claude-use 9.4.2 → 9.5.0

package/README.md

@@ -133,6 +133,7 @@ agent-shim codex status [--json]
 agent-shim codex login [--no-open] [--json]       # Sign in with ChatGPT, for providers with `codex.login: chatgpt-sign-in`
 agent-shim codex logout [--json]
 agent-shim frontdoor status [--json]
+agent-shim frontdoor restart [--json]        # replace the serving door in place; running sessions reach it on their next request
 agent-shim frontdoor rc list [--json]
 agent-shim frontdoor rc status [<cse_id>] [--json]
 agent-shim frontdoor rc pending [<cse_id>] [--json]
@@ -155,7 +156,7 @@ agent-shim frontdoor rc watch [<cse_id>] [--json]
 agent-shim frontdoor rc selfhost mint <identity> [--force] [--json]
 agent-shim usage [--identity <name>] [--provider <name>] [--since <duration>] [--refresh] [--json]
 agent-shim account show [<identity>] [--refresh] [--json]
-agent-shim update [--check] [--mode <off|notify|auto>] [--json]
+agent-shim update [--check] [--restart-door] [--mode <off|notify|auto>] [--json]
 agent-shim completion <bash|zsh|fish>
 agent-shim shim enable [--dir <path>] [--force]
 agent-shim shim disable [--dir <path>] [--force]

package/dist/cli.cjs

@@ -33224,7 +33224,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "claude-use",
-      version: "9.4.2",
+      version: "9.5.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -61133,11 +61133,11 @@ function ensureFrontDoor(params) {
     if (supervisorPid !== void 0 && !distrusted.has(supervisorPid) && ports.isRunning(supervisorPid)) {
       if (state?.port !== void 0 && state.connectPort !== void 0) {
         const verdict = ports.verifyListener(state.port);
-        if (verdict.ok && (state.protocol ?? 0) < FRONT_DOOR_PROTOCOL && !replaced) {
+        if (verdict.ok && !replaced && !spawned && (params.replace === true || (state.protocol ?? 0) < FRONT_DOOR_PROTOCOL)) {
           ports.stopSupervisor(supervisorPid);
           while (ports.isRunning(supervisorPid)) {
             if (ports.now() >= deadline) {
-              throw new FrontDoorStartError(`the front door (pid ${String(supervisorPid)}, protocol ${String(state.protocol ?? 0)}) is older than this launcher (protocol ${String(FRONT_DOOR_PROTOCOL)}) and did not exit when asked. Daemon log: ${paths.frontdoorLogPath}`);
+              throw new FrontDoorStartError(`the front door (pid ${String(supervisorPid)}, protocol ${String(state.protocol ?? 0)}; this launcher speaks protocol ${String(FRONT_DOOR_PROTOCOL)}) was asked to be replaced and did not exit. Daemon log: ${paths.frontdoorLogPath}`);
             }
             ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
           }
@@ -61183,6 +61183,23 @@ function ensureFrontDoor(params) {
     ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
   }
 }
+function restartFrontDoor(params) {
+  const { paths, ports } = params;
+  const previousPid = readFrontDoorState(ports.fs, paths.frontdoorStateFile)?.supervisorPid;
+  if (previousPid === void 0 || !ports.isRunning(previousPid)) {
+    return { action: "not-running" };
+  }
+  try {
+    ensureFrontDoor({ paths, launcherPid: params.pid, replace: true, ports });
+  } finally {
+    removeFrontDoorSession(ports.fs, paths.frontdoorSessionsDir, params.pid);
+  }
+  const pid = readFrontDoorState(ports.fs, paths.frontdoorStateFile)?.supervisorPid;
+  if (pid === void 0) {
+    throw new FrontDoorStartError(`the front door was replaced but its state records no supervisor. Daemon log: ${paths.frontdoorLogPath}`);
+  }
+  return { action: "restarted", previousPid, pid };
+}
 var import_node_crypto10, FRONTDOOR_START_TIMEOUT_MS, FRONTDOOR_LAUNCHER_POLL_MS, FrontDoorStartError;
 var init_ensure2 = __esm({
   "src/frontdoor/ensure.ts"() {
@@ -61311,25 +61328,27 @@ var init_trust = __esm({
 });
 
 // src/frontdoor/realFrontDoorPort.ts
+function realEnsurePorts(paths, spawnDaemon) {
+  return {
+    fs: realFarmFs,
+    isRunning: realIsProcessRunning,
+    now: () => Date.now(),
+    sleep: realSleepSync,
+    spawnSupervisor: (layout) => spawnDaemon(layout, "__frontdoor-supervisor", layout.frontdoorLogPath),
+    stopSupervisor: (pid) => {
+      process.kill(pid, "SIGTERM");
+    },
+    // Read fresh for each probe: a replacement supervisor may have regenerated an unparseable CA, and the probe must trust exactly what the serving door's leaf chains to.
+    verifyListener: (port) => probeFrontDoorSync(port, import_node_fs12.default.readFileSync(paths.frontdoorCaCertFile, "utf8"))
+  };
+}
+function realRestartFrontDoor(paths, spawnDaemon) {
+  return restartFrontDoor({ paths, pid: process.pid, ports: realEnsurePorts(paths, spawnDaemon) });
+}
 function realFrontDoorPort(paths, spawnDaemon) {
   return {
     ensure: (inheritedExtraCaCerts) => {
-      const up2 = ensureFrontDoor({
-        paths,
-        launcherPid: process.pid,
-        ports: {
-          fs: realFarmFs,
-          isRunning: realIsProcessRunning,
-          now: () => Date.now(),
-          sleep: realSleepSync,
-          spawnSupervisor: (layout) => spawnDaemon(layout, "__frontdoor-supervisor", layout.frontdoorLogPath),
-          stopSupervisor: (pid) => {
-            process.kill(pid, "SIGTERM");
-          },
-          // Read fresh for each probe: a replacement supervisor may have regenerated an unparseable CA, and the probe must trust exactly what the serving door's leaf chains to.
-          verifyListener: (port) => probeFrontDoorSync(port, import_node_fs12.default.readFileSync(paths.frontdoorCaCertFile, "utf8"))
-        }
-      });
+      const up2 = ensureFrontDoor({ paths, launcherPid: process.pid, ports: realEnsurePorts(paths, spawnDaemon) });
       const trust = resolveTrustBundle({ caCertFile: paths.frontdoorCaCertFile, bundlesDir: paths.frontdoorCaBundlesDir, variable: "NODE_EXTRA_CA_CERTS", inherited: inheritedExtraCaCerts, fs: realTrustBundleFs });
       return {
         port: up2.port,
@@ -61351,9 +61370,9 @@ var init_realFrontDoorPort = __esm({
     import_node_fs12 = __toESM(require("node:fs"), 1);
     init_realPorts();
     init_ensure2();
+    init_state2();
     init_probe();
     init_trust();
-    init_state2();
     realTrustBundleFs = {
       readFileUtf8: (file2) => import_node_fs12.default.readFileSync(file2, "utf8"),
       exists: (file2) => import_node_fs12.default.existsSync(file2),
@@ -62163,7 +62182,7 @@ function runLaunchUpdateCheck(params) {
         return;
       }
       if (mode === "auto") {
-        port.spawnDetached(["update"]);
+        port.spawnDetached(["update", "--restart-door"]);
       }
       if (!childStarted) {
         port.writeErr(updateNotifyLine(currentVersion, latest));
@@ -114785,6 +114804,9 @@ function attachingProviderCredential(route, deps) {
   };
 }
 
+// src/frontdoor/commands.ts
+init_realFrontDoorPort();
+
 // src/frontdoor/rcCommands.ts
 var import_node_crypto19 = require("node:crypto");
 init_commandDeps();
@@ -117420,6 +117442,7 @@ function createRcStreamHub(deps) {
   };
   const runLoop = async (attachment) => {
     let retriedUnauthorized = false;
+    let refusedAuthorization;
     for (; ; ) {
       if (attachment.isStopped()) {
         return;
@@ -117435,6 +117458,11 @@ function createRcStreamHub(deps) {
         }
         return;
       }
+      if (refusedAuthorization !== void 0 && credential.authorization === refusedAuthorization) {
+        await deps.sleep(deps.backoffMs);
+        continue;
+      }
+      refusedAuthorization = void 0;
       let outcome;
       try {
         outcome = await attempt(attachment, credential);
@@ -117461,7 +117489,8 @@ function createRcStreamHub(deps) {
         retriedUnauthorized = true;
         continue;
       }
-      deps.log?.(`rc stream ${attachment.sessionId}: the client read stream refused the observed Authorization bearer past one retry; backing off`);
+      deps.log?.(`rc stream ${attachment.sessionId}: the client read stream refused the observed Authorization bearer past one retry; waiting for a fresh one`);
+      refusedAuthorization = credential.authorization;
       await deps.sleep(deps.backoffMs);
       retriedUnauthorized = false;
     }
@@ -117934,6 +117963,19 @@ function registerFrontDoorCommand(program2, deps) {
     }),
     ["agent-shim frontdoor status", "agent-shim frontdoor status --json"]
   );
+  withExamples(
+    frontdoor.command("restart").description(
+      "Replace the serving front door with one started from the installed binary, in place: it binds the same ports, so running sessions reach it on their next request. A request in flight when the old door exits fails once. Does nothing when no door is serving."
+    ).option("--json", "Print the result as JSON.").action((options) => {
+      const result = realRestartFrontDoor(paths, spawnDetachedSupervisor);
+      if (options.json === true) {
+        printJson(result);
+        return;
+      }
+      console.log(result.action === "not-running" ? "no front door is serving; nothing to restart" : `front door restarted: pid ${String(result.previousPid)} -> ${String(result.pid)}`);
+    }),
+    ["agent-shim frontdoor restart", "agent-shim frontdoor restart --json"]
+  );
   registerRcCommand(frontdoor, paths);
   program2.command("__frontdoor-supervisor", { hidden: true }).description("Internal: serve the front-door routing listeners. Started by the launcher; never run by hand.").allowUnknownOption().action(async () => {
     const idleShutdownMinutes = readGlobalConfig(paths)?.frontdoor?.idleShutdownMinutes ?? FRONTDOOR_DEFAULT_IDLE_SHUTDOWN_MINUTES;
@@ -118972,6 +119014,7 @@ init_package();
 init_commandDeps();
 init_store();
 init_schema();
+init_realFrontDoorPort();
 init_realPorts();
 init_update();
 function isEnoent6(error62) {
@@ -119122,7 +119165,7 @@ function registerUpdateCommand(program2, deps, ports = realUpdatePorts) {
   withExamples(
     program2.command("update").description(
       "Download the newest release binary and install it over the running one. An installation that belongs to a package manager (Homebrew, npm, Scoop) names its channel and its upgrade command instead of updating in place. With --mode, set the launch-time update mode in the global config instead of updating now."
-    ).option("--check", "Only report whether a newer release exists; download and change nothing.").addOption(new Option("--mode <mode>", "Set what a launch does about a newer release (off: nothing; notify: print one line; auto: also apply it in the background) in the global config, then exit.").choices(UPDATE_MODES)).option("--json", "Print the result as JSON.").action(async (options) => {
+    ).option("--check", "Only report whether a newer release exists; download and change nothing.").option("--restart-door", "After installing a newer release, replace the serving front door with one started from it, in place, instead of leaving the old one until its sessions end.").addOption(new Option("--mode <mode>", "Set what a launch does about a newer release (off: nothing; notify: print one line; auto: also apply it in the background) in the global config, then exit.").choices(UPDATE_MODES)).option("--json", "Print the result as JSON.").action(async (options) => {
       const mode = options.mode;
       if (mode !== void 0) {
         setUpdateMode(deps.paths, mode);
@@ -119140,11 +119183,15 @@ function registerUpdateCommand(program2, deps, ports = realUpdatePorts) {
         checkOnly: options.check === true,
         pid: process.pid
       });
+      const doorRestart = options.restartDoor === true && report.action === "updated" ? realRestartFrontDoor(deps.paths, spawnDetachedSupervisor) : void 0;
       if (options.json === true) {
-        printJson(report);
+        printJson(doorRestart === void 0 ? report : { ...report, frontdoor: doorRestart });
         return;
       }
       console.log(formatUpdateReport(report));
+      if (doorRestart?.action === "restarted") {
+        console.log(`front door restarted: pid ${String(doorRestart.previousPid)} -> ${String(doorRestart.pid)}`);
+      }
     }),
     ["agent-shim update", "agent-shim update --check", "agent-shim update --mode auto", "agent-shim update --json"]
   );

package/dist/index.cjs

@@ -2649,7 +2649,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "claude-use",
-      version: "9.4.2",
+      version: "9.5.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -6078,11 +6078,11 @@ function ensureFrontDoor(params) {
     if (supervisorPid !== void 0 && !distrusted.has(supervisorPid) && ports.isRunning(supervisorPid)) {
       if (state?.port !== void 0 && state.connectPort !== void 0) {
         const verdict = ports.verifyListener(state.port);
-        if (verdict.ok && (state.protocol ?? 0) < FRONT_DOOR_PROTOCOL && !replaced) {
+        if (verdict.ok && !replaced && !spawned && (params.replace === true || (state.protocol ?? 0) < FRONT_DOOR_PROTOCOL)) {
           ports.stopSupervisor(supervisorPid);
           while (ports.isRunning(supervisorPid)) {
             if (ports.now() >= deadline) {
-              throw new FrontDoorStartError(`the front door (pid ${String(supervisorPid)}, protocol ${String(state.protocol ?? 0)}) is older than this launcher (protocol ${String(FRONT_DOOR_PROTOCOL)}) and did not exit when asked. Daemon log: ${paths.frontdoorLogPath}`);
+              throw new FrontDoorStartError(`the front door (pid ${String(supervisorPid)}, protocol ${String(state.protocol ?? 0)}; this launcher speaks protocol ${String(FRONT_DOOR_PROTOCOL)}) was asked to be replaced and did not exit. Daemon log: ${paths.frontdoorLogPath}`);
             }
             ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
           }
@@ -6755,7 +6755,7 @@ function runLaunchUpdateCheck(params) {
         return;
       }
       if (mode === "auto") {
-        port.spawnDetached(["update"]);
+        port.spawnDetached(["update", "--restart-door"]);
       }
       if (!childStarted) {
         port.writeErr(updateNotifyLine(currentVersion, latest));
@@ -7256,25 +7256,24 @@ var init_trust = __esm({
 });
 
 // src/frontdoor/realFrontDoorPort.ts
+function realEnsurePorts(paths, spawnDaemon) {
+  return {
+    fs: realFarmFs,
+    isRunning: realIsProcessRunning,
+    now: () => Date.now(),
+    sleep: realSleepSync,
+    spawnSupervisor: (layout) => spawnDaemon(layout, "__frontdoor-supervisor", layout.frontdoorLogPath),
+    stopSupervisor: (pid) => {
+      process.kill(pid, "SIGTERM");
+    },
+    // Read fresh for each probe: a replacement supervisor may have regenerated an unparseable CA, and the probe must trust exactly what the serving door's leaf chains to.
+    verifyListener: (port) => probeFrontDoorSync(port, import_node_fs10.default.readFileSync(paths.frontdoorCaCertFile, "utf8"))
+  };
+}
 function realFrontDoorPort(paths, spawnDaemon) {
   return {
     ensure: (inheritedExtraCaCerts) => {
-      const up = ensureFrontDoor({
-        paths,
-        launcherPid: process.pid,
-        ports: {
-          fs: realFarmFs,
-          isRunning: realIsProcessRunning,
-          now: () => Date.now(),
-          sleep: realSleepSync,
-          spawnSupervisor: (layout) => spawnDaemon(layout, "__frontdoor-supervisor", layout.frontdoorLogPath),
-          stopSupervisor: (pid) => {
-            process.kill(pid, "SIGTERM");
-          },
-          // Read fresh for each probe: a replacement supervisor may have regenerated an unparseable CA, and the probe must trust exactly what the serving door's leaf chains to.
-          verifyListener: (port) => probeFrontDoorSync(port, import_node_fs10.default.readFileSync(paths.frontdoorCaCertFile, "utf8"))
-        }
-      });
+      const up = ensureFrontDoor({ paths, launcherPid: process.pid, ports: realEnsurePorts(paths, spawnDaemon) });
       const trust = resolveTrustBundle({ caCertFile: paths.frontdoorCaCertFile, bundlesDir: paths.frontdoorCaBundlesDir, variable: "NODE_EXTRA_CA_CERTS", inherited: inheritedExtraCaCerts, fs: realTrustBundleFs });
       return {
         port: up.port,
@@ -7296,9 +7295,9 @@ var init_realFrontDoorPort = __esm({
     import_node_fs10 = __toESM(require("node:fs"), 1);
     init_realPorts();
     init_ensure2();
+    init_state();
     init_probe();
     init_trust();
-    init_state();
     realTrustBundleFs = {
       readFileUtf8: (file) => import_node_fs10.default.readFileSync(file, "utf8"),
       exists: (file) => import_node_fs10.default.existsSync(file),
@@ -13611,6 +13610,7 @@ function createRcStreamHub(deps) {
   };
   const runLoop = async (attachment) => {
     let retriedUnauthorized = false;
+    let refusedAuthorization;
     for (; ; ) {
       if (attachment.isStopped()) {
         return;
@@ -13626,6 +13626,11 @@ function createRcStreamHub(deps) {
         }
         return;
       }
+      if (refusedAuthorization !== void 0 && credential.authorization === refusedAuthorization) {
+        await deps.sleep(deps.backoffMs);
+        continue;
+      }
+      refusedAuthorization = void 0;
       let outcome;
       try {
         outcome = await attempt(attachment, credential);
@@ -13652,7 +13657,8 @@ function createRcStreamHub(deps) {
         retriedUnauthorized = true;
         continue;
       }
-      deps.log?.(`rc stream ${attachment.sessionId}: the client read stream refused the observed Authorization bearer past one retry; backing off`);
+      deps.log?.(`rc stream ${attachment.sessionId}: the client read stream refused the observed Authorization bearer past one retry; waiting for a fresh one`);
+      refusedAuthorization = credential.authorization;
       await deps.sleep(deps.backoffMs);
       retriedUnauthorized = false;
     }

package/dist/index.mjs

@@ -2625,7 +2625,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "claude-use",
-      version: "9.4.2",
+      version: "9.5.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -6052,11 +6052,11 @@ function ensureFrontDoor(params) {
     if (supervisorPid !== void 0 && !distrusted.has(supervisorPid) && ports.isRunning(supervisorPid)) {
       if (state?.port !== void 0 && state.connectPort !== void 0) {
         const verdict = ports.verifyListener(state.port);
-        if (verdict.ok && (state.protocol ?? 0) < FRONT_DOOR_PROTOCOL && !replaced) {
+        if (verdict.ok && !replaced && !spawned && (params.replace === true || (state.protocol ?? 0) < FRONT_DOOR_PROTOCOL)) {
           ports.stopSupervisor(supervisorPid);
           while (ports.isRunning(supervisorPid)) {
             if (ports.now() >= deadline) {
-              throw new FrontDoorStartError(`the front door (pid ${String(supervisorPid)}, protocol ${String(state.protocol ?? 0)}) is older than this launcher (protocol ${String(FRONT_DOOR_PROTOCOL)}) and did not exit when asked. Daemon log: ${paths.frontdoorLogPath}`);
+              throw new FrontDoorStartError(`the front door (pid ${String(supervisorPid)}, protocol ${String(state.protocol ?? 0)}; this launcher speaks protocol ${String(FRONT_DOOR_PROTOCOL)}) was asked to be replaced and did not exit. Daemon log: ${paths.frontdoorLogPath}`);
             }
             ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
           }
@@ -6728,7 +6728,7 @@ function runLaunchUpdateCheck(params) {
         return;
       }
       if (mode === "auto") {
-        port.spawnDetached(["update"]);
+        port.spawnDetached(["update", "--restart-door"]);
       }
       if (!childStarted) {
         port.writeErr(updateNotifyLine(currentVersion, latest));
@@ -7229,25 +7229,24 @@ var init_trust = __esm({
 
 // src/frontdoor/realFrontDoorPort.ts
 import fs11 from "node:fs";
+function realEnsurePorts(paths, spawnDaemon) {
+  return {
+    fs: realFarmFs,
+    isRunning: realIsProcessRunning,
+    now: () => Date.now(),
+    sleep: realSleepSync,
+    spawnSupervisor: (layout) => spawnDaemon(layout, "__frontdoor-supervisor", layout.frontdoorLogPath),
+    stopSupervisor: (pid) => {
+      process.kill(pid, "SIGTERM");
+    },
+    // Read fresh for each probe: a replacement supervisor may have regenerated an unparseable CA, and the probe must trust exactly what the serving door's leaf chains to.
+    verifyListener: (port) => probeFrontDoorSync(port, fs11.readFileSync(paths.frontdoorCaCertFile, "utf8"))
+  };
+}
 function realFrontDoorPort(paths, spawnDaemon) {
   return {
     ensure: (inheritedExtraCaCerts) => {
-      const up = ensureFrontDoor({
-        paths,
-        launcherPid: process.pid,
-        ports: {
-          fs: realFarmFs,
-          isRunning: realIsProcessRunning,
-          now: () => Date.now(),
-          sleep: realSleepSync,
-          spawnSupervisor: (layout) => spawnDaemon(layout, "__frontdoor-supervisor", layout.frontdoorLogPath),
-          stopSupervisor: (pid) => {
-            process.kill(pid, "SIGTERM");
-          },
-          // Read fresh for each probe: a replacement supervisor may have regenerated an unparseable CA, and the probe must trust exactly what the serving door's leaf chains to.
-          verifyListener: (port) => probeFrontDoorSync(port, fs11.readFileSync(paths.frontdoorCaCertFile, "utf8"))
-        }
-      });
+      const up = ensureFrontDoor({ paths, launcherPid: process.pid, ports: realEnsurePorts(paths, spawnDaemon) });
       const trust = resolveTrustBundle({ caCertFile: paths.frontdoorCaCertFile, bundlesDir: paths.frontdoorCaBundlesDir, variable: "NODE_EXTRA_CA_CERTS", inherited: inheritedExtraCaCerts, fs: realTrustBundleFs });
       return {
         port: up.port,
@@ -7268,9 +7267,9 @@ var init_realFrontDoorPort = __esm({
     "use strict";
     init_realPorts();
     init_ensure2();
+    init_state();
     init_probe();
     init_trust();
-    init_state();
     realTrustBundleFs = {
       readFileUtf8: (file) => fs11.readFileSync(file, "utf8"),
       exists: (file) => fs11.existsSync(file),
@@ -13286,6 +13285,7 @@ function createRcStreamHub(deps) {
   };
   const runLoop = async (attachment) => {
     let retriedUnauthorized = false;
+    let refusedAuthorization;
     for (; ; ) {
       if (attachment.isStopped()) {
         return;
@@ -13301,6 +13301,11 @@ function createRcStreamHub(deps) {
         }
         return;
       }
+      if (refusedAuthorization !== void 0 && credential.authorization === refusedAuthorization) {
+        await deps.sleep(deps.backoffMs);
+        continue;
+      }
+      refusedAuthorization = void 0;
       let outcome;
       try {
         outcome = await attempt(attachment, credential);
@@ -13327,7 +13332,8 @@ function createRcStreamHub(deps) {
         retriedUnauthorized = true;
         continue;
       }
-      deps.log?.(`rc stream ${attachment.sessionId}: the client read stream refused the observed Authorization bearer past one retry; backing off`);
+      deps.log?.(`rc stream ${attachment.sessionId}: the client read stream refused the observed Authorization bearer past one retry; waiting for a fresh one`);
+      refusedAuthorization = credential.authorization;
       await deps.sleep(deps.backoffMs);
       retriedUnauthorized = false;
     }

package/dist/types/index.d.ts

@@ -5526,12 +5526,12 @@ declare function createControlApiRouter(deps: ControlApiDeps): {
                     identity: "identity";
                     provider: "provider";
                     pool: "pool";
+                    keychain: "keychain";
                     "ambient-credential": "ambient-credential";
                     "binary-discovery": "binary-discovery";
                     "claude-shim": "claude-shim";
                     "path-resolution": "path-resolution";
                     "legacy-name": "legacy-name";
-                    keychain: "keychain";
                     "directory-rules": "directory-rules";
                     "categories-local": "categories-local";
                     "active-identity": "active-identity";
@@ -6134,12 +6134,12 @@ declare function createDoorApiRouter(deps: DoorApiDeps): {
                     identity: "identity";
                     provider: "provider";
                     pool: "pool";
+                    keychain: "keychain";
                     "ambient-credential": "ambient-credential";
                     "binary-discovery": "binary-discovery";
                     "claude-shim": "claude-shim";
                     "path-resolution": "path-resolution";
                     "legacy-name": "legacy-name";
-                    keychain: "keychain";
                     "directory-rules": "directory-rules";
                     "categories-local": "categories-local";
                     "active-identity": "active-identity";
@@ -6674,12 +6674,12 @@ declare const DoctorFindingSchema: z.ZodObject<{
         identity: "identity";
         provider: "provider";
         pool: "pool";
+        keychain: "keychain";
         "ambient-credential": "ambient-credential";
         "binary-discovery": "binary-discovery";
         "claude-shim": "claude-shim";
         "path-resolution": "path-resolution";
         "legacy-name": "legacy-name";
-        keychain: "keychain";
         "directory-rules": "directory-rules";
         "categories-local": "categories-local";
         "active-identity": "active-identity";
@@ -6703,12 +6703,12 @@ declare const DoctorRunOutputSchema: z.ZodObject<{
             identity: "identity";
             provider: "provider";
             pool: "pool";
+            keychain: "keychain";
             "ambient-credential": "ambient-credential";
             "binary-discovery": "binary-discovery";
             "claude-shim": "claude-shim";
             "path-resolution": "path-resolution";
             "legacy-name": "legacy-name";
-            keychain: "keychain";
             "directory-rules": "directory-rules";
             "categories-local": "categories-local";
             "active-identity": "active-identity";
@@ -7017,6 +7017,8 @@ declare function ensureFrontDoor(params: {
     readonly paths: LayoutPaths;
     readonly launcherPid: number;
     readonly ports: EnsureFrontDoorPorts;
+    /** Replaces a serving door whatever its protocol, once: the restart a binary update asks for, so the new generation serves the sessions already running without waiting for the registry to empty. */
+    readonly replace?: boolean;
 }): {
     readonly port: number;
     readonly connectPort: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-use",
-  "version": "9.4.2",
+  "version": "9.5.0",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",