agent-shim 11.83.4 → 11.83.5

package/dist/cli.cjs

@@ -23762,9 +23762,9 @@ var require_env_paths = __commonJS({
   "node_modules/.pnpm/env-paths@2.2.1/node_modules/env-paths/index.js"(exports2, module2) {
     "use strict";
     var path79 = require("path");
-    var os16 = require("os");
-    var homedir = os16.homedir();
-    var tmpdir = os16.tmpdir();
+    var os17 = require("os");
+    var homedir = os17.homedir();
+    var tmpdir = os17.tmpdir();
     var { env } = process;
     var macos = (name) => {
       const library = path79.join(homedir, "Library");
@@ -36845,13 +36845,18 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
   });
   const { predecessor } = ports;
   const sourceOf = (listener, preferredPort) => predecessor === void 0 ? { preferredPort } : { inherit: async () => await predecessor.take(listener) };
-  const fail = (message) => {
+  const fail = async (message) => {
     ports.closeRcStreamHub();
     if (predecessor === void 0) {
       writeFrontDoorState(fs32, paths.frontdoorStateFile, { lastError: message, ...sticky() });
       fs32.removeRecursive(paths.frontdoorLockFile);
     }
     ports.log(`agent-shim frontdoor supervisor: ${message}`);
+    const chain = ports.respawnChain;
+    if (predecessor === void 0 && chain !== void 0 && chain.generation > 0) {
+      ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: this door is generation ${String(chain.generation)} of the watchdog's respawn chain and nothing waits on it, so it starts generation ${String(chain.generation + 1)} rather than leaving no door`);
+      await chain.startNext();
+    }
     return 1;
   };
   if (predecessor === void 0) {
@@ -36863,7 +36868,7 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
     http9 = await ports.startProviderListener(sourceOf("provider", lastPort));
   } catch (error63) {
     ports.doorHealth.listenerFailed("provider", error63 instanceof Error ? error63.message : String(error63));
-    return fail(`could not start the provider listener: ${error63 instanceof Error ? error63.message : String(error63)}`);
+    return await fail(`could not start the provider listener: ${error63 instanceof Error ? error63.message : String(error63)}`);
   }
   if (previousSticky !== void 0 && http9.port !== previousSticky) {
     ports.log(`agent-shim frontdoor supervisor: sticky port ${String(previousSticky)} was occupied; moving to ${String(http9.port)} (sessions launched against the old port are stale until they relaunch)`);
@@ -36876,7 +36881,7 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
   } catch (error63) {
     await http9.close();
     ports.doorHealth.listenerFailed("connect", error63 instanceof Error ? error63.message : String(error63));
-    return fail(`could not start the CONNECT surface: ${error63 instanceof Error ? error63.message : String(error63)}`);
+    return await fail(`could not start the CONNECT surface: ${error63 instanceof Error ? error63.message : String(error63)}`);
   }
   if (previousStickyConnect !== void 0 && connect3.port !== previousStickyConnect) {
     ports.log(`agent-shim frontdoor supervisor: sticky CONNECT port ${String(previousStickyConnect)} was occupied; moving to ${String(connect3.port)} (OAuth sessions launched against the old port are stale until they relaunch)`);
@@ -36890,7 +36895,7 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
     await connect3.close();
     await http9.close();
     ports.doorHealth.listenerFailed("direct", error63 instanceof Error ? error63.message : String(error63));
-    return fail(`could not start the direct listener: ${error63 instanceof Error ? error63.message : String(error63)}`);
+    return await fail(`could not start the direct listener: ${error63 instanceof Error ? error63.message : String(error63)}`);
   }
   if (previousStickyDirect !== void 0 && direct.port !== previousStickyDirect) {
     ports.log(`agent-shim frontdoor supervisor: sticky direct port ${String(previousStickyDirect)} was occupied; moving to ${String(direct.port)} (headroom admits the new address once its supervisor rewrites the allowlist file)`);
@@ -39981,7 +39986,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "agent-shim",
-      version: "11.83.4",
+      version: "11.83.5",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -126078,6 +126083,17 @@ var import_node_https = __toESM(require("node:https"), 1);
 var import_node_net2 = __toESM(require("node:net"), 1);
 init_legacy();
 
+// src/frontdoor/machineLoad.ts
+var import_node_os14 = __toESM(require("node:os"), 1);
+var processorShare = (reading) => reading.loadAverage <= reading.cpus ? 1 : reading.cpus / reading.loadAverage;
+function readMachineLoad() {
+  const [oneMinute] = import_node_os14.default.loadavg();
+  if (oneMinute === void 0) {
+    throw new Error("os.loadavg() returned no one-minute load average");
+  }
+  return { loadAverage: oneMinute, cpus: import_node_os14.default.cpus().length };
+}
+
 // src/frontdoor/rcControl.ts
 var https = __toESM(require("node:https"), 1);
 init_capability();
@@ -126764,35 +126780,54 @@ async function listenFrontDoor(server, options = {}) {
   if (options.onError !== void 0) {
     server.on("error", options.onError);
   }
-  const deadline = Date.now() + HEALTH_START_BUDGET_MS;
+  await awaitStartHealth(
+    {
+      probe: async () => await frontDoorHealthy(bound, ca2),
+      now: () => Date.now(),
+      sleep: async (ms) => {
+        await new Promise((resolve3) => {
+          setTimeout(resolve3, ms);
+        });
+      },
+      readLoad: readMachineLoad
+    },
+    `127.0.0.1:${String(bound)}`
+  );
+  return {
+    port: bound,
+    close: async () => {
+      await new Promise((resolve3) => {
+        server.close(() => {
+          resolve3(void 0);
+        });
+        server.closeAllConnections();
+      });
+    },
+    // The port is released as the close runs, before the first await (see `trackConnections` for what happens to the connections already accepted).
+    drain: async () => {
+      await new Promise((resolve3) => {
+        connections.drain(() => {
+          resolve3(void 0);
+        });
+      });
+    }
+  };
+}
+async function awaitStartHealth(ports, address) {
+  const startedAt = ports.now();
+  let scheduledMs = 0;
+  let countedTo = startedAt;
   for (; ; ) {
-    if (await frontDoorHealthy(bound, ca2)) {
-      return {
-        port: bound,
-        close: async () => {
-          await new Promise((resolve3) => {
-            server.close(() => {
-              resolve3(void 0);
-            });
-            server.closeAllConnections();
-          });
-        },
-        // The port is released as the close runs, before the first await (see `trackConnections` for what happens to the connections already accepted).
-        drain: async () => {
-          await new Promise((resolve3) => {
-            connections.drain(() => {
-              resolve3(void 0);
-            });
-          });
-        }
-      };
+    if (await ports.probe()) {
+      return;
     }
-    if (Date.now() >= deadline) {
-      throw new Error(`the front door listener on 127.0.0.1:${String(bound)} did not answer its health probe`);
+    const now = ports.now();
+    scheduledMs += (now - countedTo) * processorShare(ports.readLoad());
+    countedTo = now;
+    if (scheduledMs >= HEALTH_START_BUDGET_MS) {
+      throw new Error(`the front door listener on ${address} did not answer its health probe within ${String(HEALTH_START_BUDGET_MS)}ms of processor time (${String(now - startedAt)}ms of wall time)`);
     }
-    await new Promise((resolve3) => {
-      setTimeout(resolve3, HEALTH_RETRY_MS);
-    });
+    await ports.sleep(HEALTH_RETRY_MS);
   }
 }
 function trackConnections(server) {
@@ -134484,7 +134519,7 @@ var Builder = class _Builder {
     });
   }
 };
-var os13 = Builder.create();
+var os14 = Builder.create();
 
 // node_modules/.pnpm/@orpc+openapi@2.0.0-beta.43/node_modules/@orpc/openapi/dist/index.mjs
 var DEFS_REF_PREFIX = "#/$defs/";
@@ -138848,7 +138883,7 @@ function doorApiBearer(headers) {
   return typeof presented === "string" && presented.slice(0, bearerPrefix).toLowerCase() === "bearer " ? presented.slice(bearerPrefix) : void 0;
 }
 function doorApiAuth(expectedToken) {
-  return os13.$context().use(({ context, next }) => {
+  return os14.$context().use(({ context, next }) => {
     const token = doorApiBearer(context.headers);
     if (token === void 0 || !isLiveCapability(token, [expectedToken])) {
       throw new ORPCError("UNAUTHORIZED", { message: "the front door's typed API demands this generation's control token as a Bearer credential" });
@@ -145631,6 +145666,72 @@ var DOOR_RESPAWN_MAX_GENERATIONS = 3;
 var DOOR_RESPAWN_COOLDOWN_CAP_MS = DOOR_STALL_BOUND_MS * DOOR_RESPAWN_MAX_GENERATIONS;
 var CHECKS_PER_PROBE_DEADLINE = 2;
 var DOOR_WATCHDOG_CHECK_MS = PROBE_TIMEOUT_MS / CHECKS_PER_PROBE_DEADLINE;
+var RESPAWN_SOURCE = `
+const log = (line) => {
+  if (logFile === undefined) return;
+  try {
+    fs.appendFileSync(logFile, new Date().toISOString() + " frontdoor " + String(ownPid) + ": " + line + "\\n");
+  } catch (error) {
+    // Nowhere left to report a failed log write to; the thread's work goes on without it.
+  }
+};
+// Whether a process is alive: signal 0 only tests, and EPERM means it exists under another user.
+const isRunning = (pid) => {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+};
+// The pid holding the start lock when that holder is alive, which means a door is already being started and another must not be: the launcher's ensure and this respawn are the two things that start a door, and the lock is the one protocol that keeps them from starting two. A dead holder's lock is litter and is cleared, exactly as the launcher's ensure clears it.
+const liveLockHolder = () => {
+  let holder;
+  try {
+    holder = JSON.parse(fs.readFileSync(startLockFile, "utf8")).pid;
+  } catch (error) {
+    return undefined;
+  }
+  if (typeof holder === "number" && isRunning(holder)) return holder;
+  fs.rmSync(startLockFile, { force: true });
+  return undefined;
+};
+// Creates the lock naming the replacement as its holder, atomically (the wx flag), so the launcher's ensure sees a live holder while the replacement boots and waits for it instead of starting a door of its own; the replacement removes the lock once it is serving, as every door does.
+const claimStartLock = (holder) => {
+  try {
+    fs.writeFileSync(startLockFile, JSON.stringify({ pid: holder, at: Date.now() }) + "\\n", { flag: "wx" });
+    return true;
+  } catch (error) {
+    if (error.code === "EEXIST") return false;
+    throw error;
+  }
+};
+const spawnReplacement = () => {
+  if (respawn === undefined || logFile === undefined) return;
+  const nextGeneration = respawnGeneration + 1;
+  const cooldownMs = Math.min(Math.max(0, nextGeneration - respawnMaxGeneration) * cooldownStepMs, cooldownCapMs);
+  const startingBy = liveLockHolder();
+  if (startingBy !== undefined) {
+    log("not starting a replacement: process " + String(startingBy) + " holds the start lock, so a door is already being started and a second one would race it for the sticky ports");
+    return;
+  }
+  try {
+    const out = fs.openSync(logFile, "a");
+    const child = require("node:child_process").spawn(respawn.command, respawn.args, { detached: true, stdio: ["ignore", out, out], env: Object.assign({}, respawn.env, { [awaitPidEnv]: String(ownPid), [respawnGenerationEnv]: String(nextGeneration), [delayEnv]: String(cooldownMs) }) });
+    child.unref();
+    fs.closeSync(out);
+    if (!claimStartLock(child.pid)) {
+      // A launcher took the lock between the check and the spawn, so its door is the one that is starting: this one must not also bind.
+      process.kill(child.pid, "SIGKILL");
+      log("withdrew replacement door " + String(child.pid) + ": a launcher took the start lock first and its door is the one starting");
+      return;
+    }
+    log("started replacement door " + String(child.pid) + " of generation " + String(nextGeneration) + ", which binds once this process is gone" + (cooldownMs > 0 ? " and a " + String(cooldownMs) + "ms cooldown has passed, since the chain has gone through " + String(respawnMaxGeneration) + " consecutive replacements" : ""));
+  } catch (error) {
+    log("could not start a replacement door: " + (error instanceof Error ? error.message : String(error)));
+  }
+};
+`;
 var WATCHDOG_SOURCE = `
 const { workerData, parentPort } = require("node:worker_threads");
 const fs = require("node:fs");
@@ -145647,7 +145748,8 @@ let scheduledMs = 0;
 let waitingOutStarvation = false;
 let stopped = false;
 const readLoad = () => machineLoad === undefined ? { loadAverage: os.loadavg()[0], cpus: os.cpus().length } : machineLoad;
-const processorShare = (reading) => reading.loadAverage <= reading.cpus ? 1 : reading.cpus / reading.loadAverage;
+// The main thread's own formula, embedded as its source text (see \`processorShare\`), so the stall bound and the start-up probe budget are counted alike.
+const processorShare = ${processorShare.toString()};
 const describeLoad = (reading) => reading.loadAverage.toFixed(1) + " across " + String(reading.cpus) + " cpus";
 const record = (message) => {
   try {
@@ -145660,14 +145762,7 @@ const record = (message) => {
     // The state file is a courtesy to whoever looks next; the process still has to end.
   }
 };
-const log = (line) => {
-  if (logFile === undefined) return;
-  try {
-    fs.appendFileSync(logFile, new Date().toISOString() + " frontdoor " + String(ownPid) + ": " + line + "\\n");
-  } catch (error) {
-    // Nowhere left to report a failed log write to; the process still has to end.
-  }
-};
+${RESPAWN_SOURCE}
 const MS_PER_SECOND = 1000;
 // Enough of the stack to read the caller chain from the timer or socket callback down to the call that held the loop.
 const STACK_FRAMES_LOGGED = 12;
@@ -145708,62 +145803,6 @@ const describeMainThread = (waitMs, resume) => new Promise((resolve) => {
     finish("the main thread could not be inspected: " + (error instanceof Error ? error.message : String(error)));
   }
 });
-// Whether a process is alive: signal 0 only tests, and EPERM means it exists under another user.
-const isRunning = (pid) => {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error) {
-    return error.code === "EPERM";
-  }
-};
-// The pid holding the start lock when that holder is alive, which means a door is already being started and another must not be: the launcher's ensure and this respawn are the two things that start a door, and the lock is the one protocol that keeps them from starting two. A dead holder's lock is litter and is cleared, exactly as the launcher's ensure clears it.
-const liveLockHolder = () => {
-  let holder;
-  try {
-    holder = JSON.parse(fs.readFileSync(startLockFile, "utf8")).pid;
-  } catch (error) {
-    return undefined;
-  }
-  if (typeof holder === "number" && isRunning(holder)) return holder;
-  fs.rmSync(startLockFile, { force: true });
-  return undefined;
-};
-// Creates the lock naming the replacement as its holder, atomically (the wx flag), so the launcher's ensure sees a live holder while the replacement boots and waits for it instead of starting a door of its own; the replacement removes the lock once it is serving, as every door does.
-const claimStartLock = (holder) => {
-  try {
-    fs.writeFileSync(startLockFile, JSON.stringify({ pid: holder, at: Date.now() }) + "\\n", { flag: "wx" });
-    return true;
-  } catch (error) {
-    if (error.code === "EEXIST") return false;
-    throw error;
-  }
-};
-const spawnReplacement = () => {
-  if (respawn === undefined || logFile === undefined) return;
-  const nextGeneration = respawnGeneration + 1;
-  const cooldownMs = Math.min(Math.max(0, nextGeneration - respawnMaxGeneration) * cooldownStepMs, cooldownCapMs);
-  const startingBy = liveLockHolder();
-  if (startingBy !== undefined) {
-    log("not starting a replacement: process " + String(startingBy) + " holds the start lock, so a door is already being started and a second one would race it for the sticky ports");
-    return;
-  }
-  try {
-    const out = fs.openSync(logFile, "a");
-    const child = require("node:child_process").spawn(respawn.command, respawn.args, { detached: true, stdio: ["ignore", out, out], env: Object.assign({}, respawn.env, { [awaitPidEnv]: String(ownPid), [respawnGenerationEnv]: String(nextGeneration), [delayEnv]: String(cooldownMs) }) });
-    child.unref();
-    fs.closeSync(out);
-    if (!claimStartLock(child.pid)) {
-      // A launcher took the lock between the check and the spawn, so its door is the one that is starting: this one must not also bind.
-      process.kill(child.pid, "SIGKILL");
-      log("withdrew replacement door " + String(child.pid) + ": a launcher took the start lock first and its door is the one starting");
-      return;
-    }
-    log("started replacement door " + String(child.pid) + " of generation " + String(nextGeneration) + ", which binds once this process is gone" + (cooldownMs > 0 ? " and a " + String(cooldownMs) + "ms cooldown has passed, since the stall has recurred through " + String(respawnMaxGeneration) + " consecutive replacements" : ""));
-  } catch (error) {
-    log("could not start a replacement door: " + (error instanceof Error ? error.message : String(error)));
-  }
-};
 // Captures where a main thread that could not be paused is held natively, with the platform's own sampler, so a stall the inspector cannot name still leaves a stack to read. The wait is the sampling time plus the sampler's start-up and symbolication, stretched by the processor share the machine's load leaves it, and the capture never delays the process ending beyond that. The sampler writes its report only once it has finished, so one ended at the deadline, or one that failed, leaves no file, and the log says which rather than naming a file that is not there.
 const takeNativeSample = () => new Promise((resolve) => {
   if (nativeSample === undefined) { resolve(); return; }
@@ -145854,12 +145893,13 @@ parentPort.on("message", (message) => {
   }
 });
 `;
+var RESPAWN_ENV_NAMES = { awaitPidEnv: DOOR_AWAIT_PID_ENV, respawnGenerationEnv: DOOR_RESPAWN_GENERATION_ENV, delayEnv: DOOR_RESPAWN_DELAY_ENV };
 function startThreadWatchdog(params) {
   const shared = new SharedArrayBuffer(Int32Array.BYTES_PER_ELEMENT);
   const counter = new Int32Array(shared);
   const worker = new import_node_worker_threads2.Worker(WATCHDOG_SOURCE, {
     eval: true,
-    workerData: { shared, boundMs: params.boundMs, checkEveryMs: params.checkEveryMs, pauseWaitMs: params.pauseWaitMs, stateFile: params.stateFile, ownPid: params.ownPid, action: params.action, logFile: params.logFile, respawn: params.respawn, respawnGeneration: params.respawnGeneration, respawnMaxGeneration: params.respawnMaxGeneration, cooldownStepMs: params.cooldownStepMs, cooldownCapMs: params.cooldownCapMs, startLockFile: params.startLockFile, awaitPidEnv: DOOR_AWAIT_PID_ENV, respawnGenerationEnv: DOOR_RESPAWN_GENERATION_ENV, delayEnv: DOOR_RESPAWN_DELAY_ENV, nativeSample: params.nativeSample, machineLoad: params.machineLoad }
+    workerData: { shared, boundMs: params.boundMs, checkEveryMs: params.checkEveryMs, pauseWaitMs: params.pauseWaitMs, stateFile: params.stateFile, ownPid: params.ownPid, action: params.action, logFile: params.logFile, respawn: params.respawn, respawnGeneration: params.respawnGeneration, respawnMaxGeneration: params.respawnMaxGeneration, cooldownStepMs: params.cooldownStepMs, cooldownCapMs: params.cooldownCapMs, startLockFile: params.startLockFile, ...RESPAWN_ENV_NAMES, nativeSample: params.nativeSample, machineLoad: params.machineLoad }
   });
   worker.unref();
   const beat = setInterval(() => {
@@ -145884,6 +145924,25 @@ function startThreadWatchdog(params) {
     }
   };
 }
+var NEXT_GENERATION_SOURCE = `
+const { workerData } = require("node:worker_threads");
+const fs = require("node:fs");
+const { ownPid, logFile, respawn, respawnGeneration, respawnMaxGeneration, cooldownStepMs, cooldownCapMs, startLockFile, awaitPidEnv, respawnGenerationEnv, delayEnv } = workerData;
+${RESPAWN_SOURCE}
+spawnReplacement();
+`;
+async function startNextRespawnGeneration(params) {
+  const worker = new import_node_worker_threads2.Worker(NEXT_GENERATION_SOURCE, {
+    eval: true,
+    workerData: { ownPid: params.ownPid, logFile: params.logFile, respawn: params.respawn, respawnGeneration: params.respawnGeneration, respawnMaxGeneration: params.respawnMaxGeneration, cooldownStepMs: params.cooldownStepMs, cooldownCapMs: params.cooldownCapMs, startLockFile: params.startLockFile, ...RESPAWN_ENV_NAMES }
+  });
+  await new Promise((resolve3, reject) => {
+    worker.once("error", reject);
+    worker.once("exit", () => {
+      resolve3();
+    });
+  });
+}
 
 // src/frontdoor/commands.ts
 init_probe();
@@ -146049,6 +146108,16 @@ function realFrontDoorSupervisorPorts(paths, respawnGeneration, lifecycle, track
   const log = (line) => {
     appendDoorLog(paths, `frontdoor ${String(process.pid)}: ${line}`);
   };
+  const respawnChain = () => ({
+    ownPid: process.pid,
+    logFile: paths.frontdoorLogPath,
+    respawn: respawnInvocation(paths),
+    respawnGeneration,
+    respawnMaxGeneration: DOOR_RESPAWN_MAX_GENERATIONS,
+    cooldownStepMs: DOOR_STALL_BOUND_MS,
+    cooldownCapMs: DOOR_RESPAWN_COOLDOWN_CAP_MS,
+    startLockFile: paths.frontdoorLockFile
+  });
   let directPort = 0;
   const rcSelfHost = rcSelfHostFromEnv(process.env);
   const codexPorts = createCodexRoutePorts(log, paths.chatgptSignInFile);
@@ -146500,20 +146569,19 @@ function realFrontDoorSupervisorPorts(paths, respawnGeneration, lifecycle, track
       return { port: handle.port, listening: server, close: handle.close, drain: handle.drain };
     },
     closeRcStreamHub: rcHub.close,
+    respawnChain: {
+      generation: respawnGeneration,
+      startNext: async () => {
+        await startNextRespawnGeneration(respawnChain());
+      }
+    },
     startWatchdog: () => startThreadWatchdog({
+      ...respawnChain(),
       stateFile: paths.frontdoorStateFile,
-      ownPid: process.pid,
       boundMs: DOOR_STALL_BOUND_MS,
       checkEveryMs: DOOR_WATCHDOG_CHECK_MS,
       pauseWaitMs: DOOR_WATCHDOG_CHECK_MS,
       action: "kill-process",
-      logFile: paths.frontdoorLogPath,
-      respawn: respawnInvocation(paths),
-      respawnGeneration,
-      respawnMaxGeneration: DOOR_RESPAWN_MAX_GENERATIONS,
-      cooldownStepMs: DOOR_STALL_BOUND_MS,
-      cooldownCapMs: DOOR_RESPAWN_COOLDOWN_CAP_MS,
-      startLockFile: paths.frontdoorLockFile,
       ...process.platform === "darwin" ? { nativeSample: { command: MACOS_SAMPLER, args: ["{pid}", "{seconds}", "-file", "{file}"], directory: import_node_path61.default.join(import_node_path61.default.dirname(paths.frontdoorLogPath), "stall-samples"), seconds: Math.max(1, Math.ceil(DOOR_WATCHDOG_CHECK_MS / MS_PER_SECOND17)), overheadMs: PROBE_TIMEOUT_MS, keep: DOOR_RESPAWN_MAX_GENERATIONS + 1 } } : {}
     }),
     // The launch lifecycle publisher over the same backbone the typed API serves: the tick's registry facts go in here, and the door's own register, prune and end moments come out as source-tagged events.
@@ -146627,7 +146695,7 @@ function registerFrontDoorCommand(program2, deps) {
 
 // src/statusline/commands.ts
 var import_node_child_process9 = require("node:child_process");
-var import_node_os15 = __toESM(require("node:os"), 1);
+var import_node_os16 = __toESM(require("node:os"), 1);
 var import_node_path70 = __toESM(require("node:path"), 1);
 init_commandDeps();
 init_load();
@@ -147418,7 +147486,7 @@ function contextViewOf(frame) {
 // src/statusline/ports.ts
 init_blockingSpawn();
 var import_node_fs26 = __toESM(require("node:fs"), 1);
-var import_node_os14 = __toESM(require("node:os"), 1);
+var import_node_os15 = __toESM(require("node:os"), 1);
 var import_node_path63 = __toESM(require("node:path"), 1);
 
 // src/statusline/memoryUse.ts
@@ -147552,7 +147620,7 @@ function discard(target) {
   }
 }
 function readMemoryUse() {
-  const totalBytes = import_node_os14.default.totalmem();
+  const totalBytes = import_node_os15.default.totalmem();
   if (process.platform === "darwin") {
     const output2 = runWithPipe(RUN_TIMEOUT_MS, "/usr/bin/vm_stat", [], process.cwd());
     const usedBytes = output2 === void 0 ? void 0 : usedBytesFromVmStat(output2);
@@ -147562,13 +147630,13 @@ function readMemoryUse() {
     const meminfo = readText("/proc/meminfo");
     return meminfo === void 0 ? void 0 : memoryUseFromMeminfo(meminfo);
   }
-  return { usedBytes: totalBytes - import_node_os14.default.freemem(), totalBytes };
+  return { usedBytes: totalBytes - import_node_os15.default.freemem(), totalBytes };
 }
 function realStatuslinePorts(env, stateDirectory, runTimeoutMs = RUN_TIMEOUT_MS) {
   const { locale, timeZone } = Intl.DateTimeFormat().resolvedOptions();
   return {
     env,
-    homeDirectory: import_node_os14.default.homedir(),
+    homeDirectory: import_node_os15.default.homedir(),
     stateDirectory,
     clock: { locale, timeZone },
     readText,
@@ -151240,7 +151308,7 @@ function registerStatuslineCommand(program2, deps) {
       } else {
         const configDir = process.env.CLAUDE_CONFIG_DIR;
         try {
-          account = readAccountMetadataFile(realFarmFs, configDir === void 0 || configDir === "" ? import_node_path70.default.join(import_node_os15.default.homedir(), ".claude.json") : import_node_path70.default.join(configDir, ".claude.json"));
+          account = readAccountMetadataFile(realFarmFs, configDir === void 0 || configDir === "" ? import_node_path70.default.join(import_node_os16.default.homedir(), ".claude.json") : import_node_path70.default.join(configDir, ".claude.json"));
         } catch {
           account = void 0;
         }
@@ -151289,7 +151357,7 @@ function registerStatuslineCommand(program2, deps) {
         });
         return;
       }
-      const live = statuslineSettingsForRender({ env: process.env, cwd: process.cwd(), home: import_node_os15.default.homedir(), paths: deps.paths, fs: { ...realFsPort, readConfigFile: cosmiconfigReader() } });
+      const live = statuslineSettingsForRender({ env: process.env, cwd: process.cwd(), home: import_node_os16.default.homedir(), paths: deps.paths, fs: { ...realFsPort, readConfigFile: cosmiconfigReader() } });
       if (live.problem !== void 0) {
         process.stderr.write(`agent-shim: statusline: ${live.problem}. Drawing with the defaults.
 `);
@@ -151302,7 +151370,7 @@ function registerStatuslineCommand(program2, deps) {
       let stackedUnderDefault = false;
       if (isAntigravityPayload(payload)) {
         try {
-          stackedUnderDefault = antigravityStacksWithDefault(realFarmFs, import_node_os15.default.homedir());
+          stackedUnderDefault = antigravityStacksWithDefault(realFarmFs, import_node_os16.default.homedir());
         } catch {
           stackedUnderDefault = false;
         }

package/dist/index.cjs

@@ -4183,13 +4183,18 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
   });
   const { predecessor } = ports;
   const sourceOf = (listener, preferredPort) => predecessor === void 0 ? { preferredPort } : { inherit: async () => await predecessor.take(listener) };
-  const fail = (message) => {
+  const fail = async (message) => {
     ports.closeRcStreamHub();
     if (predecessor === void 0) {
       writeFrontDoorState(fs15, paths.frontdoorStateFile, { lastError: message, ...sticky() });
       fs15.removeRecursive(paths.frontdoorLockFile);
     }
     ports.log(`agent-shim frontdoor supervisor: ${message}`);
+    const chain = ports.respawnChain;
+    if (predecessor === void 0 && chain !== void 0 && chain.generation > 0) {
+      ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: this door is generation ${String(chain.generation)} of the watchdog's respawn chain and nothing waits on it, so it starts generation ${String(chain.generation + 1)} rather than leaving no door`);
+      await chain.startNext();
+    }
     return 1;
   };
   if (predecessor === void 0) {
@@ -4201,7 +4206,7 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
     http3 = await ports.startProviderListener(sourceOf("provider", lastPort));
   } catch (error) {
     ports.doorHealth.listenerFailed("provider", error instanceof Error ? error.message : String(error));
-    return fail(`could not start the provider listener: ${error instanceof Error ? error.message : String(error)}`);
+    return await fail(`could not start the provider listener: ${error instanceof Error ? error.message : String(error)}`);
   }
   if (previousSticky !== void 0 && http3.port !== previousSticky) {
     ports.log(`agent-shim frontdoor supervisor: sticky port ${String(previousSticky)} was occupied; moving to ${String(http3.port)} (sessions launched against the old port are stale until they relaunch)`);
@@ -4214,7 +4219,7 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
   } catch (error) {
     await http3.close();
     ports.doorHealth.listenerFailed("connect", error instanceof Error ? error.message : String(error));
-    return fail(`could not start the CONNECT surface: ${error instanceof Error ? error.message : String(error)}`);
+    return await fail(`could not start the CONNECT surface: ${error instanceof Error ? error.message : String(error)}`);
   }
   if (previousStickyConnect !== void 0 && connect3.port !== previousStickyConnect) {
     ports.log(`agent-shim frontdoor supervisor: sticky CONNECT port ${String(previousStickyConnect)} was occupied; moving to ${String(connect3.port)} (OAuth sessions launched against the old port are stale until they relaunch)`);
@@ -4228,7 +4233,7 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
     await connect3.close();
     await http3.close();
     ports.doorHealth.listenerFailed("direct", error instanceof Error ? error.message : String(error));
-    return fail(`could not start the direct listener: ${error instanceof Error ? error.message : String(error)}`);
+    return await fail(`could not start the direct listener: ${error instanceof Error ? error.message : String(error)}`);
   }
   if (previousStickyDirect !== void 0 && direct.port !== previousStickyDirect) {
     ports.log(`agent-shim frontdoor supervisor: sticky direct port ${String(previousStickyDirect)} was occupied; moving to ${String(direct.port)} (headroom admits the new address once its supervisor rewrites the allowlist file)`);
@@ -4848,7 +4853,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "agent-shim",
-      version: "11.83.4",
+      version: "11.83.5",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",

package/dist/index.mjs

@@ -4160,13 +4160,18 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
   });
   const { predecessor } = ports;
   const sourceOf = (listener, preferredPort) => predecessor === void 0 ? { preferredPort } : { inherit: async () => await predecessor.take(listener) };
-  const fail = (message) => {
+  const fail = async (message) => {
     ports.closeRcStreamHub();
     if (predecessor === void 0) {
       writeFrontDoorState(fs15, paths.frontdoorStateFile, { lastError: message, ...sticky() });
       fs15.removeRecursive(paths.frontdoorLockFile);
     }
     ports.log(`agent-shim frontdoor supervisor: ${message}`);
+    const chain = ports.respawnChain;
+    if (predecessor === void 0 && chain !== void 0 && chain.generation > 0) {
+      ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: this door is generation ${String(chain.generation)} of the watchdog's respawn chain and nothing waits on it, so it starts generation ${String(chain.generation + 1)} rather than leaving no door`);
+      await chain.startNext();
+    }
     return 1;
   };
   if (predecessor === void 0) {
@@ -4178,7 +4183,7 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
     http3 = await ports.startProviderListener(sourceOf("provider", lastPort));
   } catch (error) {
     ports.doorHealth.listenerFailed("provider", error instanceof Error ? error.message : String(error));
-    return fail(`could not start the provider listener: ${error instanceof Error ? error.message : String(error)}`);
+    return await fail(`could not start the provider listener: ${error instanceof Error ? error.message : String(error)}`);
   }
   if (previousSticky !== void 0 && http3.port !== previousSticky) {
     ports.log(`agent-shim frontdoor supervisor: sticky port ${String(previousSticky)} was occupied; moving to ${String(http3.port)} (sessions launched against the old port are stale until they relaunch)`);
@@ -4191,7 +4196,7 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
   } catch (error) {
     await http3.close();
     ports.doorHealth.listenerFailed("connect", error instanceof Error ? error.message : String(error));
-    return fail(`could not start the CONNECT surface: ${error instanceof Error ? error.message : String(error)}`);
+    return await fail(`could not start the CONNECT surface: ${error instanceof Error ? error.message : String(error)}`);
   }
   if (previousStickyConnect !== void 0 && connect3.port !== previousStickyConnect) {
     ports.log(`agent-shim frontdoor supervisor: sticky CONNECT port ${String(previousStickyConnect)} was occupied; moving to ${String(connect3.port)} (OAuth sessions launched against the old port are stale until they relaunch)`);
@@ -4205,7 +4210,7 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
     await connect3.close();
     await http3.close();
     ports.doorHealth.listenerFailed("direct", error instanceof Error ? error.message : String(error));
-    return fail(`could not start the direct listener: ${error instanceof Error ? error.message : String(error)}`);
+    return await fail(`could not start the direct listener: ${error instanceof Error ? error.message : String(error)}`);
   }
   if (previousStickyDirect !== void 0 && direct.port !== previousStickyDirect) {
     ports.log(`agent-shim frontdoor supervisor: sticky direct port ${String(previousStickyDirect)} was occupied; moving to ${String(direct.port)} (headroom admits the new address once its supervisor rewrites the allowlist file)`);
@@ -4824,7 +4829,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "agent-shim",
-      version: "11.83.4",
+      version: "11.83.5",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",

package/dist/types/index.d.ts

@@ -26355,6 +26355,13 @@ interface FrontDoorSupervisorPorts {
      * The door this one replaces through a handover, when it was started for one: its listeners are adopted from that door's sockets instead of bound, the state file is not written until this door accepts on all three (the old door owns it and keeps serving until then), and the old door is told once this door serves. Absent for every other start.
      */
     readonly predecessor?: Predecessor;
+    /**
+     * The watchdog's respawn chain this door belongs to: `generation` is how many watchdog replacements produced it (0 for a door a launch or `frontdoor restart` started), and `startNext` starts the door of the next generation the way the watchdog starts one on a stall (see `startNextRespawnGeneration`). A door of generation 1 or more whose start fails calls `startNext` before it exits, once its listeners are down and it has released the start lock, because nobody else would start a door: the stalled door that started it is gone and no launch is waiting on it, so every registered session would get connection refused until some later launch happened to start one. A door a launch started reports its failure to that launch instead, and a handover successor leaves the door it was replacing serving. Optional for a host that does not respawn.
+     */
+    readonly respawnChain?: {
+        readonly generation: number;
+        readonly startNext: () => Promise<void>;
+    };
     /** Stops the work the door runs on its own account rather than for a request (the usage, window, job and catalogue keepers), called once when a drain begins so the successor's are the only ones acting. Optional because a host without such work has nothing to stop. */
     readonly stopBackgroundWork?: () => void;
     /**
@@ -26383,7 +26390,7 @@ interface RunFrontDoorSupervisorOptions {
 /**
  * Runs the front-door supervisor: binds all three listeners (the HTTPS provider listener, the CONNECT surface and the plain-HTTP direct listener, each on its sticky port), records the serving state, and shuts down with an empty session registry, either at the first such tick after the executable it serves as has been replaced on disk (so an applied update reaches the door without waiting out the idle window) or after `idleShutdownMinutes` of it. A door whose state file comes to name another live supervisor is superseded: from then on it takes no new sessions, never writes the state file again, and exits as soon as the sessions it was serving have ended. Returns the exit code: 0 for any of these retirements, 1 for a fatal start failure.
  *
- * The listeners live in this process, so there is no child to keep alive: a crash of this process is a crash of every routed session's door at once, and recovery is the next launch's ensure spawning a replacement on the same sticky ports, which is exactly the failure model the issue asks to settle with tests. Keeping the headroom daemon alive is the headroom supervisor's job, not this one's; the two daemons idle out independently.
+ * The listeners live in this process, so there is no child to keep alive: a crash of this process is a crash of every routed session's door at once, and recovery is the next launch's ensure spawning a replacement on the same sticky ports, or, for a stall or a failed start in a door the watchdog's respawn chain started, the next generation of that chain (see `FrontDoorSupervisorPorts.respawnChain`). Keeping the headroom daemon alive is the headroom supervisor's job, not this one's; the two daemons idle out independently.
  */
 declare function runFrontDoorSupervisor(idleShutdownMinutes: number, ports: FrontDoorSupervisorPorts, options?: RunFrontDoorSupervisorOptions): Promise<number>;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-shim",
-  "version": "11.83.4",
+  "version": "11.83.5",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",