claude-use 9.7.2 → 9.9.0

package/dist/index.mjs

@@ -607,9 +607,9 @@ function applyPatch(filePath, schema, patch, options = {}) {
   if (!result.success) {
     throw new ConfigValidationError(filePath, result.error.issues);
   }
-  const validated2 = result.data;
-  writeJsonAtomic(filePath, validated2, storeFs);
-  return validated2;
+  const validated3 = result.data;
+  writeJsonAtomic(filePath, validated3, storeFs);
+  return validated3;
 }
 var nodeStoreFs;
 var init_store = __esm({
@@ -2639,7 +2639,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "claude-use",
-      version: "9.7.2",
+      version: "9.9.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -2745,7 +2745,7 @@ var init_package = __esm({
 // src/headroom/state.ts
 import { createHash as createHash3 } from "node:crypto";
 import path11 from "node:path";
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 function parseJson(raw, schema) {
   if (raw === void 0 || raw.trim() === "") {
     return void 0;
@@ -2876,28 +2876,28 @@ var init_state2 = __esm({
     "use strict";
     init_schema();
     HEADROOM_ANTHROPIC_UPSTREAM = "https://api.anthropic.com";
-    HeadroomStateSchema = z5.strictObject({
+    HeadroomStateSchema = z6.strictObject({
       /** The supervisor process owning the daemon. Alive means someone is keeping headroom running. */
-      supervisorPid: z5.number().int().positive().optional(),
+      supervisorPid: z6.number().int().positive().optional(),
       /** The headroom proxy process itself. Absent while the supervisor is between restarts. */
-      headroomPid: z5.number().int().positive().optional(),
+      headroomPid: z6.number().int().positive().optional(),
       /**
        * The unix socket the proxy serves on, inside the owner-only socket directory. Absent until the proxy has passed its readiness check, so "socketPath is set" is itself the ready signal a launcher polls for. The front door reads it on every hop, so a restart (which keeps the generation's path) is followed without anything being relaunched.
        */
-      socketPath: z5.string().min(1).optional(),
+      socketPath: z6.string().min(1).optional(),
       /** The `headroom --version` output of the running install. */
-      version: z5.string().optional(),
+      version: z6.string().optional(),
       /** Hash of the allowlist the running proxy was started with, so a provider-file change is detected as drift. */
-      allowlistHash: z5.string().optional(),
+      allowlistHash: z6.string().optional(),
       /** Hash of the token-saving settings the running proxy was started with, so a settings change is detected as drift. */
-      settingsHash: z5.string().optional(),
+      settingsHash: z6.string().optional(),
       /** The install spec the running install was last installed from, so a `source` config change is detected as drift. */
-      installedSource: z5.string().optional(),
+      installedSource: z6.string().optional(),
       /** The last fatal error, kept across shutdowns so `headroom status` can explain a daemon that is not running. */
-      lastError: z5.string().optional()
+      lastError: z6.string().optional()
     });
-    HeadroomSessionSchema = z5.strictObject({ pid: z5.number().int().positive(), startedAt: z5.number(), supervisorPid: z5.number().int().positive() });
-    HeadroomLockSchema = z5.strictObject({ pid: z5.number().int().positive(), at: z5.number() });
+    HeadroomSessionSchema = z6.strictObject({ pid: z6.number().int().positive(), startedAt: z6.number(), supervisorPid: z6.number().int().positive() });
+    HeadroomLockSchema = z6.strictObject({ pid: z6.number().int().positive(), at: z6.number() });
   }
 });
 
@@ -3091,7 +3091,7 @@ var init_socket = __esm({
 });
 
 // src/headroom/source.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 function isMovingGitSource(spec) {
   const match = GIT_SPEC_RE.exec(spec);
   if (match === null) {
@@ -3110,7 +3110,7 @@ var init_source = __esm({
     "use strict";
     GIT_SPEC_RE = /git\+[^@\s]+(?:@([^\s#]+))?/;
     COMMIT_SHA_RE = /^[0-9a-f]{40}$/i;
-    DirectUrlSchema = z6.object({ vcs_info: z6.object({ commit_id: z6.string() }) });
+    DirectUrlSchema = z7.object({ vcs_info: z7.object({ commit_id: z7.string() }) });
   }
 });
 
@@ -3378,7 +3378,7 @@ var init_supervisor = __esm({
 });
 
 // src/realPorts.ts
-import { spawn, spawnSync } from "node:child_process";
+import { spawn as spawn2, spawnSync } from "node:child_process";
 import { createHash as createHash5 } from "node:crypto";
 import fs3 from "node:fs";
 import os3 from "node:os";
@@ -3456,7 +3456,7 @@ function spawnDetachedDaemon(invocation, paths, subcommand, logPath) {
   fs3.mkdirSync(path13.dirname(logPath), { recursive: true });
   const logFd = fs3.openSync(logPath, "a");
   try {
-    const child = spawn(invocation.command, invocation.args, detachedDaemonSpawnOptions(logFd, { ...process.env, AGENT_SHIM_HOME: paths.root }));
+    const child = spawn2(invocation.command, invocation.args, detachedDaemonSpawnOptions(logFd, { ...process.env, AGENT_SHIM_HOME: paths.root }));
     child.unref();
     if (child.pid === void 0) {
       throw new Error(`spawning ${subcommand} returned no pid`);
@@ -4014,149 +4014,149 @@ var init_identity = __esm({
 });
 
 // src/usage/schema.ts
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 var USAGE_SCHEMA_VERSION, VersionSchema, InstantSchema, TokenCountSchema, TokenUsageSchema, LIMIT_KINDS, LimitClassificationSchema, UsageRecordSchema, QuotaWindowSchema, ExtraUsageSpendSchema, UnifiedRateLimitSchema, RateLimitStateSchema, LimitEventSchema, ProviderQuotaWindowSchema, ProviderQuotaSchema, ProviderUsageStateSchema, AccountMetadataSchema, UsageSnapshotSchema;
 var init_schema2 = __esm({
   "src/usage/schema.ts"() {
     "use strict";
     USAGE_SCHEMA_VERSION = 1;
-    VersionSchema = z7.literal(USAGE_SCHEMA_VERSION);
-    InstantSchema = z7.iso.datetime();
-    TokenCountSchema = z7.number().int().nonnegative();
-    TokenUsageSchema = z7.strictObject({
+    VersionSchema = z8.literal(USAGE_SCHEMA_VERSION);
+    InstantSchema = z8.iso.datetime();
+    TokenCountSchema = z8.number().int().nonnegative();
+    TokenUsageSchema = z8.strictObject({
       inputTokens: TokenCountSchema.optional(),
       outputTokens: TokenCountSchema.optional(),
       cacheCreationInputTokens: TokenCountSchema.optional(),
       cacheReadInputTokens: TokenCountSchema.optional()
     });
     LIMIT_KINDS = ["rate-limited", "quota-exhausted"];
-    LimitClassificationSchema = z7.strictObject({
-      kind: z7.enum(LIMIT_KINDS),
+    LimitClassificationSchema = z8.strictObject({
+      kind: z8.enum(LIMIT_KINDS),
       /** Seconds to wait before retrying, from the response's `retry-after`. */
-      retryAfterSeconds: z7.number().nonnegative().optional(),
+      retryAfterSeconds: z8.number().nonnegative().optional(),
       /** When the limiting window resets, from the upstream's own reset header. */
       resetAt: InstantSchema.optional(),
       /** The window the upstream named as the binding one (`anthropic-ratelimit-unified-representative-claim`), such as `five_hour` or `seven_day`. */
-      window: z7.string().optional(),
+      window: z8.string().optional(),
       /** The signals the classification rests on, each `<name>=<value>` from a response header or the error body's `type` or `code`. Never the error message. */
-      evidence: z7.array(z7.string())
+      evidence: z8.array(z8.string())
     });
-    UsageRecordSchema = z7.strictObject({
+    UsageRecordSchema = z8.strictObject({
       schemaVersion: VersionSchema,
       /** When the front door received the request. */
       at: InstantSchema,
       /** The launching identity, when the launch resolved one. */
-      identity: z7.string().optional(),
+      identity: z8.string().optional(),
       /** `anthropic` for an OAuth session's request to Claude Code's own API, otherwise the provider's name. */
-      provider: z7.string(),
+      provider: z8.string(),
       /** The launch's session id, generated per launch. */
-      sessionId: z7.string().optional(),
+      sessionId: z8.string().optional(),
       /** The project the launch ran in (its git repository root), when the launch sent one: headroom launches do. */
-      project: z7.string().optional(),
+      project: z8.string().optional(),
       /** The front-door route that served the request. */
-      route: z7.string(),
-      method: z7.string(),
+      route: z8.string(),
+      method: z8.string(),
       /** The API path as the upstream sees it (`/v1/messages`), without the provider prefix or a query string. */
-      endpoint: z7.string(),
+      endpoint: z8.string(),
       /** The model the response named. */
-      model: z7.string().optional(),
-      status: z7.number().int(),
+      model: z8.string().optional(),
+      status: z8.number().int(),
       /** Milliseconds from the request's arrival to its response head. */
-      latencyMs: z7.number().int().nonnegative(),
+      latencyMs: z8.number().int().nonnegative(),
       /** Milliseconds from the request's arrival to the end of its response body. */
-      durationMs: z7.number().int().nonnegative(),
+      durationMs: z8.number().int().nonnegative(),
       /** Whether the client received the whole body. */
-      outcome: z7.enum(["completed", "aborted"]),
+      outcome: z8.enum(["completed", "aborted"]),
       usage: TokenUsageSchema.optional(),
       /** The response's quota and rate-limit headers, by name (see `isRateLimitHeader`). */
-      rateLimitHeaders: z7.record(z7.string(), z7.string()).optional(),
+      rateLimitHeaders: z8.record(z8.string(), z8.string()).optional(),
       limit: LimitClassificationSchema.optional(),
       /** The upstream's request id (`request-id`), for matching a record to the provider's own logs. */
-      requestId: z7.string().optional()
+      requestId: z8.string().optional()
     });
-    QuotaWindowSchema = z7.strictObject({
+    QuotaWindowSchema = z8.strictObject({
       /** The fraction of the window used, as the upstream reports it (0 to 1). */
-      utilization: z7.number().nonnegative().optional(),
+      utilization: z8.number().nonnegative().optional(),
       resetsAt: InstantSchema.optional(),
       /** The window's own status (`allowed`, `allowed_warning`, `rejected`). */
-      status: z7.string().optional(),
+      status: z8.string().optional(),
       /** The fraction of the window's grace allowance used, while the upstream reports the window in grace (the five-hour window only). Requests are served beyond the window's own full mark while it grows, but refusals have been seen at a small value, so nothing ranks on it. */
-      graceUtilization: z7.number().nonnegative().optional()
+      graceUtilization: z8.number().nonnegative().optional()
     });
-    ExtraUsageSpendSchema = z7.strictObject({
+    ExtraUsageSpendSchema = z8.strictObject({
       /** Spent so far in the allowance's period, in the currency's minor units (pence, cents). */
-      usedMinor: z7.number().nonnegative(),
+      usedMinor: z8.number().nonnegative(),
       /** The allowance's cap in the same units, when it has one. */
-      limitMinor: z7.number().nonnegative().optional(),
+      limitMinor: z8.number().nonnegative().optional(),
       /** The ISO 4217 currency code. */
-      currency: z7.string()
+      currency: z8.string()
     });
-    UnifiedRateLimitSchema = z7.strictObject({
+    UnifiedRateLimitSchema = z8.strictObject({
       /** The overall status: `allowed`, `allowed_warning` or `rejected`. */
-      status: z7.string().optional(),
+      status: z8.string().optional(),
       fiveHour: QuotaWindowSchema.optional(),
       sevenDay: QuotaWindowSchema.optional(),
       /** The weekly window of the models whose usage may continue as extra usage (`7d_oi`), reported by some plans beside the all-models weekly window. */
       sevenDayOverageIncluded: QuotaWindowSchema.optional(),
       /** The window that currently binds. */
-      representativeClaim: z7.string().optional(),
+      representativeClaim: z8.string().optional(),
       /** When the binding window resets. */
       resetAt: InstantSchema.optional(),
       /** Whether usage beyond the plan (extra usage) is available: `allowed` or `rejected`. */
-      overageStatus: z7.string().optional(),
+      overageStatus: z8.string().optional(),
       /** The fraction of the extra-usage allowance used, as the upstream reports it (0 to 1). An account with no plan windows, such as an Enterprise one, is metered by this alone. */
-      overageUtilization: z7.number().nonnegative().optional(),
+      overageUtilization: z8.number().nonnegative().optional(),
       /** When the extra-usage allowance resets. */
       overageResetsAt: InstantSchema.optional(),
       /** Why extra usage is unavailable, as the upstream names it (`out_of_credits`, for one). */
-      overageDisabledReason: z7.string().optional(),
+      overageDisabledReason: z8.string().optional(),
       /** Whether the response was served on extra usage, as the upstream states it. */
-      overageInUse: z7.boolean().optional(),
+      overageInUse: z8.boolean().optional(),
       /** The allowance in money, from the usage endpoint (the response headers state only the fraction). */
       extraUsageSpend: ExtraUsageSpendSchema.optional(),
       /** True when the upstream offers a fallback while a window is rejected: some requests, by model, are still served, though the rest are refused. */
-      fallbackAvailable: z7.boolean().optional()
+      fallbackAvailable: z8.boolean().optional()
     });
-    RateLimitStateSchema = z7.strictObject({
+    RateLimitStateSchema = z8.strictObject({
       observedAt: InstantSchema,
       /** Every quota and rate-limit header on that response, by name. */
-      headers: z7.record(z7.string(), z7.string()),
+      headers: z8.record(z8.string(), z8.string()),
       unified: UnifiedRateLimitSchema.optional(),
       /** When the usage endpoint last answered that it has no plan windows for the account, which a later response replaces. Its answer leaves the recorded `unified` state alone (a response's headers may be the only source of it), so this alone says the question was asked. */
       planWindowsUnavailableAt: InstantSchema.optional()
     });
     LimitEventSchema = LimitClassificationSchema.extend({
       observedAt: InstantSchema,
-      status: z7.number().int()
+      status: z8.number().int()
     });
-    ProviderQuotaWindowSchema = z7.strictObject({
+    ProviderQuotaWindowSchema = z8.strictObject({
       /** What the window measures, in the provider's terms (`tokens`, `tool-calls`). */
-      measures: z7.string(),
+      measures: z8.string(),
       /** The window's length in milliseconds, when the provider's unit is one this project knows; absent for an unrecognised unit, with `period` carrying the raw code. */
-      periodMs: z7.number().int().positive().optional(),
+      periodMs: z8.number().int().positive().optional(),
       /** The provider's own description of the period when `periodMs` could not be derived, such as `unit 4 x 1`. */
-      period: z7.string().optional(),
+      period: z8.string().optional(),
       /** The fraction of the window used (0 to 1). */
-      utilization: z7.number().nonnegative(),
+      utilization: z8.number().nonnegative(),
       resetsAt: InstantSchema.optional(),
       /** Absolute counts, when the provider reports them for this window. */
-      limit: z7.number().nonnegative().optional(),
-      used: z7.number().nonnegative().optional(),
-      remaining: z7.number().nonnegative().optional()
+      limit: z8.number().nonnegative().optional(),
+      used: z8.number().nonnegative().optional(),
+      remaining: z8.number().nonnegative().optional()
     });
-    ProviderQuotaSchema = z7.strictObject({
+    ProviderQuotaSchema = z8.strictObject({
       observedAt: InstantSchema,
       /** Which usage endpoint produced it (`z.ai`). */
-      source: z7.string(),
+      source: z8.string(),
       /** The subscription level the endpoint reports, when it does. */
-      level: z7.string().optional(),
-      windows: z7.array(ProviderQuotaWindowSchema)
+      level: z8.string().optional(),
+      windows: z8.array(ProviderQuotaWindowSchema)
     });
-    ProviderUsageStateSchema = z7.strictObject({
+    ProviderUsageStateSchema = z8.strictObject({
       /** When the provider last served a request for the identity through the front door. Absent while the state holds only a rate-limit state fetched from the provider's usage endpoint, for an identity that has made no request. */
       lastRequestAt: InstantSchema.optional(),
-      lastStatus: z7.number().int().optional(),
-      lastModel: z7.string().optional(),
+      lastStatus: z8.number().int().optional(),
+      lastModel: z8.string().optional(),
       /** The latest rate-limit state, from the last response that carried any rate-limit header. */
       rateLimit: RateLimitStateSchema.optional(),
       /** The latest classified refusal. It stays after later successes, so a reader compares its `resetAt` (or `observedAt` plus `retryAfterSeconds`) with the current time. */
@@ -4164,31 +4164,31 @@ var init_schema2 = __esm({
       /** The latest quota the provider's usage endpoint reported, for providers whose quota is not visible in response headers. */
       quota: ProviderQuotaSchema.optional()
     });
-    AccountMetadataSchema = z7.strictObject({
-      accountUuid: z7.string().optional(),
-      emailAddress: z7.string().optional(),
-      displayName: z7.string().optional(),
-      organizationUuid: z7.string().optional(),
-      organizationName: z7.string().optional(),
-      organizationType: z7.string().optional(),
-      organizationRole: z7.string().optional(),
-      workspaceRole: z7.string().optional(),
-      billingType: z7.string().optional(),
-      seatTier: z7.string().optional(),
-      organizationRateLimitTier: z7.string().optional(),
-      userRateLimitTier: z7.string().optional(),
-      hasExtraUsageEnabled: z7.boolean().optional(),
-      subscriptionCreatedAt: z7.string().optional(),
-      accountCreatedAt: z7.string().optional()
+    AccountMetadataSchema = z8.strictObject({
+      accountUuid: z8.string().optional(),
+      emailAddress: z8.string().optional(),
+      displayName: z8.string().optional(),
+      organizationUuid: z8.string().optional(),
+      organizationName: z8.string().optional(),
+      organizationType: z8.string().optional(),
+      organizationRole: z8.string().optional(),
+      workspaceRole: z8.string().optional(),
+      billingType: z8.string().optional(),
+      seatTier: z8.string().optional(),
+      organizationRateLimitTier: z8.string().optional(),
+      userRateLimitTier: z8.string().optional(),
+      hasExtraUsageEnabled: z8.boolean().optional(),
+      subscriptionCreatedAt: z8.string().optional(),
+      accountCreatedAt: z8.string().optional()
     });
-    UsageSnapshotSchema = z7.strictObject({
+    UsageSnapshotSchema = z8.strictObject({
       schemaVersion: VersionSchema,
-      identity: z7.string(),
+      identity: z8.string(),
       updatedAt: InstantSchema,
       /** The identity's account metadata as of `updatedAt`. */
       account: AccountMetadataSchema.optional(),
       /** Latest state per provider, keyed by provider name (`anthropic` for OAuth sessions). */
-      providers: z7.record(z7.string(), ProviderUsageStateSchema)
+      providers: z8.record(z8.string(), ProviderUsageStateSchema)
     });
   }
 });
@@ -4276,7 +4276,7 @@ var init_account = __esm({
 });
 
 // src/usage/plan.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 function planOf(account) {
   const userTier = account?.userRateLimitTier;
   if (userTier !== void 0 && ZERO_TIER.test(userTier)) {
@@ -4300,19 +4300,19 @@ var PlanClassSchema, TIER_MULTIPLIER, ZERO_TIER, BASE_TIER;
 var init_plan2 = __esm({
   "src/usage/plan.ts"() {
     "use strict";
-    PlanClassSchema = z8.union([
-      z8.strictObject({
-        kind: z8.literal("subscription"),
+    PlanClassSchema = z9.union([
+      z9.strictObject({
+        kind: z9.literal("subscription"),
         /** The plan's size as a multiple of the smallest subscription tier (Max 5x is 5, Max 20x is 20). */
-        capacity: z8.number().positive(),
+        capacity: z9.number().positive(),
         /** False when the tier string named no multiplier and no tier this project knows, so `capacity` is the neutral 1 rather than a reading. */
-        recognised: z8.boolean(),
+        recognised: z9.boolean(),
         /** The tier string the classification rests on, when the account had one. */
-        tier: z8.string().optional()
+        tier: z9.string().optional()
       }),
-      z8.strictObject({
-        kind: z8.literal("pay-per-use"),
-        tier: z8.string().optional()
+      z9.strictObject({
+        kind: z9.literal("pay-per-use"),
+        tier: z9.string().optional()
       })
     ]);
     TIER_MULTIPLIER = /(?:^|_)(\d+)x$/;
@@ -4413,21 +4413,21 @@ var init_rateLimit = __esm({
 });
 
 // src/usage/scan.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 var AnthropicUsageSchema, ErrorObjectSchema;
 var init_scan = __esm({
   "src/usage/scan.ts"() {
     "use strict";
-    AnthropicUsageSchema = z9.looseObject({
-      input_tokens: z9.number().int().nonnegative().nullish(),
-      output_tokens: z9.number().int().nonnegative().nullish(),
-      cache_creation_input_tokens: z9.number().int().nonnegative().nullish(),
-      cache_read_input_tokens: z9.number().int().nonnegative().nullish()
+    AnthropicUsageSchema = z10.looseObject({
+      input_tokens: z10.number().int().nonnegative().nullish(),
+      output_tokens: z10.number().int().nonnegative().nullish(),
+      cache_creation_input_tokens: z10.number().int().nonnegative().nullish(),
+      cache_read_input_tokens: z10.number().int().nonnegative().nullish()
     });
-    ErrorObjectSchema = z9.looseObject({
-      type: z9.string().optional(),
-      code: z9.union([z9.string(), z9.number()]).optional(),
-      message: z9.string().optional()
+    ErrorObjectSchema = z10.looseObject({
+      type: z10.string().optional(),
+      code: z10.union([z10.string(), z10.number()]).optional(),
+      message: z10.string().optional()
     });
   }
 });
@@ -5001,7 +5001,7 @@ var init_store2 = __esm({
 
 // src/usage/poolPick.ts
 import path20 from "node:path";
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 function errorMessage(error) {
   return error instanceof Error ? error.message : String(error);
 }
@@ -5151,10 +5151,10 @@ var init_poolPick = __esm({
       }
     };
     SCHEMA_VERSION = 1;
-    PickEntrySchema = z10.strictObject({ identity: z10.string().min(1), at: z10.iso.datetime() });
-    PicksFileSchema = z10.strictObject({
-      schemaVersion: z10.literal(SCHEMA_VERSION),
-      picks: z10.record(z10.string().min(1), PickEntrySchema)
+    PickEntrySchema = z11.strictObject({ identity: z11.string().min(1), at: z11.iso.datetime() });
+    PicksFileSchema = z11.strictObject({
+      schemaVersion: z11.literal(SCHEMA_VERSION),
+      picks: z11.record(z11.string().min(1), PickEntrySchema)
     });
   }
 });
@@ -5230,7 +5230,7 @@ var init_paths = __esm({
 });
 
 // src/credentialCache.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 function effectiveStore(cache, platform) {
   return cache.store ?? (platform === "darwin" ? "keychain" : "file");
 }
@@ -5297,9 +5297,9 @@ var init_credentialCache = __esm({
     init_schema();
     init_preflight();
     MS_PER_UNIT = { s: 1e3, m: 6e4, h: 36e5, d: 864e5 };
-    CachedCredentialSchema = z11.strictObject({
-      token: z11.string().min(1),
-      fetchedAt: z11.number().int().nonnegative(),
+    CachedCredentialSchema = z12.strictObject({
+      token: z12.string().min(1),
+      fetchedAt: z12.number().int().nonnegative(),
       source: CredentialSourceSchema
     });
   }
@@ -5901,7 +5901,7 @@ var init_envBool = __esm({
 });
 
 // src/launcher/claudeVersion.ts
-function validated(value, origin) {
+function validated2(value, origin) {
   if (!NUMERIC_DOTTED_VERSION_RE.test(value)) {
     throw new InvalidClaudeVersionError(value, origin);
   }
@@ -5909,11 +5909,11 @@ function validated(value, origin) {
 }
 function resolveClaudeVersion(params) {
   if (params.flag !== void 0) {
-    return { version: validated(params.flag, "--claude-version"), source: "flag" };
+    return { version: validated2(params.flag, "--claude-version"), source: "flag" };
   }
   const fromEnv = params.env.AGENT_SHIM_CLAUDE_VERSION;
   if (fromEnv !== void 0 && fromEnv !== "") {
-    return { version: validated(fromEnv, "AGENT_SHIM_CLAUDE_VERSION"), source: "environment" };
+    return { version: validated2(fromEnv, "AGENT_SHIM_CLAUDE_VERSION"), source: "environment" };
   }
   return params.cascade === void 0 ? void 0 : { version: params.cascade, source: "cascade" };
 }
@@ -6001,7 +6001,7 @@ var init_commandDeps = __esm({
 // src/claudeShim.ts
 import fs8 from "node:fs";
 import path26 from "node:path";
-import { z as z15 } from "zod";
+import { z as z16 } from "zod";
 function commandFilename(ownExecutablePath, commandName) {
   return ownExecutablePath.toLowerCase().endsWith(".exe") ? `${commandName}.exe` : commandName;
 }
@@ -6051,10 +6051,10 @@ var init_claudeShim = __esm({
     init_store();
     init_realPorts();
     init_cliError();
-    ClaudeShimStateSchema = z15.strictObject({
-      targetPath: z15.string().min(1),
-      method: z15.enum(["hardlink", "copy"]),
-      installedAtMs: z15.number()
+    ClaudeShimStateSchema = z16.strictObject({
+      targetPath: z16.string().min(1),
+      method: z16.enum(["hardlink", "copy"]),
+      installedAtMs: z16.number()
     });
     nodeLinkFs = { link: fs8.linkSync, copyFile: fs8.copyFileSync, chmod: fs8.chmodSync };
   }
@@ -6510,7 +6510,7 @@ var init_headers = __esm({
 });
 
 // src/launcher/flags.ts
-import path32 from "node:path";
+import path33 from "node:path";
 function resolveLaunchFlags(params) {
   return {
     skipPermissions: params.flags?.skipPermissions ?? parseEnvBool("AGENT_SHIM_SKIP_PERMISSIONS", params.env.AGENT_SHIM_SKIP_PERMISSIONS) ?? params.cascade?.skipPermissions ?? false,
@@ -6541,7 +6541,7 @@ function buildEnv(params) {
   const parentCustomHeaders = params.baseEnv.ANTHROPIC_CUSTOM_HEADERS;
   let providerCustomHeaders;
   if (!params.configDirEscapeHatch && params.resolvedIdentityName !== void 0) {
-    env.CLAUDE_CONFIG_DIR = path32.join(params.identitiesDir, params.resolvedIdentityName);
+    env.CLAUDE_CONFIG_DIR = path33.join(params.identitiesDir, params.resolvedIdentityName);
   }
   if (params.provider !== void 0) {
     const providerEnv = params.provider.definition.env ?? {};
@@ -6803,7 +6803,7 @@ var init_launchHook = __esm({
 
 // src/launcher.ts
 import { randomUUID as randomUUID4 } from "node:crypto";
-import path33 from "node:path";
+import path34 from "node:path";
 function resolveIdentityCredential(identity, credential, env, port) {
   if (port === void 0) {
     return { ok: false, status: 1, message: `agent-shim: identity ${identity} needs its credential resolved, but this launcher has no credential port wired` };
@@ -6913,7 +6913,7 @@ function decideLaunch(params, readOnly) {
     identityDefaultConfigProfile: loadedIdentity?.config.defaultConfigProfile,
     globalDefaultConfigProfile: params.globalDefaultConfigProfile
   });
-  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs12.readConfigFile(path33.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
+  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs12.readConfigFile(path34.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
     log.error(
       `agent-shim: no configuration profile named "${configProfileDecision.name}" (selected via ${configProfileDecision.source}). Run \`agent-shim profile add ${configProfileDecision.name}\` first.`
     );
@@ -7025,7 +7025,7 @@ function decideLaunch(params, readOnly) {
     extraFlags: splitExtraFlags(env.CLAUDE_EXTRA_FLAGS),
     passthrough: parsedArgv.rest
   });
-  const configDir = configDirEscapeHatchApplies || identityDecision.name === void 0 ? env.CLAUDE_CONFIG_DIR : path33.join(paths.identitiesDir, identityDecision.name);
+  const configDir = configDirEscapeHatchApplies || identityDecision.name === void 0 ? env.CLAUDE_CONFIG_DIR : path34.join(paths.identitiesDir, identityDecision.name);
   const decision = {
     identitySource: identityDecision.source,
     configDirEscapeHatch: identityDecision.configDirEscapeHatch,
@@ -7066,7 +7066,7 @@ function prepareLaunch(params) {
   );
   const updateCheck = runLaunchUpdateCheck({
     mode: params.updateMode ?? "off",
-    checkPath: path33.join(paths.root, "update.check"),
+    checkPath: path34.join(paths.root, "update.check"),
     currentVersion: package_default.version,
     port: params.update
   });
@@ -7182,10 +7182,10 @@ function resolveLaunch(params) {
     environment
   };
 }
-function runLaunchPlan(plan, spawn2) {
+function runLaunchPlan(plan, spawn3) {
   try {
     plan.markChildStarted();
-    const result = spawn2.spawnSync(plan.bin, plan.args, { stdio: "inherit", env: plan.env });
+    const result = spawn3.spawnSync(plan.bin, plan.args, { stdio: "inherit", env: plan.env });
     if (result.error !== void 0) {
       throw result.error;
     }
@@ -7226,12 +7226,12 @@ var init_launcher = __esm({
 });
 
 // src/ownCli.ts
-import path34 from "node:path";
+import path35 from "node:path";
 function agentShimCliPath(distDir = typeof __AGENT_SHIM_DIST_DIR__ === "string" ? __AGENT_SHIM_DIST_DIR__ : void 0) {
   if (distDir === void 0) {
     throw new OwnCliPathUnknownError();
   }
-  return path34.join(distDir, OWN_CLI_FILE_NAME);
+  return path35.join(distDir, OWN_CLI_FILE_NAME);
 }
 var OWN_CLI_FILE_NAME, OwnCliPathUnknownError;
 var init_ownCli = __esm({
@@ -7320,10 +7320,10 @@ request.on("error", (error) => finish(failed, (error.code ? error.code + ": " :
 
 // src/frontdoor/trust.ts
 import { createHash as createHash6 } from "node:crypto";
-import path35 from "node:path";
+import path36 from "node:path";
 function resolveTrustBundle(params) {
   const { caCertFile, bundlesDir, variable, inherited, fs: fs12 } = params;
-  if (inherited === void 0 || inherited === "" || path35.resolve(inherited) === path35.resolve(caCertFile)) {
+  if (inherited === void 0 || inherited === "" || path36.resolve(inherited) === path36.resolve(caCertFile)) {
     return { path: caCertFile };
   }
   const caPem = fs12.readFileUtf8(caCertFile);
@@ -7341,7 +7341,7 @@ function resolveTrustBundle(params) {
   }
   const combined = `${inheritedPem.trimEnd()}
 ${caPem}`;
-  const bundle = path35.join(bundlesDir, `${createHash6("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
+  const bundle = path36.join(bundlesDir, `${createHash6("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
   if (!fs12.exists(bundle)) {
     fs12.mkdirp(bundlesDir);
     fs12.writeFileAtomic(bundle, combined);
@@ -7689,7 +7689,7 @@ var init_anthropicUsageRefresh = __esm({
 });
 
 // src/usage/providerQuota.ts
-import { z as z23 } from "zod";
+import { z as z24 } from "zod";
 var MS_PER_SECOND7, SECONDS_PER_HOUR, HOURS_PER_DAY3, DAYS_PER_MONTH, ZAI_HOST, ZAI_QUOTA_URL, ZAI_UNIT_HOURS, ZAI_UNIT_MONTHS, ZAI_UNIT_MS, ZaiLimitSchema, ZaiResponseSchema, OPENROUTER_HOST, OPENROUTER_KEY_URL, OPENROUTER_CREDITS_URL, MS_PER_DAY3, OpenRouterKeySchema, OpenRouterCreditsSchema;
 var init_providerQuota = __esm({
   "src/usage/providerQuota.ts"() {
@@ -7707,35 +7707,35 @@ var init_providerQuota = __esm({
       [ZAI_UNIT_HOURS, SECONDS_PER_HOUR * MS_PER_SECOND7],
       [ZAI_UNIT_MONTHS, DAYS_PER_MONTH * HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND7]
     ]);
-    ZaiLimitSchema = z23.object({
-      type: z23.string(),
-      unit: z23.number().int(),
-      number: z23.number().int().positive(),
-      percentage: z23.number().nonnegative(),
-      nextResetTime: z23.number().positive().optional(),
-      usage: z23.number().nonnegative().optional(),
-      currentValue: z23.number().nonnegative().optional(),
-      remaining: z23.number().nonnegative().optional()
+    ZaiLimitSchema = z24.object({
+      type: z24.string(),
+      unit: z24.number().int(),
+      number: z24.number().int().positive(),
+      percentage: z24.number().nonnegative(),
+      nextResetTime: z24.number().positive().optional(),
+      usage: z24.number().nonnegative().optional(),
+      currentValue: z24.number().nonnegative().optional(),
+      remaining: z24.number().nonnegative().optional()
     });
-    ZaiResponseSchema = z23.object({
-      success: z23.boolean(),
-      msg: z23.string().optional(),
-      data: z23.object({ level: z23.string().optional(), limits: z23.array(ZaiLimitSchema) })
+    ZaiResponseSchema = z24.object({
+      success: z24.boolean(),
+      msg: z24.string().optional(),
+      data: z24.object({ level: z24.string().optional(), limits: z24.array(ZaiLimitSchema) })
     });
     OPENROUTER_HOST = "openrouter.ai";
     OPENROUTER_KEY_URL = `https://${OPENROUTER_HOST}/api/v1/key`;
     OPENROUTER_CREDITS_URL = `https://${OPENROUTER_HOST}/api/v1/credits`;
     MS_PER_DAY3 = HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND7;
-    OpenRouterKeySchema = z23.object({
-      data: z23.object({
-        limit: z23.number().nonnegative().nullable(),
-        limit_remaining: z23.number().nullable(),
-        limit_reset: z23.string().nullable(),
-        is_free_tier: z23.boolean().optional(),
-        free_model_daily_requests: z23.object({ used: z23.number().nonnegative(), limit: z23.number().nonnegative(), remaining: z23.number() }).optional()
+    OpenRouterKeySchema = z24.object({
+      data: z24.object({
+        limit: z24.number().nonnegative().nullable(),
+        limit_remaining: z24.number().nullable(),
+        limit_reset: z24.string().nullable(),
+        is_free_tier: z24.boolean().optional(),
+        free_model_daily_requests: z24.object({ used: z24.number().nonnegative(), limit: z24.number().nonnegative(), remaining: z24.number() }).optional()
       })
     });
-    OpenRouterCreditsSchema = z23.object({ data: z23.object({ total_credits: z23.number().nonnegative(), total_usage: z23.number().nonnegative() }) });
+    OpenRouterCreditsSchema = z24.object({ data: z24.object({ total_credits: z24.number().nonnegative(), total_usage: z24.number().nonnegative() }) });
   }
 });
 
@@ -8351,8 +8351,8 @@ function parseConnectTarget(authority) {
 function isInterceptedHost(host, interceptHosts) {
   return interceptHosts.includes(host);
 }
-function servedByPipeline(path36) {
-  return path36?.startsWith(ROUTED_PATH_PREFIX) === true;
+function servedByPipeline(path37) {
+  return path37?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
   "connection",
@@ -8887,11 +8887,11 @@ function createRcSessionTracker(deps) {
   };
   const observeExchange = (request4) => {
     const method = (request4.method ?? "").toUpperCase();
-    const path36 = new URL(request4.url ?? "/", "http://127.0.0.1").pathname;
-    if (!path36.startsWith(RC_SESSIONS_PATH_PREFIX)) {
+    const path37 = new URL(request4.url ?? "/", "http://127.0.0.1").pathname;
+    if (!path37.startsWith(RC_SESSIONS_PATH_PREFIX)) {
       return void 0;
     }
-    const tail = path36.slice(RC_SESSIONS_PATH_PREFIX.length);
+    const tail = path37.slice(RC_SESSIONS_PATH_PREFIX.length);
     const facts = {
       oauthAuthorization: oauthAuthorizationOf(request4.headers),
       anthropicVersion: singleHeader(request4.headers, "anthropic-version"),
@@ -9273,8 +9273,8 @@ var RC_READ_FILE_ENCODINGS = ["utf-8", "base64"];
 function isRcReadFileEncoding(value) {
   return RC_READ_FILE_ENCODINGS.some((encoding) => encoding === value);
 }
-function buildRcReadFilePayload(requestId, path36, options) {
-  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path36, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
+function buildRcReadFilePayload(requestId, path37, options) {
+  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path37, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
 }
 function buildRcFileSuggestionsPayload(requestId, query) {
   return buildRcControlRequestPayload(requestId, { subtype: "file_suggestions", query });
@@ -9376,15 +9376,15 @@ async function getRcSessionContextUsage(deps, sessionId, detail) {
   const result = await deliverRcClientPayload(deps, sessionId, buildRcGetContextUsagePayload(requestId, detail), `request the context usage of session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
-async function readRcSessionFile(deps, sessionId, path36, options) {
-  if (path36 === "") {
+async function readRcSessionFile(deps, sessionId, path37, options) {
+  if (path37 === "") {
     return { ok: false, message: "a read-file write needs a non-empty path: the SDK's own field names the file the worker resolves against the session's cwd, and an empty string names none" };
   }
   if (options?.maxBytes !== void 0 && (!Number.isInteger(options.maxBytes) || options.maxBytes <= 0)) {
     return { ok: false, message: "a read-file write's max-bytes is a positive whole number of bytes: the SDK's own field caps the read, and a zero or negative cap reads nothing" };
   }
   const requestId = deps.newUuid();
-  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path36, options), `read ${path36} from session ${sessionId}`);
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path37, options), `read ${path37} from session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
 async function suggestRcSessionFiles(deps, sessionId, query) {
@@ -9553,11 +9553,11 @@ function createRcControlHandler(deps) {
       path: "read-file",
       read: (body) => {
         const session = bodyString(body, "session");
-        const path36 = bodyString(body, "path");
+        const path37 = bodyString(body, "path");
         const maxBytes = "maxBytes" in body ? bodyPositiveInteger(body, "maxBytes") : void 0;
         const encoding = "encoding" in body && isRcReadFileEncoding(body.encoding) ? body.encoding : void 0;
-        const refused2 = session === void 0 || path36 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
-        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path36, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
+        const refused2 = session === void 0 || path37 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
+        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path37, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
       }
     },
     {
@@ -9867,9 +9867,9 @@ function requestIdOfBody(body) {
 }
 function frontDoorRcControl(transport, token) {
   const headers = { authorization: `Bearer ${token}` };
-  const listAnswerOf = async (path36, what) => {
+  const listAnswerOf = async (path37, what) => {
     try {
-      return await transport.request({ method: "GET", path: path36, headers });
+      return await transport.request({ method: "GET", path: path37, headers });
     } catch (error) {
       throw new Error(`${what}: could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
     }
@@ -9941,10 +9941,10 @@ function frontDoorRcControl(transport, token) {
     }
     return pending;
   };
-  const writeOf = async (path36, body, describeFailure) => {
+  const writeOf = async (path37, body, describeFailure) => {
     let answer;
     try {
-      answer = await transport.request({ method: "POST", path: path36, headers: { ...headers, "content-type": "application/json" }, body });
+      answer = await transport.request({ method: "POST", path: path37, headers: { ...headers, "content-type": "application/json" }, body });
     } catch (error) {
       return { ok: false, message: `could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}` };
     }
@@ -9975,10 +9975,10 @@ function frontDoorRcControl(transport, token) {
     endSession: async (sessionId, reason) => await writeOf(`${CONTROL_PATH_PREFIX}/end-session`, JSON.stringify({ session: sessionId, ...reason === void 0 ? {} : { reason } }), (status, message) => `ending ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getUsage: async (sessionId, skipBehaviors) => await writeOf(`${CONTROL_PATH_PREFIX}/get-usage`, JSON.stringify({ session: sessionId, ...skipBehaviors === void 0 ? {} : { skipBehaviors } }), (status, message) => `requesting the usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getContextUsage: async (sessionId, detail) => await writeOf(`${CONTROL_PATH_PREFIX}/get-context-usage`, JSON.stringify({ session: sessionId, ...detail === void 0 ? {} : { detail } }), (status, message) => `requesting the context usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
-    readFile: async (sessionId, path36, options) => await writeOf(
+    readFile: async (sessionId, path37, options) => await writeOf(
       `${CONTROL_PATH_PREFIX}/read-file`,
-      JSON.stringify({ session: sessionId, path: path36, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
-      (status, message) => `reading ${path36} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
+      JSON.stringify({ session: sessionId, path: path37, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
+      (status, message) => `reading ${path37} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
     ),
     fileSuggestions: async (sessionId, query) => await writeOf(`${CONTROL_PATH_PREFIX}/file-suggestions`, JSON.stringify({ session: sessionId, query }), (status, message) => `requesting file suggestions from ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     keepAlive: async (sessionId) => await writeOf(`${CONTROL_PATH_PREFIX}/keep-alive`, JSON.stringify({ session: sessionId }), (status, message) => `keeping ${sessionId} alive failed (HTTP ${String(status)}): ${message}`),
@@ -10137,12 +10137,12 @@ function tlsFacts(options) {
 }
 function realRcEventDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const post = async (path36, headers, body) => await new Promise((resolve, reject) => {
+  const post = async (path37, headers, body) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method: "POST",
-      path: path36,
+      path: path37,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, "content-length": String(Buffer.byteLength(body, "utf8")) },
       agent
@@ -10207,12 +10207,12 @@ function lateRcStreamDial(resolve) {
 }
 function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const request4 = async (method, path36, headers, body, signal) => await new Promise((resolve, reject) => {
+  const request4 = async (method, path37, headers, body, signal) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method,
-      path: path36,
+      path: path37,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, ...body === void 0 ? {} : { "content-length": String(Buffer.byteLength(body, "utf8")) } },
       agent,
@@ -10254,9 +10254,9 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
       return { status, body: await readAll(response) };
     },
     openStream: async (sessionId, headers, resume, signal) => {
-      const path36 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
+      const path37 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
       const streamHeaders = resume === void 0 ? headers : { ...headers, "last-event-id": String(resume.fromSequenceNum) };
-      const { status, response } = await request4("GET", path36, streamHeaders, void 0, signal);
+      const { status, response } = await request4("GET", path37, streamHeaders, void 0, signal);
       if (!isSuccessful2(status)) {
         await readAll(response);
         return { status, chunks: NO_CHUNKS };
@@ -10896,6 +10896,242 @@ function frontDoorRcApiClient(port, ca, token) {
   return createORPCClient(frontDoorApiLink(port, ca, token));
 }
 
+// src/codex/appServer.ts
+init_cliError();
+init_package();
+
+// src/codex/appServerSchemas.ts
+import { z as z5 } from "zod";
+var CODEX_APP_SERVER_GENERATED_AGAINST = "0.160.0";
+var RateLimitWindowSchema = z5.object({
+  usedPercent: z5.number(),
+  resetsAt: z5.number().nullish(),
+  windowDurationMins: z5.number().nullish()
+});
+var RateLimitSnapshotSchema = z5.object({
+  limitId: z5.string().nullish(),
+  limitName: z5.string().nullish(),
+  planType: z5.string().nullish(),
+  primary: RateLimitWindowSchema.nullish(),
+  secondary: RateLimitWindowSchema.nullish(),
+  rateLimitReachedType: z5.string().nullish(),
+  spendControlReached: z5.boolean().nullish()
+});
+var RateLimitResetCreditSchema = z5.object({
+  id: z5.string(),
+  grantedAt: z5.number(),
+  expiresAt: z5.number().nullish(),
+  resetType: z5.string(),
+  status: z5.string(),
+  title: z5.string().nullish(),
+  description: z5.string().nullish()
+});
+var CodexAccountSchema = z5.discriminatedUnion("type", [
+  z5.object({ type: z5.literal("apiKey") }),
+  z5.object({ type: z5.literal("chatgpt"), email: z5.string().nullable(), planType: z5.string() }),
+  z5.object({ type: z5.literal("amazonBedrock"), usesCodexManagedCredentials: z5.boolean().default(false) })
+]);
+var CodexAccountReadSchema = z5.object({
+  account: CodexAccountSchema.nullable(),
+  requiresOpenaiAuth: z5.boolean()
+});
+var CodexRateLimitsReadSchema = z5.object({
+  rateLimits: RateLimitSnapshotSchema,
+  rateLimitsByLimitId: z5.record(z5.string(), RateLimitSnapshotSchema).nullish(),
+  rateLimitResetCredits: z5.object({ availableCount: z5.number(), credits: z5.array(RateLimitResetCreditSchema).nullish() }).nullish(),
+  accountId: z5.string().nullish(),
+  ordinaryUsageAllowed: z5.boolean().nullish()
+});
+var CodexInitializeResultSchema = z5.object({ userAgent: z5.string() });
+
+// src/codex/appServer.ts
+var CodexAppServerUnavailableError = class extends CliError {
+  constructor(detail) {
+    super(`The Codex app-server is not available: ${detail}.`);
+    this.name = "CodexAppServerUnavailableError";
+  }
+};
+var CodexAppServerRequestError = class extends CliError {
+  constructor(method, rpcCode, detail) {
+    super(`Codex app-server ${method} failed (${String(rpcCode)}): ${detail}`);
+    this.method = method;
+    this.rpcCode = rpcCode;
+    this.name = "CodexAppServerRequestError";
+  }
+  method;
+  rpcCode;
+};
+var CodexAppServerProtocolError = class extends CliError {
+  constructor(method, installedVersion, detail) {
+    super(
+      `Codex app-server ${method} answered in a shape this reader does not know (installed Codex ${installedVersion ?? "of unknown version"}, shapes generated against ${CODEX_APP_SERVER_GENERATED_AGAINST}): ${detail}`
+    );
+    this.method = method;
+    this.installedVersion = installedVersion;
+    this.name = "CodexAppServerProtocolError";
+  }
+  method;
+  installedVersion;
+};
+var CODEX_APP_SERVER_TIMEOUT_MS = 3e4;
+var CLIENT_NAME = "agent-shim";
+function installedVersionOf(userAgent) {
+  return /^[^/\s]+\/(\S+)/.exec(userAgent)?.[1];
+}
+function responseTo(message, id) {
+  if (typeof message !== "object" || message === null || !("id" in message) || message.id !== id) {
+    return void 0;
+  }
+  if ("error" in message && typeof message.error === "object" && message.error !== null) {
+    const { error } = message;
+    const code = "code" in error && typeof error.code === "number" ? error.code : 0;
+    const detail = "message" in error && typeof error.message === "string" ? error.message : "no message";
+    return { error: { code, message: detail } };
+  }
+  return "result" in message ? { result: message.result } : void 0;
+}
+async function withAppServer(port, options, ask) {
+  const connection = await port.open({ bin: options.bin ?? "codex", codexHome: options.codexHome });
+  let nextId = 0;
+  const timeoutMs = options.timeoutMs ?? CODEX_APP_SERVER_TIMEOUT_MS;
+  const stopper = AbortSignal.any([...options.signal === void 0 ? [] : [options.signal], AbortSignal.timeout(timeoutMs)]);
+  const stopReason = () => {
+    if (options.signal?.aborted !== true) {
+      return new CodexAppServerUnavailableError(`it did not answer within ${String(timeoutMs)} ms`);
+    }
+    const reason = options.signal.reason;
+    return reason instanceof Error ? reason : new Error(`the Codex app-server read was aborted: ${String(reason)}`);
+  };
+  const aborted = new Promise((_resolve, reject) => {
+    if (stopper.aborted) {
+      reject(stopReason());
+      return;
+    }
+    stopper.addEventListener(
+      "abort",
+      () => {
+        reject(stopReason());
+      },
+      { once: true }
+    );
+  });
+  aborted.catch(() => void 0);
+  const request4 = async (method, params) => {
+    nextId += 1;
+    const id = nextId;
+    connection.send({ jsonrpc: "2.0", id, method, params });
+    for (; ; ) {
+      const message = await Promise.race([connection.receive(), aborted]);
+      if (message === void 0) {
+        throw new CodexAppServerUnavailableError(`it ended before answering ${method}`);
+      }
+      const response = responseTo(message, id);
+      if (response === void 0) {
+        continue;
+      }
+      if ("error" in response) {
+        throw new CodexAppServerRequestError(method, response.error.code, response.error.message);
+      }
+      return response.result;
+    }
+  };
+  try {
+    const initialised = CodexInitializeResultSchema.safeParse(await request4("initialize", { clientInfo: { name: CLIENT_NAME, title: null, version: package_default.version } }));
+    if (!initialised.success) {
+      throw new CodexAppServerProtocolError("initialize", void 0, initialised.error.message);
+    }
+    connection.send({ jsonrpc: "2.0", method: "initialized" });
+    return await ask(request4, installedVersionOf(initialised.data.userAgent));
+  } finally {
+    await connection.close();
+  }
+}
+function validated(method, installedVersion, schema, value) {
+  const parsed = schema.safeParse(value);
+  if (!parsed.success) {
+    throw new CodexAppServerProtocolError(method, installedVersion, parsed.error.message);
+  }
+  return parsed.data;
+}
+async function readCodexAccount(port, options) {
+  return await withAppServer(port, options, async (request4, version) => validated("account/read", version, CodexAccountReadSchema, await request4("account/read", { refreshToken: false })));
+}
+async function readCodexRateLimits(port, options) {
+  return await withAppServer(port, options, async (request4, version) => validated("account/rateLimits/read", version, CodexRateLimitsReadSchema, await request4("account/rateLimits/read", void 0)));
+}
+
+// src/codex/realAppServer.ts
+import { spawn } from "node:child_process";
+import readline from "node:readline";
+var SHUTDOWN_GRACE_MS = 5e3;
+var realCodexAppServerPort = {
+  open: async ({ bin, codexHome }) => {
+    const child = spawn(bin, ["app-server"], { stdio: ["pipe", "pipe", "ignore"], env: { ...process.env, CODEX_HOME: codexHome } });
+    await new Promise((resolve, reject) => {
+      child.once("spawn", resolve);
+      child.once("error", (error) => {
+        reject(new CodexAppServerUnavailableError(`${bin} could not be started (${error.message})`));
+      });
+    });
+    const exited = new Promise((resolve) => {
+      child.once("exit", () => {
+        resolve();
+      });
+    });
+    const pending = [];
+    const waiting = [];
+    let ended = false;
+    const deliver = (message) => {
+      const waiter = waiting.shift();
+      if (waiter === void 0) {
+        pending.push(message);
+      } else {
+        waiter(message);
+      }
+    };
+    const lines = readline.createInterface({ input: child.stdout });
+    lines.on("line", (line) => {
+      try {
+        deliver(JSON.parse(line));
+      } catch {
+      }
+    });
+    lines.on("close", () => {
+      ended = true;
+      for (const waiter of waiting.splice(0)) {
+        waiter(void 0);
+      }
+    });
+    const connection = {
+      send: (message) => {
+        child.stdin.write(`${JSON.stringify(message)}
+`);
+      },
+      receive: async () => {
+        if (pending.length > 0) {
+          return pending.shift();
+        }
+        if (ended) {
+          return void 0;
+        }
+        return await new Promise((resolve) => {
+          waiting.push(resolve);
+        });
+      },
+      close: async () => {
+        child.stdin.end();
+        const timer = setTimeout(() => {
+          child.kill("SIGKILL");
+        }, SHUTDOWN_GRACE_MS);
+        await exited;
+        clearTimeout(timer);
+        lines.close();
+      }
+    };
+    return connection;
+  }
+};
+
 // src/frontdoor/doorClient.ts
 init_cliError();
 init_realPorts();
@@ -11171,19 +11407,19 @@ function writePools(paths, pools) {
   applyPatch(paths.globalConfigFile, GlobalConfigSchema, { pools }, { defaults: {} });
 }
 function poolCycleOf(pools, name) {
-  const walk = (current, path36) => {
+  const walk = (current, path37) => {
     for (const entry of pools[current]?.identities ?? []) {
       const nested = poolNameOf(poolMemberIdentity(entry));
       if (nested === void 0) {
         continue;
       }
       if (nested === name) {
-        return [...path36, nested];
+        return [...path37, nested];
       }
-      if (path36.includes(nested)) {
+      if (path37.includes(nested)) {
         continue;
       }
-      const found = walk(nested, [...path36, nested]);
+      const found = walk(nested, [...path37, nested]);
       if (found !== void 0) {
         return found;
       }
@@ -11294,7 +11530,7 @@ init_providersStore();
 init_projects();
 init_pipeline();
 import path25 from "node:path";
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 var HISTORY_PROJECTS_KEY_PREFIX = "history/projects/";
 function projectFragmentOf(rawKey) {
   return rawKey.startsWith(HISTORY_PROJECTS_KEY_PREFIX) ? rawKey.slice(HISTORY_PROJECTS_KEY_PREFIX.length) : void 0;
@@ -11371,9 +11607,9 @@ function lookupKeychainService(run, farmRoot) {
     note: serviceName === void 0 ? `A Keychain entry was found for account "${farmRoot}" but its service name could not be parsed from security's output.` : `Keychain service name for this identity: "${serviceName}".`
   };
 }
-var SettingsSecretsShapeSchema = z12.looseObject({
-  env: z12.record(z12.string(), z12.unknown()).optional(),
-  hooks: z12.record(z12.string(), z12.array(z12.unknown())).optional()
+var SettingsSecretsShapeSchema = z13.looseObject({
+  env: z13.record(z13.string(), z13.unknown()).optional(),
+  hooks: z13.record(z13.string(), z13.array(z13.unknown())).optional()
 });
 function hookCommandCountOf(group) {
   if (typeof group !== "object" || group === null) {
@@ -11669,7 +11905,7 @@ init_schema();
 init_claudeVersion();
 init_identity();
 init_projects();
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 
 // src/resolve/types.ts
 var LAYER_KINDS = [
@@ -11730,123 +11966,123 @@ var DIAGNOSTIC_SEVERITIES = ["error", "warning", "info"];
 
 // src/usage/pickReportSchema.ts
 init_plan2();
-import { z as z13 } from "zod";
-var PoolPickCandidateViewSchema = z13.strictObject({
-  identity: z13.string(),
+import { z as z14 } from "zod";
+var PoolPickCandidateViewSchema = z14.strictObject({
+  identity: z14.string(),
   /** In pick order: `scored` has usable quota data, `unknown` has none, `pay-per-use` bills by use, `ineligible` is refused right now. */
-  class: z13.enum(["scored", "unknown", "pay-per-use", "ineligible"]),
+  class: z14.enum(["scored", "unknown", "pay-per-use", "ineligible"]),
   /** Plan-size-weighted remaining quota per hour until its reset; present for `scored` only. */
-  score: z13.number().optional(),
+  score: z14.number().optional(),
   /** Which window's reset divides the score: the seven-day window, or the five-hour one when the member reports no seven-day utilisation; present with `score`. */
-  scoreWindow: z13.enum(["sevenDay", "fiveHour"]).optional(),
+  scoreWindow: z14.enum(["sevenDay", "fiveHour"]).optional(),
   /** False when the five-hour window would run dry, at the observed pace, before it resets. */
-  feasible: z13.boolean(),
+  feasible: z14.boolean(),
   /** When an `ineligible` member can be used again, as an ISO instant. */
-  blockedUntil: z13.iso.datetime().optional(),
+  blockedUntil: z14.iso.datetime().optional(),
   plan: PlanClassSchema,
   /** The facts behind the class and score, in the order they matter. */
-  reasons: z13.array(z13.string())
+  reasons: z14.array(z14.string())
 });
-var PoolPickReportSchema = z13.strictObject({
-  pool: z13.string(),
-  directory: z13.string(),
+var PoolPickReportSchema = z14.strictObject({
+  pool: z14.string(),
+  directory: z14.string(),
   /** The member a launch would run as, absent when every member is refused. */
-  pick: z13.string().optional(),
-  candidates: z13.array(PoolPickCandidateViewSchema),
+  pick: z14.string().optional(),
+  candidates: z14.array(PoolPickCandidateViewSchema),
   /** Identity members anywhere in the pool's graph that do not exist; a launch skips them. */
-  missing: z13.array(z13.string()),
+  missing: z14.array(z14.string()),
   /** When nothing can be picked, the soonest any member returns. */
-  earliestReturn: z13.strictObject({ identity: z13.string(), at: z13.iso.datetime() }).optional(),
+  earliestReturn: z14.strictObject({ identity: z14.string(), at: z14.iso.datetime() }).optional(),
   /** The member a resumed conversation started on but moved off, and why, when the ranking could not keep it. */
-  movedOff: z13.strictObject({ identity: z13.string(), reason: z13.string() }).optional(),
+  movedOff: z14.strictObject({ identity: z14.string(), reason: z14.string() }).optional(),
   /** Why the last-pick record could not be read, when that is the case. */
-  stickyProblem: z13.string().optional()
+  stickyProblem: z14.string().optional()
 });
 
 // src/checkReportSchema.ts
 var CHECK_CREDENTIAL_APPLIES = ["provider", "identity", "stored-login"];
-var CheckLayerViewSchema = z14.strictObject({
-  id: z14.int(),
-  kind: z14.enum(LAYER_KINDS),
-  source: z14.string()
-});
-var CheckEntryViewSchema = z14.strictObject({
-  path: z14.string(),
-  shared: z14.boolean(),
-  via: z14.enum(DECISION_VIAS),
+var CheckLayerViewSchema = z15.strictObject({
+  id: z15.int(),
+  kind: z15.enum(LAYER_KINDS),
+  source: z15.string()
+});
+var CheckEntryViewSchema = z15.strictObject({
+  path: z15.string(),
+  shared: z15.boolean(),
+  via: z15.enum(DECISION_VIAS),
   /** The entry's real category, or null when nothing classifies it. */
-  category: z14.enum(CATEGORY_NAMES).nullable(),
-  rule: z14.strictObject({ key: z14.string(), layer: z14.int() }).optional(),
+  category: z15.enum(CATEGORY_NAMES).nullable(),
+  rule: z15.strictObject({ key: z15.string(), layer: z15.int() }).optional(),
   /** Rules that matched but whose `when` condition failed, each with the conditions that failed. */
-  eliminated: z14.readonly(z14.array(z14.strictObject({ key: z14.string(), failed: z14.readonly(z14.array(z14.string())) }))).optional()
-});
-var CheckDiagnosticSchema = z14.strictObject({
-  code: z14.enum(DIAGNOSTIC_CODES),
-  severity: z14.enum(DIAGNOSTIC_SEVERITIES),
-  message: z14.string(),
-  subject: z14.string().optional(),
-  layer: z14.int().optional()
-});
-var CheckAmbientCredentialSchema = z14.union([z14.strictObject({ ok: z14.literal(true) }), z14.strictObject({ ok: z14.literal(false), variable: z14.string(), message: z14.string() })]);
-var CheckKeychainSchema = z14.strictObject({
-  checked: z14.literal(true),
-  found: z14.boolean(),
-  serviceName: z14.string().optional(),
-  note: z14.string()
-});
-var CheckSettingsExposureSchema = z14.strictObject({
-  file: z14.string(),
-  envKeyNames: z14.readonly(z14.array(z14.string())),
-  hookEventNames: z14.readonly(z14.array(z14.string())),
-  hookCommandCount: z14.int().nonnegative()
-});
-var CredentialSourceSummarySchema = z14.union([
-  z14.strictObject({ kind: z14.literal("env"), variable: z14.string() }),
-  z14.strictObject({ kind: z14.literal("file"), path: z14.string() }),
-  z14.strictObject({ kind: z14.literal("command"), program: z14.string() }),
-  z14.strictObject({ kind: z14.literal("op"), reference: z14.string() }),
-  z14.strictObject({ kind: z14.literal("keychain"), service: z14.string(), account: z14.string().optional() }),
-  z14.strictObject({ kind: z14.literal("literal") })
+  eliminated: z15.readonly(z15.array(z15.strictObject({ key: z15.string(), failed: z15.readonly(z15.array(z15.string())) }))).optional()
+});
+var CheckDiagnosticSchema = z15.strictObject({
+  code: z15.enum(DIAGNOSTIC_CODES),
+  severity: z15.enum(DIAGNOSTIC_SEVERITIES),
+  message: z15.string(),
+  subject: z15.string().optional(),
+  layer: z15.int().optional()
+});
+var CheckAmbientCredentialSchema = z15.union([z15.strictObject({ ok: z15.literal(true) }), z15.strictObject({ ok: z15.literal(false), variable: z15.string(), message: z15.string() })]);
+var CheckKeychainSchema = z15.strictObject({
+  checked: z15.literal(true),
+  found: z15.boolean(),
+  serviceName: z15.string().optional(),
+  note: z15.string()
+});
+var CheckSettingsExposureSchema = z15.strictObject({
+  file: z15.string(),
+  envKeyNames: z15.readonly(z15.array(z15.string())),
+  hookEventNames: z15.readonly(z15.array(z15.string())),
+  hookCommandCount: z15.int().nonnegative()
+});
+var CredentialSourceSummarySchema = z15.union([
+  z15.strictObject({ kind: z15.literal("env"), variable: z15.string() }),
+  z15.strictObject({ kind: z15.literal("file"), path: z15.string() }),
+  z15.strictObject({ kind: z15.literal("command"), program: z15.string() }),
+  z15.strictObject({ kind: z15.literal("op"), reference: z15.string() }),
+  z15.strictObject({ kind: z15.literal("keychain"), service: z15.string(), account: z15.string().optional() }),
+  z15.strictObject({ kind: z15.literal("literal") })
 ]);
-var CredentialSummarySchema = z14.strictObject({
-  target: z14.enum(CREDENTIAL_TARGETS),
-  sources: z14.readonly(z14.array(CredentialSourceSummarySchema)),
+var CredentialSummarySchema = z15.strictObject({
+  target: z15.enum(CREDENTIAL_TARGETS),
+  sources: z15.readonly(z15.array(CredentialSourceSummarySchema)),
   cache: CredentialCacheSchema.optional()
 });
-var CachedCredentialStateSchema = z14.union([
-  z14.strictObject({ store: z14.enum(CREDENTIAL_CACHE_STORES), status: z14.literal("empty") }),
-  z14.strictObject({ store: z14.enum(CREDENTIAL_CACHE_STORES), status: z14.literal("unreadable"), reason: z14.string() }),
-  z14.strictObject({ store: z14.enum(CREDENTIAL_CACHE_STORES), status: z14.enum(["fresh", "expired"]), ageMs: z14.number(), expiresInMs: z14.number().optional() })
+var CachedCredentialStateSchema = z15.union([
+  z15.strictObject({ store: z15.enum(CREDENTIAL_CACHE_STORES), status: z15.literal("empty") }),
+  z15.strictObject({ store: z15.enum(CREDENTIAL_CACHE_STORES), status: z15.literal("unreadable"), reason: z15.string() }),
+  z15.strictObject({ store: z15.enum(CREDENTIAL_CACHE_STORES), status: z15.enum(["fresh", "expired"]), ageMs: z15.number(), expiresInMs: z15.number().optional() })
 ]);
-var CheckCredentialProviderSchema = z14.union([
-  z14.strictObject({ name: z14.string(), credential: CredentialSummarySchema, cached: CachedCredentialStateSchema.optional() }),
-  z14.strictObject({ name: z14.string(), problem: z14.string() })
+var CheckCredentialProviderSchema = z15.union([
+  z15.strictObject({ name: z15.string(), credential: CredentialSummarySchema, cached: CachedCredentialStateSchema.optional() }),
+  z15.strictObject({ name: z15.string(), problem: z15.string() })
 ]);
-var CheckCredentialSchema = z14.strictObject({
-  applies: z14.enum(CHECK_CREDENTIAL_APPLIES),
+var CheckCredentialSchema = z15.strictObject({
+  applies: z15.enum(CHECK_CREDENTIAL_APPLIES),
   provider: CheckCredentialProviderSchema.optional(),
   identity: CredentialSummarySchema.optional(),
   identityCached: CachedCredentialStateSchema.optional()
 });
-var CheckClaudeVersionSchema = z14.strictObject({
-  pinned: z14.strictObject({ version: z14.string(), source: z14.enum(CLAUDE_VERSION_SOURCES), installed: z14.boolean() }).optional(),
-  highestInstalled: z14.string().optional(),
-  installed: z14.readonly(z14.array(z14.string()))
+var CheckClaudeVersionSchema = z15.strictObject({
+  pinned: z15.strictObject({ version: z15.string(), source: z15.enum(CLAUDE_VERSION_SOURCES), installed: z15.boolean() }).optional(),
+  highestInstalled: z15.string().optional(),
+  installed: z15.readonly(z15.array(z15.string()))
 });
-var CheckReportJsonSchema = z14.strictObject({
-  identity: z14.strictObject({ name: z14.string().nullable(), source: z14.enum(IDENTITY_DECISION_SOURCES) }),
+var CheckReportJsonSchema = z15.strictObject({
+  identity: z15.strictObject({ name: z15.string().nullable(), source: z15.enum(IDENTITY_DECISION_SOURCES) }),
   /** The pool ranking, when the launch named a pool instead of an identity. */
   pool: PoolPickReportSchema.optional(),
-  configProfile: z14.strictObject({ name: z14.string().nullable(), source: z14.enum(CONFIG_PROFILE_DECISION_SOURCES) }),
-  layers: z14.readonly(z14.array(CheckLayerViewSchema)),
-  entries: z14.readonly(z14.array(CheckEntryViewSchema)),
-  projectEncodingAmbiguities: z14.readonly(
-    z14.array(z14.strictObject({ fragment: z14.string(), encoded: z14.string(), reason: z14.enum(ENCODING_AMBIGUITY_REASONS), detail: z14.string() }))
+  configProfile: z15.strictObject({ name: z15.string().nullable(), source: z15.enum(CONFIG_PROFILE_DECISION_SOURCES) }),
+  layers: z15.readonly(z15.array(CheckLayerViewSchema)),
+  entries: z15.readonly(z15.array(CheckEntryViewSchema)),
+  projectEncodingAmbiguities: z15.readonly(
+    z15.array(z15.strictObject({ fragment: z15.string(), encoded: z15.string(), reason: z15.enum(ENCODING_AMBIGUITY_REASONS), detail: z15.string() }))
   ),
-  diagnostics: z14.readonly(z14.array(CheckDiagnosticSchema)),
+  diagnostics: z15.readonly(z15.array(CheckDiagnosticSchema)),
   ambientCredential: CheckAmbientCredentialSchema,
   keychain: CheckKeychainSchema.optional(),
-  settingsExposure: z14.readonly(z14.array(CheckSettingsExposureSchema)),
+  settingsExposure: z15.readonly(z15.array(CheckSettingsExposureSchema)),
   credential: CheckCredentialSchema,
   claudeVersion: CheckClaudeVersionSchema.optional()
 });
@@ -11856,8 +12092,8 @@ init_middleware();
 init_preflight();
 
 // src/frontdoor/controlSchemas.ts
-import path29 from "node:path";
-import { z as z19 } from "zod";
+import path30 from "node:path";
+import { z as z20 } from "zod";
 
 // src/doctorReport.ts
 init_claudeShim();
@@ -12027,27 +12263,49 @@ function removeIdentity(paths, name) {
 // src/doctorReport.ts
 init_realPorts();
 import fs10 from "node:fs";
+import path29 from "node:path";
+
+// src/usage/signIn.ts
 import path28 from "node:path";
+var CREDENTIALS_FILE = ".credentials.json";
+function keychainHasItem(run, account) {
+  return run.run("security", ["find-generic-password", "-a", account]).status === 0;
+}
+function decideSignIn(facts) {
+  if (facts.hasCredentialBlock) {
+    return { state: "token", detail: "supplies its own credential through a credential block, so a stored login is not what a launch uses" };
+  }
+  if (facts.keychainItem === true) {
+    return { state: "signed-in", detail: "a login is stored in the macOS Keychain" };
+  }
+  if (facts.credentialsFile) {
+    return { state: "signed-in", detail: `a login is stored in ${CREDENTIALS_FILE}` };
+  }
+  return { state: "signed-out", detail: facts.platform === "darwin" ? `no Keychain item and no ${CREDENTIALS_FILE}` : `no ${CREDENTIALS_FILE}` };
+}
+function credentialsFilePath(farmRoot) {
+  return path28.join(farmRoot, CREDENTIALS_FILE);
+}
 
 // src/codex/siwcStore.ts
-import { z as z18 } from "zod";
+import { z as z19 } from "zod";
 
 // src/codex/auth.ts
-import { z as z16 } from "zod";
-var AuthFileSchema = z16.looseObject({
-  tokens: z16.looseObject({
-    access_token: z16.string().optional(),
-    refresh_token: z16.string().optional(),
-    id_token: z16.string().optional(),
-    account_id: z16.string().optional()
+import { z as z17 } from "zod";
+var AuthFileSchema = z17.looseObject({
+  tokens: z17.looseObject({
+    access_token: z17.string().optional(),
+    refresh_token: z17.string().optional(),
+    id_token: z17.string().optional(),
+    account_id: z17.string().optional()
   }).nullish(),
-  last_refresh: z16.string().optional()
+  last_refresh: z17.string().optional()
 });
-var TokenGrantSchema = z16.looseObject({
-  access_token: z16.string().min(1).optional(),
-  refresh_token: z16.string().min(1).optional(),
-  id_token: z16.string().min(1).optional(),
-  account_id: z16.string().min(1).optional()
+var TokenGrantSchema = z17.looseObject({
+  access_token: z17.string().min(1).optional(),
+  refresh_token: z17.string().min(1).optional(),
+  id_token: z17.string().min(1).optional(),
+  account_id: z17.string().min(1).optional()
 });
 var CodexAuthError = class extends Error {
   constructor(message) {
@@ -12057,41 +12315,41 @@ var CodexAuthError = class extends Error {
 };
 
 // src/codex/siwc.ts
-import { z as z17 } from "zod";
+import { z as z18 } from "zod";
 var SIWC_RESOURCE = "https://api.openai.com/v1";
 var SIWC_RESPONSES_URL = `${SIWC_RESOURCE}/responses`;
 var SIWC_PLAN_SCOPE = "chatgpt.tokens.use.direct";
-var TokenResponseSchema = z17.looseObject({
-  access_token: z17.string().min(1),
-  refresh_token: z17.string().min(1).optional(),
-  id_token: z17.string().min(1).optional(),
-  expires_in: z17.number().positive(),
-  scope: z17.string().optional()
+var TokenResponseSchema = z18.looseObject({
+  access_token: z18.string().min(1),
+  refresh_token: z18.string().min(1).optional(),
+  id_token: z18.string().min(1).optional(),
+  expires_in: z18.number().positive(),
+  scope: z18.string().optional()
 });
-var JwtHeaderSchema = z17.looseObject({ alg: z17.string(), kid: z17.string().optional() });
-var IdTokenClaimsSchema = z17.looseObject({
-  iss: z17.string(),
-  sub: z17.string().min(1),
-  aud: z17.union([z17.string(), z17.array(z17.string())]),
-  exp: z17.number(),
-  nonce: z17.string().optional(),
-  email: z17.string().optional()
+var JwtHeaderSchema = z18.looseObject({ alg: z18.string(), kid: z18.string().optional() });
+var IdTokenClaimsSchema = z18.looseObject({
+  iss: z18.string(),
+  sub: z18.string().min(1),
+  aud: z18.union([z18.string(), z18.array(z18.string())]),
+  exp: z18.number(),
+  nonce: z18.string().optional(),
+  email: z18.string().optional()
 });
-var JwksSchema = z17.object({ keys: z17.array(z17.looseObject({ kid: z17.string().optional(), kty: z17.string() })) });
+var JwksSchema = z18.object({ keys: z18.array(z18.looseObject({ kid: z18.string().optional(), kty: z18.string() })) });
 
 // src/codex/siwcStore.ts
-var SiwcGrantSchema = z18.strictObject({
-  clientId: z18.string().min(1),
-  sub: z18.string().min(1),
-  email: z18.string().optional(),
-  idToken: z18.string().min(1),
-  accessToken: z18.string().min(1),
-  refreshToken: z18.string().min(1),
-  scopes: z18.array(z18.string()).readonly(),
+var SiwcGrantSchema = z19.strictObject({
+  clientId: z19.string().min(1),
+  sub: z19.string().min(1),
+  email: z19.string().optional(),
+  idToken: z19.string().min(1),
+  accessToken: z19.string().min(1),
+  refreshToken: z19.string().min(1),
+  scopes: z19.array(z19.string()).readonly(),
   /** When the access token stops working, in milliseconds since the epoch. */
-  expiresAt: z18.number()
+  expiresAt: z19.number()
 });
-var SiwcFileSchema = z18.strictObject({ registeredClientId: z18.string().min(1).optional(), grant: SiwcGrantSchema.optional() });
+var SiwcFileSchema = z19.strictObject({ registeredClientId: z19.string().min(1).optional(), grant: SiwcGrantSchema.optional() });
 function parseSiwcFile(raw, filePath) {
   let json;
   try {
@@ -12128,6 +12386,7 @@ var DOCTOR_SECTIONS = [
   "legacy-name",
   "config-profile",
   "identity",
+  "sign-in",
   "pool",
   "provider",
   "keychain",
@@ -12170,7 +12429,7 @@ function tcpPortEraRecord(raw) {
   return (has("port") || has("lastPort")) && !has("socketPath");
 }
 function pushPathResolution(push, resolution) {
-  const ownDir = path28.dirname(resolution.ownExecutablePath);
+  const ownDir = path29.dirname(resolution.ownExecutablePath);
   switch (resolution.agentShim.status) {
     case "ok":
       push("path-resolution", "pass", `\`agent-shim\` on PATH resolves to this running executable, ${resolution.ownExecutablePath}.`, "agent-shim");
@@ -12250,17 +12509,17 @@ function pushProvider(push, entry, cacheEnv, signIn) {
     push("provider", "fail", new LegacyProviderFileError(entry.path, conversion).message, entry.name);
     return;
   }
-  const validated2 = ProviderSchema.safeParse(parsed);
-  if (!validated2.success) {
-    push("provider", "fail", new ConfigValidationError(entry.path, validated2.error.issues).message, entry.name);
+  const validated3 = ProviderSchema.safeParse(parsed);
+  if (!validated3.success) {
+    push("provider", "fail", new ConfigValidationError(entry.path, validated3.error.issues).message, entry.name);
     return;
   }
-  const cache = cacheClause(cacheEnv, `provider ${entry.name}`, validated2.data.credential);
-  push("provider", cache.unreadable ? "fail" : "pass", `${entry.name} is valid (${describeProviderEndpoint(validated2.data)}, credential ${describeCredential(validated2.data.credential)})${cache.text}.`, entry.name);
-  if (validated2.data.env?.ENABLE_TOOL_SEARCH === void 0) {
+  const cache = cacheClause(cacheEnv, `provider ${entry.name}`, validated3.data.credential);
+  push("provider", cache.unreadable ? "fail" : "pass", `${entry.name} is valid (${describeProviderEndpoint(validated3.data)}, credential ${describeCredential(validated3.data.credential)})${cache.text}.`, entry.name);
+  if (validated3.data.env?.ENABLE_TOOL_SEARCH === void 0) {
     push("provider", "warn", `${entry.name} does not set ENABLE_TOOL_SEARCH: a session on this provider keeps Claude Code's own API as its base URL, so it defers MCP tool loading and sends tool_reference payloads the upstream backend must understand. Set ENABLE_TOOL_SEARCH=false in the provider's env block to load tools upfront instead, when the backend does not support them.`, entry.name);
   }
-  if (signIn !== void 0 && isCodexProvider(validated2.data) && validated2.data.codex?.login === "chatgpt-sign-in") {
+  if (signIn !== void 0 && isCodexProvider(validated3.data) && validated3.data.codex?.login === "chatgpt-sign-in") {
     const problem = signInProblem(signIn);
     if (problem !== void 0) {
       push("provider", "warn", `${entry.name} uses the Sign in with ChatGPT login, but ${problem}`, entry.name);
@@ -12269,14 +12528,14 @@ function pushProvider(push, entry, cacheEnv, signIn) {
 }
 function pushLegacyName(push, params) {
   const legacyVariables = Object.keys(params.env).filter((name) => name.startsWith(LEGACY_ENV_PREFIX) && params.env[name] !== void 0).sort();
-  if (legacyVariables.length === 0 && path28.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
+  if (legacyVariables.length === 0 && path29.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
     push("legacy-name", "pass", "Nothing here still uses the former `claude-use` name.");
     return;
   }
   for (const name of legacyVariables) {
     push("legacy-name", "warn", `${name} is the former name of ${name.replace(LEGACY_ENV_PREFIX, ENV_PREFIX)}. Rename it; the old name still works but is only a fallback.`, name);
   }
-  if (path28.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
+  if (path29.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
     push(
       "legacy-name",
       "warn",
@@ -12328,13 +12587,13 @@ function runDoctor(params) {
   pushLegacyName(push, params);
   const profileSources = /* @__PURE__ */ new Map();
   for (const entry of params.configProfiles) {
-    const validated2 = validateJson(ConfigProfileSchema, entry);
-    if (!validated2.ok) {
-      push("config-profile", "fail", validated2.message, entry.name);
+    const validated3 = validateJson(ConfigProfileSchema, entry);
+    if (!validated3.ok) {
+      push("config-profile", "fail", validated3.message, entry.name);
       continue;
     }
-    profileSources.set(entry.name, { name: entry.name, profile: validated2.data });
-    checkPin("config-profile", entry.name, `Configuration profile "${entry.name}"`, validated2.data.launch?.claudeVersion);
+    profileSources.set(entry.name, { name: entry.name, profile: validated3.data });
+    checkPin("config-profile", entry.name, `Configuration profile "${entry.name}"`, validated3.data.launch?.claudeVersion);
   }
   const loadProfile = (name) => profileSources.get(name);
   for (const name of profileSources.keys()) {
@@ -12350,13 +12609,13 @@ function runDoctor(params) {
   const validProfileNames = new Set(profileSources.keys());
   const validIdentityNames = /* @__PURE__ */ new Set();
   for (const entry of params.identities) {
-    const validated2 = validateJson(IdentitySchema, entry);
-    if (!validated2.ok) {
-      push("identity", "fail", validated2.message, entry.name);
+    const validated3 = validateJson(IdentitySchema, entry);
+    if (!validated3.ok) {
+      push("identity", "fail", validated3.message, entry.name);
       continue;
     }
     validIdentityNames.add(entry.name);
-    const defaultProfile = validated2.data.defaultConfigProfile;
+    const defaultProfile = validated3.data.defaultConfigProfile;
     if (defaultProfile !== void 0 && !validProfileNames.has(defaultProfile)) {
       push(
         "identity",
@@ -12365,7 +12624,7 @@ function runDoctor(params) {
         entry.name
       );
     } else {
-      const credential = validated2.data.credential;
+      const credential = validated3.data.credential;
       const cache = credential === void 0 ? { text: "", unreadable: false } : cacheClause(params.credentialCache, `identity ${entry.name}`, credential);
       push(
         "identity",
@@ -12373,6 +12632,18 @@ function runDoctor(params) {
         `${entry.name} is valid and authenticates with ${credential === void 0 ? "its stored login" : `credential ${describeCredential(credential)}`}${cache.text}.`,
         entry.name
       );
+      const signIn = decideSignIn({
+        hasCredentialBlock: credential !== void 0,
+        keychainItem: params.platform === "darwin" && params.run !== void 0 ? keychainHasItem(params.run, entry.farmRoot) : void 0,
+        credentialsFile: entry.credentialsFilePresent,
+        platform: params.platform
+      });
+      push(
+        "sign-in",
+        signIn.state === "signed-out" ? "warn" : "pass",
+        signIn.state === "signed-out" ? `${entry.name} is signed out (${signIn.detail}). Run \`agent-shim run @${entry.name}\` and sign in.` : `${entry.name} ${signIn.state === "token" ? "uses a credential block" : "is signed in"} (${signIn.detail}).`,
+        entry.name
+      );
     }
   }
   const validatedGlobalConfig = params.globalConfig.raw === void 0 ? void 0 : validateJson(GlobalConfigSchema, params.globalConfig);
@@ -12418,18 +12689,18 @@ function runDoctor(params) {
   } else {
     for (const entry of params.identities) {
       const result = lookupKeychainService(params.run, entry.farmRoot);
-      push("keychain", result.found ? "pass" : "warn", result.note, entry.name);
+      push("keychain", "pass", result.found ? result.note : `${result.note} The sign-in section reports whether a login is stored elsewhere.`, entry.name);
     }
   }
   if (params.directoryRules.raw === void 0) {
     push("directory-rules", "pass", "No directory-rules.json configured.");
   } else {
-    const validated2 = validateJson(DirectoryRulesSchema, params.directoryRules);
-    if (!validated2.ok) {
-      push("directory-rules", "fail", validated2.message);
+    const validated3 = validateJson(DirectoryRulesSchema, params.directoryRules);
+    if (!validated3.ok) {
+      push("directory-rules", "fail", validated3.message);
     } else {
       push("directory-rules", "pass", `${params.directoryRules.path} is valid.`);
-      for (const rule of validated2.data.rules) {
+      for (const rule of validated3.data.rules) {
         const badRefs = [];
         if (rule.identity !== void 0 && !selectionExists(rule.identity)) {
           badRefs.push(poolNameOf(rule.identity) === void 0 ? `identity "${rule.identity}"` : `pool "${poolNameOf(rule.identity) ?? ""}"`);
@@ -12449,11 +12720,11 @@ function runDoctor(params) {
   if (params.globalConfig.raw === void 0) {
     push("global-config", "pass", "No config.json configured.");
   } else {
-    const validated2 = validateJson(GlobalConfigSchema, params.globalConfig);
-    if (!validated2.ok) {
-      push("global-config", "fail", validated2.message);
+    const validated3 = validateJson(GlobalConfigSchema, params.globalConfig);
+    if (!validated3.ok) {
+      push("global-config", "fail", validated3.message);
     } else {
-      const defaultProfile = validated2.data.defaultConfigProfile;
+      const defaultProfile = validated3.data.defaultConfigProfile;
       if (defaultProfile !== void 0 && !validProfileNames.has(defaultProfile)) {
         push(
           "global-config",
@@ -12462,18 +12733,18 @@ function runDoctor(params) {
         );
       } else {
         push("global-config", "pass", `${params.globalConfig.path} is valid.`);
-        checkPin("global-config", void 0, "config.json", validated2.data.launch?.claudeVersion);
+        checkPin("global-config", void 0, "config.json", validated3.data.launch?.claudeVersion);
       }
     }
   }
   if (params.categoriesLocal.raw === void 0) {
     push("categories-local", "pass", "No categories.local.json configured.");
   } else {
-    const validated2 = validateJson(CategoryClassificationOverlaySchema, params.categoriesLocal);
+    const validated3 = validateJson(CategoryClassificationOverlaySchema, params.categoriesLocal);
     push(
       "categories-local",
-      validated2.ok ? "pass" : "fail",
-      validated2.ok ? `${params.categoriesLocal.path} is valid.` : validated2.message
+      validated3.ok ? "pass" : "fail",
+      validated3.ok ? `${params.categoriesLocal.path} is valid.` : validated3.message
     );
   }
   if (params.headroom.state.raw === void 0) {
@@ -12481,11 +12752,11 @@ function runDoctor(params) {
   } else if (tcpPortEraRecord(params.headroom.state.raw)) {
     push("headroom", "pass", `${params.headroom.state.path} holds a previous release's TCP-port state record; the next launch through headroom claims over it.`);
   } else {
-    const validated2 = validateJson(HeadroomStateSchema, params.headroom.state);
-    if (!validated2.ok) {
-      push("headroom", "fail", validated2.message);
+    const validated3 = validateJson(HeadroomStateSchema, params.headroom.state);
+    if (!validated3.ok) {
+      push("headroom", "fail", validated3.message);
     } else {
-      const state = validated2.data;
+      const state = validated3.data;
       const supervisorAlive = state.supervisorPid !== void 0 && params.headroom.isRunning(state.supervisorPid);
       const headroomAlive = state.headroomPid !== void 0 && params.headroom.isRunning(state.headroomPid);
       if (state.supervisorPid === void 0) {
@@ -12553,6 +12824,7 @@ var SECTION_TITLES = {
   "legacy-name": "Former `claude-use` name",
   "config-profile": "Configuration profiles",
   identity: "Identities",
+  "sign-in": "Sign-in",
   pool: "Pools",
   provider: "Providers",
   keychain: "macOS Keychain",
@@ -12569,6 +12841,7 @@ var SECTION_ORDER = [
   "path-resolution",
   "config-profile",
   "identity",
+  "sign-in",
   "pool",
   "provider",
   "keychain",
@@ -12618,18 +12891,18 @@ function collectDoctorReport(params) {
   const { paths } = params;
   const identityNames = fs10.existsSync(paths.identitiesDir) ? fs10.readdirSync(paths.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && isIdentityDirectoryName(entry.name)).map((entry) => entry.name).sort() : [];
   const identities = identityNames.map((name) => {
-    const farmRoot = path28.join(paths.identitiesDir, name);
-    const identityPath = path28.join(farmRoot, "identity.json");
-    return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot };
+    const farmRoot = path29.join(paths.identitiesDir, name);
+    const identityPath = path29.join(farmRoot, "identity.json");
+    return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot, credentialsFilePresent: fs10.existsSync(credentialsFilePath(farmRoot)) };
   });
   const profileNames = fs10.existsSync(paths.configProfilesDir) ? fs10.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const configProfiles = profileNames.map((name) => {
-    const profilePath = path28.join(paths.configProfilesDir, `${name}.json`);
+    const profilePath = path29.join(paths.configProfilesDir, `${name}.json`);
     return { name, path: profilePath, raw: realFsPort.readFileUtf8(profilePath) };
   });
   const providerNames = fs10.existsSync(paths.providersDir) ? fs10.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const providers = providerNames.map((name) => {
-    const providerPath = path28.join(paths.providersDir, `${name}.json`);
+    const providerPath = path29.join(paths.providersDir, `${name}.json`);
     return { name, path: providerPath, raw: realFsPort.readFileUtf8(providerPath) };
   });
   const ownExecutablePath = realOwnExecutablePath();
@@ -12641,12 +12914,12 @@ function collectDoctorReport(params) {
     binaryDiscovery = { ok: false, message: error instanceof Error ? error.message : String(error) };
   }
   const shimState = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-  const pathDirs = (params.env.PATH ?? "").split(path28.delimiter).filter((dir) => dir !== "");
+  const pathDirs = (params.env.PATH ?? "").split(path29.delimiter).filter((dir) => dir !== "");
   const claudeShimShadow = shimState === void 0 ? void 0 : refinePathShadow(
     findPathShadow({
       pathDirs,
-      targetDir: path28.dirname(shimState.targetPath),
-      targetFilename: path28.basename(shimState.targetPath),
+      targetDir: path29.dirname(shimState.targetPath),
+      targetFilename: path29.basename(shimState.targetPath),
       findExecutableInDir
     }),
     shimState.targetPath,
@@ -12672,7 +12945,7 @@ function collectDoctorReport(params) {
       agentShim: refinePathShadow(
         findPathShadow({
           pathDirs,
-          targetDir: path28.dirname(ownExecutablePath),
+          targetDir: path29.dirname(ownExecutablePath),
           targetFilename: commandFilename(ownExecutablePath, "agent-shim"),
           findExecutableInDir
         }),
@@ -12699,90 +12972,90 @@ function collectDoctorReport(params) {
 // src/frontdoor/controlSchemas.ts
 init_schema2();
 init_state();
-var UsageListOutputSchema = z19.strictObject({ snapshots: z19.readonly(z19.array(UsageSnapshotSchema)) });
-var UsageWindowsInputSchema = z19.strictObject({
-  identity: z19.string().min(1),
-  provider: z19.string().min(1).optional()
+var UsageListOutputSchema = z20.strictObject({ snapshots: z20.readonly(z20.array(UsageSnapshotSchema)) });
+var UsageWindowsInputSchema = z20.strictObject({
+  identity: z20.string().min(1),
+  provider: z20.string().min(1).optional()
 });
-var EffectiveWindowSchema = z19.strictObject({
+var EffectiveWindowSchema = z20.strictObject({
   /** True when the window's reset time has passed, so the recorded observation describes a window that no longer exists. */
-  reset: z19.boolean(),
+  reset: z20.boolean(),
   /** The fraction used: 0 for a reset window, otherwise what was last observed, absent when none was reported. */
-  utilization: z19.number().optional(),
+  utilization: z20.number().optional(),
   /** The reset instant, for a window that has not reset yet and reported one. */
-  resetsAtMs: z19.number().optional(),
+  resetsAtMs: z20.number().optional(),
   /** The window's own status, for a window that has not reset yet. */
-  status: z19.string().optional()
+  status: z20.string().optional()
 });
-var UsageWindowsOutputSchema = z19.strictObject({
-  identity: z19.string(),
-  provider: z19.string(),
+var UsageWindowsOutputSchema = z20.strictObject({
+  identity: z20.string(),
+  provider: z20.string(),
   /** When the rate-limit state the windows come from was observed. */
-  observedAt: z19.iso.datetime().optional(),
+  observedAt: z20.iso.datetime().optional(),
   fiveHour: EffectiveWindowSchema.optional(),
   sevenDay: EffectiveWindowSchema.optional()
 });
-var UsageLiveOutputSchema = z19.strictObject({
+var UsageLiveOutputSchema = z20.strictObject({
   /** The freshest observation the door holds, never narrowed by the read's session filter because it is the door's single latest statement of the account's quota; absent while no rate_limit_event has been filed at all. */
   latest: RcLiveRateLimitSchema.optional(),
   /** One observation per session whose stream has filed a rate_limit_event this door generation. */
-  sessions: z19.readonly(z19.array(RcLiveRateLimitSchema))
+  sessions: z20.readonly(z20.array(RcLiveRateLimitSchema))
 });
-var FrontDoorSessionStatusSchema = z19.strictObject({
-  pid: z19.int().positive(),
-  startedAt: z19.number(),
-  alive: z19.boolean()
+var FrontDoorSessionStatusSchema = z20.strictObject({
+  pid: z20.int().positive(),
+  startedAt: z20.number(),
+  alive: z20.boolean()
 });
-var HeadroomSocketTargetSchema = z19.union([z19.strictObject({ socketPath: z19.string() }), z19.strictObject({ refused: z19.string() })]);
-var FrontDoorStatusOutputSchema = z19.strictObject({
+var HeadroomSocketTargetSchema = z20.union([z20.strictObject({ socketPath: z20.string() }), z20.strictObject({ refused: z20.string() })]);
+var FrontDoorStatusOutputSchema = z20.strictObject({
   state: FrontDoorStateSchema,
-  supervisorAlive: z19.boolean(),
-  sessions: z19.readonly(z19.array(FrontDoorSessionStatusSchema)),
+  supervisorAlive: z20.boolean(),
+  sessions: z20.readonly(z20.array(FrontDoorSessionStatusSchema)),
   headroomSocket: HeadroomSocketTargetSchema.optional(),
-  logPath: z19.string(),
-  logExists: z19.boolean()
-});
-var FrontDoorSessionsOutputSchema = z19.strictObject({ sessions: z19.readonly(z19.array(FrontDoorSessionStatusSchema)) });
-var CheckRunInputSchema = z19.strictObject({
-  path: z19.string().min(1),
-  identity: z19.string().min(1).optional()
-}).refine((input) => path29.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
-var PoolPickInputSchema = z19.strictObject({
-  pool: z19.string().min(1),
-  path: z19.string().min(1)
-}).refine((input) => path29.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
-var DoctorFindingSchema = z19.strictObject({
-  section: z19.enum(DOCTOR_SECTIONS),
-  subject: z19.string().optional(),
-  severity: z19.enum(DOCTOR_SEVERITIES),
-  message: z19.string()
-});
-var DoctorRunOutputSchema = z19.strictObject({
+  logPath: z20.string(),
+  logExists: z20.boolean()
+});
+var FrontDoorSessionsOutputSchema = z20.strictObject({ sessions: z20.readonly(z20.array(FrontDoorSessionStatusSchema)) });
+var CheckRunInputSchema = z20.strictObject({
+  path: z20.string().min(1),
+  identity: z20.string().min(1).optional()
+}).refine((input) => path30.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+var PoolPickInputSchema = z20.strictObject({
+  pool: z20.string().min(1),
+  path: z20.string().min(1)
+}).refine((input) => path30.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+var DoctorFindingSchema = z20.strictObject({
+  section: z20.enum(DOCTOR_SECTIONS),
+  subject: z20.string().optional(),
+  severity: z20.enum(DOCTOR_SEVERITIES),
+  message: z20.string()
+});
+var DoctorRunOutputSchema = z20.strictObject({
   /** False exactly when any finding is a `fail`; a `warn` never fails the report on its own. */
-  ok: z19.boolean(),
-  findings: z19.readonly(z19.array(DoctorFindingSchema))
-});
-var FrontDoorRestartOutputSchema = z19.strictObject({
-  action: z19.literal("restarting"),
-  previousPid: z19.int().positive()
-});
-var UpdateCheckOutputSchema = z19.strictObject({
-  current: z19.string(),
-  latest: z19.string(),
-  action: z19.enum(["current", "available", "updated"])
-});
-var CodexSignInSchema = z19.discriminatedUnion("state", [
-  z19.strictObject({ state: z19.literal("none") }),
-  z19.strictObject({ state: z19.literal("signed-in"), email: z19.string().optional(), planScope: z19.boolean(), accessTokenExpiresAt: z19.number() }),
-  z19.strictObject({ state: z19.literal("unreadable"), message: z19.string() })
+  ok: z20.boolean(),
+  findings: z20.readonly(z20.array(DoctorFindingSchema))
+});
+var FrontDoorRestartOutputSchema = z20.strictObject({
+  action: z20.literal("restarting"),
+  previousPid: z20.int().positive()
+});
+var UpdateCheckOutputSchema = z20.strictObject({
+  current: z20.string(),
+  latest: z20.string(),
+  action: z20.enum(["current", "available", "updated"])
+});
+var CodexSignInSchema = z20.discriminatedUnion("state", [
+  z20.strictObject({ state: z20.literal("none") }),
+  z20.strictObject({ state: z20.literal("signed-in"), email: z20.string().optional(), planScope: z20.boolean(), accessTokenExpiresAt: z20.number() }),
+  z20.strictObject({ state: z20.literal("unreadable"), message: z20.string() })
 ]);
-var CodexStatusOutputSchema = z19.strictObject({
+var CodexStatusOutputSchema = z20.strictObject({
   signIn: CodexSignInSchema,
-  codexProviders: z19.readonly(z19.array(z19.string()))
+  codexProviders: z20.readonly(z20.array(z20.string()))
 });
-var CodexLogoutOutputSchema = z19.strictObject({
-  hadGrant: z19.boolean(),
-  revoked: z19.boolean()
+var CodexLogoutOutputSchema = z20.strictObject({
+  hadGrant: z20.boolean(),
+  revoked: z20.boolean()
 });
 
 // src/frontdoor/codexApi.ts
@@ -12939,130 +13212,130 @@ init_providersStore();
 
 // src/frontdoor/configSchemas.ts
 init_schema();
-import { z as z20 } from "zod";
-var RemovalConfirmationSchema = z20.boolean();
-var CredentialWriteSchema = (targets) => z20.strictObject({
-  sources: z20.array(RemoteCredentialSourceSchema).min(1).optional(),
-  target: z20.enum(targets).optional(),
-  cache: z20.union([z20.literal(false), CredentialCacheSchema]).optional()
-});
-var CredentialSummarySchema2 = z20.strictObject({
-  target: z20.enum(CREDENTIAL_TARGETS),
-  sources: z20.readonly(z20.array(
-    z20.discriminatedUnion("kind", [
-      z20.strictObject({ kind: z20.literal("env"), variable: z20.string() }),
-      z20.strictObject({ kind: z20.literal("file"), path: z20.string() }),
-      z20.strictObject({ kind: z20.literal("command"), program: z20.string() }),
-      z20.strictObject({ kind: z20.literal("op"), reference: z20.string() }),
-      z20.strictObject({ kind: z20.literal("keychain"), service: z20.string(), account: z20.string().optional() }),
-      z20.strictObject({ kind: z20.literal("literal") })
+import { z as z21 } from "zod";
+var RemovalConfirmationSchema = z21.boolean();
+var CredentialWriteSchema = (targets) => z21.strictObject({
+  sources: z21.array(RemoteCredentialSourceSchema).min(1).optional(),
+  target: z21.enum(targets).optional(),
+  cache: z21.union([z21.literal(false), CredentialCacheSchema]).optional()
+});
+var CredentialSummarySchema2 = z21.strictObject({
+  target: z21.enum(CREDENTIAL_TARGETS),
+  sources: z21.readonly(z21.array(
+    z21.discriminatedUnion("kind", [
+      z21.strictObject({ kind: z21.literal("env"), variable: z21.string() }),
+      z21.strictObject({ kind: z21.literal("file"), path: z21.string() }),
+      z21.strictObject({ kind: z21.literal("command"), program: z21.string() }),
+      z21.strictObject({ kind: z21.literal("op"), reference: z21.string() }),
+      z21.strictObject({ kind: z21.literal("keychain"), service: z21.string(), account: z21.string().optional() }),
+      z21.strictObject({ kind: z21.literal("literal") })
     ])
   )),
   cache: CredentialCacheSchema.optional()
 });
-var mutationOutput = (kind, action) => z20.strictObject({ action: z20.literal(action), kind: z20.literal(kind), name: z20.string() });
-var storedMutationOutput = (kind, action, value) => z20.strictObject({ action: z20.literal(action), kind: z20.literal(kind), name: z20.string(), value });
-var IdentityValueSchema = z20.strictObject({
-  name: z20.string(),
-  defaultConfigProfile: z20.string().optional(),
-  allowAmbientCredential: z20.boolean(),
+var mutationOutput = (kind, action) => z21.strictObject({ action: z21.literal(action), kind: z21.literal(kind), name: z21.string() });
+var storedMutationOutput = (kind, action, value) => z21.strictObject({ action: z21.literal(action), kind: z21.literal(kind), name: z21.string(), value });
+var IdentityValueSchema = z21.strictObject({
+  name: z21.string(),
+  defaultConfigProfile: z21.string().optional(),
+  allowAmbientCredential: z21.boolean(),
   credential: CredentialSummarySchema2.optional()
 });
 var ProfileValueSchema = ConfigProfileSchema.omit({ $schema: true });
-var ProviderValueSchema = z20.strictObject({
-  name: z20.string(),
-  kind: z20.enum(PROVIDER_KINDS),
-  displayName: z20.string(),
-  baseUrl: z20.string().optional(),
+var ProviderValueSchema = z21.strictObject({
+  name: z21.string(),
+  kind: z21.enum(PROVIDER_KINDS),
+  displayName: z21.string(),
+  baseUrl: z21.string().optional(),
   codex: CodexProviderConfigSchema.optional(),
   credential: CredentialSummarySchema2,
-  env: z20.record(z20.string(), z20.string()).optional()
+  env: z21.record(z21.string(), z21.string()).optional()
 });
-var ConfigNameInputSchema = z20.strictObject({ name: z20.string().min(1) });
+var ConfigNameInputSchema = z21.strictObject({ name: z21.string().min(1) });
 var ConfigIdentityAddOutputSchema = storedMutationOutput("identity", "created", IdentityValueSchema);
-var ConfigIdentitySetInputSchema = z20.strictObject({
-  name: z20.string().min(1),
-  defaultConfigProfile: z20.union([z20.string().min(1), z20.literal(false)]).optional(),
-  allowAmbientCredential: z20.boolean().optional(),
-  credential: z20.union([z20.literal(false), CredentialWriteSchema(CREDENTIAL_TARGETS)]).optional()
+var ConfigIdentitySetInputSchema = z21.strictObject({
+  name: z21.string().min(1),
+  defaultConfigProfile: z21.union([z21.string().min(1), z21.literal(false)]).optional(),
+  allowAmbientCredential: z21.boolean().optional(),
+  credential: z21.union([z21.literal(false), CredentialWriteSchema(CREDENTIAL_TARGETS)]).optional()
 });
 var ConfigIdentitySetOutputSchema = storedMutationOutput("identity", "updated", IdentityValueSchema);
-var ConfigIdentityRemoveInputSchema = z20.strictObject({ name: z20.string().min(1), confirm: RemovalConfirmationSchema });
+var ConfigIdentityRemoveInputSchema = z21.strictObject({ name: z21.string().min(1), confirm: RemovalConfirmationSchema });
 var ConfigIdentityRemoveOutputSchema = mutationOutput("identity", "removed");
 var ConfigIdentityUseOutputSchema = mutationOutput("identity", "selected");
-var ConfigProfileAddInputSchema = z20.strictObject({
-  name: z20.string().min(1),
-  extends: z20.array(z20.string().min(1)).optional(),
-  description: z20.string().optional()
+var ConfigProfileAddInputSchema = z21.strictObject({
+  name: z21.string().min(1),
+  extends: z21.array(z21.string().min(1)).optional(),
+  description: z21.string().optional()
 });
 var ConfigProfileAddOutputSchema = storedMutationOutput("profile", "created", ProfileValueSchema);
-var ConfigProfileSetInputSchema = z20.strictObject({
-  name: z20.string().min(1),
-  category: z20.record(z20.string(), z20.boolean()).optional(),
-  entry: z20.record(z20.string(), z20.boolean()).optional(),
-  extends: z20.union([z20.array(z20.string().min(1)), z20.literal(false)]).optional(),
-  description: z20.union([z20.string(), z20.literal(false)]).optional(),
-  launch: z20.strictObject({
-    skipPermissions: z20.boolean().optional(),
-    remoteControl: z20.boolean().optional(),
-    headroom: z20.boolean().optional(),
-    trackUsage: z20.boolean().optional(),
-    provider: z20.union([z20.string().min(1), z20.literal(false)]).optional(),
-    claudeVersion: z20.union([z20.string().min(1), z20.literal(false)]).optional()
+var ConfigProfileSetInputSchema = z21.strictObject({
+  name: z21.string().min(1),
+  category: z21.record(z21.string(), z21.boolean()).optional(),
+  entry: z21.record(z21.string(), z21.boolean()).optional(),
+  extends: z21.union([z21.array(z21.string().min(1)), z21.literal(false)]).optional(),
+  description: z21.union([z21.string(), z21.literal(false)]).optional(),
+  launch: z21.strictObject({
+    skipPermissions: z21.boolean().optional(),
+    remoteControl: z21.boolean().optional(),
+    headroom: z21.boolean().optional(),
+    trackUsage: z21.boolean().optional(),
+    provider: z21.union([z21.string().min(1), z21.literal(false)]).optional(),
+    claudeVersion: z21.union([z21.string().min(1), z21.literal(false)]).optional()
   }).optional()
 });
 var ConfigProfileSetOutputSchema = storedMutationOutput("profile", "updated", ProfileValueSchema);
-var ConfigProfileRemoveInputSchema = z20.strictObject({ name: z20.string().min(1), confirm: RemovalConfirmationSchema });
+var ConfigProfileRemoveInputSchema = z21.strictObject({ name: z21.string().min(1), confirm: RemovalConfirmationSchema });
 var ConfigProfileRemoveOutputSchema = mutationOutput("profile", "removed");
 var ConfigProfileUseOutputSchema = mutationOutput("profile", "selected");
-var PoolMembersInputSchema = z20.array(z20.string().min(1)).min(1);
-var ConfigPoolAddInputSchema = z20.strictObject({
-  name: z20.string().min(1),
+var PoolMembersInputSchema = z21.array(z21.string().min(1)).min(1);
+var ConfigPoolAddInputSchema = z21.strictObject({
+  name: z21.string().min(1),
   identities: PoolMembersInputSchema,
-  preference: z20.enum(POOL_PREFERENCES).optional()
+  preference: z21.enum(POOL_PREFERENCES).optional()
 });
 var ConfigPoolAddOutputSchema = storedMutationOutput("pool", "created", PoolSchema);
-var ConfigPoolSetInputSchema = z20.strictObject({
-  name: z20.string().min(1),
+var ConfigPoolSetInputSchema = z21.strictObject({
+  name: z21.string().min(1),
   identities: PoolMembersInputSchema.optional(),
-  preference: z20.union([z20.enum(POOL_PREFERENCES), z20.literal(false)]).optional()
+  preference: z21.union([z21.enum(POOL_PREFERENCES), z21.literal(false)]).optional()
 });
 var ConfigPoolSetOutputSchema = storedMutationOutput("pool", "updated", PoolSchema);
-var ConfigPoolRemoveInputSchema = z20.strictObject({ name: z20.string().min(1), confirm: RemovalConfirmationSchema });
+var ConfigPoolRemoveInputSchema = z21.strictObject({ name: z21.string().min(1), confirm: RemovalConfirmationSchema });
 var ConfigPoolRemoveOutputSchema = mutationOutput("pool", "removed");
 var ConfigPoolUseOutputSchema = mutationOutput("pool", "selected");
-var ConfigProviderAddInputSchema = z20.strictObject({
-  name: z20.string().min(1),
-  kind: z20.enum(PROVIDER_KINDS).optional(),
-  displayName: z20.string().min(1),
-  baseUrl: z20.string().min(1).optional(),
+var ConfigProviderAddInputSchema = z21.strictObject({
+  name: z21.string().min(1),
+  kind: z21.enum(PROVIDER_KINDS).optional(),
+  displayName: z21.string().min(1),
+  baseUrl: z21.string().min(1).optional(),
   credential: CredentialWriteSchema(PROVIDER_CREDENTIAL_TARGETS).required({ sources: true }),
   codex: CodexProviderConfigSchema.optional()
 });
 var ConfigProviderAddOutputSchema = storedMutationOutput("provider", "created", ProviderValueSchema);
-var ConfigProviderSetInputSchema = z20.strictObject({
-  name: z20.string().min(1),
-  displayName: z20.string().min(1).optional(),
-  baseUrl: z20.string().min(1).optional(),
+var ConfigProviderSetInputSchema = z21.strictObject({
+  name: z21.string().min(1),
+  displayName: z21.string().min(1).optional(),
+  baseUrl: z21.string().min(1).optional(),
   credential: CredentialWriteSchema(PROVIDER_CREDENTIAL_TARGETS).optional(),
   codex: CodexProviderConfigSchema.optional()
 });
 var ConfigProviderSetOutputSchema = storedMutationOutput("provider", "updated", ProviderValueSchema);
-var ConfigProviderRemoveInputSchema = z20.strictObject({ name: z20.string().min(1), confirm: RemovalConfirmationSchema });
+var ConfigProviderRemoveInputSchema = z21.strictObject({ name: z21.string().min(1), confirm: RemovalConfirmationSchema });
 var ConfigProviderRemoveOutputSchema = mutationOutput("provider", "removed");
-var ConfigRuleAddInputSchema = z20.strictObject({
-  path: z20.string().min(1),
-  configProfile: z20.string().min(1).optional(),
-  identity: z20.string().min(1).optional()
+var ConfigRuleAddInputSchema = z21.strictObject({
+  path: z21.string().min(1),
+  configProfile: z21.string().min(1).optional(),
+  identity: z21.string().min(1).optional()
 });
 var ConfigRuleAddOutputSchema = storedMutationOutput("rule", "created", DirectoryRuleSchema);
-var ConfigRuleSetInputSchema = z20.strictObject({
-  path: z20.string().min(1),
-  configProfile: z20.union([z20.string().min(1), z20.literal(false)]).optional(),
-  identity: z20.union([z20.string().min(1), z20.literal(false)]).optional()
+var ConfigRuleSetInputSchema = z21.strictObject({
+  path: z21.string().min(1),
+  configProfile: z21.union([z21.string().min(1), z21.literal(false)]).optional(),
+  identity: z21.union([z21.string().min(1), z21.literal(false)]).optional()
 });
 var ConfigRuleSetOutputSchema = storedMutationOutput("rule", "updated", DirectoryRuleSchema);
-var ConfigRuleRemoveInputSchema = z20.strictObject({ path: z20.string().min(1), confirm: RemovalConfirmationSchema });
+var ConfigRuleRemoveInputSchema = z21.strictObject({ path: z21.string().min(1), confirm: RemovalConfirmationSchema });
 var ConfigRuleRemoveOutputSchema = mutationOutput("rule", "removed");
 
 // src/frontdoor/configApi.ts
@@ -13126,7 +13399,7 @@ function profileValue(name, paths) {
 function createConfigApiRouter(deps) {
   const authed = doorApiAuth(deps.expectedToken);
   const { paths } = deps;
-  const route = (path36, summary) => authed.meta(openapi3({ method: "POST", path: path36, summary, tags: [CONFIG_API_TAG] }));
+  const route = (path37, summary) => authed.meta(openapi3({ method: "POST", path: path37, summary, tags: [CONFIG_API_TAG] }));
   return {
     config: {
       identity: {
@@ -13368,41 +13641,41 @@ import { openapi as openapi4 } from "@orpc/openapi";
 import { eventIterator as eventIterator2, withEventMeta as withEventMeta2 } from "@orpc/server";
 
 // src/frontdoor/eventSchemas.ts
-import { z as z21 } from "zod";
+import { z as z22 } from "zod";
 var DOOR_EVENT_SOURCE_RC = "rc";
 var LAUNCH_EVENT_SOURCE = "launch";
 var USAGE_EVENT_SOURCE = "usage";
 var DOOR_HEALTH_EVENT_SOURCE = "door";
 var QUOTA_EXPIRING_EVENT_SOURCE = "quota-expiring";
-var DoorEventSchema = z21.strictObject({
-  source: z21.string().min(1),
+var DoorEventSchema = z22.strictObject({
+  source: z22.string().min(1),
   /** A positive integer because the backbone's counters start at one and only ever increase. */
-  sequence: z21.number().int().positive(),
-  payload: z21.unknown()
-});
-var DoorEventSourceQuerySchema = z21.strictObject({
-  sources: z21.array(z21.string().min(1)).min(1).optional()
-});
-var LaunchLifecycleEventSchema = z21.strictObject({
-  kind: z21.enum(["registered", "pruned", "ended"]),
-  pid: z21.number().int().positive(),
-  startedAt: z21.number(),
-  observedAt: z21.number()
-});
-var DoorHealthEventSchema = z21.discriminatedUnion("kind", [
-  z21.strictObject({ kind: z21.literal("generation"), pid: z21.number().int().positive(), providerPort: z21.number().int().positive(), connectPort: z21.number().int().positive(), directPort: z21.number().int().positive(), observedAt: z21.number() }),
-  z21.strictObject({ kind: z21.literal("listenerFailed"), pid: z21.number().int().positive(), listener: z21.enum(["provider", "connect", "direct"]), message: z21.string(), observedAt: z21.number() }),
-  z21.strictObject({ kind: z21.literal("binaryTurnover"), pid: z21.number().int().positive(), observedAt: z21.number() }),
-  z21.strictObject({ kind: z21.literal("idleShutdown"), pid: z21.number().int().positive(), observedAt: z21.number() })
+  sequence: z22.number().int().positive(),
+  payload: z22.unknown()
+});
+var DoorEventSourceQuerySchema = z22.strictObject({
+  sources: z22.array(z22.string().min(1)).min(1).optional()
+});
+var LaunchLifecycleEventSchema = z22.strictObject({
+  kind: z22.enum(["registered", "pruned", "ended"]),
+  pid: z22.number().int().positive(),
+  startedAt: z22.number(),
+  observedAt: z22.number()
+});
+var DoorHealthEventSchema = z22.discriminatedUnion("kind", [
+  z22.strictObject({ kind: z22.literal("generation"), pid: z22.number().int().positive(), providerPort: z22.number().int().positive(), connectPort: z22.number().int().positive(), directPort: z22.number().int().positive(), observedAt: z22.number() }),
+  z22.strictObject({ kind: z22.literal("listenerFailed"), pid: z22.number().int().positive(), listener: z22.enum(["provider", "connect", "direct"]), message: z22.string(), observedAt: z22.number() }),
+  z22.strictObject({ kind: z22.literal("binaryTurnover"), pid: z22.number().int().positive(), observedAt: z22.number() }),
+  z22.strictObject({ kind: z22.literal("idleShutdown"), pid: z22.number().int().positive(), observedAt: z22.number() })
 ]);
-var QuotaExpiringEventSchema = z21.strictObject({
-  identity: z21.string().min(1),
-  provider: z21.string().min(1),
-  window: z21.enum(["fiveHour", "sevenDay"]),
+var QuotaExpiringEventSchema = z22.strictObject({
+  identity: z22.string().min(1),
+  provider: z22.string().min(1),
+  window: z22.enum(["fiveHour", "sevenDay"]),
   /** The fraction of the window already used when it was seen expiring, always below one because a fully used window has nothing left to spend. */
-  utilization: z21.number().min(0).max(1),
-  resetsAt: z21.iso.datetime(),
-  observedAt: z21.number()
+  utilization: z22.number().min(0).max(1),
+  resetsAt: z22.iso.datetime(),
+  observedAt: z22.number()
 });
 
 // src/frontdoor/eventsApi.ts
@@ -13485,52 +13758,52 @@ import { ORPCError as ORPCError5 } from "@orpc/client";
 import { openapi as openapi6 } from "@orpc/openapi";
 
 // src/frontdoor/launchSchemas.ts
-import path30 from "node:path";
-import { z as z22 } from "zod";
+import path31 from "node:path";
+import { z as z23 } from "zod";
 init_claudeVersion();
 init_identity();
-var LaunchResolveInputSchema = z22.strictObject({
-  path: z22.string().min(1),
+var LaunchResolveInputSchema = z23.strictObject({
+  path: z23.string().min(1),
   /** `@name`, launch flags, then the arguments for `claude`; empty for a bare launch. */
-  argv: z22.readonly(z22.array(z22.string())).optional(),
+  argv: z23.readonly(z23.array(z23.string())).optional(),
   /** The launch's inherited environment. Absent means an empty one: the door's own environment is never a substitute for the caller's, so a caller that wants `AGENT_SHIM_*` switches or a `CLAUDE_CONFIG_DIR` considered names them here. Values are read, never reported. */
-  env: z22.record(z22.string(), z22.string()).optional()
-}).refine((input) => path30.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
-var LaunchPoolDecisionSchema = z22.strictObject({
-  name: z22.string(),
-  reasons: z22.readonly(z22.array(z22.string())),
-  movedOff: z22.strictObject({ identity: z22.string(), reason: z22.string() }).optional()
-});
-var LaunchDecisionSchema = z22.strictObject({
-  identity: z22.string().optional(),
-  identitySource: z22.enum(IDENTITY_DECISION_SOURCES),
+  env: z23.record(z23.string(), z23.string()).optional()
+}).refine((input) => path31.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+var LaunchPoolDecisionSchema = z23.strictObject({
+  name: z23.string(),
+  reasons: z23.readonly(z23.array(z23.string())),
+  movedOff: z23.strictObject({ identity: z23.string(), reason: z23.string() }).optional()
+});
+var LaunchDecisionSchema = z23.strictObject({
+  identity: z23.string().optional(),
+  identitySource: z23.enum(IDENTITY_DECISION_SOURCES),
   pool: LaunchPoolDecisionSchema.optional(),
-  configDirEscapeHatch: z22.boolean(),
-  configDir: z22.string().optional(),
-  configProfile: z22.string().optional(),
-  configProfileSource: z22.enum(CONFIG_PROFILE_DECISION_SOURCES),
-  provider: z22.string().optional()
-});
-var LaunchFlagsSchema = z22.strictObject({
-  skipPermissions: z22.boolean(),
-  remoteControl: z22.boolean(),
-  headroom: z22.boolean(),
-  trackUsage: z22.boolean()
-});
-var LaunchResolveOutputSchema = z22.strictObject({
+  configDirEscapeHatch: z23.boolean(),
+  configDir: z23.string().optional(),
+  configProfile: z23.string().optional(),
+  configProfileSource: z23.enum(CONFIG_PROFILE_DECISION_SOURCES),
+  provider: z23.string().optional()
+});
+var LaunchFlagsSchema = z23.strictObject({
+  skipPermissions: z23.boolean(),
+  remoteControl: z23.boolean(),
+  headroom: z23.boolean(),
+  trackUsage: z23.boolean()
+});
+var LaunchResolveOutputSchema = z23.strictObject({
   decision: LaunchDecisionSchema,
   flags: LaunchFlagsSchema,
-  claudeVersion: z22.strictObject({ version: z22.string(), source: z22.enum(CLAUDE_VERSION_SOURCES) }).optional(),
+  claudeVersion: z23.strictObject({ version: z23.string(), source: z23.enum(CLAUDE_VERSION_SOURCES) }).optional(),
   /** The real `claude` binary the launch would spawn, on the door's host. */
-  bin: z22.string(),
+  bin: z23.string(),
   /** The arguments the launch would pass it: the tool's own flags, then `CLAUDE_EXTRA_FLAGS`, then the caller's own. */
-  args: z22.readonly(z22.array(z22.string())),
+  args: z23.readonly(z23.array(z23.string())),
   /** The credential the launch would authenticate with, by target and source kinds. Absent when none applies. */
-  credential: z22.strictObject({ subject: z22.enum(["provider", "identity"]), name: z22.string(), summary: CredentialSummarySchema }).optional(),
-  routing: z22.strictObject({ frontDoor: z22.boolean(), headroom: z22.boolean() }),
+  credential: z23.strictObject({ subject: z23.enum(["provider", "identity"]), name: z23.string(), summary: CredentialSummarySchema }).optional(),
+  routing: z23.strictObject({ frontDoor: z23.boolean(), headroom: z23.boolean() }),
   /** The names of the environment variables the launch would set or unset, sorted. Values are not reported. */
-  environment: z22.readonly(z22.array(z22.string())),
-  warnings: z22.readonly(z22.array(z22.string()))
+  environment: z23.readonly(z23.array(z23.string())),
+  warnings: z23.readonly(z23.array(z23.string()))
 });
 
 // src/frontdoor/launchApi.ts
@@ -15591,8 +15864,8 @@ data: ${JSON.stringify(envelope)}
 
 // src/frontdoor/rcSelfHostMint.ts
 init_account();
-import path31 from "node:path";
-var CREDENTIALS_FILE = ".credentials.json";
+import path32 from "node:path";
+var CREDENTIALS_FILE2 = ".credentials.json";
 var CLAUDE_JSON2 = ".claude.json";
 var RC_SELF_HOST_RECORD_DIR = "rc-selfhost";
 var RC_SELF_HOST_RECORD_FILE = "credential.json";
@@ -15615,7 +15888,7 @@ function readJsonObject(fs12, file) {
   return isRecord11(parsed) ? parsed : void 0;
 }
 function readRcSelfHostRecord(fs12, frontdoorDir) {
-  const parsed = readJsonObject(fs12, path31.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
+  const parsed = readJsonObject(fs12, path32.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
   if (parsed === void 0) {
     return void 0;
   }
@@ -15629,11 +15902,11 @@ function mintRcSelfHostCredential(deps) {
   if (!isIdentityName(deps.identity)) {
     throw new Error(`"${deps.identity}" is not a valid identity name.`);
   }
-  const identityDir = path31.join(deps.identitiesDir, deps.identity);
-  const credentialsFile = path31.join(identityDir, CREDENTIALS_FILE);
-  const claudeJsonFile = path31.join(identityDir, CLAUDE_JSON2);
-  const recordDir = path31.join(deps.frontdoorDir, RC_SELF_HOST_RECORD_DIR);
-  const recordFile = path31.join(recordDir, RC_SELF_HOST_RECORD_FILE);
+  const identityDir = path32.join(deps.identitiesDir, deps.identity);
+  const credentialsFile = path32.join(identityDir, CREDENTIALS_FILE2);
+  const claudeJsonFile = path32.join(identityDir, CLAUDE_JSON2);
+  const recordDir = path32.join(deps.frontdoorDir, RC_SELF_HOST_RECORD_DIR);
+  const recordFile = path32.join(recordDir, RC_SELF_HOST_RECORD_FILE);
   const previousRecord = readRcSelfHostRecord(deps.fs, deps.frontdoorDir);
   const existingCredentials = readJsonObject(deps.fs, credentialsFile);
   const existingOauth = isRecord11(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
@@ -15649,7 +15922,7 @@ function mintRcSelfHostCredential(deps) {
   const organizationUuid = deps.newUuid();
   const accountUuid = deps.newUuid();
   const mintedAt = new Date(deps.now()).toISOString();
-  deps.fs.mkdirPrivate(path31.dirname(credentialsFile));
+  deps.fs.mkdirPrivate(path32.dirname(credentialsFile));
   deps.fs.writeFilePrivate(credentialsFile, `${JSON.stringify({ ...existingCredentials, claudeAiOauth: { accessToken, refreshToken, expiresAt: null, scopes: [...RC_SELF_HOST_SCOPE_LIST], subscriptionType: SELF_HOST_SUBSCRIPTION_TYPE, rateLimitTier: null } }, null, 2)}
 `);
   const claudeJson = readJsonObject(deps.fs, claudeJsonFile) ?? {};
@@ -15797,6 +16070,8 @@ init_ownCli();
 export {
   AMBIENT_CREDENTIAL_VARS,
   CHECK_CREDENTIAL_APPLIES,
+  CODEX_APP_SERVER_GENERATED_AGAINST,
+  CODEX_APP_SERVER_TIMEOUT_MS,
   CONNECT_INTERCEPT_HOST,
   CONNECT_INTERCEPT_HOSTS,
   CONNECT_LIMITS,
@@ -15807,7 +16082,12 @@ export {
   CheckReportJsonSchema,
   CheckRunInputSchema,
   CliError,
+  CodexAccountReadSchema,
+  CodexAppServerProtocolError,
+  CodexAppServerRequestError,
+  CodexAppServerUnavailableError,
   CodexLogoutOutputSchema,
+  CodexRateLimitsReadSchema,
   CodexSignInSchema,
   CodexStatusOutputSchema,
   ConfigIdentityAddOutputSchema,
@@ -16065,6 +16345,8 @@ export {
   rcSelfHostFromEnv,
   rcWebFetchAllowsPrivateFromEnv,
   readActiveIdentity2 as readActiveIdentity,
+  readCodexAccount,
+  readCodexRateLimits,
   readDirectoryRules,
   readFarmManifest,
   readFrontDoorControlMaterial,
@@ -16076,6 +16358,7 @@ export {
   readRcSelfHostRecord,
   readRcSessionFile,
   readUsageSnapshot,
+  realCodexAppServerPort,
   realConnectCertStore,
   realConnectEffects,
   realRcControlTransport,