agent-shim 8.6.0 → 8.7.0

package/dist/types/index.d.ts

@@ -2497,6 +2497,24 @@ interface CredentialCachePort {
     readonly write: (store: CredentialCacheStore, owner: string, entry: CachedCredential) => void;
     readonly remove: (store: CredentialCacheStore, owner: string) => void;
 }
+/**
+ * What the cache holds for one credential, without the token: whether there is an entry, how old it is, and whether it is still within the block's TTL. `expiresInMs` is absent for a block with no expiry.
+ */
+type CachedCredentialState = {
+    readonly store: CredentialCacheStore;
+    readonly status: "empty";
+}
+/** The store cannot be read here (the keychain store configured on a platform without a Keychain): reported with its reason rather than failing the whole report. */
+ | {
+    readonly store: CredentialCacheStore;
+    readonly status: "unreadable";
+    readonly reason: string;
+} | {
+    readonly store: CredentialCacheStore;
+    readonly status: "fresh" | "expired";
+    readonly ageMs: number;
+    readonly expiresInMs?: number;
+};
 
 /** What reading one `file` source found: nothing at that path, or its contents and permission bits. `mode` is undefined on a platform with no POSIX permission bits (Windows), where the looseness check cannot apply. */
 type SecretFileRead = {
@@ -2850,8 +2868,11 @@ interface CredentialReport {
         readonly name: string;
         readonly credential?: CredentialSummary;
         readonly problem?: string;
+        readonly cached?: CachedCredentialState;
     };
     readonly identity?: CredentialSummary;
+    /** What the identity's own credential cache holds, when its block caches and the cache could be read. */
+    readonly identityCached?: CachedCredentialState;
 }
 /** Inputs to `runCheck` — everything already loaded/injected, exactly like the resolver core and the launcher: nothing in this function touches a real filesystem, git repository, clock, or environment itself. */
 interface RunCheckParams {
@@ -2887,6 +2908,8 @@ interface RunCheckParams {
     readonly platform: string;
     /** The provider a launch here would route through (`launch.provider` in the cascade), when one is selected. */
     readonly provider?: CheckProviderInput;
+    /** Where cached credentials live. Omit to skip reporting a credential cache's age; with it, a block that caches reports whether it holds an entry, how old it is and whether it has expired, never the token. */
+    readonly credentialCache?: CredentialCacheEnv;
 }
 /** Everything `agent-shim check` reports about one directory/identity, without touching the farm or spawning anything. */
 interface CheckReport {
@@ -3021,6 +3044,8 @@ interface DoctorPathResolution {
 /** Everything `runDoctor` needs, all of it already loaded/injected — nothing in `runDoctor` itself reads a file, shells out, or touches the farm. */
 interface RunDoctorParams {
     readonly env: Readonly<Record<string, string | undefined>>;
+    /** Where cached credentials live. Omit to leave a credential cache's age out of the identity and provider findings; with it, a block that caches reports whether it holds an entry, how old it is and whether it has expired, never the token. */
+    readonly credentialCache?: CredentialCacheEnv;
     readonly identities: readonly DoctorIdentityInput[];
     readonly configProfiles: readonly DoctorConfigProfileInput[];
     readonly providers: readonly DoctorProviderInput[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-shim",
-  "version": "8.6.0",
+  "version": "8.7.0",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",