claude-use 9.5.0 → 9.6.0

package/dist/index.mjs

@@ -2625,7 +2625,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "claude-use",
-      version: "9.5.0",
+      version: "9.6.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -2676,9 +2676,10 @@ var init_package = __esm({
       dependencies: {
         "@anthropic-ai/claude-agent-sdk": "0.3.292",
         "@clack/prompts": "^1.8.0",
-        "@orpc/client": "1.15.4",
-        "@orpc/openapi": "1.15.4",
-        "@orpc/server": "1.15.4",
+        "@modelcontextprotocol/sdk": "1.32.0",
+        "@orpc/client": "2.0.0-beta.41",
+        "@orpc/openapi": "2.0.0-beta.41",
+        "@orpc/server": "2.0.0-beta.41",
         commander: "^15.0.0",
         cosmiconfig: "^10.0.1",
         picomatch: "^4.0.7",
@@ -5742,7 +5743,7 @@ function cascadeProviderName(cascade) {
   }
   return name;
 }
-function resolveProvider(params) {
+function selectProvider(params) {
   const cliName = params.cliProvider !== void 0 && params.cliProvider !== "" ? params.cliProvider : void 0;
   const name = cliName ?? (params.cascade === void 0 ? void 0 : cascadeProviderName(params.cascade));
   if (name === void 0) {
@@ -5757,6 +5758,14 @@ function resolveProvider(params) {
       message: `agent-shim: no provider named "${name}". ` + (known.length > 0 ? `Known providers: ${known.join(", ")}.` : "No providers are defined yet; run `agent-shim provider add`.")
     };
   }
+  return { ok: true, provider: { name, definition } };
+}
+function resolveProvider(params) {
+  const selection = selectProvider(params);
+  if (selection?.ok !== true) {
+    return selection;
+  }
+  const { name, definition } = selection.provider;
   if (params.credentials === void 0) {
     return { ok: false, status: 1, message: `agent-shim: provider ${name} needs its credential resolved, but this launcher has no credential port wired` };
   }
@@ -6037,6 +6046,51 @@ var init_claudeShim = __esm({
   }
 });
 
+// src/update/update.ts
+function compareVersions3(left, right) {
+  const parse = (version) => {
+    const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(version);
+    if (match === null) {
+      throw new Error(`not a plain release version: ${version}`);
+    }
+    return [Number(match[1]), Number(match[2]), Number(match[3])];
+  };
+  const leftParts = parse(left);
+  const rightParts = parse(right);
+  return leftParts.map((part, index) => part - (rightParts[index] ?? 0)).find((difference) => difference !== 0) ?? 0;
+}
+function releaseTagFromUrl(url) {
+  const segment = url.split("?")[0]?.split("/").at(-1);
+  const candidate = segment?.startsWith("v") === true ? segment.slice(1) : void 0;
+  return candidate !== void 0 && /^\d+\.\d+\.\d+$/.test(candidate) ? candidate : void 0;
+}
+var LATEST_RELEASE_URL, UpdateChannelError, UpdateConflictError, UpdateDownloadError;
+var init_update = __esm({
+  "src/update/update.ts"() {
+    "use strict";
+    init_cliError();
+    LATEST_RELEASE_URL = "https://github.com/ExaDev/agent-shim/releases/latest";
+    UpdateChannelError = class extends CliError {
+      constructor(message) {
+        super(message);
+        this.name = "UpdateChannelError";
+      }
+    };
+    UpdateConflictError = class extends CliError {
+      constructor(message) {
+        super(message);
+        this.name = "UpdateConflictError";
+      }
+    };
+    UpdateDownloadError = class extends CliError {
+      constructor(message) {
+        super(message);
+        this.name = "UpdateDownloadError";
+      }
+    };
+  }
+});
+
 // src/frontdoor/ensure.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
 function ensureFrontDoor(params) {
@@ -6442,7 +6496,7 @@ var init_headers = __esm({
 });
 
 // src/launcher/flags.ts
-import path31 from "node:path";
+import path32 from "node:path";
 function resolveLaunchFlags(params) {
   return {
     skipPermissions: params.flags?.skipPermissions ?? parseEnvBool("AGENT_SHIM_SKIP_PERMISSIONS", params.env.AGENT_SHIM_SKIP_PERMISSIONS) ?? params.cascade?.skipPermissions ?? false,
@@ -6473,7 +6527,7 @@ function buildEnv(params) {
   const parentCustomHeaders = params.baseEnv.ANTHROPIC_CUSTOM_HEADERS;
   let providerCustomHeaders;
   if (!params.configDirEscapeHatch && params.resolvedIdentityName !== void 0) {
-    env.CLAUDE_CONFIG_DIR = path31.join(params.identitiesDir, params.resolvedIdentityName);
+    env.CLAUDE_CONFIG_DIR = path32.join(params.identitiesDir, params.resolvedIdentityName);
   }
   if (params.provider !== void 0) {
     const providerEnv = params.provider.definition.env ?? {};
@@ -6596,7 +6650,9 @@ function resolvePoolLaunch(params) {
     }
     const { pick, earliestReturn, movedOff } = graph.ranking;
     if (pick !== void 0) {
-      recordStickyPick(params.usageFs, params.paths.usagePicksFile, params.cwd, pick.identity, nowMs);
+      if (params.recordPick) {
+        recordStickyPick(params.usageFs, params.paths.usagePicksFile, params.cwd, pick.identity, nowMs);
+      }
       const move = movedOff === void 0 ? "" : `moved off ${movedOff.identity} (${movedOff.reason}); `;
       return {
         ok: true,
@@ -6662,33 +6718,6 @@ var init_spawn = __esm({
   }
 });
 
-// src/update/update.ts
-function compareVersions3(left, right) {
-  const parse = (version) => {
-    const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(version);
-    if (match === null) {
-      throw new Error(`not a plain release version: ${version}`);
-    }
-    return [Number(match[1]), Number(match[2]), Number(match[3])];
-  };
-  const leftParts = parse(left);
-  const rightParts = parse(right);
-  return leftParts.map((part, index) => part - (rightParts[index] ?? 0)).find((difference) => difference !== 0) ?? 0;
-}
-function releaseTagFromUrl(url) {
-  const segment = url.split("?")[0]?.split("/").at(-1);
-  const candidate = segment?.startsWith("v") === true ? segment.slice(1) : void 0;
-  return candidate !== void 0 && /^\d+\.\d+\.\d+$/.test(candidate) ? candidate : void 0;
-}
-var LATEST_RELEASE_URL;
-var init_update = __esm({
-  "src/update/update.ts"() {
-    "use strict";
-    init_cliError();
-    LATEST_RELEASE_URL = "https://github.com/ExaDev/agent-shim/releases/latest";
-  }
-});
-
 // src/update/launchHook.ts
 function resolveUpdateMode(globalConfig) {
   return globalConfig?.update?.mode ?? "off";
@@ -6760,7 +6789,7 @@ var init_launchHook = __esm({
 
 // src/launcher.ts
 import { randomUUID as randomUUID4 } from "node:crypto";
-import path32 from "node:path";
+import path33 from "node:path";
 function resolveIdentityCredential(identity, credential, env, port) {
   if (port === void 0) {
     return { ok: false, status: 1, message: `agent-shim: identity ${identity} needs its credential resolved, but this launcher has no credential port wired` };
@@ -6768,7 +6797,7 @@ function resolveIdentityCredential(identity, credential, env, port) {
   const resolution = resolveCredential({ credential, env, port, subject: `identity ${identity}` });
   return resolution.ok ? resolution : { ok: false, status: CREDENTIAL_UNAVAILABLE_EXIT, message: resolution.message };
 }
-function pickFromPool(decided, params, parsedArgv) {
+function pickFromPool(decided, params, parsedArgv, readOnly) {
   const { paths, fs: fs12, proc, log } = params;
   if (decided.pool === void 0) {
     return { identityDecision: decided };
@@ -6789,7 +6818,9 @@ function pickFromPool(decided, params, parsedArgv) {
     now: farmRuntime.now,
     sleep: farmRuntime.lock.sleep,
     passthrough: parsedArgv.rest,
-    wait: parsedArgv.wait === true,
+    // A read-only decision never sleeps for a refused pool and never records its pick, so asking what a launch would pick leaves the next real launch's keep-warm preference as it was.
+    wait: !readOnly && parsedArgv.wait === true,
+    recordPick: !readOnly,
     log
   });
   if (!resolution.ok) {
@@ -6802,7 +6833,7 @@ function pickFromPool(decided, params, parsedArgv) {
     poolPick: { name: decided.pool, reasons: resolution.reasons, ...resolution.movedOff === void 0 ? {} : { movedOff: resolution.movedOff } }
   };
 }
-function prepareLaunch(params) {
+function decideLaunch(params, readOnly) {
   const { paths, fs: fs12, proc, log } = params;
   const { env, argv } = proc;
   const parsedArgv = parseLauncherArgv(argv);
@@ -6826,10 +6857,10 @@ function prepareLaunch(params) {
       return trimmed === "" ? void 0 : trimmed;
     }
   });
-  const { identityDecision, poolExplanation, poolPick } = pickFromPool(decidedIdentity, params, parsedArgv);
+  const { identityDecision, poolExplanation, poolPick } = pickFromPool(decidedIdentity, params, parsedArgv, readOnly);
   const farmIdentity = configDirEscapeHatchApplies ? void 0 : identityDecision.name;
   const farm = farmIdentity === void 0 ? void 0 : params.farm;
-  if (farm !== void 0 && farmIdentity !== void 0) {
+  if (!readOnly && farm !== void 0 && farmIdentity !== void 0) {
     let recovery;
     try {
       recovery = recoverFarm({
@@ -6868,33 +6899,44 @@ function prepareLaunch(params) {
     identityDefaultConfigProfile: loadedIdentity?.config.defaultConfigProfile,
     globalDefaultConfigProfile: params.globalDefaultConfigProfile
   });
-  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs12.readConfigFile(path32.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
+  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs12.readConfigFile(path33.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
     log.error(
       `agent-shim: no configuration profile named "${configProfileDecision.name}" (selected via ${configProfileDecision.source}). Run \`agent-shim profile add ${configProfileDecision.name}\` first.`
     );
     proc.exit(1);
   }
   const farmContext = farm !== void 0 && farmIdentity !== void 0 ? { farm, identity: farmIdentity, cascade: farm.loadCascade(configProfileDecision.name, cliOverride) } : void 0;
-  const provider = parsedArgv.provider === false ? void 0 : resolveProvider({
+  const providerParams = {
     paths,
     port: fs12,
-    env,
-    ...params.credentials === void 0 ? {} : { credentials: params.credentials },
-    ...parsedArgv.provider === void 0 ? {} : { cliProvider: parsedArgv.provider },
+    ...parsedArgv.provider === void 0 || parsedArgv.provider === false ? {} : { cliProvider: parsedArgv.provider },
     ...farmContext === void 0 ? {} : { cascade: farmContext.cascade }
-  });
-  if (provider !== void 0 && !provider.ok) {
-    log.error(provider.message);
-    proc.exit(provider.status);
-  }
-  const resolvedProvider = provider?.ok === true ? provider.provider : void 0;
-  for (const warning of provider?.ok === true ? provider.warnings : []) {
-    log.warn(warning);
+  };
+  let selectedProvider;
+  let resolvedProvider;
+  if (parsedArgv.provider !== false && readOnly) {
+    const selection = selectProvider(providerParams);
+    if (selection !== void 0 && !selection.ok) {
+      log.error(selection.message);
+      proc.exit(selection.status);
+    }
+    selectedProvider = selection?.ok === true ? selection.provider : void 0;
+  } else if (parsedArgv.provider !== false) {
+    const provider = resolveProvider({ ...providerParams, env, ...params.credentials === void 0 ? {} : { credentials: params.credentials } });
+    if (provider !== void 0 && !provider.ok) {
+      log.error(provider.message);
+      proc.exit(provider.status);
+    }
+    resolvedProvider = provider?.ok === true ? provider.provider : void 0;
+    selectedProvider = resolvedProvider;
+    for (const warning of provider?.ok === true ? provider.warnings : []) {
+      log.warn(warning);
+    }
   }
   if (farm !== void 0 && farmIdentity !== void 0) {
     try {
       const snapshot = readUsageSnapshot(farm.fs, paths.usageSnapshotsDir, farmIdentity);
-      for (const warning of quotaWarnings(snapshot, resolvedProvider?.name ?? ANTHROPIC_PROVIDER, farm.now())) {
+      for (const warning of quotaWarnings(snapshot, selectedProvider?.name ?? ANTHROPIC_PROVIDER, farm.now())) {
         log.warn(warning);
       }
     } catch (error) {
@@ -6904,8 +6946,8 @@ function prepareLaunch(params) {
       log.warn(`agent-shim: ${error.message}`);
     }
   }
-  const identityCredentialBlock = loadedIdentity?.config.credential;
-  const identityResolution = resolvedProvider === void 0 && farmIdentity !== void 0 && identityCredentialBlock !== void 0 ? resolveIdentityCredential(farmIdentity, identityCredentialBlock, env, params.credentials) : void 0;
+  const identityCredentialBlock = selectedProvider === void 0 && farmIdentity !== void 0 ? loadedIdentity?.config.credential : void 0;
+  const identityResolution = !readOnly && identityCredentialBlock !== void 0 && farmIdentity !== void 0 ? resolveIdentityCredential(farmIdentity, identityCredentialBlock, env, params.credentials) : void 0;
   if (identityResolution !== void 0 && !identityResolution.ok) {
     log.error(identityResolution.message);
     proc.exit(identityResolution.status);
@@ -6919,25 +6961,97 @@ function prepareLaunch(params) {
     allowAmbientCredential: loadedIdentity?.config.allowAmbientCredential ?? false,
     allowAmbientCredentialOverride: parseEnvBool("AGENT_SHIM_ALLOW_AMBIENT_CREDENTIAL", env.AGENT_SHIM_ALLOW_AMBIENT_CREDENTIAL) === true,
     identityName: identityDecision.name,
-    providerSelected: resolvedProvider !== void 0,
+    providerSelected: selectedProvider !== void 0,
     ...identityCredential === void 0 ? {} : { injectedCredential: { variable: CREDENTIAL_TARGET_VARS[identityCredential.target], token: identityCredential.token } }
   });
   if (!guardResult.ok) {
-    log.error(guardResult.message);
-    proc.exit(1);
+    if (readOnly && identityCredentialBlock !== void 0) {
+      log.warn(`${guardResult.message} (not resolved here: the launch proceeds only if that value is the identity's own injected credential)`);
+    } else {
+      log.error(guardResult.message);
+      proc.exit(1);
+    }
+  }
+  const launchCascade = farmContext?.cascade ?? (params.farm === void 0 ? void 0 : params.farm.loadCascade(configProfileDecision.name, cliOverride));
+  let cascadeLaunch;
+  if (launchCascade !== void 0 && params.farm !== void 0) {
+    const assembled = assembleCascade(launchCascade);
+    const flattened = flattenLayers(assembled.layers, { home: params.farm.home });
+    cascadeLaunch = flattened.launch;
+    if (readOnly) {
+      for (const diagnostic of [...assembled.diagnostics, ...flattened.diagnostics]) {
+        if (diagnostic.severity !== "info") {
+          log.warn(`agent-shim: ${diagnostic.code}: ${diagnostic.message}`);
+        }
+      }
+    }
   }
+  const pinnedVersion = resolveClaudeVersion({ env, ...parsedArgv.claudeVersion === void 0 ? {} : { flag: parsedArgv.claudeVersion }, ...cascadeLaunch?.claudeVersion === void 0 ? {} : { cascade: cascadeLaunch.claudeVersion } });
+  const discovered = params.resolveClaudeBinary(pinnedVersion === void 0 ? void 0 : { version: pinnedVersion.version });
+  const flags = resolveLaunchFlags({
+    env,
+    // A pool pick reads the usage the front door records, so a pool launch records its own unless something says otherwise.
+    ...poolExplanation === void 0 ? {} : { trackUsageDefault: true },
+    ...cascadeLaunch === void 0 ? {} : { cascade: cascadeLaunch },
+    flags: {
+      ...parsedArgv.skipPermissions === void 0 ? {} : { skipPermissions: parsedArgv.skipPermissions },
+      ...parsedArgv.remoteControl === void 0 ? {} : { remoteControl: parsedArgv.remoteControl },
+      ...parsedArgv.headroom === void 0 ? {} : { headroom: parsedArgv.headroom },
+      ...parsedArgv.trackUsage === void 0 ? {} : { trackUsage: parsedArgv.trackUsage }
+    }
+  });
+  const args = buildArgv({
+    toolFlags: buildFlagArgs(flags),
+    extraFlags: splitExtraFlags(env.CLAUDE_EXTRA_FLAGS),
+    passthrough: parsedArgv.rest
+  });
+  const configDir = configDirEscapeHatchApplies || identityDecision.name === void 0 ? env.CLAUDE_CONFIG_DIR : path33.join(paths.identitiesDir, identityDecision.name);
+  const decision = {
+    identitySource: identityDecision.source,
+    configDirEscapeHatch: identityDecision.configDirEscapeHatch,
+    configProfileSource: configProfileDecision.source,
+    ...identityDecision.name === void 0 ? {} : { identity: identityDecision.name },
+    ...poolPick === void 0 ? {} : { pool: poolPick },
+    ...configDir === void 0 || configDir === "" ? {} : { configDir },
+    ...configProfileDecision.name === void 0 ? {} : { configProfile: configProfileDecision.name },
+    ...selectedProvider === void 0 ? {} : { provider: selectedProvider.name }
+  };
+  return {
+    parsedArgv,
+    identityDecision,
+    poolExplanation,
+    poolPick,
+    configDirEscapeHatch: configDirEscapeHatchApplies,
+    farmIdentity,
+    farmContext,
+    configProfileDecision,
+    provider: selectedProvider,
+    resolvedProvider,
+    identityCredentialBlock,
+    identityCredential,
+    pinnedVersion,
+    flags,
+    bin: discovered.path,
+    args,
+    decision
+  };
+}
+function prepareLaunch(params) {
+  const { paths, proc, log } = params;
+  const { env } = proc;
+  const decided = decideLaunch(params, false);
+  const { identityDecision, configProfileDecision, resolvedProvider, identityCredential, poolExplanation, flags: resolvedFlags, args: finalArgv, configDirEscapeHatch: configDirEscapeHatchApplies, decision } = decided;
   log.info(
     `agent-shim: identity ${identityDecision.name ?? "(none)"} (${identityDecision.source}${poolExplanation === void 0 ? "" : `, ${poolExplanation}`}), config profile ${configProfileDecision.name ?? "(none)"} (${configProfileDecision.source})` + (resolvedProvider === void 0 ? "" : `, provider ${resolvedProvider.name} (credential ${resolvedProvider.credential.target} from ${describeSource(resolvedProvider.credential.source)})`) + (identityCredential === void 0 ? "" : `, identity credential ${identityCredential.target} from ${describeSource(identityCredential.source)}`)
   );
   const updateCheck = runLaunchUpdateCheck({
     mode: params.updateMode ?? "off",
-    checkPath: path32.join(paths.root, "update.check"),
+    checkPath: path33.join(paths.root, "update.check"),
     currentVersion: package_default.version,
     port: params.update
   });
-  let cascadeLaunch;
-  if (farmContext !== void 0) {
-    const { farm: resyncFarmRuntime, identity: resyncIdentity, cascade } = farmContext;
+  if (decided.farmContext !== void 0) {
+    const { farm: resyncFarmRuntime, identity: resyncIdentity, cascade } = decided.farmContext;
     let result;
     try {
       result = resyncFarm({
@@ -6974,27 +7088,10 @@ function prepareLaunch(params) {
     log.info(
       result.noOp ? `agent-shim: farm at ${result.farmRoot} already matches the resolved cascade` : `agent-shim: farm at ${result.farmRoot} resynced (${String(result.manifest.links.length)} link(s), ${String(result.manifest.materialised.length)} built director(ies)${result.adopted.length === 0 ? "" : `, ${String(result.adopted.length)} adopted into ${resyncFarmRuntime.claudeHome}`})`
     );
-    cascadeLaunch = result.resolved.flattened.launch;
-  } else if (params.farm !== void 0) {
-    cascadeLaunch = flattenLayers(assembleCascade(params.farm.loadCascade(configProfileDecision.name, cliOverride)).layers, { home: params.farm.home }).launch;
   }
-  const pinnedVersion = resolveClaudeVersion({ env, ...parsedArgv.claudeVersion === void 0 ? {} : { flag: parsedArgv.claudeVersion }, ...cascadeLaunch?.claudeVersion === void 0 ? {} : { cascade: cascadeLaunch.claudeVersion } });
-  const discovered = params.resolveClaudeBinary(pinnedVersion === void 0 ? void 0 : { version: pinnedVersion.version });
-  if (pinnedVersion !== void 0) {
-    log.info(`agent-shim: Claude Code ${pinnedVersion.version} (pinned by ${pinnedVersion.source})`);
+  if (decided.pinnedVersion !== void 0) {
+    log.info(`agent-shim: Claude Code ${decided.pinnedVersion.version} (pinned by ${decided.pinnedVersion.source})`);
   }
-  const resolvedFlags = resolveLaunchFlags({
-    env,
-    // A pool pick reads the usage the front door records, so a pool launch records its own unless something says otherwise.
-    ...poolExplanation === void 0 ? {} : { trackUsageDefault: true },
-    ...cascadeLaunch === void 0 ? {} : { cascade: cascadeLaunch },
-    flags: {
-      ...parsedArgv.skipPermissions === void 0 ? {} : { skipPermissions: parsedArgv.skipPermissions },
-      ...parsedArgv.remoteControl === void 0 ? {} : { remoteControl: parsedArgv.remoteControl },
-      ...parsedArgv.headroom === void 0 ? {} : { headroom: parsedArgv.headroom },
-      ...parsedArgv.trackUsage === void 0 ? {} : { trackUsage: parsedArgv.trackUsage }
-    }
-  });
   const frontDoorPort = params.frontdoor;
   const frontDoorEngaged = resolvedProvider !== void 0 || resolvedFlags.headroom || resolvedFlags.trackUsage;
   if (frontDoorEngaged && frontDoorPort === void 0) {
@@ -7018,11 +7115,6 @@ function prepareLaunch(params) {
     log.info(`agent-shim: routing through the front door on 127.0.0.1:${String(frontDoor.port)}${resolvedProvider === void 0 ? ` (OAuth via the door's CONNECT surface on 127.0.0.1:${String(frontDoor.connectPort)}, usage recorded)` : ` (provider ${resolvedProvider.name})`}`);
   }
   const frontDoorRelease = frontDoor === void 0 ? void 0 : frontDoorPort?.release;
-  const finalArgv = buildArgv({
-    toolFlags: buildFlagArgs(resolvedFlags),
-    extraFlags: splitExtraFlags(env.CLAUDE_EXTRA_FLAGS),
-    passthrough: parsedArgv.rest
-  });
   const finalEnv = buildEnv({
     baseEnv: env,
     configDirEscapeHatch: configDirEscapeHatchApplies,
@@ -7040,18 +7132,35 @@ function prepareLaunch(params) {
       registered();
     }
   };
-  const configDir = finalEnv.CLAUDE_CONFIG_DIR;
-  const decision = {
-    identitySource: identityDecision.source,
-    configDirEscapeHatch: identityDecision.configDirEscapeHatch,
-    configProfileSource: configProfileDecision.source,
-    ...identityDecision.name === void 0 ? {} : { identity: identityDecision.name },
-    ...poolPick === void 0 ? {} : { pool: poolPick },
-    ...configDir === void 0 || configDir === "" ? {} : { configDir },
-    ...configProfileDecision.name === void 0 ? {} : { configProfile: configProfileDecision.name },
-    ...resolvedProvider === void 0 ? {} : { provider: resolvedProvider.name }
+  return { bin: decided.bin, args: finalArgv, env: finalEnv, release, markChildStarted: updateCheck.markChildStarted, decision };
+}
+function resolveLaunch(params) {
+  const decided = decideLaunch(params, true);
+  const { env } = params.proc;
+  const frontDoor = decided.provider !== void 0 || decided.flags.headroom || decided.flags.trackUsage;
+  const built = buildEnv({
+    baseEnv: env,
+    configDirEscapeHatch: decided.configDirEscapeHatch,
+    resolvedIdentityName: decided.identityDecision.name,
+    identitiesDir: params.paths.identitiesDir,
+    ...decided.provider === void 0 ? {} : { provider: decided.provider },
+    ...frontDoor ? { frontdoor: { port: 0, connectPort: 0, trustBundlePath: "", sessionToken: "" } } : {},
+    ...decided.flags.headroom ? { headroom: { socketPath: "", projectId: "" } } : {},
+    sessionId: ""
+  });
+  const credentialNames = decided.identityCredentialBlock === void 0 ? [] : Object.keys(credentialVariables(decided.identityCredentialBlock.target ?? "bearer", ""));
+  const environment = [.../* @__PURE__ */ new Set([...Object.keys(built).filter((name) => built[name] !== env[name]), ...credentialNames])].sort();
+  const credential = decided.provider !== void 0 ? { subject: "provider", name: decided.provider.name, summary: summariseCredential(decided.provider.definition.credential) } : decided.identityCredentialBlock !== void 0 && decided.farmIdentity !== void 0 ? { subject: "identity", name: decided.farmIdentity, summary: summariseCredential(decided.identityCredentialBlock) } : void 0;
+  return {
+    decision: decided.decision,
+    flags: decided.flags,
+    ...decided.pinnedVersion === void 0 ? {} : { claudeVersion: decided.pinnedVersion },
+    bin: decided.bin,
+    args: decided.args,
+    ...credential === void 0 ? {} : { credential },
+    routing: { frontDoor, headroom: decided.flags.headroom },
+    environment
   };
-  return { bin: discovered.path, args: finalArgv, env: finalEnv, release, markChildStarted: updateCheck.markChildStarted, decision };
 }
 function runLaunchPlan(plan, spawn2) {
   try {
@@ -7097,12 +7206,12 @@ var init_launcher = __esm({
 });
 
 // src/ownCli.ts
-import path33 from "node:path";
+import path34 from "node:path";
 function agentShimCliPath(distDir = typeof __AGENT_SHIM_DIST_DIR__ === "string" ? __AGENT_SHIM_DIST_DIR__ : void 0) {
   if (distDir === void 0) {
     throw new OwnCliPathUnknownError();
   }
-  return path33.join(distDir, OWN_CLI_FILE_NAME);
+  return path34.join(distDir, OWN_CLI_FILE_NAME);
 }
 var OWN_CLI_FILE_NAME, OwnCliPathUnknownError;
 var init_ownCli = __esm({
@@ -7191,10 +7300,10 @@ request.on("error", (error) => finish(failed, (error.code ? error.code + ": " :
 
 // src/frontdoor/trust.ts
 import { createHash as createHash6 } from "node:crypto";
-import path34 from "node:path";
+import path35 from "node:path";
 function resolveTrustBundle(params) {
   const { caCertFile, bundlesDir, variable, inherited, fs: fs12 } = params;
-  if (inherited === void 0 || inherited === "" || path34.resolve(inherited) === path34.resolve(caCertFile)) {
+  if (inherited === void 0 || inherited === "" || path35.resolve(inherited) === path35.resolve(caCertFile)) {
     return { path: caCertFile };
   }
   const caPem = fs12.readFileUtf8(caCertFile);
@@ -7212,7 +7321,7 @@ function resolveTrustBundle(params) {
   }
   const combined = `${inheritedPem.trimEnd()}
 ${caPem}`;
-  const bundle = path34.join(bundlesDir, `${createHash6("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
+  const bundle = path35.join(bundlesDir, `${createHash6("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
   if (!fs12.exists(bundle)) {
     fs12.mkdirp(bundlesDir);
     fs12.writeFileAtomic(bundle, combined);
@@ -7369,6 +7478,31 @@ function prepareClaudeLaunch(options) {
   const spawnDaemon = daemonSpawnerFor(options.agentShim);
   return prepareLaunch(realPrepareLaunchParams(paths, { proc, log, spawnDaemon, farm: buildFarmRuntime(paths, options.cwd) }));
 }
+function resolveClaudeLaunch(options) {
+  const paths = options.paths ?? resolveLayoutPaths();
+  const refusals = [];
+  const warnings = [];
+  const log = {
+    info: () => void 0,
+    warn: (message) => {
+      warnings.push(message);
+    },
+    error: (message) => {
+      refusals.push(message);
+    }
+  };
+  const proc = {
+    env: options.env,
+    argv: options.argv,
+    exit: (code) => {
+      throw new LaunchRefusedError(refusals.join("\n") || `the launch was refused (exit ${String(code)})`, code);
+    }
+  };
+  const spawnDaemon = () => {
+    throw new Error("resolving a launch starts no daemon");
+  };
+  return { resolution: resolveLaunch(realPrepareLaunchParams(paths, { proc, log, spawnDaemon, farm: buildFarmRuntime(paths, options.cwd) })), warnings };
+}
 var LaunchRefusedError;
 var init_launchWiring = __esm({
   "src/launchWiring.ts"() {
@@ -7535,7 +7669,7 @@ var init_anthropicUsageRefresh = __esm({
 });
 
 // src/usage/providerQuota.ts
-import { z as z21 } from "zod";
+import { z as z22 } from "zod";
 var MS_PER_SECOND7, SECONDS_PER_HOUR, HOURS_PER_DAY3, DAYS_PER_MONTH, ZAI_HOST, ZAI_QUOTA_URL, ZAI_UNIT_HOURS, ZAI_UNIT_MONTHS, ZAI_UNIT_MS, ZaiLimitSchema, ZaiResponseSchema, OPENROUTER_HOST, OPENROUTER_KEY_URL, OPENROUTER_CREDITS_URL, MS_PER_DAY3, OpenRouterKeySchema, OpenRouterCreditsSchema;
 var init_providerQuota = __esm({
   "src/usage/providerQuota.ts"() {
@@ -7553,35 +7687,35 @@ var init_providerQuota = __esm({
       [ZAI_UNIT_HOURS, SECONDS_PER_HOUR * MS_PER_SECOND7],
       [ZAI_UNIT_MONTHS, DAYS_PER_MONTH * HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND7]
     ]);
-    ZaiLimitSchema = z21.object({
-      type: z21.string(),
-      unit: z21.number().int(),
-      number: z21.number().int().positive(),
-      percentage: z21.number().nonnegative(),
-      nextResetTime: z21.number().positive().optional(),
-      usage: z21.number().nonnegative().optional(),
-      currentValue: z21.number().nonnegative().optional(),
-      remaining: z21.number().nonnegative().optional()
+    ZaiLimitSchema = z22.object({
+      type: z22.string(),
+      unit: z22.number().int(),
+      number: z22.number().int().positive(),
+      percentage: z22.number().nonnegative(),
+      nextResetTime: z22.number().positive().optional(),
+      usage: z22.number().nonnegative().optional(),
+      currentValue: z22.number().nonnegative().optional(),
+      remaining: z22.number().nonnegative().optional()
     });
-    ZaiResponseSchema = z21.object({
-      success: z21.boolean(),
-      msg: z21.string().optional(),
-      data: z21.object({ level: z21.string().optional(), limits: z21.array(ZaiLimitSchema) })
+    ZaiResponseSchema = z22.object({
+      success: z22.boolean(),
+      msg: z22.string().optional(),
+      data: z22.object({ level: z22.string().optional(), limits: z22.array(ZaiLimitSchema) })
     });
     OPENROUTER_HOST = "openrouter.ai";
     OPENROUTER_KEY_URL = `https://${OPENROUTER_HOST}/api/v1/key`;
     OPENROUTER_CREDITS_URL = `https://${OPENROUTER_HOST}/api/v1/credits`;
     MS_PER_DAY3 = HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND7;
-    OpenRouterKeySchema = z21.object({
-      data: z21.object({
-        limit: z21.number().nonnegative().nullable(),
-        limit_remaining: z21.number().nullable(),
-        limit_reset: z21.string().nullable(),
-        is_free_tier: z21.boolean().optional(),
-        free_model_daily_requests: z21.object({ used: z21.number().nonnegative(), limit: z21.number().nonnegative(), remaining: z21.number() }).optional()
+    OpenRouterKeySchema = z22.object({
+      data: z22.object({
+        limit: z22.number().nonnegative().nullable(),
+        limit_remaining: z22.number().nullable(),
+        limit_reset: z22.string().nullable(),
+        is_free_tier: z22.boolean().optional(),
+        free_model_daily_requests: z22.object({ used: z22.number().nonnegative(), limit: z22.number().nonnegative(), remaining: z22.number() }).optional()
       })
     });
-    OpenRouterCreditsSchema = z21.object({ data: z21.object({ total_credits: z21.number().nonnegative(), total_usage: z21.number().nonnegative() }) });
+    OpenRouterCreditsSchema = z22.object({ data: z22.object({ total_credits: z22.number().nonnegative(), total_usage: z22.number().nonnegative() }) });
   }
 });
 
@@ -8197,8 +8331,8 @@ function parseConnectTarget(authority) {
 function isInterceptedHost(host, interceptHosts) {
   return interceptHosts.includes(host);
 }
-function servedByPipeline(path35) {
-  return path35?.startsWith(ROUTED_PATH_PREFIX) === true;
+function servedByPipeline(path36) {
+  return path36?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
   "connection",
@@ -8732,11 +8866,11 @@ function createRcSessionTracker(deps) {
   };
   const observeExchange = (request4) => {
     const method = (request4.method ?? "").toUpperCase();
-    const path35 = new URL(request4.url ?? "/", "http://127.0.0.1").pathname;
-    if (!path35.startsWith(RC_SESSIONS_PATH_PREFIX)) {
+    const path36 = new URL(request4.url ?? "/", "http://127.0.0.1").pathname;
+    if (!path36.startsWith(RC_SESSIONS_PATH_PREFIX)) {
       return void 0;
     }
-    const tail = path35.slice(RC_SESSIONS_PATH_PREFIX.length);
+    const tail = path36.slice(RC_SESSIONS_PATH_PREFIX.length);
     const facts = {
       oauthAuthorization: oauthAuthorizationOf(request4.headers),
       anthropicVersion: singleHeader(request4.headers, "anthropic-version"),
@@ -9118,8 +9252,8 @@ var RC_READ_FILE_ENCODINGS = ["utf-8", "base64"];
 function isRcReadFileEncoding(value) {
   return RC_READ_FILE_ENCODINGS.some((encoding) => encoding === value);
 }
-function buildRcReadFilePayload(requestId, path35, options) {
-  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path35, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
+function buildRcReadFilePayload(requestId, path36, options) {
+  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path36, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
 }
 function buildRcFileSuggestionsPayload(requestId, query) {
   return buildRcControlRequestPayload(requestId, { subtype: "file_suggestions", query });
@@ -9221,15 +9355,15 @@ async function getRcSessionContextUsage(deps, sessionId, detail) {
   const result = await deliverRcClientPayload(deps, sessionId, buildRcGetContextUsagePayload(requestId, detail), `request the context usage of session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
-async function readRcSessionFile(deps, sessionId, path35, options) {
-  if (path35 === "") {
+async function readRcSessionFile(deps, sessionId, path36, options) {
+  if (path36 === "") {
     return { ok: false, message: "a read-file write needs a non-empty path: the SDK's own field names the file the worker resolves against the session's cwd, and an empty string names none" };
   }
   if (options?.maxBytes !== void 0 && (!Number.isInteger(options.maxBytes) || options.maxBytes <= 0)) {
     return { ok: false, message: "a read-file write's max-bytes is a positive whole number of bytes: the SDK's own field caps the read, and a zero or negative cap reads nothing" };
   }
   const requestId = deps.newUuid();
-  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path35, options), `read ${path35} from session ${sessionId}`);
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path36, options), `read ${path36} from session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
 async function suggestRcSessionFiles(deps, sessionId, query) {
@@ -9398,11 +9532,11 @@ function createRcControlHandler(deps) {
       path: "read-file",
       read: (body) => {
         const session = bodyString(body, "session");
-        const path35 = bodyString(body, "path");
+        const path36 = bodyString(body, "path");
         const maxBytes = "maxBytes" in body ? bodyPositiveInteger(body, "maxBytes") : void 0;
         const encoding = "encoding" in body && isRcReadFileEncoding(body.encoding) ? body.encoding : void 0;
-        const refused2 = session === void 0 || path35 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
-        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path35, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
+        const refused2 = session === void 0 || path36 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
+        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path36, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
       }
     },
     {
@@ -9712,9 +9846,9 @@ function requestIdOfBody(body) {
 }
 function frontDoorRcControl(transport, token) {
   const headers = { authorization: `Bearer ${token}` };
-  const listAnswerOf = async (path35, what) => {
+  const listAnswerOf = async (path36, what) => {
     try {
-      return await transport.request({ method: "GET", path: path35, headers });
+      return await transport.request({ method: "GET", path: path36, headers });
     } catch (error) {
       throw new Error(`${what}: could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
     }
@@ -9786,10 +9920,10 @@ function frontDoorRcControl(transport, token) {
     }
     return pending;
   };
-  const writeOf = async (path35, body, describeFailure) => {
+  const writeOf = async (path36, body, describeFailure) => {
     let answer;
     try {
-      answer = await transport.request({ method: "POST", path: path35, headers: { ...headers, "content-type": "application/json" }, body });
+      answer = await transport.request({ method: "POST", path: path36, headers: { ...headers, "content-type": "application/json" }, body });
     } catch (error) {
       return { ok: false, message: `could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}` };
     }
@@ -9820,10 +9954,10 @@ function frontDoorRcControl(transport, token) {
     endSession: async (sessionId, reason) => await writeOf(`${CONTROL_PATH_PREFIX}/end-session`, JSON.stringify({ session: sessionId, ...reason === void 0 ? {} : { reason } }), (status, message) => `ending ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getUsage: async (sessionId, skipBehaviors) => await writeOf(`${CONTROL_PATH_PREFIX}/get-usage`, JSON.stringify({ session: sessionId, ...skipBehaviors === void 0 ? {} : { skipBehaviors } }), (status, message) => `requesting the usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getContextUsage: async (sessionId, detail) => await writeOf(`${CONTROL_PATH_PREFIX}/get-context-usage`, JSON.stringify({ session: sessionId, ...detail === void 0 ? {} : { detail } }), (status, message) => `requesting the context usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
-    readFile: async (sessionId, path35, options) => await writeOf(
+    readFile: async (sessionId, path36, options) => await writeOf(
       `${CONTROL_PATH_PREFIX}/read-file`,
-      JSON.stringify({ session: sessionId, path: path35, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
-      (status, message) => `reading ${path35} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
+      JSON.stringify({ session: sessionId, path: path36, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
+      (status, message) => `reading ${path36} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
     ),
     fileSuggestions: async (sessionId, query) => await writeOf(`${CONTROL_PATH_PREFIX}/file-suggestions`, JSON.stringify({ session: sessionId, query }), (status, message) => `requesting file suggestions from ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     keepAlive: async (sessionId) => await writeOf(`${CONTROL_PATH_PREFIX}/keep-alive`, JSON.stringify({ session: sessionId }), (status, message) => `keeping ${sessionId} alive failed (HTTP ${String(status)}): ${message}`),
@@ -9982,12 +10116,12 @@ function tlsFacts(options) {
 }
 function realRcEventDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const post = async (path35, headers, body) => await new Promise((resolve, reject) => {
+  const post = async (path36, headers, body) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method: "POST",
-      path: path35,
+      path: path36,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, "content-length": String(Buffer.byteLength(body, "utf8")) },
       agent
@@ -10052,12 +10186,12 @@ function lateRcStreamDial(resolve) {
 }
 function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const request4 = async (method, path35, headers, body, signal) => await new Promise((resolve, reject) => {
+  const request4 = async (method, path36, headers, body, signal) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method,
-      path: path35,
+      path: path36,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, ...body === void 0 ? {} : { "content-length": String(Buffer.byteLength(body, "utf8")) } },
       agent,
@@ -10099,9 +10233,9 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
       return { status, body: await readAll(response) };
     },
     openStream: async (sessionId, headers, resume, signal) => {
-      const path35 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
+      const path36 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
       const streamHeaders = resume === void 0 ? headers : { ...headers, "last-event-id": String(resume.fromSequenceNum) };
-      const { status, response } = await request4("GET", path35, streamHeaders, void 0, signal);
+      const { status, response } = await request4("GET", path36, streamHeaders, void 0, signal);
       if (!isSuccessful2(status)) {
         await readAll(response);
         return { status, chunks: NO_CHUNKS };
@@ -10397,7 +10531,7 @@ function createRcCredentialStore(fs12, dir) {
 init_package();
 import { createORPCClient, ORPCError } from "@orpc/client";
 import { RPCLink } from "@orpc/client/fetch";
-import { OpenAPIGenerator } from "@orpc/openapi";
+import { openapi, OpenAPIGenerator } from "@orpc/openapi";
 import { OpenAPIHandler } from "@orpc/openapi/node";
 import { eventIterator, os as os2, withEventMeta } from "@orpc/server";
 import { BodyLimitPlugin, RPCHandler } from "@orpc/server/node";
@@ -10601,41 +10735,41 @@ function createRcApiRouter(deps) {
   };
   return {
     rc: {
-      list: authed.route({ method: "GET", path: "/rest/rc/sessions", summary: "List the observed Remote Control sessions", tags: [RC_API_TAG] }).output(RcListOutputSchema).handler(() => ({ sessions: deps.list() })),
-      status: authed.route({ method: "GET", path: "/rest/rc/status", summary: "Read session status, one session's when named", tags: [RC_API_TAG] }).input(RcSessionQuerySchema).output(RcStatusOutputSchema).handler(({ input }) => {
+      list: authed.meta(openapi({ method: "GET", path: "/rest/rc/sessions", summary: "List the observed Remote Control sessions", tags: [RC_API_TAG] })).output(RcListOutputSchema).handler(() => ({ sessions: deps.list() })),
+      status: authed.meta(openapi({ method: "GET", path: "/rest/rc/status", summary: "Read session status, one session's when named", tags: [RC_API_TAG] })).input(RcSessionQuerySchema).output(RcStatusOutputSchema).handler(({ input }) => {
         const statuses = deps.statusOf(input.session);
         if (input.session !== void 0 && !statuses.some((entry) => entry.id === input.session)) {
           throw new ORPCError("NOT_FOUND", { message: rcSessionNotObservedMessage(input.session) });
         }
         return { statuses };
       }),
-      pending: authed.route({ method: "GET", path: "/rest/rc/pending", summary: "Read the control requests awaiting an answer", tags: [RC_API_TAG] }).input(RcSessionQuerySchema).output(RcPendingOutputSchema).handler(({ input }) => {
+      pending: authed.meta(openapi({ method: "GET", path: "/rest/rc/pending", summary: "Read the control requests awaiting an answer", tags: [RC_API_TAG] })).input(RcSessionQuerySchema).output(RcPendingOutputSchema).handler(({ input }) => {
         const pending = deps.pendingOf(input.session);
         if (input.session !== void 0 && deps.statusOf(input.session).length === 0) {
           throw new ORPCError("NOT_FOUND", { message: rcSessionNotObservedMessage(input.session) });
         }
         return { pending };
       }),
-      send: authed.route({ method: "POST", path: "/rest/rc/send", summary: "Send one message into a session", tags: [RC_API_TAG] }).input(RcSendInputSchema).output(RcWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, sequenceNums: delivered(input.session, await deps.inject(input.session, input.text)) })),
-      answer: authed.route({ method: "POST", path: "/rest/rc/answer", summary: "Answer one pending control request", tags: [RC_API_TAG] }).input(RcAnswerInputSchema).output(RcAnswerOutputSchema).handler(async ({ input }) => {
+      send: authed.meta(openapi({ method: "POST", path: "/rest/rc/send", summary: "Send one message into a session", tags: [RC_API_TAG] })).input(RcSendInputSchema).output(RcWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, sequenceNums: delivered(input.session, await deps.inject(input.session, input.text)) })),
+      answer: authed.meta(openapi({ method: "POST", path: "/rest/rc/answer", summary: "Answer one pending control request", tags: [RC_API_TAG] })).input(RcAnswerInputSchema).output(RcAnswerOutputSchema).handler(async ({ input }) => {
         const decision = { approve: input.approve, message: input.approve || input.text === void 0 ? void 0 : input.text };
         return { session: input.session, request: input.request, sequenceNums: delivered(input.session, await deps.answer(input.session, input.request, decision)) };
       }),
-      interrupt: authed.route({ method: "POST", path: "/rest/rc/interrupt", summary: "Interrupt a session's running turn", tags: [RC_API_TAG] }).input(RcInterruptInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.interrupt(input.session)) })),
-      setModel: authed.route({ method: "POST", path: "/rest/rc/set-model", summary: "Switch a session's model", tags: [RC_API_TAG] }).input(RcSetModelInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.setModel(input.session, input.model)) })),
-      setPermissionMode: authed.route({ method: "POST", path: "/rest/rc/set-permission-mode", summary: "Switch a session's permission mode", tags: [RC_API_TAG] }).input(RcSetPermissionModeInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.setPermissionMode(input.session, input.mode)) })),
-      endSession: authed.route({ method: "POST", path: "/rest/rc/end-session", summary: "End a session", tags: [RC_API_TAG] }).input(RcEndSessionInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.endSession(input.session, input.reason)) })),
-      getUsage: authed.route({ method: "POST", path: "/rest/rc/get-usage", summary: "Ask a session for its usage snapshot", tags: [RC_API_TAG] }).input(RcGetUsageInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.getUsage(input.session, input.skipBehaviors)) })),
-      getContextUsage: authed.route({ method: "POST", path: "/rest/rc/get-context-usage", summary: "Ask a session for its context usage", tags: [RC_API_TAG] }).input(RcGetContextUsageInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.getContextUsage(input.session, input.detail)) })),
-      readFile: authed.route({ method: "POST", path: "/rest/rc/read-file", summary: "Ask a session to read one file", tags: [RC_API_TAG] }).input(RcReadFileInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.readFile(input.session, input.path, { ...input.maxBytes === void 0 ? {} : { maxBytes: input.maxBytes }, ...input.encoding === void 0 ? {} : { encoding: input.encoding } })) })),
-      fileSuggestions: authed.route({ method: "POST", path: "/rest/rc/file-suggestions", summary: "Ask a session for file-path suggestions", tags: [RC_API_TAG] }).input(RcFileSuggestionsInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.fileSuggestions(input.session, input.query)) })),
-      keepAlive: authed.route({ method: "POST", path: "/rest/rc/keep-alive", summary: "Keep a session's bridge alive", tags: [RC_API_TAG] }).input(RcKeepAliveInputSchema).output(RcWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, sequenceNums: delivered(input.session, await deps.keepAlive(input.session)) })),
-      mcpStatus: authed.route({ method: "POST", path: "/rest/rc/mcp-status", summary: "Ask a session for its MCP servers' status", tags: [RC_API_TAG] }).input(RcMcpStatusInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpStatus(input.session)) })),
-      mcpReconnect: authed.route({ method: "POST", path: "/rest/rc/mcp-reconnect", summary: "Ask a session to reconnect one MCP server", tags: [RC_API_TAG] }).input(RcMcpReconnectInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpReconnect(input.session, input.serverName)) })),
-      mcpAuthenticate: authed.route({ method: "POST", path: "/rest/rc/mcp-authenticate", summary: "Start OAuth for one MCP server on a session", tags: [RC_API_TAG] }).input(RcMcpAuthenticateInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpAuthenticate(input.session, input.serverName, input.redirectUri)) })),
-      mcpOAuthCallbackUrl: authed.route({ method: "POST", path: "/rest/rc/mcp-oauth-callback-url", summary: "Hand a completed MCP OAuth callback to a session", tags: [RC_API_TAG] }).input(RcMcpOAuthCallbackUrlInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpOAuthCallbackUrl(input.session, input.serverName, input.callbackUrl)) })),
-      teleport: authed.route({ method: "POST", path: "/rest/rc/teleport", summary: "Teleport a session to a conversation marker", tags: [RC_API_TAG] }).input(RcTeleportInputSchema).output(RcWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, sequenceNums: delivered(input.session, await deps.teleport(input.session, input.marker)) })),
-      subscribe: authed.route({ method: "GET", path: "/rest/rc/events", summary: "Stream a session's Remote Control events (SSE)", tags: [RC_API_TAG] }).input(RcSessionQuerySchema).output(eventIterator(RcStreamEventSchema)).handler(async function* ({ input, signal }) {
+      interrupt: authed.meta(openapi({ method: "POST", path: "/rest/rc/interrupt", summary: "Interrupt a session's running turn", tags: [RC_API_TAG] })).input(RcInterruptInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.interrupt(input.session)) })),
+      setModel: authed.meta(openapi({ method: "POST", path: "/rest/rc/set-model", summary: "Switch a session's model", tags: [RC_API_TAG] })).input(RcSetModelInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.setModel(input.session, input.model)) })),
+      setPermissionMode: authed.meta(openapi({ method: "POST", path: "/rest/rc/set-permission-mode", summary: "Switch a session's permission mode", tags: [RC_API_TAG] })).input(RcSetPermissionModeInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.setPermissionMode(input.session, input.mode)) })),
+      endSession: authed.meta(openapi({ method: "POST", path: "/rest/rc/end-session", summary: "End a session", tags: [RC_API_TAG] })).input(RcEndSessionInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.endSession(input.session, input.reason)) })),
+      getUsage: authed.meta(openapi({ method: "POST", path: "/rest/rc/get-usage", summary: "Ask a session for its usage snapshot", tags: [RC_API_TAG] })).input(RcGetUsageInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.getUsage(input.session, input.skipBehaviors)) })),
+      getContextUsage: authed.meta(openapi({ method: "POST", path: "/rest/rc/get-context-usage", summary: "Ask a session for its context usage", tags: [RC_API_TAG] })).input(RcGetContextUsageInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.getContextUsage(input.session, input.detail)) })),
+      readFile: authed.meta(openapi({ method: "POST", path: "/rest/rc/read-file", summary: "Ask a session to read one file", tags: [RC_API_TAG] })).input(RcReadFileInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.readFile(input.session, input.path, { ...input.maxBytes === void 0 ? {} : { maxBytes: input.maxBytes }, ...input.encoding === void 0 ? {} : { encoding: input.encoding } })) })),
+      fileSuggestions: authed.meta(openapi({ method: "POST", path: "/rest/rc/file-suggestions", summary: "Ask a session for file-path suggestions", tags: [RC_API_TAG] })).input(RcFileSuggestionsInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.fileSuggestions(input.session, input.query)) })),
+      keepAlive: authed.meta(openapi({ method: "POST", path: "/rest/rc/keep-alive", summary: "Keep a session's bridge alive", tags: [RC_API_TAG] })).input(RcKeepAliveInputSchema).output(RcWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, sequenceNums: delivered(input.session, await deps.keepAlive(input.session)) })),
+      mcpStatus: authed.meta(openapi({ method: "POST", path: "/rest/rc/mcp-status", summary: "Ask a session for its MCP servers' status", tags: [RC_API_TAG] })).input(RcMcpStatusInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpStatus(input.session)) })),
+      mcpReconnect: authed.meta(openapi({ method: "POST", path: "/rest/rc/mcp-reconnect", summary: "Ask a session to reconnect one MCP server", tags: [RC_API_TAG] })).input(RcMcpReconnectInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpReconnect(input.session, input.serverName)) })),
+      mcpAuthenticate: authed.meta(openapi({ method: "POST", path: "/rest/rc/mcp-authenticate", summary: "Start OAuth for one MCP server on a session", tags: [RC_API_TAG] })).input(RcMcpAuthenticateInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpAuthenticate(input.session, input.serverName, input.redirectUri)) })),
+      mcpOAuthCallbackUrl: authed.meta(openapi({ method: "POST", path: "/rest/rc/mcp-oauth-callback-url", summary: "Hand a completed MCP OAuth callback to a session", tags: [RC_API_TAG] })).input(RcMcpOAuthCallbackUrlInputSchema).output(RcControlWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, ...deliveredControl(input.session, await deps.mcpOAuthCallbackUrl(input.session, input.serverName, input.callbackUrl)) })),
+      teleport: authed.meta(openapi({ method: "POST", path: "/rest/rc/teleport", summary: "Teleport a session to a conversation marker", tags: [RC_API_TAG] })).input(RcTeleportInputSchema).output(RcWriteOutputSchema).handler(async ({ input }) => ({ session: input.session, sequenceNums: delivered(input.session, await deps.teleport(input.session, input.marker)) })),
+      subscribe: authed.meta(openapi({ method: "GET", path: "/rest/rc/events", summary: "Stream a session's Remote Control events (SSE)", tags: [RC_API_TAG] })).input(RcSessionQuerySchema).output(eventIterator(RcStreamEventSchema)).handler(async function* ({ input, signal }) {
         const queue = [];
         let wake;
         const detach = deps.fanout.subscribe(input.session, (event) => {
@@ -10677,7 +10811,7 @@ function doorApiNodeHandlerOf(router, expectedToken) {
   const rpcHandler = new RPCHandler(router, { plugins });
   const restHandler = new OpenAPIHandler(router, { plugins });
   let document;
-  const documentOf = async () => document ??= new OpenAPIGenerator().generate(router, { info: { title: "agent-shim front door API", version: package_default.version } });
+  const documentOf = async () => document ??= new OpenAPIGenerator().generate(router, { base: { info: { title: "agent-shim front door API", version: package_default.version } } });
   return {
     pathPrefix: RC_ORPC_PATH_PREFIX,
     handle: async (request4, response) => {
@@ -10700,11 +10834,15 @@ function doorApiNodeHandlerOf(router, expectedToken) {
         }
         return { matched: true };
       }
-      const rest = await restHandler.handle(request4, response, { context: { headers: request4.headers }, prefix: RC_ORPC_PATH_PREFIX });
+      const rest = await restHandler.handle(request4, response, { context: { headers: request4.headers, afterResponse: (action) => {
+        response.once("finish", action);
+      } }, prefix: RC_ORPC_PATH_PREFIX });
       if (rest.matched) {
         return rest;
       }
-      return await rpcHandler.handle(request4, response, { context: { headers: request4.headers }, prefix: RC_ORPC_PATH_PREFIX });
+      return await rpcHandler.handle(request4, response, { context: { headers: request4.headers, afterResponse: (action) => {
+        response.once("finish", action);
+      } }, prefix: RC_ORPC_PATH_PREFIX });
     }
   };
 }
@@ -10714,10 +10852,12 @@ function createRcApiNodeHandler(deps) {
 function frontDoorApiLink(port, ca, token) {
   const dispatcher = new Agent3({ connect: { ca } });
   return new RPCLink({
-    url: `https://127.0.0.1:${String(port)}${RC_ORPC_PATH_PREFIX}`,
+    origin: `https://127.0.0.1:${String(port)}`,
+    url: RC_ORPC_PATH_PREFIX,
     headers: { authorization: `Bearer ${token}` },
     // undici's own Request and Response types and the global ones are distinct declarations of the same standard shapes (the package's bundled types sit beside @types/node's own), and its fetch refuses the global Request instance outright, so the call is rebuilt from the request's parts and the answer re-wrapped through the global constructors, never cast between the two. The request body is one bounded JSON object (the same protocol cap the handler enforces), so reading it whole costs nothing; it is the answer that streams.
-    fetch: async (request4, _init, options) => {
+    fetch: async (url, init, options) => {
+      const request4 = new Request(url, init);
       const body = request4.body === null ? void 0 : Buffer.from(await request4.arrayBuffer());
       const answered = await undiciFetch(request4.url, {
         method: request4.method,
@@ -10739,7 +10879,8 @@ init_cliError();
 init_realPorts();
 
 // src/frontdoor/controlApi.ts
-import { createORPCClient as createORPCClient2, ORPCError as ORPCError3 } from "@orpc/client";
+import { createORPCClient as createORPCClient2, ORPCError as ORPCError5 } from "@orpc/client";
+import { openapi as openapi6 } from "@orpc/openapi";
 
 // src/checkReport.ts
 init_classify();
@@ -10966,19 +11107,19 @@ function writePools(paths, pools) {
   applyPatch(paths.globalConfigFile, GlobalConfigSchema, { pools }, { defaults: {} });
 }
 function poolCycleOf(pools, name) {
-  const walk = (current, path35) => {
+  const walk = (current, path36) => {
     for (const entry of pools[current]?.identities ?? []) {
       const nested = poolNameOf(poolMemberIdentity(entry));
       if (nested === void 0) {
         continue;
       }
       if (nested === name) {
-        return [...path35, nested];
+        return [...path36, nested];
       }
-      if (path35.includes(nested)) {
+      if (path36.includes(nested)) {
         continue;
       }
-      const found = walk(nested, [...path35, nested]);
+      const found = walk(nested, [...path36, nested]);
       if (found !== void 0) {
         return found;
       }
@@ -12549,9 +12690,48 @@ var DoctorRunOutputSchema = z19.strictObject({
   ok: z19.boolean(),
   findings: z19.readonly(z19.array(DoctorFindingSchema))
 });
+var FrontDoorRestartOutputSchema = z19.strictObject({
+  action: z19.literal("restarting"),
+  previousPid: z19.int().positive()
+});
+var UpdateCheckOutputSchema = z19.strictObject({
+  current: z19.string(),
+  latest: z19.string(),
+  action: z19.enum(["current", "available", "updated"])
+});
+var CodexSignInSchema = z19.discriminatedUnion("state", [
+  z19.strictObject({ state: z19.literal("none") }),
+  z19.strictObject({ state: z19.literal("signed-in"), email: z19.string().optional(), planScope: z19.boolean(), accessTokenExpiresAt: z19.number() }),
+  z19.strictObject({ state: z19.literal("unreadable"), message: z19.string() })
+]);
+var CodexStatusOutputSchema = z19.strictObject({
+  signIn: CodexSignInSchema,
+  codexProviders: z19.readonly(z19.array(z19.string()))
+});
+var CodexLogoutOutputSchema = z19.strictObject({
+  hadGrant: z19.boolean(),
+  revoked: z19.boolean()
+});
+
+// src/frontdoor/codexApi.ts
+import { openapi as openapi2 } from "@orpc/openapi";
+var CODEX_API_TAG = "codex";
+function createCodexApiRouter(deps) {
+  const authed = doorApiAuth(deps.expectedToken);
+  return {
+    codex: {
+      status: authed.meta(openapi2({ method: "GET", path: "/rest/codex/status", summary: "Read the Codex sign-in and the codex providers", tags: [CODEX_API_TAG] })).output(CodexStatusOutputSchema).handler(() => {
+        const status = deps.codexStatus();
+        return { signIn: status.signIn, codexProviders: status.codexProviders };
+      }),
+      logout: authed.meta(openapi2({ method: "POST", path: "/rest/codex/logout", summary: "Revoke the Sign in with ChatGPT login and remove it", tags: [CODEX_API_TAG] })).output(CodexLogoutOutputSchema).handler(async () => await deps.codexLogout())
+    }
+  };
+}
 
 // src/frontdoor/eventsApi.ts
 import { ORPCError as ORPCError2 } from "@orpc/client";
+import { openapi as openapi3 } from "@orpc/openapi";
 import { eventIterator as eventIterator2, withEventMeta as withEventMeta2 } from "@orpc/server";
 
 // src/frontdoor/eventSchemas.ts
@@ -12598,7 +12778,7 @@ function createEventsApiRouter(deps) {
   const authed = doorApiAuth(deps.expectedToken);
   return {
     events: {
-      subscribe: authed.route({ method: "GET", path: "/rest/events", summary: "Stream the door's every event source (SSE)", tags: [EVENTS_API_TAG] }).input(DoorEventSourceQuerySchema).output(eventIterator2(DoorEventSchema)).handler(async function* ({ input, signal }) {
+      subscribe: authed.meta(openapi3({ method: "GET", path: "/rest/events", summary: "Stream the door's every event source (SSE)", tags: [EVENTS_API_TAG] })).input(DoorEventSourceQuerySchema).output(eventIterator2(DoorEventSchema)).handler(async function* ({ input, signal }) {
         if (input.sources !== void 0) {
           const live = deps.events.sources();
           const unknown = input.sources.filter((source) => !live.includes(source));
@@ -12630,9 +12810,120 @@ function createEventsApiRouter(deps) {
   };
 }
 
+// src/frontdoor/lifecycleApi.ts
+init_update();
+import { ORPCError as ORPCError3 } from "@orpc/client";
+import { openapi as openapi4 } from "@orpc/openapi";
+var FRONTDOOR_API_TAG = "frontdoor";
+var UPDATE_API_TAG = "update";
+function createLifecycleApiRouter(deps) {
+  const authed = doorApiAuth(deps.expectedToken);
+  return {
+    frontdoor: {
+      restart: authed.meta(openapi4({ method: "POST", path: "/rest/frontdoor/restart", summary: "Replace the serving front door in place", description: "Answers with the pid of the door being replaced, then replaces it. The replacement is a new generation with its own control token: the caller reopens its client from the state root once the door's supervisor pid differs from the one returned.", tags: [FRONTDOOR_API_TAG] })).output(FrontDoorRestartOutputSchema).handler(({ context }) => {
+        context.afterResponse(deps.restartDoor);
+        return { action: "restarting", previousPid: deps.doorPid };
+      })
+    },
+    update: {
+      check: authed.meta(openapi4({ method: "GET", path: "/rest/update/check", summary: "Check whether a newer release exists", tags: [UPDATE_API_TAG] })).output(UpdateCheckOutputSchema).handler(async () => {
+        try {
+          return await deps.checkForUpdate();
+        } catch (error) {
+          if (error instanceof UpdateChannelError) {
+            throw new ORPCError3("PRECONDITION_FAILED", { message: error.message });
+          }
+          if (error instanceof UpdateConflictError) {
+            throw new ORPCError3("CONFLICT", { message: error.message });
+          }
+          if (error instanceof UpdateDownloadError) {
+            throw new ORPCError3("BAD_GATEWAY", { message: error.message });
+          }
+          throw error;
+        }
+      })
+    }
+  };
+}
+
+// src/frontdoor/launchApi.ts
+init_cliError();
+import { ORPCError as ORPCError4 } from "@orpc/client";
+import { openapi as openapi5 } from "@orpc/openapi";
+
+// src/frontdoor/launchSchemas.ts
+import path30 from "node:path";
+import { z as z21 } from "zod";
+init_claudeVersion();
+init_identity();
+var LaunchResolveInputSchema = z21.strictObject({
+  path: z21.string().min(1),
+  /** `@name`, launch flags, then the arguments for `claude`; empty for a bare launch. */
+  argv: z21.readonly(z21.array(z21.string())).optional(),
+  /** The launch's inherited environment. Absent means an empty one: the door's own environment is never a substitute for the caller's, so a caller that wants `AGENT_SHIM_*` switches or a `CLAUDE_CONFIG_DIR` considered names them here. Values are read, never reported. */
+  env: z21.record(z21.string(), z21.string()).optional()
+}).refine((input) => path30.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+var LaunchPoolDecisionSchema = z21.strictObject({
+  name: z21.string(),
+  reasons: z21.readonly(z21.array(z21.string())),
+  movedOff: z21.strictObject({ identity: z21.string(), reason: z21.string() }).optional()
+});
+var LaunchDecisionSchema = z21.strictObject({
+  identity: z21.string().optional(),
+  identitySource: z21.enum(IDENTITY_DECISION_SOURCES),
+  pool: LaunchPoolDecisionSchema.optional(),
+  configDirEscapeHatch: z21.boolean(),
+  configDir: z21.string().optional(),
+  configProfile: z21.string().optional(),
+  configProfileSource: z21.enum(CONFIG_PROFILE_DECISION_SOURCES),
+  provider: z21.string().optional()
+});
+var LaunchFlagsSchema = z21.strictObject({
+  skipPermissions: z21.boolean(),
+  remoteControl: z21.boolean(),
+  headroom: z21.boolean(),
+  trackUsage: z21.boolean()
+});
+var LaunchResolveOutputSchema = z21.strictObject({
+  decision: LaunchDecisionSchema,
+  flags: LaunchFlagsSchema,
+  claudeVersion: z21.strictObject({ version: z21.string(), source: z21.enum(CLAUDE_VERSION_SOURCES) }).optional(),
+  /** The real `claude` binary the launch would spawn, on the door's host. */
+  bin: z21.string(),
+  /** The arguments the launch would pass it: the tool's own flags, then `CLAUDE_EXTRA_FLAGS`, then the caller's own. */
+  args: z21.readonly(z21.array(z21.string())),
+  /** The credential the launch would authenticate with, by target and source kinds. Absent when none applies. */
+  credential: z21.strictObject({ subject: z21.enum(["provider", "identity"]), name: z21.string(), summary: CredentialSummarySchema }).optional(),
+  routing: z21.strictObject({ frontDoor: z21.boolean(), headroom: z21.boolean() }),
+  /** The names of the environment variables the launch would set or unset, sorted. Values are not reported. */
+  environment: z21.readonly(z21.array(z21.string())),
+  warnings: z21.readonly(z21.array(z21.string()))
+});
+
+// src/frontdoor/launchApi.ts
+var LAUNCH_API_TAG = "launch";
+function createLaunchApiRouter(deps) {
+  const authed = doorApiAuth(deps.expectedToken);
+  return {
+    launch: {
+      resolve: authed.meta(openapi5({ method: "POST", path: "/rest/launch/resolve", summary: "Resolve what a launch from one directory would do, without performing it", tags: [LAUNCH_API_TAG] })).input(LaunchResolveInputSchema).output(LaunchResolveOutputSchema).handler(({ input }) => {
+        try {
+          const { resolution, warnings } = deps.resolveLaunch({ path: input.path, argv: input.argv ?? [], env: input.env ?? {} });
+          return { ...resolution, warnings };
+        } catch (error) {
+          if (error instanceof CliError) {
+            throw new ORPCError4("BAD_REQUEST", { message: error.message });
+          }
+          throw error;
+        }
+      })
+    }
+  };
+}
+
 // src/frontdoor/controlApi.ts
 var USAGE_API_TAG = "usage";
-var FRONTDOOR_API_TAG = "frontdoor";
+var FRONTDOOR_API_TAG2 = "frontdoor";
 var CHECK_API_TAG = "check";
 var DOCTOR_API_TAG = "doctor";
 var POOL_API_TAG = "pool";
@@ -12640,11 +12931,11 @@ function createControlApiRouter(deps) {
   const authed = doorApiAuth(deps.expectedToken);
   return {
     usage: {
-      list: authed.route({ method: "GET", path: "/rest/usage/snapshots", summary: "List every identity's usage snapshot", tags: [USAGE_API_TAG] }).output(UsageListOutputSchema).handler(() => ({ snapshots: deps.usageSnapshots() })),
-      effectiveWindow: authed.route({ method: "GET", path: "/rest/usage/windows", summary: "Read one identity's effective quota windows", tags: [USAGE_API_TAG] }).input(UsageWindowsInputSchema).output(UsageWindowsOutputSchema).handler(({ input }) => {
+      list: authed.meta(openapi6({ method: "GET", path: "/rest/usage/snapshots", summary: "List every identity's usage snapshot", tags: [USAGE_API_TAG] })).output(UsageListOutputSchema).handler(() => ({ snapshots: deps.usageSnapshots() })),
+      effectiveWindow: authed.meta(openapi6({ method: "GET", path: "/rest/usage/windows", summary: "Read one identity's effective quota windows", tags: [USAGE_API_TAG] })).input(UsageWindowsInputSchema).output(UsageWindowsOutputSchema).handler(({ input }) => {
         const snapshot = deps.usageSnapshotOf(input.identity);
         if (snapshot === void 0) {
-          throw new ORPCError3("NOT_FOUND", { message: `identity ${input.identity} has no usage snapshot yet, so no quota window has been observed for it` });
+          throw new ORPCError5("NOT_FOUND", { message: `identity ${input.identity} has no usage snapshot yet, so no quota window has been observed for it` });
         }
         const provider = input.provider ?? ANTHROPIC_PROVIDER;
         const rateLimit = snapshot.providers[provider]?.rateLimit;
@@ -12658,34 +12949,34 @@ function createControlApiRouter(deps) {
           ...unified?.sevenDay === void 0 ? {} : { sevenDay: effectiveWindow(unified.sevenDay, now) }
         };
       }),
-      live: authed.route({ method: "GET", path: "/rest/usage/live", summary: "Read the live rate-limit observations the event backbone files", tags: [USAGE_API_TAG] }).input(RcSessionQuerySchema).output(UsageLiveOutputSchema).handler(({ input }) => {
+      live: authed.meta(openapi6({ method: "GET", path: "/rest/usage/live", summary: "Read the live rate-limit observations the event backbone files", tags: [USAGE_API_TAG] })).input(RcSessionQuerySchema).output(UsageLiveOutputSchema).handler(({ input }) => {
         const sessions = deps.liveRateLimits(input.session);
         if (input.session !== void 0 && sessions.length === 0) {
           if (deps.list().some((session) => session.id === input.session)) {
-            throw new ORPCError3("NOT_FOUND", { message: `session ${input.session} has filed no rate_limit_event on its stream yet: the worker emits one only once a turn has completed, so retry after this session's next turn` });
+            throw new ORPCError5("NOT_FOUND", { message: `session ${input.session} has filed no rate_limit_event on its stream yet: the worker emits one only once a turn has completed, so retry after this session's next turn` });
           }
-          throw new ORPCError3("NOT_FOUND", { message: rcSessionNotObservedMessage(input.session) });
+          throw new ORPCError5("NOT_FOUND", { message: rcSessionNotObservedMessage(input.session) });
         }
         return { latest: deps.latestRateLimit(), sessions };
       })
     },
     frontdoor: {
-      status: authed.route({ method: "GET", path: "/rest/frontdoor/status", summary: "Read the front door's status", tags: [FRONTDOOR_API_TAG] }).output(FrontDoorStatusOutputSchema).handler(() => deps.frontDoorStatus()),
-      sessions: authed.route({ method: "GET", path: "/rest/frontdoor/sessions", summary: "Read the front door's session registry", tags: [FRONTDOOR_API_TAG] }).output(FrontDoorSessionsOutputSchema).handler(() => ({ sessions: deps.frontDoorStatus().sessions }))
+      status: authed.meta(openapi6({ method: "GET", path: "/rest/frontdoor/status", summary: "Read the front door's status", tags: [FRONTDOOR_API_TAG2] })).output(FrontDoorStatusOutputSchema).handler(() => deps.frontDoorStatus()),
+      sessions: authed.meta(openapi6({ method: "GET", path: "/rest/frontdoor/sessions", summary: "Read the front door's session registry", tags: [FRONTDOOR_API_TAG2] })).output(FrontDoorSessionsOutputSchema).handler(() => ({ sessions: deps.frontDoorStatus().sessions }))
     },
     check: {
       // The report's own JSON shape is the contract (the same one `check --json` prints and `checkReportSchema.ts` defines), so the procedure returns exactly that conversion.
-      run: authed.route({ method: "GET", path: "/rest/check", summary: "Run the check report for one directory", tags: [CHECK_API_TAG] }).input(CheckRunInputSchema).output(CheckReportJsonSchema).handler(({ input }) => checkReportToJson(deps.checkReport(input.path, input.identity)))
+      run: authed.meta(openapi6({ method: "GET", path: "/rest/check", summary: "Run the check report for one directory", tags: [CHECK_API_TAG] })).input(CheckRunInputSchema).output(CheckReportJsonSchema).handler(({ input }) => checkReportToJson(deps.checkReport(input.path, input.identity)))
     },
     doctor: {
-      run: authed.route({ method: "GET", path: "/rest/doctor", summary: "Run the doctor report", tags: [DOCTOR_API_TAG] }).output(DoctorRunOutputSchema).handler(() => deps.doctorReport())
+      run: authed.meta(openapi6({ method: "GET", path: "/rest/doctor", summary: "Run the doctor report", tags: [DOCTOR_API_TAG] })).output(DoctorRunOutputSchema).handler(() => deps.doctorReport())
     },
     pool: {
-      pick: authed.route({ method: "GET", path: "/rest/pool/pick", summary: "Rank one pool exactly as a launch from a directory would right now", tags: [POOL_API_TAG] }).input(PoolPickInputSchema).output(PoolPickReportSchema).handler(({ input }) => {
+      pick: authed.meta(openapi6({ method: "GET", path: "/rest/pool/pick", summary: "Rank one pool exactly as a launch from a directory would right now", tags: [POOL_API_TAG] })).input(PoolPickInputSchema).output(PoolPickReportSchema).handler(({ input }) => {
         const report = deps.poolPick(input.pool, input.path);
         if (report === void 0) {
           const live = deps.poolNames();
-          throw new ORPCError3("NOT_FOUND", {
+          throw new ORPCError5("NOT_FOUND", {
             message: live.length === 0 ? `no pools are configured, so none is named ${input.pool}` : `no pool is named ${input.pool}; the live pools are ${live.map((name) => `"${name}"`).join(", ")}`
           });
         }
@@ -12695,7 +12986,9 @@ function createControlApiRouter(deps) {
   };
 }
 function createDoorApiRouter(deps) {
-  return { ...createRcApiRouter(deps), ...createControlApiRouter(deps), ...createEventsApiRouter(deps) };
+  const control = createControlApiRouter(deps);
+  const lifecycle = createLifecycleApiRouter(deps);
+  return { ...createRcApiRouter(deps), ...control, ...lifecycle, ...createCodexApiRouter(deps), ...createLaunchApiRouter(deps), ...createEventsApiRouter(deps), frontdoor: { ...control.frontdoor, ...lifecycle.frontdoor } };
 }
 function createDoorApiNodeHandler(deps) {
   return doorApiNodeHandlerOf(createDoorApiRouter(deps), deps.expectedToken);
@@ -14656,7 +14949,7 @@ data: ${JSON.stringify(envelope)}
 
 // src/frontdoor/rcSelfHostMint.ts
 init_account();
-import path30 from "node:path";
+import path31 from "node:path";
 var CREDENTIALS_FILE = ".credentials.json";
 var CLAUDE_JSON2 = ".claude.json";
 var RC_SELF_HOST_RECORD_DIR = "rc-selfhost";
@@ -14680,7 +14973,7 @@ function readJsonObject(fs12, file) {
   return isRecord11(parsed) ? parsed : void 0;
 }
 function readRcSelfHostRecord(fs12, frontdoorDir) {
-  const parsed = readJsonObject(fs12, path30.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
+  const parsed = readJsonObject(fs12, path31.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
   if (parsed === void 0) {
     return void 0;
   }
@@ -14694,11 +14987,11 @@ function mintRcSelfHostCredential(deps) {
   if (!isIdentityName(deps.identity)) {
     throw new Error(`"${deps.identity}" is not a valid identity name.`);
   }
-  const identityDir = path30.join(deps.identitiesDir, deps.identity);
-  const credentialsFile = path30.join(identityDir, CREDENTIALS_FILE);
-  const claudeJsonFile = path30.join(identityDir, CLAUDE_JSON2);
-  const recordDir = path30.join(deps.frontdoorDir, RC_SELF_HOST_RECORD_DIR);
-  const recordFile = path30.join(recordDir, RC_SELF_HOST_RECORD_FILE);
+  const identityDir = path31.join(deps.identitiesDir, deps.identity);
+  const credentialsFile = path31.join(identityDir, CREDENTIALS_FILE);
+  const claudeJsonFile = path31.join(identityDir, CLAUDE_JSON2);
+  const recordDir = path31.join(deps.frontdoorDir, RC_SELF_HOST_RECORD_DIR);
+  const recordFile = path31.join(recordDir, RC_SELF_HOST_RECORD_FILE);
   const previousRecord = readRcSelfHostRecord(deps.fs, deps.frontdoorDir);
   const existingCredentials = readJsonObject(deps.fs, credentialsFile);
   const existingOauth = isRecord11(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
@@ -14714,7 +15007,7 @@ function mintRcSelfHostCredential(deps) {
   const organizationUuid = deps.newUuid();
   const accountUuid = deps.newUuid();
   const mintedAt = new Date(deps.now()).toISOString();
-  deps.fs.mkdirPrivate(path30.dirname(credentialsFile));
+  deps.fs.mkdirPrivate(path31.dirname(credentialsFile));
   deps.fs.writeFilePrivate(credentialsFile, `${JSON.stringify({ ...existingCredentials, claudeAiOauth: { accessToken, refreshToken, expiresAt: null, scopes: [...RC_SELF_HOST_SCOPE_LIST], subscriptionType: SELF_HOST_SUBSCRIPTION_TYPE, rateLimitTier: null } }, null, 2)}
 `);
   const claudeJson = readJsonObject(deps.fs, claudeJsonFile) ?? {};
@@ -14968,6 +15261,9 @@ export {
   CheckReportJsonSchema,
   CheckRunInputSchema,
   CliError,
+  CodexLogoutOutputSchema,
+  CodexSignInSchema,
+  CodexStatusOutputSchema,
   ConfigProfileSchema,
   CredentialCacheSchema,
   CredentialSchema,
@@ -14992,6 +15288,7 @@ export {
   FARM_MANIFEST_FILENAME,
   FrontDoorControlMaterialError,
   FrontDoorNotServingError,
+  FrontDoorRestartOutputSchema,
   FrontDoorSessionStatusSchema,
   FrontDoorSessionsOutputSchema,
   FrontDoorStartError,
@@ -15009,6 +15306,8 @@ export {
   LAUNCH_EVENT_SOURCE,
   LaunchLifecycleEventSchema,
   LaunchRefusedError,
+  LaunchResolveInputSchema,
+  LaunchResolveOutputSchema,
   LegacyProviderFileError,
   OWN_CLI_FILE_NAME,
   PROMPT_CACHE_TTL_MS,
@@ -15055,6 +15354,7 @@ export {
   RcStreamEnvelopeSchema,
   RcStreamEventSchema,
   USAGE_EVENT_SOURCE,
+  UpdateCheckOutputSchema,
   UsageError,
   UsageListOutputSchema,
   UsageLiveOutputSchema,
@@ -15097,14 +15397,17 @@ export {
   collectDoctorReport,
   collectFrontDoorStatus,
   collectPoolPick,
+  createCodexApiRouter,
   createControlApiRouter,
   createDoorApiNodeHandler,
   createDoorApiRouter,
   createDoorEventHub,
   createDoorHealthPublisher,
   createEventsApiRouter,
+  createLaunchApiRouter,
   createLaunchEventPublisher,
   createLeafCache,
+  createLifecycleApiRouter,
   createProfile,
   createQuotaExpiringPublisher,
   createRcApiNodeHandler,
@@ -15212,7 +15515,9 @@ export {
   requirePool,
   resolveAgentShimHome,
   resolveClaudeHome,
+  resolveClaudeLaunch,
   resolveDecisions,
+  resolveLaunch,
   resolveLaunchSelection,
   resolveLayoutPaths,
   resolveSupervisorConfig,