agent-shim 8.10.0 → 8.11.0

package/dist/index.cjs

@@ -115,6 +115,7 @@ __export(index_exports, {
   createRcApiNodeHandler: () => createRcApiNodeHandler,
   createRcApiRouter: () => createRcApiRouter,
   createRcControlHandler: () => createRcControlHandler,
+  createRcCredentialStore: () => createRcCredentialStore,
   createRcEventFanout: () => createRcEventFanout,
   createRcSessionTracker: () => createRcSessionTracker,
   createRcStreamHub: () => createRcStreamHub,
@@ -3029,8 +3030,8 @@ function parseConnectTarget(authority) {
 function isInterceptedHost(host, interceptHosts) {
   return interceptHosts.includes(host);
 }
-function servedByPipeline(path29) {
-  return path29?.startsWith(ROUTED_PATH_PREFIX) === true;
+function servedByPipeline(path30) {
+  return path30?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
   "connection",
@@ -3554,13 +3555,18 @@ function createRcSessionTracker(deps) {
     entries.set(id, record);
     return record;
   };
+  const persistCredential = (entry) => {
+    if (entry.oauthAuthorization !== void 0) {
+      deps.credentialStore?.write(entry.id, { authorization: entry.oauthAuthorization, anthropicVersion: entry.anthropicVersion, anthropicClientPlatform: entry.anthropicClientPlatform });
+    }
+  };
   const observeExchange = (request4) => {
     const method = (request4.method ?? "").toUpperCase();
-    const path29 = new URL(request4.url ?? "/", "http://127.0.0.1").pathname;
-    if (!path29.startsWith(RC_SESSIONS_PATH_PREFIX)) {
+    const path30 = new URL(request4.url ?? "/", "http://127.0.0.1").pathname;
+    if (!path30.startsWith(RC_SESSIONS_PATH_PREFIX)) {
       return void 0;
     }
-    const tail = path29.slice(RC_SESSIONS_PATH_PREFIX.length);
+    const tail = path30.slice(RC_SESSIONS_PATH_PREFIX.length);
     const facts = {
       oauthAuthorization: oauthAuthorizationOf(request4.headers),
       anthropicVersion: singleHeader(request4.headers, "anthropic-version"),
@@ -3593,7 +3599,7 @@ function createRcSessionTracker(deps) {
           if (id2 === void 0) {
             return;
           }
-          birth(id2, facts);
+          persistCredential(birth(id2, facts));
         }
       };
     }
@@ -3607,6 +3613,7 @@ function createRcSessionTracker(deps) {
     entry.oauthAuthorization = facts.oauthAuthorization ?? entry.oauthAuthorization;
     entry.anthropicVersion = facts.anthropicVersion ?? entry.anthropicVersion;
     entry.anthropicClientPlatform = facts.anthropicClientPlatform ?? entry.anthropicClientPlatform;
+    persistCredential(entry);
     const bodyKind = method === "POST" && rest === `${id}/worker/events` ? "worker-events" : method === "POST" && rest === `${id}/events` ? "client-events" : method === "POST" && rest === `${id}/worker/heartbeat` ? "heartbeat" : method === "PUT" && rest === `${id}/worker` ? "worker-registration" : void 0;
     let chunks = [];
     let buffered = 0;
@@ -3660,6 +3667,7 @@ function createRcSessionTracker(deps) {
       },
       onResponse: (status, headers) => {
         if (singleHeader(headers, CONFLICT_REASON_HEADER) !== void 0 || archiving && isSuccessful(status)) {
+          deps.credentialStore?.remove(id);
           expire(id);
           return;
         }
@@ -3692,7 +3700,18 @@ function createRcSessionTracker(deps) {
     },
     credentialOf: (sessionId) => {
       const entry = entries.get(sessionId);
-      return entry === void 0 ? void 0 : { authorization: entry.oauthAuthorization, anthropicVersion: entry.anthropicVersion, anthropicClientPlatform: entry.anthropicClientPlatform };
+      if (entry === void 0) {
+        return void 0;
+      }
+      if (entry.oauthAuthorization === void 0 && deps.credentialStore !== void 0) {
+        const persisted = deps.credentialStore.read(sessionId);
+        if (persisted?.authorization !== void 0) {
+          entry.oauthAuthorization = persisted.authorization;
+          entry.anthropicVersion = entry.anthropicVersion ?? persisted.anthropicVersion;
+          entry.anthropicClientPlatform = entry.anthropicClientPlatform ?? persisted.anthropicClientPlatform;
+        }
+      }
+      return { authorization: entry.oauthAuthorization, anthropicVersion: entry.anthropicVersion, anthropicClientPlatform: entry.anthropicClientPlatform };
     },
     noteSequenceNums: (sessionId, sequenceNums) => {
       const entry = entries.get(sessionId);
@@ -4308,9 +4327,9 @@ function sequenceNumsOfBody(body) {
 }
 function frontDoorRcControl(transport, token) {
   const headers = { authorization: `Bearer ${token}` };
-  const listAnswerOf = async (path29, what) => {
+  const listAnswerOf = async (path30, what) => {
     try {
-      return await transport.request({ method: "GET", path: path29, headers });
+      return await transport.request({ method: "GET", path: path30, headers });
     } catch (error) {
       throw new Error(`${what}: could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
     }
@@ -4382,10 +4401,10 @@ function frontDoorRcControl(transport, token) {
     }
     return pending;
   };
-  const writeOf = async (path29, body, describeFailure) => {
+  const writeOf = async (path30, body, describeFailure) => {
     let answer;
     try {
-      answer = await transport.request({ method: "POST", path: path29, headers: { ...headers, "content-type": "application/json" }, body });
+      answer = await transport.request({ method: "POST", path: path30, headers: { ...headers, "content-type": "application/json" }, body });
     } catch (error) {
       return { ok: false, message: `could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}` };
     }
@@ -4433,15 +4452,27 @@ var SUCCESS_STATUS_MAX_EXCLUSIVE2 = 300;
 function isSuccessful2(status) {
   return status >= HTTP_STATUS.ok && status < SUCCESS_STATUS_MAX_EXCLUSIVE2;
 }
-var UPSTREAM_LOCAL_PORT_START = 47900;
-var UPSTREAM_LOCAL_PORT_END = 47919;
-var UPSTREAM_LOCAL_PORT_COUNT = UPSTREAM_LOCAL_PORT_END - UPSTREAM_LOCAL_PORT_START + 1;
-var nextUpstreamLocalPort = UPSTREAM_LOCAL_PORT_START;
-function upstreamLocalPort() {
-  const port = nextUpstreamLocalPort;
-  nextUpstreamLocalPort = nextUpstreamLocalPort === UPSTREAM_LOCAL_PORT_END ? UPSTREAM_LOCAL_PORT_START : nextUpstreamLocalPort + 1;
-  return port;
-}
+var SourcePortRange = class {
+  constructor(start, end) {
+    this.start = start;
+    this.end = end;
+    this.count = end - start + 1;
+    this.next = start;
+  }
+  start;
+  end;
+  count;
+  next;
+  /** The next port in rotation, wrapping from the end back to the start. */
+  take() {
+    const port = this.next;
+    this.next = this.next === this.end ? this.start : this.next + 1;
+    return port;
+  }
+};
+var DOOR_SOURCE_PORT_START = 47900;
+var DOOR_SOURCE_PORT_END = 47919;
+var DOOR_SOURCE_PORTS = new SourcePortRange(DOOR_SOURCE_PORT_START, DOOR_SOURCE_PORT_END);
 var realAddressLookup = (host, _options, callback) => {
   if (net2.isIP(host) !== 0) {
     callback(null, [{ address: host, family: net2.isIP(host) }]);
@@ -4479,14 +4510,14 @@ function dialTarget(options, defaultPort) {
 function literalDial(target) {
   return net2.connect({ host: target.host, port: target.port });
 }
-async function reservedDial(target) {
+async function reservedDial(target, ports) {
   for (let attempt = 0; ; attempt += 1) {
-    const outcome = await dialOnce({ host: target.host, port: target.port, localPort: upstreamLocalPort(), lookup: realAddressLookup });
+    const outcome = await dialOnce({ host: target.host, port: target.port, localPort: ports.take(), lookup: realAddressLookup });
     if (outcome.error === null) {
       return outcome;
     }
     const held = outcome.error.code !== void 0 && HELD_PORT_ERRNOS.has(outcome.error.code);
-    if (!held || attempt === UPSTREAM_LOCAL_PORT_COUNT - 1) {
+    if (!held || attempt === ports.count - 1) {
       return outcome;
     }
   }
@@ -4495,26 +4526,36 @@ function requestServername(options, fallback) {
   return "servername" in options && typeof options.servername === "string" && options.servername !== "" ? options.servername : fallback;
 }
 var ExemptHttpAgent = class extends http.Agent {
+  constructor(ports = DOOR_SOURCE_PORTS) {
+    super();
+    this.ports = ports;
+  }
+  ports;
   // A reserved-port dial that has to retry cannot produce its socket synchronously, so it settles first and arrives through the callback (node's documented asynchronous createConnection form); a literal dial has nothing to retry and keeps node's own synchronous shape.
   createConnection(options, oncreate) {
     const target = dialTarget(options, HTTP_PORT);
     if (net2.isIP(target.host) !== 0) {
       return literalDial(target);
     }
-    void reservedDial(target).then((outcome) => {
+    void reservedDial(target, this.ports).then((outcome) => {
       oncreate?.(outcome.error, outcome.socket);
     });
     return void 0;
   }
 };
 var ExemptTlsAgent = class extends https2.Agent {
+  constructor(ports = DOOR_SOURCE_PORTS) {
+    super();
+    this.ports = ports;
+  }
+  ports;
   // The same split as the plain sibling: a literal dial wraps TLS around the socket node's own agent would have returned, a reserved dial settles (retries included) first and arrives through the callback, which is exactly where node's own agent wraps its own dials.
   createConnection(options, oncreate) {
     const target = dialTarget(options, HTTPS_PORT);
     if (net2.isIP(target.host) !== 0) {
       return tls.connect({ socket: literalDial(target), servername: requestServername(options, target.host), ...tlsFacts(options) });
     }
-    void reservedDial(target).then((outcome) => {
+    void reservedDial(target, this.ports).then((outcome) => {
       if (outcome.error !== null) {
         oncreate?.(outcome.error, outcome.socket);
         return;
@@ -4575,12 +4616,12 @@ var NO_CHUNKS = {
 };
 function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const request4 = async (method, path29, headers, body, signal) => await new Promise((resolve, reject) => {
+  const request4 = async (method, path30, headers, body, signal) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method,
-      path: path29,
+      path: path30,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, ...body === void 0 ? {} : { "content-length": String(Buffer.byteLength(body, "utf8")) } },
       agent,
@@ -4617,9 +4658,9 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
       return { status, body: await readAll(response) };
     },
     openStream: async (sessionId, headers, resume, signal) => {
-      const path29 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
+      const path30 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
       const streamHeaders = resume === void 0 ? headers : { ...headers, "last-event-id": String(resume.fromSequenceNum) };
-      const { status, response } = await request4("GET", path29, streamHeaders, void 0, signal);
+      const { status, response } = await request4("GET", path30, streamHeaders, void 0, signal);
       if (!isSuccessful2(status)) {
         await readAll(response);
         return { status, chunks: NO_CHUNKS };
@@ -4628,9 +4669,9 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
     }
   };
 }
-function realConnectEffects() {
-  const plainAgent = new ExemptHttpAgent();
-  const tlsAgent = new ExemptTlsAgent();
+function realConnectEffects(ports = DOOR_SOURCE_PORTS) {
+  const plainAgent = new ExemptHttpAgent(ports);
+  const tlsAgent = new ExemptTlsAgent(ports);
   const listenOnce = async (port, onSocket) => await new Promise((resolve, reject) => {
     const accepted = /* @__PURE__ */ new Set();
     const server = net2.createServer((socket) => {
@@ -4748,7 +4789,7 @@ function realConnectEffects() {
       };
     },
     connectTlsUpstream: async (host, port, clientAlpn) => {
-      const dialled = await reservedDial({ host, port });
+      const dialled = await reservedDial({ host, port }, ports);
       if (dialled.error !== null) {
         throw dialled.error;
       }
@@ -4830,6 +4871,64 @@ function realConnectEffects() {
   };
 }
 
+// src/frontdoor/rcCredentialStore.ts
+var import_node_path9 = __toESM(require("node:path"), 1);
+function isSafeSessionId(sessionId) {
+  return /^[A-Za-z0-9_-]+$/.test(sessionId);
+}
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function credentialOfJson(parsed) {
+  if (!isRecord3(parsed)) {
+    return void 0;
+  }
+  const { authorization, anthropicVersion, anthropicClientPlatform } = parsed;
+  if (typeof authorization !== "string" || authorization === "") {
+    return void 0;
+  }
+  return {
+    authorization,
+    anthropicVersion: typeof anthropicVersion === "string" ? anthropicVersion : void 0,
+    anthropicClientPlatform: typeof anthropicClientPlatform === "string" ? anthropicClientPlatform : void 0
+  };
+}
+function createRcCredentialStore(fs12, dir) {
+  fs12.mkdirPrivate(dir);
+  const fileFor = (sessionId) => import_node_path9.default.join(dir, `${sessionId}.json`);
+  return {
+    read: (sessionId) => {
+      if (!isSafeSessionId(sessionId)) {
+        return void 0;
+      }
+      const raw = fs12.readFileUtf8(fileFor(sessionId));
+      if (raw === void 0) {
+        return void 0;
+      }
+      let parsed;
+      try {
+        parsed = JSON.parse(raw);
+      } catch {
+        return void 0;
+      }
+      return credentialOfJson(parsed);
+    },
+    write: (sessionId, credential) => {
+      if (!isSafeSessionId(sessionId)) {
+        return;
+      }
+      fs12.writeFilePrivate(fileFor(sessionId), `${JSON.stringify(credential, null, 2)}
+`);
+    },
+    remove: (sessionId) => {
+      if (!isSafeSessionId(sessionId)) {
+        return;
+      }
+      fs12.removeRecursive(fileFor(sessionId));
+    }
+  };
+}
+
 // src/frontdoor/rcApi.ts
 var import_client = require("@orpc/client");
 var import_fetch = require("@orpc/client/fetch");
@@ -5087,7 +5186,7 @@ function createSseParser() {
     }
   };
 }
-function isRecord3(value) {
+function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function sequenceNumOf(value) {
@@ -5109,7 +5208,7 @@ function parseRcStreamEnvelope(parsed) {
   } catch {
     return void 0;
   }
-  if (!isRecord3(data)) {
+  if (!isRecord4(data)) {
     return void 0;
   }
   const eventType = data.event_type;
@@ -5198,6 +5297,7 @@ function createRcStreamHub(deps) {
     if (!isSuccessful3(answer.status)) {
       throw new Error(`the client read stream answered HTTP ${String(answer.status)}`);
     }
+    deps.log?.(`rc stream ${attachment.sessionId}: attached as client ${attachment.clientId}${resume === void 0 ? ", reading from the stream's own head" : `, resuming after sequence number ${String(resume.fromSequenceNum)}`}`);
     const parser = createSseParser();
     for await (const chunk of answer.chunks) {
       attachment.controller.signal.throwIfAborted();
@@ -5221,6 +5321,7 @@ function createRcStreamHub(deps) {
       const live = deps.trackedSessions().includes(attachment.sessionId);
       const credential = deps.credentialOf(attachment.sessionId);
       if (!live || credential?.authorization === void 0) {
+        deps.log?.(`rc stream ${attachment.sessionId}: the attachment ended (${live ? "the session's client credential is no longer known" : "the tracker gave up on the session"})`);
         if (attachments.get(attachment.sessionId) === attachment) {
           attachments.delete(attachment.sessionId);
         }
@@ -5242,6 +5343,7 @@ function createRcStreamHub(deps) {
         return;
       }
       if (outcome === "dropped") {
+        deps.log?.(`rc stream ${attachment.sessionId}: the stream ended of its own accord, reconnecting`);
         retriedUnauthorized = false;
         continue;
       }
@@ -5291,7 +5393,7 @@ var import_node_crypto7 = require("node:crypto");
 
 // src/headroom/state.ts
 var import_node_crypto6 = require("node:crypto");
-var import_node_path9 = __toESM(require("node:path"), 1);
+var import_node_path10 = __toESM(require("node:path"), 1);
 var import_zod5 = require("zod");
 var HEADROOM_ANTHROPIC_UPSTREAM = "https://api.anthropic.com";
 var HEADROOM_STATE_SCHEMA_VERSION = 2;
@@ -5332,7 +5434,7 @@ function readHeadroomState(fs12, stateFile) {
   }
 }
 function writeHeadroomState(fs12, stateFile, state) {
-  fs12.mkdirp(import_node_path9.default.dirname(stateFile));
+  fs12.mkdirp(import_node_path10.default.dirname(stateFile));
   fs12.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
 `);
 }
@@ -5360,7 +5462,7 @@ function readAllProviders(fs12, providersDir) {
       continue;
     }
     try {
-      const parsed = parseJson(fs12.readFileUtf8(import_node_path9.default.join(providersDir, name)), ProviderSchema);
+      const parsed = parseJson(fs12.readFileUtf8(import_node_path10.default.join(providersDir, name)), ProviderSchema);
       if (parsed !== void 0) {
         result.push({ name: name.slice(0, -".json".length), provider: parsed });
       }
@@ -5372,11 +5474,11 @@ function readAllProviders(fs12, providersDir) {
 }
 function writeSession(fs12, sessionsDir, session) {
   fs12.mkdirp(sessionsDir);
-  fs12.writeFileUtf8(import_node_path9.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
+  fs12.writeFileUtf8(import_node_path10.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
 `);
 }
 function removeSession(fs12, sessionsDir, pid) {
-  fs12.removeRecursive(import_node_path9.default.join(sessionsDir, `${String(pid)}.json`));
+  fs12.removeRecursive(import_node_path10.default.join(sessionsDir, `${String(pid)}.json`));
 }
 function listSessions(fs12, sessionsDir) {
   const sessions = [];
@@ -5385,7 +5487,7 @@ function listSessions(fs12, sessionsDir) {
       continue;
     }
     try {
-      const parsed = parseJson(fs12.readFileUtf8(import_node_path9.default.join(sessionsDir, name)), HeadroomSessionSchema);
+      const parsed = parseJson(fs12.readFileUtf8(import_node_path10.default.join(sessionsDir, name)), HeadroomSessionSchema);
       if (parsed !== void 0) {
         sessions.push(parsed);
       }
@@ -5490,10 +5592,10 @@ function ensureFrontDoor(params) {
 }
 
 // src/usage/read.ts
-var import_node_path11 = __toESM(require("node:path"), 1);
+var import_node_path12 = __toESM(require("node:path"), 1);
 
 // src/usage/account.ts
-var import_node_path10 = __toESM(require("node:path"), 1);
+var import_node_path11 = __toESM(require("node:path"), 1);
 
 // src/usage/schema.ts
 var import_zod6 = require("zod");
@@ -5659,7 +5761,7 @@ function isIdentityName(name) {
   return IdentitySchema.shape.name.safeParse(name).success;
 }
 function claudeJsonPath(identitiesDir, identity) {
-  return import_node_path10.default.join(identitiesDir, identity, CLAUDE_JSON);
+  return import_node_path11.default.join(identitiesDir, identity, CLAUDE_JSON);
 }
 function readAccountMetadata(fs12, identitiesDir, identity) {
   if (!isIdentityName(identity)) {
@@ -5718,7 +5820,7 @@ function readUsageLog(fs12, logDir, options = {}) {
     if (sinceMs !== void 0 && segment.endsAt <= sinceMs) {
       continue;
     }
-    const contents = fs12.readFileUtf8(import_node_path11.default.join(logDir, segment.name));
+    const contents = fs12.readFileUtf8(import_node_path12.default.join(logDir, segment.name));
     if (contents === void 0) {
       continue;
     }
@@ -5760,7 +5862,7 @@ function snapshotPath(snapshotsDir, identity) {
   if (!isIdentityName(identity)) {
     throw new Error(`"${identity}" is not a valid identity name.`);
   }
-  return import_node_path11.default.join(snapshotsDir, `${identity}.json`);
+  return import_node_path12.default.join(snapshotsDir, `${identity}.json`);
 }
 function readUsageSnapshot(fs12, snapshotsDir, identity) {
   const file = snapshotPath(snapshotsDir, identity);
@@ -6094,7 +6196,7 @@ function rankPool(input) {
 }
 
 // src/usage/poolPick.ts
-var import_node_path12 = __toESM(require("node:path"), 1);
+var import_node_path13 = __toESM(require("node:path"), 1);
 var import_zod9 = require("zod");
 
 // src/usage/store.ts
@@ -6161,13 +6263,13 @@ function recordStickyPick(fs12, picksFile, directory, identity, nowMs) {
   const current = readPicksFile(fs12, picksFile).file.picks;
   const kept = Object.entries(current).filter(([, entry]) => nowMs - Date.parse(entry.at) <= USAGE_RETENTION_MS);
   const next = { schemaVersion: SCHEMA_VERSION, picks: { ...Object.fromEntries(kept), [directory]: { identity, at: new Date(nowMs).toISOString() } } };
-  fs12.mkdirPrivate(import_node_path12.default.dirname(picksFile));
+  fs12.mkdirPrivate(import_node_path13.default.dirname(picksFile));
   fs12.writeFilePrivate(picksFile, `${JSON.stringify(next, null, 2)}
 `);
 }
 
 // src/launcher/identity.ts
-var import_node_path13 = __toESM(require("node:path"), 1);
+var import_node_path14 = __toESM(require("node:path"), 1);
 function poolNameOf(selector) {
   return selector.startsWith(POOL_SELECTOR_PREFIX) ? selector.slice(POOL_SELECTOR_PREFIX.length) : void 0;
 }
@@ -6216,7 +6318,7 @@ function decideConfigProfile(params) {
   return { source: "none" };
 }
 function loadIdentity(identitiesDir, name, fs12) {
-  return loadConfigFile(import_node_path13.default.join(identitiesDir, name, "identity.json"), IdentitySchema, fs12.readConfigFile);
+  return loadConfigFile(import_node_path14.default.join(identitiesDir, name, "identity.json"), IdentitySchema, fs12.readConfigFile);
 }
 
 // src/launcher/pool.ts
@@ -6431,7 +6533,7 @@ function hashSettings(settings) {
 }
 
 // src/headroom/socket.ts
-var import_node_path14 = __toESM(require("node:path"), 1);
+var import_node_path15 = __toESM(require("node:path"), 1);
 var GROUP_OR_OTHER_BITS = 63;
 var OCTAL_RADIX = 8;
 var MODE_DIGITS = 4;
@@ -6440,7 +6542,7 @@ var HEADROOM_SOCKET_NAME = /^(\d+)\.sock$/;
 var UNIX_SOCKET_PATH_MAX_BYTES = 103;
 var PLATFORMS_WITHOUT_UNIX_SOCKETS = ["win32"];
 function headroomSocketPath(paths, supervisorPid) {
-  return import_node_path14.default.join(paths.headroomSocketDir, `${String(supervisorPid)}${HEADROOM_SOCKET_SUFFIX}`);
+  return import_node_path15.default.join(paths.headroomSocketDir, `${String(supervisorPid)}${HEADROOM_SOCKET_SUFFIX}`);
 }
 function platformRefusal(platform) {
   return PLATFORMS_WITHOUT_UNIX_SOCKETS.includes(platform) ? `headroom routing needs a unix domain socket, which headroom cannot serve on ${platform}; agent-shim never falls back to a TCP port for this hop` : void 0;
@@ -6489,7 +6591,7 @@ function pruneStaleHeadroomSockets(fs12, paths, isRunning) {
     if (pid === void 0 || isRunning(Number.parseInt(pid, 10))) {
       continue;
     }
-    fs12.removeRecursive(import_node_path14.default.join(paths.headroomSocketDir, name));
+    fs12.removeRecursive(import_node_path15.default.join(paths.headroomSocketDir, name));
     removed.push(name);
   }
   return removed;
@@ -6813,14 +6915,14 @@ function evaluateAmbientCredentialGuard(params) {
 // src/paths.ts
 var import_node_fs2 = __toESM(require("node:fs"), 1);
 var import_node_os2 = __toESM(require("node:os"), 1);
-var import_node_path15 = __toESM(require("node:path"), 1);
+var import_node_path16 = __toESM(require("node:path"), 1);
 function resolveAgentShimHome(env = process.env, home = import_node_os2.default.homedir(), isDirectory = isExistingDirectory) {
   const fromEnv = env.AGENT_SHIM_HOME;
   if (fromEnv !== void 0 && fromEnv !== "") {
     return fromEnv;
   }
-  const current = import_node_path15.default.join(home, HOME_DIRNAME);
-  const legacy = import_node_path15.default.join(home, LEGACY_HOME_DIRNAME);
+  const current = import_node_path16.default.join(home, HOME_DIRNAME);
+  const legacy = import_node_path16.default.join(home, LEGACY_HOME_DIRNAME);
   return !isDirectory(current) && isDirectory(legacy) ? legacy : current;
 }
 function isExistingDirectory(candidate) {
@@ -6831,40 +6933,41 @@ function resolveClaudeHome() {
   if (fromEnv !== void 0 && fromEnv !== "") {
     return fromEnv;
   }
-  return import_node_path15.default.join(import_node_os2.default.homedir(), ".claude");
+  return import_node_path16.default.join(import_node_os2.default.homedir(), ".claude");
 }
 function buildLayoutPaths(root) {
   return {
     root,
-    identitiesDir: import_node_path15.default.join(root, "identities"),
-    configProfilesDir: import_node_path15.default.join(root, "config-profiles"),
-    providersDir: import_node_path15.default.join(root, "providers"),
-    directoryRulesFile: import_node_path15.default.join(root, "directory-rules.json"),
-    activeIdentityFile: import_node_path15.default.join(root, "active-identity"),
-    globalConfigFile: import_node_path15.default.join(root, "config.json"),
-    categoriesLocalFile: import_node_path15.default.join(root, "categories.local.json"),
-    claudeShimFile: import_node_path15.default.join(root, "claude-shim.json"),
-    headroomDir: import_node_path15.default.join(root, "headroom"),
-    headroomStateFile: import_node_path15.default.join(root, "headroom", `state.v${String(HEADROOM_STATE_SCHEMA_VERSION)}.json`),
-    headroomSocketDir: import_node_path15.default.join(root, "headroom", "run"),
-    headroomLockFile: import_node_path15.default.join(root, "headroom", "start.lock"),
-    headroomSessionsDir: import_node_path15.default.join(root, "headroom", "sessions"),
-    logsDir: import_node_path15.default.join(root, "logs"),
-    headroomLogPath: import_node_path15.default.join(root, "logs", "headroom.log"),
-    frontdoorDir: import_node_path15.default.join(root, "frontdoor"),
-    frontdoorCaDir: import_node_path15.default.join(root, "frontdoor", "ca"),
-    frontdoorCaCertFile: import_node_path15.default.join(root, "frontdoor", "ca", "ca.pem"),
-    frontdoorCaKeyFile: import_node_path15.default.join(root, "frontdoor", "ca", "ca.key"),
-    frontdoorCaBundlesDir: import_node_path15.default.join(root, "frontdoor", "ca", "bundles"),
-    frontdoorStateFile: import_node_path15.default.join(root, "frontdoor", "state.json"),
-    frontdoorLockFile: import_node_path15.default.join(root, "frontdoor", "start.lock"),
-    frontdoorControlTokenFile: import_node_path15.default.join(root, "frontdoor", "control-token"),
-    frontdoorSessionsDir: import_node_path15.default.join(root, "frontdoor", "sessions"),
-    frontdoorLogPath: import_node_path15.default.join(root, "logs", "frontdoor.log"),
-    usageDir: import_node_path15.default.join(root, "usage"),
-    usageLogDir: import_node_path15.default.join(root, "usage", "log"),
-    usageSnapshotsDir: import_node_path15.default.join(root, "usage", "snapshots"),
-    usagePicksFile: import_node_path15.default.join(root, "usage", "picks.json")
+    identitiesDir: import_node_path16.default.join(root, "identities"),
+    configProfilesDir: import_node_path16.default.join(root, "config-profiles"),
+    providersDir: import_node_path16.default.join(root, "providers"),
+    directoryRulesFile: import_node_path16.default.join(root, "directory-rules.json"),
+    activeIdentityFile: import_node_path16.default.join(root, "active-identity"),
+    globalConfigFile: import_node_path16.default.join(root, "config.json"),
+    categoriesLocalFile: import_node_path16.default.join(root, "categories.local.json"),
+    claudeShimFile: import_node_path16.default.join(root, "claude-shim.json"),
+    headroomDir: import_node_path16.default.join(root, "headroom"),
+    headroomStateFile: import_node_path16.default.join(root, "headroom", `state.v${String(HEADROOM_STATE_SCHEMA_VERSION)}.json`),
+    headroomSocketDir: import_node_path16.default.join(root, "headroom", "run"),
+    headroomLockFile: import_node_path16.default.join(root, "headroom", "start.lock"),
+    headroomSessionsDir: import_node_path16.default.join(root, "headroom", "sessions"),
+    logsDir: import_node_path16.default.join(root, "logs"),
+    headroomLogPath: import_node_path16.default.join(root, "logs", "headroom.log"),
+    frontdoorDir: import_node_path16.default.join(root, "frontdoor"),
+    frontdoorCaDir: import_node_path16.default.join(root, "frontdoor", "ca"),
+    frontdoorCaCertFile: import_node_path16.default.join(root, "frontdoor", "ca", "ca.pem"),
+    frontdoorCaKeyFile: import_node_path16.default.join(root, "frontdoor", "ca", "ca.key"),
+    frontdoorCaBundlesDir: import_node_path16.default.join(root, "frontdoor", "ca", "bundles"),
+    frontdoorStateFile: import_node_path16.default.join(root, "frontdoor", "state.json"),
+    frontdoorLockFile: import_node_path16.default.join(root, "frontdoor", "start.lock"),
+    frontdoorControlTokenFile: import_node_path16.default.join(root, "frontdoor", "control-token"),
+    frontdoorSessionsDir: import_node_path16.default.join(root, "frontdoor", "sessions"),
+    frontdoorRcCredentialsDir: import_node_path16.default.join(root, "frontdoor", "rc-credentials"),
+    frontdoorLogPath: import_node_path16.default.join(root, "logs", "frontdoor.log"),
+    usageDir: import_node_path16.default.join(root, "usage"),
+    usageLogDir: import_node_path16.default.join(root, "usage", "log"),
+    usageSnapshotsDir: import_node_path16.default.join(root, "usage", "snapshots"),
+    usagePicksFile: import_node_path16.default.join(root, "usage", "picks.json")
   };
 }
 function resolveLayoutPaths() {
@@ -6873,11 +6976,11 @@ function resolveLayoutPaths() {
 
 // src/identityStore.ts
 var import_node_fs4 = __toESM(require("node:fs"), 1);
-var import_node_path17 = __toESM(require("node:path"), 1);
+var import_node_path18 = __toESM(require("node:path"), 1);
 
 // src/configProfilesStore.ts
 var import_node_fs3 = __toESM(require("node:fs"), 1);
-var import_node_path16 = __toESM(require("node:path"), 1);
+var import_node_path17 = __toESM(require("node:path"), 1);
 var ProfileNotFoundError = class extends CliError {
   constructor(profileName) {
     super(`No configuration profile named "${profileName}". Run \`agent-shim profile add ${profileName}\` first.`);
@@ -6903,7 +7006,7 @@ var InvalidCategoryNameError = class extends CliError {
   categoryName;
 };
 function profileJsonPath(paths, name) {
-  return import_node_path16.default.join(paths.configProfilesDir, `${name}.json`);
+  return import_node_path17.default.join(paths.configProfilesDir, `${name}.json`);
 }
 function profileExists(paths, name) {
   return import_node_fs3.default.existsSync(profileJsonPath(paths, name));
@@ -7091,7 +7194,7 @@ var InvalidIdentityNameError = class extends CliError {
   attemptedName;
 };
 function identityJsonPath(paths, name) {
-  return import_node_path17.default.join(paths.identitiesDir, name, "identity.json");
+  return import_node_path18.default.join(paths.identitiesDir, name, "identity.json");
 }
 function identityExists(paths, name) {
   return import_node_fs4.default.existsSync(identityJsonPath(paths, name));
@@ -7192,7 +7295,7 @@ function setIdentityCredential(paths, identityName, change) {
   });
 }
 function belongsToIdentity(entry, name) {
-  return entry === name || entry === import_node_path17.default.basename(identityLockPath("", name)) || entry.startsWith(`.${name}.scratch.`) || entry.startsWith(`.${name}.previous.`);
+  return entry === name || entry === import_node_path18.default.basename(identityLockPath("", name)) || entry.startsWith(`.${name}.scratch.`) || entry.startsWith(`.${name}.previous.`);
 }
 function removeIdentity(paths, name) {
   if (!identityExists(paths, name)) {
@@ -7200,7 +7303,7 @@ function removeIdentity(paths, name) {
   }
   for (const entry of import_node_fs4.default.readdirSync(paths.identitiesDir)) {
     if (belongsToIdentity(entry, name)) {
-      import_node_fs4.default.rmSync(import_node_path17.default.join(paths.identitiesDir, entry), { recursive: true, force: true });
+      import_node_fs4.default.rmSync(import_node_path18.default.join(paths.identitiesDir, entry), { recursive: true, force: true });
     }
   }
   if (readActiveIdentity(paths) === name) {
@@ -7210,7 +7313,7 @@ function removeIdentity(paths, name) {
 
 // src/providersStore.ts
 var import_node_fs5 = __toESM(require("node:fs"), 1);
-var import_node_path18 = __toESM(require("node:path"), 1);
+var import_node_path19 = __toESM(require("node:path"), 1);
 
 // src/credentialCache.ts
 var import_zod12 = require("zod");
@@ -7475,7 +7578,7 @@ var InvalidProviderNameError = class extends CliError {
 };
 var PROVIDER_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._@-]*$/;
 function providerJsonPath(paths, name) {
-  return import_node_path18.default.join(paths.providersDir, `${name}.json`);
+  return import_node_path19.default.join(paths.providersDir, `${name}.json`);
 }
 function providerExists(paths, name) {
   return import_node_fs5.default.existsSync(providerJsonPath(paths, name));
@@ -7483,14 +7586,14 @@ function providerExists(paths, name) {
 var LEGACY_PROVIDER_FIELDS = ["tokenEnv", "tokenCommand", "authScheme"];
 var LEGACY_ENV_CREDENTIAL_KEYS = Object.values(CREDENTIAL_TARGET_VARS);
 var LEGACY_LITERAL_PLACEHOLDER = "<the value of env.ANTHROPIC_AUTH_TOKEN>";
-function isRecord4(value) {
+function isRecord5(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function legacyProviderConversion(raw) {
-  if (!isRecord4(raw) || "credential" in raw) {
+  if (!isRecord5(raw) || "credential" in raw) {
     return void 0;
   }
-  const env = isRecord4(raw.env) ? raw.env : void 0;
+  const env = isRecord5(raw.env) ? raw.env : void 0;
   const legacyEnvKeys = env === void 0 ? [] : Object.keys(env).filter((key) => LEGACY_ENV_CREDENTIAL_KEYS.includes(key));
   const fields = [...LEGACY_PROVIDER_FIELDS.filter((field) => field in raw), ...legacyEnvKeys.map((key) => `env.${key}`)];
   if (fields.length === 0) {
@@ -7551,7 +7654,7 @@ function readProvider(paths, name) {
   return parseProviderFile(filePath, raw);
 }
 function loadProvider(providersDir, name, port) {
-  const filePath = import_node_path18.default.join(providersDir, `${name}.json`);
+  const filePath = import_node_path19.default.join(providersDir, `${name}.json`);
   const raw = port.readConfigFile(filePath);
   return raw === void 0 ? void 0 : parseProviderFile(filePath, raw);
 }
@@ -7806,21 +7909,21 @@ function removeDirectoryRule(paths, rulePath) {
 var import_node_os4 = __toESM(require("node:os"), 1);
 
 // src/launcher/cascade.ts
-var import_node_path20 = __toESM(require("node:path"), 1);
+var import_node_path21 = __toESM(require("node:path"), 1);
 
 // src/pathNorm.ts
-var import_node_path19 = __toESM(require("node:path"), 1);
+var import_node_path20 = __toESM(require("node:path"), 1);
 function expandTilde(value, home) {
   if (value === "~") {
     return home;
   }
   if (value.startsWith("~/")) {
-    return import_node_path19.default.join(home, value.slice(2));
+    return import_node_path20.default.join(home, value.slice(2));
   }
   return value;
 }
 function normaliseRulePath(rulePath, home) {
-  return import_node_path19.default.resolve(expandTilde(rulePath, home));
+  return import_node_path20.default.resolve(expandTilde(rulePath, home));
 }
 
 // src/launcher/cascade.ts
@@ -7830,7 +7933,7 @@ function loadCascadeInput(params) {
   const globalConfig = loadConfigFile(params.paths.globalConfigFile, GlobalConfigSchema, params.read);
   const directoryRules = loadConfigFile(params.paths.directoryRulesFile, DirectoryRulesSchema, params.read);
   const loadProfile = (name) => {
-    const filepath = import_node_path20.default.join(params.paths.configProfilesDir, `${name}.json`);
+    const filepath = import_node_path21.default.join(params.paths.configProfilesDir, `${name}.json`);
     const loaded = loadConfigFile(filepath, ConfigProfileSchema, params.read);
     if (loaded === void 0) {
       return void 0;
@@ -7845,8 +7948,8 @@ function loadCascadeInput(params) {
   });
   const levels = [];
   for (const dir of dirs) {
-    const portable = loadConfigFile(import_node_path20.default.join(dir, PORTABLE_CONFIG_FILENAME), PortableConfigSchema, params.read) ?? loadConfigFile(import_node_path20.default.join(dir, LEGACY_PORTABLE_CONFIG_FILENAME), PortableConfigSchema, params.read);
-    const portableLocal = loadConfigFile(import_node_path20.default.join(dir, PORTABLE_LOCAL_CONFIG_FILENAME), PortableConfigSchema, params.read) ?? loadConfigFile(import_node_path20.default.join(dir, LEGACY_PORTABLE_LOCAL_CONFIG_FILENAME), PortableConfigSchema, params.read);
+    const portable = loadConfigFile(import_node_path21.default.join(dir, PORTABLE_CONFIG_FILENAME), PortableConfigSchema, params.read) ?? loadConfigFile(import_node_path21.default.join(dir, LEGACY_PORTABLE_CONFIG_FILENAME), PortableConfigSchema, params.read);
+    const portableLocal = loadConfigFile(import_node_path21.default.join(dir, PORTABLE_LOCAL_CONFIG_FILENAME), PortableConfigSchema, params.read) ?? loadConfigFile(import_node_path21.default.join(dir, LEGACY_PORTABLE_LOCAL_CONFIG_FILENAME), PortableConfigSchema, params.read);
     const rules = (directoryRules?.config.rules ?? []).map((rule, index) => ({ rule, index })).filter(({ rule }) => normaliseRulePath(rule.path, params.home) === dir).map(({ rule, index }) => {
       const entryOrder = directoryRules?.ruleEntryOrders[index];
       return {
@@ -7897,7 +8000,7 @@ function readDirectorySelections(loaded) {
 // src/realCredentialCache.ts
 var import_node_child_process = require("node:child_process");
 var import_node_fs6 = __toESM(require("node:fs"), 1);
-var import_node_path21 = __toESM(require("node:path"), 1);
+var import_node_path22 = __toESM(require("node:path"), 1);
 var KEYCHAIN_CACHE_SERVICE = "agent-shim-credential-cache";
 var CACHE_DIR_MODE = 448;
 var CACHE_FILE_MODE = 384;
@@ -7924,8 +8027,8 @@ function security(args, stdin) {
   return { status: result.status, stdout: result.stdout };
 }
 function createRealCredentialCache(root) {
-  const dir = import_node_path21.default.join(root, "credential-cache");
-  const filePath = (owner) => import_node_path21.default.join(dir, cacheFileNameFor(owner));
+  const dir = import_node_path22.default.join(root, "credential-cache");
+  const filePath = (owner) => import_node_path22.default.join(dir, cacheFileNameFor(owner));
   return {
     read(store, owner) {
       if (store === "file") {
@@ -7977,7 +8080,7 @@ var import_node_child_process2 = require("node:child_process");
 var import_node_crypto9 = require("node:crypto");
 var import_node_fs7 = __toESM(require("node:fs"), 1);
 var import_node_os3 = __toESM(require("node:os"), 1);
-var import_node_path22 = __toESM(require("node:path"), 1);
+var import_node_path23 = __toESM(require("node:path"), 1);
 var import_node_sea = require("node:sea");
 function isEnoent3(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
@@ -8136,7 +8239,7 @@ var realRunPort = {
   }
 };
 function expandHome2(filePath) {
-  return filePath.startsWith("~/") ? import_node_path22.default.join(import_node_os3.default.homedir(), filePath.slice(1)) : filePath;
+  return filePath.startsWith("~/") ? import_node_path23.default.join(import_node_os3.default.homedir(), filePath.slice(1)) : filePath;
 }
 var MACOS_GUI_SESSION_MANAGER = "Aqua";
 function hasDesktopSession() {
@@ -8209,7 +8312,7 @@ function spawnDaemonThrough(executable) {
   return (paths, subcommand, logPath) => spawnDetachedDaemon({ command: executable, args: [subcommand] }, paths, subcommand, logPath);
 }
 function spawnDetachedDaemon(invocation, paths, subcommand, logPath) {
-  import_node_fs7.default.mkdirSync(import_node_path22.default.dirname(logPath), { recursive: true });
+  import_node_fs7.default.mkdirSync(import_node_path23.default.dirname(logPath), { recursive: true });
   const logFd = import_node_fs7.default.openSync(logPath, "a");
   try {
     const child = (0, import_node_child_process2.spawn)(invocation.command, invocation.args, detachedDaemonSpawnOptions(logFd, { ...process.env, AGENT_SHIM_HOME: paths.root }));
@@ -8291,7 +8394,7 @@ function listVersionsDir(dir) {
     throw error;
   }
   return entries.filter((entry) => entry.isFile()).map((entry) => {
-    const fullPath = import_node_path22.default.join(dir, entry.name);
+    const fullPath = import_node_path23.default.join(dir, entry.name);
     const stat = import_node_fs7.default.statSync(fullPath);
     return {
       name: entry.name,
@@ -8306,7 +8409,7 @@ function windowsPathExtensions(pathext) {
   return (pathext ?? WINDOWS_DEFAULT_PATHEXT).split(";").map((ext) => ext.trim()).filter((ext) => ext.length > 0);
 }
 function resolveExecutableCandidate(dir, name, env) {
-  const candidate = import_node_path22.default.join(dir, name);
+  const candidate = import_node_path23.default.join(dir, name);
   if (env.platform === "win32") {
     const extensions = windowsPathExtensions(env.pathext);
     const alreadyHasRecognisedExtension = extensions.some((ext) => candidate.toLowerCase().endsWith(ext.toLowerCase()));
@@ -8355,13 +8458,13 @@ function resolveOwnExecutablePath(env) {
   if (env.argv1 !== void 0 && !env.argv1.includes("/") && !env.argv1.includes("\\")) {
     return searchPathForExecutable(env.pathDirs, env.argv1, env.findExecutableInDir) ?? env.execPath;
   }
-  const candidate = env.argv1 === void 0 ? env.execPath : import_node_path22.default.resolve(env.cwd, env.argv1);
-  const candidateDir = import_node_path22.default.dirname(candidate);
-  const candidateDirOnPath = env.pathDirs.some((dir) => import_node_path22.default.resolve(dir) === candidateDir);
+  const candidate = env.argv1 === void 0 ? env.execPath : import_node_path23.default.resolve(env.cwd, env.argv1);
+  const candidateDir = import_node_path23.default.dirname(candidate);
+  const candidateDirOnPath = env.pathDirs.some((dir) => import_node_path23.default.resolve(dir) === candidateDir);
   if (candidateDirOnPath) {
     return candidate;
   }
-  const viaPath = searchPathForExecutable(env.pathDirs, import_node_path22.default.basename(candidate), env.findExecutableInDir);
+  const viaPath = searchPathForExecutable(env.pathDirs, import_node_path23.default.basename(candidate), env.findExecutableInDir);
   return viaPath ?? candidate;
 }
 function realOwnExecutablePath() {
@@ -8369,7 +8472,7 @@ function realOwnExecutablePath() {
     argv1: process.argv[1],
     execPath: process.execPath,
     cwd: process.cwd(),
-    pathDirs: (process.env.PATH ?? "").split(import_node_path22.default.delimiter).filter((dir) => dir !== ""),
+    pathDirs: (process.env.PATH ?? "").split(import_node_path23.default.delimiter).filter((dir) => dir !== ""),
     findExecutableInDir
   });
 }
@@ -8382,7 +8485,7 @@ function realContentSourcePath() {
 function realResolveClaudeBinary(isOwnBinary) {
   return (request4) => discoverClaudeBinary({
     listVersionsDir,
-    pathDirs: (process.env.PATH ?? "").split(import_node_path22.default.delimiter).filter((dir) => dir !== ""),
+    pathDirs: (process.env.PATH ?? "").split(import_node_path23.default.delimiter).filter((dir) => dir !== ""),
     findExecutableInDir,
     isOwnBinary,
     ...request4?.version === void 0 ? {} : { version: request4.version }
@@ -8393,7 +8496,7 @@ function realInstalledClaudeVersions() {
 }
 
 // src/checkReport.ts
-var import_node_path23 = __toESM(require("node:path"), 1);
+var import_node_path24 = __toESM(require("node:path"), 1);
 var import_zod13 = require("zod");
 
 // src/cli/bool.ts
@@ -8825,10 +8928,10 @@ function collectCheckReport(params) {
   }).input;
   const providerName = cascadeProviderName(cascade);
   const provider = providerName === void 0 ? void 0 : loadCheckProvider(paths, providerName);
-  const farmRoot = identityDecision.name === void 0 ? void 0 : import_node_path23.default.join(paths.identitiesDir, identityDecision.name);
+  const farmRoot = identityDecision.name === void 0 ? void 0 : import_node_path24.default.join(paths.identitiesDir, identityDecision.name);
   const settingsFiles = {
-    "settings.json": realFsPort.readFileUtf8(import_node_path23.default.join(claudeHome, "settings.json")),
-    "settings.local.json": realFsPort.readFileUtf8(import_node_path23.default.join(claudeHome, "settings.local.json"))
+    "settings.json": realFsPort.readFileUtf8(import_node_path24.default.join(claudeHome, "settings.json")),
+    "settings.local.json": realFsPort.readFileUtf8(import_node_path24.default.join(claudeHome, "settings.local.json"))
   };
   const report = runCheck({
     cwd,
@@ -8860,7 +8963,7 @@ function collectCheckReport(params) {
 
 // src/claudeShim.ts
 var import_node_fs8 = __toESM(require("node:fs"), 1);
-var import_node_path24 = __toESM(require("node:path"), 1);
+var import_node_path25 = __toESM(require("node:path"), 1);
 var import_zod14 = require("zod");
 var ClaudeShimStateSchema = import_zod14.z.strictObject({
   targetPath: import_zod14.z.string().min(1),
@@ -8872,10 +8975,10 @@ function commandFilename(ownExecutablePath, commandName) {
 }
 function resolveOwnBinaryCheck(paths, contentSourcePath) {
   const state = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-  const recordedTarget = state === void 0 ? void 0 : import_node_path24.default.resolve(state.targetPath);
+  const recordedTarget = state === void 0 ? void 0 : import_node_path25.default.resolve(state.targetPath);
   let ownStat;
   return (candidate) => {
-    if (recordedTarget !== void 0 && import_node_path24.default.resolve(candidate) === recordedTarget) {
+    if (recordedTarget !== void 0 && import_node_path25.default.resolve(candidate) === recordedTarget) {
       return true;
     }
     ownStat ??= statOrUndefined(contentSourcePath);
@@ -8899,20 +9002,20 @@ function statOrUndefined(target) {
 }
 var nodeLinkFs = { link: import_node_fs8.default.linkSync, copyFile: import_node_fs8.default.copyFileSync, chmod: import_node_fs8.default.chmodSync };
 function findPathShadow(params) {
-  const resolvedTargetDir = import_node_path24.default.resolve(params.targetDir);
+  const resolvedTargetDir = import_node_path25.default.resolve(params.targetDir);
   for (const dir of params.pathDirs) {
     const found = params.findExecutableInDir(dir, params.targetFilename);
     if (found === void 0) {
       continue;
     }
-    return import_node_path24.default.resolve(dir) === resolvedTargetDir ? { status: "ok" } : { status: "shadowed", by: found };
+    return import_node_path25.default.resolve(dir) === resolvedTargetDir ? { status: "ok" } : { status: "shadowed", by: found };
   }
-  return params.pathDirs.some((dir) => import_node_path24.default.resolve(dir) === resolvedTargetDir) ? { status: "ok" } : { status: "not-on-path" };
+  return params.pathDirs.some((dir) => import_node_path25.default.resolve(dir) === resolvedTargetDir) ? { status: "ok" } : { status: "not-on-path" };
 }
 
 // src/doctorReport.ts
 var import_node_fs9 = __toESM(require("node:fs"), 1);
-var import_node_path25 = __toESM(require("node:path"), 1);
+var import_node_path26 = __toESM(require("node:path"), 1);
 function refinePathShadow(status, ownExecutablePath, realpath) {
   if (status.status !== "shadowed") {
     return status;
@@ -8936,7 +9039,7 @@ function validateJson(schema, input) {
   return { ok: true, data: result.data };
 }
 function pushPathResolution(push, resolution) {
-  const ownDir = import_node_path25.default.dirname(resolution.ownExecutablePath);
+  const ownDir = import_node_path26.default.dirname(resolution.ownExecutablePath);
   switch (resolution.agentShim.status) {
     case "ok":
       push("path-resolution", "pass", `\`agent-shim\` on PATH resolves to this running executable, ${resolution.ownExecutablePath}.`, "agent-shim");
@@ -9012,14 +9115,14 @@ function pushProvider(push, entry, cacheEnv) {
 }
 function pushLegacyName(push, params) {
   const legacyVariables = Object.keys(params.env).filter((name) => name.startsWith(LEGACY_ENV_PREFIX) && params.env[name] !== void 0).sort();
-  if (legacyVariables.length === 0 && import_node_path25.default.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
+  if (legacyVariables.length === 0 && import_node_path26.default.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
     push("legacy-name", "pass", "Nothing here still uses the former `claude-use` name.");
     return;
   }
   for (const name of legacyVariables) {
     push("legacy-name", "warn", `${name} is the former name of ${name.replace(LEGACY_ENV_PREFIX, ENV_PREFIX)}. Rename it; the old name still works but is only a fallback.`, name);
   }
-  if (import_node_path25.default.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
+  if (import_node_path26.default.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
     push(
       "legacy-name",
       "warn",
@@ -9338,18 +9441,18 @@ function collectDoctorReport(params) {
   const { paths } = params;
   const identityNames = import_node_fs9.default.existsSync(paths.identitiesDir) ? import_node_fs9.default.readdirSync(paths.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && isIdentityDirectoryName(entry.name)).map((entry) => entry.name).sort() : [];
   const identities = identityNames.map((name) => {
-    const farmRoot = import_node_path25.default.join(paths.identitiesDir, name);
-    const identityPath = import_node_path25.default.join(farmRoot, "identity.json");
+    const farmRoot = import_node_path26.default.join(paths.identitiesDir, name);
+    const identityPath = import_node_path26.default.join(farmRoot, "identity.json");
     return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot };
   });
   const profileNames = import_node_fs9.default.existsSync(paths.configProfilesDir) ? import_node_fs9.default.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const configProfiles = profileNames.map((name) => {
-    const profilePath = import_node_path25.default.join(paths.configProfilesDir, `${name}.json`);
+    const profilePath = import_node_path26.default.join(paths.configProfilesDir, `${name}.json`);
     return { name, path: profilePath, raw: realFsPort.readFileUtf8(profilePath) };
   });
   const providerNames = import_node_fs9.default.existsSync(paths.providersDir) ? import_node_fs9.default.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const providers = providerNames.map((name) => {
-    const providerPath = import_node_path25.default.join(paths.providersDir, `${name}.json`);
+    const providerPath = import_node_path26.default.join(paths.providersDir, `${name}.json`);
     return { name, path: providerPath, raw: realFsPort.readFileUtf8(providerPath) };
   });
   const ownExecutablePath = realOwnExecutablePath();
@@ -9361,12 +9464,12 @@ function collectDoctorReport(params) {
     binaryDiscovery = { ok: false, message: error instanceof Error ? error.message : String(error) };
   }
   const shimState = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-  const pathDirs = (params.env.PATH ?? "").split(import_node_path25.default.delimiter).filter((dir) => dir !== "");
+  const pathDirs = (params.env.PATH ?? "").split(import_node_path26.default.delimiter).filter((dir) => dir !== "");
   const claudeShimShadow = shimState === void 0 ? void 0 : refinePathShadow(
     findPathShadow({
       pathDirs,
-      targetDir: import_node_path25.default.dirname(shimState.targetPath),
-      targetFilename: import_node_path25.default.basename(shimState.targetPath),
+      targetDir: import_node_path26.default.dirname(shimState.targetPath),
+      targetFilename: import_node_path26.default.basename(shimState.targetPath),
       findExecutableInDir
     }),
     shimState.targetPath,
@@ -9391,7 +9494,7 @@ function collectDoctorReport(params) {
       agentShim: refinePathShadow(
         findPathShadow({
           pathDirs,
-          targetDir: import_node_path25.default.dirname(ownExecutablePath),
+          targetDir: import_node_path26.default.dirname(ownExecutablePath),
           targetFilename: commandFilename(ownExecutablePath, "agent-shim"),
           findExecutableInDir
         }),
@@ -9412,7 +9515,7 @@ function collectDoctorReport(params) {
 
 // src/launcher.ts
 var import_node_crypto10 = require("node:crypto");
-var import_node_path27 = __toESM(require("node:path"), 1);
+var import_node_path28 = __toESM(require("node:path"), 1);
 
 // src/launcher/argv.ts
 var ConflictingIdentityError = class extends UsageError {
@@ -9677,7 +9780,7 @@ function buildCliOverride(params) {
 }
 
 // src/launcher/flags.ts
-var import_node_path26 = __toESM(require("node:path"), 1);
+var import_node_path27 = __toESM(require("node:path"), 1);
 
 // src/headroom/headers.ts
 function mergeAnthropicCustomHeaders(existing, additions) {
@@ -9747,7 +9850,7 @@ function buildEnv(params) {
   const parentCustomHeaders = params.baseEnv.ANTHROPIC_CUSTOM_HEADERS;
   let providerCustomHeaders;
   if (!params.configDirEscapeHatch && params.resolvedIdentityName !== void 0) {
-    env.CLAUDE_CONFIG_DIR = import_node_path26.default.join(params.identitiesDir, params.resolvedIdentityName);
+    env.CLAUDE_CONFIG_DIR = import_node_path27.default.join(params.identitiesDir, params.resolvedIdentityName);
   }
   if (params.provider !== void 0) {
     const providerEnv = params.provider.definition.env ?? {};
@@ -9908,7 +10011,7 @@ function prepareLaunch(params) {
     identityDefaultConfigProfile: loadedIdentity?.config.defaultConfigProfile,
     globalDefaultConfigProfile: params.globalDefaultConfigProfile
   });
-  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs12.readConfigFile(import_node_path27.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
+  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs12.readConfigFile(import_node_path28.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
     log.error(
       `agent-shim: no configuration profile named "${configProfileDecision.name}" (selected via ${configProfileDecision.source}). Run \`agent-shim profile add ${configProfileDecision.name}\` first.`
     );
@@ -10154,11 +10257,11 @@ function probeFrontDoorSync(port, caPem) {
 
 // src/frontdoor/trust.ts
 var import_node_crypto11 = require("node:crypto");
-var import_node_path28 = __toESM(require("node:path"), 1);
+var import_node_path29 = __toESM(require("node:path"), 1);
 var BUNDLE_NAME_HEX_DIGITS = 16;
 function resolveTrustBundle(params) {
   const { caCertFile, bundlesDir, variable, inherited, fs: fs12 } = params;
-  if (inherited === void 0 || inherited === "" || import_node_path28.default.resolve(inherited) === import_node_path28.default.resolve(caCertFile)) {
+  if (inherited === void 0 || inherited === "" || import_node_path29.default.resolve(inherited) === import_node_path29.default.resolve(caCertFile)) {
     return { path: caCertFile };
   }
   const caPem = fs12.readFileUtf8(caCertFile);
@@ -10176,7 +10279,7 @@ function resolveTrustBundle(params) {
   }
   const combined = `${inheritedPem.trimEnd()}
 ${caPem}`;
-  const bundle = import_node_path28.default.join(bundlesDir, `${(0, import_node_crypto11.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
+  const bundle = import_node_path29.default.join(bundlesDir, `${(0, import_node_crypto11.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
   if (!fs12.exists(bundle)) {
     fs12.mkdirp(bundlesDir);
     fs12.writeFileAtomic(bundle, combined);
@@ -10404,6 +10507,7 @@ function prepareClaudeLaunch(options) {
   createRcApiNodeHandler,
   createRcApiRouter,
   createRcControlHandler,
+  createRcCredentialStore,
   createRcEventFanout,
   createRcSessionTracker,
   createRcStreamHub,