claude-use 9.17.0 → 9.19.0

package/dist/index.cjs

@@ -717,7 +717,7 @@ function compile(pattern, category, source, ordinal) {
     matches: isExact ? (name) => name === pattern : (name) => matcher(name)
   };
 }
-function compileClassificationPatterns(defaults, overlay) {
+function compileClassificationPatterns(defaults, overlay2) {
   const compiled = [];
   let ordinal = 0;
   for (const category of CATEGORY_NAMES) {
@@ -726,9 +726,9 @@ function compileClassificationPatterns(defaults, overlay) {
       ordinal += 1;
     }
   }
-  if (overlay !== void 0) {
+  if (overlay2 !== void 0) {
     for (const category of CATEGORY_NAMES) {
-      for (const pattern of overlay[category] ?? []) {
+      for (const pattern of overlay2[category] ?? []) {
         compiled.push(compile(pattern, category, "local", ordinal));
         ordinal += 1;
       }
@@ -749,10 +749,10 @@ function compareClassificationPatterns(a, b) {
   return a.ordinal - b.ordinal;
 }
 function loadClassification(paths) {
-  const overlay = readJson(paths.categoriesLocalFile, CategoryClassificationOverlaySchema);
+  const overlay2 = readJson(paths.categoriesLocalFile, CategoryClassificationOverlaySchema);
   return {
     defaults: CategoryClassificationSchema.parse(categories_default_default),
-    ...overlay === void 0 ? {} : { overlay }
+    ...overlay2 === void 0 ? {} : { overlay: overlay2 }
   };
 }
 function classifyEntries(names, options) {
@@ -2693,7 +2693,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "claude-use",
-      version: "9.17.0",
+      version: "9.19.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -2951,37 +2951,37 @@ function readStartLock(fs12, lockFile) {
     return void 0;
   }
 }
-var import_node_crypto6, import_node_path11, import_zod6, HEADROOM_ANTHROPIC_UPSTREAM, HeadroomStateSchema, HeadroomSessionSchema, HeadroomLockSchema;
+var import_node_crypto6, import_node_path11, import_zod8, HEADROOM_ANTHROPIC_UPSTREAM, HeadroomStateSchema, HeadroomSessionSchema, HeadroomLockSchema;
 var init_state2 = __esm({
   "src/headroom/state.ts"() {
     "use strict";
     import_node_crypto6 = require("node:crypto");
     import_node_path11 = __toESM(require("node:path"), 1);
-    import_zod6 = require("zod");
+    import_zod8 = require("zod");
     init_schema();
     HEADROOM_ANTHROPIC_UPSTREAM = "https://api.anthropic.com";
-    HeadroomStateSchema = import_zod6.z.strictObject({
+    HeadroomStateSchema = import_zod8.z.strictObject({
       /** The supervisor process owning the daemon. Alive means someone is keeping headroom running. */
-      supervisorPid: import_zod6.z.number().int().positive().optional(),
+      supervisorPid: import_zod8.z.number().int().positive().optional(),
       /** The headroom proxy process itself. Absent while the supervisor is between restarts. */
-      headroomPid: import_zod6.z.number().int().positive().optional(),
+      headroomPid: import_zod8.z.number().int().positive().optional(),
       /**
        * The unix socket the proxy serves on, inside the owner-only socket directory. Absent until the proxy has passed its readiness check, so "socketPath is set" is itself the ready signal a launcher polls for. The front door reads it on every hop, so a restart (which keeps the generation's path) is followed without anything being relaunched.
        */
-      socketPath: import_zod6.z.string().min(1).optional(),
+      socketPath: import_zod8.z.string().min(1).optional(),
       /** The `headroom --version` output of the running install. */
-      version: import_zod6.z.string().optional(),
+      version: import_zod8.z.string().optional(),
       /** Hash of the allowlist the running proxy was started with, so a provider-file change is detected as drift. */
-      allowlistHash: import_zod6.z.string().optional(),
+      allowlistHash: import_zod8.z.string().optional(),
       /** Hash of the token-saving settings the running proxy was started with, so a settings change is detected as drift. */
-      settingsHash: import_zod6.z.string().optional(),
+      settingsHash: import_zod8.z.string().optional(),
       /** The install spec the running install was last installed from, so a `source` config change is detected as drift. */
-      installedSource: import_zod6.z.string().optional(),
+      installedSource: import_zod8.z.string().optional(),
       /** The last fatal error, kept across shutdowns so `headroom status` can explain a daemon that is not running. */
-      lastError: import_zod6.z.string().optional()
+      lastError: import_zod8.z.string().optional()
     });
-    HeadroomSessionSchema = import_zod6.z.strictObject({ pid: import_zod6.z.number().int().positive(), startedAt: import_zod6.z.number(), supervisorPid: import_zod6.z.number().int().positive() });
-    HeadroomLockSchema = import_zod6.z.strictObject({ pid: import_zod6.z.number().int().positive(), at: import_zod6.z.number() });
+    HeadroomSessionSchema = import_zod8.z.strictObject({ pid: import_zod8.z.number().int().positive(), startedAt: import_zod8.z.number(), supervisorPid: import_zod8.z.number().int().positive() });
+    HeadroomLockSchema = import_zod8.z.strictObject({ pid: import_zod8.z.number().int().positive(), at: import_zod8.z.number() });
   }
 });
 
@@ -3188,14 +3188,14 @@ function pinnedGitCommit(spec) {
   const ref = GIT_SPEC_RE.exec(spec)?.[1];
   return ref !== void 0 && COMMIT_SHA_RE.test(ref) ? ref.toLowerCase() : void 0;
 }
-var import_zod7, GIT_SPEC_RE, COMMIT_SHA_RE, DirectUrlSchema;
+var import_zod9, GIT_SPEC_RE, COMMIT_SHA_RE, DirectUrlSchema;
 var init_source = __esm({
   "src/headroom/source.ts"() {
     "use strict";
-    import_zod7 = require("zod");
+    import_zod9 = require("zod");
     GIT_SPEC_RE = /git\+[^@\s]+(?:@([^\s#]+))?/;
     COMMIT_SHA_RE = /^[0-9a-f]{40}$/i;
-    DirectUrlSchema = import_zod7.z.object({ vcs_info: import_zod7.z.object({ commit_id: import_zod7.z.string() }) });
+    DirectUrlSchema = import_zod9.z.object({ vcs_info: import_zod9.z.object({ commit_id: import_zod9.z.string() }) });
   }
 });
 
@@ -4111,149 +4111,149 @@ var init_identity = __esm({
 });
 
 // src/usage/schema.ts
-var import_zod8, USAGE_SCHEMA_VERSION, VersionSchema, InstantSchema, TokenCountSchema, TokenUsageSchema, LIMIT_KINDS, LimitClassificationSchema, UsageRecordSchema, QuotaWindowSchema, ExtraUsageSpendSchema, UnifiedRateLimitSchema, RateLimitStateSchema, LimitEventSchema, ProviderQuotaWindowSchema, ProviderQuotaSchema, ProviderUsageStateSchema, AccountMetadataSchema, UsageSnapshotSchema;
+var import_zod10, USAGE_SCHEMA_VERSION, VersionSchema, InstantSchema, TokenCountSchema, TokenUsageSchema, LIMIT_KINDS, LimitClassificationSchema, UsageRecordSchema, QuotaWindowSchema, ExtraUsageSpendSchema, UnifiedRateLimitSchema, RateLimitStateSchema, LimitEventSchema, ProviderQuotaWindowSchema, ProviderQuotaSchema, ProviderUsageStateSchema, AccountMetadataSchema, UsageSnapshotSchema;
 var init_schema2 = __esm({
   "src/usage/schema.ts"() {
     "use strict";
-    import_zod8 = require("zod");
+    import_zod10 = require("zod");
     USAGE_SCHEMA_VERSION = 1;
-    VersionSchema = import_zod8.z.literal(USAGE_SCHEMA_VERSION);
-    InstantSchema = import_zod8.z.iso.datetime();
-    TokenCountSchema = import_zod8.z.number().int().nonnegative();
-    TokenUsageSchema = import_zod8.z.strictObject({
+    VersionSchema = import_zod10.z.literal(USAGE_SCHEMA_VERSION);
+    InstantSchema = import_zod10.z.iso.datetime();
+    TokenCountSchema = import_zod10.z.number().int().nonnegative();
+    TokenUsageSchema = import_zod10.z.strictObject({
       inputTokens: TokenCountSchema.optional(),
       outputTokens: TokenCountSchema.optional(),
       cacheCreationInputTokens: TokenCountSchema.optional(),
       cacheReadInputTokens: TokenCountSchema.optional()
     });
     LIMIT_KINDS = ["rate-limited", "quota-exhausted"];
-    LimitClassificationSchema = import_zod8.z.strictObject({
-      kind: import_zod8.z.enum(LIMIT_KINDS),
+    LimitClassificationSchema = import_zod10.z.strictObject({
+      kind: import_zod10.z.enum(LIMIT_KINDS),
       /** Seconds to wait before retrying, from the response's `retry-after`. */
-      retryAfterSeconds: import_zod8.z.number().nonnegative().optional(),
+      retryAfterSeconds: import_zod10.z.number().nonnegative().optional(),
       /** When the limiting window resets, from the upstream's own reset header. */
       resetAt: InstantSchema.optional(),
       /** The window the upstream named as the binding one (`anthropic-ratelimit-unified-representative-claim`), such as `five_hour` or `seven_day`. */
-      window: import_zod8.z.string().optional(),
+      window: import_zod10.z.string().optional(),
       /** The signals the classification rests on, each `<name>=<value>` from a response header or the error body's `type` or `code`. Never the error message. */
-      evidence: import_zod8.z.array(import_zod8.z.string())
+      evidence: import_zod10.z.array(import_zod10.z.string())
     });
-    UsageRecordSchema = import_zod8.z.strictObject({
+    UsageRecordSchema = import_zod10.z.strictObject({
       schemaVersion: VersionSchema,
       /** When the front door received the request. */
       at: InstantSchema,
       /** The launching identity, when the launch resolved one. */
-      identity: import_zod8.z.string().optional(),
+      identity: import_zod10.z.string().optional(),
       /** `anthropic` for an OAuth session's request to Claude Code's own API, otherwise the provider's name. */
-      provider: import_zod8.z.string(),
+      provider: import_zod10.z.string(),
       /** The launch's session id, generated per launch. */
-      sessionId: import_zod8.z.string().optional(),
+      sessionId: import_zod10.z.string().optional(),
       /** The project the launch ran in (its git repository root), when the launch sent one: headroom launches do. */
-      project: import_zod8.z.string().optional(),
+      project: import_zod10.z.string().optional(),
       /** The front-door route that served the request. */
-      route: import_zod8.z.string(),
-      method: import_zod8.z.string(),
+      route: import_zod10.z.string(),
+      method: import_zod10.z.string(),
       /** The API path as the upstream sees it (`/v1/messages`), without the provider prefix or a query string. */
-      endpoint: import_zod8.z.string(),
+      endpoint: import_zod10.z.string(),
       /** The model the response named. */
-      model: import_zod8.z.string().optional(),
-      status: import_zod8.z.number().int(),
+      model: import_zod10.z.string().optional(),
+      status: import_zod10.z.number().int(),
       /** Milliseconds from the request's arrival to its response head. */
-      latencyMs: import_zod8.z.number().int().nonnegative(),
+      latencyMs: import_zod10.z.number().int().nonnegative(),
       /** Milliseconds from the request's arrival to the end of its response body. */
-      durationMs: import_zod8.z.number().int().nonnegative(),
+      durationMs: import_zod10.z.number().int().nonnegative(),
       /** Whether the client received the whole body. */
-      outcome: import_zod8.z.enum(["completed", "aborted"]),
+      outcome: import_zod10.z.enum(["completed", "aborted"]),
       usage: TokenUsageSchema.optional(),
       /** The response's quota and rate-limit headers, by name (see `isRateLimitHeader`). */
-      rateLimitHeaders: import_zod8.z.record(import_zod8.z.string(), import_zod8.z.string()).optional(),
+      rateLimitHeaders: import_zod10.z.record(import_zod10.z.string(), import_zod10.z.string()).optional(),
       limit: LimitClassificationSchema.optional(),
       /** The upstream's request id (`request-id`), for matching a record to the provider's own logs. */
-      requestId: import_zod8.z.string().optional()
+      requestId: import_zod10.z.string().optional()
     });
-    QuotaWindowSchema = import_zod8.z.strictObject({
+    QuotaWindowSchema = import_zod10.z.strictObject({
       /** The fraction of the window used, as the upstream reports it (0 to 1). */
-      utilization: import_zod8.z.number().nonnegative().optional(),
+      utilization: import_zod10.z.number().nonnegative().optional(),
       resetsAt: InstantSchema.optional(),
       /** The window's own status (`allowed`, `allowed_warning`, `rejected`). */
-      status: import_zod8.z.string().optional(),
+      status: import_zod10.z.string().optional(),
       /** The fraction of the window's grace allowance used, while the upstream reports the window in grace (the five-hour window only). Requests are served beyond the window's own full mark while it grows, but refusals have been seen at a small value, so nothing ranks on it. */
-      graceUtilization: import_zod8.z.number().nonnegative().optional()
+      graceUtilization: import_zod10.z.number().nonnegative().optional()
     });
-    ExtraUsageSpendSchema = import_zod8.z.strictObject({
+    ExtraUsageSpendSchema = import_zod10.z.strictObject({
       /** Spent so far in the allowance's period, in the currency's minor units (pence, cents). */
-      usedMinor: import_zod8.z.number().nonnegative(),
+      usedMinor: import_zod10.z.number().nonnegative(),
       /** The allowance's cap in the same units, when it has one. */
-      limitMinor: import_zod8.z.number().nonnegative().optional(),
+      limitMinor: import_zod10.z.number().nonnegative().optional(),
       /** The ISO 4217 currency code. */
-      currency: import_zod8.z.string()
+      currency: import_zod10.z.string()
     });
-    UnifiedRateLimitSchema = import_zod8.z.strictObject({
+    UnifiedRateLimitSchema = import_zod10.z.strictObject({
       /** The overall status: `allowed`, `allowed_warning` or `rejected`. */
-      status: import_zod8.z.string().optional(),
+      status: import_zod10.z.string().optional(),
       fiveHour: QuotaWindowSchema.optional(),
       sevenDay: QuotaWindowSchema.optional(),
       /** The weekly window of the models whose usage may continue as extra usage (`7d_oi`), reported by some plans beside the all-models weekly window. */
       sevenDayOverageIncluded: QuotaWindowSchema.optional(),
       /** The window that currently binds. */
-      representativeClaim: import_zod8.z.string().optional(),
+      representativeClaim: import_zod10.z.string().optional(),
       /** When the binding window resets. */
       resetAt: InstantSchema.optional(),
       /** Whether usage beyond the plan (extra usage) is available: `allowed` or `rejected`. */
-      overageStatus: import_zod8.z.string().optional(),
+      overageStatus: import_zod10.z.string().optional(),
       /** The fraction of the extra-usage allowance used, as the upstream reports it (0 to 1). An account with no plan windows, such as an Enterprise one, is metered by this alone. */
-      overageUtilization: import_zod8.z.number().nonnegative().optional(),
+      overageUtilization: import_zod10.z.number().nonnegative().optional(),
       /** When the extra-usage allowance resets. */
       overageResetsAt: InstantSchema.optional(),
       /** Why extra usage is unavailable, as the upstream names it (`out_of_credits`, for one). */
-      overageDisabledReason: import_zod8.z.string().optional(),
+      overageDisabledReason: import_zod10.z.string().optional(),
       /** Whether the response was served on extra usage, as the upstream states it. */
-      overageInUse: import_zod8.z.boolean().optional(),
+      overageInUse: import_zod10.z.boolean().optional(),
       /** The allowance in money, from the usage endpoint (the response headers state only the fraction). */
       extraUsageSpend: ExtraUsageSpendSchema.optional(),
       /** True when the upstream offers a fallback while a window is rejected: some requests, by model, are still served, though the rest are refused. */
-      fallbackAvailable: import_zod8.z.boolean().optional()
+      fallbackAvailable: import_zod10.z.boolean().optional()
     });
-    RateLimitStateSchema = import_zod8.z.strictObject({
+    RateLimitStateSchema = import_zod10.z.strictObject({
       observedAt: InstantSchema,
       /** Every quota and rate-limit header on that response, by name. */
-      headers: import_zod8.z.record(import_zod8.z.string(), import_zod8.z.string()),
+      headers: import_zod10.z.record(import_zod10.z.string(), import_zod10.z.string()),
       unified: UnifiedRateLimitSchema.optional(),
       /** When the usage endpoint last answered that it has no plan windows for the account, which a later response replaces. Its answer leaves the recorded `unified` state alone (a response's headers may be the only source of it), so this alone says the question was asked. */
       planWindowsUnavailableAt: InstantSchema.optional()
     });
     LimitEventSchema = LimitClassificationSchema.extend({
       observedAt: InstantSchema,
-      status: import_zod8.z.number().int()
+      status: import_zod10.z.number().int()
     });
-    ProviderQuotaWindowSchema = import_zod8.z.strictObject({
+    ProviderQuotaWindowSchema = import_zod10.z.strictObject({
       /** What the window measures, in the provider's terms (`tokens`, `tool-calls`). */
-      measures: import_zod8.z.string(),
+      measures: import_zod10.z.string(),
       /** The window's length in milliseconds, when the provider's unit is one this project knows; absent for an unrecognised unit, with `period` carrying the raw code. */
-      periodMs: import_zod8.z.number().int().positive().optional(),
+      periodMs: import_zod10.z.number().int().positive().optional(),
       /** The provider's own description of the period when `periodMs` could not be derived, such as `unit 4 x 1`. */
-      period: import_zod8.z.string().optional(),
+      period: import_zod10.z.string().optional(),
       /** The fraction of the window used (0 to 1). */
-      utilization: import_zod8.z.number().nonnegative(),
+      utilization: import_zod10.z.number().nonnegative(),
       resetsAt: InstantSchema.optional(),
       /** Absolute counts, when the provider reports them for this window. */
-      limit: import_zod8.z.number().nonnegative().optional(),
-      used: import_zod8.z.number().nonnegative().optional(),
-      remaining: import_zod8.z.number().nonnegative().optional()
+      limit: import_zod10.z.number().nonnegative().optional(),
+      used: import_zod10.z.number().nonnegative().optional(),
+      remaining: import_zod10.z.number().nonnegative().optional()
     });
-    ProviderQuotaSchema = import_zod8.z.strictObject({
+    ProviderQuotaSchema = import_zod10.z.strictObject({
       observedAt: InstantSchema,
       /** Which usage endpoint produced it (`z.ai`). */
-      source: import_zod8.z.string(),
+      source: import_zod10.z.string(),
       /** The subscription level the endpoint reports, when it does. */
-      level: import_zod8.z.string().optional(),
-      windows: import_zod8.z.array(ProviderQuotaWindowSchema)
+      level: import_zod10.z.string().optional(),
+      windows: import_zod10.z.array(ProviderQuotaWindowSchema)
     });
-    ProviderUsageStateSchema = import_zod8.z.strictObject({
+    ProviderUsageStateSchema = import_zod10.z.strictObject({
       /** When the provider last served a request for the identity through the front door. Absent while the state holds only a rate-limit state fetched from the provider's usage endpoint, for an identity that has made no request. */
       lastRequestAt: InstantSchema.optional(),
-      lastStatus: import_zod8.z.number().int().optional(),
-      lastModel: import_zod8.z.string().optional(),
+      lastStatus: import_zod10.z.number().int().optional(),
+      lastModel: import_zod10.z.string().optional(),
       /** The latest rate-limit state, from the last response that carried any rate-limit header. */
       rateLimit: RateLimitStateSchema.optional(),
       /** The latest classified refusal. It stays after later successes, so a reader compares its `resetAt` (or `observedAt` plus `retryAfterSeconds`) with the current time. */
@@ -4261,31 +4261,31 @@ var init_schema2 = __esm({
       /** The latest quota the provider's usage endpoint reported, for providers whose quota is not visible in response headers. */
       quota: ProviderQuotaSchema.optional()
     });
-    AccountMetadataSchema = import_zod8.z.strictObject({
-      accountUuid: import_zod8.z.string().optional(),
-      emailAddress: import_zod8.z.string().optional(),
-      displayName: import_zod8.z.string().optional(),
-      organizationUuid: import_zod8.z.string().optional(),
-      organizationName: import_zod8.z.string().optional(),
-      organizationType: import_zod8.z.string().optional(),
-      organizationRole: import_zod8.z.string().optional(),
-      workspaceRole: import_zod8.z.string().optional(),
-      billingType: import_zod8.z.string().optional(),
-      seatTier: import_zod8.z.string().optional(),
-      organizationRateLimitTier: import_zod8.z.string().optional(),
-      userRateLimitTier: import_zod8.z.string().optional(),
-      hasExtraUsageEnabled: import_zod8.z.boolean().optional(),
-      subscriptionCreatedAt: import_zod8.z.string().optional(),
-      accountCreatedAt: import_zod8.z.string().optional()
+    AccountMetadataSchema = import_zod10.z.strictObject({
+      accountUuid: import_zod10.z.string().optional(),
+      emailAddress: import_zod10.z.string().optional(),
+      displayName: import_zod10.z.string().optional(),
+      organizationUuid: import_zod10.z.string().optional(),
+      organizationName: import_zod10.z.string().optional(),
+      organizationType: import_zod10.z.string().optional(),
+      organizationRole: import_zod10.z.string().optional(),
+      workspaceRole: import_zod10.z.string().optional(),
+      billingType: import_zod10.z.string().optional(),
+      seatTier: import_zod10.z.string().optional(),
+      organizationRateLimitTier: import_zod10.z.string().optional(),
+      userRateLimitTier: import_zod10.z.string().optional(),
+      hasExtraUsageEnabled: import_zod10.z.boolean().optional(),
+      subscriptionCreatedAt: import_zod10.z.string().optional(),
+      accountCreatedAt: import_zod10.z.string().optional()
     });
-    UsageSnapshotSchema = import_zod8.z.strictObject({
+    UsageSnapshotSchema = import_zod10.z.strictObject({
       schemaVersion: VersionSchema,
-      identity: import_zod8.z.string(),
+      identity: import_zod10.z.string(),
       updatedAt: InstantSchema,
       /** The identity's account metadata as of `updatedAt`. */
       account: AccountMetadataSchema.optional(),
       /** Latest state per provider, keyed by provider name (`anthropic` for OAuth sessions). */
-      providers: import_zod8.z.record(import_zod8.z.string(), ProviderUsageStateSchema)
+      providers: import_zod10.z.record(import_zod10.z.string(), ProviderUsageStateSchema)
     });
   }
 });
@@ -4392,24 +4392,24 @@ function planOf(account) {
   }
   return { kind: "subscription", capacity: 1, recognised: BASE_TIER.test(tier), ...tierField };
 }
-var import_zod9, PlanClassSchema, TIER_MULTIPLIER, ZERO_TIER, BASE_TIER;
+var import_zod11, PlanClassSchema, TIER_MULTIPLIER, ZERO_TIER, BASE_TIER;
 var init_plan2 = __esm({
   "src/usage/plan.ts"() {
     "use strict";
-    import_zod9 = require("zod");
-    PlanClassSchema = import_zod9.z.union([
-      import_zod9.z.strictObject({
-        kind: import_zod9.z.literal("subscription"),
+    import_zod11 = require("zod");
+    PlanClassSchema = import_zod11.z.union([
+      import_zod11.z.strictObject({
+        kind: import_zod11.z.literal("subscription"),
         /** The plan's size as a multiple of the smallest subscription tier (Max 5x is 5, Max 20x is 20). */
-        capacity: import_zod9.z.number().positive(),
+        capacity: import_zod11.z.number().positive(),
         /** False when the tier string named no multiplier and no tier this project knows, so `capacity` is the neutral 1 rather than a reading. */
-        recognised: import_zod9.z.boolean(),
+        recognised: import_zod11.z.boolean(),
         /** The tier string the classification rests on, when the account had one. */
-        tier: import_zod9.z.string().optional()
+        tier: import_zod11.z.string().optional()
       }),
-      import_zod9.z.strictObject({
-        kind: import_zod9.z.literal("pay-per-use"),
-        tier: import_zod9.z.string().optional()
+      import_zod11.z.strictObject({
+        kind: import_zod11.z.literal("pay-per-use"),
+        tier: import_zod11.z.string().optional()
       })
     ]);
     TIER_MULTIPLIER = /(?:^|_)(\d+)x$/;
@@ -4510,21 +4510,21 @@ var init_rateLimit = __esm({
 });
 
 // src/usage/scan.ts
-var import_zod10, AnthropicUsageSchema, ErrorObjectSchema;
+var import_zod12, AnthropicUsageSchema, ErrorObjectSchema;
 var init_scan = __esm({
   "src/usage/scan.ts"() {
     "use strict";
-    import_zod10 = require("zod");
-    AnthropicUsageSchema = import_zod10.z.looseObject({
-      input_tokens: import_zod10.z.number().int().nonnegative().nullish(),
-      output_tokens: import_zod10.z.number().int().nonnegative().nullish(),
-      cache_creation_input_tokens: import_zod10.z.number().int().nonnegative().nullish(),
-      cache_read_input_tokens: import_zod10.z.number().int().nonnegative().nullish()
+    import_zod12 = require("zod");
+    AnthropicUsageSchema = import_zod12.z.looseObject({
+      input_tokens: import_zod12.z.number().int().nonnegative().nullish(),
+      output_tokens: import_zod12.z.number().int().nonnegative().nullish(),
+      cache_creation_input_tokens: import_zod12.z.number().int().nonnegative().nullish(),
+      cache_read_input_tokens: import_zod12.z.number().int().nonnegative().nullish()
     });
-    ErrorObjectSchema = import_zod10.z.looseObject({
-      type: import_zod10.z.string().optional(),
-      code: import_zod10.z.union([import_zod10.z.string(), import_zod10.z.number()]).optional(),
-      message: import_zod10.z.string().optional()
+    ErrorObjectSchema = import_zod12.z.looseObject({
+      type: import_zod12.z.string().optional(),
+      code: import_zod12.z.union([import_zod12.z.string(), import_zod12.z.number()]).optional(),
+      message: import_zod12.z.string().optional()
     });
   }
 });
@@ -4817,22 +4817,25 @@ function rankPool(input) {
       return { ...candidate, feasible: true };
     }
     const drySpots = [];
+    const dryAfterMs = [];
     if (fiveHour !== void 0 && pace !== void 0) {
       const runsDryInMs = fiveHour.remaining / pace;
       if (runsDryInMs < fiveHour.untilResetMs) {
+        dryAfterMs.push(runsDryInMs);
         drySpots.push(`5h window would run dry in ${formatAge(runsDryInMs)}, before it resets in ${formatAge(fiveHour.untilResetMs)}`);
       }
     }
     if (sevenDay !== void 0 && sevenDayBurn !== void 0) {
       const runsDryInMs = sevenDay.remaining / sevenDayBurn;
       if (runsDryInMs < sevenDay.untilResetMs) {
+        dryAfterMs.push(runsDryInMs);
         drySpots.push(`7d window would run dry in ${formatAge(runsDryInMs)}, before it resets in ${formatAge(sevenDay.untilResetMs)}`);
       }
     }
     if (drySpots.length === 0) {
       return { ...candidate, feasible: true };
     }
-    return { ...candidate, feasible: false, reasons: [...drySpots, ...candidate.reasons] };
+    return { ...candidate, feasible: false, runsDryAtMs: nowMs + Math.min(...dryAfterMs), reasons: [...drySpots, ...candidate.reasons] };
   });
   const ordered = input.preference === "listed" ? [...candidates] : [...candidates].sort(
     (left, right) => CLASS_ORDER[left.class] - CLASS_ORDER[right.class] || Number(left.policyDemoted ?? false) - Number(right.policyDemoted ?? false) || Number(right.feasible) - Number(left.feasible) || (right.headroom ?? 1) - (left.headroom ?? 1) || (right.score ?? 0) - (left.score ?? 0) || left.identity.localeCompare(right.identity)
@@ -4854,11 +4857,13 @@ function rankPool(input) {
   const pick = ordered.find((candidate) => candidate.class !== "ineligible");
   const returns = ordered.flatMap((candidate) => candidate.blockedUntilMs === void 0 ? [] : [{ identity: candidate.identity, atMs: candidate.blockedUntilMs }]);
   const earliestReturn = returns.length === 0 ? void 0 : returns.reduce((soonest, entry) => entry.atMs < soonest.atMs ? entry : soonest);
+  const holdForReturn = pick?.runsDryAtMs === void 0 ? void 0 : returns.filter((entry) => entry.atMs < (pick.runsDryAtMs ?? 0)).reduce((soonest, entry) => soonest === void 0 || entry.atMs < soonest.atMs ? entry : soonest, void 0);
   return {
     candidates: ordered,
     ...pick === void 0 ? { ...earliestReturn === void 0 ? {} : { earliestReturn } } : { pick },
     ...movedOff === void 0 || pick === void 0 ? {} : { movedOff },
-    ...pick?.planReturnsAtMs === void 0 ? {} : { planReturn: { identity: pick.identity, atMs: pick.planReturnsAtMs } }
+    ...pick?.planReturnsAtMs === void 0 ? {} : { planReturn: { identity: pick.identity, atMs: pick.planReturnsAtMs } },
+    ...holdForReturn === void 0 ? {} : { holdForReturn }
   };
 }
 var MS_PER_SECOND4, MS_PER_HOUR2, HOURS_PER_DAY2, FIVE_HOURS, PROMPT_CACHE_TTL_HOURS, PERCENT, SEVEN_DAYS, FIVE_HOUR_WINDOW_MS, SEVEN_DAY_WINDOW_MS, PROMPT_CACHE_TTL_MS, CLASS_ORDER;
@@ -5253,12 +5258,12 @@ function recordStickyPick(fs12, picksFile, directory, identity, nowMs) {
   fs12.writeFilePrivate(picksFile, `${JSON.stringify(next, null, 2)}
 `);
 }
-var import_node_path20, import_zod11, PoolGraphError, SCHEMA_VERSION, PickEntrySchema, PicksFileSchema;
+var import_node_path20, import_zod13, PoolGraphError, SCHEMA_VERSION, PickEntrySchema, PicksFileSchema;
 var init_poolPick = __esm({
   "src/usage/poolPick.ts"() {
     "use strict";
     import_node_path20 = __toESM(require("node:path"), 1);
-    import_zod11 = require("zod");
+    import_zod13 = require("zod");
     init_cliError();
     init_identity();
     init_schema();
@@ -5274,10 +5279,10 @@ var init_poolPick = __esm({
       }
     };
     SCHEMA_VERSION = 1;
-    PickEntrySchema = import_zod11.z.strictObject({ identity: import_zod11.z.string().min(1), at: import_zod11.z.iso.datetime() });
-    PicksFileSchema = import_zod11.z.strictObject({
-      schemaVersion: import_zod11.z.literal(SCHEMA_VERSION),
-      picks: import_zod11.z.record(import_zod11.z.string().min(1), PickEntrySchema)
+    PickEntrySchema = import_zod13.z.strictObject({ identity: import_zod13.z.string().min(1), at: import_zod13.z.iso.datetime() });
+    PicksFileSchema = import_zod13.z.strictObject({
+      schemaVersion: import_zod13.z.literal(SCHEMA_VERSION),
+      picks: import_zod13.z.record(import_zod13.z.string().min(1), PickEntrySchema)
     });
   }
 });
@@ -5417,17 +5422,17 @@ function formatCachedCredentialState(state) {
   }
   return state.status === "fresh" ? `${age}, expires in ${formatAge(state.expiresInMs)}` : `${age}, expired ${formatAge(-state.expiresInMs)} ago`;
 }
-var import_zod12, MS_PER_UNIT, CachedCredentialSchema;
+var import_zod14, MS_PER_UNIT, CachedCredentialSchema;
 var init_credentialCache = __esm({
   "src/credentialCache.ts"() {
     "use strict";
-    import_zod12 = require("zod");
+    import_zod14 = require("zod");
     init_schema();
     init_preflight();
     MS_PER_UNIT = { s: 1e3, m: 6e4, h: 36e5, d: 864e5 };
-    CachedCredentialSchema = import_zod12.z.strictObject({
-      token: import_zod12.z.string().min(1),
-      fetchedAt: import_zod12.z.number().int().nonnegative(),
+    CachedCredentialSchema = import_zod14.z.strictObject({
+      token: import_zod14.z.string().min(1),
+      fetchedAt: import_zod14.z.number().int().nonnegative(),
       source: CredentialSourceSchema
     });
   }
@@ -5698,14 +5703,14 @@ function providerJsonPath(paths, name) {
 function providerExists(paths, name) {
   return import_node_fs6.default.existsSync(providerJsonPath(paths, name));
 }
-function isRecord4(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function legacyProviderConversion(raw) {
-  if (!isRecord4(raw) || "credential" in raw) {
+  if (!isRecord5(raw) || "credential" in raw) {
     return void 0;
   }
-  const env = isRecord4(raw.env) ? raw.env : void 0;
+  const env = isRecord5(raw.env) ? raw.env : void 0;
   const legacyEnvKeys = env === void 0 ? [] : Object.keys(env).filter((key) => LEGACY_ENV_CREDENTIAL_KEYS.includes(key));
   const fields = [...LEGACY_PROVIDER_FIELDS.filter((field) => field in raw), ...legacyEnvKeys.map((key) => `env.${key}`)];
   if (fields.length === 0) {
@@ -6168,21 +6173,21 @@ function findPathShadow(params) {
   }
   return params.pathDirs.some((dir) => import_node_path26.default.resolve(dir) === resolvedTargetDir) ? { status: "ok" } : { status: "not-on-path" };
 }
-var import_node_fs7, import_node_path26, import_zod17, ClaudeShimStateSchema, nodeLinkFs;
+var import_node_fs7, import_node_path26, import_zod19, ClaudeShimStateSchema, nodeLinkFs;
 var init_claudeShim = __esm({
   "src/claudeShim.ts"() {
     "use strict";
     import_node_fs7 = __toESM(require("node:fs"), 1);
     import_node_path26 = __toESM(require("node:path"), 1);
-    import_zod17 = require("zod");
+    import_zod19 = require("zod");
     init_commandDeps();
     init_store();
     init_realPorts();
     init_cliError();
-    ClaudeShimStateSchema = import_zod17.z.strictObject({
-      targetPath: import_zod17.z.string().min(1),
-      method: import_zod17.z.enum(["hardlink", "copy"]),
-      installedAtMs: import_zod17.z.number()
+    ClaudeShimStateSchema = import_zod19.z.strictObject({
+      targetPath: import_zod19.z.string().min(1),
+      method: import_zod19.z.enum(["hardlink", "copy"]),
+      installedAtMs: import_zod19.z.number()
     });
     nodeLinkFs = { link: import_node_fs7.default.linkSync, copyFile: import_node_fs7.default.copyFileSync, chmod: import_node_fs7.default.chmodSync };
   }
@@ -6687,7 +6692,7 @@ function buildEnv(params) {
   const parentCustomHeaders = params.baseEnv.ANTHROPIC_CUSTOM_HEADERS;
   let providerCustomHeaders;
   if (!params.configDirEscapeHatch && params.resolvedIdentityName !== void 0) {
-    env.CLAUDE_CONFIG_DIR = import_node_path34.default.join(params.identitiesDir, params.resolvedIdentityName);
+    env.CLAUDE_CONFIG_DIR = import_node_path35.default.join(params.identitiesDir, params.resolvedIdentityName);
   }
   if (params.provider !== void 0) {
     const providerEnv = params.provider.definition.env ?? {};
@@ -6731,11 +6736,11 @@ function buildEnv(params) {
   }
   return env;
 }
-var import_node_path34, LOOPBACK_HOSTS;
+var import_node_path35, LOOPBACK_HOSTS;
 var init_flags = __esm({
   "src/launcher/flags.ts"() {
     "use strict";
-    import_node_path34 = __toESM(require("node:path"), 1);
+    import_node_path35 = __toESM(require("node:path"), 1);
     init_envBool();
     init_credential();
     init_headers();
@@ -6809,12 +6814,17 @@ function resolvePoolLaunch(params) {
     if (graph.ranking.candidates.length === 0) {
       return { ok: false, message: `agent-shim: no member of pool "${poolName}" is an existing identity.` };
     }
-    const { pick, earliestReturn, movedOff, planReturn } = graph.ranking;
+    const { pick, earliestReturn, movedOff, planReturn, holdForReturn } = graph.ranking;
     if (pick !== void 0 && params.wait && planReturn !== void 0) {
       log.info(`agent-shim: pool "${poolName}" would continue ${planReturn.identity} on extra usage; waiting until ${new Date(planReturn.atMs).toISOString()} for its plan window`);
       params.sleep(Math.max(planReturn.atMs - nowMs, 0));
       continue;
     }
+    if (pick !== void 0 && params.wait && holdForReturn !== void 0) {
+      log.info(`agent-shim: pool "${poolName}" pick ${pick.identity} would run dry before its window resets; waiting until ${new Date(holdForReturn.atMs).toISOString()} for ${holdForReturn.identity}`);
+      params.sleep(Math.max(holdForReturn.atMs - nowMs, 0));
+      continue;
+    }
     if (pick !== void 0) {
       if (params.recordPick) {
         recordStickyPick(params.usageFs, params.paths.usagePicksFile, params.cwd, pick.identity, nowMs);
@@ -7063,7 +7073,7 @@ function decideLaunch(params, readOnly) {
     identityDefaultConfigProfile: loadedIdentity?.config.defaultConfigProfile,
     globalDefaultConfigProfile: params.globalDefaultConfigProfile
   });
-  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs12.readConfigFile(import_node_path35.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
+  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs12.readConfigFile(import_node_path36.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
     log.error(
       `agent-shim: no configuration profile named "${configProfileDecision.name}" (selected via ${configProfileDecision.source}). Run \`agent-shim profile add ${configProfileDecision.name}\` first.`
     );
@@ -7175,7 +7185,7 @@ function decideLaunch(params, readOnly) {
     extraFlags: splitExtraFlags(env.CLAUDE_EXTRA_FLAGS),
     passthrough: parsedArgv.rest
   });
-  const configDir = configDirEscapeHatchApplies || identityDecision.name === void 0 ? env.CLAUDE_CONFIG_DIR : import_node_path35.default.join(paths.identitiesDir, identityDecision.name);
+  const configDir = configDirEscapeHatchApplies || identityDecision.name === void 0 ? env.CLAUDE_CONFIG_DIR : import_node_path36.default.join(paths.identitiesDir, identityDecision.name);
   const decision = {
     identitySource: identityDecision.source,
     configDirEscapeHatch: identityDecision.configDirEscapeHatch,
@@ -7216,7 +7226,7 @@ function prepareLaunch(params) {
   );
   const updateCheck = runLaunchUpdateCheck({
     mode: params.updateMode ?? "off",
-    checkPath: import_node_path35.default.join(paths.root, "update.check"),
+    checkPath: import_node_path36.default.join(paths.root, "update.check"),
     currentVersion: package_default.version,
     port: params.update
   });
@@ -7347,12 +7357,12 @@ function runLaunchPlan(plan, spawn3) {
 function runLauncher(params) {
   params.proc.exit(runLaunchPlan(prepareLaunch(params), params.spawn));
 }
-var import_node_crypto10, import_node_path35;
+var import_node_crypto10, import_node_path36;
 var init_launcher = __esm({
   "src/launcher.ts"() {
     "use strict";
     import_node_crypto10 = require("node:crypto");
-    import_node_path35 = __toESM(require("node:path"), 1);
+    import_node_path36 = __toESM(require("node:path"), 1);
     init_package();
     init_envBool();
     init_argv();
@@ -7383,13 +7393,13 @@ function agentShimCliPath(distDir = typeof __AGENT_SHIM_DIST_DIR__ === "string"
   if (distDir === void 0) {
     throw new OwnCliPathUnknownError();
   }
-  return import_node_path36.default.join(distDir, OWN_CLI_FILE_NAME);
+  return import_node_path37.default.join(distDir, OWN_CLI_FILE_NAME);
 }
-var import_node_path36, OWN_CLI_FILE_NAME, OwnCliPathUnknownError;
+var import_node_path37, OWN_CLI_FILE_NAME, OwnCliPathUnknownError;
 var init_ownCli = __esm({
   "src/ownCli.ts"() {
     "use strict";
-    import_node_path36 = __toESM(require("node:path"), 1);
+    import_node_path37 = __toESM(require("node:path"), 1);
     init_cliError();
     OWN_CLI_FILE_NAME = "cli.cjs";
     OwnCliPathUnknownError = class extends CliError {
@@ -7474,7 +7484,7 @@ request.on("error", (error) => finish(failed, (error.code ? error.code + ": " :
 // src/frontdoor/trust.ts
 function resolveTrustBundle(params) {
   const { caCertFile, bundlesDir, variable, inherited, fs: fs12 } = params;
-  if (inherited === void 0 || inherited === "" || import_node_path37.default.resolve(inherited) === import_node_path37.default.resolve(caCertFile)) {
+  if (inherited === void 0 || inherited === "" || import_node_path38.default.resolve(inherited) === import_node_path38.default.resolve(caCertFile)) {
     return { path: caCertFile };
   }
   const caPem = fs12.readFileUtf8(caCertFile);
@@ -7492,19 +7502,19 @@ function resolveTrustBundle(params) {
   }
   const combined = `${inheritedPem.trimEnd()}
 ${caPem}`;
-  const bundle = import_node_path37.default.join(bundlesDir, `${(0, import_node_crypto11.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
+  const bundle = import_node_path38.default.join(bundlesDir, `${(0, import_node_crypto11.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
   if (!fs12.exists(bundle)) {
     fs12.mkdirp(bundlesDir);
     fs12.writeFileAtomic(bundle, combined);
   }
   return { path: bundle };
 }
-var import_node_crypto11, import_node_path37, BUNDLE_NAME_HEX_DIGITS;
+var import_node_crypto11, import_node_path38, BUNDLE_NAME_HEX_DIGITS;
 var init_trust = __esm({
   "src/frontdoor/trust.ts"() {
     "use strict";
     import_node_crypto11 = require("node:crypto");
-    import_node_path37 = __toESM(require("node:path"), 1);
+    import_node_path38 = __toESM(require("node:path"), 1);
     BUNDLE_NAME_HEX_DIGITS = 16;
   }
 });
@@ -7522,7 +7532,7 @@ function realEnsurePorts(paths, spawnDaemon) {
       process.kill(pid, "SIGTERM");
     },
     // Read fresh for each probe: a replacement supervisor may have regenerated an unparseable CA, and the probe must trust exactly what the serving door's leaf chains to.
-    verifyListener: (port) => probeFrontDoorSync(port, import_node_fs10.default.readFileSync(paths.frontdoorCaCertFile, "utf8"))
+    verifyListener: (port) => probeFrontDoorSync(port, import_node_fs11.default.readFileSync(paths.frontdoorCaCertFile, "utf8"))
   };
 }
 function realFrontDoorPort(paths, spawnDaemon) {
@@ -7543,21 +7553,21 @@ function realFrontDoorPort(paths, spawnDaemon) {
     }
   };
 }
-var import_node_fs10, realTrustBundleFs;
+var import_node_fs11, realTrustBundleFs;
 var init_realFrontDoorPort = __esm({
   "src/frontdoor/realFrontDoorPort.ts"() {
     "use strict";
-    import_node_fs10 = __toESM(require("node:fs"), 1);
+    import_node_fs11 = __toESM(require("node:fs"), 1);
     init_realPorts();
     init_ensure2();
     init_state();
     init_probe();
     init_trust();
     realTrustBundleFs = {
-      readFileUtf8: (file) => import_node_fs10.default.readFileSync(file, "utf8"),
-      exists: (file) => import_node_fs10.default.existsSync(file),
+      readFileUtf8: (file) => import_node_fs11.default.readFileSync(file, "utf8"),
+      exists: (file) => import_node_fs11.default.existsSync(file),
       mkdirp: (dir) => {
-        import_node_fs10.default.mkdirSync(dir, { recursive: true });
+        import_node_fs11.default.mkdirSync(dir, { recursive: true });
       },
       writeFileAtomic: (file, contents) => {
         realFarmFs.writeFilePrivate(file, contents);
@@ -7894,11 +7904,11 @@ var init_identityClaude = __esm({
 });
 
 // src/usage/providerQuota.ts
-var import_zod27, MS_PER_SECOND7, SECONDS_PER_HOUR, HOURS_PER_DAY4, DAYS_PER_MONTH, ZAI_HOST, ZAI_QUOTA_URL, ZAI_UNIT_HOURS, ZAI_UNIT_MONTHS, ZAI_UNIT_MS, ZaiLimitSchema, ZaiResponseSchema, OPENROUTER_HOST, OPENROUTER_KEY_URL, OPENROUTER_CREDITS_URL, MS_PER_DAY3, OpenRouterKeySchema, OpenRouterCreditsSchema;
+var import_zod29, MS_PER_SECOND7, SECONDS_PER_HOUR, HOURS_PER_DAY4, DAYS_PER_MONTH, ZAI_HOST, ZAI_QUOTA_URL, ZAI_UNIT_HOURS, ZAI_UNIT_MONTHS, ZAI_UNIT_MS, ZaiLimitSchema, ZaiResponseSchema, OPENROUTER_HOST, OPENROUTER_KEY_URL, OPENROUTER_CREDITS_URL, MS_PER_DAY3, OpenRouterKeySchema, OpenRouterCreditsSchema;
 var init_providerQuota = __esm({
   "src/usage/providerQuota.ts"() {
     "use strict";
-    import_zod27 = require("zod");
+    import_zod29 = require("zod");
     init_schema2();
     MS_PER_SECOND7 = 1e3;
     SECONDS_PER_HOUR = 3600;
@@ -7912,35 +7922,35 @@ var init_providerQuota = __esm({
       [ZAI_UNIT_HOURS, SECONDS_PER_HOUR * MS_PER_SECOND7],
       [ZAI_UNIT_MONTHS, DAYS_PER_MONTH * HOURS_PER_DAY4 * SECONDS_PER_HOUR * MS_PER_SECOND7]
     ]);
-    ZaiLimitSchema = import_zod27.z.object({
-      type: import_zod27.z.string(),
-      unit: import_zod27.z.number().int(),
-      number: import_zod27.z.number().int().positive(),
-      percentage: import_zod27.z.number().nonnegative(),
-      nextResetTime: import_zod27.z.number().positive().optional(),
-      usage: import_zod27.z.number().nonnegative().optional(),
-      currentValue: import_zod27.z.number().nonnegative().optional(),
-      remaining: import_zod27.z.number().nonnegative().optional()
+    ZaiLimitSchema = import_zod29.z.object({
+      type: import_zod29.z.string(),
+      unit: import_zod29.z.number().int(),
+      number: import_zod29.z.number().int().positive(),
+      percentage: import_zod29.z.number().nonnegative(),
+      nextResetTime: import_zod29.z.number().positive().optional(),
+      usage: import_zod29.z.number().nonnegative().optional(),
+      currentValue: import_zod29.z.number().nonnegative().optional(),
+      remaining: import_zod29.z.number().nonnegative().optional()
     });
-    ZaiResponseSchema = import_zod27.z.object({
-      success: import_zod27.z.boolean(),
-      msg: import_zod27.z.string().optional(),
-      data: import_zod27.z.object({ level: import_zod27.z.string().optional(), limits: import_zod27.z.array(ZaiLimitSchema) })
+    ZaiResponseSchema = import_zod29.z.object({
+      success: import_zod29.z.boolean(),
+      msg: import_zod29.z.string().optional(),
+      data: import_zod29.z.object({ level: import_zod29.z.string().optional(), limits: import_zod29.z.array(ZaiLimitSchema) })
     });
     OPENROUTER_HOST = "openrouter.ai";
     OPENROUTER_KEY_URL = `https://${OPENROUTER_HOST}/api/v1/key`;
     OPENROUTER_CREDITS_URL = `https://${OPENROUTER_HOST}/api/v1/credits`;
     MS_PER_DAY3 = HOURS_PER_DAY4 * SECONDS_PER_HOUR * MS_PER_SECOND7;
-    OpenRouterKeySchema = import_zod27.z.object({
-      data: import_zod27.z.object({
-        limit: import_zod27.z.number().nonnegative().nullable(),
-        limit_remaining: import_zod27.z.number().nullable(),
-        limit_reset: import_zod27.z.string().nullable(),
-        is_free_tier: import_zod27.z.boolean().optional(),
-        free_model_daily_requests: import_zod27.z.object({ used: import_zod27.z.number().nonnegative(), limit: import_zod27.z.number().nonnegative(), remaining: import_zod27.z.number() }).optional()
+    OpenRouterKeySchema = import_zod29.z.object({
+      data: import_zod29.z.object({
+        limit: import_zod29.z.number().nonnegative().nullable(),
+        limit_remaining: import_zod29.z.number().nullable(),
+        limit_reset: import_zod29.z.string().nullable(),
+        is_free_tier: import_zod29.z.boolean().optional(),
+        free_model_daily_requests: import_zod29.z.object({ used: import_zod29.z.number().nonnegative(), limit: import_zod29.z.number().nonnegative(), remaining: import_zod29.z.number() }).optional()
       })
     });
-    OpenRouterCreditsSchema = import_zod27.z.object({ data: import_zod27.z.object({ total_credits: import_zod27.z.number().nonnegative(), total_usage: import_zod27.z.number().nonnegative() }) });
+    OpenRouterCreditsSchema = import_zod29.z.object({ data: import_zod29.z.object({ total_credits: import_zod29.z.number().nonnegative(), total_usage: import_zod29.z.number().nonnegative() }) });
   }
 });
 
@@ -8029,6 +8039,10 @@ __export(index_exports, {
   AgentKindSchema: () => AgentKindSchema,
   AgentMetaSchema: () => AgentMetaSchema,
   AgentNodeSchema: () => AgentNodeSchema,
+  AgentTreesListInputSchema: () => AgentTreesListInputSchema,
+  AgentTreesListOutputSchema: () => AgentTreesListOutputSchema,
+  AgentTreesShowInputSchema: () => AgentTreesShowInputSchema,
+  AgentTreesShowOutputSchema: () => AgentTreesShowOutputSchema,
   CHECK_CREDENTIAL_APPLIES: () => CHECK_CREDENTIAL_APPLIES,
   CODEX_APP_SERVER_GENERATED_AGAINST: () => CODEX_APP_SERVER_GENERATED_AGAINST,
   CODEX_APP_SERVER_TIMEOUT_MS: () => CODEX_APP_SERVER_TIMEOUT_MS,
@@ -8124,11 +8138,15 @@ __export(index_exports, {
   InvalidIdentityNameError: () => InvalidIdentityNameError,
   InvalidProviderNameError: () => InvalidProviderNameError,
   LAUNCH_EVENT_SOURCE: () => LAUNCH_EVENT_SOURCE,
+  LIVE_TASK_CAP: () => LIVE_TASK_CAP,
   LaunchLifecycleEventSchema: () => LaunchLifecycleEventSchema,
   LaunchRefusedError: () => LaunchRefusedError,
   LaunchResolveInputSchema: () => LaunchResolveInputSchema,
   LaunchResolveOutputSchema: () => LaunchResolveOutputSchema,
   LegacyProviderFileError: () => LegacyProviderFileError,
+  LiveTaskSchema: () => LiveTaskSchema,
+  MergedAgentNodeSchema: () => MergedAgentNodeSchema,
+  MergedAgentTreeSchema: () => MergedAgentTreeSchema,
   OWN_CLI_FILE_NAME: () => OWN_CLI_FILE_NAME,
   PROMPT_CACHE_TTL_MS: () => PROMPT_CACHE_TTL_MS,
   PlanClassSchema: () => PlanClassSchema,
@@ -8176,6 +8194,8 @@ __export(index_exports, {
   ResetRowSchema: () => ResetRowSchema,
   ResetScheduleSchema: () => ResetScheduleSchema,
   SessionAgentTreeSchema: () => SessionAgentTreeSchema,
+  SessionLookupError: () => SessionLookupError,
+  SessionSummarySchema: () => SessionSummarySchema,
   TaskItemSchema: () => TaskItemSchema,
   USAGE_EVENT_SOURCE: () => USAGE_EVENT_SOURCE,
   UpdateCheckOutputSchema: () => UpdateCheckOutputSchema,
@@ -8194,6 +8214,7 @@ __export(index_exports, {
   addProvider: () => addProvider,
   agentShimCliPath: () => agentShimCliPath,
   answerRcControlRequest: () => answerRcControlRequest,
+  applyAgentTaskEvent: () => applyAgentTaskEvent,
   authenticateRcSessionMcpServer: () => authenticateRcSessionMcpServer,
   buildEntryFacts: () => buildEntryFacts,
   buildLayoutPaths: () => buildLayoutPaths,
@@ -8223,6 +8244,8 @@ __export(index_exports, {
   collectFrontDoorStatus: () => collectFrontDoorStatus,
   collectPoolPick: () => collectPoolPick,
   collectResets: () => collectResets,
+  collectSessionList: () => collectSessionList,
+  createAgentTreesApiRouter: () => createAgentTreesApiRouter,
   createCodexApiRouter: () => createCodexApiRouter,
   createConfigApiRouter: () => createConfigApiRouter,
   createControlApiRouter: () => createControlApiRouter,
@@ -8291,7 +8314,9 @@ __export(index_exports, {
   listProviders: () => listProviders,
   listSessions: () => listSessions2,
   listUsageSnapshots: () => listUsageSnapshots,
+  locateSession: () => locateSession,
   matchBranch: () => matchBranch,
+  mergeLiveTasks: () => mergeLiveTasks,
   mintLeaf: () => mintLeaf,
   mintRcSelfHostCredential: () => mintRcSelfHostCredential,
   observingRoutedRoute: () => observingRoutedRoute,
@@ -8333,6 +8358,7 @@ __export(index_exports, {
   realRcEventDial: () => realRcEventDial,
   realRcStreamDial: () => realRcStreamDial,
   realRcWebFetch: () => realRcWebFetch,
+  realSessionFs: () => realSessionFs,
   reconnectRcSessionMcpServer: () => reconnectRcSessionMcpServer,
   recoverFarm: () => recoverFarm,
   recoveryDiagnostics: () => recoveryDiagnostics,
@@ -8374,11 +8400,13 @@ __export(index_exports, {
   setProfileMetadata: () => setProfileMetadata,
   setRcSessionModel: () => setRcSessionModel,
   setRcSessionPermissionMode: () => setRcSessionPermissionMode,
+  showSession: () => showSession,
   snapshotPath: () => snapshotPath,
   spawnClaude: () => spawnClaude,
   startConnectServer: () => startConnectServer,
   submitRcSessionMcpOAuthCallbackUrl: () => submitRcSessionMcpOAuthCallbackUrl,
   suggestRcSessionFiles: () => suggestRcSessionFiles,
+  summariseSession: () => summariseSession,
   teleportRcSession: () => teleportRcSession,
   topLevelNames: () => topLevelNames,
   updateDirectoryRule: () => updateDirectoryRule,
@@ -8918,8 +8946,8 @@ function parseConnectTarget(authority) {
 function isInterceptedHost(host, interceptHosts) {
   return interceptHosts.includes(host);
 }
-function servedByPipeline(path38) {
-  return path38?.startsWith(ROUTED_PATH_PREFIX) === true;
+function servedByPipeline(path39) {
+  return path39?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
   "connection",
@@ -9289,6 +9317,264 @@ var HTTP_STATUS = {
   badGateway: 502
 };
 
+// src/agents/liveTasks.ts
+var import_zod5 = require("zod");
+
+// src/agents/schema.ts
+var import_zod4 = require("zod");
+var AgentMetaSchema = import_zod4.z.looseObject({
+  agentType: import_zod4.z.string(),
+  isFork: import_zod4.z.boolean().optional(),
+  description: import_zod4.z.string().optional(),
+  name: import_zod4.z.string().optional(),
+  toolUseId: import_zod4.z.string().optional(),
+  spawnDepth: import_zod4.z.number().int().nonnegative().optional(),
+  parentAgentId: import_zod4.z.string().optional(),
+  model: import_zod4.z.string().optional(),
+  requestShape: import_zod4.z.string().optional(),
+  requestNonInteractive: import_zod4.z.boolean().optional(),
+  workflowPhase: import_zod4.z.string().optional(),
+  taskKind: import_zod4.z.string().optional(),
+  teamName: import_zod4.z.string().optional(),
+  worktreePath: import_zod4.z.string().optional(),
+  worktreeBranch: import_zod4.z.string().optional(),
+  stoppedByUser: import_zod4.z.boolean().optional()
+});
+var AgentKindSchema = import_zod4.z.enum(["subagent", "fork", "workflow-agent", "teammate"]);
+var AgentNodeFields = {
+  id: import_zod4.z.string(),
+  kind: AgentKindSchema,
+  agentType: import_zod4.z.string(),
+  description: import_zod4.z.string().optional(),
+  name: import_zod4.z.string().optional(),
+  toolUseId: import_zod4.z.string().optional(),
+  spawnDepth: import_zod4.z.number().int().nonnegative().optional(),
+  model: import_zod4.z.string().optional(),
+  background: import_zod4.z.boolean().optional(),
+  workflowRunId: import_zod4.z.string().optional(),
+  workflowPhase: import_zod4.z.string().optional(),
+  teamName: import_zod4.z.string().optional(),
+  stoppedByUser: import_zod4.z.boolean().optional(),
+  transcript: import_zod4.z.string()
+};
+var AgentNodeSchema = import_zod4.z.lazy(() => import_zod4.z.strictObject({ ...AgentNodeFields, children: import_zod4.z.array(AgentNodeSchema) }));
+var TaskItemSchema = import_zod4.z.strictObject({
+  id: import_zod4.z.string(),
+  subject: import_zod4.z.string(),
+  description: import_zod4.z.string().optional(),
+  status: import_zod4.z.string(),
+  /** What a spinner shows while the task runs. */
+  activeForm: import_zod4.z.string().optional(),
+  /** The teammate or agent name the task is assigned to, as Agent Teams writes it. */
+  owner: import_zod4.z.string().optional(),
+  /** Free-form data the harness attaches to a task, kept as written. */
+  metadata: import_zod4.z.record(import_zod4.z.string(), import_zod4.z.unknown()).optional(),
+  blocks: import_zod4.z.array(import_zod4.z.string()),
+  blockedBy: import_zod4.z.array(import_zod4.z.string()),
+  /** The id of the shared task list this task belongs to (a team's name, or a custom list id), absent for the session's own list. */
+  taskList: import_zod4.z.string().optional()
+});
+var WorkflowRunSchema = import_zod4.z.strictObject({
+  runId: import_zod4.z.string(),
+  workflowName: import_zod4.z.string().optional(),
+  status: import_zod4.z.string().optional(),
+  startTime: import_zod4.z.number().optional(),
+  phases: import_zod4.z.array(import_zod4.z.string()),
+  summary: import_zod4.z.string().optional()
+});
+var AgentTreeProblemSchema = import_zod4.z.strictObject({
+  /** Relative to the identity's configuration directory. */
+  path: import_zod4.z.string(),
+  reason: import_zod4.z.string()
+});
+var SessionSummarySchema = import_zod4.z.strictObject({
+  project: import_zod4.z.string(),
+  sessionId: import_zod4.z.string(),
+  superseded: import_zod4.z.boolean(),
+  /** The directory and transcript stem exactly as on disk, which differs from `sessionId` for a superseded session. */
+  entry: import_zod4.z.string(),
+  agentCount: import_zod4.z.number().int().nonnegative(),
+  workflowRunCount: import_zod4.z.number().int().nonnegative(),
+  /** When the transcript was last written, as an ISO instant; absent when there is no transcript file. */
+  updatedAt: import_zod4.z.iso.datetime().optional(),
+  identities: import_zod4.z.array(import_zod4.z.string())
+});
+var SessionAgentTreeSchema = import_zod4.z.strictObject({
+  project: import_zod4.z.string(),
+  sessionId: import_zod4.z.string(),
+  /** True for a session directory a resume superseded (`<session-id>.superseded-<epoch-ms>`). */
+  superseded: import_zod4.z.boolean(),
+  /** The agents the session itself spawned, each with its descendants. */
+  agents: import_zod4.z.array(AgentNodeSchema),
+  tasks: import_zod4.z.array(TaskItemSchema),
+  workflowRuns: import_zod4.z.array(WorkflowRunSchema),
+  problems: import_zod4.z.array(AgentTreeProblemSchema)
+});
+
+// src/agents/liveTasks.ts
+var LIVE_TASK_CAP = 512;
+var RUNNING_STATUS = "running";
+var LiveTaskUsageSchema = import_zod5.z.strictObject({
+  totalTokens: import_zod5.z.number().optional(),
+  toolUses: import_zod5.z.number().optional(),
+  durationMs: import_zod5.z.number().optional()
+});
+var LiveTaskSchema = import_zod5.z.strictObject({
+  /** The `task_id`: for an unnamed subagent the stem of its `agent-<id>` files on disk. */
+  taskId: import_zod5.z.string(),
+  /** The `cse_` session whose stream carried the task. */
+  sessionId: import_zod5.z.string(),
+  runId: import_zod5.z.string().optional(),
+  /** The `tool_use` block in the spawning transcript, which is the meta file's `toolUseId`. */
+  toolUseId: import_zod5.z.string().optional(),
+  /** `local_agent` for a subagent, `local_bash` for a backgrounded command; open because other kinds may exist. */
+  taskType: import_zod5.z.string().optional(),
+  description: import_zod5.z.string().optional(),
+  subagentType: import_zod5.z.string().optional(),
+  spawnDepth: import_zod5.z.number().int().nonnegative().optional(),
+  parentTaskId: import_zod5.z.string().optional(),
+  backgrounded: import_zod5.z.boolean().optional(),
+  status: import_zod5.z.string(),
+  /** `<tmpdir>/<project-slug>/<local session id>/tasks/<task_id>.output`, which embeds the local session id. */
+  outputFile: import_zod5.z.string().optional(),
+  summary: import_zod5.z.string().optional(),
+  lastToolName: import_zod5.z.string().optional(),
+  usage: LiveTaskUsageSchema.optional(),
+  /** When the door last observed an event for this task, in epoch milliseconds from its injected clock. */
+  observedAt: import_zod5.z.number()
+});
+var SYSTEM_SUBTYPES = ["task_started", "task_progress", "task_updated", "task_notification", "background_tasks_changed"];
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stringField(record, field) {
+  const value = record[field];
+  return typeof value === "string" && value !== "" ? value : void 0;
+}
+function numberField(record, field) {
+  const value = record[field];
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function booleanField(record, field) {
+  const value = record[field];
+  return typeof value === "boolean" ? value : void 0;
+}
+function usageOf(record) {
+  const raw = record.usage;
+  if (!isRecord2(raw)) {
+    return void 0;
+  }
+  const totalTokens = numberField(raw, "total_tokens");
+  const toolUses = numberField(raw, "tool_uses");
+  const durationMs = numberField(raw, "duration_ms");
+  if (totalTokens === void 0 && toolUses === void 0 && durationMs === void 0) {
+    return void 0;
+  }
+  return { ...totalTokens === void 0 ? {} : { totalTokens }, ...toolUses === void 0 ? {} : { toolUses }, ...durationMs === void 0 ? {} : { durationMs } };
+}
+function overlay(base, fields) {
+  const defined = Object.fromEntries(Object.entries(fields).filter(([, value]) => value !== void 0));
+  return LiveTaskSchema.parse({ ...base, ...defined });
+}
+function isFinished(task) {
+  return task.status !== RUNNING_STATUS;
+}
+function bounded(book) {
+  if (book.size <= LIVE_TASK_CAP) {
+    return book;
+  }
+  const evictable = [...book.values()].filter(isFinished).sort((left, right) => left.observedAt - right.observedAt);
+  for (const task of evictable) {
+    if (book.size <= LIVE_TASK_CAP) {
+      break;
+    }
+    book.delete(task.taskId);
+  }
+  return book;
+}
+function applyAgentTaskEvent(book, sessionId, payload, observedAt2) {
+  if (!isRecord2(payload) || payload.type !== "system") {
+    return book;
+  }
+  const subtype = payload.subtype;
+  if (typeof subtype !== "string" || !SYSTEM_SUBTYPES.some((known) => known === subtype)) {
+    return book;
+  }
+  const next = new Map(book);
+  const upsert = (taskId2, fields) => {
+    const existing = next.get(taskId2);
+    const base = existing ?? { taskId: taskId2, sessionId, status: RUNNING_STATUS, observedAt: observedAt2 };
+    next.set(taskId2, overlay(base, { ...fields, observedAt: observedAt2 }));
+  };
+  if (subtype === "background_tasks_changed") {
+    const tasks = Array.isArray(payload.tasks) ? payload.tasks : [];
+    for (const raw of tasks) {
+      const taskId2 = isRecord2(raw) ? stringField(raw, "task_id") : void 0;
+      if (isRecord2(raw) && taskId2 !== void 0) {
+        upsert(taskId2, { runId: stringField(raw, "run_id"), taskType: stringField(raw, "task_type"), description: stringField(raw, "description") });
+      }
+    }
+    return bounded(next);
+  }
+  const taskId = stringField(payload, "task_id");
+  if (taskId === void 0) {
+    return book;
+  }
+  const common = { runId: stringField(payload, "run_id"), toolUseId: stringField(payload, "tool_use_id"), description: stringField(payload, "description") };
+  if (subtype === "task_started") {
+    upsert(taskId, {
+      ...common,
+      taskType: stringField(payload, "task_type"),
+      subagentType: stringField(payload, "subagent_type"),
+      spawnDepth: numberField(payload, "spawn_depth"),
+      parentTaskId: stringField(payload, "parent_task_id"),
+      backgrounded: booleanField(payload, "is_backgrounded")
+    });
+  } else if (subtype === "task_progress") {
+    upsert(taskId, { ...common, subagentType: stringField(payload, "subagent_type"), lastToolName: stringField(payload, "last_tool_name"), usage: usageOf(payload) });
+  } else if (subtype === "task_updated") {
+    const patch = isRecord2(payload.patch) ? payload.patch : {};
+    upsert(taskId, { runId: stringField(payload, "run_id"), status: stringField(patch, "status") });
+  } else {
+    upsert(taskId, { ...common, status: stringField(payload, "status"), outputFile: stringField(payload, "output_file"), summary: stringField(payload, "summary"), usage: usageOf(payload) });
+  }
+  return bounded(next);
+}
+var MergedProvenanceSchema = import_zod5.z.enum(["disk", "both"]);
+var MergedAgentNodeSchema = import_zod5.z.lazy(
+  () => import_zod5.z.strictObject({
+    ...AgentNodeFields,
+    provenance: MergedProvenanceSchema,
+    live: LiveTaskSchema.optional(),
+    children: import_zod5.z.array(MergedAgentNodeSchema)
+  })
+);
+var MergedAgentTreeSchema = import_zod5.z.strictObject({
+  ...SessionAgentTreeSchema.shape,
+  agents: import_zod5.z.array(MergedAgentNodeSchema),
+  /** The `cse_` sessions whose live tasks matched this session. Empty when the session is not live or the door has not observed it. */
+  remoteSessions: import_zod5.z.array(import_zod5.z.string()),
+  /** Live tasks of those sessions that match no disk agent (a backgrounded command, or an agent whose files have not appeared yet). */
+  liveOnly: import_zod5.z.array(LiveTaskSchema)
+});
+function mergeLiveTasks(tree, live) {
+  const byTaskId = new Map(live.map((task) => [task.taskId, task]));
+  const byToolUseId = new Map(live.flatMap((task) => task.toolUseId === void 0 ? [] : [[task.toolUseId, task]]));
+  const claimed = /* @__PURE__ */ new Set();
+  const merge = (node) => {
+    const task = byTaskId.get(node.id) ?? (node.toolUseId === void 0 ? void 0 : byToolUseId.get(node.toolUseId));
+    if (task !== void 0) {
+      claimed.add(task.taskId);
+    }
+    return { ...node, provenance: task === void 0 ? "disk" : "both", ...task === void 0 ? {} : { live: task }, children: node.children.map(merge) };
+  };
+  const agents = tree.agents.map(merge);
+  const sessionMarker = `/${tree.sessionId}/`;
+  const liveOnly = live.filter((task) => !claimed.has(task.taskId) && task.outputFile?.includes(sessionMarker) === true);
+  const remoteSessions = [...new Set([...claimed, ...liveOnly.map((task) => task.taskId)].flatMap((taskId) => byTaskId.get(taskId)?.sessionId ?? []))].sort();
+  return { ...tree, agents, remoteSessions, liveOnly };
+}
+
 // src/frontdoor/rcSessions.ts
 var RC_SESSIONS_PATH_PREFIX = "/v1/code/sessions";
 var RC_SESSION_ID_PREFIX = "cse_";
@@ -9329,7 +9615,7 @@ function sessionCreateId(body) {
   const id = session.id;
   return typeof id === "string" && id.startsWith(RC_SESSION_ID_PREFIX) ? id : void 0;
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseJsonObject(body) {
@@ -9339,7 +9625,7 @@ function parseJsonObject(body) {
   } catch {
     return void 0;
   }
-  return isRecord2(parsed) ? parsed : void 0;
+  return isRecord3(parsed) ? parsed : void 0;
 }
 function nonEmptyString(record, field) {
   const value = record === void 0 ? void 0 : record[field];
@@ -9360,11 +9646,11 @@ function payloadEventsOf(body) {
   }
   const payloads = [];
   for (const event of events) {
-    if (!isRecord2(event)) {
+    if (!isRecord3(event)) {
       continue;
     }
     const payload = event.payload;
-    if (!isRecord2(payload)) {
+    if (!isRecord3(payload)) {
       continue;
     }
     payloads.push(payload);
@@ -9379,7 +9665,7 @@ function pendingOfControlRequestPayload(payload) {
   if (requestId === void 0) {
     return void 0;
   }
-  const request4 = isRecord2(payload.request) ? payload.request : void 0;
+  const request4 = isRecord3(payload.request) ? payload.request : void 0;
   const subtype = nonEmptyString(request4, "subtype");
   const type = subtype ?? "control_request";
   let summary = "";
@@ -9396,20 +9682,21 @@ function answeredRequestIdsOfControlResponsePayload(payload) {
   if (payload.type !== "control_response") {
     return [];
   }
-  const response = isRecord2(payload.response) ? payload.response : void 0;
+  const response = isRecord3(payload.response) ? payload.response : void 0;
   const id = nonEmptyString(response, "request_id") ?? nonEmptyString(payload, "request_id") ?? nonEmptyString(payload, "uuid");
   return id === void 0 ? [] : [id];
 }
 function parseRcRequestBody(kind, body) {
   if (kind === "heartbeat") {
-    return { controlRequests: [], answeredRequestIds: [], idleSeconds: finiteNumber(parseJsonObject(body), "idle_seconds"), workerStatus: void 0 };
+    return { controlRequests: [], answeredRequestIds: [], idleSeconds: finiteNumber(parseJsonObject(body), "idle_seconds"), workerStatus: void 0, payloads: [] };
   }
   if (kind === "worker-registration") {
-    return { controlRequests: [], answeredRequestIds: [], idleSeconds: void 0, workerStatus: nonEmptyString(parseJsonObject(body), "worker_status") };
+    return { controlRequests: [], answeredRequestIds: [], idleSeconds: void 0, workerStatus: nonEmptyString(parseJsonObject(body), "worker_status"), payloads: [] };
   }
   const controlRequests = [];
   const answeredRequestIds = [];
-  for (const payload of payloadEventsOf(body)) {
+  const payloads = payloadEventsOf(body);
+  for (const payload of payloads) {
     const pending = pendingOfControlRequestPayload(payload);
     if (pending !== void 0) {
       controlRequests.push({ requestId: pending.requestId, type: pending.type, summary: pending.summary });
@@ -9417,7 +9704,7 @@ function parseRcRequestBody(kind, body) {
     }
     answeredRequestIds.push(...answeredRequestIdsOfControlResponsePayload(payload));
   }
-  return { controlRequests, answeredRequestIds, idleSeconds: void 0, workerStatus: void 0 };
+  return { controlRequests, answeredRequestIds, idleSeconds: void 0, workerStatus: void 0, payloads };
 }
 function createRcSessionTracker(deps) {
   const entries = /* @__PURE__ */ new Map();
@@ -9443,7 +9730,7 @@ function createRcSessionTracker(deps) {
   const timer = setInterval(sweep, deps.idleMs);
   timer.unref();
   const birth = (id, facts) => {
-    const record = { id, createdAt: deps.now(), lastSeenAt: deps.now(), ...facts, pending: /* @__PURE__ */ new Map(), workerState: void 0, workerIdleSeconds: void 0, sequenceNum: void 0 };
+    const record = { id, createdAt: deps.now(), lastSeenAt: deps.now(), ...facts, pending: /* @__PURE__ */ new Map(), workerState: void 0, workerIdleSeconds: void 0, sequenceNum: void 0, liveTasks: /* @__PURE__ */ new Map() };
     entries.set(id, record);
     return record;
   };
@@ -9454,11 +9741,11 @@ function createRcSessionTracker(deps) {
   };
   const observeExchange = (request4) => {
     const method = (request4.method ?? "").toUpperCase();
-    const path38 = new URL(request4.url ?? "/", "http://127.0.0.1").pathname;
-    if (!path38.startsWith(RC_SESSIONS_PATH_PREFIX)) {
+    const path39 = new URL(request4.url ?? "/", "http://127.0.0.1").pathname;
+    if (!path39.startsWith(RC_SESSIONS_PATH_PREFIX)) {
       return void 0;
     }
-    const tail = path38.slice(RC_SESSIONS_PATH_PREFIX.length);
+    const tail = path39.slice(RC_SESSIONS_PATH_PREFIX.length);
     const facts = {
       oauthAuthorization: oauthAuthorizationOf(request4.headers),
       anthropicVersion: singleHeader(request4.headers, "anthropic-version"),
@@ -9531,6 +9818,9 @@ function createRcSessionTracker(deps) {
       for (const requestId of factsOfBody.answeredRequestIds) {
         entryNow.pending.delete(requestId);
       }
+      for (const payload of factsOfBody.payloads) {
+        entryNow.liveTasks = applyAgentTaskEvent(entryNow.liveTasks, id, payload, now);
+      }
       if (factsOfBody.idleSeconds !== void 0) {
         entryNow.workerIdleSeconds = { value: factsOfBody.idleSeconds, observedAt: now };
       }
@@ -9621,9 +9911,10 @@ function createRcSessionTracker(deps) {
         return;
       }
       entry.sequenceNum = entry.sequenceNum === void 0 || event.sequence_num > entry.sequenceNum ? event.sequence_num : entry.sequenceNum;
-      if (!isRecord2(event.payload)) {
+      if (!isRecord3(event.payload)) {
         return;
       }
+      entry.liveTasks = applyAgentTaskEvent(entry.liveTasks, sessionId, event.payload, deps.now());
       const pending = pendingOfControlRequestPayload(event.payload);
       if (pending !== void 0) {
         if (event.source === RC_STREAM_WORKER_SOURCE) {
@@ -9635,6 +9926,10 @@ function createRcSessionTracker(deps) {
         entry.pending.delete(requestId);
       }
     },
+    liveTasksOf: (sessionId) => {
+      sweep();
+      return sortedEntries().filter((entry) => sessionId === void 0 || entry.id === sessionId).flatMap((entry) => [...entry.liveTasks.values()].sort((left, right) => left.observedAt - right.observedAt || (left.taskId < right.taskId ? -1 : 1)));
+    },
     completePending: (sessionId, requestId) => {
       entries.get(sessionId)?.pending.delete(requestId);
     },
@@ -9840,8 +10135,8 @@ var RC_READ_FILE_ENCODINGS = ["utf-8", "base64"];
 function isRcReadFileEncoding(value) {
   return RC_READ_FILE_ENCODINGS.some((encoding) => encoding === value);
 }
-function buildRcReadFilePayload(requestId, path38, options) {
-  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path38, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
+function buildRcReadFilePayload(requestId, path39, options) {
+  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path39, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
 }
 function buildRcFileSuggestionsPayload(requestId, query) {
   return buildRcControlRequestPayload(requestId, { subtype: "file_suggestions", query });
@@ -9943,15 +10238,15 @@ async function getRcSessionContextUsage(deps, sessionId, detail) {
   const result = await deliverRcClientPayload(deps, sessionId, buildRcGetContextUsagePayload(requestId, detail), `request the context usage of session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
-async function readRcSessionFile(deps, sessionId, path38, options) {
-  if (path38 === "") {
+async function readRcSessionFile(deps, sessionId, path39, options) {
+  if (path39 === "") {
     return { ok: false, message: "a read-file write needs a non-empty path: the SDK's own field names the file the worker resolves against the session's cwd, and an empty string names none" };
   }
   if (options?.maxBytes !== void 0 && (!Number.isInteger(options.maxBytes) || options.maxBytes <= 0)) {
     return { ok: false, message: "a read-file write's max-bytes is a positive whole number of bytes: the SDK's own field caps the read, and a zero or negative cap reads nothing" };
   }
   const requestId = deps.newUuid();
-  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path38, options), `read ${path38} from session ${sessionId}`);
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path39, options), `read ${path39} from session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
 async function suggestRcSessionFiles(deps, sessionId, query) {
@@ -10120,11 +10415,11 @@ function createRcControlHandler(deps) {
       path: "read-file",
       read: (body) => {
         const session = bodyString(body, "session");
-        const path38 = bodyString(body, "path");
+        const path39 = bodyString(body, "path");
         const maxBytes = "maxBytes" in body ? bodyPositiveInteger(body, "maxBytes") : void 0;
         const encoding = "encoding" in body && isRcReadFileEncoding(body.encoding) ? body.encoding : void 0;
-        const refused2 = session === void 0 || path38 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
-        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path38, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
+        const refused2 = session === void 0 || path39 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
+        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path39, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
       }
     },
     {
@@ -10434,9 +10729,9 @@ function requestIdOfBody(body) {
 }
 function frontDoorRcControl(transport, token) {
   const headers = { authorization: `Bearer ${token}` };
-  const listAnswerOf = async (path38, what) => {
+  const listAnswerOf = async (path39, what) => {
     try {
-      return await transport.request({ method: "GET", path: path38, headers });
+      return await transport.request({ method: "GET", path: path39, headers });
     } catch (error) {
       throw new Error(`${what}: could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
     }
@@ -10508,10 +10803,10 @@ function frontDoorRcControl(transport, token) {
     }
     return pending;
   };
-  const writeOf = async (path38, body, describeFailure2) => {
+  const writeOf = async (path39, body, describeFailure2) => {
     let answer;
     try {
-      answer = await transport.request({ method: "POST", path: path38, headers: { ...headers, "content-type": "application/json" }, body });
+      answer = await transport.request({ method: "POST", path: path39, headers: { ...headers, "content-type": "application/json" }, body });
     } catch (error) {
       return { ok: false, message: `could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}` };
     }
@@ -10542,10 +10837,10 @@ function frontDoorRcControl(transport, token) {
     endSession: async (sessionId, reason) => await writeOf(`${CONTROL_PATH_PREFIX}/end-session`, JSON.stringify({ session: sessionId, ...reason === void 0 ? {} : { reason } }), (status, message) => `ending ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getUsage: async (sessionId, skipBehaviors) => await writeOf(`${CONTROL_PATH_PREFIX}/get-usage`, JSON.stringify({ session: sessionId, ...skipBehaviors === void 0 ? {} : { skipBehaviors } }), (status, message) => `requesting the usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getContextUsage: async (sessionId, detail) => await writeOf(`${CONTROL_PATH_PREFIX}/get-context-usage`, JSON.stringify({ session: sessionId, ...detail === void 0 ? {} : { detail } }), (status, message) => `requesting the context usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
-    readFile: async (sessionId, path38, options) => await writeOf(
+    readFile: async (sessionId, path39, options) => await writeOf(
       `${CONTROL_PATH_PREFIX}/read-file`,
-      JSON.stringify({ session: sessionId, path: path38, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
-      (status, message) => `reading ${path38} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
+      JSON.stringify({ session: sessionId, path: path39, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
+      (status, message) => `reading ${path39} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
     ),
     fileSuggestions: async (sessionId, query) => await writeOf(`${CONTROL_PATH_PREFIX}/file-suggestions`, JSON.stringify({ session: sessionId, query }), (status, message) => `requesting file suggestions from ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     keepAlive: async (sessionId) => await writeOf(`${CONTROL_PATH_PREFIX}/keep-alive`, JSON.stringify({ session: sessionId }), (status, message) => `keeping ${sessionId} alive failed (HTTP ${String(status)}): ${message}`),
@@ -10704,12 +10999,12 @@ function tlsFacts(options) {
 }
 function realRcEventDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const post = async (path38, headers, body) => await new Promise((resolve, reject) => {
+  const post = async (path39, headers, body) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method: "POST",
-      path: path38,
+      path: path39,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, "content-length": String(Buffer.byteLength(body, "utf8")) },
       agent
@@ -10774,12 +11069,12 @@ function lateRcStreamDial(resolve) {
 }
 function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const request4 = async (method, path38, headers, body, signal) => await new Promise((resolve, reject) => {
+  const request4 = async (method, path39, headers, body, signal) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method,
-      path: path38,
+      path: path39,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, ...body === void 0 ? {} : { "content-length": String(Buffer.byteLength(body, "utf8")) } },
       agent,
@@ -10821,9 +11116,9 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
       return { status, body: await readAll(response) };
     },
     openStream: async (sessionId, headers, resume, signal) => {
-      const path38 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
+      const path39 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
       const streamHeaders = resume === void 0 ? headers : { ...headers, "last-event-id": String(resume.fromSequenceNum) };
-      const { status, response } = await request4("GET", path38, streamHeaders, void 0, signal);
+      const { status, response } = await request4("GET", path39, streamHeaders, void 0, signal);
       if (!isSuccessful2(status)) {
         await readAll(response);
         return { status, chunks: NO_CHUNKS };
@@ -11039,11 +11334,11 @@ var import_node_path10 = __toESM(require("node:path"), 1);
 function isSafeSessionId(sessionId) {
   return /^[A-Za-z0-9_-]+$/.test(sessionId);
 }
-function isRecord3(value) {
+function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function credentialOfJson(parsed) {
-  if (!isRecord3(parsed)) {
+  if (!isRecord4(parsed)) {
     return void 0;
   }
   const { authorization, anthropicVersion, anthropicClientPlatform } = parsed;
@@ -11073,7 +11368,7 @@ function createRcCredentialStore(fs12, dir) {
     } catch {
       return void 0;
     }
-    return isRecord3(parsed) ? parsed : void 0;
+    return isRecord4(parsed) ? parsed : void 0;
   };
   return {
     read: (sessionId) => {
@@ -11127,162 +11422,162 @@ init_package();
 init_capability();
 
 // src/frontdoor/rcSchemas.ts
-var import_zod4 = require("zod");
-var RcPermissionModeSchema = import_zod4.z.enum(RC_PERMISSION_MODES);
-var RcSessionSummarySchema = import_zod4.z.strictObject({
-  id: import_zod4.z.string(),
-  createdAt: import_zod4.z.number(),
-  lastSeenAt: import_zod4.z.number()
+var import_zod6 = require("zod");
+var RcPermissionModeSchema = import_zod6.z.enum(RC_PERMISSION_MODES);
+var RcSessionSummarySchema = import_zod6.z.strictObject({
+  id: import_zod6.z.string(),
+  createdAt: import_zod6.z.number(),
+  lastSeenAt: import_zod6.z.number()
 });
 function workerFactSchema(value) {
-  return import_zod4.z.strictObject({ value, observedAt: import_zod4.z.number() });
-}
-var RcPendingRequestSummarySchema = import_zod4.z.strictObject({
-  sessionId: import_zod4.z.string(),
-  requestId: import_zod4.z.string(),
-  type: import_zod4.z.string(),
-  summary: import_zod4.z.string(),
-  observedAt: import_zod4.z.number()
+  return import_zod6.z.strictObject({ value, observedAt: import_zod6.z.number() });
+}
+var RcPendingRequestSummarySchema = import_zod6.z.strictObject({
+  sessionId: import_zod6.z.string(),
+  requestId: import_zod6.z.string(),
+  type: import_zod6.z.string(),
+  summary: import_zod6.z.string(),
+  observedAt: import_zod6.z.number()
 });
-var RcSessionStatusSchema = import_zod4.z.strictObject({
+var RcSessionStatusSchema = import_zod6.z.strictObject({
   ...RcSessionSummarySchema.shape,
-  workerState: workerFactSchema(import_zod4.z.string()).optional(),
-  workerIdleSeconds: workerFactSchema(import_zod4.z.number()).optional(),
-  pending: import_zod4.z.readonly(import_zod4.z.array(RcPendingRequestSummarySchema))
+  workerState: workerFactSchema(import_zod6.z.string()).optional(),
+  workerIdleSeconds: workerFactSchema(import_zod6.z.number()).optional(),
+  pending: import_zod6.z.readonly(import_zod6.z.array(RcPendingRequestSummarySchema))
 });
-var RcStreamEnvelopeSchema = import_zod4.z.looseObject({
+var RcStreamEnvelopeSchema = import_zod6.z.looseObject({
   /** The envelope's own event id, when the host sent one. */
-  event_id: import_zod4.z.string().optional(),
+  event_id: import_zod6.z.string().optional(),
   /** The envelope's event type, the discriminator a consumer switches on (`control_request`, `user`, and kin). */
-  event_type: import_zod4.z.string(),
+  event_type: import_zod6.z.string(),
   /** The sequence number the host assigned, the value a resume continues after. */
-  sequence_num: import_zod4.z.int(),
+  sequence_num: import_zod6.z.int(),
   /** Who emitted the event (`worker` for the CLI's half, a client id for a client's). */
-  source: import_zod4.z.string(),
+  source: import_zod6.z.string(),
   /** The event's payload, carried verbatim: its shape is the payload family's, narrowed by whichever consumer needs it. Optional in the schema's own type because the door forwards the host's envelope as it arrived, asserting only the fields it relies on itself. */
-  payload: import_zod4.z.unknown().optional(),
+  payload: import_zod6.z.unknown().optional(),
   /** When the host created the event; the protocol's own type for this field is not established here, so it is forwarded rather than asserted. */
-  created_at: import_zod4.z.unknown().optional()
+  created_at: import_zod6.z.unknown().optional()
 });
-var RcStreamEventSchema = import_zod4.z.strictObject({
-  session: import_zod4.z.string(),
+var RcStreamEventSchema = import_zod6.z.strictObject({
+  session: import_zod6.z.string(),
   envelope: RcStreamEnvelopeSchema
 });
-var RcRateLimitWindowSchema = import_zod4.z.looseObject({
+var RcRateLimitWindowSchema = import_zod6.z.looseObject({
   /** The fraction of the window used, usually between 0 and 1, above 1 when usage legitimately runs past the window's cap (the CLI's own field description states both). */
-  utilization: import_zod4.z.number().optional(),
+  utilization: import_zod6.z.number().optional(),
   /** When the window resets, in unix epoch seconds: the unit is the CLI's own field description, stated in the 2.1.289 bundle's schema. */
-  resetsAt: import_zod4.z.number().optional()
+  resetsAt: import_zod6.z.number().optional()
 });
-var RcRateLimitInfoSchema = import_zod4.z.looseObject({
+var RcRateLimitInfoSchema = import_zod6.z.looseObject({
   /** The limiting window's own status (`allowed`, `allowed_warning`, `rejected`), asserted only as a string because the vocabulary grows with the CLI. */
-  status: import_zod4.z.string(),
+  status: import_zod6.z.string(),
   /** When the limiting window resets, in unix epoch seconds. */
-  resetsAt: import_zod4.z.number().optional(),
+  resetsAt: import_zod6.z.number().optional(),
   /** Which window the top-level fields describe (`five_hour`, `seven_day`, and kin), the payload's own name for it. */
-  rateLimitType: import_zod4.z.string().optional(),
+  rateLimitType: import_zod6.z.string().optional(),
   /** The fraction of the limiting window used, on the same scale the per-window utilizations carry. */
-  utilization: import_zod4.z.number().optional(),
+  utilization: import_zod6.z.number().optional(),
   /** Whether usage beyond the plan (extra usage) is currently covering the overflow, the payload's own flag for it. */
-  isUsingOverage: import_zod4.z.boolean().optional(),
+  isUsingOverage: import_zod6.z.boolean().optional(),
   /** The overage's own status, the same vocabulary the limiting window's `status` carries. */
-  overageStatus: import_zod4.z.string().optional(),
+  overageStatus: import_zod6.z.string().optional(),
   /** When the overage window resets, in unix epoch seconds. */
-  overageResetsAt: import_zod4.z.number().optional(),
+  overageResetsAt: import_zod6.z.number().optional(),
   /** Each subscription window the account's response headers carried: the session (five-hour), weekly (seven-day), and overage-included weekly windows, each present only when the account's responses carry it. */
-  unifiedWindows: import_zod4.z.looseObject({ five_hour: RcRateLimitWindowSchema.optional(), seven_day: RcRateLimitWindowSchema.optional(), seven_day_overage_included: RcRateLimitWindowSchema.optional() }).optional()
+  unifiedWindows: import_zod6.z.looseObject({ five_hour: RcRateLimitWindowSchema.optional(), seven_day: RcRateLimitWindowSchema.optional(), seven_day_overage_included: RcRateLimitWindowSchema.optional() }).optional()
 });
-var RcLiveRateLimitSchema = import_zod4.z.strictObject({
-  session: import_zod4.z.string(),
-  observedAt: import_zod4.z.number(),
+var RcLiveRateLimitSchema = import_zod6.z.strictObject({
+  session: import_zod6.z.string(),
+  observedAt: import_zod6.z.number(),
   rateLimit: RcRateLimitInfoSchema
 });
-var RcSessionQuerySchema = import_zod4.z.strictObject({
-  session: import_zod4.z.string().min(1).optional()
+var RcSessionQuerySchema = import_zod6.z.strictObject({
+  session: import_zod6.z.string().min(1).optional()
 });
-var RcSendInputSchema = import_zod4.z.strictObject({
-  session: import_zod4.z.string().min(1),
-  text: import_zod4.z.string().min(1)
+var RcSendInputSchema = import_zod6.z.strictObject({
+  session: import_zod6.z.string().min(1),
+  text: import_zod6.z.string().min(1)
 });
-var RcAnswerInputSchema = import_zod4.z.strictObject({
-  session: import_zod4.z.string().min(1),
-  request: import_zod4.z.string().min(1),
-  approve: import_zod4.z.boolean(),
-  text: import_zod4.z.string().optional()
+var RcAnswerInputSchema = import_zod6.z.strictObject({
+  session: import_zod6.z.string().min(1),
+  request: import_zod6.z.string().min(1),
+  approve: import_zod6.z.boolean(),
+  text: import_zod6.z.string().optional()
 }).refine((input) => !input.approve || input.text === void 0 || input.text === "", { message: "an approval carries no text (the protocol's allow result has no message field); text is the denial message" });
-var RcInterruptInputSchema = import_zod4.z.strictObject({
-  session: import_zod4.z.string().min(1)
+var RcInterruptInputSchema = import_zod6.z.strictObject({
+  session: import_zod6.z.string().min(1)
 });
-var RcSetModelInputSchema = import_zod4.z.strictObject({
-  session: import_zod4.z.string().min(1),
-  model: import_zod4.z.string().min(1)
+var RcSetModelInputSchema = import_zod6.z.strictObject({
+  session: import_zod6.z.string().min(1),
+  model: import_zod6.z.string().min(1)
 });
-var RcSetPermissionModeInputSchema = import_zod4.z.strictObject({
-  session: import_zod4.z.string().min(1),
+var RcSetPermissionModeInputSchema = import_zod6.z.strictObject({
+  session: import_zod6.z.string().min(1),
   mode: RcPermissionModeSchema
 });
-var RcEndSessionInputSchema = import_zod4.z.strictObject({
-  session: import_zod4.z.string().min(1),
-  reason: import_zod4.z.string().min(1).optional()
+var RcEndSessionInputSchema = import_zod6.z.strictObject({
+  session: import_zod6.z.string().min(1),
+  reason: import_zod6.z.string().min(1).optional()
 });
-var RcGetUsageInputSchema = import_zod4.z.strictObject({
-  session: import_zod4.z.string().min(1),
-  skipBehaviors: import_zod4.z.boolean().optional()
+var RcGetUsageInputSchema = import_zod6.z.strictObject({
+  session: import_zod6.z.string().min(1),
+  skipBehaviors: import_zod6.z.boolean().optional()
 });
-var RcGetContextUsageInputSchema = import_zod4.z.strictObject({
-  session: import_zod4.z.string().min(1),
-  detail: import_zod4.z.enum(RC_CONTEXT_USAGE_DETAILS).optional()
+var RcGetContextUsageInputSchema = import_zod6.z.strictObject({
+  session: import_zod6.z.string().min(1),
+  detail: import_zod6.z.enum(RC_CONTEXT_USAGE_DETAILS).optional()
 });
-var RcReadFileInputSchema = import_zod4.z.strictObject({
-  session: import_zod4.z.string().min(1),
-  path: import_zod4.z.string().min(1),
-  maxBytes: import_zod4.z.number().int().positive().optional(),
-  encoding: import_zod4.z.enum(RC_READ_FILE_ENCODINGS).optional()
+var RcReadFileInputSchema = import_zod6.z.strictObject({
+  session: import_zod6.z.string().min(1),
+  path: import_zod6.z.string().min(1),
+  maxBytes: import_zod6.z.number().int().positive().optional(),
+  encoding: import_zod6.z.enum(RC_READ_FILE_ENCODINGS).optional()
 });
-var RcFileSuggestionsInputSchema = import_zod4.z.strictObject({
-  session: import_zod4.z.string().min(1),
-  query: import_zod4.z.string()
+var RcFileSuggestionsInputSchema = import_zod6.z.strictObject({
+  session: import_zod6.z.string().min(1),
+  query: import_zod6.z.string()
 });
-var RcKeepAliveInputSchema = import_zod4.z.strictObject({
-  session: import_zod4.z.string().min(1)
+var RcKeepAliveInputSchema = import_zod6.z.strictObject({
+  session: import_zod6.z.string().min(1)
 });
-var RcMcpStatusInputSchema = import_zod4.z.strictObject({
-  session: import_zod4.z.string().min(1)
+var RcMcpStatusInputSchema = import_zod6.z.strictObject({
+  session: import_zod6.z.string().min(1)
 });
-var RcMcpReconnectInputSchema = import_zod4.z.strictObject({
-  session: import_zod4.z.string().min(1),
-  serverName: import_zod4.z.string().min(1)
+var RcMcpReconnectInputSchema = import_zod6.z.strictObject({
+  session: import_zod6.z.string().min(1),
+  serverName: import_zod6.z.string().min(1)
 });
-var RcMcpAuthenticateInputSchema = import_zod4.z.strictObject({
-  session: import_zod4.z.string().min(1),
-  serverName: import_zod4.z.string().min(1),
-  redirectUri: import_zod4.z.string().min(1)
+var RcMcpAuthenticateInputSchema = import_zod6.z.strictObject({
+  session: import_zod6.z.string().min(1),
+  serverName: import_zod6.z.string().min(1),
+  redirectUri: import_zod6.z.string().min(1)
 });
-var RcMcpOAuthCallbackUrlInputSchema = import_zod4.z.strictObject({
-  session: import_zod4.z.string().min(1),
-  serverName: import_zod4.z.string().min(1),
-  callbackUrl: import_zod4.z.string().min(1)
+var RcMcpOAuthCallbackUrlInputSchema = import_zod6.z.strictObject({
+  session: import_zod6.z.string().min(1),
+  serverName: import_zod6.z.string().min(1),
+  callbackUrl: import_zod6.z.string().min(1)
 });
-var RcTeleportInputSchema = import_zod4.z.strictObject({
-  session: import_zod4.z.string().min(1),
-  marker: import_zod4.z.string().min(1)
+var RcTeleportInputSchema = import_zod6.z.strictObject({
+  session: import_zod6.z.string().min(1),
+  marker: import_zod6.z.string().min(1)
 });
-var RcListOutputSchema = import_zod4.z.strictObject({ sessions: import_zod4.z.readonly(import_zod4.z.array(RcSessionSummarySchema)) });
-var RcStatusOutputSchema = import_zod4.z.strictObject({ statuses: import_zod4.z.readonly(import_zod4.z.array(RcSessionStatusSchema)) });
-var RcPendingOutputSchema = import_zod4.z.strictObject({ pending: import_zod4.z.readonly(import_zod4.z.array(RcPendingRequestSummarySchema)) });
-var RcWriteOutputSchema = import_zod4.z.strictObject({
-  session: import_zod4.z.string(),
-  sequenceNums: import_zod4.z.readonly(import_zod4.z.array(import_zod4.z.number()))
+var RcListOutputSchema = import_zod6.z.strictObject({ sessions: import_zod6.z.readonly(import_zod6.z.array(RcSessionSummarySchema)) });
+var RcStatusOutputSchema = import_zod6.z.strictObject({ statuses: import_zod6.z.readonly(import_zod6.z.array(RcSessionStatusSchema)) });
+var RcPendingOutputSchema = import_zod6.z.strictObject({ pending: import_zod6.z.readonly(import_zod6.z.array(RcPendingRequestSummarySchema)) });
+var RcWriteOutputSchema = import_zod6.z.strictObject({
+  session: import_zod6.z.string(),
+  sequenceNums: import_zod6.z.readonly(import_zod6.z.array(import_zod6.z.number()))
 });
-var RcControlWriteOutputSchema = import_zod4.z.strictObject({
-  session: import_zod4.z.string(),
-  request: import_zod4.z.string(),
-  sequenceNums: import_zod4.z.readonly(import_zod4.z.array(import_zod4.z.number()))
+var RcControlWriteOutputSchema = import_zod6.z.strictObject({
+  session: import_zod6.z.string(),
+  request: import_zod6.z.string(),
+  sequenceNums: import_zod6.z.readonly(import_zod6.z.array(import_zod6.z.number()))
 });
-var RcAnswerOutputSchema = import_zod4.z.strictObject({
-  session: import_zod4.z.string(),
-  request: import_zod4.z.string(),
-  sequenceNums: import_zod4.z.readonly(import_zod4.z.array(import_zod4.z.number()))
+var RcAnswerOutputSchema = import_zod6.z.strictObject({
+  session: import_zod6.z.string(),
+  request: import_zod6.z.string(),
+  sequenceNums: import_zod6.z.readonly(import_zod6.z.array(import_zod6.z.number()))
 });
 
 // src/frontdoor/rcApi.ts
@@ -11290,6 +11585,7 @@ var RC_ORPC_PATH_PREFIX = "/__agent-shim/orpc";
 var RC_OPENAPI_DOC_PATH = "/openapi.json";
 var RC_SUBSCRIBER_BUFFER_EVENTS = 100;
 var READ_ONLY_OPERATION_EXTENSION = "x-agent-shim-read-only";
+var SESSION_HISTORY_TAG = "agent-trees";
 function doorApiBearer(headers) {
   const presented = headers.authorization;
   const bearerPrefix = "bearer ".length;
@@ -11468,48 +11764,48 @@ init_cliError();
 init_package();
 
 // src/codex/appServerSchemas.ts
-var import_zod5 = require("zod");
+var import_zod7 = require("zod");
 var CODEX_APP_SERVER_GENERATED_AGAINST = "0.160.0";
-var RateLimitWindowSchema = import_zod5.z.object({
-  usedPercent: import_zod5.z.number(),
-  resetsAt: import_zod5.z.number().nullish(),
-  windowDurationMins: import_zod5.z.number().nullish()
+var RateLimitWindowSchema = import_zod7.z.object({
+  usedPercent: import_zod7.z.number(),
+  resetsAt: import_zod7.z.number().nullish(),
+  windowDurationMins: import_zod7.z.number().nullish()
 });
-var RateLimitSnapshotSchema = import_zod5.z.object({
-  limitId: import_zod5.z.string().nullish(),
-  limitName: import_zod5.z.string().nullish(),
-  planType: import_zod5.z.string().nullish(),
+var RateLimitSnapshotSchema = import_zod7.z.object({
+  limitId: import_zod7.z.string().nullish(),
+  limitName: import_zod7.z.string().nullish(),
+  planType: import_zod7.z.string().nullish(),
   primary: RateLimitWindowSchema.nullish(),
   secondary: RateLimitWindowSchema.nullish(),
-  rateLimitReachedType: import_zod5.z.string().nullish(),
-  spendControlReached: import_zod5.z.boolean().nullish()
+  rateLimitReachedType: import_zod7.z.string().nullish(),
+  spendControlReached: import_zod7.z.boolean().nullish()
 });
-var RateLimitResetCreditSchema = import_zod5.z.object({
-  id: import_zod5.z.string(),
-  grantedAt: import_zod5.z.number(),
-  expiresAt: import_zod5.z.number().nullish(),
-  resetType: import_zod5.z.string(),
-  status: import_zod5.z.string(),
-  title: import_zod5.z.string().nullish(),
-  description: import_zod5.z.string().nullish()
+var RateLimitResetCreditSchema = import_zod7.z.object({
+  id: import_zod7.z.string(),
+  grantedAt: import_zod7.z.number(),
+  expiresAt: import_zod7.z.number().nullish(),
+  resetType: import_zod7.z.string(),
+  status: import_zod7.z.string(),
+  title: import_zod7.z.string().nullish(),
+  description: import_zod7.z.string().nullish()
 });
-var CodexAccountSchema = import_zod5.z.discriminatedUnion("type", [
-  import_zod5.z.object({ type: import_zod5.z.literal("apiKey") }),
-  import_zod5.z.object({ type: import_zod5.z.literal("chatgpt"), email: import_zod5.z.string().nullable(), planType: import_zod5.z.string() }),
-  import_zod5.z.object({ type: import_zod5.z.literal("amazonBedrock"), usesCodexManagedCredentials: import_zod5.z.boolean().default(false) })
+var CodexAccountSchema = import_zod7.z.discriminatedUnion("type", [
+  import_zod7.z.object({ type: import_zod7.z.literal("apiKey") }),
+  import_zod7.z.object({ type: import_zod7.z.literal("chatgpt"), email: import_zod7.z.string().nullable(), planType: import_zod7.z.string() }),
+  import_zod7.z.object({ type: import_zod7.z.literal("amazonBedrock"), usesCodexManagedCredentials: import_zod7.z.boolean().default(false) })
 ]);
-var CodexAccountReadSchema = import_zod5.z.object({
+var CodexAccountReadSchema = import_zod7.z.object({
   account: CodexAccountSchema.nullable(),
-  requiresOpenaiAuth: import_zod5.z.boolean()
+  requiresOpenaiAuth: import_zod7.z.boolean()
 });
-var CodexRateLimitsReadSchema = import_zod5.z.object({
+var CodexRateLimitsReadSchema = import_zod7.z.object({
   rateLimits: RateLimitSnapshotSchema,
-  rateLimitsByLimitId: import_zod5.z.record(import_zod5.z.string(), RateLimitSnapshotSchema).nullish(),
-  rateLimitResetCredits: import_zod5.z.object({ availableCount: import_zod5.z.number(), credits: import_zod5.z.array(RateLimitResetCreditSchema).nullish() }).nullish(),
-  accountId: import_zod5.z.string().nullish(),
-  ordinaryUsageAllowed: import_zod5.z.boolean().nullish()
+  rateLimitsByLimitId: import_zod7.z.record(import_zod7.z.string(), RateLimitSnapshotSchema).nullish(),
+  rateLimitResetCredits: import_zod7.z.object({ availableCount: import_zod7.z.number(), credits: import_zod7.z.array(RateLimitResetCreditSchema).nullish() }).nullish(),
+  accountId: import_zod7.z.string().nullish(),
+  ordinaryUsageAllowed: import_zod7.z.boolean().nullish()
 });
-var CodexInitializeResultSchema = import_zod5.z.object({ userAgent: import_zod5.z.string() });
+var CodexInitializeResultSchema = import_zod7.z.object({ userAgent: import_zod7.z.string() });
 
 // src/codex/appServer.ts
 var CodexAppServerUnavailableError = class extends CliError {
@@ -11704,8 +12000,8 @@ init_cliError();
 init_realPorts();
 
 // src/frontdoor/controlApi.ts
-var import_client6 = require("@orpc/client");
-var import_openapi7 = require("@orpc/openapi");
+var import_client7 = require("@orpc/client");
+var import_openapi8 = require("@orpc/openapi");
 
 // src/checkReport.ts
 var import_node_os5 = __toESM(require("node:os"), 1);
@@ -11974,19 +12270,19 @@ function writePools(paths, pools) {
   applyPatch(paths.globalConfigFile, GlobalConfigSchema, { pools }, { defaults: {} });
 }
 function poolCycleOf(pools, name) {
-  const walk = (current, path38) => {
+  const walk = (current, path39) => {
     for (const entry of pools[current]?.identities ?? []) {
       const nested = poolNameOf(poolMemberIdentity(entry));
       if (nested === void 0) {
         continue;
       }
       if (nested === name) {
-        return [...path38, nested];
+        return [...path39, nested];
       }
-      if (path38.includes(nested)) {
+      if (path39.includes(nested)) {
         continue;
       }
-      const found = walk(nested, [...path38, nested]);
+      const found = walk(nested, [...path39, nested]);
       if (found !== void 0) {
         return found;
       }
@@ -12086,7 +12382,7 @@ init_realCredentialCache();
 init_providersStore();
 init_realPorts();
 var import_node_path25 = __toESM(require("node:path"), 1);
-var import_zod13 = require("zod");
+var import_zod15 = require("zod");
 init_envBool();
 init_load();
 init_schema();
@@ -12174,9 +12470,9 @@ function lookupKeychainService(run, farmRoot) {
     note: serviceName === void 0 ? `A Keychain entry was found for account "${farmRoot}" but its service name could not be parsed from security's output.` : `Keychain service name for this identity: "${serviceName}".`
   };
 }
-var SettingsSecretsShapeSchema = import_zod13.z.looseObject({
-  env: import_zod13.z.record(import_zod13.z.string(), import_zod13.z.unknown()).optional(),
-  hooks: import_zod13.z.record(import_zod13.z.string(), import_zod13.z.array(import_zod13.z.unknown())).optional()
+var SettingsSecretsShapeSchema = import_zod15.z.looseObject({
+  env: import_zod15.z.record(import_zod15.z.string(), import_zod15.z.unknown()).optional(),
+  hooks: import_zod15.z.record(import_zod15.z.string(), import_zod15.z.array(import_zod15.z.unknown())).optional()
 });
 function hookCommandCountOf(group) {
   if (typeof group !== "object" || group === null) {
@@ -12468,7 +12764,7 @@ function collectCheckReport(params) {
 }
 
 // src/checkReportSchema.ts
-var import_zod15 = require("zod");
+var import_zod17 = require("zod");
 init_schema();
 init_claudeVersion();
 init_identity();
@@ -12532,124 +12828,124 @@ var DIAGNOSTIC_CODES = [
 var DIAGNOSTIC_SEVERITIES = ["error", "warning", "info"];
 
 // src/usage/pickReportSchema.ts
-var import_zod14 = require("zod");
+var import_zod16 = require("zod");
 init_plan2();
-var PoolPickCandidateViewSchema = import_zod14.z.strictObject({
-  identity: import_zod14.z.string(),
+var PoolPickCandidateViewSchema = import_zod16.z.strictObject({
+  identity: import_zod16.z.string(),
   /** In pick order: `scored` has usable quota data, `unknown` has none, `pay-per-use` bills by use, `ineligible` is refused right now. */
-  class: import_zod14.z.enum(["scored", "unknown", "pay-per-use", "ineligible"]),
+  class: import_zod16.z.enum(["scored", "unknown", "pay-per-use", "ineligible"]),
   /** Plan-size-weighted remaining quota per hour until its reset; present for `scored` only. */
-  score: import_zod14.z.number().optional(),
+  score: import_zod16.z.number().optional(),
   /** Which window's reset divides the score: the seven-day window, or the five-hour one when the member reports no seven-day utilisation or its measured-ratio five-hour term outranks the weekly one; present with `score`. */
-  scoreWindow: import_zod14.z.enum(["sevenDay", "fiveHour"]).optional(),
+  scoreWindow: import_zod16.z.enum(["sevenDay", "fiveHour"]).optional(),
   /** False when the five-hour window would run dry, at the observed pace, before it resets. */
-  feasible: import_zod14.z.boolean(),
+  feasible: import_zod16.z.boolean(),
   /** When an `ineligible` member can be used again, as an ISO instant. */
-  blockedUntil: import_zod14.z.iso.datetime().optional(),
+  blockedUntil: import_zod16.z.iso.datetime().optional(),
   plan: PlanClassSchema,
   /** The facts behind the class and score, in the order they matter. */
-  reasons: import_zod14.z.array(import_zod14.z.string())
+  reasons: import_zod16.z.array(import_zod16.z.string())
 });
-var PoolPickReportSchema = import_zod14.z.strictObject({
-  pool: import_zod14.z.string(),
-  directory: import_zod14.z.string(),
+var PoolPickReportSchema = import_zod16.z.strictObject({
+  pool: import_zod16.z.string(),
+  directory: import_zod16.z.string(),
   /** The member a launch would run as, absent when every member is refused. */
-  pick: import_zod14.z.string().optional(),
-  candidates: import_zod14.z.array(PoolPickCandidateViewSchema),
+  pick: import_zod16.z.string().optional(),
+  candidates: import_zod16.z.array(PoolPickCandidateViewSchema),
   /** Identity members anywhere in the pool's graph that do not exist; a launch skips them. */
-  missing: import_zod14.z.array(import_zod14.z.string()),
+  missing: import_zod16.z.array(import_zod16.z.string()),
   /** When nothing can be picked, the soonest any member returns. */
-  earliestReturn: import_zod14.z.strictObject({ identity: import_zod14.z.string(), at: import_zod14.z.iso.datetime() }).optional(),
+  earliestReturn: import_zod16.z.strictObject({ identity: import_zod16.z.string(), at: import_zod16.z.iso.datetime() }).optional(),
   /** The member a resumed conversation started on but moved off, and why, when the ranking could not keep it. */
-  movedOff: import_zod14.z.strictObject({ identity: import_zod14.z.string(), reason: import_zod14.z.string() }).optional(),
+  movedOff: import_zod16.z.strictObject({ identity: import_zod16.z.string(), reason: import_zod16.z.string() }).optional(),
   /** Why the last-pick record could not be read, when that is the case. */
-  stickyProblem: import_zod14.z.string().optional()
+  stickyProblem: import_zod16.z.string().optional()
 });
 
 // src/checkReportSchema.ts
 var CHECK_CREDENTIAL_APPLIES = ["provider", "identity", "stored-login"];
-var CheckLayerViewSchema = import_zod15.z.strictObject({
-  id: import_zod15.z.int(),
-  kind: import_zod15.z.enum(LAYER_KINDS),
-  source: import_zod15.z.string()
+var CheckLayerViewSchema = import_zod17.z.strictObject({
+  id: import_zod17.z.int(),
+  kind: import_zod17.z.enum(LAYER_KINDS),
+  source: import_zod17.z.string()
 });
-var CheckEntryViewSchema = import_zod15.z.strictObject({
-  path: import_zod15.z.string(),
-  shared: import_zod15.z.boolean(),
-  via: import_zod15.z.enum(DECISION_VIAS),
+var CheckEntryViewSchema = import_zod17.z.strictObject({
+  path: import_zod17.z.string(),
+  shared: import_zod17.z.boolean(),
+  via: import_zod17.z.enum(DECISION_VIAS),
   /** The entry's real category, or null when nothing classifies it. */
-  category: import_zod15.z.enum(CATEGORY_NAMES).nullable(),
-  rule: import_zod15.z.strictObject({ key: import_zod15.z.string(), layer: import_zod15.z.int() }).optional(),
+  category: import_zod17.z.enum(CATEGORY_NAMES).nullable(),
+  rule: import_zod17.z.strictObject({ key: import_zod17.z.string(), layer: import_zod17.z.int() }).optional(),
   /** Rules that matched but whose `when` condition failed, each with the conditions that failed. */
-  eliminated: import_zod15.z.readonly(import_zod15.z.array(import_zod15.z.strictObject({ key: import_zod15.z.string(), failed: import_zod15.z.readonly(import_zod15.z.array(import_zod15.z.string())) }))).optional()
+  eliminated: import_zod17.z.readonly(import_zod17.z.array(import_zod17.z.strictObject({ key: import_zod17.z.string(), failed: import_zod17.z.readonly(import_zod17.z.array(import_zod17.z.string())) }))).optional()
 });
-var CheckDiagnosticSchema = import_zod15.z.strictObject({
-  code: import_zod15.z.enum(DIAGNOSTIC_CODES),
-  severity: import_zod15.z.enum(DIAGNOSTIC_SEVERITIES),
-  message: import_zod15.z.string(),
-  subject: import_zod15.z.string().optional(),
-  layer: import_zod15.z.int().optional()
+var CheckDiagnosticSchema = import_zod17.z.strictObject({
+  code: import_zod17.z.enum(DIAGNOSTIC_CODES),
+  severity: import_zod17.z.enum(DIAGNOSTIC_SEVERITIES),
+  message: import_zod17.z.string(),
+  subject: import_zod17.z.string().optional(),
+  layer: import_zod17.z.int().optional()
 });
-var CheckAmbientCredentialSchema = import_zod15.z.union([import_zod15.z.strictObject({ ok: import_zod15.z.literal(true) }), import_zod15.z.strictObject({ ok: import_zod15.z.literal(false), variable: import_zod15.z.string(), message: import_zod15.z.string() })]);
-var CheckKeychainSchema = import_zod15.z.strictObject({
-  checked: import_zod15.z.literal(true),
-  found: import_zod15.z.boolean(),
-  serviceName: import_zod15.z.string().optional(),
-  note: import_zod15.z.string()
+var CheckAmbientCredentialSchema = import_zod17.z.union([import_zod17.z.strictObject({ ok: import_zod17.z.literal(true) }), import_zod17.z.strictObject({ ok: import_zod17.z.literal(false), variable: import_zod17.z.string(), message: import_zod17.z.string() })]);
+var CheckKeychainSchema = import_zod17.z.strictObject({
+  checked: import_zod17.z.literal(true),
+  found: import_zod17.z.boolean(),
+  serviceName: import_zod17.z.string().optional(),
+  note: import_zod17.z.string()
 });
-var CheckSettingsExposureSchema = import_zod15.z.strictObject({
-  file: import_zod15.z.string(),
-  envKeyNames: import_zod15.z.readonly(import_zod15.z.array(import_zod15.z.string())),
-  hookEventNames: import_zod15.z.readonly(import_zod15.z.array(import_zod15.z.string())),
-  hookCommandCount: import_zod15.z.int().nonnegative()
+var CheckSettingsExposureSchema = import_zod17.z.strictObject({
+  file: import_zod17.z.string(),
+  envKeyNames: import_zod17.z.readonly(import_zod17.z.array(import_zod17.z.string())),
+  hookEventNames: import_zod17.z.readonly(import_zod17.z.array(import_zod17.z.string())),
+  hookCommandCount: import_zod17.z.int().nonnegative()
 });
-var CredentialSourceSummarySchema = import_zod15.z.union([
-  import_zod15.z.strictObject({ kind: import_zod15.z.literal("env"), variable: import_zod15.z.string() }),
-  import_zod15.z.strictObject({ kind: import_zod15.z.literal("file"), path: import_zod15.z.string() }),
-  import_zod15.z.strictObject({ kind: import_zod15.z.literal("command"), program: import_zod15.z.string() }),
-  import_zod15.z.strictObject({ kind: import_zod15.z.literal("op"), reference: import_zod15.z.string() }),
-  import_zod15.z.strictObject({ kind: import_zod15.z.literal("keychain"), service: import_zod15.z.string(), account: import_zod15.z.string().optional() }),
-  import_zod15.z.strictObject({ kind: import_zod15.z.literal("literal") })
+var CredentialSourceSummarySchema = import_zod17.z.union([
+  import_zod17.z.strictObject({ kind: import_zod17.z.literal("env"), variable: import_zod17.z.string() }),
+  import_zod17.z.strictObject({ kind: import_zod17.z.literal("file"), path: import_zod17.z.string() }),
+  import_zod17.z.strictObject({ kind: import_zod17.z.literal("command"), program: import_zod17.z.string() }),
+  import_zod17.z.strictObject({ kind: import_zod17.z.literal("op"), reference: import_zod17.z.string() }),
+  import_zod17.z.strictObject({ kind: import_zod17.z.literal("keychain"), service: import_zod17.z.string(), account: import_zod17.z.string().optional() }),
+  import_zod17.z.strictObject({ kind: import_zod17.z.literal("literal") })
 ]);
-var CredentialSummarySchema = import_zod15.z.strictObject({
-  target: import_zod15.z.enum(CREDENTIAL_TARGETS),
-  sources: import_zod15.z.readonly(import_zod15.z.array(CredentialSourceSummarySchema)),
+var CredentialSummarySchema = import_zod17.z.strictObject({
+  target: import_zod17.z.enum(CREDENTIAL_TARGETS),
+  sources: import_zod17.z.readonly(import_zod17.z.array(CredentialSourceSummarySchema)),
   cache: CredentialCacheSchema.optional()
 });
-var CachedCredentialStateSchema = import_zod15.z.union([
-  import_zod15.z.strictObject({ store: import_zod15.z.enum(CREDENTIAL_CACHE_STORES), status: import_zod15.z.literal("empty") }),
-  import_zod15.z.strictObject({ store: import_zod15.z.enum(CREDENTIAL_CACHE_STORES), status: import_zod15.z.literal("unreadable"), reason: import_zod15.z.string() }),
-  import_zod15.z.strictObject({ store: import_zod15.z.enum(CREDENTIAL_CACHE_STORES), status: import_zod15.z.enum(["fresh", "expired"]), ageMs: import_zod15.z.number(), expiresInMs: import_zod15.z.number().optional() })
+var CachedCredentialStateSchema = import_zod17.z.union([
+  import_zod17.z.strictObject({ store: import_zod17.z.enum(CREDENTIAL_CACHE_STORES), status: import_zod17.z.literal("empty") }),
+  import_zod17.z.strictObject({ store: import_zod17.z.enum(CREDENTIAL_CACHE_STORES), status: import_zod17.z.literal("unreadable"), reason: import_zod17.z.string() }),
+  import_zod17.z.strictObject({ store: import_zod17.z.enum(CREDENTIAL_CACHE_STORES), status: import_zod17.z.enum(["fresh", "expired"]), ageMs: import_zod17.z.number(), expiresInMs: import_zod17.z.number().optional() })
 ]);
-var CheckCredentialProviderSchema = import_zod15.z.union([
-  import_zod15.z.strictObject({ name: import_zod15.z.string(), credential: CredentialSummarySchema, cached: CachedCredentialStateSchema.optional() }),
-  import_zod15.z.strictObject({ name: import_zod15.z.string(), problem: import_zod15.z.string() })
+var CheckCredentialProviderSchema = import_zod17.z.union([
+  import_zod17.z.strictObject({ name: import_zod17.z.string(), credential: CredentialSummarySchema, cached: CachedCredentialStateSchema.optional() }),
+  import_zod17.z.strictObject({ name: import_zod17.z.string(), problem: import_zod17.z.string() })
 ]);
-var CheckCredentialSchema = import_zod15.z.strictObject({
-  applies: import_zod15.z.enum(CHECK_CREDENTIAL_APPLIES),
+var CheckCredentialSchema = import_zod17.z.strictObject({
+  applies: import_zod17.z.enum(CHECK_CREDENTIAL_APPLIES),
   provider: CheckCredentialProviderSchema.optional(),
   identity: CredentialSummarySchema.optional(),
   identityCached: CachedCredentialStateSchema.optional()
 });
-var CheckClaudeVersionSchema = import_zod15.z.strictObject({
-  pinned: import_zod15.z.strictObject({ version: import_zod15.z.string(), source: import_zod15.z.enum(CLAUDE_VERSION_SOURCES), installed: import_zod15.z.boolean() }).optional(),
-  highestInstalled: import_zod15.z.string().optional(),
-  installed: import_zod15.z.readonly(import_zod15.z.array(import_zod15.z.string()))
+var CheckClaudeVersionSchema = import_zod17.z.strictObject({
+  pinned: import_zod17.z.strictObject({ version: import_zod17.z.string(), source: import_zod17.z.enum(CLAUDE_VERSION_SOURCES), installed: import_zod17.z.boolean() }).optional(),
+  highestInstalled: import_zod17.z.string().optional(),
+  installed: import_zod17.z.readonly(import_zod17.z.array(import_zod17.z.string()))
 });
-var CheckReportJsonSchema = import_zod15.z.strictObject({
-  identity: import_zod15.z.strictObject({ name: import_zod15.z.string().nullable(), source: import_zod15.z.enum(IDENTITY_DECISION_SOURCES) }),
+var CheckReportJsonSchema = import_zod17.z.strictObject({
+  identity: import_zod17.z.strictObject({ name: import_zod17.z.string().nullable(), source: import_zod17.z.enum(IDENTITY_DECISION_SOURCES) }),
   /** The pool ranking, when the launch named a pool instead of an identity. */
   pool: PoolPickReportSchema.optional(),
-  configProfile: import_zod15.z.strictObject({ name: import_zod15.z.string().nullable(), source: import_zod15.z.enum(CONFIG_PROFILE_DECISION_SOURCES) }),
-  layers: import_zod15.z.readonly(import_zod15.z.array(CheckLayerViewSchema)),
-  entries: import_zod15.z.readonly(import_zod15.z.array(CheckEntryViewSchema)),
-  projectEncodingAmbiguities: import_zod15.z.readonly(
-    import_zod15.z.array(import_zod15.z.strictObject({ fragment: import_zod15.z.string(), encoded: import_zod15.z.string(), reason: import_zod15.z.enum(ENCODING_AMBIGUITY_REASONS), detail: import_zod15.z.string() }))
+  configProfile: import_zod17.z.strictObject({ name: import_zod17.z.string().nullable(), source: import_zod17.z.enum(CONFIG_PROFILE_DECISION_SOURCES) }),
+  layers: import_zod17.z.readonly(import_zod17.z.array(CheckLayerViewSchema)),
+  entries: import_zod17.z.readonly(import_zod17.z.array(CheckEntryViewSchema)),
+  projectEncodingAmbiguities: import_zod17.z.readonly(
+    import_zod17.z.array(import_zod17.z.strictObject({ fragment: import_zod17.z.string(), encoded: import_zod17.z.string(), reason: import_zod17.z.enum(ENCODING_AMBIGUITY_REASONS), detail: import_zod17.z.string() }))
   ),
-  diagnostics: import_zod15.z.readonly(import_zod15.z.array(CheckDiagnosticSchema)),
+  diagnostics: import_zod17.z.readonly(import_zod17.z.array(CheckDiagnosticSchema)),
   ambientCredential: CheckAmbientCredentialSchema,
   keychain: CheckKeychainSchema.optional(),
-  settingsExposure: import_zod15.z.readonly(import_zod15.z.array(CheckSettingsExposureSchema)),
+  settingsExposure: import_zod17.z.readonly(import_zod17.z.array(CheckSettingsExposureSchema)),
   credential: CheckCredentialSchema,
   claudeVersion: CheckClaudeVersionSchema.optional()
 });
@@ -12709,28 +13005,28 @@ function collectResets(snapshots, nowMs) {
 }
 
 // src/usage/resetsSchema.ts
-var import_zod16 = require("zod");
-var ResetRowSchema = import_zod16.z.strictObject({
-  identity: import_zod16.z.string(),
-  provider: import_zod16.z.string(),
+var import_zod18 = require("zod");
+var ResetRowSchema = import_zod18.z.strictObject({
+  identity: import_zod18.z.string(),
+  provider: import_zod18.z.string(),
   /** What the window is: `5h`, `7d` or `extra usage` for an Anthropic account, or the provider's own measure and period (`tokens 5h`). */
-  window: import_zod16.z.string(),
+  window: import_zod18.z.string(),
   /** When the state the window comes from was observed, as an ISO instant. */
-  observedAt: import_zod16.z.iso.datetime(),
+  observedAt: import_zod18.z.iso.datetime(),
   /** When the window resets, as an ISO instant; absent when the upstream reported none. */
-  resetsAt: import_zod16.z.iso.datetime().optional(),
+  resetsAt: import_zod18.z.iso.datetime().optional(),
   /** True when the reset time has passed, so the recorded observation describes a window that no longer exists and its utilisation reads as 0. */
-  reset: import_zod16.z.boolean(),
+  reset: import_zod18.z.boolean(),
   /** The fraction used, as `effectiveWindow` reads it at the report's own clock. */
-  utilization: import_zod16.z.number().optional(),
+  utilization: import_zod18.z.number().optional(),
   /** The window's own status, for a window that has not reset yet. */
-  status: import_zod16.z.string().optional()
+  status: import_zod18.z.string().optional()
 });
-var ResetScheduleSchema = import_zod16.z.strictObject({ resets: import_zod16.z.readonly(import_zod16.z.array(ResetRowSchema)) });
+var ResetScheduleSchema = import_zod18.z.strictObject({ resets: import_zod18.z.readonly(import_zod18.z.array(ResetRowSchema)) });
 
 // src/frontdoor/controlSchemas.ts
 var import_node_path30 = __toESM(require("node:path"), 1);
-var import_zod21 = require("zod");
+var import_zod23 = require("zod");
 
 // src/doctorReport.ts
 init_claudeShim();
@@ -12931,24 +13227,24 @@ function credentialsFilePath(farmRoot) {
 }
 
 // src/codex/siwcStore.ts
-var import_zod20 = require("zod");
+var import_zod22 = require("zod");
 
 // src/codex/auth.ts
-var import_zod18 = require("zod");
-var AuthFileSchema = import_zod18.z.looseObject({
-  tokens: import_zod18.z.looseObject({
-    access_token: import_zod18.z.string().optional(),
-    refresh_token: import_zod18.z.string().optional(),
-    id_token: import_zod18.z.string().optional(),
-    account_id: import_zod18.z.string().optional()
+var import_zod20 = require("zod");
+var AuthFileSchema = import_zod20.z.looseObject({
+  tokens: import_zod20.z.looseObject({
+    access_token: import_zod20.z.string().optional(),
+    refresh_token: import_zod20.z.string().optional(),
+    id_token: import_zod20.z.string().optional(),
+    account_id: import_zod20.z.string().optional()
   }).nullish(),
-  last_refresh: import_zod18.z.string().optional()
+  last_refresh: import_zod20.z.string().optional()
 });
-var TokenGrantSchema = import_zod18.z.looseObject({
-  access_token: import_zod18.z.string().min(1).optional(),
-  refresh_token: import_zod18.z.string().min(1).optional(),
-  id_token: import_zod18.z.string().min(1).optional(),
-  account_id: import_zod18.z.string().min(1).optional()
+var TokenGrantSchema = import_zod20.z.looseObject({
+  access_token: import_zod20.z.string().min(1).optional(),
+  refresh_token: import_zod20.z.string().min(1).optional(),
+  id_token: import_zod20.z.string().min(1).optional(),
+  account_id: import_zod20.z.string().min(1).optional()
 });
 var CodexAuthError = class extends Error {
   constructor(message) {
@@ -12958,41 +13254,41 @@ var CodexAuthError = class extends Error {
 };
 
 // src/codex/siwc.ts
-var import_zod19 = require("zod");
+var import_zod21 = require("zod");
 var SIWC_RESOURCE = "https://api.openai.com/v1";
 var SIWC_RESPONSES_URL = `${SIWC_RESOURCE}/responses`;
 var SIWC_PLAN_SCOPE = "chatgpt.tokens.use.direct";
-var TokenResponseSchema = import_zod19.z.looseObject({
-  access_token: import_zod19.z.string().min(1),
-  refresh_token: import_zod19.z.string().min(1).optional(),
-  id_token: import_zod19.z.string().min(1).optional(),
-  expires_in: import_zod19.z.number().positive(),
-  scope: import_zod19.z.string().optional()
+var TokenResponseSchema = import_zod21.z.looseObject({
+  access_token: import_zod21.z.string().min(1),
+  refresh_token: import_zod21.z.string().min(1).optional(),
+  id_token: import_zod21.z.string().min(1).optional(),
+  expires_in: import_zod21.z.number().positive(),
+  scope: import_zod21.z.string().optional()
 });
-var JwtHeaderSchema = import_zod19.z.looseObject({ alg: import_zod19.z.string(), kid: import_zod19.z.string().optional() });
-var IdTokenClaimsSchema = import_zod19.z.looseObject({
-  iss: import_zod19.z.string(),
-  sub: import_zod19.z.string().min(1),
-  aud: import_zod19.z.union([import_zod19.z.string(), import_zod19.z.array(import_zod19.z.string())]),
-  exp: import_zod19.z.number(),
-  nonce: import_zod19.z.string().optional(),
-  email: import_zod19.z.string().optional()
+var JwtHeaderSchema = import_zod21.z.looseObject({ alg: import_zod21.z.string(), kid: import_zod21.z.string().optional() });
+var IdTokenClaimsSchema = import_zod21.z.looseObject({
+  iss: import_zod21.z.string(),
+  sub: import_zod21.z.string().min(1),
+  aud: import_zod21.z.union([import_zod21.z.string(), import_zod21.z.array(import_zod21.z.string())]),
+  exp: import_zod21.z.number(),
+  nonce: import_zod21.z.string().optional(),
+  email: import_zod21.z.string().optional()
 });
-var JwksSchema = import_zod19.z.object({ keys: import_zod19.z.array(import_zod19.z.looseObject({ kid: import_zod19.z.string().optional(), kty: import_zod19.z.string() })) });
+var JwksSchema = import_zod21.z.object({ keys: import_zod21.z.array(import_zod21.z.looseObject({ kid: import_zod21.z.string().optional(), kty: import_zod21.z.string() })) });
 
 // src/codex/siwcStore.ts
-var SiwcGrantSchema = import_zod20.z.strictObject({
-  clientId: import_zod20.z.string().min(1),
-  sub: import_zod20.z.string().min(1),
-  email: import_zod20.z.string().optional(),
-  idToken: import_zod20.z.string().min(1),
-  accessToken: import_zod20.z.string().min(1),
-  refreshToken: import_zod20.z.string().min(1),
-  scopes: import_zod20.z.array(import_zod20.z.string()).readonly(),
+var SiwcGrantSchema = import_zod22.z.strictObject({
+  clientId: import_zod22.z.string().min(1),
+  sub: import_zod22.z.string().min(1),
+  email: import_zod22.z.string().optional(),
+  idToken: import_zod22.z.string().min(1),
+  accessToken: import_zod22.z.string().min(1),
+  refreshToken: import_zod22.z.string().min(1),
+  scopes: import_zod22.z.array(import_zod22.z.string()).readonly(),
   /** When the access token stops working, in milliseconds since the epoch. */
-  expiresAt: import_zod20.z.number()
+  expiresAt: import_zod22.z.number()
 });
-var SiwcFileSchema = import_zod20.z.strictObject({ registeredClientId: import_zod20.z.string().min(1).optional(), grant: SiwcGrantSchema.optional() });
+var SiwcFileSchema = import_zod22.z.strictObject({ registeredClientId: import_zod22.z.string().min(1).optional(), grant: SiwcGrantSchema.optional() });
 function parseSiwcFile(raw, filePath) {
   let json;
   try {
@@ -13689,90 +13985,90 @@ function collectDoctorReport(params) {
 // src/frontdoor/controlSchemas.ts
 init_schema2();
 init_state();
-var UsageListOutputSchema = import_zod21.z.strictObject({ snapshots: import_zod21.z.readonly(import_zod21.z.array(UsageSnapshotSchema)) });
-var UsageWindowsInputSchema = import_zod21.z.strictObject({
-  identity: import_zod21.z.string().min(1),
-  provider: import_zod21.z.string().min(1).optional()
+var UsageListOutputSchema = import_zod23.z.strictObject({ snapshots: import_zod23.z.readonly(import_zod23.z.array(UsageSnapshotSchema)) });
+var UsageWindowsInputSchema = import_zod23.z.strictObject({
+  identity: import_zod23.z.string().min(1),
+  provider: import_zod23.z.string().min(1).optional()
 });
-var EffectiveWindowSchema = import_zod21.z.strictObject({
+var EffectiveWindowSchema = import_zod23.z.strictObject({
   /** True when the window's reset time has passed, so the recorded observation describes a window that no longer exists. */
-  reset: import_zod21.z.boolean(),
+  reset: import_zod23.z.boolean(),
   /** The fraction used: 0 for a reset window, otherwise what was last observed, absent when none was reported. */
-  utilization: import_zod21.z.number().optional(),
+  utilization: import_zod23.z.number().optional(),
   /** The reset instant, for a window that has not reset yet and reported one. */
-  resetsAtMs: import_zod21.z.number().optional(),
+  resetsAtMs: import_zod23.z.number().optional(),
   /** The window's own status, for a window that has not reset yet. */
-  status: import_zod21.z.string().optional()
+  status: import_zod23.z.string().optional()
 });
-var UsageWindowsOutputSchema = import_zod21.z.strictObject({
-  identity: import_zod21.z.string(),
-  provider: import_zod21.z.string(),
+var UsageWindowsOutputSchema = import_zod23.z.strictObject({
+  identity: import_zod23.z.string(),
+  provider: import_zod23.z.string(),
   /** When the rate-limit state the windows come from was observed. */
-  observedAt: import_zod21.z.iso.datetime().optional(),
+  observedAt: import_zod23.z.iso.datetime().optional(),
   fiveHour: EffectiveWindowSchema.optional(),
   sevenDay: EffectiveWindowSchema.optional()
 });
-var UsageLiveOutputSchema = import_zod21.z.strictObject({
+var UsageLiveOutputSchema = import_zod23.z.strictObject({
   /** The freshest observation the door holds, never narrowed by the read's session filter because it is the door's single latest statement of the account's quota; absent while no rate_limit_event has been filed at all. */
   latest: RcLiveRateLimitSchema.optional(),
   /** One observation per session whose stream has filed a rate_limit_event this door generation. */
-  sessions: import_zod21.z.readonly(import_zod21.z.array(RcLiveRateLimitSchema))
+  sessions: import_zod23.z.readonly(import_zod23.z.array(RcLiveRateLimitSchema))
 });
-var FrontDoorSessionStatusSchema = import_zod21.z.strictObject({
-  pid: import_zod21.z.int().positive(),
-  startedAt: import_zod21.z.number(),
-  alive: import_zod21.z.boolean()
+var FrontDoorSessionStatusSchema = import_zod23.z.strictObject({
+  pid: import_zod23.z.int().positive(),
+  startedAt: import_zod23.z.number(),
+  alive: import_zod23.z.boolean()
 });
-var HeadroomSocketTargetSchema = import_zod21.z.union([import_zod21.z.strictObject({ socketPath: import_zod21.z.string() }), import_zod21.z.strictObject({ refused: import_zod21.z.string() })]);
-var FrontDoorStatusOutputSchema = import_zod21.z.strictObject({
+var HeadroomSocketTargetSchema = import_zod23.z.union([import_zod23.z.strictObject({ socketPath: import_zod23.z.string() }), import_zod23.z.strictObject({ refused: import_zod23.z.string() })]);
+var FrontDoorStatusOutputSchema = import_zod23.z.strictObject({
   state: FrontDoorStateSchema,
-  supervisorAlive: import_zod21.z.boolean(),
-  sessions: import_zod21.z.readonly(import_zod21.z.array(FrontDoorSessionStatusSchema)),
+  supervisorAlive: import_zod23.z.boolean(),
+  sessions: import_zod23.z.readonly(import_zod23.z.array(FrontDoorSessionStatusSchema)),
   headroomSocket: HeadroomSocketTargetSchema.optional(),
-  logPath: import_zod21.z.string(),
-  logExists: import_zod21.z.boolean()
+  logPath: import_zod23.z.string(),
+  logExists: import_zod23.z.boolean()
 });
-var FrontDoorSessionsOutputSchema = import_zod21.z.strictObject({ sessions: import_zod21.z.readonly(import_zod21.z.array(FrontDoorSessionStatusSchema)) });
-var CheckRunInputSchema = import_zod21.z.strictObject({
-  path: import_zod21.z.string().min(1),
-  identity: import_zod21.z.string().min(1).optional()
+var FrontDoorSessionsOutputSchema = import_zod23.z.strictObject({ sessions: import_zod23.z.readonly(import_zod23.z.array(FrontDoorSessionStatusSchema)) });
+var CheckRunInputSchema = import_zod23.z.strictObject({
+  path: import_zod23.z.string().min(1),
+  identity: import_zod23.z.string().min(1).optional()
 }).refine((input) => import_node_path30.default.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
-var PoolPickInputSchema = import_zod21.z.strictObject({
-  pool: import_zod21.z.string().min(1),
-  path: import_zod21.z.string().min(1)
+var PoolPickInputSchema = import_zod23.z.strictObject({
+  pool: import_zod23.z.string().min(1),
+  path: import_zod23.z.string().min(1)
 }).refine((input) => import_node_path30.default.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
-var DoctorFindingSchema = import_zod21.z.strictObject({
-  section: import_zod21.z.enum(DOCTOR_SECTIONS),
-  subject: import_zod21.z.string().optional(),
-  severity: import_zod21.z.enum(DOCTOR_SEVERITIES),
-  message: import_zod21.z.string()
+var DoctorFindingSchema = import_zod23.z.strictObject({
+  section: import_zod23.z.enum(DOCTOR_SECTIONS),
+  subject: import_zod23.z.string().optional(),
+  severity: import_zod23.z.enum(DOCTOR_SEVERITIES),
+  message: import_zod23.z.string()
 });
-var DoctorRunOutputSchema = import_zod21.z.strictObject({
+var DoctorRunOutputSchema = import_zod23.z.strictObject({
   /** False exactly when any finding is a `fail`; a `warn` never fails the report on its own. */
-  ok: import_zod21.z.boolean(),
-  findings: import_zod21.z.readonly(import_zod21.z.array(DoctorFindingSchema))
+  ok: import_zod23.z.boolean(),
+  findings: import_zod23.z.readonly(import_zod23.z.array(DoctorFindingSchema))
 });
-var FrontDoorRestartOutputSchema = import_zod21.z.strictObject({
-  action: import_zod21.z.literal("restarting"),
-  previousPid: import_zod21.z.int().positive()
+var FrontDoorRestartOutputSchema = import_zod23.z.strictObject({
+  action: import_zod23.z.literal("restarting"),
+  previousPid: import_zod23.z.int().positive()
 });
-var UpdateCheckOutputSchema = import_zod21.z.strictObject({
-  current: import_zod21.z.string(),
-  latest: import_zod21.z.string(),
-  action: import_zod21.z.enum(["current", "available", "updated"])
+var UpdateCheckOutputSchema = import_zod23.z.strictObject({
+  current: import_zod23.z.string(),
+  latest: import_zod23.z.string(),
+  action: import_zod23.z.enum(["current", "available", "updated"])
 });
-var CodexSignInSchema = import_zod21.z.discriminatedUnion("state", [
-  import_zod21.z.strictObject({ state: import_zod21.z.literal("none") }),
-  import_zod21.z.strictObject({ state: import_zod21.z.literal("signed-in"), email: import_zod21.z.string().optional(), planScope: import_zod21.z.boolean(), accessTokenExpiresAt: import_zod21.z.number() }),
-  import_zod21.z.strictObject({ state: import_zod21.z.literal("unreadable"), message: import_zod21.z.string() })
+var CodexSignInSchema = import_zod23.z.discriminatedUnion("state", [
+  import_zod23.z.strictObject({ state: import_zod23.z.literal("none") }),
+  import_zod23.z.strictObject({ state: import_zod23.z.literal("signed-in"), email: import_zod23.z.string().optional(), planScope: import_zod23.z.boolean(), accessTokenExpiresAt: import_zod23.z.number() }),
+  import_zod23.z.strictObject({ state: import_zod23.z.literal("unreadable"), message: import_zod23.z.string() })
 ]);
-var CodexStatusOutputSchema = import_zod21.z.strictObject({
+var CodexStatusOutputSchema = import_zod23.z.strictObject({
   signIn: CodexSignInSchema,
-  codexProviders: import_zod21.z.readonly(import_zod21.z.array(import_zod21.z.string()))
+  codexProviders: import_zod23.z.readonly(import_zod23.z.array(import_zod23.z.string()))
 });
-var CodexLogoutOutputSchema = import_zod21.z.strictObject({
-  hadGrant: import_zod21.z.boolean(),
-  revoked: import_zod21.z.boolean()
+var CodexLogoutOutputSchema = import_zod23.z.strictObject({
+  hadGrant: import_zod23.z.boolean(),
+  revoked: import_zod23.z.boolean()
 });
 
 // src/frontdoor/codexApi.ts
@@ -13928,134 +14224,134 @@ init_identity();
 init_providersStore();
 
 // src/frontdoor/configSchemas.ts
-var import_zod22 = require("zod");
+var import_zod24 = require("zod");
 init_schema();
-var RemovalConfirmationSchema = import_zod22.z.boolean();
-var CredentialWriteSchema = (targets) => import_zod22.z.strictObject({
-  sources: import_zod22.z.array(RemoteCredentialSourceSchema).min(1).optional(),
-  target: import_zod22.z.enum(targets).optional(),
-  cache: import_zod22.z.union([import_zod22.z.literal(false), CredentialCacheSchema]).optional()
+var RemovalConfirmationSchema = import_zod24.z.boolean();
+var CredentialWriteSchema = (targets) => import_zod24.z.strictObject({
+  sources: import_zod24.z.array(RemoteCredentialSourceSchema).min(1).optional(),
+  target: import_zod24.z.enum(targets).optional(),
+  cache: import_zod24.z.union([import_zod24.z.literal(false), CredentialCacheSchema]).optional()
 });
-var CredentialSummarySchema2 = import_zod22.z.strictObject({
-  target: import_zod22.z.enum(CREDENTIAL_TARGETS),
-  sources: import_zod22.z.readonly(import_zod22.z.array(
-    import_zod22.z.discriminatedUnion("kind", [
-      import_zod22.z.strictObject({ kind: import_zod22.z.literal("env"), variable: import_zod22.z.string() }),
-      import_zod22.z.strictObject({ kind: import_zod22.z.literal("file"), path: import_zod22.z.string() }),
-      import_zod22.z.strictObject({ kind: import_zod22.z.literal("command"), program: import_zod22.z.string() }),
-      import_zod22.z.strictObject({ kind: import_zod22.z.literal("op"), reference: import_zod22.z.string() }),
-      import_zod22.z.strictObject({ kind: import_zod22.z.literal("keychain"), service: import_zod22.z.string(), account: import_zod22.z.string().optional() }),
-      import_zod22.z.strictObject({ kind: import_zod22.z.literal("literal") })
+var CredentialSummarySchema2 = import_zod24.z.strictObject({
+  target: import_zod24.z.enum(CREDENTIAL_TARGETS),
+  sources: import_zod24.z.readonly(import_zod24.z.array(
+    import_zod24.z.discriminatedUnion("kind", [
+      import_zod24.z.strictObject({ kind: import_zod24.z.literal("env"), variable: import_zod24.z.string() }),
+      import_zod24.z.strictObject({ kind: import_zod24.z.literal("file"), path: import_zod24.z.string() }),
+      import_zod24.z.strictObject({ kind: import_zod24.z.literal("command"), program: import_zod24.z.string() }),
+      import_zod24.z.strictObject({ kind: import_zod24.z.literal("op"), reference: import_zod24.z.string() }),
+      import_zod24.z.strictObject({ kind: import_zod24.z.literal("keychain"), service: import_zod24.z.string(), account: import_zod24.z.string().optional() }),
+      import_zod24.z.strictObject({ kind: import_zod24.z.literal("literal") })
     ])
   )),
   cache: CredentialCacheSchema.optional()
 });
-var mutationOutput = (kind, action) => import_zod22.z.strictObject({ action: import_zod22.z.literal(action), kind: import_zod22.z.literal(kind), name: import_zod22.z.string() });
-var storedMutationOutput = (kind, action, value) => import_zod22.z.strictObject({ action: import_zod22.z.literal(action), kind: import_zod22.z.literal(kind), name: import_zod22.z.string(), value });
-var IdentityValueSchema = import_zod22.z.strictObject({
-  name: import_zod22.z.string(),
-  defaultConfigProfile: import_zod22.z.string().optional(),
-  allowAmbientCredential: import_zod22.z.boolean(),
+var mutationOutput = (kind, action) => import_zod24.z.strictObject({ action: import_zod24.z.literal(action), kind: import_zod24.z.literal(kind), name: import_zod24.z.string() });
+var storedMutationOutput = (kind, action, value) => import_zod24.z.strictObject({ action: import_zod24.z.literal(action), kind: import_zod24.z.literal(kind), name: import_zod24.z.string(), value });
+var IdentityValueSchema = import_zod24.z.strictObject({
+  name: import_zod24.z.string(),
+  defaultConfigProfile: import_zod24.z.string().optional(),
+  allowAmbientCredential: import_zod24.z.boolean(),
   credential: CredentialSummarySchema2.optional(),
-  anchors: import_zod22.z.array(AnchorSchema).optional()
+  anchors: import_zod24.z.array(AnchorSchema).optional()
 });
 var ProfileValueSchema = ConfigProfileSchema.omit({ $schema: true });
-var ProviderValueSchema = import_zod22.z.strictObject({
-  name: import_zod22.z.string(),
-  kind: import_zod22.z.enum(PROVIDER_KINDS),
-  displayName: import_zod22.z.string(),
-  baseUrl: import_zod22.z.string().optional(),
+var ProviderValueSchema = import_zod24.z.strictObject({
+  name: import_zod24.z.string(),
+  kind: import_zod24.z.enum(PROVIDER_KINDS),
+  displayName: import_zod24.z.string(),
+  baseUrl: import_zod24.z.string().optional(),
   codex: CodexProviderConfigSchema.optional(),
   credential: CredentialSummarySchema2,
-  env: import_zod22.z.record(import_zod22.z.string(), import_zod22.z.string()).optional()
+  env: import_zod24.z.record(import_zod24.z.string(), import_zod24.z.string()).optional()
 });
-var ConfigNameInputSchema = import_zod22.z.strictObject({ name: import_zod22.z.string().min(1) });
+var ConfigNameInputSchema = import_zod24.z.strictObject({ name: import_zod24.z.string().min(1) });
 var ConfigIdentityAddOutputSchema = storedMutationOutput("identity", "created", IdentityValueSchema);
-var ConfigIdentitySetInputSchema = import_zod22.z.strictObject({
-  name: import_zod22.z.string().min(1),
-  defaultConfigProfile: import_zod22.z.union([import_zod22.z.string().min(1), import_zod22.z.literal(false)]).optional(),
-  allowAmbientCredential: import_zod22.z.boolean().optional(),
-  credential: import_zod22.z.union([import_zod22.z.literal(false), CredentialWriteSchema(CREDENTIAL_TARGETS)]).optional(),
+var ConfigIdentitySetInputSchema = import_zod24.z.strictObject({
+  name: import_zod24.z.string().min(1),
+  defaultConfigProfile: import_zod24.z.union([import_zod24.z.string().min(1), import_zod24.z.literal(false)]).optional(),
+  allowAmbientCredential: import_zod24.z.boolean().optional(),
+  credential: import_zod24.z.union([import_zod24.z.literal(false), CredentialWriteSchema(CREDENTIAL_TARGETS)]).optional(),
   /** `false` removes the anchors; a list replaces them. */
-  anchors: import_zod22.z.union([import_zod22.z.literal(false), import_zod22.z.array(AnchorSchema).min(1)]).optional()
+  anchors: import_zod24.z.union([import_zod24.z.literal(false), import_zod24.z.array(AnchorSchema).min(1)]).optional()
 });
 var ConfigIdentitySetOutputSchema = storedMutationOutput("identity", "updated", IdentityValueSchema);
-var ConfigIdentityRemoveInputSchema = import_zod22.z.strictObject({ name: import_zod22.z.string().min(1), confirm: RemovalConfirmationSchema });
+var ConfigIdentityRemoveInputSchema = import_zod24.z.strictObject({ name: import_zod24.z.string().min(1), confirm: RemovalConfirmationSchema });
 var ConfigIdentityRemoveOutputSchema = mutationOutput("identity", "removed");
 var ConfigIdentityUseOutputSchema = mutationOutput("identity", "selected");
-var ConfigProfileAddInputSchema = import_zod22.z.strictObject({
-  name: import_zod22.z.string().min(1),
-  extends: import_zod22.z.array(import_zod22.z.string().min(1)).optional(),
-  description: import_zod22.z.string().optional()
+var ConfigProfileAddInputSchema = import_zod24.z.strictObject({
+  name: import_zod24.z.string().min(1),
+  extends: import_zod24.z.array(import_zod24.z.string().min(1)).optional(),
+  description: import_zod24.z.string().optional()
 });
 var ConfigProfileAddOutputSchema = storedMutationOutput("profile", "created", ProfileValueSchema);
-var ConfigProfileSetInputSchema = import_zod22.z.strictObject({
-  name: import_zod22.z.string().min(1),
-  category: import_zod22.z.record(import_zod22.z.string(), import_zod22.z.boolean()).optional(),
-  entry: import_zod22.z.record(import_zod22.z.string(), import_zod22.z.boolean()).optional(),
-  extends: import_zod22.z.union([import_zod22.z.array(import_zod22.z.string().min(1)), import_zod22.z.literal(false)]).optional(),
-  description: import_zod22.z.union([import_zod22.z.string(), import_zod22.z.literal(false)]).optional(),
-  launch: import_zod22.z.strictObject({
-    skipPermissions: import_zod22.z.boolean().optional(),
-    remoteControl: import_zod22.z.boolean().optional(),
-    headroom: import_zod22.z.boolean().optional(),
-    trackUsage: import_zod22.z.boolean().optional(),
-    provider: import_zod22.z.union([import_zod22.z.string().min(1), import_zod22.z.literal(false)]).optional(),
-    claudeVersion: import_zod22.z.union([import_zod22.z.string().min(1), import_zod22.z.literal(false)]).optional()
+var ConfigProfileSetInputSchema = import_zod24.z.strictObject({
+  name: import_zod24.z.string().min(1),
+  category: import_zod24.z.record(import_zod24.z.string(), import_zod24.z.boolean()).optional(),
+  entry: import_zod24.z.record(import_zod24.z.string(), import_zod24.z.boolean()).optional(),
+  extends: import_zod24.z.union([import_zod24.z.array(import_zod24.z.string().min(1)), import_zod24.z.literal(false)]).optional(),
+  description: import_zod24.z.union([import_zod24.z.string(), import_zod24.z.literal(false)]).optional(),
+  launch: import_zod24.z.strictObject({
+    skipPermissions: import_zod24.z.boolean().optional(),
+    remoteControl: import_zod24.z.boolean().optional(),
+    headroom: import_zod24.z.boolean().optional(),
+    trackUsage: import_zod24.z.boolean().optional(),
+    provider: import_zod24.z.union([import_zod24.z.string().min(1), import_zod24.z.literal(false)]).optional(),
+    claudeVersion: import_zod24.z.union([import_zod24.z.string().min(1), import_zod24.z.literal(false)]).optional()
   }).optional()
 });
 var ConfigProfileSetOutputSchema = storedMutationOutput("profile", "updated", ProfileValueSchema);
-var ConfigProfileRemoveInputSchema = import_zod22.z.strictObject({ name: import_zod22.z.string().min(1), confirm: RemovalConfirmationSchema });
+var ConfigProfileRemoveInputSchema = import_zod24.z.strictObject({ name: import_zod24.z.string().min(1), confirm: RemovalConfirmationSchema });
 var ConfigProfileRemoveOutputSchema = mutationOutput("profile", "removed");
 var ConfigProfileUseOutputSchema = mutationOutput("profile", "selected");
-var PoolMembersInputSchema = import_zod22.z.array(import_zod22.z.string().min(1)).min(1);
-var ConfigPoolAddInputSchema = import_zod22.z.strictObject({
-  name: import_zod22.z.string().min(1),
+var PoolMembersInputSchema = import_zod24.z.array(import_zod24.z.string().min(1)).min(1);
+var ConfigPoolAddInputSchema = import_zod24.z.strictObject({
+  name: import_zod24.z.string().min(1),
   identities: PoolMembersInputSchema,
-  preference: import_zod22.z.enum(POOL_PREFERENCES).optional()
+  preference: import_zod24.z.enum(POOL_PREFERENCES).optional()
 });
 var ConfigPoolAddOutputSchema = storedMutationOutput("pool", "created", PoolSchema);
-var ConfigPoolSetInputSchema = import_zod22.z.strictObject({
-  name: import_zod22.z.string().min(1),
+var ConfigPoolSetInputSchema = import_zod24.z.strictObject({
+  name: import_zod24.z.string().min(1),
   identities: PoolMembersInputSchema.optional(),
-  preference: import_zod22.z.union([import_zod22.z.enum(POOL_PREFERENCES), import_zod22.z.literal(false)]).optional()
+  preference: import_zod24.z.union([import_zod24.z.enum(POOL_PREFERENCES), import_zod24.z.literal(false)]).optional()
 });
 var ConfigPoolSetOutputSchema = storedMutationOutput("pool", "updated", PoolSchema);
-var ConfigPoolRemoveInputSchema = import_zod22.z.strictObject({ name: import_zod22.z.string().min(1), confirm: RemovalConfirmationSchema });
+var ConfigPoolRemoveInputSchema = import_zod24.z.strictObject({ name: import_zod24.z.string().min(1), confirm: RemovalConfirmationSchema });
 var ConfigPoolRemoveOutputSchema = mutationOutput("pool", "removed");
 var ConfigPoolUseOutputSchema = mutationOutput("pool", "selected");
-var ConfigProviderAddInputSchema = import_zod22.z.strictObject({
-  name: import_zod22.z.string().min(1),
-  kind: import_zod22.z.enum(PROVIDER_KINDS).optional(),
-  displayName: import_zod22.z.string().min(1),
-  baseUrl: import_zod22.z.string().min(1).optional(),
+var ConfigProviderAddInputSchema = import_zod24.z.strictObject({
+  name: import_zod24.z.string().min(1),
+  kind: import_zod24.z.enum(PROVIDER_KINDS).optional(),
+  displayName: import_zod24.z.string().min(1),
+  baseUrl: import_zod24.z.string().min(1).optional(),
   credential: CredentialWriteSchema(PROVIDER_CREDENTIAL_TARGETS).required({ sources: true }),
   codex: CodexProviderConfigSchema.optional()
 });
 var ConfigProviderAddOutputSchema = storedMutationOutput("provider", "created", ProviderValueSchema);
-var ConfigProviderSetInputSchema = import_zod22.z.strictObject({
-  name: import_zod22.z.string().min(1),
-  displayName: import_zod22.z.string().min(1).optional(),
-  baseUrl: import_zod22.z.string().min(1).optional(),
+var ConfigProviderSetInputSchema = import_zod24.z.strictObject({
+  name: import_zod24.z.string().min(1),
+  displayName: import_zod24.z.string().min(1).optional(),
+  baseUrl: import_zod24.z.string().min(1).optional(),
   credential: CredentialWriteSchema(PROVIDER_CREDENTIAL_TARGETS).optional(),
   codex: CodexProviderConfigSchema.optional()
 });
 var ConfigProviderSetOutputSchema = storedMutationOutput("provider", "updated", ProviderValueSchema);
-var ConfigProviderRemoveInputSchema = import_zod22.z.strictObject({ name: import_zod22.z.string().min(1), confirm: RemovalConfirmationSchema });
+var ConfigProviderRemoveInputSchema = import_zod24.z.strictObject({ name: import_zod24.z.string().min(1), confirm: RemovalConfirmationSchema });
 var ConfigProviderRemoveOutputSchema = mutationOutput("provider", "removed");
-var ConfigRuleAddInputSchema = import_zod22.z.strictObject({
-  path: import_zod22.z.string().min(1),
-  configProfile: import_zod22.z.string().min(1).optional(),
-  identity: import_zod22.z.string().min(1).optional()
+var ConfigRuleAddInputSchema = import_zod24.z.strictObject({
+  path: import_zod24.z.string().min(1),
+  configProfile: import_zod24.z.string().min(1).optional(),
+  identity: import_zod24.z.string().min(1).optional()
 });
 var ConfigRuleAddOutputSchema = storedMutationOutput("rule", "created", DirectoryRuleSchema);
-var ConfigRuleSetInputSchema = import_zod22.z.strictObject({
-  path: import_zod22.z.string().min(1),
-  configProfile: import_zod22.z.union([import_zod22.z.string().min(1), import_zod22.z.literal(false)]).optional(),
-  identity: import_zod22.z.union([import_zod22.z.string().min(1), import_zod22.z.literal(false)]).optional()
+var ConfigRuleSetInputSchema = import_zod24.z.strictObject({
+  path: import_zod24.z.string().min(1),
+  configProfile: import_zod24.z.union([import_zod24.z.string().min(1), import_zod24.z.literal(false)]).optional(),
+  identity: import_zod24.z.union([import_zod24.z.string().min(1), import_zod24.z.literal(false)]).optional()
 });
 var ConfigRuleSetOutputSchema = storedMutationOutput("rule", "updated", DirectoryRuleSchema);
-var ConfigRuleRemoveInputSchema = import_zod22.z.strictObject({ path: import_zod22.z.string().min(1), confirm: RemovalConfirmationSchema });
+var ConfigRuleRemoveInputSchema = import_zod24.z.strictObject({ path: import_zod24.z.string().min(1), confirm: RemovalConfirmationSchema });
 var ConfigRuleRemoveOutputSchema = mutationOutput("rule", "removed");
 
 // src/frontdoor/configApi.ts
@@ -14120,7 +14416,7 @@ function profileValue(name, paths) {
 function createConfigApiRouter(deps) {
   const authed = doorApiAuth(deps.expectedToken);
   const { paths } = deps;
-  const route = (path38, summary) => authed.meta((0, import_openapi3.openapi)({ method: "POST", path: path38, summary, tags: [CONFIG_API_TAG] }));
+  const route = (path39, summary) => authed.meta((0, import_openapi3.openapi)({ method: "POST", path: path39, summary, tags: [CONFIG_API_TAG] }));
   return {
     config: {
       identity: {
@@ -14365,43 +14661,43 @@ var import_openapi4 = require("@orpc/openapi");
 var import_server3 = require("@orpc/server");
 
 // src/frontdoor/eventSchemas.ts
-var import_zod23 = require("zod");
+var import_zod25 = require("zod");
 var DOOR_EVENT_SOURCE_RC = "rc";
 var LAUNCH_EVENT_SOURCE = "launch";
 var USAGE_EVENT_SOURCE = "usage";
 var DOOR_HEALTH_EVENT_SOURCE = "door";
 var QUOTA_EXPIRING_EVENT_SOURCE = "quota-expiring";
-var DoorEventSchema = import_zod23.z.strictObject({
-  source: import_zod23.z.string().min(1),
+var DoorEventSchema = import_zod25.z.strictObject({
+  source: import_zod25.z.string().min(1),
   /** A positive integer because the backbone's counters start at one and only ever increase. */
-  sequence: import_zod23.z.number().int().positive(),
-  payload: import_zod23.z.unknown()
+  sequence: import_zod25.z.number().int().positive(),
+  payload: import_zod25.z.unknown()
 });
-var DoorEventSourceQuerySchema = import_zod23.z.strictObject({
-  sources: import_zod23.z.array(import_zod23.z.string().min(1)).min(1).optional()
+var DoorEventSourceQuerySchema = import_zod25.z.strictObject({
+  sources: import_zod25.z.array(import_zod25.z.string().min(1)).min(1).optional()
 });
-var LaunchLifecycleEventSchema = import_zod23.z.strictObject({
-  kind: import_zod23.z.enum(["registered", "pruned", "ended"]),
-  pid: import_zod23.z.number().int().positive(),
-  startedAt: import_zod23.z.number(),
-  observedAt: import_zod23.z.number()
+var LaunchLifecycleEventSchema = import_zod25.z.strictObject({
+  kind: import_zod25.z.enum(["registered", "pruned", "ended"]),
+  pid: import_zod25.z.number().int().positive(),
+  startedAt: import_zod25.z.number(),
+  observedAt: import_zod25.z.number()
 });
-var DoorHealthEventSchema = import_zod23.z.discriminatedUnion("kind", [
-  import_zod23.z.strictObject({ kind: import_zod23.z.literal("generation"), pid: import_zod23.z.number().int().positive(), providerPort: import_zod23.z.number().int().positive(), connectPort: import_zod23.z.number().int().positive(), directPort: import_zod23.z.number().int().positive(), observedAt: import_zod23.z.number() }),
-  import_zod23.z.strictObject({ kind: import_zod23.z.literal("listenerFailed"), pid: import_zod23.z.number().int().positive(), listener: import_zod23.z.enum(["provider", "connect", "direct"]), message: import_zod23.z.string(), observedAt: import_zod23.z.number() }),
-  import_zod23.z.strictObject({ kind: import_zod23.z.literal("binaryTurnover"), pid: import_zod23.z.number().int().positive(), observedAt: import_zod23.z.number() }),
-  import_zod23.z.strictObject({ kind: import_zod23.z.literal("idleShutdown"), pid: import_zod23.z.number().int().positive(), observedAt: import_zod23.z.number() }),
-  import_zod23.z.strictObject({ kind: import_zod23.z.literal("superseded"), pid: import_zod23.z.number().int().positive(), ownerPid: import_zod23.z.number().int().positive(), observedAt: import_zod23.z.number() }),
-  import_zod23.z.strictObject({ kind: import_zod23.z.literal("drained"), pid: import_zod23.z.number().int().positive(), observedAt: import_zod23.z.number() })
+var DoorHealthEventSchema = import_zod25.z.discriminatedUnion("kind", [
+  import_zod25.z.strictObject({ kind: import_zod25.z.literal("generation"), pid: import_zod25.z.number().int().positive(), providerPort: import_zod25.z.number().int().positive(), connectPort: import_zod25.z.number().int().positive(), directPort: import_zod25.z.number().int().positive(), observedAt: import_zod25.z.number() }),
+  import_zod25.z.strictObject({ kind: import_zod25.z.literal("listenerFailed"), pid: import_zod25.z.number().int().positive(), listener: import_zod25.z.enum(["provider", "connect", "direct"]), message: import_zod25.z.string(), observedAt: import_zod25.z.number() }),
+  import_zod25.z.strictObject({ kind: import_zod25.z.literal("binaryTurnover"), pid: import_zod25.z.number().int().positive(), observedAt: import_zod25.z.number() }),
+  import_zod25.z.strictObject({ kind: import_zod25.z.literal("idleShutdown"), pid: import_zod25.z.number().int().positive(), observedAt: import_zod25.z.number() }),
+  import_zod25.z.strictObject({ kind: import_zod25.z.literal("superseded"), pid: import_zod25.z.number().int().positive(), ownerPid: import_zod25.z.number().int().positive(), observedAt: import_zod25.z.number() }),
+  import_zod25.z.strictObject({ kind: import_zod25.z.literal("drained"), pid: import_zod25.z.number().int().positive(), observedAt: import_zod25.z.number() })
 ]);
-var QuotaExpiringEventSchema = import_zod23.z.strictObject({
-  identity: import_zod23.z.string().min(1),
-  provider: import_zod23.z.string().min(1),
-  window: import_zod23.z.enum(["fiveHour", "sevenDay"]),
+var QuotaExpiringEventSchema = import_zod25.z.strictObject({
+  identity: import_zod25.z.string().min(1),
+  provider: import_zod25.z.string().min(1),
+  window: import_zod25.z.enum(["fiveHour", "sevenDay"]),
   /** The fraction of the window already used when it was seen expiring, always below one because a fully used window has nothing left to spend. */
-  utilization: import_zod23.z.number().min(0).max(1),
-  resetsAt: import_zod23.z.iso.datetime(),
-  observedAt: import_zod23.z.number()
+  utilization: import_zod25.z.number().min(0).max(1),
+  resetsAt: import_zod25.z.iso.datetime(),
+  observedAt: import_zod25.z.number()
 });
 
 // src/frontdoor/eventsApi.ts
@@ -14485,51 +14781,51 @@ init_cliError();
 
 // src/frontdoor/launchSchemas.ts
 var import_node_path31 = __toESM(require("node:path"), 1);
-var import_zod24 = require("zod");
+var import_zod26 = require("zod");
 init_claudeVersion();
 init_identity();
-var LaunchResolveInputSchema = import_zod24.z.strictObject({
-  path: import_zod24.z.string().min(1),
+var LaunchResolveInputSchema = import_zod26.z.strictObject({
+  path: import_zod26.z.string().min(1),
   /** `@name`, launch flags, then the arguments for `claude`; empty for a bare launch. */
-  argv: import_zod24.z.readonly(import_zod24.z.array(import_zod24.z.string())).optional(),
+  argv: import_zod26.z.readonly(import_zod26.z.array(import_zod26.z.string())).optional(),
   /** The launch's inherited environment. Absent means an empty one: the door's own environment is never a substitute for the caller's, so a caller that wants `AGENT_SHIM_*` switches or a `CLAUDE_CONFIG_DIR` considered names them here. Values are read, never reported. */
-  env: import_zod24.z.record(import_zod24.z.string(), import_zod24.z.string()).optional()
+  env: import_zod26.z.record(import_zod26.z.string(), import_zod26.z.string()).optional()
 }).refine((input) => import_node_path31.default.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
-var LaunchPoolDecisionSchema = import_zod24.z.strictObject({
-  name: import_zod24.z.string(),
-  reasons: import_zod24.z.readonly(import_zod24.z.array(import_zod24.z.string())),
-  movedOff: import_zod24.z.strictObject({ identity: import_zod24.z.string(), reason: import_zod24.z.string() }).optional()
+var LaunchPoolDecisionSchema = import_zod26.z.strictObject({
+  name: import_zod26.z.string(),
+  reasons: import_zod26.z.readonly(import_zod26.z.array(import_zod26.z.string())),
+  movedOff: import_zod26.z.strictObject({ identity: import_zod26.z.string(), reason: import_zod26.z.string() }).optional()
 });
-var LaunchDecisionSchema = import_zod24.z.strictObject({
-  identity: import_zod24.z.string().optional(),
-  identitySource: import_zod24.z.enum(IDENTITY_DECISION_SOURCES),
+var LaunchDecisionSchema = import_zod26.z.strictObject({
+  identity: import_zod26.z.string().optional(),
+  identitySource: import_zod26.z.enum(IDENTITY_DECISION_SOURCES),
   pool: LaunchPoolDecisionSchema.optional(),
-  configDirEscapeHatch: import_zod24.z.boolean(),
-  configDir: import_zod24.z.string().optional(),
-  configProfile: import_zod24.z.string().optional(),
-  configProfileSource: import_zod24.z.enum(CONFIG_PROFILE_DECISION_SOURCES),
-  provider: import_zod24.z.string().optional()
+  configDirEscapeHatch: import_zod26.z.boolean(),
+  configDir: import_zod26.z.string().optional(),
+  configProfile: import_zod26.z.string().optional(),
+  configProfileSource: import_zod26.z.enum(CONFIG_PROFILE_DECISION_SOURCES),
+  provider: import_zod26.z.string().optional()
 });
-var LaunchFlagsSchema = import_zod24.z.strictObject({
-  skipPermissions: import_zod24.z.boolean(),
-  remoteControl: import_zod24.z.boolean(),
-  headroom: import_zod24.z.boolean(),
-  trackUsage: import_zod24.z.boolean()
+var LaunchFlagsSchema = import_zod26.z.strictObject({
+  skipPermissions: import_zod26.z.boolean(),
+  remoteControl: import_zod26.z.boolean(),
+  headroom: import_zod26.z.boolean(),
+  trackUsage: import_zod26.z.boolean()
 });
-var LaunchResolveOutputSchema = import_zod24.z.strictObject({
+var LaunchResolveOutputSchema = import_zod26.z.strictObject({
   decision: LaunchDecisionSchema,
   flags: LaunchFlagsSchema,
-  claudeVersion: import_zod24.z.strictObject({ version: import_zod24.z.string(), source: import_zod24.z.enum(CLAUDE_VERSION_SOURCES) }).optional(),
+  claudeVersion: import_zod26.z.strictObject({ version: import_zod26.z.string(), source: import_zod26.z.enum(CLAUDE_VERSION_SOURCES) }).optional(),
   /** The real `claude` binary the launch would spawn, on the door's host. */
-  bin: import_zod24.z.string(),
+  bin: import_zod26.z.string(),
   /** The arguments the launch would pass it: the tool's own flags, then `CLAUDE_EXTRA_FLAGS`, then the caller's own. */
-  args: import_zod24.z.readonly(import_zod24.z.array(import_zod24.z.string())),
+  args: import_zod26.z.readonly(import_zod26.z.array(import_zod26.z.string())),
   /** The credential the launch would authenticate with, by target and source kinds. Absent when none applies. */
-  credential: import_zod24.z.strictObject({ subject: import_zod24.z.enum(["provider", "identity"]), name: import_zod24.z.string(), summary: CredentialSummarySchema }).optional(),
-  routing: import_zod24.z.strictObject({ frontDoor: import_zod24.z.boolean(), headroom: import_zod24.z.boolean() }),
+  credential: import_zod26.z.strictObject({ subject: import_zod26.z.enum(["provider", "identity"]), name: import_zod26.z.string(), summary: CredentialSummarySchema }).optional(),
+  routing: import_zod26.z.strictObject({ frontDoor: import_zod26.z.boolean(), headroom: import_zod26.z.boolean() }),
   /** The names of the environment variables the launch would set or unset, sorted. Values are not reported. */
-  environment: import_zod24.z.readonly(import_zod24.z.array(import_zod24.z.string())),
-  warnings: import_zod24.z.readonly(import_zod24.z.array(import_zod24.z.string()))
+  environment: import_zod26.z.readonly(import_zod26.z.array(import_zod26.z.string())),
+  warnings: import_zod26.z.readonly(import_zod26.z.array(import_zod26.z.string()))
 });
 
 // src/frontdoor/launchApi.ts
@@ -14562,6 +14858,71 @@ function createLaunchApiRouter(deps) {
   };
 }
 
+// src/frontdoor/agentTreesApi.ts
+var import_client6 = require("@orpc/client");
+var import_openapi7 = require("@orpc/openapi");
+var import_zod27 = require("zod");
+init_cliError();
+var AgentTreesListInputSchema = import_zod27.z.strictObject({
+  /** Only this identity's sessions. */
+  identity: import_zod27.z.string().optional(),
+  /** Include sessions that spawned no agent and ran no workflow. */
+  all: import_zod27.z.boolean().optional()
+});
+var AgentTreesListOutputSchema = import_zod27.z.array(SessionSummarySchema);
+var AgentTreesShowInputSchema = import_zod27.z.strictObject({
+  /** A session id, or an unambiguous prefix of one. */
+  session: import_zod27.z.string().min(1),
+  /** Look only in this identity. */
+  identity: import_zod27.z.string().optional()
+});
+var AgentTreesShowOutputSchema = import_zod27.z.strictObject({ identities: import_zod27.z.array(import_zod27.z.string()), ...MergedAgentTreeSchema.shape });
+function asBadRequest(error) {
+  if (error instanceof CliError) {
+    throw new import_client6.ORPCError("BAD_REQUEST", { message: error.message });
+  }
+  throw error;
+}
+function createAgentTreesApiRouter(deps) {
+  const authed = doorApiAuth(deps.expectedToken);
+  return {
+    agentTrees: {
+      list: authed.meta(
+        (0, import_openapi7.openapi)({
+          method: "POST",
+          path: "/rest/agent-trees/list",
+          summary: "List the sessions that spawned agents or ran workflows, newest transcript first",
+          tags: [SESSION_HISTORY_TAG],
+          // A POST because the filters are a body, but the answer changes nothing.
+          spec: (current) => ({ ...current, [READ_ONLY_OPERATION_EXTENSION]: true })
+        })
+      ).input(AgentTreesListInputSchema).output(AgentTreesListOutputSchema).handler(({ input }) => {
+        try {
+          return deps.sessionList(input).map((session) => ({ ...session, identities: [...session.identities] }));
+        } catch (error) {
+          return asBadRequest(error);
+        }
+      }),
+      show: authed.meta(
+        (0, import_openapi7.openapi)({
+          method: "POST",
+          path: "/rest/agent-trees/show",
+          summary: "Show one session's agent tree, task list and workflow runs, with the live Remote Control tasks merged in",
+          tags: [SESSION_HISTORY_TAG],
+          spec: (current) => ({ ...current, [READ_ONLY_OPERATION_EXTENSION]: true })
+        })
+      ).input(AgentTreesShowInputSchema).output(AgentTreesShowOutputSchema).handler(({ input }) => {
+        try {
+          const view = deps.sessionShow(input.session, input.identity);
+          return { identities: [...view.identities], ...mergeLiveTasks(view.tree, deps.liveTasks()) };
+        } catch (error) {
+          return asBadRequest(error);
+        }
+      })
+    }
+  };
+}
+
 // src/frontdoor/controlApi.ts
 var USAGE_API_TAG = "usage";
 var FRONTDOOR_API_TAG2 = "frontdoor";
@@ -14572,12 +14933,12 @@ function createControlApiRouter(deps) {
   const authed = doorApiAuth(deps.expectedToken);
   return {
     usage: {
-      list: authed.meta((0, import_openapi7.openapi)({ method: "GET", path: "/rest/usage/snapshots", summary: "List every identity's usage snapshot", tags: [USAGE_API_TAG] })).output(UsageListOutputSchema).handler(() => ({ snapshots: deps.usageSnapshots() })),
-      resets: authed.meta((0, import_openapi7.openapi)({ method: "GET", path: "/rest/usage/resets", summary: "List every recorded quota window with when it resets", tags: [USAGE_API_TAG] })).output(ResetScheduleSchema).handler(() => collectResets(deps.usageSnapshots(), deps.now())),
-      effectiveWindow: authed.meta((0, import_openapi7.openapi)({ method: "GET", path: "/rest/usage/windows", summary: "Read one identity's effective quota windows", tags: [USAGE_API_TAG] })).input(UsageWindowsInputSchema).output(UsageWindowsOutputSchema).handler(({ input }) => {
+      list: authed.meta((0, import_openapi8.openapi)({ method: "GET", path: "/rest/usage/snapshots", summary: "List every identity's usage snapshot", tags: [USAGE_API_TAG] })).output(UsageListOutputSchema).handler(() => ({ snapshots: deps.usageSnapshots() })),
+      resets: authed.meta((0, import_openapi8.openapi)({ method: "GET", path: "/rest/usage/resets", summary: "List every recorded quota window with when it resets", tags: [USAGE_API_TAG] })).output(ResetScheduleSchema).handler(() => collectResets(deps.usageSnapshots(), deps.now())),
+      effectiveWindow: authed.meta((0, import_openapi8.openapi)({ method: "GET", path: "/rest/usage/windows", summary: "Read one identity's effective quota windows", tags: [USAGE_API_TAG] })).input(UsageWindowsInputSchema).output(UsageWindowsOutputSchema).handler(({ input }) => {
         const snapshot = deps.usageSnapshotOf(input.identity);
         if (snapshot === void 0) {
-          throw new import_client6.ORPCError("NOT_FOUND", { message: `identity ${input.identity} has no usage snapshot yet, so no quota window has been observed for it` });
+          throw new import_client7.ORPCError("NOT_FOUND", { message: `identity ${input.identity} has no usage snapshot yet, so no quota window has been observed for it` });
         }
         const provider = input.provider ?? ANTHROPIC_PROVIDER;
         const rateLimit = snapshot.providers[provider]?.rateLimit;
@@ -14591,34 +14952,34 @@ function createControlApiRouter(deps) {
           ...unified?.sevenDay === void 0 ? {} : { sevenDay: effectiveWindow(unified.sevenDay, now) }
         };
       }),
-      live: authed.meta((0, import_openapi7.openapi)({ method: "GET", path: "/rest/usage/live", summary: "Read the live rate-limit observations the event backbone files", tags: [USAGE_API_TAG] })).input(RcSessionQuerySchema).output(UsageLiveOutputSchema).handler(({ input }) => {
+      live: authed.meta((0, import_openapi8.openapi)({ method: "GET", path: "/rest/usage/live", summary: "Read the live rate-limit observations the event backbone files", tags: [USAGE_API_TAG] })).input(RcSessionQuerySchema).output(UsageLiveOutputSchema).handler(({ input }) => {
         const sessions = deps.liveRateLimits(input.session);
         if (input.session !== void 0 && sessions.length === 0) {
           if (deps.list().some((session) => session.id === input.session)) {
-            throw new import_client6.ORPCError("NOT_FOUND", { message: `session ${input.session} has filed no rate_limit_event on its stream yet: the worker emits one only once a turn has completed, so retry after this session's next turn` });
+            throw new import_client7.ORPCError("NOT_FOUND", { message: `session ${input.session} has filed no rate_limit_event on its stream yet: the worker emits one only once a turn has completed, so retry after this session's next turn` });
           }
-          throw new import_client6.ORPCError("NOT_FOUND", { message: rcSessionNotObservedMessage(input.session) });
+          throw new import_client7.ORPCError("NOT_FOUND", { message: rcSessionNotObservedMessage(input.session) });
         }
         return { latest: deps.latestRateLimit(), sessions };
       })
     },
     frontdoor: {
-      status: authed.meta((0, import_openapi7.openapi)({ method: "GET", path: "/rest/frontdoor/status", summary: "Read the front door's status", tags: [FRONTDOOR_API_TAG2] })).output(FrontDoorStatusOutputSchema).handler(() => deps.frontDoorStatus()),
-      sessions: authed.meta((0, import_openapi7.openapi)({ method: "GET", path: "/rest/frontdoor/sessions", summary: "Read the front door's session registry", tags: [FRONTDOOR_API_TAG2] })).output(FrontDoorSessionsOutputSchema).handler(() => ({ sessions: deps.frontDoorStatus().sessions }))
+      status: authed.meta((0, import_openapi8.openapi)({ method: "GET", path: "/rest/frontdoor/status", summary: "Read the front door's status", tags: [FRONTDOOR_API_TAG2] })).output(FrontDoorStatusOutputSchema).handler(() => deps.frontDoorStatus()),
+      sessions: authed.meta((0, import_openapi8.openapi)({ method: "GET", path: "/rest/frontdoor/sessions", summary: "Read the front door's session registry", tags: [FRONTDOOR_API_TAG2] })).output(FrontDoorSessionsOutputSchema).handler(() => ({ sessions: deps.frontDoorStatus().sessions }))
     },
     check: {
       // The report's own JSON shape is the contract (the same one `check --json` prints and `checkReportSchema.ts` defines), so the procedure returns exactly that conversion.
-      run: authed.meta((0, import_openapi7.openapi)({ method: "GET", path: "/rest/check", summary: "Run the check report for one directory", tags: [CHECK_API_TAG] })).input(CheckRunInputSchema).output(CheckReportJsonSchema).handler(({ input }) => checkReportToJson(deps.checkReport(input.path, input.identity)))
+      run: authed.meta((0, import_openapi8.openapi)({ method: "GET", path: "/rest/check", summary: "Run the check report for one directory", tags: [CHECK_API_TAG] })).input(CheckRunInputSchema).output(CheckReportJsonSchema).handler(({ input }) => checkReportToJson(deps.checkReport(input.path, input.identity)))
     },
     doctor: {
-      run: authed.meta((0, import_openapi7.openapi)({ method: "GET", path: "/rest/doctor", summary: "Run the doctor report", tags: [DOCTOR_API_TAG] })).output(DoctorRunOutputSchema).handler(() => deps.doctorReport())
+      run: authed.meta((0, import_openapi8.openapi)({ method: "GET", path: "/rest/doctor", summary: "Run the doctor report", tags: [DOCTOR_API_TAG] })).output(DoctorRunOutputSchema).handler(() => deps.doctorReport())
     },
     pool: {
-      pick: authed.meta((0, import_openapi7.openapi)({ method: "GET", path: "/rest/pool/pick", summary: "Rank one pool exactly as a launch from a directory would right now", tags: [POOL_API_TAG] })).input(PoolPickInputSchema).output(PoolPickReportSchema).handler(({ input }) => {
+      pick: authed.meta((0, import_openapi8.openapi)({ method: "GET", path: "/rest/pool/pick", summary: "Rank one pool exactly as a launch from a directory would right now", tags: [POOL_API_TAG] })).input(PoolPickInputSchema).output(PoolPickReportSchema).handler(({ input }) => {
         const report = deps.poolPick(input.pool, input.path);
         if (report === void 0) {
           const live = deps.poolNames();
-          throw new import_client6.ORPCError("NOT_FOUND", {
+          throw new import_client7.ORPCError("NOT_FOUND", {
             message: live.length === 0 ? `no pools are configured, so none is named ${input.pool}` : `no pool is named ${input.pool}; the live pools are ${live.map((name) => `"${name}"`).join(", ")}`
           });
         }
@@ -14630,13 +14991,13 @@ function createControlApiRouter(deps) {
 function createDoorApiRouter(deps) {
   const control = createControlApiRouter(deps);
   const lifecycle = createLifecycleApiRouter(deps);
-  return { ...createRcApiRouter(deps), ...control, ...lifecycle, ...createConfigApiRouter(deps), ...createCodexApiRouter(deps), ...createLaunchApiRouter(deps), ...createEventsApiRouter(deps), frontdoor: { ...control.frontdoor, ...lifecycle.frontdoor } };
+  return { ...createRcApiRouter(deps), ...control, ...lifecycle, ...createConfigApiRouter(deps), ...createCodexApiRouter(deps), ...createLaunchApiRouter(deps), ...createAgentTreesApiRouter(deps), ...createEventsApiRouter(deps), frontdoor: { ...control.frontdoor, ...lifecycle.frontdoor } };
 }
 function createDoorApiNodeHandler(deps) {
   return doorApiNodeHandlerOf(createDoorApiRouter(deps), deps.expectedToken);
 }
 function frontDoorApiClient(port, ca, token) {
-  return (0, import_client6.createORPCClient)(frontDoorApiLink(port, ca, token));
+  return (0, import_client7.createORPCClient)(frontDoorApiLink(port, ca, token));
 }
 
 // src/frontdoor/doorClient.ts
@@ -14961,15 +15322,15 @@ function createQuotaExpiringPublisher(hub, deps) {
 
 // src/frontdoor/rcLiveUsage.ts
 var RC_RATE_LIMIT_EVENT_TYPE = "rate_limit_event";
-function isRecord5(value) {
+function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function rcRateLimitInfoOf(event) {
   const payload = event.envelope.payload;
-  if (!isRecord5(payload) || payload.type !== RC_RATE_LIMIT_EVENT_TYPE) {
+  if (!isRecord6(payload) || payload.type !== RC_RATE_LIMIT_EVENT_TYPE) {
     return void 0;
   }
-  if (!isRecord5(payload.rate_limit_info)) {
+  if (!isRecord6(payload.rate_limit_info)) {
     return void 0;
   }
   const parsed = RcRateLimitInfoSchema.safeParse(payload.rate_limit_info);
@@ -15057,7 +15418,7 @@ function createSseParser() {
     }
   };
 }
-function isRecord6(value) {
+function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function sequenceNumOf(value) {
@@ -15079,7 +15440,7 @@ function parseRcStreamEnvelope(parsed) {
   } catch {
     return void 0;
   }
-  if (!isRecord6(data)) {
+  if (!isRecord7(data)) {
     return void 0;
   }
   const eventType = data.event_type;
@@ -15320,7 +15681,7 @@ init_capability();
 // src/frontdoor/rcSelfHostEndpoints.ts
 var RC_SOURCE_WORKER = "worker";
 var RC_SOURCE_CLIENT = "client";
-function isRecord7(value) {
+function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseJsonObject2(body) {
@@ -15330,7 +15691,7 @@ function parseJsonObject2(body) {
   } catch {
     return void 0;
   }
-  return isRecord7(parsed) ? parsed : void 0;
+  return isRecord8(parsed) ? parsed : void 0;
 }
 function nonEmptyString2(record, field) {
   const value = record === void 0 ? void 0 : record[field];
@@ -15404,7 +15765,7 @@ async function serveRcClientChannels(ctx, tail, method, maxBatchEvents) {
     }
     const results = [];
     for (const event of events) {
-      if (!isRecord7(event) || !isRecord7(event.payload)) {
+      if (!isRecord8(event) || !isRecord8(event.payload)) {
         await ctx.answerJson(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "every event in a teleport write is an object carrying one payload object" } });
         return true;
       }
@@ -15504,7 +15865,7 @@ async function serveRcCompatSessions(ctx, pathname, compatPath) {
 // src/frontdoor/rcSelfHostConversations.ts
 var RC_CONVERSATIONS_PATH_PREFIX = "/v1/code/conversations";
 var RC_CONVERSATION_ID_PREFIX = "conv_";
-function isRecord8(value) {
+function isRecord9(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseJsonObject3(body) {
@@ -15514,7 +15875,7 @@ function parseJsonObject3(body) {
   } catch {
     return void 0;
   }
-  return isRecord8(parsed) ? parsed : void 0;
+  return isRecord9(parsed) ? parsed : void 0;
 }
 function nonEmptyString3(record, field) {
   const value = record === void 0 ? void 0 : record[field];
@@ -15568,7 +15929,7 @@ async function serveRcConversations(ctx, pathname, method) {
     }
     const results = [];
     for (const event of events) {
-      if (!isRecord8(event) || !isRecord8(event.payload)) {
+      if (!isRecord9(event) || !isRecord9(event.payload)) {
         await ctx.answerJson(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "every event in a write is an object carrying one payload object" } });
         return;
       }
@@ -15600,7 +15961,7 @@ var RC_SELF_HOST_SCOPE_LIST = ["user:profile", "user:inference", "user:sessions:
 var RC_SELF_HOST_OAUTH_TOKEN_TTL_SECONDS = 3600;
 var MS_PER_SECOND5 = 1e3;
 var HTTP_SERVICE_UNAVAILABLE = 503;
-function isRecord9(value) {
+function isRecord10(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseJsonObject4(body) {
@@ -15610,7 +15971,7 @@ function parseJsonObject4(body) {
   } catch {
     return void 0;
   }
-  return isRecord9(parsed) ? parsed : void 0;
+  return isRecord10(parsed) ? parsed : void 0;
 }
 function growthBookFeatures() {
   return {
@@ -15964,7 +16325,7 @@ var RC_SELF_HOST_WORKER_EPOCH = 1;
 var RC_STREAM_EVENT_NAME2 = "client_event";
 var CONFLICT_REASON_HEADER2 = "x-ccr-conflict-reason";
 var CONFLICT_REASON_EPOCH_STALE = "epoch_stale";
-function isRecord10(value) {
+function isRecord11(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isWebSearchRefusal(value) {
@@ -16048,7 +16409,7 @@ function parseJsonObject5(body) {
   } catch {
     return void 0;
   }
-  return isRecord10(parsed) ? parsed : void 0;
+  return isRecord11(parsed) ? parsed : void 0;
 }
 function mintWorkerJwt(randomToken, issuedAt) {
   const encode = (value) => Buffer.from(JSON.stringify(value), "utf8").toString("base64url");
@@ -16308,7 +16669,7 @@ data: ${JSON.stringify(envelope)}
         if (status !== void 0) {
           session.workerStatus = status;
         }
-        if (isRecord10(body?.external_metadata)) {
+        if (isRecord11(body?.external_metadata)) {
           session.externalMetadata = body.external_metadata;
         }
         await answerJson2(response, HTTP_STATUS.ok, {});
@@ -16338,7 +16699,7 @@ data: ${JSON.stringify(envelope)}
         }
         const results = [];
         for (const event of events) {
-          if (!isRecord10(event) || !isRecord10(event.payload)) {
+          if (!isRecord11(event) || !isRecord11(event.payload)) {
             await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "every event in a batch is an object carrying one payload object" } });
             return;
           }
@@ -16371,7 +16732,7 @@ data: ${JSON.stringify(envelope)}
           return;
         }
         for (const event of events) {
-          if (isRecord10(event)) {
+          if (isRecord11(event)) {
             session.internalEvents.push({ eventId: deps.newUuid(), body: event });
           }
         }
@@ -16467,7 +16828,7 @@ data: ${JSON.stringify(envelope)}
       }
       const results = [];
       for (const event of events) {
-        if (!isRecord10(event) || !isRecord10(event.payload)) {
+        if (!isRecord11(event) || !isRecord11(event.payload)) {
           await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "every event in a write is an object carrying one payload object" } });
           return;
         }
@@ -16604,7 +16965,7 @@ var RC_SELF_HOST_RECORD_DIR = "rc-selfhost";
 var RC_SELF_HOST_RECORD_FILE = "credential.json";
 var SELF_HOST_EMAIL = "selfhost@agent-shim.invalid";
 var SELF_HOST_SUBSCRIPTION_TYPE = "max";
-function isRecord11(value) {
+function isRecord12(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function readJsonObject(fs12, file) {
@@ -16618,7 +16979,7 @@ function readJsonObject(fs12, file) {
   } catch {
     return void 0;
   }
-  return isRecord11(parsed) ? parsed : void 0;
+  return isRecord12(parsed) ? parsed : void 0;
 }
 function readRcSelfHostRecord(fs12, frontdoorDir) {
   const parsed = readJsonObject(fs12, import_node_path32.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
@@ -16642,7 +17003,7 @@ function mintRcSelfHostCredential(deps) {
   const recordFile = import_node_path32.default.join(recordDir, RC_SELF_HOST_RECORD_FILE);
   const previousRecord = readRcSelfHostRecord(deps.fs, deps.frontdoorDir);
   const existingCredentials = readJsonObject(deps.fs, credentialsFile);
-  const existingOauth = isRecord11(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
+  const existingOauth = isRecord12(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
   const existingToken = typeof existingOauth?.accessToken === "string" && existingOauth.accessToken !== "" ? existingOauth.accessToken : void 0;
   const existingIsOwn = existingToken !== void 0 && previousRecord?.accessToken === existingToken;
   if (existingToken !== void 0 && !existingIsOwn && !deps.force) {
@@ -16659,7 +17020,7 @@ function mintRcSelfHostCredential(deps) {
   deps.fs.writeFilePrivate(credentialsFile, `${JSON.stringify({ ...existingCredentials, claudeAiOauth: { accessToken, refreshToken, expiresAt: null, scopes: [...RC_SELF_HOST_SCOPE_LIST], subscriptionType: SELF_HOST_SUBSCRIPTION_TYPE, rateLimitTier: null } }, null, 2)}
 `);
   const claudeJson = readJsonObject(deps.fs, claudeJsonFile) ?? {};
-  const existingBlock = (value) => isRecord11(value) ? value : {};
+  const existingBlock = (value) => isRecord12(value) ? value : {};
   deps.fs.writeFilePrivate(claudeJsonFile, `${JSON.stringify({
     ...claudeJson,
     oauthAccount: {
@@ -16698,90 +17059,7 @@ init_poolPick();
 
 // src/agents/read.ts
 var import_node_path33 = __toESM(require("node:path"), 1);
-var import_zod26 = require("zod");
-
-// src/agents/schema.ts
-var import_zod25 = require("zod");
-var AgentMetaSchema = import_zod25.z.looseObject({
-  agentType: import_zod25.z.string(),
-  isFork: import_zod25.z.boolean().optional(),
-  description: import_zod25.z.string().optional(),
-  name: import_zod25.z.string().optional(),
-  toolUseId: import_zod25.z.string().optional(),
-  spawnDepth: import_zod25.z.number().int().nonnegative().optional(),
-  parentAgentId: import_zod25.z.string().optional(),
-  model: import_zod25.z.string().optional(),
-  requestShape: import_zod25.z.string().optional(),
-  requestNonInteractive: import_zod25.z.boolean().optional(),
-  workflowPhase: import_zod25.z.string().optional(),
-  taskKind: import_zod25.z.string().optional(),
-  teamName: import_zod25.z.string().optional(),
-  worktreePath: import_zod25.z.string().optional(),
-  worktreeBranch: import_zod25.z.string().optional(),
-  stoppedByUser: import_zod25.z.boolean().optional()
-});
-var AgentKindSchema = import_zod25.z.enum(["subagent", "fork", "workflow-agent", "teammate"]);
-var AgentNodeSchema = import_zod25.z.lazy(
-  () => import_zod25.z.strictObject({
-    id: import_zod25.z.string(),
-    kind: AgentKindSchema,
-    agentType: import_zod25.z.string(),
-    description: import_zod25.z.string().optional(),
-    name: import_zod25.z.string().optional(),
-    toolUseId: import_zod25.z.string().optional(),
-    spawnDepth: import_zod25.z.number().int().nonnegative().optional(),
-    model: import_zod25.z.string().optional(),
-    background: import_zod25.z.boolean().optional(),
-    workflowRunId: import_zod25.z.string().optional(),
-    workflowPhase: import_zod25.z.string().optional(),
-    teamName: import_zod25.z.string().optional(),
-    stoppedByUser: import_zod25.z.boolean().optional(),
-    transcript: import_zod25.z.string(),
-    children: import_zod25.z.array(AgentNodeSchema)
-  })
-);
-var TaskItemSchema = import_zod25.z.strictObject({
-  id: import_zod25.z.string(),
-  subject: import_zod25.z.string(),
-  description: import_zod25.z.string().optional(),
-  status: import_zod25.z.string(),
-  /** What a spinner shows while the task runs. */
-  activeForm: import_zod25.z.string().optional(),
-  /** The teammate or agent name the task is assigned to, as Agent Teams writes it. */
-  owner: import_zod25.z.string().optional(),
-  /** Free-form data the harness attaches to a task, kept as written. */
-  metadata: import_zod25.z.record(import_zod25.z.string(), import_zod25.z.unknown()).optional(),
-  blocks: import_zod25.z.array(import_zod25.z.string()),
-  blockedBy: import_zod25.z.array(import_zod25.z.string()),
-  /** The id of the shared task list this task belongs to (a team's name, or a custom list id), absent for the session's own list. */
-  taskList: import_zod25.z.string().optional()
-});
-var WorkflowRunSchema = import_zod25.z.strictObject({
-  runId: import_zod25.z.string(),
-  workflowName: import_zod25.z.string().optional(),
-  status: import_zod25.z.string().optional(),
-  startTime: import_zod25.z.number().optional(),
-  phases: import_zod25.z.array(import_zod25.z.string()),
-  summary: import_zod25.z.string().optional()
-});
-var AgentTreeProblemSchema = import_zod25.z.strictObject({
-  /** Relative to the identity's configuration directory. */
-  path: import_zod25.z.string(),
-  reason: import_zod25.z.string()
-});
-var SessionAgentTreeSchema = import_zod25.z.strictObject({
-  project: import_zod25.z.string(),
-  sessionId: import_zod25.z.string(),
-  /** True for a session directory a resume superseded (`<session-id>.superseded-<epoch-ms>`). */
-  superseded: import_zod25.z.boolean(),
-  /** The agents the session itself spawned, each with its descendants. */
-  agents: import_zod25.z.array(AgentNodeSchema),
-  tasks: import_zod25.z.array(TaskItemSchema),
-  workflowRuns: import_zod25.z.array(WorkflowRunSchema),
-  problems: import_zod25.z.array(AgentTreeProblemSchema)
-});
-
-// src/agents/read.ts
+var import_zod28 = require("zod");
 var PROJECTS_DIR = "projects";
 var TASKS_DIR = "tasks";
 var SUBAGENTS_DIR = "subagents";
@@ -16900,15 +17178,30 @@ function parseJson2(text) {
     return void 0;
   }
 }
-var TaskFileSchema = import_zod26.z.object({ ...TaskItemSchema.omit({ taskList: true }).shape, blocks: import_zod26.z.array(import_zod26.z.string()).default([]), blockedBy: import_zod26.z.array(import_zod26.z.string()).default([]) });
-var WorkflowRunFileSchema = import_zod26.z.object({
-  runId: import_zod26.z.string(),
-  workflowName: import_zod26.z.string().optional(),
-  status: import_zod26.z.string().optional(),
-  startTime: import_zod26.z.number().optional(),
-  phases: import_zod26.z.array(import_zod26.z.object({ title: import_zod26.z.string() })).default([]),
-  summary: import_zod26.z.string().optional()
+var TaskFileSchema = import_zod28.z.object({ ...TaskItemSchema.omit({ taskList: true }).shape, blocks: import_zod28.z.array(import_zod28.z.string()).default([]), blockedBy: import_zod28.z.array(import_zod28.z.string()).default([]) });
+var WorkflowRunFileSchema = import_zod28.z.object({
+  runId: import_zod28.z.string(),
+  workflowName: import_zod28.z.string().optional(),
+  status: import_zod28.z.string().optional(),
+  startTime: import_zod28.z.number().optional(),
+  phases: import_zod28.z.array(import_zod28.z.object({ title: import_zod28.z.string() })).default([]),
+  summary: import_zod28.z.string().optional()
 });
+function summariseSession(fs12, configDir, ref) {
+  const sessionRelative = import_node_path33.default.join(PROJECTS_DIR, ref.project, ref.entry);
+  const subagentsRelative = import_node_path33.default.join(sessionRelative, SUBAGENTS_DIR);
+  const workflowsUnderSubagents = import_node_path33.default.join(subagentsRelative, WORKFLOWS_DIR);
+  const isMeta = (name) => name.startsWith(AGENT_FILE_PREFIX) && name.endsWith(META_SUFFIX);
+  let agentCount = fs12.readdir(import_node_path33.default.join(configDir, subagentsRelative)).filter(isMeta).length;
+  for (const runDir of fs12.readdir(import_node_path33.default.join(configDir, workflowsUnderSubagents))) {
+    if (runDir.startsWith(WORKFLOW_RUN_PREFIX)) {
+      agentCount += fs12.readdir(import_node_path33.default.join(configDir, workflowsUnderSubagents, runDir)).filter(isMeta).length;
+    }
+  }
+  const workflowRunCount = fs12.readdir(import_node_path33.default.join(configDir, sessionRelative, WORKFLOWS_DIR)).filter((name) => name.startsWith(WORKFLOW_RUN_PREFIX) && name.endsWith(JSON_SUFFIX)).length;
+  const transcript = fs12.lstat(import_node_path33.default.join(configDir, PROJECTS_DIR, ref.project, `${ref.entry}${TRANSCRIPT_SUFFIX}`));
+  return { ...ref, agentCount, workflowRunCount, ...transcript === void 0 ? {} : { updatedAt: new Date(transcript.mtimeMs).toISOString() } };
+}
 function readSessionAgentTree(fs12, configDir, ref, options = {}) {
   const problems = [];
   const report = (problem) => {
@@ -17064,6 +17357,94 @@ function readWorkflowRuns(fs12, configDir, relativeDir, report) {
   return runs;
 }
 
+// src/agents/sessions.ts
+var import_node_path34 = __toESM(require("node:path"), 1);
+init_cliError();
+var SessionLookupError = class extends CliError {
+  constructor(message) {
+    super(message);
+    this.name = "SessionLookupError";
+  }
+};
+function identityConfigDir(identitiesDir, identity) {
+  return import_node_path34.default.join(identitiesDir, identity);
+}
+function historyStores(fs12, identitiesDir, identities) {
+  const byRealPath = /* @__PURE__ */ new Map();
+  for (const identity of identities) {
+    const configDir = identityConfigDir(identitiesDir, identity);
+    const real = fs12.realpath(import_node_path34.default.join(configDir, "projects"));
+    if (real === void 0) {
+      continue;
+    }
+    const store = byRealPath.get(real);
+    if (store === void 0) {
+      byRealPath.set(real, { configDir, identities: [identity] });
+    } else {
+      store.identities.push(identity);
+    }
+  }
+  return [...byRealPath.values()];
+}
+function collectSessionList(fs12, identitiesDir, identities, filters) {
+  const names = filters.identity === void 0 ? identities : identities.filter((name) => name === filters.identity);
+  if (filters.identity !== void 0 && names.length === 0) {
+    throw new SessionLookupError(`no identity named "${filters.identity}"`);
+  }
+  const sessions = [];
+  for (const store of historyStores(fs12, identitiesDir, names)) {
+    for (const ref of listSessions2(fs12, store.configDir)) {
+      const summary = summariseSession(fs12, store.configDir, ref);
+      if (filters.all === true || summary.agentCount > 0 || summary.workflowRunCount > 0) {
+        sessions.push({ ...summary, identities: store.identities });
+      }
+    }
+  }
+  return sessions.sort((left, right) => (right.updatedAt ?? "").localeCompare(left.updatedAt ?? "") || left.sessionId.localeCompare(right.sessionId));
+}
+function locateSession(fs12, identitiesDir, identities, query, onlyIdentity) {
+  const names = onlyIdentity === void 0 ? identities : identities.filter((name) => name === onlyIdentity);
+  if (onlyIdentity !== void 0 && names.length === 0) {
+    throw new SessionLookupError(`no identity named "${onlyIdentity}"`);
+  }
+  const matches = [];
+  for (const store of historyStores(fs12, identitiesDir, names)) {
+    for (const ref of listSessions2(fs12, store.configDir)) {
+      if (ref.sessionId.startsWith(query)) {
+        matches.push({ identities: store.identities, configDir: store.configDir, ref });
+      }
+    }
+  }
+  const exact = matches.filter((match) => match.ref.sessionId === query);
+  const candidates = exact.length > 0 ? exact : matches;
+  const only = candidates[0];
+  if (candidates.length === 1 && only !== void 0) {
+    return only;
+  }
+  if (candidates.length === 0) {
+    throw new SessionLookupError(`no session matches "${query}"`);
+  }
+  throw new SessionLookupError(`"${query}" matches ${String(candidates.length)} sessions: ${candidates.map((match) => `${match.ref.sessionId} (${match.identities.join(", ")})`).join("; ")}; give more of the id or pass --identity`);
+}
+function showSession(fs12, identitiesDir, identities, query, onlyIdentity) {
+  const located = locateSession(fs12, identitiesDir, identities, query, onlyIdentity);
+  return { identities: located.identities, tree: readSessionAgentTree(fs12, located.configDir, located.ref) };
+}
+
+// src/agents/realFs.ts
+var import_node_fs10 = __toESM(require("node:fs"), 1);
+init_realPorts();
+var realSessionFs = {
+  ...realFarmFs,
+  realpath: (candidate) => {
+    try {
+      return import_node_fs10.default.realpathSync(candidate);
+    } catch {
+      return void 0;
+    }
+  }
+};
+
 // src/index.ts
 init_conditions();
 init_ensure();
@@ -17176,6 +17557,10 @@ init_ownCli();
   AgentKindSchema,
   AgentMetaSchema,
   AgentNodeSchema,
+  AgentTreesListInputSchema,
+  AgentTreesListOutputSchema,
+  AgentTreesShowInputSchema,
+  AgentTreesShowOutputSchema,
   CHECK_CREDENTIAL_APPLIES,
   CODEX_APP_SERVER_GENERATED_AGAINST,
   CODEX_APP_SERVER_TIMEOUT_MS,
@@ -17271,11 +17656,15 @@ init_ownCli();
   InvalidIdentityNameError,
   InvalidProviderNameError,
   LAUNCH_EVENT_SOURCE,
+  LIVE_TASK_CAP,
   LaunchLifecycleEventSchema,
   LaunchRefusedError,
   LaunchResolveInputSchema,
   LaunchResolveOutputSchema,
   LegacyProviderFileError,
+  LiveTaskSchema,
+  MergedAgentNodeSchema,
+  MergedAgentTreeSchema,
   OWN_CLI_FILE_NAME,
   PROMPT_CACHE_TTL_MS,
   PlanClassSchema,
@@ -17323,6 +17712,8 @@ init_ownCli();
   ResetRowSchema,
   ResetScheduleSchema,
   SessionAgentTreeSchema,
+  SessionLookupError,
+  SessionSummarySchema,
   TaskItemSchema,
   USAGE_EVENT_SOURCE,
   UpdateCheckOutputSchema,
@@ -17341,6 +17732,7 @@ init_ownCli();
   addProvider,
   agentShimCliPath,
   answerRcControlRequest,
+  applyAgentTaskEvent,
   authenticateRcSessionMcpServer,
   buildEntryFacts,
   buildLayoutPaths,
@@ -17370,6 +17762,8 @@ init_ownCli();
   collectFrontDoorStatus,
   collectPoolPick,
   collectResets,
+  collectSessionList,
+  createAgentTreesApiRouter,
   createCodexApiRouter,
   createConfigApiRouter,
   createControlApiRouter,
@@ -17438,7 +17832,9 @@ init_ownCli();
   listProviders,
   listSessions,
   listUsageSnapshots,
+  locateSession,
   matchBranch,
+  mergeLiveTasks,
   mintLeaf,
   mintRcSelfHostCredential,
   observingRoutedRoute,
@@ -17480,6 +17876,7 @@ init_ownCli();
   realRcEventDial,
   realRcStreamDial,
   realRcWebFetch,
+  realSessionFs,
   reconnectRcSessionMcpServer,
   recoverFarm,
   recoveryDiagnostics,
@@ -17521,11 +17918,13 @@ init_ownCli();
   setProfileMetadata,
   setRcSessionModel,
   setRcSessionPermissionMode,
+  showSession,
   snapshotPath,
   spawnClaude,
   startConnectServer,
   submitRcSessionMcpOAuthCallbackUrl,
   suggestRcSessionFiles,
+  summariseSession,
   teleportRcSession,
   topLevelNames,
   updateDirectoryRule,