1);
-  const candidateDir = path21.dirname(candidate);
-  const candidateDirOnPath = env.pathDirs.some((dir) => path21.resolve(dir) === candidateDir);
+  const candidate = env.argv1 === void 0 ? env.execPath : path22.resolve(env.cwd, env.argv1);
+  const candidateDir = path22.dirname(candidate);
+  const candidateDirOnPath = env.pathDirs.some((dir) => path22.resolve(dir) === candidateDir);
   if (candidateDirOnPath) {
     return candidate;
   }
-  const viaPath = searchPathForExecutable(env.pathDirs, path21.basename(candidate), env.findExecutableInDir);
+  const viaPath = searchPathForExecutable(env.pathDirs, path22.basename(candidate), env.findExecutableInDir);
   return viaPath ?? candidate;
 }
 function realOwnExecutablePath() {
@@ -7379,7 +7498,7 @@ function realOwnExecutablePath() {
     argv1: process.argv[1],
     execPath: process.execPath,
     cwd: process.cwd(),
-    pathDirs: (process.env.PATH ?? "").split(path21.delimiter).filter((dir) => dir !== ""),
+    pathDirs: (process.env.PATH ?? "").split(path22.delimiter).filter((dir) => dir !== ""),
     findExecutableInDir
   });
 }
@@ -7392,14 +7511,14 @@ function realContentSourcePath() {
 function realResolveClaudeBinary(isOwnBinary) {
   return () => discoverClaudeBinary({
     listVersionsDir,
-    pathDirs: (process.env.PATH ?? "").split(path21.delimiter).filter((dir) => dir !== ""),
+    pathDirs: (process.env.PATH ?? "").split(path22.delimiter).filter((dir) => dir !== ""),
     findExecutableInDir,
     isOwnBinary
   });
 }
 
 // src/checkReport.ts
-import path22 from "node:path";
+import path23 from "node:path";
 import { z as z10 } from "zod";
 
 // src/cli/bool.ts
@@ -7569,14 +7688,23 @@ function inspectSettingsExposure(params) {
   }
   return reports;
 }
-function buildCredentialReport(provider, identity) {
+function cachedState(cacheEnv, owner, block) {
+  if (cacheEnv === void 0 || block.cache === void 0) {
+    return void 0;
+  }
+  return describeCachedCredential({ port: cacheEnv.port, platform: cacheEnv.platform, owner, cache: block.cache, nowMs: cacheEnv.now() });
+}
+function buildCredentialReport(provider, identity, identityName, cacheEnv) {
   const identityCredential = identity?.credential === void 0 ? void 0 : summariseCredential(identity.credential);
+  const identityCached = identity?.credential === void 0 || identityName === void 0 ? void 0 : cachedState(cacheEnv, `identity ${identityName}`, identity.credential);
+  const providerCached = provider?.definition === void 0 ? void 0 : cachedState(cacheEnv, `provider ${provider.name}`, provider.definition.credential);
   return {
     applies: provider !== void 0 ? "provider" : identityCredential !== void 0 ? "identity" : "stored-login",
     ...provider === void 0 ? {} : {
-      provider: provider.problem === void 0 ? { name: provider.name, credential: summariseCredential(provider.definition.credential) } : { name: provider.name, problem: provider.problem }
+      provider: provider.problem === void 0 ? { name: provider.name, credential: summariseCredential(provider.definition.credential), ...providerCached === void 0 ? {} : { cached: providerCached } } : { name: provider.name, problem: provider.problem }
     },
-    ...identityCredential === void 0 ? {} : { identity: identityCredential }
+    ...identityCredential === void 0 ? {} : { identity: identityCredential },
+    ...identityCached === void 0 ? {} : { identityCached }
   };
 }
 function runCheck(params) {
@@ -7615,7 +7743,7 @@ function runCheck(params) {
     ambientCredential,
     ...keychain === void 0 ? {} : { keychain },
     settingsExposure,
-    credential: buildCredentialReport(params.provider, params.identity)
+    credential: buildCredentialReport(params.provider, params.identity, params.identityName, params.credentialCache)
   };
 }
 function formatCheckReport(report) {
@@ -7653,12 +7781,12 @@ function formatCheckReport(report) {
   const { credential } = report;
   if (credential.provider !== void 0) {
     lines.push(
-      `  Provider ${credential.provider.name}: ${credential.provider.credential === void 0 ? `unusable: ${credential.provider.problem ?? ""}` : formatCredentialSummary(credential.provider.credential)}`
+      `  Provider ${credential.provider.name}: ${credential.provider.credential === void 0 ? `unusable: ${credential.provider.problem ?? ""}` : formatCredentialSummary(credential.provider.credential)}${credential.provider.cached === void 0 ? "" : `; ${formatCachedCredentialState(credential.provider.cached)}`}`
     );
   }
   if (credential.identity !== void 0) {
     lines.push(
-      `  Identity ${report.identityName ?? "(none)"}: ${formatCredentialSummary(credential.identity)}${credential.applies === "provider" ? " (not used: the provider's credential applies)" : ""}`
+      `  Identity ${report.identityName ?? "(none)"}: ${formatCredentialSummary(credential.identity)}${credential.identityCached === void 0 ? "" : `; ${formatCachedCredentialState(credential.identityCached)}`}${credential.applies === "provider" ? " (not used: the provider's credential applies)" : ""}`
     );
   }
   if (credential.applies === "stored-login") {
@@ -7767,10 +7895,10 @@ function collectCheckReport(params) {
   }).input;
   const providerName = cascadeProviderName(cascade);
   const provider = providerName === void 0 ? void 0 : loadCheckProvider(paths, providerName);
-  const farmRoot = identityDecision.name === void 0 ? void 0 : path22.join(paths.identitiesDir, identityDecision.name);
+  const farmRoot = identityDecision.name === void 0 ? void 0 : path23.join(paths.identitiesDir, identityDecision.name);
   const settingsFiles = {
-    "settings.json": realFsPort.readFileUtf8(path22.join(claudeHome, "settings.json")),
-    "settings.local.json": realFsPort.readFileUtf8(path22.join(claudeHome, "settings.local.json"))
+    "settings.json": realFsPort.readFileUtf8(path23.join(claudeHome, "settings.json")),
+    "settings.local.json": realFsPort.readFileUtf8(path23.join(claudeHome, "settings.local.json"))
   };
   const report = runCheck({
     cwd,
@@ -7791,6 +7919,7 @@ function collectCheckReport(params) {
     ...loadedIdentity === void 0 ? {} : { identity: loadedIdentity.config },
     settingsFiles,
     run: realRunPort,
+    credentialCache: realCredentialCacheEnv(paths),
     ...farmRoot === void 0 ? {} : { farmRoot },
     platform: process.platform,
     ...provider === void 0 ? {} : { provider }
@@ -7799,8 +7928,8 @@ function collectCheckReport(params) {
 }
 
 // src/claudeShim.ts
-import fs8 from "node:fs";
-import path23 from "node:path";
+import fs9 from "node:fs";
+import path24 from "node:path";
 import { z as z11 } from "zod";
 var ClaudeShimStateSchema = z11.strictObject({
   targetPath: z11.string().min(1),
@@ -7812,10 +7941,10 @@ function commandFilename(ownExecutablePath, commandName) {
 }
 function resolveOwnBinaryCheck(paths, contentSourcePath) {
   const state = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-  const recordedTarget = state === void 0 ? void 0 : path23.resolve(state.targetPath);
+  const recordedTarget = state === void 0 ? void 0 : path24.resolve(state.targetPath);
   let ownStat;
   return (candidate) => {
-    if (recordedTarget !== void 0 && path23.resolve(candidate) === recordedTarget) {
+    if (recordedTarget !== void 0 && path24.resolve(candidate) === recordedTarget) {
       return true;
     }
     ownStat ??= statOrUndefined(contentSourcePath);
@@ -7829,7 +7958,7 @@ function isEnoent4(error) {
 }
 function statOrUndefined(target) {
   try {
-    return fs8.statSync(target);
+    return fs9.statSync(target);
   } catch (error) {
     if (isEnoent4(error)) {
       return void 0;
@@ -7837,22 +7966,22 @@ function statOrUndefined(target) {
     throw error;
   }
 }
-var nodeLinkFs = { link: fs8.linkSync, copyFile: fs8.copyFileSync, chmod: fs8.chmodSync };
+var nodeLinkFs = { link: fs9.linkSync, copyFile: fs9.copyFileSync, chmod: fs9.chmodSync };
 function findPathShadow(params) {
-  const resolvedTargetDir = path23.resolve(params.targetDir);
+  const resolvedTargetDir = path24.resolve(params.targetDir);
   for (const dir of params.pathDirs) {
     const found = params.findExecutableInDir(dir, params.targetFilename);
     if (found === void 0) {
       continue;
     }
-    return path23.resolve(dir) === resolvedTargetDir ? { status: "ok" } : { status: "shadowed", by: found };
+    return path24.resolve(dir) === resolvedTargetDir ? { status: "ok" } : { status: "shadowed", by: found };
   }
-  return params.pathDirs.some((dir) => path23.resolve(dir) === resolvedTargetDir) ? { status: "ok" } : { status: "not-on-path" };
+  return params.pathDirs.some((dir) => path24.resolve(dir) === resolvedTargetDir) ? { status: "ok" } : { status: "not-on-path" };
 }
 
 // src/doctorReport.ts
-import fs9 from "node:fs";
-import path24 from "node:path";
+import fs10 from "node:fs";
+import path25 from "node:path";
 function refinePathShadow(status, ownExecutablePath, realpath) {
   if (status.status !== "shadowed") {
     return status;
@@ -7876,7 +8005,7 @@ function validateJson(schema, input) {
   return { ok: true, data: result.data };
 }
 function pushPathResolution(push, resolution) {
-  const ownDir = path24.dirname(resolution.ownExecutablePath);
+  const ownDir = path25.dirname(resolution.ownExecutablePath);
   switch (resolution.agentShim.status) {
     case "ok":
       push("path-resolution", "pass", `\`agent-shim\` on PATH resolves to this running executable, ${resolution.ownExecutablePath}.`, "agent-shim");
@@ -7918,7 +8047,14 @@ function pushPathResolution(push, resolution) {
       break;
   }
 }
-function pushProvider(push, entry) {
+function cacheClause(cacheEnv, owner, block) {
+  if (cacheEnv === void 0 || block.cache === void 0) {
+    return { text: "", unreadable: false };
+  }
+  const state = describeCachedCredential({ port: cacheEnv.port, platform: cacheEnv.platform, owner, cache: block.cache, nowMs: cacheEnv.now() });
+  return { text: `; ${formatCachedCredentialState(state)}`, unreadable: state.status === "unreadable" };
+}
+function pushProvider(push, entry, cacheEnv) {
   if (entry.raw === void 0) {
     push("provider", "fail", `${entry.path} is missing.`, entry.name);
     return;
@@ -7940,18 +8076,19 @@ function pushProvider(push, entry) {
     push("provider", "fail", new ConfigValidationError(entry.path, validated.error.issues).message, entry.name);
     return;
   }
-  push("provider", "pass", `${entry.name} is valid (${describeProviderEndpoint(validated.data)}, credential ${describeCredential(validated.data.credential)}).`, entry.name);
+  const cache = cacheClause(cacheEnv, `provider ${entry.name}`, validated.data.credential);
+  push("provider", cache.unreadable ? "fail" : "pass", `${entry.name} is valid (${describeProviderEndpoint(validated.data)}, credential ${describeCredential(validated.data.credential)})${cache.text}.`, entry.name);
 }
 function pushLegacyName(push, params) {
   const legacyVariables = Object.keys(params.env).filter((name) => name.startsWith(LEGACY_ENV_PREFIX) && params.env[name] !== void 0).sort();
-  if (legacyVariables.length === 0 && path24.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
+  if (legacyVariables.length === 0 && path25.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
     push("legacy-name", "pass", "Nothing here still uses the former `claude-use` name.");
     return;
   }
   for (const name of legacyVariables) {
     push("legacy-name", "warn", `${name} is the former name of ${name.replace(LEGACY_ENV_PREFIX, ENV_PREFIX)}. Rename it; the old name still works but is only a fallback.`, name);
   }
-  if (path24.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
+  if (path25.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
     push(
       "legacy-name",
       "warn",
@@ -8033,10 +8170,11 @@ function runDoctor(params) {
       );
     } else {
       const credential = validated.data.credential;
+      const cache = credential === void 0 ? { text: "", unreadable: false } : cacheClause(params.credentialCache, `identity ${entry.name}`, credential);
       push(
         "identity",
-        "pass",
-        `${entry.name} is valid and authenticates with ${credential === void 0 ? "its stored login" : `credential ${describeCredential(credential)}`}.`,
+        cache.unreadable ? "fail" : "pass",
+        `${entry.name} is valid and authenticates with ${credential === void 0 ? "its stored login" : `credential ${describeCredential(credential)}`}${cache.text}.`,
         entry.name
       );
     }
@@ -8056,7 +8194,7 @@ function runDoctor(params) {
     return poolName === void 0 ? validIdentityNames.has(selector) : poolName in pools;
   };
   for (const entry of params.providers) {
-    pushProvider(push, entry);
+    pushProvider(push, entry, params.credentialCache);
   }
   if (params.platform !== "darwin" || params.run === void 0) {
     push("keychain", "pass", "Skipped (not macOS).");
@@ -8250,27 +8388,27 @@ function formatDoctorReport(report) {
 }
 function realpathOrSelf(target) {
   try {
-    return fs9.realpathSync(target);
+    return fs10.realpathSync(target);
   } catch {
     return target;
   }
 }
 function collectDoctorReport(params) {
   const { paths } = params;
-  const identityNames = fs9.existsSync(paths.identitiesDir) ? fs9.readdirSync(paths.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && isIdentityDirectoryName(entry.name)).map((entry) => entry.name).sort() : [];
+  const identityNames = fs10.existsSync(paths.identitiesDir) ? fs10.readdirSync(paths.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && isIdentityDirectoryName(entry.name)).map((entry) => entry.name).sort() : [];
   const identities = identityNames.map((name) => {
-    const farmRoot = path24.join(paths.identitiesDir, name);
-    const identityPath = path24.join(farmRoot, "identity.json");
+    const farmRoot = path25.join(paths.identitiesDir, name);
+    const identityPath = path25.join(farmRoot, "identity.json");
     return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot };
   });
-  const profileNames = fs9.existsSync(paths.configProfilesDir) ? fs9.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
+  const profileNames = fs10.existsSync(paths.configProfilesDir) ? fs10.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const configProfiles = profileNames.map((name) => {
-    const profilePath = path24.join(paths.configProfilesDir, `${name}.json`);
+    const profilePath = path25.join(paths.configProfilesDir, `${name}.json`);
     return { name, path: profilePath, raw: realFsPort.readFileUtf8(profilePath) };
   });
-  const providerNames = fs9.existsSync(paths.providersDir) ? fs9.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
+  const providerNames = fs10.existsSync(paths.providersDir) ? fs10.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const providers = providerNames.map((name) => {
-    const providerPath = path24.join(paths.providersDir, `${name}.json`);
+    const providerPath = path25.join(paths.providersDir, `${name}.json`);
     return { name, path: providerPath, raw: realFsPort.readFileUtf8(providerPath) };
   });
   const ownExecutablePath = realOwnExecutablePath();
@@ -8282,12 +8420,12 @@ function collectDoctorReport(params) {
     binaryDiscovery = { ok: false, message: error instanceof Error ? error.message : String(error) };
   }
   const shimState = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-  const pathDirs = (params.env.PATH ?? "").split(path24.delimiter).filter((dir) => dir !== "");
+  const pathDirs = (params.env.PATH ?? "").split(path25.delimiter).filter((dir) => dir !== "");
   const claudeShimShadow = shimState === void 0 ? void 0 : refinePathShadow(
     findPathShadow({
       pathDirs,
-      targetDir: path24.dirname(shimState.targetPath),
-      targetFilename: path24.basename(shimState.targetPath),
+      targetDir: path25.dirname(shimState.targetPath),
+      targetFilename: path25.basename(shimState.targetPath),
       findExecutableInDir
     }),
     shimState.targetPath,
@@ -8295,6 +8433,7 @@ function collectDoctorReport(params) {
   );
   const report = runDoctor({
     env: params.env,
+    credentialCache: realCredentialCacheEnv(paths),
     identities,
     configProfiles,
     providers,
@@ -8303,14 +8442,14 @@ function collectDoctorReport(params) {
     categoriesLocal: { path: paths.categoriesLocalFile, raw: realFsPort.readFileUtf8(paths.categoriesLocalFile) },
     activeIdentity: { path: paths.activeIdentityFile, raw: realFsPort.readFileUtf8(paths.activeIdentityFile) },
     binaryDiscovery,
-    claudeShim: { state: shimState, targetExists: shimState !== void 0 && fs9.existsSync(shimState.targetPath) },
+    claudeShim: { state: shimState, targetExists: shimState !== void 0 && fs10.existsSync(shimState.targetPath) },
     rootPath: paths.root,
     pathResolution: {
       ownExecutablePath,
       agentShim: refinePathShadow(
         findPathShadow({
           pathDirs,
-          targetDir: path24.dirname(ownExecutablePath),
+          targetDir: path25.dirname(ownExecutablePath),
           targetFilename: commandFilename(ownExecutablePath, "agent-shim"),
           findExecutableInDir
         }),
@@ -8331,7 +8470,7 @@ function collectDoctorReport(params) {
 
 // src/launcher.ts
 import { randomUUID as randomUUID4 } from "node:crypto";
-import path26 from "node:path";
+import path27 from "node:path";
 
 // src/launcher/argv.ts
 var ConflictingIdentityError = class extends UsageError {
@@ -8583,7 +8722,7 @@ function buildCliOverride(params) {
 }
 
 // src/launcher/flags.ts
-import path25 from "node:path";
+import path26 from "node:path";
 
 // src/headroom/headers.ts
 function mergeAnthropicCustomHeaders(existing, additions) {
@@ -8653,7 +8792,7 @@ function buildEnv(params) {
   const parentCustomHeaders = params.baseEnv.ANTHROPIC_CUSTOM_HEADERS;
   let providerCustomHeaders;
   if (!params.configDirEscapeHatch && params.resolvedIdentityName !== void 0) {
-    env.CLAUDE_CONFIG_DIR = path25.join(params.identitiesDir, params.resolvedIdentityName);
+    env.CLAUDE_CONFIG_DIR = path26.join(params.identitiesDir, params.resolvedIdentityName);
   }
   if (params.provider !== void 0) {
     const providerEnv = params.provider.definition.env ?? {};
@@ -8814,7 +8953,7 @@ function prepareLaunch(params) {
     identityDefaultConfigProfile: loadedIdentity?.config.defaultConfigProfile,
     globalDefaultConfigProfile: params.globalDefaultConfigProfile
   });
-  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs12.readConfigFile(path26.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
+  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs12.readConfigFile(path27.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
     log.error(
       `agent-shim: no configuration profile named "${configProfileDecision.name}" (selected via ${configProfileDecision.source}). Run \`agent-shim profile add ${configProfileDecision.name}\` first.`
     );
@@ -8987,84 +9126,6 @@ function prepareLaunch(params) {
 import os5 from "node:os";
 import { randomUUID as randomUUID5 } from "node:crypto";
 
-// src/realCredentialCache.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
-import fs10 from "node:fs";
-import path27 from "node:path";
-var KEYCHAIN_CACHE_SERVICE = "agent-shim-credential-cache";
-var CACHE_DIR_MODE = 448;
-var CACHE_FILE_MODE = 384;
-function cacheFileNameFor(owner) {
-  return `${owner.replace(/[^A-Za-z0-9._-]/g, "_")}.json`;
-}
-function parseEntry(raw) {
-  let json;
-  try {
-    json = JSON.parse(raw);
-  } catch {
-    return void 0;
-  }
-  const parsed = CachedCredentialSchema.safeParse(json);
-  return parsed.success ? parsed.data : void 0;
-}
-function requireKeychain() {
-  if (process.platform !== "darwin") {
-    throw new Error("the keychain credential store needs macOS; use --credential-cache-store file");
-  }
-}
-function security(args, stdin) {
-  const result = spawnSync2("security", args, { encoding: "utf8", ...stdin === void 0 ? {} : { input: stdin }, stdio: ["pipe", "pipe", "ignore"] });
-  return { status: result.status, stdout: result.stdout };
-}
-function createRealCredentialCache(root) {
-  const dir = path27.join(root, "credential-cache");
-  const filePath = (owner) => path27.join(dir, cacheFileNameFor(owner));
-  return {
-    read(store, owner) {
-      if (store === "file") {
-        try {
-          return parseEntry(fs10.readFileSync(filePath(owner), "utf8"));
-        } catch {
-          return void 0;
-        }
-      }
-      requireKeychain();
-      const result = security(["find-generic-password", "-s", KEYCHAIN_CACHE_SERVICE, "-a", owner, "-w"]);
-      return result.status === 0 ? parseEntry(Buffer.from(result.stdout.trim(), "base64").toString("utf8")) : void 0;
-    },
-    write(store, owner, entry) {
-      const serialised = JSON.stringify(entry);
-      if (store === "file") {
-        fs10.mkdirSync(dir, { recursive: true, mode: CACHE_DIR_MODE });
-        fs10.chmodSync(dir, CACHE_DIR_MODE);
-        const target = filePath(owner);
-        const temp = `${target}.${String(process.pid)}.tmp`;
-        fs10.writeFileSync(temp, serialised, { mode: CACHE_FILE_MODE });
-        fs10.renameSync(temp, target);
-        return;
-      }
-      requireKeychain();
-      const encoded = Buffer.from(serialised, "utf8").toString("base64");
-      const result = security(["-i"], `add-generic-password -U -s ${KEYCHAIN_CACHE_SERVICE} -a ${JSON.stringify(owner)} -w ${encoded}
-`);
-      if (result.status !== 0) {
-        throw new Error(`could not write the keychain credential cache for ${owner}`);
-      }
-    },
-    remove(store, owner) {
-      if (store === "file") {
-        fs10.rmSync(filePath(owner), { force: true });
-        return;
-      }
-      requireKeychain();
-      security(["delete-generic-password", "-s", KEYCHAIN_CACHE_SERVICE, "-a", owner]);
-    }
-  };
-}
-function realCredentialCacheEnv(paths) {
-  return { port: createRealCredentialCache(paths.root), platform: process.platform, now: () => Date.now() };
-}
-
 // src/frontdoor/realFrontDoorPort.ts
 import fs11 from "node:fs";