claude-use 11.22.0 → 11.24.0

package/dist/index.mjs

@@ -223,7 +223,7 @@ function isTimeZone(name) {
     return false;
   }
 }
-var CATEGORY_NAMES, OVERRIDABLE_CATEGORIES, CategoryMapSchema, DURATION_RE, DurationSchema, WhenConditionObjectSchema, WhenSchema, EntryValueSchema, ENTRY_KEY_RE, EntriesSchema, LaunchSchema, CREDENTIAL_TARGETS, PROVIDER_CREDENTIAL_TARGETS, CREDENTIAL_TARGET_VARS, ArgvSchema, CommandSourceOptions, EnvCredentialSourceSchema, FileCredentialSourceSchema, CommandCredentialSourceSchema, OpCredentialSourceSchema, KeychainCredentialSourceSchema, LiteralCredentialSourceSchema, CredentialSourceSchema, RemoteCredentialSourceSchema, CREDENTIAL_CACHE_STORES, CredentialCacheSchema, CredentialSchema, ProviderCredentialSchema, RESERVED_PROVIDER_ENV_KEYS, ProviderEnvSchema, PROVIDER_KINDS, ANTIGRAVITY_MODES, ANTIGRAVITY_EFFORTS, ANTIGRAVITY_DEFAULT_MODE, ANTIGRAVITY_DEFAULT_TIER_MODELS, AntigravityModelTargetSchema, AntigravityProviderConfigSchema, CODEX_EFFORTS, CODEX_LOGINS, CODEX_DEFAULT_TIER_MODELS, CodexProviderConfigSchema, ProviderRouteSchema, HttpProviderSchema, CodexProviderSchema, AntigravityProviderSchema, ProviderSchema, ConfigProfileSchema, POOL_SELECTOR_PREFIX, POOL_NAME_PATTERN, IDENTITY_NAME_PATTERN, PoolNameSchema, SELECTOR_RE, IdentitySelectorSchema, PoolMemberSchema, POOL_PREFERENCES, PoolPreferenceSchema, WHOLE_PERCENT_MAX, CompactAtUtilisationSchema, PoolSchema, WEEKDAYS, AnchorSchema, JOB_WINDOWS, JobTriggerSchema, JobTargetSchema, JobSchema, DirectoryRuleSchema, DirectoryRulesSchema, PortableConfigSchema, HEADROOM_MODES, HEADROOM_CCR_MODES, HEADROOM_ROLLOUT_CHANNELS, INTERCEPT_CHANNELS, READ_MATURATION_CHANNELS, HeadroomGlobalConfigObjectSchema, HeadroomGlobalConfigSchema, HEADROOM_DEFAULT_SOURCE, HEADROOM_DEFAULT_IDLE_SHUTDOWN_MINUTES, FrontDoorGlobalConfigSchema, UPDATE_MODES, UpdateGlobalConfigSchema, GlobalConfigSchema, IdentitySchema, CategoryClassificationSchema, CategoryClassificationOverlaySchema, SHIPPED_CATEGORY_DEFAULTS;
+var CATEGORY_NAMES, OVERRIDABLE_CATEGORIES, CategoryMapSchema, DURATION_RE, DurationSchema, WhenConditionObjectSchema, WhenSchema, EntryValueSchema, ENTRY_KEY_RE, EntriesSchema, LaunchSchema, CREDENTIAL_TARGETS, PROVIDER_CREDENTIAL_TARGETS, CREDENTIAL_TARGET_VARS, ArgvSchema, CommandSourceOptions, EnvCredentialSourceSchema, FileCredentialSourceSchema, CommandCredentialSourceSchema, OpCredentialSourceSchema, KeychainCredentialSourceSchema, LiteralCredentialSourceSchema, CredentialSourceSchema, RemoteCredentialSourceSchema, CREDENTIAL_CACHE_STORES, CredentialCacheSchema, CredentialSchema, ProviderCredentialSchema, RESERVED_PROVIDER_ENV_KEYS, ProviderEnvSchema, PROVIDER_KINDS, ANTIGRAVITY_MODES, ANTIGRAVITY_TIERS, ANTIGRAVITY_EFFORTS, ANTIGRAVITY_DEFAULT_MODE, ANTIGRAVITY_DEFAULT_MODEL, ANTIGRAVITY_DEFAULT_TIER_MODELS, ANTIGRAVITY_DEFAULT_EFFORT, AntigravityModelTargetSchema, AntigravityProviderConfigSchema, CODEX_TIERS, CODEX_EFFORTS, CODEX_LOGINS, CODEX_DEFAULT_LOGIN, CODEX_DEFAULT_MODEL, CODEX_DEFAULT_TIER_MODELS, CODEX_DEFAULT_EFFORT, CodexProviderConfigSchema, ProviderRouteSchema, HttpProviderSchema, CodexProviderSchema, AntigravityProviderSchema, ProviderSchema, ConfigProfileSchema, POOL_SELECTOR_PREFIX, POOL_NAME_PATTERN, IDENTITY_NAME_PATTERN, PoolNameSchema, SELECTOR_RE, IdentitySelectorSchema, PoolMemberSchema, POOL_PREFERENCES, PoolPreferenceSchema, WHOLE_PERCENT_MAX, CompactAtUtilisationSchema, PoolSchema, WEEKDAYS, AnchorSchema, JOB_WINDOWS, JobTriggerSchema, JobTargetSchema, JobSchema, DirectoryRuleSchema, DirectoryRulesSchema, PortableConfigSchema, HEADROOM_MODES, HEADROOM_CCR_MODES, HEADROOM_ROLLOUT_CHANNELS, INTERCEPT_CHANNELS, READ_MATURATION_CHANNELS, HeadroomGlobalConfigObjectSchema, HeadroomGlobalConfigSchema, HEADROOM_DEFAULT_SOURCE, HEADROOM_DEFAULT_IDLE_SHUTDOWN_MINUTES, FrontDoorGlobalConfigSchema, UPDATE_MODES, UpdateGlobalConfigSchema, GlobalConfigSchema, IdentitySchema, CategoryClassificationSchema, CategoryClassificationOverlaySchema, SHIPPED_CATEGORY_DEFAULTS;
 var init_schema = __esm({
   "src/config/schema.ts"() {
     "use strict";
@@ -321,14 +321,17 @@ var init_schema = __esm({
     });
     PROVIDER_KINDS = ["http", "codex", "antigravity"];
     ANTIGRAVITY_MODES = ["cloud", "local"];
+    ANTIGRAVITY_TIERS = ["fable", "opus", "sonnet", "haiku"];
     ANTIGRAVITY_EFFORTS = ["none", "low", "medium", "high", "xhigh", "max"];
     ANTIGRAVITY_DEFAULT_MODE = "cloud";
+    ANTIGRAVITY_DEFAULT_MODEL = "gemini-3.8-flash-high";
     ANTIGRAVITY_DEFAULT_TIER_MODELS = Object.freeze({
       fable: ["gemini-4-argon-high", "claude-opus-5-5-high", "gemini-3.8-flash-high"],
       opus: ["claude-opus-5-5-high", "gemini-4-argon-high", "gemini-3.8-flash-high"],
       sonnet: ["claude-sonnet-5-5-medium", "gemini-4-argon-medium", "gemini-3.8-flash-medium"],
       haiku: ["gemini-3.8-flash-low", "gemini-4-argon-low", "claude-sonnet-5-5-low"]
     });
+    ANTIGRAVITY_DEFAULT_EFFORT = "low";
     AntigravityModelTargetSchema = z.union([z.string().min(1), z.array(z.string().min(1)).min(1)]);
     AntigravityProviderConfigSchema = z.strictObject({
       /** Operational mode: direct cloud endpoint or local ACP daemon. Defaults to `cloud`. */
@@ -358,14 +361,18 @@ var init_schema = __esm({
         socketPath: z.string().min(1).optional()
       }).optional()
     });
+    CODEX_TIERS = ["fable", "opus", "sonnet", "haiku"];
     CODEX_EFFORTS = ["none", "low", "medium", "high"];
     CODEX_LOGINS = ["codex-cli", "chatgpt-sign-in"];
+    CODEX_DEFAULT_LOGIN = "codex-cli";
+    CODEX_DEFAULT_MODEL = "gpt-5.6-sol";
     CODEX_DEFAULT_TIER_MODELS = Object.freeze({
       fable: "gpt-5.6-sol",
       opus: "gpt-5.6-sol",
       sonnet: "gpt-5.6-terra",
       haiku: "gpt-5.6-luna"
     });
+    CODEX_DEFAULT_EFFORT = "low";
     CodexProviderConfigSchema = z.strictObject({
       /** The codex model a request maps to when no tier matches its model name. */
       defaultModel: z.string().min(1).optional(),
@@ -602,7 +609,7 @@ function parseIgnoringUnrecognisedKeys(schema, raw) {
   return second.success ? { success: true, data: second.data, ignored } : { success: false, issues: second.error.issues };
 }
 function describeIgnoredKeys(filePath, ignored) {
-  const places = ignored.map(({ path: path41, keys }) => `${path41.length === 0 ? "" : `${path41.map(String).join(".")}.`}${keys.join(", ")}`);
+  const places = ignored.map(({ path: path42, keys }) => `${path42.length === 0 ? "" : `${path42.map(String).join(".")}.`}${keys.join(", ")}`);
   return `${filePath} has settings this version of agent-shim does not know and ignores: ${places.join("; ")}. A newer release may read them.`;
 }
 function noteIgnoredKeys(filePath, ignored) {
@@ -624,9 +631,9 @@ function restoreIgnoredKeys(filePath, value) {
     return value;
   }
   const restored = structuredClone(value);
-  for (const { path: path41, values } of ignored) {
+  for (const { path: path42, values } of ignored) {
     let holder = restored;
-    for (const step of path41) {
+    for (const step of path42) {
       holder = isRecord(holder) ? holder[step] : void 0;
     }
     if (isRecord(holder)) {
@@ -2904,7 +2911,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "claude-use",
-      version: "11.22.0",
+      version: "11.24.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -6706,6 +6713,49 @@ var init_providersStore = __esm({
   }
 });
 
+// src/usage/signIn.ts
+import { createHash as createHash6 } from "node:crypto";
+import path26 from "node:path";
+function claudeCodeKeychainService(configDir) {
+  return `${KEYCHAIN_SERVICE_PREFIX}-${createHash6("sha256").update(configDir).digest("hex").slice(0, KEYCHAIN_SERVICE_HASH_DIGITS)}`;
+}
+function keychainHasItem(run, configDir) {
+  return run.run("security", ["find-generic-password", "-s", claudeCodeKeychainService(configDir)]).status === 0;
+}
+function decideSignIn(facts) {
+  if (facts.hasCredentialBlock) {
+    return { state: "token", detail: "supplies its own credential through a credential block, so a stored login is not what a launch uses" };
+  }
+  if (facts.keychainItem === true) {
+    return { state: "signed-in", detail: "a login is stored in the macOS Keychain" };
+  }
+  if (facts.credentialsFile) {
+    return { state: "signed-in", detail: `a login is stored in ${CREDENTIALS_FILE}` };
+  }
+  return { state: "signed-out", detail: facts.platform === "darwin" ? `no Keychain item and no ${CREDENTIALS_FILE}` : `no ${CREDENTIALS_FILE}` };
+}
+function credentialsFilePath(farmRoot) {
+  return path26.join(farmRoot, CREDENTIALS_FILE);
+}
+function identitySignIn(fs13, probe, identity) {
+  const probing = !identity.hasCredentialBlock;
+  return decideSignIn({
+    hasCredentialBlock: identity.hasCredentialBlock,
+    keychainItem: probing && probe.platform === "darwin" && probe.run !== void 0 ? keychainHasItem(probe.run, identity.farmRoot) : void 0,
+    credentialsFile: probing && fs13.lstat(credentialsFilePath(identity.farmRoot)) !== void 0,
+    platform: probe.platform
+  });
+}
+var CREDENTIALS_FILE, KEYCHAIN_SERVICE_PREFIX, KEYCHAIN_SERVICE_HASH_DIGITS;
+var init_signIn = __esm({
+  "src/usage/signIn.ts"() {
+    "use strict";
+    CREDENTIALS_FILE = ".credentials.json";
+    KEYCHAIN_SERVICE_PREFIX = "Claude Code-credentials";
+    KEYCHAIN_SERVICE_HASH_DIGITS = 8;
+  }
+});
+
 // src/cli/bool.ts
 function parseBoolWord(input) {
   switch (input) {
@@ -6855,17 +6905,17 @@ var init_commandDeps = __esm({
 
 // src/claudeShim.ts
 import fs8 from "node:fs";
-import path27 from "node:path";
+import path28 from "node:path";
 import { z as z19 } from "zod";
 function commandFilename(ownExecutablePath, commandName) {
   return ownExecutablePath.toLowerCase().endsWith(".exe") ? `${commandName}.exe` : commandName;
 }
 function resolveOwnBinaryCheck(paths, contentSourcePath) {
   const state = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-  const recordedTarget = state === void 0 ? void 0 : path27.resolve(state.targetPath);
+  const recordedTarget = state === void 0 ? void 0 : path28.resolve(state.targetPath);
   let ownStat;
   return (candidate) => {
-    if (recordedTarget !== void 0 && path27.resolve(candidate) === recordedTarget) {
+    if (recordedTarget !== void 0 && path28.resolve(candidate) === recordedTarget) {
       return true;
     }
     ownStat ??= statOrUndefined(contentSourcePath);
@@ -6888,15 +6938,15 @@ function statOrUndefined(target) {
   }
 }
 function findPathShadow(params) {
-  const resolvedTargetDir = path27.resolve(params.targetDir);
+  const resolvedTargetDir = path28.resolve(params.targetDir);
   for (const dir of params.pathDirs) {
     const found = params.findExecutableInDir(dir, params.targetFilename);
     if (found === void 0) {
       continue;
     }
-    return path27.resolve(dir) === resolvedTargetDir ? { status: "ok" } : { status: "shadowed", by: found };
+    return path28.resolve(dir) === resolvedTargetDir ? { status: "ok" } : { status: "shadowed", by: found };
   }
-  return params.pathDirs.some((dir) => path27.resolve(dir) === resolvedTargetDir) ? { status: "ok" } : { status: "not-on-path" };
+  return params.pathDirs.some((dir) => path28.resolve(dir) === resolvedTargetDir) ? { status: "ok" } : { status: "not-on-path" };
 }
 var ClaudeShimStateSchema, nodeLinkFs;
 var init_claudeShim = __esm({
@@ -7554,7 +7604,7 @@ function buildEnv(params) {
     }
   }
   if (params.provider !== void 0) {
-    env.ANTHROPIC_AUTH_TOKEN = void 0;
+    env.ANTHROPIC_AUTH_TOKEN = params.remoteControl ? void 0 : PROVIDER_SESSION_PLACEHOLDER;
     env.ANTHROPIC_API_KEY = void 0;
     env.CLAUDE_CODE_OAUTH_TOKEN = void 0;
   } else if (params.identityCredential !== void 0) {
@@ -7586,7 +7636,7 @@ function buildEnv(params) {
   }
   return env;
 }
-var LOOPBACK_HOSTS;
+var LOOPBACK_HOSTS, PROVIDER_SESSION_PLACEHOLDER;
 var init_flags = __esm({
   "src/launcher/flags.ts"() {
     "use strict";
@@ -7596,6 +7646,7 @@ var init_flags = __esm({
     init_capability();
     init_route();
     LOOPBACK_HOSTS = ["127.0.0.1", "localhost", "::1"];
+    PROVIDER_SESSION_PLACEHOLDER = "agent-shim-provider-session";
   }
 });
 
@@ -7724,13 +7775,43 @@ function withConversation(passthrough, conversation, id) {
   }
   return [...kept, conversation === "start" ? "--session-id" : "--resume", id, ...tail];
 }
+function hasSettingsArgument(passthrough) {
+  const end = passthrough.indexOf(TERMINATOR2);
+  return (end === -1 ? passthrough : passthrough.slice(0, end)).some((token) => token === "--settings" || token.startsWith("--settings="));
+}
 function withSupervision(passthrough, supervised) {
-  const conversation = supervised.conversation === "as-given" ? passthrough : withConversation(passthrough, supervised.conversation, supervised.sessionId);
-  if (supervised.settings === void 0) {
-    return conversation;
+  return supervised.conversation === "as-given" ? passthrough : withConversation(passthrough, supervised.conversation, supervised.sessionId);
+}
+function withLauncherSettings(passthrough, settings) {
+  if (settings === void 0) {
+    return passthrough;
+  }
+  const end = passthrough.indexOf(TERMINATOR2);
+  return end === -1 ? [...passthrough, "--settings", settings] : [...passthrough.slice(0, end), "--settings", settings, ...passthrough.slice(end)];
+}
+function isRecord15(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function mergeSettings(parts) {
+  const merged = {};
+  let any = false;
+  for (const part of parts) {
+    if (part === void 0) {
+      continue;
+    }
+    const parsed = JSON.parse(part);
+    if (!isRecord15(parsed)) {
+      throw new Error("a launch's settings part is not a JSON object");
+    }
+    for (const [key, value] of Object.entries(parsed)) {
+      if (key in merged) {
+        throw new Error(`two launch settings parts both set "${key}"`);
+      }
+      merged[key] = value;
+    }
+    any = true;
   }
-  const end = conversation.indexOf(TERMINATOR2);
-  return end === -1 ? [...conversation, "--settings", supervised.settings] : [...conversation.slice(0, end), "--settings", supervised.settings, ...conversation.slice(end)];
+  return any ? JSON.stringify(merged) : void 0;
 }
 var TERMINATOR2, VALUED_CONVERSATION_FLAGS, CONTINUE_FLAGS;
 var init_claudeSession = __esm({
@@ -7743,6 +7824,253 @@ var init_claudeSession = __esm({
   }
 });
 
+// src/antigravity/cloudUpstream.ts
+var init_cloudUpstream = __esm({
+  "src/antigravity/cloudUpstream.ts"() {
+    "use strict";
+  }
+});
+
+// src/antigravity/quota.ts
+var SECONDS_PER_HOUR, HOURS_PER_FIVE_HOUR_WINDOW, DAYS_PER_WEEK, HOURS_PER_DAY4, FIVE_HOUR_PERIOD_SECONDS, WEEK_PERIOD_SECONDS;
+var init_quota = __esm({
+  "src/antigravity/quota.ts"() {
+    "use strict";
+    init_cloudUpstream();
+    SECONDS_PER_HOUR = 3600;
+    HOURS_PER_FIVE_HOUR_WINDOW = 5;
+    DAYS_PER_WEEK = 7;
+    HOURS_PER_DAY4 = 24;
+    FIVE_HOUR_PERIOD_SECONDS = HOURS_PER_FIVE_HOUR_WINDOW * SECONDS_PER_HOUR;
+    WEEK_PERIOD_SECONDS = DAYS_PER_WEEK * HOURS_PER_DAY4 * SECONDS_PER_HOUR;
+  }
+});
+
+// src/antigravity/signatures.ts
+var init_signatures = __esm({
+  "src/antigravity/signatures.ts"() {
+    "use strict";
+  }
+});
+
+// src/codex/anthropic.ts
+import { z as z29 } from "zod";
+var TextBlockSchema, Base64ImageSourceSchema, UrlImageSourceSchema, ImageBlockSchema, ToolUseBlockSchema, ToolResultContentBlockSchema, ToolResultBlockSchema, OtherBlockSchema, ContentBlockSchema, MessageSchema, ToolSchema, ToolChoiceSchema, SystemSchema, MessagesRequestSchema, CountTokensRequestSchema;
+var init_anthropic = __esm({
+  "src/codex/anthropic.ts"() {
+    "use strict";
+    TextBlockSchema = z29.looseObject({ type: z29.literal("text"), text: z29.string() });
+    Base64ImageSourceSchema = z29.looseObject({ type: z29.literal("base64"), media_type: z29.string().min(1), data: z29.string() });
+    UrlImageSourceSchema = z29.looseObject({ type: z29.literal("url"), url: z29.string().min(1) });
+    ImageBlockSchema = z29.looseObject({
+      type: z29.literal("image"),
+      source: z29.union([Base64ImageSourceSchema, UrlImageSourceSchema])
+    });
+    ToolUseBlockSchema = z29.looseObject({
+      type: z29.literal("tool_use"),
+      id: z29.string().min(1),
+      name: z29.string().min(1),
+      input: z29.unknown()
+    });
+    ToolResultContentBlockSchema = z29.union([TextBlockSchema, z29.looseObject({ type: z29.string() })]);
+    ToolResultBlockSchema = z29.looseObject({
+      type: z29.literal("tool_result"),
+      tool_use_id: z29.string().min(1),
+      content: z29.union([z29.string(), z29.array(ToolResultContentBlockSchema)]).optional()
+    });
+    OtherBlockSchema = z29.looseObject({ type: z29.string() });
+    ContentBlockSchema = z29.union([TextBlockSchema, ImageBlockSchema, ToolUseBlockSchema, ToolResultBlockSchema, OtherBlockSchema]);
+    MessageSchema = z29.looseObject({
+      role: z29.enum(["user", "assistant", "system"]),
+      content: z29.union([z29.string(), z29.array(ContentBlockSchema)])
+    });
+    ToolSchema = z29.looseObject({
+      name: z29.string().min(1),
+      description: z29.string().optional(),
+      input_schema: z29.record(z29.string(), z29.unknown()).optional()
+    });
+    ToolChoiceSchema = z29.union([
+      z29.looseObject({ type: z29.enum(["auto", "none", "any"]) }),
+      z29.looseObject({ type: z29.literal("tool"), name: z29.string().min(1) })
+    ]);
+    SystemSchema = z29.union([z29.string(), z29.array(z29.union([TextBlockSchema, OtherBlockSchema]))]);
+    MessagesRequestSchema = z29.looseObject({
+      model: z29.string().optional(),
+      system: SystemSchema.optional(),
+      messages: z29.array(MessageSchema),
+      tools: z29.array(ToolSchema).optional(),
+      tool_choice: ToolChoiceSchema.optional(),
+      stream: z29.boolean().optional(),
+      /** `user_id` is stable for one Claude Code session and differs between sessions, which is what makes it the right key for both the backend's prompt cache and its session header. */
+      metadata: z29.looseObject({ user_id: z29.string().optional() }).optional(),
+      /** Claude Code's effort setting. Any string is accepted; the translator honours only the levels the backend understands. */
+      output_config: z29.looseObject({ effort: z29.string().optional() }).optional()
+    });
+    CountTokensRequestSchema = z29.looseObject({
+      system: z29.unknown().optional(),
+      messages: z29.unknown().optional(),
+      tools: z29.unknown().optional()
+    });
+  }
+});
+
+// src/antigravity/translate.ts
+function candidatesOf(target) {
+  return typeof target === "string" ? [target] : target;
+}
+function isAntigravityTier(key) {
+  return ANTIGRAVITY_TIERS.some((tier) => tier === key);
+}
+function resolveAntigravityConfig(config) {
+  const overrides = config?.models ?? {};
+  const aliases = /* @__PURE__ */ new Map();
+  for (const [key, target] of Object.entries(overrides)) {
+    if (!isAntigravityTier(key)) {
+      aliases.set(key.toLowerCase(), candidatesOf(target));
+    }
+  }
+  const tierModel = (tier) => {
+    const target = overrides[tier];
+    return target === void 0 ? ANTIGRAVITY_DEFAULT_TIER_MODELS[tier] : candidatesOf(target);
+  };
+  return {
+    mode: config?.mode ?? ANTIGRAVITY_DEFAULT_MODE,
+    defaultModel: config?.defaultModel ?? ANTIGRAVITY_DEFAULT_MODEL,
+    models: { fable: tierModel("fable"), opus: tierModel("opus"), sonnet: tierModel("sonnet"), haiku: tierModel("haiku") },
+    aliases,
+    degradeDownTiers: config?.degradeDownTiers ?? false,
+    effort: config?.effort ?? ANTIGRAVITY_DEFAULT_EFFORT,
+    cloud: {
+      endpoint: config?.cloud?.endpoint,
+      projectId: config?.cloud?.projectId,
+      location: config?.cloud?.location
+    },
+    local: {
+      command: config?.local?.command,
+      socketPath: config?.local?.socketPath
+    }
+  };
+}
+var init_translate = __esm({
+  "src/antigravity/translate.ts"() {
+    "use strict";
+    init_quota();
+    init_signatures();
+    init_schema();
+    init_anthropic();
+  }
+});
+
+// src/codex/translate.ts
+function resolveCodexConfig(config) {
+  const overrides = config?.models;
+  return {
+    defaultModel: config?.defaultModel ?? CODEX_DEFAULT_MODEL,
+    models: {
+      fable: overrides?.fable ?? CODEX_DEFAULT_TIER_MODELS.fable,
+      opus: overrides?.opus ?? CODEX_DEFAULT_TIER_MODELS.opus,
+      sonnet: overrides?.sonnet ?? CODEX_DEFAULT_TIER_MODELS.sonnet,
+      haiku: overrides?.haiku ?? CODEX_DEFAULT_TIER_MODELS.haiku
+    },
+    effort: config?.effort ?? CODEX_DEFAULT_EFFORT,
+    login: config?.login ?? CODEX_DEFAULT_LOGIN
+  };
+}
+var init_translate2 = __esm({
+  "src/codex/translate.ts"() {
+    "use strict";
+    init_schema();
+    init_anthropic();
+  }
+});
+
+// src/launcher/modelPicker.ts
+function joined(parts) {
+  const last = parts[parts.length - 1];
+  return last === void 0 || parts.length === 1 ? last ?? "" : `${parts.slice(0, -1).join(", ")} and ${last}`;
+}
+function rowOf2(model, reaches) {
+  const lead = reaches.find((reach) => reach.standing === "first") ?? reaches[0];
+  if (lead === void 0) {
+    throw new Error(`model ${model} is reached by no tier`);
+  }
+  const firsts = reaches.filter((reach) => reach.standing === "first").map((reach) => reach.tier);
+  const fallbacks = reaches.filter((reach) => reach.standing === "fallback").map((reach) => reach.tier);
+  const serves = firsts.length === 0 ? [] : [`Serves the ${joined(firsts)} tier${firsts.length === 1 ? "" : "s"}`];
+  const falls = fallbacks.length === 0 ? [] : [`${serves.length === 0 ? "Fallback" : "fallback"} for ${joined(fallbacks)}`];
+  return { model, label: model, description: [...serves, ...falls].join("; "), behavesAs: TIER_BEHAVES_AS[lead.tier] };
+}
+function rowsOfTable(table) {
+  const reachesByModel = /* @__PURE__ */ new Map();
+  for (const [tier, candidates] of table) {
+    candidates.forEach((model, index) => {
+      const reaches = reachesByModel.get(model) ?? [];
+      if (!reaches.some((reach) => reach.tier === tier)) {
+        reaches.push({ tier, standing: index === 0 ? "first" : "fallback" });
+      }
+      reachesByModel.set(model, reaches);
+    });
+  }
+  return [...reachesByModel].map(([model, reaches]) => rowOf2(model, reaches));
+}
+function antigravityRows(provider) {
+  const config = resolveAntigravityConfig(provider.antigravity);
+  const tiers = rowsOfTable(ANTIGRAVITY_TIERS.map((tier) => [tier, config.models[tier]]));
+  const behavesAsOf = new Map(tiers.map((row) => [row.model, row.behavesAs]));
+  const aliases = [...config.aliases].flatMap(([alias, candidates]) => {
+    const [first] = candidates;
+    const behavesAs = first === void 0 ? void 0 : behavesAsOf.get(first);
+    return behavesAs === void 0 ? [] : [{ model: alias, label: alias, description: `Alias for ${candidates.join(", then ")}`, behavesAs }];
+  });
+  return [...tiers, ...aliases];
+}
+function codexRows(provider) {
+  const config = resolveCodexConfig(provider.codex);
+  return rowsOfTable(CODEX_TIERS.map((tier) => [tier, [config.models[tier]]]));
+}
+function httpRows(provider) {
+  const env = provider.env ?? {};
+  const table = CODEX_TIERS.flatMap((tier) => {
+    const model = env[TIER_ENV_VARIABLES[tier]];
+    return model === void 0 || model === "" ? [] : [[tier, [model]]];
+  });
+  return rowsOfTable(table);
+}
+function providerModelRows(provider) {
+  if (provider.kind === "codex") {
+    return codexRows(provider);
+  }
+  if (provider.kind === "antigravity") {
+    return antigravityRows(provider);
+  }
+  return httpRows(provider);
+}
+function modelPickerSettings(provider) {
+  const options = providerModelRows(provider);
+  return options.length === 0 ? void 0 : JSON.stringify({ modelPicker: { options, replaceBuiltInOptions: true } });
+}
+var TIER_BEHAVES_AS, TIER_ENV_VARIABLES;
+var init_modelPicker = __esm({
+  "src/launcher/modelPicker.ts"() {
+    "use strict";
+    init_translate();
+    init_translate2();
+    init_schema();
+    TIER_BEHAVES_AS = Object.freeze({
+      fable: "claude-fable-5-1",
+      opus: "claude-opus-5-5",
+      sonnet: "claude-sonnet-5-5",
+      haiku: "claude-haiku-5-5"
+    });
+    TIER_ENV_VARIABLES = Object.freeze({
+      fable: "ANTHROPIC_DEFAULT_FABLE_MODEL",
+      opus: "ANTHROPIC_DEFAULT_OPUS_MODEL",
+      sonnet: "ANTHROPIC_DEFAULT_SONNET_MODEL",
+      haiku: "ANTHROPIC_DEFAULT_HAIKU_MODEL"
+    });
+  }
+});
+
 // src/launcher/pool.ts
 function isResuming(passthrough) {
   const end = passthrough.indexOf(TERMINATOR3);
@@ -8154,7 +8482,7 @@ function decideLaunch(params, readOnly) {
   }
   const pinnedVersion = resolveClaudeVersion({ env, ...parsedArgv.claudeVersion === void 0 ? {} : { flag: parsedArgv.claudeVersion }, ...cascadeLaunch?.claudeVersion === void 0 ? {} : { cascade: cascadeLaunch.claudeVersion } });
   const discovered = params.resolveClaudeBinary(pinnedVersion === void 0 ? void 0 : { version: pinnedVersion.version });
-  const flags = resolveLaunchFlags({
+  const requestedFlags = resolveLaunchFlags({
     env,
     ...cascadeLaunch === void 0 ? {} : { cascade: cascadeLaunch },
     flags: {
@@ -8164,10 +8492,21 @@ function decideLaunch(params, readOnly) {
       ...parsedArgv.trackUsage === void 0 ? {} : { trackUsage: parsedArgv.trackUsage }
     }
   });
+  const loginlessProvider = requestedFlags.remoteControl && selectedProvider !== void 0 && farmIdentity !== void 0 && params.hasStoredLogin?.(farmIdentity) === false ? { identity: farmIdentity, provider: selectedProvider.name } : void 0;
+  if (loginlessProvider !== void 0 && !readOnly) {
+    log.info(`agent-shim: identity ${loginlessProvider.identity} has no stored login, so Remote Control, which needs one, is off for this launch; provider ${loginlessProvider.provider} runs without it`);
+  }
+  const flags = loginlessProvider === void 0 ? requestedFlags : { ...requestedFlags, remoteControl: false };
+  const pickerSettings = selectedProvider === void 0 ? void 0 : modelPickerSettings(selectedProvider.definition);
+  const callerSettings = hasSettingsArgument(parsedArgv.rest);
+  if (pickerSettings !== void 0 && callerSettings && !readOnly) {
+    log.info("agent-shim: this launch passes its own --settings, so /model keeps Claude Code's own model names instead of listing the provider's models");
+  }
+  const launcherSettings = mergeSettings([params.supervised?.settings, callerSettings ? void 0 : pickerSettings]);
   const args = buildArgv({
     toolFlags: buildFlagArgs(flags),
     extraFlags: splitExtraFlags(env.CLAUDE_EXTRA_FLAGS),
-    passthrough: params.supervised === void 0 ? parsedArgv.rest : withSupervision(parsedArgv.rest, params.supervised)
+    passthrough: withLauncherSettings(params.supervised === void 0 ? parsedArgv.rest : withSupervision(parsedArgv.rest, params.supervised), launcherSettings)
   });
   const configDir = configDirEscapeHatchApplies || identityDecision.name === void 0 ? env.CLAUDE_CONFIG_DIR : path38.join(paths.identitiesDir, identityDecision.name);
   const decision = {
@@ -8289,7 +8628,8 @@ function prepareLaunch(params) {
     ...identityCredential === void 0 ? {} : { identityCredential },
     ...frontDoor === void 0 ? {} : { frontdoor: frontDoor },
     ...headroom === void 0 ? {} : { headroom },
-    sessionId
+    sessionId,
+    remoteControl: resolvedFlags.remoteControl
   });
   const releases = [...headroom === void 0 || headroomPort === void 0 ? [] : [headroomPort.release], ...frontDoorRelease === void 0 ? [] : [frontDoorRelease]];
   const release = () => {
@@ -8311,7 +8651,8 @@ function resolveLaunch(params) {
     ...decided.provider === void 0 ? {} : { provider: decided.provider },
     ...frontDoor ? { frontdoor: { port: 0, connectPort: 0, trustBundlePath: "", sessionToken: "" } } : {},
     ...decided.flags.headroom ? { headroom: { socketPath: "", projectId: "" } } : {},
-    sessionId: ""
+    sessionId: "",
+    remoteControl: decided.flags.remoteControl
   });
   const credentialNames = decided.identityCredentialBlock === void 0 ? [] : Object.keys(credentialVariables(decided.identityCredentialBlock.target ?? "bearer", ""));
   const environment = [.../* @__PURE__ */ new Set([...Object.keys(built).filter((name) => built[name] !== env[name]), ...credentialNames])].sort();
@@ -8355,6 +8696,7 @@ var init_launcher = __esm({
     init_flags();
     init_extraFlags();
     init_claudeSession();
+    init_modelPicker();
     init_pool();
     init_resumeContext();
     init_lock();
@@ -8407,7 +8749,7 @@ var init_selfIdentity = __esm({
 });
 
 // src/frontdoor/trust.ts
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 import path40 from "node:path";
 function resolveTrustBundle(params) {
   const { caCertFile, bundlesDir, variable, inherited, fs: fs13 } = params;
@@ -8429,7 +8771,7 @@ function resolveTrustBundle(params) {
   }
   const combined = `${inheritedPem.trimEnd()}
 ${caPem}`;
-  const bundle = path40.join(bundlesDir, `${createHash6("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
+  const bundle = path40.join(bundlesDir, `${createHash7("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
   if (!fs13.exists(bundle)) {
     fs13.mkdirp(bundlesDir);
     fs13.writeFileAtomic(bundle, combined);
@@ -8507,6 +8849,7 @@ var init_realFrontDoorPort = __esm({
 
 // src/launchWiring.ts
 import os8 from "node:os";
+import path41 from "node:path";
 import { randomUUID as randomUUID5 } from "node:crypto";
 function buildFarmRuntime(paths, cwd) {
   const home = os8.homedir();
@@ -8560,6 +8903,7 @@ function realPrepareLaunchParams(paths, options) {
     headroom: realHeadroomPort(paths, { spawnDaemon: options.spawnDaemon, cwd: farm.runtime.cwd }),
     frontdoor: realFrontDoorPort(paths, options.spawnDaemon),
     credentials: { ...realCredentialPort, cache: realCredentialCacheEnv(paths) },
+    hasStoredLogin: (identity) => identitySignIn(realFarmFs, { platform: process.platform, run: realRunPort }, { farmRoot: path41.join(paths.identitiesDir, identity), hasCredentialBlock: false }).state !== "signed-out",
     ...farm.directoryIdentity === void 0 ? {} : { directoryPinnedIdentity: farm.directoryIdentity },
     ...farm.directoryConfigProfile === void 0 ? {} : { directoryRuleConfigProfile: farm.directoryConfigProfile },
     ...farm.globalDefaultConfigProfile === void 0 ? {} : { globalDefaultConfigProfile: farm.globalDefaultConfigProfile },
@@ -8631,6 +8975,7 @@ var init_launchWiring = __esm({
     init_launchHook();
     init_cascade();
     init_paths();
+    init_signIn();
     init_realPorts();
     LaunchRefusedError = class extends CliError {
       exitCode;
@@ -8832,84 +9177,77 @@ var init_identityClaude = __esm({
   }
 });
 
-// src/antigravity/cloudUpstream.ts
-var init_cloudUpstream = __esm({
-  "src/antigravity/cloudUpstream.ts"() {
-    "use strict";
-  }
-});
-
 // src/usage/providerQuota.ts
-import { z as z29 } from "zod";
-var MS_PER_SECOND7, SECONDS_PER_HOUR, HOURS_PER_DAY4, DAYS_PER_MONTH, ZAI_HOST, ZAI_QUOTA_URL, ZAI_UNIT_HOURS, ZAI_UNIT_MONTHS, ZAI_UNIT_MS, ZaiLimitSchema, ZaiResponseSchema, OPENROUTER_HOST, OPENROUTER_KEY_URL, OPENROUTER_CREDITS_URL, MS_PER_DAY3, OpenRouterKeySchema, OpenRouterCreditsSchema, ANTIGRAVITY_HOST, ANTIGRAVITY_QUOTA_URL, ANTIGRAVITY_USER_URL, FIVE_HOURS2, DAYS_PER_WEEK, FIVE_HOURS_MS, WEEK_MS, AntigravityBucketSchema, AntigravitySummarySchema, GoogleTokenInfoSchema, AntigravityUserSchema;
+import { z as z30 } from "zod";
+var MS_PER_SECOND7, SECONDS_PER_HOUR2, HOURS_PER_DAY5, DAYS_PER_MONTH, ZAI_HOST, ZAI_QUOTA_URL, ZAI_UNIT_HOURS, ZAI_UNIT_MONTHS, ZAI_UNIT_MS, ZaiLimitSchema, ZaiResponseSchema, OPENROUTER_HOST, OPENROUTER_KEY_URL, OPENROUTER_CREDITS_URL, MS_PER_DAY3, OpenRouterKeySchema, OpenRouterCreditsSchema, ANTIGRAVITY_HOST, ANTIGRAVITY_QUOTA_URL, ANTIGRAVITY_USER_URL, FIVE_HOURS2, DAYS_PER_WEEK2, FIVE_HOURS_MS, WEEK_MS, AntigravityBucketSchema, AntigravitySummarySchema, GoogleTokenInfoSchema, AntigravityUserSchema;
 var init_providerQuota = __esm({
   "src/usage/providerQuota.ts"() {
     "use strict";
     init_cloudUpstream();
     init_schema2();
     MS_PER_SECOND7 = 1e3;
-    SECONDS_PER_HOUR = 3600;
-    HOURS_PER_DAY4 = 24;
+    SECONDS_PER_HOUR2 = 3600;
+    HOURS_PER_DAY5 = 24;
     DAYS_PER_MONTH = 30;
     ZAI_HOST = "api.z.ai";
     ZAI_QUOTA_URL = `https://${ZAI_HOST}/api/monitor/usage/quota/limit`;
     ZAI_UNIT_HOURS = 3;
     ZAI_UNIT_MONTHS = 5;
     ZAI_UNIT_MS = /* @__PURE__ */ new Map([
-      [ZAI_UNIT_HOURS, SECONDS_PER_HOUR * MS_PER_SECOND7],
-      [ZAI_UNIT_MONTHS, DAYS_PER_MONTH * HOURS_PER_DAY4 * SECONDS_PER_HOUR * MS_PER_SECOND7]
+      [ZAI_UNIT_HOURS, SECONDS_PER_HOUR2 * MS_PER_SECOND7],
+      [ZAI_UNIT_MONTHS, DAYS_PER_MONTH * HOURS_PER_DAY5 * SECONDS_PER_HOUR2 * MS_PER_SECOND7]
     ]);
-    ZaiLimitSchema = z29.object({
-      type: z29.string(),
-      unit: z29.number().int(),
-      number: z29.number().int().positive(),
-      percentage: z29.number().nonnegative(),
-      nextResetTime: z29.number().positive().optional(),
-      usage: z29.number().nonnegative().optional(),
-      currentValue: z29.number().nonnegative().optional(),
-      remaining: z29.number().nonnegative().optional()
+    ZaiLimitSchema = z30.object({
+      type: z30.string(),
+      unit: z30.number().int(),
+      number: z30.number().int().positive(),
+      percentage: z30.number().nonnegative(),
+      nextResetTime: z30.number().positive().optional(),
+      usage: z30.number().nonnegative().optional(),
+      currentValue: z30.number().nonnegative().optional(),
+      remaining: z30.number().nonnegative().optional()
     });
-    ZaiResponseSchema = z29.object({
-      success: z29.boolean(),
-      msg: z29.string().optional(),
-      data: z29.object({ level: z29.string().optional(), limits: z29.array(ZaiLimitSchema) })
+    ZaiResponseSchema = z30.object({
+      success: z30.boolean(),
+      msg: z30.string().optional(),
+      data: z30.object({ level: z30.string().optional(), limits: z30.array(ZaiLimitSchema) })
     });
     OPENROUTER_HOST = "openrouter.ai";
     OPENROUTER_KEY_URL = `https://${OPENROUTER_HOST}/api/v1/key`;
     OPENROUTER_CREDITS_URL = `https://${OPENROUTER_HOST}/api/v1/credits`;
-    MS_PER_DAY3 = HOURS_PER_DAY4 * SECONDS_PER_HOUR * MS_PER_SECOND7;
-    OpenRouterKeySchema = z29.object({
-      data: z29.object({
-        limit: z29.number().nonnegative().nullable(),
-        limit_remaining: z29.number().nullable(),
-        limit_reset: z29.string().nullable(),
-        is_free_tier: z29.boolean().optional(),
-        free_model_daily_requests: z29.object({ used: z29.number().nonnegative(), limit: z29.number().nonnegative(), remaining: z29.number() }).optional()
+    MS_PER_DAY3 = HOURS_PER_DAY5 * SECONDS_PER_HOUR2 * MS_PER_SECOND7;
+    OpenRouterKeySchema = z30.object({
+      data: z30.object({
+        limit: z30.number().nonnegative().nullable(),
+        limit_remaining: z30.number().nullable(),
+        limit_reset: z30.string().nullable(),
+        is_free_tier: z30.boolean().optional(),
+        free_model_daily_requests: z30.object({ used: z30.number().nonnegative(), limit: z30.number().nonnegative(), remaining: z30.number() }).optional()
       })
     });
-    OpenRouterCreditsSchema = z29.object({ data: z29.object({ total_credits: z29.number().nonnegative(), total_usage: z29.number().nonnegative() }) });
+    OpenRouterCreditsSchema = z30.object({ data: z30.object({ total_credits: z30.number().nonnegative(), total_usage: z30.number().nonnegative() }) });
     ANTIGRAVITY_HOST = "daily-cloudcode-pa.googleapis.com";
     ANTIGRAVITY_QUOTA_URL = `https://${ANTIGRAVITY_HOST}/v1internal:retrieveUserQuotaSummary`;
     ANTIGRAVITY_USER_URL = `https://${ANTIGRAVITY_HOST}/v1internal:loadCodeAssist`;
     FIVE_HOURS2 = 5;
-    DAYS_PER_WEEK = 7;
-    FIVE_HOURS_MS = FIVE_HOURS2 * SECONDS_PER_HOUR * MS_PER_SECOND7;
-    WEEK_MS = DAYS_PER_WEEK * HOURS_PER_DAY4 * SECONDS_PER_HOUR * MS_PER_SECOND7;
-    AntigravityBucketSchema = z29.object({
-      bucketId: z29.string(),
-      remainingFraction: z29.number().optional(),
-      resetTime: z29.string().optional()
+    DAYS_PER_WEEK2 = 7;
+    FIVE_HOURS_MS = FIVE_HOURS2 * SECONDS_PER_HOUR2 * MS_PER_SECOND7;
+    WEEK_MS = DAYS_PER_WEEK2 * HOURS_PER_DAY5 * SECONDS_PER_HOUR2 * MS_PER_SECOND7;
+    AntigravityBucketSchema = z30.object({
+      bucketId: z30.string(),
+      remainingFraction: z30.number().optional(),
+      resetTime: z30.string().optional()
     });
-    AntigravitySummarySchema = z29.object({ groups: z29.array(z29.object({ buckets: z29.array(AntigravityBucketSchema) })) });
-    GoogleTokenInfoSchema = z29.object({
-      email: z29.string().optional(),
-      sub: z29.string().optional()
+    AntigravitySummarySchema = z30.object({ groups: z30.array(z30.object({ buckets: z30.array(AntigravityBucketSchema) })) });
+    GoogleTokenInfoSchema = z30.object({
+      email: z30.string().optional(),
+      sub: z30.string().optional()
     });
-    AntigravityUserSchema = z29.object({
+    AntigravityUserSchema = z30.object({
       /** The code-assist tier context, which defaults to the free tier for every account. */
-      currentTier: z29.object({ name: z29.string().optional(), id: z29.string().optional() }).optional(),
+      currentTier: z30.object({ name: z30.string().optional(), id: z30.string().optional() }).optional(),
       /** The account's paid subscription; absent when the account has none. */
-      paidTier: z29.object({ name: z29.string().optional(), id: z29.string().optional() }).optional()
+      paidTier: z30.object({ name: z30.string().optional(), id: z30.string().optional() }).optional()
     });
   }
 });
@@ -9538,8 +9876,8 @@ function parseConnectTarget(authority) {
 function isInterceptedHost(host, interceptHosts) {
   return interceptHosts.includes(host);
 }
-function servedByPipeline(path41) {
-  return path41?.startsWith(ROUTED_PATH_PREFIX) === true;
+function servedByPipeline(path42) {
+  return path42?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
   "connection",
@@ -10333,11 +10671,11 @@ function createRcSessionTracker(deps) {
   };
   const observeExchange = (request4) => {
     const method = (request4.method ?? "").toUpperCase();
-    const path41 = new URL(request4.url ?? "/", "http://127.0.0.1").pathname;
-    if (!path41.startsWith(RC_SESSIONS_PATH_PREFIX)) {
+    const path42 = new URL(request4.url ?? "/", "http://127.0.0.1").pathname;
+    if (!path42.startsWith(RC_SESSIONS_PATH_PREFIX)) {
       return void 0;
     }
-    const tail = path41.slice(RC_SESSIONS_PATH_PREFIX.length);
+    const tail = path42.slice(RC_SESSIONS_PATH_PREFIX.length);
     const facts = {
       oauthAuthorization: oauthAuthorizationOf(request4.headers),
       anthropicVersion: singleHeader(request4.headers, "anthropic-version"),
@@ -10727,8 +11065,8 @@ var RC_READ_FILE_ENCODINGS = ["utf-8", "base64"];
 function isRcReadFileEncoding(value) {
   return RC_READ_FILE_ENCODINGS.some((encoding) => encoding === value);
 }
-function buildRcReadFilePayload(requestId, path41, options) {
-  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path41, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
+function buildRcReadFilePayload(requestId, path42, options) {
+  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path42, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
 }
 function buildRcFileSuggestionsPayload(requestId, query) {
   return buildRcControlRequestPayload(requestId, { subtype: "file_suggestions", query });
@@ -10830,15 +11168,15 @@ async function getRcSessionContextUsage(deps, sessionId, detail) {
   const result = await deliverRcClientPayload(deps, sessionId, buildRcGetContextUsagePayload(requestId, detail), `request the context usage of session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
-async function readRcSessionFile(deps, sessionId, path41, options) {
-  if (path41 === "") {
+async function readRcSessionFile(deps, sessionId, path42, options) {
+  if (path42 === "") {
     return { ok: false, message: "a read-file write needs a non-empty path: the SDK's own field names the file the worker resolves against the session's cwd, and an empty string names none" };
   }
   if (options?.maxBytes !== void 0 && (!Number.isInteger(options.maxBytes) || options.maxBytes <= 0)) {
     return { ok: false, message: "a read-file write's max-bytes is a positive whole number of bytes: the SDK's own field caps the read, and a zero or negative cap reads nothing" };
   }
   const requestId = deps.newUuid();
-  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path41, options), `read ${path41} from session ${sessionId}`);
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path42, options), `read ${path42} from session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
 async function suggestRcSessionFiles(deps, sessionId, query) {
@@ -11007,11 +11345,11 @@ function createRcControlHandler(deps) {
       path: "read-file",
       read: (body) => {
         const session = bodyString(body, "session");
-        const path41 = bodyString(body, "path");
+        const path42 = bodyString(body, "path");
         const maxBytes = "maxBytes" in body ? bodyPositiveInteger(body, "maxBytes") : void 0;
         const encoding = "encoding" in body && isRcReadFileEncoding(body.encoding) ? body.encoding : void 0;
-        const refused2 = session === void 0 || path41 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
-        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path41, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
+        const refused2 = session === void 0 || path42 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
+        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path42, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
       }
     },
     {
@@ -11321,9 +11659,9 @@ function requestIdOfBody(body) {
 }
 function frontDoorRcControl(transport, token) {
   const headers = { authorization: `Bearer ${token}` };
-  const listAnswerOf = async (path41, what) => {
+  const listAnswerOf = async (path42, what) => {
     try {
-      return await transport.request({ method: "GET", path: path41, headers });
+      return await transport.request({ method: "GET", path: path42, headers });
     } catch (error) {
       throw new Error(`${what}: could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
     }
@@ -11395,10 +11733,10 @@ function frontDoorRcControl(transport, token) {
     }
     return pending;
   };
-  const writeOf = async (path41, body, describeFailure2) => {
+  const writeOf = async (path42, body, describeFailure2) => {
     let answer;
     try {
-      answer = await transport.request({ method: "POST", path: path41, headers: { ...headers, "content-type": "application/json" }, body });
+      answer = await transport.request({ method: "POST", path: path42, headers: { ...headers, "content-type": "application/json" }, body });
     } catch (error) {
       return { ok: false, message: `could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}` };
     }
@@ -11429,10 +11767,10 @@ function frontDoorRcControl(transport, token) {
     endSession: async (sessionId, reason) => await writeOf(`${CONTROL_PATH_PREFIX}/end-session`, JSON.stringify({ session: sessionId, ...reason === void 0 ? {} : { reason } }), (status, message) => `ending ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getUsage: async (sessionId, skipBehaviors) => await writeOf(`${CONTROL_PATH_PREFIX}/get-usage`, JSON.stringify({ session: sessionId, ...skipBehaviors === void 0 ? {} : { skipBehaviors } }), (status, message) => `requesting the usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getContextUsage: async (sessionId, detail) => await writeOf(`${CONTROL_PATH_PREFIX}/get-context-usage`, JSON.stringify({ session: sessionId, ...detail === void 0 ? {} : { detail } }), (status, message) => `requesting the context usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
-    readFile: async (sessionId, path41, options) => await writeOf(
+    readFile: async (sessionId, path42, options) => await writeOf(
       `${CONTROL_PATH_PREFIX}/read-file`,
-      JSON.stringify({ session: sessionId, path: path41, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
-      (status, message) => `reading ${path41} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
+      JSON.stringify({ session: sessionId, path: path42, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
+      (status, message) => `reading ${path42} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
     ),
     fileSuggestions: async (sessionId, query) => await writeOf(`${CONTROL_PATH_PREFIX}/file-suggestions`, JSON.stringify({ session: sessionId, query }), (status, message) => `requesting file suggestions from ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     keepAlive: async (sessionId) => await writeOf(`${CONTROL_PATH_PREFIX}/keep-alive`, JSON.stringify({ session: sessionId }), (status, message) => `keeping ${sessionId} alive failed (HTTP ${String(status)}): ${message}`),
@@ -11591,12 +11929,12 @@ function tlsFacts(options) {
 }
 function realRcEventDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const post = async (path41, headers, body) => await new Promise((resolve, reject) => {
+  const post = async (path42, headers, body) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method: "POST",
-      path: path41,
+      path: path42,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, "content-length": String(Buffer.byteLength(body, "utf8")) },
       agent
@@ -11661,12 +11999,12 @@ function lateRcStreamDial(resolve) {
 }
 function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const request4 = async (method, path41, headers, body, signal) => await new Promise((resolve, reject) => {
+  const request4 = async (method, path42, headers, body, signal) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method,
-      path: path41,
+      path: path42,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, ...body === void 0 ? {} : { "content-length": String(Buffer.byteLength(body, "utf8")) } },
       agent,
@@ -11708,9 +12046,9 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
       return { status, body: await readAll(response) };
     },
     openStream: async (sessionId, headers, resume, signal) => {
-      const path41 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
+      const path42 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
       const streamHeaders = resume === void 0 ? headers : { ...headers, "last-event-id": String(resume.fromSequenceNum) };
-      const { status, response } = await request4("GET", path41, streamHeaders, void 0, signal);
+      const { status, response } = await request4("GET", path42, streamHeaders, void 0, signal);
       if (!isSuccessful2(status)) {
         await readAll(response);
         return { status, chunks: NO_CHUNKS };
@@ -12862,19 +13200,19 @@ function writePools(paths, pools) {
   applyPatch(paths.globalConfigFile, GlobalConfigSchema, { pools }, { defaults: {} });
 }
 function poolCycleOf(pools, name) {
-  const walk = (current, path41) => {
+  const walk = (current, path42) => {
     for (const entry of pools[current]?.identities ?? []) {
       const nested = poolNameOf(poolMemberIdentity(entry));
       if (nested === void 0) {
         continue;
       }
       if (nested === name) {
-        return [...path41, nested];
+        return [...path42, nested];
       }
-      if (path41.includes(nested)) {
+      if (path42.includes(nested)) {
         continue;
       }
-      const found = walk(nested, [...path41, nested]);
+      const found = walk(nested, [...path42, nested]);
       if (found !== void 0) {
         return found;
       }
@@ -12996,6 +13334,7 @@ init_cascade();
 init_paths();
 init_realCredentialCache();
 init_providersStore();
+init_signIn();
 init_realPorts();
 init_envBool();
 init_load();
@@ -13008,7 +13347,7 @@ init_guard();
 init_providersStore();
 init_projects();
 init_pipeline();
-import path26 from "node:path";
+import path27 from "node:path";
 import { z as z15 } from "zod";
 var HISTORY_PROJECTS_KEY_PREFIX = "history/projects/";
 function projectFragmentOf(rawKey) {
@@ -13065,26 +13404,18 @@ function formatDecision(decision) {
   const eliminatedNote = decision.eliminated !== void 0 && decision.eliminated.length > 0 ? ` [${String(decision.eliminated.length)} more specific rule(s) eliminated by a failing when-condition]` : "";
   return `${decision.relPath}: ${status} \u2014 ${reason}${eliminatedNote}`;
 }
-function parseKeychainServiceName(stderr) {
-  const match = /"svce"<blob>="([^"]*)"/.exec(stderr);
-  return match?.[1];
-}
 function lookupKeychainService(run, farmRoot) {
-  const result = run.run("security", ["find-generic-password", "-a", farmRoot, "-g"]);
+  const serviceName = claudeCodeKeychainService(farmRoot);
+  const result = run.run("security", ["find-generic-password", "-s", serviceName]);
   if (result.status !== 0) {
     return {
       checked: true,
       found: false,
-      note: `No Keychain entry found for account "${farmRoot}" (security exited ${result.status === null ? "with no status" : String(result.status)}).`
+      serviceName,
+      note: `No Keychain entry found for service "${serviceName}" (security exited ${result.status === null ? "with no status" : String(result.status)}).`
     };
   }
-  const serviceName = parseKeychainServiceName(result.stderr);
-  return {
-    checked: true,
-    found: true,
-    ...serviceName === void 0 ? {} : { serviceName },
-    note: serviceName === void 0 ? `A Keychain entry was found for account "${farmRoot}" but its service name could not be parsed from security's output.` : `Keychain service name for this identity: "${serviceName}".`
-  };
+  return { checked: true, found: true, serviceName, note: `Keychain service name for this identity: "${serviceName}".` };
 }
 var SettingsSecretsShapeSchema = z15.looseObject({
   env: z15.record(z15.string(), z15.unknown()).optional(),
@@ -13346,10 +13677,10 @@ function collectCheckReport(params) {
   }).input;
   const providerName = cascadeProviderName(cascade);
   const provider = providerName === void 0 ? void 0 : loadCheckProvider(paths, providerName);
-  const farmRoot = identityDecision.name === void 0 ? void 0 : path26.join(paths.identitiesDir, identityDecision.name);
+  const farmRoot = identityDecision.name === void 0 ? void 0 : path27.join(paths.identitiesDir, identityDecision.name);
   const settingsFiles = {
-    "settings.json": realFsPort.readFileUtf8(path26.join(claudeHome, "settings.json")),
-    "settings.local.json": realFsPort.readFileUtf8(path26.join(claudeHome, "settings.local.json"))
+    "settings.json": realFsPort.readFileUtf8(path27.join(claudeHome, "settings.json")),
+    "settings.local.json": realFsPort.readFileUtf8(path27.join(claudeHome, "settings.local.json"))
   };
   const report = runCheck({
     cwd,
@@ -13655,7 +13986,7 @@ init_schema();
 init_cliError();
 init_identity();
 import fs9 from "node:fs";
-import path28 from "node:path";
+import path29 from "node:path";
 init_lock();
 var IdentityNotFoundError = class extends CliError {
   constructor(name) {
@@ -13684,7 +14015,7 @@ var InvalidIdentityNameError = class extends CliError {
   attemptedName;
 };
 function identityJsonPath(paths, name) {
-  return path28.join(paths.identitiesDir, name, "identity.json");
+  return path29.join(paths.identitiesDir, name, "identity.json");
 }
 function requireIdentityNames(paths, names) {
   const existing = new Set(listIdentities(paths).map((entry) => entry.name));
@@ -13799,7 +14130,7 @@ function setIdentityCredential(paths, identityName, change) {
   });
 }
 function belongsToIdentity(entry, name) {
-  return entry === name || entry === path28.basename(identityLockPath("", name)) || entry.startsWith(`.${name}.scratch.`) || entry.startsWith(`.${name}.previous.`);
+  return entry === name || entry === path29.basename(identityLockPath("", name)) || entry.startsWith(`.${name}.scratch.`) || entry.startsWith(`.${name}.previous.`);
 }
 function removeIdentity(paths, name) {
   if (!identityExists(paths, name)) {
@@ -13807,7 +14138,7 @@ function removeIdentity(paths, name) {
   }
   for (const entry of fs9.readdirSync(paths.identitiesDir)) {
     if (belongsToIdentity(entry, name)) {
-      fs9.rmSync(path28.join(paths.identitiesDir, entry), { recursive: true, force: true });
+      fs9.rmSync(path29.join(paths.identitiesDir, entry), { recursive: true, force: true });
     }
   }
   if (readActiveIdentity2(paths) === name) {
@@ -13819,28 +14150,7 @@ function removeIdentity(paths, name) {
 init_realPorts();
 import fs11 from "node:fs";
 import path30 from "node:path";
-
-// src/usage/signIn.ts
-import path29 from "node:path";
-var CREDENTIALS_FILE = ".credentials.json";
-function keychainHasItem(run, account) {
-  return run.run("security", ["find-generic-password", "-a", account]).status === 0;
-}
-function decideSignIn(facts) {
-  if (facts.hasCredentialBlock) {
-    return { state: "token", detail: "supplies its own credential through a credential block, so a stored login is not what a launch uses" };
-  }
-  if (facts.keychainItem === true) {
-    return { state: "signed-in", detail: "a login is stored in the macOS Keychain" };
-  }
-  if (facts.credentialsFile) {
-    return { state: "signed-in", detail: `a login is stored in ${CREDENTIALS_FILE}` };
-  }
-  return { state: "signed-out", detail: facts.platform === "darwin" ? `no Keychain item and no ${CREDENTIALS_FILE}` : `no ${CREDENTIALS_FILE}` };
-}
-function credentialsFilePath(farmRoot) {
-  return path29.join(farmRoot, CREDENTIALS_FILE);
-}
+init_signIn();
 
 // src/codex/siwcStore.ts
 import { z as z22 } from "zod";
@@ -15181,7 +15491,7 @@ function profileValue(name, paths) {
 function createConfigApiRouter(deps) {
   const authed = doorApiAuth(deps.expectedToken);
   const { paths } = deps;
-  const route = (path41, summary) => authed.meta(openapi3({ method: "POST", path: path41, summary, tags: [CONFIG_API_TAG] }));
+  const route = (path42, summary) => authed.meta(openapi3({ method: "POST", path: path42, summary, tags: [CONFIG_API_TAG] }));
   return {
     config: {
       identity: {
@@ -16471,7 +16781,7 @@ function numberOf(record, field) {
   }
   return void 0;
 }
-function pageOfRcChannel(url, rows, idOf, rowOf2) {
+function pageOfRcChannel(url, rows, idOf, rowOf3) {
   const query = new URL(url, "http://127.0.0.1").searchParams;
   const anchor = query.get("after_event_id") ?? query.get("cursor");
   const rawLimit = query.get("limit");
@@ -16485,7 +16795,7 @@ function pageOfRcChannel(url, rows, idOf, rowOf2) {
   }
   const page = limit === void 0 ? rows.slice(from) : rows.slice(from, from + limit);
   const last = page[page.length - 1];
-  return { data: page.map(rowOf2), ...last === void 0 ? {} : { next_cursor: idOf(last) } };
+  return { data: page.map(rowOf3), ...last === void 0 ? {} : { next_cursor: idOf(last) } };
 }
 async function serveRcClientChannels(ctx, tail, method, maxBatchEvents) {
   const { request: request4, response, host } = ctx;