agent-shim 8.43.0 → 9.0.0

package/dist/index.cjs

@@ -2643,7 +2643,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "agent-shim",
-      version: "8.43.0",
+      version: "9.0.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -2761,10 +2761,36 @@ function readHeadroomState(fs12, stateFile) {
   }
 }
 function writeHeadroomState(fs12, stateFile, state) {
-  fs12.mkdirp(import_node_path10.default.dirname(stateFile));
+  fs12.mkdirp(import_node_path11.default.dirname(stateFile));
   fs12.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
 `);
 }
+function resolveServingHeadroomState(fs12, files, isRunning) {
+  const current = readHeadroomState(fs12, files.stateFile);
+  if (current !== void 0) {
+    return { path: files.stateFile, state: current };
+  }
+  const legacy = readHeadroomState(fs12, files.legacyStateFile);
+  if (legacy?.supervisorPid !== void 0 && isRunning(legacy.supervisorPid)) {
+    return { path: files.legacyStateFile, state: legacy };
+  }
+  return void 0;
+}
+function migrateHeadroomState(fs12, files, isRunning) {
+  const legacy = readHeadroomState(fs12, files.legacyStateFile);
+  const legacyLive = legacy?.supervisorPid !== void 0 && isRunning(legacy.supervisorPid);
+  const current = readHeadroomState(fs12, files.stateFile);
+  if (current !== void 0 || legacyLive) {
+    if (!legacyLive && fs12.readFileUtf8(files.legacyStateFile) !== void 0) {
+      fs12.removeRecursive(files.legacyStateFile);
+    }
+    return;
+  }
+  if (legacy !== void 0) {
+    writeHeadroomState(fs12, files.stateFile, legacy);
+  }
+  fs12.removeRecursive(files.legacyStateFile);
+}
 function headroomAllowlist(providers) {
   const urls = /* @__PURE__ */ new Set([HEADROOM_ANTHROPIC_UPSTREAM]);
   for (const provider of providers) {
@@ -2789,7 +2815,7 @@ function readAllProviders(fs12, providersDir) {
       continue;
     }
     try {
-      const parsed = parseJson(fs12.readFileUtf8(import_node_path10.default.join(providersDir, name)), ProviderSchema);
+      const parsed = parseJson(fs12.readFileUtf8(import_node_path11.default.join(providersDir, name)), ProviderSchema);
       if (parsed !== void 0) {
         result.push({ name: name.slice(0, -".json".length), provider: parsed });
       }
@@ -2801,11 +2827,11 @@ function readAllProviders(fs12, providersDir) {
 }
 function writeSession(fs12, sessionsDir, session) {
   fs12.mkdirp(sessionsDir);
-  fs12.writeFileUtf8(import_node_path10.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
+  fs12.writeFileUtf8(import_node_path11.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
 `);
 }
 function removeSession(fs12, sessionsDir, pid) {
-  fs12.removeRecursive(import_node_path10.default.join(sessionsDir, `${String(pid)}.json`));
+  fs12.removeRecursive(import_node_path11.default.join(sessionsDir, `${String(pid)}.json`));
 }
 function listSessions(fs12, sessionsDir) {
   const sessions = [];
@@ -2814,7 +2840,7 @@ function listSessions(fs12, sessionsDir) {
       continue;
     }
     try {
-      const parsed = parseJson(fs12.readFileUtf8(import_node_path10.default.join(sessionsDir, name)), HeadroomSessionSchema);
+      const parsed = parseJson(fs12.readFileUtf8(import_node_path11.default.join(sessionsDir, name)), HeadroomSessionSchema);
       if (parsed !== void 0) {
         sessions.push(parsed);
       }
@@ -2844,16 +2870,15 @@ function readStartLock(fs12, lockFile) {
     return void 0;
   }
 }
-var import_node_crypto6, import_node_path10, import_zod5, HEADROOM_ANTHROPIC_UPSTREAM, HEADROOM_STATE_SCHEMA_VERSION, HeadroomStateSchema, HeadroomSessionSchema, HeadroomLockSchema;
+var import_node_crypto6, import_node_path11, import_zod5, HEADROOM_ANTHROPIC_UPSTREAM, HeadroomStateSchema, HeadroomSessionSchema, HeadroomLockSchema;
 var init_state2 = __esm({
   "src/headroom/state.ts"() {
     "use strict";
     import_node_crypto6 = require("node:crypto");
-    import_node_path10 = __toESM(require("node:path"), 1);
+    import_node_path11 = __toESM(require("node:path"), 1);
     import_zod5 = require("zod");
     init_schema();
     HEADROOM_ANTHROPIC_UPSTREAM = "https://api.anthropic.com";
-    HEADROOM_STATE_SCHEMA_VERSION = 2;
     HeadroomStateSchema = import_zod5.z.strictObject({
       /** The supervisor process owning the daemon. Alive means someone is keeping headroom running. */
       supervisorPid: import_zod5.z.number().int().positive().optional(),
@@ -2885,8 +2910,9 @@ function ensureHeadroom(params) {
   const deadline = ports.now() + HEADROOM_START_TIMEOUT_MS;
   let spawnedSupervisor = false;
   let awaitingAllowlist = false;
+  migrateHeadroomState(ports.fs, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, ports.isRunning);
   for (; ; ) {
-    const state = readHeadroomState(ports.fs, paths.headroomStateFile);
+    const state = resolveServingHeadroomState(ports.fs, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, ports.isRunning)?.state;
     if (state?.supervisorPid !== void 0 && ports.isRunning(state.supervisorPid)) {
       const daemonUp = state.socketPath !== void 0 && state.headroomPid !== void 0 && ports.isRunning(state.headroomPid);
       if (daemonUp && state.socketPath !== void 0) {
@@ -2989,7 +3015,7 @@ var init_settings = __esm({
 
 // src/headroom/socket.ts
 function headroomSocketPath(paths, supervisorPid) {
-  return import_node_path11.default.join(paths.headroomSocketDir, `${String(supervisorPid)}${HEADROOM_SOCKET_SUFFIX}`);
+  return import_node_path12.default.join(paths.headroomSocketDir, `${String(supervisorPid)}${HEADROOM_SOCKET_SUFFIX}`);
 }
 function platformRefusal(platform) {
   return PLATFORMS_WITHOUT_UNIX_SOCKETS.includes(platform) ? `headroom routing needs a unix domain socket, which headroom cannot serve on ${platform}; agent-shim never falls back to a TCP port for this hop` : void 0;
@@ -3018,7 +3044,7 @@ function verifyHeadroomSocket(socketPath, ports) {
     return { refused: unsupported };
   }
   const uid = ports.currentUid();
-  const directory = import_node_path11.default.dirname(socketPath);
+  const directory = import_node_path12.default.dirname(socketPath);
   const refusal = ownerOnlyRefusal("socket directory", directory, ports.lstat(directory), "dir", uid) ?? ownerOnlyRefusal("socket", socketPath, ports.lstat(socketPath), "socket", uid);
   return refusal === void 0 ? { socketPath } : { refused: refusal };
 }
@@ -3048,16 +3074,16 @@ function pruneStaleHeadroomSockets(fs12, paths, isRunning) {
     if (pid === void 0 || isRunning(Number.parseInt(pid, 10))) {
       continue;
     }
-    fs12.removeRecursive(import_node_path11.default.join(paths.headroomSocketDir, name));
+    fs12.removeRecursive(import_node_path12.default.join(paths.headroomSocketDir, name));
     removed.push(name);
   }
   return removed;
 }
-var import_node_path11, GROUP_OR_OTHER_BITS, OCTAL_RADIX, MODE_DIGITS, HEADROOM_SOCKET_SUFFIX, HEADROOM_SOCKET_NAME, UNIX_SOCKET_PATH_MAX_BYTES, PLATFORMS_WITHOUT_UNIX_SOCKETS;
+var import_node_path12, GROUP_OR_OTHER_BITS, OCTAL_RADIX, MODE_DIGITS, HEADROOM_SOCKET_SUFFIX, HEADROOM_SOCKET_NAME, UNIX_SOCKET_PATH_MAX_BYTES, PLATFORMS_WITHOUT_UNIX_SOCKETS;
 var init_socket = __esm({
   "src/headroom/socket.ts"() {
     "use strict";
-    import_node_path11 = __toESM(require("node:path"), 1);
+    import_node_path12 = __toESM(require("node:path"), 1);
     GROUP_OR_OTHER_BITS = 63;
     OCTAL_RADIX = 8;
     MODE_DIGITS = 4;
@@ -3156,7 +3182,8 @@ function compareVersions2(a, b) {
 async function runSupervisor(initialConfig, ports, options = {}) {
   const { fs: fs12, paths } = ports;
   let config = initialConfig;
-  const previousState = readHeadroomState(fs12, paths.headroomStateFile);
+  migrateHeadroomState(fs12, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, ports.isRunning);
+  const previousState = resolveServingHeadroomState(fs12, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, ports.isRunning)?.state;
   if (previousState?.supervisorPid !== void 0 && previousState.supervisorPid !== ports.ownPid && ports.isRunning(previousState.supervisorPid)) {
     ports.log(`agent-shim headroom supervisor ${String(ports.ownPid)}: supervisor ${String(previousState.supervisorPid)} already owns the daemon; exiting`);
     return 0;
@@ -3380,7 +3407,7 @@ function realIsProcessRunning(pid) {
   return realIsProcessAlive(pid) && !realIsProcessZombie(pid);
 }
 function expandHome2(filePath) {
-  return filePath.startsWith("~/") ? import_node_path12.default.join(import_node_os2.default.homedir(), filePath.slice(1)) : filePath;
+  return filePath.startsWith("~/") ? import_node_path13.default.join(import_node_os2.default.homedir(), filePath.slice(1)) : filePath;
 }
 function hasDesktopSession() {
   if (process.platform === "darwin") {
@@ -3424,7 +3451,7 @@ function spawnDaemonThroughScript(script) {
   return (paths, subcommand, logPath) => spawnDetachedDaemon({ command: process.execPath, args: [script, subcommand] }, paths, subcommand, logPath);
 }
 function spawnDetachedDaemon(invocation, paths, subcommand, logPath) {
-  import_node_fs2.default.mkdirSync(import_node_path12.default.dirname(logPath), { recursive: true });
+  import_node_fs2.default.mkdirSync(import_node_path13.default.dirname(logPath), { recursive: true });
   const logFd = import_node_fs2.default.openSync(logPath, "a");
   try {
     const child = (0, import_node_child_process.spawn)(invocation.command, invocation.args, detachedDaemonSpawnOptions(logFd, { ...process.env, AGENT_SHIM_HOME: paths.root }));
@@ -3477,7 +3504,7 @@ function listVersionsDir(dir) {
     throw error;
   }
   return entries.filter((entry) => entry.isFile()).map((entry) => {
-    const fullPath = import_node_path12.default.join(dir, entry.name);
+    const fullPath = import_node_path13.default.join(dir, entry.name);
     const stat = import_node_fs2.default.statSync(fullPath);
     return {
       name: entry.name,
@@ -3491,7 +3518,7 @@ function windowsPathExtensions(pathext) {
   return (pathext ?? WINDOWS_DEFAULT_PATHEXT).split(";").map((ext) => ext.trim()).filter((ext) => ext.length > 0);
 }
 function resolveExecutableCandidate(dir, name, env) {
-  const candidate = import_node_path12.default.join(dir, name);
+  const candidate = import_node_path13.default.join(dir, name);
   if (env.platform === "win32") {
     const extensions = windowsPathExtensions(env.pathext);
     const alreadyHasRecognisedExtension = extensions.some((ext) => candidate.toLowerCase().endsWith(ext.toLowerCase()));
@@ -3540,13 +3567,13 @@ function resolveOwnExecutablePath(env) {
   if (env.argv1 !== void 0 && !env.argv1.includes("/") && !env.argv1.includes("\\")) {
     return searchPathForExecutable(env.pathDirs, env.argv1, env.findExecutableInDir) ?? env.execPath;
   }
-  const candidate = env.argv1 === void 0 ? env.execPath : import_node_path12.default.resolve(env.cwd, env.argv1);
-  const candidateDir = import_node_path12.default.dirname(candidate);
-  const candidateDirOnPath = env.pathDirs.some((dir) => import_node_path12.default.resolve(dir) === candidateDir);
+  const candidate = env.argv1 === void 0 ? env.execPath : import_node_path13.default.resolve(env.cwd, env.argv1);
+  const candidateDir = import_node_path13.default.dirname(candidate);
+  const candidateDirOnPath = env.pathDirs.some((dir) => import_node_path13.default.resolve(dir) === candidateDir);
   if (candidateDirOnPath) {
     return candidate;
   }
-  const viaPath = searchPathForExecutable(env.pathDirs, import_node_path12.default.basename(candidate), env.findExecutableInDir);
+  const viaPath = searchPathForExecutable(env.pathDirs, import_node_path13.default.basename(candidate), env.findExecutableInDir);
   return viaPath ?? candidate;
 }
 function realOwnExecutablePath() {
@@ -3554,7 +3581,7 @@ function realOwnExecutablePath() {
     argv1: process.argv[1],
     execPath: process.execPath,
     cwd: process.cwd(),
-    pathDirs: (process.env.PATH ?? "").split(import_node_path12.default.delimiter).filter((dir) => dir !== ""),
+    pathDirs: (process.env.PATH ?? "").split(import_node_path13.default.delimiter).filter((dir) => dir !== ""),
     findExecutableInDir
   });
 }
@@ -3567,7 +3594,7 @@ function realContentSourcePath() {
 function realResolveClaudeBinary(isOwnBinary) {
   return (request4) => discoverClaudeBinary({
     listVersionsDir,
-    pathDirs: (process.env.PATH ?? "").split(import_node_path12.default.delimiter).filter((dir) => dir !== ""),
+    pathDirs: (process.env.PATH ?? "").split(import_node_path13.default.delimiter).filter((dir) => dir !== ""),
     findExecutableInDir,
     isOwnBinary,
     ...request4?.version === void 0 ? {} : { version: request4.version }
@@ -3576,7 +3603,7 @@ function realResolveClaudeBinary(isOwnBinary) {
 function realInstalledClaudeVersions() {
   return installedVersions(listVersionsDir(defaultVersionsDir()));
 }
-var import_node_child_process, import_node_crypto8, import_node_fs2, import_node_os2, import_node_path12, import_node_sea, realFsPort, OWNER_ONLY_DIR_MODE, OWNER_ONLY_FILE_MODE, PERMISSION_BITS, realFarmFs, INT32_BYTE_LENGTH, realRunPort, MACOS_GUI_SESSION_MANAGER, realCredentialPort, SOCKET_PERMISSION_BITS, realHeadroomSocketTrust, realSpawnPort, realProcPort, EXECUTE_BITS_MASK, WINDOWS_DEFAULT_PATHEXT;
+var import_node_child_process, import_node_crypto8, import_node_fs2, import_node_os2, import_node_path13, import_node_sea, realFsPort, OWNER_ONLY_DIR_MODE, OWNER_ONLY_FILE_MODE, PERMISSION_BITS, realFarmFs, INT32_BYTE_LENGTH, realRunPort, MACOS_GUI_SESSION_MANAGER, realCredentialPort, SOCKET_PERMISSION_BITS, realHeadroomSocketTrust, realSpawnPort, realProcPort, EXECUTE_BITS_MASK, WINDOWS_DEFAULT_PATHEXT;
 var init_realPorts = __esm({
   "src/realPorts.ts"() {
     "use strict";
@@ -3584,7 +3611,7 @@ var init_realPorts = __esm({
     import_node_crypto8 = require("node:crypto");
     import_node_fs2 = __toESM(require("node:fs"), 1);
     import_node_os2 = __toESM(require("node:os"), 1);
-    import_node_path12 = __toESM(require("node:path"), 1);
+    import_node_path13 = __toESM(require("node:path"), 1);
     import_node_sea = require("node:sea");
     init_load();
     init_versionDiscovery();
@@ -3800,18 +3827,18 @@ function expandTilde(value, home) {
     return home;
   }
   if (value.startsWith("~/")) {
-    return import_node_path13.default.join(home, value.slice(2));
+    return import_node_path14.default.join(home, value.slice(2));
   }
   return value;
 }
 function normaliseRulePath(rulePath, home) {
-  return import_node_path13.default.resolve(expandTilde(rulePath, home));
+  return import_node_path14.default.resolve(expandTilde(rulePath, home));
 }
-var import_node_path13;
+var import_node_path14;
 var init_pathNorm = __esm({
   "src/pathNorm.ts"() {
     "use strict";
-    import_node_path13 = __toESM(require("node:path"), 1);
+    import_node_path14 = __toESM(require("node:path"), 1);
   }
 });
 
@@ -3820,7 +3847,7 @@ function loadCascadeInput(params) {
   const globalConfig = loadConfigFile(params.paths.globalConfigFile, GlobalConfigSchema, params.read);
   const directoryRules = loadConfigFile(params.paths.directoryRulesFile, DirectoryRulesSchema, params.read);
   const loadProfile = (name) => {
-    const filepath = import_node_path14.default.join(params.paths.configProfilesDir, `${name}.json`);
+    const filepath = import_node_path15.default.join(params.paths.configProfilesDir, `${name}.json`);
     const loaded = loadConfigFile(filepath, ConfigProfileSchema, params.read);
     if (loaded === void 0) {
       return void 0;
@@ -3835,8 +3862,8 @@ function loadCascadeInput(params) {
   });
   const levels = [];
   for (const dir of dirs) {
-    const portable = loadConfigFile(import_node_path14.default.join(dir, PORTABLE_CONFIG_FILENAME), PortableConfigSchema, params.read) ?? loadConfigFile(import_node_path14.default.join(dir, LEGACY_PORTABLE_CONFIG_FILENAME), PortableConfigSchema, params.read);
-    const portableLocal = loadConfigFile(import_node_path14.default.join(dir, PORTABLE_LOCAL_CONFIG_FILENAME), PortableConfigSchema, params.read) ?? loadConfigFile(import_node_path14.default.join(dir, LEGACY_PORTABLE_LOCAL_CONFIG_FILENAME), PortableConfigSchema, params.read);
+    const portable = loadConfigFile(import_node_path15.default.join(dir, PORTABLE_CONFIG_FILENAME), PortableConfigSchema, params.read) ?? loadConfigFile(import_node_path15.default.join(dir, LEGACY_PORTABLE_CONFIG_FILENAME), PortableConfigSchema, params.read);
+    const portableLocal = loadConfigFile(import_node_path15.default.join(dir, PORTABLE_LOCAL_CONFIG_FILENAME), PortableConfigSchema, params.read) ?? loadConfigFile(import_node_path15.default.join(dir, LEGACY_PORTABLE_LOCAL_CONFIG_FILENAME), PortableConfigSchema, params.read);
     const rules = (directoryRules?.config.rules ?? []).map((rule, index) => ({ rule, index })).filter(({ rule }) => normaliseRulePath(rule.path, params.home) === dir).map(({ rule, index }) => {
       const entryOrder = directoryRules?.ruleEntryOrders[index];
       return {
@@ -3883,11 +3910,11 @@ function readDirectorySelections(loaded) {
   }
   return { ...identity === void 0 ? {} : { identity }, ...configProfile === void 0 ? {} : { configProfile } };
 }
-var import_node_path14, PORTABLE_CONFIG_FILENAME, PORTABLE_LOCAL_CONFIG_FILENAME;
+var import_node_path15, PORTABLE_CONFIG_FILENAME, PORTABLE_LOCAL_CONFIG_FILENAME;
 var init_cascade = __esm({
   "src/launcher/cascade.ts"() {
     "use strict";
-    import_node_path14 = __toESM(require("node:path"), 1);
+    import_node_path15 = __toESM(require("node:path"), 1);
     init_load();
     init_schema();
     init_pathNorm();
@@ -3951,13 +3978,13 @@ function decideConfigProfile(params) {
   return { source: "none" };
 }
 function loadIdentity(identitiesDir, name, fs12) {
-  return loadConfigFile(import_node_path15.default.join(identitiesDir, name, "identity.json"), IdentitySchema, fs12.readConfigFile);
+  return loadConfigFile(import_node_path16.default.join(identitiesDir, name, "identity.json"), IdentitySchema, fs12.readConfigFile);
 }
-var import_node_path15, IDENTITY_DECISION_SOURCES, CONFIG_PROFILE_DECISION_SOURCES;
+var import_node_path16, IDENTITY_DECISION_SOURCES, CONFIG_PROFILE_DECISION_SOURCES;
 var init_identity = __esm({
   "src/launcher/identity.ts"() {
     "use strict";
-    import_node_path15 = __toESM(require("node:path"), 1);
+    import_node_path16 = __toESM(require("node:path"), 1);
     init_load();
     init_schema();
     IDENTITY_DECISION_SOURCES = [
@@ -4153,7 +4180,7 @@ function isIdentityName(name) {
   return IdentitySchema.shape.name.safeParse(name).success;
 }
 function claudeJsonPath(identitiesDir, identity) {
-  return import_node_path16.default.join(identitiesDir, identity, CLAUDE_JSON);
+  return import_node_path17.default.join(identitiesDir, identity, CLAUDE_JSON);
 }
 function readAccountMetadata(fs12, identitiesDir, identity) {
   if (!isIdentityName(identity)) {
@@ -4207,11 +4234,11 @@ function createAccountReader(fs12, identitiesDir) {
     return account;
   };
 }
-var import_node_path16, CLAUDE_JSON, AccountMetadataError;
+var import_node_path17, CLAUDE_JSON, AccountMetadataError;
 var init_account = __esm({
   "src/usage/account.ts"() {
     "use strict";
-    import_node_path16 = __toESM(require("node:path"), 1);
+    import_node_path17 = __toESM(require("node:path"), 1);
     init_cliError();
     init_schema();
     init_schema2();
@@ -4677,7 +4704,7 @@ function readUsageLog(fs12, logDir, options = {}) {
     if (sinceMs !== void 0 && segment.endsAt <= sinceMs) {
       continue;
     }
-    const contents = fs12.readFileUtf8(import_node_path17.default.join(logDir, segment.name));
+    const contents = fs12.readFileUtf8(import_node_path18.default.join(logDir, segment.name));
     if (contents === void 0) {
       continue;
     }
@@ -4711,7 +4738,7 @@ function snapshotPath(snapshotsDir, identity) {
   if (!isIdentityName(identity)) {
     throw new Error(`"${identity}" is not a valid identity name.`);
   }
-  return import_node_path17.default.join(snapshotsDir, `${identity}.json`);
+  return import_node_path18.default.join(snapshotsDir, `${identity}.json`);
 }
 function readUsageSnapshot(fs12, snapshotsDir, identity) {
   const file = snapshotPath(snapshotsDir, identity);
@@ -4744,11 +4771,11 @@ function listUsageSnapshots(fs12, snapshotsDir) {
     return snapshot === void 0 ? [] : [snapshot];
   }).sort((left, right) => left.identity.localeCompare(right.identity));
 }
-var import_node_path17, SEGMENT_RE, DAY_MS, UsageSnapshotError;
+var import_node_path18, SEGMENT_RE, DAY_MS, UsageSnapshotError;
 var init_read = __esm({
   "src/usage/read.ts"() {
     "use strict";
-    import_node_path17 = __toESM(require("node:path"), 1);
+    import_node_path18 = __toESM(require("node:path"), 1);
     init_account();
     init_schema2();
     SEGMENT_RE = /^(\d{4}-\d{2}-\d{2})\.(\d+)\.jsonl$/;
@@ -4769,7 +4796,7 @@ function pruneUsageLog(fs12, logDir, nowMs) {
   const cutoff = nowMs - USAGE_RETENTION_MS;
   for (const segment of listLogSegments(fs12, logDir)) {
     if (segment.endsAt <= cutoff) {
-      fs12.removeRecursive(import_node_path18.default.join(logDir, segment.name));
+      fs12.removeRecursive(import_node_path19.default.join(logDir, segment.name));
     }
   }
 }
@@ -4851,7 +4878,7 @@ function createUsageStore(deps) {
         pruneUsageLog(fs12, paths.usageLogDir, nowMs);
         prunedDay = day;
       }
-      fs12.appendFilePrivate(import_node_path18.default.join(paths.usageLogDir, segmentName(day, deps.pid)), `${JSON.stringify(record)}
+      fs12.appendFilePrivate(import_node_path19.default.join(paths.usageLogDir, segmentName(day, deps.pid)), `${JSON.stringify(record)}
 `);
       if (record.identity !== void 0) {
         rewriteSnapshot(record.identity, (current) => ({ ...current?.providers, [record.provider]: foldProviderState(current?.providers[record.provider], record) }));
@@ -4874,11 +4901,11 @@ function createUsageStore(deps) {
     })
   };
 }
-var import_node_path18, DAY_MS2, DAYS_IN_WEEK, USAGE_RETENTION_MS;
+var import_node_path19, DAY_MS2, DAYS_IN_WEEK, USAGE_RETENTION_MS;
 var init_store2 = __esm({
   "src/usage/store.ts"() {
     "use strict";
-    import_node_path18 = __toESM(require("node:path"), 1);
+    import_node_path19 = __toESM(require("node:path"), 1);
     init_account();
     init_rateLimit();
     init_read();
@@ -5016,15 +5043,15 @@ function recordStickyPick(fs12, picksFile, directory, identity, nowMs) {
   const current = readPicksFile(fs12, picksFile).file.picks;
   const kept = Object.entries(current).filter(([, entry]) => nowMs - Date.parse(entry.at) <= USAGE_RETENTION_MS);
   const next = { schemaVersion: SCHEMA_VERSION, picks: { ...Object.fromEntries(kept), [directory]: { identity, at: new Date(nowMs).toISOString() } } };
-  fs12.mkdirPrivate(import_node_path19.default.dirname(picksFile));
+  fs12.mkdirPrivate(import_node_path20.default.dirname(picksFile));
   fs12.writeFilePrivate(picksFile, `${JSON.stringify(next, null, 2)}
 `);
 }
-var import_node_path19, import_zod10, PoolGraphError, SCHEMA_VERSION, PickEntrySchema, PicksFileSchema;
+var import_node_path20, import_zod10, PoolGraphError, SCHEMA_VERSION, PickEntrySchema, PicksFileSchema;
 var init_poolPick = __esm({
   "src/usage/poolPick.ts"() {
     "use strict";
-    import_node_path19 = __toESM(require("node:path"), 1);
+    import_node_path20 = __toESM(require("node:path"), 1);
     import_zod10 = require("zod");
     init_cliError();
     init_identity();
@@ -5055,8 +5082,8 @@ function resolveAgentShimHome(env = process.env, home = import_node_os4.default.
   if (fromEnv !== void 0 && fromEnv !== "") {
     return fromEnv;
   }
-  const current = import_node_path21.default.join(home, HOME_DIRNAME);
-  const legacy = import_node_path21.default.join(home, LEGACY_HOME_DIRNAME);
+  const current = import_node_path22.default.join(home, HOME_DIRNAME);
+  const legacy = import_node_path22.default.join(home, LEGACY_HOME_DIRNAME);
   return !isDirectory(current) && isDirectory(legacy) ? legacy : current;
 }
 function isExistingDirectory(candidate) {
@@ -5067,55 +5094,55 @@ function resolveClaudeHome() {
   if (fromEnv !== void 0 && fromEnv !== "") {
     return fromEnv;
   }
-  return import_node_path21.default.join(import_node_os4.default.homedir(), ".claude");
+  return import_node_path22.default.join(import_node_os4.default.homedir(), ".claude");
 }
 function buildLayoutPaths(root) {
   return {
     root,
-    identitiesDir: import_node_path21.default.join(root, "identities"),
-    configProfilesDir: import_node_path21.default.join(root, "config-profiles"),
-    providersDir: import_node_path21.default.join(root, "providers"),
-    directoryRulesFile: import_node_path21.default.join(root, "directory-rules.json"),
-    activeIdentityFile: import_node_path21.default.join(root, "active-identity"),
-    globalConfigFile: import_node_path21.default.join(root, "config.json"),
-    categoriesLocalFile: import_node_path21.default.join(root, "categories.local.json"),
-    claudeShimFile: import_node_path21.default.join(root, "claude-shim.json"),
-    headroomDir: import_node_path21.default.join(root, "headroom"),
-    headroomStateFile: import_node_path21.default.join(root, "headroom", `state.v${String(HEADROOM_STATE_SCHEMA_VERSION)}.json`),
-    headroomSocketDir: import_node_path21.default.join(root, "headroom", "run"),
-    headroomLockFile: import_node_path21.default.join(root, "headroom", "start.lock"),
-    headroomSessionsDir: import_node_path21.default.join(root, "headroom", "sessions"),
-    logsDir: import_node_path21.default.join(root, "logs"),
-    headroomLogPath: import_node_path21.default.join(root, "logs", "headroom.log"),
-    frontdoorDir: import_node_path21.default.join(root, "frontdoor"),
-    frontdoorCaDir: import_node_path21.default.join(root, "frontdoor", "ca"),
-    frontdoorCaCertFile: import_node_path21.default.join(root, "frontdoor", "ca", "ca.pem"),
-    frontdoorCaKeyFile: import_node_path21.default.join(root, "frontdoor", "ca", "ca.key"),
-    frontdoorCaBundlesDir: import_node_path21.default.join(root, "frontdoor", "ca", "bundles"),
-    chatgptSignInFile: import_node_path21.default.join(root, "codex", "chatgpt-sign-in.json"),
-    frontdoorStateFile: import_node_path21.default.join(root, "frontdoor", "state.json"),
-    frontdoorLockFile: import_node_path21.default.join(root, "frontdoor", "start.lock"),
-    frontdoorControlTokenFile: import_node_path21.default.join(root, "frontdoor", "control-token"),
-    frontdoorSessionsDir: import_node_path21.default.join(root, "frontdoor", "sessions"),
-    frontdoorRcCredentialsDir: import_node_path21.default.join(root, "frontdoor", "rc-credentials"),
-    frontdoorLogPath: import_node_path21.default.join(root, "logs", "frontdoor.log"),
-    usageDir: import_node_path21.default.join(root, "usage"),
-    usageLogDir: import_node_path21.default.join(root, "usage", "log"),
-    usageSnapshotsDir: import_node_path21.default.join(root, "usage", "snapshots"),
-    usagePicksFile: import_node_path21.default.join(root, "usage", "picks.json")
+    identitiesDir: import_node_path22.default.join(root, "identities"),
+    configProfilesDir: import_node_path22.default.join(root, "config-profiles"),
+    providersDir: import_node_path22.default.join(root, "providers"),
+    directoryRulesFile: import_node_path22.default.join(root, "directory-rules.json"),
+    activeIdentityFile: import_node_path22.default.join(root, "active-identity"),
+    globalConfigFile: import_node_path22.default.join(root, "config.json"),
+    categoriesLocalFile: import_node_path22.default.join(root, "categories.local.json"),
+    claudeShimFile: import_node_path22.default.join(root, "claude-shim.json"),
+    headroomDir: import_node_path22.default.join(root, "headroom"),
+    headroomStateFile: import_node_path22.default.join(root, "headroom", "state.json"),
+    headroomLegacyStateFile: import_node_path22.default.join(root, "headroom", "state.v2.json"),
+    headroomSocketDir: import_node_path22.default.join(root, "headroom", "run"),
+    headroomLockFile: import_node_path22.default.join(root, "headroom", "start.lock"),
+    headroomSessionsDir: import_node_path22.default.join(root, "headroom", "sessions"),
+    logsDir: import_node_path22.default.join(root, "logs"),
+    headroomLogPath: import_node_path22.default.join(root, "logs", "headroom.log"),
+    frontdoorDir: import_node_path22.default.join(root, "frontdoor"),
+    frontdoorCaDir: import_node_path22.default.join(root, "frontdoor", "ca"),
+    frontdoorCaCertFile: import_node_path22.default.join(root, "frontdoor", "ca", "ca.pem"),
+    frontdoorCaKeyFile: import_node_path22.default.join(root, "frontdoor", "ca", "ca.key"),
+    frontdoorCaBundlesDir: import_node_path22.default.join(root, "frontdoor", "ca", "bundles"),
+    chatgptSignInFile: import_node_path22.default.join(root, "codex", "chatgpt-sign-in.json"),
+    frontdoorStateFile: import_node_path22.default.join(root, "frontdoor", "state.json"),
+    frontdoorLockFile: import_node_path22.default.join(root, "frontdoor", "start.lock"),
+    frontdoorControlTokenFile: import_node_path22.default.join(root, "frontdoor", "control-token"),
+    frontdoorSessionsDir: import_node_path22.default.join(root, "frontdoor", "sessions"),
+    frontdoorRcCredentialsDir: import_node_path22.default.join(root, "frontdoor", "rc-credentials"),
+    frontdoorLogPath: import_node_path22.default.join(root, "logs", "frontdoor.log"),
+    usageDir: import_node_path22.default.join(root, "usage"),
+    usageLogDir: import_node_path22.default.join(root, "usage", "log"),
+    usageSnapshotsDir: import_node_path22.default.join(root, "usage", "snapshots"),
+    usagePicksFile: import_node_path22.default.join(root, "usage", "picks.json")
   };
 }
 function resolveLayoutPaths() {
   return buildLayoutPaths(resolveAgentShimHome());
 }
-var import_node_fs4, import_node_os4, import_node_path21;
+var import_node_fs4, import_node_os4, import_node_path22;
 var init_paths = __esm({
   "src/paths.ts"() {
     "use strict";
     import_node_fs4 = __toESM(require("node:fs"), 1);
     import_node_os4 = __toESM(require("node:os"), 1);
-    import_node_path21 = __toESM(require("node:path"), 1);
-    init_state2();
+    import_node_path22 = __toESM(require("node:path"), 1);
     init_legacy();
   }
 });
@@ -5220,8 +5247,8 @@ function security(args, stdin) {
   return { status: result.status, stdout: result.stdout };
 }
 function createRealCredentialCache(root) {
-  const dir = import_node_path22.default.join(root, "credential-cache");
-  const filePath = (owner) => import_node_path22.default.join(dir, cacheFileNameFor(owner));
+  const dir = import_node_path23.default.join(root, "credential-cache");
+  const filePath = (owner) => import_node_path23.default.join(dir, cacheFileNameFor(owner));
   return {
     read(store, owner) {
       if (store === "file") {
@@ -5267,13 +5294,13 @@ function createRealCredentialCache(root) {
 function realCredentialCacheEnv(paths) {
   return { port: createRealCredentialCache(paths.root), platform: process.platform, now: () => Date.now() };
 }
-var import_node_child_process2, import_node_fs5, import_node_path22, KEYCHAIN_CACHE_SERVICE, CACHE_DIR_MODE, CACHE_FILE_MODE;
+var import_node_child_process2, import_node_fs5, import_node_path23, KEYCHAIN_CACHE_SERVICE, CACHE_DIR_MODE, CACHE_FILE_MODE;
 var init_realCredentialCache = __esm({
   "src/realCredentialCache.ts"() {
     "use strict";
     import_node_child_process2 = require("node:child_process");
     import_node_fs5 = __toESM(require("node:fs"), 1);
-    import_node_path22 = __toESM(require("node:path"), 1);
+    import_node_path23 = __toESM(require("node:path"), 1);
     init_credentialCache();
     KEYCHAIN_CACHE_SERVICE = "agent-shim-credential-cache";
     CACHE_DIR_MODE = 448;
@@ -5456,7 +5483,7 @@ var init_credential = __esm({
 
 // src/providersStore.ts
 function providerJsonPath(paths, name) {
-  return import_node_path23.default.join(paths.providersDir, `${name}.json`);
+  return import_node_path24.default.join(paths.providersDir, `${name}.json`);
 }
 function providerExists(paths, name) {
   return import_node_fs6.default.existsSync(providerJsonPath(paths, name));
@@ -5516,7 +5543,7 @@ function readProvider(paths, name) {
   return parseProviderFile(filePath, raw);
 }
 function loadProvider(providersDir, name, port) {
-  const filePath = import_node_path23.default.join(providersDir, `${name}.json`);
+  const filePath = import_node_path24.default.join(providersDir, `${name}.json`);
   const raw = port.readConfigFile(filePath);
   return raw === void 0 ? void 0 : parseProviderFile(filePath, raw);
 }
@@ -5670,12 +5697,12 @@ function resolveProvider(params) {
   }
   return { ok: true, provider: { name, definition, credential: resolution.credential }, warnings: resolution.credential.warnings };
 }
-var import_node_fs6, import_node_path23, ProviderNotFoundError, ProviderAlreadyExistsError, InvalidProviderNameError, PROVIDER_NAME_RE, LEGACY_PROVIDER_FIELDS, LEGACY_ENV_CREDENTIAL_KEYS, LEGACY_LITERAL_PLACEHOLDER, LegacyProviderFileError, ProviderKindMismatchError;
+var import_node_fs6, import_node_path24, ProviderNotFoundError, ProviderAlreadyExistsError, InvalidProviderNameError, PROVIDER_NAME_RE, LEGACY_PROVIDER_FIELDS, LEGACY_ENV_CREDENTIAL_KEYS, LEGACY_LITERAL_PLACEHOLDER, LegacyProviderFileError, ProviderKindMismatchError;
 var init_providersStore = __esm({
   "src/providersStore.ts"() {
     "use strict";
     import_node_fs6 = __toESM(require("node:fs"), 1);
-    import_node_path23 = __toESM(require("node:path"), 1);
+    import_node_path24 = __toESM(require("node:path"), 1);
     init_load();
     init_store();
     init_schema();
@@ -5887,10 +5914,10 @@ function commandFilename(ownExecutablePath, commandName) {
 }
 function resolveOwnBinaryCheck(paths, contentSourcePath) {
   const state = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-  const recordedTarget = state === void 0 ? void 0 : import_node_path25.default.resolve(state.targetPath);
+  const recordedTarget = state === void 0 ? void 0 : import_node_path26.default.resolve(state.targetPath);
   let ownStat;
   return (candidate) => {
-    if (recordedTarget !== void 0 && import_node_path25.default.resolve(candidate) === recordedTarget) {
+    if (recordedTarget !== void 0 && import_node_path26.default.resolve(candidate) === recordedTarget) {
       return true;
     }
     ownStat ??= statOrUndefined(contentSourcePath);
@@ -5913,22 +5940,22 @@ function statOrUndefined(target) {
   }
 }
 function findPathShadow(params) {
-  const resolvedTargetDir = import_node_path25.default.resolve(params.targetDir);
+  const resolvedTargetDir = import_node_path26.default.resolve(params.targetDir);
   for (const dir of params.pathDirs) {
     const found = params.findExecutableInDir(dir, params.targetFilename);
     if (found === void 0) {
       continue;
     }
-    return import_node_path25.default.resolve(dir) === resolvedTargetDir ? { status: "ok" } : { status: "shadowed", by: found };
+    return import_node_path26.default.resolve(dir) === resolvedTargetDir ? { status: "ok" } : { status: "shadowed", by: found };
   }
-  return params.pathDirs.some((dir) => import_node_path25.default.resolve(dir) === resolvedTargetDir) ? { status: "ok" } : { status: "not-on-path" };
+  return params.pathDirs.some((dir) => import_node_path26.default.resolve(dir) === resolvedTargetDir) ? { status: "ok" } : { status: "not-on-path" };
 }
-var import_node_fs7, import_node_path25, import_zod15, ClaudeShimStateSchema, nodeLinkFs;
+var import_node_fs7, import_node_path26, import_zod15, ClaudeShimStateSchema, nodeLinkFs;
 var init_claudeShim = __esm({
   "src/claudeShim.ts"() {
     "use strict";
     import_node_fs7 = __toESM(require("node:fs"), 1);
-    import_node_path25 = __toESM(require("node:path"), 1);
+    import_node_path26 = __toESM(require("node:path"), 1);
     import_zod15 = require("zod");
     init_commandDeps();
     init_store();
@@ -6378,7 +6405,7 @@ function buildEnv(params) {
   const parentCustomHeaders = params.baseEnv.ANTHROPIC_CUSTOM_HEADERS;
   let providerCustomHeaders;
   if (!params.configDirEscapeHatch && params.resolvedIdentityName !== void 0) {
-    env.CLAUDE_CONFIG_DIR = import_node_path30.default.join(params.identitiesDir, params.resolvedIdentityName);
+    env.CLAUDE_CONFIG_DIR = import_node_path31.default.join(params.identitiesDir, params.resolvedIdentityName);
   }
   if (params.provider !== void 0) {
     const providerEnv = params.provider.definition.env ?? {};
@@ -6422,11 +6449,11 @@ function buildEnv(params) {
   }
   return env;
 }
-var import_node_path30, LOOPBACK_HOSTS;
+var import_node_path31, LOOPBACK_HOSTS;
 var init_flags = __esm({
   "src/launcher/flags.ts"() {
     "use strict";
-    import_node_path30 = __toESM(require("node:path"), 1);
+    import_node_path31 = __toESM(require("node:path"), 1);
     init_envBool();
     init_credential();
     init_headers();
@@ -6772,7 +6799,7 @@ function prepareLaunch(params) {
     identityDefaultConfigProfile: loadedIdentity?.config.defaultConfigProfile,
     globalDefaultConfigProfile: params.globalDefaultConfigProfile
   });
-  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs12.readConfigFile(import_node_path31.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
+  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs12.readConfigFile(import_node_path32.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
     log.error(
       `agent-shim: no configuration profile named "${configProfileDecision.name}" (selected via ${configProfileDecision.source}). Run \`agent-shim profile add ${configProfileDecision.name}\` first.`
     );
@@ -6835,7 +6862,7 @@ function prepareLaunch(params) {
   );
   const updateCheck = runLaunchUpdateCheck({
     mode: params.updateMode ?? "off",
-    checkPath: import_node_path31.default.join(paths.root, "update.check"),
+    checkPath: import_node_path32.default.join(paths.root, "update.check"),
     currentVersion: package_default.version,
     port: params.update
   });
@@ -6972,12 +6999,12 @@ function runLaunchPlan(plan, spawn2) {
 function runLauncher(params) {
   params.proc.exit(runLaunchPlan(prepareLaunch(params), params.spawn));
 }
-var import_node_crypto10, import_node_path31;
+var import_node_crypto10, import_node_path32;
 var init_launcher = __esm({
   "src/launcher.ts"() {
     "use strict";
     import_node_crypto10 = require("node:crypto");
-    import_node_path31 = __toESM(require("node:path"), 1);
+    import_node_path32 = __toESM(require("node:path"), 1);
     init_package();
     init_envBool();
     init_argv();
@@ -7008,13 +7035,13 @@ function agentShimCliPath(distDir = typeof __AGENT_SHIM_DIST_DIR__ === "string"
   if (distDir === void 0) {
     throw new OwnCliPathUnknownError();
   }
-  return import_node_path32.default.join(distDir, OWN_CLI_FILE_NAME);
+  return import_node_path33.default.join(distDir, OWN_CLI_FILE_NAME);
 }
-var import_node_path32, OWN_CLI_FILE_NAME, OwnCliPathUnknownError;
+var import_node_path33, OWN_CLI_FILE_NAME, OwnCliPathUnknownError;
 var init_ownCli = __esm({
   "src/ownCli.ts"() {
     "use strict";
-    import_node_path32 = __toESM(require("node:path"), 1);
+    import_node_path33 = __toESM(require("node:path"), 1);
     init_cliError();
     OWN_CLI_FILE_NAME = "cli.cjs";
     OwnCliPathUnknownError = class extends CliError {
@@ -7099,7 +7126,7 @@ request.on("error", (error) => finish(failed, (error.code ? error.code + ": " :
 // src/frontdoor/trust.ts
 function resolveTrustBundle(params) {
   const { caCertFile, bundlesDir, variable, inherited, fs: fs12 } = params;
-  if (inherited === void 0 || inherited === "" || import_node_path33.default.resolve(inherited) === import_node_path33.default.resolve(caCertFile)) {
+  if (inherited === void 0 || inherited === "" || import_node_path34.default.resolve(inherited) === import_node_path34.default.resolve(caCertFile)) {
     return { path: caCertFile };
   }
   const caPem = fs12.readFileUtf8(caCertFile);
@@ -7117,19 +7144,19 @@ function resolveTrustBundle(params) {
   }
   const combined = `${inheritedPem.trimEnd()}
 ${caPem}`;
-  const bundle = import_node_path33.default.join(bundlesDir, `${(0, import_node_crypto11.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
+  const bundle = import_node_path34.default.join(bundlesDir, `${(0, import_node_crypto11.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
   if (!fs12.exists(bundle)) {
     fs12.mkdirp(bundlesDir);
     fs12.writeFileAtomic(bundle, combined);
   }
   return { path: bundle };
 }
-var import_node_crypto11, import_node_path33, BUNDLE_NAME_HEX_DIGITS;
+var import_node_crypto11, import_node_path34, BUNDLE_NAME_HEX_DIGITS;
 var init_trust = __esm({
   "src/frontdoor/trust.ts"() {
     "use strict";
     import_node_crypto11 = require("node:crypto");
-    import_node_path33 = __toESM(require("node:path"), 1);
+    import_node_path34 = __toESM(require("node:path"), 1);
     BUNDLE_NAME_HEX_DIGITS = 16;
   }
 });
@@ -7882,6 +7909,7 @@ __export(index_exports, {
   updateDirectoryRule: () => updateDirectoryRule,
   updateProvider: () => updateProvider,
   useIdentity: () => useIdentity,
+  watchedInstallEntry: () => watchedInstallEntry,
   writeDirectoryRules: () => writeDirectoryRules
 });
 module.exports = __toCommonJS(index_exports);
@@ -8219,12 +8247,22 @@ init_capability();
 init_route();
 
 // src/frontdoor/supervisor.ts
+var import_node_path9 = __toESM(require("node:path"), 1);
 init_state();
+function watchedInstallEntry(resolvedOwnExecutablePath, siblingExists) {
+  const parsed = import_node_path9.default.parse(resolvedOwnExecutablePath);
+  if (parsed.name === "agent-shim") {
+    return resolvedOwnExecutablePath;
+  }
+  const sibling = import_node_path9.default.join(parsed.dir, `agent-shim${parsed.ext}`);
+  return siblingExists(sibling) ? sibling : resolvedOwnExecutablePath;
+}
 var FRONTDOOR_SUPERVISOR_STILL_RUNNING = -1;
 var FRONTDOOR_POLL_MS = 1e3;
 var MS_PER_MINUTE = 6e4;
 async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {}) {
   const { fs: fs12, paths } = ports;
+  const servingBinary = ports.statOwnExecutable();
   const previous = readFrontDoorState(fs12, paths.frontdoorStateFile);
   let lastPort = previous?.lastPort;
   let lastConnectPort = previous?.lastConnectPort;
@@ -8287,6 +8325,18 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
   ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http3.port)}, CONNECT surface on 127.0.0.1:${String(connect3.port)}`);
   let idleSince;
   let ticks = 0;
+  const binaryReplaced = () => {
+    const current = ports.statOwnExecutable();
+    return current !== void 0 && servingBinary !== void 0 && (current.dev !== servingBinary.dev || current.ino !== servingBinary.ino || current.size !== servingBinary.size || current.mtimeMs !== servingBinary.mtimeMs);
+  };
+  const shutdown = async () => {
+    await direct.close();
+    await connect3.close();
+    await http3.close();
+    ports.closeRcStreamHub();
+    writeFrontDoorState(fs12, paths.frontdoorStateFile, sticky());
+    return 0;
+  };
   for (; ; ) {
     if (options.tickLimit !== void 0 && ticks >= options.tickLimit) {
       return FRONTDOOR_SUPERVISOR_STILL_RUNNING;
@@ -8298,16 +8348,16 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     ports.checkQuotaExpiry();
     const prunedPids = new Set(pruned);
     if (listed.filter((session) => !prunedPids.has(session.pid)).length === 0) {
+      if (ticks > 1 && binaryReplaced()) {
+        ports.log("agent-shim frontdoor supervisor: the installed binary changed and no sessions are live; turning the door over for the next launch");
+        ports.doorHealth.binaryTurnover();
+        return await shutdown();
+      }
       idleSince ??= ports.now();
       if (ports.now() - idleSince >= idleShutdownMinutes * MS_PER_MINUTE) {
         ports.log(`agent-shim frontdoor supervisor: no sessions for ${String(idleShutdownMinutes)} minute(s); closing the front door and exiting`);
         ports.doorHealth.idleShutdown();
-        await direct.close();
-        await connect3.close();
-        await http3.close();
-        ports.closeRcStreamHub();
-        writeFrontDoorState(fs12, paths.frontdoorStateFile, sticky());
-        return 0;
+        return await shutdown();
       }
     } else {
       idleSince = void 0;
@@ -8361,8 +8411,8 @@ function parseConnectTarget(authority) {
 function isInterceptedHost(host, interceptHosts) {
   return interceptHosts.includes(host);
 }
-function servedByPipeline(path34) {
-  return path34?.startsWith(ROUTED_PATH_PREFIX) === true;
+function servedByPipeline(path35) {
+  return path35?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
   "connection",
@@ -8896,11 +8946,11 @@ function createRcSessionTracker(deps) {
   };
   const observeExchange = (request4) => {
     const method = (request4.method ?? "").toUpperCase();
-    const path34 = new URL(request4.url ?? "/", "http://127.0.0.1").pathname;
-    if (!path34.startsWith(RC_SESSIONS_PATH_PREFIX)) {
+    const path35 = new URL(request4.url ?? "/", "http://127.0.0.1").pathname;
+    if (!path35.startsWith(RC_SESSIONS_PATH_PREFIX)) {
       return void 0;
     }
-    const tail = path34.slice(RC_SESSIONS_PATH_PREFIX.length);
+    const tail = path35.slice(RC_SESSIONS_PATH_PREFIX.length);
     const facts = {
       oauthAuthorization: oauthAuthorizationOf(request4.headers),
       anthropicVersion: singleHeader(request4.headers, "anthropic-version"),
@@ -9282,8 +9332,8 @@ var RC_READ_FILE_ENCODINGS = ["utf-8", "base64"];
 function isRcReadFileEncoding(value) {
   return RC_READ_FILE_ENCODINGS.some((encoding) => encoding === value);
 }
-function buildRcReadFilePayload(requestId, path34, options) {
-  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path34, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
+function buildRcReadFilePayload(requestId, path35, options) {
+  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path35, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
 }
 function buildRcFileSuggestionsPayload(requestId, query) {
   return buildRcControlRequestPayload(requestId, { subtype: "file_suggestions", query });
@@ -9385,15 +9435,15 @@ async function getRcSessionContextUsage(deps, sessionId, detail) {
   const result = await deliverRcClientPayload(deps, sessionId, buildRcGetContextUsagePayload(requestId, detail), `request the context usage of session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
-async function readRcSessionFile(deps, sessionId, path34, options) {
-  if (path34 === "") {
+async function readRcSessionFile(deps, sessionId, path35, options) {
+  if (path35 === "") {
     return { ok: false, message: "a read-file write needs a non-empty path: the SDK's own field names the file the worker resolves against the session's cwd, and an empty string names none" };
   }
   if (options?.maxBytes !== void 0 && (!Number.isInteger(options.maxBytes) || options.maxBytes <= 0)) {
     return { ok: false, message: "a read-file write's max-bytes is a positive whole number of bytes: the SDK's own field caps the read, and a zero or negative cap reads nothing" };
   }
   const requestId = deps.newUuid();
-  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path34, options), `read ${path34} from session ${sessionId}`);
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path35, options), `read ${path35} from session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
 async function suggestRcSessionFiles(deps, sessionId, query) {
@@ -9562,11 +9612,11 @@ function createRcControlHandler(deps) {
       path: "read-file",
       read: (body) => {
         const session = bodyString(body, "session");
-        const path34 = bodyString(body, "path");
+        const path35 = bodyString(body, "path");
         const maxBytes = "maxBytes" in body ? bodyPositiveInteger(body, "maxBytes") : void 0;
         const encoding = "encoding" in body && isRcReadFileEncoding(body.encoding) ? body.encoding : void 0;
-        const refused2 = session === void 0 || path34 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
-        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path34, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
+        const refused2 = session === void 0 || path35 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
+        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path35, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
       }
     },
     {
@@ -9876,9 +9926,9 @@ function requestIdOfBody(body) {
 }
 function frontDoorRcControl(transport, token) {
   const headers = { authorization: `Bearer ${token}` };
-  const listAnswerOf = async (path34, what) => {
+  const listAnswerOf = async (path35, what) => {
     try {
-      return await transport.request({ method: "GET", path: path34, headers });
+      return await transport.request({ method: "GET", path: path35, headers });
     } catch (error) {
       throw new Error(`${what}: could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
     }
@@ -9950,10 +10000,10 @@ function frontDoorRcControl(transport, token) {
     }
     return pending;
   };
-  const writeOf = async (path34, body, describeFailure) => {
+  const writeOf = async (path35, body, describeFailure) => {
     let answer;
     try {
-      answer = await transport.request({ method: "POST", path: path34, headers: { ...headers, "content-type": "application/json" }, body });
+      answer = await transport.request({ method: "POST", path: path35, headers: { ...headers, "content-type": "application/json" }, body });
     } catch (error) {
       return { ok: false, message: `could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}` };
     }
@@ -9984,10 +10034,10 @@ function frontDoorRcControl(transport, token) {
     endSession: async (sessionId, reason) => await writeOf(`${CONTROL_PATH_PREFIX}/end-session`, JSON.stringify({ session: sessionId, ...reason === void 0 ? {} : { reason } }), (status, message) => `ending ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getUsage: async (sessionId, skipBehaviors) => await writeOf(`${CONTROL_PATH_PREFIX}/get-usage`, JSON.stringify({ session: sessionId, ...skipBehaviors === void 0 ? {} : { skipBehaviors } }), (status, message) => `requesting the usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getContextUsage: async (sessionId, detail) => await writeOf(`${CONTROL_PATH_PREFIX}/get-context-usage`, JSON.stringify({ session: sessionId, ...detail === void 0 ? {} : { detail } }), (status, message) => `requesting the context usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
-    readFile: async (sessionId, path34, options) => await writeOf(
+    readFile: async (sessionId, path35, options) => await writeOf(
       `${CONTROL_PATH_PREFIX}/read-file`,
-      JSON.stringify({ session: sessionId, path: path34, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
-      (status, message) => `reading ${path34} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
+      JSON.stringify({ session: sessionId, path: path35, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
+      (status, message) => `reading ${path35} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
     ),
     fileSuggestions: async (sessionId, query) => await writeOf(`${CONTROL_PATH_PREFIX}/file-suggestions`, JSON.stringify({ session: sessionId, query }), (status, message) => `requesting file suggestions from ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     keepAlive: async (sessionId) => await writeOf(`${CONTROL_PATH_PREFIX}/keep-alive`, JSON.stringify({ session: sessionId }), (status, message) => `keeping ${sessionId} alive failed (HTTP ${String(status)}): ${message}`),
@@ -10142,12 +10192,12 @@ function tlsFacts(options) {
 }
 function realRcEventDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const post = async (path34, headers, body) => await new Promise((resolve, reject) => {
+  const post = async (path35, headers, body) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method: "POST",
-      path: path34,
+      path: path35,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, "content-length": String(Buffer.byteLength(body, "utf8")) },
       agent
@@ -10212,12 +10262,12 @@ function lateRcStreamDial(resolve) {
 }
 function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const request4 = async (method, path34, headers, body, signal) => await new Promise((resolve, reject) => {
+  const request4 = async (method, path35, headers, body, signal) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method,
-      path: path34,
+      path: path35,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, ...body === void 0 ? {} : { "content-length": String(Buffer.byteLength(body, "utf8")) } },
       agent,
@@ -10259,9 +10309,9 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
       return { status, body: await readAll(response) };
     },
     openStream: async (sessionId, headers, resume, signal) => {
-      const path34 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
+      const path35 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
       const streamHeaders = resume === void 0 ? headers : { ...headers, "last-event-id": String(resume.fromSequenceNum) };
-      const { status, response } = await request4("GET", path34, streamHeaders, void 0, signal);
+      const { status, response } = await request4("GET", path35, streamHeaders, void 0, signal);
       if (!isSuccessful2(status)) {
         await readAll(response);
         return { status, chunks: NO_CHUNKS };
@@ -10473,7 +10523,7 @@ function realConnectEffects(ports = DOOR_SOURCE_PORTS) {
 }
 
 // src/frontdoor/rcCredentialStore.ts
-var import_node_path9 = __toESM(require("node:path"), 1);
+var import_node_path10 = __toESM(require("node:path"), 1);
 function isSafeSessionId(sessionId) {
   return /^[A-Za-z0-9_-]+$/.test(sessionId);
 }
@@ -10499,7 +10549,7 @@ function sequenceNumOfJson(value) {
 }
 function createRcCredentialStore(fs12, dir) {
   fs12.mkdirPrivate(dir);
-  const fileFor = (sessionId) => import_node_path9.default.join(dir, `${sessionId}.json`);
+  const fileFor = (sessionId) => import_node_path10.default.join(dir, `${sessionId}.json`);
   const readParsed = (sessionId) => {
     const raw = fs12.readFileUtf8(fileFor(sessionId));
     if (raw === void 0) {
@@ -10955,7 +11005,7 @@ init_cliError();
 
 // src/configProfilesStore.ts
 var import_node_fs3 = __toESM(require("node:fs"), 1);
-var import_node_path20 = __toESM(require("node:path"), 1);
+var import_node_path21 = __toESM(require("node:path"), 1);
 init_store();
 init_schema();
 init_cliError();
@@ -10985,7 +11035,7 @@ var InvalidCategoryNameError = class extends CliError {
   categoryName;
 };
 function profileJsonPath(paths, name) {
-  return import_node_path20.default.join(paths.configProfilesDir, `${name}.json`);
+  return import_node_path21.default.join(paths.configProfilesDir, `${name}.json`);
 }
 function profileExists(paths, name) {
   return import_node_fs3.default.existsSync(profileJsonPath(paths, name));
@@ -11125,19 +11175,19 @@ function writePools(paths, pools) {
   applyPatch(paths.globalConfigFile, GlobalConfigSchema, { pools }, { defaults: {} });
 }
 function poolCycleOf(pools, name) {
-  const walk = (current, path34) => {
+  const walk = (current, path35) => {
     for (const entry of pools[current]?.identities ?? []) {
       const nested = poolNameOf(poolMemberIdentity(entry));
       if (nested === void 0) {
         continue;
       }
       if (nested === name) {
-        return [...path34, nested];
+        return [...path35, nested];
       }
-      if (path34.includes(nested)) {
+      if (path35.includes(nested)) {
         continue;
       }
-      const found = walk(nested, [...path34, nested]);
+      const found = walk(nested, [...path35, nested]);
       if (found !== void 0) {
         return found;
       }
@@ -11236,7 +11286,7 @@ init_paths();
 init_realCredentialCache();
 init_providersStore();
 init_realPorts();
-var import_node_path24 = __toESM(require("node:path"), 1);
+var import_node_path25 = __toESM(require("node:path"), 1);
 var import_zod12 = require("zod");
 init_envBool();
 init_load();
@@ -11585,10 +11635,10 @@ function collectCheckReport(params) {
   }).input;
   const providerName = cascadeProviderName(cascade);
   const provider = providerName === void 0 ? void 0 : loadCheckProvider(paths, providerName);
-  const farmRoot = identityDecision.name === void 0 ? void 0 : import_node_path24.default.join(paths.identitiesDir, identityDecision.name);
+  const farmRoot = identityDecision.name === void 0 ? void 0 : import_node_path25.default.join(paths.identitiesDir, identityDecision.name);
   const settingsFiles = {
-    "settings.json": realFsPort.readFileUtf8(import_node_path24.default.join(claudeHome, "settings.json")),
-    "settings.local.json": realFsPort.readFileUtf8(import_node_path24.default.join(claudeHome, "settings.local.json"))
+    "settings.json": realFsPort.readFileUtf8(import_node_path25.default.join(claudeHome, "settings.json")),
+    "settings.local.json": realFsPort.readFileUtf8(import_node_path25.default.join(claudeHome, "settings.local.json"))
   };
   const report = runCheck({
     cwd,
@@ -11808,7 +11858,7 @@ init_middleware();
 init_preflight();
 
 // src/frontdoor/controlSchemas.ts
-var import_node_path28 = __toESM(require("node:path"), 1);
+var import_node_path29 = __toESM(require("node:path"), 1);
 var import_zod19 = require("zod");
 
 // src/doctorReport.ts
@@ -11817,7 +11867,7 @@ init_store();
 
 // src/identityStore.ts
 var import_node_fs8 = __toESM(require("node:fs"), 1);
-var import_node_path26 = __toESM(require("node:path"), 1);
+var import_node_path27 = __toESM(require("node:path"), 1);
 init_load();
 init_store();
 init_schema();
@@ -11851,7 +11901,7 @@ var InvalidIdentityNameError = class extends CliError {
   attemptedName;
 };
 function identityJsonPath(paths, name) {
-  return import_node_path26.default.join(paths.identitiesDir, name, "identity.json");
+  return import_node_path27.default.join(paths.identitiesDir, name, "identity.json");
 }
 function identityExists(paths, name) {
   return import_node_fs8.default.existsSync(identityJsonPath(paths, name));
@@ -11952,7 +12002,7 @@ function setIdentityCredential(paths, identityName, change) {
   });
 }
 function belongsToIdentity(entry, name) {
-  return entry === name || entry === import_node_path26.default.basename(identityLockPath("", name)) || entry.startsWith(`.${name}.scratch.`) || entry.startsWith(`.${name}.previous.`);
+  return entry === name || entry === import_node_path27.default.basename(identityLockPath("", name)) || entry.startsWith(`.${name}.scratch.`) || entry.startsWith(`.${name}.previous.`);
 }
 function removeIdentity(paths, name) {
   if (!identityExists(paths, name)) {
@@ -11960,7 +12010,7 @@ function removeIdentity(paths, name) {
   }
   for (const entry of import_node_fs8.default.readdirSync(paths.identitiesDir)) {
     if (belongsToIdentity(entry, name)) {
-      import_node_fs8.default.rmSync(import_node_path26.default.join(paths.identitiesDir, entry), { recursive: true, force: true });
+      import_node_fs8.default.rmSync(import_node_path27.default.join(paths.identitiesDir, entry), { recursive: true, force: true });
     }
   }
   if (readActiveIdentity2(paths) === name) {
@@ -11971,7 +12021,7 @@ function removeIdentity(paths, name) {
 // src/doctorReport.ts
 init_realPorts();
 var import_node_fs9 = __toESM(require("node:fs"), 1);
-var import_node_path27 = __toESM(require("node:path"), 1);
+var import_node_path28 = __toESM(require("node:path"), 1);
 
 // src/codex/siwcStore.ts
 var import_zod18 = require("zod");
@@ -12103,8 +12153,18 @@ function validateJson(schema, input) {
   }
   return { ok: true, data: result.data };
 }
+function tcpPortEraRecord(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return false;
+  }
+  const has = (key) => typeof parsed === "object" && parsed !== null && key in parsed;
+  return (has("port") || has("lastPort")) && !has("socketPath");
+}
 function pushPathResolution(push, resolution) {
-  const ownDir = import_node_path27.default.dirname(resolution.ownExecutablePath);
+  const ownDir = import_node_path28.default.dirname(resolution.ownExecutablePath);
   switch (resolution.agentShim.status) {
     case "ok":
       push("path-resolution", "pass", `\`agent-shim\` on PATH resolves to this running executable, ${resolution.ownExecutablePath}.`, "agent-shim");
@@ -12203,14 +12263,14 @@ function pushProvider(push, entry, cacheEnv, signIn) {
 }
 function pushLegacyName(push, params) {
   const legacyVariables = Object.keys(params.env).filter((name) => name.startsWith(LEGACY_ENV_PREFIX) && params.env[name] !== void 0).sort();
-  if (legacyVariables.length === 0 && import_node_path27.default.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
+  if (legacyVariables.length === 0 && import_node_path28.default.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
     push("legacy-name", "pass", "Nothing here still uses the former `claude-use` name.");
     return;
   }
   for (const name of legacyVariables) {
     push("legacy-name", "warn", `${name} is the former name of ${name.replace(LEGACY_ENV_PREFIX, ENV_PREFIX)}. Rename it; the old name still works but is only a fallback.`, name);
   }
-  if (import_node_path27.default.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
+  if (import_node_path28.default.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
     push(
       "legacy-name",
       "warn",
@@ -12412,6 +12472,8 @@ function runDoctor(params) {
   }
   if (params.headroom.state.raw === void 0) {
     push("headroom", "pass", "No headroom daemon has ever run; nothing to check.");
+  } else if (tcpPortEraRecord(params.headroom.state.raw)) {
+    push("headroom", "pass", `${params.headroom.state.path} holds a previous release's TCP-port state record; the next launch through headroom claims over it.`);
   } else {
     const validated2 = validateJson(HeadroomStateSchema, params.headroom.state);
     if (!validated2.ok) {
@@ -12550,18 +12612,18 @@ function collectDoctorReport(params) {
   const { paths } = params;
   const identityNames = import_node_fs9.default.existsSync(paths.identitiesDir) ? import_node_fs9.default.readdirSync(paths.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && isIdentityDirectoryName(entry.name)).map((entry) => entry.name).sort() : [];
   const identities = identityNames.map((name) => {
-    const farmRoot = import_node_path27.default.join(paths.identitiesDir, name);
-    const identityPath = import_node_path27.default.join(farmRoot, "identity.json");
+    const farmRoot = import_node_path28.default.join(paths.identitiesDir, name);
+    const identityPath = import_node_path28.default.join(farmRoot, "identity.json");
     return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot };
   });
   const profileNames = import_node_fs9.default.existsSync(paths.configProfilesDir) ? import_node_fs9.default.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const configProfiles = profileNames.map((name) => {
-    const profilePath = import_node_path27.default.join(paths.configProfilesDir, `${name}.json`);
+    const profilePath = import_node_path28.default.join(paths.configProfilesDir, `${name}.json`);
     return { name, path: profilePath, raw: realFsPort.readFileUtf8(profilePath) };
   });
   const providerNames = import_node_fs9.default.existsSync(paths.providersDir) ? import_node_fs9.default.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const providers = providerNames.map((name) => {
-    const providerPath = import_node_path27.default.join(paths.providersDir, `${name}.json`);
+    const providerPath = import_node_path28.default.join(paths.providersDir, `${name}.json`);
     return { name, path: providerPath, raw: realFsPort.readFileUtf8(providerPath) };
   });
   const ownExecutablePath = realOwnExecutablePath();
@@ -12573,12 +12635,12 @@ function collectDoctorReport(params) {
     binaryDiscovery = { ok: false, message: error instanceof Error ? error.message : String(error) };
   }
   const shimState = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-  const pathDirs = (params.env.PATH ?? "").split(import_node_path27.default.delimiter).filter((dir) => dir !== "");
+  const pathDirs = (params.env.PATH ?? "").split(import_node_path28.default.delimiter).filter((dir) => dir !== "");
   const claudeShimShadow = shimState === void 0 ? void 0 : refinePathShadow(
     findPathShadow({
       pathDirs,
-      targetDir: import_node_path27.default.dirname(shimState.targetPath),
-      targetFilename: import_node_path27.default.basename(shimState.targetPath),
+      targetDir: import_node_path28.default.dirname(shimState.targetPath),
+      targetFilename: import_node_path28.default.basename(shimState.targetPath),
       findExecutableInDir
     }),
     shimState.targetPath,
@@ -12604,7 +12666,7 @@ function collectDoctorReport(params) {
       agentShim: refinePathShadow(
         findPathShadow({
           pathDirs,
-          targetDir: import_node_path27.default.dirname(ownExecutablePath),
+          targetDir: import_node_path28.default.dirname(ownExecutablePath),
           targetFilename: commandFilename(ownExecutablePath, "agent-shim"),
           findExecutableInDir
         }),
@@ -12616,7 +12678,12 @@ function collectDoctorReport(params) {
     run: realRunPort,
     platform: process.platform,
     headroom: {
-      state: { path: paths.headroomStateFile, raw: realFsPort.readFileUtf8(paths.headroomStateFile) },
+      // Read-only resolution like `headroom status`: the doctor reports whichever record a launch would join, migrating nothing.
+      state: (() => {
+        const resolved = resolveServingHeadroomState(realFarmFs, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, realIsProcessRunning);
+        const statePath = resolved?.path ?? paths.headroomStateFile;
+        return { path: statePath, raw: realFarmFs.readFileUtf8(statePath) };
+      })(),
       isRunning: realIsProcessRunning
     }
   });
@@ -12673,11 +12740,11 @@ var FrontDoorSessionsOutputSchema = import_zod19.z.strictObject({ sessions: impo
 var CheckRunInputSchema = import_zod19.z.strictObject({
   path: import_zod19.z.string().min(1),
   identity: import_zod19.z.string().min(1).optional()
-}).refine((input) => import_node_path28.default.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+}).refine((input) => import_node_path29.default.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
 var PoolPickInputSchema = import_zod19.z.strictObject({
   pool: import_zod19.z.string().min(1),
   path: import_zod19.z.string().min(1)
-}).refine((input) => import_node_path28.default.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+}).refine((input) => import_node_path29.default.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
 var DoctorFindingSchema = import_zod19.z.strictObject({
   section: import_zod19.z.enum(DOCTOR_SECTIONS),
   subject: import_zod19.z.string().optional(),
@@ -12719,6 +12786,7 @@ var LaunchLifecycleEventSchema = import_zod20.z.strictObject({
 var DoorHealthEventSchema = import_zod20.z.discriminatedUnion("kind", [
   import_zod20.z.strictObject({ kind: import_zod20.z.literal("generation"), pid: import_zod20.z.number().int().positive(), providerPort: import_zod20.z.number().int().positive(), connectPort: import_zod20.z.number().int().positive(), directPort: import_zod20.z.number().int().positive(), observedAt: import_zod20.z.number() }),
   import_zod20.z.strictObject({ kind: import_zod20.z.literal("listenerFailed"), pid: import_zod20.z.number().int().positive(), listener: import_zod20.z.enum(["provider", "connect", "direct"]), message: import_zod20.z.string(), observedAt: import_zod20.z.number() }),
+  import_zod20.z.strictObject({ kind: import_zod20.z.literal("binaryTurnover"), pid: import_zod20.z.number().int().positive(), observedAt: import_zod20.z.number() }),
   import_zod20.z.strictObject({ kind: import_zod20.z.literal("idleShutdown"), pid: import_zod20.z.number().int().positive(), observedAt: import_zod20.z.number() })
 ]);
 var QuotaExpiringEventSchema = import_zod20.z.strictObject({
@@ -12882,7 +12950,7 @@ init_socket();
 init_state2();
 init_state();
 function headroomSocketTarget(fsPort, trust, paths) {
-  const socketPath = readHeadroomState(fsPort, paths.headroomStateFile)?.socketPath;
+  const socketPath = readHeadroomState(fsPort, paths.headroomStateFile)?.socketPath ?? readHeadroomState(fsPort, paths.headroomLegacyStateFile)?.socketPath;
   return socketPath === void 0 ? void 0 : verifyHeadroomSocket(socketPath, trust);
 }
 function collectFrontDoorStatus(fsPort, socketTrust, paths, isRunning) {
@@ -13090,6 +13158,9 @@ function createDoorHealthPublisher(hub, now, pid) {
     },
     idleShutdown: () => {
       publisher.publish({ kind: "idleShutdown", pid, observedAt: now() });
+    },
+    binaryTurnover: () => {
+      publisher.publish({ kind: "binaryTurnover", pid, observedAt: now() });
     }
   };
 }
@@ -14784,7 +14855,7 @@ data: ${JSON.stringify(envelope)}
 }
 
 // src/frontdoor/rcSelfHostMint.ts
-var import_node_path29 = __toESM(require("node:path"), 1);
+var import_node_path30 = __toESM(require("node:path"), 1);
 init_account();
 var CREDENTIALS_FILE = ".credentials.json";
 var CLAUDE_JSON2 = ".claude.json";
@@ -14809,7 +14880,7 @@ function readJsonObject(fs12, file) {
   return isRecord11(parsed) ? parsed : void 0;
 }
 function readRcSelfHostRecord(fs12, frontdoorDir) {
-  const parsed = readJsonObject(fs12, import_node_path29.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
+  const parsed = readJsonObject(fs12, import_node_path30.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
   if (parsed === void 0) {
     return void 0;
   }
@@ -14823,11 +14894,11 @@ function mintRcSelfHostCredential(deps) {
   if (!isIdentityName(deps.identity)) {
     throw new Error(`"${deps.identity}" is not a valid identity name.`);
   }
-  const identityDir = import_node_path29.default.join(deps.identitiesDir, deps.identity);
-  const credentialsFile = import_node_path29.default.join(identityDir, CREDENTIALS_FILE);
-  const claudeJsonFile = import_node_path29.default.join(identityDir, CLAUDE_JSON2);
-  const recordDir = import_node_path29.default.join(deps.frontdoorDir, RC_SELF_HOST_RECORD_DIR);
-  const recordFile = import_node_path29.default.join(recordDir, RC_SELF_HOST_RECORD_FILE);
+  const identityDir = import_node_path30.default.join(deps.identitiesDir, deps.identity);
+  const credentialsFile = import_node_path30.default.join(identityDir, CREDENTIALS_FILE);
+  const claudeJsonFile = import_node_path30.default.join(identityDir, CLAUDE_JSON2);
+  const recordDir = import_node_path30.default.join(deps.frontdoorDir, RC_SELF_HOST_RECORD_DIR);
+  const recordFile = import_node_path30.default.join(recordDir, RC_SELF_HOST_RECORD_FILE);
   const previousRecord = readRcSelfHostRecord(deps.fs, deps.frontdoorDir);
   const existingCredentials = readJsonObject(deps.fs, credentialsFile);
   const existingOauth = isRecord11(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
@@ -14843,7 +14914,7 @@ function mintRcSelfHostCredential(deps) {
   const organizationUuid = deps.newUuid();
   const accountUuid = deps.newUuid();
   const mintedAt = new Date(deps.now()).toISOString();
-  deps.fs.mkdirPrivate(import_node_path29.default.dirname(credentialsFile));
+  deps.fs.mkdirPrivate(import_node_path30.default.dirname(credentialsFile));
   deps.fs.writeFilePrivate(credentialsFile, `${JSON.stringify({ ...existingCredentials, claudeAiOauth: { accessToken, refreshToken, expiresAt: null, scopes: [...RC_SELF_HOST_SCOPE_LIST], subscriptionType: SELF_HOST_SUBSCRIPTION_TYPE, rateLimitTier: null } }, null, 2)}
 `);
   const claudeJson = readJsonObject(deps.fs, claudeJsonFile) ?? {};
@@ -15376,5 +15447,6 @@ init_ownCli();
   updateDirectoryRule,
   updateProvider,
   useIdentity,
+  watchedInstallEntry,
   writeDirectoryRules
 });