agent-shim 11.84.0 → 11.84.1

package/dist/index.mjs

@@ -1278,7 +1278,7 @@ function parseIgnoringUnrecognisedKeys(schema, raw) {
   return second.success ? { success: true, data: second.data, ignored } : { success: false, issues: second.error.issues };
 }
 function describeIgnoredKeys(filePath, ignored) {
-  const places = ignored.map(({ path: path48, keys }) => `${path48.length === 0 ? "" : `${path48.map(String).join(".")}.`}${keys.join(", ")}`);
+  const places = ignored.map(({ path: path49, keys }) => `${path49.length === 0 ? "" : `${path49.map(String).join(".")}.`}${keys.join(", ")}`);
   return `${filePath} has settings this version of agent-shim does not know and ignores: ${places.join("; ")}. A newer release may read them.`;
 }
 function noteIgnoredKeys(filePath, ignored) {
@@ -1300,9 +1300,9 @@ function restoreIgnoredKeys(filePath, value) {
     return value;
   }
   const restored = structuredClone(value);
-  for (const { path: path48, values } of ignored) {
+  for (const { path: path49, values } of ignored) {
     let holder = restored;
-    for (const step of path48) {
+    for (const step of path49) {
       holder = isRecord(holder) ? holder[step] : void 0;
     }
     if (isRecord(holder)) {
@@ -3022,8 +3022,8 @@ var init_lock = __esm({
 // src/launcher/farm.ts
 import path8 from "node:path";
 import { z as z4 } from "zod";
-function readFarmManifest(fs15, farmRoot) {
-  const raw = fs15.readFileUtf8(path8.join(farmRoot, FARM_MANIFEST_FILENAME)) ?? fs15.readFileUtf8(path8.join(farmRoot, LEGACY_FARM_MANIFEST_FILENAME));
+function readFarmManifest(fs16, farmRoot) {
+  const raw = fs16.readFileUtf8(path8.join(farmRoot, FARM_MANIFEST_FILENAME)) ?? fs16.readFileUtf8(path8.join(farmRoot, LEGACY_FARM_MANIFEST_FILENAME));
   if (raw === void 0) {
     return void 0;
   }
@@ -3081,9 +3081,9 @@ function buildEntryFacts(params) {
     entries
   };
 }
-function listSubtree(fs15, root, rel) {
+function listSubtree(fs16, root, rel) {
   const absolute = path8.join(root, rel);
-  const stat = fs15.lstat(absolute);
+  const stat = fs16.lstat(absolute);
   if (stat === void 0) {
     return [];
   }
@@ -3091,10 +3091,10 @@ function listSubtree(fs15, root, rel) {
     return [{ rel, kind: "symlink" }];
   }
   if (stat.kind === "dir") {
-    const children = [...fs15.readdir(absolute)].sort().flatMap((name) => listSubtree(fs15, root, `${rel}/${name}`));
+    const children = [...fs16.readdir(absolute)].sort().flatMap((name) => listSubtree(fs16, root, `${rel}/${name}`));
     return [{ rel, kind: "dir" }, ...children];
   }
-  const contentHash = fs15.hashFile(absolute);
+  const contentHash = fs16.hashFile(absolute);
   return [{ rel, kind: "file", ...contentHash === void 0 ? {} : { contentHash } }];
 }
 function topLevelScopeRoots(roots) {
@@ -3108,25 +3108,25 @@ function topLevelScopeRoots(roots) {
   }
   return kept;
 }
-function reconciliationScope(fs15, farmRoot, manifest) {
+function reconciliationScope(fs16, farmRoot, manifest) {
   if (manifest !== void 0) {
     return topLevelScopeRoots(manifest.materialised);
   }
-  return [...fs15.readdir(farmRoot)].filter((name) => name !== FARM_MANIFEST_FILENAME && name !== LEGACY_FARM_MANIFEST_FILENAME && fs15.lstat(path8.join(farmRoot, name))?.kind === "dir").sort();
+  return [...fs16.readdir(farmRoot)].filter((name) => name !== FARM_MANIFEST_FILENAME && name !== LEGACY_FARM_MANIFEST_FILENAME && fs16.lstat(path8.join(farmRoot, name))?.kind === "dir").sort();
 }
-function collectFarmListing(fs15, farmRoot, scopeRoots) {
-  return scopeRoots.flatMap((root) => listSubtree(fs15, farmRoot, root));
+function collectFarmListing(fs16, farmRoot, scopeRoots) {
+  return scopeRoots.flatMap((root) => listSubtree(fs16, farmRoot, root));
 }
-function collectCanonicalCounterparts(fs15, claudeHome, farmListing) {
+function collectCanonicalCounterparts(fs16, claudeHome, farmListing) {
   const out = [];
   for (const entry of farmListing) {
     const absolute = path8.join(claudeHome, entry.rel);
-    const stat = fs15.lstat(absolute);
+    const stat = fs16.lstat(absolute);
     if (stat === void 0) {
       continue;
     }
     if (stat.kind === "file") {
-      const contentHash = fs15.hashFile(absolute);
+      const contentHash = fs16.hashFile(absolute);
       out.push({ rel: entry.rel, kind: "file", ...contentHash === void 0 ? {} : { contentHash } });
       continue;
     }
@@ -3964,9 +3964,9 @@ var init_providerCatalogue = __esm({
 // src/frontdoor/state.ts
 import path10 from "node:path";
 import { z as z6 } from "zod";
-function readCatalogueStatus(fs15, paths, pid, generation, name) {
+function readCatalogueStatus(fs16, paths, pid, generation, name) {
   const file = path10.join(path10.dirname(catalogueCachePath(paths, name, pid, generation)), `${name}.status.json`);
-  const raw = fs15.readFileUtf8(file);
+  const raw = fs16.readFileUtf8(file);
   if (raw === void 0) return void 0;
   try {
     const value = z6.strictObject({ status: z6.enum(["running", "ready", "failed"]), fingerprint: z6.string().min(1).optional(), recordedAt: z6.number().optional() }).safeParse(JSON.parse(raw));
@@ -3975,14 +3975,14 @@ function readCatalogueStatus(fs15, paths, pid, generation, name) {
     return void 0;
   }
 }
-function writeFrontDoorCodexHome(fs15, frontdoorDir, pid, codexHome, generation) {
+function writeFrontDoorCodexHome(fs16, frontdoorDir, pid, codexHome, generation) {
   const directory = path10.join(frontdoorDir, "codex-homes");
-  fs15.mkdirp(directory);
-  fs15.writeFilePrivate(path10.join(directory, `${String(pid)}.json`), `${JSON.stringify({ codexHome, generation })}
+  fs16.mkdirp(directory);
+  fs16.writeFilePrivate(path10.join(directory, `${String(pid)}.json`), `${JSON.stringify({ codexHome, generation })}
 `);
 }
-function readFrontDoorCodexRecord(fs15, frontdoorDir, pid) {
-  const raw = fs15.readFileUtf8(path10.join(frontdoorDir, "codex-homes", `${String(pid)}.json`));
+function readFrontDoorCodexRecord(fs16, frontdoorDir, pid) {
+  const raw = fs16.readFileUtf8(path10.join(frontdoorDir, "codex-homes", `${String(pid)}.json`));
   if (raw === void 0) return void 0;
   try {
     const parsed = z6.strictObject({ codexHome: z6.string().min(1), generation: z6.uuid() }).safeParse(JSON.parse(raw));
@@ -3991,13 +3991,13 @@ function readFrontDoorCodexRecord(fs15, frontdoorDir, pid) {
     return void 0;
   }
 }
-function removeFrontDoorCodexHome(fs15, frontdoorDir, pid) {
-  fs15.removeRecursive(path10.join(frontdoorDir, "codex-homes", `${String(pid)}.json`));
+function removeFrontDoorCodexHome(fs16, frontdoorDir, pid) {
+  fs16.removeRecursive(path10.join(frontdoorDir, "codex-homes", `${String(pid)}.json`));
 }
-function readFrontDoorState(fs15, stateFile) {
+function readFrontDoorState(fs16, stateFile) {
   let raw;
   try {
-    raw = fs15.readFileUtf8(stateFile);
+    raw = fs16.readFileUtf8(stateFile);
   } catch {
     return void 0;
   }
@@ -4011,9 +4011,9 @@ function readFrontDoorState(fs15, stateFile) {
     return void 0;
   }
 }
-function writeFrontDoorState(fs15, stateFile, state) {
-  fs15.mkdirp(path10.dirname(stateFile));
-  fs15.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
+function writeFrontDoorState(fs16, stateFile, state) {
+  fs16.mkdirp(path10.dirname(stateFile));
+  fs16.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
 `);
 }
 function directOrigin(port) {
@@ -4023,37 +4023,37 @@ function frontDoorOrigin(state) {
   const port = state?.directPort ?? state?.lastDirectPort;
   return port === void 0 ? void 0 : directOrigin(port);
 }
-function writeFrontDoorDirectRecord(fs15, recordsDir, record) {
-  fs15.mkdirp(recordsDir);
-  fs15.writeFilePrivate(path10.join(recordsDir, `${String(record.pid)}.json`), `${JSON.stringify({ directPort: record.directPort })}
+function writeFrontDoorDirectRecord(fs16, recordsDir, record) {
+  fs16.mkdirp(recordsDir);
+  fs16.writeFilePrivate(path10.join(recordsDir, `${String(record.pid)}.json`), `${JSON.stringify({ directPort: record.directPort })}
 `);
 }
-function removeFrontDoorDirectRecord(fs15, recordsDir, pid) {
-  fs15.removeRecursive(path10.join(recordsDir, `${String(pid)}.json`));
+function removeFrontDoorDirectRecord(fs16, recordsDir, pid) {
+  fs16.removeRecursive(path10.join(recordsDir, `${String(pid)}.json`));
 }
-function markFrontDoorDraining(fs15, markersDir, pid) {
-  fs15.mkdirp(markersDir);
-  fs15.writeFilePrivate(path10.join(markersDir, String(pid)), "\n");
+function markFrontDoorDraining(fs16, markersDir, pid) {
+  fs16.mkdirp(markersDir);
+  fs16.writeFilePrivate(path10.join(markersDir, String(pid)), "\n");
 }
-function unmarkFrontDoorDraining(fs15, markersDir, pid) {
-  fs15.removeRecursive(path10.join(markersDir, String(pid)));
+function unmarkFrontDoorDraining(fs16, markersDir, pid) {
+  fs16.removeRecursive(path10.join(markersDir, String(pid)));
 }
-function listDrainingFrontDoors(fs15, markersDir, isRunning) {
-  return fs15.readdir(markersDir).flatMap((file) => /^[1-9]\d*$/.test(file) && Number.isSafeInteger(Number(file)) ? [Number(file)] : []).filter(isRunning).sort((a, b) => a - b);
+function listDrainingFrontDoors(fs16, markersDir, isRunning) {
+  return fs16.readdir(markersDir).flatMap((file) => /^[1-9]\d*$/.test(file) && Number.isSafeInteger(Number(file)) ? [Number(file)] : []).filter(isRunning).sort((a, b) => a - b);
 }
 function recordPid(file) {
   const pidText = /^([1-9]\d*)\.json$/.exec(file)?.[1];
   const pid = pidText === void 0 ? void 0 : Number(pidText);
   return pid !== void 0 && Number.isSafeInteger(pid) ? pid : void 0;
 }
-function readDirectRecordEntry(fs15, recordsDir, file) {
+function readDirectRecordEntry(fs16, recordsDir, file) {
   const pid = recordPid(file);
   if (pid === void 0) {
     return void 0;
   }
   let raw;
   try {
-    raw = fs15.readFileUtf8(path10.join(recordsDir, file));
+    raw = fs16.readFileUtf8(path10.join(recordsDir, file));
   } catch {
     return void 0;
   }
@@ -4067,37 +4067,37 @@ function readDirectRecordEntry(fs15, recordsDir, file) {
     return { malformed: true };
   }
 }
-function listFrontDoorDirectRecords(fs15, recordsDir) {
-  return fs15.readdir(recordsDir).flatMap((file) => {
-    const entry = readDirectRecordEntry(fs15, recordsDir, file);
+function listFrontDoorDirectRecords(fs16, recordsDir) {
+  return fs16.readdir(recordsDir).flatMap((file) => {
+    const entry = readDirectRecordEntry(fs16, recordsDir, file);
     return entry?.record === void 0 ? [] : [entry.record];
   }).sort((a, b) => a.pid - b.pid);
 }
-function pruneMalformedFrontDoorDirectFiles(fs15, recordsDir, isRunning) {
-  for (const file of fs15.readdir(recordsDir)) {
+function pruneMalformedFrontDoorDirectFiles(fs16, recordsDir, isRunning) {
+  for (const file of fs16.readdir(recordsDir)) {
     const writer = RECORD_TEMPORARY_FILE.exec(file)?.[1];
     const stale = writer !== void 0 && !isRunning(Number(writer));
-    if (stale || readDirectRecordEntry(fs15, recordsDir, file)?.malformed === true) {
-      fs15.removeRecursive(path10.join(recordsDir, file));
+    if (stale || readDirectRecordEntry(fs16, recordsDir, file)?.malformed === true) {
+      fs16.removeRecursive(path10.join(recordsDir, file));
     }
   }
 }
 function liveFrontDoorDirectRecords(records, liveness) {
   return records.filter((record) => liveness.doors.has(record.pid) || liveness.unknown.has(record.pid));
 }
-function pruneDeadFrontDoorDirectRecords(fs15, recordsDir, records, liveness) {
+function pruneDeadFrontDoorDirectRecords(fs16, recordsDir, records, liveness) {
   for (const record of records) {
     if (!liveness.doors.has(record.pid) && !liveness.unknown.has(record.pid)) {
-      removeFrontDoorDirectRecord(fs15, recordsDir, record.pid);
+      removeFrontDoorDirectRecord(fs16, recordsDir, record.pid);
     }
   }
 }
 function recordOf(details) {
   return details === void 0 ? {} : { sessionId: details.sessionId, ...details.models === void 0 ? {} : { models: details.models } };
 }
-function writeFrontDoorSession(fs15, sessionsDir, session) {
-  fs15.mkdirPrivate(sessionsDir);
-  fs15.writeFilePrivate(path10.join(sessionsDir, sessionRecordName(session.pid)), `${JSON.stringify(session, null, 2)}
+function writeFrontDoorSession(fs16, sessionsDir, session) {
+  fs16.mkdirPrivate(sessionsDir);
+  fs16.writeFilePrivate(path10.join(sessionsDir, sessionRecordName(session.pid)), `${JSON.stringify(session, null, 2)}
 `);
 }
 function sessionRecordName(pid) {
@@ -4109,32 +4109,32 @@ function isSessionRecordName(name) {
 function summaryOf(session) {
   return { pid: session.pid, startedAt: session.startedAt, ...session.supervisorPid === void 0 ? {} : { supervisorPid: session.supervisorPid } };
 }
-function readFrontDoorSessionRecord(fs15, sessionsDir, name) {
+function readFrontDoorSessionRecord(fs16, sessionsDir, name) {
   try {
-    const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs15.readFileUtf8(path10.join(sessionsDir, name)) ?? ""));
+    const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs16.readFileUtf8(path10.join(sessionsDir, name)) ?? ""));
     return parsed.success ? parsed.data : void 0;
   } catch {
     return void 0;
   }
 }
-function listFrontDoorSessions(fs15, sessionsDir) {
+function listFrontDoorSessions(fs16, sessionsDir) {
   const sessions = [];
-  for (const name of fs15.readdir(sessionsDir)) {
-    const record = isSessionRecordName(name) ? readFrontDoorSessionRecord(fs15, sessionsDir, name) : void 0;
+  for (const name of fs16.readdir(sessionsDir)) {
+    const record = isSessionRecordName(name) ? readFrontDoorSessionRecord(fs16, sessionsDir, name) : void 0;
     if (record !== void 0) {
       sessions.push(summaryOf(record));
     }
   }
   return sessions.sort((a, b) => a.pid - b.pid);
 }
-function removeFrontDoorSession(fs15, sessionsDir, pid) {
-  fs15.removeRecursive(path10.join(sessionsDir, sessionRecordName(pid)));
+function removeFrontDoorSession(fs16, sessionsDir, pid) {
+  fs16.removeRecursive(path10.join(sessionsDir, sessionRecordName(pid)));
 }
-function pruneDeadFrontDoorSessions(fs15, sessionsDir, listed, isRunning) {
+function pruneDeadFrontDoorSessions(fs16, sessionsDir, listed, isRunning) {
   const removed = [];
   for (const session of listed) {
     if (!isRunning(session.pid)) {
-      removeFrontDoorSession(fs15, sessionsDir, session.pid);
+      removeFrontDoorSession(fs16, sessionsDir, session.pid);
       removed.push(session.pid);
     }
   }
@@ -4217,19 +4217,19 @@ var init_processRole = __esm({
 // src/frontdoor/catalogueCleanup.ts
 import path11 from "node:path";
 import { z as z7 } from "zod";
-async function pruneAbandonedCatalogueGenerations(fs15, paths, ownPid, generation, runningAmong) {
+async function pruneAbandonedCatalogueGenerations(fs16, paths, ownPid, generation, runningAmong) {
   const root = path11.join(paths.catalogueDir, "supervisors");
-  const owners = fs15.readdir(root).flatMap((entry) => {
+  const owners = fs16.readdir(root).flatMap((entry) => {
     const pid = Number(entry);
-    return Number.isSafeInteger(pid) && pid > 0 && String(pid) === entry && fs15.lstat(path11.join(root, entry))?.kind === "dir" ? [pid] : [];
+    return Number.isSafeInteger(pid) && pid > 0 && String(pid) === entry && fs16.lstat(path11.join(root, entry))?.kind === "dir" ? [pid] : [];
   });
   const running = await runningAmong(owners);
   for (const pid of owners) {
     if (pid !== ownPid && running.has(pid)) continue;
     const directory = path11.join(root, String(pid));
-    for (const entry of fs15.readdir(directory)) {
+    for (const entry of fs16.readdir(directory)) {
       const candidate = path11.join(directory, entry);
-      if (z7.uuid().safeParse(entry).success && (pid !== ownPid || entry !== generation) && fs15.lstat(candidate)?.kind === "dir") fs15.removeRecursive(candidate);
+      if (z7.uuid().safeParse(entry).success && (pid !== ownPid || entry !== generation) && fs16.lstat(candidate)?.kind === "dir") fs16.removeRecursive(candidate);
     }
   }
 }
@@ -4258,9 +4258,9 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
   }
 }
 async function serveFrontDoor(idleShutdownMinutes, ports, options) {
-  const { fs: fs15, paths } = ports;
+  const { fs: fs16, paths } = ports;
   const servingBinary = ports.statOwnExecutable();
-  const previous = readFrontDoorState(fs15, paths.frontdoorStateFile);
+  const previous = readFrontDoorState(fs16, paths.frontdoorStateFile);
   let lastPort = previous?.lastPort;
   let lastConnectPort = previous?.lastConnectPort;
   let lastDirectPort = previous?.lastDirectPort;
@@ -4274,8 +4274,8 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
   const fail = async (message) => {
     ports.closeRcStreamHub();
     if (predecessor === void 0) {
-      writeFrontDoorState(fs15, paths.frontdoorStateFile, { lastError: message, ...sticky() });
-      fs15.removeRecursive(paths.frontdoorLockFile);
+      writeFrontDoorState(fs16, paths.frontdoorStateFile, { lastError: message, ...sticky() });
+      fs16.removeRecursive(paths.frontdoorLockFile);
     }
     ports.log(`agent-shim frontdoor supervisor: ${message}`);
     const chain = ports.respawnChain;
@@ -4286,7 +4286,7 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
     return 1;
   };
   if (predecessor === void 0) {
-    writeFrontDoorState(fs15, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, ...sticky() });
+    writeFrontDoorState(fs16, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, ...sticky() });
   }
   const previousSticky = lastPort;
   let http3;
@@ -4327,14 +4327,14 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
     ports.log(`agent-shim frontdoor supervisor: sticky direct port ${String(previousStickyDirect)} was occupied; moving to ${String(direct.port)} (headroom admits the new address once its supervisor rewrites the allowlist file)`);
   }
   lastDirectPort = direct.port;
-  writeFrontDoorDirectRecord(fs15, paths.frontdoorDirectRecordsDir, { pid: ports.ownPid, directPort: direct.port });
-  writeFrontDoorCodexHome(fs15, paths.frontdoorDir, ports.ownPid, ports.codexHome, ports.catalogueGeneration);
-  writeFrontDoorState(fs15, paths.frontdoorStateFile, { protocol: FRONT_DOOR_PROTOCOL, supervisorPid: ports.ownPid, port: http3.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
-  await pruneAbandonedCatalogueGenerations(fs15, paths, ports.ownPid, ports.catalogueGeneration, ports.runningAmong);
+  writeFrontDoorDirectRecord(fs16, paths.frontdoorDirectRecordsDir, { pid: ports.ownPid, directPort: direct.port });
+  writeFrontDoorCodexHome(fs16, paths.frontdoorDir, ports.ownPid, ports.codexHome, ports.catalogueGeneration);
+  writeFrontDoorState(fs16, paths.frontdoorStateFile, { protocol: FRONT_DOOR_PROTOCOL, supervisorPid: ports.ownPid, port: http3.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
+  await pruneAbandonedCatalogueGenerations(fs16, paths, ports.ownPid, ports.catalogueGeneration, ports.runningAmong);
   ports.onServing();
   ports.doorHealth.generation({ providerPort: http3.port, connectPort: connect3.port, directPort: direct.port });
   if (predecessor === void 0) {
-    fs15.removeRecursive(paths.frontdoorLockFile);
+    fs16.removeRecursive(paths.frontdoorLockFile);
   } else {
     predecessor.serving();
   }
@@ -4343,7 +4343,7 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
   let idleSince;
   let ticks = 0;
   const supersedingOwner = async () => {
-    const owner = readFrontDoorState(fs15, paths.frontdoorStateFile)?.supervisorPid;
+    const owner = readFrontDoorState(fs16, paths.frontdoorStateFile)?.supervisorPid;
     return owner !== void 0 && owner !== ports.ownPid && (await ports.runningAmong([owner])).has(owner) ? owner : void 0;
   };
   let supersededBy;
@@ -4372,15 +4372,15 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
     ports.stopBackgroundWork?.();
     const drained = [direct.drain(), connect3.drain(), http3.drain()];
     if (await supersedingOwner() === void 0) {
-      writeFrontDoorState(fs15, paths.frontdoorStateFile, sticky());
+      writeFrontDoorState(fs16, paths.frontdoorStateFile, sticky());
     }
-    markFrontDoorDraining(fs15, paths.frontdoorDrainingDir, ports.ownPid);
+    markFrontDoorDraining(fs16, paths.frontdoorDrainingDir, ports.ownPid);
     ports.closeRcStreamHub();
     await Promise.all(drained);
-    unmarkFrontDoorDraining(fs15, paths.frontdoorDrainingDir, ports.ownPid);
-    removeFrontDoorDirectRecord(fs15, paths.frontdoorDirectRecordsDir, ports.ownPid);
-    removeFrontDoorCodexHome(fs15, paths.frontdoorDir, ports.ownPid);
-    fs15.removeRecursive(catalogueGenerationDir(paths, ports.ownPid, ports.catalogueGeneration));
+    unmarkFrontDoorDraining(fs16, paths.frontdoorDrainingDir, ports.ownPid);
+    removeFrontDoorDirectRecord(fs16, paths.frontdoorDirectRecordsDir, ports.ownPid);
+    removeFrontDoorCodexHome(fs16, paths.frontdoorDir, ports.ownPid);
+    fs16.removeRecursive(catalogueGenerationDir(paths, ports.ownPid, ports.catalogueGeneration));
     ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: the connections this door carried have ended; exiting`);
     return 0;
   };
@@ -4401,14 +4401,14 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
     await connect3.close();
     await http3.close();
     ports.closeRcStreamHub();
-    removeFrontDoorDirectRecord(fs15, paths.frontdoorDirectRecordsDir, ports.ownPid);
-    removeFrontDoorCodexHome(fs15, paths.frontdoorDir, ports.ownPid);
-    fs15.removeRecursive(catalogueGenerationDir(paths, ports.ownPid, ports.catalogueGeneration));
+    removeFrontDoorDirectRecord(fs16, paths.frontdoorDirectRecordsDir, ports.ownPid);
+    removeFrontDoorCodexHome(fs16, paths.frontdoorDir, ports.ownPid);
+    fs16.removeRecursive(catalogueGenerationDir(paths, ports.ownPid, ports.catalogueGeneration));
   };
   const shutdown = async () => {
     await closeServing();
     if (await supersedingOwner() === void 0) {
-      writeFrontDoorState(fs15, paths.frontdoorStateFile, sticky());
+      writeFrontDoorState(fs16, paths.frontdoorStateFile, sticky());
     }
     return 0;
   };
@@ -4427,7 +4427,7 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
     ticks += 1;
     const listed = ports.registry.rescan();
     const running = await ports.runningAmong(listed.map((session) => session.pid));
-    const pruned = pruneDeadFrontDoorSessions(fs15, paths.frontdoorSessionsDir, listed, (pid) => running.has(pid));
+    const pruned = pruneDeadFrontDoorSessions(fs16, paths.frontdoorSessionsDir, listed, (pid) => running.has(pid));
     ports.registry.forget(pruned);
     ports.observeLaunchRegistry(listed, pruned);
     ports.checkQuotaExpiry();
@@ -4504,8 +4504,8 @@ function parseConnectTarget(authority) {
 function isInterceptedHost(host, interceptHosts) {
   return interceptHosts.includes(host);
 }
-function servedByPipeline(path48) {
-  return path48?.startsWith(ROUTED_PATH_PREFIX) === true;
+function servedByPipeline(path49) {
+  return path49?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 function forwardableHeaders(headers) {
   const connectionTokens = new Set(
@@ -4949,7 +4949,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "agent-shim",
-      version: "11.84.0",
+      version: "11.84.1",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -5175,43 +5175,43 @@ function parseJson(raw, schema) {
   const parsed = schema.safeParse(JSON.parse(raw));
   return parsed.success ? parsed.data : void 0;
 }
-function readHeadroomState(fs15, stateFile) {
+function readHeadroomState(fs16, stateFile) {
   try {
-    return parseJson(fs15.readFileUtf8(stateFile), HeadroomStateSchema);
+    return parseJson(fs16.readFileUtf8(stateFile), HeadroomStateSchema);
   } catch {
     return void 0;
   }
 }
-function writeHeadroomState(fs15, stateFile, state) {
-  fs15.mkdirp(path14.dirname(stateFile));
-  fs15.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
+function writeHeadroomState(fs16, stateFile, state) {
+  fs16.mkdirp(path14.dirname(stateFile));
+  fs16.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
 `);
 }
-function resolveServingHeadroomState(fs15, files, isRunning) {
-  const current = readHeadroomState(fs15, files.stateFile);
+function resolveServingHeadroomState(fs16, files, isRunning) {
+  const current = readHeadroomState(fs16, files.stateFile);
   if (current !== void 0) {
     return { path: files.stateFile, state: current };
   }
-  const legacy = readHeadroomState(fs15, files.legacyStateFile);
+  const legacy = readHeadroomState(fs16, files.legacyStateFile);
   if (legacy?.supervisorPid !== void 0 && isRunning(legacy.supervisorPid)) {
     return { path: files.legacyStateFile, state: legacy };
   }
   return void 0;
 }
-function migrateHeadroomState(fs15, files, isRunning) {
-  const legacy = readHeadroomState(fs15, files.legacyStateFile);
+function migrateHeadroomState(fs16, files, isRunning) {
+  const legacy = readHeadroomState(fs16, files.legacyStateFile);
   const legacyLive = legacy?.supervisorPid !== void 0 && isRunning(legacy.supervisorPid);
-  const current = readHeadroomState(fs15, files.stateFile);
+  const current = readHeadroomState(fs16, files.stateFile);
   if (current !== void 0 || legacyLive) {
-    if (!legacyLive && fs15.readFileUtf8(files.legacyStateFile) !== void 0) {
-      fs15.removeRecursive(files.legacyStateFile);
+    if (!legacyLive && fs16.readFileUtf8(files.legacyStateFile) !== void 0) {
+      fs16.removeRecursive(files.legacyStateFile);
     }
     return;
   }
   if (legacy !== void 0) {
-    writeHeadroomState(fs15, files.stateFile, legacy);
+    writeHeadroomState(fs16, files.stateFile, legacy);
   }
-  fs15.removeRecursive(files.legacyStateFile);
+  fs16.removeRecursive(files.legacyStateFile);
 }
 function hashAllowlist(allowlist) {
   return createHash3("sha256").update(allowlist.join("\n")).digest("hex");
@@ -5244,27 +5244,27 @@ function isAdmissibleUrl(entry) {
 function parseAllowlistFile(content) {
   return content.replace(/^\uFEFF/, "").replace(ALLOWLIST_FILE_COMMENT, "").split(ALLOWLIST_FILE_SEPARATORS).map((entry) => entry.replace(ALLOWLIST_SURROUNDING_WHITESPACE, "")).filter((entry) => entry !== "" && !ALLOWLIST_ENTRY_WHITESPACE.test(entry) && (entry.includes("://") ? isAdmissibleUrl(entry) : isBareHost(entry)));
 }
-function writeAllowlistFile(fs15, allowlistFile, allowlist) {
-  fs15.mkdirPrivate(path14.dirname(allowlistFile));
-  fs15.writeFilePrivate(allowlistFile, formatAllowlistFile(allowlist));
+function writeAllowlistFile(fs16, allowlistFile, allowlist) {
+  fs16.mkdirPrivate(path14.dirname(allowlistFile));
+  fs16.writeFilePrivate(allowlistFile, formatAllowlistFile(allowlist));
 }
-function pruneStaleAllowlistTemporaries(fs15, allowlistFile, isRunning) {
+function pruneStaleAllowlistTemporaries(fs16, allowlistFile, isRunning) {
   const prefix = `${path14.basename(allowlistFile)}.`;
-  for (const name of fs15.readdir(path14.dirname(allowlistFile))) {
+  for (const name of fs16.readdir(path14.dirname(allowlistFile))) {
     const writer = name.startsWith(prefix) ? /^([1-9]\d*)\.tmp$/.exec(name.slice(prefix.length))?.[1] : void 0;
     if (writer !== void 0 && !isRunning(Number(writer))) {
-      fs15.removeRecursive(path14.join(path14.dirname(allowlistFile), name));
+      fs16.removeRecursive(path14.join(path14.dirname(allowlistFile), name));
     }
   }
 }
-function readAllProviders(fs15, providersDir) {
+function readAllProviders(fs16, providersDir) {
   const result = [];
-  for (const name of fs15.readdir(providersDir)) {
+  for (const name of fs16.readdir(providersDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = parseJson(fs15.readFileUtf8(path14.join(providersDir, name)), ProviderSchema);
+      const parsed = parseJson(fs16.readFileUtf8(path14.join(providersDir, name)), ProviderSchema);
       if (parsed !== void 0) {
         result.push({ name: name.slice(0, -".json".length), provider: parsed });
       }
@@ -5274,22 +5274,22 @@ function readAllProviders(fs15, providersDir) {
   }
   return result;
 }
-function writeSession(fs15, sessionsDir, session) {
-  fs15.mkdirp(sessionsDir);
-  fs15.writeFileUtf8(path14.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
+function writeSession(fs16, sessionsDir, session) {
+  fs16.mkdirp(sessionsDir);
+  fs16.writeFileUtf8(path14.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
 `);
 }
-function removeSession(fs15, sessionsDir, pid) {
-  fs15.removeRecursive(path14.join(sessionsDir, `${String(pid)}.json`));
+function removeSession(fs16, sessionsDir, pid) {
+  fs16.removeRecursive(path14.join(sessionsDir, `${String(pid)}.json`));
 }
-function listSessions(fs15, sessionsDir) {
+function listSessions(fs16, sessionsDir) {
   const sessions = [];
-  for (const name of fs15.readdir(sessionsDir)) {
+  for (const name of fs16.readdir(sessionsDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = parseJson(fs15.readFileUtf8(path14.join(sessionsDir, name)), HeadroomSessionSchema);
+      const parsed = parseJson(fs16.readFileUtf8(path14.join(sessionsDir, name)), HeadroomSessionSchema);
       if (parsed !== void 0) {
         sessions.push(parsed);
       }
@@ -5299,22 +5299,22 @@ function listSessions(fs15, sessionsDir) {
   }
   return sessions.sort((a, b) => a.pid - b.pid);
 }
-function sessionsForSupervisor(fs15, sessionsDir, supervisorPid) {
-  return listSessions(fs15, sessionsDir).filter((session) => session.supervisorPid === supervisorPid);
+function sessionsForSupervisor(fs16, sessionsDir, supervisorPid) {
+  return listSessions(fs16, sessionsDir).filter((session) => session.supervisorPid === supervisorPid);
 }
-function pruneDeadSessions(fs15, sessionsDir, isRunning) {
+function pruneDeadSessions(fs16, sessionsDir, isRunning) {
   const removed = [];
-  for (const session of listSessions(fs15, sessionsDir)) {
+  for (const session of listSessions(fs16, sessionsDir)) {
     if (!isRunning(session.pid)) {
-      removeSession(fs15, sessionsDir, session.pid);
+      removeSession(fs16, sessionsDir, session.pid);
       removed.push(session.pid);
     }
   }
   return removed;
 }
-function readStartLock(fs15, lockFile) {
+function readStartLock(fs16, lockFile) {
   try {
-    return parseJson(fs15.readFileUtf8(lockFile), HeadroomLockSchema);
+    return parseJson(fs16.readFileUtf8(lockFile), HeadroomLockSchema);
   } catch {
     return void 0;
   }
@@ -5404,12 +5404,12 @@ function earlierReleaseAllowlistHash(providers, doorOrigin) {
   }
   return hashAllowlist([...entries].sort());
 }
-function earlierReleaseDaemon(fs15, paths, daemon) {
+function earlierReleaseDaemon(fs16, paths, daemon) {
   if (daemonIdentity(daemon.commandLine, daemon.socketPath) !== "earlier-release") {
     return void 0;
   }
-  const providers = readAllProviders(fs15, paths.providersDir).map((entry) => entry.provider);
-  const expected = earlierReleaseAllowlistHash(providers, frontDoorOrigin(readFrontDoorState(fs15, paths.frontdoorStateFile)));
+  const providers = readAllProviders(fs16, paths.providersDir).map((entry) => entry.provider);
+  const expected = earlierReleaseAllowlistHash(providers, frontDoorOrigin(readFrontDoorState(fs16, paths.frontdoorStateFile)));
   return { admitsServingDoor: daemon.recordedHash === expected };
 }
 var EARLIER_RELEASE_ALLOWLIST, EARLIER_RELEASE_ANTHROPIC_UPSTREAM;
@@ -5434,8 +5434,8 @@ function awaitingCause(daemonPid, identity, allowlistFile) {
   }
   return `the headroom supervisor has not written an allowlist admitting this launch's upstreams to ${allowlistFile} within ${String(HEADROOM_START_TIMEOUT_MS)}ms`;
 }
-function daemonAdmits(fs15, allowlistFile, recordedHash, required) {
-  const content = fs15.readFileUtf8(allowlistFile);
+function daemonAdmits(fs16, allowlistFile, recordedHash, required) {
+  const content = fs16.readFileUtf8(allowlistFile);
   if (content === void 0 || recordedHash === void 0) {
     return false;
   }
@@ -5704,7 +5704,7 @@ function verifyAllowlistFile(allowlistFile, ports) {
   const replaceable = fileStat === void 0 || fileStat.kind === "file" || fileStat.kind === "symlink";
   return { message: refusal2, repairable: replaceable };
 }
-function prepareHeadroomSocket(fs15, ports, paths, supervisorPid) {
+function prepareHeadroomSocket(fs16, ports, paths, supervisorPid) {
   const unsupported = platformRefusal(ports.platform);
   if (unsupported !== void 0) {
     return { refused: unsupported };
@@ -5719,18 +5719,18 @@ function prepareHeadroomSocket(fs15, ports, paths, supervisorPid) {
   if (ports.lstat(paths.headroomSocketDir)?.kind === "symlink") {
     return { refused: `the headroom socket directory ${paths.headroomSocketDir} is a symlink; it must be the real directory` };
   }
-  fs15.mkdirPrivate(paths.headroomSocketDir);
+  fs16.mkdirPrivate(paths.headroomSocketDir);
   const refusal2 = ownerOnlyRefusal("socket directory", paths.headroomSocketDir, ports.lstat(paths.headroomSocketDir), "dir", ports.currentUid());
   return refusal2 === void 0 ? { socketPath } : { refused: refusal2 };
 }
-function pruneStaleHeadroomSockets(fs15, paths, isRunning) {
+function pruneStaleHeadroomSockets(fs16, paths, isRunning) {
   const removed = [];
-  for (const name of fs15.readdir(paths.headroomSocketDir)) {
+  for (const name of fs16.readdir(paths.headroomSocketDir)) {
     const pid = HEADROOM_SOCKET_NAME.exec(name)?.[1];
     if (pid === void 0 || isRunning(Number.parseInt(pid, 10))) {
       continue;
     }
-    fs15.removeRecursive(path15.join(paths.headroomSocketDir, name));
+    fs16.removeRecursive(path15.join(paths.headroomSocketDir, name));
     removed.push(name);
   }
   return removed;
@@ -5842,37 +5842,37 @@ function compareVersions2(a, b) {
   return 0;
 }
 async function runSupervisor(initialConfig, ports, options = {}) {
-  const { fs: fs15, paths } = ports;
+  const { fs: fs16, paths } = ports;
   let config = initialConfig;
-  migrateHeadroomState(fs15, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, ports.isRunning);
-  const previousState = resolveServingHeadroomState(fs15, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, ports.isRunning)?.state;
+  migrateHeadroomState(fs16, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, ports.isRunning);
+  const previousState = resolveServingHeadroomState(fs16, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, ports.isRunning)?.state;
   if (previousState?.supervisorPid !== void 0 && previousState.supervisorPid !== ports.ownPid && ports.isRunning(previousState.supervisorPid)) {
     ports.log(`agent-shim headroom supervisor ${String(ports.ownPid)}: supervisor ${String(previousState.supervisorPid)} already owns the daemon; exiting`);
     return 0;
   }
   let installedSource = previousState?.installedSource;
   const ownsState = () => {
-    const owner = readHeadroomState(fs15, paths.headroomStateFile)?.supervisorPid;
+    const owner = readHeadroomState(fs16, paths.headroomStateFile)?.supervisorPid;
     return owner === void 0 || owner === ports.ownPid || !ports.isRunning(owner);
   };
   const writeOwnState = (state) => {
     if (!ownsState()) {
       return false;
     }
-    writeHeadroomState(fs15, paths.headroomStateFile, state);
+    writeHeadroomState(fs16, paths.headroomStateFile, state);
     return true;
   };
   const fail = (message) => {
     if (writeOwnState({ lastError: message })) {
-      fs15.removeRecursive(paths.headroomLockFile);
+      fs16.removeRecursive(paths.headroomLockFile);
     }
     ports.log(`agent-shim headroom supervisor: ${message}`);
     return 1;
   };
   const syncAllowlistFile = (allowlist) => {
     try {
-      if (fs15.readFileUtf8(paths.headroomAllowlistFile) !== formatAllowlistFile(allowlist)) {
-        writeAllowlistFile(fs15, paths.headroomAllowlistFile, allowlist);
+      if (fs16.readFileUtf8(paths.headroomAllowlistFile) !== formatAllowlistFile(allowlist)) {
+        writeAllowlistFile(fs16, paths.headroomAllowlistFile, allowlist);
         ports.log(`agent-shim headroom supervisor: wrote allowlist [${allowlist.join(", ")}] to ${paths.headroomAllowlistFile}`);
       }
       return void 0;
@@ -5890,9 +5890,9 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     }
     ports.log(`agent-shim headroom supervisor: repairing the allowlist file: ${problem.message}`);
     try {
-      fs15.mkdirPrivate(paths.headroomDir);
-      fs15.mkdirPrivate(path16.dirname(paths.headroomAllowlistFile));
-      writeAllowlistFile(fs15, paths.headroomAllowlistFile, allowlist);
+      fs16.mkdirPrivate(paths.headroomDir);
+      fs16.mkdirPrivate(path16.dirname(paths.headroomAllowlistFile));
+      writeAllowlistFile(fs16, paths.headroomAllowlistFile, allowlist);
     } catch (error) {
       return `could not write the headroom allowlist file ${paths.headroomAllowlistFile}: ${error instanceof Error ? error.message : String(error)}`;
     }
@@ -5917,20 +5917,20 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     installedSource = config.source;
     return void 0;
   };
-  const socket = prepareHeadroomSocket(fs15, ports.socketTrust, paths, ports.ownPid);
+  const socket = prepareHeadroomSocket(fs16, ports.socketTrust, paths, ports.ownPid);
   if (socket.refused !== void 0) {
     return fail(socket.refused);
   }
   const { socketPath } = socket;
-  pruneStaleHeadroomSockets(fs15, paths, ports.isRunning);
-  pruneStaleAllowlistTemporaries(fs15, paths.headroomAllowlistFile, ports.isRunning);
+  pruneStaleHeadroomSockets(fs16, paths, ports.isRunning);
+  pruneStaleAllowlistTemporaries(fs16, paths.headroomAllowlistFile, ports.isRunning);
   const installFailure = ensureInstalled();
   if (installFailure !== void 0) {
     return fail(installFailure);
   }
   const version = ports.headroomVersion() ?? "unknown";
   writeOwnState({ supervisorPid: ports.ownPid, version, installedSource });
-  ports.log(`agent-shim headroom supervisor ${String(ports.ownPid)}: managing headroom on allowlist [${currentHeadroomAllowlistInputs(fs15, paths, ports.frontDoorLiveness).frontDoorOrigins.join(", ")}]`);
+  ports.log(`agent-shim headroom supervisor ${String(ports.ownPid)}: managing headroom on allowlist [${currentHeadroomAllowlistInputs(fs16, paths, ports.frontDoorLiveness).frontDoorOrigins.join(", ")}]`);
   const orphanPid = previousState?.headroomPid;
   const orphanSocket = previousState?.socketPath ?? (previousState?.supervisorPid === void 0 ? void 0 : headroomSocketPath(paths, previousState.supervisorPid));
   const orphanIdentity = orphanPid === void 0 || orphanSocket === void 0 || !ports.isRunning(orphanPid) ? void 0 : daemonIdentity(ports.daemonCommandLine(orphanPid), orphanSocket);
@@ -5968,12 +5968,12 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     }
     config = ports.readConfig();
     const settingsHash = hashSettings(config.settings);
-    const inputs = currentHeadroomAllowlistInputs(fs15, paths, ports.frontDoorLiveness);
-    pruneDeadFrontDoorDirectRecords(fs15, paths.frontdoorDirectRecordsDir, inputs.frontDoorRecords, inputs.frontDoorLiveness);
-    pruneMalformedFrontDoorDirectFiles(fs15, paths.frontdoorDirectRecordsDir, ports.isRunning);
+    const inputs = currentHeadroomAllowlistInputs(fs16, paths, ports.frontDoorLiveness);
+    pruneDeadFrontDoorDirectRecords(fs16, paths.frontdoorDirectRecordsDir, inputs.frontDoorRecords, inputs.frontDoorLiveness);
+    pruneMalformedFrontDoorDirectFiles(fs16, paths.frontdoorDirectRecordsDir, ports.isRunning);
     const allowlist = inputs.frontDoorOrigins;
     const allowlistHash = hashAllowlist(allowlist);
-    pruneDeadSessions(fs15, paths.headroomSessionsDir, ports.isRunning);
+    pruneDeadSessions(fs16, paths.headroomSessionsDir, ports.isRunning);
     const ownsNow = ownsState();
     if (!ownsNow && !superseded) {
       ports.log("agent-shim headroom supervisor: another supervisor now owns the state file; serving this daemon's own sessions until they end");
@@ -6020,7 +6020,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
         runningSettingsHash = settingsHash;
         const recorded = writeOwnState(servingState(pid));
         if (recorded) {
-          fs15.removeRecursive(paths.headroomLockFile);
+          fs16.removeRecursive(paths.headroomLockFile);
         }
         idleSince = void 0;
         ports.log(`agent-shim headroom supervisor: headroom pid ${String(pid)} ready on unix socket ${socketPath}`);
@@ -6048,7 +6048,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
         ports.log(`agent-shim headroom supervisor: headroom pid ${String(headroomPid)} now serves allowlist [${allowlist.join(", ")}]`);
       }
       if (runningSettingsHash !== settingsHash || installedSource !== config.source) {
-        if (sessionsForSupervisor(fs15, paths.headroomSessionsDir, ports.ownPid).length === 0) {
+        if (sessionsForSupervisor(fs16, paths.headroomSessionsDir, ports.ownPid).length === 0) {
           ports.log("agent-shim headroom supervisor: configuration drifted and no sessions are live; restarting headroom");
           ports.stopProcess(headroomPid);
           headroomPid = void 0;
@@ -6057,7 +6057,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
           continue;
         }
       }
-      const sessions = sessionsForSupervisor(fs15, paths.headroomSessionsDir, ports.ownPid);
+      const sessions = sessionsForSupervisor(fs16, paths.headroomSessionsDir, ports.ownPid);
       if (sessions.length === 0) {
         idleSince ??= ports.now();
         const idleMs = ports.now() - idleSince;
@@ -6082,9 +6082,9 @@ function undeterminedFrontDoors(inputs) {
     return reason === void 0 ? [] : [{ pid: record.pid, origin: directOrigin(record.directPort), reason }];
   });
 }
-function currentHeadroomAllowlistInputs(fs15, paths, frontDoorLiveness) {
-  const named = frontDoorOrigin(readFrontDoorState(fs15, paths.frontdoorStateFile));
-  const records = listFrontDoorDirectRecords(fs15, paths.frontdoorDirectRecordsDir);
+function currentHeadroomAllowlistInputs(fs16, paths, frontDoorLiveness) {
+  const named = frontDoorOrigin(readFrontDoorState(fs16, paths.frontdoorStateFile));
+  const records = listFrontDoorDirectRecords(fs16, paths.frontdoorDirectRecordsDir);
   const liveness = frontDoorLiveness(records.map((record) => record.pid));
   const live = liveFrontDoorDirectRecords(records, liveness).map((record) => directOrigin(record.directPort));
   return {
@@ -6093,8 +6093,8 @@ function currentHeadroomAllowlistInputs(fs15, paths, frontDoorLiveness) {
     frontDoorOrigins: [.../* @__PURE__ */ new Set([...named === void 0 ? [] : [named], ...live])].sort()
   };
 }
-function launchRequiredUpstreams(fs15, paths) {
-  const door = frontDoorOrigin(readFrontDoorState(fs15, paths.frontdoorStateFile));
+function launchRequiredUpstreams(fs16, paths) {
+  const door = frontDoorOrigin(readFrontDoorState(fs16, paths.frontdoorStateFile));
   return door === void 0 ? [] : [door];
 }
 async function waitUntilReady(ports, socketPath, pid) {
@@ -6884,8 +6884,8 @@ import path20 from "node:path";
 function poolNameOf(selector) {
   return selector.startsWith(POOL_SELECTOR_PREFIX) ? selector.slice(POOL_SELECTOR_PREFIX.length) : void 0;
 }
-function readActiveIdentity(fs15, activeIdentityFile) {
-  const trimmed = fs15.readFileUtf8(activeIdentityFile)?.trim();
+function readActiveIdentity(fs16, activeIdentityFile) {
+  const trimmed = fs16.readFileUtf8(activeIdentityFile)?.trim();
   return trimmed === void 0 || trimmed === "" ? void 0 : trimmed;
 }
 function isNonEmpty(value) {
@@ -6935,11 +6935,11 @@ function decideConfigProfile(params) {
   }
   return { source: "none" };
 }
-function loadIdentity(identitiesDir, name, fs15) {
+function loadIdentity(identitiesDir, name, fs16) {
   if (!isFileName(name)) {
     throw new UnsafeNameError(name, "identity", FILE_NAME_RULE);
   }
-  return loadConfigFile(path20.join(identitiesDir, name, "identity.json"), IdentitySchema, fs15.readConfigFile);
+  return loadConfigFile(path20.join(identitiesDir, name, "identity.json"), IdentitySchema, fs16.readConfigFile);
 }
 var IDENTITY_DECISION_SOURCES, IDENTITY_SOURCE_LABELS, CONFIG_PROFILE_DECISION_SOURCES;
 var init_identity = __esm({
@@ -7193,14 +7193,14 @@ function isIdentityName(name) {
 function claudeJsonPath(identitiesDir, identity) {
   return path21.join(identitiesDir, identity, CLAUDE_JSON);
 }
-function readAccountMetadata(fs15, identitiesDir, identity) {
+function readAccountMetadata(fs16, identitiesDir, identity) {
   if (!isIdentityName(identity)) {
     throw new Error(`"${identity}" is not a valid identity name.`);
   }
-  return readAccountMetadataFile(fs15, claudeJsonPath(identitiesDir, identity));
+  return readAccountMetadataFile(fs16, claudeJsonPath(identitiesDir, identity));
 }
-function readAccountMetadataFile(fs15, file) {
-  const raw = fs15.readFileUtf8(file);
+function readAccountMetadataFile(fs16, file) {
+  const raw = fs16.readFileUtf8(file);
   if (raw === void 0) {
     return void 0;
   }
@@ -7230,19 +7230,19 @@ function readAccountMetadataFile(fs15, file) {
   }
   return account.data;
 }
-function createAccountReader(fs15, identitiesDir) {
+function createAccountReader(fs16, identitiesDir) {
   const cache = /* @__PURE__ */ new Map();
   return (identity) => {
     if (!isIdentityName(identity)) {
       throw new Error(`"${identity}" is not a valid identity name.`);
     }
-    const stat = fs15.lstat(claudeJsonPath(identitiesDir, identity));
+    const stat = fs16.lstat(claudeJsonPath(identitiesDir, identity));
     const stamp = stat === void 0 ? "absent" : `${String(stat.mtimeMs)}:${String(stat.sizeBytes)}`;
     const cached = cache.get(identity);
     if (cached?.stamp === stamp) {
       return cached.account;
     }
-    const account = readAccountMetadata(fs15, identitiesDir, identity);
+    const account = readAccountMetadata(fs16, identitiesDir, identity);
     cache.set(identity, { stamp, account });
     return account;
   };
@@ -7278,9 +7278,9 @@ var init_accountDescription = __esm({
 });
 
 // src/identityAccounts.ts
-function readIdentityAccount(fs15, identitiesDir, identity) {
+function readIdentityAccount(fs16, identitiesDir, identity) {
   try {
-    const account = readAccountMetadata(fs15, identitiesDir, identity);
+    const account = readAccountMetadata(fs16, identitiesDir, identity);
     return account === void 0 ? void 0 : { account };
   } catch (error) {
     if (error instanceof AccountMetadataError) {
@@ -7919,8 +7919,8 @@ function segmentDay(epochMs) {
 function segmentName(day, pid) {
   return `${day}.${String(pid)}.jsonl`;
 }
-function listLogSegments(fs15, logDir) {
-  return fs15.readdir(logDir).flatMap((name) => {
+function listLogSegments(fs16, logDir) {
+  return fs16.readdir(logDir).flatMap((name) => {
     const match = SEGMENT_RE.exec(name);
     const day = match?.[1];
     if (day === void 0) {
@@ -7929,15 +7929,15 @@ function listLogSegments(fs15, logDir) {
     return [{ name, day, endsAt: Date.parse(`${day}T00:00:00.000Z`) + DAY_MS }];
   }).sort((left, right) => left.day.localeCompare(right.day) || left.name.localeCompare(right.name));
 }
-function readUsageLog(fs15, logDir, options = {}) {
+function readUsageLog(fs16, logDir, options = {}) {
   const { sinceMs } = options;
   const records = [];
   let invalidLines = 0;
-  for (const segment of listLogSegments(fs15, logDir)) {
+  for (const segment of listLogSegments(fs16, logDir)) {
     if (sinceMs !== void 0 && segment.endsAt <= sinceMs) {
       continue;
     }
-    const read = readSegment(fs15, logDir, segment);
+    const read = readSegment(fs16, logDir, segment);
     if (read === void 0) {
       continue;
     }
@@ -7951,8 +7951,8 @@ function readUsageLog(fs15, logDir, options = {}) {
   records.sort((left, right) => left.at.localeCompare(right.at));
   return { records, invalidLines };
 }
-function readSegment(fs15, logDir, segment) {
-  const contents = fs15.readFileUtf8(path22.join(logDir, segment.name));
+function readSegment(fs16, logDir, segment) {
+  const contents = fs16.readFileUtf8(path22.join(logDir, segment.name));
   if (contents === void 0) {
     return void 0;
   }
@@ -7986,9 +7986,9 @@ function snapshotPath(snapshotsDir, identity) {
   }
   return path22.join(snapshotsDir, `${identity}.json`);
 }
-function readUsageSnapshot(fs15, snapshotsDir, identity) {
+function readUsageSnapshot(fs16, snapshotsDir, identity) {
   const file = snapshotPath(snapshotsDir, identity);
-  const raw = fs15.readFileUtf8(file);
+  const raw = fs16.readFileUtf8(file);
   if (raw === void 0) {
     return void 0;
   }
@@ -8004,8 +8004,8 @@ function readUsageSnapshot(fs15, snapshotsDir, identity) {
   }
   return snapshot.data;
 }
-function listUsageSnapshots(fs15, snapshotsDir) {
-  return fs15.readdir(snapshotsDir).flatMap((name) => {
+function listUsageSnapshots(fs16, snapshotsDir) {
+  return fs16.readdir(snapshotsDir).flatMap((name) => {
     if (!name.endsWith(".json")) {
       return [];
     }
@@ -8013,7 +8013,7 @@ function listUsageSnapshots(fs15, snapshotsDir) {
     if (!isIdentityName(identity)) {
       return [];
     }
-    const snapshot = readUsageSnapshot(fs15, snapshotsDir, identity);
+    const snapshot = readUsageSnapshot(fs16, snapshotsDir, identity);
     return snapshot === void 0 ? [] : [snapshot];
   }).sort((left, right) => left.identity.localeCompare(right.identity));
 }
@@ -8038,11 +8038,11 @@ var init_read = __esm({
 
 // src/usage/store.ts
 import path23 from "node:path";
-function pruneUsageLog(fs15, logDir, nowMs) {
+function pruneUsageLog(fs16, logDir, nowMs) {
   const cutoff = nowMs - USAGE_RETENTION_MS;
-  for (const segment of listLogSegments(fs15, logDir)) {
+  for (const segment of listLogSegments(fs16, logDir)) {
     if (segment.endsAt <= cutoff) {
-      fs15.removeRecursive(path23.join(logDir, segment.name));
+      fs16.removeRecursive(path23.join(logDir, segment.name));
     }
   }
 }
@@ -8071,7 +8071,7 @@ function foldProviderState(current, record) {
   };
 }
 function createUsageStore(deps) {
-  const { fs: fs15, paths } = deps;
+  const { fs: fs16, paths } = deps;
   let prunedDay;
   const rewriteSnapshot = (identity, fold) => {
     if (!isIdentityName(identity)) {
@@ -8080,7 +8080,7 @@ function createUsageStore(deps) {
     }
     let current;
     try {
-      current = readUsageSnapshot(fs15, paths.usageSnapshotsDir, identity);
+      current = readUsageSnapshot(fs16, paths.usageSnapshotsDir, identity);
     } catch (error) {
       if (!(error instanceof UsageSnapshotError)) {
         throw error;
@@ -8107,8 +8107,8 @@ function createUsageStore(deps) {
       ...account === void 0 ? {} : { account },
       providers
     });
-    fs15.mkdirPrivate(paths.usageSnapshotsDir);
-    fs15.writeFilePrivate(snapshotPath(paths.usageSnapshotsDir, identity), `${JSON.stringify(snapshot, null, 2)}
+    fs16.mkdirPrivate(paths.usageSnapshotsDir);
+    fs16.writeFilePrivate(snapshotPath(paths.usageSnapshotsDir, identity), `${JSON.stringify(snapshot, null, 2)}
 `);
     deps.publish?.(snapshot);
     return true;
@@ -8117,14 +8117,14 @@ function createUsageStore(deps) {
     record: (input) => {
       const record = UsageRecordSchema.parse(input);
       const nowMs = deps.now();
-      fs15.mkdirPrivate(paths.usageDir);
-      fs15.mkdirPrivate(paths.usageLogDir);
+      fs16.mkdirPrivate(paths.usageDir);
+      fs16.mkdirPrivate(paths.usageLogDir);
       const day = segmentDay(nowMs);
       if (prunedDay !== day) {
-        pruneUsageLog(fs15, paths.usageLogDir, nowMs);
+        pruneUsageLog(fs16, paths.usageLogDir, nowMs);
         prunedDay = day;
       }
-      fs15.appendFilePrivate(path23.join(paths.usageLogDir, segmentName(day, deps.pid)), `${JSON.stringify(record)}
+      fs16.appendFilePrivate(path23.join(paths.usageLogDir, segmentName(day, deps.pid)), `${JSON.stringify(record)}
 `);
       deps.onRecord?.(record);
       if (record.identity !== void 0) {
@@ -8168,14 +8168,14 @@ import { z as z17 } from "zod";
 function errorMessage(error) {
   return error instanceof Error ? error.message : String(error);
 }
-function loadPoolMembers(fs15, paths, identities, nowMs) {
+function loadPoolMembers(fs16, paths, identities, nowMs) {
   const windowStartMs = nowMs - FIVE_HOUR_WINDOW_MS;
-  const log = readUsageLog(fs15, paths.usageLogDir, { sinceMs: windowStartMs });
+  const log = readUsageLog(fs16, paths.usageLogDir, { sinceMs: windowStartMs });
   return identities.map((identity) => {
     const records = log.records.filter((record) => record.identity === identity && record.provider === ANTHROPIC_PROVIDER && Date.parse(record.at) >= windowStartMs);
     try {
-      const snapshot = readUsageSnapshot(fs15, paths.usageSnapshotsDir, identity);
-      const account = readAccountMetadata(fs15, paths.identitiesDir, identity) ?? snapshot?.account;
+      const snapshot = readUsageSnapshot(fs16, paths.usageSnapshotsDir, identity);
+      const account = readAccountMetadata(fs16, paths.identitiesDir, identity) ?? snapshot?.account;
       return { identity, records, ...snapshot === void 0 ? {} : { snapshot }, ...account === void 0 ? {} : { account } };
     } catch (error) {
       if (error instanceof UsageSnapshotError || error instanceof AccountMetadataError) {
@@ -8294,9 +8294,9 @@ function collectPoolIdentities(pools, poolName, stack, found) {
     collectPoolIdentities(pools, nestedName, childStack, found);
   }
 }
-function readPicksFile(fs15, file) {
+function readPicksFile(fs16, file) {
   const empty = { schemaVersion: SCHEMA_VERSION, picks: {} };
-  const raw = fs15.readFileUtf8(file);
+  const raw = fs16.readFileUtf8(file);
   if (raw === void 0) {
     return { file: empty };
   }
@@ -8309,17 +8309,17 @@ function readPicksFile(fs15, file) {
   const result = PicksFileSchema.safeParse(parsed);
   return result.success ? { file: result.data } : { file: empty, problem: `${file} is not a picks file this agent-shim can read` };
 }
-function readStickyPick(fs15, picksFile, directory) {
-  const read = readPicksFile(fs15, picksFile);
+function readStickyPick(fs16, picksFile, directory) {
+  const read = readPicksFile(fs16, picksFile);
   const entry = read.file.picks[directory];
   return { ...entry === void 0 ? {} : { sticky: entry }, ...read.problem === void 0 ? {} : { problem: read.problem } };
 }
-function recordStickyPick(fs15, picksFile, directory, identity, nowMs) {
-  const current = readPicksFile(fs15, picksFile).file.picks;
+function recordStickyPick(fs16, picksFile, directory, identity, nowMs) {
+  const current = readPicksFile(fs16, picksFile).file.picks;
   const kept = Object.entries(current).filter(([, entry]) => nowMs - Date.parse(entry.at) <= USAGE_RETENTION_MS);
   const next = { schemaVersion: SCHEMA_VERSION, picks: { ...Object.fromEntries(kept), [directory]: { identity, at: new Date(nowMs).toISOString() } } };
-  fs15.mkdirPrivate(path24.dirname(picksFile));
-  fs15.writeFilePrivate(picksFile, `${JSON.stringify(next, null, 2)}
+  fs16.mkdirPrivate(path24.dirname(picksFile));
+  fs16.writeFilePrivate(picksFile, `${JSON.stringify(next, null, 2)}
 `);
 }
 var PoolGraphError, SCHEMA_VERSION, PickEntrySchema, PicksFileSchema;
@@ -8352,9 +8352,9 @@ var init_poolPick = __esm({
 
 // src/statusline/keys.ts
 import { z as z18 } from "zod";
-function valueAt(source, path48) {
+function valueAt(source, path49) {
   let current = source;
-  for (const part of path48) {
+  for (const part of path49) {
     if (!isPlainObject(current)) {
       return void 0;
     }
@@ -8362,14 +8362,14 @@ function valueAt(source, path48) {
   }
   return current;
 }
-function acceptsNull(path48) {
-  const layer = path48.reduceRight((inner, part) => ({ [part]: inner }), null);
+function acceptsNull(path49) {
+  const layer = path49.reduceRight((inner, part) => ({ [part]: inner }), null);
   return StatuslineSchema.safeParse(layer).success;
 }
-function keyOf(path48, declared) {
+function keyOf(path49, declared) {
   const optional = declared instanceof z18.ZodOptional;
   const leaf = optional ? declared.unwrap() : declared;
-  const common = { path: path48.join("."), description: declared.description ?? "", defaultValue: valueAt(STATUSLINE_DEFAULTS, path48), optional, unsettable: acceptsNull(path48) };
+  const common = { path: path49.join("."), description: declared.description ?? "", defaultValue: valueAt(STATUSLINE_DEFAULTS, path49), optional, unsettable: acceptsNull(path49) };
   if (leaf instanceof z18.ZodNumber) {
     return { ...common, kind: "integer", choices: [] };
   }
@@ -8394,7 +8394,7 @@ function keyOf(path48, declared) {
   if (leaf instanceof z18.ZodArray && leaf.element instanceof z18.ZodString) {
     return { ...common, kind: "textList", choices: [] };
   }
-  throw new TypeError(`statusline setting ${path48.join(".")} has a kind the key listing does not describe`);
+  throw new TypeError(`statusline setting ${path49.join(".")} has a kind the key listing does not describe`);
 }
 function walk(shape, prefix) {
   return Object.entries(shape).flatMap(([name, schema]) => schema instanceof z18.ZodObject ? walk(schema.shape, [...prefix, name]) : [keyOf([...prefix, name], schema)]);
@@ -8410,15 +8410,15 @@ var init_keys = __esm({
 });
 
 // src/statusline/change.ts
-function keyNamed(path48) {
-  const found = statuslineKeys().find((key) => key.path === path48);
+function keyNamed(path49) {
+  const found = statuslineKeys().find((key) => key.path === path49);
   if (found === void 0) {
-    throw new UsageError(`"${path48}" is not a statusline setting; \`agent-shim statusline keys\` lists them.`);
+    throw new UsageError(`"${path49}" is not a statusline setting; \`agent-shim statusline keys\` lists them.`);
   }
   return found;
 }
-function setAt(target, path48, value) {
-  const [head, ...rest] = path48;
+function setAt(target, path49, value) {
+  const [head, ...rest] = path49;
   if (head === void 0) {
     return;
   }
@@ -8431,8 +8431,8 @@ function setAt(target, path48, value) {
   target[head] = next;
   setAt(next, rest, value);
 }
-function removeAt(target, path48) {
-  const [head, ...rest] = path48;
+function removeAt(target, path49) {
+  const [head, ...rest] = path49;
   if (head === void 0) {
     return;
   }
@@ -8450,13 +8450,13 @@ function removeAt(target, path48) {
 }
 function applyStatuslineChange(existing, change) {
   const draft = structuredClone(existing ?? {});
-  for (const [path48, value] of Object.entries(change.set ?? {})) {
-    keyNamed(path48);
-    setAt(draft, path48.split("."), value);
+  for (const [path49, value] of Object.entries(change.set ?? {})) {
+    keyNamed(path49);
+    setAt(draft, path49.split("."), value);
   }
-  for (const path48 of change.unset ?? []) {
-    keyNamed(path48);
-    removeAt(draft, path48.split("."));
+  for (const path49 of change.unset ?? []) {
+    keyNamed(path49);
+    removeAt(draft, path49.split("."));
   }
   const result = StatuslineSchema.safeParse(draft);
   if (!result.success) {
@@ -9835,13 +9835,13 @@ function decideSignIn(facts) {
 function credentialsFilePath(farmRoot) {
   return path27.join(farmRoot, CREDENTIALS_FILE);
 }
-function identitySignIn(fs15, probe, identity) {
+function identitySignIn(fs16, probe, identity) {
   const probing = !identity.hasCredentialBlock && identity.provider === void 0;
   return decideSignIn({
     hasCredentialBlock: identity.hasCredentialBlock,
     provider: identity.provider,
     keychainItem: probing && probe.platform === "darwin" && probe.run !== void 0 ? keychainHasItem(probe.run, identity.farmRoot) : void 0,
-    credentialsFile: probing && fs15.lstat(credentialsFilePath(identity.farmRoot)) !== void 0,
+    credentialsFile: probing && fs16.lstat(credentialsFilePath(identity.farmRoot)) !== void 0,
     platform: probe.platform
   });
 }
@@ -10270,7 +10270,7 @@ var init_modelsStore = __esm({
 
 // src/codex/catalogueCredential.ts
 import { createHash as createHash7 } from "node:crypto";
-import path33 from "node:path";
+import path34 from "node:path";
 import { z as z30 } from "zod";
 function parseCatalogueBinding(raw) {
   if (raw === void 0) return void 0;
@@ -10304,8 +10304,8 @@ function signInCatalogueFingerprint(raw, filePath) {
 function savedCatalogueFingerprint(provider, paths, env, home, read) {
   if (provider.codex?.login === "chatgpt-sign-in") return signInCatalogueFingerprint(read(paths.chatgptSignInFile), paths.chatgptSignInFile);
   const configuredHome = env.CODEX_HOME;
-  const codexHome = configuredHome === void 0 || configuredHome === "" ? path33.join(home, ".codex") : configuredHome;
-  return cliCatalogueFingerprint(read(path33.join(codexHome, "auth.json")));
+  const codexHome = configuredHome === void 0 || configuredHome === "" ? path34.join(home, ".codex") : configuredHome;
+  return cliCatalogueFingerprint(read(path34.join(codexHome, "auth.json")));
 }
 var CatalogueBindingSchema;
 var init_catalogueCredential = __esm({
@@ -11412,16 +11412,16 @@ var init_cliOverride = __esm({
 });
 
 // src/launcher/launchRecords.ts
-import path41 from "node:path";
+import path42 from "node:path";
 import { z as z39 } from "zod";
 function recordFile(directory, pid, identity) {
-  return path41.join(directory, `${String(pid)}.${identity}${RECORD_SUFFIX}`);
+  return path42.join(directory, `${String(pid)}.${identity}${RECORD_SUFFIX}`);
 }
-function readRecord(fs15, directory, name) {
+function readRecord(fs16, directory, name) {
   if (!name.endsWith(RECORD_SUFFIX)) {
     return void 0;
   }
-  const raw = fs15.readFileUtf8(path41.join(directory, name));
+  const raw = fs16.readFileUtf8(path42.join(directory, name));
   if (raw === void 0) {
     return void 0;
   }
@@ -11434,20 +11434,20 @@ function readRecord(fs15, directory, name) {
   const result = LaunchRecordSchema.safeParse(parsed);
   return result.success ? result.data : void 0;
 }
-function registerLaunch(fs15, directory, owner, isRunning) {
-  fs15.mkdirPrivate(directory);
-  for (const name of fs15.readdir(directory)) {
-    const record2 = readRecord(fs15, directory, name);
+function registerLaunch(fs16, directory, owner, isRunning) {
+  fs16.mkdirPrivate(directory);
+  for (const name of fs16.readdir(directory)) {
+    const record2 = readRecord(fs16, directory, name);
     if (record2 !== void 0 && !isRunning(record2.pid)) {
-      fs15.removeRecursive(path41.join(directory, name));
+      fs16.removeRecursive(path42.join(directory, name));
     }
   }
   const file = recordFile(directory, owner.pid, owner.identity);
   const record = { pid: owner.pid, identity: owner.identity, startedAt: new Date(owner.startedAtMs).toISOString() };
-  fs15.writeFilePrivate(file, `${JSON.stringify(record)}
+  fs16.writeFilePrivate(file, `${JSON.stringify(record)}
 `);
   return () => {
-    fs15.removeRecursive(file);
+    fs16.removeRecursive(file);
   };
 }
 var LaunchRecordSchema, RECORD_SUFFIX;
@@ -11532,7 +11532,7 @@ var init_settings2 = __esm({
 });
 
 // src/launcher/flags.ts
-import path42 from "node:path";
+import path43 from "node:path";
 function resolveLaunchFlags(params) {
   const statusline = resolveStatuslineSettings(params);
   return {
@@ -11588,7 +11588,7 @@ function buildEnv(params) {
   const parentCustomHeaders = params.baseEnv.ANTHROPIC_CUSTOM_HEADERS;
   let providerCustomHeaders;
   if (!params.configDirEscapeHatch && params.resolvedIdentityName !== void 0) {
-    env.CLAUDE_CONFIG_DIR = path42.join(params.identitiesDir, params.resolvedIdentityName);
+    env.CLAUDE_CONFIG_DIR = path43.join(params.identitiesDir, params.resolvedIdentityName);
   }
   if (params.provider !== void 0) {
     const providerEnv = params.provider.definition.kind !== void 0 && params.provider.definition.kind !== "http" ? {} : params.provider.definition.env ?? {};
@@ -11680,7 +11680,7 @@ var init_extraFlags = __esm({
 });
 
 // src/usage/resumeContext.ts
-import path43 from "node:path";
+import path44 from "node:path";
 function projectDirNameOf(cwd) {
   return cwd.replace(/[^A-Za-z0-9]/g, "-");
 }
@@ -11731,15 +11731,15 @@ function contextTokensOfTranscript(text) {
   }
   return void 0;
 }
-function newestTranscript(fs15, projectDir) {
+function newestTranscript(fs16, projectDir) {
   let newest;
   let newestMs = -Infinity;
-  for (const name of fs15.readdir(projectDir)) {
+  for (const name of fs16.readdir(projectDir)) {
     if (!name.endsWith(".jsonl")) {
       continue;
     }
-    const candidate = path43.join(projectDir, name);
-    const stat = fs15.lstat(candidate);
+    const candidate = path44.join(projectDir, name);
+    const stat = fs16.lstat(candidate);
     if (stat?.kind === "file" && stat.mtimeMs > newestMs) {
       newestMs = stat.mtimeMs;
       newest = candidate;
@@ -11747,14 +11747,14 @@ function newestTranscript(fs15, projectDir) {
   }
   return newest;
 }
-function resumedContextTokens(fs15, params) {
+function resumedContextTokens(fs16, params) {
   const target = resumeTargetOf(params.passthrough);
   if (target === void 0) {
     return void 0;
   }
-  const projectDir = path43.join(params.claudeHome, "projects", projectDirNameOf(params.cwd));
-  const file = target.kind === "id" ? path43.join(projectDir, `${target.id}.jsonl`) : newestTranscript(fs15, projectDir);
-  const text = file === void 0 ? void 0 : fs15.readFileUtf8(file);
+  const projectDir = path44.join(params.claudeHome, "projects", projectDirNameOf(params.cwd));
+  const file = target.kind === "id" ? path44.join(projectDir, `${target.id}.jsonl`) : newestTranscript(fs16, projectDir);
+  const text = file === void 0 ? void 0 : fs16.readFileUtf8(file);
   return text === void 0 ? void 0 : contextTokensOfTranscript(text);
 }
 var init_resumeContext = __esm({
@@ -12351,7 +12351,7 @@ var init_launchHook = __esm({
 import { randomUUID as randomUUID4 } from "node:crypto";
 import os9 from "node:os";
 import { isDeepStrictEqual } from "node:util";
-import path44 from "node:path";
+import path45 from "node:path";
 function resolveIdentityCredential(identity, credential, env, port) {
   if (port === void 0) {
     return { ok: false, status: 1, message: `agent-shim: identity ${identity} needs its credential resolved, but this launcher has no credential port wired` };
@@ -12360,7 +12360,7 @@ function resolveIdentityCredential(identity, credential, env, port) {
   return resolution.ok ? resolution : { ok: false, status: CREDENTIAL_UNAVAILABLE_EXIT, message: resolution.message };
 }
 function pickFromPool(decided, params, parsedArgv, readOnly) {
-  const { paths, fs: fs15, proc, log } = params;
+  const { paths, fs: fs16, proc, log } = params;
   if (decided.pool === void 0) {
     return { identityDecision: decided };
   }
@@ -12379,7 +12379,7 @@ function pickFromPool(decided, params, parsedArgv, readOnly) {
     selectedVia: decided.source,
     pools: params.pools,
     paths,
-    fs: fs15,
+    fs: fs16,
     usageFs: farmRuntime.fs,
     cwd: farmRuntime.cwd,
     now: farmRuntime.now,
@@ -12403,7 +12403,7 @@ function pickFromPool(decided, params, parsedArgv, readOnly) {
   };
 }
 function decideLaunch(params, readOnly) {
-  const { paths, fs: fs15, proc, log } = params;
+  const { paths, fs: fs16, proc, log } = params;
   const { env, argv } = proc;
   const parsedArgv = parseLauncherArgv(argv);
   const cliOverride = buildCliOverride({
@@ -12418,7 +12418,7 @@ function decideLaunch(params, readOnly) {
     argv0Identity: params.pickedIdentity ?? parsedArgv.identity,
     directoryPinnedIdentity: params.directoryPinnedIdentity,
     readActiveIdentityFile: () => {
-      const raw = fs15.readFileUtf8(paths.activeIdentityFile);
+      const raw = fs16.readFileUtf8(paths.activeIdentityFile);
       if (raw === void 0) {
         return void 0;
       }
@@ -12453,7 +12453,7 @@ function decideLaunch(params, readOnly) {
   }
   let loadedIdentity;
   if (identityDecision.name !== void 0) {
-    loadedIdentity = loadIdentity(paths.identitiesDir, identityDecision.name, fs15);
+    loadedIdentity = loadIdentity(paths.identitiesDir, identityDecision.name, fs16);
     if (loadedIdentity === void 0) {
       log.error(
         `agent-shim: no identity named "${identityDecision.name}" (selected via ${identityDecision.source}). Run \`agent-shim identity add ${identityDecision.name}\` first.`
@@ -12468,7 +12468,7 @@ function decideLaunch(params, readOnly) {
     identityDefaultConfigProfile: loadedIdentity?.config.defaultConfigProfile,
     globalDefaultConfigProfile: params.globalDefaultConfigProfile
   });
-  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs15.readConfigFile(profileFilePath(paths.configProfilesDir, configProfileDecision.name, `the configuration profile selected via ${configProfileDecision.source}`)) === void 0) {
+  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs16.readConfigFile(profileFilePath(paths.configProfilesDir, configProfileDecision.name, `the configuration profile selected via ${configProfileDecision.source}`)) === void 0) {
     log.error(
       `agent-shim: no configuration profile named "${configProfileDecision.name}" (selected via ${configProfileDecision.source}). Run \`agent-shim profile add ${configProfileDecision.name}\` first.`
     );
@@ -12477,7 +12477,7 @@ function decideLaunch(params, readOnly) {
   const farmContext = farm !== void 0 && farmIdentity !== void 0 ? { farm, identity: farmIdentity, cascade: farm.loadCascade(configProfileDecision.name, cliOverride) } : void 0;
   const providerParams = {
     paths,
-    port: fs15,
+    port: fs16,
     ...parsedArgv.provider === void 0 || parsedArgv.provider === false ? {} : { cliProvider: parsedArgv.provider },
     ...farmContext === void 0 ? {} : { cascade: farmContext.cascade },
     ...loadedIdentity?.config.provider === void 0 ? {} : { identityProvider: loadedIdentity.config.provider }
@@ -12598,9 +12598,9 @@ function decideLaunch(params, readOnly) {
     const doorRecord = doorPid === void 0 ? void 0 : readFrontDoorCodexRecord(params.fs, paths.frontdoorDir, doorPid);
     const doorHome = doorRecord?.codexHome;
     const catalogueEnv = doorHome === void 0 ? proc.env : { ...proc.env, CODEX_HOME: doorHome };
-    const listedProviders = listProviderNames(fs15.readdir, paths.providersDir).flatMap((name) => {
+    const listedProviders = listProviderNames(fs16.readdir, paths.providersDir).flatMap((name) => {
       try {
-        const definition = loadProvider(paths.providersDir, name, fs15);
+        const definition = loadProvider(paths.providersDir, name, fs16);
         if (definition === void 0) return [];
         const catalogueOwner = definition.kind === "codex" ? doorPid : void 0;
         const generation = definition.kind === "codex" ? doorRecord?.generation : void 0;
@@ -12610,8 +12610,8 @@ function decideLaunch(params, readOnly) {
         if (definition.kind === "codex" && readOnly && cache !== void 0) {
           const binding = parseCatalogueBinding(params.fs.readFileUtf8(catalogueBindingPath(paths, name, catalogueOwner, generation)));
           const configuredHome = catalogueEnv.CODEX_HOME;
-          const home = configuredHome === void 0 || configuredHome === "" ? path44.join(os9.homedir(), ".codex") : configuredHome;
-          const source = definition.codex?.login === "chatgpt-sign-in" ? paths.chatgptSignInFile : path44.resolve(home, "auth.json");
+          const home = configuredHome === void 0 || configuredHome === "" ? path45.join(os9.homedir(), ".codex") : configuredHome;
+          const source = definition.codex?.login === "chatgpt-sign-in" ? paths.chatgptSignInFile : path45.resolve(home, "auth.json");
           const revision = params.fs.fileRevision?.(source);
           if (binding === void 0 || binding.fingerprint !== cache.credentialFingerprint || binding.source !== source || revision === void 0 || revision !== binding.revision) return [];
         }
@@ -12632,7 +12632,7 @@ function decideLaunch(params, readOnly) {
     return { args: args2, pickerSuppressed: startsSession && pickerSettings !== void 0 && callerSettings };
   };
   const args = argsForSupervisor().args;
-  const configDir = configDirEscapeHatchApplies || identityDecision.name === void 0 ? env.CLAUDE_CONFIG_DIR : path44.join(paths.identitiesDir, identityDecision.name);
+  const configDir = configDirEscapeHatchApplies || identityDecision.name === void 0 ? env.CLAUDE_CONFIG_DIR : path45.join(paths.identitiesDir, identityDecision.name);
   const decision = {
     identitySource: identityDecision.source,
     configDirEscapeHatch: identityDecision.configDirEscapeHatch,
@@ -12707,7 +12707,7 @@ function prepareRegisteredLaunch(params, onRecorded) {
   let unregisterLaunch;
   const updateCheck = runLaunchUpdateCheck({
     mode: params.updateMode ?? "off",
-    checkPath: path44.join(paths.root, "update.check"),
+    checkPath: path45.join(paths.root, "update.check"),
     currentVersion: package_default.version,
     port: params.update
   });
@@ -12918,12 +12918,12 @@ var init_launcher = __esm({
 });
 
 // src/ownCli.ts
-import path45 from "node:path";
+import path46 from "node:path";
 function agentShimCliPath(distDir = typeof __AGENT_SHIM_DIST_DIR__ === "string" ? __AGENT_SHIM_DIST_DIR__ : void 0) {
   if (distDir === void 0) {
     throw new OwnCliPathUnknownError();
   }
-  return path45.join(distDir, OWN_CLI_FILE_NAME);
+  return path46.join(distDir, OWN_CLI_FILE_NAME);
 }
 var OWN_CLI_FILE_NAME, OwnCliPathUnknownError;
 var init_ownCli = __esm({
@@ -12951,10 +12951,10 @@ var init_childRun = __esm({
 });
 
 // src/frontdoor/doorLog.ts
-import fs13 from "node:fs";
+import fs14 from "node:fs";
 function appendDoorLog(paths, line) {
-  fs13.mkdirSync(paths.logsDir, { recursive: true });
-  fs13.appendFileSync(paths.frontdoorLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+  fs14.mkdirSync(paths.logsDir, { recursive: true });
+  fs14.appendFileSync(paths.frontdoorLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
 `);
 }
 var init_doorLog = __esm({
@@ -12979,16 +12979,16 @@ var init_selfIdentity = __esm({
 
 // src/frontdoor/trust.ts
 import { createHash as createHash8 } from "node:crypto";
-import path46 from "node:path";
+import path47 from "node:path";
 function resolveTrustBundle(params) {
-  const { caCertFile, bundlesDir, variable, inherited, fs: fs15 } = params;
-  if (inherited === void 0 || inherited === "" || path46.resolve(inherited) === path46.resolve(caCertFile)) {
+  const { caCertFile, bundlesDir, variable, inherited, fs: fs16 } = params;
+  if (inherited === void 0 || inherited === "" || path47.resolve(inherited) === path47.resolve(caCertFile)) {
     return { path: caCertFile };
   }
-  const caPem = fs15.readFileUtf8(caCertFile);
+  const caPem = fs16.readFileUtf8(caCertFile);
   let inheritedPem;
   try {
-    inheritedPem = fs15.readFileUtf8(inherited);
+    inheritedPem = fs16.readFileUtf8(inherited);
   } catch (error) {
     return {
       path: caCertFile,
@@ -13000,10 +13000,10 @@ function resolveTrustBundle(params) {
   }
   const combined = `${inheritedPem.trimEnd()}
 ${caPem}`;
-  const bundle = path46.join(bundlesDir, `${createHash8("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
-  if (!fs15.exists(bundle)) {
-    fs15.mkdirp(bundlesDir);
-    fs15.writeFileAtomic(bundle, combined);
+  const bundle = path47.join(bundlesDir, `${createHash8("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
+  if (!fs16.exists(bundle)) {
+    fs16.mkdirp(bundlesDir);
+    fs16.writeFileAtomic(bundle, combined);
   }
   return { path: bundle };
 }
@@ -13016,7 +13016,7 @@ var init_trust = __esm({
 });
 
 // src/frontdoor/realFrontDoorPort.ts
-import fs14 from "node:fs";
+import fs15 from "node:fs";
 import os10 from "node:os";
 function realEnsurePorts(paths, spawnDaemon) {
   return {
@@ -13043,7 +13043,7 @@ function realEnsurePorts(paths, spawnDaemon) {
       }
     },
     // Read fresh for each probe: a replacement supervisor may have regenerated an unparseable CA, and the probe must trust exactly what the serving door's leaf chains to.
-    verifyListener: (port) => probeFrontDoorSync(port, fs14.readFileSync(paths.frontdoorCaCertFile, "utf8"))
+    verifyListener: (port) => probeFrontDoorSync(port, fs15.readFileSync(paths.frontdoorCaCertFile, "utf8"))
   };
 }
 function realFrontDoorPort(paths, spawnDaemon) {
@@ -13130,10 +13130,10 @@ var init_realFrontDoorPort = __esm({
     init_selfIdentity();
     init_trust();
     realTrustBundleFs = {
-      readFileUtf8: (file) => fs14.readFileSync(file, "utf8"),
-      exists: (file) => fs14.existsSync(file),
+      readFileUtf8: (file) => fs15.readFileSync(file, "utf8"),
+      exists: (file) => fs15.existsSync(file),
       mkdirp: (dir) => {
-        fs14.mkdirSync(dir, { recursive: true });
+        fs15.mkdirSync(dir, { recursive: true });
       },
       writeFileAtomic: (file, contents) => {
         realFarmFs.writeFilePrivate(file, contents);
@@ -13144,7 +13144,7 @@ var init_realFrontDoorPort = __esm({
 
 // src/launchWiring.ts
 import os11 from "node:os";
-import path47 from "node:path";
+import path48 from "node:path";
 import { randomUUID as randomUUID5 } from "node:crypto";
 function buildFarmRuntime(paths, cwd, run = realRunPort) {
   const home = os11.homedir();
@@ -13199,7 +13199,7 @@ function realPrepareLaunchParams(paths, options) {
     frontdoor: realFrontDoorPort(paths, options.spawnDaemon),
     credentials: { ...realCredentialPort, cache: realCredentialCacheEnv(paths) },
     hold: realHoldPort,
-    hasStoredLogin: (identity) => identitySignIn(realFarmFs, { platform: process.platform, run: options.run ?? realRunPort }, { farmRoot: path47.join(paths.identitiesDir, identity), hasCredentialBlock: false, provider: void 0 }).state !== "signed-out",
+    hasStoredLogin: (identity) => identitySignIn(realFarmFs, { platform: process.platform, run: options.run ?? realRunPort }, { farmRoot: path48.join(paths.identitiesDir, identity), hasCredentialBlock: false, provider: void 0 }).state !== "signed-out",
     ...farm.directoryIdentity === void 0 ? {} : { directoryPinnedIdentity: farm.directoryIdentity },
     ...farm.directoryConfigProfile === void 0 ? {} : { directoryRuleConfigProfile: farm.directoryConfigProfile },
     ...farm.globalDefaultConfigProfile === void 0 ? {} : { globalDefaultConfigProfile: farm.globalDefaultConfigProfile },
@@ -13935,8 +13935,8 @@ function pathnameOf(url) {
   return new URL(url ?? "/", "http://127.0.0.1").pathname;
 }
 function isRcSessionExchange(url) {
-  const path48 = pathnameOf(url);
-  return path48 === RC_SESSIONS_PATH_PREFIX || path48.startsWith(`${RC_SESSIONS_PATH_PREFIX}/`);
+  const path49 = pathnameOf(url);
+  return path49 === RC_SESSIONS_PATH_PREFIX || path49.startsWith(`${RC_SESSIONS_PATH_PREFIX}/`);
 }
 var RC_SESSION_ID_PREFIX = "cse_";
 var RC_IDLE_EXPIRY_MS = 45e3;
@@ -14495,8 +14495,8 @@ var RC_READ_FILE_ENCODINGS = ["utf-8", "base64"];
 function isRcReadFileEncoding(value) {
   return RC_READ_FILE_ENCODINGS.some((encoding) => encoding === value);
 }
-function buildRcReadFilePayload(requestId, path48, options) {
-  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path48, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
+function buildRcReadFilePayload(requestId, path49, options) {
+  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path49, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
 }
 function buildRcFileSuggestionsPayload(requestId, query) {
   return buildRcControlRequestPayload(requestId, { subtype: "file_suggestions", query });
@@ -14598,15 +14598,15 @@ async function getRcSessionContextUsage(deps, sessionId, detail) {
   const result = await deliverRcClientPayload(deps, sessionId, buildRcGetContextUsagePayload(requestId, detail), `request the context usage of session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
-async function readRcSessionFile(deps, sessionId, path48, options) {
-  if (path48 === "") {
+async function readRcSessionFile(deps, sessionId, path49, options) {
+  if (path49 === "") {
     return { ok: false, message: "a read-file write needs a non-empty path: the SDK's own field names the file the worker resolves against the session's cwd, and an empty string names none" };
   }
   if (options?.maxBytes !== void 0 && (!Number.isInteger(options.maxBytes) || options.maxBytes <= 0)) {
     return { ok: false, message: "a read-file write's max-bytes is a positive whole number of bytes: the SDK's own field caps the read, and a zero or negative cap reads nothing" };
   }
   const requestId = deps.newUuid();
-  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path48, options), `read ${path48} from session ${sessionId}`);
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path49, options), `read ${path49} from session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
 async function suggestRcSessionFiles(deps, sessionId, query) {
@@ -14775,11 +14775,11 @@ function createRcControlHandler(deps) {
       path: "read-file",
       read: (body) => {
         const session = bodyString(body, "session");
-        const path48 = bodyString(body, "path");
+        const path49 = bodyString(body, "path");
         const maxBytes = "maxBytes" in body ? bodyPositiveInteger(body, "maxBytes") : void 0;
         const encoding = "encoding" in body && isRcReadFileEncoding(body.encoding) ? body.encoding : void 0;
-        const refused2 = session === void 0 || path48 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
-        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path48, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
+        const refused2 = session === void 0 || path49 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
+        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path49, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
       }
     },
     {
@@ -15089,9 +15089,9 @@ function requestIdOfBody(body) {
 }
 function frontDoorRcControl(transport, token) {
   const headers = { authorization: `Bearer ${token}` };
-  const listAnswerOf = async (path48, what) => {
+  const listAnswerOf = async (path49, what) => {
     try {
-      return await transport.request({ method: "GET", path: path48, headers });
+      return await transport.request({ method: "GET", path: path49, headers });
     } catch (error) {
       throw new Error(`${what}: could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
     }
@@ -15163,10 +15163,10 @@ function frontDoorRcControl(transport, token) {
     }
     return pending;
   };
-  const writeOf = async (path48, body, describeFailure2) => {
+  const writeOf = async (path49, body, describeFailure2) => {
     let answer;
     try {
-      answer = await transport.request({ method: "POST", path: path48, headers: { ...headers, "content-type": "application/json" }, body });
+      answer = await transport.request({ method: "POST", path: path49, headers: { ...headers, "content-type": "application/json" }, body });
     } catch (error) {
       return { ok: false, message: `could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}` };
     }
@@ -15197,10 +15197,10 @@ function frontDoorRcControl(transport, token) {
     endSession: async (sessionId, reason) => await writeOf(`${CONTROL_PATH_PREFIX}/end-session`, JSON.stringify({ session: sessionId, ...reason === void 0 ? {} : { reason } }), (status, message) => `ending ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getUsage: async (sessionId, skipBehaviors) => await writeOf(`${CONTROL_PATH_PREFIX}/get-usage`, JSON.stringify({ session: sessionId, ...skipBehaviors === void 0 ? {} : { skipBehaviors } }), (status, message) => `requesting the usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getContextUsage: async (sessionId, detail) => await writeOf(`${CONTROL_PATH_PREFIX}/get-context-usage`, JSON.stringify({ session: sessionId, ...detail === void 0 ? {} : { detail } }), (status, message) => `requesting the context usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
-    readFile: async (sessionId, path48, options) => await writeOf(
+    readFile: async (sessionId, path49, options) => await writeOf(
       `${CONTROL_PATH_PREFIX}/read-file`,
-      JSON.stringify({ session: sessionId, path: path48, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
-      (status, message) => `reading ${path48} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
+      JSON.stringify({ session: sessionId, path: path49, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
+      (status, message) => `reading ${path49} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
     ),
     fileSuggestions: async (sessionId, query) => await writeOf(`${CONTROL_PATH_PREFIX}/file-suggestions`, JSON.stringify({ session: sessionId, query }), (status, message) => `requesting file suggestions from ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     keepAlive: async (sessionId) => await writeOf(`${CONTROL_PATH_PREFIX}/keep-alive`, JSON.stringify({ session: sessionId }), (status, message) => `keeping ${sessionId} alive failed (HTTP ${String(status)}): ${message}`),
@@ -15359,12 +15359,12 @@ function tlsFacts(options) {
 }
 function realRcEventDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const post = async (path48, headers, body) => await new Promise((resolve, reject) => {
+  const post = async (path49, headers, body) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method: "POST",
-      path: path48,
+      path: path49,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, "content-length": String(Buffer.byteLength(body, "utf8")) },
       agent
@@ -15429,12 +15429,12 @@ function lateRcStreamDial(resolve) {
 }
 function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const request4 = async (method, path48, headers, body, signal) => await new Promise((resolve, reject) => {
+  const request4 = async (method, path49, headers, body, signal) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method,
-      path: path48,
+      path: path49,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, ...body === void 0 ? {} : { "content-length": String(Buffer.byteLength(body, "utf8")) } },
       agent,
@@ -15476,9 +15476,9 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
       return { status, body: await readAll(response) };
     },
     openStream: async (sessionId, headers, resume, signal) => {
-      const path48 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
+      const path49 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
       const streamHeaders = resume === void 0 ? headers : { ...headers, "last-event-id": String(resume.fromSequenceNum) };
-      const { status, response } = await request4("GET", path48, streamHeaders, void 0, signal);
+      const { status, response } = await request4("GET", path49, streamHeaders, void 0, signal);
       if (!isSuccessful2(status)) {
         await readAll(response);
         return { status, chunks: NO_CHUNKS };
@@ -15728,11 +15728,11 @@ function credentialOfJson(parsed) {
 function sequenceNumOfJson(value) {
   return typeof value === "number" && Number.isInteger(value) && value >= 0 ? value : void 0;
 }
-function createRcCredentialStore(fs15, dir) {
-  fs15.mkdirPrivate(dir);
+function createRcCredentialStore(fs16, dir) {
+  fs16.mkdirPrivate(dir);
   const fileFor = (sessionId) => path13.join(dir, `${sessionId}.json`);
   const readParsed = (sessionId) => {
-    const raw = fs15.readFileUtf8(fileFor(sessionId));
+    const raw = fs16.readFileUtf8(fileFor(sessionId));
     if (raw === void 0) {
       return void 0;
     }
@@ -15757,7 +15757,7 @@ function createRcCredentialStore(fs15, dir) {
       }
       const cursor = sequenceNumOfJson(readParsed(sessionId)?.highestSequenceNum);
       const record = { ...credential, ...cursor === void 0 ? {} : { highestSequenceNum: cursor } };
-      fs15.writeFilePrivate(fileFor(sessionId), `${JSON.stringify(record, null, 2)}
+      fs16.writeFilePrivate(fileFor(sessionId), `${JSON.stringify(record, null, 2)}
 `);
     },
     readCursor: (sessionId) => {
@@ -15772,14 +15772,14 @@ function createRcCredentialStore(fs15, dir) {
       }
       const credential = credentialOfJson(readParsed(sessionId));
       const record = credential === void 0 ? { highestSequenceNum } : { ...credential, highestSequenceNum };
-      fs15.writeFilePrivate(fileFor(sessionId), `${JSON.stringify(record, null, 2)}
+      fs16.writeFilePrivate(fileFor(sessionId), `${JSON.stringify(record, null, 2)}
 `);
     },
     remove: (sessionId) => {
       if (!isSafeSessionId(sessionId)) {
         return;
       }
-      fs15.removeRecursive(fileFor(sessionId));
+      fs16.removeRecursive(fileFor(sessionId));
     }
   };
 }
@@ -16471,19 +16471,19 @@ function writePools(paths, pools) {
   applyPatch(paths.globalConfigFile, GlobalConfigSchema, { pools }, { defaults: {} });
 }
 function poolCycleOf(pools, name) {
-  const walk2 = (current, path48) => {
+  const walk2 = (current, path49) => {
     for (const entry of pools[current]?.identities ?? []) {
       const nested = poolNameOf(poolMemberIdentity(entry));
       if (nested === void 0) {
         continue;
       }
       if (nested === name) {
-        return [...path48, nested];
+        return [...path49, nested];
       }
-      if (path48.includes(nested)) {
+      if (path49.includes(nested)) {
         continue;
       }
-      const found = walk2(nested, [...path48, nested]);
+      const found = walk2(nested, [...path49, nested]);
       if (found !== void 0) {
         return found;
       }
@@ -17195,7 +17195,7 @@ var ResetRowSchema = z24.strictObject({
 var ResetScheduleSchema = z24.strictObject({ resets: z24.readonly(z24.array(ResetRowSchema)) });
 
 // src/frontdoor/controlSchemas.ts
-import path35 from "node:path";
+import path36 from "node:path";
 import { z as z32 } from "zod";
 
 // src/doctorReport.ts
@@ -17244,8 +17244,8 @@ var RenameJournalUnreadableError = class extends CliError {
   }
   detail;
 };
-function readRenameJournal(fs15, file) {
-  const raw = fs15.readFileUtf8(file);
+function readRenameJournal(fs16, file) {
+  const raw = fs16.readFileUtf8(file);
   if (raw === void 0) {
     return void 0;
   }
@@ -17261,16 +17261,16 @@ function readRenameJournal(fs15, file) {
   }
   return result.data;
 }
-function listRenameJournals(fs15, directory) {
+function listRenameJournals(fs16, directory) {
   const journals = [];
   const unreadable = [];
-  for (const name of [...fs15.readdir(directory)].sort()) {
+  for (const name of [...fs16.readdir(directory)].sort()) {
     if (!name.endsWith(JOURNAL_SUFFIX)) {
       continue;
     }
     const file = path30.join(directory, name);
     try {
-      const journal = readRenameJournal(fs15, file);
+      const journal = readRenameJournal(fs16, file);
       if (journal !== void 0) {
         journals.push(journal);
       }
@@ -17313,8 +17313,8 @@ var NameHeldByUnfinishedRenameError = class extends CliError {
     this.name = "NameHeldByUnfinishedRenameError";
   }
 };
-function requireNameFreeOfUnfinishedRename(fs15, directory, name, action, sameName, exists) {
-  const held = listRenameJournals(fs15, directory).journals.find((journal) => [journal.from, journal.to].some((heldName) => heldName === name || sameName(name, heldName)));
+function requireNameFreeOfUnfinishedRename(fs16, directory, name, action, sameName, exists) {
+  const held = listRenameJournals(fs16, directory).journals.find((journal) => [journal.from, journal.to].some((heldName) => heldName === name || sameName(name, heldName)));
   if (held !== void 0) {
     throw new NameHeldByUnfinishedRenameError(action, name, held, finishabilityOf(held, exists));
   }
@@ -17664,8 +17664,46 @@ function removeIdentity(paths, name) {
 
 // src/doctorReport.ts
 init_realPorts();
-import fs12 from "node:fs";
-import path34 from "node:path";
+import fs13 from "node:fs";
+
+// src/doctorPath.ts
+init_blockingSpawn();
+init_realPorts();
+import fs11 from "node:fs";
+import path33 from "node:path";
+function realpathOrSelf(target) {
+  try {
+    return fs11.realpathSync(target);
+  } catch {
+    return target;
+  }
+}
+var MAX_FORWARDING_SCRIPT_BYTES = 8192;
+function resolveMiseDispatcher(target, pathDirs, env, trustedExecutable) {
+  const executable = realpathOrSelf(target);
+  const trustedMise = path33.join(path33.dirname(trustedExecutable), "mise");
+  if (path33.basename(executable) !== "mise" || realpathOrSelf(trustedMise) !== executable) return void 0;
+  const result = spawnSyncBlocking("a mise shim lookup", executable, ["which", path33.basename(target)], { encoding: "utf8", env });
+  if (result.error !== void 0) return void 0;
+  if (result.status === 0 && result.stdout.trim() !== "") return result.stdout.trim();
+  if (!result.stderr.includes("not currently active")) return void 0;
+  for (const dir of pathDirs) {
+    const candidate = findExecutableInDir(dir, path33.basename(target));
+    if (candidate !== void 0 && realpathOrSelf(candidate) !== executable) {
+      try {
+        const script = fs11.statSync(candidate).size <= MAX_FORWARDING_SCRIPT_BYTES ? realFsPort.readFileUtf8(candidate) : void 0;
+        const forwarded = script === void 0 ? void 0 : /^#!\/bin\/sh\r?\nexec (\/[A-Za-z0-9_./+-]+) "\$@"\r?\n?$/.exec(script)?.[1];
+        return forwarded ?? candidate;
+      } catch {
+        return candidate;
+      }
+    }
+  }
+  return void 0;
+}
+
+// src/doctorReport.ts
+import path35 from "node:path";
 init_signIn();
 init_identityAccounts();
 init_read();
@@ -17912,7 +17950,7 @@ function pushFrontDoorListeners(push, readings) {
 
 // src/frontdoor/listenerReadings.ts
 init_probe();
-import fs11 from "node:fs";
+import fs12 from "node:fs";
 function readFrontDoorListeners(state, supervisorAlive, probes) {
   if (!supervisorAlive) {
     return [];
@@ -17932,7 +17970,7 @@ function readFrontDoorListeners(state, supervisorAlive, probes) {
 }
 function realFrontDoorListenerProbes(paths) {
   return {
-    authenticateProvider: (port) => probeFrontDoorSync(port, fs11.readFileSync(paths.frontdoorCaCertFile, "utf8")),
+    authenticateProvider: (port) => probeFrontDoorSync(port, fs12.readFileSync(paths.frontdoorCaCertFile, "utf8")),
     connect: probeListenerAcceptSync,
     now: () => performance.now()
   };
@@ -18064,11 +18102,12 @@ var DOCTOR_SECTIONS = [
   "frontdoor",
   "models"
 ];
-function refinePathShadow(status, ownExecutablePath, realpath) {
+function refinePathShadow(status, ownExecutablePath, realpath, resolveDispatcher) {
   if (status.status !== "shadowed") {
     return status;
   }
-  return realpath(status.by) === realpath(ownExecutablePath) ? { status: "ok" } : status;
+  const resolved = resolveDispatcher?.(status.by) ?? status.by;
+  return realpath(resolved) === realpath(ownExecutablePath) ? { status: "ok" } : status;
 }
 function validateJson(schema, input) {
   if (input.raw === void 0) {
@@ -18097,7 +18136,7 @@ function tcpPortEraRecord(raw) {
   return (has("port") || has("lastPort")) && !has("socketPath");
 }
 function pushPathResolution(push, resolution) {
-  const ownDir = path34.dirname(resolution.ownExecutablePath);
+  const ownDir = path35.dirname(resolution.ownExecutablePath);
   switch (resolution.agentShim.status) {
     case "ok":
       push("path-resolution", "pass", `\`agent-shim\` on PATH resolves to this running executable, ${resolution.ownExecutablePath}.`, "agent-shim");
@@ -18217,14 +18256,14 @@ function pushProvider(push, entry, cacheEnv, signIn) {
 }
 function pushLegacyName(push, params) {
   const legacyVariables = Object.keys(params.env).filter((name) => name.startsWith(LEGACY_ENV_PREFIX) && params.env[name] !== void 0).sort();
-  if (legacyVariables.length === 0 && path34.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
+  if (legacyVariables.length === 0 && path35.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
     push("legacy-name", "pass", "Nothing here still uses the former `claude-use` name.");
     return;
   }
   for (const name of legacyVariables) {
     push("legacy-name", "warn", `${name} is the former name of ${name.replace(LEGACY_ENV_PREFIX, ENV_PREFIX)}. Rename it; the old name still works but is only a fallback.`, name);
   }
-  if (path34.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
+  if (path35.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
     push(
       "legacy-name",
       "warn",
@@ -18318,7 +18357,7 @@ function runDoctor(params) {
     push("identity", "warn", `identities/${name} cannot be reached (${code}), so it is not counted as an identity. Repair the permissions of the directory or of what a symlink points through, or remove the entry.`, name);
   }
   for (const { file, detail } of params.renameJournals?.unreadable ?? []) {
-    push("identity", "fail", `${file} is not a rename journal this agent-shim can read (${detail}), so no identity can be renamed until it is fixed or removed, and it may be the trace of a rename that was left unfinished.`, path34.basename(file));
+    push("identity", "fail", `${file} is not a rename journal this agent-shim can read (${detail}), so no identity can be renamed until it is fixed or removed, and it may be the trace of a rename that was left unfinished.`, path35.basename(file));
   }
   const validIdentityNames = /* @__PURE__ */ new Set();
   const signedInAccounts = [];
@@ -18668,13 +18707,6 @@ function formatDoctorReport(report) {
   lines.push("", report.ok ? "All checks passed." : `${String(failCount)} check(s) failed.`);
   return lines;
 }
-function realpathOrSelf(target) {
-  try {
-    return fs12.realpathSync(target);
-  } catch {
-    return target;
-  }
-}
 function servingDoorListeners(paths) {
   const state = readFrontDoorState(realFarmFs, paths.frontdoorStateFile) ?? {};
   const alive = state.supervisorPid !== void 0 && realIsProcessRunning(state.supervisorPid);
@@ -18684,9 +18716,9 @@ function collectDoctorReport(params) {
   const { paths } = params;
   const { names: identityNames, unreachable: unreachableIdentities } = listIdentityDirectories(paths);
   const identities = identityNames.map((name) => {
-    const farmRoot = path34.join(paths.identitiesDir, name);
-    const identityPath = path34.join(farmRoot, "identity.json");
-    return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot, credentialsFilePresent: fs12.existsSync(credentialsFilePath(farmRoot)), account: readIdentityAccount(realFsPort, paths.identitiesDir, name)?.account };
+    const farmRoot = path35.join(paths.identitiesDir, name);
+    const identityPath = path35.join(farmRoot, "identity.json");
+    return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot, credentialsFilePresent: fs13.existsSync(credentialsFilePath(farmRoot)), account: readIdentityAccount(realFsPort, paths.identitiesDir, name)?.account };
   });
   const usageSnapshots = {};
   for (const name of identityNames) {
@@ -18701,14 +18733,14 @@ function collectDoctorReport(params) {
       }
     }
   }
-  const profileNames = fs12.existsSync(paths.configProfilesDir) ? fs12.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
+  const profileNames = fs13.existsSync(paths.configProfilesDir) ? fs13.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const configProfiles = profileNames.map((name) => {
-    const profilePath = path34.join(paths.configProfilesDir, `${name}.json`);
+    const profilePath = path35.join(paths.configProfilesDir, `${name}.json`);
     return { name, path: profilePath, raw: realFsPort.readFileUtf8(profilePath) };
   });
-  const providerNames = fs12.existsSync(paths.providersDir) ? fs12.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
+  const providerNames = fs13.existsSync(paths.providersDir) ? fs13.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const providers = providerNames.map((name) => {
-    const providerPath = path34.join(paths.providersDir, `${name}.json`);
+    const providerPath = path35.join(paths.providersDir, `${name}.json`);
     return { name, path: providerPath, raw: realFsPort.readFileUtf8(providerPath) };
   });
   const ownExecutablePath = realOwnExecutablePath();
@@ -18720,16 +18752,17 @@ function collectDoctorReport(params) {
     binaryDiscovery = { ok: false, message: error instanceof Error ? error.message : String(error) };
   }
   const shimState = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-  const pathDirs = (params.env.PATH ?? "").split(path34.delimiter).filter((dir) => dir !== "");
+  const pathDirs = (params.env.PATH ?? "").split(path35.delimiter).filter((dir) => dir !== "");
   const claudeShimShadow = shimState === void 0 ? void 0 : refinePathShadow(
     findPathShadow({
       pathDirs,
-      targetDir: path34.dirname(shimState.targetPath),
-      targetFilename: path34.basename(shimState.targetPath),
+      targetDir: path35.dirname(shimState.targetPath),
+      targetFilename: path35.basename(shimState.targetPath),
       findExecutableInDir
     }),
     shimState.targetPath,
-    realpathOrSelf
+    realpathOrSelf,
+    (target) => resolveMiseDispatcher(target, pathDirs, params.env, shimState.targetPath)
   );
   const uid = process.getuid?.();
   const allowlistContent = realFarmFs.readFileUtf8(paths.headroomAllowlistFile);
@@ -18757,19 +18790,20 @@ function collectDoctorReport(params) {
     categoriesLocal: { path: paths.categoriesLocalFile, raw: realFsPort.readFileUtf8(paths.categoriesLocalFile) },
     activeIdentity: { path: paths.activeIdentityFile, raw: realFsPort.readFileUtf8(paths.activeIdentityFile) },
     binaryDiscovery,
-    claudeShim: { state: shimState, targetExists: shimState !== void 0 && fs12.existsSync(shimState.targetPath) },
+    claudeShim: { state: shimState, targetExists: shimState !== void 0 && fs13.existsSync(shimState.targetPath) },
     rootPath: paths.root,
     pathResolution: {
       ownExecutablePath,
       agentShim: refinePathShadow(
         findPathShadow({
           pathDirs,
-          targetDir: path34.dirname(ownExecutablePath),
+          targetDir: path35.dirname(ownExecutablePath),
           targetFilename: commandFilename(ownExecutablePath, "agent-shim"),
           findExecutableInDir
         }),
         ownExecutablePath,
-        realpathOrSelf
+        realpathOrSelf,
+        (target) => resolveMiseDispatcher(target, pathDirs, params.env, ownExecutablePath)
       ),
       ...claudeShimShadow === void 0 ? {} : { claude: claudeShimShadow }
     },
@@ -18854,11 +18888,11 @@ var FrontDoorSessionsOutputSchema = z32.strictObject({ sessions: z32.readonly(z3
 var CheckRunInputSchema = z32.strictObject({
   path: z32.string().min(1),
   identity: z32.string().min(1).optional()
-}).refine((input) => path35.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+}).refine((input) => path36.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
 var PoolPickInputSchema = z32.strictObject({
   pool: z32.string().min(1),
   path: z32.string().min(1)
-}).refine((input) => path35.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+}).refine((input) => path36.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
 var DoctorFindingSchema = z32.strictObject({
   section: z32.enum(DOCTOR_SECTIONS),
   subject: z32.string().optional(),
@@ -19282,7 +19316,7 @@ function profileValue(name, paths) {
 function createConfigApiRouter(deps) {
   const authed = doorApiAuth(deps.expectedToken);
   const { paths } = deps;
-  const route = (path48, summary) => authed.meta(openapi3({ method: "POST", path: path48, summary, tags: [CONFIG_API_TAG] }));
+  const route = (path49, summary) => authed.meta(openapi3({ method: "POST", path: path49, summary, tags: [CONFIG_API_TAG] }));
   return {
     config: {
       identity: {
@@ -19669,7 +19703,7 @@ import { ORPCError as ORPCError5 } from "@orpc/client";
 import { openapi as openapi6 } from "@orpc/openapi";
 
 // src/frontdoor/launchSchemas.ts
-import path36 from "node:path";
+import path37 from "node:path";
 import { z as z36 } from "zod";
 init_statusline();
 init_claudeVersion();
@@ -19680,7 +19714,7 @@ var LaunchResolveInputSchema = z36.strictObject({
   argv: z36.readonly(z36.array(z36.string())).optional(),
   /** The launch's inherited environment. Absent means an empty one: the door's own environment is never a substitute for the caller's, so a caller that wants `AGENT_SHIM_*` switches or a `CLAUDE_CONFIG_DIR` considered names them here. Values are read, never reported. */
   env: z36.record(z36.string(), z36.string()).optional()
-}).refine((input) => path36.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+}).refine((input) => path37.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
 var LaunchPoolDecisionSchema = z36.strictObject({
   name: z36.string(),
   reasons: z36.readonly(z36.array(z36.string())),
@@ -21861,7 +21895,7 @@ data: ${JSON.stringify(envelope)}
 
 // src/frontdoor/rcSelfHostMint.ts
 init_account();
-import path37 from "node:path";
+import path38 from "node:path";
 var CREDENTIALS_FILE2 = ".credentials.json";
 var CLAUDE_JSON2 = ".claude.json";
 var RC_SELF_HOST_RECORD_DIR = "rc-selfhost";
@@ -21871,8 +21905,8 @@ var SELF_HOST_SUBSCRIPTION_TYPE = "max";
 function isRecord14(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function readJsonObject(fs15, file) {
-  const raw = fs15.readFileUtf8(file);
+function readJsonObject(fs16, file) {
+  const raw = fs16.readFileUtf8(file);
   if (raw === void 0) {
     return void 0;
   }
@@ -21884,8 +21918,8 @@ function readJsonObject(fs15, file) {
   }
   return isRecord14(parsed) ? parsed : void 0;
 }
-function readRcSelfHostRecord(fs15, frontdoorDir) {
-  const parsed = readJsonObject(fs15, path37.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
+function readRcSelfHostRecord(fs16, frontdoorDir) {
+  const parsed = readJsonObject(fs16, path38.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
   if (parsed === void 0) {
     return void 0;
   }
@@ -21899,11 +21933,11 @@ function mintRcSelfHostCredential(deps) {
   if (!isIdentityName(deps.identity)) {
     throw new Error(`"${deps.identity}" is not a valid identity name.`);
   }
-  const identityDir = path37.join(deps.identitiesDir, deps.identity);
-  const credentialsFile = path37.join(identityDir, CREDENTIALS_FILE2);
-  const claudeJsonFile = path37.join(identityDir, CLAUDE_JSON2);
-  const recordDir = path37.join(deps.frontdoorDir, RC_SELF_HOST_RECORD_DIR);
-  const recordFile2 = path37.join(recordDir, RC_SELF_HOST_RECORD_FILE);
+  const identityDir = path38.join(deps.identitiesDir, deps.identity);
+  const credentialsFile = path38.join(identityDir, CREDENTIALS_FILE2);
+  const claudeJsonFile = path38.join(identityDir, CLAUDE_JSON2);
+  const recordDir = path38.join(deps.frontdoorDir, RC_SELF_HOST_RECORD_DIR);
+  const recordFile2 = path38.join(recordDir, RC_SELF_HOST_RECORD_FILE);
   const previousRecord = readRcSelfHostRecord(deps.fs, deps.frontdoorDir);
   const existingCredentials = readJsonObject(deps.fs, credentialsFile);
   const existingOauth = isRecord14(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
@@ -21919,7 +21953,7 @@ function mintRcSelfHostCredential(deps) {
   const organizationUuid = deps.newUuid();
   const accountUuid = deps.newUuid();
   const mintedAt = new Date(deps.now()).toISOString();
-  deps.fs.mkdirPrivate(path37.dirname(credentialsFile));
+  deps.fs.mkdirPrivate(path38.dirname(credentialsFile));
   deps.fs.writeFilePrivate(credentialsFile, `${JSON.stringify({ ...existingCredentials, claudeAiOauth: { accessToken, refreshToken, expiresAt: null, scopes: [...RC_SELF_HOST_SCOPE_LIST], subscriptionType: SELF_HOST_SUBSCRIPTION_TYPE, rateLimitTier: null } }, null, 2)}
 `);
   const claudeJson = readJsonObject(deps.fs, claudeJsonFile) ?? {};
@@ -21957,25 +21991,25 @@ init_ensure2();
 // src/frontdoor/liveSessionRegistry.ts
 init_capability();
 init_state();
-import path38 from "node:path";
+import path39 from "node:path";
 function sameStat(recorded, current) {
   return recorded?.mtimeMs === current.mtimeMs && recorded.sizeBytes === current.sizeBytes;
 }
 function createLiveSessionRegistry(ports) {
-  const { fs: fs15, sessionsDir } = ports;
+  const { fs: fs16, sessionsDir } = ports;
   const known = /* @__PURE__ */ new Map();
   let tokens = /* @__PURE__ */ new Set();
   let bySessionId = /* @__PURE__ */ new Map();
-  const recordNames = () => fs15.readdir(sessionsDir).filter(isSessionRecordName);
+  const recordNames = () => fs16.readdir(sessionsDir).filter(isSessionRecordName);
   const rebuildIndexes = () => {
     const records = [...known.values()].flatMap(({ record }) => record === void 0 ? [] : [record]);
     tokens = new Set(records.map((record) => record.token));
     bySessionId = new Map(records.flatMap((record) => record.sessionId === void 0 ? [] : [[record.sessionId, record]]));
   };
   const load = (name, stat) => {
-    known.set(name, { stat: { mtimeMs: stat.mtimeMs, sizeBytes: stat.sizeBytes }, record: readFrontDoorSessionRecord(fs15, sessionsDir, name) });
+    known.set(name, { stat: { mtimeMs: stat.mtimeMs, sizeBytes: stat.sizeBytes }, record: readFrontDoorSessionRecord(fs16, sessionsDir, name) });
   };
-  const statOf = (name) => fs15.lstat(path38.join(sessionsDir, name));
+  const statOf = (name) => fs16.lstat(path39.join(sessionsDir, name));
   const reconcile = () => {
     const names = new Set(recordNames());
     let changed = false;
@@ -22042,7 +22076,7 @@ init_plan2();
 init_poolPick();
 
 // src/agents/read.ts
-import path39 from "node:path";
+import path40 from "node:path";
 import { z as z38 } from "zod";
 var PROJECTS_DIR = "projects";
 var TASKS_DIR = "tasks";
@@ -22066,17 +22100,17 @@ function parseEntry2(project, entry) {
   const base = match?.[1];
   return base === void 0 ? { project, sessionId: entry, superseded: false, entry } : { project, sessionId: base, superseded: true, entry };
 }
-function listSessions2(fs15, configDir) {
+function listSessions2(fs16, configDir) {
   const found = [];
-  for (const project of fs15.readdir(path39.join(configDir, PROJECTS_DIR))) {
-    const projectDir = path39.join(configDir, PROJECTS_DIR, project);
+  for (const project of fs16.readdir(path40.join(configDir, PROJECTS_DIR))) {
+    const projectDir = path40.join(configDir, PROJECTS_DIR, project);
     const entries = /* @__PURE__ */ new Set();
-    for (const name of fs15.readdir(projectDir)) {
+    for (const name of fs16.readdir(projectDir)) {
       if (name.endsWith(TRANSCRIPT_SUFFIX)) {
         entries.add(name.slice(0, -TRANSCRIPT_SUFFIX.length));
         continue;
       }
-      const children = fs15.readdir(path39.join(projectDir, name));
+      const children = fs16.readdir(path40.join(projectDir, name));
       if (children.includes(SUBAGENTS_DIR) || children.includes(WORKFLOWS_DIR)) {
         entries.add(name);
       }
@@ -22087,17 +22121,17 @@ function listSessions2(fs15, configDir) {
   }
   return found.sort((left, right) => left.project.localeCompare(right.project) || left.entry.localeCompare(right.entry));
 }
-function locateAgents(fs15, configDir, relativeDir, workflowRunId, report) {
+function locateAgents(fs16, configDir, relativeDir, workflowRunId, report) {
   const located = [];
-  for (const name of listDirOrReport(fs15, configDir, relativeDir, report)) {
+  for (const name of listDirOrReport(fs16, configDir, relativeDir, report)) {
     if (!name.startsWith(AGENT_FILE_PREFIX) || !name.endsWith(META_SUFFIX)) {
       continue;
     }
     const id = name.slice(AGENT_FILE_PREFIX.length, -META_SUFFIX.length);
     located.push({
       id,
-      metaPath: path39.join(relativeDir, name),
-      transcriptPath: path39.join(relativeDir, `${AGENT_FILE_PREFIX}${id}${TRANSCRIPT_SUFFIX}`),
+      metaPath: path40.join(relativeDir, name),
+      transcriptPath: path40.join(relativeDir, `${AGENT_FILE_PREFIX}${id}${TRANSCRIPT_SUFFIX}`),
       workflowRunId
     });
   }
@@ -22138,17 +22172,17 @@ function toNode(read, children) {
 function describeFailure(error) {
   return error instanceof Error ? error.message : String(error);
 }
-function readFileOrReport(fs15, configDir, relative, report) {
+function readFileOrReport(fs16, configDir, relative, report) {
   try {
-    return fs15.readFileUtf8(path39.join(configDir, relative));
+    return fs16.readFileUtf8(path40.join(configDir, relative));
   } catch (error) {
     report({ path: relative, reason: `could not be read: ${describeFailure(error)}` });
     return void 0;
   }
 }
-function listDirOrReport(fs15, configDir, relative, report) {
+function listDirOrReport(fs16, configDir, relative, report) {
   try {
-    return fs15.readdir(path39.join(configDir, relative));
+    return fs16.readdir(path40.join(configDir, relative));
   } catch (error) {
     report({ path: relative, reason: `could not be listed: ${describeFailure(error)}` });
     return [];
@@ -22171,38 +22205,38 @@ var WorkflowRunFileSchema = z38.object({
   phases: z38.array(z38.object({ title: z38.string() })).default([]),
   summary: z38.string().optional()
 });
-function summariseSession(fs15, configDir, ref) {
-  const sessionRelative = path39.join(PROJECTS_DIR, ref.project, ref.entry);
-  const subagentsRelative = path39.join(sessionRelative, SUBAGENTS_DIR);
-  const workflowsUnderSubagents = path39.join(subagentsRelative, WORKFLOWS_DIR);
+function summariseSession(fs16, configDir, ref) {
+  const sessionRelative = path40.join(PROJECTS_DIR, ref.project, ref.entry);
+  const subagentsRelative = path40.join(sessionRelative, SUBAGENTS_DIR);
+  const workflowsUnderSubagents = path40.join(subagentsRelative, WORKFLOWS_DIR);
   const isMeta = (name) => name.startsWith(AGENT_FILE_PREFIX) && name.endsWith(META_SUFFIX);
-  let agentCount = fs15.readdir(path39.join(configDir, subagentsRelative)).filter(isMeta).length;
-  for (const runDir of fs15.readdir(path39.join(configDir, workflowsUnderSubagents))) {
+  let agentCount = fs16.readdir(path40.join(configDir, subagentsRelative)).filter(isMeta).length;
+  for (const runDir of fs16.readdir(path40.join(configDir, workflowsUnderSubagents))) {
     if (runDir.startsWith(WORKFLOW_RUN_PREFIX)) {
-      agentCount += fs15.readdir(path39.join(configDir, workflowsUnderSubagents, runDir)).filter(isMeta).length;
+      agentCount += fs16.readdir(path40.join(configDir, workflowsUnderSubagents, runDir)).filter(isMeta).length;
     }
   }
-  const workflowRunCount = fs15.readdir(path39.join(configDir, sessionRelative, WORKFLOWS_DIR)).filter((name) => name.startsWith(WORKFLOW_RUN_PREFIX) && name.endsWith(JSON_SUFFIX)).length;
-  const transcript = fs15.lstat(path39.join(configDir, PROJECTS_DIR, ref.project, `${ref.entry}${TRANSCRIPT_SUFFIX}`));
+  const workflowRunCount = fs16.readdir(path40.join(configDir, sessionRelative, WORKFLOWS_DIR)).filter((name) => name.startsWith(WORKFLOW_RUN_PREFIX) && name.endsWith(JSON_SUFFIX)).length;
+  const transcript = fs16.lstat(path40.join(configDir, PROJECTS_DIR, ref.project, `${ref.entry}${TRANSCRIPT_SUFFIX}`));
   return { ...ref, agentCount, workflowRunCount, ...transcript === void 0 ? {} : { updatedAt: new Date(transcript.mtimeMs).toISOString() } };
 }
-function readSessionAgentTree(fs15, configDir, ref, options = {}) {
+function readSessionAgentTree(fs16, configDir, ref, options = {}) {
   const problems = [];
   const report = (problem) => {
     problems.push(problem);
   };
-  const sessionRelative = path39.join(PROJECTS_DIR, ref.project, ref.entry);
-  const subagentsRelative = path39.join(sessionRelative, SUBAGENTS_DIR);
-  const workflowsUnderSubagents = path39.join(subagentsRelative, WORKFLOWS_DIR);
-  const located = locateAgents(fs15, configDir, subagentsRelative, void 0, report);
-  for (const runDir of listDirOrReport(fs15, configDir, workflowsUnderSubagents, report)) {
+  const sessionRelative = path40.join(PROJECTS_DIR, ref.project, ref.entry);
+  const subagentsRelative = path40.join(sessionRelative, SUBAGENTS_DIR);
+  const workflowsUnderSubagents = path40.join(subagentsRelative, WORKFLOWS_DIR);
+  const located = locateAgents(fs16, configDir, subagentsRelative, void 0, report);
+  for (const runDir of listDirOrReport(fs16, configDir, workflowsUnderSubagents, report)) {
     if (runDir.startsWith(WORKFLOW_RUN_PREFIX)) {
-      located.push(...locateAgents(fs15, configDir, path39.join(workflowsUnderSubagents, runDir), runDir, report));
+      located.push(...locateAgents(fs16, configDir, path40.join(workflowsUnderSubagents, runDir), runDir, report));
     }
   }
   const agents = /* @__PURE__ */ new Map();
   for (const candidate of located) {
-    const text = readFileOrReport(fs15, configDir, candidate.metaPath, report);
+    const text = readFileOrReport(fs16, configDir, candidate.metaPath, report);
     if (text === void 0) {
       continue;
     }
@@ -22214,7 +22248,7 @@ function readSessionAgentTree(fs15, configDir, ref, options = {}) {
     agents.set(candidate.id, { located: candidate, meta: parsed.data });
   }
   const teamNames = [...new Set([...agents.values()].flatMap((agent) => agent.meta.teamName === void 0 ? [] : [agent.meta.teamName]))].sort();
-  const parentOf3 = resolveParents(fs15, configDir, agents, report);
+  const parentOf3 = resolveParents(fs16, configDir, agents, report);
   const childrenOf = /* @__PURE__ */ new Map();
   const roots = [];
   for (const id of agents.keys()) {
@@ -22237,12 +22271,12 @@ function readSessionAgentTree(fs15, configDir, ref, options = {}) {
     sessionId: ref.sessionId,
     superseded: ref.superseded,
     agents: roots.sort().map(build),
-    tasks: readTasks(fs15, configDir, ownTaskLists(ref.sessionId), [.../* @__PURE__ */ new Set([...teamNames, ...options.taskListIds ?? []])].filter((id) => !ownTaskLists(ref.sessionId).includes(id)), report),
-    workflowRuns: readWorkflowRuns(fs15, configDir, path39.join(sessionRelative, WORKFLOWS_DIR), report),
+    tasks: readTasks(fs16, configDir, ownTaskLists(ref.sessionId), [.../* @__PURE__ */ new Set([...teamNames, ...options.taskListIds ?? []])].filter((id) => !ownTaskLists(ref.sessionId).includes(id)), report),
+    workflowRuns: readWorkflowRuns(fs16, configDir, path40.join(sessionRelative, WORKFLOWS_DIR), report),
     problems
   };
 }
-function resolveParents(fs15, configDir, agents, report) {
+function resolveParents(fs16, configDir, agents, report) {
   const parentOf3 = /* @__PURE__ */ new Map();
   const transcriptCache = /* @__PURE__ */ new Map();
   const transcriptOf = (agent) => {
@@ -22250,7 +22284,7 @@ function resolveParents(fs15, configDir, agents, report) {
     if (cached !== void 0) {
       return cached;
     }
-    const text = readFileOrReport(fs15, configDir, agent.located.transcriptPath, report) ?? "";
+    const text = readFileOrReport(fs16, configDir, agent.located.transcriptPath, report) ?? "";
     transcriptCache.set(agent.located.id, text);
     return text;
   };
@@ -22300,16 +22334,16 @@ function resolveParents(fs15, configDir, agents, report) {
 function ownTaskLists(sessionId) {
   return [sessionId, `${SHORT_SESSION_LIST_PREFIX}${sessionId.slice(0, SHORT_SESSION_ID_LENGTH)}`];
 }
-function readTasks(fs15, configDir, ownLists, sharedLists, report) {
+function readTasks(fs16, configDir, ownLists, sharedLists, report) {
   const tasks = [];
   [...ownLists, ...sharedLists].forEach((scope, index) => {
-    const relativeDir = path39.join(TASKS_DIR, scope);
-    for (const name of [...listDirOrReport(fs15, configDir, relativeDir, report)].sort()) {
+    const relativeDir = path40.join(TASKS_DIR, scope);
+    for (const name of [...listDirOrReport(fs16, configDir, relativeDir, report)].sort()) {
       if (name.startsWith(".") || !name.endsWith(JSON_SUFFIX)) {
         continue;
       }
-      const relative = path39.join(relativeDir, name);
-      const text = readFileOrReport(fs15, configDir, relative, report);
+      const relative = path40.join(relativeDir, name);
+      const text = readFileOrReport(fs16, configDir, relative, report);
       const parsed = TaskFileSchema.safeParse(text === void 0 ? void 0 : parseJson2(text));
       if (parsed.success) {
         tasks.push(index < ownLists.length ? parsed.data : { ...parsed.data, taskList: scope });
@@ -22320,14 +22354,14 @@ function readTasks(fs15, configDir, ownLists, sharedLists, report) {
   });
   return tasks;
 }
-function readWorkflowRuns(fs15, configDir, relativeDir, report) {
+function readWorkflowRuns(fs16, configDir, relativeDir, report) {
   const runs = [];
-  for (const name of [...listDirOrReport(fs15, configDir, relativeDir, report)].sort()) {
+  for (const name of [...listDirOrReport(fs16, configDir, relativeDir, report)].sort()) {
     if (!name.startsWith(WORKFLOW_RUN_PREFIX) || !name.endsWith(JSON_SUFFIX)) {
       continue;
     }
-    const relative = path39.join(relativeDir, name);
-    const text = readFileOrReport(fs15, configDir, relative, report);
+    const relative = path40.join(relativeDir, name);
+    const text = readFileOrReport(fs16, configDir, relative, report);
     const parsed = WorkflowRunFileSchema.safeParse(text === void 0 ? void 0 : parseJson2(text));
     if (!parsed.success) {
       if (text !== void 0) {
@@ -22343,7 +22377,7 @@ function readWorkflowRuns(fs15, configDir, relativeDir, report) {
 
 // src/agents/sessions.ts
 init_cliError();
-import path40 from "node:path";
+import path41 from "node:path";
 var SessionLookupError = class extends CliError {
   constructor(message) {
     super(message);
@@ -22351,13 +22385,13 @@ var SessionLookupError = class extends CliError {
   }
 };
 function identityConfigDir(identitiesDir, identity) {
-  return path40.join(identitiesDir, identity);
+  return path41.join(identitiesDir, identity);
 }
-function historyStores(fs15, identitiesDir, identities) {
+function historyStores(fs16, identitiesDir, identities) {
   const byRealPath = /* @__PURE__ */ new Map();
   for (const identity of identities) {
     const configDir = identityConfigDir(identitiesDir, identity);
-    const real = fs15.realpath(path40.join(configDir, "projects"));
+    const real = fs16.realpath(path41.join(configDir, "projects"));
     if (real === void 0) {
       continue;
     }
@@ -22370,15 +22404,15 @@ function historyStores(fs15, identitiesDir, identities) {
   }
   return [...byRealPath.values()];
 }
-function collectSessionList(fs15, identitiesDir, identities, filters) {
+function collectSessionList(fs16, identitiesDir, identities, filters) {
   const names = filters.identity === void 0 ? identities : identities.filter((name) => name === filters.identity);
   if (filters.identity !== void 0 && names.length === 0) {
     throw new SessionLookupError(`no identity named "${filters.identity}"`);
   }
   const sessions = [];
-  for (const store of historyStores(fs15, identitiesDir, names)) {
-    for (const ref of listSessions2(fs15, store.configDir)) {
-      const summary = summariseSession(fs15, store.configDir, ref);
+  for (const store of historyStores(fs16, identitiesDir, names)) {
+    for (const ref of listSessions2(fs16, store.configDir)) {
+      const summary = summariseSession(fs16, store.configDir, ref);
       if (filters.all === true || summary.agentCount > 0 || summary.workflowRunCount > 0) {
         sessions.push({ ...summary, identities: store.identities });
       }
@@ -22386,14 +22420,14 @@ function collectSessionList(fs15, identitiesDir, identities, filters) {
   }
   return sessions.sort((left, right) => (right.updatedAt ?? "").localeCompare(left.updatedAt ?? "") || left.sessionId.localeCompare(right.sessionId));
 }
-function locateSession(fs15, identitiesDir, identities, query, onlyIdentity) {
+function locateSession(fs16, identitiesDir, identities, query, onlyIdentity) {
   const names = onlyIdentity === void 0 ? identities : identities.filter((name) => name === onlyIdentity);
   if (onlyIdentity !== void 0 && names.length === 0) {
     throw new SessionLookupError(`no identity named "${onlyIdentity}"`);
   }
   const matches = [];
-  for (const store of historyStores(fs15, identitiesDir, names)) {
-    for (const ref of listSessions2(fs15, store.configDir)) {
+  for (const store of historyStores(fs16, identitiesDir, names)) {
+    for (const ref of listSessions2(fs16, store.configDir)) {
       if (ref.sessionId.startsWith(query)) {
         matches.push({ identities: store.identities, configDir: store.configDir, ref });
       }
@@ -22410,9 +22444,9 @@ function locateSession(fs15, identitiesDir, identities, query, onlyIdentity) {
   }
   throw new SessionLookupError(`"${query}" matches ${String(candidates.length)} sessions: ${candidates.map((match) => `${match.ref.sessionId} (${match.identities.join(", ")})`).join("; ")}; give more of the id or pass --identity`);
 }
-function showSession(fs15, identitiesDir, identities, query, onlyIdentity) {
-  const located = locateSession(fs15, identitiesDir, identities, query, onlyIdentity);
-  return { identities: located.identities, tree: readSessionAgentTree(fs15, located.configDir, located.ref) };
+function showSession(fs16, identitiesDir, identities, query, onlyIdentity) {
+  const located = locateSession(fs16, identitiesDir, identities, query, onlyIdentity);
+  return { identities: located.identities, tree: readSessionAgentTree(fs16, located.configDir, located.ref) };
 }
 
 // src/agents/realFs.ts