claude-use 9.19.1 → 10.0.1

package/dist/types/index.d.ts

@@ -1703,12 +1703,14 @@ interface LayoutPaths {
     readonly categoriesLocalFile: string;
     /** Path to the claude-shim.json marker recording where `agent-shim shim enable` last placed a `claude`-named copy of this executable, and how. */
     readonly claudeShimFile: string;
-    /** Directory holding the headroom daemon's coordination state: the state file, the start lock, the session registry, and the socket directory. */
+    /** Directory holding the headroom daemon's coordination state: the state file, the start lock, the session registry, and the owner-only socket directory, which also holds the allowlist file. */
     readonly headroomDir: string;
-    /** Path to the headroom supervisor's state file: pids, socket path, version, allowlist hash, last error. One unversioned name every release shares, arbitrated by the ownership rules in `headroom/state.ts` rather than by a version in the file name. */
+    /** Path to the headroom supervisor's state file: pids, socket path, version, the hash of the allowlist the daemon serves, last error. One unversioned name every release shares, arbitrated by the ownership rules in `headroom/state.ts` rather than by a version in the file name. */
     readonly headroomStateFile: string;
     /** The previous release's versioned name for the state file, read only while a supervisor from that release is still alive and removed once its generation has drained (see `migrateHeadroomState`). */
     readonly headroomLegacyStateFile: string;
+    /** Path to the file the headroom daemon reads its upstream allowlist from (`--allowed-base-urls-file`): the direct origin of every live front door, one per line. It lives in the owner-only socket directory because headroom refuses an allowlist file whose directory another user could write to, and that directory is the one this tool already creates mode 0700 (narrowing it if it existed wider) and checks before every daemon start. The supervisor replaces the file owner-only and atomically whenever a door's origin changes, and the daemon re-reads it on its next request, so a moved or retired front door never needs a restart. */
+    readonly headroomAllowlistFile: string;
     /** Directory, mode 0700, holding the headroom daemon's unix socket: one `<supervisor-pid>.sock` per supervisor generation. Only its owner can enter it, which is what authenticates the door's hop to the daemon. */
     readonly headroomSocketDir: string;
     /** Path to the exclusive-create marker guarding "who spawns the supervisor" so concurrent launches start at most one. */
@@ -1741,6 +1743,8 @@ interface LayoutPaths {
     readonly frontdoorControlTokenFile: string;
     /** Directory holding one `<launcher-pid>.json` session-registry entry per live launch routed through the front door. */
     readonly frontdoorSessionsDir: string;
+    /** Directory holding one `<supervisor-pid>.json` per live front door, recording that door's own direct port: every door still serving sessions forwards its headroom traffic back to its own direct origin, so headroom must admit each of them, not only the one `state.json` names. */
+    readonly frontdoorDirectRecordsDir: string;
     /**
      * Directory holding one `<cse-session-id>.json` Remote Control client credential per observed session, mode 0700 with 0600 files: the OAuth-kind bearer and protocol headers the door replays as the session's attached client, persisted so a door generation that starts after a session's create can still attach. The same secret the identity's own store holds, at the same owner-only protection.
      */
@@ -2204,7 +2208,7 @@ interface HeadroomUp {
 /**
  * Everything the launcher needs from the headroom daemon, injected so its daemon-supervision side effects stay behind a port and the launcher's own logic stays pure over it (`src/realPorts.ts` wires the real one; tests wire fakes).
  *
- * `ensure` brings the daemon up (spawning the detached supervisor when nothing healthy is running) and registers this launch in its session registry; `release` removes that registration when the spawned `claude` exits. `routesProvider` says the launch sends a provider's traffic through the daemon, which needs the daemon to have been started with the front door's current address on its allowlist: `ensure` then waits for a restart that brings it, or refuses when live sessions hold the stale daemon up, instead of registering against a daemon that would reject every request.
+ * `ensure` brings the daemon up (spawning the detached supervisor when nothing healthy is running) and registers this launch in its session registry; `release` removes that registration when the spawned `claude` exits. `routesProvider` says the launch sends a provider's traffic through the daemon, which needs the daemon to be serving an allowlist holding the front door's current direct origin: `ensure` then waits until the supervisor has written it to the daemon's allowlist file and recorded it, instead of registering against a daemon that would reject every request.
  */
 interface HeadroomPort {
     readonly ensure: (options: Readonly<{
@@ -3697,7 +3701,7 @@ type HeadroomFs = Pick<FarmFs, "mkdirp" | "mkdirPrivate" | "readFileUtf8" | "wri
 
 /** What an `lstat` (which never follows symlinks) reports about one path, narrowed to what authenticating the socket needs. */
 interface SocketPathStat {
-    readonly kind: "dir" | "socket" | "symlink" | "other";
+    readonly kind: "dir" | "file" | "socket" | "symlink" | "other";
     /** The owning user id. */
     readonly uid: number;
     /** The permission bits, without the file type bits. */
@@ -3711,6 +3715,8 @@ interface HeadroomSocketTrustPorts {
     readonly currentUid: () => number;
     /** Stats one path without following symlinks, or returns undefined when nothing is there. */
     readonly lstat: (target: string) => SocketPathStat | undefined;
+    /** The target a symlink holds, as written: how the allowlist file's path is resolved through a symlinked ancestor. */
+    readonly readlink: (target: string) => string;
 }
 /** Either a socket path the hop may dial, or the reason it must not: the two never appear together. */
 type HeadroomSocketTarget = {
@@ -3720,6 +3726,11 @@ type HeadroomSocketTarget = {
     readonly refused: string;
     readonly socketPath?: never;
 };
+/** How the allowlist file fails the rules it is held to: what is wrong, and whether the supervisor can repair it (only what lies in agent-shim's own directories can be). */
+interface AllowlistFileProblem {
+    readonly message: string;
+    readonly repairable: boolean;
+}
 
 /**
  * A secondary pre-pipeline surface the listener answers under one path prefix: the typed Remote Control API. The listener owns only the dispatch (the prefix and the not-matched 404); the handle itself is whatever the door built, so this file stays independent of the API framework behind it.
@@ -4877,8 +4888,161 @@ type PathShadowStatus = {
     readonly by: string;
 };
 
-/** One input the headroom allowlist is computed from: the provider definitions on disk, or the front door's direct origin. */
-type AllowlistDriftInput = "provider-files" | "front-door-origin";
+/**
+ * How the allowlist the headroom daemon serves lags the allowlist computed now. The daemon re-reads its allowlist file on every request that follows a change to it, and its supervisor rewrites the file and records the hash in the same tick, so a lag that lasts beyond one tick means the supervisor is not running or cannot write the file. A daemon started by an earlier release reads no file, and is reported as such instead.
+ */
+type AllowlistDrift = FileAllowlistDrift | EarlierReleaseAllowlistDrift;
+/** A daemon started by an earlier release whose fixed allowlist, by its recorded hash, does not admit the serving door. */
+interface EarlierReleaseAllowlistDrift {
+    readonly startedByEarlierRelease: true;
+    readonly missingFromFile?: never;
+    readonly staleInFile?: never;
+    readonly hashLags?: never;
+}
+/** A daemon reading the allowlist file, whose file or recorded hash lags the computed allowlist. */
+interface FileAllowlistDrift {
+    readonly startedByEarlierRelease?: never;
+    /** Computed entries the file does not list: the daemon refuses every request to these upstreams. A missing file lists nothing, so every entry is here. */
+    readonly missingFromFile: readonly string[];
+    /** Entries the file lists that the computed allowlist no longer holds: origins of doors that are gone, which the daemon still admits although nothing routes to them. */
+    readonly staleInFile: readonly string[];
+    /** Whether the recorded hash is not the hash of the entries the file lists: the supervisor has not recorded the file as served, and a provider launch's gate waits until it has. */
+    readonly hashLags: boolean;
+}
+
+/**
+ * The record held in one front-door session-registry file: the launcher's pid plus the per-launch capability token its child presents on every request, and the supervisor of the door the launch was sent to. `supervisorPid` is absent on a record written before it existed and on a door's own transparent-surface record; such a launch cannot be attributed to a door, so a superseded door treats it as its own.
+ */
+declare const FrontDoorSessionSchema: z.ZodObject<{
+    pid: z.ZodNumber;
+    startedAt: z.ZodNumber;
+    token: z.ZodString;
+    supervisorPid: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+type FrontDoorSession = z.infer<typeof FrontDoorSessionSchema>;
+/**
+ * The front-door supervisor's state.json under `<home>/frontdoor/`. Every field is optional because the file exists in stages, exactly like headroom's and the old codex daemon's: a fresh supervisor writes its own pid before the listener is up, and a shut-down front door leaves only the sticky `lastPort` and any `lastError` worth surfacing.
+ */
+declare const FrontDoorStateSchema: z.ZodObject<{
+    protocol: z.ZodOptional<z.ZodNumber>;
+    supervisorPid: z.ZodOptional<z.ZodNumber>;
+    port: z.ZodOptional<z.ZodNumber>;
+    lastPort: z.ZodOptional<z.ZodNumber>;
+    connectPort: z.ZodOptional<z.ZodNumber>;
+    lastConnectPort: z.ZodOptional<z.ZodNumber>;
+    directPort: z.ZodOptional<z.ZodNumber>;
+    lastDirectPort: z.ZodOptional<z.ZodNumber>;
+    lastError: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+type FrontDoorState = z.infer<typeof FrontDoorStateSchema>;
+/**
+ * Which recorded doors are still running as front-door supervisors, as reads of the process table answer it: `doors` holds the pids the table shows running (not zombies) with the front-door supervisor's command line; `unknown` holds the pids no read could answer for, each with why (ps failed to run, was killed, timed out or reported an error). Every other pid asked about is known not to be a door: gone, a zombie, or a process that reused a crashed door's pid.
+ */
+interface FrontDoorLiveness {
+    readonly doors: ReadonlySet<number>;
+    readonly unknown: ReadonlyMap<number, string>;
+}
+/** A registered launch as status and the idle decision see it: the pid and start time, never the token, so nothing that prints or serialises a session can leak the capability. */
+type FrontDoorSessionSummary = Pick<FrontDoorSession, "pid" | "startedAt" | "supervisorPid">;
+
+/** The token-saving settings of the `headroom` config block, without its install and lifecycle fields (`source`, `idleShutdownMinutes`). */
+type HeadroomSettings = Pick<HeadroomGlobalConfig, "mode" | "targetRatio" | "ccr" | "rolloutChannel" | "interceptToolResults" | "readMaturation">;
+
+/** Everything the supervisor needs to run the daemon, resolved from the global config and the filesystem before it starts. */
+interface HeadroomSupervisorConfig {
+    /** The install spec as configured (`headroom.source`), already defaulted. */
+    readonly source: string;
+    /** `headroom.idleShutdownMinutes`, already defaulted. */
+    readonly idleShutdownMinutes: number;
+    /** The token-saving settings (`mode`, `targetRatio`, `ccr`, the rollout channel and its opt-ins), as configured; unset fields leave headroom on its own defaults. */
+    readonly settings: HeadroomSettings;
+}
+/** How the supervisor resolves the configured source against its defaults. */
+declare function resolveSupervisorConfig(configured: Readonly<HeadroomGlobalConfig>): HeadroomSupervisorConfig;
+/**
+ * Every effect the supervisor performs, injected so the whole lifecycle is testable against fakes: no real process, port, clock, or HTTP call ever happens in a unit test.
+ */
+interface SupervisorPorts {
+    readonly fs: HeadroomFs;
+    readonly paths: LayoutPaths;
+    readonly ownPid: number;
+    readonly now: () => number;
+    /**
+     * Waits `ms`, yielding to the event loop while it does. Deliberately NOT a synchronous Atomics.wait-style sleep: the real supervisor learns of its child's death through the ChildProcess exit event, and a blocking sleep would stop the event loop from ever delivering it (the exact failure that left an unreaped zombie answering liveness checks as alive).
+     */
+    readonly sleep: (ms: number) => Promise<void>;
+    /**
+     * Zombie-aware liveness, and for a daemon this supervisor spawned, exit-event-backed: the implementation keeps the spawned ChildProcess handle, consumes its exit event (which is also what reaps it), and reports the pid as not running from that moment. A bare signal-0 check is not enough, because a defunct process still answers it.
+     */
+    readonly isRunning: (pid: number) => boolean;
+    /** Which of the recorded doors' pids are running front-door supervisors, from one read of the process table per call (see `FrontDoorLiveness`): a door's direct record outlives a crash, and the pid it names can be reused by an unrelated process, whose record must not keep the dead door's origin admitted. The supervisor calls it once per tick. */
+    readonly frontDoorLiveness: (pids: readonly number[]) => FrontDoorLiveness;
+    /** The daemon log's size in bytes (0 before it exists): where the next start attempt's own output will begin. */
+    readonly daemonLogSize: () => number;
+    /** The daemon log from byte `fromByte` to its end, at most its last `maxBytes`, read without loading the whole file (nothing rotates the log). */
+    readonly readDaemonLogTail: (fromByte: number, maxBytes: number) => string;
+    /** The command line of a running process as `ps` reports it, or undefined when it cannot be read: how a recorded orphan daemon is confirmed to be one before it is signalled (see `daemonIdentity`). */
+    readonly daemonCommandLine: (pid: number) => string | undefined;
+    /** The platform facts and owner-only checks the daemon's socket directory is prepared and verified with (see `prepareHeadroomSocket`). */
+    readonly socketTrust: HeadroomSocketTrustPorts;
+    /**
+     * Starts `headroom proxy` serving on the unix socket `socketPath` (and on no TCP port), reading its upstream allowlist from `allowlistFile`, which it re-reads on the next request after the file is replaced, returning its pid. Output goes to the daemon log. The implementation must keep the ChildProcess handle and attach an exit listener (detaching the process is fine; unref'ing a child you still need events from is not, since without the listener nothing reaps it and it lingers as a zombie).
+     */
+    readonly spawnHeadroom: (socketPath: string, allowlistFile: string, settings: Readonly<HeadroomSettings>) => number;
+    /** Reads the headroom config block as it stands on disk now. The supervisor calls it every tick, so a changed `source` or setting is noticed while the daemon runs and applied by a restart once no session is registered against this supervisor. */
+    readonly readConfig: () => HeadroomSupervisorConfig;
+    /** Stops a process the supervisor owns, escalating SIGTERM to SIGKILL on a bounded timeout (see `stopSupervisedProcess`). */
+    readonly stopProcess: (pid: number) => void;
+    /** True once `GET /readyz` over the unix socket succeeds. */
+    readonly ready: (socketPath: string) => Promise<boolean>;
+    /** Runs `uv tool install <spec>`, logging output to the daemon log. Returns ok=false with the error when `uv` is absent or the install fails. */
+    readonly install: (spec: string) => {
+        readonly ok: boolean;
+        readonly error?: string;
+    };
+    /** The installed `headroom --version` output, or undefined when the binary is not on PATH. */
+    readonly headroomVersion: () => string | undefined;
+    /** The commit the installed headroom was built from, as the install itself records it (`direct_url.json`), or undefined when it was not installed from a git source. */
+    readonly installedCommit: () => string | undefined;
+    readonly log: (line: string) => void;
+}
+/** Options for `runSupervisor`. */
+interface RunSupervisorOptions {
+    /**
+     * Bounds the supervisor loop's iterations. The real supervisor runs until it exits on its own (idle shutdown or fatal error); a bounded run is how tests observe steady-state behaviour (drift deferral, restart-on-crash, pruning) without an infinite loop, and such a run returns `HEADROOM_SUPERVISOR_STILL_RUNNING` instead of an exit code.
+     */
+    readonly tickLimit?: number;
+}
+/**
+ * Runs the headroom supervisor loop: install the daemon, start it, keep it alive (for crash or drift), and stop it after the configured idle period with an empty session registry. Returns the process exit code (0 for an idle shutdown, 1 for a fatal setup failure).
+ *
+ * Every effect flows through `ports`, so the whole loop is unit-testable with a fake clock, filesystem, and processes. The loop awaits its sleeps, which in the real implementation run on a timer: between ticks the event loop turns, the spawned child's exit event is delivered (and the child thereby reaped), and the next tick's liveness check reads the truth.
+ */
+declare function runSupervisor(initialConfig: HeadroomSupervisorConfig, ports: SupervisorPorts, options?: RunSupervisorOptions): Promise<number>;
+/** A recorded front door no read of the process table could answer for, kept on the allowlist until one can: its pid, its direct origin, and why the read failed. */
+interface UndeterminedFrontDoor {
+    readonly pid: number;
+    readonly origin: string;
+    readonly reason: string;
+}
+/**
+ * The upstreams the headroom daemon must admit for one launch that routes a provider through it: the direct origin of the front door `state.json` names, the door the launch is sent to, whose hop names that origin as headroom's upstream for every provider request. Empty before any door has served, when there is nothing to wait for. What `ensureHeadroom`'s `requiredUpstreams` takes.
+ */
+declare function launchRequiredUpstreams(fs: HeadroomFs, paths: LayoutPaths): readonly string[];
+
+/** How the running headroom daemon's allowlist file and recorded hash compare with the allowlist computed now, as `doctor` audits it. A file lacking a live door's origin, a recorded hash that lags the file, or an earlier release's fixed allowlist that lags fails (requests through that door are refused or provider launches wait at their gate); a file still listing a gone door's origin warns. */
+interface DoctorHeadroomAllowlist {
+    /** The drift `diagnoseAllowlistDrift` found, or undefined when the file and the recorded hash are current. */
+    readonly drift: AllowlistDrift | undefined;
+    /** The allowlist file the daemon reads. */
+    readonly file: string;
+    /** The log the supervisor reports a failed write of that file to. */
+    readonly logPath: string;
+    /** The recorded front doors the process table could not answer for (see `undeterminedFrontDoors`): each is a warning, since its origin stays admitted until a read can tell. */
+    readonly undeterminedFrontDoors: readonly UndeterminedFrontDoor[];
+    /** How the allowlist file fails the rules it is held to (see `reportableAllowlistFileProblem`), or undefined when it keeps them or an earlier release's daemon, which reads no file, serves: a failure, whether or not a daemon is up, when headroom refuses it over a directory agent-shim cannot repair, and a warning while a daemon is up otherwise. */
+    readonly fileProblem: AllowlistFileProblem | undefined;
+}
 
 /** What listing the front-door supervisors found: their pids, or why the process table could not be read. */
 type FrontDoorSupervisorListing = {
@@ -5003,18 +5167,15 @@ interface RunDoctorParams {
     readonly headroom: {
         readonly state: DoctorFileInput;
         readonly isRunning: (pid: number) => boolean;
-        /** What the daemon's allowlist is measured against. Omit to skip the allowlist check; with it, a daemon whose allowlist may exclude the serving door's direct origin is a failure. */
-        readonly allowlist?: {
-            /** The inputs that could explain the recorded allowlist hash not matching the current allowlist, or undefined when it matches. */
-            readonly driftInputs: readonly AllowlistDriftInput[] | undefined;
-            /** The serving front door's direct origin, or undefined before it has ever served. */
-            readonly frontDoorOrigin: string | undefined;
-        };
+        /** How the running daemon's allowlist file and recorded hash compare with the allowlist computed now. Omit to skip the allowlist check; with it, a file lacking an upstream the computed allowlist holds, or a recorded hash that lags it, fails (requests to that upstream are refused and provider launches wait at their gate), and a file still listing an upstream nothing routes to warns. */
+        readonly allowlist?: DoctorHeadroomAllowlist;
     };
     /** The front door's state.json and the supervisor processes alive for this user. Omit to skip the front-door checks (the platform cannot list processes); with it, more than one supervisor alive at once is a failure naming each superseded one. */
     readonly frontDoor?: {
         readonly state: DoctorFileInput;
         readonly supervisors: FrontDoorSupervisorListing;
+        /** The launches registered with the front door whose launcher is still running, each naming the door it was sent to: what tells a superseded door still serving its launches from one serving nothing. */
+        readonly liveSessions: readonly FrontDoorSessionSummary[];
     };
 }
 /**
@@ -5203,34 +5364,6 @@ declare const UsageSnapshotSchema: z.ZodObject<{
 }, z.core.$strict>;
 type UsageSnapshot = z.infer<typeof UsageSnapshotSchema>;
 
-/**
- * The record held in one front-door session-registry file: the launcher's pid plus the per-launch capability token its child presents on every request, and the supervisor of the door the launch was sent to. `supervisorPid` is absent on a record written before it existed and on a door's own transparent-surface record; such a launch cannot be attributed to a door, so a superseded door treats it as its own.
- */
-declare const FrontDoorSessionSchema: z.ZodObject<{
-    pid: z.ZodNumber;
-    startedAt: z.ZodNumber;
-    token: z.ZodString;
-    supervisorPid: z.ZodOptional<z.ZodNumber>;
-}, z.core.$strict>;
-type FrontDoorSession = z.infer<typeof FrontDoorSessionSchema>;
-/**
- * The front-door supervisor's state.json under `<home>/frontdoor/`. Every field is optional because the file exists in stages, exactly like headroom's and the old codex daemon's: a fresh supervisor writes its own pid before the listener is up, and a shut-down front door leaves only the sticky `lastPort` and any `lastError` worth surfacing.
- */
-declare const FrontDoorStateSchema: z.ZodObject<{
-    protocol: z.ZodOptional<z.ZodNumber>;
-    supervisorPid: z.ZodOptional<z.ZodNumber>;
-    port: z.ZodOptional<z.ZodNumber>;
-    lastPort: z.ZodOptional<z.ZodNumber>;
-    connectPort: z.ZodOptional<z.ZodNumber>;
-    lastConnectPort: z.ZodOptional<z.ZodNumber>;
-    directPort: z.ZodOptional<z.ZodNumber>;
-    lastDirectPort: z.ZodOptional<z.ZodNumber>;
-    lastError: z.ZodOptional<z.ZodString>;
-}, z.core.$strict>;
-type FrontDoorState = z.infer<typeof FrontDoorStateSchema>;
-/** A registered launch as status and the idle decision see it: the pid and start time, never the token, so nothing that prints or serialises a session can leak the capability. */
-type FrontDoorSessionSummary = Pick<FrontDoorSession, "pid" | "startedAt" | "supervisorPid">;
-
 /** How a sign-out went: whether OpenAI was told, so the person knows the grant is dead on its side too. */
 interface SiwcLogoutResult {
     readonly hadGrant: boolean;
@@ -12842,95 +12975,30 @@ interface EnsureHeadroomPorts {
     readonly isRunning: (pid: number) => boolean;
     readonly now: () => number;
     readonly sleep: (ms: number) => void;
+    /** The command line of a running process as `ps` reports it, or undefined when it cannot be read: how a daemon started by an earlier release, which reads no allowlist file, is told apart. */
+    readonly daemonCommandLine: (pid: number) => string | undefined;
     /** Spawns the detached supervisor process that owns the headroom daemon, returning its pid. */
     readonly spawnSupervisor: (paths: LayoutPaths) => number;
 }
 /**
- * Brings the headroom daemon up for this launch, or finds it already running, and registers this launcher pid in its session registry (the fact that keeps the daemon alive and defers drift restarts until this launch is done).
+ * Brings the headroom daemon up for this launch, or finds it already running, and registers this launcher pid in its session registry (the fact that keeps the daemon alive and defers a restart for a changed install source or setting until this launch is done). A launch that routes a provider waits, within the same bound, until the supervisor records that the daemon serves an allowlist admitting it.
  *
  * The exclusive-create start lock decides which of several concurrent launches spawns the one supervisor: its holder spawns and keeps waiting like everyone else, everyone else waits on the state file, and a lock whose holder has died is removed and retried. Readiness is "state names a live supervisor, a live headroom pid, and a socket path", which the supervisor only writes after its own `/readyz` probe over that socket has passed, so polling state alone never mistakes a bound-but-not-ready socket for a usable daemon.
  *
- * Throws `HeadroomStartError` (naming the daemon log path and any recorded `lastError`) when the daemon is not up within `HEADROOM_START_TIMEOUT_MS`, or when a live supervisor has recorded a fatal error (a platform without unix sockets and a socket directory that fails the owner-only check are recorded this way, so the launch fails with the reason).
+ * Throws `HeadroomStartError` (naming the daemon log path and any recorded `lastError`, or the allowlist file when that is what the launch waited on) when the daemon is not up, or not serving the allowlist the launch needs, within `HEADROOM_START_TIMEOUT_MS`, or when a live supervisor has recorded a fatal error (a platform without unix sockets and a socket directory that fails the owner-only check are recorded this way, so the launch fails with the reason).
  */
 declare function ensureHeadroom(params: {
     readonly paths: LayoutPaths;
     readonly launcherPid: number;
     readonly ports: EnsureHeadroomPorts;
     /**
-     * The hash of the allowlist the daemon must have been started with for this launch to work, read fresh on every poll because the front door's address it contains can change while the launch waits. Given for a launch that routes a provider through headroom, whose requests come back to the front door's direct origin and are refused by a daemon that was started without it; absent for a launch that only needs Claude Code's own API, which every daemon admits.
+     * The upstreams the daemon must admit for this launch to work, read fresh on every poll because the front door's address among them can change while the launch waits. Given for a launch that routes a provider through headroom, whose requests come back to the front door's direct origin and are refused by a daemon whose allowlist lacks it; absent for a launch that only needs Claude Code's own API, which every daemon admits. `launchRequiredUpstreams` computes them for a provider launch: the serving door's direct origin. The daemon may admit more (a superseded door still serving its own sessions keeps its origin admitted), so the check is that these are among what it serves, not that the lists are equal.
      */
-    readonly requiredAllowlistHash?: () => string;
+    readonly requiredUpstreams?: () => readonly string[];
 }): {
     readonly socketPath: string;
 };
 
-/** The token-saving settings of the `headroom` config block, without its install and lifecycle fields (`source`, `idleShutdownMinutes`). */
-type HeadroomSettings = Pick<HeadroomGlobalConfig, "mode" | "targetRatio" | "ccr" | "rolloutChannel" | "interceptToolResults" | "readMaturation">;
-
-/** Everything the supervisor needs to run the daemon, resolved from the global config and the filesystem before it starts. */
-interface HeadroomSupervisorConfig {
-    /** The install spec as configured (`headroom.source`), already defaulted. */
-    readonly source: string;
-    /** `headroom.idleShutdownMinutes`, already defaulted. */
-    readonly idleShutdownMinutes: number;
-    /** The token-saving settings (`mode`, `targetRatio`, `ccr`, the rollout channel and its opt-ins), as configured; unset fields leave headroom on its own defaults. */
-    readonly settings: HeadroomSettings;
-}
-/** How the supervisor resolves the configured source against its defaults. */
-declare function resolveSupervisorConfig(configured: Readonly<HeadroomGlobalConfig>): HeadroomSupervisorConfig;
-/**
- * Every effect the supervisor performs, injected so the whole lifecycle is testable against fakes: no real process, port, clock, or HTTP call ever happens in a unit test.
- */
-interface SupervisorPorts {
-    readonly fs: HeadroomFs;
-    readonly paths: LayoutPaths;
-    readonly ownPid: number;
-    readonly now: () => number;
-    /**
-     * Waits `ms`, yielding to the event loop while it does. Deliberately NOT a synchronous Atomics.wait-style sleep: the real supervisor learns of its child's death through the ChildProcess exit event, and a blocking sleep would stop the event loop from ever delivering it (the exact failure that left an unreaped zombie answering liveness checks as alive).
-     */
-    readonly sleep: (ms: number) => Promise<void>;
-    /**
-     * Zombie-aware liveness, and for a daemon this supervisor spawned, exit-event-backed: the implementation keeps the spawned ChildProcess handle, consumes its exit event (which is also what reaps it), and reports the pid as not running from that moment. A bare signal-0 check is not enough, because a defunct process still answers it.
-     */
-    readonly isRunning: (pid: number) => boolean;
-    /** The platform facts and owner-only checks the daemon's socket directory is prepared and verified with (see `prepareHeadroomSocket`). */
-    readonly socketTrust: HeadroomSocketTrustPorts;
-    /**
-     * Starts `headroom proxy` serving on the unix socket `socketPath` (and on no TCP port) with the given allowlist, returning its pid. Output goes to the daemon log. The implementation must keep the ChildProcess handle and attach an exit listener (detaching the process is fine; unref'ing a child you still need events from is not, since without the listener nothing reaps it and it lingers as a zombie).
-     */
-    readonly spawnHeadroom: (socketPath: string, allowlist: readonly string[], settings: Readonly<HeadroomSettings>) => number;
-    /** Reads the headroom config block as it stands on disk now. The supervisor calls it every tick, so a changed `source` or setting is noticed while the daemon runs and applied by the same quiet-registry restart an allowlist change gets. */
-    readonly readConfig: () => HeadroomSupervisorConfig;
-    /** Stops a process the supervisor owns, escalating SIGTERM to SIGKILL on a bounded timeout (see `stopSupervisedProcess`). */
-    readonly stopProcess: (pid: number) => void;
-    /** True once `GET /readyz` over the unix socket succeeds. */
-    readonly ready: (socketPath: string) => Promise<boolean>;
-    /** Runs `uv tool install <spec>`, logging output to the daemon log. Returns ok=false with the error when `uv` is absent or the install fails. */
-    readonly install: (spec: string) => {
-        readonly ok: boolean;
-        readonly error?: string;
-    };
-    /** The installed `headroom --version` output, or undefined when the binary is not on PATH. */
-    readonly headroomVersion: () => string | undefined;
-    /** The commit the installed headroom was built from, as the install itself records it (`direct_url.json`), or undefined when it was not installed from a git source. */
-    readonly installedCommit: () => string | undefined;
-    readonly log: (line: string) => void;
-}
-/** Options for `runSupervisor`. */
-interface RunSupervisorOptions {
-    /**
-     * Bounds the supervisor loop's iterations. The real supervisor runs until it exits on its own (idle shutdown or fatal error); a bounded run is how tests observe steady-state behaviour (drift deferral, restart-on-crash, pruning) without an infinite loop, and such a run returns `HEADROOM_SUPERVISOR_STILL_RUNNING` instead of an exit code.
-     */
-    readonly tickLimit?: number;
-}
-/**
- * Runs the headroom supervisor loop: install the daemon, start it, keep it alive (for crash or drift), and stop it after the configured idle period with an empty session registry. Returns the process exit code (0 for an idle shutdown, 1 for a fatal setup failure).
- *
- * Every effect flows through `ports`, so the whole loop is unit-testable with a fake clock, filesystem, and processes. The loop awaits its sleeps, which in the real implementation run on a timer: between ticks the event loop turns, the spawned child's exit event is delivered (and the child thereby reaped), and the next tick's liveness check reads the truth.
- */
-declare function runSupervisor(initialConfig: HeadroomSupervisorConfig, ports: SupervisorPorts, options?: RunSupervisorOptions): Promise<number>;
-
 /** Raised by any operation that requires an identity to already exist, when it does not. */
 declare class IdentityNotFoundError extends CliError {
     readonly name: string;
@@ -13395,5 +13463,5 @@ declare const OWN_CLI_FILE_NAME = "cli.cjs";
  */
 declare function agentShimCliPath(distDir?: string | undefined): string;
 
-export { AMBIENT_CREDENTIAL_VARS, AgentKindSchema, AgentMetaSchema, AgentNodeSchema, AgentTreesListInputSchema, AgentTreesListOutputSchema, AgentTreesShowInputSchema, AgentTreesShowOutputSchema, CHECK_CREDENTIAL_APPLIES, CODEX_APP_SERVER_GENERATED_AGAINST, CODEX_APP_SERVER_TIMEOUT_MS, CONNECT_INTERCEPT_HOST, CONNECT_INTERCEPT_HOSTS, CONNECT_LIMITS, CONTROL_PATH_PREFIX, CategoryClassificationOverlaySchema, CategoryClassificationSchema, CategoryMapSchema, CheckReportJsonSchema, CheckRunInputSchema, CliError, CodexAccountReadSchema, CodexAppServerProtocolError, CodexAppServerRequestError, CodexAppServerUnavailableError, CodexLogoutOutputSchema, CodexRateLimitsReadSchema, CodexSignInSchema, CodexStatusOutputSchema, ConfigIdentityAddOutputSchema, ConfigIdentityRemoveInputSchema, ConfigIdentityRemoveOutputSchema, ConfigIdentitySetInputSchema, ConfigIdentitySetOutputSchema, ConfigIdentityUseOutputSchema, ConfigNameInputSchema, ConfigPoolAddInputSchema, ConfigPoolAddOutputSchema, ConfigPoolRemoveInputSchema, ConfigPoolRemoveOutputSchema, ConfigPoolSetInputSchema, ConfigPoolSetOutputSchema, ConfigPoolUseOutputSchema, ConfigProfileAddInputSchema, ConfigProfileAddOutputSchema, ConfigProfileRemoveInputSchema, ConfigProfileRemoveOutputSchema, ConfigProfileSchema, ConfigProfileSetInputSchema, ConfigProfileSetOutputSchema, ConfigProfileUseOutputSchema, ConfigProviderAddInputSchema, ConfigProviderAddOutputSchema, ConfigProviderRemoveInputSchema, ConfigProviderRemoveOutputSchema, ConfigProviderSetInputSchema, ConfigProviderSetOutputSchema, ConfigRuleAddInputSchema, ConfigRuleAddOutputSchema, ConfigRuleRemoveInputSchema, ConfigRuleRemoveOutputSchema, ConfigRuleSetInputSchema, ConfigRuleSetOutputSchema, CredentialCacheSchema, CredentialSchema, CredentialSourceSchema, CredentialSummarySchema, DOOR_EVENT_BUFFER_EVENTS, DOOR_EVENT_SOURCE_RC, DOOR_HEALTH_EVENT_SOURCE, DirectoryRuleAlreadyExistsError, DirectoryRuleMissingTargetError, DirectoryRuleNotFoundError, DirectoryRuleSchema, DirectoryRulesSchema, DoctorFindingSchema, DoctorRunOutputSchema, DoorEventSchema, DoorEventSourceQuerySchema, DoorHealthEventSchema, EXIT_FAILURE, EXIT_USAGE, EffectiveWindowSchema, EntryValueSchema, FARM_MANIFEST_FILENAME, FrontDoorControlMaterialError, FrontDoorNotServingError, FrontDoorRestartOutputSchema, FrontDoorSessionStatusSchema, FrontDoorSessionsOutputSchema, FrontDoorStartError, FrontDoorStateSchema, FrontDoorStatusOutputSchema, GlobalConfigSchema, HeadroomSocketTargetSchema, HeadroomStartError, IdentityAlreadyExistsError, IdentityNotFoundError, IdentitySchema, InvalidCategoryNameError, InvalidIdentityNameError, InvalidProviderNameError, LAUNCH_EVENT_SOURCE, LIVE_TASK_CAP, LaunchLifecycleEventSchema, LaunchRefusedError, LaunchResolveInputSchema, LaunchResolveOutputSchema, LegacyProviderFileError, LiveTaskSchema, MergedAgentNodeSchema, MergedAgentTreeSchema, OWN_CLI_FILE_NAME, PROMPT_CACHE_TTL_MS, PlanClassSchema, PoolGraphError, PoolNameSchema, PoolNotFoundError, PoolPickReportSchema, PoolSchema, PortableConfigSchema, ProfileAlreadyExistsError, ProfileNotFoundError, ProviderAlreadyExistsError, ProviderKindMismatchError, ProviderNotFoundError, ProviderSchema, QUOTA_EXPIRING_EVENT_SOURCE, QuotaExpiringEventSchema, RC_CONTEXT_USAGE_DETAILS, RC_IDLE_EXPIRY_MS, RC_ORPC_PATH_PREFIX, RC_PENDING_DEADLINE_MS, RC_PERMISSION_MODES, RC_READ_FILE_ENCODINGS, RC_REQUEST_PARSE_CAP_BYTES, RC_SELF_HOST_ENV, RC_SELF_HOST_KEEPALIVE_MS, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE, RC_SELF_HOST_RETENTION_MS, RC_SELF_HOST_SCOPE_LIST, RC_SELF_HOST_WORKER_JWT_TTL_SECONDS, RC_SESSIONS_PATH_PREFIX, RC_STREAM_BACKOFF_MS, RC_WEB_FETCH_ALLOW_PRIVATE_ENV, RC_WEB_FETCH_DEADLINE_MS, RC_WEB_FETCH_MAX_BYTES, RC_WEB_FETCH_MAX_REDIRECTS, ROUTED_PATH_PREFIX, RcLiveRateLimitSchema, RcPermissionModeSchema, RcRateLimitInfoSchema, RcRateLimitWindowSchema, RcStreamEnvelopeSchema, RcStreamEventSchema, ResetRowSchema, ResetScheduleSchema, SessionAgentTreeSchema, SessionLookupError, SessionSummarySchema, TaskItemSchema, USAGE_EVENT_SOURCE, UpdateCheckOutputSchema, UsageError, UsageListOutputSchema, UsageLiveOutputSchema, UsageSnapshotError, UsageSnapshotSchema, UsageWindowsInputSchema, UsageWindowsOutputSchema, WhenSchema, WorkflowRunSchema, addDirectoryRule, addIdentity, addPool, addProvider, agentShimCliPath, answerRcControlRequest, applyAgentTaskEvent, authenticateRcSessionMcpServer, buildEntryFacts, buildLayoutPaths, buildRcControlRequestPayload, buildRcControlResponsePayload, buildRcEndSessionPayload, buildRcEventWriteBody, buildRcFileSuggestionsPayload, buildRcGetContextUsagePayload, buildRcGetUsagePayload, buildRcInterruptPayload, buildRcKeepAlivePayload, buildRcMarkReadBody, buildRcMcpAuthenticatePayload, buildRcMcpOAuthCallbackUrlPayload, buildRcMcpReconnectPayload, buildRcMcpStatusPayload, buildRcReadFilePayload, buildRcSetModelPayload, buildRcSetPermissionModePayload, buildRcUserMessagePayload, carryOver, checkReportHasWarnings, checkReportToJson, collectCheckReport, collectDoctorReport, collectFrontDoorStatus, collectPoolPick, collectResets, collectSessionList, createAgentTreesApiRouter, createCodexApiRouter, createConfigApiRouter, createControlApiRouter, createDoorApiNodeHandler, createDoorApiRouter, createDoorEventHub, createDoorHealthPublisher, createEventsApiRouter, createLaunchApiRouter, createLaunchEventPublisher, createLeafCache, createLifecycleApiRouter, createProfile, createQuotaExpiringPublisher, createRcApiNodeHandler, createRcApiRouter, createRcControlHandler, createRcCredentialStore, createRcEventFanout, createRcLiveUsage, createRcSelfHostSurface, createRcSessionTracker, createRcStreamHub, createSseParser, describeProviderEndpoint, detectAmbientCredential, doorApiAuth, doorApiNodeHandlerOf, effectiveWindow, endRcSession, ensureCa, ensureFrontDoor, ensureHeadroom, evaluateAmbientCredentialGuard, evaluateWhen, fetchThroughWebProxy, formatAmbientCredentialGuardMessage, formatCheckReport, formatDoctorReport, formatFrontDoorStatus, forwardableHeaders, frontDoorApiClient, frontDoorApiFromState, frontDoorApiLink, frontDoorRcApiClient, frontDoorRcControl, generateCa, getRcSessionContextUsage, getRcSessionMcpStatus, getRcSessionUsage, headroomSocketTarget, identityExists, injectRcUserMessage, interruptRcSession, isIdentityDirectoryName, isInterceptedHost, isPrivateAddress, isRcContextUsageDetail, isRcPermissionMode, isRcReadFileEncoding, lateRcEventDial, lateRcStreamDial, listDirectoryRules, listIdentities, listProfiles, listProviders, listSessions, listUsageSnapshots, locateSession, matchBranch, mergeLiveTasks, mintLeaf, mintRcSelfHostCredential, observingRoutedRoute, parseConnectTarget, parseRcStreamEnvelope, planOf, poolIdentities, poolSelectedByLaunch, prepareClaudeLaunch, prepareLaunch, profileExists, providerExists, rankPool, rcEventWriteResultFromAnswer, rcFanoutOnDoorHub, rcObserverAsPassthrough, rcRateLimitInfoOf, rcSelfHostFromEnv, rcWebFetchAllowsPrivateFromEnv, readActiveIdentity, readCodexAccount, readCodexRateLimits, readDirectoryRules, readFarmManifest, readFrontDoorControlMaterial, readGlobalConfig, readIdentity, readPools, readProfile, readProvider, readRcSelfHostRecord, readRcSessionFile, readSessionAgentTree, readUsageSnapshot, realCodexAppServerPort, realConnectCertStore, realConnectEffects, realRcControlTransport, realRcEventDial, realRcStreamDial, realRcWebFetch, realSessionFs, reconnectRcSessionMcpServer, recoverFarm, recoveryDiagnostics, refreshLaunchPoolUsage, refreshPoolUsage, refreshStalePoolMembers, removeDirectoryRule, removeIdentity, removePool, removeProfile, removeProvider, requirePool, resolveAgentShimHome, resolveClaudeHome, resolveClaudeLaunch, resolveDecisions, resolveLaunch, resolveLaunchSelection, resolveLayoutPaths, resolveSupervisorConfig, resyncFarm, runCheck, runClaudeLaunch, runDoctor, runFrontDoorSupervisor, runLaunchPlan, runLauncher, runSupervisor, sendRcKeepAlive, servedByPipeline, setAllowAmbientCredential, setDefaultConfigProfile, setGlobalDefaultProfile, setIdentityCredential, setPool, setProfileCategories, setProfileEntries, setProfileLaunchFlags, setProfileMetadata, setRcSessionModel, setRcSessionPermissionMode, showSession, snapshotPath, spawnClaude, startConnectServer, submitRcSessionMcpOAuthCallbackUrl, suggestRcSessionFiles, summariseSession, teleportRcSession, topLevelNames, updateDirectoryRule, updateProvider, useIdentity, watchedInstallEntry, writeDirectoryRules };
+export { AMBIENT_CREDENTIAL_VARS, AgentKindSchema, AgentMetaSchema, AgentNodeSchema, AgentTreesListInputSchema, AgentTreesListOutputSchema, AgentTreesShowInputSchema, AgentTreesShowOutputSchema, CHECK_CREDENTIAL_APPLIES, CODEX_APP_SERVER_GENERATED_AGAINST, CODEX_APP_SERVER_TIMEOUT_MS, CONNECT_INTERCEPT_HOST, CONNECT_INTERCEPT_HOSTS, CONNECT_LIMITS, CONTROL_PATH_PREFIX, CategoryClassificationOverlaySchema, CategoryClassificationSchema, CategoryMapSchema, CheckReportJsonSchema, CheckRunInputSchema, CliError, CodexAccountReadSchema, CodexAppServerProtocolError, CodexAppServerRequestError, CodexAppServerUnavailableError, CodexLogoutOutputSchema, CodexRateLimitsReadSchema, CodexSignInSchema, CodexStatusOutputSchema, ConfigIdentityAddOutputSchema, ConfigIdentityRemoveInputSchema, ConfigIdentityRemoveOutputSchema, ConfigIdentitySetInputSchema, ConfigIdentitySetOutputSchema, ConfigIdentityUseOutputSchema, ConfigNameInputSchema, ConfigPoolAddInputSchema, ConfigPoolAddOutputSchema, ConfigPoolRemoveInputSchema, ConfigPoolRemoveOutputSchema, ConfigPoolSetInputSchema, ConfigPoolSetOutputSchema, ConfigPoolUseOutputSchema, ConfigProfileAddInputSchema, ConfigProfileAddOutputSchema, ConfigProfileRemoveInputSchema, ConfigProfileRemoveOutputSchema, ConfigProfileSchema, ConfigProfileSetInputSchema, ConfigProfileSetOutputSchema, ConfigProfileUseOutputSchema, ConfigProviderAddInputSchema, ConfigProviderAddOutputSchema, ConfigProviderRemoveInputSchema, ConfigProviderRemoveOutputSchema, ConfigProviderSetInputSchema, ConfigProviderSetOutputSchema, ConfigRuleAddInputSchema, ConfigRuleAddOutputSchema, ConfigRuleRemoveInputSchema, ConfigRuleRemoveOutputSchema, ConfigRuleSetInputSchema, ConfigRuleSetOutputSchema, CredentialCacheSchema, CredentialSchema, CredentialSourceSchema, CredentialSummarySchema, DOOR_EVENT_BUFFER_EVENTS, DOOR_EVENT_SOURCE_RC, DOOR_HEALTH_EVENT_SOURCE, DirectoryRuleAlreadyExistsError, DirectoryRuleMissingTargetError, DirectoryRuleNotFoundError, DirectoryRuleSchema, DirectoryRulesSchema, DoctorFindingSchema, DoctorRunOutputSchema, DoorEventSchema, DoorEventSourceQuerySchema, DoorHealthEventSchema, EXIT_FAILURE, EXIT_USAGE, EffectiveWindowSchema, EntryValueSchema, FARM_MANIFEST_FILENAME, FrontDoorControlMaterialError, FrontDoorNotServingError, FrontDoorRestartOutputSchema, FrontDoorSessionStatusSchema, FrontDoorSessionsOutputSchema, FrontDoorStartError, FrontDoorStateSchema, FrontDoorStatusOutputSchema, GlobalConfigSchema, HeadroomSocketTargetSchema, HeadroomStartError, IdentityAlreadyExistsError, IdentityNotFoundError, IdentitySchema, InvalidCategoryNameError, InvalidIdentityNameError, InvalidProviderNameError, LAUNCH_EVENT_SOURCE, LIVE_TASK_CAP, LaunchLifecycleEventSchema, LaunchRefusedError, LaunchResolveInputSchema, LaunchResolveOutputSchema, LegacyProviderFileError, LiveTaskSchema, MergedAgentNodeSchema, MergedAgentTreeSchema, OWN_CLI_FILE_NAME, PROMPT_CACHE_TTL_MS, PlanClassSchema, PoolGraphError, PoolNameSchema, PoolNotFoundError, PoolPickReportSchema, PoolSchema, PortableConfigSchema, ProfileAlreadyExistsError, ProfileNotFoundError, ProviderAlreadyExistsError, ProviderKindMismatchError, ProviderNotFoundError, ProviderSchema, QUOTA_EXPIRING_EVENT_SOURCE, QuotaExpiringEventSchema, RC_CONTEXT_USAGE_DETAILS, RC_IDLE_EXPIRY_MS, RC_ORPC_PATH_PREFIX, RC_PENDING_DEADLINE_MS, RC_PERMISSION_MODES, RC_READ_FILE_ENCODINGS, RC_REQUEST_PARSE_CAP_BYTES, RC_SELF_HOST_ENV, RC_SELF_HOST_KEEPALIVE_MS, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE, RC_SELF_HOST_RETENTION_MS, RC_SELF_HOST_SCOPE_LIST, RC_SELF_HOST_WORKER_JWT_TTL_SECONDS, RC_SESSIONS_PATH_PREFIX, RC_STREAM_BACKOFF_MS, RC_WEB_FETCH_ALLOW_PRIVATE_ENV, RC_WEB_FETCH_DEADLINE_MS, RC_WEB_FETCH_MAX_BYTES, RC_WEB_FETCH_MAX_REDIRECTS, ROUTED_PATH_PREFIX, RcLiveRateLimitSchema, RcPermissionModeSchema, RcRateLimitInfoSchema, RcRateLimitWindowSchema, RcStreamEnvelopeSchema, RcStreamEventSchema, ResetRowSchema, ResetScheduleSchema, SessionAgentTreeSchema, SessionLookupError, SessionSummarySchema, TaskItemSchema, USAGE_EVENT_SOURCE, UpdateCheckOutputSchema, UsageError, UsageListOutputSchema, UsageLiveOutputSchema, UsageSnapshotError, UsageSnapshotSchema, UsageWindowsInputSchema, UsageWindowsOutputSchema, WhenSchema, WorkflowRunSchema, addDirectoryRule, addIdentity, addPool, addProvider, agentShimCliPath, answerRcControlRequest, applyAgentTaskEvent, authenticateRcSessionMcpServer, buildEntryFacts, buildLayoutPaths, buildRcControlRequestPayload, buildRcControlResponsePayload, buildRcEndSessionPayload, buildRcEventWriteBody, buildRcFileSuggestionsPayload, buildRcGetContextUsagePayload, buildRcGetUsagePayload, buildRcInterruptPayload, buildRcKeepAlivePayload, buildRcMarkReadBody, buildRcMcpAuthenticatePayload, buildRcMcpOAuthCallbackUrlPayload, buildRcMcpReconnectPayload, buildRcMcpStatusPayload, buildRcReadFilePayload, buildRcSetModelPayload, buildRcSetPermissionModePayload, buildRcUserMessagePayload, carryOver, checkReportHasWarnings, checkReportToJson, collectCheckReport, collectDoctorReport, collectFrontDoorStatus, collectPoolPick, collectResets, collectSessionList, createAgentTreesApiRouter, createCodexApiRouter, createConfigApiRouter, createControlApiRouter, createDoorApiNodeHandler, createDoorApiRouter, createDoorEventHub, createDoorHealthPublisher, createEventsApiRouter, createLaunchApiRouter, createLaunchEventPublisher, createLeafCache, createLifecycleApiRouter, createProfile, createQuotaExpiringPublisher, createRcApiNodeHandler, createRcApiRouter, createRcControlHandler, createRcCredentialStore, createRcEventFanout, createRcLiveUsage, createRcSelfHostSurface, createRcSessionTracker, createRcStreamHub, createSseParser, describeProviderEndpoint, detectAmbientCredential, doorApiAuth, doorApiNodeHandlerOf, effectiveWindow, endRcSession, ensureCa, ensureFrontDoor, ensureHeadroom, evaluateAmbientCredentialGuard, evaluateWhen, fetchThroughWebProxy, formatAmbientCredentialGuardMessage, formatCheckReport, formatDoctorReport, formatFrontDoorStatus, forwardableHeaders, frontDoorApiClient, frontDoorApiFromState, frontDoorApiLink, frontDoorRcApiClient, frontDoorRcControl, generateCa, getRcSessionContextUsage, getRcSessionMcpStatus, getRcSessionUsage, headroomSocketTarget, identityExists, injectRcUserMessage, interruptRcSession, isIdentityDirectoryName, isInterceptedHost, isPrivateAddress, isRcContextUsageDetail, isRcPermissionMode, isRcReadFileEncoding, lateRcEventDial, lateRcStreamDial, launchRequiredUpstreams, listDirectoryRules, listIdentities, listProfiles, listProviders, listSessions, listUsageSnapshots, locateSession, matchBranch, mergeLiveTasks, mintLeaf, mintRcSelfHostCredential, observingRoutedRoute, parseConnectTarget, parseRcStreamEnvelope, planOf, poolIdentities, poolSelectedByLaunch, prepareClaudeLaunch, prepareLaunch, profileExists, providerExists, rankPool, rcEventWriteResultFromAnswer, rcFanoutOnDoorHub, rcObserverAsPassthrough, rcRateLimitInfoOf, rcSelfHostFromEnv, rcWebFetchAllowsPrivateFromEnv, readActiveIdentity, readCodexAccount, readCodexRateLimits, readDirectoryRules, readFarmManifest, readFrontDoorControlMaterial, readGlobalConfig, readIdentity, readPools, readProfile, readProvider, readRcSelfHostRecord, readRcSessionFile, readSessionAgentTree, readUsageSnapshot, realCodexAppServerPort, realConnectCertStore, realConnectEffects, realRcControlTransport, realRcEventDial, realRcStreamDial, realRcWebFetch, realSessionFs, reconnectRcSessionMcpServer, recoverFarm, recoveryDiagnostics, refreshLaunchPoolUsage, refreshPoolUsage, refreshStalePoolMembers, removeDirectoryRule, removeIdentity, removePool, removeProfile, removeProvider, requirePool, resolveAgentShimHome, resolveClaudeHome, resolveClaudeLaunch, resolveDecisions, resolveLaunch, resolveLaunchSelection, resolveLayoutPaths, resolveSupervisorConfig, resyncFarm, runCheck, runClaudeLaunch, runDoctor, runFrontDoorSupervisor, runLaunchPlan, runLauncher, runSupervisor, sendRcKeepAlive, servedByPipeline, setAllowAmbientCredential, setDefaultConfigProfile, setGlobalDefaultProfile, setIdentityCredential, setPool, setProfileCategories, setProfileEntries, setProfileLaunchFlags, setProfileMetadata, setRcSessionModel, setRcSessionPermissionMode, showSession, snapshotPath, spawnClaude, startConnectServer, submitRcSessionMcpOAuthCallbackUrl, suggestRcSessionFiles, summariseSession, teleportRcSession, topLevelNames, updateDirectoryRule, updateProvider, useIdentity, watchedInstallEntry, writeDirectoryRules };
 export type { AddDirectoryRuleOptions, AddProviderInput, AgentKind, AgentNode, AgentReadFs, AgentTreesApiDeps, AgentTreesApiRouter, AmbientCredentialDetection, AmbientCredentialGuardResult, AmbientCredentialVar, AnthropicUsageRefresher, BuildEntryFactsParams, CaMaterial, Candidate, CarryOverParams, CarryOverResult, CategoryMap, CheckReport, CheckReportJson, ClaudeLaunchResolution, CodexAccountRead, CodexApiClient, CodexApiDeps, CodexApiRouter, CodexAppServerConnection, CodexAppServerPort, CodexAppServerReadOptions, CodexRateLimitsRead, CollectCheckReportParams, CollectDoctorReportParams, CompiledRule, ConditionContext, ConfigApiDeps, ConfigApiRouter, ConfigProfile, ConnectCertStore, ConnectEffects, ConnectLimits, ConnectLocalSurface, ConnectServerConfig, ConnectServerHandle, ConnectTarget, ControlApiClient, ControlApiDeps, ControlApiRouter, Credential, CredentialSource, Decision, Diagnostic, DirectoryRule, DirectoryRules, DoctorReport, DoorApiClient, DoorApiContext, DoorApiDeps, DoorApiRouter, DoorEvent, DoorEventHub, DoorEventPublisher, DoorEventStream, DoorEventsApiDeps, DoorHealthEvent, DoorHealthPublisher, EffectiveWindow, EliminatedRule, EnsureFrontDoorPorts, EnsureHeadroomPorts, EntryFact, EntryFacts, EntryValue, EvaluateAmbientCredentialGuardParams, FlattenedCascade, FrontDoorControlMaterial, FrontDoorRcControl, FrontDoorSessionStatus, FrontDoorStatus, FrontDoorSupervisorPorts, GlobalConfig, HeadroomSupervisorConfig, Identity, IdentityCredentialChange, IdentityListEntry, IdentityListing, IdentitySession, InjectedCredential, LaunchApiDeps, LaunchApiRouter, LaunchDecision, LaunchEventPublisher, LaunchLifecycleEvent, LaunchPlan, LaunchPoolDecision, LaunchResolution, LaunchSelection, Layer, LayerId, LayoutPaths, LeafCert, LifecycleApiClient, LifecycleApiDeps, LifecycleApiRouter, LiveTask, LiveTaskBook, LocatedSession, MergedAgentNode, MergedAgentTree, NestedContribution, OwnExecutableStat, PlanClass, Pool, PoolMember, PoolPickReport, PoolRanking, PortableConfig, PrepareClaudeLaunchOptions, PrepareLaunchParams, ProfileListEntry, Provider, ProviderListEntry, QuotaExpiringEvent, QuotaExpiringPublisher, RankPoolInput, RcAnswerDecision, RcAnswerDeps, RcApiClient, RcApiDeps, RcApiRouter, RcContextUsageDetail, RcControlAnswer, RcControlHandlerDeps, RcControlRequestDeps, RcControlTransport, RcCredentialStore, RcDialAnswer, RcDialTarget, RcEventDial, RcEventFanout, RcEventWriteResult, RcExchangeObserver, RcInjectDeps, RcLiveRateLimit, RcLiveUsage, RcLiveUsageDeps, RcObservedCredential, RcObservedRequest, RcPendingRequestSummary, RcPermissionMode, RcPresenceAnswer, RcRateLimitInfo, RcRateLimitWindow, RcReadFileEncoding, RcReadFileOptions, RcSelfHostCredentialRecord, RcSelfHostDeps, RcSelfHostMintResult, RcSelfHostSurface, RcSessionStatus, RcSessionSummary, RcSessionTracker, RcSessionTrackerDeps, RcStreamAnswer, RcStreamDial, RcStreamEnvelope, RcStreamEvent, RcStreamHub, RcStreamHubDeps, RcWebFetchDeps, RcWebFetchHop, RcWebFetchOutcome, RcWebFetcher, RcWorkerFact, RcWriteHeaders, ReadSessionOptions, RecoverFarmParams, RecoveryResult, RefreshLaunchPoolUsageOptions, RefreshPoolUsageParams, RefreshStalePoolMembersParams, ResetRow, ResetSchedule, ResolveClaudeLaunchOptions, ResolveDecisionsInput, ResolveLaunchSelectionParams, ResolvedState, ResyncFarmParams, ResyncFarmResult, RunCheckParams, RunClaudeLaunchOptions, RunDoctorParams, RunFrontDoorSupervisorOptions, RunLauncherParams, RunSupervisorOptions, SessionAgentTree, SessionCommandFs, SessionListFilters, SessionRef, SessionSummary, SessionView, SpawnClaudeParams, SseParsedEvent, StickyPick, SupervisorPorts, TaskItem, UnreadableIdentityListEntry, UpdateDirectoryRuleOptions, UpdateProviderInput, UsageChangeEvent, UsageReadFs, UsageSnapshot, WhenCondition, WhenEvaluation, WorkflowRun };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-use",
-  "version": "9.19.1",
+  "version": "10.0.1",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",