agent-shim 8.9.0 → 8.11.0

package/dist/cli.cjs

@@ -3248,42 +3248,42 @@ var require_defaults = __commonJS({
 var require_env_paths = __commonJS({
   "node_modules/.pnpm/env-paths@2.2.1/node_modules/env-paths/index.js"(exports2, module2) {
     "use strict";
-    var path41 = require("path");
+    var path42 = require("path");
     var os10 = require("os");
     var homedir = os10.homedir();
     var tmpdir = os10.tmpdir();
     var { env } = process;
     var macos = (name) => {
-      const library = path41.join(homedir, "Library");
+      const library = path42.join(homedir, "Library");
       return {
-        data: path41.join(library, "Application Support", name),
-        config: path41.join(library, "Preferences", name),
-        cache: path41.join(library, "Caches", name),
-        log: path41.join(library, "Logs", name),
-        temp: path41.join(tmpdir, name)
+        data: path42.join(library, "Application Support", name),
+        config: path42.join(library, "Preferences", name),
+        cache: path42.join(library, "Caches", name),
+        log: path42.join(library, "Logs", name),
+        temp: path42.join(tmpdir, name)
       };
     };
     var windows = (name) => {
-      const appData = env.APPDATA || path41.join(homedir, "AppData", "Roaming");
-      const localAppData = env.LOCALAPPDATA || path41.join(homedir, "AppData", "Local");
+      const appData = env.APPDATA || path42.join(homedir, "AppData", "Roaming");
+      const localAppData = env.LOCALAPPDATA || path42.join(homedir, "AppData", "Local");
       return {
         // Data/config/cache/log are invented by me as Windows isn't opinionated about this
-        data: path41.join(localAppData, name, "Data"),
-        config: path41.join(appData, name, "Config"),
-        cache: path41.join(localAppData, name, "Cache"),
-        log: path41.join(localAppData, name, "Log"),
-        temp: path41.join(tmpdir, name)
+        data: path42.join(localAppData, name, "Data"),
+        config: path42.join(appData, name, "Config"),
+        cache: path42.join(localAppData, name, "Cache"),
+        log: path42.join(localAppData, name, "Log"),
+        temp: path42.join(tmpdir, name)
       };
     };
     var linux = (name) => {
-      const username = path41.basename(homedir);
+      const username = path42.basename(homedir);
       return {
-        data: path41.join(env.XDG_DATA_HOME || path41.join(homedir, ".local", "share"), name),
-        config: path41.join(env.XDG_CONFIG_HOME || path41.join(homedir, ".config"), name),
-        cache: path41.join(env.XDG_CACHE_HOME || path41.join(homedir, ".cache"), name),
+        data: path42.join(env.XDG_DATA_HOME || path42.join(homedir, ".local", "share"), name),
+        config: path42.join(env.XDG_CONFIG_HOME || path42.join(homedir, ".config"), name),
+        cache: path42.join(env.XDG_CACHE_HOME || path42.join(homedir, ".cache"), name),
         // https://wiki.debian.org/XDGBaseDirectorySpecification#state
-        log: path41.join(env.XDG_STATE_HOME || path41.join(homedir, ".local", "state"), name),
-        temp: path41.join(tmpdir, username, name)
+        log: path42.join(env.XDG_STATE_HOME || path42.join(homedir, ".local", "state"), name),
+        temp: path42.join(tmpdir, username, name)
       };
     };
     var envPaths = (name, options) => {
@@ -3351,11 +3351,11 @@ var require_util = __commonJS({
       return result;
     }
     exports2.emplace = emplace;
-    function getPropertyByPath(source, path41) {
-      if (typeof path41 === "string" && Object.prototype.hasOwnProperty.call(source, path41)) {
-        return source[path41];
+    function getPropertyByPath(source, path42) {
+      if (typeof path42 === "string" && Object.prototype.hasOwnProperty.call(source, path42)) {
+        return source[path42];
       }
-      const parsedPath = typeof path41 === "string" ? path41.split(".") : path41;
+      const parsedPath = typeof path42 === "string" ? path42.split(".") : path42;
       return parsedPath.reduce((previous, key) => {
         if (previous === void 0) {
           return previous;
@@ -3378,9 +3378,9 @@ var require_util = __commonJS({
       return Object.fromEntries(Object.entries(options).filter(([, value2]) => value2 !== void 0));
     }
     exports2.removeUndefinedValuesFromObject = removeUndefinedValuesFromObject;
-    async function isDirectory(path41) {
+    async function isDirectory(path42) {
       try {
-        const stat = await fs_1.promises.stat(path41);
+        const stat = await fs_1.promises.stat(path42);
         return stat.isDirectory();
       } catch (e) {
         if (e.code === "ENOENT") {
@@ -3390,9 +3390,9 @@ var require_util = __commonJS({
       }
     }
     exports2.isDirectory = isDirectory;
-    function isDirectorySync(path41) {
+    function isDirectorySync(path42) {
       try {
-        const stat = fs_1.default.statSync(path41);
+        const stat = fs_1.default.statSync(path42);
         return stat.isDirectory();
       } catch (e) {
         if (e.code === "ENOENT") {
@@ -3490,7 +3490,7 @@ var require_ExplorerBase = __commonJS({
           const idx = importStack.indexOf(fullPath);
           if (idx !== -1) {
             throw new Error(`Circular import detected:
-${[...importStack, fullPath].map((path41, i2) => `${i2 + 1}. ${path41}`).join("\n")} (same as ${idx + 1}.)`);
+${[...importStack, fullPath].map((path42, i2) => `${i2 + 1}. ${path42}`).join("\n")} (same as ${idx + 1}.)`);
           }
         }
       }
@@ -3678,9 +3678,9 @@ var require_Explorer = __commonJS({
           throw error62;
         }
       }
-      async #fileExists(path41) {
+      async #fileExists(path42) {
         try {
-          await promises_1.default.stat(path41);
+          await promises_1.default.stat(path42);
           return true;
         } catch (e) {
           return false;
@@ -3840,9 +3840,9 @@ var require_ExplorerSync = __commonJS({
           throw error62;
         }
       }
-      #fileExists(path41) {
+      #fileExists(path42) {
         try {
-          fs_1.default.statSync(path41);
+          fs_1.default.statSync(path42);
           return true;
         } catch (e) {
           return false;
@@ -3966,7 +3966,7 @@ var require_dist = __commonJS({
       };
     }
     function getResolvedSearchPlaces(moduleName, toolDefinedSearchPlaces, userConfiguredOptions) {
-      const userConfiguredSearchPlaces = userConfiguredOptions.searchPlaces?.map((path41) => path41.replace("{name}", moduleName));
+      const userConfiguredSearchPlaces = userConfiguredOptions.searchPlaces?.map((path42) => path42.replace("{name}", moduleName));
       if (userConfiguredOptions.mergeSearchPlaces) {
         return [...userConfiguredSearchPlaces ?? [], ...toolDefinedSearchPlaces];
       }
@@ -4374,8 +4374,8 @@ var require_utils = __commonJS({
       }
       return output2;
     };
-    exports2.basename = (path41, { windows } = {}) => {
-      const segs = path41.split(windows ? /[\\/]/ : "/");
+    exports2.basename = (path42, { windows } = {}) => {
+      const segs = path42.split(windows ? /[\\/]/ : "/");
       const last = segs[segs.length - 1];
       if (last === "") {
         return segs[segs.length - 2];
@@ -7003,14 +7003,14 @@ var require_util2 = __commonJS({
         }
         const port = url2.port != null ? url2.port : url2.protocol === "https:" ? 443 : 80;
         let origin = url2.origin != null ? url2.origin : `${url2.protocol || ""}//${url2.hostname || ""}:${port}`;
-        let path41 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`;
+        let path42 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`;
         if (origin[origin.length - 1] === "/") {
           origin = origin.slice(0, origin.length - 1);
         }
-        if (path41 && path41[0] !== "/") {
-          path41 = `/${path41}`;
+        if (path42 && path42[0] !== "/") {
+          path42 = `/${path42}`;
         }
-        return new URL(`${origin}${path41}`);
+        return new URL(`${origin}${path42}`);
       }
       if (!isHttpOrHttpsPrefixed(url2.origin || url2.protocol)) {
         throw new InvalidArgumentError2("Invalid URL protocol: the URL must start with `http:` or `https:`.");
@@ -7831,9 +7831,9 @@ var require_diagnostics = __commonJS({
         "undici:client:sendHeaders",
         (evt) => {
           const {
-            request: { method, path: path41, origin }
+            request: { method, path: path42, origin }
           } = evt;
-          debugLog("sending request to %s %s%s", method, origin, path41);
+          debugLog("sending request to %s %s%s", method, origin, path42);
         }
       );
     }
@@ -7851,14 +7851,14 @@ var require_diagnostics = __commonJS({
         "undici:request:headers",
         (evt) => {
           const {
-            request: { method, path: path41, origin },
+            request: { method, path: path42, origin },
             response: { statusCode }
           } = evt;
           debugLog(
             "received response to %s %s%s - HTTP %d",
             method,
             origin,
-            path41,
+            path42,
             statusCode
           );
         }
@@ -7867,23 +7867,23 @@ var require_diagnostics = __commonJS({
         "undici:request:trailers",
         (evt) => {
           const {
-            request: { method, path: path41, origin }
+            request: { method, path: path42, origin }
           } = evt;
-          debugLog("trailers received from %s %s%s", method, origin, path41);
+          debugLog("trailers received from %s %s%s", method, origin, path42);
         }
       );
       diagnosticsChannel.subscribe(
         "undici:request:error",
         (evt) => {
           const {
-            request: { method, path: path41, origin },
+            request: { method, path: path42, origin },
             error: error62
           } = evt;
           debugLog(
             "request to %s %s%s errored - %s",
             method,
             origin,
-            path41,
+            path42,
             error62.message
           );
         }
@@ -7998,7 +7998,7 @@ var require_request = __commonJS({
     var kHandler = /* @__PURE__ */ Symbol("handler");
     var Request2 = class {
       constructor(origin, {
-        path: path41,
+        path: path42,
         method,
         body,
         headers,
@@ -8015,11 +8015,11 @@ var require_request = __commonJS({
         maxRedirections,
         typeOfService
       }, handler) {
-        if (typeof path41 !== "string") {
+        if (typeof path42 !== "string") {
           throw new InvalidArgumentError2("path must be a string");
-        } else if (path41[0] !== "/" && !(path41.startsWith("http://") || path41.startsWith("https://")) && method !== "CONNECT") {
+        } else if (path42[0] !== "/" && !(path42.startsWith("http://") || path42.startsWith("https://")) && method !== "CONNECT") {
           throw new InvalidArgumentError2("path must be an absolute URL or start with a slash");
-        } else if (invalidPathRegex.test(path41)) {
+        } else if (invalidPathRegex.test(path42)) {
           throw new InvalidArgumentError2("invalid request path");
         }
         if (typeof method !== "string") {
@@ -8094,7 +8094,7 @@ var require_request = __commonJS({
         this.completed = false;
         this.aborted = false;
         this.upgrade = upgrade || null;
-        this.path = query ? serializePathWithQuery(path41, query) : path41;
+        this.path = query ? serializePathWithQuery(path42, query) : path42;
         this.origin = origin;
         this.protocol = getProtocolFromUrlString(origin);
         this.idempotent = idempotent == null ? method === "HEAD" || method === "GET" : idempotent;
@@ -13276,7 +13276,7 @@ var require_client_h1 = __commonJS({
       return method !== "GET" && method !== "HEAD" && method !== "OPTIONS" && method !== "TRACE" && method !== "CONNECT";
     }
     function writeH1(client, request7) {
-      const { method, path: path41, host, upgrade, blocking, reset } = request7;
+      const { method, path: path42, host, upgrade, blocking, reset } = request7;
       let { body, headers, contentLength } = request7;
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH" || method === "QUERY" || method === "PROPFIND" || method === "PROPPATCH";
       if (util.isFormDataLike(body)) {
@@ -13354,7 +13354,7 @@ var require_client_h1 = __commonJS({
       if (socket.setTypeOfService) {
         socket.setTypeOfService(request7.typeOfService);
       }
-      let header = `${method} ${path41} HTTP/1.1\r
+      let header = `${method} ${path42} HTTP/1.1\r
 `;
       if (typeof host === "string") {
         header += `host: ${host}\r
@@ -14033,7 +14033,7 @@ var require_client_h2 = __commonJS({
       const headersTimeout = request7.headersTimeout ?? client[kHeadersTimeout];
       const bodyTimeout = request7.bodyTimeout ?? client[kBodyTimeout];
       const session = client[kHTTP2Session];
-      const { method, path: path41, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request7;
+      const { method, path: path42, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request7;
       let { body } = request7;
       if (upgrade != null && upgrade !== "websocket") {
         util.errorRequest(client, request7, new InvalidArgumentError2(`Custom upgrade "${upgrade}" not supported over HTTP/2`));
@@ -14102,7 +14102,7 @@ var require_client_h2 = __commonJS({
           }
           headers[HTTP2_HEADER_METHOD] = "CONNECT";
           headers[HTTP2_HEADER_PROTOCOL] = "websocket";
-          headers[HTTP2_HEADER_PATH] = path41;
+          headers[HTTP2_HEADER_PATH] = path42;
           if (protocol === "ws:" || protocol === "wss:") {
             headers[HTTP2_HEADER_SCHEME] = protocol === "ws:" ? "http" : "https";
           } else {
@@ -14144,7 +14144,7 @@ var require_client_h2 = __commonJS({
         stream.setTimeout(headersTimeout);
         return true;
       }
-      headers[HTTP2_HEADER_PATH] = path41;
+      headers[HTTP2_HEADER_PATH] = path42;
       headers[HTTP2_HEADER_SCHEME] = protocol === "http:" ? "http" : "https";
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH";
       if (body && typeof body.read === "function") {
@@ -16496,10 +16496,10 @@ var require_proxy_agent = __commonJS({
         };
         const {
           origin,
-          path: path41 = "/",
+          path: path42 = "/",
           headers = {}
         } = opts;
-        opts.path = origin + path41;
+        opts.path = origin + path42;
         if (!("host" in headers) && !("Host" in headers)) {
           const { host } = new URL(origin);
           headers.host = host;
@@ -18608,20 +18608,20 @@ var require_mock_utils = __commonJS({
       }
       return normalizedQp;
     }
-    function safeUrl(path41) {
-      if (typeof path41 !== "string") {
-        return path41;
+    function safeUrl(path42) {
+      if (typeof path42 !== "string") {
+        return path42;
       }
-      const pathSegments = path41.split("?", 3);
+      const pathSegments = path42.split("?", 3);
       if (pathSegments.length !== 2) {
-        return path41;
+        return path42;
       }
       const qp = new URLSearchParams(pathSegments.pop());
       qp.sort();
       return [...pathSegments, qp.toString()].join("?");
     }
-    function matchKey(mockDispatch2, { path: path41, method, body, headers }) {
-      const pathMatch = matchValue(mockDispatch2.path, path41);
+    function matchKey(mockDispatch2, { path: path42, method, body, headers }) {
+      const pathMatch = matchValue(mockDispatch2.path, path42);
       const methodMatch = matchValue(mockDispatch2.method, method);
       const bodyMatch = typeof mockDispatch2.body !== "undefined" ? matchValue(mockDispatch2.body, body) : true;
       const headersMatch = matchHeaders(mockDispatch2, headers);
@@ -18646,8 +18646,8 @@ var require_mock_utils = __commonJS({
       const basePath = key.query ? serializePathWithQuery(key.path, key.query) : key.path;
       const resolvedPath = typeof basePath === "string" ? safeUrl(basePath) : basePath;
       const resolvedPathWithoutTrailingSlash = removeTrailingSlash(resolvedPath);
-      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path41, ignoreTrailingSlash }) => {
-        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path41)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path41), resolvedPath);
+      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path42, ignoreTrailingSlash }) => {
+        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path42)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path42), resolvedPath);
       });
       if (matchedMockDispatches.length === 0) {
         throw new MockNotMatchedError(`Mock dispatch not matched for path '${resolvedPath}'`);
@@ -18686,19 +18686,19 @@ var require_mock_utils = __commonJS({
         mockDispatches.splice(index, 1);
       }
     }
-    function removeTrailingSlash(path41) {
-      while (path41.endsWith("/")) {
-        path41 = path41.slice(0, -1);
+    function removeTrailingSlash(path42) {
+      while (path42.endsWith("/")) {
+        path42 = path42.slice(0, -1);
       }
-      if (path41.length === 0) {
-        path41 = "/";
+      if (path42.length === 0) {
+        path42 = "/";
       }
-      return path41;
+      return path42;
     }
     function buildKey(opts) {
-      const { path: path41, method, body, headers, query } = opts;
+      const { path: path42, method, body, headers, query } = opts;
       return {
-        path: path41,
+        path: path42,
         method,
         body,
         headers,
@@ -19388,10 +19388,10 @@ var require_pending_interceptors_formatter = __commonJS({
       }
       format(pendingInterceptors) {
         const withPrettyHeaders = pendingInterceptors.map(
-          ({ method, path: path41, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
+          ({ method, path: path42, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
             Method: method,
             Origin: origin,
-            Path: path41,
+            Path: path42,
             "Status code": statusCode,
             Persistent: persist ? PERSISTENT : NOT_PERSISTENT,
             Invocations: timesInvoked,
@@ -19473,9 +19473,9 @@ var require_mock_agent = __commonJS({
         const acceptNonStandardSearchParameters = this[kMockAgentAcceptsNonStandardSearchParameters];
         const dispatchOpts = { ...opts };
         if (acceptNonStandardSearchParameters && dispatchOpts.path) {
-          const [path41, searchParams] = dispatchOpts.path.split("?");
+          const [path42, searchParams] = dispatchOpts.path.split("?");
           const normalizedSearchParams = normalizeSearchParams(searchParams, acceptNonStandardSearchParameters);
-          dispatchOpts.path = `${path41}?${normalizedSearchParams}`;
+          dispatchOpts.path = `${path42}?${normalizedSearchParams}`;
         }
         return this[kAgent].dispatch(dispatchOpts, handler);
       }
@@ -19876,12 +19876,12 @@ var require_snapshot_recorder = __commonJS({
        * @return {Promise<void>} - Resolves when snapshots are loaded
        */
       async loadSnapshots(filePath) {
-        const path41 = filePath || this.#snapshotPath;
-        if (!path41) {
+        const path42 = filePath || this.#snapshotPath;
+        if (!path42) {
           throw new InvalidArgumentError2("Snapshot path is required");
         }
         try {
-          const data = await readFile(resolve(path41), "utf8");
+          const data = await readFile(resolve(path42), "utf8");
           const parsed = JSON.parse(data);
           if (Array.isArray(parsed)) {
             this.#snapshots.clear();
@@ -19895,7 +19895,7 @@ var require_snapshot_recorder = __commonJS({
           if (error62.code === "ENOENT") {
             this.#snapshots.clear();
           } else {
-            throw new UndiciError(`Failed to load snapshots from ${path41}`, { cause: error62 });
+            throw new UndiciError(`Failed to load snapshots from ${path42}`, { cause: error62 });
           }
         }
       }
@@ -19906,11 +19906,11 @@ var require_snapshot_recorder = __commonJS({
        * @returns {Promise<void>} - Resolves when snapshots are saved
        */
       async saveSnapshots(filePath) {
-        const path41 = filePath || this.#snapshotPath;
-        if (!path41) {
+        const path42 = filePath || this.#snapshotPath;
+        if (!path42) {
           throw new InvalidArgumentError2("Snapshot path is required");
         }
-        const resolvedPath = resolve(path41);
+        const resolvedPath = resolve(path42);
         await mkdir(dirname2(resolvedPath), { recursive: true });
         const data = Array.from(this.#snapshots.entries()).map(([hash2, snapshot]) => ({
           hash: hash2,
@@ -20542,15 +20542,15 @@ var require_redirect_handler = __commonJS({
           return;
         }
         const { origin, pathname, search } = util.parseURL(new URL(this.location, this.opts.origin && new URL(this.opts.path, this.opts.origin)));
-        const path41 = search ? `${pathname}${search}` : pathname;
-        const redirectUrlString = `${origin}${path41}`;
+        const path42 = search ? `${pathname}${search}` : pathname;
+        const redirectUrlString = `${origin}${path42}`;
         for (const historyUrl of this.history) {
           if (historyUrl.toString() === redirectUrlString) {
             throw new InvalidArgumentError2(`Redirect loop detected. Cannot redirect to ${origin}. This typically happens when using a Client or Pool with cross-origin redirects. Use an Agent for cross-origin redirects.`);
           }
         }
         this.opts.headers = cleanRequestHeaders(this.opts.headers, statusCode === 303, this.opts.origin !== origin);
-        this.opts.path = path41;
+        this.opts.path = path42;
         this.opts.origin = origin;
         this.opts.query = null;
       }
@@ -22310,10 +22310,10 @@ var require_cache_handler = __commonJS({
       }
       return locationUrl.pathname + locationUrl.search;
     }
-    function deleteCachedUri(store, cacheKey, path41) {
+    function deleteCachedUri(store, cacheKey, path42) {
       deleteCachedValue(store, {
         ...cacheKey,
-        path: path41
+        path: path42
       });
       for (let i2 = 0; i2 < util.safeHTTPMethods.length; i2++) {
         const method = util.safeHTTPMethods[i2];
@@ -22321,7 +22321,7 @@ var require_cache_handler = __commonJS({
           deleteCachedValue(store, {
             ...cacheKey,
             method,
-            path: path41
+            path: path42
           });
         }
       }
@@ -22332,9 +22332,9 @@ var require_cache_handler = __commonJS({
       }
       const values = Array.isArray(headerValue2) ? headerValue2 : [headerValue2];
       for (let i2 = 0; i2 < values.length; i2++) {
-        const path41 = getSameOriginPath(cacheKey, values[i2]);
-        if (path41 !== void 0) {
-          deleteCachedUri(store, cacheKey, path41);
+        const path42 = getSameOriginPath(cacheKey, values[i2]);
+        if (path42 !== void 0) {
+          deleteCachedUri(store, cacheKey, path42);
         }
       }
     }
@@ -27334,11 +27334,11 @@ var require_fetch = __commonJS({
       function dispatch({ body }) {
         const url2 = requestCurrentURL(request7);
         const agent = fetchParams.controller.dispatcher;
-        const path41 = url2.pathname + url2.search;
+        const path42 = url2.pathname + url2.search;
         const hasTrailingQuestionMark = url2.search.length === 0 && url2.href[url2.href.length - url2.hash.length - 1] === "?";
         return new Promise((resolve, reject) => agent.dispatch(
           {
-            path: hasTrailingQuestionMark ? `${path41}?` : path41,
+            path: hasTrailingQuestionMark ? `${path42}?` : path42,
             origin: url2.origin,
             method: request7.method,
             body: agent.isMockActive ? request7.body && (request7.body.source || request7.body.stream) : body,
@@ -28285,9 +28285,9 @@ var require_util5 = __commonJS({
         }
       }
     }
-    function validateCookiePath(path41) {
-      for (let i2 = 0; i2 < path41.length; ++i2) {
-        const code = path41.charCodeAt(i2);
+    function validateCookiePath(path42) {
+      for (let i2 = 0; i2 < path42.length; ++i2) {
+        const code = path42.charCodeAt(i2);
         if (code < 32 || // exclude CTLs (0-31)
         code > 126 || // exclude DEL and non-ascii
         code === 59) {
@@ -31635,11 +31635,11 @@ var require_undici = __commonJS({
           if (typeof opts.path !== "string") {
             throw new InvalidArgumentError2("invalid opts.path");
           }
-          let path41 = opts.path;
+          let path42 = opts.path;
           if (!opts.path.startsWith("/")) {
-            path41 = `/${path41}`;
+            path42 = `/${path42}`;
           }
-          url2 = new URL(util.parseOrigin(url2).origin + path41);
+          url2 = new URL(util.parseOrigin(url2).origin + path42);
         } else {
           if (!opts) {
             opts = typeof url2 === "object" ? url2 : {};
@@ -31749,7 +31749,7 @@ ${captureLines}` : capture.stack;
 });
 
 // src/cli.ts
-var import_node_path39 = __toESM(require("node:path"), 1);
+var import_node_path40 = __toESM(require("node:path"), 1);
 
 // node_modules/.pnpm/commander@15.0.0/node_modules/commander/lib/error.js
 var CommanderError = class extends Error {
@@ -34862,9 +34862,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
    * @param {string} [path]
    * @return {(string|null|Command)}
    */
-  executableDir(path41) {
-    if (path41 === void 0) return this._executableDir;
-    this._executableDir = path41;
+  executableDir(path42) {
+    if (path42 === void 0) return this._executableDir;
+    this._executableDir = path42;
     return this;
   }
   /**
@@ -36002,10 +36002,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path41) {
-  if (!path41)
+function getElementAtPath(obj, path42) {
+  if (!path42)
     return obj;
-  return path41.reduce((acc, key) => acc?.[key], obj);
+  return path42.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -36345,11 +36345,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path41, issues) {
+function prefixIssues(path42, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path41);
+    iss.path.unshift(path42);
     return iss;
   });
 }
@@ -36799,16 +36799,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path41 = []) => {
+  const processError = (error63, path42 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path41, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path42, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path41, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path42, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path41, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path42, ...issue2.path]);
       } else {
-        const fullpath = [...path41, ...issue2.path];
+        const fullpath = [...path42, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -36847,17 +36847,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error63, path41 = []) => {
+  const processError = (error63, path42 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path41, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path42, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path41, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path42, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path41, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path42, ...issue2.path]);
       } else {
-        const fullpath = [...path41, ...issue2.path];
+        const fullpath = [...path42, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -36896,8 +36896,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path41 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path41) {
+  const path42 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path42) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -53999,13 +53999,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path41 = ref.slice(1).split("/").filter(Boolean);
-  if (path41.length === 0) {
+  const path42 = ref.slice(1).split("/").filter(Boolean);
+  if (path42.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path41[0] === defsKey) {
-    const key = path41[1] === void 0 ? void 0 : decodeJSONPointerSegment(path41[1]);
+  if (path42[0] === defsKey) {
+    const key = path42[1] === void 0 ? void 0 : decodeJSONPointerSegment(path42[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -55043,9 +55043,9 @@ function applyPatch(filePath, schema, patch, options = {}) {
   if (!result.success) {
     throw new ConfigValidationError(filePath, result.error.issues);
   }
-  const validated = result.data;
-  writeJsonAtomic(filePath, validated, storeFs);
-  return validated;
+  const validated2 = result.data;
+  writeJsonAtomic(filePath, validated2, storeFs);
+  return validated2;
 }
 
 // src/realPorts.ts
@@ -55085,6 +55085,23 @@ function compareVersions(a2, b) {
   }
   return 0;
 }
+var ClaudeVersionNotInstalledError = class extends CliError {
+  constructor(version2, versionsDir, installed) {
+    super(
+      `Claude Code ${version2} is pinned for this launch but is not installed under "${versionsDir}"` + (installed.length === 0 ? " (no versions are installed there)." : `. Installed: ${installed.join(", ")}.`) + " Install it, or change or remove the pin (--claude-version, AGENT_SHIM_CLAUDE_VERSION, or launch.claudeVersion)."
+    );
+    this.version = version2;
+    this.versionsDir = versionsDir;
+    this.installed = installed;
+    this.name = "ClaudeVersionNotInstalledError";
+  }
+  version;
+  versionsDir;
+  installed;
+};
+function installedVersions(entries) {
+  return entries.filter((entry) => entry.isFile && entry.isExecutable && entry.sizeBytes > 0 && isNumericDottedVersion(entry.name)).map((entry) => entry.name).sort(compareVersions);
+}
 function pickHighestVersion(entries) {
   const candidates = entries.filter(
     (entry) => entry.isFile && entry.isExecutable && entry.sizeBytes > 0 && isNumericDottedVersion(entry.name)
@@ -55100,6 +55117,13 @@ function discoverClaudeBinary(options) {
   const versionsDir = options.versionsDir ?? defaultVersionsDir();
   const entries = options.listVersionsDir(versionsDir);
   const highestVersion = pickHighestVersion(entries);
+  if (options.version !== void 0) {
+    const installed = installedVersions(entries);
+    if (!installed.includes(options.version)) {
+      throw new ClaudeVersionNotInstalledError(options.version, versionsDir, installed);
+    }
+    return { path: import_node_path3.default.join(versionsDir, options.version), source: "versions-dir", version: options.version };
+  }
   if (highestVersion !== void 0) {
     return {
       path: import_node_path3.default.join(versionsDir, highestVersion),
@@ -55167,7 +55191,9 @@ var LaunchSchema = external_exports.strictObject({
   remoteControl: external_exports.boolean().optional(),
   provider: external_exports.string().min(1).optional(),
   headroom: external_exports.boolean().optional(),
-  trackUsage: external_exports.boolean().optional()
+  trackUsage: external_exports.boolean().optional(),
+  /** The exact Claude Code version to run, as it is named in Claude Code's versions directory (`2.1.220`). A pin that is not installed fails the launch; it never falls back to the highest version. */
+  claudeVersion: external_exports.string().regex(NUMERIC_DOTTED_VERSION_RE, "must be an exact dotted-numeric Claude Code version such as 2.1.220").optional()
 });
 var CREDENTIAL_TARGETS = ["bearer", "apiKey", "oauthToken"];
 var PROVIDER_CREDENTIAL_TARGETS = ["bearer", "apiKey"];
@@ -56501,13 +56527,17 @@ function realContentSourcePath() {
   return resolveContentSourcePath({ isSea: (0, import_node_sea.isSea)(), execPath: process.execPath, argv1: process.argv[1] });
 }
 function realResolveClaudeBinary(isOwnBinary) {
-  return () => discoverClaudeBinary({
+  return (request7) => discoverClaudeBinary({
     listVersionsDir,
     pathDirs: (process.env.PATH ?? "").split(import_node_path8.default.delimiter).filter((dir) => dir !== ""),
     findExecutableInDir,
-    isOwnBinary
+    isOwnBinary,
+    ...request7?.version === void 0 ? {} : { version: request7.version }
   });
 }
+function realInstalledClaudeVersions() {
+  return installedVersions(listVersionsDir(defaultVersionsDir()));
+}
 
 // src/claudeShim.ts
 var EXECUTABLE_FILE_MODE = 493;
@@ -59284,6 +59314,9 @@ function flattenLayers(layers, options) {
       if (layer.launch.trackUsage !== void 0) {
         launch.trackUsage = layer.launch.trackUsage;
       }
+      if (layer.launch.claudeVersion !== void 0) {
+        launch.claudeVersion = layer.launch.claudeVersion;
+      }
     }
     if (layer.entries === void 0) {
       continue;
@@ -60215,6 +60248,7 @@ function buildLayoutPaths(root) {
     frontdoorLockFile: import_node_path19.default.join(root, "frontdoor", "start.lock"),
     frontdoorControlTokenFile: import_node_path19.default.join(root, "frontdoor", "control-token"),
     frontdoorSessionsDir: import_node_path19.default.join(root, "frontdoor", "sessions"),
+    frontdoorRcCredentialsDir: import_node_path19.default.join(root, "frontdoor", "rc-credentials"),
     frontdoorLogPath: import_node_path19.default.join(root, "logs", "frontdoor.log"),
     usageDir: import_node_path19.default.join(root, "usage"),
     usageLogDir: import_node_path19.default.join(root, "usage", "log"),
@@ -61264,6 +61298,9 @@ function applyProfileSet(paths, name, options) {
   if (options.launchProvider !== void 0) {
     launchPatch.provider = options.launchProvider === false ? void 0 : options.launchProvider;
   }
+  if (options.launchClaudeVersion !== void 0) {
+    launchPatch.claudeVersion = options.launchClaudeVersion === false ? void 0 : options.launchClaudeVersion;
+  }
   if (Object.keys(launchPatch).length > 0) {
     setProfileLaunchFlags(paths, name, launchPatch);
     touched = true;
@@ -61305,7 +61342,7 @@ function registerProfileCommand(program2, deps) {
   withExamples(
     profile.command("set <name>").description(
       "Update a configuration profile's categories, entries, extends list, description or launch settings. With no options on a terminal, walks through its categories."
-    ).option("--category <category=bool>", "Share (true) or hide (false) a whole category (repeatable).", collectBoolPair).option("--entry <path=bool>", "Share (true) or hide (false) one <category>/<path> entry (repeatable).", collectBoolPair).option("--extends <profile>", "Replace the extends list with these profiles (repeatable, in order).", collectRepeated).option("--no-extends", "Clear the extends list.").option("--description <text>", "Replace the description.").option("--no-description", "Clear the description.").option("--launch-skip-permissions", "Launches under this profile skip permission prompts.").option("--no-launch-skip-permissions", "Launches under this profile keep permission prompts.").option("--launch-remote-control", "Launches under this profile enable Remote Control.").option("--no-launch-remote-control", "Launches under this profile leave Remote Control off.").option("--launch-headroom", "Launches under this profile route through headroom.").option("--no-launch-headroom", "Launches under this profile route direct.").option("--launch-track-usage", "Launches under this profile route through the front door so their requests and quota are recorded, with no headroom needed.").option("--no-launch-track-usage", "Launches under this profile are not recorded unless a provider or headroom routes them anyway.").option("--launch-provider <provider>", "Launches under this profile route through this provider.").option("--no-launch-provider", "Clear this profile's provider selection.").option("--json", "Print the result as JSON.").action(async (name, allOptions) => {
+    ).option("--category <category=bool>", "Share (true) or hide (false) a whole category (repeatable).", collectBoolPair).option("--entry <path=bool>", "Share (true) or hide (false) one <category>/<path> entry (repeatable).", collectBoolPair).option("--extends <profile>", "Replace the extends list with these profiles (repeatable, in order).", collectRepeated).option("--no-extends", "Clear the extends list.").option("--description <text>", "Replace the description.").option("--no-description", "Clear the description.").option("--launch-skip-permissions", "Launches under this profile skip permission prompts.").option("--no-launch-skip-permissions", "Launches under this profile keep permission prompts.").option("--launch-remote-control", "Launches under this profile enable Remote Control.").option("--no-launch-remote-control", "Launches under this profile leave Remote Control off.").option("--launch-headroom", "Launches under this profile route through headroom.").option("--no-launch-headroom", "Launches under this profile route direct.").option("--launch-track-usage", "Launches under this profile route through the front door so their requests and quota are recorded, with no headroom needed.").option("--no-launch-track-usage", "Launches under this profile are not recorded unless a provider or headroom routes them anyway.").option("--launch-provider <provider>", "Launches under this profile route through this provider.").option("--no-launch-provider", "Clear this profile's provider selection.").option("--launch-claude-version <version>", "Launches under this profile run exactly this installed Claude Code version (such as 2.1.220); a version that is not installed fails the launch.").option("--no-launch-claude-version", "Clear this profile's Claude Code version pin.").option("--json", "Print the result as JSON.").action(async (name, allOptions) => {
       const { json: json2, ...options } = allOptions;
       requireProfileExists(paths, name);
       if (Object.entries(allOptions).every(([key, value2]) => key === "json" || value2 === void 0)) {
@@ -61673,7 +61710,7 @@ function registerIdentityCommand(program2, deps) {
 // package.json
 var package_default = {
   name: "agent-shim",
-  version: "8.9.0",
+  version: "8.11.0",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -62103,11 +62140,11 @@ function providerBaseUrl(port, provider) {
 function directOrigin(port) {
   return `http://127.0.0.1:${String(port)}`;
 }
-function parseProviderPath(path41) {
-  if (!path41.startsWith(PROVIDER_PATH_PREFIX)) {
+function parseProviderPath(path42) {
+  if (!path42.startsWith(PROVIDER_PATH_PREFIX)) {
     return void 0;
   }
-  const tail = path41.slice(PROVIDER_PATH_PREFIX.length);
+  const tail = path42.slice(PROVIDER_PATH_PREFIX.length);
   const slash = tail.indexOf("/");
   if (slash <= 0) {
     return void 0;
@@ -62507,9 +62544,9 @@ function decoderFor(encoding) {
       return void 0;
   }
 }
-function destinationOf(path41) {
-  const scoped = parseProviderPath(path41);
-  return scoped === void 0 ? { provider: ANTHROPIC_PROVIDER, endpoint: path41 } : { provider: scoped.provider, endpoint: scoped.rest };
+function destinationOf(path42) {
+  const scoped = parseProviderPath(path42);
+  return scoped === void 0 ? { provider: ANTHROPIC_PROVIDER, endpoint: path42 } : { provider: scoped.provider, endpoint: scoped.rest };
 }
 function buildRecord(event, context) {
   const { scan } = context;
@@ -63553,6 +63590,34 @@ function parseEnvBool(variable, value2) {
   return parsed;
 }
 
+// src/launcher/claudeVersion.ts
+var InvalidClaudeVersionError = class extends UsageError {
+  constructor(value2, origin) {
+    super(`${origin} names Claude Code version "${value2}", which is not an exact dotted-numeric version such as 2.1.220.`);
+    this.value = value2;
+    this.origin = origin;
+    this.name = "InvalidClaudeVersionError";
+  }
+  value;
+  origin;
+};
+function validated(value2, origin) {
+  if (!NUMERIC_DOTTED_VERSION_RE.test(value2)) {
+    throw new InvalidClaudeVersionError(value2, origin);
+  }
+  return value2;
+}
+function resolveClaudeVersion(params) {
+  if (params.flag !== void 0) {
+    return { version: validated(params.flag, "--claude-version"), source: "flag" };
+  }
+  const fromEnv = params.env.AGENT_SHIM_CLAUDE_VERSION;
+  if (fromEnv !== void 0 && fromEnv !== "") {
+    return { version: validated(fromEnv, "AGENT_SHIM_CLAUDE_VERSION"), source: "environment" };
+  }
+  return params.cascade === void 0 ? void 0 : { version: params.cascade, source: "cascade" };
+}
+
 // src/launcher/guard.ts
 var AMBIENT_CREDENTIAL_VARS = [
   "ANTHROPIC_API_KEY",
@@ -63750,6 +63815,19 @@ function buildCredentialReport(provider, identity, identityName, cacheEnv) {
     ...identityCached === void 0 ? {} : { identityCached }
   };
 }
+function buildClaudeVersionReport(params, cascadePin) {
+  const installed = params.installedClaudeVersions;
+  if (installed === void 0) {
+    return void 0;
+  }
+  const pin = resolveClaudeVersion({ env: params.env, ...cascadePin === void 0 ? {} : { cascade: cascadePin } });
+  const highestInstalled = installed.at(-1);
+  return {
+    ...pin === void 0 ? {} : { pinned: { ...pin, installed: installed.includes(pin.version) } },
+    ...highestInstalled === void 0 ? {} : { highestInstalled },
+    installed
+  };
+}
 function runCheck(params) {
   const facts = buildEntryFacts({
     fs: params.farmFs,
@@ -63774,6 +63852,7 @@ function runCheck(params) {
   const settingsShared = resolved.flattened.categories.get("settings") ?? SHIPPED_CATEGORY_DEFAULTS.settings;
   const settingsExposure = inspectSettingsExposure({ settingsShared, files: params.settingsFiles });
   const keychain = params.platform === "darwin" && params.run !== void 0 && params.farmRoot !== void 0 ? lookupKeychainService(params.run, params.farmRoot) : void 0;
+  const claudeVersion = buildClaudeVersionReport(params, resolved.flattened.launch.claudeVersion);
   return {
     ...params.identityName === void 0 ? {} : { identityName: params.identityName },
     identitySource: params.identitySource,
@@ -63786,7 +63865,8 @@ function runCheck(params) {
     ambientCredential,
     ...keychain === void 0 ? {} : { keychain },
     settingsExposure,
-    credential: buildCredentialReport(params.provider, params.identity, params.identityName, params.credentialCache)
+    credential: buildCredentialReport(params.provider, params.identity, params.identityName, params.credentialCache),
+    ...claudeVersion === void 0 ? {} : { claudeVersion }
   };
 }
 function formatCheckReport(report) {
@@ -63835,6 +63915,17 @@ function formatCheckReport(report) {
   if (credential.applies === "stored-login") {
     lines.push("  The identity's stored login (no credential block applies).");
   }
+  if (report.claudeVersion !== void 0) {
+    lines.push("", "Claude Code version:");
+    const { pinned, highestInstalled, installed } = report.claudeVersion;
+    if (pinned !== void 0) {
+      lines.push(
+        pinned.installed ? `  ${pinned.version}, pinned by the ${pinned.source} (installed)` : `  ${pinned.version}, pinned by the ${pinned.source}, but NOT installed; a launch here fails. Installed: ${installed.length === 0 ? "none" : installed.join(", ")}`
+      );
+    } else {
+      lines.push(highestInstalled === void 0 ? "  none installed in the versions directory (a launch falls back to a claude on PATH)" : `  ${highestInstalled} (the highest installed; nothing pins a version)`);
+    }
+  }
   lines.push("", "Ambient-credential exposure:");
   lines.push(
     report.ambientCredential.ok ? `  OK \u2014 none of ${AMBIENT_CREDENTIAL_VARS.join(", ")} is set to a non-empty value.` : report.ambientCredential.message.split("\n").map((line) => `  ${line}`).join("\n")
@@ -63873,11 +63964,12 @@ function checkReportToJson(report) {
     ambientCredential: report.ambientCredential.ok ? { ok: true } : { ok: false, variable: report.ambientCredential.variable, message: report.ambientCredential.message },
     ...report.keychain === void 0 ? {} : { keychain: report.keychain },
     settingsExposure: report.settingsExposure,
-    credential: report.credential
+    credential: report.credential,
+    ...report.claudeVersion === void 0 ? {} : { claudeVersion: report.claudeVersion }
   };
 }
 function checkReportHasWarnings(report) {
-  return report.resolved.diagnostics.some((diagnostic) => diagnostic.severity !== "info") || report.projectEncodingAmbiguities.length > 0 || !report.ambientCredential.ok || report.credential.provider?.problem !== void 0;
+  return report.resolved.diagnostics.some((diagnostic) => diagnostic.severity !== "info") || report.projectEncodingAmbiguities.length > 0 || !report.ambientCredential.ok || report.credential.provider?.problem !== void 0 || report.claudeVersion?.pinned?.installed === false;
 }
 function loadCheckProvider(paths, name) {
   let definition;
@@ -63963,6 +64055,7 @@ function collectCheckReport(params) {
     settingsFiles,
     run: realRunPort,
     credentialCache: realCredentialCacheEnv(paths),
+    installedClaudeVersions: realInstalledClaudeVersions(),
     ...farmRoot === void 0 ? {} : { farmRoot },
     platform: process.platform,
     ...provider === void 0 ? {} : { provider }
@@ -64353,7 +64446,7 @@ function registerCodexCommand(program2, deps) {
 
 // src/frontdoor/commands.ts
 var import_node_crypto12 = require("node:crypto");
-var import_node_path32 = __toESM(require("node:path"), 1);
+var import_node_path33 = __toESM(require("node:path"), 1);
 var import_node_fs12 = __toESM(require("node:fs"), 1);
 
 // src/frontdoor/custody.ts
@@ -65083,8 +65176,8 @@ function parseConnectTarget(authority) {
   }
   return { host, port };
 }
-function servedByPipeline(path41) {
-  return path41?.startsWith(ROUTED_PATH_PREFIX) === true;
+function servedByPipeline(path42) {
+  return path42?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
   "connection",
@@ -65597,13 +65690,18 @@ function createRcSessionTracker(deps) {
     entries.set(id, record2);
     return record2;
   };
+  const persistCredential = (entry) => {
+    if (entry.oauthAuthorization !== void 0) {
+      deps.credentialStore?.write(entry.id, { authorization: entry.oauthAuthorization, anthropicVersion: entry.anthropicVersion, anthropicClientPlatform: entry.anthropicClientPlatform });
+    }
+  };
   const observeExchange = (request7) => {
     const method = (request7.method ?? "").toUpperCase();
-    const path41 = new URL(request7.url ?? "/", "http://127.0.0.1").pathname;
-    if (!path41.startsWith(RC_SESSIONS_PATH_PREFIX)) {
+    const path42 = new URL(request7.url ?? "/", "http://127.0.0.1").pathname;
+    if (!path42.startsWith(RC_SESSIONS_PATH_PREFIX)) {
       return void 0;
     }
-    const tail = path41.slice(RC_SESSIONS_PATH_PREFIX.length);
+    const tail = path42.slice(RC_SESSIONS_PATH_PREFIX.length);
     const facts = {
       oauthAuthorization: oauthAuthorizationOf(request7.headers),
       anthropicVersion: singleHeader(request7.headers, "anthropic-version"),
@@ -65636,7 +65734,7 @@ function createRcSessionTracker(deps) {
           if (id2 === void 0) {
             return;
           }
-          birth(id2, facts);
+          persistCredential(birth(id2, facts));
         }
       };
     }
@@ -65650,6 +65748,7 @@ function createRcSessionTracker(deps) {
     entry.oauthAuthorization = facts.oauthAuthorization ?? entry.oauthAuthorization;
     entry.anthropicVersion = facts.anthropicVersion ?? entry.anthropicVersion;
     entry.anthropicClientPlatform = facts.anthropicClientPlatform ?? entry.anthropicClientPlatform;
+    persistCredential(entry);
     const bodyKind = method === "POST" && rest === `${id}/worker/events` ? "worker-events" : method === "POST" && rest === `${id}/events` ? "client-events" : method === "POST" && rest === `${id}/worker/heartbeat` ? "heartbeat" : method === "PUT" && rest === `${id}/worker` ? "worker-registration" : void 0;
     let chunks = [];
     let buffered = 0;
@@ -65703,6 +65802,7 @@ function createRcSessionTracker(deps) {
       },
       onResponse: (status, headers) => {
         if (singleHeader(headers, CONFLICT_REASON_HEADER) !== void 0 || archiving && isSuccessful(status)) {
+          deps.credentialStore?.remove(id);
           expire(id);
           return;
         }
@@ -65735,7 +65835,18 @@ function createRcSessionTracker(deps) {
     },
     credentialOf: (sessionId) => {
       const entry = entries.get(sessionId);
-      return entry === void 0 ? void 0 : { authorization: entry.oauthAuthorization, anthropicVersion: entry.anthropicVersion, anthropicClientPlatform: entry.anthropicClientPlatform };
+      if (entry === void 0) {
+        return void 0;
+      }
+      if (entry.oauthAuthorization === void 0 && deps.credentialStore !== void 0) {
+        const persisted = deps.credentialStore.read(sessionId);
+        if (persisted?.authorization !== void 0) {
+          entry.oauthAuthorization = persisted.authorization;
+          entry.anthropicVersion = entry.anthropicVersion ?? persisted.anthropicVersion;
+          entry.anthropicClientPlatform = entry.anthropicClientPlatform ?? persisted.anthropicClientPlatform;
+        }
+      }
+      return { authorization: entry.oauthAuthorization, anthropicVersion: entry.anthropicVersion, anthropicClientPlatform: entry.anthropicClientPlatform };
     },
     noteSequenceNums: (sessionId, sequenceNums) => {
       const entry = entries.get(sessionId);
@@ -66330,9 +66441,9 @@ function sequenceNumsOfBody(body) {
 }
 function frontDoorRcControl(transport, token) {
   const headers = { authorization: `Bearer ${token}` };
-  const listAnswerOf = async (path41, what) => {
+  const listAnswerOf = async (path42, what) => {
     try {
-      return await transport.request({ method: "GET", path: path41, headers });
+      return await transport.request({ method: "GET", path: path42, headers });
     } catch (error62) {
       throw new Error(`${what}: could not reach the front door's control listener: ${error62 instanceof Error ? error62.message : String(error62)}`, { cause: error62 });
     }
@@ -66404,10 +66515,10 @@ function frontDoorRcControl(transport, token) {
     }
     return pending;
   };
-  const writeOf = async (path41, body, describeFailure) => {
+  const writeOf = async (path42, body, describeFailure) => {
     let answer;
     try {
-      answer = await transport.request({ method: "POST", path: path41, headers: { ...headers, "content-type": "application/json" }, body });
+      answer = await transport.request({ method: "POST", path: path42, headers: { ...headers, "content-type": "application/json" }, body });
     } catch (error62) {
       return { ok: false, message: `could not reach the front door's control listener: ${error62 instanceof Error ? error62.message : String(error62)}` };
     }
@@ -66589,15 +66700,27 @@ var SUCCESS_STATUS_MAX_EXCLUSIVE2 = 300;
 function isSuccessful2(status) {
   return status >= HTTP_STATUS.ok && status < SUCCESS_STATUS_MAX_EXCLUSIVE2;
 }
-var UPSTREAM_LOCAL_PORT_START = 47900;
-var UPSTREAM_LOCAL_PORT_END = 47919;
-var UPSTREAM_LOCAL_PORT_COUNT = UPSTREAM_LOCAL_PORT_END - UPSTREAM_LOCAL_PORT_START + 1;
-var nextUpstreamLocalPort = UPSTREAM_LOCAL_PORT_START;
-function upstreamLocalPort() {
-  const port = nextUpstreamLocalPort;
-  nextUpstreamLocalPort = nextUpstreamLocalPort === UPSTREAM_LOCAL_PORT_END ? UPSTREAM_LOCAL_PORT_START : nextUpstreamLocalPort + 1;
-  return port;
-}
+var SourcePortRange = class {
+  constructor(start, end) {
+    this.start = start;
+    this.end = end;
+    this.count = end - start + 1;
+    this.next = start;
+  }
+  start;
+  end;
+  count;
+  next;
+  /** The next port in rotation, wrapping from the end back to the start. */
+  take() {
+    const port = this.next;
+    this.next = this.next === this.end ? this.start : this.next + 1;
+    return port;
+  }
+};
+var DOOR_SOURCE_PORT_START = 47900;
+var DOOR_SOURCE_PORT_END = 47919;
+var DOOR_SOURCE_PORTS = new SourcePortRange(DOOR_SOURCE_PORT_START, DOOR_SOURCE_PORT_END);
 var realAddressLookup = (host, _options, callback) => {
   if (net2.isIP(host) !== 0) {
     callback(null, [{ address: host, family: net2.isIP(host) }]);
@@ -66635,14 +66758,14 @@ function dialTarget(options, defaultPort) {
 function literalDial(target) {
   return net2.connect({ host: target.host, port: target.port });
 }
-async function reservedDial(target) {
+async function reservedDial(target, ports) {
   for (let attempt = 0; ; attempt += 1) {
-    const outcome = await dialOnce({ host: target.host, port: target.port, localPort: upstreamLocalPort(), lookup: realAddressLookup });
+    const outcome = await dialOnce({ host: target.host, port: target.port, localPort: ports.take(), lookup: realAddressLookup });
     if (outcome.error === null) {
       return outcome;
     }
     const held = outcome.error.code !== void 0 && HELD_PORT_ERRNOS.has(outcome.error.code);
-    if (!held || attempt === UPSTREAM_LOCAL_PORT_COUNT - 1) {
+    if (!held || attempt === ports.count - 1) {
       return outcome;
     }
   }
@@ -66651,26 +66774,36 @@ function requestServername(options, fallback) {
   return "servername" in options && typeof options.servername === "string" && options.servername !== "" ? options.servername : fallback;
 }
 var ExemptHttpAgent = class extends http2.Agent {
+  constructor(ports = DOOR_SOURCE_PORTS) {
+    super();
+    this.ports = ports;
+  }
+  ports;
   // A reserved-port dial that has to retry cannot produce its socket synchronously, so it settles first and arrives through the callback (node's documented asynchronous createConnection form); a literal dial has nothing to retry and keeps node's own synchronous shape.
   createConnection(options, oncreate) {
     const target = dialTarget(options, HTTP_PORT);
     if (net2.isIP(target.host) !== 0) {
       return literalDial(target);
     }
-    void reservedDial(target).then((outcome) => {
+    void reservedDial(target, this.ports).then((outcome) => {
       oncreate?.(outcome.error, outcome.socket);
     });
     return void 0;
   }
 };
 var ExemptTlsAgent = class extends https3.Agent {
+  constructor(ports = DOOR_SOURCE_PORTS) {
+    super();
+    this.ports = ports;
+  }
+  ports;
   // The same split as the plain sibling: a literal dial wraps TLS around the socket node's own agent would have returned, a reserved dial settles (retries included) first and arrives through the callback, which is exactly where node's own agent wraps its own dials.
   createConnection(options, oncreate) {
     const target = dialTarget(options, HTTPS_PORT);
     if (net2.isIP(target.host) !== 0) {
       return tls.connect({ socket: literalDial(target), servername: requestServername(options, target.host), ...tlsFacts(options) });
     }
-    void reservedDial(target).then((outcome) => {
+    void reservedDial(target, this.ports).then((outcome) => {
       if (outcome.error !== null) {
         oncreate?.(outcome.error, outcome.socket);
         return;
@@ -66731,12 +66864,12 @@ var NO_CHUNKS = {
 };
 function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const request7 = async (method, path41, headers, body, signal) => await new Promise((resolve, reject) => {
+  const request7 = async (method, path42, headers, body, signal) => await new Promise((resolve, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method,
-      path: path41,
+      path: path42,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, ...body === void 0 ? {} : { "content-length": String(Buffer.byteLength(body, "utf8")) } },
       agent,
@@ -66773,9 +66906,9 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
       return { status, body: await readAll(response) };
     },
     openStream: async (sessionId, headers, resume, signal) => {
-      const path41 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
+      const path42 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
       const streamHeaders = resume === void 0 ? headers : { ...headers, "last-event-id": String(resume.fromSequenceNum) };
-      const { status, response } = await request7("GET", path41, streamHeaders, void 0, signal);
+      const { status, response } = await request7("GET", path42, streamHeaders, void 0, signal);
       if (!isSuccessful2(status)) {
         await readAll(response);
         return { status, chunks: NO_CHUNKS };
@@ -66784,9 +66917,9 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
     }
   };
 }
-function realConnectEffects() {
-  const plainAgent = new ExemptHttpAgent();
-  const tlsAgent = new ExemptTlsAgent();
+function realConnectEffects(ports = DOOR_SOURCE_PORTS) {
+  const plainAgent = new ExemptHttpAgent(ports);
+  const tlsAgent = new ExemptTlsAgent(ports);
   const listenOnce = async (port, onSocket) => await new Promise((resolve, reject) => {
     const accepted = /* @__PURE__ */ new Set();
     const server = net2.createServer((socket) => {
@@ -66904,7 +67037,7 @@ function realConnectEffects() {
       };
     },
     connectTlsUpstream: async (host, port, clientAlpn) => {
-      const dialled = await reservedDial({ host, port });
+      const dialled = await reservedDial({ host, port }, ports);
       if (dialled.error !== null) {
         throw dialled.error;
       }
@@ -67898,9 +68031,9 @@ function resolveFriendlyClientOptions(options) {
   };
 }
 function createORPCClient(link, options = {}) {
-  const path41 = options.path ?? [];
+  const path42 = options.path ?? [];
   const procedureClient = async (...[input2, options2 = {}]) => {
-    return await link.call(path41, input2, resolveFriendlyClientOptions(options2));
+    return await link.call(path42, input2, resolveFriendlyClientOptions(options2));
   };
   const recursive2 = new Proxy(procedureClient, {
     get(target, key) {
@@ -67909,7 +68042,7 @@ function createORPCClient(link, options = {}) {
       }
       return createORPCClient(link, {
         ...options,
-        path: [...path41, key]
+        path: [...path42, key]
       });
     }
   });
@@ -68211,19 +68344,19 @@ var StandardLink = class {
   }
   interceptors;
   clientInterceptors;
-  call(path41, input2, options) {
+  call(path42, input2, options) {
     return runWithSpan(
-      { name: `${ORPC_NAME}.${path41.join("/")}`, signal: options.signal },
+      { name: `${ORPC_NAME}.${path42.join("/")}`, signal: options.signal },
       (span) => {
         span?.setAttribute("rpc.system", ORPC_NAME);
-        span?.setAttribute("rpc.method", path41.join("."));
+        span?.setAttribute("rpc.method", path42.join("."));
         if (isAsyncIteratorObject(input2)) {
           input2 = asyncIteratorWithSpan(
             { name: "consume_event_iterator_input", signal: options.signal },
             input2
           );
         }
-        return intercept(this.interceptors, { ...options, path: path41, input: input2 }, async ({ path: path210, input: input22, ...options2 }) => {
+        return intercept(this.interceptors, { ...options, path: path42, input: input2 }, async ({ path: path210, input: input22, ...options2 }) => {
           const otelConfig = getGlobalOtelConfig();
           let otelContext;
           const currentSpan = otelConfig?.trace.getActiveSpan() ?? span;
@@ -68458,8 +68591,8 @@ var StandardRPCJsonSerializer = class {
     return ref.data;
   }
 };
-function toHttpPath(path41) {
-  return `/${path41.map(encodeURIComponent).join("/")}`;
+function toHttpPath(path42) {
+  return `/${path42.map(encodeURIComponent).join("/")}`;
 }
 function toStandardHeaders2(headers) {
   if (typeof headers.forEach === "function") {
@@ -68484,18 +68617,18 @@ var StandardRPCLinkCodec = class {
   fallbackMethod;
   expectedMethod;
   headers;
-  async encode(path41, input2, options) {
-    let headers = toStandardHeaders2(await value(this.headers, options, path41, input2));
+  async encode(path42, input2, options) {
+    let headers = toStandardHeaders2(await value(this.headers, options, path42, input2));
     if (options.lastEventId !== void 0) {
       headers = mergeStandardHeaders(headers, { "last-event-id": options.lastEventId });
     }
-    const expectedMethod = await value(this.expectedMethod, options, path41, input2);
-    const baseUrl = await value(this.baseUrl, options, path41, input2);
+    const expectedMethod = await value(this.expectedMethod, options, path42, input2);
+    const baseUrl = await value(this.baseUrl, options, path42, input2);
     const url2 = new URL(baseUrl);
-    url2.pathname = `${url2.pathname.replace(/\/$/, "")}${toHttpPath(path41)}`;
+    url2.pathname = `${url2.pathname.replace(/\/$/, "")}${toHttpPath(path42)}`;
     const serialized = this.serializer.serialize(input2);
     if (expectedMethod === "GET" && !(serialized instanceof FormData) && !isAsyncIteratorObject(serialized)) {
-      const maxUrlLength = await value(this.maxUrlLength, options, path41, input2);
+      const maxUrlLength = await value(this.maxUrlLength, options, path42, input2);
       const getUrl = new URL(url2);
       getUrl.searchParams.append("data", stringifyJSON(serialized));
       if (getUrl.toString().length <= maxUrlLength) {
@@ -68646,11 +68779,11 @@ var LinkFetchClient = class {
     this.toFetchRequestOptions = options;
     this.adapterInterceptors = toArray(options.adapterInterceptors);
   }
-  async call(standardRequest, options, path41, input2) {
+  async call(standardRequest, options, path42, input2) {
     const request7 = toFetchRequest(standardRequest, this.toFetchRequestOptions);
     const fetchResponse = await intercept(
       this.adapterInterceptors,
-      { ...options, request: request7, path: path41, input: input2, init: { redirect: "manual" } },
+      { ...options, request: request7, path: path42, input: input2, init: { redirect: "manual" } },
       ({ request: request22, path: path210, input: input22, init, ...options2 }) => this.fetch(request22, init, options2, path210, input22)
     );
     const lazyResponse = toStandardLazyResponse(fetchResponse, { signal: request7.signal });
@@ -68686,11 +68819,11 @@ async function validateORPCError(map3, error62) {
   if (!config2.data) {
     return defined ? error62 : new ORPCError(code, { defined: true, status, message, data, cause });
   }
-  const validated = await config2.data["~standard"].validate(error62.data);
-  if (validated.issues) {
+  const validated2 = await config2.data["~standard"].validate(error62.data);
+  if (validated2.issues) {
     return defined ? new ORPCError(code, { defined: false, status, message, data, cause }) : error62;
   }
-  return new ORPCError(code, { defined: true, status, message, data: validated.value, cause });
+  return new ORPCError(code, { defined: true, status, message, data: validated2.value, cause });
 }
 var ContractProcedure = class {
   /**
@@ -69050,7 +69183,7 @@ function middlewareOutputFn(output2) {
 function createProcedureClient(lazyableProcedure, ...rest) {
   const options = resolveMaybeOptionalOptions(rest);
   return async (...[input2, callerOptions]) => {
-    const path41 = toArray(options.path);
+    const path42 = toArray(options.path);
     const { default: procedure } = await unlazy(lazyableProcedure);
     const clientContext = callerOptions?.context ?? {};
     const context = await value(options.context ?? {}, clientContext);
@@ -69065,7 +69198,7 @@ function createProcedureClient(lazyableProcedure, ...rest) {
       const output2 = await runWithSpan(
         { name: "call_procedure", signal: callerOptions?.signal },
         (span) => {
-          span?.setAttribute("procedure.path", [...path41]);
+          span?.setAttribute("procedure.path", [...path42]);
           return intercept(
             toArray(options.interceptors),
             {
@@ -69073,7 +69206,7 @@ function createProcedureClient(lazyableProcedure, ...rest) {
               input: input2,
               // input only optional when it undefinable so we can safely cast it
               errors,
-              path: path41,
+              path: path42,
               procedure,
               signal: callerOptions?.signal,
               lastEventId: callerOptions?.lastEventId
@@ -69195,10 +69328,10 @@ var HIDDEN_ROUTER_CONTRACT_SYMBOL = /* @__PURE__ */ Symbol("ORPC_HIDDEN_ROUTER_C
 function getHiddenRouterContract(router) {
   return router[HIDDEN_ROUTER_CONTRACT_SYMBOL];
 }
-function getRouter(router, path41) {
+function getRouter(router, path42) {
   let current = router;
-  for (let i2 = 0; i2 < path41.length; i2++) {
-    const segment = path41[i2];
+  for (let i2 = 0; i2 < path42.length; i2++) {
+    const segment = path42[i2];
     if (!current) {
       return void 0;
     }
@@ -69213,7 +69346,7 @@ function getRouter(router, path41) {
       continue;
     }
     const lazied = current;
-    const rest = path41.slice(i2);
+    const rest = path42.slice(i2);
     return lazy2(async () => {
       const unwrapped = await unlazy(lazied);
       const next = getRouter(unwrapped.default, rest);
@@ -69791,8 +69924,8 @@ function toAbortSignal(stream) {
 function toStandardUrl(req) {
   const protocol = "encrypted" in req.socket && req.socket.encrypted ? "https:" : "http:";
   const origin = guard(() => new URL(`${protocol}//${req.headers.host ?? "localhost"}`).origin) ?? `${protocol}//localhost`;
-  const path41 = req.originalUrl ?? req.url ?? "/";
-  return new URL(`${origin}${path41.startsWith("/") ? "" : "/"}${path41}`);
+  const path42 = req.originalUrl ?? req.url ?? "/";
+  return new URL(`${origin}${path42.startsWith("/") ? "" : "/"}${path42}`);
 }
 function toStandardLazyRequest(req, res) {
   const signal = toAbortSignal(res);
@@ -69991,8 +70124,8 @@ var StandardRPCMatcher = class {
   constructor(options = {}) {
     this.filter = options.filter ?? true;
   }
-  init(router, path41 = []) {
-    const laziedOptions = traverseContractProcedures({ router, path: path41 }, (traverseOptions) => {
+  init(router, path42 = []) {
+    const laziedOptions = traverseContractProcedures({ router, path: path42 }, (traverseOptions) => {
       if (!value(this.filter, traverseOptions)) {
         return;
       }
@@ -71454,8 +71587,8 @@ function createCodexRouteMount(ports, upstreamBase, provider) {
         request7.body.resume();
         return;
       }
-      const path41 = new URL(request7.url, "http://127.0.0.1").pathname;
-      const translated = { method: request7.method, path: path41, body, signal: request7.signal };
+      const path42 = new URL(request7.url, "http://127.0.0.1").pathname;
+      const translated = { method: request7.method, path: path42, body, signal: request7.signal };
       const routed = await route(translated);
       if (request7.signal.aborted) {
         return;
@@ -71489,7 +71622,7 @@ function createPassthroughRoute(name, target) {
     headroomUpstream: target.headroomUpstream,
     serve: async (request7, response) => {
       const incoming = new URL(request7.url, "http://127.0.0.1");
-      const path41 = target.stripPrefix !== void 0 && incoming.pathname.startsWith(target.stripPrefix) ? incoming.pathname.slice(target.stripPrefix.length) : incoming.pathname;
+      const path42 = target.stripPrefix !== void 0 && incoming.pathname.startsWith(target.stripPrefix) ? incoming.pathname.slice(target.stripPrefix.length) : incoming.pathname;
       const headers = forwardableHeaders(request7.headers);
       delete headers.host;
       await new Promise((resolve) => {
@@ -71497,7 +71630,7 @@ function createPassthroughRoute(name, target) {
           host: base.hostname,
           port: base.port === "" ? void 0 : Number(base.port),
           method: request7.method,
-          path: `${basePath}${path41}${incoming.search}`,
+          path: `${basePath}${path42}${incoming.search}`,
           headers,
           agent
         };
@@ -71559,10 +71692,10 @@ function createProviderRouteResolver(deps) {
     return route;
   };
   const resolve = (request7) => {
-    const path41 = new URL(request7.url, "http://127.0.0.1").pathname;
-    const scoped = parseProviderPath(path41);
+    const path42 = new URL(request7.url, "http://127.0.0.1").pathname;
+    const scoped = parseProviderPath(path42);
     if (scoped === void 0) {
-      return path41.startsWith("/v1/") ? { ok: true, route: oauthRoute } : { ok: false, status: HTTP_STATUS.notFound, message: `no such endpoint: ${path41}` };
+      return path42.startsWith("/v1/") ? { ok: true, route: oauthRoute } : { ok: false, status: HTTP_STATUS.notFound, message: `no such endpoint: ${path42}` };
     }
     const { provider } = scoped;
     let definition;
@@ -71601,6 +71734,64 @@ function createProviderRouteResolver(deps) {
   return async (request7) => await Promise.resolve(resolve(request7));
 }
 
+// src/frontdoor/rcCredentialStore.ts
+var import_node_path32 = __toESM(require("node:path"), 1);
+function isSafeSessionId(sessionId) {
+  return /^[A-Za-z0-9_-]+$/.test(sessionId);
+}
+function isRecord4(value2) {
+  return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+}
+function credentialOfJson(parsed) {
+  if (!isRecord4(parsed)) {
+    return void 0;
+  }
+  const { authorization, anthropicVersion, anthropicClientPlatform } = parsed;
+  if (typeof authorization !== "string" || authorization === "") {
+    return void 0;
+  }
+  return {
+    authorization,
+    anthropicVersion: typeof anthropicVersion === "string" ? anthropicVersion : void 0,
+    anthropicClientPlatform: typeof anthropicClientPlatform === "string" ? anthropicClientPlatform : void 0
+  };
+}
+function createRcCredentialStore(fs19, dir) {
+  fs19.mkdirPrivate(dir);
+  const fileFor = (sessionId) => import_node_path32.default.join(dir, `${sessionId}.json`);
+  return {
+    read: (sessionId) => {
+      if (!isSafeSessionId(sessionId)) {
+        return void 0;
+      }
+      const raw = fs19.readFileUtf8(fileFor(sessionId));
+      if (raw === void 0) {
+        return void 0;
+      }
+      let parsed;
+      try {
+        parsed = JSON.parse(raw);
+      } catch {
+        return void 0;
+      }
+      return credentialOfJson(parsed);
+    },
+    write: (sessionId, credential) => {
+      if (!isSafeSessionId(sessionId)) {
+        return;
+      }
+      fs19.writeFilePrivate(fileFor(sessionId), `${JSON.stringify(credential, null, 2)}
+`);
+    },
+    remove: (sessionId) => {
+      if (!isSafeSessionId(sessionId)) {
+        return;
+      }
+      fs19.removeRecursive(fileFor(sessionId));
+    }
+  };
+}
+
 // src/frontdoor/rcStream.ts
 var RC_STREAM_EVENT_NAME = "client_event";
 var SSE_BYTE_ORDER_MARK = 65279;
@@ -71663,7 +71854,7 @@ function createSseParser() {
     }
   };
 }
-function isRecord4(value2) {
+function isRecord5(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 }
 function sequenceNumOf(value2) {
@@ -71685,7 +71876,7 @@ function parseRcStreamEnvelope(parsed) {
   } catch {
     return void 0;
   }
-  if (!isRecord4(data)) {
+  if (!isRecord5(data)) {
     return void 0;
   }
   const eventType = data.event_type;
@@ -71774,6 +71965,7 @@ function createRcStreamHub(deps) {
     if (!isSuccessful3(answer.status)) {
       throw new Error(`the client read stream answered HTTP ${String(answer.status)}`);
     }
+    deps.log?.(`rc stream ${attachment.sessionId}: attached as client ${attachment.clientId}${resume === void 0 ? ", reading from the stream's own head" : `, resuming after sequence number ${String(resume.fromSequenceNum)}`}`);
     const parser = createSseParser();
     for await (const chunk of answer.chunks) {
       attachment.controller.signal.throwIfAborted();
@@ -71797,6 +71989,7 @@ function createRcStreamHub(deps) {
       const live = deps.trackedSessions().includes(attachment.sessionId);
       const credential = deps.credentialOf(attachment.sessionId);
       if (!live || credential?.authorization === void 0) {
+        deps.log?.(`rc stream ${attachment.sessionId}: the attachment ended (${live ? "the session's client credential is no longer known" : "the tracker gave up on the session"})`);
         if (attachments.get(attachment.sessionId) === attachment) {
           attachments.delete(attachment.sessionId);
         }
@@ -71818,6 +72011,7 @@ function createRcStreamHub(deps) {
         return;
       }
       if (outcome === "dropped") {
+        deps.log?.(`rc stream ${attachment.sessionId}: the stream ended of its own accord, reconnecting`);
         retriedUnauthorized = false;
         continue;
       }
@@ -72167,7 +72361,7 @@ function realFrontDoorSupervisorPorts(paths) {
   };
   let directPort = 0;
   const codexPorts = createCodexRoutePorts(log);
-  const rcTracker = createRcSessionTracker({ now: () => Date.now(), idleMs: RC_IDLE_EXPIRY_MS });
+  const rcTracker = createRcSessionTracker({ now: () => Date.now(), idleMs: RC_IDLE_EXPIRY_MS, credentialStore: createRcCredentialStore(realFarmFs, paths.frontdoorRcCredentialsDir) });
   const rcFanout = createRcEventFanout();
   const rcHub = createRcStreamHub({
     now: () => Date.now(),
@@ -72278,7 +72472,7 @@ function realFrontDoorSupervisorPorts(paths) {
       const leafFor = createLeafCache(loadCa(), () => /* @__PURE__ */ new Date());
       const capture = captureFromEnv(process.env, paths.logsDir);
       if (capture !== void 0) {
-        log(`capture enabled, recording CONNECT targets and piped exchanges to ${import_node_path32.default.join(paths.logsDir, "frontdoor-capture.jsonl")}`);
+        log(`capture enabled, recording CONNECT targets and piped exchanges to ${import_node_path33.default.join(paths.logsDir, "frontdoor-capture.jsonl")}`);
       }
       const server = await startConnectServer(
         {
@@ -72649,7 +72843,7 @@ var ConflictingIdentityError = class extends UsageError {
   positional;
   flag;
 };
-var VALUED_FLAGS = ["--identity", "--config-profile", "--provider", "--category", "--share", "--hide"];
+var VALUED_FLAGS = ["--identity", "--config-profile", "--provider", "--claude-version", "--category", "--share", "--hide"];
 var BOOLEAN_FLAGS = [
   { flag: "--headroom", key: "headroom" },
   { flag: "--track-usage", key: "trackUsage" },
@@ -72695,6 +72889,7 @@ function parseLauncherArgv(argv) {
   let flagIdentity;
   let configProfile;
   let provider;
+  let claudeVersion;
   const booleans = {};
   const categoryFlags = [];
   const shareFlags = [];
@@ -72749,6 +72944,9 @@ function parseLauncherArgv(argv) {
       case "--provider":
         provider = value2;
         break;
+      case "--claude-version":
+        claudeVersion = value2;
+        break;
       case "--category":
         categoryFlags.push(value2);
         break;
@@ -72770,6 +72968,7 @@ function parseLauncherArgv(argv) {
     ...identity === void 0 ? {} : { identity },
     ...configProfile === void 0 ? {} : { configProfile },
     ...provider === void 0 ? {} : { provider },
+    ...claudeVersion === void 0 ? {} : { claudeVersion },
     ...native ? { native: true } : {},
     ...booleans,
     categoryFlags,
@@ -72925,15 +73124,15 @@ var import_node_child_process4 = require("node:child_process");
 
 // src/identityToken.ts
 var import_node_fs13 = __toESM(require("node:fs"), 1);
-var import_node_path33 = __toESM(require("node:path"), 1);
+var import_node_path34 = __toESM(require("node:path"), 1);
 var TOKEN_FILE_MODE = 384;
 var TOKEN_DIR_MODE = 448;
 var OAUTH_TOKEN_RE = /^sk-ant-oat\d+-[A-Za-z0-9_-]+$/;
 function identityTokenDir(paths) {
-  return import_node_path33.default.join(paths.root, "credentials");
+  return import_node_path34.default.join(paths.root, "credentials");
 }
 function identityTokenPath(paths, identityName) {
-  return import_node_path33.default.join(identityTokenDir(paths), `${identityName}.token`);
+  return import_node_path34.default.join(identityTokenDir(paths), `${identityName}.token`);
 }
 function storeIdentityToken(paths, identityName, raw) {
   const token = raw.trim();
@@ -72944,7 +73143,7 @@ function storeIdentityToken(paths, identityName, raw) {
   import_node_fs13.default.mkdirSync(dir, { recursive: true, mode: TOKEN_DIR_MODE });
   import_node_fs13.default.chmodSync(dir, TOKEN_DIR_MODE);
   const target = identityTokenPath(paths, identityName);
-  const temp = import_node_path33.default.join(dir, `.${identityName}.${String(process.pid)}.tmp`);
+  const temp = import_node_path34.default.join(dir, `.${identityName}.${String(process.pid)}.tmp`);
   import_node_fs13.default.writeFileSync(temp, `${token}
 `, { mode: TOKEN_FILE_MODE });
   import_node_fs13.default.renameSync(temp, target);
@@ -73083,7 +73282,7 @@ function subjectName(positional, provider) {
 
 // src/doctorReport.ts
 var import_node_fs14 = __toESM(require("node:fs"), 1);
-var import_node_path34 = __toESM(require("node:path"), 1);
+var import_node_path35 = __toESM(require("node:path"), 1);
 function refinePathShadow(status, ownExecutablePath, realpath) {
   if (status.status !== "shadowed") {
     return status;
@@ -73107,7 +73306,7 @@ function validateJson(schema, input2) {
   return { ok: true, data: result.data };
 }
 function pushPathResolution(push, resolution) {
-  const ownDir = import_node_path34.default.dirname(resolution.ownExecutablePath);
+  const ownDir = import_node_path35.default.dirname(resolution.ownExecutablePath);
   switch (resolution.agentShim.status) {
     case "ok":
       push("path-resolution", "pass", `\`agent-shim\` on PATH resolves to this running executable, ${resolution.ownExecutablePath}.`, "agent-shim");
@@ -73173,24 +73372,24 @@ function pushProvider(push, entry, cacheEnv) {
     push("provider", "fail", new LegacyProviderFileError(entry.path, conversion).message, entry.name);
     return;
   }
-  const validated = ProviderSchema.safeParse(parsed);
-  if (!validated.success) {
-    push("provider", "fail", new ConfigValidationError(entry.path, validated.error.issues).message, entry.name);
+  const validated2 = ProviderSchema.safeParse(parsed);
+  if (!validated2.success) {
+    push("provider", "fail", new ConfigValidationError(entry.path, validated2.error.issues).message, entry.name);
     return;
   }
-  const cache = cacheClause(cacheEnv, `provider ${entry.name}`, validated.data.credential);
-  push("provider", cache.unreadable ? "fail" : "pass", `${entry.name} is valid (${describeProviderEndpoint(validated.data)}, credential ${describeCredential(validated.data.credential)})${cache.text}.`, entry.name);
+  const cache = cacheClause(cacheEnv, `provider ${entry.name}`, validated2.data.credential);
+  push("provider", cache.unreadable ? "fail" : "pass", `${entry.name} is valid (${describeProviderEndpoint(validated2.data)}, credential ${describeCredential(validated2.data.credential)})${cache.text}.`, entry.name);
 }
 function pushLegacyName(push, params) {
   const legacyVariables = Object.keys(params.env).filter((name) => name.startsWith(LEGACY_ENV_PREFIX) && params.env[name] !== void 0).sort();
-  if (legacyVariables.length === 0 && import_node_path34.default.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
+  if (legacyVariables.length === 0 && import_node_path35.default.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
     push("legacy-name", "pass", "Nothing here still uses the former `claude-use` name.");
     return;
   }
   for (const name of legacyVariables) {
     push("legacy-name", "warn", `${name} is the former name of ${name.replace(LEGACY_ENV_PREFIX, ENV_PREFIX)}. Rename it; the old name still works but is only a fallback.`, name);
   }
-  if (import_node_path34.default.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
+  if (import_node_path35.default.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
     push(
       "legacy-name",
       "warn",
@@ -73203,6 +73402,13 @@ function runDoctor(params) {
   const push = (section, severity, message, subject) => {
     findings.push({ section, severity, message, ...subject === void 0 ? {} : { subject } });
   };
+  const checkPin = (section, subject, where, version2) => {
+    const installed = params.installedClaudeVersions;
+    if (version2 === void 0 || installed === void 0 || installed.includes(version2)) {
+      return;
+    }
+    push(section, "warn", `${where} pins Claude Code ${version2}, which is not installed (installed: ${installed.length === 0 ? "none" : installed.join(", ")}); a launch that resolves to it fails.`, subject);
+  };
   const ambient = detectAmbientCredential(params.env);
   if (ambient === void 0) {
     push("ambient-credential", "pass", "No ambient-credential environment variable is set.");
@@ -73235,12 +73441,13 @@ function runDoctor(params) {
   pushLegacyName(push, params);
   const profileSources = /* @__PURE__ */ new Map();
   for (const entry of params.configProfiles) {
-    const validated = validateJson(ConfigProfileSchema, entry);
-    if (!validated.ok) {
-      push("config-profile", "fail", validated.message, entry.name);
+    const validated2 = validateJson(ConfigProfileSchema, entry);
+    if (!validated2.ok) {
+      push("config-profile", "fail", validated2.message, entry.name);
       continue;
     }
-    profileSources.set(entry.name, { name: entry.name, profile: validated.data });
+    profileSources.set(entry.name, { name: entry.name, profile: validated2.data });
+    checkPin("config-profile", entry.name, `Configuration profile "${entry.name}"`, validated2.data.launch?.claudeVersion);
   }
   const loadProfile = (name) => profileSources.get(name);
   for (const name of profileSources.keys()) {
@@ -73256,13 +73463,13 @@ function runDoctor(params) {
   const validProfileNames = new Set(profileSources.keys());
   const validIdentityNames = /* @__PURE__ */ new Set();
   for (const entry of params.identities) {
-    const validated = validateJson(IdentitySchema, entry);
-    if (!validated.ok) {
-      push("identity", "fail", validated.message, entry.name);
+    const validated2 = validateJson(IdentitySchema, entry);
+    if (!validated2.ok) {
+      push("identity", "fail", validated2.message, entry.name);
       continue;
     }
     validIdentityNames.add(entry.name);
-    const defaultProfile = validated.data.defaultConfigProfile;
+    const defaultProfile = validated2.data.defaultConfigProfile;
     if (defaultProfile !== void 0 && !validProfileNames.has(defaultProfile)) {
       push(
         "identity",
@@ -73271,7 +73478,7 @@ function runDoctor(params) {
         entry.name
       );
     } else {
-      const credential = validated.data.credential;
+      const credential = validated2.data.credential;
       const cache = credential === void 0 ? { text: "", unreadable: false } : cacheClause(params.credentialCache, `identity ${entry.name}`, credential);
       push(
         "identity",
@@ -73309,12 +73516,12 @@ function runDoctor(params) {
   if (params.directoryRules.raw === void 0) {
     push("directory-rules", "pass", "No directory-rules.json configured.");
   } else {
-    const validated = validateJson(DirectoryRulesSchema, params.directoryRules);
-    if (!validated.ok) {
-      push("directory-rules", "fail", validated.message);
+    const validated2 = validateJson(DirectoryRulesSchema, params.directoryRules);
+    if (!validated2.ok) {
+      push("directory-rules", "fail", validated2.message);
     } else {
       push("directory-rules", "pass", `${params.directoryRules.path} is valid.`);
-      for (const rule of validated.data.rules) {
+      for (const rule of validated2.data.rules) {
         const badRefs = [];
         if (rule.identity !== void 0 && !selectionExists(rule.identity)) {
           badRefs.push(poolNameOf(rule.identity) === void 0 ? `identity "${rule.identity}"` : `pool "${poolNameOf(rule.identity) ?? ""}"`);
@@ -73322,6 +73529,7 @@ function runDoctor(params) {
         if (rule.configProfile !== void 0 && !validProfileNames.has(rule.configProfile)) {
           badRefs.push(`configuration profile "${rule.configProfile}"`);
         }
+        checkPin("directory-rules", rule.path, `Rule for "${rule.path}"`, rule.launch?.claudeVersion);
         if (badRefs.length > 0) {
           push("directory-rules", "fail", `Rule for "${rule.path}" names ${badRefs.join(" and ")}, which do not exist.`, rule.path);
         } else {
@@ -73333,11 +73541,11 @@ function runDoctor(params) {
   if (params.globalConfig.raw === void 0) {
     push("global-config", "pass", "No config.json configured.");
   } else {
-    const validated = validateJson(GlobalConfigSchema, params.globalConfig);
-    if (!validated.ok) {
-      push("global-config", "fail", validated.message);
+    const validated2 = validateJson(GlobalConfigSchema, params.globalConfig);
+    if (!validated2.ok) {
+      push("global-config", "fail", validated2.message);
     } else {
-      const defaultProfile = validated.data.defaultConfigProfile;
+      const defaultProfile = validated2.data.defaultConfigProfile;
       if (defaultProfile !== void 0 && !validProfileNames.has(defaultProfile)) {
         push(
           "global-config",
@@ -73346,27 +73554,28 @@ function runDoctor(params) {
         );
       } else {
         push("global-config", "pass", `${params.globalConfig.path} is valid.`);
+        checkPin("global-config", void 0, "config.json", validated2.data.launch?.claudeVersion);
       }
     }
   }
   if (params.categoriesLocal.raw === void 0) {
     push("categories-local", "pass", "No categories.local.json configured.");
   } else {
-    const validated = validateJson(CategoryClassificationOverlaySchema, params.categoriesLocal);
+    const validated2 = validateJson(CategoryClassificationOverlaySchema, params.categoriesLocal);
     push(
       "categories-local",
-      validated.ok ? "pass" : "fail",
-      validated.ok ? `${params.categoriesLocal.path} is valid.` : validated.message
+      validated2.ok ? "pass" : "fail",
+      validated2.ok ? `${params.categoriesLocal.path} is valid.` : validated2.message
     );
   }
   if (params.headroom.state.raw === void 0) {
     push("headroom", "pass", "No headroom daemon has ever run; nothing to check.");
   } else {
-    const validated = validateJson(HeadroomStateSchema, params.headroom.state);
-    if (!validated.ok) {
-      push("headroom", "fail", validated.message);
+    const validated2 = validateJson(HeadroomStateSchema, params.headroom.state);
+    if (!validated2.ok) {
+      push("headroom", "fail", validated2.message);
     } else {
-      const state = validated.data;
+      const state = validated2.data;
       const supervisorAlive = state.supervisorPid !== void 0 && params.headroom.isRunning(state.supervisorPid);
       const headroomAlive = state.headroomPid !== void 0 && params.headroom.isRunning(state.headroomPid);
       if (state.supervisorPid === void 0) {
@@ -73499,18 +73708,18 @@ function collectDoctorReport(params) {
   const { paths } = params;
   const identityNames = import_node_fs14.default.existsSync(paths.identitiesDir) ? import_node_fs14.default.readdirSync(paths.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && isIdentityDirectoryName(entry.name)).map((entry) => entry.name).sort() : [];
   const identities = identityNames.map((name) => {
-    const farmRoot = import_node_path34.default.join(paths.identitiesDir, name);
-    const identityPath = import_node_path34.default.join(farmRoot, "identity.json");
+    const farmRoot = import_node_path35.default.join(paths.identitiesDir, name);
+    const identityPath = import_node_path35.default.join(farmRoot, "identity.json");
     return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot };
   });
   const profileNames = import_node_fs14.default.existsSync(paths.configProfilesDir) ? import_node_fs14.default.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const configProfiles = profileNames.map((name) => {
-    const profilePath = import_node_path34.default.join(paths.configProfilesDir, `${name}.json`);
+    const profilePath = import_node_path35.default.join(paths.configProfilesDir, `${name}.json`);
     return { name, path: profilePath, raw: realFsPort.readFileUtf8(profilePath) };
   });
   const providerNames = import_node_fs14.default.existsSync(paths.providersDir) ? import_node_fs14.default.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const providers = providerNames.map((name) => {
-    const providerPath = import_node_path34.default.join(paths.providersDir, `${name}.json`);
+    const providerPath = import_node_path35.default.join(paths.providersDir, `${name}.json`);
     return { name, path: providerPath, raw: realFsPort.readFileUtf8(providerPath) };
   });
   const ownExecutablePath = realOwnExecutablePath();
@@ -73522,12 +73731,12 @@ function collectDoctorReport(params) {
     binaryDiscovery = { ok: false, message: error62 instanceof Error ? error62.message : String(error62) };
   }
   const shimState = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-  const pathDirs = (params.env.PATH ?? "").split(import_node_path34.default.delimiter).filter((dir) => dir !== "");
+  const pathDirs = (params.env.PATH ?? "").split(import_node_path35.default.delimiter).filter((dir) => dir !== "");
   const claudeShimShadow = shimState === void 0 ? void 0 : refinePathShadow(
     findPathShadow({
       pathDirs,
-      targetDir: import_node_path34.default.dirname(shimState.targetPath),
-      targetFilename: import_node_path34.default.basename(shimState.targetPath),
+      targetDir: import_node_path35.default.dirname(shimState.targetPath),
+      targetFilename: import_node_path35.default.basename(shimState.targetPath),
       findExecutableInDir
     }),
     shimState.targetPath,
@@ -73536,6 +73745,7 @@ function collectDoctorReport(params) {
   const report = runDoctor({
     env: params.env,
     credentialCache: realCredentialCacheEnv(paths),
+    installedClaudeVersions: realInstalledClaudeVersions(),
     identities,
     configProfiles,
     providers,
@@ -73551,7 +73761,7 @@ function collectDoctorReport(params) {
       agentShim: refinePathShadow(
         findPathShadow({
           pathDirs,
-          targetDir: import_node_path34.default.dirname(ownExecutablePath),
+          targetDir: import_node_path35.default.dirname(ownExecutablePath),
           targetFilename: commandFilename(ownExecutablePath, "agent-shim"),
           findExecutableInDir
         }),
@@ -73594,7 +73804,7 @@ function registerDoctorCommand(program2, deps) {
 // src/headroom/commands.ts
 var import_node_fs16 = __toESM(require("node:fs"), 1);
 var import_node_http2 = __toESM(require("node:http"), 1);
-var import_node_path36 = __toESM(require("node:path"), 1);
+var import_node_path37 = __toESM(require("node:path"), 1);
 var import_node_child_process5 = require("node:child_process");
 
 // src/frontdoor/realFrontDoorPort.ts
@@ -73740,11 +73950,11 @@ function probeFrontDoorSync(port, caPem) {
 
 // src/frontdoor/trust.ts
 var import_node_crypto14 = require("node:crypto");
-var import_node_path35 = __toESM(require("node:path"), 1);
+var import_node_path36 = __toESM(require("node:path"), 1);
 var BUNDLE_NAME_HEX_DIGITS = 16;
 function resolveTrustBundle(params) {
   const { caCertFile, bundlesDir, variable, inherited, fs: fs19 } = params;
-  if (inherited === void 0 || inherited === "" || import_node_path35.default.resolve(inherited) === import_node_path35.default.resolve(caCertFile)) {
+  if (inherited === void 0 || inherited === "" || import_node_path36.default.resolve(inherited) === import_node_path36.default.resolve(caCertFile)) {
     return { path: caCertFile };
   }
   const caPem = fs19.readFileUtf8(caCertFile);
@@ -73762,7 +73972,7 @@ function resolveTrustBundle(params) {
   }
   const combined = `${inheritedPem.trimEnd()}
 ${caPem}`;
-  const bundle = import_node_path35.default.join(bundlesDir, `${(0, import_node_crypto14.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
+  const bundle = import_node_path36.default.join(bundlesDir, `${(0, import_node_crypto14.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
   if (!fs19.exists(bundle)) {
     fs19.mkdirp(bundlesDir);
     fs19.writeFileAtomic(bundle, combined);
@@ -73920,12 +74130,12 @@ function readInstalledHeadroomCommit() {
   if (toolDir.status !== 0) {
     return void 0;
   }
-  const libDir = import_node_path36.default.join(toolDir.stdout.trim(), HEADROOM_TOOL_NAME, "lib");
+  const libDir = import_node_path37.default.join(toolDir.stdout.trim(), HEADROOM_TOOL_NAME, "lib");
   for (const python of realFarmFs.readdir(libDir)) {
-    const sitePackages = import_node_path36.default.join(libDir, python, "site-packages");
+    const sitePackages = import_node_path37.default.join(libDir, python, "site-packages");
     for (const entry of realFarmFs.readdir(sitePackages)) {
       if (entry.startsWith("headroom_ai-") && entry.endsWith(".dist-info")) {
-        const directUrl = realFarmFs.readFileUtf8(import_node_path36.default.join(sitePackages, entry, "direct_url.json"));
+        const directUrl = realFarmFs.readFileUtf8(import_node_path37.default.join(sitePackages, entry, "direct_url.json"));
         return directUrl === void 0 ? void 0 : parseInstalledCommit(directUrl);
       }
     }
@@ -74686,6 +74896,7 @@ Launching:
     --category <category=bool>   share or hide a category (repeatable)
     --share <path>, --hide <path>  share or hide one <category>/<path> entry (repeatable)
     --[no-]skip-permissions, --[no-]remote-control, --[no-]headroom, --[no-]track-usage
+    --claude-version <version>   run exactly this installed Claude Code version (not the highest)
     --[no-]wait                  with @pool:<name>, sleep until the earliest member returns when all are refused
     --native                     run the real claude with nothing from agent-shim applied (no other launch flag allowed)
 
@@ -74731,7 +74942,7 @@ var import_node_crypto16 = require("node:crypto");
 
 // src/launcher.ts
 var import_node_crypto15 = require("node:crypto");
-var import_node_path38 = __toESM(require("node:path"), 1);
+var import_node_path39 = __toESM(require("node:path"), 1);
 
 // src/launcher/cliOverride.ts
 var InvalidCliCategoryError = class extends CliError {
@@ -74815,7 +75026,7 @@ function buildCliOverride(params) {
 }
 
 // src/launcher/flags.ts
-var import_node_path37 = __toESM(require("node:path"), 1);
+var import_node_path38 = __toESM(require("node:path"), 1);
 
 // src/headroom/headers.ts
 function mergeAnthropicCustomHeaders(existing, additions) {
@@ -74885,7 +75096,7 @@ function buildEnv(params) {
   const parentCustomHeaders = params.baseEnv.ANTHROPIC_CUSTOM_HEADERS;
   let providerCustomHeaders;
   if (!params.configDirEscapeHatch && params.resolvedIdentityName !== void 0) {
-    env.CLAUDE_CONFIG_DIR = import_node_path37.default.join(params.identitiesDir, params.resolvedIdentityName);
+    env.CLAUDE_CONFIG_DIR = import_node_path38.default.join(params.identitiesDir, params.resolvedIdentityName);
   }
   if (params.provider !== void 0) {
     const providerEnv = params.provider.definition.env ?? {};
@@ -75069,7 +75280,7 @@ function prepareLaunch(params) {
     identityDefaultConfigProfile: loadedIdentity?.config.defaultConfigProfile,
     globalDefaultConfigProfile: params.globalDefaultConfigProfile
   });
-  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs19.readConfigFile(import_node_path38.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
+  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs19.readConfigFile(import_node_path39.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
     log.error(
       `agent-shim: no configuration profile named "${configProfileDecision.name}" (selected via ${configProfileDecision.source}). Run \`agent-shim profile add ${configProfileDecision.name}\` first.`
     );
@@ -75173,7 +75384,11 @@ function prepareLaunch(params) {
   } else if (params.farm !== void 0) {
     cascadeLaunch = flattenLayers(assembleCascade(params.farm.loadCascade(configProfileDecision.name, cliOverride)).layers, { home: params.farm.home }).launch;
   }
-  const discovered = params.resolveClaudeBinary();
+  const pinnedVersion = resolveClaudeVersion({ env, ...parsedArgv.claudeVersion === void 0 ? {} : { flag: parsedArgv.claudeVersion }, ...cascadeLaunch?.claudeVersion === void 0 ? {} : { cascade: cascadeLaunch.claudeVersion } });
+  const discovered = params.resolveClaudeBinary(pinnedVersion === void 0 ? void 0 : { version: pinnedVersion.version });
+  if (pinnedVersion !== void 0) {
+    log.info(`agent-shim: Claude Code ${pinnedVersion.version} (pinned by ${pinnedVersion.source})`);
+  }
   const resolvedFlags = resolveLaunchFlags({
     env,
     // A pool pick reads the usage the front door records, so a pool launch records its own unless something says otherwise.
@@ -75319,6 +75534,7 @@ function otherLaunchFlags(parsed) {
     ...parsed.identity === void 0 ? [] : ["@<identity> / --identity"],
     ...parsed.configProfile === void 0 ? [] : ["--config-profile"],
     ...parsed.provider === void 0 ? [] : [parsed.provider === false ? "--no-provider" : "--provider"],
+    ...parsed.claudeVersion === void 0 ? [] : ["--claude-version"],
     ...parsed.headroom === void 0 ? [] : ["--[no-]headroom"],
     ...parsed.trackUsage === void 0 ? [] : ["--[no-]track-usage"],
     ...parsed.skipPermissions === void 0 ? [] : ["--[no-]skip-permissions"],
@@ -75410,7 +75626,7 @@ async function runClaude(argvOverride) {
 // src/cli.ts
 async function main() {
   aliasLegacyEnv(process.env);
-  const invokedName = import_node_path39.default.basename(process.argv[1] ?? "agent-shim");
+  const invokedName = import_node_path40.default.basename(process.argv[1] ?? "agent-shim");
   if (isInvokedAsClaude(invokedName)) {
     await runClaude();
     return;