claude-use 9.5.1 → 9.7.0

package/dist/index.mjs

@@ -209,7 +209,7 @@ function isCodexProvider(provider) {
 function poolMemberIdentity(member) {
   return typeof member === "string" ? member : member.identity;
 }
-var CATEGORY_NAMES, OVERRIDABLE_CATEGORIES, CategoryMapSchema, DURATION_RE, DurationSchema, WhenConditionObjectSchema, WhenSchema, EntryValueSchema, ENTRY_KEY_RE, EntriesSchema, LaunchSchema, CREDENTIAL_TARGETS, PROVIDER_CREDENTIAL_TARGETS, CREDENTIAL_TARGET_VARS, ArgvSchema, CommandSourceOptions, CredentialSourceSchema, CREDENTIAL_CACHE_STORES, CredentialCacheSchema, CredentialSchema, ProviderCredentialSchema, RESERVED_PROVIDER_ENV_KEYS, ProviderEnvSchema, CODEX_EFFORTS, CODEX_LOGINS, CODEX_DEFAULT_TIER_MODELS, CodexProviderConfigSchema, ProviderRouteSchema, HttpProviderSchema, CodexProviderSchema, ProviderSchema, ConfigProfileSchema, POOL_SELECTOR_PREFIX, POOL_NAME_PATTERN, IDENTITY_NAME_PATTERN, PoolNameSchema, SELECTOR_RE, IdentitySelectorSchema, PoolMemberSchema, POOL_PREFERENCES, PoolPreferenceSchema, PoolSchema, DirectoryRuleSchema, DirectoryRulesSchema, PortableConfigSchema, HEADROOM_MODES, HEADROOM_CCR_MODES, HEADROOM_ROLLOUT_CHANNELS, INTERCEPT_CHANNELS, READ_MATURATION_CHANNELS, HeadroomGlobalConfigObjectSchema, HeadroomGlobalConfigSchema, HEADROOM_DEFAULT_SOURCE, HEADROOM_DEFAULT_IDLE_SHUTDOWN_MINUTES, FrontDoorGlobalConfigSchema, UPDATE_MODES, UpdateGlobalConfigSchema, GlobalConfigSchema, IdentitySchema, CategoryClassificationSchema, CategoryClassificationOverlaySchema, SHIPPED_CATEGORY_DEFAULTS;
+var CATEGORY_NAMES, OVERRIDABLE_CATEGORIES, CategoryMapSchema, DURATION_RE, DurationSchema, WhenConditionObjectSchema, WhenSchema, EntryValueSchema, ENTRY_KEY_RE, EntriesSchema, LaunchSchema, CREDENTIAL_TARGETS, PROVIDER_CREDENTIAL_TARGETS, CREDENTIAL_TARGET_VARS, ArgvSchema, CommandSourceOptions, EnvCredentialSourceSchema, FileCredentialSourceSchema, CommandCredentialSourceSchema, OpCredentialSourceSchema, KeychainCredentialSourceSchema, LiteralCredentialSourceSchema, CredentialSourceSchema, RemoteCredentialSourceSchema, CREDENTIAL_CACHE_STORES, CredentialCacheSchema, CredentialSchema, ProviderCredentialSchema, RESERVED_PROVIDER_ENV_KEYS, ProviderEnvSchema, PROVIDER_KINDS, CODEX_EFFORTS, CODEX_LOGINS, CODEX_DEFAULT_TIER_MODELS, CodexProviderConfigSchema, ProviderRouteSchema, HttpProviderSchema, CodexProviderSchema, ProviderSchema, ConfigProfileSchema, POOL_SELECTOR_PREFIX, POOL_NAME_PATTERN, IDENTITY_NAME_PATTERN, PoolNameSchema, SELECTOR_RE, IdentitySelectorSchema, PoolMemberSchema, POOL_PREFERENCES, PoolPreferenceSchema, PoolSchema, DirectoryRuleSchema, DirectoryRulesSchema, PortableConfigSchema, HEADROOM_MODES, HEADROOM_CCR_MODES, HEADROOM_ROLLOUT_CHANNELS, INTERCEPT_CHANNELS, READ_MATURATION_CHANNELS, HeadroomGlobalConfigObjectSchema, HeadroomGlobalConfigSchema, HEADROOM_DEFAULT_SOURCE, HEADROOM_DEFAULT_IDLE_SHUTDOWN_MINUTES, FrontDoorGlobalConfigSchema, UPDATE_MODES, UpdateGlobalConfigSchema, GlobalConfigSchema, IdentitySchema, CategoryClassificationSchema, CategoryClassificationOverlaySchema, SHIPPED_CATEGORY_DEFAULTS;
 var init_schema = __esm({
   "src/config/schema.ts"() {
     "use strict";
@@ -262,20 +262,33 @@ var init_schema = __esm({
       /** How long the command may run before it is killed and counted as failed. Defaults to `CREDENTIAL_COMMAND_TIMEOUT_MS`, or `CREDENTIAL_INTERACTIVE_TIMEOUT_MS` for an interactive source. */
       timeoutMs: z.int().positive().optional()
     };
+    EnvCredentialSourceSchema = z.strictObject({ env: z.string().min(1) });
+    FileCredentialSourceSchema = z.strictObject({
+      file: z.string().min(1).refine((filePath) => filePath.startsWith("~/") || path2.isAbsolute(filePath), {
+        message: "a credential file must be an absolute or ~-rooted path, since a launch can start in any directory"
+      })
+    });
+    CommandCredentialSourceSchema = z.strictObject({ command: ArgvSchema, ...CommandSourceOptions });
+    OpCredentialSourceSchema = z.strictObject({ op: z.string().startsWith("op://"), ...CommandSourceOptions });
+    KeychainCredentialSourceSchema = z.strictObject({
+      keychain: z.strictObject({ service: z.string().min(1), account: z.string().min(1).optional() }),
+      ...CommandSourceOptions
+    });
+    LiteralCredentialSourceSchema = z.strictObject({ literal: z.string().min(1) });
     CredentialSourceSchema = z.union([
-      z.strictObject({ env: z.string().min(1) }),
-      z.strictObject({
-        file: z.string().min(1).refine((filePath) => filePath.startsWith("~/") || path2.isAbsolute(filePath), {
-          message: "a credential file must be an absolute or ~-rooted path, since a launch can start in any directory"
-        })
-      }),
-      z.strictObject({ command: ArgvSchema, ...CommandSourceOptions }),
-      z.strictObject({ op: z.string().startsWith("op://"), ...CommandSourceOptions }),
-      z.strictObject({
-        keychain: z.strictObject({ service: z.string().min(1), account: z.string().min(1).optional() }),
-        ...CommandSourceOptions
-      }),
-      z.strictObject({ literal: z.string().min(1) })
+      EnvCredentialSourceSchema,
+      FileCredentialSourceSchema,
+      CommandCredentialSourceSchema,
+      OpCredentialSourceSchema,
+      KeychainCredentialSourceSchema,
+      LiteralCredentialSourceSchema
+    ]);
+    RemoteCredentialSourceSchema = z.union([
+      EnvCredentialSourceSchema,
+      FileCredentialSourceSchema,
+      OpCredentialSourceSchema,
+      KeychainCredentialSourceSchema,
+      LiteralCredentialSourceSchema
     ]);
     CREDENTIAL_CACHE_STORES = ["keychain", "file"];
     CredentialCacheSchema = z.strictObject({
@@ -292,6 +305,7 @@ var init_schema = __esm({
     ProviderEnvSchema = z.record(z.string().min(1), z.string()).refine((env) => !Object.keys(env).some((key) => RESERVED_PROVIDER_ENV_KEYS.includes(key)), {
       message: `env may not set ${RESERVED_PROVIDER_ENV_KEYS.join(", ")}: the credential block's target sets one and agent-shim removes the others`
     });
+    PROVIDER_KINDS = ["http", "codex"];
     CODEX_EFFORTS = ["none", "low", "medium", "high"];
     CODEX_LOGINS = ["codex-cli", "chatgpt-sign-in"];
     CODEX_DEFAULT_TIER_MODELS = Object.freeze({
@@ -2625,7 +2639,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "claude-use",
-      version: "9.5.1",
+      version: "9.7.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -2676,6 +2690,7 @@ var init_package = __esm({
       dependencies: {
         "@anthropic-ai/claude-agent-sdk": "0.3.292",
         "@clack/prompts": "^1.8.0",
+        "@modelcontextprotocol/sdk": "1.32.0",
         "@orpc/client": "2.0.0-beta.41",
         "@orpc/openapi": "2.0.0-beta.41",
         "@orpc/server": "2.0.0-beta.41",
@@ -3027,8 +3042,8 @@ function verifyHeadroomSocket(socketPath, ports) {
   }
   const uid = ports.currentUid();
   const directory = path12.dirname(socketPath);
-  const refusal = ownerOnlyRefusal("socket directory", directory, ports.lstat(directory), "dir", uid) ?? ownerOnlyRefusal("socket", socketPath, ports.lstat(socketPath), "socket", uid);
-  return refusal === void 0 ? { socketPath } : { refused: refusal };
+  const refusal2 = ownerOnlyRefusal("socket directory", directory, ports.lstat(directory), "dir", uid) ?? ownerOnlyRefusal("socket", socketPath, ports.lstat(socketPath), "socket", uid);
+  return refusal2 === void 0 ? { socketPath } : { refused: refusal2 };
 }
 function prepareHeadroomSocket(fs12, ports, paths, supervisorPid) {
   const unsupported = platformRefusal(ports.platform);
@@ -3046,8 +3061,8 @@ function prepareHeadroomSocket(fs12, ports, paths, supervisorPid) {
     return { refused: `the headroom socket directory ${paths.headroomSocketDir} is a symlink; it must be the real directory` };
   }
   fs12.mkdirPrivate(paths.headroomSocketDir);
-  const refusal = ownerOnlyRefusal("socket directory", paths.headroomSocketDir, ports.lstat(paths.headroomSocketDir), "dir", ports.currentUid());
-  return refusal === void 0 ? { socketPath } : { refused: refusal };
+  const refusal2 = ownerOnlyRefusal("socket directory", paths.headroomSocketDir, ports.lstat(paths.headroomSocketDir), "dir", ports.currentUid());
+  return refusal2 === void 0 ? { socketPath } : { refused: refusal2 };
 }
 function pruneStaleHeadroomSockets(fs12, paths, isRunning) {
   const removed = [];
@@ -4559,14 +4574,14 @@ function capacityOf(plan) {
   return plan.kind === "subscription" ? plan.capacity : 1;
 }
 function assessRefusedNested(member, nested, nowMs) {
-  const refusal = nested.earliestReturn === void 0 ? { reason: `no member of pool "${nested.pool}" can be picked` } : { reason: `every member of pool "${nested.pool}" is refused; ${nested.earliestReturn.identity} returns at ${new Date(nested.earliestReturn.atMs).toISOString()} (in ${formatAge(nested.earliestReturn.atMs - nowMs)})`, blockedUntilMs: nested.earliestReturn.atMs };
+  const refusal2 = nested.earliestReturn === void 0 ? { reason: `no member of pool "${nested.pool}" can be picked` } : { reason: `every member of pool "${nested.pool}" is refused; ${nested.earliestReturn.identity} returns at ${new Date(nested.earliestReturn.atMs).toISOString()} (in ${formatAge(nested.earliestReturn.atMs - nowMs)})`, blockedUntilMs: nested.earliestReturn.atMs };
   return {
     candidate: {
       identity: member.identity,
       class: "ineligible",
-      ...refusal.blockedUntilMs === void 0 ? {} : { blockedUntilMs: refusal.blockedUntilMs },
+      ...refusal2.blockedUntilMs === void 0 ? {} : { blockedUntilMs: refusal2.blockedUntilMs },
       plan: planOf(member.account),
-      reasons: [refusal.reason]
+      reasons: [refusal2.reason]
     }
   };
 }
@@ -4657,7 +4672,7 @@ function rankPool(input) {
   const assessments = members.map((member) => ({ member, ...assess(member, nowMs) }));
   const demands = assessments.flatMap(({ candidate, burn }) => burn === void 0 ? [] : [burn * capacityOf(candidate.plan)]);
   const sharedDemand = demands.length === 0 ? void 0 : Math.max(...demands);
-  const guarded = assessments.map((assessment) => {
+  const guarded2 = assessments.map((assessment) => {
     const { candidate } = assessment;
     if (candidate.class === "ineligible" || assessment.member.policy === void 0) {
       return assessment;
@@ -4672,7 +4687,7 @@ function rankPool(input) {
     }
     return { ...assessment, candidate: { ...candidate, class: "ineligible", reasons: [`skipped by policy (${verdict.checked.join(", ")}: did not hold)`, ...candidate.reasons] } };
   });
-  const candidates = guarded.map((assessment) => {
+  const candidates = guarded2.map((assessment) => {
     const { candidate, fiveHour, burn } = assessment;
     const pace = burn ?? (sharedDemand === void 0 ? void 0 : sharedDemand / capacityOf(candidate.plan));
     const { sevenDay, sevenDayBurn } = assessment;
@@ -5742,7 +5757,7 @@ function cascadeProviderName(cascade) {
   }
   return name;
 }
-function resolveProvider(params) {
+function selectProvider(params) {
   const cliName = params.cliProvider !== void 0 && params.cliProvider !== "" ? params.cliProvider : void 0;
   const name = cliName ?? (params.cascade === void 0 ? void 0 : cascadeProviderName(params.cascade));
   if (name === void 0) {
@@ -5757,6 +5772,14 @@ function resolveProvider(params) {
       message: `agent-shim: no provider named "${name}". ` + (known.length > 0 ? `Known providers: ${known.join(", ")}.` : "No providers are defined yet; run `agent-shim provider add`.")
     };
   }
+  return { ok: true, provider: { name, definition } };
+}
+function resolveProvider(params) {
+  const selection = selectProvider(params);
+  if (selection?.ok !== true) {
+    return selection;
+  }
+  const { name, definition } = selection.provider;
   if (params.credentials === void 0) {
     return { ok: false, status: 1, message: `agent-shim: provider ${name} needs its credential resolved, but this launcher has no credential port wired` };
   }
@@ -6037,6 +6060,51 @@ var init_claudeShim = __esm({
   }
 });
 
+// src/update/update.ts
+function compareVersions3(left, right) {
+  const parse = (version) => {
+    const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(version);
+    if (match === null) {
+      throw new Error(`not a plain release version: ${version}`);
+    }
+    return [Number(match[1]), Number(match[2]), Number(match[3])];
+  };
+  const leftParts = parse(left);
+  const rightParts = parse(right);
+  return leftParts.map((part, index) => part - (rightParts[index] ?? 0)).find((difference) => difference !== 0) ?? 0;
+}
+function releaseTagFromUrl(url) {
+  const segment = url.split("?")[0]?.split("/").at(-1);
+  const candidate = segment?.startsWith("v") === true ? segment.slice(1) : void 0;
+  return candidate !== void 0 && /^\d+\.\d+\.\d+$/.test(candidate) ? candidate : void 0;
+}
+var LATEST_RELEASE_URL, UpdateChannelError, UpdateConflictError, UpdateDownloadError;
+var init_update = __esm({
+  "src/update/update.ts"() {
+    "use strict";
+    init_cliError();
+    LATEST_RELEASE_URL = "https://github.com/ExaDev/agent-shim/releases/latest";
+    UpdateChannelError = class extends CliError {
+      constructor(message) {
+        super(message);
+        this.name = "UpdateChannelError";
+      }
+    };
+    UpdateConflictError = class extends CliError {
+      constructor(message) {
+        super(message);
+        this.name = "UpdateConflictError";
+      }
+    };
+    UpdateDownloadError = class extends CliError {
+      constructor(message) {
+        super(message);
+        this.name = "UpdateDownloadError";
+      }
+    };
+  }
+});
+
 // src/frontdoor/ensure.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
 function ensureFrontDoor(params) {
@@ -6442,7 +6510,7 @@ var init_headers = __esm({
 });
 
 // src/launcher/flags.ts
-import path31 from "node:path";
+import path32 from "node:path";
 function resolveLaunchFlags(params) {
   return {
     skipPermissions: params.flags?.skipPermissions ?? parseEnvBool("AGENT_SHIM_SKIP_PERMISSIONS", params.env.AGENT_SHIM_SKIP_PERMISSIONS) ?? params.cascade?.skipPermissions ?? false,
@@ -6473,7 +6541,7 @@ function buildEnv(params) {
   const parentCustomHeaders = params.baseEnv.ANTHROPIC_CUSTOM_HEADERS;
   let providerCustomHeaders;
   if (!params.configDirEscapeHatch && params.resolvedIdentityName !== void 0) {
-    env.CLAUDE_CONFIG_DIR = path31.join(params.identitiesDir, params.resolvedIdentityName);
+    env.CLAUDE_CONFIG_DIR = path32.join(params.identitiesDir, params.resolvedIdentityName);
   }
   if (params.provider !== void 0) {
     const providerEnv = params.provider.definition.env ?? {};
@@ -6596,7 +6664,9 @@ function resolvePoolLaunch(params) {
     }
     const { pick, earliestReturn, movedOff } = graph.ranking;
     if (pick !== void 0) {
-      recordStickyPick(params.usageFs, params.paths.usagePicksFile, params.cwd, pick.identity, nowMs);
+      if (params.recordPick) {
+        recordStickyPick(params.usageFs, params.paths.usagePicksFile, params.cwd, pick.identity, nowMs);
+      }
       const move = movedOff === void 0 ? "" : `moved off ${movedOff.identity} (${movedOff.reason}); `;
       return {
         ok: true,
@@ -6662,33 +6732,6 @@ var init_spawn = __esm({
   }
 });
 
-// src/update/update.ts
-function compareVersions3(left, right) {
-  const parse = (version) => {
-    const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(version);
-    if (match === null) {
-      throw new Error(`not a plain release version: ${version}`);
-    }
-    return [Number(match[1]), Number(match[2]), Number(match[3])];
-  };
-  const leftParts = parse(left);
-  const rightParts = parse(right);
-  return leftParts.map((part, index) => part - (rightParts[index] ?? 0)).find((difference) => difference !== 0) ?? 0;
-}
-function releaseTagFromUrl(url) {
-  const segment = url.split("?")[0]?.split("/").at(-1);
-  const candidate = segment?.startsWith("v") === true ? segment.slice(1) : void 0;
-  return candidate !== void 0 && /^\d+\.\d+\.\d+$/.test(candidate) ? candidate : void 0;
-}
-var LATEST_RELEASE_URL;
-var init_update = __esm({
-  "src/update/update.ts"() {
-    "use strict";
-    init_cliError();
-    LATEST_RELEASE_URL = "https://github.com/ExaDev/agent-shim/releases/latest";
-  }
-});
-
 // src/update/launchHook.ts
 function resolveUpdateMode(globalConfig) {
   return globalConfig?.update?.mode ?? "off";
@@ -6760,7 +6803,7 @@ var init_launchHook = __esm({
 
 // src/launcher.ts
 import { randomUUID as randomUUID4 } from "node:crypto";
-import path32 from "node:path";
+import path33 from "node:path";
 function resolveIdentityCredential(identity, credential, env, port) {
   if (port === void 0) {
     return { ok: false, status: 1, message: `agent-shim: identity ${identity} needs its credential resolved, but this launcher has no credential port wired` };
@@ -6768,7 +6811,7 @@ function resolveIdentityCredential(identity, credential, env, port) {
   const resolution = resolveCredential({ credential, env, port, subject: `identity ${identity}` });
   return resolution.ok ? resolution : { ok: false, status: CREDENTIAL_UNAVAILABLE_EXIT, message: resolution.message };
 }
-function pickFromPool(decided, params, parsedArgv) {
+function pickFromPool(decided, params, parsedArgv, readOnly) {
   const { paths, fs: fs12, proc, log } = params;
   if (decided.pool === void 0) {
     return { identityDecision: decided };
@@ -6789,7 +6832,9 @@ function pickFromPool(decided, params, parsedArgv) {
     now: farmRuntime.now,
     sleep: farmRuntime.lock.sleep,
     passthrough: parsedArgv.rest,
-    wait: parsedArgv.wait === true,
+    // A read-only decision never sleeps for a refused pool and never records its pick, so asking what a launch would pick leaves the next real launch's keep-warm preference as it was.
+    wait: !readOnly && parsedArgv.wait === true,
+    recordPick: !readOnly,
     log
   });
   if (!resolution.ok) {
@@ -6802,7 +6847,7 @@ function pickFromPool(decided, params, parsedArgv) {
     poolPick: { name: decided.pool, reasons: resolution.reasons, ...resolution.movedOff === void 0 ? {} : { movedOff: resolution.movedOff } }
   };
 }
-function prepareLaunch(params) {
+function decideLaunch(params, readOnly) {
   const { paths, fs: fs12, proc, log } = params;
   const { env, argv } = proc;
   const parsedArgv = parseLauncherArgv(argv);
@@ -6826,10 +6871,10 @@ function prepareLaunch(params) {
       return trimmed === "" ? void 0 : trimmed;
     }
   });
-  const { identityDecision, poolExplanation, poolPick } = pickFromPool(decidedIdentity, params, parsedArgv);
+  const { identityDecision, poolExplanation, poolPick } = pickFromPool(decidedIdentity, params, parsedArgv, readOnly);
   const farmIdentity = configDirEscapeHatchApplies ? void 0 : identityDecision.name;
   const farm = farmIdentity === void 0 ? void 0 : params.farm;
-  if (farm !== void 0 && farmIdentity !== void 0) {
+  if (!readOnly && farm !== void 0 && farmIdentity !== void 0) {
     let recovery;
     try {
       recovery = recoverFarm({
@@ -6868,33 +6913,44 @@ function prepareLaunch(params) {
     identityDefaultConfigProfile: loadedIdentity?.config.defaultConfigProfile,
     globalDefaultConfigProfile: params.globalDefaultConfigProfile
   });
-  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs12.readConfigFile(path32.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
+  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs12.readConfigFile(path33.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
     log.error(
       `agent-shim: no configuration profile named "${configProfileDecision.name}" (selected via ${configProfileDecision.source}). Run \`agent-shim profile add ${configProfileDecision.name}\` first.`
     );
     proc.exit(1);
   }
   const farmContext = farm !== void 0 && farmIdentity !== void 0 ? { farm, identity: farmIdentity, cascade: farm.loadCascade(configProfileDecision.name, cliOverride) } : void 0;
-  const provider = parsedArgv.provider === false ? void 0 : resolveProvider({
+  const providerParams = {
     paths,
     port: fs12,
-    env,
-    ...params.credentials === void 0 ? {} : { credentials: params.credentials },
-    ...parsedArgv.provider === void 0 ? {} : { cliProvider: parsedArgv.provider },
+    ...parsedArgv.provider === void 0 || parsedArgv.provider === false ? {} : { cliProvider: parsedArgv.provider },
     ...farmContext === void 0 ? {} : { cascade: farmContext.cascade }
-  });
-  if (provider !== void 0 && !provider.ok) {
-    log.error(provider.message);
-    proc.exit(provider.status);
-  }
-  const resolvedProvider = provider?.ok === true ? provider.provider : void 0;
-  for (const warning of provider?.ok === true ? provider.warnings : []) {
-    log.warn(warning);
+  };
+  let selectedProvider;
+  let resolvedProvider;
+  if (parsedArgv.provider !== false && readOnly) {
+    const selection = selectProvider(providerParams);
+    if (selection !== void 0 && !selection.ok) {
+      log.error(selection.message);
+      proc.exit(selection.status);
+    }
+    selectedProvider = selection?.ok === true ? selection.provider : void 0;
+  } else if (parsedArgv.provider !== false) {
+    const provider = resolveProvider({ ...providerParams, env, ...params.credentials === void 0 ? {} : { credentials: params.credentials } });
+    if (provider !== void 0 && !provider.ok) {
+      log.error(provider.message);
+      proc.exit(provider.status);
+    }
+    resolvedProvider = provider?.ok === true ? provider.provider : void 0;
+    selectedProvider = resolvedProvider;
+    for (const warning of provider?.ok === true ? provider.warnings : []) {
+      log.warn(warning);
+    }
   }
   if (farm !== void 0 && farmIdentity !== void 0) {
     try {
       const snapshot = readUsageSnapshot(farm.fs, paths.usageSnapshotsDir, farmIdentity);
-      for (const warning of quotaWarnings(snapshot, resolvedProvider?.name ?? ANTHROPIC_PROVIDER, farm.now())) {
+      for (const warning of quotaWarnings(snapshot, selectedProvider?.name ?? ANTHROPIC_PROVIDER, farm.now())) {
         log.warn(warning);
       }
     } catch (error) {
@@ -6904,8 +6960,8 @@ function prepareLaunch(params) {
       log.warn(`agent-shim: ${error.message}`);
     }
   }
-  const identityCredentialBlock = loadedIdentity?.config.credential;
-  const identityResolution = resolvedProvider === void 0 && farmIdentity !== void 0 && identityCredentialBlock !== void 0 ? resolveIdentityCredential(farmIdentity, identityCredentialBlock, env, params.credentials) : void 0;
+  const identityCredentialBlock = selectedProvider === void 0 && farmIdentity !== void 0 ? loadedIdentity?.config.credential : void 0;
+  const identityResolution = !readOnly && identityCredentialBlock !== void 0 && farmIdentity !== void 0 ? resolveIdentityCredential(farmIdentity, identityCredentialBlock, env, params.credentials) : void 0;
   if (identityResolution !== void 0 && !identityResolution.ok) {
     log.error(identityResolution.message);
     proc.exit(identityResolution.status);
@@ -6919,25 +6975,97 @@ function prepareLaunch(params) {
     allowAmbientCredential: loadedIdentity?.config.allowAmbientCredential ?? false,
     allowAmbientCredentialOverride: parseEnvBool("AGENT_SHIM_ALLOW_AMBIENT_CREDENTIAL", env.AGENT_SHIM_ALLOW_AMBIENT_CREDENTIAL) === true,
     identityName: identityDecision.name,
-    providerSelected: resolvedProvider !== void 0,
+    providerSelected: selectedProvider !== void 0,
     ...identityCredential === void 0 ? {} : { injectedCredential: { variable: CREDENTIAL_TARGET_VARS[identityCredential.target], token: identityCredential.token } }
   });
   if (!guardResult.ok) {
-    log.error(guardResult.message);
-    proc.exit(1);
+    if (readOnly && identityCredentialBlock !== void 0) {
+      log.warn(`${guardResult.message} (not resolved here: the launch proceeds only if that value is the identity's own injected credential)`);
+    } else {
+      log.error(guardResult.message);
+      proc.exit(1);
+    }
+  }
+  const launchCascade = farmContext?.cascade ?? (params.farm === void 0 ? void 0 : params.farm.loadCascade(configProfileDecision.name, cliOverride));
+  let cascadeLaunch;
+  if (launchCascade !== void 0 && params.farm !== void 0) {
+    const assembled = assembleCascade(launchCascade);
+    const flattened = flattenLayers(assembled.layers, { home: params.farm.home });
+    cascadeLaunch = flattened.launch;
+    if (readOnly) {
+      for (const diagnostic of [...assembled.diagnostics, ...flattened.diagnostics]) {
+        if (diagnostic.severity !== "info") {
+          log.warn(`agent-shim: ${diagnostic.code}: ${diagnostic.message}`);
+        }
+      }
+    }
   }
+  const pinnedVersion = resolveClaudeVersion({ env, ...parsedArgv.claudeVersion === void 0 ? {} : { flag: parsedArgv.claudeVersion }, ...cascadeLaunch?.claudeVersion === void 0 ? {} : { cascade: cascadeLaunch.claudeVersion } });
+  const discovered = params.resolveClaudeBinary(pinnedVersion === void 0 ? void 0 : { version: pinnedVersion.version });
+  const flags = resolveLaunchFlags({
+    env,
+    // A pool pick reads the usage the front door records, so a pool launch records its own unless something says otherwise.
+    ...poolExplanation === void 0 ? {} : { trackUsageDefault: true },
+    ...cascadeLaunch === void 0 ? {} : { cascade: cascadeLaunch },
+    flags: {
+      ...parsedArgv.skipPermissions === void 0 ? {} : { skipPermissions: parsedArgv.skipPermissions },
+      ...parsedArgv.remoteControl === void 0 ? {} : { remoteControl: parsedArgv.remoteControl },
+      ...parsedArgv.headroom === void 0 ? {} : { headroom: parsedArgv.headroom },
+      ...parsedArgv.trackUsage === void 0 ? {} : { trackUsage: parsedArgv.trackUsage }
+    }
+  });
+  const args = buildArgv({
+    toolFlags: buildFlagArgs(flags),
+    extraFlags: splitExtraFlags(env.CLAUDE_EXTRA_FLAGS),
+    passthrough: parsedArgv.rest
+  });
+  const configDir = configDirEscapeHatchApplies || identityDecision.name === void 0 ? env.CLAUDE_CONFIG_DIR : path33.join(paths.identitiesDir, identityDecision.name);
+  const decision = {
+    identitySource: identityDecision.source,
+    configDirEscapeHatch: identityDecision.configDirEscapeHatch,
+    configProfileSource: configProfileDecision.source,
+    ...identityDecision.name === void 0 ? {} : { identity: identityDecision.name },
+    ...poolPick === void 0 ? {} : { pool: poolPick },
+    ...configDir === void 0 || configDir === "" ? {} : { configDir },
+    ...configProfileDecision.name === void 0 ? {} : { configProfile: configProfileDecision.name },
+    ...selectedProvider === void 0 ? {} : { provider: selectedProvider.name }
+  };
+  return {
+    parsedArgv,
+    identityDecision,
+    poolExplanation,
+    poolPick,
+    configDirEscapeHatch: configDirEscapeHatchApplies,
+    farmIdentity,
+    farmContext,
+    configProfileDecision,
+    provider: selectedProvider,
+    resolvedProvider,
+    identityCredentialBlock,
+    identityCredential,
+    pinnedVersion,
+    flags,
+    bin: discovered.path,
+    args,
+    decision
+  };
+}
+function prepareLaunch(params) {
+  const { paths, proc, log } = params;
+  const { env } = proc;
+  const decided = decideLaunch(params, false);
+  const { identityDecision, configProfileDecision, resolvedProvider, identityCredential, poolExplanation, flags: resolvedFlags, args: finalArgv, configDirEscapeHatch: configDirEscapeHatchApplies, decision } = decided;
   log.info(
     `agent-shim: identity ${identityDecision.name ?? "(none)"} (${identityDecision.source}${poolExplanation === void 0 ? "" : `, ${poolExplanation}`}), config profile ${configProfileDecision.name ?? "(none)"} (${configProfileDecision.source})` + (resolvedProvider === void 0 ? "" : `, provider ${resolvedProvider.name} (credential ${resolvedProvider.credential.target} from ${describeSource(resolvedProvider.credential.source)})`) + (identityCredential === void 0 ? "" : `, identity credential ${identityCredential.target} from ${describeSource(identityCredential.source)}`)
   );
   const updateCheck = runLaunchUpdateCheck({
     mode: params.updateMode ?? "off",
-    checkPath: path32.join(paths.root, "update.check"),
+    checkPath: path33.join(paths.root, "update.check"),
     currentVersion: package_default.version,
     port: params.update
   });
-  let cascadeLaunch;
-  if (farmContext !== void 0) {
-    const { farm: resyncFarmRuntime, identity: resyncIdentity, cascade } = farmContext;
+  if (decided.farmContext !== void 0) {
+    const { farm: resyncFarmRuntime, identity: resyncIdentity, cascade } = decided.farmContext;
     let result;
     try {
       result = resyncFarm({
@@ -6974,27 +7102,10 @@ function prepareLaunch(params) {
     log.info(
       result.noOp ? `agent-shim: farm at ${result.farmRoot} already matches the resolved cascade` : `agent-shim: farm at ${result.farmRoot} resynced (${String(result.manifest.links.length)} link(s), ${String(result.manifest.materialised.length)} built director(ies)${result.adopted.length === 0 ? "" : `, ${String(result.adopted.length)} adopted into ${resyncFarmRuntime.claudeHome}`})`
     );
-    cascadeLaunch = result.resolved.flattened.launch;
-  } else if (params.farm !== void 0) {
-    cascadeLaunch = flattenLayers(assembleCascade(params.farm.loadCascade(configProfileDecision.name, cliOverride)).layers, { home: params.farm.home }).launch;
   }
-  const pinnedVersion = resolveClaudeVersion({ env, ...parsedArgv.claudeVersion === void 0 ? {} : { flag: parsedArgv.claudeVersion }, ...cascadeLaunch?.claudeVersion === void 0 ? {} : { cascade: cascadeLaunch.claudeVersion } });
-  const discovered = params.resolveClaudeBinary(pinnedVersion === void 0 ? void 0 : { version: pinnedVersion.version });
-  if (pinnedVersion !== void 0) {
-    log.info(`agent-shim: Claude Code ${pinnedVersion.version} (pinned by ${pinnedVersion.source})`);
+  if (decided.pinnedVersion !== void 0) {
+    log.info(`agent-shim: Claude Code ${decided.pinnedVersion.version} (pinned by ${decided.pinnedVersion.source})`);
   }
-  const resolvedFlags = resolveLaunchFlags({
-    env,
-    // A pool pick reads the usage the front door records, so a pool launch records its own unless something says otherwise.
-    ...poolExplanation === void 0 ? {} : { trackUsageDefault: true },
-    ...cascadeLaunch === void 0 ? {} : { cascade: cascadeLaunch },
-    flags: {
-      ...parsedArgv.skipPermissions === void 0 ? {} : { skipPermissions: parsedArgv.skipPermissions },
-      ...parsedArgv.remoteControl === void 0 ? {} : { remoteControl: parsedArgv.remoteControl },
-      ...parsedArgv.headroom === void 0 ? {} : { headroom: parsedArgv.headroom },
-      ...parsedArgv.trackUsage === void 0 ? {} : { trackUsage: parsedArgv.trackUsage }
-    }
-  });
   const frontDoorPort = params.frontdoor;
   const frontDoorEngaged = resolvedProvider !== void 0 || resolvedFlags.headroom || resolvedFlags.trackUsage;
   if (frontDoorEngaged && frontDoorPort === void 0) {
@@ -7018,11 +7129,6 @@ function prepareLaunch(params) {
     log.info(`agent-shim: routing through the front door on 127.0.0.1:${String(frontDoor.port)}${resolvedProvider === void 0 ? ` (OAuth via the door's CONNECT surface on 127.0.0.1:${String(frontDoor.connectPort)}, usage recorded)` : ` (provider ${resolvedProvider.name})`}`);
   }
   const frontDoorRelease = frontDoor === void 0 ? void 0 : frontDoorPort?.release;
-  const finalArgv = buildArgv({
-    toolFlags: buildFlagArgs(resolvedFlags),
-    extraFlags: splitExtraFlags(env.CLAUDE_EXTRA_FLAGS),
-    passthrough: parsedArgv.rest
-  });
   const finalEnv = buildEnv({
     baseEnv: env,
     configDirEscapeHatch: configDirEscapeHatchApplies,
@@ -7040,18 +7146,35 @@ function prepareLaunch(params) {
       registered();
     }
   };
-  const configDir = finalEnv.CLAUDE_CONFIG_DIR;
-  const decision = {
-    identitySource: identityDecision.source,
-    configDirEscapeHatch: identityDecision.configDirEscapeHatch,
-    configProfileSource: configProfileDecision.source,
-    ...identityDecision.name === void 0 ? {} : { identity: identityDecision.name },
-    ...poolPick === void 0 ? {} : { pool: poolPick },
-    ...configDir === void 0 || configDir === "" ? {} : { configDir },
-    ...configProfileDecision.name === void 0 ? {} : { configProfile: configProfileDecision.name },
-    ...resolvedProvider === void 0 ? {} : { provider: resolvedProvider.name }
+  return { bin: decided.bin, args: finalArgv, env: finalEnv, release, markChildStarted: updateCheck.markChildStarted, decision };
+}
+function resolveLaunch(params) {
+  const decided = decideLaunch(params, true);
+  const { env } = params.proc;
+  const frontDoor = decided.provider !== void 0 || decided.flags.headroom || decided.flags.trackUsage;
+  const built = buildEnv({
+    baseEnv: env,
+    configDirEscapeHatch: decided.configDirEscapeHatch,
+    resolvedIdentityName: decided.identityDecision.name,
+    identitiesDir: params.paths.identitiesDir,
+    ...decided.provider === void 0 ? {} : { provider: decided.provider },
+    ...frontDoor ? { frontdoor: { port: 0, connectPort: 0, trustBundlePath: "", sessionToken: "" } } : {},
+    ...decided.flags.headroom ? { headroom: { socketPath: "", projectId: "" } } : {},
+    sessionId: ""
+  });
+  const credentialNames = decided.identityCredentialBlock === void 0 ? [] : Object.keys(credentialVariables(decided.identityCredentialBlock.target ?? "bearer", ""));
+  const environment = [.../* @__PURE__ */ new Set([...Object.keys(built).filter((name) => built[name] !== env[name]), ...credentialNames])].sort();
+  const credential = decided.provider !== void 0 ? { subject: "provider", name: decided.provider.name, summary: summariseCredential(decided.provider.definition.credential) } : decided.identityCredentialBlock !== void 0 && decided.farmIdentity !== void 0 ? { subject: "identity", name: decided.farmIdentity, summary: summariseCredential(decided.identityCredentialBlock) } : void 0;
+  return {
+    decision: decided.decision,
+    flags: decided.flags,
+    ...decided.pinnedVersion === void 0 ? {} : { claudeVersion: decided.pinnedVersion },
+    bin: decided.bin,
+    args: decided.args,
+    ...credential === void 0 ? {} : { credential },
+    routing: { frontDoor, headroom: decided.flags.headroom },
+    environment
   };
-  return { bin: discovered.path, args: finalArgv, env: finalEnv, release, markChildStarted: updateCheck.markChildStarted, decision };
 }
 function runLaunchPlan(plan, spawn2) {
   try {
@@ -7097,12 +7220,12 @@ var init_launcher = __esm({
 });
 
 // src/ownCli.ts
-import path33 from "node:path";
+import path34 from "node:path";
 function agentShimCliPath(distDir = typeof __AGENT_SHIM_DIST_DIR__ === "string" ? __AGENT_SHIM_DIST_DIR__ : void 0) {
   if (distDir === void 0) {
     throw new OwnCliPathUnknownError();
   }
-  return path33.join(distDir, OWN_CLI_FILE_NAME);
+  return path34.join(distDir, OWN_CLI_FILE_NAME);
 }
 var OWN_CLI_FILE_NAME, OwnCliPathUnknownError;
 var init_ownCli = __esm({
@@ -7191,10 +7314,10 @@ request.on("error", (error) => finish(failed, (error.code ? error.code + ": " :
 
 // src/frontdoor/trust.ts
 import { createHash as createHash6 } from "node:crypto";
-import path34 from "node:path";
+import path35 from "node:path";
 function resolveTrustBundle(params) {
   const { caCertFile, bundlesDir, variable, inherited, fs: fs12 } = params;
-  if (inherited === void 0 || inherited === "" || path34.resolve(inherited) === path34.resolve(caCertFile)) {
+  if (inherited === void 0 || inherited === "" || path35.resolve(inherited) === path35.resolve(caCertFile)) {
     return { path: caCertFile };
   }
   const caPem = fs12.readFileUtf8(caCertFile);
@@ -7212,7 +7335,7 @@ function resolveTrustBundle(params) {
   }
   const combined = `${inheritedPem.trimEnd()}
 ${caPem}`;
-  const bundle = path34.join(bundlesDir, `${createHash6("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
+  const bundle = path35.join(bundlesDir, `${createHash6("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
   if (!fs12.exists(bundle)) {
     fs12.mkdirp(bundlesDir);
     fs12.writeFileAtomic(bundle, combined);
@@ -7369,6 +7492,31 @@ function prepareClaudeLaunch(options) {
   const spawnDaemon = daemonSpawnerFor(options.agentShim);
   return prepareLaunch(realPrepareLaunchParams(paths, { proc, log, spawnDaemon, farm: buildFarmRuntime(paths, options.cwd) }));
 }
+function resolveClaudeLaunch(options) {
+  const paths = options.paths ?? resolveLayoutPaths();
+  const refusals = [];
+  const warnings = [];
+  const log = {
+    info: () => void 0,
+    warn: (message) => {
+      warnings.push(message);
+    },
+    error: (message) => {
+      refusals.push(message);
+    }
+  };
+  const proc = {
+    env: options.env,
+    argv: options.argv,
+    exit: (code) => {
+      throw new LaunchRefusedError(refusals.join("\n") || `the launch was refused (exit ${String(code)})`, code);
+    }
+  };
+  const spawnDaemon = () => {
+    throw new Error("resolving a launch starts no daemon");
+  };
+  return { resolution: resolveLaunch(realPrepareLaunchParams(paths, { proc, log, spawnDaemon, farm: buildFarmRuntime(paths, options.cwd) })), warnings };
+}
 var LaunchRefusedError;
 var init_launchWiring = __esm({
   "src/launchWiring.ts"() {
@@ -7535,7 +7683,7 @@ var init_anthropicUsageRefresh = __esm({
 });
 
 // src/usage/providerQuota.ts
-import { z as z21 } from "zod";
+import { z as z23 } from "zod";
 var MS_PER_SECOND7, SECONDS_PER_HOUR, HOURS_PER_DAY3, DAYS_PER_MONTH, ZAI_HOST, ZAI_QUOTA_URL, ZAI_UNIT_HOURS, ZAI_UNIT_MONTHS, ZAI_UNIT_MS, ZaiLimitSchema, ZaiResponseSchema, OPENROUTER_HOST, OPENROUTER_KEY_URL, OPENROUTER_CREDITS_URL, MS_PER_DAY3, OpenRouterKeySchema, OpenRouterCreditsSchema;
 var init_providerQuota = __esm({
   "src/usage/providerQuota.ts"() {
@@ -7553,35 +7701,35 @@ var init_providerQuota = __esm({
       [ZAI_UNIT_HOURS, SECONDS_PER_HOUR * MS_PER_SECOND7],
       [ZAI_UNIT_MONTHS, DAYS_PER_MONTH * HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND7]
     ]);
-    ZaiLimitSchema = z21.object({
-      type: z21.string(),
-      unit: z21.number().int(),
-      number: z21.number().int().positive(),
-      percentage: z21.number().nonnegative(),
-      nextResetTime: z21.number().positive().optional(),
-      usage: z21.number().nonnegative().optional(),
-      currentValue: z21.number().nonnegative().optional(),
-      remaining: z21.number().nonnegative().optional()
+    ZaiLimitSchema = z23.object({
+      type: z23.string(),
+      unit: z23.number().int(),
+      number: z23.number().int().positive(),
+      percentage: z23.number().nonnegative(),
+      nextResetTime: z23.number().positive().optional(),
+      usage: z23.number().nonnegative().optional(),
+      currentValue: z23.number().nonnegative().optional(),
+      remaining: z23.number().nonnegative().optional()
     });
-    ZaiResponseSchema = z21.object({
-      success: z21.boolean(),
-      msg: z21.string().optional(),
-      data: z21.object({ level: z21.string().optional(), limits: z21.array(ZaiLimitSchema) })
+    ZaiResponseSchema = z23.object({
+      success: z23.boolean(),
+      msg: z23.string().optional(),
+      data: z23.object({ level: z23.string().optional(), limits: z23.array(ZaiLimitSchema) })
     });
     OPENROUTER_HOST = "openrouter.ai";
     OPENROUTER_KEY_URL = `https://${OPENROUTER_HOST}/api/v1/key`;
     OPENROUTER_CREDITS_URL = `https://${OPENROUTER_HOST}/api/v1/credits`;
     MS_PER_DAY3 = HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND7;
-    OpenRouterKeySchema = z21.object({
-      data: z21.object({
-        limit: z21.number().nonnegative().nullable(),
-        limit_remaining: z21.number().nullable(),
-        limit_reset: z21.string().nullable(),
-        is_free_tier: z21.boolean().optional(),
-        free_model_daily_requests: z21.object({ used: z21.number().nonnegative(), limit: z21.number().nonnegative(), remaining: z21.number() }).optional()
+    OpenRouterKeySchema = z23.object({
+      data: z23.object({
+        limit: z23.number().nonnegative().nullable(),
+        limit_remaining: z23.number().nullable(),
+        limit_reset: z23.string().nullable(),
+        is_free_tier: z23.boolean().optional(),
+        free_model_daily_requests: z23.object({ used: z23.number().nonnegative(), limit: z23.number().nonnegative(), remaining: z23.number() }).optional()
       })
     });
-    OpenRouterCreditsSchema = z21.object({ data: z21.object({ total_credits: z21.number().nonnegative(), total_usage: z21.number().nonnegative() }) });
+    OpenRouterCreditsSchema = z23.object({ data: z23.object({ total_credits: z23.number().nonnegative(), total_usage: z23.number().nonnegative() }) });
   }
 });
 
@@ -8197,8 +8345,8 @@ function parseConnectTarget(authority) {
 function isInterceptedHost(host, interceptHosts) {
   return interceptHosts.includes(host);
 }
-function servedByPipeline(path35) {
-  return path35?.startsWith(ROUTED_PATH_PREFIX) === true;
+function servedByPipeline(path36) {
+  return path36?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
   "connection",
@@ -8559,6 +8707,7 @@ var HTTP_STATUS = {
   forbidden: 403,
   notFound: 404,
   methodNotAllowed: 405,
+  conflict: 409,
   payloadTooLarge: 413,
   tooManyRequests: 429,
   /** Not sent to anyone: the client is gone. Recorded for a response abandoned because the client disconnected, following the convention nginx uses for the same case. */
@@ -8732,11 +8881,11 @@ function createRcSessionTracker(deps) {
   };
   const observeExchange = (request4) => {
     const method = (request4.method ?? "").toUpperCase();
-    const path35 = new URL(request4.url ?? "/", "http://127.0.0.1").pathname;
-    if (!path35.startsWith(RC_SESSIONS_PATH_PREFIX)) {
+    const path36 = new URL(request4.url ?? "/", "http://127.0.0.1").pathname;
+    if (!path36.startsWith(RC_SESSIONS_PATH_PREFIX)) {
       return void 0;
     }
-    const tail = path35.slice(RC_SESSIONS_PATH_PREFIX.length);
+    const tail = path36.slice(RC_SESSIONS_PATH_PREFIX.length);
     const facts = {
       oauthAuthorization: oauthAuthorizationOf(request4.headers),
       anthropicVersion: singleHeader(request4.headers, "anthropic-version"),
@@ -9118,8 +9267,8 @@ var RC_READ_FILE_ENCODINGS = ["utf-8", "base64"];
 function isRcReadFileEncoding(value) {
   return RC_READ_FILE_ENCODINGS.some((encoding) => encoding === value);
 }
-function buildRcReadFilePayload(requestId, path35, options) {
-  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path35, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
+function buildRcReadFilePayload(requestId, path36, options) {
+  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path36, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
 }
 function buildRcFileSuggestionsPayload(requestId, query) {
   return buildRcControlRequestPayload(requestId, { subtype: "file_suggestions", query });
@@ -9221,15 +9370,15 @@ async function getRcSessionContextUsage(deps, sessionId, detail) {
   const result = await deliverRcClientPayload(deps, sessionId, buildRcGetContextUsagePayload(requestId, detail), `request the context usage of session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
-async function readRcSessionFile(deps, sessionId, path35, options) {
-  if (path35 === "") {
+async function readRcSessionFile(deps, sessionId, path36, options) {
+  if (path36 === "") {
     return { ok: false, message: "a read-file write needs a non-empty path: the SDK's own field names the file the worker resolves against the session's cwd, and an empty string names none" };
   }
   if (options?.maxBytes !== void 0 && (!Number.isInteger(options.maxBytes) || options.maxBytes <= 0)) {
     return { ok: false, message: "a read-file write's max-bytes is a positive whole number of bytes: the SDK's own field caps the read, and a zero or negative cap reads nothing" };
   }
   const requestId = deps.newUuid();
-  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path35, options), `read ${path35} from session ${sessionId}`);
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path36, options), `read ${path36} from session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
 async function suggestRcSessionFiles(deps, sessionId, query) {
@@ -9398,11 +9547,11 @@ function createRcControlHandler(deps) {
       path: "read-file",
       read: (body) => {
         const session = bodyString(body, "session");
-        const path35 = bodyString(body, "path");
+        const path36 = bodyString(body, "path");
         const maxBytes = "maxBytes" in body ? bodyPositiveInteger(body, "maxBytes") : void 0;
         const encoding = "encoding" in body && isRcReadFileEncoding(body.encoding) ? body.encoding : void 0;
-        const refused2 = session === void 0 || path35 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
-        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path35, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
+        const refused2 = session === void 0 || path36 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
+        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path36, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
       }
     },
     {
@@ -9712,9 +9861,9 @@ function requestIdOfBody(body) {
 }
 function frontDoorRcControl(transport, token) {
   const headers = { authorization: `Bearer ${token}` };
-  const listAnswerOf = async (path35, what) => {
+  const listAnswerOf = async (path36, what) => {
     try {
-      return await transport.request({ method: "GET", path: path35, headers });
+      return await transport.request({ method: "GET", path: path36, headers });
     } catch (error) {
       throw new Error(`${what}: could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
     }
@@ -9786,10 +9935,10 @@ function frontDoorRcControl(transport, token) {
     }
     return pending;
   };
-  const writeOf = async (path35, body, describeFailure) => {
+  const writeOf = async (path36, body, describeFailure) => {
     let answer;
     try {
-      answer = await transport.request({ method: "POST", path: path35, headers: { ...headers, "content-type": "application/json" }, body });
+      answer = await transport.request({ method: "POST", path: path36, headers: { ...headers, "content-type": "application/json" }, body });
     } catch (error) {
       return { ok: false, message: `could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}` };
     }
@@ -9820,10 +9969,10 @@ function frontDoorRcControl(transport, token) {
     endSession: async (sessionId, reason) => await writeOf(`${CONTROL_PATH_PREFIX}/end-session`, JSON.stringify({ session: sessionId, ...reason === void 0 ? {} : { reason } }), (status, message) => `ending ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getUsage: async (sessionId, skipBehaviors) => await writeOf(`${CONTROL_PATH_PREFIX}/get-usage`, JSON.stringify({ session: sessionId, ...skipBehaviors === void 0 ? {} : { skipBehaviors } }), (status, message) => `requesting the usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getContextUsage: async (sessionId, detail) => await writeOf(`${CONTROL_PATH_PREFIX}/get-context-usage`, JSON.stringify({ session: sessionId, ...detail === void 0 ? {} : { detail } }), (status, message) => `requesting the context usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
-    readFile: async (sessionId, path35, options) => await writeOf(
+    readFile: async (sessionId, path36, options) => await writeOf(
       `${CONTROL_PATH_PREFIX}/read-file`,
-      JSON.stringify({ session: sessionId, path: path35, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
-      (status, message) => `reading ${path35} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
+      JSON.stringify({ session: sessionId, path: path36, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
+      (status, message) => `reading ${path36} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
     ),
     fileSuggestions: async (sessionId, query) => await writeOf(`${CONTROL_PATH_PREFIX}/file-suggestions`, JSON.stringify({ session: sessionId, query }), (status, message) => `requesting file suggestions from ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     keepAlive: async (sessionId) => await writeOf(`${CONTROL_PATH_PREFIX}/keep-alive`, JSON.stringify({ session: sessionId }), (status, message) => `keeping ${sessionId} alive failed (HTTP ${String(status)}): ${message}`),
@@ -9982,12 +10131,12 @@ function tlsFacts(options) {
 }
 function realRcEventDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const post = async (path35, headers, body) => await new Promise((resolve, reject) => {
+  const post = async (path36, headers, body) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method: "POST",
-      path: path35,
+      path: path36,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, "content-length": String(Buffer.byteLength(body, "utf8")) },
       agent
@@ -10052,12 +10201,12 @@ function lateRcStreamDial(resolve) {
 }
 function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const request4 = async (method, path35, headers, body, signal) => await new Promise((resolve, reject) => {
+  const request4 = async (method, path36, headers, body, signal) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method,
-      path: path35,
+      path: path36,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, ...body === void 0 ? {} : { "content-length": String(Buffer.byteLength(body, "utf8")) } },
       agent,
@@ -10099,9 +10248,9 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
       return { status, body: await readAll(response) };
     },
     openStream: async (sessionId, headers, resume, signal) => {
-      const path35 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
+      const path36 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
       const streamHeaders = resume === void 0 ? headers : { ...headers, "last-event-id": String(resume.fromSequenceNum) };
-      const { status, response } = await request4("GET", path35, streamHeaders, void 0, signal);
+      const { status, response } = await request4("GET", path36, streamHeaders, void 0, signal);
       if (!isSuccessful2(status)) {
         await readAll(response);
         return { status, chunks: NO_CHUNKS };
@@ -10684,9 +10833,9 @@ function doorApiNodeHandlerOf(router, expectedToken) {
       if (request4.method === "GET" && request4.url === `${RC_ORPC_PATH_PREFIX}${RC_OPENAPI_DOC_PATH}`) {
         const token = doorApiBearer(request4.headers);
         if (token === void 0 || !isLiveCapability(token, [expectedToken])) {
-          const refusal = new ORPCError("UNAUTHORIZED", { message: "the front door's OpenAPI document demands this generation's control token as a Bearer credential" });
+          const refusal2 = new ORPCError("UNAUTHORIZED", { message: "the front door's OpenAPI document demands this generation's control token as a Bearer credential" });
           response.writeHead(HTTP_STATUS.unauthorized, { "content-type": "application/json" });
-          response.end(JSON.stringify(refusal.toJSON()));
+          response.end(JSON.stringify(refusal2.toJSON()));
           return { matched: true };
         }
         try {
@@ -10694,17 +10843,21 @@ function doorApiNodeHandlerOf(router, expectedToken) {
           response.writeHead(HTTP_STATUS.ok, { "content-type": "application/json" });
           response.end(JSON.stringify(doc));
         } catch (error) {
-          const refusal = new ORPCError("INTERNAL_SERVER_ERROR", { message: `the OpenAPI document could not be generated from the door's own router: ${error instanceof Error ? error.message : String(error)}` });
+          const refusal2 = new ORPCError("INTERNAL_SERVER_ERROR", { message: `the OpenAPI document could not be generated from the door's own router: ${error instanceof Error ? error.message : String(error)}` });
           response.writeHead(HTTP_STATUS.internalServerError, { "content-type": "application/json" });
-          response.end(JSON.stringify(refusal.toJSON()));
+          response.end(JSON.stringify(refusal2.toJSON()));
         }
         return { matched: true };
       }
-      const rest = await restHandler.handle(request4, response, { context: { headers: request4.headers }, prefix: RC_ORPC_PATH_PREFIX });
+      const rest = await restHandler.handle(request4, response, { context: { headers: request4.headers, afterResponse: (action) => {
+        response.once("finish", action);
+      } }, prefix: RC_ORPC_PATH_PREFIX });
       if (rest.matched) {
         return rest;
       }
-      return await rpcHandler.handle(request4, response, { context: { headers: request4.headers }, prefix: RC_ORPC_PATH_PREFIX });
+      return await rpcHandler.handle(request4, response, { context: { headers: request4.headers, afterResponse: (action) => {
+        response.once("finish", action);
+      } }, prefix: RC_ORPC_PATH_PREFIX });
     }
   };
 }
@@ -10741,8 +10894,8 @@ init_cliError();
 init_realPorts();
 
 // src/frontdoor/controlApi.ts
-import { createORPCClient as createORPCClient2, ORPCError as ORPCError3 } from "@orpc/client";
-import { openapi as openapi3 } from "@orpc/openapi";
+import { createORPCClient as createORPCClient2, ORPCError as ORPCError6 } from "@orpc/client";
+import { openapi as openapi7 } from "@orpc/openapi";
 
 // src/checkReport.ts
 init_classify();
@@ -10926,6 +11079,48 @@ function removeProfile(paths, name) {
   requireProfileExists(paths, name);
   fs4.rmSync(profileJsonPath(paths, name));
 }
+function applyProfileChange(paths, name, change) {
+  let touched = false;
+  if (change.category !== void 0) {
+    setProfileCategories(paths, name, change.category);
+    touched = true;
+  }
+  if (change.entry !== void 0) {
+    setProfileEntries(paths, name, change.entry);
+    touched = true;
+  }
+  if (change.extends !== void 0 || change.description !== void 0) {
+    setProfileMetadata(paths, name, {
+      ...change.extends === void 0 ? {} : { extends: change.extends === false ? [] : change.extends },
+      ...change.description === void 0 ? {} : { description: change.description }
+    });
+    touched = true;
+  }
+  const launchPatch = {};
+  if (change.launchSkipPermissions !== void 0) {
+    launchPatch.skipPermissions = change.launchSkipPermissions;
+  }
+  if (change.launchRemoteControl !== void 0) {
+    launchPatch.remoteControl = change.launchRemoteControl;
+  }
+  if (change.launchHeadroom !== void 0) {
+    launchPatch.headroom = change.launchHeadroom;
+  }
+  if (change.launchTrackUsage !== void 0) {
+    launchPatch.trackUsage = change.launchTrackUsage;
+  }
+  if (change.launchProvider !== void 0) {
+    launchPatch.provider = change.launchProvider === false ? void 0 : change.launchProvider;
+  }
+  if (change.launchClaudeVersion !== void 0) {
+    launchPatch.claudeVersion = change.launchClaudeVersion === false ? void 0 : change.launchClaudeVersion;
+  }
+  if (Object.keys(launchPatch).length > 0) {
+    setProfileLaunchFlags(paths, name, launchPatch);
+    touched = true;
+  }
+  return touched;
+}
 
 // src/poolStore.ts
 init_store();
@@ -10969,19 +11164,19 @@ function writePools(paths, pools) {
   applyPatch(paths.globalConfigFile, GlobalConfigSchema, { pools }, { defaults: {} });
 }
 function poolCycleOf(pools, name) {
-  const walk = (current, path35) => {
+  const walk = (current, path36) => {
     for (const entry of pools[current]?.identities ?? []) {
       const nested = poolNameOf(poolMemberIdentity(entry));
       if (nested === void 0) {
         continue;
       }
       if (nested === name) {
-        return [...path35, nested];
+        return [...path36, nested];
       }
-      if (path35.includes(nested)) {
+      if (path36.includes(nested)) {
         continue;
       }
-      const found = walk(nested, [...path35, nested]);
+      const found = walk(nested, [...path36, nested]);
       if (found !== void 0) {
         return found;
       }
@@ -11699,6 +11894,14 @@ var InvalidIdentityNameError = class extends CliError {
 function identityJsonPath(paths, name) {
   return path27.join(paths.identitiesDir, name, "identity.json");
 }
+function requireIdentityNames(paths, names) {
+  const existing = new Set(listIdentities(paths).map((entry) => entry.name));
+  for (const name of names) {
+    if (poolNameOf(name) === void 0 && !existing.has(name)) {
+      throw new IdentityNotFoundError(name);
+    }
+  }
+}
 function identityExists(paths, name) {
   return fs9.existsSync(identityJsonPath(paths, name));
 }
@@ -12552,103 +12755,813 @@ var DoctorRunOutputSchema = z19.strictObject({
   ok: z19.boolean(),
   findings: z19.readonly(z19.array(DoctorFindingSchema))
 });
-
-// src/frontdoor/eventsApi.ts
-import { ORPCError as ORPCError2 } from "@orpc/client";
-import { openapi as openapi2 } from "@orpc/openapi";
-import { eventIterator as eventIterator2, withEventMeta as withEventMeta2 } from "@orpc/server";
-
-// src/frontdoor/eventSchemas.ts
-import { z as z20 } from "zod";
-var DOOR_EVENT_SOURCE_RC = "rc";
-var LAUNCH_EVENT_SOURCE = "launch";
-var USAGE_EVENT_SOURCE = "usage";
-var DOOR_HEALTH_EVENT_SOURCE = "door";
-var QUOTA_EXPIRING_EVENT_SOURCE = "quota-expiring";
-var DoorEventSchema = z20.strictObject({
-  source: z20.string().min(1),
-  /** A positive integer because the backbone's counters start at one and only ever increase. */
-  sequence: z20.number().int().positive(),
-  payload: z20.unknown()
-});
-var DoorEventSourceQuerySchema = z20.strictObject({
-  sources: z20.array(z20.string().min(1)).min(1).optional()
-});
-var LaunchLifecycleEventSchema = z20.strictObject({
-  kind: z20.enum(["registered", "pruned", "ended"]),
-  pid: z20.number().int().positive(),
-  startedAt: z20.number(),
-  observedAt: z20.number()
-});
-var DoorHealthEventSchema = z20.discriminatedUnion("kind", [
-  z20.strictObject({ kind: z20.literal("generation"), pid: z20.number().int().positive(), providerPort: z20.number().int().positive(), connectPort: z20.number().int().positive(), directPort: z20.number().int().positive(), observedAt: z20.number() }),
-  z20.strictObject({ kind: z20.literal("listenerFailed"), pid: z20.number().int().positive(), listener: z20.enum(["provider", "connect", "direct"]), message: z20.string(), observedAt: z20.number() }),
-  z20.strictObject({ kind: z20.literal("binaryTurnover"), pid: z20.number().int().positive(), observedAt: z20.number() }),
-  z20.strictObject({ kind: z20.literal("idleShutdown"), pid: z20.number().int().positive(), observedAt: z20.number() })
+var FrontDoorRestartOutputSchema = z19.strictObject({
+  action: z19.literal("restarting"),
+  previousPid: z19.int().positive()
+});
+var UpdateCheckOutputSchema = z19.strictObject({
+  current: z19.string(),
+  latest: z19.string(),
+  action: z19.enum(["current", "available", "updated"])
+});
+var CodexSignInSchema = z19.discriminatedUnion("state", [
+  z19.strictObject({ state: z19.literal("none") }),
+  z19.strictObject({ state: z19.literal("signed-in"), email: z19.string().optional(), planScope: z19.boolean(), accessTokenExpiresAt: z19.number() }),
+  z19.strictObject({ state: z19.literal("unreadable"), message: z19.string() })
 ]);
-var QuotaExpiringEventSchema = z20.strictObject({
-  identity: z20.string().min(1),
-  provider: z20.string().min(1),
-  window: z20.enum(["fiveHour", "sevenDay"]),
-  /** The fraction of the window already used when it was seen expiring, always below one because a fully used window has nothing left to spend. */
-  utilization: z20.number().min(0).max(1),
-  resetsAt: z20.iso.datetime(),
-  observedAt: z20.number()
+var CodexStatusOutputSchema = z19.strictObject({
+  signIn: CodexSignInSchema,
+  codexProviders: z19.readonly(z19.array(z19.string()))
+});
+var CodexLogoutOutputSchema = z19.strictObject({
+  hadGrant: z19.boolean(),
+  revoked: z19.boolean()
 });
 
-// src/frontdoor/eventsApi.ts
-var EVENTS_API_TAG = "events";
-function createEventsApiRouter(deps) {
+// src/frontdoor/codexApi.ts
+import { openapi as openapi2 } from "@orpc/openapi";
+var CODEX_API_TAG = "codex";
+function createCodexApiRouter(deps) {
   const authed = doorApiAuth(deps.expectedToken);
   return {
-    events: {
-      subscribe: authed.meta(openapi2({ method: "GET", path: "/rest/events", summary: "Stream the door's every event source (SSE)", tags: [EVENTS_API_TAG] })).input(DoorEventSourceQuerySchema).output(eventIterator2(DoorEventSchema)).handler(async function* ({ input, signal }) {
-        if (input.sources !== void 0) {
-          const live = deps.events.sources();
-          const unknown = input.sources.filter((source) => !live.includes(source));
-          if (unknown.length > 0) {
-            throw new ORPCError2("NOT_FOUND", { message: `the door publishes no event source named ${unknown.map((source) => `"${source}"`).join(", ")}; the live sources are ${live.map((source) => `"${source}"`).join(", ")}` });
-          }
-        }
-        const stream = deps.events.stream(input.sources);
-        const ended = new Promise((resolve) => {
-          signal?.addEventListener("abort", () => {
-            resolve();
-          }, { once: true });
-        });
-        try {
-          for (; ; ) {
-            signal?.throwIfAborted();
-            const next = await Promise.race([stream.next(), ended.then(() => ({ value: void 0, done: true }))]);
-            if (next.done === true) {
-              signal?.throwIfAborted();
-              return;
-            }
-            yield withEventMeta2(next.value, { id: String(next.value.sequence) });
-          }
-        } finally {
-          stream.close();
-        }
-      })
+    codex: {
+      status: authed.meta(openapi2({ method: "GET", path: "/rest/codex/status", summary: "Read the Codex sign-in and the codex providers", tags: [CODEX_API_TAG] })).output(CodexStatusOutputSchema).handler(() => {
+        const status = deps.codexStatus();
+        return { signIn: status.signIn, codexProviders: status.codexProviders };
+      }),
+      logout: authed.meta(openapi2({ method: "POST", path: "/rest/codex/logout", summary: "Revoke the Sign in with ChatGPT login and remove it", tags: [CODEX_API_TAG] })).output(CodexLogoutOutputSchema).handler(async () => await deps.codexLogout())
     }
   };
 }
 
-// src/frontdoor/controlApi.ts
-var USAGE_API_TAG = "usage";
-var FRONTDOOR_API_TAG = "frontdoor";
-var CHECK_API_TAG = "check";
-var DOCTOR_API_TAG = "doctor";
-var POOL_API_TAG = "pool";
-function createControlApiRouter(deps) {
-  const authed = doorApiAuth(deps.expectedToken);
+// src/frontdoor/configApi.ts
+init_cliError();
+init_schema();
+import { ORPCError as ORPCError2 } from "@orpc/client";
+import { openapi as openapi3 } from "@orpc/openapi";
+init_credential();
+
+// src/credentialCacheChange.ts
+init_cliError();
+init_schema();
+function mergeCredentialCache(request4, existing) {
+  if (request4.enabled === false) {
+    return false;
+  }
+  if (request4.ttl === void 0 && request4.store === void 0 && request4.enabled !== true) {
+    return void 0;
+  }
+  const parsed = CredentialCacheSchema.safeParse({
+    ...existing,
+    ...request4.ttl === void 0 ? {} : { ttl: request4.ttl },
+    ...request4.store === void 0 ? {} : { store: request4.store }
+  });
+  if (!parsed.success) {
+    throw new UsageError(parsed.error.issues.map((issue) => issue.message).join("; "));
+  }
+  return parsed.data;
+}
+
+// src/directoryRulesStore.ts
+init_store();
+init_load();
+init_schema();
+init_cliError();
+var DirectoryRuleNotFoundError = class extends CliError {
+  constructor(rulePath) {
+    super(`No directory rule found for path "${rulePath}".`);
+    this.rulePath = rulePath;
+    this.name = "DirectoryRuleNotFoundError";
+  }
+  rulePath;
+};
+var DirectoryRuleMissingTargetError = class extends CliError {
+  constructor() {
+    super("A directory rule must set at least one of --config-profile or --identity.");
+    this.name = "DirectoryRuleMissingTargetError";
+  }
+};
+var DirectoryRuleAlreadyExistsError = class extends CliError {
+  constructor(rulePath) {
+    super(`A directory rule for path "${rulePath}" already exists. Use \`agent-shim rule set\` to change it.`);
+    this.rulePath = rulePath;
+    this.name = "DirectoryRuleAlreadyExistsError";
+  }
+  rulePath;
+};
+function readDirectoryRules(paths) {
+  return readJson(paths.directoryRulesFile, DirectoryRulesSchema) ?? { rules: [] };
+}
+function writeDirectoryRules(paths, rules) {
+  const parsed = DirectoryRulesSchema.safeParse(rules);
+  if (!parsed.success) {
+    throw new ConfigValidationError(paths.directoryRulesFile, parsed.error.issues);
+  }
+  writeJsonAtomic(paths.directoryRulesFile, parsed.data);
+}
+function listDirectoryRules(paths) {
+  return readDirectoryRules(paths).rules;
+}
+function addDirectoryRule(paths, rulePath, options) {
+  if (options.configProfile === void 0 && options.identity === void 0) {
+    throw new DirectoryRuleMissingTargetError();
+  }
+  const current = readDirectoryRules(paths);
+  if (current.rules.some((rule) => rule.path === rulePath)) {
+    throw new DirectoryRuleAlreadyExistsError(rulePath);
+  }
+  const created = buildNewRule(rulePath, options);
+  writeDirectoryRules(paths, { ...current, rules: [...current.rules, created] });
+  return created;
+}
+function ruleHasEffect(rule) {
+  return rule.configProfile !== void 0 || rule.identity !== void 0 || rule.categories !== void 0 || rule.entries !== void 0 || rule.launch !== void 0;
+}
+function updateDirectoryRule(paths, rulePath, options) {
+  const current = readDirectoryRules(paths);
+  const index = current.rules.findIndex((rule) => rule.path === rulePath);
+  const existing = index === -1 ? void 0 : current.rules[index];
+  if (existing === void 0) {
+    throw new DirectoryRuleNotFoundError(rulePath);
+  }
+  const { configProfile, identity, ...rest } = existing;
+  const nextConfigProfile = options.configProfile === void 0 ? configProfile : options.configProfile === false ? void 0 : options.configProfile;
+  const nextIdentity = options.identity === void 0 ? identity : options.identity === false ? void 0 : options.identity;
+  const updated = {
+    ...rest,
+    ...nextConfigProfile === void 0 ? {} : { configProfile: nextConfigProfile },
+    ...nextIdentity === void 0 ? {} : { identity: nextIdentity }
+  };
+  if (!ruleHasEffect(updated)) {
+    throw new DirectoryRuleMissingTargetError();
+  }
+  const nextRules = [...current.rules];
+  nextRules[index] = updated;
+  writeDirectoryRules(paths, { ...current, rules: nextRules });
+  return updated;
+}
+function buildNewRule(rulePath, options) {
+  return {
+    path: rulePath,
+    ...options.configProfile !== void 0 ? { configProfile: options.configProfile } : {},
+    ...options.identity !== void 0 ? { identity: options.identity } : {}
+  };
+}
+function removeDirectoryRule(paths, rulePath) {
+  const current = readDirectoryRules(paths);
+  const nextRules = current.rules.filter((rule) => rule.path !== rulePath);
+  if (nextRules.length === current.rules.length) {
+    throw new DirectoryRuleNotFoundError(rulePath);
+  }
+  writeDirectoryRules(paths, { ...current, rules: nextRules });
+}
+function requireRuleSelector(paths, selector) {
+  if (selector.startsWith(POOL_SELECTOR_PREFIX)) {
+    const poolName = selector.slice(POOL_SELECTOR_PREFIX.length);
+    if (readPools(paths)[poolName] === void 0) {
+      throw new PoolNotFoundError(poolName);
+    }
+  } else if (readIdentity(paths, selector) === void 0) {
+    throw new IdentityNotFoundError(selector);
+  }
+}
+
+// src/frontdoor/configApi.ts
+init_identity();
+init_providersStore();
+
+// src/frontdoor/configSchemas.ts
+init_schema();
+import { z as z20 } from "zod";
+var RemovalConfirmationSchema = z20.boolean();
+var CredentialWriteSchema = (targets) => z20.strictObject({
+  sources: z20.array(RemoteCredentialSourceSchema).min(1).optional(),
+  target: z20.enum(targets).optional(),
+  cache: z20.union([z20.literal(false), CredentialCacheSchema]).optional()
+});
+var CredentialSummarySchema2 = z20.strictObject({
+  target: z20.enum(CREDENTIAL_TARGETS),
+  sources: z20.readonly(z20.array(
+    z20.discriminatedUnion("kind", [
+      z20.strictObject({ kind: z20.literal("env"), variable: z20.string() }),
+      z20.strictObject({ kind: z20.literal("file"), path: z20.string() }),
+      z20.strictObject({ kind: z20.literal("command"), program: z20.string() }),
+      z20.strictObject({ kind: z20.literal("op"), reference: z20.string() }),
+      z20.strictObject({ kind: z20.literal("keychain"), service: z20.string(), account: z20.string().optional() }),
+      z20.strictObject({ kind: z20.literal("literal") })
+    ])
+  )),
+  cache: CredentialCacheSchema.optional()
+});
+var mutationOutput = (kind, action) => z20.strictObject({ action: z20.literal(action), kind: z20.literal(kind), name: z20.string() });
+var storedMutationOutput = (kind, action, value) => z20.strictObject({ action: z20.literal(action), kind: z20.literal(kind), name: z20.string(), value });
+var IdentityValueSchema = z20.strictObject({
+  name: z20.string(),
+  defaultConfigProfile: z20.string().optional(),
+  allowAmbientCredential: z20.boolean(),
+  credential: CredentialSummarySchema2.optional()
+});
+var ProfileValueSchema = ConfigProfileSchema.omit({ $schema: true });
+var ProviderValueSchema = z20.strictObject({
+  name: z20.string(),
+  kind: z20.enum(PROVIDER_KINDS),
+  displayName: z20.string(),
+  baseUrl: z20.string().optional(),
+  codex: CodexProviderConfigSchema.optional(),
+  credential: CredentialSummarySchema2,
+  env: z20.record(z20.string(), z20.string()).optional()
+});
+var ConfigNameInputSchema = z20.strictObject({ name: z20.string().min(1) });
+var ConfigIdentityAddOutputSchema = storedMutationOutput("identity", "created", IdentityValueSchema);
+var ConfigIdentitySetInputSchema = z20.strictObject({
+  name: z20.string().min(1),
+  defaultConfigProfile: z20.union([z20.string().min(1), z20.literal(false)]).optional(),
+  allowAmbientCredential: z20.boolean().optional(),
+  credential: z20.union([z20.literal(false), CredentialWriteSchema(CREDENTIAL_TARGETS)]).optional()
+});
+var ConfigIdentitySetOutputSchema = storedMutationOutput("identity", "updated", IdentityValueSchema);
+var ConfigIdentityRemoveInputSchema = z20.strictObject({ name: z20.string().min(1), confirm: RemovalConfirmationSchema });
+var ConfigIdentityRemoveOutputSchema = mutationOutput("identity", "removed");
+var ConfigIdentityUseOutputSchema = mutationOutput("identity", "selected");
+var ConfigProfileAddInputSchema = z20.strictObject({
+  name: z20.string().min(1),
+  extends: z20.array(z20.string().min(1)).optional(),
+  description: z20.string().optional()
+});
+var ConfigProfileAddOutputSchema = storedMutationOutput("profile", "created", ProfileValueSchema);
+var ConfigProfileSetInputSchema = z20.strictObject({
+  name: z20.string().min(1),
+  category: z20.record(z20.string(), z20.boolean()).optional(),
+  entry: z20.record(z20.string(), z20.boolean()).optional(),
+  extends: z20.union([z20.array(z20.string().min(1)), z20.literal(false)]).optional(),
+  description: z20.union([z20.string(), z20.literal(false)]).optional(),
+  launch: z20.strictObject({
+    skipPermissions: z20.boolean().optional(),
+    remoteControl: z20.boolean().optional(),
+    headroom: z20.boolean().optional(),
+    trackUsage: z20.boolean().optional(),
+    provider: z20.union([z20.string().min(1), z20.literal(false)]).optional(),
+    claudeVersion: z20.union([z20.string().min(1), z20.literal(false)]).optional()
+  }).optional()
+});
+var ConfigProfileSetOutputSchema = storedMutationOutput("profile", "updated", ProfileValueSchema);
+var ConfigProfileRemoveInputSchema = z20.strictObject({ name: z20.string().min(1), confirm: RemovalConfirmationSchema });
+var ConfigProfileRemoveOutputSchema = mutationOutput("profile", "removed");
+var ConfigProfileUseOutputSchema = mutationOutput("profile", "selected");
+var PoolMembersInputSchema = z20.array(z20.string().min(1)).min(1);
+var ConfigPoolAddInputSchema = z20.strictObject({
+  name: z20.string().min(1),
+  identities: PoolMembersInputSchema,
+  preference: z20.enum(POOL_PREFERENCES).optional()
+});
+var ConfigPoolAddOutputSchema = storedMutationOutput("pool", "created", PoolSchema);
+var ConfigPoolSetInputSchema = z20.strictObject({
+  name: z20.string().min(1),
+  identities: PoolMembersInputSchema.optional(),
+  preference: z20.union([z20.enum(POOL_PREFERENCES), z20.literal(false)]).optional()
+});
+var ConfigPoolSetOutputSchema = storedMutationOutput("pool", "updated", PoolSchema);
+var ConfigPoolRemoveInputSchema = z20.strictObject({ name: z20.string().min(1), confirm: RemovalConfirmationSchema });
+var ConfigPoolRemoveOutputSchema = mutationOutput("pool", "removed");
+var ConfigPoolUseOutputSchema = mutationOutput("pool", "selected");
+var ConfigProviderAddInputSchema = z20.strictObject({
+  name: z20.string().min(1),
+  kind: z20.enum(PROVIDER_KINDS).optional(),
+  displayName: z20.string().min(1),
+  baseUrl: z20.string().min(1).optional(),
+  credential: CredentialWriteSchema(PROVIDER_CREDENTIAL_TARGETS).required({ sources: true }),
+  codex: CodexProviderConfigSchema.optional()
+});
+var ConfigProviderAddOutputSchema = storedMutationOutput("provider", "created", ProviderValueSchema);
+var ConfigProviderSetInputSchema = z20.strictObject({
+  name: z20.string().min(1),
+  displayName: z20.string().min(1).optional(),
+  baseUrl: z20.string().min(1).optional(),
+  credential: CredentialWriteSchema(PROVIDER_CREDENTIAL_TARGETS).optional(),
+  codex: CodexProviderConfigSchema.optional()
+});
+var ConfigProviderSetOutputSchema = storedMutationOutput("provider", "updated", ProviderValueSchema);
+var ConfigProviderRemoveInputSchema = z20.strictObject({ name: z20.string().min(1), confirm: RemovalConfirmationSchema });
+var ConfigProviderRemoveOutputSchema = mutationOutput("provider", "removed");
+var ConfigRuleAddInputSchema = z20.strictObject({
+  path: z20.string().min(1),
+  configProfile: z20.string().min(1).optional(),
+  identity: z20.string().min(1).optional()
+});
+var ConfigRuleAddOutputSchema = storedMutationOutput("rule", "created", DirectoryRuleSchema);
+var ConfigRuleSetInputSchema = z20.strictObject({
+  path: z20.string().min(1),
+  configProfile: z20.union([z20.string().min(1), z20.literal(false)]).optional(),
+  identity: z20.union([z20.string().min(1), z20.literal(false)]).optional()
+});
+var ConfigRuleSetOutputSchema = storedMutationOutput("rule", "updated", DirectoryRuleSchema);
+var ConfigRuleRemoveInputSchema = z20.strictObject({ path: z20.string().min(1), confirm: RemovalConfirmationSchema });
+var ConfigRuleRemoveOutputSchema = mutationOutput("rule", "removed");
+
+// src/frontdoor/configApi.ts
+var CONFIG_API_TAG = "config";
+function refusal(error) {
+  if (error instanceof IdentityNotFoundError || error instanceof ProfileNotFoundError || error instanceof PoolNotFoundError || error instanceof ProviderNotFoundError || error instanceof DirectoryRuleNotFoundError) {
+    throw new ORPCError2("NOT_FOUND", { message: error.message });
+  }
+  if (error instanceof IdentityAlreadyExistsError || error instanceof ProfileAlreadyExistsError || error instanceof PoolAlreadyExistsError || error instanceof ProviderAlreadyExistsError || error instanceof DirectoryRuleAlreadyExistsError) {
+    throw new ORPCError2("CONFLICT", { message: error.message });
+  }
+  if (error instanceof CliError) {
+    throw new ORPCError2("BAD_REQUEST", { message: error.message });
+  }
+  throw error;
+}
+function guarded(write) {
+  try {
+    return write();
+  } catch (error) {
+    return refusal(error);
+  }
+}
+function requireConfirmation(confirm, what) {
+  if (!confirm) {
+    throw new ORPCError2("BAD_REQUEST", { message: `removing ${what} needs confirm: true, the API's form of the CLI's --yes` });
+  }
+}
+function requireChange(given, fields) {
+  if (!given) {
+    throw new ORPCError2("BAD_REQUEST", { message: `Nothing to change: pass ${fields}.` });
+  }
+}
+function identityValue(name, paths) {
+  const identity = readIdentity(paths, name);
+  if (identity === void 0) {
+    throw new IdentityNotFoundError(name);
+  }
+  return {
+    name: identity.name,
+    ...identity.defaultConfigProfile === void 0 ? {} : { defaultConfigProfile: identity.defaultConfigProfile },
+    allowAmbientCredential: identity.allowAmbientCredential,
+    ...identity.credential === void 0 ? {} : { credential: summariseCredential(identity.credential) }
+  };
+}
+function providerValue(name, provider) {
+  return {
+    name,
+    kind: provider.kind ?? "http",
+    displayName: provider.displayName,
+    ...isCodexProvider(provider) ? provider.codex === void 0 ? {} : { codex: provider.codex } : { baseUrl: provider.baseUrl },
+    credential: summariseCredential(provider.credential),
+    ...provider.env === void 0 ? {} : { env: provider.env }
+  };
+}
+function profileValue(name, paths) {
+  const profile = { ...readProfile(paths, name) };
+  delete profile.$schema;
+  return profile;
+}
+function createConfigApiRouter(deps) {
+  const authed = doorApiAuth(deps.expectedToken);
+  const { paths } = deps;
+  const route = (path36, summary) => authed.meta(openapi3({ method: "POST", path: path36, summary, tags: [CONFIG_API_TAG] }));
+  return {
+    config: {
+      identity: {
+        add: route("/rest/config/identity/add", "Create an identity").input(ConfigNameInputSchema).output(ConfigIdentityAddOutputSchema).handler(
+          ({ input }) => guarded(() => {
+            addIdentity(paths, input.name);
+            return { action: "created", kind: "identity", name: input.name, value: identityValue(input.name, paths) };
+          })
+        ),
+        set: route("/rest/config/identity/set", "Update an identity's default profile, ambient-credential setting or credential").input(ConfigIdentitySetInputSchema).output(ConfigIdentitySetOutputSchema).handler(
+          ({ input }) => guarded(() => {
+            requireChange(input.defaultConfigProfile !== void 0 || input.allowAmbientCredential !== void 0 || input.credential !== void 0, "defaultConfigProfile, allowAmbientCredential or credential");
+            if (!identityExists(paths, input.name)) {
+              throw new IdentityNotFoundError(input.name);
+            }
+            if (typeof input.defaultConfigProfile === "string") {
+              requireProfileExists(paths, input.defaultConfigProfile);
+            }
+            if (input.defaultConfigProfile !== void 0) {
+              setDefaultConfigProfile(paths, input.name, input.defaultConfigProfile === false ? void 0 : input.defaultConfigProfile);
+            }
+            if (input.allowAmbientCredential !== void 0) {
+              setAllowAmbientCredential(paths, input.name, input.allowAmbientCredential);
+            }
+            if (input.credential === false) {
+              setIdentityCredential(paths, input.name, false);
+            } else if (input.credential !== void 0) {
+              const { sources, target, cache } = input.credential;
+              const merged = cache === void 0 ? void 0 : mergeCredentialCache(cache === false ? { enabled: false } : { ...cache, enabled: true }, readIdentity(paths, input.name)?.credential?.cache);
+              const change = {
+                ...sources === void 0 ? {} : { sources },
+                ...target === void 0 ? {} : { target },
+                ...merged === void 0 ? {} : { cache: merged }
+              };
+              setIdentityCredential(paths, input.name, change);
+            }
+            return { action: "updated", kind: "identity", name: input.name, value: identityValue(input.name, paths) };
+          })
+        ),
+        remove: route("/rest/config/identity/remove", "Delete an identity and its directory").input(ConfigIdentityRemoveInputSchema).output(ConfigIdentityRemoveOutputSchema).handler(({ input }) => {
+          requireConfirmation(input.confirm, `identity "${input.name}" and its directory`);
+          return guarded(() => {
+            removeIdentity(paths, input.name);
+            return { action: "removed", kind: "identity", name: input.name };
+          });
+        }),
+        use: route("/rest/config/identity/use", "Select the active identity").input(ConfigNameInputSchema).output(ConfigIdentityUseOutputSchema).handler(
+          ({ input }) => guarded(() => {
+            if (poolNameOf(input.name) === void 0 && !identityExists(paths, input.name)) {
+              throw new IdentityNotFoundError(input.name);
+            }
+            useIdentity(paths, input.name);
+            return { action: "selected", kind: "identity", name: input.name };
+          })
+        )
+      },
+      profile: {
+        add: route("/rest/config/profile/add", "Create a configuration profile").input(ConfigProfileAddInputSchema).output(ConfigProfileAddOutputSchema).handler(
+          ({ input }) => guarded(() => {
+            createProfile(paths, input.name, input.extends, input.description);
+            return { action: "created", kind: "profile", name: input.name, value: profileValue(input.name, paths) };
+          })
+        ),
+        set: route("/rest/config/profile/set", "Update a configuration profile's categories, entries, extends list, description or launch settings").input(ConfigProfileSetInputSchema).output(ConfigProfileSetOutputSchema).handler(
+          ({ input }) => guarded(() => {
+            const { launch } = input;
+            requireChange(
+              input.category !== void 0 || input.entry !== void 0 || input.extends !== void 0 || input.description !== void 0 || launch !== void 0,
+              "category, entry, extends, description or launch"
+            );
+            requireProfileExists(paths, input.name);
+            applyProfileChange(paths, input.name, {
+              ...input.category === void 0 ? {} : { category: input.category },
+              ...input.entry === void 0 ? {} : { entry: input.entry },
+              ...input.extends === void 0 ? {} : { extends: input.extends },
+              ...input.description === void 0 ? {} : { description: input.description },
+              ...launch?.skipPermissions === void 0 ? {} : { launchSkipPermissions: launch.skipPermissions },
+              ...launch?.remoteControl === void 0 ? {} : { launchRemoteControl: launch.remoteControl },
+              ...launch?.headroom === void 0 ? {} : { launchHeadroom: launch.headroom },
+              ...launch?.trackUsage === void 0 ? {} : { launchTrackUsage: launch.trackUsage },
+              ...launch?.provider === void 0 ? {} : { launchProvider: launch.provider },
+              ...launch?.claudeVersion === void 0 ? {} : { launchClaudeVersion: launch.claudeVersion }
+            });
+            return { action: "updated", kind: "profile", name: input.name, value: profileValue(input.name, paths) };
+          })
+        ),
+        remove: route("/rest/config/profile/remove", "Delete a configuration profile").input(ConfigProfileRemoveInputSchema).output(ConfigProfileRemoveOutputSchema).handler(({ input }) => {
+          requireConfirmation(input.confirm, `configuration profile "${input.name}"`);
+          return guarded(() => {
+            removeProfile(paths, input.name);
+            return { action: "removed", kind: "profile", name: input.name };
+          });
+        }),
+        use: route("/rest/config/profile/use", "Make a configuration profile the global default").input(ConfigNameInputSchema).output(ConfigProfileUseOutputSchema).handler(
+          ({ input }) => guarded(() => {
+            requireProfileExists(paths, input.name);
+            setGlobalDefaultProfile(paths, input.name);
+            return { action: "selected", kind: "profile", name: input.name };
+          })
+        )
+      },
+      pool: {
+        add: route("/rest/config/pool/add", "Define a pool").input(ConfigPoolAddInputSchema).output(ConfigPoolAddOutputSchema).handler(
+          ({ input }) => guarded(() => {
+            requireIdentityNames(paths, input.identities);
+            const created = addPool(paths, input.name, input.identities, input.preference);
+            return { action: "created", kind: "pool", name: input.name, value: created };
+          })
+        ),
+        set: route("/rest/config/pool/set", "Replace a pool's members, its preference or both").input(ConfigPoolSetInputSchema).output(ConfigPoolSetOutputSchema).handler(
+          ({ input }) => guarded(() => {
+            requireChange(input.identities !== void 0 || input.preference !== void 0, "identities or preference");
+            const existing = requirePool(paths, input.name);
+            if (input.identities !== void 0) {
+              requireIdentityNames(paths, input.identities);
+            }
+            const members = input.identities ?? existing.identities;
+            const preference = input.preference === void 0 ? existing.preference : input.preference === false ? void 0 : input.preference;
+            return { action: "updated", kind: "pool", name: input.name, value: setPool(paths, input.name, members, preference) };
+          })
+        ),
+        remove: route("/rest/config/pool/remove", "Delete a pool").input(ConfigPoolRemoveInputSchema).output(ConfigPoolRemoveOutputSchema).handler(({ input }) => {
+          requireConfirmation(input.confirm, `pool "${input.name}"`);
+          return guarded(() => {
+            removePool(paths, input.name);
+            return { action: "removed", kind: "pool", name: input.name };
+          });
+        }),
+        use: route("/rest/config/pool/use", "Make launches with no other selection pick a member of a pool").input(ConfigNameInputSchema).output(ConfigPoolUseOutputSchema).handler(
+          ({ input }) => guarded(() => {
+            if (readPools(paths)[input.name] === void 0) {
+              throw new PoolNotFoundError(input.name);
+            }
+            useIdentity(paths, `pool:${input.name}`);
+            return { action: "selected", kind: "pool", name: input.name };
+          })
+        )
+      },
+      provider: {
+        add: route("/rest/config/provider/add", "Create an API provider definition").input(ConfigProviderAddInputSchema).output(ConfigProviderAddOutputSchema).handler(
+          ({ input }) => guarded(() => {
+            const created = addProvider(paths, input.name, {
+              ...input.kind === void 0 ? {} : { kind: input.kind },
+              displayName: input.displayName,
+              ...input.baseUrl === void 0 ? {} : { baseUrl: input.baseUrl },
+              sources: input.credential.sources,
+              ...input.credential.target === void 0 ? {} : { target: input.credential.target },
+              ...input.codex === void 0 ? {} : { codex: input.codex }
+            });
+            const cache = input.credential.cache;
+            const stored = cache === void 0 || cache === false ? created : updateProvider(paths, input.name, { cache });
+            return { action: "created", kind: "provider", name: input.name, value: providerValue(input.name, stored) };
+          })
+        ),
+        set: route("/rest/config/provider/set", "Update an API provider definition").input(ConfigProviderSetInputSchema).output(ConfigProviderSetOutputSchema).handler(
+          ({ input }) => guarded(() => {
+            requireChange(input.displayName !== void 0 || input.baseUrl !== void 0 || input.credential !== void 0 || input.codex !== void 0, "displayName, baseUrl, credential or codex");
+            const existing = readProvider(paths, input.name);
+            if (existing === void 0) {
+              throw new ProviderNotFoundError(input.name);
+            }
+            const credential = input.credential;
+            if (input.baseUrl !== void 0 && !isCodexProvider(existing) && input.baseUrl !== existing.baseUrl && credential?.sources === void 0) {
+              throw new ORPCError2("BAD_REQUEST", { message: `Changing the base URL of provider "${input.name}" requires a credential block in the same call: the stored credential is not sent to a different endpoint.` });
+            }
+            const cache = credential?.cache === void 0 ? void 0 : mergeCredentialCache(credential.cache === false ? { enabled: false } : { ...credential.cache, enabled: true }, existing.credential.cache);
+            const updated = updateProvider(paths, input.name, {
+              ...input.displayName === void 0 ? {} : { displayName: input.displayName },
+              ...input.baseUrl === void 0 ? {} : { baseUrl: input.baseUrl },
+              ...credential?.sources === void 0 ? {} : { sources: credential.sources },
+              ...credential?.target === void 0 ? {} : { target: credential.target },
+              ...cache === void 0 ? {} : { cache },
+              ...input.codex === void 0 ? {} : { codex: input.codex }
+            });
+            return { action: "updated", kind: "provider", name: input.name, value: providerValue(input.name, updated) };
+          })
+        ),
+        remove: route("/rest/config/provider/remove", "Delete an API provider definition").input(ConfigProviderRemoveInputSchema).output(ConfigProviderRemoveOutputSchema).handler(({ input }) => {
+          requireConfirmation(input.confirm, `provider "${input.name}"`);
+          return guarded(() => {
+            if (!providerExists(paths, input.name)) {
+              throw new ProviderNotFoundError(input.name);
+            }
+            removeProvider(paths, input.name);
+            return { action: "removed", kind: "provider", name: input.name };
+          });
+        })
+      },
+      rule: {
+        add: route("/rest/config/rule/add", "Add a directory rule for a path").input(ConfigRuleAddInputSchema).output(ConfigRuleAddOutputSchema).handler(
+          ({ input }) => guarded(() => {
+            if (input.identity !== void 0) {
+              requireRuleSelector(paths, input.identity);
+            }
+            if (input.configProfile !== void 0) {
+              requireProfileExists(paths, input.configProfile);
+            }
+            const created = addDirectoryRule(paths, input.path, {
+              ...input.configProfile === void 0 ? {} : { configProfile: input.configProfile },
+              ...input.identity === void 0 ? {} : { identity: input.identity }
+            });
+            return { action: "created", kind: "rule", name: input.path, value: created };
+          })
+        ),
+        set: route("/rest/config/rule/set", "Update the directory rule for a path").input(ConfigRuleSetInputSchema).output(ConfigRuleSetOutputSchema).handler(
+          ({ input }) => guarded(() => {
+            requireChange(input.configProfile !== void 0 || input.identity !== void 0, "configProfile or identity");
+            if (typeof input.identity === "string") {
+              requireRuleSelector(paths, input.identity);
+            }
+            if (typeof input.configProfile === "string") {
+              requireProfileExists(paths, input.configProfile);
+            }
+            const updated = updateDirectoryRule(paths, input.path, {
+              ...input.configProfile === void 0 ? {} : { configProfile: input.configProfile },
+              ...input.identity === void 0 ? {} : { identity: input.identity }
+            });
+            return { action: "updated", kind: "rule", name: input.path, value: updated };
+          })
+        ),
+        remove: route("/rest/config/rule/remove", "Remove the directory rule for a path").input(ConfigRuleRemoveInputSchema).output(ConfigRuleRemoveOutputSchema).handler(({ input }) => {
+          requireConfirmation(input.confirm, `the directory rule for "${input.path}"`);
+          return guarded(() => {
+            if (!listDirectoryRules(paths).some((entry) => entry.path === input.path)) {
+              throw new DirectoryRuleNotFoundError(input.path);
+            }
+            removeDirectoryRule(paths, input.path);
+            return { action: "removed", kind: "rule", name: input.path };
+          });
+        })
+      }
+    }
+  };
+}
+
+// src/frontdoor/eventsApi.ts
+import { ORPCError as ORPCError3 } from "@orpc/client";
+import { openapi as openapi4 } from "@orpc/openapi";
+import { eventIterator as eventIterator2, withEventMeta as withEventMeta2 } from "@orpc/server";
+
+// src/frontdoor/eventSchemas.ts
+import { z as z21 } from "zod";
+var DOOR_EVENT_SOURCE_RC = "rc";
+var LAUNCH_EVENT_SOURCE = "launch";
+var USAGE_EVENT_SOURCE = "usage";
+var DOOR_HEALTH_EVENT_SOURCE = "door";
+var QUOTA_EXPIRING_EVENT_SOURCE = "quota-expiring";
+var DoorEventSchema = z21.strictObject({
+  source: z21.string().min(1),
+  /** A positive integer because the backbone's counters start at one and only ever increase. */
+  sequence: z21.number().int().positive(),
+  payload: z21.unknown()
+});
+var DoorEventSourceQuerySchema = z21.strictObject({
+  sources: z21.array(z21.string().min(1)).min(1).optional()
+});
+var LaunchLifecycleEventSchema = z21.strictObject({
+  kind: z21.enum(["registered", "pruned", "ended"]),
+  pid: z21.number().int().positive(),
+  startedAt: z21.number(),
+  observedAt: z21.number()
+});
+var DoorHealthEventSchema = z21.discriminatedUnion("kind", [
+  z21.strictObject({ kind: z21.literal("generation"), pid: z21.number().int().positive(), providerPort: z21.number().int().positive(), connectPort: z21.number().int().positive(), directPort: z21.number().int().positive(), observedAt: z21.number() }),
+  z21.strictObject({ kind: z21.literal("listenerFailed"), pid: z21.number().int().positive(), listener: z21.enum(["provider", "connect", "direct"]), message: z21.string(), observedAt: z21.number() }),
+  z21.strictObject({ kind: z21.literal("binaryTurnover"), pid: z21.number().int().positive(), observedAt: z21.number() }),
+  z21.strictObject({ kind: z21.literal("idleShutdown"), pid: z21.number().int().positive(), observedAt: z21.number() })
+]);
+var QuotaExpiringEventSchema = z21.strictObject({
+  identity: z21.string().min(1),
+  provider: z21.string().min(1),
+  window: z21.enum(["fiveHour", "sevenDay"]),
+  /** The fraction of the window already used when it was seen expiring, always below one because a fully used window has nothing left to spend. */
+  utilization: z21.number().min(0).max(1),
+  resetsAt: z21.iso.datetime(),
+  observedAt: z21.number()
+});
+
+// src/frontdoor/eventsApi.ts
+var EVENTS_API_TAG = "events";
+function createEventsApiRouter(deps) {
+  const authed = doorApiAuth(deps.expectedToken);
+  return {
+    events: {
+      subscribe: authed.meta(openapi4({ method: "GET", path: "/rest/events", summary: "Stream the door's every event source (SSE)", tags: [EVENTS_API_TAG] })).input(DoorEventSourceQuerySchema).output(eventIterator2(DoorEventSchema)).handler(async function* ({ input, signal }) {
+        if (input.sources !== void 0) {
+          const live = deps.events.sources();
+          const unknown = input.sources.filter((source) => !live.includes(source));
+          if (unknown.length > 0) {
+            throw new ORPCError3("NOT_FOUND", { message: `the door publishes no event source named ${unknown.map((source) => `"${source}"`).join(", ")}; the live sources are ${live.map((source) => `"${source}"`).join(", ")}` });
+          }
+        }
+        const stream = deps.events.stream(input.sources);
+        const ended = new Promise((resolve) => {
+          signal?.addEventListener("abort", () => {
+            resolve();
+          }, { once: true });
+        });
+        try {
+          for (; ; ) {
+            signal?.throwIfAborted();
+            const next = await Promise.race([stream.next(), ended.then(() => ({ value: void 0, done: true }))]);
+            if (next.done === true) {
+              signal?.throwIfAborted();
+              return;
+            }
+            yield withEventMeta2(next.value, { id: String(next.value.sequence) });
+          }
+        } finally {
+          stream.close();
+        }
+      })
+    }
+  };
+}
+
+// src/frontdoor/lifecycleApi.ts
+init_update();
+import { ORPCError as ORPCError4 } from "@orpc/client";
+import { openapi as openapi5 } from "@orpc/openapi";
+var FRONTDOOR_API_TAG = "frontdoor";
+var UPDATE_API_TAG = "update";
+function createLifecycleApiRouter(deps) {
+  const authed = doorApiAuth(deps.expectedToken);
+  return {
+    frontdoor: {
+      restart: authed.meta(openapi5({ method: "POST", path: "/rest/frontdoor/restart", summary: "Replace the serving front door in place", description: "Answers with the pid of the door being replaced, then replaces it. The replacement is a new generation with its own control token: the caller reopens its client from the state root once the door's supervisor pid differs from the one returned.", tags: [FRONTDOOR_API_TAG] })).output(FrontDoorRestartOutputSchema).handler(({ context }) => {
+        context.afterResponse(deps.restartDoor);
+        return { action: "restarting", previousPid: deps.doorPid };
+      })
+    },
+    update: {
+      check: authed.meta(openapi5({ method: "GET", path: "/rest/update/check", summary: "Check whether a newer release exists", tags: [UPDATE_API_TAG] })).output(UpdateCheckOutputSchema).handler(async () => {
+        try {
+          return await deps.checkForUpdate();
+        } catch (error) {
+          if (error instanceof UpdateChannelError) {
+            throw new ORPCError4("PRECONDITION_FAILED", { message: error.message });
+          }
+          if (error instanceof UpdateConflictError) {
+            throw new ORPCError4("CONFLICT", { message: error.message });
+          }
+          if (error instanceof UpdateDownloadError) {
+            throw new ORPCError4("BAD_GATEWAY", { message: error.message });
+          }
+          throw error;
+        }
+      })
+    }
+  };
+}
+
+// src/frontdoor/launchApi.ts
+init_cliError();
+import { ORPCError as ORPCError5 } from "@orpc/client";
+import { openapi as openapi6 } from "@orpc/openapi";
+
+// src/frontdoor/launchSchemas.ts
+import path30 from "node:path";
+import { z as z22 } from "zod";
+init_claudeVersion();
+init_identity();
+var LaunchResolveInputSchema = z22.strictObject({
+  path: z22.string().min(1),
+  /** `@name`, launch flags, then the arguments for `claude`; empty for a bare launch. */
+  argv: z22.readonly(z22.array(z22.string())).optional(),
+  /** The launch's inherited environment. Absent means an empty one: the door's own environment is never a substitute for the caller's, so a caller that wants `AGENT_SHIM_*` switches or a `CLAUDE_CONFIG_DIR` considered names them here. Values are read, never reported. */
+  env: z22.record(z22.string(), z22.string()).optional()
+}).refine((input) => path30.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+var LaunchPoolDecisionSchema = z22.strictObject({
+  name: z22.string(),
+  reasons: z22.readonly(z22.array(z22.string())),
+  movedOff: z22.strictObject({ identity: z22.string(), reason: z22.string() }).optional()
+});
+var LaunchDecisionSchema = z22.strictObject({
+  identity: z22.string().optional(),
+  identitySource: z22.enum(IDENTITY_DECISION_SOURCES),
+  pool: LaunchPoolDecisionSchema.optional(),
+  configDirEscapeHatch: z22.boolean(),
+  configDir: z22.string().optional(),
+  configProfile: z22.string().optional(),
+  configProfileSource: z22.enum(CONFIG_PROFILE_DECISION_SOURCES),
+  provider: z22.string().optional()
+});
+var LaunchFlagsSchema = z22.strictObject({
+  skipPermissions: z22.boolean(),
+  remoteControl: z22.boolean(),
+  headroom: z22.boolean(),
+  trackUsage: z22.boolean()
+});
+var LaunchResolveOutputSchema = z22.strictObject({
+  decision: LaunchDecisionSchema,
+  flags: LaunchFlagsSchema,
+  claudeVersion: z22.strictObject({ version: z22.string(), source: z22.enum(CLAUDE_VERSION_SOURCES) }).optional(),
+  /** The real `claude` binary the launch would spawn, on the door's host. */
+  bin: z22.string(),
+  /** The arguments the launch would pass it: the tool's own flags, then `CLAUDE_EXTRA_FLAGS`, then the caller's own. */
+  args: z22.readonly(z22.array(z22.string())),
+  /** The credential the launch would authenticate with, by target and source kinds. Absent when none applies. */
+  credential: z22.strictObject({ subject: z22.enum(["provider", "identity"]), name: z22.string(), summary: CredentialSummarySchema }).optional(),
+  routing: z22.strictObject({ frontDoor: z22.boolean(), headroom: z22.boolean() }),
+  /** The names of the environment variables the launch would set or unset, sorted. Values are not reported. */
+  environment: z22.readonly(z22.array(z22.string())),
+  warnings: z22.readonly(z22.array(z22.string()))
+});
+
+// src/frontdoor/launchApi.ts
+var LAUNCH_API_TAG = "launch";
+function createLaunchApiRouter(deps) {
+  const authed = doorApiAuth(deps.expectedToken);
+  return {
+    launch: {
+      resolve: authed.meta(openapi6({ method: "POST", path: "/rest/launch/resolve", summary: "Resolve what a launch from one directory would do, without performing it", tags: [LAUNCH_API_TAG] })).input(LaunchResolveInputSchema).output(LaunchResolveOutputSchema).handler(({ input }) => {
+        try {
+          const { resolution, warnings } = deps.resolveLaunch({ path: input.path, argv: input.argv ?? [], env: input.env ?? {} });
+          return { ...resolution, warnings };
+        } catch (error) {
+          if (error instanceof CliError) {
+            throw new ORPCError5("BAD_REQUEST", { message: error.message });
+          }
+          throw error;
+        }
+      })
+    }
+  };
+}
+
+// src/frontdoor/controlApi.ts
+var USAGE_API_TAG = "usage";
+var FRONTDOOR_API_TAG2 = "frontdoor";
+var CHECK_API_TAG = "check";
+var DOCTOR_API_TAG = "doctor";
+var POOL_API_TAG = "pool";
+function createControlApiRouter(deps) {
+  const authed = doorApiAuth(deps.expectedToken);
   return {
     usage: {
-      list: authed.meta(openapi3({ method: "GET", path: "/rest/usage/snapshots", summary: "List every identity's usage snapshot", tags: [USAGE_API_TAG] })).output(UsageListOutputSchema).handler(() => ({ snapshots: deps.usageSnapshots() })),
-      effectiveWindow: authed.meta(openapi3({ method: "GET", path: "/rest/usage/windows", summary: "Read one identity's effective quota windows", tags: [USAGE_API_TAG] })).input(UsageWindowsInputSchema).output(UsageWindowsOutputSchema).handler(({ input }) => {
+      list: authed.meta(openapi7({ method: "GET", path: "/rest/usage/snapshots", summary: "List every identity's usage snapshot", tags: [USAGE_API_TAG] })).output(UsageListOutputSchema).handler(() => ({ snapshots: deps.usageSnapshots() })),
+      effectiveWindow: authed.meta(openapi7({ method: "GET", path: "/rest/usage/windows", summary: "Read one identity's effective quota windows", tags: [USAGE_API_TAG] })).input(UsageWindowsInputSchema).output(UsageWindowsOutputSchema).handler(({ input }) => {
         const snapshot = deps.usageSnapshotOf(input.identity);
         if (snapshot === void 0) {
-          throw new ORPCError3("NOT_FOUND", { message: `identity ${input.identity} has no usage snapshot yet, so no quota window has been observed for it` });
+          throw new ORPCError6("NOT_FOUND", { message: `identity ${input.identity} has no usage snapshot yet, so no quota window has been observed for it` });
         }
         const provider = input.provider ?? ANTHROPIC_PROVIDER;
         const rateLimit = snapshot.providers[provider]?.rateLimit;
@@ -12662,34 +13575,34 @@ function createControlApiRouter(deps) {
           ...unified?.sevenDay === void 0 ? {} : { sevenDay: effectiveWindow(unified.sevenDay, now) }
         };
       }),
-      live: authed.meta(openapi3({ method: "GET", path: "/rest/usage/live", summary: "Read the live rate-limit observations the event backbone files", tags: [USAGE_API_TAG] })).input(RcSessionQuerySchema).output(UsageLiveOutputSchema).handler(({ input }) => {
+      live: authed.meta(openapi7({ method: "GET", path: "/rest/usage/live", summary: "Read the live rate-limit observations the event backbone files", tags: [USAGE_API_TAG] })).input(RcSessionQuerySchema).output(UsageLiveOutputSchema).handler(({ input }) => {
         const sessions = deps.liveRateLimits(input.session);
         if (input.session !== void 0 && sessions.length === 0) {
           if (deps.list().some((session) => session.id === input.session)) {
-            throw new ORPCError3("NOT_FOUND", { message: `session ${input.session} has filed no rate_limit_event on its stream yet: the worker emits one only once a turn has completed, so retry after this session's next turn` });
+            throw new ORPCError6("NOT_FOUND", { message: `session ${input.session} has filed no rate_limit_event on its stream yet: the worker emits one only once a turn has completed, so retry after this session's next turn` });
           }
-          throw new ORPCError3("NOT_FOUND", { message: rcSessionNotObservedMessage(input.session) });
+          throw new ORPCError6("NOT_FOUND", { message: rcSessionNotObservedMessage(input.session) });
         }
         return { latest: deps.latestRateLimit(), sessions };
       })
     },
     frontdoor: {
-      status: authed.meta(openapi3({ method: "GET", path: "/rest/frontdoor/status", summary: "Read the front door's status", tags: [FRONTDOOR_API_TAG] })).output(FrontDoorStatusOutputSchema).handler(() => deps.frontDoorStatus()),
-      sessions: authed.meta(openapi3({ method: "GET", path: "/rest/frontdoor/sessions", summary: "Read the front door's session registry", tags: [FRONTDOOR_API_TAG] })).output(FrontDoorSessionsOutputSchema).handler(() => ({ sessions: deps.frontDoorStatus().sessions }))
+      status: authed.meta(openapi7({ method: "GET", path: "/rest/frontdoor/status", summary: "Read the front door's status", tags: [FRONTDOOR_API_TAG2] })).output(FrontDoorStatusOutputSchema).handler(() => deps.frontDoorStatus()),
+      sessions: authed.meta(openapi7({ method: "GET", path: "/rest/frontdoor/sessions", summary: "Read the front door's session registry", tags: [FRONTDOOR_API_TAG2] })).output(FrontDoorSessionsOutputSchema).handler(() => ({ sessions: deps.frontDoorStatus().sessions }))
     },
     check: {
       // The report's own JSON shape is the contract (the same one `check --json` prints and `checkReportSchema.ts` defines), so the procedure returns exactly that conversion.
-      run: authed.meta(openapi3({ method: "GET", path: "/rest/check", summary: "Run the check report for one directory", tags: [CHECK_API_TAG] })).input(CheckRunInputSchema).output(CheckReportJsonSchema).handler(({ input }) => checkReportToJson(deps.checkReport(input.path, input.identity)))
+      run: authed.meta(openapi7({ method: "GET", path: "/rest/check", summary: "Run the check report for one directory", tags: [CHECK_API_TAG] })).input(CheckRunInputSchema).output(CheckReportJsonSchema).handler(({ input }) => checkReportToJson(deps.checkReport(input.path, input.identity)))
     },
     doctor: {
-      run: authed.meta(openapi3({ method: "GET", path: "/rest/doctor", summary: "Run the doctor report", tags: [DOCTOR_API_TAG] })).output(DoctorRunOutputSchema).handler(() => deps.doctorReport())
+      run: authed.meta(openapi7({ method: "GET", path: "/rest/doctor", summary: "Run the doctor report", tags: [DOCTOR_API_TAG] })).output(DoctorRunOutputSchema).handler(() => deps.doctorReport())
     },
     pool: {
-      pick: authed.meta(openapi3({ method: "GET", path: "/rest/pool/pick", summary: "Rank one pool exactly as a launch from a directory would right now", tags: [POOL_API_TAG] })).input(PoolPickInputSchema).output(PoolPickReportSchema).handler(({ input }) => {
+      pick: authed.meta(openapi7({ method: "GET", path: "/rest/pool/pick", summary: "Rank one pool exactly as a launch from a directory would right now", tags: [POOL_API_TAG] })).input(PoolPickInputSchema).output(PoolPickReportSchema).handler(({ input }) => {
         const report = deps.poolPick(input.pool, input.path);
         if (report === void 0) {
           const live = deps.poolNames();
-          throw new ORPCError3("NOT_FOUND", {
+          throw new ORPCError6("NOT_FOUND", {
             message: live.length === 0 ? `no pools are configured, so none is named ${input.pool}` : `no pool is named ${input.pool}; the live pools are ${live.map((name) => `"${name}"`).join(", ")}`
           });
         }
@@ -12699,7 +13612,9 @@ function createControlApiRouter(deps) {
   };
 }
 function createDoorApiRouter(deps) {
-  return { ...createRcApiRouter(deps), ...createControlApiRouter(deps), ...createEventsApiRouter(deps) };
+  const control = createControlApiRouter(deps);
+  const lifecycle = createLifecycleApiRouter(deps);
+  return { ...createRcApiRouter(deps), ...control, ...lifecycle, ...createConfigApiRouter(deps), ...createCodexApiRouter(deps), ...createLaunchApiRouter(deps), ...createEventsApiRouter(deps), frontdoor: { ...control.frontdoor, ...lifecycle.frontdoor } };
 }
 function createDoorApiNodeHandler(deps) {
   return doorApiNodeHandlerOf(createDoorApiRouter(deps), deps.expectedToken);
@@ -13511,9 +14426,9 @@ async function serveRcCompatSessions(ctx, pathname, compatPath) {
   const slash = rest.indexOf("/");
   const address = slash === -1 ? rest : rest.slice(0, slash);
   const compatTail = slash === -1 ? "" : rest.slice(slash + 1);
-  const refusal = ctx.credentialRefusal(request4.headers);
-  if (refusal !== void 0) {
-    await ctx.unauthorized(response, refusal);
+  const refusal2 = ctx.credentialRefusal(request4.headers);
+  if (refusal2 !== void 0) {
+    await ctx.unauthorized(response, refusal2);
     return;
   }
   const session = ctx.sessions.get(address) ?? ctx.sessions.get(`cse_${address}`);
@@ -13591,9 +14506,9 @@ function conversationRow(conversation) {
 }
 async function serveRcConversations(ctx, pathname, method) {
   const { request: request4, response, conversations } = ctx;
-  const refusal = ctx.credentialRefusal(request4.headers);
-  if (refusal !== void 0) {
-    await ctx.unauthorized(response, refusal);
+  const refusal2 = ctx.credentialRefusal(request4.headers);
+  if (refusal2 !== void 0) {
+    await ctx.unauthorized(response, refusal2);
     return;
   }
   if (pathname === RC_CONVERSATIONS_PATH_PREFIX) {
@@ -13917,9 +14832,9 @@ async function fetchThroughWebProxy(url, deps) {
   try {
     let redirects = 0;
     for (; ; ) {
-      const refusal = await checkTarget(current, deps);
-      if (refusal !== void 0) {
-        return refusal;
+      const refusal2 = await checkTarget(current, deps);
+      if (refusal2 !== void 0) {
+        return refusal2;
       }
       let hop;
       try {
@@ -14289,8 +15204,8 @@ data: ${JSON.stringify(envelope)}
     "doubled-scheme-word": "the self-hosted Remote Control surface reads one Bearer scheme word, and this call's Authorization header carried it twice: a persisted session record holds the whole header value with the scheme word included, so prefixing Bearer onto it presents a different credential",
     unrecognised: "the self-hosted Remote Control surface did not recognise the presented credential"
   };
-  const unauthorized = async (response, refusal) => {
-    await answerJson2(response, HTTP_STATUS.unauthorized, { type: "error", error: { type: "authentication_error", message: refusalMessages[refusal] } });
+  const unauthorized = async (response, refusal2) => {
+    await answerJson2(response, HTTP_STATUS.unauthorized, { type: "error", error: { type: "authentication_error", message: refusalMessages[refusal2] } });
   };
   const serveSessionPath = async (session, tail, request4, response) => {
     const method = request4.method.toUpperCase();
@@ -14301,9 +15216,9 @@ data: ${JSON.stringify(envelope)}
     session.lastTrafficAt = deps.now();
     if (tail === "") {
       if (method === "PATCH" || method === "PUT") {
-        const refusal = credentialRefusal(request4.headers);
-        if (refusal !== void 0) {
-          await unauthorized(response, refusal);
+        const refusal2 = credentialRefusal(request4.headers);
+        if (refusal2 !== void 0) {
+          await unauthorized(response, refusal2);
           return;
         }
         const body = parseJsonObject5(await readBody2(request4.body, CONTROL_BODY_CAP_BYTES));
@@ -14326,9 +15241,9 @@ data: ${JSON.stringify(envelope)}
       return;
     }
     if (tail === "bridge" && method === "POST") {
-      const refusal = credentialRefusal(request4.headers);
-      if (refusal !== void 0) {
-        await unauthorized(response, refusal);
+      const refusal2 = credentialRefusal(request4.headers);
+      if (refusal2 !== void 0) {
+        await unauthorized(response, refusal2);
         return;
       }
       const workerJwt = mintWorkerJwt(deps.randomToken, deps.now());
@@ -14338,9 +15253,9 @@ data: ${JSON.stringify(envelope)}
       return;
     }
     if (tail === "archive" && method === "POST") {
-      const refusal = credentialRefusal(request4.headers);
-      if (refusal !== void 0) {
-        await unauthorized(response, refusal);
+      const refusal2 = credentialRefusal(request4.headers);
+      if (refusal2 !== void 0) {
+        await unauthorized(response, refusal2);
         return;
       }
       retireSession(session);
@@ -14351,9 +15266,9 @@ data: ${JSON.stringify(envelope)}
     if (tail === "worker" || tail.startsWith("worker/")) {
       const workerTail = tail === "worker" ? "" : tail.slice("worker/".length);
       const webProxy = workerTail === "web-fetch" || workerTail === "web-search";
-      const refusal = webProxy ? workerOrCredentialRefusal(request4.headers, session) : workerRefusal(request4.headers, session);
-      if (refusal !== void 0) {
-        await unauthorized(response, refusal);
+      const refusal2 = webProxy ? workerOrCredentialRefusal(request4.headers, session) : workerRefusal(request4.headers, session);
+      if (refusal2 !== void 0) {
+        await unauthorized(response, refusal2);
         return;
       }
       if (workerTail === "" && method === "GET") {
@@ -14660,7 +15575,7 @@ data: ${JSON.stringify(envelope)}
 
 // src/frontdoor/rcSelfHostMint.ts
 init_account();
-import path30 from "node:path";
+import path31 from "node:path";
 var CREDENTIALS_FILE = ".credentials.json";
 var CLAUDE_JSON2 = ".claude.json";
 var RC_SELF_HOST_RECORD_DIR = "rc-selfhost";
@@ -14684,7 +15599,7 @@ function readJsonObject(fs12, file) {
   return isRecord11(parsed) ? parsed : void 0;
 }
 function readRcSelfHostRecord(fs12, frontdoorDir) {
-  const parsed = readJsonObject(fs12, path30.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
+  const parsed = readJsonObject(fs12, path31.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
   if (parsed === void 0) {
     return void 0;
   }
@@ -14698,11 +15613,11 @@ function mintRcSelfHostCredential(deps) {
   if (!isIdentityName(deps.identity)) {
     throw new Error(`"${deps.identity}" is not a valid identity name.`);
   }
-  const identityDir = path30.join(deps.identitiesDir, deps.identity);
-  const credentialsFile = path30.join(identityDir, CREDENTIALS_FILE);
-  const claudeJsonFile = path30.join(identityDir, CLAUDE_JSON2);
-  const recordDir = path30.join(deps.frontdoorDir, RC_SELF_HOST_RECORD_DIR);
-  const recordFile = path30.join(recordDir, RC_SELF_HOST_RECORD_FILE);
+  const identityDir = path31.join(deps.identitiesDir, deps.identity);
+  const credentialsFile = path31.join(identityDir, CREDENTIALS_FILE);
+  const claudeJsonFile = path31.join(identityDir, CLAUDE_JSON2);
+  const recordDir = path31.join(deps.frontdoorDir, RC_SELF_HOST_RECORD_DIR);
+  const recordFile = path31.join(recordDir, RC_SELF_HOST_RECORD_FILE);
   const previousRecord = readRcSelfHostRecord(deps.fs, deps.frontdoorDir);
   const existingCredentials = readJsonObject(deps.fs, credentialsFile);
   const existingOauth = isRecord11(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
@@ -14718,7 +15633,7 @@ function mintRcSelfHostCredential(deps) {
   const organizationUuid = deps.newUuid();
   const accountUuid = deps.newUuid();
   const mintedAt = new Date(deps.now()).toISOString();
-  deps.fs.mkdirPrivate(path30.dirname(credentialsFile));
+  deps.fs.mkdirPrivate(path31.dirname(credentialsFile));
   deps.fs.writeFilePrivate(credentialsFile, `${JSON.stringify({ ...existingCredentials, claudeAiOauth: { accessToken, refreshToken, expiresAt: null, scopes: [...RC_SELF_HOST_SCOPE_LIST], subscriptionType: SELF_HOST_SUBSCRIPTION_TYPE, rateLimitTier: null } }, null, 2)}
 `);
   const claudeJson = readJsonObject(deps.fs, claudeJsonFile) ?? {};
@@ -14766,102 +15681,6 @@ init_paths();
 init_cliError();
 init_schema();
 init_providersStore();
-
-// src/directoryRulesStore.ts
-init_store();
-init_load();
-init_schema();
-init_cliError();
-var DirectoryRuleNotFoundError = class extends CliError {
-  constructor(rulePath) {
-    super(`No directory rule found for path "${rulePath}".`);
-    this.rulePath = rulePath;
-    this.name = "DirectoryRuleNotFoundError";
-  }
-  rulePath;
-};
-var DirectoryRuleMissingTargetError = class extends CliError {
-  constructor() {
-    super("A directory rule must set at least one of --config-profile or --identity.");
-    this.name = "DirectoryRuleMissingTargetError";
-  }
-};
-var DirectoryRuleAlreadyExistsError = class extends CliError {
-  constructor(rulePath) {
-    super(`A directory rule for path "${rulePath}" already exists. Use \`agent-shim rule set\` to change it.`);
-    this.rulePath = rulePath;
-    this.name = "DirectoryRuleAlreadyExistsError";
-  }
-  rulePath;
-};
-function readDirectoryRules(paths) {
-  return readJson(paths.directoryRulesFile, DirectoryRulesSchema) ?? { rules: [] };
-}
-function writeDirectoryRules(paths, rules) {
-  const parsed = DirectoryRulesSchema.safeParse(rules);
-  if (!parsed.success) {
-    throw new ConfigValidationError(paths.directoryRulesFile, parsed.error.issues);
-  }
-  writeJsonAtomic(paths.directoryRulesFile, parsed.data);
-}
-function listDirectoryRules(paths) {
-  return readDirectoryRules(paths).rules;
-}
-function addDirectoryRule(paths, rulePath, options) {
-  if (options.configProfile === void 0 && options.identity === void 0) {
-    throw new DirectoryRuleMissingTargetError();
-  }
-  const current = readDirectoryRules(paths);
-  if (current.rules.some((rule) => rule.path === rulePath)) {
-    throw new DirectoryRuleAlreadyExistsError(rulePath);
-  }
-  const created = buildNewRule(rulePath, options);
-  writeDirectoryRules(paths, { ...current, rules: [...current.rules, created] });
-  return created;
-}
-function ruleHasEffect(rule) {
-  return rule.configProfile !== void 0 || rule.identity !== void 0 || rule.categories !== void 0 || rule.entries !== void 0 || rule.launch !== void 0;
-}
-function updateDirectoryRule(paths, rulePath, options) {
-  const current = readDirectoryRules(paths);
-  const index = current.rules.findIndex((rule) => rule.path === rulePath);
-  const existing = index === -1 ? void 0 : current.rules[index];
-  if (existing === void 0) {
-    throw new DirectoryRuleNotFoundError(rulePath);
-  }
-  const { configProfile, identity, ...rest } = existing;
-  const nextConfigProfile = options.configProfile === void 0 ? configProfile : options.configProfile === false ? void 0 : options.configProfile;
-  const nextIdentity = options.identity === void 0 ? identity : options.identity === false ? void 0 : options.identity;
-  const updated = {
-    ...rest,
-    ...nextConfigProfile === void 0 ? {} : { configProfile: nextConfigProfile },
-    ...nextIdentity === void 0 ? {} : { identity: nextIdentity }
-  };
-  if (!ruleHasEffect(updated)) {
-    throw new DirectoryRuleMissingTargetError();
-  }
-  const nextRules = [...current.rules];
-  nextRules[index] = updated;
-  writeDirectoryRules(paths, { ...current, rules: nextRules });
-  return updated;
-}
-function buildNewRule(rulePath, options) {
-  return {
-    path: rulePath,
-    ...options.configProfile !== void 0 ? { configProfile: options.configProfile } : {},
-    ...options.identity !== void 0 ? { identity: options.identity } : {}
-  };
-}
-function removeDirectoryRule(paths, rulePath) {
-  const current = readDirectoryRules(paths);
-  const nextRules = current.rules.filter((rule) => rule.path !== rulePath);
-  if (nextRules.length === current.rules.length) {
-    throw new DirectoryRuleNotFoundError(rulePath);
-  }
-  writeDirectoryRules(paths, { ...current, rules: nextRules });
-}
-
-// src/index.ts
 init_launcher();
 init_spawn();
 init_launchWiring();
@@ -14972,10 +15791,47 @@ export {
   CheckReportJsonSchema,
   CheckRunInputSchema,
   CliError,
+  CodexLogoutOutputSchema,
+  CodexSignInSchema,
+  CodexStatusOutputSchema,
+  ConfigIdentityAddOutputSchema,
+  ConfigIdentityRemoveInputSchema,
+  ConfigIdentityRemoveOutputSchema,
+  ConfigIdentitySetInputSchema,
+  ConfigIdentitySetOutputSchema,
+  ConfigIdentityUseOutputSchema,
+  ConfigNameInputSchema,
+  ConfigPoolAddInputSchema,
+  ConfigPoolAddOutputSchema,
+  ConfigPoolRemoveInputSchema,
+  ConfigPoolRemoveOutputSchema,
+  ConfigPoolSetInputSchema,
+  ConfigPoolSetOutputSchema,
+  ConfigPoolUseOutputSchema,
+  ConfigProfileAddInputSchema,
+  ConfigProfileAddOutputSchema,
+  ConfigProfileRemoveInputSchema,
+  ConfigProfileRemoveOutputSchema,
   ConfigProfileSchema,
+  ConfigProfileSetInputSchema,
+  ConfigProfileSetOutputSchema,
+  ConfigProfileUseOutputSchema,
+  ConfigProviderAddInputSchema,
+  ConfigProviderAddOutputSchema,
+  ConfigProviderRemoveInputSchema,
+  ConfigProviderRemoveOutputSchema,
+  ConfigProviderSetInputSchema,
+  ConfigProviderSetOutputSchema,
+  ConfigRuleAddInputSchema,
+  ConfigRuleAddOutputSchema,
+  ConfigRuleRemoveInputSchema,
+  ConfigRuleRemoveOutputSchema,
+  ConfigRuleSetInputSchema,
+  ConfigRuleSetOutputSchema,
   CredentialCacheSchema,
   CredentialSchema,
   CredentialSourceSchema,
+  CredentialSummarySchema2 as CredentialSummarySchema,
   DOOR_EVENT_BUFFER_EVENTS,
   DOOR_EVENT_SOURCE_RC,
   DOOR_HEALTH_EVENT_SOURCE,
@@ -14996,6 +15852,7 @@ export {
   FARM_MANIFEST_FILENAME,
   FrontDoorControlMaterialError,
   FrontDoorNotServingError,
+  FrontDoorRestartOutputSchema,
   FrontDoorSessionStatusSchema,
   FrontDoorSessionsOutputSchema,
   FrontDoorStartError,
@@ -15013,6 +15870,8 @@ export {
   LAUNCH_EVENT_SOURCE,
   LaunchLifecycleEventSchema,
   LaunchRefusedError,
+  LaunchResolveInputSchema,
+  LaunchResolveOutputSchema,
   LegacyProviderFileError,
   OWN_CLI_FILE_NAME,
   PROMPT_CACHE_TTL_MS,
@@ -15059,6 +15918,7 @@ export {
   RcStreamEnvelopeSchema,
   RcStreamEventSchema,
   USAGE_EVENT_SOURCE,
+  UpdateCheckOutputSchema,
   UsageError,
   UsageListOutputSchema,
   UsageLiveOutputSchema,
@@ -15101,14 +15961,18 @@ export {
   collectDoctorReport,
   collectFrontDoorStatus,
   collectPoolPick,
+  createCodexApiRouter,
+  createConfigApiRouter,
   createControlApiRouter,
   createDoorApiNodeHandler,
   createDoorApiRouter,
   createDoorEventHub,
   createDoorHealthPublisher,
   createEventsApiRouter,
+  createLaunchApiRouter,
   createLaunchEventPublisher,
   createLeafCache,
+  createLifecycleApiRouter,
   createProfile,
   createQuotaExpiringPublisher,
   createRcApiNodeHandler,
@@ -15216,7 +16080,9 @@ export {
   requirePool,
   resolveAgentShimHome,
   resolveClaudeHome,
+  resolveClaudeLaunch,
   resolveDecisions,
+  resolveLaunch,
   resolveLaunchSelection,
   resolveLayoutPaths,
   resolveSupervisorConfig,