agent-shim 8.43.0 → 9.0.0

package/dist/cli.cjs

@@ -318,10 +318,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path46) {
-  if (!path46)
+function getElementAtPath(obj, path47) {
+  if (!path47)
     return obj;
-  return path46.reduce((acc, key) => acc?.[key], obj);
+  return path47.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -580,11 +580,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path46, issues) {
+function prefixIssues(path47, issues) {
   return issues.map((iss) => {
     var _a4;
     (_a4 = iss).path ?? (_a4.path = []);
-    iss.path.unshift(path46);
+    iss.path.unshift(path47);
     return iss;
   });
 }
@@ -1105,16 +1105,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path46 = []) => {
+  const processError = (error63, path47 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path46, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path47, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path46, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path47, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path46, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path47, ...issue2.path]);
       } else {
-        const fullpath = [...path46, ...issue2.path];
+        const fullpath = [...path47, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -1153,17 +1153,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error63, path46 = []) => {
+  const processError = (error63, path47 = []) => {
     var _a4;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path46, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path47, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path46, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path47, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path46, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path47, ...issue2.path]);
       } else {
-        const fullpath = [...path46, ...issue2.path];
+        const fullpath = [...path47, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -1202,8 +1202,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path46 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path46) {
+  const path47 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path47) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -19199,13 +19199,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path46 = ref.slice(1).split("/").filter(Boolean);
-  if (path46.length === 0) {
+  const path47 = ref.slice(1).split("/").filter(Boolean);
+  if (path47.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path46[0] === defsKey) {
-    const key = path46[1] === void 0 ? void 0 : decodeJSONPointerSegment(path46[1]);
+  if (path47[0] === defsKey) {
+    const key = path47[1] === void 0 ? void 0 : decodeJSONPointerSegment(path47[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -23712,42 +23712,42 @@ var require_defaults = __commonJS({
 var require_env_paths = __commonJS({
   "node_modules/.pnpm/env-paths@2.2.1/node_modules/env-paths/index.js"(exports2, module2) {
     "use strict";
-    var path46 = require("path");
+    var path47 = require("path");
     var os12 = require("os");
     var homedir = os12.homedir();
     var tmpdir = os12.tmpdir();
     var { env } = process;
     var macos = (name) => {
-      const library = path46.join(homedir, "Library");
+      const library = path47.join(homedir, "Library");
       return {
-        data: path46.join(library, "Application Support", name),
-        config: path46.join(library, "Preferences", name),
-        cache: path46.join(library, "Caches", name),
-        log: path46.join(library, "Logs", name),
-        temp: path46.join(tmpdir, name)
+        data: path47.join(library, "Application Support", name),
+        config: path47.join(library, "Preferences", name),
+        cache: path47.join(library, "Caches", name),
+        log: path47.join(library, "Logs", name),
+        temp: path47.join(tmpdir, name)
       };
     };
     var windows = (name) => {
-      const appData = env.APPDATA || path46.join(homedir, "AppData", "Roaming");
-      const localAppData = env.LOCALAPPDATA || path46.join(homedir, "AppData", "Local");
+      const appData = env.APPDATA || path47.join(homedir, "AppData", "Roaming");
+      const localAppData = env.LOCALAPPDATA || path47.join(homedir, "AppData", "Local");
       return {
         // Data/config/cache/log are invented by me as Windows isn't opinionated about this
-        data: path46.join(localAppData, name, "Data"),
-        config: path46.join(appData, name, "Config"),
-        cache: path46.join(localAppData, name, "Cache"),
-        log: path46.join(localAppData, name, "Log"),
-        temp: path46.join(tmpdir, name)
+        data: path47.join(localAppData, name, "Data"),
+        config: path47.join(appData, name, "Config"),
+        cache: path47.join(localAppData, name, "Cache"),
+        log: path47.join(localAppData, name, "Log"),
+        temp: path47.join(tmpdir, name)
       };
     };
     var linux = (name) => {
-      const username = path46.basename(homedir);
+      const username = path47.basename(homedir);
       return {
-        data: path46.join(env.XDG_DATA_HOME || path46.join(homedir, ".local", "share"), name),
-        config: path46.join(env.XDG_CONFIG_HOME || path46.join(homedir, ".config"), name),
-        cache: path46.join(env.XDG_CACHE_HOME || path46.join(homedir, ".cache"), name),
+        data: path47.join(env.XDG_DATA_HOME || path47.join(homedir, ".local", "share"), name),
+        config: path47.join(env.XDG_CONFIG_HOME || path47.join(homedir, ".config"), name),
+        cache: path47.join(env.XDG_CACHE_HOME || path47.join(homedir, ".cache"), name),
         // https://wiki.debian.org/XDGBaseDirectorySpecification#state
-        log: path46.join(env.XDG_STATE_HOME || path46.join(homedir, ".local", "state"), name),
-        temp: path46.join(tmpdir, username, name)
+        log: path47.join(env.XDG_STATE_HOME || path47.join(homedir, ".local", "state"), name),
+        temp: path47.join(tmpdir, username, name)
       };
     };
     var envPaths = (name, options) => {
@@ -23815,11 +23815,11 @@ var require_util = __commonJS({
       return result;
     }
     exports2.emplace = emplace;
-    function getPropertyByPath(source, path46) {
-      if (typeof path46 === "string" && Object.prototype.hasOwnProperty.call(source, path46)) {
-        return source[path46];
+    function getPropertyByPath(source, path47) {
+      if (typeof path47 === "string" && Object.prototype.hasOwnProperty.call(source, path47)) {
+        return source[path47];
       }
-      const parsedPath = typeof path46 === "string" ? path46.split(".") : path46;
+      const parsedPath = typeof path47 === "string" ? path47.split(".") : path47;
       return parsedPath.reduce((previous, key) => {
         if (previous === void 0) {
           return previous;
@@ -23842,9 +23842,9 @@ var require_util = __commonJS({
       return Object.fromEntries(Object.entries(options).filter(([, value2]) => value2 !== void 0));
     }
     exports2.removeUndefinedValuesFromObject = removeUndefinedValuesFromObject;
-    async function isDirectory(path46) {
+    async function isDirectory(path47) {
       try {
-        const stat = await fs_1.promises.stat(path46);
+        const stat = await fs_1.promises.stat(path47);
         return stat.isDirectory();
       } catch (e14) {
         if (e14.code === "ENOENT") {
@@ -23854,9 +23854,9 @@ var require_util = __commonJS({
       }
     }
     exports2.isDirectory = isDirectory;
-    function isDirectorySync(path46) {
+    function isDirectorySync(path47) {
       try {
-        const stat = fs_1.default.statSync(path46);
+        const stat = fs_1.default.statSync(path47);
         return stat.isDirectory();
       } catch (e14) {
         if (e14.code === "ENOENT") {
@@ -23954,7 +23954,7 @@ var require_ExplorerBase = __commonJS({
           const idx = importStack.indexOf(fullPath);
           if (idx !== -1) {
             throw new Error(`Circular import detected:
-${[...importStack, fullPath].map((path46, i10) => `${i10 + 1}. ${path46}`).join("\n")} (same as ${idx + 1}.)`);
+${[...importStack, fullPath].map((path47, i10) => `${i10 + 1}. ${path47}`).join("\n")} (same as ${idx + 1}.)`);
           }
         }
       }
@@ -24142,9 +24142,9 @@ var require_Explorer = __commonJS({
           throw error62;
         }
       }
-      async #fileExists(path46) {
+      async #fileExists(path47) {
         try {
-          await promises_1.default.stat(path46);
+          await promises_1.default.stat(path47);
           return true;
         } catch (e14) {
           return false;
@@ -24304,9 +24304,9 @@ var require_ExplorerSync = __commonJS({
           throw error62;
         }
       }
-      #fileExists(path46) {
+      #fileExists(path47) {
         try {
-          fs_1.default.statSync(path46);
+          fs_1.default.statSync(path47);
           return true;
         } catch (e14) {
           return false;
@@ -24430,7 +24430,7 @@ var require_dist = __commonJS({
       };
     }
     function getResolvedSearchPlaces(moduleName, toolDefinedSearchPlaces, userConfiguredOptions) {
-      const userConfiguredSearchPlaces = userConfiguredOptions.searchPlaces?.map((path46) => path46.replace("{name}", moduleName));
+      const userConfiguredSearchPlaces = userConfiguredOptions.searchPlaces?.map((path47) => path47.replace("{name}", moduleName));
       if (userConfiguredOptions.mergeSearchPlaces) {
         return [...userConfiguredSearchPlaces ?? [], ...toolDefinedSearchPlaces];
       }
@@ -27054,6 +27054,32 @@ function writeHeadroomState(fs21, stateFile, state) {
   fs21.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
 `);
 }
+function resolveServingHeadroomState(fs21, files, isRunning) {
+  const current = readHeadroomState(fs21, files.stateFile);
+  if (current !== void 0) {
+    return { path: files.stateFile, state: current };
+  }
+  const legacy = readHeadroomState(fs21, files.legacyStateFile);
+  if (legacy?.supervisorPid !== void 0 && isRunning(legacy.supervisorPid)) {
+    return { path: files.legacyStateFile, state: legacy };
+  }
+  return void 0;
+}
+function migrateHeadroomState(fs21, files, isRunning) {
+  const legacy = readHeadroomState(fs21, files.legacyStateFile);
+  const legacyLive = legacy?.supervisorPid !== void 0 && isRunning(legacy.supervisorPid);
+  const current = readHeadroomState(fs21, files.stateFile);
+  if (current !== void 0 || legacyLive) {
+    if (!legacyLive && fs21.readFileUtf8(files.legacyStateFile) !== void 0) {
+      fs21.removeRecursive(files.legacyStateFile);
+    }
+    return;
+  }
+  if (legacy !== void 0) {
+    writeHeadroomState(fs21, files.stateFile, legacy);
+  }
+  fs21.removeRecursive(files.legacyStateFile);
+}
 function headroomAllowlist(providers) {
   const urls = /* @__PURE__ */ new Set([HEADROOM_ANTHROPIC_UPSTREAM]);
   for (const provider of providers) {
@@ -27133,7 +27159,7 @@ function readStartLock(fs21, lockFile) {
     return void 0;
   }
 }
-var import_node_crypto2, import_node_path5, HEADROOM_ANTHROPIC_UPSTREAM, HEADROOM_STATE_SCHEMA_VERSION, HeadroomStateSchema, HeadroomSessionSchema, HeadroomLockSchema;
+var import_node_crypto2, import_node_path5, HEADROOM_ANTHROPIC_UPSTREAM, HeadroomStateSchema, HeadroomSessionSchema, HeadroomLockSchema;
 var init_state = __esm({
   "src/headroom/state.ts"() {
     "use strict";
@@ -27142,7 +27168,6 @@ var init_state = __esm({
     init_zod();
     init_schema();
     HEADROOM_ANTHROPIC_UPSTREAM = "https://api.anthropic.com";
-    HEADROOM_STATE_SCHEMA_VERSION = 2;
     HeadroomStateSchema = external_exports.strictObject({
       /** The supervisor process owning the daemon. Alive means someone is keeping headroom running. */
       supervisorPid: external_exports.number().int().positive().optional(),
@@ -27174,8 +27199,9 @@ function ensureHeadroom(params) {
   const deadline = ports.now() + HEADROOM_START_TIMEOUT_MS;
   let spawnedSupervisor = false;
   let awaitingAllowlist = false;
+  migrateHeadroomState(ports.fs, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, ports.isRunning);
   for (; ; ) {
-    const state = readHeadroomState(ports.fs, paths.headroomStateFile);
+    const state = resolveServingHeadroomState(ports.fs, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, ports.isRunning)?.state;
     if (state?.supervisorPid !== void 0 && ports.isRunning(state.supervisorPid)) {
       const daemonUp = state.socketPath !== void 0 && state.headroomPid !== void 0 && ports.isRunning(state.headroomPid);
       if (daemonUp && state.socketPath !== void 0) {
@@ -27600,7 +27626,8 @@ function compareVersions2(a10, b) {
 async function runSupervisor(initialConfig, ports, options = {}) {
   const { fs: fs21, paths } = ports;
   let config2 = initialConfig;
-  const previousState = readHeadroomState(fs21, paths.headroomStateFile);
+  migrateHeadroomState(fs21, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, ports.isRunning);
+  const previousState = resolveServingHeadroomState(fs21, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, ports.isRunning)?.state;
   if (previousState?.supervisorPid !== void 0 && previousState.supervisorPid !== ports.ownPid && ports.isRunning(previousState.supervisorPid)) {
     ports.log(`agent-shim headroom supervisor ${String(ports.ownPid)}: supervisor ${String(previousState.supervisorPid)} already owns the daemon; exiting`);
     return 0;
@@ -28825,8 +28852,8 @@ var require_utils = __commonJS({
       }
       return output2;
     };
-    exports2.basename = (path46, { windows } = {}) => {
-      const segs = path46.split(windows ? /[\\/]/ : "/");
+    exports2.basename = (path47, { windows } = {}) => {
+      const segs = path47.split(windows ? /[\\/]/ : "/");
       const last = segs[segs.length - 1];
       if (last === "") {
         return segs[segs.length - 2];
@@ -32463,7 +32490,8 @@ function buildLayoutPaths(root) {
     categoriesLocalFile: import_node_path19.default.join(root, "categories.local.json"),
     claudeShimFile: import_node_path19.default.join(root, "claude-shim.json"),
     headroomDir: import_node_path19.default.join(root, "headroom"),
-    headroomStateFile: import_node_path19.default.join(root, "headroom", `state.v${String(HEADROOM_STATE_SCHEMA_VERSION)}.json`),
+    headroomStateFile: import_node_path19.default.join(root, "headroom", "state.json"),
+    headroomLegacyStateFile: import_node_path19.default.join(root, "headroom", "state.v2.json"),
     headroomSocketDir: import_node_path19.default.join(root, "headroom", "run"),
     headroomLockFile: import_node_path19.default.join(root, "headroom", "start.lock"),
     headroomSessionsDir: import_node_path19.default.join(root, "headroom", "sessions"),
@@ -32497,7 +32525,6 @@ var init_paths = __esm({
     import_node_fs7 = __toESM(require("node:fs"), 1);
     import_node_os3 = __toESM(require("node:os"), 1);
     import_node_path19 = __toESM(require("node:path"), 1);
-    init_state();
     init_legacy();
   }
 });
@@ -32852,7 +32879,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "agent-shim",
-      version: "8.43.0",
+      version: "9.0.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -33276,11 +33303,11 @@ function identifyRequest(headers) {
 function directOrigin(port) {
   return `http://127.0.0.1:${String(port)}`;
 }
-function parseProviderPath(path46) {
-  if (!path46.startsWith(PROVIDER_PATH_PREFIX)) {
+function parseProviderPath(path47) {
+  if (!path47.startsWith(PROVIDER_PATH_PREFIX)) {
     return void 0;
   }
-  const tail = path46.slice(PROVIDER_PATH_PREFIX.length);
+  const tail = path47.slice(PROVIDER_PATH_PREFIX.length);
   const slash = tail.indexOf("/");
   if (slash <= 0) {
     return void 0;
@@ -33721,9 +33748,9 @@ function decoderFor(encoding) {
       return void 0;
   }
 }
-function destinationOf(path46) {
-  const scoped = parseProviderPath(path46);
-  return scoped === void 0 ? { provider: ANTHROPIC_PROVIDER, endpoint: path46 } : { provider: scoped.provider, endpoint: scoped.rest };
+function destinationOf(path47) {
+  const scoped = parseProviderPath(path47);
+  return scoped === void 0 ? { provider: ANTHROPIC_PROVIDER, endpoint: path47 } : { provider: scoped.provider, endpoint: scoped.rest };
 }
 function buildRecord(event, context) {
   const { scan } = context;
@@ -36107,14 +36134,14 @@ var require_util2 = __commonJS({
         }
         const port = url2.port != null ? url2.port : url2.protocol === "https:" ? 443 : 80;
         let origin = url2.origin != null ? url2.origin : `${url2.protocol || ""}//${url2.hostname || ""}:${port}`;
-        let path46 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`;
+        let path47 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`;
         if (origin[origin.length - 1] === "/") {
           origin = origin.slice(0, origin.length - 1);
         }
-        if (path46 && path46[0] !== "/") {
-          path46 = `/${path46}`;
+        if (path47 && path47[0] !== "/") {
+          path47 = `/${path47}`;
         }
-        return new URL(`${origin}${path46}`);
+        return new URL(`${origin}${path47}`);
       }
       if (!isHttpOrHttpsPrefixed(url2.origin || url2.protocol)) {
         throw new InvalidArgumentError2("Invalid URL protocol: the URL must start with `http:` or `https:`.");
@@ -36935,9 +36962,9 @@ var require_diagnostics = __commonJS({
         "undici:client:sendHeaders",
         (evt) => {
           const {
-            request: { method, path: path46, origin }
+            request: { method, path: path47, origin }
           } = evt;
-          debugLog("sending request to %s %s%s", method, origin, path46);
+          debugLog("sending request to %s %s%s", method, origin, path47);
         }
       );
     }
@@ -36955,14 +36982,14 @@ var require_diagnostics = __commonJS({
         "undici:request:headers",
         (evt) => {
           const {
-            request: { method, path: path46, origin },
+            request: { method, path: path47, origin },
             response: { statusCode }
           } = evt;
           debugLog(
             "received response to %s %s%s - HTTP %d",
             method,
             origin,
-            path46,
+            path47,
             statusCode
           );
         }
@@ -36971,23 +36998,23 @@ var require_diagnostics = __commonJS({
         "undici:request:trailers",
         (evt) => {
           const {
-            request: { method, path: path46, origin }
+            request: { method, path: path47, origin }
           } = evt;
-          debugLog("trailers received from %s %s%s", method, origin, path46);
+          debugLog("trailers received from %s %s%s", method, origin, path47);
         }
       );
       diagnosticsChannel.subscribe(
         "undici:request:error",
         (evt) => {
           const {
-            request: { method, path: path46, origin },
+            request: { method, path: path47, origin },
             error: error62
           } = evt;
           debugLog(
             "request to %s %s%s errored - %s",
             method,
             origin,
-            path46,
+            path47,
             error62.message
           );
         }
@@ -37102,7 +37129,7 @@ var require_request = __commonJS({
     var kHandler = /* @__PURE__ */ Symbol("handler");
     var Request2 = class {
       constructor(origin, {
-        path: path46,
+        path: path47,
         method,
         body,
         headers,
@@ -37119,11 +37146,11 @@ var require_request = __commonJS({
         maxRedirections,
         typeOfService
       }, handler) {
-        if (typeof path46 !== "string") {
+        if (typeof path47 !== "string") {
           throw new InvalidArgumentError2("path must be a string");
-        } else if (path46[0] !== "/" && !(path46.startsWith("http://") || path46.startsWith("https://")) && method !== "CONNECT") {
+        } else if (path47[0] !== "/" && !(path47.startsWith("http://") || path47.startsWith("https://")) && method !== "CONNECT") {
           throw new InvalidArgumentError2("path must be an absolute URL or start with a slash");
-        } else if (invalidPathRegex.test(path46)) {
+        } else if (invalidPathRegex.test(path47)) {
           throw new InvalidArgumentError2("invalid request path");
         }
         if (typeof method !== "string") {
@@ -37198,7 +37225,7 @@ var require_request = __commonJS({
         this.completed = false;
         this.aborted = false;
         this.upgrade = upgrade || null;
-        this.path = query ? serializePathWithQuery(path46, query) : path46;
+        this.path = query ? serializePathWithQuery(path47, query) : path47;
         this.origin = origin;
         this.protocol = getProtocolFromUrlString(origin);
         this.idempotent = idempotent == null ? method === "HEAD" || method === "GET" : idempotent;
@@ -42380,7 +42407,7 @@ var require_client_h1 = __commonJS({
       return method !== "GET" && method !== "HEAD" && method !== "OPTIONS" && method !== "TRACE" && method !== "CONNECT";
     }
     function writeH1(client, request7) {
-      const { method, path: path46, host, upgrade, blocking, reset } = request7;
+      const { method, path: path47, host, upgrade, blocking, reset } = request7;
       let { body, headers, contentLength } = request7;
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH" || method === "QUERY" || method === "PROPFIND" || method === "PROPPATCH";
       if (util.isFormDataLike(body)) {
@@ -42458,7 +42485,7 @@ var require_client_h1 = __commonJS({
       if (socket.setTypeOfService) {
         socket.setTypeOfService(request7.typeOfService);
       }
-      let header = `${method} ${path46} HTTP/1.1\r
+      let header = `${method} ${path47} HTTP/1.1\r
 `;
       if (typeof host === "string") {
         header += `host: ${host}\r
@@ -43137,7 +43164,7 @@ var require_client_h2 = __commonJS({
       const headersTimeout = request7.headersTimeout ?? client[kHeadersTimeout];
       const bodyTimeout = request7.bodyTimeout ?? client[kBodyTimeout];
       const session = client[kHTTP2Session];
-      const { method, path: path46, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request7;
+      const { method, path: path47, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request7;
       let { body } = request7;
       if (upgrade != null && upgrade !== "websocket") {
         util.errorRequest(client, request7, new InvalidArgumentError2(`Custom upgrade "${upgrade}" not supported over HTTP/2`));
@@ -43206,7 +43233,7 @@ var require_client_h2 = __commonJS({
           }
           headers[HTTP2_HEADER_METHOD] = "CONNECT";
           headers[HTTP2_HEADER_PROTOCOL] = "websocket";
-          headers[HTTP2_HEADER_PATH] = path46;
+          headers[HTTP2_HEADER_PATH] = path47;
           if (protocol === "ws:" || protocol === "wss:") {
             headers[HTTP2_HEADER_SCHEME] = protocol === "ws:" ? "http" : "https";
           } else {
@@ -43248,7 +43275,7 @@ var require_client_h2 = __commonJS({
         stream.setTimeout(headersTimeout);
         return true;
       }
-      headers[HTTP2_HEADER_PATH] = path46;
+      headers[HTTP2_HEADER_PATH] = path47;
       headers[HTTP2_HEADER_SCHEME] = protocol === "http:" ? "http" : "https";
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH";
       if (body && typeof body.read === "function") {
@@ -45600,10 +45627,10 @@ var require_proxy_agent = __commonJS({
         };
         const {
           origin,
-          path: path46 = "/",
+          path: path47 = "/",
           headers = {}
         } = opts;
-        opts.path = origin + path46;
+        opts.path = origin + path47;
         if (!("host" in headers) && !("Host" in headers)) {
           const { host } = new URL(origin);
           headers.host = host;
@@ -47712,20 +47739,20 @@ var require_mock_utils = __commonJS({
       }
       return normalizedQp;
     }
-    function safeUrl(path46) {
-      if (typeof path46 !== "string") {
-        return path46;
+    function safeUrl(path47) {
+      if (typeof path47 !== "string") {
+        return path47;
       }
-      const pathSegments = path46.split("?", 3);
+      const pathSegments = path47.split("?", 3);
       if (pathSegments.length !== 2) {
-        return path46;
+        return path47;
       }
       const qp2 = new URLSearchParams(pathSegments.pop());
       qp2.sort();
       return [...pathSegments, qp2.toString()].join("?");
     }
-    function matchKey(mockDispatch2, { path: path46, method, body, headers }) {
-      const pathMatch = matchValue(mockDispatch2.path, path46);
+    function matchKey(mockDispatch2, { path: path47, method, body, headers }) {
+      const pathMatch = matchValue(mockDispatch2.path, path47);
       const methodMatch = matchValue(mockDispatch2.method, method);
       const bodyMatch = typeof mockDispatch2.body !== "undefined" ? matchValue(mockDispatch2.body, body) : true;
       const headersMatch = matchHeaders(mockDispatch2, headers);
@@ -47750,8 +47777,8 @@ var require_mock_utils = __commonJS({
       const basePath = key.query ? serializePathWithQuery(key.path, key.query) : key.path;
       const resolvedPath = typeof basePath === "string" ? safeUrl(basePath) : basePath;
       const resolvedPathWithoutTrailingSlash = removeTrailingSlash(resolvedPath);
-      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path46, ignoreTrailingSlash }) => {
-        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path46)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path46), resolvedPath);
+      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path47, ignoreTrailingSlash }) => {
+        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path47)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path47), resolvedPath);
       });
       if (matchedMockDispatches.length === 0) {
         throw new MockNotMatchedError(`Mock dispatch not matched for path '${resolvedPath}'`);
@@ -47790,19 +47817,19 @@ var require_mock_utils = __commonJS({
         mockDispatches.splice(index, 1);
       }
     }
-    function removeTrailingSlash(path46) {
-      while (path46.endsWith("/")) {
-        path46 = path46.slice(0, -1);
+    function removeTrailingSlash(path47) {
+      while (path47.endsWith("/")) {
+        path47 = path47.slice(0, -1);
       }
-      if (path46.length === 0) {
-        path46 = "/";
+      if (path47.length === 0) {
+        path47 = "/";
       }
-      return path46;
+      return path47;
     }
     function buildKey(opts) {
-      const { path: path46, method, body, headers, query } = opts;
+      const { path: path47, method, body, headers, query } = opts;
       return {
-        path: path46,
+        path: path47,
         method,
         body,
         headers,
@@ -48492,10 +48519,10 @@ var require_pending_interceptors_formatter = __commonJS({
       }
       format(pendingInterceptors) {
         const withPrettyHeaders = pendingInterceptors.map(
-          ({ method, path: path46, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
+          ({ method, path: path47, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
             Method: method,
             Origin: origin,
-            Path: path46,
+            Path: path47,
             "Status code": statusCode,
             Persistent: persist ? PERSISTENT : NOT_PERSISTENT,
             Invocations: timesInvoked,
@@ -48577,9 +48604,9 @@ var require_mock_agent = __commonJS({
         const acceptNonStandardSearchParameters = this[kMockAgentAcceptsNonStandardSearchParameters];
         const dispatchOpts = { ...opts };
         if (acceptNonStandardSearchParameters && dispatchOpts.path) {
-          const [path46, searchParams] = dispatchOpts.path.split("?");
+          const [path47, searchParams] = dispatchOpts.path.split("?");
           const normalizedSearchParams = normalizeSearchParams(searchParams, acceptNonStandardSearchParameters);
-          dispatchOpts.path = `${path46}?${normalizedSearchParams}`;
+          dispatchOpts.path = `${path47}?${normalizedSearchParams}`;
         }
         return this[kAgent].dispatch(dispatchOpts, handler);
       }
@@ -48980,12 +49007,12 @@ var require_snapshot_recorder = __commonJS({
        * @return {Promise<void>} - Resolves when snapshots are loaded
        */
       async loadSnapshots(filePath) {
-        const path46 = filePath || this.#snapshotPath;
-        if (!path46) {
+        const path47 = filePath || this.#snapshotPath;
+        if (!path47) {
           throw new InvalidArgumentError2("Snapshot path is required");
         }
         try {
-          const data = await readFile(resolve2(path46), "utf8");
+          const data = await readFile(resolve2(path47), "utf8");
           const parsed = JSON.parse(data);
           if (Array.isArray(parsed)) {
             this.#snapshots.clear();
@@ -48999,7 +49026,7 @@ var require_snapshot_recorder = __commonJS({
           if (error62.code === "ENOENT") {
             this.#snapshots.clear();
           } else {
-            throw new UndiciError(`Failed to load snapshots from ${path46}`, { cause: error62 });
+            throw new UndiciError(`Failed to load snapshots from ${path47}`, { cause: error62 });
           }
         }
       }
@@ -49010,11 +49037,11 @@ var require_snapshot_recorder = __commonJS({
        * @returns {Promise<void>} - Resolves when snapshots are saved
        */
       async saveSnapshots(filePath) {
-        const path46 = filePath || this.#snapshotPath;
-        if (!path46) {
+        const path47 = filePath || this.#snapshotPath;
+        if (!path47) {
           throw new InvalidArgumentError2("Snapshot path is required");
         }
-        const resolvedPath = resolve2(path46);
+        const resolvedPath = resolve2(path47);
         await mkdir(dirname3(resolvedPath), { recursive: true });
         const data = Array.from(this.#snapshots.entries()).map(([hash2, snapshot]) => ({
           hash: hash2,
@@ -49646,15 +49673,15 @@ var require_redirect_handler = __commonJS({
           return;
         }
         const { origin, pathname, search } = util.parseURL(new URL(this.location, this.opts.origin && new URL(this.opts.path, this.opts.origin)));
-        const path46 = search ? `${pathname}${search}` : pathname;
-        const redirectUrlString = `${origin}${path46}`;
+        const path47 = search ? `${pathname}${search}` : pathname;
+        const redirectUrlString = `${origin}${path47}`;
         for (const historyUrl of this.history) {
           if (historyUrl.toString() === redirectUrlString) {
             throw new InvalidArgumentError2(`Redirect loop detected. Cannot redirect to ${origin}. This typically happens when using a Client or Pool with cross-origin redirects. Use an Agent for cross-origin redirects.`);
           }
         }
         this.opts.headers = cleanRequestHeaders(this.opts.headers, statusCode === 303, this.opts.origin !== origin);
-        this.opts.path = path46;
+        this.opts.path = path47;
         this.opts.origin = origin;
         this.opts.query = null;
       }
@@ -51414,10 +51441,10 @@ var require_cache_handler = __commonJS({
       }
       return locationUrl.pathname + locationUrl.search;
     }
-    function deleteCachedUri(store, cacheKey, path46) {
+    function deleteCachedUri(store, cacheKey, path47) {
       deleteCachedValue(store, {
         ...cacheKey,
-        path: path46
+        path: path47
       });
       for (let i10 = 0; i10 < util.safeHTTPMethods.length; i10++) {
         const method = util.safeHTTPMethods[i10];
@@ -51425,7 +51452,7 @@ var require_cache_handler = __commonJS({
           deleteCachedValue(store, {
             ...cacheKey,
             method,
-            path: path46
+            path: path47
           });
         }
       }
@@ -51436,9 +51463,9 @@ var require_cache_handler = __commonJS({
       }
       const values = Array.isArray(headerValue2) ? headerValue2 : [headerValue2];
       for (let i10 = 0; i10 < values.length; i10++) {
-        const path46 = getSameOriginPath(cacheKey, values[i10]);
-        if (path46 !== void 0) {
-          deleteCachedUri(store, cacheKey, path46);
+        const path47 = getSameOriginPath(cacheKey, values[i10]);
+        if (path47 !== void 0) {
+          deleteCachedUri(store, cacheKey, path47);
         }
       }
     }
@@ -56438,11 +56465,11 @@ var require_fetch = __commonJS({
       function dispatch({ body }) {
         const url2 = requestCurrentURL(request7);
         const agent = fetchParams.controller.dispatcher;
-        const path46 = url2.pathname + url2.search;
+        const path47 = url2.pathname + url2.search;
         const hasTrailingQuestionMark = url2.search.length === 0 && url2.href[url2.href.length - url2.hash.length - 1] === "?";
         return new Promise((resolve2, reject) => agent.dispatch(
           {
-            path: hasTrailingQuestionMark ? `${path46}?` : path46,
+            path: hasTrailingQuestionMark ? `${path47}?` : path47,
             origin: url2.origin,
             method: request7.method,
             body: agent.isMockActive ? request7.body && (request7.body.source || request7.body.stream) : body,
@@ -57389,9 +57416,9 @@ var require_util5 = __commonJS({
         }
       }
     }
-    function validateCookiePath(path46) {
-      for (let i10 = 0; i10 < path46.length; ++i10) {
-        const code = path46.charCodeAt(i10);
+    function validateCookiePath(path47) {
+      for (let i10 = 0; i10 < path47.length; ++i10) {
+        const code = path47.charCodeAt(i10);
         if (code < 32 || // exclude CTLs (0-31)
         code > 126 || // exclude DEL and non-ascii
         code === 59) {
@@ -60739,11 +60766,11 @@ var require_undici = __commonJS({
           if (typeof opts.path !== "string") {
             throw new InvalidArgumentError2("invalid opts.path");
           }
-          let path46 = opts.path;
+          let path47 = opts.path;
           if (!opts.path.startsWith("/")) {
-            path46 = `/${path46}`;
+            path47 = `/${path47}`;
           }
-          url2 = new URL(util.parseOrigin(url2).origin + path46);
+          url2 = new URL(util.parseOrigin(url2).origin + path47);
         } else {
           if (!opts) {
             opts = typeof url2 === "object" ? url2 : {};
@@ -96322,7 +96349,7 @@ var init_realAnthropicUsageProbe = __esm({
 });
 
 // src/cli.ts
-var import_node_path45 = __toESM(require("node:path"), 1);
+var import_node_path46 = __toESM(require("node:path"), 1);
 
 // node_modules/.pnpm/commander@15.0.0/node_modules/commander/lib/error.js
 var CommanderError = class extends Error {
@@ -99435,9 +99462,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
    * @param {string} [path]
    * @return {(string|null|Command)}
    */
-  executableDir(path46) {
-    if (path46 === void 0) return this._executableDir;
-    this._executableDir = path46;
+  executableDir(path47) {
+    if (path47 === void 0) return this._executableDir;
+    this._executableDir = path47;
     return this;
   }
   /**
@@ -101044,19 +101071,19 @@ function writePools(paths, pools) {
   applyPatch(paths.globalConfigFile, GlobalConfigSchema, { pools }, { defaults: {} });
 }
 function poolCycleOf(pools, name) {
-  const walk = (current, path46) => {
+  const walk = (current, path47) => {
     for (const entry of pools[current]?.identities ?? []) {
       const nested = poolNameOf(poolMemberIdentity(entry));
       if (nested === void 0) {
         continue;
       }
       if (nested === name) {
-        return [...path46, nested];
+        return [...path47, nested];
       }
-      if (path46.includes(nested)) {
+      if (path47.includes(nested)) {
         continue;
       }
-      const found = walk(nested, [...path46, nested]);
+      const found = walk(nested, [...path47, nested]);
       if (found !== void 0) {
         return found;
       }
@@ -103871,7 +103898,7 @@ function registerCodexCommand(program2, deps) {
 
 // src/frontdoor/commands.ts
 var import_node_crypto20 = require("node:crypto");
-var import_node_path41 = __toESM(require("node:path"), 1);
+var import_node_path42 = __toESM(require("node:path"), 1);
 var import_node_fs15 = __toESM(require("node:fs"), 1);
 init_commandDeps();
 init_schema();
@@ -104465,12 +104492,22 @@ init_capability();
 init_route();
 
 // src/frontdoor/supervisor.ts
+var import_node_path37 = __toESM(require("node:path"), 1);
 init_state2();
+function watchedInstallEntry(resolvedOwnExecutablePath, siblingExists) {
+  const parsed = import_node_path37.default.parse(resolvedOwnExecutablePath);
+  if (parsed.name === "agent-shim") {
+    return resolvedOwnExecutablePath;
+  }
+  const sibling = import_node_path37.default.join(parsed.dir, `agent-shim${parsed.ext}`);
+  return siblingExists(sibling) ? sibling : resolvedOwnExecutablePath;
+}
 var FRONTDOOR_SUPERVISOR_STILL_RUNNING = -1;
 var FRONTDOOR_POLL_MS = 1e3;
 var MS_PER_MINUTE2 = 6e4;
 async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {}) {
   const { fs: fs21, paths } = ports;
+  const servingBinary = ports.statOwnExecutable();
   const previous = readFrontDoorState(fs21, paths.frontdoorStateFile);
   let lastPort = previous?.lastPort;
   let lastConnectPort = previous?.lastConnectPort;
@@ -104533,6 +104570,18 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
   ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http8.port)}, CONNECT surface on 127.0.0.1:${String(connect3.port)}`);
   let idleSince;
   let ticks = 0;
+  const binaryReplaced = () => {
+    const current = ports.statOwnExecutable();
+    return current !== void 0 && servingBinary !== void 0 && (current.dev !== servingBinary.dev || current.ino !== servingBinary.ino || current.size !== servingBinary.size || current.mtimeMs !== servingBinary.mtimeMs);
+  };
+  const shutdown = async () => {
+    await direct.close();
+    await connect3.close();
+    await http8.close();
+    ports.closeRcStreamHub();
+    writeFrontDoorState(fs21, paths.frontdoorStateFile, sticky());
+    return 0;
+  };
   for (; ; ) {
     if (options.tickLimit !== void 0 && ticks >= options.tickLimit) {
       return FRONTDOOR_SUPERVISOR_STILL_RUNNING;
@@ -104544,16 +104593,16 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     ports.checkQuotaExpiry();
     const prunedPids = new Set(pruned);
     if (listed.filter((session) => !prunedPids.has(session.pid)).length === 0) {
+      if (ticks > 1 && binaryReplaced()) {
+        ports.log("agent-shim frontdoor supervisor: the installed binary changed and no sessions are live; turning the door over for the next launch");
+        ports.doorHealth.binaryTurnover();
+        return await shutdown();
+      }
       idleSince ??= ports.now();
       if (ports.now() - idleSince >= idleShutdownMinutes * MS_PER_MINUTE2) {
         ports.log(`agent-shim frontdoor supervisor: no sessions for ${String(idleShutdownMinutes)} minute(s); closing the front door and exiting`);
         ports.doorHealth.idleShutdown();
-        await direct.close();
-        await connect3.close();
-        await http8.close();
-        ports.closeRcStreamHub();
-        writeFrontDoorState(fs21, paths.frontdoorStateFile, sticky());
-        return 0;
+        return await shutdown();
       }
     } else {
       idleSince = void 0;
@@ -104605,8 +104654,8 @@ function parseConnectTarget(authority) {
   }
   return { host, port };
 }
-function servedByPipeline(path46) {
-  return path46?.startsWith(ROUTED_PATH_PREFIX) === true;
+function servedByPipeline(path47) {
+  return path47?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
   "connection",
@@ -105125,11 +105174,11 @@ function createRcSessionTracker(deps) {
   };
   const observeExchange = (request7) => {
     const method = (request7.method ?? "").toUpperCase();
-    const path46 = new URL(request7.url ?? "/", "http://127.0.0.1").pathname;
-    if (!path46.startsWith(RC_SESSIONS_PATH_PREFIX)) {
+    const path47 = new URL(request7.url ?? "/", "http://127.0.0.1").pathname;
+    if (!path47.startsWith(RC_SESSIONS_PATH_PREFIX)) {
       return void 0;
     }
-    const tail = path46.slice(RC_SESSIONS_PATH_PREFIX.length);
+    const tail = path47.slice(RC_SESSIONS_PATH_PREFIX.length);
     const facts = {
       oauthAuthorization: oauthAuthorizationOf(request7.headers),
       anthropicVersion: singleHeader(request7.headers, "anthropic-version"),
@@ -105490,8 +105539,8 @@ var RC_READ_FILE_ENCODINGS = ["utf-8", "base64"];
 function isRcReadFileEncoding(value2) {
   return RC_READ_FILE_ENCODINGS.some((encoding) => encoding === value2);
 }
-function buildRcReadFilePayload(requestId, path46, options) {
-  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path46, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
+function buildRcReadFilePayload(requestId, path47, options) {
+  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path47, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
 }
 function buildRcFileSuggestionsPayload(requestId, query) {
   return buildRcControlRequestPayload(requestId, { subtype: "file_suggestions", query });
@@ -105593,15 +105642,15 @@ async function getRcSessionContextUsage(deps, sessionId, detail) {
   const result = await deliverRcClientPayload(deps, sessionId, buildRcGetContextUsagePayload(requestId, detail), `request the context usage of session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
-async function readRcSessionFile(deps, sessionId, path46, options) {
-  if (path46 === "") {
+async function readRcSessionFile(deps, sessionId, path47, options) {
+  if (path47 === "") {
     return { ok: false, message: "a read-file write needs a non-empty path: the SDK's own field names the file the worker resolves against the session's cwd, and an empty string names none" };
   }
   if (options?.maxBytes !== void 0 && (!Number.isInteger(options.maxBytes) || options.maxBytes <= 0)) {
     return { ok: false, message: "a read-file write's max-bytes is a positive whole number of bytes: the SDK's own field caps the read, and a zero or negative cap reads nothing" };
   }
   const requestId = deps.newUuid();
-  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path46, options), `read ${path46} from session ${sessionId}`);
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path47, options), `read ${path47} from session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
 async function suggestRcSessionFiles(deps, sessionId, query) {
@@ -105772,11 +105821,11 @@ function createRcControlHandler(deps) {
       path: "read-file",
       read: (body) => {
         const session = bodyString(body, "session");
-        const path46 = bodyString(body, "path");
+        const path47 = bodyString(body, "path");
         const maxBytes = "maxBytes" in body ? bodyPositiveInteger(body, "maxBytes") : void 0;
         const encoding = "encoding" in body && isRcReadFileEncoding(body.encoding) ? body.encoding : void 0;
-        const refused2 = session === void 0 || path46 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
-        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path46, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
+        const refused2 = session === void 0 || path47 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
+        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path47, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
       }
     },
     {
@@ -106086,9 +106135,9 @@ function requestIdOfBody(body) {
 }
 function frontDoorRcControl(transport, token) {
   const headers = { authorization: `Bearer ${token}` };
-  const listAnswerOf = async (path46, what) => {
+  const listAnswerOf = async (path47, what) => {
     try {
-      return await transport.request({ method: "GET", path: path46, headers });
+      return await transport.request({ method: "GET", path: path47, headers });
     } catch (error62) {
       throw new Error(`${what}: could not reach the front door's control listener: ${error62 instanceof Error ? error62.message : String(error62)}`, { cause: error62 });
     }
@@ -106160,10 +106209,10 @@ function frontDoorRcControl(transport, token) {
     }
     return pending;
   };
-  const writeOf = async (path46, body, describeFailure) => {
+  const writeOf = async (path47, body, describeFailure) => {
     let answer;
     try {
-      answer = await transport.request({ method: "POST", path: path46, headers: { ...headers, "content-type": "application/json" }, body });
+      answer = await transport.request({ method: "POST", path: path47, headers: { ...headers, "content-type": "application/json" }, body });
     } catch (error62) {
       return { ok: false, message: `could not reach the front door's control listener: ${error62 instanceof Error ? error62.message : String(error62)}` };
     }
@@ -106194,10 +106243,10 @@ function frontDoorRcControl(transport, token) {
     endSession: async (sessionId, reason) => await writeOf(`${CONTROL_PATH_PREFIX}/end-session`, JSON.stringify({ session: sessionId, ...reason === void 0 ? {} : { reason } }), (status, message) => `ending ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getUsage: async (sessionId, skipBehaviors) => await writeOf(`${CONTROL_PATH_PREFIX}/get-usage`, JSON.stringify({ session: sessionId, ...skipBehaviors === void 0 ? {} : { skipBehaviors } }), (status, message) => `requesting the usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getContextUsage: async (sessionId, detail) => await writeOf(`${CONTROL_PATH_PREFIX}/get-context-usage`, JSON.stringify({ session: sessionId, ...detail === void 0 ? {} : { detail } }), (status, message) => `requesting the context usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
-    readFile: async (sessionId, path46, options) => await writeOf(
+    readFile: async (sessionId, path47, options) => await writeOf(
       `${CONTROL_PATH_PREFIX}/read-file`,
-      JSON.stringify({ session: sessionId, path: path46, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
-      (status, message) => `reading ${path46} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
+      JSON.stringify({ session: sessionId, path: path47, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
+      (status, message) => `reading ${path47} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
     ),
     fileSuggestions: async (sessionId, query) => await writeOf(`${CONTROL_PATH_PREFIX}/file-suggestions`, JSON.stringify({ session: sessionId, query }), (status, message) => `requesting file suggestions from ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     keepAlive: async (sessionId) => await writeOf(`${CONTROL_PATH_PREFIX}/keep-alive`, JSON.stringify({ session: sessionId }), (status, message) => `keeping ${sessionId} alive failed (HTTP ${String(status)}): ${message}`),
@@ -106487,12 +106536,12 @@ function tlsFacts(options) {
 }
 function realRcEventDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const post = async (path46, headers, body) => await new Promise((resolve2, reject) => {
+  const post = async (path47, headers, body) => await new Promise((resolve2, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method: "POST",
-      path: path46,
+      path: path47,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, "content-length": String(Buffer.byteLength(body, "utf8")) },
       agent
@@ -106557,12 +106606,12 @@ function lateRcStreamDial(resolve2) {
 }
 function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const request7 = async (method, path46, headers, body, signal) => await new Promise((resolve2, reject) => {
+  const request7 = async (method, path47, headers, body, signal) => await new Promise((resolve2, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method,
-      path: path46,
+      path: path47,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, ...body === void 0 ? {} : { "content-length": String(Buffer.byteLength(body, "utf8")) } },
       agent,
@@ -106604,9 +106653,9 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
       return { status, body: await readAll(response) };
     },
     openStream: async (sessionId, headers, resume, signal) => {
-      const path46 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
+      const path47 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
       const streamHeaders = resume === void 0 ? headers : { ...headers, "last-event-id": String(resume.fromSequenceNum) };
-      const { status, response } = await request7("GET", path46, streamHeaders, void 0, signal);
+      const { status, response } = await request7("GET", path47, streamHeaders, void 0, signal);
       if (!isSuccessful2(status)) {
         await readAll(response);
         return { status, chunks: NO_CHUNKS };
@@ -106822,7 +106871,7 @@ init_claudeShim();
 init_store();
 init_realPorts();
 var import_node_fs14 = __toESM(require("node:fs"), 1);
-var import_node_path37 = __toESM(require("node:path"), 1);
+var import_node_path38 = __toESM(require("node:path"), 1);
 init_load();
 init_schema();
 init_credential();
@@ -106875,8 +106924,18 @@ function validateJson(schema, input2) {
   }
   return { ok: true, data: result.data };
 }
+function tcpPortEraRecord(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return false;
+  }
+  const has = (key) => typeof parsed === "object" && parsed !== null && key in parsed;
+  return (has("port") || has("lastPort")) && !has("socketPath");
+}
 function pushPathResolution(push, resolution) {
-  const ownDir = import_node_path37.default.dirname(resolution.ownExecutablePath);
+  const ownDir = import_node_path38.default.dirname(resolution.ownExecutablePath);
   switch (resolution.agentShim.status) {
     case "ok":
       push("path-resolution", "pass", `\`agent-shim\` on PATH resolves to this running executable, ${resolution.ownExecutablePath}.`, "agent-shim");
@@ -106975,14 +107034,14 @@ function pushProvider(push, entry, cacheEnv, signIn) {
 }
 function pushLegacyName(push, params) {
   const legacyVariables = Object.keys(params.env).filter((name) => name.startsWith(LEGACY_ENV_PREFIX) && params.env[name] !== void 0).sort();
-  if (legacyVariables.length === 0 && import_node_path37.default.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
+  if (legacyVariables.length === 0 && import_node_path38.default.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
     push("legacy-name", "pass", "Nothing here still uses the former `claude-use` name.");
     return;
   }
   for (const name of legacyVariables) {
     push("legacy-name", "warn", `${name} is the former name of ${name.replace(LEGACY_ENV_PREFIX, ENV_PREFIX)}. Rename it; the old name still works but is only a fallback.`, name);
   }
-  if (import_node_path37.default.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
+  if (import_node_path38.default.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
     push(
       "legacy-name",
       "warn",
@@ -107184,6 +107243,8 @@ function runDoctor(params) {
   }
   if (params.headroom.state.raw === void 0) {
     push("headroom", "pass", "No headroom daemon has ever run; nothing to check.");
+  } else if (tcpPortEraRecord(params.headroom.state.raw)) {
+    push("headroom", "pass", `${params.headroom.state.path} holds a previous release's TCP-port state record; the next launch through headroom claims over it.`);
   } else {
     const validated2 = validateJson(HeadroomStateSchema, params.headroom.state);
     if (!validated2.ok) {
@@ -107322,18 +107383,18 @@ function collectDoctorReport(params) {
   const { paths } = params;
   const identityNames = import_node_fs14.default.existsSync(paths.identitiesDir) ? import_node_fs14.default.readdirSync(paths.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && isIdentityDirectoryName(entry.name)).map((entry) => entry.name).sort() : [];
   const identities = identityNames.map((name) => {
-    const farmRoot = import_node_path37.default.join(paths.identitiesDir, name);
-    const identityPath = import_node_path37.default.join(farmRoot, "identity.json");
+    const farmRoot = import_node_path38.default.join(paths.identitiesDir, name);
+    const identityPath = import_node_path38.default.join(farmRoot, "identity.json");
     return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot };
   });
   const profileNames = import_node_fs14.default.existsSync(paths.configProfilesDir) ? import_node_fs14.default.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const configProfiles = profileNames.map((name) => {
-    const profilePath = import_node_path37.default.join(paths.configProfilesDir, `${name}.json`);
+    const profilePath = import_node_path38.default.join(paths.configProfilesDir, `${name}.json`);
     return { name, path: profilePath, raw: realFsPort.readFileUtf8(profilePath) };
   });
   const providerNames = import_node_fs14.default.existsSync(paths.providersDir) ? import_node_fs14.default.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const providers = providerNames.map((name) => {
-    const providerPath = import_node_path37.default.join(paths.providersDir, `${name}.json`);
+    const providerPath = import_node_path38.default.join(paths.providersDir, `${name}.json`);
     return { name, path: providerPath, raw: realFsPort.readFileUtf8(providerPath) };
   });
   const ownExecutablePath = realOwnExecutablePath();
@@ -107345,12 +107406,12 @@ function collectDoctorReport(params) {
     binaryDiscovery = { ok: false, message: error62 instanceof Error ? error62.message : String(error62) };
   }
   const shimState = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-  const pathDirs = (params.env.PATH ?? "").split(import_node_path37.default.delimiter).filter((dir) => dir !== "");
+  const pathDirs = (params.env.PATH ?? "").split(import_node_path38.default.delimiter).filter((dir) => dir !== "");
   const claudeShimShadow = shimState === void 0 ? void 0 : refinePathShadow(
     findPathShadow({
       pathDirs,
-      targetDir: import_node_path37.default.dirname(shimState.targetPath),
-      targetFilename: import_node_path37.default.basename(shimState.targetPath),
+      targetDir: import_node_path38.default.dirname(shimState.targetPath),
+      targetFilename: import_node_path38.default.basename(shimState.targetPath),
       findExecutableInDir
     }),
     shimState.targetPath,
@@ -107376,7 +107437,7 @@ function collectDoctorReport(params) {
       agentShim: refinePathShadow(
         findPathShadow({
           pathDirs,
-          targetDir: import_node_path37.default.dirname(ownExecutablePath),
+          targetDir: import_node_path38.default.dirname(ownExecutablePath),
           targetFilename: commandFilename(ownExecutablePath, "agent-shim"),
           findExecutableInDir
         }),
@@ -107388,7 +107449,12 @@ function collectDoctorReport(params) {
     run: realRunPort,
     platform: process.platform,
     headroom: {
-      state: { path: paths.headroomStateFile, raw: realFsPort.readFileUtf8(paths.headroomStateFile) },
+      // Read-only resolution like `headroom status`: the doctor reports whichever record a launch would join, migrating nothing.
+      state: (() => {
+        const resolved = resolveServingHeadroomState(realFarmFs, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, realIsProcessRunning);
+        const statePath = resolved?.path ?? paths.headroomStateFile;
+        return { path: statePath, raw: realFarmFs.readFileUtf8(statePath) };
+      })(),
       isRunning: realIsProcessRunning
     }
   });
@@ -108341,9 +108407,9 @@ function resolveFriendlyClientOptions(options) {
   };
 }
 function createORPCClient(link, options = {}) {
-  const path46 = options.path ?? [];
+  const path47 = options.path ?? [];
   const procedureClient = async (...[input2, options2 = {}]) => {
-    return await link.call(path46, input2, resolveFriendlyClientOptions(options2));
+    return await link.call(path47, input2, resolveFriendlyClientOptions(options2));
   };
   const recursive2 = new Proxy(procedureClient, {
     get(target, key) {
@@ -108352,7 +108418,7 @@ function createORPCClient(link, options = {}) {
       }
       return createORPCClient(link, {
         ...options,
-        path: [...path46, key]
+        path: [...path47, key]
       });
     }
   });
@@ -108549,7 +108615,7 @@ init_middleware();
 init_preflight();
 
 // src/frontdoor/controlSchemas.ts
-var import_node_path38 = __toESM(require("node:path"), 1);
+var import_node_path39 = __toESM(require("node:path"), 1);
 init_zod();
 init_schema2();
 
@@ -108761,11 +108827,11 @@ var FrontDoorSessionsOutputSchema = external_exports.strictObject({ sessions: ex
 var CheckRunInputSchema = external_exports.strictObject({
   path: external_exports.string().min(1),
   identity: external_exports.string().min(1).optional()
-}).refine((input2) => import_node_path38.default.isAbsolute(input2.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+}).refine((input2) => import_node_path39.default.isAbsolute(input2.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
 var PoolPickInputSchema = external_exports.strictObject({
   pool: external_exports.string().min(1),
   path: external_exports.string().min(1)
-}).refine((input2) => import_node_path38.default.isAbsolute(input2.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+}).refine((input2) => import_node_path39.default.isAbsolute(input2.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
 var DoctorFindingSchema = external_exports.strictObject({
   section: external_exports.enum(DOCTOR_SECTIONS),
   subject: external_exports.string().optional(),
@@ -109123,19 +109189,19 @@ var StandardLink = class {
   }
   interceptors;
   clientInterceptors;
-  call(path46, input2, options) {
+  call(path47, input2, options) {
     return runWithSpan(
-      { name: `${ORPC_NAME}.${path46.join("/")}`, signal: options.signal },
+      { name: `${ORPC_NAME}.${path47.join("/")}`, signal: options.signal },
       (span) => {
         span?.setAttribute("rpc.system", ORPC_NAME);
-        span?.setAttribute("rpc.method", path46.join("."));
+        span?.setAttribute("rpc.method", path47.join("."));
         if (isAsyncIteratorObject(input2)) {
           input2 = asyncIteratorWithSpan(
             { name: "consume_event_iterator_input", signal: options.signal },
             input2
           );
         }
-        return intercept(this.interceptors, { ...options, path: path46, input: input2 }, async ({ path: path210, input: input22, ...options2 }) => {
+        return intercept(this.interceptors, { ...options, path: path47, input: input2 }, async ({ path: path210, input: input22, ...options2 }) => {
           const otelConfig = getGlobalOtelConfig();
           let otelContext;
           const currentSpan = otelConfig?.trace.getActiveSpan() ?? span;
@@ -109370,8 +109436,8 @@ var StandardRPCJsonSerializer = class {
     return ref.data;
   }
 };
-function toHttpPath(path46) {
-  return `/${path46.map(encodeURIComponent).join("/")}`;
+function toHttpPath(path47) {
+  return `/${path47.map(encodeURIComponent).join("/")}`;
 }
 function toStandardHeaders2(headers) {
   if (typeof headers.forEach === "function") {
@@ -109396,18 +109462,18 @@ var StandardRPCLinkCodec = class {
   fallbackMethod;
   expectedMethod;
   headers;
-  async encode(path46, input2, options) {
-    let headers = toStandardHeaders2(await value(this.headers, options, path46, input2));
+  async encode(path47, input2, options) {
+    let headers = toStandardHeaders2(await value(this.headers, options, path47, input2));
     if (options.lastEventId !== void 0) {
       headers = mergeStandardHeaders(headers, { "last-event-id": options.lastEventId });
     }
-    const expectedMethod = await value(this.expectedMethod, options, path46, input2);
-    const baseUrl = await value(this.baseUrl, options, path46, input2);
+    const expectedMethod = await value(this.expectedMethod, options, path47, input2);
+    const baseUrl = await value(this.baseUrl, options, path47, input2);
     const url2 = new URL(baseUrl);
-    url2.pathname = `${url2.pathname.replace(/\/$/, "")}${toHttpPath(path46)}`;
+    url2.pathname = `${url2.pathname.replace(/\/$/, "")}${toHttpPath(path47)}`;
     const serialized = this.serializer.serialize(input2);
     if (expectedMethod === "GET" && !(serialized instanceof FormData) && !isAsyncIteratorObject(serialized)) {
-      const maxUrlLength = await value(this.maxUrlLength, options, path46, input2);
+      const maxUrlLength = await value(this.maxUrlLength, options, path47, input2);
       const getUrl = new URL(url2);
       getUrl.searchParams.append("data", stringifyJSON(serialized));
       if (getUrl.toString().length <= maxUrlLength) {
@@ -109881,7 +109947,7 @@ function middlewareOutputFn(output2) {
 function createProcedureClient(lazyableProcedure, ...rest) {
   const options = resolveMaybeOptionalOptions(rest);
   return async (...[input2, callerOptions]) => {
-    const path46 = toArray(options.path);
+    const path47 = toArray(options.path);
     const { default: procedure } = await unlazy(lazyableProcedure);
     const clientContext = callerOptions?.context ?? {};
     const context = await value(options.context ?? {}, clientContext);
@@ -109896,7 +109962,7 @@ function createProcedureClient(lazyableProcedure, ...rest) {
       const output2 = await runWithSpan(
         { name: "call_procedure", signal: callerOptions?.signal },
         (span) => {
-          span?.setAttribute("procedure.path", [...path46]);
+          span?.setAttribute("procedure.path", [...path47]);
           return intercept(
             toArray(options.interceptors),
             {
@@ -109904,7 +109970,7 @@ function createProcedureClient(lazyableProcedure, ...rest) {
               input: input2,
               // input only optional when it undefinable so we can safely cast it
               errors,
-              path: path46,
+              path: path47,
               procedure,
               signal: callerOptions?.signal,
               lastEventId: callerOptions?.lastEventId
@@ -110026,10 +110092,10 @@ var HIDDEN_ROUTER_CONTRACT_SYMBOL = /* @__PURE__ */ Symbol("ORPC_HIDDEN_ROUTER_C
 function getHiddenRouterContract(router) {
   return router[HIDDEN_ROUTER_CONTRACT_SYMBOL];
 }
-function getRouter(router, path46) {
+function getRouter(router, path47) {
   let current = router;
-  for (let i10 = 0; i10 < path46.length; i10++) {
-    const segment = path46[i10];
+  for (let i10 = 0; i10 < path47.length; i10++) {
+    const segment = path47[i10];
     if (!current) {
       return void 0;
     }
@@ -110044,7 +110110,7 @@ function getRouter(router, path46) {
       continue;
     }
     const lazied = current;
-    const rest = path46.slice(i10);
+    const rest = path47.slice(i10);
     return lazy2(async () => {
       const unwrapped = await unlazy(lazied);
       const next = getRouter(unwrapped.default, rest);
@@ -110521,11 +110587,11 @@ var LinkFetchClient = class {
     this.toFetchRequestOptions = options;
     this.adapterInterceptors = toArray(options.adapterInterceptors);
   }
-  async call(standardRequest, options, path46, input2) {
+  async call(standardRequest, options, path47, input2) {
     const request7 = toFetchRequest(standardRequest, this.toFetchRequestOptions);
     const fetchResponse = await intercept(
       this.adapterInterceptors,
-      { ...options, request: request7, path: path46, input: input2, init: { redirect: "manual" } },
+      { ...options, request: request7, path: path47, input: input2, init: { redirect: "manual" } },
       ({ request: request22, path: path210, input: input22, init, ...options2 }) => this.fetch(request22, init, options2, path210, input22)
     );
     const lazyResponse = toStandardLazyResponse(fetchResponse, { signal: request7.signal });
@@ -110565,8 +110631,8 @@ var StandardBracketNotationSerializer = class {
     }
     const arrayPushStyles = /* @__PURE__ */ new WeakSet();
     const ref = { value: [] };
-    for (const [path46, value2] of serialized) {
-      const segments = this.parsePath(path46);
+    for (const [path47, value2] of serialized) {
+      const segments = this.parsePath(path47);
       let currentRef = ref;
       let nextSegment = "value";
       segments.forEach((segment, i10) => {
@@ -110638,14 +110704,14 @@ var StandardBracketNotationSerializer = class {
       return `${result}[${segment}]`;
     }, "");
   }
-  parsePath(path46) {
+  parsePath(path47) {
     const segments = [];
     let inBrackets = false;
     let currentSegment = "";
     let backslashCount = 0;
-    for (let i10 = 0; i10 < path46.length; i10++) {
-      const char = path46[i10];
-      const nextChar = path46[i10 + 1];
+    for (let i10 = 0; i10 < path47.length; i10++) {
+      const char = path47[i10];
+      const nextChar = path47[i10 + 1];
       if (inBrackets && char === "]" && (nextChar === void 0 || nextChar === "[") && backslashCount % 2 === 0) {
         if (nextChar === void 0) {
           inBrackets = false;
@@ -110664,7 +110730,7 @@ var StandardBracketNotationSerializer = class {
         backslashCount = 0;
       }
     }
-    return inBrackets || segments.length === 0 ? [path46] : segments;
+    return inBrackets || segments.length === 0 ? [path47] : segments;
   }
 };
 function isValidArrayIndex(value2, maxIndex) {
@@ -110732,11 +110798,11 @@ var StandardOpenAPIJsonSerializer = class {
     return [data, hasBlobRef.value];
   }
 };
-function standardizeHTTPPath(path46) {
-  return `/${path46.replace(/\/{2,}/g, "/").replace(/^\/|\/$/g, "")}`;
+function standardizeHTTPPath(path47) {
+  return `/${path47.replace(/\/{2,}/g, "/").replace(/^\/|\/$/g, "")}`;
 }
-function getDynamicParams(path46) {
-  return path46 ? standardizeHTTPPath(path46).match(/\/\{[^}]+\}/g)?.map((v) => ({
+function getDynamicParams(path47) {
+  return path47 ? standardizeHTTPPath(path47).match(/\/\{[^}]+\}/g)?.map((v) => ({
     raw: v,
     name: v.match(/\{\+?([^}]+)\}/)[1]
   })) : void 0;
@@ -110767,9 +110833,9 @@ var StandardOpenAPISerializer = class {
     }
     if (options.outputFormat === "URLSearchParams") {
       const params = new URLSearchParams();
-      for (const [path46, value2] of this.bracketNotation.serialize(json2)) {
+      for (const [path47, value2] of this.bracketNotation.serialize(json2)) {
         if (typeof value2 === "string" || typeof value2 === "number" || typeof value2 === "boolean") {
-          params.append(path46, value2.toString());
+          params.append(path47, value2.toString());
         }
       }
       return params;
@@ -110778,11 +110844,11 @@ var StandardOpenAPISerializer = class {
       return json2;
     }
     const form = new FormData();
-    for (const [path46, value2] of this.bracketNotation.serialize(json2)) {
+    for (const [path47, value2] of this.bracketNotation.serialize(json2)) {
       if (typeof value2 === "string" || typeof value2 === "number" || typeof value2 === "boolean") {
-        form.append(path46, value2.toString());
+        form.append(path47, value2.toString());
       } else if (value2 instanceof Blob) {
-        form.append(path46, value2);
+        form.append(path47, value2);
       }
     }
     return form;
@@ -111097,8 +111163,8 @@ function isPrimitiveSchema(schema) {
     return false;
   });
 }
-function toOpenAPIPath(path46) {
-  return standardizeHTTPPath(path46).replace(/\/\{\+([^}]+)\}/g, "/{$1}");
+function toOpenAPIPath(path47) {
+  return standardizeHTTPPath(path47).replace(/\/\{\+([^}]+)\}/g, "/{$1}");
 }
 function toOpenAPIMethod(method) {
   return method.toLocaleLowerCase();
@@ -111345,8 +111411,8 @@ var OpenAPIGenerator = class {
    * @see {@link https://orpc.dev/docs/openapi/openapi-specification OpenAPI Specification Docs}
    */
   async generate(router, { customErrorResponseBodySchema, commonSchemas, filter: baseFilter, exclude, ...baseDoc } = {}) {
-    const filter = baseFilter ?? (({ contract, path: path46 }) => {
-      return !(exclude?.(contract, path46) ?? false);
+    const filter = baseFilter ?? (({ contract, path: path47 }) => {
+      return !(exclude?.(contract, path47) ?? false);
     });
     const doc = {
       ...clone2(baseDoc),
@@ -111362,12 +111428,12 @@ var OpenAPIGenerator = class {
       contracts.push(traverseOptions);
     });
     const errors = [];
-    for (const { contract, path: path46 } of contracts) {
-      const stringPath = path46.join(".");
+    for (const { contract, path: path47 } of contracts) {
+      const stringPath = path47.join(".");
       try {
         const def = contract["~orpc"];
         const method = toOpenAPIMethod(fallbackContractConfig("defaultMethod", def.route.method));
-        const httpPath = toOpenAPIPath(def.route.path ?? toHttpPath(path46));
+        const httpPath = toOpenAPIPath(def.route.path ?? toHttpPath(path47));
         let operationObjectRef;
         if (def.route.spec !== void 0 && typeof def.route.spec !== "function") {
           operationObjectRef = def.route.spec;
@@ -111839,8 +111905,8 @@ function toAbortSignal(stream) {
 function toStandardUrl(req) {
   const protocol = "encrypted" in req.socket && req.socket.encrypted ? "https:" : "http:";
   const origin = guard(() => new URL(`${protocol}//${req.headers.host ?? "localhost"}`).origin) ?? `${protocol}//localhost`;
-  const path46 = req.originalUrl ?? req.url ?? "/";
-  return new URL(`${origin}${path46.startsWith("/") ? "" : "/"}${path46}`);
+  const path47 = req.originalUrl ?? req.url ?? "/";
+  return new URL(`${origin}${path47.startsWith("/") ? "" : "/"}${path47}`);
 }
 function toStandardLazyRequest(req, res) {
   const signal = toAbortSignal(res);
@@ -112039,8 +112105,8 @@ var StandardRPCMatcher = class {
   constructor(options = {}) {
     this.filter = options.filter ?? true;
   }
-  init(router, path46 = []) {
-    const laziedOptions = traverseContractProcedures({ router, path: path46 }, (traverseOptions) => {
+  init(router, path47 = []) {
+    const laziedOptions = traverseContractProcedures({ router, path: path47 }, (traverseOptions) => {
       if (!value(this.filter, traverseOptions)) {
         return;
       }
@@ -112246,8 +112312,8 @@ function createRouter() {
     static: new NullProtoObj2()
   };
 }
-function splitPath(path46) {
-  const [_, ...s] = path46.split("/");
+function splitPath(path47) {
+  const [_, ...s] = path47.split("/");
   return s[s.length - 1] === "" ? s.slice(0, -1) : s;
 }
 function getMatchParams(segments, paramsMap) {
@@ -112262,11 +112328,11 @@ function getMatchParams(segments, paramsMap) {
   }
   return params;
 }
-function addRoute(ctx, method = "", path46, data) {
+function addRoute(ctx, method = "", path47, data) {
   method = method.toUpperCase();
-  if (path46.charCodeAt(0) !== 47) path46 = `/${path46}`;
-  path46 = path46.replace(/\\:/g, "%3A");
-  const segments = splitPath(path46);
+  if (path47.charCodeAt(0) !== 47) path47 = `/${path47}`;
+  path47 = path47.replace(/\\:/g, "%3A");
+  const segments = splitPath(path47);
   let node2 = ctx.root;
   let _unnamedParamIndex = 0;
   const paramsMap = [];
@@ -112332,14 +112398,14 @@ function getParamRegexp(segment) {
   const regex = segment.replace(/:(\w+)/g, (_, id2) => `(?<${id2}>[^/]+)`).replace(/\./g, "\\.");
   return /* @__PURE__ */ new RegExp(`^${regex}$`);
 }
-function findRoute(ctx, method = "", path46, opts) {
-  if (path46.charCodeAt(path46.length - 1) === 47) path46 = path46.slice(0, -1);
-  const staticNode = ctx.static[path46];
+function findRoute(ctx, method = "", path47, opts) {
+  if (path47.charCodeAt(path47.length - 1) === 47) path47 = path47.slice(0, -1);
+  const staticNode = ctx.static[path47];
   if (staticNode && staticNode.methods) {
     const staticMatch = staticNode.methods[method] || staticNode.methods[""];
     if (staticMatch !== void 0) return staticMatch[0];
   }
-  const segments = splitPath(path46);
+  const segments = splitPath(path47);
   const match = _lookupTree(ctx, ctx.root, method, segments, 0)?.[0];
   if (match === void 0) return;
   if (opts?.params === false) return match;
@@ -112494,8 +112560,8 @@ var StandardOpenAPICodec = class {
     return true;
   }
 };
-function toRou3Pattern(path46) {
-  return standardizeHTTPPath(path46).replace(/\/\{\+([^}]+)\}/g, "/**:$1").replace(/\/\{([^}]+)\}/g, "/:$1");
+function toRou3Pattern(path47) {
+  return standardizeHTTPPath(path47).replace(/\/\{\+([^}]+)\}/g, "/**:$1").replace(/\/\{([^}]+)\}/g, "/:$1");
 }
 function decodeParams(params) {
   return Object.fromEntries(Object.entries(params).map(([key, value2]) => [key, tryDecodeURIComponent(value2)]));
@@ -112507,8 +112573,8 @@ var StandardOpenAPIMatcher = class {
   constructor(options = {}) {
     this.filter = options.filter ?? true;
   }
-  init(router, path46 = []) {
-    const laziedOptions = traverseContractProcedures({ router, path: path46 }, (traverseOptions) => {
+  init(router, path47 = []) {
+    const laziedOptions = traverseContractProcedures({ router, path: path47 }, (traverseOptions) => {
       if (!value(this.filter, traverseOptions)) {
         return;
       }
@@ -112790,6 +112856,7 @@ var LaunchLifecycleEventSchema = external_exports.strictObject({
 var DoorHealthEventSchema = external_exports.discriminatedUnion("kind", [
   external_exports.strictObject({ kind: external_exports.literal("generation"), pid: external_exports.number().int().positive(), providerPort: external_exports.number().int().positive(), connectPort: external_exports.number().int().positive(), directPort: external_exports.number().int().positive(), observedAt: external_exports.number() }),
   external_exports.strictObject({ kind: external_exports.literal("listenerFailed"), pid: external_exports.number().int().positive(), listener: external_exports.enum(["provider", "connect", "direct"]), message: external_exports.string(), observedAt: external_exports.number() }),
+  external_exports.strictObject({ kind: external_exports.literal("binaryTurnover"), pid: external_exports.number().int().positive(), observedAt: external_exports.number() }),
   external_exports.strictObject({ kind: external_exports.literal("idleShutdown"), pid: external_exports.number().int().positive(), observedAt: external_exports.number() })
 ]);
 var QuotaExpiringEventSchema = external_exports.strictObject({
@@ -112923,6 +112990,9 @@ function createDoorHealthPublisher(hub, now, pid) {
     },
     idleShutdown: () => {
       publisher.publish({ kind: "idleShutdown", pid, observedAt: now() });
+    },
+    binaryTurnover: () => {
+      publisher.publish({ kind: "binaryTurnover", pid, observedAt: now() });
     }
   };
 }
@@ -114231,8 +114301,8 @@ function createCodexRouteMount(ports, upstreamBase, provider) {
         request7.body.resume();
         return;
       }
-      const path46 = new URL(request7.url, "http://127.0.0.1").pathname;
-      const translated = { method: request7.method, path: path46, body, signal: request7.signal };
+      const path47 = new URL(request7.url, "http://127.0.0.1").pathname;
+      const translated = { method: request7.method, path: path47, body, signal: request7.signal };
       const routed = await route(translated);
       if (request7.signal.aborted) {
         return;
@@ -114266,7 +114336,7 @@ function createPassthroughRoute(name, target) {
     headroomUpstream: target.headroomUpstream,
     serve: async (request7, response) => {
       const incoming = new URL(request7.url, "http://127.0.0.1");
-      const path46 = target.stripPrefix !== void 0 && incoming.pathname.startsWith(target.stripPrefix) ? incoming.pathname.slice(target.stripPrefix.length) : incoming.pathname;
+      const path47 = target.stripPrefix !== void 0 && incoming.pathname.startsWith(target.stripPrefix) ? incoming.pathname.slice(target.stripPrefix.length) : incoming.pathname;
       const headers = forwardableHeaders(request7.headers);
       delete headers.host;
       await new Promise((resolve2) => {
@@ -114274,7 +114344,7 @@ function createPassthroughRoute(name, target) {
           host: base.hostname,
           port: base.port === "" ? void 0 : Number(base.port),
           method: request7.method,
-          path: `${basePath}${path46}${incoming.search}`,
+          path: `${basePath}${path47}${incoming.search}`,
           headers,
           agent
         };
@@ -114407,7 +114477,7 @@ async function scanRequestHead(request7, wholeBody = false) {
 // src/frontdoor/providerRoute.ts
 var MS_PER_HOUR3 = 36e5;
 function createProviderRouteResolver(deps) {
-  const isRcSelfHostPath = (path46) => path46 === "/v1/code/sessions" || path46.startsWith("/v1/code/sessions/") || path46 === "/v1/sessions" || path46.startsWith("/v1/sessions/");
+  const isRcSelfHostPath = (path47) => path47 === "/v1/code/sessions" || path47.startsWith("/v1/code/sessions/") || path47 === "/v1/sessions" || path47.startsWith("/v1/sessions/");
   const oauthRoute = createPassthroughRoute("anthropic", { baseUrl: `https://${CONNECT_INTERCEPT_HOST}:${String(HTTPS_PORT)}`, stripPrefix: void 0, headroomUpstream: void 0 });
   const passthroughByTarget = /* @__PURE__ */ new Map();
   const passthroughFor = (name, target) => {
@@ -114421,16 +114491,16 @@ function createProviderRouteResolver(deps) {
     return route;
   };
   const resolve2 = (request7) => {
-    const path46 = new URL(request7.url, "http://127.0.0.1").pathname;
-    const scoped = parseProviderPath(path46);
+    const path47 = new URL(request7.url, "http://127.0.0.1").pathname;
+    const scoped = parseProviderPath(path47);
     if (scoped === void 0) {
-      if (deps.rcSelfHostRoute !== void 0 && isRcSelfHostPath(path46)) {
+      if (deps.rcSelfHostRoute !== void 0 && isRcSelfHostPath(path47)) {
         return { ok: true, route: deps.rcSelfHostRoute };
       }
-      if (request7.session.provider !== void 0 && path46.startsWith("/v1/") && !isRcSelfHostPath(path46)) {
+      if (request7.session.provider !== void 0 && path47.startsWith("/v1/") && !isRcSelfHostPath(path47)) {
         return resolve2({ ...request7, url: `${PROVIDER_PATH_PREFIX}${encodeURIComponent(request7.session.provider)}${request7.url}` });
       }
-      return path46.startsWith("/v1/") ? { ok: true, route: oauthRoute } : { ok: false, status: HTTP_STATUS.notFound, message: `no such endpoint: ${path46}` };
+      return path47.startsWith("/v1/") ? { ok: true, route: oauthRoute } : { ok: false, status: HTTP_STATUS.notFound, message: `no such endpoint: ${path47}` };
     }
     const { provider } = scoped;
     let definition;
@@ -114483,8 +114553,8 @@ function createProviderRouteResolver(deps) {
     let replay;
     const visited = /* @__PURE__ */ new Set();
     for (; ; ) {
-      const path46 = new URL(current.url, "http://127.0.0.1").pathname;
-      const scoped = parseProviderPath(path46);
+      const path47 = new URL(current.url, "http://127.0.0.1").pathname;
+      const scoped = parseProviderPath(path47);
       const providerName = scoped?.provider ?? current.session.provider;
       if (providerName !== void 0 && visited.has(providerName)) {
         return { ok: false, status: HTTP_STATUS.internalServerError, message: `provider routing cycle: ${[...visited, providerName].join(" -> ")}` };
@@ -114549,7 +114619,7 @@ function createProviderRouteResolver(deps) {
         const headers = Object.fromEntries(Object.entries(replay.headers).filter(([name]) => name.toLowerCase() !== "content-length"));
         replay = { ...replay, headers, body: import_node_stream3.Readable.from([Buffer.from(rewritten, "utf8")]) };
       }
-      const rest = scoped === void 0 ? path46 : path46.slice(`${PROVIDER_PATH_PREFIX}${encodeURIComponent(scoped.provider)}`.length);
+      const rest = scoped === void 0 ? path47 : path47.slice(`${PROVIDER_PATH_PREFIX}${encodeURIComponent(scoped.provider)}`.length);
       const query = current.url.includes("?") ? current.url.slice(current.url.indexOf("?")) : "";
       current = { ...current, url: `${PROVIDER_PATH_PREFIX}${encodeURIComponent(matched.provider)}${rest}${query}`, body: replay.body, headers: replay.headers };
     }
@@ -114653,7 +114723,7 @@ function createRcLiveUsage(deps) {
 }
 
 // src/frontdoor/rcSelfHostMint.ts
-var import_node_path39 = __toESM(require("node:path"), 1);
+var import_node_path40 = __toESM(require("node:path"), 1);
 init_account();
 
 // src/frontdoor/rcSelfHostLocal.ts
@@ -114783,7 +114853,7 @@ function readJsonObject(fs21, file2) {
   return isRecord6(parsed) ? parsed : void 0;
 }
 function readRcSelfHostRecord(fs21, frontdoorDir) {
-  const parsed = readJsonObject(fs21, import_node_path39.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
+  const parsed = readJsonObject(fs21, import_node_path40.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
   if (parsed === void 0) {
     return void 0;
   }
@@ -114797,11 +114867,11 @@ function mintRcSelfHostCredential(deps) {
   if (!isIdentityName(deps.identity)) {
     throw new Error(`"${deps.identity}" is not a valid identity name.`);
   }
-  const identityDir = import_node_path39.default.join(deps.identitiesDir, deps.identity);
-  const credentialsFile = import_node_path39.default.join(identityDir, CREDENTIALS_FILE);
-  const claudeJsonFile = import_node_path39.default.join(identityDir, CLAUDE_JSON2);
-  const recordDir = import_node_path39.default.join(deps.frontdoorDir, RC_SELF_HOST_RECORD_DIR);
-  const recordFile = import_node_path39.default.join(recordDir, RC_SELF_HOST_RECORD_FILE);
+  const identityDir = import_node_path40.default.join(deps.identitiesDir, deps.identity);
+  const credentialsFile = import_node_path40.default.join(identityDir, CREDENTIALS_FILE);
+  const claudeJsonFile = import_node_path40.default.join(identityDir, CLAUDE_JSON2);
+  const recordDir = import_node_path40.default.join(deps.frontdoorDir, RC_SELF_HOST_RECORD_DIR);
+  const recordFile = import_node_path40.default.join(recordDir, RC_SELF_HOST_RECORD_FILE);
   const previousRecord = readRcSelfHostRecord(deps.fs, deps.frontdoorDir);
   const existingCredentials = readJsonObject(deps.fs, credentialsFile);
   const existingOauth = isRecord6(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
@@ -114817,7 +114887,7 @@ function mintRcSelfHostCredential(deps) {
   const organizationUuid = deps.newUuid();
   const accountUuid = deps.newUuid();
   const mintedAt = new Date(deps.now()).toISOString();
-  deps.fs.mkdirPrivate(import_node_path39.default.dirname(credentialsFile));
+  deps.fs.mkdirPrivate(import_node_path40.default.dirname(credentialsFile));
   deps.fs.writeFilePrivate(credentialsFile, `${JSON.stringify({ ...existingCredentials, claudeAiOauth: { accessToken, refreshToken, expiresAt: null, scopes: [...RC_SELF_HOST_SCOPE_LIST], subscriptionType: SELF_HOST_SUBSCRIPTION_TYPE, rateLimitTier: null } }, null, 2)}
 `);
   const claudeJson = readJsonObject(deps.fs, claudeJsonFile) ?? {};
@@ -115204,7 +115274,7 @@ function registerRcCommand(frontdoor, paths) {
 }
 
 // src/frontdoor/rcCredentialStore.ts
-var import_node_path40 = __toESM(require("node:path"), 1);
+var import_node_path41 = __toESM(require("node:path"), 1);
 function isSafeSessionId(sessionId) {
   return /^[A-Za-z0-9_-]+$/.test(sessionId);
 }
@@ -115230,7 +115300,7 @@ function sequenceNumOfJson(value2) {
 }
 function createRcCredentialStore(fs21, dir) {
   fs21.mkdirPrivate(dir);
-  const fileFor = (sessionId) => import_node_path40.default.join(dir, `${sessionId}.json`);
+  const fileFor = (sessionId) => import_node_path41.default.join(dir, `${sessionId}.json`);
   const readParsed = (sessionId) => {
     const raw = fs21.readFileUtf8(fileFor(sessionId));
     if (raw === void 0) {
@@ -117299,7 +117369,7 @@ init_socket();
 init_state();
 init_state2();
 function headroomSocketTarget(fsPort, trust, paths) {
-  const socketPath = readHeadroomState(fsPort, paths.headroomStateFile)?.socketPath;
+  const socketPath = readHeadroomState(fsPort, paths.headroomStateFile)?.socketPath ?? readHeadroomState(fsPort, paths.headroomLegacyStateFile)?.socketPath;
   return socketPath === void 0 ? void 0 : verifyHeadroomSocket(socketPath, trust);
 }
 function collectFrontDoorStatus(fsPort, socketTrust, paths, isRunning) {
@@ -117404,6 +117474,12 @@ function rcObservingResolver(resolve2, tracker, hub) {
     } }) } : resolution;
   };
 }
+function realStatOwnExecutable(watchPath) {
+  return () => {
+    const st2 = import_node_fs15.default.statSync(watchPath, { throwIfNoEntry: false });
+    return st2?.isFile() !== true ? void 0 : { dev: st2.dev, ino: st2.ino, size: st2.size, mtimeMs: st2.mtimeMs };
+  };
+}
 function realFrontDoorSupervisorPorts(paths) {
   const log = (line) => {
     appendLog(paths, `frontdoor ${String(process.pid)}: ${line}`);
@@ -117532,6 +117608,8 @@ function realFrontDoorSupervisorPorts(paths) {
       });
     },
     isRunning: realIsProcessRunning,
+    // The turnover check's file identity, over the installed entry resolved once at door start: re-resolving per tick would re-run the PATH scan every second and could theoretically flip between two files, while the entry itself is fixed for as long as this door lives. The existence check prefers the agent-shim sibling only when it is really there (see watchedInstallEntry).
+    statOwnExecutable: realStatOwnExecutable(watchedInstallEntry(realOwnExecutablePath(), (candidate) => import_node_fs15.default.existsSync(candidate))),
     startProviderListener: async (preferredPort) => {
       const authority = loadCa();
       const rcDial = rcSelfHost ? lateRcEventDial(rcSelfHostDialTarget) : realRcEventDial();
@@ -117626,7 +117704,7 @@ function realFrontDoorSupervisorPorts(paths) {
       const leafFor = createLeafCache(loadCa(), () => /* @__PURE__ */ new Date());
       const capture = captureFromEnv(process.env, paths.logsDir);
       if (capture !== void 0) {
-        log(`capture enabled, recording CONNECT targets and piped exchanges to ${import_node_path41.default.join(paths.logsDir, "frontdoor-capture.jsonl")}`);
+        log(`capture enabled, recording CONNECT targets and piped exchanges to ${import_node_path42.default.join(paths.logsDir, "frontdoor-capture.jsonl")}`);
       }
       if (rcSelfHostSurface !== void 0) {
         log("self-hosted Remote Control surface on: the door serves the CCR session family itself, and its own client-half dials its own transparent surface");
@@ -117885,16 +117963,16 @@ init_credentialCache();
 
 // src/identityToken.ts
 var import_node_fs16 = __toESM(require("node:fs"), 1);
-var import_node_path42 = __toESM(require("node:path"), 1);
+var import_node_path43 = __toESM(require("node:path"), 1);
 init_cliError();
 var TOKEN_FILE_MODE = 384;
 var TOKEN_DIR_MODE = 448;
 var OAUTH_TOKEN_RE = /^sk-ant-oat\d+-[A-Za-z0-9_-]+$/;
 function identityTokenDir(paths) {
-  return import_node_path42.default.join(paths.root, "credentials");
+  return import_node_path43.default.join(paths.root, "credentials");
 }
 function identityTokenPath(paths, identityName) {
-  return import_node_path42.default.join(identityTokenDir(paths), `${identityName}.token`);
+  return import_node_path43.default.join(identityTokenDir(paths), `${identityName}.token`);
 }
 function storeIdentityToken(paths, identityName, raw) {
   const token = raw.trim();
@@ -117905,7 +117983,7 @@ function storeIdentityToken(paths, identityName, raw) {
   import_node_fs16.default.mkdirSync(dir, { recursive: true, mode: TOKEN_DIR_MODE });
   import_node_fs16.default.chmodSync(dir, TOKEN_DIR_MODE);
   const target = identityTokenPath(paths, identityName);
-  const temp = import_node_path42.default.join(dir, `.${identityName}.${String(process.pid)}.tmp`);
+  const temp = import_node_path43.default.join(dir, `.${identityName}.${String(process.pid)}.tmp`);
   import_node_fs16.default.writeFileSync(temp, `${token}
 `, { mode: TOKEN_FILE_MODE });
   import_node_fs16.default.renameSync(temp, target);
@@ -118073,7 +118151,7 @@ function registerDoctorCommand(program2, deps) {
 // src/headroom/commands.ts
 var import_node_fs17 = __toESM(require("node:fs"), 1);
 var import_node_http3 = __toESM(require("node:http"), 1);
-var import_node_path43 = __toESM(require("node:path"), 1);
+var import_node_path44 = __toESM(require("node:path"), 1);
 var import_node_child_process6 = require("node:child_process");
 init_commandDeps();
 init_realFrontDoorPort();
@@ -118084,7 +118162,7 @@ init_realPorts();
 init_state();
 init_supervisor();
 function collectHeadroomStatus(fsPort, paths, isRunning) {
-  const state = readHeadroomState(fsPort, paths.headroomStateFile) ?? {};
+  const state = resolveServingHeadroomState(fsPort, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, isRunning)?.state ?? {};
   const allowlist = currentHeadroomAllowlist(fsPort, paths);
   const settings2 = settingsOf(readGlobalConfig(paths)?.headroom ?? {});
   return {
@@ -118187,12 +118265,12 @@ function readInstalledHeadroomCommit() {
   if (toolDir.status !== 0) {
     return void 0;
   }
-  const libDir = import_node_path43.default.join(toolDir.stdout.trim(), HEADROOM_TOOL_NAME, "lib");
+  const libDir = import_node_path44.default.join(toolDir.stdout.trim(), HEADROOM_TOOL_NAME, "lib");
   for (const python of realFarmFs.readdir(libDir)) {
-    const sitePackages = import_node_path43.default.join(libDir, python, "site-packages");
+    const sitePackages = import_node_path44.default.join(libDir, python, "site-packages");
     for (const entry of realFarmFs.readdir(sitePackages)) {
       if (entry.startsWith("headroom_ai-") && entry.endsWith(".dist-info")) {
-        const directUrl = realFarmFs.readFileUtf8(import_node_path43.default.join(sitePackages, entry, "direct_url.json"));
+        const directUrl = realFarmFs.readFileUtf8(import_node_path44.default.join(sitePackages, entry, "direct_url.json"));
         return directUrl === void 0 ? void 0 : parseInstalledCommit(directUrl);
       }
     }
@@ -118752,7 +118830,7 @@ function registerRunCommand(program2, handler) {
 var import_node_child_process7 = require("node:child_process");
 var import_node_fs18 = __toESM(require("node:fs"), 1);
 var import_node_os11 = __toESM(require("node:os"), 1);
-var import_node_path44 = __toESM(require("node:path"), 1);
+var import_node_path45 = __toESM(require("node:path"), 1);
 init_package();
 init_commandDeps();
 init_store();
@@ -118854,7 +118932,7 @@ var realUpdatePorts = {
     chmod: (filePath, mode) => {
       import_node_fs18.default.chmodSync(filePath, mode);
     },
-    mkdtemp: () => import_node_fs18.default.mkdtempSync(import_node_path44.default.join(import_node_os11.default.tmpdir(), "agent-shim-update-")),
+    mkdtemp: () => import_node_fs18.default.mkdtempSync(import_node_path45.default.join(import_node_os11.default.tmpdir(), "agent-shim-update-")),
     rmRecursive: (targetPath) => {
       import_node_fs18.default.rmSync(targetPath, { recursive: true, force: true });
     }
@@ -118921,7 +118999,7 @@ function registerUpdateCommand(program2, deps, ports = realUpdatePorts) {
         platform: process.platform,
         arch: process.arch,
         executablePath: realOwnExecutablePath(),
-        lockPath: import_node_path44.default.join(deps.paths.root, "update.lock"),
+        lockPath: import_node_path45.default.join(deps.paths.root, "update.lock"),
         checkOnly: options.check === true,
         pid: process.pid
       });
@@ -119391,7 +119469,7 @@ async function runClaude(argvOverride) {
 // src/cli.ts
 async function main() {
   aliasLegacyEnv(process.env);
-  const invokedName = import_node_path45.default.basename(process.argv[1] ?? "agent-shim");
+  const invokedName = import_node_path46.default.basename(process.argv[1] ?? "agent-shim");
   if (isInvokedAsClaude(invokedName)) {
     await runClaude();
     return;