claude-use 6.2.2 → 7.1.0

package/dist/index.cjs

@@ -91,7 +91,7 @@ function expandAllCategoryKey(pairs) {
   if (all === void 0) {
     return { ...rest };
   }
-  const expanded = Object.fromEntries(OVERRIDABLE_CATEGORIES.map((category) => [category, all]));
+  const expanded = Object.fromEntries(OVERRIDABLE_CATEGORIES.filter((category) => !all || category !== "runtime").map((category) => [category, all]));
   return { ...expanded, ...rest };
 }
 var CategoryMapSchema = import_zod.z.strictObject({
@@ -165,7 +165,7 @@ var CredentialSchema = import_zod.z.strictObject({
 var ProviderCredentialSchema = CredentialSchema.extend({ target: import_zod.z.enum(PROVIDER_CREDENTIAL_TARGETS).optional() });
 var RESERVED_PROVIDER_ENV_KEYS = Object.values(CREDENTIAL_TARGET_VARS);
 var ProviderEnvSchema = import_zod.z.record(import_zod.z.string().min(1), import_zod.z.string()).refine((env) => !Object.keys(env).some((key) => RESERVED_PROVIDER_ENV_KEYS.includes(key)), {
-  message: `env may not set ${RESERVED_PROVIDER_ENV_KEYS.join(", ")}: the credential block's target sets one and claude-use removes the others`
+  message: `env may not set ${RESERVED_PROVIDER_ENV_KEYS.join(", ")}: the credential block's target sets one and agent-shim removes the others`
 });
 var CODEX_EFFORTS = ["none", "low", "medium", "high"];
 var CODEX_DEFAULT_TIER_MODELS = Object.freeze({
@@ -808,7 +808,7 @@ function resolveEntry(relPath, params) {
     diagnostics.push({
       code: "UNCLASSIFIED_ENTRY",
       severity: "warning",
-      message: `"${head}" is not in the category map, so it is excluded. Run \`claude-use configure\` to classify it, which records the answer in the local overlay without touching the shipped default map.`,
+      message: `"${head}" is not in the category map, so it is excluded. Run \`agent-shim configure\` to classify it, which records the answer in the local overlay without touching the shipped default map.`,
       subject: head
     });
     return { decision: { relPath, shared: false, via: "unclassified", category }, diagnostics };
@@ -1285,6 +1285,9 @@ function planReconciliation(params) {
   return { actions, diagnostics, conservative };
 }
 
+// src/legacy.ts
+var LEGACY_FARM_MANIFEST_FILENAME = ".claude-use-farm.json";
+
 // src/launcher/lock.ts
 var import_node_crypto = require("node:crypto");
 var import_node_path3 = __toESM(require("node:path"), 1);
@@ -1294,7 +1297,7 @@ var DEFAULT_MAX_ATTEMPTS = 200;
 var IdentityLockBusyError = class extends CliError {
   constructor(identity, lockPath, holderPid) {
     super(
-      `Another claude-use resync is already running for identity "${identity}"` + (holderPid === void 0 ? "" : ` (pid ${String(holderPid)})`) + `. Its lock at ${lockPath} was still held after the full retry budget; nothing was changed.`
+      `Another agent-shim resync is already running for identity "${identity}"` + (holderPid === void 0 ? "" : ` (pid ${String(holderPid)})`) + `. Its lock at ${lockPath} was still held after the full retry budget; nothing was changed.`
     );
     this.identity = identity;
     this.lockPath = lockPath;
@@ -1373,7 +1376,7 @@ function acquireIdentityLock(params) {
 }
 
 // src/launcher/farm.ts
-var FARM_MANIFEST_FILENAME = ".claude-use-farm.json";
+var FARM_MANIFEST_FILENAME = ".agent-shim-farm.json";
 var FarmManifestSchema = import_zod2.z.strictObject({
   version: import_zod2.z.literal(1),
   builtAtMs: import_zod2.z.number(),
@@ -1385,7 +1388,7 @@ var FarmManifestSchema = import_zod2.z.strictObject({
   links: import_zod2.z.array(import_zod2.z.strictObject({ rel: import_zod2.z.string(), target: import_zod2.z.string() }))
 });
 function readFarmManifest(fs2, farmRoot) {
-  const raw = fs2.readFileUtf8(import_node_path4.default.join(farmRoot, FARM_MANIFEST_FILENAME));
+  const raw = fs2.readFileUtf8(import_node_path4.default.join(farmRoot, FARM_MANIFEST_FILENAME)) ?? fs2.readFileUtf8(import_node_path4.default.join(farmRoot, LEGACY_FARM_MANIFEST_FILENAME));
   if (raw === void 0) {
     return void 0;
   }
@@ -1474,7 +1477,7 @@ function reconciliationScope(fs2, farmRoot, manifest) {
   if (manifest !== void 0) {
     return topLevelScopeRoots(manifest.materialised);
   }
-  return [...fs2.readdir(farmRoot)].filter((name) => name !== FARM_MANIFEST_FILENAME && fs2.lstat(import_node_path4.default.join(farmRoot, name))?.kind === "dir").sort();
+  return [...fs2.readdir(farmRoot)].filter((name) => name !== FARM_MANIFEST_FILENAME && name !== LEGACY_FARM_MANIFEST_FILENAME && fs2.lstat(import_node_path4.default.join(farmRoot, name))?.kind === "dir").sort();
 }
 function collectFarmListing(fs2, farmRoot, scopeRoots) {
   return scopeRoots.flatMap((root) => listSubtree(fs2, farmRoot, root));
@@ -1498,7 +1501,7 @@ function collectCanonicalCounterparts(fs2, claudeHome, farmListing) {
 }
 function carryOver(params) {
   const manifest = readFarmManifest(params.fs, params.previousRoot);
-  const accounted = /* @__PURE__ */ new Set([FARM_MANIFEST_FILENAME]);
+  const accounted = /* @__PURE__ */ new Set([FARM_MANIFEST_FILENAME, LEGACY_FARM_MANIFEST_FILENAME]);
   for (const rel of manifest?.materialised ?? []) {
     const head = rel.split("/")[0];
     if (head !== void 0 && head !== "") {
@@ -1796,7 +1799,7 @@ function resyncFarm(params) {
       diagnostics.push({
         code: "FARM_PREVIOUS_RETAINED",
         severity: "warning",
-        message: `The superseded farm was left at ${swap.retainedPrevious} because it still holds ${swap.collided.join(", ")}, which the new farm has its own entry for. Nothing was overwritten in either direction; run \`claude-use identity resolve-conflicts ${params.identity}\` to resolve it interactively.`,
+        message: `The superseded farm was left at ${swap.retainedPrevious} because it still holds ${swap.collided.join(", ")}, which the new farm has its own entry for. Nothing was overwritten in either direction; run \`agent-shim identity resolve-conflicts ${params.identity}\` to resolve it interactively.`,
         subject: swap.retainedPrevious
       });
     }
@@ -1833,7 +1836,7 @@ function recoveryDiagnostics(recovery, identity) {
   }
   if (recovery.retained.length > 0) {
     parts.push(
-      `kept ${recovery.retained.join(", ")}, which still holds data the current farm also has an entry for \u2014 run \`claude-use identity resolve-conflicts ${identity}\` to resolve it interactively`
+      `kept ${recovery.retained.join(", ")}, which still holds data the current farm also has an entry for \u2014 run \`agent-shim identity resolve-conflicts ${identity}\` to resolve it interactively`
     );
   }
   return [
@@ -2125,7 +2128,7 @@ function issueLeafCertificate(ca, names, notBefore, notAfter) {
 }
 
 // src/frontdoor/capability.ts
-var CONNECT_PROXY_REALM = "claude-use front door";
+var CONNECT_PROXY_REALM = "agent-shim front door";
 var BASIC_SCHEME = "basic";
 function capabilityFromProxyAuthorization(value) {
   const trimmed = value.trim();
@@ -2252,7 +2255,7 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
   const fail = (message) => {
     writeFrontDoorState(fs2, paths.frontdoorStateFile, { lastError: message, ...sticky() });
     fs2.removeRecursive(paths.frontdoorLockFile);
-    ports.log(`claude-use frontdoor supervisor: ${message}`);
+    ports.log(`agent-shim frontdoor supervisor: ${message}`);
     return 1;
   };
   writeFrontDoorState(fs2, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, ...sticky() });
@@ -2264,7 +2267,7 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     return fail(`could not start the provider listener: ${error instanceof Error ? error.message : String(error)}`);
   }
   if (previousSticky !== void 0 && http2.port !== previousSticky) {
-    ports.log(`claude-use frontdoor supervisor: sticky port ${String(previousSticky)} was occupied; moving to ${String(http2.port)} (sessions launched against the old port are stale until they relaunch)`);
+    ports.log(`agent-shim frontdoor supervisor: sticky port ${String(previousSticky)} was occupied; moving to ${String(http2.port)} (sessions launched against the old port are stale until they relaunch)`);
   }
   lastPort = http2.port;
   const previousStickyConnect = lastConnectPort;
@@ -2276,7 +2279,7 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     return fail(`could not start the CONNECT surface: ${error instanceof Error ? error.message : String(error)}`);
   }
   if (previousStickyConnect !== void 0 && connect2.port !== previousStickyConnect) {
-    ports.log(`claude-use frontdoor supervisor: sticky CONNECT port ${String(previousStickyConnect)} was occupied; moving to ${String(connect2.port)} (OAuth sessions launched against the old port are stale until they relaunch)`);
+    ports.log(`agent-shim frontdoor supervisor: sticky CONNECT port ${String(previousStickyConnect)} was occupied; moving to ${String(connect2.port)} (OAuth sessions launched against the old port are stale until they relaunch)`);
   }
   lastConnectPort = connect2.port;
   const previousStickyDirect = lastDirectPort;
@@ -2289,12 +2292,12 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     return fail(`could not start the direct listener: ${error instanceof Error ? error.message : String(error)}`);
   }
   if (previousStickyDirect !== void 0 && direct.port !== previousStickyDirect) {
-    ports.log(`claude-use frontdoor supervisor: sticky direct port ${String(previousStickyDirect)} was occupied; moving to ${String(direct.port)} (headroom must be restarted to admit the new address)`);
+    ports.log(`agent-shim frontdoor supervisor: sticky direct port ${String(previousStickyDirect)} was occupied; moving to ${String(direct.port)} (headroom must be restarted to admit the new address)`);
   }
   lastDirectPort = direct.port;
   writeFrontDoorState(fs2, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, port: http2.port, connectPort: connect2.port, directPort: direct.port, ...sticky() });
   fs2.removeRecursive(paths.frontdoorLockFile);
-  ports.log(`claude-use frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http2.port)}, CONNECT surface on 127.0.0.1:${String(connect2.port)}`);
+  ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http2.port)}, CONNECT surface on 127.0.0.1:${String(connect2.port)}`);
   let idleSince;
   let ticks = 0;
   for (; ; ) {
@@ -2306,7 +2309,7 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     if (listFrontDoorSessions(fs2, paths.frontdoorSessionsDir).length === 0) {
       idleSince ??= ports.now();
       if (ports.now() - idleSince >= idleShutdownMinutes * MS_PER_MINUTE) {
-        ports.log(`claude-use frontdoor supervisor: no sessions for ${String(idleShutdownMinutes)} minute(s); closing the front door and exiting`);
+        ports.log(`agent-shim frontdoor supervisor: no sessions for ${String(idleShutdownMinutes)} minute(s); closing the front door and exiting`);
         await direct.close();
         await connect2.close();
         await http2.close();
@@ -2346,7 +2349,7 @@ var CONNECT_LIMITS = {
 };
 var CA_VALIDITY_DAYS = 3650;
 var LEAF_VALIDITY_DAYS = 397;
-var CA_SUBJECT_COMMON_NAME = "claude-use front door CA";
+var CA_SUBJECT_COMMON_NAME = "agent-shim front door CA";
 var MS_PER_DAY = 864e5;
 function parseConnectTarget(authority) {
   const colon = authority.lastIndexOf(":");
@@ -2740,7 +2743,7 @@ function realConnectEffects() {
           response.destroy(error);
           return;
         }
-        const body = `claude-use headroom: upstream unreachable (${error.message})`;
+        const body = `agent-shim headroom: upstream unreachable (${error.message})`;
         response.writeHead(HTTP_BAD_GATEWAY, { "content-type": "text/plain", "content-length": String(body.length) });
         response.end(body);
       });
@@ -2829,7 +2832,7 @@ function readHeadroomState(fs2, stateFile) {
 }
 function writeHeadroomState(fs2, stateFile, state) {
   fs2.mkdirp(import_node_path6.default.dirname(stateFile));
-  fs2.writeFileUtf8(stateFile, `${JSON.stringify(state, null, 2)}
+  fs2.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
 `);
 }
 function headroomAllowlist(providers) {
@@ -2940,13 +2943,13 @@ function ensureFrontDoor(params) {
         }
         lastRejection = `the listener on 127.0.0.1:${String(state.port)} (recorded for pid ${String(supervisorPid)}) failed authentication: ${verdict.reason}`;
         if (spawned) {
-          throw new FrontDoorStartError(`claude-use: ${lastRejection}; refusing to send this session's credentials to it. Daemon log: ${paths.frontdoorLogPath}`);
+          throw new FrontDoorStartError(`agent-shim: ${lastRejection}; refusing to send this session's credentials to it. Daemon log: ${paths.frontdoorLogPath}`);
         }
         distrusted.add(supervisorPid);
         continue;
       }
       if (state?.lastError !== void 0) {
-        throw new FrontDoorStartError(`claude-use: the front door reported a fatal error and is not serving: ${state.lastError} (daemon log: ${paths.frontdoorLogPath})`);
+        throw new FrontDoorStartError(`agent-shim: the front door reported a fatal error and is not serving: ${state.lastError} (daemon log: ${paths.frontdoorLogPath})`);
       }
     } else if (!spawned) {
       ports.fs.mkdirp(paths.frontdoorDir);
@@ -2966,7 +2969,7 @@ function ensureFrontDoor(params) {
     if (ports.now() >= deadline) {
       const lastError = state?.lastError;
       throw new FrontDoorStartError(
-        `claude-use: the front door did not become ready within ${String(FRONTDOOR_START_TIMEOUT_MS)}ms` + (lastError === void 0 ? "" : ` (last error: ${lastError})`) + (lastRejection === void 0 ? "" : ` (${lastRejection})`) + `. Daemon log: ${paths.frontdoorLogPath}`
+        `agent-shim: the front door did not become ready within ${String(FRONTDOOR_START_TIMEOUT_MS)}ms` + (lastError === void 0 ? "" : ` (last error: ${lastError})`) + (lastRejection === void 0 ? "" : ` (${lastRejection})`) + `. Daemon log: ${paths.frontdoorLogPath}`
       );
     }
     ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
@@ -3131,7 +3134,7 @@ function isIdentityName(name) {
 // src/usage/read.ts
 var UsageSnapshotError = class extends Error {
   constructor(file, detail) {
-    super(`${file} is not a usage snapshot this claude-use can read (schema version ${String(USAGE_SCHEMA_VERSION)}): ${detail}`);
+    super(`${file} is not a usage snapshot this agent-shim can read (schema version ${String(USAGE_SCHEMA_VERSION)}): ${detail}`);
     this.file = file;
     this.name = "UsageSnapshotError";
   }
@@ -3198,7 +3201,7 @@ function ensureHeadroom(params) {
       }
       if (state.lastError !== void 0) {
         throw new HeadroomStartError(
-          `claude-use: the headroom daemon reported a fatal error and is not serving: ${state.lastError} (daemon log: ${paths.headroomLogPath})`
+          `agent-shim: the headroom daemon reported a fatal error and is not serving: ${state.lastError} (daemon log: ${paths.headroomLogPath})`
         );
       }
     } else if (!spawnedSupervisor) {
@@ -3222,7 +3225,7 @@ function ensureHeadroom(params) {
     if (ports.now() >= deadline) {
       const lastError = state?.lastError;
       throw new HeadroomStartError(
-        `claude-use: the headroom daemon did not become ready within ${String(HEADROOM_START_TIMEOUT_MS)}ms` + (lastError === void 0 ? "" : ` (last error: ${lastError})`) + `. Daemon log: ${paths.headroomLogPath}`
+        `agent-shim: the headroom daemon did not become ready within ${String(HEADROOM_START_TIMEOUT_MS)}ms` + (lastError === void 0 ? "" : ` (last error: ${lastError})`) + `. Daemon log: ${paths.headroomLogPath}`
       );
     }
     ports.sleep(HEADROOM_LAUNCHER_POLL_MS);
@@ -3258,6 +3261,16 @@ function hashSettings(settings) {
   return (0, import_node_crypto6.createHash)("sha256").update(JSON.stringify([...settingsArgs(settings), JSON.stringify(settingsEnv(settings))])).digest("hex");
 }
 
+// src/headroom/source.ts
+var import_zod6 = require("zod");
+var GIT_SPEC_RE = /git\+[^@\s]+(?:@([^\s#]+))?/;
+var COMMIT_SHA_RE = /^[0-9a-f]{40}$/i;
+var DirectUrlSchema = import_zod6.z.object({ vcs_info: import_zod6.z.object({ commit_id: import_zod6.z.string() }) });
+function pinnedGitCommit(spec) {
+  const ref = GIT_SPEC_RE.exec(spec)?.[1];
+  return ref !== void 0 && COMMIT_SHA_RE.test(ref) ? ref.toLowerCase() : void 0;
+}
+
 // src/headroom/supervisor.ts
 function resolveSupervisorConfig(configured) {
   return {
@@ -3331,7 +3344,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
   let config = initialConfig;
   const previousState = readHeadroomState(fs2, paths.headroomStateFile);
   if (previousState?.supervisorPid !== void 0 && previousState.supervisorPid !== ports.ownPid && ports.isRunning(previousState.supervisorPid)) {
-    ports.log(`claude-use headroom supervisor ${String(ports.ownPid)}: supervisor ${String(previousState.supervisorPid)} already owns the daemon; exiting`);
+    ports.log(`agent-shim headroom supervisor ${String(ports.ownPid)}: supervisor ${String(previousState.supervisorPid)} already owns the daemon; exiting`);
     return 0;
   }
   let installedSource = previousState?.installedSource;
@@ -3352,17 +3365,19 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     if (writeOwnState({ lastError: message, ...sticky() })) {
       fs2.removeRecursive(paths.headroomLockFile);
     }
-    ports.log(`claude-use headroom supervisor: ${message}`);
+    ports.log(`agent-shim headroom supervisor: ${message}`);
     return 1;
   };
   const ensureInstalled = () => {
     const version2 = ports.headroomVersion();
     const versionOk = version2 !== void 0 && versionSatisfies(version2, config.source);
-    if (versionOk && (installedSource === void 0 || installedSource === config.source)) {
+    const pinned = pinnedGitCommit(config.source);
+    const commitOk = pinned === void 0 || ports.installedCommit() === pinned;
+    if (versionOk && commitOk && (installedSource === void 0 || installedSource === config.source)) {
       installedSource = config.source;
       return true;
     }
-    ports.log(`claude-use headroom supervisor: installing headroom from ${config.source}`);
+    ports.log(`agent-shim headroom supervisor: installing headroom from ${config.source}`);
     const result = ports.install(config.source);
     if (!result.ok) {
       return false;
@@ -3375,10 +3390,10 @@ async function runSupervisor(initialConfig, ports, options = {}) {
   }
   const version = ports.headroomVersion() ?? "unknown";
   writeOwnState({ supervisorPid: ports.ownPid, version, installedSource, ...sticky() });
-  ports.log(`claude-use headroom supervisor ${String(ports.ownPid)}: managing headroom on allowlist [${allowlistOf(ports).join(", ")}]`);
+  ports.log(`agent-shim headroom supervisor ${String(ports.ownPid)}: managing headroom on allowlist [${allowlistOf(ports).join(", ")}]`);
   const orphanPid = previousState?.headroomPid;
   if (orphanPid !== void 0 && ports.isRunning(orphanPid)) {
-    ports.log(`claude-use headroom supervisor: stopping daemon pid ${String(orphanPid)} left behind by the previous supervisor`);
+    ports.log(`agent-shim headroom supervisor: stopping daemon pid ${String(orphanPid)} left behind by the previous supervisor`);
     ports.stopProcess(orphanPid);
   }
   let headroomPid;
@@ -3400,13 +3415,13 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     pruneDeadSessions(fs2, paths.headroomSessionsDir, ports.isRunning);
     const ownsNow = ownsState();
     if (!ownsNow && !superseded) {
-      ports.log("claude-use headroom supervisor: another supervisor now owns state.json; serving this daemon's own sessions until they end");
+      ports.log("agent-shim headroom supervisor: another supervisor now owns state.json; serving this daemon's own sessions until they end");
     }
     superseded = !ownsNow;
     const crashed = headroomPid !== void 0 && !ports.isRunning(headroomPid);
     if (headroomPid === void 0 || crashed) {
       if (crashed) {
-        ports.log(`claude-use headroom supervisor: headroom pid ${String(headroomPid)} died`);
+        ports.log(`agent-shim headroom supervisor: headroom pid ${String(headroomPid)} died`);
         headroomPid = void 0;
         runningHash = void 0;
         runningSettingsHash = void 0;
@@ -3435,7 +3450,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
         lastPort = port;
         if (previousSticky !== void 0 && port !== previousSticky) {
           ports.log(
-            `claude-use headroom supervisor: sticky port ${String(previousSticky)} was occupied; moving to ${String(port)} (sessions launched against the old port are stale until they relaunch)`
+            `agent-shim headroom supervisor: sticky port ${String(previousSticky)} was occupied; moving to ${String(port)} (sessions launched against the old port are stale until they relaunch)`
           );
         }
         const recorded = writeOwnState({
@@ -3452,12 +3467,12 @@ async function runSupervisor(initialConfig, ports, options = {}) {
           fs2.removeRecursive(paths.headroomLockFile);
         }
         idleSince = void 0;
-        ports.log(`claude-use headroom supervisor: headroom pid ${String(pid)} ready on 127.0.0.1:${String(port)}`);
+        ports.log(`agent-shim headroom supervisor: headroom pid ${String(pid)} ready on 127.0.0.1:${String(port)}`);
       } else {
         ports.stopProcess(pid);
         consecutiveFailures += 1;
         ports.log(
-          `claude-use headroom supervisor: headroom did not become ready on port ${String(port)} (attempt ${String(consecutiveFailures)} of ${String(HEADROOM_START_RETRY_BUDGET)})`
+          `agent-shim headroom supervisor: headroom did not become ready on port ${String(port)} (attempt ${String(consecutiveFailures)} of ${String(HEADROOM_START_RETRY_BUDGET)})`
         );
         await ports.sleep(backoffForAttempt(consecutiveFailures));
         continue;
@@ -3465,7 +3480,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     } else {
       if (runningHash !== allowlistHash || runningSettingsHash !== settingsHash || installedSource !== config.source) {
         if (sessionsForSupervisor(fs2, paths.headroomSessionsDir, ports.ownPid).length === 0) {
-          ports.log("claude-use headroom supervisor: configuration drifted and no sessions are live; restarting headroom");
+          ports.log("agent-shim headroom supervisor: configuration drifted and no sessions are live; restarting headroom");
           ports.stopProcess(headroomPid);
           headroomPid = void 0;
           runningHash = void 0;
@@ -3479,7 +3494,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
         const idleMs = ports.now() - idleSince;
         if (idleMs >= config.idleShutdownMinutes * MS_PER_MINUTE2) {
           ports.log(
-            `claude-use headroom supervisor: no sessions for ${String(config.idleShutdownMinutes)} minute(s); stopping headroom and exiting`
+            `agent-shim headroom supervisor: no sessions for ${String(config.idleShutdownMinutes)} minute(s); stopping headroom and exiting`
           );
           ports.stopProcess(headroomPid);
           writeOwnState({
@@ -3538,12 +3553,12 @@ function detectAmbientCredential(env, injected) {
   return void 0;
 }
 function formatAmbientCredentialGuardMessage(variable, identityName) {
-  const identitySetCommand = identityName === void 0 ? "claude-use identity set <name> --allow-ambient-credential" : `claude-use identity set ${identityName} --allow-ambient-credential`;
+  const identitySetCommand = identityName === void 0 ? "agent-shim identity set <name> --allow-ambient-credential" : `agent-shim identity set ${identityName} --allow-ambient-credential`;
   return [
     `error: ${variable} is set in the environment. This identity's isolated`,
     "credential would be bypassed \u2014 every identity authenticates as this same key",
     "while it's set. Unset it, or if this is deliberate, opt in per-launch with",
-    "CLAUDE_USE_ALLOW_AMBIENT_CREDENTIAL=1, or persistently for this identity with",
+    "AGENT_SHIM_ALLOW_AMBIENT_CREDENTIAL=1, or persistently for this identity with",
     `\`${identitySetCommand}\`.`
   ].join("\n");
 }