agent-shim 0.0.0 → 7.1.0

package/dist/index.mjs

@@ -0,0 +1,3545 @@
+// src/config/classify.ts
+import picomatch from "picomatch";
+
+// src/config/schema.ts
+import path from "node:path";
+import { z } from "zod";
+var CATEGORY_NAMES = ["secret", "runtime", "history", "knowledge", "settings"];
+var OVERRIDABLE_CATEGORIES = ["runtime", "history", "knowledge", "settings"];
+function isOverridableCategory(name) {
+  return OVERRIDABLE_CATEGORIES.some((category) => category === name);
+}
+function isCategoryName(name) {
+  return CATEGORY_NAMES.some((category) => category === name);
+}
+function expandAllCategoryKey(pairs) {
+  const { all, ...rest } = pairs;
+  if (all === void 0) {
+    return { ...rest };
+  }
+  const expanded = Object.fromEntries(OVERRIDABLE_CATEGORIES.filter((category) => !all || category !== "runtime").map((category) => [category, all]));
+  return { ...expanded, ...rest };
+}
+var CategoryMapSchema = z.strictObject({
+  all: z.boolean().optional(),
+  runtime: z.boolean().optional(),
+  history: z.boolean().optional(),
+  knowledge: z.boolean().optional(),
+  settings: z.boolean().optional()
+}).transform((input) => expandAllCategoryKey(input));
+var DURATION_RE = /^(?:0|[1-9][0-9]*)(?:ms|s|m|h|d|w)$/;
+var DurationSchema = z.string().regex(DURATION_RE);
+var WhenSchema = z.strictObject({
+  newerThan: DurationSchema.optional(),
+  olderThan: DurationSchema.optional(),
+  maxSizeBytes: z.int().positive().optional(),
+  branch: z.string().min(1).optional(),
+  env: z.record(z.string().min(1), z.string()).optional()
+});
+var EntryValueSchema = z.union([
+  z.boolean(),
+  z.strictObject({ value: z.boolean(), when: WhenSchema })
+]);
+var ENTRY_KEY_RE = /^(?:secret|runtime|history|knowledge|settings)\/(?!\/)\S(?:.*\S)?$/;
+var EntriesSchema = z.record(z.string().regex(ENTRY_KEY_RE), EntryValueSchema);
+var LaunchSchema = z.strictObject({
+  skipPermissions: z.boolean().optional(),
+  remoteControl: z.boolean().optional(),
+  provider: z.string().min(1).optional(),
+  headroom: z.boolean().optional(),
+  trackUsage: z.boolean().optional()
+});
+var CREDENTIAL_TARGETS = ["bearer", "apiKey", "oauthToken"];
+var PROVIDER_CREDENTIAL_TARGETS = ["bearer", "apiKey"];
+var CREDENTIAL_TARGET_VARS = {
+  bearer: "ANTHROPIC_AUTH_TOKEN",
+  apiKey: "ANTHROPIC_API_KEY",
+  oauthToken: "CLAUDE_CODE_OAUTH_TOKEN"
+};
+var ArgvSchema = z.tuple([z.string().min(1)], z.string());
+var CommandSourceOptions = {
+  /** True when running the command needs a person present (a desktop-unlocked secret store's approval prompt), so it is skipped when there is neither a terminal nor a desktop session. Defaults per source kind; see `isInteractiveSource`. */
+  interactive: z.boolean().optional(),
+  /** How long the command may run before it is killed and counted as failed. Defaults to `CREDENTIAL_COMMAND_TIMEOUT_MS`, or `CREDENTIAL_INTERACTIVE_TIMEOUT_MS` for an interactive source. */
+  timeoutMs: z.int().positive().optional()
+};
+var CredentialSourceSchema = z.union([
+  z.strictObject({ env: z.string().min(1) }),
+  z.strictObject({
+    file: z.string().min(1).refine((filePath) => filePath.startsWith("~/") || path.isAbsolute(filePath), {
+      message: "a credential file must be an absolute or ~-rooted path, since a launch can start in any directory"
+    })
+  }),
+  z.strictObject({ command: ArgvSchema, ...CommandSourceOptions }),
+  z.strictObject({ op: z.string().startsWith("op://"), ...CommandSourceOptions }),
+  z.strictObject({
+    keychain: z.strictObject({ service: z.string().min(1), account: z.string().min(1).optional() }),
+    ...CommandSourceOptions
+  }),
+  z.strictObject({ literal: z.string().min(1) })
+]);
+var CREDENTIAL_CACHE_STORES = ["keychain", "file"];
+var CredentialCacheSchema = z.strictObject({
+  ttl: z.string().regex(/^[1-9]\d*[smhd]$/, { message: "ttl is a whole number followed by s, m, h or d, for example 12h" }).optional(),
+  store: z.enum(CREDENTIAL_CACHE_STORES).optional()
+});
+var CredentialSchema = z.strictObject({
+  sources: z.array(CredentialSourceSchema).min(1),
+  target: z.enum(CREDENTIAL_TARGETS).optional(),
+  cache: CredentialCacheSchema.optional()
+});
+var ProviderCredentialSchema = CredentialSchema.extend({ target: z.enum(PROVIDER_CREDENTIAL_TARGETS).optional() });
+var RESERVED_PROVIDER_ENV_KEYS = Object.values(CREDENTIAL_TARGET_VARS);
+var ProviderEnvSchema = z.record(z.string().min(1), z.string()).refine((env) => !Object.keys(env).some((key) => RESERVED_PROVIDER_ENV_KEYS.includes(key)), {
+  message: `env may not set ${RESERVED_PROVIDER_ENV_KEYS.join(", ")}: the credential block's target sets one and agent-shim removes the others`
+});
+var CODEX_EFFORTS = ["none", "low", "medium", "high"];
+var CODEX_DEFAULT_TIER_MODELS = Object.freeze({
+  fable: "gpt-5.6-sol",
+  opus: "gpt-5.6-sol",
+  sonnet: "gpt-5.6-terra",
+  haiku: "gpt-5.6-luna"
+});
+var CodexProviderConfigSchema = z.strictObject({
+  /** The codex model a request maps to when no tier matches its model name. */
+  defaultModel: z.string().min(1).optional(),
+  /** Per-tier overrides of the shipped mapping, matched by substring of the requested model name in `CODEX_TIERS` order. */
+  models: z.strictObject({
+    fable: z.string().min(1).optional(),
+    opus: z.string().min(1).optional(),
+    sonnet: z.string().min(1).optional(),
+    haiku: z.string().min(1).optional()
+  }).optional(),
+  /** The reasoning effort used when the request's own `output_config.effort` is not one the backend accepts. */
+  effort: z.enum(CODEX_EFFORTS).optional()
+});
+var HttpProviderSchema = z.strictObject({
+  $schema: z.string().optional(),
+  kind: z.literal("http").optional(),
+  displayName: z.string().min(1),
+  baseUrl: z.url(),
+  credential: ProviderCredentialSchema,
+  env: ProviderEnvSchema.optional()
+});
+var CodexProviderSchema = z.strictObject({
+  $schema: z.string().optional(),
+  kind: z.literal("codex"),
+  displayName: z.string().min(1),
+  credential: ProviderCredentialSchema,
+  env: ProviderEnvSchema.optional(),
+  codex: CodexProviderConfigSchema.optional()
+});
+var ProviderSchema = z.discriminatedUnion("kind", [HttpProviderSchema, CodexProviderSchema]);
+function isCodexProvider(provider) {
+  return provider.kind === "codex";
+}
+var ConfigProfileSchema = z.strictObject({
+  $schema: z.string().optional(),
+  description: z.string().optional(),
+  extends: z.array(z.string().min(1)).optional(),
+  categories: CategoryMapSchema.optional(),
+  entries: EntriesSchema.optional(),
+  launch: LaunchSchema.optional()
+});
+var POOL_SELECTOR_PREFIX = "pool:";
+var POOL_NAME_PATTERN = "[A-Za-z0-9][A-Za-z0-9._-]*";
+var IDENTITY_NAME_PATTERN = "[A-Za-z0-9][A-Za-z0-9._@-]*";
+var PoolNameSchema = z.string().min(1).regex(new RegExp(`^${POOL_NAME_PATTERN}$`));
+var IdentitySelectorSchema = z.string().min(1).regex(new RegExp(`^(${POOL_SELECTOR_PREFIX}${POOL_NAME_PATTERN}|${IDENTITY_NAME_PATTERN})$`));
+var PoolSchema = z.strictObject({
+  identities: z.array(z.string().min(1).regex(new RegExp(`^${IDENTITY_NAME_PATTERN}$`))).min(1).refine((names) => new Set(names).size === names.length, { message: "pool members must be unique" })
+});
+var DirectoryRuleSchema = ConfigProfileSchema.omit({ description: true }).extend({
+  path: z.string().min(1),
+  configProfile: z.string().min(1).optional(),
+  identity: IdentitySelectorSchema.optional(),
+  when: WhenSchema.optional()
+});
+var DirectoryRulesSchema = z.strictObject({
+  $schema: z.string().optional(),
+  rules: z.array(DirectoryRuleSchema)
+});
+var PortableConfigSchema = ConfigProfileSchema.omit({ description: true }).extend({
+  configProfile: z.string().min(1).optional(),
+  identity: IdentitySelectorSchema.optional(),
+  when: WhenSchema.optional()
+});
+var HEADROOM_MODES = ["cache", "token"];
+var HEADROOM_CCR_MODES = ["default", "lossless", "none"];
+var HEADROOM_ROLLOUT_CHANNELS = ["beta", "canary", "dev"];
+var INTERCEPT_CHANNELS = ["canary", "dev"];
+var READ_MATURATION_CHANNELS = ["beta", "dev"];
+var HeadroomGlobalConfigObjectSchema = z.strictObject({
+  /** Install spec handed to `uv tool install`. Defaults to HEADROOM_DEFAULT_SOURCE. */
+  source: z.string().min(1).optional(),
+  /** How long the daemon may sit with no registered sessions before the supervisor stops it. Defaults to HEADROOM_DEFAULT_IDLE_SHUTDOWN_MINUTES. */
+  idleShutdownMinutes: z.number().int().positive().optional(),
+  /** Optimisation mode, passed as `--mode`. Unset leaves headroom's own default (`cache`). */
+  mode: z.enum(HEADROOM_MODES).optional(),
+  /** Keep-ratio for prose and code compression, passed as `--target-ratio`: lower is more aggressive. Unset lets headroom decide. */
+  targetRatio: z.number().gt(0).max(1).optional(),
+  /** How compressed tool output stays recoverable. Unset leaves headroom's own default (`default`). */
+  ccr: z.enum(HEADROOM_CCR_MODES).optional(),
+  /** Headroom's experimental release channel, exported as `HEADROOM_ROLLOUT_CHANNEL`. Required by `interceptToolResults` and `readMaturation`, which are refused without a channel that unlocks them. */
+  rolloutChannel: z.enum(HEADROOM_ROLLOUT_CHANNELS).optional(),
+  /** Opt in to headroom's tool-result interceptors (`--intercept-tool-results`). Needs `rolloutChannel` canary or dev. */
+  interceptToolResults: z.boolean().optional(),
+  /** Opt in to headroom's experimental read maturation (`--read-maturation`). Needs `rolloutChannel` beta or dev. */
+  readMaturation: z.boolean().optional()
+});
+var HeadroomGlobalConfigSchema = HeadroomGlobalConfigObjectSchema.superRefine((config, context) => {
+  if (config.interceptToolResults === true && !INTERCEPT_CHANNELS.includes(config.rolloutChannel ?? "")) {
+    context.addIssue({ code: "custom", path: ["interceptToolResults"], message: "interceptToolResults needs rolloutChannel canary or dev" });
+  }
+  if (config.readMaturation === true && !READ_MATURATION_CHANNELS.includes(config.rolloutChannel ?? "")) {
+    context.addIssue({ code: "custom", path: ["readMaturation"], message: "readMaturation needs rolloutChannel beta or dev" });
+  }
+});
+var HEADROOM_DEFAULT_SOURCE = "headroom-ai[proxy] @ git+https://github.com/ExaDev/headroom@ecd1c351fcfed97499721e86852e148436ff2ee6";
+var HEADROOM_DEFAULT_IDLE_SHUTDOWN_MINUTES = 15;
+var FrontDoorGlobalConfigSchema = z.strictObject({
+  /** How long the front door may sit with no registered sessions before it closes and exits. Defaults to FRONTDOOR_DEFAULT_IDLE_SHUTDOWN_MINUTES. */
+  idleShutdownMinutes: z.number().int().positive().optional()
+});
+var GlobalConfigSchema = z.strictObject({
+  $schema: z.string().optional(),
+  defaultConfigProfile: z.string().min(1).optional(),
+  walkUpLimit: z.string().min(1).optional(),
+  categories: CategoryMapSchema.optional(),
+  entries: EntriesSchema.optional(),
+  launch: LaunchSchema.optional(),
+  headroom: HeadroomGlobalConfigSchema.optional(),
+  frontdoor: FrontDoorGlobalConfigSchema.optional(),
+  pools: z.record(PoolNameSchema, PoolSchema).optional()
+});
+var IdentitySchema = z.strictObject({
+  $schema: z.string().optional(),
+  name: z.string().min(1).regex(/^[A-Za-z0-9][A-Za-z0-9._@-]*$/),
+  defaultConfigProfile: z.string().min(1).optional(),
+  allowAmbientCredential: z.boolean().default(false),
+  credential: CredentialSchema.optional()
+});
+var CategoryClassificationSchema = z.strictObject({
+  $schema: z.string().optional(),
+  secret: z.array(z.string().min(1)),
+  runtime: z.array(z.string().min(1)),
+  history: z.array(z.string().min(1)),
+  knowledge: z.array(z.string().min(1)),
+  settings: z.array(z.string().min(1))
+});
+var CategoryClassificationOverlaySchema = z.strictObject({
+  $schema: z.string().optional(),
+  secret: z.array(z.string().min(1)).optional(),
+  runtime: z.array(z.string().min(1)).optional(),
+  history: z.array(z.string().min(1)).optional(),
+  knowledge: z.array(z.string().min(1)).optional(),
+  settings: z.array(z.string().min(1)).optional()
+});
+var SHIPPED_CATEGORY_DEFAULTS = Object.freeze({
+  secret: false,
+  runtime: false,
+  history: true,
+  knowledge: true,
+  settings: true
+});
+
+// src/config/load.ts
+import { cosmiconfigSync } from "cosmiconfig";
+
+// src/cliError.ts
+var EXIT_FAILURE = 1;
+var CliError = class extends Error {
+  /** The process exit status this failure maps to. `EXIT_FAILURE` unless a subclass says otherwise. */
+  exitCode = EXIT_FAILURE;
+};
+
+// src/config/classify.ts
+var GLOB_METACHARACTERS = /[*?[\]{}!()]/;
+function isExactPattern(pattern) {
+  return !GLOB_METACHARACTERS.test(pattern);
+}
+function compile(pattern, category, source, ordinal) {
+  const isExact = isExactPattern(pattern);
+  const matcher = picomatch(pattern, { dot: true, nocase: false });
+  return {
+    pattern,
+    category,
+    source,
+    isExact,
+    ordinal,
+    matches: isExact ? (name) => name === pattern : (name) => matcher(name)
+  };
+}
+function compileClassificationPatterns(defaults, overlay) {
+  const compiled = [];
+  let ordinal = 0;
+  for (const category of CATEGORY_NAMES) {
+    for (const pattern of defaults[category]) {
+      compiled.push(compile(pattern, category, "default", ordinal));
+      ordinal += 1;
+    }
+  }
+  if (overlay !== void 0) {
+    for (const category of CATEGORY_NAMES) {
+      for (const pattern of overlay[category] ?? []) {
+        compiled.push(compile(pattern, category, "local", ordinal));
+        ordinal += 1;
+      }
+    }
+  }
+  return compiled;
+}
+function compareClassificationPatterns(a, b) {
+  if (a.isExact !== b.isExact) {
+    return a.isExact ? 1 : -1;
+  }
+  if (a.source !== b.source) {
+    return a.source === "local" ? 1 : -1;
+  }
+  if (a.pattern.length !== b.pattern.length) {
+    return a.pattern.length - b.pattern.length;
+  }
+  return a.ordinal - b.ordinal;
+}
+function classifyEntries(names, options) {
+  const patterns = compileClassificationPatterns(options.defaults, options.overlay);
+  const classification = /* @__PURE__ */ new Map();
+  const decidedBy = /* @__PURE__ */ new Map();
+  const unclassified = [];
+  for (const name of names) {
+    let winner;
+    for (const candidate of patterns) {
+      if (!candidate.matches(name)) {
+        continue;
+      }
+      if (winner === void 0 || compareClassificationPatterns(candidate, winner) > 0) {
+        winner = candidate;
+      }
+    }
+    if (winner === void 0) {
+      classification.set(name, null);
+      unclassified.push(name);
+      continue;
+    }
+    classification.set(name, winner.category);
+    decidedBy.set(name, winner);
+  }
+  return { classification, unclassified, decidedBy };
+}
+
+// src/resolve/conditions.ts
+import picomatch2 from "picomatch";
+var MILLISECONDS_PER_UNIT = Object.freeze({
+  ms: 1,
+  s: 1e3,
+  m: 6e4,
+  h: 36e5,
+  d: 864e5,
+  w: 6048e5
+});
+var DURATION_PARTS_RE = /^(0|[1-9][0-9]*)(ms|s|m|h|d|w)$/;
+function parseDuration(value) {
+  const parts = DURATION_PARTS_RE.exec(value);
+  if (parts === null) {
+    throw new Error(`"${value}" is not a valid duration. Expected a count followed by ms, s, m, h, d, or w.`);
+  }
+  const [, count, unit] = parts;
+  if (count === void 0 || unit === void 0) {
+    throw new Error(`"${value}" is not a valid duration.`);
+  }
+  const multiplier = MILLISECONDS_PER_UNIT[unit];
+  if (multiplier === void 0) {
+    throw new Error(`"${value}" is not a valid duration.`);
+  }
+  return Number(count) * multiplier;
+}
+function matchBranch(pattern, branch, detached = false) {
+  if (branch === void 0 || branch === "" || detached) {
+    return false;
+  }
+  return picomatch2(pattern, { dot: true, nocase: false })(branch);
+}
+function evaluateWhen(when, context) {
+  if (when === void 0) {
+    return { passed: true, checked: [], failed: [] };
+  }
+  const checked = [];
+  const failed = [];
+  if (when.newerThan !== void 0) {
+    checked.push("newerThan");
+    const window = parseDuration(when.newerThan);
+    const latest = context.fact?.latestMtimeMs;
+    if (latest === void 0 || context.nowMs - latest > window) {
+      failed.push("newerThan");
+    }
+  }
+  if (when.olderThan !== void 0) {
+    checked.push("olderThan");
+    const window = parseDuration(when.olderThan);
+    const latest = context.fact?.latestMtimeMs;
+    if (latest === void 0 || context.nowMs - latest <= window) {
+      failed.push("olderThan");
+    }
+  }
+  if (when.maxSizeBytes !== void 0) {
+    checked.push("maxSizeBytes");
+    const total = context.fact?.totalSizeBytes;
+    if (total === void 0 || total > when.maxSizeBytes) {
+      failed.push("maxSizeBytes");
+    }
+  }
+  if (when.branch !== void 0) {
+    checked.push("branch");
+    if (!matchBranch(when.branch, context.branch, context.branchDetached ?? false)) {
+      failed.push("branch");
+    }
+  }
+  if (when.env !== void 0) {
+    checked.push("env");
+    const mismatch = Object.entries(when.env).some(([name, expected]) => context.env[name] !== expected);
+    if (mismatch) {
+      failed.push("env");
+    }
+  }
+  return { passed: failed.length === 0, checked, failed };
+}
+function isVacuousWhen(when) {
+  return when !== void 0 && Object.keys(when).length === 0;
+}
+
+// src/resolve/match.ts
+import picomatch3 from "picomatch";
+
+// src/resolve/projects.ts
+var NON_ALPHANUMERIC = /[^A-Za-z0-9]/g;
+var WILDCARD_TOKENS = ["**", "*", "?"];
+function encodeProjectPath(realPath) {
+  return realPath.replace(NON_ALPHANUMERIC, "-");
+}
+function splitOnWildcards(pattern) {
+  const fragments = [];
+  let literal = "";
+  let index = 0;
+  while (index < pattern.length) {
+    const token = WILDCARD_TOKENS.find((candidate) => pattern.startsWith(candidate, index));
+    if (token === void 0) {
+      literal += pattern.charAt(index);
+      index += 1;
+      continue;
+    }
+    if (literal !== "") {
+      fragments.push({ kind: "literal", text: literal });
+      literal = "";
+    }
+    fragments.push({ kind: "wildcard", text: token });
+    index += token.length;
+  }
+  if (literal !== "") {
+    fragments.push({ kind: "literal", text: literal });
+  }
+  return fragments;
+}
+var UnrootedProjectPathError = class extends CliError {
+  constructor(fragment) {
+    super(
+      `"${fragment}" is not a rooted path. Everything written after the "history/projects/" prefix is a real absolute working directory (optionally globbed), so it must start with "/" or "~/" \u2014 a bare relative path has nothing to encode against.`
+    );
+    this.fragment = fragment;
+    this.name = "UnrootedProjectPathError";
+  }
+  fragment;
+};
+function expandHome(fragment, home) {
+  if (fragment === "~") {
+    return home;
+  }
+  if (fragment.startsWith("~/")) {
+    return home + fragment.slice(1);
+  }
+  return fragment;
+}
+function encodeProjectPattern(fragment, options) {
+  const expanded = expandHome(fragment, options.home);
+  if (!expanded.startsWith("/")) {
+    throw new UnrootedProjectPathError(fragment);
+  }
+  return splitOnWildcards(expanded).map((piece) => piece.kind === "literal" ? encodeProjectPath(piece.text) : piece.text).join("");
+}
+
+// src/resolve/match.ts
+var GLOB_METACHARACTERS2 = /[*?[\]{}!()]/;
+function isExactPattern2(pattern) {
+  return !GLOB_METACHARACTERS2.test(pattern);
+}
+function literalPrefixOf(pattern) {
+  const match = GLOB_METACHARACTERS2.exec(pattern);
+  return match === null ? pattern : pattern.slice(0, match.index);
+}
+function normaliseRelative(fragment) {
+  const segments = fragment.split("/").filter((segment) => segment !== "" && segment !== ".");
+  return segments.join("/");
+}
+var PROJECTS_PREFIX = "projects/";
+var EntryKeyError = class extends CliError {
+  constructor(key, message, reason) {
+    super(message);
+    this.key = key;
+    this.reason = reason;
+    this.name = "EntryKeyError";
+  }
+  key;
+  reason;
+};
+function canonicaliseEntryKey(key, options) {
+  const separator = key.indexOf("/");
+  if (separator <= 0) {
+    throw new EntryKeyError(key, `Entry key "${key}" has no "<category>/" prefix.`, "malformed");
+  }
+  const category = key.slice(0, separator);
+  if (!isCategoryName(category)) {
+    throw new EntryKeyError(key, `Entry key "${key}" starts with "${category}", which is not a category name.`, "malformed");
+  }
+  const rest = key.slice(separator + 1);
+  if (rest === "") {
+    throw new EntryKeyError(key, `Entry key "${key}" names a category with no path after it.`, "malformed");
+  }
+  if (category === "history" && rest.startsWith(PROJECTS_PREFIX)) {
+    const fragment = rest.slice(PROJECTS_PREFIX.length);
+    try {
+      const encoded = encodeProjectPattern(fragment, { home: options.home });
+      return { declaredCategory: category, canonicalPattern: PROJECTS_PREFIX + encoded, projectFragment: fragment };
+    } catch (error) {
+      if (error instanceof UnrootedProjectPathError) {
+        throw new EntryKeyError(key, error.message, "unrooted-project-path");
+      }
+      throw error;
+    }
+  }
+  return { declaredCategory: category, canonicalPattern: normaliseRelative(rest) };
+}
+function compileMatcher(canonicalPattern) {
+  const options = { dot: true, nocase: false };
+  const self = picomatch3(canonicalPattern, options);
+  const subtree = picomatch3(`${canonicalPattern}/**`, options);
+  return (relPath) => self(relPath) || subtree(relPath);
+}
+function patternCouldReachUnder(canonicalPattern, dir) {
+  const patternSegments = canonicalPattern.split("/").filter((segment) => segment !== "");
+  const dirSegments = dir.split("/").filter((segment) => segment !== "");
+  return couldReach(patternSegments, dirSegments);
+}
+function couldReach(patternSegments, dirSegments) {
+  if (dirSegments.length === 0) {
+    return true;
+  }
+  if (patternSegments.length === 0) {
+    return true;
+  }
+  const [head, ...restPattern] = patternSegments;
+  if (head === "**") {
+    return true;
+  }
+  const [dirHead, ...restDir] = dirSegments;
+  if (head === void 0 || dirHead === void 0) {
+    return true;
+  }
+  if (!picomatch3(head, { dot: true, nocase: false })(dirHead)) {
+    return false;
+  }
+  return couldReach(restPattern, restDir);
+}
+function compareSpecificity(a, b) {
+  if (a.layer !== b.layer) {
+    return a.layer - b.layer;
+  }
+  if (a.isExact !== b.isExact) {
+    return a.isExact ? 1 : -1;
+  }
+  if (a.literalPrefix.length !== b.literalPrefix.length) {
+    return a.literalPrefix.length - b.literalPrefix.length;
+  }
+  if (a.segmentCount !== b.segmentCount) {
+    return a.segmentCount - b.segmentCount;
+  }
+  if (a.ordinal !== b.ordinal) {
+    return a.ordinal - b.ordinal;
+  }
+  if (a.canonicalPattern === b.canonicalPattern) {
+    return 0;
+  }
+  return a.canonicalPattern < b.canonicalPattern ? -1 : 1;
+}
+
+// src/resolve/flatten.ts
+function unpackEntryValue(value) {
+  if (typeof value === "boolean") {
+    return { value };
+  }
+  return { value: value.value, when: value.when };
+}
+function flattenLayers(layers, options) {
+  const categories = /* @__PURE__ */ new Map();
+  const rules = /* @__PURE__ */ new Map();
+  const launch = {};
+  const diagnostics = [];
+  for (const layer of layers) {
+    if (layer.categories !== void 0) {
+      for (const [name, value] of Object.entries(layer.categories)) {
+        if (!isOverridableCategory(name)) {
+          continue;
+        }
+        categories.set(name, value);
+      }
+    }
+    if (layer.launch !== void 0) {
+      if (layer.launch.skipPermissions !== void 0) {
+        launch.skipPermissions = layer.launch.skipPermissions;
+      }
+      if (layer.launch.remoteControl !== void 0) {
+        launch.remoteControl = layer.launch.remoteControl;
+      }
+      if (layer.launch.provider !== void 0) {
+        launch.provider = layer.launch.provider;
+      }
+      if (layer.launch.headroom !== void 0) {
+        launch.headroom = layer.launch.headroom;
+      }
+      if (layer.launch.trackUsage !== void 0) {
+        launch.trackUsage = layer.launch.trackUsage;
+      }
+    }
+    if (layer.entries === void 0) {
+      continue;
+    }
+    const order = orderedKeys(layer);
+    for (const [ordinal, rawKey] of order.entries()) {
+      const value = layer.entries[rawKey];
+      if (value === void 0) {
+        continue;
+      }
+      let canonical;
+      try {
+        canonical = canonicaliseEntryKey(rawKey, { home: options.home });
+      } catch (error) {
+        if (error instanceof EntryKeyError) {
+          diagnostics.push({
+            code: error.reason === "unrooted-project-path" ? "UNROOTED_PROJECT_PATH" : "MALFORMED_ENTRY_KEY",
+            severity: "error",
+            message: error.message,
+            subject: rawKey,
+            layer: layer.id
+          });
+          continue;
+        }
+        throw error;
+      }
+      if (canonical.declaredCategory === "secret") {
+        diagnostics.push({
+          code: "SECRET_ENTRY_KEY",
+          severity: "error",
+          message: `Entry key "${rawKey}" targets the secret category, which no configuration layer may override. Credentials and config backups are never shared with any identity, and this key is ignored entirely.`,
+          subject: rawKey,
+          layer: layer.id
+        });
+        continue;
+      }
+      const unpacked = unpackEntryValue(value);
+      if (isVacuousWhen(unpacked.when)) {
+        diagnostics.push({
+          code: "EMPTY_WHEN",
+          severity: "warning",
+          message: `Entry key "${rawKey}" carries an empty "when" object, which is vacuously true and has no effect.`,
+          subject: rawKey,
+          layer: layer.id
+        });
+      }
+      const pattern = canonical.canonicalPattern;
+      const rule = {
+        rawKey,
+        declaredCategory: canonical.declaredCategory,
+        canonicalPattern: pattern,
+        value: unpacked.value,
+        ...unpacked.when === void 0 ? {} : { when: unpacked.when },
+        layer: layer.id,
+        ordinal,
+        isExact: isExactPattern2(pattern),
+        literalPrefix: literalPrefixOf(pattern),
+        segmentCount: pattern.split("/").filter((segment) => segment !== "").length,
+        matches: compileMatcher(pattern)
+      };
+      rules.set(pattern, rule);
+    }
+  }
+  return { categories, rules, launch, diagnostics };
+}
+function orderedKeys(layer) {
+  const present = new Set(Object.keys(layer.entries ?? {}));
+  const ordered = [];
+  for (const key of layer.entryOrder ?? []) {
+    if (present.has(key)) {
+      ordered.push(key);
+      present.delete(key);
+    }
+  }
+  for (const key of present) {
+    ordered.push(key);
+  }
+  return ordered;
+}
+function matchingRules(flattened, relPath) {
+  const matches = [];
+  for (const rule of flattened.rules.values()) {
+    if (rule.matches(relPath)) {
+      matches.push(rule);
+    }
+  }
+  return matches.sort((a, b) => compareSpecificity(b, a));
+}
+
+// src/resolve/decide.ts
+function selectRule(relPath, flattened, context) {
+  const eliminated = [];
+  for (const rule of matchingRules(flattened, relPath)) {
+    const evaluation = evaluateWhen(rule.when, {
+      nowMs: context.nowMs,
+      ...context.fact === void 0 ? {} : { fact: context.fact },
+      ...context.branch === void 0 ? {} : { branch: context.branch },
+      ...context.branchDetached === void 0 ? {} : { branchDetached: context.branchDetached },
+      env: context.env
+    });
+    if (evaluation.passed) {
+      return { rule, eliminated };
+    }
+    eliminated.push({ rule, failed: evaluation.failed });
+  }
+  return { eliminated };
+}
+function resolveEntry(relPath, params) {
+  const diagnostics = [];
+  const head = relPath.split("/")[0] ?? relPath;
+  const category = params.classification.get(head) ?? null;
+  if (category === "secret") {
+    for (const rule of matchingRules(params.flattened, relPath)) {
+      diagnostics.push({
+        code: "SECRET_PATH_NEUTRALISED",
+        severity: "warning",
+        message: `Entry key "${rule.rawKey}" matches "${relPath}", whose real category is secret. Credentials and config backups are never shared with any identity, so this override is ignored for that path.`,
+        subject: relPath,
+        layer: rule.layer
+      });
+    }
+    return { decision: { relPath, shared: false, via: "secret-floor", category }, diagnostics };
+  }
+  if (category === null) {
+    diagnostics.push({
+      code: "UNCLASSIFIED_ENTRY",
+      severity: "warning",
+      message: `"${head}" is not in the category map, so it is excluded. Run \`agent-shim configure\` to classify it, which records the answer in the local overlay without touching the shipped default map.`,
+      subject: head
+    });
+    return { decision: { relPath, shared: false, via: "unclassified", category }, diagnostics };
+  }
+  const fact = params.facts.entries.get(relPath);
+  const selection = selectRule(relPath, params.flattened, {
+    nowMs: params.facts.nowMs,
+    ...fact === void 0 ? {} : { fact },
+    ...params.facts.branch === void 0 ? {} : { branch: params.facts.branch },
+    ...params.facts.branchDetached === void 0 ? {} : { branchDetached: params.facts.branchDetached },
+    env: params.facts.env
+  });
+  if (selection.rule !== void 0) {
+    const winner = selection.rule;
+    if (winner.declaredCategory !== category) {
+      diagnostics.push({
+        code: "CATEGORY_PREFIX_MISMATCH",
+        severity: "warning",
+        message: `Entry key "${winner.rawKey}" declares the ${winner.declaredCategory} category but matches "${relPath}", which is classified as ${category}.`,
+        subject: relPath,
+        layer: winner.layer
+      });
+    }
+    diagnostics.push(...reportOverriddenExactKeys(winner, params, relPath));
+    return {
+      decision: {
+        relPath,
+        shared: winner.value,
+        via: "entry-rule",
+        category,
+        rule: winner,
+        ...selection.eliminated.length === 0 ? {} : { eliminated: selection.eliminated }
+      },
+      diagnostics
+    };
+  }
+  if (isOverridableCategory(category)) {
+    const override = params.flattened.categories.get(category);
+    if (override !== void 0) {
+      return {
+        decision: {
+          relPath,
+          shared: override,
+          via: "category-override",
+          category,
+          ...selection.eliminated.length === 0 ? {} : { eliminated: selection.eliminated }
+        },
+        diagnostics
+      };
+    }
+  }
+  return {
+    decision: {
+      relPath,
+      shared: SHIPPED_CATEGORY_DEFAULTS[category],
+      via: "category-default",
+      category,
+      ...selection.eliminated.length === 0 ? {} : { eliminated: selection.eliminated }
+    },
+    diagnostics
+  };
+}
+function reportOverriddenExactKeys(winner, params, relPath) {
+  if (winner.isExact) {
+    return [];
+  }
+  const diagnostics = [];
+  for (const candidate of params.flattened.rules.values()) {
+    if (candidate === winner || !candidate.isExact || candidate.layer >= winner.layer) {
+      continue;
+    }
+    if (!candidate.matches(relPath) || candidate.value === winner.value) {
+      continue;
+    }
+    diagnostics.push({
+      code: "EXACT_ENTRY_OVERRIDDEN_BY_LATER_GLOB",
+      severity: "info",
+      message: `For "${relPath}", the exact key "${candidate.rawKey}" from layer ${String(candidate.layer)} is overridden by the glob "${winner.rawKey}" from the later layer ${String(winner.layer)}. A later layer always wins, so a local rule can only ever tighten what an earlier, shared configuration opened.`,
+      subject: relPath,
+      layer: winner.layer
+    });
+  }
+  return diagnostics;
+}
+function resolveAll(params) {
+  const decisions = /* @__PURE__ */ new Map();
+  const diagnostics = [...params.flattened.diagnostics];
+  for (const relPath of params.facts.entries.keys()) {
+    const result = resolveEntry(relPath, params);
+    decisions.set(relPath, result.decision);
+    diagnostics.push(...result.diagnostics);
+  }
+  return { decisions, diagnostics: dedupeDiagnostics(diagnostics) };
+}
+function dedupeDiagnostics(diagnostics) {
+  const seen = /* @__PURE__ */ new Set();
+  const unique = [];
+  for (const diagnostic of diagnostics) {
+    const key = `${diagnostic.code} ${diagnostic.subject ?? ""} ${diagnostic.layer === void 0 ? "" : String(diagnostic.layer)} ${diagnostic.message}`;
+    if (seen.has(key)) {
+      continue;
+    }
+    seen.add(key);
+    unique.push(diagnostic);
+  }
+  return unique;
+}
+
+// src/resolve/plan.ts
+import path2 from "node:path";
+function parentOf(rel) {
+  const index = rel.lastIndexOf("/");
+  return index === -1 ? "" : rel.slice(0, index);
+}
+function buildChildIndex(facts) {
+  const children = /* @__PURE__ */ new Map();
+  for (const rel of facts.entries.keys()) {
+    const parent = parentOf(rel);
+    const bucket = children.get(parent);
+    if (bucket === void 0) {
+      children.set(parent, [rel]);
+    } else {
+      bucket.push(rel);
+    }
+  }
+  for (const bucket of children.values()) {
+    bucket.sort();
+  }
+  return children;
+}
+function planFarm(params) {
+  const children = buildChildIndex(params.facts);
+  const entries = [];
+  const materialised = [];
+  const links = [];
+  const conditionalPatterns = [...params.flattened.rules.values()].filter((rule) => rule.when !== void 0).map((rule) => rule.canonicalPattern);
+  const conditionalRuleCouldReach = (dir) => conditionalPatterns.some((pattern) => patternCouldReachUnder(pattern, dir));
+  const subtreeDecision = (rel) => {
+    const own = params.decisions.get(rel);
+    let value = own?.shared;
+    const stack = [...children.get(rel) ?? []];
+    while (stack.length > 0) {
+      const next = stack.pop();
+      if (next === void 0) {
+        continue;
+      }
+      const decision = params.decisions.get(next);
+      if (decision === void 0) {
+        continue;
+      }
+      if (value === void 0) {
+        value = decision.shared;
+      } else if (decision.shared !== value) {
+        return void 0;
+      }
+      stack.push(...children.get(next) ?? []);
+    }
+    return value;
+  };
+  const linkTarget = (rel) => path2.join(params.facts.claudeHome, rel);
+  const visit = (rel) => {
+    const fact = params.facts.entries.get(rel);
+    const decision = params.decisions.get(rel);
+    if (fact === void 0) {
+      return;
+    }
+    if (!fact.isDirectory) {
+      if (decision?.shared === true) {
+        entries.push({ kind: "link", rel, target: linkTarget(rel) });
+        links.push({ rel, target: linkTarget(rel) });
+      } else {
+        entries.push({ kind: "omit", rel });
+      }
+      return;
+    }
+    if (conditionalRuleCouldReach(rel)) {
+      entries.push({ kind: "materialise", rel, reason: "conditional-rule" });
+      materialised.push(rel);
+      for (const child of children.get(rel) ?? []) {
+        visit(child);
+      }
+      return;
+    }
+    const uniform = subtreeDecision(rel);
+    if (uniform === true) {
+      entries.push({ kind: "link", rel, target: linkTarget(rel) });
+      links.push({ rel, target: linkTarget(rel) });
+      return;
+    }
+    if (uniform === false) {
+      entries.push({ kind: "omit", rel });
+      return;
+    }
+    entries.push({ kind: "materialise", rel, reason: "split-decision" });
+    materialised.push(rel);
+    for (const child of children.get(rel) ?? []) {
+      visit(child);
+    }
+  };
+  for (const rel of children.get("") ?? []) {
+    visit(rel);
+  }
+  return { entries, materialised, links };
+}
+
+// src/resolve/extends.ts
+function lineariseProfile(rootName, load) {
+  const stack = [];
+  const visited = /* @__PURE__ */ new Set();
+  const order = [];
+  const diagnostics = [];
+  const visit = (name) => {
+    if (stack.includes(name)) {
+      diagnostics.push({
+        code: "EXTENDS_CYCLE",
+        severity: "error",
+        message: `Circular profile extends: ${[...stack, name].join(" -> ")}. The cycle is broken here and "${name}" is not applied twice.`,
+        subject: name
+      });
+      return;
+    }
+    if (visited.has(name)) {
+      return;
+    }
+    const source = load(name);
+    if (source === void 0) {
+      diagnostics.push({
+        code: "MISSING_PROFILE",
+        severity: "error",
+        message: `Configuration profile "${name}" does not exist.`,
+        subject: name
+      });
+      visited.add(name);
+      return;
+    }
+    stack.push(name);
+    for (const dependency of source.profile.extends ?? []) {
+      visit(dependency);
+    }
+    stack.pop();
+    visited.add(name);
+    order.push(name);
+  };
+  visit(rootName);
+  return { order, diagnostics };
+}
+function profileLayers(rootName, load, startId) {
+  const { order, diagnostics } = lineariseProfile(rootName, load);
+  const layers = [];
+  let nextId = startId;
+  for (const name of order) {
+    const source = load(name);
+    if (source === void 0) {
+      continue;
+    }
+    layers.push({
+      id: nextId,
+      kind: "config-profile",
+      source: source.filepath ?? name,
+      ...source.profile.categories === void 0 ? {} : { categories: source.profile.categories },
+      ...source.profile.entries === void 0 ? {} : { entries: source.profile.entries },
+      ...source.entryOrder === void 0 ? {} : { entryOrder: source.entryOrder },
+      ...source.profile.launch === void 0 ? {} : { launch: source.profile.launch }
+    });
+    nextId += 1;
+  }
+  return { layers, nextId, diagnostics };
+}
+
+// src/resolve/walk.ts
+function assembleCascade(input) {
+  const layers = [];
+  const diagnostics = [];
+  let nextId = 0;
+  let identityPin;
+  let directoryConfigProfile;
+  if (input.globalConfig !== void 0) {
+    const { config, entryOrder, filepath } = input.globalConfig;
+    layers.push({
+      id: nextId,
+      kind: "global-config",
+      source: filepath,
+      ...config.categories === void 0 ? {} : { categories: config.categories },
+      ...config.entries === void 0 ? {} : { entries: config.entries },
+      ...entryOrder === void 0 ? {} : { entryOrder },
+      ...config.launch === void 0 ? {} : { launch: config.launch }
+    });
+    nextId += 1;
+  }
+  if (input.baseConfigProfile !== void 0) {
+    const resolved = profileLayers(input.baseConfigProfile, input.loadProfile, nextId);
+    layers.push(...resolved.layers);
+    diagnostics.push(...resolved.diagnostics);
+    nextId = resolved.nextId;
+  }
+  for (const level of input.levels ?? []) {
+    const sources = [];
+    if (level.portable !== void 0) {
+      sources.push({ kind: "portable", config: level.portable.config, ...level.portable.entryOrder === void 0 ? {} : { entryOrder: level.portable.entryOrder }, filepath: level.portable.filepath });
+    }
+    for (const entry of level.rules ?? []) {
+      sources.push({ kind: "directory-rule", config: entry.rule, ...entry.entryOrder === void 0 ? {} : { entryOrder: entry.entryOrder }, filepath: entry.filepath });
+    }
+    if (level.portableLocal !== void 0) {
+      sources.push({ kind: "portable-local", config: level.portableLocal.config, ...level.portableLocal.entryOrder === void 0 ? {} : { entryOrder: level.portableLocal.entryOrder }, filepath: level.portableLocal.filepath });
+    }
+    for (const source of sources) {
+      if (source.config.identity !== void 0) {
+        identityPin = source.config.identity;
+      }
+      if (source.config.configProfile !== void 0) {
+        directoryConfigProfile = source.config.configProfile;
+        const resolved = profileLayers(source.config.configProfile, input.loadProfile, nextId);
+        layers.push(...resolved.layers);
+        diagnostics.push(...resolved.diagnostics);
+        nextId = resolved.nextId;
+      }
+      layers.push({
+        id: nextId,
+        kind: source.kind,
+        source: source.filepath,
+        ...source.config.categories === void 0 ? {} : { categories: source.config.categories },
+        ...source.config.entries === void 0 ? {} : { entries: source.config.entries },
+        ...source.entryOrder === void 0 ? {} : { entryOrder: source.entryOrder },
+        ...source.config.launch === void 0 ? {} : { launch: source.config.launch }
+      });
+      nextId += 1;
+    }
+  }
+  if (input.cliOverride !== void 0) {
+    layers.push({
+      id: nextId,
+      kind: "cli-override",
+      source: "command line",
+      ...input.cliOverride.categories === void 0 ? {} : { categories: input.cliOverride.categories },
+      ...input.cliOverride.entries === void 0 ? {} : { entries: input.cliOverride.entries },
+      ...input.cliOverride.entryOrder === void 0 ? {} : { entryOrder: input.cliOverride.entryOrder },
+      ...input.cliOverride.launch === void 0 ? {} : { launch: input.cliOverride.launch }
+    });
+  }
+  return {
+    layers,
+    diagnostics,
+    ...identityPin === void 0 ? {} : { identityPin },
+    ...directoryConfigProfile === void 0 ? {} : { directoryConfigProfile }
+  };
+}
+
+// src/resolve/pipeline.ts
+function topLevelNames(facts) {
+  const names = /* @__PURE__ */ new Set();
+  for (const rel of facts.entries.keys()) {
+    const head = rel.split("/")[0];
+    if (head !== void 0 && head !== "") {
+      names.add(head);
+    }
+  }
+  return [...names].sort();
+}
+function resolveDecisions(input) {
+  const assembled = assembleCascade(input.cascade);
+  const flattened = flattenLayers(assembled.layers, { home: input.facts.home });
+  const classification = classifyEntries(topLevelNames(input.facts), {
+    defaults: input.classification.defaults,
+    ...input.classification.overlay === void 0 ? {} : { overlay: input.classification.overlay }
+  });
+  const resolved = resolveAll({
+    flattened,
+    facts: input.facts,
+    classification: classification.classification
+  });
+  const farm = planFarm({ facts: input.facts, decisions: resolved.decisions, flattened });
+  return {
+    assembled,
+    flattened,
+    classification,
+    decisions: resolved.decisions,
+    farm,
+    diagnostics: [...assembled.diagnostics, ...resolved.diagnostics]
+  };
+}
+
+// src/launcher/farm.ts
+import path4 from "node:path";
+import { z as z2 } from "zod";
+
+// src/resolve/reconcile.ts
+function parentOf2(rel) {
+  const index = rel.lastIndexOf("/");
+  return index === -1 ? "" : rel.slice(0, index);
+}
+function indexByParent(listing) {
+  const children = /* @__PURE__ */ new Map();
+  for (const entry of listing) {
+    const parent = parentOf2(entry.rel);
+    const bucket = children.get(parent);
+    if (bucket === void 0) {
+      children.set(parent, [entry]);
+    } else {
+      bucket.push(entry);
+    }
+  }
+  for (const bucket of children.values()) {
+    bucket.sort((a, b) => a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0);
+  }
+  return children;
+}
+function planReconciliation(params) {
+  const conservative = params.manifest === void 0;
+  const diagnostics = [];
+  const actions = [];
+  const farmChildren = indexByParent(params.farmListing);
+  const canonicalByRel = new Map(params.canonicalListing.map((entry) => [entry.rel, entry]));
+  const materialised = /* @__PURE__ */ new Set([""]);
+  if (params.manifest !== void 0) {
+    for (const rel of params.manifest.materialised) {
+      materialised.add(rel);
+    }
+  } else {
+    for (const entry of params.farmListing) {
+      if (entry.kind === "dir") {
+        materialised.add(entry.rel);
+      }
+    }
+    diagnostics.push({
+      code: "FARM_MANIFEST_MISSING",
+      severity: "warning",
+      message: "The previous farm's manifest is missing or unreadable, so there is no record of which directories the farm built itself. Every real directory in the farm was treated as materialised and every real child examined for adoption. This over-adopts rather than risking data Claude Code wrote being discarded."
+    });
+  }
+  const visit = (dir) => {
+    for (const child of farmChildren.get(dir) ?? []) {
+      if (child.kind === "symlink") {
+        actions.push({ kind: "skip", rel: child.rel, reason: "is-symlink" });
+        continue;
+      }
+      if (child.kind === "dir" && materialised.has(child.rel)) {
+        actions.push({ kind: "skip", rel: child.rel, reason: "tracked-materialised-dir" });
+        visit(child.rel);
+        continue;
+      }
+      if (child.kind === "dir") {
+        const grandchildren = farmChildren.get(child.rel) ?? [];
+        if (grandchildren.length === 0) {
+          if (canonicalByRel.has(child.rel)) {
+            actions.push({ kind: "skip", rel: child.rel, reason: "identical-content" });
+          } else {
+            actions.push({ kind: "adopt", rel: child.rel, reason: "absent-from-canonical" });
+          }
+          continue;
+        }
+        visit(child.rel);
+        continue;
+      }
+      const canonical = canonicalByRel.get(child.rel);
+      if (canonical === void 0) {
+        actions.push({ kind: "adopt", rel: child.rel, reason: "absent-from-canonical" });
+        continue;
+      }
+      if (canonical.contentHash !== void 0 && canonical.contentHash === child.contentHash) {
+        actions.push({ kind: "skip", rel: child.rel, reason: "identical-content" });
+        continue;
+      }
+      actions.push({ kind: "adopt-conflict", rel: child.rel });
+      diagnostics.push({
+        code: "RECONCILE_CONFLICT",
+        severity: "warning",
+        message: `"${child.rel}" exists both in the farm and in the canonical ~/.claude with different content. The canonical copy is left authoritative and the farm's copy is preserved alongside it rather than either being discarded.`,
+        subject: child.rel
+      });
+    }
+  };
+  visit("");
+  return { actions, diagnostics, conservative };
+}
+
+// src/legacy.ts
+var LEGACY_FARM_MANIFEST_FILENAME = ".claude-use-farm.json";
+
+// src/launcher/lock.ts
+import { randomUUID } from "node:crypto";
+import path3 from "node:path";
+var DEFAULT_STALE_AFTER_MS = 12e4;
+var DEFAULT_RETRY_DELAY_MS = 50;
+var DEFAULT_MAX_ATTEMPTS = 200;
+var IdentityLockBusyError = class extends CliError {
+  constructor(identity, lockPath, holderPid) {
+    super(
+      `Another agent-shim resync is already running for identity "${identity}"` + (holderPid === void 0 ? "" : ` (pid ${String(holderPid)})`) + `. Its lock at ${lockPath} was still held after the full retry budget; nothing was changed.`
+    );
+    this.identity = identity;
+    this.lockPath = lockPath;
+    this.holderPid = holderPid;
+    this.name = "IdentityLockBusyError";
+  }
+  identity;
+  lockPath;
+  holderPid;
+};
+function identityLockPath(dir, identity) {
+  return path3.join(dir, `.${identity}.lock`);
+}
+function parseLockRecord(raw) {
+  if (raw === void 0) {
+    return void 0;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return void 0;
+  }
+  if (typeof parsed !== "object" || parsed === null) {
+    return void 0;
+  }
+  if (!("identity" in parsed) || !("pid" in parsed) || !("token" in parsed) || !("acquiredAtMs" in parsed)) {
+    return void 0;
+  }
+  const { identity, pid, token, acquiredAtMs } = parsed;
+  if (typeof identity !== "string" || typeof pid !== "number" || typeof token !== "string" || typeof acquiredAtMs !== "number") {
+    return void 0;
+  }
+  return { identity, pid, token, acquiredAtMs };
+}
+function acquireIdentityLock(params) {
+  const lockPath = identityLockPath(params.dir, params.identity);
+  const staleAfterMs = params.staleAfterMs ?? DEFAULT_STALE_AFTER_MS;
+  const retryDelayMs = params.retryDelayMs ?? DEFAULT_RETRY_DELAY_MS;
+  const maxAttempts = params.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
+  const token = randomUUID();
+  if (params.fs.lstat(params.dir) === void 0) {
+    params.fs.mkdirp(params.dir);
+  }
+  let lastHolderPid;
+  for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+    const record = { identity: params.identity, pid: params.pid, token, acquiredAtMs: params.nowMs() };
+    if (params.fs.writeFileExclusive(lockPath, `${JSON.stringify(record)}
+`)) {
+      return {
+        path: lockPath,
+        token,
+        release: () => {
+          const current = parseLockRecord(params.fs.readFileUtf8(lockPath));
+          if (current !== void 0 && current.token !== token) {
+            return;
+          }
+          params.fs.removeRecursive(lockPath);
+        }
+      };
+    }
+    const existing = parseLockRecord(params.fs.readFileUtf8(lockPath));
+    if (existing === void 0) {
+      params.fs.removeRecursive(lockPath);
+      continue;
+    }
+    lastHolderPid = existing.pid;
+    const expired = params.nowMs() - existing.acquiredAtMs > staleAfterMs;
+    if (expired || !params.isRunning(existing.pid)) {
+      params.fs.removeRecursive(lockPath);
+      continue;
+    }
+    params.sleep(retryDelayMs);
+  }
+  throw new IdentityLockBusyError(params.identity, lockPath, lastHolderPid);
+}
+
+// src/launcher/farm.ts
+var FARM_MANIFEST_FILENAME = ".agent-shim-farm.json";
+var FarmManifestSchema = z2.strictObject({
+  version: z2.literal(1),
+  builtAtMs: z2.number(),
+  identity: z2.string(),
+  configProfile: z2.string().optional(),
+  cwd: z2.string(),
+  claudeHome: z2.string(),
+  materialised: z2.array(z2.string()),
+  links: z2.array(z2.strictObject({ rel: z2.string(), target: z2.string() }))
+});
+function readFarmManifest(fs2, farmRoot) {
+  const raw = fs2.readFileUtf8(path4.join(farmRoot, FARM_MANIFEST_FILENAME)) ?? fs2.readFileUtf8(path4.join(farmRoot, LEGACY_FARM_MANIFEST_FILENAME));
+  if (raw === void 0) {
+    return void 0;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return void 0;
+  }
+  const result = FarmManifestSchema.safeParse(parsed);
+  return result.success ? result.data : void 0;
+}
+function buildEntryFacts(params) {
+  const entries = /* @__PURE__ */ new Map();
+  const visit = (rel) => {
+    const absolute = path4.join(params.claudeHome, rel);
+    const stat = params.fs.lstat(absolute);
+    if (stat === void 0) {
+      return void 0;
+    }
+    const isDirectory = stat.kind === "dir";
+    let latestMtimeMs = stat.mtimeMs;
+    let totalSizeBytes = stat.sizeBytes;
+    if (isDirectory) {
+      for (const name of [...params.fs.readdir(absolute)].sort()) {
+        const child = visit(`${rel}/${name}`);
+        if (child !== void 0) {
+          latestMtimeMs = Math.max(latestMtimeMs, child.latestMtimeMs);
+          totalSizeBytes += child.totalSizeBytes;
+        }
+      }
+    }
+    entries.set(rel, {
+      relPath: rel,
+      isDirectory,
+      isSymlink: stat.kind === "symlink",
+      mtimeMs: stat.mtimeMs,
+      latestMtimeMs,
+      sizeBytes: stat.sizeBytes,
+      totalSizeBytes
+    });
+    return { latestMtimeMs, totalSizeBytes };
+  };
+  for (const name of [...params.fs.readdir(params.claudeHome)].sort()) {
+    visit(name);
+  }
+  return {
+    nowMs: params.nowMs,
+    home: params.home,
+    claudeHome: params.claudeHome,
+    cwd: params.cwd,
+    ...params.branch === void 0 ? {} : { branch: params.branch },
+    ...params.branchDetached === void 0 ? {} : { branchDetached: params.branchDetached },
+    env: params.env,
+    entries
+  };
+}
+function listSubtree(fs2, root, rel) {
+  const absolute = path4.join(root, rel);
+  const stat = fs2.lstat(absolute);
+  if (stat === void 0) {
+    return [];
+  }
+  if (stat.kind === "symlink") {
+    return [{ rel, kind: "symlink" }];
+  }
+  if (stat.kind === "dir") {
+    const children = [...fs2.readdir(absolute)].sort().flatMap((name) => listSubtree(fs2, root, `${rel}/${name}`));
+    return [{ rel, kind: "dir" }, ...children];
+  }
+  const contentHash = fs2.hashFile(absolute);
+  return [{ rel, kind: "file", ...contentHash === void 0 ? {} : { contentHash } }];
+}
+function topLevelScopeRoots(roots) {
+  const sorted = [...new Set(roots)].sort();
+  const kept = [];
+  for (const root of sorted) {
+    if (kept.some((existing) => root === existing || root.startsWith(`${existing}/`))) {
+      continue;
+    }
+    kept.push(root);
+  }
+  return kept;
+}
+function reconciliationScope(fs2, farmRoot, manifest) {
+  if (manifest !== void 0) {
+    return topLevelScopeRoots(manifest.materialised);
+  }
+  return [...fs2.readdir(farmRoot)].filter((name) => name !== FARM_MANIFEST_FILENAME && name !== LEGACY_FARM_MANIFEST_FILENAME && fs2.lstat(path4.join(farmRoot, name))?.kind === "dir").sort();
+}
+function collectFarmListing(fs2, farmRoot, scopeRoots) {
+  return scopeRoots.flatMap((root) => listSubtree(fs2, farmRoot, root));
+}
+function collectCanonicalCounterparts(fs2, claudeHome, farmListing) {
+  const out = [];
+  for (const entry of farmListing) {
+    const absolute = path4.join(claudeHome, entry.rel);
+    const stat = fs2.lstat(absolute);
+    if (stat === void 0) {
+      continue;
+    }
+    if (stat.kind === "file") {
+      const contentHash = fs2.hashFile(absolute);
+      out.push({ rel: entry.rel, kind: "file", ...contentHash === void 0 ? {} : { contentHash } });
+      continue;
+    }
+    out.push({ rel: entry.rel, kind: stat.kind });
+  }
+  return out;
+}
+function carryOver(params) {
+  const manifest = readFarmManifest(params.fs, params.previousRoot);
+  const accounted = /* @__PURE__ */ new Set([FARM_MANIFEST_FILENAME, LEGACY_FARM_MANIFEST_FILENAME]);
+  for (const rel of manifest?.materialised ?? []) {
+    const head = rel.split("/")[0];
+    if (head !== void 0 && head !== "") {
+      accounted.add(head);
+    }
+  }
+  const carried = [];
+  const autoResolved = [];
+  const collided = [];
+  for (const name of [...params.fs.readdir(params.previousRoot)].sort()) {
+    if (accounted.has(name)) {
+      continue;
+    }
+    const stat = params.fs.lstat(path4.join(params.previousRoot, name));
+    if (stat === void 0 || stat.kind === "symlink") {
+      continue;
+    }
+    if (params.fs.lstat(path4.join(params.farmRoot, name)) !== void 0) {
+      const category = params.classification === void 0 ? void 0 : classifyEntries([name], params.classification).classification.get(name);
+      if (category === "runtime") {
+        params.fs.removeRecursive(path4.join(params.previousRoot, name));
+        autoResolved.push(name);
+        continue;
+      }
+      collided.push(name);
+      continue;
+    }
+    params.fs.rename(path4.join(params.previousRoot, name), path4.join(params.farmRoot, name));
+    carried.push(name);
+  }
+  return { carried, autoResolved, collided };
+}
+function buildScratchTree(params) {
+  params.fs.mkdirp(params.scratchRoot);
+  for (const entry of params.plan.entries) {
+    const absolute = path4.join(params.scratchRoot, entry.rel);
+    if (entry.kind === "link") {
+      params.fs.mkdirp(path4.dirname(absolute));
+      params.fs.symlink(entry.target, absolute);
+      continue;
+    }
+    if (entry.kind === "materialise") {
+      params.fs.mkdirp(absolute);
+    }
+  }
+  params.fs.writeFileUtf8(
+    path4.join(params.scratchRoot, FARM_MANIFEST_FILENAME),
+    `${JSON.stringify(params.manifest, null, 2)}
+`
+  );
+}
+function swapIn(params) {
+  if (params.fs.lstat(params.farmRoot) === void 0) {
+    params.fs.mkdirp(path4.dirname(params.farmRoot));
+    params.fs.rename(params.scratchRoot, params.farmRoot);
+    return { carried: [], autoResolved: [], collided: [] };
+  }
+  params.fs.rename(params.farmRoot, params.previousRoot);
+  params.fs.rename(params.scratchRoot, params.farmRoot);
+  const result = carryOver({
+    fs: params.fs,
+    previousRoot: params.previousRoot,
+    farmRoot: params.farmRoot,
+    ...params.classification === void 0 ? {} : { classification: params.classification }
+  });
+  if (result.collided.length === 0) {
+    params.fs.removeRecursive(params.previousRoot);
+    return result;
+  }
+  return { ...result, retainedPrevious: params.previousRoot };
+}
+function recoverInterruptedSwap(params) {
+  const scratchPrefix = `.${params.identity}.scratch.`;
+  const previousPrefix = `.${params.identity}.previous.`;
+  const names = [...params.fs.readdir(params.identitiesDir)].sort();
+  const removedScratch = [];
+  for (const name of names.filter((candidate) => candidate.startsWith(scratchPrefix))) {
+    params.fs.removeRecursive(path4.join(params.identitiesDir, name));
+    removedScratch.push(name);
+  }
+  let previous = names.filter((candidate) => candidate.startsWith(previousPrefix));
+  let restoredFrom;
+  const first = previous[0];
+  if (first !== void 0 && params.fs.lstat(params.farmRoot) === void 0) {
+    params.fs.rename(path4.join(params.identitiesDir, first), params.farmRoot);
+    restoredFrom = first;
+    previous = previous.slice(1);
+  }
+  const completed = [];
+  const autoResolved = [];
+  const retained = [];
+  for (const name of previous) {
+    const previousRoot = path4.join(params.identitiesDir, name);
+    const result = carryOver({
+      fs: params.fs,
+      previousRoot,
+      farmRoot: params.farmRoot,
+      ...params.classification === void 0 ? {} : { classification: params.classification }
+    });
+    autoResolved.push(...result.autoResolved);
+    if (result.collided.length === 0) {
+      params.fs.removeRecursive(previousRoot);
+      completed.push(name);
+      continue;
+    }
+    retained.push(previousRoot);
+  }
+  return {
+    removedScratch,
+    ...restoredFrom === void 0 ? {} : { restoredFrom },
+    completed,
+    autoResolved,
+    retained,
+    recovered: removedScratch.length > 0 || restoredFrom !== void 0 || completed.length > 0 || autoResolved.length > 0 || retained.length > 0
+  };
+}
+function recoverFarm(params) {
+  const farmRoot = path4.join(params.identitiesDir, params.identity);
+  const lock = acquireIdentityLock({
+    identity: params.identity,
+    dir: params.identitiesDir,
+    fs: params.fs,
+    nowMs: params.now,
+    pid: params.lock.pid,
+    isRunning: params.lock.isRunning,
+    sleep: params.lock.sleep,
+    ...params.lock.staleAfterMs === void 0 ? {} : { staleAfterMs: params.lock.staleAfterMs },
+    ...params.lock.retryDelayMs === void 0 ? {} : { retryDelayMs: params.lock.retryDelayMs },
+    ...params.lock.maxAttempts === void 0 ? {} : { maxAttempts: params.lock.maxAttempts }
+  });
+  try {
+    return recoverInterruptedSwap({
+      fs: params.fs,
+      identitiesDir: params.identitiesDir,
+      identity: params.identity,
+      farmRoot,
+      ...params.classification === void 0 ? {} : { classification: params.classification }
+    });
+  } finally {
+    lock.release();
+  }
+}
+function executeReconciliation(params) {
+  const heads = /* @__PURE__ */ new Set();
+  for (const action of params.actions) {
+    if (action.kind === "skip") {
+      continue;
+    }
+    const head = action.rel.split("/")[0];
+    if (head !== void 0 && head !== "") {
+      heads.add(head);
+    }
+  }
+  const classified = classifyEntries([...heads], {
+    defaults: params.classification.defaults,
+    ...params.classification.overlay === void 0 ? {} : { overlay: params.classification.overlay }
+  });
+  const adopted = [];
+  const conflicts = [];
+  const blocked = [];
+  const diagnostics = [];
+  for (const action of params.actions) {
+    if (action.kind === "skip") {
+      continue;
+    }
+    const head = action.rel.split("/")[0] ?? "";
+    if (classified.classification.get(head) === "secret") {
+      blocked.push(action.rel);
+      diagnostics.push({
+        code: "RECONCILE_SECRET_BLOCKED",
+        severity: "warning",
+        message: `"${action.rel}" was found in the farm but was not copied into ~/.claude: its top-level entry "${head}" is classified secret, and no configuration layer or reconciliation pass may move data across that floor.`,
+        subject: action.rel
+      });
+      continue;
+    }
+    const from = path4.join(params.farmRoot, action.rel);
+    const canonical = path4.join(params.claudeHome, action.rel);
+    if (action.kind === "adopt") {
+      params.fs.mkdirp(path4.dirname(canonical));
+      params.fs.copyRecursive(from, canonical);
+      adopted.push(action.rel);
+      continue;
+    }
+    const preserved = `${canonical}.farm-conflict-${String(params.nowMs)}`;
+    params.fs.mkdirp(path4.dirname(canonical));
+    params.fs.copyRecursive(from, preserved);
+    conflicts.push(action.rel);
+  }
+  return { adopted, conflicts, blocked, diagnostics };
+}
+function sameLinks(a, b) {
+  if (a.length !== b.length) {
+    return false;
+  }
+  return a.every((link, index) => {
+    const other = b[index];
+    if (other === void 0) {
+      return false;
+    }
+    return other.rel === link.rel && other.target === link.target;
+  });
+}
+function sameStrings(a, b) {
+  return a.length === b.length && a.every((value, index) => b[index] === value);
+}
+function farmAlreadyMatches(existing, next) {
+  return existing.identity === next.identity && existing.claudeHome === next.claudeHome && sameStrings(existing.materialised, next.materialised) && sameLinks(existing.links, next.links);
+}
+function resyncFarm(params) {
+  const farmRoot = path4.join(params.identitiesDir, params.identity);
+  const lock = acquireIdentityLock({
+    identity: params.identity,
+    dir: params.identitiesDir,
+    fs: params.fs,
+    nowMs: params.now,
+    pid: params.lock.pid,
+    isRunning: params.lock.isRunning,
+    sleep: params.lock.sleep,
+    ...params.lock.staleAfterMs === void 0 ? {} : { staleAfterMs: params.lock.staleAfterMs },
+    ...params.lock.retryDelayMs === void 0 ? {} : { retryDelayMs: params.lock.retryDelayMs },
+    ...params.lock.maxAttempts === void 0 ? {} : { maxAttempts: params.lock.maxAttempts }
+  });
+  try {
+    const recovery = recoverInterruptedSwap({
+      fs: params.fs,
+      identitiesDir: params.identitiesDir,
+      identity: params.identity,
+      farmRoot,
+      classification: params.classification
+    });
+    const previousManifest = readFarmManifest(params.fs, farmRoot);
+    const scope = reconciliationScope(params.fs, farmRoot, previousManifest);
+    const farmListing = collectFarmListing(params.fs, farmRoot, scope);
+    const canonicalListing = collectCanonicalCounterparts(params.fs, params.claudeHome, farmListing);
+    const reconciliation = scope.length === 0 ? { actions: [], diagnostics: [], conservative: false } : planReconciliation({
+      ...previousManifest === void 0 ? {} : { manifest: previousManifest },
+      farmListing,
+      canonicalListing
+    });
+    const nowMs = params.now();
+    const outcome = executeReconciliation({
+      fs: params.fs,
+      farmRoot,
+      claudeHome: params.claudeHome,
+      actions: reconciliation.actions,
+      nowMs,
+      classification: params.classification
+    });
+    const facts = buildEntryFacts({
+      fs: params.fs,
+      claudeHome: params.claudeHome,
+      home: params.home,
+      cwd: params.cwd,
+      nowMs,
+      env: params.env,
+      ...params.branch === void 0 ? {} : { branch: params.branch },
+      ...params.branchDetached === void 0 ? {} : { branchDetached: params.branchDetached }
+    });
+    const resolved = resolveDecisions({ facts, cascade: params.cascade, classification: params.classification });
+    const manifest = {
+      version: 1,
+      builtAtMs: nowMs,
+      identity: params.identity,
+      ...params.configProfile === void 0 ? {} : { configProfile: params.configProfile },
+      cwd: params.cwd,
+      claudeHome: params.claudeHome,
+      materialised: resolved.farm.materialised,
+      links: resolved.farm.links
+    };
+    const diagnostics = [
+      ...resolved.diagnostics,
+      ...reconciliation.diagnostics,
+      ...outcome.diagnostics,
+      ...recoveryDiagnostics(recovery, params.identity)
+    ];
+    const farmExists = params.fs.lstat(farmRoot) !== void 0;
+    const nothingAdopted = outcome.adopted.length === 0 && outcome.conflicts.length === 0;
+    if (farmExists && !recovery.recovered && nothingAdopted && previousManifest !== void 0 && farmAlreadyMatches(previousManifest, manifest)) {
+      return {
+        farmRoot,
+        noOp: true,
+        manifest: previousManifest,
+        resolved,
+        adopted: outcome.adopted,
+        recovery,
+        diagnostics
+      };
+    }
+    const scratchRoot = path4.join(params.identitiesDir, `.${params.identity}.scratch.${params.uniqueSuffix}`);
+    const previousRoot = path4.join(params.identitiesDir, `.${params.identity}.previous.${params.uniqueSuffix}`);
+    buildScratchTree({ fs: params.fs, scratchRoot, plan: resolved.farm, manifest });
+    const swap = swapIn({ fs: params.fs, farmRoot, scratchRoot, previousRoot, classification: params.classification });
+    if (swap.retainedPrevious !== void 0) {
+      diagnostics.push({
+        code: "FARM_PREVIOUS_RETAINED",
+        severity: "warning",
+        message: `The superseded farm was left at ${swap.retainedPrevious} because it still holds ${swap.collided.join(", ")}, which the new farm has its own entry for. Nothing was overwritten in either direction; run \`agent-shim identity resolve-conflicts ${params.identity}\` to resolve it interactively.`,
+        subject: swap.retainedPrevious
+      });
+    }
+    return {
+      farmRoot,
+      noOp: false,
+      manifest,
+      resolved,
+      adopted: outcome.adopted,
+      recovery,
+      diagnostics,
+      ...swap.retainedPrevious === void 0 ? {} : { retainedPrevious: swap.retainedPrevious }
+    };
+  } finally {
+    lock.release();
+  }
+}
+function recoveryDiagnostics(recovery, identity) {
+  if (!recovery.recovered) {
+    return [];
+  }
+  const parts = [];
+  if (recovery.removedScratch.length > 0) {
+    parts.push(`removed ${String(recovery.removedScratch.length)} abandoned scratch tree(s)`);
+  }
+  if (recovery.restoredFrom !== void 0) {
+    parts.push(`restored the farm from ${recovery.restoredFrom}, which a previous launch was killed mid-swap`);
+  }
+  if (recovery.completed.length > 0) {
+    parts.push(`finished carrying local state out of ${String(recovery.completed.length)} superseded farm(s)`);
+  }
+  if (recovery.autoResolved.length > 0) {
+    parts.push(`discarded ${String(recovery.autoResolved.length)} superseded runtime entr${recovery.autoResolved.length === 1 ? "y" : "ies"} (${recovery.autoResolved.join(", ")}) \u2014 disposable per-machine state, safe to drop without asking`);
+  }
+  if (recovery.retained.length > 0) {
+    parts.push(
+      `kept ${recovery.retained.join(", ")}, which still holds data the current farm also has an entry for \u2014 run \`agent-shim identity resolve-conflicts ${identity}\` to resolve it interactively`
+    );
+  }
+  return [
+    {
+      code: "FARM_SWAP_RECOVERED",
+      severity: "warning",
+      message: `A previous launch left this identity's farm mid-swap. This launch ${parts.join("; ")}.`
+    }
+  ];
+}
+
+// src/frontdoor/connect.ts
+import { X509Certificate as X509Certificate2, createPrivateKey as createPrivateKey2 } from "node:crypto";
+import * as fs from "node:fs";
+import * as http from "node:http";
+import * as https from "node:https";
+import * as net2 from "node:net";
+import * as tls from "node:tls";
+
+// src/frontdoor/x509.ts
+import { createHash, createPrivateKey, generateKeyPairSync, randomBytes, sign, X509Certificate } from "node:crypto";
+import net from "node:net";
+var TAG_BOOLEAN = 1;
+var TAG_INTEGER = 2;
+var TAG_BIT_STRING = 3;
+var TAG_OCTET_STRING = 4;
+var TAG_NULL = 5;
+var TAG_OID = 6;
+var TAG_UTF8_STRING = 12;
+var TAG_UTC_TIME = 23;
+var TAG_GENERALIZED_TIME = 24;
+var TAG_SEQUENCE = 48;
+var TAG_SET = 49;
+var TAG_VERSION = 160;
+var TAG_EXTENSIONS = 163;
+var TAG_GENERAL_NAME_DNS = 130;
+var TAG_GENERAL_NAME_IP = 135;
+var TAG_KEY_IDENTIFIER = 128;
+var OID_COMMON_NAME = "2.5.4.3";
+var OID_SHA256_WITH_RSA = "1.2.840.113549.1.1.11";
+var OID_SUBJECT_KEY_IDENTIFIER = "2.5.29.14";
+var OID_KEY_USAGE = "2.5.29.15";
+var OID_SUBJECT_ALT_NAME = "2.5.29.17";
+var OID_BASIC_CONSTRAINTS = "2.5.29.19";
+var OID_AUTHORITY_KEY_IDENTIFIER = "2.5.29.35";
+var OID_EXT_KEY_USAGE = "2.5.29.37";
+var OID_SERVER_AUTH = "1.3.6.1.5.5.7.3.1";
+var VERSION_3 = 2;
+var SERIAL_NUMBER_BYTES = 16;
+var RSA_MODULUS_BITS = 2048;
+var BITS_PER_BYTE = 8;
+var BYTE_MASK = 255;
+var HIGH_BIT = 128;
+var BASE_128_PAYLOAD_MASK = 127;
+var FIRST_ARC_WEIGHT = 40;
+var SHORT_FORM_MAX_LENGTH = 127;
+var MS_PER_SECOND = 1e3;
+var UTC_TIME_LAST_YEAR = 2049;
+var YEAR_DIGITS = 4;
+var TWO_DIGIT_YEAR_DIGITS = 2;
+var COMPACT_TIME_DIGITS = 14;
+var KEY_USAGE = { digitalSignature: 0, keyEncipherment: 2, keyCertSign: 5, cRLSign: 6 };
+function tlv(tag, content) {
+  const length = content.length;
+  if (length <= SHORT_FORM_MAX_LENGTH) {
+    return Buffer.concat([Buffer.from([tag, length]), content]);
+  }
+  const lengthBytes = [];
+  for (let remaining = length; remaining > 0; remaining = Math.floor(remaining / (BYTE_MASK + 1))) {
+    lengthBytes.unshift(remaining & BYTE_MASK);
+  }
+  return Buffer.concat([Buffer.from([tag, HIGH_BIT | lengthBytes.length, ...lengthBytes]), content]);
+}
+function sequence(...parts) {
+  return tlv(TAG_SEQUENCE, Buffer.concat(parts));
+}
+function unsignedInteger(magnitude) {
+  let start = 0;
+  while (start < magnitude.length - 1 && magnitude[start] === 0) {
+    start += 1;
+  }
+  const trimmed = magnitude.subarray(start);
+  const first = trimmed[0];
+  const padded = first !== void 0 && (first & HIGH_BIT) !== 0 ? Buffer.concat([Buffer.from([0]), trimmed]) : Buffer.from(trimmed);
+  return tlv(TAG_INTEGER, padded);
+}
+function smallInteger(value) {
+  return unsignedInteger(Buffer.from([value]));
+}
+function oid(dotted) {
+  const arcs = dotted.split(".").map(Number);
+  const [first, second, ...rest] = arcs;
+  if (first === void 0 || second === void 0 || arcs.some((arc) => !Number.isInteger(arc) || arc < 0)) {
+    throw new Error(`invalid object identifier ${dotted}`);
+  }
+  const encoded = [];
+  for (const arc of [first * FIRST_ARC_WEIGHT + second, ...rest]) {
+    const groups = [arc & BASE_128_PAYLOAD_MASK];
+    for (let remaining = Math.floor(arc / HIGH_BIT); remaining > 0; remaining = Math.floor(remaining / HIGH_BIT)) {
+      groups.unshift(remaining & BASE_128_PAYLOAD_MASK | HIGH_BIT);
+    }
+    encoded.push(...groups);
+  }
+  return tlv(TAG_OID, Buffer.from(encoded));
+}
+function boolean(value) {
+  return tlv(TAG_BOOLEAN, Buffer.from([value ? BYTE_MASK : 0]));
+}
+function octetString(content) {
+  return tlv(TAG_OCTET_STRING, content);
+}
+function wholeBitString(content) {
+  return tlv(TAG_BIT_STRING, Buffer.concat([Buffer.from([0]), content]));
+}
+function time(instant) {
+  const iso = new Date(Math.floor(instant.getTime() / MS_PER_SECOND) * MS_PER_SECOND).toISOString();
+  const compact = `${iso.replace(/[-:T]/g, "").slice(0, COMPACT_TIME_DIGITS)}Z`;
+  if (instant.getUTCFullYear() > UTC_TIME_LAST_YEAR) {
+    return tlv(TAG_GENERALIZED_TIME, Buffer.from(compact, "ascii"));
+  }
+  return tlv(TAG_UTC_TIME, Buffer.from(compact.slice(YEAR_DIGITS - TWO_DIGIT_YEAR_DIGITS), "ascii"));
+}
+function commonNameOnly(commonName) {
+  return sequence(tlv(TAG_SET, sequence(oid(OID_COMMON_NAME), tlv(TAG_UTF8_STRING, Buffer.from(commonName, "utf8")))));
+}
+var SIGNATURE_ALGORITHM = sequence(oid(OID_SHA256_WITH_RSA), tlv(TAG_NULL, Buffer.alloc(0)));
+function extension(extensionOid, critical, value) {
+  return sequence(oid(extensionOid), ...critical ? [boolean(true)] : [], octetString(value));
+}
+function keyUsageExtension(bits) {
+  const highest = Math.max(...bits);
+  const byteCount = Math.floor(highest / BITS_PER_BYTE) + 1;
+  const bytes = Buffer.alloc(byteCount);
+  for (const bit of bits) {
+    const index = Math.floor(bit / BITS_PER_BYTE);
+    bytes[index] = (bytes[index] ?? 0) | HIGH_BIT >> bit % BITS_PER_BYTE;
+  }
+  const unusedBits = BITS_PER_BYTE - 1 - highest % BITS_PER_BYTE;
+  return extension(OID_KEY_USAGE, true, tlv(TAG_BIT_STRING, Buffer.concat([Buffer.from([unusedBits]), bytes])));
+}
+var IPV6_GROUPS = 8;
+var HEX_RADIX = 16;
+var BYTES_PER_IPV6_GROUP = 2;
+function ipv6Groups(address) {
+  const [head = "", tail] = address.split("::");
+  const split = (text) => text === "" ? [] : text.split(":");
+  const expand = (groups) => groups.flatMap((group) => {
+    if (!net.isIPv4(group)) {
+      return [Number.parseInt(group, HEX_RADIX)];
+    }
+    const [a = 0, b = 0, c = 0, d = 0] = group.split(".").map(Number);
+    return [a * (BYTE_MASK + 1) + b, c * (BYTE_MASK + 1) + d];
+  });
+  const before = expand(split(head));
+  const after = tail === void 0 ? [] : expand(split(tail));
+  const filler = tail === void 0 ? [] : Array.from({ length: IPV6_GROUPS - before.length - after.length }, () => 0);
+  return [...before, ...filler, ...after];
+}
+function ipBytes(address) {
+  if (net.isIPv4(address)) {
+    return Buffer.from(address.split(".").map(Number));
+  }
+  if (!net.isIPv6(address)) {
+    throw new Error(`${address} is not an IP address`);
+  }
+  const bytes = Buffer.alloc(IPV6_GROUPS * BYTES_PER_IPV6_GROUP);
+  ipv6Groups(address).forEach((group, index) => {
+    bytes.writeUInt16BE(group, index * BYTES_PER_IPV6_GROUP);
+  });
+  return bytes;
+}
+function keyIdentifier(publicKey) {
+  return createHash("sha1").update(publicKey.export({ type: "pkcs1", format: "der" })).digest();
+}
+function readElement(buffer, offset) {
+  const tag = buffer[offset];
+  const first = buffer[offset + 1];
+  if (tag === void 0 || first === void 0) {
+    throw new Error("truncated DER");
+  }
+  let length = first;
+  let contentStart = offset + 2;
+  if ((first & HIGH_BIT) !== 0) {
+    const count = first & BASE_128_PAYLOAD_MASK;
+    length = 0;
+    for (let index = 0; index < count; index += 1) {
+      length = length * (BYTE_MASK + 1) + (buffer[offset + 2 + index] ?? 0);
+    }
+    contentStart = offset + 2 + count;
+  }
+  return { tag, start: offset, contentStart, end: contentStart + length };
+}
+function subjectNameOf(certificateDer) {
+  const certificate = readElement(certificateDer, 0);
+  let cursor = readElement(certificateDer, certificate.contentStart);
+  const tbsEnd = cursor.end;
+  cursor = readElement(certificateDer, cursor.contentStart);
+  if (cursor.tag === TAG_VERSION) {
+    cursor = readElement(certificateDer, cursor.end);
+  }
+  const fieldsBeforeSubject = 4;
+  for (let skipped = 1; skipped < fieldsBeforeSubject; skipped += 1) {
+    cursor = readElement(certificateDer, cursor.end);
+  }
+  const subject = readElement(certificateDer, cursor.end);
+  if (subject.end > tbsEnd) {
+    throw new Error("certificate has no subject");
+  }
+  return Buffer.from(certificateDer.subarray(subject.start, subject.end));
+}
+function toPem(label, der) {
+  const body = Buffer.from(der).toString("base64").match(/.{1,64}/g) ?? [];
+  return `-----BEGIN ${label}-----
+${body.join("\n")}
+-----END ${label}-----
+`;
+}
+function randomSerial() {
+  const bytes = randomBytes(SERIAL_NUMBER_BYTES);
+  bytes[0] = (bytes[0] ?? 0) & BASE_128_PAYLOAD_MASK | HIGH_BIT >> 1;
+  return bytes;
+}
+function assemble(spec) {
+  const tbs = sequence(
+    tlv(TAG_VERSION, smallInteger(VERSION_3)),
+    unsignedInteger(randomSerial()),
+    SIGNATURE_ALGORITHM,
+    spec.issuerName,
+    sequence(time(spec.notBefore), time(spec.notAfter)),
+    spec.subjectName,
+    spec.subjectPublicKey.export({ type: "spki", format: "der" }),
+    tlv(TAG_EXTENSIONS, sequence(...spec.extensions))
+  );
+  const signature = sign("sha256", tbs, spec.signingKey);
+  return sequence(tbs, SIGNATURE_ALGORITHM, wholeBitString(signature));
+}
+function subjectKeyIdentifierExtension(publicKey) {
+  return extension(OID_SUBJECT_KEY_IDENTIFIER, false, octetString(keyIdentifier(publicKey)));
+}
+function basicConstraintsExtension(isCa) {
+  return extension(OID_BASIC_CONSTRAINTS, true, sequence(...isCa ? [boolean(true)] : []));
+}
+function rsaKeyPair() {
+  return generateKeyPairSync("rsa", { modulusLength: RSA_MODULUS_BITS });
+}
+function keyPem(privateKey) {
+  return privateKey.export({ type: "pkcs8", format: "pem" });
+}
+function issueCaCertificate(commonName, notBefore, notAfter) {
+  const { publicKey, privateKey } = rsaKeyPair();
+  const name = commonNameOnly(commonName);
+  const der = assemble({
+    subjectPublicKey: publicKey,
+    subjectName: name,
+    issuerName: name,
+    signingKey: privateKey,
+    notBefore,
+    notAfter,
+    extensions: [basicConstraintsExtension(true), keyUsageExtension([KEY_USAGE.keyCertSign, KEY_USAGE.cRLSign]), subjectKeyIdentifierExtension(publicKey)]
+  });
+  return { certPem: toPem("CERTIFICATE", der), keyPem: keyPem(privateKey) };
+}
+function issueLeafCertificate(ca, names, notBefore, notAfter) {
+  const [commonName] = names;
+  if (commonName === void 0) {
+    throw new Error("a leaf certificate needs at least one name");
+  }
+  const caCertificate = new X509Certificate(ca.certPem);
+  const caPrivateKey = createPrivateKey(ca.keyPem);
+  const { publicKey, privateKey } = rsaKeyPair();
+  const generalNames = names.map((name) => net.isIP(name) === 0 ? tlv(TAG_GENERAL_NAME_DNS, Buffer.from(name, "ascii")) : tlv(TAG_GENERAL_NAME_IP, ipBytes(name)));
+  const der = assemble({
+    subjectPublicKey: publicKey,
+    subjectName: commonNameOnly(commonName),
+    issuerName: subjectNameOf(caCertificate.raw),
+    signingKey: caPrivateKey,
+    notBefore,
+    notAfter,
+    extensions: [
+      basicConstraintsExtension(false),
+      keyUsageExtension([KEY_USAGE.digitalSignature, KEY_USAGE.keyEncipherment]),
+      extension(OID_EXT_KEY_USAGE, false, sequence(oid(OID_SERVER_AUTH))),
+      extension(OID_SUBJECT_ALT_NAME, false, sequence(...generalNames)),
+      subjectKeyIdentifierExtension(publicKey),
+      extension(OID_AUTHORITY_KEY_IDENTIFIER, false, sequence(tlv(TAG_KEY_IDENTIFIER, keyIdentifier(caCertificate.publicKey))))
+    ]
+  });
+  return { certPem: toPem("CERTIFICATE", der), keyPem: keyPem(privateKey) };
+}
+
+// src/frontdoor/capability.ts
+var CONNECT_PROXY_REALM = "agent-shim front door";
+var BASIC_SCHEME = "basic";
+function capabilityFromProxyAuthorization(value) {
+  const trimmed = value.trim();
+  const space = trimmed.indexOf(" ");
+  if (space === -1 || trimmed.slice(0, space).toLowerCase() !== BASIC_SCHEME) {
+    return void 0;
+  }
+  const userPass = Buffer.from(trimmed.slice(space + 1).trim(), "base64").toString("utf8");
+  const colon = userPass.indexOf(":");
+  if (colon === -1) {
+    return void 0;
+  }
+  const password = userPass.slice(colon + 1);
+  return password === "" ? void 0 : password;
+}
+
+// src/frontdoor/state.ts
+import path5 from "node:path";
+import { z as z3 } from "zod";
+var FrontDoorSessionSchema = z3.strictObject({ pid: z3.number().int().positive(), startedAt: z3.number(), token: z3.string().min(1) });
+var FrontDoorStateSchema = z3.strictObject({
+  /** The supervisor process serving the front door. Alive means both listeners are up in that process. */
+  supervisorPid: z3.number().int().positive().optional(),
+  /** The loopback port the HTTPS provider listener serves on. Absent until the listener has bound and answered its health probe, so "port is set" is itself the ready signal a launcher polls for. */
+  port: z3.number().int().positive().optional(),
+  /**
+   * The sticky port preference for the provider listener: kept across crashes, restarts and idle shutdowns so every provider session, whose base URL was frozen at launch, keeps finding the front door at the same address.
+   */
+  lastPort: z3.number().int().positive().optional(),
+  /**
+   * The loopback port the CONNECT surface listens on. Absent whenever no supervisor is serving it, so "connectPort is set" is the ready signal an OAuth launch polls for alongside `port`.
+   */
+  connectPort: z3.number().int().positive().optional(),
+  /**
+   * The sticky port preference for the CONNECT surface, the exact analogue of `lastPort` for the second listener: it survives every shutdown, because every OAuth session's environment was frozen at launch with HTTPS_PROXY pointing at this address and a restart that moves strands them.
+   */
+  lastConnectPort: z3.number().int().positive().optional(),
+  /**
+   * The loopback port the direct listener serves on: the listener a headroom hop tells the daemon to forward routed traffic back to. Sticky like the others, because headroom's allowlist admits its exact origin and an ephemeral port would invalidate the allowlist on every restart.
+   */
+  directPort: z3.number().int().positive().optional(),
+  /** The sticky port preference for the direct listener, for the reason `directPort` gives. */
+  lastDirectPort: z3.number().int().positive().optional(),
+  /** The last fatal error, kept across shutdowns so `frontdoor status` can explain a front door that is not running. */
+  lastError: z3.string().optional()
+});
+function readFrontDoorState(fs2, stateFile) {
+  let raw;
+  try {
+    raw = fs2.readFileUtf8(stateFile);
+  } catch {
+    return void 0;
+  }
+  if (raw === void 0 || raw.trim() === "") {
+    return void 0;
+  }
+  try {
+    const parsed = FrontDoorStateSchema.safeParse(JSON.parse(raw));
+    return parsed.success ? parsed.data : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function writeFrontDoorState(fs2, stateFile, state) {
+  fs2.mkdirp(path5.dirname(stateFile));
+  fs2.writeFileUtf8(stateFile, `${JSON.stringify(state, null, 2)}
+`);
+}
+function frontDoorOrigin(state) {
+  const port = state?.directPort ?? state?.lastDirectPort;
+  return port === void 0 ? void 0 : `http://127.0.0.1:${String(port)}`;
+}
+function writeFrontDoorSession(fs2, sessionsDir, session) {
+  fs2.mkdirPrivate(sessionsDir);
+  fs2.writeFilePrivate(path5.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
+`);
+}
+function listFrontDoorSessions(fs2, sessionsDir) {
+  const sessions = [];
+  for (const name of fs2.readdir(sessionsDir)) {
+    if (!name.endsWith(".json")) {
+      continue;
+    }
+    try {
+      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs2.readFileUtf8(path5.join(sessionsDir, name)) ?? ""));
+      if (parsed.success) {
+        sessions.push({ pid: parsed.data.pid, startedAt: parsed.data.startedAt });
+      }
+    } catch {
+      continue;
+    }
+  }
+  return sessions.sort((a, b) => a.pid - b.pid);
+}
+function removeFrontDoorSession(fs2, sessionsDir, pid) {
+  fs2.removeRecursive(path5.join(sessionsDir, `${String(pid)}.json`));
+}
+function pruneDeadFrontDoorSessions(fs2, sessionsDir, isRunning) {
+  const removed = [];
+  for (const session of listFrontDoorSessions(fs2, sessionsDir)) {
+    if (!isRunning(session.pid)) {
+      removeFrontDoorSession(fs2, sessionsDir, session.pid);
+      removed.push(session.pid);
+    }
+  }
+  return removed;
+}
+
+// src/frontdoor/supervisor.ts
+var FRONTDOOR_SUPERVISOR_STILL_RUNNING = -1;
+var FRONTDOOR_POLL_MS = 1e3;
+var MS_PER_MINUTE = 6e4;
+async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {}) {
+  const { fs: fs2, paths } = ports;
+  const previous = readFrontDoorState(fs2, paths.frontdoorStateFile);
+  let lastPort = previous?.lastPort;
+  let lastConnectPort = previous?.lastConnectPort;
+  let lastDirectPort = previous?.lastDirectPort;
+  const sticky = () => ({
+    ...lastPort === void 0 ? {} : { lastPort },
+    ...lastConnectPort === void 0 ? {} : { lastConnectPort },
+    ...lastDirectPort === void 0 ? {} : { lastDirectPort }
+  });
+  const fail = (message) => {
+    writeFrontDoorState(fs2, paths.frontdoorStateFile, { lastError: message, ...sticky() });
+    fs2.removeRecursive(paths.frontdoorLockFile);
+    ports.log(`agent-shim frontdoor supervisor: ${message}`);
+    return 1;
+  };
+  writeFrontDoorState(fs2, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, ...sticky() });
+  const previousSticky = lastPort;
+  let http2;
+  try {
+    http2 = await ports.startProviderListener(lastPort);
+  } catch (error) {
+    return fail(`could not start the provider listener: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  if (previousSticky !== void 0 && http2.port !== previousSticky) {
+    ports.log(`agent-shim frontdoor supervisor: sticky port ${String(previousSticky)} was occupied; moving to ${String(http2.port)} (sessions launched against the old port are stale until they relaunch)`);
+  }
+  lastPort = http2.port;
+  const previousStickyConnect = lastConnectPort;
+  let connect2;
+  try {
+    connect2 = await ports.startConnectListener(lastConnectPort);
+  } catch (error) {
+    await http2.close();
+    return fail(`could not start the CONNECT surface: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  if (previousStickyConnect !== void 0 && connect2.port !== previousStickyConnect) {
+    ports.log(`agent-shim frontdoor supervisor: sticky CONNECT port ${String(previousStickyConnect)} was occupied; moving to ${String(connect2.port)} (OAuth sessions launched against the old port are stale until they relaunch)`);
+  }
+  lastConnectPort = connect2.port;
+  const previousStickyDirect = lastDirectPort;
+  let direct;
+  try {
+    direct = await ports.startDirectListener(lastDirectPort);
+  } catch (error) {
+    await connect2.close();
+    await http2.close();
+    return fail(`could not start the direct listener: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  if (previousStickyDirect !== void 0 && direct.port !== previousStickyDirect) {
+    ports.log(`agent-shim frontdoor supervisor: sticky direct port ${String(previousStickyDirect)} was occupied; moving to ${String(direct.port)} (headroom must be restarted to admit the new address)`);
+  }
+  lastDirectPort = direct.port;
+  writeFrontDoorState(fs2, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, port: http2.port, connectPort: connect2.port, directPort: direct.port, ...sticky() });
+  fs2.removeRecursive(paths.frontdoorLockFile);
+  ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http2.port)}, CONNECT surface on 127.0.0.1:${String(connect2.port)}`);
+  let idleSince;
+  let ticks = 0;
+  for (; ; ) {
+    if (options.tickLimit !== void 0 && ticks >= options.tickLimit) {
+      return FRONTDOOR_SUPERVISOR_STILL_RUNNING;
+    }
+    ticks += 1;
+    pruneDeadFrontDoorSessions(fs2, paths.frontdoorSessionsDir, ports.isRunning);
+    if (listFrontDoorSessions(fs2, paths.frontdoorSessionsDir).length === 0) {
+      idleSince ??= ports.now();
+      if (ports.now() - idleSince >= idleShutdownMinutes * MS_PER_MINUTE) {
+        ports.log(`agent-shim frontdoor supervisor: no sessions for ${String(idleShutdownMinutes)} minute(s); closing the front door and exiting`);
+        await direct.close();
+        await connect2.close();
+        await http2.close();
+        writeFrontDoorState(fs2, paths.frontdoorStateFile, sticky());
+        return 0;
+      }
+    } else {
+      idleSince = void 0;
+    }
+    await ports.sleep(FRONTDOOR_POLL_MS);
+  }
+}
+
+// src/frontdoor/connect.ts
+var CONNECT_INTERCEPT_HOST = "api.anthropic.com";
+var ROUTED_PATH_PREFIX = "/v1/";
+var HTTPS_PORT = 443;
+var MAX_PORT = 65535;
+var HTTP_BAD_GATEWAY = 502;
+var CA_KEY_FILE_MODE = 384;
+var CONNECT_LINE_TOKENS = 3;
+var HEAD_TERMINATOR = "\r\n\r\n";
+var MAX_CONNECT_HEAD_BYTES = 8192;
+var CONNECT_ESTABLISHED = "HTTP/1.1 200 Connection Established\r\n\r\n";
+var REFUSAL = {
+  badRequest: "400 Bad Request",
+  proxyAuthenticationRequired: "407 Proxy Authentication Required",
+  requestTimeout: "408 Request Timeout",
+  headTooLarge: "431 Request Header Fields Too Large",
+  serviceUnavailable: "503 Service Unavailable"
+};
+var CONNECT_LIMITS = {
+  headDeadlineMs: 1e4,
+  maxPendingHeads: 64,
+  maxTunnels: 1024,
+  revalidateMs: FRONTDOOR_POLL_MS
+};
+var CA_VALIDITY_DAYS = 3650;
+var LEAF_VALIDITY_DAYS = 397;
+var CA_SUBJECT_COMMON_NAME = "agent-shim front door CA";
+var MS_PER_DAY = 864e5;
+function parseConnectTarget(authority) {
+  const colon = authority.lastIndexOf(":");
+  if (colon === -1) {
+    const host2 = authority.trim().toLowerCase();
+    return host2 === "" ? void 0 : { host: host2, port: HTTPS_PORT };
+  }
+  const host = authority.slice(0, colon).trim().toLowerCase();
+  const port = Number.parseInt(authority.slice(colon + 1), 10);
+  if (host === "" || !Number.isInteger(port) || port <= 0 || port > MAX_PORT) {
+    return void 0;
+  }
+  return { host, port };
+}
+function isInterceptedHost(host, interceptHost) {
+  return host === interceptHost;
+}
+function servedByPipeline(path8) {
+  return path8?.startsWith(ROUTED_PATH_PREFIX) === true;
+}
+var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
+  "connection",
+  "keep-alive",
+  "proxy-connection",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade"
+]);
+function forwardableHeaders(headers) {
+  const connectionTokens = new Set(
+    (headers.connection ?? "").split(",").map((token) => token.trim().toLowerCase()).filter((token) => token !== "")
+  );
+  const result = {};
+  for (const [name, value] of Object.entries(headers)) {
+    if (value === void 0) {
+      continue;
+    }
+    const lower = name.toLowerCase();
+    if (HOP_BY_HOP_HEADERS.has(lower) || connectionTokens.has(lower)) {
+      continue;
+    }
+    result[name] = value;
+  }
+  return result;
+}
+function generateCa(now) {
+  return issueCaCertificate(CA_SUBJECT_COMMON_NAME, new Date(now.getTime() - MS_PER_DAY), new Date(now.getTime() + CA_VALIDITY_DAYS * MS_PER_DAY));
+}
+function mintLeaf(ca, names, now) {
+  return issueLeafCertificate(ca, names, new Date(now.getTime() - MS_PER_DAY), new Date(now.getTime() + LEAF_VALIDITY_DAYS * MS_PER_DAY));
+}
+function createLeafCache(ca, now) {
+  const cache = /* @__PURE__ */ new Map();
+  return (host) => {
+    const existing = cache.get(host);
+    if (existing !== void 0) {
+      return existing;
+    }
+    const minted = mintLeaf(ca, [host], now());
+    cache.set(host, minted);
+    return minted;
+  };
+}
+function ensureCa(store, generate) {
+  const existing = store.loadCa();
+  if (existing !== void 0 && caParses(existing)) {
+    return existing;
+  }
+  const ca = generate();
+  store.writeCa(ca);
+  return ca;
+}
+function caParses(ca) {
+  try {
+    new X509Certificate2(ca.certPem);
+    createPrivateKey2(ca.keyPem);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function startConnectServer(config, effects, preferredPort) {
+  const handler = (request3, response) => {
+    if (servedByPipeline(request3.url)) {
+      config.serveRouted(request3, response);
+      return;
+    }
+    effects.forwardHttp(config.upstream, request3, response);
+  };
+  const httpSession = effects.createHttpSession(handler);
+  const tlsAcceptor = effects.createTlsAcceptor(config.leafFor(config.interceptHost), (secure) => {
+    httpSession.serve(secure);
+  });
+  const ledger = createConnectionLedger(config.limits, config.isLiveCapability);
+  const listener = await effects.listenLoopback(preferredPort, (socket) => {
+    handleConnect(socket, { config, effects, tlsAcceptor, ledger });
+  });
+  return {
+    port: listener.port,
+    close: async () => {
+      ledger.close();
+      await listener.close();
+      tlsAcceptor.close();
+      httpSession.close();
+    }
+  };
+}
+function createConnectionLedger(limits, isLiveCapability) {
+  const pending = /* @__PURE__ */ new Map();
+  const authenticated = /* @__PURE__ */ new Map();
+  let tunnels = 0;
+  const leavePending = (socket) => {
+    const deadline = pending.get(socket);
+    if (deadline !== void 0) {
+      clearTimeout(deadline);
+      pending.delete(socket);
+    }
+  };
+  const revalidation = setInterval(() => {
+    for (const [capability, sockets] of authenticated) {
+      if (!isLiveCapability(capability)) {
+        for (const socket of sockets) {
+          socket.destroy();
+        }
+      }
+    }
+  }, limits.revalidateMs);
+  revalidation.unref();
+  return {
+    accept: (socket) => {
+      const [oldest] = pending.keys();
+      if (pending.size >= limits.maxPendingHeads && oldest !== void 0) {
+        leavePending(oldest);
+        refuse(oldest, REFUSAL.requestTimeout);
+      }
+      pending.set(
+        socket,
+        setTimeout(() => {
+          leavePending(socket);
+          refuse(socket, REFUSAL.requestTimeout);
+        }, limits.headDeadlineMs)
+      );
+      socket.once("close", () => {
+        leavePending(socket);
+      });
+    },
+    headReceived: leavePending,
+    establish: (socket, capability) => {
+      if (tunnels >= limits.maxTunnels) {
+        return false;
+      }
+      tunnels += 1;
+      const sockets = authenticated.get(capability) ?? /* @__PURE__ */ new Set();
+      sockets.add(socket);
+      authenticated.set(capability, sockets);
+      socket.once("close", () => {
+        tunnels -= 1;
+        sockets.delete(socket);
+        if (sockets.size === 0 && authenticated.get(capability) === sockets) {
+          authenticated.delete(capability);
+        }
+      });
+      return true;
+    },
+    close: () => {
+      clearInterval(revalidation);
+      for (const deadline of pending.values()) {
+        clearTimeout(deadline);
+      }
+      pending.clear();
+    }
+  };
+}
+function refuse(socket, status, headers = []) {
+  socket.removeAllListeners("data");
+  socket.pause();
+  if (socket.destroyed || socket.writableEnded) {
+    return;
+  }
+  socket.end(`HTTP/1.1 ${status}\r
+${headers.map((header) => `${header}\r
+`).join("")}content-length: 0\r
+connection: close\r
+\r
+`, () => {
+    socket.destroy();
+  });
+}
+function handleConnect(socket, context) {
+  socket.on("error", () => {
+    socket.destroy();
+  });
+  context.ledger.accept(socket);
+  let buffer = Buffer.alloc(0);
+  const onData = (chunk) => {
+    buffer = Buffer.concat([buffer, chunk]);
+    const headEnd = buffer.indexOf(HEAD_TERMINATOR);
+    if (headEnd === -1 ? buffer.length > MAX_CONNECT_HEAD_BYTES : headEnd > MAX_CONNECT_HEAD_BYTES) {
+      context.ledger.headReceived(socket);
+      refuse(socket, REFUSAL.headTooLarge);
+      return;
+    }
+    if (headEnd === -1) {
+      return;
+    }
+    socket.removeListener("data", onData);
+    socket.pause();
+    context.ledger.headReceived(socket);
+    const head = buffer.subarray(0, headEnd).toString("utf8");
+    socket.unshift(buffer.subarray(headEnd + HEAD_TERMINATOR.length));
+    routeConnect(socket, head, context);
+  };
+  socket.on("data", onData);
+}
+function proxyAuthorizationOf(head) {
+  const values = head.split("\r\n").slice(1).flatMap((line) => {
+    const colon = line.indexOf(":");
+    return colon > 0 && line.slice(0, colon).trim().toLowerCase() === "proxy-authorization" ? [line.slice(colon + 1)] : [];
+  });
+  const [value] = values;
+  return values.length === 1 ? value : void 0;
+}
+function routeConnect(socket, head, context) {
+  const { config, effects, tlsAcceptor, ledger } = context;
+  const credential = proxyAuthorizationOf(head);
+  const capability = credential === void 0 ? void 0 : capabilityFromProxyAuthorization(credential);
+  if (capability === void 0 || !config.isLiveCapability(capability)) {
+    refuse(socket, REFUSAL.proxyAuthenticationRequired, [`Proxy-Authenticate: Basic realm="${CONNECT_PROXY_REALM}"`]);
+    return;
+  }
+  const requestLine = head.split("\r\n", 1)[0] ?? "";
+  const parts = requestLine.split(" ");
+  const authority = parts.length === CONNECT_LINE_TOKENS && parts[0]?.toUpperCase() === "CONNECT" ? parts[1] ?? "" : void 0;
+  const target = authority === void 0 ? void 0 : parseConnectTarget(authority);
+  if (target === void 0) {
+    refuse(socket, REFUSAL.badRequest);
+    return;
+  }
+  if (!ledger.establish(socket, capability)) {
+    refuse(socket, REFUSAL.serviceUnavailable);
+    return;
+  }
+  socket.write(CONNECT_ESTABLISHED);
+  if (isInterceptedHost(target.host, config.interceptHost)) {
+    tlsAcceptor.accept(socket);
+    return;
+  }
+  void blindTunnel(socket, target, effects);
+}
+async function blindTunnel(socket, target, effects) {
+  let upstream;
+  try {
+    upstream = await effects.connectTcp(target.host, target.port);
+  } catch {
+    socket.destroy();
+    return;
+  }
+  if (socket.destroyed) {
+    upstream.destroy();
+    return;
+  }
+  socket.pipe(upstream);
+  upstream.pipe(socket);
+  const drop = () => {
+    socket.destroy();
+    upstream.destroy();
+  };
+  socket.on("error", drop);
+  upstream.on("error", drop);
+  socket.on("close", () => {
+    upstream.destroy();
+  });
+  upstream.on("close", () => {
+    socket.destroy();
+  });
+}
+function realConnectEffects() {
+  const plainAgent = new http.Agent({ keepAlive: true });
+  const tlsAgent = new https.Agent({ keepAlive: true });
+  const listenOnce = async (port, onSocket) => await new Promise((resolve, reject) => {
+    const accepted = /* @__PURE__ */ new Set();
+    const server = net2.createServer((socket) => {
+      accepted.add(socket);
+      socket.on("close", () => {
+        accepted.delete(socket);
+      });
+      onSocket(socket);
+    });
+    server.once("error", reject);
+    server.listen(port, "127.0.0.1", () => {
+      const address = server.address();
+      const bound = typeof address === "object" && address !== null ? address.port : 0;
+      if (bound === 0) {
+        reject(new Error("could not bind a loopback port"));
+        return;
+      }
+      resolve({
+        port: bound,
+        close: async () => {
+          await new Promise((closeResolve) => {
+            server.close(() => {
+              closeResolve(void 0);
+            });
+            for (const socket of accepted) {
+              socket.destroy();
+            }
+          });
+        }
+      });
+    });
+  });
+  return {
+    listenLoopback: async (preferredPort, onSocket) => {
+      if (preferredPort !== void 0) {
+        try {
+          return await listenOnce(preferredPort, onSocket);
+        } catch {
+        }
+      }
+      return await listenOnce(0, onSocket);
+    },
+    createTlsAcceptor: (leaf, onSecure) => {
+      const server = tls.createServer({ key: leaf.keyPem, cert: leaf.certPem }, (secure) => {
+        onSecure(secure);
+      });
+      server.on("clientError", (_error, socket) => {
+        socket.destroy();
+      });
+      return {
+        // tls.Server is a net.Server whose connection listener wraps the raw socket in the TLS handshake, and emitting the event by hand is what runs that listener on a socket this process already owns (the CONNECT half of the connection) rather than one the server accepted itself.
+        accept: (socket) => {
+          server.emit("connection", socket);
+        },
+        close: () => {
+          server.close();
+        }
+      };
+    },
+    createHttpSession: (handler) => {
+      const server = http.createServer(handler);
+      server.on("clientError", (_error, socket) => {
+        socket.destroy();
+      });
+      return {
+        serve: (socket) => {
+          server.emit("connection", socket);
+        },
+        close: () => {
+          server.close();
+          server.closeAllConnections();
+        }
+      };
+    },
+    connectTcp: async (host, port) => await new Promise((resolve, reject) => {
+      const socket = net2.connect({ host, port });
+      socket.once("connect", () => {
+        resolve(socket);
+      });
+      socket.once("error", reject);
+    }),
+    forwardHttp: (target, request3, response) => {
+      const headers = forwardableHeaders(request3.headers);
+      const options = {
+        host: target.host,
+        port: target.port,
+        method: request3.method,
+        path: request3.url,
+        headers,
+        agent: target.tls ? tlsAgent : plainAgent
+      };
+      if (target.tls) {
+        options.servername = target.servername ?? target.host;
+        if (target.ca !== void 0) {
+          options.ca = [...target.ca];
+        }
+        if (target.rejectUnauthorized !== void 0) {
+          options.rejectUnauthorized = target.rejectUnauthorized;
+        }
+      }
+      const onUpstreamResponse = (upstreamResponse) => {
+        response.writeHead(upstreamResponse.statusCode ?? HTTP_BAD_GATEWAY, forwardableHeaders(upstreamResponse.headers));
+        response.flushHeaders();
+        upstreamResponse.pipe(response);
+      };
+      const upstream = target.tls ? https.request(options, onUpstreamResponse) : http.request(options, onUpstreamResponse);
+      upstream.on("error", (error) => {
+        if (response.headersSent) {
+          response.destroy(error);
+          return;
+        }
+        const body = `agent-shim headroom: upstream unreachable (${error.message})`;
+        response.writeHead(HTTP_BAD_GATEWAY, { "content-type": "text/plain", "content-length": String(body.length) });
+        response.end(body);
+      });
+      request3.pipe(upstream);
+      request3.socket.setNoDelay(true);
+      upstream.on("socket", (socket) => {
+        socket.setNoDelay(true);
+      });
+    }
+  };
+}
+function isEnoent(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+function realConnectCertStore(paths) {
+  const read = (file) => {
+    try {
+      return fs.readFileSync(file, "utf8");
+    } catch (error) {
+      if (isEnoent(error)) {
+        return void 0;
+      }
+      throw error;
+    }
+  };
+  return {
+    loadCa: () => {
+      const certPem = read(paths.frontdoorCaCertFile);
+      const keyPem2 = read(paths.frontdoorCaKeyFile);
+      return certPem === void 0 || keyPem2 === void 0 ? void 0 : { certPem, keyPem: keyPem2 };
+    },
+    writeCa: (ca) => {
+      fs.mkdirSync(paths.frontdoorCaDir, { recursive: true });
+      fs.writeFileSync(paths.frontdoorCaCertFile, ca.certPem, "utf8");
+      fs.writeFileSync(paths.frontdoorCaKeyFile, ca.keyPem, { encoding: "utf8", mode: CA_KEY_FILE_MODE });
+      fs.chmodSync(paths.frontdoorCaKeyFile, CA_KEY_FILE_MODE);
+    }
+  };
+}
+
+// src/frontdoor/ensure.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+
+// src/headroom/state.ts
+import { createHash as createHash2 } from "node:crypto";
+import path6 from "node:path";
+import { z as z4 } from "zod";
+var HEADROOM_ANTHROPIC_UPSTREAM = "https://api.anthropic.com";
+var HeadroomStateSchema = z4.strictObject({
+  /** The supervisor process owning the daemon. Alive means someone is keeping headroom running. */
+  supervisorPid: z4.number().int().positive().optional(),
+  /** The headroom proxy process itself. Absent while the supervisor is between restarts. */
+  headroomPid: z4.number().int().positive().optional(),
+  /** The loopback port the proxy listens on. Absent until the proxy has passed its readiness check, so "port is set" is itself the ready signal a launcher polls for. */
+  port: z4.number().int().positive().optional(),
+  /**
+   * The sticky port preference: the address the daemon last served on, kept across crashes, restarts, and idle shutdowns so the next start reuses it. Distinct from `port` on purpose: `port` is the ready signal (absent whenever nothing is serving), while `lastPort` survives every shutdown, because the front door (which routes sessions through this daemon) reads it live and follows a restart to whichever address it lands on.
+   */
+  lastPort: z4.number().int().positive().optional(),
+  /** The `headroom --version` output of the running install. */
+  version: z4.string().optional(),
+  /** Hash of the allowlist the running proxy was started with, so a provider-file change is detected as drift. */
+  allowlistHash: z4.string().optional(),
+  /** Hash of the token-saving settings the running proxy was started with, so a settings change is detected as drift. */
+  settingsHash: z4.string().optional(),
+  /** The install spec the running install was last installed from, so a `source` config change is detected as drift. */
+  installedSource: z4.string().optional(),
+  /** The last fatal error, kept across shutdowns so `headroom status` can explain a daemon that is not running. */
+  lastError: z4.string().optional()
+});
+var HeadroomSessionSchema = z4.strictObject({ pid: z4.number().int().positive(), startedAt: z4.number(), supervisorPid: z4.number().int().positive() });
+var HeadroomLockSchema = z4.strictObject({ pid: z4.number().int().positive(), at: z4.number() });
+function parseJson(raw, schema) {
+  if (raw === void 0 || raw.trim() === "") {
+    return void 0;
+  }
+  const parsed = schema.safeParse(JSON.parse(raw));
+  return parsed.success ? parsed.data : void 0;
+}
+function readHeadroomState(fs2, stateFile) {
+  try {
+    return parseJson(fs2.readFileUtf8(stateFile), HeadroomStateSchema);
+  } catch {
+    return void 0;
+  }
+}
+function writeHeadroomState(fs2, stateFile, state) {
+  fs2.mkdirp(path6.dirname(stateFile));
+  fs2.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
+`);
+}
+function headroomAllowlist(providers) {
+  const urls = /* @__PURE__ */ new Set([HEADROOM_ANTHROPIC_UPSTREAM]);
+  for (const provider of providers) {
+    urls.add(provider.baseUrl);
+  }
+  return [...urls].sort();
+}
+function headroomUpstreams(providers, frontDoorOrigin2) {
+  const upstreams = providers.filter((provider) => !isCodexProvider(provider)).map((provider) => ({ baseUrl: provider.baseUrl }));
+  if (providers.length > 0 && frontDoorOrigin2 !== void 0) {
+    upstreams.push({ baseUrl: frontDoorOrigin2 });
+  }
+  return upstreams;
+}
+function hashAllowlist(allowlist) {
+  return createHash2("sha256").update(allowlist.join("\n")).digest("hex");
+}
+function readAllProviders(fs2, providersDir) {
+  const result = [];
+  for (const name of fs2.readdir(providersDir)) {
+    if (!name.endsWith(".json")) {
+      continue;
+    }
+    try {
+      const parsed = parseJson(fs2.readFileUtf8(path6.join(providersDir, name)), ProviderSchema);
+      if (parsed !== void 0) {
+        result.push({ name: name.slice(0, -".json".length), provider: parsed });
+      }
+    } catch {
+      continue;
+    }
+  }
+  return result;
+}
+function writeSession(fs2, sessionsDir, session) {
+  fs2.mkdirp(sessionsDir);
+  fs2.writeFileUtf8(path6.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
+`);
+}
+function removeSession(fs2, sessionsDir, pid) {
+  fs2.removeRecursive(path6.join(sessionsDir, `${String(pid)}.json`));
+}
+function listSessions(fs2, sessionsDir) {
+  const sessions = [];
+  for (const name of fs2.readdir(sessionsDir)) {
+    if (!name.endsWith(".json")) {
+      continue;
+    }
+    try {
+      const parsed = parseJson(fs2.readFileUtf8(path6.join(sessionsDir, name)), HeadroomSessionSchema);
+      if (parsed !== void 0) {
+        sessions.push(parsed);
+      }
+    } catch {
+      continue;
+    }
+  }
+  return sessions.sort((a, b) => a.pid - b.pid);
+}
+function sessionsForSupervisor(fs2, sessionsDir, supervisorPid) {
+  return listSessions(fs2, sessionsDir).filter((session) => session.supervisorPid === supervisorPid);
+}
+function pruneDeadSessions(fs2, sessionsDir, isRunning) {
+  const removed = [];
+  for (const session of listSessions(fs2, sessionsDir)) {
+    if (!isRunning(session.pid)) {
+      removeSession(fs2, sessionsDir, session.pid);
+      removed.push(session.pid);
+    }
+  }
+  return removed;
+}
+function readStartLock(fs2, lockFile) {
+  try {
+    return parseJson(fs2.readFileUtf8(lockFile), HeadroomLockSchema);
+  } catch {
+    return void 0;
+  }
+}
+
+// src/frontdoor/ensure.ts
+var FRONTDOOR_START_TIMEOUT_MS = 3e4;
+var FRONTDOOR_LAUNCHER_POLL_MS = 100;
+var FrontDoorStartError = class extends CliError {
+  constructor(message) {
+    super(message);
+    this.name = "FrontDoorStartError";
+  }
+};
+function ensureFrontDoor(params) {
+  const { paths, ports } = params;
+  const deadline = ports.now() + FRONTDOOR_START_TIMEOUT_MS;
+  let spawned = false;
+  const distrusted = /* @__PURE__ */ new Set();
+  let lastRejection;
+  for (; ; ) {
+    const state = readFrontDoorState(ports.fs, paths.frontdoorStateFile);
+    const supervisorPid = state?.supervisorPid;
+    if (supervisorPid !== void 0 && !distrusted.has(supervisorPid) && ports.isRunning(supervisorPid)) {
+      if (state?.port !== void 0 && state.connectPort !== void 0) {
+        const verdict = ports.verifyListener(state.port);
+        if (verdict.ok) {
+          const token = randomUUID2();
+          writeFrontDoorSession(ports.fs, paths.frontdoorSessionsDir, { pid: params.launcherPid, startedAt: ports.now(), token });
+          return { port: state.port, connectPort: state.connectPort, token };
+        }
+        lastRejection = `the listener on 127.0.0.1:${String(state.port)} (recorded for pid ${String(supervisorPid)}) failed authentication: ${verdict.reason}`;
+        if (spawned) {
+          throw new FrontDoorStartError(`agent-shim: ${lastRejection}; refusing to send this session's credentials to it. Daemon log: ${paths.frontdoorLogPath}`);
+        }
+        distrusted.add(supervisorPid);
+        continue;
+      }
+      if (state?.lastError !== void 0) {
+        throw new FrontDoorStartError(`agent-shim: the front door reported a fatal error and is not serving: ${state.lastError} (daemon log: ${paths.frontdoorLogPath})`);
+      }
+    } else if (!spawned) {
+      ports.fs.mkdirp(paths.frontdoorDir);
+      const created = ports.fs.writeFileExclusive(paths.frontdoorLockFile, `${JSON.stringify({ pid: params.launcherPid, at: ports.now() })}
+`);
+      if (created) {
+        ports.spawnSupervisor(paths);
+        spawned = true;
+      } else {
+        const lock = readStartLock(ports.fs, paths.frontdoorLockFile);
+        if (lock === void 0 || !ports.isRunning(lock.pid)) {
+          ports.fs.removeRecursive(paths.frontdoorLockFile);
+          continue;
+        }
+      }
+    }
+    if (ports.now() >= deadline) {
+      const lastError = state?.lastError;
+      throw new FrontDoorStartError(
+        `agent-shim: the front door did not become ready within ${String(FRONTDOOR_START_TIMEOUT_MS)}ms` + (lastError === void 0 ? "" : ` (last error: ${lastError})`) + (lastRejection === void 0 ? "" : ` (${lastRejection})`) + `. Daemon log: ${paths.frontdoorLogPath}`
+      );
+    }
+    ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
+  }
+}
+
+// src/usage/read.ts
+import path7 from "node:path";
+
+// src/usage/schema.ts
+import { z as z5 } from "zod";
+var USAGE_SCHEMA_VERSION = 1;
+var VersionSchema = z5.literal(USAGE_SCHEMA_VERSION);
+var InstantSchema = z5.iso.datetime();
+var TokenCountSchema = z5.number().int().nonnegative();
+var TokenUsageSchema = z5.strictObject({
+  inputTokens: TokenCountSchema.optional(),
+  outputTokens: TokenCountSchema.optional(),
+  cacheCreationInputTokens: TokenCountSchema.optional(),
+  cacheReadInputTokens: TokenCountSchema.optional()
+});
+var LIMIT_KINDS = ["rate-limited", "quota-exhausted"];
+var LimitClassificationSchema = z5.strictObject({
+  kind: z5.enum(LIMIT_KINDS),
+  /** Seconds to wait before retrying, from the response's `retry-after`. */
+  retryAfterSeconds: z5.number().nonnegative().optional(),
+  /** When the limiting window resets, from the upstream's own reset header. */
+  resetAt: InstantSchema.optional(),
+  /** The window the upstream named as the binding one (`anthropic-ratelimit-unified-representative-claim`), such as `five_hour` or `seven_day`. */
+  window: z5.string().optional(),
+  /** The signals the classification rests on, each `<name>=<value>` from a response header or the error body's `type` or `code`. Never the error message. */
+  evidence: z5.array(z5.string())
+});
+var UsageRecordSchema = z5.strictObject({
+  schemaVersion: VersionSchema,
+  /** When the front door received the request. */
+  at: InstantSchema,
+  /** The launching identity, when the launch resolved one. */
+  identity: z5.string().optional(),
+  /** `anthropic` for an OAuth session's request to Claude Code's own API, otherwise the provider's name. */
+  provider: z5.string(),
+  /** The launch's session id, generated per launch. */
+  sessionId: z5.string().optional(),
+  /** The project the launch ran in (its git repository root), when the launch sent one: headroom launches do. */
+  project: z5.string().optional(),
+  /** The front-door route that served the request. */
+  route: z5.string(),
+  method: z5.string(),
+  /** The API path as the upstream sees it (`/v1/messages`), without the provider prefix or a query string. */
+  endpoint: z5.string(),
+  /** The model the response named. */
+  model: z5.string().optional(),
+  status: z5.number().int(),
+  /** Milliseconds from the request's arrival to its response head. */
+  latencyMs: z5.number().int().nonnegative(),
+  /** Milliseconds from the request's arrival to the end of its response body. */
+  durationMs: z5.number().int().nonnegative(),
+  /** Whether the client received the whole body. */
+  outcome: z5.enum(["completed", "aborted"]),
+  usage: TokenUsageSchema.optional(),
+  /** The response's quota and rate-limit headers, by name (see `isRateLimitHeader`). */
+  rateLimitHeaders: z5.record(z5.string(), z5.string()).optional(),
+  limit: LimitClassificationSchema.optional(),
+  /** The upstream's request id (`request-id`), for matching a record to the provider's own logs. */
+  requestId: z5.string().optional()
+});
+var QuotaWindowSchema = z5.strictObject({
+  /** The fraction of the window used, as the upstream reports it (0 to 1). */
+  utilization: z5.number().nonnegative().optional(),
+  resetsAt: InstantSchema.optional(),
+  /** The window's own status (`allowed`, `allowed_warning`, `rejected`). */
+  status: z5.string().optional()
+});
+var UnifiedRateLimitSchema = z5.strictObject({
+  /** The overall status: `allowed`, `allowed_warning` or `rejected`. */
+  status: z5.string().optional(),
+  fiveHour: QuotaWindowSchema.optional(),
+  sevenDay: QuotaWindowSchema.optional(),
+  /** The window that currently binds. */
+  representativeClaim: z5.string().optional(),
+  /** When the binding window resets. */
+  resetAt: InstantSchema.optional(),
+  /** Whether usage beyond the plan (extra usage) is available: `allowed` or `rejected`. */
+  overageStatus: z5.string().optional()
+});
+var RateLimitStateSchema = z5.strictObject({
+  observedAt: InstantSchema,
+  /** Every quota and rate-limit header on that response, by name. */
+  headers: z5.record(z5.string(), z5.string()),
+  unified: UnifiedRateLimitSchema.optional()
+});
+var LimitEventSchema = LimitClassificationSchema.extend({
+  observedAt: InstantSchema,
+  status: z5.number().int()
+});
+var ProviderQuotaWindowSchema = z5.strictObject({
+  /** What the window measures, in the provider's terms (`tokens`, `tool-calls`). */
+  measures: z5.string(),
+  /** The window's length in milliseconds, when the provider's unit is one this project knows; absent for an unrecognised unit, with `period` carrying the raw code. */
+  periodMs: z5.number().int().positive().optional(),
+  /** The provider's own description of the period when `periodMs` could not be derived, such as `unit 4 x 1`. */
+  period: z5.string().optional(),
+  /** The fraction of the window used (0 to 1). */
+  utilization: z5.number().nonnegative(),
+  resetsAt: InstantSchema.optional(),
+  /** Absolute counts, when the provider reports them for this window. */
+  limit: z5.number().nonnegative().optional(),
+  used: z5.number().nonnegative().optional(),
+  remaining: z5.number().nonnegative().optional()
+});
+var ProviderQuotaSchema = z5.strictObject({
+  observedAt: InstantSchema,
+  /** Which usage endpoint produced it (`z.ai`). */
+  source: z5.string(),
+  /** The subscription level the endpoint reports, when it does. */
+  level: z5.string().optional(),
+  windows: z5.array(ProviderQuotaWindowSchema)
+});
+var ProviderUsageStateSchema = z5.strictObject({
+  lastRequestAt: InstantSchema,
+  lastStatus: z5.number().int(),
+  lastModel: z5.string().optional(),
+  /** The latest rate-limit state, from the last response that carried any rate-limit header. */
+  rateLimit: RateLimitStateSchema.optional(),
+  /** The latest classified refusal. It stays after later successes, so a reader compares its `resetAt` (or `observedAt` plus `retryAfterSeconds`) with the current time. */
+  lastLimit: LimitEventSchema.optional(),
+  /** The latest quota the provider's usage endpoint reported, for providers whose quota is not visible in response headers. */
+  quota: ProviderQuotaSchema.optional()
+});
+var AccountMetadataSchema = z5.strictObject({
+  accountUuid: z5.string().optional(),
+  emailAddress: z5.string().optional(),
+  displayName: z5.string().optional(),
+  organizationUuid: z5.string().optional(),
+  organizationName: z5.string().optional(),
+  organizationType: z5.string().optional(),
+  organizationRole: z5.string().optional(),
+  workspaceRole: z5.string().optional(),
+  billingType: z5.string().optional(),
+  seatTier: z5.string().optional(),
+  organizationRateLimitTier: z5.string().optional(),
+  userRateLimitTier: z5.string().optional(),
+  hasExtraUsageEnabled: z5.boolean().optional(),
+  subscriptionCreatedAt: z5.string().optional(),
+  accountCreatedAt: z5.string().optional()
+});
+var UsageSnapshotSchema = z5.strictObject({
+  schemaVersion: VersionSchema,
+  identity: z5.string(),
+  updatedAt: InstantSchema,
+  /** The identity's account metadata as of `updatedAt`. */
+  account: AccountMetadataSchema.optional(),
+  /** Latest state per provider, keyed by provider name (`anthropic` for OAuth sessions). */
+  providers: z5.record(z5.string(), ProviderUsageStateSchema)
+});
+
+// src/usage/account.ts
+function isIdentityName(name) {
+  return IdentitySchema.shape.name.safeParse(name).success;
+}
+
+// src/usage/read.ts
+var UsageSnapshotError = class extends Error {
+  constructor(file, detail) {
+    super(`${file} is not a usage snapshot this agent-shim can read (schema version ${String(USAGE_SCHEMA_VERSION)}): ${detail}`);
+    this.file = file;
+    this.name = "UsageSnapshotError";
+  }
+  file;
+};
+function snapshotPath(snapshotsDir, identity) {
+  if (!isIdentityName(identity)) {
+    throw new Error(`"${identity}" is not a valid identity name.`);
+  }
+  return path7.join(snapshotsDir, `${identity}.json`);
+}
+function readUsageSnapshot(fs2, snapshotsDir, identity) {
+  const file = snapshotPath(snapshotsDir, identity);
+  const raw = fs2.readFileUtf8(file);
+  if (raw === void 0) {
+    return void 0;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new UsageSnapshotError(file, "not valid JSON");
+  }
+  const snapshot = UsageSnapshotSchema.safeParse(parsed);
+  if (!snapshot.success) {
+    throw new UsageSnapshotError(file, snapshot.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; "));
+  }
+  return snapshot.data;
+}
+function listUsageSnapshots(fs2, snapshotsDir) {
+  return fs2.readdir(snapshotsDir).flatMap((name) => {
+    if (!name.endsWith(".json")) {
+      return [];
+    }
+    const identity = name.slice(0, -".json".length);
+    if (!isIdentityName(identity)) {
+      return [];
+    }
+    const snapshot = readUsageSnapshot(fs2, snapshotsDir, identity);
+    return snapshot === void 0 ? [] : [snapshot];
+  }).sort((left, right) => left.identity.localeCompare(right.identity));
+}
+
+// src/headroom/ensure.ts
+var HEADROOM_START_TIMEOUT_MS = 12e4;
+var HEADROOM_LAUNCHER_POLL_MS = 250;
+var HeadroomStartError = class extends CliError {
+  constructor(message) {
+    super(message);
+    this.name = "HeadroomStartError";
+  }
+};
+function ensureHeadroom(params) {
+  const { paths, ports } = params;
+  const deadline = ports.now() + HEADROOM_START_TIMEOUT_MS;
+  let spawnedSupervisor = false;
+  for (; ; ) {
+    const state = readHeadroomState(ports.fs, paths.headroomStateFile);
+    if (state?.supervisorPid !== void 0 && ports.isRunning(state.supervisorPid)) {
+      const daemonUp = state.port !== void 0 && state.headroomPid !== void 0 && ports.isRunning(state.headroomPid);
+      if (daemonUp && state.port !== void 0) {
+        writeSession(ports.fs, paths.headroomSessionsDir, { pid: params.launcherPid, startedAt: ports.now(), supervisorPid: state.supervisorPid });
+        return { port: state.port };
+      }
+      if (state.lastError !== void 0) {
+        throw new HeadroomStartError(
+          `agent-shim: the headroom daemon reported a fatal error and is not serving: ${state.lastError} (daemon log: ${paths.headroomLogPath})`
+        );
+      }
+    } else if (!spawnedSupervisor) {
+      ports.fs.mkdirp(paths.headroomDir);
+      const created = ports.fs.writeFileExclusive(
+        paths.headroomLockFile,
+        `${JSON.stringify({ pid: params.launcherPid, at: ports.now() })}
+`
+      );
+      if (created) {
+        ports.spawnSupervisor(paths);
+        spawnedSupervisor = true;
+      } else {
+        const lock = readStartLock(ports.fs, paths.headroomLockFile);
+        if (lock === void 0 || !ports.isRunning(lock.pid)) {
+          ports.fs.removeRecursive(paths.headroomLockFile);
+          continue;
+        }
+      }
+    }
+    if (ports.now() >= deadline) {
+      const lastError = state?.lastError;
+      throw new HeadroomStartError(
+        `agent-shim: the headroom daemon did not become ready within ${String(HEADROOM_START_TIMEOUT_MS)}ms` + (lastError === void 0 ? "" : ` (last error: ${lastError})`) + `. Daemon log: ${paths.headroomLogPath}`
+      );
+    }
+    ports.sleep(HEADROOM_LAUNCHER_POLL_MS);
+  }
+}
+
+// src/headroom/settings.ts
+import { createHash as createHash3 } from "node:crypto";
+function settingsOf(config) {
+  return {
+    ...config.mode === void 0 ? {} : { mode: config.mode },
+    ...config.targetRatio === void 0 ? {} : { targetRatio: config.targetRatio },
+    ...config.ccr === void 0 ? {} : { ccr: config.ccr },
+    ...config.rolloutChannel === void 0 ? {} : { rolloutChannel: config.rolloutChannel },
+    ...config.interceptToolResults === void 0 ? {} : { interceptToolResults: config.interceptToolResults },
+    ...config.readMaturation === void 0 ? {} : { readMaturation: config.readMaturation }
+  };
+}
+function settingsArgs(settings) {
+  return [
+    ...settings.mode === void 0 ? [] : ["--mode", settings.mode],
+    ...settings.targetRatio === void 0 ? [] : ["--target-ratio", String(settings.targetRatio)],
+    ...settings.ccr === "lossless" ? ["--lossless"] : [],
+    ...settings.ccr === "none" ? ["--no-ccr"] : [],
+    ...settings.interceptToolResults === true ? ["--intercept-tool-results"] : [],
+    ...settings.readMaturation === true ? ["--read-maturation"] : []
+  ];
+}
+function settingsEnv(settings) {
+  return settings.rolloutChannel === void 0 ? {} : { HEADROOM_ROLLOUT_CHANNEL: settings.rolloutChannel };
+}
+function hashSettings(settings) {
+  return createHash3("sha256").update(JSON.stringify([...settingsArgs(settings), JSON.stringify(settingsEnv(settings))])).digest("hex");
+}
+
+// src/headroom/source.ts
+import { z as z6 } from "zod";
+var GIT_SPEC_RE = /git\+[^@\s]+(?:@([^\s#]+))?/;
+var COMMIT_SHA_RE = /^[0-9a-f]{40}$/i;
+var DirectUrlSchema = z6.object({ vcs_info: z6.object({ commit_id: z6.string() }) });
+function pinnedGitCommit(spec) {
+  const ref = GIT_SPEC_RE.exec(spec)?.[1];
+  return ref !== void 0 && COMMIT_SHA_RE.test(ref) ? ref.toLowerCase() : void 0;
+}
+
+// src/headroom/supervisor.ts
+function resolveSupervisorConfig(configured) {
+  return {
+    source: configured.source ?? HEADROOM_DEFAULT_SOURCE,
+    idleShutdownMinutes: configured.idleShutdownMinutes ?? HEADROOM_DEFAULT_IDLE_SHUTDOWN_MINUTES,
+    settings: settingsOf(configured)
+  };
+}
+var HEADROOM_BACKOFF_BASE_MS = 500;
+var HEADROOM_BACKOFF_CAP_MS = 3e4;
+var HEADROOM_START_RETRY_BUDGET = 5;
+var HEADROOM_READY_TIMEOUT_MS = 15e3;
+var HEADROOM_POLL_MS = 1e3;
+var MS_PER_MINUTE2 = 6e4;
+function backoffForAttempt(attempt) {
+  return Math.min(HEADROOM_BACKOFF_CAP_MS, HEADROOM_BACKOFF_BASE_MS * 2 ** (attempt - 1));
+}
+function versionSatisfies(version, source) {
+  if (version === void 0) {
+    return false;
+  }
+  const specifier = /==|>=|<=|!=|>|<|~=/.exec(source);
+  if (specifier === null) {
+    return true;
+  }
+  const installed = parseVersion(version);
+  const wanted = parseVersion(source.slice(specifier.index + specifier[0].length));
+  if (installed === void 0 || wanted === void 0) {
+    return true;
+  }
+  const cmp = compareVersions(installed, wanted);
+  switch (specifier[0]) {
+    case "==":
+      return cmp === 0;
+    case "!=":
+      return cmp !== 0;
+    case ">=":
+      return cmp >= 0;
+    case "<=":
+      return cmp <= 0;
+    case ">":
+      return cmp > 0;
+    case "<":
+      return cmp < 0;
+    case "~=":
+      return compareVersions(installed.slice(0, Math.max(0, wanted.length - 1)), wanted.slice(0, Math.max(0, wanted.length - 1))) === 0 && cmp >= 0;
+    default:
+      return true;
+  }
+}
+function parseVersion(input) {
+  const match = /(\d+)(\.\d+)*/.exec(input);
+  if (match === null) {
+    return void 0;
+  }
+  return match[0].split(".").map((part) => Number.parseInt(part, 10));
+}
+function compareVersions(a, b) {
+  for (let index = 0; index < Math.max(a.length, b.length); index += 1) {
+    const left = a[index] ?? 0;
+    const right = b[index] ?? 0;
+    if (left !== right) {
+      return left - right;
+    }
+  }
+  return 0;
+}
+var HEADROOM_SUPERVISOR_STILL_RUNNING = -1;
+async function runSupervisor(initialConfig, ports, options = {}) {
+  const { fs: fs2, paths } = ports;
+  let config = initialConfig;
+  const previousState = readHeadroomState(fs2, paths.headroomStateFile);
+  if (previousState?.supervisorPid !== void 0 && previousState.supervisorPid !== ports.ownPid && ports.isRunning(previousState.supervisorPid)) {
+    ports.log(`agent-shim headroom supervisor ${String(ports.ownPid)}: supervisor ${String(previousState.supervisorPid)} already owns the daemon; exiting`);
+    return 0;
+  }
+  let installedSource = previousState?.installedSource;
+  let lastPort = previousState?.lastPort;
+  const sticky = () => lastPort === void 0 ? {} : { lastPort };
+  const ownsState = () => {
+    const owner = readHeadroomState(fs2, paths.headroomStateFile)?.supervisorPid;
+    return owner === void 0 || owner === ports.ownPid || !ports.isRunning(owner);
+  };
+  const writeOwnState = (state) => {
+    if (!ownsState()) {
+      return false;
+    }
+    writeHeadroomState(fs2, paths.headroomStateFile, state);
+    return true;
+  };
+  const fail = (message) => {
+    if (writeOwnState({ lastError: message, ...sticky() })) {
+      fs2.removeRecursive(paths.headroomLockFile);
+    }
+    ports.log(`agent-shim headroom supervisor: ${message}`);
+    return 1;
+  };
+  const ensureInstalled = () => {
+    const version2 = ports.headroomVersion();
+    const versionOk = version2 !== void 0 && versionSatisfies(version2, config.source);
+    const pinned = pinnedGitCommit(config.source);
+    const commitOk = pinned === void 0 || ports.installedCommit() === pinned;
+    if (versionOk && commitOk && (installedSource === void 0 || installedSource === config.source)) {
+      installedSource = config.source;
+      return true;
+    }
+    ports.log(`agent-shim headroom supervisor: installing headroom from ${config.source}`);
+    const result = ports.install(config.source);
+    if (!result.ok) {
+      return false;
+    }
+    installedSource = config.source;
+    return true;
+  };
+  if (!ensureInstalled()) {
+    return fail(`could not install headroom from ${config.source}: install failed (is uv installed and on PATH?)`);
+  }
+  const version = ports.headroomVersion() ?? "unknown";
+  writeOwnState({ supervisorPid: ports.ownPid, version, installedSource, ...sticky() });
+  ports.log(`agent-shim headroom supervisor ${String(ports.ownPid)}: managing headroom on allowlist [${allowlistOf(ports).join(", ")}]`);
+  const orphanPid = previousState?.headroomPid;
+  if (orphanPid !== void 0 && ports.isRunning(orphanPid)) {
+    ports.log(`agent-shim headroom supervisor: stopping daemon pid ${String(orphanPid)} left behind by the previous supervisor`);
+    ports.stopProcess(orphanPid);
+  }
+  let headroomPid;
+  let runningHash;
+  let runningSettingsHash;
+  let consecutiveFailures = 0;
+  let idleSince;
+  let superseded = false;
+  let ticks = 0;
+  for (; ; ) {
+    if (options.tickLimit !== void 0 && ticks >= options.tickLimit) {
+      return HEADROOM_SUPERVISOR_STILL_RUNNING;
+    }
+    ticks += 1;
+    config = ports.readConfig();
+    const settingsHash = hashSettings(config.settings);
+    const allowlist = allowlistOf(ports);
+    const allowlistHash = hashAllowlist(allowlist);
+    pruneDeadSessions(fs2, paths.headroomSessionsDir, ports.isRunning);
+    const ownsNow = ownsState();
+    if (!ownsNow && !superseded) {
+      ports.log("agent-shim headroom supervisor: another supervisor now owns state.json; serving this daemon's own sessions until they end");
+    }
+    superseded = !ownsNow;
+    const crashed = headroomPid !== void 0 && !ports.isRunning(headroomPid);
+    if (headroomPid === void 0 || crashed) {
+      if (crashed) {
+        ports.log(`agent-shim headroom supervisor: headroom pid ${String(headroomPid)} died`);
+        headroomPid = void 0;
+        runningHash = void 0;
+        runningSettingsHash = void 0;
+        writeOwnState({
+          supervisorPid: ports.ownPid,
+          version,
+          installedSource,
+          ...sticky()
+        });
+      }
+      if (consecutiveFailures >= HEADROOM_START_RETRY_BUDGET) {
+        return fail(`headroom failed to become ready ${String(consecutiveFailures)} times in a row; giving up`);
+      }
+      if (installedSource !== config.source && !ensureInstalled()) {
+        return fail(`could not install headroom from ${config.source}: install failed (is uv installed and on PATH?)`);
+      }
+      const previousSticky = lastPort;
+      const port = lastPort !== void 0 && await ports.isPortFree(lastPort) ? lastPort : await ports.freePort();
+      const pid = ports.spawnHeadroom(port, allowlist, config.settings);
+      const ready = await waitUntilReady(ports, port);
+      if (ready) {
+        consecutiveFailures = 0;
+        headroomPid = pid;
+        runningHash = allowlistHash;
+        runningSettingsHash = settingsHash;
+        lastPort = port;
+        if (previousSticky !== void 0 && port !== previousSticky) {
+          ports.log(
+            `agent-shim headroom supervisor: sticky port ${String(previousSticky)} was occupied; moving to ${String(port)} (sessions launched against the old port are stale until they relaunch)`
+          );
+        }
+        const recorded = writeOwnState({
+          supervisorPid: ports.ownPid,
+          headroomPid: pid,
+          port,
+          version,
+          allowlistHash,
+          settingsHash,
+          installedSource: config.source,
+          ...sticky()
+        });
+        if (recorded) {
+          fs2.removeRecursive(paths.headroomLockFile);
+        }
+        idleSince = void 0;
+        ports.log(`agent-shim headroom supervisor: headroom pid ${String(pid)} ready on 127.0.0.1:${String(port)}`);
+      } else {
+        ports.stopProcess(pid);
+        consecutiveFailures += 1;
+        ports.log(
+          `agent-shim headroom supervisor: headroom did not become ready on port ${String(port)} (attempt ${String(consecutiveFailures)} of ${String(HEADROOM_START_RETRY_BUDGET)})`
+        );
+        await ports.sleep(backoffForAttempt(consecutiveFailures));
+        continue;
+      }
+    } else {
+      if (runningHash !== allowlistHash || runningSettingsHash !== settingsHash || installedSource !== config.source) {
+        if (sessionsForSupervisor(fs2, paths.headroomSessionsDir, ports.ownPid).length === 0) {
+          ports.log("agent-shim headroom supervisor: configuration drifted and no sessions are live; restarting headroom");
+          ports.stopProcess(headroomPid);
+          headroomPid = void 0;
+          runningHash = void 0;
+          runningSettingsHash = void 0;
+          continue;
+        }
+      }
+      const sessions = sessionsForSupervisor(fs2, paths.headroomSessionsDir, ports.ownPid);
+      if (sessions.length === 0) {
+        idleSince ??= ports.now();
+        const idleMs = ports.now() - idleSince;
+        if (idleMs >= config.idleShutdownMinutes * MS_PER_MINUTE2) {
+          ports.log(
+            `agent-shim headroom supervisor: no sessions for ${String(config.idleShutdownMinutes)} minute(s); stopping headroom and exiting`
+          );
+          ports.stopProcess(headroomPid);
+          writeOwnState({
+            version,
+            ...sticky()
+          });
+          return 0;
+        }
+      } else {
+        idleSince = void 0;
+      }
+    }
+    await ports.sleep(HEADROOM_POLL_MS);
+  }
+}
+function currentHeadroomAllowlist(fs2, paths) {
+  const providers = readAllProviders(fs2, paths.providersDir).map((entry) => entry.provider);
+  return headroomAllowlist(headroomUpstreams(providers, frontDoorOrigin(readFrontDoorState(fs2, paths.frontdoorStateFile))));
+}
+function allowlistOf(ports) {
+  return currentHeadroomAllowlist(ports.fs, ports.paths);
+}
+async function waitUntilReady(ports, port) {
+  const deadline = ports.now() + HEADROOM_READY_TIMEOUT_MS;
+  for (; ; ) {
+    if (await ports.ready(port)) {
+      return true;
+    }
+    if (ports.now() >= deadline) {
+      return false;
+    }
+    await ports.sleep(HEADROOM_POLL_MS);
+  }
+}
+
+// src/launcher/guard.ts
+var AMBIENT_CREDENTIAL_VARS = [
+  "ANTHROPIC_API_KEY",
+  "ANTHROPIC_AUTH_TOKEN",
+  "CLAUDE_CODE_OAUTH_TOKEN",
+  "CLAUDE_CODE_USE_BEDROCK",
+  "CLAUDE_CODE_USE_VERTEX",
+  "CLAUDE_CODE_USE_FOUNDRY"
+];
+function detectAmbientCredential(env, injected) {
+  for (const variable of AMBIENT_CREDENTIAL_VARS) {
+    const value = env[variable];
+    if (value === void 0 || value === "") {
+      continue;
+    }
+    if (injected?.variable === variable && value === injected.token) {
+      continue;
+    }
+    return { variable };
+  }
+  return void 0;
+}
+function formatAmbientCredentialGuardMessage(variable, identityName) {
+  const identitySetCommand = identityName === void 0 ? "agent-shim identity set <name> --allow-ambient-credential" : `agent-shim identity set ${identityName} --allow-ambient-credential`;
+  return [
+    `error: ${variable} is set in the environment. This identity's isolated`,
+    "credential would be bypassed \u2014 every identity authenticates as this same key",
+    "while it's set. Unset it, or if this is deliberate, opt in per-launch with",
+    "AGENT_SHIM_ALLOW_AMBIENT_CREDENTIAL=1, or persistently for this identity with",
+    `\`${identitySetCommand}\`.`
+  ].join("\n");
+}
+function evaluateAmbientCredentialGuard(params) {
+  const detected = detectAmbientCredential(params.env, params.injectedCredential);
+  if (detected === void 0) {
+    return { ok: true };
+  }
+  if (params.allowAmbientCredentialOverride || params.allowAmbientCredential || params.providerSelected === true) {
+    return { ok: true };
+  }
+  return {
+    ok: false,
+    variable: detected.variable,
+    message: formatAmbientCredentialGuardMessage(detected.variable, params.identityName)
+  };
+}
+export {
+  AMBIENT_CREDENTIAL_VARS,
+  CONNECT_INTERCEPT_HOST,
+  CONNECT_LIMITS,
+  FARM_MANIFEST_FILENAME,
+  FrontDoorStartError,
+  HeadroomStartError,
+  ROUTED_PATH_PREFIX,
+  UsageSnapshotError,
+  UsageSnapshotSchema,
+  buildEntryFacts,
+  carryOver,
+  createLeafCache,
+  detectAmbientCredential,
+  ensureCa,
+  ensureFrontDoor,
+  ensureHeadroom,
+  evaluateAmbientCredentialGuard,
+  formatAmbientCredentialGuardMessage,
+  forwardableHeaders,
+  generateCa,
+  isInterceptedHost,
+  listUsageSnapshots,
+  mintLeaf,
+  parseConnectTarget,
+  readFarmManifest,
+  readUsageSnapshot,
+  realConnectCertStore,
+  realConnectEffects,
+  recoverFarm,
+  recoveryDiagnostics,
+  resolveDecisions,
+  resolveSupervisorConfig,
+  resyncFarm,
+  runFrontDoorSupervisor,
+  runSupervisor,
+  servedByPipeline,
+  snapshotPath,
+  startConnectServer,
+  topLevelNames
+};