agent-shim 8.6.0 → 8.8.0

package/dist/cli.cjs

@@ -60816,6 +60816,54 @@ function cacheChange(options, existing) {
   return parsed.data;
 }
 
+// src/usage/preflight.ts
+var MS_PER_SECOND = 1e3;
+var SECONDS_PER_MINUTE = 60;
+var MINUTES_PER_HOUR = 60;
+var HOURS_PER_DAY = 24;
+var WARNING_STATUSES = /* @__PURE__ */ new Set(["allowed_warning", "rejected"]);
+function formatAge(ms) {
+  const minutes = Math.floor(ms / (MS_PER_SECOND * SECONDS_PER_MINUTE));
+  if (minutes < MINUTES_PER_HOUR) {
+    return `${String(Math.max(minutes, 0))}m`;
+  }
+  const hours = Math.floor(minutes / MINUTES_PER_HOUR);
+  return hours < HOURS_PER_DAY ? `${String(hours)}h` : `${String(Math.floor(hours / HOURS_PER_DAY))}d`;
+}
+function effectiveWindow(window, nowMs) {
+  const resetsAtMs = window.resetsAt === void 0 ? void 0 : Date.parse(window.resetsAt);
+  if (resetsAtMs !== void 0 && resetsAtMs <= nowMs) {
+    return { reset: true, utilization: 0 };
+  }
+  return {
+    reset: false,
+    ...window.utilization === void 0 ? {} : { utilization: window.utilization },
+    ...resetsAtMs === void 0 ? {} : { resetsAtMs },
+    ...window.status === void 0 ? {} : { status: window.status }
+  };
+}
+function quotaWarnings(snapshot, provider, nowMs) {
+  const rateLimit = snapshot?.providers[provider]?.rateLimit;
+  const unified = rateLimit?.unified;
+  if (snapshot === void 0 || rateLimit === void 0 || unified === void 0) {
+    return [];
+  }
+  const age = formatAge(nowMs - Date.parse(rateLimit.observedAt));
+  const windows = [
+    { name: "five-hour", window: unified.fiveHour },
+    { name: "seven-day", window: unified.sevenDay }
+  ];
+  return windows.flatMap(({ name, window }) => {
+    const effective = window === void 0 ? void 0 : effectiveWindow(window, nowMs);
+    if (window === void 0 || effective?.status === void 0 || !WARNING_STATUSES.has(effective.status)) {
+      return [];
+    }
+    const reset = window.resetsAt === void 0 ? "" : `, resets ${window.resetsAt}`;
+    const verdict = effective.status === "rejected" ? "exhausted" : "nearly used";
+    return [`agent-shim: identity ${snapshot.identity}: the ${name} quota is ${verdict}${reset} (last seen ${age} ago)`];
+  });
+}
+
 // src/credentialCache.ts
 var MS_PER_UNIT = { s: 1e3, m: 6e4, h: 36e5, d: 864e5 };
 var CachedCredentialSchema = external_exports.strictObject({
@@ -60843,6 +60891,45 @@ function isFresh(entry, cache, now) {
   }
   return limit === void 0 || now - entry.fetchedAt < limit;
 }
+function cacheAgeMs(entry, now) {
+  return Math.max(0, now - entry.fetchedAt);
+}
+function describeCachedCredential(params) {
+  const store = effectiveStore(params.cache, params.platform);
+  let entry;
+  try {
+    entry = params.port.read(store, params.owner);
+  } catch (error62) {
+    return { store, status: "unreadable", reason: error62 instanceof Error ? error62.message : String(error62) };
+  }
+  if (entry === void 0) {
+    return { store, status: "empty" };
+  }
+  const limit = ttlMs(params.cache);
+  const ageMs = cacheAgeMs(entry, params.nowMs);
+  return {
+    store,
+    status: isFresh(entry, params.cache, params.nowMs) ? "fresh" : "expired",
+    ageMs,
+    ...limit === void 0 ? {} : { expiresInMs: limit - ageMs }
+  };
+}
+function formatCachedCredentialState(state) {
+  if (state.status === "empty") {
+    return `no cached entry in the ${state.store} store yet`;
+  }
+  if (state.status === "unreadable") {
+    return `the ${state.store} store cannot be read here: ${state.reason}`;
+  }
+  if (state.status === "expired" && (state.expiresInMs === void 0 || state.expiresInMs > 0)) {
+    return "cached with a timestamp in the future, treated as expired";
+  }
+  const age = `cached ${formatAge(state.ageMs)} ago`;
+  if (state.expiresInMs === void 0) {
+    return `${age}, no expiry`;
+  }
+  return state.status === "fresh" ? `${age}, expires in ${formatAge(state.expiresInMs)}` : `${age}, expired ${formatAge(-state.expiresInMs)} ago`;
+}
 
 // src/credential.ts
 var CREDENTIAL_UNAVAILABLE_EXIT = 64;
@@ -61586,7 +61673,7 @@ function registerIdentityCommand(program2, deps) {
 // package.json
 var package_default = {
   name: "agent-shim",
-  version: "8.6.0",
+  version: "8.8.0",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -61682,59 +61769,11 @@ var package_default = {
 };
 
 // src/check.ts
-var import_node_path29 = __toESM(require("node:path"), 1);
+var import_node_path30 = __toESM(require("node:path"), 1);
 
 // src/checkReport.ts
 var import_node_os5 = __toESM(require("node:os"), 1);
 
-// src/usage/preflight.ts
-var MS_PER_SECOND = 1e3;
-var SECONDS_PER_MINUTE = 60;
-var MINUTES_PER_HOUR = 60;
-var HOURS_PER_DAY = 24;
-var WARNING_STATUSES = /* @__PURE__ */ new Set(["allowed_warning", "rejected"]);
-function formatAge(ms) {
-  const minutes = Math.floor(ms / (MS_PER_SECOND * SECONDS_PER_MINUTE));
-  if (minutes < MINUTES_PER_HOUR) {
-    return `${String(Math.max(minutes, 0))}m`;
-  }
-  const hours = Math.floor(minutes / MINUTES_PER_HOUR);
-  return hours < HOURS_PER_DAY ? `${String(hours)}h` : `${String(Math.floor(hours / HOURS_PER_DAY))}d`;
-}
-function effectiveWindow(window, nowMs) {
-  const resetsAtMs = window.resetsAt === void 0 ? void 0 : Date.parse(window.resetsAt);
-  if (resetsAtMs !== void 0 && resetsAtMs <= nowMs) {
-    return { reset: true, utilization: 0 };
-  }
-  return {
-    reset: false,
-    ...window.utilization === void 0 ? {} : { utilization: window.utilization },
-    ...resetsAtMs === void 0 ? {} : { resetsAtMs },
-    ...window.status === void 0 ? {} : { status: window.status }
-  };
-}
-function quotaWarnings(snapshot, provider, nowMs) {
-  const rateLimit = snapshot?.providers[provider]?.rateLimit;
-  const unified = rateLimit?.unified;
-  if (snapshot === void 0 || rateLimit === void 0 || unified === void 0) {
-    return [];
-  }
-  const age = formatAge(nowMs - Date.parse(rateLimit.observedAt));
-  const windows = [
-    { name: "five-hour", window: unified.fiveHour },
-    { name: "seven-day", window: unified.sevenDay }
-  ];
-  return windows.flatMap(({ name, window }) => {
-    const effective = window === void 0 ? void 0 : effectiveWindow(window, nowMs);
-    if (window === void 0 || effective?.status === void 0 || !WARNING_STATUSES.has(effective.status)) {
-      return [];
-    }
-    const reset = window.resetsAt === void 0 ? "" : `, resets ${window.resetsAt}`;
-    const verdict = effective.status === "rejected" ? "exhausted" : "nearly used";
-    return [`agent-shim: identity ${snapshot.identity}: the ${name} quota is ${verdict}${reset} (last seen ${age} ago)`];
-  });
-}
-
 // src/usage/poolPick.ts
 var import_node_path26 = __toESM(require("node:path"), 1);
 
@@ -61964,6 +62003,21 @@ function createAccountReader(fs19, identitiesDir) {
 }
 
 // src/usage/plan.ts
+var PlanClassSchema = external_exports.union([
+  external_exports.strictObject({
+    kind: external_exports.literal("subscription"),
+    /** The plan's size as a multiple of the smallest subscription tier (Max 5x is 5, Max 20x is 20). */
+    capacity: external_exports.number().positive(),
+    /** False when the tier string named no multiplier and no tier this project knows, so `capacity` is the neutral 1 rather than a reading. */
+    recognised: external_exports.boolean(),
+    /** The tier string the classification rests on, when the account had one. */
+    tier: external_exports.string().optional()
+  }),
+  external_exports.strictObject({
+    kind: external_exports.literal("pay-per-use"),
+    tier: external_exports.string().optional()
+  })
+]);
 var TIER_MULTIPLIER = /(?:^|_)(\d+)x$/;
 var ZERO_TIER = /(?:^|_)zero$/;
 var BASE_TIER = /(?:^|_)(?:pro|free)$/;
@@ -63101,7 +63155,7 @@ function candidateView(candidate) {
     feasible: candidate.feasible,
     ...candidate.blockedUntilMs === void 0 ? {} : { blockedUntil: new Date(candidate.blockedUntilMs).toISOString() },
     plan: candidate.plan,
-    reasons: candidate.reasons
+    reasons: [...candidate.reasons]
   };
 }
 function collectPoolPick(params) {
@@ -63120,15 +63174,93 @@ function collectPoolPick(params) {
     directory: params.directory,
     ...ranking.pick === void 0 ? {} : { pick: ranking.pick.identity },
     candidates: ranking.candidates.map(candidateView),
-    missing,
+    missing: [...missing],
     ...ranking.earliestReturn === void 0 ? {} : { earliestReturn: { identity: ranking.earliestReturn.identity, at: new Date(ranking.earliestReturn.atMs).toISOString() } },
     ...sticky.problem === void 0 ? {} : { stickyProblem: sticky.problem }
   };
 }
 
-// src/providersStore.ts
+// src/realCredentialCache.ts
+var import_node_child_process3 = require("node:child_process");
 var import_node_fs9 = __toESM(require("node:fs"), 1);
 var import_node_path27 = __toESM(require("node:path"), 1);
+var KEYCHAIN_CACHE_SERVICE = "agent-shim-credential-cache";
+var CACHE_DIR_MODE = 448;
+var CACHE_FILE_MODE = 384;
+function cacheFileNameFor(owner) {
+  return `${owner.replace(/[^A-Za-z0-9._-]/g, "_")}.json`;
+}
+function parseEntry(raw) {
+  let json2;
+  try {
+    json2 = JSON.parse(raw);
+  } catch {
+    return void 0;
+  }
+  const parsed = CachedCredentialSchema.safeParse(json2);
+  return parsed.success ? parsed.data : void 0;
+}
+function requireKeychain() {
+  if (process.platform !== "darwin") {
+    throw new Error("the keychain credential store needs macOS; use --credential-cache-store file");
+  }
+}
+function security(args, stdin2) {
+  const result = (0, import_node_child_process3.spawnSync)("security", args, { encoding: "utf8", ...stdin2 === void 0 ? {} : { input: stdin2 }, stdio: ["pipe", "pipe", "ignore"] });
+  return { status: result.status, stdout: result.stdout };
+}
+function createRealCredentialCache(root) {
+  const dir = import_node_path27.default.join(root, "credential-cache");
+  const filePath = (owner) => import_node_path27.default.join(dir, cacheFileNameFor(owner));
+  return {
+    read(store, owner) {
+      if (store === "file") {
+        try {
+          return parseEntry(import_node_fs9.default.readFileSync(filePath(owner), "utf8"));
+        } catch {
+          return void 0;
+        }
+      }
+      requireKeychain();
+      const result = security(["find-generic-password", "-s", KEYCHAIN_CACHE_SERVICE, "-a", owner, "-w"]);
+      return result.status === 0 ? parseEntry(Buffer.from(result.stdout.trim(), "base64").toString("utf8")) : void 0;
+    },
+    write(store, owner, entry) {
+      const serialised = JSON.stringify(entry);
+      if (store === "file") {
+        import_node_fs9.default.mkdirSync(dir, { recursive: true, mode: CACHE_DIR_MODE });
+        import_node_fs9.default.chmodSync(dir, CACHE_DIR_MODE);
+        const target = filePath(owner);
+        const temp = `${target}.${String(process.pid)}.tmp`;
+        import_node_fs9.default.writeFileSync(temp, serialised, { mode: CACHE_FILE_MODE });
+        import_node_fs9.default.renameSync(temp, target);
+        return;
+      }
+      requireKeychain();
+      const encoded = Buffer.from(serialised, "utf8").toString("base64");
+      const result = security(["-i"], `add-generic-password -U -s ${KEYCHAIN_CACHE_SERVICE} -a ${JSON.stringify(owner)} -w ${encoded}
+`);
+      if (result.status !== 0) {
+        throw new Error(`could not write the keychain credential cache for ${owner}`);
+      }
+    },
+    remove(store, owner) {
+      if (store === "file") {
+        import_node_fs9.default.rmSync(filePath(owner), { force: true });
+        return;
+      }
+      requireKeychain();
+      security(["delete-generic-password", "-s", KEYCHAIN_CACHE_SERVICE, "-a", owner]);
+    }
+  };
+}
+function realCredentialCacheEnv(paths) {
+  return { port: createRealCredentialCache(paths.root), platform: process.platform, now: () => Date.now() };
+}
+
+// src/providersStore.ts
+var import_node_fs10 = __toESM(require("node:fs"), 1);
+var import_node_path28 = __toESM(require("node:path"), 1);
 var ProviderNotFoundError = class extends CliError {
   constructor(name) {
     super(`No provider named "${name}". Run \`agent-shim provider add ${name}\` first.`);
@@ -63157,10 +63289,10 @@ var InvalidProviderNameError = class extends CliError {
 };
 var PROVIDER_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._@-]*$/;
 function providerJsonPath(paths, name) {
-  return import_node_path27.default.join(paths.providersDir, `${name}.json`);
+  return import_node_path28.default.join(paths.providersDir, `${name}.json`);
 }
 function providerExists(paths, name) {
-  return import_node_fs9.default.existsSync(providerJsonPath(paths, name));
+  return import_node_fs10.default.existsSync(providerJsonPath(paths, name));
 }
 var LEGACY_PROVIDER_FIELDS = ["tokenEnv", "tokenCommand", "authScheme"];
 var LEGACY_ENV_CREDENTIAL_KEYS = Object.values(CREDENTIAL_TARGET_VARS);
@@ -63226,20 +63358,20 @@ function parseProviderFile(filePath, raw) {
 }
 function readProvider(paths, name) {
   const filePath = providerJsonPath(paths, name);
-  if (!import_node_fs9.default.existsSync(filePath)) {
+  if (!import_node_fs10.default.existsSync(filePath)) {
     return void 0;
   }
-  const raw = JSON.parse(import_node_fs9.default.readFileSync(filePath, "utf8"));
+  const raw = JSON.parse(import_node_fs10.default.readFileSync(filePath, "utf8"));
   return parseProviderFile(filePath, raw);
 }
 function loadProvider(providersDir, name, port) {
-  const filePath = import_node_path27.default.join(providersDir, `${name}.json`);
+  const filePath = import_node_path28.default.join(providersDir, `${name}.json`);
   const raw = port.readConfigFile(filePath);
   return raw === void 0 ? void 0 : parseProviderFile(filePath, raw);
 }
 function listProviders(paths) {
   const names = listProviderNames(
-    (dir) => import_node_fs9.default.readdirSync(dir),
+    (dir) => import_node_fs10.default.readdirSync(dir),
     paths.providersDir
   );
   const result = [];
@@ -63358,7 +63490,7 @@ function removeProvider(paths, name) {
   if (!providerExists(paths, name)) {
     throw new ProviderNotFoundError(name);
   }
-  import_node_fs9.default.rmSync(providerJsonPath(paths, name));
+  import_node_fs10.default.rmSync(providerJsonPath(paths, name));
 }
 function cascadeProviderName(cascade) {
   let name;
@@ -63395,7 +63527,7 @@ function resolveProvider(params) {
 }
 
 // src/checkReport.ts
-var import_node_path28 = __toESM(require("node:path"), 1);
+var import_node_path29 = __toESM(require("node:path"), 1);
 
 // src/cli/envBool.ts
 var InvalidEnvBoolError = class extends UsageError {
@@ -63597,14 +63729,23 @@ function inspectSettingsExposure(params) {
   }
   return reports;
 }
-function buildCredentialReport(provider, identity) {
+function cachedState(cacheEnv, owner, block2) {
+  if (cacheEnv === void 0 || block2.cache === void 0) {
+    return void 0;
+  }
+  return describeCachedCredential({ port: cacheEnv.port, platform: cacheEnv.platform, owner, cache: block2.cache, nowMs: cacheEnv.now() });
+}
+function buildCredentialReport(provider, identity, identityName, cacheEnv) {
   const identityCredential = identity?.credential === void 0 ? void 0 : summariseCredential(identity.credential);
+  const identityCached = identity?.credential === void 0 || identityName === void 0 ? void 0 : cachedState(cacheEnv, `identity ${identityName}`, identity.credential);
+  const providerCached = provider?.definition === void 0 ? void 0 : cachedState(cacheEnv, `provider ${provider.name}`, provider.definition.credential);
   return {
     applies: provider !== void 0 ? "provider" : identityCredential !== void 0 ? "identity" : "stored-login",
     ...provider === void 0 ? {} : {
-      provider: provider.problem === void 0 ? { name: provider.name, credential: summariseCredential(provider.definition.credential) } : { name: provider.name, problem: provider.problem }
+      provider: provider.problem === void 0 ? { name: provider.name, credential: summariseCredential(provider.definition.credential), ...providerCached === void 0 ? {} : { cached: providerCached } } : { name: provider.name, problem: provider.problem }
     },
-    ...identityCredential === void 0 ? {} : { identity: identityCredential }
+    ...identityCredential === void 0 ? {} : { identity: identityCredential },
+    ...identityCached === void 0 ? {} : { identityCached }
   };
 }
 function runCheck(params) {
@@ -63643,7 +63784,7 @@ function runCheck(params) {
     ambientCredential,
     ...keychain === void 0 ? {} : { keychain },
     settingsExposure,
-    credential: buildCredentialReport(params.provider, params.identity)
+    credential: buildCredentialReport(params.provider, params.identity, params.identityName, params.credentialCache)
   };
 }
 function formatCheckReport(report) {
@@ -63681,12 +63822,12 @@ function formatCheckReport(report) {
   const { credential } = report;
   if (credential.provider !== void 0) {
     lines.push(
-      `  Provider ${credential.provider.name}: ${credential.provider.credential === void 0 ? `unusable: ${credential.provider.problem ?? ""}` : formatCredentialSummary(credential.provider.credential)}`
+      `  Provider ${credential.provider.name}: ${credential.provider.credential === void 0 ? `unusable: ${credential.provider.problem ?? ""}` : formatCredentialSummary(credential.provider.credential)}${credential.provider.cached === void 0 ? "" : `; ${formatCachedCredentialState(credential.provider.cached)}`}`
     );
   }
   if (credential.identity !== void 0) {
     lines.push(
-      `  Identity ${report.identityName ?? "(none)"}: ${formatCredentialSummary(credential.identity)}${credential.applies === "provider" ? " (not used: the provider's credential applies)" : ""}`
+      `  Identity ${report.identityName ?? "(none)"}: ${formatCredentialSummary(credential.identity)}${credential.identityCached === void 0 ? "" : `; ${formatCachedCredentialState(credential.identityCached)}`}${credential.applies === "provider" ? " (not used: the provider's credential applies)" : ""}`
     );
   }
   if (credential.applies === "stored-login") {
@@ -63795,10 +63936,10 @@ function collectCheckReport(params) {
   }).input;
   const providerName = cascadeProviderName(cascade);
   const provider = providerName === void 0 ? void 0 : loadCheckProvider(paths, providerName);
-  const farmRoot = identityDecision.name === void 0 ? void 0 : import_node_path28.default.join(paths.identitiesDir, identityDecision.name);
+  const farmRoot = identityDecision.name === void 0 ? void 0 : import_node_path29.default.join(paths.identitiesDir, identityDecision.name);
   const settingsFiles = {
-    "settings.json": realFsPort.readFileUtf8(import_node_path28.default.join(claudeHome, "settings.json")),
-    "settings.local.json": realFsPort.readFileUtf8(import_node_path28.default.join(claudeHome, "settings.local.json"))
+    "settings.json": realFsPort.readFileUtf8(import_node_path29.default.join(claudeHome, "settings.json")),
+    "settings.local.json": realFsPort.readFileUtf8(import_node_path29.default.join(claudeHome, "settings.local.json"))
   };
   const report = runCheck({
     cwd,
@@ -63819,6 +63960,7 @@ function collectCheckReport(params) {
     ...loadedIdentity === void 0 ? {} : { identity: loadedIdentity.config },
     settingsFiles,
     run: realRunPort,
+    credentialCache: realCredentialCacheEnv(paths),
     ...farmRoot === void 0 ? {} : { farmRoot },
     platform: process.platform,
     ...provider === void 0 ? {} : { provider }
@@ -63832,7 +63974,7 @@ function registerCheckCommand(program2, deps) {
   const command = program2.command("check [path]").description(
     "Show what a launch in a directory would share or hide and why, plus credential and settings diagnostics. Never touches the farm or spawns claude."
   ).option("--identity <name>", "Identity to check (defaults to the identity a launch there would resolve).").option("--json", "Print the report as JSON.").option("--strict", "Exit 1 when the report carries any warning, not only on errors.").action((pathArg, options) => {
-    const cwd = pathArg === void 0 ? process.cwd() : import_node_path29.default.resolve(pathArg);
+    const cwd = pathArg === void 0 ? process.cwd() : import_node_path30.default.resolve(pathArg);
     const report = collectCheckReport({ paths, cwd, ...options.identity === void 0 ? {} : { identity: options.identity }, env: process.env });
     if (options.json === true) {
       printJson(checkReportToJson(report));
@@ -63850,9 +63992,9 @@ function registerCheckCommand(program2, deps) {
 
 // src/codex/commands.ts
 var import_node_crypto7 = require("node:crypto");
-var import_node_fs10 = __toESM(require("node:fs"), 1);
+var import_node_fs11 = __toESM(require("node:fs"), 1);
 var import_node_os6 = __toESM(require("node:os"), 1);
-var import_node_path30 = __toESM(require("node:path"), 1);
+var import_node_path31 = __toESM(require("node:path"), 1);
 
 // src/codex/agent.ts
 var import_undici = __toESM(require_undici(), 1);
@@ -64091,10 +64233,10 @@ async function callCodex(ports, request7, sessionId, signal) {
 // src/codex/commands.ts
 function codexHome(env, home) {
   const fromEnv = env.CODEX_HOME;
-  return fromEnv !== void 0 && fromEnv !== "" ? fromEnv : import_node_path30.default.join(home, ".codex");
+  return fromEnv !== void 0 && fromEnv !== "" ? fromEnv : import_node_path31.default.join(home, ".codex");
 }
 function codexUsageSnapshotPath() {
-  return import_node_path30.default.join(resolveClaudeHome(), "codex-quota.json");
+  return import_node_path31.default.join(resolveClaudeHome(), "codex-quota.json");
 }
 function isEnoent4(error62) {
   return typeof error62 === "object" && error62 !== null && "code" in error62 && error62.code === "ENOENT";
@@ -64103,7 +64245,7 @@ var PRIVATE_FILE_MODE = 384;
 var realCodexAuthFs = {
   read: (filePath) => {
     try {
-      return import_node_fs10.default.readFileSync(filePath, "utf8");
+      return import_node_fs11.default.readFileSync(filePath, "utf8");
     } catch (error62) {
       if (isEnoent4(error62)) {
         return void 0;
@@ -64112,21 +64254,21 @@ var realCodexAuthFs = {
     }
   },
   writePrivate: (filePath, contents) => {
-    import_node_fs10.default.writeFileSync(filePath, contents, { encoding: "utf8", mode: PRIVATE_FILE_MODE });
-    import_node_fs10.default.chmodSync(filePath, PRIVATE_FILE_MODE);
+    import_node_fs11.default.writeFileSync(filePath, contents, { encoding: "utf8", mode: PRIVATE_FILE_MODE });
+    import_node_fs11.default.chmodSync(filePath, PRIVATE_FILE_MODE);
   },
   rename: (from, to) => {
-    import_node_fs10.default.renameSync(from, to);
+    import_node_fs11.default.renameSync(from, to);
   }
 };
 function writeUsageSnapshot(log, snapshot) {
   const target = codexUsageSnapshotPath();
   const temp = `${target}.${String(process.pid)}.tmp`;
   try {
-    import_node_fs10.default.mkdirSync(import_node_path30.default.dirname(target), { recursive: true });
-    import_node_fs10.default.writeFileSync(temp, `${JSON.stringify(snapshot, null, 2)}
+    import_node_fs11.default.mkdirSync(import_node_path31.default.dirname(target), { recursive: true });
+    import_node_fs11.default.writeFileSync(temp, `${JSON.stringify(snapshot, null, 2)}
 `);
-    import_node_fs10.default.renameSync(temp, target);
+    import_node_fs11.default.renameSync(temp, target);
   } catch (error62) {
     log(`usage snapshot write failed: ${error62 instanceof Error ? error62.message : String(error62)}`);
   }
@@ -64134,7 +64276,7 @@ function writeUsageSnapshot(log, snapshot) {
 function createCodexRoutePorts(log) {
   const agent = createUpstreamAgent();
   const upstreamFetch = createUpstreamFetch(agent);
-  const auth = createCodexAuthStore(import_node_path30.default.join(codexHome(process.env, import_node_os6.default.homedir()), "auth.json"), {
+  const auth = createCodexAuthStore(import_node_path31.default.join(codexHome(process.env, import_node_os6.default.homedir()), "auth.json"), {
     fs: realCodexAuthFs,
     fetch: upstreamFetch,
     now: () => /* @__PURE__ */ new Date(),
@@ -64209,8 +64351,8 @@ function registerCodexCommand(program2, deps) {
 
 // src/frontdoor/commands.ts
 var import_node_crypto12 = require("node:crypto");
-var import_node_path31 = __toESM(require("node:path"), 1);
-var import_node_fs11 = __toESM(require("node:fs"), 1);
+var import_node_path32 = __toESM(require("node:path"), 1);
+var import_node_fs12 = __toESM(require("node:fs"), 1);
 
 // src/frontdoor/custody.ts
 var CREDENTIAL_HEADERS = ["authorization", "x-api-key"];
@@ -64348,8 +64490,8 @@ function isLiveCapability(presented, live) {
 }
 
 // src/frontdoor/capture.ts
-var fs11 = __toESM(require("node:fs"), 1);
-var path31 = __toESM(require("node:path"), 1);
+var fs12 = __toESM(require("node:fs"), 1);
+var path32 = __toESM(require("node:path"), 1);
 var SECRET_HEADER_NAME = /authorization|cookie|token|secret|credential|api[-_]key/i;
 var SECRET_JSON_KEY = /token|secret|password|credential|authorization|api[-_]key/i;
 var SECRET_BODY_PATTERNS = [
@@ -64393,13 +64535,13 @@ function redactBody(chunk) {
 }
 var CAPTURE_ENV = "AGENT_SHIM_FRONTDOOR_CAPTURE";
 function captureFromEnv(env, logsDir) {
-  return env[CAPTURE_ENV] === "1" ? createFileCapture(path31.join(logsDir, "frontdoor-capture.jsonl")) : void 0;
+  return env[CAPTURE_ENV] === "1" ? createFileCapture(path32.join(logsDir, "frontdoor-capture.jsonl")) : void 0;
 }
 function createFileCapture(file2, now = () => /* @__PURE__ */ new Date()) {
-  fs11.mkdirSync(path31.dirname(file2), { recursive: true });
+  fs12.mkdirSync(path32.dirname(file2), { recursive: true });
   let nextId = 0;
   const append = (record2) => {
-    fs11.appendFileSync(file2, `${JSON.stringify({ ts: now().toISOString(), ...record2 })}
+    fs12.appendFileSync(file2, `${JSON.stringify({ ts: now().toISOString(), ...record2 })}
 `, { mode: CAPTURE_FILE_MODE });
   };
   return {
@@ -64486,7 +64628,7 @@ function createFileCapture(file2, now = () => /* @__PURE__ */ new Date()) {
 
 // src/frontdoor/connect.ts
 var import_node_crypto10 = require("node:crypto");
-var fs12 = __toESM(require("node:fs"), 1);
+var fs13 = __toESM(require("node:fs"), 1);
 
 // src/frontdoor/x509.ts
 var import_node_crypto9 = require("node:crypto");
@@ -65258,7 +65400,7 @@ function isEnoent5(error62) {
 function realConnectCertStore(paths) {
   const read = (file2) => {
     try {
-      return fs12.readFileSync(file2, "utf8");
+      return fs13.readFileSync(file2, "utf8");
     } catch (error62) {
       if (isEnoent5(error62)) {
         return void 0;
@@ -65273,10 +65415,10 @@ function realConnectCertStore(paths) {
       return certPem === void 0 || keyPem2 === void 0 ? void 0 : { certPem, keyPem: keyPem2 };
     },
     writeCa: (ca) => {
-      fs12.mkdirSync(paths.frontdoorCaDir, { recursive: true });
-      fs12.writeFileSync(paths.frontdoorCaCertFile, ca.certPem, "utf8");
-      fs12.writeFileSync(paths.frontdoorCaKeyFile, ca.keyPem, { encoding: "utf8", mode: CA_KEY_FILE_MODE });
-      fs12.chmodSync(paths.frontdoorCaKeyFile, CA_KEY_FILE_MODE);
+      fs13.mkdirSync(paths.frontdoorCaDir, { recursive: true });
+      fs13.writeFileSync(paths.frontdoorCaCertFile, ca.certPem, "utf8");
+      fs13.writeFileSync(paths.frontdoorCaKeyFile, ca.keyPem, { encoding: "utf8", mode: CA_KEY_FILE_MODE });
+      fs13.chmodSync(paths.frontdoorCaKeyFile, CA_KEY_FILE_MODE);
     }
   };
 }
@@ -65541,25 +65683,19 @@ function realConnectEffects() {
         }
       };
     },
-    connectTlsUpstream: async (host, port, clientAlpn) => await new Promise((resolve, reject) => {
-      const dial = (localPort) => {
-        const raw = net2.connect({ host, port, localPort, lookup: realAddressLookup });
-        return tls.connect({ socket: raw, servername: host, ...clientAlpn === void 0 ? {} : { ALPNProtocols: [clientAlpn] } });
-      };
-      const settle2 = (candidate) => {
-        candidate.once("secureConnect", () => {
-          resolve(candidate);
-        });
-        candidate.once("error", (error62) => {
-          if ("code" in error62 && error62.code === "EADDRINUSE") {
-            settle2(dial(upstreamLocalPort()));
-            return;
-          }
-          reject(error62);
+    connectTlsUpstream: async (host, port, clientAlpn) => {
+      const dialled = await reservedDial({ host, port });
+      if (dialled.error !== null) {
+        throw dialled.error;
+      }
+      return await new Promise((resolve, reject) => {
+        const secure = tls.connect({ socket: dialled.socket, servername: host, ...clientAlpn === void 0 ? {} : { ALPNProtocols: [clientAlpn] } });
+        secure.once("secureConnect", () => {
+          resolve(secure);
         });
-      };
-      settle2(dial(upstreamLocalPort()));
-    }),
+        secure.once("error", reject);
+      });
+    },
     connectTcp: async (host, port) => await new Promise((resolve, reject) => {
       const socket = net2.connect({ host, port });
       socket.once("connect", () => {
@@ -68222,8 +68358,8 @@ function createRealQuotaRefresher(params) {
 
 // src/frontdoor/commands.ts
 function appendLog(paths, line) {
-  import_node_fs11.default.mkdirSync(paths.logsDir, { recursive: true });
-  import_node_fs11.default.appendFileSync(paths.frontdoorLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+  import_node_fs12.default.mkdirSync(paths.logsDir, { recursive: true });
+  import_node_fs12.default.appendFileSync(paths.frontdoorLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
 `);
 }
 function headroomSocketTarget(fsPort, trust, paths) {
@@ -68332,7 +68468,7 @@ function realFrontDoorSupervisorPorts(paths) {
       const leafFor = createLeafCache(loadCa(), () => /* @__PURE__ */ new Date());
       const capture = captureFromEnv(process.env, paths.logsDir);
       if (capture !== void 0) {
-        log(`capture enabled, recording CONNECT targets and piped exchanges to ${import_node_path31.default.join(paths.logsDir, "frontdoor-capture.jsonl")}`);
+        log(`capture enabled, recording CONNECT targets and piped exchanges to ${import_node_path32.default.join(paths.logsDir, "frontdoor-capture.jsonl")}`);
       }
       const server = await startConnectServer(
         {
@@ -68921,16 +69057,16 @@ function registerCompletionCommand(program2) {
 var import_node_child_process4 = require("node:child_process");
 
 // src/identityToken.ts
-var import_node_fs12 = __toESM(require("node:fs"), 1);
-var import_node_path32 = __toESM(require("node:path"), 1);
+var import_node_fs13 = __toESM(require("node:fs"), 1);
+var import_node_path33 = __toESM(require("node:path"), 1);
 var TOKEN_FILE_MODE = 384;
 var TOKEN_DIR_MODE = 448;
 var OAUTH_TOKEN_RE = /^sk-ant-oat\d+-[A-Za-z0-9_-]+$/;
 function identityTokenDir(paths) {
-  return import_node_path32.default.join(paths.root, "credentials");
+  return import_node_path33.default.join(paths.root, "credentials");
 }
 function identityTokenPath(paths, identityName) {
-  return import_node_path32.default.join(identityTokenDir(paths), `${identityName}.token`);
+  return import_node_path33.default.join(identityTokenDir(paths), `${identityName}.token`);
 }
 function storeIdentityToken(paths, identityName, raw) {
   const token = raw.trim();
@@ -68938,94 +69074,16 @@ function storeIdentityToken(paths, identityName, raw) {
     throw new UsageError("That is not a claude setup-token token (expected it to start with sk-ant-oat). Run `claude setup-token` and pass its token on standard input.");
   }
   const dir = identityTokenDir(paths);
-  import_node_fs12.default.mkdirSync(dir, { recursive: true, mode: TOKEN_DIR_MODE });
-  import_node_fs12.default.chmodSync(dir, TOKEN_DIR_MODE);
+  import_node_fs13.default.mkdirSync(dir, { recursive: true, mode: TOKEN_DIR_MODE });
+  import_node_fs13.default.chmodSync(dir, TOKEN_DIR_MODE);
   const target = identityTokenPath(paths, identityName);
-  const temp = import_node_path32.default.join(dir, `.${identityName}.${String(process.pid)}.tmp`);
-  import_node_fs12.default.writeFileSync(temp, `${token}
+  const temp = import_node_path33.default.join(dir, `.${identityName}.${String(process.pid)}.tmp`);
+  import_node_fs13.default.writeFileSync(temp, `${token}
 `, { mode: TOKEN_FILE_MODE });
-  import_node_fs12.default.renameSync(temp, target);
+  import_node_fs13.default.renameSync(temp, target);
   return target;
 }
 
-// src/realCredentialCache.ts
-var import_node_child_process3 = require("node:child_process");
-var import_node_fs13 = __toESM(require("node:fs"), 1);
-var import_node_path33 = __toESM(require("node:path"), 1);
-var KEYCHAIN_CACHE_SERVICE = "agent-shim-credential-cache";
-var CACHE_DIR_MODE = 448;
-var CACHE_FILE_MODE = 384;
-function cacheFileNameFor(owner) {
-  return `${owner.replace(/[^A-Za-z0-9._-]/g, "_")}.json`;
-}
-function parseEntry(raw) {
-  let json2;
-  try {
-    json2 = JSON.parse(raw);
-  } catch {
-    return void 0;
-  }
-  const parsed = CachedCredentialSchema.safeParse(json2);
-  return parsed.success ? parsed.data : void 0;
-}
-function requireKeychain() {
-  if (process.platform !== "darwin") {
-    throw new Error("the keychain credential store needs macOS; use --credential-cache-store file");
-  }
-}
-function security(args, stdin2) {
-  const result = (0, import_node_child_process3.spawnSync)("security", args, { encoding: "utf8", ...stdin2 === void 0 ? {} : { input: stdin2 }, stdio: ["pipe", "pipe", "ignore"] });
-  return { status: result.status, stdout: result.stdout };
-}
-function createRealCredentialCache(root) {
-  const dir = import_node_path33.default.join(root, "credential-cache");
-  const filePath = (owner) => import_node_path33.default.join(dir, cacheFileNameFor(owner));
-  return {
-    read(store, owner) {
-      if (store === "file") {
-        try {
-          return parseEntry(import_node_fs13.default.readFileSync(filePath(owner), "utf8"));
-        } catch {
-          return void 0;
-        }
-      }
-      requireKeychain();
-      const result = security(["find-generic-password", "-s", KEYCHAIN_CACHE_SERVICE, "-a", owner, "-w"]);
-      return result.status === 0 ? parseEntry(Buffer.from(result.stdout.trim(), "base64").toString("utf8")) : void 0;
-    },
-    write(store, owner, entry) {
-      const serialised = JSON.stringify(entry);
-      if (store === "file") {
-        import_node_fs13.default.mkdirSync(dir, { recursive: true, mode: CACHE_DIR_MODE });
-        import_node_fs13.default.chmodSync(dir, CACHE_DIR_MODE);
-        const target = filePath(owner);
-        const temp = `${target}.${String(process.pid)}.tmp`;
-        import_node_fs13.default.writeFileSync(temp, serialised, { mode: CACHE_FILE_MODE });
-        import_node_fs13.default.renameSync(temp, target);
-        return;
-      }
-      requireKeychain();
-      const encoded = Buffer.from(serialised, "utf8").toString("base64");
-      const result = security(["-i"], `add-generic-password -U -s ${KEYCHAIN_CACHE_SERVICE} -a ${JSON.stringify(owner)} -w ${encoded}
-`);
-      if (result.status !== 0) {
-        throw new Error(`could not write the keychain credential cache for ${owner}`);
-      }
-    },
-    remove(store, owner) {
-      if (store === "file") {
-        import_node_fs13.default.rmSync(filePath(owner), { force: true });
-        return;
-      }
-      requireKeychain();
-      security(["delete-generic-password", "-s", KEYCHAIN_CACHE_SERVICE, "-a", owner]);
-    }
-  };
-}
-function realCredentialCacheEnv(paths) {
-  return { port: createRealCredentialCache(paths.root), platform: process.platform, now: () => Date.now() };
-}
-
 // src/credentialCommand.ts
 async function readStandardInput() {
   const chunks = [];
@@ -69224,7 +69282,14 @@ function pushPathResolution(push, resolution) {
       break;
   }
 }
-function pushProvider(push, entry) {
+function cacheClause(cacheEnv, owner, block2) {
+  if (cacheEnv === void 0 || block2.cache === void 0) {
+    return { text: "", unreadable: false };
+  }
+  const state = describeCachedCredential({ port: cacheEnv.port, platform: cacheEnv.platform, owner, cache: block2.cache, nowMs: cacheEnv.now() });
+  return { text: `; ${formatCachedCredentialState(state)}`, unreadable: state.status === "unreadable" };
+}
+function pushProvider(push, entry, cacheEnv) {
   if (entry.raw === void 0) {
     push("provider", "fail", `${entry.path} is missing.`, entry.name);
     return;
@@ -69246,7 +69311,8 @@ function pushProvider(push, entry) {
     push("provider", "fail", new ConfigValidationError(entry.path, validated.error.issues).message, entry.name);
     return;
   }
-  push("provider", "pass", `${entry.name} is valid (${describeProviderEndpoint(validated.data)}, credential ${describeCredential(validated.data.credential)}).`, entry.name);
+  const cache = cacheClause(cacheEnv, `provider ${entry.name}`, validated.data.credential);
+  push("provider", cache.unreadable ? "fail" : "pass", `${entry.name} is valid (${describeProviderEndpoint(validated.data)}, credential ${describeCredential(validated.data.credential)})${cache.text}.`, entry.name);
 }
 function pushLegacyName(push, params) {
   const legacyVariables = Object.keys(params.env).filter((name) => name.startsWith(LEGACY_ENV_PREFIX) && params.env[name] !== void 0).sort();
@@ -69339,10 +69405,11 @@ function runDoctor(params) {
       );
     } else {
       const credential = validated.data.credential;
+      const cache = credential === void 0 ? { text: "", unreadable: false } : cacheClause(params.credentialCache, `identity ${entry.name}`, credential);
       push(
         "identity",
-        "pass",
-        `${entry.name} is valid and authenticates with ${credential === void 0 ? "its stored login" : `credential ${describeCredential(credential)}`}.`,
+        cache.unreadable ? "fail" : "pass",
+        `${entry.name} is valid and authenticates with ${credential === void 0 ? "its stored login" : `credential ${describeCredential(credential)}`}${cache.text}.`,
         entry.name
       );
     }
@@ -69362,7 +69429,7 @@ function runDoctor(params) {
     return poolName === void 0 ? validIdentityNames.has(selector) : poolName in pools;
   };
   for (const entry of params.providers) {
-    pushProvider(push, entry);
+    pushProvider(push, entry, params.credentialCache);
   }
   if (params.platform !== "darwin" || params.run === void 0) {
     push("keychain", "pass", "Skipped (not macOS).");
@@ -69601,6 +69668,7 @@ function collectDoctorReport(params) {
   );
   const report = runDoctor({
     env: params.env,
+    credentialCache: realCredentialCacheEnv(paths),
     identities,
     configProfiles,
     providers,