claude-use 9.5.0 → 9.6.0

package/dist/index.cjs

@@ -2649,7 +2649,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "claude-use",
-      version: "9.5.0",
+      version: "9.6.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -2700,9 +2700,10 @@ var init_package = __esm({
       dependencies: {
         "@anthropic-ai/claude-agent-sdk": "0.3.292",
         "@clack/prompts": "^1.8.0",
-        "@orpc/client": "1.15.4",
-        "@orpc/openapi": "1.15.4",
-        "@orpc/server": "1.15.4",
+        "@modelcontextprotocol/sdk": "1.32.0",
+        "@orpc/client": "2.0.0-beta.41",
+        "@orpc/openapi": "2.0.0-beta.41",
+        "@orpc/server": "2.0.0-beta.41",
         commander: "^15.0.0",
         cosmiconfig: "^10.0.1",
         picomatch: "^4.0.7",
@@ -5767,7 +5768,7 @@ function cascadeProviderName(cascade) {
   }
   return name;
 }
-function resolveProvider(params) {
+function selectProvider(params) {
   const cliName = params.cliProvider !== void 0 && params.cliProvider !== "" ? params.cliProvider : void 0;
   const name = cliName ?? (params.cascade === void 0 ? void 0 : cascadeProviderName(params.cascade));
   if (name === void 0) {
@@ -5782,6 +5783,14 @@ function resolveProvider(params) {
       message: `agent-shim: no provider named "${name}". ` + (known.length > 0 ? `Known providers: ${known.join(", ")}.` : "No providers are defined yet; run `agent-shim provider add`.")
     };
   }
+  return { ok: true, provider: { name, definition } };
+}
+function resolveProvider(params) {
+  const selection = selectProvider(params);
+  if (selection?.ok !== true) {
+    return selection;
+  }
+  const { name, definition } = selection.provider;
   if (params.credentials === void 0) {
     return { ok: false, status: 1, message: `agent-shim: provider ${name} needs its credential resolved, but this launcher has no credential port wired` };
   }
@@ -6064,6 +6073,51 @@ var init_claudeShim = __esm({
   }
 });
 
+// src/update/update.ts
+function compareVersions3(left, right) {
+  const parse = (version) => {
+    const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(version);
+    if (match === null) {
+      throw new Error(`not a plain release version: ${version}`);
+    }
+    return [Number(match[1]), Number(match[2]), Number(match[3])];
+  };
+  const leftParts = parse(left);
+  const rightParts = parse(right);
+  return leftParts.map((part, index) => part - (rightParts[index] ?? 0)).find((difference) => difference !== 0) ?? 0;
+}
+function releaseTagFromUrl(url) {
+  const segment = url.split("?")[0]?.split("/").at(-1);
+  const candidate = segment?.startsWith("v") === true ? segment.slice(1) : void 0;
+  return candidate !== void 0 && /^\d+\.\d+\.\d+$/.test(candidate) ? candidate : void 0;
+}
+var LATEST_RELEASE_URL, UpdateChannelError, UpdateConflictError, UpdateDownloadError;
+var init_update = __esm({
+  "src/update/update.ts"() {
+    "use strict";
+    init_cliError();
+    LATEST_RELEASE_URL = "https://github.com/ExaDev/agent-shim/releases/latest";
+    UpdateChannelError = class extends CliError {
+      constructor(message) {
+        super(message);
+        this.name = "UpdateChannelError";
+      }
+    };
+    UpdateConflictError = class extends CliError {
+      constructor(message) {
+        super(message);
+        this.name = "UpdateConflictError";
+      }
+    };
+    UpdateDownloadError = class extends CliError {
+      constructor(message) {
+        super(message);
+        this.name = "UpdateDownloadError";
+      }
+    };
+  }
+});
+
 // src/frontdoor/ensure.ts
 function ensureFrontDoor(params) {
   const { paths, ports } = params;
@@ -6499,7 +6553,7 @@ function buildEnv(params) {
   const parentCustomHeaders = params.baseEnv.ANTHROPIC_CUSTOM_HEADERS;
   let providerCustomHeaders;
   if (!params.configDirEscapeHatch && params.resolvedIdentityName !== void 0) {
-    env.CLAUDE_CONFIG_DIR = import_node_path31.default.join(params.identitiesDir, params.resolvedIdentityName);
+    env.CLAUDE_CONFIG_DIR = import_node_path32.default.join(params.identitiesDir, params.resolvedIdentityName);
   }
   if (params.provider !== void 0) {
     const providerEnv = params.provider.definition.env ?? {};
@@ -6543,11 +6597,11 @@ function buildEnv(params) {
   }
   return env;
 }
-var import_node_path31, LOOPBACK_HOSTS;
+var import_node_path32, LOOPBACK_HOSTS;
 var init_flags = __esm({
   "src/launcher/flags.ts"() {
     "use strict";
-    import_node_path31 = __toESM(require("node:path"), 1);
+    import_node_path32 = __toESM(require("node:path"), 1);
     init_envBool();
     init_credential();
     init_headers();
@@ -6623,7 +6677,9 @@ function resolvePoolLaunch(params) {
     }
     const { pick, earliestReturn, movedOff } = graph.ranking;
     if (pick !== void 0) {
-      recordStickyPick(params.usageFs, params.paths.usagePicksFile, params.cwd, pick.identity, nowMs);
+      if (params.recordPick) {
+        recordStickyPick(params.usageFs, params.paths.usagePicksFile, params.cwd, pick.identity, nowMs);
+      }
       const move = movedOff === void 0 ? "" : `moved off ${movedOff.identity} (${movedOff.reason}); `;
       return {
         ok: true,
@@ -6689,33 +6745,6 @@ var init_spawn = __esm({
   }
 });
 
-// src/update/update.ts
-function compareVersions3(left, right) {
-  const parse = (version) => {
-    const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(version);
-    if (match === null) {
-      throw new Error(`not a plain release version: ${version}`);
-    }
-    return [Number(match[1]), Number(match[2]), Number(match[3])];
-  };
-  const leftParts = parse(left);
-  const rightParts = parse(right);
-  return leftParts.map((part, index) => part - (rightParts[index] ?? 0)).find((difference) => difference !== 0) ?? 0;
-}
-function releaseTagFromUrl(url) {
-  const segment = url.split("?")[0]?.split("/").at(-1);
-  const candidate = segment?.startsWith("v") === true ? segment.slice(1) : void 0;
-  return candidate !== void 0 && /^\d+\.\d+\.\d+$/.test(candidate) ? candidate : void 0;
-}
-var LATEST_RELEASE_URL;
-var init_update = __esm({
-  "src/update/update.ts"() {
-    "use strict";
-    init_cliError();
-    LATEST_RELEASE_URL = "https://github.com/ExaDev/agent-shim/releases/latest";
-  }
-});
-
 // src/update/launchHook.ts
 function resolveUpdateMode(globalConfig) {
   return globalConfig?.update?.mode ?? "off";
@@ -6793,7 +6822,7 @@ function resolveIdentityCredential(identity, credential, env, port) {
   const resolution = resolveCredential({ credential, env, port, subject: `identity ${identity}` });
   return resolution.ok ? resolution : { ok: false, status: CREDENTIAL_UNAVAILABLE_EXIT, message: resolution.message };
 }
-function pickFromPool(decided, params, parsedArgv) {
+function pickFromPool(decided, params, parsedArgv, readOnly) {
   const { paths, fs: fs12, proc, log } = params;
   if (decided.pool === void 0) {
     return { identityDecision: decided };
@@ -6814,7 +6843,9 @@ function pickFromPool(decided, params, parsedArgv) {
     now: farmRuntime.now,
     sleep: farmRuntime.lock.sleep,
     passthrough: parsedArgv.rest,
-    wait: parsedArgv.wait === true,
+    // A read-only decision never sleeps for a refused pool and never records its pick, so asking what a launch would pick leaves the next real launch's keep-warm preference as it was.
+    wait: !readOnly && parsedArgv.wait === true,
+    recordPick: !readOnly,
     log
   });
   if (!resolution.ok) {
@@ -6827,7 +6858,7 @@ function pickFromPool(decided, params, parsedArgv) {
     poolPick: { name: decided.pool, reasons: resolution.reasons, ...resolution.movedOff === void 0 ? {} : { movedOff: resolution.movedOff } }
   };
 }
-function prepareLaunch(params) {
+function decideLaunch(params, readOnly) {
   const { paths, fs: fs12, proc, log } = params;
   const { env, argv } = proc;
   const parsedArgv = parseLauncherArgv(argv);
@@ -6851,10 +6882,10 @@ function prepareLaunch(params) {
       return trimmed === "" ? void 0 : trimmed;
     }
   });
-  const { identityDecision, poolExplanation, poolPick } = pickFromPool(decidedIdentity, params, parsedArgv);
+  const { identityDecision, poolExplanation, poolPick } = pickFromPool(decidedIdentity, params, parsedArgv, readOnly);
   const farmIdentity = configDirEscapeHatchApplies ? void 0 : identityDecision.name;
   const farm = farmIdentity === void 0 ? void 0 : params.farm;
-  if (farm !== void 0 && farmIdentity !== void 0) {
+  if (!readOnly && farm !== void 0 && farmIdentity !== void 0) {
     let recovery;
     try {
       recovery = recoverFarm({
@@ -6893,33 +6924,44 @@ function prepareLaunch(params) {
     identityDefaultConfigProfile: loadedIdentity?.config.defaultConfigProfile,
     globalDefaultConfigProfile: params.globalDefaultConfigProfile
   });
-  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs12.readConfigFile(import_node_path32.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
+  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs12.readConfigFile(import_node_path33.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
     log.error(
       `agent-shim: no configuration profile named "${configProfileDecision.name}" (selected via ${configProfileDecision.source}). Run \`agent-shim profile add ${configProfileDecision.name}\` first.`
     );
     proc.exit(1);
   }
   const farmContext = farm !== void 0 && farmIdentity !== void 0 ? { farm, identity: farmIdentity, cascade: farm.loadCascade(configProfileDecision.name, cliOverride) } : void 0;
-  const provider = parsedArgv.provider === false ? void 0 : resolveProvider({
+  const providerParams = {
     paths,
     port: fs12,
-    env,
-    ...params.credentials === void 0 ? {} : { credentials: params.credentials },
-    ...parsedArgv.provider === void 0 ? {} : { cliProvider: parsedArgv.provider },
+    ...parsedArgv.provider === void 0 || parsedArgv.provider === false ? {} : { cliProvider: parsedArgv.provider },
     ...farmContext === void 0 ? {} : { cascade: farmContext.cascade }
-  });
-  if (provider !== void 0 && !provider.ok) {
-    log.error(provider.message);
-    proc.exit(provider.status);
-  }
-  const resolvedProvider = provider?.ok === true ? provider.provider : void 0;
-  for (const warning of provider?.ok === true ? provider.warnings : []) {
-    log.warn(warning);
+  };
+  let selectedProvider;
+  let resolvedProvider;
+  if (parsedArgv.provider !== false && readOnly) {
+    const selection = selectProvider(providerParams);
+    if (selection !== void 0 && !selection.ok) {
+      log.error(selection.message);
+      proc.exit(selection.status);
+    }
+    selectedProvider = selection?.ok === true ? selection.provider : void 0;
+  } else if (parsedArgv.provider !== false) {
+    const provider = resolveProvider({ ...providerParams, env, ...params.credentials === void 0 ? {} : { credentials: params.credentials } });
+    if (provider !== void 0 && !provider.ok) {
+      log.error(provider.message);
+      proc.exit(provider.status);
+    }
+    resolvedProvider = provider?.ok === true ? provider.provider : void 0;
+    selectedProvider = resolvedProvider;
+    for (const warning of provider?.ok === true ? provider.warnings : []) {
+      log.warn(warning);
+    }
   }
   if (farm !== void 0 && farmIdentity !== void 0) {
     try {
       const snapshot = readUsageSnapshot(farm.fs, paths.usageSnapshotsDir, farmIdentity);
-      for (const warning of quotaWarnings(snapshot, resolvedProvider?.name ?? ANTHROPIC_PROVIDER, farm.now())) {
+      for (const warning of quotaWarnings(snapshot, selectedProvider?.name ?? ANTHROPIC_PROVIDER, farm.now())) {
         log.warn(warning);
       }
     } catch (error) {
@@ -6929,8 +6971,8 @@ function prepareLaunch(params) {
       log.warn(`agent-shim: ${error.message}`);
     }
   }
-  const identityCredentialBlock = loadedIdentity?.config.credential;
-  const identityResolution = resolvedProvider === void 0 && farmIdentity !== void 0 && identityCredentialBlock !== void 0 ? resolveIdentityCredential(farmIdentity, identityCredentialBlock, env, params.credentials) : void 0;
+  const identityCredentialBlock = selectedProvider === void 0 && farmIdentity !== void 0 ? loadedIdentity?.config.credential : void 0;
+  const identityResolution = !readOnly && identityCredentialBlock !== void 0 && farmIdentity !== void 0 ? resolveIdentityCredential(farmIdentity, identityCredentialBlock, env, params.credentials) : void 0;
   if (identityResolution !== void 0 && !identityResolution.ok) {
     log.error(identityResolution.message);
     proc.exit(identityResolution.status);
@@ -6944,25 +6986,97 @@ function prepareLaunch(params) {
     allowAmbientCredential: loadedIdentity?.config.allowAmbientCredential ?? false,
     allowAmbientCredentialOverride: parseEnvBool("AGENT_SHIM_ALLOW_AMBIENT_CREDENTIAL", env.AGENT_SHIM_ALLOW_AMBIENT_CREDENTIAL) === true,
     identityName: identityDecision.name,
-    providerSelected: resolvedProvider !== void 0,
+    providerSelected: selectedProvider !== void 0,
     ...identityCredential === void 0 ? {} : { injectedCredential: { variable: CREDENTIAL_TARGET_VARS[identityCredential.target], token: identityCredential.token } }
   });
   if (!guardResult.ok) {
-    log.error(guardResult.message);
-    proc.exit(1);
+    if (readOnly && identityCredentialBlock !== void 0) {
+      log.warn(`${guardResult.message} (not resolved here: the launch proceeds only if that value is the identity's own injected credential)`);
+    } else {
+      log.error(guardResult.message);
+      proc.exit(1);
+    }
   }
+  const launchCascade = farmContext?.cascade ?? (params.farm === void 0 ? void 0 : params.farm.loadCascade(configProfileDecision.name, cliOverride));
+  let cascadeLaunch;
+  if (launchCascade !== void 0 && params.farm !== void 0) {
+    const assembled = assembleCascade(launchCascade);
+    const flattened = flattenLayers(assembled.layers, { home: params.farm.home });
+    cascadeLaunch = flattened.launch;
+    if (readOnly) {
+      for (const diagnostic of [...assembled.diagnostics, ...flattened.diagnostics]) {
+        if (diagnostic.severity !== "info") {
+          log.warn(`agent-shim: ${diagnostic.code}: ${diagnostic.message}`);
+        }
+      }
+    }
+  }
+  const pinnedVersion = resolveClaudeVersion({ env, ...parsedArgv.claudeVersion === void 0 ? {} : { flag: parsedArgv.claudeVersion }, ...cascadeLaunch?.claudeVersion === void 0 ? {} : { cascade: cascadeLaunch.claudeVersion } });
+  const discovered = params.resolveClaudeBinary(pinnedVersion === void 0 ? void 0 : { version: pinnedVersion.version });
+  const flags = resolveLaunchFlags({
+    env,
+    // A pool pick reads the usage the front door records, so a pool launch records its own unless something says otherwise.
+    ...poolExplanation === void 0 ? {} : { trackUsageDefault: true },
+    ...cascadeLaunch === void 0 ? {} : { cascade: cascadeLaunch },
+    flags: {
+      ...parsedArgv.skipPermissions === void 0 ? {} : { skipPermissions: parsedArgv.skipPermissions },
+      ...parsedArgv.remoteControl === void 0 ? {} : { remoteControl: parsedArgv.remoteControl },
+      ...parsedArgv.headroom === void 0 ? {} : { headroom: parsedArgv.headroom },
+      ...parsedArgv.trackUsage === void 0 ? {} : { trackUsage: parsedArgv.trackUsage }
+    }
+  });
+  const args = buildArgv({
+    toolFlags: buildFlagArgs(flags),
+    extraFlags: splitExtraFlags(env.CLAUDE_EXTRA_FLAGS),
+    passthrough: parsedArgv.rest
+  });
+  const configDir = configDirEscapeHatchApplies || identityDecision.name === void 0 ? env.CLAUDE_CONFIG_DIR : import_node_path33.default.join(paths.identitiesDir, identityDecision.name);
+  const decision = {
+    identitySource: identityDecision.source,
+    configDirEscapeHatch: identityDecision.configDirEscapeHatch,
+    configProfileSource: configProfileDecision.source,
+    ...identityDecision.name === void 0 ? {} : { identity: identityDecision.name },
+    ...poolPick === void 0 ? {} : { pool: poolPick },
+    ...configDir === void 0 || configDir === "" ? {} : { configDir },
+    ...configProfileDecision.name === void 0 ? {} : { configProfile: configProfileDecision.name },
+    ...selectedProvider === void 0 ? {} : { provider: selectedProvider.name }
+  };
+  return {
+    parsedArgv,
+    identityDecision,
+    poolExplanation,
+    poolPick,
+    configDirEscapeHatch: configDirEscapeHatchApplies,
+    farmIdentity,
+    farmContext,
+    configProfileDecision,
+    provider: selectedProvider,
+    resolvedProvider,
+    identityCredentialBlock,
+    identityCredential,
+    pinnedVersion,
+    flags,
+    bin: discovered.path,
+    args,
+    decision
+  };
+}
+function prepareLaunch(params) {
+  const { paths, proc, log } = params;
+  const { env } = proc;
+  const decided = decideLaunch(params, false);
+  const { identityDecision, configProfileDecision, resolvedProvider, identityCredential, poolExplanation, flags: resolvedFlags, args: finalArgv, configDirEscapeHatch: configDirEscapeHatchApplies, decision } = decided;
   log.info(
     `agent-shim: identity ${identityDecision.name ?? "(none)"} (${identityDecision.source}${poolExplanation === void 0 ? "" : `, ${poolExplanation}`}), config profile ${configProfileDecision.name ?? "(none)"} (${configProfileDecision.source})` + (resolvedProvider === void 0 ? "" : `, provider ${resolvedProvider.name} (credential ${resolvedProvider.credential.target} from ${describeSource(resolvedProvider.credential.source)})`) + (identityCredential === void 0 ? "" : `, identity credential ${identityCredential.target} from ${describeSource(identityCredential.source)}`)
   );
   const updateCheck = runLaunchUpdateCheck({
     mode: params.updateMode ?? "off",
-    checkPath: import_node_path32.default.join(paths.root, "update.check"),
+    checkPath: import_node_path33.default.join(paths.root, "update.check"),
     currentVersion: package_default.version,
     port: params.update
   });
-  let cascadeLaunch;
-  if (farmContext !== void 0) {
-    const { farm: resyncFarmRuntime, identity: resyncIdentity, cascade } = farmContext;
+  if (decided.farmContext !== void 0) {
+    const { farm: resyncFarmRuntime, identity: resyncIdentity, cascade } = decided.farmContext;
     let result;
     try {
       result = resyncFarm({
@@ -6999,27 +7113,10 @@ function prepareLaunch(params) {
     log.info(
       result.noOp ? `agent-shim: farm at ${result.farmRoot} already matches the resolved cascade` : `agent-shim: farm at ${result.farmRoot} resynced (${String(result.manifest.links.length)} link(s), ${String(result.manifest.materialised.length)} built director(ies)${result.adopted.length === 0 ? "" : `, ${String(result.adopted.length)} adopted into ${resyncFarmRuntime.claudeHome}`})`
     );
-    cascadeLaunch = result.resolved.flattened.launch;
-  } else if (params.farm !== void 0) {
-    cascadeLaunch = flattenLayers(assembleCascade(params.farm.loadCascade(configProfileDecision.name, cliOverride)).layers, { home: params.farm.home }).launch;
   }
-  const pinnedVersion = resolveClaudeVersion({ env, ...parsedArgv.claudeVersion === void 0 ? {} : { flag: parsedArgv.claudeVersion }, ...cascadeLaunch?.claudeVersion === void 0 ? {} : { cascade: cascadeLaunch.claudeVersion } });
-  const discovered = params.resolveClaudeBinary(pinnedVersion === void 0 ? void 0 : { version: pinnedVersion.version });
-  if (pinnedVersion !== void 0) {
-    log.info(`agent-shim: Claude Code ${pinnedVersion.version} (pinned by ${pinnedVersion.source})`);
+  if (decided.pinnedVersion !== void 0) {
+    log.info(`agent-shim: Claude Code ${decided.pinnedVersion.version} (pinned by ${decided.pinnedVersion.source})`);
   }
-  const resolvedFlags = resolveLaunchFlags({
-    env,
-    // A pool pick reads the usage the front door records, so a pool launch records its own unless something says otherwise.
-    ...poolExplanation === void 0 ? {} : { trackUsageDefault: true },
-    ...cascadeLaunch === void 0 ? {} : { cascade: cascadeLaunch },
-    flags: {
-      ...parsedArgv.skipPermissions === void 0 ? {} : { skipPermissions: parsedArgv.skipPermissions },
-      ...parsedArgv.remoteControl === void 0 ? {} : { remoteControl: parsedArgv.remoteControl },
-      ...parsedArgv.headroom === void 0 ? {} : { headroom: parsedArgv.headroom },
-      ...parsedArgv.trackUsage === void 0 ? {} : { trackUsage: parsedArgv.trackUsage }
-    }
-  });
   const frontDoorPort = params.frontdoor;
   const frontDoorEngaged = resolvedProvider !== void 0 || resolvedFlags.headroom || resolvedFlags.trackUsage;
   if (frontDoorEngaged && frontDoorPort === void 0) {
@@ -7043,11 +7140,6 @@ function prepareLaunch(params) {
     log.info(`agent-shim: routing through the front door on 127.0.0.1:${String(frontDoor.port)}${resolvedProvider === void 0 ? ` (OAuth via the door's CONNECT surface on 127.0.0.1:${String(frontDoor.connectPort)}, usage recorded)` : ` (provider ${resolvedProvider.name})`}`);
   }
   const frontDoorRelease = frontDoor === void 0 ? void 0 : frontDoorPort?.release;
-  const finalArgv = buildArgv({
-    toolFlags: buildFlagArgs(resolvedFlags),
-    extraFlags: splitExtraFlags(env.CLAUDE_EXTRA_FLAGS),
-    passthrough: parsedArgv.rest
-  });
   const finalEnv = buildEnv({
     baseEnv: env,
     configDirEscapeHatch: configDirEscapeHatchApplies,
@@ -7065,18 +7157,35 @@ function prepareLaunch(params) {
       registered();
     }
   };
-  const configDir = finalEnv.CLAUDE_CONFIG_DIR;
-  const decision = {
-    identitySource: identityDecision.source,
-    configDirEscapeHatch: identityDecision.configDirEscapeHatch,
-    configProfileSource: configProfileDecision.source,
-    ...identityDecision.name === void 0 ? {} : { identity: identityDecision.name },
-    ...poolPick === void 0 ? {} : { pool: poolPick },
-    ...configDir === void 0 || configDir === "" ? {} : { configDir },
-    ...configProfileDecision.name === void 0 ? {} : { configProfile: configProfileDecision.name },
-    ...resolvedProvider === void 0 ? {} : { provider: resolvedProvider.name }
+  return { bin: decided.bin, args: finalArgv, env: finalEnv, release, markChildStarted: updateCheck.markChildStarted, decision };
+}
+function resolveLaunch(params) {
+  const decided = decideLaunch(params, true);
+  const { env } = params.proc;
+  const frontDoor = decided.provider !== void 0 || decided.flags.headroom || decided.flags.trackUsage;
+  const built = buildEnv({
+    baseEnv: env,
+    configDirEscapeHatch: decided.configDirEscapeHatch,
+    resolvedIdentityName: decided.identityDecision.name,
+    identitiesDir: params.paths.identitiesDir,
+    ...decided.provider === void 0 ? {} : { provider: decided.provider },
+    ...frontDoor ? { frontdoor: { port: 0, connectPort: 0, trustBundlePath: "", sessionToken: "" } } : {},
+    ...decided.flags.headroom ? { headroom: { socketPath: "", projectId: "" } } : {},
+    sessionId: ""
+  });
+  const credentialNames = decided.identityCredentialBlock === void 0 ? [] : Object.keys(credentialVariables(decided.identityCredentialBlock.target ?? "bearer", ""));
+  const environment = [.../* @__PURE__ */ new Set([...Object.keys(built).filter((name) => built[name] !== env[name]), ...credentialNames])].sort();
+  const credential = decided.provider !== void 0 ? { subject: "provider", name: decided.provider.name, summary: summariseCredential(decided.provider.definition.credential) } : decided.identityCredentialBlock !== void 0 && decided.farmIdentity !== void 0 ? { subject: "identity", name: decided.farmIdentity, summary: summariseCredential(decided.identityCredentialBlock) } : void 0;
+  return {
+    decision: decided.decision,
+    flags: decided.flags,
+    ...decided.pinnedVersion === void 0 ? {} : { claudeVersion: decided.pinnedVersion },
+    bin: decided.bin,
+    args: decided.args,
+    ...credential === void 0 ? {} : { credential },
+    routing: { frontDoor, headroom: decided.flags.headroom },
+    environment
   };
-  return { bin: discovered.path, args: finalArgv, env: finalEnv, release, markChildStarted: updateCheck.markChildStarted, decision };
 }
 function runLaunchPlan(plan, spawn2) {
   try {
@@ -7093,12 +7202,12 @@ function runLaunchPlan(plan, spawn2) {
 function runLauncher(params) {
   params.proc.exit(runLaunchPlan(prepareLaunch(params), params.spawn));
 }
-var import_node_crypto10, import_node_path32;
+var import_node_crypto10, import_node_path33;
 var init_launcher = __esm({
   "src/launcher.ts"() {
     "use strict";
     import_node_crypto10 = require("node:crypto");
-    import_node_path32 = __toESM(require("node:path"), 1);
+    import_node_path33 = __toESM(require("node:path"), 1);
     init_package();
     init_envBool();
     init_argv();
@@ -7129,13 +7238,13 @@ function agentShimCliPath(distDir = typeof __AGENT_SHIM_DIST_DIR__ === "string"
   if (distDir === void 0) {
     throw new OwnCliPathUnknownError();
   }
-  return import_node_path33.default.join(distDir, OWN_CLI_FILE_NAME);
+  return import_node_path34.default.join(distDir, OWN_CLI_FILE_NAME);
 }
-var import_node_path33, OWN_CLI_FILE_NAME, OwnCliPathUnknownError;
+var import_node_path34, OWN_CLI_FILE_NAME, OwnCliPathUnknownError;
 var init_ownCli = __esm({
   "src/ownCli.ts"() {
     "use strict";
-    import_node_path33 = __toESM(require("node:path"), 1);
+    import_node_path34 = __toESM(require("node:path"), 1);
     init_cliError();
     OWN_CLI_FILE_NAME = "cli.cjs";
     OwnCliPathUnknownError = class extends CliError {
@@ -7220,7 +7329,7 @@ request.on("error", (error) => finish(failed, (error.code ? error.code + ": " :
 // src/frontdoor/trust.ts
 function resolveTrustBundle(params) {
   const { caCertFile, bundlesDir, variable, inherited, fs: fs12 } = params;
-  if (inherited === void 0 || inherited === "" || import_node_path34.default.resolve(inherited) === import_node_path34.default.resolve(caCertFile)) {
+  if (inherited === void 0 || inherited === "" || import_node_path35.default.resolve(inherited) === import_node_path35.default.resolve(caCertFile)) {
     return { path: caCertFile };
   }
   const caPem = fs12.readFileUtf8(caCertFile);
@@ -7238,19 +7347,19 @@ function resolveTrustBundle(params) {
   }
   const combined = `${inheritedPem.trimEnd()}
 ${caPem}`;
-  const bundle = import_node_path34.default.join(bundlesDir, `${(0, import_node_crypto11.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
+  const bundle = import_node_path35.default.join(bundlesDir, `${(0, import_node_crypto11.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
   if (!fs12.exists(bundle)) {
     fs12.mkdirp(bundlesDir);
     fs12.writeFileAtomic(bundle, combined);
   }
   return { path: bundle };
 }
-var import_node_crypto11, import_node_path34, BUNDLE_NAME_HEX_DIGITS;
+var import_node_crypto11, import_node_path35, BUNDLE_NAME_HEX_DIGITS;
 var init_trust = __esm({
   "src/frontdoor/trust.ts"() {
     "use strict";
     import_node_crypto11 = require("node:crypto");
-    import_node_path34 = __toESM(require("node:path"), 1);
+    import_node_path35 = __toESM(require("node:path"), 1);
     BUNDLE_NAME_HEX_DIGITS = 16;
   }
 });
@@ -7395,6 +7504,31 @@ function prepareClaudeLaunch(options) {
   const spawnDaemon = daemonSpawnerFor(options.agentShim);
   return prepareLaunch(realPrepareLaunchParams(paths, { proc, log, spawnDaemon, farm: buildFarmRuntime(paths, options.cwd) }));
 }
+function resolveClaudeLaunch(options) {
+  const paths = options.paths ?? resolveLayoutPaths();
+  const refusals = [];
+  const warnings = [];
+  const log = {
+    info: () => void 0,
+    warn: (message) => {
+      warnings.push(message);
+    },
+    error: (message) => {
+      refusals.push(message);
+    }
+  };
+  const proc = {
+    env: options.env,
+    argv: options.argv,
+    exit: (code) => {
+      throw new LaunchRefusedError(refusals.join("\n") || `the launch was refused (exit ${String(code)})`, code);
+    }
+  };
+  const spawnDaemon = () => {
+    throw new Error("resolving a launch starts no daemon");
+  };
+  return { resolution: resolveLaunch(realPrepareLaunchParams(paths, { proc, log, spawnDaemon, farm: buildFarmRuntime(paths, options.cwd) })), warnings };
+}
 var import_node_os7, import_node_crypto12, LaunchRefusedError;
 var init_launchWiring = __esm({
   "src/launchWiring.ts"() {
@@ -7563,11 +7697,11 @@ var init_anthropicUsageRefresh = __esm({
 });
 
 // src/usage/providerQuota.ts
-var import_zod21, MS_PER_SECOND7, SECONDS_PER_HOUR, HOURS_PER_DAY3, DAYS_PER_MONTH, ZAI_HOST, ZAI_QUOTA_URL, ZAI_UNIT_HOURS, ZAI_UNIT_MONTHS, ZAI_UNIT_MS, ZaiLimitSchema, ZaiResponseSchema, OPENROUTER_HOST, OPENROUTER_KEY_URL, OPENROUTER_CREDITS_URL, MS_PER_DAY3, OpenRouterKeySchema, OpenRouterCreditsSchema;
+var import_zod22, MS_PER_SECOND7, SECONDS_PER_HOUR, HOURS_PER_DAY3, DAYS_PER_MONTH, ZAI_HOST, ZAI_QUOTA_URL, ZAI_UNIT_HOURS, ZAI_UNIT_MONTHS, ZAI_UNIT_MS, ZaiLimitSchema, ZaiResponseSchema, OPENROUTER_HOST, OPENROUTER_KEY_URL, OPENROUTER_CREDITS_URL, MS_PER_DAY3, OpenRouterKeySchema, OpenRouterCreditsSchema;
 var init_providerQuota = __esm({
   "src/usage/providerQuota.ts"() {
     "use strict";
-    import_zod21 = require("zod");
+    import_zod22 = require("zod");
     init_schema2();
     MS_PER_SECOND7 = 1e3;
     SECONDS_PER_HOUR = 3600;
@@ -7581,35 +7715,35 @@ var init_providerQuota = __esm({
       [ZAI_UNIT_HOURS, SECONDS_PER_HOUR * MS_PER_SECOND7],
       [ZAI_UNIT_MONTHS, DAYS_PER_MONTH * HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND7]
     ]);
-    ZaiLimitSchema = import_zod21.z.object({
-      type: import_zod21.z.string(),
-      unit: import_zod21.z.number().int(),
-      number: import_zod21.z.number().int().positive(),
-      percentage: import_zod21.z.number().nonnegative(),
-      nextResetTime: import_zod21.z.number().positive().optional(),
-      usage: import_zod21.z.number().nonnegative().optional(),
-      currentValue: import_zod21.z.number().nonnegative().optional(),
-      remaining: import_zod21.z.number().nonnegative().optional()
+    ZaiLimitSchema = import_zod22.z.object({
+      type: import_zod22.z.string(),
+      unit: import_zod22.z.number().int(),
+      number: import_zod22.z.number().int().positive(),
+      percentage: import_zod22.z.number().nonnegative(),
+      nextResetTime: import_zod22.z.number().positive().optional(),
+      usage: import_zod22.z.number().nonnegative().optional(),
+      currentValue: import_zod22.z.number().nonnegative().optional(),
+      remaining: import_zod22.z.number().nonnegative().optional()
     });
-    ZaiResponseSchema = import_zod21.z.object({
-      success: import_zod21.z.boolean(),
-      msg: import_zod21.z.string().optional(),
-      data: import_zod21.z.object({ level: import_zod21.z.string().optional(), limits: import_zod21.z.array(ZaiLimitSchema) })
+    ZaiResponseSchema = import_zod22.z.object({
+      success: import_zod22.z.boolean(),
+      msg: import_zod22.z.string().optional(),
+      data: import_zod22.z.object({ level: import_zod22.z.string().optional(), limits: import_zod22.z.array(ZaiLimitSchema) })
     });
     OPENROUTER_HOST = "openrouter.ai";
     OPENROUTER_KEY_URL = `https://${OPENROUTER_HOST}/api/v1/key`;
     OPENROUTER_CREDITS_URL = `https://${OPENROUTER_HOST}/api/v1/credits`;
     MS_PER_DAY3 = HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND7;
-    OpenRouterKeySchema = import_zod21.z.object({
-      data: import_zod21.z.object({
-        limit: import_zod21.z.number().nonnegative().nullable(),
-        limit_remaining: import_zod21.z.number().nullable(),
-        limit_reset: import_zod21.z.string().nullable(),
-        is_free_tier: import_zod21.z.boolean().optional(),
-        free_model_daily_requests: import_zod21.z.object({ used: import_zod21.z.number().nonnegative(), limit: import_zod21.z.number().nonnegative(), remaining: import_zod21.z.number() }).optional()
+    OpenRouterKeySchema = import_zod22.z.object({
+      data: import_zod22.z.object({
+        limit: import_zod22.z.number().nonnegative().nullable(),
+        limit_remaining: import_zod22.z.number().nullable(),
+        limit_reset: import_zod22.z.string().nullable(),
+        is_free_tier: import_zod22.z.boolean().optional(),
+        free_model_daily_requests: import_zod22.z.object({ used: import_zod22.z.number().nonnegative(), limit: import_zod22.z.number().nonnegative(), remaining: import_zod22.z.number() }).optional()
       })
     });
-    OpenRouterCreditsSchema = import_zod21.z.object({ data: import_zod21.z.object({ total_credits: import_zod21.z.number().nonnegative(), total_usage: import_zod21.z.number().nonnegative() }) });
+    OpenRouterCreditsSchema = import_zod22.z.object({ data: import_zod22.z.object({ total_credits: import_zod22.z.number().nonnegative(), total_usage: import_zod22.z.number().nonnegative() }) });
   }
 });
 
@@ -7741,6 +7875,9 @@ __export(index_exports, {
   CheckReportJsonSchema: () => CheckReportJsonSchema,
   CheckRunInputSchema: () => CheckRunInputSchema,
   CliError: () => CliError,
+  CodexLogoutOutputSchema: () => CodexLogoutOutputSchema,
+  CodexSignInSchema: () => CodexSignInSchema,
+  CodexStatusOutputSchema: () => CodexStatusOutputSchema,
   ConfigProfileSchema: () => ConfigProfileSchema,
   CredentialCacheSchema: () => CredentialCacheSchema,
   CredentialSchema: () => CredentialSchema,
@@ -7765,6 +7902,7 @@ __export(index_exports, {
   FARM_MANIFEST_FILENAME: () => FARM_MANIFEST_FILENAME,
   FrontDoorControlMaterialError: () => FrontDoorControlMaterialError,
   FrontDoorNotServingError: () => FrontDoorNotServingError,
+  FrontDoorRestartOutputSchema: () => FrontDoorRestartOutputSchema,
   FrontDoorSessionStatusSchema: () => FrontDoorSessionStatusSchema,
   FrontDoorSessionsOutputSchema: () => FrontDoorSessionsOutputSchema,
   FrontDoorStartError: () => FrontDoorStartError,
@@ -7782,6 +7920,8 @@ __export(index_exports, {
   LAUNCH_EVENT_SOURCE: () => LAUNCH_EVENT_SOURCE,
   LaunchLifecycleEventSchema: () => LaunchLifecycleEventSchema,
   LaunchRefusedError: () => LaunchRefusedError,
+  LaunchResolveInputSchema: () => LaunchResolveInputSchema,
+  LaunchResolveOutputSchema: () => LaunchResolveOutputSchema,
   LegacyProviderFileError: () => LegacyProviderFileError,
   OWN_CLI_FILE_NAME: () => OWN_CLI_FILE_NAME,
   PROMPT_CACHE_TTL_MS: () => PROMPT_CACHE_TTL_MS,
@@ -7828,6 +7968,7 @@ __export(index_exports, {
   RcStreamEnvelopeSchema: () => RcStreamEnvelopeSchema,
   RcStreamEventSchema: () => RcStreamEventSchema,
   USAGE_EVENT_SOURCE: () => USAGE_EVENT_SOURCE,
+  UpdateCheckOutputSchema: () => UpdateCheckOutputSchema,
   UsageError: () => UsageError,
   UsageListOutputSchema: () => UsageListOutputSchema,
   UsageLiveOutputSchema: () => UsageLiveOutputSchema,
@@ -7870,14 +8011,17 @@ __export(index_exports, {
   collectDoctorReport: () => collectDoctorReport,
   collectFrontDoorStatus: () => collectFrontDoorStatus,
   collectPoolPick: () => collectPoolPick,
+  createCodexApiRouter: () => createCodexApiRouter,
   createControlApiRouter: () => createControlApiRouter,
   createDoorApiNodeHandler: () => createDoorApiNodeHandler,
   createDoorApiRouter: () => createDoorApiRouter,
   createDoorEventHub: () => createDoorEventHub,
   createDoorHealthPublisher: () => createDoorHealthPublisher,
   createEventsApiRouter: () => createEventsApiRouter,
+  createLaunchApiRouter: () => createLaunchApiRouter,
   createLaunchEventPublisher: () => createLaunchEventPublisher,
   createLeafCache: () => createLeafCache,
+  createLifecycleApiRouter: () => createLifecycleApiRouter,
   createProfile: () => createProfile,
   createQuotaExpiringPublisher: () => createQuotaExpiringPublisher,
   createRcApiNodeHandler: () => createRcApiNodeHandler,
@@ -7985,7 +8129,9 @@ __export(index_exports, {
   requirePool: () => requirePool,
   resolveAgentShimHome: () => resolveAgentShimHome,
   resolveClaudeHome: () => resolveClaudeHome,
+  resolveClaudeLaunch: () => resolveClaudeLaunch,
   resolveDecisions: () => resolveDecisions,
+  resolveLaunch: () => resolveLaunch,
   resolveLaunchSelection: () => resolveLaunchSelection,
   resolveLayoutPaths: () => resolveLayoutPaths,
   resolveSupervisorConfig: () => resolveSupervisorConfig,
@@ -8522,8 +8668,8 @@ function parseConnectTarget(authority) {
 function isInterceptedHost(host, interceptHosts) {
   return interceptHosts.includes(host);
 }
-function servedByPipeline(path35) {
-  return path35?.startsWith(ROUTED_PATH_PREFIX) === true;
+function servedByPipeline(path36) {
+  return path36?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
   "connection",
@@ -9057,11 +9203,11 @@ function createRcSessionTracker(deps) {
   };
   const observeExchange = (request4) => {
     const method = (request4.method ?? "").toUpperCase();
-    const path35 = new URL(request4.url ?? "/", "http://127.0.0.1").pathname;
-    if (!path35.startsWith(RC_SESSIONS_PATH_PREFIX)) {
+    const path36 = new URL(request4.url ?? "/", "http://127.0.0.1").pathname;
+    if (!path36.startsWith(RC_SESSIONS_PATH_PREFIX)) {
       return void 0;
     }
-    const tail = path35.slice(RC_SESSIONS_PATH_PREFIX.length);
+    const tail = path36.slice(RC_SESSIONS_PATH_PREFIX.length);
     const facts = {
       oauthAuthorization: oauthAuthorizationOf(request4.headers),
       anthropicVersion: singleHeader(request4.headers, "anthropic-version"),
@@ -9443,8 +9589,8 @@ var RC_READ_FILE_ENCODINGS = ["utf-8", "base64"];
 function isRcReadFileEncoding(value) {
   return RC_READ_FILE_ENCODINGS.some((encoding) => encoding === value);
 }
-function buildRcReadFilePayload(requestId, path35, options) {
-  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path35, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
+function buildRcReadFilePayload(requestId, path36, options) {
+  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path36, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
 }
 function buildRcFileSuggestionsPayload(requestId, query) {
   return buildRcControlRequestPayload(requestId, { subtype: "file_suggestions", query });
@@ -9546,15 +9692,15 @@ async function getRcSessionContextUsage(deps, sessionId, detail) {
   const result = await deliverRcClientPayload(deps, sessionId, buildRcGetContextUsagePayload(requestId, detail), `request the context usage of session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
-async function readRcSessionFile(deps, sessionId, path35, options) {
-  if (path35 === "") {
+async function readRcSessionFile(deps, sessionId, path36, options) {
+  if (path36 === "") {
     return { ok: false, message: "a read-file write needs a non-empty path: the SDK's own field names the file the worker resolves against the session's cwd, and an empty string names none" };
   }
   if (options?.maxBytes !== void 0 && (!Number.isInteger(options.maxBytes) || options.maxBytes <= 0)) {
     return { ok: false, message: "a read-file write's max-bytes is a positive whole number of bytes: the SDK's own field caps the read, and a zero or negative cap reads nothing" };
   }
   const requestId = deps.newUuid();
-  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path35, options), `read ${path35} from session ${sessionId}`);
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path36, options), `read ${path36} from session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
 async function suggestRcSessionFiles(deps, sessionId, query) {
@@ -9723,11 +9869,11 @@ function createRcControlHandler(deps) {
       path: "read-file",
       read: (body) => {
         const session = bodyString(body, "session");
-        const path35 = bodyString(body, "path");
+        const path36 = bodyString(body, "path");
         const maxBytes = "maxBytes" in body ? bodyPositiveInteger(body, "maxBytes") : void 0;
         const encoding = "encoding" in body && isRcReadFileEncoding(body.encoding) ? body.encoding : void 0;
-        const refused2 = session === void 0 || path35 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
-        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path35, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
+        const refused2 = session === void 0 || path36 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
+        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path36, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
       }
     },
     {
@@ -10037,9 +10183,9 @@ function requestIdOfBody(body) {
 }
 function frontDoorRcControl(transport, token) {
   const headers = { authorization: `Bearer ${token}` };
-  const listAnswerOf = async (path35, what) => {
+  const listAnswerOf = async (path36, what) => {
     try {
-      return await transport.request({ method: "GET", path: path35, headers });
+      return await transport.request({ method: "GET", path: path36, headers });
     } catch (error) {
       throw new Error(`${what}: could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
     }
@@ -10111,10 +10257,10 @@ function frontDoorRcControl(transport, token) {
     }
     return pending;
   };
-  const writeOf = async (path35, body, describeFailure) => {
+  const writeOf = async (path36, body, describeFailure) => {
     let answer;
     try {
-      answer = await transport.request({ method: "POST", path: path35, headers: { ...headers, "content-type": "application/json" }, body });
+      answer = await transport.request({ method: "POST", path: path36, headers: { ...headers, "content-type": "application/json" }, body });
     } catch (error) {
       return { ok: false, message: `could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}` };
     }
@@ -10145,10 +10291,10 @@ function frontDoorRcControl(transport, token) {
     endSession: async (sessionId, reason) => await writeOf(`${CONTROL_PATH_PREFIX}/end-session`, JSON.stringify({ session: sessionId, ...reason === void 0 ? {} : { reason } }), (status, message) => `ending ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getUsage: async (sessionId, skipBehaviors) => await writeOf(`${CONTROL_PATH_PREFIX}/get-usage`, JSON.stringify({ session: sessionId, ...skipBehaviors === void 0 ? {} : { skipBehaviors } }), (status, message) => `requesting the usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getContextUsage: async (sessionId, detail) => await writeOf(`${CONTROL_PATH_PREFIX}/get-context-usage`, JSON.stringify({ session: sessionId, ...detail === void 0 ? {} : { detail } }), (status, message) => `requesting the context usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
-    readFile: async (sessionId, path35, options) => await writeOf(
+    readFile: async (sessionId, path36, options) => await writeOf(
       `${CONTROL_PATH_PREFIX}/read-file`,
-      JSON.stringify({ session: sessionId, path: path35, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
-      (status, message) => `reading ${path35} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
+      JSON.stringify({ session: sessionId, path: path36, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
+      (status, message) => `reading ${path36} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
     ),
     fileSuggestions: async (sessionId, query) => await writeOf(`${CONTROL_PATH_PREFIX}/file-suggestions`, JSON.stringify({ session: sessionId, query }), (status, message) => `requesting file suggestions from ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     keepAlive: async (sessionId) => await writeOf(`${CONTROL_PATH_PREFIX}/keep-alive`, JSON.stringify({ session: sessionId }), (status, message) => `keeping ${sessionId} alive failed (HTTP ${String(status)}): ${message}`),
@@ -10307,12 +10453,12 @@ function tlsFacts(options) {
 }
 function realRcEventDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const post = async (path35, headers, body) => await new Promise((resolve, reject) => {
+  const post = async (path36, headers, body) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method: "POST",
-      path: path35,
+      path: path36,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, "content-length": String(Buffer.byteLength(body, "utf8")) },
       agent
@@ -10377,12 +10523,12 @@ function lateRcStreamDial(resolve) {
 }
 function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const request4 = async (method, path35, headers, body, signal) => await new Promise((resolve, reject) => {
+  const request4 = async (method, path36, headers, body, signal) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method,
-      path: path35,
+      path: path36,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, ...body === void 0 ? {} : { "content-length": String(Buffer.byteLength(body, "utf8")) } },
       agent,
@@ -10424,9 +10570,9 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
       return { status, body: await readAll(response) };
     },
     openStream: async (sessionId, headers, resume, signal) => {
-      const path35 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
+      const path36 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
       const streamHeaders = resume === void 0 ? headers : { ...headers, "last-event-id": String(resume.fromSequenceNum) };
-      const { status, response } = await request4("GET", path35, streamHeaders, void 0, signal);
+      const { status, response } = await request4("GET", path36, streamHeaders, void 0, signal);
       if (!isSuccessful2(status)) {
         await readAll(response);
         return { status, chunks: NO_CHUNKS };
@@ -10926,41 +11072,41 @@ function createRcApiRouter(deps) {
   };
   return {
     rc: {
-      list: authed.route({ method: "GET", path: "/rest/rc/sessions", summary: "List the observed Remote Control sessions", tags: [RC_API_TAG] }).output(RcListOutputSchema).handler(() => ({ sessions: deps.list() })),
-      status: authed.route({ method: "GET", path: "/rest/rc/status", summary: "Read session status, one session's when named", tags: [RC_API_TAG] }).input(RcSessionQuerySchema).output(RcStatusOutputSchema).handler(({ input }) => {
+      list: authed.meta((0, import_openapi.openapi)({ method: "GET", path: "/rest/rc/sessions", summary: "List the observed Remote Control sessions", tags: [RC_API_TAG] })).output(RcListOutputSchema).handler(() => ({ sessions: deps.list() })),
+      status: authed.meta((0, import_openapi.openapi)({ method: "GET", path: "/rest/rc/status", summary: "Read session status, one session's when named", tags: [RC_API_TAG] })).input(RcSessionQuerySchema).output(RcStatusOutputSchema).handler(({ input }) => {
         const statuses = deps.statusOf(input.session);
         if (input.session !== void 0 && !statuses.some((entry) => entry.id === input.session)) {
           throw new import_client.ORPCError("NOT_FOUND", { message: rcSessionNotObservedMessage(input.session) });
         }
         return { statuses };
       }),
-      pending: authed.route({ method: "GET", path: "/rest/rc/pending", summary: "Read the control requests awaiting an answer", tags: [RC_API_TAG] }).input(RcSessionQuerySchema).output(RcPendingOutputSchema).handler(({ input }) => {
+      pending: authed.meta((0, import_openapi.openapi)({ method: "GET", path: "/rest/rc/pending", summary: "Read the control requests awaiting an answer", tags: [RC_API_TAG] })).input(RcSessionQuerySchema).output(RcPendingOutputSchema).handler(({ input }) => {
         const pending = deps.pendingOf(input.session);
         if (input.session !== void 0 && deps.statusOf(input.session).length === 0) {
           throw new import_client.ORPCError("NOT_FOUND", { message: rcSessionNotObservedMessage(input.session) });
         }
         return { pending };
       }),
-      send: authed.route({ method: "POST", path: "/rest/rc/send", summary: "Send one message into a session", tags: [RC_API_TAG] }).input(RcSendInputSchema).output(RcWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, sequenceNums: delivered(input.session, await deps.inject(input.session, input.text)) })),
-      answer: authed.route({ method: "POST", path: "/rest/rc/answer", summary: "Answer one pending control request", tags: [RC_API_TAG] }).input(RcAnswerInputSchema).output(RcAnswerOutputSchema).handler(async ({ input }) => {
+      send: authed.meta((0, import_openapi.openapi)({ method: "POST", path: "/rest/rc/send", summary: "Send one message into a session", tags: [RC_API_TAG] })).input(RcSendInputSchema).output(RcWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, sequenceNums: delivered(input.session, await deps.inject(input.session, input.text)) })),
+      answer: authed.meta((0, import_openapi.openapi)({ method: "POST", path: "/rest/rc/answer", summary: "Answer one pending control request", tags: [RC_API_TAG] })).input(RcAnswerInputSchema).output(RcAnswerOutputSchema).handler(async ({ input }) => {
         const decision = { approve: input.approve, message: input.approve || input.text === void 0 ? void 0 : input.text };
         return { session: input.session, request: input.request, sequenceNums: delivered(input.session, await deps.answer(input.session, input.request, decision)) };
       }),
-      interrupt: authed.route({ method: "POST", path: "/rest/rc/interrupt", summary: "Interrupt a session's running turn", tags: [RC_API_TAG] }).input(RcInterruptInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.interrupt(input.session)) })),
-      setModel: authed.route({ method: "POST", path: "/rest/rc/set-model", summary: "Switch a session's model", tags: [RC_API_TAG] }).input(RcSetModelInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.setModel(input.session, input.model)) })),
-      setPermissionMode: authed.route({ method: "POST", path: "/rest/rc/set-permission-mode", summary: "Switch a session's permission mode", tags: [RC_API_TAG] }).input(RcSetPermissionModeInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.setPermissionMode(input.session, input.mode)) })),
-      endSession: authed.route({ method: "POST", path: "/rest/rc/end-session", summary: "End a session", tags: [RC_API_TAG] }).input(RcEndSessionInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.endSession(input.session, input.reason)) })),
-      getUsage: authed.route({ method: "POST", path: "/rest/rc/get-usage", summary: "Ask a session for its usage snapshot", tags: [RC_API_TAG] }).input(RcGetUsageInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.getUsage(input.session, input.skipBehaviors)) })),
-      getContextUsage: authed.route({ method: "POST", path: "/rest/rc/get-context-usage", summary: "Ask a session for its context usage", tags: [RC_API_TAG] }).input(RcGetContextUsageInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.getContextUsage(input.session, input.detail)) })),
-      readFile: authed.route({ method: "POST", path: "/rest/rc/read-file", summary: "Ask a session to read one file", tags: [RC_API_TAG] }).input(RcReadFileInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.readFile(input.session, input.path, { ...input.maxBytes === void 0 ? {} : { maxBytes: input.maxBytes }, ...input.encoding === void 0 ? {} : { encoding: input.encoding } })) })),
-      fileSuggestions: authed.route({ method: "POST", path: "/rest/rc/file-suggestions", summary: "Ask a session for file-path suggestions", tags: [RC_API_TAG] }).input(RcFileSuggestionsInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.fileSuggestions(input.session, input.query)) })),
-      keepAlive: authed.route({ method: "POST", path: "/rest/rc/keep-alive", summary: "Keep a session's bridge alive", tags: [RC_API_TAG] }).input(RcKeepAliveInputSchema).output(RcWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, sequenceNums: delivered(input.session, await deps.keepAlive(input.session)) })),
-      mcpStatus: authed.route({ method: "POST", path: "/rest/rc/mcp-status", summary: "Ask a session for its MCP servers' status", tags: [RC_API_TAG] }).input(RcMcpStatusInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpStatus(input.session)) })),
-      mcpReconnect: authed.route({ method: "POST", path: "/rest/rc/mcp-reconnect", summary: "Ask a session to reconnect one MCP server", tags: [RC_API_TAG] }).input(RcMcpReconnectInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpReconnect(input.session, input.serverName)) })),
-      mcpAuthenticate: authed.route({ method: "POST", path: "/rest/rc/mcp-authenticate", summary: "Start OAuth for one MCP server on a session", tags: [RC_API_TAG] }).input(RcMcpAuthenticateInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpAuthenticate(input.session, input.serverName, input.redirectUri)) })),
-      mcpOAuthCallbackUrl: authed.route({ method: "POST", path: "/rest/rc/mcp-oauth-callback-url", summary: "Hand a completed MCP OAuth callback to a session", tags: [RC_API_TAG] }).input(RcMcpOAuthCallbackUrlInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpOAuthCallbackUrl(input.session, input.serverName, input.callbackUrl)) })),
-      teleport: authed.route({ method: "POST", path: "/rest/rc/teleport", summary: "Teleport a session to a conversation marker", tags: [RC_API_TAG] }).input(RcTeleportInputSchema).output(RcWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, sequenceNums: delivered(input.session, await deps.teleport(input.session, input.marker)) })),
-      subscribe: authed.route({ method: "GET", path: "/rest/rc/events", summary: "Stream a session's Remote Control events (SSE)", tags: [RC_API_TAG] }).input(RcSessionQuerySchema).output((0, import_server2.eventIterator)(RcStreamEventSchema)).handler(async function* ({ input, signal }) {
+      interrupt: authed.meta((0, import_openapi.openapi)({ method: "POST", path: "/rest/rc/interrupt", summary: "Interrupt a session's running turn", tags: [RC_API_TAG] })).input(RcInterruptInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.interrupt(input.session)) })),
+      setModel: authed.meta((0, import_openapi.openapi)({ method: "POST", path: "/rest/rc/set-model", summary: "Switch a session's model", tags: [RC_API_TAG] })).input(RcSetModelInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.setModel(input.session, input.model)) })),
+      setPermissionMode: authed.meta((0, import_openapi.openapi)({ method: "POST", path: "/rest/rc/set-permission-mode", summary: "Switch a session's permission mode", tags: [RC_API_TAG] })).input(RcSetPermissionModeInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.setPermissionMode(input.session, input.mode)) })),
+      endSession: authed.meta((0, import_openapi.openapi)({ method: "POST", path: "/rest/rc/end-session", summary: "End a session", tags: [RC_API_TAG] })).input(RcEndSessionInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.endSession(input.session, input.reason)) })),
+      getUsage: authed.meta((0, import_openapi.openapi)({ method: "POST", path: "/rest/rc/get-usage", summary: "Ask a session for its usage snapshot", tags: [RC_API_TAG] })).input(RcGetUsageInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.getUsage(input.session, input.skipBehaviors)) })),
+      getContextUsage: authed.meta((0, import_openapi.openapi)({ method: "POST", path: "/rest/rc/get-context-usage", summary: "Ask a session for its context usage", tags: [RC_API_TAG] })).input(RcGetContextUsageInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.getContextUsage(input.session, input.detail)) })),
+      readFile: authed.meta((0, import_openapi.openapi)({ method: "POST", path: "/rest/rc/read-file", summary: "Ask a session to read one file", tags: [RC_API_TAG] })).input(RcReadFileInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.readFile(input.session, input.path, { ...input.maxBytes === void 0 ? {} : { maxBytes: input.maxBytes }, ...input.encoding === void 0 ? {} : { encoding: input.encoding } })) })),
+      fileSuggestions: authed.meta((0, import_openapi.openapi)({ method: "POST", path: "/rest/rc/file-suggestions", summary: "Ask a session for file-path suggestions", tags: [RC_API_TAG] })).input(RcFileSuggestionsInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.fileSuggestions(input.session, input.query)) })),
+      keepAlive: authed.meta((0, import_openapi.openapi)({ method: "POST", path: "/rest/rc/keep-alive", summary: "Keep a session's bridge alive", tags: [RC_API_TAG] })).input(RcKeepAliveInputSchema).output(RcWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, sequenceNums: delivered(input.session, await deps.keepAlive(input.session)) })),
+      mcpStatus: authed.meta((0, import_openapi.openapi)({ method: "POST", path: "/rest/rc/mcp-status", summary: "Ask a session for its MCP servers' status", tags: [RC_API_TAG] })).input(RcMcpStatusInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpStatus(input.session)) })),
+      mcpReconnect: authed.meta((0, import_openapi.openapi)({ method: "POST", path: "/rest/rc/mcp-reconnect", summary: "Ask a session to reconnect one MCP server", tags: [RC_API_TAG] })).input(RcMcpReconnectInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpReconnect(input.session, input.serverName)) })),
+      mcpAuthenticate: authed.meta((0, import_openapi.openapi)({ method: "POST", path: "/rest/rc/mcp-authenticate", summary: "Start OAuth for one MCP server on a session", tags: [RC_API_TAG] })).input(RcMcpAuthenticateInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpAuthenticate(input.session, input.serverName, input.redirectUri)) })),
+      mcpOAuthCallbackUrl: authed.meta((0, import_openapi.openapi)({ method: "POST", path: "/rest/rc/mcp-oauth-callback-url", summary: "Hand a completed MCP OAuth callback to a session", tags: [RC_API_TAG] })).input(RcMcpOAuthCallbackUrlInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpOAuthCallbackUrl(input.session, input.serverName, input.callbackUrl)) })),
+      teleport: authed.meta((0, import_openapi.openapi)({ method: "POST", path: "/rest/rc/teleport", summary: "Teleport a session to a conversation marker", tags: [RC_API_TAG] })).input(RcTeleportInputSchema).output(RcWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, sequenceNums: delivered(input.session, await deps.teleport(input.session, input.marker)) })),
+      subscribe: authed.meta((0, import_openapi.openapi)({ method: "GET", path: "/rest/rc/events", summary: "Stream a session's Remote Control events (SSE)", tags: [RC_API_TAG] })).input(RcSessionQuerySchema).output((0, import_server2.eventIterator)(RcStreamEventSchema)).handler(async function* ({ input, signal }) {
         const queue = [];
         let wake;
         const detach = deps.fanout.subscribe(input.session, (event) => {
@@ -11002,7 +11148,7 @@ function doorApiNodeHandlerOf(router, expectedToken) {
   const rpcHandler = new import_node2.RPCHandler(router, { plugins });
   const restHandler = new import_node.OpenAPIHandler(router, { plugins });
   let document;
-  const documentOf = async () => document ??= new import_openapi.OpenAPIGenerator().generate(router, { info: { title: "agent-shim front door API", version: package_default.version } });
+  const documentOf = async () => document ??= new import_openapi.OpenAPIGenerator().generate(router, { base: { info: { title: "agent-shim front door API", version: package_default.version } } });
   return {
     pathPrefix: RC_ORPC_PATH_PREFIX,
     handle: async (request4, response) => {
@@ -11025,11 +11171,15 @@ function doorApiNodeHandlerOf(router, expectedToken) {
         }
         return { matched: true };
       }
-      const rest = await restHandler.handle(request4, response, { context: { headers: request4.headers }, prefix: RC_ORPC_PATH_PREFIX });
+      const rest = await restHandler.handle(request4, response, { context: { headers: request4.headers, afterResponse: (action) => {
+        response.once("finish", action);
+      } }, prefix: RC_ORPC_PATH_PREFIX });
       if (rest.matched) {
         return rest;
       }
-      return await rpcHandler.handle(request4, response, { context: { headers: request4.headers }, prefix: RC_ORPC_PATH_PREFIX });
+      return await rpcHandler.handle(request4, response, { context: { headers: request4.headers, afterResponse: (action) => {
+        response.once("finish", action);
+      } }, prefix: RC_ORPC_PATH_PREFIX });
     }
   };
 }
@@ -11039,10 +11189,12 @@ function createRcApiNodeHandler(deps) {
 function frontDoorApiLink(port, ca, token) {
   const dispatcher = new import_undici.Agent({ connect: { ca } });
   return new import_fetch.RPCLink({
-    url: `https://127.0.0.1:${String(port)}${RC_ORPC_PATH_PREFIX}`,
+    origin: `https://127.0.0.1:${String(port)}`,
+    url: RC_ORPC_PATH_PREFIX,
     headers: { authorization: `Bearer ${token}` },
     // undici's own Request and Response types and the global ones are distinct declarations of the same standard shapes (the package's bundled types sit beside @types/node's own), and its fetch refuses the global Request instance outright, so the call is rebuilt from the request's parts and the answer re-wrapped through the global constructors, never cast between the two. The request body is one bounded JSON object (the same protocol cap the handler enforces), so reading it whole costs nothing; it is the answer that streams.
-    fetch: async (request4, _init, options) => {
+    fetch: async (url, init, options) => {
+      const request4 = new Request(url, init);
       const body = request4.body === null ? void 0 : Buffer.from(await request4.arrayBuffer());
       const answered = await (0, import_undici.fetch)(request4.url, {
         method: request4.method,
@@ -11064,7 +11216,8 @@ init_cliError();
 init_realPorts();
 
 // src/frontdoor/controlApi.ts
-var import_client3 = require("@orpc/client");
+var import_client5 = require("@orpc/client");
+var import_openapi6 = require("@orpc/openapi");
 
 // src/checkReport.ts
 var import_node_os5 = __toESM(require("node:os"), 1);
@@ -11291,19 +11444,19 @@ function writePools(paths, pools) {
   applyPatch(paths.globalConfigFile, GlobalConfigSchema, { pools }, { defaults: {} });
 }
 function poolCycleOf(pools, name) {
-  const walk = (current, path35) => {
+  const walk = (current, path36) => {
     for (const entry of pools[current]?.identities ?? []) {
       const nested = poolNameOf(poolMemberIdentity(entry));
       if (nested === void 0) {
         continue;
       }
       if (nested === name) {
-        return [...path35, nested];
+        return [...path36, nested];
       }
-      if (path35.includes(nested)) {
+      if (path36.includes(nested)) {
         continue;
       }
-      const found = walk(nested, [...path35, nested]);
+      const found = walk(nested, [...path36, nested]);
       if (found !== void 0) {
         return found;
       }
@@ -12874,9 +13027,48 @@ var DoctorRunOutputSchema = import_zod19.z.strictObject({
   ok: import_zod19.z.boolean(),
   findings: import_zod19.z.readonly(import_zod19.z.array(DoctorFindingSchema))
 });
+var FrontDoorRestartOutputSchema = import_zod19.z.strictObject({
+  action: import_zod19.z.literal("restarting"),
+  previousPid: import_zod19.z.int().positive()
+});
+var UpdateCheckOutputSchema = import_zod19.z.strictObject({
+  current: import_zod19.z.string(),
+  latest: import_zod19.z.string(),
+  action: import_zod19.z.enum(["current", "available", "updated"])
+});
+var CodexSignInSchema = import_zod19.z.discriminatedUnion("state", [
+  import_zod19.z.strictObject({ state: import_zod19.z.literal("none") }),
+  import_zod19.z.strictObject({ state: import_zod19.z.literal("signed-in"), email: import_zod19.z.string().optional(), planScope: import_zod19.z.boolean(), accessTokenExpiresAt: import_zod19.z.number() }),
+  import_zod19.z.strictObject({ state: import_zod19.z.literal("unreadable"), message: import_zod19.z.string() })
+]);
+var CodexStatusOutputSchema = import_zod19.z.strictObject({
+  signIn: CodexSignInSchema,
+  codexProviders: import_zod19.z.readonly(import_zod19.z.array(import_zod19.z.string()))
+});
+var CodexLogoutOutputSchema = import_zod19.z.strictObject({
+  hadGrant: import_zod19.z.boolean(),
+  revoked: import_zod19.z.boolean()
+});
+
+// src/frontdoor/codexApi.ts
+var import_openapi2 = require("@orpc/openapi");
+var CODEX_API_TAG = "codex";
+function createCodexApiRouter(deps) {
+  const authed = doorApiAuth(deps.expectedToken);
+  return {
+    codex: {
+      status: authed.meta((0, import_openapi2.openapi)({ method: "GET", path: "/rest/codex/status", summary: "Read the Codex sign-in and the codex providers", tags: [CODEX_API_TAG] })).output(CodexStatusOutputSchema).handler(() => {
+        const status = deps.codexStatus();
+        return { signIn: status.signIn, codexProviders: status.codexProviders };
+      }),
+      logout: authed.meta((0, import_openapi2.openapi)({ method: "POST", path: "/rest/codex/logout", summary: "Revoke the Sign in with ChatGPT login and remove it", tags: [CODEX_API_TAG] })).output(CodexLogoutOutputSchema).handler(async () => await deps.codexLogout())
+    }
+  };
+}
 
 // src/frontdoor/eventsApi.ts
 var import_client2 = require("@orpc/client");
+var import_openapi3 = require("@orpc/openapi");
 var import_server3 = require("@orpc/server");
 
 // src/frontdoor/eventSchemas.ts
@@ -12923,7 +13115,7 @@ function createEventsApiRouter(deps) {
   const authed = doorApiAuth(deps.expectedToken);
   return {
     events: {
-      subscribe: authed.route({ method: "GET", path: "/rest/events", summary: "Stream the door's every event source (SSE)", tags: [EVENTS_API_TAG] }).input(DoorEventSourceQuerySchema).output((0, import_server3.eventIterator)(DoorEventSchema)).handler(async function* ({ input, signal }) {
+      subscribe: authed.meta((0, import_openapi3.openapi)({ method: "GET", path: "/rest/events", summary: "Stream the door's every event source (SSE)", tags: [EVENTS_API_TAG] })).input(DoorEventSourceQuerySchema).output((0, import_server3.eventIterator)(DoorEventSchema)).handler(async function* ({ input, signal }) {
         if (input.sources !== void 0) {
           const live = deps.events.sources();
           const unknown = input.sources.filter((source) => !live.includes(source));
@@ -12955,9 +13147,120 @@ function createEventsApiRouter(deps) {
   };
 }
 
+// src/frontdoor/lifecycleApi.ts
+var import_client3 = require("@orpc/client");
+var import_openapi4 = require("@orpc/openapi");
+init_update();
+var FRONTDOOR_API_TAG = "frontdoor";
+var UPDATE_API_TAG = "update";
+function createLifecycleApiRouter(deps) {
+  const authed = doorApiAuth(deps.expectedToken);
+  return {
+    frontdoor: {
+      restart: authed.meta((0, import_openapi4.openapi)({ method: "POST", path: "/rest/frontdoor/restart", summary: "Replace the serving front door in place", description: "Answers with the pid of the door being replaced, then replaces it. The replacement is a new generation with its own control token: the caller reopens its client from the state root once the door's supervisor pid differs from the one returned.", tags: [FRONTDOOR_API_TAG] })).output(FrontDoorRestartOutputSchema).handler(({ context }) => {
+        context.afterResponse(deps.restartDoor);
+        return { action: "restarting", previousPid: deps.doorPid };
+      })
+    },
+    update: {
+      check: authed.meta((0, import_openapi4.openapi)({ method: "GET", path: "/rest/update/check", summary: "Check whether a newer release exists", tags: [UPDATE_API_TAG] })).output(UpdateCheckOutputSchema).handler(async () => {
+        try {
+          return await deps.checkForUpdate();
+        } catch (error) {
+          if (error instanceof UpdateChannelError) {
+            throw new import_client3.ORPCError("PRECONDITION_FAILED", { message: error.message });
+          }
+          if (error instanceof UpdateConflictError) {
+            throw new import_client3.ORPCError("CONFLICT", { message: error.message });
+          }
+          if (error instanceof UpdateDownloadError) {
+            throw new import_client3.ORPCError("BAD_GATEWAY", { message: error.message });
+          }
+          throw error;
+        }
+      })
+    }
+  };
+}
+
+// src/frontdoor/launchApi.ts
+var import_client4 = require("@orpc/client");
+var import_openapi5 = require("@orpc/openapi");
+init_cliError();
+
+// src/frontdoor/launchSchemas.ts
+var import_node_path30 = __toESM(require("node:path"), 1);
+var import_zod21 = require("zod");
+init_claudeVersion();
+init_identity();
+var LaunchResolveInputSchema = import_zod21.z.strictObject({
+  path: import_zod21.z.string().min(1),
+  /** `@name`, launch flags, then the arguments for `claude`; empty for a bare launch. */
+  argv: import_zod21.z.readonly(import_zod21.z.array(import_zod21.z.string())).optional(),
+  /** The launch's inherited environment. Absent means an empty one: the door's own environment is never a substitute for the caller's, so a caller that wants `AGENT_SHIM_*` switches or a `CLAUDE_CONFIG_DIR` considered names them here. Values are read, never reported. */
+  env: import_zod21.z.record(import_zod21.z.string(), import_zod21.z.string()).optional()
+}).refine((input) => import_node_path30.default.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+var LaunchPoolDecisionSchema = import_zod21.z.strictObject({
+  name: import_zod21.z.string(),
+  reasons: import_zod21.z.readonly(import_zod21.z.array(import_zod21.z.string())),
+  movedOff: import_zod21.z.strictObject({ identity: import_zod21.z.string(), reason: import_zod21.z.string() }).optional()
+});
+var LaunchDecisionSchema = import_zod21.z.strictObject({
+  identity: import_zod21.z.string().optional(),
+  identitySource: import_zod21.z.enum(IDENTITY_DECISION_SOURCES),
+  pool: LaunchPoolDecisionSchema.optional(),
+  configDirEscapeHatch: import_zod21.z.boolean(),
+  configDir: import_zod21.z.string().optional(),
+  configProfile: import_zod21.z.string().optional(),
+  configProfileSource: import_zod21.z.enum(CONFIG_PROFILE_DECISION_SOURCES),
+  provider: import_zod21.z.string().optional()
+});
+var LaunchFlagsSchema = import_zod21.z.strictObject({
+  skipPermissions: import_zod21.z.boolean(),
+  remoteControl: import_zod21.z.boolean(),
+  headroom: import_zod21.z.boolean(),
+  trackUsage: import_zod21.z.boolean()
+});
+var LaunchResolveOutputSchema = import_zod21.z.strictObject({
+  decision: LaunchDecisionSchema,
+  flags: LaunchFlagsSchema,
+  claudeVersion: import_zod21.z.strictObject({ version: import_zod21.z.string(), source: import_zod21.z.enum(CLAUDE_VERSION_SOURCES) }).optional(),
+  /** The real `claude` binary the launch would spawn, on the door's host. */
+  bin: import_zod21.z.string(),
+  /** The arguments the launch would pass it: the tool's own flags, then `CLAUDE_EXTRA_FLAGS`, then the caller's own. */
+  args: import_zod21.z.readonly(import_zod21.z.array(import_zod21.z.string())),
+  /** The credential the launch would authenticate with, by target and source kinds. Absent when none applies. */
+  credential: import_zod21.z.strictObject({ subject: import_zod21.z.enum(["provider", "identity"]), name: import_zod21.z.string(), summary: CredentialSummarySchema }).optional(),
+  routing: import_zod21.z.strictObject({ frontDoor: import_zod21.z.boolean(), headroom: import_zod21.z.boolean() }),
+  /** The names of the environment variables the launch would set or unset, sorted. Values are not reported. */
+  environment: import_zod21.z.readonly(import_zod21.z.array(import_zod21.z.string())),
+  warnings: import_zod21.z.readonly(import_zod21.z.array(import_zod21.z.string()))
+});
+
+// src/frontdoor/launchApi.ts
+var LAUNCH_API_TAG = "launch";
+function createLaunchApiRouter(deps) {
+  const authed = doorApiAuth(deps.expectedToken);
+  return {
+    launch: {
+      resolve: authed.meta((0, import_openapi5.openapi)({ method: "POST", path: "/rest/launch/resolve", summary: "Resolve what a launch from one directory would do, without performing it", tags: [LAUNCH_API_TAG] })).input(LaunchResolveInputSchema).output(LaunchResolveOutputSchema).handler(({ input }) => {
+        try {
+          const { resolution, warnings } = deps.resolveLaunch({ path: input.path, argv: input.argv ?? [], env: input.env ?? {} });
+          return { ...resolution, warnings };
+        } catch (error) {
+          if (error instanceof CliError) {
+            throw new import_client4.ORPCError("BAD_REQUEST", { message: error.message });
+          }
+          throw error;
+        }
+      })
+    }
+  };
+}
+
 // src/frontdoor/controlApi.ts
 var USAGE_API_TAG = "usage";
-var FRONTDOOR_API_TAG = "frontdoor";
+var FRONTDOOR_API_TAG2 = "frontdoor";
 var CHECK_API_TAG = "check";
 var DOCTOR_API_TAG = "doctor";
 var POOL_API_TAG = "pool";
@@ -12965,11 +13268,11 @@ function createControlApiRouter(deps) {
   const authed = doorApiAuth(deps.expectedToken);
   return {
     usage: {
-      list: authed.route({ method: "GET", path: "/rest/usage/snapshots", summary: "List every identity's usage snapshot", tags: [USAGE_API_TAG] }).output(UsageListOutputSchema).handler(() => ({ snapshots: deps.usageSnapshots() })),
-      effectiveWindow: authed.route({ method: "GET", path: "/rest/usage/windows", summary: "Read one identity's effective quota windows", tags: [USAGE_API_TAG] }).input(UsageWindowsInputSchema).output(UsageWindowsOutputSchema).handler(({ input }) => {
+      list: authed.meta((0, import_openapi6.openapi)({ method: "GET", path: "/rest/usage/snapshots", summary: "List every identity's usage snapshot", tags: [USAGE_API_TAG] })).output(UsageListOutputSchema).handler(() => ({ snapshots: deps.usageSnapshots() })),
+      effectiveWindow: authed.meta((0, import_openapi6.openapi)({ method: "GET", path: "/rest/usage/windows", summary: "Read one identity's effective quota windows", tags: [USAGE_API_TAG] })).input(UsageWindowsInputSchema).output(UsageWindowsOutputSchema).handler(({ input }) => {
         const snapshot = deps.usageSnapshotOf(input.identity);
         if (snapshot === void 0) {
-          throw new import_client3.ORPCError("NOT_FOUND", { message: `identity ${input.identity} has no usage snapshot yet, so no quota window has been observed for it` });
+          throw new import_client5.ORPCError("NOT_FOUND", { message: `identity ${input.identity} has no usage snapshot yet, so no quota window has been observed for it` });
         }
         const provider = input.provider ?? ANTHROPIC_PROVIDER;
         const rateLimit = snapshot.providers[provider]?.rateLimit;
@@ -12983,34 +13286,34 @@ function createControlApiRouter(deps) {
           ...unified?.sevenDay === void 0 ? {} : { sevenDay: effectiveWindow(unified.sevenDay, now) }
         };
       }),
-      live: authed.route({ method: "GET", path: "/rest/usage/live", summary: "Read the live rate-limit observations the event backbone files", tags: [USAGE_API_TAG] }).input(RcSessionQuerySchema).output(UsageLiveOutputSchema).handler(({ input }) => {
+      live: authed.meta((0, import_openapi6.openapi)({ method: "GET", path: "/rest/usage/live", summary: "Read the live rate-limit observations the event backbone files", tags: [USAGE_API_TAG] })).input(RcSessionQuerySchema).output(UsageLiveOutputSchema).handler(({ input }) => {
         const sessions = deps.liveRateLimits(input.session);
         if (input.session !== void 0 && sessions.length === 0) {
           if (deps.list().some((session) => session.id === input.session)) {
-            throw new import_client3.ORPCError("NOT_FOUND", { message: `session ${input.session} has filed no rate_limit_event on its stream yet: the worker emits one only once a turn has completed, so retry after this session's next turn` });
+            throw new import_client5.ORPCError("NOT_FOUND", { message: `session ${input.session} has filed no rate_limit_event on its stream yet: the worker emits one only once a turn has completed, so retry after this session's next turn` });
           }
-          throw new import_client3.ORPCError("NOT_FOUND", { message: rcSessionNotObservedMessage(input.session) });
+          throw new import_client5.ORPCError("NOT_FOUND", { message: rcSessionNotObservedMessage(input.session) });
         }
         return { latest: deps.latestRateLimit(), sessions };
       })
     },
     frontdoor: {
-      status: authed.route({ method: "GET", path: "/rest/frontdoor/status", summary: "Read the front door's status", tags: [FRONTDOOR_API_TAG] }).output(FrontDoorStatusOutputSchema).handler(() => deps.frontDoorStatus()),
-      sessions: authed.route({ method: "GET", path: "/rest/frontdoor/sessions", summary: "Read the front door's session registry", tags: [FRONTDOOR_API_TAG] }).output(FrontDoorSessionsOutputSchema).handler(() => ({ sessions: deps.frontDoorStatus().sessions }))
+      status: authed.meta((0, import_openapi6.openapi)({ method: "GET", path: "/rest/frontdoor/status", summary: "Read the front door's status", tags: [FRONTDOOR_API_TAG2] })).output(FrontDoorStatusOutputSchema).handler(() => deps.frontDoorStatus()),
+      sessions: authed.meta((0, import_openapi6.openapi)({ method: "GET", path: "/rest/frontdoor/sessions", summary: "Read the front door's session registry", tags: [FRONTDOOR_API_TAG2] })).output(FrontDoorSessionsOutputSchema).handler(() => ({ sessions: deps.frontDoorStatus().sessions }))
     },
     check: {
       // The report's own JSON shape is the contract (the same one `check --json` prints and `checkReportSchema.ts` defines), so the procedure returns exactly that conversion.
-      run: authed.route({ method: "GET", path: "/rest/check", summary: "Run the check report for one directory", tags: [CHECK_API_TAG] }).input(CheckRunInputSchema).output(CheckReportJsonSchema).handler(({ input }) => checkReportToJson(deps.checkReport(input.path, input.identity)))
+      run: authed.meta((0, import_openapi6.openapi)({ method: "GET", path: "/rest/check", summary: "Run the check report for one directory", tags: [CHECK_API_TAG] })).input(CheckRunInputSchema).output(CheckReportJsonSchema).handler(({ input }) => checkReportToJson(deps.checkReport(input.path, input.identity)))
     },
     doctor: {
-      run: authed.route({ method: "GET", path: "/rest/doctor", summary: "Run the doctor report", tags: [DOCTOR_API_TAG] }).output(DoctorRunOutputSchema).handler(() => deps.doctorReport())
+      run: authed.meta((0, import_openapi6.openapi)({ method: "GET", path: "/rest/doctor", summary: "Run the doctor report", tags: [DOCTOR_API_TAG] })).output(DoctorRunOutputSchema).handler(() => deps.doctorReport())
     },
     pool: {
-      pick: authed.route({ method: "GET", path: "/rest/pool/pick", summary: "Rank one pool exactly as a launch from a directory would right now", tags: [POOL_API_TAG] }).input(PoolPickInputSchema).output(PoolPickReportSchema).handler(({ input }) => {
+      pick: authed.meta((0, import_openapi6.openapi)({ method: "GET", path: "/rest/pool/pick", summary: "Rank one pool exactly as a launch from a directory would right now", tags: [POOL_API_TAG] })).input(PoolPickInputSchema).output(PoolPickReportSchema).handler(({ input }) => {
         const report = deps.poolPick(input.pool, input.path);
         if (report === void 0) {
           const live = deps.poolNames();
-          throw new import_client3.ORPCError("NOT_FOUND", {
+          throw new import_client5.ORPCError("NOT_FOUND", {
             message: live.length === 0 ? `no pools are configured, so none is named ${input.pool}` : `no pool is named ${input.pool}; the live pools are ${live.map((name) => `"${name}"`).join(", ")}`
           });
         }
@@ -13020,13 +13323,15 @@ function createControlApiRouter(deps) {
   };
 }
 function createDoorApiRouter(deps) {
-  return { ...createRcApiRouter(deps), ...createControlApiRouter(deps), ...createEventsApiRouter(deps) };
+  const control = createControlApiRouter(deps);
+  const lifecycle = createLifecycleApiRouter(deps);
+  return { ...createRcApiRouter(deps), ...control, ...lifecycle, ...createCodexApiRouter(deps), ...createLaunchApiRouter(deps), ...createEventsApiRouter(deps), frontdoor: { ...control.frontdoor, ...lifecycle.frontdoor } };
 }
 function createDoorApiNodeHandler(deps) {
   return doorApiNodeHandlerOf(createDoorApiRouter(deps), deps.expectedToken);
 }
 function frontDoorApiClient(port, ca, token) {
-  return (0, import_client3.createORPCClient)(frontDoorApiLink(port, ca, token));
+  return (0, import_client5.createORPCClient)(frontDoorApiLink(port, ca, token));
 }
 
 // src/frontdoor/doorClient.ts
@@ -14980,7 +15285,7 @@ data: ${JSON.stringify(envelope)}
 }
 
 // src/frontdoor/rcSelfHostMint.ts
-var import_node_path30 = __toESM(require("node:path"), 1);
+var import_node_path31 = __toESM(require("node:path"), 1);
 init_account();
 var CREDENTIALS_FILE = ".credentials.json";
 var CLAUDE_JSON2 = ".claude.json";
@@ -15005,7 +15310,7 @@ function readJsonObject(fs12, file) {
   return isRecord11(parsed) ? parsed : void 0;
 }
 function readRcSelfHostRecord(fs12, frontdoorDir) {
-  const parsed = readJsonObject(fs12, import_node_path30.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
+  const parsed = readJsonObject(fs12, import_node_path31.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
   if (parsed === void 0) {
     return void 0;
   }
@@ -15019,11 +15324,11 @@ function mintRcSelfHostCredential(deps) {
   if (!isIdentityName(deps.identity)) {
     throw new Error(`"${deps.identity}" is not a valid identity name.`);
   }
-  const identityDir = import_node_path30.default.join(deps.identitiesDir, deps.identity);
-  const credentialsFile = import_node_path30.default.join(identityDir, CREDENTIALS_FILE);
-  const claudeJsonFile = import_node_path30.default.join(identityDir, CLAUDE_JSON2);
-  const recordDir = import_node_path30.default.join(deps.frontdoorDir, RC_SELF_HOST_RECORD_DIR);
-  const recordFile = import_node_path30.default.join(recordDir, RC_SELF_HOST_RECORD_FILE);
+  const identityDir = import_node_path31.default.join(deps.identitiesDir, deps.identity);
+  const credentialsFile = import_node_path31.default.join(identityDir, CREDENTIALS_FILE);
+  const claudeJsonFile = import_node_path31.default.join(identityDir, CLAUDE_JSON2);
+  const recordDir = import_node_path31.default.join(deps.frontdoorDir, RC_SELF_HOST_RECORD_DIR);
+  const recordFile = import_node_path31.default.join(recordDir, RC_SELF_HOST_RECORD_FILE);
   const previousRecord = readRcSelfHostRecord(deps.fs, deps.frontdoorDir);
   const existingCredentials = readJsonObject(deps.fs, credentialsFile);
   const existingOauth = isRecord11(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
@@ -15039,7 +15344,7 @@ function mintRcSelfHostCredential(deps) {
   const organizationUuid = deps.newUuid();
   const accountUuid = deps.newUuid();
   const mintedAt = new Date(deps.now()).toISOString();
-  deps.fs.mkdirPrivate(import_node_path30.default.dirname(credentialsFile));
+  deps.fs.mkdirPrivate(import_node_path31.default.dirname(credentialsFile));
   deps.fs.writeFilePrivate(credentialsFile, `${JSON.stringify({ ...existingCredentials, claudeAiOauth: { accessToken, refreshToken, expiresAt: null, scopes: [...RC_SELF_HOST_SCOPE_LIST], subscriptionType: SELF_HOST_SUBSCRIPTION_TYPE, rateLimitTier: null } }, null, 2)}
 `);
   const claudeJson = readJsonObject(deps.fs, claudeJsonFile) ?? {};
@@ -15294,6 +15599,9 @@ init_ownCli();
   CheckReportJsonSchema,
   CheckRunInputSchema,
   CliError,
+  CodexLogoutOutputSchema,
+  CodexSignInSchema,
+  CodexStatusOutputSchema,
   ConfigProfileSchema,
   CredentialCacheSchema,
   CredentialSchema,
@@ -15318,6 +15626,7 @@ init_ownCli();
   FARM_MANIFEST_FILENAME,
   FrontDoorControlMaterialError,
   FrontDoorNotServingError,
+  FrontDoorRestartOutputSchema,
   FrontDoorSessionStatusSchema,
   FrontDoorSessionsOutputSchema,
   FrontDoorStartError,
@@ -15335,6 +15644,8 @@ init_ownCli();
   LAUNCH_EVENT_SOURCE,
   LaunchLifecycleEventSchema,
   LaunchRefusedError,
+  LaunchResolveInputSchema,
+  LaunchResolveOutputSchema,
   LegacyProviderFileError,
   OWN_CLI_FILE_NAME,
   PROMPT_CACHE_TTL_MS,
@@ -15381,6 +15692,7 @@ init_ownCli();
   RcStreamEnvelopeSchema,
   RcStreamEventSchema,
   USAGE_EVENT_SOURCE,
+  UpdateCheckOutputSchema,
   UsageError,
   UsageListOutputSchema,
   UsageLiveOutputSchema,
@@ -15423,14 +15735,17 @@ init_ownCli();
   collectDoctorReport,
   collectFrontDoorStatus,
   collectPoolPick,
+  createCodexApiRouter,
   createControlApiRouter,
   createDoorApiNodeHandler,
   createDoorApiRouter,
   createDoorEventHub,
   createDoorHealthPublisher,
   createEventsApiRouter,
+  createLaunchApiRouter,
   createLaunchEventPublisher,
   createLeafCache,
+  createLifecycleApiRouter,
   createProfile,
   createQuotaExpiringPublisher,
   createRcApiNodeHandler,
@@ -15538,7 +15853,9 @@ init_ownCli();
   requirePool,
   resolveAgentShimHome,
   resolveClaudeHome,
+  resolveClaudeLaunch,
   resolveDecisions,
+  resolveLaunch,
   resolveLaunchSelection,
   resolveLayoutPaths,
   resolveSupervisorConfig,