agent-shim 8.43.0 → 9.0.0

package/dist/index.mjs

@@ -2619,7 +2619,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "agent-shim",
-      version: "8.43.0",
+      version: "9.0.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -2723,7 +2723,7 @@ var init_package = __esm({
 
 // src/headroom/state.ts
 import { createHash as createHash3 } from "node:crypto";
-import path10 from "node:path";
+import path11 from "node:path";
 import { z as z5 } from "zod";
 function parseJson(raw, schema) {
   if (raw === void 0 || raw.trim() === "") {
@@ -2740,10 +2740,36 @@ function readHeadroomState(fs12, stateFile) {
   }
 }
 function writeHeadroomState(fs12, stateFile, state) {
-  fs12.mkdirp(path10.dirname(stateFile));
+  fs12.mkdirp(path11.dirname(stateFile));
   fs12.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
 `);
 }
+function resolveServingHeadroomState(fs12, files, isRunning) {
+  const current = readHeadroomState(fs12, files.stateFile);
+  if (current !== void 0) {
+    return { path: files.stateFile, state: current };
+  }
+  const legacy = readHeadroomState(fs12, files.legacyStateFile);
+  if (legacy?.supervisorPid !== void 0 && isRunning(legacy.supervisorPid)) {
+    return { path: files.legacyStateFile, state: legacy };
+  }
+  return void 0;
+}
+function migrateHeadroomState(fs12, files, isRunning) {
+  const legacy = readHeadroomState(fs12, files.legacyStateFile);
+  const legacyLive = legacy?.supervisorPid !== void 0 && isRunning(legacy.supervisorPid);
+  const current = readHeadroomState(fs12, files.stateFile);
+  if (current !== void 0 || legacyLive) {
+    if (!legacyLive && fs12.readFileUtf8(files.legacyStateFile) !== void 0) {
+      fs12.removeRecursive(files.legacyStateFile);
+    }
+    return;
+  }
+  if (legacy !== void 0) {
+    writeHeadroomState(fs12, files.stateFile, legacy);
+  }
+  fs12.removeRecursive(files.legacyStateFile);
+}
 function headroomAllowlist(providers) {
   const urls = /* @__PURE__ */ new Set([HEADROOM_ANTHROPIC_UPSTREAM]);
   for (const provider of providers) {
@@ -2768,7 +2794,7 @@ function readAllProviders(fs12, providersDir) {
       continue;
     }
     try {
-      const parsed = parseJson(fs12.readFileUtf8(path10.join(providersDir, name)), ProviderSchema);
+      const parsed = parseJson(fs12.readFileUtf8(path11.join(providersDir, name)), ProviderSchema);
       if (parsed !== void 0) {
         result.push({ name: name.slice(0, -".json".length), provider: parsed });
       }
@@ -2780,11 +2806,11 @@ function readAllProviders(fs12, providersDir) {
 }
 function writeSession(fs12, sessionsDir, session) {
   fs12.mkdirp(sessionsDir);
-  fs12.writeFileUtf8(path10.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
+  fs12.writeFileUtf8(path11.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
 `);
 }
 function removeSession(fs12, sessionsDir, pid) {
-  fs12.removeRecursive(path10.join(sessionsDir, `${String(pid)}.json`));
+  fs12.removeRecursive(path11.join(sessionsDir, `${String(pid)}.json`));
 }
 function listSessions(fs12, sessionsDir) {
   const sessions = [];
@@ -2793,7 +2819,7 @@ function listSessions(fs12, sessionsDir) {
       continue;
     }
     try {
-      const parsed = parseJson(fs12.readFileUtf8(path10.join(sessionsDir, name)), HeadroomSessionSchema);
+      const parsed = parseJson(fs12.readFileUtf8(path11.join(sessionsDir, name)), HeadroomSessionSchema);
       if (parsed !== void 0) {
         sessions.push(parsed);
       }
@@ -2823,13 +2849,12 @@ function readStartLock(fs12, lockFile) {
     return void 0;
   }
 }
-var HEADROOM_ANTHROPIC_UPSTREAM, HEADROOM_STATE_SCHEMA_VERSION, HeadroomStateSchema, HeadroomSessionSchema, HeadroomLockSchema;
+var HEADROOM_ANTHROPIC_UPSTREAM, HeadroomStateSchema, HeadroomSessionSchema, HeadroomLockSchema;
 var init_state2 = __esm({
   "src/headroom/state.ts"() {
     "use strict";
     init_schema();
     HEADROOM_ANTHROPIC_UPSTREAM = "https://api.anthropic.com";
-    HEADROOM_STATE_SCHEMA_VERSION = 2;
     HeadroomStateSchema = z5.strictObject({
       /** The supervisor process owning the daemon. Alive means someone is keeping headroom running. */
       supervisorPid: z5.number().int().positive().optional(),
@@ -2861,8 +2886,9 @@ function ensureHeadroom(params) {
   const deadline = ports.now() + HEADROOM_START_TIMEOUT_MS;
   let spawnedSupervisor = false;
   let awaitingAllowlist = false;
+  migrateHeadroomState(ports.fs, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, ports.isRunning);
   for (; ; ) {
-    const state = readHeadroomState(ports.fs, paths.headroomStateFile);
+    const state = resolveServingHeadroomState(ports.fs, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, ports.isRunning)?.state;
     if (state?.supervisorPid !== void 0 && ports.isRunning(state.supervisorPid)) {
       const daemonUp = state.socketPath !== void 0 && state.headroomPid !== void 0 && ports.isRunning(state.headroomPid);
       if (daemonUp && state.socketPath !== void 0) {
@@ -2963,9 +2989,9 @@ var init_settings = __esm({
 });
 
 // src/headroom/socket.ts
-import path11 from "node:path";
+import path12 from "node:path";
 function headroomSocketPath(paths, supervisorPid) {
-  return path11.join(paths.headroomSocketDir, `${String(supervisorPid)}${HEADROOM_SOCKET_SUFFIX}`);
+  return path12.join(paths.headroomSocketDir, `${String(supervisorPid)}${HEADROOM_SOCKET_SUFFIX}`);
 }
 function platformRefusal(platform) {
   return PLATFORMS_WITHOUT_UNIX_SOCKETS.includes(platform) ? `headroom routing needs a unix domain socket, which headroom cannot serve on ${platform}; agent-shim never falls back to a TCP port for this hop` : void 0;
@@ -2994,7 +3020,7 @@ function verifyHeadroomSocket(socketPath, ports) {
     return { refused: unsupported };
   }
   const uid = ports.currentUid();
-  const directory = path11.dirname(socketPath);
+  const directory = path12.dirname(socketPath);
   const refusal = ownerOnlyRefusal("socket directory", directory, ports.lstat(directory), "dir", uid) ?? ownerOnlyRefusal("socket", socketPath, ports.lstat(socketPath), "socket", uid);
   return refusal === void 0 ? { socketPath } : { refused: refusal };
 }
@@ -3024,7 +3050,7 @@ function pruneStaleHeadroomSockets(fs12, paths, isRunning) {
     if (pid === void 0 || isRunning(Number.parseInt(pid, 10))) {
       continue;
     }
-    fs12.removeRecursive(path11.join(paths.headroomSocketDir, name));
+    fs12.removeRecursive(path12.join(paths.headroomSocketDir, name));
     removed.push(name);
   }
   return removed;
@@ -3131,7 +3157,8 @@ function compareVersions2(a, b) {
 async function runSupervisor(initialConfig, ports, options = {}) {
   const { fs: fs12, paths } = ports;
   let config = initialConfig;
-  const previousState = readHeadroomState(fs12, paths.headroomStateFile);
+  migrateHeadroomState(fs12, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, ports.isRunning);
+  const previousState = resolveServingHeadroomState(fs12, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, ports.isRunning)?.state;
   if (previousState?.supervisorPid !== void 0 && previousState.supervisorPid !== ports.ownPid && ports.isRunning(previousState.supervisorPid)) {
     ports.log(`agent-shim headroom supervisor ${String(ports.ownPid)}: supervisor ${String(previousState.supervisorPid)} already owns the daemon; exiting`);
     return 0;
@@ -3334,7 +3361,7 @@ import { spawn, spawnSync } from "node:child_process";
 import { createHash as createHash5 } from "node:crypto";
 import fs3 from "node:fs";
 import os3 from "node:os";
-import path12 from "node:path";
+import path13 from "node:path";
 import { isSea } from "node:sea";
 function isEnoent3(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
@@ -3361,7 +3388,7 @@ function realIsProcessRunning(pid) {
   return realIsProcessAlive(pid) && !realIsProcessZombie(pid);
 }
 function expandHome2(filePath) {
-  return filePath.startsWith("~/") ? path12.join(os3.homedir(), filePath.slice(1)) : filePath;
+  return filePath.startsWith("~/") ? path13.join(os3.homedir(), filePath.slice(1)) : filePath;
 }
 function hasDesktopSession() {
   if (process.platform === "darwin") {
@@ -3405,7 +3432,7 @@ function spawnDaemonThroughScript(script) {
   return (paths, subcommand, logPath) => spawnDetachedDaemon({ command: process.execPath, args: [script, subcommand] }, paths, subcommand, logPath);
 }
 function spawnDetachedDaemon(invocation, paths, subcommand, logPath) {
-  fs3.mkdirSync(path12.dirname(logPath), { recursive: true });
+  fs3.mkdirSync(path13.dirname(logPath), { recursive: true });
   const logFd = fs3.openSync(logPath, "a");
   try {
     const child = spawn(invocation.command, invocation.args, detachedDaemonSpawnOptions(logFd, { ...process.env, AGENT_SHIM_HOME: paths.root }));
@@ -3458,7 +3485,7 @@ function listVersionsDir(dir) {
     throw error;
   }
   return entries.filter((entry) => entry.isFile()).map((entry) => {
-    const fullPath = path12.join(dir, entry.name);
+    const fullPath = path13.join(dir, entry.name);
     const stat = fs3.statSync(fullPath);
     return {
       name: entry.name,
@@ -3472,7 +3499,7 @@ function windowsPathExtensions(pathext) {
   return (pathext ?? WINDOWS_DEFAULT_PATHEXT).split(";").map((ext) => ext.trim()).filter((ext) => ext.length > 0);
 }
 function resolveExecutableCandidate(dir, name, env) {
-  const candidate = path12.join(dir, name);
+  const candidate = path13.join(dir, name);
   if (env.platform === "win32") {
     const extensions = windowsPathExtensions(env.pathext);
     const alreadyHasRecognisedExtension = extensions.some((ext) => candidate.toLowerCase().endsWith(ext.toLowerCase()));
@@ -3521,13 +3548,13 @@ function resolveOwnExecutablePath(env) {
   if (env.argv1 !== void 0 && !env.argv1.includes("/") && !env.argv1.includes("\\")) {
     return searchPathForExecutable(env.pathDirs, env.argv1, env.findExecutableInDir) ?? env.execPath;
   }
-  const candidate = env.argv1 === void 0 ? env.execPath : path12.resolve(env.cwd, env.argv1);
-  const candidateDir = path12.dirname(candidate);
-  const candidateDirOnPath = env.pathDirs.some((dir) => path12.resolve(dir) === candidateDir);
+  const candidate = env.argv1 === void 0 ? env.execPath : path13.resolve(env.cwd, env.argv1);
+  const candidateDir = path13.dirname(candidate);
+  const candidateDirOnPath = env.pathDirs.some((dir) => path13.resolve(dir) === candidateDir);
   if (candidateDirOnPath) {
     return candidate;
   }
-  const viaPath = searchPathForExecutable(env.pathDirs, path12.basename(candidate), env.findExecutableInDir);
+  const viaPath = searchPathForExecutable(env.pathDirs, path13.basename(candidate), env.findExecutableInDir);
   return viaPath ?? candidate;
 }
 function realOwnExecutablePath() {
@@ -3535,7 +3562,7 @@ function realOwnExecutablePath() {
     argv1: process.argv[1],
     execPath: process.execPath,
     cwd: process.cwd(),
-    pathDirs: (process.env.PATH ?? "").split(path12.delimiter).filter((dir) => dir !== ""),
+    pathDirs: (process.env.PATH ?? "").split(path13.delimiter).filter((dir) => dir !== ""),
     findExecutableInDir
   });
 }
@@ -3548,7 +3575,7 @@ function realContentSourcePath() {
 function realResolveClaudeBinary(isOwnBinary) {
   return (request4) => discoverClaudeBinary({
     listVersionsDir,
-    pathDirs: (process.env.PATH ?? "").split(path12.delimiter).filter((dir) => dir !== ""),
+    pathDirs: (process.env.PATH ?? "").split(path13.delimiter).filter((dir) => dir !== ""),
     findExecutableInDir,
     isOwnBinary,
     ...request4?.version === void 0 ? {} : { version: request4.version }
@@ -3770,18 +3797,18 @@ var init_realPorts = __esm({
 });
 
 // src/pathNorm.ts
-import path13 from "node:path";
+import path14 from "node:path";
 function expandTilde(value, home) {
   if (value === "~") {
     return home;
   }
   if (value.startsWith("~/")) {
-    return path13.join(home, value.slice(2));
+    return path14.join(home, value.slice(2));
   }
   return value;
 }
 function normaliseRulePath(rulePath, home) {
-  return path13.resolve(expandTilde(rulePath, home));
+  return path14.resolve(expandTilde(rulePath, home));
 }
 var init_pathNorm = __esm({
   "src/pathNorm.ts"() {
@@ -3790,12 +3817,12 @@ var init_pathNorm = __esm({
 });
 
 // src/launcher/cascade.ts
-import path14 from "node:path";
+import path15 from "node:path";
 function loadCascadeInput(params) {
   const globalConfig = loadConfigFile(params.paths.globalConfigFile, GlobalConfigSchema, params.read);
   const directoryRules = loadConfigFile(params.paths.directoryRulesFile, DirectoryRulesSchema, params.read);
   const loadProfile = (name) => {
-    const filepath = path14.join(params.paths.configProfilesDir, `${name}.json`);
+    const filepath = path15.join(params.paths.configProfilesDir, `${name}.json`);
     const loaded = loadConfigFile(filepath, ConfigProfileSchema, params.read);
     if (loaded === void 0) {
       return void 0;
@@ -3810,8 +3837,8 @@ function loadCascadeInput(params) {
   });
   const levels = [];
   for (const dir of dirs) {
-    const portable = loadConfigFile(path14.join(dir, PORTABLE_CONFIG_FILENAME), PortableConfigSchema, params.read) ?? loadConfigFile(path14.join(dir, LEGACY_PORTABLE_CONFIG_FILENAME), PortableConfigSchema, params.read);
-    const portableLocal = loadConfigFile(path14.join(dir, PORTABLE_LOCAL_CONFIG_FILENAME), PortableConfigSchema, params.read) ?? loadConfigFile(path14.join(dir, LEGACY_PORTABLE_LOCAL_CONFIG_FILENAME), PortableConfigSchema, params.read);
+    const portable = loadConfigFile(path15.join(dir, PORTABLE_CONFIG_FILENAME), PortableConfigSchema, params.read) ?? loadConfigFile(path15.join(dir, LEGACY_PORTABLE_CONFIG_FILENAME), PortableConfigSchema, params.read);
+    const portableLocal = loadConfigFile(path15.join(dir, PORTABLE_LOCAL_CONFIG_FILENAME), PortableConfigSchema, params.read) ?? loadConfigFile(path15.join(dir, LEGACY_PORTABLE_LOCAL_CONFIG_FILENAME), PortableConfigSchema, params.read);
     const rules = (directoryRules?.config.rules ?? []).map((rule, index) => ({ rule, index })).filter(({ rule }) => normaliseRulePath(rule.path, params.home) === dir).map(({ rule, index }) => {
       const entryOrder = directoryRules?.ruleEntryOrders[index];
       return {
@@ -3873,7 +3900,7 @@ var init_cascade = __esm({
 });
 
 // src/launcher/identity.ts
-import path15 from "node:path";
+import path16 from "node:path";
 function poolNameOf(selector) {
   return selector.startsWith(POOL_SELECTOR_PREFIX) ? selector.slice(POOL_SELECTOR_PREFIX.length) : void 0;
 }
@@ -3926,7 +3953,7 @@ function decideConfigProfile(params) {
   return { source: "none" };
 }
 function loadIdentity(identitiesDir, name, fs12) {
-  return loadConfigFile(path15.join(identitiesDir, name, "identity.json"), IdentitySchema, fs12.readConfigFile);
+  return loadConfigFile(path16.join(identitiesDir, name, "identity.json"), IdentitySchema, fs12.readConfigFile);
 }
 var IDENTITY_DECISION_SOURCES, CONFIG_PROFILE_DECISION_SOURCES;
 var init_identity = __esm({
@@ -4120,7 +4147,7 @@ var init_schema2 = __esm({
 });
 
 // src/usage/account.ts
-import path16 from "node:path";
+import path17 from "node:path";
 function isObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -4128,7 +4155,7 @@ function isIdentityName(name) {
   return IdentitySchema.shape.name.safeParse(name).success;
 }
 function claudeJsonPath(identitiesDir, identity) {
-  return path16.join(identitiesDir, identity, CLAUDE_JSON);
+  return path17.join(identitiesDir, identity, CLAUDE_JSON);
 }
 function readAccountMetadata(fs12, identitiesDir, identity) {
   if (!isIdentityName(identity)) {
@@ -4627,7 +4654,7 @@ var init_pick = __esm({
 });
 
 // src/usage/read.ts
-import path17 from "node:path";
+import path18 from "node:path";
 function segmentDay(epochMs) {
   return new Date(epochMs).toISOString().slice(0, "YYYY-MM-DD".length);
 }
@@ -4652,7 +4679,7 @@ function readUsageLog(fs12, logDir, options = {}) {
     if (sinceMs !== void 0 && segment.endsAt <= sinceMs) {
       continue;
     }
-    const contents = fs12.readFileUtf8(path17.join(logDir, segment.name));
+    const contents = fs12.readFileUtf8(path18.join(logDir, segment.name));
     if (contents === void 0) {
       continue;
     }
@@ -4686,7 +4713,7 @@ function snapshotPath(snapshotsDir, identity) {
   if (!isIdentityName(identity)) {
     throw new Error(`"${identity}" is not a valid identity name.`);
   }
-  return path17.join(snapshotsDir, `${identity}.json`);
+  return path18.join(snapshotsDir, `${identity}.json`);
 }
 function readUsageSnapshot(fs12, snapshotsDir, identity) {
   const file = snapshotPath(snapshotsDir, identity);
@@ -4739,12 +4766,12 @@ var init_read = __esm({
 });
 
 // src/usage/store.ts
-import path18 from "node:path";
+import path19 from "node:path";
 function pruneUsageLog(fs12, logDir, nowMs) {
   const cutoff = nowMs - USAGE_RETENTION_MS;
   for (const segment of listLogSegments(fs12, logDir)) {
     if (segment.endsAt <= cutoff) {
-      fs12.removeRecursive(path18.join(logDir, segment.name));
+      fs12.removeRecursive(path19.join(logDir, segment.name));
     }
   }
 }
@@ -4826,7 +4853,7 @@ function createUsageStore(deps) {
         pruneUsageLog(fs12, paths.usageLogDir, nowMs);
         prunedDay = day;
       }
-      fs12.appendFilePrivate(path18.join(paths.usageLogDir, segmentName(day, deps.pid)), `${JSON.stringify(record)}
+      fs12.appendFilePrivate(path19.join(paths.usageLogDir, segmentName(day, deps.pid)), `${JSON.stringify(record)}
 `);
       if (record.identity !== void 0) {
         rewriteSnapshot(record.identity, (current) => ({ ...current?.providers, [record.provider]: foldProviderState(current?.providers[record.provider], record) }));
@@ -4864,7 +4891,7 @@ var init_store2 = __esm({
 });
 
 // src/usage/poolPick.ts
-import path19 from "node:path";
+import path20 from "node:path";
 import { z as z10 } from "zod";
 function errorMessage(error) {
   return error instanceof Error ? error.message : String(error);
@@ -4992,7 +5019,7 @@ function recordStickyPick(fs12, picksFile, directory, identity, nowMs) {
   const current = readPicksFile(fs12, picksFile).file.picks;
   const kept = Object.entries(current).filter(([, entry]) => nowMs - Date.parse(entry.at) <= USAGE_RETENTION_MS);
   const next = { schemaVersion: SCHEMA_VERSION, picks: { ...Object.fromEntries(kept), [directory]: { identity, at: new Date(nowMs).toISOString() } } };
-  fs12.mkdirPrivate(path19.dirname(picksFile));
+  fs12.mkdirPrivate(path20.dirname(picksFile));
   fs12.writeFilePrivate(picksFile, `${JSON.stringify(next, null, 2)}
 `);
 }
@@ -5026,14 +5053,14 @@ var init_poolPick = __esm({
 // src/paths.ts
 import fs5 from "node:fs";
 import os5 from "node:os";
-import path21 from "node:path";
+import path22 from "node:path";
 function resolveAgentShimHome(env = process.env, home = os5.homedir(), isDirectory = isExistingDirectory) {
   const fromEnv = env.AGENT_SHIM_HOME;
   if (fromEnv !== void 0 && fromEnv !== "") {
     return fromEnv;
   }
-  const current = path21.join(home, HOME_DIRNAME);
-  const legacy = path21.join(home, LEGACY_HOME_DIRNAME);
+  const current = path22.join(home, HOME_DIRNAME);
+  const legacy = path22.join(home, LEGACY_HOME_DIRNAME);
   return !isDirectory(current) && isDirectory(legacy) ? legacy : current;
 }
 function isExistingDirectory(candidate) {
@@ -5044,42 +5071,43 @@ function resolveClaudeHome() {
   if (fromEnv !== void 0 && fromEnv !== "") {
     return fromEnv;
   }
-  return path21.join(os5.homedir(), ".claude");
+  return path22.join(os5.homedir(), ".claude");
 }
 function buildLayoutPaths(root) {
   return {
     root,
-    identitiesDir: path21.join(root, "identities"),
-    configProfilesDir: path21.join(root, "config-profiles"),
-    providersDir: path21.join(root, "providers"),
-    directoryRulesFile: path21.join(root, "directory-rules.json"),
-    activeIdentityFile: path21.join(root, "active-identity"),
-    globalConfigFile: path21.join(root, "config.json"),
-    categoriesLocalFile: path21.join(root, "categories.local.json"),
-    claudeShimFile: path21.join(root, "claude-shim.json"),
-    headroomDir: path21.join(root, "headroom"),
-    headroomStateFile: path21.join(root, "headroom", `state.v${String(HEADROOM_STATE_SCHEMA_VERSION)}.json`),
-    headroomSocketDir: path21.join(root, "headroom", "run"),
-    headroomLockFile: path21.join(root, "headroom", "start.lock"),
-    headroomSessionsDir: path21.join(root, "headroom", "sessions"),
-    logsDir: path21.join(root, "logs"),
-    headroomLogPath: path21.join(root, "logs", "headroom.log"),
-    frontdoorDir: path21.join(root, "frontdoor"),
-    frontdoorCaDir: path21.join(root, "frontdoor", "ca"),
-    frontdoorCaCertFile: path21.join(root, "frontdoor", "ca", "ca.pem"),
-    frontdoorCaKeyFile: path21.join(root, "frontdoor", "ca", "ca.key"),
-    frontdoorCaBundlesDir: path21.join(root, "frontdoor", "ca", "bundles"),
-    chatgptSignInFile: path21.join(root, "codex", "chatgpt-sign-in.json"),
-    frontdoorStateFile: path21.join(root, "frontdoor", "state.json"),
-    frontdoorLockFile: path21.join(root, "frontdoor", "start.lock"),
-    frontdoorControlTokenFile: path21.join(root, "frontdoor", "control-token"),
-    frontdoorSessionsDir: path21.join(root, "frontdoor", "sessions"),
-    frontdoorRcCredentialsDir: path21.join(root, "frontdoor", "rc-credentials"),
-    frontdoorLogPath: path21.join(root, "logs", "frontdoor.log"),
-    usageDir: path21.join(root, "usage"),
-    usageLogDir: path21.join(root, "usage", "log"),
-    usageSnapshotsDir: path21.join(root, "usage", "snapshots"),
-    usagePicksFile: path21.join(root, "usage", "picks.json")
+    identitiesDir: path22.join(root, "identities"),
+    configProfilesDir: path22.join(root, "config-profiles"),
+    providersDir: path22.join(root, "providers"),
+    directoryRulesFile: path22.join(root, "directory-rules.json"),
+    activeIdentityFile: path22.join(root, "active-identity"),
+    globalConfigFile: path22.join(root, "config.json"),
+    categoriesLocalFile: path22.join(root, "categories.local.json"),
+    claudeShimFile: path22.join(root, "claude-shim.json"),
+    headroomDir: path22.join(root, "headroom"),
+    headroomStateFile: path22.join(root, "headroom", "state.json"),
+    headroomLegacyStateFile: path22.join(root, "headroom", "state.v2.json"),
+    headroomSocketDir: path22.join(root, "headroom", "run"),
+    headroomLockFile: path22.join(root, "headroom", "start.lock"),
+    headroomSessionsDir: path22.join(root, "headroom", "sessions"),
+    logsDir: path22.join(root, "logs"),
+    headroomLogPath: path22.join(root, "logs", "headroom.log"),
+    frontdoorDir: path22.join(root, "frontdoor"),
+    frontdoorCaDir: path22.join(root, "frontdoor", "ca"),
+    frontdoorCaCertFile: path22.join(root, "frontdoor", "ca", "ca.pem"),
+    frontdoorCaKeyFile: path22.join(root, "frontdoor", "ca", "ca.key"),
+    frontdoorCaBundlesDir: path22.join(root, "frontdoor", "ca", "bundles"),
+    chatgptSignInFile: path22.join(root, "codex", "chatgpt-sign-in.json"),
+    frontdoorStateFile: path22.join(root, "frontdoor", "state.json"),
+    frontdoorLockFile: path22.join(root, "frontdoor", "start.lock"),
+    frontdoorControlTokenFile: path22.join(root, "frontdoor", "control-token"),
+    frontdoorSessionsDir: path22.join(root, "frontdoor", "sessions"),
+    frontdoorRcCredentialsDir: path22.join(root, "frontdoor", "rc-credentials"),
+    frontdoorLogPath: path22.join(root, "logs", "frontdoor.log"),
+    usageDir: path22.join(root, "usage"),
+    usageLogDir: path22.join(root, "usage", "log"),
+    usageSnapshotsDir: path22.join(root, "usage", "snapshots"),
+    usagePicksFile: path22.join(root, "usage", "picks.json")
   };
 }
 function resolveLayoutPaths() {
@@ -5088,7 +5116,6 @@ function resolveLayoutPaths() {
 var init_paths = __esm({
   "src/paths.ts"() {
     "use strict";
-    init_state2();
     init_legacy();
   }
 });
@@ -5172,7 +5199,7 @@ var init_credentialCache = __esm({
 // src/realCredentialCache.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
 import fs6 from "node:fs";
-import path22 from "node:path";
+import path23 from "node:path";
 function cacheFileNameFor(owner) {
   return `${owner.replace(/[^A-Za-z0-9._-]/g, "_")}.json`;
 }
@@ -5196,8 +5223,8 @@ function security(args, stdin) {
   return { status: result.status, stdout: result.stdout };
 }
 function createRealCredentialCache(root) {
-  const dir = path22.join(root, "credential-cache");
-  const filePath = (owner) => path22.join(dir, cacheFileNameFor(owner));
+  const dir = path23.join(root, "credential-cache");
+  const filePath = (owner) => path23.join(dir, cacheFileNameFor(owner));
   return {
     read(store, owner) {
       if (store === "file") {
@@ -5429,9 +5456,9 @@ var init_credential = __esm({
 
 // src/providersStore.ts
 import fs7 from "node:fs";
-import path23 from "node:path";
+import path24 from "node:path";
 function providerJsonPath(paths, name) {
-  return path23.join(paths.providersDir, `${name}.json`);
+  return path24.join(paths.providersDir, `${name}.json`);
 }
 function providerExists(paths, name) {
   return fs7.existsSync(providerJsonPath(paths, name));
@@ -5491,7 +5518,7 @@ function readProvider(paths, name) {
   return parseProviderFile(filePath, raw);
 }
 function loadProvider(providersDir, name, port) {
-  const filePath = path23.join(providersDir, `${name}.json`);
+  const filePath = path24.join(providersDir, `${name}.json`);
   const raw = port.readConfigFile(filePath);
   return raw === void 0 ? void 0 : parseProviderFile(filePath, raw);
 }
@@ -5856,17 +5883,17 @@ var init_commandDeps = __esm({
 
 // src/claudeShim.ts
 import fs8 from "node:fs";
-import path25 from "node:path";
+import path26 from "node:path";
 import { z as z15 } from "zod";
 function commandFilename(ownExecutablePath, commandName) {
   return ownExecutablePath.toLowerCase().endsWith(".exe") ? `${commandName}.exe` : commandName;
 }
 function resolveOwnBinaryCheck(paths, contentSourcePath) {
   const state = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-  const recordedTarget = state === void 0 ? void 0 : path25.resolve(state.targetPath);
+  const recordedTarget = state === void 0 ? void 0 : path26.resolve(state.targetPath);
   let ownStat;
   return (candidate) => {
-    if (recordedTarget !== void 0 && path25.resolve(candidate) === recordedTarget) {
+    if (recordedTarget !== void 0 && path26.resolve(candidate) === recordedTarget) {
       return true;
     }
     ownStat ??= statOrUndefined(contentSourcePath);
@@ -5889,15 +5916,15 @@ function statOrUndefined(target) {
   }
 }
 function findPathShadow(params) {
-  const resolvedTargetDir = path25.resolve(params.targetDir);
+  const resolvedTargetDir = path26.resolve(params.targetDir);
   for (const dir of params.pathDirs) {
     const found = params.findExecutableInDir(dir, params.targetFilename);
     if (found === void 0) {
       continue;
     }
-    return path25.resolve(dir) === resolvedTargetDir ? { status: "ok" } : { status: "shadowed", by: found };
+    return path26.resolve(dir) === resolvedTargetDir ? { status: "ok" } : { status: "shadowed", by: found };
   }
-  return params.pathDirs.some((dir) => path25.resolve(dir) === resolvedTargetDir) ? { status: "ok" } : { status: "not-on-path" };
+  return params.pathDirs.some((dir) => path26.resolve(dir) === resolvedTargetDir) ? { status: "ok" } : { status: "not-on-path" };
 }
 var ClaudeShimStateSchema, nodeLinkFs;
 var init_claudeShim = __esm({
@@ -6321,7 +6348,7 @@ var init_headers = __esm({
 });
 
 // src/launcher/flags.ts
-import path30 from "node:path";
+import path31 from "node:path";
 function resolveLaunchFlags(params) {
   return {
     skipPermissions: params.flags?.skipPermissions ?? parseEnvBool("AGENT_SHIM_SKIP_PERMISSIONS", params.env.AGENT_SHIM_SKIP_PERMISSIONS) ?? params.cascade?.skipPermissions ?? false,
@@ -6352,7 +6379,7 @@ function buildEnv(params) {
   const parentCustomHeaders = params.baseEnv.ANTHROPIC_CUSTOM_HEADERS;
   let providerCustomHeaders;
   if (!params.configDirEscapeHatch && params.resolvedIdentityName !== void 0) {
-    env.CLAUDE_CONFIG_DIR = path30.join(params.identitiesDir, params.resolvedIdentityName);
+    env.CLAUDE_CONFIG_DIR = path31.join(params.identitiesDir, params.resolvedIdentityName);
   }
   if (params.provider !== void 0) {
     const providerEnv = params.provider.definition.env ?? {};
@@ -6639,7 +6666,7 @@ var init_launchHook = __esm({
 
 // src/launcher.ts
 import { randomUUID as randomUUID4 } from "node:crypto";
-import path31 from "node:path";
+import path32 from "node:path";
 function resolveIdentityCredential(identity, credential, env, port) {
   if (port === void 0) {
     return { ok: false, status: 1, message: `agent-shim: identity ${identity} needs its credential resolved, but this launcher has no credential port wired` };
@@ -6747,7 +6774,7 @@ function prepareLaunch(params) {
     identityDefaultConfigProfile: loadedIdentity?.config.defaultConfigProfile,
     globalDefaultConfigProfile: params.globalDefaultConfigProfile
   });
-  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs12.readConfigFile(path31.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
+  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs12.readConfigFile(path32.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
     log.error(
       `agent-shim: no configuration profile named "${configProfileDecision.name}" (selected via ${configProfileDecision.source}). Run \`agent-shim profile add ${configProfileDecision.name}\` first.`
     );
@@ -6810,7 +6837,7 @@ function prepareLaunch(params) {
   );
   const updateCheck = runLaunchUpdateCheck({
     mode: params.updateMode ?? "off",
-    checkPath: path31.join(paths.root, "update.check"),
+    checkPath: path32.join(paths.root, "update.check"),
     currentVersion: package_default.version,
     port: params.update
   });
@@ -6976,12 +7003,12 @@ var init_launcher = __esm({
 });
 
 // src/ownCli.ts
-import path32 from "node:path";
+import path33 from "node:path";
 function agentShimCliPath(distDir = typeof __AGENT_SHIM_DIST_DIR__ === "string" ? __AGENT_SHIM_DIST_DIR__ : void 0) {
   if (distDir === void 0) {
     throw new OwnCliPathUnknownError();
   }
-  return path32.join(distDir, OWN_CLI_FILE_NAME);
+  return path33.join(distDir, OWN_CLI_FILE_NAME);
 }
 var OWN_CLI_FILE_NAME, OwnCliPathUnknownError;
 var init_ownCli = __esm({
@@ -7070,10 +7097,10 @@ request.on("error", (error) => finish(failed, (error.code ? error.code + ": " :
 
 // src/frontdoor/trust.ts
 import { createHash as createHash6 } from "node:crypto";
-import path33 from "node:path";
+import path34 from "node:path";
 function resolveTrustBundle(params) {
   const { caCertFile, bundlesDir, variable, inherited, fs: fs12 } = params;
-  if (inherited === void 0 || inherited === "" || path33.resolve(inherited) === path33.resolve(caCertFile)) {
+  if (inherited === void 0 || inherited === "" || path34.resolve(inherited) === path34.resolve(caCertFile)) {
     return { path: caCertFile };
   }
   const caPem = fs12.readFileUtf8(caCertFile);
@@ -7091,7 +7118,7 @@ function resolveTrustBundle(params) {
   }
   const combined = `${inheritedPem.trimEnd()}
 ${caPem}`;
-  const bundle = path33.join(bundlesDir, `${createHash6("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
+  const bundle = path34.join(bundlesDir, `${createHash6("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
   if (!fs12.exists(bundle)) {
     fs12.mkdirp(bundlesDir);
     fs12.writeFileAtomic(bundle, combined);
@@ -7897,11 +7924,21 @@ init_route();
 
 // src/frontdoor/supervisor.ts
 init_state();
+import path9 from "node:path";
+function watchedInstallEntry(resolvedOwnExecutablePath, siblingExists) {
+  const parsed = path9.parse(resolvedOwnExecutablePath);
+  if (parsed.name === "agent-shim") {
+    return resolvedOwnExecutablePath;
+  }
+  const sibling = path9.join(parsed.dir, `agent-shim${parsed.ext}`);
+  return siblingExists(sibling) ? sibling : resolvedOwnExecutablePath;
+}
 var FRONTDOOR_SUPERVISOR_STILL_RUNNING = -1;
 var FRONTDOOR_POLL_MS = 1e3;
 var MS_PER_MINUTE = 6e4;
 async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {}) {
   const { fs: fs12, paths } = ports;
+  const servingBinary = ports.statOwnExecutable();
   const previous = readFrontDoorState(fs12, paths.frontdoorStateFile);
   let lastPort = previous?.lastPort;
   let lastConnectPort = previous?.lastConnectPort;
@@ -7964,6 +8001,18 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
   ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http3.port)}, CONNECT surface on 127.0.0.1:${String(connect3.port)}`);
   let idleSince;
   let ticks = 0;
+  const binaryReplaced = () => {
+    const current = ports.statOwnExecutable();
+    return current !== void 0 && servingBinary !== void 0 && (current.dev !== servingBinary.dev || current.ino !== servingBinary.ino || current.size !== servingBinary.size || current.mtimeMs !== servingBinary.mtimeMs);
+  };
+  const shutdown = async () => {
+    await direct.close();
+    await connect3.close();
+    await http3.close();
+    ports.closeRcStreamHub();
+    writeFrontDoorState(fs12, paths.frontdoorStateFile, sticky());
+    return 0;
+  };
   for (; ; ) {
     if (options.tickLimit !== void 0 && ticks >= options.tickLimit) {
       return FRONTDOOR_SUPERVISOR_STILL_RUNNING;
@@ -7975,16 +8024,16 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     ports.checkQuotaExpiry();
     const prunedPids = new Set(pruned);
     if (listed.filter((session) => !prunedPids.has(session.pid)).length === 0) {
+      if (ticks > 1 && binaryReplaced()) {
+        ports.log("agent-shim frontdoor supervisor: the installed binary changed and no sessions are live; turning the door over for the next launch");
+        ports.doorHealth.binaryTurnover();
+        return await shutdown();
+      }
       idleSince ??= ports.now();
       if (ports.now() - idleSince >= idleShutdownMinutes * MS_PER_MINUTE) {
         ports.log(`agent-shim frontdoor supervisor: no sessions for ${String(idleShutdownMinutes)} minute(s); closing the front door and exiting`);
         ports.doorHealth.idleShutdown();
-        await direct.close();
-        await connect3.close();
-        await http3.close();
-        ports.closeRcStreamHub();
-        writeFrontDoorState(fs12, paths.frontdoorStateFile, sticky());
-        return 0;
+        return await shutdown();
       }
     } else {
       idleSince = void 0;
@@ -8038,8 +8087,8 @@ function parseConnectTarget(authority) {
 function isInterceptedHost(host, interceptHosts) {
   return interceptHosts.includes(host);
 }
-function servedByPipeline(path34) {
-  return path34?.startsWith(ROUTED_PATH_PREFIX) === true;
+function servedByPipeline(path35) {
+  return path35?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
   "connection",
@@ -8573,11 +8622,11 @@ function createRcSessionTracker(deps) {
   };
   const observeExchange = (request4) => {
     const method = (request4.method ?? "").toUpperCase();
-    const path34 = new URL(request4.url ?? "/", "http://127.0.0.1").pathname;
-    if (!path34.startsWith(RC_SESSIONS_PATH_PREFIX)) {
+    const path35 = new URL(request4.url ?? "/", "http://127.0.0.1").pathname;
+    if (!path35.startsWith(RC_SESSIONS_PATH_PREFIX)) {
       return void 0;
     }
-    const tail = path34.slice(RC_SESSIONS_PATH_PREFIX.length);
+    const tail = path35.slice(RC_SESSIONS_PATH_PREFIX.length);
     const facts = {
       oauthAuthorization: oauthAuthorizationOf(request4.headers),
       anthropicVersion: singleHeader(request4.headers, "anthropic-version"),
@@ -8959,8 +9008,8 @@ var RC_READ_FILE_ENCODINGS = ["utf-8", "base64"];
 function isRcReadFileEncoding(value) {
   return RC_READ_FILE_ENCODINGS.some((encoding) => encoding === value);
 }
-function buildRcReadFilePayload(requestId, path34, options) {
-  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path34, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
+function buildRcReadFilePayload(requestId, path35, options) {
+  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path35, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
 }
 function buildRcFileSuggestionsPayload(requestId, query) {
   return buildRcControlRequestPayload(requestId, { subtype: "file_suggestions", query });
@@ -9062,15 +9111,15 @@ async function getRcSessionContextUsage(deps, sessionId, detail) {
   const result = await deliverRcClientPayload(deps, sessionId, buildRcGetContextUsagePayload(requestId, detail), `request the context usage of session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
-async function readRcSessionFile(deps, sessionId, path34, options) {
-  if (path34 === "") {
+async function readRcSessionFile(deps, sessionId, path35, options) {
+  if (path35 === "") {
     return { ok: false, message: "a read-file write needs a non-empty path: the SDK's own field names the file the worker resolves against the session's cwd, and an empty string names none" };
   }
   if (options?.maxBytes !== void 0 && (!Number.isInteger(options.maxBytes) || options.maxBytes <= 0)) {
     return { ok: false, message: "a read-file write's max-bytes is a positive whole number of bytes: the SDK's own field caps the read, and a zero or negative cap reads nothing" };
   }
   const requestId = deps.newUuid();
-  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path34, options), `read ${path34} from session ${sessionId}`);
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path35, options), `read ${path35} from session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
 async function suggestRcSessionFiles(deps, sessionId, query) {
@@ -9239,11 +9288,11 @@ function createRcControlHandler(deps) {
       path: "read-file",
       read: (body) => {
         const session = bodyString(body, "session");
-        const path34 = bodyString(body, "path");
+        const path35 = bodyString(body, "path");
         const maxBytes = "maxBytes" in body ? bodyPositiveInteger(body, "maxBytes") : void 0;
         const encoding = "encoding" in body && isRcReadFileEncoding(body.encoding) ? body.encoding : void 0;
-        const refused2 = session === void 0 || path34 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
-        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path34, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
+        const refused2 = session === void 0 || path35 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
+        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path35, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
       }
     },
     {
@@ -9553,9 +9602,9 @@ function requestIdOfBody(body) {
 }
 function frontDoorRcControl(transport, token) {
   const headers = { authorization: `Bearer ${token}` };
-  const listAnswerOf = async (path34, what) => {
+  const listAnswerOf = async (path35, what) => {
     try {
-      return await transport.request({ method: "GET", path: path34, headers });
+      return await transport.request({ method: "GET", path: path35, headers });
     } catch (error) {
       throw new Error(`${what}: could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
     }
@@ -9627,10 +9676,10 @@ function frontDoorRcControl(transport, token) {
     }
     return pending;
   };
-  const writeOf = async (path34, body, describeFailure) => {
+  const writeOf = async (path35, body, describeFailure) => {
     let answer;
     try {
-      answer = await transport.request({ method: "POST", path: path34, headers: { ...headers, "content-type": "application/json" }, body });
+      answer = await transport.request({ method: "POST", path: path35, headers: { ...headers, "content-type": "application/json" }, body });
     } catch (error) {
       return { ok: false, message: `could not reach the front door's control listener: ${error instanceof Error ? error.message : String(error)}` };
     }
@@ -9661,10 +9710,10 @@ function frontDoorRcControl(transport, token) {
     endSession: async (sessionId, reason) => await writeOf(`${CONTROL_PATH_PREFIX}/end-session`, JSON.stringify({ session: sessionId, ...reason === void 0 ? {} : { reason } }), (status, message) => `ending ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getUsage: async (sessionId, skipBehaviors) => await writeOf(`${CONTROL_PATH_PREFIX}/get-usage`, JSON.stringify({ session: sessionId, ...skipBehaviors === void 0 ? {} : { skipBehaviors } }), (status, message) => `requesting the usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getContextUsage: async (sessionId, detail) => await writeOf(`${CONTROL_PATH_PREFIX}/get-context-usage`, JSON.stringify({ session: sessionId, ...detail === void 0 ? {} : { detail } }), (status, message) => `requesting the context usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
-    readFile: async (sessionId, path34, options) => await writeOf(
+    readFile: async (sessionId, path35, options) => await writeOf(
       `${CONTROL_PATH_PREFIX}/read-file`,
-      JSON.stringify({ session: sessionId, path: path34, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
-      (status, message) => `reading ${path34} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
+      JSON.stringify({ session: sessionId, path: path35, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
+      (status, message) => `reading ${path35} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
     ),
     fileSuggestions: async (sessionId, query) => await writeOf(`${CONTROL_PATH_PREFIX}/file-suggestions`, JSON.stringify({ session: sessionId, query }), (status, message) => `requesting file suggestions from ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     keepAlive: async (sessionId) => await writeOf(`${CONTROL_PATH_PREFIX}/keep-alive`, JSON.stringify({ session: sessionId }), (status, message) => `keeping ${sessionId} alive failed (HTTP ${String(status)}): ${message}`),
@@ -9819,12 +9868,12 @@ function tlsFacts(options) {
 }
 function realRcEventDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const post = async (path34, headers, body) => await new Promise((resolve, reject) => {
+  const post = async (path35, headers, body) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method: "POST",
-      path: path34,
+      path: path35,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, "content-length": String(Buffer.byteLength(body, "utf8")) },
       agent
@@ -9889,12 +9938,12 @@ function lateRcStreamDial(resolve) {
 }
 function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const request4 = async (method, path34, headers, body, signal) => await new Promise((resolve, reject) => {
+  const request4 = async (method, path35, headers, body, signal) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method,
-      path: path34,
+      path: path35,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, ...body === void 0 ? {} : { "content-length": String(Buffer.byteLength(body, "utf8")) } },
       agent,
@@ -9936,9 +9985,9 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
       return { status, body: await readAll(response) };
     },
     openStream: async (sessionId, headers, resume, signal) => {
-      const path34 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
+      const path35 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
       const streamHeaders = resume === void 0 ? headers : { ...headers, "last-event-id": String(resume.fromSequenceNum) };
-      const { status, response } = await request4("GET", path34, streamHeaders, void 0, signal);
+      const { status, response } = await request4("GET", path35, streamHeaders, void 0, signal);
       if (!isSuccessful2(status)) {
         await readAll(response);
         return { status, chunks: NO_CHUNKS };
@@ -10150,7 +10199,7 @@ function realConnectEffects(ports = DOOR_SOURCE_PORTS) {
 }
 
 // src/frontdoor/rcCredentialStore.ts
-import path9 from "node:path";
+import path10 from "node:path";
 function isSafeSessionId(sessionId) {
   return /^[A-Za-z0-9_-]+$/.test(sessionId);
 }
@@ -10176,7 +10225,7 @@ function sequenceNumOfJson(value) {
 }
 function createRcCredentialStore(fs12, dir) {
   fs12.mkdirPrivate(dir);
-  const fileFor = (sessionId) => path9.join(dir, `${sessionId}.json`);
+  const fileFor = (sessionId) => path10.join(dir, `${sessionId}.json`);
   const readParsed = (sessionId) => {
     const raw = fs12.readFileUtf8(fileFor(sessionId));
     if (raw === void 0) {
@@ -10636,7 +10685,7 @@ init_schema();
 init_cliError();
 init_load();
 import fs4 from "node:fs";
-import path20 from "node:path";
+import path21 from "node:path";
 var ProfileNotFoundError = class extends CliError {
   constructor(profileName) {
     super(`No configuration profile named "${profileName}". Run \`agent-shim profile add ${profileName}\` first.`);
@@ -10662,7 +10711,7 @@ var InvalidCategoryNameError = class extends CliError {
   categoryName;
 };
 function profileJsonPath(paths, name) {
-  return path20.join(paths.configProfilesDir, `${name}.json`);
+  return path21.join(paths.configProfilesDir, `${name}.json`);
 }
 function profileExists(paths, name) {
   return fs4.existsSync(profileJsonPath(paths, name));
@@ -10802,19 +10851,19 @@ function writePools(paths, pools) {
   applyPatch(paths.globalConfigFile, GlobalConfigSchema, { pools }, { defaults: {} });
 }
 function poolCycleOf(pools, name) {
-  const walk = (current, path34) => {
+  const walk = (current, path35) => {
     for (const entry of pools[current]?.identities ?? []) {
       const nested = poolNameOf(poolMemberIdentity(entry));
       if (nested === void 0) {
         continue;
       }
       if (nested === name) {
-        return [...path34, nested];
+        return [...path35, nested];
       }
-      if (path34.includes(nested)) {
+      if (path35.includes(nested)) {
         continue;
       }
-      const found = walk(nested, [...path34, nested]);
+      const found = walk(nested, [...path35, nested]);
       if (found !== void 0) {
         return found;
       }
@@ -10924,7 +10973,7 @@ init_guard();
 init_providersStore();
 init_projects();
 init_pipeline();
-import path24 from "node:path";
+import path25 from "node:path";
 import { z as z12 } from "zod";
 var HISTORY_PROJECTS_KEY_PREFIX = "history/projects/";
 function projectFragmentOf(rawKey) {
@@ -11262,10 +11311,10 @@ function collectCheckReport(params) {
   }).input;
   const providerName = cascadeProviderName(cascade);
   const provider = providerName === void 0 ? void 0 : loadCheckProvider(paths, providerName);
-  const farmRoot = identityDecision.name === void 0 ? void 0 : path24.join(paths.identitiesDir, identityDecision.name);
+  const farmRoot = identityDecision.name === void 0 ? void 0 : path25.join(paths.identitiesDir, identityDecision.name);
   const settingsFiles = {
-    "settings.json": realFsPort.readFileUtf8(path24.join(claudeHome, "settings.json")),
-    "settings.local.json": realFsPort.readFileUtf8(path24.join(claudeHome, "settings.local.json"))
+    "settings.json": realFsPort.readFileUtf8(path25.join(claudeHome, "settings.json")),
+    "settings.local.json": realFsPort.readFileUtf8(path25.join(claudeHome, "settings.local.json"))
   };
   const report = runCheck({
     cwd,
@@ -11485,7 +11534,7 @@ init_middleware();
 init_preflight();
 
 // src/frontdoor/controlSchemas.ts
-import path28 from "node:path";
+import path29 from "node:path";
 import { z as z19 } from "zod";
 
 // src/doctorReport.ts
@@ -11499,7 +11548,7 @@ init_schema();
 init_cliError();
 init_identity();
 import fs9 from "node:fs";
-import path26 from "node:path";
+import path27 from "node:path";
 init_lock();
 var IdentityNotFoundError = class extends CliError {
   constructor(name) {
@@ -11528,7 +11577,7 @@ var InvalidIdentityNameError = class extends CliError {
   attemptedName;
 };
 function identityJsonPath(paths, name) {
-  return path26.join(paths.identitiesDir, name, "identity.json");
+  return path27.join(paths.identitiesDir, name, "identity.json");
 }
 function identityExists(paths, name) {
   return fs9.existsSync(identityJsonPath(paths, name));
@@ -11629,7 +11678,7 @@ function setIdentityCredential(paths, identityName, change) {
   });
 }
 function belongsToIdentity(entry, name) {
-  return entry === name || entry === path26.basename(identityLockPath("", name)) || entry.startsWith(`.${name}.scratch.`) || entry.startsWith(`.${name}.previous.`);
+  return entry === name || entry === path27.basename(identityLockPath("", name)) || entry.startsWith(`.${name}.scratch.`) || entry.startsWith(`.${name}.previous.`);
 }
 function removeIdentity(paths, name) {
   if (!identityExists(paths, name)) {
@@ -11637,7 +11686,7 @@ function removeIdentity(paths, name) {
   }
   for (const entry of fs9.readdirSync(paths.identitiesDir)) {
     if (belongsToIdentity(entry, name)) {
-      fs9.rmSync(path26.join(paths.identitiesDir, entry), { recursive: true, force: true });
+      fs9.rmSync(path27.join(paths.identitiesDir, entry), { recursive: true, force: true });
     }
   }
   if (readActiveIdentity2(paths) === name) {
@@ -11648,7 +11697,7 @@ function removeIdentity(paths, name) {
 // src/doctorReport.ts
 init_realPorts();
 import fs10 from "node:fs";
-import path27 from "node:path";
+import path28 from "node:path";
 
 // src/codex/siwcStore.ts
 import { z as z18 } from "zod";
@@ -11780,8 +11829,18 @@ function validateJson(schema, input) {
   }
   return { ok: true, data: result.data };
 }
+function tcpPortEraRecord(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return false;
+  }
+  const has = (key) => typeof parsed === "object" && parsed !== null && key in parsed;
+  return (has("port") || has("lastPort")) && !has("socketPath");
+}
 function pushPathResolution(push, resolution) {
-  const ownDir = path27.dirname(resolution.ownExecutablePath);
+  const ownDir = path28.dirname(resolution.ownExecutablePath);
   switch (resolution.agentShim.status) {
     case "ok":
       push("path-resolution", "pass", `\`agent-shim\` on PATH resolves to this running executable, ${resolution.ownExecutablePath}.`, "agent-shim");
@@ -11880,14 +11939,14 @@ function pushProvider(push, entry, cacheEnv, signIn) {
 }
 function pushLegacyName(push, params) {
   const legacyVariables = Object.keys(params.env).filter((name) => name.startsWith(LEGACY_ENV_PREFIX) && params.env[name] !== void 0).sort();
-  if (legacyVariables.length === 0 && path27.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
+  if (legacyVariables.length === 0 && path28.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
     push("legacy-name", "pass", "Nothing here still uses the former `claude-use` name.");
     return;
   }
   for (const name of legacyVariables) {
     push("legacy-name", "warn", `${name} is the former name of ${name.replace(LEGACY_ENV_PREFIX, ENV_PREFIX)}. Rename it; the old name still works but is only a fallback.`, name);
   }
-  if (path27.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
+  if (path28.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
     push(
       "legacy-name",
       "warn",
@@ -12089,6 +12148,8 @@ function runDoctor(params) {
   }
   if (params.headroom.state.raw === void 0) {
     push("headroom", "pass", "No headroom daemon has ever run; nothing to check.");
+  } else if (tcpPortEraRecord(params.headroom.state.raw)) {
+    push("headroom", "pass", `${params.headroom.state.path} holds a previous release's TCP-port state record; the next launch through headroom claims over it.`);
   } else {
     const validated2 = validateJson(HeadroomStateSchema, params.headroom.state);
     if (!validated2.ok) {
@@ -12227,18 +12288,18 @@ function collectDoctorReport(params) {
   const { paths } = params;
   const identityNames = fs10.existsSync(paths.identitiesDir) ? fs10.readdirSync(paths.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && isIdentityDirectoryName(entry.name)).map((entry) => entry.name).sort() : [];
   const identities = identityNames.map((name) => {
-    const farmRoot = path27.join(paths.identitiesDir, name);
-    const identityPath = path27.join(farmRoot, "identity.json");
+    const farmRoot = path28.join(paths.identitiesDir, name);
+    const identityPath = path28.join(farmRoot, "identity.json");
     return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot };
   });
   const profileNames = fs10.existsSync(paths.configProfilesDir) ? fs10.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const configProfiles = profileNames.map((name) => {
-    const profilePath = path27.join(paths.configProfilesDir, `${name}.json`);
+    const profilePath = path28.join(paths.configProfilesDir, `${name}.json`);
     return { name, path: profilePath, raw: realFsPort.readFileUtf8(profilePath) };
   });
   const providerNames = fs10.existsSync(paths.providersDir) ? fs10.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const providers = providerNames.map((name) => {
-    const providerPath = path27.join(paths.providersDir, `${name}.json`);
+    const providerPath = path28.join(paths.providersDir, `${name}.json`);
     return { name, path: providerPath, raw: realFsPort.readFileUtf8(providerPath) };
   });
   const ownExecutablePath = realOwnExecutablePath();
@@ -12250,12 +12311,12 @@ function collectDoctorReport(params) {
     binaryDiscovery = { ok: false, message: error instanceof Error ? error.message : String(error) };
   }
   const shimState = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-  const pathDirs = (params.env.PATH ?? "").split(path27.delimiter).filter((dir) => dir !== "");
+  const pathDirs = (params.env.PATH ?? "").split(path28.delimiter).filter((dir) => dir !== "");
   const claudeShimShadow = shimState === void 0 ? void 0 : refinePathShadow(
     findPathShadow({
       pathDirs,
-      targetDir: path27.dirname(shimState.targetPath),
-      targetFilename: path27.basename(shimState.targetPath),
+      targetDir: path28.dirname(shimState.targetPath),
+      targetFilename: path28.basename(shimState.targetPath),
       findExecutableInDir
     }),
     shimState.targetPath,
@@ -12281,7 +12342,7 @@ function collectDoctorReport(params) {
       agentShim: refinePathShadow(
         findPathShadow({
           pathDirs,
-          targetDir: path27.dirname(ownExecutablePath),
+          targetDir: path28.dirname(ownExecutablePath),
           targetFilename: commandFilename(ownExecutablePath, "agent-shim"),
           findExecutableInDir
         }),
@@ -12293,7 +12354,12 @@ function collectDoctorReport(params) {
     run: realRunPort,
     platform: process.platform,
     headroom: {
-      state: { path: paths.headroomStateFile, raw: realFsPort.readFileUtf8(paths.headroomStateFile) },
+      // Read-only resolution like `headroom status`: the doctor reports whichever record a launch would join, migrating nothing.
+      state: (() => {
+        const resolved = resolveServingHeadroomState(realFarmFs, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, realIsProcessRunning);
+        const statePath = resolved?.path ?? paths.headroomStateFile;
+        return { path: statePath, raw: realFarmFs.readFileUtf8(statePath) };
+      })(),
       isRunning: realIsProcessRunning
     }
   });
@@ -12350,11 +12416,11 @@ var FrontDoorSessionsOutputSchema = z19.strictObject({ sessions: z19.readonly(z1
 var CheckRunInputSchema = z19.strictObject({
   path: z19.string().min(1),
   identity: z19.string().min(1).optional()
-}).refine((input) => path28.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+}).refine((input) => path29.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
 var PoolPickInputSchema = z19.strictObject({
   pool: z19.string().min(1),
   path: z19.string().min(1)
-}).refine((input) => path28.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+}).refine((input) => path29.isAbsolute(input.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
 var DoctorFindingSchema = z19.strictObject({
   section: z19.enum(DOCTOR_SECTIONS),
   subject: z19.string().optional(),
@@ -12396,6 +12462,7 @@ var LaunchLifecycleEventSchema = z20.strictObject({
 var DoorHealthEventSchema = z20.discriminatedUnion("kind", [
   z20.strictObject({ kind: z20.literal("generation"), pid: z20.number().int().positive(), providerPort: z20.number().int().positive(), connectPort: z20.number().int().positive(), directPort: z20.number().int().positive(), observedAt: z20.number() }),
   z20.strictObject({ kind: z20.literal("listenerFailed"), pid: z20.number().int().positive(), listener: z20.enum(["provider", "connect", "direct"]), message: z20.string(), observedAt: z20.number() }),
+  z20.strictObject({ kind: z20.literal("binaryTurnover"), pid: z20.number().int().positive(), observedAt: z20.number() }),
   z20.strictObject({ kind: z20.literal("idleShutdown"), pid: z20.number().int().positive(), observedAt: z20.number() })
 ]);
 var QuotaExpiringEventSchema = z20.strictObject({
@@ -12559,7 +12626,7 @@ init_socket();
 init_state2();
 init_state();
 function headroomSocketTarget(fsPort, trust, paths) {
-  const socketPath = readHeadroomState(fsPort, paths.headroomStateFile)?.socketPath;
+  const socketPath = readHeadroomState(fsPort, paths.headroomStateFile)?.socketPath ?? readHeadroomState(fsPort, paths.headroomLegacyStateFile)?.socketPath;
   return socketPath === void 0 ? void 0 : verifyHeadroomSocket(socketPath, trust);
 }
 function collectFrontDoorStatus(fsPort, socketTrust, paths, isRunning) {
@@ -12767,6 +12834,9 @@ function createDoorHealthPublisher(hub, now, pid) {
     },
     idleShutdown: () => {
       publisher.publish({ kind: "idleShutdown", pid, observedAt: now() });
+    },
+    binaryTurnover: () => {
+      publisher.publish({ kind: "binaryTurnover", pid, observedAt: now() });
     }
   };
 }
@@ -14462,7 +14532,7 @@ data: ${JSON.stringify(envelope)}
 
 // src/frontdoor/rcSelfHostMint.ts
 init_account();
-import path29 from "node:path";
+import path30 from "node:path";
 var CREDENTIALS_FILE = ".credentials.json";
 var CLAUDE_JSON2 = ".claude.json";
 var RC_SELF_HOST_RECORD_DIR = "rc-selfhost";
@@ -14486,7 +14556,7 @@ function readJsonObject(fs12, file) {
   return isRecord11(parsed) ? parsed : void 0;
 }
 function readRcSelfHostRecord(fs12, frontdoorDir) {
-  const parsed = readJsonObject(fs12, path29.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
+  const parsed = readJsonObject(fs12, path30.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
   if (parsed === void 0) {
     return void 0;
   }
@@ -14500,11 +14570,11 @@ function mintRcSelfHostCredential(deps) {
   if (!isIdentityName(deps.identity)) {
     throw new Error(`"${deps.identity}" is not a valid identity name.`);
   }
-  const identityDir = path29.join(deps.identitiesDir, deps.identity);
-  const credentialsFile = path29.join(identityDir, CREDENTIALS_FILE);
-  const claudeJsonFile = path29.join(identityDir, CLAUDE_JSON2);
-  const recordDir = path29.join(deps.frontdoorDir, RC_SELF_HOST_RECORD_DIR);
-  const recordFile = path29.join(recordDir, RC_SELF_HOST_RECORD_FILE);
+  const identityDir = path30.join(deps.identitiesDir, deps.identity);
+  const credentialsFile = path30.join(identityDir, CREDENTIALS_FILE);
+  const claudeJsonFile = path30.join(identityDir, CLAUDE_JSON2);
+  const recordDir = path30.join(deps.frontdoorDir, RC_SELF_HOST_RECORD_DIR);
+  const recordFile = path30.join(recordDir, RC_SELF_HOST_RECORD_FILE);
   const previousRecord = readRcSelfHostRecord(deps.fs, deps.frontdoorDir);
   const existingCredentials = readJsonObject(deps.fs, credentialsFile);
   const existingOauth = isRecord11(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
@@ -14520,7 +14590,7 @@ function mintRcSelfHostCredential(deps) {
   const organizationUuid = deps.newUuid();
   const accountUuid = deps.newUuid();
   const mintedAt = new Date(deps.now()).toISOString();
-  deps.fs.mkdirPrivate(path29.dirname(credentialsFile));
+  deps.fs.mkdirPrivate(path30.dirname(credentialsFile));
   deps.fs.writeFilePrivate(credentialsFile, `${JSON.stringify({ ...existingCredentials, claudeAiOauth: { accessToken, refreshToken, expiresAt: null, scopes: [...RC_SELF_HOST_SCOPE_LIST], subscriptionType: SELF_HOST_SUBSCRIPTION_TYPE, rateLimitTier: null } }, null, 2)}
 `);
   const claudeJson = readJsonObject(deps.fs, claudeJsonFile) ?? {};
@@ -15052,5 +15122,6 @@ export {
   updateDirectoryRule,
   updateProvider,
   useIdentity,
+  watchedInstallEntry,
   writeDirectoryRules
 };