claude-use 9.4.3 → 9.5.0

package/README.md

@@ -133,6 +133,7 @@ agent-shim codex status [--json]
 agent-shim codex login [--no-open] [--json]       # Sign in with ChatGPT, for providers with `codex.login: chatgpt-sign-in`
 agent-shim codex logout [--json]
 agent-shim frontdoor status [--json]
+agent-shim frontdoor restart [--json]        # replace the serving door in place; running sessions reach it on their next request
 agent-shim frontdoor rc list [--json]
 agent-shim frontdoor rc status [<cse_id>] [--json]
 agent-shim frontdoor rc pending [<cse_id>] [--json]
@@ -155,7 +156,7 @@ agent-shim frontdoor rc watch [<cse_id>] [--json]
 agent-shim frontdoor rc selfhost mint <identity> [--force] [--json]
 agent-shim usage [--identity <name>] [--provider <name>] [--since <duration>] [--refresh] [--json]
 agent-shim account show [<identity>] [--refresh] [--json]
-agent-shim update [--check] [--mode <off|notify|auto>] [--json]
+agent-shim update [--check] [--restart-door] [--mode <off|notify|auto>] [--json]
 agent-shim completion <bash|zsh|fish>
 agent-shim shim enable [--dir <path>] [--force]
 agent-shim shim disable [--dir <path>] [--force]

package/dist/cli.cjs

@@ -33224,7 +33224,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "claude-use",
-      version: "9.4.3",
+      version: "9.5.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -61133,11 +61133,11 @@ function ensureFrontDoor(params) {
     if (supervisorPid !== void 0 && !distrusted.has(supervisorPid) && ports.isRunning(supervisorPid)) {
       if (state?.port !== void 0 && state.connectPort !== void 0) {
         const verdict = ports.verifyListener(state.port);
-        if (verdict.ok && (state.protocol ?? 0) < FRONT_DOOR_PROTOCOL && !replaced) {
+        if (verdict.ok && !replaced && !spawned && (params.replace === true || (state.protocol ?? 0) < FRONT_DOOR_PROTOCOL)) {
           ports.stopSupervisor(supervisorPid);
           while (ports.isRunning(supervisorPid)) {
             if (ports.now() >= deadline) {
-              throw new FrontDoorStartError(`the front door (pid ${String(supervisorPid)}, protocol ${String(state.protocol ?? 0)}) is older than this launcher (protocol ${String(FRONT_DOOR_PROTOCOL)}) and did not exit when asked. Daemon log: ${paths.frontdoorLogPath}`);
+              throw new FrontDoorStartError(`the front door (pid ${String(supervisorPid)}, protocol ${String(state.protocol ?? 0)}; this launcher speaks protocol ${String(FRONT_DOOR_PROTOCOL)}) was asked to be replaced and did not exit. Daemon log: ${paths.frontdoorLogPath}`);
             }
             ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
           }
@@ -61183,6 +61183,23 @@ function ensureFrontDoor(params) {
     ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
   }
 }
+function restartFrontDoor(params) {
+  const { paths, ports } = params;
+  const previousPid = readFrontDoorState(ports.fs, paths.frontdoorStateFile)?.supervisorPid;
+  if (previousPid === void 0 || !ports.isRunning(previousPid)) {
+    return { action: "not-running" };
+  }
+  try {
+    ensureFrontDoor({ paths, launcherPid: params.pid, replace: true, ports });
+  } finally {
+    removeFrontDoorSession(ports.fs, paths.frontdoorSessionsDir, params.pid);
+  }
+  const pid = readFrontDoorState(ports.fs, paths.frontdoorStateFile)?.supervisorPid;
+  if (pid === void 0) {
+    throw new FrontDoorStartError(`the front door was replaced but its state records no supervisor. Daemon log: ${paths.frontdoorLogPath}`);
+  }
+  return { action: "restarted", previousPid, pid };
+}
 var import_node_crypto10, FRONTDOOR_START_TIMEOUT_MS, FRONTDOOR_LAUNCHER_POLL_MS, FrontDoorStartError;
 var init_ensure2 = __esm({
   "src/frontdoor/ensure.ts"() {
@@ -61311,25 +61328,27 @@ var init_trust = __esm({
 });
 
 // src/frontdoor/realFrontDoorPort.ts
+function realEnsurePorts(paths, spawnDaemon) {
+  return {
+    fs: realFarmFs,
+    isRunning: realIsProcessRunning,
+    now: () => Date.now(),
+    sleep: realSleepSync,
+    spawnSupervisor: (layout) => spawnDaemon(layout, "__frontdoor-supervisor", layout.frontdoorLogPath),
+    stopSupervisor: (pid) => {
+      process.kill(pid, "SIGTERM");
+    },
+    // Read fresh for each probe: a replacement supervisor may have regenerated an unparseable CA, and the probe must trust exactly what the serving door's leaf chains to.
+    verifyListener: (port) => probeFrontDoorSync(port, import_node_fs12.default.readFileSync(paths.frontdoorCaCertFile, "utf8"))
+  };
+}
+function realRestartFrontDoor(paths, spawnDaemon) {
+  return restartFrontDoor({ paths, pid: process.pid, ports: realEnsurePorts(paths, spawnDaemon) });
+}
 function realFrontDoorPort(paths, spawnDaemon) {
   return {
     ensure: (inheritedExtraCaCerts) => {
-      const up2 = ensureFrontDoor({
-        paths,
-        launcherPid: process.pid,
-        ports: {
-          fs: realFarmFs,
-          isRunning: realIsProcessRunning,
-          now: () => Date.now(),
-          sleep: realSleepSync,
-          spawnSupervisor: (layout) => spawnDaemon(layout, "__frontdoor-supervisor", layout.frontdoorLogPath),
-          stopSupervisor: (pid) => {
-            process.kill(pid, "SIGTERM");
-          },
-          // Read fresh for each probe: a replacement supervisor may have regenerated an unparseable CA, and the probe must trust exactly what the serving door's leaf chains to.
-          verifyListener: (port) => probeFrontDoorSync(port, import_node_fs12.default.readFileSync(paths.frontdoorCaCertFile, "utf8"))
-        }
-      });
+      const up2 = ensureFrontDoor({ paths, launcherPid: process.pid, ports: realEnsurePorts(paths, spawnDaemon) });
       const trust = resolveTrustBundle({ caCertFile: paths.frontdoorCaCertFile, bundlesDir: paths.frontdoorCaBundlesDir, variable: "NODE_EXTRA_CA_CERTS", inherited: inheritedExtraCaCerts, fs: realTrustBundleFs });
       return {
         port: up2.port,
@@ -61351,9 +61370,9 @@ var init_realFrontDoorPort = __esm({
     import_node_fs12 = __toESM(require("node:fs"), 1);
     init_realPorts();
     init_ensure2();
+    init_state2();
     init_probe();
     init_trust();
-    init_state2();
     realTrustBundleFs = {
       readFileUtf8: (file2) => import_node_fs12.default.readFileSync(file2, "utf8"),
       exists: (file2) => import_node_fs12.default.existsSync(file2),
@@ -62163,7 +62182,7 @@ function runLaunchUpdateCheck(params) {
         return;
       }
       if (mode === "auto") {
-        port.spawnDetached(["update"]);
+        port.spawnDetached(["update", "--restart-door"]);
       }
       if (!childStarted) {
         port.writeErr(updateNotifyLine(currentVersion, latest));
@@ -114785,6 +114804,9 @@ function attachingProviderCredential(route, deps) {
   };
 }
 
+// src/frontdoor/commands.ts
+init_realFrontDoorPort();
+
 // src/frontdoor/rcCommands.ts
 var import_node_crypto19 = require("node:crypto");
 init_commandDeps();
@@ -117941,6 +117963,19 @@ function registerFrontDoorCommand(program2, deps) {
     }),
     ["agent-shim frontdoor status", "agent-shim frontdoor status --json"]
   );
+  withExamples(
+    frontdoor.command("restart").description(
+      "Replace the serving front door with one started from the installed binary, in place: it binds the same ports, so running sessions reach it on their next request. A request in flight when the old door exits fails once. Does nothing when no door is serving."
+    ).option("--json", "Print the result as JSON.").action((options) => {
+      const result = realRestartFrontDoor(paths, spawnDetachedSupervisor);
+      if (options.json === true) {
+        printJson(result);
+        return;
+      }
+      console.log(result.action === "not-running" ? "no front door is serving; nothing to restart" : `front door restarted: pid ${String(result.previousPid)} -> ${String(result.pid)}`);
+    }),
+    ["agent-shim frontdoor restart", "agent-shim frontdoor restart --json"]
+  );
   registerRcCommand(frontdoor, paths);
   program2.command("__frontdoor-supervisor", { hidden: true }).description("Internal: serve the front-door routing listeners. Started by the launcher; never run by hand.").allowUnknownOption().action(async () => {
     const idleShutdownMinutes = readGlobalConfig(paths)?.frontdoor?.idleShutdownMinutes ?? FRONTDOOR_DEFAULT_IDLE_SHUTDOWN_MINUTES;
@@ -118979,6 +119014,7 @@ init_package();
 init_commandDeps();
 init_store();
 init_schema();
+init_realFrontDoorPort();
 init_realPorts();
 init_update();
 function isEnoent6(error62) {
@@ -119129,7 +119165,7 @@ function registerUpdateCommand(program2, deps, ports = realUpdatePorts) {
   withExamples(
     program2.command("update").description(
       "Download the newest release binary and install it over the running one. An installation that belongs to a package manager (Homebrew, npm, Scoop) names its channel and its upgrade command instead of updating in place. With --mode, set the launch-time update mode in the global config instead of updating now."
-    ).option("--check", "Only report whether a newer release exists; download and change nothing.").addOption(new Option("--mode <mode>", "Set what a launch does about a newer release (off: nothing; notify: print one line; auto: also apply it in the background) in the global config, then exit.").choices(UPDATE_MODES)).option("--json", "Print the result as JSON.").action(async (options) => {
+    ).option("--check", "Only report whether a newer release exists; download and change nothing.").option("--restart-door", "After installing a newer release, replace the serving front door with one started from it, in place, instead of leaving the old one until its sessions end.").addOption(new Option("--mode <mode>", "Set what a launch does about a newer release (off: nothing; notify: print one line; auto: also apply it in the background) in the global config, then exit.").choices(UPDATE_MODES)).option("--json", "Print the result as JSON.").action(async (options) => {
       const mode = options.mode;
       if (mode !== void 0) {
         setUpdateMode(deps.paths, mode);
@@ -119147,11 +119183,15 @@ function registerUpdateCommand(program2, deps, ports = realUpdatePorts) {
         checkOnly: options.check === true,
         pid: process.pid
       });
+      const doorRestart = options.restartDoor === true && report.action === "updated" ? realRestartFrontDoor(deps.paths, spawnDetachedSupervisor) : void 0;
       if (options.json === true) {
-        printJson(report);
+        printJson(doorRestart === void 0 ? report : { ...report, frontdoor: doorRestart });
         return;
       }
       console.log(formatUpdateReport(report));
+      if (doorRestart?.action === "restarted") {
+        console.log(`front door restarted: pid ${String(doorRestart.previousPid)} -> ${String(doorRestart.pid)}`);
+      }
     }),
     ["agent-shim update", "agent-shim update --check", "agent-shim update --mode auto", "agent-shim update --json"]
   );

package/dist/index.cjs

@@ -2649,7 +2649,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "claude-use",
-      version: "9.4.3",
+      version: "9.5.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -6078,11 +6078,11 @@ function ensureFrontDoor(params) {
     if (supervisorPid !== void 0 && !distrusted.has(supervisorPid) && ports.isRunning(supervisorPid)) {
       if (state?.port !== void 0 && state.connectPort !== void 0) {
         const verdict = ports.verifyListener(state.port);
-        if (verdict.ok && (state.protocol ?? 0) < FRONT_DOOR_PROTOCOL && !replaced) {
+        if (verdict.ok && !replaced && !spawned && (params.replace === true || (state.protocol ?? 0) < FRONT_DOOR_PROTOCOL)) {
           ports.stopSupervisor(supervisorPid);
           while (ports.isRunning(supervisorPid)) {
             if (ports.now() >= deadline) {
-              throw new FrontDoorStartError(`the front door (pid ${String(supervisorPid)}, protocol ${String(state.protocol ?? 0)}) is older than this launcher (protocol ${String(FRONT_DOOR_PROTOCOL)}) and did not exit when asked. Daemon log: ${paths.frontdoorLogPath}`);
+              throw new FrontDoorStartError(`the front door (pid ${String(supervisorPid)}, protocol ${String(state.protocol ?? 0)}; this launcher speaks protocol ${String(FRONT_DOOR_PROTOCOL)}) was asked to be replaced and did not exit. Daemon log: ${paths.frontdoorLogPath}`);
             }
             ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
           }
@@ -6755,7 +6755,7 @@ function runLaunchUpdateCheck(params) {
         return;
       }
       if (mode === "auto") {
-        port.spawnDetached(["update"]);
+        port.spawnDetached(["update", "--restart-door"]);
       }
       if (!childStarted) {
         port.writeErr(updateNotifyLine(currentVersion, latest));
@@ -7256,25 +7256,24 @@ var init_trust = __esm({
 });
 
 // src/frontdoor/realFrontDoorPort.ts
+function realEnsurePorts(paths, spawnDaemon) {
+  return {
+    fs: realFarmFs,
+    isRunning: realIsProcessRunning,
+    now: () => Date.now(),
+    sleep: realSleepSync,
+    spawnSupervisor: (layout) => spawnDaemon(layout, "__frontdoor-supervisor", layout.frontdoorLogPath),
+    stopSupervisor: (pid) => {
+      process.kill(pid, "SIGTERM");
+    },
+    // Read fresh for each probe: a replacement supervisor may have regenerated an unparseable CA, and the probe must trust exactly what the serving door's leaf chains to.
+    verifyListener: (port) => probeFrontDoorSync(port, import_node_fs10.default.readFileSync(paths.frontdoorCaCertFile, "utf8"))
+  };
+}
 function realFrontDoorPort(paths, spawnDaemon) {
   return {
     ensure: (inheritedExtraCaCerts) => {
-      const up = ensureFrontDoor({
-        paths,
-        launcherPid: process.pid,
-        ports: {
-          fs: realFarmFs,
-          isRunning: realIsProcessRunning,
-          now: () => Date.now(),
-          sleep: realSleepSync,
-          spawnSupervisor: (layout) => spawnDaemon(layout, "__frontdoor-supervisor", layout.frontdoorLogPath),
-          stopSupervisor: (pid) => {
-            process.kill(pid, "SIGTERM");
-          },
-          // Read fresh for each probe: a replacement supervisor may have regenerated an unparseable CA, and the probe must trust exactly what the serving door's leaf chains to.
-          verifyListener: (port) => probeFrontDoorSync(port, import_node_fs10.default.readFileSync(paths.frontdoorCaCertFile, "utf8"))
-        }
-      });
+      const up = ensureFrontDoor({ paths, launcherPid: process.pid, ports: realEnsurePorts(paths, spawnDaemon) });
       const trust = resolveTrustBundle({ caCertFile: paths.frontdoorCaCertFile, bundlesDir: paths.frontdoorCaBundlesDir, variable: "NODE_EXTRA_CA_CERTS", inherited: inheritedExtraCaCerts, fs: realTrustBundleFs });
       return {
         port: up.port,
@@ -7296,9 +7295,9 @@ var init_realFrontDoorPort = __esm({
     import_node_fs10 = __toESM(require("node:fs"), 1);
     init_realPorts();
     init_ensure2();
+    init_state();
     init_probe();
     init_trust();
-    init_state();
     realTrustBundleFs = {
       readFileUtf8: (file) => import_node_fs10.default.readFileSync(file, "utf8"),
       exists: (file) => import_node_fs10.default.existsSync(file),

package/dist/index.mjs

@@ -2625,7 +2625,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "claude-use",
-      version: "9.4.3",
+      version: "9.5.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -6052,11 +6052,11 @@ function ensureFrontDoor(params) {
     if (supervisorPid !== void 0 && !distrusted.has(supervisorPid) && ports.isRunning(supervisorPid)) {
       if (state?.port !== void 0 && state.connectPort !== void 0) {
         const verdict = ports.verifyListener(state.port);
-        if (verdict.ok && (state.protocol ?? 0) < FRONT_DOOR_PROTOCOL && !replaced) {
+        if (verdict.ok && !replaced && !spawned && (params.replace === true || (state.protocol ?? 0) < FRONT_DOOR_PROTOCOL)) {
           ports.stopSupervisor(supervisorPid);
           while (ports.isRunning(supervisorPid)) {
             if (ports.now() >= deadline) {
-              throw new FrontDoorStartError(`the front door (pid ${String(supervisorPid)}, protocol ${String(state.protocol ?? 0)}) is older than this launcher (protocol ${String(FRONT_DOOR_PROTOCOL)}) and did not exit when asked. Daemon log: ${paths.frontdoorLogPath}`);
+              throw new FrontDoorStartError(`the front door (pid ${String(supervisorPid)}, protocol ${String(state.protocol ?? 0)}; this launcher speaks protocol ${String(FRONT_DOOR_PROTOCOL)}) was asked to be replaced and did not exit. Daemon log: ${paths.frontdoorLogPath}`);
             }
             ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
           }
@@ -6728,7 +6728,7 @@ function runLaunchUpdateCheck(params) {
         return;
       }
       if (mode === "auto") {
-        port.spawnDetached(["update"]);
+        port.spawnDetached(["update", "--restart-door"]);
       }
       if (!childStarted) {
         port.writeErr(updateNotifyLine(currentVersion, latest));
@@ -7229,25 +7229,24 @@ var init_trust = __esm({
 
 // src/frontdoor/realFrontDoorPort.ts
 import fs11 from "node:fs";
+function realEnsurePorts(paths, spawnDaemon) {
+  return {
+    fs: realFarmFs,
+    isRunning: realIsProcessRunning,
+    now: () => Date.now(),
+    sleep: realSleepSync,
+    spawnSupervisor: (layout) => spawnDaemon(layout, "__frontdoor-supervisor", layout.frontdoorLogPath),
+    stopSupervisor: (pid) => {
+      process.kill(pid, "SIGTERM");
+    },
+    // Read fresh for each probe: a replacement supervisor may have regenerated an unparseable CA, and the probe must trust exactly what the serving door's leaf chains to.
+    verifyListener: (port) => probeFrontDoorSync(port, fs11.readFileSync(paths.frontdoorCaCertFile, "utf8"))
+  };
+}
 function realFrontDoorPort(paths, spawnDaemon) {
   return {
     ensure: (inheritedExtraCaCerts) => {
-      const up = ensureFrontDoor({
-        paths,
-        launcherPid: process.pid,
-        ports: {
-          fs: realFarmFs,
-          isRunning: realIsProcessRunning,
-          now: () => Date.now(),
-          sleep: realSleepSync,
-          spawnSupervisor: (layout) => spawnDaemon(layout, "__frontdoor-supervisor", layout.frontdoorLogPath),
-          stopSupervisor: (pid) => {
-            process.kill(pid, "SIGTERM");
-          },
-          // Read fresh for each probe: a replacement supervisor may have regenerated an unparseable CA, and the probe must trust exactly what the serving door's leaf chains to.
-          verifyListener: (port) => probeFrontDoorSync(port, fs11.readFileSync(paths.frontdoorCaCertFile, "utf8"))
-        }
-      });
+      const up = ensureFrontDoor({ paths, launcherPid: process.pid, ports: realEnsurePorts(paths, spawnDaemon) });
       const trust = resolveTrustBundle({ caCertFile: paths.frontdoorCaCertFile, bundlesDir: paths.frontdoorCaBundlesDir, variable: "NODE_EXTRA_CA_CERTS", inherited: inheritedExtraCaCerts, fs: realTrustBundleFs });
       return {
         port: up.port,
@@ -7268,9 +7267,9 @@ var init_realFrontDoorPort = __esm({
     "use strict";
     init_realPorts();
     init_ensure2();
+    init_state();
     init_probe();
     init_trust();
-    init_state();
     realTrustBundleFs = {
       readFileUtf8: (file) => fs11.readFileSync(file, "utf8"),
       exists: (file) => fs11.existsSync(file),

package/dist/types/index.d.ts

@@ -7017,6 +7017,8 @@ declare function ensureFrontDoor(params: {
     readonly paths: LayoutPaths;
     readonly launcherPid: number;
     readonly ports: EnsureFrontDoorPorts;
+    /** Replaces a serving door whatever its protocol, once: the restart a binary update asks for, so the new generation serves the sessions already running without waiting for the registry to empty. */
+    readonly replace?: boolean;
 }): {
     readonly port: number;
     readonly connectPort: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-use",
-  "version": "9.4.3",
+  "version": "9.5.0",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",