agent-shim 8.5.0 → 8.5.2

package/dist/cli.cjs

@@ -55107,18 +55107,14 @@ function discoverClaudeBinary(options) {
       version: highestVersion
     };
   }
-  const ownInstallDirs = new Set(options.ownInstallDirs.map((dir) => import_node_path3.default.resolve(dir)));
   for (const dir of options.pathDirs) {
-    if (ownInstallDirs.has(import_node_path3.default.resolve(dir))) {
-      continue;
-    }
     const found = options.findExecutableInDir(dir, "claude");
-    if (found !== void 0) {
+    if (found !== void 0 && !options.isOwnBinary(found)) {
       return { path: found, source: "path-fallback" };
     }
   }
   throw new Error(
-    `Could not find a claude binary. Looked for genuinely-executable versioned binaries under "${versionsDir}" (missing, empty, or containing nothing executable) and for a "claude" executable on PATH (excluding this tool's own install directory). Install Claude Code, or set the versions directory / PATH correctly, then try again.`
+    `Could not find a claude binary. Looked for genuinely-executable versioned binaries under "${versionsDir}" (missing, empty, or containing nothing executable) and for a "claude" executable on PATH (never this tool's own binary). Install Claude Code, or set the versions directory / PATH correctly, then try again.`
   );
 }
 
@@ -55970,12 +55966,12 @@ function resolveContentSourcePath(env) {
 function realContentSourcePath() {
   return resolveContentSourcePath({ isSea: (0, import_node_sea.isSea)(), execPath: process.execPath, argv1: process.argv[1] });
 }
-function realResolveClaudeBinary(ownInstallDirs) {
+function realResolveClaudeBinary(isOwnBinary) {
   return () => discoverClaudeBinary({
     listVersionsDir,
     pathDirs: (process.env.PATH ?? "").split(import_node_path6.default.delimiter).filter((dir) => dir !== ""),
     findExecutableInDir,
-    ownInstallDirs: [...ownInstallDirs]
+    isOwnBinary
   });
 }
 
@@ -56017,13 +56013,19 @@ function commandFilename(ownExecutablePath, commandName) {
 function isInvokedAsClaude(invokedName) {
   return invokedName === "claude" || invokedName.toLowerCase() === "claude.exe";
 }
-function resolveOwnInstallDirs(paths, ownExecutablePath) {
-  const dirs = [import_node_path7.default.dirname(ownExecutablePath)];
+function resolveOwnBinaryCheck(paths, contentSourcePath) {
   const state = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-  if (state !== void 0) {
-    dirs.push(import_node_path7.default.dirname(state.targetPath));
-  }
-  return dirs;
+  const recordedTarget = state === void 0 ? void 0 : import_node_path7.default.resolve(state.targetPath);
+  let ownStat;
+  return (candidate) => {
+    if (recordedTarget !== void 0 && import_node_path7.default.resolve(candidate) === recordedTarget) {
+      return true;
+    }
+    ownStat ??= statOrUndefined(contentSourcePath);
+    const candidateStat = statOrUndefined(candidate);
+    return ownStat !== void 0 && candidateStat !== void 0 && // A platform reporting no inode number for either file must not read every candidate as this tool.
+    ownStat.ino !== 0 && candidateStat.ino !== 0 && candidateStat.dev === ownStat.dev && candidateStat.ino === ownStat.ino;
+  };
 }
 function resolveClaudeTargetPath(ownExecutablePath, dir) {
   return import_node_path7.default.join(dir ?? import_node_path7.default.dirname(ownExecutablePath), claudeTargetFilename(ownExecutablePath));
@@ -56044,6 +56046,16 @@ function lstatOrUndefined(target) {
     throw error62;
   }
 }
+function statOrUndefined(target) {
+  try {
+    return import_node_fs4.default.statSync(target);
+  } catch (error62) {
+    if (isEnoent3(error62)) {
+      return void 0;
+    }
+    throw error62;
+  }
+}
 var nodeLinkFs = { link: import_node_fs4.default.linkSync, copyFile: import_node_fs4.default.copyFileSync, chmod: import_node_fs4.default.chmodSync };
 function enableClaudeShim(params, linkFs = nodeLinkFs) {
   const realContentPath = import_node_fs4.default.realpathSync(params.contentSourcePath);
@@ -61040,7 +61052,7 @@ function registerIdentityCommand(program2, deps) {
 // package.json
 var package_default = {
   name: "agent-shim",
-  version: "8.5.0",
+  version: "8.5.2",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -64924,13 +64936,14 @@ function realConnectCertStore(paths) {
 }
 
 // src/frontdoor/connectEffects.ts
-var dns = __toESM(require("node:dns"), 1);
+var import_node_dns = __toESM(require("node:dns"), 1);
 var http = __toESM(require("node:http"), 1);
 var https = __toESM(require("node:https"), 1);
 var net2 = __toESM(require("node:net"), 1);
 var tls = __toESM(require("node:tls"), 1);
 var UPSTREAM_LOCAL_PORT_START = 47900;
 var UPSTREAM_LOCAL_PORT_END = 47919;
+var UPSTREAM_LOCAL_PORT_COUNT = UPSTREAM_LOCAL_PORT_END - UPSTREAM_LOCAL_PORT_START + 1;
 var nextUpstreamLocalPort = UPSTREAM_LOCAL_PORT_START;
 function upstreamLocalPort() {
   const port = nextUpstreamLocalPort;
@@ -64942,42 +64955,93 @@ var realAddressLookup = (host, _options, callback) => {
     callback(null, [{ address: host, family: net2.isIP(host) }]);
     return;
   }
-  dns.resolve4(host, (error62, addresses) => {
+  import_node_dns.default.resolve4(host, (error62, addresses) => {
+    if (error62 !== null) {
+      callback(error62, [{ address: "", family: 4 }]);
+      return;
+    }
     const first = addresses[0];
-    if (error62 !== null || first === void 0) {
-      callback(error62 ?? new Error(`no A record for ${host}`), [{ address: "", family: 4 }]);
+    if (first === void 0) {
+      callback(new Error(`no A record for ${host}`), [{ address: "", family: 4 }]);
       return;
     }
     callback(null, [{ address: first, family: 4 }]);
   });
 };
 var HTTP_PORT = 80;
-function exemptDial(options, defaultPort) {
-  const host = typeof options.host === "string" ? options.host : "";
-  const port = typeof options.port === "number" ? options.port : defaultPort;
-  return net2.connect(net2.isIP(host) === 0 ? { host, port, localPort: upstreamLocalPort(), lookup: realAddressLookup } : { host, port });
+var HELD_PORT_ERRNOS = /* @__PURE__ */ new Set(["EADDRINUSE", "EADDRNOTAVAIL"]);
+async function dialOnce(connectOptions) {
+  return await new Promise((resolve) => {
+    const socket = net2.connect(connectOptions);
+    socket.once("connect", () => {
+      resolve({ error: null, socket });
+    });
+    socket.once("error", (error62) => {
+      resolve({ error: error62, socket });
+    });
+  });
+}
+function dialTarget(options, defaultPort) {
+  return { host: typeof options.host === "string" ? options.host : "", port: typeof options.port === "number" ? options.port : defaultPort };
+}
+function literalDial(target) {
+  return net2.connect({ host: target.host, port: target.port });
+}
+async function reservedDial(target) {
+  for (let attempt = 0; ; attempt += 1) {
+    const outcome = await dialOnce({ host: target.host, port: target.port, localPort: upstreamLocalPort(), lookup: realAddressLookup });
+    if (outcome.error === null) {
+      return outcome;
+    }
+    const held = outcome.error.code !== void 0 && HELD_PORT_ERRNOS.has(outcome.error.code);
+    if (!held || attempt === UPSTREAM_LOCAL_PORT_COUNT - 1) {
+      return outcome;
+    }
+  }
 }
 function requestServername(options, fallback) {
   return "servername" in options && typeof options.servername === "string" && options.servername !== "" ? options.servername : fallback;
 }
 var ExemptHttpAgent = class extends http.Agent {
-  createConnection(options) {
-    return exemptDial(options, HTTP_PORT);
+  // A reserved-port dial that has to retry cannot produce its socket synchronously, so it settles first and arrives through the callback (node's documented asynchronous createConnection form); a literal dial has nothing to retry and keeps node's own synchronous shape.
+  createConnection(options, oncreate) {
+    const target = dialTarget(options, HTTP_PORT);
+    if (net2.isIP(target.host) !== 0) {
+      return literalDial(target);
+    }
+    void reservedDial(target).then((outcome) => {
+      oncreate?.(outcome.error, outcome.socket);
+    });
+    return void 0;
   }
 };
 var ExemptTlsAgent = class extends https.Agent {
-  createConnection(options) {
-    const host = typeof options.host === "string" ? options.host : "";
-    const tlsOptions = { socket: exemptDial(options, HTTPS_PORT), servername: requestServername(options, host) };
-    if ("ca" in options && Array.isArray(options.ca)) {
-      tlsOptions.ca = options.ca;
-    }
-    if ("rejectUnauthorized" in options && typeof options.rejectUnauthorized === "boolean") {
-      tlsOptions.rejectUnauthorized = options.rejectUnauthorized;
-    }
-    return tls.connect(tlsOptions);
+  // The same split as the plain sibling: a literal dial wraps TLS around the socket node's own agent would have returned, a reserved dial settles (retries included) first and arrives through the callback, which is exactly where node's own agent wraps its own dials.
+  createConnection(options, oncreate) {
+    const target = dialTarget(options, HTTPS_PORT);
+    if (net2.isIP(target.host) !== 0) {
+      return tls.connect({ socket: literalDial(target), servername: requestServername(options, target.host), ...tlsFacts(options) });
+    }
+    void reservedDial(target).then((outcome) => {
+      if (outcome.error !== null) {
+        oncreate?.(outcome.error, outcome.socket);
+        return;
+      }
+      oncreate?.(null, tls.connect({ socket: outcome.socket, servername: requestServername(options, target.host), ...tlsFacts(options) }));
+    });
+    return void 0;
   }
 };
+function tlsFacts(options) {
+  const facts = {};
+  if ("ca" in options && Array.isArray(options.ca)) {
+    facts.ca = options.ca;
+  }
+  if ("rejectUnauthorized" in options && typeof options.rejectUnauthorized === "boolean") {
+    facts.rejectUnauthorized = options.rejectUnauthorized;
+  }
+  return facts;
+}
 function realRcEventDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
   return {
@@ -68982,7 +69046,7 @@ function collectDoctorReport(params) {
   const ownExecutablePath = realOwnExecutablePath();
   let binaryDiscovery;
   try {
-    const binary = realResolveClaudeBinary(resolveOwnInstallDirs(paths, ownExecutablePath))();
+    const binary = realResolveClaudeBinary(resolveOwnBinaryCheck(paths, realContentSourcePath()))();
     binaryDiscovery = { ok: true, binary };
   } catch (error62) {
     binaryDiscovery = { ok: false, message: error62 instanceof Error ? error62.message : String(error62) };
@@ -71062,7 +71126,7 @@ function realPrepareLaunchParams(paths, options) {
     fs: realFsPort,
     proc: options.proc,
     log: options.log,
-    resolveClaudeBinary: realResolveClaudeBinary(resolveOwnInstallDirs(paths, realOwnExecutablePath())),
+    resolveClaudeBinary: realResolveClaudeBinary(resolveOwnBinaryCheck(paths, realContentSourcePath())),
     farm: farm.runtime,
     headroom: realHeadroomPort(paths, { spawnDaemon: options.spawnDaemon, cwd: farm.runtime.cwd }),
     frontdoor: realFrontDoorPort(paths, options.spawnDaemon),

package/dist/index.cjs

@@ -3248,13 +3248,14 @@ function realConnectCertStore(paths) {
 }
 
 // src/frontdoor/connectEffects.ts
-var dns = __toESM(require("node:dns"), 1);
+var import_node_dns = __toESM(require("node:dns"), 1);
 var http = __toESM(require("node:http"), 1);
 var https = __toESM(require("node:https"), 1);
 var net2 = __toESM(require("node:net"), 1);
 var tls = __toESM(require("node:tls"), 1);
 var UPSTREAM_LOCAL_PORT_START = 47900;
 var UPSTREAM_LOCAL_PORT_END = 47919;
+var UPSTREAM_LOCAL_PORT_COUNT = UPSTREAM_LOCAL_PORT_END - UPSTREAM_LOCAL_PORT_START + 1;
 var nextUpstreamLocalPort = UPSTREAM_LOCAL_PORT_START;
 function upstreamLocalPort() {
   const port = nextUpstreamLocalPort;
@@ -3266,42 +3267,93 @@ var realAddressLookup = (host, _options, callback) => {
     callback(null, [{ address: host, family: net2.isIP(host) }]);
     return;
   }
-  dns.resolve4(host, (error, addresses) => {
+  import_node_dns.default.resolve4(host, (error, addresses) => {
+    if (error !== null) {
+      callback(error, [{ address: "", family: 4 }]);
+      return;
+    }
     const first = addresses[0];
-    if (error !== null || first === void 0) {
-      callback(error ?? new Error(`no A record for ${host}`), [{ address: "", family: 4 }]);
+    if (first === void 0) {
+      callback(new Error(`no A record for ${host}`), [{ address: "", family: 4 }]);
       return;
     }
     callback(null, [{ address: first, family: 4 }]);
   });
 };
 var HTTP_PORT = 80;
-function exemptDial(options, defaultPort) {
-  const host = typeof options.host === "string" ? options.host : "";
-  const port = typeof options.port === "number" ? options.port : defaultPort;
-  return net2.connect(net2.isIP(host) === 0 ? { host, port, localPort: upstreamLocalPort(), lookup: realAddressLookup } : { host, port });
+var HELD_PORT_ERRNOS = /* @__PURE__ */ new Set(["EADDRINUSE", "EADDRNOTAVAIL"]);
+async function dialOnce(connectOptions) {
+  return await new Promise((resolve) => {
+    const socket = net2.connect(connectOptions);
+    socket.once("connect", () => {
+      resolve({ error: null, socket });
+    });
+    socket.once("error", (error) => {
+      resolve({ error, socket });
+    });
+  });
+}
+function dialTarget(options, defaultPort) {
+  return { host: typeof options.host === "string" ? options.host : "", port: typeof options.port === "number" ? options.port : defaultPort };
+}
+function literalDial(target) {
+  return net2.connect({ host: target.host, port: target.port });
+}
+async function reservedDial(target) {
+  for (let attempt = 0; ; attempt += 1) {
+    const outcome = await dialOnce({ host: target.host, port: target.port, localPort: upstreamLocalPort(), lookup: realAddressLookup });
+    if (outcome.error === null) {
+      return outcome;
+    }
+    const held = outcome.error.code !== void 0 && HELD_PORT_ERRNOS.has(outcome.error.code);
+    if (!held || attempt === UPSTREAM_LOCAL_PORT_COUNT - 1) {
+      return outcome;
+    }
+  }
 }
 function requestServername(options, fallback) {
   return "servername" in options && typeof options.servername === "string" && options.servername !== "" ? options.servername : fallback;
 }
 var ExemptHttpAgent = class extends http.Agent {
-  createConnection(options) {
-    return exemptDial(options, HTTP_PORT);
+  // A reserved-port dial that has to retry cannot produce its socket synchronously, so it settles first and arrives through the callback (node's documented asynchronous createConnection form); a literal dial has nothing to retry and keeps node's own synchronous shape.
+  createConnection(options, oncreate) {
+    const target = dialTarget(options, HTTP_PORT);
+    if (net2.isIP(target.host) !== 0) {
+      return literalDial(target);
+    }
+    void reservedDial(target).then((outcome) => {
+      oncreate?.(outcome.error, outcome.socket);
+    });
+    return void 0;
   }
 };
 var ExemptTlsAgent = class extends https.Agent {
-  createConnection(options) {
-    const host = typeof options.host === "string" ? options.host : "";
-    const tlsOptions = { socket: exemptDial(options, HTTPS_PORT), servername: requestServername(options, host) };
-    if ("ca" in options && Array.isArray(options.ca)) {
-      tlsOptions.ca = options.ca;
-    }
-    if ("rejectUnauthorized" in options && typeof options.rejectUnauthorized === "boolean") {
-      tlsOptions.rejectUnauthorized = options.rejectUnauthorized;
-    }
-    return tls.connect(tlsOptions);
+  // The same split as the plain sibling: a literal dial wraps TLS around the socket node's own agent would have returned, a reserved dial settles (retries included) first and arrives through the callback, which is exactly where node's own agent wraps its own dials.
+  createConnection(options, oncreate) {
+    const target = dialTarget(options, HTTPS_PORT);
+    if (net2.isIP(target.host) !== 0) {
+      return tls.connect({ socket: literalDial(target), servername: requestServername(options, target.host), ...tlsFacts(options) });
+    }
+    void reservedDial(target).then((outcome) => {
+      if (outcome.error !== null) {
+        oncreate?.(outcome.error, outcome.socket);
+        return;
+      }
+      oncreate?.(null, tls.connect({ socket: outcome.socket, servername: requestServername(options, target.host), ...tlsFacts(options) }));
+    });
+    return void 0;
   }
 };
+function tlsFacts(options) {
+  const facts = {};
+  if ("ca" in options && Array.isArray(options.ca)) {
+    facts.ca = options.ca;
+  }
+  if ("rejectUnauthorized" in options && typeof options.rejectUnauthorized === "boolean") {
+    facts.rejectUnauthorized = options.rejectUnauthorized;
+  }
+  return facts;
+}
 function realRcEventDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
   return {
@@ -6935,18 +6987,14 @@ function discoverClaudeBinary(options) {
       version: highestVersion
     };
   }
-  const ownInstallDirs = new Set(options.ownInstallDirs.map((dir) => import_node_path20.default.resolve(dir)));
   for (const dir of options.pathDirs) {
-    if (ownInstallDirs.has(import_node_path20.default.resolve(dir))) {
-      continue;
-    }
     const found = options.findExecutableInDir(dir, "claude");
-    if (found !== void 0) {
+    if (found !== void 0 && !options.isOwnBinary(found)) {
       return { path: found, source: "path-fallback" };
     }
   }
   throw new Error(
-    `Could not find a claude binary. Looked for genuinely-executable versioned binaries under "${versionsDir}" (missing, empty, or containing nothing executable) and for a "claude" executable on PATH (excluding this tool's own install directory). Install Claude Code, or set the versions directory / PATH correctly, then try again.`
+    `Could not find a claude binary. Looked for genuinely-executable versioned binaries under "${versionsDir}" (missing, empty, or containing nothing executable) and for a "claude" executable on PATH (never this tool's own binary). Install Claude Code, or set the versions directory / PATH correctly, then try again.`
   );
 }
 
@@ -7344,12 +7392,18 @@ function realOwnExecutablePath() {
     findExecutableInDir
   });
 }
-function realResolveClaudeBinary(ownInstallDirs) {
+function resolveContentSourcePath(env) {
+  return env.isSea ? env.execPath : env.argv1 ?? env.execPath;
+}
+function realContentSourcePath() {
+  return resolveContentSourcePath({ isSea: (0, import_node_sea.isSea)(), execPath: process.execPath, argv1: process.argv[1] });
+}
+function realResolveClaudeBinary(isOwnBinary) {
   return () => discoverClaudeBinary({
     listVersionsDir,
     pathDirs: (process.env.PATH ?? "").split(import_node_path21.default.delimiter).filter((dir) => dir !== ""),
     findExecutableInDir,
-    ownInstallDirs: [...ownInstallDirs]
+    isOwnBinary
   });
 }
 
@@ -7765,13 +7819,32 @@ var ClaudeShimStateSchema = import_zod11.z.strictObject({
 function commandFilename(ownExecutablePath, commandName) {
   return ownExecutablePath.toLowerCase().endsWith(".exe") ? `${commandName}.exe` : commandName;
 }
-function resolveOwnInstallDirs(paths, ownExecutablePath) {
-  const dirs = [import_node_path23.default.dirname(ownExecutablePath)];
+function resolveOwnBinaryCheck(paths, contentSourcePath) {
   const state = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-  if (state !== void 0) {
-    dirs.push(import_node_path23.default.dirname(state.targetPath));
+  const recordedTarget = state === void 0 ? void 0 : import_node_path23.default.resolve(state.targetPath);
+  let ownStat;
+  return (candidate) => {
+    if (recordedTarget !== void 0 && import_node_path23.default.resolve(candidate) === recordedTarget) {
+      return true;
+    }
+    ownStat ??= statOrUndefined(contentSourcePath);
+    const candidateStat = statOrUndefined(candidate);
+    return ownStat !== void 0 && candidateStat !== void 0 && // A platform reporting no inode number for either file must not read every candidate as this tool.
+    ownStat.ino !== 0 && candidateStat.ino !== 0 && candidateStat.dev === ownStat.dev && candidateStat.ino === ownStat.ino;
+  };
+}
+function isEnoent4(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+function statOrUndefined(target) {
+  try {
+    return import_node_fs7.default.statSync(target);
+  } catch (error) {
+    if (isEnoent4(error)) {
+      return void 0;
+    }
+    throw error;
   }
-  return dirs;
 }
 var nodeLinkFs = { link: import_node_fs7.default.linkSync, copyFile: import_node_fs7.default.copyFileSync, chmod: import_node_fs7.default.chmodSync };
 function findPathShadow(params) {
@@ -8212,7 +8285,7 @@ function collectDoctorReport(params) {
   const ownExecutablePath = realOwnExecutablePath();
   let binaryDiscovery;
   try {
-    const binary = realResolveClaudeBinary(resolveOwnInstallDirs(paths, ownExecutablePath))();
+    const binary = realResolveClaudeBinary(resolveOwnBinaryCheck(paths, realContentSourcePath()))();
     binaryDiscovery = { ok: true, binary };
   } catch (error) {
     binaryDiscovery = { ok: false, message: error instanceof Error ? error.message : String(error) };
@@ -9188,7 +9261,7 @@ function realPrepareLaunchParams(paths, options) {
     fs: realFsPort,
     proc: options.proc,
     log: options.log,
-    resolveClaudeBinary: realResolveClaudeBinary(resolveOwnInstallDirs(paths, realOwnExecutablePath())),
+    resolveClaudeBinary: realResolveClaudeBinary(resolveOwnBinaryCheck(paths, realContentSourcePath())),
     farm: farm.runtime,
     headroom: realHeadroomPort(paths, { spawnDaemon: options.spawnDaemon, cwd: farm.runtime.cwd }),
     frontdoor: realFrontDoorPort(paths, options.spawnDaemon),

package/dist/index.mjs

@@ -3064,13 +3064,14 @@ function realConnectCertStore(paths) {
 }
 
 // src/frontdoor/connectEffects.ts
-import * as dns from "node:dns";
+import dns from "node:dns";
 import * as http from "node:http";
 import * as https from "node:https";
 import * as net2 from "node:net";
 import * as tls from "node:tls";
 var UPSTREAM_LOCAL_PORT_START = 47900;
 var UPSTREAM_LOCAL_PORT_END = 47919;
+var UPSTREAM_LOCAL_PORT_COUNT = UPSTREAM_LOCAL_PORT_END - UPSTREAM_LOCAL_PORT_START + 1;
 var nextUpstreamLocalPort = UPSTREAM_LOCAL_PORT_START;
 function upstreamLocalPort() {
   const port = nextUpstreamLocalPort;
@@ -3083,41 +3084,92 @@ var realAddressLookup = (host, _options, callback) => {
     return;
   }
   dns.resolve4(host, (error, addresses) => {
+    if (error !== null) {
+      callback(error, [{ address: "", family: 4 }]);
+      return;
+    }
     const first = addresses[0];
-    if (error !== null || first === void 0) {
-      callback(error ?? new Error(`no A record for ${host}`), [{ address: "", family: 4 }]);
+    if (first === void 0) {
+      callback(new Error(`no A record for ${host}`), [{ address: "", family: 4 }]);
       return;
     }
     callback(null, [{ address: first, family: 4 }]);
   });
 };
 var HTTP_PORT = 80;
-function exemptDial(options, defaultPort) {
-  const host = typeof options.host === "string" ? options.host : "";
-  const port = typeof options.port === "number" ? options.port : defaultPort;
-  return net2.connect(net2.isIP(host) === 0 ? { host, port, localPort: upstreamLocalPort(), lookup: realAddressLookup } : { host, port });
+var HELD_PORT_ERRNOS = /* @__PURE__ */ new Set(["EADDRINUSE", "EADDRNOTAVAIL"]);
+async function dialOnce(connectOptions) {
+  return await new Promise((resolve) => {
+    const socket = net2.connect(connectOptions);
+    socket.once("connect", () => {
+      resolve({ error: null, socket });
+    });
+    socket.once("error", (error) => {
+      resolve({ error, socket });
+    });
+  });
+}
+function dialTarget(options, defaultPort) {
+  return { host: typeof options.host === "string" ? options.host : "", port: typeof options.port === "number" ? options.port : defaultPort };
+}
+function literalDial(target) {
+  return net2.connect({ host: target.host, port: target.port });
+}
+async function reservedDial(target) {
+  for (let attempt = 0; ; attempt += 1) {
+    const outcome = await dialOnce({ host: target.host, port: target.port, localPort: upstreamLocalPort(), lookup: realAddressLookup });
+    if (outcome.error === null) {
+      return outcome;
+    }
+    const held = outcome.error.code !== void 0 && HELD_PORT_ERRNOS.has(outcome.error.code);
+    if (!held || attempt === UPSTREAM_LOCAL_PORT_COUNT - 1) {
+      return outcome;
+    }
+  }
 }
 function requestServername(options, fallback) {
   return "servername" in options && typeof options.servername === "string" && options.servername !== "" ? options.servername : fallback;
 }
 var ExemptHttpAgent = class extends http.Agent {
-  createConnection(options) {
-    return exemptDial(options, HTTP_PORT);
+  // A reserved-port dial that has to retry cannot produce its socket synchronously, so it settles first and arrives through the callback (node's documented asynchronous createConnection form); a literal dial has nothing to retry and keeps node's own synchronous shape.
+  createConnection(options, oncreate) {
+    const target = dialTarget(options, HTTP_PORT);
+    if (net2.isIP(target.host) !== 0) {
+      return literalDial(target);
+    }
+    void reservedDial(target).then((outcome) => {
+      oncreate?.(outcome.error, outcome.socket);
+    });
+    return void 0;
   }
 };
 var ExemptTlsAgent = class extends https.Agent {
-  createConnection(options) {
-    const host = typeof options.host === "string" ? options.host : "";
-    const tlsOptions = { socket: exemptDial(options, HTTPS_PORT), servername: requestServername(options, host) };
-    if ("ca" in options && Array.isArray(options.ca)) {
-      tlsOptions.ca = options.ca;
-    }
-    if ("rejectUnauthorized" in options && typeof options.rejectUnauthorized === "boolean") {
-      tlsOptions.rejectUnauthorized = options.rejectUnauthorized;
-    }
-    return tls.connect(tlsOptions);
+  // The same split as the plain sibling: a literal dial wraps TLS around the socket node's own agent would have returned, a reserved dial settles (retries included) first and arrives through the callback, which is exactly where node's own agent wraps its own dials.
+  createConnection(options, oncreate) {
+    const target = dialTarget(options, HTTPS_PORT);
+    if (net2.isIP(target.host) !== 0) {
+      return tls.connect({ socket: literalDial(target), servername: requestServername(options, target.host), ...tlsFacts(options) });
+    }
+    void reservedDial(target).then((outcome) => {
+      if (outcome.error !== null) {
+        oncreate?.(outcome.error, outcome.socket);
+        return;
+      }
+      oncreate?.(null, tls.connect({ socket: outcome.socket, servername: requestServername(options, target.host), ...tlsFacts(options) }));
+    });
+    return void 0;
   }
 };
+function tlsFacts(options) {
+  const facts = {};
+  if ("ca" in options && Array.isArray(options.ca)) {
+    facts.ca = options.ca;
+  }
+  if ("rejectUnauthorized" in options && typeof options.rejectUnauthorized === "boolean") {
+    facts.rejectUnauthorized = options.rejectUnauthorized;
+  }
+  return facts;
+}
 function realRcEventDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
   return {
@@ -6751,18 +6803,14 @@ function discoverClaudeBinary(options) {
       version: highestVersion
     };
   }
-  const ownInstallDirs = new Set(options.ownInstallDirs.map((dir) => path20.resolve(dir)));
   for (const dir of options.pathDirs) {
-    if (ownInstallDirs.has(path20.resolve(dir))) {
-      continue;
-    }
     const found = options.findExecutableInDir(dir, "claude");
-    if (found !== void 0) {
+    if (found !== void 0 && !options.isOwnBinary(found)) {
       return { path: found, source: "path-fallback" };
     }
   }
   throw new Error(
-    `Could not find a claude binary. Looked for genuinely-executable versioned binaries under "${versionsDir}" (missing, empty, or containing nothing executable) and for a "claude" executable on PATH (excluding this tool's own install directory). Install Claude Code, or set the versions directory / PATH correctly, then try again.`
+    `Could not find a claude binary. Looked for genuinely-executable versioned binaries under "${versionsDir}" (missing, empty, or containing nothing executable) and for a "claude" executable on PATH (never this tool's own binary). Install Claude Code, or set the versions directory / PATH correctly, then try again.`
   );
 }
 
@@ -7160,12 +7208,18 @@ function realOwnExecutablePath() {
     findExecutableInDir
   });
 }
-function realResolveClaudeBinary(ownInstallDirs) {
+function resolveContentSourcePath(env) {
+  return env.isSea ? env.execPath : env.argv1 ?? env.execPath;
+}
+function realContentSourcePath() {
+  return resolveContentSourcePath({ isSea: isSea(), execPath: process.execPath, argv1: process.argv[1] });
+}
+function realResolveClaudeBinary(isOwnBinary) {
   return () => discoverClaudeBinary({
     listVersionsDir,
     pathDirs: (process.env.PATH ?? "").split(path21.delimiter).filter((dir) => dir !== ""),
     findExecutableInDir,
-    ownInstallDirs: [...ownInstallDirs]
+    isOwnBinary
   });
 }
 
@@ -7581,13 +7635,32 @@ var ClaudeShimStateSchema = z11.strictObject({
 function commandFilename(ownExecutablePath, commandName) {
   return ownExecutablePath.toLowerCase().endsWith(".exe") ? `${commandName}.exe` : commandName;
 }
-function resolveOwnInstallDirs(paths, ownExecutablePath) {
-  const dirs = [path23.dirname(ownExecutablePath)];
+function resolveOwnBinaryCheck(paths, contentSourcePath) {
   const state = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-  if (state !== void 0) {
-    dirs.push(path23.dirname(state.targetPath));
+  const recordedTarget = state === void 0 ? void 0 : path23.resolve(state.targetPath);
+  let ownStat;
+  return (candidate) => {
+    if (recordedTarget !== void 0 && path23.resolve(candidate) === recordedTarget) {
+      return true;
+    }
+    ownStat ??= statOrUndefined(contentSourcePath);
+    const candidateStat = statOrUndefined(candidate);
+    return ownStat !== void 0 && candidateStat !== void 0 && // A platform reporting no inode number for either file must not read every candidate as this tool.
+    ownStat.ino !== 0 && candidateStat.ino !== 0 && candidateStat.dev === ownStat.dev && candidateStat.ino === ownStat.ino;
+  };
+}
+function isEnoent4(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+function statOrUndefined(target) {
+  try {
+    return fs8.statSync(target);
+  } catch (error) {
+    if (isEnoent4(error)) {
+      return void 0;
+    }
+    throw error;
   }
-  return dirs;
 }
 var nodeLinkFs = { link: fs8.linkSync, copyFile: fs8.copyFileSync, chmod: fs8.chmodSync };
 function findPathShadow(params) {
@@ -8028,7 +8101,7 @@ function collectDoctorReport(params) {
   const ownExecutablePath = realOwnExecutablePath();
   let binaryDiscovery;
   try {
-    const binary = realResolveClaudeBinary(resolveOwnInstallDirs(paths, ownExecutablePath))();
+    const binary = realResolveClaudeBinary(resolveOwnBinaryCheck(paths, realContentSourcePath()))();
     binaryDiscovery = { ok: true, binary };
   } catch (error) {
     binaryDiscovery = { ok: false, message: error instanceof Error ? error.message : String(error) };
@@ -9004,7 +9077,7 @@ function realPrepareLaunchParams(paths, options) {
     fs: realFsPort,
     proc: options.proc,
     log: options.log,
-    resolveClaudeBinary: realResolveClaudeBinary(resolveOwnInstallDirs(paths, realOwnExecutablePath())),
+    resolveClaudeBinary: realResolveClaudeBinary(resolveOwnBinaryCheck(paths, realContentSourcePath())),
     farm: farm.runtime,
     headroom: realHeadroomPort(paths, { spawnDaemon: options.spawnDaemon, cwd: farm.runtime.cwd }),
     frontdoor: realFrontDoorPort(paths, options.spawnDaemon),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-shim",
-  "version": "8.5.0",
+  "version": "8.5.2",
   "description": "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   "license": "MIT",
   "author": "Joseph Mearman <joseph@mearman.co.uk>",