agent-shim 8.14.0 → 8.15.0

package/dist/cli.cjs

@@ -3248,42 +3248,42 @@ var require_defaults = __commonJS({
 var require_env_paths = __commonJS({
   "node_modules/.pnpm/env-paths@2.2.1/node_modules/env-paths/index.js"(exports2, module2) {
     "use strict";
-    var path43 = require("path");
+    var path44 = require("path");
     var os10 = require("os");
     var homedir = os10.homedir();
     var tmpdir = os10.tmpdir();
     var { env } = process;
     var macos = (name) => {
-      const library = path43.join(homedir, "Library");
+      const library = path44.join(homedir, "Library");
       return {
-        data: path43.join(library, "Application Support", name),
-        config: path43.join(library, "Preferences", name),
-        cache: path43.join(library, "Caches", name),
-        log: path43.join(library, "Logs", name),
-        temp: path43.join(tmpdir, name)
+        data: path44.join(library, "Application Support", name),
+        config: path44.join(library, "Preferences", name),
+        cache: path44.join(library, "Caches", name),
+        log: path44.join(library, "Logs", name),
+        temp: path44.join(tmpdir, name)
       };
     };
     var windows = (name) => {
-      const appData = env.APPDATA || path43.join(homedir, "AppData", "Roaming");
-      const localAppData = env.LOCALAPPDATA || path43.join(homedir, "AppData", "Local");
+      const appData = env.APPDATA || path44.join(homedir, "AppData", "Roaming");
+      const localAppData = env.LOCALAPPDATA || path44.join(homedir, "AppData", "Local");
       return {
         // Data/config/cache/log are invented by me as Windows isn't opinionated about this
-        data: path43.join(localAppData, name, "Data"),
-        config: path43.join(appData, name, "Config"),
-        cache: path43.join(localAppData, name, "Cache"),
-        log: path43.join(localAppData, name, "Log"),
-        temp: path43.join(tmpdir, name)
+        data: path44.join(localAppData, name, "Data"),
+        config: path44.join(appData, name, "Config"),
+        cache: path44.join(localAppData, name, "Cache"),
+        log: path44.join(localAppData, name, "Log"),
+        temp: path44.join(tmpdir, name)
       };
     };
     var linux = (name) => {
-      const username = path43.basename(homedir);
+      const username = path44.basename(homedir);
       return {
-        data: path43.join(env.XDG_DATA_HOME || path43.join(homedir, ".local", "share"), name),
-        config: path43.join(env.XDG_CONFIG_HOME || path43.join(homedir, ".config"), name),
-        cache: path43.join(env.XDG_CACHE_HOME || path43.join(homedir, ".cache"), name),
+        data: path44.join(env.XDG_DATA_HOME || path44.join(homedir, ".local", "share"), name),
+        config: path44.join(env.XDG_CONFIG_HOME || path44.join(homedir, ".config"), name),
+        cache: path44.join(env.XDG_CACHE_HOME || path44.join(homedir, ".cache"), name),
         // https://wiki.debian.org/XDGBaseDirectorySpecification#state
-        log: path43.join(env.XDG_STATE_HOME || path43.join(homedir, ".local", "state"), name),
-        temp: path43.join(tmpdir, username, name)
+        log: path44.join(env.XDG_STATE_HOME || path44.join(homedir, ".local", "state"), name),
+        temp: path44.join(tmpdir, username, name)
       };
     };
     var envPaths = (name, options) => {
@@ -3351,11 +3351,11 @@ var require_util = __commonJS({
       return result;
     }
     exports2.emplace = emplace;
-    function getPropertyByPath(source, path43) {
-      if (typeof path43 === "string" && Object.prototype.hasOwnProperty.call(source, path43)) {
-        return source[path43];
+    function getPropertyByPath(source, path44) {
+      if (typeof path44 === "string" && Object.prototype.hasOwnProperty.call(source, path44)) {
+        return source[path44];
       }
-      const parsedPath = typeof path43 === "string" ? path43.split(".") : path43;
+      const parsedPath = typeof path44 === "string" ? path44.split(".") : path44;
       return parsedPath.reduce((previous, key) => {
         if (previous === void 0) {
           return previous;
@@ -3378,9 +3378,9 @@ var require_util = __commonJS({
       return Object.fromEntries(Object.entries(options).filter(([, value2]) => value2 !== void 0));
     }
     exports2.removeUndefinedValuesFromObject = removeUndefinedValuesFromObject;
-    async function isDirectory(path43) {
+    async function isDirectory(path44) {
       try {
-        const stat = await fs_1.promises.stat(path43);
+        const stat = await fs_1.promises.stat(path44);
         return stat.isDirectory();
       } catch (e) {
         if (e.code === "ENOENT") {
@@ -3390,9 +3390,9 @@ var require_util = __commonJS({
       }
     }
     exports2.isDirectory = isDirectory;
-    function isDirectorySync(path43) {
+    function isDirectorySync(path44) {
       try {
-        const stat = fs_1.default.statSync(path43);
+        const stat = fs_1.default.statSync(path44);
         return stat.isDirectory();
       } catch (e) {
         if (e.code === "ENOENT") {
@@ -3490,7 +3490,7 @@ var require_ExplorerBase = __commonJS({
           const idx = importStack.indexOf(fullPath);
           if (idx !== -1) {
             throw new Error(`Circular import detected:
-${[...importStack, fullPath].map((path43, i2) => `${i2 + 1}. ${path43}`).join("\n")} (same as ${idx + 1}.)`);
+${[...importStack, fullPath].map((path44, i2) => `${i2 + 1}. ${path44}`).join("\n")} (same as ${idx + 1}.)`);
           }
         }
       }
@@ -3678,9 +3678,9 @@ var require_Explorer = __commonJS({
           throw error62;
         }
       }
-      async #fileExists(path43) {
+      async #fileExists(path44) {
         try {
-          await promises_1.default.stat(path43);
+          await promises_1.default.stat(path44);
           return true;
         } catch (e) {
           return false;
@@ -3840,9 +3840,9 @@ var require_ExplorerSync = __commonJS({
           throw error62;
         }
       }
-      #fileExists(path43) {
+      #fileExists(path44) {
         try {
-          fs_1.default.statSync(path43);
+          fs_1.default.statSync(path44);
           return true;
         } catch (e) {
           return false;
@@ -3966,7 +3966,7 @@ var require_dist = __commonJS({
       };
     }
     function getResolvedSearchPlaces(moduleName, toolDefinedSearchPlaces, userConfiguredOptions) {
-      const userConfiguredSearchPlaces = userConfiguredOptions.searchPlaces?.map((path43) => path43.replace("{name}", moduleName));
+      const userConfiguredSearchPlaces = userConfiguredOptions.searchPlaces?.map((path44) => path44.replace("{name}", moduleName));
       if (userConfiguredOptions.mergeSearchPlaces) {
         return [...userConfiguredSearchPlaces ?? [], ...toolDefinedSearchPlaces];
       }
@@ -4374,8 +4374,8 @@ var require_utils = __commonJS({
       }
       return output2;
     };
-    exports2.basename = (path43, { windows } = {}) => {
-      const segs = path43.split(windows ? /[\\/]/ : "/");
+    exports2.basename = (path44, { windows } = {}) => {
+      const segs = path44.split(windows ? /[\\/]/ : "/");
       const last = segs[segs.length - 1];
       if (last === "") {
         return segs[segs.length - 2];
@@ -7003,14 +7003,14 @@ var require_util2 = __commonJS({
         }
         const port = url2.port != null ? url2.port : url2.protocol === "https:" ? 443 : 80;
         let origin = url2.origin != null ? url2.origin : `${url2.protocol || ""}//${url2.hostname || ""}:${port}`;
-        let path43 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`;
+        let path44 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`;
         if (origin[origin.length - 1] === "/") {
           origin = origin.slice(0, origin.length - 1);
         }
-        if (path43 && path43[0] !== "/") {
-          path43 = `/${path43}`;
+        if (path44 && path44[0] !== "/") {
+          path44 = `/${path44}`;
         }
-        return new URL(`${origin}${path43}`);
+        return new URL(`${origin}${path44}`);
       }
       if (!isHttpOrHttpsPrefixed(url2.origin || url2.protocol)) {
         throw new InvalidArgumentError2("Invalid URL protocol: the URL must start with `http:` or `https:`.");
@@ -7831,9 +7831,9 @@ var require_diagnostics = __commonJS({
         "undici:client:sendHeaders",
         (evt) => {
           const {
-            request: { method, path: path43, origin }
+            request: { method, path: path44, origin }
           } = evt;
-          debugLog("sending request to %s %s%s", method, origin, path43);
+          debugLog("sending request to %s %s%s", method, origin, path44);
         }
       );
     }
@@ -7851,14 +7851,14 @@ var require_diagnostics = __commonJS({
         "undici:request:headers",
         (evt) => {
           const {
-            request: { method, path: path43, origin },
+            request: { method, path: path44, origin },
             response: { statusCode }
           } = evt;
           debugLog(
             "received response to %s %s%s - HTTP %d",
             method,
             origin,
-            path43,
+            path44,
             statusCode
           );
         }
@@ -7867,23 +7867,23 @@ var require_diagnostics = __commonJS({
         "undici:request:trailers",
         (evt) => {
           const {
-            request: { method, path: path43, origin }
+            request: { method, path: path44, origin }
           } = evt;
-          debugLog("trailers received from %s %s%s", method, origin, path43);
+          debugLog("trailers received from %s %s%s", method, origin, path44);
         }
       );
       diagnosticsChannel.subscribe(
         "undici:request:error",
         (evt) => {
           const {
-            request: { method, path: path43, origin },
+            request: { method, path: path44, origin },
             error: error62
           } = evt;
           debugLog(
             "request to %s %s%s errored - %s",
             method,
             origin,
-            path43,
+            path44,
             error62.message
           );
         }
@@ -7998,7 +7998,7 @@ var require_request = __commonJS({
     var kHandler = /* @__PURE__ */ Symbol("handler");
     var Request2 = class {
       constructor(origin, {
-        path: path43,
+        path: path44,
         method,
         body,
         headers,
@@ -8015,11 +8015,11 @@ var require_request = __commonJS({
         maxRedirections,
         typeOfService
       }, handler) {
-        if (typeof path43 !== "string") {
+        if (typeof path44 !== "string") {
           throw new InvalidArgumentError2("path must be a string");
-        } else if (path43[0] !== "/" && !(path43.startsWith("http://") || path43.startsWith("https://")) && method !== "CONNECT") {
+        } else if (path44[0] !== "/" && !(path44.startsWith("http://") || path44.startsWith("https://")) && method !== "CONNECT") {
           throw new InvalidArgumentError2("path must be an absolute URL or start with a slash");
-        } else if (invalidPathRegex.test(path43)) {
+        } else if (invalidPathRegex.test(path44)) {
           throw new InvalidArgumentError2("invalid request path");
         }
         if (typeof method !== "string") {
@@ -8094,7 +8094,7 @@ var require_request = __commonJS({
         this.completed = false;
         this.aborted = false;
         this.upgrade = upgrade || null;
-        this.path = query ? serializePathWithQuery(path43, query) : path43;
+        this.path = query ? serializePathWithQuery(path44, query) : path44;
         this.origin = origin;
         this.protocol = getProtocolFromUrlString(origin);
         this.idempotent = idempotent == null ? method === "HEAD" || method === "GET" : idempotent;
@@ -13276,7 +13276,7 @@ var require_client_h1 = __commonJS({
       return method !== "GET" && method !== "HEAD" && method !== "OPTIONS" && method !== "TRACE" && method !== "CONNECT";
     }
     function writeH1(client, request7) {
-      const { method, path: path43, host, upgrade, blocking, reset } = request7;
+      const { method, path: path44, host, upgrade, blocking, reset } = request7;
       let { body, headers, contentLength } = request7;
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH" || method === "QUERY" || method === "PROPFIND" || method === "PROPPATCH";
       if (util.isFormDataLike(body)) {
@@ -13354,7 +13354,7 @@ var require_client_h1 = __commonJS({
       if (socket.setTypeOfService) {
         socket.setTypeOfService(request7.typeOfService);
       }
-      let header = `${method} ${path43} HTTP/1.1\r
+      let header = `${method} ${path44} HTTP/1.1\r
 `;
       if (typeof host === "string") {
         header += `host: ${host}\r
@@ -14033,7 +14033,7 @@ var require_client_h2 = __commonJS({
       const headersTimeout = request7.headersTimeout ?? client[kHeadersTimeout];
       const bodyTimeout = request7.bodyTimeout ?? client[kBodyTimeout];
       const session = client[kHTTP2Session];
-      const { method, path: path43, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request7;
+      const { method, path: path44, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request7;
       let { body } = request7;
       if (upgrade != null && upgrade !== "websocket") {
         util.errorRequest(client, request7, new InvalidArgumentError2(`Custom upgrade "${upgrade}" not supported over HTTP/2`));
@@ -14102,7 +14102,7 @@ var require_client_h2 = __commonJS({
           }
           headers[HTTP2_HEADER_METHOD] = "CONNECT";
           headers[HTTP2_HEADER_PROTOCOL] = "websocket";
-          headers[HTTP2_HEADER_PATH] = path43;
+          headers[HTTP2_HEADER_PATH] = path44;
           if (protocol === "ws:" || protocol === "wss:") {
             headers[HTTP2_HEADER_SCHEME] = protocol === "ws:" ? "http" : "https";
           } else {
@@ -14144,7 +14144,7 @@ var require_client_h2 = __commonJS({
         stream.setTimeout(headersTimeout);
         return true;
       }
-      headers[HTTP2_HEADER_PATH] = path43;
+      headers[HTTP2_HEADER_PATH] = path44;
       headers[HTTP2_HEADER_SCHEME] = protocol === "http:" ? "http" : "https";
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH";
       if (body && typeof body.read === "function") {
@@ -16496,10 +16496,10 @@ var require_proxy_agent = __commonJS({
         };
         const {
           origin,
-          path: path43 = "/",
+          path: path44 = "/",
           headers = {}
         } = opts;
-        opts.path = origin + path43;
+        opts.path = origin + path44;
         if (!("host" in headers) && !("Host" in headers)) {
           const { host } = new URL(origin);
           headers.host = host;
@@ -18608,20 +18608,20 @@ var require_mock_utils = __commonJS({
       }
       return normalizedQp;
     }
-    function safeUrl(path43) {
-      if (typeof path43 !== "string") {
-        return path43;
+    function safeUrl(path44) {
+      if (typeof path44 !== "string") {
+        return path44;
       }
-      const pathSegments = path43.split("?", 3);
+      const pathSegments = path44.split("?", 3);
       if (pathSegments.length !== 2) {
-        return path43;
+        return path44;
       }
       const qp = new URLSearchParams(pathSegments.pop());
       qp.sort();
       return [...pathSegments, qp.toString()].join("?");
     }
-    function matchKey(mockDispatch2, { path: path43, method, body, headers }) {
-      const pathMatch = matchValue(mockDispatch2.path, path43);
+    function matchKey(mockDispatch2, { path: path44, method, body, headers }) {
+      const pathMatch = matchValue(mockDispatch2.path, path44);
       const methodMatch = matchValue(mockDispatch2.method, method);
       const bodyMatch = typeof mockDispatch2.body !== "undefined" ? matchValue(mockDispatch2.body, body) : true;
       const headersMatch = matchHeaders(mockDispatch2, headers);
@@ -18646,8 +18646,8 @@ var require_mock_utils = __commonJS({
       const basePath = key.query ? serializePathWithQuery(key.path, key.query) : key.path;
       const resolvedPath = typeof basePath === "string" ? safeUrl(basePath) : basePath;
       const resolvedPathWithoutTrailingSlash = removeTrailingSlash(resolvedPath);
-      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path43, ignoreTrailingSlash }) => {
-        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path43)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path43), resolvedPath);
+      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path44, ignoreTrailingSlash }) => {
+        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path44)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path44), resolvedPath);
       });
       if (matchedMockDispatches.length === 0) {
         throw new MockNotMatchedError(`Mock dispatch not matched for path '${resolvedPath}'`);
@@ -18686,19 +18686,19 @@ var require_mock_utils = __commonJS({
         mockDispatches.splice(index, 1);
       }
     }
-    function removeTrailingSlash(path43) {
-      while (path43.endsWith("/")) {
-        path43 = path43.slice(0, -1);
+    function removeTrailingSlash(path44) {
+      while (path44.endsWith("/")) {
+        path44 = path44.slice(0, -1);
       }
-      if (path43.length === 0) {
-        path43 = "/";
+      if (path44.length === 0) {
+        path44 = "/";
       }
-      return path43;
+      return path44;
     }
     function buildKey(opts) {
-      const { path: path43, method, body, headers, query } = opts;
+      const { path: path44, method, body, headers, query } = opts;
       return {
-        path: path43,
+        path: path44,
         method,
         body,
         headers,
@@ -19388,10 +19388,10 @@ var require_pending_interceptors_formatter = __commonJS({
       }
       format(pendingInterceptors) {
         const withPrettyHeaders = pendingInterceptors.map(
-          ({ method, path: path43, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
+          ({ method, path: path44, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
             Method: method,
             Origin: origin,
-            Path: path43,
+            Path: path44,
             "Status code": statusCode,
             Persistent: persist ? PERSISTENT : NOT_PERSISTENT,
             Invocations: timesInvoked,
@@ -19473,9 +19473,9 @@ var require_mock_agent = __commonJS({
         const acceptNonStandardSearchParameters = this[kMockAgentAcceptsNonStandardSearchParameters];
         const dispatchOpts = { ...opts };
         if (acceptNonStandardSearchParameters && dispatchOpts.path) {
-          const [path43, searchParams] = dispatchOpts.path.split("?");
+          const [path44, searchParams] = dispatchOpts.path.split("?");
           const normalizedSearchParams = normalizeSearchParams(searchParams, acceptNonStandardSearchParameters);
-          dispatchOpts.path = `${path43}?${normalizedSearchParams}`;
+          dispatchOpts.path = `${path44}?${normalizedSearchParams}`;
         }
         return this[kAgent].dispatch(dispatchOpts, handler);
       }
@@ -19876,12 +19876,12 @@ var require_snapshot_recorder = __commonJS({
        * @return {Promise<void>} - Resolves when snapshots are loaded
        */
       async loadSnapshots(filePath) {
-        const path43 = filePath || this.#snapshotPath;
-        if (!path43) {
+        const path44 = filePath || this.#snapshotPath;
+        if (!path44) {
           throw new InvalidArgumentError2("Snapshot path is required");
         }
         try {
-          const data = await readFile(resolve(path43), "utf8");
+          const data = await readFile(resolve(path44), "utf8");
           const parsed = JSON.parse(data);
           if (Array.isArray(parsed)) {
             this.#snapshots.clear();
@@ -19895,7 +19895,7 @@ var require_snapshot_recorder = __commonJS({
           if (error62.code === "ENOENT") {
             this.#snapshots.clear();
           } else {
-            throw new UndiciError(`Failed to load snapshots from ${path43}`, { cause: error62 });
+            throw new UndiciError(`Failed to load snapshots from ${path44}`, { cause: error62 });
           }
         }
       }
@@ -19906,11 +19906,11 @@ var require_snapshot_recorder = __commonJS({
        * @returns {Promise<void>} - Resolves when snapshots are saved
        */
       async saveSnapshots(filePath) {
-        const path43 = filePath || this.#snapshotPath;
-        if (!path43) {
+        const path44 = filePath || this.#snapshotPath;
+        if (!path44) {
           throw new InvalidArgumentError2("Snapshot path is required");
         }
-        const resolvedPath = resolve(path43);
+        const resolvedPath = resolve(path44);
         await mkdir(dirname2(resolvedPath), { recursive: true });
         const data = Array.from(this.#snapshots.entries()).map(([hash2, snapshot]) => ({
           hash: hash2,
@@ -20542,15 +20542,15 @@ var require_redirect_handler = __commonJS({
           return;
         }
         const { origin, pathname, search } = util.parseURL(new URL(this.location, this.opts.origin && new URL(this.opts.path, this.opts.origin)));
-        const path43 = search ? `${pathname}${search}` : pathname;
-        const redirectUrlString = `${origin}${path43}`;
+        const path44 = search ? `${pathname}${search}` : pathname;
+        const redirectUrlString = `${origin}${path44}`;
         for (const historyUrl of this.history) {
           if (historyUrl.toString() === redirectUrlString) {
             throw new InvalidArgumentError2(`Redirect loop detected. Cannot redirect to ${origin}. This typically happens when using a Client or Pool with cross-origin redirects. Use an Agent for cross-origin redirects.`);
           }
         }
         this.opts.headers = cleanRequestHeaders(this.opts.headers, statusCode === 303, this.opts.origin !== origin);
-        this.opts.path = path43;
+        this.opts.path = path44;
         this.opts.origin = origin;
         this.opts.query = null;
       }
@@ -22310,10 +22310,10 @@ var require_cache_handler = __commonJS({
       }
       return locationUrl.pathname + locationUrl.search;
     }
-    function deleteCachedUri(store, cacheKey, path43) {
+    function deleteCachedUri(store, cacheKey, path44) {
       deleteCachedValue(store, {
         ...cacheKey,
-        path: path43
+        path: path44
       });
       for (let i2 = 0; i2 < util.safeHTTPMethods.length; i2++) {
         const method = util.safeHTTPMethods[i2];
@@ -22321,7 +22321,7 @@ var require_cache_handler = __commonJS({
           deleteCachedValue(store, {
             ...cacheKey,
             method,
-            path: path43
+            path: path44
           });
         }
       }
@@ -22332,9 +22332,9 @@ var require_cache_handler = __commonJS({
       }
       const values = Array.isArray(headerValue2) ? headerValue2 : [headerValue2];
       for (let i2 = 0; i2 < values.length; i2++) {
-        const path43 = getSameOriginPath(cacheKey, values[i2]);
-        if (path43 !== void 0) {
-          deleteCachedUri(store, cacheKey, path43);
+        const path44 = getSameOriginPath(cacheKey, values[i2]);
+        if (path44 !== void 0) {
+          deleteCachedUri(store, cacheKey, path44);
         }
       }
     }
@@ -27334,11 +27334,11 @@ var require_fetch = __commonJS({
       function dispatch({ body }) {
         const url2 = requestCurrentURL(request7);
         const agent = fetchParams.controller.dispatcher;
-        const path43 = url2.pathname + url2.search;
+        const path44 = url2.pathname + url2.search;
         const hasTrailingQuestionMark = url2.search.length === 0 && url2.href[url2.href.length - url2.hash.length - 1] === "?";
         return new Promise((resolve, reject) => agent.dispatch(
           {
-            path: hasTrailingQuestionMark ? `${path43}?` : path43,
+            path: hasTrailingQuestionMark ? `${path44}?` : path44,
             origin: url2.origin,
             method: request7.method,
             body: agent.isMockActive ? request7.body && (request7.body.source || request7.body.stream) : body,
@@ -28285,9 +28285,9 @@ var require_util5 = __commonJS({
         }
       }
     }
-    function validateCookiePath(path43) {
-      for (let i2 = 0; i2 < path43.length; ++i2) {
-        const code = path43.charCodeAt(i2);
+    function validateCookiePath(path44) {
+      for (let i2 = 0; i2 < path44.length; ++i2) {
+        const code = path44.charCodeAt(i2);
         if (code < 32 || // exclude CTLs (0-31)
         code > 126 || // exclude DEL and non-ascii
         code === 59) {
@@ -31635,11 +31635,11 @@ var require_undici = __commonJS({
           if (typeof opts.path !== "string") {
             throw new InvalidArgumentError2("invalid opts.path");
           }
-          let path43 = opts.path;
+          let path44 = opts.path;
           if (!opts.path.startsWith("/")) {
-            path43 = `/${path43}`;
+            path44 = `/${path44}`;
           }
-          url2 = new URL(util.parseOrigin(url2).origin + path43);
+          url2 = new URL(util.parseOrigin(url2).origin + path44);
         } else {
           if (!opts) {
             opts = typeof url2 === "object" ? url2 : {};
@@ -31749,7 +31749,7 @@ ${captureLines}` : capture.stack;
 });
 
 // src/cli.ts
-var import_node_path41 = __toESM(require("node:path"), 1);
+var import_node_path42 = __toESM(require("node:path"), 1);
 
 // node_modules/.pnpm/commander@15.0.0/node_modules/commander/lib/error.js
 var CommanderError = class extends Error {
@@ -34862,9 +34862,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
    * @param {string} [path]
    * @return {(string|null|Command)}
    */
-  executableDir(path43) {
-    if (path43 === void 0) return this._executableDir;
-    this._executableDir = path43;
+  executableDir(path44) {
+    if (path44 === void 0) return this._executableDir;
+    this._executableDir = path44;
     return this;
   }
   /**
@@ -36002,10 +36002,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path43) {
-  if (!path43)
+function getElementAtPath(obj, path44) {
+  if (!path44)
     return obj;
-  return path43.reduce((acc, key) => acc?.[key], obj);
+  return path44.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -36345,11 +36345,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path43, issues) {
+function prefixIssues(path44, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path43);
+    iss.path.unshift(path44);
     return iss;
   });
 }
@@ -36799,16 +36799,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path43 = []) => {
+  const processError = (error63, path44 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path43, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path44, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path43, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path44, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path43, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path44, ...issue2.path]);
       } else {
-        const fullpath = [...path43, ...issue2.path];
+        const fullpath = [...path44, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -36847,17 +36847,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error63, path43 = []) => {
+  const processError = (error63, path44 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path43, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path44, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path43, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path44, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path43, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path44, ...issue2.path]);
       } else {
-        const fullpath = [...path43, ...issue2.path];
+        const fullpath = [...path44, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -36896,8 +36896,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path43 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path43) {
+  const path44 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path44) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -53999,13 +53999,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path43 = ref.slice(1).split("/").filter(Boolean);
-  if (path43.length === 0) {
+  const path44 = ref.slice(1).split("/").filter(Boolean);
+  if (path44.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path43[0] === defsKey) {
-    const key = path43[1] === void 0 ? void 0 : decodeJSONPointerSegment(path43[1]);
+  if (path44[0] === defsKey) {
+    const key = path44[1] === void 0 ? void 0 : decodeJSONPointerSegment(path44[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -58058,6 +58058,20 @@ var import_node_path13 = __toESM(require("node:path"), 1);
 
 // src/launcher/identity.ts
 var import_node_path10 = __toESM(require("node:path"), 1);
+var IDENTITY_DECISION_SOURCES = [
+  /** `CLAUDE_CONFIG_DIR` was already set: identity resolution is skipped entirely and the real binary uses whatever it already points to. */
+  "config-dir-escape-hatch",
+  /** A leading `@name` argv[0] positional, or its explicit form `--identity <name>`. */
+  "argv",
+  /** The `AGENT_SHIM_IDENTITY` environment variable. */
+  "env",
+  /** A directory rule pinning an identity to the current path. */
+  "directory-pin",
+  /** The persisted `~/.agent-shim/active-identity` file. */
+  "active-identity-file",
+  /** Nothing resolved an identity at all — a bare launch with no active identity. */
+  "none"
+];
 function poolNameOf(selector) {
   return selector.startsWith(POOL_SELECTOR_PREFIX) ? selector.slice(POOL_SELECTOR_PREFIX.length) : void 0;
 }
@@ -58087,6 +58101,20 @@ function decideIdentity(params) {
   }
   return { source: "none", configDirEscapeHatch: false };
 }
+var CONFIG_PROFILE_DECISION_SOURCES = [
+  /** An explicit `--config-profile` CLI flag. */
+  "cli-flag",
+  /** The `AGENT_SHIM_CONFIG_PROFILE` environment variable. */
+  "env",
+  /** A directory rule's `configProfile` selection for `$PWD`. */
+  "directory-rule",
+  /** The active identity's own declared `defaultConfigProfile`. */
+  "identity-default",
+  /** The user-global `~/.agent-shim/config.json` default. */
+  "global-default",
+  /** Nothing resolved a configuration profile at all. */
+  "none"
+];
 function decideConfigProfile(params) {
   if (isNonEmpty(params.cliFlagConfigProfile)) {
     return { name: params.cliFlagConfigProfile, source: "cli-flag" };
@@ -59114,6 +59142,12 @@ function encodeProjectPattern(fragment, options) {
   }
   return splitOnWildcards(expanded).map((piece) => piece.kind === "literal" ? encodeProjectPath(piece.text) : piece.text).join("");
 }
+var ENCODING_AMBIGUITY_REASONS = [
+  /** The literal portion contains a character other than `/` that encodes to `-`, so a sibling path differing only in that character encodes identically. */
+  "lossy-characters",
+  /** Two different patterns in the same configuration encode to the identical form. */
+  "collides-with-sibling-pattern"
+];
 function lossyCharacters(literal2) {
   const found = /* @__PURE__ */ new Set();
   for (const character of literal2) {
@@ -61710,7 +61744,7 @@ function registerIdentityCommand(program2, deps) {
 // package.json
 var package_default = {
   name: "agent-shim",
-  version: "8.14.0",
+  version: "8.15.0",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -62140,11 +62174,11 @@ function providerBaseUrl(port, provider) {
 function directOrigin(port) {
   return `http://127.0.0.1:${String(port)}`;
 }
-function parseProviderPath(path43) {
-  if (!path43.startsWith(PROVIDER_PATH_PREFIX)) {
+function parseProviderPath(path44) {
+  if (!path44.startsWith(PROVIDER_PATH_PREFIX)) {
     return void 0;
   }
-  const tail = path43.slice(PROVIDER_PATH_PREFIX.length);
+  const tail = path44.slice(PROVIDER_PATH_PREFIX.length);
   const slash = tail.indexOf("/");
   if (slash <= 0) {
     return void 0;
@@ -62544,9 +62578,9 @@ function decoderFor(encoding) {
       return void 0;
   }
 }
-function destinationOf(path43) {
-  const scoped = parseProviderPath(path43);
-  return scoped === void 0 ? { provider: ANTHROPIC_PROVIDER, endpoint: path43 } : { provider: scoped.provider, endpoint: scoped.rest };
+function destinationOf(path44) {
+  const scoped = parseProviderPath(path44);
+  return scoped === void 0 ? { provider: ANTHROPIC_PROVIDER, endpoint: path44 } : { provider: scoped.provider, endpoint: scoped.rest };
 }
 function buildRecord(event, context) {
   const { scan } = context;
@@ -63591,6 +63625,7 @@ function parseEnvBool(variable, value2) {
 }
 
 // src/launcher/claudeVersion.ts
+var CLAUDE_VERSION_SOURCES = ["flag", "environment", "cascade"];
 var InvalidClaudeVersionError = class extends UsageError {
   constructor(value2, origin) {
     super(`${origin} names Claude Code version "${value2}", which is not an exact dotted-numeric version such as 2.1.220.`);
@@ -63904,7 +63939,7 @@ function formatCheckReport(report) {
   const { credential } = report;
   if (credential.provider !== void 0) {
     lines.push(
-      `  Provider ${credential.provider.name}: ${credential.provider.credential === void 0 ? `unusable: ${credential.provider.problem ?? ""}` : formatCredentialSummary(credential.provider.credential)}${credential.provider.cached === void 0 ? "" : `; ${formatCachedCredentialState(credential.provider.cached)}`}`
+      `  Provider ${credential.provider.name}: ${credential.provider.credential === void 0 ? `unusable: ${credential.provider.problem}` : formatCredentialSummary(credential.provider.credential)}${credential.provider.cached === void 0 ? "" : `; ${formatCachedCredentialState(credential.provider.cached)}`}`
     );
   }
   if (credential.identity !== void 0) {
@@ -64446,8 +64481,8 @@ function registerCodexCommand(program2, deps) {
 
 // src/frontdoor/commands.ts
 var import_node_crypto12 = require("node:crypto");
-var import_node_path34 = __toESM(require("node:path"), 1);
-var import_node_fs12 = __toESM(require("node:fs"), 1);
+var import_node_path36 = __toESM(require("node:path"), 1);
+var import_node_fs13 = __toESM(require("node:fs"), 1);
 
 // src/frontdoor/custody.ts
 var CREDENTIAL_HEADERS = ["authorization", "x-api-key"];
@@ -65063,6 +65098,7 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     ...lastDirectPort === void 0 ? {} : { lastDirectPort }
   });
   const fail = (message) => {
+    ports.closeRcStreamHub();
     writeFrontDoorState(fs19, paths.frontdoorStateFile, { lastError: message, ...sticky() });
     fs19.removeRecursive(paths.frontdoorLockFile);
     ports.log(`agent-shim frontdoor supervisor: ${message}`);
@@ -65123,6 +65159,7 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
         await direct.close();
         await connect3.close();
         await http6.close();
+        ports.closeRcStreamHub();
         writeFrontDoorState(fs19, paths.frontdoorStateFile, sticky());
         return 0;
       }
@@ -65176,8 +65213,8 @@ function parseConnectTarget(authority) {
   }
   return { host, port };
 }
-function servedByPipeline(path43) {
-  return path43?.startsWith(ROUTED_PATH_PREFIX) === true;
+function servedByPipeline(path44) {
+  return path44?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
   "connection",
@@ -65703,11 +65740,11 @@ function createRcSessionTracker(deps) {
   };
   const observeExchange = (request7) => {
     const method = (request7.method ?? "").toUpperCase();
-    const path43 = new URL(request7.url ?? "/", "http://127.0.0.1").pathname;
-    if (!path43.startsWith(RC_SESSIONS_PATH_PREFIX)) {
+    const path44 = new URL(request7.url ?? "/", "http://127.0.0.1").pathname;
+    if (!path44.startsWith(RC_SESSIONS_PATH_PREFIX)) {
       return void 0;
     }
-    const tail = path43.slice(RC_SESSIONS_PATH_PREFIX.length);
+    const tail = path44.slice(RC_SESSIONS_PATH_PREFIX.length);
     const facts = {
       oauthAuthorization: oauthAuthorizationOf(request7.headers),
       anthropicVersion: singleHeader(request7.headers, "anthropic-version"),
@@ -66447,9 +66484,9 @@ function sequenceNumsOfBody(body) {
 }
 function frontDoorRcControl(transport, token) {
   const headers = { authorization: `Bearer ${token}` };
-  const listAnswerOf = async (path43, what) => {
+  const listAnswerOf = async (path44, what) => {
     try {
-      return await transport.request({ method: "GET", path: path43, headers });
+      return await transport.request({ method: "GET", path: path44, headers });
     } catch (error62) {
       throw new Error(`${what}: could not reach the front door's control listener: ${error62 instanceof Error ? error62.message : String(error62)}`, { cause: error62 });
     }
@@ -66521,10 +66558,10 @@ function frontDoorRcControl(transport, token) {
     }
     return pending;
   };
-  const writeOf = async (path43, body, describeFailure) => {
+  const writeOf = async (path44, body, describeFailure) => {
     let answer;
     try {
-      answer = await transport.request({ method: "POST", path: path43, headers: { ...headers, "content-type": "application/json" }, body });
+      answer = await transport.request({ method: "POST", path: path44, headers: { ...headers, "content-type": "application/json" }, body });
     } catch (error62) {
       return { ok: false, message: `could not reach the front door's control listener: ${error62 instanceof Error ? error62.message : String(error62)}` };
     }
@@ -66897,12 +66934,12 @@ function lateRcStreamDial(resolve) {
 }
 function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const request7 = async (method, path43, headers, body, signal) => await new Promise((resolve, reject) => {
+  const request7 = async (method, path44, headers, body, signal) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method,
-      path: path43,
+      path: path44,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, ...body === void 0 ? {} : { "content-length": String(Buffer.byteLength(body, "utf8")) } },
       agent,
@@ -66939,9 +66976,9 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
       return { status, body: await readAll(response) };
     },
     openStream: async (sessionId, headers, resume, signal) => {
-      const path43 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
+      const path44 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
       const streamHeaders = resume === void 0 ? headers : { ...headers, "last-event-id": String(resume.fromSequenceNum) };
-      const { status, response } = await request7("GET", path43, streamHeaders, void 0, signal);
+      const { status, response } = await request7("GET", path44, streamHeaders, void 0, signal);
       if (!isSuccessful2(status)) {
         await readAll(response);
         return { status, chunks: NO_CHUNKS };
@@ -67152,6 +67189,527 @@ function realConnectEffects(ports = DOOR_SOURCE_PORTS) {
   };
 }
 
+// src/doctorReport.ts
+var import_node_fs12 = __toESM(require("node:fs"), 1);
+var import_node_path32 = __toESM(require("node:path"), 1);
+var DOCTOR_SEVERITIES = ["pass", "warn", "fail"];
+var DOCTOR_SECTIONS = [
+  "ambient-credential",
+  "binary-discovery",
+  "claude-shim",
+  "path-resolution",
+  "legacy-name",
+  "config-profile",
+  "identity",
+  "pool",
+  "provider",
+  "keychain",
+  "directory-rules",
+  "global-config",
+  "categories-local",
+  "active-identity",
+  "headroom"
+];
+function refinePathShadow(status, ownExecutablePath, realpath) {
+  if (status.status !== "shadowed") {
+    return status;
+  }
+  return realpath(status.by) === realpath(ownExecutablePath) ? { status: "ok" } : status;
+}
+function validateJson(schema, input2) {
+  if (input2.raw === void 0) {
+    return { ok: false, message: `${input2.path} is missing.` };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(input2.raw);
+  } catch (error62) {
+    return { ok: false, message: `${input2.path} is not valid JSON: ${error62 instanceof Error ? error62.message : String(error62)}` };
+  }
+  const result = schema.safeParse(parsed);
+  if (!result.success) {
+    return { ok: false, message: new ConfigValidationError(input2.path, result.error.issues).message };
+  }
+  return { ok: true, data: result.data };
+}
+function pushPathResolution(push, resolution) {
+  const ownDir = import_node_path32.default.dirname(resolution.ownExecutablePath);
+  switch (resolution.agentShim.status) {
+    case "ok":
+      push("path-resolution", "pass", `\`agent-shim\` on PATH resolves to this running executable, ${resolution.ownExecutablePath}.`, "agent-shim");
+      break;
+    case "not-on-path":
+      push(
+        "path-resolution",
+        "warn",
+        `${ownDir} is not on PATH, so a bare \`agent-shim\` does not reach ${resolution.ownExecutablePath}. Add it to PATH, or keep invoking this executable by its full path.`,
+        "agent-shim"
+      );
+      break;
+    case "shadowed":
+      push(
+        "path-resolution",
+        "fail",
+        `\`agent-shim\` on PATH resolves to ${resolution.agentShim.by}, not this running executable, ${resolution.ownExecutablePath}. Every command you type runs that one instead, at whatever version it happens to be \u2014 including the checks in this report, which describe this executable. Remove ${resolution.agentShim.by}, repoint it at ${resolution.ownExecutablePath}, or put ${ownDir} ahead of it on PATH.`,
+        "agent-shim"
+      );
+      break;
+  }
+  if (resolution.claude === void 0) {
+    return;
+  }
+  switch (resolution.claude.status) {
+    case "ok":
+      push("path-resolution", "pass", "`claude` on PATH resolves to the enabled shim.", "claude");
+      break;
+    case "not-on-path":
+      push("path-resolution", "warn", "The enabled `claude` shim's directory is not on PATH \u2014 add it, or use `agent-shim run` instead.", "claude");
+      break;
+    case "shadowed":
+      push(
+        "path-resolution",
+        "warn",
+        `\`claude\` on PATH resolves to ${resolution.claude.by}, not the enabled shim. Put the shim's directory ahead of it on PATH, or run \`agent-shim shim disable\` if you meant to launch that one directly.`,
+        "claude"
+      );
+      break;
+  }
+}
+function cacheClause(cacheEnv, owner, block2) {
+  if (cacheEnv === void 0 || block2.cache === void 0) {
+    return { text: "", unreadable: false };
+  }
+  const state = describeCachedCredential({ port: cacheEnv.port, platform: cacheEnv.platform, owner, cache: block2.cache, nowMs: cacheEnv.now() });
+  return { text: `; ${formatCachedCredentialState(state)}`, unreadable: state.status === "unreadable" };
+}
+function pushProvider(push, entry, cacheEnv) {
+  if (entry.raw === void 0) {
+    push("provider", "fail", `${entry.path} is missing.`, entry.name);
+    return;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(entry.raw);
+  } catch (error62) {
+    push("provider", "fail", `${entry.path} is not valid JSON: ${error62 instanceof Error ? error62.message : String(error62)}`, entry.name);
+    return;
+  }
+  const conversion = legacyProviderConversion(parsed);
+  if (conversion !== void 0) {
+    push("provider", "fail", new LegacyProviderFileError(entry.path, conversion).message, entry.name);
+    return;
+  }
+  const validated2 = ProviderSchema.safeParse(parsed);
+  if (!validated2.success) {
+    push("provider", "fail", new ConfigValidationError(entry.path, validated2.error.issues).message, entry.name);
+    return;
+  }
+  const cache = cacheClause(cacheEnv, `provider ${entry.name}`, validated2.data.credential);
+  push("provider", cache.unreadable ? "fail" : "pass", `${entry.name} is valid (${describeProviderEndpoint(validated2.data)}, credential ${describeCredential(validated2.data.credential)})${cache.text}.`, entry.name);
+  if (validated2.data.env?.ENABLE_TOOL_SEARCH === void 0) {
+    push("provider", "warn", `${entry.name} does not set ENABLE_TOOL_SEARCH: a session on this provider loads MCP tools upfront rather than deferring them, because its base URL is the front door, which Claude Code treats as a non-first-party host. Set ENABLE_TOOL_SEARCH in the provider's env block to restore deferred loading, when the upstream backend supports the tool_reference payloads it sends.`, entry.name);
+  }
+}
+function pushLegacyName(push, params) {
+  const legacyVariables = Object.keys(params.env).filter((name) => name.startsWith(LEGACY_ENV_PREFIX) && params.env[name] !== void 0).sort();
+  if (legacyVariables.length === 0 && import_node_path32.default.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
+    push("legacy-name", "pass", "Nothing here still uses the former `claude-use` name.");
+    return;
+  }
+  for (const name of legacyVariables) {
+    push("legacy-name", "warn", `${name} is the former name of ${name.replace(LEGACY_ENV_PREFIX, ENV_PREFIX)}. Rename it; the old name still works but is only a fallback.`, name);
+  }
+  if (import_node_path32.default.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
+    push(
+      "legacy-name",
+      "warn",
+      `The state root is the former ${params.rootPath}, used in place. Leave it where it is: macOS Claude Code keys each identity's Keychain login on its exact configuration directory path, so moving it signs every identity out.`
+    );
+  }
+}
+function runDoctor(params) {
+  const findings = [];
+  const push = (section, severity, message, subject) => {
+    findings.push({ section, severity, message, ...subject === void 0 ? {} : { subject } });
+  };
+  const checkPin = (section, subject, where, version2) => {
+    const installed = params.installedClaudeVersions;
+    if (version2 === void 0 || installed === void 0 || installed.includes(version2)) {
+      return;
+    }
+    push(section, "warn", `${where} pins Claude Code ${version2}, which is not installed (installed: ${installed.length === 0 ? "none" : installed.join(", ")}); a launch that resolves to it fails.`, subject);
+  };
+  const ambient = detectAmbientCredential(params.env);
+  if (ambient === void 0) {
+    push("ambient-credential", "pass", "No ambient-credential environment variable is set.");
+  } else {
+    push("ambient-credential", "warn", formatAmbientCredentialGuardMessage(ambient.variable));
+  }
+  if (params.binaryDiscovery.ok) {
+    const { binary } = params.binaryDiscovery;
+    const versionNote = binary.version === void 0 ? "" : `, version ${binary.version}`;
+    push("binary-discovery", "pass", `Found ${binary.path} (${binary.source}${versionNote}).`);
+  } else {
+    push("binary-discovery", "fail", params.binaryDiscovery.message);
+  }
+  if (params.claudeShim.state === void 0) {
+    push("claude-shim", "pass", "No `claude` command shim enabled (the default). Run `agent-shim shim enable` to add one.");
+  } else if (!params.claudeShim.targetExists) {
+    push(
+      "claude-shim",
+      "warn",
+      `claude-shim.json records a \`claude\` shim at ${params.claudeShim.state.targetPath}, but nothing is there. Run \`agent-shim shim enable\` again, or \`agent-shim shim disable\` to clear the stale record.`
+    );
+  } else {
+    push(
+      "claude-shim",
+      "pass",
+      `\`claude\` is enabled at ${params.claudeShim.state.targetPath} (${params.claudeShim.state.method}). If you've upgraded agent-shim since, re-run \`agent-shim shim enable\` to refresh it.`
+    );
+  }
+  pushPathResolution(push, params.pathResolution);
+  pushLegacyName(push, params);
+  const profileSources = /* @__PURE__ */ new Map();
+  for (const entry of params.configProfiles) {
+    const validated2 = validateJson(ConfigProfileSchema, entry);
+    if (!validated2.ok) {
+      push("config-profile", "fail", validated2.message, entry.name);
+      continue;
+    }
+    profileSources.set(entry.name, { name: entry.name, profile: validated2.data });
+    checkPin("config-profile", entry.name, `Configuration profile "${entry.name}"`, validated2.data.launch?.claudeVersion);
+  }
+  const loadProfile = (name) => profileSources.get(name);
+  for (const name of profileSources.keys()) {
+    const linearised = lineariseProfile(name, loadProfile);
+    if (linearised.diagnostics.length === 0) {
+      push("config-profile", "pass", `${name} is valid and its extends chain resolves cleanly.`, name);
+    } else {
+      for (const diagnostic of linearised.diagnostics) {
+        push("config-profile", "fail", diagnostic.message, name);
+      }
+    }
+  }
+  const validProfileNames = new Set(profileSources.keys());
+  const validIdentityNames = /* @__PURE__ */ new Set();
+  for (const entry of params.identities) {
+    const validated2 = validateJson(IdentitySchema, entry);
+    if (!validated2.ok) {
+      push("identity", "fail", validated2.message, entry.name);
+      continue;
+    }
+    validIdentityNames.add(entry.name);
+    const defaultProfile = validated2.data.defaultConfigProfile;
+    if (defaultProfile !== void 0 && !validProfileNames.has(defaultProfile)) {
+      push(
+        "identity",
+        "fail",
+        `Identity "${entry.name}" names configuration profile "${defaultProfile}" as its default, but no such profile exists.`,
+        entry.name
+      );
+    } else {
+      const credential = validated2.data.credential;
+      const cache = credential === void 0 ? { text: "", unreadable: false } : cacheClause(params.credentialCache, `identity ${entry.name}`, credential);
+      push(
+        "identity",
+        cache.unreadable ? "fail" : "pass",
+        `${entry.name} is valid and authenticates with ${credential === void 0 ? "its stored login" : `credential ${describeCredential(credential)}`}${cache.text}.`,
+        entry.name
+      );
+    }
+  }
+  const validatedGlobalConfig = params.globalConfig.raw === void 0 ? void 0 : validateJson(GlobalConfigSchema, params.globalConfig);
+  const pools = validatedGlobalConfig?.ok === true ? validatedGlobalConfig.data.pools ?? {} : {};
+  for (const [poolName, pool] of Object.entries(pools)) {
+    const missing = pool.identities.filter((member) => !validIdentityNames.has(member));
+    if (missing.length === 0) {
+      push("pool", "pass", `${poolName} is valid (${pool.identities.join(", ")}).`, poolName);
+    } else {
+      push("pool", "fail", `Pool "${poolName}" names ${missing.map((member) => `identity "${member}"`).join(" and ")}, which ${missing.length === 1 ? "does" : "do"} not exist.`, poolName);
+    }
+  }
+  const selectionExists = (selector) => {
+    const poolName = poolNameOf(selector);
+    return poolName === void 0 ? validIdentityNames.has(selector) : poolName in pools;
+  };
+  for (const entry of params.providers) {
+    pushProvider(push, entry, params.credentialCache);
+  }
+  if (params.platform !== "darwin" || params.run === void 0) {
+    push("keychain", "pass", "Skipped (not macOS).");
+  } else {
+    for (const entry of params.identities) {
+      const result = lookupKeychainService(params.run, entry.farmRoot);
+      push("keychain", result.found ? "pass" : "warn", result.note, entry.name);
+    }
+  }
+  if (params.directoryRules.raw === void 0) {
+    push("directory-rules", "pass", "No directory-rules.json configured.");
+  } else {
+    const validated2 = validateJson(DirectoryRulesSchema, params.directoryRules);
+    if (!validated2.ok) {
+      push("directory-rules", "fail", validated2.message);
+    } else {
+      push("directory-rules", "pass", `${params.directoryRules.path} is valid.`);
+      for (const rule of validated2.data.rules) {
+        const badRefs = [];
+        if (rule.identity !== void 0 && !selectionExists(rule.identity)) {
+          badRefs.push(poolNameOf(rule.identity) === void 0 ? `identity "${rule.identity}"` : `pool "${poolNameOf(rule.identity) ?? ""}"`);
+        }
+        if (rule.configProfile !== void 0 && !validProfileNames.has(rule.configProfile)) {
+          badRefs.push(`configuration profile "${rule.configProfile}"`);
+        }
+        checkPin("directory-rules", rule.path, `Rule for "${rule.path}"`, rule.launch?.claudeVersion);
+        if (badRefs.length > 0) {
+          push("directory-rules", "fail", `Rule for "${rule.path}" names ${badRefs.join(" and ")}, which do not exist.`, rule.path);
+        } else {
+          push("directory-rules", "pass", `Rule for "${rule.path}" is valid.`, rule.path);
+        }
+      }
+    }
+  }
+  if (params.globalConfig.raw === void 0) {
+    push("global-config", "pass", "No config.json configured.");
+  } else {
+    const validated2 = validateJson(GlobalConfigSchema, params.globalConfig);
+    if (!validated2.ok) {
+      push("global-config", "fail", validated2.message);
+    } else {
+      const defaultProfile = validated2.data.defaultConfigProfile;
+      if (defaultProfile !== void 0 && !validProfileNames.has(defaultProfile)) {
+        push(
+          "global-config",
+          "fail",
+          `config.json names configuration profile "${defaultProfile}" as its default, but no such profile exists.`
+        );
+      } else {
+        push("global-config", "pass", `${params.globalConfig.path} is valid.`);
+        checkPin("global-config", void 0, "config.json", validated2.data.launch?.claudeVersion);
+      }
+    }
+  }
+  if (params.categoriesLocal.raw === void 0) {
+    push("categories-local", "pass", "No categories.local.json configured.");
+  } else {
+    const validated2 = validateJson(CategoryClassificationOverlaySchema, params.categoriesLocal);
+    push(
+      "categories-local",
+      validated2.ok ? "pass" : "fail",
+      validated2.ok ? `${params.categoriesLocal.path} is valid.` : validated2.message
+    );
+  }
+  if (params.headroom.state.raw === void 0) {
+    push("headroom", "pass", "No headroom daemon has ever run; nothing to check.");
+  } else {
+    const validated2 = validateJson(HeadroomStateSchema, params.headroom.state);
+    if (!validated2.ok) {
+      push("headroom", "fail", validated2.message);
+    } else {
+      const state = validated2.data;
+      const supervisorAlive = state.supervisorPid !== void 0 && params.headroom.isRunning(state.supervisorPid);
+      const headroomAlive = state.headroomPid !== void 0 && params.headroom.isRunning(state.headroomPid);
+      if (state.supervisorPid === void 0) {
+        if (state.lastError === void 0) {
+          push("headroom", "pass", "Headroom daemon is stopped (idle shutdown) with no recorded error.");
+        } else {
+          push("headroom", "warn", `Headroom supervisor is not running; last error: ${state.lastError}`);
+        }
+      } else if (!supervisorAlive) {
+        push(
+          "headroom",
+          "warn",
+          `Headroom state names supervisor pid ${String(state.supervisorPid)}, which is not running; the next launch through headroom will start a replacement.`
+        );
+      } else if (state.headroomPid === void 0 || state.socketPath === void 0) {
+        push(
+          "headroom",
+          "warn",
+          state.lastError === void 0 ? "Headroom supervisor is running but the daemon has no healthy process; it should be restarting it." : `Headroom supervisor is running but the daemon is down; last error: ${state.lastError}`
+        );
+      } else if (!headroomAlive) {
+        push(
+          "headroom",
+          "warn",
+          `Headroom state names daemon pid ${String(state.headroomPid)}, which is not running; its supervisor should be restarting it.`
+        );
+      } else {
+        push(
+          "headroom",
+          "pass",
+          `Headroom daemon is up on unix socket ${state.socketPath} (supervisor ${String(state.supervisorPid)}, daemon ${String(state.headroomPid)}).`
+        );
+      }
+      if (state.lastError !== void 0 && supervisorAlive) {
+        push("headroom", "warn", `Headroom recorded a previous error: ${state.lastError}`);
+      }
+      if (state.installedSource !== void 0 && isMovingGitSource(state.installedSource)) {
+        push(
+          "headroom",
+          "warn",
+          `Headroom is installed from a git ref that can move (${state.installedSource}); pin headroom.source to a full commit SHA so a rebased or deleted branch cannot change or break the install.`
+        );
+      }
+    }
+  }
+  if (params.activeIdentity.raw === void 0) {
+    push("active-identity", "pass", "No active identity set.");
+  } else {
+    const trimmed = params.activeIdentity.raw.trim();
+    if (trimmed === "") {
+      push("active-identity", "warn", "active-identity is present but empty \u2014 treated the same as unset.");
+    } else if (!selectionExists(trimmed)) {
+      push("active-identity", "fail", `active-identity names "${trimmed}", which does not exist.`);
+    } else {
+      push("active-identity", "pass", `Active identity "${trimmed}" is valid.`);
+    }
+  }
+  return { findings, ok: !findings.some((finding) => finding.severity === "fail") };
+}
+var SECTION_TITLES = {
+  "ambient-credential": "Ambient-credential exposure",
+  "binary-discovery": "Claude Code binary discovery",
+  "claude-shim": "`claude` command shim",
+  "path-resolution": "PATH resolution",
+  "legacy-name": "Former `claude-use` name",
+  "config-profile": "Configuration profiles",
+  identity: "Identities",
+  pool: "Pools",
+  provider: "Providers",
+  keychain: "macOS Keychain",
+  "directory-rules": "Directory rules",
+  "global-config": "Global config",
+  headroom: "Headroom daemon",
+  "categories-local": "categories.local.json",
+  "active-identity": "Active identity"
+};
+var SECTION_ORDER = [
+  "ambient-credential",
+  "binary-discovery",
+  "claude-shim",
+  "path-resolution",
+  "config-profile",
+  "identity",
+  "pool",
+  "provider",
+  "keychain",
+  "directory-rules",
+  "global-config",
+  "headroom",
+  "categories-local",
+  "active-identity"
+];
+function severityPrefix(severity) {
+  switch (severity) {
+    case "pass":
+      return "[PASS]";
+    case "warn":
+      return "[WARN]";
+    case "fail":
+      return "[FAIL]";
+    default:
+      return severity;
+  }
+}
+function formatDoctorReport(report) {
+  const lines = [];
+  for (const section of SECTION_ORDER) {
+    const sectionFindings = report.findings.filter((finding) => finding.section === section);
+    if (sectionFindings.length === 0) {
+      continue;
+    }
+    lines.push("", `${SECTION_TITLES[section]}:`);
+    for (const finding of sectionFindings) {
+      const subject = finding.subject === void 0 ? "" : `${finding.subject}: `;
+      lines.push(`  ${severityPrefix(finding.severity)} ${subject}${finding.message}`);
+    }
+  }
+  const failCount = report.findings.filter((finding) => finding.severity === "fail").length;
+  lines.push("", report.ok ? "All checks passed." : `${String(failCount)} check(s) failed.`);
+  return lines;
+}
+function realpathOrSelf(target) {
+  try {
+    return import_node_fs12.default.realpathSync(target);
+  } catch {
+    return target;
+  }
+}
+function collectDoctorReport(params) {
+  const { paths } = params;
+  const identityNames = import_node_fs12.default.existsSync(paths.identitiesDir) ? import_node_fs12.default.readdirSync(paths.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && isIdentityDirectoryName(entry.name)).map((entry) => entry.name).sort() : [];
+  const identities = identityNames.map((name) => {
+    const farmRoot = import_node_path32.default.join(paths.identitiesDir, name);
+    const identityPath = import_node_path32.default.join(farmRoot, "identity.json");
+    return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot };
+  });
+  const profileNames = import_node_fs12.default.existsSync(paths.configProfilesDir) ? import_node_fs12.default.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
+  const configProfiles = profileNames.map((name) => {
+    const profilePath = import_node_path32.default.join(paths.configProfilesDir, `${name}.json`);
+    return { name, path: profilePath, raw: realFsPort.readFileUtf8(profilePath) };
+  });
+  const providerNames = import_node_fs12.default.existsSync(paths.providersDir) ? import_node_fs12.default.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
+  const providers = providerNames.map((name) => {
+    const providerPath = import_node_path32.default.join(paths.providersDir, `${name}.json`);
+    return { name, path: providerPath, raw: realFsPort.readFileUtf8(providerPath) };
+  });
+  const ownExecutablePath = realOwnExecutablePath();
+  let binaryDiscovery;
+  try {
+    const binary = realResolveClaudeBinary(resolveOwnBinaryCheck(paths, realContentSourcePath()))();
+    binaryDiscovery = { ok: true, binary };
+  } catch (error62) {
+    binaryDiscovery = { ok: false, message: error62 instanceof Error ? error62.message : String(error62) };
+  }
+  const shimState = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
+  const pathDirs = (params.env.PATH ?? "").split(import_node_path32.default.delimiter).filter((dir) => dir !== "");
+  const claudeShimShadow = shimState === void 0 ? void 0 : refinePathShadow(
+    findPathShadow({
+      pathDirs,
+      targetDir: import_node_path32.default.dirname(shimState.targetPath),
+      targetFilename: import_node_path32.default.basename(shimState.targetPath),
+      findExecutableInDir
+    }),
+    shimState.targetPath,
+    realpathOrSelf
+  );
+  const report = runDoctor({
+    env: params.env,
+    credentialCache: realCredentialCacheEnv(paths),
+    installedClaudeVersions: realInstalledClaudeVersions(),
+    identities,
+    configProfiles,
+    providers,
+    directoryRules: { path: paths.directoryRulesFile, raw: realFsPort.readFileUtf8(paths.directoryRulesFile) },
+    globalConfig: { path: paths.globalConfigFile, raw: realFsPort.readFileUtf8(paths.globalConfigFile) },
+    categoriesLocal: { path: paths.categoriesLocalFile, raw: realFsPort.readFileUtf8(paths.categoriesLocalFile) },
+    activeIdentity: { path: paths.activeIdentityFile, raw: realFsPort.readFileUtf8(paths.activeIdentityFile) },
+    binaryDiscovery,
+    claudeShim: { state: shimState, targetExists: shimState !== void 0 && import_node_fs12.default.existsSync(shimState.targetPath) },
+    rootPath: paths.root,
+    pathResolution: {
+      ownExecutablePath,
+      agentShim: refinePathShadow(
+        findPathShadow({
+          pathDirs,
+          targetDir: import_node_path32.default.dirname(ownExecutablePath),
+          targetFilename: commandFilename(ownExecutablePath, "agent-shim"),
+          findExecutableInDir
+        }),
+        ownExecutablePath,
+        realpathOrSelf
+      ),
+      ...claudeShimShadow === void 0 ? {} : { claude: claudeShimShadow }
+    },
+    run: realRunPort,
+    platform: process.platform,
+    headroom: {
+      state: { path: paths.headroomStateFile, raw: realFsPort.readFileUtf8(paths.headroomStateFile) },
+      isRunning: realIsProcessRunning
+    }
+  });
+  return report;
+}
+
 // node_modules/.pnpm/radash@12.1.1/node_modules/radash/dist/esm/async.mjs
 var guard = (func, shouldGuard) => {
   const _guard = (err) => {
@@ -68064,9 +68622,9 @@ function resolveFriendlyClientOptions(options) {
   };
 }
 function createORPCClient(link, options = {}) {
-  const path43 = options.path ?? [];
+  const path44 = options.path ?? [];
   const procedureClient = async (...[input2, options2 = {}]) => {
-    return await link.call(path43, input2, resolveFriendlyClientOptions(options2));
+    return await link.call(path44, input2, resolveFriendlyClientOptions(options2));
   };
   const recursive2 = new Proxy(procedureClient, {
     get(target, key) {
@@ -68075,13 +68633,243 @@ function createORPCClient(link, options = {}) {
       }
       return createORPCClient(link, {
         ...options,
-        path: [...path43, key]
+        path: [...path44, key]
       });
     }
   });
   return preventNativeAwait(recursive2);
 }
 
+// src/resolve/types.ts
+var LAYER_KINDS = [
+  "global-config",
+  "config-profile",
+  "directory-rule",
+  "portable",
+  "portable-local",
+  "cli-override"
+];
+var DECISION_VIAS = [
+  /** The unconditional pre-cascade floor: the path's real classification is `secret`. */
+  "secret-floor",
+  /** Nothing in the classification map recognises the path's top-level entry. */
+  "unclassified",
+  /** An entries rule matched and its condition (if any) held. */
+  "entry-rule",
+  /** No entries rule survived; a layer's category toggle decided it. */
+  "category-override",
+  /** No entries rule and no category toggle; the shipped default for the category decided it. */
+  "category-default"
+];
+var DIAGNOSTIC_CODES = [
+  /** A profile's `extends` graph contains a cycle. */
+  "EXTENDS_CYCLE",
+  /** An `extends` entry names a profile that does not exist. */
+  "MISSING_PROFILE",
+  /** An entries key was written under the `secret/` prefix. Rejected at compile time — `secret` can never be overridden by any layer. */
+  "SECRET_ENTRY_KEY",
+  /** An entries key under some other prefix matched a path whose real classification is `secret`. Neutralised at resolve time by the floor check. */
+  "SECRET_PATH_NEUTRALISED",
+  /** An entries key's declared category prefix disagrees with the real classification of a path it matched. */
+  "CATEGORY_PREFIX_MISMATCH",
+  /** An entries key is not of the form `<category>/<path>`. The schema rejects these at parse time; this fires only for a layer built in code. */
+  "MALFORMED_ENTRY_KEY",
+  /** An earlier layer's exact key lost to a later layer's glob. Correct per the comparator, but worth surfacing rather than resolving silently. */
+  "EXACT_ENTRY_OVERRIDDEN_BY_LATER_GLOB",
+  /** A `history/projects/` pattern's encoded form could plausibly correspond to more than one real path. */
+  "AMBIGUOUS_PROJECT_ENCODING",
+  /** A `history/projects/` key's path fragment is neither home-rooted nor absolute, so it cannot be encoded. */
+  "UNROOTED_PROJECT_PATH",
+  /** A `~/.claude` entry nothing in the classification map recognises. */
+  "UNCLASSIFIED_ENTRY",
+  /** An empty `when: {}` object, which is vacuously true and therefore has no effect. */
+  "EMPTY_WHEN",
+  /** The previous farm's manifest is missing or unreadable, so reconciliation ran in conservative mode. */
+  "FARM_MANIFEST_MISSING",
+  /** A file Claude Code wrote into a materialised farm directory differs from the canonical copy of the same path. */
+  "RECONCILE_CONFLICT",
+  /** Reconciliation proposed adopting a path whose real classification is `secret`. Refused: the secret floor applies to data moving into `~/.claude` exactly as it applies to data moving out. */
+  "RECONCILE_SECRET_BLOCKED",
+  /** A previous launch was interrupted mid-swap and this launch completed or undid the half-finished work. */
+  "FARM_SWAP_RECOVERED",
+  /** A superseded farm could not be discarded because it still held data the new farm has its own entry for, so it was left on disk for the user to look at. */
+  "FARM_PREVIOUS_RETAINED"
+];
+var DIAGNOSTIC_SEVERITIES = ["error", "warning", "info"];
+
+// src/usage/pickReportSchema.ts
+var PoolPickCandidateViewSchema = external_exports.strictObject({
+  identity: external_exports.string(),
+  /** In pick order: `scored` has usable quota data, `unknown` has none, `pay-per-use` bills by use, `ineligible` is refused right now. */
+  class: external_exports.enum(["scored", "unknown", "pay-per-use", "ineligible"]),
+  /** Plan-size-weighted remaining quota per hour until its reset; present for `scored` only. */
+  score: external_exports.number().optional(),
+  /** False when the five-hour window would run dry, at the observed pace, before it resets. */
+  feasible: external_exports.boolean(),
+  /** When an `ineligible` member can be used again, as an ISO instant. */
+  blockedUntil: external_exports.iso.datetime().optional(),
+  plan: PlanClassSchema,
+  /** The facts behind the class and score, in the order they matter. */
+  reasons: external_exports.array(external_exports.string())
+});
+var PoolPickReportSchema = external_exports.strictObject({
+  pool: external_exports.string(),
+  directory: external_exports.string(),
+  /** The member a launch would run as, absent when every member is refused. */
+  pick: external_exports.string().optional(),
+  candidates: external_exports.array(PoolPickCandidateViewSchema),
+  /** Members that name an identity that does not exist; a launch skips them. */
+  missing: external_exports.array(external_exports.string()),
+  /** When nothing can be picked, the soonest any member returns. */
+  earliestReturn: external_exports.strictObject({ identity: external_exports.string(), at: external_exports.iso.datetime() }).optional(),
+  /** Why the last-pick record could not be read, when that is the case. */
+  stickyProblem: external_exports.string().optional()
+});
+
+// src/checkReportSchema.ts
+var CHECK_CREDENTIAL_APPLIES = ["provider", "identity", "stored-login"];
+var CheckLayerViewSchema = external_exports.strictObject({
+  id: external_exports.int(),
+  kind: external_exports.enum(LAYER_KINDS),
+  source: external_exports.string()
+});
+var CheckEntryViewSchema = external_exports.strictObject({
+  path: external_exports.string(),
+  shared: external_exports.boolean(),
+  via: external_exports.enum(DECISION_VIAS),
+  /** The entry's real category, or null when nothing classifies it. */
+  category: external_exports.enum(CATEGORY_NAMES).nullable(),
+  rule: external_exports.strictObject({ key: external_exports.string(), layer: external_exports.int() }).optional(),
+  /** Rules that matched but whose `when` condition failed, each with the conditions that failed. */
+  eliminated: external_exports.readonly(external_exports.array(external_exports.strictObject({ key: external_exports.string(), failed: external_exports.readonly(external_exports.array(external_exports.string())) }))).optional()
+});
+var CheckDiagnosticSchema = external_exports.strictObject({
+  code: external_exports.enum(DIAGNOSTIC_CODES),
+  severity: external_exports.enum(DIAGNOSTIC_SEVERITIES),
+  message: external_exports.string(),
+  subject: external_exports.string().optional(),
+  layer: external_exports.int().optional()
+});
+var CheckAmbientCredentialSchema = external_exports.union([external_exports.strictObject({ ok: external_exports.literal(true) }), external_exports.strictObject({ ok: external_exports.literal(false), variable: external_exports.string(), message: external_exports.string() })]);
+var CheckKeychainSchema = external_exports.strictObject({
+  checked: external_exports.literal(true),
+  found: external_exports.boolean(),
+  serviceName: external_exports.string().optional(),
+  note: external_exports.string()
+});
+var CheckSettingsExposureSchema = external_exports.strictObject({
+  file: external_exports.string(),
+  envKeyNames: external_exports.readonly(external_exports.array(external_exports.string())),
+  hookEventNames: external_exports.readonly(external_exports.array(external_exports.string())),
+  hookCommandCount: external_exports.int().nonnegative()
+});
+var CredentialSourceSummarySchema = external_exports.union([
+  external_exports.strictObject({ kind: external_exports.literal("env"), variable: external_exports.string() }),
+  external_exports.strictObject({ kind: external_exports.literal("file"), path: external_exports.string() }),
+  external_exports.strictObject({ kind: external_exports.literal("command"), program: external_exports.string() }),
+  external_exports.strictObject({ kind: external_exports.literal("op"), reference: external_exports.string() }),
+  external_exports.strictObject({ kind: external_exports.literal("keychain"), service: external_exports.string(), account: external_exports.string().optional() }),
+  external_exports.strictObject({ kind: external_exports.literal("literal") })
+]);
+var CredentialSummarySchema = external_exports.strictObject({
+  target: external_exports.enum(CREDENTIAL_TARGETS),
+  sources: external_exports.readonly(external_exports.array(CredentialSourceSummarySchema)),
+  cache: CredentialCacheSchema.optional()
+});
+var CachedCredentialStateSchema = external_exports.union([
+  external_exports.strictObject({ store: external_exports.enum(CREDENTIAL_CACHE_STORES), status: external_exports.literal("empty") }),
+  external_exports.strictObject({ store: external_exports.enum(CREDENTIAL_CACHE_STORES), status: external_exports.literal("unreadable"), reason: external_exports.string() }),
+  external_exports.strictObject({ store: external_exports.enum(CREDENTIAL_CACHE_STORES), status: external_exports.enum(["fresh", "expired"]), ageMs: external_exports.number(), expiresInMs: external_exports.number().optional() })
+]);
+var CheckCredentialProviderSchema = external_exports.union([
+  external_exports.strictObject({ name: external_exports.string(), credential: CredentialSummarySchema, cached: CachedCredentialStateSchema.optional() }),
+  external_exports.strictObject({ name: external_exports.string(), problem: external_exports.string() })
+]);
+var CheckCredentialSchema = external_exports.strictObject({
+  applies: external_exports.enum(CHECK_CREDENTIAL_APPLIES),
+  provider: CheckCredentialProviderSchema.optional(),
+  identity: CredentialSummarySchema.optional(),
+  identityCached: CachedCredentialStateSchema.optional()
+});
+var CheckClaudeVersionSchema = external_exports.strictObject({
+  pinned: external_exports.strictObject({ version: external_exports.string(), source: external_exports.enum(CLAUDE_VERSION_SOURCES), installed: external_exports.boolean() }).optional(),
+  highestInstalled: external_exports.string().optional(),
+  installed: external_exports.readonly(external_exports.array(external_exports.string()))
+});
+var CheckReportJsonSchema = external_exports.strictObject({
+  identity: external_exports.strictObject({ name: external_exports.string().nullable(), source: external_exports.enum(IDENTITY_DECISION_SOURCES) }),
+  /** The pool ranking, when the launch named a pool instead of an identity. */
+  pool: PoolPickReportSchema.optional(),
+  configProfile: external_exports.strictObject({ name: external_exports.string().nullable(), source: external_exports.enum(CONFIG_PROFILE_DECISION_SOURCES) }),
+  layers: external_exports.readonly(external_exports.array(CheckLayerViewSchema)),
+  entries: external_exports.readonly(external_exports.array(CheckEntryViewSchema)),
+  projectEncodingAmbiguities: external_exports.readonly(
+    external_exports.array(external_exports.strictObject({ fragment: external_exports.string(), encoded: external_exports.string(), reason: external_exports.enum(ENCODING_AMBIGUITY_REASONS), detail: external_exports.string() }))
+  ),
+  diagnostics: external_exports.readonly(external_exports.array(CheckDiagnosticSchema)),
+  ambientCredential: CheckAmbientCredentialSchema,
+  keychain: CheckKeychainSchema.optional(),
+  settingsExposure: external_exports.readonly(external_exports.array(CheckSettingsExposureSchema)),
+  credential: CheckCredentialSchema,
+  claudeVersion: CheckClaudeVersionSchema.optional()
+});
+
+// src/frontdoor/controlSchemas.ts
+var import_node_path33 = __toESM(require("node:path"), 1);
+var UsageListOutputSchema = external_exports.strictObject({ snapshots: external_exports.readonly(external_exports.array(UsageSnapshotSchema)) });
+var UsageWindowsInputSchema = external_exports.strictObject({
+  identity: external_exports.string().min(1),
+  provider: external_exports.string().min(1).optional()
+});
+var EffectiveWindowSchema = external_exports.strictObject({
+  /** True when the window's reset time has passed, so the recorded observation describes a window that no longer exists. */
+  reset: external_exports.boolean(),
+  /** The fraction used: 0 for a reset window, otherwise what was last observed, absent when none was reported. */
+  utilization: external_exports.number().optional(),
+  /** The reset instant, for a window that has not reset yet and reported one. */
+  resetsAtMs: external_exports.number().optional(),
+  /** The window's own status, for a window that has not reset yet. */
+  status: external_exports.string().optional()
+});
+var UsageWindowsOutputSchema = external_exports.strictObject({
+  identity: external_exports.string(),
+  provider: external_exports.string(),
+  /** When the rate-limit state the windows come from was observed. */
+  observedAt: external_exports.iso.datetime().optional(),
+  fiveHour: EffectiveWindowSchema.optional(),
+  sevenDay: EffectiveWindowSchema.optional()
+});
+var FrontDoorSessionStatusSchema = external_exports.strictObject({
+  pid: external_exports.int().positive(),
+  startedAt: external_exports.number(),
+  alive: external_exports.boolean()
+});
+var HeadroomSocketTargetSchema = external_exports.union([external_exports.strictObject({ socketPath: external_exports.string() }), external_exports.strictObject({ refused: external_exports.string() })]);
+var FrontDoorStatusOutputSchema = external_exports.strictObject({
+  state: FrontDoorStateSchema,
+  supervisorAlive: external_exports.boolean(),
+  sessions: external_exports.readonly(external_exports.array(FrontDoorSessionStatusSchema)),
+  headroomSocket: HeadroomSocketTargetSchema.optional(),
+  logPath: external_exports.string(),
+  logExists: external_exports.boolean()
+});
+var FrontDoorSessionsOutputSchema = external_exports.strictObject({ sessions: external_exports.readonly(external_exports.array(FrontDoorSessionStatusSchema)) });
+var CheckRunInputSchema = external_exports.strictObject({
+  path: external_exports.string().min(1),
+  identity: external_exports.string().min(1).optional()
+}).refine((input2) => import_node_path33.default.isAbsolute(input2.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+var DoctorFindingSchema = external_exports.strictObject({
+  section: external_exports.enum(DOCTOR_SECTIONS),
+  subject: external_exports.string().optional(),
+  severity: external_exports.enum(DOCTOR_SEVERITIES),
+  message: external_exports.string()
+});
+var DoctorRunOutputSchema = external_exports.strictObject({
+  /** False exactly when any finding is a `fail`; a `warn` never fails the report on its own. */
+  ok: external_exports.boolean(),
+  findings: external_exports.readonly(external_exports.array(DoctorFindingSchema))
+});
+
 // node_modules/.pnpm/@orpc+standard-server-fetch@1.15.4/node_modules/@orpc/standard-server-fetch/dist/index.mjs
 function toEventIterator(stream, options = {}) {
   const eventStream = stream?.pipeThrough(new TextDecoderStream()).pipeThrough(new EventDecoderStream());
@@ -68377,19 +69165,19 @@ var StandardLink = class {
   }
   interceptors;
   clientInterceptors;
-  call(path43, input2, options) {
+  call(path44, input2, options) {
     return runWithSpan(
-      { name: `${ORPC_NAME}.${path43.join("/")}`, signal: options.signal },
+      { name: `${ORPC_NAME}.${path44.join("/")}`, signal: options.signal },
       (span) => {
         span?.setAttribute("rpc.system", ORPC_NAME);
-        span?.setAttribute("rpc.method", path43.join("."));
+        span?.setAttribute("rpc.method", path44.join("."));
         if (isAsyncIteratorObject(input2)) {
           input2 = asyncIteratorWithSpan(
             { name: "consume_event_iterator_input", signal: options.signal },
             input2
           );
         }
-        return intercept(this.interceptors, { ...options, path: path43, input: input2 }, async ({ path: path210, input: input22, ...options2 }) => {
+        return intercept(this.interceptors, { ...options, path: path44, input: input2 }, async ({ path: path210, input: input22, ...options2 }) => {
           const otelConfig = getGlobalOtelConfig();
           let otelContext;
           const currentSpan = otelConfig?.trace.getActiveSpan() ?? span;
@@ -68624,8 +69412,8 @@ var StandardRPCJsonSerializer = class {
     return ref.data;
   }
 };
-function toHttpPath(path43) {
-  return `/${path43.map(encodeURIComponent).join("/")}`;
+function toHttpPath(path44) {
+  return `/${path44.map(encodeURIComponent).join("/")}`;
 }
 function toStandardHeaders2(headers) {
   if (typeof headers.forEach === "function") {
@@ -68650,18 +69438,18 @@ var StandardRPCLinkCodec = class {
   fallbackMethod;
   expectedMethod;
   headers;
-  async encode(path43, input2, options) {
-    let headers = toStandardHeaders2(await value(this.headers, options, path43, input2));
+  async encode(path44, input2, options) {
+    let headers = toStandardHeaders2(await value(this.headers, options, path44, input2));
     if (options.lastEventId !== void 0) {
       headers = mergeStandardHeaders(headers, { "last-event-id": options.lastEventId });
     }
-    const expectedMethod = await value(this.expectedMethod, options, path43, input2);
-    const baseUrl = await value(this.baseUrl, options, path43, input2);
+    const expectedMethod = await value(this.expectedMethod, options, path44, input2);
+    const baseUrl = await value(this.baseUrl, options, path44, input2);
     const url2 = new URL(baseUrl);
-    url2.pathname = `${url2.pathname.replace(/\/$/, "")}${toHttpPath(path43)}`;
+    url2.pathname = `${url2.pathname.replace(/\/$/, "")}${toHttpPath(path44)}`;
     const serialized = this.serializer.serialize(input2);
     if (expectedMethod === "GET" && !(serialized instanceof FormData) && !isAsyncIteratorObject(serialized)) {
-      const maxUrlLength = await value(this.maxUrlLength, options, path43, input2);
+      const maxUrlLength = await value(this.maxUrlLength, options, path44, input2);
       const getUrl = new URL(url2);
       getUrl.searchParams.append("data", stringifyJSON(serialized));
       if (getUrl.toString().length <= maxUrlLength) {
@@ -68812,11 +69600,11 @@ var LinkFetchClient = class {
     this.toFetchRequestOptions = options;
     this.adapterInterceptors = toArray(options.adapterInterceptors);
   }
-  async call(standardRequest, options, path43, input2) {
+  async call(standardRequest, options, path44, input2) {
     const request7 = toFetchRequest(standardRequest, this.toFetchRequestOptions);
     const fetchResponse = await intercept(
       this.adapterInterceptors,
-      { ...options, request: request7, path: path43, input: input2, init: { redirect: "manual" } },
+      { ...options, request: request7, path: path44, input: input2, init: { redirect: "manual" } },
       ({ request: request22, path: path210, input: input22, init, ...options2 }) => this.fetch(request22, init, options2, path210, input22)
     );
     const lazyResponse = toStandardLazyResponse(fetchResponse, { signal: request7.signal });
@@ -69216,7 +70004,7 @@ function middlewareOutputFn(output2) {
 function createProcedureClient(lazyableProcedure, ...rest) {
   const options = resolveMaybeOptionalOptions(rest);
   return async (...[input2, callerOptions]) => {
-    const path43 = toArray(options.path);
+    const path44 = toArray(options.path);
     const { default: procedure } = await unlazy(lazyableProcedure);
     const clientContext = callerOptions?.context ?? {};
     const context = await value(options.context ?? {}, clientContext);
@@ -69231,7 +70019,7 @@ function createProcedureClient(lazyableProcedure, ...rest) {
       const output2 = await runWithSpan(
         { name: "call_procedure", signal: callerOptions?.signal },
         (span) => {
-          span?.setAttribute("procedure.path", [...path43]);
+          span?.setAttribute("procedure.path", [...path44]);
           return intercept(
             toArray(options.interceptors),
             {
@@ -69239,7 +70027,7 @@ function createProcedureClient(lazyableProcedure, ...rest) {
               input: input2,
               // input only optional when it undefinable so we can safely cast it
               errors,
-              path: path43,
+              path: path44,
               procedure,
               signal: callerOptions?.signal,
               lastEventId: callerOptions?.lastEventId
@@ -69361,10 +70149,10 @@ var HIDDEN_ROUTER_CONTRACT_SYMBOL = /* @__PURE__ */ Symbol("ORPC_HIDDEN_ROUTER_C
 function getHiddenRouterContract(router) {
   return router[HIDDEN_ROUTER_CONTRACT_SYMBOL];
 }
-function getRouter(router, path43) {
+function getRouter(router, path44) {
   let current = router;
-  for (let i2 = 0; i2 < path43.length; i2++) {
-    const segment = path43[i2];
+  for (let i2 = 0; i2 < path44.length; i2++) {
+    const segment = path44[i2];
     if (!current) {
       return void 0;
     }
@@ -69379,7 +70167,7 @@ function getRouter(router, path43) {
       continue;
     }
     const lazied = current;
-    const rest = path43.slice(i2);
+    const rest = path44.slice(i2);
     return lazy2(async () => {
       const unwrapped = await unlazy(lazied);
       const next = getRouter(unwrapped.default, rest);
@@ -69957,8 +70745,8 @@ function toAbortSignal(stream) {
 function toStandardUrl(req) {
   const protocol = "encrypted" in req.socket && req.socket.encrypted ? "https:" : "http:";
   const origin = guard(() => new URL(`${protocol}//${req.headers.host ?? "localhost"}`).origin) ?? `${protocol}//localhost`;
-  const path43 = req.originalUrl ?? req.url ?? "/";
-  return new URL(`${origin}${path43.startsWith("/") ? "" : "/"}${path43}`);
+  const path44 = req.originalUrl ?? req.url ?? "/";
+  return new URL(`${origin}${path44.startsWith("/") ? "" : "/"}${path44}`);
 }
 function toStandardLazyRequest(req, res) {
   const signal = toAbortSignal(res);
@@ -70157,8 +70945,8 @@ var StandardRPCMatcher = class {
   constructor(options = {}) {
     this.filter = options.filter ?? true;
   }
-  init(router, path43 = []) {
-    const laziedOptions = traverseContractProcedures({ router, path: path43 }, (traverseOptions) => {
+  init(router, path44 = []) {
+    const laziedOptions = traverseContractProcedures({ router, path: path44 }, (traverseOptions) => {
       if (!value(this.filter, traverseOptions)) {
         return;
       }
@@ -70436,16 +71224,19 @@ var RcAnswerOutputSchema = external_exports.strictObject({
 // src/frontdoor/rcApi.ts
 var RC_ORPC_PATH_PREFIX = "/__agent-shim/orpc";
 var RC_SUBSCRIBER_BUFFER_EVENTS = 100;
-function createRcApiRouter(deps) {
-  const authed = os7.$context().use(({ context, next }) => {
+function doorApiAuth(expectedToken) {
+  return os7.$context().use(({ context, next }) => {
     const presented = context.headers.authorization;
     const bearerPrefix = "bearer ".length;
     const token = typeof presented === "string" && presented.slice(0, bearerPrefix).toLowerCase() === "bearer " ? presented.slice(bearerPrefix) : void 0;
-    if (token === void 0 || !isLiveCapability(token, [deps.expectedToken])) {
+    if (token === void 0 || !isLiveCapability(token, [expectedToken])) {
       throw new ORPCError("UNAUTHORIZED", { message: "the front door's typed API demands this generation's control token as a Bearer credential" });
     }
     return next();
   });
+}
+function createRcApiRouter(deps) {
+  const authed = doorApiAuth(deps.expectedToken);
   const delivered = (sessionId, result) => {
     if (!result.ok) {
       throw new ORPCError("BAD_GATEWAY", { message: result.message });
@@ -70514,16 +71305,16 @@ function createRcApiRouter(deps) {
     }
   };
 }
-function createRcApiNodeHandler(deps) {
-  const handler = new RPCHandler(createRcApiRouter(deps), { plugins: [new BodyLimitPlugin({ maxBodySize: CONTROL_BODY_CAP_BYTES })] });
+function doorApiNodeHandlerOf(router) {
+  const handler = new RPCHandler(router, { plugins: [new BodyLimitPlugin({ maxBodySize: CONTROL_BODY_CAP_BYTES })] });
   return {
     pathPrefix: RC_ORPC_PATH_PREFIX,
     handle: async (request7, response) => await handler.handle(request7, response, { context: { headers: request7.headers }, prefix: RC_ORPC_PATH_PREFIX })
   };
 }
-function frontDoorRcApiClient(port, ca, token) {
+function frontDoorApiLink(port, ca, token) {
   const dispatcher = new import_undici2.Agent({ connect: { ca } });
-  const link = new RPCLink({
+  return new RPCLink({
     url: `https://127.0.0.1:${String(port)}${RC_ORPC_PATH_PREFIX}`,
     headers: { authorization: `Bearer ${token}` },
     // undici's own Request and Response types and the global ones are distinct declarations of the same standard shapes (the package's bundled types sit beside @types/node's own), and its fetch refuses the global Request instance outright, so the call is rebuilt from the request's parts and the answer re-wrapped through the global constructors, never cast between the two. The request body is one bounded JSON object (the same protocol cap the handler enforces), so reading it whole costs nothing; it is the answer that streams.
@@ -70539,7 +71330,53 @@ function frontDoorRcApiClient(port, ca, token) {
       return new Response(answered.body, { status: answered.status, statusText: answered.statusText, headers: [...answered.headers] });
     }
   });
-  return createORPCClient(link);
+}
+function frontDoorRcApiClient(port, ca, token) {
+  return createORPCClient(frontDoorApiLink(port, ca, token));
+}
+
+// src/frontdoor/controlApi.ts
+function createControlApiRouter(deps) {
+  const authed = doorApiAuth(deps.expectedToken);
+  return {
+    usage: {
+      list: authed.output(UsageListOutputSchema).handler(() => ({ snapshots: deps.usageSnapshots() })),
+      effectiveWindow: authed.input(UsageWindowsInputSchema).output(UsageWindowsOutputSchema).handler(({ input: input2 }) => {
+        const snapshot = deps.usageSnapshotOf(input2.identity);
+        if (snapshot === void 0) {
+          throw new ORPCError("NOT_FOUND", { message: `identity ${input2.identity} has no usage snapshot yet, so no quota window has been observed for it` });
+        }
+        const provider = input2.provider ?? ANTHROPIC_PROVIDER;
+        const rateLimit = snapshot.providers[provider]?.rateLimit;
+        const unified = rateLimit?.unified;
+        const now = deps.now();
+        return {
+          identity: snapshot.identity,
+          provider,
+          ...rateLimit === void 0 ? {} : { observedAt: rateLimit.observedAt },
+          ...unified?.fiveHour === void 0 ? {} : { fiveHour: effectiveWindow(unified.fiveHour, now) },
+          ...unified?.sevenDay === void 0 ? {} : { sevenDay: effectiveWindow(unified.sevenDay, now) }
+        };
+      })
+    },
+    frontdoor: {
+      status: authed.output(FrontDoorStatusOutputSchema).handler(() => deps.frontDoorStatus()),
+      sessions: authed.output(FrontDoorSessionsOutputSchema).handler(() => ({ sessions: deps.frontDoorStatus().sessions }))
+    },
+    check: {
+      // The report's own JSON shape is the contract (the same one `check --json` prints and `checkReportSchema.ts` defines), so the procedure returns exactly that conversion.
+      run: authed.input(CheckRunInputSchema).output(CheckReportJsonSchema).handler(({ input: input2 }) => checkReportToJson(deps.checkReport(input2.path, input2.identity)))
+    },
+    doctor: {
+      run: authed.output(DoctorRunOutputSchema).handler(() => deps.doctorReport())
+    }
+  };
+}
+function createDoorApiRouter(deps) {
+  return { ...createRcApiRouter(deps), ...createControlApiRouter(deps) };
+}
+function createDoorApiNodeHandler(deps) {
+  return doorApiNodeHandlerOf(createDoorApiRouter(deps));
 }
 
 // src/frontdoor/headroomHop.ts
@@ -71620,8 +72457,8 @@ function createCodexRouteMount(ports, upstreamBase, provider) {
         request7.body.resume();
         return;
       }
-      const path43 = new URL(request7.url, "http://127.0.0.1").pathname;
-      const translated = { method: request7.method, path: path43, body, signal: request7.signal };
+      const path44 = new URL(request7.url, "http://127.0.0.1").pathname;
+      const translated = { method: request7.method, path: path44, body, signal: request7.signal };
       const routed = await route(translated);
       if (request7.signal.aborted) {
         return;
@@ -71655,7 +72492,7 @@ function createPassthroughRoute(name, target) {
     headroomUpstream: target.headroomUpstream,
     serve: async (request7, response) => {
       const incoming = new URL(request7.url, "http://127.0.0.1");
-      const path43 = target.stripPrefix !== void 0 && incoming.pathname.startsWith(target.stripPrefix) ? incoming.pathname.slice(target.stripPrefix.length) : incoming.pathname;
+      const path44 = target.stripPrefix !== void 0 && incoming.pathname.startsWith(target.stripPrefix) ? incoming.pathname.slice(target.stripPrefix.length) : incoming.pathname;
       const headers = forwardableHeaders(request7.headers);
       delete headers.host;
       await new Promise((resolve) => {
@@ -71663,7 +72500,7 @@ function createPassthroughRoute(name, target) {
           host: base.hostname,
           port: base.port === "" ? void 0 : Number(base.port),
           method: request7.method,
-          path: `${basePath}${path43}${incoming.search}`,
+          path: `${basePath}${path44}${incoming.search}`,
           headers,
           agent
         };
@@ -71712,7 +72549,7 @@ function createPassthroughRoute(name, target) {
 
 // src/frontdoor/providerRoute.ts
 function createProviderRouteResolver(deps) {
-  const isRcSelfHostPath = (path43) => path43 === "/v1/code/sessions" || path43.startsWith("/v1/code/sessions/") || path43 === "/v1/sessions" || path43.startsWith("/v1/sessions/");
+  const isRcSelfHostPath = (path44) => path44 === "/v1/code/sessions" || path44.startsWith("/v1/code/sessions/") || path44 === "/v1/sessions" || path44.startsWith("/v1/sessions/");
   const oauthRoute = createPassthroughRoute("anthropic", { baseUrl: `https://${CONNECT_INTERCEPT_HOST}:${String(HTTPS_PORT)}`, stripPrefix: void 0, headroomUpstream: void 0 });
   const passthroughByTarget = /* @__PURE__ */ new Map();
   const passthroughFor = (name, target) => {
@@ -71726,13 +72563,13 @@ function createProviderRouteResolver(deps) {
     return route;
   };
   const resolve = (request7) => {
-    const path43 = new URL(request7.url, "http://127.0.0.1").pathname;
-    const scoped = parseProviderPath(path43);
+    const path44 = new URL(request7.url, "http://127.0.0.1").pathname;
+    const scoped = parseProviderPath(path44);
     if (scoped === void 0) {
-      if (deps.rcSelfHostRoute !== void 0 && isRcSelfHostPath(path43)) {
+      if (deps.rcSelfHostRoute !== void 0 && isRcSelfHostPath(path44)) {
         return { ok: true, route: deps.rcSelfHostRoute };
       }
-      return path43.startsWith("/v1/") ? { ok: true, route: oauthRoute } : { ok: false, status: HTTP_STATUS.notFound, message: `no such endpoint: ${path43}` };
+      return path44.startsWith("/v1/") ? { ok: true, route: oauthRoute } : { ok: false, status: HTTP_STATUS.notFound, message: `no such endpoint: ${path44}` };
     }
     const { provider } = scoped;
     let definition;
@@ -71772,7 +72609,7 @@ function createProviderRouteResolver(deps) {
 }
 
 // src/frontdoor/rcCredentialStore.ts
-var import_node_path32 = __toESM(require("node:path"), 1);
+var import_node_path34 = __toESM(require("node:path"), 1);
 function isSafeSessionId(sessionId) {
   return /^[A-Za-z0-9_-]+$/.test(sessionId);
 }
@@ -71798,7 +72635,7 @@ function sequenceNumOfJson(value2) {
 }
 function createRcCredentialStore(fs19, dir) {
   fs19.mkdirPrivate(dir);
-  const fileFor = (sessionId) => import_node_path32.default.join(dir, `${sessionId}.json`);
+  const fileFor = (sessionId) => import_node_path34.default.join(dir, `${sessionId}.json`);
   const readParsed = (sessionId) => {
     const raw = fs19.readFileUtf8(fileFor(sessionId));
     if (raw === void 0) {
@@ -72448,7 +73285,7 @@ data: ${JSON.stringify(envelope)}
 }
 
 // src/frontdoor/rcSelfHostMint.ts
-var import_node_path33 = __toESM(require("node:path"), 1);
+var import_node_path35 = __toESM(require("node:path"), 1);
 var CREDENTIALS_FILE = ".credentials.json";
 var CLAUDE_JSON2 = ".claude.json";
 var RC_SELF_HOST_RECORD_DIR = "rc-selfhost";
@@ -72472,7 +73309,7 @@ function readJsonObject(fs19, file2) {
   return isRecord6(parsed) ? parsed : void 0;
 }
 function readRcSelfHostRecord(fs19, frontdoorDir) {
-  const parsed = readJsonObject(fs19, import_node_path33.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
+  const parsed = readJsonObject(fs19, import_node_path35.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
   if (parsed === void 0) {
     return void 0;
   }
@@ -72486,11 +73323,11 @@ function mintRcSelfHostCredential(deps) {
   if (!isIdentityName(deps.identity)) {
     throw new Error(`"${deps.identity}" is not a valid identity name.`);
   }
-  const identityDir = import_node_path33.default.join(deps.identitiesDir, deps.identity);
-  const credentialsFile = import_node_path33.default.join(identityDir, CREDENTIALS_FILE);
-  const claudeJsonFile = import_node_path33.default.join(identityDir, CLAUDE_JSON2);
-  const recordDir = import_node_path33.default.join(deps.frontdoorDir, RC_SELF_HOST_RECORD_DIR);
-  const recordFile = import_node_path33.default.join(recordDir, RC_SELF_HOST_RECORD_FILE);
+  const identityDir = import_node_path35.default.join(deps.identitiesDir, deps.identity);
+  const credentialsFile = import_node_path35.default.join(identityDir, CREDENTIALS_FILE);
+  const claudeJsonFile = import_node_path35.default.join(identityDir, CLAUDE_JSON2);
+  const recordDir = import_node_path35.default.join(deps.frontdoorDir, RC_SELF_HOST_RECORD_DIR);
+  const recordFile = import_node_path35.default.join(recordDir, RC_SELF_HOST_RECORD_FILE);
   const previousRecord = readRcSelfHostRecord(deps.fs, deps.frontdoorDir);
   const existingCredentials = readJsonObject(deps.fs, credentialsFile);
   const existingOauth = isRecord6(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
@@ -72506,7 +73343,7 @@ function mintRcSelfHostCredential(deps) {
   const organizationUuid = deps.newUuid();
   const accountUuid = deps.newUuid();
   const mintedAt = new Date(deps.now()).toISOString();
-  deps.fs.mkdirPrivate(import_node_path33.default.dirname(credentialsFile));
+  deps.fs.mkdirPrivate(import_node_path35.default.dirname(credentialsFile));
   deps.fs.writeFilePrivate(credentialsFile, `${JSON.stringify({ ...existingCredentials, claudeAiOauth: { accessToken, refreshToken, expiresAt: null, scopes: [...RC_SELF_HOST_SCOPE_LIST], subscriptionType: SELF_HOST_SUBSCRIPTION_TYPE, rateLimitTier: null } }, null, 2)}
 `);
   const claudeJson = readJsonObject(deps.fs, claudeJsonFile) ?? {};
@@ -72818,6 +73655,59 @@ function createRcStreamHub(deps) {
   };
 }
 
+// src/frontdoor/status.ts
+function headroomSocketTarget(fsPort, trust, paths) {
+  const socketPath = readHeadroomState(fsPort, paths.headroomStateFile)?.socketPath;
+  return socketPath === void 0 ? void 0 : verifyHeadroomSocket(socketPath, trust);
+}
+function collectFrontDoorStatus(fsPort, socketTrust, paths, isRunning) {
+  const state = readFrontDoorState(fsPort, paths.frontdoorStateFile) ?? {};
+  return {
+    state,
+    supervisorAlive: state.supervisorPid !== void 0 && isRunning(state.supervisorPid),
+    sessions: listFrontDoorSessions(fsPort, paths.frontdoorSessionsDir).map((session) => ({ ...session, alive: isRunning(session.pid) })),
+    headroomSocket: headroomSocketTarget(fsPort, socketTrust, paths),
+    logPath: paths.frontdoorLogPath,
+    logExists: fsPort.readFileUtf8(paths.frontdoorLogPath) !== void 0
+  };
+}
+function formatFrontDoorStatus(status, caCertPath) {
+  const lines = [];
+  if (status.state.supervisorPid === void 0) {
+    lines.push("supervisor: not running");
+  } else {
+    lines.push(`supervisor: pid ${String(status.state.supervisorPid)} (${status.supervisorAlive ? "alive" : "NOT running"})`);
+  }
+  if (status.state.port === void 0) {
+    lines.push(`front door: not listening${status.state.lastPort === void 0 ? "" : ` (next start on 127.0.0.1:${String(status.state.lastPort)})`}`);
+  } else {
+    lines.push(`front door: listening on https://127.0.0.1:${String(status.state.port)}, routing /providers/<name> requests`);
+  }
+  if (status.state.connectPort === void 0) {
+    lines.push(`connect surface: not listening${status.state.lastConnectPort === void 0 ? "" : ` (next start on 127.0.0.1:${String(status.state.lastConnectPort)})`}`);
+  } else {
+    lines.push(`connect surface: listening on 127.0.0.1:${String(status.state.connectPort)}, CA ${caCertPath}`);
+  }
+  if (status.headroomSocket === void 0) {
+    lines.push("headroom hop: the daemon is not serving (sessions asking for headroom fail until it is up)");
+  } else if (status.headroomSocket.refused === void 0) {
+    lines.push(`headroom hop: daemon on unix socket ${status.headroomSocket.socketPath}`);
+  } else {
+    lines.push(`headroom hop: REFUSING the daemon's socket (sessions asking for headroom fail until it is fixed): ${status.headroomSocket.refused}`);
+  }
+  if (status.sessions.length === 0) {
+    lines.push("sessions: none");
+  } else {
+    const pids = status.sessions.map((session) => `${String(session.pid)}${session.alive ? "" : " (dead)"}`);
+    lines.push(`sessions: ${String(status.sessions.length)} registered (${pids.join(", ")})`);
+  }
+  if (status.state.lastError !== void 0) {
+    lines.push(`last error: ${status.state.lastError}`);
+  }
+  lines.push(`daemon log: ${status.logPath}${status.logExists ? "" : " (not created yet)"}`);
+  return lines;
+}
+
 // src/usage/providerQuota.ts
 var ProviderQuotaError = class extends Error {
   constructor(source, detail) {
@@ -73101,15 +73991,11 @@ function createRealQuotaRefresher(params) {
 
 // src/frontdoor/commands.ts
 function appendLog(paths, line) {
-  import_node_fs12.default.mkdirSync(paths.logsDir, { recursive: true });
-  import_node_fs12.default.appendFileSync(paths.frontdoorLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+  import_node_fs13.default.mkdirSync(paths.logsDir, { recursive: true });
+  import_node_fs13.default.appendFileSync(paths.frontdoorLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
 `);
 }
 var MINTED_TOKEN_RANDOM_BYTES = 32;
-function headroomSocketTarget(fsPort, trust, paths) {
-  const socketPath = readHeadroomState(fsPort, paths.headroomStateFile)?.socketPath;
-  return socketPath === void 0 ? void 0 : verifyHeadroomSocket(socketPath, trust);
-}
 function rcObservingResolver(resolve, tracker, hub) {
   return async (request7) => {
     const resolution = await resolve(request7);
@@ -73229,6 +74115,14 @@ function realFrontDoorSupervisorPorts(paths) {
       const rcInterrupt = async (sessionId) => await interruptRcSession(rcControlRequestDeps, sessionId);
       const rcSetModel = async (sessionId, model) => await setRcSessionModel(rcControlRequestDeps, sessionId, model);
       const rcSetPermissionMode = async (sessionId, mode) => await setRcSessionPermissionMode(rcControlRequestDeps, sessionId, mode);
+      const controlDeps = {
+        usageSnapshots: () => listUsageSnapshots(realFarmFs, paths.usageSnapshotsDir),
+        usageSnapshotOf: (identity) => readUsageSnapshot(realFarmFs, paths.usageSnapshotsDir, identity),
+        now: () => Date.now(),
+        frontDoorStatus: () => collectFrontDoorStatus(realFarmFs, realHeadroomSocketTrust, paths, realIsProcessRunning),
+        checkReport: (target, identity) => collectCheckReport({ paths, cwd: target, ...identity === void 0 ? {} : { identity }, env: process.env }),
+        doctorReport: () => collectDoctorReport({ paths, env: process.env })
+      };
       realFarmFs.mkdirp(paths.frontdoorDir);
       realFarmFs.writeFilePrivate(paths.frontdoorControlTokenFile, `${rcControlToken}
 `);
@@ -73239,7 +74133,19 @@ function realFrontDoorSupervisorPorts(paths) {
         log,
         mintLeaf(authority, LOOPBACK_LEAF_NAMES, /* @__PURE__ */ new Date()),
         createRcControlHandler({ expectedToken: rcControlToken, list: rcTracker.list, statusOf: rcTracker.statusOf, pendingOf: rcTracker.pendingOf, inject: rcInject, answer: rcAnswer, interrupt: rcInterrupt, setModel: rcSetModel, setPermissionMode: rcSetPermissionMode }),
-        createRcApiNodeHandler({ expectedToken: rcControlToken, list: rcTracker.list, statusOf: rcTracker.statusOf, pendingOf: rcTracker.pendingOf, inject: rcInject, answer: rcAnswer, interrupt: rcInterrupt, setModel: rcSetModel, setPermissionMode: rcSetPermissionMode, fanout: rcFanout })
+        createDoorApiNodeHandler({
+          expectedToken: rcControlToken,
+          list: rcTracker.list,
+          statusOf: rcTracker.statusOf,
+          pendingOf: rcTracker.pendingOf,
+          inject: rcInject,
+          answer: rcAnswer,
+          interrupt: rcInterrupt,
+          setModel: rcSetModel,
+          setPermissionMode: rcSetPermissionMode,
+          fanout: rcFanout,
+          ...controlDeps
+        })
       );
       const handle = await listenFrontDoor(server, { ...preferredPort === void 0 ? {} : { preferredPort }, ca: authority.certPem, onError: onListenerError("provider") });
       return {
@@ -73259,7 +74165,7 @@ function realFrontDoorSupervisorPorts(paths) {
       const leafFor = createLeafCache(loadCa(), () => /* @__PURE__ */ new Date());
       const capture = captureFromEnv(process.env, paths.logsDir);
       if (capture !== void 0) {
-        log(`capture enabled, recording CONNECT targets and piped exchanges to ${import_node_path34.default.join(paths.logsDir, "frontdoor-capture.jsonl")}`);
+        log(`capture enabled, recording CONNECT targets and piped exchanges to ${import_node_path36.default.join(paths.logsDir, "frontdoor-capture.jsonl")}`);
       }
       if (rcSelfHostSurface !== void 0) {
         log("self-hosted Remote Control surface on: the door serves the CCR session family itself, and its own client-half dials its own transparent surface");
@@ -73324,58 +74230,12 @@ function realFrontDoorSupervisorPorts(paths) {
       });
       return { port: handle.port, close: handle.close };
     },
+    closeRcStreamHub: rcHub.close,
     log: (line) => {
       appendLog(paths, line);
     }
   };
 }
-function collectFrontDoorStatus(fsPort, socketTrust, paths, isRunning) {
-  const state = readFrontDoorState(fsPort, paths.frontdoorStateFile) ?? {};
-  return {
-    state,
-    supervisorAlive: state.supervisorPid !== void 0 && isRunning(state.supervisorPid),
-    sessions: listFrontDoorSessions(fsPort, paths.frontdoorSessionsDir).map((session) => ({ ...session, alive: isRunning(session.pid) })),
-    headroomSocket: headroomSocketTarget(fsPort, socketTrust, paths),
-    logPath: paths.frontdoorLogPath,
-    logExists: fsPort.readFileUtf8(paths.frontdoorLogPath) !== void 0
-  };
-}
-function formatFrontDoorStatus(status, caCertPath) {
-  const lines = [];
-  if (status.state.supervisorPid === void 0) {
-    lines.push("supervisor: not running");
-  } else {
-    lines.push(`supervisor: pid ${String(status.state.supervisorPid)} (${status.supervisorAlive ? "alive" : "NOT running"})`);
-  }
-  if (status.state.port === void 0) {
-    lines.push(`front door: not listening${status.state.lastPort === void 0 ? "" : ` (next start on 127.0.0.1:${String(status.state.lastPort)})`}`);
-  } else {
-    lines.push(`front door: listening on https://127.0.0.1:${String(status.state.port)}, routing /providers/<name> requests`);
-  }
-  if (status.state.connectPort === void 0) {
-    lines.push(`connect surface: not listening${status.state.lastConnectPort === void 0 ? "" : ` (next start on 127.0.0.1:${String(status.state.lastConnectPort)})`}`);
-  } else {
-    lines.push(`connect surface: listening on 127.0.0.1:${String(status.state.connectPort)}, CA ${caCertPath}`);
-  }
-  if (status.headroomSocket === void 0) {
-    lines.push("headroom hop: the daemon is not serving (sessions asking for headroom fail until it is up)");
-  } else if (status.headroomSocket.refused === void 0) {
-    lines.push(`headroom hop: daemon on unix socket ${status.headroomSocket.socketPath}`);
-  } else {
-    lines.push(`headroom hop: REFUSING the daemon's socket (sessions asking for headroom fail until it is fixed): ${status.headroomSocket.refused}`);
-  }
-  if (status.sessions.length === 0) {
-    lines.push("sessions: none");
-  } else {
-    const pids = status.sessions.map((session) => `${String(session.pid)}${session.alive ? "" : " (dead)"}`);
-    lines.push(`sessions: ${String(status.sessions.length)} registered (${pids.join(", ")})`);
-  }
-  if (status.state.lastError !== void 0) {
-    lines.push(`last error: ${status.state.lastError}`);
-  }
-  lines.push(`daemon log: ${status.logPath}${status.logExists ? "" : " (not created yet)"}`);
-  return lines;
-}
 function formatRcSessionList(sessions) {
   if (sessions.length === 0) {
     return ["no Remote Control sessions observed"];
@@ -73959,16 +74819,16 @@ function registerCompletionCommand(program2) {
 var import_node_child_process4 = require("node:child_process");
 
 // src/identityToken.ts
-var import_node_fs13 = __toESM(require("node:fs"), 1);
-var import_node_path35 = __toESM(require("node:path"), 1);
+var import_node_fs14 = __toESM(require("node:fs"), 1);
+var import_node_path37 = __toESM(require("node:path"), 1);
 var TOKEN_FILE_MODE = 384;
 var TOKEN_DIR_MODE = 448;
 var OAUTH_TOKEN_RE = /^sk-ant-oat\d+-[A-Za-z0-9_-]+$/;
 function identityTokenDir(paths) {
-  return import_node_path35.default.join(paths.root, "credentials");
+  return import_node_path37.default.join(paths.root, "credentials");
 }
 function identityTokenPath(paths, identityName) {
-  return import_node_path35.default.join(identityTokenDir(paths), `${identityName}.token`);
+  return import_node_path37.default.join(identityTokenDir(paths), `${identityName}.token`);
 }
 function storeIdentityToken(paths, identityName, raw) {
   const token = raw.trim();
@@ -73976,13 +74836,13 @@ function storeIdentityToken(paths, identityName, raw) {
     throw new UsageError("That is not a claude setup-token token (expected it to start with sk-ant-oat). Run `claude setup-token` and pass its token on standard input.");
   }
   const dir = identityTokenDir(paths);
-  import_node_fs13.default.mkdirSync(dir, { recursive: true, mode: TOKEN_DIR_MODE });
-  import_node_fs13.default.chmodSync(dir, TOKEN_DIR_MODE);
+  import_node_fs14.default.mkdirSync(dir, { recursive: true, mode: TOKEN_DIR_MODE });
+  import_node_fs14.default.chmodSync(dir, TOKEN_DIR_MODE);
   const target = identityTokenPath(paths, identityName);
-  const temp = import_node_path35.default.join(dir, `.${identityName}.${String(process.pid)}.tmp`);
-  import_node_fs13.default.writeFileSync(temp, `${token}
+  const temp = import_node_path37.default.join(dir, `.${identityName}.${String(process.pid)}.tmp`);
+  import_node_fs14.default.writeFileSync(temp, `${token}
 `, { mode: TOKEN_FILE_MODE });
-  import_node_fs13.default.renameSync(temp, target);
+  import_node_fs14.default.renameSync(temp, target);
   return target;
 }
 
@@ -74116,509 +74976,6 @@ function subjectName(positional, provider) {
   return name;
 }
 
-// src/doctorReport.ts
-var import_node_fs14 = __toESM(require("node:fs"), 1);
-var import_node_path36 = __toESM(require("node:path"), 1);
-function refinePathShadow(status, ownExecutablePath, realpath) {
-  if (status.status !== "shadowed") {
-    return status;
-  }
-  return realpath(status.by) === realpath(ownExecutablePath) ? { status: "ok" } : status;
-}
-function validateJson(schema, input2) {
-  if (input2.raw === void 0) {
-    return { ok: false, message: `${input2.path} is missing.` };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(input2.raw);
-  } catch (error62) {
-    return { ok: false, message: `${input2.path} is not valid JSON: ${error62 instanceof Error ? error62.message : String(error62)}` };
-  }
-  const result = schema.safeParse(parsed);
-  if (!result.success) {
-    return { ok: false, message: new ConfigValidationError(input2.path, result.error.issues).message };
-  }
-  return { ok: true, data: result.data };
-}
-function pushPathResolution(push, resolution) {
-  const ownDir = import_node_path36.default.dirname(resolution.ownExecutablePath);
-  switch (resolution.agentShim.status) {
-    case "ok":
-      push("path-resolution", "pass", `\`agent-shim\` on PATH resolves to this running executable, ${resolution.ownExecutablePath}.`, "agent-shim");
-      break;
-    case "not-on-path":
-      push(
-        "path-resolution",
-        "warn",
-        `${ownDir} is not on PATH, so a bare \`agent-shim\` does not reach ${resolution.ownExecutablePath}. Add it to PATH, or keep invoking this executable by its full path.`,
-        "agent-shim"
-      );
-      break;
-    case "shadowed":
-      push(
-        "path-resolution",
-        "fail",
-        `\`agent-shim\` on PATH resolves to ${resolution.agentShim.by}, not this running executable, ${resolution.ownExecutablePath}. Every command you type runs that one instead, at whatever version it happens to be \u2014 including the checks in this report, which describe this executable. Remove ${resolution.agentShim.by}, repoint it at ${resolution.ownExecutablePath}, or put ${ownDir} ahead of it on PATH.`,
-        "agent-shim"
-      );
-      break;
-  }
-  if (resolution.claude === void 0) {
-    return;
-  }
-  switch (resolution.claude.status) {
-    case "ok":
-      push("path-resolution", "pass", "`claude` on PATH resolves to the enabled shim.", "claude");
-      break;
-    case "not-on-path":
-      push("path-resolution", "warn", "The enabled `claude` shim's directory is not on PATH \u2014 add it, or use `agent-shim run` instead.", "claude");
-      break;
-    case "shadowed":
-      push(
-        "path-resolution",
-        "warn",
-        `\`claude\` on PATH resolves to ${resolution.claude.by}, not the enabled shim. Put the shim's directory ahead of it on PATH, or run \`agent-shim shim disable\` if you meant to launch that one directly.`,
-        "claude"
-      );
-      break;
-  }
-}
-function cacheClause(cacheEnv, owner, block2) {
-  if (cacheEnv === void 0 || block2.cache === void 0) {
-    return { text: "", unreadable: false };
-  }
-  const state = describeCachedCredential({ port: cacheEnv.port, platform: cacheEnv.platform, owner, cache: block2.cache, nowMs: cacheEnv.now() });
-  return { text: `; ${formatCachedCredentialState(state)}`, unreadable: state.status === "unreadable" };
-}
-function pushProvider(push, entry, cacheEnv) {
-  if (entry.raw === void 0) {
-    push("provider", "fail", `${entry.path} is missing.`, entry.name);
-    return;
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(entry.raw);
-  } catch (error62) {
-    push("provider", "fail", `${entry.path} is not valid JSON: ${error62 instanceof Error ? error62.message : String(error62)}`, entry.name);
-    return;
-  }
-  const conversion = legacyProviderConversion(parsed);
-  if (conversion !== void 0) {
-    push("provider", "fail", new LegacyProviderFileError(entry.path, conversion).message, entry.name);
-    return;
-  }
-  const validated2 = ProviderSchema.safeParse(parsed);
-  if (!validated2.success) {
-    push("provider", "fail", new ConfigValidationError(entry.path, validated2.error.issues).message, entry.name);
-    return;
-  }
-  const cache = cacheClause(cacheEnv, `provider ${entry.name}`, validated2.data.credential);
-  push("provider", cache.unreadable ? "fail" : "pass", `${entry.name} is valid (${describeProviderEndpoint(validated2.data)}, credential ${describeCredential(validated2.data.credential)})${cache.text}.`, entry.name);
-  if (validated2.data.env?.ENABLE_TOOL_SEARCH === void 0) {
-    push("provider", "warn", `${entry.name} does not set ENABLE_TOOL_SEARCH: a session on this provider loads MCP tools upfront rather than deferring them, because its base URL is the front door, which Claude Code treats as a non-first-party host. Set ENABLE_TOOL_SEARCH in the provider's env block to restore deferred loading, when the upstream backend supports the tool_reference payloads it sends.`, entry.name);
-  }
-}
-function pushLegacyName(push, params) {
-  const legacyVariables = Object.keys(params.env).filter((name) => name.startsWith(LEGACY_ENV_PREFIX) && params.env[name] !== void 0).sort();
-  if (legacyVariables.length === 0 && import_node_path36.default.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
-    push("legacy-name", "pass", "Nothing here still uses the former `claude-use` name.");
-    return;
-  }
-  for (const name of legacyVariables) {
-    push("legacy-name", "warn", `${name} is the former name of ${name.replace(LEGACY_ENV_PREFIX, ENV_PREFIX)}. Rename it; the old name still works but is only a fallback.`, name);
-  }
-  if (import_node_path36.default.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
-    push(
-      "legacy-name",
-      "warn",
-      `The state root is the former ${params.rootPath}, used in place. Leave it where it is: macOS Claude Code keys each identity's Keychain login on its exact configuration directory path, so moving it signs every identity out.`
-    );
-  }
-}
-function runDoctor(params) {
-  const findings = [];
-  const push = (section, severity, message, subject) => {
-    findings.push({ section, severity, message, ...subject === void 0 ? {} : { subject } });
-  };
-  const checkPin = (section, subject, where, version2) => {
-    const installed = params.installedClaudeVersions;
-    if (version2 === void 0 || installed === void 0 || installed.includes(version2)) {
-      return;
-    }
-    push(section, "warn", `${where} pins Claude Code ${version2}, which is not installed (installed: ${installed.length === 0 ? "none" : installed.join(", ")}); a launch that resolves to it fails.`, subject);
-  };
-  const ambient = detectAmbientCredential(params.env);
-  if (ambient === void 0) {
-    push("ambient-credential", "pass", "No ambient-credential environment variable is set.");
-  } else {
-    push("ambient-credential", "warn", formatAmbientCredentialGuardMessage(ambient.variable));
-  }
-  if (params.binaryDiscovery.ok) {
-    const { binary } = params.binaryDiscovery;
-    const versionNote = binary.version === void 0 ? "" : `, version ${binary.version}`;
-    push("binary-discovery", "pass", `Found ${binary.path} (${binary.source}${versionNote}).`);
-  } else {
-    push("binary-discovery", "fail", params.binaryDiscovery.message);
-  }
-  if (params.claudeShim.state === void 0) {
-    push("claude-shim", "pass", "No `claude` command shim enabled (the default). Run `agent-shim shim enable` to add one.");
-  } else if (!params.claudeShim.targetExists) {
-    push(
-      "claude-shim",
-      "warn",
-      `claude-shim.json records a \`claude\` shim at ${params.claudeShim.state.targetPath}, but nothing is there. Run \`agent-shim shim enable\` again, or \`agent-shim shim disable\` to clear the stale record.`
-    );
-  } else {
-    push(
-      "claude-shim",
-      "pass",
-      `\`claude\` is enabled at ${params.claudeShim.state.targetPath} (${params.claudeShim.state.method}). If you've upgraded agent-shim since, re-run \`agent-shim shim enable\` to refresh it.`
-    );
-  }
-  pushPathResolution(push, params.pathResolution);
-  pushLegacyName(push, params);
-  const profileSources = /* @__PURE__ */ new Map();
-  for (const entry of params.configProfiles) {
-    const validated2 = validateJson(ConfigProfileSchema, entry);
-    if (!validated2.ok) {
-      push("config-profile", "fail", validated2.message, entry.name);
-      continue;
-    }
-    profileSources.set(entry.name, { name: entry.name, profile: validated2.data });
-    checkPin("config-profile", entry.name, `Configuration profile "${entry.name}"`, validated2.data.launch?.claudeVersion);
-  }
-  const loadProfile = (name) => profileSources.get(name);
-  for (const name of profileSources.keys()) {
-    const linearised = lineariseProfile(name, loadProfile);
-    if (linearised.diagnostics.length === 0) {
-      push("config-profile", "pass", `${name} is valid and its extends chain resolves cleanly.`, name);
-    } else {
-      for (const diagnostic of linearised.diagnostics) {
-        push("config-profile", "fail", diagnostic.message, name);
-      }
-    }
-  }
-  const validProfileNames = new Set(profileSources.keys());
-  const validIdentityNames = /* @__PURE__ */ new Set();
-  for (const entry of params.identities) {
-    const validated2 = validateJson(IdentitySchema, entry);
-    if (!validated2.ok) {
-      push("identity", "fail", validated2.message, entry.name);
-      continue;
-    }
-    validIdentityNames.add(entry.name);
-    const defaultProfile = validated2.data.defaultConfigProfile;
-    if (defaultProfile !== void 0 && !validProfileNames.has(defaultProfile)) {
-      push(
-        "identity",
-        "fail",
-        `Identity "${entry.name}" names configuration profile "${defaultProfile}" as its default, but no such profile exists.`,
-        entry.name
-      );
-    } else {
-      const credential = validated2.data.credential;
-      const cache = credential === void 0 ? { text: "", unreadable: false } : cacheClause(params.credentialCache, `identity ${entry.name}`, credential);
-      push(
-        "identity",
-        cache.unreadable ? "fail" : "pass",
-        `${entry.name} is valid and authenticates with ${credential === void 0 ? "its stored login" : `credential ${describeCredential(credential)}`}${cache.text}.`,
-        entry.name
-      );
-    }
-  }
-  const validatedGlobalConfig = params.globalConfig.raw === void 0 ? void 0 : validateJson(GlobalConfigSchema, params.globalConfig);
-  const pools = validatedGlobalConfig?.ok === true ? validatedGlobalConfig.data.pools ?? {} : {};
-  for (const [poolName, pool] of Object.entries(pools)) {
-    const missing = pool.identities.filter((member) => !validIdentityNames.has(member));
-    if (missing.length === 0) {
-      push("pool", "pass", `${poolName} is valid (${pool.identities.join(", ")}).`, poolName);
-    } else {
-      push("pool", "fail", `Pool "${poolName}" names ${missing.map((member) => `identity "${member}"`).join(" and ")}, which ${missing.length === 1 ? "does" : "do"} not exist.`, poolName);
-    }
-  }
-  const selectionExists = (selector) => {
-    const poolName = poolNameOf(selector);
-    return poolName === void 0 ? validIdentityNames.has(selector) : poolName in pools;
-  };
-  for (const entry of params.providers) {
-    pushProvider(push, entry, params.credentialCache);
-  }
-  if (params.platform !== "darwin" || params.run === void 0) {
-    push("keychain", "pass", "Skipped (not macOS).");
-  } else {
-    for (const entry of params.identities) {
-      const result = lookupKeychainService(params.run, entry.farmRoot);
-      push("keychain", result.found ? "pass" : "warn", result.note, entry.name);
-    }
-  }
-  if (params.directoryRules.raw === void 0) {
-    push("directory-rules", "pass", "No directory-rules.json configured.");
-  } else {
-    const validated2 = validateJson(DirectoryRulesSchema, params.directoryRules);
-    if (!validated2.ok) {
-      push("directory-rules", "fail", validated2.message);
-    } else {
-      push("directory-rules", "pass", `${params.directoryRules.path} is valid.`);
-      for (const rule of validated2.data.rules) {
-        const badRefs = [];
-        if (rule.identity !== void 0 && !selectionExists(rule.identity)) {
-          badRefs.push(poolNameOf(rule.identity) === void 0 ? `identity "${rule.identity}"` : `pool "${poolNameOf(rule.identity) ?? ""}"`);
-        }
-        if (rule.configProfile !== void 0 && !validProfileNames.has(rule.configProfile)) {
-          badRefs.push(`configuration profile "${rule.configProfile}"`);
-        }
-        checkPin("directory-rules", rule.path, `Rule for "${rule.path}"`, rule.launch?.claudeVersion);
-        if (badRefs.length > 0) {
-          push("directory-rules", "fail", `Rule for "${rule.path}" names ${badRefs.join(" and ")}, which do not exist.`, rule.path);
-        } else {
-          push("directory-rules", "pass", `Rule for "${rule.path}" is valid.`, rule.path);
-        }
-      }
-    }
-  }
-  if (params.globalConfig.raw === void 0) {
-    push("global-config", "pass", "No config.json configured.");
-  } else {
-    const validated2 = validateJson(GlobalConfigSchema, params.globalConfig);
-    if (!validated2.ok) {
-      push("global-config", "fail", validated2.message);
-    } else {
-      const defaultProfile = validated2.data.defaultConfigProfile;
-      if (defaultProfile !== void 0 && !validProfileNames.has(defaultProfile)) {
-        push(
-          "global-config",
-          "fail",
-          `config.json names configuration profile "${defaultProfile}" as its default, but no such profile exists.`
-        );
-      } else {
-        push("global-config", "pass", `${params.globalConfig.path} is valid.`);
-        checkPin("global-config", void 0, "config.json", validated2.data.launch?.claudeVersion);
-      }
-    }
-  }
-  if (params.categoriesLocal.raw === void 0) {
-    push("categories-local", "pass", "No categories.local.json configured.");
-  } else {
-    const validated2 = validateJson(CategoryClassificationOverlaySchema, params.categoriesLocal);
-    push(
-      "categories-local",
-      validated2.ok ? "pass" : "fail",
-      validated2.ok ? `${params.categoriesLocal.path} is valid.` : validated2.message
-    );
-  }
-  if (params.headroom.state.raw === void 0) {
-    push("headroom", "pass", "No headroom daemon has ever run; nothing to check.");
-  } else {
-    const validated2 = validateJson(HeadroomStateSchema, params.headroom.state);
-    if (!validated2.ok) {
-      push("headroom", "fail", validated2.message);
-    } else {
-      const state = validated2.data;
-      const supervisorAlive = state.supervisorPid !== void 0 && params.headroom.isRunning(state.supervisorPid);
-      const headroomAlive = state.headroomPid !== void 0 && params.headroom.isRunning(state.headroomPid);
-      if (state.supervisorPid === void 0) {
-        if (state.lastError === void 0) {
-          push("headroom", "pass", "Headroom daemon is stopped (idle shutdown) with no recorded error.");
-        } else {
-          push("headroom", "warn", `Headroom supervisor is not running; last error: ${state.lastError}`);
-        }
-      } else if (!supervisorAlive) {
-        push(
-          "headroom",
-          "warn",
-          `Headroom state names supervisor pid ${String(state.supervisorPid)}, which is not running; the next launch through headroom will start a replacement.`
-        );
-      } else if (state.headroomPid === void 0 || state.socketPath === void 0) {
-        push(
-          "headroom",
-          "warn",
-          state.lastError === void 0 ? "Headroom supervisor is running but the daemon has no healthy process; it should be restarting it." : `Headroom supervisor is running but the daemon is down; last error: ${state.lastError}`
-        );
-      } else if (!headroomAlive) {
-        push(
-          "headroom",
-          "warn",
-          `Headroom state names daemon pid ${String(state.headroomPid)}, which is not running; its supervisor should be restarting it.`
-        );
-      } else {
-        push(
-          "headroom",
-          "pass",
-          `Headroom daemon is up on unix socket ${state.socketPath} (supervisor ${String(state.supervisorPid)}, daemon ${String(state.headroomPid)}).`
-        );
-      }
-      if (state.lastError !== void 0 && supervisorAlive) {
-        push("headroom", "warn", `Headroom recorded a previous error: ${state.lastError}`);
-      }
-      if (state.installedSource !== void 0 && isMovingGitSource(state.installedSource)) {
-        push(
-          "headroom",
-          "warn",
-          `Headroom is installed from a git ref that can move (${state.installedSource}); pin headroom.source to a full commit SHA so a rebased or deleted branch cannot change or break the install.`
-        );
-      }
-    }
-  }
-  if (params.activeIdentity.raw === void 0) {
-    push("active-identity", "pass", "No active identity set.");
-  } else {
-    const trimmed = params.activeIdentity.raw.trim();
-    if (trimmed === "") {
-      push("active-identity", "warn", "active-identity is present but empty \u2014 treated the same as unset.");
-    } else if (!selectionExists(trimmed)) {
-      push("active-identity", "fail", `active-identity names "${trimmed}", which does not exist.`);
-    } else {
-      push("active-identity", "pass", `Active identity "${trimmed}" is valid.`);
-    }
-  }
-  return { findings, ok: !findings.some((finding) => finding.severity === "fail") };
-}
-var SECTION_TITLES = {
-  "ambient-credential": "Ambient-credential exposure",
-  "binary-discovery": "Claude Code binary discovery",
-  "claude-shim": "`claude` command shim",
-  "path-resolution": "PATH resolution",
-  "legacy-name": "Former `claude-use` name",
-  "config-profile": "Configuration profiles",
-  identity: "Identities",
-  pool: "Pools",
-  provider: "Providers",
-  keychain: "macOS Keychain",
-  "directory-rules": "Directory rules",
-  "global-config": "Global config",
-  headroom: "Headroom daemon",
-  "categories-local": "categories.local.json",
-  "active-identity": "Active identity"
-};
-var SECTION_ORDER = [
-  "ambient-credential",
-  "binary-discovery",
-  "claude-shim",
-  "path-resolution",
-  "config-profile",
-  "identity",
-  "pool",
-  "provider",
-  "keychain",
-  "directory-rules",
-  "global-config",
-  "headroom",
-  "categories-local",
-  "active-identity"
-];
-function severityPrefix(severity) {
-  switch (severity) {
-    case "pass":
-      return "[PASS]";
-    case "warn":
-      return "[WARN]";
-    case "fail":
-      return "[FAIL]";
-    default:
-      return severity;
-  }
-}
-function formatDoctorReport(report) {
-  const lines = [];
-  for (const section of SECTION_ORDER) {
-    const sectionFindings = report.findings.filter((finding) => finding.section === section);
-    if (sectionFindings.length === 0) {
-      continue;
-    }
-    lines.push("", `${SECTION_TITLES[section]}:`);
-    for (const finding of sectionFindings) {
-      const subject = finding.subject === void 0 ? "" : `${finding.subject}: `;
-      lines.push(`  ${severityPrefix(finding.severity)} ${subject}${finding.message}`);
-    }
-  }
-  const failCount = report.findings.filter((finding) => finding.severity === "fail").length;
-  lines.push("", report.ok ? "All checks passed." : `${String(failCount)} check(s) failed.`);
-  return lines;
-}
-function realpathOrSelf(target) {
-  try {
-    return import_node_fs14.default.realpathSync(target);
-  } catch {
-    return target;
-  }
-}
-function collectDoctorReport(params) {
-  const { paths } = params;
-  const identityNames = import_node_fs14.default.existsSync(paths.identitiesDir) ? import_node_fs14.default.readdirSync(paths.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && isIdentityDirectoryName(entry.name)).map((entry) => entry.name).sort() : [];
-  const identities = identityNames.map((name) => {
-    const farmRoot = import_node_path36.default.join(paths.identitiesDir, name);
-    const identityPath = import_node_path36.default.join(farmRoot, "identity.json");
-    return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot };
-  });
-  const profileNames = import_node_fs14.default.existsSync(paths.configProfilesDir) ? import_node_fs14.default.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
-  const configProfiles = profileNames.map((name) => {
-    const profilePath = import_node_path36.default.join(paths.configProfilesDir, `${name}.json`);
-    return { name, path: profilePath, raw: realFsPort.readFileUtf8(profilePath) };
-  });
-  const providerNames = import_node_fs14.default.existsSync(paths.providersDir) ? import_node_fs14.default.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
-  const providers = providerNames.map((name) => {
-    const providerPath = import_node_path36.default.join(paths.providersDir, `${name}.json`);
-    return { name, path: providerPath, raw: realFsPort.readFileUtf8(providerPath) };
-  });
-  const ownExecutablePath = realOwnExecutablePath();
-  let binaryDiscovery;
-  try {
-    const binary = realResolveClaudeBinary(resolveOwnBinaryCheck(paths, realContentSourcePath()))();
-    binaryDiscovery = { ok: true, binary };
-  } catch (error62) {
-    binaryDiscovery = { ok: false, message: error62 instanceof Error ? error62.message : String(error62) };
-  }
-  const shimState = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-  const pathDirs = (params.env.PATH ?? "").split(import_node_path36.default.delimiter).filter((dir) => dir !== "");
-  const claudeShimShadow = shimState === void 0 ? void 0 : refinePathShadow(
-    findPathShadow({
-      pathDirs,
-      targetDir: import_node_path36.default.dirname(shimState.targetPath),
-      targetFilename: import_node_path36.default.basename(shimState.targetPath),
-      findExecutableInDir
-    }),
-    shimState.targetPath,
-    realpathOrSelf
-  );
-  const report = runDoctor({
-    env: params.env,
-    credentialCache: realCredentialCacheEnv(paths),
-    installedClaudeVersions: realInstalledClaudeVersions(),
-    identities,
-    configProfiles,
-    providers,
-    directoryRules: { path: paths.directoryRulesFile, raw: realFsPort.readFileUtf8(paths.directoryRulesFile) },
-    globalConfig: { path: paths.globalConfigFile, raw: realFsPort.readFileUtf8(paths.globalConfigFile) },
-    categoriesLocal: { path: paths.categoriesLocalFile, raw: realFsPort.readFileUtf8(paths.categoriesLocalFile) },
-    activeIdentity: { path: paths.activeIdentityFile, raw: realFsPort.readFileUtf8(paths.activeIdentityFile) },
-    binaryDiscovery,
-    claudeShim: { state: shimState, targetExists: shimState !== void 0 && import_node_fs14.default.existsSync(shimState.targetPath) },
-    rootPath: paths.root,
-    pathResolution: {
-      ownExecutablePath,
-      agentShim: refinePathShadow(
-        findPathShadow({
-          pathDirs,
-          targetDir: import_node_path36.default.dirname(ownExecutablePath),
-          targetFilename: commandFilename(ownExecutablePath, "agent-shim"),
-          findExecutableInDir
-        }),
-        ownExecutablePath,
-        realpathOrSelf
-      ),
-      ...claudeShimShadow === void 0 ? {} : { claude: claudeShimShadow }
-    },
-    run: realRunPort,
-    platform: process.platform,
-    headroom: {
-      state: { path: paths.headroomStateFile, raw: realFsPort.readFileUtf8(paths.headroomStateFile) },
-      isRunning: realIsProcessRunning
-    }
-  });
-  return report;
-}
-
 // src/doctor.ts
 function registerDoctorCommand(program2, deps) {
   const { paths } = deps;
@@ -74643,7 +75000,7 @@ function registerDoctorCommand(program2, deps) {
 // src/headroom/commands.ts
 var import_node_fs16 = __toESM(require("node:fs"), 1);
 var import_node_http2 = __toESM(require("node:http"), 1);
-var import_node_path38 = __toESM(require("node:path"), 1);
+var import_node_path39 = __toESM(require("node:path"), 1);
 var import_node_child_process5 = require("node:child_process");
 
 // src/frontdoor/realFrontDoorPort.ts
@@ -74789,11 +75146,11 @@ function probeFrontDoorSync(port, caPem) {
 
 // src/frontdoor/trust.ts
 var import_node_crypto14 = require("node:crypto");
-var import_node_path37 = __toESM(require("node:path"), 1);
+var import_node_path38 = __toESM(require("node:path"), 1);
 var BUNDLE_NAME_HEX_DIGITS = 16;
 function resolveTrustBundle(params) {
   const { caCertFile, bundlesDir, variable, inherited, fs: fs19 } = params;
-  if (inherited === void 0 || inherited === "" || import_node_path37.default.resolve(inherited) === import_node_path37.default.resolve(caCertFile)) {
+  if (inherited === void 0 || inherited === "" || import_node_path38.default.resolve(inherited) === import_node_path38.default.resolve(caCertFile)) {
     return { path: caCertFile };
   }
   const caPem = fs19.readFileUtf8(caCertFile);
@@ -74811,7 +75168,7 @@ function resolveTrustBundle(params) {
   }
   const combined = `${inheritedPem.trimEnd()}
 ${caPem}`;
-  const bundle = import_node_path37.default.join(bundlesDir, `${(0, import_node_crypto14.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
+  const bundle = import_node_path38.default.join(bundlesDir, `${(0, import_node_crypto14.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
   if (!fs19.exists(bundle)) {
     fs19.mkdirp(bundlesDir);
     fs19.writeFileAtomic(bundle, combined);
@@ -74969,12 +75326,12 @@ function readInstalledHeadroomCommit() {
   if (toolDir.status !== 0) {
     return void 0;
   }
-  const libDir = import_node_path38.default.join(toolDir.stdout.trim(), HEADROOM_TOOL_NAME, "lib");
+  const libDir = import_node_path39.default.join(toolDir.stdout.trim(), HEADROOM_TOOL_NAME, "lib");
   for (const python of realFarmFs.readdir(libDir)) {
-    const sitePackages = import_node_path38.default.join(libDir, python, "site-packages");
+    const sitePackages = import_node_path39.default.join(libDir, python, "site-packages");
     for (const entry of realFarmFs.readdir(sitePackages)) {
       if (entry.startsWith("headroom_ai-") && entry.endsWith(".dist-info")) {
-        const directUrl = realFarmFs.readFileUtf8(import_node_path38.default.join(sitePackages, entry, "direct_url.json"));
+        const directUrl = realFarmFs.readFileUtf8(import_node_path39.default.join(sitePackages, entry, "direct_url.json"));
         return directUrl === void 0 ? void 0 : parseInstalledCommit(directUrl);
       }
     }
@@ -75781,7 +76138,7 @@ var import_node_crypto16 = require("node:crypto");
 
 // src/launcher.ts
 var import_node_crypto15 = require("node:crypto");
-var import_node_path40 = __toESM(require("node:path"), 1);
+var import_node_path41 = __toESM(require("node:path"), 1);
 
 // src/launcher/cliOverride.ts
 var InvalidCliCategoryError = class extends CliError {
@@ -75865,7 +76222,7 @@ function buildCliOverride(params) {
 }
 
 // src/launcher/flags.ts
-var import_node_path39 = __toESM(require("node:path"), 1);
+var import_node_path40 = __toESM(require("node:path"), 1);
 
 // src/headroom/headers.ts
 function mergeAnthropicCustomHeaders(existing, additions) {
@@ -75935,7 +76292,7 @@ function buildEnv(params) {
   const parentCustomHeaders = params.baseEnv.ANTHROPIC_CUSTOM_HEADERS;
   let providerCustomHeaders;
   if (!params.configDirEscapeHatch && params.resolvedIdentityName !== void 0) {
-    env.CLAUDE_CONFIG_DIR = import_node_path39.default.join(params.identitiesDir, params.resolvedIdentityName);
+    env.CLAUDE_CONFIG_DIR = import_node_path40.default.join(params.identitiesDir, params.resolvedIdentityName);
   }
   if (params.provider !== void 0) {
     const providerEnv = params.provider.definition.env ?? {};
@@ -76119,7 +76476,7 @@ function prepareLaunch(params) {
     identityDefaultConfigProfile: loadedIdentity?.config.defaultConfigProfile,
     globalDefaultConfigProfile: params.globalDefaultConfigProfile
   });
-  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs19.readConfigFile(import_node_path40.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
+  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs19.readConfigFile(import_node_path41.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
     log.error(
       `agent-shim: no configuration profile named "${configProfileDecision.name}" (selected via ${configProfileDecision.source}). Run \`agent-shim profile add ${configProfileDecision.name}\` first.`
     );
@@ -76465,7 +76822,7 @@ async function runClaude(argvOverride) {
 // src/cli.ts
 async function main() {
   aliasLegacyEnv(process.env);
-  const invokedName = import_node_path41.default.basename(process.argv[1] ?? "agent-shim");
+  const invokedName = import_node_path42.default.basename(process.argv[1] ?? "agent-shim");
   if (isInvokedAsClaude(invokedName)) {
     await runClaude();
     return;