agent-shim 7.7.0 → 7.9.0

package/dist/index.cjs

@@ -42,6 +42,9 @@ __export(index_exports, {
   CredentialCacheSchema: () => CredentialCacheSchema,
   CredentialSchema: () => CredentialSchema,
   CredentialSourceSchema: () => CredentialSourceSchema,
+  DirectoryRuleAlreadyExistsError: () => DirectoryRuleAlreadyExistsError,
+  DirectoryRuleMissingTargetError: () => DirectoryRuleMissingTargetError,
+  DirectoryRuleNotFoundError: () => DirectoryRuleNotFoundError,
   DirectoryRuleSchema: () => DirectoryRuleSchema,
   DirectoryRulesSchema: () => DirectoryRulesSchema,
   EXIT_FAILURE: () => EXIT_FAILURE,
@@ -51,56 +54,168 @@ __export(index_exports, {
   FrontDoorStartError: () => FrontDoorStartError,
   GlobalConfigSchema: () => GlobalConfigSchema,
   HeadroomStartError: () => HeadroomStartError,
+  IdentityAlreadyExistsError: () => IdentityAlreadyExistsError,
+  IdentityNotFoundError: () => IdentityNotFoundError,
   IdentitySchema: () => IdentitySchema,
+  InvalidCategoryNameError: () => InvalidCategoryNameError,
+  InvalidIdentityNameError: () => InvalidIdentityNameError,
+  InvalidProviderNameError: () => InvalidProviderNameError,
+  LegacyProviderFileError: () => LegacyProviderFileError,
   PoolNameSchema: () => PoolNameSchema,
+  PoolNotFoundError: () => PoolNotFoundError,
   PoolSchema: () => PoolSchema,
   PortableConfigSchema: () => PortableConfigSchema,
+  ProfileAlreadyExistsError: () => ProfileAlreadyExistsError,
+  ProfileNotFoundError: () => ProfileNotFoundError,
+  ProviderAlreadyExistsError: () => ProviderAlreadyExistsError,
+  ProviderKindMismatchError: () => ProviderKindMismatchError,
+  ProviderNotFoundError: () => ProviderNotFoundError,
   ProviderSchema: () => ProviderSchema,
   ROUTED_PATH_PREFIX: () => ROUTED_PATH_PREFIX,
   UsageError: () => UsageError,
   UsageSnapshotError: () => UsageSnapshotError,
   UsageSnapshotSchema: () => UsageSnapshotSchema,
   WhenSchema: () => WhenSchema,
+  addDirectoryRule: () => addDirectoryRule,
+  addIdentity: () => addIdentity,
+  addPool: () => addPool,
+  addProvider: () => addProvider,
   buildEntryFacts: () => buildEntryFacts,
   buildLayoutPaths: () => buildLayoutPaths,
   carryOver: () => carryOver,
+  checkReportHasWarnings: () => checkReportHasWarnings,
+  checkReportToJson: () => checkReportToJson,
+  collectCheckReport: () => collectCheckReport,
+  collectDoctorReport: () => collectDoctorReport,
   createLeafCache: () => createLeafCache,
+  createProfile: () => createProfile,
+  describeProviderEndpoint: () => describeProviderEndpoint,
   detectAmbientCredential: () => detectAmbientCredential,
   ensureCa: () => ensureCa,
   ensureFrontDoor: () => ensureFrontDoor,
   ensureHeadroom: () => ensureHeadroom,
   evaluateAmbientCredentialGuard: () => evaluateAmbientCredentialGuard,
   formatAmbientCredentialGuardMessage: () => formatAmbientCredentialGuardMessage,
+  formatCheckReport: () => formatCheckReport,
+  formatDoctorReport: () => formatDoctorReport,
   forwardableHeaders: () => forwardableHeaders,
   generateCa: () => generateCa,
+  identityExists: () => identityExists,
+  isIdentityDirectoryName: () => isIdentityDirectoryName,
   isInterceptedHost: () => isInterceptedHost,
+  listDirectoryRules: () => listDirectoryRules,
+  listIdentities: () => listIdentities,
+  listProfiles: () => listProfiles,
+  listProviders: () => listProviders,
   listUsageSnapshots: () => listUsageSnapshots,
   mintLeaf: () => mintLeaf,
   parseConnectTarget: () => parseConnectTarget,
+  profileExists: () => profileExists,
+  providerExists: () => providerExists,
+  readActiveIdentity: () => readActiveIdentity,
+  readDirectoryRules: () => readDirectoryRules,
   readFarmManifest: () => readFarmManifest,
+  readGlobalConfig: () => readGlobalConfig,
+  readIdentity: () => readIdentity,
+  readPools: () => readPools,
+  readProfile: () => readProfile,
+  readProvider: () => readProvider,
   readUsageSnapshot: () => readUsageSnapshot,
   realConnectCertStore: () => realConnectCertStore,
   realConnectEffects: () => realConnectEffects,
   recoverFarm: () => recoverFarm,
   recoveryDiagnostics: () => recoveryDiagnostics,
+  removeDirectoryRule: () => removeDirectoryRule,
+  removeIdentity: () => removeIdentity,
+  removePool: () => removePool,
+  removeProfile: () => removeProfile,
+  removeProvider: () => removeProvider,
+  requirePool: () => requirePool,
   resolveAgentShimHome: () => resolveAgentShimHome,
   resolveClaudeHome: () => resolveClaudeHome,
   resolveDecisions: () => resolveDecisions,
   resolveLayoutPaths: () => resolveLayoutPaths,
   resolveSupervisorConfig: () => resolveSupervisorConfig,
   resyncFarm: () => resyncFarm,
+  runCheck: () => runCheck,
+  runDoctor: () => runDoctor,
   runFrontDoorSupervisor: () => runFrontDoorSupervisor,
   runSupervisor: () => runSupervisor,
   servedByPipeline: () => servedByPipeline,
+  setAllowAmbientCredential: () => setAllowAmbientCredential,
+  setDefaultConfigProfile: () => setDefaultConfigProfile,
+  setGlobalDefaultProfile: () => setGlobalDefaultProfile,
+  setIdentityCredential: () => setIdentityCredential,
+  setPool: () => setPool,
+  setProfileCategories: () => setProfileCategories,
+  setProfileEntries: () => setProfileEntries,
+  setProfileLaunchFlags: () => setProfileLaunchFlags,
+  setProfileMetadata: () => setProfileMetadata,
   snapshotPath: () => snapshotPath,
   startConnectServer: () => startConnectServer,
-  topLevelNames: () => topLevelNames
+  topLevelNames: () => topLevelNames,
+  updateDirectoryRule: () => updateDirectoryRule,
+  updateProvider: () => updateProvider,
+  useIdentity: () => useIdentity,
+  writeDirectoryRules: () => writeDirectoryRules
 });
 module.exports = __toCommonJS(index_exports);
 
 // src/config/classify.ts
 var import_picomatch = __toESM(require("picomatch"), 1);
 
+// src/config/categories.default.json
+var categories_default_default = {
+  secret: [".credentials.json", "backups", "settings.json.bak*"],
+  runtime: [
+    "daemon*",
+    ".git*",
+    ".DS_Store",
+    "mcp-needs-auth-cache.json",
+    "codex-quota.json",
+    "file-transfers",
+    "shell-snapshots",
+    "statsig",
+    "telemetry",
+    "stats-cache.json",
+    "usage-data",
+    "ide",
+    "cache",
+    "scheduled_tasks.lock"
+  ],
+  history: [
+    "projects",
+    "sessions",
+    "session-env",
+    "teams",
+    "tasks",
+    "todos",
+    "history.jsonl",
+    "transcripts",
+    "paste-cache",
+    "file-history",
+    "plans",
+    "workflows",
+    "jobs",
+    "debug",
+    "downloads",
+    "chrome"
+  ],
+  knowledge: [
+    "skills",
+    "agents",
+    "rules",
+    "memory",
+    "commands",
+    "plugins",
+    "hooks",
+    "AGENTS.md",
+    "CLAUDE.md",
+    "README.md"
+  ],
+  settings: ["settings.json", "settings.local.json"]
+};
+
 // src/config/schema.ts
 var import_node_path = __toESM(require("node:path"), 1);
 var import_zod = require("zod");
@@ -343,6 +458,11 @@ var SHIPPED_CATEGORY_DEFAULTS = Object.freeze({
   settings: true
 });
 
+// src/config/store.ts
+var import_node_fs = __toESM(require("node:fs"), 1);
+var import_node_path2 = __toESM(require("node:path"), 1);
+var import_node_crypto = require("node:crypto");
+
 // src/config/load.ts
 var import_cosmiconfig = require("cosmiconfig");
 
@@ -361,6 +481,158 @@ var UsageError = class extends CliError {
   }
 };
 
+// src/config/load.ts
+function createExplorer(moduleName = "agent-shim") {
+  return (0, import_cosmiconfig.cosmiconfigSync)(moduleName, { searchPlaces: [] });
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function captureEntryOrder(value) {
+  if (!isRecord(value)) {
+    return [];
+  }
+  const entries = value.entries;
+  if (!isRecord(entries)) {
+    return [];
+  }
+  return Object.keys(entries);
+}
+function captureRuleEntryOrders(value) {
+  if (!isRecord(value)) {
+    return [];
+  }
+  const rules = value.rules;
+  if (!Array.isArray(rules)) {
+    return [];
+  }
+  return rules.map((rule) => captureEntryOrder(rule));
+}
+var ConfigValidationError = class extends CliError {
+  constructor(filepath, issues) {
+    const detail = issues.map((issue) => `  ${issue.path.join(".") || "(root)"}: ${issue.message}`).join("\n");
+    super(`Invalid configuration in ${filepath}:
+${detail}`);
+    this.filepath = filepath;
+    this.issues = issues;
+    this.name = "ConfigValidationError";
+  }
+  filepath;
+  issues;
+};
+function cosmiconfigReader(explorer = createExplorer()) {
+  return (filepath) => {
+    let result;
+    try {
+      result = explorer.load(filepath);
+    } catch (error) {
+      const code = isRecord(error) ? error.code : void 0;
+      if (code === "ENOENT") {
+        return void 0;
+      }
+      throw error;
+    }
+    if (result === null || result.isEmpty === true) {
+      return void 0;
+    }
+    return result.config;
+  };
+}
+function loadConfigFile(filepath, schema, read = cosmiconfigReader()) {
+  const raw = read(filepath);
+  if (raw === void 0) {
+    return void 0;
+  }
+  const parsed = schema.safeParse(raw);
+  if (!parsed.success) {
+    throw new ConfigValidationError(filepath, parsed.error.issues);
+  }
+  return {
+    filepath,
+    config: parsed.data,
+    entryOrder: captureEntryOrder(raw),
+    ruleEntryOrders: captureRuleEntryOrders(raw)
+  };
+}
+
+// src/config/store.ts
+function isEnoent(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+var nodeStoreFs = {
+  readFileUtf8(filePath) {
+    try {
+      return import_node_fs.default.readFileSync(filePath, "utf8");
+    } catch (error) {
+      if (isEnoent(error)) {
+        return void 0;
+      }
+      throw error;
+    }
+  },
+  writeFileUtf8(filePath, contents) {
+    import_node_fs.default.writeFileSync(filePath, contents, "utf8");
+  },
+  renameSync(from, to) {
+    import_node_fs.default.renameSync(from, to);
+  },
+  mkdirSync(dirPath) {
+    import_node_fs.default.mkdirSync(dirPath, { recursive: true });
+  },
+  unlinkSync(filePath) {
+    try {
+      import_node_fs.default.unlinkSync(filePath);
+    } catch (error) {
+      if (!isEnoent(error)) {
+        throw error;
+      }
+    }
+  }
+};
+function readJson(filePath, schema, storeFs = nodeStoreFs) {
+  const raw = storeFs.readFileUtf8(filePath);
+  if (raw === void 0) {
+    return void 0;
+  }
+  const parsed = JSON.parse(raw);
+  const result = schema.safeParse(parsed);
+  if (!result.success) {
+    throw new ConfigValidationError(filePath, result.error.issues);
+  }
+  return result.data;
+}
+function writeTextAtomic(filePath, contents, storeFs = nodeStoreFs) {
+  const dir = import_node_path2.default.dirname(filePath);
+  storeFs.mkdirSync(dir);
+  const tempPath = import_node_path2.default.join(dir, `.${import_node_path2.default.basename(filePath)}.${String(process.pid)}.${(0, import_node_crypto.randomUUID)()}.tmp`);
+  storeFs.writeFileUtf8(tempPath, contents);
+  try {
+    storeFs.renameSync(tempPath, filePath);
+  } catch (error) {
+    storeFs.unlinkSync(tempPath);
+    throw error;
+  }
+}
+function writeJsonAtomic(filePath, data, storeFs = nodeStoreFs) {
+  writeTextAtomic(filePath, `${JSON.stringify(data, null, 2)}
+`, storeFs);
+}
+function applyPatch(filePath, schema, patch, options = {}) {
+  const storeFs = options.storeFs ?? nodeStoreFs;
+  const existing = readJson(filePath, schema, storeFs) ?? options.defaults;
+  if (existing === void 0) {
+    throw new Error(`Cannot patch ${filePath}: it does not exist yet and no defaults were provided.`);
+  }
+  const merged = { ...existing, ...patch };
+  const result = schema.safeParse(merged);
+  if (!result.success) {
+    throw new ConfigValidationError(filePath, result.error.issues);
+  }
+  const validated = result.data;
+  writeJsonAtomic(filePath, validated, storeFs);
+  return validated;
+}
+
 // src/config/classify.ts
 var GLOB_METACHARACTERS = /[*?[\]{}!()]/;
 function isExactPattern(pattern) {
@@ -409,6 +681,13 @@ function compareClassificationPatterns(a, b) {
   }
   return a.ordinal - b.ordinal;
 }
+function loadClassification(paths) {
+  const overlay = readJson(paths.categoriesLocalFile, CategoryClassificationOverlaySchema);
+  return {
+    defaults: CategoryClassificationSchema.parse(categories_default_default),
+    ...overlay === void 0 ? {} : { overlay }
+  };
+}
 function classifyEntries(names, options) {
   const patterns = compileClassificationPatterns(options.defaults, options.overlay);
   const classification = /* @__PURE__ */ new Map();
@@ -520,6 +799,7 @@ var import_picomatch3 = __toESM(require("picomatch"), 1);
 
 // src/resolve/projects.ts
 var NON_ALPHANUMERIC = /[^A-Za-z0-9]/g;
+var NON_ALPHANUMERIC_CHARACTER = /[^A-Za-z0-9]/;
 var WILDCARD_TOKENS = ["**", "*", "?"];
 function encodeProjectPath(realPath) {
   return realPath.replace(NON_ALPHANUMERIC, "-");
@@ -573,6 +853,64 @@ function encodeProjectPattern(fragment, options) {
   }
   return splitOnWildcards(expanded).map((piece) => piece.kind === "literal" ? encodeProjectPath(piece.text) : piece.text).join("");
 }
+function lossyCharacters(literal) {
+  const found = /* @__PURE__ */ new Set();
+  for (const character of literal) {
+    if (character !== "/" && NON_ALPHANUMERIC_CHARACTER.test(character)) {
+      found.add(character);
+    }
+  }
+  return [...found];
+}
+function detectEncodingAmbiguity(fragments, options) {
+  const ambiguities = [];
+  const encodedByFragment = /* @__PURE__ */ new Map();
+  for (const fragment of fragments) {
+    let encoded;
+    try {
+      encoded = encodeProjectPattern(fragment, { home: options.home });
+    } catch {
+      continue;
+    }
+    encodedByFragment.set(fragment, encoded);
+    const expanded = expandHome(fragment, options.home);
+    const literalText = splitOnWildcards(expanded).filter((piece) => piece.kind === "literal").map((piece) => piece.text).join("");
+    const lossy = lossyCharacters(literalText);
+    if (lossy.length > 0) {
+      const matched = options.existingNames?.filter((name) => name === encoded).length;
+      const suffix = matched === void 0 ? "" : ` It currently matches ${String(matched)} existing project directory name(s).`;
+      ambiguities.push({
+        fragment,
+        encoded,
+        reason: "lossy-characters",
+        detail: `The literal portion contains ${lossy.map((character) => JSON.stringify(character)).join(", ")}, which the encoding collapses to "-" exactly as it collapses "/". A different real path differing only in those characters would encode to the same name.${suffix}`
+      });
+    }
+  }
+  const byEncoded = /* @__PURE__ */ new Map();
+  for (const [fragment, encoded] of encodedByFragment) {
+    const group = byEncoded.get(encoded);
+    if (group === void 0) {
+      byEncoded.set(encoded, [fragment]);
+    } else {
+      group.push(fragment);
+    }
+  }
+  for (const [encoded, group] of byEncoded) {
+    if (group.length < 2) {
+      continue;
+    }
+    for (const fragment of group) {
+      ambiguities.push({
+        fragment,
+        encoded,
+        reason: "collides-with-sibling-pattern",
+        detail: `Encodes identically to ${group.filter((other) => other !== fragment).map((other) => JSON.stringify(other)).join(", ")}.`
+      });
+    }
+  }
+  return ambiguities;
+}
 
 // src/resolve/match.ts
 var GLOB_METACHARACTERS2 = /[*?[\]{}!()]/;
@@ -952,7 +1290,7 @@ function dedupeDiagnostics(diagnostics) {
 }
 
 // src/resolve/plan.ts
-var import_node_path2 = __toESM(require("node:path"), 1);
+var import_node_path3 = __toESM(require("node:path"), 1);
 function parentOf(rel) {
   const index = rel.lastIndexOf("/");
   return index === -1 ? "" : rel.slice(0, index);
@@ -1002,7 +1340,7 @@ function planFarm(params) {
     }
     return value;
   };
-  const linkTarget = (rel) => import_node_path2.default.join(params.facts.claudeHome, rel);
+  const linkTarget = (rel) => import_node_path3.default.join(params.facts.claudeHome, rel);
   const visit = (rel) => {
     const fact = params.facts.entries.get(rel);
     const decision = params.decisions.get(rel);
@@ -1048,6 +1386,9 @@ function planFarm(params) {
   return { entries, materialised, links };
 }
 
+// src/resolve/walk.ts
+var import_node_path4 = __toESM(require("node:path"), 1);
+
 // src/resolve/extends.ts
 function lineariseProfile(rootName, load) {
   const stack = [];
@@ -1113,6 +1454,27 @@ function profileLayers(rootName, load, startId) {
 }
 
 // src/resolve/walk.ts
+function walkDirectoryAncestors(cwd, options) {
+  const limit = import_node_path4.default.resolve(options.limit ?? options.home);
+  const isReadable = options.isReadable ?? (() => true);
+  const collected = [];
+  let current = import_node_path4.default.resolve(cwd);
+  for (; ; ) {
+    if (!isReadable(current)) {
+      break;
+    }
+    collected.push(current);
+    if (current === limit) {
+      break;
+    }
+    const parent = import_node_path4.default.dirname(current);
+    if (parent === current) {
+      break;
+    }
+    current = parent;
+  }
+  return collected.reverse();
+}
 function assembleCascade(input) {
   const layers = [];
   const diagnostics = [];
@@ -1226,7 +1588,7 @@ function resolveDecisions(input) {
 }
 
 // src/launcher/farm.ts
-var import_node_path4 = __toESM(require("node:path"), 1);
+var import_node_path6 = __toESM(require("node:path"), 1);
 var import_zod2 = require("zod");
 
 // src/resolve/reconcile.ts
@@ -1320,13 +1682,17 @@ function planReconciliation(params) {
 }
 
 // src/legacy.ts
+var ENV_PREFIX = "AGENT_SHIM_";
+var LEGACY_ENV_PREFIX = "CLAUDE_USE_";
 var HOME_DIRNAME = ".agent-shim";
 var LEGACY_HOME_DIRNAME = ".claude-use";
+var LEGACY_PORTABLE_CONFIG_FILENAME = ".claude-use.json";
+var LEGACY_PORTABLE_LOCAL_CONFIG_FILENAME = ".claude-use.local.json";
 var LEGACY_FARM_MANIFEST_FILENAME = ".claude-use-farm.json";
 
 // src/launcher/lock.ts
-var import_node_crypto = require("node:crypto");
-var import_node_path3 = __toESM(require("node:path"), 1);
+var import_node_crypto2 = require("node:crypto");
+var import_node_path5 = __toESM(require("node:path"), 1);
 var DEFAULT_STALE_AFTER_MS = 12e4;
 var DEFAULT_RETRY_DELAY_MS = 50;
 var DEFAULT_MAX_ATTEMPTS = 200;
@@ -1345,7 +1711,7 @@ var IdentityLockBusyError = class extends CliError {
   holderPid;
 };
 function identityLockPath(dir, identity) {
-  return import_node_path3.default.join(dir, `.${identity}.lock`);
+  return import_node_path5.default.join(dir, `.${identity}.lock`);
 }
 function parseLockRecord(raw) {
   if (raw === void 0) {
@@ -1374,7 +1740,7 @@ function acquireIdentityLock(params) {
   const staleAfterMs = params.staleAfterMs ?? DEFAULT_STALE_AFTER_MS;
   const retryDelayMs = params.retryDelayMs ?? DEFAULT_RETRY_DELAY_MS;
   const maxAttempts = params.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
-  const token = (0, import_node_crypto.randomUUID)();
+  const token = (0, import_node_crypto2.randomUUID)();
   if (params.fs.lstat(params.dir) === void 0) {
     params.fs.mkdirp(params.dir);
   }
@@ -1423,8 +1789,8 @@ var FarmManifestSchema = import_zod2.z.strictObject({
   materialised: import_zod2.z.array(import_zod2.z.string()),
   links: import_zod2.z.array(import_zod2.z.strictObject({ rel: import_zod2.z.string(), target: import_zod2.z.string() }))
 });
-function readFarmManifest(fs3, farmRoot) {
-  const raw = fs3.readFileUtf8(import_node_path4.default.join(farmRoot, FARM_MANIFEST_FILENAME)) ?? fs3.readFileUtf8(import_node_path4.default.join(farmRoot, LEGACY_FARM_MANIFEST_FILENAME));
+function readFarmManifest(fs10, farmRoot) {
+  const raw = fs10.readFileUtf8(import_node_path6.default.join(farmRoot, FARM_MANIFEST_FILENAME)) ?? fs10.readFileUtf8(import_node_path6.default.join(farmRoot, LEGACY_FARM_MANIFEST_FILENAME));
   if (raw === void 0) {
     return void 0;
   }
@@ -1440,7 +1806,7 @@ function readFarmManifest(fs3, farmRoot) {
 function buildEntryFacts(params) {
   const entries = /* @__PURE__ */ new Map();
   const visit = (rel) => {
-    const absolute = import_node_path4.default.join(params.claudeHome, rel);
+    const absolute = import_node_path6.default.join(params.claudeHome, rel);
     const stat = params.fs.lstat(absolute);
     if (stat === void 0) {
       return void 0;
@@ -1482,9 +1848,9 @@ function buildEntryFacts(params) {
     entries
   };
 }
-function listSubtree(fs3, root, rel) {
-  const absolute = import_node_path4.default.join(root, rel);
-  const stat = fs3.lstat(absolute);
+function listSubtree(fs10, root, rel) {
+  const absolute = import_node_path6.default.join(root, rel);
+  const stat = fs10.lstat(absolute);
   if (stat === void 0) {
     return [];
   }
@@ -1492,10 +1858,10 @@ function listSubtree(fs3, root, rel) {
     return [{ rel, kind: "symlink" }];
   }
   if (stat.kind === "dir") {
-    const children = [...fs3.readdir(absolute)].sort().flatMap((name) => listSubtree(fs3, root, `${rel}/${name}`));
+    const children = [...fs10.readdir(absolute)].sort().flatMap((name) => listSubtree(fs10, root, `${rel}/${name}`));
     return [{ rel, kind: "dir" }, ...children];
   }
-  const contentHash = fs3.hashFile(absolute);
+  const contentHash = fs10.hashFile(absolute);
   return [{ rel, kind: "file", ...contentHash === void 0 ? {} : { contentHash } }];
 }
 function topLevelScopeRoots(roots) {
@@ -1509,25 +1875,25 @@ function topLevelScopeRoots(roots) {
   }
   return kept;
 }
-function reconciliationScope(fs3, farmRoot, manifest) {
+function reconciliationScope(fs10, farmRoot, manifest) {
   if (manifest !== void 0) {
     return topLevelScopeRoots(manifest.materialised);
   }
-  return [...fs3.readdir(farmRoot)].filter((name) => name !== FARM_MANIFEST_FILENAME && name !== LEGACY_FARM_MANIFEST_FILENAME && fs3.lstat(import_node_path4.default.join(farmRoot, name))?.kind === "dir").sort();
+  return [...fs10.readdir(farmRoot)].filter((name) => name !== FARM_MANIFEST_FILENAME && name !== LEGACY_FARM_MANIFEST_FILENAME && fs10.lstat(import_node_path6.default.join(farmRoot, name))?.kind === "dir").sort();
 }
-function collectFarmListing(fs3, farmRoot, scopeRoots) {
-  return scopeRoots.flatMap((root) => listSubtree(fs3, farmRoot, root));
+function collectFarmListing(fs10, farmRoot, scopeRoots) {
+  return scopeRoots.flatMap((root) => listSubtree(fs10, farmRoot, root));
 }
-function collectCanonicalCounterparts(fs3, claudeHome, farmListing) {
+function collectCanonicalCounterparts(fs10, claudeHome, farmListing) {
   const out = [];
   for (const entry of farmListing) {
-    const absolute = import_node_path4.default.join(claudeHome, entry.rel);
-    const stat = fs3.lstat(absolute);
+    const absolute = import_node_path6.default.join(claudeHome, entry.rel);
+    const stat = fs10.lstat(absolute);
     if (stat === void 0) {
       continue;
     }
     if (stat.kind === "file") {
-      const contentHash = fs3.hashFile(absolute);
+      const contentHash = fs10.hashFile(absolute);
       out.push({ rel: entry.rel, kind: "file", ...contentHash === void 0 ? {} : { contentHash } });
       continue;
     }
@@ -1551,21 +1917,21 @@ function carryOver(params) {
     if (accounted.has(name)) {
       continue;
     }
-    const stat = params.fs.lstat(import_node_path4.default.join(params.previousRoot, name));
+    const stat = params.fs.lstat(import_node_path6.default.join(params.previousRoot, name));
     if (stat === void 0 || stat.kind === "symlink") {
       continue;
     }
-    if (params.fs.lstat(import_node_path4.default.join(params.farmRoot, name)) !== void 0) {
+    if (params.fs.lstat(import_node_path6.default.join(params.farmRoot, name)) !== void 0) {
       const category = params.classification === void 0 ? void 0 : classifyEntries([name], params.classification).classification.get(name);
       if (category === "runtime") {
-        params.fs.removeRecursive(import_node_path4.default.join(params.previousRoot, name));
+        params.fs.removeRecursive(import_node_path6.default.join(params.previousRoot, name));
         autoResolved.push(name);
         continue;
       }
       collided.push(name);
       continue;
     }
-    params.fs.rename(import_node_path4.default.join(params.previousRoot, name), import_node_path4.default.join(params.farmRoot, name));
+    params.fs.rename(import_node_path6.default.join(params.previousRoot, name), import_node_path6.default.join(params.farmRoot, name));
     carried.push(name);
   }
   return { carried, autoResolved, collided };
@@ -1573,9 +1939,9 @@ function carryOver(params) {
 function buildScratchTree(params) {
   params.fs.mkdirp(params.scratchRoot);
   for (const entry of params.plan.entries) {
-    const absolute = import_node_path4.default.join(params.scratchRoot, entry.rel);
+    const absolute = import_node_path6.default.join(params.scratchRoot, entry.rel);
     if (entry.kind === "link") {
-      params.fs.mkdirp(import_node_path4.default.dirname(absolute));
+      params.fs.mkdirp(import_node_path6.default.dirname(absolute));
       params.fs.symlink(entry.target, absolute);
       continue;
     }
@@ -1584,14 +1950,14 @@ function buildScratchTree(params) {
     }
   }
   params.fs.writeFileUtf8(
-    import_node_path4.default.join(params.scratchRoot, FARM_MANIFEST_FILENAME),
+    import_node_path6.default.join(params.scratchRoot, FARM_MANIFEST_FILENAME),
     `${JSON.stringify(params.manifest, null, 2)}
 `
   );
 }
 function swapIn(params) {
   if (params.fs.lstat(params.farmRoot) === void 0) {
-    params.fs.mkdirp(import_node_path4.default.dirname(params.farmRoot));
+    params.fs.mkdirp(import_node_path6.default.dirname(params.farmRoot));
     params.fs.rename(params.scratchRoot, params.farmRoot);
     return { carried: [], autoResolved: [], collided: [] };
   }
@@ -1615,14 +1981,14 @@ function recoverInterruptedSwap(params) {
   const names = [...params.fs.readdir(params.identitiesDir)].sort();
   const removedScratch = [];
   for (const name of names.filter((candidate) => candidate.startsWith(scratchPrefix))) {
-    params.fs.removeRecursive(import_node_path4.default.join(params.identitiesDir, name));
+    params.fs.removeRecursive(import_node_path6.default.join(params.identitiesDir, name));
     removedScratch.push(name);
   }
   let previous = names.filter((candidate) => candidate.startsWith(previousPrefix));
   let restoredFrom;
   const first = previous[0];
   if (first !== void 0 && params.fs.lstat(params.farmRoot) === void 0) {
-    params.fs.rename(import_node_path4.default.join(params.identitiesDir, first), params.farmRoot);
+    params.fs.rename(import_node_path6.default.join(params.identitiesDir, first), params.farmRoot);
     restoredFrom = first;
     previous = previous.slice(1);
   }
@@ -1630,7 +1996,7 @@ function recoverInterruptedSwap(params) {
   const autoResolved = [];
   const retained = [];
   for (const name of previous) {
-    const previousRoot = import_node_path4.default.join(params.identitiesDir, name);
+    const previousRoot = import_node_path6.default.join(params.identitiesDir, name);
     const result = carryOver({
       fs: params.fs,
       previousRoot,
@@ -1655,7 +2021,7 @@ function recoverInterruptedSwap(params) {
   };
 }
 function recoverFarm(params) {
-  const farmRoot = import_node_path4.default.join(params.identitiesDir, params.identity);
+  const farmRoot = import_node_path6.default.join(params.identitiesDir, params.identity);
   const lock = acquireIdentityLock({
     identity: params.identity,
     dir: params.identitiesDir,
@@ -1714,16 +2080,16 @@ function executeReconciliation(params) {
       });
       continue;
     }
-    const from = import_node_path4.default.join(params.farmRoot, action.rel);
-    const canonical = import_node_path4.default.join(params.claudeHome, action.rel);
+    const from = import_node_path6.default.join(params.farmRoot, action.rel);
+    const canonical = import_node_path6.default.join(params.claudeHome, action.rel);
     if (action.kind === "adopt") {
-      params.fs.mkdirp(import_node_path4.default.dirname(canonical));
+      params.fs.mkdirp(import_node_path6.default.dirname(canonical));
       params.fs.copyRecursive(from, canonical);
       adopted.push(action.rel);
       continue;
     }
     const preserved = `${canonical}.farm-conflict-${String(params.nowMs)}`;
-    params.fs.mkdirp(import_node_path4.default.dirname(canonical));
+    params.fs.mkdirp(import_node_path6.default.dirname(canonical));
     params.fs.copyRecursive(from, preserved);
     conflicts.push(action.rel);
   }
@@ -1748,7 +2114,7 @@ function farmAlreadyMatches(existing, next) {
   return existing.identity === next.identity && existing.claudeHome === next.claudeHome && sameStrings(existing.materialised, next.materialised) && sameLinks(existing.links, next.links);
 }
 function resyncFarm(params) {
-  const farmRoot = import_node_path4.default.join(params.identitiesDir, params.identity);
+  const farmRoot = import_node_path6.default.join(params.identitiesDir, params.identity);
   const lock = acquireIdentityLock({
     identity: params.identity,
     dir: params.identitiesDir,
@@ -1827,8 +2193,8 @@ function resyncFarm(params) {
         diagnostics
       };
     }
-    const scratchRoot = import_node_path4.default.join(params.identitiesDir, `.${params.identity}.scratch.${params.uniqueSuffix}`);
-    const previousRoot = import_node_path4.default.join(params.identitiesDir, `.${params.identity}.previous.${params.uniqueSuffix}`);
+    const scratchRoot = import_node_path6.default.join(params.identitiesDir, `.${params.identity}.scratch.${params.uniqueSuffix}`);
+    const previousRoot = import_node_path6.default.join(params.identitiesDir, `.${params.identity}.previous.${params.uniqueSuffix}`);
     buildScratchTree({ fs: params.fs, scratchRoot, plan: resolved.farm, manifest });
     const swap = swapIn({ fs: params.fs, farmRoot, scratchRoot, previousRoot, classification: params.classification });
     if (swap.retainedPrevious !== void 0) {
@@ -1885,11 +2251,11 @@ function recoveryDiagnostics(recovery, identity) {
 }
 
 // src/frontdoor/connect.ts
-var import_node_crypto3 = require("node:crypto");
-var fs = __toESM(require("node:fs"), 1);
+var import_node_crypto4 = require("node:crypto");
+var fs2 = __toESM(require("node:fs"), 1);
 
 // src/frontdoor/x509.ts
-var import_node_crypto2 = require("node:crypto");
+var import_node_crypto3 = require("node:crypto");
 var import_node_net = __toESM(require("node:net"), 1);
 var TAG_BOOLEAN = 1;
 var TAG_INTEGER = 2;
@@ -2041,7 +2407,7 @@ function ipBytes(address) {
   return bytes;
 }
 function keyIdentifier(publicKey) {
-  return (0, import_node_crypto2.createHash)("sha1").update(publicKey.export({ type: "pkcs1", format: "der" })).digest();
+  return (0, import_node_crypto3.createHash)("sha1").update(publicKey.export({ type: "pkcs1", format: "der" })).digest();
 }
 function readElement(buffer, offset) {
   const tag = buffer[offset];
@@ -2087,7 +2453,7 @@ ${body.join("\n")}
 `;
 }
 function randomSerial() {
-  const bytes = (0, import_node_crypto2.randomBytes)(SERIAL_NUMBER_BYTES);
+  const bytes = (0, import_node_crypto3.randomBytes)(SERIAL_NUMBER_BYTES);
   bytes[0] = (bytes[0] ?? 0) & BASE_128_PAYLOAD_MASK | HIGH_BIT >> 1;
   return bytes;
 }
@@ -2102,7 +2468,7 @@ function assemble(spec) {
     spec.subjectPublicKey.export({ type: "spki", format: "der" }),
     tlv(TAG_EXTENSIONS, sequence(...spec.extensions))
   );
-  const signature = (0, import_node_crypto2.sign)("sha256", tbs, spec.signingKey);
+  const signature = (0, import_node_crypto3.sign)("sha256", tbs, spec.signingKey);
   return sequence(tbs, SIGNATURE_ALGORITHM, wholeBitString(signature));
 }
 function subjectKeyIdentifierExtension(publicKey) {
@@ -2112,7 +2478,7 @@ function basicConstraintsExtension(isCa) {
   return extension(OID_BASIC_CONSTRAINTS, true, sequence(...isCa ? [boolean(true)] : []));
 }
 function rsaKeyPair() {
-  return (0, import_node_crypto2.generateKeyPairSync)("rsa", { modulusLength: RSA_MODULUS_BITS });
+  return (0, import_node_crypto3.generateKeyPairSync)("rsa", { modulusLength: RSA_MODULUS_BITS });
 }
 function keyPem(privateKey) {
   return privateKey.export({ type: "pkcs8", format: "pem" });
@@ -2136,8 +2502,8 @@ function issueLeafCertificate(ca, names, notBefore, notAfter) {
   if (commonName === void 0) {
     throw new Error("a leaf certificate needs at least one name");
   }
-  const caCertificate = new import_node_crypto2.X509Certificate(ca.certPem);
-  const caPrivateKey = (0, import_node_crypto2.createPrivateKey)(ca.keyPem);
+  const caCertificate = new import_node_crypto3.X509Certificate(ca.certPem);
+  const caPrivateKey = (0, import_node_crypto3.createPrivateKey)(ca.keyPem);
   const { publicKey, privateKey } = rsaKeyPair();
   const generalNames = names.map((name) => import_node_net.default.isIP(name) === 0 ? tlv(TAG_GENERAL_NAME_DNS, Buffer.from(name, "ascii")) : tlv(TAG_GENERAL_NAME_IP, ipBytes(name)));
   const der = assemble({
@@ -2232,7 +2598,7 @@ function capabilityFromProxyAuthorization(value) {
 var AUTH_HEADER = "x-agent-shim-auth";
 
 // src/frontdoor/state.ts
-var import_node_path5 = __toESM(require("node:path"), 1);
+var import_node_path7 = __toESM(require("node:path"), 1);
 var import_zod3 = require("zod");
 var FRONT_DOOR_PROTOCOL = 1;
 var FrontDoorSessionSchema = import_zod3.z.strictObject({ pid: import_zod3.z.number().int().positive(), startedAt: import_zod3.z.number(), token: import_zod3.z.string().min(1) });
@@ -2266,10 +2632,10 @@ var FrontDoorStateSchema = import_zod3.z.strictObject({
   /** The last fatal error, kept across shutdowns so `frontdoor status` can explain a front door that is not running. */
   lastError: import_zod3.z.string().optional()
 });
-function readFrontDoorState(fs3, stateFile) {
+function readFrontDoorState(fs10, stateFile) {
   let raw;
   try {
-    raw = fs3.readFileUtf8(stateFile);
+    raw = fs10.readFileUtf8(stateFile);
   } catch {
     return void 0;
   }
@@ -2283,28 +2649,28 @@ function readFrontDoorState(fs3, stateFile) {
     return void 0;
   }
 }
-function writeFrontDoorState(fs3, stateFile, state) {
-  fs3.mkdirp(import_node_path5.default.dirname(stateFile));
-  fs3.writeFileUtf8(stateFile, `${JSON.stringify(state, null, 2)}
+function writeFrontDoorState(fs10, stateFile, state) {
+  fs10.mkdirp(import_node_path7.default.dirname(stateFile));
+  fs10.writeFileUtf8(stateFile, `${JSON.stringify(state, null, 2)}
 `);
 }
 function frontDoorOrigin(state) {
   const port = state?.directPort ?? state?.lastDirectPort;
   return port === void 0 ? void 0 : `http://127.0.0.1:${String(port)}`;
 }
-function writeFrontDoorSession(fs3, sessionsDir, session) {
-  fs3.mkdirPrivate(sessionsDir);
-  fs3.writeFilePrivate(import_node_path5.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
+function writeFrontDoorSession(fs10, sessionsDir, session) {
+  fs10.mkdirPrivate(sessionsDir);
+  fs10.writeFilePrivate(import_node_path7.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
 `);
 }
-function listFrontDoorSessions(fs3, sessionsDir) {
+function listFrontDoorSessions(fs10, sessionsDir) {
   const sessions = [];
-  for (const name of fs3.readdir(sessionsDir)) {
+  for (const name of fs10.readdir(sessionsDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs3.readFileUtf8(import_node_path5.default.join(sessionsDir, name)) ?? ""));
+      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs10.readFileUtf8(import_node_path7.default.join(sessionsDir, name)) ?? ""));
       if (parsed.success) {
         sessions.push({ pid: parsed.data.pid, startedAt: parsed.data.startedAt });
       }
@@ -2314,14 +2680,14 @@ function listFrontDoorSessions(fs3, sessionsDir) {
   }
   return sessions.sort((a, b) => a.pid - b.pid);
 }
-function removeFrontDoorSession(fs3, sessionsDir, pid) {
-  fs3.removeRecursive(import_node_path5.default.join(sessionsDir, `${String(pid)}.json`));
+function removeFrontDoorSession(fs10, sessionsDir, pid) {
+  fs10.removeRecursive(import_node_path7.default.join(sessionsDir, `${String(pid)}.json`));
 }
-function pruneDeadFrontDoorSessions(fs3, sessionsDir, isRunning) {
+function pruneDeadFrontDoorSessions(fs10, sessionsDir, isRunning) {
   const removed = [];
-  for (const session of listFrontDoorSessions(fs3, sessionsDir)) {
+  for (const session of listFrontDoorSessions(fs10, sessionsDir)) {
     if (!isRunning(session.pid)) {
-      removeFrontDoorSession(fs3, sessionsDir, session.pid);
+      removeFrontDoorSession(fs10, sessionsDir, session.pid);
       removed.push(session.pid);
     }
   }
@@ -2333,8 +2699,8 @@ var FRONTDOOR_SUPERVISOR_STILL_RUNNING = -1;
 var FRONTDOOR_POLL_MS = 1e3;
 var MS_PER_MINUTE = 6e4;
 async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {}) {
-  const { fs: fs3, paths } = ports;
-  const previous = readFrontDoorState(fs3, paths.frontdoorStateFile);
+  const { fs: fs10, paths } = ports;
+  const previous = readFrontDoorState(fs10, paths.frontdoorStateFile);
   let lastPort = previous?.lastPort;
   let lastConnectPort = previous?.lastConnectPort;
   let lastDirectPort = previous?.lastDirectPort;
@@ -2344,12 +2710,12 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     ...lastDirectPort === void 0 ? {} : { lastDirectPort }
   });
   const fail = (message) => {
-    writeFrontDoorState(fs3, paths.frontdoorStateFile, { lastError: message, ...sticky() });
-    fs3.removeRecursive(paths.frontdoorLockFile);
+    writeFrontDoorState(fs10, paths.frontdoorStateFile, { lastError: message, ...sticky() });
+    fs10.removeRecursive(paths.frontdoorLockFile);
     ports.log(`agent-shim frontdoor supervisor: ${message}`);
     return 1;
   };
-  writeFrontDoorState(fs3, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, ...sticky() });
+  writeFrontDoorState(fs10, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, ...sticky() });
   const previousSticky = lastPort;
   let http2;
   try {
@@ -2386,8 +2752,8 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     ports.log(`agent-shim frontdoor supervisor: sticky direct port ${String(previousStickyDirect)} was occupied; moving to ${String(direct.port)} (headroom must be restarted to admit the new address)`);
   }
   lastDirectPort = direct.port;
-  writeFrontDoorState(fs3, paths.frontdoorStateFile, { protocol: FRONT_DOOR_PROTOCOL, supervisorPid: ports.ownPid, port: http2.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
-  fs3.removeRecursive(paths.frontdoorLockFile);
+  writeFrontDoorState(fs10, paths.frontdoorStateFile, { protocol: FRONT_DOOR_PROTOCOL, supervisorPid: ports.ownPid, port: http2.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
+  fs10.removeRecursive(paths.frontdoorLockFile);
   ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http2.port)}, CONNECT surface on 127.0.0.1:${String(connect3.port)}`);
   let idleSince;
   let ticks = 0;
@@ -2396,15 +2762,15 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
       return FRONTDOOR_SUPERVISOR_STILL_RUNNING;
     }
     ticks += 1;
-    pruneDeadFrontDoorSessions(fs3, paths.frontdoorSessionsDir, ports.isRunning);
-    if (listFrontDoorSessions(fs3, paths.frontdoorSessionsDir).length === 0) {
+    pruneDeadFrontDoorSessions(fs10, paths.frontdoorSessionsDir, ports.isRunning);
+    if (listFrontDoorSessions(fs10, paths.frontdoorSessionsDir).length === 0) {
       idleSince ??= ports.now();
       if (ports.now() - idleSince >= idleShutdownMinutes * MS_PER_MINUTE) {
         ports.log(`agent-shim frontdoor supervisor: no sessions for ${String(idleShutdownMinutes)} minute(s); closing the front door and exiting`);
         await direct.close();
         await connect3.close();
         await http2.close();
-        writeFrontDoorState(fs3, paths.frontdoorStateFile, sticky());
+        writeFrontDoorState(fs10, paths.frontdoorStateFile, sticky());
         return 0;
       }
     } else {
@@ -2459,8 +2825,8 @@ function parseConnectTarget(authority) {
 function isInterceptedHost(host, interceptHosts) {
   return interceptHosts.includes(host);
 }
-function servedByPipeline(path9) {
-  return path9?.startsWith(ROUTED_PATH_PREFIX) === true;
+function servedByPipeline(path23) {
+  return path23?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
   "connection",
@@ -2519,8 +2885,8 @@ function ensureCa(store, generate) {
 }
 function caParses(ca) {
   try {
-    new import_node_crypto3.X509Certificate(ca.certPem);
-    (0, import_node_crypto3.createPrivateKey)(ca.keyPem);
+    new import_node_crypto4.X509Certificate(ca.certPem);
+    (0, import_node_crypto4.createPrivateKey)(ca.keyPem);
     return true;
   } catch {
     return false;
@@ -2758,15 +3124,15 @@ async function blindTunnel(socket, target, effects) {
     socket.destroy();
   });
 }
-function isEnoent(error) {
+function isEnoent2(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 }
 function realConnectCertStore(paths) {
   const read = (file) => {
     try {
-      return fs.readFileSync(file, "utf8");
+      return fs2.readFileSync(file, "utf8");
     } catch (error) {
-      if (isEnoent(error)) {
+      if (isEnoent2(error)) {
         return void 0;
       }
       throw error;
@@ -2779,10 +3145,10 @@ function realConnectCertStore(paths) {
       return certPem === void 0 || keyPem2 === void 0 ? void 0 : { certPem, keyPem: keyPem2 };
     },
     writeCa: (ca) => {
-      fs.mkdirSync(paths.frontdoorCaDir, { recursive: true });
-      fs.writeFileSync(paths.frontdoorCaCertFile, ca.certPem, "utf8");
-      fs.writeFileSync(paths.frontdoorCaKeyFile, ca.keyPem, { encoding: "utf8", mode: CA_KEY_FILE_MODE });
-      fs.chmodSync(paths.frontdoorCaKeyFile, CA_KEY_FILE_MODE);
+      fs2.mkdirSync(paths.frontdoorCaDir, { recursive: true });
+      fs2.writeFileSync(paths.frontdoorCaCertFile, ca.certPem, "utf8");
+      fs2.writeFileSync(paths.frontdoorCaKeyFile, ca.keyPem, { encoding: "utf8", mode: CA_KEY_FILE_MODE });
+      fs2.chmodSync(paths.frontdoorCaKeyFile, CA_KEY_FILE_MODE);
     }
   };
 }
@@ -2951,11 +3317,11 @@ function realConnectEffects() {
 }
 
 // src/frontdoor/ensure.ts
-var import_node_crypto5 = require("node:crypto");
+var import_node_crypto6 = require("node:crypto");
 
 // src/headroom/state.ts
-var import_node_crypto4 = require("node:crypto");
-var import_node_path6 = __toESM(require("node:path"), 1);
+var import_node_crypto5 = require("node:crypto");
+var import_node_path8 = __toESM(require("node:path"), 1);
 var import_zod4 = require("zod");
 var HEADROOM_ANTHROPIC_UPSTREAM = "https://api.anthropic.com";
 var HeadroomStateSchema = import_zod4.z.strictObject({
@@ -2989,16 +3355,16 @@ function parseJson(raw, schema) {
   const parsed = schema.safeParse(JSON.parse(raw));
   return parsed.success ? parsed.data : void 0;
 }
-function readHeadroomState(fs3, stateFile) {
+function readHeadroomState(fs10, stateFile) {
   try {
-    return parseJson(fs3.readFileUtf8(stateFile), HeadroomStateSchema);
+    return parseJson(fs10.readFileUtf8(stateFile), HeadroomStateSchema);
   } catch {
     return void 0;
   }
 }
-function writeHeadroomState(fs3, stateFile, state) {
-  fs3.mkdirp(import_node_path6.default.dirname(stateFile));
-  fs3.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
+function writeHeadroomState(fs10, stateFile, state) {
+  fs10.mkdirp(import_node_path8.default.dirname(stateFile));
+  fs10.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
 `);
 }
 function headroomAllowlist(providers) {
@@ -3016,16 +3382,16 @@ function headroomUpstreams(providers, frontDoorOrigin2) {
   return upstreams;
 }
 function hashAllowlist(allowlist) {
-  return (0, import_node_crypto4.createHash)("sha256").update(allowlist.join("\n")).digest("hex");
+  return (0, import_node_crypto5.createHash)("sha256").update(allowlist.join("\n")).digest("hex");
 }
-function readAllProviders(fs3, providersDir) {
+function readAllProviders(fs10, providersDir) {
   const result = [];
-  for (const name of fs3.readdir(providersDir)) {
+  for (const name of fs10.readdir(providersDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = parseJson(fs3.readFileUtf8(import_node_path6.default.join(providersDir, name)), ProviderSchema);
+      const parsed = parseJson(fs10.readFileUtf8(import_node_path8.default.join(providersDir, name)), ProviderSchema);
       if (parsed !== void 0) {
         result.push({ name: name.slice(0, -".json".length), provider: parsed });
       }
@@ -3035,22 +3401,22 @@ function readAllProviders(fs3, providersDir) {
   }
   return result;
 }
-function writeSession(fs3, sessionsDir, session) {
-  fs3.mkdirp(sessionsDir);
-  fs3.writeFileUtf8(import_node_path6.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
+function writeSession(fs10, sessionsDir, session) {
+  fs10.mkdirp(sessionsDir);
+  fs10.writeFileUtf8(import_node_path8.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
 `);
 }
-function removeSession(fs3, sessionsDir, pid) {
-  fs3.removeRecursive(import_node_path6.default.join(sessionsDir, `${String(pid)}.json`));
+function removeSession(fs10, sessionsDir, pid) {
+  fs10.removeRecursive(import_node_path8.default.join(sessionsDir, `${String(pid)}.json`));
 }
-function listSessions(fs3, sessionsDir) {
+function listSessions(fs10, sessionsDir) {
   const sessions = [];
-  for (const name of fs3.readdir(sessionsDir)) {
+  for (const name of fs10.readdir(sessionsDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = parseJson(fs3.readFileUtf8(import_node_path6.default.join(sessionsDir, name)), HeadroomSessionSchema);
+      const parsed = parseJson(fs10.readFileUtf8(import_node_path8.default.join(sessionsDir, name)), HeadroomSessionSchema);
       if (parsed !== void 0) {
         sessions.push(parsed);
       }
@@ -3060,22 +3426,22 @@ function listSessions(fs3, sessionsDir) {
   }
   return sessions.sort((a, b) => a.pid - b.pid);
 }
-function sessionsForSupervisor(fs3, sessionsDir, supervisorPid) {
-  return listSessions(fs3, sessionsDir).filter((session) => session.supervisorPid === supervisorPid);
+function sessionsForSupervisor(fs10, sessionsDir, supervisorPid) {
+  return listSessions(fs10, sessionsDir).filter((session) => session.supervisorPid === supervisorPid);
 }
-function pruneDeadSessions(fs3, sessionsDir, isRunning) {
+function pruneDeadSessions(fs10, sessionsDir, isRunning) {
   const removed = [];
-  for (const session of listSessions(fs3, sessionsDir)) {
+  for (const session of listSessions(fs10, sessionsDir)) {
     if (!isRunning(session.pid)) {
-      removeSession(fs3, sessionsDir, session.pid);
+      removeSession(fs10, sessionsDir, session.pid);
       removed.push(session.pid);
     }
   }
   return removed;
 }
-function readStartLock(fs3, lockFile) {
+function readStartLock(fs10, lockFile) {
   try {
-    return parseJson(fs3.readFileUtf8(lockFile), HeadroomLockSchema);
+    return parseJson(fs10.readFileUtf8(lockFile), HeadroomLockSchema);
   } catch {
     return void 0;
   }
@@ -3115,7 +3481,7 @@ function ensureFrontDoor(params) {
           continue;
         }
         if (verdict.ok) {
-          const token = (0, import_node_crypto5.randomUUID)();
+          const token = (0, import_node_crypto6.randomUUID)();
           writeFrontDoorSession(ports.fs, paths.frontdoorSessionsDir, { pid: params.launcherPid, startedAt: ports.now(), token });
           return { port: state.port, connectPort: state.connectPort, token };
         }
@@ -3155,7 +3521,10 @@ function ensureFrontDoor(params) {
 }
 
 // src/usage/read.ts
-var import_node_path7 = __toESM(require("node:path"), 1);
+var import_node_path10 = __toESM(require("node:path"), 1);
+
+// src/usage/account.ts
+var import_node_path9 = __toESM(require("node:path"), 1);
 
 // src/usage/schema.ts
 var import_zod5 = require("zod");
@@ -3305,11 +3674,111 @@ var UsageSnapshotSchema = import_zod5.z.strictObject({
 });
 
 // src/usage/account.ts
+var CLAUDE_JSON = ".claude.json";
+var AccountMetadataError = class extends CliError {
+  constructor(file, detail) {
+    super(`${file}: ${detail}, so its account metadata cannot be read.`);
+    this.file = file;
+    this.name = "AccountMetadataError";
+  }
+  file;
+};
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 function isIdentityName(name) {
   return IdentitySchema.shape.name.safeParse(name).success;
 }
+function claudeJsonPath(identitiesDir, identity) {
+  return import_node_path9.default.join(identitiesDir, identity, CLAUDE_JSON);
+}
+function readAccountMetadata(fs10, identitiesDir, identity) {
+  if (!isIdentityName(identity)) {
+    throw new Error(`"${identity}" is not a valid identity name.`);
+  }
+  const file = claudeJsonPath(identitiesDir, identity);
+  const raw = fs10.readFileUtf8(file);
+  if (raw === void 0) {
+    return void 0;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new AccountMetadataError(file, "not valid JSON");
+  }
+  if (!isObject(parsed)) {
+    throw new AccountMetadataError(file, "not a JSON object");
+  }
+  const oauthAccount = parsed.oauthAccount;
+  if (!isObject(oauthAccount)) {
+    return void 0;
+  }
+  const picked = {};
+  for (const key of Object.keys(AccountMetadataSchema.shape)) {
+    const value = oauthAccount[key];
+    if (value !== null && value !== void 0) {
+      picked[key] = value;
+    }
+  }
+  const account = AccountMetadataSchema.safeParse(picked);
+  if (!account.success) {
+    throw new AccountMetadataError(file, account.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; "));
+  }
+  return account.data;
+}
 
 // src/usage/read.ts
+var SEGMENT_RE = /^(\d{4}-\d{2}-\d{2})\.(\d+)\.jsonl$/;
+var DAY_MS = 864e5;
+function listLogSegments(fs10, logDir) {
+  return fs10.readdir(logDir).flatMap((name) => {
+    const match = SEGMENT_RE.exec(name);
+    const day = match?.[1];
+    if (day === void 0) {
+      return [];
+    }
+    return [{ name, day, endsAt: Date.parse(`${day}T00:00:00.000Z`) + DAY_MS }];
+  }).sort((left, right) => left.day.localeCompare(right.day) || left.name.localeCompare(right.name));
+}
+function readUsageLog(fs10, logDir, options = {}) {
+  const { sinceMs } = options;
+  const records = [];
+  let invalidLines = 0;
+  for (const segment of listLogSegments(fs10, logDir)) {
+    if (sinceMs !== void 0 && segment.endsAt <= sinceMs) {
+      continue;
+    }
+    const contents = fs10.readFileUtf8(import_node_path10.default.join(logDir, segment.name));
+    if (contents === void 0) {
+      continue;
+    }
+    const lines = contents.split("\n");
+    lines.pop();
+    for (const line of lines) {
+      if (line === "") {
+        continue;
+      }
+      let raw;
+      try {
+        raw = JSON.parse(line);
+      } catch {
+        invalidLines += 1;
+        continue;
+      }
+      const parsed = UsageRecordSchema.safeParse(raw);
+      if (!parsed.success) {
+        invalidLines += 1;
+        continue;
+      }
+      if (sinceMs === void 0 || Date.parse(parsed.data.at) >= sinceMs) {
+        records.push(parsed.data);
+      }
+    }
+  }
+  records.sort((left, right) => left.at.localeCompare(right.at));
+  return { records, invalidLines };
+}
 var UsageSnapshotError = class extends Error {
   constructor(file, detail) {
     super(`${file} is not a usage snapshot this agent-shim can read (schema version ${String(USAGE_SCHEMA_VERSION)}): ${detail}`);
@@ -3322,11 +3791,11 @@ function snapshotPath(snapshotsDir, identity) {
   if (!isIdentityName(identity)) {
     throw new Error(`"${identity}" is not a valid identity name.`);
   }
-  return import_node_path7.default.join(snapshotsDir, `${identity}.json`);
+  return import_node_path10.default.join(snapshotsDir, `${identity}.json`);
 }
-function readUsageSnapshot(fs3, snapshotsDir, identity) {
+function readUsageSnapshot(fs10, snapshotsDir, identity) {
   const file = snapshotPath(snapshotsDir, identity);
-  const raw = fs3.readFileUtf8(file);
+  const raw = fs10.readFileUtf8(file);
   if (raw === void 0) {
     return void 0;
   }
@@ -3342,8 +3811,8 @@ function readUsageSnapshot(fs3, snapshotsDir, identity) {
   }
   return snapshot.data;
 }
-function listUsageSnapshots(fs3, snapshotsDir) {
-  return fs3.readdir(snapshotsDir).flatMap((name) => {
+function listUsageSnapshots(fs10, snapshotsDir) {
+  return fs10.readdir(snapshotsDir).flatMap((name) => {
     if (!name.endsWith(".json")) {
       return [];
     }
@@ -3351,7 +3820,7 @@ function listUsageSnapshots(fs3, snapshotsDir) {
     if (!isIdentityName(identity)) {
       return [];
     }
-    const snapshot = readUsageSnapshot(fs3, snapshotsDir, identity);
+    const snapshot = readUsageSnapshot(fs10, snapshotsDir, identity);
     return snapshot === void 0 ? [] : [snapshot];
   }).sort((left, right) => left.identity.localeCompare(right.identity));
 }
@@ -3411,7 +3880,7 @@ function ensureHeadroom(params) {
 }
 
 // src/headroom/settings.ts
-var import_node_crypto6 = require("node:crypto");
+var import_node_crypto7 = require("node:crypto");
 function settingsOf(config) {
   return {
     ...config.mode === void 0 ? {} : { mode: config.mode },
@@ -3436,7 +3905,7 @@ function settingsEnv(settings) {
   return settings.rolloutChannel === void 0 ? {} : { HEADROOM_ROLLOUT_CHANNEL: settings.rolloutChannel };
 }
 function hashSettings(settings) {
-  return (0, import_node_crypto6.createHash)("sha256").update(JSON.stringify([...settingsArgs(settings), JSON.stringify(settingsEnv(settings))])).digest("hex");
+  return (0, import_node_crypto7.createHash)("sha256").update(JSON.stringify([...settingsArgs(settings), JSON.stringify(settingsEnv(settings))])).digest("hex");
 }
 
 // src/headroom/source.ts
@@ -3444,6 +3913,14 @@ var import_zod6 = require("zod");
 var GIT_SPEC_RE = /git\+[^@\s]+(?:@([^\s#]+))?/;
 var COMMIT_SHA_RE = /^[0-9a-f]{40}$/i;
 var DirectUrlSchema = import_zod6.z.object({ vcs_info: import_zod6.z.object({ commit_id: import_zod6.z.string() }) });
+function isMovingGitSource(spec) {
+  const match = GIT_SPEC_RE.exec(spec);
+  if (match === null) {
+    return false;
+  }
+  const ref = match[1];
+  return ref === void 0 || !COMMIT_SHA_RE.test(ref);
+}
 function pinnedGitCommit(spec) {
   const ref = GIT_SPEC_RE.exec(spec)?.[1];
   return ref !== void 0 && COMMIT_SHA_RE.test(ref) ? ref.toLowerCase() : void 0;
@@ -3518,9 +3995,9 @@ function compareVersions(a, b) {
 }
 var HEADROOM_SUPERVISOR_STILL_RUNNING = -1;
 async function runSupervisor(initialConfig, ports, options = {}) {
-  const { fs: fs3, paths } = ports;
+  const { fs: fs10, paths } = ports;
   let config = initialConfig;
-  const previousState = readHeadroomState(fs3, paths.headroomStateFile);
+  const previousState = readHeadroomState(fs10, paths.headroomStateFile);
   if (previousState?.supervisorPid !== void 0 && previousState.supervisorPid !== ports.ownPid && ports.isRunning(previousState.supervisorPid)) {
     ports.log(`agent-shim headroom supervisor ${String(ports.ownPid)}: supervisor ${String(previousState.supervisorPid)} already owns the daemon; exiting`);
     return 0;
@@ -3529,19 +4006,19 @@ async function runSupervisor(initialConfig, ports, options = {}) {
   let lastPort = previousState?.lastPort;
   const sticky = () => lastPort === void 0 ? {} : { lastPort };
   const ownsState = () => {
-    const owner = readHeadroomState(fs3, paths.headroomStateFile)?.supervisorPid;
+    const owner = readHeadroomState(fs10, paths.headroomStateFile)?.supervisorPid;
     return owner === void 0 || owner === ports.ownPid || !ports.isRunning(owner);
   };
   const writeOwnState = (state) => {
     if (!ownsState()) {
       return false;
     }
-    writeHeadroomState(fs3, paths.headroomStateFile, state);
+    writeHeadroomState(fs10, paths.headroomStateFile, state);
     return true;
   };
   const fail = (message) => {
     if (writeOwnState({ lastError: message, ...sticky() })) {
-      fs3.removeRecursive(paths.headroomLockFile);
+      fs10.removeRecursive(paths.headroomLockFile);
     }
     ports.log(`agent-shim headroom supervisor: ${message}`);
     return 1;
@@ -3590,7 +4067,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     const settingsHash = hashSettings(config.settings);
     const allowlist = allowlistOf(ports);
     const allowlistHash = hashAllowlist(allowlist);
-    pruneDeadSessions(fs3, paths.headroomSessionsDir, ports.isRunning);
+    pruneDeadSessions(fs10, paths.headroomSessionsDir, ports.isRunning);
     const ownsNow = ownsState();
     if (!ownsNow && !superseded) {
       ports.log("agent-shim headroom supervisor: another supervisor now owns state.json; serving this daemon's own sessions until they end");
@@ -3642,7 +4119,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
           ...sticky()
         });
         if (recorded) {
-          fs3.removeRecursive(paths.headroomLockFile);
+          fs10.removeRecursive(paths.headroomLockFile);
         }
         idleSince = void 0;
         ports.log(`agent-shim headroom supervisor: headroom pid ${String(pid)} ready on 127.0.0.1:${String(port)}`);
@@ -3657,7 +4134,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
       }
     } else {
       if (runningHash !== allowlistHash || runningSettingsHash !== settingsHash || installedSource !== config.source) {
-        if (sessionsForSupervisor(fs3, paths.headroomSessionsDir, ports.ownPid).length === 0) {
+        if (sessionsForSupervisor(fs10, paths.headroomSessionsDir, ports.ownPid).length === 0) {
           ports.log("agent-shim headroom supervisor: configuration drifted and no sessions are live; restarting headroom");
           ports.stopProcess(headroomPid);
           headroomPid = void 0;
@@ -3666,7 +4143,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
           continue;
         }
       }
-      const sessions = sessionsForSupervisor(fs3, paths.headroomSessionsDir, ports.ownPid);
+      const sessions = sessionsForSupervisor(fs10, paths.headroomSessionsDir, ports.ownPid);
       if (sessions.length === 0) {
         idleSince ??= ports.now();
         const idleMs = ports.now() - idleSince;
@@ -3688,9 +4165,9 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     await ports.sleep(HEADROOM_POLL_MS);
   }
 }
-function currentHeadroomAllowlist(fs3, paths) {
-  const providers = readAllProviders(fs3, paths.providersDir).map((entry) => entry.provider);
-  return headroomAllowlist(headroomUpstreams(providers, frontDoorOrigin(readFrontDoorState(fs3, paths.frontdoorStateFile))));
+function currentHeadroomAllowlist(fs10, paths) {
+  const providers = readAllProviders(fs10, paths.providersDir).map((entry) => entry.provider);
+  return headroomAllowlist(headroomUpstreams(providers, frontDoorOrigin(readFrontDoorState(fs10, paths.frontdoorStateFile))));
 }
 function allowlistOf(ports) {
   return currentHeadroomAllowlist(ports.fs, ports.paths);
@@ -3756,63 +4233,2564 @@ function evaluateAmbientCredentialGuard(params) {
 }
 
 // src/paths.ts
-var import_node_fs = __toESM(require("node:fs"), 1);
+var import_node_fs2 = __toESM(require("node:fs"), 1);
 var import_node_os = __toESM(require("node:os"), 1);
-var import_node_path8 = __toESM(require("node:path"), 1);
+var import_node_path11 = __toESM(require("node:path"), 1);
 function resolveAgentShimHome(env = process.env, home = import_node_os.default.homedir(), isDirectory = isExistingDirectory) {
   const fromEnv = env.AGENT_SHIM_HOME;
   if (fromEnv !== void 0 && fromEnv !== "") {
     return fromEnv;
   }
-  const current = import_node_path8.default.join(home, HOME_DIRNAME);
-  const legacy = import_node_path8.default.join(home, LEGACY_HOME_DIRNAME);
+  const current = import_node_path11.default.join(home, HOME_DIRNAME);
+  const legacy = import_node_path11.default.join(home, LEGACY_HOME_DIRNAME);
   return !isDirectory(current) && isDirectory(legacy) ? legacy : current;
 }
 function isExistingDirectory(candidate) {
-  return import_node_fs.default.statSync(candidate, { throwIfNoEntry: false })?.isDirectory() ?? false;
+  return import_node_fs2.default.statSync(candidate, { throwIfNoEntry: false })?.isDirectory() ?? false;
 }
 function resolveClaudeHome() {
   const fromEnv = process.env.AGENT_SHIM_CLAUDE_HOME;
   if (fromEnv !== void 0 && fromEnv !== "") {
     return fromEnv;
   }
-  return import_node_path8.default.join(import_node_os.default.homedir(), ".claude");
+  return import_node_path11.default.join(import_node_os.default.homedir(), ".claude");
 }
 function buildLayoutPaths(root) {
   return {
     root,
-    identitiesDir: import_node_path8.default.join(root, "identities"),
-    configProfilesDir: import_node_path8.default.join(root, "config-profiles"),
-    providersDir: import_node_path8.default.join(root, "providers"),
-    directoryRulesFile: import_node_path8.default.join(root, "directory-rules.json"),
-    activeIdentityFile: import_node_path8.default.join(root, "active-identity"),
-    globalConfigFile: import_node_path8.default.join(root, "config.json"),
-    categoriesLocalFile: import_node_path8.default.join(root, "categories.local.json"),
-    claudeShimFile: import_node_path8.default.join(root, "claude-shim.json"),
-    headroomDir: import_node_path8.default.join(root, "headroom"),
-    headroomStateFile: import_node_path8.default.join(root, "headroom", "state.json"),
-    headroomLockFile: import_node_path8.default.join(root, "headroom", "start.lock"),
-    headroomSessionsDir: import_node_path8.default.join(root, "headroom", "sessions"),
-    logsDir: import_node_path8.default.join(root, "logs"),
-    headroomLogPath: import_node_path8.default.join(root, "logs", "headroom.log"),
-    frontdoorDir: import_node_path8.default.join(root, "frontdoor"),
-    frontdoorCaDir: import_node_path8.default.join(root, "frontdoor", "ca"),
-    frontdoorCaCertFile: import_node_path8.default.join(root, "frontdoor", "ca", "ca.pem"),
-    frontdoorCaKeyFile: import_node_path8.default.join(root, "frontdoor", "ca", "ca.key"),
-    frontdoorCaBundlesDir: import_node_path8.default.join(root, "frontdoor", "ca", "bundles"),
-    frontdoorStateFile: import_node_path8.default.join(root, "frontdoor", "state.json"),
-    frontdoorLockFile: import_node_path8.default.join(root, "frontdoor", "start.lock"),
-    frontdoorSessionsDir: import_node_path8.default.join(root, "frontdoor", "sessions"),
-    frontdoorLogPath: import_node_path8.default.join(root, "logs", "frontdoor.log"),
-    usageDir: import_node_path8.default.join(root, "usage"),
-    usageLogDir: import_node_path8.default.join(root, "usage", "log"),
-    usageSnapshotsDir: import_node_path8.default.join(root, "usage", "snapshots"),
-    usagePicksFile: import_node_path8.default.join(root, "usage", "picks.json")
+    identitiesDir: import_node_path11.default.join(root, "identities"),
+    configProfilesDir: import_node_path11.default.join(root, "config-profiles"),
+    providersDir: import_node_path11.default.join(root, "providers"),
+    directoryRulesFile: import_node_path11.default.join(root, "directory-rules.json"),
+    activeIdentityFile: import_node_path11.default.join(root, "active-identity"),
+    globalConfigFile: import_node_path11.default.join(root, "config.json"),
+    categoriesLocalFile: import_node_path11.default.join(root, "categories.local.json"),
+    claudeShimFile: import_node_path11.default.join(root, "claude-shim.json"),
+    headroomDir: import_node_path11.default.join(root, "headroom"),
+    headroomStateFile: import_node_path11.default.join(root, "headroom", "state.json"),
+    headroomLockFile: import_node_path11.default.join(root, "headroom", "start.lock"),
+    headroomSessionsDir: import_node_path11.default.join(root, "headroom", "sessions"),
+    logsDir: import_node_path11.default.join(root, "logs"),
+    headroomLogPath: import_node_path11.default.join(root, "logs", "headroom.log"),
+    frontdoorDir: import_node_path11.default.join(root, "frontdoor"),
+    frontdoorCaDir: import_node_path11.default.join(root, "frontdoor", "ca"),
+    frontdoorCaCertFile: import_node_path11.default.join(root, "frontdoor", "ca", "ca.pem"),
+    frontdoorCaKeyFile: import_node_path11.default.join(root, "frontdoor", "ca", "ca.key"),
+    frontdoorCaBundlesDir: import_node_path11.default.join(root, "frontdoor", "ca", "bundles"),
+    frontdoorStateFile: import_node_path11.default.join(root, "frontdoor", "state.json"),
+    frontdoorLockFile: import_node_path11.default.join(root, "frontdoor", "start.lock"),
+    frontdoorSessionsDir: import_node_path11.default.join(root, "frontdoor", "sessions"),
+    frontdoorLogPath: import_node_path11.default.join(root, "logs", "frontdoor.log"),
+    usageDir: import_node_path11.default.join(root, "usage"),
+    usageLogDir: import_node_path11.default.join(root, "usage", "log"),
+    usageSnapshotsDir: import_node_path11.default.join(root, "usage", "snapshots"),
+    usagePicksFile: import_node_path11.default.join(root, "usage", "picks.json")
   };
 }
 function resolveLayoutPaths() {
   return buildLayoutPaths(resolveAgentShimHome());
 }
+
+// src/identityStore.ts
+var import_node_fs4 = __toESM(require("node:fs"), 1);
+var import_node_path14 = __toESM(require("node:path"), 1);
+
+// src/launcher/identity.ts
+var import_node_path12 = __toESM(require("node:path"), 1);
+function poolNameOf(selector) {
+  return selector.startsWith(POOL_SELECTOR_PREFIX) ? selector.slice(POOL_SELECTOR_PREFIX.length) : void 0;
+}
+function isNonEmpty(value) {
+  return value !== void 0 && value !== "";
+}
+function selected(selector, source) {
+  const pool = poolNameOf(selector);
+  return pool === void 0 ? { name: selector, source, configDirEscapeHatch: false } : { pool, source, configDirEscapeHatch: false };
+}
+function decideIdentity(params) {
+  if (isNonEmpty(params.env.CLAUDE_CONFIG_DIR)) {
+    return { source: "config-dir-escape-hatch", configDirEscapeHatch: true };
+  }
+  if (isNonEmpty(params.argv0Identity)) {
+    return selected(params.argv0Identity, "argv");
+  }
+  if (isNonEmpty(params.env.AGENT_SHIM_IDENTITY)) {
+    return selected(params.env.AGENT_SHIM_IDENTITY, "env");
+  }
+  if (isNonEmpty(params.directoryPinnedIdentity)) {
+    return selected(params.directoryPinnedIdentity, "directory-pin");
+  }
+  const persisted = params.readActiveIdentityFile();
+  if (isNonEmpty(persisted)) {
+    return selected(persisted, "active-identity-file");
+  }
+  return { source: "none", configDirEscapeHatch: false };
+}
+function decideConfigProfile(params) {
+  if (isNonEmpty(params.cliFlagConfigProfile)) {
+    return { name: params.cliFlagConfigProfile, source: "cli-flag" };
+  }
+  if (isNonEmpty(params.env.AGENT_SHIM_CONFIG_PROFILE)) {
+    return { name: params.env.AGENT_SHIM_CONFIG_PROFILE, source: "env" };
+  }
+  if (isNonEmpty(params.directoryRuleConfigProfile)) {
+    return { name: params.directoryRuleConfigProfile, source: "directory-rule" };
+  }
+  if (isNonEmpty(params.identityDefaultConfigProfile)) {
+    return { name: params.identityDefaultConfigProfile, source: "identity-default" };
+  }
+  if (isNonEmpty(params.globalDefaultConfigProfile)) {
+    return { name: params.globalDefaultConfigProfile, source: "global-default" };
+  }
+  return { source: "none" };
+}
+function loadIdentity(identitiesDir, name, fs10) {
+  return loadConfigFile(import_node_path12.default.join(identitiesDir, name, "identity.json"), IdentitySchema, fs10.readConfigFile);
+}
+
+// src/configProfilesStore.ts
+var import_node_fs3 = __toESM(require("node:fs"), 1);
+var import_node_path13 = __toESM(require("node:path"), 1);
+var ProfileNotFoundError = class extends CliError {
+  constructor(profileName) {
+    super(`No configuration profile named "${profileName}". Run \`agent-shim profile add ${profileName}\` first.`);
+    this.profileName = profileName;
+    this.name = "ProfileNotFoundError";
+  }
+  profileName;
+};
+var ProfileAlreadyExistsError = class extends CliError {
+  constructor(profileName) {
+    super(`A configuration profile named "${profileName}" already exists.`);
+    this.profileName = profileName;
+    this.name = "ProfileAlreadyExistsError";
+  }
+  profileName;
+};
+var InvalidCategoryNameError = class extends CliError {
+  constructor(categoryName) {
+    super(`"${categoryName}" is not a category a configuration profile may toggle (runtime, history, knowledge, settings).`);
+    this.categoryName = categoryName;
+    this.name = "InvalidCategoryNameError";
+  }
+  categoryName;
+};
+function profileJsonPath(paths, name) {
+  return import_node_path13.default.join(paths.configProfilesDir, `${name}.json`);
+}
+function profileExists(paths, name) {
+  return import_node_fs3.default.existsSync(profileJsonPath(paths, name));
+}
+function requireProfileExists(paths, name) {
+  if (!profileExists(paths, name)) {
+    throw new ProfileNotFoundError(name);
+  }
+}
+function readProfile(paths, name) {
+  return readJson(profileJsonPath(paths, name), ConfigProfileSchema);
+}
+function createProfile(paths, name, extendsList, description) {
+  if (profileExists(paths, name)) {
+    throw new ProfileAlreadyExistsError(name);
+  }
+  const filePath = profileJsonPath(paths, name);
+  const parsed = ConfigProfileSchema.safeParse({
+    ...description === void 0 ? {} : { description },
+    ...extendsList !== void 0 && extendsList.length > 0 ? { extends: [...extendsList] } : {}
+  });
+  if (!parsed.success) {
+    throw new ConfigValidationError(filePath, parsed.error.issues);
+  }
+  writeJsonAtomic(filePath, parsed.data);
+  return parsed.data;
+}
+function listProfiles(paths) {
+  if (!import_node_fs3.default.existsSync(paths.configProfilesDir)) {
+    return [];
+  }
+  const names = import_node_fs3.default.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort();
+  const result = [];
+  for (const name of names) {
+    const profile = readProfile(paths, name);
+    if (profile !== void 0) {
+      result.push({ name, profile });
+    }
+  }
+  return result;
+}
+function globalConfigPath(paths) {
+  return paths.globalConfigFile;
+}
+function readGlobalConfig(paths) {
+  return readJson(globalConfigPath(paths), GlobalConfigSchema);
+}
+function setGlobalDefaultProfile(paths, name) {
+  return applyPatch(
+    globalConfigPath(paths),
+    GlobalConfigSchema,
+    { defaultConfigProfile: name },
+    { defaults: {} }
+  );
+}
+function validateCategoryNames(patch) {
+  for (const key of Object.keys(patch)) {
+    if (!isOverridableCategory(key)) {
+      throw new InvalidCategoryNameError(key);
+    }
+  }
+}
+function setProfileCategories(paths, name, patch) {
+  requireProfileExists(paths, name);
+  const expandedPatch = expandAllCategoryKey(patch);
+  validateCategoryNames(expandedPatch);
+  const existing = readProfile(paths, name) ?? {};
+  const mergedCategories = { ...existing.categories, ...expandedPatch };
+  return applyPatch(profileJsonPath(paths, name), ConfigProfileSchema, { categories: mergedCategories });
+}
+function setProfileEntries(paths, name, patch) {
+  requireProfileExists(paths, name);
+  const existing = readProfile(paths, name) ?? {};
+  const mergedEntries = { ...existing.entries, ...patch };
+  return applyPatch(profileJsonPath(paths, name), ConfigProfileSchema, { entries: mergedEntries });
+}
+function setProfileLaunchFlags(paths, name, patch) {
+  requireProfileExists(paths, name);
+  const existing = readProfile(paths, name) ?? {};
+  const mergedLaunch = { ...existing.launch, ...patch };
+  return applyPatch(profileJsonPath(paths, name), ConfigProfileSchema, {
+    // Read as `unknown` so the check sees the `undefined` a cleared key holds, which LaunchFlags' optional properties hide from the value type.
+    launch: Object.values(mergedLaunch).every((value) => value === void 0) ? void 0 : mergedLaunch
+  });
+}
+function setProfileMetadata(paths, name, patch) {
+  requireProfileExists(paths, name);
+  return applyPatch(profileJsonPath(paths, name), ConfigProfileSchema, {
+    ...patch.extends === void 0 ? {} : { extends: patch.extends.length === 0 ? void 0 : [...patch.extends] },
+    ...patch.description === void 0 ? {} : { description: patch.description === false ? void 0 : patch.description }
+  });
+}
+function removeProfile(paths, name) {
+  requireProfileExists(paths, name);
+  import_node_fs3.default.rmSync(profileJsonPath(paths, name));
+}
+
+// src/poolStore.ts
+var PoolNotFoundError = class extends CliError {
+  constructor(poolName) {
+    super(`No pool named "${poolName}". Run \`agent-shim pool add ${poolName} --identity <name>...\` first.`);
+    this.poolName = poolName;
+    this.name = "PoolNotFoundError";
+  }
+  poolName;
+};
+var PoolAlreadyExistsError = class extends CliError {
+  constructor(poolName) {
+    super(`A pool named "${poolName}" already exists. Use \`agent-shim pool set ${poolName}\` to change its members.`);
+    this.poolName = poolName;
+    this.name = "PoolAlreadyExistsError";
+  }
+  poolName;
+};
+var InvalidPoolNameError = class extends CliError {
+  constructor(attemptedName) {
+    super(`"${attemptedName}" is not a valid pool name: it must start with a letter or number and may then contain letters, numbers, dots, hyphens and underscores.`);
+    this.attemptedName = attemptedName;
+    this.name = "InvalidPoolNameError";
+  }
+  attemptedName;
+};
+function readPools(paths) {
+  return readGlobalConfig(paths)?.pools ?? {};
+}
+function requirePool(paths, name) {
+  const pool = readPools(paths)[name];
+  if (pool === void 0) {
+    throw new PoolNotFoundError(name);
+  }
+  return pool;
+}
+function writePools(paths, pools) {
+  applyPatch(paths.globalConfigFile, GlobalConfigSchema, { pools }, { defaults: {} });
+}
+function addPool(paths, name, identities) {
+  if (!PoolNameSchema.safeParse(name).success) {
+    throw new InvalidPoolNameError(name);
+  }
+  const pools = readPools(paths);
+  if (pools[name] !== void 0) {
+    throw new PoolAlreadyExistsError(name);
+  }
+  const pool = { identities: [...identities] };
+  writePools(paths, { ...pools, [name]: pool });
+  return pool;
+}
+function setPool(paths, name, identities) {
+  requirePool(paths, name);
+  const pool = { identities: [...identities] };
+  writePools(paths, { ...readPools(paths), [name]: pool });
+  return pool;
+}
+function removePool(paths, name) {
+  requirePool(paths, name);
+  const remaining = Object.fromEntries(Object.entries(readPools(paths)).filter(([existing]) => existing !== name));
+  writePools(paths, remaining);
+}
+
+// src/identityStore.ts
+var IdentityNotFoundError = class extends CliError {
+  constructor(name) {
+    super(`No identity named "${name}". Run \`agent-shim identity add ${name}\` first.`);
+    this.name = name;
+    this.name = "IdentityNotFoundError";
+  }
+  name;
+};
+var IdentityAlreadyExistsError = class extends CliError {
+  constructor(identityName) {
+    super(`An identity named "${identityName}" already exists.`);
+    this.identityName = identityName;
+    this.name = "IdentityAlreadyExistsError";
+  }
+  identityName;
+};
+var InvalidIdentityNameError = class extends CliError {
+  constructor(attemptedName) {
+    super(
+      `"${attemptedName}" is not a valid identity name \u2014 identity names must start with a letter or number and may then contain letters, numbers, dots, hyphens, underscores, and at signs.`
+    );
+    this.attemptedName = attemptedName;
+    this.name = "InvalidIdentityNameError";
+  }
+  attemptedName;
+};
+function identityJsonPath(paths, name) {
+  return import_node_path14.default.join(paths.identitiesDir, name, "identity.json");
+}
+function identityExists(paths, name) {
+  return import_node_fs4.default.existsSync(identityJsonPath(paths, name));
+}
+function readIdentity(paths, name) {
+  return readJson(identityJsonPath(paths, name), IdentitySchema);
+}
+function addIdentity(paths, name) {
+  if (identityExists(paths, name)) {
+    throw new IdentityAlreadyExistsError(name);
+  }
+  const parsed = IdentitySchema.safeParse({ name, allowAmbientCredential: false });
+  if (!parsed.success) {
+    throw new InvalidIdentityNameError(name);
+  }
+  writeJsonAtomic(identityJsonPath(paths, name), parsed.data);
+  return parsed.data;
+}
+function useIdentity(paths, name) {
+  const pool = poolNameOf(name);
+  if (pool !== void 0) {
+    requirePool(paths, pool);
+  } else if (!identityExists(paths, name)) {
+    throw new IdentityNotFoundError(name);
+  }
+  writeTextAtomic(paths.activeIdentityFile, `${name}
+`);
+}
+function readActiveIdentity(paths) {
+  if (!import_node_fs4.default.existsSync(paths.activeIdentityFile)) {
+    return void 0;
+  }
+  const raw = import_node_fs4.default.readFileSync(paths.activeIdentityFile, "utf8").trim();
+  return raw === "" ? void 0 : raw;
+}
+function isIdentityDirectoryName(name) {
+  return !name.startsWith(".");
+}
+function readIdentityForListing(paths, name) {
+  try {
+    return readIdentity(paths, name);
+  } catch (error) {
+    if (error instanceof ConfigValidationError || error instanceof SyntaxError) {
+      return { problem: error.message.replace(/\s*\n\s*/g, " ") };
+    }
+    throw error;
+  }
+}
+function listIdentities(paths) {
+  if (!import_node_fs4.default.existsSync(paths.identitiesDir)) {
+    return [];
+  }
+  const active = readActiveIdentity(paths);
+  const names = import_node_fs4.default.readdirSync(paths.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && isIdentityDirectoryName(entry.name)).map((entry) => entry.name).sort();
+  const result = [];
+  for (const name of names) {
+    const read = readIdentityForListing(paths, name);
+    if (read === void 0) {
+      continue;
+    }
+    const isActive = name === active;
+    result.push("problem" in read ? { name, isActive, problem: read.problem } : { name, identity: read, isActive });
+  }
+  return result;
+}
+function setDefaultConfigProfile(paths, identityName, profileName) {
+  if (!identityExists(paths, identityName)) {
+    throw new IdentityNotFoundError(identityName);
+  }
+  return applyPatch(identityJsonPath(paths, identityName), IdentitySchema, {
+    defaultConfigProfile: profileName
+  });
+}
+function setAllowAmbientCredential(paths, identityName, allow) {
+  if (!identityExists(paths, identityName)) {
+    throw new IdentityNotFoundError(identityName);
+  }
+  return applyPatch(identityJsonPath(paths, identityName), IdentitySchema, {
+    allowAmbientCredential: allow
+  });
+}
+function setIdentityCredential(paths, identityName, change) {
+  const existing = readIdentity(paths, identityName);
+  if (existing === void 0) {
+    throw new IdentityNotFoundError(identityName);
+  }
+  if (change === false) {
+    return applyPatch(identityJsonPath(paths, identityName), IdentitySchema, { credential: void 0 });
+  }
+  const sources = change.sources ?? existing.credential?.sources;
+  if (sources === void 0) {
+    throw new UsageError(`Identity "${identityName}" has no credential yet: pass --credential to give it one before choosing its target.`);
+  }
+  const target = change.target ?? existing.credential?.target;
+  const cache = change.cache === void 0 ? existing.credential?.cache : change.cache === false ? void 0 : change.cache;
+  return applyPatch(identityJsonPath(paths, identityName), IdentitySchema, {
+    credential: { sources: [...sources], ...target === void 0 ? {} : { target }, ...cache === void 0 ? {} : { cache } }
+  });
+}
+function belongsToIdentity(entry, name) {
+  return entry === name || entry === import_node_path14.default.basename(identityLockPath("", name)) || entry.startsWith(`.${name}.scratch.`) || entry.startsWith(`.${name}.previous.`);
+}
+function removeIdentity(paths, name) {
+  if (!identityExists(paths, name)) {
+    throw new IdentityNotFoundError(name);
+  }
+  for (const entry of import_node_fs4.default.readdirSync(paths.identitiesDir)) {
+    if (belongsToIdentity(entry, name)) {
+      import_node_fs4.default.rmSync(import_node_path14.default.join(paths.identitiesDir, entry), { recursive: true, force: true });
+    }
+  }
+  if (readActiveIdentity(paths) === name) {
+    import_node_fs4.default.rmSync(paths.activeIdentityFile);
+  }
+}
+
+// src/providersStore.ts
+var import_node_fs5 = __toESM(require("node:fs"), 1);
+var import_node_path15 = __toESM(require("node:path"), 1);
+
+// src/credentialCache.ts
+var import_zod7 = require("zod");
+var CachedCredentialSchema = import_zod7.z.strictObject({
+  token: import_zod7.z.string().min(1),
+  fetchedAt: import_zod7.z.number().int().nonnegative(),
+  source: CredentialSourceSchema
+});
+
+// src/credential.ts
+function summariseSource(source) {
+  if ("env" in source) {
+    return { kind: "env", variable: source.env };
+  }
+  if ("file" in source) {
+    return { kind: "file", path: source.file };
+  }
+  if ("command" in source) {
+    return { kind: "command", program: source.command[0] };
+  }
+  if ("op" in source) {
+    return { kind: "op", reference: source.op };
+  }
+  if ("keychain" in source) {
+    return {
+      kind: "keychain",
+      service: source.keychain.service,
+      ...source.keychain.account === void 0 ? {} : { account: source.keychain.account }
+    };
+  }
+  return { kind: "literal" };
+}
+function summariseCredential(credential) {
+  return {
+    target: credential.target ?? "bearer",
+    sources: credential.sources.map(summariseSource),
+    ...credential.cache === void 0 ? {} : { cache: credential.cache }
+  };
+}
+function formatSourceSummary(summary) {
+  switch (summary.kind) {
+    case "env":
+      return `env ${summary.variable}`;
+    case "file":
+      return `file ${summary.path}`;
+    case "command":
+      return `command ${summary.program}`;
+    case "op":
+      return `op ${summary.reference}`;
+    case "keychain":
+      return `keychain ${summary.service}${summary.account === void 0 ? "" : ` (account ${summary.account})`}`;
+    case "literal":
+      return "literal (non-secret placeholder)";
+    default:
+      return summary;
+  }
+}
+function formatCredentialSummary(summary) {
+  const cache = summary.cache === void 0 ? "" : `, cached ${summary.cache.ttl === void 0 ? "with no expiry" : `for ${summary.cache.ttl}`}${summary.cache.store === void 0 ? "" : ` in the ${summary.cache.store} store`}`;
+  return `${summary.target} from ${summary.sources.map(formatSourceSummary).join(", then ")}${cache}`;
+}
+function describeCredential(credential) {
+  return formatCredentialSummary(summariseCredential(credential));
+}
+
+// src/providersStore.ts
+var ProviderNotFoundError = class extends CliError {
+  constructor(name) {
+    super(`No provider named "${name}". Run \`agent-shim provider add ${name}\` first.`);
+    this.name = name;
+    this.name = "ProviderNotFoundError";
+  }
+  name;
+};
+var ProviderAlreadyExistsError = class extends CliError {
+  constructor(providerName) {
+    super(`A provider named "${providerName}" already exists.`);
+    this.providerName = providerName;
+    this.name = "ProviderAlreadyExistsError";
+  }
+  providerName;
+};
+var InvalidProviderNameError = class extends CliError {
+  constructor(attemptedName) {
+    super(
+      `"${attemptedName}" is not a valid provider name. Provider names must start with a letter or number and may then contain letters, numbers, dots, hyphens, underscores, and at signs.`
+    );
+    this.attemptedName = attemptedName;
+    this.name = "InvalidProviderNameError";
+  }
+  attemptedName;
+};
+var PROVIDER_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._@-]*$/;
+function providerJsonPath(paths, name) {
+  return import_node_path15.default.join(paths.providersDir, `${name}.json`);
+}
+function providerExists(paths, name) {
+  return import_node_fs5.default.existsSync(providerJsonPath(paths, name));
+}
+var LEGACY_PROVIDER_FIELDS = ["tokenEnv", "tokenCommand", "authScheme"];
+var LEGACY_ENV_CREDENTIAL_KEYS = Object.values(CREDENTIAL_TARGET_VARS);
+var LEGACY_LITERAL_PLACEHOLDER = "<the value of env.ANTHROPIC_AUTH_TOKEN>";
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function legacyProviderConversion(raw) {
+  if (!isRecord2(raw) || "credential" in raw) {
+    return void 0;
+  }
+  const env = isRecord2(raw.env) ? raw.env : void 0;
+  const legacyEnvKeys = env === void 0 ? [] : Object.keys(env).filter((key) => LEGACY_ENV_CREDENTIAL_KEYS.includes(key));
+  const fields = [...LEGACY_PROVIDER_FIELDS.filter((field) => field in raw), ...legacyEnvKeys.map((key) => `env.${key}`)];
+  if (fields.length === 0) {
+    return void 0;
+  }
+  const sources = [];
+  if (typeof raw.tokenEnv === "string") {
+    sources.push({ env: raw.tokenEnv });
+  }
+  if (Array.isArray(raw.tokenCommand)) {
+    sources.push({ command: raw.tokenCommand });
+  }
+  if (typeof env?.ANTHROPIC_AUTH_TOKEN === "string" && env.ANTHROPIC_AUTH_TOKEN !== "") {
+    sources.push({ literal: LEGACY_LITERAL_PLACEHOLDER });
+  }
+  const remainingEnv = env === void 0 ? void 0 : Object.fromEntries(Object.entries(env).filter(([key]) => !LEGACY_ENV_CREDENTIAL_KEYS.includes(key)));
+  const replacedKeys = [...LEGACY_PROVIDER_FIELDS, "env"];
+  const rest = Object.fromEntries(Object.entries(raw).filter(([key]) => !replacedKeys.includes(key)));
+  return {
+    fields,
+    replacement: {
+      ...rest,
+      credential: { sources, ...raw.authScheme === "apiKey" ? { target: "apiKey" } : {} },
+      ...remainingEnv === void 0 || Object.keys(remainingEnv).length === 0 ? {} : { env: remainingEnv }
+    }
+  };
+}
+var LegacyProviderFileError = class extends CliError {
+  constructor(filePath, conversion) {
+    super(
+      `${filePath} uses ${conversion.fields.join(", ")}, which a credential block replaced. Rewrite it as:
+` + JSON.stringify(conversion.replacement, null, 2)
+    );
+    this.filePath = filePath;
+    this.conversion = conversion;
+    this.name = "LegacyProviderFileError";
+  }
+  filePath;
+  conversion;
+};
+function parseProviderFile(filePath, raw) {
+  const conversion = legacyProviderConversion(raw);
+  if (conversion !== void 0) {
+    throw new LegacyProviderFileError(filePath, conversion);
+  }
+  const parsed = ProviderSchema.safeParse(raw);
+  if (!parsed.success) {
+    throw new ConfigValidationError(filePath, parsed.error.issues);
+  }
+  return parsed.data;
+}
+function readProvider(paths, name) {
+  const filePath = providerJsonPath(paths, name);
+  if (!import_node_fs5.default.existsSync(filePath)) {
+    return void 0;
+  }
+  const raw = JSON.parse(import_node_fs5.default.readFileSync(filePath, "utf8"));
+  return parseProviderFile(filePath, raw);
+}
+function listProviders(paths) {
+  const names = listProviderNames(
+    (dir) => import_node_fs5.default.readdirSync(dir),
+    paths.providersDir
+  );
+  const result = [];
+  for (const name of names) {
+    let provider;
+    try {
+      provider = readProvider(paths, name);
+    } catch (error) {
+      if (!(error instanceof ConfigValidationError || error instanceof LegacyProviderFileError)) {
+        throw error;
+      }
+      console.error(`agent-shim: providers/${name}.json is invalid and was skipped: ${error.message}`);
+      continue;
+    }
+    if (provider !== void 0) {
+      result.push({ name, provider });
+    }
+  }
+  return result;
+}
+function listProviderNames(readdir, providersDir) {
+  let entries;
+  try {
+    entries = readdir(providersDir);
+  } catch {
+    return [];
+  }
+  return entries.filter((entry) => entry.endsWith(".json")).map((entry) => entry.slice(0, -".json".length)).sort();
+}
+function describeProviderEndpoint(provider) {
+  return isCodexProvider(provider) ? "codex translation daemon" : provider.baseUrl;
+}
+var ProviderKindMismatchError = class extends UsageError {
+  constructor(message) {
+    super(message);
+    this.name = "ProviderKindMismatchError";
+  }
+};
+function isEmptyCodexConfig(config) {
+  return config === void 0 || config.defaultModel === void 0 && config.effort === void 0 && (config.models === void 0 || Object.keys(config.models).length === 0);
+}
+function addProvider(paths, name, input) {
+  if (providerExists(paths, name)) {
+    throw new ProviderAlreadyExistsError(name);
+  }
+  if (!PROVIDER_NAME_RE.test(name)) {
+    throw new InvalidProviderNameError(name);
+  }
+  const kind = input.kind ?? "http";
+  if (kind === "codex" && input.baseUrl !== void 0) {
+    throw new ProviderKindMismatchError("A codex provider has no base URL: the launcher points its sessions at the front-door daemon. Drop --base-url.");
+  }
+  if (kind === "http" && input.baseUrl === void 0) {
+    throw new ProviderKindMismatchError("An http provider needs --base-url.");
+  }
+  if (kind === "http" && !isEmptyCodexConfig(input.codex)) {
+    throw new ProviderKindMismatchError("Codex settings apply only to a codex provider (--kind codex).");
+  }
+  const shared = {
+    displayName: input.displayName,
+    credential: { sources: input.sources, ...input.target === void 0 ? {} : { target: input.target } },
+    ...input.env === void 0 || Object.keys(input.env).length === 0 ? {} : { env: input.env }
+  };
+  const parsed = ProviderSchema.safeParse(
+    kind === "codex" ? { kind, ...shared, ...isEmptyCodexConfig(input.codex) ? {} : { codex: input.codex } } : { ...shared, baseUrl: input.baseUrl }
+  );
+  if (!parsed.success) {
+    throw new ConfigValidationError(providerJsonPath(paths, name), parsed.error.issues);
+  }
+  writeJsonAtomic(providerJsonPath(paths, name), parsed.data);
+  return parsed.data;
+}
+function updateProvider(paths, name, input) {
+  const existing = readProvider(paths, name);
+  if (existing === void 0) {
+    throw new ProviderNotFoundError(name);
+  }
+  const unset = new Set(input.unsetEnv);
+  const env = Object.fromEntries(Object.entries({ ...existing.env, ...input.env }).filter(([key]) => !unset.has(key)));
+  const target = input.target ?? existing.credential.target;
+  const cache = input.cache === void 0 ? existing.credential.cache : input.cache === false ? void 0 : input.cache;
+  if (isCodexProvider(existing) && input.baseUrl !== void 0) {
+    throw new ProviderKindMismatchError(`Provider "${name}" is a codex provider, which has no base URL.`);
+  }
+  if (!isCodexProvider(existing) && !isEmptyCodexConfig(input.codex)) {
+    throw new ProviderKindMismatchError(`Provider "${name}" is an http provider; codex settings apply only to a codex provider.`);
+  }
+  const shared = {
+    ...input.displayName === void 0 ? {} : { displayName: input.displayName },
+    credential: {
+      sources: input.sources ?? existing.credential.sources,
+      ...target === void 0 ? {} : { target },
+      ...cache === void 0 ? {} : { cache }
+    },
+    env: Object.keys(env).length === 0 ? void 0 : env
+  };
+  let candidate;
+  if (isCodexProvider(existing)) {
+    const codex = {
+      ...existing.codex,
+      ...input.codex,
+      ...existing.codex?.models === void 0 && input.codex?.models === void 0 ? {} : { models: { ...existing.codex?.models, ...input.codex?.models } }
+    };
+    candidate = { ...existing, ...shared, codex: isEmptyCodexConfig(codex) ? void 0 : codex };
+  } else {
+    candidate = { ...existing, ...shared, ...input.baseUrl === void 0 ? {} : { baseUrl: input.baseUrl } };
+  }
+  const parsed = ProviderSchema.safeParse(candidate);
+  if (!parsed.success) {
+    throw new ConfigValidationError(providerJsonPath(paths, name), parsed.error.issues);
+  }
+  writeJsonAtomic(providerJsonPath(paths, name), parsed.data);
+  return parsed.data;
+}
+function removeProvider(paths, name) {
+  if (!providerExists(paths, name)) {
+    throw new ProviderNotFoundError(name);
+  }
+  import_node_fs5.default.rmSync(providerJsonPath(paths, name));
+}
+function cascadeProviderName(cascade) {
+  let name;
+  for (const layer of assembleCascade(cascade).layers) {
+    if (layer.launch?.provider !== void 0) {
+      name = layer.launch.provider;
+    }
+  }
+  return name;
+}
+
+// src/directoryRulesStore.ts
+var DirectoryRuleNotFoundError = class extends CliError {
+  constructor(rulePath) {
+    super(`No directory rule found for path "${rulePath}".`);
+    this.rulePath = rulePath;
+    this.name = "DirectoryRuleNotFoundError";
+  }
+  rulePath;
+};
+var DirectoryRuleMissingTargetError = class extends CliError {
+  constructor() {
+    super("A directory rule must set at least one of --config-profile or --identity.");
+    this.name = "DirectoryRuleMissingTargetError";
+  }
+};
+var DirectoryRuleAlreadyExistsError = class extends CliError {
+  constructor(rulePath) {
+    super(`A directory rule for path "${rulePath}" already exists. Use \`agent-shim rule set\` to change it.`);
+    this.rulePath = rulePath;
+    this.name = "DirectoryRuleAlreadyExistsError";
+  }
+  rulePath;
+};
+function readDirectoryRules(paths) {
+  return readJson(paths.directoryRulesFile, DirectoryRulesSchema) ?? { rules: [] };
+}
+function writeDirectoryRules(paths, rules) {
+  const parsed = DirectoryRulesSchema.safeParse(rules);
+  if (!parsed.success) {
+    throw new ConfigValidationError(paths.directoryRulesFile, parsed.error.issues);
+  }
+  writeJsonAtomic(paths.directoryRulesFile, parsed.data);
+}
+function listDirectoryRules(paths) {
+  return readDirectoryRules(paths).rules;
+}
+function addDirectoryRule(paths, rulePath, options) {
+  if (options.configProfile === void 0 && options.identity === void 0) {
+    throw new DirectoryRuleMissingTargetError();
+  }
+  const current = readDirectoryRules(paths);
+  if (current.rules.some((rule) => rule.path === rulePath)) {
+    throw new DirectoryRuleAlreadyExistsError(rulePath);
+  }
+  const created = buildNewRule(rulePath, options);
+  writeDirectoryRules(paths, { ...current, rules: [...current.rules, created] });
+  return created;
+}
+function ruleHasEffect(rule) {
+  return rule.configProfile !== void 0 || rule.identity !== void 0 || rule.categories !== void 0 || rule.entries !== void 0 || rule.launch !== void 0;
+}
+function updateDirectoryRule(paths, rulePath, options) {
+  const current = readDirectoryRules(paths);
+  const index = current.rules.findIndex((rule) => rule.path === rulePath);
+  const existing = index === -1 ? void 0 : current.rules[index];
+  if (existing === void 0) {
+    throw new DirectoryRuleNotFoundError(rulePath);
+  }
+  const { configProfile, identity, ...rest } = existing;
+  const nextConfigProfile = options.configProfile === void 0 ? configProfile : options.configProfile === false ? void 0 : options.configProfile;
+  const nextIdentity = options.identity === void 0 ? identity : options.identity === false ? void 0 : options.identity;
+  const updated = {
+    ...rest,
+    ...nextConfigProfile === void 0 ? {} : { configProfile: nextConfigProfile },
+    ...nextIdentity === void 0 ? {} : { identity: nextIdentity }
+  };
+  if (!ruleHasEffect(updated)) {
+    throw new DirectoryRuleMissingTargetError();
+  }
+  const nextRules = [...current.rules];
+  nextRules[index] = updated;
+  writeDirectoryRules(paths, { ...current, rules: nextRules });
+  return updated;
+}
+function buildNewRule(rulePath, options) {
+  return {
+    path: rulePath,
+    ...options.configProfile !== void 0 ? { configProfile: options.configProfile } : {},
+    ...options.identity !== void 0 ? { identity: options.identity } : {}
+  };
+}
+function removeDirectoryRule(paths, rulePath) {
+  const current = readDirectoryRules(paths);
+  const nextRules = current.rules.filter((rule) => rule.path !== rulePath);
+  if (nextRules.length === current.rules.length) {
+    throw new DirectoryRuleNotFoundError(rulePath);
+  }
+  writeDirectoryRules(paths, { ...current, rules: nextRules });
+}
+
+// src/checkReport.ts
+var import_node_os3 = __toESM(require("node:os"), 1);
+
+// src/launcher/cascade.ts
+var import_node_path17 = __toESM(require("node:path"), 1);
+
+// src/pathNorm.ts
+var import_node_path16 = __toESM(require("node:path"), 1);
+function expandTilde(value, home) {
+  if (value === "~") {
+    return home;
+  }
+  if (value.startsWith("~/")) {
+    return import_node_path16.default.join(home, value.slice(2));
+  }
+  return value;
+}
+function normaliseRulePath(rulePath, home) {
+  return import_node_path16.default.resolve(expandTilde(rulePath, home));
+}
+
+// src/launcher/cascade.ts
+var PORTABLE_CONFIG_FILENAME = ".agent-shim.json";
+var PORTABLE_LOCAL_CONFIG_FILENAME = ".agent-shim.local.json";
+function loadCascadeInput(params) {
+  const globalConfig = loadConfigFile(params.paths.globalConfigFile, GlobalConfigSchema, params.read);
+  const directoryRules = loadConfigFile(params.paths.directoryRulesFile, DirectoryRulesSchema, params.read);
+  const loadProfile = (name) => {
+    const filepath = import_node_path17.default.join(params.paths.configProfilesDir, `${name}.json`);
+    const loaded = loadConfigFile(filepath, ConfigProfileSchema, params.read);
+    if (loaded === void 0) {
+      return void 0;
+    }
+    return { name, profile: loaded.config, entryOrder: loaded.entryOrder, filepath: loaded.filepath };
+  };
+  const limit = globalConfig?.config.walkUpLimit;
+  const dirs = walkDirectoryAncestors(params.cwd, {
+    home: params.home,
+    ...limit === void 0 ? {} : { limit: expandTilde(limit, params.home) },
+    ...params.isReadable === void 0 ? {} : { isReadable: params.isReadable }
+  });
+  const levels = [];
+  for (const dir of dirs) {
+    const portable = loadConfigFile(import_node_path17.default.join(dir, PORTABLE_CONFIG_FILENAME), PortableConfigSchema, params.read) ?? loadConfigFile(import_node_path17.default.join(dir, LEGACY_PORTABLE_CONFIG_FILENAME), PortableConfigSchema, params.read);
+    const portableLocal = loadConfigFile(import_node_path17.default.join(dir, PORTABLE_LOCAL_CONFIG_FILENAME), PortableConfigSchema, params.read) ?? loadConfigFile(import_node_path17.default.join(dir, LEGACY_PORTABLE_LOCAL_CONFIG_FILENAME), PortableConfigSchema, params.read);
+    const rules = (directoryRules?.config.rules ?? []).map((rule, index) => ({ rule, index })).filter(({ rule }) => normaliseRulePath(rule.path, params.home) === dir).map(({ rule, index }) => {
+      const entryOrder = directoryRules?.ruleEntryOrders[index];
+      return {
+        rule,
+        ...entryOrder === void 0 ? {} : { entryOrder },
+        filepath: params.paths.directoryRulesFile
+      };
+    });
+    if (portable === void 0 && portableLocal === void 0 && rules.length === 0) {
+      continue;
+    }
+    levels.push({
+      dir,
+      ...portable === void 0 ? {} : { portable: { config: portable.config, entryOrder: portable.entryOrder, filepath: portable.filepath } },
+      ...rules.length === 0 ? {} : { rules },
+      ...portableLocal === void 0 ? {} : { portableLocal: { config: portableLocal.config, entryOrder: portableLocal.entryOrder, filepath: portableLocal.filepath } }
+    });
+  }
+  const input = {
+    home: params.home,
+    ...globalConfig === void 0 ? {} : { globalConfig: { config: globalConfig.config, entryOrder: globalConfig.entryOrder, filepath: globalConfig.filepath } },
+    ...params.baseConfigProfile === void 0 ? {} : { baseConfigProfile: params.baseConfigProfile },
+    loadProfile,
+    levels,
+    ...params.cliOverride === void 0 ? {} : { cliOverride: params.cliOverride }
+  };
+  return { input, ...globalConfig === void 0 ? {} : { globalConfig: globalConfig.config } };
+}
+function readDirectorySelections(loaded) {
+  let identity;
+  let configProfile;
+  for (const level of loaded.input.levels ?? []) {
+    for (const source of [level.portable?.config, ...(level.rules ?? []).map((entry) => entry.rule), level.portableLocal?.config]) {
+      if (source === void 0) {
+        continue;
+      }
+      if (source.identity !== void 0) {
+        identity = source.identity;
+      }
+      if (source.configProfile !== void 0) {
+        configProfile = source.configProfile;
+      }
+    }
+  }
+  return { ...identity === void 0 ? {} : { identity }, ...configProfile === void 0 ? {} : { configProfile } };
+}
+
+// src/usage/preflight.ts
+var MS_PER_SECOND2 = 1e3;
+var SECONDS_PER_MINUTE = 60;
+var MINUTES_PER_HOUR = 60;
+var HOURS_PER_DAY = 24;
+function formatAge(ms) {
+  const minutes = Math.floor(ms / (MS_PER_SECOND2 * SECONDS_PER_MINUTE));
+  if (minutes < MINUTES_PER_HOUR) {
+    return `${String(Math.max(minutes, 0))}m`;
+  }
+  const hours = Math.floor(minutes / MINUTES_PER_HOUR);
+  return hours < HOURS_PER_DAY ? `${String(hours)}h` : `${String(Math.floor(hours / HOURS_PER_DAY))}d`;
+}
+function effectiveWindow(window, nowMs) {
+  const resetsAtMs = window.resetsAt === void 0 ? void 0 : Date.parse(window.resetsAt);
+  if (resetsAtMs !== void 0 && resetsAtMs <= nowMs) {
+    return { reset: true, utilization: 0 };
+  }
+  return {
+    reset: false,
+    ...window.utilization === void 0 ? {} : { utilization: window.utilization },
+    ...resetsAtMs === void 0 ? {} : { resetsAtMs },
+    ...window.status === void 0 ? {} : { status: window.status }
+  };
+}
+
+// src/usage/poolPick.ts
+var import_zod9 = require("zod");
+
+// src/usage/plan.ts
+var TIER_MULTIPLIER = /(?:^|_)(\d+)x$/;
+var ZERO_TIER = /(?:^|_)zero$/;
+var BASE_TIER = /(?:^|_)(?:pro|free)$/;
+function planOf(account) {
+  const tier = account?.organizationRateLimitTier ?? account?.userRateLimitTier;
+  const tierField = tier === void 0 ? {} : { tier };
+  if (tier === void 0) {
+    return { kind: "subscription", capacity: 1, recognised: false };
+  }
+  if (ZERO_TIER.test(tier)) {
+    return { kind: "pay-per-use", ...tierField };
+  }
+  const multiplier = TIER_MULTIPLIER.exec(tier)?.[1];
+  if (multiplier !== void 0) {
+    return { kind: "subscription", capacity: Number(multiplier), recognised: true, ...tierField };
+  }
+  return { kind: "subscription", capacity: 1, recognised: BASE_TIER.test(tier), ...tierField };
+}
+
+// src/usage/rateLimit.ts
+var MS_PER_SECOND3 = 1e3;
+function epochSecondsToIso(value) {
+  if (value === void 0) {
+    return void 0;
+  }
+  const seconds = Number(value);
+  return Number.isFinite(seconds) && seconds > 0 ? new Date(seconds * MS_PER_SECOND3).toISOString() : void 0;
+}
+function nonNegativeNumber(value) {
+  if (value === void 0 || value.trim() === "") {
+    return void 0;
+  }
+  const parsed = Number(value);
+  return Number.isFinite(parsed) && parsed >= 0 ? parsed : void 0;
+}
+var UNIFIED_PREFIX = "anthropic-ratelimit-unified-";
+function unifiedWindow(headers, window) {
+  const utilization = nonNegativeNumber(headers[`${UNIFIED_PREFIX}${window}-utilization`]);
+  const resetsAt = epochSecondsToIso(headers[`${UNIFIED_PREFIX}${window}-reset`]);
+  const status = headers[`${UNIFIED_PREFIX}${window}-status`];
+  if (utilization === void 0 && resetsAt === void 0 && status === void 0) {
+    return void 0;
+  }
+  return { ...utilization === void 0 ? {} : { utilization }, ...resetsAt === void 0 ? {} : { resetsAt }, ...status === void 0 ? {} : { status } };
+}
+function parseUnifiedRateLimit(headers) {
+  if (!Object.keys(headers).some((name) => name.startsWith(UNIFIED_PREFIX))) {
+    return void 0;
+  }
+  const status = headers[`${UNIFIED_PREFIX}status`];
+  const fiveHour = unifiedWindow(headers, "5h");
+  const sevenDay = unifiedWindow(headers, "7d");
+  const representativeClaim = headers[`${UNIFIED_PREFIX}representative-claim`];
+  const resetAt = epochSecondsToIso(headers[`${UNIFIED_PREFIX}reset`]);
+  const overageStatus = headers[`${UNIFIED_PREFIX}overage-status`];
+  return {
+    ...status === void 0 ? {} : { status },
+    ...fiveHour === void 0 ? {} : { fiveHour },
+    ...sevenDay === void 0 ? {} : { sevenDay },
+    ...representativeClaim === void 0 ? {} : { representativeClaim },
+    ...resetAt === void 0 ? {} : { resetAt },
+    ...overageStatus === void 0 ? {} : { overageStatus }
+  };
+}
+
+// src/usage/scan.ts
+var import_zod8 = require("zod");
+var AnthropicUsageSchema = import_zod8.z.looseObject({
+  input_tokens: import_zod8.z.number().int().nonnegative().nullish(),
+  output_tokens: import_zod8.z.number().int().nonnegative().nullish(),
+  cache_creation_input_tokens: import_zod8.z.number().int().nonnegative().nullish(),
+  cache_read_input_tokens: import_zod8.z.number().int().nonnegative().nullish()
+});
+var ErrorObjectSchema = import_zod8.z.looseObject({
+  type: import_zod8.z.string().optional(),
+  code: import_zod8.z.union([import_zod8.z.string(), import_zod8.z.number()]).optional(),
+  message: import_zod8.z.string().optional()
+});
+
+// src/usage/middleware.ts
+var ANTHROPIC_PROVIDER = "anthropic";
+
+// src/usage/pick.ts
+var MS_PER_SECOND4 = 1e3;
+var MS_PER_HOUR = 36e5;
+var HOURS_PER_DAY2 = 24;
+var FIVE_HOURS = 5;
+var PROMPT_CACHE_TTL_HOURS = 1;
+var PERCENT = 100;
+var SEVEN_DAYS = 7;
+var FIVE_HOUR_WINDOW_MS = FIVE_HOURS * MS_PER_HOUR;
+var SEVEN_DAY_WINDOW_MS = SEVEN_DAYS * HOURS_PER_DAY2 * MS_PER_HOUR;
+var PROMPT_CACHE_TTL_MS = PROMPT_CACHE_TTL_HOURS * MS_PER_HOUR;
+var CLASS_ORDER = { scored: 0, unknown: 1, "pay-per-use": 2, ineligible: 3 };
+function unifiedOf(state) {
+  return state?.rateLimit?.unified;
+}
+function limitBlockedUntil(state, nowMs) {
+  const limit = state?.lastLimit;
+  if (state === void 0 || limit === void 0) {
+    return void 0;
+  }
+  if (Date.parse(state.lastRequestAt) > Date.parse(limit.observedAt)) {
+    return void 0;
+  }
+  const until = limit.resetAt === void 0 ? limit.retryAfterSeconds === void 0 ? void 0 : Date.parse(limit.observedAt) + limit.retryAfterSeconds * MS_PER_SECOND4 : Date.parse(limit.resetAt);
+  return until !== void 0 && until > nowMs ? until : void 0;
+}
+function windowBlockedUntil(windows) {
+  const resets = windows.flatMap((window) => window.status === "rejected" && window.resetsAtMs !== void 0 ? [window.resetsAtMs] : []);
+  return resets.length === 0 ? void 0 : Math.max(...resets);
+}
+function fiveHourBurn(records) {
+  const points = [];
+  for (const record of records) {
+    const window = record.rateLimitHeaders === void 0 ? void 0 : parseUnifiedRateLimit(record.rateLimitHeaders)?.fiveHour;
+    if (window?.utilization !== void 0 && window.resetsAt !== void 0) {
+      points.push({ resetsAt: window.resetsAt, point: { atMs: Date.parse(record.at), utilization: window.utilization } });
+    }
+  }
+  const latest = points.at(-1)?.resetsAt;
+  const current = points.filter((entry) => entry.resetsAt === latest).map((entry) => entry.point);
+  const first = current.at(0);
+  const last = current.at(-1);
+  if (first === void 0 || last === void 0 || last.atMs <= first.atMs || last.utilization <= first.utilization) {
+    return void 0;
+  }
+  return (last.utilization - first.utilization) / (last.atMs - first.atMs);
+}
+function percent(fraction) {
+  return `${String(Math.round(fraction * PERCENT))}%`;
+}
+function describeWindow(label, window, effective, nowMs) {
+  if (effective.reset) {
+    return `${label} window has reset`;
+  }
+  const used = effective.utilization === void 0 ? "usage unknown" : `${percent(effective.utilization)} used`;
+  const resets = effective.resetsAtMs === void 0 ? "" : `, resets in ${formatAge(effective.resetsAtMs - nowMs)}`;
+  return `${label} ${used}${resets}${window.status === "allowed_warning" ? " (nearly used)" : ""}`;
+}
+function capacityOf(plan) {
+  return plan.kind === "subscription" ? plan.capacity : 1;
+}
+function assess(member, nowMs) {
+  const plan = planOf(member.account);
+  const planReasons = plan.kind === "pay-per-use" ? ["billed by use (no plan allowance)"] : plan.recognised ? [`${String(plan.capacity)}x plan`] : [`plan tier ${plan.tier === void 0 ? "not known" : `"${plan.tier}" not recognised`}, counted as 1x`];
+  const base = { identity: member.identity, plan };
+  if (member.readError !== void 0) {
+    return { candidate: { ...base, class: "unknown", reasons: [`usage state unreadable: ${member.readError}`, ...planReasons] } };
+  }
+  const state = member.snapshot?.providers[ANTHROPIC_PROVIDER];
+  const unified = unifiedOf(state);
+  if (member.snapshot === void 0 || state === void 0 || unified === void 0) {
+    return { candidate: { ...base, class: "unknown", reasons: ["no usage recorded yet, so its quota is unknown (turn on trackUsage for it)", ...planReasons] } };
+  }
+  const observedAgo = state.rateLimit === void 0 ? "" : ` (last seen ${formatAge(nowMs - Date.parse(state.rateLimit.observedAt))} ago)`;
+  const fiveHourWindow = unified.fiveHour;
+  const sevenDayWindow = unified.sevenDay;
+  const five = fiveHourWindow === void 0 ? void 0 : effectiveWindow(fiveHourWindow, nowMs);
+  const seven = sevenDayWindow === void 0 ? void 0 : effectiveWindow(sevenDayWindow, nowMs);
+  const windowReasons = [
+    ...fiveHourWindow === void 0 || five === void 0 ? [] : [describeWindow("5h", fiveHourWindow, five, nowMs)],
+    ...sevenDayWindow === void 0 || seven === void 0 ? [] : [describeWindow("7d", sevenDayWindow, seven, nowMs)]
+  ];
+  const blockedUntil = Math.max(
+    windowBlockedUntil([five, seven].flatMap((window) => window === void 0 ? [] : [window])) ?? 0,
+    limitBlockedUntil(state, nowMs) ?? 0
+  );
+  if (blockedUntil > nowMs) {
+    if (unified.overageStatus === "allowed") {
+      return { candidate: { ...base, class: "pay-per-use", reasons: [`plan exhausted until ${new Date(blockedUntil).toISOString()}, continues as extra usage`, ...windowReasons, ...planReasons] } };
+    }
+    return { candidate: { ...base, class: "ineligible", blockedUntilMs: blockedUntil, reasons: [`refused until ${new Date(blockedUntil).toISOString()} (in ${formatAge(blockedUntil - nowMs)})`, ...windowReasons, ...planReasons] } };
+  }
+  if (plan.kind === "pay-per-use" || fiveHourWindow === void 0 && sevenDayWindow === void 0) {
+    return { candidate: { ...base, class: "pay-per-use", reasons: [...plan.kind === "pay-per-use" ? planReasons : ["no plan windows reported, so usage bills as extra usage"]] } };
+  }
+  const basis = seven?.utilization !== void 0 ? { window: seven, windowMs: SEVEN_DAY_WINDOW_MS } : five?.utilization !== void 0 ? { window: five, windowMs: FIVE_HOUR_WINDOW_MS } : void 0;
+  if (basis?.window.utilization === void 0) {
+    return { candidate: { ...base, class: "unknown", reasons: ["quota windows reported no utilisation", ...windowReasons, ...planReasons] } };
+  }
+  const remaining = Math.max(0, 1 - basis.window.utilization);
+  const untilResetMs = basis.window.resetsAtMs === void 0 ? basis.windowMs : Math.max(basis.window.resetsAtMs - nowMs, MS_PER_SECOND4);
+  const score = remaining * plan.capacity / (untilResetMs / MS_PER_HOUR);
+  const fiveRemaining = five?.utilization === void 0 ? void 0 : Math.max(0, 1 - five.utilization);
+  const fiveUntil = five?.resetsAtMs === void 0 ? FIVE_HOUR_WINDOW_MS : Math.max(five.resetsAtMs - nowMs, MS_PER_SECOND4);
+  const burn = fiveHourBurn(member.records);
+  return {
+    candidate: { ...base, class: "scored", score, reasons: [...windowReasons.map((reason, index) => index === windowReasons.length - 1 ? `${reason}${observedAgo}` : reason), ...planReasons] },
+    ...fiveRemaining === void 0 ? {} : { fiveHour: { remaining: fiveRemaining, untilResetMs: fiveUntil } },
+    ...burn === void 0 ? {} : { burn }
+  };
+}
+function rankPool(input) {
+  const { members, nowMs } = input;
+  const assessments = members.map((member) => assess(member, nowMs));
+  const demands = assessments.flatMap(({ candidate, burn }) => burn === void 0 ? [] : [burn * capacityOf(candidate.plan)]);
+  const sharedDemand = demands.length === 0 ? void 0 : Math.max(...demands);
+  const candidates = assessments.map((assessment) => {
+    const { candidate, fiveHour, burn } = assessment;
+    const pace = burn ?? (sharedDemand === void 0 ? void 0 : sharedDemand / capacityOf(candidate.plan));
+    if (candidate.class !== "scored" || fiveHour === void 0 || pace === void 0) {
+      return { ...candidate, feasible: true };
+    }
+    const runsDryInMs = fiveHour.remaining / pace;
+    if (runsDryInMs >= fiveHour.untilResetMs) {
+      return { ...candidate, feasible: true };
+    }
+    return { ...candidate, feasible: false, reasons: [`5h window would run dry in ${formatAge(runsDryInMs)}, before it resets in ${formatAge(fiveHour.untilResetMs)}`, ...candidate.reasons] };
+  });
+  const ordered = [...candidates].sort(
+    (left, right) => CLASS_ORDER[left.class] - CLASS_ORDER[right.class] || Number(right.feasible) - Number(left.feasible) || (right.score ?? 0) - (left.score ?? 0) || left.identity.localeCompare(right.identity)
+  );
+  const sticky = input.sticky;
+  const stickyIndex = sticky === void 0 ? -1 : ordered.findIndex((candidate) => candidate.identity === sticky.identity);
+  const stickyCandidate = ordered[stickyIndex];
+  if (sticky !== void 0 && stickyCandidate?.class === "scored" && stickyCandidate.feasible) {
+    const ageMs = nowMs - Date.parse(sticky.at);
+    const warm = ageMs <= PROMPT_CACHE_TTL_MS;
+    if (input.resuming || warm) {
+      const why = warm ? `used here ${formatAge(ageMs)} ago, prompt cache still warm` : "resuming a conversation started on this account";
+      ordered.splice(stickyIndex, 1);
+      ordered.unshift({ ...stickyCandidate, reasons: [why, ...stickyCandidate.reasons] });
+    }
+  }
+  const pick = ordered.find((candidate) => candidate.class !== "ineligible");
+  const returns = ordered.flatMap((candidate) => candidate.blockedUntilMs === void 0 ? [] : [{ identity: candidate.identity, atMs: candidate.blockedUntilMs }]);
+  const earliestReturn = returns.length === 0 ? void 0 : returns.reduce((soonest, entry) => entry.atMs < soonest.atMs ? entry : soonest);
+  return {
+    candidates: ordered,
+    ...pick === void 0 ? { ...earliestReturn === void 0 ? {} : { earliestReturn } } : { pick }
+  };
+}
+
+// src/usage/store.ts
+var DAY_MS2 = 864e5;
+var DAYS_IN_WEEK = 7;
+var USAGE_RETENTION_MS = DAYS_IN_WEEK * DAY_MS2;
+
+// src/usage/poolPick.ts
+var SCHEMA_VERSION = 1;
+var PickEntrySchema = import_zod9.z.strictObject({ identity: import_zod9.z.string().min(1), at: import_zod9.z.iso.datetime() });
+var PicksFileSchema = import_zod9.z.strictObject({
+  schemaVersion: import_zod9.z.literal(SCHEMA_VERSION),
+  picks: import_zod9.z.record(import_zod9.z.string().min(1), PickEntrySchema)
+});
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function loadPoolMembers(fs10, paths, identities, nowMs) {
+  const windowStartMs = nowMs - FIVE_HOUR_WINDOW_MS;
+  const log = readUsageLog(fs10, paths.usageLogDir, { sinceMs: windowStartMs });
+  return identities.map((identity) => {
+    const records = log.records.filter((record) => record.identity === identity && record.provider === ANTHROPIC_PROVIDER && Date.parse(record.at) >= windowStartMs);
+    try {
+      const snapshot = readUsageSnapshot(fs10, paths.usageSnapshotsDir, identity);
+      const account = readAccountMetadata(fs10, paths.identitiesDir, identity) ?? snapshot?.account;
+      return { identity, records, ...snapshot === void 0 ? {} : { snapshot }, ...account === void 0 ? {} : { account } };
+    } catch (error) {
+      if (error instanceof UsageSnapshotError || error instanceof AccountMetadataError) {
+        return { identity, records, readError: errorMessage(error) };
+      }
+      throw error;
+    }
+  });
+}
+function rankPoolFromStore(params) {
+  return rankPool({
+    members: loadPoolMembers(params.fs, params.paths, params.identities, params.nowMs),
+    nowMs: params.nowMs,
+    resuming: params.resuming,
+    ...params.sticky === void 0 ? {} : { sticky: params.sticky }
+  });
+}
+function readPicksFile(fs10, file) {
+  const empty = { schemaVersion: SCHEMA_VERSION, picks: {} };
+  const raw = fs10.readFileUtf8(file);
+  if (raw === void 0) {
+    return { file: empty };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { file: empty, problem: `${file} is not valid JSON` };
+  }
+  const result = PicksFileSchema.safeParse(parsed);
+  return result.success ? { file: result.data } : { file: empty, problem: `${file} is not a picks file this agent-shim can read` };
+}
+function readStickyPick(fs10, picksFile, directory) {
+  const read = readPicksFile(fs10, picksFile);
+  const entry = read.file.picks[directory];
+  return { ...entry === void 0 ? {} : { sticky: entry }, ...read.problem === void 0 ? {} : { problem: read.problem } };
+}
+
+// src/launcher/pool.ts
+function splitMembers(pool, paths, fs10) {
+  const exists = (name) => loadIdentity(paths.identitiesDir, name, fs10) !== void 0;
+  return { present: pool.identities.filter(exists), missing: pool.identities.filter((name) => !exists(name)) };
+}
+
+// src/poolPickReport.ts
+function candidateView(candidate) {
+  return {
+    identity: candidate.identity,
+    class: candidate.class,
+    ...candidate.score === void 0 ? {} : { score: candidate.score },
+    feasible: candidate.feasible,
+    ...candidate.blockedUntilMs === void 0 ? {} : { blockedUntil: new Date(candidate.blockedUntilMs).toISOString() },
+    plan: candidate.plan,
+    reasons: candidate.reasons
+  };
+}
+function collectPoolPick(params) {
+  const { present, missing } = splitMembers(params.pool, params.paths, params.fs);
+  const sticky = readStickyPick(params.usageFs, params.paths.usagePicksFile, params.directory);
+  const ranking = rankPoolFromStore({
+    fs: params.usageFs,
+    paths: params.paths,
+    identities: present,
+    nowMs: params.nowMs,
+    resuming: false,
+    ...sticky.sticky === void 0 ? {} : { sticky: sticky.sticky }
+  });
+  return {
+    pool: params.poolName,
+    directory: params.directory,
+    ...ranking.pick === void 0 ? {} : { pick: ranking.pick.identity },
+    candidates: ranking.candidates.map(candidateView),
+    missing,
+    ...ranking.earliestReturn === void 0 ? {} : { earliestReturn: { identity: ranking.earliestReturn.identity, at: new Date(ranking.earliestReturn.atMs).toISOString() } },
+    ...sticky.problem === void 0 ? {} : { stickyProblem: sticky.problem }
+  };
+}
+
+// src/realPorts.ts
+var import_node_child_process = require("node:child_process");
+var import_node_crypto8 = require("node:crypto");
+var import_node_fs6 = __toESM(require("node:fs"), 1);
+var import_node_path19 = __toESM(require("node:path"), 1);
+var import_node_sea = require("node:sea");
+
+// src/versionDiscovery.ts
+var import_node_os2 = __toESM(require("node:os"), 1);
+var import_node_path18 = __toESM(require("node:path"), 1);
+function defaultVersionsDir() {
+  return import_node_path18.default.join(import_node_os2.default.homedir(), ".local", "share", "claude", "versions");
+}
+var NUMERIC_DOTTED_VERSION_RE = /^\d+(?:\.\d+)*$/;
+function isNumericDottedVersion(name) {
+  return NUMERIC_DOTTED_VERSION_RE.test(name);
+}
+function compareVersions2(a, b) {
+  if (!isNumericDottedVersion(a)) {
+    throw new Error(`compareVersions: "${a}" is not a valid plain dotted-numeric version`);
+  }
+  if (!isNumericDottedVersion(b)) {
+    throw new Error(`compareVersions: "${b}" is not a valid plain dotted-numeric version`);
+  }
+  const segmentsA = a.split(".").map(Number);
+  const segmentsB = b.split(".").map(Number);
+  const length = Math.max(segmentsA.length, segmentsB.length);
+  for (let i = 0; i < length; i += 1) {
+    const segmentA = segmentsA[i] ?? 0;
+    const segmentB = segmentsB[i] ?? 0;
+    if (segmentA !== segmentB) {
+      return segmentA - segmentB;
+    }
+  }
+  return 0;
+}
+function pickHighestVersion(entries) {
+  const candidates = entries.filter(
+    (entry) => entry.isFile && entry.isExecutable && entry.sizeBytes > 0 && isNumericDottedVersion(entry.name)
+  );
+  if (candidates.length === 0) {
+    return void 0;
+  }
+  return candidates.reduce(
+    (highest, candidate) => compareVersions2(candidate.name, highest.name) > 0 ? candidate : highest
+  ).name;
+}
+function discoverClaudeBinary(options) {
+  const versionsDir = options.versionsDir ?? defaultVersionsDir();
+  const entries = options.listVersionsDir(versionsDir);
+  const highestVersion = pickHighestVersion(entries);
+  if (highestVersion !== void 0) {
+    return {
+      path: import_node_path18.default.join(versionsDir, highestVersion),
+      source: "versions-dir",
+      version: highestVersion
+    };
+  }
+  const ownInstallDirs = new Set(options.ownInstallDirs.map((dir) => import_node_path18.default.resolve(dir)));
+  for (const dir of options.pathDirs) {
+    if (ownInstallDirs.has(import_node_path18.default.resolve(dir))) {
+      continue;
+    }
+    const found = options.findExecutableInDir(dir, "claude");
+    if (found !== void 0) {
+      return { path: found, source: "path-fallback" };
+    }
+  }
+  throw new Error(
+    `Could not find a claude binary. Looked for genuinely-executable versioned binaries under "${versionsDir}" (missing, empty, or containing nothing executable) and for a "claude" executable on PATH (excluding this tool's own install directory). Install Claude Code, or set the versions directory / PATH correctly, then try again.`
+  );
+}
+
+// src/realPorts.ts
+function isEnoent3(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+var realFsPort = {
+  readFileUtf8(filePath) {
+    try {
+      return import_node_fs6.default.readFileSync(filePath, "utf8");
+    } catch (error) {
+      if (isEnoent3(error)) {
+        return void 0;
+      }
+      throw error;
+    }
+  },
+  readConfigFile: cosmiconfigReader(),
+  readdir(dirPath) {
+    try {
+      return import_node_fs6.default.readdirSync(dirPath);
+    } catch (error) {
+      if (isEnoent3(error)) {
+        return [];
+      }
+      throw error;
+    }
+  }
+};
+function isErrorWithCode(error, code) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === code;
+}
+var OWNER_ONLY_DIR_MODE = 448;
+var OWNER_ONLY_FILE_MODE = 384;
+var PERMISSION_BITS = 511;
+var realFarmFs = {
+  lstat(filePath) {
+    let stat;
+    try {
+      stat = import_node_fs6.default.lstatSync(filePath);
+    } catch (error) {
+      if (isEnoent3(error)) {
+        return void 0;
+      }
+      throw error;
+    }
+    const kind = stat.isSymbolicLink() ? "symlink" : stat.isDirectory() ? "dir" : "file";
+    return { kind, mtimeMs: stat.mtimeMs, sizeBytes: stat.size };
+  },
+  readdir(dirPath) {
+    try {
+      return import_node_fs6.default.readdirSync(dirPath);
+    } catch (error) {
+      if (isEnoent3(error) || isErrorWithCode(error, "ENOTDIR")) {
+        return [];
+      }
+      throw error;
+    }
+  },
+  mkdirp(dirPath) {
+    import_node_fs6.default.mkdirSync(dirPath, { recursive: true });
+  },
+  symlink(target, linkPath) {
+    import_node_fs6.default.symlinkSync(target, linkPath);
+  },
+  rename(from, to) {
+    import_node_fs6.default.renameSync(from, to);
+  },
+  removeRecursive(targetPath) {
+    import_node_fs6.default.rmSync(targetPath, { recursive: true, force: true });
+  },
+  copyRecursive(from, to) {
+    import_node_fs6.default.cpSync(from, to, { recursive: true, force: true, verbatimSymlinks: true });
+  },
+  readFileUtf8(filePath) {
+    try {
+      return import_node_fs6.default.readFileSync(filePath, "utf8");
+    } catch (error) {
+      if (isEnoent3(error)) {
+        return void 0;
+      }
+      throw error;
+    }
+  },
+  writeFileUtf8(filePath, contents) {
+    import_node_fs6.default.writeFileSync(filePath, contents, "utf8");
+  },
+  mkdirPrivate(dirPath) {
+    import_node_fs6.default.mkdirSync(dirPath, { recursive: true, mode: OWNER_ONLY_DIR_MODE });
+    import_node_fs6.default.chmodSync(dirPath, OWNER_ONLY_DIR_MODE);
+  },
+  writeFilePrivate(filePath, contents) {
+    const temp = `${filePath}.${String(process.pid)}.tmp`;
+    import_node_fs6.default.writeFileSync(temp, contents, { encoding: "utf8", mode: OWNER_ONLY_FILE_MODE });
+    import_node_fs6.default.chmodSync(temp, OWNER_ONLY_FILE_MODE);
+    import_node_fs6.default.renameSync(temp, filePath);
+  },
+  appendFilePrivate(filePath, contents) {
+    const descriptor = import_node_fs6.default.openSync(filePath, "a", OWNER_ONLY_FILE_MODE);
+    try {
+      if ((import_node_fs6.default.fstatSync(descriptor).mode & PERMISSION_BITS) !== OWNER_ONLY_FILE_MODE) {
+        import_node_fs6.default.fchmodSync(descriptor, OWNER_ONLY_FILE_MODE);
+      }
+      const bytes = Buffer.from(contents, "utf8");
+      let written = 0;
+      while (written < bytes.length) {
+        written += import_node_fs6.default.writeSync(descriptor, bytes, written, bytes.length - written);
+      }
+    } finally {
+      import_node_fs6.default.closeSync(descriptor);
+    }
+  },
+  writeFileExclusive(filePath, contents) {
+    try {
+      import_node_fs6.default.writeFileSync(filePath, contents, { encoding: "utf8", flag: "wx" });
+      return true;
+    } catch (error) {
+      if (isErrorWithCode(error, "EEXIST")) {
+        return false;
+      }
+      throw error;
+    }
+  },
+  hashFile(filePath) {
+    try {
+      return (0, import_node_crypto8.createHash)("sha256").update(import_node_fs6.default.readFileSync(filePath)).digest("hex");
+    } catch (error) {
+      if (isEnoent3(error) || isErrorWithCode(error, "EISDIR")) {
+        return void 0;
+      }
+      throw error;
+    }
+  }
+};
+function realIsProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return isErrorWithCode(error, "EPERM");
+  }
+}
+function realIsProcessZombie(pid) {
+  const result = (0, import_node_child_process.spawnSync)("ps", ["-o", "stat=", "-p", String(pid)], { encoding: "utf8" });
+  return result.status === 0 && result.stdout.trim().startsWith("Z");
+}
+function realIsProcessRunning(pid) {
+  return realIsProcessAlive(pid) && !realIsProcessZombie(pid);
+}
+var realRunPort = {
+  run(command, args) {
+    const result = (0, import_node_child_process.spawnSync)(command, [...args], { encoding: "utf8" });
+    return { status: result.status, stdout: result.stdout, stderr: result.stderr };
+  }
+};
+function resolveGitBranch(run, cwd) {
+  const result = run.run("git", ["-C", cwd, "rev-parse", "--abbrev-ref", "HEAD"]);
+  if (result.status !== 0) {
+    return {};
+  }
+  const name = result.stdout.trim();
+  if (name === "") {
+    return {};
+  }
+  if (name === "HEAD") {
+    return { branchDetached: true };
+  }
+  return { branch: name, branchDetached: false };
+}
+var realProcPort = {
+  env: process.env,
+  argv: process.argv.slice(2),
+  exit: (code) => process.exit(code)
+};
+var EXECUTE_BITS_MASK = 73;
+function listVersionsDir(dir) {
+  let entries;
+  try {
+    entries = import_node_fs6.default.readdirSync(dir, { withFileTypes: true });
+  } catch (error) {
+    if (isEnoent3(error)) {
+      return [];
+    }
+    throw error;
+  }
+  return entries.filter((entry) => entry.isFile()).map((entry) => {
+    const fullPath = import_node_path19.default.join(dir, entry.name);
+    const stat = import_node_fs6.default.statSync(fullPath);
+    return {
+      name: entry.name,
+      isFile: true,
+      isExecutable: (stat.mode & EXECUTE_BITS_MASK) !== 0,
+      sizeBytes: stat.size
+    };
+  });
+}
+var WINDOWS_DEFAULT_PATHEXT = ".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC;.PS1";
+function windowsPathExtensions(pathext) {
+  return (pathext ?? WINDOWS_DEFAULT_PATHEXT).split(";").map((ext) => ext.trim()).filter((ext) => ext.length > 0);
+}
+function resolveExecutableCandidate(dir, name, env) {
+  const candidate = import_node_path19.default.join(dir, name);
+  if (env.platform === "win32") {
+    const extensions = windowsPathExtensions(env.pathext);
+    const alreadyHasRecognisedExtension = extensions.some((ext) => candidate.toLowerCase().endsWith(ext.toLowerCase()));
+    if (alreadyHasRecognisedExtension) {
+      return env.statFileMode(candidate) !== void 0 ? candidate : void 0;
+    }
+    for (const ext of extensions) {
+      const withExt = candidate + ext;
+      if (env.statFileMode(withExt) !== void 0) {
+        return withExt;
+      }
+    }
+    return void 0;
+  }
+  const mode = env.statFileMode(candidate);
+  return mode !== void 0 && (mode & EXECUTE_BITS_MASK) !== 0 ? candidate : void 0;
+}
+function realStatFileMode(candidate) {
+  try {
+    const stat = import_node_fs6.default.statSync(candidate);
+    return stat.isFile() ? stat.mode : void 0;
+  } catch (error) {
+    if (isEnoent3(error)) {
+      return void 0;
+    }
+    throw error;
+  }
+}
+function findExecutableInDir(dir, name) {
+  return resolveExecutableCandidate(dir, name, {
+    platform: process.platform,
+    pathext: process.env.PATHEXT,
+    statFileMode: realStatFileMode
+  });
+}
+function searchPathForExecutable(pathDirs, name, findExecutable) {
+  for (const dir of pathDirs) {
+    const found = findExecutable(dir, name);
+    if (found !== void 0) {
+      return found;
+    }
+  }
+  return void 0;
+}
+function resolveOwnExecutablePath(env) {
+  if (env.argv1 !== void 0 && !env.argv1.includes("/") && !env.argv1.includes("\\")) {
+    return searchPathForExecutable(env.pathDirs, env.argv1, env.findExecutableInDir) ?? env.execPath;
+  }
+  const candidate = env.argv1 === void 0 ? env.execPath : import_node_path19.default.resolve(env.cwd, env.argv1);
+  const candidateDir = import_node_path19.default.dirname(candidate);
+  const candidateDirOnPath = env.pathDirs.some((dir) => import_node_path19.default.resolve(dir) === candidateDir);
+  if (candidateDirOnPath) {
+    return candidate;
+  }
+  const viaPath = searchPathForExecutable(env.pathDirs, import_node_path19.default.basename(candidate), env.findExecutableInDir);
+  return viaPath ?? candidate;
+}
+function realOwnExecutablePath() {
+  return resolveOwnExecutablePath({
+    argv1: process.argv[1],
+    execPath: process.execPath,
+    cwd: process.cwd(),
+    pathDirs: (process.env.PATH ?? "").split(import_node_path19.default.delimiter).filter((dir) => dir !== ""),
+    findExecutableInDir
+  });
+}
+function realResolveClaudeBinary(ownInstallDirs) {
+  return () => discoverClaudeBinary({
+    listVersionsDir,
+    pathDirs: (process.env.PATH ?? "").split(import_node_path19.default.delimiter).filter((dir) => dir !== ""),
+    findExecutableInDir,
+    ownInstallDirs: [...ownInstallDirs]
+  });
+}
+
+// src/checkReport.ts
+var import_node_path20 = __toESM(require("node:path"), 1);
+var import_zod10 = require("zod");
+
+// src/cli/bool.ts
+function parseBoolWord(input) {
+  switch (input) {
+    case "true":
+    case "1":
+      return true;
+    case "false":
+    case "0":
+      return false;
+    default:
+      return void 0;
+  }
+}
+
+// src/cli/envBool.ts
+var InvalidEnvBoolError = class extends UsageError {
+  constructor(variable, value) {
+    super(`${variable} must be one of true, false, 1 or 0, got "${value}".`);
+    this.variable = variable;
+    this.value = value;
+    this.name = "InvalidEnvBoolError";
+  }
+  variable;
+  value;
+};
+function parseEnvBool(variable, value) {
+  if (value === void 0 || value === "") {
+    return void 0;
+  }
+  const parsed = parseBoolWord(value);
+  if (parsed === void 0) {
+    throw new InvalidEnvBoolError(variable, value);
+  }
+  return parsed;
+}
+
+// src/checkReport.ts
+var HISTORY_PROJECTS_KEY_PREFIX = "history/projects/";
+function projectFragmentOf(rawKey) {
+  return rawKey.startsWith(HISTORY_PROJECTS_KEY_PREFIX) ? rawKey.slice(HISTORY_PROJECTS_KEY_PREFIX.length) : void 0;
+}
+function existingProjectNames(facts) {
+  const names = /* @__PURE__ */ new Set();
+  const prefix = "projects/";
+  for (const rel of facts.entries.keys()) {
+    if (!rel.startsWith(prefix)) {
+      continue;
+    }
+    const rest = rel.slice(prefix.length);
+    const head = rest.split("/")[0];
+    if (head !== void 0 && head !== "") {
+      names.add(head);
+    }
+  }
+  return [...names];
+}
+function flagAmbiguousEncodings(flattened, facts) {
+  const fragments = [];
+  for (const rule of flattened.rules.values()) {
+    const fragment = projectFragmentOf(rule.rawKey);
+    if (fragment !== void 0) {
+      fragments.push(fragment);
+    }
+  }
+  if (fragments.length === 0) {
+    return [];
+  }
+  return detectEncodingAmbiguity(fragments, { home: facts.home, existingNames: existingProjectNames(facts) });
+}
+function formatDecision(decision) {
+  const status = decision.shared ? "shared" : "hidden";
+  let reason;
+  switch (decision.via) {
+    case "secret-floor":
+      reason = "secret (never shared, cannot be overridden by any layer)";
+      break;
+    case "unclassified":
+      reason = "unclassified entry (no category recognises it)";
+      break;
+    case "entry-rule":
+      reason = decision.rule === void 0 ? "an entries rule" : `entries rule "${decision.rule.rawKey}" from layer ${String(decision.rule.layer)}`;
+      break;
+    case "category-override":
+      reason = `category "${decision.category ?? "?"}" overridden by a layer`;
+      break;
+    case "category-default":
+      reason = `category "${decision.category ?? "?"}" shipped default`;
+      break;
+  }
+  const eliminatedNote = decision.eliminated !== void 0 && decision.eliminated.length > 0 ? ` [${String(decision.eliminated.length)} more specific rule(s) eliminated by a failing when-condition]` : "";
+  return `${decision.relPath}: ${status} \u2014 ${reason}${eliminatedNote}`;
+}
+function parseKeychainServiceName(stderr) {
+  const match = /"svce"<blob>="([^"]*)"/.exec(stderr);
+  return match?.[1];
+}
+function lookupKeychainService(run, farmRoot) {
+  const result = run.run("security", ["find-generic-password", "-a", farmRoot, "-g"]);
+  if (result.status !== 0) {
+    return {
+      checked: true,
+      found: false,
+      note: `No Keychain entry found for account "${farmRoot}" (security exited ${result.status === null ? "with no status" : String(result.status)}).`
+    };
+  }
+  const serviceName = parseKeychainServiceName(result.stderr);
+  return {
+    checked: true,
+    found: true,
+    ...serviceName === void 0 ? {} : { serviceName },
+    note: serviceName === void 0 ? `A Keychain entry was found for account "${farmRoot}" but its service name could not be parsed from security's output.` : `Keychain service name for this identity: "${serviceName}".`
+  };
+}
+var SettingsSecretsShapeSchema = import_zod10.z.looseObject({
+  env: import_zod10.z.record(import_zod10.z.string(), import_zod10.z.unknown()).optional(),
+  hooks: import_zod10.z.record(import_zod10.z.string(), import_zod10.z.array(import_zod10.z.unknown())).optional()
+});
+function hookCommandCountOf(group) {
+  if (typeof group !== "object" || group === null) {
+    return 0;
+  }
+  if (!("hooks" in group)) {
+    return 0;
+  }
+  return Array.isArray(group.hooks) ? group.hooks.length : 0;
+}
+function countHookCommands(hooks) {
+  if (hooks === void 0) {
+    return 0;
+  }
+  let total = 0;
+  for (const groups of Object.values(hooks)) {
+    for (const group of groups) {
+      total += hookCommandCountOf(group);
+    }
+  }
+  return total;
+}
+function inspectSettingsExposure(params) {
+  if (!params.settingsShared) {
+    return [];
+  }
+  const reports = [];
+  for (const [file, raw] of Object.entries(params.files)) {
+    if (raw === void 0) {
+      continue;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      continue;
+    }
+    const result = SettingsSecretsShapeSchema.safeParse(parsed);
+    if (!result.success) {
+      continue;
+    }
+    const envKeyNames = Object.keys(result.data.env ?? {});
+    const hookEventNames = Object.keys(result.data.hooks ?? {});
+    const hookCommandCount = countHookCommands(result.data.hooks);
+    if (envKeyNames.length === 0 && hookCommandCount === 0) {
+      continue;
+    }
+    reports.push({ file, envKeyNames, hookEventNames, hookCommandCount });
+  }
+  return reports;
+}
+function buildCredentialReport(provider, identity) {
+  const identityCredential = identity?.credential === void 0 ? void 0 : summariseCredential(identity.credential);
+  return {
+    applies: provider !== void 0 ? "provider" : identityCredential !== void 0 ? "identity" : "stored-login",
+    ...provider === void 0 ? {} : {
+      provider: provider.problem === void 0 ? { name: provider.name, credential: summariseCredential(provider.definition.credential) } : { name: provider.name, problem: provider.problem }
+    },
+    ...identityCredential === void 0 ? {} : { identity: identityCredential }
+  };
+}
+function runCheck(params) {
+  const facts = buildEntryFacts({
+    fs: params.farmFs,
+    claudeHome: params.claudeHome,
+    home: params.home,
+    cwd: params.cwd,
+    nowMs: params.nowMs,
+    env: params.env,
+    ...params.branch === void 0 ? {} : { branch: params.branch },
+    ...params.branchDetached === void 0 ? {} : { branchDetached: params.branchDetached }
+  });
+  const resolved = resolveDecisions({ facts, cascade: params.cascade, classification: params.classification });
+  const decisionLines = [...resolved.decisions.values()].slice().sort((a, b) => a.relPath < b.relPath ? -1 : a.relPath > b.relPath ? 1 : 0).map(formatDecision);
+  const projectEncodingAmbiguities = flagAmbiguousEncodings(resolved.flattened, facts);
+  const ambientCredential = evaluateAmbientCredentialGuard({
+    env: params.env,
+    allowAmbientCredential: params.identity?.allowAmbientCredential ?? false,
+    allowAmbientCredentialOverride: parseEnvBool("AGENT_SHIM_ALLOW_AMBIENT_CREDENTIAL", params.env.AGENT_SHIM_ALLOW_AMBIENT_CREDENTIAL) === true,
+    ...params.identityName === void 0 ? {} : { identityName: params.identityName }
+  });
+  const settingsShared = resolved.flattened.categories.get("settings") ?? SHIPPED_CATEGORY_DEFAULTS.settings;
+  const settingsExposure = inspectSettingsExposure({ settingsShared, files: params.settingsFiles });
+  const keychain = params.platform === "darwin" && params.run !== void 0 && params.farmRoot !== void 0 ? lookupKeychainService(params.run, params.farmRoot) : void 0;
+  return {
+    ...params.identityName === void 0 ? {} : { identityName: params.identityName },
+    identitySource: params.identitySource,
+    ...params.poolPick === void 0 ? {} : { poolPick: params.poolPick },
+    ...params.configProfileName === void 0 ? {} : { configProfileName: params.configProfileName },
+    configProfileSource: params.configProfileSource,
+    resolved,
+    decisionLines,
+    projectEncodingAmbiguities,
+    ambientCredential,
+    ...keychain === void 0 ? {} : { keychain },
+    settingsExposure,
+    credential: buildCredentialReport(params.provider, params.identity)
+  };
+}
+function formatCheckReport(report) {
+  const lines = [];
+  lines.push(`Identity: ${report.identityName ?? "(none)"} (${report.identitySource})`);
+  if (report.poolPick !== void 0) {
+    const top = report.poolPick.candidates.find((candidate) => candidate.identity === report.poolPick?.pick);
+    lines.push(`Pool: ${report.poolPick.pool}${top === void 0 ? ", every member is refused right now" : `, would pick ${top.identity} (${top.reasons.join("; ")})`}`);
+  }
+  lines.push(`Configuration profile: ${report.configProfileName ?? "(none)"} (${report.configProfileSource})`);
+  lines.push("", "Layers (shallowest/earliest first):");
+  for (const layer of report.resolved.assembled.layers) {
+    lines.push(`  [${String(layer.id)}] ${layer.kind}: ${layer.source}`);
+  }
+  lines.push("", "Resolved entries:");
+  if (report.decisionLines.length === 0) {
+    lines.push("  (nothing under ~/.claude to report)");
+  }
+  for (const line of report.decisionLines) {
+    lines.push(`  ${line}`);
+  }
+  if (report.projectEncodingAmbiguities.length > 0) {
+    lines.push("", "Ambiguous history/projects/ encodings:");
+    for (const ambiguity of report.projectEncodingAmbiguities) {
+      lines.push(`  "${ambiguity.fragment}" -> "${ambiguity.encoded}" (${ambiguity.reason}): ${ambiguity.detail}`);
+    }
+  }
+  if (report.resolved.diagnostics.length > 0) {
+    lines.push("", "Diagnostics:");
+    for (const diagnostic of report.resolved.diagnostics) {
+      lines.push(`  [${diagnostic.severity}] ${diagnostic.code}: ${diagnostic.message}`);
+    }
+  }
+  lines.push("", "Credential (source kinds and targets only, never values):");
+  const { credential } = report;
+  if (credential.provider !== void 0) {
+    lines.push(
+      `  Provider ${credential.provider.name}: ${credential.provider.credential === void 0 ? `unusable: ${credential.provider.problem ?? ""}` : formatCredentialSummary(credential.provider.credential)}`
+    );
+  }
+  if (credential.identity !== void 0) {
+    lines.push(
+      `  Identity ${report.identityName ?? "(none)"}: ${formatCredentialSummary(credential.identity)}${credential.applies === "provider" ? " (not used: the provider's credential applies)" : ""}`
+    );
+  }
+  if (credential.applies === "stored-login") {
+    lines.push("  The identity's stored login (no credential block applies).");
+  }
+  lines.push("", "Ambient-credential exposure:");
+  lines.push(
+    report.ambientCredential.ok ? `  OK \u2014 none of ${AMBIENT_CREDENTIAL_VARS.join(", ")} is set to a non-empty value.` : report.ambientCredential.message.split("\n").map((line) => `  ${line}`).join("\n")
+  );
+  if (report.keychain !== void 0) {
+    lines.push("", "macOS Keychain:");
+    lines.push(`  ${report.keychain.note}`);
+  }
+  if (report.settingsExposure.length > 0) {
+    lines.push("", "Settings exposure (names and counts only, never values):");
+    for (const exposure of report.settingsExposure) {
+      lines.push(
+        `  ${exposure.file}: ${String(exposure.envKeyNames.length)} env key(s) [${exposure.envKeyNames.join(", ")}], ${String(exposure.hookEventNames.length)} hook event(s) [${exposure.hookEventNames.join(", ")}], ${String(exposure.hookCommandCount)} hook command(s)`
+      );
+    }
+  }
+  return lines;
+}
+function checkReportToJson(report) {
+  const decisions = [...report.resolved.decisions.values()].sort((a, b) => a.relPath < b.relPath ? -1 : a.relPath > b.relPath ? 1 : 0);
+  return {
+    identity: { name: report.identityName ?? null, source: report.identitySource },
+    ...report.poolPick === void 0 ? {} : { pool: report.poolPick },
+    configProfile: { name: report.configProfileName ?? null, source: report.configProfileSource },
+    layers: report.resolved.assembled.layers.map((layer) => ({ id: layer.id, kind: layer.kind, source: layer.source })),
+    entries: decisions.map((decision) => ({
+      path: decision.relPath,
+      shared: decision.shared,
+      via: decision.via,
+      category: decision.category,
+      ...decision.rule === void 0 ? {} : { rule: { key: decision.rule.rawKey, layer: decision.rule.layer } },
+      ...decision.eliminated === void 0 || decision.eliminated.length === 0 ? {} : { eliminated: decision.eliminated.map((eliminated) => ({ key: eliminated.rule.rawKey, failed: eliminated.failed })) }
+    })),
+    projectEncodingAmbiguities: report.projectEncodingAmbiguities,
+    diagnostics: report.resolved.diagnostics,
+    ambientCredential: report.ambientCredential.ok ? { ok: true } : { ok: false, variable: report.ambientCredential.variable, message: report.ambientCredential.message },
+    ...report.keychain === void 0 ? {} : { keychain: report.keychain },
+    settingsExposure: report.settingsExposure,
+    credential: report.credential
+  };
+}
+function checkReportHasWarnings(report) {
+  return report.resolved.diagnostics.some((diagnostic) => diagnostic.severity !== "info") || report.projectEncodingAmbiguities.length > 0 || !report.ambientCredential.ok || report.credential.provider?.problem !== void 0;
+}
+function loadCheckProvider(paths, name) {
+  let definition;
+  try {
+    definition = readProvider(paths, name);
+  } catch (error) {
+    if (error instanceof ConfigValidationError || error instanceof LegacyProviderFileError) {
+      return { name, problem: error.message };
+    }
+    throw error;
+  }
+  return definition === void 0 ? { name, problem: `no provider named "${name}"` } : { name, definition };
+}
+function collectCheckReport(params) {
+  const { paths, cwd } = params;
+  const home = import_node_os3.default.homedir();
+  const claudeHome = resolveClaudeHome();
+  const read = cosmiconfigReader();
+  const classification = loadClassification(paths);
+  const loaded = loadCascadeInput({ paths, home, cwd, read });
+  const selections = readDirectorySelections(loaded);
+  const git = resolveGitBranch(realRunPort, cwd);
+  const decidedIdentity = decideIdentity({
+    env: params.env,
+    argv0Identity: params.identity,
+    directoryPinnedIdentity: selections.identity,
+    readActiveIdentityFile: () => {
+      const raw = realFsPort.readFileUtf8(paths.activeIdentityFile);
+      if (raw === void 0) {
+        return void 0;
+      }
+      const trimmed = raw.trim();
+      return trimmed === "" ? void 0 : trimmed;
+    }
+  });
+  let poolPick;
+  if (decidedIdentity.pool !== void 0) {
+    const pool = loaded.globalConfig?.pools?.[decidedIdentity.pool];
+    if (pool === void 0) {
+      throw new PoolNotFoundError(decidedIdentity.pool);
+    }
+    poolPick = collectPoolPick({ paths, fs: realFsPort, usageFs: realFarmFs, poolName: decidedIdentity.pool, pool, directory: cwd, nowMs: Date.now() });
+  }
+  const identityDecision = poolPick?.pick === void 0 ? decidedIdentity : { ...decidedIdentity, name: poolPick.pick };
+  const loadedIdentity = identityDecision.name === void 0 ? void 0 : loadIdentity(paths.identitiesDir, identityDecision.name, realFsPort);
+  const configProfileDecision = decideConfigProfile({
+    env: params.env,
+    directoryRuleConfigProfile: selections.configProfile,
+    identityDefaultConfigProfile: loadedIdentity?.config.defaultConfigProfile,
+    globalDefaultConfigProfile: loaded.globalConfig?.defaultConfigProfile
+  });
+  const cascade = loadCascadeInput({
+    paths,
+    home,
+    cwd,
+    read,
+    ...configProfileDecision.name === void 0 ? {} : { baseConfigProfile: configProfileDecision.name }
+  }).input;
+  const providerName = cascadeProviderName(cascade);
+  const provider = providerName === void 0 ? void 0 : loadCheckProvider(paths, providerName);
+  const farmRoot = identityDecision.name === void 0 ? void 0 : import_node_path20.default.join(paths.identitiesDir, identityDecision.name);
+  const settingsFiles = {
+    "settings.json": realFsPort.readFileUtf8(import_node_path20.default.join(claudeHome, "settings.json")),
+    "settings.local.json": realFsPort.readFileUtf8(import_node_path20.default.join(claudeHome, "settings.local.json"))
+  };
+  const report = runCheck({
+    cwd,
+    home,
+    claudeHome,
+    env: params.env,
+    ...git.branch === void 0 ? {} : { branch: git.branch },
+    ...git.branchDetached === void 0 ? {} : { branchDetached: git.branchDetached },
+    nowMs: Date.now(),
+    farmFs: realFarmFs,
+    cascade,
+    classification,
+    ...identityDecision.name === void 0 ? {} : { identityName: identityDecision.name },
+    identitySource: identityDecision.source,
+    ...poolPick === void 0 ? {} : { poolPick },
+    ...configProfileDecision.name === void 0 ? {} : { configProfileName: configProfileDecision.name },
+    configProfileSource: configProfileDecision.source,
+    ...loadedIdentity === void 0 ? {} : { identity: loadedIdentity.config },
+    settingsFiles,
+    run: realRunPort,
+    ...farmRoot === void 0 ? {} : { farmRoot },
+    platform: process.platform,
+    ...provider === void 0 ? {} : { provider }
+  });
+  return report;
+}
+
+// src/claudeShim.ts
+var import_node_fs7 = __toESM(require("node:fs"), 1);
+var import_node_path21 = __toESM(require("node:path"), 1);
+var import_zod11 = require("zod");
+var ClaudeShimStateSchema = import_zod11.z.strictObject({
+  targetPath: import_zod11.z.string().min(1),
+  method: import_zod11.z.enum(["hardlink", "copy"]),
+  installedAtMs: import_zod11.z.number()
+});
+function commandFilename(ownExecutablePath, commandName) {
+  return ownExecutablePath.toLowerCase().endsWith(".exe") ? `${commandName}.exe` : commandName;
+}
+function resolveOwnInstallDirs(paths, ownExecutablePath) {
+  const dirs = [import_node_path21.default.dirname(ownExecutablePath)];
+  const state = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
+  if (state !== void 0) {
+    dirs.push(import_node_path21.default.dirname(state.targetPath));
+  }
+  return dirs;
+}
+var nodeLinkFs = { link: import_node_fs7.default.linkSync, copyFile: import_node_fs7.default.copyFileSync, chmod: import_node_fs7.default.chmodSync };
+function findPathShadow(params) {
+  const resolvedTargetDir = import_node_path21.default.resolve(params.targetDir);
+  for (const dir of params.pathDirs) {
+    const found = params.findExecutableInDir(dir, params.targetFilename);
+    if (found === void 0) {
+      continue;
+    }
+    return import_node_path21.default.resolve(dir) === resolvedTargetDir ? { status: "ok" } : { status: "shadowed", by: found };
+  }
+  return params.pathDirs.some((dir) => import_node_path21.default.resolve(dir) === resolvedTargetDir) ? { status: "ok" } : { status: "not-on-path" };
+}
+
+// src/doctorReport.ts
+var import_node_fs8 = __toESM(require("node:fs"), 1);
+var import_node_path22 = __toESM(require("node:path"), 1);
+function refinePathShadow(status, ownExecutablePath, realpath) {
+  if (status.status !== "shadowed") {
+    return status;
+  }
+  return realpath(status.by) === realpath(ownExecutablePath) ? { status: "ok" } : status;
+}
+function validateJson(schema, input) {
+  if (input.raw === void 0) {
+    return { ok: false, message: `${input.path} is missing.` };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(input.raw);
+  } catch (error) {
+    return { ok: false, message: `${input.path} is not valid JSON: ${error instanceof Error ? error.message : String(error)}` };
+  }
+  const result = schema.safeParse(parsed);
+  if (!result.success) {
+    return { ok: false, message: new ConfigValidationError(input.path, result.error.issues).message };
+  }
+  return { ok: true, data: result.data };
+}
+function pushPathResolution(push, resolution) {
+  const ownDir = import_node_path22.default.dirname(resolution.ownExecutablePath);
+  switch (resolution.agentShim.status) {
+    case "ok":
+      push("path-resolution", "pass", `\`agent-shim\` on PATH resolves to this running executable, ${resolution.ownExecutablePath}.`, "agent-shim");
+      break;
+    case "not-on-path":
+      push(
+        "path-resolution",
+        "warn",
+        `${ownDir} is not on PATH, so a bare \`agent-shim\` does not reach ${resolution.ownExecutablePath}. Add it to PATH, or keep invoking this executable by its full path.`,
+        "agent-shim"
+      );
+      break;
+    case "shadowed":
+      push(
+        "path-resolution",
+        "fail",
+        `\`agent-shim\` on PATH resolves to ${resolution.agentShim.by}, not this running executable, ${resolution.ownExecutablePath}. Every command you type runs that one instead, at whatever version it happens to be \u2014 including the checks in this report, which describe this executable. Remove ${resolution.agentShim.by}, repoint it at ${resolution.ownExecutablePath}, or put ${ownDir} ahead of it on PATH.`,
+        "agent-shim"
+      );
+      break;
+  }
+  if (resolution.claude === void 0) {
+    return;
+  }
+  switch (resolution.claude.status) {
+    case "ok":
+      push("path-resolution", "pass", "`claude` on PATH resolves to the enabled shim.", "claude");
+      break;
+    case "not-on-path":
+      push("path-resolution", "warn", "The enabled `claude` shim's directory is not on PATH \u2014 add it, or use `agent-shim run` instead.", "claude");
+      break;
+    case "shadowed":
+      push(
+        "path-resolution",
+        "warn",
+        `\`claude\` on PATH resolves to ${resolution.claude.by}, not the enabled shim. Put the shim's directory ahead of it on PATH, or run \`agent-shim shim disable\` if you meant to launch that one directly.`,
+        "claude"
+      );
+      break;
+  }
+}
+function pushProvider(push, entry) {
+  if (entry.raw === void 0) {
+    push("provider", "fail", `${entry.path} is missing.`, entry.name);
+    return;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(entry.raw);
+  } catch (error) {
+    push("provider", "fail", `${entry.path} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`, entry.name);
+    return;
+  }
+  const conversion = legacyProviderConversion(parsed);
+  if (conversion !== void 0) {
+    push("provider", "fail", new LegacyProviderFileError(entry.path, conversion).message, entry.name);
+    return;
+  }
+  const validated = ProviderSchema.safeParse(parsed);
+  if (!validated.success) {
+    push("provider", "fail", new ConfigValidationError(entry.path, validated.error.issues).message, entry.name);
+    return;
+  }
+  push("provider", "pass", `${entry.name} is valid (${describeProviderEndpoint(validated.data)}, credential ${describeCredential(validated.data.credential)}).`, entry.name);
+}
+function pushLegacyName(push, params) {
+  const legacyVariables = Object.keys(params.env).filter((name) => name.startsWith(LEGACY_ENV_PREFIX) && params.env[name] !== void 0).sort();
+  if (legacyVariables.length === 0 && import_node_path22.default.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
+    push("legacy-name", "pass", "Nothing here still uses the former `claude-use` name.");
+    return;
+  }
+  for (const name of legacyVariables) {
+    push("legacy-name", "warn", `${name} is the former name of ${name.replace(LEGACY_ENV_PREFIX, ENV_PREFIX)}. Rename it; the old name still works but is only a fallback.`, name);
+  }
+  if (import_node_path22.default.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
+    push(
+      "legacy-name",
+      "warn",
+      `The state root is the former ${params.rootPath}, used in place. Leave it where it is: macOS Claude Code keys each identity's Keychain login on its exact configuration directory path, so moving it signs every identity out.`
+    );
+  }
+}
+function runDoctor(params) {
+  const findings = [];
+  const push = (section, severity, message, subject) => {
+    findings.push({ section, severity, message, ...subject === void 0 ? {} : { subject } });
+  };
+  const ambient = detectAmbientCredential(params.env);
+  if (ambient === void 0) {
+    push("ambient-credential", "pass", "No ambient-credential environment variable is set.");
+  } else {
+    push("ambient-credential", "warn", formatAmbientCredentialGuardMessage(ambient.variable));
+  }
+  if (params.binaryDiscovery.ok) {
+    const { binary } = params.binaryDiscovery;
+    const versionNote = binary.version === void 0 ? "" : `, version ${binary.version}`;
+    push("binary-discovery", "pass", `Found ${binary.path} (${binary.source}${versionNote}).`);
+  } else {
+    push("binary-discovery", "fail", params.binaryDiscovery.message);
+  }
+  if (params.claudeShim.state === void 0) {
+    push("claude-shim", "pass", "No `claude` command shim enabled (the default). Run `agent-shim shim enable` to add one.");
+  } else if (!params.claudeShim.targetExists) {
+    push(
+      "claude-shim",
+      "warn",
+      `claude-shim.json records a \`claude\` shim at ${params.claudeShim.state.targetPath}, but nothing is there. Run \`agent-shim shim enable\` again, or \`agent-shim shim disable\` to clear the stale record.`
+    );
+  } else {
+    push(
+      "claude-shim",
+      "pass",
+      `\`claude\` is enabled at ${params.claudeShim.state.targetPath} (${params.claudeShim.state.method}). If you've upgraded agent-shim since, re-run \`agent-shim shim enable\` to refresh it.`
+    );
+  }
+  pushPathResolution(push, params.pathResolution);
+  pushLegacyName(push, params);
+  const profileSources = /* @__PURE__ */ new Map();
+  for (const entry of params.configProfiles) {
+    const validated = validateJson(ConfigProfileSchema, entry);
+    if (!validated.ok) {
+      push("config-profile", "fail", validated.message, entry.name);
+      continue;
+    }
+    profileSources.set(entry.name, { name: entry.name, profile: validated.data });
+  }
+  const loadProfile = (name) => profileSources.get(name);
+  for (const name of profileSources.keys()) {
+    const linearised = lineariseProfile(name, loadProfile);
+    if (linearised.diagnostics.length === 0) {
+      push("config-profile", "pass", `${name} is valid and its extends chain resolves cleanly.`, name);
+    } else {
+      for (const diagnostic of linearised.diagnostics) {
+        push("config-profile", "fail", diagnostic.message, name);
+      }
+    }
+  }
+  const validProfileNames = new Set(profileSources.keys());
+  const validIdentityNames = /* @__PURE__ */ new Set();
+  for (const entry of params.identities) {
+    const validated = validateJson(IdentitySchema, entry);
+    if (!validated.ok) {
+      push("identity", "fail", validated.message, entry.name);
+      continue;
+    }
+    validIdentityNames.add(entry.name);
+    const defaultProfile = validated.data.defaultConfigProfile;
+    if (defaultProfile !== void 0 && !validProfileNames.has(defaultProfile)) {
+      push(
+        "identity",
+        "fail",
+        `Identity "${entry.name}" names configuration profile "${defaultProfile}" as its default, but no such profile exists.`,
+        entry.name
+      );
+    } else {
+      const credential = validated.data.credential;
+      push(
+        "identity",
+        "pass",
+        `${entry.name} is valid and authenticates with ${credential === void 0 ? "its stored login" : `credential ${describeCredential(credential)}`}.`,
+        entry.name
+      );
+    }
+  }
+  const validatedGlobalConfig = params.globalConfig.raw === void 0 ? void 0 : validateJson(GlobalConfigSchema, params.globalConfig);
+  const pools = validatedGlobalConfig?.ok === true ? validatedGlobalConfig.data.pools ?? {} : {};
+  for (const [poolName, pool] of Object.entries(pools)) {
+    const missing = pool.identities.filter((member) => !validIdentityNames.has(member));
+    if (missing.length === 0) {
+      push("pool", "pass", `${poolName} is valid (${pool.identities.join(", ")}).`, poolName);
+    } else {
+      push("pool", "fail", `Pool "${poolName}" names ${missing.map((member) => `identity "${member}"`).join(" and ")}, which ${missing.length === 1 ? "does" : "do"} not exist.`, poolName);
+    }
+  }
+  const selectionExists = (selector) => {
+    const poolName = poolNameOf(selector);
+    return poolName === void 0 ? validIdentityNames.has(selector) : poolName in pools;
+  };
+  for (const entry of params.providers) {
+    pushProvider(push, entry);
+  }
+  if (params.platform !== "darwin" || params.run === void 0) {
+    push("keychain", "pass", "Skipped (not macOS).");
+  } else {
+    for (const entry of params.identities) {
+      const result = lookupKeychainService(params.run, entry.farmRoot);
+      push("keychain", result.found ? "pass" : "warn", result.note, entry.name);
+    }
+  }
+  if (params.directoryRules.raw === void 0) {
+    push("directory-rules", "pass", "No directory-rules.json configured.");
+  } else {
+    const validated = validateJson(DirectoryRulesSchema, params.directoryRules);
+    if (!validated.ok) {
+      push("directory-rules", "fail", validated.message);
+    } else {
+      push("directory-rules", "pass", `${params.directoryRules.path} is valid.`);
+      for (const rule of validated.data.rules) {
+        const badRefs = [];
+        if (rule.identity !== void 0 && !selectionExists(rule.identity)) {
+          badRefs.push(poolNameOf(rule.identity) === void 0 ? `identity "${rule.identity}"` : `pool "${poolNameOf(rule.identity) ?? ""}"`);
+        }
+        if (rule.configProfile !== void 0 && !validProfileNames.has(rule.configProfile)) {
+          badRefs.push(`configuration profile "${rule.configProfile}"`);
+        }
+        if (badRefs.length > 0) {
+          push("directory-rules", "fail", `Rule for "${rule.path}" names ${badRefs.join(" and ")}, which do not exist.`, rule.path);
+        } else {
+          push("directory-rules", "pass", `Rule for "${rule.path}" is valid.`, rule.path);
+        }
+      }
+    }
+  }
+  if (params.globalConfig.raw === void 0) {
+    push("global-config", "pass", "No config.json configured.");
+  } else {
+    const validated = validateJson(GlobalConfigSchema, params.globalConfig);
+    if (!validated.ok) {
+      push("global-config", "fail", validated.message);
+    } else {
+      const defaultProfile = validated.data.defaultConfigProfile;
+      if (defaultProfile !== void 0 && !validProfileNames.has(defaultProfile)) {
+        push(
+          "global-config",
+          "fail",
+          `config.json names configuration profile "${defaultProfile}" as its default, but no such profile exists.`
+        );
+      } else {
+        push("global-config", "pass", `${params.globalConfig.path} is valid.`);
+      }
+    }
+  }
+  if (params.categoriesLocal.raw === void 0) {
+    push("categories-local", "pass", "No categories.local.json configured.");
+  } else {
+    const validated = validateJson(CategoryClassificationOverlaySchema, params.categoriesLocal);
+    push(
+      "categories-local",
+      validated.ok ? "pass" : "fail",
+      validated.ok ? `${params.categoriesLocal.path} is valid.` : validated.message
+    );
+  }
+  if (params.headroom.state.raw === void 0) {
+    push("headroom", "pass", "No headroom daemon has ever run; nothing to check.");
+  } else {
+    const validated = validateJson(HeadroomStateSchema, params.headroom.state);
+    if (!validated.ok) {
+      push("headroom", "fail", validated.message);
+    } else {
+      const state = validated.data;
+      const supervisorAlive = state.supervisorPid !== void 0 && params.headroom.isRunning(state.supervisorPid);
+      const headroomAlive = state.headroomPid !== void 0 && params.headroom.isRunning(state.headroomPid);
+      if (state.supervisorPid === void 0) {
+        if (state.lastError === void 0) {
+          push("headroom", "pass", "Headroom daemon is stopped (idle shutdown) with no recorded error.");
+        } else {
+          push("headroom", "warn", `Headroom supervisor is not running; last error: ${state.lastError}`);
+        }
+      } else if (!supervisorAlive) {
+        push(
+          "headroom",
+          "warn",
+          `Headroom state names supervisor pid ${String(state.supervisorPid)}, which is not running; the next launch through headroom will start a replacement.`
+        );
+      } else if (state.headroomPid === void 0 || state.port === void 0) {
+        push(
+          "headroom",
+          "warn",
+          state.lastError === void 0 ? "Headroom supervisor is running but the daemon has no healthy process; it should be restarting it." : `Headroom supervisor is running but the daemon is down; last error: ${state.lastError}`
+        );
+      } else if (!headroomAlive) {
+        push(
+          "headroom",
+          "warn",
+          `Headroom state names daemon pid ${String(state.headroomPid)}, which is not running; its supervisor should be restarting it.`
+        );
+      } else {
+        push(
+          "headroom",
+          "pass",
+          `Headroom daemon is up on 127.0.0.1:${String(state.port)} (supervisor ${String(state.supervisorPid)}, daemon ${String(state.headroomPid)}).`
+        );
+      }
+      if (state.lastError !== void 0 && supervisorAlive) {
+        push("headroom", "warn", `Headroom recorded a previous error: ${state.lastError}`);
+      }
+      if (state.installedSource !== void 0 && isMovingGitSource(state.installedSource)) {
+        push(
+          "headroom",
+          "warn",
+          `Headroom is installed from a git ref that can move (${state.installedSource}); pin headroom.source to a full commit SHA so a rebased or deleted branch cannot change or break the install.`
+        );
+      }
+    }
+  }
+  if (params.activeIdentity.raw === void 0) {
+    push("active-identity", "pass", "No active identity set.");
+  } else {
+    const trimmed = params.activeIdentity.raw.trim();
+    if (trimmed === "") {
+      push("active-identity", "warn", "active-identity is present but empty \u2014 treated the same as unset.");
+    } else if (!selectionExists(trimmed)) {
+      push("active-identity", "fail", `active-identity names "${trimmed}", which does not exist.`);
+    } else {
+      push("active-identity", "pass", `Active identity "${trimmed}" is valid.`);
+    }
+  }
+  return { findings, ok: !findings.some((finding) => finding.severity === "fail") };
+}
+var SECTION_TITLES = {
+  "ambient-credential": "Ambient-credential exposure",
+  "binary-discovery": "Claude Code binary discovery",
+  "claude-shim": "`claude` command shim",
+  "path-resolution": "PATH resolution",
+  "legacy-name": "Former `claude-use` name",
+  "config-profile": "Configuration profiles",
+  identity: "Identities",
+  pool: "Pools",
+  provider: "Providers",
+  keychain: "macOS Keychain",
+  "directory-rules": "Directory rules",
+  "global-config": "Global config",
+  headroom: "Headroom daemon",
+  "categories-local": "categories.local.json",
+  "active-identity": "Active identity"
+};
+var SECTION_ORDER = [
+  "ambient-credential",
+  "binary-discovery",
+  "claude-shim",
+  "path-resolution",
+  "config-profile",
+  "identity",
+  "pool",
+  "provider",
+  "keychain",
+  "directory-rules",
+  "global-config",
+  "headroom",
+  "categories-local",
+  "active-identity"
+];
+function severityPrefix(severity) {
+  switch (severity) {
+    case "pass":
+      return "[PASS]";
+    case "warn":
+      return "[WARN]";
+    case "fail":
+      return "[FAIL]";
+    default:
+      return severity;
+  }
+}
+function formatDoctorReport(report) {
+  const lines = [];
+  for (const section of SECTION_ORDER) {
+    const sectionFindings = report.findings.filter((finding) => finding.section === section);
+    if (sectionFindings.length === 0) {
+      continue;
+    }
+    lines.push("", `${SECTION_TITLES[section]}:`);
+    for (const finding of sectionFindings) {
+      const subject = finding.subject === void 0 ? "" : `${finding.subject}: `;
+      lines.push(`  ${severityPrefix(finding.severity)} ${subject}${finding.message}`);
+    }
+  }
+  const failCount = report.findings.filter((finding) => finding.severity === "fail").length;
+  lines.push("", report.ok ? "All checks passed." : `${String(failCount)} check(s) failed.`);
+  return lines;
+}
+function realpathOrSelf(target) {
+  try {
+    return import_node_fs8.default.realpathSync(target);
+  } catch {
+    return target;
+  }
+}
+function collectDoctorReport(params) {
+  const { paths } = params;
+  const identityNames = import_node_fs8.default.existsSync(paths.identitiesDir) ? import_node_fs8.default.readdirSync(paths.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && isIdentityDirectoryName(entry.name)).map((entry) => entry.name).sort() : [];
+  const identities = identityNames.map((name) => {
+    const farmRoot = import_node_path22.default.join(paths.identitiesDir, name);
+    const identityPath = import_node_path22.default.join(farmRoot, "identity.json");
+    return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot };
+  });
+  const profileNames = import_node_fs8.default.existsSync(paths.configProfilesDir) ? import_node_fs8.default.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
+  const configProfiles = profileNames.map((name) => {
+    const profilePath = import_node_path22.default.join(paths.configProfilesDir, `${name}.json`);
+    return { name, path: profilePath, raw: realFsPort.readFileUtf8(profilePath) };
+  });
+  const providerNames = import_node_fs8.default.existsSync(paths.providersDir) ? import_node_fs8.default.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
+  const providers = providerNames.map((name) => {
+    const providerPath = import_node_path22.default.join(paths.providersDir, `${name}.json`);
+    return { name, path: providerPath, raw: realFsPort.readFileUtf8(providerPath) };
+  });
+  const ownExecutablePath = realOwnExecutablePath();
+  let binaryDiscovery;
+  try {
+    const binary = realResolveClaudeBinary(resolveOwnInstallDirs(paths, ownExecutablePath))();
+    binaryDiscovery = { ok: true, binary };
+  } catch (error) {
+    binaryDiscovery = { ok: false, message: error instanceof Error ? error.message : String(error) };
+  }
+  const shimState = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
+  const pathDirs = (params.env.PATH ?? "").split(import_node_path22.default.delimiter).filter((dir) => dir !== "");
+  const claudeShimShadow = shimState === void 0 ? void 0 : refinePathShadow(
+    findPathShadow({
+      pathDirs,
+      targetDir: import_node_path22.default.dirname(shimState.targetPath),
+      targetFilename: import_node_path22.default.basename(shimState.targetPath),
+      findExecutableInDir
+    }),
+    shimState.targetPath,
+    realpathOrSelf
+  );
+  const report = runDoctor({
+    env: params.env,
+    identities,
+    configProfiles,
+    providers,
+    directoryRules: { path: paths.directoryRulesFile, raw: realFsPort.readFileUtf8(paths.directoryRulesFile) },
+    globalConfig: { path: paths.globalConfigFile, raw: realFsPort.readFileUtf8(paths.globalConfigFile) },
+    categoriesLocal: { path: paths.categoriesLocalFile, raw: realFsPort.readFileUtf8(paths.categoriesLocalFile) },
+    activeIdentity: { path: paths.activeIdentityFile, raw: realFsPort.readFileUtf8(paths.activeIdentityFile) },
+    binaryDiscovery,
+    claudeShim: { state: shimState, targetExists: shimState !== void 0 && import_node_fs8.default.existsSync(shimState.targetPath) },
+    rootPath: paths.root,
+    pathResolution: {
+      ownExecutablePath,
+      agentShim: refinePathShadow(
+        findPathShadow({
+          pathDirs,
+          targetDir: import_node_path22.default.dirname(ownExecutablePath),
+          targetFilename: commandFilename(ownExecutablePath, "agent-shim"),
+          findExecutableInDir
+        }),
+        ownExecutablePath,
+        realpathOrSelf
+      ),
+      ...claudeShimShadow === void 0 ? {} : { claude: claudeShimShadow }
+    },
+    run: realRunPort,
+    platform: process.platform,
+    headroom: {
+      state: { path: paths.headroomStateFile, raw: realFsPort.readFileUtf8(paths.headroomStateFile) },
+      isRunning: realIsProcessRunning
+    }
+  });
+  return report;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AMBIENT_CREDENTIAL_VARS,
@@ -3827,6 +6805,9 @@ function resolveLayoutPaths() {
   CredentialCacheSchema,
   CredentialSchema,
   CredentialSourceSchema,
+  DirectoryRuleAlreadyExistsError,
+  DirectoryRuleMissingTargetError,
+  DirectoryRuleNotFoundError,
   DirectoryRuleSchema,
   DirectoryRulesSchema,
   EXIT_FAILURE,
@@ -3836,48 +6817,108 @@ function resolveLayoutPaths() {
   FrontDoorStartError,
   GlobalConfigSchema,
   HeadroomStartError,
+  IdentityAlreadyExistsError,
+  IdentityNotFoundError,
   IdentitySchema,
+  InvalidCategoryNameError,
+  InvalidIdentityNameError,
+  InvalidProviderNameError,
+  LegacyProviderFileError,
   PoolNameSchema,
+  PoolNotFoundError,
   PoolSchema,
   PortableConfigSchema,
+  ProfileAlreadyExistsError,
+  ProfileNotFoundError,
+  ProviderAlreadyExistsError,
+  ProviderKindMismatchError,
+  ProviderNotFoundError,
   ProviderSchema,
   ROUTED_PATH_PREFIX,
   UsageError,
   UsageSnapshotError,
   UsageSnapshotSchema,
   WhenSchema,
+  addDirectoryRule,
+  addIdentity,
+  addPool,
+  addProvider,
   buildEntryFacts,
   buildLayoutPaths,
   carryOver,
+  checkReportHasWarnings,
+  checkReportToJson,
+  collectCheckReport,
+  collectDoctorReport,
   createLeafCache,
+  createProfile,
+  describeProviderEndpoint,
   detectAmbientCredential,
   ensureCa,
   ensureFrontDoor,
   ensureHeadroom,
   evaluateAmbientCredentialGuard,
   formatAmbientCredentialGuardMessage,
+  formatCheckReport,
+  formatDoctorReport,
   forwardableHeaders,
   generateCa,
+  identityExists,
+  isIdentityDirectoryName,
   isInterceptedHost,
+  listDirectoryRules,
+  listIdentities,
+  listProfiles,
+  listProviders,
   listUsageSnapshots,
   mintLeaf,
   parseConnectTarget,
+  profileExists,
+  providerExists,
+  readActiveIdentity,
+  readDirectoryRules,
   readFarmManifest,
+  readGlobalConfig,
+  readIdentity,
+  readPools,
+  readProfile,
+  readProvider,
   readUsageSnapshot,
   realConnectCertStore,
   realConnectEffects,
   recoverFarm,
   recoveryDiagnostics,
+  removeDirectoryRule,
+  removeIdentity,
+  removePool,
+  removeProfile,
+  removeProvider,
+  requirePool,
   resolveAgentShimHome,
   resolveClaudeHome,
   resolveDecisions,
   resolveLayoutPaths,
   resolveSupervisorConfig,
   resyncFarm,
+  runCheck,
+  runDoctor,
   runFrontDoorSupervisor,
   runSupervisor,
   servedByPipeline,
+  setAllowAmbientCredential,
+  setDefaultConfigProfile,
+  setGlobalDefaultProfile,
+  setIdentityCredential,
+  setPool,
+  setProfileCategories,
+  setProfileEntries,
+  setProfileLaunchFlags,
+  setProfileMetadata,
   snapshotPath,
   startConnectServer,
-  topLevelNames
+  topLevelNames,
+  updateDirectoryRule,
+  updateProvider,
+  useIdentity,
+  writeDirectoryRules
 });