very-happy-cli 0.2.95 → 0.2.97

package/dist/{types-HRuZ13LS.cjs → types-DoGaKVfK.cjs}

@@ -51,7 +51,7 @@ var z__namespace = /*#__PURE__*/_interopNamespaceDefault(z);
 var pty__namespace = /*#__PURE__*/_interopNamespaceDefault(pty);
 
 var name = "very-happy-cli";
-var version = "0.2.95";
+var version = "0.2.97";
 var description = "Remote multi-agent workspace CLI with deep Claude integration, native terminal streaming, and self-hosting.";
 var author = "Kirill Dubovitskiy";
 var contributors = [
@@ -164,12 +164,12 @@ var dependencies = {
 	zod: "^4.0.0"
 };
 var optionalDependencies = {
-	"very-happy-tools-arm64-darwin": "0.2.95",
-	"very-happy-tools-x64-darwin": "0.2.95",
-	"very-happy-tools-arm64-linux": "0.2.95",
-	"very-happy-tools-x64-linux": "0.2.95",
-	"very-happy-tools-arm64-win32": "0.2.95",
-	"very-happy-tools-x64-win32": "0.2.95"
+	"very-happy-tools-arm64-darwin": "0.2.97",
+	"very-happy-tools-x64-darwin": "0.2.97",
+	"very-happy-tools-arm64-linux": "0.2.97",
+	"very-happy-tools-x64-linux": "0.2.97",
+	"very-happy-tools-arm64-win32": "0.2.97",
+	"very-happy-tools-x64-win32": "0.2.97"
 };
 var devDependencies = {
 	"@slopus/happy-wire": "workspace:*",
@@ -1002,6 +1002,22 @@ z.z.object({
     detectedAt: z.z.number()
   }).optional()
 });
+const ClaudeAuthStateSchema = z.z.object({
+  probeVersion: z.z.number(),
+  daemonPid: z.z.number(),
+  status: z.z.union([z.z.enum(["ok", "not-logged-in", "unknown", "error", "claude-missing"]), z.z.string()]),
+  authMethod: z.z.string().optional(),
+  subscriptionType: z.z.string().optional(),
+  diagnosis: z.z.string().optional(),
+  detail: z.z.string().optional(),
+  repairable: z.z.string().optional(),
+  context: z.z.object({
+    platform: z.z.string(),
+    lineage: z.z.string(),
+    credentialStore: z.z.string()
+  }),
+  checkedAt: z.z.number()
+});
 const CliUpdateStateSchema = z.z.object({
   currentVersion: z.z.string(),
   recommendedVersion: z.z.string().nullable(),
@@ -1096,7 +1112,15 @@ z.z.object({
     detectedAt: z.z.number()
   }).optional(),
   /** Relay-owned CLI compatibility/update policy last checked by this daemon. */
-  cliUpdate: CliUpdateStateSchema.optional()
+  cliUpdate: CliUpdateStateSchema.optional(),
+  /**
+   * B-276: result of the daemon-context Claude auth preflight (spec
+   * 2026-09-claude-auth-preflight). Trust rule for consumers:
+   * `claudeAuth.daemonPid === daemonState.pid` — daemonState survives daemon
+   * restarts (the server returns the existing row and connect spreads it
+   * forward), so a downgraded daemon carries this field along unchanged.
+   */
+  claudeAuth: ClaudeAuthStateSchema.optional()
 });
 const MessageMetaSchema = z.z.object({
   sentFrom: z.z.string().optional(),
@@ -1545,7 +1569,7 @@ class RpcHandlerManager {
   }
 }
 
-const __dirname$1 = path$1.dirname(url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('types-HRuZ13LS.cjs', document.baseURI).href))));
+const __dirname$1 = path$1.dirname(url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('types-DoGaKVfK.cjs', document.baseURI).href))));
 function projectPath() {
   const path = path$1.resolve(__dirname$1, "..");
   return path;
@@ -10368,8 +10392,18 @@ function resolveDefaultShell(platform, env, isExecutable = (path) => {
 function defaultShell() {
   return resolveDefaultShell(process.platform, process.env);
 }
+const VH_SESSION_OPTION_OVERRIDES = [
+  ["session", "destroy-unattached", "off"],
+  ["window", "remain-on-exit", "off"],
+  ["window", "window-size", "latest"],
+  ["window", "pane-border-status", "off"]
+];
 function tmuxNewSessionArgs(session, cols, rows, cwd, envFlags, shell) {
-  return ["new-session", "-d", ...envFlags, "-s", session, "-x", String(cols), "-y", String(rows), "-c", cwd, shell];
+  const args = ["new-session", "-d", ...envFlags, "-s", session, "-x", String(cols), "-y", String(rows), "-c", cwd, shell];
+  for (const [scope, option, value] of VH_SESSION_OPTION_OVERRIDES) {
+    args.push(";", "set-option", ...scope === "window" ? ["-w"] : [], "-q", "-t", `=${session}:`, option, value);
+  }
+  return args;
 }
 function shouldUseDirectPtyFallback(attachOnly, createdNew, sessionAlive) {
   return !attachOnly && !createdNew && !sessionAlive;
@@ -13771,6 +13805,7 @@ class ApiMachineClient {
   lastKnownResumeSupport = null;
   cliUpdateState = null;
   cliUpdatePushChain = Promise.resolve();
+  claudeAuthState = null;
   rpcHandlerManager;
   resumeSessionHandler = null;
   restartSessionHandler = null;
@@ -13837,6 +13872,44 @@ class ApiMachineClient {
     if (!this.socket?.connected) return;
     this.cliUpdatePushChain = this.cliUpdatePushChain.then(() => this.updateDaemonState((current) => withCurrentCliUpdateState(current, this.cliUpdateState))).catch((error) => logger.debug("[API MACHINE] Failed to publish CLI update policy:", error));
   }
+  /**
+   * B-276: publish the daemon-context Claude auth preflight into daemonState
+   * (same serialized push chain as the CLI update policy). Resolves true when
+   * the server acknowledged the write with our value in it, false otherwise
+   * (rate-limit `result:'error'` is swallowed by updateDaemonState, so the
+   * caller checks the echoed state and re-sends on the next probe).
+   */
+  setClaudeAuthState(state) {
+    this.claudeAuthState = state;
+    if (!this.socket?.connected) return Promise.resolve(false);
+    const attempt = this.cliUpdatePushChain.then(() => this.updateDaemonState((current) => ({
+      ...current ?? {},
+      status: current?.status ?? "running",
+      claudeAuth: state
+    }))).then(() => this.machine.daemonState?.claudeAuth?.checkedAt === state.checkedAt && this.machine.daemonState?.claudeAuth?.daemonPid === state.daemonPid).catch((error) => {
+      logger.debug("[API MACHINE] Failed to publish Claude auth state:", error);
+      return false;
+    });
+    this.cliUpdatePushChain = attempt.then(() => void 0);
+    return attempt;
+  }
+  /** B-276 machine RPCs. Responses always carry `claudeAuth` so the web can refresh in place. */
+  setClaudeAuthHandlers(handlers) {
+    this.rpcHandlerManager.registerHandler("claude-auth-probe", async () => {
+      const claudeAuth = await handlers.probe();
+      return { claudeAuth };
+    });
+    this.rpcHandlerManager.registerHandler("claude-auth-repair", async (params) => {
+      const action = typeof params?.action === "string" ? params.action : "";
+      return handlers.repair(action);
+    });
+    this.rpcHandlerManager.registerHandler("claude-auth-set-store", async (params) => {
+      const store = params?.store === "file" ? "file" : params?.store === "auto" ? "auto" : null;
+      if (!store) return { error: "invalid-store", claudeAuth: this.claudeAuthState };
+      const claudeAuth = await handlers.setStore(store);
+      return { claudeAuth };
+    });
+  }
   setRPCHandlers({
     spawnSession,
     resumeSession,
@@ -14351,7 +14424,10 @@ class ApiMachineClient {
         // B-084: closed records survive daemon restarts (persisted
         // in closed-terminals.json), so the connect snapshot ships
         // them too — not just the incremental pushes.
-        closedTerminals: this.webTerminal.getClosedTerminals()
+        closedTerminals: this.webTerminal.getClosedTerminals(),
+        // B-276: re-ship the last preflight so a reconnect never
+        // leaves a stale-pid value visible longer than needed.
+        ...this.claudeAuthState ? { claudeAuth: this.claudeAuthState } : {}
       };
     });
     this.webTerminal.startListTracking((terminals) => this.pushTerminalList(terminals));
@@ -15763,3 +15839,4 @@ exports.writeCredentialsDataKey = writeCredentialsDataKey;
 exports.writeCredentialsLegacy = writeCredentialsLegacy;
 exports.writeDaemonState = writeDaemonState;
 exports.writePrivateFileSync = writePrivateFileSync;
+exports.writeSettings = writeSettings;

package/dist/{types-BLE8Hfmh.mjs → types-xZOYW0_G.mjs}

@@ -29,7 +29,7 @@ import { SandboxManager } from '@anthropic-ai/sandbox-runtime';
 import { Expo } from 'expo-server-sdk';
 
 var name = "very-happy-cli";
-var version = "0.2.95";
+var version = "0.2.97";
 var description = "Remote multi-agent workspace CLI with deep Claude integration, native terminal streaming, and self-hosting.";
 var author = "Kirill Dubovitskiy";
 var contributors = [
@@ -142,12 +142,12 @@ var dependencies = {
 	zod: "^4.0.0"
 };
 var optionalDependencies = {
-	"very-happy-tools-arm64-darwin": "0.2.95",
-	"very-happy-tools-x64-darwin": "0.2.95",
-	"very-happy-tools-arm64-linux": "0.2.95",
-	"very-happy-tools-x64-linux": "0.2.95",
-	"very-happy-tools-arm64-win32": "0.2.95",
-	"very-happy-tools-x64-win32": "0.2.95"
+	"very-happy-tools-arm64-darwin": "0.2.97",
+	"very-happy-tools-x64-darwin": "0.2.97",
+	"very-happy-tools-arm64-linux": "0.2.97",
+	"very-happy-tools-x64-linux": "0.2.97",
+	"very-happy-tools-arm64-win32": "0.2.97",
+	"very-happy-tools-x64-win32": "0.2.97"
 };
 var devDependencies = {
 	"@slopus/happy-wire": "workspace:*",
@@ -980,6 +980,22 @@ z$1.object({
     detectedAt: z$1.number()
   }).optional()
 });
+const ClaudeAuthStateSchema = z$1.object({
+  probeVersion: z$1.number(),
+  daemonPid: z$1.number(),
+  status: z$1.union([z$1.enum(["ok", "not-logged-in", "unknown", "error", "claude-missing"]), z$1.string()]),
+  authMethod: z$1.string().optional(),
+  subscriptionType: z$1.string().optional(),
+  diagnosis: z$1.string().optional(),
+  detail: z$1.string().optional(),
+  repairable: z$1.string().optional(),
+  context: z$1.object({
+    platform: z$1.string(),
+    lineage: z$1.string(),
+    credentialStore: z$1.string()
+  }),
+  checkedAt: z$1.number()
+});
 const CliUpdateStateSchema = z$1.object({
   currentVersion: z$1.string(),
   recommendedVersion: z$1.string().nullable(),
@@ -1074,7 +1090,15 @@ z$1.object({
     detectedAt: z$1.number()
   }).optional(),
   /** Relay-owned CLI compatibility/update policy last checked by this daemon. */
-  cliUpdate: CliUpdateStateSchema.optional()
+  cliUpdate: CliUpdateStateSchema.optional(),
+  /**
+   * B-276: result of the daemon-context Claude auth preflight (spec
+   * 2026-09-claude-auth-preflight). Trust rule for consumers:
+   * `claudeAuth.daemonPid === daemonState.pid` — daemonState survives daemon
+   * restarts (the server returns the existing row and connect spreads it
+   * forward), so a downgraded daemon carries this field along unchanged.
+   */
+  claudeAuth: ClaudeAuthStateSchema.optional()
 });
 const MessageMetaSchema = z$1.object({
   sentFrom: z$1.string().optional(),
@@ -10346,8 +10370,18 @@ function resolveDefaultShell(platform, env, isExecutable = (path) => {
 function defaultShell() {
   return resolveDefaultShell(process.platform, process.env);
 }
+const VH_SESSION_OPTION_OVERRIDES = [
+  ["session", "destroy-unattached", "off"],
+  ["window", "remain-on-exit", "off"],
+  ["window", "window-size", "latest"],
+  ["window", "pane-border-status", "off"]
+];
 function tmuxNewSessionArgs(session, cols, rows, cwd, envFlags, shell) {
-  return ["new-session", "-d", ...envFlags, "-s", session, "-x", String(cols), "-y", String(rows), "-c", cwd, shell];
+  const args = ["new-session", "-d", ...envFlags, "-s", session, "-x", String(cols), "-y", String(rows), "-c", cwd, shell];
+  for (const [scope, option, value] of VH_SESSION_OPTION_OVERRIDES) {
+    args.push(";", "set-option", ...scope === "window" ? ["-w"] : [], "-q", "-t", `=${session}:`, option, value);
+  }
+  return args;
 }
 function shouldUseDirectPtyFallback(attachOnly, createdNew, sessionAlive) {
   return !attachOnly && !createdNew && !sessionAlive;
@@ -13749,6 +13783,7 @@ class ApiMachineClient {
   lastKnownResumeSupport = null;
   cliUpdateState = null;
   cliUpdatePushChain = Promise.resolve();
+  claudeAuthState = null;
   rpcHandlerManager;
   resumeSessionHandler = null;
   restartSessionHandler = null;
@@ -13815,6 +13850,44 @@ class ApiMachineClient {
     if (!this.socket?.connected) return;
     this.cliUpdatePushChain = this.cliUpdatePushChain.then(() => this.updateDaemonState((current) => withCurrentCliUpdateState(current, this.cliUpdateState))).catch((error) => logger.debug("[API MACHINE] Failed to publish CLI update policy:", error));
   }
+  /**
+   * B-276: publish the daemon-context Claude auth preflight into daemonState
+   * (same serialized push chain as the CLI update policy). Resolves true when
+   * the server acknowledged the write with our value in it, false otherwise
+   * (rate-limit `result:'error'` is swallowed by updateDaemonState, so the
+   * caller checks the echoed state and re-sends on the next probe).
+   */
+  setClaudeAuthState(state) {
+    this.claudeAuthState = state;
+    if (!this.socket?.connected) return Promise.resolve(false);
+    const attempt = this.cliUpdatePushChain.then(() => this.updateDaemonState((current) => ({
+      ...current ?? {},
+      status: current?.status ?? "running",
+      claudeAuth: state
+    }))).then(() => this.machine.daemonState?.claudeAuth?.checkedAt === state.checkedAt && this.machine.daemonState?.claudeAuth?.daemonPid === state.daemonPid).catch((error) => {
+      logger.debug("[API MACHINE] Failed to publish Claude auth state:", error);
+      return false;
+    });
+    this.cliUpdatePushChain = attempt.then(() => void 0);
+    return attempt;
+  }
+  /** B-276 machine RPCs. Responses always carry `claudeAuth` so the web can refresh in place. */
+  setClaudeAuthHandlers(handlers) {
+    this.rpcHandlerManager.registerHandler("claude-auth-probe", async () => {
+      const claudeAuth = await handlers.probe();
+      return { claudeAuth };
+    });
+    this.rpcHandlerManager.registerHandler("claude-auth-repair", async (params) => {
+      const action = typeof params?.action === "string" ? params.action : "";
+      return handlers.repair(action);
+    });
+    this.rpcHandlerManager.registerHandler("claude-auth-set-store", async (params) => {
+      const store = params?.store === "file" ? "file" : params?.store === "auto" ? "auto" : null;
+      if (!store) return { error: "invalid-store", claudeAuth: this.claudeAuthState };
+      const claudeAuth = await handlers.setStore(store);
+      return { claudeAuth };
+    });
+  }
   setRPCHandlers({
     spawnSession,
     resumeSession,
@@ -14329,7 +14402,10 @@ class ApiMachineClient {
         // B-084: closed records survive daemon restarts (persisted
         // in closed-terminals.json), so the connect snapshot ships
         // them too — not just the incremental pushes.
-        closedTerminals: this.webTerminal.getClosedTerminals()
+        closedTerminals: this.webTerminal.getClosedTerminals(),
+        // B-276: re-ship the last preflight so a reconnect never
+        // leaves a stale-pid value visible longer than needed.
+        ...this.claudeAuthState ? { claudeAuth: this.claudeAuthState } : {}
       };
     });
     this.webTerminal.startListTracking((terminals) => this.pushTerminalList(terminals));
@@ -15664,4 +15740,4 @@ const RawJSONLinesSchema = z$1.discriminatedUnion("type", [
   }).passthrough()
 ]);
 
-export { detectResumeSupport as $, ApiClient as A, deriveLocalCliUpdateSummary as B, updateSettings as C, encodeBase64Url as D, decodeBase64 as E, writeCredentialsLegacy as F, writeCredentialsDataKey as G, readCredentialsForConfiguredRelay as H, InvalidateSync as I, encrypt as J, isClaudeSessionId as K, getLocalHappyAgentCredentialPath as L, MAX_CHAT_ATTACHMENT_SOURCE_BYTES as M, readLocalHappyAgentCredentials as N, decryptWithDataKey as O, decryptLegacy as P, extractCompleteLines as Q, RawJSONLinesSchema as R, decideBackfill as S, parseTerminalHookPayload as T, tmuxArgs as U, scrubTmuxClientEnv as V, decideMirrorBinding as W, MIRROR_BACKFILL_LINES_DEFAULT as X, persistSession as Y, mirrorLineKey as Z, mirrorLocalId as _, ApiSessionClient as a, detectCLIAvailability as a0, acquireDaemonLock as a1, summarizeSpawnSessionForLog as a2, deletePersistedSessions as a3, decrypt as a4, writeDaemonState as a5, fetchCliUpdateState as a6, resolveCliUpdateCheckInterval as a7, DEFAULT_CLI_UPDATE_CHECK_INTERVAL_MS as a8, releaseDaemonLock as a9, isValidSessionId as aa, listVhTerminals as ab, isValidTerminalId as ac, readVhTerminal as ad, sendToVhTerminal as ae, startOfflineReconnection as af, clearCredentials as ag, clearMachineId as ah, SandboxConfigSchema as ai, CodexAppServerClient as aj, getLatestDaemonLog as ak, persistence as al, api as am, createEnvelope as b, configuration as c, contentLogMetadata as d, errorLogMetadata as e, packageJson as f, delay as g, connectionState as h, readSettings as i, encodeBase64 as j, ensurePrivateDirectorySync as k, logger as l, hardenPrivateFileSync as m, readDaemonState as n, clearDaemonState as o, projectPath as p, getProjectPath as q, readPersistedSessions as r, initializeSandbox as s, wrapCommand as t, AsyncLock as u, ensurePrivateDirectory as v, writePrivateFileSync as w, hardenPrivateFile as x, readCredentials as y, credentialRelayProblem as z };
+export { detectResumeSupport as $, ApiClient as A, deriveLocalCliUpdateSummary as B, updateSettings as C, encodeBase64Url as D, decodeBase64 as E, writeCredentialsLegacy as F, writeCredentialsDataKey as G, readCredentialsForConfiguredRelay as H, InvalidateSync as I, encrypt as J, isClaudeSessionId as K, getLocalHappyAgentCredentialPath as L, MAX_CHAT_ATTACHMENT_SOURCE_BYTES as M, readLocalHappyAgentCredentials as N, decryptWithDataKey as O, decryptLegacy as P, extractCompleteLines as Q, RawJSONLinesSchema as R, decideBackfill as S, parseTerminalHookPayload as T, tmuxArgs as U, scrubTmuxClientEnv as V, decideMirrorBinding as W, MIRROR_BACKFILL_LINES_DEFAULT as X, persistSession as Y, mirrorLineKey as Z, mirrorLocalId as _, ApiSessionClient as a, detectCLIAvailability as a0, acquireDaemonLock as a1, summarizeSpawnSessionForLog as a2, deletePersistedSessions as a3, decrypt as a4, writeDaemonState as a5, writeSettings as a6, fetchCliUpdateState as a7, resolveCliUpdateCheckInterval as a8, DEFAULT_CLI_UPDATE_CHECK_INTERVAL_MS as a9, releaseDaemonLock as aa, isValidSessionId as ab, listVhTerminals as ac, isValidTerminalId as ad, readVhTerminal as ae, sendToVhTerminal as af, startOfflineReconnection as ag, clearCredentials as ah, clearMachineId as ai, SandboxConfigSchema as aj, CodexAppServerClient as ak, getLatestDaemonLog as al, persistence as am, api as an, createEnvelope as b, configuration as c, contentLogMetadata as d, errorLogMetadata as e, packageJson as f, delay as g, connectionState as h, readSettings as i, encodeBase64 as j, ensurePrivateDirectorySync as k, logger as l, hardenPrivateFileSync as m, readDaemonState as n, clearDaemonState as o, projectPath as p, getProjectPath as q, readPersistedSessions as r, initializeSandbox as s, wrapCommand as t, AsyncLock as u, ensurePrivateDirectory as v, writePrivateFileSync as w, hardenPrivateFile as x, readCredentials as y, credentialRelayProblem as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "very-happy-cli",
-  "version": "0.2.95",
+  "version": "0.2.97",
   "description": "Remote multi-agent workspace CLI with deep Claude integration, native terminal streaming, and self-hosting.",
   "author": "Kirill Dubovitskiy",
   "contributors": [
@@ -113,12 +113,12 @@
     "zod": "^4.0.0"
   },
   "optionalDependencies": {
-    "very-happy-tools-arm64-darwin": "0.2.95",
-    "very-happy-tools-x64-darwin": "0.2.95",
-    "very-happy-tools-arm64-linux": "0.2.95",
-    "very-happy-tools-x64-linux": "0.2.95",
-    "very-happy-tools-arm64-win32": "0.2.95",
-    "very-happy-tools-x64-win32": "0.2.95"
+    "very-happy-tools-arm64-darwin": "0.2.97",
+    "very-happy-tools-x64-darwin": "0.2.97",
+    "very-happy-tools-arm64-linux": "0.2.97",
+    "very-happy-tools-x64-linux": "0.2.97",
+    "very-happy-tools-arm64-win32": "0.2.97",
+    "very-happy-tools-x64-win32": "0.2.97"
   },
   "devDependencies": {
     "@slopus/happy-wire": "workspace:*",

package/scripts/shims/keychain-off/security

@@ -0,0 +1,51 @@
+#!/bin/bash
+# very-happy keychain-off shim for Claude Code (B-276, spec 2026-09-claude-auth-preflight D8).
+#
+# Placed FIRST on PATH only for the Claude Code processes very-happy spawns when
+# the machine-local setting `claudeCredentialStore` is `file`. Claude Code reads
+# and writes its OAuth credentials through the bare `security` CLI; an exit code
+# of 36 (errSecInteractionNotAllowed) on its own keychain item makes it fall
+# back to ~/.claude/.credentials.json for reads AND writes without deleting the
+# file — exactly what an ssh/tmux shell sees. Everything that is not Claude
+# Code's own item is passed through to the real binary untouched.
+#
+# Exit code MUST be 36 or 44: anything else is treated by Claude Code as a
+# transient READ_FAILED (cached credentials), not as "use the file".
+REAL="${HAPPY_SECURITY_BIN:-/usr/bin/security}"
+
+is_claude_item() {
+  # $@ = tokens of one security command line; true when -s <value> starts with "Claude Code"
+  local prev="" tok
+  for tok in "$@"; do
+    if [ "$prev" = "-s" ]; then
+      tok="${tok%\"}"; tok="${tok#\"}"; tok="${tok%\'}"; tok="${tok#\'}"
+      case "$tok" in "Claude Code"*) return 0 ;; esac
+      return 1
+    fi
+    prev="$tok"
+  done
+  return 1
+}
+
+case "${1:-}" in
+  show-keychain-info)
+    exit 36 ;;
+  find-generic-password|add-generic-password|delete-generic-password)
+    if is_claude_item "$@"; then exit 36; fi
+    exec "$REAL" "$@" ;;
+  -i)
+    # Interactive form: Claude Code's normal write path feeds
+    # `add-generic-password -U -a <user> -s "<service>" -X <hex>` on stdin.
+    input="$(cat)"
+    first_line="$(printf '%s\n' "$input" | sed -n '1p')"
+    case "$first_line" in
+      find-generic-password*|add-generic-password*|delete-generic-password*)
+        if [[ "$first_line" =~ (^|[[:space:]])-s[[:space:]]+(\"([^\"]*)\"|\'([^\']*)\'|([^[:space:]]+)) ]]; then
+          svc="${BASH_REMATCH[3]}${BASH_REMATCH[4]}${BASH_REMATCH[5]}"
+          case "$svc" in "Claude Code"*) exit 36 ;; esac
+        fi ;;
+    esac
+    printf '%s\n' "$input" | exec "$REAL" -i ;;
+  *)
+    exec "$REAL" "$@" ;;
+esac