claude-use 9.11.0 → 9.12.1

package/README.md

@@ -265,6 +265,7 @@ Issues and pull requests are welcome. Please keep the tool itself free of assump
 - [docs/rc-interception-rig.md](docs/rc-interception-rig.md): the Remote Control interception rig: bring-up, per-host TLS proof, teardown, and the manual login step.
 - [docs/rc-web-client.md](docs/rc-web-client.md): the self-hosted Remote Control web client: the page the door serves behind its control token for browser control of its sessions, how it authenticates and speaks the typed API, and how it is tested.
 - [docs/rc-agent-events.md](docs/rc-agent-events.md): the task and subagent lifecycle events a Remote Control session's read stream carries, and the keys that join them to the transcripts on disk.
+- [docs/agent-transcripts.md](docs/agent-transcripts.md): how Claude Code lays out a session's subagents, forks, workflow runs, tasks, teams and jobs on disk, and which fields are always present.
 
 ## License
 

package/dist/cli.cjs

@@ -27866,6 +27866,10 @@ function realIsProcessZombie(pid) {
 function realIsProcessRunning(pid) {
   return realIsProcessAlive(pid) && !realIsProcessZombie(pid);
 }
+function realIsFrontDoorSupervisor(pid) {
+  const result = (0, import_node_child_process2.spawnSync)("ps", ["-o", "command=", "-p", String(pid)], { encoding: "utf8" });
+  return result.status === 0 && result.stdout.split(/\s+/).includes(FRONT_DOOR_SUPERVISOR_SUBCOMMAND);
+}
 function expandHome(filePath) {
   return filePath.startsWith("~/") ? import_node_path8.default.join(import_node_os2.default.homedir(), filePath.slice(1)) : filePath;
 }
@@ -28068,7 +28072,7 @@ function realResolveClaudeBinary(isOwnBinary) {
 function realInstalledClaudeVersions() {
   return installedVersions(listVersionsDir(defaultVersionsDir()));
 }
-var import_node_child_process2, import_node_crypto4, import_node_fs3, import_node_os2, import_node_path8, import_node_sea, realFsPort, OWNER_ONLY_DIR_MODE, OWNER_ONLY_FILE_MODE, PERMISSION_BITS, realFarmFs, INT32_BYTE_LENGTH, realRunPort, MACOS_GUI_SESSION_MANAGER, realCredentialPort, SOCKET_PERMISSION_BITS, realHeadroomSocketTrust, realSpawnPort, realProcPort, realLogPort, EXECUTE_BITS_MASK, WINDOWS_DEFAULT_PATHEXT;
+var import_node_child_process2, import_node_crypto4, import_node_fs3, import_node_os2, import_node_path8, import_node_sea, realFsPort, OWNER_ONLY_DIR_MODE, OWNER_ONLY_FILE_MODE, PERMISSION_BITS, realFarmFs, INT32_BYTE_LENGTH, FRONT_DOOR_SUPERVISOR_SUBCOMMAND, realRunPort, MACOS_GUI_SESSION_MANAGER, realCredentialPort, SOCKET_PERMISSION_BITS, realHeadroomSocketTrust, realSpawnPort, realProcPort, realLogPort, EXECUTE_BITS_MASK, WINDOWS_DEFAULT_PATHEXT;
 var init_realPorts = __esm({
   "src/realPorts.ts"() {
     "use strict";
@@ -28209,6 +28213,7 @@ var init_realPorts = __esm({
       }
     };
     INT32_BYTE_LENGTH = 4;
+    FRONT_DOOR_SUPERVISOR_SUBCOMMAND = "__frontdoor-supervisor";
     realRunPort = {
       run(command, args) {
         const result = (0, import_node_child_process2.spawnSync)(command, [...args], { encoding: "utf8" });
@@ -33243,7 +33248,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "claude-use",
-      version: "9.11.0",
+      version: "9.12.1",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -61034,20 +61039,34 @@ function ensureFrontDoor(params) {
   let replaced = false;
   const distrusted = /* @__PURE__ */ new Set();
   let lastRejection;
+  const verifyWithRetry = (port) => {
+    let verdict = ports.verifyListener(port);
+    for (let attempt = 1; !verdict.ok && attempt < FRONTDOOR_PROBE_ATTEMPTS; attempt += 1) {
+      ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
+      verdict = ports.verifyListener(port);
+    }
+    return verdict;
+  };
+  const stopAndAwaitExit = (supervisorPid, failure2) => {
+    ports.stopSupervisor(supervisorPid);
+    while (ports.isRunning(supervisorPid)) {
+      if (ports.now() >= deadline) {
+        throw new FrontDoorStartError(`${failure2}. Daemon log: ${paths.frontdoorLogPath}`);
+      }
+      ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
+    }
+  };
   for (; ; ) {
     const state = readFrontDoorState(ports.fs, paths.frontdoorStateFile);
     const supervisorPid = state?.supervisorPid;
     if (supervisorPid !== void 0 && !distrusted.has(supervisorPid) && ports.isRunning(supervisorPid)) {
       if (state?.port !== void 0 && state.connectPort !== void 0) {
-        const verdict = ports.verifyListener(state.port);
+        const verdict = verifyWithRetry(state.port);
         if (verdict.ok && !replaced && !spawned && (params.replace === true || (state.protocol ?? 0) < FRONT_DOOR_PROTOCOL)) {
-          ports.stopSupervisor(supervisorPid);
-          while (ports.isRunning(supervisorPid)) {
-            if (ports.now() >= deadline) {
-              throw new FrontDoorStartError(`the front door (pid ${String(supervisorPid)}, protocol ${String(state.protocol ?? 0)}; this launcher speaks protocol ${String(FRONT_DOOR_PROTOCOL)}) was asked to be replaced and did not exit. Daemon log: ${paths.frontdoorLogPath}`);
-            }
-            ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
-          }
+          stopAndAwaitExit(
+            supervisorPid,
+            `the front door (pid ${String(supervisorPid)}, protocol ${String(state.protocol ?? 0)}; this launcher speaks protocol ${String(FRONT_DOOR_PROTOCOL)}) was asked to be replaced and did not exit`
+          );
           replaced = true;
           continue;
         }
@@ -61060,6 +61079,10 @@ function ensureFrontDoor(params) {
         if (spawned) {
           throw new FrontDoorStartError(`${lastRejection}; refusing to send this session's credentials to it. Daemon log: ${paths.frontdoorLogPath}`);
         }
+        if (ports.isFrontDoorSupervisor(supervisorPid)) {
+          stopAndAwaitExit(supervisorPid, `the front door (pid ${String(supervisorPid)}) stopped answering and did not exit when asked to`);
+          continue;
+        }
         distrusted.add(supervisorPid);
         continue;
       }
@@ -61107,7 +61130,7 @@ function restartFrontDoor(params) {
   }
   return { action: "restarted", previousPid, pid };
 }
-var import_node_crypto10, FRONTDOOR_START_TIMEOUT_MS, FRONTDOOR_LAUNCHER_POLL_MS, FrontDoorStartError;
+var import_node_crypto10, FRONTDOOR_START_TIMEOUT_MS, FRONTDOOR_LAUNCHER_POLL_MS, FRONTDOOR_PROBE_ATTEMPTS, FrontDoorStartError;
 var init_ensure2 = __esm({
   "src/frontdoor/ensure.ts"() {
     "use strict";
@@ -61117,6 +61140,7 @@ var init_ensure2 = __esm({
     init_state2();
     FRONTDOOR_START_TIMEOUT_MS = 3e4;
     FRONTDOOR_LAUNCHER_POLL_MS = 100;
+    FRONTDOOR_PROBE_ATTEMPTS = 3;
     FrontDoorStartError = class extends CliError {
       constructor(message) {
         super(message);
@@ -61242,6 +61266,7 @@ function realEnsurePorts(paths, spawnDaemon) {
     now: () => Date.now(),
     sleep: realSleepSync,
     spawnSupervisor: (layout) => spawnDaemon(layout, "__frontdoor-supervisor", layout.frontdoorLogPath),
+    isFrontDoorSupervisor: realIsFrontDoorSupervisor,
     stopSupervisor: (pid) => {
       process.kill(pid, "SIGTERM");
     },

package/dist/index.cjs

@@ -2663,7 +2663,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "claude-use",
-      version: "9.11.0",
+      version: "9.12.1",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -3427,6 +3427,10 @@ function realIsProcessZombie(pid) {
 function realIsProcessRunning(pid) {
   return realIsProcessAlive(pid) && !realIsProcessZombie(pid);
 }
+function realIsFrontDoorSupervisor(pid) {
+  const result = (0, import_node_child_process2.spawnSync)("ps", ["-o", "command=", "-p", String(pid)], { encoding: "utf8" });
+  return result.status === 0 && result.stdout.split(/\s+/).includes(FRONT_DOOR_SUPERVISOR_SUBCOMMAND);
+}
 function expandHome2(filePath) {
   return filePath.startsWith("~/") ? import_node_path13.default.join(import_node_os2.default.homedir(), filePath.slice(1)) : filePath;
 }
@@ -3624,7 +3628,7 @@ function realResolveClaudeBinary(isOwnBinary) {
 function realInstalledClaudeVersions() {
   return installedVersions(listVersionsDir(defaultVersionsDir()));
 }
-var import_node_child_process2, import_node_crypto8, import_node_fs2, import_node_os2, import_node_path13, import_node_sea, realFsPort, OWNER_ONLY_DIR_MODE, OWNER_ONLY_FILE_MODE, PERMISSION_BITS, realFarmFs, INT32_BYTE_LENGTH, realRunPort, MACOS_GUI_SESSION_MANAGER, realCredentialPort, SOCKET_PERMISSION_BITS, realHeadroomSocketTrust, realSpawnPort, realProcPort, EXECUTE_BITS_MASK, WINDOWS_DEFAULT_PATHEXT;
+var import_node_child_process2, import_node_crypto8, import_node_fs2, import_node_os2, import_node_path13, import_node_sea, realFsPort, OWNER_ONLY_DIR_MODE, OWNER_ONLY_FILE_MODE, PERMISSION_BITS, realFarmFs, INT32_BYTE_LENGTH, FRONT_DOOR_SUPERVISOR_SUBCOMMAND, realRunPort, MACOS_GUI_SESSION_MANAGER, realCredentialPort, SOCKET_PERMISSION_BITS, realHeadroomSocketTrust, realSpawnPort, realProcPort, EXECUTE_BITS_MASK, WINDOWS_DEFAULT_PATHEXT;
 var init_realPorts = __esm({
   "src/realPorts.ts"() {
     "use strict";
@@ -3765,6 +3769,7 @@ var init_realPorts = __esm({
       }
     };
     INT32_BYTE_LENGTH = 4;
+    FRONT_DOOR_SUPERVISOR_SUBCOMMAND = "__frontdoor-supervisor";
     realRunPort = {
       run(command, args) {
         const result = (0, import_node_child_process2.spawnSync)(command, [...args], { encoding: "utf8" });
@@ -6166,20 +6171,34 @@ function ensureFrontDoor(params) {
   let replaced = false;
   const distrusted = /* @__PURE__ */ new Set();
   let lastRejection;
+  const verifyWithRetry = (port) => {
+    let verdict = ports.verifyListener(port);
+    for (let attempt = 1; !verdict.ok && attempt < FRONTDOOR_PROBE_ATTEMPTS; attempt += 1) {
+      ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
+      verdict = ports.verifyListener(port);
+    }
+    return verdict;
+  };
+  const stopAndAwaitExit = (supervisorPid, failure) => {
+    ports.stopSupervisor(supervisorPid);
+    while (ports.isRunning(supervisorPid)) {
+      if (ports.now() >= deadline) {
+        throw new FrontDoorStartError(`${failure}. Daemon log: ${paths.frontdoorLogPath}`);
+      }
+      ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
+    }
+  };
   for (; ; ) {
     const state = readFrontDoorState(ports.fs, paths.frontdoorStateFile);
     const supervisorPid = state?.supervisorPid;
     if (supervisorPid !== void 0 && !distrusted.has(supervisorPid) && ports.isRunning(supervisorPid)) {
       if (state?.port !== void 0 && state.connectPort !== void 0) {
-        const verdict = ports.verifyListener(state.port);
+        const verdict = verifyWithRetry(state.port);
         if (verdict.ok && !replaced && !spawned && (params.replace === true || (state.protocol ?? 0) < FRONT_DOOR_PROTOCOL)) {
-          ports.stopSupervisor(supervisorPid);
-          while (ports.isRunning(supervisorPid)) {
-            if (ports.now() >= deadline) {
-              throw new FrontDoorStartError(`the front door (pid ${String(supervisorPid)}, protocol ${String(state.protocol ?? 0)}; this launcher speaks protocol ${String(FRONT_DOOR_PROTOCOL)}) was asked to be replaced and did not exit. Daemon log: ${paths.frontdoorLogPath}`);
-            }
-            ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
-          }
+          stopAndAwaitExit(
+            supervisorPid,
+            `the front door (pid ${String(supervisorPid)}, protocol ${String(state.protocol ?? 0)}; this launcher speaks protocol ${String(FRONT_DOOR_PROTOCOL)}) was asked to be replaced and did not exit`
+          );
           replaced = true;
           continue;
         }
@@ -6192,6 +6211,10 @@ function ensureFrontDoor(params) {
         if (spawned) {
           throw new FrontDoorStartError(`${lastRejection}; refusing to send this session's credentials to it. Daemon log: ${paths.frontdoorLogPath}`);
         }
+        if (ports.isFrontDoorSupervisor(supervisorPid)) {
+          stopAndAwaitExit(supervisorPid, `the front door (pid ${String(supervisorPid)}) stopped answering and did not exit when asked to`);
+          continue;
+        }
         distrusted.add(supervisorPid);
         continue;
       }
@@ -6222,7 +6245,7 @@ function ensureFrontDoor(params) {
     ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
   }
 }
-var import_node_crypto9, FRONTDOOR_START_TIMEOUT_MS, FRONTDOOR_LAUNCHER_POLL_MS, FrontDoorStartError;
+var import_node_crypto9, FRONTDOOR_START_TIMEOUT_MS, FRONTDOOR_LAUNCHER_POLL_MS, FRONTDOOR_PROBE_ATTEMPTS, FrontDoorStartError;
 var init_ensure2 = __esm({
   "src/frontdoor/ensure.ts"() {
     "use strict";
@@ -6232,6 +6255,7 @@ var init_ensure2 = __esm({
     init_state();
     FRONTDOOR_START_TIMEOUT_MS = 3e4;
     FRONTDOOR_LAUNCHER_POLL_MS = 100;
+    FRONTDOOR_PROBE_ATTEMPTS = 3;
     FrontDoorStartError = class extends CliError {
       constructor(message) {
         super(message);
@@ -7418,6 +7442,7 @@ function realEnsurePorts(paths, spawnDaemon) {
     now: () => Date.now(),
     sleep: realSleepSync,
     spawnSupervisor: (layout) => spawnDaemon(layout, "__frontdoor-supervisor", layout.frontdoorLogPath),
+    isFrontDoorSupervisor: realIsFrontDoorSupervisor,
     stopSupervisor: (pid) => {
       process.kill(pid, "SIGTERM");
     },

package/dist/index.mjs

@@ -2639,7 +2639,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "claude-use",
-      version: "9.11.0",
+      version: "9.12.1",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -3408,6 +3408,10 @@ function realIsProcessZombie(pid) {
 function realIsProcessRunning(pid) {
   return realIsProcessAlive(pid) && !realIsProcessZombie(pid);
 }
+function realIsFrontDoorSupervisor(pid) {
+  const result = spawnSync("ps", ["-o", "command=", "-p", String(pid)], { encoding: "utf8" });
+  return result.status === 0 && result.stdout.split(/\s+/).includes(FRONT_DOOR_SUPERVISOR_SUBCOMMAND);
+}
 function expandHome2(filePath) {
   return filePath.startsWith("~/") ? path13.join(os3.homedir(), filePath.slice(1)) : filePath;
 }
@@ -3605,7 +3609,7 @@ function realResolveClaudeBinary(isOwnBinary) {
 function realInstalledClaudeVersions() {
   return installedVersions(listVersionsDir(defaultVersionsDir()));
 }
-var realFsPort, OWNER_ONLY_DIR_MODE, OWNER_ONLY_FILE_MODE, PERMISSION_BITS, realFarmFs, INT32_BYTE_LENGTH, realRunPort, MACOS_GUI_SESSION_MANAGER, realCredentialPort, SOCKET_PERMISSION_BITS, realHeadroomSocketTrust, realSpawnPort, realProcPort, EXECUTE_BITS_MASK, WINDOWS_DEFAULT_PATHEXT;
+var realFsPort, OWNER_ONLY_DIR_MODE, OWNER_ONLY_FILE_MODE, PERMISSION_BITS, realFarmFs, INT32_BYTE_LENGTH, FRONT_DOOR_SUPERVISOR_SUBCOMMAND, realRunPort, MACOS_GUI_SESSION_MANAGER, realCredentialPort, SOCKET_PERMISSION_BITS, realHeadroomSocketTrust, realSpawnPort, realProcPort, EXECUTE_BITS_MASK, WINDOWS_DEFAULT_PATHEXT;
 var init_realPorts = __esm({
   "src/realPorts.ts"() {
     "use strict";
@@ -3740,6 +3744,7 @@ var init_realPorts = __esm({
       }
     };
     INT32_BYTE_LENGTH = 4;
+    FRONT_DOOR_SUPERVISOR_SUBCOMMAND = "__frontdoor-supervisor";
     realRunPort = {
       run(command, args) {
         const result = spawnSync(command, [...args], { encoding: "utf8" });
@@ -6140,20 +6145,34 @@ function ensureFrontDoor(params) {
   let replaced = false;
   const distrusted = /* @__PURE__ */ new Set();
   let lastRejection;
+  const verifyWithRetry = (port) => {
+    let verdict = ports.verifyListener(port);
+    for (let attempt = 1; !verdict.ok && attempt < FRONTDOOR_PROBE_ATTEMPTS; attempt += 1) {
+      ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
+      verdict = ports.verifyListener(port);
+    }
+    return verdict;
+  };
+  const stopAndAwaitExit = (supervisorPid, failure) => {
+    ports.stopSupervisor(supervisorPid);
+    while (ports.isRunning(supervisorPid)) {
+      if (ports.now() >= deadline) {
+        throw new FrontDoorStartError(`${failure}. Daemon log: ${paths.frontdoorLogPath}`);
+      }
+      ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
+    }
+  };
   for (; ; ) {
     const state = readFrontDoorState(ports.fs, paths.frontdoorStateFile);
     const supervisorPid = state?.supervisorPid;
     if (supervisorPid !== void 0 && !distrusted.has(supervisorPid) && ports.isRunning(supervisorPid)) {
       if (state?.port !== void 0 && state.connectPort !== void 0) {
-        const verdict = ports.verifyListener(state.port);
+        const verdict = verifyWithRetry(state.port);
         if (verdict.ok && !replaced && !spawned && (params.replace === true || (state.protocol ?? 0) < FRONT_DOOR_PROTOCOL)) {
-          ports.stopSupervisor(supervisorPid);
-          while (ports.isRunning(supervisorPid)) {
-            if (ports.now() >= deadline) {
-              throw new FrontDoorStartError(`the front door (pid ${String(supervisorPid)}, protocol ${String(state.protocol ?? 0)}; this launcher speaks protocol ${String(FRONT_DOOR_PROTOCOL)}) was asked to be replaced and did not exit. Daemon log: ${paths.frontdoorLogPath}`);
-            }
-            ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
-          }
+          stopAndAwaitExit(
+            supervisorPid,
+            `the front door (pid ${String(supervisorPid)}, protocol ${String(state.protocol ?? 0)}; this launcher speaks protocol ${String(FRONT_DOOR_PROTOCOL)}) was asked to be replaced and did not exit`
+          );
           replaced = true;
           continue;
         }
@@ -6166,6 +6185,10 @@ function ensureFrontDoor(params) {
         if (spawned) {
           throw new FrontDoorStartError(`${lastRejection}; refusing to send this session's credentials to it. Daemon log: ${paths.frontdoorLogPath}`);
         }
+        if (ports.isFrontDoorSupervisor(supervisorPid)) {
+          stopAndAwaitExit(supervisorPid, `the front door (pid ${String(supervisorPid)}) stopped answering and did not exit when asked to`);
+          continue;
+        }
         distrusted.add(supervisorPid);
         continue;
       }
@@ -6196,7 +6219,7 @@ function ensureFrontDoor(params) {
     ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
   }
 }
-var FRONTDOOR_START_TIMEOUT_MS, FRONTDOOR_LAUNCHER_POLL_MS, FrontDoorStartError;
+var FRONTDOOR_START_TIMEOUT_MS, FRONTDOOR_LAUNCHER_POLL_MS, FRONTDOOR_PROBE_ATTEMPTS, FrontDoorStartError;
 var init_ensure2 = __esm({
   "src/frontdoor/ensure.ts"() {
     "use strict";
@@ -6205,6 +6228,7 @@ var init_ensure2 = __esm({
     init_state();
     FRONTDOOR_START_TIMEOUT_MS = 3e4;
     FRONTDOOR_LAUNCHER_POLL_MS = 100;
+    FRONTDOOR_PROBE_ATTEMPTS = 3;
     FrontDoorStartError = class extends CliError {
       constructor(message) {
         super(message);
@@ -7391,6 +7415,7 @@ function realEnsurePorts(paths, spawnDaemon) {
     now: () => Date.now(),
     sleep: realSleepSync,
     spawnSupervisor: (layout) => spawnDaemon(layout, "__frontdoor-supervisor", layout.frontdoorLogPath),
+    isFrontDoorSupervisor: realIsFrontDoorSupervisor,
     stopSupervisor: (pid) => {
       process.kill(pid, "SIGTERM");
     },

package/dist/types/index.d.ts

@@ -864,8 +864,8 @@ declare const DirectoryRuleSchema: z.ZodObject<{
             key: z.ZodType<trilean.JsonValue, unknown, z.core.$ZodTypeInternals<trilean.JsonValue, unknown>>;
         }, z.core.$strip>], "kind">]>;
     }, z.core.$strict>]>>>;
-    $schema: z.ZodOptional<z.ZodString>;
     extends: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    $schema: z.ZodOptional<z.ZodString>;
     categories: z.ZodOptional<z.ZodPipe<z.ZodObject<{
         all: z.ZodOptional<z.ZodBoolean>;
         runtime: z.ZodOptional<z.ZodBoolean>;
@@ -1043,8 +1043,8 @@ declare const DirectoryRulesSchema: z.ZodObject<{
                 key: z.ZodType<trilean.JsonValue, unknown, z.core.$ZodTypeInternals<trilean.JsonValue, unknown>>;
             }, z.core.$strip>], "kind">]>;
         }, z.core.$strict>]>>>;
-        $schema: z.ZodOptional<z.ZodString>;
         extends: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        $schema: z.ZodOptional<z.ZodString>;
         categories: z.ZodOptional<z.ZodPipe<z.ZodObject<{
             all: z.ZodOptional<z.ZodBoolean>;
             runtime: z.ZodOptional<z.ZodBoolean>;
@@ -1223,8 +1223,8 @@ declare const PortableConfigSchema: z.ZodObject<{
             key: z.ZodType<trilean.JsonValue, unknown, z.core.$ZodTypeInternals<trilean.JsonValue, unknown>>;
         }, z.core.$strip>], "kind">]>;
     }, z.core.$strict>]>>>;
-    $schema: z.ZodOptional<z.ZodString>;
     extends: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    $schema: z.ZodOptional<z.ZodString>;
     categories: z.ZodOptional<z.ZodPipe<z.ZodObject<{
         all: z.ZodOptional<z.ZodBoolean>;
         runtime: z.ZodOptional<z.ZodBoolean>;
@@ -3859,12 +3859,12 @@ declare const CheckReportJsonSchema: z.ZodObject<{
     identity: z.ZodObject<{
         name: z.ZodNullable<z.ZodString>;
         source: z.ZodEnum<{
+            env: "env";
+            none: "none";
             "config-dir-escape-hatch": "config-dir-escape-hatch";
             argv: "argv";
-            env: "env";
             "directory-pin": "directory-pin";
             "active-identity-file": "active-identity-file";
-            none: "none";
         }>;
     }, z.core.$strict>;
     pool: z.ZodOptional<z.ZodObject<{
@@ -3942,11 +3942,11 @@ declare const CheckReportJsonSchema: z.ZodObject<{
             "category-default": "category-default";
         }>;
         category: z.ZodNullable<z.ZodEnum<{
-            secret: "secret";
             runtime: "runtime";
             history: "history";
             knowledge: "knowledge";
             settings: "settings";
+            secret: "secret";
         }>>;
         rule: z.ZodOptional<z.ZodObject<{
             key: z.ZodString;
@@ -5942,8 +5942,8 @@ declare function createConfigApiRouter(deps: ConfigApiDeps): {
                             key: zod.ZodType<trilean.JsonValue, unknown, zod_v4_core.$ZodTypeInternals<trilean.JsonValue, unknown>>;
                         }, zod_v4_core.$strip>], "kind">]>;
                     }, zod_v4_core.$strict>]>>>;
-                    $schema: zod.ZodOptional<zod.ZodString>;
                     extends: zod.ZodOptional<zod.ZodArray<zod.ZodString>>;
+                    $schema: zod.ZodOptional<zod.ZodString>;
                     categories: zod.ZodOptional<zod.ZodPipe<zod.ZodObject<{
                         all: zod.ZodOptional<zod.ZodBoolean>;
                         runtime: zod.ZodOptional<zod.ZodBoolean>;
@@ -6126,8 +6126,8 @@ declare function createConfigApiRouter(deps: ConfigApiDeps): {
                             key: zod.ZodType<trilean.JsonValue, unknown, zod_v4_core.$ZodTypeInternals<trilean.JsonValue, unknown>>;
                         }, zod_v4_core.$strip>], "kind">]>;
                     }, zod_v4_core.$strict>]>>>;
-                    $schema: zod.ZodOptional<zod.ZodString>;
                     extends: zod.ZodOptional<zod.ZodArray<zod.ZodString>>;
+                    $schema: zod.ZodOptional<zod.ZodString>;
                     categories: zod.ZodOptional<zod.ZodPipe<zod.ZodObject<{
                         all: zod.ZodOptional<zod.ZodBoolean>;
                         runtime: zod.ZodOptional<zod.ZodBoolean>;
@@ -6440,9 +6440,9 @@ declare function createLifecycleApiRouter(deps: LifecycleApiDeps): {
             current: zod.ZodString;
             latest: zod.ZodString;
             action: zod.ZodEnum<{
+                updated: "updated";
                 current: "current";
                 available: "available";
-                updated: "updated";
             }>;
         }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
     };
@@ -6689,12 +6689,12 @@ declare function createLaunchApiRouter(deps: LaunchApiDeps): {
             decision: zod.ZodObject<{
                 identity: zod.ZodOptional<zod.ZodString>;
                 identitySource: zod.ZodEnum<{
+                    env: "env";
+                    none: "none";
                     "config-dir-escape-hatch": "config-dir-escape-hatch";
                     argv: "argv";
-                    env: "env";
                     "directory-pin": "directory-pin";
                     "active-identity-file": "active-identity-file";
-                    none: "none";
                 }>;
                 pool: zod.ZodOptional<zod.ZodObject<{
                     name: zod.ZodString;
@@ -7080,12 +7080,12 @@ declare function createControlApiRouter(deps: ControlApiDeps): {
             identity: zod.ZodObject<{
                 name: zod.ZodNullable<zod.ZodString>;
                 source: zod.ZodEnum<{
+                    env: "env";
+                    none: "none";
                     "config-dir-escape-hatch": "config-dir-escape-hatch";
                     argv: "argv";
-                    env: "env";
                     "directory-pin": "directory-pin";
                     "active-identity-file": "active-identity-file";
-                    none: "none";
                 }>;
             }, zod_v4_core.$strict>;
             pool: zod.ZodOptional<zod.ZodObject<{
@@ -7163,11 +7163,11 @@ declare function createControlApiRouter(deps: ControlApiDeps): {
                     "category-default": "category-default";
                 }>;
                 category: zod.ZodNullable<zod.ZodEnum<{
-                    secret: "secret";
                     runtime: "runtime";
                     history: "history";
                     knowledge: "knowledge";
                     settings: "settings";
+                    secret: "secret";
                 }>>;
                 rule: zod.ZodOptional<zod.ZodObject<{
                     key: zod.ZodString;
@@ -7385,10 +7385,11 @@ declare function createControlApiRouter(deps: ControlApiDeps): {
                 section: zod.ZodEnum<{
                     "global-config": "global-config";
                     "config-profile": "config-profile";
+                    keychain: "keychain";
                     identity: "identity";
                     provider: "provider";
+                    headroom: "headroom";
                     pool: "pool";
-                    keychain: "keychain";
                     "ambient-credential": "ambient-credential";
                     "binary-discovery": "binary-discovery";
                     "claude-shim": "claude-shim";
@@ -7398,7 +7399,6 @@ declare function createControlApiRouter(deps: ControlApiDeps): {
                     "directory-rules": "directory-rules";
                     "categories-local": "categories-local";
                     "active-identity": "active-identity";
-                    headroom: "headroom";
                 }>;
                 subject: zod.ZodOptional<zod.ZodString>;
                 severity: zod.ZodEnum<{
@@ -7519,12 +7519,12 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
             decision: zod.ZodObject<{
                 identity: zod.ZodOptional<zod.ZodString>;
                 identitySource: zod.ZodEnum<{
+                    env: "env";
+                    none: "none";
                     "config-dir-escape-hatch": "config-dir-escape-hatch";
                     argv: "argv";
-                    env: "env";
                     "directory-pin": "directory-pin";
                     "active-identity-file": "active-identity-file";
-                    none: "none";
                 }>;
                 pool: zod.ZodOptional<zod.ZodObject<{
                     name: zod.ZodString;
@@ -8562,8 +8562,8 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                             key: zod.ZodType<trilean.JsonValue, unknown, zod_v4_core.$ZodTypeInternals<trilean.JsonValue, unknown>>;
                         }, zod_v4_core.$strip>], "kind">]>;
                     }, zod_v4_core.$strict>]>>>;
-                    $schema: zod.ZodOptional<zod.ZodString>;
                     extends: zod.ZodOptional<zod.ZodArray<zod.ZodString>>;
+                    $schema: zod.ZodOptional<zod.ZodString>;
                     categories: zod.ZodOptional<zod.ZodPipe<zod.ZodObject<{
                         all: zod.ZodOptional<zod.ZodBoolean>;
                         runtime: zod.ZodOptional<zod.ZodBoolean>;
@@ -8746,8 +8746,8 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                             key: zod.ZodType<trilean.JsonValue, unknown, zod_v4_core.$ZodTypeInternals<trilean.JsonValue, unknown>>;
                         }, zod_v4_core.$strip>], "kind">]>;
                     }, zod_v4_core.$strict>]>>>;
-                    $schema: zod.ZodOptional<zod.ZodString>;
                     extends: zod.ZodOptional<zod.ZodArray<zod.ZodString>>;
+                    $schema: zod.ZodOptional<zod.ZodString>;
                     categories: zod.ZodOptional<zod.ZodPipe<zod.ZodObject<{
                         all: zod.ZodOptional<zod.ZodBoolean>;
                         runtime: zod.ZodOptional<zod.ZodBoolean>;
@@ -8861,9 +8861,9 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
             current: zod.ZodString;
             latest: zod.ZodString;
             action: zod.ZodEnum<{
+                updated: "updated";
                 current: "current";
                 available: "available";
-                updated: "updated";
             }>;
         }, zod_v4_core.$strict>, MergedErrorMap<$ErrorMap, TErrorMap>>;
     };
@@ -9062,12 +9062,12 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
             identity: zod.ZodObject<{
                 name: zod.ZodNullable<zod.ZodString>;
                 source: zod.ZodEnum<{
+                    env: "env";
+                    none: "none";
                     "config-dir-escape-hatch": "config-dir-escape-hatch";
                     argv: "argv";
-                    env: "env";
                     "directory-pin": "directory-pin";
                     "active-identity-file": "active-identity-file";
-                    none: "none";
                 }>;
             }, zod_v4_core.$strict>;
             pool: zod.ZodOptional<zod.ZodObject<{
@@ -9145,11 +9145,11 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                     "category-default": "category-default";
                 }>;
                 category: zod.ZodNullable<zod.ZodEnum<{
-                    secret: "secret";
                     runtime: "runtime";
                     history: "history";
                     knowledge: "knowledge";
                     settings: "settings";
+                    secret: "secret";
                 }>>;
                 rule: zod.ZodOptional<zod.ZodObject<{
                     key: zod.ZodString;
@@ -9367,10 +9367,11 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                 section: zod.ZodEnum<{
                     "global-config": "global-config";
                     "config-profile": "config-profile";
+                    keychain: "keychain";
                     identity: "identity";
                     provider: "provider";
+                    headroom: "headroom";
                     pool: "pool";
-                    keychain: "keychain";
                     "ambient-credential": "ambient-credential";
                     "binary-discovery": "binary-discovery";
                     "claude-shim": "claude-shim";
@@ -9380,7 +9381,6 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                     "directory-rules": "directory-rules";
                     "categories-local": "categories-local";
                     "active-identity": "active-identity";
-                    headroom: "headroom";
                 }>;
                 subject: zod.ZodOptional<zod.ZodString>;
                 severity: zod.ZodEnum<{
@@ -10634,8 +10634,8 @@ declare const ConfigRuleAddOutputSchema: z.ZodObject<{
                 key: z.ZodType<trilean.JsonValue, unknown, z.core.$ZodTypeInternals<trilean.JsonValue, unknown>>;
             }, z.core.$strip>], "kind">]>;
         }, z.core.$strict>]>>>;
-        $schema: z.ZodOptional<z.ZodString>;
         extends: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        $schema: z.ZodOptional<z.ZodString>;
         categories: z.ZodOptional<z.ZodPipe<z.ZodObject<{
             all: z.ZodOptional<z.ZodBoolean>;
             runtime: z.ZodOptional<z.ZodBoolean>;
@@ -10820,8 +10820,8 @@ declare const ConfigRuleSetOutputSchema: z.ZodObject<{
                 key: z.ZodType<trilean.JsonValue, unknown, z.core.$ZodTypeInternals<trilean.JsonValue, unknown>>;
             }, z.core.$strip>], "kind">]>;
         }, z.core.$strict>]>>>;
-        $schema: z.ZodOptional<z.ZodString>;
         extends: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        $schema: z.ZodOptional<z.ZodString>;
         categories: z.ZodOptional<z.ZodPipe<z.ZodObject<{
             all: z.ZodOptional<z.ZodBoolean>;
             runtime: z.ZodOptional<z.ZodBoolean>;
@@ -11173,10 +11173,11 @@ declare const DoctorFindingSchema: z.ZodObject<{
     section: z.ZodEnum<{
         "global-config": "global-config";
         "config-profile": "config-profile";
+        keychain: "keychain";
         identity: "identity";
         provider: "provider";
+        headroom: "headroom";
         pool: "pool";
-        keychain: "keychain";
         "ambient-credential": "ambient-credential";
         "binary-discovery": "binary-discovery";
         "claude-shim": "claude-shim";
@@ -11186,7 +11187,6 @@ declare const DoctorFindingSchema: z.ZodObject<{
         "directory-rules": "directory-rules";
         "categories-local": "categories-local";
         "active-identity": "active-identity";
-        headroom: "headroom";
     }>;
     subject: z.ZodOptional<z.ZodString>;
     severity: z.ZodEnum<{
@@ -11203,10 +11203,11 @@ declare const DoctorRunOutputSchema: z.ZodObject<{
         section: z.ZodEnum<{
             "global-config": "global-config";
             "config-profile": "config-profile";
+            keychain: "keychain";
             identity: "identity";
             provider: "provider";
+            headroom: "headroom";
             pool: "pool";
-            keychain: "keychain";
             "ambient-credential": "ambient-credential";
             "binary-discovery": "binary-discovery";
             "claude-shim": "claude-shim";
@@ -11216,7 +11217,6 @@ declare const DoctorRunOutputSchema: z.ZodObject<{
             "directory-rules": "directory-rules";
             "categories-local": "categories-local";
             "active-identity": "active-identity";
-            headroom: "headroom";
         }>;
         subject: z.ZodOptional<z.ZodString>;
         severity: z.ZodEnum<{
@@ -11237,9 +11237,9 @@ declare const UpdateCheckOutputSchema: z.ZodObject<{
     current: z.ZodString;
     latest: z.ZodString;
     action: z.ZodEnum<{
+        updated: "updated";
         current: "current";
         available: "available";
-        updated: "updated";
     }>;
 }, z.core.$strict>;
 /** The Sign in with ChatGPT login's state as `codex status` reports it: no sign-in yet, signed in (with who, whether the plan scope was granted, and when the access token lapses), or a file that cannot be read. */
@@ -11289,12 +11289,12 @@ declare const LaunchResolveOutputSchema: z.ZodObject<{
     decision: z.ZodObject<{
         identity: z.ZodOptional<z.ZodString>;
         identitySource: z.ZodEnum<{
+            env: "env";
+            none: "none";
             "config-dir-escape-hatch": "config-dir-escape-hatch";
             argv: "argv";
-            env: "env";
             "directory-pin": "directory-pin";
             "active-identity-file": "active-identity-file";
-            none: "none";
         }>;
         pool: z.ZodOptional<z.ZodObject<{
             name: z.ZodString;
@@ -11662,8 +11662,10 @@ interface EnsureFrontDoorPorts {
     readonly spawnSupervisor: (paths: LayoutPaths) => number;
     /** Authenticates the provider listener on `port`: a TLS handshake chaining to agent-shim's CA and a healthy answer, with no capability sent (see `probeFrontDoorSync`). */
     readonly verifyListener: (port: number) => ListenerVerdict;
-    /** Asks a running front-door supervisor to exit, without waiting for it to: the caller polls `isRunning`. Only ever called for a pid whose recorded listener has just authenticated as agent-shim's own. */
+    /** Asks a running front-door supervisor to exit, without waiting for it to: the caller polls `isRunning`. Only ever called for a pid whose recorded listener has just authenticated as agent-shim's own, or whose process is agent-shim's front-door supervisor (`isFrontDoorSupervisor`). */
     readonly stopSupervisor: (pid: number) => void;
+    /** Whether `pid` is a live agent-shim front-door supervisor process, read from the process's own command line. This is what separates a wedged door of this tool, which a replacement must retire so the two never coexist, from an unrelated process that reuses the recorded pid, which must never be signalled. */
+    readonly isFrontDoorSupervisor: (pid: number) => boolean;
 }
 /**
  * Brings the front door up for this launch, or finds it serving, and registers this launcher pid in its session registry: the fact that keeps the door from idling out while this session lives, and the record that holds this launch's capability token. The same lock-and-poll coordination as headroom's and the old codex daemon's ensure: the exclusive-create start lock decides which of several concurrent launches spawns the one supervisor, everyone waits on state.json, and a lock whose holder died is removed and retried. Ready means state names a live supervisor and both listeners' ports, which the supervisor writes only after both have bound (and the provider listener has answered its own health probe).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-use",
-  "version": "9.11.0",
+  "version": "9.12.1",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",