agent-shim 7.8.0 → 7.10.0

package/dist/cli.cjs

@@ -3248,42 +3248,42 @@ var require_defaults = __commonJS({
 var require_env_paths = __commonJS({
   "node_modules/.pnpm/env-paths@2.2.1/node_modules/env-paths/index.js"(exports2, module2) {
     "use strict";
-    var path39 = require("path");
+    var path40 = require("path");
     var os9 = require("os");
     var homedir = os9.homedir();
     var tmpdir = os9.tmpdir();
     var { env } = process;
     var macos = (name) => {
-      const library = path39.join(homedir, "Library");
+      const library = path40.join(homedir, "Library");
       return {
-        data: path39.join(library, "Application Support", name),
-        config: path39.join(library, "Preferences", name),
-        cache: path39.join(library, "Caches", name),
-        log: path39.join(library, "Logs", name),
-        temp: path39.join(tmpdir, name)
+        data: path40.join(library, "Application Support", name),
+        config: path40.join(library, "Preferences", name),
+        cache: path40.join(library, "Caches", name),
+        log: path40.join(library, "Logs", name),
+        temp: path40.join(tmpdir, name)
       };
     };
     var windows = (name) => {
-      const appData = env.APPDATA || path39.join(homedir, "AppData", "Roaming");
-      const localAppData = env.LOCALAPPDATA || path39.join(homedir, "AppData", "Local");
+      const appData = env.APPDATA || path40.join(homedir, "AppData", "Roaming");
+      const localAppData = env.LOCALAPPDATA || path40.join(homedir, "AppData", "Local");
       return {
         // Data/config/cache/log are invented by me as Windows isn't opinionated about this
-        data: path39.join(localAppData, name, "Data"),
-        config: path39.join(appData, name, "Config"),
-        cache: path39.join(localAppData, name, "Cache"),
-        log: path39.join(localAppData, name, "Log"),
-        temp: path39.join(tmpdir, name)
+        data: path40.join(localAppData, name, "Data"),
+        config: path40.join(appData, name, "Config"),
+        cache: path40.join(localAppData, name, "Cache"),
+        log: path40.join(localAppData, name, "Log"),
+        temp: path40.join(tmpdir, name)
       };
     };
     var linux = (name) => {
-      const username = path39.basename(homedir);
+      const username = path40.basename(homedir);
       return {
-        data: path39.join(env.XDG_DATA_HOME || path39.join(homedir, ".local", "share"), name),
-        config: path39.join(env.XDG_CONFIG_HOME || path39.join(homedir, ".config"), name),
-        cache: path39.join(env.XDG_CACHE_HOME || path39.join(homedir, ".cache"), name),
+        data: path40.join(env.XDG_DATA_HOME || path40.join(homedir, ".local", "share"), name),
+        config: path40.join(env.XDG_CONFIG_HOME || path40.join(homedir, ".config"), name),
+        cache: path40.join(env.XDG_CACHE_HOME || path40.join(homedir, ".cache"), name),
         // https://wiki.debian.org/XDGBaseDirectorySpecification#state
-        log: path39.join(env.XDG_STATE_HOME || path39.join(homedir, ".local", "state"), name),
-        temp: path39.join(tmpdir, username, name)
+        log: path40.join(env.XDG_STATE_HOME || path40.join(homedir, ".local", "state"), name),
+        temp: path40.join(tmpdir, username, name)
       };
     };
     var envPaths = (name, options) => {
@@ -3351,11 +3351,11 @@ var require_util = __commonJS({
       return result;
     }
     exports2.emplace = emplace;
-    function getPropertyByPath(source, path39) {
-      if (typeof path39 === "string" && Object.prototype.hasOwnProperty.call(source, path39)) {
-        return source[path39];
+    function getPropertyByPath(source, path40) {
+      if (typeof path40 === "string" && Object.prototype.hasOwnProperty.call(source, path40)) {
+        return source[path40];
       }
-      const parsedPath = typeof path39 === "string" ? path39.split(".") : path39;
+      const parsedPath = typeof path40 === "string" ? path40.split(".") : path40;
       return parsedPath.reduce((previous, key) => {
         if (previous === void 0) {
           return previous;
@@ -3378,9 +3378,9 @@ var require_util = __commonJS({
       return Object.fromEntries(Object.entries(options).filter(([, value]) => value !== void 0));
     }
     exports2.removeUndefinedValuesFromObject = removeUndefinedValuesFromObject;
-    async function isDirectory(path39) {
+    async function isDirectory(path40) {
       try {
-        const stat = await fs_1.promises.stat(path39);
+        const stat = await fs_1.promises.stat(path40);
         return stat.isDirectory();
       } catch (e) {
         if (e.code === "ENOENT") {
@@ -3390,9 +3390,9 @@ var require_util = __commonJS({
       }
     }
     exports2.isDirectory = isDirectory;
-    function isDirectorySync(path39) {
+    function isDirectorySync(path40) {
       try {
-        const stat = fs_1.default.statSync(path39);
+        const stat = fs_1.default.statSync(path40);
         return stat.isDirectory();
       } catch (e) {
         if (e.code === "ENOENT") {
@@ -3490,7 +3490,7 @@ var require_ExplorerBase = __commonJS({
           const idx = importStack.indexOf(fullPath);
           if (idx !== -1) {
             throw new Error(`Circular import detected:
-${[...importStack, fullPath].map((path39, i2) => `${i2 + 1}. ${path39}`).join("\n")} (same as ${idx + 1}.)`);
+${[...importStack, fullPath].map((path40, i2) => `${i2 + 1}. ${path40}`).join("\n")} (same as ${idx + 1}.)`);
           }
         }
       }
@@ -3678,9 +3678,9 @@ var require_Explorer = __commonJS({
           throw error62;
         }
       }
-      async #fileExists(path39) {
+      async #fileExists(path40) {
         try {
-          await promises_1.default.stat(path39);
+          await promises_1.default.stat(path40);
           return true;
         } catch (e) {
           return false;
@@ -3840,9 +3840,9 @@ var require_ExplorerSync = __commonJS({
           throw error62;
         }
       }
-      #fileExists(path39) {
+      #fileExists(path40) {
         try {
-          fs_1.default.statSync(path39);
+          fs_1.default.statSync(path40);
           return true;
         } catch (e) {
           return false;
@@ -3966,7 +3966,7 @@ var require_dist = __commonJS({
       };
     }
     function getResolvedSearchPlaces(moduleName, toolDefinedSearchPlaces, userConfiguredOptions) {
-      const userConfiguredSearchPlaces = userConfiguredOptions.searchPlaces?.map((path39) => path39.replace("{name}", moduleName));
+      const userConfiguredSearchPlaces = userConfiguredOptions.searchPlaces?.map((path40) => path40.replace("{name}", moduleName));
       if (userConfiguredOptions.mergeSearchPlaces) {
         return [...userConfiguredSearchPlaces ?? [], ...toolDefinedSearchPlaces];
       }
@@ -4374,8 +4374,8 @@ var require_utils = __commonJS({
       }
       return output2;
     };
-    exports2.basename = (path39, { windows } = {}) => {
-      const segs = path39.split(windows ? /[\\/]/ : "/");
+    exports2.basename = (path40, { windows } = {}) => {
+      const segs = path40.split(windows ? /[\\/]/ : "/");
       const last = segs[segs.length - 1];
       if (last === "") {
         return segs[segs.length - 2];
@@ -7003,14 +7003,14 @@ var require_util2 = __commonJS({
         }
         const port = url2.port != null ? url2.port : url2.protocol === "https:" ? 443 : 80;
         let origin = url2.origin != null ? url2.origin : `${url2.protocol || ""}//${url2.hostname || ""}:${port}`;
-        let path39 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`;
+        let path40 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`;
         if (origin[origin.length - 1] === "/") {
           origin = origin.slice(0, origin.length - 1);
         }
-        if (path39 && path39[0] !== "/") {
-          path39 = `/${path39}`;
+        if (path40 && path40[0] !== "/") {
+          path40 = `/${path40}`;
         }
-        return new URL(`${origin}${path39}`);
+        return new URL(`${origin}${path40}`);
       }
       if (!isHttpOrHttpsPrefixed(url2.origin || url2.protocol)) {
         throw new InvalidArgumentError2("Invalid URL protocol: the URL must start with `http:` or `https:`.");
@@ -7831,9 +7831,9 @@ var require_diagnostics = __commonJS({
         "undici:client:sendHeaders",
         (evt) => {
           const {
-            request: { method, path: path39, origin }
+            request: { method, path: path40, origin }
           } = evt;
-          debugLog("sending request to %s %s%s", method, origin, path39);
+          debugLog("sending request to %s %s%s", method, origin, path40);
         }
       );
     }
@@ -7851,14 +7851,14 @@ var require_diagnostics = __commonJS({
         "undici:request:headers",
         (evt) => {
           const {
-            request: { method, path: path39, origin },
+            request: { method, path: path40, origin },
             response: { statusCode }
           } = evt;
           debugLog(
             "received response to %s %s%s - HTTP %d",
             method,
             origin,
-            path39,
+            path40,
             statusCode
           );
         }
@@ -7867,23 +7867,23 @@ var require_diagnostics = __commonJS({
         "undici:request:trailers",
         (evt) => {
           const {
-            request: { method, path: path39, origin }
+            request: { method, path: path40, origin }
           } = evt;
-          debugLog("trailers received from %s %s%s", method, origin, path39);
+          debugLog("trailers received from %s %s%s", method, origin, path40);
         }
       );
       diagnosticsChannel.subscribe(
         "undici:request:error",
         (evt) => {
           const {
-            request: { method, path: path39, origin },
+            request: { method, path: path40, origin },
             error: error62
           } = evt;
           debugLog(
             "request to %s %s%s errored - %s",
             method,
             origin,
-            path39,
+            path40,
             error62.message
           );
         }
@@ -7998,7 +7998,7 @@ var require_request = __commonJS({
     var kHandler = /* @__PURE__ */ Symbol("handler");
     var Request = class {
       constructor(origin, {
-        path: path39,
+        path: path40,
         method,
         body,
         headers,
@@ -8015,11 +8015,11 @@ var require_request = __commonJS({
         maxRedirections,
         typeOfService
       }, handler) {
-        if (typeof path39 !== "string") {
+        if (typeof path40 !== "string") {
           throw new InvalidArgumentError2("path must be a string");
-        } else if (path39[0] !== "/" && !(path39.startsWith("http://") || path39.startsWith("https://")) && method !== "CONNECT") {
+        } else if (path40[0] !== "/" && !(path40.startsWith("http://") || path40.startsWith("https://")) && method !== "CONNECT") {
           throw new InvalidArgumentError2("path must be an absolute URL or start with a slash");
-        } else if (invalidPathRegex.test(path39)) {
+        } else if (invalidPathRegex.test(path40)) {
           throw new InvalidArgumentError2("invalid request path");
         }
         if (typeof method !== "string") {
@@ -8094,7 +8094,7 @@ var require_request = __commonJS({
         this.completed = false;
         this.aborted = false;
         this.upgrade = upgrade || null;
-        this.path = query ? serializePathWithQuery(path39, query) : path39;
+        this.path = query ? serializePathWithQuery(path40, query) : path40;
         this.origin = origin;
         this.protocol = getProtocolFromUrlString(origin);
         this.idempotent = idempotent == null ? method === "HEAD" || method === "GET" : idempotent;
@@ -13276,7 +13276,7 @@ var require_client_h1 = __commonJS({
       return method !== "GET" && method !== "HEAD" && method !== "OPTIONS" && method !== "TRACE" && method !== "CONNECT";
     }
     function writeH1(client, request6) {
-      const { method, path: path39, host, upgrade, blocking, reset } = request6;
+      const { method, path: path40, host, upgrade, blocking, reset } = request6;
       let { body, headers, contentLength } = request6;
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH" || method === "QUERY" || method === "PROPFIND" || method === "PROPPATCH";
       if (util.isFormDataLike(body)) {
@@ -13354,7 +13354,7 @@ var require_client_h1 = __commonJS({
       if (socket.setTypeOfService) {
         socket.setTypeOfService(request6.typeOfService);
       }
-      let header = `${method} ${path39} HTTP/1.1\r
+      let header = `${method} ${path40} HTTP/1.1\r
 `;
       if (typeof host === "string") {
         header += `host: ${host}\r
@@ -14033,7 +14033,7 @@ var require_client_h2 = __commonJS({
       const headersTimeout = request6.headersTimeout ?? client[kHeadersTimeout];
       const bodyTimeout = request6.bodyTimeout ?? client[kBodyTimeout];
       const session = client[kHTTP2Session];
-      const { method, path: path39, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request6;
+      const { method, path: path40, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request6;
       let { body } = request6;
       if (upgrade != null && upgrade !== "websocket") {
         util.errorRequest(client, request6, new InvalidArgumentError2(`Custom upgrade "${upgrade}" not supported over HTTP/2`));
@@ -14102,7 +14102,7 @@ var require_client_h2 = __commonJS({
           }
           headers[HTTP2_HEADER_METHOD] = "CONNECT";
           headers[HTTP2_HEADER_PROTOCOL] = "websocket";
-          headers[HTTP2_HEADER_PATH] = path39;
+          headers[HTTP2_HEADER_PATH] = path40;
           if (protocol === "ws:" || protocol === "wss:") {
             headers[HTTP2_HEADER_SCHEME] = protocol === "ws:" ? "http" : "https";
           } else {
@@ -14144,7 +14144,7 @@ var require_client_h2 = __commonJS({
         stream.setTimeout(headersTimeout);
         return true;
       }
-      headers[HTTP2_HEADER_PATH] = path39;
+      headers[HTTP2_HEADER_PATH] = path40;
       headers[HTTP2_HEADER_SCHEME] = protocol === "http:" ? "http" : "https";
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH";
       if (body && typeof body.read === "function") {
@@ -16496,10 +16496,10 @@ var require_proxy_agent = __commonJS({
         };
         const {
           origin,
-          path: path39 = "/",
+          path: path40 = "/",
           headers = {}
         } = opts;
-        opts.path = origin + path39;
+        opts.path = origin + path40;
         if (!("host" in headers) && !("Host" in headers)) {
           const { host } = new URL(origin);
           headers.host = host;
@@ -18608,20 +18608,20 @@ var require_mock_utils = __commonJS({
       }
       return normalizedQp;
     }
-    function safeUrl(path39) {
-      if (typeof path39 !== "string") {
-        return path39;
+    function safeUrl(path40) {
+      if (typeof path40 !== "string") {
+        return path40;
       }
-      const pathSegments = path39.split("?", 3);
+      const pathSegments = path40.split("?", 3);
       if (pathSegments.length !== 2) {
-        return path39;
+        return path40;
       }
       const qp = new URLSearchParams(pathSegments.pop());
       qp.sort();
       return [...pathSegments, qp.toString()].join("?");
     }
-    function matchKey(mockDispatch2, { path: path39, method, body, headers }) {
-      const pathMatch = matchValue(mockDispatch2.path, path39);
+    function matchKey(mockDispatch2, { path: path40, method, body, headers }) {
+      const pathMatch = matchValue(mockDispatch2.path, path40);
       const methodMatch = matchValue(mockDispatch2.method, method);
       const bodyMatch = typeof mockDispatch2.body !== "undefined" ? matchValue(mockDispatch2.body, body) : true;
       const headersMatch = matchHeaders(mockDispatch2, headers);
@@ -18646,8 +18646,8 @@ var require_mock_utils = __commonJS({
       const basePath = key.query ? serializePathWithQuery(key.path, key.query) : key.path;
       const resolvedPath = typeof basePath === "string" ? safeUrl(basePath) : basePath;
       const resolvedPathWithoutTrailingSlash = removeTrailingSlash(resolvedPath);
-      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path39, ignoreTrailingSlash }) => {
-        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path39)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path39), resolvedPath);
+      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path40, ignoreTrailingSlash }) => {
+        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path40)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path40), resolvedPath);
       });
       if (matchedMockDispatches.length === 0) {
         throw new MockNotMatchedError(`Mock dispatch not matched for path '${resolvedPath}'`);
@@ -18686,19 +18686,19 @@ var require_mock_utils = __commonJS({
         mockDispatches.splice(index, 1);
       }
     }
-    function removeTrailingSlash(path39) {
-      while (path39.endsWith("/")) {
-        path39 = path39.slice(0, -1);
+    function removeTrailingSlash(path40) {
+      while (path40.endsWith("/")) {
+        path40 = path40.slice(0, -1);
       }
-      if (path39.length === 0) {
-        path39 = "/";
+      if (path40.length === 0) {
+        path40 = "/";
       }
-      return path39;
+      return path40;
     }
     function buildKey(opts) {
-      const { path: path39, method, body, headers, query } = opts;
+      const { path: path40, method, body, headers, query } = opts;
       return {
-        path: path39,
+        path: path40,
         method,
         body,
         headers,
@@ -19388,10 +19388,10 @@ var require_pending_interceptors_formatter = __commonJS({
       }
       format(pendingInterceptors) {
         const withPrettyHeaders = pendingInterceptors.map(
-          ({ method, path: path39, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
+          ({ method, path: path40, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
             Method: method,
             Origin: origin,
-            Path: path39,
+            Path: path40,
             "Status code": statusCode,
             Persistent: persist ? PERSISTENT : NOT_PERSISTENT,
             Invocations: timesInvoked,
@@ -19473,9 +19473,9 @@ var require_mock_agent = __commonJS({
         const acceptNonStandardSearchParameters = this[kMockAgentAcceptsNonStandardSearchParameters];
         const dispatchOpts = { ...opts };
         if (acceptNonStandardSearchParameters && dispatchOpts.path) {
-          const [path39, searchParams] = dispatchOpts.path.split("?");
+          const [path40, searchParams] = dispatchOpts.path.split("?");
           const normalizedSearchParams = normalizeSearchParams(searchParams, acceptNonStandardSearchParameters);
-          dispatchOpts.path = `${path39}?${normalizedSearchParams}`;
+          dispatchOpts.path = `${path40}?${normalizedSearchParams}`;
         }
         return this[kAgent].dispatch(dispatchOpts, handler);
       }
@@ -19876,12 +19876,12 @@ var require_snapshot_recorder = __commonJS({
        * @return {Promise<void>} - Resolves when snapshots are loaded
        */
       async loadSnapshots(filePath) {
-        const path39 = filePath || this.#snapshotPath;
-        if (!path39) {
+        const path40 = filePath || this.#snapshotPath;
+        if (!path40) {
           throw new InvalidArgumentError2("Snapshot path is required");
         }
         try {
-          const data = await readFile(resolve(path39), "utf8");
+          const data = await readFile(resolve(path40), "utf8");
           const parsed = JSON.parse(data);
           if (Array.isArray(parsed)) {
             this.#snapshots.clear();
@@ -19895,7 +19895,7 @@ var require_snapshot_recorder = __commonJS({
           if (error62.code === "ENOENT") {
             this.#snapshots.clear();
           } else {
-            throw new UndiciError(`Failed to load snapshots from ${path39}`, { cause: error62 });
+            throw new UndiciError(`Failed to load snapshots from ${path40}`, { cause: error62 });
           }
         }
       }
@@ -19906,11 +19906,11 @@ var require_snapshot_recorder = __commonJS({
        * @returns {Promise<void>} - Resolves when snapshots are saved
        */
       async saveSnapshots(filePath) {
-        const path39 = filePath || this.#snapshotPath;
-        if (!path39) {
+        const path40 = filePath || this.#snapshotPath;
+        if (!path40) {
           throw new InvalidArgumentError2("Snapshot path is required");
         }
-        const resolvedPath = resolve(path39);
+        const resolvedPath = resolve(path40);
         await mkdir(dirname2(resolvedPath), { recursive: true });
         const data = Array.from(this.#snapshots.entries()).map(([hash2, snapshot]) => ({
           hash: hash2,
@@ -20542,15 +20542,15 @@ var require_redirect_handler = __commonJS({
           return;
         }
         const { origin, pathname, search } = util.parseURL(new URL(this.location, this.opts.origin && new URL(this.opts.path, this.opts.origin)));
-        const path39 = search ? `${pathname}${search}` : pathname;
-        const redirectUrlString = `${origin}${path39}`;
+        const path40 = search ? `${pathname}${search}` : pathname;
+        const redirectUrlString = `${origin}${path40}`;
         for (const historyUrl of this.history) {
           if (historyUrl.toString() === redirectUrlString) {
             throw new InvalidArgumentError2(`Redirect loop detected. Cannot redirect to ${origin}. This typically happens when using a Client or Pool with cross-origin redirects. Use an Agent for cross-origin redirects.`);
           }
         }
         this.opts.headers = cleanRequestHeaders(this.opts.headers, statusCode === 303, this.opts.origin !== origin);
-        this.opts.path = path39;
+        this.opts.path = path40;
         this.opts.origin = origin;
         this.opts.query = null;
       }
@@ -22310,10 +22310,10 @@ var require_cache_handler = __commonJS({
       }
       return locationUrl.pathname + locationUrl.search;
     }
-    function deleteCachedUri(store, cacheKey, path39) {
+    function deleteCachedUri(store, cacheKey, path40) {
       deleteCachedValue(store, {
         ...cacheKey,
-        path: path39
+        path: path40
       });
       for (let i2 = 0; i2 < util.safeHTTPMethods.length; i2++) {
         const method = util.safeHTTPMethods[i2];
@@ -22321,7 +22321,7 @@ var require_cache_handler = __commonJS({
           deleteCachedValue(store, {
             ...cacheKey,
             method,
-            path: path39
+            path: path40
           });
         }
       }
@@ -22332,9 +22332,9 @@ var require_cache_handler = __commonJS({
       }
       const values = Array.isArray(headerValue2) ? headerValue2 : [headerValue2];
       for (let i2 = 0; i2 < values.length; i2++) {
-        const path39 = getSameOriginPath(cacheKey, values[i2]);
-        if (path39 !== void 0) {
-          deleteCachedUri(store, cacheKey, path39);
+        const path40 = getSameOriginPath(cacheKey, values[i2]);
+        if (path40 !== void 0) {
+          deleteCachedUri(store, cacheKey, path40);
         }
       }
     }
@@ -27334,11 +27334,11 @@ var require_fetch = __commonJS({
       function dispatch({ body }) {
         const url2 = requestCurrentURL(request6);
         const agent = fetchParams.controller.dispatcher;
-        const path39 = url2.pathname + url2.search;
+        const path40 = url2.pathname + url2.search;
         const hasTrailingQuestionMark = url2.search.length === 0 && url2.href[url2.href.length - url2.hash.length - 1] === "?";
         return new Promise((resolve, reject) => agent.dispatch(
           {
-            path: hasTrailingQuestionMark ? `${path39}?` : path39,
+            path: hasTrailingQuestionMark ? `${path40}?` : path40,
             origin: url2.origin,
             method: request6.method,
             body: agent.isMockActive ? request6.body && (request6.body.source || request6.body.stream) : body,
@@ -28285,9 +28285,9 @@ var require_util5 = __commonJS({
         }
       }
     }
-    function validateCookiePath(path39) {
-      for (let i2 = 0; i2 < path39.length; ++i2) {
-        const code = path39.charCodeAt(i2);
+    function validateCookiePath(path40) {
+      for (let i2 = 0; i2 < path40.length; ++i2) {
+        const code = path40.charCodeAt(i2);
         if (code < 32 || // exclude CTLs (0-31)
         code > 126 || // exclude DEL and non-ascii
         code === 59) {
@@ -31635,11 +31635,11 @@ var require_undici = __commonJS({
           if (typeof opts.path !== "string") {
             throw new InvalidArgumentError2("invalid opts.path");
           }
-          let path39 = opts.path;
+          let path40 = opts.path;
           if (!opts.path.startsWith("/")) {
-            path39 = `/${path39}`;
+            path40 = `/${path40}`;
           }
-          url2 = new URL(util.parseOrigin(url2).origin + path39);
+          url2 = new URL(util.parseOrigin(url2).origin + path40);
         } else {
           if (!opts) {
             opts = typeof url2 === "object" ? url2 : {};
@@ -31749,7 +31749,7 @@ ${captureLines}` : capture.stack;
 });
 
 // src/cli.ts
-var import_node_path37 = __toESM(require("node:path"), 1);
+var import_node_path38 = __toESM(require("node:path"), 1);
 
 // node_modules/.pnpm/commander@15.0.0/node_modules/commander/lib/error.js
 var CommanderError = class extends Error {
@@ -34862,9 +34862,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
    * @param {string} [path]
    * @return {(string|null|Command)}
    */
-  executableDir(path39) {
-    if (path39 === void 0) return this._executableDir;
-    this._executableDir = path39;
+  executableDir(path40) {
+    if (path40 === void 0) return this._executableDir;
+    this._executableDir = path40;
     return this;
   }
   /**
@@ -36002,10 +36002,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path39) {
-  if (!path39)
+function getElementAtPath(obj, path40) {
+  if (!path40)
     return obj;
-  return path39.reduce((acc, key) => acc?.[key], obj);
+  return path40.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -36345,11 +36345,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path39, issues) {
+function prefixIssues(path40, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path39);
+    iss.path.unshift(path40);
     return iss;
   });
 }
@@ -36799,16 +36799,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path39 = []) => {
+  const processError = (error63, path40 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path39, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path40, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path39, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path40, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path39, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path40, ...issue2.path]);
       } else {
-        const fullpath = [...path39, ...issue2.path];
+        const fullpath = [...path40, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -36847,17 +36847,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error63, path39 = []) => {
+  const processError = (error63, path40 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path39, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path40, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path39, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path40, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path39, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path40, ...issue2.path]);
       } else {
-        const fullpath = [...path39, ...issue2.path];
+        const fullpath = [...path40, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -36896,8 +36896,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path39 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path39) {
+  const path40 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path40) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -53999,13 +53999,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path39 = ref.slice(1).split("/").filter(Boolean);
-  if (path39.length === 0) {
+  const path40 = ref.slice(1).split("/").filter(Boolean);
+  if (path40.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path39[0] === defsKey) {
-    const key = path39[1] === void 0 ? void 0 : decodeJSONPointerSegment(path39[1]);
+  if (path40[0] === defsKey) {
+    const key = path40[1] === void 0 ? void 0 : decodeJSONPointerSegment(path40[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -60474,26 +60474,6 @@ function parseBool(input2) {
   }
   return parsed;
 }
-var InvalidEnvBoolError = class extends UsageError {
-  constructor(variable, value) {
-    super(`${variable} must be one of true, false, 1 or 0, got "${value}".`);
-    this.variable = variable;
-    this.value = value;
-    this.name = "InvalidEnvBoolError";
-  }
-  variable;
-  value;
-};
-function parseEnvBool(variable, value) {
-  if (value === void 0 || value === "") {
-    return void 0;
-  }
-  const parsed = parseBoolWord(value);
-  if (parsed === void 0) {
-    throw new InvalidEnvBoolError(variable, value);
-  }
-  return parsed;
-}
 function parseBoolPairList(input2) {
   const result = {};
   for (const piece of splitCommas(input2)) {
@@ -60975,7 +60955,7 @@ function registerIdentityCommand(program2, deps) {
 // package.json
 var package_default = {
   name: "agent-shim",
-  version: "7.8.0",
+  version: "7.10.0",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -61069,55 +61049,10 @@ var package_default = {
 };
 
 // src/check.ts
-var import_node_os5 = __toESM(require("node:os"), 1);
-var import_node_path26 = __toESM(require("node:path"), 1);
+var import_node_path27 = __toESM(require("node:path"), 1);
 
-// src/launcher/guard.ts
-var AMBIENT_CREDENTIAL_VARS = [
-  "ANTHROPIC_API_KEY",
-  "ANTHROPIC_AUTH_TOKEN",
-  "CLAUDE_CODE_OAUTH_TOKEN",
-  "CLAUDE_CODE_USE_BEDROCK",
-  "CLAUDE_CODE_USE_VERTEX",
-  "CLAUDE_CODE_USE_FOUNDRY"
-];
-function detectAmbientCredential(env, injected) {
-  for (const variable of AMBIENT_CREDENTIAL_VARS) {
-    const value = env[variable];
-    if (value === void 0 || value === "") {
-      continue;
-    }
-    if (injected?.variable === variable && value === injected.token) {
-      continue;
-    }
-    return { variable };
-  }
-  return void 0;
-}
-function formatAmbientCredentialGuardMessage(variable, identityName) {
-  const identitySetCommand = identityName === void 0 ? "agent-shim identity set <name> --allow-ambient-credential" : `agent-shim identity set ${identityName} --allow-ambient-credential`;
-  return [
-    `error: ${variable} is set in the environment. This identity's isolated`,
-    "credential would be bypassed \u2014 every identity authenticates as this same key",
-    "while it's set. Unset it, or if this is deliberate, opt in per-launch with",
-    "AGENT_SHIM_ALLOW_AMBIENT_CREDENTIAL=1, or persistently for this identity with",
-    `\`${identitySetCommand}\`.`
-  ].join("\n");
-}
-function evaluateAmbientCredentialGuard(params) {
-  const detected = detectAmbientCredential(params.env, params.injectedCredential);
-  if (detected === void 0) {
-    return { ok: true };
-  }
-  if (params.allowAmbientCredentialOverride || params.allowAmbientCredential || params.providerSelected === true) {
-    return { ok: true };
-  }
-  return {
-    ok: false,
-    variable: detected.variable,
-    message: formatAmbientCredentialGuardMessage(detected.variable, params.identityName)
-  };
-}
+// src/checkReport.ts
+var import_node_os5 = __toESM(require("node:os"), 1);
 
 // src/usage/preflight.ts
 var MS_PER_SECOND = 1e3;
@@ -61479,11 +61414,11 @@ function providerBaseUrl(port, provider) {
 function directOrigin(port) {
   return `http://127.0.0.1:${String(port)}`;
 }
-function parseProviderPath(path39) {
-  if (!path39.startsWith(PROVIDER_PATH_PREFIX)) {
+function parseProviderPath(path40) {
+  if (!path40.startsWith(PROVIDER_PATH_PREFIX)) {
     return void 0;
   }
-  const tail = path39.slice(PROVIDER_PATH_PREFIX.length);
+  const tail = path40.slice(PROVIDER_PATH_PREFIX.length);
   const slash = tail.indexOf("/");
   if (slash <= 0) {
     return void 0;
@@ -61883,9 +61818,9 @@ function decoderFor(encoding) {
       return void 0;
   }
 }
-function destinationOf(path39) {
-  const scoped = parseProviderPath(path39);
-  return scoped === void 0 ? { provider: ANTHROPIC_PROVIDER, endpoint: path39 } : { provider: scoped.provider, endpoint: scoped.rest };
+function destinationOf(path40) {
+  const scoped = parseProviderPath(path40);
+  return scoped === void 0 ? { provider: ANTHROPIC_PROVIDER, endpoint: path40 } : { provider: scoped.provider, endpoint: scoped.rest };
 }
 function buildRecord(event, context) {
   const { scan } = context;
@@ -62524,7 +62459,7 @@ function resolvePoolLaunch(params) {
   }
 }
 
-// src/pools.ts
+// src/poolPickReport.ts
 function candidateView(candidate) {
   return {
     identity: candidate.identity,
@@ -62557,116 +62492,6 @@ function collectPoolPick(params) {
     ...sticky.problem === void 0 ? {} : { stickyProblem: sticky.problem }
   };
 }
-function formatPoolPick(report, nowMs) {
-  const head = report.pick === void 0 ? `Pool ${report.pool}: every member is refused right now${report.earliestReturn === void 0 ? "" : `; ${report.earliestReturn.identity} returns at ${report.earliestReturn.at} (in ${formatAge(Date.parse(report.earliestReturn.at) - nowMs)})`}` : `Pool ${report.pool}: a launch from ${report.directory} would run as ${report.pick}`;
-  const rows = report.candidates.map((candidate, index) => {
-    const score = candidate.score === void 0 ? "" : ` score ${candidate.score.toFixed(2)}`;
-    const dry = candidate.feasible ? "" : " (5h would run dry)";
-    return `  ${String(index + 1)}. ${candidate.identity} [${candidate.class}${score}]${dry}
-     ${candidate.reasons.join("; ")}`;
-  });
-  return [head, ...rows, ...report.missing.map((name) => `  (skipped: ${name} is not an identity)`), ...report.stickyProblem === void 0 ? [] : [`Note: ${report.stickyProblem}; the last-pick record was ignored.`]];
-}
-function requireIdentities(paths, names) {
-  const existing = new Set(listIdentities(paths).map((entry) => entry.name));
-  for (const name of names) {
-    if (!existing.has(name)) {
-      throw new IdentityNotFoundError(name);
-    }
-  }
-}
-function membersOf(options) {
-  if (options.identity === void 0 || options.identity.length === 0) {
-    throw new UsageError("A pool needs at least one member: pass --identity <name> (repeatable).");
-  }
-  return options.identity;
-}
-function registerPoolCommand(program2, deps) {
-  const { paths } = deps;
-  const pool = withExamples(
-    program2.command("pool").description("Manage pools: named sets of identities that a launch picks one member of, by remaining quota, with `claude @pool:<name>`."),
-    ["agent-shim pool add subs --identity work --identity personal", "agent-shim pool pick subs"]
-  );
-  withExamples(
-    pool.command("add <name>").description("Define a pool. Fails if one with this name already exists.").option("--identity <name>", "A member identity (repeatable).", collectRepeated).action((name, options) => {
-      const members2 = membersOf(options);
-      requireIdentities(paths, members2);
-      addPool(paths, name, members2);
-      console.log(`Created pool "${name}" with ${members2.join(", ")}.`);
-    }),
-    ["agent-shim pool add subs --identity work --identity personal"]
-  );
-  withExamples(
-    pool.command("set <name>").description("Replace a pool's members.").option("--identity <name>", "A member identity (repeatable); the full new list.", collectRepeated).action((name, options) => {
-      const members2 = membersOf(options);
-      requireIdentities(paths, members2);
-      setPool(paths, name, members2);
-      console.log(`Pool "${name}" now has ${members2.join(", ")}.`);
-    }),
-    ["agent-shim pool set subs --identity work --identity personal --identity spare"]
-  );
-  withExamples(
-    pool.command("list").description("List every pool and its members, marking the active selection with *.").option("--json", "Print the pools as JSON.").action((options) => {
-      const pools = readPools(paths);
-      const active = readActiveIdentity(paths);
-      if (options.json === true) {
-        printJson(Object.entries(pools).map(([name, entry]) => ({ name, identities: entry.identities, active: active === `${POOL_SELECTOR_PREFIX}${name}` })));
-        return;
-      }
-      const names = Object.keys(pools).sort();
-      if (names.length === 0) {
-        console.log("No pools yet. Run `agent-shim pool add <name> --identity <name>...` to create one.");
-        return;
-      }
-      for (const name of names) {
-        console.log(`${active === `${POOL_SELECTOR_PREFIX}${name}` ? "*" : " "} ${name}: ${(pools[name]?.identities ?? []).join(", ")}`);
-      }
-    }),
-    ["agent-shim pool list", "agent-shim pool list --json"]
-  );
-  withExamples(
-    pool.command("show <name>").description("Show one pool's members.").option("--json", "Print the pool as JSON.").action((name, options) => {
-      const entry = requirePool(paths, name);
-      if (options.json === true) {
-        printJson({ name, identities: entry.identities });
-        return;
-      }
-      console.log(`Pool: ${name}`);
-      console.log(`Members: ${entry.identities.join(", ")}`);
-    }),
-    ["agent-shim pool show subs"]
-  );
-  withExamples(
-    pool.command("remove <name>").description("Delete a pool. Its member identities are untouched.").option("--yes", "Skip the confirmation prompt.").action(async (name, options) => {
-      requirePool(paths, name);
-      await confirmRemoval(deps, options.yes, `pool "${name}"`);
-      removePool(paths, name);
-      console.log(`Removed pool "${name}".`);
-    }),
-    ["agent-shim pool remove subs --yes"]
-  );
-  withExamples(
-    pool.command("use <name>").description("Make launches with no other selection pick a member of this pool.").action((name) => {
-      useIdentity(paths, `${POOL_SELECTOR_PREFIX}${name}`);
-      console.log(`Active selection is now pool "${name}".`);
-    }),
-    ["agent-shim pool use subs"]
-  );
-  withExamples(
-    pool.command("pick <name>").description("Show how a launch from this directory would rank the pool's members right now, and which it would run as. Read-only: it records nothing.").option("--json", "Print the ranking as JSON.").action((name, options) => {
-      const nowMs = Date.now();
-      const report = collectPoolPick({ paths, fs: realFsPort, usageFs: realFarmFs, poolName: name, pool: requirePool(paths, name), directory: process.cwd(), nowMs });
-      if (options.json === true) {
-        printJson(report);
-        return;
-      }
-      for (const line of formatPoolPick(report, nowMs)) {
-        console.log(line);
-      }
-    }),
-    ["agent-shim pool pick subs", "agent-shim pool pick subs --json"]
-  );
-}
 
 // src/providersStore.ts
 var import_node_fs9 = __toESM(require("node:fs"), 1);
@@ -62936,7 +62761,79 @@ function resolveProvider(params) {
   return { ok: true, provider: { name, definition, credential: resolution.credential }, warnings: resolution.credential.warnings };
 }
 
-// src/check.ts
+// src/checkReport.ts
+var import_node_path26 = __toESM(require("node:path"), 1);
+
+// src/cli/envBool.ts
+var InvalidEnvBoolError = class extends UsageError {
+  constructor(variable, value) {
+    super(`${variable} must be one of true, false, 1 or 0, got "${value}".`);
+    this.variable = variable;
+    this.value = value;
+    this.name = "InvalidEnvBoolError";
+  }
+  variable;
+  value;
+};
+function parseEnvBool(variable, value) {
+  if (value === void 0 || value === "") {
+    return void 0;
+  }
+  const parsed = parseBoolWord(value);
+  if (parsed === void 0) {
+    throw new InvalidEnvBoolError(variable, value);
+  }
+  return parsed;
+}
+
+// src/launcher/guard.ts
+var AMBIENT_CREDENTIAL_VARS = [
+  "ANTHROPIC_API_KEY",
+  "ANTHROPIC_AUTH_TOKEN",
+  "CLAUDE_CODE_OAUTH_TOKEN",
+  "CLAUDE_CODE_USE_BEDROCK",
+  "CLAUDE_CODE_USE_VERTEX",
+  "CLAUDE_CODE_USE_FOUNDRY"
+];
+function detectAmbientCredential(env, injected) {
+  for (const variable of AMBIENT_CREDENTIAL_VARS) {
+    const value = env[variable];
+    if (value === void 0 || value === "") {
+      continue;
+    }
+    if (injected?.variable === variable && value === injected.token) {
+      continue;
+    }
+    return { variable };
+  }
+  return void 0;
+}
+function formatAmbientCredentialGuardMessage(variable, identityName) {
+  const identitySetCommand = identityName === void 0 ? "agent-shim identity set <name> --allow-ambient-credential" : `agent-shim identity set ${identityName} --allow-ambient-credential`;
+  return [
+    `error: ${variable} is set in the environment. This identity's isolated`,
+    "credential would be bypassed \u2014 every identity authenticates as this same key",
+    "while it's set. Unset it, or if this is deliberate, opt in per-launch with",
+    "AGENT_SHIM_ALLOW_AMBIENT_CREDENTIAL=1, or persistently for this identity with",
+    `\`${identitySetCommand}\`.`
+  ].join("\n");
+}
+function evaluateAmbientCredentialGuard(params) {
+  const detected = detectAmbientCredential(params.env, params.injectedCredential);
+  if (detected === void 0) {
+    return { ok: true };
+  }
+  if (params.allowAmbientCredentialOverride || params.allowAmbientCredential || params.providerSelected === true) {
+    return { ok: true };
+  }
+  return {
+    ok: false,
+    variable: detected.variable,
+    message: formatAmbientCredentialGuardMessage(detected.variable, params.identityName)
+  };
+}
+
+// src/checkReport.ts
 var HISTORY_PROJECTS_KEY_PREFIX = "history/projects/";
 function projectFragmentOf(rawKey) {
   return rawKey.startsWith(HISTORY_PROJECTS_KEY_PREFIX) ? rawKey.slice(HISTORY_PROJECTS_KEY_PREFIX.length) : void 0;
@@ -63217,85 +63114,92 @@ function loadCheckProvider(paths, name) {
   }
   return definition === void 0 ? { name, problem: `no provider named "${name}"` } : { name, definition };
 }
+function collectCheckReport(params) {
+  const { paths, cwd } = params;
+  const home = import_node_os5.default.homedir();
+  const claudeHome = resolveClaudeHome();
+  const read = cosmiconfigReader();
+  const classification = loadClassification(paths);
+  const loaded = loadCascadeInput({ paths, home, cwd, read });
+  const selections = readDirectorySelections(loaded);
+  const git = resolveGitBranch(realRunPort, cwd);
+  const decidedIdentity = decideIdentity({
+    env: params.env,
+    argv0Identity: params.identity,
+    directoryPinnedIdentity: selections.identity,
+    readActiveIdentityFile: () => {
+      const raw = realFsPort.readFileUtf8(paths.activeIdentityFile);
+      if (raw === void 0) {
+        return void 0;
+      }
+      const trimmed = raw.trim();
+      return trimmed === "" ? void 0 : trimmed;
+    }
+  });
+  let poolPick;
+  if (decidedIdentity.pool !== void 0) {
+    const pool = loaded.globalConfig?.pools?.[decidedIdentity.pool];
+    if (pool === void 0) {
+      throw new PoolNotFoundError(decidedIdentity.pool);
+    }
+    poolPick = collectPoolPick({ paths, fs: realFsPort, usageFs: realFarmFs, poolName: decidedIdentity.pool, pool, directory: cwd, nowMs: Date.now() });
+  }
+  const identityDecision = poolPick?.pick === void 0 ? decidedIdentity : { ...decidedIdentity, name: poolPick.pick };
+  const loadedIdentity = identityDecision.name === void 0 ? void 0 : loadIdentity(paths.identitiesDir, identityDecision.name, realFsPort);
+  const configProfileDecision = decideConfigProfile({
+    env: params.env,
+    directoryRuleConfigProfile: selections.configProfile,
+    identityDefaultConfigProfile: loadedIdentity?.config.defaultConfigProfile,
+    globalDefaultConfigProfile: loaded.globalConfig?.defaultConfigProfile
+  });
+  const cascade = loadCascadeInput({
+    paths,
+    home,
+    cwd,
+    read,
+    ...configProfileDecision.name === void 0 ? {} : { baseConfigProfile: configProfileDecision.name }
+  }).input;
+  const providerName = cascadeProviderName(cascade);
+  const provider = providerName === void 0 ? void 0 : loadCheckProvider(paths, providerName);
+  const farmRoot = identityDecision.name === void 0 ? void 0 : import_node_path26.default.join(paths.identitiesDir, identityDecision.name);
+  const settingsFiles = {
+    "settings.json": realFsPort.readFileUtf8(import_node_path26.default.join(claudeHome, "settings.json")),
+    "settings.local.json": realFsPort.readFileUtf8(import_node_path26.default.join(claudeHome, "settings.local.json"))
+  };
+  const report = runCheck({
+    cwd,
+    home,
+    claudeHome,
+    env: params.env,
+    ...git.branch === void 0 ? {} : { branch: git.branch },
+    ...git.branchDetached === void 0 ? {} : { branchDetached: git.branchDetached },
+    nowMs: Date.now(),
+    farmFs: realFarmFs,
+    cascade,
+    classification,
+    ...identityDecision.name === void 0 ? {} : { identityName: identityDecision.name },
+    identitySource: identityDecision.source,
+    ...poolPick === void 0 ? {} : { poolPick },
+    ...configProfileDecision.name === void 0 ? {} : { configProfileName: configProfileDecision.name },
+    configProfileSource: configProfileDecision.source,
+    ...loadedIdentity === void 0 ? {} : { identity: loadedIdentity.config },
+    settingsFiles,
+    run: realRunPort,
+    ...farmRoot === void 0 ? {} : { farmRoot },
+    platform: process.platform,
+    ...provider === void 0 ? {} : { provider }
+  });
+  return report;
+}
+
+// src/check.ts
 function registerCheckCommand(program2, deps) {
   const { paths } = deps;
   const command = program2.command("check [path]").description(
     "Show what a launch in a directory would share or hide and why, plus credential and settings diagnostics. Never touches the farm or spawns claude."
   ).option("--identity <name>", "Identity to check (defaults to the identity a launch there would resolve).").option("--json", "Print the report as JSON.").option("--strict", "Exit 1 when the report carries any warning, not only on errors.").action((pathArg, options) => {
-    const cwd = pathArg === void 0 ? process.cwd() : import_node_path26.default.resolve(pathArg);
-    const home = import_node_os5.default.homedir();
-    const claudeHome = resolveClaudeHome();
-    const read = cosmiconfigReader();
-    const classification = loadClassification(paths);
-    const loaded = loadCascadeInput({ paths, home, cwd, read });
-    const selections = readDirectorySelections(loaded);
-    const git = resolveGitBranch(realRunPort, cwd);
-    const decidedIdentity = decideIdentity({
-      env: process.env,
-      argv0Identity: options.identity,
-      directoryPinnedIdentity: selections.identity,
-      readActiveIdentityFile: () => {
-        const raw = realFsPort.readFileUtf8(paths.activeIdentityFile);
-        if (raw === void 0) {
-          return void 0;
-        }
-        const trimmed = raw.trim();
-        return trimmed === "" ? void 0 : trimmed;
-      }
-    });
-    let poolPick;
-    if (decidedIdentity.pool !== void 0) {
-      const pool = loaded.globalConfig?.pools?.[decidedIdentity.pool];
-      if (pool === void 0) {
-        throw new PoolNotFoundError(decidedIdentity.pool);
-      }
-      poolPick = collectPoolPick({ paths, fs: realFsPort, usageFs: realFarmFs, poolName: decidedIdentity.pool, pool, directory: cwd, nowMs: Date.now() });
-    }
-    const identityDecision = poolPick?.pick === void 0 ? decidedIdentity : { ...decidedIdentity, name: poolPick.pick };
-    const loadedIdentity = identityDecision.name === void 0 ? void 0 : loadIdentity(paths.identitiesDir, identityDecision.name, realFsPort);
-    const configProfileDecision = decideConfigProfile({
-      env: process.env,
-      directoryRuleConfigProfile: selections.configProfile,
-      identityDefaultConfigProfile: loadedIdentity?.config.defaultConfigProfile,
-      globalDefaultConfigProfile: loaded.globalConfig?.defaultConfigProfile
-    });
-    const cascade = loadCascadeInput({
-      paths,
-      home,
-      cwd,
-      read,
-      ...configProfileDecision.name === void 0 ? {} : { baseConfigProfile: configProfileDecision.name }
-    }).input;
-    const providerName = cascadeProviderName(cascade);
-    const provider = providerName === void 0 ? void 0 : loadCheckProvider(paths, providerName);
-    const farmRoot = identityDecision.name === void 0 ? void 0 : import_node_path26.default.join(paths.identitiesDir, identityDecision.name);
-    const settingsFiles = {
-      "settings.json": realFsPort.readFileUtf8(import_node_path26.default.join(claudeHome, "settings.json")),
-      "settings.local.json": realFsPort.readFileUtf8(import_node_path26.default.join(claudeHome, "settings.local.json"))
-    };
-    const report = runCheck({
-      cwd,
-      home,
-      claudeHome,
-      env: process.env,
-      ...git.branch === void 0 ? {} : { branch: git.branch },
-      ...git.branchDetached === void 0 ? {} : { branchDetached: git.branchDetached },
-      nowMs: Date.now(),
-      farmFs: realFarmFs,
-      cascade,
-      classification,
-      ...identityDecision.name === void 0 ? {} : { identityName: identityDecision.name },
-      identitySource: identityDecision.source,
-      ...poolPick === void 0 ? {} : { poolPick },
-      ...configProfileDecision.name === void 0 ? {} : { configProfileName: configProfileDecision.name },
-      configProfileSource: configProfileDecision.source,
-      ...loadedIdentity === void 0 ? {} : { identity: loadedIdentity.config },
-      settingsFiles,
-      run: realRunPort,
-      ...farmRoot === void 0 ? {} : { farmRoot },
-      platform: process.platform,
-      ...provider === void 0 ? {} : { provider }
-    });
+    const cwd = pathArg === void 0 ? process.cwd() : import_node_path27.default.resolve(pathArg);
+    const report = collectCheckReport({ paths, cwd, ...options.identity === void 0 ? {} : { identity: options.identity }, env: process.env });
     if (options.json === true) {
       printJson(checkReportToJson(report));
     } else {
@@ -63314,10 +63218,10 @@ function registerCheckCommand(program2, deps) {
 var import_node_crypto6 = require("node:crypto");
 var import_node_fs10 = __toESM(require("node:fs"), 1);
 var import_node_os6 = __toESM(require("node:os"), 1);
-var import_node_path28 = __toESM(require("node:path"), 1);
+var import_node_path29 = __toESM(require("node:path"), 1);
 
 // src/frontdoor/state.ts
-var import_node_path27 = __toESM(require("node:path"), 1);
+var import_node_path28 = __toESM(require("node:path"), 1);
 var FRONT_DOOR_PROTOCOL = 1;
 var FrontDoorSessionSchema = external_exports.strictObject({ pid: external_exports.number().int().positive(), startedAt: external_exports.number(), token: external_exports.string().min(1) });
 var FrontDoorStateSchema = external_exports.strictObject({
@@ -63368,7 +63272,7 @@ function readFrontDoorState(fs18, stateFile) {
   }
 }
 function writeFrontDoorState(fs18, stateFile, state) {
-  fs18.mkdirp(import_node_path27.default.dirname(stateFile));
+  fs18.mkdirp(import_node_path28.default.dirname(stateFile));
   fs18.writeFileUtf8(stateFile, `${JSON.stringify(state, null, 2)}
 `);
 }
@@ -63378,7 +63282,7 @@ function frontDoorOrigin(state) {
 }
 function writeFrontDoorSession(fs18, sessionsDir, session) {
   fs18.mkdirPrivate(sessionsDir);
-  fs18.writeFilePrivate(import_node_path27.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
+  fs18.writeFilePrivate(import_node_path28.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
 `);
 }
 function listFrontDoorSessions(fs18, sessionsDir) {
@@ -63388,7 +63292,7 @@ function listFrontDoorSessions(fs18, sessionsDir) {
       continue;
     }
     try {
-      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs18.readFileUtf8(import_node_path27.default.join(sessionsDir, name)) ?? ""));
+      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs18.readFileUtf8(import_node_path28.default.join(sessionsDir, name)) ?? ""));
       if (parsed.success) {
         sessions.push({ pid: parsed.data.pid, startedAt: parsed.data.startedAt });
       }
@@ -63399,7 +63303,7 @@ function listFrontDoorSessions(fs18, sessionsDir) {
   return sessions.sort((a2, b) => a2.pid - b.pid);
 }
 function removeFrontDoorSession(fs18, sessionsDir, pid) {
-  fs18.removeRecursive(import_node_path27.default.join(sessionsDir, `${String(pid)}.json`));
+  fs18.removeRecursive(import_node_path28.default.join(sessionsDir, `${String(pid)}.json`));
 }
 function pruneDeadFrontDoorSessions(fs18, sessionsDir, isRunning) {
   const removed = [];
@@ -63418,7 +63322,7 @@ function liveSessionTokens(fs18, sessionsDir) {
       continue;
     }
     try {
-      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs18.readFileUtf8(import_node_path27.default.join(sessionsDir, name)) ?? ""));
+      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs18.readFileUtf8(import_node_path28.default.join(sessionsDir, name)) ?? ""));
       if (parsed.success) {
         tokens.add(parsed.data.token);
       }
@@ -63666,10 +63570,10 @@ async function callCodex(ports, request6, sessionId, signal) {
 // src/codex/commands.ts
 function codexHome(env, home) {
   const fromEnv = env.CODEX_HOME;
-  return fromEnv !== void 0 && fromEnv !== "" ? fromEnv : import_node_path28.default.join(home, ".codex");
+  return fromEnv !== void 0 && fromEnv !== "" ? fromEnv : import_node_path29.default.join(home, ".codex");
 }
 function codexUsageSnapshotPath() {
-  return import_node_path28.default.join(resolveClaudeHome(), "codex-quota.json");
+  return import_node_path29.default.join(resolveClaudeHome(), "codex-quota.json");
 }
 function isEnoent4(error62) {
   return typeof error62 === "object" && error62 !== null && "code" in error62 && error62.code === "ENOENT";
@@ -63698,7 +63602,7 @@ function writeUsageSnapshot(log, snapshot) {
   const target = codexUsageSnapshotPath();
   const temp = `${target}.${String(process.pid)}.tmp`;
   try {
-    import_node_fs10.default.mkdirSync(import_node_path28.default.dirname(target), { recursive: true });
+    import_node_fs10.default.mkdirSync(import_node_path29.default.dirname(target), { recursive: true });
     import_node_fs10.default.writeFileSync(temp, `${JSON.stringify(snapshot, null, 2)}
 `);
     import_node_fs10.default.renameSync(temp, target);
@@ -63709,7 +63613,7 @@ function writeUsageSnapshot(log, snapshot) {
 function createCodexRoutePorts(log) {
   const agent = createUpstreamAgent();
   const upstreamFetch = createUpstreamFetch(agent);
-  const auth = createCodexAuthStore(import_node_path28.default.join(codexHome(process.env, import_node_os6.default.homedir()), "auth.json"), {
+  const auth = createCodexAuthStore(import_node_path29.default.join(codexHome(process.env, import_node_os6.default.homedir()), "auth.json"), {
     fs: realCodexAuthFs,
     fetch: upstreamFetch,
     now: () => /* @__PURE__ */ new Date(),
@@ -63784,7 +63688,7 @@ function registerCodexCommand(program2, deps) {
 
 // src/frontdoor/commands.ts
 var import_node_crypto13 = require("node:crypto");
-var import_node_path30 = __toESM(require("node:path"), 1);
+var import_node_path31 = __toESM(require("node:path"), 1);
 var import_node_fs11 = __toESM(require("node:fs"), 1);
 
 // src/frontdoor/custody.ts
@@ -63924,7 +63828,7 @@ function isLiveCapability(presented, live) {
 
 // src/frontdoor/capture.ts
 var fs11 = __toESM(require("node:fs"), 1);
-var path29 = __toESM(require("node:path"), 1);
+var path30 = __toESM(require("node:path"), 1);
 var SECRET_HEADER_NAME = /authorization|cookie|token|secret|credential|api[-_]key/i;
 var SECRET_JSON_KEY = /token|secret|password|credential|authorization|api[-_]key/i;
 var SECRET_BODY_PATTERNS = [
@@ -63968,10 +63872,10 @@ function redactBody(chunk) {
 }
 var CAPTURE_ENV = "AGENT_SHIM_FRONTDOOR_CAPTURE";
 function captureFromEnv(env, logsDir) {
-  return env[CAPTURE_ENV] === "1" ? createFileCapture(path29.join(logsDir, "frontdoor-capture.jsonl")) : void 0;
+  return env[CAPTURE_ENV] === "1" ? createFileCapture(path30.join(logsDir, "frontdoor-capture.jsonl")) : void 0;
 }
 function createFileCapture(file2, now = () => /* @__PURE__ */ new Date()) {
-  fs11.mkdirSync(path29.dirname(file2), { recursive: true });
+  fs11.mkdirSync(path30.dirname(file2), { recursive: true });
   let nextId = 0;
   const append = (record2) => {
     fs11.appendFileSync(file2, `${JSON.stringify({ ts: now().toISOString(), ...record2 })}
@@ -64514,8 +64418,8 @@ function parseConnectTarget(authority) {
   }
   return { host, port };
 }
-function servedByPipeline(path39) {
-  return path39?.startsWith(ROUTED_PATH_PREFIX) === true;
+function servedByPipeline(path40) {
+  return path40?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
   "connection",
@@ -64595,7 +64499,7 @@ async function startConnectServer(config2, effects, preferredPort) {
 ${request6.rawHeaders.reduce((accumulated, value, index) => index % 2 === 0 ? `${accumulated}${value}: ` : `${accumulated}${value}\r
 `, "")}\r
 `;
-    pumpTapSession(socket, async (clientAlpn) => await effects.connectTlsUpstream(host, HTTPS_PORT, clientAlpn), void 0, Buffer.from(headText, "utf8"));
+    pumpTapSession(socket, async (clientAlpn) => await effects.connectTlsUpstream(host, HTTPS_PORT, clientAlpn), config2.capture?.tapStream?.(host), Buffer.from(headText, "utf8"));
   };
   const sessions = config2.interceptHosts.map((host) => {
     if (config2.tapHosts.includes(host)) {
@@ -66337,8 +66241,8 @@ function createCodexRouteMount(ports, upstreamBase, provider) {
         request6.body.resume();
         return;
       }
-      const path39 = new URL(request6.url, "http://127.0.0.1").pathname;
-      const translated = { method: request6.method, path: path39, body, signal: request6.signal };
+      const path40 = new URL(request6.url, "http://127.0.0.1").pathname;
+      const translated = { method: request6.method, path: path40, body, signal: request6.signal };
       const routed = await route(translated);
       if (request6.signal.aborted) {
         return;
@@ -66372,7 +66276,7 @@ function createPassthroughRoute(name, target) {
     headroomUpstream: target.headroomUpstream,
     serve: async (request6, response) => {
       const incoming = new URL(request6.url, "http://127.0.0.1");
-      const path39 = target.stripPrefix !== void 0 && incoming.pathname.startsWith(target.stripPrefix) ? incoming.pathname.slice(target.stripPrefix.length) : incoming.pathname;
+      const path40 = target.stripPrefix !== void 0 && incoming.pathname.startsWith(target.stripPrefix) ? incoming.pathname.slice(target.stripPrefix.length) : incoming.pathname;
       const headers = forwardableHeaders(request6.headers);
       delete headers.host;
       await new Promise((resolve) => {
@@ -66380,7 +66284,7 @@ function createPassthroughRoute(name, target) {
           host: base.hostname,
           port: base.port === "" ? void 0 : Number(base.port),
           method: request6.method,
-          path: `${basePath}${path39}${incoming.search}`,
+          path: `${basePath}${path40}${incoming.search}`,
           headers,
           agent
         };
@@ -66442,10 +66346,10 @@ function createProviderRouteResolver(deps) {
     return route;
   };
   const resolve = (request6) => {
-    const path39 = new URL(request6.url, "http://127.0.0.1").pathname;
-    const scoped = parseProviderPath(path39);
+    const path40 = new URL(request6.url, "http://127.0.0.1").pathname;
+    const scoped = parseProviderPath(path40);
     if (scoped === void 0) {
-      return path39.startsWith("/v1/") ? { ok: true, route: oauthRoute } : { ok: false, status: HTTP_STATUS.notFound, message: `no such endpoint: ${path39}` };
+      return path40.startsWith("/v1/") ? { ok: true, route: oauthRoute } : { ok: false, status: HTTP_STATUS.notFound, message: `no such endpoint: ${path40}` };
     }
     const { provider } = scoped;
     let definition;
@@ -66486,11 +66390,11 @@ function createProviderRouteResolver(deps) {
 
 // src/frontdoor/trust.ts
 var import_node_crypto12 = require("node:crypto");
-var import_node_path29 = __toESM(require("node:path"), 1);
+var import_node_path30 = __toESM(require("node:path"), 1);
 var BUNDLE_NAME_HEX_DIGITS = 16;
 function resolveTrustBundle(params) {
   const { caCertFile, bundlesDir, inherited, fs: fs18 } = params;
-  if (inherited === void 0 || inherited === "" || import_node_path29.default.resolve(inherited) === import_node_path29.default.resolve(caCertFile)) {
+  if (inherited === void 0 || inherited === "" || import_node_path30.default.resolve(inherited) === import_node_path30.default.resolve(caCertFile)) {
     return { path: caCertFile };
   }
   const caPem = fs18.readFileUtf8(caCertFile);
@@ -66508,7 +66412,7 @@ function resolveTrustBundle(params) {
   }
   const combined = `${inheritedPem.trimEnd()}
 ${caPem}`;
-  const bundle = import_node_path29.default.join(bundlesDir, `${(0, import_node_crypto12.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
+  const bundle = import_node_path30.default.join(bundlesDir, `${(0, import_node_crypto12.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
   if (!fs18.exists(bundle)) {
     fs18.mkdirp(bundlesDir);
     fs18.writeFileAtomic(bundle, combined);
@@ -66878,7 +66782,7 @@ function realFrontDoorSupervisorPorts(paths) {
       const leafFor = createLeafCache(loadCa(), () => /* @__PURE__ */ new Date());
       const capture = captureFromEnv(process.env, paths.logsDir);
       if (capture !== void 0) {
-        log(`capture enabled, recording CONNECT targets and piped exchanges to ${import_node_path30.default.join(paths.logsDir, "frontdoor-capture.jsonl")}`);
+        log(`capture enabled, recording CONNECT targets and piped exchanges to ${import_node_path31.default.join(paths.logsDir, "frontdoor-capture.jsonl")}`);
       }
       const server = await startConnectServer(
         {
@@ -67328,15 +67232,15 @@ var import_node_child_process4 = require("node:child_process");
 
 // src/identityToken.ts
 var import_node_fs12 = __toESM(require("node:fs"), 1);
-var import_node_path31 = __toESM(require("node:path"), 1);
+var import_node_path32 = __toESM(require("node:path"), 1);
 var TOKEN_FILE_MODE = 384;
 var TOKEN_DIR_MODE = 448;
 var OAUTH_TOKEN_RE = /^sk-ant-oat\d+-[A-Za-z0-9_-]+$/;
 function identityTokenDir(paths) {
-  return import_node_path31.default.join(paths.root, "credentials");
+  return import_node_path32.default.join(paths.root, "credentials");
 }
 function identityTokenPath(paths, identityName) {
-  return import_node_path31.default.join(identityTokenDir(paths), `${identityName}.token`);
+  return import_node_path32.default.join(identityTokenDir(paths), `${identityName}.token`);
 }
 function storeIdentityToken(paths, identityName, raw) {
   const token = raw.trim();
@@ -67347,7 +67251,7 @@ function storeIdentityToken(paths, identityName, raw) {
   import_node_fs12.default.mkdirSync(dir, { recursive: true, mode: TOKEN_DIR_MODE });
   import_node_fs12.default.chmodSync(dir, TOKEN_DIR_MODE);
   const target = identityTokenPath(paths, identityName);
-  const temp = import_node_path31.default.join(dir, `.${identityName}.${String(process.pid)}.tmp`);
+  const temp = import_node_path32.default.join(dir, `.${identityName}.${String(process.pid)}.tmp`);
   import_node_fs12.default.writeFileSync(temp, `${token}
 `, { mode: TOKEN_FILE_MODE });
   import_node_fs12.default.renameSync(temp, target);
@@ -67357,7 +67261,7 @@ function storeIdentityToken(paths, identityName, raw) {
 // src/realCredentialCache.ts
 var import_node_child_process3 = require("node:child_process");
 var import_node_fs13 = __toESM(require("node:fs"), 1);
-var import_node_path32 = __toESM(require("node:path"), 1);
+var import_node_path33 = __toESM(require("node:path"), 1);
 var KEYCHAIN_CACHE_SERVICE = "agent-shim-credential-cache";
 var CACHE_DIR_MODE = 448;
 var CACHE_FILE_MODE = 384;
@@ -67384,8 +67288,8 @@ function security(args, stdin2) {
   return { status: result.status, stdout: result.stdout };
 }
 function createRealCredentialCache(root) {
-  const dir = import_node_path32.default.join(root, "credential-cache");
-  const filePath = (owner) => import_node_path32.default.join(dir, cacheFileNameFor(owner));
+  const dir = import_node_path33.default.join(root, "credential-cache");
+  const filePath = (owner) => import_node_path33.default.join(dir, cacheFileNameFor(owner));
   return {
     read(store, owner) {
       if (store === "file") {
@@ -67562,9 +67466,9 @@ function subjectName(positional, provider) {
   return name;
 }
 
-// src/doctor.ts
+// src/doctorReport.ts
 var import_node_fs14 = __toESM(require("node:fs"), 1);
-var import_node_path33 = __toESM(require("node:path"), 1);
+var import_node_path34 = __toESM(require("node:path"), 1);
 
 // src/headroom/source.ts
 var GIT_SPEC_RE = /git\+[^@\s]+(?:@([^\s#]+))?/;
@@ -67591,7 +67495,7 @@ function parseInstalledCommit(directUrlJson) {
   }
 }
 
-// src/doctor.ts
+// src/doctorReport.ts
 function refinePathShadow(status, ownExecutablePath, realpath) {
   if (status.status !== "shadowed") {
     return status;
@@ -67615,7 +67519,7 @@ function validateJson(schema, input2) {
   return { ok: true, data: result.data };
 }
 function pushPathResolution(push, resolution) {
-  const ownDir = import_node_path33.default.dirname(resolution.ownExecutablePath);
+  const ownDir = import_node_path34.default.dirname(resolution.ownExecutablePath);
   switch (resolution.agentShim.status) {
     case "ok":
       push("path-resolution", "pass", `\`agent-shim\` on PATH resolves to this running executable, ${resolution.ownExecutablePath}.`, "agent-shim");
@@ -67683,14 +67587,14 @@ function pushProvider(push, entry) {
 }
 function pushLegacyName(push, params) {
   const legacyVariables = Object.keys(params.env).filter((name) => name.startsWith(LEGACY_ENV_PREFIX) && params.env[name] !== void 0).sort();
-  if (legacyVariables.length === 0 && import_node_path33.default.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
+  if (legacyVariables.length === 0 && import_node_path34.default.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
     push("legacy-name", "pass", "Nothing here still uses the former `claude-use` name.");
     return;
   }
   for (const name of legacyVariables) {
     push("legacy-name", "warn", `${name} is the former name of ${name.replace(LEGACY_ENV_PREFIX, ENV_PREFIX)}. Rename it; the old name still works but is only a fallback.`, name);
   }
-  if (import_node_path33.default.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
+  if (import_node_path34.default.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
     push(
       "legacy-name",
       "warn",
@@ -67994,80 +67898,87 @@ function realpathOrSelf(target) {
     return target;
   }
 }
+function collectDoctorReport(params) {
+  const { paths } = params;
+  const identityNames = import_node_fs14.default.existsSync(paths.identitiesDir) ? import_node_fs14.default.readdirSync(paths.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && isIdentityDirectoryName(entry.name)).map((entry) => entry.name).sort() : [];
+  const identities = identityNames.map((name) => {
+    const farmRoot = import_node_path34.default.join(paths.identitiesDir, name);
+    const identityPath = import_node_path34.default.join(farmRoot, "identity.json");
+    return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot };
+  });
+  const profileNames = import_node_fs14.default.existsSync(paths.configProfilesDir) ? import_node_fs14.default.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
+  const configProfiles = profileNames.map((name) => {
+    const profilePath = import_node_path34.default.join(paths.configProfilesDir, `${name}.json`);
+    return { name, path: profilePath, raw: realFsPort.readFileUtf8(profilePath) };
+  });
+  const providerNames = import_node_fs14.default.existsSync(paths.providersDir) ? import_node_fs14.default.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
+  const providers = providerNames.map((name) => {
+    const providerPath = import_node_path34.default.join(paths.providersDir, `${name}.json`);
+    return { name, path: providerPath, raw: realFsPort.readFileUtf8(providerPath) };
+  });
+  const ownExecutablePath = realOwnExecutablePath();
+  let binaryDiscovery;
+  try {
+    const binary = realResolveClaudeBinary(resolveOwnInstallDirs(paths, ownExecutablePath))();
+    binaryDiscovery = { ok: true, binary };
+  } catch (error62) {
+    binaryDiscovery = { ok: false, message: error62 instanceof Error ? error62.message : String(error62) };
+  }
+  const shimState = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
+  const pathDirs = (params.env.PATH ?? "").split(import_node_path34.default.delimiter).filter((dir) => dir !== "");
+  const claudeShimShadow = shimState === void 0 ? void 0 : refinePathShadow(
+    findPathShadow({
+      pathDirs,
+      targetDir: import_node_path34.default.dirname(shimState.targetPath),
+      targetFilename: import_node_path34.default.basename(shimState.targetPath),
+      findExecutableInDir
+    }),
+    shimState.targetPath,
+    realpathOrSelf
+  );
+  const report = runDoctor({
+    env: params.env,
+    identities,
+    configProfiles,
+    providers,
+    directoryRules: { path: paths.directoryRulesFile, raw: realFsPort.readFileUtf8(paths.directoryRulesFile) },
+    globalConfig: { path: paths.globalConfigFile, raw: realFsPort.readFileUtf8(paths.globalConfigFile) },
+    categoriesLocal: { path: paths.categoriesLocalFile, raw: realFsPort.readFileUtf8(paths.categoriesLocalFile) },
+    activeIdentity: { path: paths.activeIdentityFile, raw: realFsPort.readFileUtf8(paths.activeIdentityFile) },
+    binaryDiscovery,
+    claudeShim: { state: shimState, targetExists: shimState !== void 0 && import_node_fs14.default.existsSync(shimState.targetPath) },
+    rootPath: paths.root,
+    pathResolution: {
+      ownExecutablePath,
+      agentShim: refinePathShadow(
+        findPathShadow({
+          pathDirs,
+          targetDir: import_node_path34.default.dirname(ownExecutablePath),
+          targetFilename: commandFilename(ownExecutablePath, "agent-shim"),
+          findExecutableInDir
+        }),
+        ownExecutablePath,
+        realpathOrSelf
+      ),
+      ...claudeShimShadow === void 0 ? {} : { claude: claudeShimShadow }
+    },
+    run: realRunPort,
+    platform: process.platform,
+    headroom: {
+      state: { path: paths.headroomStateFile, raw: realFsPort.readFileUtf8(paths.headroomStateFile) },
+      isRunning: realIsProcessRunning
+    }
+  });
+  return report;
+}
+
+// src/doctor.ts
 function registerDoctorCommand(program2, deps) {
   const { paths } = deps;
   const command = program2.command("doctor").description(
     "Audit the whole ~/.agent-shim config graph: every identity, every configuration profile's extends chain, every provider, directory-rules.json, config.json, categories.local.json, active-identity, and real Claude Code binary discoverability. Identity/directory-agnostic, unlike `check`. Exits 1 when any check fails."
   ).option("--json", "Print the report as JSON.").action((options) => {
-    const identityNames = import_node_fs14.default.existsSync(paths.identitiesDir) ? import_node_fs14.default.readdirSync(paths.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && isIdentityDirectoryName(entry.name)).map((entry) => entry.name).sort() : [];
-    const identities = identityNames.map((name) => {
-      const farmRoot = import_node_path33.default.join(paths.identitiesDir, name);
-      const identityPath = import_node_path33.default.join(farmRoot, "identity.json");
-      return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot };
-    });
-    const profileNames = import_node_fs14.default.existsSync(paths.configProfilesDir) ? import_node_fs14.default.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
-    const configProfiles = profileNames.map((name) => {
-      const profilePath = import_node_path33.default.join(paths.configProfilesDir, `${name}.json`);
-      return { name, path: profilePath, raw: realFsPort.readFileUtf8(profilePath) };
-    });
-    const providerNames = import_node_fs14.default.existsSync(paths.providersDir) ? import_node_fs14.default.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
-    const providers = providerNames.map((name) => {
-      const providerPath = import_node_path33.default.join(paths.providersDir, `${name}.json`);
-      return { name, path: providerPath, raw: realFsPort.readFileUtf8(providerPath) };
-    });
-    const ownExecutablePath = realOwnExecutablePath();
-    let binaryDiscovery;
-    try {
-      const binary = realResolveClaudeBinary(resolveOwnInstallDirs(paths, ownExecutablePath))();
-      binaryDiscovery = { ok: true, binary };
-    } catch (error62) {
-      binaryDiscovery = { ok: false, message: error62 instanceof Error ? error62.message : String(error62) };
-    }
-    const shimState = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-    const pathDirs = (process.env.PATH ?? "").split(import_node_path33.default.delimiter).filter((dir) => dir !== "");
-    const claudeShimShadow = shimState === void 0 ? void 0 : refinePathShadow(
-      findPathShadow({
-        pathDirs,
-        targetDir: import_node_path33.default.dirname(shimState.targetPath),
-        targetFilename: import_node_path33.default.basename(shimState.targetPath),
-        findExecutableInDir
-      }),
-      shimState.targetPath,
-      realpathOrSelf
-    );
-    const report = runDoctor({
-      env: process.env,
-      identities,
-      configProfiles,
-      providers,
-      directoryRules: { path: paths.directoryRulesFile, raw: realFsPort.readFileUtf8(paths.directoryRulesFile) },
-      globalConfig: { path: paths.globalConfigFile, raw: realFsPort.readFileUtf8(paths.globalConfigFile) },
-      categoriesLocal: { path: paths.categoriesLocalFile, raw: realFsPort.readFileUtf8(paths.categoriesLocalFile) },
-      activeIdentity: { path: paths.activeIdentityFile, raw: realFsPort.readFileUtf8(paths.activeIdentityFile) },
-      binaryDiscovery,
-      claudeShim: { state: shimState, targetExists: shimState !== void 0 && import_node_fs14.default.existsSync(shimState.targetPath) },
-      rootPath: paths.root,
-      pathResolution: {
-        ownExecutablePath,
-        agentShim: refinePathShadow(
-          findPathShadow({
-            pathDirs,
-            targetDir: import_node_path33.default.dirname(ownExecutablePath),
-            targetFilename: commandFilename(ownExecutablePath, "agent-shim"),
-            findExecutableInDir
-          }),
-          ownExecutablePath,
-          realpathOrSelf
-        ),
-        ...claudeShimShadow === void 0 ? {} : { claude: claudeShimShadow }
-      },
-      run: realRunPort,
-      platform: process.platform,
-      headroom: {
-        state: { path: paths.headroomStateFile, raw: realFsPort.readFileUtf8(paths.headroomStateFile) },
-        isRunning: realIsProcessRunning
-      }
-    });
+    const report = collectDoctorReport({ paths, env: process.env });
     if (options.json === true) {
       printJson(report);
     } else {
@@ -68085,7 +67996,7 @@ function registerDoctorCommand(program2, deps) {
 // src/headroom/commands.ts
 var import_node_fs15 = __toESM(require("node:fs"), 1);
 var import_node_net3 = __toESM(require("node:net"), 1);
-var import_node_path34 = __toESM(require("node:path"), 1);
+var import_node_path35 = __toESM(require("node:path"), 1);
 var import_node_child_process5 = require("node:child_process");
 
 // src/headroom/settings.ts
@@ -68500,12 +68411,12 @@ function readInstalledHeadroomCommit() {
   if (toolDir.status !== 0) {
     return void 0;
   }
-  const libDir = import_node_path34.default.join(toolDir.stdout.trim(), HEADROOM_TOOL_NAME, "lib");
+  const libDir = import_node_path35.default.join(toolDir.stdout.trim(), HEADROOM_TOOL_NAME, "lib");
   for (const python of realFarmFs.readdir(libDir)) {
-    const sitePackages = import_node_path34.default.join(libDir, python, "site-packages");
+    const sitePackages = import_node_path35.default.join(libDir, python, "site-packages");
     for (const entry of realFarmFs.readdir(sitePackages)) {
       if (entry.startsWith("headroom_ai-") && entry.endsWith(".dist-info")) {
-        const directUrl = realFarmFs.readFileUtf8(import_node_path34.default.join(sitePackages, entry, "direct_url.json"));
+        const directUrl = realFarmFs.readFileUtf8(import_node_path35.default.join(sitePackages, entry, "direct_url.json"));
         return directUrl === void 0 ? void 0 : parseInstalledCommit(directUrl);
       }
     }
@@ -68643,6 +68554,118 @@ function registerHeadroomCommand(program2, deps) {
   });
 }
 
+// src/pools.ts
+function formatPoolPick(report, nowMs) {
+  const head = report.pick === void 0 ? `Pool ${report.pool}: every member is refused right now${report.earliestReturn === void 0 ? "" : `; ${report.earliestReturn.identity} returns at ${report.earliestReturn.at} (in ${formatAge(Date.parse(report.earliestReturn.at) - nowMs)})`}` : `Pool ${report.pool}: a launch from ${report.directory} would run as ${report.pick}`;
+  const rows = report.candidates.map((candidate, index) => {
+    const score = candidate.score === void 0 ? "" : ` score ${candidate.score.toFixed(2)}`;
+    const dry = candidate.feasible ? "" : " (5h would run dry)";
+    return `  ${String(index + 1)}. ${candidate.identity} [${candidate.class}${score}]${dry}
+     ${candidate.reasons.join("; ")}`;
+  });
+  return [head, ...rows, ...report.missing.map((name) => `  (skipped: ${name} is not an identity)`), ...report.stickyProblem === void 0 ? [] : [`Note: ${report.stickyProblem}; the last-pick record was ignored.`]];
+}
+function requireIdentities(paths, names) {
+  const existing = new Set(listIdentities(paths).map((entry) => entry.name));
+  for (const name of names) {
+    if (!existing.has(name)) {
+      throw new IdentityNotFoundError(name);
+    }
+  }
+}
+function membersOf(options) {
+  if (options.identity === void 0 || options.identity.length === 0) {
+    throw new UsageError("A pool needs at least one member: pass --identity <name> (repeatable).");
+  }
+  return options.identity;
+}
+function registerPoolCommand(program2, deps) {
+  const { paths } = deps;
+  const pool = withExamples(
+    program2.command("pool").description("Manage pools: named sets of identities that a launch picks one member of, by remaining quota, with `claude @pool:<name>`."),
+    ["agent-shim pool add subs --identity work --identity personal", "agent-shim pool pick subs"]
+  );
+  withExamples(
+    pool.command("add <name>").description("Define a pool. Fails if one with this name already exists.").option("--identity <name>", "A member identity (repeatable).", collectRepeated).action((name, options) => {
+      const members2 = membersOf(options);
+      requireIdentities(paths, members2);
+      addPool(paths, name, members2);
+      console.log(`Created pool "${name}" with ${members2.join(", ")}.`);
+    }),
+    ["agent-shim pool add subs --identity work --identity personal"]
+  );
+  withExamples(
+    pool.command("set <name>").description("Replace a pool's members.").option("--identity <name>", "A member identity (repeatable); the full new list.", collectRepeated).action((name, options) => {
+      const members2 = membersOf(options);
+      requireIdentities(paths, members2);
+      setPool(paths, name, members2);
+      console.log(`Pool "${name}" now has ${members2.join(", ")}.`);
+    }),
+    ["agent-shim pool set subs --identity work --identity personal --identity spare"]
+  );
+  withExamples(
+    pool.command("list").description("List every pool and its members, marking the active selection with *.").option("--json", "Print the pools as JSON.").action((options) => {
+      const pools = readPools(paths);
+      const active = readActiveIdentity(paths);
+      if (options.json === true) {
+        printJson(Object.entries(pools).map(([name, entry]) => ({ name, identities: entry.identities, active: active === `${POOL_SELECTOR_PREFIX}${name}` })));
+        return;
+      }
+      const names = Object.keys(pools).sort();
+      if (names.length === 0) {
+        console.log("No pools yet. Run `agent-shim pool add <name> --identity <name>...` to create one.");
+        return;
+      }
+      for (const name of names) {
+        console.log(`${active === `${POOL_SELECTOR_PREFIX}${name}` ? "*" : " "} ${name}: ${(pools[name]?.identities ?? []).join(", ")}`);
+      }
+    }),
+    ["agent-shim pool list", "agent-shim pool list --json"]
+  );
+  withExamples(
+    pool.command("show <name>").description("Show one pool's members.").option("--json", "Print the pool as JSON.").action((name, options) => {
+      const entry = requirePool(paths, name);
+      if (options.json === true) {
+        printJson({ name, identities: entry.identities });
+        return;
+      }
+      console.log(`Pool: ${name}`);
+      console.log(`Members: ${entry.identities.join(", ")}`);
+    }),
+    ["agent-shim pool show subs"]
+  );
+  withExamples(
+    pool.command("remove <name>").description("Delete a pool. Its member identities are untouched.").option("--yes", "Skip the confirmation prompt.").action(async (name, options) => {
+      requirePool(paths, name);
+      await confirmRemoval(deps, options.yes, `pool "${name}"`);
+      removePool(paths, name);
+      console.log(`Removed pool "${name}".`);
+    }),
+    ["agent-shim pool remove subs --yes"]
+  );
+  withExamples(
+    pool.command("use <name>").description("Make launches with no other selection pick a member of this pool.").action((name) => {
+      useIdentity(paths, `${POOL_SELECTOR_PREFIX}${name}`);
+      console.log(`Active selection is now pool "${name}".`);
+    }),
+    ["agent-shim pool use subs"]
+  );
+  withExamples(
+    pool.command("pick <name>").description("Show how a launch from this directory would rank the pool's members right now, and which it would run as. Read-only: it records nothing.").option("--json", "Print the ranking as JSON.").action((name, options) => {
+      const nowMs = Date.now();
+      const report = collectPoolPick({ paths, fs: realFsPort, usageFs: realFarmFs, poolName: name, pool: requirePool(paths, name), directory: process.cwd(), nowMs });
+      if (options.json === true) {
+        printJson(report);
+        return;
+      }
+      for (const line of formatPoolPick(report, nowMs)) {
+        console.log(line);
+      }
+    }),
+    ["agent-shim pool pick subs", "agent-shim pool pick subs --json"]
+  );
+}
+
 // src/providers.ts
 function toProviderView(name, provider) {
   return {
@@ -69178,7 +69201,7 @@ var import_node_crypto16 = require("node:crypto");
 
 // src/launcher.ts
 var import_node_crypto15 = require("node:crypto");
-var import_node_path36 = __toESM(require("node:path"), 1);
+var import_node_path37 = __toESM(require("node:path"), 1);
 
 // src/launcher/cliOverride.ts
 var InvalidCliCategoryError = class extends CliError {
@@ -69262,7 +69285,7 @@ function buildCliOverride(params) {
 }
 
 // src/launcher/flags.ts
-var import_node_path35 = __toESM(require("node:path"), 1);
+var import_node_path36 = __toESM(require("node:path"), 1);
 
 // src/headroom/headers.ts
 function mergeAnthropicCustomHeaders(existing, additions) {
@@ -69332,7 +69355,7 @@ function buildEnv(params) {
   const parentCustomHeaders = params.baseEnv.ANTHROPIC_CUSTOM_HEADERS;
   let providerCustomHeaders;
   if (!params.configDirEscapeHatch && params.resolvedIdentityName !== void 0) {
-    env.CLAUDE_CONFIG_DIR = import_node_path35.default.join(params.identitiesDir, params.resolvedIdentityName);
+    env.CLAUDE_CONFIG_DIR = import_node_path36.default.join(params.identitiesDir, params.resolvedIdentityName);
   }
   if (params.provider !== void 0) {
     const providerEnv = params.provider.definition.env ?? {};
@@ -69519,7 +69542,7 @@ function runLauncher(params) {
     identityDefaultConfigProfile: loadedIdentity?.config.defaultConfigProfile,
     globalDefaultConfigProfile: params.globalDefaultConfigProfile
   });
-  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs18.readConfigFile(import_node_path36.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
+  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs18.readConfigFile(import_node_path37.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
     log.error(
       `agent-shim: no configuration profile named "${configProfileDecision.name}" (selected via ${configProfileDecision.source}). Run \`agent-shim profile add ${configProfileDecision.name}\` first.`
     );
@@ -69812,7 +69835,7 @@ async function runClaude(argvOverride) {
 // src/cli.ts
 async function main() {
   aliasLegacyEnv(process.env);
-  const invokedName = import_node_path37.default.basename(process.argv[1] ?? "agent-shim");
+  const invokedName = import_node_path38.default.basename(process.argv[1] ?? "agent-shim");
   if (isInvokedAsClaude(invokedName)) {
     await runClaude();
     return;