npm - agent-shim - Versions diffs - 8.20.2 → 8.21.1 - Mend

agent-shim 8.20.2 → 8.21.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (6) hide show

package/dist/cli.cjs CHANGED Viewed

@@ -3248,42 +3248,42 @@ var require_defaults = __commonJS({
 var require_env_paths = __commonJS({
   "node_modules/.pnpm/env-paths@2.2.1/node_modules/env-paths/index.js"(exports2, module2) {
     "use strict";
-    var path44 = require("path");
-    var os10 = require("os");
-    var homedir = os10.homedir();
-    var tmpdir = os10.tmpdir();
+    var path46 = require("path");
+    var os11 = require("os");
+    var homedir = os11.homedir();
+    var tmpdir = os11.tmpdir();
     var { env } = process;
     var macos = (name) => {
-      const library = path44.join(homedir, "Library");
+      const library = path46.join(homedir, "Library");
       return {
-        data: path44.join(library, "Application Support", name),
-        config: path44.join(library, "Preferences", name),
-        cache: path44.join(library, "Caches", name),
-        log: path44.join(library, "Logs", name),
-        temp: path44.join(tmpdir, name)
+        data: path46.join(library, "Application Support", name),
+        config: path46.join(library, "Preferences", name),
+        cache: path46.join(library, "Caches", name),
+        log: path46.join(library, "Logs", name),
+        temp: path46.join(tmpdir, name)
       };
     };
     var windows = (name) => {
-      const appData = env.APPDATA || path44.join(homedir, "AppData", "Roaming");
-      const localAppData = env.LOCALAPPDATA || path44.join(homedir, "AppData", "Local");
+      const appData = env.APPDATA || path46.join(homedir, "AppData", "Roaming");
+      const localAppData = env.LOCALAPPDATA || path46.join(homedir, "AppData", "Local");
       return {
         // Data/config/cache/log are invented by me as Windows isn't opinionated about this
-        data: path44.join(localAppData, name, "Data"),
-        config: path44.join(appData, name, "Config"),
-        cache: path44.join(localAppData, name, "Cache"),
-        log: path44.join(localAppData, name, "Log"),
-        temp: path44.join(tmpdir, name)
+        data: path46.join(localAppData, name, "Data"),
+        config: path46.join(appData, name, "Config"),
+        cache: path46.join(localAppData, name, "Cache"),
+        log: path46.join(localAppData, name, "Log"),
+        temp: path46.join(tmpdir, name)
       };
     };
     var linux = (name) => {
-      const username = path44.basename(homedir);
+      const username = path46.basename(homedir);
       return {
-        data: path44.join(env.XDG_DATA_HOME || path44.join(homedir, ".local", "share"), name),
-        config: path44.join(env.XDG_CONFIG_HOME || path44.join(homedir, ".config"), name),
-        cache: path44.join(env.XDG_CACHE_HOME || path44.join(homedir, ".cache"), name),
+        data: path46.join(env.XDG_DATA_HOME || path46.join(homedir, ".local", "share"), name),
+        config: path46.join(env.XDG_CONFIG_HOME || path46.join(homedir, ".config"), name),
+        cache: path46.join(env.XDG_CACHE_HOME || path46.join(homedir, ".cache"), name),
         // https://wiki.debian.org/XDGBaseDirectorySpecification#state
-        log: path44.join(env.XDG_STATE_HOME || path44.join(homedir, ".local", "state"), name),
-        temp: path44.join(tmpdir, username, name)
+        log: path46.join(env.XDG_STATE_HOME || path46.join(homedir, ".local", "state"), name),
+        temp: path46.join(tmpdir, username, name)
       };
     };
     var envPaths = (name, options) => {
@@ -3351,11 +3351,11 @@ var require_util = __commonJS({
       return result;
     }
     exports2.emplace = emplace;
-    function getPropertyByPath(source, path44) {
-      if (typeof path44 === "string" && Object.prototype.hasOwnProperty.call(source, path44)) {
-        return source[path44];
+    function getPropertyByPath(source, path46) {
+      if (typeof path46 === "string" && Object.prototype.hasOwnProperty.call(source, path46)) {
+        return source[path46];
       }
-      const parsedPath = typeof path44 === "string" ? path44.split(".") : path44;
+      const parsedPath = typeof path46 === "string" ? path46.split(".") : path46;
       return parsedPath.reduce((previous, key) => {
         if (previous === void 0) {
           return previous;
@@ -3378,9 +3378,9 @@ var require_util = __commonJS({
       return Object.fromEntries(Object.entries(options).filter(([, value2]) => value2 !== void 0));
     }
     exports2.removeUndefinedValuesFromObject = removeUndefinedValuesFromObject;
-    async function isDirectory(path44) {
+    async function isDirectory(path46) {
       try {
-        const stat = await fs_1.promises.stat(path44);
+        const stat = await fs_1.promises.stat(path46);
         return stat.isDirectory();
       } catch (e) {
         if (e.code === "ENOENT") {
@@ -3390,9 +3390,9 @@ var require_util = __commonJS({
       }
     }
     exports2.isDirectory = isDirectory;
-    function isDirectorySync(path44) {
+    function isDirectorySync(path46) {
       try {
-        const stat = fs_1.default.statSync(path44);
+        const stat = fs_1.default.statSync(path46);
         return stat.isDirectory();
       } catch (e) {
         if (e.code === "ENOENT") {
@@ -3490,7 +3490,7 @@ var require_ExplorerBase = __commonJS({
           const idx = importStack.indexOf(fullPath);
           if (idx !== -1) {
             throw new Error(`Circular import detected:
-${[...importStack, fullPath].map((path44, i2) => `${i2 + 1}. ${path44}`).join("\n")} (same as ${idx + 1}.)`);
+${[...importStack, fullPath].map((path46, i2) => `${i2 + 1}. ${path46}`).join("\n")} (same as ${idx + 1}.)`);
           }
         }
       }
@@ -3678,9 +3678,9 @@ var require_Explorer = __commonJS({
           throw error62;
         }
       }
-      async #fileExists(path44) {
+      async #fileExists(path46) {
         try {
-          await promises_1.default.stat(path44);
+          await promises_1.default.stat(path46);
           return true;
         } catch (e) {
           return false;
@@ -3840,9 +3840,9 @@ var require_ExplorerSync = __commonJS({
           throw error62;
         }
       }
-      #fileExists(path44) {
+      #fileExists(path46) {
         try {
-          fs_1.default.statSync(path44);
+          fs_1.default.statSync(path46);
           return true;
         } catch (e) {
           return false;
@@ -3966,7 +3966,7 @@ var require_dist = __commonJS({
       };
     }
     function getResolvedSearchPlaces(moduleName, toolDefinedSearchPlaces, userConfiguredOptions) {
-      const userConfiguredSearchPlaces = userConfiguredOptions.searchPlaces?.map((path44) => path44.replace("{name}", moduleName));
+      const userConfiguredSearchPlaces = userConfiguredOptions.searchPlaces?.map((path46) => path46.replace("{name}", moduleName));
       if (userConfiguredOptions.mergeSearchPlaces) {
         return [...userConfiguredSearchPlaces ?? [], ...toolDefinedSearchPlaces];
       }
@@ -4374,8 +4374,8 @@ var require_utils = __commonJS({
       }
       return output2;
     };
-    exports2.basename = (path44, { windows } = {}) => {
-      const segs = path44.split(windows ? /[\\/]/ : "/");
+    exports2.basename = (path46, { windows } = {}) => {
+      const segs = path46.split(windows ? /[\\/]/ : "/");
       const last = segs[segs.length - 1];
       if (last === "") {
         return segs[segs.length - 2];
@@ -6891,7 +6891,7 @@ var require_util2 = __commonJS({
     var { kDestroyed, kBodyUsed, kListeners, kBody } = require_symbols();
     var { IncomingMessage } = require("node:http");
     var stream = require("node:stream");
-    var net3 = require("node:net");
+    var net4 = require("node:net");
     var { stringify } = require("node:querystring");
     var { EventEmitter: EE } = require("node:events");
     var timers = require_timers();
@@ -7003,14 +7003,14 @@ var require_util2 = __commonJS({
         }
         const port = url2.port != null ? url2.port : url2.protocol === "https:" ? 443 : 80;
         let origin = url2.origin != null ? url2.origin : `${url2.protocol || ""}//${url2.hostname || ""}:${port}`;
-        let path44 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`;
+        let path46 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`;
         if (origin[origin.length - 1] === "/") {
           origin = origin.slice(0, origin.length - 1);
         }
-        if (path44 && path44[0] !== "/") {
-          path44 = `/${path44}`;
+        if (path46 && path46[0] !== "/") {
+          path46 = `/${path46}`;
         }
-        return new URL(`${origin}${path44}`);
+        return new URL(`${origin}${path46}`);
       }
       if (!isHttpOrHttpsPrefixed(url2.origin || url2.protocol)) {
         throw new InvalidArgumentError2("Invalid URL protocol: the URL must start with `http:` or `https:`.");
@@ -7040,7 +7040,7 @@ var require_util2 = __commonJS({
       }
       assert2(typeof host === "string");
       const servername = getHostname(host);
-      if (net3.isIP(servername)) {
+      if (net4.isIP(servername)) {
         return "";
       }
       return servername;
@@ -7831,9 +7831,9 @@ var require_diagnostics = __commonJS({
         "undici:client:sendHeaders",
         (evt) => {
           const {
-            request: { method, path: path44, origin }
+            request: { method, path: path46, origin }
           } = evt;
-          debugLog("sending request to %s %s%s", method, origin, path44);
+          debugLog("sending request to %s %s%s", method, origin, path46);
         }
       );
     }
@@ -7851,14 +7851,14 @@ var require_diagnostics = __commonJS({
         "undici:request:headers",
         (evt) => {
           const {
-            request: { method, path: path44, origin },
+            request: { method, path: path46, origin },
             response: { statusCode }
           } = evt;
           debugLog(
             "received response to %s %s%s - HTTP %d",
             method,
             origin,
-            path44,
+            path46,
             statusCode
           );
         }
@@ -7867,23 +7867,23 @@ var require_diagnostics = __commonJS({
         "undici:request:trailers",
         (evt) => {
           const {
-            request: { method, path: path44, origin }
+            request: { method, path: path46, origin }
           } = evt;
-          debugLog("trailers received from %s %s%s", method, origin, path44);
+          debugLog("trailers received from %s %s%s", method, origin, path46);
         }
       );
       diagnosticsChannel.subscribe(
         "undici:request:error",
         (evt) => {
           const {
-            request: { method, path: path44, origin },
+            request: { method, path: path46, origin },
             error: error62
           } = evt;
           debugLog(
             "request to %s %s%s errored - %s",
             method,
             origin,
-            path44,
+            path46,
             error62.message
           );
         }
@@ -7998,7 +7998,7 @@ var require_request = __commonJS({
     var kHandler = /* @__PURE__ */ Symbol("handler");
     var Request2 = class {
       constructor(origin, {
-        path: path44,
+        path: path46,
         method,
         body,
         headers,
@@ -8015,11 +8015,11 @@ var require_request = __commonJS({
         maxRedirections,
         typeOfService
       }, handler) {
-        if (typeof path44 !== "string") {
+        if (typeof path46 !== "string") {
           throw new InvalidArgumentError2("path must be a string");
-        } else if (path44[0] !== "/" && !(path44.startsWith("http://") || path44.startsWith("https://")) && method !== "CONNECT") {
+        } else if (path46[0] !== "/" && !(path46.startsWith("http://") || path46.startsWith("https://")) && method !== "CONNECT") {
           throw new InvalidArgumentError2("path must be an absolute URL or start with a slash");
-        } else if (invalidPathRegex.test(path44)) {
+        } else if (invalidPathRegex.test(path46)) {
           throw new InvalidArgumentError2("invalid request path");
         }
         if (typeof method !== "string") {
@@ -8094,7 +8094,7 @@ var require_request = __commonJS({
         this.completed = false;
         this.aborted = false;
         this.upgrade = upgrade || null;
-        this.path = query ? serializePathWithQuery(path44, query) : path44;
+        this.path = query ? serializePathWithQuery(path46, query) : path46;
         this.origin = origin;
         this.protocol = getProtocolFromUrlString(origin);
         this.idempotent = idempotent == null ? method === "HEAD" || method === "GET" : idempotent;
@@ -8703,7 +8703,7 @@ var require_dispatcher_base = __commonJS({
 var require_connect = __commonJS({
   "node_modules/.pnpm/undici@7.29.1/node_modules/undici/lib/core/connect.js"(exports2, module2) {
     "use strict";
-    var net3 = require("node:net");
+    var net4 = require("node:net");
     var assert2 = require("node:assert");
     var util = require_util2();
     var { InvalidArgumentError: InvalidArgumentError2 } = require_errors();
@@ -8786,7 +8786,7 @@ var require_connect = __commonJS({
         } else {
           assert2(!httpSocket, "httpSocket can only be sent on TLS update");
           port = port || 80;
-          socket = net3.connect({
+          socket = net4.connect({
             highWaterMark: 64 * 1024,
             // Same as nodejs fs streams.
             ...options,
@@ -13276,7 +13276,7 @@ var require_client_h1 = __commonJS({
       return method !== "GET" && method !== "HEAD" && method !== "OPTIONS" && method !== "TRACE" && method !== "CONNECT";
     }
     function writeH1(client, request7) {
-      const { method, path: path44, host, upgrade, blocking, reset } = request7;
+      const { method, path: path46, host, upgrade, blocking, reset } = request7;
       let { body, headers, contentLength } = request7;
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH" || method === "QUERY" || method === "PROPFIND" || method === "PROPPATCH";
       if (util.isFormDataLike(body)) {
@@ -13354,7 +13354,7 @@ var require_client_h1 = __commonJS({
       if (socket.setTypeOfService) {
         socket.setTypeOfService(request7.typeOfService);
       }
-      let header = `${method} ${path44} HTTP/1.1\r
+      let header = `${method} ${path46} HTTP/1.1\r
 `;
       if (typeof host === "string") {
         header += `host: ${host}\r
@@ -14033,7 +14033,7 @@ var require_client_h2 = __commonJS({
       const headersTimeout = request7.headersTimeout ?? client[kHeadersTimeout];
       const bodyTimeout = request7.bodyTimeout ?? client[kBodyTimeout];
       const session = client[kHTTP2Session];
-      const { method, path: path44, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request7;
+      const { method, path: path46, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request7;
       let { body } = request7;
       if (upgrade != null && upgrade !== "websocket") {
         util.errorRequest(client, request7, new InvalidArgumentError2(`Custom upgrade "${upgrade}" not supported over HTTP/2`));
@@ -14102,7 +14102,7 @@ var require_client_h2 = __commonJS({
           }
           headers[HTTP2_HEADER_METHOD] = "CONNECT";
           headers[HTTP2_HEADER_PROTOCOL] = "websocket";
-          headers[HTTP2_HEADER_PATH] = path44;
+          headers[HTTP2_HEADER_PATH] = path46;
           if (protocol === "ws:" || protocol === "wss:") {
             headers[HTTP2_HEADER_SCHEME] = protocol === "ws:" ? "http" : "https";
           } else {
@@ -14144,7 +14144,7 @@ var require_client_h2 = __commonJS({
         stream.setTimeout(headersTimeout);
         return true;
       }
-      headers[HTTP2_HEADER_PATH] = path44;
+      headers[HTTP2_HEADER_PATH] = path46;
       headers[HTTP2_HEADER_SCHEME] = protocol === "http:" ? "http" : "https";
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH";
       if (body && typeof body.read === "function") {
@@ -14463,8 +14463,8 @@ var require_client = __commonJS({
   "node_modules/.pnpm/undici@7.29.1/node_modules/undici/lib/dispatcher/client.js"(exports2, module2) {
     "use strict";
     var assert2 = require("node:assert");
-    var net3 = require("node:net");
-    var http7 = require("node:http");
+    var net4 = require("node:net");
+    var http8 = require("node:http");
     var util = require_util2();
     var { ClientStats } = require_stats();
     var { channels } = require_diagnostics();
@@ -14522,7 +14522,7 @@ var require_client = __commonJS({
     var connectH1 = require_client_h1();
     var connectH2 = require_client_h2();
     var kClosedResolve = /* @__PURE__ */ Symbol("kClosedResolve");
-    var getDefaultNodeMaxHeaderSize = http7 && http7.maxHeaderSize && Number.isInteger(http7.maxHeaderSize) && http7.maxHeaderSize > 0 ? () => http7.maxHeaderSize : () => {
+    var getDefaultNodeMaxHeaderSize = http8 && http8.maxHeaderSize && Number.isInteger(http8.maxHeaderSize) && http8.maxHeaderSize > 0 ? () => http8.maxHeaderSize : () => {
       throw new InvalidArgumentError2("http module not available or http.maxHeaderSize invalid");
     };
     var noop = () => {
@@ -14618,7 +14618,7 @@ var require_client = __commonJS({
         if (maxRequestsPerClient != null && (!Number.isInteger(maxRequestsPerClient) || maxRequestsPerClient < 0)) {
           throw new InvalidArgumentError2("maxRequestsPerClient must be a positive number");
         }
-        if (localAddress != null && (typeof localAddress !== "string" || net3.isIP(localAddress) === 0)) {
+        if (localAddress != null && (typeof localAddress !== "string" || net4.isIP(localAddress) === 0)) {
           throw new InvalidArgumentError2("localAddress must be valid string IP address");
         }
         if (maxResponseSize != null && (!Number.isInteger(maxResponseSize) || maxResponseSize < -1)) {
@@ -14798,7 +14798,7 @@ var require_client = __commonJS({
         const idx = hostname3.indexOf("]");
         assert2(idx !== -1);
         const ip = hostname3.substring(1, idx);
-        assert2(net3.isIPv6(ip));
+        assert2(net4.isIPv6(ip));
         hostname3 = ip;
       }
       client[kConnecting] = true;
@@ -15743,10 +15743,10 @@ var require_socks5_utils = __commonJS({
   "node_modules/.pnpm/undici@7.29.1/node_modules/undici/lib/core/socks5-utils.js"(exports2, module2) {
     "use strict";
     var { Buffer: Buffer3 } = require("node:buffer");
-    var net3 = require("node:net");
+    var net4 = require("node:net");
     var { InvalidArgumentError: InvalidArgumentError2 } = require_errors();
     function parseAddress(address) {
-      if (net3.isIPv4(address)) {
+      if (net4.isIPv4(address)) {
         const parts = address.split(".").map(Number);
         return {
           type: 1,
@@ -15754,7 +15754,7 @@ var require_socks5_utils = __commonJS({
           buffer: Buffer3.from(parts)
         };
       }
-      if (net3.isIPv6(address)) {
+      if (net4.isIPv6(address)) {
         return {
           type: 4,
           // IPv6
@@ -15777,7 +15777,7 @@ var require_socks5_utils = __commonJS({
       if (address.includes(".")) {
         const lastColonIndex = address.lastIndexOf(":");
         const ipv4Part = address.slice(lastColonIndex + 1);
-        if (net3.isIPv4(ipv4Part)) {
+        if (net4.isIPv4(ipv4Part)) {
           const octets = ipv4Part.split(".").map(Number);
           const high = (octets[0] << 8 | octets[1]).toString(16);
           const low = (octets[2] << 8 | octets[3]).toString(16);
@@ -16496,10 +16496,10 @@ var require_proxy_agent = __commonJS({
         };
         const {
           origin,
-          path: path44 = "/",
+          path: path46 = "/",
           headers = {}
         } = opts;
-        opts.path = origin + path44;
+        opts.path = origin + path46;
         if (!("host" in headers) && !("Host" in headers)) {
           const { host } = new URL(origin);
           headers.host = host;
@@ -16658,18 +16658,18 @@ var require_proxy_agent = __commonJS({
         }
       }
       [kClose]() {
-        const promises = [this[kAgent].close()];
+        const promises2 = [this[kAgent].close()];
         if (this[kClient]) {
-          promises.push(this[kClient].close());
+          promises2.push(this[kClient].close());
         }
-        return Promise.all(promises);
+        return Promise.all(promises2);
       }
       [kDestroy]() {
-        const promises = [this[kAgent].destroy()];
+        const promises2 = [this[kAgent].destroy()];
         if (this[kClient]) {
-          promises.push(this[kClient].destroy());
+          promises2.push(this[kClient].destroy());
         }
-        return Promise.all(promises);
+        return Promise.all(promises2);
       }
     };
     function buildHeaders(headers) {
@@ -18608,20 +18608,20 @@ var require_mock_utils = __commonJS({
       }
       return normalizedQp;
     }
-    function safeUrl(path44) {
-      if (typeof path44 !== "string") {
-        return path44;
+    function safeUrl(path46) {
+      if (typeof path46 !== "string") {
+        return path46;
       }
-      const pathSegments = path44.split("?", 3);
+      const pathSegments = path46.split("?", 3);
       if (pathSegments.length !== 2) {
-        return path44;
+        return path46;
       }
       const qp = new URLSearchParams(pathSegments.pop());
       qp.sort();
       return [...pathSegments, qp.toString()].join("?");
     }
-    function matchKey(mockDispatch2, { path: path44, method, body, headers }) {
-      const pathMatch = matchValue(mockDispatch2.path, path44);
+    function matchKey(mockDispatch2, { path: path46, method, body, headers }) {
+      const pathMatch = matchValue(mockDispatch2.path, path46);
       const methodMatch = matchValue(mockDispatch2.method, method);
       const bodyMatch = typeof mockDispatch2.body !== "undefined" ? matchValue(mockDispatch2.body, body) : true;
       const headersMatch = matchHeaders(mockDispatch2, headers);
@@ -18646,8 +18646,8 @@ var require_mock_utils = __commonJS({
       const basePath = key.query ? serializePathWithQuery(key.path, key.query) : key.path;
       const resolvedPath = typeof basePath === "string" ? safeUrl(basePath) : basePath;
       const resolvedPathWithoutTrailingSlash = removeTrailingSlash(resolvedPath);
-      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path44, ignoreTrailingSlash }) => {
-        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path44)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path44), resolvedPath);
+      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path46, ignoreTrailingSlash }) => {
+        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path46)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path46), resolvedPath);
       });
       if (matchedMockDispatches.length === 0) {
         throw new MockNotMatchedError(`Mock dispatch not matched for path '${resolvedPath}'`);
@@ -18686,19 +18686,19 @@ var require_mock_utils = __commonJS({
         mockDispatches.splice(index, 1);
       }
     }
-    function removeTrailingSlash(path44) {
-      while (path44.endsWith("/")) {
-        path44 = path44.slice(0, -1);
+    function removeTrailingSlash(path46) {
+      while (path46.endsWith("/")) {
+        path46 = path46.slice(0, -1);
       }
-      if (path44.length === 0) {
-        path44 = "/";
+      if (path46.length === 0) {
+        path46 = "/";
       }
-      return path44;
+      return path46;
     }
     function buildKey(opts) {
-      const { path: path44, method, body, headers, query } = opts;
+      const { path: path46, method, body, headers, query } = opts;
       return {
-        path: path44,
+        path: path46,
         method,
         body,
         headers,
@@ -19388,10 +19388,10 @@ var require_pending_interceptors_formatter = __commonJS({
       }
       format(pendingInterceptors) {
         const withPrettyHeaders = pendingInterceptors.map(
-          ({ method, path: path44, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
+          ({ method, path: path46, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
             Method: method,
             Origin: origin,
-            Path: path44,
+            Path: path46,
             "Status code": statusCode,
             Persistent: persist ? PERSISTENT : NOT_PERSISTENT,
             Invocations: timesInvoked,
@@ -19473,9 +19473,9 @@ var require_mock_agent = __commonJS({
         const acceptNonStandardSearchParameters = this[kMockAgentAcceptsNonStandardSearchParameters];
         const dispatchOpts = { ...opts };
         if (acceptNonStandardSearchParameters && dispatchOpts.path) {
-          const [path44, searchParams] = dispatchOpts.path.split("?");
+          const [path46, searchParams] = dispatchOpts.path.split("?");
           const normalizedSearchParams = normalizeSearchParams(searchParams, acceptNonStandardSearchParameters);
-          dispatchOpts.path = `${path44}?${normalizedSearchParams}`;
+          dispatchOpts.path = `${path46}?${normalizedSearchParams}`;
         }
         return this[kAgent].dispatch(dispatchOpts, handler);
       }
@@ -19876,12 +19876,12 @@ var require_snapshot_recorder = __commonJS({
        * @return {Promise<void>} - Resolves when snapshots are loaded
        */
       async loadSnapshots(filePath) {
-        const path44 = filePath || this.#snapshotPath;
-        if (!path44) {
+        const path46 = filePath || this.#snapshotPath;
+        if (!path46) {
           throw new InvalidArgumentError2("Snapshot path is required");
         }
         try {
-          const data = await readFile(resolve(path44), "utf8");
+          const data = await readFile(resolve(path46), "utf8");
           const parsed = JSON.parse(data);
           if (Array.isArray(parsed)) {
             this.#snapshots.clear();
@@ -19895,7 +19895,7 @@ var require_snapshot_recorder = __commonJS({
           if (error62.code === "ENOENT") {
             this.#snapshots.clear();
           } else {
-            throw new UndiciError(`Failed to load snapshots from ${path44}`, { cause: error62 });
+            throw new UndiciError(`Failed to load snapshots from ${path46}`, { cause: error62 });
           }
         }
       }
@@ -19906,11 +19906,11 @@ var require_snapshot_recorder = __commonJS({
        * @returns {Promise<void>} - Resolves when snapshots are saved
        */
       async saveSnapshots(filePath) {
-        const path44 = filePath || this.#snapshotPath;
-        if (!path44) {
+        const path46 = filePath || this.#snapshotPath;
+        if (!path46) {
           throw new InvalidArgumentError2("Snapshot path is required");
         }
-        const resolvedPath = resolve(path44);
+        const resolvedPath = resolve(path46);
         await mkdir(dirname2(resolvedPath), { recursive: true });
         const data = Array.from(this.#snapshots.entries()).map(([hash2, snapshot]) => ({
           hash: hash2,
@@ -20542,15 +20542,15 @@ var require_redirect_handler = __commonJS({
           return;
         }
         const { origin, pathname, search } = util.parseURL(new URL(this.location, this.opts.origin && new URL(this.opts.path, this.opts.origin)));
-        const path44 = search ? `${pathname}${search}` : pathname;
-        const redirectUrlString = `${origin}${path44}`;
+        const path46 = search ? `${pathname}${search}` : pathname;
+        const redirectUrlString = `${origin}${path46}`;
         for (const historyUrl of this.history) {
           if (historyUrl.toString() === redirectUrlString) {
             throw new InvalidArgumentError2(`Redirect loop detected. Cannot redirect to ${origin}. This typically happens when using a Client or Pool with cross-origin redirects. Use an Agent for cross-origin redirects.`);
           }
         }
         this.opts.headers = cleanRequestHeaders(this.opts.headers, statusCode === 303, this.opts.origin !== origin);
-        this.opts.path = path44;
+        this.opts.path = path46;
         this.opts.origin = origin;
         this.opts.query = null;
       }
@@ -20817,7 +20817,7 @@ var require_dump = __commonJS({
 var require_dns = __commonJS({
   "node_modules/.pnpm/undici@7.29.1/node_modules/undici/lib/interceptor/dns.js"(exports2, module2) {
     "use strict";
-    var { isIP: isIP2 } = require("node:net");
+    var { isIP: isIP3 } = require("node:net");
     var { lookup } = require("node:dns");
     var DecoratorHandler = require_decorator_handler();
     var { InvalidArgumentError: InvalidArgumentError2, InformationalError } = require_errors();
@@ -21223,7 +21223,7 @@ var require_dns = __commonJS({
       return (dispatch) => {
         return function dnsInterceptor(origDispatchOpts, handler) {
           const origin = origDispatchOpts.origin.constructor === URL ? origDispatchOpts.origin : new URL(origDispatchOpts.origin);
-          if (isIP2(origin.hostname) !== 0) {
+          if (isIP3(origin.hostname) !== 0) {
             return dispatch(origDispatchOpts, handler);
           }
           instance.runLookup(origin, origDispatchOpts, (err, newOrigin) => {
@@ -22310,10 +22310,10 @@ var require_cache_handler = __commonJS({
       }
       return locationUrl.pathname + locationUrl.search;
     }
-    function deleteCachedUri(store, cacheKey, path44) {
+    function deleteCachedUri(store, cacheKey, path46) {
       deleteCachedValue(store, {
         ...cacheKey,
-        path: path44
+        path: path46
       });
       for (let i2 = 0; i2 < util.safeHTTPMethods.length; i2++) {
         const method = util.safeHTTPMethods[i2];
@@ -22321,7 +22321,7 @@ var require_cache_handler = __commonJS({
           deleteCachedValue(store, {
             ...cacheKey,
             method,
-            path: path44
+            path: path46
           });
         }
       }
@@ -22332,9 +22332,9 @@ var require_cache_handler = __commonJS({
       }
       const values = Array.isArray(headerValue2) ? headerValue2 : [headerValue2];
       for (let i2 = 0; i2 < values.length; i2++) {
-        const path44 = getSameOriginPath(cacheKey, values[i2]);
-        if (path44 !== void 0) {
-          deleteCachedUri(store, cacheKey, path44);
+        const path46 = getSameOriginPath(cacheKey, values[i2]);
+        if (path46 !== void 0) {
+          deleteCachedUri(store, cacheKey, path46);
         }
       }
     }
@@ -27334,11 +27334,11 @@ var require_fetch = __commonJS({
       function dispatch({ body }) {
         const url2 = requestCurrentURL(request7);
         const agent = fetchParams.controller.dispatcher;
-        const path44 = url2.pathname + url2.search;
+        const path46 = url2.pathname + url2.search;
         const hasTrailingQuestionMark = url2.search.length === 0 && url2.href[url2.href.length - url2.hash.length - 1] === "?";
         return new Promise((resolve, reject) => agent.dispatch(
           {
-            path: hasTrailingQuestionMark ? `${path44}?` : path44,
+            path: hasTrailingQuestionMark ? `${path46}?` : path46,
             origin: url2.origin,
             method: request7.method,
             body: agent.isMockActive ? request7.body && (request7.body.source || request7.body.stream) : body,
@@ -28285,9 +28285,9 @@ var require_util5 = __commonJS({
         }
       }
     }
-    function validateCookiePath(path44) {
-      for (let i2 = 0; i2 < path44.length; ++i2) {
-        const code = path44.charCodeAt(i2);
+    function validateCookiePath(path46) {
+      for (let i2 = 0; i2 < path46.length; ++i2) {
+        const code = path46.charCodeAt(i2);
         if (code < 32 || // exclude CTLs (0-31)
         code > 126 || // exclude DEL and non-ascii
         code === 59) {
@@ -31635,11 +31635,11 @@ var require_undici = __commonJS({
           if (typeof opts.path !== "string") {
             throw new InvalidArgumentError2("invalid opts.path");
           }
-          let path44 = opts.path;
+          let path46 = opts.path;
           if (!opts.path.startsWith("/")) {
-            path44 = `/${path44}`;
+            path46 = `/${path46}`;
           }
-          url2 = new URL(util.parseOrigin(url2).origin + path44);
+          url2 = new URL(util.parseOrigin(url2).origin + path46);
         } else {
           if (!opts) {
             opts = typeof url2 === "object" ? url2 : {};
@@ -31749,7 +31749,7 @@ ${captureLines}` : capture.stack;
 });
 // src/cli.ts
-var import_node_path42 = __toESM(require("node:path"), 1);
+var import_node_path44 = __toESM(require("node:path"), 1);
 // node_modules/.pnpm/commander@15.0.0/node_modules/commander/lib/error.js
 var CommanderError = class extends Error {
@@ -34862,9 +34862,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
    * @param {string} [path]
    * @return {(string|null|Command)}
    */
-  executableDir(path44) {
-    if (path44 === void 0) return this._executableDir;
-    this._executableDir = path44;
+  executableDir(path46) {
+    if (path46 === void 0) return this._executableDir;
+    this._executableDir = path46;
     return this;
   }
   /**
@@ -36002,15 +36002,15 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path44) {
-  if (!path44)
+function getElementAtPath(obj, path46) {
+  if (!path46)
     return obj;
-  return path44.reduce((acc, key) => acc?.[key], obj);
+  return path46.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
-  const promises = keys.map((key) => promisesObj[key]);
-  return Promise.all(promises).then((results) => {
+  const promises2 = keys.map((key) => promisesObj[key]);
+  return Promise.all(promises2).then((results) => {
     const resolvedObj = {};
     for (let i2 = 0; i2 < keys.length; i2++) {
       resolvedObj[keys[i2]] = results[i2];
@@ -36345,11 +36345,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path44, issues) {
+function prefixIssues(path46, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path44);
+    iss.path.unshift(path46);
     return iss;
   });
 }
@@ -36799,16 +36799,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path44 = []) => {
+  const processError = (error63, path46 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path44, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path46, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path44, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path46, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path44, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path46, ...issue2.path]);
       } else {
-        const fullpath = [...path44, ...issue2.path];
+        const fullpath = [...path46, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -36847,17 +36847,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error63, path44 = []) => {
+  const processError = (error63, path46 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path44, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path46, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path44, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path46, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path44, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path46, ...issue2.path]);
       } else {
-        const fullpath = [...path44, ...issue2.path];
+        const fullpath = [...path46, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -36896,8 +36896,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path44 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path44) {
+  const path46 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path46) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -53999,13 +53999,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path44 = ref.slice(1).split("/").filter(Boolean);
-  if (path44.length === 0) {
+  const path46 = ref.slice(1).split("/").filter(Boolean);
+  if (path46.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path44[0] === defsKey) {
-    const key = path44[1] === void 0 ? void 0 : decodeJSONPointerSegment(path44[1]);
+  if (path46[0] === defsKey) {
+    const key = path46[1] === void 0 ? void 0 : decodeJSONPointerSegment(path46[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -55435,16 +55435,16 @@ function parseJson(raw, schema) {
   const parsed = schema.safeParse(JSON.parse(raw));
   return parsed.success ? parsed.data : void 0;
 }
-function readHeadroomState(fs19, stateFile) {
+function readHeadroomState(fs20, stateFile) {
   try {
-    return parseJson(fs19.readFileUtf8(stateFile), HeadroomStateSchema);
+    return parseJson(fs20.readFileUtf8(stateFile), HeadroomStateSchema);
   } catch {
     return void 0;
   }
 }
-function writeHeadroomState(fs19, stateFile, state) {
-  fs19.mkdirp(import_node_path5.default.dirname(stateFile));
-  fs19.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
+function writeHeadroomState(fs20, stateFile, state) {
+  fs20.mkdirp(import_node_path5.default.dirname(stateFile));
+  fs20.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
 `);
 }
 function headroomAllowlist(providers) {
@@ -55464,14 +55464,14 @@ function headroomUpstreams(providers, frontDoorOrigin2) {
 function hashAllowlist(allowlist) {
   return (0, import_node_crypto2.createHash)("sha256").update(allowlist.join("\n")).digest("hex");
 }
-function readAllProviders(fs19, providersDir) {
+function readAllProviders(fs20, providersDir) {
   const result = [];
-  for (const name of fs19.readdir(providersDir)) {
+  for (const name of fs20.readdir(providersDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = parseJson(fs19.readFileUtf8(import_node_path5.default.join(providersDir, name)), ProviderSchema);
+      const parsed = parseJson(fs20.readFileUtf8(import_node_path5.default.join(providersDir, name)), ProviderSchema);
       if (parsed !== void 0) {
         result.push({ name: name.slice(0, -".json".length), provider: parsed });
       }
@@ -55481,22 +55481,22 @@ function readAllProviders(fs19, providersDir) {
   }
   return result;
 }
-function writeSession(fs19, sessionsDir, session) {
-  fs19.mkdirp(sessionsDir);
-  fs19.writeFileUtf8(import_node_path5.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
+function writeSession(fs20, sessionsDir, session) {
+  fs20.mkdirp(sessionsDir);
+  fs20.writeFileUtf8(import_node_path5.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
 `);
 }
-function removeSession(fs19, sessionsDir, pid) {
-  fs19.removeRecursive(import_node_path5.default.join(sessionsDir, `${String(pid)}.json`));
+function removeSession(fs20, sessionsDir, pid) {
+  fs20.removeRecursive(import_node_path5.default.join(sessionsDir, `${String(pid)}.json`));
 }
-function listSessions(fs19, sessionsDir) {
+function listSessions(fs20, sessionsDir) {
   const sessions = [];
-  for (const name of fs19.readdir(sessionsDir)) {
+  for (const name of fs20.readdir(sessionsDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = parseJson(fs19.readFileUtf8(import_node_path5.default.join(sessionsDir, name)), HeadroomSessionSchema);
+      const parsed = parseJson(fs20.readFileUtf8(import_node_path5.default.join(sessionsDir, name)), HeadroomSessionSchema);
       if (parsed !== void 0) {
         sessions.push(parsed);
       }
@@ -55506,22 +55506,22 @@ function listSessions(fs19, sessionsDir) {
   }
   return sessions.sort((a2, b) => a2.pid - b.pid);
 }
-function sessionsForSupervisor(fs19, sessionsDir, supervisorPid) {
-  return listSessions(fs19, sessionsDir).filter((session) => session.supervisorPid === supervisorPid);
+function sessionsForSupervisor(fs20, sessionsDir, supervisorPid) {
+  return listSessions(fs20, sessionsDir).filter((session) => session.supervisorPid === supervisorPid);
 }
-function pruneDeadSessions(fs19, sessionsDir, isRunning) {
+function pruneDeadSessions(fs20, sessionsDir, isRunning) {
   const removed = [];
-  for (const session of listSessions(fs19, sessionsDir)) {
+  for (const session of listSessions(fs20, sessionsDir)) {
     if (!isRunning(session.pid)) {
-      removeSession(fs19, sessionsDir, session.pid);
+      removeSession(fs20, sessionsDir, session.pid);
       removed.push(session.pid);
     }
   }
   return removed;
 }
-function readStartLock(fs19, lockFile) {
+function readStartLock(fs20, lockFile) {
   try {
-    return parseJson(fs19.readFileUtf8(lockFile), HeadroomLockSchema);
+    return parseJson(fs20.readFileUtf8(lockFile), HeadroomLockSchema);
   } catch {
     return void 0;
   }
@@ -55626,10 +55626,10 @@ var FrontDoorStateSchema = external_exports.strictObject({
   /** The last fatal error, kept across shutdowns so `frontdoor status` can explain a front door that is not running. */
   lastError: external_exports.string().optional()
 });
-function readFrontDoorState(fs19, stateFile) {
+function readFrontDoorState(fs20, stateFile) {
   let raw;
   try {
-    raw = fs19.readFileUtf8(stateFile);
+    raw = fs20.readFileUtf8(stateFile);
   } catch {
     return void 0;
   }
@@ -55643,28 +55643,28 @@ function readFrontDoorState(fs19, stateFile) {
     return void 0;
   }
 }
-function writeFrontDoorState(fs19, stateFile, state) {
-  fs19.mkdirp(import_node_path6.default.dirname(stateFile));
-  fs19.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
+function writeFrontDoorState(fs20, stateFile, state) {
+  fs20.mkdirp(import_node_path6.default.dirname(stateFile));
+  fs20.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
 `);
 }
 function frontDoorOrigin(state) {
   const port = state?.directPort ?? state?.lastDirectPort;
   return port === void 0 ? void 0 : `http://127.0.0.1:${String(port)}`;
 }
-function writeFrontDoorSession(fs19, sessionsDir, session) {
-  fs19.mkdirPrivate(sessionsDir);
-  fs19.writeFilePrivate(import_node_path6.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
+function writeFrontDoorSession(fs20, sessionsDir, session) {
+  fs20.mkdirPrivate(sessionsDir);
+  fs20.writeFilePrivate(import_node_path6.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
 `);
 }
-function listFrontDoorSessions(fs19, sessionsDir) {
+function listFrontDoorSessions(fs20, sessionsDir) {
   const sessions = [];
-  for (const name of fs19.readdir(sessionsDir)) {
+  for (const name of fs20.readdir(sessionsDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs19.readFileUtf8(import_node_path6.default.join(sessionsDir, name)) ?? ""));
+      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs20.readFileUtf8(import_node_path6.default.join(sessionsDir, name)) ?? ""));
       if (parsed.success) {
         sessions.push({ pid: parsed.data.pid, startedAt: parsed.data.startedAt });
       }
@@ -55674,27 +55674,27 @@ function listFrontDoorSessions(fs19, sessionsDir) {
   }
   return sessions.sort((a2, b) => a2.pid - b.pid);
 }
-function removeFrontDoorSession(fs19, sessionsDir, pid) {
-  fs19.removeRecursive(import_node_path6.default.join(sessionsDir, `${String(pid)}.json`));
+function removeFrontDoorSession(fs20, sessionsDir, pid) {
+  fs20.removeRecursive(import_node_path6.default.join(sessionsDir, `${String(pid)}.json`));
 }
-function pruneDeadFrontDoorSessions(fs19, sessionsDir, isRunning) {
+function pruneDeadFrontDoorSessions(fs20, sessionsDir, isRunning) {
   const removed = [];
-  for (const session of listFrontDoorSessions(fs19, sessionsDir)) {
+  for (const session of listFrontDoorSessions(fs20, sessionsDir)) {
     if (!isRunning(session.pid)) {
-      removeFrontDoorSession(fs19, sessionsDir, session.pid);
+      removeFrontDoorSession(fs20, sessionsDir, session.pid);
       removed.push(session.pid);
     }
   }
   return removed;
 }
-function liveSessionTokens(fs19, sessionsDir) {
+function liveSessionTokens(fs20, sessionsDir) {
   const tokens = /* @__PURE__ */ new Set();
-  for (const name of fs19.readdir(sessionsDir)) {
+  for (const name of fs20.readdir(sessionsDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs19.readFileUtf8(import_node_path6.default.join(sessionsDir, name)) ?? ""));
+      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs20.readFileUtf8(import_node_path6.default.join(sessionsDir, name)) ?? ""));
       if (parsed.success) {
         tokens.add(parsed.data.token);
       }
@@ -55777,7 +55777,7 @@ function verifyHeadroomSocket(socketPath, ports) {
   const refusal = ownerOnlyRefusal("socket directory", directory, ports.lstat(directory), "dir", uid) ?? ownerOnlyRefusal("socket", socketPath, ports.lstat(socketPath), "socket", uid);
   return refusal === void 0 ? { socketPath } : { refused: refusal };
 }
-function prepareHeadroomSocket(fs19, ports, paths, supervisorPid) {
+function prepareHeadroomSocket(fs20, ports, paths, supervisorPid) {
   const unsupported = platformRefusal(ports.platform);
   if (unsupported !== void 0) {
     return { refused: unsupported };
@@ -55792,18 +55792,18 @@ function prepareHeadroomSocket(fs19, ports, paths, supervisorPid) {
   if (ports.lstat(paths.headroomSocketDir)?.kind === "symlink") {
     return { refused: `the headroom socket directory ${paths.headroomSocketDir} is a symlink; it must be the real directory` };
   }
-  fs19.mkdirPrivate(paths.headroomSocketDir);
+  fs20.mkdirPrivate(paths.headroomSocketDir);
   const refusal = ownerOnlyRefusal("socket directory", paths.headroomSocketDir, ports.lstat(paths.headroomSocketDir), "dir", ports.currentUid());
   return refusal === void 0 ? { socketPath } : { refused: refusal };
 }
-function pruneStaleHeadroomSockets(fs19, paths, isRunning) {
+function pruneStaleHeadroomSockets(fs20, paths, isRunning) {
   const removed = [];
-  for (const name of fs19.readdir(paths.headroomSocketDir)) {
+  for (const name of fs20.readdir(paths.headroomSocketDir)) {
     const pid = HEADROOM_SOCKET_NAME.exec(name)?.[1];
     if (pid === void 0 || isRunning(Number.parseInt(pid, 10))) {
       continue;
     }
-    fs19.removeRecursive(import_node_path7.default.join(paths.headroomSocketDir, name));
+    fs20.removeRecursive(import_node_path7.default.join(paths.headroomSocketDir, name));
     removed.push(name);
   }
   return removed;
@@ -55933,28 +55933,28 @@ function compareVersions2(a2, b) {
 }
 var HEADROOM_SUPERVISOR_STILL_RUNNING = -1;
 async function runSupervisor(initialConfig, ports, options = {}) {
-  const { fs: fs19, paths } = ports;
+  const { fs: fs20, paths } = ports;
   let config2 = initialConfig;
-  const previousState = readHeadroomState(fs19, paths.headroomStateFile);
+  const previousState = readHeadroomState(fs20, paths.headroomStateFile);
   if (previousState?.supervisorPid !== void 0 && previousState.supervisorPid !== ports.ownPid && ports.isRunning(previousState.supervisorPid)) {
     ports.log(`agent-shim headroom supervisor ${String(ports.ownPid)}: supervisor ${String(previousState.supervisorPid)} already owns the daemon; exiting`);
     return 0;
   }
   let installedSource = previousState?.installedSource;
   const ownsState = () => {
-    const owner = readHeadroomState(fs19, paths.headroomStateFile)?.supervisorPid;
+    const owner = readHeadroomState(fs20, paths.headroomStateFile)?.supervisorPid;
     return owner === void 0 || owner === ports.ownPid || !ports.isRunning(owner);
   };
   const writeOwnState = (state) => {
     if (!ownsState()) {
       return false;
     }
-    writeHeadroomState(fs19, paths.headroomStateFile, state);
+    writeHeadroomState(fs20, paths.headroomStateFile, state);
     return true;
   };
   const fail = (message) => {
     if (writeOwnState({ lastError: message })) {
-      fs19.removeRecursive(paths.headroomLockFile);
+      fs20.removeRecursive(paths.headroomLockFile);
     }
     ports.log(`agent-shim headroom supervisor: ${message}`);
     return 1;
@@ -55976,12 +55976,12 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     installedSource = config2.source;
     return true;
   };
-  const socket = prepareHeadroomSocket(fs19, ports.socketTrust, paths, ports.ownPid);
+  const socket = prepareHeadroomSocket(fs20, ports.socketTrust, paths, ports.ownPid);
   if (socket.refused !== void 0) {
     return fail(socket.refused);
   }
   const { socketPath } = socket;
-  pruneStaleHeadroomSockets(fs19, paths, ports.isRunning);
+  pruneStaleHeadroomSockets(fs20, paths, ports.isRunning);
   if (!ensureInstalled()) {
     return fail(`could not install headroom from ${config2.source}: install failed (is uv installed and on PATH?)`);
   }
@@ -56009,7 +56009,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     const settingsHash = hashSettings(config2.settings);
     const allowlist = allowlistOf(ports);
     const allowlistHash = hashAllowlist(allowlist);
-    pruneDeadSessions(fs19, paths.headroomSessionsDir, ports.isRunning);
+    pruneDeadSessions(fs20, paths.headroomSessionsDir, ports.isRunning);
     const ownsNow = ownsState();
     if (!ownsNow && !superseded) {
       ports.log("agent-shim headroom supervisor: another supervisor now owns the state file; serving this daemon's own sessions until they end");
@@ -56051,7 +56051,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
           installedSource: config2.source
         });
         if (recorded) {
-          fs19.removeRecursive(paths.headroomLockFile);
+          fs20.removeRecursive(paths.headroomLockFile);
         }
         idleSince = void 0;
         ports.log(`agent-shim headroom supervisor: headroom pid ${String(pid)} ready on unix socket ${socketPath}`);
@@ -56066,7 +56066,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
       }
     } else {
       if (runningHash !== allowlistHash || runningSettingsHash !== settingsHash || installedSource !== config2.source) {
-        if (sessionsForSupervisor(fs19, paths.headroomSessionsDir, ports.ownPid).length === 0) {
+        if (sessionsForSupervisor(fs20, paths.headroomSessionsDir, ports.ownPid).length === 0) {
           ports.log("agent-shim headroom supervisor: configuration drifted and no sessions are live; restarting headroom");
           ports.stopProcess(headroomPid);
           headroomPid = void 0;
@@ -56075,7 +56075,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
           continue;
         }
       }
-      const sessions = sessionsForSupervisor(fs19, paths.headroomSessionsDir, ports.ownPid);
+      const sessions = sessionsForSupervisor(fs20, paths.headroomSessionsDir, ports.ownPid);
       if (sessions.length === 0) {
         idleSince ??= ports.now();
         const idleMs = ports.now() - idleSince;
@@ -56094,9 +56094,9 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     await ports.sleep(HEADROOM_POLL_MS);
   }
 }
-function currentHeadroomAllowlist(fs19, paths) {
-  const providers = readAllProviders(fs19, paths.providersDir).map((entry) => entry.provider);
-  return headroomAllowlist(headroomUpstreams(providers, frontDoorOrigin(readFrontDoorState(fs19, paths.frontdoorStateFile))));
+function currentHeadroomAllowlist(fs20, paths) {
+  const providers = readAllProviders(fs20, paths.providersDir).map((entry) => entry.provider);
+  return headroomAllowlist(headroomUpstreams(providers, frontDoorOrigin(readFrontDoorState(fs20, paths.frontdoorStateFile))));
 }
 function allowlistOf(ports) {
   return currentHeadroomAllowlist(ports.fs, ports.paths);
@@ -58142,8 +58142,8 @@ function decideConfigProfile(params) {
   }
   return { source: "none" };
 }
-function loadIdentity(identitiesDir, name, fs19) {
-  return loadConfigFile(import_node_path10.default.join(identitiesDir, name, "identity.json"), IdentitySchema, fs19.readConfigFile);
+function loadIdentity(identitiesDir, name, fs20) {
+  return loadConfigFile(import_node_path10.default.join(identitiesDir, name, "identity.json"), IdentitySchema, fs20.readConfigFile);
 }
 // src/configProfilesStore.ts
@@ -58311,19 +58311,19 @@ function writePools(paths, pools) {
   applyPatch(paths.globalConfigFile, GlobalConfigSchema, { pools }, { defaults: {} });
 }
 function poolCycleOf(pools, name) {
-  const walk = (current, path44) => {
+  const walk = (current, path46) => {
     for (const entry of pools[current]?.identities ?? []) {
       const nested = poolNameOf(entry);
       if (nested === void 0) {
         continue;
       }
       if (nested === name) {
-        return [...path44, nested];
+        return [...path46, nested];
       }
-      if (path44.includes(nested)) {
+      if (path46.includes(nested)) {
         continue;
       }
-      const found = walk(nested, [...path44, nested]);
+      const found = walk(nested, [...path46, nested]);
       if (found !== void 0) {
         return found;
       }
@@ -59815,8 +59815,8 @@ var FarmManifestSchema = external_exports.strictObject({
   materialised: external_exports.array(external_exports.string()),
   links: external_exports.array(external_exports.strictObject({ rel: external_exports.string(), target: external_exports.string() }))
 });
-function readFarmManifest(fs19, farmRoot) {
-  const raw = fs19.readFileUtf8(import_node_path18.default.join(farmRoot, FARM_MANIFEST_FILENAME)) ?? fs19.readFileUtf8(import_node_path18.default.join(farmRoot, LEGACY_FARM_MANIFEST_FILENAME));
+function readFarmManifest(fs20, farmRoot) {
+  const raw = fs20.readFileUtf8(import_node_path18.default.join(farmRoot, FARM_MANIFEST_FILENAME)) ?? fs20.readFileUtf8(import_node_path18.default.join(farmRoot, LEGACY_FARM_MANIFEST_FILENAME));
   if (raw === void 0) {
     return void 0;
   }
@@ -59874,9 +59874,9 @@ function buildEntryFacts(params) {
     entries
   };
 }
-function listSubtree(fs19, root, rel) {
+function listSubtree(fs20, root, rel) {
   const absolute = import_node_path18.default.join(root, rel);
-  const stat = fs19.lstat(absolute);
+  const stat = fs20.lstat(absolute);
   if (stat === void 0) {
     return [];
   }
@@ -59884,10 +59884,10 @@ function listSubtree(fs19, root, rel) {
     return [{ rel, kind: "symlink" }];
   }
   if (stat.kind === "dir") {
-    const children = [...fs19.readdir(absolute)].sort().flatMap((name) => listSubtree(fs19, root, `${rel}/${name}`));
+    const children = [...fs20.readdir(absolute)].sort().flatMap((name) => listSubtree(fs20, root, `${rel}/${name}`));
     return [{ rel, kind: "dir" }, ...children];
   }
-  const contentHash = fs19.hashFile(absolute);
+  const contentHash = fs20.hashFile(absolute);
   return [{ rel, kind: "file", ...contentHash === void 0 ? {} : { contentHash } }];
 }
 function topLevelScopeRoots(roots) {
@@ -59901,25 +59901,25 @@ function topLevelScopeRoots(roots) {
   }
   return kept;
 }
-function reconciliationScope(fs19, farmRoot, manifest) {
+function reconciliationScope(fs20, farmRoot, manifest) {
   if (manifest !== void 0) {
     return topLevelScopeRoots(manifest.materialised);
   }
-  return [...fs19.readdir(farmRoot)].filter((name) => name !== FARM_MANIFEST_FILENAME && name !== LEGACY_FARM_MANIFEST_FILENAME && fs19.lstat(import_node_path18.default.join(farmRoot, name))?.kind === "dir").sort();
+  return [...fs20.readdir(farmRoot)].filter((name) => name !== FARM_MANIFEST_FILENAME && name !== LEGACY_FARM_MANIFEST_FILENAME && fs20.lstat(import_node_path18.default.join(farmRoot, name))?.kind === "dir").sort();
 }
-function collectFarmListing(fs19, farmRoot, scopeRoots) {
-  return scopeRoots.flatMap((root) => listSubtree(fs19, farmRoot, root));
+function collectFarmListing(fs20, farmRoot, scopeRoots) {
+  return scopeRoots.flatMap((root) => listSubtree(fs20, farmRoot, root));
 }
-function collectCanonicalCounterparts(fs19, claudeHome, farmListing) {
+function collectCanonicalCounterparts(fs20, claudeHome, farmListing) {
   const out = [];
   for (const entry of farmListing) {
     const absolute = import_node_path18.default.join(claudeHome, entry.rel);
-    const stat = fs19.lstat(absolute);
+    const stat = fs20.lstat(absolute);
     if (stat === void 0) {
       continue;
     }
     if (stat.kind === "file") {
-      const contentHash = fs19.hashFile(absolute);
+      const contentHash = fs20.hashFile(absolute);
       out.push({ rel: entry.rel, kind: "file", ...contentHash === void 0 ? {} : { contentHash } });
       continue;
     }
@@ -61790,7 +61790,7 @@ function registerIdentityCommand(program2, deps) {
 // package.json
 var package_default = {
   name: "agent-shim",
-  version: "8.20.2",
+  version: "8.21.1",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -62068,12 +62068,12 @@ function isIdentityName(name) {
 function claudeJsonPath(identitiesDir, identity) {
   return import_node_path23.default.join(identitiesDir, identity, CLAUDE_JSON);
 }
-function readAccountMetadata(fs19, identitiesDir, identity) {
+function readAccountMetadata(fs20, identitiesDir, identity) {
   if (!isIdentityName(identity)) {
     throw new Error(`"${identity}" is not a valid identity name.`);
   }
   const file2 = claudeJsonPath(identitiesDir, identity);
-  const raw = fs19.readFileUtf8(file2);
+  const raw = fs20.readFileUtf8(file2);
   if (raw === void 0) {
     return void 0;
   }
@@ -62103,19 +62103,19 @@ function readAccountMetadata(fs19, identitiesDir, identity) {
   }
   return account.data;
 }
-function createAccountReader(fs19, identitiesDir) {
+function createAccountReader(fs20, identitiesDir) {
   const cache = /* @__PURE__ */ new Map();
   return (identity) => {
     if (!isIdentityName(identity)) {
       throw new Error(`"${identity}" is not a valid identity name.`);
     }
-    const stat = fs19.lstat(claudeJsonPath(identitiesDir, identity));
+    const stat = fs20.lstat(claudeJsonPath(identitiesDir, identity));
     const stamp = stat === void 0 ? "absent" : `${String(stat.mtimeMs)}:${String(stat.sizeBytes)}`;
     const cached2 = cache.get(identity);
     if (cached2?.stamp === stamp) {
       return cached2.account;
     }
-    const account = readAccountMetadata(fs19, identitiesDir, identity);
+    const account = readAccountMetadata(fs20, identitiesDir, identity);
     cache.set(identity, { stamp, account });
     return account;
   };
@@ -62222,11 +62222,11 @@ var PROVIDER_PATH_PREFIX = "/providers/";
 function directOrigin(port) {
   return `http://127.0.0.1:${String(port)}`;
 }
-function parseProviderPath(path44) {
-  if (!path44.startsWith(PROVIDER_PATH_PREFIX)) {
+function parseProviderPath(path46) {
+  if (!path46.startsWith(PROVIDER_PATH_PREFIX)) {
     return void 0;
   }
-  const tail = path44.slice(PROVIDER_PATH_PREFIX.length);
+  const tail = path46.slice(PROVIDER_PATH_PREFIX.length);
   const slash = tail.indexOf("/");
   if (slash <= 0) {
     return void 0;
@@ -62626,9 +62626,9 @@ function decoderFor(encoding) {
       return void 0;
   }
 }
-function destinationOf(path44) {
-  const scoped = parseProviderPath(path44);
-  return scoped === void 0 ? { provider: ANTHROPIC_PROVIDER, endpoint: path44 } : { provider: scoped.provider, endpoint: scoped.rest };
+function destinationOf(path46) {
+  const scoped = parseProviderPath(path46);
+  return scoped === void 0 ? { provider: ANTHROPIC_PROVIDER, endpoint: path46 } : { provider: scoped.provider, endpoint: scoped.rest };
 }
 function buildRecord(event, context) {
   const { scan } = context;
@@ -62923,8 +62923,8 @@ function segmentDay(epochMs) {
 function segmentName(day, pid) {
   return `${day}.${String(pid)}.jsonl`;
 }
-function listLogSegments(fs19, logDir) {
-  return fs19.readdir(logDir).flatMap((name) => {
+function listLogSegments(fs20, logDir) {
+  return fs20.readdir(logDir).flatMap((name) => {
     const match = SEGMENT_RE.exec(name);
     const day = match?.[1];
     if (day === void 0) {
@@ -62933,15 +62933,15 @@ function listLogSegments(fs19, logDir) {
     return [{ name, day, endsAt: Date.parse(`${day}T00:00:00.000Z`) + DAY_MS }];
   }).sort((left, right) => left.day.localeCompare(right.day) || left.name.localeCompare(right.name));
 }
-function readUsageLog(fs19, logDir, options = {}) {
+function readUsageLog(fs20, logDir, options = {}) {
   const { sinceMs } = options;
   const records = [];
   let invalidLines = 0;
-  for (const segment of listLogSegments(fs19, logDir)) {
+  for (const segment of listLogSegments(fs20, logDir)) {
     if (sinceMs !== void 0 && segment.endsAt <= sinceMs) {
       continue;
     }
-    const contents = fs19.readFileUtf8(import_node_path24.default.join(logDir, segment.name));
+    const contents = fs20.readFileUtf8(import_node_path24.default.join(logDir, segment.name));
     if (contents === void 0) {
       continue;
     }
@@ -62985,9 +62985,9 @@ function snapshotPath(snapshotsDir, identity) {
   }
   return import_node_path24.default.join(snapshotsDir, `${identity}.json`);
 }
-function readUsageSnapshot(fs19, snapshotsDir, identity) {
+function readUsageSnapshot(fs20, snapshotsDir, identity) {
   const file2 = snapshotPath(snapshotsDir, identity);
-  const raw = fs19.readFileUtf8(file2);
+  const raw = fs20.readFileUtf8(file2);
   if (raw === void 0) {
     return void 0;
   }
@@ -63003,8 +63003,8 @@ function readUsageSnapshot(fs19, snapshotsDir, identity) {
   }
   return snapshot.data;
 }
-function listUsageSnapshots(fs19, snapshotsDir) {
-  return fs19.readdir(snapshotsDir).flatMap((name) => {
+function listUsageSnapshots(fs20, snapshotsDir) {
+  return fs20.readdir(snapshotsDir).flatMap((name) => {
     if (!name.endsWith(".json")) {
       return [];
     }
@@ -63012,7 +63012,7 @@ function listUsageSnapshots(fs19, snapshotsDir) {
     if (!isIdentityName(identity)) {
       return [];
     }
-    const snapshot = readUsageSnapshot(fs19, snapshotsDir, identity);
+    const snapshot = readUsageSnapshot(fs20, snapshotsDir, identity);
     return snapshot === void 0 ? [] : [snapshot];
   }).sort((left, right) => left.identity.localeCompare(right.identity));
 }
@@ -63071,11 +63071,11 @@ var import_node_path25 = __toESM(require("node:path"), 1);
 var DAY_MS2 = 864e5;
 var DAYS_IN_WEEK = 7;
 var USAGE_RETENTION_MS = DAYS_IN_WEEK * DAY_MS2;
-function pruneUsageLog(fs19, logDir, nowMs) {
+function pruneUsageLog(fs20, logDir, nowMs) {
   const cutoff = nowMs - USAGE_RETENTION_MS;
-  for (const segment of listLogSegments(fs19, logDir)) {
+  for (const segment of listLogSegments(fs20, logDir)) {
     if (segment.endsAt <= cutoff) {
-      fs19.removeRecursive(import_node_path25.default.join(logDir, segment.name));
+      fs20.removeRecursive(import_node_path25.default.join(logDir, segment.name));
     }
   }
 }
@@ -63104,7 +63104,7 @@ function foldProviderState(current, record2) {
   };
 }
 function createUsageStore(deps) {
-  const { fs: fs19, paths } = deps;
+  const { fs: fs20, paths } = deps;
   let prunedDay;
   const rewriteSnapshot = (identity, fold) => {
     if (!isIdentityName(identity)) {
@@ -63113,7 +63113,7 @@ function createUsageStore(deps) {
     }
     let current;
     try {
-      current = readUsageSnapshot(fs19, paths.usageSnapshotsDir, identity);
+      current = readUsageSnapshot(fs20, paths.usageSnapshotsDir, identity);
     } catch (error62) {
       if (!(error62 instanceof UsageSnapshotError)) {
         throw error62;
@@ -63140,8 +63140,8 @@ function createUsageStore(deps) {
       ...account === void 0 ? {} : { account },
       providers
     });
-    fs19.mkdirPrivate(paths.usageSnapshotsDir);
-    fs19.writeFilePrivate(snapshotPath(paths.usageSnapshotsDir, identity), `${JSON.stringify(snapshot, null, 2)}
+    fs20.mkdirPrivate(paths.usageSnapshotsDir);
+    fs20.writeFilePrivate(snapshotPath(paths.usageSnapshotsDir, identity), `${JSON.stringify(snapshot, null, 2)}
 `);
     return true;
   };
@@ -63149,14 +63149,14 @@ function createUsageStore(deps) {
     record: (input2) => {
       const record2 = UsageRecordSchema.parse(input2);
       const nowMs = deps.now();
-      fs19.mkdirPrivate(paths.usageDir);
-      fs19.mkdirPrivate(paths.usageLogDir);
+      fs20.mkdirPrivate(paths.usageDir);
+      fs20.mkdirPrivate(paths.usageLogDir);
       const day = segmentDay(nowMs);
       if (prunedDay !== day) {
-        pruneUsageLog(fs19, paths.usageLogDir, nowMs);
+        pruneUsageLog(fs20, paths.usageLogDir, nowMs);
         prunedDay = day;
       }
-      fs19.appendFilePrivate(import_node_path25.default.join(paths.usageLogDir, segmentName(day, deps.pid)), `${JSON.stringify(record2)}
+      fs20.appendFilePrivate(import_node_path25.default.join(paths.usageLogDir, segmentName(day, deps.pid)), `${JSON.stringify(record2)}
 `);
       if (record2.identity !== void 0) {
         rewriteSnapshot(record2.identity, (current) => ({ ...current?.providers, [record2.provider]: foldProviderState(current?.providers[record2.provider], record2) }));
@@ -63189,14 +63189,14 @@ var PicksFileSchema = external_exports.strictObject({
 function errorMessage(error62) {
   return error62 instanceof Error ? error62.message : String(error62);
 }
-function loadPoolMembers(fs19, paths, identities, nowMs) {
+function loadPoolMembers(fs20, paths, identities, nowMs) {
   const windowStartMs = nowMs - FIVE_HOUR_WINDOW_MS;
-  const log = readUsageLog(fs19, paths.usageLogDir, { sinceMs: windowStartMs });
+  const log = readUsageLog(fs20, paths.usageLogDir, { sinceMs: windowStartMs });
   return identities.map((identity) => {
     const records = log.records.filter((record2) => record2.identity === identity && record2.provider === ANTHROPIC_PROVIDER && Date.parse(record2.at) >= windowStartMs);
     try {
-      const snapshot = readUsageSnapshot(fs19, paths.usageSnapshotsDir, identity);
-      const account = readAccountMetadata(fs19, paths.identitiesDir, identity) ?? snapshot?.account;
+      const snapshot = readUsageSnapshot(fs20, paths.usageSnapshotsDir, identity);
+      const account = readAccountMetadata(fs20, paths.identitiesDir, identity) ?? snapshot?.account;
       return { identity, records, ...snapshot === void 0 ? {} : { snapshot }, ...account === void 0 ? {} : { account } };
     } catch (error62) {
       if (error62 instanceof UsageSnapshotError || error62 instanceof AccountMetadataError) {
@@ -63264,9 +63264,9 @@ function nestedMember(input2, nestedName, childStack, sticky) {
     missing: nested.missing
   };
 }
-function readPicksFile(fs19, file2) {
+function readPicksFile(fs20, file2) {
   const empty = { schemaVersion: SCHEMA_VERSION, picks: {} };
-  const raw = fs19.readFileUtf8(file2);
+  const raw = fs20.readFileUtf8(file2);
   if (raw === void 0) {
     return { file: empty };
   }
@@ -63279,17 +63279,17 @@ function readPicksFile(fs19, file2) {
   const result = PicksFileSchema.safeParse(parsed);
   return result.success ? { file: result.data } : { file: empty, problem: `${file2} is not a picks file this agent-shim can read` };
 }
-function readStickyPick(fs19, picksFile, directory) {
-  const read = readPicksFile(fs19, picksFile);
+function readStickyPick(fs20, picksFile, directory) {
+  const read = readPicksFile(fs20, picksFile);
   const entry = read.file.picks[directory];
   return { ...entry === void 0 ? {} : { sticky: entry }, ...read.problem === void 0 ? {} : { problem: read.problem } };
 }
-function recordStickyPick(fs19, picksFile, directory, identity, nowMs) {
-  const current = readPicksFile(fs19, picksFile).file.picks;
+function recordStickyPick(fs20, picksFile, directory, identity, nowMs) {
+  const current = readPicksFile(fs20, picksFile).file.picks;
   const kept = Object.entries(current).filter(([, entry]) => nowMs - Date.parse(entry.at) <= USAGE_RETENTION_MS);
   const next = { schemaVersion: SCHEMA_VERSION, picks: { ...Object.fromEntries(kept), [directory]: { identity, at: new Date(nowMs).toISOString() } } };
-  fs19.mkdirPrivate(import_node_path26.default.dirname(picksFile));
-  fs19.writeFilePrivate(picksFile, `${JSON.stringify(next, null, 2)}
+  fs20.mkdirPrivate(import_node_path26.default.dirname(picksFile));
+  fs20.writeFilePrivate(picksFile, `${JSON.stringify(next, null, 2)}
 `);
 }
@@ -65652,8 +65652,8 @@ var FRONTDOOR_SUPERVISOR_STILL_RUNNING = -1;
 var FRONTDOOR_POLL_MS = 1e3;
 var MS_PER_MINUTE2 = 6e4;
 async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {}) {
-  const { fs: fs19, paths } = ports;
-  const previous = readFrontDoorState(fs19, paths.frontdoorStateFile);
+  const { fs: fs20, paths } = ports;
+  const previous = readFrontDoorState(fs20, paths.frontdoorStateFile);
   let lastPort = previous?.lastPort;
   let lastConnectPort = previous?.lastConnectPort;
   let lastDirectPort = previous?.lastDirectPort;
@@ -65664,29 +65664,29 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
   });
   const fail = (message) => {
     ports.closeRcStreamHub();
-    writeFrontDoorState(fs19, paths.frontdoorStateFile, { lastError: message, ...sticky() });
-    fs19.removeRecursive(paths.frontdoorLockFile);
+    writeFrontDoorState(fs20, paths.frontdoorStateFile, { lastError: message, ...sticky() });
+    fs20.removeRecursive(paths.frontdoorLockFile);
     ports.log(`agent-shim frontdoor supervisor: ${message}`);
     return 1;
   };
-  writeFrontDoorState(fs19, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, ...sticky() });
+  writeFrontDoorState(fs20, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, ...sticky() });
   const previousSticky = lastPort;
-  let http7;
+  let http8;
   try {
-    http7 = await ports.startProviderListener(lastPort);
+    http8 = await ports.startProviderListener(lastPort);
   } catch (error62) {
     return fail(`could not start the provider listener: ${error62 instanceof Error ? error62.message : String(error62)}`);
   }
-  if (previousSticky !== void 0 && http7.port !== previousSticky) {
-    ports.log(`agent-shim frontdoor supervisor: sticky port ${String(previousSticky)} was occupied; moving to ${String(http7.port)} (sessions launched against the old port are stale until they relaunch)`);
+  if (previousSticky !== void 0 && http8.port !== previousSticky) {
+    ports.log(`agent-shim frontdoor supervisor: sticky port ${String(previousSticky)} was occupied; moving to ${String(http8.port)} (sessions launched against the old port are stale until they relaunch)`);
   }
-  lastPort = http7.port;
+  lastPort = http8.port;
   const previousStickyConnect = lastConnectPort;
   let connect3;
   try {
     connect3 = await ports.startConnectListener(lastConnectPort);
   } catch (error62) {
-    await http7.close();
+    await http8.close();
     return fail(`could not start the CONNECT surface: ${error62 instanceof Error ? error62.message : String(error62)}`);
   }
   if (previousStickyConnect !== void 0 && connect3.port !== previousStickyConnect) {
@@ -65699,16 +65699,16 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     direct = await ports.startDirectListener(lastDirectPort);
   } catch (error62) {
     await connect3.close();
-    await http7.close();
+    await http8.close();
     return fail(`could not start the direct listener: ${error62 instanceof Error ? error62.message : String(error62)}`);
   }
   if (previousStickyDirect !== void 0 && direct.port !== previousStickyDirect) {
     ports.log(`agent-shim frontdoor supervisor: sticky direct port ${String(previousStickyDirect)} was occupied; moving to ${String(direct.port)} (headroom must be restarted to admit the new address)`);
   }
   lastDirectPort = direct.port;
-  writeFrontDoorState(fs19, paths.frontdoorStateFile, { protocol: FRONT_DOOR_PROTOCOL, supervisorPid: ports.ownPid, port: http7.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
-  fs19.removeRecursive(paths.frontdoorLockFile);
-  ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http7.port)}, CONNECT surface on 127.0.0.1:${String(connect3.port)}`);
+  writeFrontDoorState(fs20, paths.frontdoorStateFile, { protocol: FRONT_DOOR_PROTOCOL, supervisorPid: ports.ownPid, port: http8.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
+  fs20.removeRecursive(paths.frontdoorLockFile);
+  ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http8.port)}, CONNECT surface on 127.0.0.1:${String(connect3.port)}`);
   let idleSince;
   let ticks = 0;
   for (; ; ) {
@@ -65716,8 +65716,8 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
       return FRONTDOOR_SUPERVISOR_STILL_RUNNING;
     }
     ticks += 1;
-    const listed = listFrontDoorSessions(fs19, paths.frontdoorSessionsDir);
-    const pruned = pruneDeadFrontDoorSessions(fs19, paths.frontdoorSessionsDir, ports.isRunning);
+    const listed = listFrontDoorSessions(fs20, paths.frontdoorSessionsDir);
+    const pruned = pruneDeadFrontDoorSessions(fs20, paths.frontdoorSessionsDir, ports.isRunning);
     ports.observeLaunchRegistry(listed, pruned);
     const prunedPids = new Set(pruned);
     if (listed.filter((session) => !prunedPids.has(session.pid)).length === 0) {
@@ -65726,9 +65726,9 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
         ports.log(`agent-shim frontdoor supervisor: no sessions for ${String(idleShutdownMinutes)} minute(s); closing the front door and exiting`);
         await direct.close();
         await connect3.close();
-        await http7.close();
+        await http8.close();
         ports.closeRcStreamHub();
-        writeFrontDoorState(fs19, paths.frontdoorStateFile, sticky());
+        writeFrontDoorState(fs20, paths.frontdoorStateFile, sticky());
         return 0;
       }
     } else {
@@ -65781,8 +65781,8 @@ function parseConnectTarget(authority) {
   }
   return { host, port };
 }
-function servedByPipeline(path44) {
-  return path44?.startsWith(ROUTED_PATH_PREFIX) === true;
+function servedByPipeline(path46) {
+  return path46?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
   "connection",
@@ -66308,11 +66308,11 @@ function createRcSessionTracker(deps) {
   };
   const observeExchange = (request7) => {
     const method = (request7.method ?? "").toUpperCase();
-    const path44 = new URL(request7.url ?? "/", "http://127.0.0.1").pathname;
-    if (!path44.startsWith(RC_SESSIONS_PATH_PREFIX)) {
+    const path46 = new URL(request7.url ?? "/", "http://127.0.0.1").pathname;
+    if (!path46.startsWith(RC_SESSIONS_PATH_PREFIX)) {
       return void 0;
     }
-    const tail = path44.slice(RC_SESSIONS_PATH_PREFIX.length);
+    const tail = path46.slice(RC_SESSIONS_PATH_PREFIX.length);
     const facts = {
       oauthAuthorization: oauthAuthorizationOf(request7.headers),
       anthropicVersion: singleHeader(request7.headers, "anthropic-version"),
@@ -67052,9 +67052,9 @@ function sequenceNumsOfBody(body) {
 }
 function frontDoorRcControl(transport, token) {
   const headers = { authorization: `Bearer ${token}` };
-  const listAnswerOf = async (path44, what) => {
+  const listAnswerOf = async (path46, what) => {
     try {
-      return await transport.request({ method: "GET", path: path44, headers });
+      return await transport.request({ method: "GET", path: path46, headers });
     } catch (error62) {
       throw new Error(`${what}: could not reach the front door's control listener: ${error62 instanceof Error ? error62.message : String(error62)}`, { cause: error62 });
     }
@@ -67126,10 +67126,10 @@ function frontDoorRcControl(transport, token) {
     }
     return pending;
   };
-  const writeOf = async (path44, body, describeFailure) => {
+  const writeOf = async (path46, body, describeFailure) => {
     let answer;
     try {
-      answer = await transport.request({ method: "POST", path: path44, headers: { ...headers, "content-type": "application/json" }, body });
+      answer = await transport.request({ method: "POST", path: path46, headers: { ...headers, "content-type": "application/json" }, body });
     } catch (error62) {
       return { ok: false, message: `could not reach the front door's control listener: ${error62 instanceof Error ? error62.message : String(error62)}` };
     }
@@ -67503,12 +67503,12 @@ function lateRcStreamDial(resolve) {
 }
 function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const request7 = async (method, path44, headers, body, signal) => await new Promise((resolve, reject) => {
+  const request7 = async (method, path46, headers, body, signal) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method,
-      path: path44,
+      path: path46,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, ...body === void 0 ? {} : { "content-length": String(Buffer.byteLength(body, "utf8")) } },
       agent,
@@ -67545,9 +67545,9 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
       return { status, body: await readAll(response) };
     },
     openStream: async (sessionId, headers, resume, signal) => {
-      const path44 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
+      const path46 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
       const streamHeaders = resume === void 0 ? headers : { ...headers, "last-event-id": String(resume.fromSequenceNum) };
-      const { status, response } = await request7("GET", path44, streamHeaders, void 0, signal);
+      const { status, response } = await request7("GET", path46, streamHeaders, void 0, signal);
       if (!isSuccessful2(status)) {
         await readAll(response);
         return { status, chunks: NO_CHUNKS };
@@ -69233,9 +69233,9 @@ function resolveFriendlyClientOptions(options) {
   };
 }
 function createORPCClient(link, options = {}) {
-  const path44 = options.path ?? [];
+  const path46 = options.path ?? [];
   const procedureClient = async (...[input2, options2 = {}]) => {
-    return await link.call(path44, input2, resolveFriendlyClientOptions(options2));
+    return await link.call(path46, input2, resolveFriendlyClientOptions(options2));
   };
   const recursive2 = new Proxy(procedureClient, {
     get(target, key) {
@@ -69244,7 +69244,7 @@ function createORPCClient(link, options = {}) {
       }
       return createORPCClient(link, {
         ...options,
-        path: [...path44, key]
+        path: [...path46, key]
       });
     }
   });
@@ -69826,19 +69826,19 @@ var StandardLink = class {
   }
   interceptors;
   clientInterceptors;
-  call(path44, input2, options) {
+  call(path46, input2, options) {
     return runWithSpan(
-      { name: `${ORPC_NAME}.${path44.join("/")}`, signal: options.signal },
+      { name: `${ORPC_NAME}.${path46.join("/")}`, signal: options.signal },
       (span) => {
         span?.setAttribute("rpc.system", ORPC_NAME);
-        span?.setAttribute("rpc.method", path44.join("."));
+        span?.setAttribute("rpc.method", path46.join("."));
         if (isAsyncIteratorObject(input2)) {
           input2 = asyncIteratorWithSpan(
             { name: "consume_event_iterator_input", signal: options.signal },
             input2
           );
         }
-        return intercept(this.interceptors, { ...options, path: path44, input: input2 }, async ({ path: path210, input: input22, ...options2 }) => {
+        return intercept(this.interceptors, { ...options, path: path46, input: input2 }, async ({ path: path210, input: input22, ...options2 }) => {
           const otelConfig = getGlobalOtelConfig();
           let otelContext;
           const currentSpan = otelConfig?.trace.getActiveSpan() ?? span;
@@ -70073,8 +70073,8 @@ var StandardRPCJsonSerializer = class {
     return ref.data;
   }
 };
-function toHttpPath(path44) {
-  return `/${path44.map(encodeURIComponent).join("/")}`;
+function toHttpPath(path46) {
+  return `/${path46.map(encodeURIComponent).join("/")}`;
 }
 function toStandardHeaders2(headers) {
   if (typeof headers.forEach === "function") {
@@ -70099,18 +70099,18 @@ var StandardRPCLinkCodec = class {
   fallbackMethod;
   expectedMethod;
   headers;
-  async encode(path44, input2, options) {
-    let headers = toStandardHeaders2(await value(this.headers, options, path44, input2));
+  async encode(path46, input2, options) {
+    let headers = toStandardHeaders2(await value(this.headers, options, path46, input2));
     if (options.lastEventId !== void 0) {
       headers = mergeStandardHeaders(headers, { "last-event-id": options.lastEventId });
     }
-    const expectedMethod = await value(this.expectedMethod, options, path44, input2);
-    const baseUrl = await value(this.baseUrl, options, path44, input2);
+    const expectedMethod = await value(this.expectedMethod, options, path46, input2);
+    const baseUrl = await value(this.baseUrl, options, path46, input2);
     const url2 = new URL(baseUrl);
-    url2.pathname = `${url2.pathname.replace(/\/$/, "")}${toHttpPath(path44)}`;
+    url2.pathname = `${url2.pathname.replace(/\/$/, "")}${toHttpPath(path46)}`;
     const serialized = this.serializer.serialize(input2);
     if (expectedMethod === "GET" && !(serialized instanceof FormData) && !isAsyncIteratorObject(serialized)) {
-      const maxUrlLength = await value(this.maxUrlLength, options, path44, input2);
+      const maxUrlLength = await value(this.maxUrlLength, options, path46, input2);
       const getUrl = new URL(url2);
       getUrl.searchParams.append("data", stringifyJSON(serialized));
       if (getUrl.toString().length <= maxUrlLength) {
@@ -70578,7 +70578,7 @@ function middlewareOutputFn(output2) {
 function createProcedureClient(lazyableProcedure, ...rest) {
   const options = resolveMaybeOptionalOptions(rest);
   return async (...[input2, callerOptions]) => {
-    const path44 = toArray(options.path);
+    const path46 = toArray(options.path);
     const { default: procedure } = await unlazy(lazyableProcedure);
     const clientContext = callerOptions?.context ?? {};
     const context = await value(options.context ?? {}, clientContext);
@@ -70593,7 +70593,7 @@ function createProcedureClient(lazyableProcedure, ...rest) {
       const output2 = await runWithSpan(
         { name: "call_procedure", signal: callerOptions?.signal },
         (span) => {
-          span?.setAttribute("procedure.path", [...path44]);
+          span?.setAttribute("procedure.path", [...path46]);
           return intercept(
             toArray(options.interceptors),
             {
@@ -70601,7 +70601,7 @@ function createProcedureClient(lazyableProcedure, ...rest) {
               input: input2,
               // input only optional when it undefinable so we can safely cast it
               errors,
-              path: path44,
+              path: path46,
               procedure,
               signal: callerOptions?.signal,
               lastEventId: callerOptions?.lastEventId
@@ -70723,10 +70723,10 @@ var HIDDEN_ROUTER_CONTRACT_SYMBOL = /* @__PURE__ */ Symbol("ORPC_HIDDEN_ROUTER_C
 function getHiddenRouterContract(router) {
   return router[HIDDEN_ROUTER_CONTRACT_SYMBOL];
 }
-function getRouter(router, path44) {
+function getRouter(router, path46) {
   let current = router;
-  for (let i2 = 0; i2 < path44.length; i2++) {
-    const segment = path44[i2];
+  for (let i2 = 0; i2 < path46.length; i2++) {
+    const segment = path46[i2];
     if (!current) {
       return void 0;
     }
@@ -70741,7 +70741,7 @@ function getRouter(router, path44) {
       continue;
     }
     const lazied = current;
-    const rest = path44.slice(i2);
+    const rest = path46.slice(i2);
     return lazy2(async () => {
       const unwrapped = await unlazy(lazied);
       const next = getRouter(unwrapped.default, rest);
@@ -71205,11 +71205,11 @@ var LinkFetchClient = class {
     this.toFetchRequestOptions = options;
     this.adapterInterceptors = toArray(options.adapterInterceptors);
   }
-  async call(standardRequest, options, path44, input2) {
+  async call(standardRequest, options, path46, input2) {
     const request7 = toFetchRequest(standardRequest, this.toFetchRequestOptions);
     const fetchResponse = await intercept(
       this.adapterInterceptors,
-      { ...options, request: request7, path: path44, input: input2, init: { redirect: "manual" } },
+      { ...options, request: request7, path: path46, input: input2, init: { redirect: "manual" } },
       ({ request: request22, path: path210, input: input22, init, ...options2 }) => this.fetch(request22, init, options2, path210, input22)
     );
     const lazyResponse = toStandardLazyResponse(fetchResponse, { signal: request7.signal });
@@ -71356,8 +71356,8 @@ function toAbortSignal(stream) {
 function toStandardUrl(req) {
   const protocol = "encrypted" in req.socket && req.socket.encrypted ? "https:" : "http:";
   const origin = guard(() => new URL(`${protocol}//${req.headers.host ?? "localhost"}`).origin) ?? `${protocol}//localhost`;
-  const path44 = req.originalUrl ?? req.url ?? "/";
-  return new URL(`${origin}${path44.startsWith("/") ? "" : "/"}${path44}`);
+  const path46 = req.originalUrl ?? req.url ?? "/";
+  return new URL(`${origin}${path46.startsWith("/") ? "" : "/"}${path46}`);
 }
 function toStandardLazyRequest(req, res) {
   const signal = toAbortSignal(res);
@@ -71556,8 +71556,8 @@ var StandardRPCMatcher = class {
   constructor(options = {}) {
     this.filter = options.filter ?? true;
   }
-  init(router, path44 = []) {
-    const laziedOptions = traverseContractProcedures({ router, path: path44 }, (traverseOptions) => {
+  init(router, path46 = []) {
+    const laziedOptions = traverseContractProcedures({ router, path: path46 }, (traverseOptions) => {
       if (!value(this.filter, traverseOptions)) {
         return;
       }
@@ -73274,8 +73274,8 @@ function createCodexRouteMount(ports, upstreamBase, provider) {
         request7.body.resume();
         return;
       }
-      const path44 = new URL(request7.url, "http://127.0.0.1").pathname;
-      const translated = { method: request7.method, path: path44, body, signal: request7.signal };
+      const path46 = new URL(request7.url, "http://127.0.0.1").pathname;
+      const translated = { method: request7.method, path: path46, body, signal: request7.signal };
       const routed = await route(translated);
       if (request7.signal.aborted) {
         return;
@@ -73309,7 +73309,7 @@ function createPassthroughRoute(name, target) {
     headroomUpstream: target.headroomUpstream,
     serve: async (request7, response) => {
       const incoming = new URL(request7.url, "http://127.0.0.1");
-      const path44 = target.stripPrefix !== void 0 && incoming.pathname.startsWith(target.stripPrefix) ? incoming.pathname.slice(target.stripPrefix.length) : incoming.pathname;
+      const path46 = target.stripPrefix !== void 0 && incoming.pathname.startsWith(target.stripPrefix) ? incoming.pathname.slice(target.stripPrefix.length) : incoming.pathname;
       const headers = forwardableHeaders(request7.headers);
       delete headers.host;
       await new Promise((resolve) => {
@@ -73317,7 +73317,7 @@ function createPassthroughRoute(name, target) {
           host: base.hostname,
           port: base.port === "" ? void 0 : Number(base.port),
           method: request7.method,
-          path: `${basePath}${path44}${incoming.search}`,
+          path: `${basePath}${path46}${incoming.search}`,
           headers,
           agent
         };
@@ -73366,7 +73366,7 @@ function createPassthroughRoute(name, target) {
 // src/frontdoor/providerRoute.ts
 function createProviderRouteResolver(deps) {
-  const isRcSelfHostPath = (path44) => path44 === "/v1/code/sessions" || path44.startsWith("/v1/code/sessions/") || path44 === "/v1/sessions" || path44.startsWith("/v1/sessions/");
+  const isRcSelfHostPath = (path46) => path46 === "/v1/code/sessions" || path46.startsWith("/v1/code/sessions/") || path46 === "/v1/sessions" || path46.startsWith("/v1/sessions/");
   const oauthRoute = createPassthroughRoute("anthropic", { baseUrl: `https://${CONNECT_INTERCEPT_HOST}:${String(HTTPS_PORT)}`, stripPrefix: void 0, headroomUpstream: void 0 });
   const passthroughByTarget = /* @__PURE__ */ new Map();
   const passthroughFor = (name, target) => {
@@ -73380,16 +73380,16 @@ function createProviderRouteResolver(deps) {
     return route;
   };
   const resolve = (request7) => {
-    const path44 = new URL(request7.url, "http://127.0.0.1").pathname;
-    const scoped = parseProviderPath(path44);
+    const path46 = new URL(request7.url, "http://127.0.0.1").pathname;
+    const scoped = parseProviderPath(path46);
     if (scoped === void 0) {
-      if (deps.rcSelfHostRoute !== void 0 && isRcSelfHostPath(path44)) {
+      if (deps.rcSelfHostRoute !== void 0 && isRcSelfHostPath(path46)) {
         return { ok: true, route: deps.rcSelfHostRoute };
       }
-      if (request7.session.provider !== void 0 && path44.startsWith("/v1/") && !isRcSelfHostPath(path44)) {
+      if (request7.session.provider !== void 0 && path46.startsWith("/v1/") && !isRcSelfHostPath(path46)) {
         return resolve({ ...request7, url: `${PROVIDER_PATH_PREFIX}${encodeURIComponent(request7.session.provider)}${request7.url}` });
       }
-      return path44.startsWith("/v1/") ? { ok: true, route: oauthRoute } : { ok: false, status: HTTP_STATUS.notFound, message: `no such endpoint: ${path44}` };
+      return path46.startsWith("/v1/") ? { ok: true, route: oauthRoute } : { ok: false, status: HTTP_STATUS.notFound, message: `no such endpoint: ${path46}` };
     }
     const { provider } = scoped;
     let definition;
@@ -73478,11 +73478,11 @@ function credentialOfJson(parsed) {
 function sequenceNumOfJson(value2) {
   return typeof value2 === "number" && Number.isInteger(value2) && value2 >= 0 ? value2 : void 0;
 }
-function createRcCredentialStore(fs19, dir) {
-  fs19.mkdirPrivate(dir);
+function createRcCredentialStore(fs20, dir) {
+  fs20.mkdirPrivate(dir);
   const fileFor = (sessionId) => import_node_path34.default.join(dir, `${sessionId}.json`);
   const readParsed = (sessionId) => {
-    const raw = fs19.readFileUtf8(fileFor(sessionId));
+    const raw = fs20.readFileUtf8(fileFor(sessionId));
     if (raw === void 0) {
       return void 0;
     }
@@ -73507,7 +73507,7 @@ function createRcCredentialStore(fs19, dir) {
       }
       const cursor3 = sequenceNumOfJson(readParsed(sessionId)?.highestSequenceNum);
       const record2 = { ...credential, ...cursor3 === void 0 ? {} : { highestSequenceNum: cursor3 } };
-      fs19.writeFilePrivate(fileFor(sessionId), `${JSON.stringify(record2, null, 2)}
+      fs20.writeFilePrivate(fileFor(sessionId), `${JSON.stringify(record2, null, 2)}
 `);
     },
     readCursor: (sessionId) => {
@@ -73522,14 +73522,14 @@ function createRcCredentialStore(fs19, dir) {
       }
       const credential = credentialOfJson(readParsed(sessionId));
       const record2 = credential === void 0 ? { highestSequenceNum } : { ...credential, highestSequenceNum };
-      fs19.writeFilePrivate(fileFor(sessionId), `${JSON.stringify(record2, null, 2)}
+      fs20.writeFilePrivate(fileFor(sessionId), `${JSON.stringify(record2, null, 2)}
 `);
     },
     remove: (sessionId) => {
       if (!isSafeSessionId(sessionId)) {
         return;
       }
-      fs19.removeRecursive(fileFor(sessionId));
+      fs20.removeRecursive(fileFor(sessionId));
     }
   };
 }
@@ -73994,6 +73994,252 @@ function createRcClientPage(expectedToken) {
   };
 }
+// src/frontdoor/rcWebFetch.ts
+var dns2 = __toESM(require("node:dns"), 1);
+var http6 = __toESM(require("node:http"), 1);
+var https5 = __toESM(require("node:https"), 1);
+var net3 = __toESM(require("node:net"), 1);
+var RC_WEB_FETCH_MAX_BYTES = 12582912;
+var RC_WEB_FETCH_DEADLINE_MS = 4e4;
+var RC_WEB_FETCH_MAX_REDIRECTS = 20;
+var RC_WEB_FETCH_ALLOW_PRIVATE_ENV = "AGENT_SHIM_FRONTDOOR_RC_SELF_HOST_WEB_FETCH_ALLOW_PRIVATE";
+function rcWebFetchAllowsPrivateFromEnv(env) {
+  return env[RC_WEB_FETCH_ALLOW_PRIVATE_ENV] === "1";
+}
+var WEB_FETCH_USER_AGENT = "agent-shim-frontdoor";
+var ERROR_PREFIX = "web_fetch_";
+var V4_THIS_NETWORK_OCTET = 0;
+var V4_PRIVATE_A_OCTET = 10;
+var V4_LOOPBACK_OCTET = 127;
+var V4_CGNAT_OCTET = 100;
+var V4_CGNAT_SECOND_FROM = 64;
+var V4_CGNAT_SECOND_TO = 127;
+var V4_LINK_LOCAL_OCTET = 169;
+var V4_LINK_LOCAL_SECOND = 254;
+var V4_PRIVATE_B_OCTET = 172;
+var V4_PRIVATE_B_SECOND_FROM = 16;
+var V4_PRIVATE_B_SECOND_TO = 31;
+var V4_PRIVATE_C_OCTET = 192;
+var V4_PRIVATE_C_SECOND = 168;
+var V4_MULTICAST_FROM_OCTET = 224;
+var V6_UNIQUE_LOCAL_FROM = 64512;
+var V6_UNIQUE_LOCAL_TO = 65023;
+var V6_LINK_LOCAL_FROM = 65152;
+var V6_LINK_LOCAL_TO = 65215;
+var V6_MULTICAST_FROM = 65280;
+var IP_VERSION_4 = 4;
+var IP_VERSION_6 = 6;
+var HTTP_MOVED_PERMANENTLY = 301;
+var HTTP_FOUND = 302;
+var HTTP_SEE_OTHER = 303;
+var HTTP_TEMPORARY_REDIRECT = 307;
+var HTTP_PERMANENT_REDIRECT = 308;
+var SUCCESS_STATUS_MAX_EXCLUSIVE3 = 300;
+function refused(errorType, errorMessage2) {
+  return { kind: "refused", errorType: `${ERROR_PREFIX}${errorType}`, errorMessage: errorMessage2 };
+}
+function isPrivateAddress(address) {
+  const version2 = net3.isIP(address);
+  if (version2 === IP_VERSION_4) {
+    const octets = address.split(".").map((part) => Number(part));
+    const first = octets[0] ?? -1;
+    const second = octets[1] ?? -1;
+    if (first === V4_THIS_NETWORK_OCTET || first === V4_PRIVATE_A_OCTET || first === V4_LOOPBACK_OCTET) {
+      return true;
+    }
+    if (first === V4_CGNAT_OCTET && second >= V4_CGNAT_SECOND_FROM && second <= V4_CGNAT_SECOND_TO) {
+      return true;
+    }
+    if (first === V4_LINK_LOCAL_OCTET && second === V4_LINK_LOCAL_SECOND) {
+      return true;
+    }
+    if (first === V4_PRIVATE_B_OCTET && second >= V4_PRIVATE_B_SECOND_FROM && second <= V4_PRIVATE_B_SECOND_TO) {
+      return true;
+    }
+    if (first === V4_PRIVATE_C_OCTET && second === V4_PRIVATE_C_SECOND) {
+      return true;
+    }
+    return first >= V4_MULTICAST_FROM_OCTET;
+  }
+  if (version2 === IP_VERSION_6) {
+    const lower = address.toLowerCase();
+    const mapped = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/.exec(lower);
+    if (mapped !== null) {
+      return isPrivateAddress(mapped[1] ?? "");
+    }
+    if (lower === "::" || lower === "::1") {
+      return true;
+    }
+    const firstGroup = Number.parseInt(/^([0-9a-f]+):/.exec(lower)?.[1] ?? "0", 16);
+    if (Number.isNaN(firstGroup)) {
+      return true;
+    }
+    if (firstGroup >= V6_UNIQUE_LOCAL_FROM && firstGroup <= V6_UNIQUE_LOCAL_TO) {
+      return true;
+    }
+    if (firstGroup >= V6_LINK_LOCAL_FROM && firstGroup <= V6_LINK_LOCAL_TO) {
+      return true;
+    }
+    return firstGroup >= V6_MULTICAST_FROM;
+  }
+  return true;
+}
+function isSuccessful3(status) {
+  return status >= HTTP_STATUS.ok && status < SUCCESS_STATUS_MAX_EXCLUSIVE3;
+}
+function isRedirect(status) {
+  return status === HTTP_MOVED_PERMANENTLY || status === HTTP_FOUND || status === HTTP_SEE_OTHER || status === HTTP_TEMPORARY_REDIRECT || status === HTTP_PERMANENT_REDIRECT;
+}
+function readableContentType(contentType) {
+  if (contentType === void 0 || contentType.trim() === "") {
+    return true;
+  }
+  const normalised = contentType.split(";")[0]?.trim().toLowerCase() ?? "";
+  const slash = normalised.indexOf("/");
+  const main2 = slash === -1 ? normalised : normalised.slice(0, slash);
+  const sub = slash === -1 ? "" : normalised.slice(slash + 1);
+  if (main2 === "text") {
+    return true;
+  }
+  return /json|xml|javascript|ecmascript|yaml|csv/.test(sub);
+}
+async function readCapped(chunks) {
+  const collected = [];
+  let total = 0;
+  for await (const chunk of chunks) {
+    total += chunk.byteLength;
+    if (total > RC_WEB_FETCH_MAX_BYTES) {
+      return { tooLarge: true, text: "" };
+    }
+    collected.push(Buffer.from(chunk));
+  }
+  return { tooLarge: false, text: Buffer.concat(collected).toString("utf8") };
+}
+async function checkTarget(url2, deps) {
+  if (url2.protocol !== "http:" && url2.protocol !== "https:") {
+    return refused("scheme", `the web-fetch proxy dials http and https only, not ${url2.protocol}`);
+  }
+  if (deps.allowPrivate) {
+    return void 0;
+  }
+  const hostname3 = url2.hostname.replace(/^\[|\]$/g, "");
+  let addresses;
+  try {
+    addresses = net3.isIP(hostname3) === 0 ? await deps.lookup(hostname3) : [hostname3];
+  } catch {
+    return refused("resolve", `${hostname3} did not resolve`);
+  }
+  for (const address of addresses) {
+    if (isPrivateAddress(address)) {
+      return refused("private_address", `${hostname3} resolves to ${address}, a private address this web-fetch proxy refuses; set ${RC_WEB_FETCH_ALLOW_PRIVATE_ENV}=1 on the door if serving internal targets is intended`);
+    }
+  }
+  return void 0;
+}
+async function fetchThroughWebProxy(url2, deps) {
+  let current;
+  try {
+    current = new URL(url2);
+  } catch {
+    return refused("malformed_url", `${url2} is not a URL this proxy can dial`);
+  }
+  const controller = new AbortController();
+  const timer = setTimeout(() => {
+    controller.abort();
+  }, deps.deadlineMs);
+  timer.unref();
+  try {
+    let redirects = 0;
+    for (; ; ) {
+      const refusal = await checkTarget(current, deps);
+      if (refusal !== void 0) {
+        return refusal;
+      }
+      let hop;
+      try {
+        hop = await deps.dial(current, controller.signal);
+      } catch (error62) {
+        if (controller.signal.aborted) {
+          return refused("deadline", `the fetch of ${url2} did not settle within its deadline`);
+        }
+        return refused("transport", `the dial of ${current.toString()} failed: ${error62 instanceof Error ? error62.message : "unknown error"}`);
+      }
+      if (isRedirect(hop.status) && hop.location !== void 0) {
+        if (redirects >= RC_WEB_FETCH_MAX_REDIRECTS) {
+          controller.abort();
+          return refused("too_many_redirects", `${url2} followed more than ${String(RC_WEB_FETCH_MAX_REDIRECTS)} redirects without settling`);
+        }
+        let next;
+        try {
+          next = new URL(hop.location, current);
+        } catch {
+          controller.abort();
+          return refused("malformed_url", `a redirect of ${current.toString()} named ${hop.location}, which is not a URL this proxy can dial`);
+        }
+        const drained = await readCapped(hop.chunks);
+        if (drained.tooLarge) {
+          controller.abort();
+          return refused("too_large", `the body of a redirect from ${url2} exceeds the ${String(RC_WEB_FETCH_MAX_BYTES)} byte cap the CLI's proxy client reads`);
+        }
+        redirects += 1;
+        current = next;
+        continue;
+      }
+      if (!isSuccessful3(hop.status)) {
+        controller.abort();
+        return refused("status", `the target answered HTTP ${String(hop.status)} for ${current.toString()}`);
+      }
+      const contentType = hop.contentType ?? "";
+      if (!readableContentType(contentType)) {
+        controller.abort();
+        return refused("content_type", `the target at ${current.toString()} served a ${contentType} answer, which the proxy's text field cannot carry`);
+      }
+      const read = await readCapped(hop.chunks);
+      if (read.tooLarge) {
+        controller.abort();
+        return refused("too_large", `the body of ${current.toString()} exceeds the ${String(RC_WEB_FETCH_MAX_BYTES)} byte cap the CLI's proxy client reads`);
+      }
+      return { kind: "fetched", url: url2, destinationUrl: current.toString(), contentType: hop.contentType, text: read.text };
+    }
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function realRcWebFetch(options) {
+  const plainAgent = new ExemptHttpAgent();
+  const tlsAgent = new ExemptTlsAgent();
+  const deps = {
+    dial: async (url2, signal) => await new Promise((resolve, reject) => {
+      const request7 = (url2.protocol === "https:" ? https5 : http6).request(
+        {
+          hostname: url2.hostname,
+          port: url2.port === "" ? void 0 : Number(url2.port),
+          method: "GET",
+          path: `${url2.pathname}${url2.search}`,
+          headers: { accept: "*/*", "accept-encoding": "identity", "user-agent": WEB_FETCH_USER_AGENT },
+          agent: url2.protocol === "https:" ? tlsAgent : plainAgent,
+          signal
+        },
+        (response) => {
+          const location = response.headers.location;
+          resolve({
+            status: response.statusCode ?? 0,
+            location: typeof location === "string" ? location : void 0,
+            contentType: typeof response.headers["content-type"] === "string" ? response.headers["content-type"] : void 0,
+            chunks: response
+          });
+        }
+      );
+      request7.once("error", reject);
+      request7.end();
+    }),
+    lookup: async (hostname3) => (await dns2.promises.lookup(hostname3, { all: true })).map((entry) => entry.address),
+    allowPrivate: options.allowPrivate,
+    deadlineMs: RC_WEB_FETCH_DEADLINE_MS
+  };
+  return async (url2) => await fetchThroughWebProxy(url2, deps);
+}
 // src/frontdoor/rcSelfHost.ts
 var RC_SELF_HOST_ENV = "AGENT_SHIM_FRONTDOOR_RC_SELF_HOST";
 function rcSelfHostFromEnv(env) {
@@ -74023,6 +74269,9 @@ var CONFLICT_REASON_EPOCH_STALE = "epoch_stale";
 function isRecord5(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 }
+function isWebSearchRefusal(value2) {
+  return !Array.isArray(value2);
+}
 function nonEmptyString2(record2, field) {
   const value2 = record2 === void 0 ? void 0 : record2[field];
   return typeof value2 === "string" && value2 !== "" ? value2 : void 0;
@@ -74037,6 +74286,20 @@ function numberOf(record2, field) {
   }
   return void 0;
 }
+function stringArray(record2, field) {
+  const value2 = record2 === void 0 ? void 0 : record2[field];
+  if (!Array.isArray(value2)) {
+    return void 0;
+  }
+  const members2 = [];
+  for (const member of value2) {
+    if (typeof member !== "string") {
+      return void 0;
+    }
+    members2.push(member);
+  }
+  return members2;
+}
 function singleHeader2(headers, name) {
   const value2 = headers[name];
   return typeof value2 === "string" ? value2 : void 0;
@@ -74048,6 +74311,17 @@ function bearerOf(headers) {
   }
   return presented.slice(0, "bearer ".length).toLowerCase() === "bearer " ? presented.slice("bearer ".length) : void 0;
 }
+function presentationRefusal(headers) {
+  const presented = singleHeader2(headers, "authorization");
+  if (presented === void 0) {
+    return "absent";
+  }
+  if (presented.slice(0, "bearer ".length).toLowerCase() !== "bearer ") {
+    return "not-a-bearer";
+  }
+  const bearer = presented.slice("bearer ".length);
+  return bearer.slice(0, "bearer ".length).toLowerCase() === "bearer " ? "doubled-scheme-word" : "unrecognised";
+}
 async function readBody3(request7, capBytes) {
   return await new Promise((resolve, reject) => {
     const chunks = [];
@@ -74136,6 +74410,9 @@ function createRcSelfHostSurface(deps) {
     }
     return false;
   };
+  const credentialRefusal = (headers) => presentsCredential(headers) ? void 0 : presentationRefusal(headers);
+  const workerRefusal = (headers, session) => presentsWorkerJwt(headers, session) ? void 0 : presentationRefusal(headers);
+  const workerOrCredentialRefusal = (headers, session) => presentsWorkerJwt(headers, session) || presentsCredential(headers) ? void 0 : presentationRefusal(headers);
   const frameOf = (event) => {
     const envelope = {
       event_id: event.eventId,
@@ -74224,8 +74501,14 @@ data: ${JSON.stringify(envelope)}
   const epochStale = async (response) => {
     await answerJson2(response, HTTP_CONFLICT, { type: "error", error: { type: "api_error", message: "worker_epoch does not match the session's live epoch" } }, { [CONFLICT_REASON_HEADER2]: CONFLICT_REASON_EPOCH_STALE });
   };
-  const unauthorized = async (response) => {
-    await answerJson2(response, HTTP_STATUS.unauthorized, { type: "error", error: { type: "authentication_error", message: "the self-hosted Remote Control surface did not recognise the presented credential" } });
+  const refusalMessages = {
+    absent: "the self-hosted Remote Control surface authenticates by the Authorization header, and this call carried none",
+    "not-a-bearer": "the self-hosted Remote Control surface reads a Bearer authorization, and this call's Authorization header did not carry the Bearer scheme word",
+    "doubled-scheme-word": "the self-hosted Remote Control surface reads one Bearer scheme word, and this call's Authorization header carried it twice: a persisted session record holds the whole header value with the scheme word included, so prefixing Bearer onto it presents a different credential",
+    unrecognised: "the self-hosted Remote Control surface did not recognise the presented credential"
+  };
+  const unauthorized = async (response, refusal) => {
+    await answerJson2(response, HTTP_STATUS.unauthorized, { type: "error", error: { type: "authentication_error", message: refusalMessages[refusal] } });
   };
   const serveSessionPath = async (session, tail, request7, response) => {
     const method = request7.method.toUpperCase();
@@ -74243,8 +74526,9 @@ data: ${JSON.stringify(envelope)}
       return;
     }
     if (tail === "bridge" && method === "POST") {
-      if (!presentsCredential(request7.headers)) {
-        await unauthorized(response);
+      const refusal = credentialRefusal(request7.headers);
+      if (refusal !== void 0) {
+        await unauthorized(response, refusal);
         return;
       }
       const workerJwt = mintWorkerJwt(deps.randomToken, deps.now());
@@ -74254,8 +74538,9 @@ data: ${JSON.stringify(envelope)}
       return;
     }
     if (tail === "archive" && method === "POST") {
-      if (!presentsCredential(request7.headers)) {
-        await unauthorized(response);
+      const refusal = credentialRefusal(request7.headers);
+      if (refusal !== void 0) {
+        await unauthorized(response, refusal);
         return;
       }
       for (const sink of [...session.workerStreams, ...session.clientStreams]) {
@@ -74267,11 +74552,13 @@ data: ${JSON.stringify(envelope)}
       return;
     }
     if (tail === "worker" || tail.startsWith("worker/")) {
-      if (!presentsWorkerJwt(request7.headers, session)) {
-        await unauthorized(response);
+      const workerTail = tail === "worker" ? "" : tail.slice("worker/".length);
+      const webProxy = workerTail === "web-fetch" || workerTail === "web-search";
+      const refusal = webProxy ? workerOrCredentialRefusal(request7.headers, session) : workerRefusal(request7.headers, session);
+      if (refusal !== void 0) {
+        await unauthorized(response, refusal);
         return;
       }
-      const workerTail = tail === "worker" ? "" : tail.slice("worker/".length);
       if (workerTail === "" && method === "GET") {
         await answerJson2(response, HTTP_STATUS.ok, { worker: { external_metadata: session.externalMetadata ?? null } });
         return;
@@ -74370,11 +74657,64 @@ data: ${JSON.stringify(envelope)}
         await answerJson2(response, HTTP_STATUS.ok, {});
         return;
       }
+      if (workerTail === "web-fetch" && method === "POST") {
+        const body = parseJsonObject2(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
+        const target = nonEmptyString2(body, "url");
+        if (target === void 0) {
+          await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "a worker web-fetch carries one url" } });
+          return;
+        }
+        const outcome = await deps.webFetch(target);
+        if (outcome.kind === "fetched") {
+          const answer = { url: target, destination_url: outcome.destinationUrl, text: outcome.text, ...outcome.contentType === void 0 ? {} : { content_type: outcome.contentType } };
+          if (Buffer.byteLength(JSON.stringify(answer), "utf8") > RC_WEB_FETCH_MAX_BYTES) {
+            deps.log?.(`rc selfhost ${session.id}: worker web-fetch of ${target} escaped past the reader cap when framed`);
+            await answerJson2(response, HTTP_STATUS.ok, { error: { error_type: "web_fetch_too_large", error_message: `the answer for ${target} exceeds the ${String(RC_WEB_FETCH_MAX_BYTES)} byte cap the CLI's proxy client reads` } });
+            return;
+          }
+          deps.log?.(`rc selfhost ${session.id}: worker web-fetch served ${target} as ${outcome.destinationUrl}`);
+          await answerJson2(response, HTTP_STATUS.ok, answer);
+          return;
+        }
+        deps.log?.(`rc selfhost ${session.id}: worker web-fetch of ${target} refused: ${outcome.errorType}`);
+        await answerJson2(response, HTTP_STATUS.ok, { error: { error_type: outcome.errorType, error_message: outcome.errorMessage } });
+        return;
+      }
+      if (workerTail === "web-search" && method === "POST") {
+        const body = parseJsonObject2(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
+        const query = nonEmptyString2(body, "query");
+        if (query === void 0) {
+          await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "a worker web-search carries one query" } });
+          return;
+        }
+        const allowedDomains = stringArray(body, "allowed_domains");
+        const blockedDomains = stringArray(body, "blocked_domains");
+        if (body?.allowed_domains !== void 0 && allowedDomains === void 0 || body?.blocked_domains !== void 0 && blockedDomains === void 0) {
+          await answerJson2(response, HTTP_STATUS.badRequest, { type: "error", error: { type: "invalid_request_error", message: "the domain filters of a worker web-search are string arrays" } });
+          return;
+        }
+        const searchProfile = nonEmptyString2(body, "search_profile");
+        const backend = deps.webSearch;
+        if (backend === void 0) {
+          deps.log?.(`rc selfhost ${session.id}: worker web-search of "${query}" refused: no search backend serves this door`);
+          await answerJson2(response, HTTP_STATUS.ok, { results: [], error: { error_type: "web_search_unavailable", error_message: "this front door serves the Remote Control web-search proxy without a search backend, so no query can be served here" } });
+          return;
+        }
+        const answered = await backend({ query, ...allowedDomains === void 0 ? {} : { allowedDomains }, ...blockedDomains === void 0 ? {} : { blockedDomains }, ...searchProfile === void 0 ? {} : { searchProfile } });
+        deps.log?.(`rc selfhost ${session.id}: worker web-search of "${query}" answered by its backend`);
+        if (isWebSearchRefusal(answered)) {
+          await answerJson2(response, HTTP_STATUS.ok, { results: [], error: { error_type: answered.errorType, error_message: answered.errorMessage } });
+          return;
+        }
+        await answerJson2(response, HTTP_STATUS.ok, { results: answered.map((result) => ({ title: result.title ?? "", url: result.url, snippet: result.snippet ?? "" })) });
+        return;
+      }
       await answerJson2(response, HTTP_STATUS.notFound, { type: "error", error: { type: "api_error", message: `the self-hosted Remote Control surface serves no worker path "${workerTail}"` } });
       return;
     }
-    if (!presentsCredential(request7.headers)) {
-      await unauthorized(response);
+    const clientRefusal = credentialRefusal(request7.headers);
+    if (clientRefusal !== void 0) {
+      await unauthorized(response, clientRefusal);
       return;
     }
     if (tail === "events" && method === "POST") {
@@ -74439,8 +74779,9 @@ data: ${JSON.stringify(envelope)}
           await answerJson2(response, HTTP_STATUS.methodNotAllowed, { type: "error", error: { type: "api_error", message: "the compatibility session list is a GET" } });
           return;
         }
-        if (!presentsCredential(request7.headers)) {
-          await unauthorized(response);
+        const listRefusal = credentialRefusal(request7.headers);
+        if (listRefusal !== void 0) {
+          await unauthorized(response, listRefusal);
           return;
         }
         await answerJson2(response, HTTP_STATUS.ok, { data: [] });
@@ -74452,8 +74793,9 @@ data: ${JSON.stringify(envelope)}
       }
       if (pathname === RC_SESSIONS_PATH_PREFIX2) {
         if (method === "POST") {
-          if (!presentsCredential(request7.headers)) {
-            await unauthorized(response);
+          const createRefusal = credentialRefusal(request7.headers);
+          if (createRefusal !== void 0) {
+            await unauthorized(response, createRefusal);
             return;
           }
           const body = parseJsonObject2(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
@@ -74478,8 +74820,9 @@ data: ${JSON.stringify(envelope)}
           return;
         }
         if (method === "GET") {
-          if (!presentsCredential(request7.headers)) {
-            await unauthorized(response);
+          const readRefusal = credentialRefusal(request7.headers);
+          if (readRefusal !== void 0) {
+            await unauthorized(response, readRefusal);
             return;
           }
           await answerJson2(response, HTTP_STATUS.ok, { data: [...sessions.values()].map((session) => ({ id: session.id, title: session.title, created_at: new Date(session.createdAt).toISOString(), updated_at: new Date(session.lastTrafficAt).toISOString(), session_status: "active" })) });
@@ -74600,8 +74943,8 @@ var SELF_HOST_SUBSCRIPTION_TYPE = "max";
 function isRecord6(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 }
-function readJsonObject(fs19, file2) {
-  const raw = fs19.readFileUtf8(file2);
+function readJsonObject(fs20, file2) {
+  const raw = fs20.readFileUtf8(file2);
   if (raw === void 0) {
     return void 0;
   }
@@ -74613,8 +74956,8 @@ function readJsonObject(fs19, file2) {
   }
   return isRecord6(parsed) ? parsed : void 0;
 }
-function readRcSelfHostRecord(fs19, frontdoorDir) {
-  const parsed = readJsonObject(fs19, import_node_path35.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
+function readRcSelfHostRecord(fs20, frontdoorDir) {
+  const parsed = readJsonObject(fs20, import_node_path35.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
   if (parsed === void 0) {
     return void 0;
   }
@@ -74684,9 +75027,9 @@ function mintRcSelfHostCredential(deps) {
 var RC_STREAM_EVENT_NAME2 = "client_event";
 var SSE_BYTE_ORDER_MARK = 65279;
 var RC_STREAM_BACKOFF_MS = 45e3;
-var SUCCESS_STATUS_MAX_EXCLUSIVE3 = 300;
-function isSuccessful3(status) {
-  return status >= HTTP_STATUS.ok && status < SUCCESS_STATUS_MAX_EXCLUSIVE3;
+var SUCCESS_STATUS_MAX_EXCLUSIVE4 = 300;
+function isSuccessful4(status) {
+  return status >= HTTP_STATUS.ok && status < SUCCESS_STATUS_MAX_EXCLUSIVE4;
 }
 function createSseParser() {
   let buffer = "";
@@ -74853,7 +75196,7 @@ function createRcStreamHub(deps) {
     if (presence.status === HTTP_STATUS.unauthorized) {
       return "unauthorized";
     }
-    if (!isSuccessful3(presence.status)) {
+    if (!isSuccessful4(presence.status)) {
       throw new Error(`the presence call answered HTTP ${String(presence.status)}: ${presence.body}`);
     }
     const cursor3 = deps.sequenceNumOf(attachment.sessionId) ?? deps.storedSequenceNumOf?.(attachment.sessionId);
@@ -74862,7 +75205,7 @@ function createRcStreamHub(deps) {
     if (answer.status === HTTP_STATUS.unauthorized) {
       return "unauthorized";
     }
-    if (!isSuccessful3(answer.status)) {
+    if (!isSuccessful4(answer.status)) {
       throw new Error(`the client read stream answered HTTP ${String(answer.status)}`);
     }
     deps.log?.(`rc stream ${attachment.sessionId}: attached as client ${attachment.clientId}${resume === void 0 ? ", reading from the stream's own head" : `, resuming after sequence number ${String(resume.fromSequenceNum)}`}`);
@@ -75066,8 +75409,8 @@ function zaiWindow(limit) {
 var zaiQuotaAdapter = {
   source: ZAI_SOURCE,
   matches: (baseUrl) => URL.canParse(baseUrl) && new URL(baseUrl).hostname === ZAI_HOST,
-  fetch: async (apiKey, http7, signal, nowMs) => {
-    const response = await http7(ZAI_QUOTA_URL, { authorization: apiKey, accept: "application/json" }, signal);
+  fetch: async (apiKey, http8, signal, nowMs) => {
+    const response = await http8(ZAI_QUOTA_URL, { authorization: apiKey, accept: "application/json" }, signal);
     if (response.status !== HTTP_OK) {
       throw new ProviderQuotaError(ZAI_SOURCE, `answered HTTP ${String(response.status)}`);
     }
@@ -75108,8 +75451,8 @@ var OpenRouterKeySchema = external_exports.object({
   })
 });
 var OpenRouterCreditsSchema = external_exports.object({ data: external_exports.object({ total_credits: external_exports.number().nonnegative(), total_usage: external_exports.number().nonnegative() }) });
-async function openRouterGet(url2, schema, apiKey, http7, signal) {
-  const response = await http7(url2, { authorization: `Bearer ${apiKey}`, accept: "application/json" }, signal);
+async function openRouterGet(url2, schema, apiKey, http8, signal) {
+  const response = await http8(url2, { authorization: `Bearer ${apiKey}`, accept: "application/json" }, signal);
   if (response.status === HTTP_FORBIDDEN) {
     return "forbidden";
   }
@@ -75134,12 +75477,12 @@ function nextUtcMidnight(nowMs) {
 var openRouterQuotaAdapter = {
   source: OPENROUTER_SOURCE,
   matches: (baseUrl) => URL.canParse(baseUrl) && new URL(baseUrl).hostname === OPENROUTER_HOST,
-  fetch: async (apiKey, http7, signal, nowMs) => {
-    const key = await openRouterGet(OPENROUTER_KEY_URL, OpenRouterKeySchema, apiKey, http7, signal);
+  fetch: async (apiKey, http8, signal, nowMs) => {
+    const key = await openRouterGet(OPENROUTER_KEY_URL, OpenRouterKeySchema, apiKey, http8, signal);
     if (key === "forbidden") {
       throw new ProviderQuotaError(OPENROUTER_SOURCE, "/api/v1/key refused the key (HTTP 403)");
     }
-    const credits = await openRouterGet(OPENROUTER_CREDITS_URL, OpenRouterCreditsSchema, apiKey, http7, signal);
+    const credits = await openRouterGet(OPENROUTER_CREDITS_URL, OpenRouterCreditsSchema, apiKey, http8, signal);
     const { limit, limit_remaining: limitRemaining, limit_reset: limitReset, free_model_daily_requests: free, is_free_tier: isFreeTier } = key.data;
     const windows = [];
     if (limit !== null && limit > 0) {
@@ -75335,6 +75678,7 @@ function realFrontDoorSupervisorPorts(paths) {
     newUuid: import_node_crypto14.randomUUID,
     randomToken: () => (0, import_node_crypto14.randomBytes)(MINTED_TOKEN_RANDOM_BYTES).toString("base64url"),
     credentialRecord: () => readRcSelfHostRecord(realFarmFs, paths.frontdoorDir),
+    webFetch: realRcWebFetch({ allowPrivate: rcWebFetchAllowsPrivateFromEnv(process.env) }),
     log
   }) : void 0;
   const rcCredentialStore = createRcCredentialStore(realFarmFs, paths.frontdoorRcCredentialsDir);
@@ -76471,14 +76815,14 @@ var import_node_crypto16 = require("node:crypto");
 var import_node_path38 = __toESM(require("node:path"), 1);
 var BUNDLE_NAME_HEX_DIGITS = 16;
 function resolveTrustBundle(params) {
-  const { caCertFile, bundlesDir, variable, inherited, fs: fs19 } = params;
+  const { caCertFile, bundlesDir, variable, inherited, fs: fs20 } = params;
   if (inherited === void 0 || inherited === "" || import_node_path38.default.resolve(inherited) === import_node_path38.default.resolve(caCertFile)) {
     return { path: caCertFile };
   }
-  const caPem = fs19.readFileUtf8(caCertFile);
+  const caPem = fs20.readFileUtf8(caCertFile);
   let inheritedPem;
   try {
-    inheritedPem = fs19.readFileUtf8(inherited);
+    inheritedPem = fs20.readFileUtf8(inherited);
   } catch (error62) {
     return {
       path: caCertFile,
@@ -76491,9 +76835,9 @@ function resolveTrustBundle(params) {
   const combined = `${inheritedPem.trimEnd()}
 ${caPem}`;
   const bundle = import_node_path38.default.join(bundlesDir, `${(0, import_node_crypto16.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
-  if (!fs19.exists(bundle)) {
-    fs19.mkdirp(bundlesDir);
-    fs19.writeFileAtomic(bundle, combined);
+  if (!fs20.exists(bundle)) {
+    fs20.mkdirp(bundlesDir);
+    fs20.writeFileAtomic(bundle, combined);
   }
   return { path: bundle };
 }
@@ -77194,6 +77538,366 @@ function registerRunCommand(program2, handler) {
   });
 }
+// src/update/commands.ts
+var import_node_fs17 = __toESM(require("node:fs"), 1);
+var import_node_os7 = __toESM(require("node:os"), 1);
+var import_node_path41 = __toESM(require("node:path"), 1);
+// src/update/update.ts
+var import_node_crypto17 = require("node:crypto");
+var import_node_path40 = __toESM(require("node:path"), 1);
+var LATEST_RELEASE_URL = "https://github.com/ExaDev/agent-shim/releases/latest";
+var DOWNLOAD_BASE_URL = "https://github.com/ExaDev/agent-shim/releases/latest/download";
+var MACOS_X64_NOTE = "the standalone macOS x64 binary is currently broken upstream (see https://github.com/ExaDev/agent-shim#build-node-sea)";
+var BREW_PREFIXES = ["/opt/homebrew", "/usr/local/Cellar", "/home/linuxbrew/.linuxbrew"];
+var EXECUTABLE_MODE = 493;
+var UpdateChannelError = class extends CliError {
+  constructor(message) {
+    super(message);
+    this.name = "UpdateChannelError";
+  }
+};
+var UpdateConflictError = class extends CliError {
+  constructor(message) {
+    super(message);
+    this.name = "UpdateConflictError";
+  }
+};
+var UpdateDownloadError = class extends CliError {
+  constructor(message) {
+    super(message);
+    this.name = "UpdateDownloadError";
+  }
+};
+function compareVersions3(left, right) {
+  const parse3 = (version2) => {
+    const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(version2);
+    if (match === null) {
+      throw new Error(`not a plain release version: ${version2}`);
+    }
+    return [Number(match[1]), Number(match[2]), Number(match[3])];
+  };
+  const leftParts = parse3(left);
+  const rightParts = parse3(right);
+  return leftParts.map((part, index) => part - (rightParts[index] ?? 0)).find((difference) => difference !== 0) ?? 0;
+}
+function releaseTagFromUrl(url2) {
+  const segment = url2.split("?")[0]?.split("/").at(-1);
+  const candidate = segment?.startsWith("v") === true ? segment.slice(1) : void 0;
+  return candidate !== void 0 && /^\d+\.\d+\.\d+$/.test(candidate) ? candidate : void 0;
+}
+function selectAsset(platform, arch) {
+  if (platform === "darwin") {
+    return arch === "arm64" ? "agent-shim-macos-arm64" : void 0;
+  }
+  if (platform === "linux") {
+    if (arch === "arm64" || arch === "aarch64") {
+      return "agent-shim-linux-arm64";
+    }
+    return arch === "x64" ? "agent-shim-linux-x64" : void 0;
+  }
+  return void 0;
+}
+function channelUpgradeCommand(channel) {
+  switch (channel.kind) {
+    case "brew":
+      return "brew upgrade agent-shim";
+    case "npm":
+      return "npm install -g agent-shim@latest";
+    case "scoop":
+      return "scoop update agent-shim";
+    default:
+      return channel;
+  }
+}
+function channelRefusalMessage(channel) {
+  const command = channelUpgradeCommand(channel);
+  switch (channel.kind) {
+    case "brew":
+      return `this agent-shim was installed by Homebrew, so it updates through Homebrew instead: ${command}`;
+    case "npm":
+      switch (channel.reason) {
+        case "node_modules":
+          return `this agent-shim was installed by npm, so it updates through npm instead: ${command}`;
+        case "script":
+          return `the running agent-shim is a script rather than a release binary, so it updates through npm instead: ${command}`;
+        case "macos-x64":
+          return `${MACOS_X64_NOTE}, so it updates through npm instead: ${command}`;
+        default:
+          return channel.reason;
+      }
+    case "scoop":
+      return `this agent-shim was installed by Scoop, so it updates through Scoop instead: ${command}`;
+    default:
+      return channel;
+  }
+}
+function underBrewPrefix(executableRealPath) {
+  return BREW_PREFIXES.some((prefix) => executableRealPath === prefix || executableRealPath.startsWith(`${prefix}/`));
+}
+function detectChannel(env) {
+  if (env.platform === "win32") {
+    return { kind: "scoop" };
+  }
+  if (underBrewPrefix(env.executableRealPath)) {
+    return { kind: "brew" };
+  }
+  if (env.executableRealPath.split(/[\\/]/).includes("node_modules")) {
+    return { kind: "npm", reason: "node_modules" };
+  }
+  if ((env.fileHead ?? "").startsWith("#!")) {
+    return { kind: "npm", reason: "script" };
+  }
+  if (env.platform === "darwin" && env.arch === "x64") {
+    return { kind: "npm", reason: "macos-x64" };
+  }
+  return { kind: "self" };
+}
+function lockHolder(contents) {
+  const pid = Number((contents ?? "").trim());
+  return Number.isInteger(pid) && pid > 0 ? pid : void 0;
+}
+function acquireUpdateLock(fs20, isProcessAlive, pid, lockPath) {
+  const take = () => fs20.writeFileExclusive(lockPath, `${String(pid)}
+`);
+  const release = () => {
+    fs20.unlink(lockPath);
+  };
+  if (take()) {
+    return release;
+  }
+  const holder = lockHolder(fs20.readFileUtf8(lockPath));
+  if (holder !== void 0 && holder !== pid && isProcessAlive(holder)) {
+    throw new UpdateConflictError(`another agent-shim update (pid ${String(holder)}) is already running`);
+  }
+  fs20.unlink(lockPath);
+  if (!take()) {
+    throw new UpdateConflictError("another agent-shim update took the lock while it was being replaced");
+  }
+  return release;
+}
+function expectedSha256(sidecar) {
+  const first = sidecar.trim().split(/\s+/)[0];
+  return first === "" ? void 0 : first;
+}
+async function mustDownload(http8, url2) {
+  try {
+    return await http8.download(url2);
+  } catch (error62) {
+    throw new UpdateDownloadError(`could not download ${url2}: ${error62 instanceof Error ? error62.message : String(error62)}`);
+  }
+}
+async function downloadAndInstall(ports, asset, target) {
+  const tempDir = ports.fs.mkdtemp();
+  try {
+    const assetUrl = `${DOWNLOAD_BASE_URL}/${asset}`;
+    ports.fs.writeFileBytes(import_node_path40.default.join(tempDir, asset), await mustDownload(ports.http, assetUrl));
+    ports.fs.writeFileUtf8(import_node_path40.default.join(tempDir, `${asset}.sha256`), Buffer.from(await mustDownload(ports.http, `${assetUrl}.sha256`)).toString("utf8"));
+    const downloaded = ports.fs.readFileBytes(import_node_path40.default.join(tempDir, asset));
+    const sidecar = ports.fs.readFileUtf8(import_node_path40.default.join(tempDir, `${asset}.sha256`));
+    if (downloaded === void 0 || sidecar === void 0) {
+      throw new UpdateDownloadError(`the downloaded files for ${asset} are missing from ${tempDir}`);
+    }
+    const expected = expectedSha256(sidecar);
+    const actual = (0, import_node_crypto17.createHash)("sha256").update(downloaded).digest("hex");
+    if (expected === void 0 || expected !== actual) {
+      throw new UpdateDownloadError(`checksum mismatch for ${asset} (expected ${expected ?? "(none)"}, got ${actual})`);
+    }
+    const tempBinary = import_node_path40.default.join(import_node_path40.default.dirname(target), `.${import_node_path40.default.basename(target)}.${String(process.pid)}.${(0, import_node_crypto17.randomUUID)()}.tmp`);
+    ports.fs.writeFileBytes(tempBinary, downloaded);
+    try {
+      ports.fs.chmod(tempBinary, EXECUTABLE_MODE);
+      ports.fs.rename(tempBinary, target);
+    } catch (error62) {
+      ports.fs.unlink(tempBinary);
+      throw error62;
+    }
+  } finally {
+    ports.fs.rmRecursive(tempDir);
+  }
+}
+async function runSelfUpdate(ports, options) {
+  const executableRealPath = ports.fs.realpath(options.executablePath);
+  const channel = detectChannel({ platform: options.platform, arch: options.arch, executableRealPath, fileHead: ports.fs.readFileHead(executableRealPath, 2) });
+  if (channel.kind !== "self") {
+    throw new UpdateChannelError(channelRefusalMessage(channel));
+  }
+  const asset = selectAsset(options.platform, options.arch);
+  if (asset === void 0) {
+    throw new UpdateChannelError(`no release binary exists for ${options.platform} ${options.arch}; install agent-shim through one of the documented channels instead (see docs/installation.md)`);
+  }
+  let effectiveUrl;
+  try {
+    effectiveUrl = await ports.http.effectiveUrl(LATEST_RELEASE_URL);
+  } catch (error62) {
+    throw new UpdateDownloadError(`could not resolve the latest release from ${LATEST_RELEASE_URL}: ${error62 instanceof Error ? error62.message : String(error62)}`);
+  }
+  const latest = releaseTagFromUrl(effectiveUrl);
+  if (latest === void 0) {
+    throw new UpdateDownloadError(`could not read the latest release version from ${effectiveUrl}`);
+  }
+  if (compareVersions3(latest, options.currentVersion) <= 0) {
+    return { current: options.currentVersion, latest: options.currentVersion, action: "current" };
+  }
+  if (options.checkOnly) {
+    return { current: options.currentVersion, latest, action: "available" };
+  }
+  const releaseLock = acquireUpdateLock(ports.fs, ports.isProcessAlive, options.pid, options.lockPath);
+  try {
+    await downloadAndInstall(ports, asset, executableRealPath);
+  } finally {
+    releaseLock();
+  }
+  return { current: options.currentVersion, latest, action: "updated" };
+}
+// src/update/commands.ts
+function isEnoent6(error62) {
+  return typeof error62 === "object" && error62 !== null && "code" in error62 && error62.code === "ENOENT";
+}
+function isErrorWithCode2(error62, code) {
+  return typeof error62 === "object" && error62 !== null && "code" in error62 && error62.code === code;
+}
+var realUpdatePorts = {
+  http: {
+    effectiveUrl: async (url2) => {
+      const response = await fetch(url2, { redirect: "follow" });
+      if (!response.ok) {
+        throw new Error(`HTTP ${String(response.status)}`);
+      }
+      return response.url;
+    },
+    download: async (url2) => {
+      const response = await fetch(url2, { redirect: "follow" });
+      if (!response.ok) {
+        throw new Error(`HTTP ${String(response.status)}`);
+      }
+      return new Uint8Array(await response.arrayBuffer());
+    }
+  },
+  fs: {
+    realpath: (target) => import_node_fs17.default.realpathSync(target),
+    readFileUtf8: (filePath) => {
+      try {
+        return import_node_fs17.default.readFileSync(filePath, "utf8");
+      } catch (error62) {
+        if (isEnoent6(error62)) {
+          return void 0;
+        }
+        throw error62;
+      }
+    },
+    readFileBytes: (filePath) => {
+      try {
+        return new Uint8Array(import_node_fs17.default.readFileSync(filePath));
+      } catch (error62) {
+        if (isEnoent6(error62)) {
+          return void 0;
+        }
+        throw error62;
+      }
+    },
+    readFileHead: (filePath, length) => {
+      let descriptor;
+      try {
+        descriptor = import_node_fs17.default.openSync(filePath, "r");
+      } catch (error62) {
+        if (isEnoent6(error62)) {
+          return void 0;
+        }
+        throw error62;
+      }
+      try {
+        const buffer = Buffer.alloc(length);
+        const read = import_node_fs17.default.readSync(descriptor, buffer, 0, length, 0);
+        return read === 0 ? "" : buffer.toString("latin1", 0, read);
+      } finally {
+        import_node_fs17.default.closeSync(descriptor);
+      }
+    },
+    writeFileUtf8: (filePath, contents) => {
+      import_node_fs17.default.writeFileSync(filePath, contents, "utf8");
+    },
+    writeFileBytes: (filePath, contents) => {
+      import_node_fs17.default.writeFileSync(filePath, contents);
+    },
+    writeFileExclusive: (filePath, contents) => {
+      try {
+        import_node_fs17.default.writeFileSync(filePath, contents, { encoding: "utf8", flag: "wx" });
+        return true;
+      } catch (error62) {
+        if (isErrorWithCode2(error62, "EEXIST")) {
+          return false;
+        }
+        throw error62;
+      }
+    },
+    unlink: (filePath) => {
+      try {
+        import_node_fs17.default.unlinkSync(filePath);
+      } catch (error62) {
+        if (!isEnoent6(error62)) {
+          throw error62;
+        }
+      }
+    },
+    rename: (from, to) => {
+      import_node_fs17.default.renameSync(from, to);
+    },
+    chmod: (filePath, mode) => {
+      import_node_fs17.default.chmodSync(filePath, mode);
+    },
+    mkdtemp: () => import_node_fs17.default.mkdtempSync(import_node_path41.default.join(import_node_os7.default.tmpdir(), "agent-shim-update-")),
+    rmRecursive: (targetPath) => {
+      import_node_fs17.default.rmSync(targetPath, { recursive: true, force: true });
+    }
+  },
+  // Signal 0 performs the permission and existence checks without delivering anything; EPERM means the process exists but belongs to another user.
+  isProcessAlive: (pid) => {
+    try {
+      process.kill(pid, 0);
+      return true;
+    } catch (error62) {
+      return isErrorWithCode2(error62, "EPERM");
+    }
+  }
+};
+function formatUpdateReport(report) {
+  switch (report.action) {
+    case "current":
+      return `already at the latest release (${report.latest})`;
+    case "available":
+      return `update available: ${report.current} -> ${report.latest} (run \`agent-shim update\` to install it)`;
+    case "updated":
+      return `updated agent-shim: ${report.current} -> ${report.latest}`;
+    default:
+      return report.action;
+  }
+}
+function registerUpdateCommand(program2, deps, ports = realUpdatePorts) {
+  withExamples(
+    program2.command("update").description(
+      "Download the newest release binary and install it over the running one. An installation that belongs to a package manager (Homebrew, npm, Scoop) names its channel and its upgrade command instead of updating in place."
+    ).option("--check", "Only report whether a newer release exists; download and change nothing.").option("--json", "Print the result as JSON.").action(async (options) => {
+      const report = await runSelfUpdate(ports, {
+        currentVersion: package_default.version,
+        platform: process.platform,
+        arch: process.arch,
+        executablePath: realOwnExecutablePath(),
+        lockPath: import_node_path41.default.join(deps.paths.root, "update.lock"),
+        checkOnly: options.check === true,
+        pid: process.pid
+      });
+      if (options.json === true) {
+        printJson(report);
+        return;
+      }
+      console.log(formatUpdateReport(report));
+    }),
+    ["agent-shim update", "agent-shim update --check", "agent-shim update --json"]
+  );
+}
 // src/usage/commands.ts
 var DAY_MS3 = 864e5;
 function requireIdentity(paths, name) {
@@ -77201,14 +77905,14 @@ function requireIdentity(paths, name) {
     throw new IdentityNotFoundError(name);
   }
 }
-function collectUsageReport(fs19, paths, filters) {
+function collectUsageReport(fs20, paths, filters) {
   const { identity, provider, sinceMs } = filters;
   if (identity !== void 0) {
     requireIdentity(paths, identity);
   }
-  const log = readUsageLog(fs19, paths.usageLogDir, sinceMs === void 0 ? {} : { sinceMs });
+  const log = readUsageLog(fs20, paths.usageLogDir, sinceMs === void 0 ? {} : { sinceMs });
   const records = log.records.filter((record2) => (identity === void 0 || record2.identity === identity) && (provider === void 0 || record2.provider === provider));
-  const snapshots = (identity === void 0 ? listUsageSnapshots(fs19, paths.usageSnapshotsDir) : [readUsageSnapshot(fs19, paths.usageSnapshotsDir, identity)].flatMap((snapshot) => snapshot === void 0 ? [] : [snapshot])).map((snapshot) => provider === void 0 ? snapshot : { ...snapshot, providers: Object.fromEntries(Object.entries(snapshot.providers).filter(([name]) => name === provider)) }).filter((snapshot) => Object.keys(snapshot.providers).length > 0);
+  const snapshots = (identity === void 0 ? listUsageSnapshots(fs20, paths.usageSnapshotsDir) : [readUsageSnapshot(fs20, paths.usageSnapshotsDir, identity)].flatMap((snapshot) => snapshot === void 0 ? [] : [snapshot])).map((snapshot) => provider === void 0 ? snapshot : { ...snapshot, providers: Object.fromEntries(Object.entries(snapshot.providers).filter(([name]) => name === provider)) }).filter((snapshot) => Object.keys(snapshot.providers).length > 0);
   return {
     since: sinceMs === void 0 ? void 0 : new Date(sinceMs).toISOString(),
     logDir: paths.usageLogDir,
@@ -77304,15 +78008,15 @@ function formatUsageReport(report) {
   }
   return lines;
 }
-function collectAccounts(fs19, paths, identity) {
+function collectAccounts(fs20, paths, identity) {
   if (identity !== void 0) {
     requireIdentity(paths, identity);
   }
   const names = identity === void 0 ? listIdentities(paths).map((entry) => entry.name) : [identity];
   return names.map((name) => ({
     identity: name,
-    account: readAccountMetadata(fs19, paths.identitiesDir, name),
-    usage: readUsageSnapshot(fs19, paths.usageSnapshotsDir, name)
+    account: readAccountMetadata(fs20, paths.identitiesDir, name),
+    usage: readUsageSnapshot(fs20, paths.usageSnapshotsDir, name)
   }));
 }
 function formatAccounts(views) {
@@ -77471,17 +78175,18 @@ function buildProgram(deps) {
   registerFrontDoorCommand(program2, deps);
   registerUsageCommands(program2, deps);
   registerRunCommand(program2, deps.runClaude);
+  registerUpdateCommand(program2, deps, deps.updatePorts);
   registerCompletionCommand(program2);
   return program2;
 }
 // src/launchWiring.ts
-var import_node_os8 = __toESM(require("node:os"), 1);
-var import_node_crypto18 = require("node:crypto");
+var import_node_os9 = __toESM(require("node:os"), 1);
+var import_node_crypto19 = require("node:crypto");
 // src/launcher.ts
-var import_node_crypto17 = require("node:crypto");
-var import_node_path41 = __toESM(require("node:path"), 1);
+var import_node_crypto18 = require("node:crypto");
+var import_node_path43 = __toESM(require("node:path"), 1);
 // src/launcher/cliOverride.ts
 var InvalidCliCategoryError = class extends CliError {
@@ -77565,7 +78270,7 @@ function buildCliOverride(params) {
 }
 // src/launcher/flags.ts
-var import_node_path40 = __toESM(require("node:path"), 1);
+var import_node_path42 = __toESM(require("node:path"), 1);
 // src/headroom/headers.ts
 function mergeAnthropicCustomHeaders(existing, additions) {
@@ -77626,7 +78331,7 @@ function buildEnv(params) {
   const parentCustomHeaders = params.baseEnv.ANTHROPIC_CUSTOM_HEADERS;
   let providerCustomHeaders;
   if (!params.configDirEscapeHatch && params.resolvedIdentityName !== void 0) {
-    env.CLAUDE_CONFIG_DIR = import_node_path40.default.join(params.identitiesDir, params.resolvedIdentityName);
+    env.CLAUDE_CONFIG_DIR = import_node_path42.default.join(params.identitiesDir, params.resolvedIdentityName);
   }
   if (params.provider !== void 0) {
     const providerEnv = params.provider.definition.env ?? {};
@@ -77752,14 +78457,14 @@ function resolvePoolLaunch(params) {
 }
 // src/launcher/spawn.ts
-var import_node_os7 = __toESM(require("node:os"), 1);
+var import_node_os8 = __toESM(require("node:os"), 1);
 var SIGNAL_EXIT_CODE_OFFSET = 128;
 function exitCodeFor(result) {
   if (result.status !== null) {
     return result.status;
   }
   if (result.signal !== null) {
-    return SIGNAL_EXIT_CODE_OFFSET + import_node_os7.default.constants.signals[result.signal];
+    return SIGNAL_EXIT_CODE_OFFSET + import_node_os8.default.constants.signals[result.signal];
   }
   return 1;
 }
@@ -77783,7 +78488,7 @@ function resolveIdentityCredential(identity, credential, env, port) {
   return resolution.ok ? resolution : { ok: false, status: CREDENTIAL_UNAVAILABLE_EXIT, message: resolution.message };
 }
 function pickFromPool(decided, params, parsedArgv) {
-  const { paths, fs: fs19, proc, log } = params;
+  const { paths, fs: fs20, proc, log } = params;
   if (decided.pool === void 0) {
     return { identityDecision: decided };
   }
@@ -77797,7 +78502,7 @@ function pickFromPool(decided, params, parsedArgv) {
     selectedVia: decided.source,
     pools: params.pools,
     paths,
-    fs: fs19,
+    fs: fs20,
     usageFs: farmRuntime.fs,
     cwd: farmRuntime.cwd,
     now: farmRuntime.now,
@@ -77813,7 +78518,7 @@ function pickFromPool(decided, params, parsedArgv) {
   return { identityDecision: { ...decided, name: resolution.identity }, poolExplanation: resolution.explanation };
 }
 function prepareLaunch(params) {
-  const { paths, fs: fs19, proc, log } = params;
+  const { paths, fs: fs20, proc, log } = params;
   const { env, argv } = proc;
   const parsedArgv = parseLauncherArgv(argv);
   const cliOverride = buildCliOverride({
@@ -77828,7 +78533,7 @@ function prepareLaunch(params) {
     argv0Identity: parsedArgv.identity,
     directoryPinnedIdentity: params.directoryPinnedIdentity,
     readActiveIdentityFile: () => {
-      const raw = fs19.readFileUtf8(paths.activeIdentityFile);
+      const raw = fs20.readFileUtf8(paths.activeIdentityFile);
       if (raw === void 0) {
         return void 0;
       }
@@ -77863,7 +78568,7 @@ function prepareLaunch(params) {
   }
   let loadedIdentity;
   if (identityDecision.name !== void 0) {
-    loadedIdentity = loadIdentity(paths.identitiesDir, identityDecision.name, fs19);
+    loadedIdentity = loadIdentity(paths.identitiesDir, identityDecision.name, fs20);
     if (loadedIdentity === void 0) {
       log.error(
         `agent-shim: no identity named "${identityDecision.name}" (selected via ${identityDecision.source}). Run \`agent-shim identity add ${identityDecision.name}\` first.`
@@ -77878,7 +78583,7 @@ function prepareLaunch(params) {
     identityDefaultConfigProfile: loadedIdentity?.config.defaultConfigProfile,
     globalDefaultConfigProfile: params.globalDefaultConfigProfile
   });
-  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs19.readConfigFile(import_node_path41.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
+  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs20.readConfigFile(import_node_path43.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
     log.error(
       `agent-shim: no configuration profile named "${configProfileDecision.name}" (selected via ${configProfileDecision.source}). Run \`agent-shim profile add ${configProfileDecision.name}\` first.`
     );
@@ -77887,7 +78592,7 @@ function prepareLaunch(params) {
   const farmContext = farm !== void 0 && farmIdentity !== void 0 ? { farm, identity: farmIdentity, cascade: farm.loadCascade(configProfileDecision.name, cliOverride) } : void 0;
   const provider = parsedArgv.provider === false ? void 0 : resolveProvider({
     paths,
-    port: fs19,
+    port: fs20,
     env,
     ...params.credentials === void 0 ? {} : { credentials: params.credentials },
     ...parsedArgv.provider === void 0 ? {} : { cliProvider: parsedArgv.provider },
@@ -78036,7 +78741,7 @@ function prepareLaunch(params) {
     ...identityCredential === void 0 ? {} : { identityCredential },
     ...frontDoor === void 0 ? {} : { frontdoor: frontDoor },
     ...headroom === void 0 ? {} : { headroom },
-    sessionId: (0, import_node_crypto17.randomUUID)()
+    sessionId: (0, import_node_crypto18.randomUUID)()
   });
   const releases = [...headroom === void 0 || headroomPort === void 0 ? [] : [headroomPort.release], ...frontDoorRelease === void 0 ? [] : [frontDoorRelease]];
   const release = () => {
@@ -78057,7 +78762,7 @@ function runLauncher(params) {
 // src/launchWiring.ts
 function buildFarmRuntime(paths, cwd) {
-  const home = import_node_os8.default.homedir();
+  const home = import_node_os9.default.homedir();
   const read = cosmiconfigReader();
   const classification = loadClassification(paths);
   const loaded = loadCascadeInput({ paths, home, cwd, read });
@@ -78081,7 +78786,7 @@ function buildFarmRuntime(paths, cwd) {
         ...cliOverride === void 0 ? {} : { cliOverride }
       }).input,
       now: () => Date.now(),
-      uniqueSuffix: `${String(process.pid)}.${(0, import_node_crypto18.randomUUID)()}`,
+      uniqueSuffix: `${String(process.pid)}.${(0, import_node_crypto19.randomUUID)()}`,
       // Zombie-aware on purpose: a previous launcher that crashed out of a resync without releasing the lock may sit unreaped, still answering signal 0 as alive, and must read as a dead holder so this launch takes the lock over instead of timing out.
       lock: { pid: process.pid, isRunning: realIsProcessRunning, sleep: realSleepSync }
     },
@@ -78220,7 +78925,7 @@ async function runClaude(argvOverride) {
 // src/cli.ts
 async function main() {
   aliasLegacyEnv(process.env);
-  const invokedName = import_node_path42.default.basename(process.argv[1] ?? "agent-shim");
+  const invokedName = import_node_path44.default.basename(process.argv[1] ?? "agent-shim");
   if (isInvokedAsClaude(invokedName)) {
     await runClaude();
     return;