agent-shim 11.86.4 → 11.87.0

package/dist/index.cjs

@@ -1234,6 +1234,8 @@ var init_schema = __esm({
       jobs: import_zod3.z.record(PoolNameSchema, JobSchema).optional()
     });
     IdentitySchema = import_zod3.z.strictObject({
+      /** The CLI this login belongs to; absent means Claude Code for backwards compatibility. */
+      agent: import_zod3.z.enum(["claude", "codex"]).optional(),
       $schema: import_zod3.z.string().optional(),
       name: FileNameSchema,
       /** What the identity is for, in the person's words, drawn beside its name in `identity list` and `show`, the launch banner and the statusline. Display only: the name stays the key for lookup and for the references to the identity (pools, rules, jobs, model refs), and the id for paths and Keychain service names. */
@@ -1305,7 +1307,7 @@ function parseIgnoringUnrecognisedKeys(schema, raw) {
   return second.success ? { success: true, data: second.data, ignored } : { success: false, issues: second.error.issues };
 }
 function describeIgnoredKeys(filePath, ignored) {
-  const places = ignored.map(({ path: path53, keys }) => `${path53.length === 0 ? "" : `${path53.map(String).join(".")}.`}${keys.join(", ")}`);
+  const places = ignored.map(({ path: path54, keys }) => `${path54.length === 0 ? "" : `${path54.map(String).join(".")}.`}${keys.join(", ")}`);
   return `${filePath} has settings this version of agent-shim does not know and ignores: ${places.join("; ")}. A newer release may read them.`;
 }
 function noteIgnoredKeys(filePath, ignored) {
@@ -1327,9 +1329,9 @@ function restoreIgnoredKeys(filePath, value) {
     return value;
   }
   const restored = structuredClone(value);
-  for (const { path: path53, values } of ignored) {
+  for (const { path: path54, values } of ignored) {
     let holder = restored;
-    for (const step of path53) {
+    for (const step of path54) {
       holder = isRecord(holder) ? holder[step] : void 0;
     }
     if (isRecord(holder)) {
@@ -4724,8 +4726,8 @@ function parseConnectTarget(authority) {
 function isInterceptedHost(host, interceptHosts) {
   return interceptHosts.includes(host);
 }
-function servedByPipeline(path53) {
-  return path53?.startsWith(ROUTED_PATH_PREFIX) === true;
+function servedByPipeline(path54) {
+  return path54?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 function forwardableHeaders(headers) {
   const connectionTokens = new Set(
@@ -5171,7 +5173,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "agent-shim",
-      version: "11.86.4",
+      version: "11.87.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -6997,24 +6999,73 @@ var init_realPorts = __esm({
   }
 });
 
+// src/cli/bool.ts
+function parseBoolWord(input) {
+  switch (input) {
+    case "true":
+    case "1":
+      return true;
+    case "false":
+    case "0":
+      return false;
+    default:
+      return void 0;
+  }
+}
+var init_bool = __esm({
+  "src/cli/bool.ts"() {
+    "use strict";
+  }
+});
+
+// src/cli/envBool.ts
+function parseEnvBool(variable, value) {
+  if (value === void 0 || value === "") {
+    return void 0;
+  }
+  const parsed = parseBoolWord(value);
+  if (parsed === void 0) {
+    throw new InvalidEnvBoolError(variable, value);
+  }
+  return parsed;
+}
+var InvalidEnvBoolError;
+var init_envBool = __esm({
+  "src/cli/envBool.ts"() {
+    "use strict";
+    init_cliError();
+    init_bool();
+    InvalidEnvBoolError = class extends UsageError {
+      constructor(variable, value) {
+        super(`${variable} must be one of true, false, 1 or 0, got "${value}".`);
+        this.variable = variable;
+        this.value = value;
+        this.name = "InvalidEnvBoolError";
+      }
+      variable;
+      value;
+    };
+  }
+});
+
 // src/pathNorm.ts
 function expandTilde(value, home) {
   if (value === "~") {
     return home;
   }
   if (value.startsWith("~/")) {
-    return import_node_path20.default.join(home, value.slice(2));
+    return import_node_path21.default.join(home, value.slice(2));
   }
   return value;
 }
 function normaliseRulePath(rulePath, home) {
-  return import_node_path20.default.resolve(expandTilde(rulePath, home));
+  return import_node_path21.default.resolve(expandTilde(rulePath, home));
 }
-var import_node_path20;
+var import_node_path21;
 var init_pathNorm = __esm({
   "src/pathNorm.ts"() {
     "use strict";
-    import_node_path20 = __toESM(require("node:path"), 1);
+    import_node_path21 = __toESM(require("node:path"), 1);
   }
 });
 
@@ -7038,8 +7089,8 @@ function loadCascadeInput(params) {
   });
   const levels = [];
   for (const dir of dirs) {
-    const portable = loadConfigFile(import_node_path21.default.join(dir, PORTABLE_CONFIG_FILENAME), PortableConfigSchema, params.read) ?? loadConfigFile(import_node_path21.default.join(dir, LEGACY_PORTABLE_CONFIG_FILENAME), PortableConfigSchema, params.read);
-    const portableLocal = loadConfigFile(import_node_path21.default.join(dir, PORTABLE_LOCAL_CONFIG_FILENAME), PortableConfigSchema, params.read) ?? loadConfigFile(import_node_path21.default.join(dir, LEGACY_PORTABLE_LOCAL_CONFIG_FILENAME), PortableConfigSchema, params.read);
+    const portable = loadConfigFile(import_node_path22.default.join(dir, PORTABLE_CONFIG_FILENAME), PortableConfigSchema, params.read) ?? loadConfigFile(import_node_path22.default.join(dir, LEGACY_PORTABLE_CONFIG_FILENAME), PortableConfigSchema, params.read);
+    const portableLocal = loadConfigFile(import_node_path22.default.join(dir, PORTABLE_LOCAL_CONFIG_FILENAME), PortableConfigSchema, params.read) ?? loadConfigFile(import_node_path22.default.join(dir, LEGACY_PORTABLE_LOCAL_CONFIG_FILENAME), PortableConfigSchema, params.read);
     const rules = (directoryRules?.config.rules ?? []).map((rule, index) => ({ rule, index })).filter(({ rule }) => normaliseRulePath(rule.path, params.home) === dir).map(({ rule, index }) => {
       const entryOrder = directoryRules?.ruleEntryOrders[index];
       return {
@@ -7086,11 +7137,11 @@ function readDirectorySelections(loaded) {
   }
   return { ...identity === void 0 ? {} : { identity }, ...configProfile === void 0 ? {} : { configProfile } };
 }
-var import_node_path21, PORTABLE_CONFIG_FILENAME, PORTABLE_LOCAL_CONFIG_FILENAME;
+var import_node_path22, PORTABLE_CONFIG_FILENAME, PORTABLE_LOCAL_CONFIG_FILENAME;
 var init_cascade = __esm({
   "src/launcher/cascade.ts"() {
     "use strict";
-    import_node_path21 = __toESM(require("node:path"), 1);
+    import_node_path22 = __toESM(require("node:path"), 1);
     init_load();
     init_schema();
     init_pathNorm();
@@ -7191,13 +7242,13 @@ function loadIdentity(identitiesDir, name, fs17) {
     throw new UnsafeNameError(name, "identity", FILE_NAME_RULE);
   }
   const id = resolveIdentityId(identitiesDir, name, fs17);
-  return id === void 0 ? void 0 : loadConfigFile(import_node_path22.default.join(identitiesDir, id, "identity.json"), IdentitySchema, fs17.readConfigFile);
+  return id === void 0 ? void 0 : loadConfigFile(import_node_path23.default.join(identitiesDir, id, "identity.json"), IdentitySchema, fs17.readConfigFile);
 }
-var import_node_path22, IDENTITY_DECISION_SOURCES, IDENTITY_SOURCE_LABELS, CONFIG_PROFILE_DECISION_SOURCES;
+var import_node_path23, IDENTITY_DECISION_SOURCES, IDENTITY_SOURCE_LABELS, CONFIG_PROFILE_DECISION_SOURCES;
 var init_identity = __esm({
   "src/launcher/identity.ts"() {
     "use strict";
-    import_node_path22 = __toESM(require("node:path"), 1);
+    import_node_path23 = __toESM(require("node:path"), 1);
     init_load();
     init_names();
     init_schema();
@@ -7456,7 +7507,7 @@ function requireIdentityDirectoryId(id) {
   }
 }
 function claudeJsonPath(identitiesDir, identity) {
-  return import_node_path23.default.join(identitiesDir, identity, CLAUDE_JSON);
+  return import_node_path24.default.join(identitiesDir, identity, CLAUDE_JSON);
 }
 function readAccountMetadata(fs17, identitiesDir, identity) {
   requireIdentityDirectoryId(identity);
@@ -7508,11 +7559,11 @@ function createAccountReader(fs17, identitiesDir) {
     return account;
   };
 }
-var import_node_path23, CLAUDE_JSON, AccountMetadataError, InvalidIdentityIdError;
+var import_node_path24, CLAUDE_JSON, AccountMetadataError, InvalidIdentityIdError;
 var init_account = __esm({
   "src/usage/account.ts"() {
     "use strict";
-    import_node_path23 = __toESM(require("node:path"), 1);
+    import_node_path24 = __toESM(require("node:path"), 1);
     init_cliError();
     init_names();
     init_schema();
@@ -8222,7 +8273,7 @@ function readUsageLog(fs17, logDir, options = {}) {
   return { records, invalidLines };
 }
 function readSegment(fs17, logDir, segment) {
-  const contents = fs17.readFileUtf8(import_node_path24.default.join(logDir, segment.name));
+  const contents = fs17.readFileUtf8(import_node_path25.default.join(logDir, segment.name));
   if (contents === void 0) {
     return void 0;
   }
@@ -8252,7 +8303,7 @@ function readSegment(fs17, logDir, segment) {
 }
 function snapshotPath(snapshotsDir, identity) {
   requireIdentityDirectoryId(identity);
-  return import_node_path24.default.join(snapshotsDir, `${identity}.json`);
+  return import_node_path25.default.join(snapshotsDir, `${identity}.json`);
 }
 function readUsageSnapshot(fs17, snapshotsDir, identity) {
   const file = snapshotPath(snapshotsDir, identity);
@@ -8285,11 +8336,11 @@ function listUsageSnapshots(fs17, snapshotsDir) {
     return snapshot === void 0 ? [] : [snapshot];
   }).sort((left, right) => left.identity.localeCompare(right.identity));
 }
-var import_node_path24, SEGMENT_RE, DAY_MS, UsageSnapshotError;
+var import_node_path25, SEGMENT_RE, DAY_MS, UsageSnapshotError;
 var init_read = __esm({
   "src/usage/read.ts"() {
     "use strict";
-    import_node_path24 = __toESM(require("node:path"), 1);
+    import_node_path25 = __toESM(require("node:path"), 1);
     init_account();
     init_schema2();
     SEGMENT_RE = /^(\d{4}-\d{2}-\d{2})\.(\d+)\.jsonl$/;
@@ -8310,7 +8361,7 @@ function pruneUsageLog(fs17, logDir, nowMs) {
   const cutoff = nowMs - USAGE_RETENTION_MS;
   for (const segment of listLogSegments(fs17, logDir)) {
     if (segment.endsAt <= cutoff) {
-      fs17.removeRecursive(import_node_path25.default.join(logDir, segment.name));
+      fs17.removeRecursive(import_node_path26.default.join(logDir, segment.name));
     }
   }
 }
@@ -8392,7 +8443,7 @@ function createUsageStore(deps) {
         pruneUsageLog(fs17, paths.usageLogDir, nowMs);
         prunedDay = day;
       }
-      fs17.appendFilePrivate(import_node_path25.default.join(paths.usageLogDir, segmentName(day, deps.pid)), `${JSON.stringify(record)}
+      fs17.appendFilePrivate(import_node_path26.default.join(paths.usageLogDir, segmentName(day, deps.pid)), `${JSON.stringify(record)}
 `);
       deps.onRecord?.(record);
       if (record.identity !== void 0) {
@@ -8416,11 +8467,11 @@ function createUsageStore(deps) {
     })
   };
 }
-var import_node_path25, DAY_MS2, DAYS_IN_WEEK, USAGE_RETENTION_MS;
+var import_node_path26, DAY_MS2, DAYS_IN_WEEK, USAGE_RETENTION_MS;
 var init_store2 = __esm({
   "src/usage/store.ts"() {
     "use strict";
-    import_node_path25 = __toESM(require("node:path"), 1);
+    import_node_path26 = __toESM(require("node:path"), 1);
     init_account();
     init_rateLimit();
     init_read();
@@ -8609,15 +8660,15 @@ function recordStickyPick(fs17, picksFile, directory, identity, nowMs) {
   const current = readPicksFile(fs17, picksFile).file.picks;
   const kept = Object.entries(current).filter(([, entry]) => nowMs - Date.parse(entry.at) <= USAGE_RETENTION_MS);
   const next = { schemaVersion: SCHEMA_VERSION, picks: { ...Object.fromEntries(kept), [directory]: { identity, at: new Date(nowMs).toISOString() } } };
-  fs17.mkdirPrivate(import_node_path26.default.dirname(picksFile));
+  fs17.mkdirPrivate(import_node_path27.default.dirname(picksFile));
   fs17.writeFilePrivate(picksFile, `${JSON.stringify(next, null, 2)}
 `);
 }
-var import_node_path26, import_zod17, PoolGraphError, SCHEMA_VERSION, PickEntrySchema, PicksFileSchema;
+var import_node_path27, import_zod17, PoolGraphError, SCHEMA_VERSION, PickEntrySchema, PicksFileSchema;
 var init_poolPick = __esm({
   "src/usage/poolPick.ts"() {
     "use strict";
-    import_node_path26 = __toESM(require("node:path"), 1);
+    import_node_path27 = __toESM(require("node:path"), 1);
     import_zod17 = require("zod");
     init_cliError();
     init_identity();
@@ -8644,9 +8695,9 @@ var init_poolPick = __esm({
 });
 
 // src/statusline/keys.ts
-function valueAt(source, path53) {
+function valueAt(source, path54) {
   let current = source;
-  for (const part of path53) {
+  for (const part of path54) {
     if (!isPlainObject(current)) {
       return void 0;
     }
@@ -8654,14 +8705,14 @@ function valueAt(source, path53) {
   }
   return current;
 }
-function acceptsNull(path53) {
-  const layer = path53.reduceRight((inner, part) => ({ [part]: inner }), null);
+function acceptsNull(path54) {
+  const layer = path54.reduceRight((inner, part) => ({ [part]: inner }), null);
   return StatuslineSchema.safeParse(layer).success;
 }
-function keyOf(path53, declared) {
+function keyOf(path54, declared) {
   const optional = declared instanceof import_zod18.z.ZodOptional;
   const leaf = optional ? declared.unwrap() : declared;
-  const common = { path: path53.join("."), description: declared.description ?? "", defaultValue: valueAt(STATUSLINE_DEFAULTS, path53), optional, unsettable: acceptsNull(path53) };
+  const common = { path: path54.join("."), description: declared.description ?? "", defaultValue: valueAt(STATUSLINE_DEFAULTS, path54), optional, unsettable: acceptsNull(path54) };
   if (leaf instanceof import_zod18.z.ZodNumber) {
     return { ...common, kind: "integer", choices: [] };
   }
@@ -8686,7 +8737,7 @@ function keyOf(path53, declared) {
   if (leaf instanceof import_zod18.z.ZodArray && leaf.element instanceof import_zod18.z.ZodString) {
     return { ...common, kind: "textList", choices: [] };
   }
-  throw new TypeError(`statusline setting ${path53.join(".")} has a kind the key listing does not describe`);
+  throw new TypeError(`statusline setting ${path54.join(".")} has a kind the key listing does not describe`);
 }
 function walk(shape, prefix) {
   return Object.entries(shape).flatMap(([name, schema]) => schema instanceof import_zod18.z.ZodObject ? walk(schema.shape, [...prefix, name]) : [keyOf([...prefix, name], schema)]);
@@ -8704,15 +8755,15 @@ var init_keys = __esm({
 });
 
 // src/statusline/change.ts
-function keyNamed(path53) {
-  const found = statuslineKeys().find((key) => key.path === path53);
+function keyNamed(path54) {
+  const found = statuslineKeys().find((key) => key.path === path54);
   if (found === void 0) {
-    throw new UsageError(`"${path53}" is not a statusline setting; \`agent-shim statusline keys\` lists them.`);
+    throw new UsageError(`"${path54}" is not a statusline setting; \`agent-shim statusline keys\` lists them.`);
   }
   return found;
 }
-function setAt(target, path53, value) {
-  const [head, ...rest] = path53;
+function setAt(target, path54, value) {
+  const [head, ...rest] = path54;
   if (head === void 0) {
     return;
   }
@@ -8725,8 +8776,8 @@ function setAt(target, path53, value) {
   target[head] = next;
   setAt(next, rest, value);
 }
-function removeAt(target, path53) {
-  const [head, ...rest] = path53;
+function removeAt(target, path54) {
+  const [head, ...rest] = path54;
   if (head === void 0) {
     return;
   }
@@ -8744,13 +8795,13 @@ function removeAt(target, path53) {
 }
 function applyStatuslineChange(existing, change) {
   const draft = structuredClone(existing ?? {});
-  for (const [path53, value] of Object.entries(change.set ?? {})) {
-    keyNamed(path53);
-    setAt(draft, path53.split("."), value);
+  for (const [path54, value] of Object.entries(change.set ?? {})) {
+    keyNamed(path54);
+    setAt(draft, path54.split("."), value);
   }
-  for (const path53 of change.unset ?? []) {
-    keyNamed(path53);
-    removeAt(draft, path53.split("."));
+  for (const path54 of change.unset ?? []) {
+    keyNamed(path54);
+    removeAt(draft, path54.split("."));
   }
   const result = StatuslineSchema.safeParse(draft);
   if (!result.success) {
@@ -8986,19 +9037,19 @@ function writePools(paths, pools) {
   applyPatch(paths.globalConfigFile, GlobalConfigSchema, { pools }, { defaults: {} });
 }
 function poolCycleOf(pools, name) {
-  const walk2 = (current, path53) => {
+  const walk2 = (current, path54) => {
     for (const entry of pools[current]?.identities ?? []) {
       const nested = poolNameOf(poolMemberIdentity(entry));
       if (nested === void 0) {
         continue;
       }
       if (nested === name) {
-        return [...path53, nested];
+        return [...path54, nested];
       }
-      if (path53.includes(nested)) {
+      if (path54.includes(nested)) {
         continue;
       }
-      const found = walk2(nested, [...path53, nested]);
+      const found = walk2(nested, [...path54, nested]);
       if (found !== void 0) {
         return found;
       }
@@ -9111,8 +9162,8 @@ function resolveAgentShimHome(env = process.env, home = import_node_os4.default.
   if (fromEnv !== void 0 && fromEnv !== "") {
     return fromEnv;
   }
-  const current = import_node_path27.default.join(home, HOME_DIRNAME);
-  const legacy = import_node_path27.default.join(home, LEGACY_HOME_DIRNAME);
+  const current = import_node_path28.default.join(home, HOME_DIRNAME);
+  const legacy = import_node_path28.default.join(home, LEGACY_HOME_DIRNAME);
   return !isDirectory(current) && isDirectory(legacy) ? legacy : current;
 }
 function isExistingDirectory(candidate) {
@@ -9123,71 +9174,71 @@ function resolveClaudeHome() {
   if (fromEnv !== void 0 && fromEnv !== "") {
     return fromEnv;
   }
-  return import_node_path27.default.join(import_node_os4.default.homedir(), ".claude");
+  return import_node_path28.default.join(import_node_os4.default.homedir(), ".claude");
 }
 function buildLayoutPaths(root) {
   return {
     root,
-    identitiesDir: import_node_path27.default.join(root, "identities"),
-    configProfilesDir: import_node_path27.default.join(root, "config-profiles"),
-    providersDir: import_node_path27.default.join(root, "providers"),
-    providerAliasesFile: import_node_path27.default.join(root, "provider-aliases.json"),
-    directoryRulesFile: import_node_path27.default.join(root, "directory-rules.json"),
-    activeIdentityFile: import_node_path27.default.join(root, "active-identity"),
-    globalConfigFile: import_node_path27.default.join(root, "config.json"),
-    categoriesLocalFile: import_node_path27.default.join(root, "categories.local.json"),
-    claudeShimFile: import_node_path27.default.join(root, "claude-shim.json"),
-    headroomDir: import_node_path27.default.join(root, "headroom"),
-    headroomStateFile: import_node_path27.default.join(root, "headroom", "state.json"),
-    headroomRoutingFile: import_node_path27.default.join(root, "headroom", "routing.json"),
-    headroomLegacyStateFile: import_node_path27.default.join(root, "headroom", "state.v2.json"),
-    headroomAllowlistFile: import_node_path27.default.join(root, "headroom", "run", "allowlist.txt"),
-    headroomSocketDir: import_node_path27.default.join(root, "headroom", "run"),
-    headroomLockFile: import_node_path27.default.join(root, "headroom", "start.lock"),
-    headroomSessionsDir: import_node_path27.default.join(root, "headroom", "sessions"),
-    logsDir: import_node_path27.default.join(root, "logs"),
-    headroomLogPath: import_node_path27.default.join(root, "logs", "headroom.log"),
-    frontdoorDir: import_node_path27.default.join(root, "frontdoor"),
-    frontdoorCaDir: import_node_path27.default.join(root, "frontdoor", "ca"),
-    frontdoorCaCertFile: import_node_path27.default.join(root, "frontdoor", "ca", "ca.pem"),
-    frontdoorCaKeyFile: import_node_path27.default.join(root, "frontdoor", "ca", "ca.key"),
-    frontdoorCaBundlesDir: import_node_path27.default.join(root, "frontdoor", "ca", "bundles"),
-    chatgptSignInFile: import_node_path27.default.join(root, "codex", "chatgpt-sign-in.json"),
-    frontdoorStateFile: import_node_path27.default.join(root, "frontdoor", "state.json"),
-    frontdoorLockFile: import_node_path27.default.join(root, "frontdoor", "start.lock"),
-    frontdoorControlTokenFile: import_node_path27.default.join(root, "frontdoor", "control-token"),
-    frontdoorSessionsDir: import_node_path27.default.join(root, "frontdoor", "sessions"),
-    frontdoorDirectRecordsDir: import_node_path27.default.join(root, "frontdoor", "direct"),
-    frontdoorDrainingDir: import_node_path27.default.join(root, "frontdoor", "draining"),
-    frontdoorRcCredentialsDir: import_node_path27.default.join(root, "frontdoor", "rc-credentials"),
-    frontdoorLogPath: import_node_path27.default.join(root, "logs", "frontdoor.log"),
-    usageDir: import_node_path27.default.join(root, "usage"),
-    usageLogDir: import_node_path27.default.join(root, "usage", "log"),
-    usageSnapshotsDir: import_node_path27.default.join(root, "usage", "snapshots"),
-    statuslineDir: import_node_path27.default.join(root, "statusline"),
-    catalogueDir: import_node_path27.default.join(root, "catalogues"),
-    usagePicksFile: import_node_path27.default.join(root, "usage", "picks.json"),
-    usageAnchorsFile: import_node_path27.default.join(root, "usage", "anchors.json"),
-    usageJobsFile: import_node_path27.default.join(root, "usage", "jobs.json"),
-    jobLogsDir: import_node_path27.default.join(root, "logs", "jobs"),
-    identityRenamesDir: import_node_path27.default.join(root, "identity-renames"),
-    identityNameRenamesDir: import_node_path27.default.join(root, "identity-name-renames"),
-    launchesDir: import_node_path27.default.join(root, "launches"),
-    superviseDir: import_node_path27.default.join(root, "supervise"),
-    modelMovesDir: import_node_path27.default.join(root, "model-moves"),
-    mcpPermissionsFile: import_node_path27.default.join(root, "mcp", "permissions.json")
+    identitiesDir: import_node_path28.default.join(root, "identities"),
+    configProfilesDir: import_node_path28.default.join(root, "config-profiles"),
+    providersDir: import_node_path28.default.join(root, "providers"),
+    providerAliasesFile: import_node_path28.default.join(root, "provider-aliases.json"),
+    directoryRulesFile: import_node_path28.default.join(root, "directory-rules.json"),
+    activeIdentityFile: import_node_path28.default.join(root, "active-identity"),
+    globalConfigFile: import_node_path28.default.join(root, "config.json"),
+    categoriesLocalFile: import_node_path28.default.join(root, "categories.local.json"),
+    claudeShimFile: import_node_path28.default.join(root, "claude-shim.json"),
+    headroomDir: import_node_path28.default.join(root, "headroom"),
+    headroomStateFile: import_node_path28.default.join(root, "headroom", "state.json"),
+    headroomRoutingFile: import_node_path28.default.join(root, "headroom", "routing.json"),
+    headroomLegacyStateFile: import_node_path28.default.join(root, "headroom", "state.v2.json"),
+    headroomAllowlistFile: import_node_path28.default.join(root, "headroom", "run", "allowlist.txt"),
+    headroomSocketDir: import_node_path28.default.join(root, "headroom", "run"),
+    headroomLockFile: import_node_path28.default.join(root, "headroom", "start.lock"),
+    headroomSessionsDir: import_node_path28.default.join(root, "headroom", "sessions"),
+    logsDir: import_node_path28.default.join(root, "logs"),
+    headroomLogPath: import_node_path28.default.join(root, "logs", "headroom.log"),
+    frontdoorDir: import_node_path28.default.join(root, "frontdoor"),
+    frontdoorCaDir: import_node_path28.default.join(root, "frontdoor", "ca"),
+    frontdoorCaCertFile: import_node_path28.default.join(root, "frontdoor", "ca", "ca.pem"),
+    frontdoorCaKeyFile: import_node_path28.default.join(root, "frontdoor", "ca", "ca.key"),
+    frontdoorCaBundlesDir: import_node_path28.default.join(root, "frontdoor", "ca", "bundles"),
+    chatgptSignInFile: import_node_path28.default.join(root, "codex", "chatgpt-sign-in.json"),
+    frontdoorStateFile: import_node_path28.default.join(root, "frontdoor", "state.json"),
+    frontdoorLockFile: import_node_path28.default.join(root, "frontdoor", "start.lock"),
+    frontdoorControlTokenFile: import_node_path28.default.join(root, "frontdoor", "control-token"),
+    frontdoorSessionsDir: import_node_path28.default.join(root, "frontdoor", "sessions"),
+    frontdoorDirectRecordsDir: import_node_path28.default.join(root, "frontdoor", "direct"),
+    frontdoorDrainingDir: import_node_path28.default.join(root, "frontdoor", "draining"),
+    frontdoorRcCredentialsDir: import_node_path28.default.join(root, "frontdoor", "rc-credentials"),
+    frontdoorLogPath: import_node_path28.default.join(root, "logs", "frontdoor.log"),
+    usageDir: import_node_path28.default.join(root, "usage"),
+    usageLogDir: import_node_path28.default.join(root, "usage", "log"),
+    usageSnapshotsDir: import_node_path28.default.join(root, "usage", "snapshots"),
+    statuslineDir: import_node_path28.default.join(root, "statusline"),
+    catalogueDir: import_node_path28.default.join(root, "catalogues"),
+    usagePicksFile: import_node_path28.default.join(root, "usage", "picks.json"),
+    usageAnchorsFile: import_node_path28.default.join(root, "usage", "anchors.json"),
+    usageJobsFile: import_node_path28.default.join(root, "usage", "jobs.json"),
+    jobLogsDir: import_node_path28.default.join(root, "logs", "jobs"),
+    identityRenamesDir: import_node_path28.default.join(root, "identity-renames"),
+    identityNameRenamesDir: import_node_path28.default.join(root, "identity-name-renames"),
+    launchesDir: import_node_path28.default.join(root, "launches"),
+    superviseDir: import_node_path28.default.join(root, "supervise"),
+    modelMovesDir: import_node_path28.default.join(root, "model-moves"),
+    mcpPermissionsFile: import_node_path28.default.join(root, "mcp", "permissions.json")
   };
 }
 function resolveLayoutPaths() {
   return buildLayoutPaths(resolveAgentShimHome());
 }
-var import_node_fs6, import_node_os4, import_node_path27;
+var import_node_fs6, import_node_os4, import_node_path28;
 var init_paths = __esm({
   "src/paths.ts"() {
     "use strict";
     import_node_fs6 = __toESM(require("node:fs"), 1);
     import_node_os4 = __toESM(require("node:os"), 1);
-    import_node_path27 = __toESM(require("node:path"), 1);
+    import_node_path28 = __toESM(require("node:path"), 1);
     init_legacy();
   }
 });
@@ -9215,7 +9266,7 @@ function decideSignIn(facts) {
   return { state: "signed-out", detail: facts.platform === "darwin" ? `no Keychain item and no ${CREDENTIALS_FILE}` : `no ${CREDENTIALS_FILE}` };
 }
 function credentialsFilePath(farmRoot) {
-  return import_node_path28.default.join(farmRoot, CREDENTIALS_FILE);
+  return import_node_path29.default.join(farmRoot, CREDENTIALS_FILE);
 }
 function identitySignIn(fs17, probe, identity) {
   const probing = !identity.hasCredentialBlock && identity.provider === void 0;
@@ -9227,12 +9278,12 @@ function identitySignIn(fs17, probe, identity) {
     platform: probe.platform
   });
 }
-var import_node_crypto9, import_node_path28, CREDENTIALS_FILE, KEYCHAIN_SERVICE_PREFIX, KEYCHAIN_SERVICE_HASH_DIGITS;
+var import_node_crypto9, import_node_path29, CREDENTIALS_FILE, KEYCHAIN_SERVICE_PREFIX, KEYCHAIN_SERVICE_HASH_DIGITS;
 var init_signIn = __esm({
   "src/usage/signIn.ts"() {
     "use strict";
     import_node_crypto9 = require("node:crypto");
-    import_node_path28 = __toESM(require("node:path"), 1);
+    import_node_path29 = __toESM(require("node:path"), 1);
     CREDENTIALS_FILE = ".credentials.json";
     KEYCHAIN_SERVICE_PREFIX = "Claude Code-credentials";
     KEYCHAIN_SERVICE_HASH_DIGITS = 8;
@@ -9445,7 +9496,7 @@ function serialisedFor(entry, owner) {
   return JSON.stringify({ owner, ...withoutOwner(entry) });
 }
 function tempPathFor(target) {
-  return import_node_path29.default.join(import_node_path29.default.dirname(target), `${TEMP_PREFIX}${String(process.pid)}-${(0, import_node_crypto10.randomUUID)()}`);
+  return import_node_path30.default.join(import_node_path30.default.dirname(target), `${TEMP_PREFIX}${String(process.pid)}-${(0, import_node_crypto10.randomUUID)()}`);
 }
 function processRuns(pid) {
   try {
@@ -9463,7 +9514,7 @@ function abandonedTempFiles(entries) {
 }
 function sweepAbandonedTempFiles(dir) {
   for (const entry of abandonedTempFiles(import_node_fs7.default.existsSync(dir) ? import_node_fs7.default.readdirSync(dir) : [])) {
-    import_node_fs7.default.rmSync(import_node_path29.default.join(dir, entry), { force: true });
+    import_node_fs7.default.rmSync(import_node_path30.default.join(dir, entry), { force: true });
   }
 }
 function storedEntry(store, entry, owner) {
@@ -9502,8 +9553,8 @@ function security(args, stdin) {
   return { status: result.status, stdout: result.stdout };
 }
 function createRealCredentialCache(root, keychain = { run: security, platform: process.platform }) {
-  const dir = import_node_path29.default.join(root, "credential-cache");
-  const filePath = (owner) => import_node_path29.default.join(dir, cacheFileNameFor(owner));
+  const dir = import_node_path30.default.join(root, "credential-cache");
+  const filePath = (owner) => import_node_path30.default.join(dir, cacheFileNameFor(owner));
   return {
     read(store, owner) {
       if (store === "file") {
@@ -9564,13 +9615,13 @@ function createRealCredentialCache(root, keychain = { run: security, platform: p
 function realCredentialCacheEnv(paths) {
   return { port: createRealCredentialCache(paths.root), platform: process.platform, now: () => Date.now() };
 }
-var import_node_crypto10, import_node_fs7, import_node_path29, CACHE_DIR_MODE, CACHE_FILE_MODE, TEMP_PREFIX, TEMP_NAME, RELEASED_TEMP_NAME;
+var import_node_crypto10, import_node_fs7, import_node_path30, CACHE_DIR_MODE, CACHE_FILE_MODE, TEMP_PREFIX, TEMP_NAME, RELEASED_TEMP_NAME;
 var init_realCredentialCache = __esm({
   "src/realCredentialCache.ts"() {
     "use strict";
     import_node_crypto10 = require("node:crypto");
     import_node_fs7 = __toESM(require("node:fs"), 1);
-    import_node_path29 = __toESM(require("node:path"), 1);
+    import_node_path30 = __toESM(require("node:path"), 1);
     init_blockingSpawn();
     init_names();
     init_keychainLogin();
@@ -10477,67 +10528,18 @@ var init_providersStore = __esm({
   }
 });
 
-// src/cli/bool.ts
-function parseBoolWord(input) {
-  switch (input) {
-    case "true":
-    case "1":
-      return true;
-    case "false":
-    case "0":
-      return false;
-    default:
-      return void 0;
-  }
-}
-var init_bool = __esm({
-  "src/cli/bool.ts"() {
-    "use strict";
-  }
-});
-
-// src/cli/envBool.ts
-function parseEnvBool(variable, value) {
-  if (value === void 0 || value === "") {
-    return void 0;
-  }
-  const parsed = parseBoolWord(value);
-  if (parsed === void 0) {
-    throw new InvalidEnvBoolError(variable, value);
-  }
-  return parsed;
-}
-var InvalidEnvBoolError;
-var init_envBool = __esm({
-  "src/cli/envBool.ts"() {
-    "use strict";
-    init_cliError();
-    init_bool();
-    InvalidEnvBoolError = class extends UsageError {
-      constructor(variable, value) {
-        super(`${variable} must be one of true, false, 1 or 0, got "${value}".`);
-        this.variable = variable;
-        this.value = value;
-        this.name = "InvalidEnvBoolError";
-      }
-      variable;
-      value;
-    };
-  }
-});
-
 // src/identityToken.ts
 function identityTokenDir(paths) {
-  return import_node_path30.default.join(paths.root, "credentials");
+  return import_node_path31.default.join(paths.root, "credentials");
 }
 function identityTokenPath(paths, identityId) {
-  return import_node_path30.default.join(identityTokenDir(paths), `${identityId}.token`);
+  return import_node_path31.default.join(identityTokenDir(paths), `${identityId}.token`);
 }
-var import_node_path30;
+var import_node_path31;
 var init_identityToken = __esm({
   "src/identityToken.ts"() {
     "use strict";
-    import_node_path30 = __toESM(require("node:path"), 1);
+    import_node_path31 = __toESM(require("node:path"), 1);
     init_cliError();
   }
 });
@@ -10783,7 +10785,7 @@ function listRenameJournals(fs17, directory) {
     if (!name.endsWith(JOURNAL_SUFFIX)) {
       continue;
     }
-    const file = import_node_path31.default.join(directory, name);
+    const file = import_node_path32.default.join(directory, name);
     try {
       const journal = readRenameJournal(fs17, file);
       if (journal !== void 0) {
@@ -10828,12 +10830,12 @@ function requireNameFreeOfUnfinishedRename(fs17, directory, name, action, sameNa
     throw new NameHeldByUnfinishedRenameError(action, name, held, finishabilityOf(held, exists));
   }
 }
-var import_node_crypto11, import_node_path31, import_zod21, RenameJournalSchema, FILE_NAME_HASH_DIGITS, JOURNAL_SUFFIX, RenameJournalUnreadableError, NameHeldByUnfinishedRenameError;
+var import_node_crypto11, import_node_path32, import_zod21, RenameJournalSchema, FILE_NAME_HASH_DIGITS, JOURNAL_SUFFIX, RenameJournalUnreadableError, NameHeldByUnfinishedRenameError;
 var init_identityRenameJournal = __esm({
   "src/identityRenameJournal.ts"() {
     "use strict";
     import_node_crypto11 = require("node:crypto");
-    import_node_path31 = __toESM(require("node:path"), 1);
+    import_node_path32 = __toESM(require("node:path"), 1);
     import_zod21 = require("zod");
     init_cliError();
     RenameJournalSchema = import_zod21.z.strictObject({
@@ -10881,7 +10883,7 @@ function readRecordFiles(paths) {
     if (!entry.endsWith(RECORD_SUFFIX)) {
       return [];
     }
-    const file = import_node_path32.default.join(paths.identityNameRenamesDir, entry);
+    const file = import_node_path33.default.join(paths.identityNameRenamesDir, entry);
     let parsed;
     try {
       parsed = JSON.parse(import_node_fs9.default.readFileSync(file, "utf8"));
@@ -10893,7 +10895,7 @@ function readRecordFiles(paths) {
   });
 }
 function isFiledForItsPair(entry) {
-  return import_node_path32.default.basename(entry.file) === renamePairFileName(entry.record.from, entry.record.to, RECORD_SUFFIX);
+  return import_node_path33.default.basename(entry.file) === renamePairFileName(entry.record.from, entry.record.to, RECORD_SUFFIX);
 }
 function readNameRenameRecords(paths) {
   return readRecordFiles(paths).filter(isFiledForItsPair).map((entry) => entry.record);
@@ -10954,12 +10956,12 @@ function requireNoInterruptedNameRename(paths, name, action, except) {
     throw new InterruptedNameRenameError(action, describeInterruptedNameRename(paths, held));
   }
 }
-var import_node_fs9, import_node_path32, import_zod22, NameRenameRecordSchema, RECORD_SUFFIX, InterruptedNameRenameError;
+var import_node_fs9, import_node_path33, import_zod22, NameRenameRecordSchema, RECORD_SUFFIX, InterruptedNameRenameError;
 var init_identityNameRenameRecord = __esm({
   "src/identityNameRenameRecord.ts"() {
     "use strict";
     import_node_fs9 = __toESM(require("node:fs"), 1);
-    import_node_path32 = __toESM(require("node:path"), 1);
+    import_node_path33 = __toESM(require("node:path"), 1);
     import_zod22 = require("zod");
     init_cliError();
     init_configProfilesStore();
@@ -10989,13 +10991,13 @@ var init_identityNameRenameRecord = __esm({
 
 // src/launcher/launchRecords.ts
 function recordFile(directory, pid) {
-  return import_node_path33.default.join(directory, `${String(pid)}.${(0, import_node_crypto12.randomUUID)()}${RECORD_SUFFIX2}`);
+  return import_node_path34.default.join(directory, `${String(pid)}.${(0, import_node_crypto12.randomUUID)()}${RECORD_SUFFIX2}`);
 }
 function readRecord(fs17, directory, name) {
   if (!name.endsWith(RECORD_SUFFIX2)) {
     return void 0;
   }
-  const raw = fs17.readFileUtf8(import_node_path33.default.join(directory, name));
+  const raw = fs17.readFileUtf8(import_node_path34.default.join(directory, name));
   if (raw === void 0) {
     return void 0;
   }
@@ -11013,7 +11015,7 @@ function registerLaunch(fs17, directory, owner, isRunning) {
   for (const name of fs17.readdir(directory)) {
     const record2 = readRecord(fs17, directory, name);
     if (record2 !== void 0 && !isRunning(record2.pid)) {
-      fs17.removeRecursive(import_node_path33.default.join(directory, name));
+      fs17.removeRecursive(import_node_path34.default.join(directory, name));
     }
   }
   const file = recordFile(directory, owner.pid);
@@ -11030,11 +11032,11 @@ function liveLaunchesOn(fs17, directory, identity, isRunning) {
     return record?.identity === identity && isRunning(record.pid) ? [record.pid] : [];
   }).sort((left, right) => left - right);
 }
-var import_node_path33, import_node_crypto12, import_zod23, LaunchRecordSchema, RECORD_SUFFIX2;
+var import_node_path34, import_node_crypto12, import_zod23, LaunchRecordSchema, RECORD_SUFFIX2;
 var init_launchRecords = __esm({
   "src/launcher/launchRecords.ts"() {
     "use strict";
-    import_node_path33 = __toESM(require("node:path"), 1);
+    import_node_path34 = __toESM(require("node:path"), 1);
     import_node_crypto12 = require("node:crypto");
     import_zod23 = require("zod");
     LaunchRecordSchema = import_zod23.z.strictObject({
@@ -11078,13 +11080,13 @@ function identityNameOf(paths, id) {
   return identityNameIn(identityRecords(paths), id);
 }
 function identityDirectory(paths, id) {
-  return import_node_path34.default.join(paths.identitiesDir, id);
+  return import_node_path35.default.join(paths.identitiesDir, id);
 }
 function identityJsonPath(paths, id) {
   if (!isStoredName(id)) {
     throw new UnsafeNameError(id, "identity");
   }
-  return import_node_path34.default.join(identityDirectory(paths, id), IDENTITY_FILE);
+  return import_node_path35.default.join(identityDirectory(paths, id), IDENTITY_FILE);
 }
 function requireIdentityNames(paths, names) {
   const existing = new Set(listIdentities(paths).map((entry) => entry.name));
@@ -11108,7 +11110,7 @@ function readIdentityById(paths, id) {
   return readJson(identityJsonPath(paths, id), IdentitySchema);
 }
 function idKeyedFiles(paths, id) {
-  return [identityTokenPath(paths, id), import_node_path34.default.join(paths.root, "credential-cache", cacheFileNameFor(identityCacheKey(id))), snapshotPath(paths.usageSnapshotsDir, id)];
+  return [identityTokenPath(paths, id), import_node_path35.default.join(paths.root, "credential-cache", cacheFileNameFor(identityCacheKey(id))), snapshotPath(paths.usageSnapshotsDir, id)];
 }
 function loggedIdentityIds(paths) {
   let logged;
@@ -11138,7 +11140,7 @@ function stateFiledUnder(paths, id, allocation, moving) {
   const folded = id.toLowerCase();
   const entry = (import_node_fs10.default.existsSync(paths.identitiesDir) ? import_node_fs10.default.readdirSync(paths.identitiesDir) : []).find((candidate) => candidate !== moving?.lockEntry && belongsToIdentity(candidate.toLowerCase(), folded));
   if (entry !== void 0) {
-    return `${import_node_path34.default.join(paths.identitiesDir, entry)} exists${entry.toLowerCase() === folded && entry !== id ? `, and an id that differs from "${id}" only in case is the same directory on a filesystem that ignores case` : ""}`;
+    return `${import_node_path35.default.join(paths.identitiesDir, entry)} exists${entry.toLowerCase() === folded && entry !== id ? `, and an id that differs from "${id}" only in case is the same directory on a filesystem that ignores case` : ""}`;
   }
   const sharing = allocation.recordIds().find((other) => other.toLowerCase() !== folded && other !== moving?.id && foldedCacheFile(other) === foldedCacheFile(id));
   if (sharing !== void 0) {
@@ -11146,12 +11148,12 @@ function stateFiledUnder(paths, id, allocation, moving) {
     const sharingFile = cacheFileNameFor(identityCacheKey(sharing));
     return `the credential cache would file it in ${file}, ${file === sharingFile ? `the file of identities/${sharing}` : `which differs only in case from the file of identities/${sharing}, ${sharingFile}`}`;
   }
-  const cacheDir = import_node_path34.default.join(paths.root, "credential-cache");
+  const cacheDir = import_node_path35.default.join(paths.root, "credential-cache");
   const ownCacheFile = moving !== void 0 && createRealCredentialCache(paths.root).read("file", identityCacheKey(moving.id)) !== void 0 ? cacheFileNameFor(identityCacheKey(moving.id)) : void 0;
   for (const candidate of idKeyedFiles(paths, id)) {
-    const onDisk = entriesOf(import_node_path34.default.dirname(candidate)).find((spelled) => spelled.toLowerCase() === import_node_path34.default.basename(candidate).toLowerCase() && !(import_node_path34.default.dirname(candidate) === cacheDir && spelled === ownCacheFile));
+    const onDisk = entriesOf(import_node_path35.default.dirname(candidate)).find((spelled) => spelled.toLowerCase() === import_node_path35.default.basename(candidate).toLowerCase() && !(import_node_path35.default.dirname(candidate) === cacheDir && spelled === ownCacheFile));
     if (onDisk !== void 0) {
-      return `${import_node_path34.default.join(import_node_path34.default.dirname(candidate), onDisk)} exists${onDisk === import_node_path34.default.basename(candidate) ? "" : `, and a file name that differs from ${import_node_path34.default.basename(candidate)} only in case is the same file on a filesystem that ignores case`}`;
+      return `${import_node_path35.default.join(import_node_path35.default.dirname(candidate), onDisk)} exists${onDisk === import_node_path35.default.basename(candidate) ? "" : `, and a file name that differs from ${import_node_path35.default.basename(candidate)} only in case is the same file on a filesystem that ignores case`}`;
     }
   }
   if (allocation.keychain !== void 0 && keychainCacheEntryExists(allocation.keychain, identityCacheKey(id))) {
@@ -11195,7 +11197,7 @@ function addIdentity(paths, name, options = {}) {
     if (checkedId !== void 0 && idTaken(paths, checkedId, allocation)) {
       throw new CheckedIdTakenError(name, checkedId);
     }
-    const identity = IdentitySchema.parse({ name, allowAmbientCredential: false });
+    const identity = IdentitySchema.parse({ name, allowAmbientCredential: false, ...options.agent === void 0 ? {} : { agent: options.agent } });
     writeJsonAtomic(identityJsonPath(paths, id()), identity);
     return identity;
   });
@@ -11256,7 +11258,7 @@ function listIdentityDirectories(paths) {
       if (!isIdentityDirectoryName(entry.name)) {
         continue;
       }
-      const entryPath = import_node_path34.default.join(paths.identitiesDir, entry.name);
+      const entryPath = import_node_path35.default.join(paths.identitiesDir, entry.name);
       const followed = entry.isDirectory() ? "directory" : entry.isSymbolicLink() ? followedLink(entryPath) : "other";
       if (followed === "other") {
         continue;
@@ -11366,7 +11368,7 @@ function isFarmEntry(entry, name) {
   return entry === name || new RegExp(`^\\.${escapedForPattern(name)}${FARM_SUFFIX_PATTERN}$`, "u").test(entry);
 }
 function belongsToIdentity(entry, name) {
-  return isFarmEntry(entry, name) || entry === import_node_path34.default.basename(identityLockPath("", name));
+  return isFarmEntry(entry, name) || entry === import_node_path35.default.basename(identityLockPath("", name));
 }
 function requireNewIdentityName(name) {
   if (!FileNameSchema.safeParse(name).success) {
@@ -11374,7 +11376,7 @@ function requireNewIdentityName(name) {
   }
 }
 function sameIdentityName(paths, first, second) {
-  return sameDirectory(import_node_path34.default.join(paths.identitiesDir, first), import_node_path34.default.join(paths.identitiesDir, second)) || first.toLowerCase() === second.toLowerCase() && ignoresCase(paths.identitiesDir);
+  return sameDirectory(import_node_path35.default.join(paths.identitiesDir, first), import_node_path35.default.join(paths.identitiesDir, second)) || first.toLowerCase() === second.toLowerCase() && ignoresCase(paths.identitiesDir);
 }
 function requireNoUnfinishedRenameNaming(paths, name, action) {
   requireNameFreeOfUnfinishedRename({ readFileUtf8: nodeStoreFs.readFileUtf8, readdir: (directory) => import_node_fs10.default.existsSync(directory) ? import_node_fs10.default.readdirSync(directory) : [] }, paths.identityRenamesDir, name, action, (first, second) => sameIdentityName(paths, first, second), (identity) => identityIdExists(paths, identity));
@@ -11404,17 +11406,17 @@ function removeIdentityWithLockHeld(paths, name, namesLock) {
   }
   const resync = acquireRemovalLock(paths, name, id, namesLock);
   try {
-    const lockFile = import_node_path34.default.basename(resync.path);
+    const lockFile = import_node_path35.default.basename(resync.path);
     for (const file of idKeyedFiles(paths, id).filter((candidate) => import_node_fs10.default.existsSync(candidate))) {
-      import_node_fs10.default.accessSync(import_node_path34.default.dirname(file), import_node_fs10.default.constants.W_OK | import_node_fs10.default.constants.X_OK);
+      import_node_fs10.default.accessSync(import_node_path35.default.dirname(file), import_node_fs10.default.constants.W_OK | import_node_fs10.default.constants.X_OK);
     }
-    const links = import_node_fs10.default.readdirSync(paths.identitiesDir).filter((entry) => !entry.startsWith(".") && entry !== id && sameDirectory(import_node_path34.default.join(paths.identitiesDir, entry), import_node_path34.default.join(paths.identitiesDir, id)));
+    const links = import_node_fs10.default.readdirSync(paths.identitiesDir).filter((entry) => !entry.startsWith(".") && entry !== id && sameDirectory(import_node_path35.default.join(paths.identitiesDir, entry), import_node_path35.default.join(paths.identitiesDir, id)));
     for (const entry of import_node_fs10.default.readdirSync(paths.identitiesDir)) {
       if (links.includes(entry) || entry !== lockFile && belongsToIdentity(entry, id)) {
-        import_node_fs10.default.rmSync(import_node_path34.default.join(paths.identitiesDir, entry), { recursive: true, force: true });
+        import_node_fs10.default.rmSync(import_node_path35.default.join(paths.identitiesDir, entry), { recursive: true, force: true });
       }
     }
-    const cacheFile = import_node_path34.default.join(paths.root, "credential-cache", cacheFileNameFor(identityCacheKey(id)));
+    const cacheFile = import_node_path35.default.join(paths.root, "credential-cache", cacheFileNameFor(identityCacheKey(id)));
     for (const file of idKeyedFiles(paths, id).filter((candidate) => candidate !== cacheFile)) {
       import_node_fs10.default.rmSync(file, { force: true });
     }
@@ -11427,12 +11429,12 @@ function removeIdentityWithLockHeld(paths, name, namesLock) {
     resync.release();
   }
 }
-var import_node_fs10, import_node_path34, IdentityNotFoundError, DisplacedIdentityError, IdentityAlreadyExistsError, InvalidIdentityNameError, realUsageReadFs, realRecordsPort, CheckedIdTakenError, DISPLACED_PROBLEM, NOT_JSON_PROBLEM, IdentityRemovalBusyError, REMOVED_STATE;
+var import_node_fs10, import_node_path35, IdentityNotFoundError, DisplacedIdentityError, IdentityAlreadyExistsError, InvalidIdentityNameError, realUsageReadFs, realRecordsPort, CheckedIdTakenError, DISPLACED_PROBLEM, NOT_JSON_PROBLEM, IdentityRemovalBusyError, REMOVED_STATE;
 var init_identityStore = __esm({
   "src/identityStore.ts"() {
     "use strict";
     import_node_fs10 = __toESM(require("node:fs"), 1);
-    import_node_path34 = __toESM(require("node:path"), 1);
+    import_node_path35 = __toESM(require("node:path"), 1);
     init_load();
     init_names();
     init_store();
@@ -11666,10 +11668,10 @@ function commandFilename(ownExecutablePath, commandName) {
 }
 function resolveOwnBinaryCheck(paths, contentSourcePath) {
   const state = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-  const recordedTarget = state === void 0 ? void 0 : import_node_path36.default.resolve(state.targetPath);
+  const recordedTarget = state === void 0 ? void 0 : import_node_path37.default.resolve(state.targetPath);
   let ownStat;
   return (candidate) => {
-    if (recordedTarget !== void 0 && import_node_path36.default.resolve(candidate) === recordedTarget) {
+    if (recordedTarget !== void 0 && import_node_path37.default.resolve(candidate) === recordedTarget) {
       return true;
     }
     ownStat ??= statOrUndefined(contentSourcePath);
@@ -11692,22 +11694,22 @@ function statOrUndefined(target) {
   }
 }
 function findPathShadow(params) {
-  const resolvedTargetDir = import_node_path36.default.resolve(params.targetDir);
+  const resolvedTargetDir = import_node_path37.default.resolve(params.targetDir);
   for (const dir of params.pathDirs) {
     const found = params.findExecutableInDir(dir, params.targetFilename);
     if (found === void 0) {
       continue;
     }
-    return import_node_path36.default.resolve(dir) === resolvedTargetDir ? { status: "ok" } : { status: "shadowed", by: found };
+    return import_node_path37.default.resolve(dir) === resolvedTargetDir ? { status: "ok" } : { status: "shadowed", by: found };
   }
-  return params.pathDirs.some((dir) => import_node_path36.default.resolve(dir) === resolvedTargetDir) ? { status: "ok" } : { status: "not-on-path" };
+  return params.pathDirs.some((dir) => import_node_path37.default.resolve(dir) === resolvedTargetDir) ? { status: "ok" } : { status: "not-on-path" };
 }
-var import_node_fs11, import_node_path36, import_zod28, ClaudeShimStateSchema, nodeLinkFs;
+var import_node_fs11, import_node_path37, import_zod28, ClaudeShimStateSchema, nodeLinkFs;
 var init_claudeShim = __esm({
   "src/claudeShim.ts"() {
     "use strict";
     import_node_fs11 = __toESM(require("node:fs"), 1);
-    import_node_path36 = __toESM(require("node:path"), 1);
+    import_node_path37 = __toESM(require("node:path"), 1);
     import_zod28 = require("zod");
     init_commandDeps();
     init_store();
@@ -11903,15 +11905,15 @@ function signInCatalogueFingerprint(raw, filePath) {
 function savedCatalogueFingerprint(provider, paths, env, home, read) {
   if (provider.codex?.login === "chatgpt-sign-in") return signInCatalogueFingerprint(read(paths.chatgptSignInFile), paths.chatgptSignInFile);
   const configuredHome = env.CODEX_HOME;
-  const codexHome = configuredHome === void 0 || configuredHome === "" ? import_node_path39.default.join(home, ".codex") : configuredHome;
-  return cliCatalogueFingerprint(read(import_node_path39.default.join(codexHome, "auth.json")));
+  const codexHome = configuredHome === void 0 || configuredHome === "" ? import_node_path40.default.join(home, ".codex") : configuredHome;
+  return cliCatalogueFingerprint(read(import_node_path40.default.join(codexHome, "auth.json")));
 }
-var import_node_crypto13, import_node_path39, import_zod32, CatalogueBindingSchema;
+var import_node_crypto13, import_node_path40, import_zod32, CatalogueBindingSchema;
 var init_catalogueCredential = __esm({
   "src/codex/catalogueCredential.ts"() {
     "use strict";
     import_node_crypto13 = require("node:crypto");
-    import_node_path39 = __toESM(require("node:path"), 1);
+    import_node_path40 = __toESM(require("node:path"), 1);
     import_zod32 = require("zod");
     init_siwcStore();
     CatalogueBindingSchema = import_zod32.z.strictObject({ fingerprint: import_zod32.z.string().min(1), source: import_zod32.z.string().min(1), revision: import_zod32.z.string().min(1) });
@@ -13140,7 +13142,7 @@ function buildEnv(params) {
   const parentCustomHeaders = params.baseEnv.ANTHROPIC_CUSTOM_HEADERS;
   let providerCustomHeaders;
   if (!params.configDirEscapeHatch && params.identityId !== void 0) {
-    env.CLAUDE_CONFIG_DIR = import_node_path47.default.join(params.identitiesDir, params.identityId);
+    env.CLAUDE_CONFIG_DIR = import_node_path48.default.join(params.identitiesDir, params.identityId);
   }
   if (params.provider !== void 0) {
     const providerEnv = params.provider.definition.kind !== void 0 && params.provider.definition.kind !== "http" ? {} : params.provider.definition.env ?? {};
@@ -13194,11 +13196,11 @@ function buildEnv(params) {
   }
   return env;
 }
-var import_node_path47, LOOPBACK_HOSTS, PROVIDER_SESSION_PLACEHOLDER;
+var import_node_path48, LOOPBACK_HOSTS, PROVIDER_SESSION_PLACEHOLDER;
 var init_flags = __esm({
   "src/launcher/flags.ts"() {
     "use strict";
-    import_node_path47 = __toESM(require("node:path"), 1);
+    import_node_path48 = __toESM(require("node:path"), 1);
     init_envBool();
     init_cliError();
     init_conditions();
@@ -13290,7 +13292,7 @@ function newestTranscript(fs17, projectDir) {
     if (!name.endsWith(".jsonl")) {
       continue;
     }
-    const candidate = import_node_path48.default.join(projectDir, name);
+    const candidate = import_node_path49.default.join(projectDir, name);
     const stat = fs17.lstat(candidate);
     if (stat?.kind === "file" && stat.mtimeMs > newestMs) {
       newestMs = stat.mtimeMs;
@@ -13304,16 +13306,16 @@ function resumedContextTokens(fs17, params) {
   if (target === void 0) {
     return void 0;
   }
-  const projectDir = import_node_path48.default.join(params.claudeHome, "projects", projectDirNameOf(params.cwd));
-  const file = target.kind === "id" ? import_node_path48.default.join(projectDir, `${target.id}.jsonl`) : newestTranscript(fs17, projectDir);
+  const projectDir = import_node_path49.default.join(params.claudeHome, "projects", projectDirNameOf(params.cwd));
+  const file = target.kind === "id" ? import_node_path49.default.join(projectDir, `${target.id}.jsonl`) : newestTranscript(fs17, projectDir);
   const text = file === void 0 ? void 0 : fs17.readFileUtf8(file);
   return text === void 0 ? void 0 : contextTokensOfTranscript(text);
 }
-var import_node_path48;
+var import_node_path49;
 var init_resumeContext = __esm({
   "src/usage/resumeContext.ts"() {
     "use strict";
-    import_node_path48 = __toESM(require("node:path"), 1);
+    import_node_path49 = __toESM(require("node:path"), 1);
   }
 });
 
@@ -14007,6 +14009,10 @@ function decideLaunch(params, readOnly, onRecorded) {
         proc.exit(1);
       }
     }
+    if (loadedIdentity?.config.agent === "codex") {
+      log.error(`Identity "${identityDecision.name ?? ""}" belongs to Codex. Use agent-shim run --agent codex @${identityDecision.name ?? ""}.`);
+      proc.exit(1);
+    }
     const configProfileDecision = decideConfigProfile({
       env,
       cliFlagConfigProfile: params.cliFlagConfigProfile ?? parsedArgv.configProfile,
@@ -14157,8 +14163,8 @@ function decideLaunch(params, readOnly, onRecorded) {
           if (definition.kind === "codex" && readOnly && cache !== void 0) {
             const binding = parseCatalogueBinding(params.fs.readFileUtf8(catalogueBindingPath(paths, name, catalogueOwner, generation)));
             const configuredHome = catalogueEnv.CODEX_HOME;
-            const home = configuredHome === void 0 || configuredHome === "" ? import_node_path49.default.join(import_node_os8.default.homedir(), ".codex") : configuredHome;
-            const source = definition.codex?.login === "chatgpt-sign-in" ? paths.chatgptSignInFile : import_node_path49.default.resolve(home, "auth.json");
+            const home = configuredHome === void 0 || configuredHome === "" ? import_node_path50.default.join(import_node_os8.default.homedir(), ".codex") : configuredHome;
+            const source = definition.codex?.login === "chatgpt-sign-in" ? paths.chatgptSignInFile : import_node_path50.default.resolve(home, "auth.json");
             const revision = params.fs.fileRevision?.(source);
             if (binding === void 0 || binding.fingerprint !== cache.credentialFingerprint || binding.source !== source || revision === void 0 || revision !== binding.revision) return [];
           }
@@ -14179,7 +14185,7 @@ function decideLaunch(params, readOnly, onRecorded) {
       return { args: args2, pickerSuppressed: startsSession && pickerSettings !== void 0 && callerSettings };
     };
     const args = argsForSupervisor().args;
-    const configDir = configDirEscapeHatchApplies || farmIdentity === void 0 ? env.CLAUDE_CONFIG_DIR : import_node_path49.default.join(paths.identitiesDir, farmIdentity);
+    const configDir = configDirEscapeHatchApplies || farmIdentity === void 0 ? env.CLAUDE_CONFIG_DIR : import_node_path50.default.join(paths.identitiesDir, farmIdentity);
     const decision = {
       identitySource: identityDecision.source,
       configDirEscapeHatch: identityDecision.configDirEscapeHatch,
@@ -14266,7 +14272,7 @@ function prepareRegisteredLaunch(params, onRecorded) {
   let warnings = [];
   const updateCheck = runLaunchUpdateCheck({
     mode: params.updateMode ?? "off",
-    checkPath: import_node_path49.default.join(paths.root, "update.check"),
+    checkPath: import_node_path50.default.join(paths.root, "update.check"),
     currentVersion: package_default.version,
     port: params.update
   });
@@ -14289,7 +14295,7 @@ function prepareRegisteredLaunch(params, onRecorded) {
         classification: resyncFarmRuntime.classification,
         now: resyncFarmRuntime.now,
         uniqueSuffix: resyncFarmRuntime.uniqueSuffix,
-        identityExists: () => params.fs.readConfigFile(import_node_path49.default.join(paths.identitiesDir, resyncIdentity, IDENTITY_FILE)) !== void 0,
+        identityExists: () => params.fs.readConfigFile(import_node_path50.default.join(paths.identitiesDir, resyncIdentity, IDENTITY_FILE)) !== void 0,
         lock: resyncFarmRuntime.lock
       });
     } catch (error) {
@@ -14429,7 +14435,7 @@ function runLaunchPlan(plan, spawn3) {
 function runLauncher(params) {
   params.proc.exit(runLaunchPlan(prepareLaunch(params), params.spawn));
 }
-var import_node_crypto15, import_node_os8, import_node_util2, import_node_path49;
+var import_node_crypto15, import_node_os8, import_node_util2, import_node_path50;
 var init_launcher = __esm({
   "src/launcher.ts"() {
     "use strict";
@@ -14437,7 +14443,7 @@ var init_launcher = __esm({
     import_node_os8 = __toESM(require("node:os"), 1);
     init_catalogueCredential();
     import_node_util2 = require("node:util");
-    import_node_path49 = __toESM(require("node:path"), 1);
+    import_node_path50 = __toESM(require("node:path"), 1);
     init_package();
     init_envBool();
     init_argv();
@@ -14487,13 +14493,13 @@ function agentShimCliPath(distDir = typeof __AGENT_SHIM_DIST_DIR__ === "string"
   if (distDir === void 0) {
     throw new OwnCliPathUnknownError();
   }
-  return import_node_path50.default.join(distDir, OWN_CLI_FILE_NAME);
+  return import_node_path51.default.join(distDir, OWN_CLI_FILE_NAME);
 }
-var import_node_path50, OWN_CLI_FILE_NAME, OwnCliPathUnknownError;
+var import_node_path51, OWN_CLI_FILE_NAME, OwnCliPathUnknownError;
 var init_ownCli = __esm({
   "src/ownCli.ts"() {
     "use strict";
-    import_node_path50 = __toESM(require("node:path"), 1);
+    import_node_path51 = __toESM(require("node:path"), 1);
     init_cliError();
     OWN_CLI_FILE_NAME = "cli.cjs";
     OwnCliPathUnknownError = class extends CliError {
@@ -14546,7 +14552,7 @@ var init_selfIdentity = __esm({
 // src/frontdoor/trust.ts
 function resolveTrustBundle(params) {
   const { caCertFile, bundlesDir, variable, inherited, fs: fs17 } = params;
-  if (inherited === void 0 || inherited === "" || import_node_path51.default.resolve(inherited) === import_node_path51.default.resolve(caCertFile)) {
+  if (inherited === void 0 || inherited === "" || import_node_path52.default.resolve(inherited) === import_node_path52.default.resolve(caCertFile)) {
     return { path: caCertFile };
   }
   const caPem = fs17.readFileUtf8(caCertFile);
@@ -14564,19 +14570,19 @@ function resolveTrustBundle(params) {
   }
   const combined = `${inheritedPem.trimEnd()}
 ${caPem}`;
-  const bundle = import_node_path51.default.join(bundlesDir, `${(0, import_node_crypto16.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
+  const bundle = import_node_path52.default.join(bundlesDir, `${(0, import_node_crypto16.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
   if (!fs17.exists(bundle)) {
     fs17.mkdirp(bundlesDir);
     fs17.writeFileAtomic(bundle, combined);
   }
   return { path: bundle };
 }
-var import_node_crypto16, import_node_path51, BUNDLE_NAME_HEX_DIGITS;
+var import_node_crypto16, import_node_path52, BUNDLE_NAME_HEX_DIGITS;
 var init_trust = __esm({
   "src/frontdoor/trust.ts"() {
     "use strict";
     import_node_crypto16 = require("node:crypto");
-    import_node_path51 = __toESM(require("node:path"), 1);
+    import_node_path52 = __toESM(require("node:path"), 1);
     BUNDLE_NAME_HEX_DIGITS = 16;
   }
 });
@@ -14762,7 +14768,7 @@ function realPrepareLaunchParams(paths, options) {
     frontdoor: realFrontDoorPort(paths, options.spawnDaemon),
     credentials: { ...realCredentialPort, cache: realCredentialCacheEnv(paths) },
     hold: realHoldPort,
-    hasStoredLogin: (identity) => identitySignIn(realFarmFs, { platform: process.platform, run: options.run ?? realRunPort }, { farmRoot: import_node_path52.default.join(paths.identitiesDir, identity), hasCredentialBlock: false, provider: void 0 }).state !== "signed-out",
+    hasStoredLogin: (identity) => identitySignIn(realFarmFs, { platform: process.platform, run: options.run ?? realRunPort }, { farmRoot: import_node_path53.default.join(paths.identitiesDir, identity), hasCredentialBlock: false, provider: void 0 }).state !== "signed-out",
     ...farm.directoryIdentity === void 0 ? {} : { directoryPinnedIdentity: farm.directoryIdentity },
     ...farm.directoryConfigProfile === void 0 ? {} : { directoryRuleConfigProfile: farm.directoryConfigProfile },
     ...farm.globalDefaultConfigProfile === void 0 ? {} : { globalDefaultConfigProfile: farm.globalDefaultConfigProfile },
@@ -14823,12 +14829,12 @@ function resolveClaudeLaunch(options, run = realRunPort) {
   };
   return { resolution: resolveLaunch(realPrepareLaunchParams(paths, { proc, log, spawnDaemon, run, farm: buildFarmRuntime(paths, options.cwd, run) })), warnings };
 }
-var import_node_os10, import_node_path52, import_node_crypto17, LaunchRefusedError;
+var import_node_os10, import_node_path53, import_node_crypto17, LaunchRefusedError;
 var init_launchWiring = __esm({
   "src/launchWiring.ts"() {
     "use strict";
     import_node_os10 = __toESM(require("node:os"), 1);
-    import_node_path52 = __toESM(require("node:path"), 1);
+    import_node_path53 = __toESM(require("node:path"), 1);
     import_node_crypto17 = require("node:crypto");
     init_cliError();
     init_claudeShim();
@@ -15898,8 +15904,8 @@ function pathnameOf(url) {
   return new URL(url ?? "/", "http://127.0.0.1").pathname;
 }
 function isRcSessionExchange(url) {
-  const path53 = pathnameOf(url);
-  return path53 === RC_SESSIONS_PATH_PREFIX || path53.startsWith(`${RC_SESSIONS_PATH_PREFIX}/`);
+  const path54 = pathnameOf(url);
+  return path54 === RC_SESSIONS_PATH_PREFIX || path54.startsWith(`${RC_SESSIONS_PATH_PREFIX}/`);
 }
 var RC_SESSION_ID_PREFIX = "cse_";
 var RC_IDLE_EXPIRY_MS = 45e3;
@@ -16458,8 +16464,8 @@ var RC_READ_FILE_ENCODINGS = ["utf-8", "base64"];
 function isRcReadFileEncoding(value) {
   return RC_READ_FILE_ENCODINGS.some((encoding) => encoding === value);
 }
-function buildRcReadFilePayload(requestId, path53, options) {
-  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path53, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
+function buildRcReadFilePayload(requestId, path54, options) {
+  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path54, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
 }
 function buildRcFileSuggestionsPayload(requestId, query) {
   return buildRcControlRequestPayload(requestId, { subtype: "file_suggestions", query });
@@ -16561,15 +16567,15 @@ async function getRcSessionContextUsage(deps, sessionId, detail) {
   const result = await deliverRcClientPayload(deps, sessionId, buildRcGetContextUsagePayload(requestId, detail), `request the context usage of session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
-async function readRcSessionFile(deps, sessionId, path53, options) {
-  if (path53 === "") {
+async function readRcSessionFile(deps, sessionId, path54, options) {
+  if (path54 === "") {
     return { ok: false, message: "a read-file write needs a non-empty path: the SDK's own field names the file the worker resolves against the session's cwd, and an empty string names none" };
   }
   if (options?.maxBytes !== void 0 && (!Number.isInteger(options.maxBytes) || options.maxBytes <= 0)) {
     return { ok: false, message: "a read-file write's max-bytes is a positive whole number of bytes: the SDK's own field caps the read, and a zero or negative cap reads nothing" };
   }
   const requestId = deps.newUuid();
-  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path53, options), `read ${path53} from session ${sessionId}`);
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path54, options), `read ${path54} from session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
 async function suggestRcSessionFiles(deps, sessionId, query) {
@@ -16738,11 +16744,11 @@ function createRcControlHandler(deps) {
       path: "read-file",
       read: (body) => {
         const session = bodyString(body, "session");
-        const path53 = bodyString(body, "path");
+        const path54 = bodyString(body, "path");
         const maxBytes = "maxBytes" in body ? bodyPositiveInteger(body, "maxBytes") : void 0;
         const encoding = "encoding" in body && isRcReadFileEncoding(body.encoding) ? body.encoding : void 0;
-        const refused2 = session === void 0 || path53 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
-        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path53, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
+        const refused2 = session === void 0 || path54 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
+        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path54, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
       }
     },
     {
@@ -17052,9 +17058,9 @@ function requestIdOfBody(body) {
 }
 function frontDoorRcControl(transport, token) {
   const headers = { authorization: `Bearer ${token}` };
-  const listAnswerOf = async (path53, what) => {
+  const listAnswerOf = async (path54, what) => {
     try {
-      return await transport.request({ method: "GET", path: path53, headers });
+      return await transport.request({ method: "GET", path: path54, headers });
     } catch (error) {
       throw new Error(`${what}: could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
     }
@@ -17126,10 +17132,10 @@ function frontDoorRcControl(transport, token) {
     }
     return pending;
   };
-  const writeOf = async (path53, body, describeFailure2) => {
+  const writeOf = async (path54, body, describeFailure2) => {
     let answer;
     try {
-      answer = await transport.request({ method: "POST", path: path53, headers: { ...headers, "content-type": "application/json" }, body });
+      answer = await transport.request({ method: "POST", path: path54, headers: { ...headers, "content-type": "application/json" }, body });
     } catch (error) {
       return { ok: false, message: `could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}` };
     }
@@ -17160,10 +17166,10 @@ function frontDoorRcControl(transport, token) {
     endSession: async (sessionId, reason) => await writeOf(`${CONTROL_PATH_PREFIX}/end-session`, JSON.stringify({ session: sessionId, ...reason === void 0 ? {} : { reason } }), (status, message) => `ending ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getUsage: async (sessionId, skipBehaviors) => await writeOf(`${CONTROL_PATH_PREFIX}/get-usage`, JSON.stringify({ session: sessionId, ...skipBehaviors === void 0 ? {} : { skipBehaviors } }), (status, message) => `requesting the usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getContextUsage: async (sessionId, detail) => await writeOf(`${CONTROL_PATH_PREFIX}/get-context-usage`, JSON.stringify({ session: sessionId, ...detail === void 0 ? {} : { detail } }), (status, message) => `requesting the context usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
-    readFile: async (sessionId, path53, options) => await writeOf(
+    readFile: async (sessionId, path54, options) => await writeOf(
       `${CONTROL_PATH_PREFIX}/read-file`,
-      JSON.stringify({ session: sessionId, path: path53, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
-      (status, message) => `reading ${path53} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
+      JSON.stringify({ session: sessionId, path: path54, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
+      (status, message) => `reading ${path54} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
     ),
     fileSuggestions: async (sessionId, query) => await writeOf(`${CONTROL_PATH_PREFIX}/file-suggestions`, JSON.stringify({ session: sessionId, query }), (status, message) => `requesting file suggestions from ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     keepAlive: async (sessionId) => await writeOf(`${CONTROL_PATH_PREFIX}/keep-alive`, JSON.stringify({ session: sessionId }), (status, message) => `keeping ${sessionId} alive failed (HTTP ${String(status)}): ${message}`),
@@ -17322,12 +17328,12 @@ function tlsFacts(options) {
 }
 function realRcEventDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const post = async (path53, headers, body) => await new Promise((resolve, reject) => {
+  const post = async (path54, headers, body) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method: "POST",
-      path: path53,
+      path: path54,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, "content-length": String(Buffer.byteLength(body, "utf8")) },
       agent
@@ -17392,12 +17398,12 @@ function lateRcStreamDial(resolve) {
 }
 function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const request4 = async (method, path53, headers, body, signal) => await new Promise((resolve, reject) => {
+  const request4 = async (method, path54, headers, body, signal) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method,
-      path: path53,
+      path: path54,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, ...body === void 0 ? {} : { "content-length": String(Buffer.byteLength(body, "utf8")) } },
       agent,
@@ -17439,9 +17445,9 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
       return { status, body: await readAll(response) };
     },
     openStream: async (sessionId, headers, resume, signal) => {
-      const path53 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
+      const path54 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
       const streamHeaders = resume === void 0 ? headers : { ...headers, "last-event-id": String(resume.fromSequenceNum) };
-      const { status, response } = await request4("GET", path53, streamHeaders, void 0, signal);
+      const { status, response } = await request4("GET", path54, streamHeaders, void 0, signal);
       if (!isSuccessful2(status)) {
         await readAll(response);
         return { status, chunks: NO_CHUNKS };
@@ -18342,6 +18348,31 @@ var import_openapi8 = require("@orpc/openapi");
 
 // src/checkReport.ts
 var import_node_os5 = __toESM(require("node:os"), 1);
+init_cliError();
+
+// src/codex/categories.ts
+var CODEX_CATEGORIES = {
+  secret: ["auth.json", "auth.json.*", "*.sqlite*", "*.db*", "identity.json", "cap_sid", "credentials*", "secrets*"],
+  runtime: [".git*", ".DS_Store", "log", "logs", "tmp", "cache", "shell_snapshots", "models_cache.json", "version.json", "packages", "bin", "state", "otel"],
+  history: ["sessions", "archived_sessions", "history.jsonl", "session_index.jsonl", "memories"],
+  knowledge: ["AGENTS.md", "AGENTS.override.md", "skills", "rules", "agents", "prompts"],
+  settings: ["config.toml", "*.config.toml"]
+};
+
+// src/codex/identity.ts
+var import_node_path20 = __toESM(require("node:path"), 1);
+init_envBool();
+var CODEX_AMBIENT_CREDENTIALS = ["OPENAI_API_KEY", "CODEX_API_KEY", "CODEX_ACCESS_TOKEN", "OPENAI_IDENTITY_TOKEN_FILE", "OPENAI_FEDERATION_RULE_ID"];
+function canonicalCodexHome(env, home) {
+  return import_node_path20.default.resolve(env.AGENT_SHIM_CODEX_HOME === void 0 || env.AGENT_SHIM_CODEX_HOME === "" ? import_node_path20.default.join(home, ".codex") : env.AGENT_SHIM_CODEX_HOME);
+}
+function codexCredentialGuard(env, allowAmbientCredential) {
+  const variable = CODEX_AMBIENT_CREDENTIALS.find((key) => (env[key] ?? "") !== "");
+  if (variable === void 0 || allowAmbientCredential || parseEnvBool("AGENT_SHIM_ALLOW_AMBIENT_CREDENTIAL", env.AGENT_SHIM_ALLOW_AMBIENT_CREDENTIAL) === true) return { ok: true };
+  return { ok: false, variable, message: `Ambient Codex credential variable ${variable} overrides the selected login. Unset it or explicitly allow ambient credentials with AGENT_SHIM_ALLOW_AMBIENT_CREDENTIAL=1 or identity set <name> --allow-ambient-credential.` };
+}
+
+// src/checkReport.ts
 init_classify();
 init_load();
 
@@ -18443,7 +18474,7 @@ init_realCredentialCache();
 init_providersStore();
 init_signIn();
 init_realPorts();
-var import_node_path35 = __toESM(require("node:path"), 1);
+var import_node_path36 = __toESM(require("node:path"), 1);
 var import_zod24 = require("zod");
 init_envBool();
 init_load();
@@ -18613,6 +18644,7 @@ function buildClaudeVersionReport(params, cascadePin) {
   };
 }
 function runCheck(params) {
+  const isCodex = params.agent === "codex" || params.identity?.agent === "codex";
   const facts = buildEntryFacts({
     fs: params.farmFs,
     claudeHome: params.claudeHome,
@@ -18627,7 +18659,7 @@ function runCheck(params) {
   const resolved = resolveDecisions({ facts, cascade: params.cascade, classification: params.classification });
   const decisionLines = [...resolved.decisions.values()].slice().sort((a, b) => a.relPath < b.relPath ? -1 : a.relPath > b.relPath ? 1 : 0).map(formatDecision);
   const projectEncodingAmbiguities = flagAmbiguousEncodings(resolved.flattened, facts);
-  const ambientCredential = evaluateAmbientCredentialGuard({
+  const ambientCredential = isCodex ? codexCredentialGuard(params.env, params.identity?.allowAmbientCredential ?? false) : evaluateAmbientCredentialGuard({
     env: params.env,
     allowAmbientCredential: params.identity?.allowAmbientCredential ?? false,
     allowAmbientCredentialOverride: parseEnvBool("AGENT_SHIM_ALLOW_AMBIENT_CREDENTIAL", params.env.AGENT_SHIM_ALLOW_AMBIENT_CREDENTIAL) === true,
@@ -18635,8 +18667,8 @@ function runCheck(params) {
   });
   const settingsShared = resolved.flattened.categories.get("settings") ?? SHIPPED_CATEGORY_DEFAULTS.settings;
   const settingsExposure = inspectSettingsExposure({ settingsShared, files: params.settingsFiles });
-  const keychain = params.platform === "darwin" && params.run !== void 0 && params.farmRoot !== void 0 ? lookupKeychainService(params.run, params.farmRoot) : void 0;
-  const claudeVersion = buildClaudeVersionReport(params, resolved.flattened.launch.claudeVersion);
+  const keychain = !isCodex && params.platform === "darwin" && params.run !== void 0 && params.farmRoot !== void 0 ? lookupKeychainService(params.run, params.farmRoot) : void 0;
+  const claudeVersion = isCodex ? void 0 : buildClaudeVersionReport(params, resolved.flattened.launch.claudeVersion);
   return {
     ...params.identityName === void 0 ? {} : { identityName: params.identityName },
     identitySource: params.identitySource,
@@ -18667,7 +18699,7 @@ function formatCheckReport(report) {
   }
   lines.push("", "Resolved entries:");
   if (report.decisionLines.length === 0) {
-    lines.push("  (nothing under ~/.claude to report)");
+    lines.push("  (nothing in the canonical home to report)");
   }
   for (const line of report.decisionLines) {
     lines.push(`  ${line}`);
@@ -18770,13 +18802,15 @@ function loadCheckProvider(paths, name) {
 function collectCheckReport(params) {
   const { paths, cwd } = params;
   const home = import_node_os5.default.homedir();
-  const claudeHome = resolveClaudeHome();
   const read = cosmiconfigReader();
-  const classification = loadClassification(paths);
   const loaded = loadCascadeInput({ paths, home, cwd, read });
   const git = resolveGitBranch(realRunPort, cwd);
-  const { selection, identityConfig } = selectLaunch({ paths, cwd, env: params.env, ...params.identity === void 0 ? {} : { identity: params.identity } }, loaded);
+  const { selection, identityConfig } = selectLaunch({ paths, cwd, env: params.agent === "codex" ? { ...params.env, CLAUDE_CONFIG_DIR: void 0 } : params.env, ...params.identity === void 0 ? {} : { identity: params.identity } }, loaded);
   const { identity: identityDecision, poolPick, configProfile: configProfileDecision } = selection;
+  const isCodex = identityConfig?.agent === "codex" || params.agent === "codex";
+  if (identityConfig !== void 0 && params.agent !== void 0 && (identityConfig.agent ?? "claude") !== params.agent) throw new UsageError("The selected identity belongs to a different agent.");
+  const claudeHome = isCodex ? canonicalCodexHome(params.env, home) : resolveClaudeHome();
+  const classification = isCodex ? { defaults: CODEX_CATEGORIES } : loadClassification(paths);
   const cascade = loadCascadeInput({
     paths,
     home,
@@ -18787,12 +18821,13 @@ function collectCheckReport(params) {
   const providerName = cascadeProviderName(cascade, identityConfig?.provider);
   const provider = providerName === void 0 ? void 0 : loadCheckProvider(paths, providerName);
   const identityId = identityDecision.name === void 0 ? void 0 : identityIdOf(paths, identityDecision.name);
-  const farmRoot = identityId === void 0 ? void 0 : import_node_path35.default.join(paths.identitiesDir, identityId);
-  const settingsFiles = {
-    "settings.json": realFsPort.readFileUtf8(import_node_path35.default.join(claudeHome, "settings.json")),
-    "settings.local.json": realFsPort.readFileUtf8(import_node_path35.default.join(claudeHome, "settings.local.json"))
+  const farmRoot = identityId === void 0 ? void 0 : import_node_path36.default.join(paths.identitiesDir, identityId);
+  const settingsFiles = isCodex ? {} : {
+    "settings.json": realFsPort.readFileUtf8(import_node_path36.default.join(claudeHome, "settings.json")),
+    "settings.local.json": realFsPort.readFileUtf8(import_node_path36.default.join(claudeHome, "settings.local.json"))
   };
   const report = runCheck({
+    ...isCodex ? { agent: "codex" } : {},
     cwd,
     home,
     claudeHome,
@@ -18813,7 +18848,7 @@ function collectCheckReport(params) {
     settingsFiles,
     run: realRunPort,
     credentialCache: realCredentialCacheEnv(paths),
-    installedClaudeVersions: realInstalledClaudeVersions(),
+    ...isCodex ? {} : { installedClaudeVersions: realInstalledClaudeVersions() },
     ...farmRoot === void 0 ? {} : { farmRoot },
     platform: process.platform,
     ...provider === void 0 ? {} : { provider }
@@ -19034,9 +19069,18 @@ var ResetRowSchema = import_zod27.z.strictObject({
 var ResetScheduleSchema = import_zod27.z.strictObject({ resets: import_zod27.z.readonly(import_zod27.z.array(ResetRowSchema)) });
 
 // src/frontdoor/controlSchemas.ts
-var import_node_path41 = __toESM(require("node:path"), 1);
+var import_node_path42 = __toESM(require("node:path"), 1);
 var import_zod34 = require("zod");
 
+// src/codex/doctor.ts
+function codexIdentityFindings(entry, identity) {
+  const incompatible = identity.provider !== void 0 || identity.credential !== void 0 || identity.anchors !== void 0;
+  return [
+    { section: "identity", severity: incompatible ? "fail" : "pass", subject: entry.name, message: incompatible ? `${entry.name} is a Codex identity with Claude-only provider, credential or anchor settings.` : `${entry.name} is a valid Codex identity; its home is ${entry.farmRoot}.` },
+    { section: "sign-in", severity: "warn", subject: entry.name, message: `Codex login not queried. Run agent-shim run --agent codex @${entry.name} login status to validate its isolated login.` }
+  ];
+}
+
 // src/doctorReport.ts
 init_claudeShim();
 init_readableConfig();
@@ -19046,14 +19090,14 @@ init_identityStore();
 init_identityRecords();
 
 // src/doctorIdentityRecords.ts
-var import_node_path37 = __toESM(require("node:path"), 1);
+var import_node_path38 = __toESM(require("node:path"), 1);
 init_identityRecords();
 function identityRecordFindings(records, displaced, nameRenames, strayNameRenameFiles) {
   return [
     ...strayNameRenameFiles.map((file) => ({
       severity: "warn",
       message: `${file} holds the record of a rename of an identity's name, but not under the file name that rename keeps it in, so nothing reads it or removes it. Remove it.`,
-      subject: import_node_path37.default.basename(file)
+      subject: import_node_path38.default.basename(file)
     })),
     ...nameRenames.map(({ from, description }) => ({ severity: "fail", message: description, subject: from })),
     ...duplicateIdentityNames(records).map(({ name, ids }) => ({
@@ -19076,7 +19120,7 @@ var import_node_fs14 = __toESM(require("node:fs"), 1);
 
 // src/doctorPath.ts
 var import_node_fs12 = __toESM(require("node:fs"), 1);
-var import_node_path38 = __toESM(require("node:path"), 1);
+var import_node_path39 = __toESM(require("node:path"), 1);
 init_blockingSpawn();
 init_realPorts();
 function realpathOrSelf(target) {
@@ -19089,14 +19133,14 @@ function realpathOrSelf(target) {
 var MAX_FORWARDING_SCRIPT_BYTES = 8192;
 function resolveMiseDispatcher(target, pathDirs, env, trustedExecutable) {
   const executable = realpathOrSelf(target);
-  const trustedMise = import_node_path38.default.join(import_node_path38.default.dirname(trustedExecutable), "mise");
-  if (import_node_path38.default.basename(executable) !== "mise" || realpathOrSelf(trustedMise) !== executable) return void 0;
-  const result = spawnSyncBlocking("a mise shim lookup", executable, ["which", import_node_path38.default.basename(target)], { encoding: "utf8", env });
+  const trustedMise = import_node_path39.default.join(import_node_path39.default.dirname(trustedExecutable), "mise");
+  if (import_node_path39.default.basename(executable) !== "mise" || realpathOrSelf(trustedMise) !== executable) return void 0;
+  const result = spawnSyncBlocking("a mise shim lookup", executable, ["which", import_node_path39.default.basename(target)], { encoding: "utf8", env });
   if (result.error !== void 0) return void 0;
   if (result.status === 0 && result.stdout.trim() !== "") return result.stdout.trim();
   if (!result.stderr.includes("not currently active")) return void 0;
   for (const dir of pathDirs) {
-    const candidate = findExecutableInDir(dir, import_node_path38.default.basename(target));
+    const candidate = findExecutableInDir(dir, import_node_path39.default.basename(target));
     if (candidate !== void 0 && realpathOrSelf(candidate) !== executable) {
       try {
         const script = import_node_fs12.default.statSync(candidate).size <= MAX_FORWARDING_SCRIPT_BYTES ? realFsPort.readFileUtf8(candidate) : void 0;
@@ -19111,7 +19155,7 @@ function resolveMiseDispatcher(target, pathDirs, env, trustedExecutable) {
 }
 
 // src/doctorReport.ts
-var import_node_path40 = __toESM(require("node:path"), 1);
+var import_node_path41 = __toESM(require("node:path"), 1);
 init_signIn();
 init_identityAccounts();
 init_read();
@@ -19546,7 +19590,7 @@ function tcpPortEraRecord(raw) {
   return (has("port") || has("lastPort")) && !has("socketPath");
 }
 function pushPathResolution(push, resolution) {
-  const ownDir = import_node_path40.default.dirname(resolution.ownExecutablePath);
+  const ownDir = import_node_path41.default.dirname(resolution.ownExecutablePath);
   switch (resolution.agentShim.status) {
     case "ok":
       push("path-resolution", "pass", `\`agent-shim\` on PATH resolves to this running executable, ${resolution.ownExecutablePath}.`, "agent-shim");
@@ -19666,14 +19710,14 @@ function pushProvider(push, entry, cacheEnv, signIn) {
 }
 function pushLegacyName(push, params) {
   const legacyVariables = Object.keys(params.env).filter((name) => name.startsWith(LEGACY_ENV_PREFIX) && params.env[name] !== void 0).sort();
-  if (legacyVariables.length === 0 && import_node_path40.default.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
+  if (legacyVariables.length === 0 && import_node_path41.default.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
     push("legacy-name", "pass", "Nothing here still uses the former `claude-use` name.");
     return;
   }
   for (const name of legacyVariables) {
     push("legacy-name", "warn", `${name} is the former name of ${name.replace(LEGACY_ENV_PREFIX, ENV_PREFIX)}. Rename it; the old name still works but is only a fallback.`, name);
   }
-  if (import_node_path40.default.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
+  if (import_node_path41.default.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
     push(
       "legacy-name",
       "warn",
@@ -19767,9 +19811,9 @@ function runDoctor(params) {
     push("identity", "warn", `identities/${name} cannot be reached (${code}), so it is not counted as an identity. Repair the permissions of the directory or of what a symlink points through, or remove the entry.`, name);
   }
   for (const { file, detail } of params.renameJournals?.unreadable ?? []) {
-    push("identity", "fail", `${file} is not a rename journal this agent-shim can read (${detail}), so no identity can be renamed until it is fixed or removed, and it may be the trace of a rename that was left unfinished.`, import_node_path40.default.basename(file));
+    push("identity", "fail", `${file} is not a rename journal this agent-shim can read (${detail}), so no identity can be renamed until it is fixed or removed, and it may be the trace of a rename that was left unfinished.`, import_node_path41.default.basename(file));
   }
-  const validIdentityNames = /* @__PURE__ */ new Set();
+  const validIdentityAgents = /* @__PURE__ */ new Map();
   const signedInAccounts = [];
   for (const entry of params.identities) {
     const validated3 = validate(IdentitySchema, entry, "identity", entry.name);
@@ -19777,7 +19821,7 @@ function runDoctor(params) {
       push("identity", "fail", validated3.message, entry.name);
       continue;
     }
-    validIdentityNames.add(entry.name);
+    validIdentityAgents.set(entry.name, validated3.data.agent ?? "claude");
     const defaultProfile = validated3.data.defaultConfigProfile;
     let consistent = true;
     if (defaultProfile !== void 0 && !validProfileNames.has(defaultProfile)) {
@@ -19797,6 +19841,10 @@ function runDoctor(params) {
     if (!consistent) {
       continue;
     }
+    if (validated3.data.agent === "codex") {
+      findings.push(...codexIdentityFindings(entry, validated3.data));
+      continue;
+    }
     const credential = validated3.data.credential;
     const cache = credential === void 0 ? { text: "", unreadable: false } : cacheClause(params.credentialCache, identityCacheKey(entry.id), credential);
     const authenticatesWith = credential !== void 0 ? `credential ${describeCredential(credential)}` : identityProvider !== void 0 ? `the credential of provider "${identityProvider}"` : "its stored login";
@@ -19835,9 +19883,9 @@ function runDoctor(params) {
   }
   const validatedGlobalConfig = params.globalConfig.raw === void 0 ? void 0 : validateJson(GlobalConfigSchema, params.globalConfig);
   const pools = validatedGlobalConfig?.ok === true ? validatedGlobalConfig.data.pools ?? {} : {};
-  const accountByIdentity = new Map(params.identities.flatMap((entry) => validIdentityNames.has(entry.name) && entry.account !== void 0 ? [[entry.name, entry.account]] : []));
+  const accountByIdentity = new Map(params.identities.flatMap((entry) => validIdentityAgents.has(entry.name) && entry.account !== void 0 ? [[entry.name, entry.account]] : []));
   for (const [poolName, pool] of Object.entries(pools)) {
-    const missing = pool.identities.filter((member) => poolNameOf(poolMemberIdentity(member)) === void 0 && !validIdentityNames.has(poolMemberIdentity(member)));
+    const missing = pool.identities.filter((member) => poolNameOf(poolMemberIdentity(member)) === void 0 && !validIdentityAgents.has(poolMemberIdentity(member)));
     const undefinedPools = pool.identities.flatMap((member) => {
       const nested = poolNameOf(poolMemberIdentity(member));
       return nested === void 0 || nested in pools ? [] : [nested];
@@ -19881,7 +19929,7 @@ function runDoctor(params) {
   }
   const selectionExists = (selector) => {
     const poolName = poolNameOf(selector);
-    return poolName === void 0 ? validIdentityNames.has(selector) : poolName in pools;
+    return poolName === void 0 ? validIdentityAgents.has(selector) : poolName in pools;
   };
   for (const entry of params.providers) {
     if (!pushNameFinding(push, "provider", "provider", entry)) {
@@ -19897,6 +19945,7 @@ function runDoctor(params) {
     push("keychain", "pass", "Skipped (not macOS).");
   } else {
     for (const entry of params.identities) {
+      if (validIdentityAgents.get(entry.name) === "codex") continue;
       const result = lookupKeychainService(params.run, entry.farmRoot);
       push("keychain", "pass", result.found ? result.note : `${result.note} The sign-in section reports whether a login is stored elsewhere.`, entry.name);
     }
@@ -20127,9 +20176,9 @@ function collectDoctorReport(params) {
   const { names: identityNames, unreachable: unreachableIdentities } = listIdentityDirectories(paths);
   const records = identityRecords(paths);
   const displacedIdentities = records.filter((record) => !identityIdExists(paths, record.id) && !unreachableIdentities.some((entry) => entry.name === record.id));
-  const identities = identityNames.filter((id) => (records.some((record) => record.id === id) || !import_node_fs14.default.existsSync(import_node_path40.default.join(paths.identitiesDir, id, "identity.json"))) && !displacedIdentities.some((record) => record.id === id)).map((id) => {
-    const farmRoot = import_node_path40.default.join(paths.identitiesDir, id);
-    const identityPath = import_node_path40.default.join(farmRoot, "identity.json");
+  const identities = identityNames.filter((id) => (records.some((record) => record.id === id) || !import_node_fs14.default.existsSync(import_node_path41.default.join(paths.identitiesDir, id, "identity.json"))) && !displacedIdentities.some((record) => record.id === id)).map((id) => {
+    const farmRoot = import_node_path41.default.join(paths.identitiesDir, id);
+    const identityPath = import_node_path41.default.join(farmRoot, "identity.json");
     return { name: identityNameIn(records, id) ?? id, id, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot, credentialsFilePresent: import_node_fs14.default.existsSync(credentialsFilePath(farmRoot)), account: readIdentityAccount(realFsPort, paths.identitiesDir, id)?.account };
   });
   const usageSnapshots = {};
@@ -20147,12 +20196,12 @@ function collectDoctorReport(params) {
   }
   const profileNames = import_node_fs14.default.existsSync(paths.configProfilesDir) ? import_node_fs14.default.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const configProfiles = profileNames.map((name) => {
-    const profilePath = import_node_path40.default.join(paths.configProfilesDir, `${name}.json`);
+    const profilePath = import_node_path41.default.join(paths.configProfilesDir, `${name}.json`);
     return { name, path: profilePath, raw: realFsPort.readFileUtf8(profilePath) };
   });
   const providerNames = import_node_fs14.default.existsSync(paths.providersDir) ? import_node_fs14.default.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const providers = providerNames.map((name) => {
-    const providerPath = import_node_path40.default.join(paths.providersDir, `${name}.json`);
+    const providerPath = import_node_path41.default.join(paths.providersDir, `${name}.json`);
     return { name, path: providerPath, raw: realFsPort.readFileUtf8(providerPath) };
   });
   const ownExecutablePath = realOwnExecutablePath();
@@ -20164,12 +20213,12 @@ function collectDoctorReport(params) {
     binaryDiscovery = { ok: false, message: error instanceof Error ? error.message : String(error) };
   }
   const shimState = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-  const pathDirs = (params.env.PATH ?? "").split(import_node_path40.default.delimiter).filter((dir) => dir !== "");
+  const pathDirs = (params.env.PATH ?? "").split(import_node_path41.default.delimiter).filter((dir) => dir !== "");
   const claudeShimShadow = shimState === void 0 ? void 0 : refinePathShadow(
     findPathShadow({
       pathDirs,
-      targetDir: import_node_path40.default.dirname(shimState.targetPath),
-      targetFilename: import_node_path40.default.basename(shimState.targetPath),
+      targetDir: import_node_path41.default.dirname(shimState.targetPath),
+      targetFilename: import_node_path41.default.basename(shimState.targetPath),
       findExecutableInDir
     }),
     shimState.targetPath,
@@ -20195,7 +20244,7 @@ function collectDoctorReport(params) {
     providerAliases: readProviderAliases(paths),
     renameJournals: listRenameJournals(realFarmFs, paths.identityRenamesDir),
     unreachableIdentities,
-    identityRecords: { all: records, displaced: displacedIdentities.map((record) => ({ ...record, directoryPresent: import_node_fs14.default.existsSync(import_node_path40.default.join(paths.identitiesDir, record.id)) })), nameRenames: unfinishedNameRenames(paths).map((record) => ({ from: record.from, description: describeInterruptedNameRename(paths, record) })), strayNameRenameFiles: strayNameRenameRecordFiles(paths) },
+    identityRecords: { all: records, displaced: displacedIdentities.map((record) => ({ ...record, directoryPresent: import_node_fs14.default.existsSync(import_node_path41.default.join(paths.identitiesDir, record.id)) })), nameRenames: unfinishedNameRenames(paths).map((record) => ({ from: record.from, description: describeInterruptedNameRename(paths, record) })), strayNameRenameFiles: strayNameRenameRecordFiles(paths) },
     directoryRules: { path: paths.directoryRulesFile, raw: realFsPort.readFileUtf8(paths.directoryRulesFile) },
     globalConfig: { path: paths.globalConfigFile, raw: realFsPort.readFileUtf8(paths.globalConfigFile) },
     models: readableOr(() => readGlobalConfig(paths)?.models, void 0),
@@ -20210,7 +20259,7 @@ function collectDoctorReport(params) {
       agentShim: refinePathShadow(
         findPathShadow({
           pathDirs,
-          targetDir: import_node_path40.default.dirname(ownExecutablePath),
+          targetDir: import_node_path41.default.dirname(ownExecutablePath),
           targetFilename: commandFilename(ownExecutablePath, "agent-shim"),
           findExecutableInDir
         }),
@@ -20301,11 +20350,11 @@ var FrontDoorSessionsOutputSchema = import_zod34.z.strictObject({ sessions: impo
 var CheckRunInputSchema = import_zod34.z.strictObject({
   path: import_zod34.z.string().min(1),
   identity: import_zod34.z.string().min(1).optional()
-}).refine((input) => import_node_path41.default.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+}).refine((input) => import_node_path42.default.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
 var PoolPickInputSchema = import_zod34.z.strictObject({
   pool: import_zod34.z.string().min(1),
   path: import_zod34.z.string().min(1)
-}).refine((input) => import_node_path41.default.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+}).refine((input) => import_node_path42.default.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
 var DoctorFindingSchema = import_zod34.z.strictObject({
   section: import_zod34.z.enum(DOCTOR_SECTIONS),
   subject: import_zod34.z.string().optional(),
@@ -20641,7 +20690,7 @@ function profileValue(name, paths) {
 function createConfigApiRouter(deps) {
   const authed = doorApiAuth(deps.expectedToken);
   const { paths } = deps;
-  const route = (path53, summary) => authed.meta((0, import_openapi3.openapi)({ method: "POST", path: path53, summary, tags: [CONFIG_API_TAG] }));
+  const route = (path54, summary) => authed.meta((0, import_openapi3.openapi)({ method: "POST", path: path54, summary, tags: [CONFIG_API_TAG] }));
   return {
     config: {
       identity: {
@@ -21043,7 +21092,7 @@ var import_openapi6 = require("@orpc/openapi");
 init_cliError();
 
 // src/frontdoor/launchSchemas.ts
-var import_node_path42 = __toESM(require("node:path"), 1);
+var import_node_path43 = __toESM(require("node:path"), 1);
 var import_zod38 = require("zod");
 init_statusline();
 init_claudeVersion();
@@ -21054,7 +21103,7 @@ var LaunchResolveInputSchema = import_zod38.z.strictObject({
   argv: import_zod38.z.readonly(import_zod38.z.array(import_zod38.z.string())).optional(),
   /** The launch's inherited environment. Absent means an empty one: the door's own environment is never a substitute for the caller's, so a caller that wants `AGENT_SHIM_*` switches or a `CLAUDE_CONFIG_DIR` considered names them here. Values are read, never reported. */
   env: import_zod38.z.record(import_zod38.z.string(), import_zod38.z.string()).optional()
-}).refine((input) => import_node_path42.default.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+}).refine((input) => import_node_path43.default.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
 var LaunchPoolDecisionSchema = import_zod38.z.strictObject({
   name: import_zod38.z.string(),
   reasons: import_zod38.z.readonly(import_zod38.z.array(import_zod38.z.string())),
@@ -23235,7 +23284,7 @@ data: ${JSON.stringify(envelope)}
 }
 
 // src/frontdoor/rcSelfHostMint.ts
-var import_node_path43 = __toESM(require("node:path"), 1);
+var import_node_path44 = __toESM(require("node:path"), 1);
 init_identityRecords();
 init_account();
 var CREDENTIALS_FILE2 = ".credentials.json";
@@ -23261,7 +23310,7 @@ function readJsonObject(fs17, file) {
   return isRecord14(parsed) ? parsed : void 0;
 }
 function readRcSelfHostRecord(fs17, frontdoorDir) {
-  const parsed = readJsonObject(fs17, import_node_path43.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
+  const parsed = readJsonObject(fs17, import_node_path44.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
   if (parsed === void 0) {
     return void 0;
   }
@@ -23279,11 +23328,11 @@ function mintRcSelfHostCredential(deps) {
   if (id === void 0) {
     throw new Error(`No identity named "${deps.identity}".`);
   }
-  const identityDir = import_node_path43.default.join(deps.identitiesDir, id);
-  const credentialsFile = import_node_path43.default.join(identityDir, CREDENTIALS_FILE2);
-  const claudeJsonFile = import_node_path43.default.join(identityDir, CLAUDE_JSON2);
-  const recordDir = import_node_path43.default.join(deps.frontdoorDir, RC_SELF_HOST_RECORD_DIR);
-  const recordFile2 = import_node_path43.default.join(recordDir, RC_SELF_HOST_RECORD_FILE);
+  const identityDir = import_node_path44.default.join(deps.identitiesDir, id);
+  const credentialsFile = import_node_path44.default.join(identityDir, CREDENTIALS_FILE2);
+  const claudeJsonFile = import_node_path44.default.join(identityDir, CLAUDE_JSON2);
+  const recordDir = import_node_path44.default.join(deps.frontdoorDir, RC_SELF_HOST_RECORD_DIR);
+  const recordFile2 = import_node_path44.default.join(recordDir, RC_SELF_HOST_RECORD_FILE);
   const previousRecord = readRcSelfHostRecord(deps.fs, deps.frontdoorDir);
   const existingCredentials = readJsonObject(deps.fs, credentialsFile);
   const existingOauth = isRecord14(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
@@ -23299,7 +23348,7 @@ function mintRcSelfHostCredential(deps) {
   const organizationUuid = deps.newUuid();
   const accountUuid = deps.newUuid();
   const mintedAt = new Date(deps.now()).toISOString();
-  deps.fs.mkdirPrivate(import_node_path43.default.dirname(credentialsFile));
+  deps.fs.mkdirPrivate(import_node_path44.default.dirname(credentialsFile));
   deps.fs.writeFilePrivate(credentialsFile, `${JSON.stringify({ ...existingCredentials, claudeAiOauth: { accessToken, refreshToken, expiresAt: null, scopes: [...RC_SELF_HOST_SCOPE_LIST], subscriptionType: SELF_HOST_SUBSCRIPTION_TYPE, rateLimitTier: null } }, null, 2)}
 `);
   const claudeJson = readJsonObject(deps.fs, claudeJsonFile) ?? {};
@@ -23335,7 +23384,7 @@ function mintRcSelfHostCredential(deps) {
 init_ensure2();
 
 // src/frontdoor/liveSessionRegistry.ts
-var import_node_path44 = __toESM(require("node:path"), 1);
+var import_node_path45 = __toESM(require("node:path"), 1);
 init_capability();
 init_state();
 function sameStat(recorded, current) {
@@ -23355,7 +23404,7 @@ function createLiveSessionRegistry(ports) {
   const load = (name, stat) => {
     known.set(name, { stat: { mtimeMs: stat.mtimeMs, sizeBytes: stat.sizeBytes }, record: readFrontDoorSessionRecord(fs17, sessionsDir, name) });
   };
-  const statOf = (name) => fs17.lstat(import_node_path44.default.join(sessionsDir, name));
+  const statOf = (name) => fs17.lstat(import_node_path45.default.join(sessionsDir, name));
   const reconcile = () => {
     const names = new Set(recordNames());
     let changed = false;
@@ -23422,7 +23471,7 @@ init_plan2();
 init_poolPick();
 
 // src/agents/read.ts
-var import_node_path45 = __toESM(require("node:path"), 1);
+var import_node_path46 = __toESM(require("node:path"), 1);
 var import_zod40 = require("zod");
 var PROJECTS_DIR = "projects";
 var TASKS_DIR = "tasks";
@@ -23448,15 +23497,15 @@ function parseEntry2(project, entry) {
 }
 function listSessions2(fs17, configDir) {
   const found = [];
-  for (const project of fs17.readdir(import_node_path45.default.join(configDir, PROJECTS_DIR))) {
-    const projectDir = import_node_path45.default.join(configDir, PROJECTS_DIR, project);
+  for (const project of fs17.readdir(import_node_path46.default.join(configDir, PROJECTS_DIR))) {
+    const projectDir = import_node_path46.default.join(configDir, PROJECTS_DIR, project);
     const entries = /* @__PURE__ */ new Set();
     for (const name of fs17.readdir(projectDir)) {
       if (name.endsWith(TRANSCRIPT_SUFFIX)) {
         entries.add(name.slice(0, -TRANSCRIPT_SUFFIX.length));
         continue;
       }
-      const children = fs17.readdir(import_node_path45.default.join(projectDir, name));
+      const children = fs17.readdir(import_node_path46.default.join(projectDir, name));
       if (children.includes(SUBAGENTS_DIR) || children.includes(WORKFLOWS_DIR)) {
         entries.add(name);
       }
@@ -23476,8 +23525,8 @@ function locateAgents(fs17, configDir, relativeDir, workflowRunId, report) {
     const id = name.slice(AGENT_FILE_PREFIX.length, -META_SUFFIX.length);
     located.push({
       id,
-      metaPath: import_node_path45.default.join(relativeDir, name),
-      transcriptPath: import_node_path45.default.join(relativeDir, `${AGENT_FILE_PREFIX}${id}${TRANSCRIPT_SUFFIX}`),
+      metaPath: import_node_path46.default.join(relativeDir, name),
+      transcriptPath: import_node_path46.default.join(relativeDir, `${AGENT_FILE_PREFIX}${id}${TRANSCRIPT_SUFFIX}`),
       workflowRunId
     });
   }
@@ -23520,7 +23569,7 @@ function describeFailure(error) {
 }
 function readFileOrReport(fs17, configDir, relative, report) {
   try {
-    return fs17.readFileUtf8(import_node_path45.default.join(configDir, relative));
+    return fs17.readFileUtf8(import_node_path46.default.join(configDir, relative));
   } catch (error) {
     report({ path: relative, reason: `could not be read: ${describeFailure(error)}` });
     return void 0;
@@ -23528,7 +23577,7 @@ function readFileOrReport(fs17, configDir, relative, report) {
 }
 function listDirOrReport(fs17, configDir, relative, report) {
   try {
-    return fs17.readdir(import_node_path45.default.join(configDir, relative));
+    return fs17.readdir(import_node_path46.default.join(configDir, relative));
   } catch (error) {
     report({ path: relative, reason: `could not be listed: ${describeFailure(error)}` });
     return [];
@@ -23552,18 +23601,18 @@ var WorkflowRunFileSchema = import_zod40.z.object({
   summary: import_zod40.z.string().optional()
 });
 function summariseSession(fs17, configDir, ref) {
-  const sessionRelative = import_node_path45.default.join(PROJECTS_DIR, ref.project, ref.entry);
-  const subagentsRelative = import_node_path45.default.join(sessionRelative, SUBAGENTS_DIR);
-  const workflowsUnderSubagents = import_node_path45.default.join(subagentsRelative, WORKFLOWS_DIR);
+  const sessionRelative = import_node_path46.default.join(PROJECTS_DIR, ref.project, ref.entry);
+  const subagentsRelative = import_node_path46.default.join(sessionRelative, SUBAGENTS_DIR);
+  const workflowsUnderSubagents = import_node_path46.default.join(subagentsRelative, WORKFLOWS_DIR);
   const isMeta = (name) => name.startsWith(AGENT_FILE_PREFIX) && name.endsWith(META_SUFFIX);
-  let agentCount = fs17.readdir(import_node_path45.default.join(configDir, subagentsRelative)).filter(isMeta).length;
-  for (const runDir of fs17.readdir(import_node_path45.default.join(configDir, workflowsUnderSubagents))) {
+  let agentCount = fs17.readdir(import_node_path46.default.join(configDir, subagentsRelative)).filter(isMeta).length;
+  for (const runDir of fs17.readdir(import_node_path46.default.join(configDir, workflowsUnderSubagents))) {
     if (runDir.startsWith(WORKFLOW_RUN_PREFIX)) {
-      agentCount += fs17.readdir(import_node_path45.default.join(configDir, workflowsUnderSubagents, runDir)).filter(isMeta).length;
+      agentCount += fs17.readdir(import_node_path46.default.join(configDir, workflowsUnderSubagents, runDir)).filter(isMeta).length;
     }
   }
-  const workflowRunCount = fs17.readdir(import_node_path45.default.join(configDir, sessionRelative, WORKFLOWS_DIR)).filter((name) => name.startsWith(WORKFLOW_RUN_PREFIX) && name.endsWith(JSON_SUFFIX)).length;
-  const transcript = fs17.lstat(import_node_path45.default.join(configDir, PROJECTS_DIR, ref.project, `${ref.entry}${TRANSCRIPT_SUFFIX}`));
+  const workflowRunCount = fs17.readdir(import_node_path46.default.join(configDir, sessionRelative, WORKFLOWS_DIR)).filter((name) => name.startsWith(WORKFLOW_RUN_PREFIX) && name.endsWith(JSON_SUFFIX)).length;
+  const transcript = fs17.lstat(import_node_path46.default.join(configDir, PROJECTS_DIR, ref.project, `${ref.entry}${TRANSCRIPT_SUFFIX}`));
   return { ...ref, agentCount, workflowRunCount, ...transcript === void 0 ? {} : { updatedAt: new Date(transcript.mtimeMs).toISOString() } };
 }
 function readSessionAgentTree(fs17, configDir, ref, options = {}) {
@@ -23571,13 +23620,13 @@ function readSessionAgentTree(fs17, configDir, ref, options = {}) {
   const report = (problem) => {
     problems.push(problem);
   };
-  const sessionRelative = import_node_path45.default.join(PROJECTS_DIR, ref.project, ref.entry);
-  const subagentsRelative = import_node_path45.default.join(sessionRelative, SUBAGENTS_DIR);
-  const workflowsUnderSubagents = import_node_path45.default.join(subagentsRelative, WORKFLOWS_DIR);
+  const sessionRelative = import_node_path46.default.join(PROJECTS_DIR, ref.project, ref.entry);
+  const subagentsRelative = import_node_path46.default.join(sessionRelative, SUBAGENTS_DIR);
+  const workflowsUnderSubagents = import_node_path46.default.join(subagentsRelative, WORKFLOWS_DIR);
   const located = locateAgents(fs17, configDir, subagentsRelative, void 0, report);
   for (const runDir of listDirOrReport(fs17, configDir, workflowsUnderSubagents, report)) {
     if (runDir.startsWith(WORKFLOW_RUN_PREFIX)) {
-      located.push(...locateAgents(fs17, configDir, import_node_path45.default.join(workflowsUnderSubagents, runDir), runDir, report));
+      located.push(...locateAgents(fs17, configDir, import_node_path46.default.join(workflowsUnderSubagents, runDir), runDir, report));
     }
   }
   const agents = /* @__PURE__ */ new Map();
@@ -23618,7 +23667,7 @@ function readSessionAgentTree(fs17, configDir, ref, options = {}) {
     superseded: ref.superseded,
     agents: roots.sort().map(build),
     tasks: readTasks(fs17, configDir, ownTaskLists(ref.sessionId), [.../* @__PURE__ */ new Set([...teamNames, ...options.taskListIds ?? []])].filter((id) => !ownTaskLists(ref.sessionId).includes(id)), report),
-    workflowRuns: readWorkflowRuns(fs17, configDir, import_node_path45.default.join(sessionRelative, WORKFLOWS_DIR), report),
+    workflowRuns: readWorkflowRuns(fs17, configDir, import_node_path46.default.join(sessionRelative, WORKFLOWS_DIR), report),
     problems
   };
 }
@@ -23683,12 +23732,12 @@ function ownTaskLists(sessionId) {
 function readTasks(fs17, configDir, ownLists, sharedLists, report) {
   const tasks = [];
   [...ownLists, ...sharedLists].forEach((scope, index) => {
-    const relativeDir = import_node_path45.default.join(TASKS_DIR, scope);
+    const relativeDir = import_node_path46.default.join(TASKS_DIR, scope);
     for (const name of [...listDirOrReport(fs17, configDir, relativeDir, report)].sort()) {
       if (name.startsWith(".") || !name.endsWith(JSON_SUFFIX)) {
         continue;
       }
-      const relative = import_node_path45.default.join(relativeDir, name);
+      const relative = import_node_path46.default.join(relativeDir, name);
       const text = readFileOrReport(fs17, configDir, relative, report);
       const parsed = TaskFileSchema.safeParse(text === void 0 ? void 0 : parseJson2(text));
       if (parsed.success) {
@@ -23706,7 +23755,7 @@ function readWorkflowRuns(fs17, configDir, relativeDir, report) {
     if (!name.startsWith(WORKFLOW_RUN_PREFIX) || !name.endsWith(JSON_SUFFIX)) {
       continue;
     }
-    const relative = import_node_path45.default.join(relativeDir, name);
+    const relative = import_node_path46.default.join(relativeDir, name);
     const text = readFileOrReport(fs17, configDir, relative, report);
     const parsed = WorkflowRunFileSchema.safeParse(text === void 0 ? void 0 : parseJson2(text));
     if (!parsed.success) {
@@ -23722,7 +23771,7 @@ function readWorkflowRuns(fs17, configDir, relativeDir, report) {
 }
 
 // src/agents/sessions.ts
-var import_node_path46 = __toESM(require("node:path"), 1);
+var import_node_path47 = __toESM(require("node:path"), 1);
 init_cliError();
 var SessionLookupError = class extends CliError {
   constructor(message) {
@@ -23734,7 +23783,7 @@ function historyStores(fs17, configDirOf, identities) {
   const byRealPath = /* @__PURE__ */ new Map();
   for (const identity of identities) {
     const configDir = configDirOf(identity);
-    const real = fs17.realpath(import_node_path46.default.join(configDir, "projects"));
+    const real = fs17.realpath(import_node_path47.default.join(configDir, "projects"));
     if (real === void 0) {
       continue;
     }