claude-use 11.22.0 → 11.23.0

package/dist/index.mjs

@@ -602,7 +602,7 @@ function parseIgnoringUnrecognisedKeys(schema, raw) {
   return second.success ? { success: true, data: second.data, ignored } : { success: false, issues: second.error.issues };
 }
 function describeIgnoredKeys(filePath, ignored) {
-  const places = ignored.map(({ path: path41, keys }) => `${path41.length === 0 ? "" : `${path41.map(String).join(".")}.`}${keys.join(", ")}`);
+  const places = ignored.map(({ path: path42, keys }) => `${path42.length === 0 ? "" : `${path42.map(String).join(".")}.`}${keys.join(", ")}`);
   return `${filePath} has settings this version of agent-shim does not know and ignores: ${places.join("; ")}. A newer release may read them.`;
 }
 function noteIgnoredKeys(filePath, ignored) {
@@ -624,9 +624,9 @@ function restoreIgnoredKeys(filePath, value) {
     return value;
   }
   const restored = structuredClone(value);
-  for (const { path: path41, values } of ignored) {
+  for (const { path: path42, values } of ignored) {
     let holder = restored;
-    for (const step of path41) {
+    for (const step of path42) {
       holder = isRecord(holder) ? holder[step] : void 0;
     }
     if (isRecord(holder)) {
@@ -2904,7 +2904,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "claude-use",
-      version: "11.22.0",
+      version: "11.23.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -6706,6 +6706,49 @@ var init_providersStore = __esm({
   }
 });
 
+// src/usage/signIn.ts
+import { createHash as createHash6 } from "node:crypto";
+import path26 from "node:path";
+function claudeCodeKeychainService(configDir) {
+  return `${KEYCHAIN_SERVICE_PREFIX}-${createHash6("sha256").update(configDir).digest("hex").slice(0, KEYCHAIN_SERVICE_HASH_DIGITS)}`;
+}
+function keychainHasItem(run, configDir) {
+  return run.run("security", ["find-generic-password", "-s", claudeCodeKeychainService(configDir)]).status === 0;
+}
+function decideSignIn(facts) {
+  if (facts.hasCredentialBlock) {
+    return { state: "token", detail: "supplies its own credential through a credential block, so a stored login is not what a launch uses" };
+  }
+  if (facts.keychainItem === true) {
+    return { state: "signed-in", detail: "a login is stored in the macOS Keychain" };
+  }
+  if (facts.credentialsFile) {
+    return { state: "signed-in", detail: `a login is stored in ${CREDENTIALS_FILE}` };
+  }
+  return { state: "signed-out", detail: facts.platform === "darwin" ? `no Keychain item and no ${CREDENTIALS_FILE}` : `no ${CREDENTIALS_FILE}` };
+}
+function credentialsFilePath(farmRoot) {
+  return path26.join(farmRoot, CREDENTIALS_FILE);
+}
+function identitySignIn(fs13, probe, identity) {
+  const probing = !identity.hasCredentialBlock;
+  return decideSignIn({
+    hasCredentialBlock: identity.hasCredentialBlock,
+    keychainItem: probing && probe.platform === "darwin" && probe.run !== void 0 ? keychainHasItem(probe.run, identity.farmRoot) : void 0,
+    credentialsFile: probing && fs13.lstat(credentialsFilePath(identity.farmRoot)) !== void 0,
+    platform: probe.platform
+  });
+}
+var CREDENTIALS_FILE, KEYCHAIN_SERVICE_PREFIX, KEYCHAIN_SERVICE_HASH_DIGITS;
+var init_signIn = __esm({
+  "src/usage/signIn.ts"() {
+    "use strict";
+    CREDENTIALS_FILE = ".credentials.json";
+    KEYCHAIN_SERVICE_PREFIX = "Claude Code-credentials";
+    KEYCHAIN_SERVICE_HASH_DIGITS = 8;
+  }
+});
+
 // src/cli/bool.ts
 function parseBoolWord(input) {
   switch (input) {
@@ -6855,17 +6898,17 @@ var init_commandDeps = __esm({
 
 // src/claudeShim.ts
 import fs8 from "node:fs";
-import path27 from "node:path";
+import path28 from "node:path";
 import { z as z19 } from "zod";
 function commandFilename(ownExecutablePath, commandName) {
   return ownExecutablePath.toLowerCase().endsWith(".exe") ? `${commandName}.exe` : commandName;
 }
 function resolveOwnBinaryCheck(paths, contentSourcePath) {
   const state = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-  const recordedTarget = state === void 0 ? void 0 : path27.resolve(state.targetPath);
+  const recordedTarget = state === void 0 ? void 0 : path28.resolve(state.targetPath);
   let ownStat;
   return (candidate) => {
-    if (recordedTarget !== void 0 && path27.resolve(candidate) === recordedTarget) {
+    if (recordedTarget !== void 0 && path28.resolve(candidate) === recordedTarget) {
       return true;
     }
     ownStat ??= statOrUndefined(contentSourcePath);
@@ -6888,15 +6931,15 @@ function statOrUndefined(target) {
   }
 }
 function findPathShadow(params) {
-  const resolvedTargetDir = path27.resolve(params.targetDir);
+  const resolvedTargetDir = path28.resolve(params.targetDir);
   for (const dir of params.pathDirs) {
     const found = params.findExecutableInDir(dir, params.targetFilename);
     if (found === void 0) {
       continue;
     }
-    return path27.resolve(dir) === resolvedTargetDir ? { status: "ok" } : { status: "shadowed", by: found };
+    return path28.resolve(dir) === resolvedTargetDir ? { status: "ok" } : { status: "shadowed", by: found };
   }
-  return params.pathDirs.some((dir) => path27.resolve(dir) === resolvedTargetDir) ? { status: "ok" } : { status: "not-on-path" };
+  return params.pathDirs.some((dir) => path28.resolve(dir) === resolvedTargetDir) ? { status: "ok" } : { status: "not-on-path" };
 }
 var ClaudeShimStateSchema, nodeLinkFs;
 var init_claudeShim = __esm({
@@ -7554,7 +7597,7 @@ function buildEnv(params) {
     }
   }
   if (params.provider !== void 0) {
-    env.ANTHROPIC_AUTH_TOKEN = void 0;
+    env.ANTHROPIC_AUTH_TOKEN = params.remoteControl ? void 0 : PROVIDER_SESSION_PLACEHOLDER;
     env.ANTHROPIC_API_KEY = void 0;
     env.CLAUDE_CODE_OAUTH_TOKEN = void 0;
   } else if (params.identityCredential !== void 0) {
@@ -7586,7 +7629,7 @@ function buildEnv(params) {
   }
   return env;
 }
-var LOOPBACK_HOSTS;
+var LOOPBACK_HOSTS, PROVIDER_SESSION_PLACEHOLDER;
 var init_flags = __esm({
   "src/launcher/flags.ts"() {
     "use strict";
@@ -7596,6 +7639,7 @@ var init_flags = __esm({
     init_capability();
     init_route();
     LOOPBACK_HOSTS = ["127.0.0.1", "localhost", "::1"];
+    PROVIDER_SESSION_PLACEHOLDER = "agent-shim-provider-session";
   }
 });
 
@@ -8154,7 +8198,7 @@ function decideLaunch(params, readOnly) {
   }
   const pinnedVersion = resolveClaudeVersion({ env, ...parsedArgv.claudeVersion === void 0 ? {} : { flag: parsedArgv.claudeVersion }, ...cascadeLaunch?.claudeVersion === void 0 ? {} : { cascade: cascadeLaunch.claudeVersion } });
   const discovered = params.resolveClaudeBinary(pinnedVersion === void 0 ? void 0 : { version: pinnedVersion.version });
-  const flags = resolveLaunchFlags({
+  const requestedFlags = resolveLaunchFlags({
     env,
     ...cascadeLaunch === void 0 ? {} : { cascade: cascadeLaunch },
     flags: {
@@ -8164,6 +8208,11 @@ function decideLaunch(params, readOnly) {
       ...parsedArgv.trackUsage === void 0 ? {} : { trackUsage: parsedArgv.trackUsage }
     }
   });
+  const loginlessProvider = requestedFlags.remoteControl && selectedProvider !== void 0 && farmIdentity !== void 0 && params.hasStoredLogin?.(farmIdentity) === false ? { identity: farmIdentity, provider: selectedProvider.name } : void 0;
+  if (loginlessProvider !== void 0 && !readOnly) {
+    log.info(`agent-shim: identity ${loginlessProvider.identity} has no stored login, so Remote Control, which needs one, is off for this launch; provider ${loginlessProvider.provider} runs without it`);
+  }
+  const flags = loginlessProvider === void 0 ? requestedFlags : { ...requestedFlags, remoteControl: false };
   const args = buildArgv({
     toolFlags: buildFlagArgs(flags),
     extraFlags: splitExtraFlags(env.CLAUDE_EXTRA_FLAGS),
@@ -8289,7 +8338,8 @@ function prepareLaunch(params) {
     ...identityCredential === void 0 ? {} : { identityCredential },
     ...frontDoor === void 0 ? {} : { frontdoor: frontDoor },
     ...headroom === void 0 ? {} : { headroom },
-    sessionId
+    sessionId,
+    remoteControl: resolvedFlags.remoteControl
   });
   const releases = [...headroom === void 0 || headroomPort === void 0 ? [] : [headroomPort.release], ...frontDoorRelease === void 0 ? [] : [frontDoorRelease]];
   const release = () => {
@@ -8311,7 +8361,8 @@ function resolveLaunch(params) {
     ...decided.provider === void 0 ? {} : { provider: decided.provider },
     ...frontDoor ? { frontdoor: { port: 0, connectPort: 0, trustBundlePath: "", sessionToken: "" } } : {},
     ...decided.flags.headroom ? { headroom: { socketPath: "", projectId: "" } } : {},
-    sessionId: ""
+    sessionId: "",
+    remoteControl: decided.flags.remoteControl
   });
   const credentialNames = decided.identityCredentialBlock === void 0 ? [] : Object.keys(credentialVariables(decided.identityCredentialBlock.target ?? "bearer", ""));
   const environment = [.../* @__PURE__ */ new Set([...Object.keys(built).filter((name) => built[name] !== env[name]), ...credentialNames])].sort();
@@ -8407,7 +8458,7 @@ var init_selfIdentity = __esm({
 });
 
 // src/frontdoor/trust.ts
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 import path40 from "node:path";
 function resolveTrustBundle(params) {
   const { caCertFile, bundlesDir, variable, inherited, fs: fs13 } = params;
@@ -8429,7 +8480,7 @@ function resolveTrustBundle(params) {
   }
   const combined = `${inheritedPem.trimEnd()}
 ${caPem}`;
-  const bundle = path40.join(bundlesDir, `${createHash6("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
+  const bundle = path40.join(bundlesDir, `${createHash7("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
   if (!fs13.exists(bundle)) {
     fs13.mkdirp(bundlesDir);
     fs13.writeFileAtomic(bundle, combined);
@@ -8507,6 +8558,7 @@ var init_realFrontDoorPort = __esm({
 
 // src/launchWiring.ts
 import os8 from "node:os";
+import path41 from "node:path";
 import { randomUUID as randomUUID5 } from "node:crypto";
 function buildFarmRuntime(paths, cwd) {
   const home = os8.homedir();
@@ -8560,6 +8612,7 @@ function realPrepareLaunchParams(paths, options) {
     headroom: realHeadroomPort(paths, { spawnDaemon: options.spawnDaemon, cwd: farm.runtime.cwd }),
     frontdoor: realFrontDoorPort(paths, options.spawnDaemon),
     credentials: { ...realCredentialPort, cache: realCredentialCacheEnv(paths) },
+    hasStoredLogin: (identity) => identitySignIn(realFarmFs, { platform: process.platform, run: realRunPort }, { farmRoot: path41.join(paths.identitiesDir, identity), hasCredentialBlock: false }).state !== "signed-out",
     ...farm.directoryIdentity === void 0 ? {} : { directoryPinnedIdentity: farm.directoryIdentity },
     ...farm.directoryConfigProfile === void 0 ? {} : { directoryRuleConfigProfile: farm.directoryConfigProfile },
     ...farm.globalDefaultConfigProfile === void 0 ? {} : { globalDefaultConfigProfile: farm.globalDefaultConfigProfile },
@@ -8631,6 +8684,7 @@ var init_launchWiring = __esm({
     init_launchHook();
     init_cascade();
     init_paths();
+    init_signIn();
     init_realPorts();
     LaunchRefusedError = class extends CliError {
       exitCode;
@@ -9538,8 +9592,8 @@ function parseConnectTarget(authority) {
 function isInterceptedHost(host, interceptHosts) {
   return interceptHosts.includes(host);
 }
-function servedByPipeline(path41) {
-  return path41?.startsWith(ROUTED_PATH_PREFIX) === true;
+function servedByPipeline(path42) {
+  return path42?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
   "connection",
@@ -10333,11 +10387,11 @@ function createRcSessionTracker(deps) {
   };
   const observeExchange = (request4) => {
     const method = (request4.method ?? "").toUpperCase();
-    const path41 = new URL(request4.url ?? "/", "http://127.0.0.1").pathname;
-    if (!path41.startsWith(RC_SESSIONS_PATH_PREFIX)) {
+    const path42 = new URL(request4.url ?? "/", "http://127.0.0.1").pathname;
+    if (!path42.startsWith(RC_SESSIONS_PATH_PREFIX)) {
       return void 0;
     }
-    const tail = path41.slice(RC_SESSIONS_PATH_PREFIX.length);
+    const tail = path42.slice(RC_SESSIONS_PATH_PREFIX.length);
     const facts = {
       oauthAuthorization: oauthAuthorizationOf(request4.headers),
       anthropicVersion: singleHeader(request4.headers, "anthropic-version"),
@@ -10727,8 +10781,8 @@ var RC_READ_FILE_ENCODINGS = ["utf-8", "base64"];
 function isRcReadFileEncoding(value) {
   return RC_READ_FILE_ENCODINGS.some((encoding) => encoding === value);
 }
-function buildRcReadFilePayload(requestId, path41, options) {
-  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path41, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
+function buildRcReadFilePayload(requestId, path42, options) {
+  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path42, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
 }
 function buildRcFileSuggestionsPayload(requestId, query) {
   return buildRcControlRequestPayload(requestId, { subtype: "file_suggestions", query });
@@ -10830,15 +10884,15 @@ async function getRcSessionContextUsage(deps, sessionId, detail) {
   const result = await deliverRcClientPayload(deps, sessionId, buildRcGetContextUsagePayload(requestId, detail), `request the context usage of session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
-async function readRcSessionFile(deps, sessionId, path41, options) {
-  if (path41 === "") {
+async function readRcSessionFile(deps, sessionId, path42, options) {
+  if (path42 === "") {
     return { ok: false, message: "a read-file write needs a non-empty path: the SDK's own field names the file the worker resolves against the session's cwd, and an empty string names none" };
   }
   if (options?.maxBytes !== void 0 && (!Number.isInteger(options.maxBytes) || options.maxBytes <= 0)) {
     return { ok: false, message: "a read-file write's max-bytes is a positive whole number of bytes: the SDK's own field caps the read, and a zero or negative cap reads nothing" };
   }
   const requestId = deps.newUuid();
-  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path41, options), `read ${path41} from session ${sessionId}`);
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path42, options), `read ${path42} from session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
 async function suggestRcSessionFiles(deps, sessionId, query) {
@@ -11007,11 +11061,11 @@ function createRcControlHandler(deps) {
       path: "read-file",
       read: (body) => {
         const session = bodyString(body, "session");
-        const path41 = bodyString(body, "path");
+        const path42 = bodyString(body, "path");
         const maxBytes = "maxBytes" in body ? bodyPositiveInteger(body, "maxBytes") : void 0;
         const encoding = "encoding" in body && isRcReadFileEncoding(body.encoding) ? body.encoding : void 0;
-        const refused2 = session === void 0 || path41 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
-        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path41, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
+        const refused2 = session === void 0 || path42 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
+        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path42, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
       }
     },
     {
@@ -11321,9 +11375,9 @@ function requestIdOfBody(body) {
 }
 function frontDoorRcControl(transport, token) {
   const headers = { authorization: `Bearer ${token}` };
-  const listAnswerOf = async (path41, what) => {
+  const listAnswerOf = async (path42, what) => {
     try {
-      return await transport.request({ method: "GET", path: path41, headers });
+      return await transport.request({ method: "GET", path: path42, headers });
     } catch (error) {
       throw new Error(`${what}: could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
     }
@@ -11395,10 +11449,10 @@ function frontDoorRcControl(transport, token) {
     }
     return pending;
   };
-  const writeOf = async (path41, body, describeFailure2) => {
+  const writeOf = async (path42, body, describeFailure2) => {
     let answer;
     try {
-      answer = await transport.request({ method: "POST", path: path41, headers: { ...headers, "content-type": "application/json" }, body });
+      answer = await transport.request({ method: "POST", path: path42, headers: { ...headers, "content-type": "application/json" }, body });
     } catch (error) {
       return { ok: false, message: `could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}` };
     }
@@ -11429,10 +11483,10 @@ function frontDoorRcControl(transport, token) {
     endSession: async (sessionId, reason) => await writeOf(`${CONTROL_PATH_PREFIX}/end-session`, JSON.stringify({ session: sessionId, ...reason === void 0 ? {} : { reason } }), (status, message) => `ending ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getUsage: async (sessionId, skipBehaviors) => await writeOf(`${CONTROL_PATH_PREFIX}/get-usage`, JSON.stringify({ session: sessionId, ...skipBehaviors === void 0 ? {} : { skipBehaviors } }), (status, message) => `requesting the usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getContextUsage: async (sessionId, detail) => await writeOf(`${CONTROL_PATH_PREFIX}/get-context-usage`, JSON.stringify({ session: sessionId, ...detail === void 0 ? {} : { detail } }), (status, message) => `requesting the context usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
-    readFile: async (sessionId, path41, options) => await writeOf(
+    readFile: async (sessionId, path42, options) => await writeOf(
       `${CONTROL_PATH_PREFIX}/read-file`,
-      JSON.stringify({ session: sessionId, path: path41, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
-      (status, message) => `reading ${path41} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
+      JSON.stringify({ session: sessionId, path: path42, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
+      (status, message) => `reading ${path42} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
     ),
     fileSuggestions: async (sessionId, query) => await writeOf(`${CONTROL_PATH_PREFIX}/file-suggestions`, JSON.stringify({ session: sessionId, query }), (status, message) => `requesting file suggestions from ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     keepAlive: async (sessionId) => await writeOf(`${CONTROL_PATH_PREFIX}/keep-alive`, JSON.stringify({ session: sessionId }), (status, message) => `keeping ${sessionId} alive failed (HTTP ${String(status)}): ${message}`),
@@ -11591,12 +11645,12 @@ function tlsFacts(options) {
 }
 function realRcEventDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const post = async (path41, headers, body) => await new Promise((resolve, reject) => {
+  const post = async (path42, headers, body) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method: "POST",
-      path: path41,
+      path: path42,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, "content-length": String(Buffer.byteLength(body, "utf8")) },
       agent
@@ -11661,12 +11715,12 @@ function lateRcStreamDial(resolve) {
 }
 function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const request4 = async (method, path41, headers, body, signal) => await new Promise((resolve, reject) => {
+  const request4 = async (method, path42, headers, body, signal) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method,
-      path: path41,
+      path: path42,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, ...body === void 0 ? {} : { "content-length": String(Buffer.byteLength(body, "utf8")) } },
       agent,
@@ -11708,9 +11762,9 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
       return { status, body: await readAll(response) };
     },
     openStream: async (sessionId, headers, resume, signal) => {
-      const path41 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
+      const path42 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
       const streamHeaders = resume === void 0 ? headers : { ...headers, "last-event-id": String(resume.fromSequenceNum) };
-      const { status, response } = await request4("GET", path41, streamHeaders, void 0, signal);
+      const { status, response } = await request4("GET", path42, streamHeaders, void 0, signal);
       if (!isSuccessful2(status)) {
         await readAll(response);
         return { status, chunks: NO_CHUNKS };
@@ -12862,19 +12916,19 @@ function writePools(paths, pools) {
   applyPatch(paths.globalConfigFile, GlobalConfigSchema, { pools }, { defaults: {} });
 }
 function poolCycleOf(pools, name) {
-  const walk = (current, path41) => {
+  const walk = (current, path42) => {
     for (const entry of pools[current]?.identities ?? []) {
       const nested = poolNameOf(poolMemberIdentity(entry));
       if (nested === void 0) {
         continue;
       }
       if (nested === name) {
-        return [...path41, nested];
+        return [...path42, nested];
       }
-      if (path41.includes(nested)) {
+      if (path42.includes(nested)) {
         continue;
       }
-      const found = walk(nested, [...path41, nested]);
+      const found = walk(nested, [...path42, nested]);
       if (found !== void 0) {
         return found;
       }
@@ -12996,6 +13050,7 @@ init_cascade();
 init_paths();
 init_realCredentialCache();
 init_providersStore();
+init_signIn();
 init_realPorts();
 init_envBool();
 init_load();
@@ -13008,7 +13063,7 @@ init_guard();
 init_providersStore();
 init_projects();
 init_pipeline();
-import path26 from "node:path";
+import path27 from "node:path";
 import { z as z15 } from "zod";
 var HISTORY_PROJECTS_KEY_PREFIX = "history/projects/";
 function projectFragmentOf(rawKey) {
@@ -13065,26 +13120,18 @@ function formatDecision(decision) {
   const eliminatedNote = decision.eliminated !== void 0 && decision.eliminated.length > 0 ? ` [${String(decision.eliminated.length)} more specific rule(s) eliminated by a failing when-condition]` : "";
   return `${decision.relPath}: ${status} \u2014 ${reason}${eliminatedNote}`;
 }
-function parseKeychainServiceName(stderr) {
-  const match = /"svce"<blob>="([^"]*)"/.exec(stderr);
-  return match?.[1];
-}
 function lookupKeychainService(run, farmRoot) {
-  const result = run.run("security", ["find-generic-password", "-a", farmRoot, "-g"]);
+  const serviceName = claudeCodeKeychainService(farmRoot);
+  const result = run.run("security", ["find-generic-password", "-s", serviceName]);
   if (result.status !== 0) {
     return {
       checked: true,
       found: false,
-      note: `No Keychain entry found for account "${farmRoot}" (security exited ${result.status === null ? "with no status" : String(result.status)}).`
+      serviceName,
+      note: `No Keychain entry found for service "${serviceName}" (security exited ${result.status === null ? "with no status" : String(result.status)}).`
     };
   }
-  const serviceName = parseKeychainServiceName(result.stderr);
-  return {
-    checked: true,
-    found: true,
-    ...serviceName === void 0 ? {} : { serviceName },
-    note: serviceName === void 0 ? `A Keychain entry was found for account "${farmRoot}" but its service name could not be parsed from security's output.` : `Keychain service name for this identity: "${serviceName}".`
-  };
+  return { checked: true, found: true, serviceName, note: `Keychain service name for this identity: "${serviceName}".` };
 }
 var SettingsSecretsShapeSchema = z15.looseObject({
   env: z15.record(z15.string(), z15.unknown()).optional(),
@@ -13346,10 +13393,10 @@ function collectCheckReport(params) {
   }).input;
   const providerName = cascadeProviderName(cascade);
   const provider = providerName === void 0 ? void 0 : loadCheckProvider(paths, providerName);
-  const farmRoot = identityDecision.name === void 0 ? void 0 : path26.join(paths.identitiesDir, identityDecision.name);
+  const farmRoot = identityDecision.name === void 0 ? void 0 : path27.join(paths.identitiesDir, identityDecision.name);
   const settingsFiles = {
-    "settings.json": realFsPort.readFileUtf8(path26.join(claudeHome, "settings.json")),
-    "settings.local.json": realFsPort.readFileUtf8(path26.join(claudeHome, "settings.local.json"))
+    "settings.json": realFsPort.readFileUtf8(path27.join(claudeHome, "settings.json")),
+    "settings.local.json": realFsPort.readFileUtf8(path27.join(claudeHome, "settings.local.json"))
   };
   const report = runCheck({
     cwd,
@@ -13655,7 +13702,7 @@ init_schema();
 init_cliError();
 init_identity();
 import fs9 from "node:fs";
-import path28 from "node:path";
+import path29 from "node:path";
 init_lock();
 var IdentityNotFoundError = class extends CliError {
   constructor(name) {
@@ -13684,7 +13731,7 @@ var InvalidIdentityNameError = class extends CliError {
   attemptedName;
 };
 function identityJsonPath(paths, name) {
-  return path28.join(paths.identitiesDir, name, "identity.json");
+  return path29.join(paths.identitiesDir, name, "identity.json");
 }
 function requireIdentityNames(paths, names) {
   const existing = new Set(listIdentities(paths).map((entry) => entry.name));
@@ -13799,7 +13846,7 @@ function setIdentityCredential(paths, identityName, change) {
   });
 }
 function belongsToIdentity(entry, name) {
-  return entry === name || entry === path28.basename(identityLockPath("", name)) || entry.startsWith(`.${name}.scratch.`) || entry.startsWith(`.${name}.previous.`);
+  return entry === name || entry === path29.basename(identityLockPath("", name)) || entry.startsWith(`.${name}.scratch.`) || entry.startsWith(`.${name}.previous.`);
 }
 function removeIdentity(paths, name) {
   if (!identityExists(paths, name)) {
@@ -13807,7 +13854,7 @@ function removeIdentity(paths, name) {
   }
   for (const entry of fs9.readdirSync(paths.identitiesDir)) {
     if (belongsToIdentity(entry, name)) {
-      fs9.rmSync(path28.join(paths.identitiesDir, entry), { recursive: true, force: true });
+      fs9.rmSync(path29.join(paths.identitiesDir, entry), { recursive: true, force: true });
     }
   }
   if (readActiveIdentity2(paths) === name) {
@@ -13819,28 +13866,7 @@ function removeIdentity(paths, name) {
 init_realPorts();
 import fs11 from "node:fs";
 import path30 from "node:path";
-
-// src/usage/signIn.ts
-import path29 from "node:path";
-var CREDENTIALS_FILE = ".credentials.json";
-function keychainHasItem(run, account) {
-  return run.run("security", ["find-generic-password", "-a", account]).status === 0;
-}
-function decideSignIn(facts) {
-  if (facts.hasCredentialBlock) {
-    return { state: "token", detail: "supplies its own credential through a credential block, so a stored login is not what a launch uses" };
-  }
-  if (facts.keychainItem === true) {
-    return { state: "signed-in", detail: "a login is stored in the macOS Keychain" };
-  }
-  if (facts.credentialsFile) {
-    return { state: "signed-in", detail: `a login is stored in ${CREDENTIALS_FILE}` };
-  }
-  return { state: "signed-out", detail: facts.platform === "darwin" ? `no Keychain item and no ${CREDENTIALS_FILE}` : `no ${CREDENTIALS_FILE}` };
-}
-function credentialsFilePath(farmRoot) {
-  return path29.join(farmRoot, CREDENTIALS_FILE);
-}
+init_signIn();
 
 // src/codex/siwcStore.ts
 import { z as z22 } from "zod";
@@ -15181,7 +15207,7 @@ function profileValue(name, paths) {
 function createConfigApiRouter(deps) {
   const authed = doorApiAuth(deps.expectedToken);
   const { paths } = deps;
-  const route = (path41, summary) => authed.meta(openapi3({ method: "POST", path: path41, summary, tags: [CONFIG_API_TAG] }));
+  const route = (path42, summary) => authed.meta(openapi3({ method: "POST", path: path42, summary, tags: [CONFIG_API_TAG] }));
   return {
     config: {
       identity: {

package/dist/types/index.d.ts

@@ -7218,6 +7218,8 @@ interface PrepareLaunchParams {
     readonly supervised?: SupervisedLaunch;
     /** Wires the launch-time update check behind `update.mode`. Omitted by a caller that cannot resolve releases, re-invoke this binary, or write to the terminal; a mode of `notify` or `auto` with no port wired simply checks nothing. */
     readonly update?: UpdateLaunchPort;
+    /** Whether an identity has a stored login Claude Code can use (a Keychain item or a credentials file). Absent when the caller cannot ask, in which case a launch assumes it does. */
+    readonly hasStoredLogin?: (identity: string) => boolean;
 }
 /** Inputs to `runLauncher`: a launch's inputs plus the port that spawns the child. */
 interface RunLauncherParams extends PrepareLaunchParams {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-use",
-  "version": "11.22.0",
+  "version": "11.23.0",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",