agent-shim 9.12.1 → 9.14.0

package/dist/types/index.d.ts

@@ -1608,6 +1608,19 @@ declare const IdentitySchema: z.ZodObject<{
             }>>;
         }, z.core.$strict>>;
     }, z.core.$strict>>;
+    anchors: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        days: z.ZodArray<z.ZodEnum<{
+            mon: "mon";
+            tue: "tue";
+            wed: "wed";
+            thu: "thu";
+            fri: "fri";
+            sat: "sat";
+            sun: "sun";
+        }>>;
+        time: z.ZodString;
+        timeZone: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
 }, z.core.$strict>;
 type Identity = z.infer<typeof IdentitySchema>;
 /**
@@ -1711,6 +1724,8 @@ interface LayoutPaths {
     readonly mcpPermissionsFile: string;
     /** The last identity picked from a pool for each directory, so a conversation stays on the account whose prompt cache is warm. */
     readonly usagePicksFile: string;
+    /** The last anchor the front door's window keeper handled for each identity, so a restart neither replays an anchor nor skips one. */
+    readonly usageAnchorsFile: string;
 }
 /**
  * Resolves the state root: `AGENT_SHIM_HOME` when set to a non-empty string (an empty string counts as unset, consistent with how this project treats empty-string environment variables elsewhere, see the ambient-credential guard), otherwise `~/.agent-shim`, or the former `~/.claude-use` when only that exists.
@@ -4586,6 +4601,18 @@ type PathShadowStatus = {
     readonly by: string;
 };
 
+/** One input the headroom allowlist is computed from: the provider definitions on disk, or the front door's direct origin. */
+type AllowlistDriftInput = "provider-files" | "front-door-origin";
+
+/** What listing the front-door supervisors found: their pids, or why the process table could not be read. */
+type FrontDoorSupervisorListing = {
+    readonly ok: true;
+    readonly pids: readonly number[];
+} | {
+    readonly ok: false;
+    readonly message: string;
+};
+
 /** The result of a successful discovery. */
 interface DiscoveredClaudeBinary {
     /** Full path to the discovered `claude` executable. */
@@ -4604,7 +4631,7 @@ type ClaudeBinaryResolver = (request?: Readonly<ClaudeBinaryRequest>) => Discove
 
 declare const DOCTOR_SEVERITIES: readonly ["pass", "warn", "fail"];
 type DoctorSeverity = (typeof DOCTOR_SEVERITIES)[number];
-declare const DOCTOR_SECTIONS: readonly ["ambient-credential", "binary-discovery", "claude-shim", "path-resolution", "legacy-name", "config-profile", "identity", "sign-in", "pool", "provider", "keychain", "directory-rules", "global-config", "categories-local", "active-identity", "headroom"];
+declare const DOCTOR_SECTIONS: readonly ["ambient-credential", "binary-discovery", "claude-shim", "path-resolution", "legacy-name", "config-profile", "identity", "sign-in", "pool", "provider", "keychain", "directory-rules", "global-config", "categories-local", "active-identity", "headroom", "frontdoor"];
 type DoctorSection = (typeof DOCTOR_SECTIONS)[number];
 /** One line of `agent-shim doctor`'s report. `subject` names the identity/profile/rule the finding is about, when the section has more than one of those. */
 interface DoctorFinding {
@@ -4700,6 +4727,18 @@ interface RunDoctorParams {
     readonly headroom: {
         readonly state: DoctorFileInput;
         readonly isRunning: (pid: number) => boolean;
+        /** What the daemon's allowlist is measured against. Omit to skip the allowlist check; with it, a daemon whose allowlist may exclude the serving door's direct origin is a failure. */
+        readonly allowlist?: {
+            /** The inputs that could explain the recorded allowlist hash not matching the current allowlist, or undefined when it matches. */
+            readonly driftInputs: readonly AllowlistDriftInput[] | undefined;
+            /** The serving front door's direct origin, or undefined before it has ever served. */
+            readonly frontDoorOrigin: string | undefined;
+        };
+    };
+    /** The front door's state.json and the supervisor processes alive for this user. Omit to skip the front-door checks (the platform cannot list processes); with it, more than one supervisor alive at once is a failure naming each superseded one. */
+    readonly frontDoor?: {
+        readonly state: DoctorFileInput;
+        readonly supervisors: FrontDoorSupervisorListing;
     };
 }
 /**
@@ -4888,11 +4927,14 @@ declare const UsageSnapshotSchema: z.ZodObject<{
 }, z.core.$strict>;
 type UsageSnapshot = z.infer<typeof UsageSnapshotSchema>;
 
-/** The record held in one front-door session-registry file: the launcher's pid plus the per-launch capability token its child presents on every request. */
+/**
+ * The record held in one front-door session-registry file: the launcher's pid plus the per-launch capability token its child presents on every request, and the supervisor of the door the launch was sent to. `supervisorPid` is absent on a record written before it existed and on a door's own transparent-surface record; such a launch cannot be attributed to a door, so a superseded door treats it as its own.
+ */
 declare const FrontDoorSessionSchema: z.ZodObject<{
     pid: z.ZodNumber;
     startedAt: z.ZodNumber;
     token: z.ZodString;
+    supervisorPid: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strict>;
 type FrontDoorSession = z.infer<typeof FrontDoorSessionSchema>;
 /**
@@ -4911,7 +4953,7 @@ declare const FrontDoorStateSchema: z.ZodObject<{
 }, z.core.$strict>;
 type FrontDoorState = z.infer<typeof FrontDoorStateSchema>;
 /** A registered launch as status and the idle decision see it: the pid and start time, never the token, so nothing that prints or serialises a session can leak the capability. */
-type FrontDoorSessionSummary = Pick<FrontDoorSession, "pid" | "startedAt">;
+type FrontDoorSessionSummary = Pick<FrontDoorSession, "pid" | "startedAt" | "supervisorPid">;
 
 /** How a sign-out went: whether OpenAI was told, so the person knows the grant is dead on its side too. */
 interface SiwcLogoutResult {
@@ -5056,6 +5098,19 @@ declare function createConfigApiRouter(deps: ConfigApiDeps): {
                             }>>;
                         }, zod_v4_core.$strict>>;
                     }, zod_v4_core.$strict>>;
+                    anchors: zod.ZodOptional<zod.ZodArray<zod.ZodObject<{
+                        days: zod.ZodArray<zod.ZodEnum<{
+                            mon: "mon";
+                            tue: "tue";
+                            wed: "wed";
+                            thu: "thu";
+                            fri: "fri";
+                            sat: "sat";
+                            sun: "sun";
+                        }>>;
+                        time: zod.ZodString;
+                        timeZone: zod.ZodOptional<zod.ZodString>;
+                    }, zod_v4_core.$strict>>>;
                 }, zod_v4_core.$strict>;
             }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
             set: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
@@ -5094,6 +5149,19 @@ declare function createConfigApiRouter(deps: ConfigApiDeps): {
                         }>>;
                     }, zod_v4_core.$strict>]>>;
                 }, zod_v4_core.$strict>]>>;
+                anchors: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodLiteral<false>, zod.ZodArray<zod.ZodObject<{
+                    days: zod.ZodArray<zod.ZodEnum<{
+                        mon: "mon";
+                        tue: "tue";
+                        wed: "wed";
+                        thu: "thu";
+                        fri: "fri";
+                        sat: "sat";
+                        sun: "sun";
+                    }>>;
+                    time: zod.ZodString;
+                    timeZone: zod.ZodOptional<zod.ZodString>;
+                }, zod_v4_core.$strict>>]>>;
             }, zod_v4_core.$strict>, zod.ZodObject<{
                 action: zod.ZodLiteral<"updated">;
                 kind: zod.ZodLiteral<"identity">;
@@ -5135,6 +5203,19 @@ declare function createConfigApiRouter(deps: ConfigApiDeps): {
                             }>>;
                         }, zod_v4_core.$strict>>;
                     }, zod_v4_core.$strict>>;
+                    anchors: zod.ZodOptional<zod.ZodArray<zod.ZodObject<{
+                        days: zod.ZodArray<zod.ZodEnum<{
+                            mon: "mon";
+                            tue: "tue";
+                            wed: "wed";
+                            thu: "thu";
+                            fri: "fri";
+                            sat: "sat";
+                            sun: "sun";
+                        }>>;
+                        time: zod.ZodString;
+                        timeZone: zod.ZodOptional<zod.ZodString>;
+                    }, zod_v4_core.$strict>>>;
                 }, zod_v4_core.$strict>;
             }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
             remove: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
@@ -6283,7 +6364,7 @@ declare const LaunchLifecycleEventSchema: z.ZodObject<{
 /** One launch lifecycle event, as the TypeScript the publisher emits and its consumers handle. */
 type LaunchLifecycleEvent = z.output<typeof LaunchLifecycleEventSchema>;
 /**
- * One door health event: the supervisor's own state transitions, observed at the moment they happened in this process. `generation` is the door fully serving (every listener bound and the state file naming it); `listenerFailed` is a start failure that ends the generation, naming which listener and why; `binaryTurnover` is the door retiring because the installed binary changed and no session is live, so the next launch serves from the new one; `idleShutdown` is the door closing itself with an empty session registry.
+ * One door health event: the supervisor's own state transitions, observed at the moment they happened in this process. `generation` is the door fully serving (every listener bound and the state file naming it); `listenerFailed` is a start failure that ends the generation, naming which listener and why; `binaryTurnover` is the door retiring because the installed binary changed and no session is live, so the next launch serves from the new one; `idleShutdown` is the door closing itself with an empty session registry; `superseded` is the state file coming to name another live supervisor, `ownerPid`, after which this door takes no new sessions; `drained` is a superseded door closing itself because every session it served has ended.
  */
 declare const DoorHealthEventSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     kind: z.ZodLiteral<"generation">;
@@ -6310,6 +6391,15 @@ declare const DoorHealthEventSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     kind: z.ZodLiteral<"idleShutdown">;
     pid: z.ZodNumber;
     observedAt: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"superseded">;
+    pid: z.ZodNumber;
+    ownerPid: z.ZodNumber;
+    observedAt: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"drained">;
+    pid: z.ZodNumber;
+    observedAt: z.ZodNumber;
 }, z.core.$strict>], "kind">;
 /** One door health event, as the TypeScript the publisher emits and its consumers handle. */
 type DoorHealthEvent = z.output<typeof DoorHealthEventSchema>;
@@ -7387,6 +7477,7 @@ declare function createControlApiRouter(deps: ControlApiDeps): {
                     "config-profile": "config-profile";
                     identity: "identity";
                     provider: "provider";
+                    frontdoor: "frontdoor";
                     pool: "pool";
                     keychain: "keychain";
                     "ambient-credential": "ambient-credential";
@@ -7676,6 +7767,19 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                             }>>;
                         }, zod_v4_core.$strict>>;
                     }, zod_v4_core.$strict>>;
+                    anchors: zod.ZodOptional<zod.ZodArray<zod.ZodObject<{
+                        days: zod.ZodArray<zod.ZodEnum<{
+                            mon: "mon";
+                            tue: "tue";
+                            wed: "wed";
+                            thu: "thu";
+                            fri: "fri";
+                            sat: "sat";
+                            sun: "sun";
+                        }>>;
+                        time: zod.ZodString;
+                        timeZone: zod.ZodOptional<zod.ZodString>;
+                    }, zod_v4_core.$strict>>>;
                 }, zod_v4_core.$strict>;
             }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
             set: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
@@ -7714,6 +7818,19 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                         }>>;
                     }, zod_v4_core.$strict>]>>;
                 }, zod_v4_core.$strict>]>>;
+                anchors: zod.ZodOptional<zod.ZodUnion<readonly [zod.ZodLiteral<false>, zod.ZodArray<zod.ZodObject<{
+                    days: zod.ZodArray<zod.ZodEnum<{
+                        mon: "mon";
+                        tue: "tue";
+                        wed: "wed";
+                        thu: "thu";
+                        fri: "fri";
+                        sat: "sat";
+                        sun: "sun";
+                    }>>;
+                    time: zod.ZodString;
+                    timeZone: zod.ZodOptional<zod.ZodString>;
+                }, zod_v4_core.$strict>>]>>;
             }, zod_v4_core.$strict>, zod.ZodObject<{
                 action: zod.ZodLiteral<"updated">;
                 kind: zod.ZodLiteral<"identity">;
@@ -7755,6 +7872,19 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                             }>>;
                         }, zod_v4_core.$strict>>;
                     }, zod_v4_core.$strict>>;
+                    anchors: zod.ZodOptional<zod.ZodArray<zod.ZodObject<{
+                        days: zod.ZodArray<zod.ZodEnum<{
+                            mon: "mon";
+                            tue: "tue";
+                            wed: "wed";
+                            thu: "thu";
+                            fri: "fri";
+                            sat: "sat";
+                            sun: "sun";
+                        }>>;
+                        time: zod.ZodString;
+                        timeZone: zod.ZodOptional<zod.ZodString>;
+                    }, zod_v4_core.$strict>>>;
                 }, zod_v4_core.$strict>;
             }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
             remove: _orpc_server.DecoratedProcedure<DoorApiContext & object, IntersectPick<TInitialContext, $OutContext>, zod.ZodObject<{
@@ -9369,6 +9499,7 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                     "config-profile": "config-profile";
                     identity: "identity";
                     provider: "provider";
+                    frontdoor: "frontdoor";
                     pool: "pool";
                     keychain: "keychain";
                     "ambient-credential": "ambient-credential";
@@ -9744,6 +9875,19 @@ declare const ConfigIdentityAddOutputSchema: z.ZodObject<{
                 }>>;
             }, z.core.$strict>>;
         }, z.core.$strict>>;
+        anchors: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            days: z.ZodArray<z.ZodEnum<{
+                mon: "mon";
+                tue: "tue";
+                wed: "wed";
+                thu: "thu";
+                fri: "fri";
+                sat: "sat";
+                sun: "sun";
+            }>>;
+            time: z.ZodString;
+            timeZone: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>>;
     }, z.core.$strict>;
 }, z.core.$strict>;
 /** `defaultConfigProfile: false` clears it; `credential: false` removes the credential block, returning the identity to its stored login. At least one field must be present. */
@@ -9783,6 +9927,19 @@ declare const ConfigIdentitySetInputSchema: z.ZodObject<{
             }>>;
         }, z.core.$strict>]>>;
     }, z.core.$strict>]>>;
+    anchors: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<false>, z.ZodArray<z.ZodObject<{
+        days: z.ZodArray<z.ZodEnum<{
+            mon: "mon";
+            tue: "tue";
+            wed: "wed";
+            thu: "thu";
+            fri: "fri";
+            sat: "sat";
+            sun: "sun";
+        }>>;
+        time: z.ZodString;
+        timeZone: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>]>>;
 }, z.core.$strict>;
 declare const ConfigIdentitySetOutputSchema: z.ZodObject<{
     action: z.ZodLiteral<"updated">;
@@ -9825,6 +9982,19 @@ declare const ConfigIdentitySetOutputSchema: z.ZodObject<{
                 }>>;
             }, z.core.$strict>>;
         }, z.core.$strict>>;
+        anchors: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            days: z.ZodArray<z.ZodEnum<{
+                mon: "mon";
+                tue: "tue";
+                wed: "wed";
+                thu: "thu";
+                fri: "fri";
+                sat: "sat";
+                sun: "sun";
+            }>>;
+            time: z.ZodString;
+            timeZone: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>>;
     }, z.core.$strict>;
 }, z.core.$strict>;
 declare const ConfigIdentityRemoveInputSchema: z.ZodObject<{
@@ -11175,6 +11345,7 @@ declare const DoctorFindingSchema: z.ZodObject<{
         "config-profile": "config-profile";
         identity: "identity";
         provider: "provider";
+        frontdoor: "frontdoor";
         pool: "pool";
         keychain: "keychain";
         "ambient-credential": "ambient-credential";
@@ -11205,6 +11376,7 @@ declare const DoctorRunOutputSchema: z.ZodObject<{
             "config-profile": "config-profile";
             identity: "identity";
             provider: "provider";
+            frontdoor: "frontdoor";
             pool: "pool";
             keychain: "keychain";
             "ambient-credential": "ambient-credential";
@@ -11397,7 +11569,7 @@ interface LaunchEventPublisher {
 declare function createLaunchEventPublisher(hub: DoorEventHub, now: () => number): LaunchEventPublisher;
 
 /**
- * The door health publisher: the supervisor's own state transitions as backbone events, so a consumer of the door learns the door itself changed and not only its sessions. The publisher emits nothing of its own: the supervisor tells it the moments it already lives through (every listener bound, a start failure that ends the generation, the binary turnover, the idle shutdown), each published the moment it happens rather than at a tick, because these are process facts, not registry facts diffed between observations.
+ * The door health publisher: the supervisor's own state transitions as backbone events, so a consumer of the door learns the door itself changed and not only its sessions. The publisher emits nothing of its own: the supervisor tells it the moments it already lives through (every listener bound, a start failure that ends the generation, the binary turnover, the idle shutdown, the supersession and the drained exit that follows it), each published the moment it happens rather than at a tick, because these are process facts, not registry facts diffed between observations.
  */
 /** Everything the door health publisher needs: the backbone it publishes on and the clock its events are observed at. */
 interface DoorHealthPublisher {
@@ -11413,6 +11585,10 @@ interface DoorHealthPublisher {
     readonly binaryTurnover: () => void;
     /** Publishes the idle shutdown: the door closing itself with an empty session registry. */
     readonly idleShutdown: () => void;
+    /** Publishes the supersession: the state file naming another live supervisor, `ownerPid`, so this door takes no new sessions and serves only those it already had. */
+    readonly superseded: (ownerPid: number) => void;
+    /** Publishes the drained exit: a superseded door closing itself because every session it served has ended. */
+    readonly drained: () => void;
 }
 /** Creates the door health publisher. One per door process, fed by the supervisor. */
 declare function createDoorHealthPublisher(hub: DoorEventHub, now: () => number, pid: number): DoorHealthPublisher;
@@ -11753,7 +11929,7 @@ interface RunFrontDoorSupervisorOptions {
     readonly tickLimit?: number;
 }
 /**
- * Runs the front-door supervisor: binds all three listeners (the HTTPS provider listener, the CONNECT surface and the plain-HTTP direct listener, each on its sticky port), records the serving state, and shuts down with an empty session registry, either at the first such tick after the executable it serves as has been replaced on disk (so an applied update reaches the door without waiting out the idle window) or after `idleShutdownMinutes` of it. Returns the exit code: 0 for either retirement, 1 for a fatal start failure.
+ * Runs the front-door supervisor: binds all three listeners (the HTTPS provider listener, the CONNECT surface and the plain-HTTP direct listener, each on its sticky port), records the serving state, and shuts down with an empty session registry, either at the first such tick after the executable it serves as has been replaced on disk (so an applied update reaches the door without waiting out the idle window) or after `idleShutdownMinutes` of it. A door whose state file comes to name another live supervisor is superseded: from then on it takes no new sessions, never writes the state file again, and exits as soon as the sessions it was serving have ended. Returns the exit code: 0 for any of these retirements, 1 for a fatal start failure.
  *
  * The listeners live in this process, so there is no child to keep alive: a crash of this process is a crash of every routed session's door at once, and recovery is the next launch's ensure spawning a replacement on the same sticky ports, which is exactly the failure model the issue asks to settle with tests. Keeping the headroom daemon alive is the headroom supervisor's job, not this one's; the two daemons idle out independently.
  */
@@ -11904,6 +12080,8 @@ interface Candidate {
     readonly headroom?: number;
     /** When an `ineligible` candidate can be used again. */
     readonly blockedUntilMs?: number;
+    /** When the exhausted plan window of a `pay-per-use` candidate that is only on extra usage because its plan ran out resets, so a launch can hold for it rather than spend. Absent for a candidate that bills by use with no plan allowance. */
+    readonly planReturnsAtMs?: number;
     readonly plan: PlanClass;
     /** True when the member's policy condition could not be decided and it is ranked last within its class, naming the missing fact in its reasons. */
     readonly policyDemoted?: boolean;
@@ -11920,6 +12098,11 @@ interface PoolRanking {
         readonly identity: string;
         readonly atMs: number;
     };
+    /** When the pick continues on extra usage only because its plan ran out, the identity and the instant its plan window resets: what a launch that would rather wait than spend sleeps until. Absent when the pick is on plan quota, bills by use with no plan, or no member can be picked. */
+    readonly planReturn?: {
+        readonly identity: string;
+        readonly atMs: number;
+    };
     /** The member a resumed or continued conversation started on but moved off, and why, when a launch that resumes could not keep it. One sentence for the launch decision line and `check`. */
     readonly movedOff?: {
         readonly identity: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-shim",
-  "version": "9.12.1",
+  "version": "9.14.0",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",