agent-shim 8.11.2 → 8.12.0

package/dist/cli.cjs

@@ -3248,42 +3248,42 @@ var require_defaults = __commonJS({
 var require_env_paths = __commonJS({
   "node_modules/.pnpm/env-paths@2.2.1/node_modules/env-paths/index.js"(exports2, module2) {
     "use strict";
-    var path42 = require("path");
+    var path43 = require("path");
     var os10 = require("os");
     var homedir = os10.homedir();
     var tmpdir = os10.tmpdir();
     var { env } = process;
     var macos = (name) => {
-      const library = path42.join(homedir, "Library");
+      const library = path43.join(homedir, "Library");
       return {
-        data: path42.join(library, "Application Support", name),
-        config: path42.join(library, "Preferences", name),
-        cache: path42.join(library, "Caches", name),
-        log: path42.join(library, "Logs", name),
-        temp: path42.join(tmpdir, name)
+        data: path43.join(library, "Application Support", name),
+        config: path43.join(library, "Preferences", name),
+        cache: path43.join(library, "Caches", name),
+        log: path43.join(library, "Logs", name),
+        temp: path43.join(tmpdir, name)
       };
     };
     var windows = (name) => {
-      const appData = env.APPDATA || path42.join(homedir, "AppData", "Roaming");
-      const localAppData = env.LOCALAPPDATA || path42.join(homedir, "AppData", "Local");
+      const appData = env.APPDATA || path43.join(homedir, "AppData", "Roaming");
+      const localAppData = env.LOCALAPPDATA || path43.join(homedir, "AppData", "Local");
       return {
         // Data/config/cache/log are invented by me as Windows isn't opinionated about this
-        data: path42.join(localAppData, name, "Data"),
-        config: path42.join(appData, name, "Config"),
-        cache: path42.join(localAppData, name, "Cache"),
-        log: path42.join(localAppData, name, "Log"),
-        temp: path42.join(tmpdir, name)
+        data: path43.join(localAppData, name, "Data"),
+        config: path43.join(appData, name, "Config"),
+        cache: path43.join(localAppData, name, "Cache"),
+        log: path43.join(localAppData, name, "Log"),
+        temp: path43.join(tmpdir, name)
       };
     };
     var linux = (name) => {
-      const username = path42.basename(homedir);
+      const username = path43.basename(homedir);
       return {
-        data: path42.join(env.XDG_DATA_HOME || path42.join(homedir, ".local", "share"), name),
-        config: path42.join(env.XDG_CONFIG_HOME || path42.join(homedir, ".config"), name),
-        cache: path42.join(env.XDG_CACHE_HOME || path42.join(homedir, ".cache"), name),
+        data: path43.join(env.XDG_DATA_HOME || path43.join(homedir, ".local", "share"), name),
+        config: path43.join(env.XDG_CONFIG_HOME || path43.join(homedir, ".config"), name),
+        cache: path43.join(env.XDG_CACHE_HOME || path43.join(homedir, ".cache"), name),
         // https://wiki.debian.org/XDGBaseDirectorySpecification#state
-        log: path42.join(env.XDG_STATE_HOME || path42.join(homedir, ".local", "state"), name),
-        temp: path42.join(tmpdir, username, name)
+        log: path43.join(env.XDG_STATE_HOME || path43.join(homedir, ".local", "state"), name),
+        temp: path43.join(tmpdir, username, name)
       };
     };
     var envPaths = (name, options) => {
@@ -3351,11 +3351,11 @@ var require_util = __commonJS({
       return result;
     }
     exports2.emplace = emplace;
-    function getPropertyByPath(source, path42) {
-      if (typeof path42 === "string" && Object.prototype.hasOwnProperty.call(source, path42)) {
-        return source[path42];
+    function getPropertyByPath(source, path43) {
+      if (typeof path43 === "string" && Object.prototype.hasOwnProperty.call(source, path43)) {
+        return source[path43];
       }
-      const parsedPath = typeof path42 === "string" ? path42.split(".") : path42;
+      const parsedPath = typeof path43 === "string" ? path43.split(".") : path43;
       return parsedPath.reduce((previous, key) => {
         if (previous === void 0) {
           return previous;
@@ -3378,9 +3378,9 @@ var require_util = __commonJS({
       return Object.fromEntries(Object.entries(options).filter(([, value2]) => value2 !== void 0));
     }
     exports2.removeUndefinedValuesFromObject = removeUndefinedValuesFromObject;
-    async function isDirectory(path42) {
+    async function isDirectory(path43) {
       try {
-        const stat = await fs_1.promises.stat(path42);
+        const stat = await fs_1.promises.stat(path43);
         return stat.isDirectory();
       } catch (e) {
         if (e.code === "ENOENT") {
@@ -3390,9 +3390,9 @@ var require_util = __commonJS({
       }
     }
     exports2.isDirectory = isDirectory;
-    function isDirectorySync(path42) {
+    function isDirectorySync(path43) {
       try {
-        const stat = fs_1.default.statSync(path42);
+        const stat = fs_1.default.statSync(path43);
         return stat.isDirectory();
       } catch (e) {
         if (e.code === "ENOENT") {
@@ -3490,7 +3490,7 @@ var require_ExplorerBase = __commonJS({
           const idx = importStack.indexOf(fullPath);
           if (idx !== -1) {
             throw new Error(`Circular import detected:
-${[...importStack, fullPath].map((path42, i2) => `${i2 + 1}. ${path42}`).join("\n")} (same as ${idx + 1}.)`);
+${[...importStack, fullPath].map((path43, i2) => `${i2 + 1}. ${path43}`).join("\n")} (same as ${idx + 1}.)`);
           }
         }
       }
@@ -3678,9 +3678,9 @@ var require_Explorer = __commonJS({
           throw error62;
         }
       }
-      async #fileExists(path42) {
+      async #fileExists(path43) {
         try {
-          await promises_1.default.stat(path42);
+          await promises_1.default.stat(path43);
           return true;
         } catch (e) {
           return false;
@@ -3840,9 +3840,9 @@ var require_ExplorerSync = __commonJS({
           throw error62;
         }
       }
-      #fileExists(path42) {
+      #fileExists(path43) {
         try {
-          fs_1.default.statSync(path42);
+          fs_1.default.statSync(path43);
           return true;
         } catch (e) {
           return false;
@@ -3966,7 +3966,7 @@ var require_dist = __commonJS({
       };
     }
     function getResolvedSearchPlaces(moduleName, toolDefinedSearchPlaces, userConfiguredOptions) {
-      const userConfiguredSearchPlaces = userConfiguredOptions.searchPlaces?.map((path42) => path42.replace("{name}", moduleName));
+      const userConfiguredSearchPlaces = userConfiguredOptions.searchPlaces?.map((path43) => path43.replace("{name}", moduleName));
       if (userConfiguredOptions.mergeSearchPlaces) {
         return [...userConfiguredSearchPlaces ?? [], ...toolDefinedSearchPlaces];
       }
@@ -4374,8 +4374,8 @@ var require_utils = __commonJS({
       }
       return output2;
     };
-    exports2.basename = (path42, { windows } = {}) => {
-      const segs = path42.split(windows ? /[\\/]/ : "/");
+    exports2.basename = (path43, { windows } = {}) => {
+      const segs = path43.split(windows ? /[\\/]/ : "/");
       const last = segs[segs.length - 1];
       if (last === "") {
         return segs[segs.length - 2];
@@ -7003,14 +7003,14 @@ var require_util2 = __commonJS({
         }
         const port = url2.port != null ? url2.port : url2.protocol === "https:" ? 443 : 80;
         let origin = url2.origin != null ? url2.origin : `${url2.protocol || ""}//${url2.hostname || ""}:${port}`;
-        let path42 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`;
+        let path43 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`;
         if (origin[origin.length - 1] === "/") {
           origin = origin.slice(0, origin.length - 1);
         }
-        if (path42 && path42[0] !== "/") {
-          path42 = `/${path42}`;
+        if (path43 && path43[0] !== "/") {
+          path43 = `/${path43}`;
         }
-        return new URL(`${origin}${path42}`);
+        return new URL(`${origin}${path43}`);
       }
       if (!isHttpOrHttpsPrefixed(url2.origin || url2.protocol)) {
         throw new InvalidArgumentError2("Invalid URL protocol: the URL must start with `http:` or `https:`.");
@@ -7831,9 +7831,9 @@ var require_diagnostics = __commonJS({
         "undici:client:sendHeaders",
         (evt) => {
           const {
-            request: { method, path: path42, origin }
+            request: { method, path: path43, origin }
           } = evt;
-          debugLog("sending request to %s %s%s", method, origin, path42);
+          debugLog("sending request to %s %s%s", method, origin, path43);
         }
       );
     }
@@ -7851,14 +7851,14 @@ var require_diagnostics = __commonJS({
         "undici:request:headers",
         (evt) => {
           const {
-            request: { method, path: path42, origin },
+            request: { method, path: path43, origin },
             response: { statusCode }
           } = evt;
           debugLog(
             "received response to %s %s%s - HTTP %d",
             method,
             origin,
-            path42,
+            path43,
             statusCode
           );
         }
@@ -7867,23 +7867,23 @@ var require_diagnostics = __commonJS({
         "undici:request:trailers",
         (evt) => {
           const {
-            request: { method, path: path42, origin }
+            request: { method, path: path43, origin }
           } = evt;
-          debugLog("trailers received from %s %s%s", method, origin, path42);
+          debugLog("trailers received from %s %s%s", method, origin, path43);
         }
       );
       diagnosticsChannel.subscribe(
         "undici:request:error",
         (evt) => {
           const {
-            request: { method, path: path42, origin },
+            request: { method, path: path43, origin },
             error: error62
           } = evt;
           debugLog(
             "request to %s %s%s errored - %s",
             method,
             origin,
-            path42,
+            path43,
             error62.message
           );
         }
@@ -7998,7 +7998,7 @@ var require_request = __commonJS({
     var kHandler = /* @__PURE__ */ Symbol("handler");
     var Request2 = class {
       constructor(origin, {
-        path: path42,
+        path: path43,
         method,
         body,
         headers,
@@ -8015,11 +8015,11 @@ var require_request = __commonJS({
         maxRedirections,
         typeOfService
       }, handler) {
-        if (typeof path42 !== "string") {
+        if (typeof path43 !== "string") {
           throw new InvalidArgumentError2("path must be a string");
-        } else if (path42[0] !== "/" && !(path42.startsWith("http://") || path42.startsWith("https://")) && method !== "CONNECT") {
+        } else if (path43[0] !== "/" && !(path43.startsWith("http://") || path43.startsWith("https://")) && method !== "CONNECT") {
           throw new InvalidArgumentError2("path must be an absolute URL or start with a slash");
-        } else if (invalidPathRegex.test(path42)) {
+        } else if (invalidPathRegex.test(path43)) {
           throw new InvalidArgumentError2("invalid request path");
         }
         if (typeof method !== "string") {
@@ -8094,7 +8094,7 @@ var require_request = __commonJS({
         this.completed = false;
         this.aborted = false;
         this.upgrade = upgrade || null;
-        this.path = query ? serializePathWithQuery(path42, query) : path42;
+        this.path = query ? serializePathWithQuery(path43, query) : path43;
         this.origin = origin;
         this.protocol = getProtocolFromUrlString(origin);
         this.idempotent = idempotent == null ? method === "HEAD" || method === "GET" : idempotent;
@@ -13276,7 +13276,7 @@ var require_client_h1 = __commonJS({
       return method !== "GET" && method !== "HEAD" && method !== "OPTIONS" && method !== "TRACE" && method !== "CONNECT";
     }
     function writeH1(client, request7) {
-      const { method, path: path42, host, upgrade, blocking, reset } = request7;
+      const { method, path: path43, host, upgrade, blocking, reset } = request7;
       let { body, headers, contentLength } = request7;
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH" || method === "QUERY" || method === "PROPFIND" || method === "PROPPATCH";
       if (util.isFormDataLike(body)) {
@@ -13354,7 +13354,7 @@ var require_client_h1 = __commonJS({
       if (socket.setTypeOfService) {
         socket.setTypeOfService(request7.typeOfService);
       }
-      let header = `${method} ${path42} HTTP/1.1\r
+      let header = `${method} ${path43} HTTP/1.1\r
 `;
       if (typeof host === "string") {
         header += `host: ${host}\r
@@ -14033,7 +14033,7 @@ var require_client_h2 = __commonJS({
       const headersTimeout = request7.headersTimeout ?? client[kHeadersTimeout];
       const bodyTimeout = request7.bodyTimeout ?? client[kBodyTimeout];
       const session = client[kHTTP2Session];
-      const { method, path: path42, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request7;
+      const { method, path: path43, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request7;
       let { body } = request7;
       if (upgrade != null && upgrade !== "websocket") {
         util.errorRequest(client, request7, new InvalidArgumentError2(`Custom upgrade "${upgrade}" not supported over HTTP/2`));
@@ -14102,7 +14102,7 @@ var require_client_h2 = __commonJS({
           }
           headers[HTTP2_HEADER_METHOD] = "CONNECT";
           headers[HTTP2_HEADER_PROTOCOL] = "websocket";
-          headers[HTTP2_HEADER_PATH] = path42;
+          headers[HTTP2_HEADER_PATH] = path43;
           if (protocol === "ws:" || protocol === "wss:") {
             headers[HTTP2_HEADER_SCHEME] = protocol === "ws:" ? "http" : "https";
           } else {
@@ -14144,7 +14144,7 @@ var require_client_h2 = __commonJS({
         stream.setTimeout(headersTimeout);
         return true;
       }
-      headers[HTTP2_HEADER_PATH] = path42;
+      headers[HTTP2_HEADER_PATH] = path43;
       headers[HTTP2_HEADER_SCHEME] = protocol === "http:" ? "http" : "https";
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH";
       if (body && typeof body.read === "function") {
@@ -16496,10 +16496,10 @@ var require_proxy_agent = __commonJS({
         };
         const {
           origin,
-          path: path42 = "/",
+          path: path43 = "/",
           headers = {}
         } = opts;
-        opts.path = origin + path42;
+        opts.path = origin + path43;
         if (!("host" in headers) && !("Host" in headers)) {
           const { host } = new URL(origin);
           headers.host = host;
@@ -18608,20 +18608,20 @@ var require_mock_utils = __commonJS({
       }
       return normalizedQp;
     }
-    function safeUrl(path42) {
-      if (typeof path42 !== "string") {
-        return path42;
+    function safeUrl(path43) {
+      if (typeof path43 !== "string") {
+        return path43;
       }
-      const pathSegments = path42.split("?", 3);
+      const pathSegments = path43.split("?", 3);
       if (pathSegments.length !== 2) {
-        return path42;
+        return path43;
       }
       const qp = new URLSearchParams(pathSegments.pop());
       qp.sort();
       return [...pathSegments, qp.toString()].join("?");
     }
-    function matchKey(mockDispatch2, { path: path42, method, body, headers }) {
-      const pathMatch = matchValue(mockDispatch2.path, path42);
+    function matchKey(mockDispatch2, { path: path43, method, body, headers }) {
+      const pathMatch = matchValue(mockDispatch2.path, path43);
       const methodMatch = matchValue(mockDispatch2.method, method);
       const bodyMatch = typeof mockDispatch2.body !== "undefined" ? matchValue(mockDispatch2.body, body) : true;
       const headersMatch = matchHeaders(mockDispatch2, headers);
@@ -18646,8 +18646,8 @@ var require_mock_utils = __commonJS({
       const basePath = key.query ? serializePathWithQuery(key.path, key.query) : key.path;
       const resolvedPath = typeof basePath === "string" ? safeUrl(basePath) : basePath;
       const resolvedPathWithoutTrailingSlash = removeTrailingSlash(resolvedPath);
-      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path42, ignoreTrailingSlash }) => {
-        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path42)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path42), resolvedPath);
+      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path43, ignoreTrailingSlash }) => {
+        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path43)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path43), resolvedPath);
       });
       if (matchedMockDispatches.length === 0) {
         throw new MockNotMatchedError(`Mock dispatch not matched for path '${resolvedPath}'`);
@@ -18686,19 +18686,19 @@ var require_mock_utils = __commonJS({
         mockDispatches.splice(index, 1);
       }
     }
-    function removeTrailingSlash(path42) {
-      while (path42.endsWith("/")) {
-        path42 = path42.slice(0, -1);
+    function removeTrailingSlash(path43) {
+      while (path43.endsWith("/")) {
+        path43 = path43.slice(0, -1);
       }
-      if (path42.length === 0) {
-        path42 = "/";
+      if (path43.length === 0) {
+        path43 = "/";
       }
-      return path42;
+      return path43;
     }
     function buildKey(opts) {
-      const { path: path42, method, body, headers, query } = opts;
+      const { path: path43, method, body, headers, query } = opts;
       return {
-        path: path42,
+        path: path43,
         method,
         body,
         headers,
@@ -19388,10 +19388,10 @@ var require_pending_interceptors_formatter = __commonJS({
       }
       format(pendingInterceptors) {
         const withPrettyHeaders = pendingInterceptors.map(
-          ({ method, path: path42, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
+          ({ method, path: path43, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
             Method: method,
             Origin: origin,
-            Path: path42,
+            Path: path43,
             "Status code": statusCode,
             Persistent: persist ? PERSISTENT : NOT_PERSISTENT,
             Invocations: timesInvoked,
@@ -19473,9 +19473,9 @@ var require_mock_agent = __commonJS({
         const acceptNonStandardSearchParameters = this[kMockAgentAcceptsNonStandardSearchParameters];
         const dispatchOpts = { ...opts };
         if (acceptNonStandardSearchParameters && dispatchOpts.path) {
-          const [path42, searchParams] = dispatchOpts.path.split("?");
+          const [path43, searchParams] = dispatchOpts.path.split("?");
           const normalizedSearchParams = normalizeSearchParams(searchParams, acceptNonStandardSearchParameters);
-          dispatchOpts.path = `${path42}?${normalizedSearchParams}`;
+          dispatchOpts.path = `${path43}?${normalizedSearchParams}`;
         }
         return this[kAgent].dispatch(dispatchOpts, handler);
       }
@@ -19876,12 +19876,12 @@ var require_snapshot_recorder = __commonJS({
        * @return {Promise<void>} - Resolves when snapshots are loaded
        */
       async loadSnapshots(filePath) {
-        const path42 = filePath || this.#snapshotPath;
-        if (!path42) {
+        const path43 = filePath || this.#snapshotPath;
+        if (!path43) {
           throw new InvalidArgumentError2("Snapshot path is required");
         }
         try {
-          const data = await readFile(resolve(path42), "utf8");
+          const data = await readFile(resolve(path43), "utf8");
           const parsed = JSON.parse(data);
           if (Array.isArray(parsed)) {
             this.#snapshots.clear();
@@ -19895,7 +19895,7 @@ var require_snapshot_recorder = __commonJS({
           if (error62.code === "ENOENT") {
             this.#snapshots.clear();
           } else {
-            throw new UndiciError(`Failed to load snapshots from ${path42}`, { cause: error62 });
+            throw new UndiciError(`Failed to load snapshots from ${path43}`, { cause: error62 });
           }
         }
       }
@@ -19906,11 +19906,11 @@ var require_snapshot_recorder = __commonJS({
        * @returns {Promise<void>} - Resolves when snapshots are saved
        */
       async saveSnapshots(filePath) {
-        const path42 = filePath || this.#snapshotPath;
-        if (!path42) {
+        const path43 = filePath || this.#snapshotPath;
+        if (!path43) {
           throw new InvalidArgumentError2("Snapshot path is required");
         }
-        const resolvedPath = resolve(path42);
+        const resolvedPath = resolve(path43);
         await mkdir(dirname2(resolvedPath), { recursive: true });
         const data = Array.from(this.#snapshots.entries()).map(([hash2, snapshot]) => ({
           hash: hash2,
@@ -20542,15 +20542,15 @@ var require_redirect_handler = __commonJS({
           return;
         }
         const { origin, pathname, search } = util.parseURL(new URL(this.location, this.opts.origin && new URL(this.opts.path, this.opts.origin)));
-        const path42 = search ? `${pathname}${search}` : pathname;
-        const redirectUrlString = `${origin}${path42}`;
+        const path43 = search ? `${pathname}${search}` : pathname;
+        const redirectUrlString = `${origin}${path43}`;
         for (const historyUrl of this.history) {
           if (historyUrl.toString() === redirectUrlString) {
             throw new InvalidArgumentError2(`Redirect loop detected. Cannot redirect to ${origin}. This typically happens when using a Client or Pool with cross-origin redirects. Use an Agent for cross-origin redirects.`);
           }
         }
         this.opts.headers = cleanRequestHeaders(this.opts.headers, statusCode === 303, this.opts.origin !== origin);
-        this.opts.path = path42;
+        this.opts.path = path43;
         this.opts.origin = origin;
         this.opts.query = null;
       }
@@ -22310,10 +22310,10 @@ var require_cache_handler = __commonJS({
       }
       return locationUrl.pathname + locationUrl.search;
     }
-    function deleteCachedUri(store, cacheKey, path42) {
+    function deleteCachedUri(store, cacheKey, path43) {
       deleteCachedValue(store, {
         ...cacheKey,
-        path: path42
+        path: path43
       });
       for (let i2 = 0; i2 < util.safeHTTPMethods.length; i2++) {
         const method = util.safeHTTPMethods[i2];
@@ -22321,7 +22321,7 @@ var require_cache_handler = __commonJS({
           deleteCachedValue(store, {
             ...cacheKey,
             method,
-            path: path42
+            path: path43
           });
         }
       }
@@ -22332,9 +22332,9 @@ var require_cache_handler = __commonJS({
       }
       const values = Array.isArray(headerValue2) ? headerValue2 : [headerValue2];
       for (let i2 = 0; i2 < values.length; i2++) {
-        const path42 = getSameOriginPath(cacheKey, values[i2]);
-        if (path42 !== void 0) {
-          deleteCachedUri(store, cacheKey, path42);
+        const path43 = getSameOriginPath(cacheKey, values[i2]);
+        if (path43 !== void 0) {
+          deleteCachedUri(store, cacheKey, path43);
         }
       }
     }
@@ -27334,11 +27334,11 @@ var require_fetch = __commonJS({
       function dispatch({ body }) {
         const url2 = requestCurrentURL(request7);
         const agent = fetchParams.controller.dispatcher;
-        const path42 = url2.pathname + url2.search;
+        const path43 = url2.pathname + url2.search;
         const hasTrailingQuestionMark = url2.search.length === 0 && url2.href[url2.href.length - url2.hash.length - 1] === "?";
         return new Promise((resolve, reject) => agent.dispatch(
           {
-            path: hasTrailingQuestionMark ? `${path42}?` : path42,
+            path: hasTrailingQuestionMark ? `${path43}?` : path43,
             origin: url2.origin,
             method: request7.method,
             body: agent.isMockActive ? request7.body && (request7.body.source || request7.body.stream) : body,
@@ -28285,9 +28285,9 @@ var require_util5 = __commonJS({
         }
       }
     }
-    function validateCookiePath(path42) {
-      for (let i2 = 0; i2 < path42.length; ++i2) {
-        const code = path42.charCodeAt(i2);
+    function validateCookiePath(path43) {
+      for (let i2 = 0; i2 < path43.length; ++i2) {
+        const code = path43.charCodeAt(i2);
         if (code < 32 || // exclude CTLs (0-31)
         code > 126 || // exclude DEL and non-ascii
         code === 59) {
@@ -31635,11 +31635,11 @@ var require_undici = __commonJS({
           if (typeof opts.path !== "string") {
             throw new InvalidArgumentError2("invalid opts.path");
           }
-          let path42 = opts.path;
+          let path43 = opts.path;
           if (!opts.path.startsWith("/")) {
-            path42 = `/${path42}`;
+            path43 = `/${path43}`;
           }
-          url2 = new URL(util.parseOrigin(url2).origin + path42);
+          url2 = new URL(util.parseOrigin(url2).origin + path43);
         } else {
           if (!opts) {
             opts = typeof url2 === "object" ? url2 : {};
@@ -31749,7 +31749,7 @@ ${captureLines}` : capture.stack;
 });
 
 // src/cli.ts
-var import_node_path40 = __toESM(require("node:path"), 1);
+var import_node_path41 = __toESM(require("node:path"), 1);
 
 // node_modules/.pnpm/commander@15.0.0/node_modules/commander/lib/error.js
 var CommanderError = class extends Error {
@@ -34862,9 +34862,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
    * @param {string} [path]
    * @return {(string|null|Command)}
    */
-  executableDir(path42) {
-    if (path42 === void 0) return this._executableDir;
-    this._executableDir = path42;
+  executableDir(path43) {
+    if (path43 === void 0) return this._executableDir;
+    this._executableDir = path43;
     return this;
   }
   /**
@@ -36002,10 +36002,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path42) {
-  if (!path42)
+function getElementAtPath(obj, path43) {
+  if (!path43)
     return obj;
-  return path42.reduce((acc, key) => acc?.[key], obj);
+  return path43.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -36345,11 +36345,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path42, issues) {
+function prefixIssues(path43, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path42);
+    iss.path.unshift(path43);
     return iss;
   });
 }
@@ -36799,16 +36799,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path42 = []) => {
+  const processError = (error63, path43 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path42, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path43, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path42, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path43, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path42, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path43, ...issue2.path]);
       } else {
-        const fullpath = [...path42, ...issue2.path];
+        const fullpath = [...path43, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -36847,17 +36847,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error63, path42 = []) => {
+  const processError = (error63, path43 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path42, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path43, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path42, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path43, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path42, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path43, ...issue2.path]);
       } else {
-        const fullpath = [...path42, ...issue2.path];
+        const fullpath = [...path43, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -36896,8 +36896,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path42 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path42) {
+  const path43 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path43) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -53999,13 +53999,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path42 = ref.slice(1).split("/").filter(Boolean);
-  if (path42.length === 0) {
+  const path43 = ref.slice(1).split("/").filter(Boolean);
+  if (path43.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path42[0] === defsKey) {
-    const key = path42[1] === void 0 ? void 0 : decodeJSONPointerSegment(path42[1]);
+  if (path43[0] === defsKey) {
+    const key = path43[1] === void 0 ? void 0 : decodeJSONPointerSegment(path43[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -61710,7 +61710,7 @@ function registerIdentityCommand(program2, deps) {
 // package.json
 var package_default = {
   name: "agent-shim",
-  version: "8.11.2",
+  version: "8.12.0",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -62140,11 +62140,11 @@ function providerBaseUrl(port, provider) {
 function directOrigin(port) {
   return `http://127.0.0.1:${String(port)}`;
 }
-function parseProviderPath(path42) {
-  if (!path42.startsWith(PROVIDER_PATH_PREFIX)) {
+function parseProviderPath(path43) {
+  if (!path43.startsWith(PROVIDER_PATH_PREFIX)) {
     return void 0;
   }
-  const tail = path42.slice(PROVIDER_PATH_PREFIX.length);
+  const tail = path43.slice(PROVIDER_PATH_PREFIX.length);
   const slash = tail.indexOf("/");
   if (slash <= 0) {
     return void 0;
@@ -62544,9 +62544,9 @@ function decoderFor(encoding) {
       return void 0;
   }
 }
-function destinationOf(path42) {
-  const scoped = parseProviderPath(path42);
-  return scoped === void 0 ? { provider: ANTHROPIC_PROVIDER, endpoint: path42 } : { provider: scoped.provider, endpoint: scoped.rest };
+function destinationOf(path43) {
+  const scoped = parseProviderPath(path43);
+  return scoped === void 0 ? { provider: ANTHROPIC_PROVIDER, endpoint: path43 } : { provider: scoped.provider, endpoint: scoped.rest };
 }
 function buildRecord(event, context) {
   const { scan } = context;
@@ -64446,7 +64446,7 @@ function registerCodexCommand(program2, deps) {
 
 // src/frontdoor/commands.ts
 var import_node_crypto12 = require("node:crypto");
-var import_node_path33 = __toESM(require("node:path"), 1);
+var import_node_path34 = __toESM(require("node:path"), 1);
 var import_node_fs12 = __toESM(require("node:fs"), 1);
 
 // src/frontdoor/custody.ts
@@ -65176,8 +65176,8 @@ function parseConnectTarget(authority) {
   }
   return { host, port };
 }
-function servedByPipeline(path42) {
-  return path42?.startsWith(ROUTED_PATH_PREFIX) === true;
+function servedByPipeline(path43) {
+  return path43?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
   "connection",
@@ -65260,14 +65260,17 @@ ${request7.rawHeaders.reduce((accumulated, value2, index) => index % 2 === 0 ? `
     pumpTapSession(socket, async (clientAlpn) => await effects.connectTlsUpstream(host, HTTPS_PORT, clientAlpn), config2.capture?.tapStream?.(host), Buffer.from(headText, "utf8"));
   };
   const sessions = config2.interceptHosts.map((host) => {
-    if (config2.tapHosts.includes(host)) {
+    if (config2.tapHosts.includes(host) && !(config2.localSurface?.parsesHost(host) ?? false)) {
       const serveSecure2 = (secure) => {
         pumpTapSession(secure, async (clientAlpn) => await effects.connectTlsUpstream(host, HTTPS_PORT, clientAlpn), config2.capture?.tapStream?.(host));
       };
       const tlsAcceptor2 = effects.createTlsAcceptor(config2.leafFor(host), serveSecure2, TAP_ALPN_PROTOCOLS);
       return { host, serveSecure: serveSecure2, tlsAcceptor: tlsAcceptor2 };
     }
-    const handler = (request7, response) => {
+    const handleHostRequest = async (request7, response) => {
+      if (config2.localSurface !== void 0 && await config2.localSurface.serve(host, request7, response)) {
+        return;
+      }
       if (host === config2.routedHost && servedByPipeline(request7.url)) {
         const tunnelToken = tunnelTokens.get(request7.socket);
         if (tunnelToken !== void 0 && request7.headers[AUTH_HEADER] === void 0) {
@@ -65278,6 +65281,9 @@ ${request7.rawHeaders.reduce((accumulated, value2, index) => index % 2 === 0 ? `
       }
       effects.forwardHttp(config2.upstreamFor(host), request7, response, config2.capture?.observePassthrough(request7));
     };
+    const handler = (request7, response) => {
+      void handleHostRequest(request7, response);
+    };
     const httpSession = effects.createHttpSession(handler, onUpgrade(host));
     const serveSecure = (secure, capability) => {
       tunnelTokens.set(secure, capability);
@@ -65648,7 +65654,7 @@ function parseRcRequestBody(kind, body) {
     return { controlRequests: [], answeredRequestIds: [], idleSeconds: finiteNumber(parseJsonObject(body), "idle_seconds"), workerStatus: void 0 };
   }
   if (kind === "worker-registration") {
-    return { controlRequests: [], answeredRequestIds: [], idleSeconds: void 0, workerStatus: nonEmptyString(parseJsonObject(body), "status") };
+    return { controlRequests: [], answeredRequestIds: [], idleSeconds: void 0, workerStatus: nonEmptyString(parseJsonObject(body), "worker_status") };
   }
   const controlRequests = [];
   const answeredRequestIds = [];
@@ -65697,11 +65703,11 @@ function createRcSessionTracker(deps) {
   };
   const observeExchange = (request7) => {
     const method = (request7.method ?? "").toUpperCase();
-    const path42 = new URL(request7.url ?? "/", "http://127.0.0.1").pathname;
-    if (!path42.startsWith(RC_SESSIONS_PATH_PREFIX)) {
+    const path43 = new URL(request7.url ?? "/", "http://127.0.0.1").pathname;
+    if (!path43.startsWith(RC_SESSIONS_PATH_PREFIX)) {
       return void 0;
     }
-    const tail = path42.slice(RC_SESSIONS_PATH_PREFIX.length);
+    const tail = path43.slice(RC_SESSIONS_PATH_PREFIX.length);
     const facts = {
       oauthAuthorization: oauthAuthorizationOf(request7.headers),
       anthropicVersion: singleHeader(request7.headers, "anthropic-version"),
@@ -66441,9 +66447,9 @@ function sequenceNumsOfBody(body) {
 }
 function frontDoorRcControl(transport, token) {
   const headers = { authorization: `Bearer ${token}` };
-  const listAnswerOf = async (path42, what) => {
+  const listAnswerOf = async (path43, what) => {
     try {
-      return await transport.request({ method: "GET", path: path42, headers });
+      return await transport.request({ method: "GET", path: path43, headers });
     } catch (error62) {
       throw new Error(`${what}: could not reach the front door's control listener: ${error62 instanceof Error ? error62.message : String(error62)}`, { cause: error62 });
     }
@@ -66515,10 +66521,10 @@ function frontDoorRcControl(transport, token) {
     }
     return pending;
   };
-  const writeOf = async (path42, body, describeFailure) => {
+  const writeOf = async (path43, body, describeFailure) => {
     let answer;
     try {
-      answer = await transport.request({ method: "POST", path: path42, headers: { ...headers, "content-type": "application/json" }, body });
+      answer = await transport.request({ method: "POST", path: path43, headers: { ...headers, "content-type": "application/json" }, body });
     } catch (error62) {
       return { ok: false, message: `could not reach the front door's control listener: ${error62 instanceof Error ? error62.message : String(error62)}` };
     }
@@ -66862,14 +66868,41 @@ var NO_CHUNKS = {
     next: async () => await Promise.resolve({ done: true, value: void 0 })
   })
 };
+function lateRcEventDial(resolve) {
+  let built;
+  const dialFor = () => {
+    const target = resolve();
+    if (built === void 0 || built.for !== target) {
+      built = { for: target, dial: realRcEventDial(target) };
+    }
+    return built.dial;
+  };
+  return {
+    writeEvents: async (sessionId, headers, body) => await dialFor().writeEvents(sessionId, headers, body)
+  };
+}
+function lateRcStreamDial(resolve) {
+  let built;
+  const dialFor = () => {
+    const target = resolve();
+    if (built === void 0 || built.for !== target) {
+      built = { for: target, dial: realRcStreamDial(target) };
+    }
+    return built.dial;
+  };
+  return {
+    announcePresence: async (sessionId, headers, clientId) => await dialFor().announcePresence(sessionId, headers, clientId),
+    openStream: async (sessionId, headers, resume, signal) => await dialFor().openStream(sessionId, headers, resume, signal)
+  };
+}
 function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const request7 = async (method, path42, headers, body, signal) => await new Promise((resolve, reject) => {
+  const request7 = async (method, path43, headers, body, signal) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method,
-      path: path42,
+      path: path43,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, ...body === void 0 ? {} : { "content-length": String(Buffer.byteLength(body, "utf8")) } },
       agent,
@@ -66906,9 +66939,9 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
       return { status, body: await readAll(response) };
     },
     openStream: async (sessionId, headers, resume, signal) => {
-      const path42 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
+      const path43 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
       const streamHeaders = resume === void 0 ? headers : { ...headers, "last-event-id": String(resume.fromSequenceNum) };
-      const { status, response } = await request7("GET", path42, streamHeaders, void 0, signal);
+      const { status, response } = await request7("GET", path43, streamHeaders, void 0, signal);
       if (!isSuccessful2(status)) {
         await readAll(response);
         return { status, chunks: NO_CHUNKS };
@@ -68031,9 +68064,9 @@ function resolveFriendlyClientOptions(options) {
   };
 }
 function createORPCClient(link, options = {}) {
-  const path42 = options.path ?? [];
+  const path43 = options.path ?? [];
   const procedureClient = async (...[input2, options2 = {}]) => {
-    return await link.call(path42, input2, resolveFriendlyClientOptions(options2));
+    return await link.call(path43, input2, resolveFriendlyClientOptions(options2));
   };
   const recursive2 = new Proxy(procedureClient, {
     get(target, key) {
@@ -68042,7 +68075,7 @@ function createORPCClient(link, options = {}) {
       }
       return createORPCClient(link, {
         ...options,
-        path: [...path42, key]
+        path: [...path43, key]
       });
     }
   });
@@ -68344,19 +68377,19 @@ var StandardLink = class {
   }
   interceptors;
   clientInterceptors;
-  call(path42, input2, options) {
+  call(path43, input2, options) {
     return runWithSpan(
-      { name: `${ORPC_NAME}.${path42.join("/")}`, signal: options.signal },
+      { name: `${ORPC_NAME}.${path43.join("/")}`, signal: options.signal },
       (span) => {
         span?.setAttribute("rpc.system", ORPC_NAME);
-        span?.setAttribute("rpc.method", path42.join("."));
+        span?.setAttribute("rpc.method", path43.join("."));
         if (isAsyncIteratorObject(input2)) {
           input2 = asyncIteratorWithSpan(
             { name: "consume_event_iterator_input", signal: options.signal },
             input2
           );
         }
-        return intercept(this.interceptors, { ...options, path: path42, input: input2 }, async ({ path: path210, input: input22, ...options2 }) => {
+        return intercept(this.interceptors, { ...options, path: path43, input: input2 }, async ({ path: path210, input: input22, ...options2 }) => {
           const otelConfig = getGlobalOtelConfig();
           let otelContext;
           const currentSpan = otelConfig?.trace.getActiveSpan() ?? span;
@@ -68591,8 +68624,8 @@ var StandardRPCJsonSerializer = class {
     return ref.data;
   }
 };
-function toHttpPath(path42) {
-  return `/${path42.map(encodeURIComponent).join("/")}`;
+function toHttpPath(path43) {
+  return `/${path43.map(encodeURIComponent).join("/")}`;
 }
 function toStandardHeaders2(headers) {
   if (typeof headers.forEach === "function") {
@@ -68617,18 +68650,18 @@ var StandardRPCLinkCodec = class {
   fallbackMethod;
   expectedMethod;
   headers;
-  async encode(path42, input2, options) {
-    let headers = toStandardHeaders2(await value(this.headers, options, path42, input2));
+  async encode(path43, input2, options) {
+    let headers = toStandardHeaders2(await value(this.headers, options, path43, input2));
     if (options.lastEventId !== void 0) {
       headers = mergeStandardHeaders(headers, { "last-event-id": options.lastEventId });
     }
-    const expectedMethod = await value(this.expectedMethod, options, path42, input2);
-    const baseUrl = await value(this.baseUrl, options, path42, input2);
+    const expectedMethod = await value(this.expectedMethod, options, path43, input2);
+    const baseUrl = await value(this.baseUrl, options, path43, input2);
     const url2 = new URL(baseUrl);
-    url2.pathname = `${url2.pathname.replace(/\/$/, "")}${toHttpPath(path42)}`;
+    url2.pathname = `${url2.pathname.replace(/\/$/, "")}${toHttpPath(path43)}`;
     const serialized = this.serializer.serialize(input2);
     if (expectedMethod === "GET" && !(serialized instanceof FormData) && !isAsyncIteratorObject(serialized)) {
-      const maxUrlLength = await value(this.maxUrlLength, options, path42, input2);
+      const maxUrlLength = await value(this.maxUrlLength, options, path43, input2);
       const getUrl = new URL(url2);
       getUrl.searchParams.append("data", stringifyJSON(serialized));
       if (getUrl.toString().length <= maxUrlLength) {
@@ -68779,11 +68812,11 @@ var LinkFetchClient = class {
     this.toFetchRequestOptions = options;
     this.adapterInterceptors = toArray(options.adapterInterceptors);
   }
-  async call(standardRequest, options, path42, input2) {
+  async call(standardRequest, options, path43, input2) {
     const request7 = toFetchRequest(standardRequest, this.toFetchRequestOptions);
     const fetchResponse = await intercept(
       this.adapterInterceptors,
-      { ...options, request: request7, path: path42, input: input2, init: { redirect: "manual" } },
+      { ...options, request: request7, path: path43, input: input2, init: { redirect: "manual" } },
       ({ request: request22, path: path210, input: input22, init, ...options2 }) => this.fetch(request22, init, options2, path210, input22)
     );
     const lazyResponse = toStandardLazyResponse(fetchResponse, { signal: request7.signal });
@@ -69183,7 +69216,7 @@ function middlewareOutputFn(output2) {
 function createProcedureClient(lazyableProcedure, ...rest) {
   const options = resolveMaybeOptionalOptions(rest);
   return async (...[input2, callerOptions]) => {
-    const path42 = toArray(options.path);
+    const path43 = toArray(options.path);
     const { default: procedure } = await unlazy(lazyableProcedure);
     const clientContext = callerOptions?.context ?? {};
     const context = await value(options.context ?? {}, clientContext);
@@ -69198,7 +69231,7 @@ function createProcedureClient(lazyableProcedure, ...rest) {
       const output2 = await runWithSpan(
         { name: "call_procedure", signal: callerOptions?.signal },
         (span) => {
-          span?.setAttribute("procedure.path", [...path42]);
+          span?.setAttribute("procedure.path", [...path43]);
           return intercept(
             toArray(options.interceptors),
             {
@@ -69206,7 +69239,7 @@ function createProcedureClient(lazyableProcedure, ...rest) {
               input: input2,
               // input only optional when it undefinable so we can safely cast it
               errors,
-              path: path42,
+              path: path43,
               procedure,
               signal: callerOptions?.signal,
               lastEventId: callerOptions?.lastEventId
@@ -69328,10 +69361,10 @@ var HIDDEN_ROUTER_CONTRACT_SYMBOL = /* @__PURE__ */ Symbol("ORPC_HIDDEN_ROUTER_C
 function getHiddenRouterContract(router) {
   return router[HIDDEN_ROUTER_CONTRACT_SYMBOL];
 }
-function getRouter(router, path42) {
+function getRouter(router, path43) {
   let current = router;
-  for (let i2 = 0; i2 < path42.length; i2++) {
-    const segment = path42[i2];
+  for (let i2 = 0; i2 < path43.length; i2++) {
+    const segment = path43[i2];
     if (!current) {
       return void 0;
     }
@@ -69346,7 +69379,7 @@ function getRouter(router, path42) {
       continue;
     }
     const lazied = current;
-    const rest = path42.slice(i2);
+    const rest = path43.slice(i2);
     return lazy2(async () => {
       const unwrapped = await unlazy(lazied);
       const next = getRouter(unwrapped.default, rest);
@@ -69924,8 +69957,8 @@ function toAbortSignal(stream) {
 function toStandardUrl(req) {
   const protocol = "encrypted" in req.socket && req.socket.encrypted ? "https:" : "http:";
   const origin = guard(() => new URL(`${protocol}//${req.headers.host ?? "localhost"}`).origin) ?? `${protocol}//localhost`;
-  const path42 = req.originalUrl ?? req.url ?? "/";
-  return new URL(`${origin}${path42.startsWith("/") ? "" : "/"}${path42}`);
+  const path43 = req.originalUrl ?? req.url ?? "/";
+  return new URL(`${origin}${path43.startsWith("/") ? "" : "/"}${path43}`);
 }
 function toStandardLazyRequest(req, res) {
   const signal = toAbortSignal(res);
@@ -70124,8 +70157,8 @@ var StandardRPCMatcher = class {
   constructor(options = {}) {
     this.filter = options.filter ?? true;
   }
-  init(router, path42 = []) {
-    const laziedOptions = traverseContractProcedures({ router, path: path42 }, (traverseOptions) => {
+  init(router, path43 = []) {
+    const laziedOptions = traverseContractProcedures({ router, path: path43 }, (traverseOptions) => {
       if (!value(this.filter, traverseOptions)) {
         return;
       }
@@ -71587,8 +71620,8 @@ function createCodexRouteMount(ports, upstreamBase, provider) {
         request7.body.resume();
         return;
       }
-      const path42 = new URL(request7.url, "http://127.0.0.1").pathname;
-      const translated = { method: request7.method, path: path42, body, signal: request7.signal };
+      const path43 = new URL(request7.url, "http://127.0.0.1").pathname;
+      const translated = { method: request7.method, path: path43, body, signal: request7.signal };
       const routed = await route(translated);
       if (request7.signal.aborted) {
         return;
@@ -71622,7 +71655,7 @@ function createPassthroughRoute(name, target) {
     headroomUpstream: target.headroomUpstream,
     serve: async (request7, response) => {
       const incoming = new URL(request7.url, "http://127.0.0.1");
-      const path42 = target.stripPrefix !== void 0 && incoming.pathname.startsWith(target.stripPrefix) ? incoming.pathname.slice(target.stripPrefix.length) : incoming.pathname;
+      const path43 = target.stripPrefix !== void 0 && incoming.pathname.startsWith(target.stripPrefix) ? incoming.pathname.slice(target.stripPrefix.length) : incoming.pathname;
       const headers = forwardableHeaders(request7.headers);
       delete headers.host;
       await new Promise((resolve) => {
@@ -71630,7 +71663,7 @@ function createPassthroughRoute(name, target) {
           host: base.hostname,
           port: base.port === "" ? void 0 : Number(base.port),
           method: request7.method,
-          path: `${basePath}${path42}${incoming.search}`,
+          path: `${basePath}${path43}${incoming.search}`,
           headers,
           agent
         };
@@ -71679,6 +71712,7 @@ function createPassthroughRoute(name, target) {
 
 // src/frontdoor/providerRoute.ts
 function createProviderRouteResolver(deps) {
+  const isRcSelfHostPath = (path43) => path43 === "/v1/code/sessions" || path43.startsWith("/v1/code/sessions/") || path43 === "/v1/sessions" || path43.startsWith("/v1/sessions/");
   const oauthRoute = createPassthroughRoute("anthropic", { baseUrl: `https://${CONNECT_INTERCEPT_HOST}:${String(HTTPS_PORT)}`, stripPrefix: void 0, headroomUpstream: void 0 });
   const passthroughByTarget = /* @__PURE__ */ new Map();
   const passthroughFor = (name, target) => {
@@ -71692,10 +71726,13 @@ function createProviderRouteResolver(deps) {
     return route;
   };
   const resolve = (request7) => {
-    const path42 = new URL(request7.url, "http://127.0.0.1").pathname;
-    const scoped = parseProviderPath(path42);
+    const path43 = new URL(request7.url, "http://127.0.0.1").pathname;
+    const scoped = parseProviderPath(path43);
     if (scoped === void 0) {
-      return path42.startsWith("/v1/") ? { ok: true, route: oauthRoute } : { ok: false, status: HTTP_STATUS.notFound, message: `no such endpoint: ${path42}` };
+      if (deps.rcSelfHostRoute !== void 0 && isRcSelfHostPath(path43)) {
+        return { ok: true, route: deps.rcSelfHostRoute };
+      }
+      return path43.startsWith("/v1/") ? { ok: true, route: oauthRoute } : { ok: false, status: HTTP_STATUS.notFound, message: `no such endpoint: ${path43}` };
     }
     const { provider } = scoped;
     let definition;
@@ -71792,8 +71829,694 @@ function createRcCredentialStore(fs19, dir) {
   };
 }
 
-// src/frontdoor/rcStream.ts
+// src/frontdoor/rcSelfHost.ts
+var RC_SELF_HOST_ENV = "AGENT_SHIM_FRONTDOOR_RC_SELF_HOST";
+function rcSelfHostFromEnv(env) {
+  return env[RC_SELF_HOST_ENV] === "1";
+}
+var RC_SELF_HOST_SCOPE_LIST = ["user:profile", "user:inference", "user:sessions:claude_code", "user:mcp_servers", "user:file_upload"];
+var RC_SESSIONS_PATH_PREFIX2 = "/v1/code/sessions";
+var RC_COMPAT_SESSIONS_PATH = "/v1/sessions";
+var RC_SESSION_ID_PREFIX2 = "cse_";
+var RC_SELF_HOST_API_BASE_URL = "https://api.anthropic.com";
+var RC_SELF_HOST_OAUTH_HOST = "platform.claude.com";
+var HTTP_CONFLICT = 409;
+var MS_PER_SECOND6 = 1e3;
+var HTTP_SERVICE_UNAVAILABLE = 503;
+var RC_SELF_HOST_WORKER_JWT_TTL_SECONDS = 46800;
+var RC_SELF_HOST_OAUTH_TOKEN_TTL_SECONDS = 3600;
+var RC_SELF_HOST_KEEPALIVE_MS = 15e3;
+var RC_SELF_HOST_RETENTION_MS = 6e5;
+var RC_PRESENCE_REFRESH_SECONDS = 60;
+var RC_SELF_HOST_MAX_BATCH_EVENTS = 100;
+var RC_SELF_HOST_WORKER_EPOCH = 1;
 var RC_STREAM_EVENT_NAME = "client_event";
+var RC_SOURCE_WORKER = "worker";
+var RC_SOURCE_CLIENT = "client";
+var CONFLICT_REASON_HEADER2 = "x-ccr-conflict-reason";
+var CONFLICT_REASON_EPOCH_STALE = "epoch_stale";
+function isRecord5(value2) {
+  return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+}
+function nonEmptyString2(record2, field) {
+  const value2 = record2 === void 0 ? void 0 : record2[field];
+  return typeof value2 === "string" && value2 !== "" ? value2 : void 0;
+}
+function numberOf(record2, field) {
+  const value2 = record2 === void 0 ? void 0 : record2[field];
+  if (typeof value2 === "number" && Number.isFinite(value2)) {
+    return value2;
+  }
+  if (typeof value2 === "string" && /^[0-9]+$/.test(value2)) {
+    return Number(value2);
+  }
+  return void 0;
+}
+function singleHeader2(headers, name) {
+  const value2 = headers[name];
+  return typeof value2 === "string" ? value2 : void 0;
+}
+function bearerOf(headers) {
+  const presented = singleHeader2(headers, "authorization");
+  if (presented === void 0) {
+    return void 0;
+  }
+  return presented.slice(0, "bearer ".length).toLowerCase() === "bearer " ? presented.slice("bearer ".length) : void 0;
+}
+async function readBody3(request7, capBytes) {
+  return await new Promise((resolve, reject) => {
+    const chunks = [];
+    let total = 0;
+    request7.on("data", (chunk) => {
+      total += chunk.length;
+      if (total > capBytes) {
+        request7.destroy();
+        reject(new Error("body too large"));
+        return;
+      }
+      chunks.push(chunk);
+    });
+    request7.on("end", () => {
+      resolve(Buffer.concat(chunks).toString("utf8"));
+    });
+    request7.on("error", () => {
+      reject(new Error("the request body ended early"));
+    });
+  });
+}
+function parseJsonObject2(body) {
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return void 0;
+  }
+  return isRecord5(parsed) ? parsed : void 0;
+}
+function mintWorkerJwt(randomToken, issuedAt) {
+  const encode3 = (value2) => Buffer.from(JSON.stringify(value2), "utf8").toString("base64url");
+  const header = encode3({ alg: "HS256", typ: "JWT" });
+  const payload = encode3({ exp: Math.floor((issuedAt + RC_SELF_HOST_WORKER_JWT_TTL_SECONDS * MS_PER_SECOND6) / MS_PER_SECOND6), iat: Math.floor(issuedAt / MS_PER_SECOND6) });
+  return `${header}.${payload}.${Buffer.from(randomToken(), "utf8").toString("base64url")}`;
+}
+function growthBookFeatures() {
+  return {
+    tengu_ccr_bridge: { defaultValue: true },
+    tengu_bridge_repl_v2: { defaultValue: true },
+    tengu_bridge_repl_v2_cse_shim_enabled: { defaultValue: true },
+    tengu_bridge_min_version: { defaultValue: { minVersion: "0.0.0" } }
+  };
+}
+function createRcSelfHostSurface(deps) {
+  const sessions = /* @__PURE__ */ new Map();
+  const sweep = () => {
+    const now = deps.now();
+    for (const session of sessions.values()) {
+      while (session.events[0] !== void 0 && now - session.events[0].storedAt > RC_SELF_HOST_RETENTION_MS) {
+        const dropped = session.events.shift();
+        const uuid3 = dropped === void 0 ? void 0 : nonEmptyString2(dropped.payload, "uuid");
+        if (uuid3 !== void 0) {
+          session.seenPayloadUuids.delete(uuid3);
+        }
+      }
+      if (session.workerStreams.size === 0 && session.clientStreams.size === 0 && now - session.lastTrafficAt > RC_SELF_HOST_RETENTION_MS) {
+        sessions.delete(session.id);
+      }
+    }
+  };
+  const timer = setInterval(sweep, RC_SELF_HOST_RETENTION_MS);
+  timer.unref();
+  const keepalive = setInterval(() => {
+    for (const session of sessions.values()) {
+      for (const sink of [...session.workerStreams, ...session.clientStreams]) {
+        sink.write(": keep-alive\n\n");
+      }
+    }
+  }, RC_SELF_HOST_KEEPALIVE_MS);
+  keepalive.unref();
+  const presentsCredential = (headers) => {
+    const expected = deps.credentialRecord()?.accessToken;
+    const presented = bearerOf(headers);
+    return expected !== void 0 && presented !== void 0 && isLiveCapability(presented, [expected]);
+  };
+  const presentsWorkerJwt = (headers, session) => {
+    const presented = bearerOf(headers);
+    if (presented === void 0) {
+      return false;
+    }
+    for (const minted of session.workerJwts) {
+      if (isLiveCapability(presented, [minted])) {
+        return true;
+      }
+    }
+    return false;
+  };
+  const frameOf = (event) => {
+    const envelope = {
+      event_id: event.eventId,
+      event_type: nonEmptyString2(event.payload, "type") ?? "event",
+      sequence_num: event.sequenceNum,
+      source: event.source,
+      payload: event.payload,
+      created_at: event.createdAt
+    };
+    return `event: ${RC_STREAM_EVENT_NAME}
+id: ${String(event.sequenceNum)}
+data: ${JSON.stringify(envelope)}
+
+`;
+  };
+  const holdStream = async (session, which, wantsReplay, request7, response) => {
+    const url2 = new URL(request7.url, "http://127.0.0.1");
+    const cursor3 = numberOf({ value: url2.searchParams.get("from_sequence_num") }, "value") ?? numberOf({ value: singleHeader2(request7.headers, "last-event-id") }, "value");
+    const replay = cursor3 === void 0 ? [] : session.events.filter((event) => wantsReplay(event) && event.sequenceNum > cursor3);
+    response.start(HTTP_STATUS.ok, { "content-type": "text/event-stream", "cache-control": "no-cache" });
+    response.flush();
+    let pending = Promise.resolve();
+    const sink = {
+      write: (frame) => {
+        pending = pending.then(async () => {
+          await response.write(frame);
+        }).catch(() => {
+        });
+      },
+      retire: () => {
+        session[which].delete(sink);
+      }
+    };
+    session[which].add(sink);
+    session.lastTrafficAt = deps.now();
+    for (const event of replay) {
+      sink.write(frameOf(event));
+    }
+    await new Promise((resolve) => {
+      request7.signal.addEventListener("abort", () => {
+        resolve(void 0);
+      }, { once: true });
+    });
+    sink.retire();
+    response.end();
+  };
+  const publish = (session, source, payload) => {
+    const uuid3 = nonEmptyString2(payload, "uuid");
+    const duplicate = uuid3 !== void 0 && session.seenPayloadUuids.has(uuid3);
+    session.sequenceNum += 1;
+    const event = {
+      sequenceNum: session.sequenceNum,
+      eventId: uuid3 ?? deps.newUuid(),
+      source,
+      // The one enrichment the real service was observed making on the live rig's stream: the wall-clock instant it took the write. The worker's handler ignores it; the door's own parser forwards it verbatim.
+      payload: source === RC_SOURCE_CLIENT ? { ...payload, server_received_wall_ms: deps.now() } : payload,
+      createdAt: new Date(deps.now()).toISOString(),
+      toWorker: source === RC_SOURCE_CLIENT,
+      storedAt: deps.now()
+    };
+    session.events.push(event);
+    if (uuid3 !== void 0) {
+      session.seenPayloadUuids.add(uuid3);
+    }
+    session.lastTrafficAt = event.storedAt;
+    const frame = frameOf(event);
+    if (event.toWorker) {
+      for (const sink of [...session.workerStreams]) {
+        sink.write(frame);
+      }
+    }
+    for (const sink of [...session.clientStreams]) {
+      sink.write(frame);
+    }
+    return { sequenceNum: event.sequenceNum, eventId: event.eventId, duplicate };
+  };
+  const answerJson2 = async (response, status, body, extraHeaders = {}) => {
+    const text2 = JSON.stringify(body);
+    response.start(status, { "content-type": "application/json", "content-length": String(Buffer.byteLength(text2, "utf8")), ...extraHeaders });
+    await response.write(text2);
+    response.end();
+  };
+  const noCredential = async (response) => {
+    await answerJson2(response, HTTP_SERVICE_UNAVAILABLE, { type: "error", error: { type: "api_error", message: "the front door's self-hosted Remote Control surface is on but no credential has been minted for it; run agent-shim frontdoor rc selfhost mint first" } });
+  };
+  const epochStale = async (response) => {
+    await answerJson2(response, HTTP_CONFLICT, { type: "error", error: { type: "api_error", message: "worker_epoch does not match the session's live epoch" } }, { [CONFLICT_REASON_HEADER2]: CONFLICT_REASON_EPOCH_STALE });
+  };
+  const unauthorized = async (response) => {
+    await answerJson2(response, HTTP_STATUS.unauthorized, { type: "error", error: { type: "authentication_error", message: "the self-hosted Remote Control surface did not recognise the presented credential" } });
+  };
+  const serveSessionPath = async (session, tail, request7, response) => {
+    const method = request7.method.toUpperCase();
+    if (session === void 0) {
+      await answerJson2(response, HTTP_STATUS.notFound, { type: "error", error: { type: "api_error", message: "no such Remote Control session on this door" } });
+      return;
+    }
+    session.lastTrafficAt = deps.now();
+    if (tail === "") {
+      if (method !== "GET") {
+        await answerJson2(response, HTTP_STATUS.methodNotAllowed, { type: "error", error: { type: "api_error", message: "the session read is a GET" } });
+        return;
+      }
+      await answerJson2(response, HTTP_STATUS.ok, { session: { id: session.id, title: session.title, created_at: new Date(session.createdAt).toISOString(), status: "active" } });
+      return;
+    }
+    if (tail === "bridge" && method === "POST") {
+      if (!presentsCredential(request7.headers)) {
+        await unauthorized(response);
+        return;
+      }
+      const workerJwt = mintWorkerJwt(deps.randomToken, deps.now());
+      session.workerJwts.add(workerJwt);
+      deps.log?.(`rc selfhost ${session.id}: bridge registration minted a worker credential`);
+      await answerJson2(response, HTTP_STATUS.ok, { worker_jwt: workerJwt, expires_in: RC_SELF_HOST_WORKER_JWT_TTL_SECONDS, api_base_url: RC_SELF_HOST_API_BASE_URL, worker_epoch: RC_SELF_HOST_WORKER_EPOCH });
+      return;
+    }
+    if (tail === "archive" && method === "POST") {
+      if (!presentsCredential(request7.headers)) {
+        await unauthorized(response);
+        return;
+      }
+      for (const sink of [...session.workerStreams, ...session.clientStreams]) {
+        sink.retire();
+      }
+      sessions.delete(session.id);
+      deps.log?.(`rc selfhost ${session.id}: archived at its client's request`);
+      await answerJson2(response, HTTP_STATUS.ok, {});
+      return;
+    }
+    if (tail === "worker" || tail.startsWith("worker/")) {
+      if (!presentsWorkerJwt(request7.headers, session)) {
+        await unauthorized(response);
+        return;
+      }
+      const workerTail = tail === "worker" ? "" : tail.slice("worker/".length);
+      if (workerTail === "" && method === "GET") {
+        await answerJson2(response, HTTP_STATUS.ok, { worker: { external_metadata: session.externalMetadata ?? null } });
+        return;
+      }
+      if (workerTail === "" && method === "PUT") {
+        const body = parseJsonObject2(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
+        const claimedEpoch = numberOf(body, "worker_epoch");
+        if (claimedEpoch !== void 0 && claimedEpoch !== RC_SELF_HOST_WORKER_EPOCH) {
+          await epochStale(response);
+          return;
+        }
+        const status = nonEmptyString2(body, "worker_status");
+        if (status !== void 0) {
+          session.workerStatus = status;
+        }
+        if (isRecord5(body?.external_metadata)) {
+          session.externalMetadata = body.external_metadata;
+        }
+        await answerJson2(response, HTTP_STATUS.ok, {});
+        return;
+      }
+      if (workerTail === "register" && method === "POST") {
+        await readBody3(request7.body, CONTROL_BODY_CAP_BYTES);
+        await answerJson2(response, HTTP_STATUS.ok, { worker_epoch: RC_SELF_HOST_WORKER_EPOCH });
+        return;
+      }
+      if (workerTail === "heartbeat" && method === "POST") {
+        await readBody3(request7.body, CONTROL_BODY_CAP_BYTES);
+        await answerJson2(response, HTTP_STATUS.ok, {});
+        return;
+      }
+      if (workerTail === "events" && method === "POST") {
+        const body = parseJsonObject2(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
+        const claimedEpoch = numberOf(body, "worker_epoch");
+        if (claimedEpoch !== void 0 && claimedEpoch !== RC_SELF_HOST_WORKER_EPOCH) {
+          await epochStale(response);
+          return;
+        }
+        const events = body?.events;
+        if (!Array.isArray(events) || events.length === 0 || events.length > RC_SELF_HOST_MAX_BATCH_EVENTS) {
+          await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: `a worker event batch is a non-empty array of at most ${String(RC_SELF_HOST_MAX_BATCH_EVENTS)} events` } });
+          return;
+        }
+        const results = [];
+        for (const event of events) {
+          if (!isRecord5(event) || !isRecord5(event.payload)) {
+            await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "every event in a batch is an object carrying one payload object" } });
+            return;
+          }
+          const published = publish(session, RC_SOURCE_WORKER, event.payload);
+          results.push({ event_id: published.eventId, sequence_num: String(published.sequenceNum) });
+        }
+        sweep();
+        await answerJson2(response, HTTP_STATUS.ok, { results });
+        return;
+      }
+      if (workerTail === "events/stream" && method === "GET") {
+        await holdStream(session, "workerStreams", (event) => event.toWorker, request7, response);
+        return;
+      }
+      if (workerTail === "events/delivery" && method === "POST") {
+        await readBody3(request7.body, CONTROL_BODY_CAP_BYTES);
+        await answerJson2(response, HTTP_STATUS.ok, {});
+        return;
+      }
+      if (workerTail === "internal-events" && method === "POST") {
+        const body = parseJsonObject2(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
+        const claimedEpoch = numberOf(body, "worker_epoch");
+        if (claimedEpoch !== void 0 && claimedEpoch !== RC_SELF_HOST_WORKER_EPOCH) {
+          await epochStale(response);
+          return;
+        }
+        const events = body?.events;
+        if (!Array.isArray(events)) {
+          await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "an internal event batch is an array" } });
+          return;
+        }
+        for (const event of events) {
+          if (isRecord5(event)) {
+            session.internalEvents.push({ cursor: deps.newUuid(), body: event });
+          }
+        }
+        await answerJson2(response, HTTP_STATUS.ok, {});
+        return;
+      }
+      if (workerTail === "internal-events" && method === "GET") {
+        const url2 = new URL(request7.url, "http://127.0.0.1");
+        const cursor3 = url2.searchParams.get("cursor");
+        const from = cursor3 === null ? 0 : session.internalEvents.findIndex((event) => event.cursor === cursor3) + 1;
+        const page = session.internalEvents.slice(from);
+        await answerJson2(response, HTTP_STATUS.ok, { data: page.map((event) => event.body), next_cursor: page.length === 0 ? void 0 : page[page.length - 1]?.cursor });
+        return;
+      }
+      if (workerTail === "diagnostics" && method === "POST") {
+        await readBody3(request7.body, CONTROL_BODY_CAP_BYTES);
+        await answerJson2(response, HTTP_STATUS.ok, {});
+        return;
+      }
+      await answerJson2(response, HTTP_STATUS.notFound, { type: "error", error: { type: "api_error", message: `the self-hosted Remote Control surface serves no worker path "${workerTail}"` } });
+      return;
+    }
+    if (!presentsCredential(request7.headers)) {
+      await unauthorized(response);
+      return;
+    }
+    if (tail === "events" && method === "POST") {
+      const body = parseJsonObject2(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
+      const events = body?.events;
+      if (!Array.isArray(events) || events.length === 0 || events.length > RC_SELF_HOST_MAX_BATCH_EVENTS) {
+        await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: `a client event write is a non-empty array of at most ${String(RC_SELF_HOST_MAX_BATCH_EVENTS)} events` } });
+        return;
+      }
+      const results = [];
+      for (const event of events) {
+        if (!isRecord5(event) || !isRecord5(event.payload)) {
+          await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "every event in a write is an object carrying one payload object" } });
+          return;
+        }
+        const published = publish(session, RC_SOURCE_CLIENT, event.payload);
+        results.push({ sequence_num: String(published.sequenceNum), duplicate: published.duplicate });
+      }
+      sweep();
+      await answerJson2(response, HTTP_STATUS.ok, { results });
+      return;
+    }
+    if (tail === "events" && method === "GET") {
+      await answerJson2(response, HTTP_STATUS.ok, { data: session.events.map((event) => ({ event_id: event.eventId, event_type: nonEmptyString2(event.payload, "type") ?? "event", sequence_num: event.sequenceNum, source: event.source, payload: event.payload, created_at: event.createdAt })) });
+      return;
+    }
+    if (tail === "events/stream" && method === "GET") {
+      await holdStream(session, "clientStreams", () => true, request7, response);
+      return;
+    }
+    if (tail === "client/presence" && method === "POST") {
+      await readBody3(request7.body, CONTROL_BODY_CAP_BYTES);
+      await answerJson2(response, HTTP_STATUS.ok, { refresh_after_seconds: RC_PRESENCE_REFRESH_SECONDS });
+      return;
+    }
+    if (tail === "mark_read" && method === "POST") {
+      await readBody3(request7.body, CONTROL_BODY_CAP_BYTES);
+      await answerJson2(response, HTTP_STATUS.ok, {});
+      return;
+    }
+    if (tail === "teleport-events" && method === "POST") {
+      await readBody3(request7.body, CONTROL_BODY_CAP_BYTES);
+      await answerJson2(response, HTTP_STATUS.ok, {});
+      return;
+    }
+    await answerJson2(response, HTTP_STATUS.notFound, { type: "error", error: { type: "api_error", message: `the self-hosted Remote Control surface serves no path "${tail}"` } });
+  };
+  const recordMissing = () => deps.credentialRecord() === void 0;
+  const route = {
+    name: "rc-selfhost",
+    headroomEligible: false,
+    headroomUpstream: void 0,
+    serve: async (request7, response) => {
+      const method = request7.method.toUpperCase();
+      const pathname = new URL(request7.url, "http://127.0.0.1").pathname;
+      if (recordMissing()) {
+        await noCredential(response);
+        return;
+      }
+      if (pathname === RC_COMPAT_SESSIONS_PATH) {
+        if (method !== "GET") {
+          await answerJson2(response, HTTP_STATUS.methodNotAllowed, { type: "error", error: { type: "api_error", message: "the compatibility session list is a GET" } });
+          return;
+        }
+        if (!presentsCredential(request7.headers)) {
+          await unauthorized(response);
+          return;
+        }
+        await answerJson2(response, HTTP_STATUS.ok, { data: [] });
+        return;
+      }
+      if (pathname !== RC_SESSIONS_PATH_PREFIX2 && !pathname.startsWith(`${RC_SESSIONS_PATH_PREFIX2}/`)) {
+        await answerJson2(response, HTTP_STATUS.notFound, { type: "error", error: { type: "api_error", message: `the self-hosted Remote Control surface serves no path "${pathname}"` } });
+        return;
+      }
+      if (pathname === RC_SESSIONS_PATH_PREFIX2) {
+        if (method === "POST") {
+          if (!presentsCredential(request7.headers)) {
+            await unauthorized(response);
+            return;
+          }
+          const body = parseJsonObject2(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
+          const session = {
+            id: `${RC_SESSION_ID_PREFIX2}${deps.newUuid()}`,
+            createdAt: deps.now(),
+            title: nonEmptyString2(body, "title"),
+            workerJwts: /* @__PURE__ */ new Set(),
+            sequenceNum: 0,
+            events: [],
+            seenPayloadUuids: /* @__PURE__ */ new Set(),
+            workerStreams: /* @__PURE__ */ new Set(),
+            clientStreams: /* @__PURE__ */ new Set(),
+            internalEvents: [],
+            workerStatus: void 0,
+            externalMetadata: void 0,
+            lastTrafficAt: deps.now()
+          };
+          sessions.set(session.id, session);
+          deps.log?.(`rc selfhost ${session.id}: session created on the door's own surface`);
+          await answerJson2(response, HTTP_STATUS.ok, { session: { id: session.id, title: session.title, created_at: new Date(session.createdAt).toISOString(), status: "active" } });
+          return;
+        }
+        if (method === "GET") {
+          if (!presentsCredential(request7.headers)) {
+            await unauthorized(response);
+            return;
+          }
+          await answerJson2(response, HTTP_STATUS.ok, { data: [...sessions.values()].map((session) => ({ id: session.id, title: session.title, created_at: new Date(session.createdAt).toISOString(), updated_at: new Date(session.lastTrafficAt).toISOString(), session_status: "active" })) });
+          return;
+        }
+        await answerJson2(response, HTTP_STATUS.methodNotAllowed, { type: "error", error: { type: "api_error", message: "the session collection is a POST (create) and a GET (list)" } });
+        return;
+      }
+      const rest = pathname.slice(`${RC_SESSIONS_PATH_PREFIX2}/`.length);
+      const slash = rest.indexOf("/");
+      const id = slash === -1 ? rest : rest.slice(0, slash);
+      const tail = slash === -1 ? "" : rest.slice(slash + 1);
+      if (!id.startsWith(RC_SESSION_ID_PREFIX2)) {
+        await answerJson2(response, HTTP_STATUS.notFound, { type: "error", error: { type: "api_error", message: "the session family names one cse_-prefixed session id" } });
+        return;
+      }
+      await serveSessionPath(sessions.get(id), tail, request7, response);
+    }
+  };
+  const answerServerJson = (response, status, body) => {
+    const text2 = JSON.stringify(body);
+    response.writeHead(status, { "content-type": "application/json", "content-length": String(Buffer.byteLength(text2, "utf8")) });
+    response.end(text2);
+  };
+  const local = {
+    parsesHost: (host) => host === RC_SELF_HOST_OAUTH_HOST,
+    serve: async (host, request7, response) => {
+      const method = (request7.method ?? "").toUpperCase();
+      const pathname = new URL(request7.url ?? "/", "http://127.0.0.1").pathname;
+      if (host === RC_SELF_HOST_OAUTH_HOST) {
+        if (method === "POST" && pathname === "/v1/oauth/token") {
+          const body = parseJsonObject2(await readBody3(request7, CONTROL_BODY_CAP_BYTES));
+          const record2 = deps.credentialRecord();
+          if (record2 === void 0) {
+            answerServerJson(response, HTTP_SERVICE_UNAVAILABLE, { error: "the front door's self-hosted Remote Control surface is on but no credential has been minted for it" });
+            return true;
+          }
+          if (body?.grant_type !== void 0 && body.grant_type !== "refresh_token") {
+            answerServerJson(response, HTTP_STATUS.badRequest, { error: "unsupported_grant_type" });
+            return true;
+          }
+          answerServerJson(response, HTTP_STATUS.ok, { access_token: record2.accessToken, refresh_token: record2.refreshToken, expires_in: RC_SELF_HOST_OAUTH_TOKEN_TTL_SECONDS, scope: RC_SELF_HOST_SCOPE_LIST.join(" ") });
+          return true;
+        }
+        if (method === "GET" && pathname === "/v1/oauth/hello") {
+          answerServerJson(response, HTTP_STATUS.ok, {});
+          return true;
+        }
+        return false;
+      }
+      if (method === "POST" && pathname.startsWith("/api/eval/")) {
+        await readBody3(request7, CONTROL_BODY_CAP_BYTES);
+        answerServerJson(response, HTTP_STATUS.ok, { features: growthBookFeatures(), dateUpdated: Math.floor(deps.now() / MS_PER_SECOND6) });
+        return true;
+      }
+      if (method === "GET" && pathname === "/api/oauth/profile") {
+        const record2 = deps.credentialRecord();
+        if (record2 === void 0) {
+          answerServerJson(response, HTTP_SERVICE_UNAVAILABLE, { error: "the front door's self-hosted Remote Control surface is on but no credential has been minted for it" });
+          return true;
+        }
+        answerServerJson(response, HTTP_STATUS.ok, {
+          account: { uuid: record2.accountUuid, display_name: "agent-shim self-hosted", created_at: (/* @__PURE__ */ new Date(0)).toISOString() },
+          organization: { uuid: record2.organizationUuid, organization_type: "claude_max" }
+        });
+        return true;
+      }
+      if (method === "GET" && pathname === "/api/claude_code/policy_limits") {
+        answerServerJson(response, HTTP_STATUS.ok, {});
+        return true;
+      }
+      if (method === "POST" && pathname === "/api/oauth/validate") {
+        await readBody3(request7, CONTROL_BODY_CAP_BYTES);
+        const record2 = deps.credentialRecord();
+        if (record2 === void 0) {
+          answerServerJson(response, HTTP_SERVICE_UNAVAILABLE, { error: "the front door's self-hosted Remote Control surface is on but no credential has been minted for it" });
+          return true;
+        }
+        answerServerJson(response, HTTP_STATUS.ok, { scopes: [...RC_SELF_HOST_SCOPE_LIST], expiresAt: null, subscriptionType: "max", account_uuid: record2.accountUuid, organization_uuid: record2.organizationUuid });
+        return true;
+      }
+      if (method === "POST" && (pathname === "/api/event_logging/v2/batch" || pathname === "/api/claude_code/metrics" || pathname === "/api/claude_cli_feedback")) {
+        await readBody3(request7, CONTROL_BODY_CAP_BYTES);
+        answerServerJson(response, HTTP_STATUS.ok, {});
+        return true;
+      }
+      if (method === "GET" && pathname === "/api/hello") {
+        answerServerJson(response, HTTP_STATUS.ok, {});
+        return true;
+      }
+      return false;
+    }
+  };
+  return {
+    route,
+    local,
+    close: () => {
+      clearInterval(timer);
+      clearInterval(keepalive);
+      for (const session of sessions.values()) {
+        for (const sink of [...session.workerStreams, ...session.clientStreams]) {
+          sink.retire();
+        }
+      }
+      sessions.clear();
+    }
+  };
+}
+
+// src/frontdoor/rcSelfHostMint.ts
+var import_node_path33 = __toESM(require("node:path"), 1);
+var CREDENTIALS_FILE = ".credentials.json";
+var CLAUDE_JSON2 = ".claude.json";
+var RC_SELF_HOST_RECORD_DIR = "rc-selfhost";
+var RC_SELF_HOST_RECORD_FILE = "credential.json";
+var SELF_HOST_EMAIL = "selfhost@agent-shim.invalid";
+var SELF_HOST_SUBSCRIPTION_TYPE = "max";
+function isRecord6(value2) {
+  return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+}
+function readJsonObject(fs19, file2) {
+  const raw = fs19.readFileUtf8(file2);
+  if (raw === void 0) {
+    return void 0;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return void 0;
+  }
+  return isRecord6(parsed) ? parsed : void 0;
+}
+function readRcSelfHostRecord(fs19, frontdoorDir) {
+  const parsed = readJsonObject(fs19, import_node_path33.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
+  if (parsed === void 0) {
+    return void 0;
+  }
+  const { accessToken, refreshToken, organizationUuid, accountUuid } = parsed;
+  if (typeof accessToken !== "string" || accessToken === "" || typeof refreshToken !== "string" || refreshToken === "" || typeof organizationUuid !== "string" || organizationUuid === "" || typeof accountUuid !== "string" || accountUuid === "") {
+    return void 0;
+  }
+  return { accessToken, refreshToken, organizationUuid, accountUuid };
+}
+function mintRcSelfHostCredential(deps) {
+  if (!isIdentityName(deps.identity)) {
+    throw new Error(`"${deps.identity}" is not a valid identity name.`);
+  }
+  const identityDir = import_node_path33.default.join(deps.identitiesDir, deps.identity);
+  const credentialsFile = import_node_path33.default.join(identityDir, CREDENTIALS_FILE);
+  const claudeJsonFile = import_node_path33.default.join(identityDir, CLAUDE_JSON2);
+  const recordDir = import_node_path33.default.join(deps.frontdoorDir, RC_SELF_HOST_RECORD_DIR);
+  const recordFile = import_node_path33.default.join(recordDir, RC_SELF_HOST_RECORD_FILE);
+  const previousRecord = readRcSelfHostRecord(deps.fs, deps.frontdoorDir);
+  const existingCredentials = readJsonObject(deps.fs, credentialsFile);
+  const existingOauth = isRecord6(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
+  const existingToken = typeof existingOauth?.accessToken === "string" && existingOauth.accessToken !== "" ? existingOauth.accessToken : void 0;
+  const existingIsOwn = existingToken !== void 0 && previousRecord?.accessToken === existingToken;
+  if (existingToken !== void 0 && !existingIsOwn && !deps.force) {
+    throw new Error(
+      `identity ${deps.identity} already holds an OAuth credential this door did not mint (a real claude.ai login): pass --force to replace it, or mint into an identity with no login. The self-hosted mode expects no Anthropic credential to be in play.`
+    );
+  }
+  const accessToken = `sk-ant-oat${deps.randomToken()}`;
+  const refreshToken = deps.randomToken();
+  const organizationUuid = deps.newUuid();
+  const accountUuid = deps.newUuid();
+  const mintedAt = new Date(deps.now()).toISOString();
+  deps.fs.mkdirPrivate(import_node_path33.default.dirname(credentialsFile));
+  deps.fs.writeFilePrivate(credentialsFile, `${JSON.stringify({ ...existingCredentials, claudeAiOauth: { accessToken, refreshToken, expiresAt: null, scopes: [...RC_SELF_HOST_SCOPE_LIST], subscriptionType: SELF_HOST_SUBSCRIPTION_TYPE, rateLimitTier: null } }, null, 2)}
+`);
+  const claudeJson = readJsonObject(deps.fs, claudeJsonFile) ?? {};
+  const existingBlock = (value2) => isRecord6(value2) ? value2 : {};
+  deps.fs.writeFilePrivate(claudeJsonFile, `${JSON.stringify({
+    ...claudeJson,
+    oauthAccount: {
+      ...existingBlock(claudeJson.oauthAccount),
+      accountUuid,
+      emailAddress: SELF_HOST_EMAIL,
+      organizationUuid,
+      organizationName: "agent-shim self-hosted",
+      // The billing and creation fields exist so the CLI's "populate the account block if it is missing" step finds a complete block and skips its profile fetch; the door answers that fetch locally anyway, so these are the quiet path, not a load-bearing claim.
+      billingType: "stripe_subscription",
+      accountCreatedAt: mintedAt,
+      subscriptionCreatedAt: mintedAt
+    },
+    cachedGrowthBookFeatures: {
+      ...existingBlock(claudeJson.cachedGrowthBookFeatures),
+      tengu_ccr_bridge: true,
+      tengu_bridge_repl_v2: true,
+      tengu_bridge_repl_v2_cse_shim_enabled: true
+    }
+  }, null, 2)}
+`);
+  deps.fs.mkdirPrivate(recordDir);
+  deps.fs.writeFilePrivate(recordFile, `${JSON.stringify({ accessToken, refreshToken, organizationUuid, accountUuid }, null, 2)}
+`);
+  return { identity: deps.identity, organizationUuid, credentialsFile, claudeJsonFile, recordFile, replaced: existingIsOwn };
+}
+
+// src/frontdoor/rcStream.ts
+var RC_STREAM_EVENT_NAME2 = "client_event";
 var SSE_BYTE_ORDER_MARK = 65279;
 var RC_STREAM_BACKOFF_MS = 45e3;
 var SUCCESS_STATUS_MAX_EXCLUSIVE3 = 300;
@@ -71854,7 +72577,7 @@ function createSseParser() {
     }
   };
 }
-function isRecord5(value2) {
+function isRecord7(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 }
 function sequenceNumOf(value2) {
@@ -71867,7 +72590,7 @@ function sequenceNumOf(value2) {
   return void 0;
 }
 function parseRcStreamEnvelope(parsed) {
-  if (parsed.event !== RC_STREAM_EVENT_NAME) {
+  if (parsed.event !== RC_STREAM_EVENT_NAME2) {
     return void 0;
   }
   let data;
@@ -71876,7 +72599,7 @@ function parseRcStreamEnvelope(parsed) {
   } catch {
     return void 0;
   }
-  if (!isRecord5(data)) {
+  if (!isRecord7(data)) {
     return void 0;
   }
   const eventType = data.event_type;
@@ -72063,7 +72786,7 @@ var ProviderQuotaError = class extends Error {
     this.name = "ProviderQuotaError";
   }
 };
-var MS_PER_SECOND6 = 1e3;
+var MS_PER_SECOND7 = 1e3;
 var SECONDS_PER_HOUR = 3600;
 var HOURS_PER_DAY3 = 24;
 var DAYS_PER_MONTH = 30;
@@ -72075,8 +72798,8 @@ var ZAI_QUOTA_URL = `https://${ZAI_HOST}/api/monitor/usage/quota/limit`;
 var ZAI_UNIT_HOURS = 3;
 var ZAI_UNIT_MONTHS = 5;
 var ZAI_UNIT_MS = /* @__PURE__ */ new Map([
-  [ZAI_UNIT_HOURS, SECONDS_PER_HOUR * MS_PER_SECOND6],
-  [ZAI_UNIT_MONTHS, DAYS_PER_MONTH * HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND6]
+  [ZAI_UNIT_HOURS, SECONDS_PER_HOUR * MS_PER_SECOND7],
+  [ZAI_UNIT_MONTHS, DAYS_PER_MONTH * HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND7]
 ]);
 var ZAI_MEASURES = { TOKENS_LIMIT: "tokens", TIME_LIMIT: "tool-calls" };
 var ZaiLimitSchema = external_exports.object({
@@ -72140,7 +72863,7 @@ var OPENROUTER_HOST = "openrouter.ai";
 var OPENROUTER_KEY_URL = `https://${OPENROUTER_HOST}/api/v1/key`;
 var OPENROUTER_CREDITS_URL = `https://${OPENROUTER_HOST}/api/v1/credits`;
 var HTTP_FORBIDDEN = 403;
-var MS_PER_DAY2 = HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND6;
+var MS_PER_DAY2 = HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND7;
 var OpenRouterKeySchema = external_exports.object({
   data: external_exports.object({
     limit: external_exports.number().nonnegative().nullable(),
@@ -72343,6 +73066,7 @@ function appendLog(paths, line) {
   import_node_fs12.default.appendFileSync(paths.frontdoorLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
 `);
 }
+var MINTED_TOKEN_RANDOM_BYTES = 32;
 function headroomSocketTarget(fsPort, trust, paths) {
   const socketPath = readHeadroomState(fsPort, paths.headroomStateFile)?.socketPath;
   return socketPath === void 0 ? void 0 : verifyHeadroomSocket(socketPath, trust);
@@ -72360,7 +73084,29 @@ function realFrontDoorSupervisorPorts(paths) {
     appendLog(paths, `frontdoor ${String(process.pid)}: ${line}`);
   };
   let directPort = 0;
+  const rcSelfHost = rcSelfHostFromEnv(process.env);
   const codexPorts = createCodexRoutePorts(log);
+  let ca;
+  const loadCa = () => {
+    ca ??= ensureCa(realConnectCertStore(paths), () => generateCa(/* @__PURE__ */ new Date()));
+    return ca;
+  };
+  let transparentPort;
+  let selfHostDialTarget;
+  const rcSelfHostDialTarget = () => {
+    if (!rcSelfHost || transparentPort === void 0) {
+      return void 0;
+    }
+    selfHostDialTarget ??= { host: "127.0.0.1", port: transparentPort, servername: CONNECT_INTERCEPT_HOST, ca: [loadCa().certPem] };
+    return selfHostDialTarget;
+  };
+  const rcSelfHostSurface = rcSelfHost ? createRcSelfHostSurface({
+    now: () => Date.now(),
+    newUuid: import_node_crypto12.randomUUID,
+    randomToken: () => (0, import_node_crypto12.randomBytes)(MINTED_TOKEN_RANDOM_BYTES).toString("base64url"),
+    credentialRecord: () => readRcSelfHostRecord(realFarmFs, paths.frontdoorDir),
+    log
+  }) : void 0;
   const rcTracker = createRcSessionTracker({ now: () => Date.now(), idleMs: RC_IDLE_EXPIRY_MS, credentialStore: createRcCredentialStore(realFarmFs, paths.frontdoorRcCredentialsDir) });
   const rcFanout = createRcEventFanout();
   const rcHub = createRcStreamHub({
@@ -72369,7 +73115,7 @@ function realFrontDoorSupervisorPorts(paths) {
     trackedSessions: () => rcTracker.list().map((session) => session.id),
     fileStreamEvent: rcTracker.fileStreamEvent,
     sequenceNumOf: rcTracker.sequenceNumOf,
-    dial: realRcStreamDial(),
+    dial: rcSelfHost ? lateRcStreamDial(rcSelfHostDialTarget) : realRcStreamDial(),
     fanout: rcFanout,
     newClientId: import_node_crypto12.randomUUID,
     backoffMs: RC_STREAM_BACKOFF_MS,
@@ -72383,7 +73129,11 @@ function realFrontDoorSupervisorPorts(paths) {
     }
   });
   const rcControlToken = (0, import_node_crypto12.randomUUID)();
-  const resolveRoute = rcObservingResolver(createProviderRouteResolver({ fs: realFsPort, providersDir: paths.providersDir, codexPorts, directPort: () => directPort }), rcTracker, rcHub);
+  const resolveRoute = rcObservingResolver(
+    createProviderRouteResolver({ fs: realFsPort, providersDir: paths.providersDir, codexPorts, directPort: () => directPort, ...rcSelfHostSurface === void 0 ? {} : { rcSelfHostRoute: rcSelfHostSurface.route } }),
+    rcTracker,
+    rcHub
+  );
   const isLiveToken = (token) => isLiveCapability(token, liveSessionTokens(realFarmFs, paths.frontdoorSessionsDir));
   const usageStore = createUsageStore({
     fs: realFarmFs,
@@ -72413,11 +73163,6 @@ function realFrontDoorSupervisorPorts(paths) {
     custody: createCredentialCustody(() => (0, import_node_crypto12.randomUUID)()),
     log
   });
-  let ca;
-  const loadCa = () => {
-    ca ??= ensureCa(realConnectCertStore(paths), () => generateCa(/* @__PURE__ */ new Date()));
-    return ca;
-  };
   const onListenerError = (name) => (error62) => {
     appendLog(paths, `frontdoor ${String(process.pid)}: ${name} listener failed: ${error62.message}; exiting`);
     process.exit(1);
@@ -72435,7 +73180,7 @@ function realFrontDoorSupervisorPorts(paths) {
     isRunning: realIsProcessRunning,
     startProviderListener: async (preferredPort) => {
       const authority = loadCa();
-      const rcDial = realRcEventDial();
+      const rcDial = rcSelfHost ? lateRcEventDial(rcSelfHostDialTarget) : realRcEventDial();
       const rcInject = async (sessionId, text2) => await injectRcUserMessage({ credentialOf: rcTracker.credentialOf, noteSequenceNums: rcTracker.noteSequenceNums, dial: rcDial, newUuid: import_node_crypto12.randomUUID }, sessionId, text2);
       const rcAnswer = async (sessionId, requestId, decision) => await answerRcControlRequest({ credentialOf: rcTracker.credentialOf, pendingOf: (id) => rcTracker.pendingOf(id), completePending: rcTracker.completePending, noteSequenceNums: rcTracker.noteSequenceNums, dial: rcDial }, sessionId, requestId, decision);
       const rcControlRequestDeps = { credentialOf: rcTracker.credentialOf, noteSequenceNums: rcTracker.noteSequenceNums, dial: rcDial, newUuid: import_node_crypto12.randomUUID };
@@ -72464,21 +73209,28 @@ function realFrontDoorSupervisorPorts(paths) {
       };
     },
     startConnectListener: async (preferredPort) => {
-      const transparentPort = process.env.AGENT_SHIM_TRANSPARENT_SURFACE === void 0 ? void 0 : Number(process.env.AGENT_SHIM_TRANSPARENT_SURFACE);
-      const transparentCapability = transparentPort === void 0 || Number.isNaN(transparentPort) ? void 0 : (0, import_node_crypto12.randomUUID)();
+      const wantedTransparentPort = process.env.AGENT_SHIM_TRANSPARENT_SURFACE === void 0 ? void 0 : Number(process.env.AGENT_SHIM_TRANSPARENT_SURFACE);
+      const transparentCapability = wantedTransparentPort === void 0 || Number.isNaN(wantedTransparentPort) ? void 0 : (0, import_node_crypto12.randomUUID)();
       if (transparentCapability !== void 0) {
         writeFrontDoorSession(realFarmFs, paths.frontdoorSessionsDir, { pid: process.pid, startedAt: Date.now(), token: transparentCapability });
       }
       const leafFor = createLeafCache(loadCa(), () => /* @__PURE__ */ new Date());
       const capture = captureFromEnv(process.env, paths.logsDir);
       if (capture !== void 0) {
-        log(`capture enabled, recording CONNECT targets and piped exchanges to ${import_node_path33.default.join(paths.logsDir, "frontdoor-capture.jsonl")}`);
+        log(`capture enabled, recording CONNECT targets and piped exchanges to ${import_node_path34.default.join(paths.logsDir, "frontdoor-capture.jsonl")}`);
+      }
+      if (rcSelfHostSurface !== void 0) {
+        log("self-hosted Remote Control surface on: the door serves the CCR session family itself, and its own client-half dials its own transparent surface");
+        if (wantedTransparentPort === void 0 || Number.isNaN(wantedTransparentPort)) {
+          log("self-hosted Remote Control surface: AGENT_SHIM_TRANSPARENT_SURFACE is not set, so nothing redirects the CLI's Remote Control traffic to this door and the door's own client half has no surface to dial; set it to the interception port the mode is deployed with");
+        }
       }
       const server = await startConnectServer(
         {
           interceptHosts: CONNECT_INTERCEPT_HOSTS,
           tapHosts: CONNECT_TAP_HOSTS,
           routedHost: CONNECT_INTERCEPT_HOST,
+          ...rcSelfHostSurface === void 0 ? {} : { localSurface: rcSelfHostSurface.local },
           serveRouted: (request7, response) => {
             const abort = new AbortController();
             response.on("close", () => {
@@ -72501,14 +73253,21 @@ function realFrontDoorSupervisorPorts(paths) {
           leafFor,
           upstreamFor: (host) => ({ host, port: HTTPS_PORT, tls: true }),
           isLiveCapability: isLiveToken,
-          ...transparentPort === void 0 || Number.isNaN(transparentPort) ? {} : { transparentPort, ...transparentCapability === void 0 ? {} : { transparentCapability } },
+          ...wantedTransparentPort === void 0 || Number.isNaN(wantedTransparentPort) ? {} : { transparentPort: wantedTransparentPort, ...transparentCapability === void 0 ? {} : { transparentCapability } },
           limits: CONNECT_LIMITS,
           ...capture === void 0 ? {} : { capture }
         },
         realConnectEffects(),
         preferredPort
       );
-      return { port: server.port, close: server.close };
+      transparentPort = server.transparentPort;
+      return {
+        port: server.port,
+        close: async () => {
+          rcSelfHostSurface?.close();
+          await server.close();
+        }
+      };
     },
     startDirectListener: async (preferredPort) => {
       const server = createFrontDoorServer(async (request7) => {
@@ -72618,6 +73377,15 @@ function formatRcStreamEvent(event) {
   const sketch = envelope.payload === void 0 ? "" : `  ${eventExcerpt(JSON.stringify(envelope.payload))}`;
   return `${event.session}  ${envelope.event_type}  sequence_num ${String(envelope.sequence_num)}  source ${envelope.source}${sketch}`;
 }
+function formatRcSelfHostMint(result) {
+  return [
+    `identity:       ${result.identity} (organisation ${result.organizationUuid})`,
+    `credential:     ${result.credentialsFile}${result.replaced ? " (replacing this door's previous mint)" : ""}`,
+    `account block:  ${result.claudeJsonFile} (oauthAccount and the feature-cache seed merged in)`,
+    `door record:    ${result.recordFile} (the copy the door's served surface authenticates against)`,
+    "next:           start the door with AGENT_SHIM_FRONTDOOR_RC_SELF_HOST=1 and its transparent surface pointed at the interception port, then launch this identity and switch Remote Control on; no claude.ai login is involved"
+  ];
+}
 function frontDoorRcControlFromState(fsPort, paths) {
   const state = readFrontDoorState(fsPort, paths.frontdoorStateFile);
   if (state?.port === void 0) {
@@ -72820,6 +73588,32 @@ function registerFrontDoorCommand(program2, deps) {
     }),
     ["agent-shim frontdoor rc watch", "agent-shim frontdoor rc watch cse_00000000-0000-4000-8000-000000000000 --json"]
   );
+  const selfhost = withExamples(
+    rc.command("selfhost").description("Mint the local credential behind the door's self-hosted Remote Control surface: the opt-in mode (AGENT_SHIM_FRONTDOOR_RC_SELF_HOST=1 in the door's environment) where the door serves the CCR surface itself and a session activates Remote Control with no Anthropic credential anywhere."),
+    ["agent-shim frontdoor rc selfhost mint rig"]
+  );
+  withExamples(
+    selfhost.command("mint").description("Mint the local OAuth credential, account block and feature-cache seed one identity needs to activate Remote Control against the door's own served surface, and record the door-side copy the surface authenticates against. Refuses to replace a real claude.ai login unless --force. Never prints a token.").argument("<identity>", "The identity to mint into, as `agent-shim identity list` names it.").option("--force", "Replace an existing OAuth credential this door did not mint.").option("--json", "Print the mint result as JSON.").action((identity, options) => {
+      const result = mintRcSelfHostCredential({
+        fs: realFarmFs,
+        identitiesDir: paths.identitiesDir,
+        frontdoorDir: paths.frontdoorDir,
+        identity,
+        newUuid: import_node_crypto12.randomUUID,
+        randomToken: () => (0, import_node_crypto12.randomBytes)(MINTED_TOKEN_RANDOM_BYTES).toString("base64url"),
+        force: options.force === true,
+        now: () => Date.now()
+      });
+      if (options.json === true) {
+        printJson(result);
+        return;
+      }
+      for (const line of formatRcSelfHostMint(result)) {
+        console.log(line);
+      }
+    }),
+    ["agent-shim frontdoor rc selfhost mint rig", "agent-shim frontdoor rc selfhost mint rig --force"]
+  );
   program2.command("__frontdoor-supervisor", { hidden: true }).description("Internal: serve the front-door routing listeners. Started by the launcher; never run by hand.").allowUnknownOption().action(async () => {
     const idleShutdownMinutes = readGlobalConfig(paths)?.frontdoor?.idleShutdownMinutes ?? FRONTDOOR_DEFAULT_IDLE_SHUTDOWN_MINUTES;
     process.on("SIGTERM", () => {
@@ -73124,15 +73918,15 @@ var import_node_child_process4 = require("node:child_process");
 
 // src/identityToken.ts
 var import_node_fs13 = __toESM(require("node:fs"), 1);
-var import_node_path34 = __toESM(require("node:path"), 1);
+var import_node_path35 = __toESM(require("node:path"), 1);
 var TOKEN_FILE_MODE = 384;
 var TOKEN_DIR_MODE = 448;
 var OAUTH_TOKEN_RE = /^sk-ant-oat\d+-[A-Za-z0-9_-]+$/;
 function identityTokenDir(paths) {
-  return import_node_path34.default.join(paths.root, "credentials");
+  return import_node_path35.default.join(paths.root, "credentials");
 }
 function identityTokenPath(paths, identityName) {
-  return import_node_path34.default.join(identityTokenDir(paths), `${identityName}.token`);
+  return import_node_path35.default.join(identityTokenDir(paths), `${identityName}.token`);
 }
 function storeIdentityToken(paths, identityName, raw) {
   const token = raw.trim();
@@ -73143,7 +73937,7 @@ function storeIdentityToken(paths, identityName, raw) {
   import_node_fs13.default.mkdirSync(dir, { recursive: true, mode: TOKEN_DIR_MODE });
   import_node_fs13.default.chmodSync(dir, TOKEN_DIR_MODE);
   const target = identityTokenPath(paths, identityName);
-  const temp = import_node_path34.default.join(dir, `.${identityName}.${String(process.pid)}.tmp`);
+  const temp = import_node_path35.default.join(dir, `.${identityName}.${String(process.pid)}.tmp`);
   import_node_fs13.default.writeFileSync(temp, `${token}
 `, { mode: TOKEN_FILE_MODE });
   import_node_fs13.default.renameSync(temp, target);
@@ -73282,7 +74076,7 @@ function subjectName(positional, provider) {
 
 // src/doctorReport.ts
 var import_node_fs14 = __toESM(require("node:fs"), 1);
-var import_node_path35 = __toESM(require("node:path"), 1);
+var import_node_path36 = __toESM(require("node:path"), 1);
 function refinePathShadow(status, ownExecutablePath, realpath) {
   if (status.status !== "shadowed") {
     return status;
@@ -73306,7 +74100,7 @@ function validateJson(schema, input2) {
   return { ok: true, data: result.data };
 }
 function pushPathResolution(push, resolution) {
-  const ownDir = import_node_path35.default.dirname(resolution.ownExecutablePath);
+  const ownDir = import_node_path36.default.dirname(resolution.ownExecutablePath);
   switch (resolution.agentShim.status) {
     case "ok":
       push("path-resolution", "pass", `\`agent-shim\` on PATH resolves to this running executable, ${resolution.ownExecutablePath}.`, "agent-shim");
@@ -73379,17 +74173,20 @@ function pushProvider(push, entry, cacheEnv) {
   }
   const cache = cacheClause(cacheEnv, `provider ${entry.name}`, validated2.data.credential);
   push("provider", cache.unreadable ? "fail" : "pass", `${entry.name} is valid (${describeProviderEndpoint(validated2.data)}, credential ${describeCredential(validated2.data.credential)})${cache.text}.`, entry.name);
+  if (validated2.data.env?.ENABLE_TOOL_SEARCH === void 0) {
+    push("provider", "warn", `${entry.name} does not set ENABLE_TOOL_SEARCH: a session on this provider loads MCP tools upfront rather than deferring them, because its base URL is the front door, which Claude Code treats as a non-first-party host. Set ENABLE_TOOL_SEARCH in the provider's env block to restore deferred loading, when the upstream backend supports the tool_reference payloads it sends.`, entry.name);
+  }
 }
 function pushLegacyName(push, params) {
   const legacyVariables = Object.keys(params.env).filter((name) => name.startsWith(LEGACY_ENV_PREFIX) && params.env[name] !== void 0).sort();
-  if (legacyVariables.length === 0 && import_node_path35.default.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
+  if (legacyVariables.length === 0 && import_node_path36.default.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
     push("legacy-name", "pass", "Nothing here still uses the former `claude-use` name.");
     return;
   }
   for (const name of legacyVariables) {
     push("legacy-name", "warn", `${name} is the former name of ${name.replace(LEGACY_ENV_PREFIX, ENV_PREFIX)}. Rename it; the old name still works but is only a fallback.`, name);
   }
-  if (import_node_path35.default.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
+  if (import_node_path36.default.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
     push(
       "legacy-name",
       "warn",
@@ -73708,18 +74505,18 @@ function collectDoctorReport(params) {
   const { paths } = params;
   const identityNames = import_node_fs14.default.existsSync(paths.identitiesDir) ? import_node_fs14.default.readdirSync(paths.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && isIdentityDirectoryName(entry.name)).map((entry) => entry.name).sort() : [];
   const identities = identityNames.map((name) => {
-    const farmRoot = import_node_path35.default.join(paths.identitiesDir, name);
-    const identityPath = import_node_path35.default.join(farmRoot, "identity.json");
+    const farmRoot = import_node_path36.default.join(paths.identitiesDir, name);
+    const identityPath = import_node_path36.default.join(farmRoot, "identity.json");
     return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot };
   });
   const profileNames = import_node_fs14.default.existsSync(paths.configProfilesDir) ? import_node_fs14.default.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const configProfiles = profileNames.map((name) => {
-    const profilePath = import_node_path35.default.join(paths.configProfilesDir, `${name}.json`);
+    const profilePath = import_node_path36.default.join(paths.configProfilesDir, `${name}.json`);
     return { name, path: profilePath, raw: realFsPort.readFileUtf8(profilePath) };
   });
   const providerNames = import_node_fs14.default.existsSync(paths.providersDir) ? import_node_fs14.default.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const providers = providerNames.map((name) => {
-    const providerPath = import_node_path35.default.join(paths.providersDir, `${name}.json`);
+    const providerPath = import_node_path36.default.join(paths.providersDir, `${name}.json`);
     return { name, path: providerPath, raw: realFsPort.readFileUtf8(providerPath) };
   });
   const ownExecutablePath = realOwnExecutablePath();
@@ -73731,12 +74528,12 @@ function collectDoctorReport(params) {
     binaryDiscovery = { ok: false, message: error62 instanceof Error ? error62.message : String(error62) };
   }
   const shimState = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-  const pathDirs = (params.env.PATH ?? "").split(import_node_path35.default.delimiter).filter((dir) => dir !== "");
+  const pathDirs = (params.env.PATH ?? "").split(import_node_path36.default.delimiter).filter((dir) => dir !== "");
   const claudeShimShadow = shimState === void 0 ? void 0 : refinePathShadow(
     findPathShadow({
       pathDirs,
-      targetDir: import_node_path35.default.dirname(shimState.targetPath),
-      targetFilename: import_node_path35.default.basename(shimState.targetPath),
+      targetDir: import_node_path36.default.dirname(shimState.targetPath),
+      targetFilename: import_node_path36.default.basename(shimState.targetPath),
       findExecutableInDir
     }),
     shimState.targetPath,
@@ -73761,7 +74558,7 @@ function collectDoctorReport(params) {
       agentShim: refinePathShadow(
         findPathShadow({
           pathDirs,
-          targetDir: import_node_path35.default.dirname(ownExecutablePath),
+          targetDir: import_node_path36.default.dirname(ownExecutablePath),
           targetFilename: commandFilename(ownExecutablePath, "agent-shim"),
           findExecutableInDir
         }),
@@ -73804,7 +74601,7 @@ function registerDoctorCommand(program2, deps) {
 // src/headroom/commands.ts
 var import_node_fs16 = __toESM(require("node:fs"), 1);
 var import_node_http2 = __toESM(require("node:http"), 1);
-var import_node_path37 = __toESM(require("node:path"), 1);
+var import_node_path38 = __toESM(require("node:path"), 1);
 var import_node_child_process5 = require("node:child_process");
 
 // src/frontdoor/realFrontDoorPort.ts
@@ -73950,11 +74747,11 @@ function probeFrontDoorSync(port, caPem) {
 
 // src/frontdoor/trust.ts
 var import_node_crypto14 = require("node:crypto");
-var import_node_path36 = __toESM(require("node:path"), 1);
+var import_node_path37 = __toESM(require("node:path"), 1);
 var BUNDLE_NAME_HEX_DIGITS = 16;
 function resolveTrustBundle(params) {
   const { caCertFile, bundlesDir, variable, inherited, fs: fs19 } = params;
-  if (inherited === void 0 || inherited === "" || import_node_path36.default.resolve(inherited) === import_node_path36.default.resolve(caCertFile)) {
+  if (inherited === void 0 || inherited === "" || import_node_path37.default.resolve(inherited) === import_node_path37.default.resolve(caCertFile)) {
     return { path: caCertFile };
   }
   const caPem = fs19.readFileUtf8(caCertFile);
@@ -73972,7 +74769,7 @@ function resolveTrustBundle(params) {
   }
   const combined = `${inheritedPem.trimEnd()}
 ${caPem}`;
-  const bundle = import_node_path36.default.join(bundlesDir, `${(0, import_node_crypto14.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
+  const bundle = import_node_path37.default.join(bundlesDir, `${(0, import_node_crypto14.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
   if (!fs19.exists(bundle)) {
     fs19.mkdirp(bundlesDir);
     fs19.writeFileAtomic(bundle, combined);
@@ -74130,12 +74927,12 @@ function readInstalledHeadroomCommit() {
   if (toolDir.status !== 0) {
     return void 0;
   }
-  const libDir = import_node_path37.default.join(toolDir.stdout.trim(), HEADROOM_TOOL_NAME, "lib");
+  const libDir = import_node_path38.default.join(toolDir.stdout.trim(), HEADROOM_TOOL_NAME, "lib");
   for (const python of realFarmFs.readdir(libDir)) {
-    const sitePackages = import_node_path37.default.join(libDir, python, "site-packages");
+    const sitePackages = import_node_path38.default.join(libDir, python, "site-packages");
     for (const entry of realFarmFs.readdir(sitePackages)) {
       if (entry.startsWith("headroom_ai-") && entry.endsWith(".dist-info")) {
-        const directUrl = realFarmFs.readFileUtf8(import_node_path37.default.join(sitePackages, entry, "direct_url.json"));
+        const directUrl = realFarmFs.readFileUtf8(import_node_path38.default.join(sitePackages, entry, "direct_url.json"));
         return directUrl === void 0 ? void 0 : parseInstalledCommit(directUrl);
       }
     }
@@ -74942,7 +75739,7 @@ var import_node_crypto16 = require("node:crypto");
 
 // src/launcher.ts
 var import_node_crypto15 = require("node:crypto");
-var import_node_path39 = __toESM(require("node:path"), 1);
+var import_node_path40 = __toESM(require("node:path"), 1);
 
 // src/launcher/cliOverride.ts
 var InvalidCliCategoryError = class extends CliError {
@@ -75026,7 +75823,7 @@ function buildCliOverride(params) {
 }
 
 // src/launcher/flags.ts
-var import_node_path38 = __toESM(require("node:path"), 1);
+var import_node_path39 = __toESM(require("node:path"), 1);
 
 // src/headroom/headers.ts
 function mergeAnthropicCustomHeaders(existing, additions) {
@@ -75096,7 +75893,7 @@ function buildEnv(params) {
   const parentCustomHeaders = params.baseEnv.ANTHROPIC_CUSTOM_HEADERS;
   let providerCustomHeaders;
   if (!params.configDirEscapeHatch && params.resolvedIdentityName !== void 0) {
-    env.CLAUDE_CONFIG_DIR = import_node_path38.default.join(params.identitiesDir, params.resolvedIdentityName);
+    env.CLAUDE_CONFIG_DIR = import_node_path39.default.join(params.identitiesDir, params.resolvedIdentityName);
   }
   if (params.provider !== void 0) {
     const providerEnv = params.provider.definition.env ?? {};
@@ -75280,7 +76077,7 @@ function prepareLaunch(params) {
     identityDefaultConfigProfile: loadedIdentity?.config.defaultConfigProfile,
     globalDefaultConfigProfile: params.globalDefaultConfigProfile
   });
-  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs19.readConfigFile(import_node_path39.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
+  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs19.readConfigFile(import_node_path40.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
     log.error(
       `agent-shim: no configuration profile named "${configProfileDecision.name}" (selected via ${configProfileDecision.source}). Run \`agent-shim profile add ${configProfileDecision.name}\` first.`
     );
@@ -75626,7 +76423,7 @@ async function runClaude(argvOverride) {
 // src/cli.ts
 async function main() {
   aliasLegacyEnv(process.env);
-  const invokedName = import_node_path40.default.basename(process.argv[1] ?? "agent-shim");
+  const invokedName = import_node_path41.default.basename(process.argv[1] ?? "agent-shim");
   if (isInvokedAsClaude(invokedName)) {
     await runClaude();
     return;