agent-shim 7.1.3 → 7.3.0

package/dist/cli.cjs

@@ -3248,42 +3248,42 @@ var require_defaults = __commonJS({
 var require_env_paths = __commonJS({
   "node_modules/.pnpm/env-paths@2.2.1/node_modules/env-paths/index.js"(exports2, module2) {
     "use strict";
-    var path36 = require("path");
+    var path38 = require("path");
     var os9 = require("os");
     var homedir = os9.homedir();
     var tmpdir = os9.tmpdir();
     var { env } = process;
     var macos = (name) => {
-      const library = path36.join(homedir, "Library");
+      const library = path38.join(homedir, "Library");
       return {
-        data: path36.join(library, "Application Support", name),
-        config: path36.join(library, "Preferences", name),
-        cache: path36.join(library, "Caches", name),
-        log: path36.join(library, "Logs", name),
-        temp: path36.join(tmpdir, name)
+        data: path38.join(library, "Application Support", name),
+        config: path38.join(library, "Preferences", name),
+        cache: path38.join(library, "Caches", name),
+        log: path38.join(library, "Logs", name),
+        temp: path38.join(tmpdir, name)
       };
     };
     var windows = (name) => {
-      const appData = env.APPDATA || path36.join(homedir, "AppData", "Roaming");
-      const localAppData = env.LOCALAPPDATA || path36.join(homedir, "AppData", "Local");
+      const appData = env.APPDATA || path38.join(homedir, "AppData", "Roaming");
+      const localAppData = env.LOCALAPPDATA || path38.join(homedir, "AppData", "Local");
       return {
         // Data/config/cache/log are invented by me as Windows isn't opinionated about this
-        data: path36.join(localAppData, name, "Data"),
-        config: path36.join(appData, name, "Config"),
-        cache: path36.join(localAppData, name, "Cache"),
-        log: path36.join(localAppData, name, "Log"),
-        temp: path36.join(tmpdir, name)
+        data: path38.join(localAppData, name, "Data"),
+        config: path38.join(appData, name, "Config"),
+        cache: path38.join(localAppData, name, "Cache"),
+        log: path38.join(localAppData, name, "Log"),
+        temp: path38.join(tmpdir, name)
       };
     };
     var linux = (name) => {
-      const username = path36.basename(homedir);
+      const username = path38.basename(homedir);
       return {
-        data: path36.join(env.XDG_DATA_HOME || path36.join(homedir, ".local", "share"), name),
-        config: path36.join(env.XDG_CONFIG_HOME || path36.join(homedir, ".config"), name),
-        cache: path36.join(env.XDG_CACHE_HOME || path36.join(homedir, ".cache"), name),
+        data: path38.join(env.XDG_DATA_HOME || path38.join(homedir, ".local", "share"), name),
+        config: path38.join(env.XDG_CONFIG_HOME || path38.join(homedir, ".config"), name),
+        cache: path38.join(env.XDG_CACHE_HOME || path38.join(homedir, ".cache"), name),
         // https://wiki.debian.org/XDGBaseDirectorySpecification#state
-        log: path36.join(env.XDG_STATE_HOME || path36.join(homedir, ".local", "state"), name),
-        temp: path36.join(tmpdir, username, name)
+        log: path38.join(env.XDG_STATE_HOME || path38.join(homedir, ".local", "state"), name),
+        temp: path38.join(tmpdir, username, name)
       };
     };
     var envPaths = (name, options) => {
@@ -3351,11 +3351,11 @@ var require_util = __commonJS({
       return result;
     }
     exports2.emplace = emplace;
-    function getPropertyByPath(source, path36) {
-      if (typeof path36 === "string" && Object.prototype.hasOwnProperty.call(source, path36)) {
-        return source[path36];
+    function getPropertyByPath(source, path38) {
+      if (typeof path38 === "string" && Object.prototype.hasOwnProperty.call(source, path38)) {
+        return source[path38];
       }
-      const parsedPath = typeof path36 === "string" ? path36.split(".") : path36;
+      const parsedPath = typeof path38 === "string" ? path38.split(".") : path38;
       return parsedPath.reduce((previous, key) => {
         if (previous === void 0) {
           return previous;
@@ -3378,9 +3378,9 @@ var require_util = __commonJS({
       return Object.fromEntries(Object.entries(options).filter(([, value]) => value !== void 0));
     }
     exports2.removeUndefinedValuesFromObject = removeUndefinedValuesFromObject;
-    async function isDirectory(path36) {
+    async function isDirectory(path38) {
       try {
-        const stat = await fs_1.promises.stat(path36);
+        const stat = await fs_1.promises.stat(path38);
         return stat.isDirectory();
       } catch (e) {
         if (e.code === "ENOENT") {
@@ -3390,9 +3390,9 @@ var require_util = __commonJS({
       }
     }
     exports2.isDirectory = isDirectory;
-    function isDirectorySync(path36) {
+    function isDirectorySync(path38) {
       try {
-        const stat = fs_1.default.statSync(path36);
+        const stat = fs_1.default.statSync(path38);
         return stat.isDirectory();
       } catch (e) {
         if (e.code === "ENOENT") {
@@ -3490,7 +3490,7 @@ var require_ExplorerBase = __commonJS({
           const idx = importStack.indexOf(fullPath);
           if (idx !== -1) {
             throw new Error(`Circular import detected:
-${[...importStack, fullPath].map((path36, i2) => `${i2 + 1}. ${path36}`).join("\n")} (same as ${idx + 1}.)`);
+${[...importStack, fullPath].map((path38, i2) => `${i2 + 1}. ${path38}`).join("\n")} (same as ${idx + 1}.)`);
           }
         }
       }
@@ -3678,9 +3678,9 @@ var require_Explorer = __commonJS({
           throw error62;
         }
       }
-      async #fileExists(path36) {
+      async #fileExists(path38) {
         try {
-          await promises_1.default.stat(path36);
+          await promises_1.default.stat(path38);
           return true;
         } catch (e) {
           return false;
@@ -3840,9 +3840,9 @@ var require_ExplorerSync = __commonJS({
           throw error62;
         }
       }
-      #fileExists(path36) {
+      #fileExists(path38) {
         try {
-          fs_1.default.statSync(path36);
+          fs_1.default.statSync(path38);
           return true;
         } catch (e) {
           return false;
@@ -3966,7 +3966,7 @@ var require_dist = __commonJS({
       };
     }
     function getResolvedSearchPlaces(moduleName, toolDefinedSearchPlaces, userConfiguredOptions) {
-      const userConfiguredSearchPlaces = userConfiguredOptions.searchPlaces?.map((path36) => path36.replace("{name}", moduleName));
+      const userConfiguredSearchPlaces = userConfiguredOptions.searchPlaces?.map((path38) => path38.replace("{name}", moduleName));
       if (userConfiguredOptions.mergeSearchPlaces) {
         return [...userConfiguredSearchPlaces ?? [], ...toolDefinedSearchPlaces];
       }
@@ -4374,8 +4374,8 @@ var require_utils = __commonJS({
       }
       return output2;
     };
-    exports2.basename = (path36, { windows } = {}) => {
-      const segs = path36.split(windows ? /[\\/]/ : "/");
+    exports2.basename = (path38, { windows } = {}) => {
+      const segs = path38.split(windows ? /[\\/]/ : "/");
       const last = segs[segs.length - 1];
       if (last === "") {
         return segs[segs.length - 2];
@@ -7003,14 +7003,14 @@ var require_util2 = __commonJS({
         }
         const port = url2.port != null ? url2.port : url2.protocol === "https:" ? 443 : 80;
         let origin = url2.origin != null ? url2.origin : `${url2.protocol || ""}//${url2.hostname || ""}:${port}`;
-        let path36 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`;
+        let path38 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`;
         if (origin[origin.length - 1] === "/") {
           origin = origin.slice(0, origin.length - 1);
         }
-        if (path36 && path36[0] !== "/") {
-          path36 = `/${path36}`;
+        if (path38 && path38[0] !== "/") {
+          path38 = `/${path38}`;
         }
-        return new URL(`${origin}${path36}`);
+        return new URL(`${origin}${path38}`);
       }
       if (!isHttpOrHttpsPrefixed(url2.origin || url2.protocol)) {
         throw new InvalidArgumentError2("Invalid URL protocol: the URL must start with `http:` or `https:`.");
@@ -7831,9 +7831,9 @@ var require_diagnostics = __commonJS({
         "undici:client:sendHeaders",
         (evt) => {
           const {
-            request: { method, path: path36, origin }
+            request: { method, path: path38, origin }
           } = evt;
-          debugLog("sending request to %s %s%s", method, origin, path36);
+          debugLog("sending request to %s %s%s", method, origin, path38);
         }
       );
     }
@@ -7851,14 +7851,14 @@ var require_diagnostics = __commonJS({
         "undici:request:headers",
         (evt) => {
           const {
-            request: { method, path: path36, origin },
+            request: { method, path: path38, origin },
             response: { statusCode }
           } = evt;
           debugLog(
             "received response to %s %s%s - HTTP %d",
             method,
             origin,
-            path36,
+            path38,
             statusCode
           );
         }
@@ -7867,23 +7867,23 @@ var require_diagnostics = __commonJS({
         "undici:request:trailers",
         (evt) => {
           const {
-            request: { method, path: path36, origin }
+            request: { method, path: path38, origin }
           } = evt;
-          debugLog("trailers received from %s %s%s", method, origin, path36);
+          debugLog("trailers received from %s %s%s", method, origin, path38);
         }
       );
       diagnosticsChannel.subscribe(
         "undici:request:error",
         (evt) => {
           const {
-            request: { method, path: path36, origin },
+            request: { method, path: path38, origin },
             error: error62
           } = evt;
           debugLog(
             "request to %s %s%s errored - %s",
             method,
             origin,
-            path36,
+            path38,
             error62.message
           );
         }
@@ -7998,7 +7998,7 @@ var require_request = __commonJS({
     var kHandler = /* @__PURE__ */ Symbol("handler");
     var Request = class {
       constructor(origin, {
-        path: path36,
+        path: path38,
         method,
         body,
         headers,
@@ -8015,11 +8015,11 @@ var require_request = __commonJS({
         maxRedirections,
         typeOfService
       }, handler) {
-        if (typeof path36 !== "string") {
+        if (typeof path38 !== "string") {
           throw new InvalidArgumentError2("path must be a string");
-        } else if (path36[0] !== "/" && !(path36.startsWith("http://") || path36.startsWith("https://")) && method !== "CONNECT") {
+        } else if (path38[0] !== "/" && !(path38.startsWith("http://") || path38.startsWith("https://")) && method !== "CONNECT") {
           throw new InvalidArgumentError2("path must be an absolute URL or start with a slash");
-        } else if (invalidPathRegex.test(path36)) {
+        } else if (invalidPathRegex.test(path38)) {
           throw new InvalidArgumentError2("invalid request path");
         }
         if (typeof method !== "string") {
@@ -8094,7 +8094,7 @@ var require_request = __commonJS({
         this.completed = false;
         this.aborted = false;
         this.upgrade = upgrade || null;
-        this.path = query ? serializePathWithQuery(path36, query) : path36;
+        this.path = query ? serializePathWithQuery(path38, query) : path38;
         this.origin = origin;
         this.protocol = getProtocolFromUrlString(origin);
         this.idempotent = idempotent == null ? method === "HEAD" || method === "GET" : idempotent;
@@ -13276,7 +13276,7 @@ var require_client_h1 = __commonJS({
       return method !== "GET" && method !== "HEAD" && method !== "OPTIONS" && method !== "TRACE" && method !== "CONNECT";
     }
     function writeH1(client, request6) {
-      const { method, path: path36, host, upgrade, blocking, reset } = request6;
+      const { method, path: path38, host, upgrade, blocking, reset } = request6;
       let { body, headers, contentLength } = request6;
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH" || method === "QUERY" || method === "PROPFIND" || method === "PROPPATCH";
       if (util.isFormDataLike(body)) {
@@ -13354,7 +13354,7 @@ var require_client_h1 = __commonJS({
       if (socket.setTypeOfService) {
         socket.setTypeOfService(request6.typeOfService);
       }
-      let header = `${method} ${path36} HTTP/1.1\r
+      let header = `${method} ${path38} HTTP/1.1\r
 `;
       if (typeof host === "string") {
         header += `host: ${host}\r
@@ -14033,7 +14033,7 @@ var require_client_h2 = __commonJS({
       const headersTimeout = request6.headersTimeout ?? client[kHeadersTimeout];
       const bodyTimeout = request6.bodyTimeout ?? client[kBodyTimeout];
       const session = client[kHTTP2Session];
-      const { method, path: path36, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request6;
+      const { method, path: path38, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request6;
       let { body } = request6;
       if (upgrade != null && upgrade !== "websocket") {
         util.errorRequest(client, request6, new InvalidArgumentError2(`Custom upgrade "${upgrade}" not supported over HTTP/2`));
@@ -14102,7 +14102,7 @@ var require_client_h2 = __commonJS({
           }
           headers[HTTP2_HEADER_METHOD] = "CONNECT";
           headers[HTTP2_HEADER_PROTOCOL] = "websocket";
-          headers[HTTP2_HEADER_PATH] = path36;
+          headers[HTTP2_HEADER_PATH] = path38;
           if (protocol === "ws:" || protocol === "wss:") {
             headers[HTTP2_HEADER_SCHEME] = protocol === "ws:" ? "http" : "https";
           } else {
@@ -14144,7 +14144,7 @@ var require_client_h2 = __commonJS({
         stream.setTimeout(headersTimeout);
         return true;
       }
-      headers[HTTP2_HEADER_PATH] = path36;
+      headers[HTTP2_HEADER_PATH] = path38;
       headers[HTTP2_HEADER_SCHEME] = protocol === "http:" ? "http" : "https";
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH";
       if (body && typeof body.read === "function") {
@@ -16496,10 +16496,10 @@ var require_proxy_agent = __commonJS({
         };
         const {
           origin,
-          path: path36 = "/",
+          path: path38 = "/",
           headers = {}
         } = opts;
-        opts.path = origin + path36;
+        opts.path = origin + path38;
         if (!("host" in headers) && !("Host" in headers)) {
           const { host } = new URL(origin);
           headers.host = host;
@@ -18608,20 +18608,20 @@ var require_mock_utils = __commonJS({
       }
       return normalizedQp;
     }
-    function safeUrl(path36) {
-      if (typeof path36 !== "string") {
-        return path36;
+    function safeUrl(path38) {
+      if (typeof path38 !== "string") {
+        return path38;
       }
-      const pathSegments = path36.split("?", 3);
+      const pathSegments = path38.split("?", 3);
       if (pathSegments.length !== 2) {
-        return path36;
+        return path38;
       }
       const qp = new URLSearchParams(pathSegments.pop());
       qp.sort();
       return [...pathSegments, qp.toString()].join("?");
     }
-    function matchKey(mockDispatch2, { path: path36, method, body, headers }) {
-      const pathMatch = matchValue(mockDispatch2.path, path36);
+    function matchKey(mockDispatch2, { path: path38, method, body, headers }) {
+      const pathMatch = matchValue(mockDispatch2.path, path38);
       const methodMatch = matchValue(mockDispatch2.method, method);
       const bodyMatch = typeof mockDispatch2.body !== "undefined" ? matchValue(mockDispatch2.body, body) : true;
       const headersMatch = matchHeaders(mockDispatch2, headers);
@@ -18646,8 +18646,8 @@ var require_mock_utils = __commonJS({
       const basePath = key.query ? serializePathWithQuery(key.path, key.query) : key.path;
       const resolvedPath = typeof basePath === "string" ? safeUrl(basePath) : basePath;
       const resolvedPathWithoutTrailingSlash = removeTrailingSlash(resolvedPath);
-      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path36, ignoreTrailingSlash }) => {
-        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path36)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path36), resolvedPath);
+      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path38, ignoreTrailingSlash }) => {
+        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path38)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path38), resolvedPath);
       });
       if (matchedMockDispatches.length === 0) {
         throw new MockNotMatchedError(`Mock dispatch not matched for path '${resolvedPath}'`);
@@ -18686,19 +18686,19 @@ var require_mock_utils = __commonJS({
         mockDispatches.splice(index, 1);
       }
     }
-    function removeTrailingSlash(path36) {
-      while (path36.endsWith("/")) {
-        path36 = path36.slice(0, -1);
+    function removeTrailingSlash(path38) {
+      while (path38.endsWith("/")) {
+        path38 = path38.slice(0, -1);
       }
-      if (path36.length === 0) {
-        path36 = "/";
+      if (path38.length === 0) {
+        path38 = "/";
       }
-      return path36;
+      return path38;
     }
     function buildKey(opts) {
-      const { path: path36, method, body, headers, query } = opts;
+      const { path: path38, method, body, headers, query } = opts;
       return {
-        path: path36,
+        path: path38,
         method,
         body,
         headers,
@@ -19388,10 +19388,10 @@ var require_pending_interceptors_formatter = __commonJS({
       }
       format(pendingInterceptors) {
         const withPrettyHeaders = pendingInterceptors.map(
-          ({ method, path: path36, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
+          ({ method, path: path38, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
             Method: method,
             Origin: origin,
-            Path: path36,
+            Path: path38,
             "Status code": statusCode,
             Persistent: persist ? PERSISTENT : NOT_PERSISTENT,
             Invocations: timesInvoked,
@@ -19473,9 +19473,9 @@ var require_mock_agent = __commonJS({
         const acceptNonStandardSearchParameters = this[kMockAgentAcceptsNonStandardSearchParameters];
         const dispatchOpts = { ...opts };
         if (acceptNonStandardSearchParameters && dispatchOpts.path) {
-          const [path36, searchParams] = dispatchOpts.path.split("?");
+          const [path38, searchParams] = dispatchOpts.path.split("?");
           const normalizedSearchParams = normalizeSearchParams(searchParams, acceptNonStandardSearchParameters);
-          dispatchOpts.path = `${path36}?${normalizedSearchParams}`;
+          dispatchOpts.path = `${path38}?${normalizedSearchParams}`;
         }
         return this[kAgent].dispatch(dispatchOpts, handler);
       }
@@ -19680,7 +19680,7 @@ var require_snapshot_recorder = __commonJS({
   "node_modules/.pnpm/undici@7.29.1/node_modules/undici/lib/mock/snapshot-recorder.js"(exports2, module2) {
     "use strict";
     var { writeFile, readFile, mkdir } = require("node:fs/promises");
-    var { dirname, resolve } = require("node:path");
+    var { dirname: dirname2, resolve } = require("node:path");
     var { setTimeout: setTimeout2, clearTimeout: clearTimeout2 } = require("node:timers");
     var { InvalidArgumentError: InvalidArgumentError2, UndiciError } = require_errors();
     var { hashId, isUrlExcludedFactory, normalizeHeaders, createHeaderFilters } = require_snapshot_utils();
@@ -19876,12 +19876,12 @@ var require_snapshot_recorder = __commonJS({
        * @return {Promise<void>} - Resolves when snapshots are loaded
        */
       async loadSnapshots(filePath) {
-        const path36 = filePath || this.#snapshotPath;
-        if (!path36) {
+        const path38 = filePath || this.#snapshotPath;
+        if (!path38) {
           throw new InvalidArgumentError2("Snapshot path is required");
         }
         try {
-          const data = await readFile(resolve(path36), "utf8");
+          const data = await readFile(resolve(path38), "utf8");
           const parsed = JSON.parse(data);
           if (Array.isArray(parsed)) {
             this.#snapshots.clear();
@@ -19895,7 +19895,7 @@ var require_snapshot_recorder = __commonJS({
           if (error62.code === "ENOENT") {
             this.#snapshots.clear();
           } else {
-            throw new UndiciError(`Failed to load snapshots from ${path36}`, { cause: error62 });
+            throw new UndiciError(`Failed to load snapshots from ${path38}`, { cause: error62 });
           }
         }
       }
@@ -19906,12 +19906,12 @@ var require_snapshot_recorder = __commonJS({
        * @returns {Promise<void>} - Resolves when snapshots are saved
        */
       async saveSnapshots(filePath) {
-        const path36 = filePath || this.#snapshotPath;
-        if (!path36) {
+        const path38 = filePath || this.#snapshotPath;
+        if (!path38) {
           throw new InvalidArgumentError2("Snapshot path is required");
         }
-        const resolvedPath = resolve(path36);
-        await mkdir(dirname(resolvedPath), { recursive: true });
+        const resolvedPath = resolve(path38);
+        await mkdir(dirname2(resolvedPath), { recursive: true });
         const data = Array.from(this.#snapshots.entries()).map(([hash2, snapshot]) => ({
           hash: hash2,
           snapshot
@@ -20542,15 +20542,15 @@ var require_redirect_handler = __commonJS({
           return;
         }
         const { origin, pathname, search } = util.parseURL(new URL(this.location, this.opts.origin && new URL(this.opts.path, this.opts.origin)));
-        const path36 = search ? `${pathname}${search}` : pathname;
-        const redirectUrlString = `${origin}${path36}`;
+        const path38 = search ? `${pathname}${search}` : pathname;
+        const redirectUrlString = `${origin}${path38}`;
         for (const historyUrl of this.history) {
           if (historyUrl.toString() === redirectUrlString) {
             throw new InvalidArgumentError2(`Redirect loop detected. Cannot redirect to ${origin}. This typically happens when using a Client or Pool with cross-origin redirects. Use an Agent for cross-origin redirects.`);
           }
         }
         this.opts.headers = cleanRequestHeaders(this.opts.headers, statusCode === 303, this.opts.origin !== origin);
-        this.opts.path = path36;
+        this.opts.path = path38;
         this.opts.origin = origin;
         this.opts.query = null;
       }
@@ -22310,10 +22310,10 @@ var require_cache_handler = __commonJS({
       }
       return locationUrl.pathname + locationUrl.search;
     }
-    function deleteCachedUri(store, cacheKey, path36) {
+    function deleteCachedUri(store, cacheKey, path38) {
       deleteCachedValue(store, {
         ...cacheKey,
-        path: path36
+        path: path38
       });
       for (let i2 = 0; i2 < util.safeHTTPMethods.length; i2++) {
         const method = util.safeHTTPMethods[i2];
@@ -22321,7 +22321,7 @@ var require_cache_handler = __commonJS({
           deleteCachedValue(store, {
             ...cacheKey,
             method,
-            path: path36
+            path: path38
           });
         }
       }
@@ -22332,9 +22332,9 @@ var require_cache_handler = __commonJS({
       }
       const values = Array.isArray(headerValue2) ? headerValue2 : [headerValue2];
       for (let i2 = 0; i2 < values.length; i2++) {
-        const path36 = getSameOriginPath(cacheKey, values[i2]);
-        if (path36 !== void 0) {
-          deleteCachedUri(store, cacheKey, path36);
+        const path38 = getSameOriginPath(cacheKey, values[i2]);
+        if (path38 !== void 0) {
+          deleteCachedUri(store, cacheKey, path38);
         }
       }
     }
@@ -27334,11 +27334,11 @@ var require_fetch = __commonJS({
       function dispatch({ body }) {
         const url2 = requestCurrentURL(request6);
         const agent = fetchParams.controller.dispatcher;
-        const path36 = url2.pathname + url2.search;
+        const path38 = url2.pathname + url2.search;
         const hasTrailingQuestionMark = url2.search.length === 0 && url2.href[url2.href.length - url2.hash.length - 1] === "?";
         return new Promise((resolve, reject) => agent.dispatch(
           {
-            path: hasTrailingQuestionMark ? `${path36}?` : path36,
+            path: hasTrailingQuestionMark ? `${path38}?` : path38,
             origin: url2.origin,
             method: request6.method,
             body: agent.isMockActive ? request6.body && (request6.body.source || request6.body.stream) : body,
@@ -28285,9 +28285,9 @@ var require_util5 = __commonJS({
         }
       }
     }
-    function validateCookiePath(path36) {
-      for (let i2 = 0; i2 < path36.length; ++i2) {
-        const code = path36.charCodeAt(i2);
+    function validateCookiePath(path38) {
+      for (let i2 = 0; i2 < path38.length; ++i2) {
+        const code = path38.charCodeAt(i2);
         if (code < 32 || // exclude CTLs (0-31)
         code > 126 || // exclude DEL and non-ascii
         code === 59) {
@@ -31635,11 +31635,11 @@ var require_undici = __commonJS({
           if (typeof opts.path !== "string") {
             throw new InvalidArgumentError2("invalid opts.path");
           }
-          let path36 = opts.path;
+          let path38 = opts.path;
           if (!opts.path.startsWith("/")) {
-            path36 = `/${path36}`;
+            path38 = `/${path38}`;
           }
-          url2 = new URL(util.parseOrigin(url2).origin + path36);
+          url2 = new URL(util.parseOrigin(url2).origin + path38);
         } else {
           if (!opts) {
             opts = typeof url2 === "object" ? url2 : {};
@@ -31749,7 +31749,7 @@ ${captureLines}` : capture.stack;
 });
 
 // src/cli.ts
-var import_node_path35 = __toESM(require("node:path"), 1);
+var import_node_path36 = __toESM(require("node:path"), 1);
 
 // node_modules/.pnpm/commander@15.0.0/node_modules/commander/lib/error.js
 var CommanderError = class extends Error {
@@ -34862,9 +34862,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
    * @param {string} [path]
    * @return {(string|null|Command)}
    */
-  executableDir(path36) {
-    if (path36 === void 0) return this._executableDir;
-    this._executableDir = path36;
+  executableDir(path38) {
+    if (path38 === void 0) return this._executableDir;
+    this._executableDir = path38;
     return this;
   }
   /**
@@ -36002,10 +36002,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path36) {
-  if (!path36)
+function getElementAtPath(obj, path38) {
+  if (!path38)
     return obj;
-  return path36.reduce((acc, key) => acc?.[key], obj);
+  return path38.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -36345,11 +36345,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path36, issues) {
+function prefixIssues(path38, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path36);
+    iss.path.unshift(path38);
     return iss;
   });
 }
@@ -36799,16 +36799,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path36 = []) => {
+  const processError = (error63, path38 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path36, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path38, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path36, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path38, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path36, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path38, ...issue2.path]);
       } else {
-        const fullpath = [...path36, ...issue2.path];
+        const fullpath = [...path38, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -36847,17 +36847,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error63, path36 = []) => {
+  const processError = (error63, path38 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path36, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path38, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path36, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path38, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path36, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path38, ...issue2.path]);
       } else {
-        const fullpath = [...path36, ...issue2.path];
+        const fullpath = [...path38, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -36896,8 +36896,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path36 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path36) {
+  const path38 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path38) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -53999,13 +53999,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path36 = ref.slice(1).split("/").filter(Boolean);
-  if (path36.length === 0) {
+  const path38 = ref.slice(1).split("/").filter(Boolean);
+  if (path38.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path36[0] === defsKey) {
-    const key = path36[1] === void 0 ? void 0 : decodeJSONPointerSegment(path36[1]);
+  if (path38[0] === defsKey) {
+    const key = path38[1] === void 0 ? void 0 : decodeJSONPointerSegment(path38[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -55399,16 +55399,16 @@ function parseJson(raw, schema) {
   const parsed = schema.safeParse(JSON.parse(raw));
   return parsed.success ? parsed.data : void 0;
 }
-function readHeadroomState(fs17, stateFile) {
+function readHeadroomState(fs18, stateFile) {
   try {
-    return parseJson(fs17.readFileUtf8(stateFile), HeadroomStateSchema);
+    return parseJson(fs18.readFileUtf8(stateFile), HeadroomStateSchema);
   } catch {
     return void 0;
   }
 }
-function writeHeadroomState(fs17, stateFile, state) {
-  fs17.mkdirp(import_node_path5.default.dirname(stateFile));
-  fs17.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
+function writeHeadroomState(fs18, stateFile, state) {
+  fs18.mkdirp(import_node_path5.default.dirname(stateFile));
+  fs18.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
 `);
 }
 function headroomAllowlist(providers) {
@@ -55428,14 +55428,14 @@ function headroomUpstreams(providers, frontDoorOrigin2) {
 function hashAllowlist(allowlist) {
   return (0, import_node_crypto2.createHash)("sha256").update(allowlist.join("\n")).digest("hex");
 }
-function readAllProviders(fs17, providersDir) {
+function readAllProviders(fs18, providersDir) {
   const result = [];
-  for (const name of fs17.readdir(providersDir)) {
+  for (const name of fs18.readdir(providersDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = parseJson(fs17.readFileUtf8(import_node_path5.default.join(providersDir, name)), ProviderSchema);
+      const parsed = parseJson(fs18.readFileUtf8(import_node_path5.default.join(providersDir, name)), ProviderSchema);
       if (parsed !== void 0) {
         result.push({ name: name.slice(0, -".json".length), provider: parsed });
       }
@@ -55445,22 +55445,22 @@ function readAllProviders(fs17, providersDir) {
   }
   return result;
 }
-function writeSession(fs17, sessionsDir, session) {
-  fs17.mkdirp(sessionsDir);
-  fs17.writeFileUtf8(import_node_path5.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
+function writeSession(fs18, sessionsDir, session) {
+  fs18.mkdirp(sessionsDir);
+  fs18.writeFileUtf8(import_node_path5.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
 `);
 }
-function removeSession(fs17, sessionsDir, pid) {
-  fs17.removeRecursive(import_node_path5.default.join(sessionsDir, `${String(pid)}.json`));
+function removeSession(fs18, sessionsDir, pid) {
+  fs18.removeRecursive(import_node_path5.default.join(sessionsDir, `${String(pid)}.json`));
 }
-function listSessions(fs17, sessionsDir) {
+function listSessions(fs18, sessionsDir) {
   const sessions = [];
-  for (const name of fs17.readdir(sessionsDir)) {
+  for (const name of fs18.readdir(sessionsDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = parseJson(fs17.readFileUtf8(import_node_path5.default.join(sessionsDir, name)), HeadroomSessionSchema);
+      const parsed = parseJson(fs18.readFileUtf8(import_node_path5.default.join(sessionsDir, name)), HeadroomSessionSchema);
       if (parsed !== void 0) {
         sessions.push(parsed);
       }
@@ -55470,22 +55470,22 @@ function listSessions(fs17, sessionsDir) {
   }
   return sessions.sort((a2, b) => a2.pid - b.pid);
 }
-function sessionsForSupervisor(fs17, sessionsDir, supervisorPid) {
-  return listSessions(fs17, sessionsDir).filter((session) => session.supervisorPid === supervisorPid);
+function sessionsForSupervisor(fs18, sessionsDir, supervisorPid) {
+  return listSessions(fs18, sessionsDir).filter((session) => session.supervisorPid === supervisorPid);
 }
-function pruneDeadSessions(fs17, sessionsDir, isRunning) {
+function pruneDeadSessions(fs18, sessionsDir, isRunning) {
   const removed = [];
-  for (const session of listSessions(fs17, sessionsDir)) {
+  for (const session of listSessions(fs18, sessionsDir)) {
     if (!isRunning(session.pid)) {
-      removeSession(fs17, sessionsDir, session.pid);
+      removeSession(fs18, sessionsDir, session.pid);
       removed.push(session.pid);
     }
   }
   return removed;
 }
-function readStartLock(fs17, lockFile) {
+function readStartLock(fs18, lockFile) {
   try {
-    return parseJson(fs17.readFileUtf8(lockFile), HeadroomLockSchema);
+    return parseJson(fs18.readFileUtf8(lockFile), HeadroomLockSchema);
   } catch {
     return void 0;
   }
@@ -58797,8 +58797,8 @@ var FarmManifestSchema = external_exports.strictObject({
   materialised: external_exports.array(external_exports.string()),
   links: external_exports.array(external_exports.strictObject({ rel: external_exports.string(), target: external_exports.string() }))
 });
-function readFarmManifest(fs17, farmRoot) {
-  const raw = fs17.readFileUtf8(import_node_path11.default.join(farmRoot, FARM_MANIFEST_FILENAME)) ?? fs17.readFileUtf8(import_node_path11.default.join(farmRoot, LEGACY_FARM_MANIFEST_FILENAME));
+function readFarmManifest(fs18, farmRoot) {
+  const raw = fs18.readFileUtf8(import_node_path11.default.join(farmRoot, FARM_MANIFEST_FILENAME)) ?? fs18.readFileUtf8(import_node_path11.default.join(farmRoot, LEGACY_FARM_MANIFEST_FILENAME));
   if (raw === void 0) {
     return void 0;
   }
@@ -58856,9 +58856,9 @@ function buildEntryFacts(params) {
     entries
   };
 }
-function listSubtree(fs17, root, rel) {
+function listSubtree(fs18, root, rel) {
   const absolute = import_node_path11.default.join(root, rel);
-  const stat = fs17.lstat(absolute);
+  const stat = fs18.lstat(absolute);
   if (stat === void 0) {
     return [];
   }
@@ -58866,10 +58866,10 @@ function listSubtree(fs17, root, rel) {
     return [{ rel, kind: "symlink" }];
   }
   if (stat.kind === "dir") {
-    const children = [...fs17.readdir(absolute)].sort().flatMap((name) => listSubtree(fs17, root, `${rel}/${name}`));
+    const children = [...fs18.readdir(absolute)].sort().flatMap((name) => listSubtree(fs18, root, `${rel}/${name}`));
     return [{ rel, kind: "dir" }, ...children];
   }
-  const contentHash = fs17.hashFile(absolute);
+  const contentHash = fs18.hashFile(absolute);
   return [{ rel, kind: "file", ...contentHash === void 0 ? {} : { contentHash } }];
 }
 function topLevelScopeRoots(roots) {
@@ -58883,25 +58883,25 @@ function topLevelScopeRoots(roots) {
   }
   return kept;
 }
-function reconciliationScope(fs17, farmRoot, manifest) {
+function reconciliationScope(fs18, farmRoot, manifest) {
   if (manifest !== void 0) {
     return topLevelScopeRoots(manifest.materialised);
   }
-  return [...fs17.readdir(farmRoot)].filter((name) => name !== FARM_MANIFEST_FILENAME && name !== LEGACY_FARM_MANIFEST_FILENAME && fs17.lstat(import_node_path11.default.join(farmRoot, name))?.kind === "dir").sort();
+  return [...fs18.readdir(farmRoot)].filter((name) => name !== FARM_MANIFEST_FILENAME && name !== LEGACY_FARM_MANIFEST_FILENAME && fs18.lstat(import_node_path11.default.join(farmRoot, name))?.kind === "dir").sort();
 }
-function collectFarmListing(fs17, farmRoot, scopeRoots) {
-  return scopeRoots.flatMap((root) => listSubtree(fs17, farmRoot, root));
+function collectFarmListing(fs18, farmRoot, scopeRoots) {
+  return scopeRoots.flatMap((root) => listSubtree(fs18, farmRoot, root));
 }
-function collectCanonicalCounterparts(fs17, claudeHome, farmListing) {
+function collectCanonicalCounterparts(fs18, claudeHome, farmListing) {
   const out = [];
   for (const entry of farmListing) {
     const absolute = import_node_path11.default.join(claudeHome, entry.rel);
-    const stat = fs17.lstat(absolute);
+    const stat = fs18.lstat(absolute);
     if (stat === void 0) {
       continue;
     }
     if (stat.kind === "file") {
-      const contentHash = fs17.hashFile(absolute);
+      const contentHash = fs18.hashFile(absolute);
       out.push({ rel: entry.rel, kind: "file", ...contentHash === void 0 ? {} : { contentHash } });
       continue;
     }
@@ -59741,8 +59741,8 @@ function decideConfigProfile(params) {
   }
   return { source: "none" };
 }
-function loadIdentity(identitiesDir, name, fs17) {
-  return loadConfigFile(import_node_path14.default.join(identitiesDir, name, "identity.json"), IdentitySchema, fs17.readConfigFile);
+function loadIdentity(identitiesDir, name, fs18) {
+  return loadConfigFile(import_node_path14.default.join(identitiesDir, name, "identity.json"), IdentitySchema, fs18.readConfigFile);
 }
 
 // src/poolStore.ts
@@ -61051,7 +61051,7 @@ function resolveLaunchIdentity(paths, cwd) {
 // package.json
 var package_default = {
   name: "agent-shim",
-  version: "7.1.3",
+  version: "7.3.0",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -61418,12 +61418,12 @@ function isIdentityName(name) {
 function claudeJsonPath(identitiesDir, identity) {
   return import_node_path20.default.join(identitiesDir, identity, CLAUDE_JSON);
 }
-function readAccountMetadata(fs17, identitiesDir, identity) {
+function readAccountMetadata(fs18, identitiesDir, identity) {
   if (!isIdentityName(identity)) {
     throw new Error(`"${identity}" is not a valid identity name.`);
   }
   const file2 = claudeJsonPath(identitiesDir, identity);
-  const raw = fs17.readFileUtf8(file2);
+  const raw = fs18.readFileUtf8(file2);
   if (raw === void 0) {
     return void 0;
   }
@@ -61453,19 +61453,19 @@ function readAccountMetadata(fs17, identitiesDir, identity) {
   }
   return account.data;
 }
-function createAccountReader(fs17, identitiesDir) {
+function createAccountReader(fs18, identitiesDir) {
   const cache = /* @__PURE__ */ new Map();
   return (identity) => {
     if (!isIdentityName(identity)) {
       throw new Error(`"${identity}" is not a valid identity name.`);
     }
-    const stat = fs17.lstat(claudeJsonPath(identitiesDir, identity));
+    const stat = fs18.lstat(claudeJsonPath(identitiesDir, identity));
     const stamp = stat === void 0 ? "absent" : `${String(stat.mtimeMs)}:${String(stat.sizeBytes)}`;
     const cached2 = cache.get(identity);
     if (cached2?.stamp === stamp) {
       return cached2.account;
     }
-    const account = readAccountMetadata(fs17, identitiesDir, identity);
+    const account = readAccountMetadata(fs18, identitiesDir, identity);
     cache.set(identity, { stamp, account });
     return account;
   };
@@ -61555,11 +61555,11 @@ function providerBaseUrl(port, provider) {
 function directOrigin(port) {
   return `http://127.0.0.1:${String(port)}`;
 }
-function parseProviderPath(path36) {
-  if (!path36.startsWith(PROVIDER_PATH_PREFIX)) {
+function parseProviderPath(path38) {
+  if (!path38.startsWith(PROVIDER_PATH_PREFIX)) {
     return void 0;
   }
-  const tail = path36.slice(PROVIDER_PATH_PREFIX.length);
+  const tail = path38.slice(PROVIDER_PATH_PREFIX.length);
   const slash = tail.indexOf("/");
   if (slash <= 0) {
     return void 0;
@@ -61959,9 +61959,9 @@ function decoderFor(encoding) {
       return void 0;
   }
 }
-function destinationOf(path36) {
-  const scoped = parseProviderPath(path36);
-  return scoped === void 0 ? { provider: ANTHROPIC_PROVIDER, endpoint: path36 } : { provider: scoped.provider, endpoint: scoped.rest };
+function destinationOf(path38) {
+  const scoped = parseProviderPath(path38);
+  return scoped === void 0 ? { provider: ANTHROPIC_PROVIDER, endpoint: path38 } : { provider: scoped.provider, endpoint: scoped.rest };
 }
 function buildRecord(event, context) {
   const { scan } = context;
@@ -62233,8 +62233,8 @@ function segmentDay(epochMs) {
 function segmentName(day, pid) {
   return `${day}.${String(pid)}.jsonl`;
 }
-function listLogSegments(fs17, logDir) {
-  return fs17.readdir(logDir).flatMap((name) => {
+function listLogSegments(fs18, logDir) {
+  return fs18.readdir(logDir).flatMap((name) => {
     const match = SEGMENT_RE.exec(name);
     const day = match?.[1];
     if (day === void 0) {
@@ -62243,15 +62243,15 @@ function listLogSegments(fs17, logDir) {
     return [{ name, day, endsAt: Date.parse(`${day}T00:00:00.000Z`) + DAY_MS }];
   }).sort((left, right) => left.day.localeCompare(right.day) || left.name.localeCompare(right.name));
 }
-function readUsageLog(fs17, logDir, options = {}) {
+function readUsageLog(fs18, logDir, options = {}) {
   const { sinceMs } = options;
   const records = [];
   let invalidLines = 0;
-  for (const segment of listLogSegments(fs17, logDir)) {
+  for (const segment of listLogSegments(fs18, logDir)) {
     if (sinceMs !== void 0 && segment.endsAt <= sinceMs) {
       continue;
     }
-    const contents = fs17.readFileUtf8(import_node_path21.default.join(logDir, segment.name));
+    const contents = fs18.readFileUtf8(import_node_path21.default.join(logDir, segment.name));
     if (contents === void 0) {
       continue;
     }
@@ -62295,9 +62295,9 @@ function snapshotPath(snapshotsDir, identity) {
   }
   return import_node_path21.default.join(snapshotsDir, `${identity}.json`);
 }
-function readUsageSnapshot(fs17, snapshotsDir, identity) {
+function readUsageSnapshot(fs18, snapshotsDir, identity) {
   const file2 = snapshotPath(snapshotsDir, identity);
-  const raw = fs17.readFileUtf8(file2);
+  const raw = fs18.readFileUtf8(file2);
   if (raw === void 0) {
     return void 0;
   }
@@ -62313,8 +62313,8 @@ function readUsageSnapshot(fs17, snapshotsDir, identity) {
   }
   return snapshot.data;
 }
-function listUsageSnapshots(fs17, snapshotsDir) {
-  return fs17.readdir(snapshotsDir).flatMap((name) => {
+function listUsageSnapshots(fs18, snapshotsDir) {
+  return fs18.readdir(snapshotsDir).flatMap((name) => {
     if (!name.endsWith(".json")) {
       return [];
     }
@@ -62322,7 +62322,7 @@ function listUsageSnapshots(fs17, snapshotsDir) {
     if (!isIdentityName(identity)) {
       return [];
     }
-    const snapshot = readUsageSnapshot(fs17, snapshotsDir, identity);
+    const snapshot = readUsageSnapshot(fs18, snapshotsDir, identity);
     return snapshot === void 0 ? [] : [snapshot];
   }).sort((left, right) => left.identity.localeCompare(right.identity));
 }
@@ -62381,11 +62381,11 @@ var import_node_path22 = __toESM(require("node:path"), 1);
 var DAY_MS2 = 864e5;
 var DAYS_IN_WEEK = 7;
 var USAGE_RETENTION_MS = DAYS_IN_WEEK * DAY_MS2;
-function pruneUsageLog(fs17, logDir, nowMs) {
+function pruneUsageLog(fs18, logDir, nowMs) {
   const cutoff = nowMs - USAGE_RETENTION_MS;
-  for (const segment of listLogSegments(fs17, logDir)) {
+  for (const segment of listLogSegments(fs18, logDir)) {
     if (segment.endsAt <= cutoff) {
-      fs17.removeRecursive(import_node_path22.default.join(logDir, segment.name));
+      fs18.removeRecursive(import_node_path22.default.join(logDir, segment.name));
     }
   }
 }
@@ -62414,7 +62414,7 @@ function foldProviderState(current, record2) {
   };
 }
 function createUsageStore(deps) {
-  const { fs: fs17, paths } = deps;
+  const { fs: fs18, paths } = deps;
   let prunedDay;
   const rewriteSnapshot = (identity, fold) => {
     if (!isIdentityName(identity)) {
@@ -62423,7 +62423,7 @@ function createUsageStore(deps) {
     }
     let current;
     try {
-      current = readUsageSnapshot(fs17, paths.usageSnapshotsDir, identity);
+      current = readUsageSnapshot(fs18, paths.usageSnapshotsDir, identity);
     } catch (error62) {
       if (!(error62 instanceof UsageSnapshotError)) {
         throw error62;
@@ -62450,8 +62450,8 @@ function createUsageStore(deps) {
       ...account === void 0 ? {} : { account },
       providers
     });
-    fs17.mkdirPrivate(paths.usageSnapshotsDir);
-    fs17.writeFilePrivate(snapshotPath(paths.usageSnapshotsDir, identity), `${JSON.stringify(snapshot, null, 2)}
+    fs18.mkdirPrivate(paths.usageSnapshotsDir);
+    fs18.writeFilePrivate(snapshotPath(paths.usageSnapshotsDir, identity), `${JSON.stringify(snapshot, null, 2)}
 `);
     return true;
   };
@@ -62459,14 +62459,14 @@ function createUsageStore(deps) {
     record: (input2) => {
       const record2 = UsageRecordSchema.parse(input2);
       const nowMs = deps.now();
-      fs17.mkdirPrivate(paths.usageDir);
-      fs17.mkdirPrivate(paths.usageLogDir);
+      fs18.mkdirPrivate(paths.usageDir);
+      fs18.mkdirPrivate(paths.usageLogDir);
       const day = segmentDay(nowMs);
       if (prunedDay !== day) {
-        pruneUsageLog(fs17, paths.usageLogDir, nowMs);
+        pruneUsageLog(fs18, paths.usageLogDir, nowMs);
         prunedDay = day;
       }
-      fs17.appendFilePrivate(import_node_path22.default.join(paths.usageLogDir, segmentName(day, deps.pid)), `${JSON.stringify(record2)}
+      fs18.appendFilePrivate(import_node_path22.default.join(paths.usageLogDir, segmentName(day, deps.pid)), `${JSON.stringify(record2)}
 `);
       if (record2.identity !== void 0) {
         rewriteSnapshot(record2.identity, (current) => ({ ...current?.providers, [record2.provider]: foldProviderState(current?.providers[record2.provider], record2) }));
@@ -62493,14 +62493,14 @@ var PicksFileSchema = external_exports.strictObject({
 function errorMessage(error62) {
   return error62 instanceof Error ? error62.message : String(error62);
 }
-function loadPoolMembers(fs17, paths, identities, nowMs) {
+function loadPoolMembers(fs18, paths, identities, nowMs) {
   const windowStartMs = nowMs - FIVE_HOUR_WINDOW_MS;
-  const log = readUsageLog(fs17, paths.usageLogDir, { sinceMs: windowStartMs });
+  const log = readUsageLog(fs18, paths.usageLogDir, { sinceMs: windowStartMs });
   return identities.map((identity) => {
     const records = log.records.filter((record2) => record2.identity === identity && record2.provider === ANTHROPIC_PROVIDER && Date.parse(record2.at) >= windowStartMs);
     try {
-      const snapshot = readUsageSnapshot(fs17, paths.usageSnapshotsDir, identity);
-      const account = readAccountMetadata(fs17, paths.identitiesDir, identity) ?? snapshot?.account;
+      const snapshot = readUsageSnapshot(fs18, paths.usageSnapshotsDir, identity);
+      const account = readAccountMetadata(fs18, paths.identitiesDir, identity) ?? snapshot?.account;
       return { identity, records, ...snapshot === void 0 ? {} : { snapshot }, ...account === void 0 ? {} : { account } };
     } catch (error62) {
       if (error62 instanceof UsageSnapshotError || error62 instanceof AccountMetadataError) {
@@ -62518,9 +62518,9 @@ function rankPoolFromStore(params) {
     ...params.sticky === void 0 ? {} : { sticky: params.sticky }
   });
 }
-function readPicksFile(fs17, file2) {
+function readPicksFile(fs18, file2) {
   const empty = { schemaVersion: SCHEMA_VERSION, picks: {} };
-  const raw = fs17.readFileUtf8(file2);
+  const raw = fs18.readFileUtf8(file2);
   if (raw === void 0) {
     return { file: empty };
   }
@@ -62533,17 +62533,17 @@ function readPicksFile(fs17, file2) {
   const result = PicksFileSchema.safeParse(parsed);
   return result.success ? { file: result.data } : { file: empty, problem: `${file2} is not a picks file this agent-shim can read` };
 }
-function readStickyPick(fs17, picksFile, directory) {
-  const read = readPicksFile(fs17, picksFile);
+function readStickyPick(fs18, picksFile, directory) {
+  const read = readPicksFile(fs18, picksFile);
   const entry = read.file.picks[directory];
   return { ...entry === void 0 ? {} : { sticky: entry }, ...read.problem === void 0 ? {} : { problem: read.problem } };
 }
-function recordStickyPick(fs17, picksFile, directory, identity, nowMs) {
-  const current = readPicksFile(fs17, picksFile).file.picks;
+function recordStickyPick(fs18, picksFile, directory, identity, nowMs) {
+  const current = readPicksFile(fs18, picksFile).file.picks;
   const kept = Object.entries(current).filter(([, entry]) => nowMs - Date.parse(entry.at) <= USAGE_RETENTION_MS);
   const next = { schemaVersion: SCHEMA_VERSION, picks: { ...Object.fromEntries(kept), [directory]: { identity, at: new Date(nowMs).toISOString() } } };
-  fs17.mkdirPrivate(import_node_path23.default.dirname(picksFile));
-  fs17.writeFilePrivate(picksFile, `${JSON.stringify(next, null, 2)}
+  fs18.mkdirPrivate(import_node_path23.default.dirname(picksFile));
+  fs18.writeFilePrivate(picksFile, `${JSON.stringify(next, null, 2)}
 `);
 }
 
@@ -62551,8 +62551,8 @@ function recordStickyPick(fs17, picksFile, directory, identity, nowMs) {
 var RESUME_FLAGS = /* @__PURE__ */ new Set(["--continue", "-c", "--resume", "-r"]);
 var TERMINATOR = "--";
 var REASONS_LOGGED = 3;
-function splitMembers(pool, paths, fs17) {
-  const exists = (name) => loadIdentity(paths.identitiesDir, name, fs17) !== void 0;
+function splitMembers(pool, paths, fs18) {
+  const exists = (name) => loadIdentity(paths.identitiesDir, name, fs18) !== void 0;
   return { present: pool.identities.filter(exists), missing: pool.identities.filter((name) => !exists(name)) };
 }
 function isResuming(passthrough) {
@@ -63816,10 +63816,10 @@ var FrontDoorStateSchema = external_exports.strictObject({
   /** The last fatal error, kept across shutdowns so `frontdoor status` can explain a front door that is not running. */
   lastError: external_exports.string().optional()
 });
-function readFrontDoorState(fs17, stateFile) {
+function readFrontDoorState(fs18, stateFile) {
   let raw;
   try {
-    raw = fs17.readFileUtf8(stateFile);
+    raw = fs18.readFileUtf8(stateFile);
   } catch {
     return void 0;
   }
@@ -63833,28 +63833,28 @@ function readFrontDoorState(fs17, stateFile) {
     return void 0;
   }
 }
-function writeFrontDoorState(fs17, stateFile, state) {
-  fs17.mkdirp(import_node_path26.default.dirname(stateFile));
-  fs17.writeFileUtf8(stateFile, `${JSON.stringify(state, null, 2)}
+function writeFrontDoorState(fs18, stateFile, state) {
+  fs18.mkdirp(import_node_path26.default.dirname(stateFile));
+  fs18.writeFileUtf8(stateFile, `${JSON.stringify(state, null, 2)}
 `);
 }
 function frontDoorOrigin(state) {
   const port = state?.directPort ?? state?.lastDirectPort;
   return port === void 0 ? void 0 : `http://127.0.0.1:${String(port)}`;
 }
-function writeFrontDoorSession(fs17, sessionsDir, session) {
-  fs17.mkdirPrivate(sessionsDir);
-  fs17.writeFilePrivate(import_node_path26.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
+function writeFrontDoorSession(fs18, sessionsDir, session) {
+  fs18.mkdirPrivate(sessionsDir);
+  fs18.writeFilePrivate(import_node_path26.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
 `);
 }
-function listFrontDoorSessions(fs17, sessionsDir) {
+function listFrontDoorSessions(fs18, sessionsDir) {
   const sessions = [];
-  for (const name of fs17.readdir(sessionsDir)) {
+  for (const name of fs18.readdir(sessionsDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs17.readFileUtf8(import_node_path26.default.join(sessionsDir, name)) ?? ""));
+      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs18.readFileUtf8(import_node_path26.default.join(sessionsDir, name)) ?? ""));
       if (parsed.success) {
         sessions.push({ pid: parsed.data.pid, startedAt: parsed.data.startedAt });
       }
@@ -63864,27 +63864,27 @@ function listFrontDoorSessions(fs17, sessionsDir) {
   }
   return sessions.sort((a2, b) => a2.pid - b.pid);
 }
-function removeFrontDoorSession(fs17, sessionsDir, pid) {
-  fs17.removeRecursive(import_node_path26.default.join(sessionsDir, `${String(pid)}.json`));
+function removeFrontDoorSession(fs18, sessionsDir, pid) {
+  fs18.removeRecursive(import_node_path26.default.join(sessionsDir, `${String(pid)}.json`));
 }
-function pruneDeadFrontDoorSessions(fs17, sessionsDir, isRunning) {
+function pruneDeadFrontDoorSessions(fs18, sessionsDir, isRunning) {
   const removed = [];
-  for (const session of listFrontDoorSessions(fs17, sessionsDir)) {
+  for (const session of listFrontDoorSessions(fs18, sessionsDir)) {
     if (!isRunning(session.pid)) {
-      removeFrontDoorSession(fs17, sessionsDir, session.pid);
+      removeFrontDoorSession(fs18, sessionsDir, session.pid);
       removed.push(session.pid);
     }
   }
   return removed;
 }
-function liveSessionTokens(fs17, sessionsDir) {
+function liveSessionTokens(fs18, sessionsDir) {
   const tokens = /* @__PURE__ */ new Set();
-  for (const name of fs17.readdir(sessionsDir)) {
+  for (const name of fs18.readdir(sessionsDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs17.readFileUtf8(import_node_path26.default.join(sessionsDir, name)) ?? ""));
+      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs18.readFileUtf8(import_node_path26.default.join(sessionsDir, name)) ?? ""));
       if (parsed.success) {
         tokens.add(parsed.data.token);
       }
@@ -64250,6 +64250,7 @@ function registerCodexCommand(program2, deps) {
 
 // src/frontdoor/commands.ts
 var import_node_crypto13 = require("node:crypto");
+var import_node_path29 = __toESM(require("node:path"), 1);
 var import_node_fs11 = __toESM(require("node:fs"), 1);
 
 // src/frontdoor/custody.ts
@@ -64387,9 +64388,113 @@ function isLiveCapability(presented, live) {
   return matched;
 }
 
+// src/frontdoor/capture.ts
+var fs11 = __toESM(require("node:fs"), 1);
+var path28 = __toESM(require("node:path"), 1);
+var SECRET_HEADER_NAME = /authorization|cookie|token|secret|credential|api[-_]key/i;
+var SECRET_JSON_KEY = /token|secret|password|credential|authorization|api[-_]key/i;
+var SECRET_BODY_PATTERNS = [
+  { pattern: /sk-ant-[A-Za-z0-9_-]{8,}/g, replacement: "<redacted>" },
+  { pattern: /Bearer\s+[A-Za-z0-9._~+/=-]{8,}/gi, replacement: "Bearer <redacted>" },
+  { pattern: /eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{8,}/g, replacement: "<redacted>" }
+];
+var CHUNK_LOG_CAP_BYTES = 8192;
+var STREAM_LOG_CAP_BYTES = 262144;
+var CAPTURE_FILE_MODE = 384;
+function redactHeaders(headers) {
+  const result = {};
+  for (const [name, value] of Object.entries(headers)) {
+    result[name] = value !== void 0 && SECRET_HEADER_NAME.test(name) ? "<redacted>" : value;
+  }
+  return result;
+}
+function redactText(text2) {
+  return SECRET_BODY_PATTERNS.reduce((accumulated, { pattern, replacement }) => accumulated.replace(pattern, replacement), text2);
+}
+function redactJsonValue(value) {
+  if (typeof value === "string") {
+    return redactText(value);
+  }
+  if (Array.isArray(value)) {
+    return value.map(redactJsonValue);
+  }
+  if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+    return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, SECRET_JSON_KEY.test(key) ? "<redacted>" : redactJsonValue(entry)]));
+  }
+  return value;
+}
+function redactBody(chunk) {
+  const text2 = chunk.toString("utf8");
+  try {
+    const parsed = JSON.parse(text2);
+    return JSON.stringify(redactJsonValue(parsed));
+  } catch {
+    return redactText(text2);
+  }
+}
+var CAPTURE_ENV = "AGENT_SHIM_FRONTDOOR_CAPTURE";
+function captureFromEnv(env, logsDir) {
+  return env[CAPTURE_ENV] === "1" ? createFileCapture(path28.join(logsDir, "frontdoor-capture.jsonl")) : void 0;
+}
+function createFileCapture(file2, now = () => /* @__PURE__ */ new Date()) {
+  fs11.mkdirSync(path28.dirname(file2), { recursive: true });
+  let nextId = 0;
+  const append = (record2) => {
+    fs11.appendFileSync(file2, `${JSON.stringify({ ts: now().toISOString(), ...record2 })}
+`, { mode: CAPTURE_FILE_MODE });
+  };
+  return {
+    connect: (target, intercepted) => {
+      append({ kind: "connect", host: target.host, port: target.port, intercepted });
+    },
+    upgrade: (request6) => {
+      append({ kind: "upgrade", method: request6.method ?? "?", url: request6.url ?? "?", headers: redactHeaders(request6.headers) });
+    },
+    observePassthrough: (request6) => {
+      nextId += 1;
+      const id = nextId;
+      append({ kind: "request", id, method: request6.method ?? "?", url: request6.url ?? "?", headers: redactHeaders(request6.headers) });
+      const logged = { request: 0, response: 0 };
+      const sequences = { request: 0, response: 0 };
+      const chunk = (direction, incoming) => {
+        sequences[direction] += 1;
+        const budget = STREAM_LOG_CAP_BYTES - logged[direction];
+        if (budget <= 0) {
+          return;
+        }
+        const excerpt = incoming.subarray(0, Math.min(CHUNK_LOG_CAP_BYTES, budget));
+        logged[direction] += excerpt.length;
+        append({
+          kind: `${direction}-chunk`,
+          id,
+          seq: sequences[direction],
+          bytes: incoming.length,
+          stored: excerpt.length,
+          truncated: excerpt.length < incoming.length,
+          body: redactBody(excerpt)
+        });
+      };
+      return {
+        onRequestChunk: (incoming) => {
+          chunk("request", incoming);
+        },
+        onResponse: (status, headers) => {
+          append({ kind: "response", id, status, headers: redactHeaders(headers) });
+        },
+        onResponseChunk: (incoming) => {
+          chunk("response", incoming);
+        },
+        onEnd: () => {
+          append({ kind: "end", id, requestBytesCapped: logged.request >= STREAM_LOG_CAP_BYTES, responseBytesCapped: logged.response >= STREAM_LOG_CAP_BYTES });
+        }
+      };
+    }
+  };
+}
+
 // src/frontdoor/connect.ts
 var import_node_crypto10 = require("node:crypto");
-var fs11 = __toESM(require("node:fs"), 1);
+var fs12 = __toESM(require("node:fs"), 1);
 var http = __toESM(require("node:http"), 1);
 var https = __toESM(require("node:https"), 1);
 var net3 = __toESM(require("node:net"), 1);
@@ -64671,8 +64776,8 @@ var FRONTDOOR_SUPERVISOR_STILL_RUNNING = -1;
 var FRONTDOOR_POLL_MS = 1e3;
 var MS_PER_MINUTE = 6e4;
 async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {}) {
-  const { fs: fs17, paths } = ports;
-  const previous = readFrontDoorState(fs17, paths.frontdoorStateFile);
+  const { fs: fs18, paths } = ports;
+  const previous = readFrontDoorState(fs18, paths.frontdoorStateFile);
   let lastPort = previous?.lastPort;
   let lastConnectPort = previous?.lastConnectPort;
   let lastDirectPort = previous?.lastDirectPort;
@@ -64682,12 +64787,12 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     ...lastDirectPort === void 0 ? {} : { lastDirectPort }
   });
   const fail = (message) => {
-    writeFrontDoorState(fs17, paths.frontdoorStateFile, { lastError: message, ...sticky() });
-    fs17.removeRecursive(paths.frontdoorLockFile);
+    writeFrontDoorState(fs18, paths.frontdoorStateFile, { lastError: message, ...sticky() });
+    fs18.removeRecursive(paths.frontdoorLockFile);
     ports.log(`agent-shim frontdoor supervisor: ${message}`);
     return 1;
   };
-  writeFrontDoorState(fs17, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, ...sticky() });
+  writeFrontDoorState(fs18, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, ...sticky() });
   const previousSticky = lastPort;
   let http5;
   try {
@@ -64724,8 +64829,8 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     ports.log(`agent-shim frontdoor supervisor: sticky direct port ${String(previousStickyDirect)} was occupied; moving to ${String(direct.port)} (headroom must be restarted to admit the new address)`);
   }
   lastDirectPort = direct.port;
-  writeFrontDoorState(fs17, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, port: http5.port, connectPort: connect2.port, directPort: direct.port, ...sticky() });
-  fs17.removeRecursive(paths.frontdoorLockFile);
+  writeFrontDoorState(fs18, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, port: http5.port, connectPort: connect2.port, directPort: direct.port, ...sticky() });
+  fs18.removeRecursive(paths.frontdoorLockFile);
   ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http5.port)}, CONNECT surface on 127.0.0.1:${String(connect2.port)}`);
   let idleSince;
   let ticks = 0;
@@ -64734,15 +64839,15 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
       return FRONTDOOR_SUPERVISOR_STILL_RUNNING;
     }
     ticks += 1;
-    pruneDeadFrontDoorSessions(fs17, paths.frontdoorSessionsDir, ports.isRunning);
-    if (listFrontDoorSessions(fs17, paths.frontdoorSessionsDir).length === 0) {
+    pruneDeadFrontDoorSessions(fs18, paths.frontdoorSessionsDir, ports.isRunning);
+    if (listFrontDoorSessions(fs18, paths.frontdoorSessionsDir).length === 0) {
       idleSince ??= ports.now();
       if (ports.now() - idleSince >= idleShutdownMinutes * MS_PER_MINUTE) {
         ports.log(`agent-shim frontdoor supervisor: no sessions for ${String(idleShutdownMinutes)} minute(s); closing the front door and exiting`);
         await direct.close();
         await connect2.close();
         await http5.close();
-        writeFrontDoorState(fs17, paths.frontdoorStateFile, sticky());
+        writeFrontDoorState(fs18, paths.frontdoorStateFile, sticky());
         return 0;
       }
     } else {
@@ -64796,8 +64901,8 @@ function parseConnectTarget(authority) {
 function isInterceptedHost(host, interceptHost) {
   return host === interceptHost;
 }
-function servedByPipeline(path36) {
-  return path36?.startsWith(ROUTED_PATH_PREFIX) === true;
+function servedByPipeline(path38) {
+  return path38?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
   "connection",
@@ -64870,9 +64975,9 @@ async function startConnectServer(config2, effects, preferredPort) {
       config2.serveRouted(request6, response);
       return;
     }
-    effects.forwardHttp(config2.upstream, request6, response);
+    effects.forwardHttp(config2.upstream, request6, response, config2.capture?.observePassthrough(request6));
   };
-  const httpSession = effects.createHttpSession(handler);
+  const httpSession = effects.createHttpSession(handler, config2.capture === void 0 ? void 0 : (request6) => config2.capture?.upgrade(request6));
   const tlsAcceptor = effects.createTlsAcceptor(config2.leafFor(config2.interceptHost), (secure) => {
     httpSession.serve(secure);
   });
@@ -65025,6 +65130,7 @@ function routeConnect(socket, head, context) {
     refuse(socket, REFUSAL.serviceUnavailable);
     return;
   }
+  config2.capture?.connect(target, isInterceptedHost(target.host, config2.interceptHost));
   socket.write(CONNECT_ESTABLISHED);
   if (isInterceptedHost(target.host, config2.interceptHost)) {
     tlsAcceptor.accept(socket);
@@ -65121,11 +65227,17 @@ function realConnectEffects() {
         }
       };
     },
-    createHttpSession: (handler) => {
+    createHttpSession: (handler, onUpgrade) => {
       const server = http.createServer(handler);
       server.on("clientError", (_error, socket) => {
         socket.destroy();
       });
+      if (onUpgrade !== void 0) {
+        server.on("upgrade", (request6, socket) => {
+          onUpgrade(request6);
+          socket.destroy();
+        });
+      }
       return {
         serve: (socket) => {
           server.emit("connection", socket);
@@ -65143,7 +65255,7 @@ function realConnectEffects() {
       });
       socket.once("error", reject);
     }),
-    forwardHttp: (target, request6, response) => {
+    forwardHttp: (target, request6, response, observer) => {
       const headers = forwardableHeaders(request6.headers);
       const options = {
         host: target.host,
@@ -65163,8 +65275,14 @@ function realConnectEffects() {
         }
       }
       const onUpstreamResponse = (upstreamResponse) => {
+        observer?.onResponse(upstreamResponse.statusCode ?? HTTP_BAD_GATEWAY, upstreamResponse.headers);
         response.writeHead(upstreamResponse.statusCode ?? HTTP_BAD_GATEWAY, forwardableHeaders(upstreamResponse.headers));
         response.flushHeaders();
+        if (observer !== void 0) {
+          upstreamResponse.on("data", (chunk) => {
+            observer.onResponseChunk(chunk);
+          });
+        }
         upstreamResponse.pipe(response);
       };
       const upstream = target.tls ? https.request(options, onUpstreamResponse) : http.request(options, onUpstreamResponse);
@@ -65177,6 +65295,14 @@ function realConnectEffects() {
         response.writeHead(HTTP_BAD_GATEWAY, { "content-type": "text/plain", "content-length": String(body.length) });
         response.end(body);
       });
+      if (observer !== void 0) {
+        request6.on("data", (chunk) => {
+          observer.onRequestChunk(chunk);
+        });
+        response.on("close", () => {
+          observer.onEnd();
+        });
+      }
       request6.pipe(upstream);
       request6.socket.setNoDelay(true);
       upstream.on("socket", (socket) => {
@@ -65191,7 +65317,7 @@ function isEnoent5(error62) {
 function realConnectCertStore(paths) {
   const read = (file2) => {
     try {
-      return fs11.readFileSync(file2, "utf8");
+      return fs12.readFileSync(file2, "utf8");
     } catch (error62) {
       if (isEnoent5(error62)) {
         return void 0;
@@ -65206,10 +65332,10 @@ function realConnectCertStore(paths) {
       return certPem === void 0 || keyPem2 === void 0 ? void 0 : { certPem, keyPem: keyPem2 };
     },
     writeCa: (ca) => {
-      fs11.mkdirSync(paths.frontdoorCaDir, { recursive: true });
-      fs11.writeFileSync(paths.frontdoorCaCertFile, ca.certPem, "utf8");
-      fs11.writeFileSync(paths.frontdoorCaKeyFile, ca.keyPem, { encoding: "utf8", mode: CA_KEY_FILE_MODE });
-      fs11.chmodSync(paths.frontdoorCaKeyFile, CA_KEY_FILE_MODE);
+      fs12.mkdirSync(paths.frontdoorCaDir, { recursive: true });
+      fs12.writeFileSync(paths.frontdoorCaCertFile, ca.certPem, "utf8");
+      fs12.writeFileSync(paths.frontdoorCaKeyFile, ca.keyPem, { encoding: "utf8", mode: CA_KEY_FILE_MODE });
+      fs12.chmodSync(paths.frontdoorCaKeyFile, CA_KEY_FILE_MODE);
     }
   };
 }
@@ -66296,8 +66422,8 @@ function createCodexRouteMount(ports, upstreamBase, provider) {
         request6.body.resume();
         return;
       }
-      const path36 = new URL(request6.url, "http://127.0.0.1").pathname;
-      const translated = { method: request6.method, path: path36, body, signal: request6.signal };
+      const path38 = new URL(request6.url, "http://127.0.0.1").pathname;
+      const translated = { method: request6.method, path: path38, body, signal: request6.signal };
       const routed = await route(translated);
       if (request6.signal.aborted) {
         return;
@@ -66331,7 +66457,7 @@ function createPassthroughRoute(name, target) {
     headroomUpstream: target.headroomUpstream,
     serve: async (request6, response) => {
       const incoming = new URL(request6.url, "http://127.0.0.1");
-      const path36 = target.stripPrefix !== void 0 && incoming.pathname.startsWith(target.stripPrefix) ? incoming.pathname.slice(target.stripPrefix.length) : incoming.pathname;
+      const path38 = target.stripPrefix !== void 0 && incoming.pathname.startsWith(target.stripPrefix) ? incoming.pathname.slice(target.stripPrefix.length) : incoming.pathname;
       const headers = forwardableHeaders(request6.headers);
       delete headers.host;
       await new Promise((resolve) => {
@@ -66339,7 +66465,7 @@ function createPassthroughRoute(name, target) {
           host: base.hostname,
           port: base.port === "" ? void 0 : Number(base.port),
           method: request6.method,
-          path: `${basePath}${path36}${incoming.search}`,
+          path: `${basePath}${path38}${incoming.search}`,
           headers,
           agent
         };
@@ -66401,10 +66527,10 @@ function createProviderRouteResolver(deps) {
     return route;
   };
   const resolve = (request6) => {
-    const path36 = new URL(request6.url, "http://127.0.0.1").pathname;
-    const scoped = parseProviderPath(path36);
+    const path38 = new URL(request6.url, "http://127.0.0.1").pathname;
+    const scoped = parseProviderPath(path38);
     if (scoped === void 0) {
-      return path36.startsWith("/v1/") ? { ok: true, route: oauthRoute } : { ok: false, status: HTTP_STATUS.notFound, message: `no such endpoint: ${path36}` };
+      return path38.startsWith("/v1/") ? { ok: true, route: oauthRoute } : { ok: false, status: HTTP_STATUS.notFound, message: `no such endpoint: ${path38}` };
     }
     const { provider } = scoped;
     let definition;
@@ -66448,14 +66574,14 @@ var import_node_crypto12 = require("node:crypto");
 var import_node_path28 = __toESM(require("node:path"), 1);
 var BUNDLE_NAME_HEX_DIGITS = 16;
 function resolveTrustBundle(params) {
-  const { caCertFile, bundlesDir, inherited, fs: fs17 } = params;
+  const { caCertFile, bundlesDir, inherited, fs: fs18 } = params;
   if (inherited === void 0 || inherited === "" || import_node_path28.default.resolve(inherited) === import_node_path28.default.resolve(caCertFile)) {
     return { path: caCertFile };
   }
-  const caPem = fs17.readFileUtf8(caCertFile);
+  const caPem = fs18.readFileUtf8(caCertFile);
   let inheritedPem;
   try {
-    inheritedPem = fs17.readFileUtf8(inherited);
+    inheritedPem = fs18.readFileUtf8(inherited);
   } catch (error62) {
     return {
       path: caCertFile,
@@ -66468,9 +66594,9 @@ function resolveTrustBundle(params) {
   const combined = `${inheritedPem.trimEnd()}
 ${caPem}`;
   const bundle = import_node_path28.default.join(bundlesDir, `${(0, import_node_crypto12.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
-  if (!fs17.exists(bundle)) {
-    fs17.mkdirp(bundlesDir);
-    fs17.writeFileAtomic(bundle, combined);
+  if (!fs18.exists(bundle)) {
+    fs18.mkdirp(bundlesDir);
+    fs18.writeFileAtomic(bundle, combined);
   }
   return { path: bundle };
 }
@@ -66835,6 +66961,10 @@ function realFrontDoorSupervisorPorts(paths) {
     },
     startConnectListener: async (preferredPort) => {
       const leafFor = createLeafCache(loadCa(), () => /* @__PURE__ */ new Date());
+      const capture = captureFromEnv(process.env, paths.logsDir);
+      if (capture !== void 0) {
+        log(`capture enabled, recording CONNECT targets and piped exchanges to ${import_node_path29.default.join(paths.logsDir, "frontdoor-capture.jsonl")}`);
+      }
       const server = await startConnectServer(
         {
           interceptHost: CONNECT_INTERCEPT_HOST,
@@ -66860,7 +66990,8 @@ function realFrontDoorSupervisorPorts(paths) {
           leafFor,
           upstream: { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT, tls: true },
           isLiveCapability: isLiveToken,
-          limits: CONNECT_LIMITS
+          limits: CONNECT_LIMITS,
+          ...capture === void 0 ? {} : { capture }
         },
         realConnectEffects(),
         preferredPort
@@ -67277,15 +67408,15 @@ var import_node_child_process4 = require("node:child_process");
 
 // src/identityToken.ts
 var import_node_fs12 = __toESM(require("node:fs"), 1);
-var import_node_path29 = __toESM(require("node:path"), 1);
+var import_node_path30 = __toESM(require("node:path"), 1);
 var TOKEN_FILE_MODE = 384;
 var TOKEN_DIR_MODE = 448;
 var OAUTH_TOKEN_RE = /^sk-ant-oat\d+-[A-Za-z0-9_-]+$/;
 function identityTokenDir(paths) {
-  return import_node_path29.default.join(paths.root, "credentials");
+  return import_node_path30.default.join(paths.root, "credentials");
 }
 function identityTokenPath(paths, identityName) {
-  return import_node_path29.default.join(identityTokenDir(paths), `${identityName}.token`);
+  return import_node_path30.default.join(identityTokenDir(paths), `${identityName}.token`);
 }
 function storeIdentityToken(paths, identityName, raw) {
   const token = raw.trim();
@@ -67296,7 +67427,7 @@ function storeIdentityToken(paths, identityName, raw) {
   import_node_fs12.default.mkdirSync(dir, { recursive: true, mode: TOKEN_DIR_MODE });
   import_node_fs12.default.chmodSync(dir, TOKEN_DIR_MODE);
   const target = identityTokenPath(paths, identityName);
-  const temp = import_node_path29.default.join(dir, `.${identityName}.${String(process.pid)}.tmp`);
+  const temp = import_node_path30.default.join(dir, `.${identityName}.${String(process.pid)}.tmp`);
   import_node_fs12.default.writeFileSync(temp, `${token}
 `, { mode: TOKEN_FILE_MODE });
   import_node_fs12.default.renameSync(temp, target);
@@ -67306,7 +67437,7 @@ function storeIdentityToken(paths, identityName, raw) {
 // src/realCredentialCache.ts
 var import_node_child_process3 = require("node:child_process");
 var import_node_fs13 = __toESM(require("node:fs"), 1);
-var import_node_path30 = __toESM(require("node:path"), 1);
+var import_node_path31 = __toESM(require("node:path"), 1);
 var KEYCHAIN_CACHE_SERVICE = "agent-shim-credential-cache";
 var CACHE_DIR_MODE = 448;
 var CACHE_FILE_MODE = 384;
@@ -67333,8 +67464,8 @@ function security(args, stdin2) {
   return { status: result.status, stdout: result.stdout };
 }
 function createRealCredentialCache(root) {
-  const dir = import_node_path30.default.join(root, "credential-cache");
-  const filePath = (owner) => import_node_path30.default.join(dir, cacheFileNameFor(owner));
+  const dir = import_node_path31.default.join(root, "credential-cache");
+  const filePath = (owner) => import_node_path31.default.join(dir, cacheFileNameFor(owner));
   return {
     read(store, owner) {
       if (store === "file") {
@@ -67513,7 +67644,7 @@ function subjectName(positional, provider) {
 
 // src/doctor.ts
 var import_node_fs14 = __toESM(require("node:fs"), 1);
-var import_node_path31 = __toESM(require("node:path"), 1);
+var import_node_path32 = __toESM(require("node:path"), 1);
 
 // src/headroom/source.ts
 var GIT_SPEC_RE = /git\+[^@\s]+(?:@([^\s#]+))?/;
@@ -67564,7 +67695,7 @@ function validateJson(schema, input2) {
   return { ok: true, data: result.data };
 }
 function pushPathResolution(push, resolution) {
-  const ownDir = import_node_path31.default.dirname(resolution.ownExecutablePath);
+  const ownDir = import_node_path32.default.dirname(resolution.ownExecutablePath);
   switch (resolution.agentShim.status) {
     case "ok":
       push("path-resolution", "pass", `\`agent-shim\` on PATH resolves to this running executable, ${resolution.ownExecutablePath}.`, "agent-shim");
@@ -67632,14 +67763,14 @@ function pushProvider(push, entry) {
 }
 function pushLegacyName(push, params) {
   const legacyVariables = Object.keys(params.env).filter((name) => name.startsWith(LEGACY_ENV_PREFIX) && params.env[name] !== void 0).sort();
-  if (legacyVariables.length === 0 && import_node_path31.default.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
+  if (legacyVariables.length === 0 && import_node_path32.default.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
     push("legacy-name", "pass", "Nothing here still uses the former `claude-use` name.");
     return;
   }
   for (const name of legacyVariables) {
     push("legacy-name", "warn", `${name} is the former name of ${name.replace(LEGACY_ENV_PREFIX, ENV_PREFIX)}. Rename it; the old name still works but is only a fallback.`, name);
   }
-  if (import_node_path31.default.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
+  if (import_node_path32.default.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
     push(
       "legacy-name",
       "warn",
@@ -67950,18 +68081,18 @@ function registerDoctorCommand(program2, deps) {
   ).option("--json", "Print the report as JSON.").action((options) => {
     const identityNames = import_node_fs14.default.existsSync(paths.identitiesDir) ? import_node_fs14.default.readdirSync(paths.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && isIdentityDirectoryName(entry.name)).map((entry) => entry.name).sort() : [];
     const identities = identityNames.map((name) => {
-      const farmRoot = import_node_path31.default.join(paths.identitiesDir, name);
-      const identityPath = import_node_path31.default.join(farmRoot, "identity.json");
+      const farmRoot = import_node_path32.default.join(paths.identitiesDir, name);
+      const identityPath = import_node_path32.default.join(farmRoot, "identity.json");
       return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot };
     });
     const profileNames = import_node_fs14.default.existsSync(paths.configProfilesDir) ? import_node_fs14.default.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
     const configProfiles = profileNames.map((name) => {
-      const profilePath = import_node_path31.default.join(paths.configProfilesDir, `${name}.json`);
+      const profilePath = import_node_path32.default.join(paths.configProfilesDir, `${name}.json`);
       return { name, path: profilePath, raw: realFsPort.readFileUtf8(profilePath) };
     });
     const providerNames = import_node_fs14.default.existsSync(paths.providersDir) ? import_node_fs14.default.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
     const providers = providerNames.map((name) => {
-      const providerPath = import_node_path31.default.join(paths.providersDir, `${name}.json`);
+      const providerPath = import_node_path32.default.join(paths.providersDir, `${name}.json`);
       return { name, path: providerPath, raw: realFsPort.readFileUtf8(providerPath) };
     });
     const ownExecutablePath = realOwnExecutablePath();
@@ -67973,12 +68104,12 @@ function registerDoctorCommand(program2, deps) {
       binaryDiscovery = { ok: false, message: error62 instanceof Error ? error62.message : String(error62) };
     }
     const shimState = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-    const pathDirs = (process.env.PATH ?? "").split(import_node_path31.default.delimiter).filter((dir) => dir !== "");
+    const pathDirs = (process.env.PATH ?? "").split(import_node_path32.default.delimiter).filter((dir) => dir !== "");
     const claudeShimShadow = shimState === void 0 ? void 0 : refinePathShadow(
       findPathShadow({
         pathDirs,
-        targetDir: import_node_path31.default.dirname(shimState.targetPath),
-        targetFilename: import_node_path31.default.basename(shimState.targetPath),
+        targetDir: import_node_path32.default.dirname(shimState.targetPath),
+        targetFilename: import_node_path32.default.basename(shimState.targetPath),
         findExecutableInDir
       }),
       shimState.targetPath,
@@ -68001,7 +68132,7 @@ function registerDoctorCommand(program2, deps) {
         agentShim: refinePathShadow(
           findPathShadow({
             pathDirs,
-            targetDir: import_node_path31.default.dirname(ownExecutablePath),
+            targetDir: import_node_path32.default.dirname(ownExecutablePath),
             targetFilename: commandFilename(ownExecutablePath, "agent-shim"),
             findExecutableInDir
           }),
@@ -68034,7 +68165,7 @@ function registerDoctorCommand(program2, deps) {
 // src/headroom/commands.ts
 var import_node_fs15 = __toESM(require("node:fs"), 1);
 var import_node_net3 = __toESM(require("node:net"), 1);
-var import_node_path32 = __toESM(require("node:path"), 1);
+var import_node_path33 = __toESM(require("node:path"), 1);
 var import_node_child_process5 = require("node:child_process");
 
 // src/headroom/settings.ts
@@ -68165,9 +68296,9 @@ function compareVersions2(a2, b) {
 }
 var HEADROOM_SUPERVISOR_STILL_RUNNING = -1;
 async function runSupervisor(initialConfig, ports, options = {}) {
-  const { fs: fs17, paths } = ports;
+  const { fs: fs18, paths } = ports;
   let config2 = initialConfig;
-  const previousState = readHeadroomState(fs17, paths.headroomStateFile);
+  const previousState = readHeadroomState(fs18, paths.headroomStateFile);
   if (previousState?.supervisorPid !== void 0 && previousState.supervisorPid !== ports.ownPid && ports.isRunning(previousState.supervisorPid)) {
     ports.log(`agent-shim headroom supervisor ${String(ports.ownPid)}: supervisor ${String(previousState.supervisorPid)} already owns the daemon; exiting`);
     return 0;
@@ -68176,19 +68307,19 @@ async function runSupervisor(initialConfig, ports, options = {}) {
   let lastPort = previousState?.lastPort;
   const sticky = () => lastPort === void 0 ? {} : { lastPort };
   const ownsState = () => {
-    const owner = readHeadroomState(fs17, paths.headroomStateFile)?.supervisorPid;
+    const owner = readHeadroomState(fs18, paths.headroomStateFile)?.supervisorPid;
     return owner === void 0 || owner === ports.ownPid || !ports.isRunning(owner);
   };
   const writeOwnState = (state) => {
     if (!ownsState()) {
       return false;
     }
-    writeHeadroomState(fs17, paths.headroomStateFile, state);
+    writeHeadroomState(fs18, paths.headroomStateFile, state);
     return true;
   };
   const fail = (message) => {
     if (writeOwnState({ lastError: message, ...sticky() })) {
-      fs17.removeRecursive(paths.headroomLockFile);
+      fs18.removeRecursive(paths.headroomLockFile);
     }
     ports.log(`agent-shim headroom supervisor: ${message}`);
     return 1;
@@ -68237,7 +68368,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     const settingsHash = hashSettings(config2.settings);
     const allowlist = allowlistOf(ports);
     const allowlistHash = hashAllowlist(allowlist);
-    pruneDeadSessions(fs17, paths.headroomSessionsDir, ports.isRunning);
+    pruneDeadSessions(fs18, paths.headroomSessionsDir, ports.isRunning);
     const ownsNow = ownsState();
     if (!ownsNow && !superseded) {
       ports.log("agent-shim headroom supervisor: another supervisor now owns state.json; serving this daemon's own sessions until they end");
@@ -68289,7 +68420,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
           ...sticky()
         });
         if (recorded) {
-          fs17.removeRecursive(paths.headroomLockFile);
+          fs18.removeRecursive(paths.headroomLockFile);
         }
         idleSince = void 0;
         ports.log(`agent-shim headroom supervisor: headroom pid ${String(pid)} ready on 127.0.0.1:${String(port)}`);
@@ -68304,7 +68435,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
       }
     } else {
       if (runningHash !== allowlistHash || runningSettingsHash !== settingsHash || installedSource !== config2.source) {
-        if (sessionsForSupervisor(fs17, paths.headroomSessionsDir, ports.ownPid).length === 0) {
+        if (sessionsForSupervisor(fs18, paths.headroomSessionsDir, ports.ownPid).length === 0) {
           ports.log("agent-shim headroom supervisor: configuration drifted and no sessions are live; restarting headroom");
           ports.stopProcess(headroomPid);
           headroomPid = void 0;
@@ -68313,7 +68444,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
           continue;
         }
       }
-      const sessions = sessionsForSupervisor(fs17, paths.headroomSessionsDir, ports.ownPid);
+      const sessions = sessionsForSupervisor(fs18, paths.headroomSessionsDir, ports.ownPid);
       if (sessions.length === 0) {
         idleSince ??= ports.now();
         const idleMs = ports.now() - idleSince;
@@ -68335,9 +68466,9 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     await ports.sleep(HEADROOM_POLL_MS);
   }
 }
-function currentHeadroomAllowlist(fs17, paths) {
-  const providers = readAllProviders(fs17, paths.providersDir).map((entry) => entry.provider);
-  return headroomAllowlist(headroomUpstreams(providers, frontDoorOrigin(readFrontDoorState(fs17, paths.frontdoorStateFile))));
+function currentHeadroomAllowlist(fs18, paths) {
+  const providers = readAllProviders(fs18, paths.providersDir).map((entry) => entry.provider);
+  return headroomAllowlist(headroomUpstreams(providers, frontDoorOrigin(readFrontDoorState(fs18, paths.frontdoorStateFile))));
 }
 function allowlistOf(ports) {
   return currentHeadroomAllowlist(ports.fs, ports.paths);
@@ -68449,12 +68580,12 @@ function readInstalledHeadroomCommit() {
   if (toolDir.status !== 0) {
     return void 0;
   }
-  const libDir = import_node_path32.default.join(toolDir.stdout.trim(), HEADROOM_TOOL_NAME, "lib");
+  const libDir = import_node_path33.default.join(toolDir.stdout.trim(), HEADROOM_TOOL_NAME, "lib");
   for (const python of realFarmFs.readdir(libDir)) {
-    const sitePackages = import_node_path32.default.join(libDir, python, "site-packages");
+    const sitePackages = import_node_path33.default.join(libDir, python, "site-packages");
     for (const entry of realFarmFs.readdir(sitePackages)) {
       if (entry.startsWith("headroom_ai-") && entry.endsWith(".dist-info")) {
-        const directUrl = realFarmFs.readFileUtf8(import_node_path32.default.join(sitePackages, entry, "direct_url.json"));
+        const directUrl = realFarmFs.readFileUtf8(import_node_path33.default.join(sitePackages, entry, "direct_url.json"));
         return directUrl === void 0 ? void 0 : parseInstalledCommit(directUrl);
       }
     }
@@ -68608,14 +68739,14 @@ function requireIdentity(paths, name) {
     throw new IdentityNotFoundError(name);
   }
 }
-function collectUsageReport(fs17, paths, filters) {
+function collectUsageReport(fs18, paths, filters) {
   const { identity, provider, sinceMs } = filters;
   if (identity !== void 0) {
     requireIdentity(paths, identity);
   }
-  const log = readUsageLog(fs17, paths.usageLogDir, sinceMs === void 0 ? {} : { sinceMs });
+  const log = readUsageLog(fs18, paths.usageLogDir, sinceMs === void 0 ? {} : { sinceMs });
   const records = log.records.filter((record2) => (identity === void 0 || record2.identity === identity) && (provider === void 0 || record2.provider === provider));
-  const snapshots = (identity === void 0 ? listUsageSnapshots(fs17, paths.usageSnapshotsDir) : [readUsageSnapshot(fs17, paths.usageSnapshotsDir, identity)].flatMap((snapshot) => snapshot === void 0 ? [] : [snapshot])).map((snapshot) => provider === void 0 ? snapshot : { ...snapshot, providers: Object.fromEntries(Object.entries(snapshot.providers).filter(([name]) => name === provider)) }).filter((snapshot) => Object.keys(snapshot.providers).length > 0);
+  const snapshots = (identity === void 0 ? listUsageSnapshots(fs18, paths.usageSnapshotsDir) : [readUsageSnapshot(fs18, paths.usageSnapshotsDir, identity)].flatMap((snapshot) => snapshot === void 0 ? [] : [snapshot])).map((snapshot) => provider === void 0 ? snapshot : { ...snapshot, providers: Object.fromEntries(Object.entries(snapshot.providers).filter(([name]) => name === provider)) }).filter((snapshot) => Object.keys(snapshot.providers).length > 0);
   return {
     since: sinceMs === void 0 ? void 0 : new Date(sinceMs).toISOString(),
     logDir: paths.usageLogDir,
@@ -68711,15 +68842,15 @@ function formatUsageReport(report) {
   }
   return lines;
 }
-function collectAccounts(fs17, paths, identity) {
+function collectAccounts(fs18, paths, identity) {
   if (identity !== void 0) {
     requireIdentity(paths, identity);
   }
   const names = identity === void 0 ? listIdentities(paths).map((entry) => entry.name) : [identity];
   return names.map((name) => ({
     identity: name,
-    account: readAccountMetadata(fs17, paths.identitiesDir, name),
-    usage: readUsageSnapshot(fs17, paths.usageSnapshotsDir, name)
+    account: readAccountMetadata(fs18, paths.identitiesDir, name),
+    usage: readUsageSnapshot(fs18, paths.usageSnapshotsDir, name)
   }));
 }
 function formatAccounts(views) {
@@ -68886,7 +69017,7 @@ var import_node_crypto16 = require("node:crypto");
 
 // src/launcher.ts
 var import_node_crypto15 = require("node:crypto");
-var import_node_path34 = __toESM(require("node:path"), 1);
+var import_node_path35 = __toESM(require("node:path"), 1);
 
 // src/launcher/cliOverride.ts
 var InvalidCliCategoryError = class extends CliError {
@@ -68970,7 +69101,7 @@ function buildCliOverride(params) {
 }
 
 // src/launcher/flags.ts
-var import_node_path33 = __toESM(require("node:path"), 1);
+var import_node_path34 = __toESM(require("node:path"), 1);
 
 // src/headroom/headers.ts
 function mergeAnthropicCustomHeaders(existing, additions) {
@@ -69040,7 +69171,7 @@ function buildEnv(params) {
   const parentCustomHeaders = params.baseEnv.ANTHROPIC_CUSTOM_HEADERS;
   let providerCustomHeaders;
   if (!params.configDirEscapeHatch && params.resolvedIdentityName !== void 0) {
-    env.CLAUDE_CONFIG_DIR = import_node_path33.default.join(params.identitiesDir, params.resolvedIdentityName);
+    env.CLAUDE_CONFIG_DIR = import_node_path34.default.join(params.identitiesDir, params.resolvedIdentityName);
   }
   if (params.provider !== void 0) {
     const providerEnv = params.provider.definition.env ?? {};
@@ -69132,7 +69263,7 @@ function resolveIdentityCredential(identity, credential, env, port) {
   return resolution.ok ? resolution : { ok: false, status: CREDENTIAL_UNAVAILABLE_EXIT, message: resolution.message };
 }
 function pickFromPool(decided, params, parsedArgv) {
-  const { paths, fs: fs17, proc, log } = params;
+  const { paths, fs: fs18, proc, log } = params;
   if (decided.pool === void 0) {
     return { identityDecision: decided };
   }
@@ -69146,7 +69277,7 @@ function pickFromPool(decided, params, parsedArgv) {
     selectedVia: decided.source,
     pools: params.pools,
     paths,
-    fs: fs17,
+    fs: fs18,
     usageFs: farmRuntime.fs,
     cwd: farmRuntime.cwd,
     now: farmRuntime.now,
@@ -69162,7 +69293,7 @@ function pickFromPool(decided, params, parsedArgv) {
   return { identityDecision: { ...decided, name: resolution.identity }, poolExplanation: resolution.explanation };
 }
 function runLauncher(params) {
-  const { paths, fs: fs17, spawn: spawn3, proc, log } = params;
+  const { paths, fs: fs18, spawn: spawn3, proc, log } = params;
   const { env, argv } = proc;
   const parsedArgv = parseLauncherArgv(argv);
   const cliOverride = buildCliOverride({
@@ -69177,7 +69308,7 @@ function runLauncher(params) {
     argv0Identity: parsedArgv.identity,
     directoryPinnedIdentity: params.directoryPinnedIdentity,
     readActiveIdentityFile: () => {
-      const raw = fs17.readFileUtf8(paths.activeIdentityFile);
+      const raw = fs18.readFileUtf8(paths.activeIdentityFile);
       if (raw === void 0) {
         return void 0;
       }
@@ -69212,7 +69343,7 @@ function runLauncher(params) {
   }
   let loadedIdentity;
   if (identityDecision.name !== void 0) {
-    loadedIdentity = loadIdentity(paths.identitiesDir, identityDecision.name, fs17);
+    loadedIdentity = loadIdentity(paths.identitiesDir, identityDecision.name, fs18);
     if (loadedIdentity === void 0) {
       log.error(
         `agent-shim: no identity named "${identityDecision.name}" (selected via ${identityDecision.source}). Run \`agent-shim identity add ${identityDecision.name}\` first.`
@@ -69227,7 +69358,7 @@ function runLauncher(params) {
     identityDefaultConfigProfile: loadedIdentity?.config.defaultConfigProfile,
     globalDefaultConfigProfile: params.globalDefaultConfigProfile
   });
-  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs17.readConfigFile(import_node_path34.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
+  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs18.readConfigFile(import_node_path35.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
     log.error(
       `agent-shim: no configuration profile named "${configProfileDecision.name}" (selected via ${configProfileDecision.source}). Run \`agent-shim profile add ${configProfileDecision.name}\` first.`
     );
@@ -69236,7 +69367,7 @@ function runLauncher(params) {
   const farmContext = farm !== void 0 && farmIdentity !== void 0 ? { farm, identity: farmIdentity, cascade: farm.loadCascade(configProfileDecision.name, cliOverride) } : void 0;
   const provider = parsedArgv.provider === false ? void 0 : resolveProvider({
     paths,
-    port: fs17,
+    port: fs18,
     env,
     ...params.credentials === void 0 ? {} : { credentials: params.credentials },
     ...parsedArgv.provider === void 0 ? {} : { cliProvider: parsedArgv.provider },
@@ -69520,7 +69651,7 @@ async function runClaude(argvOverride) {
 // src/cli.ts
 async function main() {
   aliasLegacyEnv(process.env);
-  const invokedName = import_node_path35.default.basename(process.argv[1] ?? "agent-shim");
+  const invokedName = import_node_path36.default.basename(process.argv[1] ?? "agent-shim");
   if (isInvokedAsClaude(invokedName)) {
     await runClaude();
     return;