claude-use 9.17.0 → 9.19.0

package/dist/index.mjs

@@ -696,7 +696,7 @@ function compile(pattern, category, source, ordinal) {
     matches: isExact ? (name) => name === pattern : (name) => matcher(name)
   };
 }
-function compileClassificationPatterns(defaults, overlay) {
+function compileClassificationPatterns(defaults, overlay2) {
   const compiled = [];
   let ordinal = 0;
   for (const category of CATEGORY_NAMES) {
@@ -705,9 +705,9 @@ function compileClassificationPatterns(defaults, overlay) {
       ordinal += 1;
     }
   }
-  if (overlay !== void 0) {
+  if (overlay2 !== void 0) {
     for (const category of CATEGORY_NAMES) {
-      for (const pattern of overlay[category] ?? []) {
+      for (const pattern of overlay2[category] ?? []) {
         compiled.push(compile(pattern, category, "local", ordinal));
         ordinal += 1;
       }
@@ -728,10 +728,10 @@ function compareClassificationPatterns(a, b) {
   return a.ordinal - b.ordinal;
 }
 function loadClassification(paths) {
-  const overlay = readJson(paths.categoriesLocalFile, CategoryClassificationOverlaySchema);
+  const overlay2 = readJson(paths.categoriesLocalFile, CategoryClassificationOverlaySchema);
   return {
     defaults: CategoryClassificationSchema.parse(categories_default_default),
-    ...overlay === void 0 ? {} : { overlay }
+    ...overlay2 === void 0 ? {} : { overlay: overlay2 }
   };
 }
 function classifyEntries(names, options) {
@@ -2669,7 +2669,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "claude-use",
-      version: "9.17.0",
+      version: "9.19.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -2805,7 +2805,7 @@ var init_supervisorProcesses = __esm({
 // src/headroom/state.ts
 import { createHash as createHash3 } from "node:crypto";
 import path11 from "node:path";
-import { z as z6 } from "zod";
+import { z as z8 } from "zod";
 function parseJson(raw, schema) {
   if (raw === void 0 || raw.trim() === "") {
     return void 0;
@@ -2936,28 +2936,28 @@ var init_state2 = __esm({
     "use strict";
     init_schema();
     HEADROOM_ANTHROPIC_UPSTREAM = "https://api.anthropic.com";
-    HeadroomStateSchema = z6.strictObject({
+    HeadroomStateSchema = z8.strictObject({
       /** The supervisor process owning the daemon. Alive means someone is keeping headroom running. */
-      supervisorPid: z6.number().int().positive().optional(),
+      supervisorPid: z8.number().int().positive().optional(),
       /** The headroom proxy process itself. Absent while the supervisor is between restarts. */
-      headroomPid: z6.number().int().positive().optional(),
+      headroomPid: z8.number().int().positive().optional(),
       /**
        * The unix socket the proxy serves on, inside the owner-only socket directory. Absent until the proxy has passed its readiness check, so "socketPath is set" is itself the ready signal a launcher polls for. The front door reads it on every hop, so a restart (which keeps the generation's path) is followed without anything being relaunched.
        */
-      socketPath: z6.string().min(1).optional(),
+      socketPath: z8.string().min(1).optional(),
       /** The `headroom --version` output of the running install. */
-      version: z6.string().optional(),
+      version: z8.string().optional(),
       /** Hash of the allowlist the running proxy was started with, so a provider-file change is detected as drift. */
-      allowlistHash: z6.string().optional(),
+      allowlistHash: z8.string().optional(),
       /** Hash of the token-saving settings the running proxy was started with, so a settings change is detected as drift. */
-      settingsHash: z6.string().optional(),
+      settingsHash: z8.string().optional(),
       /** The install spec the running install was last installed from, so a `source` config change is detected as drift. */
-      installedSource: z6.string().optional(),
+      installedSource: z8.string().optional(),
       /** The last fatal error, kept across shutdowns so `headroom status` can explain a daemon that is not running. */
-      lastError: z6.string().optional()
+      lastError: z8.string().optional()
     });
-    HeadroomSessionSchema = z6.strictObject({ pid: z6.number().int().positive(), startedAt: z6.number(), supervisorPid: z6.number().int().positive() });
-    HeadroomLockSchema = z6.strictObject({ pid: z6.number().int().positive(), at: z6.number() });
+    HeadroomSessionSchema = z8.strictObject({ pid: z8.number().int().positive(), startedAt: z8.number(), supervisorPid: z8.number().int().positive() });
+    HeadroomLockSchema = z8.strictObject({ pid: z8.number().int().positive(), at: z8.number() });
   }
 });
 
@@ -3151,7 +3151,7 @@ var init_socket = __esm({
 });
 
 // src/headroom/source.ts
-import { z as z7 } from "zod";
+import { z as z9 } from "zod";
 function isMovingGitSource(spec) {
   const match = GIT_SPEC_RE.exec(spec);
   if (match === null) {
@@ -3170,7 +3170,7 @@ var init_source = __esm({
     "use strict";
     GIT_SPEC_RE = /git\+[^@\s]+(?:@([^\s#]+))?/;
     COMMIT_SHA_RE = /^[0-9a-f]{40}$/i;
-    DirectUrlSchema = z7.object({ vcs_info: z7.object({ commit_id: z7.string() }) });
+    DirectUrlSchema = z9.object({ vcs_info: z9.object({ commit_id: z9.string() }) });
   }
 });
 
@@ -4085,149 +4085,149 @@ var init_identity = __esm({
 });
 
 // src/usage/schema.ts
-import { z as z8 } from "zod";
+import { z as z10 } from "zod";
 var USAGE_SCHEMA_VERSION, VersionSchema, InstantSchema, TokenCountSchema, TokenUsageSchema, LIMIT_KINDS, LimitClassificationSchema, UsageRecordSchema, QuotaWindowSchema, ExtraUsageSpendSchema, UnifiedRateLimitSchema, RateLimitStateSchema, LimitEventSchema, ProviderQuotaWindowSchema, ProviderQuotaSchema, ProviderUsageStateSchema, AccountMetadataSchema, UsageSnapshotSchema;
 var init_schema2 = __esm({
   "src/usage/schema.ts"() {
     "use strict";
     USAGE_SCHEMA_VERSION = 1;
-    VersionSchema = z8.literal(USAGE_SCHEMA_VERSION);
-    InstantSchema = z8.iso.datetime();
-    TokenCountSchema = z8.number().int().nonnegative();
-    TokenUsageSchema = z8.strictObject({
+    VersionSchema = z10.literal(USAGE_SCHEMA_VERSION);
+    InstantSchema = z10.iso.datetime();
+    TokenCountSchema = z10.number().int().nonnegative();
+    TokenUsageSchema = z10.strictObject({
       inputTokens: TokenCountSchema.optional(),
       outputTokens: TokenCountSchema.optional(),
       cacheCreationInputTokens: TokenCountSchema.optional(),
       cacheReadInputTokens: TokenCountSchema.optional()
     });
     LIMIT_KINDS = ["rate-limited", "quota-exhausted"];
-    LimitClassificationSchema = z8.strictObject({
-      kind: z8.enum(LIMIT_KINDS),
+    LimitClassificationSchema = z10.strictObject({
+      kind: z10.enum(LIMIT_KINDS),
       /** Seconds to wait before retrying, from the response's `retry-after`. */
-      retryAfterSeconds: z8.number().nonnegative().optional(),
+      retryAfterSeconds: z10.number().nonnegative().optional(),
       /** When the limiting window resets, from the upstream's own reset header. */
       resetAt: InstantSchema.optional(),
       /** The window the upstream named as the binding one (`anthropic-ratelimit-unified-representative-claim`), such as `five_hour` or `seven_day`. */
-      window: z8.string().optional(),
+      window: z10.string().optional(),
       /** The signals the classification rests on, each `<name>=<value>` from a response header or the error body's `type` or `code`. Never the error message. */
-      evidence: z8.array(z8.string())
+      evidence: z10.array(z10.string())
     });
-    UsageRecordSchema = z8.strictObject({
+    UsageRecordSchema = z10.strictObject({
       schemaVersion: VersionSchema,
       /** When the front door received the request. */
       at: InstantSchema,
       /** The launching identity, when the launch resolved one. */
-      identity: z8.string().optional(),
+      identity: z10.string().optional(),
       /** `anthropic` for an OAuth session's request to Claude Code's own API, otherwise the provider's name. */
-      provider: z8.string(),
+      provider: z10.string(),
       /** The launch's session id, generated per launch. */
-      sessionId: z8.string().optional(),
+      sessionId: z10.string().optional(),
       /** The project the launch ran in (its git repository root), when the launch sent one: headroom launches do. */
-      project: z8.string().optional(),
+      project: z10.string().optional(),
       /** The front-door route that served the request. */
-      route: z8.string(),
-      method: z8.string(),
+      route: z10.string(),
+      method: z10.string(),
       /** The API path as the upstream sees it (`/v1/messages`), without the provider prefix or a query string. */
-      endpoint: z8.string(),
+      endpoint: z10.string(),
       /** The model the response named. */
-      model: z8.string().optional(),
-      status: z8.number().int(),
+      model: z10.string().optional(),
+      status: z10.number().int(),
       /** Milliseconds from the request's arrival to its response head. */
-      latencyMs: z8.number().int().nonnegative(),
+      latencyMs: z10.number().int().nonnegative(),
       /** Milliseconds from the request's arrival to the end of its response body. */
-      durationMs: z8.number().int().nonnegative(),
+      durationMs: z10.number().int().nonnegative(),
       /** Whether the client received the whole body. */
-      outcome: z8.enum(["completed", "aborted"]),
+      outcome: z10.enum(["completed", "aborted"]),
       usage: TokenUsageSchema.optional(),
       /** The response's quota and rate-limit headers, by name (see `isRateLimitHeader`). */
-      rateLimitHeaders: z8.record(z8.string(), z8.string()).optional(),
+      rateLimitHeaders: z10.record(z10.string(), z10.string()).optional(),
       limit: LimitClassificationSchema.optional(),
       /** The upstream's request id (`request-id`), for matching a record to the provider's own logs. */
-      requestId: z8.string().optional()
+      requestId: z10.string().optional()
     });
-    QuotaWindowSchema = z8.strictObject({
+    QuotaWindowSchema = z10.strictObject({
       /** The fraction of the window used, as the upstream reports it (0 to 1). */
-      utilization: z8.number().nonnegative().optional(),
+      utilization: z10.number().nonnegative().optional(),
       resetsAt: InstantSchema.optional(),
       /** The window's own status (`allowed`, `allowed_warning`, `rejected`). */
-      status: z8.string().optional(),
+      status: z10.string().optional(),
       /** The fraction of the window's grace allowance used, while the upstream reports the window in grace (the five-hour window only). Requests are served beyond the window's own full mark while it grows, but refusals have been seen at a small value, so nothing ranks on it. */
-      graceUtilization: z8.number().nonnegative().optional()
+      graceUtilization: z10.number().nonnegative().optional()
     });
-    ExtraUsageSpendSchema = z8.strictObject({
+    ExtraUsageSpendSchema = z10.strictObject({
       /** Spent so far in the allowance's period, in the currency's minor units (pence, cents). */
-      usedMinor: z8.number().nonnegative(),
+      usedMinor: z10.number().nonnegative(),
       /** The allowance's cap in the same units, when it has one. */
-      limitMinor: z8.number().nonnegative().optional(),
+      limitMinor: z10.number().nonnegative().optional(),
       /** The ISO 4217 currency code. */
-      currency: z8.string()
+      currency: z10.string()
     });
-    UnifiedRateLimitSchema = z8.strictObject({
+    UnifiedRateLimitSchema = z10.strictObject({
       /** The overall status: `allowed`, `allowed_warning` or `rejected`. */
-      status: z8.string().optional(),
+      status: z10.string().optional(),
       fiveHour: QuotaWindowSchema.optional(),
       sevenDay: QuotaWindowSchema.optional(),
       /** The weekly window of the models whose usage may continue as extra usage (`7d_oi`), reported by some plans beside the all-models weekly window. */
       sevenDayOverageIncluded: QuotaWindowSchema.optional(),
       /** The window that currently binds. */
-      representativeClaim: z8.string().optional(),
+      representativeClaim: z10.string().optional(),
       /** When the binding window resets. */
       resetAt: InstantSchema.optional(),
       /** Whether usage beyond the plan (extra usage) is available: `allowed` or `rejected`. */
-      overageStatus: z8.string().optional(),
+      overageStatus: z10.string().optional(),
       /** The fraction of the extra-usage allowance used, as the upstream reports it (0 to 1). An account with no plan windows, such as an Enterprise one, is metered by this alone. */
-      overageUtilization: z8.number().nonnegative().optional(),
+      overageUtilization: z10.number().nonnegative().optional(),
       /** When the extra-usage allowance resets. */
       overageResetsAt: InstantSchema.optional(),
       /** Why extra usage is unavailable, as the upstream names it (`out_of_credits`, for one). */
-      overageDisabledReason: z8.string().optional(),
+      overageDisabledReason: z10.string().optional(),
       /** Whether the response was served on extra usage, as the upstream states it. */
-      overageInUse: z8.boolean().optional(),
+      overageInUse: z10.boolean().optional(),
       /** The allowance in money, from the usage endpoint (the response headers state only the fraction). */
       extraUsageSpend: ExtraUsageSpendSchema.optional(),
       /** True when the upstream offers a fallback while a window is rejected: some requests, by model, are still served, though the rest are refused. */
-      fallbackAvailable: z8.boolean().optional()
+      fallbackAvailable: z10.boolean().optional()
     });
-    RateLimitStateSchema = z8.strictObject({
+    RateLimitStateSchema = z10.strictObject({
       observedAt: InstantSchema,
       /** Every quota and rate-limit header on that response, by name. */
-      headers: z8.record(z8.string(), z8.string()),
+      headers: z10.record(z10.string(), z10.string()),
       unified: UnifiedRateLimitSchema.optional(),
       /** When the usage endpoint last answered that it has no plan windows for the account, which a later response replaces. Its answer leaves the recorded `unified` state alone (a response's headers may be the only source of it), so this alone says the question was asked. */
       planWindowsUnavailableAt: InstantSchema.optional()
     });
     LimitEventSchema = LimitClassificationSchema.extend({
       observedAt: InstantSchema,
-      status: z8.number().int()
+      status: z10.number().int()
     });
-    ProviderQuotaWindowSchema = z8.strictObject({
+    ProviderQuotaWindowSchema = z10.strictObject({
       /** What the window measures, in the provider's terms (`tokens`, `tool-calls`). */
-      measures: z8.string(),
+      measures: z10.string(),
       /** The window's length in milliseconds, when the provider's unit is one this project knows; absent for an unrecognised unit, with `period` carrying the raw code. */
-      periodMs: z8.number().int().positive().optional(),
+      periodMs: z10.number().int().positive().optional(),
       /** The provider's own description of the period when `periodMs` could not be derived, such as `unit 4 x 1`. */
-      period: z8.string().optional(),
+      period: z10.string().optional(),
       /** The fraction of the window used (0 to 1). */
-      utilization: z8.number().nonnegative(),
+      utilization: z10.number().nonnegative(),
       resetsAt: InstantSchema.optional(),
       /** Absolute counts, when the provider reports them for this window. */
-      limit: z8.number().nonnegative().optional(),
-      used: z8.number().nonnegative().optional(),
-      remaining: z8.number().nonnegative().optional()
+      limit: z10.number().nonnegative().optional(),
+      used: z10.number().nonnegative().optional(),
+      remaining: z10.number().nonnegative().optional()
     });
-    ProviderQuotaSchema = z8.strictObject({
+    ProviderQuotaSchema = z10.strictObject({
       observedAt: InstantSchema,
       /** Which usage endpoint produced it (`z.ai`). */
-      source: z8.string(),
+      source: z10.string(),
       /** The subscription level the endpoint reports, when it does. */
-      level: z8.string().optional(),
-      windows: z8.array(ProviderQuotaWindowSchema)
+      level: z10.string().optional(),
+      windows: z10.array(ProviderQuotaWindowSchema)
     });
-    ProviderUsageStateSchema = z8.strictObject({
+    ProviderUsageStateSchema = z10.strictObject({
       /** When the provider last served a request for the identity through the front door. Absent while the state holds only a rate-limit state fetched from the provider's usage endpoint, for an identity that has made no request. */
       lastRequestAt: InstantSchema.optional(),
-      lastStatus: z8.number().int().optional(),
-      lastModel: z8.string().optional(),
+      lastStatus: z10.number().int().optional(),
+      lastModel: z10.string().optional(),
       /** The latest rate-limit state, from the last response that carried any rate-limit header. */
       rateLimit: RateLimitStateSchema.optional(),
       /** The latest classified refusal. It stays after later successes, so a reader compares its `resetAt` (or `observedAt` plus `retryAfterSeconds`) with the current time. */
@@ -4235,31 +4235,31 @@ var init_schema2 = __esm({
       /** The latest quota the provider's usage endpoint reported, for providers whose quota is not visible in response headers. */
       quota: ProviderQuotaSchema.optional()
     });
-    AccountMetadataSchema = z8.strictObject({
-      accountUuid: z8.string().optional(),
-      emailAddress: z8.string().optional(),
-      displayName: z8.string().optional(),
-      organizationUuid: z8.string().optional(),
-      organizationName: z8.string().optional(),
-      organizationType: z8.string().optional(),
-      organizationRole: z8.string().optional(),
-      workspaceRole: z8.string().optional(),
-      billingType: z8.string().optional(),
-      seatTier: z8.string().optional(),
-      organizationRateLimitTier: z8.string().optional(),
-      userRateLimitTier: z8.string().optional(),
-      hasExtraUsageEnabled: z8.boolean().optional(),
-      subscriptionCreatedAt: z8.string().optional(),
-      accountCreatedAt: z8.string().optional()
+    AccountMetadataSchema = z10.strictObject({
+      accountUuid: z10.string().optional(),
+      emailAddress: z10.string().optional(),
+      displayName: z10.string().optional(),
+      organizationUuid: z10.string().optional(),
+      organizationName: z10.string().optional(),
+      organizationType: z10.string().optional(),
+      organizationRole: z10.string().optional(),
+      workspaceRole: z10.string().optional(),
+      billingType: z10.string().optional(),
+      seatTier: z10.string().optional(),
+      organizationRateLimitTier: z10.string().optional(),
+      userRateLimitTier: z10.string().optional(),
+      hasExtraUsageEnabled: z10.boolean().optional(),
+      subscriptionCreatedAt: z10.string().optional(),
+      accountCreatedAt: z10.string().optional()
     });
-    UsageSnapshotSchema = z8.strictObject({
+    UsageSnapshotSchema = z10.strictObject({
       schemaVersion: VersionSchema,
-      identity: z8.string(),
+      identity: z10.string(),
       updatedAt: InstantSchema,
       /** The identity's account metadata as of `updatedAt`. */
       account: AccountMetadataSchema.optional(),
       /** Latest state per provider, keyed by provider name (`anthropic` for OAuth sessions). */
-      providers: z8.record(z8.string(), ProviderUsageStateSchema)
+      providers: z10.record(z10.string(), ProviderUsageStateSchema)
     });
   }
 });
@@ -4347,7 +4347,7 @@ var init_account = __esm({
 });
 
 // src/usage/plan.ts
-import { z as z9 } from "zod";
+import { z as z11 } from "zod";
 function planOf(account) {
   const userTier = account?.userRateLimitTier;
   if (userTier !== void 0 && ZERO_TIER.test(userTier)) {
@@ -4371,19 +4371,19 @@ var PlanClassSchema, TIER_MULTIPLIER, ZERO_TIER, BASE_TIER;
 var init_plan2 = __esm({
   "src/usage/plan.ts"() {
     "use strict";
-    PlanClassSchema = z9.union([
-      z9.strictObject({
-        kind: z9.literal("subscription"),
+    PlanClassSchema = z11.union([
+      z11.strictObject({
+        kind: z11.literal("subscription"),
         /** The plan's size as a multiple of the smallest subscription tier (Max 5x is 5, Max 20x is 20). */
-        capacity: z9.number().positive(),
+        capacity: z11.number().positive(),
         /** False when the tier string named no multiplier and no tier this project knows, so `capacity` is the neutral 1 rather than a reading. */
-        recognised: z9.boolean(),
+        recognised: z11.boolean(),
         /** The tier string the classification rests on, when the account had one. */
-        tier: z9.string().optional()
+        tier: z11.string().optional()
       }),
-      z9.strictObject({
-        kind: z9.literal("pay-per-use"),
-        tier: z9.string().optional()
+      z11.strictObject({
+        kind: z11.literal("pay-per-use"),
+        tier: z11.string().optional()
       })
     ]);
     TIER_MULTIPLIER = /(?:^|_)(\d+)x$/;
@@ -4484,21 +4484,21 @@ var init_rateLimit = __esm({
 });
 
 // src/usage/scan.ts
-import { z as z10 } from "zod";
+import { z as z12 } from "zod";
 var AnthropicUsageSchema, ErrorObjectSchema;
 var init_scan = __esm({
   "src/usage/scan.ts"() {
     "use strict";
-    AnthropicUsageSchema = z10.looseObject({
-      input_tokens: z10.number().int().nonnegative().nullish(),
-      output_tokens: z10.number().int().nonnegative().nullish(),
-      cache_creation_input_tokens: z10.number().int().nonnegative().nullish(),
-      cache_read_input_tokens: z10.number().int().nonnegative().nullish()
+    AnthropicUsageSchema = z12.looseObject({
+      input_tokens: z12.number().int().nonnegative().nullish(),
+      output_tokens: z12.number().int().nonnegative().nullish(),
+      cache_creation_input_tokens: z12.number().int().nonnegative().nullish(),
+      cache_read_input_tokens: z12.number().int().nonnegative().nullish()
     });
-    ErrorObjectSchema = z10.looseObject({
-      type: z10.string().optional(),
-      code: z10.union([z10.string(), z10.number()]).optional(),
-      message: z10.string().optional()
+    ErrorObjectSchema = z12.looseObject({
+      type: z12.string().optional(),
+      code: z12.union([z12.string(), z12.number()]).optional(),
+      message: z12.string().optional()
     });
   }
 });
@@ -4791,22 +4791,25 @@ function rankPool(input) {
       return { ...candidate, feasible: true };
     }
     const drySpots = [];
+    const dryAfterMs = [];
     if (fiveHour !== void 0 && pace !== void 0) {
       const runsDryInMs = fiveHour.remaining / pace;
       if (runsDryInMs < fiveHour.untilResetMs) {
+        dryAfterMs.push(runsDryInMs);
         drySpots.push(`5h window would run dry in ${formatAge(runsDryInMs)}, before it resets in ${formatAge(fiveHour.untilResetMs)}`);
       }
     }
     if (sevenDay !== void 0 && sevenDayBurn !== void 0) {
       const runsDryInMs = sevenDay.remaining / sevenDayBurn;
       if (runsDryInMs < sevenDay.untilResetMs) {
+        dryAfterMs.push(runsDryInMs);
         drySpots.push(`7d window would run dry in ${formatAge(runsDryInMs)}, before it resets in ${formatAge(sevenDay.untilResetMs)}`);
       }
     }
     if (drySpots.length === 0) {
       return { ...candidate, feasible: true };
     }
-    return { ...candidate, feasible: false, reasons: [...drySpots, ...candidate.reasons] };
+    return { ...candidate, feasible: false, runsDryAtMs: nowMs + Math.min(...dryAfterMs), reasons: [...drySpots, ...candidate.reasons] };
   });
   const ordered = input.preference === "listed" ? [...candidates] : [...candidates].sort(
     (left, right) => CLASS_ORDER[left.class] - CLASS_ORDER[right.class] || Number(left.policyDemoted ?? false) - Number(right.policyDemoted ?? false) || Number(right.feasible) - Number(left.feasible) || (right.headroom ?? 1) - (left.headroom ?? 1) || (right.score ?? 0) - (left.score ?? 0) || left.identity.localeCompare(right.identity)
@@ -4828,11 +4831,13 @@ function rankPool(input) {
   const pick = ordered.find((candidate) => candidate.class !== "ineligible");
   const returns = ordered.flatMap((candidate) => candidate.blockedUntilMs === void 0 ? [] : [{ identity: candidate.identity, atMs: candidate.blockedUntilMs }]);
   const earliestReturn = returns.length === 0 ? void 0 : returns.reduce((soonest, entry) => entry.atMs < soonest.atMs ? entry : soonest);
+  const holdForReturn = pick?.runsDryAtMs === void 0 ? void 0 : returns.filter((entry) => entry.atMs < (pick.runsDryAtMs ?? 0)).reduce((soonest, entry) => soonest === void 0 || entry.atMs < soonest.atMs ? entry : soonest, void 0);
   return {
     candidates: ordered,
     ...pick === void 0 ? { ...earliestReturn === void 0 ? {} : { earliestReturn } } : { pick },
     ...movedOff === void 0 || pick === void 0 ? {} : { movedOff },
-    ...pick?.planReturnsAtMs === void 0 ? {} : { planReturn: { identity: pick.identity, atMs: pick.planReturnsAtMs } }
+    ...pick?.planReturnsAtMs === void 0 ? {} : { planReturn: { identity: pick.identity, atMs: pick.planReturnsAtMs } },
+    ...holdForReturn === void 0 ? {} : { holdForReturn }
   };
 }
 var MS_PER_SECOND4, MS_PER_HOUR2, HOURS_PER_DAY2, FIVE_HOURS, PROMPT_CACHE_TTL_HOURS, PERCENT, SEVEN_DAYS, FIVE_HOUR_WINDOW_MS, SEVEN_DAY_WINDOW_MS, PROMPT_CACHE_TTL_MS, CLASS_ORDER;
@@ -5098,7 +5103,7 @@ var init_store2 = __esm({
 
 // src/usage/poolPick.ts
 import path20 from "node:path";
-import { z as z11 } from "zod";
+import { z as z13 } from "zod";
 function errorMessage(error) {
   return error instanceof Error ? error.message : String(error);
 }
@@ -5248,10 +5253,10 @@ var init_poolPick = __esm({
       }
     };
     SCHEMA_VERSION = 1;
-    PickEntrySchema = z11.strictObject({ identity: z11.string().min(1), at: z11.iso.datetime() });
-    PicksFileSchema = z11.strictObject({
-      schemaVersion: z11.literal(SCHEMA_VERSION),
-      picks: z11.record(z11.string().min(1), PickEntrySchema)
+    PickEntrySchema = z13.strictObject({ identity: z13.string().min(1), at: z13.iso.datetime() });
+    PicksFileSchema = z13.strictObject({
+      schemaVersion: z13.literal(SCHEMA_VERSION),
+      picks: z13.record(z13.string().min(1), PickEntrySchema)
     });
   }
 });
@@ -5331,7 +5336,7 @@ var init_paths = __esm({
 });
 
 // src/credentialCache.ts
-import { z as z12 } from "zod";
+import { z as z14 } from "zod";
 function effectiveStore(cache, platform) {
   return cache.store ?? (platform === "darwin" ? "keychain" : "file");
 }
@@ -5398,9 +5403,9 @@ var init_credentialCache = __esm({
     init_schema();
     init_preflight();
     MS_PER_UNIT = { s: 1e3, m: 6e4, h: 36e5, d: 864e5 };
-    CachedCredentialSchema = z12.strictObject({
-      token: z12.string().min(1),
-      fetchedAt: z12.number().int().nonnegative(),
+    CachedCredentialSchema = z14.strictObject({
+      token: z14.string().min(1),
+      fetchedAt: z14.number().int().nonnegative(),
       source: CredentialSourceSchema
     });
   }
@@ -5673,14 +5678,14 @@ function providerJsonPath(paths, name) {
 function providerExists(paths, name) {
   return fs7.existsSync(providerJsonPath(paths, name));
 }
-function isRecord4(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function legacyProviderConversion(raw) {
-  if (!isRecord4(raw) || "credential" in raw) {
+  if (!isRecord5(raw) || "credential" in raw) {
     return void 0;
   }
-  const env = isRecord4(raw.env) ? raw.env : void 0;
+  const env = isRecord5(raw.env) ? raw.env : void 0;
   const legacyEnvKeys = env === void 0 ? [] : Object.keys(env).filter((key) => LEGACY_ENV_CREDENTIAL_KEYS.includes(key));
   const fields = [...LEGACY_PROVIDER_FIELDS.filter((field) => field in raw), ...legacyEnvKeys.map((key) => `env.${key}`)];
   if (fields.length === 0) {
@@ -6102,7 +6107,7 @@ var init_commandDeps = __esm({
 // src/claudeShim.ts
 import fs8 from "node:fs";
 import path26 from "node:path";
-import { z as z17 } from "zod";
+import { z as z19 } from "zod";
 function commandFilename(ownExecutablePath, commandName) {
   return ownExecutablePath.toLowerCase().endsWith(".exe") ? `${commandName}.exe` : commandName;
 }
@@ -6152,10 +6157,10 @@ var init_claudeShim = __esm({
     init_store();
     init_realPorts();
     init_cliError();
-    ClaudeShimStateSchema = z17.strictObject({
-      targetPath: z17.string().min(1),
-      method: z17.enum(["hardlink", "copy"]),
-      installedAtMs: z17.number()
+    ClaudeShimStateSchema = z19.strictObject({
+      targetPath: z19.string().min(1),
+      method: z19.enum(["hardlink", "copy"]),
+      installedAtMs: z19.number()
     });
     nodeLinkFs = { link: fs8.linkSync, copyFile: fs8.copyFileSync, chmod: fs8.chmodSync };
   }
@@ -6630,7 +6635,7 @@ var init_headers = __esm({
 });
 
 // src/launcher/flags.ts
-import path34 from "node:path";
+import path35 from "node:path";
 function resolveLaunchFlags(params) {
   return {
     skipPermissions: params.flags?.skipPermissions ?? parseEnvBool("AGENT_SHIM_SKIP_PERMISSIONS", params.env.AGENT_SHIM_SKIP_PERMISSIONS) ?? params.cascade?.skipPermissions ?? false,
@@ -6661,7 +6666,7 @@ function buildEnv(params) {
   const parentCustomHeaders = params.baseEnv.ANTHROPIC_CUSTOM_HEADERS;
   let providerCustomHeaders;
   if (!params.configDirEscapeHatch && params.resolvedIdentityName !== void 0) {
-    env.CLAUDE_CONFIG_DIR = path34.join(params.identitiesDir, params.resolvedIdentityName);
+    env.CLAUDE_CONFIG_DIR = path35.join(params.identitiesDir, params.resolvedIdentityName);
   }
   if (params.provider !== void 0) {
     const providerEnv = params.provider.definition.env ?? {};
@@ -6782,12 +6787,17 @@ function resolvePoolLaunch(params) {
     if (graph.ranking.candidates.length === 0) {
       return { ok: false, message: `agent-shim: no member of pool "${poolName}" is an existing identity.` };
     }
-    const { pick, earliestReturn, movedOff, planReturn } = graph.ranking;
+    const { pick, earliestReturn, movedOff, planReturn, holdForReturn } = graph.ranking;
     if (pick !== void 0 && params.wait && planReturn !== void 0) {
       log.info(`agent-shim: pool "${poolName}" would continue ${planReturn.identity} on extra usage; waiting until ${new Date(planReturn.atMs).toISOString()} for its plan window`);
       params.sleep(Math.max(planReturn.atMs - nowMs, 0));
       continue;
     }
+    if (pick !== void 0 && params.wait && holdForReturn !== void 0) {
+      log.info(`agent-shim: pool "${poolName}" pick ${pick.identity} would run dry before its window resets; waiting until ${new Date(holdForReturn.atMs).toISOString()} for ${holdForReturn.identity}`);
+      params.sleep(Math.max(holdForReturn.atMs - nowMs, 0));
+      continue;
+    }
     if (pick !== void 0) {
       if (params.recordPick) {
         recordStickyPick(params.usageFs, params.paths.usagePicksFile, params.cwd, pick.identity, nowMs);
@@ -6928,7 +6938,7 @@ var init_launchHook = __esm({
 
 // src/launcher.ts
 import { randomUUID as randomUUID4 } from "node:crypto";
-import path35 from "node:path";
+import path36 from "node:path";
 function resolveIdentityCredential(identity, credential, env, port) {
   if (port === void 0) {
     return { ok: false, status: 1, message: `agent-shim: identity ${identity} needs its credential resolved, but this launcher has no credential port wired` };
@@ -7038,7 +7048,7 @@ function decideLaunch(params, readOnly) {
     identityDefaultConfigProfile: loadedIdentity?.config.defaultConfigProfile,
     globalDefaultConfigProfile: params.globalDefaultConfigProfile
   });
-  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs12.readConfigFile(path35.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
+  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs12.readConfigFile(path36.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
     log.error(
       `agent-shim: no configuration profile named "${configProfileDecision.name}" (selected via ${configProfileDecision.source}). Run \`agent-shim profile add ${configProfileDecision.name}\` first.`
     );
@@ -7150,7 +7160,7 @@ function decideLaunch(params, readOnly) {
     extraFlags: splitExtraFlags(env.CLAUDE_EXTRA_FLAGS),
     passthrough: parsedArgv.rest
   });
-  const configDir = configDirEscapeHatchApplies || identityDecision.name === void 0 ? env.CLAUDE_CONFIG_DIR : path35.join(paths.identitiesDir, identityDecision.name);
+  const configDir = configDirEscapeHatchApplies || identityDecision.name === void 0 ? env.CLAUDE_CONFIG_DIR : path36.join(paths.identitiesDir, identityDecision.name);
   const decision = {
     identitySource: identityDecision.source,
     configDirEscapeHatch: identityDecision.configDirEscapeHatch,
@@ -7191,7 +7201,7 @@ function prepareLaunch(params) {
   );
   const updateCheck = runLaunchUpdateCheck({
     mode: params.updateMode ?? "off",
-    checkPath: path35.join(paths.root, "update.check"),
+    checkPath: path36.join(paths.root, "update.check"),
     currentVersion: package_default.version,
     port: params.update
   });
@@ -7351,12 +7361,12 @@ var init_launcher = __esm({
 });
 
 // src/ownCli.ts
-import path36 from "node:path";
+import path37 from "node:path";
 function agentShimCliPath(distDir = typeof __AGENT_SHIM_DIST_DIR__ === "string" ? __AGENT_SHIM_DIST_DIR__ : void 0) {
   if (distDir === void 0) {
     throw new OwnCliPathUnknownError();
   }
-  return path36.join(distDir, OWN_CLI_FILE_NAME);
+  return path37.join(distDir, OWN_CLI_FILE_NAME);
 }
 var OWN_CLI_FILE_NAME, OwnCliPathUnknownError;
 var init_ownCli = __esm({
@@ -7445,10 +7455,10 @@ request.on("error", (error) => finish(failed, (error.code ? error.code + ": " :
 
 // src/frontdoor/trust.ts
 import { createHash as createHash6 } from "node:crypto";
-import path37 from "node:path";
+import path38 from "node:path";
 function resolveTrustBundle(params) {
   const { caCertFile, bundlesDir, variable, inherited, fs: fs12 } = params;
-  if (inherited === void 0 || inherited === "" || path37.resolve(inherited) === path37.resolve(caCertFile)) {
+  if (inherited === void 0 || inherited === "" || path38.resolve(inherited) === path38.resolve(caCertFile)) {
     return { path: caCertFile };
   }
   const caPem = fs12.readFileUtf8(caCertFile);
@@ -7466,7 +7476,7 @@ function resolveTrustBundle(params) {
   }
   const combined = `${inheritedPem.trimEnd()}
 ${caPem}`;
-  const bundle = path37.join(bundlesDir, `${createHash6("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
+  const bundle = path38.join(bundlesDir, `${createHash6("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
   if (!fs12.exists(bundle)) {
     fs12.mkdirp(bundlesDir);
     fs12.writeFileAtomic(bundle, combined);
@@ -7866,7 +7876,7 @@ var init_identityClaude = __esm({
 });
 
 // src/usage/providerQuota.ts
-import { z as z27 } from "zod";
+import { z as z29 } from "zod";
 var MS_PER_SECOND7, SECONDS_PER_HOUR, HOURS_PER_DAY4, DAYS_PER_MONTH, ZAI_HOST, ZAI_QUOTA_URL, ZAI_UNIT_HOURS, ZAI_UNIT_MONTHS, ZAI_UNIT_MS, ZaiLimitSchema, ZaiResponseSchema, OPENROUTER_HOST, OPENROUTER_KEY_URL, OPENROUTER_CREDITS_URL, MS_PER_DAY3, OpenRouterKeySchema, OpenRouterCreditsSchema;
 var init_providerQuota = __esm({
   "src/usage/providerQuota.ts"() {
@@ -7884,35 +7894,35 @@ var init_providerQuota = __esm({
       [ZAI_UNIT_HOURS, SECONDS_PER_HOUR * MS_PER_SECOND7],
       [ZAI_UNIT_MONTHS, DAYS_PER_MONTH * HOURS_PER_DAY4 * SECONDS_PER_HOUR * MS_PER_SECOND7]
     ]);
-    ZaiLimitSchema = z27.object({
-      type: z27.string(),
-      unit: z27.number().int(),
-      number: z27.number().int().positive(),
-      percentage: z27.number().nonnegative(),
-      nextResetTime: z27.number().positive().optional(),
-      usage: z27.number().nonnegative().optional(),
-      currentValue: z27.number().nonnegative().optional(),
-      remaining: z27.number().nonnegative().optional()
+    ZaiLimitSchema = z29.object({
+      type: z29.string(),
+      unit: z29.number().int(),
+      number: z29.number().int().positive(),
+      percentage: z29.number().nonnegative(),
+      nextResetTime: z29.number().positive().optional(),
+      usage: z29.number().nonnegative().optional(),
+      currentValue: z29.number().nonnegative().optional(),
+      remaining: z29.number().nonnegative().optional()
     });
-    ZaiResponseSchema = z27.object({
-      success: z27.boolean(),
-      msg: z27.string().optional(),
-      data: z27.object({ level: z27.string().optional(), limits: z27.array(ZaiLimitSchema) })
+    ZaiResponseSchema = z29.object({
+      success: z29.boolean(),
+      msg: z29.string().optional(),
+      data: z29.object({ level: z29.string().optional(), limits: z29.array(ZaiLimitSchema) })
     });
     OPENROUTER_HOST = "openrouter.ai";
     OPENROUTER_KEY_URL = `https://${OPENROUTER_HOST}/api/v1/key`;
     OPENROUTER_CREDITS_URL = `https://${OPENROUTER_HOST}/api/v1/credits`;
     MS_PER_DAY3 = HOURS_PER_DAY4 * SECONDS_PER_HOUR * MS_PER_SECOND7;
-    OpenRouterKeySchema = z27.object({
-      data: z27.object({
-        limit: z27.number().nonnegative().nullable(),
-        limit_remaining: z27.number().nullable(),
-        limit_reset: z27.string().nullable(),
-        is_free_tier: z27.boolean().optional(),
-        free_model_daily_requests: z27.object({ used: z27.number().nonnegative(), limit: z27.number().nonnegative(), remaining: z27.number() }).optional()
+    OpenRouterKeySchema = z29.object({
+      data: z29.object({
+        limit: z29.number().nonnegative().nullable(),
+        limit_remaining: z29.number().nullable(),
+        limit_reset: z29.string().nullable(),
+        is_free_tier: z29.boolean().optional(),
+        free_model_daily_requests: z29.object({ used: z29.number().nonnegative(), limit: z29.number().nonnegative(), remaining: z29.number() }).optional()
       })
     });
-    OpenRouterCreditsSchema = z27.object({ data: z27.object({ total_credits: z27.number().nonnegative(), total_usage: z27.number().nonnegative() }) });
+    OpenRouterCreditsSchema = z29.object({ data: z29.object({ total_credits: z29.number().nonnegative(), total_usage: z29.number().nonnegative() }) });
   }
 });
 
@@ -8525,8 +8535,8 @@ function parseConnectTarget(authority) {
 function isInterceptedHost(host, interceptHosts) {
   return interceptHosts.includes(host);
 }
-function servedByPipeline(path38) {
-  return path38?.startsWith(ROUTED_PATH_PREFIX) === true;
+function servedByPipeline(path39) {
+  return path39?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
   "connection",
@@ -8896,6 +8906,264 @@ var HTTP_STATUS = {
   badGateway: 502
 };
 
+// src/agents/liveTasks.ts
+import { z as z5 } from "zod";
+
+// src/agents/schema.ts
+import { z as z4 } from "zod";
+var AgentMetaSchema = z4.looseObject({
+  agentType: z4.string(),
+  isFork: z4.boolean().optional(),
+  description: z4.string().optional(),
+  name: z4.string().optional(),
+  toolUseId: z4.string().optional(),
+  spawnDepth: z4.number().int().nonnegative().optional(),
+  parentAgentId: z4.string().optional(),
+  model: z4.string().optional(),
+  requestShape: z4.string().optional(),
+  requestNonInteractive: z4.boolean().optional(),
+  workflowPhase: z4.string().optional(),
+  taskKind: z4.string().optional(),
+  teamName: z4.string().optional(),
+  worktreePath: z4.string().optional(),
+  worktreeBranch: z4.string().optional(),
+  stoppedByUser: z4.boolean().optional()
+});
+var AgentKindSchema = z4.enum(["subagent", "fork", "workflow-agent", "teammate"]);
+var AgentNodeFields = {
+  id: z4.string(),
+  kind: AgentKindSchema,
+  agentType: z4.string(),
+  description: z4.string().optional(),
+  name: z4.string().optional(),
+  toolUseId: z4.string().optional(),
+  spawnDepth: z4.number().int().nonnegative().optional(),
+  model: z4.string().optional(),
+  background: z4.boolean().optional(),
+  workflowRunId: z4.string().optional(),
+  workflowPhase: z4.string().optional(),
+  teamName: z4.string().optional(),
+  stoppedByUser: z4.boolean().optional(),
+  transcript: z4.string()
+};
+var AgentNodeSchema = z4.lazy(() => z4.strictObject({ ...AgentNodeFields, children: z4.array(AgentNodeSchema) }));
+var TaskItemSchema = z4.strictObject({
+  id: z4.string(),
+  subject: z4.string(),
+  description: z4.string().optional(),
+  status: z4.string(),
+  /** What a spinner shows while the task runs. */
+  activeForm: z4.string().optional(),
+  /** The teammate or agent name the task is assigned to, as Agent Teams writes it. */
+  owner: z4.string().optional(),
+  /** Free-form data the harness attaches to a task, kept as written. */
+  metadata: z4.record(z4.string(), z4.unknown()).optional(),
+  blocks: z4.array(z4.string()),
+  blockedBy: z4.array(z4.string()),
+  /** The id of the shared task list this task belongs to (a team's name, or a custom list id), absent for the session's own list. */
+  taskList: z4.string().optional()
+});
+var WorkflowRunSchema = z4.strictObject({
+  runId: z4.string(),
+  workflowName: z4.string().optional(),
+  status: z4.string().optional(),
+  startTime: z4.number().optional(),
+  phases: z4.array(z4.string()),
+  summary: z4.string().optional()
+});
+var AgentTreeProblemSchema = z4.strictObject({
+  /** Relative to the identity's configuration directory. */
+  path: z4.string(),
+  reason: z4.string()
+});
+var SessionSummarySchema = z4.strictObject({
+  project: z4.string(),
+  sessionId: z4.string(),
+  superseded: z4.boolean(),
+  /** The directory and transcript stem exactly as on disk, which differs from `sessionId` for a superseded session. */
+  entry: z4.string(),
+  agentCount: z4.number().int().nonnegative(),
+  workflowRunCount: z4.number().int().nonnegative(),
+  /** When the transcript was last written, as an ISO instant; absent when there is no transcript file. */
+  updatedAt: z4.iso.datetime().optional(),
+  identities: z4.array(z4.string())
+});
+var SessionAgentTreeSchema = z4.strictObject({
+  project: z4.string(),
+  sessionId: z4.string(),
+  /** True for a session directory a resume superseded (`<session-id>.superseded-<epoch-ms>`). */
+  superseded: z4.boolean(),
+  /** The agents the session itself spawned, each with its descendants. */
+  agents: z4.array(AgentNodeSchema),
+  tasks: z4.array(TaskItemSchema),
+  workflowRuns: z4.array(WorkflowRunSchema),
+  problems: z4.array(AgentTreeProblemSchema)
+});
+
+// src/agents/liveTasks.ts
+var LIVE_TASK_CAP = 512;
+var RUNNING_STATUS = "running";
+var LiveTaskUsageSchema = z5.strictObject({
+  totalTokens: z5.number().optional(),
+  toolUses: z5.number().optional(),
+  durationMs: z5.number().optional()
+});
+var LiveTaskSchema = z5.strictObject({
+  /** The `task_id`: for an unnamed subagent the stem of its `agent-<id>` files on disk. */
+  taskId: z5.string(),
+  /** The `cse_` session whose stream carried the task. */
+  sessionId: z5.string(),
+  runId: z5.string().optional(),
+  /** The `tool_use` block in the spawning transcript, which is the meta file's `toolUseId`. */
+  toolUseId: z5.string().optional(),
+  /** `local_agent` for a subagent, `local_bash` for a backgrounded command; open because other kinds may exist. */
+  taskType: z5.string().optional(),
+  description: z5.string().optional(),
+  subagentType: z5.string().optional(),
+  spawnDepth: z5.number().int().nonnegative().optional(),
+  parentTaskId: z5.string().optional(),
+  backgrounded: z5.boolean().optional(),
+  status: z5.string(),
+  /** `<tmpdir>/<project-slug>/<local session id>/tasks/<task_id>.output`, which embeds the local session id. */
+  outputFile: z5.string().optional(),
+  summary: z5.string().optional(),
+  lastToolName: z5.string().optional(),
+  usage: LiveTaskUsageSchema.optional(),
+  /** When the door last observed an event for this task, in epoch milliseconds from its injected clock. */
+  observedAt: z5.number()
+});
+var SYSTEM_SUBTYPES = ["task_started", "task_progress", "task_updated", "task_notification", "background_tasks_changed"];
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stringField(record, field) {
+  const value = record[field];
+  return typeof value === "string" && value !== "" ? value : void 0;
+}
+function numberField(record, field) {
+  const value = record[field];
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function booleanField(record, field) {
+  const value = record[field];
+  return typeof value === "boolean" ? value : void 0;
+}
+function usageOf(record) {
+  const raw = record.usage;
+  if (!isRecord2(raw)) {
+    return void 0;
+  }
+  const totalTokens = numberField(raw, "total_tokens");
+  const toolUses = numberField(raw, "tool_uses");
+  const durationMs = numberField(raw, "duration_ms");
+  if (totalTokens === void 0 && toolUses === void 0 && durationMs === void 0) {
+    return void 0;
+  }
+  return { ...totalTokens === void 0 ? {} : { totalTokens }, ...toolUses === void 0 ? {} : { toolUses }, ...durationMs === void 0 ? {} : { durationMs } };
+}
+function overlay(base, fields) {
+  const defined = Object.fromEntries(Object.entries(fields).filter(([, value]) => value !== void 0));
+  return LiveTaskSchema.parse({ ...base, ...defined });
+}
+function isFinished(task) {
+  return task.status !== RUNNING_STATUS;
+}
+function bounded(book) {
+  if (book.size <= LIVE_TASK_CAP) {
+    return book;
+  }
+  const evictable = [...book.values()].filter(isFinished).sort((left, right) => left.observedAt - right.observedAt);
+  for (const task of evictable) {
+    if (book.size <= LIVE_TASK_CAP) {
+      break;
+    }
+    book.delete(task.taskId);
+  }
+  return book;
+}
+function applyAgentTaskEvent(book, sessionId, payload, observedAt2) {
+  if (!isRecord2(payload) || payload.type !== "system") {
+    return book;
+  }
+  const subtype = payload.subtype;
+  if (typeof subtype !== "string" || !SYSTEM_SUBTYPES.some((known) => known === subtype)) {
+    return book;
+  }
+  const next = new Map(book);
+  const upsert = (taskId2, fields) => {
+    const existing = next.get(taskId2);
+    const base = existing ?? { taskId: taskId2, sessionId, status: RUNNING_STATUS, observedAt: observedAt2 };
+    next.set(taskId2, overlay(base, { ...fields, observedAt: observedAt2 }));
+  };
+  if (subtype === "background_tasks_changed") {
+    const tasks = Array.isArray(payload.tasks) ? payload.tasks : [];
+    for (const raw of tasks) {
+      const taskId2 = isRecord2(raw) ? stringField(raw, "task_id") : void 0;
+      if (isRecord2(raw) && taskId2 !== void 0) {
+        upsert(taskId2, { runId: stringField(raw, "run_id"), taskType: stringField(raw, "task_type"), description: stringField(raw, "description") });
+      }
+    }
+    return bounded(next);
+  }
+  const taskId = stringField(payload, "task_id");
+  if (taskId === void 0) {
+    return book;
+  }
+  const common = { runId: stringField(payload, "run_id"), toolUseId: stringField(payload, "tool_use_id"), description: stringField(payload, "description") };
+  if (subtype === "task_started") {
+    upsert(taskId, {
+      ...common,
+      taskType: stringField(payload, "task_type"),
+      subagentType: stringField(payload, "subagent_type"),
+      spawnDepth: numberField(payload, "spawn_depth"),
+      parentTaskId: stringField(payload, "parent_task_id"),
+      backgrounded: booleanField(payload, "is_backgrounded")
+    });
+  } else if (subtype === "task_progress") {
+    upsert(taskId, { ...common, subagentType: stringField(payload, "subagent_type"), lastToolName: stringField(payload, "last_tool_name"), usage: usageOf(payload) });
+  } else if (subtype === "task_updated") {
+    const patch = isRecord2(payload.patch) ? payload.patch : {};
+    upsert(taskId, { runId: stringField(payload, "run_id"), status: stringField(patch, "status") });
+  } else {
+    upsert(taskId, { ...common, status: stringField(payload, "status"), outputFile: stringField(payload, "output_file"), summary: stringField(payload, "summary"), usage: usageOf(payload) });
+  }
+  return bounded(next);
+}
+var MergedProvenanceSchema = z5.enum(["disk", "both"]);
+var MergedAgentNodeSchema = z5.lazy(
+  () => z5.strictObject({
+    ...AgentNodeFields,
+    provenance: MergedProvenanceSchema,
+    live: LiveTaskSchema.optional(),
+    children: z5.array(MergedAgentNodeSchema)
+  })
+);
+var MergedAgentTreeSchema = z5.strictObject({
+  ...SessionAgentTreeSchema.shape,
+  agents: z5.array(MergedAgentNodeSchema),
+  /** The `cse_` sessions whose live tasks matched this session. Empty when the session is not live or the door has not observed it. */
+  remoteSessions: z5.array(z5.string()),
+  /** Live tasks of those sessions that match no disk agent (a backgrounded command, or an agent whose files have not appeared yet). */
+  liveOnly: z5.array(LiveTaskSchema)
+});
+function mergeLiveTasks(tree, live) {
+  const byTaskId = new Map(live.map((task) => [task.taskId, task]));
+  const byToolUseId = new Map(live.flatMap((task) => task.toolUseId === void 0 ? [] : [[task.toolUseId, task]]));
+  const claimed = /* @__PURE__ */ new Set();
+  const merge = (node) => {
+    const task = byTaskId.get(node.id) ?? (node.toolUseId === void 0 ? void 0 : byToolUseId.get(node.toolUseId));
+    if (task !== void 0) {
+      claimed.add(task.taskId);
+    }
+    return { ...node, provenance: task === void 0 ? "disk" : "both", ...task === void 0 ? {} : { live: task }, children: node.children.map(merge) };
+  };
+  const agents = tree.agents.map(merge);
+  const sessionMarker = `/${tree.sessionId}/`;
+  const liveOnly = live.filter((task) => !claimed.has(task.taskId) && task.outputFile?.includes(sessionMarker) === true);
+  const remoteSessions = [...new Set([...claimed, ...liveOnly.map((task) => task.taskId)].flatMap((taskId) => byTaskId.get(taskId)?.sessionId ?? []))].sort();
+  return { ...tree, agents, remoteSessions, liveOnly };
+}
+
 // src/frontdoor/rcSessions.ts
 var RC_SESSIONS_PATH_PREFIX = "/v1/code/sessions";
 var RC_SESSION_ID_PREFIX = "cse_";
@@ -8936,7 +9204,7 @@ function sessionCreateId(body) {
   const id = session.id;
   return typeof id === "string" && id.startsWith(RC_SESSION_ID_PREFIX) ? id : void 0;
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseJsonObject(body) {
@@ -8946,7 +9214,7 @@ function parseJsonObject(body) {
   } catch {
     return void 0;
   }
-  return isRecord2(parsed) ? parsed : void 0;
+  return isRecord3(parsed) ? parsed : void 0;
 }
 function nonEmptyString(record, field) {
   const value = record === void 0 ? void 0 : record[field];
@@ -8967,11 +9235,11 @@ function payloadEventsOf(body) {
   }
   const payloads = [];
   for (const event of events) {
-    if (!isRecord2(event)) {
+    if (!isRecord3(event)) {
       continue;
     }
     const payload = event.payload;
-    if (!isRecord2(payload)) {
+    if (!isRecord3(payload)) {
       continue;
     }
     payloads.push(payload);
@@ -8986,7 +9254,7 @@ function pendingOfControlRequestPayload(payload) {
   if (requestId === void 0) {
     return void 0;
   }
-  const request4 = isRecord2(payload.request) ? payload.request : void 0;
+  const request4 = isRecord3(payload.request) ? payload.request : void 0;
   const subtype = nonEmptyString(request4, "subtype");
   const type = subtype ?? "control_request";
   let summary = "";
@@ -9003,20 +9271,21 @@ function answeredRequestIdsOfControlResponsePayload(payload) {
   if (payload.type !== "control_response") {
     return [];
   }
-  const response = isRecord2(payload.response) ? payload.response : void 0;
+  const response = isRecord3(payload.response) ? payload.response : void 0;
   const id = nonEmptyString(response, "request_id") ?? nonEmptyString(payload, "request_id") ?? nonEmptyString(payload, "uuid");
   return id === void 0 ? [] : [id];
 }
 function parseRcRequestBody(kind, body) {
   if (kind === "heartbeat") {
-    return { controlRequests: [], answeredRequestIds: [], idleSeconds: finiteNumber(parseJsonObject(body), "idle_seconds"), workerStatus: void 0 };
+    return { controlRequests: [], answeredRequestIds: [], idleSeconds: finiteNumber(parseJsonObject(body), "idle_seconds"), workerStatus: void 0, payloads: [] };
   }
   if (kind === "worker-registration") {
-    return { controlRequests: [], answeredRequestIds: [], idleSeconds: void 0, workerStatus: nonEmptyString(parseJsonObject(body), "worker_status") };
+    return { controlRequests: [], answeredRequestIds: [], idleSeconds: void 0, workerStatus: nonEmptyString(parseJsonObject(body), "worker_status"), payloads: [] };
   }
   const controlRequests = [];
   const answeredRequestIds = [];
-  for (const payload of payloadEventsOf(body)) {
+  const payloads = payloadEventsOf(body);
+  for (const payload of payloads) {
     const pending = pendingOfControlRequestPayload(payload);
     if (pending !== void 0) {
       controlRequests.push({ requestId: pending.requestId, type: pending.type, summary: pending.summary });
@@ -9024,7 +9293,7 @@ function parseRcRequestBody(kind, body) {
     }
     answeredRequestIds.push(...answeredRequestIdsOfControlResponsePayload(payload));
   }
-  return { controlRequests, answeredRequestIds, idleSeconds: void 0, workerStatus: void 0 };
+  return { controlRequests, answeredRequestIds, idleSeconds: void 0, workerStatus: void 0, payloads };
 }
 function createRcSessionTracker(deps) {
   const entries = /* @__PURE__ */ new Map();
@@ -9050,7 +9319,7 @@ function createRcSessionTracker(deps) {
   const timer = setInterval(sweep, deps.idleMs);
   timer.unref();
   const birth = (id, facts) => {
-    const record = { id, createdAt: deps.now(), lastSeenAt: deps.now(), ...facts, pending: /* @__PURE__ */ new Map(), workerState: void 0, workerIdleSeconds: void 0, sequenceNum: void 0 };
+    const record = { id, createdAt: deps.now(), lastSeenAt: deps.now(), ...facts, pending: /* @__PURE__ */ new Map(), workerState: void 0, workerIdleSeconds: void 0, sequenceNum: void 0, liveTasks: /* @__PURE__ */ new Map() };
     entries.set(id, record);
     return record;
   };
@@ -9061,11 +9330,11 @@ function createRcSessionTracker(deps) {
   };
   const observeExchange = (request4) => {
     const method = (request4.method ?? "").toUpperCase();
-    const path38 = new URL(request4.url ?? "/", "http://127.0.0.1").pathname;
-    if (!path38.startsWith(RC_SESSIONS_PATH_PREFIX)) {
+    const path39 = new URL(request4.url ?? "/", "http://127.0.0.1").pathname;
+    if (!path39.startsWith(RC_SESSIONS_PATH_PREFIX)) {
       return void 0;
     }
-    const tail = path38.slice(RC_SESSIONS_PATH_PREFIX.length);
+    const tail = path39.slice(RC_SESSIONS_PATH_PREFIX.length);
     const facts = {
       oauthAuthorization: oauthAuthorizationOf(request4.headers),
       anthropicVersion: singleHeader(request4.headers, "anthropic-version"),
@@ -9138,6 +9407,9 @@ function createRcSessionTracker(deps) {
       for (const requestId of factsOfBody.answeredRequestIds) {
         entryNow.pending.delete(requestId);
       }
+      for (const payload of factsOfBody.payloads) {
+        entryNow.liveTasks = applyAgentTaskEvent(entryNow.liveTasks, id, payload, now);
+      }
       if (factsOfBody.idleSeconds !== void 0) {
         entryNow.workerIdleSeconds = { value: factsOfBody.idleSeconds, observedAt: now };
       }
@@ -9228,9 +9500,10 @@ function createRcSessionTracker(deps) {
         return;
       }
       entry.sequenceNum = entry.sequenceNum === void 0 || event.sequence_num > entry.sequenceNum ? event.sequence_num : entry.sequenceNum;
-      if (!isRecord2(event.payload)) {
+      if (!isRecord3(event.payload)) {
         return;
       }
+      entry.liveTasks = applyAgentTaskEvent(entry.liveTasks, sessionId, event.payload, deps.now());
       const pending = pendingOfControlRequestPayload(event.payload);
       if (pending !== void 0) {
         if (event.source === RC_STREAM_WORKER_SOURCE) {
@@ -9242,6 +9515,10 @@ function createRcSessionTracker(deps) {
         entry.pending.delete(requestId);
       }
     },
+    liveTasksOf: (sessionId) => {
+      sweep();
+      return sortedEntries().filter((entry) => sessionId === void 0 || entry.id === sessionId).flatMap((entry) => [...entry.liveTasks.values()].sort((left, right) => left.observedAt - right.observedAt || (left.taskId < right.taskId ? -1 : 1)));
+    },
     completePending: (sessionId, requestId) => {
       entries.get(sessionId)?.pending.delete(requestId);
     },
@@ -9447,8 +9724,8 @@ var RC_READ_FILE_ENCODINGS = ["utf-8", "base64"];
 function isRcReadFileEncoding(value) {
   return RC_READ_FILE_ENCODINGS.some((encoding) => encoding === value);
 }
-function buildRcReadFilePayload(requestId, path38, options) {
-  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path38, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
+function buildRcReadFilePayload(requestId, path39, options) {
+  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path39, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
 }
 function buildRcFileSuggestionsPayload(requestId, query) {
   return buildRcControlRequestPayload(requestId, { subtype: "file_suggestions", query });
@@ -9550,15 +9827,15 @@ async function getRcSessionContextUsage(deps, sessionId, detail) {
   const result = await deliverRcClientPayload(deps, sessionId, buildRcGetContextUsagePayload(requestId, detail), `request the context usage of session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
-async function readRcSessionFile(deps, sessionId, path38, options) {
-  if (path38 === "") {
+async function readRcSessionFile(deps, sessionId, path39, options) {
+  if (path39 === "") {
     return { ok: false, message: "a read-file write needs a non-empty path: the SDK's own field names the file the worker resolves against the session's cwd, and an empty string names none" };
   }
   if (options?.maxBytes !== void 0 && (!Number.isInteger(options.maxBytes) || options.maxBytes <= 0)) {
     return { ok: false, message: "a read-file write's max-bytes is a positive whole number of bytes: the SDK's own field caps the read, and a zero or negative cap reads nothing" };
   }
   const requestId = deps.newUuid();
-  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path38, options), `read ${path38} from session ${sessionId}`);
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path39, options), `read ${path39} from session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
 async function suggestRcSessionFiles(deps, sessionId, query) {
@@ -9727,11 +10004,11 @@ function createRcControlHandler(deps) {
       path: "read-file",
       read: (body) => {
         const session = bodyString(body, "session");
-        const path38 = bodyString(body, "path");
+        const path39 = bodyString(body, "path");
         const maxBytes = "maxBytes" in body ? bodyPositiveInteger(body, "maxBytes") : void 0;
         const encoding = "encoding" in body && isRcReadFileEncoding(body.encoding) ? body.encoding : void 0;
-        const refused2 = session === void 0 || path38 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
-        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path38, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
+        const refused2 = session === void 0 || path39 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
+        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path39, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
       }
     },
     {
@@ -10041,9 +10318,9 @@ function requestIdOfBody(body) {
 }
 function frontDoorRcControl(transport, token) {
   const headers = { authorization: `Bearer ${token}` };
-  const listAnswerOf = async (path38, what) => {
+  const listAnswerOf = async (path39, what) => {
     try {
-      return await transport.request({ method: "GET", path: path38, headers });
+      return await transport.request({ method: "GET", path: path39, headers });
     } catch (error) {
       throw new Error(`${what}: could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
     }
@@ -10115,10 +10392,10 @@ function frontDoorRcControl(transport, token) {
     }
     return pending;
   };
-  const writeOf = async (path38, body, describeFailure2) => {
+  const writeOf = async (path39, body, describeFailure2) => {
     let answer;
     try {
-      answer = await transport.request({ method: "POST", path: path38, headers: { ...headers, "content-type": "application/json" }, body });
+      answer = await transport.request({ method: "POST", path: path39, headers: { ...headers, "content-type": "application/json" }, body });
     } catch (error) {
       return { ok: false, message: `could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}` };
     }
@@ -10149,10 +10426,10 @@ function frontDoorRcControl(transport, token) {
     endSession: async (sessionId, reason) => await writeOf(`${CONTROL_PATH_PREFIX}/end-session`, JSON.stringify({ session: sessionId, ...reason === void 0 ? {} : { reason } }), (status, message) => `ending ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getUsage: async (sessionId, skipBehaviors) => await writeOf(`${CONTROL_PATH_PREFIX}/get-usage`, JSON.stringify({ session: sessionId, ...skipBehaviors === void 0 ? {} : { skipBehaviors } }), (status, message) => `requesting the usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getContextUsage: async (sessionId, detail) => await writeOf(`${CONTROL_PATH_PREFIX}/get-context-usage`, JSON.stringify({ session: sessionId, ...detail === void 0 ? {} : { detail } }), (status, message) => `requesting the context usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
-    readFile: async (sessionId, path38, options) => await writeOf(
+    readFile: async (sessionId, path39, options) => await writeOf(
       `${CONTROL_PATH_PREFIX}/read-file`,
-      JSON.stringify({ session: sessionId, path: path38, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
-      (status, message) => `reading ${path38} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
+      JSON.stringify({ session: sessionId, path: path39, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
+      (status, message) => `reading ${path39} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
     ),
     fileSuggestions: async (sessionId, query) => await writeOf(`${CONTROL_PATH_PREFIX}/file-suggestions`, JSON.stringify({ session: sessionId, query }), (status, message) => `requesting file suggestions from ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     keepAlive: async (sessionId) => await writeOf(`${CONTROL_PATH_PREFIX}/keep-alive`, JSON.stringify({ session: sessionId }), (status, message) => `keeping ${sessionId} alive failed (HTTP ${String(status)}): ${message}`),
@@ -10311,12 +10588,12 @@ function tlsFacts(options) {
 }
 function realRcEventDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const post = async (path38, headers, body) => await new Promise((resolve, reject) => {
+  const post = async (path39, headers, body) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method: "POST",
-      path: path38,
+      path: path39,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, "content-length": String(Buffer.byteLength(body, "utf8")) },
       agent
@@ -10381,12 +10658,12 @@ function lateRcStreamDial(resolve) {
 }
 function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const request4 = async (method, path38, headers, body, signal) => await new Promise((resolve, reject) => {
+  const request4 = async (method, path39, headers, body, signal) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method,
-      path: path38,
+      path: path39,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, ...body === void 0 ? {} : { "content-length": String(Buffer.byteLength(body, "utf8")) } },
       agent,
@@ -10428,9 +10705,9 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
       return { status, body: await readAll(response) };
     },
     openStream: async (sessionId, headers, resume, signal) => {
-      const path38 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
+      const path39 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
       const streamHeaders = resume === void 0 ? headers : { ...headers, "last-event-id": String(resume.fromSequenceNum) };
-      const { status, response } = await request4("GET", path38, streamHeaders, void 0, signal);
+      const { status, response } = await request4("GET", path39, streamHeaders, void 0, signal);
       if (!isSuccessful2(status)) {
         await readAll(response);
         return { status, chunks: NO_CHUNKS };
@@ -10646,11 +10923,11 @@ import path10 from "node:path";
 function isSafeSessionId(sessionId) {
   return /^[A-Za-z0-9_-]+$/.test(sessionId);
 }
-function isRecord3(value) {
+function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function credentialOfJson(parsed) {
-  if (!isRecord3(parsed)) {
+  if (!isRecord4(parsed)) {
     return void 0;
   }
   const { authorization, anthropicVersion, anthropicClientPlatform } = parsed;
@@ -10680,7 +10957,7 @@ function createRcCredentialStore(fs12, dir) {
     } catch {
       return void 0;
     }
-    return isRecord3(parsed) ? parsed : void 0;
+    return isRecord4(parsed) ? parsed : void 0;
   };
   return {
     read: (sessionId) => {
@@ -10734,162 +11011,162 @@ import { Agent as Agent3, fetch as undiciFetch } from "undici";
 init_capability();
 
 // src/frontdoor/rcSchemas.ts
-import { z as z4 } from "zod";
-var RcPermissionModeSchema = z4.enum(RC_PERMISSION_MODES);
-var RcSessionSummarySchema = z4.strictObject({
-  id: z4.string(),
-  createdAt: z4.number(),
-  lastSeenAt: z4.number()
+import { z as z6 } from "zod";
+var RcPermissionModeSchema = z6.enum(RC_PERMISSION_MODES);
+var RcSessionSummarySchema = z6.strictObject({
+  id: z6.string(),
+  createdAt: z6.number(),
+  lastSeenAt: z6.number()
 });
 function workerFactSchema(value) {
-  return z4.strictObject({ value, observedAt: z4.number() });
-}
-var RcPendingRequestSummarySchema = z4.strictObject({
-  sessionId: z4.string(),
-  requestId: z4.string(),
-  type: z4.string(),
-  summary: z4.string(),
-  observedAt: z4.number()
+  return z6.strictObject({ value, observedAt: z6.number() });
+}
+var RcPendingRequestSummarySchema = z6.strictObject({
+  sessionId: z6.string(),
+  requestId: z6.string(),
+  type: z6.string(),
+  summary: z6.string(),
+  observedAt: z6.number()
 });
-var RcSessionStatusSchema = z4.strictObject({
+var RcSessionStatusSchema = z6.strictObject({
   ...RcSessionSummarySchema.shape,
-  workerState: workerFactSchema(z4.string()).optional(),
-  workerIdleSeconds: workerFactSchema(z4.number()).optional(),
-  pending: z4.readonly(z4.array(RcPendingRequestSummarySchema))
+  workerState: workerFactSchema(z6.string()).optional(),
+  workerIdleSeconds: workerFactSchema(z6.number()).optional(),
+  pending: z6.readonly(z6.array(RcPendingRequestSummarySchema))
 });
-var RcStreamEnvelopeSchema = z4.looseObject({
+var RcStreamEnvelopeSchema = z6.looseObject({
   /** The envelope's own event id, when the host sent one. */
-  event_id: z4.string().optional(),
+  event_id: z6.string().optional(),
   /** The envelope's event type, the discriminator a consumer switches on (`control_request`, `user`, and kin). */
-  event_type: z4.string(),
+  event_type: z6.string(),
   /** The sequence number the host assigned, the value a resume continues after. */
-  sequence_num: z4.int(),
+  sequence_num: z6.int(),
   /** Who emitted the event (`worker` for the CLI's half, a client id for a client's). */
-  source: z4.string(),
+  source: z6.string(),
   /** The event's payload, carried verbatim: its shape is the payload family's, narrowed by whichever consumer needs it. Optional in the schema's own type because the door forwards the host's envelope as it arrived, asserting only the fields it relies on itself. */
-  payload: z4.unknown().optional(),
+  payload: z6.unknown().optional(),
   /** When the host created the event; the protocol's own type for this field is not established here, so it is forwarded rather than asserted. */
-  created_at: z4.unknown().optional()
+  created_at: z6.unknown().optional()
 });
-var RcStreamEventSchema = z4.strictObject({
-  session: z4.string(),
+var RcStreamEventSchema = z6.strictObject({
+  session: z6.string(),
   envelope: RcStreamEnvelopeSchema
 });
-var RcRateLimitWindowSchema = z4.looseObject({
+var RcRateLimitWindowSchema = z6.looseObject({
   /** The fraction of the window used, usually between 0 and 1, above 1 when usage legitimately runs past the window's cap (the CLI's own field description states both). */
-  utilization: z4.number().optional(),
+  utilization: z6.number().optional(),
   /** When the window resets, in unix epoch seconds: the unit is the CLI's own field description, stated in the 2.1.289 bundle's schema. */
-  resetsAt: z4.number().optional()
+  resetsAt: z6.number().optional()
 });
-var RcRateLimitInfoSchema = z4.looseObject({
+var RcRateLimitInfoSchema = z6.looseObject({
   /** The limiting window's own status (`allowed`, `allowed_warning`, `rejected`), asserted only as a string because the vocabulary grows with the CLI. */
-  status: z4.string(),
+  status: z6.string(),
   /** When the limiting window resets, in unix epoch seconds. */
-  resetsAt: z4.number().optional(),
+  resetsAt: z6.number().optional(),
   /** Which window the top-level fields describe (`five_hour`, `seven_day`, and kin), the payload's own name for it. */
-  rateLimitType: z4.string().optional(),
+  rateLimitType: z6.string().optional(),
   /** The fraction of the limiting window used, on the same scale the per-window utilizations carry. */
-  utilization: z4.number().optional(),
+  utilization: z6.number().optional(),
   /** Whether usage beyond the plan (extra usage) is currently covering the overflow, the payload's own flag for it. */
-  isUsingOverage: z4.boolean().optional(),
+  isUsingOverage: z6.boolean().optional(),
   /** The overage's own status, the same vocabulary the limiting window's `status` carries. */
-  overageStatus: z4.string().optional(),
+  overageStatus: z6.string().optional(),
   /** When the overage window resets, in unix epoch seconds. */
-  overageResetsAt: z4.number().optional(),
+  overageResetsAt: z6.number().optional(),
   /** Each subscription window the account's response headers carried: the session (five-hour), weekly (seven-day), and overage-included weekly windows, each present only when the account's responses carry it. */
-  unifiedWindows: z4.looseObject({ five_hour: RcRateLimitWindowSchema.optional(), seven_day: RcRateLimitWindowSchema.optional(), seven_day_overage_included: RcRateLimitWindowSchema.optional() }).optional()
+  unifiedWindows: z6.looseObject({ five_hour: RcRateLimitWindowSchema.optional(), seven_day: RcRateLimitWindowSchema.optional(), seven_day_overage_included: RcRateLimitWindowSchema.optional() }).optional()
 });
-var RcLiveRateLimitSchema = z4.strictObject({
-  session: z4.string(),
-  observedAt: z4.number(),
+var RcLiveRateLimitSchema = z6.strictObject({
+  session: z6.string(),
+  observedAt: z6.number(),
   rateLimit: RcRateLimitInfoSchema
 });
-var RcSessionQuerySchema = z4.strictObject({
-  session: z4.string().min(1).optional()
+var RcSessionQuerySchema = z6.strictObject({
+  session: z6.string().min(1).optional()
 });
-var RcSendInputSchema = z4.strictObject({
-  session: z4.string().min(1),
-  text: z4.string().min(1)
+var RcSendInputSchema = z6.strictObject({
+  session: z6.string().min(1),
+  text: z6.string().min(1)
 });
-var RcAnswerInputSchema = z4.strictObject({
-  session: z4.string().min(1),
-  request: z4.string().min(1),
-  approve: z4.boolean(),
-  text: z4.string().optional()
+var RcAnswerInputSchema = z6.strictObject({
+  session: z6.string().min(1),
+  request: z6.string().min(1),
+  approve: z6.boolean(),
+  text: z6.string().optional()
 }).refine((input) => !input.approve || input.text === void 0 || input.text === "", { message: "an approval carries no text (the protocol's allow result has no message field); text is the denial message" });
-var RcInterruptInputSchema = z4.strictObject({
-  session: z4.string().min(1)
+var RcInterruptInputSchema = z6.strictObject({
+  session: z6.string().min(1)
 });
-var RcSetModelInputSchema = z4.strictObject({
-  session: z4.string().min(1),
-  model: z4.string().min(1)
+var RcSetModelInputSchema = z6.strictObject({
+  session: z6.string().min(1),
+  model: z6.string().min(1)
 });
-var RcSetPermissionModeInputSchema = z4.strictObject({
-  session: z4.string().min(1),
+var RcSetPermissionModeInputSchema = z6.strictObject({
+  session: z6.string().min(1),
   mode: RcPermissionModeSchema
 });
-var RcEndSessionInputSchema = z4.strictObject({
-  session: z4.string().min(1),
-  reason: z4.string().min(1).optional()
+var RcEndSessionInputSchema = z6.strictObject({
+  session: z6.string().min(1),
+  reason: z6.string().min(1).optional()
 });
-var RcGetUsageInputSchema = z4.strictObject({
-  session: z4.string().min(1),
-  skipBehaviors: z4.boolean().optional()
+var RcGetUsageInputSchema = z6.strictObject({
+  session: z6.string().min(1),
+  skipBehaviors: z6.boolean().optional()
 });
-var RcGetContextUsageInputSchema = z4.strictObject({
-  session: z4.string().min(1),
-  detail: z4.enum(RC_CONTEXT_USAGE_DETAILS).optional()
+var RcGetContextUsageInputSchema = z6.strictObject({
+  session: z6.string().min(1),
+  detail: z6.enum(RC_CONTEXT_USAGE_DETAILS).optional()
 });
-var RcReadFileInputSchema = z4.strictObject({
-  session: z4.string().min(1),
-  path: z4.string().min(1),
-  maxBytes: z4.number().int().positive().optional(),
-  encoding: z4.enum(RC_READ_FILE_ENCODINGS).optional()
+var RcReadFileInputSchema = z6.strictObject({
+  session: z6.string().min(1),
+  path: z6.string().min(1),
+  maxBytes: z6.number().int().positive().optional(),
+  encoding: z6.enum(RC_READ_FILE_ENCODINGS).optional()
 });
-var RcFileSuggestionsInputSchema = z4.strictObject({
-  session: z4.string().min(1),
-  query: z4.string()
+var RcFileSuggestionsInputSchema = z6.strictObject({
+  session: z6.string().min(1),
+  query: z6.string()
 });
-var RcKeepAliveInputSchema = z4.strictObject({
-  session: z4.string().min(1)
+var RcKeepAliveInputSchema = z6.strictObject({
+  session: z6.string().min(1)
 });
-var RcMcpStatusInputSchema = z4.strictObject({
-  session: z4.string().min(1)
+var RcMcpStatusInputSchema = z6.strictObject({
+  session: z6.string().min(1)
 });
-var RcMcpReconnectInputSchema = z4.strictObject({
-  session: z4.string().min(1),
-  serverName: z4.string().min(1)
+var RcMcpReconnectInputSchema = z6.strictObject({
+  session: z6.string().min(1),
+  serverName: z6.string().min(1)
 });
-var RcMcpAuthenticateInputSchema = z4.strictObject({
-  session: z4.string().min(1),
-  serverName: z4.string().min(1),
-  redirectUri: z4.string().min(1)
+var RcMcpAuthenticateInputSchema = z6.strictObject({
+  session: z6.string().min(1),
+  serverName: z6.string().min(1),
+  redirectUri: z6.string().min(1)
 });
-var RcMcpOAuthCallbackUrlInputSchema = z4.strictObject({
-  session: z4.string().min(1),
-  serverName: z4.string().min(1),
-  callbackUrl: z4.string().min(1)
+var RcMcpOAuthCallbackUrlInputSchema = z6.strictObject({
+  session: z6.string().min(1),
+  serverName: z6.string().min(1),
+  callbackUrl: z6.string().min(1)
 });
-var RcTeleportInputSchema = z4.strictObject({
-  session: z4.string().min(1),
-  marker: z4.string().min(1)
+var RcTeleportInputSchema = z6.strictObject({
+  session: z6.string().min(1),
+  marker: z6.string().min(1)
 });
-var RcListOutputSchema = z4.strictObject({ sessions: z4.readonly(z4.array(RcSessionSummarySchema)) });
-var RcStatusOutputSchema = z4.strictObject({ statuses: z4.readonly(z4.array(RcSessionStatusSchema)) });
-var RcPendingOutputSchema = z4.strictObject({ pending: z4.readonly(z4.array(RcPendingRequestSummarySchema)) });
-var RcWriteOutputSchema = z4.strictObject({
-  session: z4.string(),
-  sequenceNums: z4.readonly(z4.array(z4.number()))
+var RcListOutputSchema = z6.strictObject({ sessions: z6.readonly(z6.array(RcSessionSummarySchema)) });
+var RcStatusOutputSchema = z6.strictObject({ statuses: z6.readonly(z6.array(RcSessionStatusSchema)) });
+var RcPendingOutputSchema = z6.strictObject({ pending: z6.readonly(z6.array(RcPendingRequestSummarySchema)) });
+var RcWriteOutputSchema = z6.strictObject({
+  session: z6.string(),
+  sequenceNums: z6.readonly(z6.array(z6.number()))
 });
-var RcControlWriteOutputSchema = z4.strictObject({
-  session: z4.string(),
-  request: z4.string(),
-  sequenceNums: z4.readonly(z4.array(z4.number()))
+var RcControlWriteOutputSchema = z6.strictObject({
+  session: z6.string(),
+  request: z6.string(),
+  sequenceNums: z6.readonly(z6.array(z6.number()))
 });
-var RcAnswerOutputSchema = z4.strictObject({
-  session: z4.string(),
-  request: z4.string(),
-  sequenceNums: z4.readonly(z4.array(z4.number()))
+var RcAnswerOutputSchema = z6.strictObject({
+  session: z6.string(),
+  request: z6.string(),
+  sequenceNums: z6.readonly(z6.array(z6.number()))
 });
 
 // src/frontdoor/rcApi.ts
@@ -10897,6 +11174,7 @@ var RC_ORPC_PATH_PREFIX = "/__agent-shim/orpc";
 var RC_OPENAPI_DOC_PATH = "/openapi.json";
 var RC_SUBSCRIBER_BUFFER_EVENTS = 100;
 var READ_ONLY_OPERATION_EXTENSION = "x-agent-shim-read-only";
+var SESSION_HISTORY_TAG = "agent-trees";
 function doorApiBearer(headers) {
   const presented = headers.authorization;
   const bearerPrefix = "bearer ".length;
@@ -11075,48 +11353,48 @@ init_cliError();
 init_package();
 
 // src/codex/appServerSchemas.ts
-import { z as z5 } from "zod";
+import { z as z7 } from "zod";
 var CODEX_APP_SERVER_GENERATED_AGAINST = "0.160.0";
-var RateLimitWindowSchema = z5.object({
-  usedPercent: z5.number(),
-  resetsAt: z5.number().nullish(),
-  windowDurationMins: z5.number().nullish()
+var RateLimitWindowSchema = z7.object({
+  usedPercent: z7.number(),
+  resetsAt: z7.number().nullish(),
+  windowDurationMins: z7.number().nullish()
 });
-var RateLimitSnapshotSchema = z5.object({
-  limitId: z5.string().nullish(),
-  limitName: z5.string().nullish(),
-  planType: z5.string().nullish(),
+var RateLimitSnapshotSchema = z7.object({
+  limitId: z7.string().nullish(),
+  limitName: z7.string().nullish(),
+  planType: z7.string().nullish(),
   primary: RateLimitWindowSchema.nullish(),
   secondary: RateLimitWindowSchema.nullish(),
-  rateLimitReachedType: z5.string().nullish(),
-  spendControlReached: z5.boolean().nullish()
+  rateLimitReachedType: z7.string().nullish(),
+  spendControlReached: z7.boolean().nullish()
 });
-var RateLimitResetCreditSchema = z5.object({
-  id: z5.string(),
-  grantedAt: z5.number(),
-  expiresAt: z5.number().nullish(),
-  resetType: z5.string(),
-  status: z5.string(),
-  title: z5.string().nullish(),
-  description: z5.string().nullish()
+var RateLimitResetCreditSchema = z7.object({
+  id: z7.string(),
+  grantedAt: z7.number(),
+  expiresAt: z7.number().nullish(),
+  resetType: z7.string(),
+  status: z7.string(),
+  title: z7.string().nullish(),
+  description: z7.string().nullish()
 });
-var CodexAccountSchema = z5.discriminatedUnion("type", [
-  z5.object({ type: z5.literal("apiKey") }),
-  z5.object({ type: z5.literal("chatgpt"), email: z5.string().nullable(), planType: z5.string() }),
-  z5.object({ type: z5.literal("amazonBedrock"), usesCodexManagedCredentials: z5.boolean().default(false) })
+var CodexAccountSchema = z7.discriminatedUnion("type", [
+  z7.object({ type: z7.literal("apiKey") }),
+  z7.object({ type: z7.literal("chatgpt"), email: z7.string().nullable(), planType: z7.string() }),
+  z7.object({ type: z7.literal("amazonBedrock"), usesCodexManagedCredentials: z7.boolean().default(false) })
 ]);
-var CodexAccountReadSchema = z5.object({
+var CodexAccountReadSchema = z7.object({
   account: CodexAccountSchema.nullable(),
-  requiresOpenaiAuth: z5.boolean()
+  requiresOpenaiAuth: z7.boolean()
 });
-var CodexRateLimitsReadSchema = z5.object({
+var CodexRateLimitsReadSchema = z7.object({
   rateLimits: RateLimitSnapshotSchema,
-  rateLimitsByLimitId: z5.record(z5.string(), RateLimitSnapshotSchema).nullish(),
-  rateLimitResetCredits: z5.object({ availableCount: z5.number(), credits: z5.array(RateLimitResetCreditSchema).nullish() }).nullish(),
-  accountId: z5.string().nullish(),
-  ordinaryUsageAllowed: z5.boolean().nullish()
+  rateLimitsByLimitId: z7.record(z7.string(), RateLimitSnapshotSchema).nullish(),
+  rateLimitResetCredits: z7.object({ availableCount: z7.number(), credits: z7.array(RateLimitResetCreditSchema).nullish() }).nullish(),
+  accountId: z7.string().nullish(),
+  ordinaryUsageAllowed: z7.boolean().nullish()
 });
-var CodexInitializeResultSchema = z5.object({ userAgent: z5.string() });
+var CodexInitializeResultSchema = z7.object({ userAgent: z7.string() });
 
 // src/codex/appServer.ts
 var CodexAppServerUnavailableError = class extends CliError {
@@ -11311,8 +11589,8 @@ init_cliError();
 init_realPorts();
 
 // src/frontdoor/controlApi.ts
-import { createORPCClient as createORPCClient2, ORPCError as ORPCError6 } from "@orpc/client";
-import { openapi as openapi7 } from "@orpc/openapi";
+import { createORPCClient as createORPCClient2, ORPCError as ORPCError7 } from "@orpc/client";
+import { openapi as openapi8 } from "@orpc/openapi";
 
 // src/checkReport.ts
 init_classify();
@@ -11581,19 +11859,19 @@ function writePools(paths, pools) {
   applyPatch(paths.globalConfigFile, GlobalConfigSchema, { pools }, { defaults: {} });
 }
 function poolCycleOf(pools, name) {
-  const walk = (current, path38) => {
+  const walk = (current, path39) => {
     for (const entry of pools[current]?.identities ?? []) {
       const nested = poolNameOf(poolMemberIdentity(entry));
       if (nested === void 0) {
         continue;
       }
       if (nested === name) {
-        return [...path38, nested];
+        return [...path39, nested];
       }
-      if (path38.includes(nested)) {
+      if (path39.includes(nested)) {
         continue;
       }
-      const found = walk(nested, [...path38, nested]);
+      const found = walk(nested, [...path39, nested]);
       if (found !== void 0) {
         return found;
       }
@@ -11704,7 +11982,7 @@ init_providersStore();
 init_projects();
 init_pipeline();
 import path25 from "node:path";
-import { z as z13 } from "zod";
+import { z as z15 } from "zod";
 var HISTORY_PROJECTS_KEY_PREFIX = "history/projects/";
 function projectFragmentOf(rawKey) {
   return rawKey.startsWith(HISTORY_PROJECTS_KEY_PREFIX) ? rawKey.slice(HISTORY_PROJECTS_KEY_PREFIX.length) : void 0;
@@ -11781,9 +12059,9 @@ function lookupKeychainService(run, farmRoot) {
     note: serviceName === void 0 ? `A Keychain entry was found for account "${farmRoot}" but its service name could not be parsed from security's output.` : `Keychain service name for this identity: "${serviceName}".`
   };
 }
-var SettingsSecretsShapeSchema = z13.looseObject({
-  env: z13.record(z13.string(), z13.unknown()).optional(),
-  hooks: z13.record(z13.string(), z13.array(z13.unknown())).optional()
+var SettingsSecretsShapeSchema = z15.looseObject({
+  env: z15.record(z15.string(), z15.unknown()).optional(),
+  hooks: z15.record(z15.string(), z15.array(z15.unknown())).optional()
 });
 function hookCommandCountOf(group) {
   if (typeof group !== "object" || group === null) {
@@ -12079,7 +12357,7 @@ init_schema();
 init_claudeVersion();
 init_identity();
 init_projects();
-import { z as z15 } from "zod";
+import { z as z17 } from "zod";
 
 // src/resolve/types.ts
 var LAYER_KINDS = [
@@ -12140,123 +12418,123 @@ var DIAGNOSTIC_SEVERITIES = ["error", "warning", "info"];
 
 // src/usage/pickReportSchema.ts
 init_plan2();
-import { z as z14 } from "zod";
-var PoolPickCandidateViewSchema = z14.strictObject({
-  identity: z14.string(),
+import { z as z16 } from "zod";
+var PoolPickCandidateViewSchema = z16.strictObject({
+  identity: z16.string(),
   /** In pick order: `scored` has usable quota data, `unknown` has none, `pay-per-use` bills by use, `ineligible` is refused right now. */
-  class: z14.enum(["scored", "unknown", "pay-per-use", "ineligible"]),
+  class: z16.enum(["scored", "unknown", "pay-per-use", "ineligible"]),
   /** Plan-size-weighted remaining quota per hour until its reset; present for `scored` only. */
-  score: z14.number().optional(),
+  score: z16.number().optional(),
   /** Which window's reset divides the score: the seven-day window, or the five-hour one when the member reports no seven-day utilisation or its measured-ratio five-hour term outranks the weekly one; present with `score`. */
-  scoreWindow: z14.enum(["sevenDay", "fiveHour"]).optional(),
+  scoreWindow: z16.enum(["sevenDay", "fiveHour"]).optional(),
   /** False when the five-hour window would run dry, at the observed pace, before it resets. */
-  feasible: z14.boolean(),
+  feasible: z16.boolean(),
   /** When an `ineligible` member can be used again, as an ISO instant. */
-  blockedUntil: z14.iso.datetime().optional(),
+  blockedUntil: z16.iso.datetime().optional(),
   plan: PlanClassSchema,
   /** The facts behind the class and score, in the order they matter. */
-  reasons: z14.array(z14.string())
+  reasons: z16.array(z16.string())
 });
-var PoolPickReportSchema = z14.strictObject({
-  pool: z14.string(),
-  directory: z14.string(),
+var PoolPickReportSchema = z16.strictObject({
+  pool: z16.string(),
+  directory: z16.string(),
   /** The member a launch would run as, absent when every member is refused. */
-  pick: z14.string().optional(),
-  candidates: z14.array(PoolPickCandidateViewSchema),
+  pick: z16.string().optional(),
+  candidates: z16.array(PoolPickCandidateViewSchema),
   /** Identity members anywhere in the pool's graph that do not exist; a launch skips them. */
-  missing: z14.array(z14.string()),
+  missing: z16.array(z16.string()),
   /** When nothing can be picked, the soonest any member returns. */
-  earliestReturn: z14.strictObject({ identity: z14.string(), at: z14.iso.datetime() }).optional(),
+  earliestReturn: z16.strictObject({ identity: z16.string(), at: z16.iso.datetime() }).optional(),
   /** The member a resumed conversation started on but moved off, and why, when the ranking could not keep it. */
-  movedOff: z14.strictObject({ identity: z14.string(), reason: z14.string() }).optional(),
+  movedOff: z16.strictObject({ identity: z16.string(), reason: z16.string() }).optional(),
   /** Why the last-pick record could not be read, when that is the case. */
-  stickyProblem: z14.string().optional()
+  stickyProblem: z16.string().optional()
 });
 
 // src/checkReportSchema.ts
 var CHECK_CREDENTIAL_APPLIES = ["provider", "identity", "stored-login"];
-var CheckLayerViewSchema = z15.strictObject({
-  id: z15.int(),
-  kind: z15.enum(LAYER_KINDS),
-  source: z15.string()
+var CheckLayerViewSchema = z17.strictObject({
+  id: z17.int(),
+  kind: z17.enum(LAYER_KINDS),
+  source: z17.string()
 });
-var CheckEntryViewSchema = z15.strictObject({
-  path: z15.string(),
-  shared: z15.boolean(),
-  via: z15.enum(DECISION_VIAS),
+var CheckEntryViewSchema = z17.strictObject({
+  path: z17.string(),
+  shared: z17.boolean(),
+  via: z17.enum(DECISION_VIAS),
   /** The entry's real category, or null when nothing classifies it. */
-  category: z15.enum(CATEGORY_NAMES).nullable(),
-  rule: z15.strictObject({ key: z15.string(), layer: z15.int() }).optional(),
+  category: z17.enum(CATEGORY_NAMES).nullable(),
+  rule: z17.strictObject({ key: z17.string(), layer: z17.int() }).optional(),
   /** Rules that matched but whose `when` condition failed, each with the conditions that failed. */
-  eliminated: z15.readonly(z15.array(z15.strictObject({ key: z15.string(), failed: z15.readonly(z15.array(z15.string())) }))).optional()
+  eliminated: z17.readonly(z17.array(z17.strictObject({ key: z17.string(), failed: z17.readonly(z17.array(z17.string())) }))).optional()
 });
-var CheckDiagnosticSchema = z15.strictObject({
-  code: z15.enum(DIAGNOSTIC_CODES),
-  severity: z15.enum(DIAGNOSTIC_SEVERITIES),
-  message: z15.string(),
-  subject: z15.string().optional(),
-  layer: z15.int().optional()
+var CheckDiagnosticSchema = z17.strictObject({
+  code: z17.enum(DIAGNOSTIC_CODES),
+  severity: z17.enum(DIAGNOSTIC_SEVERITIES),
+  message: z17.string(),
+  subject: z17.string().optional(),
+  layer: z17.int().optional()
 });
-var CheckAmbientCredentialSchema = z15.union([z15.strictObject({ ok: z15.literal(true) }), z15.strictObject({ ok: z15.literal(false), variable: z15.string(), message: z15.string() })]);
-var CheckKeychainSchema = z15.strictObject({
-  checked: z15.literal(true),
-  found: z15.boolean(),
-  serviceName: z15.string().optional(),
-  note: z15.string()
+var CheckAmbientCredentialSchema = z17.union([z17.strictObject({ ok: z17.literal(true) }), z17.strictObject({ ok: z17.literal(false), variable: z17.string(), message: z17.string() })]);
+var CheckKeychainSchema = z17.strictObject({
+  checked: z17.literal(true),
+  found: z17.boolean(),
+  serviceName: z17.string().optional(),
+  note: z17.string()
 });
-var CheckSettingsExposureSchema = z15.strictObject({
-  file: z15.string(),
-  envKeyNames: z15.readonly(z15.array(z15.string())),
-  hookEventNames: z15.readonly(z15.array(z15.string())),
-  hookCommandCount: z15.int().nonnegative()
+var CheckSettingsExposureSchema = z17.strictObject({
+  file: z17.string(),
+  envKeyNames: z17.readonly(z17.array(z17.string())),
+  hookEventNames: z17.readonly(z17.array(z17.string())),
+  hookCommandCount: z17.int().nonnegative()
 });
-var CredentialSourceSummarySchema = z15.union([
-  z15.strictObject({ kind: z15.literal("env"), variable: z15.string() }),
-  z15.strictObject({ kind: z15.literal("file"), path: z15.string() }),
-  z15.strictObject({ kind: z15.literal("command"), program: z15.string() }),
-  z15.strictObject({ kind: z15.literal("op"), reference: z15.string() }),
-  z15.strictObject({ kind: z15.literal("keychain"), service: z15.string(), account: z15.string().optional() }),
-  z15.strictObject({ kind: z15.literal("literal") })
+var CredentialSourceSummarySchema = z17.union([
+  z17.strictObject({ kind: z17.literal("env"), variable: z17.string() }),
+  z17.strictObject({ kind: z17.literal("file"), path: z17.string() }),
+  z17.strictObject({ kind: z17.literal("command"), program: z17.string() }),
+  z17.strictObject({ kind: z17.literal("op"), reference: z17.string() }),
+  z17.strictObject({ kind: z17.literal("keychain"), service: z17.string(), account: z17.string().optional() }),
+  z17.strictObject({ kind: z17.literal("literal") })
 ]);
-var CredentialSummarySchema = z15.strictObject({
-  target: z15.enum(CREDENTIAL_TARGETS),
-  sources: z15.readonly(z15.array(CredentialSourceSummarySchema)),
+var CredentialSummarySchema = z17.strictObject({
+  target: z17.enum(CREDENTIAL_TARGETS),
+  sources: z17.readonly(z17.array(CredentialSourceSummarySchema)),
   cache: CredentialCacheSchema.optional()
 });
-var CachedCredentialStateSchema = z15.union([
-  z15.strictObject({ store: z15.enum(CREDENTIAL_CACHE_STORES), status: z15.literal("empty") }),
-  z15.strictObject({ store: z15.enum(CREDENTIAL_CACHE_STORES), status: z15.literal("unreadable"), reason: z15.string() }),
-  z15.strictObject({ store: z15.enum(CREDENTIAL_CACHE_STORES), status: z15.enum(["fresh", "expired"]), ageMs: z15.number(), expiresInMs: z15.number().optional() })
+var CachedCredentialStateSchema = z17.union([
+  z17.strictObject({ store: z17.enum(CREDENTIAL_CACHE_STORES), status: z17.literal("empty") }),
+  z17.strictObject({ store: z17.enum(CREDENTIAL_CACHE_STORES), status: z17.literal("unreadable"), reason: z17.string() }),
+  z17.strictObject({ store: z17.enum(CREDENTIAL_CACHE_STORES), status: z17.enum(["fresh", "expired"]), ageMs: z17.number(), expiresInMs: z17.number().optional() })
 ]);
-var CheckCredentialProviderSchema = z15.union([
-  z15.strictObject({ name: z15.string(), credential: CredentialSummarySchema, cached: CachedCredentialStateSchema.optional() }),
-  z15.strictObject({ name: z15.string(), problem: z15.string() })
+var CheckCredentialProviderSchema = z17.union([
+  z17.strictObject({ name: z17.string(), credential: CredentialSummarySchema, cached: CachedCredentialStateSchema.optional() }),
+  z17.strictObject({ name: z17.string(), problem: z17.string() })
 ]);
-var CheckCredentialSchema = z15.strictObject({
-  applies: z15.enum(CHECK_CREDENTIAL_APPLIES),
+var CheckCredentialSchema = z17.strictObject({
+  applies: z17.enum(CHECK_CREDENTIAL_APPLIES),
   provider: CheckCredentialProviderSchema.optional(),
   identity: CredentialSummarySchema.optional(),
   identityCached: CachedCredentialStateSchema.optional()
 });
-var CheckClaudeVersionSchema = z15.strictObject({
-  pinned: z15.strictObject({ version: z15.string(), source: z15.enum(CLAUDE_VERSION_SOURCES), installed: z15.boolean() }).optional(),
-  highestInstalled: z15.string().optional(),
-  installed: z15.readonly(z15.array(z15.string()))
+var CheckClaudeVersionSchema = z17.strictObject({
+  pinned: z17.strictObject({ version: z17.string(), source: z17.enum(CLAUDE_VERSION_SOURCES), installed: z17.boolean() }).optional(),
+  highestInstalled: z17.string().optional(),
+  installed: z17.readonly(z17.array(z17.string()))
 });
-var CheckReportJsonSchema = z15.strictObject({
-  identity: z15.strictObject({ name: z15.string().nullable(), source: z15.enum(IDENTITY_DECISION_SOURCES) }),
+var CheckReportJsonSchema = z17.strictObject({
+  identity: z17.strictObject({ name: z17.string().nullable(), source: z17.enum(IDENTITY_DECISION_SOURCES) }),
   /** The pool ranking, when the launch named a pool instead of an identity. */
   pool: PoolPickReportSchema.optional(),
-  configProfile: z15.strictObject({ name: z15.string().nullable(), source: z15.enum(CONFIG_PROFILE_DECISION_SOURCES) }),
-  layers: z15.readonly(z15.array(CheckLayerViewSchema)),
-  entries: z15.readonly(z15.array(CheckEntryViewSchema)),
-  projectEncodingAmbiguities: z15.readonly(
-    z15.array(z15.strictObject({ fragment: z15.string(), encoded: z15.string(), reason: z15.enum(ENCODING_AMBIGUITY_REASONS), detail: z15.string() }))
+  configProfile: z17.strictObject({ name: z17.string().nullable(), source: z17.enum(CONFIG_PROFILE_DECISION_SOURCES) }),
+  layers: z17.readonly(z17.array(CheckLayerViewSchema)),
+  entries: z17.readonly(z17.array(CheckEntryViewSchema)),
+  projectEncodingAmbiguities: z17.readonly(
+    z17.array(z17.strictObject({ fragment: z17.string(), encoded: z17.string(), reason: z17.enum(ENCODING_AMBIGUITY_REASONS), detail: z17.string() }))
   ),
-  diagnostics: z15.readonly(z15.array(CheckDiagnosticSchema)),
+  diagnostics: z17.readonly(z17.array(CheckDiagnosticSchema)),
   ambientCredential: CheckAmbientCredentialSchema,
   keychain: CheckKeychainSchema.optional(),
-  settingsExposure: z15.readonly(z15.array(CheckSettingsExposureSchema)),
+  settingsExposure: z17.readonly(z17.array(CheckSettingsExposureSchema)),
   credential: CheckCredentialSchema,
   claudeVersion: CheckClaudeVersionSchema.optional()
 });
@@ -12316,28 +12594,28 @@ function collectResets(snapshots, nowMs) {
 }
 
 // src/usage/resetsSchema.ts
-import { z as z16 } from "zod";
-var ResetRowSchema = z16.strictObject({
-  identity: z16.string(),
-  provider: z16.string(),
+import { z as z18 } from "zod";
+var ResetRowSchema = z18.strictObject({
+  identity: z18.string(),
+  provider: z18.string(),
   /** What the window is: `5h`, `7d` or `extra usage` for an Anthropic account, or the provider's own measure and period (`tokens 5h`). */
-  window: z16.string(),
+  window: z18.string(),
   /** When the state the window comes from was observed, as an ISO instant. */
-  observedAt: z16.iso.datetime(),
+  observedAt: z18.iso.datetime(),
   /** When the window resets, as an ISO instant; absent when the upstream reported none. */
-  resetsAt: z16.iso.datetime().optional(),
+  resetsAt: z18.iso.datetime().optional(),
   /** True when the reset time has passed, so the recorded observation describes a window that no longer exists and its utilisation reads as 0. */
-  reset: z16.boolean(),
+  reset: z18.boolean(),
   /** The fraction used, as `effectiveWindow` reads it at the report's own clock. */
-  utilization: z16.number().optional(),
+  utilization: z18.number().optional(),
   /** The window's own status, for a window that has not reset yet. */
-  status: z16.string().optional()
+  status: z18.string().optional()
 });
-var ResetScheduleSchema = z16.strictObject({ resets: z16.readonly(z16.array(ResetRowSchema)) });
+var ResetScheduleSchema = z18.strictObject({ resets: z18.readonly(z18.array(ResetRowSchema)) });
 
 // src/frontdoor/controlSchemas.ts
 import path30 from "node:path";
-import { z as z21 } from "zod";
+import { z as z23 } from "zod";
 
 // src/doctorReport.ts
 init_claudeShim();
@@ -12538,24 +12816,24 @@ function credentialsFilePath(farmRoot) {
 }
 
 // src/codex/siwcStore.ts
-import { z as z20 } from "zod";
+import { z as z22 } from "zod";
 
 // src/codex/auth.ts
-import { z as z18 } from "zod";
-var AuthFileSchema = z18.looseObject({
-  tokens: z18.looseObject({
-    access_token: z18.string().optional(),
-    refresh_token: z18.string().optional(),
-    id_token: z18.string().optional(),
-    account_id: z18.string().optional()
+import { z as z20 } from "zod";
+var AuthFileSchema = z20.looseObject({
+  tokens: z20.looseObject({
+    access_token: z20.string().optional(),
+    refresh_token: z20.string().optional(),
+    id_token: z20.string().optional(),
+    account_id: z20.string().optional()
   }).nullish(),
-  last_refresh: z18.string().optional()
+  last_refresh: z20.string().optional()
 });
-var TokenGrantSchema = z18.looseObject({
-  access_token: z18.string().min(1).optional(),
-  refresh_token: z18.string().min(1).optional(),
-  id_token: z18.string().min(1).optional(),
-  account_id: z18.string().min(1).optional()
+var TokenGrantSchema = z20.looseObject({
+  access_token: z20.string().min(1).optional(),
+  refresh_token: z20.string().min(1).optional(),
+  id_token: z20.string().min(1).optional(),
+  account_id: z20.string().min(1).optional()
 });
 var CodexAuthError = class extends Error {
   constructor(message) {
@@ -12565,41 +12843,41 @@ var CodexAuthError = class extends Error {
 };
 
 // src/codex/siwc.ts
-import { z as z19 } from "zod";
+import { z as z21 } from "zod";
 var SIWC_RESOURCE = "https://api.openai.com/v1";
 var SIWC_RESPONSES_URL = `${SIWC_RESOURCE}/responses`;
 var SIWC_PLAN_SCOPE = "chatgpt.tokens.use.direct";
-var TokenResponseSchema = z19.looseObject({
-  access_token: z19.string().min(1),
-  refresh_token: z19.string().min(1).optional(),
-  id_token: z19.string().min(1).optional(),
-  expires_in: z19.number().positive(),
-  scope: z19.string().optional()
+var TokenResponseSchema = z21.looseObject({
+  access_token: z21.string().min(1),
+  refresh_token: z21.string().min(1).optional(),
+  id_token: z21.string().min(1).optional(),
+  expires_in: z21.number().positive(),
+  scope: z21.string().optional()
 });
-var JwtHeaderSchema = z19.looseObject({ alg: z19.string(), kid: z19.string().optional() });
-var IdTokenClaimsSchema = z19.looseObject({
-  iss: z19.string(),
-  sub: z19.string().min(1),
-  aud: z19.union([z19.string(), z19.array(z19.string())]),
-  exp: z19.number(),
-  nonce: z19.string().optional(),
-  email: z19.string().optional()
+var JwtHeaderSchema = z21.looseObject({ alg: z21.string(), kid: z21.string().optional() });
+var IdTokenClaimsSchema = z21.looseObject({
+  iss: z21.string(),
+  sub: z21.string().min(1),
+  aud: z21.union([z21.string(), z21.array(z21.string())]),
+  exp: z21.number(),
+  nonce: z21.string().optional(),
+  email: z21.string().optional()
 });
-var JwksSchema = z19.object({ keys: z19.array(z19.looseObject({ kid: z19.string().optional(), kty: z19.string() })) });
+var JwksSchema = z21.object({ keys: z21.array(z21.looseObject({ kid: z21.string().optional(), kty: z21.string() })) });
 
 // src/codex/siwcStore.ts
-var SiwcGrantSchema = z20.strictObject({
-  clientId: z20.string().min(1),
-  sub: z20.string().min(1),
-  email: z20.string().optional(),
-  idToken: z20.string().min(1),
-  accessToken: z20.string().min(1),
-  refreshToken: z20.string().min(1),
-  scopes: z20.array(z20.string()).readonly(),
+var SiwcGrantSchema = z22.strictObject({
+  clientId: z22.string().min(1),
+  sub: z22.string().min(1),
+  email: z22.string().optional(),
+  idToken: z22.string().min(1),
+  accessToken: z22.string().min(1),
+  refreshToken: z22.string().min(1),
+  scopes: z22.array(z22.string()).readonly(),
   /** When the access token stops working, in milliseconds since the epoch. */
-  expiresAt: z20.number()
+  expiresAt: z22.number()
 });
-var SiwcFileSchema = z20.strictObject({ registeredClientId: z20.string().min(1).optional(), grant: SiwcGrantSchema.optional() });
+var SiwcFileSchema = z22.strictObject({ registeredClientId: z22.string().min(1).optional(), grant: SiwcGrantSchema.optional() });
 function parseSiwcFile(raw, filePath) {
   let json;
   try {
@@ -13296,90 +13574,90 @@ function collectDoctorReport(params) {
 // src/frontdoor/controlSchemas.ts
 init_schema2();
 init_state();
-var UsageListOutputSchema = z21.strictObject({ snapshots: z21.readonly(z21.array(UsageSnapshotSchema)) });
-var UsageWindowsInputSchema = z21.strictObject({
-  identity: z21.string().min(1),
-  provider: z21.string().min(1).optional()
+var UsageListOutputSchema = z23.strictObject({ snapshots: z23.readonly(z23.array(UsageSnapshotSchema)) });
+var UsageWindowsInputSchema = z23.strictObject({
+  identity: z23.string().min(1),
+  provider: z23.string().min(1).optional()
 });
-var EffectiveWindowSchema = z21.strictObject({
+var EffectiveWindowSchema = z23.strictObject({
   /** True when the window's reset time has passed, so the recorded observation describes a window that no longer exists. */
-  reset: z21.boolean(),
+  reset: z23.boolean(),
   /** The fraction used: 0 for a reset window, otherwise what was last observed, absent when none was reported. */
-  utilization: z21.number().optional(),
+  utilization: z23.number().optional(),
   /** The reset instant, for a window that has not reset yet and reported one. */
-  resetsAtMs: z21.number().optional(),
+  resetsAtMs: z23.number().optional(),
   /** The window's own status, for a window that has not reset yet. */
-  status: z21.string().optional()
+  status: z23.string().optional()
 });
-var UsageWindowsOutputSchema = z21.strictObject({
-  identity: z21.string(),
-  provider: z21.string(),
+var UsageWindowsOutputSchema = z23.strictObject({
+  identity: z23.string(),
+  provider: z23.string(),
   /** When the rate-limit state the windows come from was observed. */
-  observedAt: z21.iso.datetime().optional(),
+  observedAt: z23.iso.datetime().optional(),
   fiveHour: EffectiveWindowSchema.optional(),
   sevenDay: EffectiveWindowSchema.optional()
 });
-var UsageLiveOutputSchema = z21.strictObject({
+var UsageLiveOutputSchema = z23.strictObject({
   /** The freshest observation the door holds, never narrowed by the read's session filter because it is the door's single latest statement of the account's quota; absent while no rate_limit_event has been filed at all. */
   latest: RcLiveRateLimitSchema.optional(),
   /** One observation per session whose stream has filed a rate_limit_event this door generation. */
-  sessions: z21.readonly(z21.array(RcLiveRateLimitSchema))
+  sessions: z23.readonly(z23.array(RcLiveRateLimitSchema))
 });
-var FrontDoorSessionStatusSchema = z21.strictObject({
-  pid: z21.int().positive(),
-  startedAt: z21.number(),
-  alive: z21.boolean()
+var FrontDoorSessionStatusSchema = z23.strictObject({
+  pid: z23.int().positive(),
+  startedAt: z23.number(),
+  alive: z23.boolean()
 });
-var HeadroomSocketTargetSchema = z21.union([z21.strictObject({ socketPath: z21.string() }), z21.strictObject({ refused: z21.string() })]);
-var FrontDoorStatusOutputSchema = z21.strictObject({
+var HeadroomSocketTargetSchema = z23.union([z23.strictObject({ socketPath: z23.string() }), z23.strictObject({ refused: z23.string() })]);
+var FrontDoorStatusOutputSchema = z23.strictObject({
   state: FrontDoorStateSchema,
-  supervisorAlive: z21.boolean(),
-  sessions: z21.readonly(z21.array(FrontDoorSessionStatusSchema)),
+  supervisorAlive: z23.boolean(),
+  sessions: z23.readonly(z23.array(FrontDoorSessionStatusSchema)),
   headroomSocket: HeadroomSocketTargetSchema.optional(),
-  logPath: z21.string(),
-  logExists: z21.boolean()
+  logPath: z23.string(),
+  logExists: z23.boolean()
 });
-var FrontDoorSessionsOutputSchema = z21.strictObject({ sessions: z21.readonly(z21.array(FrontDoorSessionStatusSchema)) });
-var CheckRunInputSchema = z21.strictObject({
-  path: z21.string().min(1),
-  identity: z21.string().min(1).optional()
+var FrontDoorSessionsOutputSchema = z23.strictObject({ sessions: z23.readonly(z23.array(FrontDoorSessionStatusSchema)) });
+var CheckRunInputSchema = z23.strictObject({
+  path: z23.string().min(1),
+  identity: z23.string().min(1).optional()
 }).refine((input) => path30.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
-var PoolPickInputSchema = z21.strictObject({
-  pool: z21.string().min(1),
-  path: z21.string().min(1)
+var PoolPickInputSchema = z23.strictObject({
+  pool: z23.string().min(1),
+  path: z23.string().min(1)
 }).refine((input) => path30.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
-var DoctorFindingSchema = z21.strictObject({
-  section: z21.enum(DOCTOR_SECTIONS),
-  subject: z21.string().optional(),
-  severity: z21.enum(DOCTOR_SEVERITIES),
-  message: z21.string()
+var DoctorFindingSchema = z23.strictObject({
+  section: z23.enum(DOCTOR_SECTIONS),
+  subject: z23.string().optional(),
+  severity: z23.enum(DOCTOR_SEVERITIES),
+  message: z23.string()
 });
-var DoctorRunOutputSchema = z21.strictObject({
+var DoctorRunOutputSchema = z23.strictObject({
   /** False exactly when any finding is a `fail`; a `warn` never fails the report on its own. */
-  ok: z21.boolean(),
-  findings: z21.readonly(z21.array(DoctorFindingSchema))
+  ok: z23.boolean(),
+  findings: z23.readonly(z23.array(DoctorFindingSchema))
 });
-var FrontDoorRestartOutputSchema = z21.strictObject({
-  action: z21.literal("restarting"),
-  previousPid: z21.int().positive()
+var FrontDoorRestartOutputSchema = z23.strictObject({
+  action: z23.literal("restarting"),
+  previousPid: z23.int().positive()
 });
-var UpdateCheckOutputSchema = z21.strictObject({
-  current: z21.string(),
-  latest: z21.string(),
-  action: z21.enum(["current", "available", "updated"])
+var UpdateCheckOutputSchema = z23.strictObject({
+  current: z23.string(),
+  latest: z23.string(),
+  action: z23.enum(["current", "available", "updated"])
 });
-var CodexSignInSchema = z21.discriminatedUnion("state", [
-  z21.strictObject({ state: z21.literal("none") }),
-  z21.strictObject({ state: z21.literal("signed-in"), email: z21.string().optional(), planScope: z21.boolean(), accessTokenExpiresAt: z21.number() }),
-  z21.strictObject({ state: z21.literal("unreadable"), message: z21.string() })
+var CodexSignInSchema = z23.discriminatedUnion("state", [
+  z23.strictObject({ state: z23.literal("none") }),
+  z23.strictObject({ state: z23.literal("signed-in"), email: z23.string().optional(), planScope: z23.boolean(), accessTokenExpiresAt: z23.number() }),
+  z23.strictObject({ state: z23.literal("unreadable"), message: z23.string() })
 ]);
-var CodexStatusOutputSchema = z21.strictObject({
+var CodexStatusOutputSchema = z23.strictObject({
   signIn: CodexSignInSchema,
-  codexProviders: z21.readonly(z21.array(z21.string()))
+  codexProviders: z23.readonly(z23.array(z23.string()))
 });
-var CodexLogoutOutputSchema = z21.strictObject({
-  hadGrant: z21.boolean(),
-  revoked: z21.boolean()
+var CodexLogoutOutputSchema = z23.strictObject({
+  hadGrant: z23.boolean(),
+  revoked: z23.boolean()
 });
 
 // src/frontdoor/codexApi.ts
@@ -13536,133 +13814,133 @@ init_providersStore();
 
 // src/frontdoor/configSchemas.ts
 init_schema();
-import { z as z22 } from "zod";
-var RemovalConfirmationSchema = z22.boolean();
-var CredentialWriteSchema = (targets) => z22.strictObject({
-  sources: z22.array(RemoteCredentialSourceSchema).min(1).optional(),
-  target: z22.enum(targets).optional(),
-  cache: z22.union([z22.literal(false), CredentialCacheSchema]).optional()
+import { z as z24 } from "zod";
+var RemovalConfirmationSchema = z24.boolean();
+var CredentialWriteSchema = (targets) => z24.strictObject({
+  sources: z24.array(RemoteCredentialSourceSchema).min(1).optional(),
+  target: z24.enum(targets).optional(),
+  cache: z24.union([z24.literal(false), CredentialCacheSchema]).optional()
 });
-var CredentialSummarySchema2 = z22.strictObject({
-  target: z22.enum(CREDENTIAL_TARGETS),
-  sources: z22.readonly(z22.array(
-    z22.discriminatedUnion("kind", [
-      z22.strictObject({ kind: z22.literal("env"), variable: z22.string() }),
-      z22.strictObject({ kind: z22.literal("file"), path: z22.string() }),
-      z22.strictObject({ kind: z22.literal("command"), program: z22.string() }),
-      z22.strictObject({ kind: z22.literal("op"), reference: z22.string() }),
-      z22.strictObject({ kind: z22.literal("keychain"), service: z22.string(), account: z22.string().optional() }),
-      z22.strictObject({ kind: z22.literal("literal") })
+var CredentialSummarySchema2 = z24.strictObject({
+  target: z24.enum(CREDENTIAL_TARGETS),
+  sources: z24.readonly(z24.array(
+    z24.discriminatedUnion("kind", [
+      z24.strictObject({ kind: z24.literal("env"), variable: z24.string() }),
+      z24.strictObject({ kind: z24.literal("file"), path: z24.string() }),
+      z24.strictObject({ kind: z24.literal("command"), program: z24.string() }),
+      z24.strictObject({ kind: z24.literal("op"), reference: z24.string() }),
+      z24.strictObject({ kind: z24.literal("keychain"), service: z24.string(), account: z24.string().optional() }),
+      z24.strictObject({ kind: z24.literal("literal") })
     ])
   )),
   cache: CredentialCacheSchema.optional()
 });
-var mutationOutput = (kind, action) => z22.strictObject({ action: z22.literal(action), kind: z22.literal(kind), name: z22.string() });
-var storedMutationOutput = (kind, action, value) => z22.strictObject({ action: z22.literal(action), kind: z22.literal(kind), name: z22.string(), value });
-var IdentityValueSchema = z22.strictObject({
-  name: z22.string(),
-  defaultConfigProfile: z22.string().optional(),
-  allowAmbientCredential: z22.boolean(),
+var mutationOutput = (kind, action) => z24.strictObject({ action: z24.literal(action), kind: z24.literal(kind), name: z24.string() });
+var storedMutationOutput = (kind, action, value) => z24.strictObject({ action: z24.literal(action), kind: z24.literal(kind), name: z24.string(), value });
+var IdentityValueSchema = z24.strictObject({
+  name: z24.string(),
+  defaultConfigProfile: z24.string().optional(),
+  allowAmbientCredential: z24.boolean(),
   credential: CredentialSummarySchema2.optional(),
-  anchors: z22.array(AnchorSchema).optional()
+  anchors: z24.array(AnchorSchema).optional()
 });
 var ProfileValueSchema = ConfigProfileSchema.omit({ $schema: true });
-var ProviderValueSchema = z22.strictObject({
-  name: z22.string(),
-  kind: z22.enum(PROVIDER_KINDS),
-  displayName: z22.string(),
-  baseUrl: z22.string().optional(),
+var ProviderValueSchema = z24.strictObject({
+  name: z24.string(),
+  kind: z24.enum(PROVIDER_KINDS),
+  displayName: z24.string(),
+  baseUrl: z24.string().optional(),
   codex: CodexProviderConfigSchema.optional(),
   credential: CredentialSummarySchema2,
-  env: z22.record(z22.string(), z22.string()).optional()
+  env: z24.record(z24.string(), z24.string()).optional()
 });
-var ConfigNameInputSchema = z22.strictObject({ name: z22.string().min(1) });
+var ConfigNameInputSchema = z24.strictObject({ name: z24.string().min(1) });
 var ConfigIdentityAddOutputSchema = storedMutationOutput("identity", "created", IdentityValueSchema);
-var ConfigIdentitySetInputSchema = z22.strictObject({
-  name: z22.string().min(1),
-  defaultConfigProfile: z22.union([z22.string().min(1), z22.literal(false)]).optional(),
-  allowAmbientCredential: z22.boolean().optional(),
-  credential: z22.union([z22.literal(false), CredentialWriteSchema(CREDENTIAL_TARGETS)]).optional(),
+var ConfigIdentitySetInputSchema = z24.strictObject({
+  name: z24.string().min(1),
+  defaultConfigProfile: z24.union([z24.string().min(1), z24.literal(false)]).optional(),
+  allowAmbientCredential: z24.boolean().optional(),
+  credential: z24.union([z24.literal(false), CredentialWriteSchema(CREDENTIAL_TARGETS)]).optional(),
   /** `false` removes the anchors; a list replaces them. */
-  anchors: z22.union([z22.literal(false), z22.array(AnchorSchema).min(1)]).optional()
+  anchors: z24.union([z24.literal(false), z24.array(AnchorSchema).min(1)]).optional()
 });
 var ConfigIdentitySetOutputSchema = storedMutationOutput("identity", "updated", IdentityValueSchema);
-var ConfigIdentityRemoveInputSchema = z22.strictObject({ name: z22.string().min(1), confirm: RemovalConfirmationSchema });
+var ConfigIdentityRemoveInputSchema = z24.strictObject({ name: z24.string().min(1), confirm: RemovalConfirmationSchema });
 var ConfigIdentityRemoveOutputSchema = mutationOutput("identity", "removed");
 var ConfigIdentityUseOutputSchema = mutationOutput("identity", "selected");
-var ConfigProfileAddInputSchema = z22.strictObject({
-  name: z22.string().min(1),
-  extends: z22.array(z22.string().min(1)).optional(),
-  description: z22.string().optional()
+var ConfigProfileAddInputSchema = z24.strictObject({
+  name: z24.string().min(1),
+  extends: z24.array(z24.string().min(1)).optional(),
+  description: z24.string().optional()
 });
 var ConfigProfileAddOutputSchema = storedMutationOutput("profile", "created", ProfileValueSchema);
-var ConfigProfileSetInputSchema = z22.strictObject({
-  name: z22.string().min(1),
-  category: z22.record(z22.string(), z22.boolean()).optional(),
-  entry: z22.record(z22.string(), z22.boolean()).optional(),
-  extends: z22.union([z22.array(z22.string().min(1)), z22.literal(false)]).optional(),
-  description: z22.union([z22.string(), z22.literal(false)]).optional(),
-  launch: z22.strictObject({
-    skipPermissions: z22.boolean().optional(),
-    remoteControl: z22.boolean().optional(),
-    headroom: z22.boolean().optional(),
-    trackUsage: z22.boolean().optional(),
-    provider: z22.union([z22.string().min(1), z22.literal(false)]).optional(),
-    claudeVersion: z22.union([z22.string().min(1), z22.literal(false)]).optional()
+var ConfigProfileSetInputSchema = z24.strictObject({
+  name: z24.string().min(1),
+  category: z24.record(z24.string(), z24.boolean()).optional(),
+  entry: z24.record(z24.string(), z24.boolean()).optional(),
+  extends: z24.union([z24.array(z24.string().min(1)), z24.literal(false)]).optional(),
+  description: z24.union([z24.string(), z24.literal(false)]).optional(),
+  launch: z24.strictObject({
+    skipPermissions: z24.boolean().optional(),
+    remoteControl: z24.boolean().optional(),
+    headroom: z24.boolean().optional(),
+    trackUsage: z24.boolean().optional(),
+    provider: z24.union([z24.string().min(1), z24.literal(false)]).optional(),
+    claudeVersion: z24.union([z24.string().min(1), z24.literal(false)]).optional()
   }).optional()
 });
 var ConfigProfileSetOutputSchema = storedMutationOutput("profile", "updated", ProfileValueSchema);
-var ConfigProfileRemoveInputSchema = z22.strictObject({ name: z22.string().min(1), confirm: RemovalConfirmationSchema });
+var ConfigProfileRemoveInputSchema = z24.strictObject({ name: z24.string().min(1), confirm: RemovalConfirmationSchema });
 var ConfigProfileRemoveOutputSchema = mutationOutput("profile", "removed");
 var ConfigProfileUseOutputSchema = mutationOutput("profile", "selected");
-var PoolMembersInputSchema = z22.array(z22.string().min(1)).min(1);
-var ConfigPoolAddInputSchema = z22.strictObject({
-  name: z22.string().min(1),
+var PoolMembersInputSchema = z24.array(z24.string().min(1)).min(1);
+var ConfigPoolAddInputSchema = z24.strictObject({
+  name: z24.string().min(1),
   identities: PoolMembersInputSchema,
-  preference: z22.enum(POOL_PREFERENCES).optional()
+  preference: z24.enum(POOL_PREFERENCES).optional()
 });
 var ConfigPoolAddOutputSchema = storedMutationOutput("pool", "created", PoolSchema);
-var ConfigPoolSetInputSchema = z22.strictObject({
-  name: z22.string().min(1),
+var ConfigPoolSetInputSchema = z24.strictObject({
+  name: z24.string().min(1),
   identities: PoolMembersInputSchema.optional(),
-  preference: z22.union([z22.enum(POOL_PREFERENCES), z22.literal(false)]).optional()
+  preference: z24.union([z24.enum(POOL_PREFERENCES), z24.literal(false)]).optional()
 });
 var ConfigPoolSetOutputSchema = storedMutationOutput("pool", "updated", PoolSchema);
-var ConfigPoolRemoveInputSchema = z22.strictObject({ name: z22.string().min(1), confirm: RemovalConfirmationSchema });
+var ConfigPoolRemoveInputSchema = z24.strictObject({ name: z24.string().min(1), confirm: RemovalConfirmationSchema });
 var ConfigPoolRemoveOutputSchema = mutationOutput("pool", "removed");
 var ConfigPoolUseOutputSchema = mutationOutput("pool", "selected");
-var ConfigProviderAddInputSchema = z22.strictObject({
-  name: z22.string().min(1),
-  kind: z22.enum(PROVIDER_KINDS).optional(),
-  displayName: z22.string().min(1),
-  baseUrl: z22.string().min(1).optional(),
+var ConfigProviderAddInputSchema = z24.strictObject({
+  name: z24.string().min(1),
+  kind: z24.enum(PROVIDER_KINDS).optional(),
+  displayName: z24.string().min(1),
+  baseUrl: z24.string().min(1).optional(),
   credential: CredentialWriteSchema(PROVIDER_CREDENTIAL_TARGETS).required({ sources: true }),
   codex: CodexProviderConfigSchema.optional()
 });
 var ConfigProviderAddOutputSchema = storedMutationOutput("provider", "created", ProviderValueSchema);
-var ConfigProviderSetInputSchema = z22.strictObject({
-  name: z22.string().min(1),
-  displayName: z22.string().min(1).optional(),
-  baseUrl: z22.string().min(1).optional(),
+var ConfigProviderSetInputSchema = z24.strictObject({
+  name: z24.string().min(1),
+  displayName: z24.string().min(1).optional(),
+  baseUrl: z24.string().min(1).optional(),
   credential: CredentialWriteSchema(PROVIDER_CREDENTIAL_TARGETS).optional(),
   codex: CodexProviderConfigSchema.optional()
 });
 var ConfigProviderSetOutputSchema = storedMutationOutput("provider", "updated", ProviderValueSchema);
-var ConfigProviderRemoveInputSchema = z22.strictObject({ name: z22.string().min(1), confirm: RemovalConfirmationSchema });
+var ConfigProviderRemoveInputSchema = z24.strictObject({ name: z24.string().min(1), confirm: RemovalConfirmationSchema });
 var ConfigProviderRemoveOutputSchema = mutationOutput("provider", "removed");
-var ConfigRuleAddInputSchema = z22.strictObject({
-  path: z22.string().min(1),
-  configProfile: z22.string().min(1).optional(),
-  identity: z22.string().min(1).optional()
+var ConfigRuleAddInputSchema = z24.strictObject({
+  path: z24.string().min(1),
+  configProfile: z24.string().min(1).optional(),
+  identity: z24.string().min(1).optional()
 });
 var ConfigRuleAddOutputSchema = storedMutationOutput("rule", "created", DirectoryRuleSchema);
-var ConfigRuleSetInputSchema = z22.strictObject({
-  path: z22.string().min(1),
-  configProfile: z22.union([z22.string().min(1), z22.literal(false)]).optional(),
-  identity: z22.union([z22.string().min(1), z22.literal(false)]).optional()
+var ConfigRuleSetInputSchema = z24.strictObject({
+  path: z24.string().min(1),
+  configProfile: z24.union([z24.string().min(1), z24.literal(false)]).optional(),
+  identity: z24.union([z24.string().min(1), z24.literal(false)]).optional()
 });
 var ConfigRuleSetOutputSchema = storedMutationOutput("rule", "updated", DirectoryRuleSchema);
-var ConfigRuleRemoveInputSchema = z22.strictObject({ path: z22.string().min(1), confirm: RemovalConfirmationSchema });
+var ConfigRuleRemoveInputSchema = z24.strictObject({ path: z24.string().min(1), confirm: RemovalConfirmationSchema });
 var ConfigRuleRemoveOutputSchema = mutationOutput("rule", "removed");
 
 // src/frontdoor/configApi.ts
@@ -13727,7 +14005,7 @@ function profileValue(name, paths) {
 function createConfigApiRouter(deps) {
   const authed = doorApiAuth(deps.expectedToken);
   const { paths } = deps;
-  const route = (path38, summary) => authed.meta(openapi3({ method: "POST", path: path38, summary, tags: [CONFIG_API_TAG] }));
+  const route = (path39, summary) => authed.meta(openapi3({ method: "POST", path: path39, summary, tags: [CONFIG_API_TAG] }));
   return {
     config: {
       identity: {
@@ -13972,43 +14250,43 @@ import { openapi as openapi4 } from "@orpc/openapi";
 import { eventIterator as eventIterator2, withEventMeta as withEventMeta2 } from "@orpc/server";
 
 // src/frontdoor/eventSchemas.ts
-import { z as z23 } from "zod";
+import { z as z25 } from "zod";
 var DOOR_EVENT_SOURCE_RC = "rc";
 var LAUNCH_EVENT_SOURCE = "launch";
 var USAGE_EVENT_SOURCE = "usage";
 var DOOR_HEALTH_EVENT_SOURCE = "door";
 var QUOTA_EXPIRING_EVENT_SOURCE = "quota-expiring";
-var DoorEventSchema = z23.strictObject({
-  source: z23.string().min(1),
+var DoorEventSchema = z25.strictObject({
+  source: z25.string().min(1),
   /** A positive integer because the backbone's counters start at one and only ever increase. */
-  sequence: z23.number().int().positive(),
-  payload: z23.unknown()
+  sequence: z25.number().int().positive(),
+  payload: z25.unknown()
 });
-var DoorEventSourceQuerySchema = z23.strictObject({
-  sources: z23.array(z23.string().min(1)).min(1).optional()
+var DoorEventSourceQuerySchema = z25.strictObject({
+  sources: z25.array(z25.string().min(1)).min(1).optional()
 });
-var LaunchLifecycleEventSchema = z23.strictObject({
-  kind: z23.enum(["registered", "pruned", "ended"]),
-  pid: z23.number().int().positive(),
-  startedAt: z23.number(),
-  observedAt: z23.number()
+var LaunchLifecycleEventSchema = z25.strictObject({
+  kind: z25.enum(["registered", "pruned", "ended"]),
+  pid: z25.number().int().positive(),
+  startedAt: z25.number(),
+  observedAt: z25.number()
 });
-var DoorHealthEventSchema = z23.discriminatedUnion("kind", [
-  z23.strictObject({ kind: z23.literal("generation"), pid: z23.number().int().positive(), providerPort: z23.number().int().positive(), connectPort: z23.number().int().positive(), directPort: z23.number().int().positive(), observedAt: z23.number() }),
-  z23.strictObject({ kind: z23.literal("listenerFailed"), pid: z23.number().int().positive(), listener: z23.enum(["provider", "connect", "direct"]), message: z23.string(), observedAt: z23.number() }),
-  z23.strictObject({ kind: z23.literal("binaryTurnover"), pid: z23.number().int().positive(), observedAt: z23.number() }),
-  z23.strictObject({ kind: z23.literal("idleShutdown"), pid: z23.number().int().positive(), observedAt: z23.number() }),
-  z23.strictObject({ kind: z23.literal("superseded"), pid: z23.number().int().positive(), ownerPid: z23.number().int().positive(), observedAt: z23.number() }),
-  z23.strictObject({ kind: z23.literal("drained"), pid: z23.number().int().positive(), observedAt: z23.number() })
+var DoorHealthEventSchema = z25.discriminatedUnion("kind", [
+  z25.strictObject({ kind: z25.literal("generation"), pid: z25.number().int().positive(), providerPort: z25.number().int().positive(), connectPort: z25.number().int().positive(), directPort: z25.number().int().positive(), observedAt: z25.number() }),
+  z25.strictObject({ kind: z25.literal("listenerFailed"), pid: z25.number().int().positive(), listener: z25.enum(["provider", "connect", "direct"]), message: z25.string(), observedAt: z25.number() }),
+  z25.strictObject({ kind: z25.literal("binaryTurnover"), pid: z25.number().int().positive(), observedAt: z25.number() }),
+  z25.strictObject({ kind: z25.literal("idleShutdown"), pid: z25.number().int().positive(), observedAt: z25.number() }),
+  z25.strictObject({ kind: z25.literal("superseded"), pid: z25.number().int().positive(), ownerPid: z25.number().int().positive(), observedAt: z25.number() }),
+  z25.strictObject({ kind: z25.literal("drained"), pid: z25.number().int().positive(), observedAt: z25.number() })
 ]);
-var QuotaExpiringEventSchema = z23.strictObject({
-  identity: z23.string().min(1),
-  provider: z23.string().min(1),
-  window: z23.enum(["fiveHour", "sevenDay"]),
+var QuotaExpiringEventSchema = z25.strictObject({
+  identity: z25.string().min(1),
+  provider: z25.string().min(1),
+  window: z25.enum(["fiveHour", "sevenDay"]),
   /** The fraction of the window already used when it was seen expiring, always below one because a fully used window has nothing left to spend. */
-  utilization: z23.number().min(0).max(1),
-  resetsAt: z23.iso.datetime(),
-  observedAt: z23.number()
+  utilization: z25.number().min(0).max(1),
+  resetsAt: z25.iso.datetime(),
+  observedAt: z25.number()
 });
 
 // src/frontdoor/eventsApi.ts
@@ -14092,51 +14370,51 @@ import { openapi as openapi6 } from "@orpc/openapi";
 
 // src/frontdoor/launchSchemas.ts
 import path31 from "node:path";
-import { z as z24 } from "zod";
+import { z as z26 } from "zod";
 init_claudeVersion();
 init_identity();
-var LaunchResolveInputSchema = z24.strictObject({
-  path: z24.string().min(1),
+var LaunchResolveInputSchema = z26.strictObject({
+  path: z26.string().min(1),
   /** `@name`, launch flags, then the arguments for `claude`; empty for a bare launch. */
-  argv: z24.readonly(z24.array(z24.string())).optional(),
+  argv: z26.readonly(z26.array(z26.string())).optional(),
   /** The launch's inherited environment. Absent means an empty one: the door's own environment is never a substitute for the caller's, so a caller that wants `AGENT_SHIM_*` switches or a `CLAUDE_CONFIG_DIR` considered names them here. Values are read, never reported. */
-  env: z24.record(z24.string(), z24.string()).optional()
+  env: z26.record(z26.string(), z26.string()).optional()
 }).refine((input) => path31.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
-var LaunchPoolDecisionSchema = z24.strictObject({
-  name: z24.string(),
-  reasons: z24.readonly(z24.array(z24.string())),
-  movedOff: z24.strictObject({ identity: z24.string(), reason: z24.string() }).optional()
+var LaunchPoolDecisionSchema = z26.strictObject({
+  name: z26.string(),
+  reasons: z26.readonly(z26.array(z26.string())),
+  movedOff: z26.strictObject({ identity: z26.string(), reason: z26.string() }).optional()
 });
-var LaunchDecisionSchema = z24.strictObject({
-  identity: z24.string().optional(),
-  identitySource: z24.enum(IDENTITY_DECISION_SOURCES),
+var LaunchDecisionSchema = z26.strictObject({
+  identity: z26.string().optional(),
+  identitySource: z26.enum(IDENTITY_DECISION_SOURCES),
   pool: LaunchPoolDecisionSchema.optional(),
-  configDirEscapeHatch: z24.boolean(),
-  configDir: z24.string().optional(),
-  configProfile: z24.string().optional(),
-  configProfileSource: z24.enum(CONFIG_PROFILE_DECISION_SOURCES),
-  provider: z24.string().optional()
+  configDirEscapeHatch: z26.boolean(),
+  configDir: z26.string().optional(),
+  configProfile: z26.string().optional(),
+  configProfileSource: z26.enum(CONFIG_PROFILE_DECISION_SOURCES),
+  provider: z26.string().optional()
 });
-var LaunchFlagsSchema = z24.strictObject({
-  skipPermissions: z24.boolean(),
-  remoteControl: z24.boolean(),
-  headroom: z24.boolean(),
-  trackUsage: z24.boolean()
+var LaunchFlagsSchema = z26.strictObject({
+  skipPermissions: z26.boolean(),
+  remoteControl: z26.boolean(),
+  headroom: z26.boolean(),
+  trackUsage: z26.boolean()
 });
-var LaunchResolveOutputSchema = z24.strictObject({
+var LaunchResolveOutputSchema = z26.strictObject({
   decision: LaunchDecisionSchema,
   flags: LaunchFlagsSchema,
-  claudeVersion: z24.strictObject({ version: z24.string(), source: z24.enum(CLAUDE_VERSION_SOURCES) }).optional(),
+  claudeVersion: z26.strictObject({ version: z26.string(), source: z26.enum(CLAUDE_VERSION_SOURCES) }).optional(),
   /** The real `claude` binary the launch would spawn, on the door's host. */
-  bin: z24.string(),
+  bin: z26.string(),
   /** The arguments the launch would pass it: the tool's own flags, then `CLAUDE_EXTRA_FLAGS`, then the caller's own. */
-  args: z24.readonly(z24.array(z24.string())),
+  args: z26.readonly(z26.array(z26.string())),
   /** The credential the launch would authenticate with, by target and source kinds. Absent when none applies. */
-  credential: z24.strictObject({ subject: z24.enum(["provider", "identity"]), name: z24.string(), summary: CredentialSummarySchema }).optional(),
-  routing: z24.strictObject({ frontDoor: z24.boolean(), headroom: z24.boolean() }),
+  credential: z26.strictObject({ subject: z26.enum(["provider", "identity"]), name: z26.string(), summary: CredentialSummarySchema }).optional(),
+  routing: z26.strictObject({ frontDoor: z26.boolean(), headroom: z26.boolean() }),
   /** The names of the environment variables the launch would set or unset, sorted. Values are not reported. */
-  environment: z24.readonly(z24.array(z24.string())),
-  warnings: z24.readonly(z24.array(z24.string()))
+  environment: z26.readonly(z26.array(z26.string())),
+  warnings: z26.readonly(z26.array(z26.string()))
 });
 
 // src/frontdoor/launchApi.ts
@@ -14169,6 +14447,71 @@ function createLaunchApiRouter(deps) {
   };
 }
 
+// src/frontdoor/agentTreesApi.ts
+import { ORPCError as ORPCError6 } from "@orpc/client";
+import { openapi as openapi7 } from "@orpc/openapi";
+import { z as z27 } from "zod";
+init_cliError();
+var AgentTreesListInputSchema = z27.strictObject({
+  /** Only this identity's sessions. */
+  identity: z27.string().optional(),
+  /** Include sessions that spawned no agent and ran no workflow. */
+  all: z27.boolean().optional()
+});
+var AgentTreesListOutputSchema = z27.array(SessionSummarySchema);
+var AgentTreesShowInputSchema = z27.strictObject({
+  /** A session id, or an unambiguous prefix of one. */
+  session: z27.string().min(1),
+  /** Look only in this identity. */
+  identity: z27.string().optional()
+});
+var AgentTreesShowOutputSchema = z27.strictObject({ identities: z27.array(z27.string()), ...MergedAgentTreeSchema.shape });
+function asBadRequest(error) {
+  if (error instanceof CliError) {
+    throw new ORPCError6("BAD_REQUEST", { message: error.message });
+  }
+  throw error;
+}
+function createAgentTreesApiRouter(deps) {
+  const authed = doorApiAuth(deps.expectedToken);
+  return {
+    agentTrees: {
+      list: authed.meta(
+        openapi7({
+          method: "POST",
+          path: "/rest/agent-trees/list",
+          summary: "List the sessions that spawned agents or ran workflows, newest transcript first",
+          tags: [SESSION_HISTORY_TAG],
+          // A POST because the filters are a body, but the answer changes nothing.
+          spec: (current) => ({ ...current, [READ_ONLY_OPERATION_EXTENSION]: true })
+        })
+      ).input(AgentTreesListInputSchema).output(AgentTreesListOutputSchema).handler(({ input }) => {
+        try {
+          return deps.sessionList(input).map((session) => ({ ...session, identities: [...session.identities] }));
+        } catch (error) {
+          return asBadRequest(error);
+        }
+      }),
+      show: authed.meta(
+        openapi7({
+          method: "POST",
+          path: "/rest/agent-trees/show",
+          summary: "Show one session's agent tree, task list and workflow runs, with the live Remote Control tasks merged in",
+          tags: [SESSION_HISTORY_TAG],
+          spec: (current) => ({ ...current, [READ_ONLY_OPERATION_EXTENSION]: true })
+        })
+      ).input(AgentTreesShowInputSchema).output(AgentTreesShowOutputSchema).handler(({ input }) => {
+        try {
+          const view = deps.sessionShow(input.session, input.identity);
+          return { identities: [...view.identities], ...mergeLiveTasks(view.tree, deps.liveTasks()) };
+        } catch (error) {
+          return asBadRequest(error);
+        }
+      })
+    }
+  };
+}
+
 // src/frontdoor/controlApi.ts
 var USAGE_API_TAG = "usage";
 var FRONTDOOR_API_TAG2 = "frontdoor";
@@ -14179,12 +14522,12 @@ function createControlApiRouter(deps) {
   const authed = doorApiAuth(deps.expectedToken);
   return {
     usage: {
-      list: authed.meta(openapi7({ method: "GET", path: "/rest/usage/snapshots", summary: "List every identity's usage snapshot", tags: [USAGE_API_TAG] })).output(UsageListOutputSchema).handler(() => ({ snapshots: deps.usageSnapshots() })),
-      resets: authed.meta(openapi7({ method: "GET", path: "/rest/usage/resets", summary: "List every recorded quota window with when it resets", tags: [USAGE_API_TAG] })).output(ResetScheduleSchema).handler(() => collectResets(deps.usageSnapshots(), deps.now())),
-      effectiveWindow: authed.meta(openapi7({ method: "GET", path: "/rest/usage/windows", summary: "Read one identity's effective quota windows", tags: [USAGE_API_TAG] })).input(UsageWindowsInputSchema).output(UsageWindowsOutputSchema).handler(({ input }) => {
+      list: authed.meta(openapi8({ method: "GET", path: "/rest/usage/snapshots", summary: "List every identity's usage snapshot", tags: [USAGE_API_TAG] })).output(UsageListOutputSchema).handler(() => ({ snapshots: deps.usageSnapshots() })),
+      resets: authed.meta(openapi8({ method: "GET", path: "/rest/usage/resets", summary: "List every recorded quota window with when it resets", tags: [USAGE_API_TAG] })).output(ResetScheduleSchema).handler(() => collectResets(deps.usageSnapshots(), deps.now())),
+      effectiveWindow: authed.meta(openapi8({ method: "GET", path: "/rest/usage/windows", summary: "Read one identity's effective quota windows", tags: [USAGE_API_TAG] })).input(UsageWindowsInputSchema).output(UsageWindowsOutputSchema).handler(({ input }) => {
         const snapshot = deps.usageSnapshotOf(input.identity);
         if (snapshot === void 0) {
-          throw new ORPCError6("NOT_FOUND", { message: `identity ${input.identity} has no usage snapshot yet, so no quota window has been observed for it` });
+          throw new ORPCError7("NOT_FOUND", { message: `identity ${input.identity} has no usage snapshot yet, so no quota window has been observed for it` });
         }
         const provider = input.provider ?? ANTHROPIC_PROVIDER;
         const rateLimit = snapshot.providers[provider]?.rateLimit;
@@ -14198,34 +14541,34 @@ function createControlApiRouter(deps) {
           ...unified?.sevenDay === void 0 ? {} : { sevenDay: effectiveWindow(unified.sevenDay, now) }
         };
       }),
-      live: authed.meta(openapi7({ method: "GET", path: "/rest/usage/live", summary: "Read the live rate-limit observations the event backbone files", tags: [USAGE_API_TAG] })).input(RcSessionQuerySchema).output(UsageLiveOutputSchema).handler(({ input }) => {
+      live: authed.meta(openapi8({ method: "GET", path: "/rest/usage/live", summary: "Read the live rate-limit observations the event backbone files", tags: [USAGE_API_TAG] })).input(RcSessionQuerySchema).output(UsageLiveOutputSchema).handler(({ input }) => {
         const sessions = deps.liveRateLimits(input.session);
         if (input.session !== void 0 && sessions.length === 0) {
           if (deps.list().some((session) => session.id === input.session)) {
-            throw new ORPCError6("NOT_FOUND", { message: `session ${input.session} has filed no rate_limit_event on its stream yet: the worker emits one only once a turn has completed, so retry after this session's next turn` });
+            throw new ORPCError7("NOT_FOUND", { message: `session ${input.session} has filed no rate_limit_event on its stream yet: the worker emits one only once a turn has completed, so retry after this session's next turn` });
           }
-          throw new ORPCError6("NOT_FOUND", { message: rcSessionNotObservedMessage(input.session) });
+          throw new ORPCError7("NOT_FOUND", { message: rcSessionNotObservedMessage(input.session) });
         }
         return { latest: deps.latestRateLimit(), sessions };
       })
     },
     frontdoor: {
-      status: authed.meta(openapi7({ method: "GET", path: "/rest/frontdoor/status", summary: "Read the front door's status", tags: [FRONTDOOR_API_TAG2] })).output(FrontDoorStatusOutputSchema).handler(() => deps.frontDoorStatus()),
-      sessions: authed.meta(openapi7({ method: "GET", path: "/rest/frontdoor/sessions", summary: "Read the front door's session registry", tags: [FRONTDOOR_API_TAG2] })).output(FrontDoorSessionsOutputSchema).handler(() => ({ sessions: deps.frontDoorStatus().sessions }))
+      status: authed.meta(openapi8({ method: "GET", path: "/rest/frontdoor/status", summary: "Read the front door's status", tags: [FRONTDOOR_API_TAG2] })).output(FrontDoorStatusOutputSchema).handler(() => deps.frontDoorStatus()),
+      sessions: authed.meta(openapi8({ method: "GET", path: "/rest/frontdoor/sessions", summary: "Read the front door's session registry", tags: [FRONTDOOR_API_TAG2] })).output(FrontDoorSessionsOutputSchema).handler(() => ({ sessions: deps.frontDoorStatus().sessions }))
     },
     check: {
       // The report's own JSON shape is the contract (the same one `check --json` prints and `checkReportSchema.ts` defines), so the procedure returns exactly that conversion.
-      run: authed.meta(openapi7({ method: "GET", path: "/rest/check", summary: "Run the check report for one directory", tags: [CHECK_API_TAG] })).input(CheckRunInputSchema).output(CheckReportJsonSchema).handler(({ input }) => checkReportToJson(deps.checkReport(input.path, input.identity)))
+      run: authed.meta(openapi8({ method: "GET", path: "/rest/check", summary: "Run the check report for one directory", tags: [CHECK_API_TAG] })).input(CheckRunInputSchema).output(CheckReportJsonSchema).handler(({ input }) => checkReportToJson(deps.checkReport(input.path, input.identity)))
     },
     doctor: {
-      run: authed.meta(openapi7({ method: "GET", path: "/rest/doctor", summary: "Run the doctor report", tags: [DOCTOR_API_TAG] })).output(DoctorRunOutputSchema).handler(() => deps.doctorReport())
+      run: authed.meta(openapi8({ method: "GET", path: "/rest/doctor", summary: "Run the doctor report", tags: [DOCTOR_API_TAG] })).output(DoctorRunOutputSchema).handler(() => deps.doctorReport())
     },
     pool: {
-      pick: authed.meta(openapi7({ method: "GET", path: "/rest/pool/pick", summary: "Rank one pool exactly as a launch from a directory would right now", tags: [POOL_API_TAG] })).input(PoolPickInputSchema).output(PoolPickReportSchema).handler(({ input }) => {
+      pick: authed.meta(openapi8({ method: "GET", path: "/rest/pool/pick", summary: "Rank one pool exactly as a launch from a directory would right now", tags: [POOL_API_TAG] })).input(PoolPickInputSchema).output(PoolPickReportSchema).handler(({ input }) => {
         const report = deps.poolPick(input.pool, input.path);
         if (report === void 0) {
           const live = deps.poolNames();
-          throw new ORPCError6("NOT_FOUND", {
+          throw new ORPCError7("NOT_FOUND", {
             message: live.length === 0 ? `no pools are configured, so none is named ${input.pool}` : `no pool is named ${input.pool}; the live pools are ${live.map((name) => `"${name}"`).join(", ")}`
           });
         }
@@ -14237,7 +14580,7 @@ function createControlApiRouter(deps) {
 function createDoorApiRouter(deps) {
   const control = createControlApiRouter(deps);
   const lifecycle = createLifecycleApiRouter(deps);
-  return { ...createRcApiRouter(deps), ...control, ...lifecycle, ...createConfigApiRouter(deps), ...createCodexApiRouter(deps), ...createLaunchApiRouter(deps), ...createEventsApiRouter(deps), frontdoor: { ...control.frontdoor, ...lifecycle.frontdoor } };
+  return { ...createRcApiRouter(deps), ...control, ...lifecycle, ...createConfigApiRouter(deps), ...createCodexApiRouter(deps), ...createLaunchApiRouter(deps), ...createAgentTreesApiRouter(deps), ...createEventsApiRouter(deps), frontdoor: { ...control.frontdoor, ...lifecycle.frontdoor } };
 }
 function createDoorApiNodeHandler(deps) {
   return doorApiNodeHandlerOf(createDoorApiRouter(deps), deps.expectedToken);
@@ -14568,15 +14911,15 @@ function createQuotaExpiringPublisher(hub, deps) {
 
 // src/frontdoor/rcLiveUsage.ts
 var RC_RATE_LIMIT_EVENT_TYPE = "rate_limit_event";
-function isRecord5(value) {
+function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function rcRateLimitInfoOf(event) {
   const payload = event.envelope.payload;
-  if (!isRecord5(payload) || payload.type !== RC_RATE_LIMIT_EVENT_TYPE) {
+  if (!isRecord6(payload) || payload.type !== RC_RATE_LIMIT_EVENT_TYPE) {
     return void 0;
   }
-  if (!isRecord5(payload.rate_limit_info)) {
+  if (!isRecord6(payload.rate_limit_info)) {
     return void 0;
   }
   const parsed = RcRateLimitInfoSchema.safeParse(payload.rate_limit_info);
@@ -14664,7 +15007,7 @@ function createSseParser() {
     }
   };
 }
-function isRecord6(value) {
+function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function sequenceNumOf(value) {
@@ -14686,7 +15029,7 @@ function parseRcStreamEnvelope(parsed) {
   } catch {
     return void 0;
   }
-  if (!isRecord6(data)) {
+  if (!isRecord7(data)) {
     return void 0;
   }
   const eventType = data.event_type;
@@ -14927,7 +15270,7 @@ init_capability();
 // src/frontdoor/rcSelfHostEndpoints.ts
 var RC_SOURCE_WORKER = "worker";
 var RC_SOURCE_CLIENT = "client";
-function isRecord7(value) {
+function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseJsonObject2(body) {
@@ -14937,7 +15280,7 @@ function parseJsonObject2(body) {
   } catch {
     return void 0;
   }
-  return isRecord7(parsed) ? parsed : void 0;
+  return isRecord8(parsed) ? parsed : void 0;
 }
 function nonEmptyString2(record, field) {
   const value = record === void 0 ? void 0 : record[field];
@@ -15011,7 +15354,7 @@ async function serveRcClientChannels(ctx, tail, method, maxBatchEvents) {
     }
     const results = [];
     for (const event of events) {
-      if (!isRecord7(event) || !isRecord7(event.payload)) {
+      if (!isRecord8(event) || !isRecord8(event.payload)) {
         await ctx.answerJson(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "every event in a teleport write is an object carrying one payload object" } });
         return true;
       }
@@ -15111,7 +15454,7 @@ async function serveRcCompatSessions(ctx, pathname, compatPath) {
 // src/frontdoor/rcSelfHostConversations.ts
 var RC_CONVERSATIONS_PATH_PREFIX = "/v1/code/conversations";
 var RC_CONVERSATION_ID_PREFIX = "conv_";
-function isRecord8(value) {
+function isRecord9(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseJsonObject3(body) {
@@ -15121,7 +15464,7 @@ function parseJsonObject3(body) {
   } catch {
     return void 0;
   }
-  return isRecord8(parsed) ? parsed : void 0;
+  return isRecord9(parsed) ? parsed : void 0;
 }
 function nonEmptyString3(record, field) {
   const value = record === void 0 ? void 0 : record[field];
@@ -15175,7 +15518,7 @@ async function serveRcConversations(ctx, pathname, method) {
     }
     const results = [];
     for (const event of events) {
-      if (!isRecord8(event) || !isRecord8(event.payload)) {
+      if (!isRecord9(event) || !isRecord9(event.payload)) {
         await ctx.answerJson(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "every event in a write is an object carrying one payload object" } });
         return;
       }
@@ -15207,7 +15550,7 @@ var RC_SELF_HOST_SCOPE_LIST = ["user:profile", "user:inference", "user:sessions:
 var RC_SELF_HOST_OAUTH_TOKEN_TTL_SECONDS = 3600;
 var MS_PER_SECOND5 = 1e3;
 var HTTP_SERVICE_UNAVAILABLE = 503;
-function isRecord9(value) {
+function isRecord10(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseJsonObject4(body) {
@@ -15217,7 +15560,7 @@ function parseJsonObject4(body) {
   } catch {
     return void 0;
   }
-  return isRecord9(parsed) ? parsed : void 0;
+  return isRecord10(parsed) ? parsed : void 0;
 }
 function growthBookFeatures() {
   return {
@@ -15571,7 +15914,7 @@ var RC_SELF_HOST_WORKER_EPOCH = 1;
 var RC_STREAM_EVENT_NAME2 = "client_event";
 var CONFLICT_REASON_HEADER2 = "x-ccr-conflict-reason";
 var CONFLICT_REASON_EPOCH_STALE = "epoch_stale";
-function isRecord10(value) {
+function isRecord11(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isWebSearchRefusal(value) {
@@ -15655,7 +15998,7 @@ function parseJsonObject5(body) {
   } catch {
     return void 0;
   }
-  return isRecord10(parsed) ? parsed : void 0;
+  return isRecord11(parsed) ? parsed : void 0;
 }
 function mintWorkerJwt(randomToken, issuedAt) {
   const encode = (value) => Buffer.from(JSON.stringify(value), "utf8").toString("base64url");
@@ -15915,7 +16258,7 @@ data: ${JSON.stringify(envelope)}
         if (status !== void 0) {
           session.workerStatus = status;
         }
-        if (isRecord10(body?.external_metadata)) {
+        if (isRecord11(body?.external_metadata)) {
           session.externalMetadata = body.external_metadata;
         }
         await answerJson2(response, HTTP_STATUS.ok, {});
@@ -15945,7 +16288,7 @@ data: ${JSON.stringify(envelope)}
         }
         const results = [];
         for (const event of events) {
-          if (!isRecord10(event) || !isRecord10(event.payload)) {
+          if (!isRecord11(event) || !isRecord11(event.payload)) {
             await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "every event in a batch is an object carrying one payload object" } });
             return;
           }
@@ -15978,7 +16321,7 @@ data: ${JSON.stringify(envelope)}
           return;
         }
         for (const event of events) {
-          if (isRecord10(event)) {
+          if (isRecord11(event)) {
             session.internalEvents.push({ eventId: deps.newUuid(), body: event });
           }
         }
@@ -16074,7 +16417,7 @@ data: ${JSON.stringify(envelope)}
       }
       const results = [];
       for (const event of events) {
-        if (!isRecord10(event) || !isRecord10(event.payload)) {
+        if (!isRecord11(event) || !isRecord11(event.payload)) {
           await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "every event in a write is an object carrying one payload object" } });
           return;
         }
@@ -16211,7 +16554,7 @@ var RC_SELF_HOST_RECORD_DIR = "rc-selfhost";
 var RC_SELF_HOST_RECORD_FILE = "credential.json";
 var SELF_HOST_EMAIL = "selfhost@agent-shim.invalid";
 var SELF_HOST_SUBSCRIPTION_TYPE = "max";
-function isRecord11(value) {
+function isRecord12(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function readJsonObject(fs12, file) {
@@ -16225,7 +16568,7 @@ function readJsonObject(fs12, file) {
   } catch {
     return void 0;
   }
-  return isRecord11(parsed) ? parsed : void 0;
+  return isRecord12(parsed) ? parsed : void 0;
 }
 function readRcSelfHostRecord(fs12, frontdoorDir) {
   const parsed = readJsonObject(fs12, path32.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
@@ -16249,7 +16592,7 @@ function mintRcSelfHostCredential(deps) {
   const recordFile = path32.join(recordDir, RC_SELF_HOST_RECORD_FILE);
   const previousRecord = readRcSelfHostRecord(deps.fs, deps.frontdoorDir);
   const existingCredentials = readJsonObject(deps.fs, credentialsFile);
-  const existingOauth = isRecord11(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
+  const existingOauth = isRecord12(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
   const existingToken = typeof existingOauth?.accessToken === "string" && existingOauth.accessToken !== "" ? existingOauth.accessToken : void 0;
   const existingIsOwn = existingToken !== void 0 && previousRecord?.accessToken === existingToken;
   if (existingToken !== void 0 && !existingIsOwn && !deps.force) {
@@ -16266,7 +16609,7 @@ function mintRcSelfHostCredential(deps) {
   deps.fs.writeFilePrivate(credentialsFile, `${JSON.stringify({ ...existingCredentials, claudeAiOauth: { accessToken, refreshToken, expiresAt: null, scopes: [...RC_SELF_HOST_SCOPE_LIST], subscriptionType: SELF_HOST_SUBSCRIPTION_TYPE, rateLimitTier: null } }, null, 2)}
 `);
   const claudeJson = readJsonObject(deps.fs, claudeJsonFile) ?? {};
-  const existingBlock = (value) => isRecord11(value) ? value : {};
+  const existingBlock = (value) => isRecord12(value) ? value : {};
   deps.fs.writeFilePrivate(claudeJsonFile, `${JSON.stringify({
     ...claudeJson,
     oauthAccount: {
@@ -16305,90 +16648,7 @@ init_poolPick();
 
 // src/agents/read.ts
 import path33 from "node:path";
-import { z as z26 } from "zod";
-
-// src/agents/schema.ts
-import { z as z25 } from "zod";
-var AgentMetaSchema = z25.looseObject({
-  agentType: z25.string(),
-  isFork: z25.boolean().optional(),
-  description: z25.string().optional(),
-  name: z25.string().optional(),
-  toolUseId: z25.string().optional(),
-  spawnDepth: z25.number().int().nonnegative().optional(),
-  parentAgentId: z25.string().optional(),
-  model: z25.string().optional(),
-  requestShape: z25.string().optional(),
-  requestNonInteractive: z25.boolean().optional(),
-  workflowPhase: z25.string().optional(),
-  taskKind: z25.string().optional(),
-  teamName: z25.string().optional(),
-  worktreePath: z25.string().optional(),
-  worktreeBranch: z25.string().optional(),
-  stoppedByUser: z25.boolean().optional()
-});
-var AgentKindSchema = z25.enum(["subagent", "fork", "workflow-agent", "teammate"]);
-var AgentNodeSchema = z25.lazy(
-  () => z25.strictObject({
-    id: z25.string(),
-    kind: AgentKindSchema,
-    agentType: z25.string(),
-    description: z25.string().optional(),
-    name: z25.string().optional(),
-    toolUseId: z25.string().optional(),
-    spawnDepth: z25.number().int().nonnegative().optional(),
-    model: z25.string().optional(),
-    background: z25.boolean().optional(),
-    workflowRunId: z25.string().optional(),
-    workflowPhase: z25.string().optional(),
-    teamName: z25.string().optional(),
-    stoppedByUser: z25.boolean().optional(),
-    transcript: z25.string(),
-    children: z25.array(AgentNodeSchema)
-  })
-);
-var TaskItemSchema = z25.strictObject({
-  id: z25.string(),
-  subject: z25.string(),
-  description: z25.string().optional(),
-  status: z25.string(),
-  /** What a spinner shows while the task runs. */
-  activeForm: z25.string().optional(),
-  /** The teammate or agent name the task is assigned to, as Agent Teams writes it. */
-  owner: z25.string().optional(),
-  /** Free-form data the harness attaches to a task, kept as written. */
-  metadata: z25.record(z25.string(), z25.unknown()).optional(),
-  blocks: z25.array(z25.string()),
-  blockedBy: z25.array(z25.string()),
-  /** The id of the shared task list this task belongs to (a team's name, or a custom list id), absent for the session's own list. */
-  taskList: z25.string().optional()
-});
-var WorkflowRunSchema = z25.strictObject({
-  runId: z25.string(),
-  workflowName: z25.string().optional(),
-  status: z25.string().optional(),
-  startTime: z25.number().optional(),
-  phases: z25.array(z25.string()),
-  summary: z25.string().optional()
-});
-var AgentTreeProblemSchema = z25.strictObject({
-  /** Relative to the identity's configuration directory. */
-  path: z25.string(),
-  reason: z25.string()
-});
-var SessionAgentTreeSchema = z25.strictObject({
-  project: z25.string(),
-  sessionId: z25.string(),
-  /** True for a session directory a resume superseded (`<session-id>.superseded-<epoch-ms>`). */
-  superseded: z25.boolean(),
-  /** The agents the session itself spawned, each with its descendants. */
-  agents: z25.array(AgentNodeSchema),
-  tasks: z25.array(TaskItemSchema),
-  workflowRuns: z25.array(WorkflowRunSchema),
-  problems: z25.array(AgentTreeProblemSchema)
-});
-
-// src/agents/read.ts
+import { z as z28 } from "zod";
 var PROJECTS_DIR = "projects";
 var TASKS_DIR = "tasks";
 var SUBAGENTS_DIR = "subagents";
@@ -16507,15 +16767,30 @@ function parseJson2(text) {
     return void 0;
   }
 }
-var TaskFileSchema = z26.object({ ...TaskItemSchema.omit({ taskList: true }).shape, blocks: z26.array(z26.string()).default([]), blockedBy: z26.array(z26.string()).default([]) });
-var WorkflowRunFileSchema = z26.object({
-  runId: z26.string(),
-  workflowName: z26.string().optional(),
-  status: z26.string().optional(),
-  startTime: z26.number().optional(),
-  phases: z26.array(z26.object({ title: z26.string() })).default([]),
-  summary: z26.string().optional()
+var TaskFileSchema = z28.object({ ...TaskItemSchema.omit({ taskList: true }).shape, blocks: z28.array(z28.string()).default([]), blockedBy: z28.array(z28.string()).default([]) });
+var WorkflowRunFileSchema = z28.object({
+  runId: z28.string(),
+  workflowName: z28.string().optional(),
+  status: z28.string().optional(),
+  startTime: z28.number().optional(),
+  phases: z28.array(z28.object({ title: z28.string() })).default([]),
+  summary: z28.string().optional()
 });
+function summariseSession(fs12, configDir, ref) {
+  const sessionRelative = path33.join(PROJECTS_DIR, ref.project, ref.entry);
+  const subagentsRelative = path33.join(sessionRelative, SUBAGENTS_DIR);
+  const workflowsUnderSubagents = path33.join(subagentsRelative, WORKFLOWS_DIR);
+  const isMeta = (name) => name.startsWith(AGENT_FILE_PREFIX) && name.endsWith(META_SUFFIX);
+  let agentCount = fs12.readdir(path33.join(configDir, subagentsRelative)).filter(isMeta).length;
+  for (const runDir of fs12.readdir(path33.join(configDir, workflowsUnderSubagents))) {
+    if (runDir.startsWith(WORKFLOW_RUN_PREFIX)) {
+      agentCount += fs12.readdir(path33.join(configDir, workflowsUnderSubagents, runDir)).filter(isMeta).length;
+    }
+  }
+  const workflowRunCount = fs12.readdir(path33.join(configDir, sessionRelative, WORKFLOWS_DIR)).filter((name) => name.startsWith(WORKFLOW_RUN_PREFIX) && name.endsWith(JSON_SUFFIX)).length;
+  const transcript = fs12.lstat(path33.join(configDir, PROJECTS_DIR, ref.project, `${ref.entry}${TRANSCRIPT_SUFFIX}`));
+  return { ...ref, agentCount, workflowRunCount, ...transcript === void 0 ? {} : { updatedAt: new Date(transcript.mtimeMs).toISOString() } };
+}
 function readSessionAgentTree(fs12, configDir, ref, options = {}) {
   const problems = [];
   const report = (problem) => {
@@ -16671,6 +16946,94 @@ function readWorkflowRuns(fs12, configDir, relativeDir, report) {
   return runs;
 }
 
+// src/agents/sessions.ts
+init_cliError();
+import path34 from "node:path";
+var SessionLookupError = class extends CliError {
+  constructor(message) {
+    super(message);
+    this.name = "SessionLookupError";
+  }
+};
+function identityConfigDir(identitiesDir, identity) {
+  return path34.join(identitiesDir, identity);
+}
+function historyStores(fs12, identitiesDir, identities) {
+  const byRealPath = /* @__PURE__ */ new Map();
+  for (const identity of identities) {
+    const configDir = identityConfigDir(identitiesDir, identity);
+    const real = fs12.realpath(path34.join(configDir, "projects"));
+    if (real === void 0) {
+      continue;
+    }
+    const store = byRealPath.get(real);
+    if (store === void 0) {
+      byRealPath.set(real, { configDir, identities: [identity] });
+    } else {
+      store.identities.push(identity);
+    }
+  }
+  return [...byRealPath.values()];
+}
+function collectSessionList(fs12, identitiesDir, identities, filters) {
+  const names = filters.identity === void 0 ? identities : identities.filter((name) => name === filters.identity);
+  if (filters.identity !== void 0 && names.length === 0) {
+    throw new SessionLookupError(`no identity named "${filters.identity}"`);
+  }
+  const sessions = [];
+  for (const store of historyStores(fs12, identitiesDir, names)) {
+    for (const ref of listSessions2(fs12, store.configDir)) {
+      const summary = summariseSession(fs12, store.configDir, ref);
+      if (filters.all === true || summary.agentCount > 0 || summary.workflowRunCount > 0) {
+        sessions.push({ ...summary, identities: store.identities });
+      }
+    }
+  }
+  return sessions.sort((left, right) => (right.updatedAt ?? "").localeCompare(left.updatedAt ?? "") || left.sessionId.localeCompare(right.sessionId));
+}
+function locateSession(fs12, identitiesDir, identities, query, onlyIdentity) {
+  const names = onlyIdentity === void 0 ? identities : identities.filter((name) => name === onlyIdentity);
+  if (onlyIdentity !== void 0 && names.length === 0) {
+    throw new SessionLookupError(`no identity named "${onlyIdentity}"`);
+  }
+  const matches = [];
+  for (const store of historyStores(fs12, identitiesDir, names)) {
+    for (const ref of listSessions2(fs12, store.configDir)) {
+      if (ref.sessionId.startsWith(query)) {
+        matches.push({ identities: store.identities, configDir: store.configDir, ref });
+      }
+    }
+  }
+  const exact = matches.filter((match) => match.ref.sessionId === query);
+  const candidates = exact.length > 0 ? exact : matches;
+  const only = candidates[0];
+  if (candidates.length === 1 && only !== void 0) {
+    return only;
+  }
+  if (candidates.length === 0) {
+    throw new SessionLookupError(`no session matches "${query}"`);
+  }
+  throw new SessionLookupError(`"${query}" matches ${String(candidates.length)} sessions: ${candidates.map((match) => `${match.ref.sessionId} (${match.identities.join(", ")})`).join("; ")}; give more of the id or pass --identity`);
+}
+function showSession(fs12, identitiesDir, identities, query, onlyIdentity) {
+  const located = locateSession(fs12, identitiesDir, identities, query, onlyIdentity);
+  return { identities: located.identities, tree: readSessionAgentTree(fs12, located.configDir, located.ref) };
+}
+
+// src/agents/realFs.ts
+init_realPorts();
+import nodeFs from "node:fs";
+var realSessionFs = {
+  ...realFarmFs,
+  realpath: (candidate) => {
+    try {
+      return nodeFs.realpathSync(candidate);
+    } catch {
+      return void 0;
+    }
+  }
+};
+
 // src/index.ts
 init_conditions();
 init_ensure();
@@ -16782,6 +17145,10 @@ export {
   AgentKindSchema,
   AgentMetaSchema,
   AgentNodeSchema,
+  AgentTreesListInputSchema,
+  AgentTreesListOutputSchema,
+  AgentTreesShowInputSchema,
+  AgentTreesShowOutputSchema,
   CHECK_CREDENTIAL_APPLIES,
   CODEX_APP_SERVER_GENERATED_AGAINST,
   CODEX_APP_SERVER_TIMEOUT_MS,
@@ -16877,11 +17244,15 @@ export {
   InvalidIdentityNameError,
   InvalidProviderNameError,
   LAUNCH_EVENT_SOURCE,
+  LIVE_TASK_CAP,
   LaunchLifecycleEventSchema,
   LaunchRefusedError,
   LaunchResolveInputSchema,
   LaunchResolveOutputSchema,
   LegacyProviderFileError,
+  LiveTaskSchema,
+  MergedAgentNodeSchema,
+  MergedAgentTreeSchema,
   OWN_CLI_FILE_NAME,
   PROMPT_CACHE_TTL_MS,
   PlanClassSchema,
@@ -16929,6 +17300,8 @@ export {
   ResetRowSchema,
   ResetScheduleSchema,
   SessionAgentTreeSchema,
+  SessionLookupError,
+  SessionSummarySchema,
   TaskItemSchema,
   USAGE_EVENT_SOURCE,
   UpdateCheckOutputSchema,
@@ -16947,6 +17320,7 @@ export {
   addProvider,
   agentShimCliPath,
   answerRcControlRequest,
+  applyAgentTaskEvent,
   authenticateRcSessionMcpServer,
   buildEntryFacts,
   buildLayoutPaths,
@@ -16976,6 +17350,8 @@ export {
   collectFrontDoorStatus,
   collectPoolPick,
   collectResets,
+  collectSessionList,
+  createAgentTreesApiRouter,
   createCodexApiRouter,
   createConfigApiRouter,
   createControlApiRouter,
@@ -17044,7 +17420,9 @@ export {
   listProviders,
   listSessions2 as listSessions,
   listUsageSnapshots,
+  locateSession,
   matchBranch,
+  mergeLiveTasks,
   mintLeaf,
   mintRcSelfHostCredential,
   observingRoutedRoute,
@@ -17086,6 +17464,7 @@ export {
   realRcEventDial,
   realRcStreamDial,
   realRcWebFetch,
+  realSessionFs,
   reconnectRcSessionMcpServer,
   recoverFarm,
   recoveryDiagnostics,
@@ -17127,11 +17506,13 @@ export {
   setProfileMetadata,
   setRcSessionModel,
   setRcSessionPermissionMode,
+  showSession,
   snapshotPath,
   spawnClaude,
   startConnectServer,
   submitRcSessionMcpOAuthCallbackUrl,
   suggestRcSessionFiles,
+  summariseSession,
   teleportRcSession,
   topLevelNames,
   updateDirectoryRule,