claude-use 11.62.2 → 11.63.0

package/dist/types/index.d.ts

@@ -4,6 +4,7 @@ import * as zod from 'zod';
 import { z } from 'zod';
 import { IncomingHttpHeaders, IncomingMessage, ServerResponse } from 'node:http';
 import * as net from 'node:net';
+import net__default from 'node:net';
 import { Duplex, Readable } from 'node:stream';
 import * as _orpc_client from '@orpc/client';
 import * as zod_v4_core from 'zod/v4/core';
@@ -296,8 +297,8 @@ declare const LaunchSchema: z.ZodObject<{
         }>>;
         layout: z.ZodOptional<z.ZodObject<{
             header: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-                model: "model";
                 account: "account";
+                model: "model";
                 identity: "identity";
                 provider: "provider";
                 version: "version";
@@ -1427,8 +1428,8 @@ declare const ConfigProfileSchema: z.ZodObject<{
             }>>;
             layout: z.ZodOptional<z.ZodObject<{
                 header: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-                    model: "model";
                     account: "account";
+                    model: "model";
                     identity: "identity";
                     provider: "provider";
                     version: "version";
@@ -2178,8 +2179,8 @@ declare const DirectoryRuleSchema: z.ZodObject<{
             }>>;
             layout: z.ZodOptional<z.ZodObject<{
                 header: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-                    model: "model";
                     account: "account";
+                    model: "model";
                     identity: "identity";
                     provider: "provider";
                     version: "version";
@@ -2856,8 +2857,8 @@ declare const DirectoryRulesSchema: z.ZodObject<{
                 }>>;
                 layout: z.ZodOptional<z.ZodObject<{
                     header: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-                        model: "model";
                         account: "account";
+                        model: "model";
                         identity: "identity";
                         provider: "provider";
                         version: "version";
@@ -3534,8 +3535,8 @@ declare const PortableConfigSchema: z.ZodObject<{
             }>>;
             layout: z.ZodOptional<z.ZodObject<{
                 header: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-                    model: "model";
                     account: "account";
+                    model: "model";
                     identity: "identity";
                     provider: "provider";
                     version: "version";
@@ -4193,8 +4194,8 @@ declare const GlobalConfigSchema: z.ZodObject<{
             }>>;
             layout: z.ZodOptional<z.ZodObject<{
                 header: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-                    model: "model";
                     account: "account";
+                    model: "model";
                     identity: "identity";
                     provider: "provider";
                     version: "version";
@@ -5785,6 +5786,42 @@ interface ConnectCapture {
     readonly upgrade: (request: CapturedRequestShape) => void;
 }
 
+/**
+ * The listening-socket handover between a serving front door and the successor it starts for a planned replacement (`agent-shim frontdoor restart`, `agent-shim update --restart-door`), so the sticky addresses never stop accepting: the kernel's accept queue for each listener is held by the old door until the successor holds it too, and only then does the old door stop accepting and drain.
+ *
+ * The two doors speak over the IPC channel Node opens between a parent and the child it spawns with one, and each listening socket crosses it as a handle attached to a message (`child.send(message, server)`), which is the only way Node passes a listening socket between processes. The successor asks for each listener only once its own server for that listener is built, and adopts the handle in the same turn the message is delivered in: Node starts accepting on a received listening handle inside a server of its own before it hands the handle over, and a connection accepted there before the successor's server adopts it would reach a server with no connection listener and hang. Asking per listener keeps every adoption inside one delivery.
+ *
+ * The exchange, in order: the successor sends `take` naming one listener; the old door answers with `listener` naming it and carrying the handle; once the successor has adopted all three and recorded itself as the owner in the state file, it sends `serving` and ends the channel. The old door then drains exactly as it does on `SIGTERM`. Any other outcome (the successor exits or ends the channel early, sends something this release cannot read, or is still not serving when the budget ends) ends the successor if it is still running and leaves the old door to drain the ordinary way, so the replacement still happens, through the path that has a gap.
+ */
+/** Where a listener's socket comes from: bound afresh, preferring the sticky port and taking any free one when it is held, or adopted from the door being replaced. */
+type ListenSource = {
+    readonly preferredPort: number | undefined;
+} | {
+    readonly inherit: () => Promise<net__default.Server>;
+};
+/** The listeners a door hands over: the HTTPS provider listener, the CONNECT surface, and the plain-HTTP direct listener. */
+declare const HANDOVER_LISTENERS: readonly ["provider", "connect", "direct"];
+type HandoverListenerName = (typeof HANDOVER_LISTENERS)[number];
+/** The listening sockets a door hands over, one per listener. */
+type HandoverSockets = Readonly<Record<HandoverListenerName, net__default.Server>>;
+/** How a handover ended, as the old door sees it. */
+type HandoverOutcome = {
+    readonly ok: true;
+    readonly successorPid: number;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};
+/** What a successor door does with the channel to the door it replaces: take each listener's socket, then report that it serves. */
+interface Predecessor {
+    /**
+     * Asks for one listener's socket and resolves with it in the turn the old door's answer is delivered in, so the caller's continuation (which must adopt it at once, see the module comment) runs before the event loop can accept a connection on it. Rejects when the channel ends first or the answer cannot be read.
+     */
+    readonly take: (listener: HandoverListenerName) => Promise<net__default.Server>;
+    /** Tells the old door this door accepts on every listener and owns the state file, then ends the channel. */
+    readonly serving: () => void;
+}
+
 /**
  * The front door's CONNECT surface, so an OAuth session can have agent-shim's routing AND Claude Code's Remote Control at once: Remote Control refuses any `ANTHROPIC_BASE_URL` other than the real API, but happily honours `HTTPS_PROXY`, so OAuth launches route at the proxy layer instead.
  *
@@ -5892,6 +5929,8 @@ type ConnectRequestHandler = (request: IncomingMessage, response: ServerResponse
 /** A bound loopback listener and how to stop it. */
 interface ConnectListenerHandle {
     readonly port: number;
+    /** The listening socket itself, which a planned replacement hands to the successor door (see `./handover.ts`). */
+    readonly listening: net.Server;
     /** Stops accepting and releases the port at once, leaving every connection already accepted open: a successor can bind the same port while they finish. */
     readonly stopAccepting: () => void;
     /** Stops accepting, ends every live connection, and resolves once the port is released. */
@@ -5920,8 +5959,8 @@ interface HttpParserSession {
  * Every effect the MITM proxy performs, injected so the routing decisions and lifecycle run against fakes in unit tests (the SupervisorPorts pattern): TCP listening, TLS termination, HTTP parsing, plain TCP tunnels, and request forwarding. The real implementation is `realConnectEffects`; the TLS round-trip test uses it with redirected targets.
  */
 interface ConnectEffects {
-    /** Binds a loopback TCP listener; `preferredPort` is tried first and any free port used when it is taken (bind, do not probe: check-then-bind races). Resolves with the bound port and a close handle. */
-    readonly listenLoopback: (preferredPort: number | undefined, onSocket: (socket: net.Socket) => void) => Promise<ConnectListenerHandle>;
+    /** Binds a loopback TCP listener, or adopts the one `source` inherits from the door being replaced; a bound one tries the preferred port first and uses any free port when it is taken (bind, do not probe: check-then-bind races). Resolves with the bound port and a close handle. */
+    readonly listenLoopback: (source: ListenSource, onSocket: (socket: net.Socket) => void) => Promise<ConnectListenerHandle>;
     /** Builds the TLS terminator for one leaf, handing each successfully handshaked session to `onSecure` together with the context its `accept` call carried. `alpnProtocols`, when given, is advertised during the handshake, which is how a tap host's session can offer HTTP/2 the way its real server does. */
     readonly createTlsAcceptor: (leaf: LeafCert, onSecure: (secure: net.Socket, context: string) => void, alpnProtocols?: readonly string[]) => TlsAcceptor;
     /** Builds the transparent surface's TLS terminator: one handshake whose SNI name selects which served host's leaf answers it, so a connection redirected from any of the hosts sharing the redirected address is terminated as the host it named. A name the surface does not serve is answered with no certificate at all (a client that sends no SNI never reaches the selection and finds no default certificate either), because the only leaf that could answer such a name is another host's, which the client's own hostname check would reject anyway. No ALPN is offered: node's TLS server negotiates ALPN from the listener's own options and ignores protocols named on an SNI-selected secure context, and the API host's terminated session is parsed as HTTP/1.1, which a negotiated `h2` would strand. */
@@ -5975,12 +6014,14 @@ interface ConnectServerConfig {
 /** A running connect surface. */
 interface ConnectServerHandle {
     readonly port: number;
+    /** The CONNECT listener's listening socket, which a planned replacement hands to the successor door (see `./handover.ts`). The transparent listener is not handed over: it exists only when the door's own environment asks for it, which a successor decides for itself. */
+    readonly listening: net.Server;
     /** The transparent listener's port, when one was requested: what an operating-system redirect should point at. */
     readonly transparentPort?: number;
     /** How many authenticated connections (blind tunnels and terminated sessions together) are open now: what closing this surface, or exiting its process, drops. */
     readonly openTunnels: () => number;
     /**
-     * Retires the surface without cutting off the tunnels it carries: the port is released at once so a successor can bind it, every connection that is not a blind tunnel (the terminated sessions, which carry this door's own routing state, and connections still waiting for their head) is ended, and the blind tunnels, which are byte pumps to hosts the door never looks into, keep running until they end by themselves or their launch ends. Resolves when the last has, with the surface fully closed.
+     * Retires the surface without cutting off the tunnels it carries: the port is released at once so a successor can bind it, the terminated sessions (which carry this door's own routing state) are ended so their clients reconnect to the successor, and the blind tunnels, which are byte pumps to hosts the door never looks into, keep running until they end by themselves or their launch ends. A connection the listener accepted before it stopped but whose head has not arrived yet is still answered: its blind tunnel runs like any other, its terminated session serves one request and ends, and one whose head never comes is refused at its deadline. Resolves when the last connection has closed, with the surface fully closed.
      */
     readonly drain: () => Promise<void>;
     /** Stops the listener, drops every live tunnel and terminated session, and resolves once the port is released. */
@@ -6002,7 +6043,7 @@ interface ConnectLocalSurface {
  *
  * The connection flow: read the CONNECT head within the deadline (never more of the stream than that, so an early ClientHello glued to the head is pushed back with `unshift` and still seen by whatever consumes the socket next), authenticate it, then either blind-tunnel the target or terminate its TLS and parse HTTP on the session. Every network effect flows through `effects`; nothing here touches the network or filesystem itself.
  */
-declare function startConnectServer(config: ConnectServerConfig, effects: ConnectEffects, preferredPort: number | undefined): Promise<ConnectServerHandle>;
+declare function startConnectServer(config: ConnectServerConfig, effects: ConnectEffects, source: ListenSource): Promise<ConnectServerHandle>;
 /** The real `ConnectCertStore` on the filesystem: `ca.pem` world-readable (it is public material), `ca.key` mode 0600 exactly, chmod'ed after the write because a create's mode bits pass through the process umask. */
 declare function realConnectCertStore(paths: {
     readonly frontdoorCaDir: string;
@@ -9019,6 +9060,7 @@ declare function createConfigApiRouter(deps: ConfigApiDeps): {
                 kind: zod.ZodLiteral<"profile">;
                 name: zod.ZodString;
                 value: zod.ZodObject<{
+                    description: zod.ZodOptional<zod.ZodString>;
                     entries: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnion<readonly [zod.ZodBoolean, zod.ZodObject<{
                         value: zod.ZodBoolean;
                         when: zod.ZodUnion<readonly [zod.ZodObject<{
@@ -9094,7 +9136,6 @@ declare function createConfigApiRouter(deps: ConfigApiDeps): {
                             key: zod.ZodType<trilean.JsonValue, unknown, zod_v4_core.$ZodTypeInternals<trilean.JsonValue, unknown>>;
                         }, zod_v4_core.$strip>], "kind">]>;
                     }, zod_v4_core.$strict>]>>>;
-                    description: zod.ZodOptional<zod.ZodString>;
                     models: zod.ZodOptional<zod.ZodObject<{
                         virtual: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnion<readonly [zod.ZodObject<{
                             mode: zod.ZodEnum<{
@@ -9182,8 +9223,8 @@ declare function createConfigApiRouter(deps: ConfigApiDeps): {
                             }>>;
                             layout: zod.ZodOptional<zod.ZodObject<{
                                 header: zod.ZodOptional<zod.ZodArray<zod.ZodEnum<{
-                                    model: "model";
                                     account: "account";
+                                    model: "model";
                                     identity: "identity";
                                     provider: "provider";
                                     version: "version";
@@ -9645,6 +9686,7 @@ declare function createConfigApiRouter(deps: ConfigApiDeps): {
                 kind: zod.ZodLiteral<"profile">;
                 name: zod.ZodString;
                 value: zod.ZodObject<{
+                    description: zod.ZodOptional<zod.ZodString>;
                     entries: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnion<readonly [zod.ZodBoolean, zod.ZodObject<{
                         value: zod.ZodBoolean;
                         when: zod.ZodUnion<readonly [zod.ZodObject<{
@@ -9720,7 +9762,6 @@ declare function createConfigApiRouter(deps: ConfigApiDeps): {
                             key: zod.ZodType<trilean.JsonValue, unknown, zod_v4_core.$ZodTypeInternals<trilean.JsonValue, unknown>>;
                         }, zod_v4_core.$strip>], "kind">]>;
                     }, zod_v4_core.$strict>]>>>;
-                    description: zod.ZodOptional<zod.ZodString>;
                     models: zod.ZodOptional<zod.ZodObject<{
                         virtual: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnion<readonly [zod.ZodObject<{
                             mode: zod.ZodEnum<{
@@ -9808,8 +9849,8 @@ declare function createConfigApiRouter(deps: ConfigApiDeps): {
                             }>>;
                             layout: zod.ZodOptional<zod.ZodObject<{
                                 header: zod.ZodOptional<zod.ZodArray<zod.ZodEnum<{
-                                    model: "model";
                                     account: "account";
+                                    model: "model";
                                     identity: "identity";
                                     provider: "provider";
                                     version: "version";
@@ -10910,8 +10951,8 @@ declare function createConfigApiRouter(deps: ConfigApiDeps): {
                             }>>;
                             layout: zod.ZodOptional<zod.ZodObject<{
                                 header: zod.ZodOptional<zod.ZodArray<zod.ZodEnum<{
-                                    model: "model";
                                     account: "account";
+                                    model: "model";
                                     identity: "identity";
                                     provider: "provider";
                                     version: "version";
@@ -11593,8 +11634,8 @@ declare function createConfigApiRouter(deps: ConfigApiDeps): {
                             }>>;
                             layout: zod.ZodOptional<zod.ZodObject<{
                                 header: zod.ZodOptional<zod.ZodArray<zod.ZodEnum<{
-                                    model: "model";
                                     account: "account";
+                                    model: "model";
                                     identity: "identity";
                                     provider: "provider";
                                     version: "version";
@@ -12365,8 +12406,8 @@ declare const StatuslineSchema: z.ZodObject<{
     }>>;
     layout: z.ZodOptional<z.ZodObject<{
         header: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-            model: "model";
             account: "account";
+            model: "model";
             identity: "identity";
             provider: "provider";
             version: "version";
@@ -13128,8 +13169,8 @@ declare function createLaunchApiRouter(deps: LaunchApiDeps): {
                     }>>;
                     layout: zod.ZodOptional<zod.ZodObject<{
                         header: zod.ZodOptional<zod.ZodArray<zod.ZodEnum<{
-                            model: "model";
                             account: "account";
+                            model: "model";
                             identity: "identity";
                             provider: "provider";
                             version: "version";
@@ -14702,8 +14743,8 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                     }>>;
                     layout: zod.ZodOptional<zod.ZodObject<{
                         header: zod.ZodOptional<zod.ZodArray<zod.ZodEnum<{
-                            model: "model";
                             account: "account";
+                            model: "model";
                             identity: "identity";
                             provider: "provider";
                             version: "version";
@@ -15405,6 +15446,7 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                 kind: zod.ZodLiteral<"profile">;
                 name: zod.ZodString;
                 value: zod.ZodObject<{
+                    description: zod.ZodOptional<zod.ZodString>;
                     entries: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnion<readonly [zod.ZodBoolean, zod.ZodObject<{
                         value: zod.ZodBoolean;
                         when: zod.ZodUnion<readonly [zod.ZodObject<{
@@ -15480,7 +15522,6 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                             key: zod.ZodType<trilean.JsonValue, unknown, zod_v4_core.$ZodTypeInternals<trilean.JsonValue, unknown>>;
                         }, zod_v4_core.$strip>], "kind">]>;
                     }, zod_v4_core.$strict>]>>>;
-                    description: zod.ZodOptional<zod.ZodString>;
                     models: zod.ZodOptional<zod.ZodObject<{
                         virtual: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnion<readonly [zod.ZodObject<{
                             mode: zod.ZodEnum<{
@@ -15568,8 +15609,8 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                             }>>;
                             layout: zod.ZodOptional<zod.ZodObject<{
                                 header: zod.ZodOptional<zod.ZodArray<zod.ZodEnum<{
-                                    model: "model";
                                     account: "account";
+                                    model: "model";
                                     identity: "identity";
                                     provider: "provider";
                                     version: "version";
@@ -16031,6 +16072,7 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                 kind: zod.ZodLiteral<"profile">;
                 name: zod.ZodString;
                 value: zod.ZodObject<{
+                    description: zod.ZodOptional<zod.ZodString>;
                     entries: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnion<readonly [zod.ZodBoolean, zod.ZodObject<{
                         value: zod.ZodBoolean;
                         when: zod.ZodUnion<readonly [zod.ZodObject<{
@@ -16106,7 +16148,6 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                             key: zod.ZodType<trilean.JsonValue, unknown, zod_v4_core.$ZodTypeInternals<trilean.JsonValue, unknown>>;
                         }, zod_v4_core.$strip>], "kind">]>;
                     }, zod_v4_core.$strict>]>>>;
-                    description: zod.ZodOptional<zod.ZodString>;
                     models: zod.ZodOptional<zod.ZodObject<{
                         virtual: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnion<readonly [zod.ZodObject<{
                             mode: zod.ZodEnum<{
@@ -16194,8 +16235,8 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                             }>>;
                             layout: zod.ZodOptional<zod.ZodObject<{
                                 header: zod.ZodOptional<zod.ZodArray<zod.ZodEnum<{
-                                    model: "model";
                                     account: "account";
+                                    model: "model";
                                     identity: "identity";
                                     provider: "provider";
                                     version: "version";
@@ -17296,8 +17337,8 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                             }>>;
                             layout: zod.ZodOptional<zod.ZodObject<{
                                 header: zod.ZodOptional<zod.ZodArray<zod.ZodEnum<{
-                                    model: "model";
                                     account: "account";
+                                    model: "model";
                                     identity: "identity";
                                     provider: "provider";
                                     version: "version";
@@ -17979,8 +18020,8 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                             }>>;
                             layout: zod.ZodOptional<zod.ZodObject<{
                                 header: zod.ZodOptional<zod.ZodArray<zod.ZodEnum<{
-                                    model: "model";
                                     account: "account";
+                                    model: "model";
                                     identity: "identity";
                                     provider: "provider";
                                     version: "version";
@@ -19540,6 +19581,7 @@ declare const ConfigProfileAddOutputSchema: z.ZodObject<{
     kind: z.ZodLiteral<"profile">;
     name: z.ZodString;
     value: z.ZodObject<{
+        description: z.ZodOptional<z.ZodString>;
         entries: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
             value: z.ZodBoolean;
             when: z.ZodUnion<readonly [z.ZodObject<{
@@ -19615,7 +19657,6 @@ declare const ConfigProfileAddOutputSchema: z.ZodObject<{
                 key: z.ZodType<trilean.JsonValue, unknown, z.core.$ZodTypeInternals<trilean.JsonValue, unknown>>;
             }, z.core.$strip>], "kind">]>;
         }, z.core.$strict>]>>>;
-        description: z.ZodOptional<z.ZodString>;
         models: z.ZodOptional<z.ZodObject<{
             virtual: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
                 mode: z.ZodEnum<{
@@ -19703,8 +19744,8 @@ declare const ConfigProfileAddOutputSchema: z.ZodObject<{
                 }>>;
                 layout: z.ZodOptional<z.ZodObject<{
                     header: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-                        model: "model";
                         account: "account";
+                        model: "model";
                         identity: "identity";
                         provider: "provider";
                         version: "version";
@@ -20168,6 +20209,7 @@ declare const ConfigProfileSetOutputSchema: z.ZodObject<{
     kind: z.ZodLiteral<"profile">;
     name: z.ZodString;
     value: z.ZodObject<{
+        description: z.ZodOptional<z.ZodString>;
         entries: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
             value: z.ZodBoolean;
             when: z.ZodUnion<readonly [z.ZodObject<{
@@ -20243,7 +20285,6 @@ declare const ConfigProfileSetOutputSchema: z.ZodObject<{
                 key: z.ZodType<trilean.JsonValue, unknown, z.core.$ZodTypeInternals<trilean.JsonValue, unknown>>;
             }, z.core.$strip>], "kind">]>;
         }, z.core.$strict>]>>>;
-        description: z.ZodOptional<z.ZodString>;
         models: z.ZodOptional<z.ZodObject<{
             virtual: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
                 mode: z.ZodEnum<{
@@ -20331,8 +20372,8 @@ declare const ConfigProfileSetOutputSchema: z.ZodObject<{
                 }>>;
                 layout: z.ZodOptional<z.ZodObject<{
                     header: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-                        model: "model";
                         account: "account";
+                        model: "model";
                         identity: "identity";
                         provider: "provider";
                         version: "version";
@@ -21435,8 +21476,8 @@ declare const ConfigRuleAddOutputSchema: z.ZodObject<{
                 }>>;
                 layout: z.ZodOptional<z.ZodObject<{
                     header: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-                        model: "model";
                         account: "account";
+                        model: "model";
                         identity: "identity";
                         provider: "provider";
                         version: "version";
@@ -22120,8 +22161,8 @@ declare const ConfigRuleSetOutputSchema: z.ZodObject<{
                 }>>;
                 layout: z.ZodOptional<z.ZodObject<{
                     header: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-                        model: "model";
                         account: "account";
+                        model: "model";
                         identity: "identity";
                         provider: "provider";
                         version: "version";
@@ -23062,8 +23103,8 @@ declare const LaunchResolveOutputSchema: z.ZodObject<{
             }>>;
             layout: z.ZodOptional<z.ZodObject<{
                 header: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-                    model: "model";
                     account: "account";
+                    model: "model";
                     identity: "identity";
                     provider: "provider";
                     version: "version";
@@ -23843,6 +23884,10 @@ interface EnsureFrontDoorPorts {
     readonly verifyListener: (port: number) => ListenerVerdict;
     /** Asks a running front-door supervisor to exit, without waiting for it to: the caller polls `isRunning`. Only ever called for a pid whose recorded listener has just authenticated as agent-shim's own, or whose process is agent-shim's front-door supervisor (`isFrontDoorSupervisor`). */
     readonly stopSupervisor: (pid: number) => void;
+    /**
+     * Asks a running front-door supervisor to hand its listening sockets to a successor it starts itself (see `./handover.ts`), without waiting for it to: the caller polls the state file for the successor. Only ever called for a pid whose listener has just authenticated, whose recorded protocol is `FRONT_DOOR_HANDOVER_PROTOCOL` or later, and whose process is agent-shim's own front-door supervisor, the process that installs the handler for the request. Absent where the platform has no way to deliver the request (Windows, which has no user signals), so every replacement there takes the stop-and-start path.
+     */
+    readonly requestHandover?: (pid: number) => void;
     /** Appends one line to the front door's own log. Called before every signal sent to a door, so the door's log names the cause of its own exit. */
     readonly recordReplacement: (line: string) => void;
     /** Ends a supervisor that did not exit when asked to, without giving it the chance to refuse: a door whose event loop is blocked never runs its signal handler. Called only for a pid `isFrontDoorSupervisor` has just confirmed, after `stopSupervisor` and a grace period. */
@@ -23869,10 +23914,8 @@ declare function ensureFrontDoor(params: {
     readonly token: string;
 };
 
-/** What the supervisor holds: a beat from each tick of its main loop, and a stop when it begins to retire. */
+/** What the supervisor holds: a stop for when it begins to retire. The beat that tells the watchdog the main event loop ran comes from the watchdog's own timer on that loop (see `startThreadWatchdog`), not from the supervisor's tick, so nothing a tick awaits (a `ps` run a loaded machine is slow to finish) is taken for a loop that did not run. */
 interface DoorWatchdog {
-    /** Records that the main event loop ran. Called from the supervisor's tick, which only runs while the loop serves. */
-    readonly beat: () => void;
     /** Ends the watchdog before the door begins an orderly retirement, so a slow close is never taken for a stall. Idempotent. */
     readonly stop: () => void;
 }
@@ -23880,6 +23923,8 @@ interface DoorWatchdog {
 /** A bound front-door listener in this process, and how to stop it. */
 interface FrontDoorListenerHandle {
     readonly port: number;
+    /** The listening socket itself, which a planned replacement hands to the successor door (see `./handover.ts`). */
+    readonly listening: net__default.Server;
     /** Stops accepting, ends every live connection, and resolves once the port is released. */
     readonly close: () => Promise<void>;
     /** Releases the port at once (before the first await) and leaves the work already in progress to finish; resolves when the listener has nothing left to carry. */
@@ -23913,29 +23958,40 @@ interface FrontDoorSupervisorPorts {
      */
     readonly runningAmong: (pids: readonly number[]) => Promise<ReadonlySet<number>>;
     /**
-     * Starts the provider listener in this process on `preferredPort` (falling back to any free port when the sticky one is taken, decided at bind time rather than by a racy check-then-bind probe) and resolves once it has bound and answered its own health probe over TLS. This is the HTTPS listener every provider session's base URL points at, serving a loopback leaf signed by agent-shim's CA.
+     * Starts the provider listener in this process from `source`: bound on its preferred port (falling back to any free port when the sticky one is taken, decided at bind time rather than by a racy check-then-bind probe), or adopted from the door this one replaces. Resolves once it accepts and has answered its own health probe over TLS. This is the HTTPS listener every provider session's base URL points at, serving a loopback leaf signed by agent-shim's CA.
      */
-    readonly startProviderListener: (preferredPort: number | undefined) => Promise<FrontDoorListenerHandle>;
+    readonly startProviderListener: (source: ListenSource) => Promise<FrontDoorListenerHandle>;
     /**
-     * Starts the CONNECT surface in this process on `preferredPort` (same bind-time fallback): the TLS-terminating listener an OAuth session's HTTPS_PROXY points at. Bound before any state names it, so an OAuth launch never finds one listener up without the other.
+     * Starts the CONNECT surface in this process from `source` (same bind-time fallback, or adopted): the TLS-terminating listener an OAuth session's HTTPS_PROXY points at. Bound before any state names it, so an OAuth launch never finds one listener up without the other.
      */
-    readonly startConnectListener: (preferredPort: number | undefined) => Promise<FrontDoorListenerHandle>;
+    readonly startConnectListener: (source: ListenSource) => Promise<FrontDoorListenerHandle>;
     /**
-     * Starts the direct listener on `preferredPort` (same bind-time fallback): the same routes as the provider listener, minus the headroom hop, over plain HTTP because headroom is what connects to it. Headroom forwards routed traffic back here, which is what keeps the hop from looping, and the port is sticky like the others because headroom's allowlist admits its exact origin. It admits only the hop's own requests and holds no credential until it redeems one from the hop's custody.
+     * Starts the direct listener from `source` (same bind-time fallback, or adopted): the same routes as the provider listener, minus the headroom hop, over plain HTTP because headroom is what connects to it. Headroom forwards routed traffic back here, which is what keeps the hop from looping, and the port is sticky like the others because headroom's allowlist admits its exact origin. It admits only the hop's own requests and holds no credential until it redeems one from the hop's custody.
      */
-    readonly startDirectListener: (preferredPort: number | undefined) => Promise<FrontDoorListenerHandle>;
+    readonly startDirectListener: (source: ListenSource) => Promise<FrontDoorListenerHandle>;
     /**
      * Stops the Remote Control stream hub: persists every live attachment's sequence cursor synchronously, then frees the dials. Called exactly once on every exit the supervisor owns, after every listener has stopped accepting. A closing exit has every listener down by then; a drain still has responses settling, which is safe because the hub refuses to attach once it is closed (otherwise the reconcile after an observed exchange would re-attach a stream the close had just ended).
      */
     readonly closeRcStreamHub: () => void;
     /**
-     * Starts the watchdog that ends this process when its main event loop stops running: it lives on its own thread, so a loop that is blocked cannot stall it. The supervisor beats it every tick and stops it before it begins to retire, so it only ever judges a door that is meant to be serving. Optional because ending the process is only right when the process is the door: the CLI's `__frontdoor-supervisor` supplies it, and a library host that runs the door inside its own process does not get its application killed by default.
+     * Starts the watchdog that ends this process when its main event loop stops running: it lives on its own thread, so a loop that is blocked cannot stall it. It beats from its own timer on the main loop rather than from the tick, so a tick waiting on a slow `ps` is never taken for a loop that stopped, and the supervisor stops it before it begins to retire, so it only ever judges a door that is meant to be serving. Optional because ending the process is only right when the process is the door: the CLI's `__frontdoor-supervisor` supplies it, and a library host that runs the door inside its own process does not get its application killed by default.
      */
     readonly startWatchdog?: () => DoorWatchdog;
     /**
      * Aborted when the process is asked to exit (the CLI's `__frontdoor-supervisor` aborts it on its first SIGTERM or SIGINT). The door then retires by draining: it releases its listening addresses at once, so a successor can bind the same sticky ports, ends what holds its own routing state, and stays up only as long as the connections it still carries (blind tunnels, a response being streamed) take to end. Optional for a host that decides when the door stops by other means.
      */
     readonly retire?: AbortSignal;
+    /**
+     * A planned replacement that keeps every address accepting (see `./handover.ts`): `requested` is aborted when a launcher asks this door to hand its listeners to a successor (the CLI's `__frontdoor-supervisor` aborts it on `SIGUSR2`), and `run` starts the successor, hands it the three listening sockets and resolves once it serves them or with why it did not. The door keeps accepting throughout and drains afterwards either way, so a failed handover still ends in the ordinary replacement. Optional because only a door whose process can start a successor of itself can offer it.
+     */
+    readonly handover?: {
+        readonly requested: AbortSignal;
+        readonly run: (sockets: HandoverSockets) => Promise<HandoverOutcome>;
+    };
+    /**
+     * The door this one replaces through a handover, when it was started for one: its listeners are adopted from that door's sockets instead of bound, the state file is not written until this door accepts on all three (the old door owns it and keeps serving until then), and the old door is told once this door serves. Absent for every other start.
+     */
+    readonly predecessor?: Predecessor;
     /** Stops the work the door runs on its own account rather than for a request (the usage, window, job and catalogue keepers), called once when a drain begins so the successor's are the only ones acting. Optional because a host without such work has nothing to stop. */
     readonly stopBackgroundWork?: () => void;
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-use",
-  "version": "11.62.2",
+  "version": "11.63.0",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",