agent-shim 8.42.0 → 8.44.0

package/dist/index.cjs

@@ -2643,7 +2643,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "agent-shim",
-      version: "8.42.0",
+      version: "8.44.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -2761,7 +2761,7 @@ function readHeadroomState(fs12, stateFile) {
   }
 }
 function writeHeadroomState(fs12, stateFile, state) {
-  fs12.mkdirp(import_node_path10.default.dirname(stateFile));
+  fs12.mkdirp(import_node_path11.default.dirname(stateFile));
   fs12.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
 `);
 }
@@ -2789,7 +2789,7 @@ function readAllProviders(fs12, providersDir) {
       continue;
     }
     try {
-      const parsed = parseJson(fs12.readFileUtf8(import_node_path10.default.join(providersDir, name)), ProviderSchema);
+      const parsed = parseJson(fs12.readFileUtf8(import_node_path11.default.join(providersDir, name)), ProviderSchema);
       if (parsed !== void 0) {
         result.push({ name: name.slice(0, -".json".length), provider: parsed });
       }
@@ -2801,11 +2801,11 @@ function readAllProviders(fs12, providersDir) {
 }
 function writeSession(fs12, sessionsDir, session) {
   fs12.mkdirp(sessionsDir);
-  fs12.writeFileUtf8(import_node_path10.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
+  fs12.writeFileUtf8(import_node_path11.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
 `);
 }
 function removeSession(fs12, sessionsDir, pid) {
-  fs12.removeRecursive(import_node_path10.default.join(sessionsDir, `${String(pid)}.json`));
+  fs12.removeRecursive(import_node_path11.default.join(sessionsDir, `${String(pid)}.json`));
 }
 function listSessions(fs12, sessionsDir) {
   const sessions = [];
@@ -2814,7 +2814,7 @@ function listSessions(fs12, sessionsDir) {
       continue;
     }
     try {
-      const parsed = parseJson(fs12.readFileUtf8(import_node_path10.default.join(sessionsDir, name)), HeadroomSessionSchema);
+      const parsed = parseJson(fs12.readFileUtf8(import_node_path11.default.join(sessionsDir, name)), HeadroomSessionSchema);
       if (parsed !== void 0) {
         sessions.push(parsed);
       }
@@ -2844,12 +2844,12 @@ function readStartLock(fs12, lockFile) {
     return void 0;
   }
 }
-var import_node_crypto6, import_node_path10, import_zod5, HEADROOM_ANTHROPIC_UPSTREAM, HEADROOM_STATE_SCHEMA_VERSION, HeadroomStateSchema, HeadroomSessionSchema, HeadroomLockSchema;
+var import_node_crypto6, import_node_path11, import_zod5, HEADROOM_ANTHROPIC_UPSTREAM, HEADROOM_STATE_SCHEMA_VERSION, HeadroomStateSchema, HeadroomSessionSchema, HeadroomLockSchema;
 var init_state2 = __esm({
   "src/headroom/state.ts"() {
     "use strict";
     import_node_crypto6 = require("node:crypto");
-    import_node_path10 = __toESM(require("node:path"), 1);
+    import_node_path11 = __toESM(require("node:path"), 1);
     import_zod5 = require("zod");
     init_schema();
     HEADROOM_ANTHROPIC_UPSTREAM = "https://api.anthropic.com";
@@ -2989,7 +2989,7 @@ var init_settings = __esm({
 
 // src/headroom/socket.ts
 function headroomSocketPath(paths, supervisorPid) {
-  return import_node_path11.default.join(paths.headroomSocketDir, `${String(supervisorPid)}${HEADROOM_SOCKET_SUFFIX}`);
+  return import_node_path12.default.join(paths.headroomSocketDir, `${String(supervisorPid)}${HEADROOM_SOCKET_SUFFIX}`);
 }
 function platformRefusal(platform) {
   return PLATFORMS_WITHOUT_UNIX_SOCKETS.includes(platform) ? `headroom routing needs a unix domain socket, which headroom cannot serve on ${platform}; agent-shim never falls back to a TCP port for this hop` : void 0;
@@ -3018,7 +3018,7 @@ function verifyHeadroomSocket(socketPath, ports) {
     return { refused: unsupported };
   }
   const uid = ports.currentUid();
-  const directory = import_node_path11.default.dirname(socketPath);
+  const directory = import_node_path12.default.dirname(socketPath);
   const refusal = ownerOnlyRefusal("socket directory", directory, ports.lstat(directory), "dir", uid) ?? ownerOnlyRefusal("socket", socketPath, ports.lstat(socketPath), "socket", uid);
   return refusal === void 0 ? { socketPath } : { refused: refusal };
 }
@@ -3048,16 +3048,16 @@ function pruneStaleHeadroomSockets(fs12, paths, isRunning) {
     if (pid === void 0 || isRunning(Number.parseInt(pid, 10))) {
       continue;
     }
-    fs12.removeRecursive(import_node_path11.default.join(paths.headroomSocketDir, name));
+    fs12.removeRecursive(import_node_path12.default.join(paths.headroomSocketDir, name));
     removed.push(name);
   }
   return removed;
 }
-var import_node_path11, GROUP_OR_OTHER_BITS, OCTAL_RADIX, MODE_DIGITS, HEADROOM_SOCKET_SUFFIX, HEADROOM_SOCKET_NAME, UNIX_SOCKET_PATH_MAX_BYTES, PLATFORMS_WITHOUT_UNIX_SOCKETS;
+var import_node_path12, GROUP_OR_OTHER_BITS, OCTAL_RADIX, MODE_DIGITS, HEADROOM_SOCKET_SUFFIX, HEADROOM_SOCKET_NAME, UNIX_SOCKET_PATH_MAX_BYTES, PLATFORMS_WITHOUT_UNIX_SOCKETS;
 var init_socket = __esm({
   "src/headroom/socket.ts"() {
     "use strict";
-    import_node_path11 = __toESM(require("node:path"), 1);
+    import_node_path12 = __toESM(require("node:path"), 1);
     GROUP_OR_OTHER_BITS = 63;
     OCTAL_RADIX = 8;
     MODE_DIGITS = 4;
@@ -3380,7 +3380,7 @@ function realIsProcessRunning(pid) {
   return realIsProcessAlive(pid) && !realIsProcessZombie(pid);
 }
 function expandHome2(filePath) {
-  return filePath.startsWith("~/") ? import_node_path12.default.join(import_node_os2.default.homedir(), filePath.slice(1)) : filePath;
+  return filePath.startsWith("~/") ? import_node_path13.default.join(import_node_os2.default.homedir(), filePath.slice(1)) : filePath;
 }
 function hasDesktopSession() {
   if (process.platform === "darwin") {
@@ -3424,7 +3424,7 @@ function spawnDaemonThroughScript(script) {
   return (paths, subcommand, logPath) => spawnDetachedDaemon({ command: process.execPath, args: [script, subcommand] }, paths, subcommand, logPath);
 }
 function spawnDetachedDaemon(invocation, paths, subcommand, logPath) {
-  import_node_fs2.default.mkdirSync(import_node_path12.default.dirname(logPath), { recursive: true });
+  import_node_fs2.default.mkdirSync(import_node_path13.default.dirname(logPath), { recursive: true });
   const logFd = import_node_fs2.default.openSync(logPath, "a");
   try {
     const child = (0, import_node_child_process.spawn)(invocation.command, invocation.args, detachedDaemonSpawnOptions(logFd, { ...process.env, AGENT_SHIM_HOME: paths.root }));
@@ -3477,7 +3477,7 @@ function listVersionsDir(dir) {
     throw error;
   }
   return entries.filter((entry) => entry.isFile()).map((entry) => {
-    const fullPath = import_node_path12.default.join(dir, entry.name);
+    const fullPath = import_node_path13.default.join(dir, entry.name);
     const stat = import_node_fs2.default.statSync(fullPath);
     return {
       name: entry.name,
@@ -3491,7 +3491,7 @@ function windowsPathExtensions(pathext) {
   return (pathext ?? WINDOWS_DEFAULT_PATHEXT).split(";").map((ext) => ext.trim()).filter((ext) => ext.length > 0);
 }
 function resolveExecutableCandidate(dir, name, env) {
-  const candidate = import_node_path12.default.join(dir, name);
+  const candidate = import_node_path13.default.join(dir, name);
   if (env.platform === "win32") {
     const extensions = windowsPathExtensions(env.pathext);
     const alreadyHasRecognisedExtension = extensions.some((ext) => candidate.toLowerCase().endsWith(ext.toLowerCase()));
@@ -3540,13 +3540,13 @@ function resolveOwnExecutablePath(env) {
   if (env.argv1 !== void 0 && !env.argv1.includes("/") && !env.argv1.includes("\\")) {
     return searchPathForExecutable(env.pathDirs, env.argv1, env.findExecutableInDir) ?? env.execPath;
   }
-  const candidate = env.argv1 === void 0 ? env.execPath : import_node_path12.default.resolve(env.cwd, env.argv1);
-  const candidateDir = import_node_path12.default.dirname(candidate);
-  const candidateDirOnPath = env.pathDirs.some((dir) => import_node_path12.default.resolve(dir) === candidateDir);
+  const candidate = env.argv1 === void 0 ? env.execPath : import_node_path13.default.resolve(env.cwd, env.argv1);
+  const candidateDir = import_node_path13.default.dirname(candidate);
+  const candidateDirOnPath = env.pathDirs.some((dir) => import_node_path13.default.resolve(dir) === candidateDir);
   if (candidateDirOnPath) {
     return candidate;
   }
-  const viaPath = searchPathForExecutable(env.pathDirs, import_node_path12.default.basename(candidate), env.findExecutableInDir);
+  const viaPath = searchPathForExecutable(env.pathDirs, import_node_path13.default.basename(candidate), env.findExecutableInDir);
   return viaPath ?? candidate;
 }
 function realOwnExecutablePath() {
@@ -3554,7 +3554,7 @@ function realOwnExecutablePath() {
     argv1: process.argv[1],
     execPath: process.execPath,
     cwd: process.cwd(),
-    pathDirs: (process.env.PATH ?? "").split(import_node_path12.default.delimiter).filter((dir) => dir !== ""),
+    pathDirs: (process.env.PATH ?? "").split(import_node_path13.default.delimiter).filter((dir) => dir !== ""),
     findExecutableInDir
   });
 }
@@ -3567,7 +3567,7 @@ function realContentSourcePath() {
 function realResolveClaudeBinary(isOwnBinary) {
   return (request4) => discoverClaudeBinary({
     listVersionsDir,
-    pathDirs: (process.env.PATH ?? "").split(import_node_path12.default.delimiter).filter((dir) => dir !== ""),
+    pathDirs: (process.env.PATH ?? "").split(import_node_path13.default.delimiter).filter((dir) => dir !== ""),
     findExecutableInDir,
     isOwnBinary,
     ...request4?.version === void 0 ? {} : { version: request4.version }
@@ -3576,7 +3576,7 @@ function realResolveClaudeBinary(isOwnBinary) {
 function realInstalledClaudeVersions() {
   return installedVersions(listVersionsDir(defaultVersionsDir()));
 }
-var import_node_child_process, import_node_crypto8, import_node_fs2, import_node_os2, import_node_path12, import_node_sea, realFsPort, OWNER_ONLY_DIR_MODE, OWNER_ONLY_FILE_MODE, PERMISSION_BITS, realFarmFs, INT32_BYTE_LENGTH, realRunPort, MACOS_GUI_SESSION_MANAGER, realCredentialPort, SOCKET_PERMISSION_BITS, realHeadroomSocketTrust, realSpawnPort, realProcPort, EXECUTE_BITS_MASK, WINDOWS_DEFAULT_PATHEXT;
+var import_node_child_process, import_node_crypto8, import_node_fs2, import_node_os2, import_node_path13, import_node_sea, realFsPort, OWNER_ONLY_DIR_MODE, OWNER_ONLY_FILE_MODE, PERMISSION_BITS, realFarmFs, INT32_BYTE_LENGTH, realRunPort, MACOS_GUI_SESSION_MANAGER, realCredentialPort, SOCKET_PERMISSION_BITS, realHeadroomSocketTrust, realSpawnPort, realProcPort, EXECUTE_BITS_MASK, WINDOWS_DEFAULT_PATHEXT;
 var init_realPorts = __esm({
   "src/realPorts.ts"() {
     "use strict";
@@ -3584,7 +3584,7 @@ var init_realPorts = __esm({
     import_node_crypto8 = require("node:crypto");
     import_node_fs2 = __toESM(require("node:fs"), 1);
     import_node_os2 = __toESM(require("node:os"), 1);
-    import_node_path12 = __toESM(require("node:path"), 1);
+    import_node_path13 = __toESM(require("node:path"), 1);
     import_node_sea = require("node:sea");
     init_load();
     init_versionDiscovery();
@@ -3800,18 +3800,18 @@ function expandTilde(value, home) {
     return home;
   }
   if (value.startsWith("~/")) {
-    return import_node_path13.default.join(home, value.slice(2));
+    return import_node_path14.default.join(home, value.slice(2));
   }
   return value;
 }
 function normaliseRulePath(rulePath, home) {
-  return import_node_path13.default.resolve(expandTilde(rulePath, home));
+  return import_node_path14.default.resolve(expandTilde(rulePath, home));
 }
-var import_node_path13;
+var import_node_path14;
 var init_pathNorm = __esm({
   "src/pathNorm.ts"() {
     "use strict";
-    import_node_path13 = __toESM(require("node:path"), 1);
+    import_node_path14 = __toESM(require("node:path"), 1);
   }
 });
 
@@ -3820,7 +3820,7 @@ function loadCascadeInput(params) {
   const globalConfig = loadConfigFile(params.paths.globalConfigFile, GlobalConfigSchema, params.read);
   const directoryRules = loadConfigFile(params.paths.directoryRulesFile, DirectoryRulesSchema, params.read);
   const loadProfile = (name) => {
-    const filepath = import_node_path14.default.join(params.paths.configProfilesDir, `${name}.json`);
+    const filepath = import_node_path15.default.join(params.paths.configProfilesDir, `${name}.json`);
     const loaded = loadConfigFile(filepath, ConfigProfileSchema, params.read);
     if (loaded === void 0) {
       return void 0;
@@ -3835,8 +3835,8 @@ function loadCascadeInput(params) {
   });
   const levels = [];
   for (const dir of dirs) {
-    const portable = loadConfigFile(import_node_path14.default.join(dir, PORTABLE_CONFIG_FILENAME), PortableConfigSchema, params.read) ?? loadConfigFile(import_node_path14.default.join(dir, LEGACY_PORTABLE_CONFIG_FILENAME), PortableConfigSchema, params.read);
-    const portableLocal = loadConfigFile(import_node_path14.default.join(dir, PORTABLE_LOCAL_CONFIG_FILENAME), PortableConfigSchema, params.read) ?? loadConfigFile(import_node_path14.default.join(dir, LEGACY_PORTABLE_LOCAL_CONFIG_FILENAME), PortableConfigSchema, params.read);
+    const portable = loadConfigFile(import_node_path15.default.join(dir, PORTABLE_CONFIG_FILENAME), PortableConfigSchema, params.read) ?? loadConfigFile(import_node_path15.default.join(dir, LEGACY_PORTABLE_CONFIG_FILENAME), PortableConfigSchema, params.read);
+    const portableLocal = loadConfigFile(import_node_path15.default.join(dir, PORTABLE_LOCAL_CONFIG_FILENAME), PortableConfigSchema, params.read) ?? loadConfigFile(import_node_path15.default.join(dir, LEGACY_PORTABLE_LOCAL_CONFIG_FILENAME), PortableConfigSchema, params.read);
     const rules = (directoryRules?.config.rules ?? []).map((rule, index) => ({ rule, index })).filter(({ rule }) => normaliseRulePath(rule.path, params.home) === dir).map(({ rule, index }) => {
       const entryOrder = directoryRules?.ruleEntryOrders[index];
       return {
@@ -3883,11 +3883,11 @@ function readDirectorySelections(loaded) {
   }
   return { ...identity === void 0 ? {} : { identity }, ...configProfile === void 0 ? {} : { configProfile } };
 }
-var import_node_path14, PORTABLE_CONFIG_FILENAME, PORTABLE_LOCAL_CONFIG_FILENAME;
+var import_node_path15, PORTABLE_CONFIG_FILENAME, PORTABLE_LOCAL_CONFIG_FILENAME;
 var init_cascade = __esm({
   "src/launcher/cascade.ts"() {
     "use strict";
-    import_node_path14 = __toESM(require("node:path"), 1);
+    import_node_path15 = __toESM(require("node:path"), 1);
     init_load();
     init_schema();
     init_pathNorm();
@@ -3951,13 +3951,13 @@ function decideConfigProfile(params) {
   return { source: "none" };
 }
 function loadIdentity(identitiesDir, name, fs12) {
-  return loadConfigFile(import_node_path15.default.join(identitiesDir, name, "identity.json"), IdentitySchema, fs12.readConfigFile);
+  return loadConfigFile(import_node_path16.default.join(identitiesDir, name, "identity.json"), IdentitySchema, fs12.readConfigFile);
 }
-var import_node_path15, IDENTITY_DECISION_SOURCES, CONFIG_PROFILE_DECISION_SOURCES;
+var import_node_path16, IDENTITY_DECISION_SOURCES, CONFIG_PROFILE_DECISION_SOURCES;
 var init_identity = __esm({
   "src/launcher/identity.ts"() {
     "use strict";
-    import_node_path15 = __toESM(require("node:path"), 1);
+    import_node_path16 = __toESM(require("node:path"), 1);
     init_load();
     init_schema();
     IDENTITY_DECISION_SOURCES = [
@@ -4153,7 +4153,7 @@ function isIdentityName(name) {
   return IdentitySchema.shape.name.safeParse(name).success;
 }
 function claudeJsonPath(identitiesDir, identity) {
-  return import_node_path16.default.join(identitiesDir, identity, CLAUDE_JSON);
+  return import_node_path17.default.join(identitiesDir, identity, CLAUDE_JSON);
 }
 function readAccountMetadata(fs12, identitiesDir, identity) {
   if (!isIdentityName(identity)) {
@@ -4207,11 +4207,11 @@ function createAccountReader(fs12, identitiesDir) {
     return account;
   };
 }
-var import_node_path16, CLAUDE_JSON, AccountMetadataError;
+var import_node_path17, CLAUDE_JSON, AccountMetadataError;
 var init_account = __esm({
   "src/usage/account.ts"() {
     "use strict";
-    import_node_path16 = __toESM(require("node:path"), 1);
+    import_node_path17 = __toESM(require("node:path"), 1);
     init_cliError();
     init_schema();
     init_schema2();
@@ -4677,7 +4677,7 @@ function readUsageLog(fs12, logDir, options = {}) {
     if (sinceMs !== void 0 && segment.endsAt <= sinceMs) {
       continue;
     }
-    const contents = fs12.readFileUtf8(import_node_path17.default.join(logDir, segment.name));
+    const contents = fs12.readFileUtf8(import_node_path18.default.join(logDir, segment.name));
     if (contents === void 0) {
       continue;
     }
@@ -4711,7 +4711,7 @@ function snapshotPath(snapshotsDir, identity) {
   if (!isIdentityName(identity)) {
     throw new Error(`"${identity}" is not a valid identity name.`);
   }
-  return import_node_path17.default.join(snapshotsDir, `${identity}.json`);
+  return import_node_path18.default.join(snapshotsDir, `${identity}.json`);
 }
 function readUsageSnapshot(fs12, snapshotsDir, identity) {
   const file = snapshotPath(snapshotsDir, identity);
@@ -4744,11 +4744,11 @@ function listUsageSnapshots(fs12, snapshotsDir) {
     return snapshot === void 0 ? [] : [snapshot];
   }).sort((left, right) => left.identity.localeCompare(right.identity));
 }
-var import_node_path17, SEGMENT_RE, DAY_MS, UsageSnapshotError;
+var import_node_path18, SEGMENT_RE, DAY_MS, UsageSnapshotError;
 var init_read = __esm({
   "src/usage/read.ts"() {
     "use strict";
-    import_node_path17 = __toESM(require("node:path"), 1);
+    import_node_path18 = __toESM(require("node:path"), 1);
     init_account();
     init_schema2();
     SEGMENT_RE = /^(\d{4}-\d{2}-\d{2})\.(\d+)\.jsonl$/;
@@ -4769,7 +4769,7 @@ function pruneUsageLog(fs12, logDir, nowMs) {
   const cutoff = nowMs - USAGE_RETENTION_MS;
   for (const segment of listLogSegments(fs12, logDir)) {
     if (segment.endsAt <= cutoff) {
-      fs12.removeRecursive(import_node_path18.default.join(logDir, segment.name));
+      fs12.removeRecursive(import_node_path19.default.join(logDir, segment.name));
     }
   }
 }
@@ -4851,7 +4851,7 @@ function createUsageStore(deps) {
         pruneUsageLog(fs12, paths.usageLogDir, nowMs);
         prunedDay = day;
       }
-      fs12.appendFilePrivate(import_node_path18.default.join(paths.usageLogDir, segmentName(day, deps.pid)), `${JSON.stringify(record)}
+      fs12.appendFilePrivate(import_node_path19.default.join(paths.usageLogDir, segmentName(day, deps.pid)), `${JSON.stringify(record)}
 `);
       if (record.identity !== void 0) {
         rewriteSnapshot(record.identity, (current) => ({ ...current?.providers, [record.provider]: foldProviderState(current?.providers[record.provider], record) }));
@@ -4874,11 +4874,11 @@ function createUsageStore(deps) {
     })
   };
 }
-var import_node_path18, DAY_MS2, DAYS_IN_WEEK, USAGE_RETENTION_MS;
+var import_node_path19, DAY_MS2, DAYS_IN_WEEK, USAGE_RETENTION_MS;
 var init_store2 = __esm({
   "src/usage/store.ts"() {
     "use strict";
-    import_node_path18 = __toESM(require("node:path"), 1);
+    import_node_path19 = __toESM(require("node:path"), 1);
     init_account();
     init_rateLimit();
     init_read();
@@ -5016,15 +5016,15 @@ function recordStickyPick(fs12, picksFile, directory, identity, nowMs) {
   const current = readPicksFile(fs12, picksFile).file.picks;
   const kept = Object.entries(current).filter(([, entry]) => nowMs - Date.parse(entry.at) <= USAGE_RETENTION_MS);
   const next = { schemaVersion: SCHEMA_VERSION, picks: { ...Object.fromEntries(kept), [directory]: { identity, at: new Date(nowMs).toISOString() } } };
-  fs12.mkdirPrivate(import_node_path19.default.dirname(picksFile));
+  fs12.mkdirPrivate(import_node_path20.default.dirname(picksFile));
   fs12.writeFilePrivate(picksFile, `${JSON.stringify(next, null, 2)}
 `);
 }
-var import_node_path19, import_zod10, PoolGraphError, SCHEMA_VERSION, PickEntrySchema, PicksFileSchema;
+var import_node_path20, import_zod10, PoolGraphError, SCHEMA_VERSION, PickEntrySchema, PicksFileSchema;
 var init_poolPick = __esm({
   "src/usage/poolPick.ts"() {
     "use strict";
-    import_node_path19 = __toESM(require("node:path"), 1);
+    import_node_path20 = __toESM(require("node:path"), 1);
     import_zod10 = require("zod");
     init_cliError();
     init_identity();
@@ -5055,8 +5055,8 @@ function resolveAgentShimHome(env = process.env, home = import_node_os4.default.
   if (fromEnv !== void 0 && fromEnv !== "") {
     return fromEnv;
   }
-  const current = import_node_path21.default.join(home, HOME_DIRNAME);
-  const legacy = import_node_path21.default.join(home, LEGACY_HOME_DIRNAME);
+  const current = import_node_path22.default.join(home, HOME_DIRNAME);
+  const legacy = import_node_path22.default.join(home, LEGACY_HOME_DIRNAME);
   return !isDirectory(current) && isDirectory(legacy) ? legacy : current;
 }
 function isExistingDirectory(candidate) {
@@ -5067,54 +5067,54 @@ function resolveClaudeHome() {
   if (fromEnv !== void 0 && fromEnv !== "") {
     return fromEnv;
   }
-  return import_node_path21.default.join(import_node_os4.default.homedir(), ".claude");
+  return import_node_path22.default.join(import_node_os4.default.homedir(), ".claude");
 }
 function buildLayoutPaths(root) {
   return {
     root,
-    identitiesDir: import_node_path21.default.join(root, "identities"),
-    configProfilesDir: import_node_path21.default.join(root, "config-profiles"),
-    providersDir: import_node_path21.default.join(root, "providers"),
-    directoryRulesFile: import_node_path21.default.join(root, "directory-rules.json"),
-    activeIdentityFile: import_node_path21.default.join(root, "active-identity"),
-    globalConfigFile: import_node_path21.default.join(root, "config.json"),
-    categoriesLocalFile: import_node_path21.default.join(root, "categories.local.json"),
-    claudeShimFile: import_node_path21.default.join(root, "claude-shim.json"),
-    headroomDir: import_node_path21.default.join(root, "headroom"),
-    headroomStateFile: import_node_path21.default.join(root, "headroom", `state.v${String(HEADROOM_STATE_SCHEMA_VERSION)}.json`),
-    headroomSocketDir: import_node_path21.default.join(root, "headroom", "run"),
-    headroomLockFile: import_node_path21.default.join(root, "headroom", "start.lock"),
-    headroomSessionsDir: import_node_path21.default.join(root, "headroom", "sessions"),
-    logsDir: import_node_path21.default.join(root, "logs"),
-    headroomLogPath: import_node_path21.default.join(root, "logs", "headroom.log"),
-    frontdoorDir: import_node_path21.default.join(root, "frontdoor"),
-    frontdoorCaDir: import_node_path21.default.join(root, "frontdoor", "ca"),
-    frontdoorCaCertFile: import_node_path21.default.join(root, "frontdoor", "ca", "ca.pem"),
-    frontdoorCaKeyFile: import_node_path21.default.join(root, "frontdoor", "ca", "ca.key"),
-    frontdoorCaBundlesDir: import_node_path21.default.join(root, "frontdoor", "ca", "bundles"),
-    chatgptSignInFile: import_node_path21.default.join(root, "codex", "chatgpt-sign-in.json"),
-    frontdoorStateFile: import_node_path21.default.join(root, "frontdoor", "state.json"),
-    frontdoorLockFile: import_node_path21.default.join(root, "frontdoor", "start.lock"),
-    frontdoorControlTokenFile: import_node_path21.default.join(root, "frontdoor", "control-token"),
-    frontdoorSessionsDir: import_node_path21.default.join(root, "frontdoor", "sessions"),
-    frontdoorRcCredentialsDir: import_node_path21.default.join(root, "frontdoor", "rc-credentials"),
-    frontdoorLogPath: import_node_path21.default.join(root, "logs", "frontdoor.log"),
-    usageDir: import_node_path21.default.join(root, "usage"),
-    usageLogDir: import_node_path21.default.join(root, "usage", "log"),
-    usageSnapshotsDir: import_node_path21.default.join(root, "usage", "snapshots"),
-    usagePicksFile: import_node_path21.default.join(root, "usage", "picks.json")
+    identitiesDir: import_node_path22.default.join(root, "identities"),
+    configProfilesDir: import_node_path22.default.join(root, "config-profiles"),
+    providersDir: import_node_path22.default.join(root, "providers"),
+    directoryRulesFile: import_node_path22.default.join(root, "directory-rules.json"),
+    activeIdentityFile: import_node_path22.default.join(root, "active-identity"),
+    globalConfigFile: import_node_path22.default.join(root, "config.json"),
+    categoriesLocalFile: import_node_path22.default.join(root, "categories.local.json"),
+    claudeShimFile: import_node_path22.default.join(root, "claude-shim.json"),
+    headroomDir: import_node_path22.default.join(root, "headroom"),
+    headroomStateFile: import_node_path22.default.join(root, "headroom", `state.v${String(HEADROOM_STATE_SCHEMA_VERSION)}.json`),
+    headroomSocketDir: import_node_path22.default.join(root, "headroom", "run"),
+    headroomLockFile: import_node_path22.default.join(root, "headroom", "start.lock"),
+    headroomSessionsDir: import_node_path22.default.join(root, "headroom", "sessions"),
+    logsDir: import_node_path22.default.join(root, "logs"),
+    headroomLogPath: import_node_path22.default.join(root, "logs", "headroom.log"),
+    frontdoorDir: import_node_path22.default.join(root, "frontdoor"),
+    frontdoorCaDir: import_node_path22.default.join(root, "frontdoor", "ca"),
+    frontdoorCaCertFile: import_node_path22.default.join(root, "frontdoor", "ca", "ca.pem"),
+    frontdoorCaKeyFile: import_node_path22.default.join(root, "frontdoor", "ca", "ca.key"),
+    frontdoorCaBundlesDir: import_node_path22.default.join(root, "frontdoor", "ca", "bundles"),
+    chatgptSignInFile: import_node_path22.default.join(root, "codex", "chatgpt-sign-in.json"),
+    frontdoorStateFile: import_node_path22.default.join(root, "frontdoor", "state.json"),
+    frontdoorLockFile: import_node_path22.default.join(root, "frontdoor", "start.lock"),
+    frontdoorControlTokenFile: import_node_path22.default.join(root, "frontdoor", "control-token"),
+    frontdoorSessionsDir: import_node_path22.default.join(root, "frontdoor", "sessions"),
+    frontdoorRcCredentialsDir: import_node_path22.default.join(root, "frontdoor", "rc-credentials"),
+    frontdoorLogPath: import_node_path22.default.join(root, "logs", "frontdoor.log"),
+    usageDir: import_node_path22.default.join(root, "usage"),
+    usageLogDir: import_node_path22.default.join(root, "usage", "log"),
+    usageSnapshotsDir: import_node_path22.default.join(root, "usage", "snapshots"),
+    usagePicksFile: import_node_path22.default.join(root, "usage", "picks.json")
   };
 }
 function resolveLayoutPaths() {
   return buildLayoutPaths(resolveAgentShimHome());
 }
-var import_node_fs4, import_node_os4, import_node_path21;
+var import_node_fs4, import_node_os4, import_node_path22;
 var init_paths = __esm({
   "src/paths.ts"() {
     "use strict";
     import_node_fs4 = __toESM(require("node:fs"), 1);
     import_node_os4 = __toESM(require("node:os"), 1);
-    import_node_path21 = __toESM(require("node:path"), 1);
+    import_node_path22 = __toESM(require("node:path"), 1);
     init_state2();
     init_legacy();
   }
@@ -5220,8 +5220,8 @@ function security(args, stdin) {
   return { status: result.status, stdout: result.stdout };
 }
 function createRealCredentialCache(root) {
-  const dir = import_node_path22.default.join(root, "credential-cache");
-  const filePath = (owner) => import_node_path22.default.join(dir, cacheFileNameFor(owner));
+  const dir = import_node_path23.default.join(root, "credential-cache");
+  const filePath = (owner) => import_node_path23.default.join(dir, cacheFileNameFor(owner));
   return {
     read(store, owner) {
       if (store === "file") {
@@ -5267,13 +5267,13 @@ function createRealCredentialCache(root) {
 function realCredentialCacheEnv(paths) {
   return { port: createRealCredentialCache(paths.root), platform: process.platform, now: () => Date.now() };
 }
-var import_node_child_process2, import_node_fs5, import_node_path22, KEYCHAIN_CACHE_SERVICE, CACHE_DIR_MODE, CACHE_FILE_MODE;
+var import_node_child_process2, import_node_fs5, import_node_path23, KEYCHAIN_CACHE_SERVICE, CACHE_DIR_MODE, CACHE_FILE_MODE;
 var init_realCredentialCache = __esm({
   "src/realCredentialCache.ts"() {
     "use strict";
     import_node_child_process2 = require("node:child_process");
     import_node_fs5 = __toESM(require("node:fs"), 1);
-    import_node_path22 = __toESM(require("node:path"), 1);
+    import_node_path23 = __toESM(require("node:path"), 1);
     init_credentialCache();
     KEYCHAIN_CACHE_SERVICE = "agent-shim-credential-cache";
     CACHE_DIR_MODE = 448;
@@ -5456,7 +5456,7 @@ var init_credential = __esm({
 
 // src/providersStore.ts
 function providerJsonPath(paths, name) {
-  return import_node_path23.default.join(paths.providersDir, `${name}.json`);
+  return import_node_path24.default.join(paths.providersDir, `${name}.json`);
 }
 function providerExists(paths, name) {
   return import_node_fs6.default.existsSync(providerJsonPath(paths, name));
@@ -5516,7 +5516,7 @@ function readProvider(paths, name) {
   return parseProviderFile(filePath, raw);
 }
 function loadProvider(providersDir, name, port) {
-  const filePath = import_node_path23.default.join(providersDir, `${name}.json`);
+  const filePath = import_node_path24.default.join(providersDir, `${name}.json`);
   const raw = port.readConfigFile(filePath);
   return raw === void 0 ? void 0 : parseProviderFile(filePath, raw);
 }
@@ -5670,12 +5670,12 @@ function resolveProvider(params) {
   }
   return { ok: true, provider: { name, definition, credential: resolution.credential }, warnings: resolution.credential.warnings };
 }
-var import_node_fs6, import_node_path23, ProviderNotFoundError, ProviderAlreadyExistsError, InvalidProviderNameError, PROVIDER_NAME_RE, LEGACY_PROVIDER_FIELDS, LEGACY_ENV_CREDENTIAL_KEYS, LEGACY_LITERAL_PLACEHOLDER, LegacyProviderFileError, ProviderKindMismatchError;
+var import_node_fs6, import_node_path24, ProviderNotFoundError, ProviderAlreadyExistsError, InvalidProviderNameError, PROVIDER_NAME_RE, LEGACY_PROVIDER_FIELDS, LEGACY_ENV_CREDENTIAL_KEYS, LEGACY_LITERAL_PLACEHOLDER, LegacyProviderFileError, ProviderKindMismatchError;
 var init_providersStore = __esm({
   "src/providersStore.ts"() {
     "use strict";
     import_node_fs6 = __toESM(require("node:fs"), 1);
-    import_node_path23 = __toESM(require("node:path"), 1);
+    import_node_path24 = __toESM(require("node:path"), 1);
     init_load();
     init_store();
     init_schema();
@@ -5887,10 +5887,10 @@ function commandFilename(ownExecutablePath, commandName) {
 }
 function resolveOwnBinaryCheck(paths, contentSourcePath) {
   const state = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-  const recordedTarget = state === void 0 ? void 0 : import_node_path25.default.resolve(state.targetPath);
+  const recordedTarget = state === void 0 ? void 0 : import_node_path26.default.resolve(state.targetPath);
   let ownStat;
   return (candidate) => {
-    if (recordedTarget !== void 0 && import_node_path25.default.resolve(candidate) === recordedTarget) {
+    if (recordedTarget !== void 0 && import_node_path26.default.resolve(candidate) === recordedTarget) {
       return true;
     }
     ownStat ??= statOrUndefined(contentSourcePath);
@@ -5913,22 +5913,22 @@ function statOrUndefined(target) {
   }
 }
 function findPathShadow(params) {
-  const resolvedTargetDir = import_node_path25.default.resolve(params.targetDir);
+  const resolvedTargetDir = import_node_path26.default.resolve(params.targetDir);
   for (const dir of params.pathDirs) {
     const found = params.findExecutableInDir(dir, params.targetFilename);
     if (found === void 0) {
       continue;
     }
-    return import_node_path25.default.resolve(dir) === resolvedTargetDir ? { status: "ok" } : { status: "shadowed", by: found };
+    return import_node_path26.default.resolve(dir) === resolvedTargetDir ? { status: "ok" } : { status: "shadowed", by: found };
   }
-  return params.pathDirs.some((dir) => import_node_path25.default.resolve(dir) === resolvedTargetDir) ? { status: "ok" } : { status: "not-on-path" };
+  return params.pathDirs.some((dir) => import_node_path26.default.resolve(dir) === resolvedTargetDir) ? { status: "ok" } : { status: "not-on-path" };
 }
-var import_node_fs7, import_node_path25, import_zod15, ClaudeShimStateSchema, nodeLinkFs;
+var import_node_fs7, import_node_path26, import_zod15, ClaudeShimStateSchema, nodeLinkFs;
 var init_claudeShim = __esm({
   "src/claudeShim.ts"() {
     "use strict";
     import_node_fs7 = __toESM(require("node:fs"), 1);
-    import_node_path25 = __toESM(require("node:path"), 1);
+    import_node_path26 = __toESM(require("node:path"), 1);
     import_zod15 = require("zod");
     init_commandDeps();
     init_store();
@@ -6378,7 +6378,7 @@ function buildEnv(params) {
   const parentCustomHeaders = params.baseEnv.ANTHROPIC_CUSTOM_HEADERS;
   let providerCustomHeaders;
   if (!params.configDirEscapeHatch && params.resolvedIdentityName !== void 0) {
-    env.CLAUDE_CONFIG_DIR = import_node_path30.default.join(params.identitiesDir, params.resolvedIdentityName);
+    env.CLAUDE_CONFIG_DIR = import_node_path31.default.join(params.identitiesDir, params.resolvedIdentityName);
   }
   if (params.provider !== void 0) {
     const providerEnv = params.provider.definition.env ?? {};
@@ -6422,11 +6422,11 @@ function buildEnv(params) {
   }
   return env;
 }
-var import_node_path30, LOOPBACK_HOSTS;
+var import_node_path31, LOOPBACK_HOSTS;
 var init_flags = __esm({
   "src/launcher/flags.ts"() {
     "use strict";
-    import_node_path30 = __toESM(require("node:path"), 1);
+    import_node_path31 = __toESM(require("node:path"), 1);
     init_envBool();
     init_credential();
     init_headers();
@@ -6772,7 +6772,7 @@ function prepareLaunch(params) {
     identityDefaultConfigProfile: loadedIdentity?.config.defaultConfigProfile,
     globalDefaultConfigProfile: params.globalDefaultConfigProfile
   });
-  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs12.readConfigFile(import_node_path31.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
+  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs12.readConfigFile(import_node_path32.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
     log.error(
       `agent-shim: no configuration profile named "${configProfileDecision.name}" (selected via ${configProfileDecision.source}). Run \`agent-shim profile add ${configProfileDecision.name}\` first.`
     );
@@ -6835,7 +6835,7 @@ function prepareLaunch(params) {
   );
   const updateCheck = runLaunchUpdateCheck({
     mode: params.updateMode ?? "off",
-    checkPath: import_node_path31.default.join(paths.root, "update.check"),
+    checkPath: import_node_path32.default.join(paths.root, "update.check"),
     currentVersion: package_default.version,
     port: params.update
   });
@@ -6972,12 +6972,12 @@ function runLaunchPlan(plan, spawn2) {
 function runLauncher(params) {
   params.proc.exit(runLaunchPlan(prepareLaunch(params), params.spawn));
 }
-var import_node_crypto10, import_node_path31;
+var import_node_crypto10, import_node_path32;
 var init_launcher = __esm({
   "src/launcher.ts"() {
     "use strict";
     import_node_crypto10 = require("node:crypto");
-    import_node_path31 = __toESM(require("node:path"), 1);
+    import_node_path32 = __toESM(require("node:path"), 1);
     init_package();
     init_envBool();
     init_argv();
@@ -7008,13 +7008,13 @@ function agentShimCliPath(distDir = typeof __AGENT_SHIM_DIST_DIR__ === "string"
   if (distDir === void 0) {
     throw new OwnCliPathUnknownError();
   }
-  return import_node_path32.default.join(distDir, OWN_CLI_FILE_NAME);
+  return import_node_path33.default.join(distDir, OWN_CLI_FILE_NAME);
 }
-var import_node_path32, OWN_CLI_FILE_NAME, OwnCliPathUnknownError;
+var import_node_path33, OWN_CLI_FILE_NAME, OwnCliPathUnknownError;
 var init_ownCli = __esm({
   "src/ownCli.ts"() {
     "use strict";
-    import_node_path32 = __toESM(require("node:path"), 1);
+    import_node_path33 = __toESM(require("node:path"), 1);
     init_cliError();
     OWN_CLI_FILE_NAME = "cli.cjs";
     OwnCliPathUnknownError = class extends CliError {
@@ -7099,7 +7099,7 @@ request.on("error", (error) => finish(failed, (error.code ? error.code + ": " :
 // src/frontdoor/trust.ts
 function resolveTrustBundle(params) {
   const { caCertFile, bundlesDir, variable, inherited, fs: fs12 } = params;
-  if (inherited === void 0 || inherited === "" || import_node_path33.default.resolve(inherited) === import_node_path33.default.resolve(caCertFile)) {
+  if (inherited === void 0 || inherited === "" || import_node_path34.default.resolve(inherited) === import_node_path34.default.resolve(caCertFile)) {
     return { path: caCertFile };
   }
   const caPem = fs12.readFileUtf8(caCertFile);
@@ -7117,19 +7117,19 @@ function resolveTrustBundle(params) {
   }
   const combined = `${inheritedPem.trimEnd()}
 ${caPem}`;
-  const bundle = import_node_path33.default.join(bundlesDir, `${(0, import_node_crypto11.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
+  const bundle = import_node_path34.default.join(bundlesDir, `${(0, import_node_crypto11.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
   if (!fs12.exists(bundle)) {
     fs12.mkdirp(bundlesDir);
     fs12.writeFileAtomic(bundle, combined);
   }
   return { path: bundle };
 }
-var import_node_crypto11, import_node_path33, BUNDLE_NAME_HEX_DIGITS;
+var import_node_crypto11, import_node_path34, BUNDLE_NAME_HEX_DIGITS;
 var init_trust = __esm({
   "src/frontdoor/trust.ts"() {
     "use strict";
     import_node_crypto11 = require("node:crypto");
-    import_node_path33 = __toESM(require("node:path"), 1);
+    import_node_path34 = __toESM(require("node:path"), 1);
     BUNDLE_NAME_HEX_DIGITS = 16;
   }
 });
@@ -7882,6 +7882,7 @@ __export(index_exports, {
   updateDirectoryRule: () => updateDirectoryRule,
   updateProvider: () => updateProvider,
   useIdentity: () => useIdentity,
+  watchedInstallEntry: () => watchedInstallEntry,
   writeDirectoryRules: () => writeDirectoryRules
 });
 module.exports = __toCommonJS(index_exports);
@@ -8219,12 +8220,22 @@ init_capability();
 init_route();
 
 // src/frontdoor/supervisor.ts
+var import_node_path9 = __toESM(require("node:path"), 1);
 init_state();
+function watchedInstallEntry(resolvedOwnExecutablePath, siblingExists) {
+  const parsed = import_node_path9.default.parse(resolvedOwnExecutablePath);
+  if (parsed.name === "agent-shim") {
+    return resolvedOwnExecutablePath;
+  }
+  const sibling = import_node_path9.default.join(parsed.dir, `agent-shim${parsed.ext}`);
+  return siblingExists(sibling) ? sibling : resolvedOwnExecutablePath;
+}
 var FRONTDOOR_SUPERVISOR_STILL_RUNNING = -1;
 var FRONTDOOR_POLL_MS = 1e3;
 var MS_PER_MINUTE = 6e4;
 async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {}) {
   const { fs: fs12, paths } = ports;
+  const servingBinary = ports.statOwnExecutable();
   const previous = readFrontDoorState(fs12, paths.frontdoorStateFile);
   let lastPort = previous?.lastPort;
   let lastConnectPort = previous?.lastConnectPort;
@@ -8287,6 +8298,18 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
   ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http3.port)}, CONNECT surface on 127.0.0.1:${String(connect3.port)}`);
   let idleSince;
   let ticks = 0;
+  const binaryReplaced = () => {
+    const current = ports.statOwnExecutable();
+    return current !== void 0 && servingBinary !== void 0 && (current.dev !== servingBinary.dev || current.ino !== servingBinary.ino || current.size !== servingBinary.size || current.mtimeMs !== servingBinary.mtimeMs);
+  };
+  const shutdown = async () => {
+    await direct.close();
+    await connect3.close();
+    await http3.close();
+    ports.closeRcStreamHub();
+    writeFrontDoorState(fs12, paths.frontdoorStateFile, sticky());
+    return 0;
+  };
   for (; ; ) {
     if (options.tickLimit !== void 0 && ticks >= options.tickLimit) {
       return FRONTDOOR_SUPERVISOR_STILL_RUNNING;
@@ -8298,16 +8321,16 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     ports.checkQuotaExpiry();
     const prunedPids = new Set(pruned);
     if (listed.filter((session) => !prunedPids.has(session.pid)).length === 0) {
+      if (ticks > 1 && binaryReplaced()) {
+        ports.log("agent-shim frontdoor supervisor: the installed binary changed and no sessions are live; turning the door over for the next launch");
+        ports.doorHealth.binaryTurnover();
+        return await shutdown();
+      }
       idleSince ??= ports.now();
       if (ports.now() - idleSince >= idleShutdownMinutes * MS_PER_MINUTE) {
         ports.log(`agent-shim frontdoor supervisor: no sessions for ${String(idleShutdownMinutes)} minute(s); closing the front door and exiting`);
         ports.doorHealth.idleShutdown();
-        await direct.close();
-        await connect3.close();
-        await http3.close();
-        ports.closeRcStreamHub();
-        writeFrontDoorState(fs12, paths.frontdoorStateFile, sticky());
-        return 0;
+        return await shutdown();
       }
     } else {
       idleSince = void 0;
@@ -8361,8 +8384,8 @@ function parseConnectTarget(authority) {
 function isInterceptedHost(host, interceptHosts) {
   return interceptHosts.includes(host);
 }
-function servedByPipeline(path34) {
-  return path34?.startsWith(ROUTED_PATH_PREFIX) === true;
+function servedByPipeline(path35) {
+  return path35?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
   "connection",
@@ -8896,11 +8919,11 @@ function createRcSessionTracker(deps) {
   };
   const observeExchange = (request4) => {
     const method = (request4.method ?? "").toUpperCase();
-    const path34 = new URL(request4.url ?? "/", "http://127.0.0.1").pathname;
-    if (!path34.startsWith(RC_SESSIONS_PATH_PREFIX)) {
+    const path35 = new URL(request4.url ?? "/", "http://127.0.0.1").pathname;
+    if (!path35.startsWith(RC_SESSIONS_PATH_PREFIX)) {
       return void 0;
     }
-    const tail = path34.slice(RC_SESSIONS_PATH_PREFIX.length);
+    const tail = path35.slice(RC_SESSIONS_PATH_PREFIX.length);
     const facts = {
       oauthAuthorization: oauthAuthorizationOf(request4.headers),
       anthropicVersion: singleHeader(request4.headers, "anthropic-version"),
@@ -9282,8 +9305,8 @@ var RC_READ_FILE_ENCODINGS = ["utf-8", "base64"];
 function isRcReadFileEncoding(value) {
   return RC_READ_FILE_ENCODINGS.some((encoding) => encoding === value);
 }
-function buildRcReadFilePayload(requestId, path34, options) {
-  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path34, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
+function buildRcReadFilePayload(requestId, path35, options) {
+  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path35, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
 }
 function buildRcFileSuggestionsPayload(requestId, query) {
   return buildRcControlRequestPayload(requestId, { subtype: "file_suggestions", query });
@@ -9385,15 +9408,15 @@ async function getRcSessionContextUsage(deps, sessionId, detail) {
   const result = await deliverRcClientPayload(deps, sessionId, buildRcGetContextUsagePayload(requestId, detail), `request the context usage of session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
-async function readRcSessionFile(deps, sessionId, path34, options) {
-  if (path34 === "") {
+async function readRcSessionFile(deps, sessionId, path35, options) {
+  if (path35 === "") {
     return { ok: false, message: "a read-file write needs a non-empty path: the SDK's own field names the file the worker resolves against the session's cwd, and an empty string names none" };
   }
   if (options?.maxBytes !== void 0 && (!Number.isInteger(options.maxBytes) || options.maxBytes <= 0)) {
     return { ok: false, message: "a read-file write's max-bytes is a positive whole number of bytes: the SDK's own field caps the read, and a zero or negative cap reads nothing" };
   }
   const requestId = deps.newUuid();
-  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path34, options), `read ${path34} from session ${sessionId}`);
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path35, options), `read ${path35} from session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
 async function suggestRcSessionFiles(deps, sessionId, query) {
@@ -9562,11 +9585,11 @@ function createRcControlHandler(deps) {
       path: "read-file",
       read: (body) => {
         const session = bodyString(body, "session");
-        const path34 = bodyString(body, "path");
+        const path35 = bodyString(body, "path");
         const maxBytes = "maxBytes" in body ? bodyPositiveInteger(body, "maxBytes") : void 0;
         const encoding = "encoding" in body && isRcReadFileEncoding(body.encoding) ? body.encoding : void 0;
-        const refused2 = session === void 0 || path34 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
-        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path34, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
+        const refused2 = session === void 0 || path35 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
+        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path35, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
       }
     },
     {
@@ -9876,9 +9899,9 @@ function requestIdOfBody(body) {
 }
 function frontDoorRcControl(transport, token) {
   const headers = { authorization: `Bearer ${token}` };
-  const listAnswerOf = async (path34, what) => {
+  const listAnswerOf = async (path35, what) => {
     try {
-      return await transport.request({ method: "GET", path: path34, headers });
+      return await transport.request({ method: "GET", path: path35, headers });
     } catch (error) {
       throw new Error(`${what}: could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
     }
@@ -9950,10 +9973,10 @@ function frontDoorRcControl(transport, token) {
     }
     return pending;
   };
-  const writeOf = async (path34, body, describeFailure) => {
+  const writeOf = async (path35, body, describeFailure) => {
     let answer;
     try {
-      answer = await transport.request({ method: "POST", path: path34, headers: { ...headers, "content-type": "application/json" }, body });
+      answer = await transport.request({ method: "POST", path: path35, headers: { ...headers, "content-type": "application/json" }, body });
     } catch (error) {
       return { ok: false, message: `could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}` };
     }
@@ -9984,10 +10007,10 @@ function frontDoorRcControl(transport, token) {
     endSession: async (sessionId, reason) => await writeOf(`${CONTROL_PATH_PREFIX}/end-session`, JSON.stringify({ session: sessionId, ...reason === void 0 ? {} : { reason } }), (status, message) => `ending ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getUsage: async (sessionId, skipBehaviors) => await writeOf(`${CONTROL_PATH_PREFIX}/get-usage`, JSON.stringify({ session: sessionId, ...skipBehaviors === void 0 ? {} : { skipBehaviors } }), (status, message) => `requesting the usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getContextUsage: async (sessionId, detail) => await writeOf(`${CONTROL_PATH_PREFIX}/get-context-usage`, JSON.stringify({ session: sessionId, ...detail === void 0 ? {} : { detail } }), (status, message) => `requesting the context usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
-    readFile: async (sessionId, path34, options) => await writeOf(
+    readFile: async (sessionId, path35, options) => await writeOf(
       `${CONTROL_PATH_PREFIX}/read-file`,
-      JSON.stringify({ session: sessionId, path: path34, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
-      (status, message) => `reading ${path34} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
+      JSON.stringify({ session: sessionId, path: path35, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
+      (status, message) => `reading ${path35} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
     ),
     fileSuggestions: async (sessionId, query) => await writeOf(`${CONTROL_PATH_PREFIX}/file-suggestions`, JSON.stringify({ session: sessionId, query }), (status, message) => `requesting file suggestions from ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     keepAlive: async (sessionId) => await writeOf(`${CONTROL_PATH_PREFIX}/keep-alive`, JSON.stringify({ session: sessionId }), (status, message) => `keeping ${sessionId} alive failed (HTTP ${String(status)}): ${message}`),
@@ -10142,12 +10165,12 @@ function tlsFacts(options) {
 }
 function realRcEventDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const post = async (path34, headers, body) => await new Promise((resolve, reject) => {
+  const post = async (path35, headers, body) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method: "POST",
-      path: path34,
+      path: path35,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, "content-length": String(Buffer.byteLength(body, "utf8")) },
       agent
@@ -10212,12 +10235,12 @@ function lateRcStreamDial(resolve) {
 }
 function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const request4 = async (method, path34, headers, body, signal) => await new Promise((resolve, reject) => {
+  const request4 = async (method, path35, headers, body, signal) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method,
-      path: path34,
+      path: path35,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, ...body === void 0 ? {} : { "content-length": String(Buffer.byteLength(body, "utf8")) } },
       agent,
@@ -10259,9 +10282,9 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
       return { status, body: await readAll(response) };
     },
     openStream: async (sessionId, headers, resume, signal) => {
-      const path34 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
+      const path35 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
       const streamHeaders = resume === void 0 ? headers : { ...headers, "last-event-id": String(resume.fromSequenceNum) };
-      const { status, response } = await request4("GET", path34, streamHeaders, void 0, signal);
+      const { status, response } = await request4("GET", path35, streamHeaders, void 0, signal);
       if (!isSuccessful2(status)) {
         await readAll(response);
         return { status, chunks: NO_CHUNKS };
@@ -10473,7 +10496,7 @@ function realConnectEffects(ports = DOOR_SOURCE_PORTS) {
 }
 
 // src/frontdoor/rcCredentialStore.ts
-var import_node_path9 = __toESM(require("node:path"), 1);
+var import_node_path10 = __toESM(require("node:path"), 1);
 function isSafeSessionId(sessionId) {
   return /^[A-Za-z0-9_-]+$/.test(sessionId);
 }
@@ -10499,7 +10522,7 @@ function sequenceNumOfJson(value) {
 }
 function createRcCredentialStore(fs12, dir) {
   fs12.mkdirPrivate(dir);
-  const fileFor = (sessionId) => import_node_path9.default.join(dir, `${sessionId}.json`);
+  const fileFor = (sessionId) => import_node_path10.default.join(dir, `${sessionId}.json`);
   const readParsed = (sessionId) => {
     const raw = fs12.readFileUtf8(fileFor(sessionId));
     if (raw === void 0) {
@@ -10955,7 +10978,7 @@ init_cliError();
 
 // src/configProfilesStore.ts
 var import_node_fs3 = __toESM(require("node:fs"), 1);
-var import_node_path20 = __toESM(require("node:path"), 1);
+var import_node_path21 = __toESM(require("node:path"), 1);
 init_store();
 init_schema();
 init_cliError();
@@ -10985,7 +11008,7 @@ var InvalidCategoryNameError = class extends CliError {
   categoryName;
 };
 function profileJsonPath(paths, name) {
-  return import_node_path20.default.join(paths.configProfilesDir, `${name}.json`);
+  return import_node_path21.default.join(paths.configProfilesDir, `${name}.json`);
 }
 function profileExists(paths, name) {
   return import_node_fs3.default.existsSync(profileJsonPath(paths, name));
@@ -11125,19 +11148,19 @@ function writePools(paths, pools) {
   applyPatch(paths.globalConfigFile, GlobalConfigSchema, { pools }, { defaults: {} });
 }
 function poolCycleOf(pools, name) {
-  const walk = (current, path34) => {
+  const walk = (current, path35) => {
     for (const entry of pools[current]?.identities ?? []) {
       const nested = poolNameOf(poolMemberIdentity(entry));
       if (nested === void 0) {
         continue;
       }
       if (nested === name) {
-        return [...path34, nested];
+        return [...path35, nested];
       }
-      if (path34.includes(nested)) {
+      if (path35.includes(nested)) {
         continue;
       }
-      const found = walk(nested, [...path34, nested]);
+      const found = walk(nested, [...path35, nested]);
       if (found !== void 0) {
         return found;
       }
@@ -11236,7 +11259,7 @@ init_paths();
 init_realCredentialCache();
 init_providersStore();
 init_realPorts();
-var import_node_path24 = __toESM(require("node:path"), 1);
+var import_node_path25 = __toESM(require("node:path"), 1);
 var import_zod12 = require("zod");
 init_envBool();
 init_load();
@@ -11585,10 +11608,10 @@ function collectCheckReport(params) {
   }).input;
   const providerName = cascadeProviderName(cascade);
   const provider = providerName === void 0 ? void 0 : loadCheckProvider(paths, providerName);
-  const farmRoot = identityDecision.name === void 0 ? void 0 : import_node_path24.default.join(paths.identitiesDir, identityDecision.name);
+  const farmRoot = identityDecision.name === void 0 ? void 0 : import_node_path25.default.join(paths.identitiesDir, identityDecision.name);
   const settingsFiles = {
-    "settings.json": realFsPort.readFileUtf8(import_node_path24.default.join(claudeHome, "settings.json")),
-    "settings.local.json": realFsPort.readFileUtf8(import_node_path24.default.join(claudeHome, "settings.local.json"))
+    "settings.json": realFsPort.readFileUtf8(import_node_path25.default.join(claudeHome, "settings.json")),
+    "settings.local.json": realFsPort.readFileUtf8(import_node_path25.default.join(claudeHome, "settings.local.json"))
   };
   const report = runCheck({
     cwd,
@@ -11808,7 +11831,7 @@ init_middleware();
 init_preflight();
 
 // src/frontdoor/controlSchemas.ts
-var import_node_path28 = __toESM(require("node:path"), 1);
+var import_node_path29 = __toESM(require("node:path"), 1);
 var import_zod19 = require("zod");
 
 // src/doctorReport.ts
@@ -11817,7 +11840,7 @@ init_store();
 
 // src/identityStore.ts
 var import_node_fs8 = __toESM(require("node:fs"), 1);
-var import_node_path26 = __toESM(require("node:path"), 1);
+var import_node_path27 = __toESM(require("node:path"), 1);
 init_load();
 init_store();
 init_schema();
@@ -11851,7 +11874,7 @@ var InvalidIdentityNameError = class extends CliError {
   attemptedName;
 };
 function identityJsonPath(paths, name) {
-  return import_node_path26.default.join(paths.identitiesDir, name, "identity.json");
+  return import_node_path27.default.join(paths.identitiesDir, name, "identity.json");
 }
 function identityExists(paths, name) {
   return import_node_fs8.default.existsSync(identityJsonPath(paths, name));
@@ -11952,7 +11975,7 @@ function setIdentityCredential(paths, identityName, change) {
   });
 }
 function belongsToIdentity(entry, name) {
-  return entry === name || entry === import_node_path26.default.basename(identityLockPath("", name)) || entry.startsWith(`.${name}.scratch.`) || entry.startsWith(`.${name}.previous.`);
+  return entry === name || entry === import_node_path27.default.basename(identityLockPath("", name)) || entry.startsWith(`.${name}.scratch.`) || entry.startsWith(`.${name}.previous.`);
 }
 function removeIdentity(paths, name) {
   if (!identityExists(paths, name)) {
@@ -11960,7 +11983,7 @@ function removeIdentity(paths, name) {
   }
   for (const entry of import_node_fs8.default.readdirSync(paths.identitiesDir)) {
     if (belongsToIdentity(entry, name)) {
-      import_node_fs8.default.rmSync(import_node_path26.default.join(paths.identitiesDir, entry), { recursive: true, force: true });
+      import_node_fs8.default.rmSync(import_node_path27.default.join(paths.identitiesDir, entry), { recursive: true, force: true });
     }
   }
   if (readActiveIdentity2(paths) === name) {
@@ -11971,7 +11994,7 @@ function removeIdentity(paths, name) {
 // src/doctorReport.ts
 init_realPorts();
 var import_node_fs9 = __toESM(require("node:fs"), 1);
-var import_node_path27 = __toESM(require("node:path"), 1);
+var import_node_path28 = __toESM(require("node:path"), 1);
 
 // src/codex/siwcStore.ts
 var import_zod18 = require("zod");
@@ -12104,7 +12127,7 @@ function validateJson(schema, input) {
   return { ok: true, data: result.data };
 }
 function pushPathResolution(push, resolution) {
-  const ownDir = import_node_path27.default.dirname(resolution.ownExecutablePath);
+  const ownDir = import_node_path28.default.dirname(resolution.ownExecutablePath);
   switch (resolution.agentShim.status) {
     case "ok":
       push("path-resolution", "pass", `\`agent-shim\` on PATH resolves to this running executable, ${resolution.ownExecutablePath}.`, "agent-shim");
@@ -12203,14 +12226,14 @@ function pushProvider(push, entry, cacheEnv, signIn) {
 }
 function pushLegacyName(push, params) {
   const legacyVariables = Object.keys(params.env).filter((name) => name.startsWith(LEGACY_ENV_PREFIX) && params.env[name] !== void 0).sort();
-  if (legacyVariables.length === 0 && import_node_path27.default.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
+  if (legacyVariables.length === 0 && import_node_path28.default.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
     push("legacy-name", "pass", "Nothing here still uses the former `claude-use` name.");
     return;
   }
   for (const name of legacyVariables) {
     push("legacy-name", "warn", `${name} is the former name of ${name.replace(LEGACY_ENV_PREFIX, ENV_PREFIX)}. Rename it; the old name still works but is only a fallback.`, name);
   }
-  if (import_node_path27.default.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
+  if (import_node_path28.default.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
     push(
       "legacy-name",
       "warn",
@@ -12550,18 +12573,18 @@ function collectDoctorReport(params) {
   const { paths } = params;
   const identityNames = import_node_fs9.default.existsSync(paths.identitiesDir) ? import_node_fs9.default.readdirSync(paths.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && isIdentityDirectoryName(entry.name)).map((entry) => entry.name).sort() : [];
   const identities = identityNames.map((name) => {
-    const farmRoot = import_node_path27.default.join(paths.identitiesDir, name);
-    const identityPath = import_node_path27.default.join(farmRoot, "identity.json");
+    const farmRoot = import_node_path28.default.join(paths.identitiesDir, name);
+    const identityPath = import_node_path28.default.join(farmRoot, "identity.json");
     return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot };
   });
   const profileNames = import_node_fs9.default.existsSync(paths.configProfilesDir) ? import_node_fs9.default.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const configProfiles = profileNames.map((name) => {
-    const profilePath = import_node_path27.default.join(paths.configProfilesDir, `${name}.json`);
+    const profilePath = import_node_path28.default.join(paths.configProfilesDir, `${name}.json`);
     return { name, path: profilePath, raw: realFsPort.readFileUtf8(profilePath) };
   });
   const providerNames = import_node_fs9.default.existsSync(paths.providersDir) ? import_node_fs9.default.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const providers = providerNames.map((name) => {
-    const providerPath = import_node_path27.default.join(paths.providersDir, `${name}.json`);
+    const providerPath = import_node_path28.default.join(paths.providersDir, `${name}.json`);
     return { name, path: providerPath, raw: realFsPort.readFileUtf8(providerPath) };
   });
   const ownExecutablePath = realOwnExecutablePath();
@@ -12573,12 +12596,12 @@ function collectDoctorReport(params) {
     binaryDiscovery = { ok: false, message: error instanceof Error ? error.message : String(error) };
   }
   const shimState = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-  const pathDirs = (params.env.PATH ?? "").split(import_node_path27.default.delimiter).filter((dir) => dir !== "");
+  const pathDirs = (params.env.PATH ?? "").split(import_node_path28.default.delimiter).filter((dir) => dir !== "");
   const claudeShimShadow = shimState === void 0 ? void 0 : refinePathShadow(
     findPathShadow({
       pathDirs,
-      targetDir: import_node_path27.default.dirname(shimState.targetPath),
-      targetFilename: import_node_path27.default.basename(shimState.targetPath),
+      targetDir: import_node_path28.default.dirname(shimState.targetPath),
+      targetFilename: import_node_path28.default.basename(shimState.targetPath),
       findExecutableInDir
     }),
     shimState.targetPath,
@@ -12604,7 +12627,7 @@ function collectDoctorReport(params) {
       agentShim: refinePathShadow(
         findPathShadow({
           pathDirs,
-          targetDir: import_node_path27.default.dirname(ownExecutablePath),
+          targetDir: import_node_path28.default.dirname(ownExecutablePath),
           targetFilename: commandFilename(ownExecutablePath, "agent-shim"),
           findExecutableInDir
         }),
@@ -12673,11 +12696,11 @@ var FrontDoorSessionsOutputSchema = import_zod19.z.strictObject({ sessions: impo
 var CheckRunInputSchema = import_zod19.z.strictObject({
   path: import_zod19.z.string().min(1),
   identity: import_zod19.z.string().min(1).optional()
-}).refine((input) => import_node_path28.default.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+}).refine((input) => import_node_path29.default.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
 var PoolPickInputSchema = import_zod19.z.strictObject({
   pool: import_zod19.z.string().min(1),
   path: import_zod19.z.string().min(1)
-}).refine((input) => import_node_path28.default.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+}).refine((input) => import_node_path29.default.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
 var DoctorFindingSchema = import_zod19.z.strictObject({
   section: import_zod19.z.enum(DOCTOR_SECTIONS),
   subject: import_zod19.z.string().optional(),
@@ -12719,6 +12742,7 @@ var LaunchLifecycleEventSchema = import_zod20.z.strictObject({
 var DoorHealthEventSchema = import_zod20.z.discriminatedUnion("kind", [
   import_zod20.z.strictObject({ kind: import_zod20.z.literal("generation"), pid: import_zod20.z.number().int().positive(), providerPort: import_zod20.z.number().int().positive(), connectPort: import_zod20.z.number().int().positive(), directPort: import_zod20.z.number().int().positive(), observedAt: import_zod20.z.number() }),
   import_zod20.z.strictObject({ kind: import_zod20.z.literal("listenerFailed"), pid: import_zod20.z.number().int().positive(), listener: import_zod20.z.enum(["provider", "connect", "direct"]), message: import_zod20.z.string(), observedAt: import_zod20.z.number() }),
+  import_zod20.z.strictObject({ kind: import_zod20.z.literal("binaryTurnover"), pid: import_zod20.z.number().int().positive(), observedAt: import_zod20.z.number() }),
   import_zod20.z.strictObject({ kind: import_zod20.z.literal("idleShutdown"), pid: import_zod20.z.number().int().positive(), observedAt: import_zod20.z.number() })
 ]);
 var QuotaExpiringEventSchema = import_zod20.z.strictObject({
@@ -13090,6 +13114,9 @@ function createDoorHealthPublisher(hub, now, pid) {
     },
     idleShutdown: () => {
       publisher.publish({ kind: "idleShutdown", pid, observedAt: now() });
+    },
+    binaryTurnover: () => {
+      publisher.publish({ kind: "binaryTurnover", pid, observedAt: now() });
     }
   };
 }
@@ -14784,7 +14811,7 @@ data: ${JSON.stringify(envelope)}
 }
 
 // src/frontdoor/rcSelfHostMint.ts
-var import_node_path29 = __toESM(require("node:path"), 1);
+var import_node_path30 = __toESM(require("node:path"), 1);
 init_account();
 var CREDENTIALS_FILE = ".credentials.json";
 var CLAUDE_JSON2 = ".claude.json";
@@ -14809,7 +14836,7 @@ function readJsonObject(fs12, file) {
   return isRecord11(parsed) ? parsed : void 0;
 }
 function readRcSelfHostRecord(fs12, frontdoorDir) {
-  const parsed = readJsonObject(fs12, import_node_path29.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
+  const parsed = readJsonObject(fs12, import_node_path30.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
   if (parsed === void 0) {
     return void 0;
   }
@@ -14823,11 +14850,11 @@ function mintRcSelfHostCredential(deps) {
   if (!isIdentityName(deps.identity)) {
     throw new Error(`"${deps.identity}" is not a valid identity name.`);
   }
-  const identityDir = import_node_path29.default.join(deps.identitiesDir, deps.identity);
-  const credentialsFile = import_node_path29.default.join(identityDir, CREDENTIALS_FILE);
-  const claudeJsonFile = import_node_path29.default.join(identityDir, CLAUDE_JSON2);
-  const recordDir = import_node_path29.default.join(deps.frontdoorDir, RC_SELF_HOST_RECORD_DIR);
-  const recordFile = import_node_path29.default.join(recordDir, RC_SELF_HOST_RECORD_FILE);
+  const identityDir = import_node_path30.default.join(deps.identitiesDir, deps.identity);
+  const credentialsFile = import_node_path30.default.join(identityDir, CREDENTIALS_FILE);
+  const claudeJsonFile = import_node_path30.default.join(identityDir, CLAUDE_JSON2);
+  const recordDir = import_node_path30.default.join(deps.frontdoorDir, RC_SELF_HOST_RECORD_DIR);
+  const recordFile = import_node_path30.default.join(recordDir, RC_SELF_HOST_RECORD_FILE);
   const previousRecord = readRcSelfHostRecord(deps.fs, deps.frontdoorDir);
   const existingCredentials = readJsonObject(deps.fs, credentialsFile);
   const existingOauth = isRecord11(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
@@ -14843,7 +14870,7 @@ function mintRcSelfHostCredential(deps) {
   const organizationUuid = deps.newUuid();
   const accountUuid = deps.newUuid();
   const mintedAt = new Date(deps.now()).toISOString();
-  deps.fs.mkdirPrivate(import_node_path29.default.dirname(credentialsFile));
+  deps.fs.mkdirPrivate(import_node_path30.default.dirname(credentialsFile));
   deps.fs.writeFilePrivate(credentialsFile, `${JSON.stringify({ ...existingCredentials, claudeAiOauth: { accessToken, refreshToken, expiresAt: null, scopes: [...RC_SELF_HOST_SCOPE_LIST], subscriptionType: SELF_HOST_SUBSCRIPTION_TYPE, rateLimitTier: null } }, null, 2)}
 `);
   const claudeJson = readJsonObject(deps.fs, claudeJsonFile) ?? {};
@@ -15376,5 +15403,6 @@ init_ownCli();
   updateDirectoryRule,
   updateProvider,
   useIdentity,
+  watchedInstallEntry,
   writeDirectoryRules
 });