claude-use 11.22.0 → 11.23.0

package/dist/index.cjs

@@ -624,7 +624,7 @@ function parseIgnoringUnrecognisedKeys(schema, raw) {
   return second.success ? { success: true, data: second.data, ignored } : { success: false, issues: second.error.issues };
 }
 function describeIgnoredKeys(filePath, ignored) {
-  const places = ignored.map(({ path: path41, keys }) => `${path41.length === 0 ? "" : `${path41.map(String).join(".")}.`}${keys.join(", ")}`);
+  const places = ignored.map(({ path: path42, keys }) => `${path42.length === 0 ? "" : `${path42.map(String).join(".")}.`}${keys.join(", ")}`);
   return `${filePath} has settings this version of agent-shim does not know and ignores: ${places.join("; ")}. A newer release may read them.`;
 }
 function noteIgnoredKeys(filePath, ignored) {
@@ -646,9 +646,9 @@ function restoreIgnoredKeys(filePath, value) {
     return value;
   }
   const restored = structuredClone(value);
-  for (const { path: path41, values } of ignored) {
+  for (const { path: path42, values } of ignored) {
     let holder = restored;
-    for (const step of path41) {
+    for (const step of path42) {
       holder = isRecord(holder) ? holder[step] : void 0;
     }
     if (isRecord(holder)) {
@@ -2928,7 +2928,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "claude-use",
-      version: "11.22.0",
+      version: "11.23.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -6733,6 +6733,49 @@ var init_providersStore = __esm({
   }
 });
 
+// src/usage/signIn.ts
+function claudeCodeKeychainService(configDir) {
+  return `${KEYCHAIN_SERVICE_PREFIX}-${(0, import_node_crypto9.createHash)("sha256").update(configDir).digest("hex").slice(0, KEYCHAIN_SERVICE_HASH_DIGITS)}`;
+}
+function keychainHasItem(run, configDir) {
+  return run.run("security", ["find-generic-password", "-s", claudeCodeKeychainService(configDir)]).status === 0;
+}
+function decideSignIn(facts) {
+  if (facts.hasCredentialBlock) {
+    return { state: "token", detail: "supplies its own credential through a credential block, so a stored login is not what a launch uses" };
+  }
+  if (facts.keychainItem === true) {
+    return { state: "signed-in", detail: "a login is stored in the macOS Keychain" };
+  }
+  if (facts.credentialsFile) {
+    return { state: "signed-in", detail: `a login is stored in ${CREDENTIALS_FILE}` };
+  }
+  return { state: "signed-out", detail: facts.platform === "darwin" ? `no Keychain item and no ${CREDENTIALS_FILE}` : `no ${CREDENTIALS_FILE}` };
+}
+function credentialsFilePath(farmRoot) {
+  return import_node_path26.default.join(farmRoot, CREDENTIALS_FILE);
+}
+function identitySignIn(fs13, probe, identity) {
+  const probing = !identity.hasCredentialBlock;
+  return decideSignIn({
+    hasCredentialBlock: identity.hasCredentialBlock,
+    keychainItem: probing && probe.platform === "darwin" && probe.run !== void 0 ? keychainHasItem(probe.run, identity.farmRoot) : void 0,
+    credentialsFile: probing && fs13.lstat(credentialsFilePath(identity.farmRoot)) !== void 0,
+    platform: probe.platform
+  });
+}
+var import_node_crypto9, import_node_path26, CREDENTIALS_FILE, KEYCHAIN_SERVICE_PREFIX, KEYCHAIN_SERVICE_HASH_DIGITS;
+var init_signIn = __esm({
+  "src/usage/signIn.ts"() {
+    "use strict";
+    import_node_crypto9 = require("node:crypto");
+    import_node_path26 = __toESM(require("node:path"), 1);
+    CREDENTIALS_FILE = ".credentials.json";
+    KEYCHAIN_SERVICE_PREFIX = "Claude Code-credentials";
+    KEYCHAIN_SERVICE_HASH_DIGITS = 8;
+  }
+});
+
 // src/cli/bool.ts
 function parseBoolWord(input) {
   switch (input) {
@@ -6886,10 +6929,10 @@ function commandFilename(ownExecutablePath, commandName) {
 }
 function resolveOwnBinaryCheck(paths, contentSourcePath) {
   const state = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-  const recordedTarget = state === void 0 ? void 0 : import_node_path27.default.resolve(state.targetPath);
+  const recordedTarget = state === void 0 ? void 0 : import_node_path28.default.resolve(state.targetPath);
   let ownStat;
   return (candidate) => {
-    if (recordedTarget !== void 0 && import_node_path27.default.resolve(candidate) === recordedTarget) {
+    if (recordedTarget !== void 0 && import_node_path28.default.resolve(candidate) === recordedTarget) {
       return true;
     }
     ownStat ??= statOrUndefined(contentSourcePath);
@@ -6912,22 +6955,22 @@ function statOrUndefined(target) {
   }
 }
 function findPathShadow(params) {
-  const resolvedTargetDir = import_node_path27.default.resolve(params.targetDir);
+  const resolvedTargetDir = import_node_path28.default.resolve(params.targetDir);
   for (const dir of params.pathDirs) {
     const found = params.findExecutableInDir(dir, params.targetFilename);
     if (found === void 0) {
       continue;
     }
-    return import_node_path27.default.resolve(dir) === resolvedTargetDir ? { status: "ok" } : { status: "shadowed", by: found };
+    return import_node_path28.default.resolve(dir) === resolvedTargetDir ? { status: "ok" } : { status: "shadowed", by: found };
   }
-  return params.pathDirs.some((dir) => import_node_path27.default.resolve(dir) === resolvedTargetDir) ? { status: "ok" } : { status: "not-on-path" };
+  return params.pathDirs.some((dir) => import_node_path28.default.resolve(dir) === resolvedTargetDir) ? { status: "ok" } : { status: "not-on-path" };
 }
-var import_node_fs7, import_node_path27, import_zod19, ClaudeShimStateSchema, nodeLinkFs;
+var import_node_fs7, import_node_path28, import_zod19, ClaudeShimStateSchema, nodeLinkFs;
 var init_claudeShim = __esm({
   "src/claudeShim.ts"() {
     "use strict";
     import_node_fs7 = __toESM(require("node:fs"), 1);
-    import_node_path27 = __toESM(require("node:path"), 1);
+    import_node_path28 = __toESM(require("node:path"), 1);
     import_zod19 = require("zod");
     init_commandDeps();
     init_store();
@@ -7128,7 +7171,7 @@ function ensureFrontDoor(params) {
     if (supervisorPid !== void 0 && !distrusted.has(supervisorPid) && ports.isRunning(supervisorPid)) {
       if (state?.port !== void 0 && state.connectPort !== void 0) {
         if (supervisorPid === params.launcherPid && params.replace !== true && ports.isFrontDoorSupervisor(supervisorPid)) {
-          const token = (0, import_node_crypto9.randomUUID)();
+          const token = (0, import_node_crypto10.randomUUID)();
           writeFrontDoorSession(ports.fs, paths.frontdoorSessionsDir, { pid: params.launcherPid, startedAt: ports.now(), token, supervisorPid });
           return { port: state.port, connectPort: state.connectPort, token };
         }
@@ -7142,7 +7185,7 @@ function ensureFrontDoor(params) {
           continue;
         }
         if (verdict.ok) {
-          const token = (0, import_node_crypto9.randomUUID)();
+          const token = (0, import_node_crypto10.randomUUID)();
           writeFrontDoorSession(ports.fs, paths.frontdoorSessionsDir, { pid: params.launcherPid, startedAt: ports.now(), token, supervisorPid });
           return { port: state.port, connectPort: state.connectPort, token };
         }
@@ -7195,11 +7238,11 @@ function ensureFrontDoor(params) {
     ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
   }
 }
-var import_node_crypto9, FRONTDOOR_START_TIMEOUT_MS, FRONTDOOR_LAUNCHER_POLL_MS, FRONTDOOR_PROBE_ATTEMPTS, FRONTDOOR_EXIT_GRACE_MS, FrontDoorStartError;
+var import_node_crypto10, FRONTDOOR_START_TIMEOUT_MS, FRONTDOOR_LAUNCHER_POLL_MS, FRONTDOOR_PROBE_ATTEMPTS, FRONTDOOR_EXIT_GRACE_MS, FrontDoorStartError;
 var init_ensure2 = __esm({
   "src/frontdoor/ensure.ts"() {
     "use strict";
-    import_node_crypto9 = require("node:crypto");
+    import_node_crypto10 = require("node:crypto");
     init_cliError();
     init_state2();
     init_state();
@@ -7580,7 +7623,7 @@ function buildEnv(params) {
     }
   }
   if (params.provider !== void 0) {
-    env.ANTHROPIC_AUTH_TOKEN = void 0;
+    env.ANTHROPIC_AUTH_TOKEN = params.remoteControl ? void 0 : PROVIDER_SESSION_PLACEHOLDER;
     env.ANTHROPIC_API_KEY = void 0;
     env.CLAUDE_CODE_OAUTH_TOKEN = void 0;
   } else if (params.identityCredential !== void 0) {
@@ -7612,7 +7655,7 @@ function buildEnv(params) {
   }
   return env;
 }
-var import_node_path36, LOOPBACK_HOSTS;
+var import_node_path36, LOOPBACK_HOSTS, PROVIDER_SESSION_PLACEHOLDER;
 var init_flags = __esm({
   "src/launcher/flags.ts"() {
     "use strict";
@@ -7623,6 +7666,7 @@ var init_flags = __esm({
     init_capability();
     init_route();
     LOOPBACK_HOSTS = ["127.0.0.1", "localhost", "::1"];
+    PROVIDER_SESSION_PLACEHOLDER = "agent-shim-provider-session";
   }
 });
 
@@ -8180,7 +8224,7 @@ function decideLaunch(params, readOnly) {
   }
   const pinnedVersion = resolveClaudeVersion({ env, ...parsedArgv.claudeVersion === void 0 ? {} : { flag: parsedArgv.claudeVersion }, ...cascadeLaunch?.claudeVersion === void 0 ? {} : { cascade: cascadeLaunch.claudeVersion } });
   const discovered = params.resolveClaudeBinary(pinnedVersion === void 0 ? void 0 : { version: pinnedVersion.version });
-  const flags = resolveLaunchFlags({
+  const requestedFlags = resolveLaunchFlags({
     env,
     ...cascadeLaunch === void 0 ? {} : { cascade: cascadeLaunch },
     flags: {
@@ -8190,6 +8234,11 @@ function decideLaunch(params, readOnly) {
       ...parsedArgv.trackUsage === void 0 ? {} : { trackUsage: parsedArgv.trackUsage }
     }
   });
+  const loginlessProvider = requestedFlags.remoteControl && selectedProvider !== void 0 && farmIdentity !== void 0 && params.hasStoredLogin?.(farmIdentity) === false ? { identity: farmIdentity, provider: selectedProvider.name } : void 0;
+  if (loginlessProvider !== void 0 && !readOnly) {
+    log.info(`agent-shim: identity ${loginlessProvider.identity} has no stored login, so Remote Control, which needs one, is off for this launch; provider ${loginlessProvider.provider} runs without it`);
+  }
+  const flags = loginlessProvider === void 0 ? requestedFlags : { ...requestedFlags, remoteControl: false };
   const args = buildArgv({
     toolFlags: buildFlagArgs(flags),
     extraFlags: splitExtraFlags(env.CLAUDE_EXTRA_FLAGS),
@@ -8305,7 +8354,7 @@ function prepareLaunch(params) {
     log.info(`agent-shim: routing through the front door on 127.0.0.1:${String(frontDoor.port)}${resolvedProvider === void 0 ? ` (OAuth via the door's CONNECT surface on 127.0.0.1:${String(frontDoor.connectPort)}, usage recorded)` : ` (provider ${resolvedProvider.name})`}`);
   }
   const frontDoorRelease = frontDoor === void 0 ? void 0 : frontDoorPort?.release;
-  const sessionId = params.supervised?.sessionId ?? (0, import_node_crypto10.randomUUID)();
+  const sessionId = params.supervised?.sessionId ?? (0, import_node_crypto11.randomUUID)();
   const finalEnv = buildEnv({
     baseEnv: env,
     configDirEscapeHatch: configDirEscapeHatchApplies,
@@ -8315,7 +8364,8 @@ function prepareLaunch(params) {
     ...identityCredential === void 0 ? {} : { identityCredential },
     ...frontDoor === void 0 ? {} : { frontdoor: frontDoor },
     ...headroom === void 0 ? {} : { headroom },
-    sessionId
+    sessionId,
+    remoteControl: resolvedFlags.remoteControl
   });
   const releases = [...headroom === void 0 || headroomPort === void 0 ? [] : [headroomPort.release], ...frontDoorRelease === void 0 ? [] : [frontDoorRelease]];
   const release = () => {
@@ -8337,7 +8387,8 @@ function resolveLaunch(params) {
     ...decided.provider === void 0 ? {} : { provider: decided.provider },
     ...frontDoor ? { frontdoor: { port: 0, connectPort: 0, trustBundlePath: "", sessionToken: "" } } : {},
     ...decided.flags.headroom ? { headroom: { socketPath: "", projectId: "" } } : {},
-    sessionId: ""
+    sessionId: "",
+    remoteControl: decided.flags.remoteControl
   });
   const credentialNames = decided.identityCredentialBlock === void 0 ? [] : Object.keys(credentialVariables(decided.identityCredentialBlock.target ?? "bearer", ""));
   const environment = [.../* @__PURE__ */ new Set([...Object.keys(built).filter((name) => built[name] !== env[name]), ...credentialNames])].sort();
@@ -8368,11 +8419,11 @@ function runLaunchPlan(plan, spawn3) {
 function runLauncher(params) {
   params.proc.exit(runLaunchPlan(prepareLaunch(params), params.spawn));
 }
-var import_node_crypto10, import_node_path38;
+var import_node_crypto11, import_node_path38;
 var init_launcher = __esm({
   "src/launcher.ts"() {
     "use strict";
-    import_node_crypto10 = require("node:crypto");
+    import_node_crypto11 = require("node:crypto");
     import_node_path38 = __toESM(require("node:path"), 1);
     init_package();
     init_envBool();
@@ -8456,18 +8507,18 @@ function resolveTrustBundle(params) {
   }
   const combined = `${inheritedPem.trimEnd()}
 ${caPem}`;
-  const bundle = import_node_path40.default.join(bundlesDir, `${(0, import_node_crypto11.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
+  const bundle = import_node_path40.default.join(bundlesDir, `${(0, import_node_crypto12.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
   if (!fs13.exists(bundle)) {
     fs13.mkdirp(bundlesDir);
     fs13.writeFileAtomic(bundle, combined);
   }
   return { path: bundle };
 }
-var import_node_crypto11, import_node_path40, BUNDLE_NAME_HEX_DIGITS;
+var import_node_crypto12, import_node_path40, BUNDLE_NAME_HEX_DIGITS;
 var init_trust = __esm({
   "src/frontdoor/trust.ts"() {
     "use strict";
-    import_node_crypto11 = require("node:crypto");
+    import_node_crypto12 = require("node:crypto");
     import_node_path40 = __toESM(require("node:path"), 1);
     BUNDLE_NAME_HEX_DIGITS = 16;
   }
@@ -8561,7 +8612,7 @@ function buildFarmRuntime(paths, cwd) {
         ...cliOverride === void 0 ? {} : { cliOverride }
       }).input,
       now: () => Date.now(),
-      uniqueSuffix: `${String(process.pid)}.${(0, import_node_crypto12.randomUUID)()}`,
+      uniqueSuffix: `${String(process.pid)}.${(0, import_node_crypto13.randomUUID)()}`,
       // Zombie-aware on purpose: a previous launcher that crashed out of a resync without releasing the lock may sit unreaped, still answering signal 0 as alive, and must read as a dead holder so this launch takes the lock over instead of timing out.
       lock: { pid: process.pid, isRunning: realIsProcessRunning, sleep: realSleepSync }
     },
@@ -8587,6 +8638,7 @@ function realPrepareLaunchParams(paths, options) {
     headroom: realHeadroomPort(paths, { spawnDaemon: options.spawnDaemon, cwd: farm.runtime.cwd }),
     frontdoor: realFrontDoorPort(paths, options.spawnDaemon),
     credentials: { ...realCredentialPort, cache: realCredentialCacheEnv(paths) },
+    hasStoredLogin: (identity) => identitySignIn(realFarmFs, { platform: process.platform, run: realRunPort }, { farmRoot: import_node_path41.default.join(paths.identitiesDir, identity), hasCredentialBlock: false }).state !== "signed-out",
     ...farm.directoryIdentity === void 0 ? {} : { directoryPinnedIdentity: farm.directoryIdentity },
     ...farm.directoryConfigProfile === void 0 ? {} : { directoryRuleConfigProfile: farm.directoryConfigProfile },
     ...farm.globalDefaultConfigProfile === void 0 ? {} : { globalDefaultConfigProfile: farm.globalDefaultConfigProfile },
@@ -8643,12 +8695,13 @@ function resolveClaudeLaunch(options) {
   };
   return { resolution: resolveLaunch(realPrepareLaunchParams(paths, { proc, log, spawnDaemon, farm: buildFarmRuntime(paths, options.cwd) })), warnings };
 }
-var import_node_os7, import_node_crypto12, LaunchRefusedError;
+var import_node_os7, import_node_path41, import_node_crypto13, LaunchRefusedError;
 var init_launchWiring = __esm({
   "src/launchWiring.ts"() {
     "use strict";
     import_node_os7 = __toESM(require("node:os"), 1);
-    import_node_crypto12 = require("node:crypto");
+    import_node_path41 = __toESM(require("node:path"), 1);
+    import_node_crypto13 = require("node:crypto");
     init_cliError();
     init_claudeShim();
     init_classify();
@@ -8660,6 +8713,7 @@ var init_launchWiring = __esm({
     init_launchHook();
     init_cascade();
     init_paths();
+    init_signIn();
     init_realPorts();
     LaunchRefusedError = class extends CliError {
       exitCode;
@@ -9951,8 +10005,8 @@ function parseConnectTarget(authority) {
 function isInterceptedHost(host, interceptHosts) {
   return interceptHosts.includes(host);
 }
-function servedByPipeline(path41) {
-  return path41?.startsWith(ROUTED_PATH_PREFIX) === true;
+function servedByPipeline(path42) {
+  return path42?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
   "connection",
@@ -10746,11 +10800,11 @@ function createRcSessionTracker(deps) {
   };
   const observeExchange = (request4) => {
     const method = (request4.method ?? "").toUpperCase();
-    const path41 = new URL(request4.url ?? "/", "http://127.0.0.1").pathname;
-    if (!path41.startsWith(RC_SESSIONS_PATH_PREFIX)) {
+    const path42 = new URL(request4.url ?? "/", "http://127.0.0.1").pathname;
+    if (!path42.startsWith(RC_SESSIONS_PATH_PREFIX)) {
       return void 0;
     }
-    const tail = path41.slice(RC_SESSIONS_PATH_PREFIX.length);
+    const tail = path42.slice(RC_SESSIONS_PATH_PREFIX.length);
     const facts = {
       oauthAuthorization: oauthAuthorizationOf(request4.headers),
       anthropicVersion: singleHeader(request4.headers, "anthropic-version"),
@@ -11140,8 +11194,8 @@ var RC_READ_FILE_ENCODINGS = ["utf-8", "base64"];
 function isRcReadFileEncoding(value) {
   return RC_READ_FILE_ENCODINGS.some((encoding) => encoding === value);
 }
-function buildRcReadFilePayload(requestId, path41, options) {
-  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path41, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
+function buildRcReadFilePayload(requestId, path42, options) {
+  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path42, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
 }
 function buildRcFileSuggestionsPayload(requestId, query) {
   return buildRcControlRequestPayload(requestId, { subtype: "file_suggestions", query });
@@ -11243,15 +11297,15 @@ async function getRcSessionContextUsage(deps, sessionId, detail) {
   const result = await deliverRcClientPayload(deps, sessionId, buildRcGetContextUsagePayload(requestId, detail), `request the context usage of session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
-async function readRcSessionFile(deps, sessionId, path41, options) {
-  if (path41 === "") {
+async function readRcSessionFile(deps, sessionId, path42, options) {
+  if (path42 === "") {
     return { ok: false, message: "a read-file write needs a non-empty path: the SDK's own field names the file the worker resolves against the session's cwd, and an empty string names none" };
   }
   if (options?.maxBytes !== void 0 && (!Number.isInteger(options.maxBytes) || options.maxBytes <= 0)) {
     return { ok: false, message: "a read-file write's max-bytes is a positive whole number of bytes: the SDK's own field caps the read, and a zero or negative cap reads nothing" };
   }
   const requestId = deps.newUuid();
-  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path41, options), `read ${path41} from session ${sessionId}`);
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path42, options), `read ${path42} from session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
 async function suggestRcSessionFiles(deps, sessionId, query) {
@@ -11420,11 +11474,11 @@ function createRcControlHandler(deps) {
       path: "read-file",
       read: (body) => {
         const session = bodyString(body, "session");
-        const path41 = bodyString(body, "path");
+        const path42 = bodyString(body, "path");
         const maxBytes = "maxBytes" in body ? bodyPositiveInteger(body, "maxBytes") : void 0;
         const encoding = "encoding" in body && isRcReadFileEncoding(body.encoding) ? body.encoding : void 0;
-        const refused2 = session === void 0 || path41 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
-        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path41, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
+        const refused2 = session === void 0 || path42 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
+        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path42, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
       }
     },
     {
@@ -11734,9 +11788,9 @@ function requestIdOfBody(body) {
 }
 function frontDoorRcControl(transport, token) {
   const headers = { authorization: `Bearer ${token}` };
-  const listAnswerOf = async (path41, what) => {
+  const listAnswerOf = async (path42, what) => {
     try {
-      return await transport.request({ method: "GET", path: path41, headers });
+      return await transport.request({ method: "GET", path: path42, headers });
     } catch (error) {
       throw new Error(`${what}: could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
     }
@@ -11808,10 +11862,10 @@ function frontDoorRcControl(transport, token) {
     }
     return pending;
   };
-  const writeOf = async (path41, body, describeFailure2) => {
+  const writeOf = async (path42, body, describeFailure2) => {
     let answer;
     try {
-      answer = await transport.request({ method: "POST", path: path41, headers: { ...headers, "content-type": "application/json" }, body });
+      answer = await transport.request({ method: "POST", path: path42, headers: { ...headers, "content-type": "application/json" }, body });
     } catch (error) {
       return { ok: false, message: `could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}` };
     }
@@ -11842,10 +11896,10 @@ function frontDoorRcControl(transport, token) {
     endSession: async (sessionId, reason) => await writeOf(`${CONTROL_PATH_PREFIX}/end-session`, JSON.stringify({ session: sessionId, ...reason === void 0 ? {} : { reason } }), (status, message) => `ending ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getUsage: async (sessionId, skipBehaviors) => await writeOf(`${CONTROL_PATH_PREFIX}/get-usage`, JSON.stringify({ session: sessionId, ...skipBehaviors === void 0 ? {} : { skipBehaviors } }), (status, message) => `requesting the usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getContextUsage: async (sessionId, detail) => await writeOf(`${CONTROL_PATH_PREFIX}/get-context-usage`, JSON.stringify({ session: sessionId, ...detail === void 0 ? {} : { detail } }), (status, message) => `requesting the context usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
-    readFile: async (sessionId, path41, options) => await writeOf(
+    readFile: async (sessionId, path42, options) => await writeOf(
       `${CONTROL_PATH_PREFIX}/read-file`,
-      JSON.stringify({ session: sessionId, path: path41, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
-      (status, message) => `reading ${path41} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
+      JSON.stringify({ session: sessionId, path: path42, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
+      (status, message) => `reading ${path42} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
     ),
     fileSuggestions: async (sessionId, query) => await writeOf(`${CONTROL_PATH_PREFIX}/file-suggestions`, JSON.stringify({ session: sessionId, query }), (status, message) => `requesting file suggestions from ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     keepAlive: async (sessionId) => await writeOf(`${CONTROL_PATH_PREFIX}/keep-alive`, JSON.stringify({ session: sessionId }), (status, message) => `keeping ${sessionId} alive failed (HTTP ${String(status)}): ${message}`),
@@ -12004,12 +12058,12 @@ function tlsFacts(options) {
 }
 function realRcEventDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const post = async (path41, headers, body) => await new Promise((resolve, reject) => {
+  const post = async (path42, headers, body) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method: "POST",
-      path: path41,
+      path: path42,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, "content-length": String(Buffer.byteLength(body, "utf8")) },
       agent
@@ -12074,12 +12128,12 @@ function lateRcStreamDial(resolve) {
 }
 function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const request4 = async (method, path41, headers, body, signal) => await new Promise((resolve, reject) => {
+  const request4 = async (method, path42, headers, body, signal) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method,
-      path: path41,
+      path: path42,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, ...body === void 0 ? {} : { "content-length": String(Buffer.byteLength(body, "utf8")) } },
       agent,
@@ -12121,9 +12175,9 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
       return { status, body: await readAll(response) };
     },
     openStream: async (sessionId, headers, resume, signal) => {
-      const path41 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
+      const path42 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
       const streamHeaders = resume === void 0 ? headers : { ...headers, "last-event-id": String(resume.fromSequenceNum) };
-      const { status, response } = await request4("GET", path41, streamHeaders, void 0, signal);
+      const { status, response } = await request4("GET", path42, streamHeaders, void 0, signal);
       if (!isSuccessful2(status)) {
         await readAll(response);
         return { status, chunks: NO_CHUNKS };
@@ -13275,19 +13329,19 @@ function writePools(paths, pools) {
   applyPatch(paths.globalConfigFile, GlobalConfigSchema, { pools }, { defaults: {} });
 }
 function poolCycleOf(pools, name) {
-  const walk = (current, path41) => {
+  const walk = (current, path42) => {
     for (const entry of pools[current]?.identities ?? []) {
       const nested = poolNameOf(poolMemberIdentity(entry));
       if (nested === void 0) {
         continue;
       }
       if (nested === name) {
-        return [...path41, nested];
+        return [...path42, nested];
       }
-      if (path41.includes(nested)) {
+      if (path42.includes(nested)) {
         continue;
       }
-      const found = walk(nested, [...path41, nested]);
+      const found = walk(nested, [...path42, nested]);
       if (found !== void 0) {
         return found;
       }
@@ -13409,8 +13463,9 @@ init_cascade();
 init_paths();
 init_realCredentialCache();
 init_providersStore();
+init_signIn();
 init_realPorts();
-var import_node_path26 = __toESM(require("node:path"), 1);
+var import_node_path27 = __toESM(require("node:path"), 1);
 var import_zod15 = require("zod");
 init_envBool();
 init_load();
@@ -13478,26 +13533,18 @@ function formatDecision(decision) {
   const eliminatedNote = decision.eliminated !== void 0 && decision.eliminated.length > 0 ? ` [${String(decision.eliminated.length)} more specific rule(s) eliminated by a failing when-condition]` : "";
   return `${decision.relPath}: ${status} \u2014 ${reason}${eliminatedNote}`;
 }
-function parseKeychainServiceName(stderr) {
-  const match = /"svce"<blob>="([^"]*)"/.exec(stderr);
-  return match?.[1];
-}
 function lookupKeychainService(run, farmRoot) {
-  const result = run.run("security", ["find-generic-password", "-a", farmRoot, "-g"]);
+  const serviceName = claudeCodeKeychainService(farmRoot);
+  const result = run.run("security", ["find-generic-password", "-s", serviceName]);
   if (result.status !== 0) {
     return {
       checked: true,
       found: false,
-      note: `No Keychain entry found for account "${farmRoot}" (security exited ${result.status === null ? "with no status" : String(result.status)}).`
+      serviceName,
+      note: `No Keychain entry found for service "${serviceName}" (security exited ${result.status === null ? "with no status" : String(result.status)}).`
     };
   }
-  const serviceName = parseKeychainServiceName(result.stderr);
-  return {
-    checked: true,
-    found: true,
-    ...serviceName === void 0 ? {} : { serviceName },
-    note: serviceName === void 0 ? `A Keychain entry was found for account "${farmRoot}" but its service name could not be parsed from security's output.` : `Keychain service name for this identity: "${serviceName}".`
-  };
+  return { checked: true, found: true, serviceName, note: `Keychain service name for this identity: "${serviceName}".` };
 }
 var SettingsSecretsShapeSchema = import_zod15.z.looseObject({
   env: import_zod15.z.record(import_zod15.z.string(), import_zod15.z.unknown()).optional(),
@@ -13759,10 +13806,10 @@ function collectCheckReport(params) {
   }).input;
   const providerName = cascadeProviderName(cascade);
   const provider = providerName === void 0 ? void 0 : loadCheckProvider(paths, providerName);
-  const farmRoot = identityDecision.name === void 0 ? void 0 : import_node_path26.default.join(paths.identitiesDir, identityDecision.name);
+  const farmRoot = identityDecision.name === void 0 ? void 0 : import_node_path27.default.join(paths.identitiesDir, identityDecision.name);
   const settingsFiles = {
-    "settings.json": realFsPort.readFileUtf8(import_node_path26.default.join(claudeHome, "settings.json")),
-    "settings.local.json": realFsPort.readFileUtf8(import_node_path26.default.join(claudeHome, "settings.local.json"))
+    "settings.json": realFsPort.readFileUtf8(import_node_path27.default.join(claudeHome, "settings.json")),
+    "settings.local.json": realFsPort.readFileUtf8(import_node_path27.default.join(claudeHome, "settings.local.json"))
   };
   const report = runCheck({
     cwd,
@@ -14063,7 +14110,7 @@ init_store();
 
 // src/identityStore.ts
 var import_node_fs8 = __toESM(require("node:fs"), 1);
-var import_node_path28 = __toESM(require("node:path"), 1);
+var import_node_path29 = __toESM(require("node:path"), 1);
 init_load();
 init_store();
 init_schema();
@@ -14097,7 +14144,7 @@ var InvalidIdentityNameError = class extends CliError {
   attemptedName;
 };
 function identityJsonPath(paths, name) {
-  return import_node_path28.default.join(paths.identitiesDir, name, "identity.json");
+  return import_node_path29.default.join(paths.identitiesDir, name, "identity.json");
 }
 function requireIdentityNames(paths, names) {
   const existing = new Set(listIdentities(paths).map((entry) => entry.name));
@@ -14212,7 +14259,7 @@ function setIdentityCredential(paths, identityName, change) {
   });
 }
 function belongsToIdentity(entry, name) {
-  return entry === name || entry === import_node_path28.default.basename(identityLockPath("", name)) || entry.startsWith(`.${name}.scratch.`) || entry.startsWith(`.${name}.previous.`);
+  return entry === name || entry === import_node_path29.default.basename(identityLockPath("", name)) || entry.startsWith(`.${name}.scratch.`) || entry.startsWith(`.${name}.previous.`);
 }
 function removeIdentity(paths, name) {
   if (!identityExists(paths, name)) {
@@ -14220,7 +14267,7 @@ function removeIdentity(paths, name) {
   }
   for (const entry of import_node_fs8.default.readdirSync(paths.identitiesDir)) {
     if (belongsToIdentity(entry, name)) {
-      import_node_fs8.default.rmSync(import_node_path28.default.join(paths.identitiesDir, entry), { recursive: true, force: true });
+      import_node_fs8.default.rmSync(import_node_path29.default.join(paths.identitiesDir, entry), { recursive: true, force: true });
     }
   }
   if (readActiveIdentity2(paths) === name) {
@@ -14232,28 +14279,7 @@ function removeIdentity(paths, name) {
 init_realPorts();
 var import_node_fs10 = __toESM(require("node:fs"), 1);
 var import_node_path30 = __toESM(require("node:path"), 1);
-
-// src/usage/signIn.ts
-var import_node_path29 = __toESM(require("node:path"), 1);
-var CREDENTIALS_FILE = ".credentials.json";
-function keychainHasItem(run, account) {
-  return run.run("security", ["find-generic-password", "-a", account]).status === 0;
-}
-function decideSignIn(facts) {
-  if (facts.hasCredentialBlock) {
-    return { state: "token", detail: "supplies its own credential through a credential block, so a stored login is not what a launch uses" };
-  }
-  if (facts.keychainItem === true) {
-    return { state: "signed-in", detail: "a login is stored in the macOS Keychain" };
-  }
-  if (facts.credentialsFile) {
-    return { state: "signed-in", detail: `a login is stored in ${CREDENTIALS_FILE}` };
-  }
-  return { state: "signed-out", detail: facts.platform === "darwin" ? `no Keychain item and no ${CREDENTIALS_FILE}` : `no ${CREDENTIALS_FILE}` };
-}
-function credentialsFilePath(farmRoot) {
-  return import_node_path29.default.join(farmRoot, CREDENTIALS_FILE);
-}
+init_signIn();
 
 // src/codex/siwcStore.ts
 var import_zod22 = require("zod");
@@ -15594,7 +15620,7 @@ function profileValue(name, paths) {
 function createConfigApiRouter(deps) {
   const authed = doorApiAuth(deps.expectedToken);
   const { paths } = deps;
-  const route = (path41, summary) => authed.meta((0, import_openapi3.openapi)({ method: "POST", path: path41, summary, tags: [CONFIG_API_TAG] }));
+  const route = (path42, summary) => authed.meta((0, import_openapi3.openapi)({ method: "POST", path: path42, summary, tags: [CONFIG_API_TAG] }));
   return {
     config: {
       identity: {