claude-use 11.25.0 → 11.26.0

package/dist/index.mjs

@@ -223,7 +223,7 @@ function isTimeZone(name) {
     return false;
   }
 }
-var CATEGORY_NAMES, OVERRIDABLE_CATEGORIES, CategoryMapSchema, DURATION_RE, DurationSchema, WhenConditionObjectSchema, WhenSchema, EntryValueSchema, ENTRY_KEY_RE, EntriesSchema, LaunchSchema, CREDENTIAL_TARGETS, PROVIDER_CREDENTIAL_TARGETS, CREDENTIAL_TARGET_VARS, ArgvSchema, CommandSourceOptions, EnvCredentialSourceSchema, FileCredentialSourceSchema, CommandCredentialSourceSchema, OpCredentialSourceSchema, KeychainCredentialSourceSchema, LiteralCredentialSourceSchema, CredentialSourceSchema, RemoteCredentialSourceSchema, CREDENTIAL_CACHE_STORES, CredentialCacheSchema, CredentialSchema, ProviderCredentialSchema, RESERVED_PROVIDER_ENV_KEYS, ProviderEnvSchema, PROVIDER_KINDS, ANTIGRAVITY_MODES, CLAUDE_TIERS, ANTIGRAVITY_EFFORTS, ANTIGRAVITY_DEFAULT_MODE, ANTIGRAVITY_DEFAULT_MODEL, ANTIGRAVITY_DEFAULT_TIER_MODELS, ANTIGRAVITY_DEFAULT_EFFORT, AntigravityModelTargetSchema, AntigravityProviderConfigSchema, CODEX_EFFORTS, CODEX_LOGINS, CODEX_DEFAULT_LOGIN, CODEX_DEFAULT_MODEL, CODEX_DEFAULT_TIER_MODELS, CODEX_DEFAULT_EFFORT, CodexProviderConfigSchema, ProviderRouteSchema, PickerModelSchema, PickerModelsSchema, HttpProviderSchema, CodexProviderSchema, AntigravityProviderSchema, ProviderSchema, ConfigProfileSchema, POOL_SELECTOR_PREFIX, POOL_NAME_PATTERN, IDENTITY_NAME_PATTERN, PoolNameSchema, SELECTOR_RE, IdentitySelectorSchema, PoolMemberSchema, POOL_PREFERENCES, PoolPreferenceSchema, WHOLE_PERCENT_MAX, CompactAtUtilisationSchema, PoolSchema, WEEKDAYS, AnchorSchema, JOB_WINDOWS, JobTriggerSchema, JobTargetSchema, JobSchema, DirectoryRuleSchema, DirectoryRulesSchema, PortableConfigSchema, HEADROOM_MODES, HEADROOM_CCR_MODES, HEADROOM_ROLLOUT_CHANNELS, INTERCEPT_CHANNELS, READ_MATURATION_CHANNELS, HeadroomGlobalConfigObjectSchema, HeadroomGlobalConfigSchema, HEADROOM_DEFAULT_SOURCE, HEADROOM_DEFAULT_IDLE_SHUTDOWN_MINUTES, FrontDoorGlobalConfigSchema, UPDATE_MODES, UpdateGlobalConfigSchema, GlobalConfigSchema, IdentitySchema, CategoryClassificationSchema, CategoryClassificationOverlaySchema, SHIPPED_CATEGORY_DEFAULTS;
+var CATEGORY_NAMES, OVERRIDABLE_CATEGORIES, CategoryMapSchema, DURATION_RE, DurationSchema, WhenConditionObjectSchema, WhenSchema, EntryValueSchema, ENTRY_KEY_RE, EntriesSchema, LaunchSchema, CREDENTIAL_TARGETS, PROVIDER_CREDENTIAL_TARGETS, CREDENTIAL_TARGET_VARS, ArgvSchema, CommandSourceOptions, EnvCredentialSourceSchema, FileCredentialSourceSchema, CommandCredentialSourceSchema, OpCredentialSourceSchema, KeychainCredentialSourceSchema, LiteralCredentialSourceSchema, CredentialSourceSchema, RemoteCredentialSourceSchema, CREDENTIAL_CACHE_STORES, CredentialCacheSchema, CredentialSchema, ProviderCredentialSchema, RESERVED_PROVIDER_ENV_KEYS, ProviderEnvSchema, PROVIDER_KINDS, ANTIGRAVITY_MODES, CLAUDE_TIERS, ANTIGRAVITY_EFFORTS, ANTIGRAVITY_DEFAULT_MODE, ANTIGRAVITY_DEFAULT_MODEL, ANTIGRAVITY_DEFAULT_TIER_MODELS, ANTIGRAVITY_DEFAULT_EFFORT, AntigravityModelTargetSchema, AntigravityProviderConfigSchema, CODEX_EFFORTS, CODEX_LOGINS, CODEX_DEFAULT_LOGIN, CODEX_DEFAULT_MODEL, CODEX_DEFAULT_TIER_MODELS, CODEX_DEFAULT_EFFORT, CodexProviderConfigSchema, ProviderRouteSchema, PickerModelSchema, PickerModelsSchema, ProviderCatalogueSchema, HttpProviderSchema, CodexProviderSchema, AntigravityProviderSchema, ProviderSchema, ConfigProfileSchema, POOL_SELECTOR_PREFIX, POOL_NAME_PATTERN, IDENTITY_NAME_PATTERN, PoolNameSchema, SELECTOR_RE, IdentitySelectorSchema, PoolMemberSchema, POOL_PREFERENCES, PoolPreferenceSchema, WHOLE_PERCENT_MAX, CompactAtUtilisationSchema, PoolSchema, WEEKDAYS, AnchorSchema, JOB_WINDOWS, JobTriggerSchema, JobTargetSchema, JobSchema, DirectoryRuleSchema, DirectoryRulesSchema, PortableConfigSchema, HEADROOM_MODES, HEADROOM_CCR_MODES, HEADROOM_ROLLOUT_CHANNELS, INTERCEPT_CHANNELS, READ_MATURATION_CHANNELS, HeadroomGlobalConfigObjectSchema, HeadroomGlobalConfigSchema, HEADROOM_DEFAULT_SOURCE, HEADROOM_DEFAULT_IDLE_SHUTDOWN_MINUTES, FrontDoorGlobalConfigSchema, UPDATE_MODES, UpdateGlobalConfigSchema, GlobalConfigSchema, IdentitySchema, CategoryClassificationSchema, CategoryClassificationOverlaySchema, SHIPPED_CATEGORY_DEFAULTS;
 var init_schema = __esm({
   "src/config/schema.ts"() {
     "use strict";
@@ -402,6 +402,12 @@ var init_schema = __esm({
       description: z.string().min(1).optional()
     });
     PickerModelsSchema = z.array(PickerModelSchema).refine((models) => new Set(models.map((entry) => entry.model)).size === models.length, { message: "pickerModels names a model more than once" });
+    ProviderCatalogueSchema = z.strictObject({
+      tier: z.enum(CLAUDE_TIERS),
+      include: z.array(z.string().min(1)).min(1).optional(),
+      exclude: z.array(z.string().min(1)).min(1).optional(),
+      url: z.url().optional()
+    });
     HttpProviderSchema = z.strictObject({
       $schema: z.string().optional(),
       kind: z.literal("http").optional(),
@@ -411,6 +417,8 @@ var init_schema = __esm({
       env: ProviderEnvSchema.optional(),
       /** Extra models `/model` lists beside the ones the tier settings name. */
       pickerModels: PickerModelsSchema.optional(),
+      /** The provider's own model catalogue, listed in `/model` when set. */
+      catalogue: ProviderCatalogueSchema.optional(),
       /** Per-request routing: when present, each request this provider would serve is matched against the list in order, and the first definite match is sent to that entry's provider instead (itself resolved exactly as a directly dialled request would be). Unmatched requests stay on this provider. */
       routes: z.array(ProviderRouteSchema).optional()
     });
@@ -621,7 +629,7 @@ function parseIgnoringUnrecognisedKeys(schema, raw) {
   return second.success ? { success: true, data: second.data, ignored } : { success: false, issues: second.error.issues };
 }
 function describeIgnoredKeys(filePath, ignored) {
-  const places = ignored.map(({ path: path42, keys }) => `${path42.length === 0 ? "" : `${path42.map(String).join(".")}.`}${keys.join(", ")}`);
+  const places = ignored.map(({ path: path43, keys }) => `${path43.length === 0 ? "" : `${path43.map(String).join(".")}.`}${keys.join(", ")}`);
   return `${filePath} has settings this version of agent-shim does not know and ignores: ${places.join("; ")}. A newer release may read them.`;
 }
 function noteIgnoredKeys(filePath, ignored) {
@@ -643,9 +651,9 @@ function restoreIgnoredKeys(filePath, value) {
     return value;
   }
   const restored = structuredClone(value);
-  for (const { path: path42, values } of ignored) {
+  for (const { path: path43, values } of ignored) {
     let holder = restored;
-    for (const step of path42) {
+    for (const step of path43) {
       holder = isRecord(holder) ? holder[step] : void 0;
     }
     if (isRecord(holder)) {
@@ -2923,7 +2931,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "claude-use",
-      version: "11.25.0",
+      version: "11.26.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -6032,6 +6040,7 @@ function buildLayoutPaths(root) {
     usageDir: path23.join(root, "usage"),
     usageLogDir: path23.join(root, "usage", "log"),
     usageSnapshotsDir: path23.join(root, "usage", "snapshots"),
+    catalogueDir: path23.join(root, "catalogues"),
     usagePicksFile: path23.join(root, "usage", "picks.json"),
     usageAnchorsFile: path23.join(root, "usage", "anchors.json"),
     usageJobsFile: path23.join(root, "usage", "jobs.json"),
@@ -6476,7 +6485,10 @@ function loadProvider(providersDir, name, port) {
   const raw = port.readConfigFile(filePath);
   return raw === void 0 ? void 0 : parseProviderFile(filePath, raw);
 }
-function listProviders(paths) {
+function reportInvalidProvider(name, message) {
+  console.error(`agent-shim: providers/${name}.json is invalid and was skipped: ${message}`);
+}
+function listProviders(paths, onInvalid = reportInvalidProvider) {
   const names = listProviderNames(
     (dir) => fs7.readdirSync(dir),
     paths.providersDir
@@ -6490,7 +6502,7 @@ function listProviders(paths) {
       if (!(error instanceof ConfigValidationError || error instanceof LegacyProviderFileError)) {
         throw error;
       }
-      console.error(`agent-shim: providers/${name}.json is invalid and was skipped: ${error.message}`);
+      onInvalid(name, error.message);
       continue;
     }
     if (provider !== void 0) {
@@ -6540,6 +6552,9 @@ function addProvider(paths, name, input) {
   if (kind === "http" && input.baseUrl === void 0) {
     throw new ProviderKindMismatchError("An http provider needs --base-url.");
   }
+  if (kind !== "http" && input.catalogue !== void 0) {
+    throw new ProviderKindMismatchError("A model catalogue applies only to an http provider.");
+  }
   if (kind !== "codex" && !isEmptyCodexConfig(input.codex)) {
     throw new ProviderKindMismatchError("Codex settings apply only to a codex provider (--kind codex).");
   }
@@ -6553,7 +6568,7 @@ function addProvider(paths, name, input) {
     ...input.pickerModels === void 0 || input.pickerModels.length === 0 ? {} : { pickerModels: input.pickerModels }
   };
   const parsed = ProviderSchema.safeParse(
-    kind === "codex" ? { kind, ...shared, ...isEmptyCodexConfig(input.codex) ? {} : { codex: input.codex } } : kind === "antigravity" ? { kind, ...shared, ...isEmptyAntigravityConfig(input.antigravity) ? {} : { antigravity: input.antigravity } } : { ...shared, baseUrl: input.baseUrl }
+    kind === "codex" ? { kind, ...shared, ...isEmptyCodexConfig(input.codex) ? {} : { codex: input.codex } } : kind === "antigravity" ? { kind, ...shared, ...isEmptyAntigravityConfig(input.antigravity) ? {} : { antigravity: input.antigravity } } : { ...shared, baseUrl: input.baseUrl, ...input.catalogue === void 0 ? {} : { catalogue: input.catalogue } }
   );
   if (!parsed.success) {
     throw new ConfigValidationError(providerJsonPath(paths, name), parsed.error.issues);
@@ -6582,6 +6597,9 @@ function updateProvider(paths, name, input) {
   if (isAntigravityProvider(existing) && input.baseUrl !== void 0) {
     throw new ProviderKindMismatchError(`Provider "${name}" is an antigravity provider, which has no base URL.`);
   }
+  if ((isCodexProvider(existing) || isAntigravityProvider(existing)) && input.catalogue !== void 0 && input.catalogue !== false) {
+    throw new ProviderKindMismatchError(`Provider "${name}" is not an http provider; a model catalogue applies only to an http provider.`);
+  }
   if (!isCodexProvider(existing) && !isEmptyCodexConfig(input.codex)) {
     throw new ProviderKindMismatchError(`Provider "${name}" is not a codex provider; codex settings apply only to a codex provider.`);
   }
@@ -6614,7 +6632,8 @@ function updateProvider(paths, name, input) {
     };
     candidate = { ...existing, ...shared, antigravity: isEmptyAntigravityConfig(antigravity) ? void 0 : antigravity };
   } else {
-    candidate = { ...existing, ...shared, ...input.baseUrl === void 0 ? {} : { baseUrl: input.baseUrl } };
+    const catalogue = input.catalogue === void 0 ? existing.catalogue : input.catalogue === false ? void 0 : input.catalogue;
+    candidate = { ...existing, ...shared, catalogue, ...input.baseUrl === void 0 ? {} : { baseUrl: input.baseUrl } };
   }
   const parsed = ProviderSchema.safeParse(candidate);
   if (!parsed.success) {
@@ -8004,6 +8023,49 @@ var init_translate2 = __esm({
   }
 });
 
+// src/providerCatalogue.ts
+import path38 from "node:path";
+import picomatch4 from "picomatch";
+import { z as z30 } from "zod";
+function catalogueCachePath(paths, name) {
+  return path38.join(paths.catalogueDir, `${name}.json`);
+}
+function parseCatalogueCache(text) {
+  if (text === void 0) {
+    return void 0;
+  }
+  try {
+    const parsed = CatalogueCacheSchema.safeParse(JSON.parse(text));
+    return parsed.success ? parsed.data : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function filterCatalogue(models, catalogue) {
+  const included = catalogue.include === void 0 ? void 0 : picomatch4(catalogue.include, { dot: true });
+  const excluded = catalogue.exclude === void 0 ? void 0 : picomatch4(catalogue.exclude, { dot: true });
+  return models.filter((model) => included?.(model.id) !== false && excluded?.(model.id) !== true);
+}
+var DEFAULT_CANDIDATE_URLS, MS_PER_SECOND7, SECONDS_PER_HOUR2, HOURS_PER_DAY5, MS_PER_HOUR5, HOURS_BETWEEN_RETRIES, CATALOGUE_MAX_AGE_MS, CATALOGUE_RETRY_MS, CATALOGUE_REQUEST_SECONDS, CATALOGUE_REQUEST_TIMEOUT_MS, CATALOGUE_REFRESH_TIMEOUT_MS, CatalogueModelSchema, CatalogueCacheSchema;
+var init_providerCatalogue = __esm({
+  "src/providerCatalogue.ts"() {
+    "use strict";
+    DEFAULT_CANDIDATE_URLS = 2;
+    MS_PER_SECOND7 = 1e3;
+    SECONDS_PER_HOUR2 = 3600;
+    HOURS_PER_DAY5 = 24;
+    MS_PER_HOUR5 = SECONDS_PER_HOUR2 * MS_PER_SECOND7;
+    HOURS_BETWEEN_RETRIES = 1;
+    CATALOGUE_MAX_AGE_MS = HOURS_PER_DAY5 * MS_PER_HOUR5;
+    CATALOGUE_RETRY_MS = HOURS_BETWEEN_RETRIES * MS_PER_HOUR5;
+    CATALOGUE_REQUEST_SECONDS = 10;
+    CATALOGUE_REQUEST_TIMEOUT_MS = CATALOGUE_REQUEST_SECONDS * MS_PER_SECOND7;
+    CATALOGUE_REFRESH_TIMEOUT_MS = DEFAULT_CANDIDATE_URLS * CATALOGUE_REQUEST_TIMEOUT_MS;
+    CatalogueModelSchema = z30.strictObject({ id: z30.string().min(1), name: z30.string().min(1).optional() });
+    CatalogueCacheSchema = z30.strictObject({ fetchedAt: z30.number(), url: z30.string().min(1), models: z30.array(CatalogueModelSchema) });
+  }
+});
+
 // src/launcher/modelPicker.ts
 function labelOf(model) {
   return model.toLowerCase().endsWith(CONTEXT_MARKER_1M) ? model.slice(0, -CONTEXT_MARKER_1M.length) : model;
@@ -8070,14 +8132,23 @@ function declaredRow(entry) {
     behavesAs: TIER_BEHAVES_AS[entry.tier]
   };
 }
-function providerModelRows(provider) {
+function catalogueRows(provider, models) {
+  if (provider.kind !== void 0 && provider.kind !== "http" || provider.catalogue === void 0) {
+    return [];
+  }
+  const { tier } = provider.catalogue;
+  return filterCatalogue(models, provider.catalogue).map((model) => ({ model: model.id, label: labelOf(model.id), description: describedAs(model.id, model.name === void 0 ? "Listed by the provider" : `Listed by the provider as ${model.name}`), behavesAs: TIER_BEHAVES_AS[tier] })).sort((left, right) => left.model.localeCompare(right.model));
+}
+function providerModelRows(provider, catalogue = []) {
   const derived = provider.kind === "codex" ? codexRows(provider) : provider.kind === "antigravity" ? antigravityRows(provider) : httpRows(provider);
   const declared = (provider.pickerModels ?? []).map(declaredRow);
   const declaredModels = new Set(declared.map((row) => row.model));
-  return [...derived.filter((row) => !declaredModels.has(row.model)), ...declared];
+  const named = [...derived.filter((row) => !declaredModels.has(row.model)), ...declared];
+  const taken = new Set(named.map((row) => labelOf(row.model)));
+  return [...named, ...catalogueRows(provider, catalogue).filter((row) => !taken.has(labelOf(row.model)))];
 }
-function modelPickerSettings(provider) {
-  const options = providerModelRows(provider);
+function modelPickerSettings(provider, catalogue = []) {
+  const options = providerModelRows(provider, catalogue);
   return options.length === 0 ? void 0 : JSON.stringify({ modelPicker: { options, replaceBuiltInOptions: true } });
 }
 var CONTEXT_MARKER_1M, TIER_BEHAVES_AS, TIER_ENV_VARIABLES;
@@ -8086,6 +8157,7 @@ var init_modelPicker = __esm({
     "use strict";
     init_translate();
     init_translate2();
+    init_providerCatalogue();
     init_schema();
     CONTEXT_MARKER_1M = "[1m]";
     TIER_BEHAVES_AS = Object.freeze({
@@ -8303,7 +8375,7 @@ var init_launchHook = __esm({
 
 // src/launcher.ts
 import { randomUUID as randomUUID4 } from "node:crypto";
-import path38 from "node:path";
+import path39 from "node:path";
 function resolveIdentityCredential(identity, credential, env, port) {
   if (port === void 0) {
     return { ok: false, status: 1, message: `agent-shim: identity ${identity} needs its credential resolved, but this launcher has no credential port wired` };
@@ -8419,7 +8491,7 @@ function decideLaunch(params, readOnly) {
     identityDefaultConfigProfile: loadedIdentity?.config.defaultConfigProfile,
     globalDefaultConfigProfile: params.globalDefaultConfigProfile
   });
-  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs13.readConfigFile(path38.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
+  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs13.readConfigFile(path39.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
     log.error(
       `agent-shim: no configuration profile named "${configProfileDecision.name}" (selected via ${configProfileDecision.source}). Run \`agent-shim profile add ${configProfileDecision.name}\` first.`
     );
@@ -8529,7 +8601,8 @@ function decideLaunch(params, readOnly) {
     log.info(`agent-shim: identity ${loginlessProvider.identity} has no stored login, so Remote Control, which needs one, is off for this launch; provider ${loginlessProvider.provider} runs without it`);
   }
   const flags = loginlessProvider === void 0 ? requestedFlags : { ...requestedFlags, remoteControl: false };
-  const pickerSettings = selectedProvider === void 0 ? void 0 : modelPickerSettings(selectedProvider.definition);
+  const catalogue = selectedProvider === void 0 ? void 0 : parseCatalogueCache(params.fs.readFileUtf8(catalogueCachePath(paths, selectedProvider.name)));
+  const pickerSettings = selectedProvider === void 0 ? void 0 : modelPickerSettings(selectedProvider.definition, catalogue?.models);
   const callerSettings = hasSettingsArgument(parsedArgv.rest);
   if (pickerSettings !== void 0 && callerSettings && !readOnly) {
     log.info("agent-shim: this launch passes its own --settings, so /model keeps Claude Code's own model names instead of listing the provider's models");
@@ -8540,7 +8613,7 @@ function decideLaunch(params, readOnly) {
     extraFlags: splitExtraFlags(env.CLAUDE_EXTRA_FLAGS),
     passthrough: withLauncherSettings(params.supervised === void 0 ? parsedArgv.rest : withSupervision(parsedArgv.rest, params.supervised), launcherSettings)
   });
-  const configDir = configDirEscapeHatchApplies || identityDecision.name === void 0 ? env.CLAUDE_CONFIG_DIR : path38.join(paths.identitiesDir, identityDecision.name);
+  const configDir = configDirEscapeHatchApplies || identityDecision.name === void 0 ? env.CLAUDE_CONFIG_DIR : path39.join(paths.identitiesDir, identityDecision.name);
   const decision = {
     identitySource: identityDecision.source,
     configDirEscapeHatch: identityDecision.configDirEscapeHatch,
@@ -8581,7 +8654,7 @@ function prepareLaunch(params) {
   );
   const updateCheck = runLaunchUpdateCheck({
     mode: params.updateMode ?? "off",
-    checkPath: path38.join(paths.root, "update.check"),
+    checkPath: path39.join(paths.root, "update.check"),
     currentVersion: package_default.version,
     port: params.update
   });
@@ -8729,6 +8802,7 @@ var init_launcher = __esm({
     init_extraFlags();
     init_claudeSession();
     init_modelPicker();
+    init_providerCatalogue();
     init_pool();
     init_resumeContext();
     init_lock();
@@ -8747,12 +8821,12 @@ var init_launcher = __esm({
 });
 
 // src/ownCli.ts
-import path39 from "node:path";
+import path40 from "node:path";
 function agentShimCliPath(distDir = typeof __AGENT_SHIM_DIST_DIR__ === "string" ? __AGENT_SHIM_DIST_DIR__ : void 0) {
   if (distDir === void 0) {
     throw new OwnCliPathUnknownError();
   }
-  return path39.join(distDir, OWN_CLI_FILE_NAME);
+  return path40.join(distDir, OWN_CLI_FILE_NAME);
 }
 var OWN_CLI_FILE_NAME, OwnCliPathUnknownError;
 var init_ownCli = __esm({
@@ -8782,10 +8856,10 @@ var init_selfIdentity = __esm({
 
 // src/frontdoor/trust.ts
 import { createHash as createHash7 } from "node:crypto";
-import path40 from "node:path";
+import path41 from "node:path";
 function resolveTrustBundle(params) {
   const { caCertFile, bundlesDir, variable, inherited, fs: fs13 } = params;
-  if (inherited === void 0 || inherited === "" || path40.resolve(inherited) === path40.resolve(caCertFile)) {
+  if (inherited === void 0 || inherited === "" || path41.resolve(inherited) === path41.resolve(caCertFile)) {
     return { path: caCertFile };
   }
   const caPem = fs13.readFileUtf8(caCertFile);
@@ -8803,7 +8877,7 @@ function resolveTrustBundle(params) {
   }
   const combined = `${inheritedPem.trimEnd()}
 ${caPem}`;
-  const bundle = path40.join(bundlesDir, `${createHash7("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
+  const bundle = path41.join(bundlesDir, `${createHash7("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
   if (!fs13.exists(bundle)) {
     fs13.mkdirp(bundlesDir);
     fs13.writeFileAtomic(bundle, combined);
@@ -8881,7 +8955,7 @@ var init_realFrontDoorPort = __esm({
 
 // src/launchWiring.ts
 import os8 from "node:os";
-import path41 from "node:path";
+import path42 from "node:path";
 import { randomUUID as randomUUID5 } from "node:crypto";
 function buildFarmRuntime(paths, cwd) {
   const home = os8.homedir();
@@ -8935,7 +9009,7 @@ function realPrepareLaunchParams(paths, options) {
     headroom: realHeadroomPort(paths, { spawnDaemon: options.spawnDaemon, cwd: farm.runtime.cwd }),
     frontdoor: realFrontDoorPort(paths, options.spawnDaemon),
     credentials: { ...realCredentialPort, cache: realCredentialCacheEnv(paths) },
-    hasStoredLogin: (identity) => identitySignIn(realFarmFs, { platform: process.platform, run: realRunPort }, { farmRoot: path41.join(paths.identitiesDir, identity), hasCredentialBlock: false }).state !== "signed-out",
+    hasStoredLogin: (identity) => identitySignIn(realFarmFs, { platform: process.platform, run: realRunPort }, { farmRoot: path42.join(paths.identitiesDir, identity), hasCredentialBlock: false }).state !== "signed-out",
     ...farm.directoryIdentity === void 0 ? {} : { directoryPinnedIdentity: farm.directoryIdentity },
     ...farm.directoryConfigProfile === void 0 ? {} : { directoryRuleConfigProfile: farm.directoryConfigProfile },
     ...farm.globalDefaultConfigProfile === void 0 ? {} : { globalDefaultConfigProfile: farm.globalDefaultConfigProfile },
@@ -9210,76 +9284,76 @@ var init_identityClaude = __esm({
 });
 
 // src/usage/providerQuota.ts
-import { z as z30 } from "zod";
-var MS_PER_SECOND7, SECONDS_PER_HOUR2, HOURS_PER_DAY5, DAYS_PER_MONTH, ZAI_HOST, ZAI_QUOTA_URL, ZAI_UNIT_HOURS, ZAI_UNIT_MONTHS, ZAI_UNIT_MS, ZaiLimitSchema, ZaiResponseSchema, OPENROUTER_HOST, OPENROUTER_KEY_URL, OPENROUTER_CREDITS_URL, MS_PER_DAY3, OpenRouterKeySchema, OpenRouterCreditsSchema, ANTIGRAVITY_HOST, ANTIGRAVITY_QUOTA_URL, ANTIGRAVITY_USER_URL, FIVE_HOURS2, DAYS_PER_WEEK2, FIVE_HOURS_MS, WEEK_MS, AntigravityBucketSchema, AntigravitySummarySchema, GoogleTokenInfoSchema, AntigravityUserSchema;
+import { z as z31 } from "zod";
+var MS_PER_SECOND8, SECONDS_PER_HOUR3, HOURS_PER_DAY6, DAYS_PER_MONTH, ZAI_HOST, ZAI_QUOTA_URL, ZAI_UNIT_HOURS, ZAI_UNIT_MONTHS, ZAI_UNIT_MS, ZaiLimitSchema, ZaiResponseSchema, OPENROUTER_HOST, OPENROUTER_KEY_URL, OPENROUTER_CREDITS_URL, MS_PER_DAY3, OpenRouterKeySchema, OpenRouterCreditsSchema, ANTIGRAVITY_HOST, ANTIGRAVITY_QUOTA_URL, ANTIGRAVITY_USER_URL, FIVE_HOURS2, DAYS_PER_WEEK2, FIVE_HOURS_MS, WEEK_MS, AntigravityBucketSchema, AntigravitySummarySchema, GoogleTokenInfoSchema, AntigravityUserSchema;
 var init_providerQuota = __esm({
   "src/usage/providerQuota.ts"() {
     "use strict";
     init_cloudUpstream();
     init_schema2();
-    MS_PER_SECOND7 = 1e3;
-    SECONDS_PER_HOUR2 = 3600;
-    HOURS_PER_DAY5 = 24;
+    MS_PER_SECOND8 = 1e3;
+    SECONDS_PER_HOUR3 = 3600;
+    HOURS_PER_DAY6 = 24;
     DAYS_PER_MONTH = 30;
     ZAI_HOST = "api.z.ai";
     ZAI_QUOTA_URL = `https://${ZAI_HOST}/api/monitor/usage/quota/limit`;
     ZAI_UNIT_HOURS = 3;
     ZAI_UNIT_MONTHS = 5;
     ZAI_UNIT_MS = /* @__PURE__ */ new Map([
-      [ZAI_UNIT_HOURS, SECONDS_PER_HOUR2 * MS_PER_SECOND7],
-      [ZAI_UNIT_MONTHS, DAYS_PER_MONTH * HOURS_PER_DAY5 * SECONDS_PER_HOUR2 * MS_PER_SECOND7]
+      [ZAI_UNIT_HOURS, SECONDS_PER_HOUR3 * MS_PER_SECOND8],
+      [ZAI_UNIT_MONTHS, DAYS_PER_MONTH * HOURS_PER_DAY6 * SECONDS_PER_HOUR3 * MS_PER_SECOND8]
     ]);
-    ZaiLimitSchema = z30.object({
-      type: z30.string(),
-      unit: z30.number().int(),
-      number: z30.number().int().positive(),
-      percentage: z30.number().nonnegative(),
-      nextResetTime: z30.number().positive().optional(),
-      usage: z30.number().nonnegative().optional(),
-      currentValue: z30.number().nonnegative().optional(),
-      remaining: z30.number().nonnegative().optional()
+    ZaiLimitSchema = z31.object({
+      type: z31.string(),
+      unit: z31.number().int(),
+      number: z31.number().int().positive(),
+      percentage: z31.number().nonnegative(),
+      nextResetTime: z31.number().positive().optional(),
+      usage: z31.number().nonnegative().optional(),
+      currentValue: z31.number().nonnegative().optional(),
+      remaining: z31.number().nonnegative().optional()
     });
-    ZaiResponseSchema = z30.object({
-      success: z30.boolean(),
-      msg: z30.string().optional(),
-      data: z30.object({ level: z30.string().optional(), limits: z30.array(ZaiLimitSchema) })
+    ZaiResponseSchema = z31.object({
+      success: z31.boolean(),
+      msg: z31.string().optional(),
+      data: z31.object({ level: z31.string().optional(), limits: z31.array(ZaiLimitSchema) })
     });
     OPENROUTER_HOST = "openrouter.ai";
     OPENROUTER_KEY_URL = `https://${OPENROUTER_HOST}/api/v1/key`;
     OPENROUTER_CREDITS_URL = `https://${OPENROUTER_HOST}/api/v1/credits`;
-    MS_PER_DAY3 = HOURS_PER_DAY5 * SECONDS_PER_HOUR2 * MS_PER_SECOND7;
-    OpenRouterKeySchema = z30.object({
-      data: z30.object({
-        limit: z30.number().nonnegative().nullable(),
-        limit_remaining: z30.number().nullable(),
-        limit_reset: z30.string().nullable(),
-        is_free_tier: z30.boolean().optional(),
-        free_model_daily_requests: z30.object({ used: z30.number().nonnegative(), limit: z30.number().nonnegative(), remaining: z30.number() }).optional()
+    MS_PER_DAY3 = HOURS_PER_DAY6 * SECONDS_PER_HOUR3 * MS_PER_SECOND8;
+    OpenRouterKeySchema = z31.object({
+      data: z31.object({
+        limit: z31.number().nonnegative().nullable(),
+        limit_remaining: z31.number().nullable(),
+        limit_reset: z31.string().nullable(),
+        is_free_tier: z31.boolean().optional(),
+        free_model_daily_requests: z31.object({ used: z31.number().nonnegative(), limit: z31.number().nonnegative(), remaining: z31.number() }).optional()
       })
     });
-    OpenRouterCreditsSchema = z30.object({ data: z30.object({ total_credits: z30.number().nonnegative(), total_usage: z30.number().nonnegative() }) });
+    OpenRouterCreditsSchema = z31.object({ data: z31.object({ total_credits: z31.number().nonnegative(), total_usage: z31.number().nonnegative() }) });
     ANTIGRAVITY_HOST = "daily-cloudcode-pa.googleapis.com";
     ANTIGRAVITY_QUOTA_URL = `https://${ANTIGRAVITY_HOST}/v1internal:retrieveUserQuotaSummary`;
     ANTIGRAVITY_USER_URL = `https://${ANTIGRAVITY_HOST}/v1internal:loadCodeAssist`;
     FIVE_HOURS2 = 5;
     DAYS_PER_WEEK2 = 7;
-    FIVE_HOURS_MS = FIVE_HOURS2 * SECONDS_PER_HOUR2 * MS_PER_SECOND7;
-    WEEK_MS = DAYS_PER_WEEK2 * HOURS_PER_DAY5 * SECONDS_PER_HOUR2 * MS_PER_SECOND7;
-    AntigravityBucketSchema = z30.object({
-      bucketId: z30.string(),
-      remainingFraction: z30.number().optional(),
-      resetTime: z30.string().optional()
+    FIVE_HOURS_MS = FIVE_HOURS2 * SECONDS_PER_HOUR3 * MS_PER_SECOND8;
+    WEEK_MS = DAYS_PER_WEEK2 * HOURS_PER_DAY6 * SECONDS_PER_HOUR3 * MS_PER_SECOND8;
+    AntigravityBucketSchema = z31.object({
+      bucketId: z31.string(),
+      remainingFraction: z31.number().optional(),
+      resetTime: z31.string().optional()
     });
-    AntigravitySummarySchema = z30.object({ groups: z30.array(z30.object({ buckets: z30.array(AntigravityBucketSchema) })) });
-    GoogleTokenInfoSchema = z30.object({
-      email: z30.string().optional(),
-      sub: z30.string().optional()
+    AntigravitySummarySchema = z31.object({ groups: z31.array(z31.object({ buckets: z31.array(AntigravityBucketSchema) })) });
+    GoogleTokenInfoSchema = z31.object({
+      email: z31.string().optional(),
+      sub: z31.string().optional()
     });
-    AntigravityUserSchema = z30.object({
+    AntigravityUserSchema = z31.object({
       /** The code-assist tier context, which defaults to the free tier for every account. */
-      currentTier: z30.object({ name: z30.string().optional(), id: z30.string().optional() }).optional(),
+      currentTier: z31.object({ name: z31.string().optional(), id: z31.string().optional() }).optional(),
       /** The account's paid subscription; absent when the account has none. */
-      paidTier: z30.object({ name: z30.string().optional(), id: z30.string().optional() }).optional()
+      paidTier: z31.object({ name: z31.string().optional(), id: z31.string().optional() }).optional()
     });
   }
 });
@@ -9908,8 +9982,8 @@ function parseConnectTarget(authority) {
 function isInterceptedHost(host, interceptHosts) {
   return interceptHosts.includes(host);
 }
-function servedByPipeline(path42) {
-  return path42?.startsWith(ROUTED_PATH_PREFIX) === true;
+function servedByPipeline(path43) {
+  return path43?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
   "connection",
@@ -10703,11 +10777,11 @@ function createRcSessionTracker(deps) {
   };
   const observeExchange = (request4) => {
     const method = (request4.method ?? "").toUpperCase();
-    const path42 = new URL(request4.url ?? "/", "http://127.0.0.1").pathname;
-    if (!path42.startsWith(RC_SESSIONS_PATH_PREFIX)) {
+    const path43 = new URL(request4.url ?? "/", "http://127.0.0.1").pathname;
+    if (!path43.startsWith(RC_SESSIONS_PATH_PREFIX)) {
       return void 0;
     }
-    const tail = path42.slice(RC_SESSIONS_PATH_PREFIX.length);
+    const tail = path43.slice(RC_SESSIONS_PATH_PREFIX.length);
     const facts = {
       oauthAuthorization: oauthAuthorizationOf(request4.headers),
       anthropicVersion: singleHeader(request4.headers, "anthropic-version"),
@@ -11097,8 +11171,8 @@ var RC_READ_FILE_ENCODINGS = ["utf-8", "base64"];
 function isRcReadFileEncoding(value) {
   return RC_READ_FILE_ENCODINGS.some((encoding) => encoding === value);
 }
-function buildRcReadFilePayload(requestId, path42, options) {
-  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path42, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
+function buildRcReadFilePayload(requestId, path43, options) {
+  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path43, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
 }
 function buildRcFileSuggestionsPayload(requestId, query) {
   return buildRcControlRequestPayload(requestId, { subtype: "file_suggestions", query });
@@ -11200,15 +11274,15 @@ async function getRcSessionContextUsage(deps, sessionId, detail) {
   const result = await deliverRcClientPayload(deps, sessionId, buildRcGetContextUsagePayload(requestId, detail), `request the context usage of session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
-async function readRcSessionFile(deps, sessionId, path42, options) {
-  if (path42 === "") {
+async function readRcSessionFile(deps, sessionId, path43, options) {
+  if (path43 === "") {
     return { ok: false, message: "a read-file write needs a non-empty path: the SDK's own field names the file the worker resolves against the session's cwd, and an empty string names none" };
   }
   if (options?.maxBytes !== void 0 && (!Number.isInteger(options.maxBytes) || options.maxBytes <= 0)) {
     return { ok: false, message: "a read-file write's max-bytes is a positive whole number of bytes: the SDK's own field caps the read, and a zero or negative cap reads nothing" };
   }
   const requestId = deps.newUuid();
-  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path42, options), `read ${path42} from session ${sessionId}`);
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path43, options), `read ${path43} from session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
 async function suggestRcSessionFiles(deps, sessionId, query) {
@@ -11377,11 +11451,11 @@ function createRcControlHandler(deps) {
       path: "read-file",
       read: (body) => {
         const session = bodyString(body, "session");
-        const path42 = bodyString(body, "path");
+        const path43 = bodyString(body, "path");
         const maxBytes = "maxBytes" in body ? bodyPositiveInteger(body, "maxBytes") : void 0;
         const encoding = "encoding" in body && isRcReadFileEncoding(body.encoding) ? body.encoding : void 0;
-        const refused2 = session === void 0 || path42 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
-        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path42, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
+        const refused2 = session === void 0 || path43 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
+        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path43, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
       }
     },
     {
@@ -11691,9 +11765,9 @@ function requestIdOfBody(body) {
 }
 function frontDoorRcControl(transport, token) {
   const headers = { authorization: `Bearer ${token}` };
-  const listAnswerOf = async (path42, what) => {
+  const listAnswerOf = async (path43, what) => {
     try {
-      return await transport.request({ method: "GET", path: path42, headers });
+      return await transport.request({ method: "GET", path: path43, headers });
     } catch (error) {
       throw new Error(`${what}: could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
     }
@@ -11765,10 +11839,10 @@ function frontDoorRcControl(transport, token) {
     }
     return pending;
   };
-  const writeOf = async (path42, body, describeFailure2) => {
+  const writeOf = async (path43, body, describeFailure2) => {
     let answer;
     try {
-      answer = await transport.request({ method: "POST", path: path42, headers: { ...headers, "content-type": "application/json" }, body });
+      answer = await transport.request({ method: "POST", path: path43, headers: { ...headers, "content-type": "application/json" }, body });
     } catch (error) {
       return { ok: false, message: `could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}` };
     }
@@ -11799,10 +11873,10 @@ function frontDoorRcControl(transport, token) {
     endSession: async (sessionId, reason) => await writeOf(`${CONTROL_PATH_PREFIX}/end-session`, JSON.stringify({ session: sessionId, ...reason === void 0 ? {} : { reason } }), (status, message) => `ending ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getUsage: async (sessionId, skipBehaviors) => await writeOf(`${CONTROL_PATH_PREFIX}/get-usage`, JSON.stringify({ session: sessionId, ...skipBehaviors === void 0 ? {} : { skipBehaviors } }), (status, message) => `requesting the usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getContextUsage: async (sessionId, detail) => await writeOf(`${CONTROL_PATH_PREFIX}/get-context-usage`, JSON.stringify({ session: sessionId, ...detail === void 0 ? {} : { detail } }), (status, message) => `requesting the context usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
-    readFile: async (sessionId, path42, options) => await writeOf(
+    readFile: async (sessionId, path43, options) => await writeOf(
       `${CONTROL_PATH_PREFIX}/read-file`,
-      JSON.stringify({ session: sessionId, path: path42, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
-      (status, message) => `reading ${path42} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
+      JSON.stringify({ session: sessionId, path: path43, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
+      (status, message) => `reading ${path43} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
     ),
     fileSuggestions: async (sessionId, query) => await writeOf(`${CONTROL_PATH_PREFIX}/file-suggestions`, JSON.stringify({ session: sessionId, query }), (status, message) => `requesting file suggestions from ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     keepAlive: async (sessionId) => await writeOf(`${CONTROL_PATH_PREFIX}/keep-alive`, JSON.stringify({ session: sessionId }), (status, message) => `keeping ${sessionId} alive failed (HTTP ${String(status)}): ${message}`),
@@ -11961,12 +12035,12 @@ function tlsFacts(options) {
 }
 function realRcEventDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const post = async (path42, headers, body) => await new Promise((resolve, reject) => {
+  const post = async (path43, headers, body) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method: "POST",
-      path: path42,
+      path: path43,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, "content-length": String(Buffer.byteLength(body, "utf8")) },
       agent
@@ -12031,12 +12105,12 @@ function lateRcStreamDial(resolve) {
 }
 function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const request4 = async (method, path42, headers, body, signal) => await new Promise((resolve, reject) => {
+  const request4 = async (method, path43, headers, body, signal) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method,
-      path: path42,
+      path: path43,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, ...body === void 0 ? {} : { "content-length": String(Buffer.byteLength(body, "utf8")) } },
       agent,
@@ -12078,9 +12152,9 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
       return { status, body: await readAll(response) };
     },
     openStream: async (sessionId, headers, resume, signal) => {
-      const path42 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
+      const path43 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
       const streamHeaders = resume === void 0 ? headers : { ...headers, "last-event-id": String(resume.fromSequenceNum) };
-      const { status, response } = await request4("GET", path42, streamHeaders, void 0, signal);
+      const { status, response } = await request4("GET", path43, streamHeaders, void 0, signal);
       if (!isSuccessful2(status)) {
         await readAll(response);
         return { status, chunks: NO_CHUNKS };
@@ -13232,19 +13306,19 @@ function writePools(paths, pools) {
   applyPatch(paths.globalConfigFile, GlobalConfigSchema, { pools }, { defaults: {} });
 }
 function poolCycleOf(pools, name) {
-  const walk = (current, path42) => {
+  const walk = (current, path43) => {
     for (const entry of pools[current]?.identities ?? []) {
       const nested = poolNameOf(poolMemberIdentity(entry));
       if (nested === void 0) {
         continue;
       }
       if (nested === name) {
-        return [...path42, nested];
+        return [...path43, nested];
       }
-      if (path42.includes(nested)) {
+      if (path43.includes(nested)) {
         continue;
       }
-      const found = walk(nested, [...path42, nested]);
+      const found = walk(nested, [...path43, nested]);
       if (found !== void 0) {
         return found;
       }
@@ -15523,7 +15597,7 @@ function profileValue(name, paths) {
 function createConfigApiRouter(deps) {
   const authed = doorApiAuth(deps.expectedToken);
   const { paths } = deps;
-  const route = (path42, summary) => authed.meta(openapi3({ method: "POST", path: path42, summary, tags: [CONFIG_API_TAG] }));
+  const route = (path43, summary) => authed.meta(openapi3({ method: "POST", path: path43, summary, tags: [CONFIG_API_TAG] }));
   return {
     config: {
       identity: {