agent-shim 8.14.1 → 8.16.0

package/dist/cli.cjs

@@ -3248,42 +3248,42 @@ var require_defaults = __commonJS({
 var require_env_paths = __commonJS({
   "node_modules/.pnpm/env-paths@2.2.1/node_modules/env-paths/index.js"(exports2, module2) {
     "use strict";
-    var path43 = require("path");
+    var path44 = require("path");
     var os10 = require("os");
     var homedir = os10.homedir();
     var tmpdir = os10.tmpdir();
     var { env } = process;
     var macos = (name) => {
-      const library = path43.join(homedir, "Library");
+      const library = path44.join(homedir, "Library");
       return {
-        data: path43.join(library, "Application Support", name),
-        config: path43.join(library, "Preferences", name),
-        cache: path43.join(library, "Caches", name),
-        log: path43.join(library, "Logs", name),
-        temp: path43.join(tmpdir, name)
+        data: path44.join(library, "Application Support", name),
+        config: path44.join(library, "Preferences", name),
+        cache: path44.join(library, "Caches", name),
+        log: path44.join(library, "Logs", name),
+        temp: path44.join(tmpdir, name)
       };
     };
     var windows = (name) => {
-      const appData = env.APPDATA || path43.join(homedir, "AppData", "Roaming");
-      const localAppData = env.LOCALAPPDATA || path43.join(homedir, "AppData", "Local");
+      const appData = env.APPDATA || path44.join(homedir, "AppData", "Roaming");
+      const localAppData = env.LOCALAPPDATA || path44.join(homedir, "AppData", "Local");
       return {
         // Data/config/cache/log are invented by me as Windows isn't opinionated about this
-        data: path43.join(localAppData, name, "Data"),
-        config: path43.join(appData, name, "Config"),
-        cache: path43.join(localAppData, name, "Cache"),
-        log: path43.join(localAppData, name, "Log"),
-        temp: path43.join(tmpdir, name)
+        data: path44.join(localAppData, name, "Data"),
+        config: path44.join(appData, name, "Config"),
+        cache: path44.join(localAppData, name, "Cache"),
+        log: path44.join(localAppData, name, "Log"),
+        temp: path44.join(tmpdir, name)
       };
     };
     var linux = (name) => {
-      const username = path43.basename(homedir);
+      const username = path44.basename(homedir);
       return {
-        data: path43.join(env.XDG_DATA_HOME || path43.join(homedir, ".local", "share"), name),
-        config: path43.join(env.XDG_CONFIG_HOME || path43.join(homedir, ".config"), name),
-        cache: path43.join(env.XDG_CACHE_HOME || path43.join(homedir, ".cache"), name),
+        data: path44.join(env.XDG_DATA_HOME || path44.join(homedir, ".local", "share"), name),
+        config: path44.join(env.XDG_CONFIG_HOME || path44.join(homedir, ".config"), name),
+        cache: path44.join(env.XDG_CACHE_HOME || path44.join(homedir, ".cache"), name),
         // https://wiki.debian.org/XDGBaseDirectorySpecification#state
-        log: path43.join(env.XDG_STATE_HOME || path43.join(homedir, ".local", "state"), name),
-        temp: path43.join(tmpdir, username, name)
+        log: path44.join(env.XDG_STATE_HOME || path44.join(homedir, ".local", "state"), name),
+        temp: path44.join(tmpdir, username, name)
       };
     };
     var envPaths = (name, options) => {
@@ -3351,11 +3351,11 @@ var require_util = __commonJS({
       return result;
     }
     exports2.emplace = emplace;
-    function getPropertyByPath(source, path43) {
-      if (typeof path43 === "string" && Object.prototype.hasOwnProperty.call(source, path43)) {
-        return source[path43];
+    function getPropertyByPath(source, path44) {
+      if (typeof path44 === "string" && Object.prototype.hasOwnProperty.call(source, path44)) {
+        return source[path44];
       }
-      const parsedPath = typeof path43 === "string" ? path43.split(".") : path43;
+      const parsedPath = typeof path44 === "string" ? path44.split(".") : path44;
       return parsedPath.reduce((previous, key) => {
         if (previous === void 0) {
           return previous;
@@ -3378,9 +3378,9 @@ var require_util = __commonJS({
       return Object.fromEntries(Object.entries(options).filter(([, value2]) => value2 !== void 0));
     }
     exports2.removeUndefinedValuesFromObject = removeUndefinedValuesFromObject;
-    async function isDirectory(path43) {
+    async function isDirectory(path44) {
       try {
-        const stat = await fs_1.promises.stat(path43);
+        const stat = await fs_1.promises.stat(path44);
         return stat.isDirectory();
       } catch (e) {
         if (e.code === "ENOENT") {
@@ -3390,9 +3390,9 @@ var require_util = __commonJS({
       }
     }
     exports2.isDirectory = isDirectory;
-    function isDirectorySync(path43) {
+    function isDirectorySync(path44) {
       try {
-        const stat = fs_1.default.statSync(path43);
+        const stat = fs_1.default.statSync(path44);
         return stat.isDirectory();
       } catch (e) {
         if (e.code === "ENOENT") {
@@ -3490,7 +3490,7 @@ var require_ExplorerBase = __commonJS({
           const idx = importStack.indexOf(fullPath);
           if (idx !== -1) {
             throw new Error(`Circular import detected:
-${[...importStack, fullPath].map((path43, i2) => `${i2 + 1}. ${path43}`).join("\n")} (same as ${idx + 1}.)`);
+${[...importStack, fullPath].map((path44, i2) => `${i2 + 1}. ${path44}`).join("\n")} (same as ${idx + 1}.)`);
           }
         }
       }
@@ -3678,9 +3678,9 @@ var require_Explorer = __commonJS({
           throw error62;
         }
       }
-      async #fileExists(path43) {
+      async #fileExists(path44) {
         try {
-          await promises_1.default.stat(path43);
+          await promises_1.default.stat(path44);
           return true;
         } catch (e) {
           return false;
@@ -3840,9 +3840,9 @@ var require_ExplorerSync = __commonJS({
           throw error62;
         }
       }
-      #fileExists(path43) {
+      #fileExists(path44) {
         try {
-          fs_1.default.statSync(path43);
+          fs_1.default.statSync(path44);
           return true;
         } catch (e) {
           return false;
@@ -3966,7 +3966,7 @@ var require_dist = __commonJS({
       };
     }
     function getResolvedSearchPlaces(moduleName, toolDefinedSearchPlaces, userConfiguredOptions) {
-      const userConfiguredSearchPlaces = userConfiguredOptions.searchPlaces?.map((path43) => path43.replace("{name}", moduleName));
+      const userConfiguredSearchPlaces = userConfiguredOptions.searchPlaces?.map((path44) => path44.replace("{name}", moduleName));
       if (userConfiguredOptions.mergeSearchPlaces) {
         return [...userConfiguredSearchPlaces ?? [], ...toolDefinedSearchPlaces];
       }
@@ -4374,8 +4374,8 @@ var require_utils = __commonJS({
       }
       return output2;
     };
-    exports2.basename = (path43, { windows } = {}) => {
-      const segs = path43.split(windows ? /[\\/]/ : "/");
+    exports2.basename = (path44, { windows } = {}) => {
+      const segs = path44.split(windows ? /[\\/]/ : "/");
       const last = segs[segs.length - 1];
       if (last === "") {
         return segs[segs.length - 2];
@@ -7003,14 +7003,14 @@ var require_util2 = __commonJS({
         }
         const port = url2.port != null ? url2.port : url2.protocol === "https:" ? 443 : 80;
         let origin = url2.origin != null ? url2.origin : `${url2.protocol || ""}//${url2.hostname || ""}:${port}`;
-        let path43 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`;
+        let path44 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`;
         if (origin[origin.length - 1] === "/") {
           origin = origin.slice(0, origin.length - 1);
         }
-        if (path43 && path43[0] !== "/") {
-          path43 = `/${path43}`;
+        if (path44 && path44[0] !== "/") {
+          path44 = `/${path44}`;
         }
-        return new URL(`${origin}${path43}`);
+        return new URL(`${origin}${path44}`);
       }
       if (!isHttpOrHttpsPrefixed(url2.origin || url2.protocol)) {
         throw new InvalidArgumentError2("Invalid URL protocol: the URL must start with `http:` or `https:`.");
@@ -7831,9 +7831,9 @@ var require_diagnostics = __commonJS({
         "undici:client:sendHeaders",
         (evt) => {
           const {
-            request: { method, path: path43, origin }
+            request: { method, path: path44, origin }
           } = evt;
-          debugLog("sending request to %s %s%s", method, origin, path43);
+          debugLog("sending request to %s %s%s", method, origin, path44);
         }
       );
     }
@@ -7851,14 +7851,14 @@ var require_diagnostics = __commonJS({
         "undici:request:headers",
         (evt) => {
           const {
-            request: { method, path: path43, origin },
+            request: { method, path: path44, origin },
             response: { statusCode }
           } = evt;
           debugLog(
             "received response to %s %s%s - HTTP %d",
             method,
             origin,
-            path43,
+            path44,
             statusCode
           );
         }
@@ -7867,23 +7867,23 @@ var require_diagnostics = __commonJS({
         "undici:request:trailers",
         (evt) => {
           const {
-            request: { method, path: path43, origin }
+            request: { method, path: path44, origin }
           } = evt;
-          debugLog("trailers received from %s %s%s", method, origin, path43);
+          debugLog("trailers received from %s %s%s", method, origin, path44);
         }
       );
       diagnosticsChannel.subscribe(
         "undici:request:error",
         (evt) => {
           const {
-            request: { method, path: path43, origin },
+            request: { method, path: path44, origin },
             error: error62
           } = evt;
           debugLog(
             "request to %s %s%s errored - %s",
             method,
             origin,
-            path43,
+            path44,
             error62.message
           );
         }
@@ -7998,7 +7998,7 @@ var require_request = __commonJS({
     var kHandler = /* @__PURE__ */ Symbol("handler");
     var Request2 = class {
       constructor(origin, {
-        path: path43,
+        path: path44,
         method,
         body,
         headers,
@@ -8015,11 +8015,11 @@ var require_request = __commonJS({
         maxRedirections,
         typeOfService
       }, handler) {
-        if (typeof path43 !== "string") {
+        if (typeof path44 !== "string") {
           throw new InvalidArgumentError2("path must be a string");
-        } else if (path43[0] !== "/" && !(path43.startsWith("http://") || path43.startsWith("https://")) && method !== "CONNECT") {
+        } else if (path44[0] !== "/" && !(path44.startsWith("http://") || path44.startsWith("https://")) && method !== "CONNECT") {
           throw new InvalidArgumentError2("path must be an absolute URL or start with a slash");
-        } else if (invalidPathRegex.test(path43)) {
+        } else if (invalidPathRegex.test(path44)) {
           throw new InvalidArgumentError2("invalid request path");
         }
         if (typeof method !== "string") {
@@ -8094,7 +8094,7 @@ var require_request = __commonJS({
         this.completed = false;
         this.aborted = false;
         this.upgrade = upgrade || null;
-        this.path = query ? serializePathWithQuery(path43, query) : path43;
+        this.path = query ? serializePathWithQuery(path44, query) : path44;
         this.origin = origin;
         this.protocol = getProtocolFromUrlString(origin);
         this.idempotent = idempotent == null ? method === "HEAD" || method === "GET" : idempotent;
@@ -13276,7 +13276,7 @@ var require_client_h1 = __commonJS({
       return method !== "GET" && method !== "HEAD" && method !== "OPTIONS" && method !== "TRACE" && method !== "CONNECT";
     }
     function writeH1(client, request7) {
-      const { method, path: path43, host, upgrade, blocking, reset } = request7;
+      const { method, path: path44, host, upgrade, blocking, reset } = request7;
       let { body, headers, contentLength } = request7;
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH" || method === "QUERY" || method === "PROPFIND" || method === "PROPPATCH";
       if (util.isFormDataLike(body)) {
@@ -13354,7 +13354,7 @@ var require_client_h1 = __commonJS({
       if (socket.setTypeOfService) {
         socket.setTypeOfService(request7.typeOfService);
       }
-      let header = `${method} ${path43} HTTP/1.1\r
+      let header = `${method} ${path44} HTTP/1.1\r
 `;
       if (typeof host === "string") {
         header += `host: ${host}\r
@@ -14033,7 +14033,7 @@ var require_client_h2 = __commonJS({
       const headersTimeout = request7.headersTimeout ?? client[kHeadersTimeout];
       const bodyTimeout = request7.bodyTimeout ?? client[kBodyTimeout];
       const session = client[kHTTP2Session];
-      const { method, path: path43, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request7;
+      const { method, path: path44, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request7;
       let { body } = request7;
       if (upgrade != null && upgrade !== "websocket") {
         util.errorRequest(client, request7, new InvalidArgumentError2(`Custom upgrade "${upgrade}" not supported over HTTP/2`));
@@ -14102,7 +14102,7 @@ var require_client_h2 = __commonJS({
           }
           headers[HTTP2_HEADER_METHOD] = "CONNECT";
           headers[HTTP2_HEADER_PROTOCOL] = "websocket";
-          headers[HTTP2_HEADER_PATH] = path43;
+          headers[HTTP2_HEADER_PATH] = path44;
           if (protocol === "ws:" || protocol === "wss:") {
             headers[HTTP2_HEADER_SCHEME] = protocol === "ws:" ? "http" : "https";
           } else {
@@ -14144,7 +14144,7 @@ var require_client_h2 = __commonJS({
         stream.setTimeout(headersTimeout);
         return true;
       }
-      headers[HTTP2_HEADER_PATH] = path43;
+      headers[HTTP2_HEADER_PATH] = path44;
       headers[HTTP2_HEADER_SCHEME] = protocol === "http:" ? "http" : "https";
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH";
       if (body && typeof body.read === "function") {
@@ -14464,7 +14464,7 @@ var require_client = __commonJS({
     "use strict";
     var assert2 = require("node:assert");
     var net3 = require("node:net");
-    var http6 = require("node:http");
+    var http7 = require("node:http");
     var util = require_util2();
     var { ClientStats } = require_stats();
     var { channels } = require_diagnostics();
@@ -14522,7 +14522,7 @@ var require_client = __commonJS({
     var connectH1 = require_client_h1();
     var connectH2 = require_client_h2();
     var kClosedResolve = /* @__PURE__ */ Symbol("kClosedResolve");
-    var getDefaultNodeMaxHeaderSize = http6 && http6.maxHeaderSize && Number.isInteger(http6.maxHeaderSize) && http6.maxHeaderSize > 0 ? () => http6.maxHeaderSize : () => {
+    var getDefaultNodeMaxHeaderSize = http7 && http7.maxHeaderSize && Number.isInteger(http7.maxHeaderSize) && http7.maxHeaderSize > 0 ? () => http7.maxHeaderSize : () => {
       throw new InvalidArgumentError2("http module not available or http.maxHeaderSize invalid");
     };
     var noop = () => {
@@ -16496,10 +16496,10 @@ var require_proxy_agent = __commonJS({
         };
         const {
           origin,
-          path: path43 = "/",
+          path: path44 = "/",
           headers = {}
         } = opts;
-        opts.path = origin + path43;
+        opts.path = origin + path44;
         if (!("host" in headers) && !("Host" in headers)) {
           const { host } = new URL(origin);
           headers.host = host;
@@ -18608,20 +18608,20 @@ var require_mock_utils = __commonJS({
       }
       return normalizedQp;
     }
-    function safeUrl(path43) {
-      if (typeof path43 !== "string") {
-        return path43;
+    function safeUrl(path44) {
+      if (typeof path44 !== "string") {
+        return path44;
       }
-      const pathSegments = path43.split("?", 3);
+      const pathSegments = path44.split("?", 3);
       if (pathSegments.length !== 2) {
-        return path43;
+        return path44;
       }
       const qp = new URLSearchParams(pathSegments.pop());
       qp.sort();
       return [...pathSegments, qp.toString()].join("?");
     }
-    function matchKey(mockDispatch2, { path: path43, method, body, headers }) {
-      const pathMatch = matchValue(mockDispatch2.path, path43);
+    function matchKey(mockDispatch2, { path: path44, method, body, headers }) {
+      const pathMatch = matchValue(mockDispatch2.path, path44);
       const methodMatch = matchValue(mockDispatch2.method, method);
       const bodyMatch = typeof mockDispatch2.body !== "undefined" ? matchValue(mockDispatch2.body, body) : true;
       const headersMatch = matchHeaders(mockDispatch2, headers);
@@ -18646,8 +18646,8 @@ var require_mock_utils = __commonJS({
       const basePath = key.query ? serializePathWithQuery(key.path, key.query) : key.path;
       const resolvedPath = typeof basePath === "string" ? safeUrl(basePath) : basePath;
       const resolvedPathWithoutTrailingSlash = removeTrailingSlash(resolvedPath);
-      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path43, ignoreTrailingSlash }) => {
-        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path43)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path43), resolvedPath);
+      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path44, ignoreTrailingSlash }) => {
+        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path44)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path44), resolvedPath);
       });
       if (matchedMockDispatches.length === 0) {
         throw new MockNotMatchedError(`Mock dispatch not matched for path '${resolvedPath}'`);
@@ -18686,19 +18686,19 @@ var require_mock_utils = __commonJS({
         mockDispatches.splice(index, 1);
       }
     }
-    function removeTrailingSlash(path43) {
-      while (path43.endsWith("/")) {
-        path43 = path43.slice(0, -1);
+    function removeTrailingSlash(path44) {
+      while (path44.endsWith("/")) {
+        path44 = path44.slice(0, -1);
       }
-      if (path43.length === 0) {
-        path43 = "/";
+      if (path44.length === 0) {
+        path44 = "/";
       }
-      return path43;
+      return path44;
     }
     function buildKey(opts) {
-      const { path: path43, method, body, headers, query } = opts;
+      const { path: path44, method, body, headers, query } = opts;
       return {
-        path: path43,
+        path: path44,
         method,
         body,
         headers,
@@ -19388,10 +19388,10 @@ var require_pending_interceptors_formatter = __commonJS({
       }
       format(pendingInterceptors) {
         const withPrettyHeaders = pendingInterceptors.map(
-          ({ method, path: path43, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
+          ({ method, path: path44, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
             Method: method,
             Origin: origin,
-            Path: path43,
+            Path: path44,
             "Status code": statusCode,
             Persistent: persist ? PERSISTENT : NOT_PERSISTENT,
             Invocations: timesInvoked,
@@ -19473,9 +19473,9 @@ var require_mock_agent = __commonJS({
         const acceptNonStandardSearchParameters = this[kMockAgentAcceptsNonStandardSearchParameters];
         const dispatchOpts = { ...opts };
         if (acceptNonStandardSearchParameters && dispatchOpts.path) {
-          const [path43, searchParams] = dispatchOpts.path.split("?");
+          const [path44, searchParams] = dispatchOpts.path.split("?");
           const normalizedSearchParams = normalizeSearchParams(searchParams, acceptNonStandardSearchParameters);
-          dispatchOpts.path = `${path43}?${normalizedSearchParams}`;
+          dispatchOpts.path = `${path44}?${normalizedSearchParams}`;
         }
         return this[kAgent].dispatch(dispatchOpts, handler);
       }
@@ -19876,12 +19876,12 @@ var require_snapshot_recorder = __commonJS({
        * @return {Promise<void>} - Resolves when snapshots are loaded
        */
       async loadSnapshots(filePath) {
-        const path43 = filePath || this.#snapshotPath;
-        if (!path43) {
+        const path44 = filePath || this.#snapshotPath;
+        if (!path44) {
           throw new InvalidArgumentError2("Snapshot path is required");
         }
         try {
-          const data = await readFile(resolve(path43), "utf8");
+          const data = await readFile(resolve(path44), "utf8");
           const parsed = JSON.parse(data);
           if (Array.isArray(parsed)) {
             this.#snapshots.clear();
@@ -19895,7 +19895,7 @@ var require_snapshot_recorder = __commonJS({
           if (error62.code === "ENOENT") {
             this.#snapshots.clear();
           } else {
-            throw new UndiciError(`Failed to load snapshots from ${path43}`, { cause: error62 });
+            throw new UndiciError(`Failed to load snapshots from ${path44}`, { cause: error62 });
           }
         }
       }
@@ -19906,11 +19906,11 @@ var require_snapshot_recorder = __commonJS({
        * @returns {Promise<void>} - Resolves when snapshots are saved
        */
       async saveSnapshots(filePath) {
-        const path43 = filePath || this.#snapshotPath;
-        if (!path43) {
+        const path44 = filePath || this.#snapshotPath;
+        if (!path44) {
           throw new InvalidArgumentError2("Snapshot path is required");
         }
-        const resolvedPath = resolve(path43);
+        const resolvedPath = resolve(path44);
         await mkdir(dirname2(resolvedPath), { recursive: true });
         const data = Array.from(this.#snapshots.entries()).map(([hash2, snapshot]) => ({
           hash: hash2,
@@ -20542,15 +20542,15 @@ var require_redirect_handler = __commonJS({
           return;
         }
         const { origin, pathname, search } = util.parseURL(new URL(this.location, this.opts.origin && new URL(this.opts.path, this.opts.origin)));
-        const path43 = search ? `${pathname}${search}` : pathname;
-        const redirectUrlString = `${origin}${path43}`;
+        const path44 = search ? `${pathname}${search}` : pathname;
+        const redirectUrlString = `${origin}${path44}`;
         for (const historyUrl of this.history) {
           if (historyUrl.toString() === redirectUrlString) {
             throw new InvalidArgumentError2(`Redirect loop detected. Cannot redirect to ${origin}. This typically happens when using a Client or Pool with cross-origin redirects. Use an Agent for cross-origin redirects.`);
           }
         }
         this.opts.headers = cleanRequestHeaders(this.opts.headers, statusCode === 303, this.opts.origin !== origin);
-        this.opts.path = path43;
+        this.opts.path = path44;
         this.opts.origin = origin;
         this.opts.query = null;
       }
@@ -22310,10 +22310,10 @@ var require_cache_handler = __commonJS({
       }
       return locationUrl.pathname + locationUrl.search;
     }
-    function deleteCachedUri(store, cacheKey, path43) {
+    function deleteCachedUri(store, cacheKey, path44) {
       deleteCachedValue(store, {
         ...cacheKey,
-        path: path43
+        path: path44
       });
       for (let i2 = 0; i2 < util.safeHTTPMethods.length; i2++) {
         const method = util.safeHTTPMethods[i2];
@@ -22321,7 +22321,7 @@ var require_cache_handler = __commonJS({
           deleteCachedValue(store, {
             ...cacheKey,
             method,
-            path: path43
+            path: path44
           });
         }
       }
@@ -22332,9 +22332,9 @@ var require_cache_handler = __commonJS({
       }
       const values = Array.isArray(headerValue2) ? headerValue2 : [headerValue2];
       for (let i2 = 0; i2 < values.length; i2++) {
-        const path43 = getSameOriginPath(cacheKey, values[i2]);
-        if (path43 !== void 0) {
-          deleteCachedUri(store, cacheKey, path43);
+        const path44 = getSameOriginPath(cacheKey, values[i2]);
+        if (path44 !== void 0) {
+          deleteCachedUri(store, cacheKey, path44);
         }
       }
     }
@@ -27334,11 +27334,11 @@ var require_fetch = __commonJS({
       function dispatch({ body }) {
         const url2 = requestCurrentURL(request7);
         const agent = fetchParams.controller.dispatcher;
-        const path43 = url2.pathname + url2.search;
+        const path44 = url2.pathname + url2.search;
         const hasTrailingQuestionMark = url2.search.length === 0 && url2.href[url2.href.length - url2.hash.length - 1] === "?";
         return new Promise((resolve, reject) => agent.dispatch(
           {
-            path: hasTrailingQuestionMark ? `${path43}?` : path43,
+            path: hasTrailingQuestionMark ? `${path44}?` : path44,
             origin: url2.origin,
             method: request7.method,
             body: agent.isMockActive ? request7.body && (request7.body.source || request7.body.stream) : body,
@@ -28285,9 +28285,9 @@ var require_util5 = __commonJS({
         }
       }
     }
-    function validateCookiePath(path43) {
-      for (let i2 = 0; i2 < path43.length; ++i2) {
-        const code = path43.charCodeAt(i2);
+    function validateCookiePath(path44) {
+      for (let i2 = 0; i2 < path44.length; ++i2) {
+        const code = path44.charCodeAt(i2);
         if (code < 32 || // exclude CTLs (0-31)
         code > 126 || // exclude DEL and non-ascii
         code === 59) {
@@ -31635,11 +31635,11 @@ var require_undici = __commonJS({
           if (typeof opts.path !== "string") {
             throw new InvalidArgumentError2("invalid opts.path");
           }
-          let path43 = opts.path;
+          let path44 = opts.path;
           if (!opts.path.startsWith("/")) {
-            path43 = `/${path43}`;
+            path44 = `/${path44}`;
           }
-          url2 = new URL(util.parseOrigin(url2).origin + path43);
+          url2 = new URL(util.parseOrigin(url2).origin + path44);
         } else {
           if (!opts) {
             opts = typeof url2 === "object" ? url2 : {};
@@ -31749,7 +31749,7 @@ ${captureLines}` : capture.stack;
 });
 
 // src/cli.ts
-var import_node_path41 = __toESM(require("node:path"), 1);
+var import_node_path42 = __toESM(require("node:path"), 1);
 
 // node_modules/.pnpm/commander@15.0.0/node_modules/commander/lib/error.js
 var CommanderError = class extends Error {
@@ -34862,9 +34862,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
    * @param {string} [path]
    * @return {(string|null|Command)}
    */
-  executableDir(path43) {
-    if (path43 === void 0) return this._executableDir;
-    this._executableDir = path43;
+  executableDir(path44) {
+    if (path44 === void 0) return this._executableDir;
+    this._executableDir = path44;
     return this;
   }
   /**
@@ -36002,10 +36002,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path43) {
-  if (!path43)
+function getElementAtPath(obj, path44) {
+  if (!path44)
     return obj;
-  return path43.reduce((acc, key) => acc?.[key], obj);
+  return path44.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -36345,11 +36345,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path43, issues) {
+function prefixIssues(path44, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path43);
+    iss.path.unshift(path44);
     return iss;
   });
 }
@@ -36799,16 +36799,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path43 = []) => {
+  const processError = (error63, path44 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path43, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path44, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path43, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path44, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path43, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path44, ...issue2.path]);
       } else {
-        const fullpath = [...path43, ...issue2.path];
+        const fullpath = [...path44, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -36847,17 +36847,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error63, path43 = []) => {
+  const processError = (error63, path44 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path43, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path44, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path43, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path44, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path43, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path44, ...issue2.path]);
       } else {
-        const fullpath = [...path43, ...issue2.path];
+        const fullpath = [...path44, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -36896,8 +36896,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path43 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path43) {
+  const path44 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path44) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -53999,13 +53999,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path43 = ref.slice(1).split("/").filter(Boolean);
-  if (path43.length === 0) {
+  const path44 = ref.slice(1).split("/").filter(Boolean);
+  if (path44.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path43[0] === defsKey) {
-    const key = path43[1] === void 0 ? void 0 : decodeJSONPointerSegment(path43[1]);
+  if (path44[0] === defsKey) {
+    const key = path44[1] === void 0 ? void 0 : decodeJSONPointerSegment(path44[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -55242,6 +55242,8 @@ var ProviderEnvSchema = external_exports.record(external_exports.string().min(1)
 var PROVIDER_KINDS = ["http", "codex"];
 var CODEX_TIERS = ["fable", "opus", "sonnet", "haiku"];
 var CODEX_EFFORTS = ["none", "low", "medium", "high"];
+var CODEX_LOGINS = ["codex-cli", "chatgpt-sign-in"];
+var CODEX_DEFAULT_LOGIN = "codex-cli";
 var CODEX_DEFAULT_MODEL = "gpt-5.6-sol";
 var CODEX_DEFAULT_TIER_MODELS = Object.freeze({
   fable: "gpt-5.6-sol",
@@ -55261,7 +55263,9 @@ var CodexProviderConfigSchema = external_exports.strictObject({
     haiku: external_exports.string().min(1).optional()
   }).optional(),
   /** The reasoning effort used when the request's own `output_config.effort` is not one the backend accepts. */
-  effort: external_exports.enum(CODEX_EFFORTS).optional()
+  effort: external_exports.enum(CODEX_EFFORTS).optional(),
+  /** Which login the upstream call is made with; see `CODEX_LOGINS`. */
+  login: external_exports.enum(CODEX_LOGINS).optional()
 });
 var HttpProviderSchema = external_exports.strictObject({
   $schema: external_exports.string().optional(),
@@ -58058,6 +58062,20 @@ var import_node_path13 = __toESM(require("node:path"), 1);
 
 // src/launcher/identity.ts
 var import_node_path10 = __toESM(require("node:path"), 1);
+var IDENTITY_DECISION_SOURCES = [
+  /** `CLAUDE_CONFIG_DIR` was already set: identity resolution is skipped entirely and the real binary uses whatever it already points to. */
+  "config-dir-escape-hatch",
+  /** A leading `@name` argv[0] positional, or its explicit form `--identity <name>`. */
+  "argv",
+  /** The `AGENT_SHIM_IDENTITY` environment variable. */
+  "env",
+  /** A directory rule pinning an identity to the current path. */
+  "directory-pin",
+  /** The persisted `~/.agent-shim/active-identity` file. */
+  "active-identity-file",
+  /** Nothing resolved an identity at all — a bare launch with no active identity. */
+  "none"
+];
 function poolNameOf(selector) {
   return selector.startsWith(POOL_SELECTOR_PREFIX) ? selector.slice(POOL_SELECTOR_PREFIX.length) : void 0;
 }
@@ -58087,6 +58105,20 @@ function decideIdentity(params) {
   }
   return { source: "none", configDirEscapeHatch: false };
 }
+var CONFIG_PROFILE_DECISION_SOURCES = [
+  /** An explicit `--config-profile` CLI flag. */
+  "cli-flag",
+  /** The `AGENT_SHIM_CONFIG_PROFILE` environment variable. */
+  "env",
+  /** A directory rule's `configProfile` selection for `$PWD`. */
+  "directory-rule",
+  /** The active identity's own declared `defaultConfigProfile`. */
+  "identity-default",
+  /** The user-global `~/.agent-shim/config.json` default. */
+  "global-default",
+  /** Nothing resolved a configuration profile at all. */
+  "none"
+];
 function decideConfigProfile(params) {
   if (isNonEmpty(params.cliFlagConfigProfile)) {
     return { name: params.cliFlagConfigProfile, source: "cli-flag" };
@@ -59114,6 +59146,12 @@ function encodeProjectPattern(fragment, options) {
   }
   return splitOnWildcards(expanded).map((piece) => piece.kind === "literal" ? encodeProjectPath(piece.text) : piece.text).join("");
 }
+var ENCODING_AMBIGUITY_REASONS = [
+  /** The literal portion contains a character other than `/` that encodes to `-`, so a sibling path differing only in that character encodes identically. */
+  "lossy-characters",
+  /** Two different patterns in the same configuration encode to the identical form. */
+  "collides-with-sibling-pattern"
+];
 function lossyCharacters(literal2) {
   const found = /* @__PURE__ */ new Set();
   for (const character of literal2) {
@@ -60244,6 +60282,7 @@ function buildLayoutPaths(root) {
     frontdoorCaCertFile: import_node_path19.default.join(root, "frontdoor", "ca", "ca.pem"),
     frontdoorCaKeyFile: import_node_path19.default.join(root, "frontdoor", "ca", "ca.key"),
     frontdoorCaBundlesDir: import_node_path19.default.join(root, "frontdoor", "ca", "bundles"),
+    chatgptSignInFile: import_node_path19.default.join(root, "codex", "chatgpt-sign-in.json"),
     frontdoorStateFile: import_node_path19.default.join(root, "frontdoor", "state.json"),
     frontdoorLockFile: import_node_path19.default.join(root, "frontdoor", "start.lock"),
     frontdoorControlTokenFile: import_node_path19.default.join(root, "frontdoor", "control-token"),
@@ -61710,7 +61749,7 @@ function registerIdentityCommand(program2, deps) {
 // package.json
 var package_default = {
   name: "agent-shim",
-  version: "8.14.1",
+  version: "8.16.0",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -62140,11 +62179,11 @@ function providerBaseUrl(port, provider) {
 function directOrigin(port) {
   return `http://127.0.0.1:${String(port)}`;
 }
-function parseProviderPath(path43) {
-  if (!path43.startsWith(PROVIDER_PATH_PREFIX)) {
+function parseProviderPath(path44) {
+  if (!path44.startsWith(PROVIDER_PATH_PREFIX)) {
     return void 0;
   }
-  const tail = path43.slice(PROVIDER_PATH_PREFIX.length);
+  const tail = path44.slice(PROVIDER_PATH_PREFIX.length);
   const slash = tail.indexOf("/");
   if (slash <= 0) {
     return void 0;
@@ -62544,9 +62583,9 @@ function decoderFor(encoding) {
       return void 0;
   }
 }
-function destinationOf(path43) {
-  const scoped = parseProviderPath(path43);
-  return scoped === void 0 ? { provider: ANTHROPIC_PROVIDER, endpoint: path43 } : { provider: scoped.provider, endpoint: scoped.rest };
+function destinationOf(path44) {
+  const scoped = parseProviderPath(path44);
+  return scoped === void 0 ? { provider: ANTHROPIC_PROVIDER, endpoint: path44 } : { provider: scoped.provider, endpoint: scoped.rest };
 }
 function buildRecord(event, context) {
   const { scan } = context;
@@ -63450,7 +63489,7 @@ var ProviderKindMismatchError = class extends UsageError {
   }
 };
 function isEmptyCodexConfig(config2) {
-  return config2 === void 0 || config2.defaultModel === void 0 && config2.effort === void 0 && (config2.models === void 0 || Object.keys(config2.models).length === 0);
+  return config2 === void 0 || config2.defaultModel === void 0 && config2.effort === void 0 && config2.login === void 0 && (config2.models === void 0 || Object.keys(config2.models).length === 0);
 }
 function addProvider(paths, name, input2) {
   if (providerExists(paths, name)) {
@@ -63591,6 +63630,7 @@ function parseEnvBool(variable, value2) {
 }
 
 // src/launcher/claudeVersion.ts
+var CLAUDE_VERSION_SOURCES = ["flag", "environment", "cascade"];
 var InvalidClaudeVersionError = class extends UsageError {
   constructor(value2, origin) {
     super(`${origin} names Claude Code version "${value2}", which is not an exact dotted-numeric version such as 2.1.220.`);
@@ -63904,7 +63944,7 @@ function formatCheckReport(report) {
   const { credential } = report;
   if (credential.provider !== void 0) {
     lines.push(
-      `  Provider ${credential.provider.name}: ${credential.provider.credential === void 0 ? `unusable: ${credential.provider.problem ?? ""}` : formatCredentialSummary(credential.provider.credential)}${credential.provider.cached === void 0 ? "" : `; ${formatCachedCredentialState(credential.provider.cached)}`}`
+      `  Provider ${credential.provider.name}: ${credential.provider.credential === void 0 ? `unusable: ${credential.provider.problem}` : formatCredentialSummary(credential.provider.credential)}${credential.provider.cached === void 0 ? "" : `; ${formatCachedCredentialState(credential.provider.cached)}`}`
     );
   }
   if (credential.identity !== void 0) {
@@ -64086,7 +64126,7 @@ function registerCheckCommand(program2, deps) {
 }
 
 // src/codex/commands.ts
-var import_node_crypto7 = require("node:crypto");
+var import_node_crypto9 = require("node:crypto");
 var import_node_fs11 = __toESM(require("node:fs"), 1);
 var import_node_os6 = __toESM(require("node:os"), 1);
 var import_node_path31 = __toESM(require("node:path"), 1);
@@ -64237,8 +64277,273 @@ function createCodexAuthStore(authPath, ports) {
   };
 }
 
-// src/codex/upstream.ts
+// src/codex/siwc.ts
 var import_node_crypto6 = require("node:crypto");
+var SIWC_AUTHORIZE_URL = "https://auth.openai.com/api/accounts/authorize";
+var SIWC_TOKEN_URL = "https://auth.openai.com/api/accounts/oauth/token";
+var SIWC_REVOKE_URL = "https://auth.openai.com/api/accounts/oauth/revoke";
+var SIWC_ISSUER = "https://auth.openai.com";
+var SIWC_JWKS_URL = "https://auth.openai.com/.well-known/jwks.json";
+var SIWC_DYNAMIC_CLIENT_ID = "dynamic_agent_client";
+var SIWC_RESOURCE = "https://api.openai.com/v1";
+var SIWC_RESPONSES_URL = `${SIWC_RESOURCE}/responses`;
+var SIWC_SCOPES = ["openid", "profile", "email", "offline_access", "resource.invoke", "chatgpt.tokens.use.direct"];
+var SIWC_PLAN_SCOPE = "chatgpt.tokens.use.direct";
+var SIWC_CALLBACK_PORT = 1455;
+var SIWC_CALLBACK_PATH = "/auth/callback";
+var SIWC_RANDOM_BYTES = 32;
+var MS_PER_SECOND4 = 1e3;
+var ID_TOKEN_ALGORITHM = "RS256";
+var SiwcError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SiwcError";
+  }
+};
+var SiwcInvalidGrantError = class extends SiwcError {
+  constructor(message) {
+    super(message);
+    this.name = "SiwcInvalidGrantError";
+  }
+};
+function base64Url(bytes) {
+  return Buffer.from(bytes).toString("base64url");
+}
+function newPkce(randomBytes4) {
+  const verifier = base64Url(randomBytes4(SIWC_RANDOM_BYTES));
+  return { verifier, challenge: (0, import_node_crypto6.createHash)("sha256").update(verifier).digest("base64url") };
+}
+function newOpaqueValue(randomBytes4) {
+  return base64Url(randomBytes4(SIWC_RANDOM_BYTES));
+}
+function buildAuthorizeUrl(request7) {
+  const url2 = new URL(SIWC_AUTHORIZE_URL);
+  const params = url2.searchParams;
+  params.set("client_id", request7.clientId ?? SIWC_DYNAMIC_CLIENT_ID);
+  if (request7.clientId === void 0) {
+    params.set("agent_name_hint", request7.agentName);
+  }
+  if (request7.returning !== void 0) {
+    params.set("id_token_hint", request7.returning.idToken);
+    if (request7.returning.loginHint !== void 0) {
+      params.set("login_hint", request7.returning.loginHint);
+    }
+  }
+  params.set("response_type", "code");
+  params.set("redirect_uri", request7.redirectUri);
+  params.set("scope", SIWC_SCOPES.join(" "));
+  params.set("resource", SIWC_RESOURCE);
+  params.set("state", request7.state);
+  params.set("nonce", request7.nonce);
+  params.set("code_challenge_method", "S256");
+  params.set("code_challenge", request7.challenge);
+  return url2.toString();
+}
+function parseCallback(url2, expectedState) {
+  const params = url2.searchParams;
+  const error62 = params.get("error");
+  if (error62 !== null) {
+    throw new SiwcError(`the sign-in was refused: ${error62}${params.has("error_description") ? ` (${params.get("error_description") ?? ""})` : ""}`);
+  }
+  if (params.get("state") !== expectedState) {
+    throw new SiwcError("the sign-in callback's state did not match the request, so it was discarded");
+  }
+  const code = params.get("code");
+  if (code === null || code === "") {
+    throw new SiwcError("the sign-in callback carried no authorization code");
+  }
+  const scope = params.get("scope");
+  return { code, clientId: params.get("client_id") ?? void 0, scopes: scope === null ? [] : scope.split(" ").filter((part) => part !== "") };
+}
+var TokenResponseSchema = external_exports.looseObject({
+  access_token: external_exports.string().min(1),
+  refresh_token: external_exports.string().min(1).optional(),
+  id_token: external_exports.string().min(1).optional(),
+  expires_in: external_exports.number().positive(),
+  scope: external_exports.string().optional()
+});
+var ERROR_BODY_CHARS = 300;
+var TOKEN_CALL_TIMEOUT_MS = 3e4;
+async function postToken(ports, form, what) {
+  const response = await ports.fetch(SIWC_TOKEN_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({ ...form, resource: SIWC_RESOURCE }).toString(),
+    signal: AbortSignal.timeout(TOKEN_CALL_TIMEOUT_MS)
+  });
+  if (!response.ok) {
+    const detail = (await response.text()).slice(0, ERROR_BODY_CHARS);
+    const message = `the ${what} failed with HTTP ${String(response.status)}: ${detail}`;
+    throw /"error"\s*:\s*"invalid_grant"/.test(detail) ? new SiwcInvalidGrantError(message) : new SiwcError(message);
+  }
+  const parsed = TokenResponseSchema.safeParse(await response.json());
+  if (!parsed.success) {
+    throw new SiwcError(`the ${what} answered without an access token and a lifetime`);
+  }
+  return parsed.data;
+}
+function grantTokens(ports, answer) {
+  return {
+    accessToken: answer.access_token,
+    refreshToken: answer.refresh_token,
+    idToken: answer.id_token,
+    scopes: answer.scope === void 0 ? void 0 : answer.scope.split(" ").filter((part) => part !== ""),
+    expiresAt: ports.now().getTime() + answer.expires_in * MS_PER_SECOND4
+  };
+}
+async function exchangeCode(ports, request7) {
+  return grantTokens(
+    ports,
+    await postToken(ports, { grant_type: "authorization_code", client_id: request7.clientId, code: request7.code, code_verifier: request7.verifier, redirect_uri: request7.redirectUri }, "authorisation code exchange")
+  );
+}
+async function refreshTokens(ports, request7) {
+  return grantTokens(ports, await postToken(ports, { grant_type: "refresh_token", client_id: request7.clientId, refresh_token: request7.refreshToken }, "token refresh"));
+}
+var JwtHeaderSchema = external_exports.looseObject({ alg: external_exports.string(), kid: external_exports.string().optional() });
+var IdTokenClaimsSchema = external_exports.looseObject({
+  iss: external_exports.string(),
+  sub: external_exports.string().min(1),
+  aud: external_exports.union([external_exports.string(), external_exports.array(external_exports.string())]),
+  exp: external_exports.number(),
+  nonce: external_exports.string().optional(),
+  email: external_exports.string().optional()
+});
+var JwksSchema = external_exports.object({ keys: external_exports.array(external_exports.looseObject({ kid: external_exports.string().optional(), kty: external_exports.string() })) });
+function decodeSegment(segment) {
+  if (segment === void 0) {
+    throw new SiwcError("the ID token is not a three-part JWT");
+  }
+  try {
+    const parsed = JSON.parse(Buffer.from(segment, "base64url").toString("utf8"));
+    return parsed;
+  } catch {
+    throw new SiwcError("the ID token has an unreadable segment");
+  }
+}
+async function verifyIdToken(ports, idToken, expected) {
+  const [headerSegment, payloadSegment, signatureSegment, ...rest] = idToken.split(".");
+  if (rest.length > 0 || headerSegment === void 0 || payloadSegment === void 0 || signatureSegment === void 0) {
+    throw new SiwcError("the ID token is not a three-part JWT");
+  }
+  const header = JwtHeaderSchema.parse(decodeSegment(headerSegment));
+  if (header.alg !== ID_TOKEN_ALGORITHM) {
+    throw new SiwcError(`the ID token is signed with ${header.alg}, and only ${ID_TOKEN_ALGORITHM} is accepted`);
+  }
+  const response = await ports.fetch(SIWC_JWKS_URL, { method: "GET", headers: {}, signal: AbortSignal.timeout(TOKEN_CALL_TIMEOUT_MS) });
+  if (!response.ok) {
+    throw new SiwcError(`the issuer's key set could not be fetched (HTTP ${String(response.status)})`);
+  }
+  const jwk = JwksSchema.parse(await response.json()).keys.find((key) => key.kty === "RSA" && (header.kid === void 0 || key.kid === header.kid));
+  if (jwk === void 0) {
+    throw new SiwcError("the issuer's key set has no key for the ID token's signature");
+  }
+  const signed = Buffer.from(`${headerSegment}.${payloadSegment}`);
+  if (!(0, import_node_crypto6.verify)("sha256", signed, (0, import_node_crypto6.createPublicKey)({ key: jwk, format: "jwk" }), Buffer.from(signatureSegment, "base64url"))) {
+    throw new SiwcError("the ID token's signature did not verify");
+  }
+  const claims = IdTokenClaimsSchema.parse(decodeSegment(payloadSegment));
+  if (claims.iss !== SIWC_ISSUER) {
+    throw new SiwcError(`the ID token was issued by ${claims.iss}, not ${SIWC_ISSUER}`);
+  }
+  if (!(Array.isArray(claims.aud) ? claims.aud : [claims.aud]).includes(expected.clientId)) {
+    throw new SiwcError("the ID token was issued for a different client");
+  }
+  if (claims.exp * MS_PER_SECOND4 <= ports.now().getTime()) {
+    throw new SiwcError("the ID token has already expired");
+  }
+  if (expected.nonce !== void 0 && claims.nonce !== expected.nonce) {
+    throw new SiwcError("the ID token's nonce did not match the request");
+  }
+  return { sub: claims.sub, email: claims.email };
+}
+
+// src/codex/siwcLogin.ts
+var SIWC_AGENT_NAME = "agent-shim";
+var SIWC_LOGIN_TIMEOUT_MS = 3e5;
+async function runSiwcLogin(ports, options) {
+  const existing = ports.store.read();
+  const returning = existing?.grant;
+  for (let attempt = 0; ; attempt += 1) {
+    const clientId = ports.store.read()?.registeredClientId ?? returning?.clientId;
+    try {
+      return await authorizeOnce(ports, options, clientId, attempt === 0 ? returning : void 0);
+    } catch (error62) {
+      if (!(error62 instanceof SiwcInvalidGrantError) || attempt > 0) {
+        throw error62;
+      }
+      ports.print("OpenAI did not accept the first code, which is expected once after registering: authorising again with the registration it issued.");
+    }
+  }
+}
+async function authorizeOnce(ports, options, savedClientId, returning) {
+  const pkce = newPkce(ports.siwc.randomBytes);
+  const state = newOpaqueValue(ports.siwc.randomBytes);
+  const nonce = newOpaqueValue(ports.siwc.randomBytes);
+  const redirectUri = `http://127.0.0.1:${String(SIWC_CALLBACK_PORT)}${SIWC_CALLBACK_PATH}`;
+  const url2 = buildAuthorizeUrl({
+    clientId: savedClientId,
+    agentName: SIWC_AGENT_NAME,
+    redirectUri,
+    state,
+    nonce,
+    challenge: pkce.challenge,
+    ...returning === void 0 ? {} : { returning: { idToken: returning.idToken, loginHint: returning.email } }
+  });
+  const listener = await ports.listen(SIWC_CALLBACK_PORT, state);
+  try {
+    ports.print(`Sign in at: ${url2}`);
+    if (options.open) {
+      ports.openBrowser(url2);
+    }
+    const callback = parseCallback(await listener.waitForCallback(AbortSignal.timeout(SIWC_LOGIN_TIMEOUT_MS)), state);
+    const clientId = callback.clientId ?? savedClientId;
+    if (clientId === void 0) {
+      throw new SiwcError("the sign-in callback carried no client id and none was stored from an earlier sign-in");
+    }
+    const grantBefore = ports.store.read()?.grant;
+    ports.store.write({ registeredClientId: clientId, ...grantBefore === void 0 ? {} : { grant: grantBefore } });
+    const tokens = await exchangeCode(ports.siwc, { clientId, code: callback.code, verifier: pkce.verifier, redirectUri });
+    if (tokens.refreshToken === void 0 || tokens.idToken === void 0) {
+      throw new SiwcError("the token endpoint did not return a refresh token and an ID token, so the sign-in cannot be kept");
+    }
+    const scopes = tokens.scopes ?? callback.scopes;
+    if (!scopes.includes(SIWC_PLAN_SCOPE)) {
+      throw new SiwcError("the sign-in was not granted permission to use your ChatGPT plan: run the login again and allow it");
+    }
+    const identity = await verifyIdToken(ports.siwc, tokens.idToken, { clientId, nonce });
+    ports.store.write({
+      registeredClientId: clientId,
+      grant: { clientId, sub: identity.sub, ...identity.email === void 0 ? {} : { email: identity.email }, idToken: tokens.idToken, accessToken: tokens.accessToken, refreshToken: tokens.refreshToken, scopes, expiresAt: tokens.expiresAt }
+    });
+    return { email: identity.email, sub: identity.sub };
+  } finally {
+    listener.close();
+  }
+}
+var REVOKE_TIMEOUT_MS = 3e4;
+async function runSiwcLogout(ports) {
+  const file2 = ports.store.read();
+  if (file2?.grant === void 0) {
+    return { hadGrant: false, revoked: false };
+  }
+  const revoked = await ports.siwc.fetch(SIWC_REVOKE_URL, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({ token: file2.grant.refreshToken, token_type_hint: "refresh_token", client_id: file2.grant.clientId }).toString(),
+    signal: AbortSignal.timeout(REVOKE_TIMEOUT_MS)
+  }).then(
+    (response) => response.ok,
+    () => false
+  );
+  ports.store.write({ registeredClientId: file2.grant.clientId });
+  return { hadGrant: true, revoked };
+}
+
+// src/codex/siwcPorts.ts
+var import_node_child_process4 = require("node:child_process");
+var import_node_crypto7 = require("node:crypto");
+var import_node_http = __toESM(require("node:http"), 1);
 
 // src/codex/http.ts
 var HTTP_STATUS = {
@@ -64256,7 +64561,157 @@ var HTTP_STATUS = {
   badGateway: 502
 };
 
+// src/codex/siwcPorts.ts
+function realSiwcPorts(fetch3) {
+  return { fetch: fetch3, randomBytes: (size) => (0, import_node_crypto7.randomBytes)(size), now: () => /* @__PURE__ */ new Date() };
+}
+var CALLBACK_PAGE = "<!doctype html><meta charset=utf-8><title>Signed in</title><p>You can close this tab and return to the terminal.</p>";
+async function listenForCallback(port, state) {
+  let deliver;
+  const arrived = new Promise((resolve) => {
+    deliver = resolve;
+  });
+  const server = import_node_http.default.createServer((request7, response) => {
+    const url2 = new URL(request7.url ?? "/", `http://127.0.0.1:${String(port)}`);
+    if (request7.method !== "GET" || url2.pathname !== SIWC_CALLBACK_PATH || url2.searchParams.getAll("state").length !== 1 || url2.searchParams.get("state") !== state) {
+      response.writeHead(HTTP_STATUS.notFound).end("Not found");
+      return;
+    }
+    response.writeHead(HTTP_STATUS.ok, { "Content-Type": "text/html; charset=utf-8" });
+    response.end(CALLBACK_PAGE);
+    deliver?.(url2);
+  });
+  await new Promise((resolve, reject) => {
+    server.once("error", (error62) => {
+      reject(error62.code === "EADDRINUSE" ? new Error(`port ${String(port)} is in use (another sign-in, such as \`codex login\`, may be running): finish or stop it and try again`) : error62);
+    });
+    server.listen(port, "127.0.0.1", () => {
+      resolve();
+    });
+  });
+  return {
+    waitForCallback: async (signal) => await Promise.race([
+      arrived,
+      new Promise((_resolve, reject) => {
+        signal.addEventListener("abort", () => {
+          reject(new Error("timed out waiting for the browser sign-in to finish"));
+        });
+      })
+    ]),
+    close: () => {
+      server.close();
+      server.closeAllConnections();
+    }
+  };
+}
+function openInBrowser(url2) {
+  const command = process.platform === "darwin" ? { file: "open", args: [url2] } : process.platform === "win32" ? { file: "cmd", args: ["/c", "start", "", url2] } : { file: "xdg-open", args: [url2] };
+  (0, import_node_child_process4.spawn)(command.file, command.args, { detached: true, stdio: "ignore" }).unref();
+}
+
+// src/codex/siwcStore.ts
+var SiwcGrantSchema = external_exports.strictObject({
+  clientId: external_exports.string().min(1),
+  sub: external_exports.string().min(1),
+  email: external_exports.string().optional(),
+  idToken: external_exports.string().min(1),
+  accessToken: external_exports.string().min(1),
+  refreshToken: external_exports.string().min(1),
+  scopes: external_exports.array(external_exports.string()).readonly(),
+  /** When the access token stops working, in milliseconds since the epoch. */
+  expiresAt: external_exports.number()
+});
+var SiwcFileSchema = external_exports.strictObject({ registeredClientId: external_exports.string().min(1).optional(), grant: SiwcGrantSchema.optional() });
+var SIWC_REFRESH_MARGIN_MS = 6e4;
+function parseSiwcFile(raw, filePath) {
+  let json2;
+  try {
+    json2 = JSON.parse(raw);
+  } catch {
+    throw new CodexAuthError(`${filePath} is not valid JSON: run \`agent-shim codex login\` again`);
+  }
+  const parsed = SiwcFileSchema.safeParse(json2);
+  if (!parsed.success) {
+    throw new CodexAuthError(`${filePath} is not a Sign in with ChatGPT file: run \`agent-shim codex login\` again`);
+  }
+  return parsed.data;
+}
+function grantFrom(previous, tokens) {
+  return {
+    ...previous,
+    accessToken: tokens.accessToken,
+    refreshToken: tokens.refreshToken ?? previous.refreshToken,
+    idToken: tokens.idToken ?? previous.idToken,
+    scopes: tokens.scopes ?? previous.scopes,
+    expiresAt: tokens.expiresAt
+  };
+}
+function createSiwcStore(filePath, ports) {
+  let cached2;
+  let inFlight;
+  const read = () => {
+    const raw = ports.fs.read(filePath);
+    return raw === void 0 ? void 0 : parseSiwcFile(raw, filePath);
+  };
+  const write = (file2) => {
+    const temp = `${filePath}.${ports.tempSuffix}.tmp`;
+    ports.fs.writePrivate(temp, `${JSON.stringify(file2, null, 2)}
+`);
+    ports.fs.rename(temp, filePath);
+    cached2 = file2.grant;
+  };
+  const loadSignedIn = () => {
+    const file2 = read();
+    if (file2?.grant === void 0) {
+      throw new CodexAuthError(`no Sign in with ChatGPT login at ${filePath}: run \`agent-shim codex login\` first`);
+    }
+    if (!file2.grant.scopes.includes(SIWC_PLAN_SCOPE)) {
+      throw new CodexAuthError(`the Sign in with ChatGPT login at ${filePath} was not granted permission to use your ChatGPT plan: run \`agent-shim codex login\` again and allow it`);
+    }
+    return { file: file2, grant: file2.grant };
+  };
+  const credentialsOf2 = (grant) => ({ accessToken: grant.accessToken, accountId: void 0 });
+  const doRefresh = async (rejected) => {
+    const { file: file2, grant } = loadSignedIn();
+    if (rejected !== void 0 && grant.accessToken !== rejected) {
+      cached2 = grant;
+      return credentialsOf2(grant);
+    }
+    let tokens;
+    try {
+      tokens = await refreshTokens(ports.siwc, { clientId: grant.clientId, refreshToken: grant.refreshToken });
+    } catch (error62) {
+      if (error62 instanceof SiwcError) {
+        throw new CodexAuthError(`${error62.message}: run \`agent-shim codex login\` again if the login was revoked`);
+      }
+      throw error62;
+    }
+    const next = grantFrom(grant, tokens);
+    write({ ...file2, grant: next });
+    return credentialsOf2(next);
+  };
+  const refreshOnce = async (rejected) => await (inFlight ??= doRefresh(rejected).finally(() => {
+    inFlight = void 0;
+  }));
+  return {
+    read,
+    write,
+    auth: {
+      current: async () => {
+        const grant = cached2 ?? loadSignedIn().grant;
+        cached2 = grant;
+        if (grant.expiresAt - SIWC_REFRESH_MARGIN_MS <= ports.siwc.now().getTime()) {
+          return await refreshOnce(void 0);
+        }
+        return credentialsOf2(grant);
+      },
+      refresh: async (rejected) => await refreshOnce(rejected)
+    }
+  };
+}
+
 // src/codex/upstream.ts
+var import_node_crypto8 = require("node:crypto");
 var CODEX_RESPONSES_URL = "https://chatgpt.com/backend-api/codex/responses";
 var CODEX_UPSTREAM_TIMEOUT_MS = 3e5;
 var CODEX_HEADERS_TIMEOUT_MS = 15e3;
@@ -64292,12 +64747,17 @@ function sessionIdFor(userId, randomId) {
   if (userId === void 0 || userId === "") {
     return randomId();
   }
-  const hex3 = (0, import_node_crypto6.createHash)("sha256").update(`agent-shim codex session
+  const hex3 = (0, import_node_crypto8.createHash)("sha256").update(`agent-shim codex session
 ${userId}`).digest("hex");
   let next = 0;
   return UUID_TEMPLATE.replace(/x/g, () => hex3.charAt(next++));
 }
-function headersFor(credentials, sessionId) {
+var CODEX_BACKEND_TARGET = { url: CODEX_RESPONSES_URL, headers: codexBackendHeaders };
+var RESPONSES_API_TARGET = {
+  url: SIWC_RESPONSES_URL,
+  headers: (credentials) => ({ "Content-Type": "application/json", Accept: "text/event-stream", Authorization: `Bearer ${credentials.accessToken}` })
+};
+function codexBackendHeaders(credentials, sessionId) {
   return {
     "Content-Type": "application/json",
     Accept: "text/event-stream",
@@ -64309,11 +64769,11 @@ function headersFor(credentials, sessionId) {
   };
 }
 async function callCodex(ports, request7, sessionId, signal) {
-  const url2 = ports.url ?? CODEX_RESPONSES_URL;
+  const target = ports.target ?? CODEX_BACKEND_TARGET;
   const body = JSON.stringify(request7);
-  const send = async (credentials2) => await fetchUntilHeaders(ports.fetch, ports.timers, url2, {
+  const send = async (credentials2) => await fetchUntilHeaders(ports.fetch, ports.timers, target.url, {
     method: "POST",
-    headers: headersFor(credentials2, sessionId),
+    headers: target.headers(credentials2, sessionId),
     body,
     signal: AbortSignal.any([signal, AbortSignal.timeout(CODEX_UPSTREAM_TIMEOUT_MS)])
   });
@@ -64349,6 +64809,7 @@ var realCodexAuthFs = {
     }
   },
   writePrivate: (filePath, contents) => {
+    import_node_fs11.default.mkdirSync(import_node_path31.default.dirname(filePath), { recursive: true });
     import_node_fs11.default.writeFileSync(filePath, contents, { encoding: "utf8", mode: PRIVATE_FILE_MODE });
     import_node_fs11.default.chmodSync(filePath, PRIVATE_FILE_MODE);
   },
@@ -64368,17 +64829,22 @@ function writeUsageSnapshot(log, snapshot) {
     log(`usage snapshot write failed: ${error62 instanceof Error ? error62.message : String(error62)}`);
   }
 }
-function createCodexRoutePorts(log) {
+function createCodexRoutePorts(log, signInFile) {
   const agent = createUpstreamAgent();
   const upstreamFetch = createUpstreamFetch(agent);
+  const tempSuffix = `${String(process.pid)}.${(0, import_node_crypto9.randomUUID)()}`;
   const auth = createCodexAuthStore(import_node_path31.default.join(codexHome(process.env, import_node_os6.default.homedir()), "auth.json"), {
     fs: realCodexAuthFs,
     fetch: upstreamFetch,
     now: () => /* @__PURE__ */ new Date(),
-    tempSuffix: `${String(process.pid)}.${(0, import_node_crypto7.randomUUID)()}`
+    tempSuffix
   });
+  const signIn = createSiwcStore(signInFile, { fs: realCodexAuthFs, siwc: realSiwcPorts(upstreamFetch), tempSuffix });
   return {
-    upstream: { fetch: upstreamFetch, auth, timers: realTimers, randomId: import_node_crypto7.randomUUID },
+    upstreams: {
+      "codex-cli": { fetch: upstreamFetch, auth, timers: realTimers, randomId: import_node_crypto9.randomUUID },
+      "chatgpt-sign-in": { fetch: upstreamFetch, auth: signIn.auth, timers: realTimers, randomId: import_node_crypto9.randomUUID, target: RESPONSES_API_TARGET }
+    },
     writeUsageSnapshot: (snapshot) => {
       writeUsageSnapshot(log, snapshot);
     },
@@ -64386,6 +64852,18 @@ function createCodexRoutePorts(log) {
     log
   };
 }
+function readSignInStatus(fsPort, filePath) {
+  const raw = fsPort.readFileUtf8(filePath);
+  if (raw === void 0) {
+    return { state: "none" };
+  }
+  try {
+    const file2 = parseSiwcFile(raw, filePath);
+    return file2.grant === void 0 ? { state: "none" } : { state: "signed-in", email: file2.grant.email, planScope: file2.grant.scopes.includes(SIWC_PLAN_SCOPE), accessTokenExpiresAt: file2.grant.expiresAt };
+  } catch (error62) {
+    return { state: "unreadable", message: error62 instanceof Error ? error62.message : String(error62) };
+  }
+}
 function codexProviderNames(fsPort, providersDir) {
   return readAllProviders(fsPort, providersDir).filter((entry) => isCodexProvider(entry.provider)).map((entry) => entry.name).sort();
 }
@@ -64396,12 +64874,22 @@ function collectCodexStatus(fsPort, paths, isRunning) {
     supervisorAlive: state.supervisorPid !== void 0 && isRunning(state.supervisorPid),
     sessions: listFrontDoorSessions(fsPort, paths.frontdoorSessionsDir).map((session) => ({ ...session, alive: isRunning(session.pid) })),
     codexProviders: codexProviderNames(fsPort, paths.providersDir),
+    signIn: readSignInStatus(fsPort, paths.chatgptSignInFile),
     usageSnapshotPath: codexUsageSnapshotPath(),
     usageSnapshotExists: fsPort.readFileUtf8(codexUsageSnapshotPath()) !== void 0,
     logPath: paths.frontdoorLogPath,
     logExists: fsPort.readFileUtf8(paths.frontdoorLogPath) !== void 0
   };
 }
+function formatSignIn(signIn) {
+  if (signIn.state === "none") {
+    return "chatgpt sign-in: not signed in (run `agent-shim codex login`)";
+  }
+  if (signIn.state === "unreadable") {
+    return `chatgpt sign-in: ${signIn.message}`;
+  }
+  return `chatgpt sign-in: signed in${signIn.email === void 0 ? "" : ` as ${signIn.email}`}${signIn.planScope ? "" : ", WITHOUT permission to use your ChatGPT plan (run `agent-shim codex login` again and allow it)"}`;
+}
 function formatCodexStatus(status) {
   const lines = [];
   lines.push(
@@ -64422,10 +64910,24 @@ function formatCodexStatus(status) {
   if (status.frontDoor.lastError !== void 0) {
     lines.push(`last error: ${status.frontDoor.lastError}`);
   }
+  lines.push(formatSignIn(status.signIn));
   lines.push(`usage snapshot: ${status.usageSnapshotPath}${status.usageSnapshotExists ? "" : " (not created yet)"}`);
   lines.push(`daemon log: ${status.logPath}${status.logExists ? "" : " (not created yet)"}`);
   return lines;
 }
+function realSiwcLoginPorts(paths) {
+  const siwc = realSiwcPorts(createUpstreamFetch(createUpstreamAgent()));
+  const store = createSiwcStore(paths.chatgptSignInFile, { fs: realCodexAuthFs, siwc, tempSuffix: `${String(process.pid)}.${(0, import_node_crypto9.randomUUID)()}` });
+  return {
+    store,
+    siwc,
+    listen: listenForCallback,
+    openBrowser: openInBrowser,
+    print: (line) => {
+      console.log(line);
+    }
+  };
+}
 function registerCodexCommand(program2, deps) {
   const { paths } = deps;
   const codex = withExamples(program2.command("codex").description("Inspect the codex translation the front-door daemon serves for codex providers."), ["agent-shim codex status"]);
@@ -64442,12 +64944,40 @@ function registerCodexCommand(program2, deps) {
     }),
     ["agent-shim codex status", "agent-shim codex status --json"]
   );
+  withExamples(
+    codex.command("login").description("Sign in with ChatGPT so a codex provider with `codex.login` set to `chatgpt-sign-in` can spend your ChatGPT plan on OpenAI's public Responses API. Opens your browser.").option("--no-open", "Print the sign-in address instead of opening the browser.").option("--json", "Print the result as JSON.").action(async (options) => {
+      const ports = realSiwcLoginPorts(paths);
+      const result = await runSiwcLogin(options.json === true ? { ...ports, print: () => void 0 } : ports, { open: options.open });
+      if (options.json === true) {
+        printJson({ action: "login", email: result.email ?? null, sub: result.sub });
+        return;
+      }
+      console.log(`Signed in${result.email === void 0 ? "" : ` as ${result.email}`}. Set "codex": { "login": "chatgpt-sign-in" } on a codex provider to use it.`);
+    }),
+    ["agent-shim codex login", "agent-shim codex login --no-open"]
+  );
+  withExamples(
+    codex.command("logout").description("Revoke the Sign in with ChatGPT login and remove it from this machine.").option("--json", "Print the result as JSON.").action(async (options) => {
+      const ports = realSiwcLoginPorts(paths);
+      const result = await runSiwcLogout(ports);
+      if (options.json === true) {
+        printJson({ action: "logout", ...result });
+        return;
+      }
+      if (!result.hadGrant) {
+        console.log("Not signed in.");
+        return;
+      }
+      console.log(result.revoked ? "Signed out and revoked the login at OpenAI." : "Signed out here, but OpenAI could not be told to revoke the login: revoke it in ChatGPT settings.");
+    }),
+    ["agent-shim codex logout"]
+  );
 }
 
 // src/frontdoor/commands.ts
-var import_node_crypto12 = require("node:crypto");
-var import_node_path34 = __toESM(require("node:path"), 1);
-var import_node_fs12 = __toESM(require("node:fs"), 1);
+var import_node_crypto14 = require("node:crypto");
+var import_node_path36 = __toESM(require("node:path"), 1);
+var import_node_fs13 = __toESM(require("node:fs"), 1);
 
 // src/frontdoor/custody.ts
 var CREDENTIAL_HEADERS = ["authorization", "x-api-key"];
@@ -64550,7 +65080,7 @@ function createDoorPipelines(deps) {
 }
 
 // src/frontdoor/capability.ts
-var import_node_crypto8 = require("node:crypto");
+var import_node_crypto10 = require("node:crypto");
 var CONNECT_PROXY_USER = "agent-shim";
 var CONNECT_PROXY_REALM = "agent-shim front door";
 var BASIC_SCHEME = "basic";
@@ -64572,13 +65102,13 @@ function capabilityFromProxyAuthorization(value2) {
   return password === "" ? void 0 : password;
 }
 function digest(token) {
-  return (0, import_node_crypto8.createHash)("sha256").update(token, "utf8").digest();
+  return (0, import_node_crypto10.createHash)("sha256").update(token, "utf8").digest();
 }
 function isLiveCapability(presented, live) {
   const presentedDigest = digest(presented);
   let matched = false;
   for (const token of live) {
-    const equal = (0, import_node_crypto8.timingSafeEqual)(presentedDigest, digest(token));
+    const equal = (0, import_node_crypto10.timingSafeEqual)(presentedDigest, digest(token));
     matched = equal || matched;
   }
   return matched;
@@ -64722,11 +65252,11 @@ function createFileCapture(file2, now = () => /* @__PURE__ */ new Date()) {
 }
 
 // src/frontdoor/connect.ts
-var import_node_crypto10 = require("node:crypto");
+var import_node_crypto12 = require("node:crypto");
 var fs13 = __toESM(require("node:fs"), 1);
 
 // src/frontdoor/x509.ts
-var import_node_crypto9 = require("node:crypto");
+var import_node_crypto11 = require("node:crypto");
 var import_node_net = __toESM(require("node:net"), 1);
 var TAG_BOOLEAN = 1;
 var TAG_INTEGER = 2;
@@ -64762,7 +65292,7 @@ var HIGH_BIT = 128;
 var BASE_128_PAYLOAD_MASK = 127;
 var FIRST_ARC_WEIGHT = 40;
 var SHORT_FORM_MAX_LENGTH = 127;
-var MS_PER_SECOND4 = 1e3;
+var MS_PER_SECOND5 = 1e3;
 var UTC_TIME_LAST_YEAR = 2049;
 var YEAR_DIGITS = 4;
 var TWO_DIGIT_YEAR_DIGITS = 2;
@@ -64821,7 +65351,7 @@ function wholeBitString(content) {
   return tlv(TAG_BIT_STRING, Buffer.concat([Buffer.from([0]), content]));
 }
 function time3(instant) {
-  const iso = new Date(Math.floor(instant.getTime() / MS_PER_SECOND4) * MS_PER_SECOND4).toISOString();
+  const iso = new Date(Math.floor(instant.getTime() / MS_PER_SECOND5) * MS_PER_SECOND5).toISOString();
   const compact = `${iso.replace(/[-:T]/g, "").slice(0, COMPACT_TIME_DIGITS)}Z`;
   if (instant.getUTCFullYear() > UTC_TIME_LAST_YEAR) {
     return tlv(TAG_GENERALIZED_TIME, Buffer.from(compact, "ascii"));
@@ -64878,7 +65408,7 @@ function ipBytes(address) {
   return bytes;
 }
 function keyIdentifier(publicKey) {
-  return (0, import_node_crypto9.createHash)("sha1").update(publicKey.export({ type: "pkcs1", format: "der" })).digest();
+  return (0, import_node_crypto11.createHash)("sha1").update(publicKey.export({ type: "pkcs1", format: "der" })).digest();
 }
 function readElement(buffer, offset) {
   const tag = buffer[offset];
@@ -64924,7 +65454,7 @@ ${body.join("\n")}
 `;
 }
 function randomSerial() {
-  const bytes = (0, import_node_crypto9.randomBytes)(SERIAL_NUMBER_BYTES);
+  const bytes = (0, import_node_crypto11.randomBytes)(SERIAL_NUMBER_BYTES);
   bytes[0] = (bytes[0] ?? 0) & BASE_128_PAYLOAD_MASK | HIGH_BIT >> 1;
   return bytes;
 }
@@ -64939,7 +65469,7 @@ function assemble(spec) {
     spec.subjectPublicKey.export({ type: "spki", format: "der" }),
     tlv(TAG_EXTENSIONS, sequence(...spec.extensions))
   );
-  const signature = (0, import_node_crypto9.sign)("sha256", tbs, spec.signingKey);
+  const signature = (0, import_node_crypto11.sign)("sha256", tbs, spec.signingKey);
   return sequence(tbs, SIGNATURE_ALGORITHM, wholeBitString(signature));
 }
 function subjectKeyIdentifierExtension(publicKey) {
@@ -64949,7 +65479,7 @@ function basicConstraintsExtension(isCa) {
   return extension(OID_BASIC_CONSTRAINTS, true, sequence(...isCa ? [boolean4(true)] : []));
 }
 function rsaKeyPair() {
-  return (0, import_node_crypto9.generateKeyPairSync)("rsa", { modulusLength: RSA_MODULUS_BITS });
+  return (0, import_node_crypto11.generateKeyPairSync)("rsa", { modulusLength: RSA_MODULUS_BITS });
 }
 function keyPem(privateKey) {
   return privateKey.export({ type: "pkcs8", format: "pem" });
@@ -64973,8 +65503,8 @@ function issueLeafCertificate(ca, names, notBefore, notAfter) {
   if (commonName === void 0) {
     throw new Error("a leaf certificate needs at least one name");
   }
-  const caCertificate = new import_node_crypto9.X509Certificate(ca.certPem);
-  const caPrivateKey = (0, import_node_crypto9.createPrivateKey)(ca.keyPem);
+  const caCertificate = new import_node_crypto11.X509Certificate(ca.certPem);
+  const caPrivateKey = (0, import_node_crypto11.createPrivateKey)(ca.keyPem);
   const { publicKey, privateKey } = rsaKeyPair();
   const generalNames = names.map((name) => import_node_net.default.isIP(name) === 0 ? tlv(TAG_GENERAL_NAME_DNS, Buffer.from(name, "ascii")) : tlv(TAG_GENERAL_NAME_IP, ipBytes(name)));
   const der = assemble({
@@ -65071,22 +65601,22 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
   };
   writeFrontDoorState(fs19, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, ...sticky() });
   const previousSticky = lastPort;
-  let http6;
+  let http7;
   try {
-    http6 = await ports.startProviderListener(lastPort);
+    http7 = await ports.startProviderListener(lastPort);
   } catch (error62) {
     return fail(`could not start the provider listener: ${error62 instanceof Error ? error62.message : String(error62)}`);
   }
-  if (previousSticky !== void 0 && http6.port !== previousSticky) {
-    ports.log(`agent-shim frontdoor supervisor: sticky port ${String(previousSticky)} was occupied; moving to ${String(http6.port)} (sessions launched against the old port are stale until they relaunch)`);
+  if (previousSticky !== void 0 && http7.port !== previousSticky) {
+    ports.log(`agent-shim frontdoor supervisor: sticky port ${String(previousSticky)} was occupied; moving to ${String(http7.port)} (sessions launched against the old port are stale until they relaunch)`);
   }
-  lastPort = http6.port;
+  lastPort = http7.port;
   const previousStickyConnect = lastConnectPort;
   let connect3;
   try {
     connect3 = await ports.startConnectListener(lastConnectPort);
   } catch (error62) {
-    await http6.close();
+    await http7.close();
     return fail(`could not start the CONNECT surface: ${error62 instanceof Error ? error62.message : String(error62)}`);
   }
   if (previousStickyConnect !== void 0 && connect3.port !== previousStickyConnect) {
@@ -65099,16 +65629,16 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     direct = await ports.startDirectListener(lastDirectPort);
   } catch (error62) {
     await connect3.close();
-    await http6.close();
+    await http7.close();
     return fail(`could not start the direct listener: ${error62 instanceof Error ? error62.message : String(error62)}`);
   }
   if (previousStickyDirect !== void 0 && direct.port !== previousStickyDirect) {
     ports.log(`agent-shim frontdoor supervisor: sticky direct port ${String(previousStickyDirect)} was occupied; moving to ${String(direct.port)} (headroom must be restarted to admit the new address)`);
   }
   lastDirectPort = direct.port;
-  writeFrontDoorState(fs19, paths.frontdoorStateFile, { protocol: FRONT_DOOR_PROTOCOL, supervisorPid: ports.ownPid, port: http6.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
+  writeFrontDoorState(fs19, paths.frontdoorStateFile, { protocol: FRONT_DOOR_PROTOCOL, supervisorPid: ports.ownPid, port: http7.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
   fs19.removeRecursive(paths.frontdoorLockFile);
-  ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http6.port)}, CONNECT surface on 127.0.0.1:${String(connect3.port)}`);
+  ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http7.port)}, CONNECT surface on 127.0.0.1:${String(connect3.port)}`);
   let idleSince;
   let ticks = 0;
   for (; ; ) {
@@ -65116,14 +65646,17 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
       return FRONTDOOR_SUPERVISOR_STILL_RUNNING;
     }
     ticks += 1;
-    pruneDeadFrontDoorSessions(fs19, paths.frontdoorSessionsDir, ports.isRunning);
-    if (listFrontDoorSessions(fs19, paths.frontdoorSessionsDir).length === 0) {
+    const listed = listFrontDoorSessions(fs19, paths.frontdoorSessionsDir);
+    const pruned = pruneDeadFrontDoorSessions(fs19, paths.frontdoorSessionsDir, ports.isRunning);
+    ports.observeLaunchRegistry(listed, pruned);
+    const prunedPids = new Set(pruned);
+    if (listed.filter((session) => !prunedPids.has(session.pid)).length === 0) {
       idleSince ??= ports.now();
       if (ports.now() - idleSince >= idleShutdownMinutes * MS_PER_MINUTE2) {
         ports.log(`agent-shim frontdoor supervisor: no sessions for ${String(idleShutdownMinutes)} minute(s); closing the front door and exiting`);
         await direct.close();
         await connect3.close();
-        await http6.close();
+        await http7.close();
         ports.closeRcStreamHub();
         writeFrontDoorState(fs19, paths.frontdoorStateFile, sticky());
         return 0;
@@ -65178,8 +65711,8 @@ function parseConnectTarget(authority) {
   }
   return { host, port };
 }
-function servedByPipeline(path43) {
-  return path43?.startsWith(ROUTED_PATH_PREFIX) === true;
+function servedByPipeline(path44) {
+  return path44?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
   "connection",
@@ -65239,8 +65772,8 @@ function ensureCa(store, generate) {
 }
 function caParses(ca) {
   try {
-    new import_node_crypto10.X509Certificate(ca.certPem);
-    (0, import_node_crypto10.createPrivateKey)(ca.keyPem);
+    new import_node_crypto12.X509Certificate(ca.certPem);
+    (0, import_node_crypto12.createPrivateKey)(ca.keyPem);
     return true;
   } catch {
     return false;
@@ -65528,13 +66061,13 @@ function realConnectCertStore(paths) {
 
 // src/frontdoor/connectEffects.ts
 var import_node_dns = __toESM(require("node:dns"), 1);
-var http2 = __toESM(require("node:http"), 1);
+var http3 = __toESM(require("node:http"), 1);
 var https3 = __toESM(require("node:https"), 1);
 var net2 = __toESM(require("node:net"), 1);
 var tls = __toESM(require("node:tls"), 1);
 
 // src/frontdoor/server.ts
-var import_node_http = __toESM(require("node:http"), 1);
+var import_node_http2 = __toESM(require("node:http"), 1);
 var import_node_https = __toESM(require("node:https"), 1);
 
 // src/frontdoor/rcControl.ts
@@ -65705,11 +66238,11 @@ function createRcSessionTracker(deps) {
   };
   const observeExchange = (request7) => {
     const method = (request7.method ?? "").toUpperCase();
-    const path43 = new URL(request7.url ?? "/", "http://127.0.0.1").pathname;
-    if (!path43.startsWith(RC_SESSIONS_PATH_PREFIX)) {
+    const path44 = new URL(request7.url ?? "/", "http://127.0.0.1").pathname;
+    if (!path44.startsWith(RC_SESSIONS_PATH_PREFIX)) {
       return void 0;
     }
-    const tail = path43.slice(RC_SESSIONS_PATH_PREFIX.length);
+    const tail = path44.slice(RC_SESSIONS_PATH_PREFIX.length);
     const facts = {
       oauthAuthorization: oauthAuthorizationOf(request7.headers),
       anthropicVersion: singleHeader(request7.headers, "anthropic-version"),
@@ -66449,9 +66982,9 @@ function sequenceNumsOfBody(body) {
 }
 function frontDoorRcControl(transport, token) {
   const headers = { authorization: `Bearer ${token}` };
-  const listAnswerOf = async (path43, what) => {
+  const listAnswerOf = async (path44, what) => {
     try {
-      return await transport.request({ method: "GET", path: path43, headers });
+      return await transport.request({ method: "GET", path: path44, headers });
     } catch (error62) {
       throw new Error(`${what}: could not reach the front door's control listener: ${error62 instanceof Error ? error62.message : String(error62)}`, { cause: error62 });
     }
@@ -66523,10 +67056,10 @@ function frontDoorRcControl(transport, token) {
     }
     return pending;
   };
-  const writeOf = async (path43, body, describeFailure) => {
+  const writeOf = async (path44, body, describeFailure) => {
     let answer;
     try {
-      answer = await transport.request({ method: "POST", path: path43, headers: { ...headers, "content-type": "application/json" }, body });
+      answer = await transport.request({ method: "POST", path: path44, headers: { ...headers, "content-type": "application/json" }, body });
     } catch (error62) {
       return { ok: false, message: `could not reach the front door's control listener: ${error62 instanceof Error ? error62.message : String(error62)}` };
     }
@@ -66611,7 +67144,7 @@ function createFrontDoorServer(pipeline, log, tls2, control, api) {
     });
   };
   if (tls2 === void 0) {
-    return import_node_http.default.createServer(handler);
+    return import_node_http2.default.createServer(handler);
   }
   const server = import_node_https.default.createServer({ key: tls2.keyPem, cert: tls2.certPem }, handler);
   server.on("tlsClientError", (_error, socket) => {
@@ -66626,7 +67159,7 @@ async function frontDoorHealthy(port, ca) {
       resolve(response.statusCode === HTTP_STATUS.ok);
     };
     const options = { host: "127.0.0.1", port, path: "/healthz", agent: false, timeout: HEALTH_TIMEOUT_MS };
-    const request7 = ca === void 0 ? import_node_http.default.get(options, onResponse) : import_node_https.default.get({ ...options, ca: [ca] }, onResponse);
+    const request7 = ca === void 0 ? import_node_http2.default.get(options, onResponse) : import_node_https.default.get({ ...options, ca: [ca] }, onResponse);
     request7.on("timeout", () => {
       request7.destroy();
     });
@@ -66781,7 +67314,7 @@ async function reservedDial(target, ports) {
 function requestServername(options, fallback) {
   return "servername" in options && typeof options.servername === "string" && options.servername !== "" ? options.servername : fallback;
 }
-var ExemptHttpAgent = class extends http2.Agent {
+var ExemptHttpAgent = class extends http3.Agent {
   constructor(ports = DOOR_SOURCE_PORTS) {
     super();
     this.ports = ports;
@@ -66899,12 +67432,12 @@ function lateRcStreamDial(resolve) {
 }
 function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const request7 = async (method, path43, headers, body, signal) => await new Promise((resolve, reject) => {
+  const request7 = async (method, path44, headers, body, signal) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method,
-      path: path43,
+      path: path44,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, ...body === void 0 ? {} : { "content-length": String(Buffer.byteLength(body, "utf8")) } },
       agent,
@@ -66941,9 +67474,9 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
       return { status, body: await readAll(response) };
     },
     openStream: async (sessionId, headers, resume, signal) => {
-      const path43 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
+      const path44 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
       const streamHeaders = resume === void 0 ? headers : { ...headers, "last-event-id": String(resume.fromSequenceNum) };
-      const { status, response } = await request7("GET", path43, streamHeaders, void 0, signal);
+      const { status, response } = await request7("GET", path44, streamHeaders, void 0, signal);
       if (!isSuccessful2(status)) {
         await readAll(response);
         return { status, chunks: NO_CHUNKS };
@@ -67052,7 +67585,7 @@ function realConnectEffects(ports = DOOR_SOURCE_PORTS) {
       };
     },
     createHttpSession: (handler, onUpgrade) => {
-      const server = http2.createServer(handler);
+      const server = http3.createServer(handler);
       server.on("clientError", (_error, socket) => {
         socket.destroy();
       });
@@ -67122,7 +67655,7 @@ function realConnectEffects(ports = DOOR_SOURCE_PORTS) {
         }
         upstreamResponse.pipe(response);
       };
-      const upstream = target.tls ? https3.request(options, onUpstreamResponse) : http2.request(options, onUpstreamResponse);
+      const upstream = target.tls ? https3.request(options, onUpstreamResponse) : http3.request(options, onUpstreamResponse);
       upstream.on("error", (error62) => {
         if (response.headersSent) {
           response.destroy(error62);
@@ -67154,6 +67687,548 @@ function realConnectEffects(ports = DOOR_SOURCE_PORTS) {
   };
 }
 
+// src/doctorReport.ts
+var import_node_fs12 = __toESM(require("node:fs"), 1);
+var import_node_path32 = __toESM(require("node:path"), 1);
+var DOCTOR_SEVERITIES = ["pass", "warn", "fail"];
+var DOCTOR_SECTIONS = [
+  "ambient-credential",
+  "binary-discovery",
+  "claude-shim",
+  "path-resolution",
+  "legacy-name",
+  "config-profile",
+  "identity",
+  "pool",
+  "provider",
+  "keychain",
+  "directory-rules",
+  "global-config",
+  "categories-local",
+  "active-identity",
+  "headroom"
+];
+function refinePathShadow(status, ownExecutablePath, realpath) {
+  if (status.status !== "shadowed") {
+    return status;
+  }
+  return realpath(status.by) === realpath(ownExecutablePath) ? { status: "ok" } : status;
+}
+function validateJson(schema, input2) {
+  if (input2.raw === void 0) {
+    return { ok: false, message: `${input2.path} is missing.` };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(input2.raw);
+  } catch (error62) {
+    return { ok: false, message: `${input2.path} is not valid JSON: ${error62 instanceof Error ? error62.message : String(error62)}` };
+  }
+  const result = schema.safeParse(parsed);
+  if (!result.success) {
+    return { ok: false, message: new ConfigValidationError(input2.path, result.error.issues).message };
+  }
+  return { ok: true, data: result.data };
+}
+function pushPathResolution(push, resolution) {
+  const ownDir = import_node_path32.default.dirname(resolution.ownExecutablePath);
+  switch (resolution.agentShim.status) {
+    case "ok":
+      push("path-resolution", "pass", `\`agent-shim\` on PATH resolves to this running executable, ${resolution.ownExecutablePath}.`, "agent-shim");
+      break;
+    case "not-on-path":
+      push(
+        "path-resolution",
+        "warn",
+        `${ownDir} is not on PATH, so a bare \`agent-shim\` does not reach ${resolution.ownExecutablePath}. Add it to PATH, or keep invoking this executable by its full path.`,
+        "agent-shim"
+      );
+      break;
+    case "shadowed":
+      push(
+        "path-resolution",
+        "fail",
+        `\`agent-shim\` on PATH resolves to ${resolution.agentShim.by}, not this running executable, ${resolution.ownExecutablePath}. Every command you type runs that one instead, at whatever version it happens to be \u2014 including the checks in this report, which describe this executable. Remove ${resolution.agentShim.by}, repoint it at ${resolution.ownExecutablePath}, or put ${ownDir} ahead of it on PATH.`,
+        "agent-shim"
+      );
+      break;
+  }
+  if (resolution.claude === void 0) {
+    return;
+  }
+  switch (resolution.claude.status) {
+    case "ok":
+      push("path-resolution", "pass", "`claude` on PATH resolves to the enabled shim.", "claude");
+      break;
+    case "not-on-path":
+      push("path-resolution", "warn", "The enabled `claude` shim's directory is not on PATH \u2014 add it, or use `agent-shim run` instead.", "claude");
+      break;
+    case "shadowed":
+      push(
+        "path-resolution",
+        "warn",
+        `\`claude\` on PATH resolves to ${resolution.claude.by}, not the enabled shim. Put the shim's directory ahead of it on PATH, or run \`agent-shim shim disable\` if you meant to launch that one directly.`,
+        "claude"
+      );
+      break;
+  }
+}
+function cacheClause(cacheEnv, owner, block2) {
+  if (cacheEnv === void 0 || block2.cache === void 0) {
+    return { text: "", unreadable: false };
+  }
+  const state = describeCachedCredential({ port: cacheEnv.port, platform: cacheEnv.platform, owner, cache: block2.cache, nowMs: cacheEnv.now() });
+  return { text: `; ${formatCachedCredentialState(state)}`, unreadable: state.status === "unreadable" };
+}
+function signInProblem(signIn) {
+  if (signIn.raw === void 0) {
+    return "nobody is signed in: run `agent-shim codex login`.";
+  }
+  try {
+    const grant = parseSiwcFile(signIn.raw, signIn.path).grant;
+    if (grant === void 0) {
+      return "nobody is signed in: run `agent-shim codex login`.";
+    }
+    return grant.scopes.includes(SIWC_PLAN_SCOPE) ? void 0 : "the login was not given permission to use your ChatGPT plan: run `agent-shim codex login` again and allow it.";
+  } catch (error62) {
+    return error62 instanceof Error ? error62.message : String(error62);
+  }
+}
+function pushProvider(push, entry, cacheEnv, signIn) {
+  if (entry.raw === void 0) {
+    push("provider", "fail", `${entry.path} is missing.`, entry.name);
+    return;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(entry.raw);
+  } catch (error62) {
+    push("provider", "fail", `${entry.path} is not valid JSON: ${error62 instanceof Error ? error62.message : String(error62)}`, entry.name);
+    return;
+  }
+  const conversion = legacyProviderConversion(parsed);
+  if (conversion !== void 0) {
+    push("provider", "fail", new LegacyProviderFileError(entry.path, conversion).message, entry.name);
+    return;
+  }
+  const validated2 = ProviderSchema.safeParse(parsed);
+  if (!validated2.success) {
+    push("provider", "fail", new ConfigValidationError(entry.path, validated2.error.issues).message, entry.name);
+    return;
+  }
+  const cache = cacheClause(cacheEnv, `provider ${entry.name}`, validated2.data.credential);
+  push("provider", cache.unreadable ? "fail" : "pass", `${entry.name} is valid (${describeProviderEndpoint(validated2.data)}, credential ${describeCredential(validated2.data.credential)})${cache.text}.`, entry.name);
+  if (validated2.data.env?.ENABLE_TOOL_SEARCH === void 0) {
+    push("provider", "warn", `${entry.name} does not set ENABLE_TOOL_SEARCH: a session on this provider loads MCP tools upfront rather than deferring them, because its base URL is the front door, which Claude Code treats as a non-first-party host. Set ENABLE_TOOL_SEARCH in the provider's env block to restore deferred loading, when the upstream backend supports the tool_reference payloads it sends.`, entry.name);
+  }
+  if (signIn !== void 0 && isCodexProvider(validated2.data) && validated2.data.codex?.login === "chatgpt-sign-in") {
+    const problem = signInProblem(signIn);
+    if (problem !== void 0) {
+      push("provider", "warn", `${entry.name} uses the Sign in with ChatGPT login, but ${problem}`, entry.name);
+    }
+  }
+}
+function pushLegacyName(push, params) {
+  const legacyVariables = Object.keys(params.env).filter((name) => name.startsWith(LEGACY_ENV_PREFIX) && params.env[name] !== void 0).sort();
+  if (legacyVariables.length === 0 && import_node_path32.default.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
+    push("legacy-name", "pass", "Nothing here still uses the former `claude-use` name.");
+    return;
+  }
+  for (const name of legacyVariables) {
+    push("legacy-name", "warn", `${name} is the former name of ${name.replace(LEGACY_ENV_PREFIX, ENV_PREFIX)}. Rename it; the old name still works but is only a fallback.`, name);
+  }
+  if (import_node_path32.default.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
+    push(
+      "legacy-name",
+      "warn",
+      `The state root is the former ${params.rootPath}, used in place. Leave it where it is: macOS Claude Code keys each identity's Keychain login on its exact configuration directory path, so moving it signs every identity out.`
+    );
+  }
+}
+function runDoctor(params) {
+  const findings = [];
+  const push = (section, severity, message, subject) => {
+    findings.push({ section, severity, message, ...subject === void 0 ? {} : { subject } });
+  };
+  const checkPin = (section, subject, where, version2) => {
+    const installed = params.installedClaudeVersions;
+    if (version2 === void 0 || installed === void 0 || installed.includes(version2)) {
+      return;
+    }
+    push(section, "warn", `${where} pins Claude Code ${version2}, which is not installed (installed: ${installed.length === 0 ? "none" : installed.join(", ")}); a launch that resolves to it fails.`, subject);
+  };
+  const ambient = detectAmbientCredential(params.env);
+  if (ambient === void 0) {
+    push("ambient-credential", "pass", "No ambient-credential environment variable is set.");
+  } else {
+    push("ambient-credential", "warn", formatAmbientCredentialGuardMessage(ambient.variable));
+  }
+  if (params.binaryDiscovery.ok) {
+    const { binary } = params.binaryDiscovery;
+    const versionNote = binary.version === void 0 ? "" : `, version ${binary.version}`;
+    push("binary-discovery", "pass", `Found ${binary.path} (${binary.source}${versionNote}).`);
+  } else {
+    push("binary-discovery", "fail", params.binaryDiscovery.message);
+  }
+  if (params.claudeShim.state === void 0) {
+    push("claude-shim", "pass", "No `claude` command shim enabled (the default). Run `agent-shim shim enable` to add one.");
+  } else if (!params.claudeShim.targetExists) {
+    push(
+      "claude-shim",
+      "warn",
+      `claude-shim.json records a \`claude\` shim at ${params.claudeShim.state.targetPath}, but nothing is there. Run \`agent-shim shim enable\` again, or \`agent-shim shim disable\` to clear the stale record.`
+    );
+  } else {
+    push(
+      "claude-shim",
+      "pass",
+      `\`claude\` is enabled at ${params.claudeShim.state.targetPath} (${params.claudeShim.state.method}). If you've upgraded agent-shim since, re-run \`agent-shim shim enable\` to refresh it.`
+    );
+  }
+  pushPathResolution(push, params.pathResolution);
+  pushLegacyName(push, params);
+  const profileSources = /* @__PURE__ */ new Map();
+  for (const entry of params.configProfiles) {
+    const validated2 = validateJson(ConfigProfileSchema, entry);
+    if (!validated2.ok) {
+      push("config-profile", "fail", validated2.message, entry.name);
+      continue;
+    }
+    profileSources.set(entry.name, { name: entry.name, profile: validated2.data });
+    checkPin("config-profile", entry.name, `Configuration profile "${entry.name}"`, validated2.data.launch?.claudeVersion);
+  }
+  const loadProfile = (name) => profileSources.get(name);
+  for (const name of profileSources.keys()) {
+    const linearised = lineariseProfile(name, loadProfile);
+    if (linearised.diagnostics.length === 0) {
+      push("config-profile", "pass", `${name} is valid and its extends chain resolves cleanly.`, name);
+    } else {
+      for (const diagnostic of linearised.diagnostics) {
+        push("config-profile", "fail", diagnostic.message, name);
+      }
+    }
+  }
+  const validProfileNames = new Set(profileSources.keys());
+  const validIdentityNames = /* @__PURE__ */ new Set();
+  for (const entry of params.identities) {
+    const validated2 = validateJson(IdentitySchema, entry);
+    if (!validated2.ok) {
+      push("identity", "fail", validated2.message, entry.name);
+      continue;
+    }
+    validIdentityNames.add(entry.name);
+    const defaultProfile = validated2.data.defaultConfigProfile;
+    if (defaultProfile !== void 0 && !validProfileNames.has(defaultProfile)) {
+      push(
+        "identity",
+        "fail",
+        `Identity "${entry.name}" names configuration profile "${defaultProfile}" as its default, but no such profile exists.`,
+        entry.name
+      );
+    } else {
+      const credential = validated2.data.credential;
+      const cache = credential === void 0 ? { text: "", unreadable: false } : cacheClause(params.credentialCache, `identity ${entry.name}`, credential);
+      push(
+        "identity",
+        cache.unreadable ? "fail" : "pass",
+        `${entry.name} is valid and authenticates with ${credential === void 0 ? "its stored login" : `credential ${describeCredential(credential)}`}${cache.text}.`,
+        entry.name
+      );
+    }
+  }
+  const validatedGlobalConfig = params.globalConfig.raw === void 0 ? void 0 : validateJson(GlobalConfigSchema, params.globalConfig);
+  const pools = validatedGlobalConfig?.ok === true ? validatedGlobalConfig.data.pools ?? {} : {};
+  for (const [poolName, pool] of Object.entries(pools)) {
+    const missing = pool.identities.filter((member) => !validIdentityNames.has(member));
+    if (missing.length === 0) {
+      push("pool", "pass", `${poolName} is valid (${pool.identities.join(", ")}).`, poolName);
+    } else {
+      push("pool", "fail", `Pool "${poolName}" names ${missing.map((member) => `identity "${member}"`).join(" and ")}, which ${missing.length === 1 ? "does" : "do"} not exist.`, poolName);
+    }
+  }
+  const selectionExists = (selector) => {
+    const poolName = poolNameOf(selector);
+    return poolName === void 0 ? validIdentityNames.has(selector) : poolName in pools;
+  };
+  for (const entry of params.providers) {
+    pushProvider(push, entry, params.credentialCache, params.chatgptSignIn);
+  }
+  if (params.platform !== "darwin" || params.run === void 0) {
+    push("keychain", "pass", "Skipped (not macOS).");
+  } else {
+    for (const entry of params.identities) {
+      const result = lookupKeychainService(params.run, entry.farmRoot);
+      push("keychain", result.found ? "pass" : "warn", result.note, entry.name);
+    }
+  }
+  if (params.directoryRules.raw === void 0) {
+    push("directory-rules", "pass", "No directory-rules.json configured.");
+  } else {
+    const validated2 = validateJson(DirectoryRulesSchema, params.directoryRules);
+    if (!validated2.ok) {
+      push("directory-rules", "fail", validated2.message);
+    } else {
+      push("directory-rules", "pass", `${params.directoryRules.path} is valid.`);
+      for (const rule of validated2.data.rules) {
+        const badRefs = [];
+        if (rule.identity !== void 0 && !selectionExists(rule.identity)) {
+          badRefs.push(poolNameOf(rule.identity) === void 0 ? `identity "${rule.identity}"` : `pool "${poolNameOf(rule.identity) ?? ""}"`);
+        }
+        if (rule.configProfile !== void 0 && !validProfileNames.has(rule.configProfile)) {
+          badRefs.push(`configuration profile "${rule.configProfile}"`);
+        }
+        checkPin("directory-rules", rule.path, `Rule for "${rule.path}"`, rule.launch?.claudeVersion);
+        if (badRefs.length > 0) {
+          push("directory-rules", "fail", `Rule for "${rule.path}" names ${badRefs.join(" and ")}, which do not exist.`, rule.path);
+        } else {
+          push("directory-rules", "pass", `Rule for "${rule.path}" is valid.`, rule.path);
+        }
+      }
+    }
+  }
+  if (params.globalConfig.raw === void 0) {
+    push("global-config", "pass", "No config.json configured.");
+  } else {
+    const validated2 = validateJson(GlobalConfigSchema, params.globalConfig);
+    if (!validated2.ok) {
+      push("global-config", "fail", validated2.message);
+    } else {
+      const defaultProfile = validated2.data.defaultConfigProfile;
+      if (defaultProfile !== void 0 && !validProfileNames.has(defaultProfile)) {
+        push(
+          "global-config",
+          "fail",
+          `config.json names configuration profile "${defaultProfile}" as its default, but no such profile exists.`
+        );
+      } else {
+        push("global-config", "pass", `${params.globalConfig.path} is valid.`);
+        checkPin("global-config", void 0, "config.json", validated2.data.launch?.claudeVersion);
+      }
+    }
+  }
+  if (params.categoriesLocal.raw === void 0) {
+    push("categories-local", "pass", "No categories.local.json configured.");
+  } else {
+    const validated2 = validateJson(CategoryClassificationOverlaySchema, params.categoriesLocal);
+    push(
+      "categories-local",
+      validated2.ok ? "pass" : "fail",
+      validated2.ok ? `${params.categoriesLocal.path} is valid.` : validated2.message
+    );
+  }
+  if (params.headroom.state.raw === void 0) {
+    push("headroom", "pass", "No headroom daemon has ever run; nothing to check.");
+  } else {
+    const validated2 = validateJson(HeadroomStateSchema, params.headroom.state);
+    if (!validated2.ok) {
+      push("headroom", "fail", validated2.message);
+    } else {
+      const state = validated2.data;
+      const supervisorAlive = state.supervisorPid !== void 0 && params.headroom.isRunning(state.supervisorPid);
+      const headroomAlive = state.headroomPid !== void 0 && params.headroom.isRunning(state.headroomPid);
+      if (state.supervisorPid === void 0) {
+        if (state.lastError === void 0) {
+          push("headroom", "pass", "Headroom daemon is stopped (idle shutdown) with no recorded error.");
+        } else {
+          push("headroom", "warn", `Headroom supervisor is not running; last error: ${state.lastError}`);
+        }
+      } else if (!supervisorAlive) {
+        push(
+          "headroom",
+          "warn",
+          `Headroom state names supervisor pid ${String(state.supervisorPid)}, which is not running; the next launch through headroom will start a replacement.`
+        );
+      } else if (state.headroomPid === void 0 || state.socketPath === void 0) {
+        push(
+          "headroom",
+          "warn",
+          state.lastError === void 0 ? "Headroom supervisor is running but the daemon has no healthy process; it should be restarting it." : `Headroom supervisor is running but the daemon is down; last error: ${state.lastError}`
+        );
+      } else if (!headroomAlive) {
+        push(
+          "headroom",
+          "warn",
+          `Headroom state names daemon pid ${String(state.headroomPid)}, which is not running; its supervisor should be restarting it.`
+        );
+      } else {
+        push(
+          "headroom",
+          "pass",
+          `Headroom daemon is up on unix socket ${state.socketPath} (supervisor ${String(state.supervisorPid)}, daemon ${String(state.headroomPid)}).`
+        );
+      }
+      if (state.lastError !== void 0 && supervisorAlive) {
+        push("headroom", "warn", `Headroom recorded a previous error: ${state.lastError}`);
+      }
+      if (state.installedSource !== void 0 && isMovingGitSource(state.installedSource)) {
+        push(
+          "headroom",
+          "warn",
+          `Headroom is installed from a git ref that can move (${state.installedSource}); pin headroom.source to a full commit SHA so a rebased or deleted branch cannot change or break the install.`
+        );
+      }
+    }
+  }
+  if (params.activeIdentity.raw === void 0) {
+    push("active-identity", "pass", "No active identity set.");
+  } else {
+    const trimmed = params.activeIdentity.raw.trim();
+    if (trimmed === "") {
+      push("active-identity", "warn", "active-identity is present but empty \u2014 treated the same as unset.");
+    } else if (!selectionExists(trimmed)) {
+      push("active-identity", "fail", `active-identity names "${trimmed}", which does not exist.`);
+    } else {
+      push("active-identity", "pass", `Active identity "${trimmed}" is valid.`);
+    }
+  }
+  return { findings, ok: !findings.some((finding) => finding.severity === "fail") };
+}
+var SECTION_TITLES = {
+  "ambient-credential": "Ambient-credential exposure",
+  "binary-discovery": "Claude Code binary discovery",
+  "claude-shim": "`claude` command shim",
+  "path-resolution": "PATH resolution",
+  "legacy-name": "Former `claude-use` name",
+  "config-profile": "Configuration profiles",
+  identity: "Identities",
+  pool: "Pools",
+  provider: "Providers",
+  keychain: "macOS Keychain",
+  "directory-rules": "Directory rules",
+  "global-config": "Global config",
+  headroom: "Headroom daemon",
+  "categories-local": "categories.local.json",
+  "active-identity": "Active identity"
+};
+var SECTION_ORDER = [
+  "ambient-credential",
+  "binary-discovery",
+  "claude-shim",
+  "path-resolution",
+  "config-profile",
+  "identity",
+  "pool",
+  "provider",
+  "keychain",
+  "directory-rules",
+  "global-config",
+  "headroom",
+  "categories-local",
+  "active-identity"
+];
+function severityPrefix(severity) {
+  switch (severity) {
+    case "pass":
+      return "[PASS]";
+    case "warn":
+      return "[WARN]";
+    case "fail":
+      return "[FAIL]";
+    default:
+      return severity;
+  }
+}
+function formatDoctorReport(report) {
+  const lines = [];
+  for (const section of SECTION_ORDER) {
+    const sectionFindings = report.findings.filter((finding) => finding.section === section);
+    if (sectionFindings.length === 0) {
+      continue;
+    }
+    lines.push("", `${SECTION_TITLES[section]}:`);
+    for (const finding of sectionFindings) {
+      const subject = finding.subject === void 0 ? "" : `${finding.subject}: `;
+      lines.push(`  ${severityPrefix(finding.severity)} ${subject}${finding.message}`);
+    }
+  }
+  const failCount = report.findings.filter((finding) => finding.severity === "fail").length;
+  lines.push("", report.ok ? "All checks passed." : `${String(failCount)} check(s) failed.`);
+  return lines;
+}
+function realpathOrSelf(target) {
+  try {
+    return import_node_fs12.default.realpathSync(target);
+  } catch {
+    return target;
+  }
+}
+function collectDoctorReport(params) {
+  const { paths } = params;
+  const identityNames = import_node_fs12.default.existsSync(paths.identitiesDir) ? import_node_fs12.default.readdirSync(paths.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && isIdentityDirectoryName(entry.name)).map((entry) => entry.name).sort() : [];
+  const identities = identityNames.map((name) => {
+    const farmRoot = import_node_path32.default.join(paths.identitiesDir, name);
+    const identityPath = import_node_path32.default.join(farmRoot, "identity.json");
+    return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot };
+  });
+  const profileNames = import_node_fs12.default.existsSync(paths.configProfilesDir) ? import_node_fs12.default.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
+  const configProfiles = profileNames.map((name) => {
+    const profilePath = import_node_path32.default.join(paths.configProfilesDir, `${name}.json`);
+    return { name, path: profilePath, raw: realFsPort.readFileUtf8(profilePath) };
+  });
+  const providerNames = import_node_fs12.default.existsSync(paths.providersDir) ? import_node_fs12.default.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
+  const providers = providerNames.map((name) => {
+    const providerPath = import_node_path32.default.join(paths.providersDir, `${name}.json`);
+    return { name, path: providerPath, raw: realFsPort.readFileUtf8(providerPath) };
+  });
+  const ownExecutablePath = realOwnExecutablePath();
+  let binaryDiscovery;
+  try {
+    const binary = realResolveClaudeBinary(resolveOwnBinaryCheck(paths, realContentSourcePath()))();
+    binaryDiscovery = { ok: true, binary };
+  } catch (error62) {
+    binaryDiscovery = { ok: false, message: error62 instanceof Error ? error62.message : String(error62) };
+  }
+  const shimState = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
+  const pathDirs = (params.env.PATH ?? "").split(import_node_path32.default.delimiter).filter((dir) => dir !== "");
+  const claudeShimShadow = shimState === void 0 ? void 0 : refinePathShadow(
+    findPathShadow({
+      pathDirs,
+      targetDir: import_node_path32.default.dirname(shimState.targetPath),
+      targetFilename: import_node_path32.default.basename(shimState.targetPath),
+      findExecutableInDir
+    }),
+    shimState.targetPath,
+    realpathOrSelf
+  );
+  const report = runDoctor({
+    env: params.env,
+    credentialCache: realCredentialCacheEnv(paths),
+    chatgptSignIn: { path: paths.chatgptSignInFile, raw: realFsPort.readFileUtf8(paths.chatgptSignInFile) },
+    installedClaudeVersions: realInstalledClaudeVersions(),
+    identities,
+    configProfiles,
+    providers,
+    directoryRules: { path: paths.directoryRulesFile, raw: realFsPort.readFileUtf8(paths.directoryRulesFile) },
+    globalConfig: { path: paths.globalConfigFile, raw: realFsPort.readFileUtf8(paths.globalConfigFile) },
+    categoriesLocal: { path: paths.categoriesLocalFile, raw: realFsPort.readFileUtf8(paths.categoriesLocalFile) },
+    activeIdentity: { path: paths.activeIdentityFile, raw: realFsPort.readFileUtf8(paths.activeIdentityFile) },
+    binaryDiscovery,
+    claudeShim: { state: shimState, targetExists: shimState !== void 0 && import_node_fs12.default.existsSync(shimState.targetPath) },
+    rootPath: paths.root,
+    pathResolution: {
+      ownExecutablePath,
+      agentShim: refinePathShadow(
+        findPathShadow({
+          pathDirs,
+          targetDir: import_node_path32.default.dirname(ownExecutablePath),
+          targetFilename: commandFilename(ownExecutablePath, "agent-shim"),
+          findExecutableInDir
+        }),
+        ownExecutablePath,
+        realpathOrSelf
+      ),
+      ...claudeShimShadow === void 0 ? {} : { claude: claudeShimShadow }
+    },
+    run: realRunPort,
+    platform: process.platform,
+    headroom: {
+      state: { path: paths.headroomStateFile, raw: realFsPort.readFileUtf8(paths.headroomStateFile) },
+      isRunning: realIsProcessRunning
+    }
+  });
+  return report;
+}
+
 // node_modules/.pnpm/radash@12.1.1/node_modules/radash/dist/esm/async.mjs
 var guard = (func, shouldGuard) => {
   const _guard = (err) => {
@@ -68066,9 +69141,9 @@ function resolveFriendlyClientOptions(options) {
   };
 }
 function createORPCClient(link, options = {}) {
-  const path43 = options.path ?? [];
+  const path44 = options.path ?? [];
   const procedureClient = async (...[input2, options2 = {}]) => {
-    return await link.call(path43, input2, resolveFriendlyClientOptions(options2));
+    return await link.call(path44, input2, resolveFriendlyClientOptions(options2));
   };
   const recursive2 = new Proxy(procedureClient, {
     get(target, key) {
@@ -68077,13 +69152,293 @@ function createORPCClient(link, options = {}) {
       }
       return createORPCClient(link, {
         ...options,
-        path: [...path43, key]
+        path: [...path44, key]
       });
     }
   });
   return preventNativeAwait(recursive2);
 }
 
+// src/resolve/types.ts
+var LAYER_KINDS = [
+  "global-config",
+  "config-profile",
+  "directory-rule",
+  "portable",
+  "portable-local",
+  "cli-override"
+];
+var DECISION_VIAS = [
+  /** The unconditional pre-cascade floor: the path's real classification is `secret`. */
+  "secret-floor",
+  /** Nothing in the classification map recognises the path's top-level entry. */
+  "unclassified",
+  /** An entries rule matched and its condition (if any) held. */
+  "entry-rule",
+  /** No entries rule survived; a layer's category toggle decided it. */
+  "category-override",
+  /** No entries rule and no category toggle; the shipped default for the category decided it. */
+  "category-default"
+];
+var DIAGNOSTIC_CODES = [
+  /** A profile's `extends` graph contains a cycle. */
+  "EXTENDS_CYCLE",
+  /** An `extends` entry names a profile that does not exist. */
+  "MISSING_PROFILE",
+  /** An entries key was written under the `secret/` prefix. Rejected at compile time — `secret` can never be overridden by any layer. */
+  "SECRET_ENTRY_KEY",
+  /** An entries key under some other prefix matched a path whose real classification is `secret`. Neutralised at resolve time by the floor check. */
+  "SECRET_PATH_NEUTRALISED",
+  /** An entries key's declared category prefix disagrees with the real classification of a path it matched. */
+  "CATEGORY_PREFIX_MISMATCH",
+  /** An entries key is not of the form `<category>/<path>`. The schema rejects these at parse time; this fires only for a layer built in code. */
+  "MALFORMED_ENTRY_KEY",
+  /** An earlier layer's exact key lost to a later layer's glob. Correct per the comparator, but worth surfacing rather than resolving silently. */
+  "EXACT_ENTRY_OVERRIDDEN_BY_LATER_GLOB",
+  /** A `history/projects/` pattern's encoded form could plausibly correspond to more than one real path. */
+  "AMBIGUOUS_PROJECT_ENCODING",
+  /** A `history/projects/` key's path fragment is neither home-rooted nor absolute, so it cannot be encoded. */
+  "UNROOTED_PROJECT_PATH",
+  /** A `~/.claude` entry nothing in the classification map recognises. */
+  "UNCLASSIFIED_ENTRY",
+  /** An empty `when: {}` object, which is vacuously true and therefore has no effect. */
+  "EMPTY_WHEN",
+  /** The previous farm's manifest is missing or unreadable, so reconciliation ran in conservative mode. */
+  "FARM_MANIFEST_MISSING",
+  /** A file Claude Code wrote into a materialised farm directory differs from the canonical copy of the same path. */
+  "RECONCILE_CONFLICT",
+  /** Reconciliation proposed adopting a path whose real classification is `secret`. Refused: the secret floor applies to data moving into `~/.claude` exactly as it applies to data moving out. */
+  "RECONCILE_SECRET_BLOCKED",
+  /** A previous launch was interrupted mid-swap and this launch completed or undid the half-finished work. */
+  "FARM_SWAP_RECOVERED",
+  /** A superseded farm could not be discarded because it still held data the new farm has its own entry for, so it was left on disk for the user to look at. */
+  "FARM_PREVIOUS_RETAINED"
+];
+var DIAGNOSTIC_SEVERITIES = ["error", "warning", "info"];
+
+// src/usage/pickReportSchema.ts
+var PoolPickCandidateViewSchema = external_exports.strictObject({
+  identity: external_exports.string(),
+  /** In pick order: `scored` has usable quota data, `unknown` has none, `pay-per-use` bills by use, `ineligible` is refused right now. */
+  class: external_exports.enum(["scored", "unknown", "pay-per-use", "ineligible"]),
+  /** Plan-size-weighted remaining quota per hour until its reset; present for `scored` only. */
+  score: external_exports.number().optional(),
+  /** False when the five-hour window would run dry, at the observed pace, before it resets. */
+  feasible: external_exports.boolean(),
+  /** When an `ineligible` member can be used again, as an ISO instant. */
+  blockedUntil: external_exports.iso.datetime().optional(),
+  plan: PlanClassSchema,
+  /** The facts behind the class and score, in the order they matter. */
+  reasons: external_exports.array(external_exports.string())
+});
+var PoolPickReportSchema = external_exports.strictObject({
+  pool: external_exports.string(),
+  directory: external_exports.string(),
+  /** The member a launch would run as, absent when every member is refused. */
+  pick: external_exports.string().optional(),
+  candidates: external_exports.array(PoolPickCandidateViewSchema),
+  /** Members that name an identity that does not exist; a launch skips them. */
+  missing: external_exports.array(external_exports.string()),
+  /** When nothing can be picked, the soonest any member returns. */
+  earliestReturn: external_exports.strictObject({ identity: external_exports.string(), at: external_exports.iso.datetime() }).optional(),
+  /** Why the last-pick record could not be read, when that is the case. */
+  stickyProblem: external_exports.string().optional()
+});
+
+// src/checkReportSchema.ts
+var CHECK_CREDENTIAL_APPLIES = ["provider", "identity", "stored-login"];
+var CheckLayerViewSchema = external_exports.strictObject({
+  id: external_exports.int(),
+  kind: external_exports.enum(LAYER_KINDS),
+  source: external_exports.string()
+});
+var CheckEntryViewSchema = external_exports.strictObject({
+  path: external_exports.string(),
+  shared: external_exports.boolean(),
+  via: external_exports.enum(DECISION_VIAS),
+  /** The entry's real category, or null when nothing classifies it. */
+  category: external_exports.enum(CATEGORY_NAMES).nullable(),
+  rule: external_exports.strictObject({ key: external_exports.string(), layer: external_exports.int() }).optional(),
+  /** Rules that matched but whose `when` condition failed, each with the conditions that failed. */
+  eliminated: external_exports.readonly(external_exports.array(external_exports.strictObject({ key: external_exports.string(), failed: external_exports.readonly(external_exports.array(external_exports.string())) }))).optional()
+});
+var CheckDiagnosticSchema = external_exports.strictObject({
+  code: external_exports.enum(DIAGNOSTIC_CODES),
+  severity: external_exports.enum(DIAGNOSTIC_SEVERITIES),
+  message: external_exports.string(),
+  subject: external_exports.string().optional(),
+  layer: external_exports.int().optional()
+});
+var CheckAmbientCredentialSchema = external_exports.union([external_exports.strictObject({ ok: external_exports.literal(true) }), external_exports.strictObject({ ok: external_exports.literal(false), variable: external_exports.string(), message: external_exports.string() })]);
+var CheckKeychainSchema = external_exports.strictObject({
+  checked: external_exports.literal(true),
+  found: external_exports.boolean(),
+  serviceName: external_exports.string().optional(),
+  note: external_exports.string()
+});
+var CheckSettingsExposureSchema = external_exports.strictObject({
+  file: external_exports.string(),
+  envKeyNames: external_exports.readonly(external_exports.array(external_exports.string())),
+  hookEventNames: external_exports.readonly(external_exports.array(external_exports.string())),
+  hookCommandCount: external_exports.int().nonnegative()
+});
+var CredentialSourceSummarySchema = external_exports.union([
+  external_exports.strictObject({ kind: external_exports.literal("env"), variable: external_exports.string() }),
+  external_exports.strictObject({ kind: external_exports.literal("file"), path: external_exports.string() }),
+  external_exports.strictObject({ kind: external_exports.literal("command"), program: external_exports.string() }),
+  external_exports.strictObject({ kind: external_exports.literal("op"), reference: external_exports.string() }),
+  external_exports.strictObject({ kind: external_exports.literal("keychain"), service: external_exports.string(), account: external_exports.string().optional() }),
+  external_exports.strictObject({ kind: external_exports.literal("literal") })
+]);
+var CredentialSummarySchema = external_exports.strictObject({
+  target: external_exports.enum(CREDENTIAL_TARGETS),
+  sources: external_exports.readonly(external_exports.array(CredentialSourceSummarySchema)),
+  cache: CredentialCacheSchema.optional()
+});
+var CachedCredentialStateSchema = external_exports.union([
+  external_exports.strictObject({ store: external_exports.enum(CREDENTIAL_CACHE_STORES), status: external_exports.literal("empty") }),
+  external_exports.strictObject({ store: external_exports.enum(CREDENTIAL_CACHE_STORES), status: external_exports.literal("unreadable"), reason: external_exports.string() }),
+  external_exports.strictObject({ store: external_exports.enum(CREDENTIAL_CACHE_STORES), status: external_exports.enum(["fresh", "expired"]), ageMs: external_exports.number(), expiresInMs: external_exports.number().optional() })
+]);
+var CheckCredentialProviderSchema = external_exports.union([
+  external_exports.strictObject({ name: external_exports.string(), credential: CredentialSummarySchema, cached: CachedCredentialStateSchema.optional() }),
+  external_exports.strictObject({ name: external_exports.string(), problem: external_exports.string() })
+]);
+var CheckCredentialSchema = external_exports.strictObject({
+  applies: external_exports.enum(CHECK_CREDENTIAL_APPLIES),
+  provider: CheckCredentialProviderSchema.optional(),
+  identity: CredentialSummarySchema.optional(),
+  identityCached: CachedCredentialStateSchema.optional()
+});
+var CheckClaudeVersionSchema = external_exports.strictObject({
+  pinned: external_exports.strictObject({ version: external_exports.string(), source: external_exports.enum(CLAUDE_VERSION_SOURCES), installed: external_exports.boolean() }).optional(),
+  highestInstalled: external_exports.string().optional(),
+  installed: external_exports.readonly(external_exports.array(external_exports.string()))
+});
+var CheckReportJsonSchema = external_exports.strictObject({
+  identity: external_exports.strictObject({ name: external_exports.string().nullable(), source: external_exports.enum(IDENTITY_DECISION_SOURCES) }),
+  /** The pool ranking, when the launch named a pool instead of an identity. */
+  pool: PoolPickReportSchema.optional(),
+  configProfile: external_exports.strictObject({ name: external_exports.string().nullable(), source: external_exports.enum(CONFIG_PROFILE_DECISION_SOURCES) }),
+  layers: external_exports.readonly(external_exports.array(CheckLayerViewSchema)),
+  entries: external_exports.readonly(external_exports.array(CheckEntryViewSchema)),
+  projectEncodingAmbiguities: external_exports.readonly(
+    external_exports.array(external_exports.strictObject({ fragment: external_exports.string(), encoded: external_exports.string(), reason: external_exports.enum(ENCODING_AMBIGUITY_REASONS), detail: external_exports.string() }))
+  ),
+  diagnostics: external_exports.readonly(external_exports.array(CheckDiagnosticSchema)),
+  ambientCredential: CheckAmbientCredentialSchema,
+  keychain: CheckKeychainSchema.optional(),
+  settingsExposure: external_exports.readonly(external_exports.array(CheckSettingsExposureSchema)),
+  credential: CheckCredentialSchema,
+  claudeVersion: CheckClaudeVersionSchema.optional()
+});
+
+// src/frontdoor/controlSchemas.ts
+var import_node_path33 = __toESM(require("node:path"), 1);
+var UsageListOutputSchema = external_exports.strictObject({ snapshots: external_exports.readonly(external_exports.array(UsageSnapshotSchema)) });
+var UsageWindowsInputSchema = external_exports.strictObject({
+  identity: external_exports.string().min(1),
+  provider: external_exports.string().min(1).optional()
+});
+var EffectiveWindowSchema = external_exports.strictObject({
+  /** True when the window's reset time has passed, so the recorded observation describes a window that no longer exists. */
+  reset: external_exports.boolean(),
+  /** The fraction used: 0 for a reset window, otherwise what was last observed, absent when none was reported. */
+  utilization: external_exports.number().optional(),
+  /** The reset instant, for a window that has not reset yet and reported one. */
+  resetsAtMs: external_exports.number().optional(),
+  /** The window's own status, for a window that has not reset yet. */
+  status: external_exports.string().optional()
+});
+var UsageWindowsOutputSchema = external_exports.strictObject({
+  identity: external_exports.string(),
+  provider: external_exports.string(),
+  /** When the rate-limit state the windows come from was observed. */
+  observedAt: external_exports.iso.datetime().optional(),
+  fiveHour: EffectiveWindowSchema.optional(),
+  sevenDay: EffectiveWindowSchema.optional()
+});
+var FrontDoorSessionStatusSchema = external_exports.strictObject({
+  pid: external_exports.int().positive(),
+  startedAt: external_exports.number(),
+  alive: external_exports.boolean()
+});
+var HeadroomSocketTargetSchema = external_exports.union([external_exports.strictObject({ socketPath: external_exports.string() }), external_exports.strictObject({ refused: external_exports.string() })]);
+var FrontDoorStatusOutputSchema = external_exports.strictObject({
+  state: FrontDoorStateSchema,
+  supervisorAlive: external_exports.boolean(),
+  sessions: external_exports.readonly(external_exports.array(FrontDoorSessionStatusSchema)),
+  headroomSocket: HeadroomSocketTargetSchema.optional(),
+  logPath: external_exports.string(),
+  logExists: external_exports.boolean()
+});
+var FrontDoorSessionsOutputSchema = external_exports.strictObject({ sessions: external_exports.readonly(external_exports.array(FrontDoorSessionStatusSchema)) });
+var CheckRunInputSchema = external_exports.strictObject({
+  path: external_exports.string().min(1),
+  identity: external_exports.string().min(1).optional()
+}).refine((input2) => import_node_path33.default.isAbsolute(input2.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+var DoctorFindingSchema = external_exports.strictObject({
+  section: external_exports.enum(DOCTOR_SECTIONS),
+  subject: external_exports.string().optional(),
+  severity: external_exports.enum(DOCTOR_SEVERITIES),
+  message: external_exports.string()
+});
+var DoctorRunOutputSchema = external_exports.strictObject({
+  /** False exactly when any finding is a `fail`; a `warn` never fails the report on its own. */
+  ok: external_exports.boolean(),
+  findings: external_exports.readonly(external_exports.array(DoctorFindingSchema))
+});
+
+// node_modules/.pnpm/@orpc+contract@1.15.4/node_modules/@orpc/contract/dist/shared/contract.D_dZrO__.mjs
+var ValidationError = class extends Error {
+  issues;
+  data;
+  constructor(options) {
+    super(options.message, options);
+    this.issues = options.issues;
+    this.data = options.data;
+  }
+};
+function mergeErrorMap(errorMap1, errorMap2) {
+  return { ...errorMap1, ...errorMap2 };
+}
+async function validateORPCError(map3, error62) {
+  const { code, status, message, data, cause, defined } = error62;
+  const config2 = map3?.[error62.code];
+  if (!config2 || fallbackORPCErrorStatus(error62.code, config2.status) !== error62.status) {
+    return defined ? new ORPCError(code, { defined: false, status, message, data, cause }) : error62;
+  }
+  if (!config2.data) {
+    return defined ? error62 : new ORPCError(code, { defined: true, status, message, data, cause });
+  }
+  const validated2 = await config2.data["~standard"].validate(error62.data);
+  if (validated2.issues) {
+    return defined ? new ORPCError(code, { defined: false, status, message, data, cause }) : error62;
+  }
+  return new ORPCError(code, { defined: true, status, message, data: validated2.value, cause });
+}
+var ContractProcedure = class {
+  /**
+   * This property holds the defined options for the contract procedure.
+   */
+  "~orpc";
+  constructor(def) {
+    if (def.route?.successStatus && isORPCErrorStatus(def.route.successStatus)) {
+      throw new Error("[ContractProcedure] Invalid successStatus.");
+    }
+    if (Object.values(def.errorMap).some((val) => val && val.status && !isORPCErrorStatus(val.status))) {
+      throw new Error("[ContractProcedure] Invalid error status code.");
+    }
+    this["~orpc"] = def;
+  }
+};
+function isContractProcedure(item) {
+  if (item instanceof ContractProcedure) {
+    return true;
+  }
+  return (typeof item === "object" || typeof item === "function") && item !== null && "~orpc" in item && typeof item["~orpc"] === "object" && item["~orpc"] !== null && "errorMap" in item["~orpc"] && "route" in item["~orpc"] && "meta" in item["~orpc"];
+}
+
 // node_modules/.pnpm/@orpc+standard-server-fetch@1.15.4/node_modules/@orpc/standard-server-fetch/dist/index.mjs
 function toEventIterator(stream, options = {}) {
   const eventStream = stream?.pipeThrough(new TextDecoderStream()).pipeThrough(new EventDecoderStream());
@@ -68379,19 +69734,19 @@ var StandardLink = class {
   }
   interceptors;
   clientInterceptors;
-  call(path43, input2, options) {
+  call(path44, input2, options) {
     return runWithSpan(
-      { name: `${ORPC_NAME}.${path43.join("/")}`, signal: options.signal },
+      { name: `${ORPC_NAME}.${path44.join("/")}`, signal: options.signal },
       (span) => {
         span?.setAttribute("rpc.system", ORPC_NAME);
-        span?.setAttribute("rpc.method", path43.join("."));
+        span?.setAttribute("rpc.method", path44.join("."));
         if (isAsyncIteratorObject(input2)) {
           input2 = asyncIteratorWithSpan(
             { name: "consume_event_iterator_input", signal: options.signal },
             input2
           );
         }
-        return intercept(this.interceptors, { ...options, path: path43, input: input2 }, async ({ path: path210, input: input22, ...options2 }) => {
+        return intercept(this.interceptors, { ...options, path: path44, input: input2 }, async ({ path: path210, input: input22, ...options2 }) => {
           const otelConfig = getGlobalOtelConfig();
           let otelContext;
           const currentSpan = otelConfig?.trace.getActiveSpan() ?? span;
@@ -68626,8 +69981,8 @@ var StandardRPCJsonSerializer = class {
     return ref.data;
   }
 };
-function toHttpPath(path43) {
-  return `/${path43.map(encodeURIComponent).join("/")}`;
+function toHttpPath(path44) {
+  return `/${path44.map(encodeURIComponent).join("/")}`;
 }
 function toStandardHeaders2(headers) {
   if (typeof headers.forEach === "function") {
@@ -68652,18 +70007,18 @@ var StandardRPCLinkCodec = class {
   fallbackMethod;
   expectedMethod;
   headers;
-  async encode(path43, input2, options) {
-    let headers = toStandardHeaders2(await value(this.headers, options, path43, input2));
+  async encode(path44, input2, options) {
+    let headers = toStandardHeaders2(await value(this.headers, options, path44, input2));
     if (options.lastEventId !== void 0) {
       headers = mergeStandardHeaders(headers, { "last-event-id": options.lastEventId });
     }
-    const expectedMethod = await value(this.expectedMethod, options, path43, input2);
-    const baseUrl = await value(this.baseUrl, options, path43, input2);
+    const expectedMethod = await value(this.expectedMethod, options, path44, input2);
+    const baseUrl = await value(this.baseUrl, options, path44, input2);
     const url2 = new URL(baseUrl);
-    url2.pathname = `${url2.pathname.replace(/\/$/, "")}${toHttpPath(path43)}`;
+    url2.pathname = `${url2.pathname.replace(/\/$/, "")}${toHttpPath(path44)}`;
     const serialized = this.serializer.serialize(input2);
     if (expectedMethod === "GET" && !(serialized instanceof FormData) && !isAsyncIteratorObject(serialized)) {
-      const maxUrlLength = await value(this.maxUrlLength, options, path43, input2);
+      const maxUrlLength = await value(this.maxUrlLength, options, path44, input2);
       const getUrl = new URL(url2);
       getUrl.searchParams.append("data", stringifyJSON(serialized));
       if (getUrl.toString().length <= maxUrlLength) {
@@ -68795,93 +70150,6 @@ var StandardRPCLink = class extends StandardLink {
   }
 };
 
-// node_modules/.pnpm/@orpc+client@1.15.4/node_modules/@orpc/client/dist/adapters/fetch/index.mjs
-var CompositeLinkFetchPlugin = class extends CompositeStandardLinkPlugin {
-  initRuntimeAdapter(options) {
-    for (const plugin of this.plugins) {
-      plugin.initRuntimeAdapter?.(options);
-    }
-  }
-};
-var LinkFetchClient = class {
-  fetch;
-  toFetchRequestOptions;
-  adapterInterceptors;
-  constructor(options) {
-    const plugin = new CompositeLinkFetchPlugin(options.plugins);
-    plugin.initRuntimeAdapter(options);
-    this.fetch = options.fetch ?? globalThis.fetch.bind(globalThis);
-    this.toFetchRequestOptions = options;
-    this.adapterInterceptors = toArray(options.adapterInterceptors);
-  }
-  async call(standardRequest, options, path43, input2) {
-    const request7 = toFetchRequest(standardRequest, this.toFetchRequestOptions);
-    const fetchResponse = await intercept(
-      this.adapterInterceptors,
-      { ...options, request: request7, path: path43, input: input2, init: { redirect: "manual" } },
-      ({ request: request22, path: path210, input: input22, init, ...options2 }) => this.fetch(request22, init, options2, path210, input22)
-    );
-    const lazyResponse = toStandardLazyResponse(fetchResponse, { signal: request7.signal });
-    return lazyResponse;
-  }
-};
-var RPCLink = class extends StandardRPCLink {
-  constructor(options) {
-    const linkClient = new LinkFetchClient(options);
-    super(linkClient, options);
-  }
-};
-
-// node_modules/.pnpm/@orpc+contract@1.15.4/node_modules/@orpc/contract/dist/shared/contract.D_dZrO__.mjs
-var ValidationError = class extends Error {
-  issues;
-  data;
-  constructor(options) {
-    super(options.message, options);
-    this.issues = options.issues;
-    this.data = options.data;
-  }
-};
-function mergeErrorMap(errorMap1, errorMap2) {
-  return { ...errorMap1, ...errorMap2 };
-}
-async function validateORPCError(map3, error62) {
-  const { code, status, message, data, cause, defined } = error62;
-  const config2 = map3?.[error62.code];
-  if (!config2 || fallbackORPCErrorStatus(error62.code, config2.status) !== error62.status) {
-    return defined ? new ORPCError(code, { defined: false, status, message, data, cause }) : error62;
-  }
-  if (!config2.data) {
-    return defined ? error62 : new ORPCError(code, { defined: true, status, message, data, cause });
-  }
-  const validated2 = await config2.data["~standard"].validate(error62.data);
-  if (validated2.issues) {
-    return defined ? new ORPCError(code, { defined: false, status, message, data, cause }) : error62;
-  }
-  return new ORPCError(code, { defined: true, status, message, data: validated2.value, cause });
-}
-var ContractProcedure = class {
-  /**
-   * This property holds the defined options for the contract procedure.
-   */
-  "~orpc";
-  constructor(def) {
-    if (def.route?.successStatus && isORPCErrorStatus(def.route.successStatus)) {
-      throw new Error("[ContractProcedure] Invalid successStatus.");
-    }
-    if (Object.values(def.errorMap).some((val) => val && val.status && !isORPCErrorStatus(val.status))) {
-      throw new Error("[ContractProcedure] Invalid error status code.");
-    }
-    this["~orpc"] = def;
-  }
-};
-function isContractProcedure(item) {
-  if (item instanceof ContractProcedure) {
-    return true;
-  }
-  return (typeof item === "object" || typeof item === "function") && item !== null && "~orpc" in item && typeof item["~orpc"] === "object" && item["~orpc"] !== null && "errorMap" in item["~orpc"] && "route" in item["~orpc"] && "meta" in item["~orpc"];
-}
-
 // node_modules/.pnpm/@orpc+contract@1.15.4/node_modules/@orpc/contract/dist/index.mjs
 function mergeMeta(meta1, meta22) {
   return { ...meta1, ...meta22 };
@@ -69218,7 +70486,7 @@ function middlewareOutputFn(output2) {
 function createProcedureClient(lazyableProcedure, ...rest) {
   const options = resolveMaybeOptionalOptions(rest);
   return async (...[input2, callerOptions]) => {
-    const path43 = toArray(options.path);
+    const path44 = toArray(options.path);
     const { default: procedure } = await unlazy(lazyableProcedure);
     const clientContext = callerOptions?.context ?? {};
     const context = await value(options.context ?? {}, clientContext);
@@ -69233,7 +70501,7 @@ function createProcedureClient(lazyableProcedure, ...rest) {
       const output2 = await runWithSpan(
         { name: "call_procedure", signal: callerOptions?.signal },
         (span) => {
-          span?.setAttribute("procedure.path", [...path43]);
+          span?.setAttribute("procedure.path", [...path44]);
           return intercept(
             toArray(options.interceptors),
             {
@@ -69241,7 +70509,7 @@ function createProcedureClient(lazyableProcedure, ...rest) {
               input: input2,
               // input only optional when it undefinable so we can safely cast it
               errors,
-              path: path43,
+              path: path44,
               procedure,
               signal: callerOptions?.signal,
               lastEventId: callerOptions?.lastEventId
@@ -69363,10 +70631,10 @@ var HIDDEN_ROUTER_CONTRACT_SYMBOL = /* @__PURE__ */ Symbol("ORPC_HIDDEN_ROUTER_C
 function getHiddenRouterContract(router) {
   return router[HIDDEN_ROUTER_CONTRACT_SYMBOL];
 }
-function getRouter(router, path43) {
+function getRouter(router, path44) {
   let current = router;
-  for (let i2 = 0; i2 < path43.length; i2++) {
-    const segment = path43[i2];
+  for (let i2 = 0; i2 < path44.length; i2++) {
+    const segment = path44[i2];
     if (!current) {
       return void 0;
     }
@@ -69381,7 +70649,7 @@ function getRouter(router, path43) {
       continue;
     }
     const lazied = current;
-    const rest = path43.slice(i2);
+    const rest = path44.slice(i2);
     return lazy2(async () => {
       const unwrapped = await unlazy(lazied);
       const next = getRouter(unwrapped.default, rest);
@@ -69826,6 +71094,43 @@ var os7 = new Builder({
   dedupeLeadingMiddlewares: true
 });
 
+// node_modules/.pnpm/@orpc+client@1.15.4/node_modules/@orpc/client/dist/adapters/fetch/index.mjs
+var CompositeLinkFetchPlugin = class extends CompositeStandardLinkPlugin {
+  initRuntimeAdapter(options) {
+    for (const plugin of this.plugins) {
+      plugin.initRuntimeAdapter?.(options);
+    }
+  }
+};
+var LinkFetchClient = class {
+  fetch;
+  toFetchRequestOptions;
+  adapterInterceptors;
+  constructor(options) {
+    const plugin = new CompositeLinkFetchPlugin(options.plugins);
+    plugin.initRuntimeAdapter(options);
+    this.fetch = options.fetch ?? globalThis.fetch.bind(globalThis);
+    this.toFetchRequestOptions = options;
+    this.adapterInterceptors = toArray(options.adapterInterceptors);
+  }
+  async call(standardRequest, options, path44, input2) {
+    const request7 = toFetchRequest(standardRequest, this.toFetchRequestOptions);
+    const fetchResponse = await intercept(
+      this.adapterInterceptors,
+      { ...options, request: request7, path: path44, input: input2, init: { redirect: "manual" } },
+      ({ request: request22, path: path210, input: input22, init, ...options2 }) => this.fetch(request22, init, options2, path210, input22)
+    );
+    const lazyResponse = toStandardLazyResponse(fetchResponse, { signal: request7.signal });
+    return lazyResponse;
+  }
+};
+var RPCLink = class extends StandardRPCLink {
+  constructor(options) {
+    const linkClient = new LinkFetchClient(options);
+    super(linkClient, options);
+  }
+};
+
 // node_modules/.pnpm/@orpc+standard-server-node@1.15.4/node_modules/@orpc/standard-server-node/dist/index.mjs
 var import_node_buffer = require("node:buffer");
 var import_node_stream = require("node:stream");
@@ -69959,8 +71264,8 @@ function toAbortSignal(stream) {
 function toStandardUrl(req) {
   const protocol = "encrypted" in req.socket && req.socket.encrypted ? "https:" : "http:";
   const origin = guard(() => new URL(`${protocol}//${req.headers.host ?? "localhost"}`).origin) ?? `${protocol}//localhost`;
-  const path43 = req.originalUrl ?? req.url ?? "/";
-  return new URL(`${origin}${path43.startsWith("/") ? "" : "/"}${path43}`);
+  const path44 = req.originalUrl ?? req.url ?? "/";
+  return new URL(`${origin}${path44.startsWith("/") ? "" : "/"}${path44}`);
 }
 function toStandardLazyRequest(req, res) {
   const signal = toAbortSignal(res);
@@ -70159,8 +71464,8 @@ var StandardRPCMatcher = class {
   constructor(options = {}) {
     this.filter = options.filter ?? true;
   }
-  init(router, path43 = []) {
-    const laziedOptions = traverseContractProcedures({ router, path: path43 }, (traverseOptions) => {
+  init(router, path44 = []) {
+    const laziedOptions = traverseContractProcedures({ router, path: path44 }, (traverseOptions) => {
       if (!value(this.filter, traverseOptions)) {
         return;
       }
@@ -70438,16 +71743,19 @@ var RcAnswerOutputSchema = external_exports.strictObject({
 // src/frontdoor/rcApi.ts
 var RC_ORPC_PATH_PREFIX = "/__agent-shim/orpc";
 var RC_SUBSCRIBER_BUFFER_EVENTS = 100;
-function createRcApiRouter(deps) {
-  const authed = os7.$context().use(({ context, next }) => {
+function doorApiAuth(expectedToken) {
+  return os7.$context().use(({ context, next }) => {
     const presented = context.headers.authorization;
     const bearerPrefix = "bearer ".length;
     const token = typeof presented === "string" && presented.slice(0, bearerPrefix).toLowerCase() === "bearer " ? presented.slice(bearerPrefix) : void 0;
-    if (token === void 0 || !isLiveCapability(token, [deps.expectedToken])) {
+    if (token === void 0 || !isLiveCapability(token, [expectedToken])) {
       throw new ORPCError("UNAUTHORIZED", { message: "the front door's typed API demands this generation's control token as a Bearer credential" });
     }
     return next();
   });
+}
+function createRcApiRouter(deps) {
+  const authed = doorApiAuth(deps.expectedToken);
   const delivered = (sessionId, result) => {
     if (!result.ok) {
       throw new ORPCError("BAD_GATEWAY", { message: result.message });
@@ -70516,16 +71824,16 @@ function createRcApiRouter(deps) {
     }
   };
 }
-function createRcApiNodeHandler(deps) {
-  const handler = new RPCHandler(createRcApiRouter(deps), { plugins: [new BodyLimitPlugin({ maxBodySize: CONTROL_BODY_CAP_BYTES })] });
+function doorApiNodeHandlerOf(router) {
+  const handler = new RPCHandler(router, { plugins: [new BodyLimitPlugin({ maxBodySize: CONTROL_BODY_CAP_BYTES })] });
   return {
     pathPrefix: RC_ORPC_PATH_PREFIX,
     handle: async (request7, response) => await handler.handle(request7, response, { context: { headers: request7.headers }, prefix: RC_ORPC_PATH_PREFIX })
   };
 }
-function frontDoorRcApiClient(port, ca, token) {
+function frontDoorApiLink(port, ca, token) {
   const dispatcher = new import_undici2.Agent({ connect: { ca } });
-  const link = new RPCLink({
+  return new RPCLink({
     url: `https://127.0.0.1:${String(port)}${RC_ORPC_PATH_PREFIX}`,
     headers: { authorization: `Bearer ${token}` },
     // undici's own Request and Response types and the global ones are distinct declarations of the same standard shapes (the package's bundled types sit beside @types/node's own), and its fetch refuses the global Request instance outright, so the call is rebuilt from the request's parts and the answer re-wrapped through the global constructors, never cast between the two. The request body is one bounded JSON object (the same protocol cap the handler enforces), so reading it whole costs nothing; it is the answer that streams.
@@ -70541,11 +71849,255 @@ function frontDoorRcApiClient(port, ca, token) {
       return new Response(answered.body, { status: answered.status, statusText: answered.statusText, headers: [...answered.headers] });
     }
   });
-  return createORPCClient(link);
+}
+function frontDoorRcApiClient(port, ca, token) {
+  return createORPCClient(frontDoorApiLink(port, ca, token));
+}
+
+// src/frontdoor/eventSchemas.ts
+var DOOR_EVENT_SOURCE_RC = "rc";
+var LAUNCH_EVENT_SOURCE = "launch";
+var DoorEventSchema = external_exports.strictObject({
+  source: external_exports.string().min(1),
+  /** A positive integer because the backbone's counters start at one and only ever increase. */
+  sequence: external_exports.number().int().positive(),
+  payload: external_exports.unknown()
+});
+var DoorEventSourceQuerySchema = external_exports.strictObject({
+  sources: external_exports.array(external_exports.string().min(1)).min(1).optional()
+});
+var LaunchLifecycleEventSchema = external_exports.strictObject({
+  kind: external_exports.enum(["registered", "pruned", "ended"]),
+  pid: external_exports.number().int().positive(),
+  startedAt: external_exports.number(),
+  observedAt: external_exports.number()
+});
+
+// src/frontdoor/eventsApi.ts
+function createEventsApiRouter(deps) {
+  const authed = doorApiAuth(deps.expectedToken);
+  return {
+    events: {
+      subscribe: authed.input(DoorEventSourceQuerySchema).output(eventIterator(DoorEventSchema)).handler(async function* ({ input: input2, signal }) {
+        if (input2.sources !== void 0) {
+          const live = deps.events.sources();
+          const unknown2 = input2.sources.filter((source) => !live.includes(source));
+          if (unknown2.length > 0) {
+            throw new ORPCError("NOT_FOUND", { message: `the door publishes no event source named ${unknown2.map((source) => `"${source}"`).join(", ")}; the live sources are ${live.map((source) => `"${source}"`).join(", ")}` });
+          }
+        }
+        const stream = deps.events.stream(input2.sources);
+        const ended = new Promise((resolve) => {
+          signal?.addEventListener("abort", () => {
+            resolve();
+          }, { once: true });
+        });
+        try {
+          for (; ; ) {
+            signal?.throwIfAborted();
+            const next = await Promise.race([stream.next(), ended.then(() => ({ value: void 0, done: true }))]);
+            if (next.done === true) {
+              signal?.throwIfAborted();
+              return;
+            }
+            yield withEventMeta(next.value, { id: String(next.value.sequence) });
+          }
+        } finally {
+          stream.close();
+        }
+      })
+    }
+  };
+}
+
+// src/frontdoor/controlApi.ts
+function createControlApiRouter(deps) {
+  const authed = doorApiAuth(deps.expectedToken);
+  return {
+    usage: {
+      list: authed.output(UsageListOutputSchema).handler(() => ({ snapshots: deps.usageSnapshots() })),
+      effectiveWindow: authed.input(UsageWindowsInputSchema).output(UsageWindowsOutputSchema).handler(({ input: input2 }) => {
+        const snapshot = deps.usageSnapshotOf(input2.identity);
+        if (snapshot === void 0) {
+          throw new ORPCError("NOT_FOUND", { message: `identity ${input2.identity} has no usage snapshot yet, so no quota window has been observed for it` });
+        }
+        const provider = input2.provider ?? ANTHROPIC_PROVIDER;
+        const rateLimit = snapshot.providers[provider]?.rateLimit;
+        const unified = rateLimit?.unified;
+        const now = deps.now();
+        return {
+          identity: snapshot.identity,
+          provider,
+          ...rateLimit === void 0 ? {} : { observedAt: rateLimit.observedAt },
+          ...unified?.fiveHour === void 0 ? {} : { fiveHour: effectiveWindow(unified.fiveHour, now) },
+          ...unified?.sevenDay === void 0 ? {} : { sevenDay: effectiveWindow(unified.sevenDay, now) }
+        };
+      })
+    },
+    frontdoor: {
+      status: authed.output(FrontDoorStatusOutputSchema).handler(() => deps.frontDoorStatus()),
+      sessions: authed.output(FrontDoorSessionsOutputSchema).handler(() => ({ sessions: deps.frontDoorStatus().sessions }))
+    },
+    check: {
+      // The report's own JSON shape is the contract (the same one `check --json` prints and `checkReportSchema.ts` defines), so the procedure returns exactly that conversion.
+      run: authed.input(CheckRunInputSchema).output(CheckReportJsonSchema).handler(({ input: input2 }) => checkReportToJson(deps.checkReport(input2.path, input2.identity)))
+    },
+    doctor: {
+      run: authed.output(DoctorRunOutputSchema).handler(() => deps.doctorReport())
+    }
+  };
+}
+function createDoorApiRouter(deps) {
+  return { ...createRcApiRouter(deps), ...createControlApiRouter(deps), ...createEventsApiRouter(deps) };
+}
+function createDoorApiNodeHandler(deps) {
+  return doorApiNodeHandlerOf(createDoorApiRouter(deps));
+}
+
+// src/frontdoor/eventHub.ts
+var DOOR_EVENT_BUFFER_EVENTS = 100;
+function createDoorEventHub() {
+  const sequences = /* @__PURE__ */ new Map();
+  const registered = /* @__PURE__ */ new Set();
+  const every = /* @__PURE__ */ new Set();
+  const bySource = /* @__PURE__ */ new Map();
+  const deliver = (event) => {
+    for (const listener of every) {
+      listener(event);
+    }
+    for (const listener of bySource.get(event.source) ?? []) {
+      listener(event);
+    }
+  };
+  const publish = (source, payload) => {
+    const sequence2 = (sequences.get(source) ?? 0) + 1;
+    sequences.set(source, sequence2);
+    deliver({ source, sequence: sequence2, payload });
+  };
+  const addListener = (sources, listener) => {
+    if (sources === void 0) {
+      every.add(listener);
+      return () => {
+        every.delete(listener);
+      };
+    }
+    const listenersFor = (source) => {
+      const listeners = bySource.get(source) ?? /* @__PURE__ */ new Set();
+      bySource.set(source, listeners);
+      return listeners;
+    };
+    const detachers = sources.map((source) => {
+      const listeners = listenersFor(source);
+      listeners.add(listener);
+      return () => {
+        listeners.delete(listener);
+        if (listeners.size === 0) {
+          bySource.delete(source);
+        }
+      };
+    });
+    return () => {
+      for (const detach of detachers) {
+        detach();
+      }
+    };
+  };
+  return {
+    publisher: (source) => {
+      registered.add(source);
+      return {
+        source,
+        publish: (payload) => {
+          publish(source, payload);
+        }
+      };
+    },
+    subscribe: addListener,
+    stream: (sources) => {
+      const queue = [];
+      let wake;
+      let closed = false;
+      const detach = addListener(sources, (event) => {
+        if (queue.length >= DOOR_EVENT_BUFFER_EVENTS) {
+          queue.shift();
+        }
+        queue.push(event);
+        wake?.();
+      });
+      return {
+        next: async () => {
+          for (; ; ) {
+            const event = queue.shift();
+            if (event !== void 0) {
+              return { value: event, done: false };
+            }
+            if (closed) {
+              return { value: void 0, done: true };
+            }
+            await new Promise((resolve) => {
+              wake = resolve;
+            });
+          }
+        },
+        close: () => {
+          closed = true;
+          detach();
+          wake?.();
+        }
+      };
+    },
+    sources: () => [...registered].sort()
+  };
+}
+function rcFanoutOnDoorHub(fanout, hub) {
+  const publisher = hub.publisher(DOOR_EVENT_SOURCE_RC);
+  return {
+    publish: (event) => {
+      fanout.publish(event);
+      publisher.publish(event);
+    },
+    subscribe: (session, listener) => fanout.subscribe(session, listener)
+  };
+}
+
+// src/frontdoor/launchEvents.ts
+function createLaunchEventPublisher(hub, now) {
+  const publisher = hub.publisher(LAUNCH_EVENT_SOURCE);
+  let known;
+  return {
+    observe: (sessions, pruned) => {
+      const previous = known;
+      const listed = new Map(sessions.map((session) => [session.pid, session]));
+      const prunedSet = new Set(pruned);
+      known = new Map([...listed].filter(([pid]) => !prunedSet.has(pid)));
+      if (previous === void 0) {
+        return;
+      }
+      const emit = (kind, pid, startedAt) => {
+        publisher.publish({ kind, pid, startedAt, observedAt: now() });
+      };
+      for (const pid of pruned) {
+        const session = listed.get(pid);
+        if (session !== void 0) {
+          emit("pruned", pid, session.startedAt);
+        }
+      }
+      for (const [pid, session] of previous) {
+        if (!listed.has(pid) && !prunedSet.has(pid)) {
+          emit("ended", pid, session.startedAt);
+        }
+      }
+      for (const [pid, session] of listed) {
+        if (!previous.has(pid) && !prunedSet.has(pid)) {
+          emit("registered", pid, session.startedAt);
+        }
+      }
+    }
+  };
 }
 
 // src/frontdoor/headroomHop.ts
-var http3 = __toESM(require("node:http"), 1);
+var http4 = __toESM(require("node:http"), 1);
 var HTTP_BAD_GATEWAY2 = HTTP_STATUS.badGateway;
 function responseHeaders(headers) {
   const result = {};
@@ -70599,7 +72151,7 @@ async function answerBadGateway(response, message) {
   await response.write(JSON.stringify({ type: "error", error: { type: "api_error", message } }));
   response.end();
 }
-var HOP_AGENT = new http3.Agent({ keepAlive: false });
+var HOP_AGENT = new http4.Agent({ keepAlive: false });
 async function forwardThroughHeadroom(request7, response, target) {
   const { socketPath, headers } = target;
   await new Promise((resolve) => {
@@ -70627,7 +72179,7 @@ async function forwardThroughHeadroom(request7, response, target) {
       };
       void stream();
     };
-    const hop = http3.request({ socketPath, method: request7.method, path: request7.url, headers, agent: HOP_AGENT }, onUpstreamResponse);
+    const hop = http4.request({ socketPath, method: request7.method, path: request7.url, headers, agent: HOP_AGENT }, onUpstreamResponse);
     hop.on("error", (error62) => {
       const phase = response.headersSent ? "mid-stream" : "before the response started";
       const code = "code" in error62 && typeof error62.code === "string" ? ` ${error62.code}` : "";
@@ -70816,7 +72368,7 @@ async function serveRouted(request7, deps) {
 }
 
 // src/codex/translate.ts
-var import_node_crypto11 = require("node:crypto");
+var import_node_crypto13 = require("node:crypto");
 
 // src/codex/anthropic.ts
 var TextBlockSchema = external_exports.looseObject({ type: external_exports.literal("text"), text: external_exports.string() });
@@ -70895,7 +72447,8 @@ function resolveCodexConfig(config2) {
       sonnet: overrides?.sonnet ?? CODEX_DEFAULT_TIER_MODELS.sonnet,
       haiku: overrides?.haiku ?? CODEX_DEFAULT_TIER_MODELS.haiku
     },
-    effort: config2?.effort ?? CODEX_DEFAULT_EFFORT
+    effort: config2?.effort ?? CODEX_DEFAULT_EFFORT,
+    login: config2?.login ?? CODEX_DEFAULT_LOGIN
   };
 }
 function mapModel(requested, config2) {
@@ -70928,7 +72481,7 @@ function shortToolName(name, names) {
   if (name.length <= CODEX_TOOL_NAME_LIMIT) {
     return name;
   }
-  const hash2 = (0, import_node_crypto11.createHash)("sha256").update(name).digest("hex").slice(0, TOOL_NAME_HASH_CHARS);
+  const hash2 = (0, import_node_crypto13.createHash)("sha256").update(name).digest("hex").slice(0, TOOL_NAME_HASH_CHARS);
   const shortened = `${name.slice(0, CODEX_TOOL_NAME_LIMIT - TOOL_NAME_HASH_CHARS - 1)}_${hash2}`;
   names.set(shortened, name);
   return shortened;
@@ -71204,17 +72757,17 @@ function unifiedQuotaHeaders(upstream, rejected, quotaError) {
   }
   return headers;
 }
-var MS_PER_SECOND5 = 1e3;
+var MS_PER_SECOND6 = 1e3;
 function buildUsageSnapshot(upstream, quotaError, nowMs) {
   const used7 = upstream.get("x-codex-primary-used-percent") ?? (quotaError === void 0 ? null : EXHAUSTED_PERCENT);
   const reset7 = upstream.get("x-codex-primary-reset-at") ?? (quotaError?.resets_at === void 0 ? null : String(quotaError.resets_at));
-  const sevenDay = used7 !== null && reset7 !== null ? { used_percentage: Number(used7), resets_at: new Date(Number(reset7) * MS_PER_SECOND5).toISOString() } : void 0;
+  const sevenDay = used7 !== null && reset7 !== null ? { used_percentage: Number(used7), resets_at: new Date(Number(reset7) * MS_PER_SECOND6).toISOString() } : void 0;
   let fiveHour;
   if (Number(upstream.get("x-codex-secondary-window-minutes")) > 0) {
     const used5 = upstream.get("x-codex-secondary-used-percent");
     const reset5 = upstream.get("x-codex-secondary-reset-at");
     if (used5 !== null && reset5 !== null) {
-      fiveHour = { used_percentage: Number(used5), resets_at: new Date(Number(reset5) * MS_PER_SECOND5).toISOString() };
+      fiveHour = { used_percentage: Number(used5), resets_at: new Date(Number(reset5) * MS_PER_SECOND6).toISOString() };
     }
   }
   if (sevenDay === void 0 && fiveHour === void 0) {
@@ -71431,12 +72984,13 @@ function createCodexRoute(ports) {
     }
     const body = parsed.data;
     const requestedModel = body.model ?? "";
+    const upstreamPorts = ports.upstreams[config2.login];
     const { request: upstreamRequest, toolNames } = translateRequest(body, config2);
     const started = ports.now();
     const elapsed = () => `${String(ports.now() - started)}ms`;
     let upstream;
     try {
-      upstream = await callCodex(ports.upstream, upstreamRequest, sessionIdFor(body.metadata?.user_id, ports.upstream.randomId), request7.signal);
+      upstream = await callCodex(upstreamPorts, upstreamRequest, sessionIdFor(body.metadata?.user_id, upstreamPorts.randomId), request7.signal);
     } catch (error62) {
       if (request7.signal.aborted) {
         return errorResponse(HTTP_STATUS.clientClosedRequest, "client disconnected");
@@ -71469,7 +73023,7 @@ function createCodexRoute(ports) {
       });
     }
     snapshot(void 0);
-    const relay = createRelay({ requestedModel, toolNames, fallbackId: () => `msg_${ports.upstream.randomId()}` });
+    const relay = createRelay({ requestedModel, toolNames, fallbackId: () => `msg_${upstreamPorts.randomId()}` });
     const upstreamBody = upstream.body;
     const quota = { ...quotaHeaders(upstream.headers), ...unifiedQuotaHeaders(upstream.headers, false, void 0) };
     const logCompleted = (message, usage) => {
@@ -71622,8 +73176,8 @@ function createCodexRouteMount(ports, upstreamBase, provider) {
         request7.body.resume();
         return;
       }
-      const path43 = new URL(request7.url, "http://127.0.0.1").pathname;
-      const translated = { method: request7.method, path: path43, body, signal: request7.signal };
+      const path44 = new URL(request7.url, "http://127.0.0.1").pathname;
+      const translated = { method: request7.method, path: path44, body, signal: request7.signal };
       const routed = await route(translated);
       if (request7.signal.aborted) {
         return;
@@ -71634,7 +73188,7 @@ function createCodexRouteMount(ports, upstreamBase, provider) {
 }
 
 // src/frontdoor/passthrough.ts
-var http4 = __toESM(require("node:http"), 1);
+var http5 = __toESM(require("node:http"), 1);
 var https4 = __toESM(require("node:https"), 1);
 function responseHeaders2(headers) {
   const result = {};
@@ -71657,7 +73211,7 @@ function createPassthroughRoute(name, target) {
     headroomUpstream: target.headroomUpstream,
     serve: async (request7, response) => {
       const incoming = new URL(request7.url, "http://127.0.0.1");
-      const path43 = target.stripPrefix !== void 0 && incoming.pathname.startsWith(target.stripPrefix) ? incoming.pathname.slice(target.stripPrefix.length) : incoming.pathname;
+      const path44 = target.stripPrefix !== void 0 && incoming.pathname.startsWith(target.stripPrefix) ? incoming.pathname.slice(target.stripPrefix.length) : incoming.pathname;
       const headers = forwardableHeaders(request7.headers);
       delete headers.host;
       await new Promise((resolve) => {
@@ -71665,7 +73219,7 @@ function createPassthroughRoute(name, target) {
           host: base.hostname,
           port: base.port === "" ? void 0 : Number(base.port),
           method: request7.method,
-          path: `${basePath}${path43}${incoming.search}`,
+          path: `${basePath}${path44}${incoming.search}`,
           headers,
           agent
         };
@@ -71688,7 +73242,7 @@ function createPassthroughRoute(name, target) {
           };
           void stream();
         };
-        const forward = tls2 ? https4.request(options, onUpstreamResponse) : http4.request(options, onUpstreamResponse);
+        const forward = tls2 ? https4.request(options, onUpstreamResponse) : http5.request(options, onUpstreamResponse);
         forward.on("error", (error62) => {
           if (!response.headersSent) {
             response.start(HTTP_STATUS.badGateway, { "Content-Type": "application/json" });
@@ -71714,7 +73268,7 @@ function createPassthroughRoute(name, target) {
 
 // src/frontdoor/providerRoute.ts
 function createProviderRouteResolver(deps) {
-  const isRcSelfHostPath = (path43) => path43 === "/v1/code/sessions" || path43.startsWith("/v1/code/sessions/") || path43 === "/v1/sessions" || path43.startsWith("/v1/sessions/");
+  const isRcSelfHostPath = (path44) => path44 === "/v1/code/sessions" || path44.startsWith("/v1/code/sessions/") || path44 === "/v1/sessions" || path44.startsWith("/v1/sessions/");
   const oauthRoute = createPassthroughRoute("anthropic", { baseUrl: `https://${CONNECT_INTERCEPT_HOST}:${String(HTTPS_PORT)}`, stripPrefix: void 0, headroomUpstream: void 0 });
   const passthroughByTarget = /* @__PURE__ */ new Map();
   const passthroughFor = (name, target) => {
@@ -71728,13 +73282,13 @@ function createProviderRouteResolver(deps) {
     return route;
   };
   const resolve = (request7) => {
-    const path43 = new URL(request7.url, "http://127.0.0.1").pathname;
-    const scoped = parseProviderPath(path43);
+    const path44 = new URL(request7.url, "http://127.0.0.1").pathname;
+    const scoped = parseProviderPath(path44);
     if (scoped === void 0) {
-      if (deps.rcSelfHostRoute !== void 0 && isRcSelfHostPath(path43)) {
+      if (deps.rcSelfHostRoute !== void 0 && isRcSelfHostPath(path44)) {
         return { ok: true, route: deps.rcSelfHostRoute };
       }
-      return path43.startsWith("/v1/") ? { ok: true, route: oauthRoute } : { ok: false, status: HTTP_STATUS.notFound, message: `no such endpoint: ${path43}` };
+      return path44.startsWith("/v1/") ? { ok: true, route: oauthRoute } : { ok: false, status: HTTP_STATUS.notFound, message: `no such endpoint: ${path44}` };
     }
     const { provider } = scoped;
     let definition;
@@ -71774,7 +73328,7 @@ function createProviderRouteResolver(deps) {
 }
 
 // src/frontdoor/rcCredentialStore.ts
-var import_node_path32 = __toESM(require("node:path"), 1);
+var import_node_path34 = __toESM(require("node:path"), 1);
 function isSafeSessionId(sessionId) {
   return /^[A-Za-z0-9_-]+$/.test(sessionId);
 }
@@ -71800,7 +73354,7 @@ function sequenceNumOfJson(value2) {
 }
 function createRcCredentialStore(fs19, dir) {
   fs19.mkdirPrivate(dir);
-  const fileFor = (sessionId) => import_node_path32.default.join(dir, `${sessionId}.json`);
+  const fileFor = (sessionId) => import_node_path34.default.join(dir, `${sessionId}.json`);
   const readParsed = (sessionId) => {
     const raw = fs19.readFileUtf8(fileFor(sessionId));
     if (raw === void 0) {
@@ -71866,7 +73420,7 @@ var RC_SESSION_ID_PREFIX2 = "cse_";
 var RC_SELF_HOST_API_BASE_URL = "https://api.anthropic.com";
 var RC_SELF_HOST_OAUTH_HOST = "platform.claude.com";
 var HTTP_CONFLICT = 409;
-var MS_PER_SECOND6 = 1e3;
+var MS_PER_SECOND7 = 1e3;
 var HTTP_SERVICE_UNAVAILABLE = 503;
 var RC_SELF_HOST_WORKER_JWT_TTL_SECONDS = 46800;
 var RC_SELF_HOST_OAUTH_TOKEN_TTL_SECONDS = 3600;
@@ -71941,7 +73495,7 @@ function parseJsonObject2(body) {
 function mintWorkerJwt(randomToken, issuedAt) {
   const encode3 = (value2) => Buffer.from(JSON.stringify(value2), "utf8").toString("base64url");
   const header = encode3({ alg: "HS256", typ: "JWT" });
-  const payload = encode3({ exp: Math.floor((issuedAt + RC_SELF_HOST_WORKER_JWT_TTL_SECONDS * MS_PER_SECOND6) / MS_PER_SECOND6), iat: Math.floor(issuedAt / MS_PER_SECOND6) });
+  const payload = encode3({ exp: Math.floor((issuedAt + RC_SELF_HOST_WORKER_JWT_TTL_SECONDS * MS_PER_SECOND7) / MS_PER_SECOND7), iat: Math.floor(issuedAt / MS_PER_SECOND7) });
   return `${header}.${payload}.${Buffer.from(randomToken(), "utf8").toString("base64url")}`;
 }
 function growthBookFeatures() {
@@ -72392,7 +73946,7 @@ data: ${JSON.stringify(envelope)}
       }
       if (method === "POST" && pathname.startsWith("/api/eval/")) {
         await readBody3(request7, CONTROL_BODY_CAP_BYTES);
-        answerServerJson(response, HTTP_STATUS.ok, { features: growthBookFeatures(), dateUpdated: Math.floor(deps.now() / MS_PER_SECOND6) });
+        answerServerJson(response, HTTP_STATUS.ok, { features: growthBookFeatures(), dateUpdated: Math.floor(deps.now() / MS_PER_SECOND7) });
         return true;
       }
       if (method === "GET" && pathname === "/api/oauth/profile") {
@@ -72450,7 +74004,7 @@ data: ${JSON.stringify(envelope)}
 }
 
 // src/frontdoor/rcSelfHostMint.ts
-var import_node_path33 = __toESM(require("node:path"), 1);
+var import_node_path35 = __toESM(require("node:path"), 1);
 var CREDENTIALS_FILE = ".credentials.json";
 var CLAUDE_JSON2 = ".claude.json";
 var RC_SELF_HOST_RECORD_DIR = "rc-selfhost";
@@ -72474,7 +74028,7 @@ function readJsonObject(fs19, file2) {
   return isRecord6(parsed) ? parsed : void 0;
 }
 function readRcSelfHostRecord(fs19, frontdoorDir) {
-  const parsed = readJsonObject(fs19, import_node_path33.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
+  const parsed = readJsonObject(fs19, import_node_path35.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
   if (parsed === void 0) {
     return void 0;
   }
@@ -72488,11 +74042,11 @@ function mintRcSelfHostCredential(deps) {
   if (!isIdentityName(deps.identity)) {
     throw new Error(`"${deps.identity}" is not a valid identity name.`);
   }
-  const identityDir = import_node_path33.default.join(deps.identitiesDir, deps.identity);
-  const credentialsFile = import_node_path33.default.join(identityDir, CREDENTIALS_FILE);
-  const claudeJsonFile = import_node_path33.default.join(identityDir, CLAUDE_JSON2);
-  const recordDir = import_node_path33.default.join(deps.frontdoorDir, RC_SELF_HOST_RECORD_DIR);
-  const recordFile = import_node_path33.default.join(recordDir, RC_SELF_HOST_RECORD_FILE);
+  const identityDir = import_node_path35.default.join(deps.identitiesDir, deps.identity);
+  const credentialsFile = import_node_path35.default.join(identityDir, CREDENTIALS_FILE);
+  const claudeJsonFile = import_node_path35.default.join(identityDir, CLAUDE_JSON2);
+  const recordDir = import_node_path35.default.join(deps.frontdoorDir, RC_SELF_HOST_RECORD_DIR);
+  const recordFile = import_node_path35.default.join(recordDir, RC_SELF_HOST_RECORD_FILE);
   const previousRecord = readRcSelfHostRecord(deps.fs, deps.frontdoorDir);
   const existingCredentials = readJsonObject(deps.fs, credentialsFile);
   const existingOauth = isRecord6(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
@@ -72508,7 +74062,7 @@ function mintRcSelfHostCredential(deps) {
   const organizationUuid = deps.newUuid();
   const accountUuid = deps.newUuid();
   const mintedAt = new Date(deps.now()).toISOString();
-  deps.fs.mkdirPrivate(import_node_path33.default.dirname(credentialsFile));
+  deps.fs.mkdirPrivate(import_node_path35.default.dirname(credentialsFile));
   deps.fs.writeFilePrivate(credentialsFile, `${JSON.stringify({ ...existingCredentials, claudeAiOauth: { accessToken, refreshToken, expiresAt: null, scopes: [...RC_SELF_HOST_SCOPE_LIST], subscriptionType: SELF_HOST_SUBSCRIPTION_TYPE, rateLimitTier: null } }, null, 2)}
 `);
   const claudeJson = readJsonObject(deps.fs, claudeJsonFile) ?? {};
@@ -72820,6 +74374,59 @@ function createRcStreamHub(deps) {
   };
 }
 
+// src/frontdoor/status.ts
+function headroomSocketTarget(fsPort, trust, paths) {
+  const socketPath = readHeadroomState(fsPort, paths.headroomStateFile)?.socketPath;
+  return socketPath === void 0 ? void 0 : verifyHeadroomSocket(socketPath, trust);
+}
+function collectFrontDoorStatus(fsPort, socketTrust, paths, isRunning) {
+  const state = readFrontDoorState(fsPort, paths.frontdoorStateFile) ?? {};
+  return {
+    state,
+    supervisorAlive: state.supervisorPid !== void 0 && isRunning(state.supervisorPid),
+    sessions: listFrontDoorSessions(fsPort, paths.frontdoorSessionsDir).map((session) => ({ ...session, alive: isRunning(session.pid) })),
+    headroomSocket: headroomSocketTarget(fsPort, socketTrust, paths),
+    logPath: paths.frontdoorLogPath,
+    logExists: fsPort.readFileUtf8(paths.frontdoorLogPath) !== void 0
+  };
+}
+function formatFrontDoorStatus(status, caCertPath) {
+  const lines = [];
+  if (status.state.supervisorPid === void 0) {
+    lines.push("supervisor: not running");
+  } else {
+    lines.push(`supervisor: pid ${String(status.state.supervisorPid)} (${status.supervisorAlive ? "alive" : "NOT running"})`);
+  }
+  if (status.state.port === void 0) {
+    lines.push(`front door: not listening${status.state.lastPort === void 0 ? "" : ` (next start on 127.0.0.1:${String(status.state.lastPort)})`}`);
+  } else {
+    lines.push(`front door: listening on https://127.0.0.1:${String(status.state.port)}, routing /providers/<name> requests`);
+  }
+  if (status.state.connectPort === void 0) {
+    lines.push(`connect surface: not listening${status.state.lastConnectPort === void 0 ? "" : ` (next start on 127.0.0.1:${String(status.state.lastConnectPort)})`}`);
+  } else {
+    lines.push(`connect surface: listening on 127.0.0.1:${String(status.state.connectPort)}, CA ${caCertPath}`);
+  }
+  if (status.headroomSocket === void 0) {
+    lines.push("headroom hop: the daemon is not serving (sessions asking for headroom fail until it is up)");
+  } else if (status.headroomSocket.refused === void 0) {
+    lines.push(`headroom hop: daemon on unix socket ${status.headroomSocket.socketPath}`);
+  } else {
+    lines.push(`headroom hop: REFUSING the daemon's socket (sessions asking for headroom fail until it is fixed): ${status.headroomSocket.refused}`);
+  }
+  if (status.sessions.length === 0) {
+    lines.push("sessions: none");
+  } else {
+    const pids = status.sessions.map((session) => `${String(session.pid)}${session.alive ? "" : " (dead)"}`);
+    lines.push(`sessions: ${String(status.sessions.length)} registered (${pids.join(", ")})`);
+  }
+  if (status.state.lastError !== void 0) {
+    lines.push(`last error: ${status.state.lastError}`);
+  }
+  lines.push(`daemon log: ${status.logPath}${status.logExists ? "" : " (not created yet)"}`);
+  return lines;
+}
+
 // src/usage/providerQuota.ts
 var ProviderQuotaError = class extends Error {
   constructor(source, detail) {
@@ -72827,7 +74434,7 @@ var ProviderQuotaError = class extends Error {
     this.name = "ProviderQuotaError";
   }
 };
-var MS_PER_SECOND7 = 1e3;
+var MS_PER_SECOND8 = 1e3;
 var SECONDS_PER_HOUR = 3600;
 var HOURS_PER_DAY3 = 24;
 var DAYS_PER_MONTH = 30;
@@ -72839,8 +74446,8 @@ var ZAI_QUOTA_URL = `https://${ZAI_HOST}/api/monitor/usage/quota/limit`;
 var ZAI_UNIT_HOURS = 3;
 var ZAI_UNIT_MONTHS = 5;
 var ZAI_UNIT_MS = /* @__PURE__ */ new Map([
-  [ZAI_UNIT_HOURS, SECONDS_PER_HOUR * MS_PER_SECOND7],
-  [ZAI_UNIT_MONTHS, DAYS_PER_MONTH * HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND7]
+  [ZAI_UNIT_HOURS, SECONDS_PER_HOUR * MS_PER_SECOND8],
+  [ZAI_UNIT_MONTHS, DAYS_PER_MONTH * HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND8]
 ]);
 var ZAI_MEASURES = { TOKENS_LIMIT: "tokens", TIME_LIMIT: "tool-calls" };
 var ZaiLimitSchema = external_exports.object({
@@ -72873,8 +74480,8 @@ function zaiWindow(limit) {
 var zaiQuotaAdapter = {
   source: ZAI_SOURCE,
   matches: (baseUrl) => URL.canParse(baseUrl) && new URL(baseUrl).hostname === ZAI_HOST,
-  fetch: async (apiKey, http6, signal, nowMs) => {
-    const response = await http6(ZAI_QUOTA_URL, { authorization: apiKey, accept: "application/json" }, signal);
+  fetch: async (apiKey, http7, signal, nowMs) => {
+    const response = await http7(ZAI_QUOTA_URL, { authorization: apiKey, accept: "application/json" }, signal);
     if (response.status !== HTTP_OK) {
       throw new ProviderQuotaError(ZAI_SOURCE, `answered HTTP ${String(response.status)}`);
     }
@@ -72904,7 +74511,7 @@ var OPENROUTER_HOST = "openrouter.ai";
 var OPENROUTER_KEY_URL = `https://${OPENROUTER_HOST}/api/v1/key`;
 var OPENROUTER_CREDITS_URL = `https://${OPENROUTER_HOST}/api/v1/credits`;
 var HTTP_FORBIDDEN = 403;
-var MS_PER_DAY2 = HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND7;
+var MS_PER_DAY2 = HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND8;
 var OpenRouterKeySchema = external_exports.object({
   data: external_exports.object({
     limit: external_exports.number().nonnegative().nullable(),
@@ -72915,8 +74522,8 @@ var OpenRouterKeySchema = external_exports.object({
   })
 });
 var OpenRouterCreditsSchema = external_exports.object({ data: external_exports.object({ total_credits: external_exports.number().nonnegative(), total_usage: external_exports.number().nonnegative() }) });
-async function openRouterGet(url2, schema, apiKey, http6, signal) {
-  const response = await http6(url2, { authorization: `Bearer ${apiKey}`, accept: "application/json" }, signal);
+async function openRouterGet(url2, schema, apiKey, http7, signal) {
+  const response = await http7(url2, { authorization: `Bearer ${apiKey}`, accept: "application/json" }, signal);
   if (response.status === HTTP_FORBIDDEN) {
     return "forbidden";
   }
@@ -72941,12 +74548,12 @@ function nextUtcMidnight(nowMs) {
 var openRouterQuotaAdapter = {
   source: OPENROUTER_SOURCE,
   matches: (baseUrl) => URL.canParse(baseUrl) && new URL(baseUrl).hostname === OPENROUTER_HOST,
-  fetch: async (apiKey, http6, signal, nowMs) => {
-    const key = await openRouterGet(OPENROUTER_KEY_URL, OpenRouterKeySchema, apiKey, http6, signal);
+  fetch: async (apiKey, http7, signal, nowMs) => {
+    const key = await openRouterGet(OPENROUTER_KEY_URL, OpenRouterKeySchema, apiKey, http7, signal);
     if (key === "forbidden") {
       throw new ProviderQuotaError(OPENROUTER_SOURCE, "/api/v1/key refused the key (HTTP 403)");
     }
-    const credits = await openRouterGet(OPENROUTER_CREDITS_URL, OpenRouterCreditsSchema, apiKey, http6, signal);
+    const credits = await openRouterGet(OPENROUTER_CREDITS_URL, OpenRouterCreditsSchema, apiKey, http7, signal);
     const { limit, limit_remaining: limitRemaining, limit_reset: limitReset, free_model_daily_requests: free, is_free_tier: isFreeTier } = key.data;
     const windows = [];
     if (limit !== null && limit > 0) {
@@ -73103,15 +74710,11 @@ function createRealQuotaRefresher(params) {
 
 // src/frontdoor/commands.ts
 function appendLog(paths, line) {
-  import_node_fs12.default.mkdirSync(paths.logsDir, { recursive: true });
-  import_node_fs12.default.appendFileSync(paths.frontdoorLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+  import_node_fs13.default.mkdirSync(paths.logsDir, { recursive: true });
+  import_node_fs13.default.appendFileSync(paths.frontdoorLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
 `);
 }
 var MINTED_TOKEN_RANDOM_BYTES = 32;
-function headroomSocketTarget(fsPort, trust, paths) {
-  const socketPath = readHeadroomState(fsPort, paths.headroomStateFile)?.socketPath;
-  return socketPath === void 0 ? void 0 : verifyHeadroomSocket(socketPath, trust);
-}
 function rcObservingResolver(resolve, tracker, hub) {
   return async (request7) => {
     const resolution = await resolve(request7);
@@ -73126,7 +74729,7 @@ function realFrontDoorSupervisorPorts(paths) {
   };
   let directPort = 0;
   const rcSelfHost = rcSelfHostFromEnv(process.env);
-  const codexPorts = createCodexRoutePorts(log);
+  const codexPorts = createCodexRoutePorts(log, paths.chatgptSignInFile);
   let ca;
   const loadCa = () => {
     ca ??= ensureCa(realConnectCertStore(paths), () => generateCa(/* @__PURE__ */ new Date()));
@@ -73143,14 +74746,15 @@ function realFrontDoorSupervisorPorts(paths) {
   };
   const rcSelfHostSurface = rcSelfHost ? createRcSelfHostSurface({
     now: () => Date.now(),
-    newUuid: import_node_crypto12.randomUUID,
-    randomToken: () => (0, import_node_crypto12.randomBytes)(MINTED_TOKEN_RANDOM_BYTES).toString("base64url"),
+    newUuid: import_node_crypto14.randomUUID,
+    randomToken: () => (0, import_node_crypto14.randomBytes)(MINTED_TOKEN_RANDOM_BYTES).toString("base64url"),
     credentialRecord: () => readRcSelfHostRecord(realFarmFs, paths.frontdoorDir),
     log
   }) : void 0;
   const rcCredentialStore = createRcCredentialStore(realFarmFs, paths.frontdoorRcCredentialsDir);
   const rcTracker = createRcSessionTracker({ now: () => Date.now(), idleMs: RC_IDLE_EXPIRY_MS, credentialStore: rcCredentialStore });
-  const rcFanout = createRcEventFanout();
+  const doorEvents = createDoorEventHub();
+  const rcFanout = rcFanoutOnDoorHub(createRcEventFanout(), doorEvents);
   const rcHub = createRcStreamHub({
     now: () => Date.now(),
     credentialOf: rcTracker.credentialOf,
@@ -73161,7 +74765,7 @@ function realFrontDoorSupervisorPorts(paths) {
     saveSequenceNum: rcCredentialStore.writeCursor,
     dial: rcSelfHost ? lateRcStreamDial(rcSelfHostDialTarget) : realRcStreamDial(),
     fanout: rcFanout,
-    newClientId: import_node_crypto12.randomUUID,
+    newClientId: import_node_crypto14.randomUUID,
     backoffMs: RC_STREAM_BACKOFF_MS,
     sleep: async (ms) => {
       await new Promise((resolve) => {
@@ -73172,7 +74776,7 @@ function realFrontDoorSupervisorPorts(paths) {
       appendLog(paths, `frontdoor ${String(process.pid)}: ${line}`);
     }
   });
-  const rcControlToken = (0, import_node_crypto12.randomUUID)();
+  const rcControlToken = (0, import_node_crypto14.randomUUID)();
   const resolveRoute = rcObservingResolver(
     createProviderRouteResolver({ fs: realFsPort, providersDir: paths.providersDir, codexPorts, directPort: () => directPort, ...rcSelfHostSurface === void 0 ? {} : { rcSelfHostRoute: rcSelfHostSurface.route } }),
     rcTracker,
@@ -73203,8 +74807,8 @@ function realFrontDoorSupervisorPorts(paths) {
     now: () => Date.now(),
     headroomSocket: () => headroomSocketTarget(realFarmFs, realHeadroomSocketTrust, paths),
     // The per-generation capability the direct listener demands: held only in this process's memory, so a loopback process that discovers the direct port still cannot use it.
-    hopSecret: (0, import_node_crypto12.randomUUID)(),
-    custody: createCredentialCustody(() => (0, import_node_crypto12.randomUUID)()),
+    hopSecret: (0, import_node_crypto14.randomUUID)(),
+    custody: createCredentialCustody(() => (0, import_node_crypto14.randomUUID)()),
     log
   });
   const onListenerError = (name) => (error62) => {
@@ -73225,12 +74829,20 @@ function realFrontDoorSupervisorPorts(paths) {
     startProviderListener: async (preferredPort) => {
       const authority = loadCa();
       const rcDial = rcSelfHost ? lateRcEventDial(rcSelfHostDialTarget) : realRcEventDial();
-      const rcInject = async (sessionId, text2) => await injectRcUserMessage({ credentialOf: rcTracker.credentialOf, noteSequenceNums: rcTracker.noteSequenceNums, dial: rcDial, newUuid: import_node_crypto12.randomUUID }, sessionId, text2);
+      const rcInject = async (sessionId, text2) => await injectRcUserMessage({ credentialOf: rcTracker.credentialOf, noteSequenceNums: rcTracker.noteSequenceNums, dial: rcDial, newUuid: import_node_crypto14.randomUUID }, sessionId, text2);
       const rcAnswer = async (sessionId, requestId, decision) => await answerRcControlRequest({ credentialOf: rcTracker.credentialOf, pendingOf: (id) => rcTracker.pendingOf(id), completePending: rcTracker.completePending, noteSequenceNums: rcTracker.noteSequenceNums, dial: rcDial }, sessionId, requestId, decision);
-      const rcControlRequestDeps = { credentialOf: rcTracker.credentialOf, noteSequenceNums: rcTracker.noteSequenceNums, dial: rcDial, newUuid: import_node_crypto12.randomUUID };
+      const rcControlRequestDeps = { credentialOf: rcTracker.credentialOf, noteSequenceNums: rcTracker.noteSequenceNums, dial: rcDial, newUuid: import_node_crypto14.randomUUID };
       const rcInterrupt = async (sessionId) => await interruptRcSession(rcControlRequestDeps, sessionId);
       const rcSetModel = async (sessionId, model) => await setRcSessionModel(rcControlRequestDeps, sessionId, model);
       const rcSetPermissionMode = async (sessionId, mode) => await setRcSessionPermissionMode(rcControlRequestDeps, sessionId, mode);
+      const controlDeps = {
+        usageSnapshots: () => listUsageSnapshots(realFarmFs, paths.usageSnapshotsDir),
+        usageSnapshotOf: (identity) => readUsageSnapshot(realFarmFs, paths.usageSnapshotsDir, identity),
+        now: () => Date.now(),
+        frontDoorStatus: () => collectFrontDoorStatus(realFarmFs, realHeadroomSocketTrust, paths, realIsProcessRunning),
+        checkReport: (target, identity) => collectCheckReport({ paths, cwd: target, ...identity === void 0 ? {} : { identity }, env: process.env }),
+        doctorReport: () => collectDoctorReport({ paths, env: process.env })
+      };
       realFarmFs.mkdirp(paths.frontdoorDir);
       realFarmFs.writeFilePrivate(paths.frontdoorControlTokenFile, `${rcControlToken}
 `);
@@ -73241,7 +74853,20 @@ function realFrontDoorSupervisorPorts(paths) {
         log,
         mintLeaf(authority, LOOPBACK_LEAF_NAMES, /* @__PURE__ */ new Date()),
         createRcControlHandler({ expectedToken: rcControlToken, list: rcTracker.list, statusOf: rcTracker.statusOf, pendingOf: rcTracker.pendingOf, inject: rcInject, answer: rcAnswer, interrupt: rcInterrupt, setModel: rcSetModel, setPermissionMode: rcSetPermissionMode }),
-        createRcApiNodeHandler({ expectedToken: rcControlToken, list: rcTracker.list, statusOf: rcTracker.statusOf, pendingOf: rcTracker.pendingOf, inject: rcInject, answer: rcAnswer, interrupt: rcInterrupt, setModel: rcSetModel, setPermissionMode: rcSetPermissionMode, fanout: rcFanout })
+        createDoorApiNodeHandler({
+          expectedToken: rcControlToken,
+          list: rcTracker.list,
+          statusOf: rcTracker.statusOf,
+          pendingOf: rcTracker.pendingOf,
+          inject: rcInject,
+          answer: rcAnswer,
+          interrupt: rcInterrupt,
+          setModel: rcSetModel,
+          setPermissionMode: rcSetPermissionMode,
+          fanout: rcFanout,
+          ...controlDeps,
+          events: doorEvents
+        })
       );
       const handle = await listenFrontDoor(server, { ...preferredPort === void 0 ? {} : { preferredPort }, ca: authority.certPem, onError: onListenerError("provider") });
       return {
@@ -73254,14 +74879,14 @@ function realFrontDoorSupervisorPorts(paths) {
     },
     startConnectListener: async (preferredPort) => {
       const wantedTransparentPort = process.env.AGENT_SHIM_TRANSPARENT_SURFACE === void 0 ? void 0 : Number(process.env.AGENT_SHIM_TRANSPARENT_SURFACE);
-      const transparentCapability = wantedTransparentPort === void 0 || Number.isNaN(wantedTransparentPort) ? void 0 : (0, import_node_crypto12.randomUUID)();
+      const transparentCapability = wantedTransparentPort === void 0 || Number.isNaN(wantedTransparentPort) ? void 0 : (0, import_node_crypto14.randomUUID)();
       if (transparentCapability !== void 0) {
         writeFrontDoorSession(realFarmFs, paths.frontdoorSessionsDir, { pid: process.pid, startedAt: Date.now(), token: transparentCapability });
       }
       const leafFor = createLeafCache(loadCa(), () => /* @__PURE__ */ new Date());
       const capture = captureFromEnv(process.env, paths.logsDir);
       if (capture !== void 0) {
-        log(`capture enabled, recording CONNECT targets and piped exchanges to ${import_node_path34.default.join(paths.logsDir, "frontdoor-capture.jsonl")}`);
+        log(`capture enabled, recording CONNECT targets and piped exchanges to ${import_node_path36.default.join(paths.logsDir, "frontdoor-capture.jsonl")}`);
       }
       if (rcSelfHostSurface !== void 0) {
         log("self-hosted Remote Control surface on: the door serves the CCR session family itself, and its own client-half dials its own transparent surface");
@@ -73327,58 +74952,13 @@ function realFrontDoorSupervisorPorts(paths) {
       return { port: handle.port, close: handle.close };
     },
     closeRcStreamHub: rcHub.close,
+    // The launch lifecycle publisher over the same backbone the typed API serves: the tick's registry facts go in here, and the door's own register, prune and end moments come out as source-tagged events.
+    observeLaunchRegistry: createLaunchEventPublisher(doorEvents, () => Date.now()).observe,
     log: (line) => {
       appendLog(paths, line);
     }
   };
 }
-function collectFrontDoorStatus(fsPort, socketTrust, paths, isRunning) {
-  const state = readFrontDoorState(fsPort, paths.frontdoorStateFile) ?? {};
-  return {
-    state,
-    supervisorAlive: state.supervisorPid !== void 0 && isRunning(state.supervisorPid),
-    sessions: listFrontDoorSessions(fsPort, paths.frontdoorSessionsDir).map((session) => ({ ...session, alive: isRunning(session.pid) })),
-    headroomSocket: headroomSocketTarget(fsPort, socketTrust, paths),
-    logPath: paths.frontdoorLogPath,
-    logExists: fsPort.readFileUtf8(paths.frontdoorLogPath) !== void 0
-  };
-}
-function formatFrontDoorStatus(status, caCertPath) {
-  const lines = [];
-  if (status.state.supervisorPid === void 0) {
-    lines.push("supervisor: not running");
-  } else {
-    lines.push(`supervisor: pid ${String(status.state.supervisorPid)} (${status.supervisorAlive ? "alive" : "NOT running"})`);
-  }
-  if (status.state.port === void 0) {
-    lines.push(`front door: not listening${status.state.lastPort === void 0 ? "" : ` (next start on 127.0.0.1:${String(status.state.lastPort)})`}`);
-  } else {
-    lines.push(`front door: listening on https://127.0.0.1:${String(status.state.port)}, routing /providers/<name> requests`);
-  }
-  if (status.state.connectPort === void 0) {
-    lines.push(`connect surface: not listening${status.state.lastConnectPort === void 0 ? "" : ` (next start on 127.0.0.1:${String(status.state.lastConnectPort)})`}`);
-  } else {
-    lines.push(`connect surface: listening on 127.0.0.1:${String(status.state.connectPort)}, CA ${caCertPath}`);
-  }
-  if (status.headroomSocket === void 0) {
-    lines.push("headroom hop: the daemon is not serving (sessions asking for headroom fail until it is up)");
-  } else if (status.headroomSocket.refused === void 0) {
-    lines.push(`headroom hop: daemon on unix socket ${status.headroomSocket.socketPath}`);
-  } else {
-    lines.push(`headroom hop: REFUSING the daemon's socket (sessions asking for headroom fail until it is fixed): ${status.headroomSocket.refused}`);
-  }
-  if (status.sessions.length === 0) {
-    lines.push("sessions: none");
-  } else {
-    const pids = status.sessions.map((session) => `${String(session.pid)}${session.alive ? "" : " (dead)"}`);
-    lines.push(`sessions: ${String(status.sessions.length)} registered (${pids.join(", ")})`);
-  }
-  if (status.state.lastError !== void 0) {
-    lines.push(`last error: ${status.state.lastError}`);
-  }
-  lines.push(`daemon log: ${status.logPath}${status.logExists ? "" : " (not created yet)"}`);
-  return lines;
-}
 function formatRcSessionList(sessions) {
   if (sessions.length === 0) {
     return ["no Remote Control sessions observed"];
@@ -73644,8 +75224,8 @@ function registerFrontDoorCommand(program2, deps) {
         identitiesDir: paths.identitiesDir,
         frontdoorDir: paths.frontdoorDir,
         identity,
-        newUuid: import_node_crypto12.randomUUID,
-        randomToken: () => (0, import_node_crypto12.randomBytes)(MINTED_TOKEN_RANDOM_BYTES).toString("base64url"),
+        newUuid: import_node_crypto14.randomUUID,
+        randomToken: () => (0, import_node_crypto14.randomBytes)(MINTED_TOKEN_RANDOM_BYTES).toString("base64url"),
         force: options.force === true,
         now: () => Date.now()
       });
@@ -73959,19 +75539,19 @@ function registerCompletionCommand(program2) {
 }
 
 // src/credentialCommand.ts
-var import_node_child_process4 = require("node:child_process");
+var import_node_child_process5 = require("node:child_process");
 
 // src/identityToken.ts
-var import_node_fs13 = __toESM(require("node:fs"), 1);
-var import_node_path35 = __toESM(require("node:path"), 1);
+var import_node_fs14 = __toESM(require("node:fs"), 1);
+var import_node_path37 = __toESM(require("node:path"), 1);
 var TOKEN_FILE_MODE = 384;
 var TOKEN_DIR_MODE = 448;
 var OAUTH_TOKEN_RE = /^sk-ant-oat\d+-[A-Za-z0-9_-]+$/;
 function identityTokenDir(paths) {
-  return import_node_path35.default.join(paths.root, "credentials");
+  return import_node_path37.default.join(paths.root, "credentials");
 }
 function identityTokenPath(paths, identityName) {
-  return import_node_path35.default.join(identityTokenDir(paths), `${identityName}.token`);
+  return import_node_path37.default.join(identityTokenDir(paths), `${identityName}.token`);
 }
 function storeIdentityToken(paths, identityName, raw) {
   const token = raw.trim();
@@ -73979,13 +75559,13 @@ function storeIdentityToken(paths, identityName, raw) {
     throw new UsageError("That is not a claude setup-token token (expected it to start with sk-ant-oat). Run `claude setup-token` and pass its token on standard input.");
   }
   const dir = identityTokenDir(paths);
-  import_node_fs13.default.mkdirSync(dir, { recursive: true, mode: TOKEN_DIR_MODE });
-  import_node_fs13.default.chmodSync(dir, TOKEN_DIR_MODE);
+  import_node_fs14.default.mkdirSync(dir, { recursive: true, mode: TOKEN_DIR_MODE });
+  import_node_fs14.default.chmodSync(dir, TOKEN_DIR_MODE);
   const target = identityTokenPath(paths, identityName);
-  const temp = import_node_path35.default.join(dir, `.${identityName}.${String(process.pid)}.tmp`);
-  import_node_fs13.default.writeFileSync(temp, `${token}
+  const temp = import_node_path37.default.join(dir, `.${identityName}.${String(process.pid)}.tmp`);
+  import_node_fs14.default.writeFileSync(temp, `${token}
 `, { mode: TOKEN_FILE_MODE });
-  import_node_fs13.default.renameSync(temp, target);
+  import_node_fs14.default.renameSync(temp, target);
   return target;
 }
 
@@ -74011,7 +75591,7 @@ function realCommandPorts(deps) {
     cache: createRealCredentialCache(deps.paths.root),
     platform: process.platform,
     now: () => Date.now(),
-    ssh: (host, remoteCommand, input2) => (0, import_node_child_process4.spawnSync)("ssh", ["--", host, remoteCommand], { input: input2, stdio: ["pipe", "inherit", "inherit"] }).status
+    ssh: (host, remoteCommand, input2) => (0, import_node_child_process5.spawnSync)("ssh", ["--", host, remoteCommand], { input: input2, stdio: ["pipe", "inherit", "inherit"] }).status
   };
 }
 var REMOTE_ROOT_SCRIPT = 'root="${AGENT_SHIM_HOME:-${CLAUDE_USE_HOME:-}}"; if [ -z "$root" ]; then if [ ! -d "$HOME/.agent-shim" ] && [ -d "$HOME/.claude-use" ]; then root="$HOME/.claude-use"; else root="$HOME/.agent-shim"; fi; fi';
@@ -74119,509 +75699,6 @@ function subjectName(positional, provider) {
   return name;
 }
 
-// src/doctorReport.ts
-var import_node_fs14 = __toESM(require("node:fs"), 1);
-var import_node_path36 = __toESM(require("node:path"), 1);
-function refinePathShadow(status, ownExecutablePath, realpath) {
-  if (status.status !== "shadowed") {
-    return status;
-  }
-  return realpath(status.by) === realpath(ownExecutablePath) ? { status: "ok" } : status;
-}
-function validateJson(schema, input2) {
-  if (input2.raw === void 0) {
-    return { ok: false, message: `${input2.path} is missing.` };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(input2.raw);
-  } catch (error62) {
-    return { ok: false, message: `${input2.path} is not valid JSON: ${error62 instanceof Error ? error62.message : String(error62)}` };
-  }
-  const result = schema.safeParse(parsed);
-  if (!result.success) {
-    return { ok: false, message: new ConfigValidationError(input2.path, result.error.issues).message };
-  }
-  return { ok: true, data: result.data };
-}
-function pushPathResolution(push, resolution) {
-  const ownDir = import_node_path36.default.dirname(resolution.ownExecutablePath);
-  switch (resolution.agentShim.status) {
-    case "ok":
-      push("path-resolution", "pass", `\`agent-shim\` on PATH resolves to this running executable, ${resolution.ownExecutablePath}.`, "agent-shim");
-      break;
-    case "not-on-path":
-      push(
-        "path-resolution",
-        "warn",
-        `${ownDir} is not on PATH, so a bare \`agent-shim\` does not reach ${resolution.ownExecutablePath}. Add it to PATH, or keep invoking this executable by its full path.`,
-        "agent-shim"
-      );
-      break;
-    case "shadowed":
-      push(
-        "path-resolution",
-        "fail",
-        `\`agent-shim\` on PATH resolves to ${resolution.agentShim.by}, not this running executable, ${resolution.ownExecutablePath}. Every command you type runs that one instead, at whatever version it happens to be \u2014 including the checks in this report, which describe this executable. Remove ${resolution.agentShim.by}, repoint it at ${resolution.ownExecutablePath}, or put ${ownDir} ahead of it on PATH.`,
-        "agent-shim"
-      );
-      break;
-  }
-  if (resolution.claude === void 0) {
-    return;
-  }
-  switch (resolution.claude.status) {
-    case "ok":
-      push("path-resolution", "pass", "`claude` on PATH resolves to the enabled shim.", "claude");
-      break;
-    case "not-on-path":
-      push("path-resolution", "warn", "The enabled `claude` shim's directory is not on PATH \u2014 add it, or use `agent-shim run` instead.", "claude");
-      break;
-    case "shadowed":
-      push(
-        "path-resolution",
-        "warn",
-        `\`claude\` on PATH resolves to ${resolution.claude.by}, not the enabled shim. Put the shim's directory ahead of it on PATH, or run \`agent-shim shim disable\` if you meant to launch that one directly.`,
-        "claude"
-      );
-      break;
-  }
-}
-function cacheClause(cacheEnv, owner, block2) {
-  if (cacheEnv === void 0 || block2.cache === void 0) {
-    return { text: "", unreadable: false };
-  }
-  const state = describeCachedCredential({ port: cacheEnv.port, platform: cacheEnv.platform, owner, cache: block2.cache, nowMs: cacheEnv.now() });
-  return { text: `; ${formatCachedCredentialState(state)}`, unreadable: state.status === "unreadable" };
-}
-function pushProvider(push, entry, cacheEnv) {
-  if (entry.raw === void 0) {
-    push("provider", "fail", `${entry.path} is missing.`, entry.name);
-    return;
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(entry.raw);
-  } catch (error62) {
-    push("provider", "fail", `${entry.path} is not valid JSON: ${error62 instanceof Error ? error62.message : String(error62)}`, entry.name);
-    return;
-  }
-  const conversion = legacyProviderConversion(parsed);
-  if (conversion !== void 0) {
-    push("provider", "fail", new LegacyProviderFileError(entry.path, conversion).message, entry.name);
-    return;
-  }
-  const validated2 = ProviderSchema.safeParse(parsed);
-  if (!validated2.success) {
-    push("provider", "fail", new ConfigValidationError(entry.path, validated2.error.issues).message, entry.name);
-    return;
-  }
-  const cache = cacheClause(cacheEnv, `provider ${entry.name}`, validated2.data.credential);
-  push("provider", cache.unreadable ? "fail" : "pass", `${entry.name} is valid (${describeProviderEndpoint(validated2.data)}, credential ${describeCredential(validated2.data.credential)})${cache.text}.`, entry.name);
-  if (validated2.data.env?.ENABLE_TOOL_SEARCH === void 0) {
-    push("provider", "warn", `${entry.name} does not set ENABLE_TOOL_SEARCH: a session on this provider loads MCP tools upfront rather than deferring them, because its base URL is the front door, which Claude Code treats as a non-first-party host. Set ENABLE_TOOL_SEARCH in the provider's env block to restore deferred loading, when the upstream backend supports the tool_reference payloads it sends.`, entry.name);
-  }
-}
-function pushLegacyName(push, params) {
-  const legacyVariables = Object.keys(params.env).filter((name) => name.startsWith(LEGACY_ENV_PREFIX) && params.env[name] !== void 0).sort();
-  if (legacyVariables.length === 0 && import_node_path36.default.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
-    push("legacy-name", "pass", "Nothing here still uses the former `claude-use` name.");
-    return;
-  }
-  for (const name of legacyVariables) {
-    push("legacy-name", "warn", `${name} is the former name of ${name.replace(LEGACY_ENV_PREFIX, ENV_PREFIX)}. Rename it; the old name still works but is only a fallback.`, name);
-  }
-  if (import_node_path36.default.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
-    push(
-      "legacy-name",
-      "warn",
-      `The state root is the former ${params.rootPath}, used in place. Leave it where it is: macOS Claude Code keys each identity's Keychain login on its exact configuration directory path, so moving it signs every identity out.`
-    );
-  }
-}
-function runDoctor(params) {
-  const findings = [];
-  const push = (section, severity, message, subject) => {
-    findings.push({ section, severity, message, ...subject === void 0 ? {} : { subject } });
-  };
-  const checkPin = (section, subject, where, version2) => {
-    const installed = params.installedClaudeVersions;
-    if (version2 === void 0 || installed === void 0 || installed.includes(version2)) {
-      return;
-    }
-    push(section, "warn", `${where} pins Claude Code ${version2}, which is not installed (installed: ${installed.length === 0 ? "none" : installed.join(", ")}); a launch that resolves to it fails.`, subject);
-  };
-  const ambient = detectAmbientCredential(params.env);
-  if (ambient === void 0) {
-    push("ambient-credential", "pass", "No ambient-credential environment variable is set.");
-  } else {
-    push("ambient-credential", "warn", formatAmbientCredentialGuardMessage(ambient.variable));
-  }
-  if (params.binaryDiscovery.ok) {
-    const { binary } = params.binaryDiscovery;
-    const versionNote = binary.version === void 0 ? "" : `, version ${binary.version}`;
-    push("binary-discovery", "pass", `Found ${binary.path} (${binary.source}${versionNote}).`);
-  } else {
-    push("binary-discovery", "fail", params.binaryDiscovery.message);
-  }
-  if (params.claudeShim.state === void 0) {
-    push("claude-shim", "pass", "No `claude` command shim enabled (the default). Run `agent-shim shim enable` to add one.");
-  } else if (!params.claudeShim.targetExists) {
-    push(
-      "claude-shim",
-      "warn",
-      `claude-shim.json records a \`claude\` shim at ${params.claudeShim.state.targetPath}, but nothing is there. Run \`agent-shim shim enable\` again, or \`agent-shim shim disable\` to clear the stale record.`
-    );
-  } else {
-    push(
-      "claude-shim",
-      "pass",
-      `\`claude\` is enabled at ${params.claudeShim.state.targetPath} (${params.claudeShim.state.method}). If you've upgraded agent-shim since, re-run \`agent-shim shim enable\` to refresh it.`
-    );
-  }
-  pushPathResolution(push, params.pathResolution);
-  pushLegacyName(push, params);
-  const profileSources = /* @__PURE__ */ new Map();
-  for (const entry of params.configProfiles) {
-    const validated2 = validateJson(ConfigProfileSchema, entry);
-    if (!validated2.ok) {
-      push("config-profile", "fail", validated2.message, entry.name);
-      continue;
-    }
-    profileSources.set(entry.name, { name: entry.name, profile: validated2.data });
-    checkPin("config-profile", entry.name, `Configuration profile "${entry.name}"`, validated2.data.launch?.claudeVersion);
-  }
-  const loadProfile = (name) => profileSources.get(name);
-  for (const name of profileSources.keys()) {
-    const linearised = lineariseProfile(name, loadProfile);
-    if (linearised.diagnostics.length === 0) {
-      push("config-profile", "pass", `${name} is valid and its extends chain resolves cleanly.`, name);
-    } else {
-      for (const diagnostic of linearised.diagnostics) {
-        push("config-profile", "fail", diagnostic.message, name);
-      }
-    }
-  }
-  const validProfileNames = new Set(profileSources.keys());
-  const validIdentityNames = /* @__PURE__ */ new Set();
-  for (const entry of params.identities) {
-    const validated2 = validateJson(IdentitySchema, entry);
-    if (!validated2.ok) {
-      push("identity", "fail", validated2.message, entry.name);
-      continue;
-    }
-    validIdentityNames.add(entry.name);
-    const defaultProfile = validated2.data.defaultConfigProfile;
-    if (defaultProfile !== void 0 && !validProfileNames.has(defaultProfile)) {
-      push(
-        "identity",
-        "fail",
-        `Identity "${entry.name}" names configuration profile "${defaultProfile}" as its default, but no such profile exists.`,
-        entry.name
-      );
-    } else {
-      const credential = validated2.data.credential;
-      const cache = credential === void 0 ? { text: "", unreadable: false } : cacheClause(params.credentialCache, `identity ${entry.name}`, credential);
-      push(
-        "identity",
-        cache.unreadable ? "fail" : "pass",
-        `${entry.name} is valid and authenticates with ${credential === void 0 ? "its stored login" : `credential ${describeCredential(credential)}`}${cache.text}.`,
-        entry.name
-      );
-    }
-  }
-  const validatedGlobalConfig = params.globalConfig.raw === void 0 ? void 0 : validateJson(GlobalConfigSchema, params.globalConfig);
-  const pools = validatedGlobalConfig?.ok === true ? validatedGlobalConfig.data.pools ?? {} : {};
-  for (const [poolName, pool] of Object.entries(pools)) {
-    const missing = pool.identities.filter((member) => !validIdentityNames.has(member));
-    if (missing.length === 0) {
-      push("pool", "pass", `${poolName} is valid (${pool.identities.join(", ")}).`, poolName);
-    } else {
-      push("pool", "fail", `Pool "${poolName}" names ${missing.map((member) => `identity "${member}"`).join(" and ")}, which ${missing.length === 1 ? "does" : "do"} not exist.`, poolName);
-    }
-  }
-  const selectionExists = (selector) => {
-    const poolName = poolNameOf(selector);
-    return poolName === void 0 ? validIdentityNames.has(selector) : poolName in pools;
-  };
-  for (const entry of params.providers) {
-    pushProvider(push, entry, params.credentialCache);
-  }
-  if (params.platform !== "darwin" || params.run === void 0) {
-    push("keychain", "pass", "Skipped (not macOS).");
-  } else {
-    for (const entry of params.identities) {
-      const result = lookupKeychainService(params.run, entry.farmRoot);
-      push("keychain", result.found ? "pass" : "warn", result.note, entry.name);
-    }
-  }
-  if (params.directoryRules.raw === void 0) {
-    push("directory-rules", "pass", "No directory-rules.json configured.");
-  } else {
-    const validated2 = validateJson(DirectoryRulesSchema, params.directoryRules);
-    if (!validated2.ok) {
-      push("directory-rules", "fail", validated2.message);
-    } else {
-      push("directory-rules", "pass", `${params.directoryRules.path} is valid.`);
-      for (const rule of validated2.data.rules) {
-        const badRefs = [];
-        if (rule.identity !== void 0 && !selectionExists(rule.identity)) {
-          badRefs.push(poolNameOf(rule.identity) === void 0 ? `identity "${rule.identity}"` : `pool "${poolNameOf(rule.identity) ?? ""}"`);
-        }
-        if (rule.configProfile !== void 0 && !validProfileNames.has(rule.configProfile)) {
-          badRefs.push(`configuration profile "${rule.configProfile}"`);
-        }
-        checkPin("directory-rules", rule.path, `Rule for "${rule.path}"`, rule.launch?.claudeVersion);
-        if (badRefs.length > 0) {
-          push("directory-rules", "fail", `Rule for "${rule.path}" names ${badRefs.join(" and ")}, which do not exist.`, rule.path);
-        } else {
-          push("directory-rules", "pass", `Rule for "${rule.path}" is valid.`, rule.path);
-        }
-      }
-    }
-  }
-  if (params.globalConfig.raw === void 0) {
-    push("global-config", "pass", "No config.json configured.");
-  } else {
-    const validated2 = validateJson(GlobalConfigSchema, params.globalConfig);
-    if (!validated2.ok) {
-      push("global-config", "fail", validated2.message);
-    } else {
-      const defaultProfile = validated2.data.defaultConfigProfile;
-      if (defaultProfile !== void 0 && !validProfileNames.has(defaultProfile)) {
-        push(
-          "global-config",
-          "fail",
-          `config.json names configuration profile "${defaultProfile}" as its default, but no such profile exists.`
-        );
-      } else {
-        push("global-config", "pass", `${params.globalConfig.path} is valid.`);
-        checkPin("global-config", void 0, "config.json", validated2.data.launch?.claudeVersion);
-      }
-    }
-  }
-  if (params.categoriesLocal.raw === void 0) {
-    push("categories-local", "pass", "No categories.local.json configured.");
-  } else {
-    const validated2 = validateJson(CategoryClassificationOverlaySchema, params.categoriesLocal);
-    push(
-      "categories-local",
-      validated2.ok ? "pass" : "fail",
-      validated2.ok ? `${params.categoriesLocal.path} is valid.` : validated2.message
-    );
-  }
-  if (params.headroom.state.raw === void 0) {
-    push("headroom", "pass", "No headroom daemon has ever run; nothing to check.");
-  } else {
-    const validated2 = validateJson(HeadroomStateSchema, params.headroom.state);
-    if (!validated2.ok) {
-      push("headroom", "fail", validated2.message);
-    } else {
-      const state = validated2.data;
-      const supervisorAlive = state.supervisorPid !== void 0 && params.headroom.isRunning(state.supervisorPid);
-      const headroomAlive = state.headroomPid !== void 0 && params.headroom.isRunning(state.headroomPid);
-      if (state.supervisorPid === void 0) {
-        if (state.lastError === void 0) {
-          push("headroom", "pass", "Headroom daemon is stopped (idle shutdown) with no recorded error.");
-        } else {
-          push("headroom", "warn", `Headroom supervisor is not running; last error: ${state.lastError}`);
-        }
-      } else if (!supervisorAlive) {
-        push(
-          "headroom",
-          "warn",
-          `Headroom state names supervisor pid ${String(state.supervisorPid)}, which is not running; the next launch through headroom will start a replacement.`
-        );
-      } else if (state.headroomPid === void 0 || state.socketPath === void 0) {
-        push(
-          "headroom",
-          "warn",
-          state.lastError === void 0 ? "Headroom supervisor is running but the daemon has no healthy process; it should be restarting it." : `Headroom supervisor is running but the daemon is down; last error: ${state.lastError}`
-        );
-      } else if (!headroomAlive) {
-        push(
-          "headroom",
-          "warn",
-          `Headroom state names daemon pid ${String(state.headroomPid)}, which is not running; its supervisor should be restarting it.`
-        );
-      } else {
-        push(
-          "headroom",
-          "pass",
-          `Headroom daemon is up on unix socket ${state.socketPath} (supervisor ${String(state.supervisorPid)}, daemon ${String(state.headroomPid)}).`
-        );
-      }
-      if (state.lastError !== void 0 && supervisorAlive) {
-        push("headroom", "warn", `Headroom recorded a previous error: ${state.lastError}`);
-      }
-      if (state.installedSource !== void 0 && isMovingGitSource(state.installedSource)) {
-        push(
-          "headroom",
-          "warn",
-          `Headroom is installed from a git ref that can move (${state.installedSource}); pin headroom.source to a full commit SHA so a rebased or deleted branch cannot change or break the install.`
-        );
-      }
-    }
-  }
-  if (params.activeIdentity.raw === void 0) {
-    push("active-identity", "pass", "No active identity set.");
-  } else {
-    const trimmed = params.activeIdentity.raw.trim();
-    if (trimmed === "") {
-      push("active-identity", "warn", "active-identity is present but empty \u2014 treated the same as unset.");
-    } else if (!selectionExists(trimmed)) {
-      push("active-identity", "fail", `active-identity names "${trimmed}", which does not exist.`);
-    } else {
-      push("active-identity", "pass", `Active identity "${trimmed}" is valid.`);
-    }
-  }
-  return { findings, ok: !findings.some((finding) => finding.severity === "fail") };
-}
-var SECTION_TITLES = {
-  "ambient-credential": "Ambient-credential exposure",
-  "binary-discovery": "Claude Code binary discovery",
-  "claude-shim": "`claude` command shim",
-  "path-resolution": "PATH resolution",
-  "legacy-name": "Former `claude-use` name",
-  "config-profile": "Configuration profiles",
-  identity: "Identities",
-  pool: "Pools",
-  provider: "Providers",
-  keychain: "macOS Keychain",
-  "directory-rules": "Directory rules",
-  "global-config": "Global config",
-  headroom: "Headroom daemon",
-  "categories-local": "categories.local.json",
-  "active-identity": "Active identity"
-};
-var SECTION_ORDER = [
-  "ambient-credential",
-  "binary-discovery",
-  "claude-shim",
-  "path-resolution",
-  "config-profile",
-  "identity",
-  "pool",
-  "provider",
-  "keychain",
-  "directory-rules",
-  "global-config",
-  "headroom",
-  "categories-local",
-  "active-identity"
-];
-function severityPrefix(severity) {
-  switch (severity) {
-    case "pass":
-      return "[PASS]";
-    case "warn":
-      return "[WARN]";
-    case "fail":
-      return "[FAIL]";
-    default:
-      return severity;
-  }
-}
-function formatDoctorReport(report) {
-  const lines = [];
-  for (const section of SECTION_ORDER) {
-    const sectionFindings = report.findings.filter((finding) => finding.section === section);
-    if (sectionFindings.length === 0) {
-      continue;
-    }
-    lines.push("", `${SECTION_TITLES[section]}:`);
-    for (const finding of sectionFindings) {
-      const subject = finding.subject === void 0 ? "" : `${finding.subject}: `;
-      lines.push(`  ${severityPrefix(finding.severity)} ${subject}${finding.message}`);
-    }
-  }
-  const failCount = report.findings.filter((finding) => finding.severity === "fail").length;
-  lines.push("", report.ok ? "All checks passed." : `${String(failCount)} check(s) failed.`);
-  return lines;
-}
-function realpathOrSelf(target) {
-  try {
-    return import_node_fs14.default.realpathSync(target);
-  } catch {
-    return target;
-  }
-}
-function collectDoctorReport(params) {
-  const { paths } = params;
-  const identityNames = import_node_fs14.default.existsSync(paths.identitiesDir) ? import_node_fs14.default.readdirSync(paths.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && isIdentityDirectoryName(entry.name)).map((entry) => entry.name).sort() : [];
-  const identities = identityNames.map((name) => {
-    const farmRoot = import_node_path36.default.join(paths.identitiesDir, name);
-    const identityPath = import_node_path36.default.join(farmRoot, "identity.json");
-    return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot };
-  });
-  const profileNames = import_node_fs14.default.existsSync(paths.configProfilesDir) ? import_node_fs14.default.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
-  const configProfiles = profileNames.map((name) => {
-    const profilePath = import_node_path36.default.join(paths.configProfilesDir, `${name}.json`);
-    return { name, path: profilePath, raw: realFsPort.readFileUtf8(profilePath) };
-  });
-  const providerNames = import_node_fs14.default.existsSync(paths.providersDir) ? import_node_fs14.default.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
-  const providers = providerNames.map((name) => {
-    const providerPath = import_node_path36.default.join(paths.providersDir, `${name}.json`);
-    return { name, path: providerPath, raw: realFsPort.readFileUtf8(providerPath) };
-  });
-  const ownExecutablePath = realOwnExecutablePath();
-  let binaryDiscovery;
-  try {
-    const binary = realResolveClaudeBinary(resolveOwnBinaryCheck(paths, realContentSourcePath()))();
-    binaryDiscovery = { ok: true, binary };
-  } catch (error62) {
-    binaryDiscovery = { ok: false, message: error62 instanceof Error ? error62.message : String(error62) };
-  }
-  const shimState = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-  const pathDirs = (params.env.PATH ?? "").split(import_node_path36.default.delimiter).filter((dir) => dir !== "");
-  const claudeShimShadow = shimState === void 0 ? void 0 : refinePathShadow(
-    findPathShadow({
-      pathDirs,
-      targetDir: import_node_path36.default.dirname(shimState.targetPath),
-      targetFilename: import_node_path36.default.basename(shimState.targetPath),
-      findExecutableInDir
-    }),
-    shimState.targetPath,
-    realpathOrSelf
-  );
-  const report = runDoctor({
-    env: params.env,
-    credentialCache: realCredentialCacheEnv(paths),
-    installedClaudeVersions: realInstalledClaudeVersions(),
-    identities,
-    configProfiles,
-    providers,
-    directoryRules: { path: paths.directoryRulesFile, raw: realFsPort.readFileUtf8(paths.directoryRulesFile) },
-    globalConfig: { path: paths.globalConfigFile, raw: realFsPort.readFileUtf8(paths.globalConfigFile) },
-    categoriesLocal: { path: paths.categoriesLocalFile, raw: realFsPort.readFileUtf8(paths.categoriesLocalFile) },
-    activeIdentity: { path: paths.activeIdentityFile, raw: realFsPort.readFileUtf8(paths.activeIdentityFile) },
-    binaryDiscovery,
-    claudeShim: { state: shimState, targetExists: shimState !== void 0 && import_node_fs14.default.existsSync(shimState.targetPath) },
-    rootPath: paths.root,
-    pathResolution: {
-      ownExecutablePath,
-      agentShim: refinePathShadow(
-        findPathShadow({
-          pathDirs,
-          targetDir: import_node_path36.default.dirname(ownExecutablePath),
-          targetFilename: commandFilename(ownExecutablePath, "agent-shim"),
-          findExecutableInDir
-        }),
-        ownExecutablePath,
-        realpathOrSelf
-      ),
-      ...claudeShimShadow === void 0 ? {} : { claude: claudeShimShadow }
-    },
-    run: realRunPort,
-    platform: process.platform,
-    headroom: {
-      state: { path: paths.headroomStateFile, raw: realFsPort.readFileUtf8(paths.headroomStateFile) },
-      isRunning: realIsProcessRunning
-    }
-  });
-  return report;
-}
-
 // src/doctor.ts
 function registerDoctorCommand(program2, deps) {
   const { paths } = deps;
@@ -74645,15 +75722,15 @@ function registerDoctorCommand(program2, deps) {
 
 // src/headroom/commands.ts
 var import_node_fs16 = __toESM(require("node:fs"), 1);
-var import_node_http2 = __toESM(require("node:http"), 1);
-var import_node_path38 = __toESM(require("node:path"), 1);
-var import_node_child_process5 = require("node:child_process");
+var import_node_http3 = __toESM(require("node:http"), 1);
+var import_node_path39 = __toESM(require("node:path"), 1);
+var import_node_child_process6 = require("node:child_process");
 
 // src/frontdoor/realFrontDoorPort.ts
 var import_node_fs15 = __toESM(require("node:fs"), 1);
 
 // src/frontdoor/ensure.ts
-var import_node_crypto13 = require("node:crypto");
+var import_node_crypto15 = require("node:crypto");
 var FRONTDOOR_START_TIMEOUT_MS = 3e4;
 var FRONTDOOR_LAUNCHER_POLL_MS = 100;
 var FrontDoorStartError = class extends CliError {
@@ -74687,7 +75764,7 @@ function ensureFrontDoor(params) {
           continue;
         }
         if (verdict.ok) {
-          const token = (0, import_node_crypto13.randomUUID)();
+          const token = (0, import_node_crypto15.randomUUID)();
           writeFrontDoorSession(ports.fs, paths.frontdoorSessionsDir, { pid: params.launcherPid, startedAt: ports.now(), token });
           return { port: state.port, connectPort: state.connectPort, token };
         }
@@ -74791,12 +75868,12 @@ function probeFrontDoorSync(port, caPem) {
 }
 
 // src/frontdoor/trust.ts
-var import_node_crypto14 = require("node:crypto");
-var import_node_path37 = __toESM(require("node:path"), 1);
+var import_node_crypto16 = require("node:crypto");
+var import_node_path38 = __toESM(require("node:path"), 1);
 var BUNDLE_NAME_HEX_DIGITS = 16;
 function resolveTrustBundle(params) {
   const { caCertFile, bundlesDir, variable, inherited, fs: fs19 } = params;
-  if (inherited === void 0 || inherited === "" || import_node_path37.default.resolve(inherited) === import_node_path37.default.resolve(caCertFile)) {
+  if (inherited === void 0 || inherited === "" || import_node_path38.default.resolve(inherited) === import_node_path38.default.resolve(caCertFile)) {
     return { path: caCertFile };
   }
   const caPem = fs19.readFileUtf8(caCertFile);
@@ -74814,7 +75891,7 @@ function resolveTrustBundle(params) {
   }
   const combined = `${inheritedPem.trimEnd()}
 ${caPem}`;
-  const bundle = import_node_path37.default.join(bundlesDir, `${(0, import_node_crypto14.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
+  const bundle = import_node_path38.default.join(bundlesDir, `${(0, import_node_crypto16.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
   if (!fs19.exists(bundle)) {
     fs19.mkdirp(bundlesDir);
     fs19.writeFileAtomic(bundle, combined);
@@ -74954,7 +76031,7 @@ function headroomProxyArgs(socketPath, settings2) {
 }
 async function readyOverSocket(socketPath) {
   return await new Promise((resolve) => {
-    const probe = import_node_http2.default.get({ socketPath, path: "/readyz", timeout: READY_FETCH_TIMEOUT_MS }, (response) => {
+    const probe = import_node_http3.default.get({ socketPath, path: "/readyz", timeout: READY_FETCH_TIMEOUT_MS }, (response) => {
       response.resume();
       resolve(response.statusCode === HTTP_STATUS.ok);
     });
@@ -74968,16 +76045,16 @@ async function readyOverSocket(socketPath) {
 }
 var HEADROOM_TOOL_NAME = "headroom-ai";
 function readInstalledHeadroomCommit() {
-  const toolDir = (0, import_node_child_process5.spawnSync)("uv", ["tool", "dir"], { encoding: "utf8" });
+  const toolDir = (0, import_node_child_process6.spawnSync)("uv", ["tool", "dir"], { encoding: "utf8" });
   if (toolDir.status !== 0) {
     return void 0;
   }
-  const libDir = import_node_path38.default.join(toolDir.stdout.trim(), HEADROOM_TOOL_NAME, "lib");
+  const libDir = import_node_path39.default.join(toolDir.stdout.trim(), HEADROOM_TOOL_NAME, "lib");
   for (const python of realFarmFs.readdir(libDir)) {
-    const sitePackages = import_node_path38.default.join(libDir, python, "site-packages");
+    const sitePackages = import_node_path39.default.join(libDir, python, "site-packages");
     for (const entry of realFarmFs.readdir(sitePackages)) {
       if (entry.startsWith("headroom_ai-") && entry.endsWith(".dist-info")) {
-        const directUrl = realFarmFs.readFileUtf8(import_node_path38.default.join(sitePackages, entry, "direct_url.json"));
+        const directUrl = realFarmFs.readFileUtf8(import_node_path39.default.join(sitePackages, entry, "direct_url.json"));
         return directUrl === void 0 ? void 0 : parseInstalledCommit(directUrl);
       }
     }
@@ -75008,7 +76085,7 @@ function realSupervisorPorts(paths) {
       }
       const logFd = import_node_fs16.default.openSync(paths.headroomLogPath, "a");
       try {
-        const child = (0, import_node_child_process5.spawn)("headroom", headroomProxyArgs(socketPath, settings2), {
+        const child = (0, import_node_child_process6.spawn)("headroom", headroomProxyArgs(socketPath, settings2), {
           detached: true,
           stdio: ["ignore", logFd, logFd],
           env: headroomSpawnEnv(process.env, allowlist, settings2, trust?.path)
@@ -75048,7 +76125,7 @@ function realSupervisorPorts(paths) {
     },
     ready: readyOverSocket,
     install: (spec) => {
-      const result = (0, import_node_child_process5.spawnSync)("uv", ["tool", "install", spec], { encoding: "utf8" });
+      const result = (0, import_node_child_process6.spawnSync)("uv", ["tool", "install", spec], { encoding: "utf8" });
       if (result.error !== void 0) {
         return { ok: false, error: `uv is not installed or not on PATH (${result.error.message})` };
       }
@@ -75061,7 +76138,7 @@ function realSupervisorPorts(paths) {
       return result.status === 0 ? { ok: true } : { ok: false, error: `uv tool install exited ${String(result.status)}` };
     },
     headroomVersion: () => {
-      const result = (0, import_node_child_process5.spawnSync)("headroom", ["--version"], { encoding: "utf8" });
+      const result = (0, import_node_child_process6.spawnSync)("headroom", ["--version"], { encoding: "utf8" });
       return result.status === 0 ? result.stdout.trim() : void 0;
     },
     installedCommit: readInstalledHeadroomCommit,
@@ -75244,13 +76321,14 @@ function toProviderView(name, provider) {
   };
 }
 function codexConfigFromOptions(options) {
-  if (options.codexDefaultModel === void 0 && options.codexModel === void 0 && options.codexEffort === void 0) {
+  if (options.codexDefaultModel === void 0 && options.codexModel === void 0 && options.codexEffort === void 0 && options.codexLogin === void 0) {
     return void 0;
   }
   const candidate = {
     ...options.codexDefaultModel === void 0 ? {} : { defaultModel: options.codexDefaultModel },
     ...options.codexModel === void 0 ? {} : { models: options.codexModel },
-    ...options.codexEffort === void 0 ? {} : { effort: options.codexEffort }
+    ...options.codexEffort === void 0 ? {} : { effort: options.codexEffort },
+    ...options.codexLogin === void 0 ? {} : { login: options.codexLogin }
   };
   const parsed = CodexProviderConfigSchema.safeParse(candidate);
   if (!parsed.success) {
@@ -75273,7 +76351,7 @@ function registerProviderCommand(program2, deps) {
       new Option("--credential-target <target>", "Where the token goes: bearer sets ANTHROPIC_AUTH_TOKEN (default), apiKey sets ANTHROPIC_API_KEY.").choices(
         PROVIDER_CREDENTIAL_TARGETS
       )
-    ).option("--env <KEY=VALUE>", "Extra environment entry for the child (repeatable).", collectStringPair).option("--codex-default-model <model>", "Codex providers: the codex model a request maps to when no tier matches.").option("--codex-model <tier=model>", "Codex providers: the codex model one tier (fable, opus, sonnet or haiku) maps to (repeatable).", collectStringPair).addOption(new Option("--codex-effort <effort>", "Codex providers: the reasoning effort when a request asks for none the backend accepts.").choices(CODEX_EFFORTS)).option("--json", "Print the result as JSON.").action((name, options) => {
+    ).option("--env <KEY=VALUE>", "Extra environment entry for the child (repeatable).", collectStringPair).option("--codex-default-model <model>", "Codex providers: the codex model a request maps to when no tier matches.").option("--codex-model <tier=model>", "Codex providers: the codex model one tier (fable, opus, sonnet or haiku) maps to (repeatable).", collectStringPair).addOption(new Option("--codex-effort <effort>", "Codex providers: the reasoning effort when a request asks for none the backend accepts.").choices(CODEX_EFFORTS)).addOption(new Option("--codex-login <login>", "Codex providers: which login the upstream call uses, the Codex CLI's own login or a Sign in with ChatGPT grant from `agent-shim codex login`.").choices(CODEX_LOGINS)).option("--json", "Print the result as JSON.").action((name, options) => {
       const codex = codexConfigFromOptions(options);
       const created = addProvider(paths, name, {
         ...options.kind === void 0 ? {} : { kind: options.kind },
@@ -75305,14 +76383,14 @@ function registerProviderCommand(program2, deps) {
     new Option("--credential-target <target>", "Where the token goes: bearer sets ANTHROPIC_AUTH_TOKEN, apiKey sets ANTHROPIC_API_KEY.").choices(
       PROVIDER_CREDENTIAL_TARGETS
     )
-  ).option("--env <KEY=VALUE>", "Add or replace an environment entry for the child (repeatable).", collectStringPair).option("--unset-env <KEY>", "Remove an environment entry (repeatable).", collectRepeated).option("--codex-default-model <model>", "Codex providers: replace the model a request maps to when no tier matches.").option("--codex-model <tier=model>", "Codex providers: set the codex model one tier maps to (repeatable; other tiers are kept).", collectStringPair).addOption(new Option("--codex-effort <effort>", "Codex providers: replace the default reasoning effort.").choices(CODEX_EFFORTS));
+  ).option("--env <KEY=VALUE>", "Add or replace an environment entry for the child (repeatable).", collectStringPair).option("--unset-env <KEY>", "Remove an environment entry (repeatable).", collectRepeated).option("--codex-default-model <model>", "Codex providers: replace the model a request maps to when no tier matches.").option("--codex-model <tier=model>", "Codex providers: set the codex model one tier maps to (repeatable; other tiers are kept).", collectStringPair).addOption(new Option("--codex-effort <effort>", "Codex providers: replace the default reasoning effort.").choices(CODEX_EFFORTS)).addOption(new Option("--codex-login <login>", "Codex providers: replace which login the upstream call uses.").choices(CODEX_LOGINS));
   addCredentialCacheOptions(providerSet);
   withExamples(
     providerSet.option("--json", "Print the result as JSON.").action((name, allOptions) => {
       const { json: json2, ...options } = allOptions;
       if (Object.entries(allOptions).every(([key, value2]) => key === "json" || value2 === void 0)) {
         throw new UsageError(
-          "Nothing to change: pass --display-name, --base-url, --credential, --credential-target, a --credential-cache option, --env, --unset-env, --codex-default-model, --codex-model or --codex-effort."
+          "Nothing to change: pass --display-name, --base-url, --credential, --credential-target, a --credential-cache option, --env, --unset-env, --codex-default-model, --codex-model, --codex-effort or --codex-login."
         );
       }
       const codex = codexConfigFromOptions(options);
@@ -75373,6 +76451,7 @@ function registerProviderCommand(program2, deps) {
         const config2 = resolveCodexConfig(found.codex);
         console.log(`Codex models: ${CODEX_TIERS.map((tier) => `${tier}=${config2.models[tier]}`).join(", ")}, otherwise ${config2.defaultModel}`);
         console.log(`Codex effort: ${config2.effort}`);
+        console.log(`Codex login: ${config2.login}`);
       } else {
         console.log(`Base URL: ${found.baseUrl}`);
       }
@@ -75780,11 +76859,11 @@ function buildProgram(deps) {
 
 // src/launchWiring.ts
 var import_node_os8 = __toESM(require("node:os"), 1);
-var import_node_crypto16 = require("node:crypto");
+var import_node_crypto18 = require("node:crypto");
 
 // src/launcher.ts
-var import_node_crypto15 = require("node:crypto");
-var import_node_path40 = __toESM(require("node:path"), 1);
+var import_node_crypto17 = require("node:crypto");
+var import_node_path41 = __toESM(require("node:path"), 1);
 
 // src/launcher/cliOverride.ts
 var InvalidCliCategoryError = class extends CliError {
@@ -75868,7 +76947,7 @@ function buildCliOverride(params) {
 }
 
 // src/launcher/flags.ts
-var import_node_path39 = __toESM(require("node:path"), 1);
+var import_node_path40 = __toESM(require("node:path"), 1);
 
 // src/headroom/headers.ts
 function mergeAnthropicCustomHeaders(existing, additions) {
@@ -75938,7 +77017,7 @@ function buildEnv(params) {
   const parentCustomHeaders = params.baseEnv.ANTHROPIC_CUSTOM_HEADERS;
   let providerCustomHeaders;
   if (!params.configDirEscapeHatch && params.resolvedIdentityName !== void 0) {
-    env.CLAUDE_CONFIG_DIR = import_node_path39.default.join(params.identitiesDir, params.resolvedIdentityName);
+    env.CLAUDE_CONFIG_DIR = import_node_path40.default.join(params.identitiesDir, params.resolvedIdentityName);
   }
   if (params.provider !== void 0) {
     const providerEnv = params.provider.definition.env ?? {};
@@ -76122,7 +77201,7 @@ function prepareLaunch(params) {
     identityDefaultConfigProfile: loadedIdentity?.config.defaultConfigProfile,
     globalDefaultConfigProfile: params.globalDefaultConfigProfile
   });
-  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs19.readConfigFile(import_node_path40.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
+  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs19.readConfigFile(import_node_path41.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
     log.error(
       `agent-shim: no configuration profile named "${configProfileDecision.name}" (selected via ${configProfileDecision.source}). Run \`agent-shim profile add ${configProfileDecision.name}\` first.`
     );
@@ -76284,7 +77363,7 @@ function prepareLaunch(params) {
     ...identityCredential === void 0 ? {} : { identityCredential },
     ...frontDoor === void 0 ? {} : { frontdoor: frontDoor },
     ...headroom === void 0 ? {} : { headroom },
-    sessionId: (0, import_node_crypto15.randomUUID)()
+    sessionId: (0, import_node_crypto17.randomUUID)()
   });
   const releases = [...headroom === void 0 || headroomPort === void 0 ? [] : [headroomPort.release], ...frontDoorRelease === void 0 ? [] : [frontDoorRelease]];
   const release = () => {
@@ -76329,7 +77408,7 @@ function buildFarmRuntime(paths, cwd) {
         ...cliOverride === void 0 ? {} : { cliOverride }
       }).input,
       now: () => Date.now(),
-      uniqueSuffix: `${String(process.pid)}.${(0, import_node_crypto16.randomUUID)()}`,
+      uniqueSuffix: `${String(process.pid)}.${(0, import_node_crypto18.randomUUID)()}`,
       // Zombie-aware on purpose: a previous launcher that crashed out of a resync without releasing the lock may sit unreaped, still answering signal 0 as alive, and must read as a dead holder so this launch takes the lock over instead of timing out.
       lock: { pid: process.pid, isRunning: realIsProcessRunning, sleep: realSleepSync }
     },
@@ -76468,7 +77547,7 @@ async function runClaude(argvOverride) {
 // src/cli.ts
 async function main() {
   aliasLegacyEnv(process.env);
-  const invokedName = import_node_path41.default.basename(process.argv[1] ?? "agent-shim");
+  const invokedName = import_node_path42.default.basename(process.argv[1] ?? "agent-shim");
   if (isInvokedAsClaude(invokedName)) {
     await runClaude();
     return;