claude-use 6.2.2 → 7.1.0

package/dist/index.mjs

@@ -17,7 +17,7 @@ function expandAllCategoryKey(pairs) {
   if (all === void 0) {
     return { ...rest };
   }
-  const expanded = Object.fromEntries(OVERRIDABLE_CATEGORIES.map((category) => [category, all]));
+  const expanded = Object.fromEntries(OVERRIDABLE_CATEGORIES.filter((category) => !all || category !== "runtime").map((category) => [category, all]));
   return { ...expanded, ...rest };
 }
 var CategoryMapSchema = z.strictObject({
@@ -91,7 +91,7 @@ var CredentialSchema = z.strictObject({
 var ProviderCredentialSchema = CredentialSchema.extend({ target: z.enum(PROVIDER_CREDENTIAL_TARGETS).optional() });
 var RESERVED_PROVIDER_ENV_KEYS = Object.values(CREDENTIAL_TARGET_VARS);
 var ProviderEnvSchema = z.record(z.string().min(1), z.string()).refine((env) => !Object.keys(env).some((key) => RESERVED_PROVIDER_ENV_KEYS.includes(key)), {
-  message: `env may not set ${RESERVED_PROVIDER_ENV_KEYS.join(", ")}: the credential block's target sets one and claude-use removes the others`
+  message: `env may not set ${RESERVED_PROVIDER_ENV_KEYS.join(", ")}: the credential block's target sets one and agent-shim removes the others`
 });
 var CODEX_EFFORTS = ["none", "low", "medium", "high"];
 var CODEX_DEFAULT_TIER_MODELS = Object.freeze({
@@ -734,7 +734,7 @@ function resolveEntry(relPath, params) {
     diagnostics.push({
       code: "UNCLASSIFIED_ENTRY",
       severity: "warning",
-      message: `"${head}" is not in the category map, so it is excluded. Run \`claude-use configure\` to classify it, which records the answer in the local overlay without touching the shipped default map.`,
+      message: `"${head}" is not in the category map, so it is excluded. Run \`agent-shim configure\` to classify it, which records the answer in the local overlay without touching the shipped default map.`,
       subject: head
     });
     return { decision: { relPath, shared: false, via: "unclassified", category }, diagnostics };
@@ -1211,6 +1211,9 @@ function planReconciliation(params) {
   return { actions, diagnostics, conservative };
 }
 
+// src/legacy.ts
+var LEGACY_FARM_MANIFEST_FILENAME = ".claude-use-farm.json";
+
 // src/launcher/lock.ts
 import { randomUUID } from "node:crypto";
 import path3 from "node:path";
@@ -1220,7 +1223,7 @@ var DEFAULT_MAX_ATTEMPTS = 200;
 var IdentityLockBusyError = class extends CliError {
   constructor(identity, lockPath, holderPid) {
     super(
-      `Another claude-use resync is already running for identity "${identity}"` + (holderPid === void 0 ? "" : ` (pid ${String(holderPid)})`) + `. Its lock at ${lockPath} was still held after the full retry budget; nothing was changed.`
+      `Another agent-shim resync is already running for identity "${identity}"` + (holderPid === void 0 ? "" : ` (pid ${String(holderPid)})`) + `. Its lock at ${lockPath} was still held after the full retry budget; nothing was changed.`
     );
     this.identity = identity;
     this.lockPath = lockPath;
@@ -1299,7 +1302,7 @@ function acquireIdentityLock(params) {
 }
 
 // src/launcher/farm.ts
-var FARM_MANIFEST_FILENAME = ".claude-use-farm.json";
+var FARM_MANIFEST_FILENAME = ".agent-shim-farm.json";
 var FarmManifestSchema = z2.strictObject({
   version: z2.literal(1),
   builtAtMs: z2.number(),
@@ -1311,7 +1314,7 @@ var FarmManifestSchema = z2.strictObject({
   links: z2.array(z2.strictObject({ rel: z2.string(), target: z2.string() }))
 });
 function readFarmManifest(fs2, farmRoot) {
-  const raw = fs2.readFileUtf8(path4.join(farmRoot, FARM_MANIFEST_FILENAME));
+  const raw = fs2.readFileUtf8(path4.join(farmRoot, FARM_MANIFEST_FILENAME)) ?? fs2.readFileUtf8(path4.join(farmRoot, LEGACY_FARM_MANIFEST_FILENAME));
   if (raw === void 0) {
     return void 0;
   }
@@ -1400,7 +1403,7 @@ function reconciliationScope(fs2, farmRoot, manifest) {
   if (manifest !== void 0) {
     return topLevelScopeRoots(manifest.materialised);
   }
-  return [...fs2.readdir(farmRoot)].filter((name) => name !== FARM_MANIFEST_FILENAME && fs2.lstat(path4.join(farmRoot, name))?.kind === "dir").sort();
+  return [...fs2.readdir(farmRoot)].filter((name) => name !== FARM_MANIFEST_FILENAME && name !== LEGACY_FARM_MANIFEST_FILENAME && fs2.lstat(path4.join(farmRoot, name))?.kind === "dir").sort();
 }
 function collectFarmListing(fs2, farmRoot, scopeRoots) {
   return scopeRoots.flatMap((root) => listSubtree(fs2, farmRoot, root));
@@ -1424,7 +1427,7 @@ function collectCanonicalCounterparts(fs2, claudeHome, farmListing) {
 }
 function carryOver(params) {
   const manifest = readFarmManifest(params.fs, params.previousRoot);
-  const accounted = /* @__PURE__ */ new Set([FARM_MANIFEST_FILENAME]);
+  const accounted = /* @__PURE__ */ new Set([FARM_MANIFEST_FILENAME, LEGACY_FARM_MANIFEST_FILENAME]);
   for (const rel of manifest?.materialised ?? []) {
     const head = rel.split("/")[0];
     if (head !== void 0 && head !== "") {
@@ -1722,7 +1725,7 @@ function resyncFarm(params) {
       diagnostics.push({
         code: "FARM_PREVIOUS_RETAINED",
         severity: "warning",
-        message: `The superseded farm was left at ${swap.retainedPrevious} because it still holds ${swap.collided.join(", ")}, which the new farm has its own entry for. Nothing was overwritten in either direction; run \`claude-use identity resolve-conflicts ${params.identity}\` to resolve it interactively.`,
+        message: `The superseded farm was left at ${swap.retainedPrevious} because it still holds ${swap.collided.join(", ")}, which the new farm has its own entry for. Nothing was overwritten in either direction; run \`agent-shim identity resolve-conflicts ${params.identity}\` to resolve it interactively.`,
         subject: swap.retainedPrevious
       });
     }
@@ -1759,7 +1762,7 @@ function recoveryDiagnostics(recovery, identity) {
   }
   if (recovery.retained.length > 0) {
     parts.push(
-      `kept ${recovery.retained.join(", ")}, which still holds data the current farm also has an entry for \u2014 run \`claude-use identity resolve-conflicts ${identity}\` to resolve it interactively`
+      `kept ${recovery.retained.join(", ")}, which still holds data the current farm also has an entry for \u2014 run \`agent-shim identity resolve-conflicts ${identity}\` to resolve it interactively`
     );
   }
   return [
@@ -2051,7 +2054,7 @@ function issueLeafCertificate(ca, names, notBefore, notAfter) {
 }
 
 // src/frontdoor/capability.ts
-var CONNECT_PROXY_REALM = "claude-use front door";
+var CONNECT_PROXY_REALM = "agent-shim front door";
 var BASIC_SCHEME = "basic";
 function capabilityFromProxyAuthorization(value) {
   const trimmed = value.trim();
@@ -2178,7 +2181,7 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
   const fail = (message) => {
     writeFrontDoorState(fs2, paths.frontdoorStateFile, { lastError: message, ...sticky() });
     fs2.removeRecursive(paths.frontdoorLockFile);
-    ports.log(`claude-use frontdoor supervisor: ${message}`);
+    ports.log(`agent-shim frontdoor supervisor: ${message}`);
     return 1;
   };
   writeFrontDoorState(fs2, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, ...sticky() });
@@ -2190,7 +2193,7 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     return fail(`could not start the provider listener: ${error instanceof Error ? error.message : String(error)}`);
   }
   if (previousSticky !== void 0 && http2.port !== previousSticky) {
-    ports.log(`claude-use frontdoor supervisor: sticky port ${String(previousSticky)} was occupied; moving to ${String(http2.port)} (sessions launched against the old port are stale until they relaunch)`);
+    ports.log(`agent-shim frontdoor supervisor: sticky port ${String(previousSticky)} was occupied; moving to ${String(http2.port)} (sessions launched against the old port are stale until they relaunch)`);
   }
   lastPort = http2.port;
   const previousStickyConnect = lastConnectPort;
@@ -2202,7 +2205,7 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     return fail(`could not start the CONNECT surface: ${error instanceof Error ? error.message : String(error)}`);
   }
   if (previousStickyConnect !== void 0 && connect2.port !== previousStickyConnect) {
-    ports.log(`claude-use frontdoor supervisor: sticky CONNECT port ${String(previousStickyConnect)} was occupied; moving to ${String(connect2.port)} (OAuth sessions launched against the old port are stale until they relaunch)`);
+    ports.log(`agent-shim frontdoor supervisor: sticky CONNECT port ${String(previousStickyConnect)} was occupied; moving to ${String(connect2.port)} (OAuth sessions launched against the old port are stale until they relaunch)`);
   }
   lastConnectPort = connect2.port;
   const previousStickyDirect = lastDirectPort;
@@ -2215,12 +2218,12 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     return fail(`could not start the direct listener: ${error instanceof Error ? error.message : String(error)}`);
   }
   if (previousStickyDirect !== void 0 && direct.port !== previousStickyDirect) {
-    ports.log(`claude-use frontdoor supervisor: sticky direct port ${String(previousStickyDirect)} was occupied; moving to ${String(direct.port)} (headroom must be restarted to admit the new address)`);
+    ports.log(`agent-shim frontdoor supervisor: sticky direct port ${String(previousStickyDirect)} was occupied; moving to ${String(direct.port)} (headroom must be restarted to admit the new address)`);
   }
   lastDirectPort = direct.port;
   writeFrontDoorState(fs2, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, port: http2.port, connectPort: connect2.port, directPort: direct.port, ...sticky() });
   fs2.removeRecursive(paths.frontdoorLockFile);
-  ports.log(`claude-use frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http2.port)}, CONNECT surface on 127.0.0.1:${String(connect2.port)}`);
+  ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http2.port)}, CONNECT surface on 127.0.0.1:${String(connect2.port)}`);
   let idleSince;
   let ticks = 0;
   for (; ; ) {
@@ -2232,7 +2235,7 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     if (listFrontDoorSessions(fs2, paths.frontdoorSessionsDir).length === 0) {
       idleSince ??= ports.now();
       if (ports.now() - idleSince >= idleShutdownMinutes * MS_PER_MINUTE) {
-        ports.log(`claude-use frontdoor supervisor: no sessions for ${String(idleShutdownMinutes)} minute(s); closing the front door and exiting`);
+        ports.log(`agent-shim frontdoor supervisor: no sessions for ${String(idleShutdownMinutes)} minute(s); closing the front door and exiting`);
         await direct.close();
         await connect2.close();
         await http2.close();
@@ -2272,7 +2275,7 @@ var CONNECT_LIMITS = {
 };
 var CA_VALIDITY_DAYS = 3650;
 var LEAF_VALIDITY_DAYS = 397;
-var CA_SUBJECT_COMMON_NAME = "claude-use front door CA";
+var CA_SUBJECT_COMMON_NAME = "agent-shim front door CA";
 var MS_PER_DAY = 864e5;
 function parseConnectTarget(authority) {
   const colon = authority.lastIndexOf(":");
@@ -2666,7 +2669,7 @@ function realConnectEffects() {
           response.destroy(error);
           return;
         }
-        const body = `claude-use headroom: upstream unreachable (${error.message})`;
+        const body = `agent-shim headroom: upstream unreachable (${error.message})`;
         response.writeHead(HTTP_BAD_GATEWAY, { "content-type": "text/plain", "content-length": String(body.length) });
         response.end(body);
       });
@@ -2755,7 +2758,7 @@ function readHeadroomState(fs2, stateFile) {
 }
 function writeHeadroomState(fs2, stateFile, state) {
   fs2.mkdirp(path6.dirname(stateFile));
-  fs2.writeFileUtf8(stateFile, `${JSON.stringify(state, null, 2)}
+  fs2.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
 `);
 }
 function headroomAllowlist(providers) {
@@ -2866,13 +2869,13 @@ function ensureFrontDoor(params) {
         }
         lastRejection = `the listener on 127.0.0.1:${String(state.port)} (recorded for pid ${String(supervisorPid)}) failed authentication: ${verdict.reason}`;
         if (spawned) {
-          throw new FrontDoorStartError(`claude-use: ${lastRejection}; refusing to send this session's credentials to it. Daemon log: ${paths.frontdoorLogPath}`);
+          throw new FrontDoorStartError(`agent-shim: ${lastRejection}; refusing to send this session's credentials to it. Daemon log: ${paths.frontdoorLogPath}`);
         }
         distrusted.add(supervisorPid);
         continue;
       }
       if (state?.lastError !== void 0) {
-        throw new FrontDoorStartError(`claude-use: the front door reported a fatal error and is not serving: ${state.lastError} (daemon log: ${paths.frontdoorLogPath})`);
+        throw new FrontDoorStartError(`agent-shim: the front door reported a fatal error and is not serving: ${state.lastError} (daemon log: ${paths.frontdoorLogPath})`);
       }
     } else if (!spawned) {
       ports.fs.mkdirp(paths.frontdoorDir);
@@ -2892,7 +2895,7 @@ function ensureFrontDoor(params) {
     if (ports.now() >= deadline) {
       const lastError = state?.lastError;
       throw new FrontDoorStartError(
-        `claude-use: the front door did not become ready within ${String(FRONTDOOR_START_TIMEOUT_MS)}ms` + (lastError === void 0 ? "" : ` (last error: ${lastError})`) + (lastRejection === void 0 ? "" : ` (${lastRejection})`) + `. Daemon log: ${paths.frontdoorLogPath}`
+        `agent-shim: the front door did not become ready within ${String(FRONTDOOR_START_TIMEOUT_MS)}ms` + (lastError === void 0 ? "" : ` (last error: ${lastError})`) + (lastRejection === void 0 ? "" : ` (${lastRejection})`) + `. Daemon log: ${paths.frontdoorLogPath}`
       );
     }
     ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
@@ -3057,7 +3060,7 @@ function isIdentityName(name) {
 // src/usage/read.ts
 var UsageSnapshotError = class extends Error {
   constructor(file, detail) {
-    super(`${file} is not a usage snapshot this claude-use can read (schema version ${String(USAGE_SCHEMA_VERSION)}): ${detail}`);
+    super(`${file} is not a usage snapshot this agent-shim can read (schema version ${String(USAGE_SCHEMA_VERSION)}): ${detail}`);
     this.file = file;
     this.name = "UsageSnapshotError";
   }
@@ -3124,7 +3127,7 @@ function ensureHeadroom(params) {
       }
       if (state.lastError !== void 0) {
         throw new HeadroomStartError(
-          `claude-use: the headroom daemon reported a fatal error and is not serving: ${state.lastError} (daemon log: ${paths.headroomLogPath})`
+          `agent-shim: the headroom daemon reported a fatal error and is not serving: ${state.lastError} (daemon log: ${paths.headroomLogPath})`
         );
       }
     } else if (!spawnedSupervisor) {
@@ -3148,7 +3151,7 @@ function ensureHeadroom(params) {
     if (ports.now() >= deadline) {
       const lastError = state?.lastError;
       throw new HeadroomStartError(
-        `claude-use: the headroom daemon did not become ready within ${String(HEADROOM_START_TIMEOUT_MS)}ms` + (lastError === void 0 ? "" : ` (last error: ${lastError})`) + `. Daemon log: ${paths.headroomLogPath}`
+        `agent-shim: the headroom daemon did not become ready within ${String(HEADROOM_START_TIMEOUT_MS)}ms` + (lastError === void 0 ? "" : ` (last error: ${lastError})`) + `. Daemon log: ${paths.headroomLogPath}`
       );
     }
     ports.sleep(HEADROOM_LAUNCHER_POLL_MS);
@@ -3184,6 +3187,16 @@ function hashSettings(settings) {
   return createHash3("sha256").update(JSON.stringify([...settingsArgs(settings), JSON.stringify(settingsEnv(settings))])).digest("hex");
 }
 
+// src/headroom/source.ts
+import { z as z6 } from "zod";
+var GIT_SPEC_RE = /git\+[^@\s]+(?:@([^\s#]+))?/;
+var COMMIT_SHA_RE = /^[0-9a-f]{40}$/i;
+var DirectUrlSchema = z6.object({ vcs_info: z6.object({ commit_id: z6.string() }) });
+function pinnedGitCommit(spec) {
+  const ref = GIT_SPEC_RE.exec(spec)?.[1];
+  return ref !== void 0 && COMMIT_SHA_RE.test(ref) ? ref.toLowerCase() : void 0;
+}
+
 // src/headroom/supervisor.ts
 function resolveSupervisorConfig(configured) {
   return {
@@ -3257,7 +3270,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
   let config = initialConfig;
   const previousState = readHeadroomState(fs2, paths.headroomStateFile);
   if (previousState?.supervisorPid !== void 0 && previousState.supervisorPid !== ports.ownPid && ports.isRunning(previousState.supervisorPid)) {
-    ports.log(`claude-use headroom supervisor ${String(ports.ownPid)}: supervisor ${String(previousState.supervisorPid)} already owns the daemon; exiting`);
+    ports.log(`agent-shim headroom supervisor ${String(ports.ownPid)}: supervisor ${String(previousState.supervisorPid)} already owns the daemon; exiting`);
     return 0;
   }
   let installedSource = previousState?.installedSource;
@@ -3278,17 +3291,19 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     if (writeOwnState({ lastError: message, ...sticky() })) {
       fs2.removeRecursive(paths.headroomLockFile);
     }
-    ports.log(`claude-use headroom supervisor: ${message}`);
+    ports.log(`agent-shim headroom supervisor: ${message}`);
     return 1;
   };
   const ensureInstalled = () => {
     const version2 = ports.headroomVersion();
     const versionOk = version2 !== void 0 && versionSatisfies(version2, config.source);
-    if (versionOk && (installedSource === void 0 || installedSource === config.source)) {
+    const pinned = pinnedGitCommit(config.source);
+    const commitOk = pinned === void 0 || ports.installedCommit() === pinned;
+    if (versionOk && commitOk && (installedSource === void 0 || installedSource === config.source)) {
       installedSource = config.source;
       return true;
     }
-    ports.log(`claude-use headroom supervisor: installing headroom from ${config.source}`);
+    ports.log(`agent-shim headroom supervisor: installing headroom from ${config.source}`);
     const result = ports.install(config.source);
     if (!result.ok) {
       return false;
@@ -3301,10 +3316,10 @@ async function runSupervisor(initialConfig, ports, options = {}) {
   }
   const version = ports.headroomVersion() ?? "unknown";
   writeOwnState({ supervisorPid: ports.ownPid, version, installedSource, ...sticky() });
-  ports.log(`claude-use headroom supervisor ${String(ports.ownPid)}: managing headroom on allowlist [${allowlistOf(ports).join(", ")}]`);
+  ports.log(`agent-shim headroom supervisor ${String(ports.ownPid)}: managing headroom on allowlist [${allowlistOf(ports).join(", ")}]`);
   const orphanPid = previousState?.headroomPid;
   if (orphanPid !== void 0 && ports.isRunning(orphanPid)) {
-    ports.log(`claude-use headroom supervisor: stopping daemon pid ${String(orphanPid)} left behind by the previous supervisor`);
+    ports.log(`agent-shim headroom supervisor: stopping daemon pid ${String(orphanPid)} left behind by the previous supervisor`);
     ports.stopProcess(orphanPid);
   }
   let headroomPid;
@@ -3326,13 +3341,13 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     pruneDeadSessions(fs2, paths.headroomSessionsDir, ports.isRunning);
     const ownsNow = ownsState();
     if (!ownsNow && !superseded) {
-      ports.log("claude-use headroom supervisor: another supervisor now owns state.json; serving this daemon's own sessions until they end");
+      ports.log("agent-shim headroom supervisor: another supervisor now owns state.json; serving this daemon's own sessions until they end");
     }
     superseded = !ownsNow;
     const crashed = headroomPid !== void 0 && !ports.isRunning(headroomPid);
     if (headroomPid === void 0 || crashed) {
       if (crashed) {
-        ports.log(`claude-use headroom supervisor: headroom pid ${String(headroomPid)} died`);
+        ports.log(`agent-shim headroom supervisor: headroom pid ${String(headroomPid)} died`);
         headroomPid = void 0;
         runningHash = void 0;
         runningSettingsHash = void 0;
@@ -3361,7 +3376,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
         lastPort = port;
         if (previousSticky !== void 0 && port !== previousSticky) {
           ports.log(
-            `claude-use headroom supervisor: sticky port ${String(previousSticky)} was occupied; moving to ${String(port)} (sessions launched against the old port are stale until they relaunch)`
+            `agent-shim headroom supervisor: sticky port ${String(previousSticky)} was occupied; moving to ${String(port)} (sessions launched against the old port are stale until they relaunch)`
           );
         }
         const recorded = writeOwnState({
@@ -3378,12 +3393,12 @@ async function runSupervisor(initialConfig, ports, options = {}) {
           fs2.removeRecursive(paths.headroomLockFile);
         }
         idleSince = void 0;
-        ports.log(`claude-use headroom supervisor: headroom pid ${String(pid)} ready on 127.0.0.1:${String(port)}`);
+        ports.log(`agent-shim headroom supervisor: headroom pid ${String(pid)} ready on 127.0.0.1:${String(port)}`);
       } else {
         ports.stopProcess(pid);
         consecutiveFailures += 1;
         ports.log(
-          `claude-use headroom supervisor: headroom did not become ready on port ${String(port)} (attempt ${String(consecutiveFailures)} of ${String(HEADROOM_START_RETRY_BUDGET)})`
+          `agent-shim headroom supervisor: headroom did not become ready on port ${String(port)} (attempt ${String(consecutiveFailures)} of ${String(HEADROOM_START_RETRY_BUDGET)})`
         );
         await ports.sleep(backoffForAttempt(consecutiveFailures));
         continue;
@@ -3391,7 +3406,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     } else {
       if (runningHash !== allowlistHash || runningSettingsHash !== settingsHash || installedSource !== config.source) {
         if (sessionsForSupervisor(fs2, paths.headroomSessionsDir, ports.ownPid).length === 0) {
-          ports.log("claude-use headroom supervisor: configuration drifted and no sessions are live; restarting headroom");
+          ports.log("agent-shim headroom supervisor: configuration drifted and no sessions are live; restarting headroom");
           ports.stopProcess(headroomPid);
           headroomPid = void 0;
           runningHash = void 0;
@@ -3405,7 +3420,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
         const idleMs = ports.now() - idleSince;
         if (idleMs >= config.idleShutdownMinutes * MS_PER_MINUTE2) {
           ports.log(
-            `claude-use headroom supervisor: no sessions for ${String(config.idleShutdownMinutes)} minute(s); stopping headroom and exiting`
+            `agent-shim headroom supervisor: no sessions for ${String(config.idleShutdownMinutes)} minute(s); stopping headroom and exiting`
           );
           ports.stopProcess(headroomPid);
           writeOwnState({
@@ -3464,12 +3479,12 @@ function detectAmbientCredential(env, injected) {
   return void 0;
 }
 function formatAmbientCredentialGuardMessage(variable, identityName) {
-  const identitySetCommand = identityName === void 0 ? "claude-use identity set <name> --allow-ambient-credential" : `claude-use identity set ${identityName} --allow-ambient-credential`;
+  const identitySetCommand = identityName === void 0 ? "agent-shim identity set <name> --allow-ambient-credential" : `agent-shim identity set ${identityName} --allow-ambient-credential`;
   return [
     `error: ${variable} is set in the environment. This identity's isolated`,
     "credential would be bypassed \u2014 every identity authenticates as this same key",
     "while it's set. Unset it, or if this is deliberate, opt in per-launch with",
-    "CLAUDE_USE_ALLOW_AMBIENT_CREDENTIAL=1, or persistently for this identity with",
+    "AGENT_SHIM_ALLOW_AMBIENT_CREDENTIAL=1, or persistently for this identity with",
     `\`${identitySetCommand}\`.`
   ].join("\n");
 }

package/dist/types/cliError.d.ts

@@ -3,7 +3,7 @@ export declare const EXIT_FAILURE = 1;
 /** Exit status for a usage error: an unknown command or option, a malformed flag value, or required input missing with no terminal to prompt on. */
 export declare const EXIT_USAGE = 2;
 /**
- * Base class for every error this CLI throws to represent an expected, user-facing failure: bad input, a missing identity/profile/rule, a malformed config file. `reportFatalError` prints this class as `claude-use: <message>` with no stack trace and exits with `exitCode`; anything that does not extend it is an unexpected bug, reported by message alone unless `CLAUDE_USE_DEBUG` asks for the stack.
+ * Base class for every error this CLI throws to represent an expected, user-facing failure: bad input, a missing identity/profile/rule, a malformed config file. `reportFatalError` prints this class as `agent-shim: <message>` with no stack trace and exits with `exitCode`; anything that does not extend it is an unexpected bug, reported by message alone unless `AGENT_SHIM_DEBUG` asks for the stack.
  */
 export declare abstract class CliError extends Error {
     /** The process exit status this failure maps to. `EXIT_FAILURE` unless a subclass says otherwise. */

package/dist/types/config/classify.d.ts

@@ -17,9 +17,9 @@ export interface ClassificationPattern {
 export interface ClassifyResult {
     /** Every input name mapped to its category, or to null when nothing in either map recognises it. */
     readonly classification: ReadonlyMap<string, CategoryName | null>;
-    /** The input names that nothing recognised, in input order. These are the names `claude-use configure` prompts about. */
+    /** The input names that nothing recognised, in input order. These are the names `agent-shim configure` prompts about. */
     readonly unclassified: readonly string[];
-    /** For each classified name, the pattern that decided it — used by `claude-use check` to explain a classification. */
+    /** For each classified name, the pattern that decided it — used by `agent-shim check` to explain a classification. */
     readonly decidedBy: ReadonlyMap<string, ClassificationPattern>;
 }
 /** True when `pattern` contains no glob metacharacter, so it matches exactly one literal name. */
@@ -40,7 +40,7 @@ export declare function loadClassification(paths: LayoutPaths): LoadedClassifica
 /**
  * Classifies a list of real top-level `~/.claude` entry names against the shipped category map plus an optional local overlay.
  *
- * An unrecognised name maps to `null` rather than being silently assumed safe or silently dropped: the resolver treats it as not-shared and reports it, and `claude-use configure` prompts for an answer that is then written to the local overlay.
+ * An unrecognised name maps to `null` rather than being silently assumed safe or silently dropped: the resolver treats it as not-shared and reports it, and `agent-shim configure` prompts for an answer that is then written to the local overlay.
  */
 export declare function classifyEntries(names: readonly string[], options: {
     defaults: CategoryClassification;

package/dist/types/config/schema.d.ts

@@ -16,13 +16,13 @@ export declare function isCategoryName(name: string): name is CategoryName;
  */
 export type CategoryMap = Partial<Record<OverridableCategory, boolean>>;
 /**
- * Expands the `all` pseudo-category key into every overridable category set to that same value, dropping `all` itself from the result. An explicit named category always wins over the `all` expansion regardless of where it appears relative to `all` in the input — `{ all: true, runtime: false }` means "share everything except runtime", not "runtime is false, then immediately overwritten back to true by all's own expansion". Built from `OVERRIDABLE_CATEGORIES` rather than the four names spelled out again, so a future addition to that list is covered by `all` with no change needed here.
+ * Expands the `all` pseudo-category key, dropping `all` itself from the result. `all: true` opens every category meant to be shared across identities, which is every overridable category except `runtime`: `runtime` holds live per-process and per-machine state (daemon locks and auth status, PIDs, IDE and shell snapshots) that must never be pooled across running identities, so it opens only when named explicitly. `all: false` closes every overridable category, `runtime` included, so it also closes a `runtime` an earlier layer opened. An explicit named category always wins over the `all` expansion regardless of where it appears relative to `all` in the input: `{ all: true, runtime: true }` opens `runtime` too, and `{ all: true, history: false }` means "share everything except history", not "history is false, then immediately overwritten back to true".
  *
- * This is the one shared implementation `CategoryMapSchema`'s own transform, `launcher/cliOverride.ts`'s `--category`/`CLAUDE_USE_CATEGORY_OVERRIDE` handling, and `configProfiles.ts`'s `claude-use profile set --category` all call — so `all` means the same thing regardless of which of those three input paths it arrived through.
+ * This is the one shared implementation `CategoryMapSchema`'s own transform, `launcher/cliOverride.ts`'s `--category`/`AGENT_SHIM_CATEGORY_OVERRIDE` handling, and `configProfiles.ts`'s `agent-shim profile set --category` all call, so `all` means the same thing regardless of which of those three input paths it arrived through.
  */
 export declare function expandAllCategoryKey(pairs: Readonly<Record<string, boolean>>): Record<string, boolean>;
 /**
- * The category toggle map as written by hand: the four overridable categories, plus `all` as shorthand for "every overridable category at once" (expanded by `expandAllCategoryKey` above). `secret` is omitted from the shape entirely, so `{ "categories": { "secret": true } }` is rejected at parse time rather than relying solely on the resolver's runtime floor check. The closed shape is also what lets the published JSON Schema offer real key-name autocomplete, which an open record type cannot.
+ * The category toggle map as written by hand: the four overridable categories, plus `all` as shorthand for "every shareable category at once" (expanded by `expandAllCategoryKey` above). `secret` is omitted from the shape entirely, so `{ "categories": { "secret": true } }` is rejected at parse time rather than relying solely on the resolver's runtime floor check. The closed shape is also what lets the published JSON Schema offer real key-name autocomplete, which an open record type cannot.
  */
 export declare const CategoryMapSchema: z.ZodPipe<z.ZodObject<{
     all: z.ZodOptional<z.ZodBoolean>;
@@ -40,7 +40,7 @@ export declare const CategoryMapSchema: z.ZodPipe<z.ZodObject<{
 /** A duration literal: a positive integer count followed by a unit. Used by `newerThan`/`olderThan`. */
 export declare const DURATION_RE: RegExp;
 /**
- * A conditional guard on an entries value or a whole directory rule. Every field present within one `when` object must hold (AND logic). An empty object is vacuously true — `claude-use check` warns about it, it is never an error.
+ * A conditional guard on an entries value or a whole directory rule. Every field present within one `when` object must hold (AND logic). An empty object is vacuously true — `agent-shim check` warns about it, it is never an error.
  */
 export declare const WhenSchema: z.ZodObject<{
     newerThan: z.ZodOptional<z.ZodString>;
@@ -93,7 +93,7 @@ export declare const CREDENTIAL_TARGETS: readonly ["bearer", "apiKey", "oauthTok
 export type CredentialTarget = (typeof CREDENTIAL_TARGETS)[number];
 /** The targets a provider's credential may use: every target except `oauthToken`, which only an identity can carry. */
 export declare const PROVIDER_CREDENTIAL_TARGETS: readonly ["bearer", "apiKey"];
-/** The environment variable each credential target exports the token as. These are also the variables no provider `env` block may set, since claude-use sets and clears them itself. */
+/** The environment variable each credential target exports the token as. These are also the variables no provider `env` block may set, since agent-shim sets and clears them itself. */
 export declare const CREDENTIAL_TARGET_VARS: {
     readonly bearer: "ANTHROPIC_AUTH_TOKEN";
     readonly apiKey: "ANTHROPIC_API_KEY";
@@ -133,7 +133,7 @@ export declare const CredentialSourceSchema: z.ZodUnion<readonly [z.ZodObject<{
     literal: z.ZodString;
 }, z.core.$strict>]>;
 export type CredentialSource = z.infer<typeof CredentialSourceSchema>;
-/** Where a cached credential is kept: the macOS login Keychain, or a mode-0600 file under the claude-use home. */
+/** Where a cached credential is kept: the macOS login Keychain, or a mode-0600 file under the agent-shim home. */
 export declare const CREDENTIAL_CACHE_STORES: readonly ["keychain", "file"];
 export type CredentialCacheStore = (typeof CREDENTIAL_CACHE_STORES)[number];
 /**
@@ -187,7 +187,7 @@ export declare const CredentialSchema: z.ZodObject<{
     }, z.core.$strict>>;
 }, z.core.$strict>;
 export type Credential = z.infer<typeof CredentialSchema>;
-/** The kinds of provider: `http` is an Anthropic Messages endpoint at a fixed `baseUrl` (the default when `kind` is absent), and `codex` is ChatGPT's Codex backend reached through claude-use's own supervised translation daemon. */
+/** The kinds of provider: `http` is an Anthropic Messages endpoint at a fixed `baseUrl` (the default when `kind` is absent), and `codex` is ChatGPT's Codex backend reached through agent-shim's own supervised translation daemon. */
 export declare const PROVIDER_KINDS: readonly ["http", "codex"];
 /**
  * The Claude model tiers the codex translator maps, in the order they are matched: the first tier whose name is a substring of the requested model (case-insensitive) decides the codex model. `fable` comes before `opus` because a fable model name is the most specific.
@@ -382,7 +382,7 @@ export type Provider = z.infer<typeof ProviderSchema>;
 /** True when `provider` is a codex provider. `kind` is the tag, since a codex provider's own distinguishing block is optional. */
 export declare function isCodexProvider(provider: Provider): provider is CodexProvider;
 /**
- * A named, reusable configuration profile at `~/.claude-use/config-profiles/<name>.json`.
+ * A named, reusable configuration profile at `~/.agent-shim/config-profiles/<name>.json`.
  *
  * `extends` is a flat array of other profiles' *names*, deliberately not a self-referential `z.lazy()` schema: nothing in this shape points back at a profile object, so each file validates in isolation and the extends graph is walked at resolve time. That also means Zod cannot detect a circular `extends` definition — the walker in `src/resolve/extends.ts` carries its own cycle guard.
  */
@@ -431,7 +431,7 @@ declare const PoolSchema: z.ZodObject<{
     identities: z.ZodArray<z.ZodString>;
 }, z.core.$strict>;
 export type Pool = z.infer<typeof PoolSchema>;
-/** One directory rule in `~/.claude-use/directory-rules.json`, scoped to an explicit absolute (or `~`-rooted) path. */
+/** One directory rule in `~/.agent-shim/directory-rules.json`, scoped to an explicit absolute (or `~`-rooted) path. */
 export declare const DirectoryRuleSchema: z.ZodObject<{
     entries: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
         value: z.ZodBoolean;
@@ -477,7 +477,7 @@ export declare const DirectoryRuleSchema: z.ZodObject<{
     }, z.core.$strict>>;
 }, z.core.$strict>;
 export type DirectoryRule = z.infer<typeof DirectoryRuleSchema>;
-/** The `~/.claude-use/directory-rules.json` file. */
+/** The `~/.agent-shim/directory-rules.json` file. */
 export declare const DirectoryRulesSchema: z.ZodObject<{
     $schema: z.ZodOptional<z.ZodString>;
     rules: z.ZodArray<z.ZodObject<{
@@ -527,7 +527,7 @@ export declare const DirectoryRulesSchema: z.ZodObject<{
 }, z.core.$strict>;
 export type DirectoryRules = z.infer<typeof DirectoryRulesSchema>;
 /**
- * A committed `.claude-use.json` (or its gitignored `.claude-use.local.json` sibling). Structurally a directory rule without the `path` field: its scope is implicit — wherever the file lives, and everything below it — which is exactly what makes it portable across clone locations.
+ * A committed `.agent-shim.json` (or its gitignored `.agent-shim.local.json` sibling). Structurally a directory rule without the `path` field: its scope is implicit — wherever the file lives, and everything below it — which is exactly what makes it portable across clone locations.
  */
 export declare const PortableConfigSchema: z.ZodObject<{
     entries: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
@@ -607,7 +607,7 @@ export declare const HEADROOM_DEFAULT_IDLE_SHUTDOWN_MINUTES = 15;
  * The default `frontdoor.idleShutdownMinutes`, the same trade-off as headroom's: warm through a break, gone the same working day once abandoned.
  */
 export declare const FRONTDOOR_DEFAULT_IDLE_SHUTDOWN_MINUTES = 15;
-/** The user-global `~/.claude-use/config.json`. */
+/** The user-global `~/.agent-shim/config.json`. */
 export declare const GlobalConfigSchema: z.ZodObject<{
     $schema: z.ZodOptional<z.ZodString>;
     defaultConfigProfile: z.ZodOptional<z.ZodString>;
@@ -729,7 +729,7 @@ export declare const CategoryClassificationSchema: z.ZodObject<{
     settings: z.ZodArray<z.ZodString>;
 }, z.core.$strict>;
 export type CategoryClassification = z.infer<typeof CategoryClassificationSchema>;
-/** The gitignored `~/.claude-use/categories.local.json` overlay: any subset of the classification lists, answering "what category is this new entry?" without editing the shipped default map. */
+/** The gitignored `~/.agent-shim/categories.local.json` overlay: any subset of the classification lists, answering "what category is this new entry?" without editing the shipped default map. */
 export declare const CategoryClassificationOverlaySchema: z.ZodObject<{
     $schema: z.ZodOptional<z.ZodString>;
     secret: z.ZodOptional<z.ZodArray<z.ZodString>>;

package/dist/types/frontdoor/capability.d.ts

@@ -1,10 +1,10 @@
 /**
- * How a launch's capability token is presented and checked. The token reaches the child twice: as the `x-claude-use-auth` header on every request it sends (see `AUTH_HEADER`), and as the password in the `HTTPS_PROXY` URL an OAuth launch gets, which every proxy-aware client turns into `Proxy-Authorization: Basic ...` on its CONNECT request. Both are checked against the same live registry with the same constant-time comparison.
+ * How a launch's capability token is presented and checked. The token reaches the child twice: as the `x-agent-shim-auth` header on every request it sends (see `AUTH_HEADER`), and as the password in the `HTTPS_PROXY` URL an OAuth launch gets, which every proxy-aware client turns into `Proxy-Authorization: Basic ...` on its CONNECT request. Both are checked against the same live registry with the same constant-time comparison.
  */
 /** The user name in the proxy URL. A label only: the surface checks the password, which is the capability, and ignores the user name, so nothing depends on how a client spells it. */
-export declare const CONNECT_PROXY_USER = "claude-use";
+export declare const CONNECT_PROXY_USER = "agent-shim";
 /** The realm the CONNECT surface's 407 challenge names, so a client that waits for a challenge before sending credentials knows which ones to send. */
-export declare const CONNECT_PROXY_REALM = "claude-use front door";
+export declare const CONNECT_PROXY_REALM = "agent-shim front door";
 /**
  * The `HTTPS_PROXY` value for a launch: the CONNECT surface's loopback address with the capability as the URL's password. Both userinfo halves are percent-encoded, because a client percent-decodes userinfo before it builds the `Proxy-Authorization` value, so the surface receives exactly the token whatever characters it holds.
  */

package/dist/types/frontdoor/connect.d.ts

@@ -1,7 +1,7 @@
 import type { IncomingHttpHeaders, IncomingMessage, ServerResponse } from "node:http";
 import * as net from "node:net";
 /**
- * The front door's CONNECT surface, so an OAuth session can have claude-use's routing AND Claude Code's Remote Control at once: Remote Control refuses any `ANTHROPIC_BASE_URL` other than the real API, but happily honours `HTTPS_PROXY`, so OAuth launches route at the proxy layer instead.
+ * The front door's CONNECT surface, so an OAuth session can have agent-shim's routing AND Claude Code's Remote Control at once: Remote Control refuses any `ANTHROPIC_BASE_URL` other than the real API, but happily honours `HTTPS_PROXY`, so OAuth launches route at the proxy layer instead.
  *
  * Nothing is tunnelled or intercepted for a client that has not authenticated: every CONNECT request must present a live launch's capability as its proxy credential (`Proxy-Authorization: Basic`, which clients derive from the credential in the `HTTPS_PROXY` URL the launcher sets), or it is answered 407 before any target is dialled, so the port is no open proxy for other local processes. Pending and authenticated connections are bounded by `ConnectLimits`.
  *
@@ -69,7 +69,7 @@ export interface LeafCert {
     readonly certPem: string;
     readonly keyPem: string;
 }
-/** Generates the local CA: one RSA keypair, self-signed, CA-only by basicConstraints and keyUsage, with a random serial. Built on `node:crypto` alone (see `x509.ts`), no openssl, so the same code works on every platform claude-use ships to. */
+/** Generates the local CA: one RSA keypair, self-signed, CA-only by basicConstraints and keyUsage, with a random serial. Built on `node:crypto` alone (see `x509.ts`), no openssl, so the same code works on every platform agent-shim ships to. */
 export declare function generateCa(now: Readonly<Date>): CaMaterial;
 /** The names the front door's provider listener answers to: the loopback address every provider session's base URL names, plus the loopback hostname for a client that spells it that way. */
 export declare const LOOPBACK_LEAF_NAMES: readonly string[];

package/dist/types/frontdoor/ensure.d.ts

@@ -15,13 +15,13 @@ export interface EnsureFrontDoorPorts {
     readonly sleep: (ms: number) => void;
     /** Spawns the detached front-door supervisor, returning its pid. */
     readonly spawnSupervisor: (paths: LayoutPaths) => number;
-    /** Authenticates the provider listener on `port`: a TLS handshake chaining to claude-use's CA and a healthy answer, with no capability sent (see `probeFrontDoorSync`). */
+    /** Authenticates the provider listener on `port`: a TLS handshake chaining to agent-shim's CA and a healthy answer, with no capability sent (see `probeFrontDoorSync`). */
     readonly verifyListener: (port: number) => ListenerVerdict;
 }
 /**
  * Brings the front door up for this launch, or finds it serving, and registers this launcher pid in its session registry: the fact that keeps the door from idling out while this session lives, and the record that holds this launch's capability token. The same lock-and-poll coordination as headroom's and the old codex daemon's ensure: the exclusive-create start lock decides which of several concurrent launches spawns the one supervisor, everyone waits on state.json, and a lock whose holder died is removed and retried. Ready means state names a live supervisor and both listeners' ports, which the supervisor writes only after both have bound (and the provider listener has answered its own health probe).
  *
- * A live pid in state proves nothing about who holds the port it names: the door may have crashed and left the port to anyone, or the pid may have been reused by an unrelated process. So before anything is registered or returned, the provider listener is authenticated over TLS against claude-use's CA. A listener that fails (wrong certificate, nothing answering, a bad answer) is treated as a stale or hostile owner: its pid is distrusted for the rest of this call and a replacement supervisor is spawned, which binds a free port when the sticky one is held and is then verified in turn. If a supervisor this call spawned also fails verification, the launch is refused naming the reason and the daemon log; no capability is written and no address is handed to the child.
+ * A live pid in state proves nothing about who holds the port it names: the door may have crashed and left the port to anyone, or the pid may have been reused by an unrelated process. So before anything is registered or returned, the provider listener is authenticated over TLS against agent-shim's CA. A listener that fails (wrong certificate, nothing answering, a bad answer) is treated as a stale or hostile owner: its pid is distrusted for the rest of this call and a replacement supervisor is spawned, which binds a free port when the sticky one is held and is then verified in turn. If a supervisor this call spawned also fails verification, the launch is refused naming the reason and the daemon log; no capability is written and no address is handed to the child.
  */
 export declare function ensureFrontDoor(params: {
     readonly paths: LayoutPaths;

package/dist/types/frontdoor/probe.d.ts

@@ -6,7 +6,7 @@ export type ListenerVerdict = {
     readonly reason: string;
 };
 /**
- * Authenticates the front door's provider listener before a launch trusts it: a TLS handshake that must chain to claude-use's CA (whose key only this user can read) for 127.0.0.1, then a healthy answer. A process that merely holds the port (a stale state file's port re-bound by someone else, or a reused pid's listener) cannot complete that handshake, so it fails here and the launch never hands its child that address.
+ * Authenticates the front door's provider listener before a launch trusts it: a TLS handshake that must chain to agent-shim's CA (whose key only this user can read) for 127.0.0.1, then a healthy answer. A process that merely holds the port (a stale state file's port re-bound by someone else, or a reused pid's listener) cannot complete that handshake, so it fails here and the launch never hands its child that address.
  *
  * Synchronous because the launcher is synchronous right through to `spawnSync`: the HTTPS request runs on a worker thread and this thread blocks on a shared buffer until the worker posts its verdict.
  */

package/dist/types/frontdoor/supervisor.d.ts

@@ -17,7 +17,7 @@ export interface FrontDoorSupervisorPorts {
     /** Zombie-aware liveness, the notion every coordination decision in this project uses. */
     readonly isRunning: (pid: number) => boolean;
     /**
-     * Starts the provider listener in this process on `preferredPort` (falling back to any free port when the sticky one is taken, decided at bind time rather than by a racy check-then-bind probe) and resolves once it has bound and answered its own health probe over TLS. This is the HTTPS listener every provider session's base URL points at, serving a loopback leaf signed by claude-use's CA.
+     * Starts the provider listener in this process on `preferredPort` (falling back to any free port when the sticky one is taken, decided at bind time rather than by a racy check-then-bind probe) and resolves once it has bound and answered its own health probe over TLS. This is the HTTPS listener every provider session's base URL points at, serving a loopback leaf signed by agent-shim's CA.
      */
     readonly startProviderListener: (preferredPort: number | undefined) => Promise<FrontDoorListenerHandle>;
     /**

package/dist/types/frontdoor/x509.d.ts

@@ -1,6 +1,6 @@
 /** An IP address as the 4 or 16 octets an iPAddress GeneralName carries. */
 export declare function ipBytes(address: string): Buffer;
-/** A key pair in the PEM forms claude-use persists. */
+/** A key pair in the PEM forms agent-shim persists. */
 export interface PemKeyPair {
     readonly certPem: string;
     readonly keyPem: string;

package/dist/types/headroom/source.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Whether an install spec resolves through a git ref that can move underneath it. A full commit SHA never moves; a branch name, a tag a maintainer can re-point, or no ref at all (the remote's default branch) can, and a rebased, renamed or deleted branch changes or breaks every fresh install. A registry requirement is not a git source.
+ */
+export declare function isMovingGitSource(spec: string): boolean;
+/** The full commit SHA an install spec pins, lowercased, or undefined when the spec is a registry requirement or follows a moving ref. */
+export declare function pinnedGitCommit(spec: string): string | undefined;
+/** The commit an install was built from, read from the text of its `direct_url.json`, or undefined when the file records no VCS commit (a registry install) or is not valid JSON. */
+export declare function parseInstalledCommit(directUrlJson: string): string | undefined;

package/dist/types/headroom/state.d.ts

@@ -38,7 +38,7 @@ export type HeadroomLock = z.infer<typeof HeadroomLockSchema>;
 /** Reads state.json, or undefined when absent. A malformed file is treated as absent: the lock-and-spawn flow below overwrites it with a fresh supervisor's state rather than crashing every future launch over one bad write. */
 export declare function readHeadroomState(fs: HeadroomFs, stateFile: string): HeadroomState | undefined;
 /**
- * Writes state.json. A plain write rather than the write-then-rename most config files get: state.json is advisory coordination, read tolerantly (`readHeadroomState` treats a malformed file as absent) and rewritten constantly by the supervisor, and the exclusive-create start lock below, not this file, is the actual mutual exclusion.
+ * Writes state.json atomically (a temporary sibling renamed into place), so a concurrent reader never sees a partial file. A reader treats a malformed file as absent, and a launcher that finds no supervisor in state spawns one, so a torn write read mid-flight started a redundant supervisor and daemon.
  */
 export declare function writeHeadroomState(fs: HeadroomFs, stateFile: string, state: Readonly<HeadroomState>): void;
 /** The allowlist the daemon is started with: every provider's base URL plus Claude Code's own API, so a session with no provider selected reaches the real Anthropic upstream through the same proxy. */