claude-use 9.6.0 → 9.7.1

package/dist/cli.cjs

@@ -26769,7 +26769,7 @@ function isCodexProvider(provider) {
 function poolMemberIdentity(member) {
   return typeof member === "string" ? member : member.identity;
 }
-var import_node_path4, CATEGORY_NAMES, OVERRIDABLE_CATEGORIES, CategoryMapSchema, DURATION_RE, DurationSchema, WhenConditionObjectSchema, WhenSchema, EntryValueSchema, ENTRY_KEY_RE, EntriesSchema, LaunchSchema, CREDENTIAL_TARGETS, PROVIDER_CREDENTIAL_TARGETS, CREDENTIAL_TARGET_VARS, ArgvSchema, CommandSourceOptions, CredentialSourceSchema, CREDENTIAL_CACHE_STORES, CredentialCacheSchema, CredentialSchema, ProviderCredentialSchema, RESERVED_PROVIDER_ENV_KEYS, ProviderEnvSchema, PROVIDER_KINDS, CODEX_TIERS, CODEX_EFFORTS, CODEX_LOGINS, CODEX_DEFAULT_LOGIN, CODEX_DEFAULT_MODEL, CODEX_DEFAULT_TIER_MODELS, CODEX_DEFAULT_EFFORT, CodexProviderConfigSchema, ProviderRouteSchema, HttpProviderSchema, CodexProviderSchema, ProviderSchema, ConfigProfileSchema, POOL_SELECTOR_PREFIX, POOL_NAME_PATTERN, IDENTITY_NAME_PATTERN, PoolNameSchema, SELECTOR_RE, IdentitySelectorSchema, PoolMemberSchema, POOL_PREFERENCES, PoolPreferenceSchema, PoolSchema, DirectoryRuleSchema, DirectoryRulesSchema, PortableConfigSchema, HEADROOM_MODES, HEADROOM_CCR_MODES, HEADROOM_ROLLOUT_CHANNELS, INTERCEPT_CHANNELS, READ_MATURATION_CHANNELS, HeadroomGlobalConfigObjectSchema, HeadroomGlobalConfigSchema, HEADROOM_DEFAULT_SOURCE, HEADROOM_DEFAULT_IDLE_SHUTDOWN_MINUTES, FRONTDOOR_DEFAULT_IDLE_SHUTDOWN_MINUTES, FrontDoorGlobalConfigSchema, UPDATE_MODES, UpdateGlobalConfigSchema, GlobalConfigSchema, IdentitySchema, CategoryClassificationSchema, CategoryClassificationOverlaySchema, SHIPPED_CATEGORY_DEFAULTS;
+var import_node_path4, CATEGORY_NAMES, OVERRIDABLE_CATEGORIES, CategoryMapSchema, DURATION_RE, DurationSchema, WhenConditionObjectSchema, WhenSchema, EntryValueSchema, ENTRY_KEY_RE, EntriesSchema, LaunchSchema, CREDENTIAL_TARGETS, PROVIDER_CREDENTIAL_TARGETS, CREDENTIAL_TARGET_VARS, ArgvSchema, CommandSourceOptions, EnvCredentialSourceSchema, FileCredentialSourceSchema, CommandCredentialSourceSchema, OpCredentialSourceSchema, KeychainCredentialSourceSchema, LiteralCredentialSourceSchema, CredentialSourceSchema, RemoteCredentialSourceSchema, CREDENTIAL_CACHE_STORES, CredentialCacheSchema, CredentialSchema, ProviderCredentialSchema, RESERVED_PROVIDER_ENV_KEYS, ProviderEnvSchema, PROVIDER_KINDS, CODEX_TIERS, CODEX_EFFORTS, CODEX_LOGINS, CODEX_DEFAULT_LOGIN, CODEX_DEFAULT_MODEL, CODEX_DEFAULT_TIER_MODELS, CODEX_DEFAULT_EFFORT, CodexProviderConfigSchema, ProviderRouteSchema, HttpProviderSchema, CodexProviderSchema, ProviderSchema, ConfigProfileSchema, POOL_SELECTOR_PREFIX, POOL_NAME_PATTERN, IDENTITY_NAME_PATTERN, PoolNameSchema, SELECTOR_RE, IdentitySelectorSchema, PoolMemberSchema, POOL_PREFERENCES, PoolPreferenceSchema, PoolSchema, DirectoryRuleSchema, DirectoryRulesSchema, PortableConfigSchema, HEADROOM_MODES, HEADROOM_CCR_MODES, HEADROOM_ROLLOUT_CHANNELS, INTERCEPT_CHANNELS, READ_MATURATION_CHANNELS, HeadroomGlobalConfigObjectSchema, HeadroomGlobalConfigSchema, HEADROOM_DEFAULT_SOURCE, HEADROOM_DEFAULT_IDLE_SHUTDOWN_MINUTES, FRONTDOOR_DEFAULT_IDLE_SHUTDOWN_MINUTES, FrontDoorGlobalConfigSchema, UPDATE_MODES, UpdateGlobalConfigSchema, GlobalConfigSchema, IdentitySchema, CategoryClassificationSchema, CategoryClassificationOverlaySchema, SHIPPED_CATEGORY_DEFAULTS;
 var init_schema = __esm({
   "src/config/schema.ts"() {
     "use strict";
@@ -26825,20 +26825,33 @@ var init_schema = __esm({
       /** How long the command may run before it is killed and counted as failed. Defaults to `CREDENTIAL_COMMAND_TIMEOUT_MS`, or `CREDENTIAL_INTERACTIVE_TIMEOUT_MS` for an interactive source. */
       timeoutMs: external_exports.int().positive().optional()
     };
+    EnvCredentialSourceSchema = external_exports.strictObject({ env: external_exports.string().min(1) });
+    FileCredentialSourceSchema = external_exports.strictObject({
+      file: external_exports.string().min(1).refine((filePath) => filePath.startsWith("~/") || import_node_path4.default.isAbsolute(filePath), {
+        message: "a credential file must be an absolute or ~-rooted path, since a launch can start in any directory"
+      })
+    });
+    CommandCredentialSourceSchema = external_exports.strictObject({ command: ArgvSchema, ...CommandSourceOptions });
+    OpCredentialSourceSchema = external_exports.strictObject({ op: external_exports.string().startsWith("op://"), ...CommandSourceOptions });
+    KeychainCredentialSourceSchema = external_exports.strictObject({
+      keychain: external_exports.strictObject({ service: external_exports.string().min(1), account: external_exports.string().min(1).optional() }),
+      ...CommandSourceOptions
+    });
+    LiteralCredentialSourceSchema = external_exports.strictObject({ literal: external_exports.string().min(1) });
     CredentialSourceSchema = external_exports.union([
-      external_exports.strictObject({ env: external_exports.string().min(1) }),
-      external_exports.strictObject({
-        file: external_exports.string().min(1).refine((filePath) => filePath.startsWith("~/") || import_node_path4.default.isAbsolute(filePath), {
-          message: "a credential file must be an absolute or ~-rooted path, since a launch can start in any directory"
-        })
-      }),
-      external_exports.strictObject({ command: ArgvSchema, ...CommandSourceOptions }),
-      external_exports.strictObject({ op: external_exports.string().startsWith("op://"), ...CommandSourceOptions }),
-      external_exports.strictObject({
-        keychain: external_exports.strictObject({ service: external_exports.string().min(1), account: external_exports.string().min(1).optional() }),
-        ...CommandSourceOptions
-      }),
-      external_exports.strictObject({ literal: external_exports.string().min(1) })
+      EnvCredentialSourceSchema,
+      FileCredentialSourceSchema,
+      CommandCredentialSourceSchema,
+      OpCredentialSourceSchema,
+      KeychainCredentialSourceSchema,
+      LiteralCredentialSourceSchema
+    ]);
+    RemoteCredentialSourceSchema = external_exports.union([
+      EnvCredentialSourceSchema,
+      FileCredentialSourceSchema,
+      OpCredentialSourceSchema,
+      KeychainCredentialSourceSchema,
+      LiteralCredentialSourceSchema
     ]);
     CREDENTIAL_CACHE_STORES = ["keychain", "file"];
     CredentialCacheSchema = external_exports.strictObject({
@@ -27454,8 +27467,8 @@ function verifyHeadroomSocket(socketPath, ports) {
   }
   const uid = ports.currentUid();
   const directory = import_node_path7.default.dirname(socketPath);
-  const refusal = ownerOnlyRefusal("socket directory", directory, ports.lstat(directory), "dir", uid) ?? ownerOnlyRefusal("socket", socketPath, ports.lstat(socketPath), "socket", uid);
-  return refusal === void 0 ? { socketPath } : { refused: refusal };
+  const refusal2 = ownerOnlyRefusal("socket directory", directory, ports.lstat(directory), "dir", uid) ?? ownerOnlyRefusal("socket", socketPath, ports.lstat(socketPath), "socket", uid);
+  return refusal2 === void 0 ? { socketPath } : { refused: refusal2 };
 }
 function prepareHeadroomSocket(fs21, ports, paths, supervisorPid) {
   const unsupported = platformRefusal(ports.platform);
@@ -27473,8 +27486,8 @@ function prepareHeadroomSocket(fs21, ports, paths, supervisorPid) {
     return { refused: `the headroom socket directory ${paths.headroomSocketDir} is a symlink; it must be the real directory` };
   }
   fs21.mkdirPrivate(paths.headroomSocketDir);
-  const refusal = ownerOnlyRefusal("socket directory", paths.headroomSocketDir, ports.lstat(paths.headroomSocketDir), "dir", ports.currentUid());
-  return refusal === void 0 ? { socketPath } : { refused: refusal };
+  const refusal2 = ownerOnlyRefusal("socket directory", paths.headroomSocketDir, ports.lstat(paths.headroomSocketDir), "dir", ports.currentUid());
+  return refusal2 === void 0 ? { socketPath } : { refused: refusal2 };
 }
 function pruneStaleHeadroomSockets(fs21, paths, isRunning) {
   const removed = [];
@@ -33229,7 +33242,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "claude-use",
-      version: "9.6.0",
+      version: "9.7.1",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -34028,14 +34041,14 @@ function capacityOf(plan) {
   return plan.kind === "subscription" ? plan.capacity : 1;
 }
 function assessRefusedNested(member, nested, nowMs) {
-  const refusal = nested.earliestReturn === void 0 ? { reason: `no member of pool "${nested.pool}" can be picked` } : { reason: `every member of pool "${nested.pool}" is refused; ${nested.earliestReturn.identity} returns at ${new Date(nested.earliestReturn.atMs).toISOString()} (in ${formatAge(nested.earliestReturn.atMs - nowMs)})`, blockedUntilMs: nested.earliestReturn.atMs };
+  const refusal2 = nested.earliestReturn === void 0 ? { reason: `no member of pool "${nested.pool}" can be picked` } : { reason: `every member of pool "${nested.pool}" is refused; ${nested.earliestReturn.identity} returns at ${new Date(nested.earliestReturn.atMs).toISOString()} (in ${formatAge(nested.earliestReturn.atMs - nowMs)})`, blockedUntilMs: nested.earliestReturn.atMs };
   return {
     candidate: {
       identity: member.identity,
       class: "ineligible",
-      ...refusal.blockedUntilMs === void 0 ? {} : { blockedUntilMs: refusal.blockedUntilMs },
+      ...refusal2.blockedUntilMs === void 0 ? {} : { blockedUntilMs: refusal2.blockedUntilMs },
       plan: planOf(member.account),
-      reasons: [refusal.reason]
+      reasons: [refusal2.reason]
     }
   };
 }
@@ -34126,7 +34139,7 @@ function rankPool(input2) {
   const assessments = members2.map((member) => ({ member, ...assess(member, nowMs) }));
   const demands = assessments.flatMap(({ candidate, burn }) => burn === void 0 ? [] : [burn * capacityOf(candidate.plan)]);
   const sharedDemand = demands.length === 0 ? void 0 : Math.max(...demands);
-  const guarded = assessments.map((assessment) => {
+  const guarded2 = assessments.map((assessment) => {
     const { candidate } = assessment;
     if (candidate.class === "ineligible" || assessment.member.policy === void 0) {
       return assessment;
@@ -34141,7 +34154,7 @@ function rankPool(input2) {
     }
     return { ...assessment, candidate: { ...candidate, class: "ineligible", reasons: [`skipped by policy (${verdict.checked.join(", ")}: did not hold)`, ...candidate.reasons] } };
   });
-  const candidates = guarded.map((assessment) => {
+  const candidates = guarded2.map((assessment) => {
     const { candidate, fiveHour, burn } = assessment;
     const pace = burn ?? (sharedDemand === void 0 ? void 0 : sharedDemand / capacityOf(candidate.plan));
     const { sevenDay, sevenDayBurn } = assessment;
@@ -108445,6 +108458,48 @@ function removeProfile(paths, name) {
   requireProfileExists(paths, name);
   import_node_fs5.default.rmSync(profileJsonPath(paths, name));
 }
+function applyProfileChange(paths, name, change) {
+  let touched = false;
+  if (change.category !== void 0) {
+    setProfileCategories(paths, name, change.category);
+    touched = true;
+  }
+  if (change.entry !== void 0) {
+    setProfileEntries(paths, name, change.entry);
+    touched = true;
+  }
+  if (change.extends !== void 0 || change.description !== void 0) {
+    setProfileMetadata(paths, name, {
+      ...change.extends === void 0 ? {} : { extends: change.extends === false ? [] : change.extends },
+      ...change.description === void 0 ? {} : { description: change.description }
+    });
+    touched = true;
+  }
+  const launchPatch = {};
+  if (change.launchSkipPermissions !== void 0) {
+    launchPatch.skipPermissions = change.launchSkipPermissions;
+  }
+  if (change.launchRemoteControl !== void 0) {
+    launchPatch.remoteControl = change.launchRemoteControl;
+  }
+  if (change.launchHeadroom !== void 0) {
+    launchPatch.headroom = change.launchHeadroom;
+  }
+  if (change.launchTrackUsage !== void 0) {
+    launchPatch.trackUsage = change.launchTrackUsage;
+  }
+  if (change.launchProvider !== void 0) {
+    launchPatch.provider = change.launchProvider === false ? void 0 : change.launchProvider;
+  }
+  if (change.launchClaudeVersion !== void 0) {
+    launchPatch.claudeVersion = change.launchClaudeVersion === false ? void 0 : change.launchClaudeVersion;
+  }
+  if (Object.keys(launchPatch).length > 0) {
+    setProfileLaunchFlags(paths, name, launchPatch);
+    touched = true;
+  }
+  return touched;
+}
 
 // src/poolStore.ts
 init_store();
@@ -108579,6 +108634,14 @@ var InvalidIdentityNameError = class extends CliError {
 function identityJsonPath(paths, name) {
   return import_node_path13.default.join(paths.identitiesDir, name, "identity.json");
 }
+function requireIdentityNames(paths, names) {
+  const existing = new Set(listIdentities(paths).map((entry) => entry.name));
+  for (const name of names) {
+    if (poolNameOf(name) === void 0 && !existing.has(name)) {
+      throw new IdentityNotFoundError(name);
+    }
+  }
+}
 function identityExists(paths, name) {
   return import_node_fs6.default.existsSync(identityJsonPath(paths, name));
 }
@@ -108787,6 +108850,16 @@ function removeDirectoryRule(paths, rulePath) {
   }
   writeDirectoryRules(paths, { ...current, rules: nextRules });
 }
+function requireRuleSelector(paths, selector) {
+  if (selector.startsWith(POOL_SELECTOR_PREFIX)) {
+    const poolName = selector.slice(POOL_SELECTOR_PREFIX.length);
+    if (readPools(paths)[poolName] === void 0) {
+      throw new PoolNotFoundError(poolName);
+    }
+  } else if (readIdentity(paths, selector) === void 0) {
+    throw new IdentityNotFoundError(selector);
+  }
+}
 
 // src/configure.ts
 init_legacy();
@@ -109318,7 +109391,31 @@ var import_node_path22 = __toESM(require("node:path"), 1);
 init_commandDeps();
 
 // src/cli/credentialOption.ts
+init_cliError();
+init_schema();
+
+// src/credentialCacheChange.ts
+init_cliError();
 init_schema();
+function mergeCredentialCache(request7, existing) {
+  if (request7.enabled === false) {
+    return false;
+  }
+  if (request7.ttl === void 0 && request7.store === void 0 && request7.enabled !== true) {
+    return void 0;
+  }
+  const parsed = CredentialCacheSchema.safeParse({
+    ...existing,
+    ...request7.ttl === void 0 ? {} : { ttl: request7.ttl },
+    ...request7.store === void 0 ? {} : { store: request7.store }
+  });
+  if (!parsed.success) {
+    throw new UsageError(parsed.error.issues.map((issue2) => issue2.message).join("; "));
+  }
+  return parsed.data;
+}
+
+// src/cli/credentialOption.ts
 var CREDENTIAL_SOURCE_SYNTAX = "env:<VAR>, file:<path>, command:<program and arguments>, op:<op://reference>, keychain:<service>[:<account>], literal:<placeholder>, or a JSON source object";
 function parseCredentialSource(spec) {
   let candidate;
@@ -109373,21 +109470,18 @@ function addCredentialCacheOptions(command) {
   ).option("--credential-cache", "Cache this credential in the default store with no expiry (add --credential-cache-ttl for one).").option("--no-credential-cache", "Stop caching this credential. Run `credential forget` first to drop the stored copy.");
 }
 function cacheChange(options, existing) {
-  if (options.credentialCache === false) {
-    return false;
-  }
-  if (options.credentialCacheTtl === void 0 && options.credentialCacheStore === void 0 && options.credentialCache !== true) {
-    return void 0;
-  }
-  const parsed = CredentialCacheSchema.safeParse({
-    ...existing,
-    ...options.credentialCacheTtl === void 0 ? {} : { ttl: options.credentialCacheTtl },
-    ...options.credentialCacheStore === void 0 ? {} : { store: options.credentialCacheStore }
-  });
-  if (!parsed.success) {
-    throw new InvalidArgumentError(parsed.error.issues.map((issue2) => issue2.message).join("; "));
+  try {
+    return mergeCredentialCache(
+      {
+        ...options.credentialCache === void 0 ? {} : { enabled: options.credentialCache },
+        ...options.credentialCacheTtl === void 0 ? {} : { ttl: options.credentialCacheTtl },
+        ...options.credentialCacheStore === void 0 ? {} : { store: options.credentialCacheStore }
+      },
+      existing
+    );
+  } catch (error63) {
+    throw error63 instanceof UsageError ? new InvalidArgumentError(error63.message) : error63;
   }
-  return parsed.data;
 }
 
 // src/identityManager.ts
@@ -109502,48 +109596,6 @@ async function ensureProfileExists(deps, name) {
 function toProfileView(name, profile, globalDefault) {
   return { name, globalDefault: name === globalDefault, ...profile, $schema: void 0 };
 }
-function applyProfileSet(paths, name, options) {
-  let touched = false;
-  if (options.category !== void 0) {
-    setProfileCategories(paths, name, options.category);
-    touched = true;
-  }
-  if (options.entry !== void 0) {
-    setProfileEntries(paths, name, options.entry);
-    touched = true;
-  }
-  if (options.extends !== void 0 || options.description !== void 0) {
-    setProfileMetadata(paths, name, {
-      ...options.extends === void 0 ? {} : { extends: options.extends === false ? [] : options.extends },
-      ...options.description === void 0 ? {} : { description: options.description }
-    });
-    touched = true;
-  }
-  const launchPatch = {};
-  if (options.launchSkipPermissions !== void 0) {
-    launchPatch.skipPermissions = options.launchSkipPermissions;
-  }
-  if (options.launchRemoteControl !== void 0) {
-    launchPatch.remoteControl = options.launchRemoteControl;
-  }
-  if (options.launchHeadroom !== void 0) {
-    launchPatch.headroom = options.launchHeadroom;
-  }
-  if (options.launchTrackUsage !== void 0) {
-    launchPatch.trackUsage = options.launchTrackUsage;
-  }
-  if (options.launchProvider !== void 0) {
-    launchPatch.provider = options.launchProvider === false ? void 0 : options.launchProvider;
-  }
-  if (options.launchClaudeVersion !== void 0) {
-    launchPatch.claudeVersion = options.launchClaudeVersion === false ? void 0 : options.launchClaudeVersion;
-  }
-  if (Object.keys(launchPatch).length > 0) {
-    setProfileLaunchFlags(paths, name, launchPatch);
-    touched = true;
-  }
-  return touched;
-}
 function registerProfileCommand(program2, deps) {
   const { paths } = deps;
   const profile = withExamples(
@@ -109592,7 +109644,7 @@ function registerProfileCommand(program2, deps) {
           throw new PromptCancelledError();
         }
       } else {
-        applyProfileSet(paths, name, options);
+        applyProfileChange(paths, name, options);
       }
       reportMutation(json2, { action: "updated", kind: "profile", name, value: readProfile(paths, name) }, () => {
         console.log(`Updated configuration profile "${name}".`);
@@ -110892,6 +110944,7 @@ var HTTP_STATUS = {
   forbidden: 403,
   notFound: 404,
   methodNotAllowed: 405,
+  conflict: 409,
   payloadTooLarge: 413,
   tooManyRequests: 429,
   /** Not sent to anyone: the client is gone. Recorded for a response abandoned because the client disconnected, following the convention nginx uses for the same case. */
@@ -122794,6 +122847,7 @@ init_capability();
 var RC_ORPC_PATH_PREFIX = "/__agent-shim/orpc";
 var RC_OPENAPI_DOC_PATH = "/openapi.json";
 var RC_SUBSCRIBER_BUFFER_EVENTS = 100;
+var READ_ONLY_OPERATION_EXTENSION = "x-agent-shim-read-only";
 function doorApiBearer(headers) {
   const presented = headers.authorization;
   const bearerPrefix = "bearer ".length;
@@ -122911,9 +122965,9 @@ function doorApiNodeHandlerOf(router, expectedToken) {
       if (request7.method === "GET" && request7.url === `${RC_ORPC_PATH_PREFIX}${RC_OPENAPI_DOC_PATH}`) {
         const token = doorApiBearer(request7.headers);
         if (token === void 0 || !isLiveCapability(token, [expectedToken])) {
-          const refusal = new ORPCError("UNAUTHORIZED", { message: "the front door's OpenAPI document demands this generation's control token as a Bearer credential" });
+          const refusal2 = new ORPCError("UNAUTHORIZED", { message: "the front door's OpenAPI document demands this generation's control token as a Bearer credential" });
           response.writeHead(HTTP_STATUS.unauthorized, { "content-type": "application/json" });
-          response.end(JSON.stringify(refusal.toJSON()));
+          response.end(JSON.stringify(refusal2.toJSON()));
           return { matched: true };
         }
         try {
@@ -122921,9 +122975,9 @@ function doorApiNodeHandlerOf(router, expectedToken) {
           response.writeHead(HTTP_STATUS.ok, { "content-type": "application/json" });
           response.end(JSON.stringify(doc));
         } catch (error63) {
-          const refusal = new ORPCError("INTERNAL_SERVER_ERROR", { message: `the OpenAPI document could not be generated from the door's own router: ${error63 instanceof Error ? error63.message : String(error63)}` });
+          const refusal2 = new ORPCError("INTERNAL_SERVER_ERROR", { message: `the OpenAPI document could not be generated from the door's own router: ${error63 instanceof Error ? error63.message : String(error63)}` });
           response.writeHead(HTTP_STATUS.internalServerError, { "content-type": "application/json" });
-          response.end(JSON.stringify(refusal.toJSON()));
+          response.end(JSON.stringify(refusal2.toJSON()));
         }
         return { matched: true };
       }
@@ -122991,6 +123045,438 @@ function createCodexApiRouter(deps) {
   };
 }
 
+// src/frontdoor/configApi.ts
+init_cliError();
+init_schema();
+init_credential();
+init_identity();
+init_providersStore();
+
+// src/frontdoor/configSchemas.ts
+init_zod();
+init_schema();
+var RemovalConfirmationSchema = external_exports.boolean();
+var CredentialWriteSchema = (targets) => external_exports.strictObject({
+  sources: external_exports.array(RemoteCredentialSourceSchema).min(1).optional(),
+  target: external_exports.enum(targets).optional(),
+  cache: external_exports.union([external_exports.literal(false), CredentialCacheSchema]).optional()
+});
+var CredentialSummarySchema2 = external_exports.strictObject({
+  target: external_exports.enum(CREDENTIAL_TARGETS),
+  sources: external_exports.readonly(external_exports.array(
+    external_exports.discriminatedUnion("kind", [
+      external_exports.strictObject({ kind: external_exports.literal("env"), variable: external_exports.string() }),
+      external_exports.strictObject({ kind: external_exports.literal("file"), path: external_exports.string() }),
+      external_exports.strictObject({ kind: external_exports.literal("command"), program: external_exports.string() }),
+      external_exports.strictObject({ kind: external_exports.literal("op"), reference: external_exports.string() }),
+      external_exports.strictObject({ kind: external_exports.literal("keychain"), service: external_exports.string(), account: external_exports.string().optional() }),
+      external_exports.strictObject({ kind: external_exports.literal("literal") })
+    ])
+  )),
+  cache: CredentialCacheSchema.optional()
+});
+var mutationOutput = (kind, action) => external_exports.strictObject({ action: external_exports.literal(action), kind: external_exports.literal(kind), name: external_exports.string() });
+var storedMutationOutput = (kind, action, value2) => external_exports.strictObject({ action: external_exports.literal(action), kind: external_exports.literal(kind), name: external_exports.string(), value: value2 });
+var IdentityValueSchema = external_exports.strictObject({
+  name: external_exports.string(),
+  defaultConfigProfile: external_exports.string().optional(),
+  allowAmbientCredential: external_exports.boolean(),
+  credential: CredentialSummarySchema2.optional()
+});
+var ProfileValueSchema = ConfigProfileSchema.omit({ $schema: true });
+var ProviderValueSchema = external_exports.strictObject({
+  name: external_exports.string(),
+  kind: external_exports.enum(PROVIDER_KINDS),
+  displayName: external_exports.string(),
+  baseUrl: external_exports.string().optional(),
+  codex: CodexProviderConfigSchema.optional(),
+  credential: CredentialSummarySchema2,
+  env: external_exports.record(external_exports.string(), external_exports.string()).optional()
+});
+var ConfigNameInputSchema = external_exports.strictObject({ name: external_exports.string().min(1) });
+var ConfigIdentityAddOutputSchema = storedMutationOutput("identity", "created", IdentityValueSchema);
+var ConfigIdentitySetInputSchema = external_exports.strictObject({
+  name: external_exports.string().min(1),
+  defaultConfigProfile: external_exports.union([external_exports.string().min(1), external_exports.literal(false)]).optional(),
+  allowAmbientCredential: external_exports.boolean().optional(),
+  credential: external_exports.union([external_exports.literal(false), CredentialWriteSchema(CREDENTIAL_TARGETS)]).optional()
+});
+var ConfigIdentitySetOutputSchema = storedMutationOutput("identity", "updated", IdentityValueSchema);
+var ConfigIdentityRemoveInputSchema = external_exports.strictObject({ name: external_exports.string().min(1), confirm: RemovalConfirmationSchema });
+var ConfigIdentityRemoveOutputSchema = mutationOutput("identity", "removed");
+var ConfigIdentityUseOutputSchema = mutationOutput("identity", "selected");
+var ConfigProfileAddInputSchema = external_exports.strictObject({
+  name: external_exports.string().min(1),
+  extends: external_exports.array(external_exports.string().min(1)).optional(),
+  description: external_exports.string().optional()
+});
+var ConfigProfileAddOutputSchema = storedMutationOutput("profile", "created", ProfileValueSchema);
+var ConfigProfileSetInputSchema = external_exports.strictObject({
+  name: external_exports.string().min(1),
+  category: external_exports.record(external_exports.string(), external_exports.boolean()).optional(),
+  entry: external_exports.record(external_exports.string(), external_exports.boolean()).optional(),
+  extends: external_exports.union([external_exports.array(external_exports.string().min(1)), external_exports.literal(false)]).optional(),
+  description: external_exports.union([external_exports.string(), external_exports.literal(false)]).optional(),
+  launch: external_exports.strictObject({
+    skipPermissions: external_exports.boolean().optional(),
+    remoteControl: external_exports.boolean().optional(),
+    headroom: external_exports.boolean().optional(),
+    trackUsage: external_exports.boolean().optional(),
+    provider: external_exports.union([external_exports.string().min(1), external_exports.literal(false)]).optional(),
+    claudeVersion: external_exports.union([external_exports.string().min(1), external_exports.literal(false)]).optional()
+  }).optional()
+});
+var ConfigProfileSetOutputSchema = storedMutationOutput("profile", "updated", ProfileValueSchema);
+var ConfigProfileRemoveInputSchema = external_exports.strictObject({ name: external_exports.string().min(1), confirm: RemovalConfirmationSchema });
+var ConfigProfileRemoveOutputSchema = mutationOutput("profile", "removed");
+var ConfigProfileUseOutputSchema = mutationOutput("profile", "selected");
+var PoolMembersInputSchema = external_exports.array(external_exports.string().min(1)).min(1);
+var ConfigPoolAddInputSchema = external_exports.strictObject({
+  name: external_exports.string().min(1),
+  identities: PoolMembersInputSchema,
+  preference: external_exports.enum(POOL_PREFERENCES).optional()
+});
+var ConfigPoolAddOutputSchema = storedMutationOutput("pool", "created", PoolSchema);
+var ConfigPoolSetInputSchema = external_exports.strictObject({
+  name: external_exports.string().min(1),
+  identities: PoolMembersInputSchema.optional(),
+  preference: external_exports.union([external_exports.enum(POOL_PREFERENCES), external_exports.literal(false)]).optional()
+});
+var ConfigPoolSetOutputSchema = storedMutationOutput("pool", "updated", PoolSchema);
+var ConfigPoolRemoveInputSchema = external_exports.strictObject({ name: external_exports.string().min(1), confirm: RemovalConfirmationSchema });
+var ConfigPoolRemoveOutputSchema = mutationOutput("pool", "removed");
+var ConfigPoolUseOutputSchema = mutationOutput("pool", "selected");
+var ConfigProviderAddInputSchema = external_exports.strictObject({
+  name: external_exports.string().min(1),
+  kind: external_exports.enum(PROVIDER_KINDS).optional(),
+  displayName: external_exports.string().min(1),
+  baseUrl: external_exports.string().min(1).optional(),
+  credential: CredentialWriteSchema(PROVIDER_CREDENTIAL_TARGETS).required({ sources: true }),
+  codex: CodexProviderConfigSchema.optional()
+});
+var ConfigProviderAddOutputSchema = storedMutationOutput("provider", "created", ProviderValueSchema);
+var ConfigProviderSetInputSchema = external_exports.strictObject({
+  name: external_exports.string().min(1),
+  displayName: external_exports.string().min(1).optional(),
+  baseUrl: external_exports.string().min(1).optional(),
+  credential: CredentialWriteSchema(PROVIDER_CREDENTIAL_TARGETS).optional(),
+  codex: CodexProviderConfigSchema.optional()
+});
+var ConfigProviderSetOutputSchema = storedMutationOutput("provider", "updated", ProviderValueSchema);
+var ConfigProviderRemoveInputSchema = external_exports.strictObject({ name: external_exports.string().min(1), confirm: RemovalConfirmationSchema });
+var ConfigProviderRemoveOutputSchema = mutationOutput("provider", "removed");
+var ConfigRuleAddInputSchema = external_exports.strictObject({
+  path: external_exports.string().min(1),
+  configProfile: external_exports.string().min(1).optional(),
+  identity: external_exports.string().min(1).optional()
+});
+var ConfigRuleAddOutputSchema = storedMutationOutput("rule", "created", DirectoryRuleSchema);
+var ConfigRuleSetInputSchema = external_exports.strictObject({
+  path: external_exports.string().min(1),
+  configProfile: external_exports.union([external_exports.string().min(1), external_exports.literal(false)]).optional(),
+  identity: external_exports.union([external_exports.string().min(1), external_exports.literal(false)]).optional()
+});
+var ConfigRuleSetOutputSchema = storedMutationOutput("rule", "updated", DirectoryRuleSchema);
+var ConfigRuleRemoveInputSchema = external_exports.strictObject({ path: external_exports.string().min(1), confirm: RemovalConfirmationSchema });
+var ConfigRuleRemoveOutputSchema = mutationOutput("rule", "removed");
+
+// src/frontdoor/configApi.ts
+var CONFIG_API_TAG = "config";
+function refusal(error63) {
+  if (error63 instanceof IdentityNotFoundError || error63 instanceof ProfileNotFoundError || error63 instanceof PoolNotFoundError || error63 instanceof ProviderNotFoundError || error63 instanceof DirectoryRuleNotFoundError) {
+    throw new ORPCError("NOT_FOUND", { message: error63.message });
+  }
+  if (error63 instanceof IdentityAlreadyExistsError || error63 instanceof ProfileAlreadyExistsError || error63 instanceof PoolAlreadyExistsError || error63 instanceof ProviderAlreadyExistsError || error63 instanceof DirectoryRuleAlreadyExistsError) {
+    throw new ORPCError("CONFLICT", { message: error63.message });
+  }
+  if (error63 instanceof CliError) {
+    throw new ORPCError("BAD_REQUEST", { message: error63.message });
+  }
+  throw error63;
+}
+function guarded(write) {
+  try {
+    return write();
+  } catch (error63) {
+    return refusal(error63);
+  }
+}
+function requireConfirmation(confirm, what) {
+  if (!confirm) {
+    throw new ORPCError("BAD_REQUEST", { message: `removing ${what} needs confirm: true, the API's form of the CLI's --yes` });
+  }
+}
+function requireChange(given, fields) {
+  if (!given) {
+    throw new ORPCError("BAD_REQUEST", { message: `Nothing to change: pass ${fields}.` });
+  }
+}
+function identityValue(name, paths) {
+  const identity = readIdentity(paths, name);
+  if (identity === void 0) {
+    throw new IdentityNotFoundError(name);
+  }
+  return {
+    name: identity.name,
+    ...identity.defaultConfigProfile === void 0 ? {} : { defaultConfigProfile: identity.defaultConfigProfile },
+    allowAmbientCredential: identity.allowAmbientCredential,
+    ...identity.credential === void 0 ? {} : { credential: summariseCredential(identity.credential) }
+  };
+}
+function providerValue(name, provider) {
+  return {
+    name,
+    kind: provider.kind ?? "http",
+    displayName: provider.displayName,
+    ...isCodexProvider(provider) ? provider.codex === void 0 ? {} : { codex: provider.codex } : { baseUrl: provider.baseUrl },
+    credential: summariseCredential(provider.credential),
+    ...provider.env === void 0 ? {} : { env: provider.env }
+  };
+}
+function profileValue(name, paths) {
+  const profile = { ...readProfile(paths, name) };
+  delete profile.$schema;
+  return profile;
+}
+function createConfigApiRouter(deps) {
+  const authed = doorApiAuth(deps.expectedToken);
+  const { paths } = deps;
+  const route = (path48, summary) => authed.meta(openapi({ method: "POST", path: path48, summary, tags: [CONFIG_API_TAG] }));
+  return {
+    config: {
+      identity: {
+        add: route("/rest/config/identity/add", "Create an identity").input(ConfigNameInputSchema).output(ConfigIdentityAddOutputSchema).handler(
+          ({ input: input2 }) => guarded(() => {
+            addIdentity(paths, input2.name);
+            return { action: "created", kind: "identity", name: input2.name, value: identityValue(input2.name, paths) };
+          })
+        ),
+        set: route("/rest/config/identity/set", "Update an identity's default profile, ambient-credential setting or credential").input(ConfigIdentitySetInputSchema).output(ConfigIdentitySetOutputSchema).handler(
+          ({ input: input2 }) => guarded(() => {
+            requireChange(input2.defaultConfigProfile !== void 0 || input2.allowAmbientCredential !== void 0 || input2.credential !== void 0, "defaultConfigProfile, allowAmbientCredential or credential");
+            if (!identityExists(paths, input2.name)) {
+              throw new IdentityNotFoundError(input2.name);
+            }
+            if (typeof input2.defaultConfigProfile === "string") {
+              requireProfileExists(paths, input2.defaultConfigProfile);
+            }
+            if (input2.defaultConfigProfile !== void 0) {
+              setDefaultConfigProfile(paths, input2.name, input2.defaultConfigProfile === false ? void 0 : input2.defaultConfigProfile);
+            }
+            if (input2.allowAmbientCredential !== void 0) {
+              setAllowAmbientCredential(paths, input2.name, input2.allowAmbientCredential);
+            }
+            if (input2.credential === false) {
+              setIdentityCredential(paths, input2.name, false);
+            } else if (input2.credential !== void 0) {
+              const { sources, target, cache } = input2.credential;
+              const merged = cache === void 0 ? void 0 : mergeCredentialCache(cache === false ? { enabled: false } : { ...cache, enabled: true }, readIdentity(paths, input2.name)?.credential?.cache);
+              const change = {
+                ...sources === void 0 ? {} : { sources },
+                ...target === void 0 ? {} : { target },
+                ...merged === void 0 ? {} : { cache: merged }
+              };
+              setIdentityCredential(paths, input2.name, change);
+            }
+            return { action: "updated", kind: "identity", name: input2.name, value: identityValue(input2.name, paths) };
+          })
+        ),
+        remove: route("/rest/config/identity/remove", "Delete an identity and its directory").input(ConfigIdentityRemoveInputSchema).output(ConfigIdentityRemoveOutputSchema).handler(({ input: input2 }) => {
+          requireConfirmation(input2.confirm, `identity "${input2.name}" and its directory`);
+          return guarded(() => {
+            removeIdentity(paths, input2.name);
+            return { action: "removed", kind: "identity", name: input2.name };
+          });
+        }),
+        use: route("/rest/config/identity/use", "Select the active identity").input(ConfigNameInputSchema).output(ConfigIdentityUseOutputSchema).handler(
+          ({ input: input2 }) => guarded(() => {
+            if (poolNameOf(input2.name) === void 0 && !identityExists(paths, input2.name)) {
+              throw new IdentityNotFoundError(input2.name);
+            }
+            useIdentity(paths, input2.name);
+            return { action: "selected", kind: "identity", name: input2.name };
+          })
+        )
+      },
+      profile: {
+        add: route("/rest/config/profile/add", "Create a configuration profile").input(ConfigProfileAddInputSchema).output(ConfigProfileAddOutputSchema).handler(
+          ({ input: input2 }) => guarded(() => {
+            createProfile(paths, input2.name, input2.extends, input2.description);
+            return { action: "created", kind: "profile", name: input2.name, value: profileValue(input2.name, paths) };
+          })
+        ),
+        set: route("/rest/config/profile/set", "Update a configuration profile's categories, entries, extends list, description or launch settings").input(ConfigProfileSetInputSchema).output(ConfigProfileSetOutputSchema).handler(
+          ({ input: input2 }) => guarded(() => {
+            const { launch } = input2;
+            requireChange(
+              input2.category !== void 0 || input2.entry !== void 0 || input2.extends !== void 0 || input2.description !== void 0 || launch !== void 0,
+              "category, entry, extends, description or launch"
+            );
+            requireProfileExists(paths, input2.name);
+            applyProfileChange(paths, input2.name, {
+              ...input2.category === void 0 ? {} : { category: input2.category },
+              ...input2.entry === void 0 ? {} : { entry: input2.entry },
+              ...input2.extends === void 0 ? {} : { extends: input2.extends },
+              ...input2.description === void 0 ? {} : { description: input2.description },
+              ...launch?.skipPermissions === void 0 ? {} : { launchSkipPermissions: launch.skipPermissions },
+              ...launch?.remoteControl === void 0 ? {} : { launchRemoteControl: launch.remoteControl },
+              ...launch?.headroom === void 0 ? {} : { launchHeadroom: launch.headroom },
+              ...launch?.trackUsage === void 0 ? {} : { launchTrackUsage: launch.trackUsage },
+              ...launch?.provider === void 0 ? {} : { launchProvider: launch.provider },
+              ...launch?.claudeVersion === void 0 ? {} : { launchClaudeVersion: launch.claudeVersion }
+            });
+            return { action: "updated", kind: "profile", name: input2.name, value: profileValue(input2.name, paths) };
+          })
+        ),
+        remove: route("/rest/config/profile/remove", "Delete a configuration profile").input(ConfigProfileRemoveInputSchema).output(ConfigProfileRemoveOutputSchema).handler(({ input: input2 }) => {
+          requireConfirmation(input2.confirm, `configuration profile "${input2.name}"`);
+          return guarded(() => {
+            removeProfile(paths, input2.name);
+            return { action: "removed", kind: "profile", name: input2.name };
+          });
+        }),
+        use: route("/rest/config/profile/use", "Make a configuration profile the global default").input(ConfigNameInputSchema).output(ConfigProfileUseOutputSchema).handler(
+          ({ input: input2 }) => guarded(() => {
+            requireProfileExists(paths, input2.name);
+            setGlobalDefaultProfile(paths, input2.name);
+            return { action: "selected", kind: "profile", name: input2.name };
+          })
+        )
+      },
+      pool: {
+        add: route("/rest/config/pool/add", "Define a pool").input(ConfigPoolAddInputSchema).output(ConfigPoolAddOutputSchema).handler(
+          ({ input: input2 }) => guarded(() => {
+            requireIdentityNames(paths, input2.identities);
+            const created = addPool(paths, input2.name, input2.identities, input2.preference);
+            return { action: "created", kind: "pool", name: input2.name, value: created };
+          })
+        ),
+        set: route("/rest/config/pool/set", "Replace a pool's members, its preference or both").input(ConfigPoolSetInputSchema).output(ConfigPoolSetOutputSchema).handler(
+          ({ input: input2 }) => guarded(() => {
+            requireChange(input2.identities !== void 0 || input2.preference !== void 0, "identities or preference");
+            const existing = requirePool(paths, input2.name);
+            if (input2.identities !== void 0) {
+              requireIdentityNames(paths, input2.identities);
+            }
+            const members2 = input2.identities ?? existing.identities;
+            const preference = input2.preference === void 0 ? existing.preference : input2.preference === false ? void 0 : input2.preference;
+            return { action: "updated", kind: "pool", name: input2.name, value: setPool(paths, input2.name, members2, preference) };
+          })
+        ),
+        remove: route("/rest/config/pool/remove", "Delete a pool").input(ConfigPoolRemoveInputSchema).output(ConfigPoolRemoveOutputSchema).handler(({ input: input2 }) => {
+          requireConfirmation(input2.confirm, `pool "${input2.name}"`);
+          return guarded(() => {
+            removePool(paths, input2.name);
+            return { action: "removed", kind: "pool", name: input2.name };
+          });
+        }),
+        use: route("/rest/config/pool/use", "Make launches with no other selection pick a member of a pool").input(ConfigNameInputSchema).output(ConfigPoolUseOutputSchema).handler(
+          ({ input: input2 }) => guarded(() => {
+            if (readPools(paths)[input2.name] === void 0) {
+              throw new PoolNotFoundError(input2.name);
+            }
+            useIdentity(paths, `pool:${input2.name}`);
+            return { action: "selected", kind: "pool", name: input2.name };
+          })
+        )
+      },
+      provider: {
+        add: route("/rest/config/provider/add", "Create an API provider definition").input(ConfigProviderAddInputSchema).output(ConfigProviderAddOutputSchema).handler(
+          ({ input: input2 }) => guarded(() => {
+            const created = addProvider(paths, input2.name, {
+              ...input2.kind === void 0 ? {} : { kind: input2.kind },
+              displayName: input2.displayName,
+              ...input2.baseUrl === void 0 ? {} : { baseUrl: input2.baseUrl },
+              sources: input2.credential.sources,
+              ...input2.credential.target === void 0 ? {} : { target: input2.credential.target },
+              ...input2.codex === void 0 ? {} : { codex: input2.codex }
+            });
+            const cache = input2.credential.cache;
+            const stored = cache === void 0 || cache === false ? created : updateProvider(paths, input2.name, { cache });
+            return { action: "created", kind: "provider", name: input2.name, value: providerValue(input2.name, stored) };
+          })
+        ),
+        set: route("/rest/config/provider/set", "Update an API provider definition").input(ConfigProviderSetInputSchema).output(ConfigProviderSetOutputSchema).handler(
+          ({ input: input2 }) => guarded(() => {
+            requireChange(input2.displayName !== void 0 || input2.baseUrl !== void 0 || input2.credential !== void 0 || input2.codex !== void 0, "displayName, baseUrl, credential or codex");
+            const existing = readProvider(paths, input2.name);
+            if (existing === void 0) {
+              throw new ProviderNotFoundError(input2.name);
+            }
+            const credential = input2.credential;
+            if (input2.baseUrl !== void 0 && !isCodexProvider(existing) && input2.baseUrl !== existing.baseUrl && credential?.sources === void 0) {
+              throw new ORPCError("BAD_REQUEST", { message: `Changing the base URL of provider "${input2.name}" requires a credential block in the same call: the stored credential is not sent to a different endpoint.` });
+            }
+            const cache = credential?.cache === void 0 ? void 0 : mergeCredentialCache(credential.cache === false ? { enabled: false } : { ...credential.cache, enabled: true }, existing.credential.cache);
+            const updated = updateProvider(paths, input2.name, {
+              ...input2.displayName === void 0 ? {} : { displayName: input2.displayName },
+              ...input2.baseUrl === void 0 ? {} : { baseUrl: input2.baseUrl },
+              ...credential?.sources === void 0 ? {} : { sources: credential.sources },
+              ...credential?.target === void 0 ? {} : { target: credential.target },
+              ...cache === void 0 ? {} : { cache },
+              ...input2.codex === void 0 ? {} : { codex: input2.codex }
+            });
+            return { action: "updated", kind: "provider", name: input2.name, value: providerValue(input2.name, updated) };
+          })
+        ),
+        remove: route("/rest/config/provider/remove", "Delete an API provider definition").input(ConfigProviderRemoveInputSchema).output(ConfigProviderRemoveOutputSchema).handler(({ input: input2 }) => {
+          requireConfirmation(input2.confirm, `provider "${input2.name}"`);
+          return guarded(() => {
+            if (!providerExists(paths, input2.name)) {
+              throw new ProviderNotFoundError(input2.name);
+            }
+            removeProvider(paths, input2.name);
+            return { action: "removed", kind: "provider", name: input2.name };
+          });
+        })
+      },
+      rule: {
+        add: route("/rest/config/rule/add", "Add a directory rule for a path").input(ConfigRuleAddInputSchema).output(ConfigRuleAddOutputSchema).handler(
+          ({ input: input2 }) => guarded(() => {
+            if (input2.identity !== void 0) {
+              requireRuleSelector(paths, input2.identity);
+            }
+            if (input2.configProfile !== void 0) {
+              requireProfileExists(paths, input2.configProfile);
+            }
+            const created = addDirectoryRule(paths, input2.path, {
+              ...input2.configProfile === void 0 ? {} : { configProfile: input2.configProfile },
+              ...input2.identity === void 0 ? {} : { identity: input2.identity }
+            });
+            return { action: "created", kind: "rule", name: input2.path, value: created };
+          })
+        ),
+        set: route("/rest/config/rule/set", "Update the directory rule for a path").input(ConfigRuleSetInputSchema).output(ConfigRuleSetOutputSchema).handler(
+          ({ input: input2 }) => guarded(() => {
+            requireChange(input2.configProfile !== void 0 || input2.identity !== void 0, "configProfile or identity");
+            if (typeof input2.identity === "string") {
+              requireRuleSelector(paths, input2.identity);
+            }
+            if (typeof input2.configProfile === "string") {
+              requireProfileExists(paths, input2.configProfile);
+            }
+            const updated = updateDirectoryRule(paths, input2.path, {
+              ...input2.configProfile === void 0 ? {} : { configProfile: input2.configProfile },
+              ...input2.identity === void 0 ? {} : { identity: input2.identity }
+            });
+            return { action: "updated", kind: "rule", name: input2.path, value: updated };
+          })
+        ),
+        remove: route("/rest/config/rule/remove", "Remove the directory rule for a path").input(ConfigRuleRemoveInputSchema).output(ConfigRuleRemoveOutputSchema).handler(({ input: input2 }) => {
+          requireConfirmation(input2.confirm, `the directory rule for "${input2.path}"`);
+          return guarded(() => {
+            if (!listDirectoryRules(paths).some((entry) => entry.path === input2.path)) {
+              throw new DirectoryRuleNotFoundError(input2.path);
+            }
+            removeDirectoryRule(paths, input2.path);
+            return { action: "removed", kind: "rule", name: input2.path };
+          });
+        })
+      }
+    }
+  };
+}
+
 // src/frontdoor/eventSchemas.ts
 init_zod();
 var DOOR_EVENT_SOURCE_RC = "rc";
@@ -123159,7 +123645,16 @@ function createLaunchApiRouter(deps) {
   const authed = doorApiAuth(deps.expectedToken);
   return {
     launch: {
-      resolve: authed.meta(openapi({ method: "POST", path: "/rest/launch/resolve", summary: "Resolve what a launch from one directory would do, without performing it", tags: [LAUNCH_API_TAG] })).input(LaunchResolveInputSchema).output(LaunchResolveOutputSchema).handler(({ input: input2 }) => {
+      resolve: authed.meta(
+        openapi({
+          method: "POST",
+          path: "/rest/launch/resolve",
+          summary: "Resolve what a launch from one directory would do, without performing it",
+          tags: [LAUNCH_API_TAG],
+          // A POST because the launch's environment and arguments are a body, but the answer changes nothing.
+          spec: (current) => ({ ...current, [READ_ONLY_OPERATION_EXTENSION]: true })
+        })
+      ).input(LaunchResolveInputSchema).output(LaunchResolveOutputSchema).handler(({ input: input2 }) => {
         try {
           const { resolution, warnings } = deps.resolveLaunch({ path: input2.path, argv: input2.argv ?? [], env: input2.env ?? {} });
           return { ...resolution, warnings };
@@ -123241,7 +123736,7 @@ function createControlApiRouter(deps) {
 function createDoorApiRouter(deps) {
   const control = createControlApiRouter(deps);
   const lifecycle = createLifecycleApiRouter(deps);
-  return { ...createRcApiRouter(deps), ...control, ...lifecycle, ...createCodexApiRouter(deps), ...createLaunchApiRouter(deps), ...createEventsApiRouter(deps), frontdoor: { ...control.frontdoor, ...lifecycle.frontdoor } };
+  return { ...createRcApiRouter(deps), ...control, ...lifecycle, ...createConfigApiRouter(deps), ...createCodexApiRouter(deps), ...createLaunchApiRouter(deps), ...createEventsApiRouter(deps), frontdoor: { ...control.frontdoor, ...lifecycle.frontdoor } };
 }
 function createDoorApiNodeHandler(deps) {
   return doorApiNodeHandlerOf(createDoorApiRouter(deps), deps.expectedToken);
@@ -126299,9 +126794,9 @@ async function serveRcCompatSessions(ctx, pathname, compatPath) {
   const slash = rest.indexOf("/");
   const address = slash === -1 ? rest : rest.slice(0, slash);
   const compatTail = slash === -1 ? "" : rest.slice(slash + 1);
-  const refusal = ctx.credentialRefusal(request7.headers);
-  if (refusal !== void 0) {
-    await ctx.unauthorized(response, refusal);
+  const refusal2 = ctx.credentialRefusal(request7.headers);
+  if (refusal2 !== void 0) {
+    await ctx.unauthorized(response, refusal2);
     return;
   }
   const session = ctx.sessions.get(address) ?? ctx.sessions.get(`cse_${address}`);
@@ -126379,9 +126874,9 @@ function conversationRow(conversation) {
 }
 async function serveRcConversations(ctx, pathname, method) {
   const { request: request7, response, conversations } = ctx;
-  const refusal = ctx.credentialRefusal(request7.headers);
-  if (refusal !== void 0) {
-    await ctx.unauthorized(response, refusal);
+  const refusal2 = ctx.credentialRefusal(request7.headers);
+  if (refusal2 !== void 0) {
+    await ctx.unauthorized(response, refusal2);
     return;
   }
   if (pathname === RC_CONVERSATIONS_PATH_PREFIX) {
@@ -126602,9 +127097,9 @@ async function fetchThroughWebProxy(url2, deps) {
   try {
     let redirects = 0;
     for (; ; ) {
-      const refusal = await checkTarget(current, deps);
-      if (refusal !== void 0) {
-        return refusal;
+      const refusal2 = await checkTarget(current, deps);
+      if (refusal2 !== void 0) {
+        return refusal2;
       }
       let hop;
       try {
@@ -126974,8 +127469,8 @@ data: ${JSON.stringify(envelope)}
     "doubled-scheme-word": "the self-hosted Remote Control surface reads one Bearer scheme word, and this call's Authorization header carried it twice: a persisted session record holds the whole header value with the scheme word included, so prefixing Bearer onto it presents a different credential",
     unrecognised: "the self-hosted Remote Control surface did not recognise the presented credential"
   };
-  const unauthorized = async (response, refusal) => {
-    await answerJson2(response, HTTP_STATUS.unauthorized, { type: "error", error: { type: "authentication_error", message: refusalMessages[refusal] } });
+  const unauthorized = async (response, refusal2) => {
+    await answerJson2(response, HTTP_STATUS.unauthorized, { type: "error", error: { type: "authentication_error", message: refusalMessages[refusal2] } });
   };
   const serveSessionPath = async (session, tail, request7, response) => {
     const method = request7.method.toUpperCase();
@@ -126986,9 +127481,9 @@ data: ${JSON.stringify(envelope)}
     session.lastTrafficAt = deps.now();
     if (tail === "") {
       if (method === "PATCH" || method === "PUT") {
-        const refusal = credentialRefusal(request7.headers);
-        if (refusal !== void 0) {
-          await unauthorized(response, refusal);
+        const refusal2 = credentialRefusal(request7.headers);
+        if (refusal2 !== void 0) {
+          await unauthorized(response, refusal2);
           return;
         }
         const body = parseJsonObject5(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
@@ -127011,9 +127506,9 @@ data: ${JSON.stringify(envelope)}
       return;
     }
     if (tail === "bridge" && method === "POST") {
-      const refusal = credentialRefusal(request7.headers);
-      if (refusal !== void 0) {
-        await unauthorized(response, refusal);
+      const refusal2 = credentialRefusal(request7.headers);
+      if (refusal2 !== void 0) {
+        await unauthorized(response, refusal2);
         return;
       }
       const workerJwt = mintWorkerJwt(deps.randomToken, deps.now());
@@ -127023,9 +127518,9 @@ data: ${JSON.stringify(envelope)}
       return;
     }
     if (tail === "archive" && method === "POST") {
-      const refusal = credentialRefusal(request7.headers);
-      if (refusal !== void 0) {
-        await unauthorized(response, refusal);
+      const refusal2 = credentialRefusal(request7.headers);
+      if (refusal2 !== void 0) {
+        await unauthorized(response, refusal2);
         return;
       }
       retireSession(session);
@@ -127036,9 +127531,9 @@ data: ${JSON.stringify(envelope)}
     if (tail === "worker" || tail.startsWith("worker/")) {
       const workerTail = tail === "worker" ? "" : tail.slice("worker/".length);
       const webProxy = workerTail === "web-fetch" || workerTail === "web-search";
-      const refusal = webProxy ? workerOrCredentialRefusal(request7.headers, session) : workerRefusal(request7.headers, session);
-      if (refusal !== void 0) {
-        await unauthorized(response, refusal);
+      const refusal2 = webProxy ? workerOrCredentialRefusal(request7.headers, session) : workerRefusal(request7.headers, session);
+      if (refusal2 !== void 0) {
+        await unauthorized(response, refusal2);
         return;
       }
       if (workerTail === "" && method === "GET") {
@@ -127969,6 +128464,7 @@ function realFrontDoorSupervisorPorts(paths) {
         [
           createDoorApiNodeHandler({
             expectedToken: rcControlToken,
+            paths,
             statusOf: rcTracker.statusOf,
             pendingOf: rcTracker.pendingOf,
             inject: rcInject,
@@ -137879,6 +138375,7 @@ var OperationSchema = external_exports.object({
   summary: external_exports.string().optional(),
   description: external_exports.string().optional(),
   tags: external_exports.array(external_exports.string()).optional(),
+  [READ_ONLY_OPERATION_EXTENSION]: external_exports.boolean().optional(),
   parameters: external_exports.array(external_exports.object({ in: external_exports.string(), name: external_exports.string(), required: external_exports.boolean().optional(), schema: external_exports.unknown().optional(), description: external_exports.string().optional() })).optional(),
   requestBody: external_exports.object({ content: external_exports.record(external_exports.string(), external_exports.object({ schema: JsonSchemaObjectSchema.optional() })) }).optional(),
   responses: external_exports.record(external_exports.string(), external_exports.object({ content: external_exports.record(external_exports.string(), external_exports.unknown()).optional() })).optional()
@@ -137927,7 +138424,7 @@ function toolsFromOpenApiDocument(document, permissions) {
       if (isStream(operation)) {
         continue;
       }
-      const readOnly = method === "get";
+      const readOnly = method === "get" || operation[READ_ONLY_OPERATION_EXTENSION] === true;
       const tag = operation.tags?.[0];
       if (!permitted(tag, readOnly, permissions)) {
         continue;
@@ -138579,7 +139076,6 @@ function registerHeadroomCommand(program2, deps) {
 init_commandDeps();
 init_cliError();
 init_schema();
-init_identity();
 init_schema();
 init_realPorts();
 init_preflight();
@@ -138593,14 +139089,6 @@ function formatPoolPick(report, nowMs) {
   });
   return [head, ...rows, ...report.missing.map((name) => `  (skipped: ${name} is not an identity)`), ...report.stickyProblem === void 0 ? [] : [`Note: ${report.stickyProblem}; the last-pick record was ignored.`]];
 }
-function requireIdentities(paths, names) {
-  const existing = new Set(listIdentities(paths).map((entry) => entry.name));
-  for (const name of names) {
-    if (poolNameOf(name) === void 0 && !existing.has(name)) {
-      throw new IdentityNotFoundError(name);
-    }
-  }
-}
 function membersOf(options) {
   if (options.identity === void 0 || options.identity.length === 0) {
     throw new UsageError("A pool needs at least one member: pass --identity <name> (repeatable).");
@@ -138617,7 +139105,7 @@ function registerPoolCommand(program2, deps) {
   withExamples(
     pool.command("add <name>").description("Define a pool. Fails if one with this name already exists.").option("--identity <name>", "A member: an identity name, or pool:<name> to nest another pool with its own policy (repeatable).", collectRepeated).addOption(new Option("--preference <mode>", PREFERENCE_DESCRIPTION).choices(POOL_PREFERENCES)).option("--json", "Print the result as JSON.").action((name, options) => {
       const members2 = membersOf(options);
-      requireIdentities(paths, members2);
+      requireIdentityNames(paths, members2);
       const created = addPool(paths, name, members2, options.preference);
       reportMutation(options.json, { action: "created", kind: "pool", name, value: created }, () => {
         console.log(`Created pool "${name}" with ${members2.join(", ")}.`);
@@ -138633,7 +139121,7 @@ function registerPoolCommand(program2, deps) {
       }
       const members2 = options.identity === void 0 ? existing.identities : membersOf(options);
       if (options.identity !== void 0) {
-        requireIdentities(paths, membersOf(options));
+        requireIdentityNames(paths, membersOf(options));
       }
       const preference = options.preference === void 0 ? existing.preference : options.preference === false ? void 0 : options.preference;
       const updated = setPool(paths, name, members2, preference);
@@ -138889,21 +139377,13 @@ function registerProviderCommand(program2, deps) {
 // src/directoryRules.ts
 init_commandDeps();
 init_cliError();
-init_schema();
 function describeRule(rule) {
   const parts = Object.entries(rule).filter(([key]) => key !== "path").map(([key, value2]) => `${key}=${typeof value2 === "string" ? value2 : JSON.stringify(value2)}`);
   return parts.length === 0 ? "(nothing)" : parts.join(", ");
 }
 async function checkRuleTargets(deps, options) {
   if (typeof options.identity === "string") {
-    if (options.identity.startsWith(POOL_SELECTOR_PREFIX)) {
-      const poolName = options.identity.slice(POOL_SELECTOR_PREFIX.length);
-      if (readPools(deps.paths)[poolName] === void 0) {
-        throw new PoolNotFoundError(poolName);
-      }
-    } else if (readIdentity(deps.paths, options.identity) === void 0) {
-      throw new IdentityNotFoundError(options.identity);
-    }
+    requireRuleSelector(deps.paths, options.identity);
   }
   if (typeof options.configProfile === "string") {
     await ensureProfileExists(deps, options.configProfile);