agent-shim 8.21.0 → 8.22.0

package/dist/cli.cjs

@@ -3248,42 +3248,42 @@ var require_defaults = __commonJS({
 var require_env_paths = __commonJS({
   "node_modules/.pnpm/env-paths@2.2.1/node_modules/env-paths/index.js"(exports2, module2) {
     "use strict";
-    var path44 = require("path");
-    var os10 = require("os");
-    var homedir = os10.homedir();
-    var tmpdir = os10.tmpdir();
+    var path46 = require("path");
+    var os11 = require("os");
+    var homedir = os11.homedir();
+    var tmpdir = os11.tmpdir();
     var { env } = process;
     var macos = (name) => {
-      const library = path44.join(homedir, "Library");
+      const library = path46.join(homedir, "Library");
       return {
-        data: path44.join(library, "Application Support", name),
-        config: path44.join(library, "Preferences", name),
-        cache: path44.join(library, "Caches", name),
-        log: path44.join(library, "Logs", name),
-        temp: path44.join(tmpdir, name)
+        data: path46.join(library, "Application Support", name),
+        config: path46.join(library, "Preferences", name),
+        cache: path46.join(library, "Caches", name),
+        log: path46.join(library, "Logs", name),
+        temp: path46.join(tmpdir, name)
       };
     };
     var windows = (name) => {
-      const appData = env.APPDATA || path44.join(homedir, "AppData", "Roaming");
-      const localAppData = env.LOCALAPPDATA || path44.join(homedir, "AppData", "Local");
+      const appData = env.APPDATA || path46.join(homedir, "AppData", "Roaming");
+      const localAppData = env.LOCALAPPDATA || path46.join(homedir, "AppData", "Local");
       return {
         // Data/config/cache/log are invented by me as Windows isn't opinionated about this
-        data: path44.join(localAppData, name, "Data"),
-        config: path44.join(appData, name, "Config"),
-        cache: path44.join(localAppData, name, "Cache"),
-        log: path44.join(localAppData, name, "Log"),
-        temp: path44.join(tmpdir, name)
+        data: path46.join(localAppData, name, "Data"),
+        config: path46.join(appData, name, "Config"),
+        cache: path46.join(localAppData, name, "Cache"),
+        log: path46.join(localAppData, name, "Log"),
+        temp: path46.join(tmpdir, name)
       };
     };
     var linux = (name) => {
-      const username = path44.basename(homedir);
+      const username = path46.basename(homedir);
       return {
-        data: path44.join(env.XDG_DATA_HOME || path44.join(homedir, ".local", "share"), name),
-        config: path44.join(env.XDG_CONFIG_HOME || path44.join(homedir, ".config"), name),
-        cache: path44.join(env.XDG_CACHE_HOME || path44.join(homedir, ".cache"), name),
+        data: path46.join(env.XDG_DATA_HOME || path46.join(homedir, ".local", "share"), name),
+        config: path46.join(env.XDG_CONFIG_HOME || path46.join(homedir, ".config"), name),
+        cache: path46.join(env.XDG_CACHE_HOME || path46.join(homedir, ".cache"), name),
         // https://wiki.debian.org/XDGBaseDirectorySpecification#state
-        log: path44.join(env.XDG_STATE_HOME || path44.join(homedir, ".local", "state"), name),
-        temp: path44.join(tmpdir, username, name)
+        log: path46.join(env.XDG_STATE_HOME || path46.join(homedir, ".local", "state"), name),
+        temp: path46.join(tmpdir, username, name)
       };
     };
     var envPaths = (name, options) => {
@@ -3351,11 +3351,11 @@ var require_util = __commonJS({
       return result;
     }
     exports2.emplace = emplace;
-    function getPropertyByPath(source, path44) {
-      if (typeof path44 === "string" && Object.prototype.hasOwnProperty.call(source, path44)) {
-        return source[path44];
+    function getPropertyByPath(source, path46) {
+      if (typeof path46 === "string" && Object.prototype.hasOwnProperty.call(source, path46)) {
+        return source[path46];
       }
-      const parsedPath = typeof path44 === "string" ? path44.split(".") : path44;
+      const parsedPath = typeof path46 === "string" ? path46.split(".") : path46;
       return parsedPath.reduce((previous, key) => {
         if (previous === void 0) {
           return previous;
@@ -3378,9 +3378,9 @@ var require_util = __commonJS({
       return Object.fromEntries(Object.entries(options).filter(([, value2]) => value2 !== void 0));
     }
     exports2.removeUndefinedValuesFromObject = removeUndefinedValuesFromObject;
-    async function isDirectory(path44) {
+    async function isDirectory(path46) {
       try {
-        const stat = await fs_1.promises.stat(path44);
+        const stat = await fs_1.promises.stat(path46);
         return stat.isDirectory();
       } catch (e) {
         if (e.code === "ENOENT") {
@@ -3390,9 +3390,9 @@ var require_util = __commonJS({
       }
     }
     exports2.isDirectory = isDirectory;
-    function isDirectorySync(path44) {
+    function isDirectorySync(path46) {
       try {
-        const stat = fs_1.default.statSync(path44);
+        const stat = fs_1.default.statSync(path46);
         return stat.isDirectory();
       } catch (e) {
         if (e.code === "ENOENT") {
@@ -3490,7 +3490,7 @@ var require_ExplorerBase = __commonJS({
           const idx = importStack.indexOf(fullPath);
           if (idx !== -1) {
             throw new Error(`Circular import detected:
-${[...importStack, fullPath].map((path44, i2) => `${i2 + 1}. ${path44}`).join("\n")} (same as ${idx + 1}.)`);
+${[...importStack, fullPath].map((path46, i2) => `${i2 + 1}. ${path46}`).join("\n")} (same as ${idx + 1}.)`);
           }
         }
       }
@@ -3678,9 +3678,9 @@ var require_Explorer = __commonJS({
           throw error62;
         }
       }
-      async #fileExists(path44) {
+      async #fileExists(path46) {
         try {
-          await promises_1.default.stat(path44);
+          await promises_1.default.stat(path46);
           return true;
         } catch (e) {
           return false;
@@ -3840,9 +3840,9 @@ var require_ExplorerSync = __commonJS({
           throw error62;
         }
       }
-      #fileExists(path44) {
+      #fileExists(path46) {
         try {
-          fs_1.default.statSync(path44);
+          fs_1.default.statSync(path46);
           return true;
         } catch (e) {
           return false;
@@ -3966,7 +3966,7 @@ var require_dist = __commonJS({
       };
     }
     function getResolvedSearchPlaces(moduleName, toolDefinedSearchPlaces, userConfiguredOptions) {
-      const userConfiguredSearchPlaces = userConfiguredOptions.searchPlaces?.map((path44) => path44.replace("{name}", moduleName));
+      const userConfiguredSearchPlaces = userConfiguredOptions.searchPlaces?.map((path46) => path46.replace("{name}", moduleName));
       if (userConfiguredOptions.mergeSearchPlaces) {
         return [...userConfiguredSearchPlaces ?? [], ...toolDefinedSearchPlaces];
       }
@@ -4374,8 +4374,8 @@ var require_utils = __commonJS({
       }
       return output2;
     };
-    exports2.basename = (path44, { windows } = {}) => {
-      const segs = path44.split(windows ? /[\\/]/ : "/");
+    exports2.basename = (path46, { windows } = {}) => {
+      const segs = path46.split(windows ? /[\\/]/ : "/");
       const last = segs[segs.length - 1];
       if (last === "") {
         return segs[segs.length - 2];
@@ -7003,14 +7003,14 @@ var require_util2 = __commonJS({
         }
         const port = url2.port != null ? url2.port : url2.protocol === "https:" ? 443 : 80;
         let origin = url2.origin != null ? url2.origin : `${url2.protocol || ""}//${url2.hostname || ""}:${port}`;
-        let path44 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`;
+        let path46 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`;
         if (origin[origin.length - 1] === "/") {
           origin = origin.slice(0, origin.length - 1);
         }
-        if (path44 && path44[0] !== "/") {
-          path44 = `/${path44}`;
+        if (path46 && path46[0] !== "/") {
+          path46 = `/${path46}`;
         }
-        return new URL(`${origin}${path44}`);
+        return new URL(`${origin}${path46}`);
       }
       if (!isHttpOrHttpsPrefixed(url2.origin || url2.protocol)) {
         throw new InvalidArgumentError2("Invalid URL protocol: the URL must start with `http:` or `https:`.");
@@ -7831,9 +7831,9 @@ var require_diagnostics = __commonJS({
         "undici:client:sendHeaders",
         (evt) => {
           const {
-            request: { method, path: path44, origin }
+            request: { method, path: path46, origin }
           } = evt;
-          debugLog("sending request to %s %s%s", method, origin, path44);
+          debugLog("sending request to %s %s%s", method, origin, path46);
         }
       );
     }
@@ -7851,14 +7851,14 @@ var require_diagnostics = __commonJS({
         "undici:request:headers",
         (evt) => {
           const {
-            request: { method, path: path44, origin },
+            request: { method, path: path46, origin },
             response: { statusCode }
           } = evt;
           debugLog(
             "received response to %s %s%s - HTTP %d",
             method,
             origin,
-            path44,
+            path46,
             statusCode
           );
         }
@@ -7867,23 +7867,23 @@ var require_diagnostics = __commonJS({
         "undici:request:trailers",
         (evt) => {
           const {
-            request: { method, path: path44, origin }
+            request: { method, path: path46, origin }
           } = evt;
-          debugLog("trailers received from %s %s%s", method, origin, path44);
+          debugLog("trailers received from %s %s%s", method, origin, path46);
         }
       );
       diagnosticsChannel.subscribe(
         "undici:request:error",
         (evt) => {
           const {
-            request: { method, path: path44, origin },
+            request: { method, path: path46, origin },
             error: error62
           } = evt;
           debugLog(
             "request to %s %s%s errored - %s",
             method,
             origin,
-            path44,
+            path46,
             error62.message
           );
         }
@@ -7998,7 +7998,7 @@ var require_request = __commonJS({
     var kHandler = /* @__PURE__ */ Symbol("handler");
     var Request2 = class {
       constructor(origin, {
-        path: path44,
+        path: path46,
         method,
         body,
         headers,
@@ -8015,11 +8015,11 @@ var require_request = __commonJS({
         maxRedirections,
         typeOfService
       }, handler) {
-        if (typeof path44 !== "string") {
+        if (typeof path46 !== "string") {
           throw new InvalidArgumentError2("path must be a string");
-        } else if (path44[0] !== "/" && !(path44.startsWith("http://") || path44.startsWith("https://")) && method !== "CONNECT") {
+        } else if (path46[0] !== "/" && !(path46.startsWith("http://") || path46.startsWith("https://")) && method !== "CONNECT") {
           throw new InvalidArgumentError2("path must be an absolute URL or start with a slash");
-        } else if (invalidPathRegex.test(path44)) {
+        } else if (invalidPathRegex.test(path46)) {
           throw new InvalidArgumentError2("invalid request path");
         }
         if (typeof method !== "string") {
@@ -8094,7 +8094,7 @@ var require_request = __commonJS({
         this.completed = false;
         this.aborted = false;
         this.upgrade = upgrade || null;
-        this.path = query ? serializePathWithQuery(path44, query) : path44;
+        this.path = query ? serializePathWithQuery(path46, query) : path46;
         this.origin = origin;
         this.protocol = getProtocolFromUrlString(origin);
         this.idempotent = idempotent == null ? method === "HEAD" || method === "GET" : idempotent;
@@ -13276,7 +13276,7 @@ var require_client_h1 = __commonJS({
       return method !== "GET" && method !== "HEAD" && method !== "OPTIONS" && method !== "TRACE" && method !== "CONNECT";
     }
     function writeH1(client, request7) {
-      const { method, path: path44, host, upgrade, blocking, reset } = request7;
+      const { method, path: path46, host, upgrade, blocking, reset } = request7;
       let { body, headers, contentLength } = request7;
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH" || method === "QUERY" || method === "PROPFIND" || method === "PROPPATCH";
       if (util.isFormDataLike(body)) {
@@ -13354,7 +13354,7 @@ var require_client_h1 = __commonJS({
       if (socket.setTypeOfService) {
         socket.setTypeOfService(request7.typeOfService);
       }
-      let header = `${method} ${path44} HTTP/1.1\r
+      let header = `${method} ${path46} HTTP/1.1\r
 `;
       if (typeof host === "string") {
         header += `host: ${host}\r
@@ -14033,7 +14033,7 @@ var require_client_h2 = __commonJS({
       const headersTimeout = request7.headersTimeout ?? client[kHeadersTimeout];
       const bodyTimeout = request7.bodyTimeout ?? client[kBodyTimeout];
       const session = client[kHTTP2Session];
-      const { method, path: path44, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request7;
+      const { method, path: path46, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request7;
       let { body } = request7;
       if (upgrade != null && upgrade !== "websocket") {
         util.errorRequest(client, request7, new InvalidArgumentError2(`Custom upgrade "${upgrade}" not supported over HTTP/2`));
@@ -14102,7 +14102,7 @@ var require_client_h2 = __commonJS({
           }
           headers[HTTP2_HEADER_METHOD] = "CONNECT";
           headers[HTTP2_HEADER_PROTOCOL] = "websocket";
-          headers[HTTP2_HEADER_PATH] = path44;
+          headers[HTTP2_HEADER_PATH] = path46;
           if (protocol === "ws:" || protocol === "wss:") {
             headers[HTTP2_HEADER_SCHEME] = protocol === "ws:" ? "http" : "https";
           } else {
@@ -14144,7 +14144,7 @@ var require_client_h2 = __commonJS({
         stream.setTimeout(headersTimeout);
         return true;
       }
-      headers[HTTP2_HEADER_PATH] = path44;
+      headers[HTTP2_HEADER_PATH] = path46;
       headers[HTTP2_HEADER_SCHEME] = protocol === "http:" ? "http" : "https";
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH";
       if (body && typeof body.read === "function") {
@@ -16496,10 +16496,10 @@ var require_proxy_agent = __commonJS({
         };
         const {
           origin,
-          path: path44 = "/",
+          path: path46 = "/",
           headers = {}
         } = opts;
-        opts.path = origin + path44;
+        opts.path = origin + path46;
         if (!("host" in headers) && !("Host" in headers)) {
           const { host } = new URL(origin);
           headers.host = host;
@@ -18608,20 +18608,20 @@ var require_mock_utils = __commonJS({
       }
       return normalizedQp;
     }
-    function safeUrl(path44) {
-      if (typeof path44 !== "string") {
-        return path44;
+    function safeUrl(path46) {
+      if (typeof path46 !== "string") {
+        return path46;
       }
-      const pathSegments = path44.split("?", 3);
+      const pathSegments = path46.split("?", 3);
       if (pathSegments.length !== 2) {
-        return path44;
+        return path46;
       }
       const qp = new URLSearchParams(pathSegments.pop());
       qp.sort();
       return [...pathSegments, qp.toString()].join("?");
     }
-    function matchKey(mockDispatch2, { path: path44, method, body, headers }) {
-      const pathMatch = matchValue(mockDispatch2.path, path44);
+    function matchKey(mockDispatch2, { path: path46, method, body, headers }) {
+      const pathMatch = matchValue(mockDispatch2.path, path46);
       const methodMatch = matchValue(mockDispatch2.method, method);
       const bodyMatch = typeof mockDispatch2.body !== "undefined" ? matchValue(mockDispatch2.body, body) : true;
       const headersMatch = matchHeaders(mockDispatch2, headers);
@@ -18646,8 +18646,8 @@ var require_mock_utils = __commonJS({
       const basePath = key.query ? serializePathWithQuery(key.path, key.query) : key.path;
       const resolvedPath = typeof basePath === "string" ? safeUrl(basePath) : basePath;
       const resolvedPathWithoutTrailingSlash = removeTrailingSlash(resolvedPath);
-      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path44, ignoreTrailingSlash }) => {
-        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path44)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path44), resolvedPath);
+      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path46, ignoreTrailingSlash }) => {
+        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path46)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path46), resolvedPath);
       });
       if (matchedMockDispatches.length === 0) {
         throw new MockNotMatchedError(`Mock dispatch not matched for path '${resolvedPath}'`);
@@ -18686,19 +18686,19 @@ var require_mock_utils = __commonJS({
         mockDispatches.splice(index, 1);
       }
     }
-    function removeTrailingSlash(path44) {
-      while (path44.endsWith("/")) {
-        path44 = path44.slice(0, -1);
+    function removeTrailingSlash(path46) {
+      while (path46.endsWith("/")) {
+        path46 = path46.slice(0, -1);
       }
-      if (path44.length === 0) {
-        path44 = "/";
+      if (path46.length === 0) {
+        path46 = "/";
       }
-      return path44;
+      return path46;
     }
     function buildKey(opts) {
-      const { path: path44, method, body, headers, query } = opts;
+      const { path: path46, method, body, headers, query } = opts;
       return {
-        path: path44,
+        path: path46,
         method,
         body,
         headers,
@@ -19388,10 +19388,10 @@ var require_pending_interceptors_formatter = __commonJS({
       }
       format(pendingInterceptors) {
         const withPrettyHeaders = pendingInterceptors.map(
-          ({ method, path: path44, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
+          ({ method, path: path46, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
             Method: method,
             Origin: origin,
-            Path: path44,
+            Path: path46,
             "Status code": statusCode,
             Persistent: persist ? PERSISTENT : NOT_PERSISTENT,
             Invocations: timesInvoked,
@@ -19473,9 +19473,9 @@ var require_mock_agent = __commonJS({
         const acceptNonStandardSearchParameters = this[kMockAgentAcceptsNonStandardSearchParameters];
         const dispatchOpts = { ...opts };
         if (acceptNonStandardSearchParameters && dispatchOpts.path) {
-          const [path44, searchParams] = dispatchOpts.path.split("?");
+          const [path46, searchParams] = dispatchOpts.path.split("?");
           const normalizedSearchParams = normalizeSearchParams(searchParams, acceptNonStandardSearchParameters);
-          dispatchOpts.path = `${path44}?${normalizedSearchParams}`;
+          dispatchOpts.path = `${path46}?${normalizedSearchParams}`;
         }
         return this[kAgent].dispatch(dispatchOpts, handler);
       }
@@ -19876,12 +19876,12 @@ var require_snapshot_recorder = __commonJS({
        * @return {Promise<void>} - Resolves when snapshots are loaded
        */
       async loadSnapshots(filePath) {
-        const path44 = filePath || this.#snapshotPath;
-        if (!path44) {
+        const path46 = filePath || this.#snapshotPath;
+        if (!path46) {
           throw new InvalidArgumentError2("Snapshot path is required");
         }
         try {
-          const data = await readFile(resolve(path44), "utf8");
+          const data = await readFile(resolve(path46), "utf8");
           const parsed = JSON.parse(data);
           if (Array.isArray(parsed)) {
             this.#snapshots.clear();
@@ -19895,7 +19895,7 @@ var require_snapshot_recorder = __commonJS({
           if (error62.code === "ENOENT") {
             this.#snapshots.clear();
           } else {
-            throw new UndiciError(`Failed to load snapshots from ${path44}`, { cause: error62 });
+            throw new UndiciError(`Failed to load snapshots from ${path46}`, { cause: error62 });
           }
         }
       }
@@ -19906,11 +19906,11 @@ var require_snapshot_recorder = __commonJS({
        * @returns {Promise<void>} - Resolves when snapshots are saved
        */
       async saveSnapshots(filePath) {
-        const path44 = filePath || this.#snapshotPath;
-        if (!path44) {
+        const path46 = filePath || this.#snapshotPath;
+        if (!path46) {
           throw new InvalidArgumentError2("Snapshot path is required");
         }
-        const resolvedPath = resolve(path44);
+        const resolvedPath = resolve(path46);
         await mkdir(dirname2(resolvedPath), { recursive: true });
         const data = Array.from(this.#snapshots.entries()).map(([hash2, snapshot]) => ({
           hash: hash2,
@@ -20542,15 +20542,15 @@ var require_redirect_handler = __commonJS({
           return;
         }
         const { origin, pathname, search } = util.parseURL(new URL(this.location, this.opts.origin && new URL(this.opts.path, this.opts.origin)));
-        const path44 = search ? `${pathname}${search}` : pathname;
-        const redirectUrlString = `${origin}${path44}`;
+        const path46 = search ? `${pathname}${search}` : pathname;
+        const redirectUrlString = `${origin}${path46}`;
         for (const historyUrl of this.history) {
           if (historyUrl.toString() === redirectUrlString) {
             throw new InvalidArgumentError2(`Redirect loop detected. Cannot redirect to ${origin}. This typically happens when using a Client or Pool with cross-origin redirects. Use an Agent for cross-origin redirects.`);
           }
         }
         this.opts.headers = cleanRequestHeaders(this.opts.headers, statusCode === 303, this.opts.origin !== origin);
-        this.opts.path = path44;
+        this.opts.path = path46;
         this.opts.origin = origin;
         this.opts.query = null;
       }
@@ -22310,10 +22310,10 @@ var require_cache_handler = __commonJS({
       }
       return locationUrl.pathname + locationUrl.search;
     }
-    function deleteCachedUri(store, cacheKey, path44) {
+    function deleteCachedUri(store, cacheKey, path46) {
       deleteCachedValue(store, {
         ...cacheKey,
-        path: path44
+        path: path46
       });
       for (let i2 = 0; i2 < util.safeHTTPMethods.length; i2++) {
         const method = util.safeHTTPMethods[i2];
@@ -22321,7 +22321,7 @@ var require_cache_handler = __commonJS({
           deleteCachedValue(store, {
             ...cacheKey,
             method,
-            path: path44
+            path: path46
           });
         }
       }
@@ -22332,9 +22332,9 @@ var require_cache_handler = __commonJS({
       }
       const values = Array.isArray(headerValue2) ? headerValue2 : [headerValue2];
       for (let i2 = 0; i2 < values.length; i2++) {
-        const path44 = getSameOriginPath(cacheKey, values[i2]);
-        if (path44 !== void 0) {
-          deleteCachedUri(store, cacheKey, path44);
+        const path46 = getSameOriginPath(cacheKey, values[i2]);
+        if (path46 !== void 0) {
+          deleteCachedUri(store, cacheKey, path46);
         }
       }
     }
@@ -27334,11 +27334,11 @@ var require_fetch = __commonJS({
       function dispatch({ body }) {
         const url2 = requestCurrentURL(request7);
         const agent = fetchParams.controller.dispatcher;
-        const path44 = url2.pathname + url2.search;
+        const path46 = url2.pathname + url2.search;
         const hasTrailingQuestionMark = url2.search.length === 0 && url2.href[url2.href.length - url2.hash.length - 1] === "?";
         return new Promise((resolve, reject) => agent.dispatch(
           {
-            path: hasTrailingQuestionMark ? `${path44}?` : path44,
+            path: hasTrailingQuestionMark ? `${path46}?` : path46,
             origin: url2.origin,
             method: request7.method,
             body: agent.isMockActive ? request7.body && (request7.body.source || request7.body.stream) : body,
@@ -28285,9 +28285,9 @@ var require_util5 = __commonJS({
         }
       }
     }
-    function validateCookiePath(path44) {
-      for (let i2 = 0; i2 < path44.length; ++i2) {
-        const code = path44.charCodeAt(i2);
+    function validateCookiePath(path46) {
+      for (let i2 = 0; i2 < path46.length; ++i2) {
+        const code = path46.charCodeAt(i2);
         if (code < 32 || // exclude CTLs (0-31)
         code > 126 || // exclude DEL and non-ascii
         code === 59) {
@@ -31635,11 +31635,11 @@ var require_undici = __commonJS({
           if (typeof opts.path !== "string") {
             throw new InvalidArgumentError2("invalid opts.path");
           }
-          let path44 = opts.path;
+          let path46 = opts.path;
           if (!opts.path.startsWith("/")) {
-            path44 = `/${path44}`;
+            path46 = `/${path46}`;
           }
-          url2 = new URL(util.parseOrigin(url2).origin + path44);
+          url2 = new URL(util.parseOrigin(url2).origin + path46);
         } else {
           if (!opts) {
             opts = typeof url2 === "object" ? url2 : {};
@@ -31749,7 +31749,7 @@ ${captureLines}` : capture.stack;
 });
 
 // src/cli.ts
-var import_node_path42 = __toESM(require("node:path"), 1);
+var import_node_path44 = __toESM(require("node:path"), 1);
 
 // node_modules/.pnpm/commander@15.0.0/node_modules/commander/lib/error.js
 var CommanderError = class extends Error {
@@ -34862,9 +34862,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
    * @param {string} [path]
    * @return {(string|null|Command)}
    */
-  executableDir(path44) {
-    if (path44 === void 0) return this._executableDir;
-    this._executableDir = path44;
+  executableDir(path46) {
+    if (path46 === void 0) return this._executableDir;
+    this._executableDir = path46;
     return this;
   }
   /**
@@ -36002,10 +36002,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path44) {
-  if (!path44)
+function getElementAtPath(obj, path46) {
+  if (!path46)
     return obj;
-  return path44.reduce((acc, key) => acc?.[key], obj);
+  return path46.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -36345,11 +36345,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path44, issues) {
+function prefixIssues(path46, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path44);
+    iss.path.unshift(path46);
     return iss;
   });
 }
@@ -36799,16 +36799,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path44 = []) => {
+  const processError = (error63, path46 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path44, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path46, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path44, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path46, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path44, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path46, ...issue2.path]);
       } else {
-        const fullpath = [...path44, ...issue2.path];
+        const fullpath = [...path46, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -36847,17 +36847,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error63, path44 = []) => {
+  const processError = (error63, path46 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path44, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path46, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path44, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path46, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path44, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path46, ...issue2.path]);
       } else {
-        const fullpath = [...path44, ...issue2.path];
+        const fullpath = [...path46, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -36896,8 +36896,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path44 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path44) {
+  const path46 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path46) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -53999,13 +53999,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path44 = ref.slice(1).split("/").filter(Boolean);
-  if (path44.length === 0) {
+  const path46 = ref.slice(1).split("/").filter(Boolean);
+  if (path46.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path44[0] === defsKey) {
-    const key = path44[1] === void 0 ? void 0 : decodeJSONPointerSegment(path44[1]);
+  if (path46[0] === defsKey) {
+    const key = path46[1] === void 0 ? void 0 : decodeJSONPointerSegment(path46[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -55435,16 +55435,16 @@ function parseJson(raw, schema) {
   const parsed = schema.safeParse(JSON.parse(raw));
   return parsed.success ? parsed.data : void 0;
 }
-function readHeadroomState(fs19, stateFile) {
+function readHeadroomState(fs20, stateFile) {
   try {
-    return parseJson(fs19.readFileUtf8(stateFile), HeadroomStateSchema);
+    return parseJson(fs20.readFileUtf8(stateFile), HeadroomStateSchema);
   } catch {
     return void 0;
   }
 }
-function writeHeadroomState(fs19, stateFile, state) {
-  fs19.mkdirp(import_node_path5.default.dirname(stateFile));
-  fs19.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
+function writeHeadroomState(fs20, stateFile, state) {
+  fs20.mkdirp(import_node_path5.default.dirname(stateFile));
+  fs20.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
 `);
 }
 function headroomAllowlist(providers) {
@@ -55464,14 +55464,14 @@ function headroomUpstreams(providers, frontDoorOrigin2) {
 function hashAllowlist(allowlist) {
   return (0, import_node_crypto2.createHash)("sha256").update(allowlist.join("\n")).digest("hex");
 }
-function readAllProviders(fs19, providersDir) {
+function readAllProviders(fs20, providersDir) {
   const result = [];
-  for (const name of fs19.readdir(providersDir)) {
+  for (const name of fs20.readdir(providersDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = parseJson(fs19.readFileUtf8(import_node_path5.default.join(providersDir, name)), ProviderSchema);
+      const parsed = parseJson(fs20.readFileUtf8(import_node_path5.default.join(providersDir, name)), ProviderSchema);
       if (parsed !== void 0) {
         result.push({ name: name.slice(0, -".json".length), provider: parsed });
       }
@@ -55481,22 +55481,22 @@ function readAllProviders(fs19, providersDir) {
   }
   return result;
 }
-function writeSession(fs19, sessionsDir, session) {
-  fs19.mkdirp(sessionsDir);
-  fs19.writeFileUtf8(import_node_path5.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
+function writeSession(fs20, sessionsDir, session) {
+  fs20.mkdirp(sessionsDir);
+  fs20.writeFileUtf8(import_node_path5.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
 `);
 }
-function removeSession(fs19, sessionsDir, pid) {
-  fs19.removeRecursive(import_node_path5.default.join(sessionsDir, `${String(pid)}.json`));
+function removeSession(fs20, sessionsDir, pid) {
+  fs20.removeRecursive(import_node_path5.default.join(sessionsDir, `${String(pid)}.json`));
 }
-function listSessions(fs19, sessionsDir) {
+function listSessions(fs20, sessionsDir) {
   const sessions = [];
-  for (const name of fs19.readdir(sessionsDir)) {
+  for (const name of fs20.readdir(sessionsDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = parseJson(fs19.readFileUtf8(import_node_path5.default.join(sessionsDir, name)), HeadroomSessionSchema);
+      const parsed = parseJson(fs20.readFileUtf8(import_node_path5.default.join(sessionsDir, name)), HeadroomSessionSchema);
       if (parsed !== void 0) {
         sessions.push(parsed);
       }
@@ -55506,22 +55506,22 @@ function listSessions(fs19, sessionsDir) {
   }
   return sessions.sort((a2, b) => a2.pid - b.pid);
 }
-function sessionsForSupervisor(fs19, sessionsDir, supervisorPid) {
-  return listSessions(fs19, sessionsDir).filter((session) => session.supervisorPid === supervisorPid);
+function sessionsForSupervisor(fs20, sessionsDir, supervisorPid) {
+  return listSessions(fs20, sessionsDir).filter((session) => session.supervisorPid === supervisorPid);
 }
-function pruneDeadSessions(fs19, sessionsDir, isRunning) {
+function pruneDeadSessions(fs20, sessionsDir, isRunning) {
   const removed = [];
-  for (const session of listSessions(fs19, sessionsDir)) {
+  for (const session of listSessions(fs20, sessionsDir)) {
     if (!isRunning(session.pid)) {
-      removeSession(fs19, sessionsDir, session.pid);
+      removeSession(fs20, sessionsDir, session.pid);
       removed.push(session.pid);
     }
   }
   return removed;
 }
-function readStartLock(fs19, lockFile) {
+function readStartLock(fs20, lockFile) {
   try {
-    return parseJson(fs19.readFileUtf8(lockFile), HeadroomLockSchema);
+    return parseJson(fs20.readFileUtf8(lockFile), HeadroomLockSchema);
   } catch {
     return void 0;
   }
@@ -55626,10 +55626,10 @@ var FrontDoorStateSchema = external_exports.strictObject({
   /** The last fatal error, kept across shutdowns so `frontdoor status` can explain a front door that is not running. */
   lastError: external_exports.string().optional()
 });
-function readFrontDoorState(fs19, stateFile) {
+function readFrontDoorState(fs20, stateFile) {
   let raw;
   try {
-    raw = fs19.readFileUtf8(stateFile);
+    raw = fs20.readFileUtf8(stateFile);
   } catch {
     return void 0;
   }
@@ -55643,28 +55643,28 @@ function readFrontDoorState(fs19, stateFile) {
     return void 0;
   }
 }
-function writeFrontDoorState(fs19, stateFile, state) {
-  fs19.mkdirp(import_node_path6.default.dirname(stateFile));
-  fs19.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
+function writeFrontDoorState(fs20, stateFile, state) {
+  fs20.mkdirp(import_node_path6.default.dirname(stateFile));
+  fs20.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
 `);
 }
 function frontDoorOrigin(state) {
   const port = state?.directPort ?? state?.lastDirectPort;
   return port === void 0 ? void 0 : `http://127.0.0.1:${String(port)}`;
 }
-function writeFrontDoorSession(fs19, sessionsDir, session) {
-  fs19.mkdirPrivate(sessionsDir);
-  fs19.writeFilePrivate(import_node_path6.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
+function writeFrontDoorSession(fs20, sessionsDir, session) {
+  fs20.mkdirPrivate(sessionsDir);
+  fs20.writeFilePrivate(import_node_path6.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
 `);
 }
-function listFrontDoorSessions(fs19, sessionsDir) {
+function listFrontDoorSessions(fs20, sessionsDir) {
   const sessions = [];
-  for (const name of fs19.readdir(sessionsDir)) {
+  for (const name of fs20.readdir(sessionsDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs19.readFileUtf8(import_node_path6.default.join(sessionsDir, name)) ?? ""));
+      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs20.readFileUtf8(import_node_path6.default.join(sessionsDir, name)) ?? ""));
       if (parsed.success) {
         sessions.push({ pid: parsed.data.pid, startedAt: parsed.data.startedAt });
       }
@@ -55674,27 +55674,27 @@ function listFrontDoorSessions(fs19, sessionsDir) {
   }
   return sessions.sort((a2, b) => a2.pid - b.pid);
 }
-function removeFrontDoorSession(fs19, sessionsDir, pid) {
-  fs19.removeRecursive(import_node_path6.default.join(sessionsDir, `${String(pid)}.json`));
+function removeFrontDoorSession(fs20, sessionsDir, pid) {
+  fs20.removeRecursive(import_node_path6.default.join(sessionsDir, `${String(pid)}.json`));
 }
-function pruneDeadFrontDoorSessions(fs19, sessionsDir, isRunning) {
+function pruneDeadFrontDoorSessions(fs20, sessionsDir, isRunning) {
   const removed = [];
-  for (const session of listFrontDoorSessions(fs19, sessionsDir)) {
+  for (const session of listFrontDoorSessions(fs20, sessionsDir)) {
     if (!isRunning(session.pid)) {
-      removeFrontDoorSession(fs19, sessionsDir, session.pid);
+      removeFrontDoorSession(fs20, sessionsDir, session.pid);
       removed.push(session.pid);
     }
   }
   return removed;
 }
-function liveSessionTokens(fs19, sessionsDir) {
+function liveSessionTokens(fs20, sessionsDir) {
   const tokens = /* @__PURE__ */ new Set();
-  for (const name of fs19.readdir(sessionsDir)) {
+  for (const name of fs20.readdir(sessionsDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs19.readFileUtf8(import_node_path6.default.join(sessionsDir, name)) ?? ""));
+      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs20.readFileUtf8(import_node_path6.default.join(sessionsDir, name)) ?? ""));
       if (parsed.success) {
         tokens.add(parsed.data.token);
       }
@@ -55777,7 +55777,7 @@ function verifyHeadroomSocket(socketPath, ports) {
   const refusal = ownerOnlyRefusal("socket directory", directory, ports.lstat(directory), "dir", uid) ?? ownerOnlyRefusal("socket", socketPath, ports.lstat(socketPath), "socket", uid);
   return refusal === void 0 ? { socketPath } : { refused: refusal };
 }
-function prepareHeadroomSocket(fs19, ports, paths, supervisorPid) {
+function prepareHeadroomSocket(fs20, ports, paths, supervisorPid) {
   const unsupported = platformRefusal(ports.platform);
   if (unsupported !== void 0) {
     return { refused: unsupported };
@@ -55792,18 +55792,18 @@ function prepareHeadroomSocket(fs19, ports, paths, supervisorPid) {
   if (ports.lstat(paths.headroomSocketDir)?.kind === "symlink") {
     return { refused: `the headroom socket directory ${paths.headroomSocketDir} is a symlink; it must be the real directory` };
   }
-  fs19.mkdirPrivate(paths.headroomSocketDir);
+  fs20.mkdirPrivate(paths.headroomSocketDir);
   const refusal = ownerOnlyRefusal("socket directory", paths.headroomSocketDir, ports.lstat(paths.headroomSocketDir), "dir", ports.currentUid());
   return refusal === void 0 ? { socketPath } : { refused: refusal };
 }
-function pruneStaleHeadroomSockets(fs19, paths, isRunning) {
+function pruneStaleHeadroomSockets(fs20, paths, isRunning) {
   const removed = [];
-  for (const name of fs19.readdir(paths.headroomSocketDir)) {
+  for (const name of fs20.readdir(paths.headroomSocketDir)) {
     const pid = HEADROOM_SOCKET_NAME.exec(name)?.[1];
     if (pid === void 0 || isRunning(Number.parseInt(pid, 10))) {
       continue;
     }
-    fs19.removeRecursive(import_node_path7.default.join(paths.headroomSocketDir, name));
+    fs20.removeRecursive(import_node_path7.default.join(paths.headroomSocketDir, name));
     removed.push(name);
   }
   return removed;
@@ -55933,28 +55933,28 @@ function compareVersions2(a2, b) {
 }
 var HEADROOM_SUPERVISOR_STILL_RUNNING = -1;
 async function runSupervisor(initialConfig, ports, options = {}) {
-  const { fs: fs19, paths } = ports;
+  const { fs: fs20, paths } = ports;
   let config2 = initialConfig;
-  const previousState = readHeadroomState(fs19, paths.headroomStateFile);
+  const previousState = readHeadroomState(fs20, paths.headroomStateFile);
   if (previousState?.supervisorPid !== void 0 && previousState.supervisorPid !== ports.ownPid && ports.isRunning(previousState.supervisorPid)) {
     ports.log(`agent-shim headroom supervisor ${String(ports.ownPid)}: supervisor ${String(previousState.supervisorPid)} already owns the daemon; exiting`);
     return 0;
   }
   let installedSource = previousState?.installedSource;
   const ownsState = () => {
-    const owner = readHeadroomState(fs19, paths.headroomStateFile)?.supervisorPid;
+    const owner = readHeadroomState(fs20, paths.headroomStateFile)?.supervisorPid;
     return owner === void 0 || owner === ports.ownPid || !ports.isRunning(owner);
   };
   const writeOwnState = (state) => {
     if (!ownsState()) {
       return false;
     }
-    writeHeadroomState(fs19, paths.headroomStateFile, state);
+    writeHeadroomState(fs20, paths.headroomStateFile, state);
     return true;
   };
   const fail = (message) => {
     if (writeOwnState({ lastError: message })) {
-      fs19.removeRecursive(paths.headroomLockFile);
+      fs20.removeRecursive(paths.headroomLockFile);
     }
     ports.log(`agent-shim headroom supervisor: ${message}`);
     return 1;
@@ -55976,12 +55976,12 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     installedSource = config2.source;
     return true;
   };
-  const socket = prepareHeadroomSocket(fs19, ports.socketTrust, paths, ports.ownPid);
+  const socket = prepareHeadroomSocket(fs20, ports.socketTrust, paths, ports.ownPid);
   if (socket.refused !== void 0) {
     return fail(socket.refused);
   }
   const { socketPath } = socket;
-  pruneStaleHeadroomSockets(fs19, paths, ports.isRunning);
+  pruneStaleHeadroomSockets(fs20, paths, ports.isRunning);
   if (!ensureInstalled()) {
     return fail(`could not install headroom from ${config2.source}: install failed (is uv installed and on PATH?)`);
   }
@@ -56009,7 +56009,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     const settingsHash = hashSettings(config2.settings);
     const allowlist = allowlistOf(ports);
     const allowlistHash = hashAllowlist(allowlist);
-    pruneDeadSessions(fs19, paths.headroomSessionsDir, ports.isRunning);
+    pruneDeadSessions(fs20, paths.headroomSessionsDir, ports.isRunning);
     const ownsNow = ownsState();
     if (!ownsNow && !superseded) {
       ports.log("agent-shim headroom supervisor: another supervisor now owns the state file; serving this daemon's own sessions until they end");
@@ -56051,7 +56051,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
           installedSource: config2.source
         });
         if (recorded) {
-          fs19.removeRecursive(paths.headroomLockFile);
+          fs20.removeRecursive(paths.headroomLockFile);
         }
         idleSince = void 0;
         ports.log(`agent-shim headroom supervisor: headroom pid ${String(pid)} ready on unix socket ${socketPath}`);
@@ -56066,7 +56066,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
       }
     } else {
       if (runningHash !== allowlistHash || runningSettingsHash !== settingsHash || installedSource !== config2.source) {
-        if (sessionsForSupervisor(fs19, paths.headroomSessionsDir, ports.ownPid).length === 0) {
+        if (sessionsForSupervisor(fs20, paths.headroomSessionsDir, ports.ownPid).length === 0) {
           ports.log("agent-shim headroom supervisor: configuration drifted and no sessions are live; restarting headroom");
           ports.stopProcess(headroomPid);
           headroomPid = void 0;
@@ -56075,7 +56075,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
           continue;
         }
       }
-      const sessions = sessionsForSupervisor(fs19, paths.headroomSessionsDir, ports.ownPid);
+      const sessions = sessionsForSupervisor(fs20, paths.headroomSessionsDir, ports.ownPid);
       if (sessions.length === 0) {
         idleSince ??= ports.now();
         const idleMs = ports.now() - idleSince;
@@ -56094,9 +56094,9 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     await ports.sleep(HEADROOM_POLL_MS);
   }
 }
-function currentHeadroomAllowlist(fs19, paths) {
-  const providers = readAllProviders(fs19, paths.providersDir).map((entry) => entry.provider);
-  return headroomAllowlist(headroomUpstreams(providers, frontDoorOrigin(readFrontDoorState(fs19, paths.frontdoorStateFile))));
+function currentHeadroomAllowlist(fs20, paths) {
+  const providers = readAllProviders(fs20, paths.providersDir).map((entry) => entry.provider);
+  return headroomAllowlist(headroomUpstreams(providers, frontDoorOrigin(readFrontDoorState(fs20, paths.frontdoorStateFile))));
 }
 function allowlistOf(ports) {
   return currentHeadroomAllowlist(ports.fs, ports.paths);
@@ -58142,8 +58142,8 @@ function decideConfigProfile(params) {
   }
   return { source: "none" };
 }
-function loadIdentity(identitiesDir, name, fs19) {
-  return loadConfigFile(import_node_path10.default.join(identitiesDir, name, "identity.json"), IdentitySchema, fs19.readConfigFile);
+function loadIdentity(identitiesDir, name, fs20) {
+  return loadConfigFile(import_node_path10.default.join(identitiesDir, name, "identity.json"), IdentitySchema, fs20.readConfigFile);
 }
 
 // src/configProfilesStore.ts
@@ -58311,19 +58311,19 @@ function writePools(paths, pools) {
   applyPatch(paths.globalConfigFile, GlobalConfigSchema, { pools }, { defaults: {} });
 }
 function poolCycleOf(pools, name) {
-  const walk = (current, path44) => {
+  const walk = (current, path46) => {
     for (const entry of pools[current]?.identities ?? []) {
       const nested = poolNameOf(entry);
       if (nested === void 0) {
         continue;
       }
       if (nested === name) {
-        return [...path44, nested];
+        return [...path46, nested];
       }
-      if (path44.includes(nested)) {
+      if (path46.includes(nested)) {
         continue;
       }
-      const found = walk(nested, [...path44, nested]);
+      const found = walk(nested, [...path46, nested]);
       if (found !== void 0) {
         return found;
       }
@@ -59815,8 +59815,8 @@ var FarmManifestSchema = external_exports.strictObject({
   materialised: external_exports.array(external_exports.string()),
   links: external_exports.array(external_exports.strictObject({ rel: external_exports.string(), target: external_exports.string() }))
 });
-function readFarmManifest(fs19, farmRoot) {
-  const raw = fs19.readFileUtf8(import_node_path18.default.join(farmRoot, FARM_MANIFEST_FILENAME)) ?? fs19.readFileUtf8(import_node_path18.default.join(farmRoot, LEGACY_FARM_MANIFEST_FILENAME));
+function readFarmManifest(fs20, farmRoot) {
+  const raw = fs20.readFileUtf8(import_node_path18.default.join(farmRoot, FARM_MANIFEST_FILENAME)) ?? fs20.readFileUtf8(import_node_path18.default.join(farmRoot, LEGACY_FARM_MANIFEST_FILENAME));
   if (raw === void 0) {
     return void 0;
   }
@@ -59874,9 +59874,9 @@ function buildEntryFacts(params) {
     entries
   };
 }
-function listSubtree(fs19, root, rel) {
+function listSubtree(fs20, root, rel) {
   const absolute = import_node_path18.default.join(root, rel);
-  const stat = fs19.lstat(absolute);
+  const stat = fs20.lstat(absolute);
   if (stat === void 0) {
     return [];
   }
@@ -59884,10 +59884,10 @@ function listSubtree(fs19, root, rel) {
     return [{ rel, kind: "symlink" }];
   }
   if (stat.kind === "dir") {
-    const children = [...fs19.readdir(absolute)].sort().flatMap((name) => listSubtree(fs19, root, `${rel}/${name}`));
+    const children = [...fs20.readdir(absolute)].sort().flatMap((name) => listSubtree(fs20, root, `${rel}/${name}`));
     return [{ rel, kind: "dir" }, ...children];
   }
-  const contentHash = fs19.hashFile(absolute);
+  const contentHash = fs20.hashFile(absolute);
   return [{ rel, kind: "file", ...contentHash === void 0 ? {} : { contentHash } }];
 }
 function topLevelScopeRoots(roots) {
@@ -59901,25 +59901,25 @@ function topLevelScopeRoots(roots) {
   }
   return kept;
 }
-function reconciliationScope(fs19, farmRoot, manifest) {
+function reconciliationScope(fs20, farmRoot, manifest) {
   if (manifest !== void 0) {
     return topLevelScopeRoots(manifest.materialised);
   }
-  return [...fs19.readdir(farmRoot)].filter((name) => name !== FARM_MANIFEST_FILENAME && name !== LEGACY_FARM_MANIFEST_FILENAME && fs19.lstat(import_node_path18.default.join(farmRoot, name))?.kind === "dir").sort();
+  return [...fs20.readdir(farmRoot)].filter((name) => name !== FARM_MANIFEST_FILENAME && name !== LEGACY_FARM_MANIFEST_FILENAME && fs20.lstat(import_node_path18.default.join(farmRoot, name))?.kind === "dir").sort();
 }
-function collectFarmListing(fs19, farmRoot, scopeRoots) {
-  return scopeRoots.flatMap((root) => listSubtree(fs19, farmRoot, root));
+function collectFarmListing(fs20, farmRoot, scopeRoots) {
+  return scopeRoots.flatMap((root) => listSubtree(fs20, farmRoot, root));
 }
-function collectCanonicalCounterparts(fs19, claudeHome, farmListing) {
+function collectCanonicalCounterparts(fs20, claudeHome, farmListing) {
   const out = [];
   for (const entry of farmListing) {
     const absolute = import_node_path18.default.join(claudeHome, entry.rel);
-    const stat = fs19.lstat(absolute);
+    const stat = fs20.lstat(absolute);
     if (stat === void 0) {
       continue;
     }
     if (stat.kind === "file") {
-      const contentHash = fs19.hashFile(absolute);
+      const contentHash = fs20.hashFile(absolute);
       out.push({ rel: entry.rel, kind: "file", ...contentHash === void 0 ? {} : { contentHash } });
       continue;
     }
@@ -61790,7 +61790,7 @@ function registerIdentityCommand(program2, deps) {
 // package.json
 var package_default = {
   name: "agent-shim",
-  version: "8.21.0",
+  version: "8.22.0",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -62068,12 +62068,12 @@ function isIdentityName(name) {
 function claudeJsonPath(identitiesDir, identity) {
   return import_node_path23.default.join(identitiesDir, identity, CLAUDE_JSON);
 }
-function readAccountMetadata(fs19, identitiesDir, identity) {
+function readAccountMetadata(fs20, identitiesDir, identity) {
   if (!isIdentityName(identity)) {
     throw new Error(`"${identity}" is not a valid identity name.`);
   }
   const file2 = claudeJsonPath(identitiesDir, identity);
-  const raw = fs19.readFileUtf8(file2);
+  const raw = fs20.readFileUtf8(file2);
   if (raw === void 0) {
     return void 0;
   }
@@ -62103,19 +62103,19 @@ function readAccountMetadata(fs19, identitiesDir, identity) {
   }
   return account.data;
 }
-function createAccountReader(fs19, identitiesDir) {
+function createAccountReader(fs20, identitiesDir) {
   const cache = /* @__PURE__ */ new Map();
   return (identity) => {
     if (!isIdentityName(identity)) {
       throw new Error(`"${identity}" is not a valid identity name.`);
     }
-    const stat = fs19.lstat(claudeJsonPath(identitiesDir, identity));
+    const stat = fs20.lstat(claudeJsonPath(identitiesDir, identity));
     const stamp = stat === void 0 ? "absent" : `${String(stat.mtimeMs)}:${String(stat.sizeBytes)}`;
     const cached2 = cache.get(identity);
     if (cached2?.stamp === stamp) {
       return cached2.account;
     }
-    const account = readAccountMetadata(fs19, identitiesDir, identity);
+    const account = readAccountMetadata(fs20, identitiesDir, identity);
     cache.set(identity, { stamp, account });
     return account;
   };
@@ -62222,11 +62222,11 @@ var PROVIDER_PATH_PREFIX = "/providers/";
 function directOrigin(port) {
   return `http://127.0.0.1:${String(port)}`;
 }
-function parseProviderPath(path44) {
-  if (!path44.startsWith(PROVIDER_PATH_PREFIX)) {
+function parseProviderPath(path46) {
+  if (!path46.startsWith(PROVIDER_PATH_PREFIX)) {
     return void 0;
   }
-  const tail = path44.slice(PROVIDER_PATH_PREFIX.length);
+  const tail = path46.slice(PROVIDER_PATH_PREFIX.length);
   const slash = tail.indexOf("/");
   if (slash <= 0) {
     return void 0;
@@ -62626,9 +62626,9 @@ function decoderFor(encoding) {
       return void 0;
   }
 }
-function destinationOf(path44) {
-  const scoped = parseProviderPath(path44);
-  return scoped === void 0 ? { provider: ANTHROPIC_PROVIDER, endpoint: path44 } : { provider: scoped.provider, endpoint: scoped.rest };
+function destinationOf(path46) {
+  const scoped = parseProviderPath(path46);
+  return scoped === void 0 ? { provider: ANTHROPIC_PROVIDER, endpoint: path46 } : { provider: scoped.provider, endpoint: scoped.rest };
 }
 function buildRecord(event, context) {
   const { scan } = context;
@@ -62923,8 +62923,8 @@ function segmentDay(epochMs) {
 function segmentName(day, pid) {
   return `${day}.${String(pid)}.jsonl`;
 }
-function listLogSegments(fs19, logDir) {
-  return fs19.readdir(logDir).flatMap((name) => {
+function listLogSegments(fs20, logDir) {
+  return fs20.readdir(logDir).flatMap((name) => {
     const match = SEGMENT_RE.exec(name);
     const day = match?.[1];
     if (day === void 0) {
@@ -62933,15 +62933,15 @@ function listLogSegments(fs19, logDir) {
     return [{ name, day, endsAt: Date.parse(`${day}T00:00:00.000Z`) + DAY_MS }];
   }).sort((left, right) => left.day.localeCompare(right.day) || left.name.localeCompare(right.name));
 }
-function readUsageLog(fs19, logDir, options = {}) {
+function readUsageLog(fs20, logDir, options = {}) {
   const { sinceMs } = options;
   const records = [];
   let invalidLines = 0;
-  for (const segment of listLogSegments(fs19, logDir)) {
+  for (const segment of listLogSegments(fs20, logDir)) {
     if (sinceMs !== void 0 && segment.endsAt <= sinceMs) {
       continue;
     }
-    const contents = fs19.readFileUtf8(import_node_path24.default.join(logDir, segment.name));
+    const contents = fs20.readFileUtf8(import_node_path24.default.join(logDir, segment.name));
     if (contents === void 0) {
       continue;
     }
@@ -62985,9 +62985,9 @@ function snapshotPath(snapshotsDir, identity) {
   }
   return import_node_path24.default.join(snapshotsDir, `${identity}.json`);
 }
-function readUsageSnapshot(fs19, snapshotsDir, identity) {
+function readUsageSnapshot(fs20, snapshotsDir, identity) {
   const file2 = snapshotPath(snapshotsDir, identity);
-  const raw = fs19.readFileUtf8(file2);
+  const raw = fs20.readFileUtf8(file2);
   if (raw === void 0) {
     return void 0;
   }
@@ -63003,8 +63003,8 @@ function readUsageSnapshot(fs19, snapshotsDir, identity) {
   }
   return snapshot.data;
 }
-function listUsageSnapshots(fs19, snapshotsDir) {
-  return fs19.readdir(snapshotsDir).flatMap((name) => {
+function listUsageSnapshots(fs20, snapshotsDir) {
+  return fs20.readdir(snapshotsDir).flatMap((name) => {
     if (!name.endsWith(".json")) {
       return [];
     }
@@ -63012,7 +63012,7 @@ function listUsageSnapshots(fs19, snapshotsDir) {
     if (!isIdentityName(identity)) {
       return [];
     }
-    const snapshot = readUsageSnapshot(fs19, snapshotsDir, identity);
+    const snapshot = readUsageSnapshot(fs20, snapshotsDir, identity);
     return snapshot === void 0 ? [] : [snapshot];
   }).sort((left, right) => left.identity.localeCompare(right.identity));
 }
@@ -63071,11 +63071,11 @@ var import_node_path25 = __toESM(require("node:path"), 1);
 var DAY_MS2 = 864e5;
 var DAYS_IN_WEEK = 7;
 var USAGE_RETENTION_MS = DAYS_IN_WEEK * DAY_MS2;
-function pruneUsageLog(fs19, logDir, nowMs) {
+function pruneUsageLog(fs20, logDir, nowMs) {
   const cutoff = nowMs - USAGE_RETENTION_MS;
-  for (const segment of listLogSegments(fs19, logDir)) {
+  for (const segment of listLogSegments(fs20, logDir)) {
     if (segment.endsAt <= cutoff) {
-      fs19.removeRecursive(import_node_path25.default.join(logDir, segment.name));
+      fs20.removeRecursive(import_node_path25.default.join(logDir, segment.name));
     }
   }
 }
@@ -63104,7 +63104,7 @@ function foldProviderState(current, record2) {
   };
 }
 function createUsageStore(deps) {
-  const { fs: fs19, paths } = deps;
+  const { fs: fs20, paths } = deps;
   let prunedDay;
   const rewriteSnapshot = (identity, fold) => {
     if (!isIdentityName(identity)) {
@@ -63113,7 +63113,7 @@ function createUsageStore(deps) {
     }
     let current;
     try {
-      current = readUsageSnapshot(fs19, paths.usageSnapshotsDir, identity);
+      current = readUsageSnapshot(fs20, paths.usageSnapshotsDir, identity);
     } catch (error62) {
       if (!(error62 instanceof UsageSnapshotError)) {
         throw error62;
@@ -63140,8 +63140,8 @@ function createUsageStore(deps) {
       ...account === void 0 ? {} : { account },
       providers
     });
-    fs19.mkdirPrivate(paths.usageSnapshotsDir);
-    fs19.writeFilePrivate(snapshotPath(paths.usageSnapshotsDir, identity), `${JSON.stringify(snapshot, null, 2)}
+    fs20.mkdirPrivate(paths.usageSnapshotsDir);
+    fs20.writeFilePrivate(snapshotPath(paths.usageSnapshotsDir, identity), `${JSON.stringify(snapshot, null, 2)}
 `);
     return true;
   };
@@ -63149,14 +63149,14 @@ function createUsageStore(deps) {
     record: (input2) => {
       const record2 = UsageRecordSchema.parse(input2);
       const nowMs = deps.now();
-      fs19.mkdirPrivate(paths.usageDir);
-      fs19.mkdirPrivate(paths.usageLogDir);
+      fs20.mkdirPrivate(paths.usageDir);
+      fs20.mkdirPrivate(paths.usageLogDir);
       const day = segmentDay(nowMs);
       if (prunedDay !== day) {
-        pruneUsageLog(fs19, paths.usageLogDir, nowMs);
+        pruneUsageLog(fs20, paths.usageLogDir, nowMs);
         prunedDay = day;
       }
-      fs19.appendFilePrivate(import_node_path25.default.join(paths.usageLogDir, segmentName(day, deps.pid)), `${JSON.stringify(record2)}
+      fs20.appendFilePrivate(import_node_path25.default.join(paths.usageLogDir, segmentName(day, deps.pid)), `${JSON.stringify(record2)}
 `);
       if (record2.identity !== void 0) {
         rewriteSnapshot(record2.identity, (current) => ({ ...current?.providers, [record2.provider]: foldProviderState(current?.providers[record2.provider], record2) }));
@@ -63189,14 +63189,14 @@ var PicksFileSchema = external_exports.strictObject({
 function errorMessage(error62) {
   return error62 instanceof Error ? error62.message : String(error62);
 }
-function loadPoolMembers(fs19, paths, identities, nowMs) {
+function loadPoolMembers(fs20, paths, identities, nowMs) {
   const windowStartMs = nowMs - FIVE_HOUR_WINDOW_MS;
-  const log = readUsageLog(fs19, paths.usageLogDir, { sinceMs: windowStartMs });
+  const log = readUsageLog(fs20, paths.usageLogDir, { sinceMs: windowStartMs });
   return identities.map((identity) => {
     const records = log.records.filter((record2) => record2.identity === identity && record2.provider === ANTHROPIC_PROVIDER && Date.parse(record2.at) >= windowStartMs);
     try {
-      const snapshot = readUsageSnapshot(fs19, paths.usageSnapshotsDir, identity);
-      const account = readAccountMetadata(fs19, paths.identitiesDir, identity) ?? snapshot?.account;
+      const snapshot = readUsageSnapshot(fs20, paths.usageSnapshotsDir, identity);
+      const account = readAccountMetadata(fs20, paths.identitiesDir, identity) ?? snapshot?.account;
       return { identity, records, ...snapshot === void 0 ? {} : { snapshot }, ...account === void 0 ? {} : { account } };
     } catch (error62) {
       if (error62 instanceof UsageSnapshotError || error62 instanceof AccountMetadataError) {
@@ -63264,9 +63264,9 @@ function nestedMember(input2, nestedName, childStack, sticky) {
     missing: nested.missing
   };
 }
-function readPicksFile(fs19, file2) {
+function readPicksFile(fs20, file2) {
   const empty = { schemaVersion: SCHEMA_VERSION, picks: {} };
-  const raw = fs19.readFileUtf8(file2);
+  const raw = fs20.readFileUtf8(file2);
   if (raw === void 0) {
     return { file: empty };
   }
@@ -63279,17 +63279,17 @@ function readPicksFile(fs19, file2) {
   const result = PicksFileSchema.safeParse(parsed);
   return result.success ? { file: result.data } : { file: empty, problem: `${file2} is not a picks file this agent-shim can read` };
 }
-function readStickyPick(fs19, picksFile, directory) {
-  const read = readPicksFile(fs19, picksFile);
+function readStickyPick(fs20, picksFile, directory) {
+  const read = readPicksFile(fs20, picksFile);
   const entry = read.file.picks[directory];
   return { ...entry === void 0 ? {} : { sticky: entry }, ...read.problem === void 0 ? {} : { problem: read.problem } };
 }
-function recordStickyPick(fs19, picksFile, directory, identity, nowMs) {
-  const current = readPicksFile(fs19, picksFile).file.picks;
+function recordStickyPick(fs20, picksFile, directory, identity, nowMs) {
+  const current = readPicksFile(fs20, picksFile).file.picks;
   const kept = Object.entries(current).filter(([, entry]) => nowMs - Date.parse(entry.at) <= USAGE_RETENTION_MS);
   const next = { schemaVersion: SCHEMA_VERSION, picks: { ...Object.fromEntries(kept), [directory]: { identity, at: new Date(nowMs).toISOString() } } };
-  fs19.mkdirPrivate(import_node_path26.default.dirname(picksFile));
-  fs19.writeFilePrivate(picksFile, `${JSON.stringify(next, null, 2)}
+  fs20.mkdirPrivate(import_node_path26.default.dirname(picksFile));
+  fs20.writeFilePrivate(picksFile, `${JSON.stringify(next, null, 2)}
 `);
 }
 
@@ -65652,8 +65652,8 @@ var FRONTDOOR_SUPERVISOR_STILL_RUNNING = -1;
 var FRONTDOOR_POLL_MS = 1e3;
 var MS_PER_MINUTE2 = 6e4;
 async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {}) {
-  const { fs: fs19, paths } = ports;
-  const previous = readFrontDoorState(fs19, paths.frontdoorStateFile);
+  const { fs: fs20, paths } = ports;
+  const previous = readFrontDoorState(fs20, paths.frontdoorStateFile);
   let lastPort = previous?.lastPort;
   let lastConnectPort = previous?.lastConnectPort;
   let lastDirectPort = previous?.lastDirectPort;
@@ -65664,12 +65664,12 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
   });
   const fail = (message) => {
     ports.closeRcStreamHub();
-    writeFrontDoorState(fs19, paths.frontdoorStateFile, { lastError: message, ...sticky() });
-    fs19.removeRecursive(paths.frontdoorLockFile);
+    writeFrontDoorState(fs20, paths.frontdoorStateFile, { lastError: message, ...sticky() });
+    fs20.removeRecursive(paths.frontdoorLockFile);
     ports.log(`agent-shim frontdoor supervisor: ${message}`);
     return 1;
   };
-  writeFrontDoorState(fs19, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, ...sticky() });
+  writeFrontDoorState(fs20, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, ...sticky() });
   const previousSticky = lastPort;
   let http8;
   try {
@@ -65706,8 +65706,8 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     ports.log(`agent-shim frontdoor supervisor: sticky direct port ${String(previousStickyDirect)} was occupied; moving to ${String(direct.port)} (headroom must be restarted to admit the new address)`);
   }
   lastDirectPort = direct.port;
-  writeFrontDoorState(fs19, paths.frontdoorStateFile, { protocol: FRONT_DOOR_PROTOCOL, supervisorPid: ports.ownPid, port: http8.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
-  fs19.removeRecursive(paths.frontdoorLockFile);
+  writeFrontDoorState(fs20, paths.frontdoorStateFile, { protocol: FRONT_DOOR_PROTOCOL, supervisorPid: ports.ownPid, port: http8.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
+  fs20.removeRecursive(paths.frontdoorLockFile);
   ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http8.port)}, CONNECT surface on 127.0.0.1:${String(connect3.port)}`);
   let idleSince;
   let ticks = 0;
@@ -65716,8 +65716,8 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
       return FRONTDOOR_SUPERVISOR_STILL_RUNNING;
     }
     ticks += 1;
-    const listed = listFrontDoorSessions(fs19, paths.frontdoorSessionsDir);
-    const pruned = pruneDeadFrontDoorSessions(fs19, paths.frontdoorSessionsDir, ports.isRunning);
+    const listed = listFrontDoorSessions(fs20, paths.frontdoorSessionsDir);
+    const pruned = pruneDeadFrontDoorSessions(fs20, paths.frontdoorSessionsDir, ports.isRunning);
     ports.observeLaunchRegistry(listed, pruned);
     const prunedPids = new Set(pruned);
     if (listed.filter((session) => !prunedPids.has(session.pid)).length === 0) {
@@ -65728,7 +65728,7 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
         await connect3.close();
         await http8.close();
         ports.closeRcStreamHub();
-        writeFrontDoorState(fs19, paths.frontdoorStateFile, sticky());
+        writeFrontDoorState(fs20, paths.frontdoorStateFile, sticky());
         return 0;
       }
     } else {
@@ -65781,8 +65781,8 @@ function parseConnectTarget(authority) {
   }
   return { host, port };
 }
-function servedByPipeline(path44) {
-  return path44?.startsWith(ROUTED_PATH_PREFIX) === true;
+function servedByPipeline(path46) {
+  return path46?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
   "connection",
@@ -66308,11 +66308,11 @@ function createRcSessionTracker(deps) {
   };
   const observeExchange = (request7) => {
     const method = (request7.method ?? "").toUpperCase();
-    const path44 = new URL(request7.url ?? "/", "http://127.0.0.1").pathname;
-    if (!path44.startsWith(RC_SESSIONS_PATH_PREFIX)) {
+    const path46 = new URL(request7.url ?? "/", "http://127.0.0.1").pathname;
+    if (!path46.startsWith(RC_SESSIONS_PATH_PREFIX)) {
       return void 0;
     }
-    const tail = path44.slice(RC_SESSIONS_PATH_PREFIX.length);
+    const tail = path46.slice(RC_SESSIONS_PATH_PREFIX.length);
     const facts = {
       oauthAuthorization: oauthAuthorizationOf(request7.headers),
       anthropicVersion: singleHeader(request7.headers, "anthropic-version"),
@@ -67052,9 +67052,9 @@ function sequenceNumsOfBody(body) {
 }
 function frontDoorRcControl(transport, token) {
   const headers = { authorization: `Bearer ${token}` };
-  const listAnswerOf = async (path44, what) => {
+  const listAnswerOf = async (path46, what) => {
     try {
-      return await transport.request({ method: "GET", path: path44, headers });
+      return await transport.request({ method: "GET", path: path46, headers });
     } catch (error62) {
       throw new Error(`${what}: could not reach the front door's control listener: ${error62 instanceof Error ? error62.message : String(error62)}`, { cause: error62 });
     }
@@ -67126,10 +67126,10 @@ function frontDoorRcControl(transport, token) {
     }
     return pending;
   };
-  const writeOf = async (path44, body, describeFailure) => {
+  const writeOf = async (path46, body, describeFailure) => {
     let answer;
     try {
-      answer = await transport.request({ method: "POST", path: path44, headers: { ...headers, "content-type": "application/json" }, body });
+      answer = await transport.request({ method: "POST", path: path46, headers: { ...headers, "content-type": "application/json" }, body });
     } catch (error62) {
       return { ok: false, message: `could not reach the front door's control listener: ${error62 instanceof Error ? error62.message : String(error62)}` };
     }
@@ -67503,12 +67503,12 @@ function lateRcStreamDial(resolve) {
 }
 function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const request7 = async (method, path44, headers, body, signal) => await new Promise((resolve, reject) => {
+  const request7 = async (method, path46, headers, body, signal) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method,
-      path: path44,
+      path: path46,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, ...body === void 0 ? {} : { "content-length": String(Buffer.byteLength(body, "utf8")) } },
       agent,
@@ -67545,9 +67545,9 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
       return { status, body: await readAll(response) };
     },
     openStream: async (sessionId, headers, resume, signal) => {
-      const path44 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
+      const path46 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
       const streamHeaders = resume === void 0 ? headers : { ...headers, "last-event-id": String(resume.fromSequenceNum) };
-      const { status, response } = await request7("GET", path44, streamHeaders, void 0, signal);
+      const { status, response } = await request7("GET", path46, streamHeaders, void 0, signal);
       if (!isSuccessful2(status)) {
         await readAll(response);
         return { status, chunks: NO_CHUNKS };
@@ -69233,9 +69233,9 @@ function resolveFriendlyClientOptions(options) {
   };
 }
 function createORPCClient(link, options = {}) {
-  const path44 = options.path ?? [];
+  const path46 = options.path ?? [];
   const procedureClient = async (...[input2, options2 = {}]) => {
-    return await link.call(path44, input2, resolveFriendlyClientOptions(options2));
+    return await link.call(path46, input2, resolveFriendlyClientOptions(options2));
   };
   const recursive2 = new Proxy(procedureClient, {
     get(target, key) {
@@ -69244,7 +69244,7 @@ function createORPCClient(link, options = {}) {
       }
       return createORPCClient(link, {
         ...options,
-        path: [...path44, key]
+        path: [...path46, key]
       });
     }
   });
@@ -69826,19 +69826,19 @@ var StandardLink = class {
   }
   interceptors;
   clientInterceptors;
-  call(path44, input2, options) {
+  call(path46, input2, options) {
     return runWithSpan(
-      { name: `${ORPC_NAME}.${path44.join("/")}`, signal: options.signal },
+      { name: `${ORPC_NAME}.${path46.join("/")}`, signal: options.signal },
       (span) => {
         span?.setAttribute("rpc.system", ORPC_NAME);
-        span?.setAttribute("rpc.method", path44.join("."));
+        span?.setAttribute("rpc.method", path46.join("."));
         if (isAsyncIteratorObject(input2)) {
           input2 = asyncIteratorWithSpan(
             { name: "consume_event_iterator_input", signal: options.signal },
             input2
           );
         }
-        return intercept(this.interceptors, { ...options, path: path44, input: input2 }, async ({ path: path210, input: input22, ...options2 }) => {
+        return intercept(this.interceptors, { ...options, path: path46, input: input2 }, async ({ path: path210, input: input22, ...options2 }) => {
           const otelConfig = getGlobalOtelConfig();
           let otelContext;
           const currentSpan = otelConfig?.trace.getActiveSpan() ?? span;
@@ -70073,8 +70073,8 @@ var StandardRPCJsonSerializer = class {
     return ref.data;
   }
 };
-function toHttpPath(path44) {
-  return `/${path44.map(encodeURIComponent).join("/")}`;
+function toHttpPath(path46) {
+  return `/${path46.map(encodeURIComponent).join("/")}`;
 }
 function toStandardHeaders2(headers) {
   if (typeof headers.forEach === "function") {
@@ -70099,18 +70099,18 @@ var StandardRPCLinkCodec = class {
   fallbackMethod;
   expectedMethod;
   headers;
-  async encode(path44, input2, options) {
-    let headers = toStandardHeaders2(await value(this.headers, options, path44, input2));
+  async encode(path46, input2, options) {
+    let headers = toStandardHeaders2(await value(this.headers, options, path46, input2));
     if (options.lastEventId !== void 0) {
       headers = mergeStandardHeaders(headers, { "last-event-id": options.lastEventId });
     }
-    const expectedMethod = await value(this.expectedMethod, options, path44, input2);
-    const baseUrl = await value(this.baseUrl, options, path44, input2);
+    const expectedMethod = await value(this.expectedMethod, options, path46, input2);
+    const baseUrl = await value(this.baseUrl, options, path46, input2);
     const url2 = new URL(baseUrl);
-    url2.pathname = `${url2.pathname.replace(/\/$/, "")}${toHttpPath(path44)}`;
+    url2.pathname = `${url2.pathname.replace(/\/$/, "")}${toHttpPath(path46)}`;
     const serialized = this.serializer.serialize(input2);
     if (expectedMethod === "GET" && !(serialized instanceof FormData) && !isAsyncIteratorObject(serialized)) {
-      const maxUrlLength = await value(this.maxUrlLength, options, path44, input2);
+      const maxUrlLength = await value(this.maxUrlLength, options, path46, input2);
       const getUrl = new URL(url2);
       getUrl.searchParams.append("data", stringifyJSON(serialized));
       if (getUrl.toString().length <= maxUrlLength) {
@@ -70578,7 +70578,7 @@ function middlewareOutputFn(output2) {
 function createProcedureClient(lazyableProcedure, ...rest) {
   const options = resolveMaybeOptionalOptions(rest);
   return async (...[input2, callerOptions]) => {
-    const path44 = toArray(options.path);
+    const path46 = toArray(options.path);
     const { default: procedure } = await unlazy(lazyableProcedure);
     const clientContext = callerOptions?.context ?? {};
     const context = await value(options.context ?? {}, clientContext);
@@ -70593,7 +70593,7 @@ function createProcedureClient(lazyableProcedure, ...rest) {
       const output2 = await runWithSpan(
         { name: "call_procedure", signal: callerOptions?.signal },
         (span) => {
-          span?.setAttribute("procedure.path", [...path44]);
+          span?.setAttribute("procedure.path", [...path46]);
           return intercept(
             toArray(options.interceptors),
             {
@@ -70601,7 +70601,7 @@ function createProcedureClient(lazyableProcedure, ...rest) {
               input: input2,
               // input only optional when it undefinable so we can safely cast it
               errors,
-              path: path44,
+              path: path46,
               procedure,
               signal: callerOptions?.signal,
               lastEventId: callerOptions?.lastEventId
@@ -70723,10 +70723,10 @@ var HIDDEN_ROUTER_CONTRACT_SYMBOL = /* @__PURE__ */ Symbol("ORPC_HIDDEN_ROUTER_C
 function getHiddenRouterContract(router) {
   return router[HIDDEN_ROUTER_CONTRACT_SYMBOL];
 }
-function getRouter(router, path44) {
+function getRouter(router, path46) {
   let current = router;
-  for (let i2 = 0; i2 < path44.length; i2++) {
-    const segment = path44[i2];
+  for (let i2 = 0; i2 < path46.length; i2++) {
+    const segment = path46[i2];
     if (!current) {
       return void 0;
     }
@@ -70741,7 +70741,7 @@ function getRouter(router, path44) {
       continue;
     }
     const lazied = current;
-    const rest = path44.slice(i2);
+    const rest = path46.slice(i2);
     return lazy2(async () => {
       const unwrapped = await unlazy(lazied);
       const next = getRouter(unwrapped.default, rest);
@@ -71205,11 +71205,11 @@ var LinkFetchClient = class {
     this.toFetchRequestOptions = options;
     this.adapterInterceptors = toArray(options.adapterInterceptors);
   }
-  async call(standardRequest, options, path44, input2) {
+  async call(standardRequest, options, path46, input2) {
     const request7 = toFetchRequest(standardRequest, this.toFetchRequestOptions);
     const fetchResponse = await intercept(
       this.adapterInterceptors,
-      { ...options, request: request7, path: path44, input: input2, init: { redirect: "manual" } },
+      { ...options, request: request7, path: path46, input: input2, init: { redirect: "manual" } },
       ({ request: request22, path: path210, input: input22, init, ...options2 }) => this.fetch(request22, init, options2, path210, input22)
     );
     const lazyResponse = toStandardLazyResponse(fetchResponse, { signal: request7.signal });
@@ -71356,8 +71356,8 @@ function toAbortSignal(stream) {
 function toStandardUrl(req) {
   const protocol = "encrypted" in req.socket && req.socket.encrypted ? "https:" : "http:";
   const origin = guard(() => new URL(`${protocol}//${req.headers.host ?? "localhost"}`).origin) ?? `${protocol}//localhost`;
-  const path44 = req.originalUrl ?? req.url ?? "/";
-  return new URL(`${origin}${path44.startsWith("/") ? "" : "/"}${path44}`);
+  const path46 = req.originalUrl ?? req.url ?? "/";
+  return new URL(`${origin}${path46.startsWith("/") ? "" : "/"}${path46}`);
 }
 function toStandardLazyRequest(req, res) {
   const signal = toAbortSignal(res);
@@ -71556,8 +71556,8 @@ var StandardRPCMatcher = class {
   constructor(options = {}) {
     this.filter = options.filter ?? true;
   }
-  init(router, path44 = []) {
-    const laziedOptions = traverseContractProcedures({ router, path: path44 }, (traverseOptions) => {
+  init(router, path46 = []) {
+    const laziedOptions = traverseContractProcedures({ router, path: path46 }, (traverseOptions) => {
       if (!value(this.filter, traverseOptions)) {
         return;
       }
@@ -73274,8 +73274,8 @@ function createCodexRouteMount(ports, upstreamBase, provider) {
         request7.body.resume();
         return;
       }
-      const path44 = new URL(request7.url, "http://127.0.0.1").pathname;
-      const translated = { method: request7.method, path: path44, body, signal: request7.signal };
+      const path46 = new URL(request7.url, "http://127.0.0.1").pathname;
+      const translated = { method: request7.method, path: path46, body, signal: request7.signal };
       const routed = await route(translated);
       if (request7.signal.aborted) {
         return;
@@ -73309,7 +73309,7 @@ function createPassthroughRoute(name, target) {
     headroomUpstream: target.headroomUpstream,
     serve: async (request7, response) => {
       const incoming = new URL(request7.url, "http://127.0.0.1");
-      const path44 = target.stripPrefix !== void 0 && incoming.pathname.startsWith(target.stripPrefix) ? incoming.pathname.slice(target.stripPrefix.length) : incoming.pathname;
+      const path46 = target.stripPrefix !== void 0 && incoming.pathname.startsWith(target.stripPrefix) ? incoming.pathname.slice(target.stripPrefix.length) : incoming.pathname;
       const headers = forwardableHeaders(request7.headers);
       delete headers.host;
       await new Promise((resolve) => {
@@ -73317,7 +73317,7 @@ function createPassthroughRoute(name, target) {
           host: base.hostname,
           port: base.port === "" ? void 0 : Number(base.port),
           method: request7.method,
-          path: `${basePath}${path44}${incoming.search}`,
+          path: `${basePath}${path46}${incoming.search}`,
           headers,
           agent
         };
@@ -73366,7 +73366,7 @@ function createPassthroughRoute(name, target) {
 
 // src/frontdoor/providerRoute.ts
 function createProviderRouteResolver(deps) {
-  const isRcSelfHostPath = (path44) => path44 === "/v1/code/sessions" || path44.startsWith("/v1/code/sessions/") || path44 === "/v1/sessions" || path44.startsWith("/v1/sessions/");
+  const isRcSelfHostPath = (path46) => path46 === "/v1/code/sessions" || path46.startsWith("/v1/code/sessions/") || path46 === "/v1/sessions" || path46.startsWith("/v1/sessions/");
   const oauthRoute = createPassthroughRoute("anthropic", { baseUrl: `https://${CONNECT_INTERCEPT_HOST}:${String(HTTPS_PORT)}`, stripPrefix: void 0, headroomUpstream: void 0 });
   const passthroughByTarget = /* @__PURE__ */ new Map();
   const passthroughFor = (name, target) => {
@@ -73380,16 +73380,16 @@ function createProviderRouteResolver(deps) {
     return route;
   };
   const resolve = (request7) => {
-    const path44 = new URL(request7.url, "http://127.0.0.1").pathname;
-    const scoped = parseProviderPath(path44);
+    const path46 = new URL(request7.url, "http://127.0.0.1").pathname;
+    const scoped = parseProviderPath(path46);
     if (scoped === void 0) {
-      if (deps.rcSelfHostRoute !== void 0 && isRcSelfHostPath(path44)) {
+      if (deps.rcSelfHostRoute !== void 0 && isRcSelfHostPath(path46)) {
         return { ok: true, route: deps.rcSelfHostRoute };
       }
-      if (request7.session.provider !== void 0 && path44.startsWith("/v1/") && !isRcSelfHostPath(path44)) {
+      if (request7.session.provider !== void 0 && path46.startsWith("/v1/") && !isRcSelfHostPath(path46)) {
         return resolve({ ...request7, url: `${PROVIDER_PATH_PREFIX}${encodeURIComponent(request7.session.provider)}${request7.url}` });
       }
-      return path44.startsWith("/v1/") ? { ok: true, route: oauthRoute } : { ok: false, status: HTTP_STATUS.notFound, message: `no such endpoint: ${path44}` };
+      return path46.startsWith("/v1/") ? { ok: true, route: oauthRoute } : { ok: false, status: HTTP_STATUS.notFound, message: `no such endpoint: ${path46}` };
     }
     const { provider } = scoped;
     let definition;
@@ -73478,11 +73478,11 @@ function credentialOfJson(parsed) {
 function sequenceNumOfJson(value2) {
   return typeof value2 === "number" && Number.isInteger(value2) && value2 >= 0 ? value2 : void 0;
 }
-function createRcCredentialStore(fs19, dir) {
-  fs19.mkdirPrivate(dir);
+function createRcCredentialStore(fs20, dir) {
+  fs20.mkdirPrivate(dir);
   const fileFor = (sessionId) => import_node_path34.default.join(dir, `${sessionId}.json`);
   const readParsed = (sessionId) => {
-    const raw = fs19.readFileUtf8(fileFor(sessionId));
+    const raw = fs20.readFileUtf8(fileFor(sessionId));
     if (raw === void 0) {
       return void 0;
     }
@@ -73507,7 +73507,7 @@ function createRcCredentialStore(fs19, dir) {
       }
       const cursor3 = sequenceNumOfJson(readParsed(sessionId)?.highestSequenceNum);
       const record2 = { ...credential, ...cursor3 === void 0 ? {} : { highestSequenceNum: cursor3 } };
-      fs19.writeFilePrivate(fileFor(sessionId), `${JSON.stringify(record2, null, 2)}
+      fs20.writeFilePrivate(fileFor(sessionId), `${JSON.stringify(record2, null, 2)}
 `);
     },
     readCursor: (sessionId) => {
@@ -73522,14 +73522,14 @@ function createRcCredentialStore(fs19, dir) {
       }
       const credential = credentialOfJson(readParsed(sessionId));
       const record2 = credential === void 0 ? { highestSequenceNum } : { ...credential, highestSequenceNum };
-      fs19.writeFilePrivate(fileFor(sessionId), `${JSON.stringify(record2, null, 2)}
+      fs20.writeFilePrivate(fileFor(sessionId), `${JSON.stringify(record2, null, 2)}
 `);
     },
     remove: (sessionId) => {
       if (!isSafeSessionId(sessionId)) {
         return;
       }
-      fs19.removeRecursive(fileFor(sessionId));
+      fs20.removeRecursive(fileFor(sessionId));
     }
   };
 }
@@ -74311,6 +74311,17 @@ function bearerOf(headers) {
   }
   return presented.slice(0, "bearer ".length).toLowerCase() === "bearer " ? presented.slice("bearer ".length) : void 0;
 }
+function presentationRefusal(headers) {
+  const presented = singleHeader2(headers, "authorization");
+  if (presented === void 0) {
+    return "absent";
+  }
+  if (presented.slice(0, "bearer ".length).toLowerCase() !== "bearer ") {
+    return "not-a-bearer";
+  }
+  const bearer = presented.slice("bearer ".length);
+  return bearer.slice(0, "bearer ".length).toLowerCase() === "bearer " ? "doubled-scheme-word" : "unrecognised";
+}
 async function readBody3(request7, capBytes) {
   return await new Promise((resolve, reject) => {
     const chunks = [];
@@ -74399,6 +74410,9 @@ function createRcSelfHostSurface(deps) {
     }
     return false;
   };
+  const credentialRefusal = (headers) => presentsCredential(headers) ? void 0 : presentationRefusal(headers);
+  const workerRefusal = (headers, session) => presentsWorkerJwt(headers, session) ? void 0 : presentationRefusal(headers);
+  const workerOrCredentialRefusal = (headers, session) => presentsWorkerJwt(headers, session) || presentsCredential(headers) ? void 0 : presentationRefusal(headers);
   const frameOf = (event) => {
     const envelope = {
       event_id: event.eventId,
@@ -74487,8 +74501,14 @@ data: ${JSON.stringify(envelope)}
   const epochStale = async (response) => {
     await answerJson2(response, HTTP_CONFLICT, { type: "error", error: { type: "api_error", message: "worker_epoch does not match the session's live epoch" } }, { [CONFLICT_REASON_HEADER2]: CONFLICT_REASON_EPOCH_STALE });
   };
-  const unauthorized = async (response) => {
-    await answerJson2(response, HTTP_STATUS.unauthorized, { type: "error", error: { type: "authentication_error", message: "the self-hosted Remote Control surface did not recognise the presented credential" } });
+  const refusalMessages = {
+    absent: "the self-hosted Remote Control surface authenticates by the Authorization header, and this call carried none",
+    "not-a-bearer": "the self-hosted Remote Control surface reads a Bearer authorization, and this call's Authorization header did not carry the Bearer scheme word",
+    "doubled-scheme-word": "the self-hosted Remote Control surface reads one Bearer scheme word, and this call's Authorization header carried it twice: a persisted session record holds the whole header value with the scheme word included, so prefixing Bearer onto it presents a different credential",
+    unrecognised: "the self-hosted Remote Control surface did not recognise the presented credential"
+  };
+  const unauthorized = async (response, refusal) => {
+    await answerJson2(response, HTTP_STATUS.unauthorized, { type: "error", error: { type: "authentication_error", message: refusalMessages[refusal] } });
   };
   const serveSessionPath = async (session, tail, request7, response) => {
     const method = request7.method.toUpperCase();
@@ -74506,8 +74526,9 @@ data: ${JSON.stringify(envelope)}
       return;
     }
     if (tail === "bridge" && method === "POST") {
-      if (!presentsCredential(request7.headers)) {
-        await unauthorized(response);
+      const refusal = credentialRefusal(request7.headers);
+      if (refusal !== void 0) {
+        await unauthorized(response, refusal);
         return;
       }
       const workerJwt = mintWorkerJwt(deps.randomToken, deps.now());
@@ -74517,8 +74538,9 @@ data: ${JSON.stringify(envelope)}
       return;
     }
     if (tail === "archive" && method === "POST") {
-      if (!presentsCredential(request7.headers)) {
-        await unauthorized(response);
+      const refusal = credentialRefusal(request7.headers);
+      if (refusal !== void 0) {
+        await unauthorized(response, refusal);
         return;
       }
       for (const sink of [...session.workerStreams, ...session.clientStreams]) {
@@ -74532,8 +74554,9 @@ data: ${JSON.stringify(envelope)}
     if (tail === "worker" || tail.startsWith("worker/")) {
       const workerTail = tail === "worker" ? "" : tail.slice("worker/".length);
       const webProxy = workerTail === "web-fetch" || workerTail === "web-search";
-      if (!(webProxy ? presentsCredential(request7.headers) || presentsWorkerJwt(request7.headers, session) : presentsWorkerJwt(request7.headers, session))) {
-        await unauthorized(response);
+      const refusal = webProxy ? workerOrCredentialRefusal(request7.headers, session) : workerRefusal(request7.headers, session);
+      if (refusal !== void 0) {
+        await unauthorized(response, refusal);
         return;
       }
       if (workerTail === "" && method === "GET") {
@@ -74689,8 +74712,9 @@ data: ${JSON.stringify(envelope)}
       await answerJson2(response, HTTP_STATUS.notFound, { type: "error", error: { type: "api_error", message: `the self-hosted Remote Control surface serves no worker path "${workerTail}"` } });
       return;
     }
-    if (!presentsCredential(request7.headers)) {
-      await unauthorized(response);
+    const clientRefusal = credentialRefusal(request7.headers);
+    if (clientRefusal !== void 0) {
+      await unauthorized(response, clientRefusal);
       return;
     }
     if (tail === "events" && method === "POST") {
@@ -74755,8 +74779,9 @@ data: ${JSON.stringify(envelope)}
           await answerJson2(response, HTTP_STATUS.methodNotAllowed, { type: "error", error: { type: "api_error", message: "the compatibility session list is a GET" } });
           return;
         }
-        if (!presentsCredential(request7.headers)) {
-          await unauthorized(response);
+        const listRefusal = credentialRefusal(request7.headers);
+        if (listRefusal !== void 0) {
+          await unauthorized(response, listRefusal);
           return;
         }
         await answerJson2(response, HTTP_STATUS.ok, { data: [] });
@@ -74768,8 +74793,9 @@ data: ${JSON.stringify(envelope)}
       }
       if (pathname === RC_SESSIONS_PATH_PREFIX2) {
         if (method === "POST") {
-          if (!presentsCredential(request7.headers)) {
-            await unauthorized(response);
+          const createRefusal = credentialRefusal(request7.headers);
+          if (createRefusal !== void 0) {
+            await unauthorized(response, createRefusal);
             return;
           }
           const body = parseJsonObject2(await readBody3(request7.body, CONTROL_BODY_CAP_BYTES));
@@ -74794,8 +74820,9 @@ data: ${JSON.stringify(envelope)}
           return;
         }
         if (method === "GET") {
-          if (!presentsCredential(request7.headers)) {
-            await unauthorized(response);
+          const readRefusal = credentialRefusal(request7.headers);
+          if (readRefusal !== void 0) {
+            await unauthorized(response, readRefusal);
             return;
           }
           await answerJson2(response, HTTP_STATUS.ok, { data: [...sessions.values()].map((session) => ({ id: session.id, title: session.title, created_at: new Date(session.createdAt).toISOString(), updated_at: new Date(session.lastTrafficAt).toISOString(), session_status: "active" })) });
@@ -74916,8 +74943,8 @@ var SELF_HOST_SUBSCRIPTION_TYPE = "max";
 function isRecord6(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 }
-function readJsonObject(fs19, file2) {
-  const raw = fs19.readFileUtf8(file2);
+function readJsonObject(fs20, file2) {
+  const raw = fs20.readFileUtf8(file2);
   if (raw === void 0) {
     return void 0;
   }
@@ -74929,8 +74956,8 @@ function readJsonObject(fs19, file2) {
   }
   return isRecord6(parsed) ? parsed : void 0;
 }
-function readRcSelfHostRecord(fs19, frontdoorDir) {
-  const parsed = readJsonObject(fs19, import_node_path35.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
+function readRcSelfHostRecord(fs20, frontdoorDir) {
+  const parsed = readJsonObject(fs20, import_node_path35.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
   if (parsed === void 0) {
     return void 0;
   }
@@ -76788,14 +76815,14 @@ var import_node_crypto16 = require("node:crypto");
 var import_node_path38 = __toESM(require("node:path"), 1);
 var BUNDLE_NAME_HEX_DIGITS = 16;
 function resolveTrustBundle(params) {
-  const { caCertFile, bundlesDir, variable, inherited, fs: fs19 } = params;
+  const { caCertFile, bundlesDir, variable, inherited, fs: fs20 } = params;
   if (inherited === void 0 || inherited === "" || import_node_path38.default.resolve(inherited) === import_node_path38.default.resolve(caCertFile)) {
     return { path: caCertFile };
   }
-  const caPem = fs19.readFileUtf8(caCertFile);
+  const caPem = fs20.readFileUtf8(caCertFile);
   let inheritedPem;
   try {
-    inheritedPem = fs19.readFileUtf8(inherited);
+    inheritedPem = fs20.readFileUtf8(inherited);
   } catch (error62) {
     return {
       path: caCertFile,
@@ -76808,9 +76835,9 @@ function resolveTrustBundle(params) {
   const combined = `${inheritedPem.trimEnd()}
 ${caPem}`;
   const bundle = import_node_path38.default.join(bundlesDir, `${(0, import_node_crypto16.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
-  if (!fs19.exists(bundle)) {
-    fs19.mkdirp(bundlesDir);
-    fs19.writeFileAtomic(bundle, combined);
+  if (!fs20.exists(bundle)) {
+    fs20.mkdirp(bundlesDir);
+    fs20.writeFileAtomic(bundle, combined);
   }
   return { path: bundle };
 }
@@ -77511,6 +77538,366 @@ function registerRunCommand(program2, handler) {
   });
 }
 
+// src/update/commands.ts
+var import_node_fs17 = __toESM(require("node:fs"), 1);
+var import_node_os7 = __toESM(require("node:os"), 1);
+var import_node_path41 = __toESM(require("node:path"), 1);
+
+// src/update/update.ts
+var import_node_crypto17 = require("node:crypto");
+var import_node_path40 = __toESM(require("node:path"), 1);
+var LATEST_RELEASE_URL = "https://github.com/ExaDev/agent-shim/releases/latest";
+var DOWNLOAD_BASE_URL = "https://github.com/ExaDev/agent-shim/releases/latest/download";
+var MACOS_X64_NOTE = "the standalone macOS x64 binary is currently broken upstream (see https://github.com/ExaDev/agent-shim#build-node-sea)";
+var BREW_PREFIXES = ["/opt/homebrew", "/usr/local/Cellar", "/home/linuxbrew/.linuxbrew"];
+var EXECUTABLE_MODE = 493;
+var UpdateChannelError = class extends CliError {
+  constructor(message) {
+    super(message);
+    this.name = "UpdateChannelError";
+  }
+};
+var UpdateConflictError = class extends CliError {
+  constructor(message) {
+    super(message);
+    this.name = "UpdateConflictError";
+  }
+};
+var UpdateDownloadError = class extends CliError {
+  constructor(message) {
+    super(message);
+    this.name = "UpdateDownloadError";
+  }
+};
+function compareVersions3(left, right) {
+  const parse3 = (version2) => {
+    const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(version2);
+    if (match === null) {
+      throw new Error(`not a plain release version: ${version2}`);
+    }
+    return [Number(match[1]), Number(match[2]), Number(match[3])];
+  };
+  const leftParts = parse3(left);
+  const rightParts = parse3(right);
+  return leftParts.map((part, index) => part - (rightParts[index] ?? 0)).find((difference) => difference !== 0) ?? 0;
+}
+function releaseTagFromUrl(url2) {
+  const segment = url2.split("?")[0]?.split("/").at(-1);
+  const candidate = segment?.startsWith("v") === true ? segment.slice(1) : void 0;
+  return candidate !== void 0 && /^\d+\.\d+\.\d+$/.test(candidate) ? candidate : void 0;
+}
+function selectAsset(platform, arch) {
+  if (platform === "darwin") {
+    return arch === "arm64" ? "agent-shim-macos-arm64" : void 0;
+  }
+  if (platform === "linux") {
+    if (arch === "arm64" || arch === "aarch64") {
+      return "agent-shim-linux-arm64";
+    }
+    return arch === "x64" ? "agent-shim-linux-x64" : void 0;
+  }
+  return void 0;
+}
+function channelUpgradeCommand(channel) {
+  switch (channel.kind) {
+    case "brew":
+      return "brew upgrade agent-shim";
+    case "npm":
+      return "npm install -g agent-shim@latest";
+    case "scoop":
+      return "scoop update agent-shim";
+    default:
+      return channel;
+  }
+}
+function channelRefusalMessage(channel) {
+  const command = channelUpgradeCommand(channel);
+  switch (channel.kind) {
+    case "brew":
+      return `this agent-shim was installed by Homebrew, so it updates through Homebrew instead: ${command}`;
+    case "npm":
+      switch (channel.reason) {
+        case "node_modules":
+          return `this agent-shim was installed by npm, so it updates through npm instead: ${command}`;
+        case "script":
+          return `the running agent-shim is a script rather than a release binary, so it updates through npm instead: ${command}`;
+        case "macos-x64":
+          return `${MACOS_X64_NOTE}, so it updates through npm instead: ${command}`;
+        default:
+          return channel.reason;
+      }
+    case "scoop":
+      return `this agent-shim was installed by Scoop, so it updates through Scoop instead: ${command}`;
+    default:
+      return channel;
+  }
+}
+function underBrewPrefix(executableRealPath) {
+  return BREW_PREFIXES.some((prefix) => executableRealPath === prefix || executableRealPath.startsWith(`${prefix}/`));
+}
+function detectChannel(env) {
+  if (env.platform === "win32") {
+    return { kind: "scoop" };
+  }
+  if (underBrewPrefix(env.executableRealPath)) {
+    return { kind: "brew" };
+  }
+  if (env.executableRealPath.split(/[\\/]/).includes("node_modules")) {
+    return { kind: "npm", reason: "node_modules" };
+  }
+  if ((env.fileHead ?? "").startsWith("#!")) {
+    return { kind: "npm", reason: "script" };
+  }
+  if (env.platform === "darwin" && env.arch === "x64") {
+    return { kind: "npm", reason: "macos-x64" };
+  }
+  return { kind: "self" };
+}
+function lockHolder(contents) {
+  const pid = Number((contents ?? "").trim());
+  return Number.isInteger(pid) && pid > 0 ? pid : void 0;
+}
+function acquireUpdateLock(fs20, isProcessAlive, pid, lockPath) {
+  const take = () => fs20.writeFileExclusive(lockPath, `${String(pid)}
+`);
+  const release = () => {
+    fs20.unlink(lockPath);
+  };
+  if (take()) {
+    return release;
+  }
+  const holder = lockHolder(fs20.readFileUtf8(lockPath));
+  if (holder !== void 0 && holder !== pid && isProcessAlive(holder)) {
+    throw new UpdateConflictError(`another agent-shim update (pid ${String(holder)}) is already running`);
+  }
+  fs20.unlink(lockPath);
+  if (!take()) {
+    throw new UpdateConflictError("another agent-shim update took the lock while it was being replaced");
+  }
+  return release;
+}
+function expectedSha256(sidecar) {
+  const first = sidecar.trim().split(/\s+/)[0];
+  return first === "" ? void 0 : first;
+}
+async function mustDownload(http8, url2) {
+  try {
+    return await http8.download(url2);
+  } catch (error62) {
+    throw new UpdateDownloadError(`could not download ${url2}: ${error62 instanceof Error ? error62.message : String(error62)}`);
+  }
+}
+async function downloadAndInstall(ports, asset, target) {
+  const tempDir = ports.fs.mkdtemp();
+  try {
+    const assetUrl = `${DOWNLOAD_BASE_URL}/${asset}`;
+    ports.fs.writeFileBytes(import_node_path40.default.join(tempDir, asset), await mustDownload(ports.http, assetUrl));
+    ports.fs.writeFileUtf8(import_node_path40.default.join(tempDir, `${asset}.sha256`), Buffer.from(await mustDownload(ports.http, `${assetUrl}.sha256`)).toString("utf8"));
+    const downloaded = ports.fs.readFileBytes(import_node_path40.default.join(tempDir, asset));
+    const sidecar = ports.fs.readFileUtf8(import_node_path40.default.join(tempDir, `${asset}.sha256`));
+    if (downloaded === void 0 || sidecar === void 0) {
+      throw new UpdateDownloadError(`the downloaded files for ${asset} are missing from ${tempDir}`);
+    }
+    const expected = expectedSha256(sidecar);
+    const actual = (0, import_node_crypto17.createHash)("sha256").update(downloaded).digest("hex");
+    if (expected === void 0 || expected !== actual) {
+      throw new UpdateDownloadError(`checksum mismatch for ${asset} (expected ${expected ?? "(none)"}, got ${actual})`);
+    }
+    const tempBinary = import_node_path40.default.join(import_node_path40.default.dirname(target), `.${import_node_path40.default.basename(target)}.${String(process.pid)}.${(0, import_node_crypto17.randomUUID)()}.tmp`);
+    ports.fs.writeFileBytes(tempBinary, downloaded);
+    try {
+      ports.fs.chmod(tempBinary, EXECUTABLE_MODE);
+      ports.fs.rename(tempBinary, target);
+    } catch (error62) {
+      ports.fs.unlink(tempBinary);
+      throw error62;
+    }
+  } finally {
+    ports.fs.rmRecursive(tempDir);
+  }
+}
+async function runSelfUpdate(ports, options) {
+  const executableRealPath = ports.fs.realpath(options.executablePath);
+  const channel = detectChannel({ platform: options.platform, arch: options.arch, executableRealPath, fileHead: ports.fs.readFileHead(executableRealPath, 2) });
+  if (channel.kind !== "self") {
+    throw new UpdateChannelError(channelRefusalMessage(channel));
+  }
+  const asset = selectAsset(options.platform, options.arch);
+  if (asset === void 0) {
+    throw new UpdateChannelError(`no release binary exists for ${options.platform} ${options.arch}; install agent-shim through one of the documented channels instead (see docs/installation.md)`);
+  }
+  let effectiveUrl;
+  try {
+    effectiveUrl = await ports.http.effectiveUrl(LATEST_RELEASE_URL);
+  } catch (error62) {
+    throw new UpdateDownloadError(`could not resolve the latest release from ${LATEST_RELEASE_URL}: ${error62 instanceof Error ? error62.message : String(error62)}`);
+  }
+  const latest = releaseTagFromUrl(effectiveUrl);
+  if (latest === void 0) {
+    throw new UpdateDownloadError(`could not read the latest release version from ${effectiveUrl}`);
+  }
+  if (compareVersions3(latest, options.currentVersion) <= 0) {
+    return { current: options.currentVersion, latest: options.currentVersion, action: "current" };
+  }
+  if (options.checkOnly) {
+    return { current: options.currentVersion, latest, action: "available" };
+  }
+  const releaseLock = acquireUpdateLock(ports.fs, ports.isProcessAlive, options.pid, options.lockPath);
+  try {
+    await downloadAndInstall(ports, asset, executableRealPath);
+  } finally {
+    releaseLock();
+  }
+  return { current: options.currentVersion, latest, action: "updated" };
+}
+
+// src/update/commands.ts
+function isEnoent6(error62) {
+  return typeof error62 === "object" && error62 !== null && "code" in error62 && error62.code === "ENOENT";
+}
+function isErrorWithCode2(error62, code) {
+  return typeof error62 === "object" && error62 !== null && "code" in error62 && error62.code === code;
+}
+var realUpdatePorts = {
+  http: {
+    effectiveUrl: async (url2) => {
+      const response = await fetch(url2, { redirect: "follow" });
+      if (!response.ok) {
+        throw new Error(`HTTP ${String(response.status)}`);
+      }
+      return response.url;
+    },
+    download: async (url2) => {
+      const response = await fetch(url2, { redirect: "follow" });
+      if (!response.ok) {
+        throw new Error(`HTTP ${String(response.status)}`);
+      }
+      return new Uint8Array(await response.arrayBuffer());
+    }
+  },
+  fs: {
+    realpath: (target) => import_node_fs17.default.realpathSync(target),
+    readFileUtf8: (filePath) => {
+      try {
+        return import_node_fs17.default.readFileSync(filePath, "utf8");
+      } catch (error62) {
+        if (isEnoent6(error62)) {
+          return void 0;
+        }
+        throw error62;
+      }
+    },
+    readFileBytes: (filePath) => {
+      try {
+        return new Uint8Array(import_node_fs17.default.readFileSync(filePath));
+      } catch (error62) {
+        if (isEnoent6(error62)) {
+          return void 0;
+        }
+        throw error62;
+      }
+    },
+    readFileHead: (filePath, length) => {
+      let descriptor;
+      try {
+        descriptor = import_node_fs17.default.openSync(filePath, "r");
+      } catch (error62) {
+        if (isEnoent6(error62)) {
+          return void 0;
+        }
+        throw error62;
+      }
+      try {
+        const buffer = Buffer.alloc(length);
+        const read = import_node_fs17.default.readSync(descriptor, buffer, 0, length, 0);
+        return read === 0 ? "" : buffer.toString("latin1", 0, read);
+      } finally {
+        import_node_fs17.default.closeSync(descriptor);
+      }
+    },
+    writeFileUtf8: (filePath, contents) => {
+      import_node_fs17.default.writeFileSync(filePath, contents, "utf8");
+    },
+    writeFileBytes: (filePath, contents) => {
+      import_node_fs17.default.writeFileSync(filePath, contents);
+    },
+    writeFileExclusive: (filePath, contents) => {
+      try {
+        import_node_fs17.default.writeFileSync(filePath, contents, { encoding: "utf8", flag: "wx" });
+        return true;
+      } catch (error62) {
+        if (isErrorWithCode2(error62, "EEXIST")) {
+          return false;
+        }
+        throw error62;
+      }
+    },
+    unlink: (filePath) => {
+      try {
+        import_node_fs17.default.unlinkSync(filePath);
+      } catch (error62) {
+        if (!isEnoent6(error62)) {
+          throw error62;
+        }
+      }
+    },
+    rename: (from, to) => {
+      import_node_fs17.default.renameSync(from, to);
+    },
+    chmod: (filePath, mode) => {
+      import_node_fs17.default.chmodSync(filePath, mode);
+    },
+    mkdtemp: () => import_node_fs17.default.mkdtempSync(import_node_path41.default.join(import_node_os7.default.tmpdir(), "agent-shim-update-")),
+    rmRecursive: (targetPath) => {
+      import_node_fs17.default.rmSync(targetPath, { recursive: true, force: true });
+    }
+  },
+  // Signal 0 performs the permission and existence checks without delivering anything; EPERM means the process exists but belongs to another user.
+  isProcessAlive: (pid) => {
+    try {
+      process.kill(pid, 0);
+      return true;
+    } catch (error62) {
+      return isErrorWithCode2(error62, "EPERM");
+    }
+  }
+};
+function formatUpdateReport(report) {
+  switch (report.action) {
+    case "current":
+      return `already at the latest release (${report.latest})`;
+    case "available":
+      return `update available: ${report.current} -> ${report.latest} (run \`agent-shim update\` to install it)`;
+    case "updated":
+      return `updated agent-shim: ${report.current} -> ${report.latest}`;
+    default:
+      return report.action;
+  }
+}
+function registerUpdateCommand(program2, deps, ports = realUpdatePorts) {
+  withExamples(
+    program2.command("update").description(
+      "Download the newest release binary and install it over the running one. An installation that belongs to a package manager (Homebrew, npm, Scoop) names its channel and its upgrade command instead of updating in place."
+    ).option("--check", "Only report whether a newer release exists; download and change nothing.").option("--json", "Print the result as JSON.").action(async (options) => {
+      const report = await runSelfUpdate(ports, {
+        currentVersion: package_default.version,
+        platform: process.platform,
+        arch: process.arch,
+        executablePath: realOwnExecutablePath(),
+        lockPath: import_node_path41.default.join(deps.paths.root, "update.lock"),
+        checkOnly: options.check === true,
+        pid: process.pid
+      });
+      if (options.json === true) {
+        printJson(report);
+        return;
+      }
+      console.log(formatUpdateReport(report));
+    }),
+    ["agent-shim update", "agent-shim update --check", "agent-shim update --json"]
+  );
+}
+
 // src/usage/commands.ts
 var DAY_MS3 = 864e5;
 function requireIdentity(paths, name) {
@@ -77518,14 +77905,14 @@ function requireIdentity(paths, name) {
     throw new IdentityNotFoundError(name);
   }
 }
-function collectUsageReport(fs19, paths, filters) {
+function collectUsageReport(fs20, paths, filters) {
   const { identity, provider, sinceMs } = filters;
   if (identity !== void 0) {
     requireIdentity(paths, identity);
   }
-  const log = readUsageLog(fs19, paths.usageLogDir, sinceMs === void 0 ? {} : { sinceMs });
+  const log = readUsageLog(fs20, paths.usageLogDir, sinceMs === void 0 ? {} : { sinceMs });
   const records = log.records.filter((record2) => (identity === void 0 || record2.identity === identity) && (provider === void 0 || record2.provider === provider));
-  const snapshots = (identity === void 0 ? listUsageSnapshots(fs19, paths.usageSnapshotsDir) : [readUsageSnapshot(fs19, paths.usageSnapshotsDir, identity)].flatMap((snapshot) => snapshot === void 0 ? [] : [snapshot])).map((snapshot) => provider === void 0 ? snapshot : { ...snapshot, providers: Object.fromEntries(Object.entries(snapshot.providers).filter(([name]) => name === provider)) }).filter((snapshot) => Object.keys(snapshot.providers).length > 0);
+  const snapshots = (identity === void 0 ? listUsageSnapshots(fs20, paths.usageSnapshotsDir) : [readUsageSnapshot(fs20, paths.usageSnapshotsDir, identity)].flatMap((snapshot) => snapshot === void 0 ? [] : [snapshot])).map((snapshot) => provider === void 0 ? snapshot : { ...snapshot, providers: Object.fromEntries(Object.entries(snapshot.providers).filter(([name]) => name === provider)) }).filter((snapshot) => Object.keys(snapshot.providers).length > 0);
   return {
     since: sinceMs === void 0 ? void 0 : new Date(sinceMs).toISOString(),
     logDir: paths.usageLogDir,
@@ -77621,15 +78008,15 @@ function formatUsageReport(report) {
   }
   return lines;
 }
-function collectAccounts(fs19, paths, identity) {
+function collectAccounts(fs20, paths, identity) {
   if (identity !== void 0) {
     requireIdentity(paths, identity);
   }
   const names = identity === void 0 ? listIdentities(paths).map((entry) => entry.name) : [identity];
   return names.map((name) => ({
     identity: name,
-    account: readAccountMetadata(fs19, paths.identitiesDir, name),
-    usage: readUsageSnapshot(fs19, paths.usageSnapshotsDir, name)
+    account: readAccountMetadata(fs20, paths.identitiesDir, name),
+    usage: readUsageSnapshot(fs20, paths.usageSnapshotsDir, name)
   }));
 }
 function formatAccounts(views) {
@@ -77788,17 +78175,18 @@ function buildProgram(deps) {
   registerFrontDoorCommand(program2, deps);
   registerUsageCommands(program2, deps);
   registerRunCommand(program2, deps.runClaude);
+  registerUpdateCommand(program2, deps, deps.updatePorts);
   registerCompletionCommand(program2);
   return program2;
 }
 
 // src/launchWiring.ts
-var import_node_os8 = __toESM(require("node:os"), 1);
-var import_node_crypto18 = require("node:crypto");
+var import_node_os9 = __toESM(require("node:os"), 1);
+var import_node_crypto19 = require("node:crypto");
 
 // src/launcher.ts
-var import_node_crypto17 = require("node:crypto");
-var import_node_path41 = __toESM(require("node:path"), 1);
+var import_node_crypto18 = require("node:crypto");
+var import_node_path43 = __toESM(require("node:path"), 1);
 
 // src/launcher/cliOverride.ts
 var InvalidCliCategoryError = class extends CliError {
@@ -77882,7 +78270,7 @@ function buildCliOverride(params) {
 }
 
 // src/launcher/flags.ts
-var import_node_path40 = __toESM(require("node:path"), 1);
+var import_node_path42 = __toESM(require("node:path"), 1);
 
 // src/headroom/headers.ts
 function mergeAnthropicCustomHeaders(existing, additions) {
@@ -77943,7 +78331,7 @@ function buildEnv(params) {
   const parentCustomHeaders = params.baseEnv.ANTHROPIC_CUSTOM_HEADERS;
   let providerCustomHeaders;
   if (!params.configDirEscapeHatch && params.resolvedIdentityName !== void 0) {
-    env.CLAUDE_CONFIG_DIR = import_node_path40.default.join(params.identitiesDir, params.resolvedIdentityName);
+    env.CLAUDE_CONFIG_DIR = import_node_path42.default.join(params.identitiesDir, params.resolvedIdentityName);
   }
   if (params.provider !== void 0) {
     const providerEnv = params.provider.definition.env ?? {};
@@ -78069,14 +78457,14 @@ function resolvePoolLaunch(params) {
 }
 
 // src/launcher/spawn.ts
-var import_node_os7 = __toESM(require("node:os"), 1);
+var import_node_os8 = __toESM(require("node:os"), 1);
 var SIGNAL_EXIT_CODE_OFFSET = 128;
 function exitCodeFor(result) {
   if (result.status !== null) {
     return result.status;
   }
   if (result.signal !== null) {
-    return SIGNAL_EXIT_CODE_OFFSET + import_node_os7.default.constants.signals[result.signal];
+    return SIGNAL_EXIT_CODE_OFFSET + import_node_os8.default.constants.signals[result.signal];
   }
   return 1;
 }
@@ -78100,7 +78488,7 @@ function resolveIdentityCredential(identity, credential, env, port) {
   return resolution.ok ? resolution : { ok: false, status: CREDENTIAL_UNAVAILABLE_EXIT, message: resolution.message };
 }
 function pickFromPool(decided, params, parsedArgv) {
-  const { paths, fs: fs19, proc, log } = params;
+  const { paths, fs: fs20, proc, log } = params;
   if (decided.pool === void 0) {
     return { identityDecision: decided };
   }
@@ -78114,7 +78502,7 @@ function pickFromPool(decided, params, parsedArgv) {
     selectedVia: decided.source,
     pools: params.pools,
     paths,
-    fs: fs19,
+    fs: fs20,
     usageFs: farmRuntime.fs,
     cwd: farmRuntime.cwd,
     now: farmRuntime.now,
@@ -78130,7 +78518,7 @@ function pickFromPool(decided, params, parsedArgv) {
   return { identityDecision: { ...decided, name: resolution.identity }, poolExplanation: resolution.explanation };
 }
 function prepareLaunch(params) {
-  const { paths, fs: fs19, proc, log } = params;
+  const { paths, fs: fs20, proc, log } = params;
   const { env, argv } = proc;
   const parsedArgv = parseLauncherArgv(argv);
   const cliOverride = buildCliOverride({
@@ -78145,7 +78533,7 @@ function prepareLaunch(params) {
     argv0Identity: parsedArgv.identity,
     directoryPinnedIdentity: params.directoryPinnedIdentity,
     readActiveIdentityFile: () => {
-      const raw = fs19.readFileUtf8(paths.activeIdentityFile);
+      const raw = fs20.readFileUtf8(paths.activeIdentityFile);
       if (raw === void 0) {
         return void 0;
       }
@@ -78180,7 +78568,7 @@ function prepareLaunch(params) {
   }
   let loadedIdentity;
   if (identityDecision.name !== void 0) {
-    loadedIdentity = loadIdentity(paths.identitiesDir, identityDecision.name, fs19);
+    loadedIdentity = loadIdentity(paths.identitiesDir, identityDecision.name, fs20);
     if (loadedIdentity === void 0) {
       log.error(
         `agent-shim: no identity named "${identityDecision.name}" (selected via ${identityDecision.source}). Run \`agent-shim identity add ${identityDecision.name}\` first.`
@@ -78195,7 +78583,7 @@ function prepareLaunch(params) {
     identityDefaultConfigProfile: loadedIdentity?.config.defaultConfigProfile,
     globalDefaultConfigProfile: params.globalDefaultConfigProfile
   });
-  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs19.readConfigFile(import_node_path41.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
+  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs20.readConfigFile(import_node_path43.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
     log.error(
       `agent-shim: no configuration profile named "${configProfileDecision.name}" (selected via ${configProfileDecision.source}). Run \`agent-shim profile add ${configProfileDecision.name}\` first.`
     );
@@ -78204,7 +78592,7 @@ function prepareLaunch(params) {
   const farmContext = farm !== void 0 && farmIdentity !== void 0 ? { farm, identity: farmIdentity, cascade: farm.loadCascade(configProfileDecision.name, cliOverride) } : void 0;
   const provider = parsedArgv.provider === false ? void 0 : resolveProvider({
     paths,
-    port: fs19,
+    port: fs20,
     env,
     ...params.credentials === void 0 ? {} : { credentials: params.credentials },
     ...parsedArgv.provider === void 0 ? {} : { cliProvider: parsedArgv.provider },
@@ -78353,7 +78741,7 @@ function prepareLaunch(params) {
     ...identityCredential === void 0 ? {} : { identityCredential },
     ...frontDoor === void 0 ? {} : { frontdoor: frontDoor },
     ...headroom === void 0 ? {} : { headroom },
-    sessionId: (0, import_node_crypto17.randomUUID)()
+    sessionId: (0, import_node_crypto18.randomUUID)()
   });
   const releases = [...headroom === void 0 || headroomPort === void 0 ? [] : [headroomPort.release], ...frontDoorRelease === void 0 ? [] : [frontDoorRelease]];
   const release = () => {
@@ -78374,7 +78762,7 @@ function runLauncher(params) {
 
 // src/launchWiring.ts
 function buildFarmRuntime(paths, cwd) {
-  const home = import_node_os8.default.homedir();
+  const home = import_node_os9.default.homedir();
   const read = cosmiconfigReader();
   const classification = loadClassification(paths);
   const loaded = loadCascadeInput({ paths, home, cwd, read });
@@ -78398,7 +78786,7 @@ function buildFarmRuntime(paths, cwd) {
         ...cliOverride === void 0 ? {} : { cliOverride }
       }).input,
       now: () => Date.now(),
-      uniqueSuffix: `${String(process.pid)}.${(0, import_node_crypto18.randomUUID)()}`,
+      uniqueSuffix: `${String(process.pid)}.${(0, import_node_crypto19.randomUUID)()}`,
       // Zombie-aware on purpose: a previous launcher that crashed out of a resync without releasing the lock may sit unreaped, still answering signal 0 as alive, and must read as a dead holder so this launch takes the lock over instead of timing out.
       lock: { pid: process.pid, isRunning: realIsProcessRunning, sleep: realSleepSync }
     },
@@ -78537,7 +78925,7 @@ async function runClaude(argvOverride) {
 // src/cli.ts
 async function main() {
   aliasLegacyEnv(process.env);
-  const invokedName = import_node_path42.default.basename(process.argv[1] ?? "agent-shim");
+  const invokedName = import_node_path44.default.basename(process.argv[1] ?? "agent-shim");
   if (isInvokedAsClaude(invokedName)) {
     await runClaude();
     return;