claude-use 11.65.0 → 11.65.2

package/dist/index.mjs

@@ -1256,7 +1256,7 @@ function parseIgnoringUnrecognisedKeys(schema, raw) {
   return second.success ? { success: true, data: second.data, ignored } : { success: false, issues: second.error.issues };
 }
 function describeIgnoredKeys(filePath, ignored) {
-  const places = ignored.map(({ path: path41, keys }) => `${path41.length === 0 ? "" : `${path41.map(String).join(".")}.`}${keys.join(", ")}`);
+  const places = ignored.map(({ path: path42, keys }) => `${path42.length === 0 ? "" : `${path42.map(String).join(".")}.`}${keys.join(", ")}`);
   return `${filePath} has settings this version of agent-shim does not know and ignores: ${places.join("; ")}. A newer release may read them.`;
 }
 function noteIgnoredKeys(filePath, ignored) {
@@ -1278,9 +1278,9 @@ function restoreIgnoredKeys(filePath, value) {
     return value;
   }
   const restored = structuredClone(value);
-  for (const { path: path41, values } of ignored) {
+  for (const { path: path42, values } of ignored) {
     let holder = restored;
-    for (const step of path41) {
+    for (const step of path42) {
       holder = isRecord(holder) ? holder[step] : void 0;
     }
     if (isRecord(holder)) {
@@ -3911,28 +3911,38 @@ function recordOf(details) {
 }
 function writeFrontDoorSession(fs14, sessionsDir, session) {
   fs14.mkdirPrivate(sessionsDir);
-  fs14.writeFilePrivate(path9.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
+  fs14.writeFilePrivate(path9.join(sessionsDir, sessionRecordName(session.pid)), `${JSON.stringify(session, null, 2)}
 `);
 }
+function sessionRecordName(pid) {
+  return `${String(pid)}.json`;
+}
+function isSessionRecordName(name) {
+  return name.endsWith(".json");
+}
+function summaryOf(session) {
+  return { pid: session.pid, startedAt: session.startedAt, ...session.supervisorPid === void 0 ? {} : { supervisorPid: session.supervisorPid } };
+}
+function readFrontDoorSessionRecord(fs14, sessionsDir, name) {
+  try {
+    const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs14.readFileUtf8(path9.join(sessionsDir, name)) ?? ""));
+    return parsed.success ? parsed.data : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function listFrontDoorSessions(fs14, sessionsDir) {
   const sessions = [];
   for (const name of fs14.readdir(sessionsDir)) {
-    if (!name.endsWith(".json")) {
-      continue;
-    }
-    try {
-      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs14.readFileUtf8(path9.join(sessionsDir, name)) ?? ""));
-      if (parsed.success) {
-        sessions.push({ pid: parsed.data.pid, startedAt: parsed.data.startedAt, ...parsed.data.supervisorPid === void 0 ? {} : { supervisorPid: parsed.data.supervisorPid } });
-      }
-    } catch {
-      continue;
+    const record = isSessionRecordName(name) ? readFrontDoorSessionRecord(fs14, sessionsDir, name) : void 0;
+    if (record !== void 0) {
+      sessions.push(summaryOf(record));
     }
   }
   return sessions.sort((a, b) => a.pid - b.pid);
 }
 function removeFrontDoorSession(fs14, sessionsDir, pid) {
-  fs14.removeRecursive(path9.join(sessionsDir, `${String(pid)}.json`));
+  fs14.removeRecursive(path9.join(sessionsDir, sessionRecordName(pid)));
 }
 function pruneDeadFrontDoorSessions(fs14, sessionsDir, listed, isRunning) {
   const removed = [];
@@ -4191,9 +4201,10 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
       return FRONTDOOR_SUPERVISOR_STILL_RUNNING;
     }
     ticks += 1;
-    const listed = listFrontDoorSessions(fs14, paths.frontdoorSessionsDir);
+    const listed = ports.registry.rescan();
     const running = await ports.runningAmong(listed.map((session) => session.pid));
     const pruned = pruneDeadFrontDoorSessions(fs14, paths.frontdoorSessionsDir, listed, (pid) => running.has(pid));
+    ports.registry.forget(pruned);
     ports.observeLaunchRegistry(listed, pruned);
     ports.checkQuotaExpiry();
     const prunedPids = new Set(pruned);
@@ -4267,8 +4278,8 @@ function parseConnectTarget(authority) {
 function isInterceptedHost(host, interceptHosts) {
   return interceptHosts.includes(host);
 }
-function servedByPipeline(path41) {
-  return path41?.startsWith(ROUTED_PATH_PREFIX) === true;
+function servedByPipeline(path42) {
+  return path42?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 function forwardableHeaders(headers) {
   const connectionTokens = new Set(
@@ -4712,7 +4723,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "claude-use",
-      version: "11.65.0",
+      version: "11.65.2",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -4764,9 +4775,9 @@ var init_package = __esm({
         "@anthropic-ai/claude-agent-sdk": "0.3.292",
         "@clack/prompts": "^1.8.0",
         "@modelcontextprotocol/sdk": "1.32.0",
-        "@orpc/client": "2.0.0-beta.41",
-        "@orpc/openapi": "2.0.0-beta.41",
-        "@orpc/server": "2.0.0-beta.41",
+        "@orpc/client": "2.0.0-beta.43",
+        "@orpc/openapi": "2.0.0-beta.43",
+        "@orpc/server": "2.0.0-beta.43",
         commander: "^15.0.0",
         cosmiconfig: "^10.0.1",
         picomatch: "^4.0.7",
@@ -7918,9 +7929,9 @@ var init_poolPick = __esm({
 
 // src/statusline/keys.ts
 import { z as z16 } from "zod";
-function valueAt(source, path41) {
+function valueAt(source, path42) {
   let current = source;
-  for (const part of path41) {
+  for (const part of path42) {
     if (!isPlainObject(current)) {
       return void 0;
     }
@@ -7928,10 +7939,10 @@ function valueAt(source, path41) {
   }
   return current;
 }
-function keyOf(path41, declared) {
+function keyOf(path42, declared) {
   const optional = declared instanceof z16.ZodOptional;
   const leaf = optional ? declared.unwrap() : declared;
-  const common = { path: path41.join("."), description: declared.description ?? "", defaultValue: valueAt(STATUSLINE_DEFAULTS, path41), optional };
+  const common = { path: path42.join("."), description: declared.description ?? "", defaultValue: valueAt(STATUSLINE_DEFAULTS, path42), optional };
   if (leaf instanceof z16.ZodNumber) {
     return { ...common, kind: "integer", choices: [] };
   }
@@ -7956,7 +7967,7 @@ function keyOf(path41, declared) {
   if (leaf instanceof z16.ZodArray && leaf.element instanceof z16.ZodString) {
     return { ...common, kind: "textList", choices: [] };
   }
-  throw new TypeError(`statusline setting ${path41.join(".")} has a kind the key listing does not describe`);
+  throw new TypeError(`statusline setting ${path42.join(".")} has a kind the key listing does not describe`);
 }
 function walk(shape, prefix) {
   return Object.entries(shape).flatMap(([name, schema]) => schema instanceof z16.ZodObject ? walk(schema.shape, [...prefix, name]) : [keyOf([...prefix, name], schema)]);
@@ -7972,15 +7983,15 @@ var init_keys = __esm({
 });
 
 // src/statusline/change.ts
-function keyNamed(path41) {
-  const found = statuslineKeys().find((key) => key.path === path41);
+function keyNamed(path42) {
+  const found = statuslineKeys().find((key) => key.path === path42);
   if (found === void 0) {
-    throw new UsageError(`"${path41}" is not a statusline setting; \`agent-shim statusline keys\` lists them.`);
+    throw new UsageError(`"${path42}" is not a statusline setting; \`agent-shim statusline keys\` lists them.`);
   }
   return found;
 }
-function setAt(target, path41, value) {
-  const [head, ...rest] = path41;
+function setAt(target, path42, value) {
+  const [head, ...rest] = path42;
   if (head === void 0) {
     return;
   }
@@ -7993,8 +8004,8 @@ function setAt(target, path41, value) {
   target[head] = next;
   setAt(next, rest, value);
 }
-function removeAt(target, path41) {
-  const [head, ...rest] = path41;
+function removeAt(target, path42) {
+  const [head, ...rest] = path42;
   if (head === void 0) {
     return;
   }
@@ -8012,13 +8023,13 @@ function removeAt(target, path41) {
 }
 function applyStatuslineChange(existing, change) {
   const draft = structuredClone(existing ?? {});
-  for (const [path41, value] of Object.entries(change.set ?? {})) {
-    keyNamed(path41);
-    setAt(draft, path41.split("."), value);
+  for (const [path42, value] of Object.entries(change.set ?? {})) {
+    keyNamed(path42);
+    setAt(draft, path42.split("."), value);
   }
-  for (const path41 of change.unset ?? []) {
-    keyNamed(path41);
-    removeAt(draft, path41.split("."));
+  for (const path42 of change.unset ?? []) {
+    keyNamed(path42);
+    removeAt(draft, path42.split("."));
   }
   const result = StatuslineSchema.safeParse(draft);
   if (!result.success) {
@@ -10755,7 +10766,7 @@ var init_settings2 = __esm({
 });
 
 // src/launcher/flags.ts
-import path35 from "node:path";
+import path36 from "node:path";
 function resolveLaunchFlags(params) {
   const statusline = resolveStatuslineSettings(params);
   return {
@@ -10811,7 +10822,7 @@ function buildEnv(params) {
   const parentCustomHeaders = params.baseEnv.ANTHROPIC_CUSTOM_HEADERS;
   let providerCustomHeaders;
   if (!params.configDirEscapeHatch && params.resolvedIdentityName !== void 0) {
-    env.CLAUDE_CONFIG_DIR = path35.join(params.identitiesDir, params.resolvedIdentityName);
+    env.CLAUDE_CONFIG_DIR = path36.join(params.identitiesDir, params.resolvedIdentityName);
   }
   if (params.provider !== void 0) {
     const providerEnv = params.provider.definition.kind !== void 0 && params.provider.definition.kind !== "http" ? {} : params.provider.definition.env ?? {};
@@ -10903,7 +10914,7 @@ var init_extraFlags = __esm({
 });
 
 // src/usage/resumeContext.ts
-import path36 from "node:path";
+import path37 from "node:path";
 function projectDirNameOf(cwd) {
   return cwd.replace(/[^A-Za-z0-9]/g, "-");
 }
@@ -10961,7 +10972,7 @@ function newestTranscript(fs14, projectDir) {
     if (!name.endsWith(".jsonl")) {
       continue;
     }
-    const candidate = path36.join(projectDir, name);
+    const candidate = path37.join(projectDir, name);
     const stat = fs14.lstat(candidate);
     if (stat?.kind === "file" && stat.mtimeMs > newestMs) {
       newestMs = stat.mtimeMs;
@@ -10975,8 +10986,8 @@ function resumedContextTokens(fs14, params) {
   if (target === void 0) {
     return void 0;
   }
-  const projectDir = path36.join(params.claudeHome, "projects", projectDirNameOf(params.cwd));
-  const file = target.kind === "id" ? path36.join(projectDir, `${target.id}.jsonl`) : newestTranscript(fs14, projectDir);
+  const projectDir = path37.join(params.claudeHome, "projects", projectDirNameOf(params.cwd));
+  const file = target.kind === "id" ? path37.join(projectDir, `${target.id}.jsonl`) : newestTranscript(fs14, projectDir);
   const text = file === void 0 ? void 0 : fs14.readFileUtf8(file);
   return text === void 0 ? void 0 : contextTokensOfTranscript(text);
 }
@@ -11421,7 +11432,7 @@ var init_launchHook = __esm({
 // src/launcher.ts
 import { randomUUID as randomUUID4 } from "node:crypto";
 import { isDeepStrictEqual } from "node:util";
-import path37 from "node:path";
+import path38 from "node:path";
 function resolveIdentityCredential(identity, credential, env, port) {
   if (port === void 0) {
     return { ok: false, status: 1, message: `agent-shim: identity ${identity} needs its credential resolved, but this launcher has no credential port wired` };
@@ -11664,7 +11675,7 @@ function decideLaunch(params, readOnly) {
     extraFlags: splitExtraFlags(env.CLAUDE_EXTRA_FLAGS),
     passthrough: withLauncherSettings(params.supervised === void 0 ? parsedArgv.rest : withSupervision(parsedArgv.rest, params.supervised), launcherSettings)
   });
-  const configDir = configDirEscapeHatchApplies || identityDecision.name === void 0 ? env.CLAUDE_CONFIG_DIR : path37.join(paths.identitiesDir, identityDecision.name);
+  const configDir = configDirEscapeHatchApplies || identityDecision.name === void 0 ? env.CLAUDE_CONFIG_DIR : path38.join(paths.identitiesDir, identityDecision.name);
   const decision = {
     identitySource: identityDecision.source,
     configDirEscapeHatch: identityDecision.configDirEscapeHatch,
@@ -11717,7 +11728,7 @@ function prepareLaunch(params) {
   let warnings = [];
   const updateCheck = runLaunchUpdateCheck({
     mode: params.updateMode ?? "off",
-    checkPath: path37.join(paths.root, "update.check"),
+    checkPath: path38.join(paths.root, "update.check"),
     currentVersion: package_default.version,
     port: params.update
   });
@@ -11905,12 +11916,12 @@ var init_launcher = __esm({
 });
 
 // src/ownCli.ts
-import path38 from "node:path";
+import path39 from "node:path";
 function agentShimCliPath(distDir = typeof __AGENT_SHIM_DIST_DIR__ === "string" ? __AGENT_SHIM_DIST_DIR__ : void 0) {
   if (distDir === void 0) {
     throw new OwnCliPathUnknownError();
   }
-  return path38.join(distDir, OWN_CLI_FILE_NAME);
+  return path39.join(distDir, OWN_CLI_FILE_NAME);
 }
 var OWN_CLI_FILE_NAME, OwnCliPathUnknownError;
 var init_ownCli = __esm({
@@ -11956,10 +11967,10 @@ var init_selfIdentity = __esm({
 
 // src/frontdoor/trust.ts
 import { createHash as createHash7 } from "node:crypto";
-import path39 from "node:path";
+import path40 from "node:path";
 function resolveTrustBundle(params) {
   const { caCertFile, bundlesDir, variable, inherited, fs: fs14 } = params;
-  if (inherited === void 0 || inherited === "" || path39.resolve(inherited) === path39.resolve(caCertFile)) {
+  if (inherited === void 0 || inherited === "" || path40.resolve(inherited) === path40.resolve(caCertFile)) {
     return { path: caCertFile };
   }
   const caPem = fs14.readFileUtf8(caCertFile);
@@ -11977,7 +11988,7 @@ function resolveTrustBundle(params) {
   }
   const combined = `${inheritedPem.trimEnd()}
 ${caPem}`;
-  const bundle = path39.join(bundlesDir, `${createHash7("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
+  const bundle = path40.join(bundlesDir, `${createHash7("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
   if (!fs14.exists(bundle)) {
     fs14.mkdirp(bundlesDir);
     fs14.writeFileAtomic(bundle, combined);
@@ -12110,7 +12121,7 @@ var init_replayRun = __esm({
 
 // src/launchWiring.ts
 import os8 from "node:os";
-import path40 from "node:path";
+import path41 from "node:path";
 import { randomUUID as randomUUID5 } from "node:crypto";
 function buildFarmRuntime(paths, cwd, run = realRunPort) {
   const home = os8.homedir();
@@ -12165,7 +12176,7 @@ function realPrepareLaunchParams(paths, options) {
     frontdoor: realFrontDoorPort(paths, options.spawnDaemon),
     credentials: { ...realCredentialPort, cache: realCredentialCacheEnv(paths) },
     hold: realHoldPort,
-    hasStoredLogin: (identity) => identitySignIn(realFarmFs, { platform: process.platform, run: options.run ?? realRunPort }, { farmRoot: path40.join(paths.identitiesDir, identity), hasCredentialBlock: false }).state !== "signed-out",
+    hasStoredLogin: (identity) => identitySignIn(realFarmFs, { platform: process.platform, run: options.run ?? realRunPort }, { farmRoot: path41.join(paths.identitiesDir, identity), hasCredentialBlock: false }).state !== "signed-out",
     ...farm.directoryIdentity === void 0 ? {} : { directoryPinnedIdentity: farm.directoryIdentity },
     ...farm.directoryConfigProfile === void 0 ? {} : { directoryRuleConfigProfile: farm.directoryConfigProfile },
     ...farm.globalDefaultConfigProfile === void 0 ? {} : { globalDefaultConfigProfile: farm.globalDefaultConfigProfile },
@@ -13058,11 +13069,11 @@ function createRcSessionTracker(deps) {
   };
   const observeExchange = (request4) => {
     const method = (request4.method ?? "").toUpperCase();
-    const path41 = new URL(request4.url ?? "/", "http://127.0.0.1").pathname;
-    if (!path41.startsWith(RC_SESSIONS_PATH_PREFIX)) {
+    const path42 = new URL(request4.url ?? "/", "http://127.0.0.1").pathname;
+    if (!path42.startsWith(RC_SESSIONS_PATH_PREFIX)) {
       return void 0;
     }
-    const tail = path41.slice(RC_SESSIONS_PATH_PREFIX.length);
+    const tail = path42.slice(RC_SESSIONS_PATH_PREFIX.length);
     const facts = {
       oauthAuthorization: oauthAuthorizationOf(request4.headers),
       anthropicVersion: singleHeader(request4.headers, "anthropic-version"),
@@ -13179,7 +13190,7 @@ function createRcSessionTracker(deps) {
       }
     };
   };
-  const summaryOf = ({ id, createdAt, lastSeenAt }) => ({ id, createdAt, lastSeenAt });
+  const summaryOf2 = ({ id, createdAt, lastSeenAt }) => ({ id, createdAt, lastSeenAt });
   const pendingSummaryOf = ({ sessionId, requestId, type, summary, observedAt: observedAt2 }) => ({ sessionId, requestId, type, summary, observedAt: observedAt2 });
   const sortedEntries = () => [...entries.values()].sort((left, right) => left.createdAt - right.createdAt || (left.id < right.id ? -1 : 1));
   const pendingSorted = (entry) => [...entry.pending.values()].sort((left, right) => left.observedAt - right.observedAt || (left.requestId < right.requestId ? -1 : 1)).map(pendingSummaryOf);
@@ -13187,11 +13198,11 @@ function createRcSessionTracker(deps) {
     observeExchange,
     list: () => {
       sweep();
-      return sortedEntries().map(summaryOf);
+      return sortedEntries().map(summaryOf2);
     },
     statusOf: (sessionId) => {
       sweep();
-      return sortedEntries().filter((entry) => sessionId === void 0 || entry.id === sessionId).map((entry) => ({ ...summaryOf(entry), workerState: entry.workerState, workerIdleSeconds: entry.workerIdleSeconds, pending: pendingSorted(entry) }));
+      return sortedEntries().filter((entry) => sessionId === void 0 || entry.id === sessionId).map((entry) => ({ ...summaryOf2(entry), workerState: entry.workerState, workerIdleSeconds: entry.workerIdleSeconds, pending: pendingSorted(entry) }));
     },
     pendingOf: (sessionId) => {
       sweep();
@@ -13452,8 +13463,8 @@ var RC_READ_FILE_ENCODINGS = ["utf-8", "base64"];
 function isRcReadFileEncoding(value) {
   return RC_READ_FILE_ENCODINGS.some((encoding) => encoding === value);
 }
-function buildRcReadFilePayload(requestId, path41, options) {
-  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path41, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
+function buildRcReadFilePayload(requestId, path42, options) {
+  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path42, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
 }
 function buildRcFileSuggestionsPayload(requestId, query) {
   return buildRcControlRequestPayload(requestId, { subtype: "file_suggestions", query });
@@ -13555,15 +13566,15 @@ async function getRcSessionContextUsage(deps, sessionId, detail) {
   const result = await deliverRcClientPayload(deps, sessionId, buildRcGetContextUsagePayload(requestId, detail), `request the context usage of session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
-async function readRcSessionFile(deps, sessionId, path41, options) {
-  if (path41 === "") {
+async function readRcSessionFile(deps, sessionId, path42, options) {
+  if (path42 === "") {
     return { ok: false, message: "a read-file write needs a non-empty path: the SDK's own field names the file the worker resolves against the session's cwd, and an empty string names none" };
   }
   if (options?.maxBytes !== void 0 && (!Number.isInteger(options.maxBytes) || options.maxBytes <= 0)) {
     return { ok: false, message: "a read-file write's max-bytes is a positive whole number of bytes: the SDK's own field caps the read, and a zero or negative cap reads nothing" };
   }
   const requestId = deps.newUuid();
-  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path41, options), `read ${path41} from session ${sessionId}`);
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path42, options), `read ${path42} from session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
 async function suggestRcSessionFiles(deps, sessionId, query) {
@@ -13732,11 +13743,11 @@ function createRcControlHandler(deps) {
       path: "read-file",
       read: (body) => {
         const session = bodyString(body, "session");
-        const path41 = bodyString(body, "path");
+        const path42 = bodyString(body, "path");
         const maxBytes = "maxBytes" in body ? bodyPositiveInteger(body, "maxBytes") : void 0;
         const encoding = "encoding" in body && isRcReadFileEncoding(body.encoding) ? body.encoding : void 0;
-        const refused2 = session === void 0 || path41 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
-        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path41, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
+        const refused2 = session === void 0 || path42 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
+        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path42, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
       }
     },
     {
@@ -14046,9 +14057,9 @@ function requestIdOfBody(body) {
 }
 function frontDoorRcControl(transport, token) {
   const headers = { authorization: `Bearer ${token}` };
-  const listAnswerOf = async (path41, what) => {
+  const listAnswerOf = async (path42, what) => {
     try {
-      return await transport.request({ method: "GET", path: path41, headers });
+      return await transport.request({ method: "GET", path: path42, headers });
     } catch (error) {
       throw new Error(`${what}: could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
     }
@@ -14120,10 +14131,10 @@ function frontDoorRcControl(transport, token) {
     }
     return pending;
   };
-  const writeOf = async (path41, body, describeFailure2) => {
+  const writeOf = async (path42, body, describeFailure2) => {
     let answer;
     try {
-      answer = await transport.request({ method: "POST", path: path41, headers: { ...headers, "content-type": "application/json" }, body });
+      answer = await transport.request({ method: "POST", path: path42, headers: { ...headers, "content-type": "application/json" }, body });
     } catch (error) {
       return { ok: false, message: `could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}` };
     }
@@ -14154,10 +14165,10 @@ function frontDoorRcControl(transport, token) {
     endSession: async (sessionId, reason) => await writeOf(`${CONTROL_PATH_PREFIX}/end-session`, JSON.stringify({ session: sessionId, ...reason === void 0 ? {} : { reason } }), (status, message) => `ending ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getUsage: async (sessionId, skipBehaviors) => await writeOf(`${CONTROL_PATH_PREFIX}/get-usage`, JSON.stringify({ session: sessionId, ...skipBehaviors === void 0 ? {} : { skipBehaviors } }), (status, message) => `requesting the usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getContextUsage: async (sessionId, detail) => await writeOf(`${CONTROL_PATH_PREFIX}/get-context-usage`, JSON.stringify({ session: sessionId, ...detail === void 0 ? {} : { detail } }), (status, message) => `requesting the context usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
-    readFile: async (sessionId, path41, options) => await writeOf(
+    readFile: async (sessionId, path42, options) => await writeOf(
       `${CONTROL_PATH_PREFIX}/read-file`,
-      JSON.stringify({ session: sessionId, path: path41, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
-      (status, message) => `reading ${path41} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
+      JSON.stringify({ session: sessionId, path: path42, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
+      (status, message) => `reading ${path42} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
     ),
     fileSuggestions: async (sessionId, query) => await writeOf(`${CONTROL_PATH_PREFIX}/file-suggestions`, JSON.stringify({ session: sessionId, query }), (status, message) => `requesting file suggestions from ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     keepAlive: async (sessionId) => await writeOf(`${CONTROL_PATH_PREFIX}/keep-alive`, JSON.stringify({ session: sessionId }), (status, message) => `keeping ${sessionId} alive failed (HTTP ${String(status)}): ${message}`),
@@ -14316,12 +14327,12 @@ function tlsFacts(options) {
 }
 function realRcEventDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const post = async (path41, headers, body) => await new Promise((resolve, reject) => {
+  const post = async (path42, headers, body) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method: "POST",
-      path: path41,
+      path: path42,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, "content-length": String(Buffer.byteLength(body, "utf8")) },
       agent
@@ -14386,12 +14397,12 @@ function lateRcStreamDial(resolve) {
 }
 function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const request4 = async (method, path41, headers, body, signal) => await new Promise((resolve, reject) => {
+  const request4 = async (method, path42, headers, body, signal) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method,
-      path: path41,
+      path: path42,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, ...body === void 0 ? {} : { "content-length": String(Buffer.byteLength(body, "utf8")) } },
       agent,
@@ -14433,9 +14444,9 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
       return { status, body: await readAll(response) };
     },
     openStream: async (sessionId, headers, resume, signal) => {
-      const path41 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
+      const path42 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
       const streamHeaders = resume === void 0 ? headers : { ...headers, "last-event-id": String(resume.fromSequenceNum) };
-      const { status, response } = await request4("GET", path41, streamHeaders, void 0, signal);
+      const { status, response } = await request4("GET", path42, streamHeaders, void 0, signal);
       if (!isSuccessful2(status)) {
         await readAll(response);
         return { status, chunks: NO_CHUNKS };
@@ -15428,19 +15439,19 @@ function writePools(paths, pools) {
   applyPatch(paths.globalConfigFile, GlobalConfigSchema, { pools }, { defaults: {} });
 }
 function poolCycleOf(pools, name) {
-  const walk2 = (current, path41) => {
+  const walk2 = (current, path42) => {
     for (const entry of pools[current]?.identities ?? []) {
       const nested = poolNameOf(poolMemberIdentity(entry));
       if (nested === void 0) {
         continue;
       }
       if (nested === name) {
-        return [...path41, nested];
+        return [...path42, nested];
       }
-      if (path41.includes(nested)) {
+      if (path42.includes(nested)) {
         continue;
       }
-      const found = walk2(nested, [...path41, nested]);
+      const found = walk2(nested, [...path42, nested]);
       if (found !== void 0) {
         return found;
       }
@@ -17886,7 +17897,7 @@ function profileValue(name, paths) {
 function createConfigApiRouter(deps) {
   const authed = doorApiAuth(deps.expectedToken);
   const { paths } = deps;
-  const route = (path41, summary) => authed.meta(openapi3({ method: "POST", path: path41, summary, tags: [CONFIG_API_TAG] }));
+  const route = (path42, summary) => authed.meta(openapi3({ method: "POST", path: path42, summary, tags: [CONFIG_API_TAG] }));
   return {
     config: {
       identity: {
@@ -20537,6 +20548,85 @@ function mintRcSelfHostCredential(deps) {
 
 // src/index.ts
 init_ensure2();
+
+// src/frontdoor/liveSessionRegistry.ts
+init_capability();
+init_state();
+import path33 from "node:path";
+function sameStat(recorded, current) {
+  return recorded?.mtimeMs === current.mtimeMs && recorded.sizeBytes === current.sizeBytes;
+}
+function createLiveSessionRegistry(ports) {
+  const { fs: fs14, sessionsDir } = ports;
+  const known = /* @__PURE__ */ new Map();
+  let tokens = /* @__PURE__ */ new Set();
+  let bySessionId = /* @__PURE__ */ new Map();
+  const recordNames = () => fs14.readdir(sessionsDir).filter(isSessionRecordName);
+  const rebuildIndexes = () => {
+    const records = [...known.values()].flatMap(({ record }) => record === void 0 ? [] : [record]);
+    tokens = new Set(records.map((record) => record.token));
+    bySessionId = new Map(records.flatMap((record) => record.sessionId === void 0 ? [] : [[record.sessionId, record]]));
+  };
+  const load = (name, stat) => {
+    known.set(name, { stat: { mtimeMs: stat.mtimeMs, sizeBytes: stat.sizeBytes }, record: readFrontDoorSessionRecord(fs14, sessionsDir, name) });
+  };
+  const statOf = (name) => fs14.lstat(path33.join(sessionsDir, name));
+  const reconcile = () => {
+    const names = new Set(recordNames());
+    let changed = false;
+    for (const name of known.keys()) {
+      if (!names.has(name)) {
+        known.delete(name);
+        changed = true;
+      }
+    }
+    for (const name of names) {
+      const held = known.get(name);
+      const stat = statOf(name);
+      if (stat === void 0) {
+        changed = known.delete(name) || changed;
+      } else if (!sameStat(held?.stat, stat)) {
+        load(name, stat);
+        changed = true;
+      }
+    }
+    if (changed) {
+      rebuildIndexes();
+    }
+    return changed;
+  };
+  return {
+    admits: (token) => {
+      if (isLiveCapability(token, tokens)) {
+        return true;
+      }
+      return reconcile() && isLiveCapability(token, tokens);
+    },
+    modelsOf: (sessionId) => {
+      const held = bySessionId.get(sessionId) ?? (reconcile() ? bySessionId.get(sessionId) : void 0);
+      return held?.models;
+    },
+    rescan: () => {
+      known.clear();
+      for (const name of recordNames()) {
+        const stat = statOf(name);
+        if (stat !== void 0) {
+          load(name, stat);
+        }
+      }
+      rebuildIndexes();
+      return [...known.values()].flatMap(({ record }) => record === void 0 ? [] : [summaryOf(record)]).sort((a, b) => a.pid - b.pid);
+    },
+    forget: (pids) => {
+      for (const pid of pids) {
+        known.delete(sessionRecordName(pid));
+      }
+      rebuildIndexes();
+    }
+  };
+}
+
+// src/index.ts
 init_supervisor();
 init_read();
 init_schema2();
@@ -20546,7 +20636,7 @@ init_plan2();
 init_poolPick();
 
 // src/agents/read.ts
-import path33 from "node:path";
+import path34 from "node:path";
 import { z as z34 } from "zod";
 var PROJECTS_DIR = "projects";
 var TASKS_DIR = "tasks";
@@ -20572,15 +20662,15 @@ function parseEntry2(project, entry) {
 }
 function listSessions2(fs14, configDir) {
   const found = [];
-  for (const project of fs14.readdir(path33.join(configDir, PROJECTS_DIR))) {
-    const projectDir = path33.join(configDir, PROJECTS_DIR, project);
+  for (const project of fs14.readdir(path34.join(configDir, PROJECTS_DIR))) {
+    const projectDir = path34.join(configDir, PROJECTS_DIR, project);
     const entries = /* @__PURE__ */ new Set();
     for (const name of fs14.readdir(projectDir)) {
       if (name.endsWith(TRANSCRIPT_SUFFIX)) {
         entries.add(name.slice(0, -TRANSCRIPT_SUFFIX.length));
         continue;
       }
-      const children = fs14.readdir(path33.join(projectDir, name));
+      const children = fs14.readdir(path34.join(projectDir, name));
       if (children.includes(SUBAGENTS_DIR) || children.includes(WORKFLOWS_DIR)) {
         entries.add(name);
       }
@@ -20600,8 +20690,8 @@ function locateAgents(fs14, configDir, relativeDir, workflowRunId, report) {
     const id = name.slice(AGENT_FILE_PREFIX.length, -META_SUFFIX.length);
     located.push({
       id,
-      metaPath: path33.join(relativeDir, name),
-      transcriptPath: path33.join(relativeDir, `${AGENT_FILE_PREFIX}${id}${TRANSCRIPT_SUFFIX}`),
+      metaPath: path34.join(relativeDir, name),
+      transcriptPath: path34.join(relativeDir, `${AGENT_FILE_PREFIX}${id}${TRANSCRIPT_SUFFIX}`),
       workflowRunId
     });
   }
@@ -20644,7 +20734,7 @@ function describeFailure(error) {
 }
 function readFileOrReport(fs14, configDir, relative, report) {
   try {
-    return fs14.readFileUtf8(path33.join(configDir, relative));
+    return fs14.readFileUtf8(path34.join(configDir, relative));
   } catch (error) {
     report({ path: relative, reason: `could not be read: ${describeFailure(error)}` });
     return void 0;
@@ -20652,7 +20742,7 @@ function readFileOrReport(fs14, configDir, relative, report) {
 }
 function listDirOrReport(fs14, configDir, relative, report) {
   try {
-    return fs14.readdir(path33.join(configDir, relative));
+    return fs14.readdir(path34.join(configDir, relative));
   } catch (error) {
     report({ path: relative, reason: `could not be listed: ${describeFailure(error)}` });
     return [];
@@ -20676,18 +20766,18 @@ var WorkflowRunFileSchema = z34.object({
   summary: z34.string().optional()
 });
 function summariseSession(fs14, configDir, ref) {
-  const sessionRelative = path33.join(PROJECTS_DIR, ref.project, ref.entry);
-  const subagentsRelative = path33.join(sessionRelative, SUBAGENTS_DIR);
-  const workflowsUnderSubagents = path33.join(subagentsRelative, WORKFLOWS_DIR);
+  const sessionRelative = path34.join(PROJECTS_DIR, ref.project, ref.entry);
+  const subagentsRelative = path34.join(sessionRelative, SUBAGENTS_DIR);
+  const workflowsUnderSubagents = path34.join(subagentsRelative, WORKFLOWS_DIR);
   const isMeta = (name) => name.startsWith(AGENT_FILE_PREFIX) && name.endsWith(META_SUFFIX);
-  let agentCount = fs14.readdir(path33.join(configDir, subagentsRelative)).filter(isMeta).length;
-  for (const runDir of fs14.readdir(path33.join(configDir, workflowsUnderSubagents))) {
+  let agentCount = fs14.readdir(path34.join(configDir, subagentsRelative)).filter(isMeta).length;
+  for (const runDir of fs14.readdir(path34.join(configDir, workflowsUnderSubagents))) {
     if (runDir.startsWith(WORKFLOW_RUN_PREFIX)) {
-      agentCount += fs14.readdir(path33.join(configDir, workflowsUnderSubagents, runDir)).filter(isMeta).length;
+      agentCount += fs14.readdir(path34.join(configDir, workflowsUnderSubagents, runDir)).filter(isMeta).length;
     }
   }
-  const workflowRunCount = fs14.readdir(path33.join(configDir, sessionRelative, WORKFLOWS_DIR)).filter((name) => name.startsWith(WORKFLOW_RUN_PREFIX) && name.endsWith(JSON_SUFFIX)).length;
-  const transcript = fs14.lstat(path33.join(configDir, PROJECTS_DIR, ref.project, `${ref.entry}${TRANSCRIPT_SUFFIX}`));
+  const workflowRunCount = fs14.readdir(path34.join(configDir, sessionRelative, WORKFLOWS_DIR)).filter((name) => name.startsWith(WORKFLOW_RUN_PREFIX) && name.endsWith(JSON_SUFFIX)).length;
+  const transcript = fs14.lstat(path34.join(configDir, PROJECTS_DIR, ref.project, `${ref.entry}${TRANSCRIPT_SUFFIX}`));
   return { ...ref, agentCount, workflowRunCount, ...transcript === void 0 ? {} : { updatedAt: new Date(transcript.mtimeMs).toISOString() } };
 }
 function readSessionAgentTree(fs14, configDir, ref, options = {}) {
@@ -20695,13 +20785,13 @@ function readSessionAgentTree(fs14, configDir, ref, options = {}) {
   const report = (problem) => {
     problems.push(problem);
   };
-  const sessionRelative = path33.join(PROJECTS_DIR, ref.project, ref.entry);
-  const subagentsRelative = path33.join(sessionRelative, SUBAGENTS_DIR);
-  const workflowsUnderSubagents = path33.join(subagentsRelative, WORKFLOWS_DIR);
+  const sessionRelative = path34.join(PROJECTS_DIR, ref.project, ref.entry);
+  const subagentsRelative = path34.join(sessionRelative, SUBAGENTS_DIR);
+  const workflowsUnderSubagents = path34.join(subagentsRelative, WORKFLOWS_DIR);
   const located = locateAgents(fs14, configDir, subagentsRelative, void 0, report);
   for (const runDir of listDirOrReport(fs14, configDir, workflowsUnderSubagents, report)) {
     if (runDir.startsWith(WORKFLOW_RUN_PREFIX)) {
-      located.push(...locateAgents(fs14, configDir, path33.join(workflowsUnderSubagents, runDir), runDir, report));
+      located.push(...locateAgents(fs14, configDir, path34.join(workflowsUnderSubagents, runDir), runDir, report));
     }
   }
   const agents = /* @__PURE__ */ new Map();
@@ -20742,7 +20832,7 @@ function readSessionAgentTree(fs14, configDir, ref, options = {}) {
     superseded: ref.superseded,
     agents: roots.sort().map(build),
     tasks: readTasks(fs14, configDir, ownTaskLists(ref.sessionId), [.../* @__PURE__ */ new Set([...teamNames, ...options.taskListIds ?? []])].filter((id) => !ownTaskLists(ref.sessionId).includes(id)), report),
-    workflowRuns: readWorkflowRuns(fs14, configDir, path33.join(sessionRelative, WORKFLOWS_DIR), report),
+    workflowRuns: readWorkflowRuns(fs14, configDir, path34.join(sessionRelative, WORKFLOWS_DIR), report),
     problems
   };
 }
@@ -20807,12 +20897,12 @@ function ownTaskLists(sessionId) {
 function readTasks(fs14, configDir, ownLists, sharedLists, report) {
   const tasks = [];
   [...ownLists, ...sharedLists].forEach((scope, index) => {
-    const relativeDir = path33.join(TASKS_DIR, scope);
+    const relativeDir = path34.join(TASKS_DIR, scope);
     for (const name of [...listDirOrReport(fs14, configDir, relativeDir, report)].sort()) {
       if (name.startsWith(".") || !name.endsWith(JSON_SUFFIX)) {
         continue;
       }
-      const relative = path33.join(relativeDir, name);
+      const relative = path34.join(relativeDir, name);
       const text = readFileOrReport(fs14, configDir, relative, report);
       const parsed = TaskFileSchema.safeParse(text === void 0 ? void 0 : parseJson2(text));
       if (parsed.success) {
@@ -20830,7 +20920,7 @@ function readWorkflowRuns(fs14, configDir, relativeDir, report) {
     if (!name.startsWith(WORKFLOW_RUN_PREFIX) || !name.endsWith(JSON_SUFFIX)) {
       continue;
     }
-    const relative = path33.join(relativeDir, name);
+    const relative = path34.join(relativeDir, name);
     const text = readFileOrReport(fs14, configDir, relative, report);
     const parsed = WorkflowRunFileSchema.safeParse(text === void 0 ? void 0 : parseJson2(text));
     if (!parsed.success) {
@@ -20847,7 +20937,7 @@ function readWorkflowRuns(fs14, configDir, relativeDir, report) {
 
 // src/agents/sessions.ts
 init_cliError();
-import path34 from "node:path";
+import path35 from "node:path";
 var SessionLookupError = class extends CliError {
   constructor(message) {
     super(message);
@@ -20855,13 +20945,13 @@ var SessionLookupError = class extends CliError {
   }
 };
 function identityConfigDir(identitiesDir, identity) {
-  return path34.join(identitiesDir, identity);
+  return path35.join(identitiesDir, identity);
 }
 function historyStores(fs14, identitiesDir, identities) {
   const byRealPath = /* @__PURE__ */ new Map();
   for (const identity of identities) {
     const configDir = identityConfigDir(identitiesDir, identity);
-    const real = fs14.realpath(path34.join(configDir, "projects"));
+    const real = fs14.realpath(path35.join(configDir, "projects"));
     if (real === void 0) {
       continue;
     }
@@ -21266,6 +21356,7 @@ export {
   createLaunchEventPublisher,
   createLeafCache,
   createLifecycleApiRouter,
+  createLiveSessionRegistry,
   createProfile,
   createQuotaExpiringPublisher,
   createRcApiNodeHandler,