claude-use 11.48.0 → 11.49.0

package/dist/cli.cjs

@@ -27490,10 +27490,10 @@ var init_schema = __esm({
 });
 
 // src/frontdoor/state.ts
-function readFrontDoorState(fs28, stateFile) {
+function readFrontDoorState(fs29, stateFile) {
   let raw;
   try {
-    raw = fs28.readFileUtf8(stateFile);
+    raw = fs29.readFileUtf8(stateFile);
   } catch {
     return void 0;
   }
@@ -27507,9 +27507,9 @@ function readFrontDoorState(fs28, stateFile) {
     return void 0;
   }
 }
-function writeFrontDoorState(fs28, stateFile, state) {
-  fs28.mkdirp(import_node_path5.default.dirname(stateFile));
-  fs28.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
+function writeFrontDoorState(fs29, stateFile, state) {
+  fs29.mkdirp(import_node_path5.default.dirname(stateFile));
+  fs29.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
 `);
 }
 function directOrigin(port) {
@@ -27519,27 +27519,37 @@ function frontDoorOrigin(state) {
   const port = state?.directPort ?? state?.lastDirectPort;
   return port === void 0 ? void 0 : directOrigin(port);
 }
-function writeFrontDoorDirectRecord(fs28, recordsDir, record2) {
-  fs28.mkdirp(recordsDir);
-  fs28.writeFilePrivate(import_node_path5.default.join(recordsDir, `${String(record2.pid)}.json`), `${JSON.stringify({ directPort: record2.directPort })}
+function writeFrontDoorDirectRecord(fs29, recordsDir, record2) {
+  fs29.mkdirp(recordsDir);
+  fs29.writeFilePrivate(import_node_path5.default.join(recordsDir, `${String(record2.pid)}.json`), `${JSON.stringify({ directPort: record2.directPort })}
 `);
 }
-function removeFrontDoorDirectRecord(fs28, recordsDir, pid) {
-  fs28.removeRecursive(import_node_path5.default.join(recordsDir, `${String(pid)}.json`));
+function removeFrontDoorDirectRecord(fs29, recordsDir, pid) {
+  fs29.removeRecursive(import_node_path5.default.join(recordsDir, `${String(pid)}.json`));
+}
+function markFrontDoorDraining(fs29, markersDir, pid) {
+  fs29.mkdirp(markersDir);
+  fs29.writeFilePrivate(import_node_path5.default.join(markersDir, String(pid)), "\n");
+}
+function unmarkFrontDoorDraining(fs29, markersDir, pid) {
+  fs29.removeRecursive(import_node_path5.default.join(markersDir, String(pid)));
+}
+function listDrainingFrontDoors(fs29, markersDir, isRunning) {
+  return fs29.readdir(markersDir).flatMap((file2) => /^[1-9]\d*$/.test(file2) && Number.isSafeInteger(Number(file2)) ? [Number(file2)] : []).filter(isRunning).sort((a10, b) => a10 - b);
 }
 function recordPid(file2) {
   const pidText = /^([1-9]\d*)\.json$/.exec(file2)?.[1];
   const pid = pidText === void 0 ? void 0 : Number(pidText);
   return pid !== void 0 && Number.isSafeInteger(pid) ? pid : void 0;
 }
-function readDirectRecordEntry(fs28, recordsDir, file2) {
+function readDirectRecordEntry(fs29, recordsDir, file2) {
   const pid = recordPid(file2);
   if (pid === void 0) {
     return void 0;
   }
   let raw;
   try {
-    raw = fs28.readFileUtf8(import_node_path5.default.join(recordsDir, file2));
+    raw = fs29.readFileUtf8(import_node_path5.default.join(recordsDir, file2));
   } catch {
     return void 0;
   }
@@ -27553,47 +27563,47 @@ function readDirectRecordEntry(fs28, recordsDir, file2) {
     return { malformed: true };
   }
 }
-function listFrontDoorDirectRecords(fs28, recordsDir) {
-  return fs28.readdir(recordsDir).flatMap((file2) => {
-    const entry = readDirectRecordEntry(fs28, recordsDir, file2);
+function listFrontDoorDirectRecords(fs29, recordsDir) {
+  return fs29.readdir(recordsDir).flatMap((file2) => {
+    const entry = readDirectRecordEntry(fs29, recordsDir, file2);
     return entry?.record === void 0 ? [] : [entry.record];
   }).sort((a10, b) => a10.pid - b.pid);
 }
-function pruneMalformedFrontDoorDirectFiles(fs28, recordsDir, isRunning) {
-  for (const file2 of fs28.readdir(recordsDir)) {
+function pruneMalformedFrontDoorDirectFiles(fs29, recordsDir, isRunning) {
+  for (const file2 of fs29.readdir(recordsDir)) {
     const writer = RECORD_TEMPORARY_FILE.exec(file2)?.[1];
     const stale = writer !== void 0 && !isRunning(Number(writer));
-    if (stale || readDirectRecordEntry(fs28, recordsDir, file2)?.malformed === true) {
-      fs28.removeRecursive(import_node_path5.default.join(recordsDir, file2));
+    if (stale || readDirectRecordEntry(fs29, recordsDir, file2)?.malformed === true) {
+      fs29.removeRecursive(import_node_path5.default.join(recordsDir, file2));
     }
   }
 }
 function liveFrontDoorDirectRecords(records, liveness) {
   return records.filter((record2) => liveness.doors.has(record2.pid) || liveness.unknown.has(record2.pid));
 }
-function pruneDeadFrontDoorDirectRecords(fs28, recordsDir, records, liveness) {
+function pruneDeadFrontDoorDirectRecords(fs29, recordsDir, records, liveness) {
   for (const record2 of records) {
     if (!liveness.doors.has(record2.pid) && !liveness.unknown.has(record2.pid)) {
-      removeFrontDoorDirectRecord(fs28, recordsDir, record2.pid);
+      removeFrontDoorDirectRecord(fs29, recordsDir, record2.pid);
     }
   }
 }
 function recordOf(details) {
   return details === void 0 ? {} : { sessionId: details.sessionId, ...details.models === void 0 ? {} : { models: details.models } };
 }
-function writeFrontDoorSession(fs28, sessionsDir, session) {
-  fs28.mkdirPrivate(sessionsDir);
-  fs28.writeFilePrivate(import_node_path5.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
+function writeFrontDoorSession(fs29, sessionsDir, session) {
+  fs29.mkdirPrivate(sessionsDir);
+  fs29.writeFilePrivate(import_node_path5.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
 `);
 }
-function listFrontDoorSessions(fs28, sessionsDir) {
+function listFrontDoorSessions(fs29, sessionsDir) {
   const sessions = [];
-  for (const name of fs28.readdir(sessionsDir)) {
+  for (const name of fs29.readdir(sessionsDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs28.readFileUtf8(import_node_path5.default.join(sessionsDir, name)) ?? ""));
+      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs29.readFileUtf8(import_node_path5.default.join(sessionsDir, name)) ?? ""));
       if (parsed.success) {
         sessions.push({ pid: parsed.data.pid, startedAt: parsed.data.startedAt, ...parsed.data.supervisorPid === void 0 ? {} : { supervisorPid: parsed.data.supervisorPid } });
       }
@@ -27603,27 +27613,27 @@ function listFrontDoorSessions(fs28, sessionsDir) {
   }
   return sessions.sort((a10, b) => a10.pid - b.pid);
 }
-function removeFrontDoorSession(fs28, sessionsDir, pid) {
-  fs28.removeRecursive(import_node_path5.default.join(sessionsDir, `${String(pid)}.json`));
+function removeFrontDoorSession(fs29, sessionsDir, pid) {
+  fs29.removeRecursive(import_node_path5.default.join(sessionsDir, `${String(pid)}.json`));
 }
-function pruneDeadFrontDoorSessions(fs28, sessionsDir, isRunning) {
+function pruneDeadFrontDoorSessions(fs29, sessionsDir, isRunning) {
   const removed = [];
-  for (const session of listFrontDoorSessions(fs28, sessionsDir)) {
+  for (const session of listFrontDoorSessions(fs29, sessionsDir)) {
     if (!isRunning(session.pid)) {
-      removeFrontDoorSession(fs28, sessionsDir, session.pid);
+      removeFrontDoorSession(fs29, sessionsDir, session.pid);
       removed.push(session.pid);
     }
   }
   return removed;
 }
-function liveSessionTokens(fs28, sessionsDir) {
+function liveSessionTokens(fs29, sessionsDir) {
   const tokens = /* @__PURE__ */ new Set();
-  for (const name of fs28.readdir(sessionsDir)) {
+  for (const name of fs29.readdir(sessionsDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs28.readFileUtf8(import_node_path5.default.join(sessionsDir, name)) ?? ""));
+      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs29.readFileUtf8(import_node_path5.default.join(sessionsDir, name)) ?? ""));
       if (parsed.success) {
         tokens.add(parsed.data.token);
       }
@@ -27633,13 +27643,13 @@ function liveSessionTokens(fs28, sessionsDir) {
   }
   return tokens;
 }
-function readFrontDoorSessionModels(fs28, sessionsDir, sessionId) {
-  for (const name of fs28.readdir(sessionsDir)) {
+function readFrontDoorSessionModels(fs29, sessionsDir, sessionId) {
+  for (const name of fs29.readdir(sessionsDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs28.readFileUtf8(import_node_path5.default.join(sessionsDir, name)) ?? ""));
+      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs29.readFileUtf8(import_node_path5.default.join(sessionsDir, name)) ?? ""));
       if (parsed.success && parsed.data.sessionId === sessionId) {
         return parsed.data.models;
       }
@@ -27702,43 +27712,43 @@ function parseJson(raw, schema) {
   const parsed = schema.safeParse(JSON.parse(raw));
   return parsed.success ? parsed.data : void 0;
 }
-function readHeadroomState(fs28, stateFile) {
+function readHeadroomState(fs29, stateFile) {
   try {
-    return parseJson(fs28.readFileUtf8(stateFile), HeadroomStateSchema);
+    return parseJson(fs29.readFileUtf8(stateFile), HeadroomStateSchema);
   } catch {
     return void 0;
   }
 }
-function writeHeadroomState(fs28, stateFile, state) {
-  fs28.mkdirp(import_node_path6.default.dirname(stateFile));
-  fs28.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
+function writeHeadroomState(fs29, stateFile, state) {
+  fs29.mkdirp(import_node_path6.default.dirname(stateFile));
+  fs29.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
 `);
 }
-function resolveServingHeadroomState(fs28, files, isRunning) {
-  const current = readHeadroomState(fs28, files.stateFile);
+function resolveServingHeadroomState(fs29, files, isRunning) {
+  const current = readHeadroomState(fs29, files.stateFile);
   if (current !== void 0) {
     return { path: files.stateFile, state: current };
   }
-  const legacy = readHeadroomState(fs28, files.legacyStateFile);
+  const legacy = readHeadroomState(fs29, files.legacyStateFile);
   if (legacy?.supervisorPid !== void 0 && isRunning(legacy.supervisorPid)) {
     return { path: files.legacyStateFile, state: legacy };
   }
   return void 0;
 }
-function migrateHeadroomState(fs28, files, isRunning) {
-  const legacy = readHeadroomState(fs28, files.legacyStateFile);
+function migrateHeadroomState(fs29, files, isRunning) {
+  const legacy = readHeadroomState(fs29, files.legacyStateFile);
   const legacyLive = legacy?.supervisorPid !== void 0 && isRunning(legacy.supervisorPid);
-  const current = readHeadroomState(fs28, files.stateFile);
+  const current = readHeadroomState(fs29, files.stateFile);
   if (current !== void 0 || legacyLive) {
-    if (!legacyLive && fs28.readFileUtf8(files.legacyStateFile) !== void 0) {
-      fs28.removeRecursive(files.legacyStateFile);
+    if (!legacyLive && fs29.readFileUtf8(files.legacyStateFile) !== void 0) {
+      fs29.removeRecursive(files.legacyStateFile);
     }
     return;
   }
   if (legacy !== void 0) {
-    writeHeadroomState(fs28, files.stateFile, legacy);
+    writeHeadroomState(fs29, files.stateFile, legacy);
   }
-  fs28.removeRecursive(files.legacyStateFile);
+  fs29.removeRecursive(files.legacyStateFile);
 }
 function hashAllowlist(allowlist) {
   return (0, import_node_crypto2.createHash)("sha256").update(allowlist.join("\n")).digest("hex");
@@ -27771,27 +27781,27 @@ function isAdmissibleUrl(entry) {
 function parseAllowlistFile(content) {
   return content.replace(/^\uFEFF/, "").replace(ALLOWLIST_FILE_COMMENT, "").split(ALLOWLIST_FILE_SEPARATORS).map((entry) => entry.replace(ALLOWLIST_SURROUNDING_WHITESPACE, "")).filter((entry) => entry !== "" && !ALLOWLIST_ENTRY_WHITESPACE.test(entry) && (entry.includes("://") ? isAdmissibleUrl(entry) : isBareHost(entry)));
 }
-function writeAllowlistFile(fs28, allowlistFile, allowlist) {
-  fs28.mkdirPrivate(import_node_path6.default.dirname(allowlistFile));
-  fs28.writeFilePrivate(allowlistFile, formatAllowlistFile(allowlist));
+function writeAllowlistFile(fs29, allowlistFile, allowlist) {
+  fs29.mkdirPrivate(import_node_path6.default.dirname(allowlistFile));
+  fs29.writeFilePrivate(allowlistFile, formatAllowlistFile(allowlist));
 }
-function pruneStaleAllowlistTemporaries(fs28, allowlistFile, isRunning) {
+function pruneStaleAllowlistTemporaries(fs29, allowlistFile, isRunning) {
   const prefix = `${import_node_path6.default.basename(allowlistFile)}.`;
-  for (const name of fs28.readdir(import_node_path6.default.dirname(allowlistFile))) {
+  for (const name of fs29.readdir(import_node_path6.default.dirname(allowlistFile))) {
     const writer = name.startsWith(prefix) ? /^([1-9]\d*)\.tmp$/.exec(name.slice(prefix.length))?.[1] : void 0;
     if (writer !== void 0 && !isRunning(Number(writer))) {
-      fs28.removeRecursive(import_node_path6.default.join(import_node_path6.default.dirname(allowlistFile), name));
+      fs29.removeRecursive(import_node_path6.default.join(import_node_path6.default.dirname(allowlistFile), name));
     }
   }
 }
-function readAllProviders(fs28, providersDir) {
+function readAllProviders(fs29, providersDir) {
   const result = [];
-  for (const name of fs28.readdir(providersDir)) {
+  for (const name of fs29.readdir(providersDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = parseJson(fs28.readFileUtf8(import_node_path6.default.join(providersDir, name)), ProviderSchema);
+      const parsed = parseJson(fs29.readFileUtf8(import_node_path6.default.join(providersDir, name)), ProviderSchema);
       if (parsed !== void 0) {
         result.push({ name: name.slice(0, -".json".length), provider: parsed });
       }
@@ -27801,22 +27811,22 @@ function readAllProviders(fs28, providersDir) {
   }
   return result;
 }
-function writeSession(fs28, sessionsDir, session) {
-  fs28.mkdirp(sessionsDir);
-  fs28.writeFileUtf8(import_node_path6.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
+function writeSession(fs29, sessionsDir, session) {
+  fs29.mkdirp(sessionsDir);
+  fs29.writeFileUtf8(import_node_path6.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
 `);
 }
-function removeSession(fs28, sessionsDir, pid) {
-  fs28.removeRecursive(import_node_path6.default.join(sessionsDir, `${String(pid)}.json`));
+function removeSession(fs29, sessionsDir, pid) {
+  fs29.removeRecursive(import_node_path6.default.join(sessionsDir, `${String(pid)}.json`));
 }
-function listSessions(fs28, sessionsDir) {
+function listSessions(fs29, sessionsDir) {
   const sessions = [];
-  for (const name of fs28.readdir(sessionsDir)) {
+  for (const name of fs29.readdir(sessionsDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = parseJson(fs28.readFileUtf8(import_node_path6.default.join(sessionsDir, name)), HeadroomSessionSchema);
+      const parsed = parseJson(fs29.readFileUtf8(import_node_path6.default.join(sessionsDir, name)), HeadroomSessionSchema);
       if (parsed !== void 0) {
         sessions.push(parsed);
       }
@@ -27826,22 +27836,22 @@ function listSessions(fs28, sessionsDir) {
   }
   return sessions.sort((a10, b) => a10.pid - b.pid);
 }
-function sessionsForSupervisor(fs28, sessionsDir, supervisorPid) {
-  return listSessions(fs28, sessionsDir).filter((session) => session.supervisorPid === supervisorPid);
+function sessionsForSupervisor(fs29, sessionsDir, supervisorPid) {
+  return listSessions(fs29, sessionsDir).filter((session) => session.supervisorPid === supervisorPid);
 }
-function pruneDeadSessions(fs28, sessionsDir, isRunning) {
+function pruneDeadSessions(fs29, sessionsDir, isRunning) {
   const removed = [];
-  for (const session of listSessions(fs28, sessionsDir)) {
+  for (const session of listSessions(fs29, sessionsDir)) {
     if (!isRunning(session.pid)) {
-      removeSession(fs28, sessionsDir, session.pid);
+      removeSession(fs29, sessionsDir, session.pid);
       removed.push(session.pid);
     }
   }
   return removed;
 }
-function readStartLock(fs28, lockFile) {
+function readStartLock(fs29, lockFile) {
   try {
-    return parseJson(fs28.readFileUtf8(lockFile), HeadroomLockSchema);
+    return parseJson(fs29.readFileUtf8(lockFile), HeadroomLockSchema);
   } catch {
     return void 0;
   }
@@ -27934,12 +27944,12 @@ function earlierReleaseAllowlistHash(providers, doorOrigin) {
   }
   return hashAllowlist([...entries].sort());
 }
-function earlierReleaseDaemon(fs28, paths, daemon) {
+function earlierReleaseDaemon(fs29, paths, daemon) {
   if (daemonIdentity(daemon.commandLine, daemon.socketPath) !== "earlier-release") {
     return void 0;
   }
-  const providers = readAllProviders(fs28, paths.providersDir).map((entry) => entry.provider);
-  const expected = earlierReleaseAllowlistHash(providers, frontDoorOrigin(readFrontDoorState(fs28, paths.frontdoorStateFile)));
+  const providers = readAllProviders(fs29, paths.providersDir).map((entry) => entry.provider);
+  const expected = earlierReleaseAllowlistHash(providers, frontDoorOrigin(readFrontDoorState(fs29, paths.frontdoorStateFile)));
   return { admitsServingDoor: daemon.recordedHash === expected };
 }
 var EARLIER_RELEASE_ALLOWLIST, EARLIER_RELEASE_ANTHROPIC_UPSTREAM;
@@ -27964,8 +27974,8 @@ function awaitingCause(daemonPid, identity, allowlistFile) {
   }
   return `the headroom supervisor has not written an allowlist admitting this launch's upstreams to ${allowlistFile} within ${String(HEADROOM_START_TIMEOUT_MS)}ms`;
 }
-function daemonAdmits(fs28, allowlistFile, recordedHash, required2) {
-  const content = fs28.readFileUtf8(allowlistFile);
+function daemonAdmits(fs29, allowlistFile, recordedHash, required2) {
+  const content = fs29.readFileUtf8(allowlistFile);
   if (content === void 0 || recordedHash === void 0) {
     return false;
   }
@@ -28355,7 +28365,7 @@ function verifyAllowlistFile(allowlistFile, ports) {
   const replaceable = fileStat === void 0 || fileStat.kind === "file" || fileStat.kind === "symlink";
   return { message: refusal2, repairable: replaceable };
 }
-function prepareHeadroomSocket(fs28, ports, paths, supervisorPid) {
+function prepareHeadroomSocket(fs29, ports, paths, supervisorPid) {
   const unsupported = platformRefusal(ports.platform);
   if (unsupported !== void 0) {
     return { refused: unsupported };
@@ -28370,18 +28380,18 @@ function prepareHeadroomSocket(fs28, ports, paths, supervisorPid) {
   if (ports.lstat(paths.headroomSocketDir)?.kind === "symlink") {
     return { refused: `the headroom socket directory ${paths.headroomSocketDir} is a symlink; it must be the real directory` };
   }
-  fs28.mkdirPrivate(paths.headroomSocketDir);
+  fs29.mkdirPrivate(paths.headroomSocketDir);
   const refusal2 = ownerOnlyRefusal("socket directory", paths.headroomSocketDir, ports.lstat(paths.headroomSocketDir), "dir", ports.currentUid());
   return refusal2 === void 0 ? { socketPath } : { refused: refusal2 };
 }
-function pruneStaleHeadroomSockets(fs28, paths, isRunning) {
+function pruneStaleHeadroomSockets(fs29, paths, isRunning) {
   const removed = [];
-  for (const name of fs28.readdir(paths.headroomSocketDir)) {
+  for (const name of fs29.readdir(paths.headroomSocketDir)) {
     const pid = HEADROOM_SOCKET_NAME.exec(name)?.[1];
     if (pid === void 0 || isRunning(Number.parseInt(pid, 10))) {
       continue;
     }
-    fs28.removeRecursive(import_node_path7.default.join(paths.headroomSocketDir, name));
+    fs29.removeRecursive(import_node_path7.default.join(paths.headroomSocketDir, name));
     removed.push(name);
   }
   return removed;
@@ -28528,37 +28538,37 @@ function compareVersions2(a10, b) {
   return 0;
 }
 async function runSupervisor(initialConfig, ports, options = {}) {
-  const { fs: fs28, paths } = ports;
+  const { fs: fs29, paths } = ports;
   let config2 = initialConfig;
-  migrateHeadroomState(fs28, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, ports.isRunning);
-  const previousState = resolveServingHeadroomState(fs28, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, ports.isRunning)?.state;
+  migrateHeadroomState(fs29, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, ports.isRunning);
+  const previousState = resolveServingHeadroomState(fs29, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, ports.isRunning)?.state;
   if (previousState?.supervisorPid !== void 0 && previousState.supervisorPid !== ports.ownPid && ports.isRunning(previousState.supervisorPid)) {
     ports.log(`agent-shim headroom supervisor ${String(ports.ownPid)}: supervisor ${String(previousState.supervisorPid)} already owns the daemon; exiting`);
     return 0;
   }
   let installedSource = previousState?.installedSource;
   const ownsState = () => {
-    const owner = readHeadroomState(fs28, paths.headroomStateFile)?.supervisorPid;
+    const owner = readHeadroomState(fs29, paths.headroomStateFile)?.supervisorPid;
     return owner === void 0 || owner === ports.ownPid || !ports.isRunning(owner);
   };
   const writeOwnState = (state) => {
     if (!ownsState()) {
       return false;
     }
-    writeHeadroomState(fs28, paths.headroomStateFile, state);
+    writeHeadroomState(fs29, paths.headroomStateFile, state);
     return true;
   };
   const fail = (message) => {
     if (writeOwnState({ lastError: message })) {
-      fs28.removeRecursive(paths.headroomLockFile);
+      fs29.removeRecursive(paths.headroomLockFile);
     }
     ports.log(`agent-shim headroom supervisor: ${message}`);
     return 1;
   };
   const syncAllowlistFile = (allowlist) => {
     try {
-      if (fs28.readFileUtf8(paths.headroomAllowlistFile) !== formatAllowlistFile(allowlist)) {
-        writeAllowlistFile(fs28, paths.headroomAllowlistFile, allowlist);
+      if (fs29.readFileUtf8(paths.headroomAllowlistFile) !== formatAllowlistFile(allowlist)) {
+        writeAllowlistFile(fs29, paths.headroomAllowlistFile, allowlist);
         ports.log(`agent-shim headroom supervisor: wrote allowlist [${allowlist.join(", ")}] to ${paths.headroomAllowlistFile}`);
       }
       return void 0;
@@ -28576,9 +28586,9 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     }
     ports.log(`agent-shim headroom supervisor: repairing the allowlist file: ${problem.message}`);
     try {
-      fs28.mkdirPrivate(paths.headroomDir);
-      fs28.mkdirPrivate(import_node_path8.default.dirname(paths.headroomAllowlistFile));
-      writeAllowlistFile(fs28, paths.headroomAllowlistFile, allowlist);
+      fs29.mkdirPrivate(paths.headroomDir);
+      fs29.mkdirPrivate(import_node_path8.default.dirname(paths.headroomAllowlistFile));
+      writeAllowlistFile(fs29, paths.headroomAllowlistFile, allowlist);
     } catch (error63) {
       return `could not write the headroom allowlist file ${paths.headroomAllowlistFile}: ${error63 instanceof Error ? error63.message : String(error63)}`;
     }
@@ -28603,20 +28613,20 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     installedSource = config2.source;
     return void 0;
   };
-  const socket = prepareHeadroomSocket(fs28, ports.socketTrust, paths, ports.ownPid);
+  const socket = prepareHeadroomSocket(fs29, ports.socketTrust, paths, ports.ownPid);
   if (socket.refused !== void 0) {
     return fail(socket.refused);
   }
   const { socketPath } = socket;
-  pruneStaleHeadroomSockets(fs28, paths, ports.isRunning);
-  pruneStaleAllowlistTemporaries(fs28, paths.headroomAllowlistFile, ports.isRunning);
+  pruneStaleHeadroomSockets(fs29, paths, ports.isRunning);
+  pruneStaleAllowlistTemporaries(fs29, paths.headroomAllowlistFile, ports.isRunning);
   const installFailure = ensureInstalled();
   if (installFailure !== void 0) {
     return fail(installFailure);
   }
   const version2 = ports.headroomVersion() ?? "unknown";
   writeOwnState({ supervisorPid: ports.ownPid, version: version2, installedSource });
-  ports.log(`agent-shim headroom supervisor ${String(ports.ownPid)}: managing headroom on allowlist [${currentHeadroomAllowlistInputs(fs28, paths, ports.frontDoorLiveness).frontDoorOrigins.join(", ")}]`);
+  ports.log(`agent-shim headroom supervisor ${String(ports.ownPid)}: managing headroom on allowlist [${currentHeadroomAllowlistInputs(fs29, paths, ports.frontDoorLiveness).frontDoorOrigins.join(", ")}]`);
   const orphanPid = previousState?.headroomPid;
   const orphanSocket = previousState?.socketPath ?? (previousState?.supervisorPid === void 0 ? void 0 : headroomSocketPath(paths, previousState.supervisorPid));
   const orphanIdentity = orphanPid === void 0 || orphanSocket === void 0 || !ports.isRunning(orphanPid) ? void 0 : daemonIdentity(ports.daemonCommandLine(orphanPid), orphanSocket);
@@ -28651,12 +28661,12 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     ticks += 1;
     config2 = ports.readConfig();
     const settingsHash = hashSettings(config2.settings);
-    const inputs = currentHeadroomAllowlistInputs(fs28, paths, ports.frontDoorLiveness);
-    pruneDeadFrontDoorDirectRecords(fs28, paths.frontdoorDirectRecordsDir, inputs.frontDoorRecords, inputs.frontDoorLiveness);
-    pruneMalformedFrontDoorDirectFiles(fs28, paths.frontdoorDirectRecordsDir, ports.isRunning);
+    const inputs = currentHeadroomAllowlistInputs(fs29, paths, ports.frontDoorLiveness);
+    pruneDeadFrontDoorDirectRecords(fs29, paths.frontdoorDirectRecordsDir, inputs.frontDoorRecords, inputs.frontDoorLiveness);
+    pruneMalformedFrontDoorDirectFiles(fs29, paths.frontdoorDirectRecordsDir, ports.isRunning);
     const allowlist = inputs.frontDoorOrigins;
     const allowlistHash = hashAllowlist(allowlist);
-    pruneDeadSessions(fs28, paths.headroomSessionsDir, ports.isRunning);
+    pruneDeadSessions(fs29, paths.headroomSessionsDir, ports.isRunning);
     const ownsNow = ownsState();
     if (!ownsNow && !superseded) {
       ports.log("agent-shim headroom supervisor: another supervisor now owns the state file; serving this daemon's own sessions until they end");
@@ -28703,7 +28713,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
         runningSettingsHash = settingsHash;
         const recorded = writeOwnState(servingState(pid));
         if (recorded) {
-          fs28.removeRecursive(paths.headroomLockFile);
+          fs29.removeRecursive(paths.headroomLockFile);
         }
         idleSince = void 0;
         ports.log(`agent-shim headroom supervisor: headroom pid ${String(pid)} ready on unix socket ${socketPath}`);
@@ -28731,7 +28741,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
         ports.log(`agent-shim headroom supervisor: headroom pid ${String(headroomPid)} now serves allowlist [${allowlist.join(", ")}]`);
       }
       if (runningSettingsHash !== settingsHash || installedSource !== config2.source) {
-        if (sessionsForSupervisor(fs28, paths.headroomSessionsDir, ports.ownPid).length === 0) {
+        if (sessionsForSupervisor(fs29, paths.headroomSessionsDir, ports.ownPid).length === 0) {
           ports.log("agent-shim headroom supervisor: configuration drifted and no sessions are live; restarting headroom");
           ports.stopProcess(headroomPid);
           headroomPid = void 0;
@@ -28740,7 +28750,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
           continue;
         }
       }
-      const sessions = sessionsForSupervisor(fs28, paths.headroomSessionsDir, ports.ownPid);
+      const sessions = sessionsForSupervisor(fs29, paths.headroomSessionsDir, ports.ownPid);
       if (sessions.length === 0) {
         idleSince ??= ports.now();
         const idleMs = ports.now() - idleSince;
@@ -28765,9 +28775,9 @@ function undeterminedFrontDoors(inputs) {
     return reason === void 0 ? [] : [{ pid: record2.pid, origin: directOrigin(record2.directPort), reason }];
   });
 }
-function currentHeadroomAllowlistInputs(fs28, paths, frontDoorLiveness) {
-  const named = frontDoorOrigin(readFrontDoorState(fs28, paths.frontdoorStateFile));
-  const records = listFrontDoorDirectRecords(fs28, paths.frontdoorDirectRecordsDir);
+function currentHeadroomAllowlistInputs(fs29, paths, frontDoorLiveness) {
+  const named = frontDoorOrigin(readFrontDoorState(fs29, paths.frontdoorStateFile));
+  const records = listFrontDoorDirectRecords(fs29, paths.frontdoorDirectRecordsDir);
   const liveness = frontDoorLiveness(records.map((record2) => record2.pid));
   const live = liveFrontDoorDirectRecords(records, liveness).map((record2) => directOrigin(record2.directPort));
   return {
@@ -28776,8 +28786,8 @@ function currentHeadroomAllowlistInputs(fs28, paths, frontDoorLiveness) {
     frontDoorOrigins: [.../* @__PURE__ */ new Set([...named === void 0 ? [] : [named], ...live])].sort()
   };
 }
-function launchRequiredUpstreams(fs28, paths) {
-  const door = frontDoorOrigin(readFrontDoorState(fs28, paths.frontdoorStateFile));
+function launchRequiredUpstreams(fs29, paths) {
+  const door = frontDoorOrigin(readFrontDoorState(fs29, paths.frontdoorStateFile));
   return door === void 0 ? [] : [door];
 }
 async function waitUntilReady(ports, socketPath, pid) {
@@ -31704,8 +31714,8 @@ var init_classify = __esm({
 function poolNameOf(selector) {
   return selector.startsWith(POOL_SELECTOR_PREFIX) ? selector.slice(POOL_SELECTOR_PREFIX.length) : void 0;
 }
-function readActiveIdentity(fs28, activeIdentityFile) {
-  const trimmed = fs28.readFileUtf8(activeIdentityFile)?.trim();
+function readActiveIdentity(fs29, activeIdentityFile) {
+  const trimmed = fs29.readFileUtf8(activeIdentityFile)?.trim();
   return trimmed === void 0 || trimmed === "" ? void 0 : trimmed;
 }
 function isNonEmpty(value2) {
@@ -31752,8 +31762,8 @@ function decideConfigProfile(params) {
   }
   return { source: "none" };
 }
-function loadIdentity(identitiesDir, name, fs28) {
-  return loadConfigFile(import_node_path11.default.join(identitiesDir, name, "identity.json"), IdentitySchema, fs28.readConfigFile);
+function loadIdentity(identitiesDir, name, fs29) {
+  return loadConfigFile(import_node_path11.default.join(identitiesDir, name, "identity.json"), IdentitySchema, fs29.readConfigFile);
 }
 var import_node_path11, IDENTITY_DECISION_SOURCES, CONFIG_PROFILE_DECISION_SOURCES;
 var init_identity = __esm({
@@ -33460,8 +33470,8 @@ var init_pipeline = __esm({
 });
 
 // src/launcher/farm.ts
-function readFarmManifest(fs28, farmRoot) {
-  const raw = fs28.readFileUtf8(import_node_path19.default.join(farmRoot, FARM_MANIFEST_FILENAME)) ?? fs28.readFileUtf8(import_node_path19.default.join(farmRoot, LEGACY_FARM_MANIFEST_FILENAME));
+function readFarmManifest(fs29, farmRoot) {
+  const raw = fs29.readFileUtf8(import_node_path19.default.join(farmRoot, FARM_MANIFEST_FILENAME)) ?? fs29.readFileUtf8(import_node_path19.default.join(farmRoot, LEGACY_FARM_MANIFEST_FILENAME));
   if (raw === void 0) {
     return void 0;
   }
@@ -33519,9 +33529,9 @@ function buildEntryFacts(params) {
     entries
   };
 }
-function listSubtree(fs28, root, rel) {
+function listSubtree(fs29, root, rel) {
   const absolute = import_node_path19.default.join(root, rel);
-  const stat = fs28.lstat(absolute);
+  const stat = fs29.lstat(absolute);
   if (stat === void 0) {
     return [];
   }
@@ -33529,10 +33539,10 @@ function listSubtree(fs28, root, rel) {
     return [{ rel, kind: "symlink" }];
   }
   if (stat.kind === "dir") {
-    const children = [...fs28.readdir(absolute)].sort().flatMap((name) => listSubtree(fs28, root, `${rel}/${name}`));
+    const children = [...fs29.readdir(absolute)].sort().flatMap((name) => listSubtree(fs29, root, `${rel}/${name}`));
     return [{ rel, kind: "dir" }, ...children];
   }
-  const contentHash = fs28.hashFile(absolute);
+  const contentHash = fs29.hashFile(absolute);
   return [{ rel, kind: "file", ...contentHash === void 0 ? {} : { contentHash } }];
 }
 function topLevelScopeRoots(roots) {
@@ -33546,25 +33556,25 @@ function topLevelScopeRoots(roots) {
   }
   return kept;
 }
-function reconciliationScope(fs28, farmRoot, manifest) {
+function reconciliationScope(fs29, farmRoot, manifest) {
   if (manifest !== void 0) {
     return topLevelScopeRoots(manifest.materialised);
   }
-  return [...fs28.readdir(farmRoot)].filter((name) => name !== FARM_MANIFEST_FILENAME && name !== LEGACY_FARM_MANIFEST_FILENAME && fs28.lstat(import_node_path19.default.join(farmRoot, name))?.kind === "dir").sort();
+  return [...fs29.readdir(farmRoot)].filter((name) => name !== FARM_MANIFEST_FILENAME && name !== LEGACY_FARM_MANIFEST_FILENAME && fs29.lstat(import_node_path19.default.join(farmRoot, name))?.kind === "dir").sort();
 }
-function collectFarmListing(fs28, farmRoot, scopeRoots) {
-  return scopeRoots.flatMap((root) => listSubtree(fs28, farmRoot, root));
+function collectFarmListing(fs29, farmRoot, scopeRoots) {
+  return scopeRoots.flatMap((root) => listSubtree(fs29, farmRoot, root));
 }
-function collectCanonicalCounterparts(fs28, claudeHome, farmListing) {
+function collectCanonicalCounterparts(fs29, claudeHome, farmListing) {
   const out = [];
   for (const entry of farmListing) {
     const absolute = import_node_path19.default.join(claudeHome, entry.rel);
-    const stat = fs28.lstat(absolute);
+    const stat = fs29.lstat(absolute);
     if (stat === void 0) {
       continue;
     }
     if (stat.kind === "file") {
-      const contentHash = fs28.hashFile(absolute);
+      const contentHash = fs29.hashFile(absolute);
       out.push({ rel: entry.rel, kind: "file", ...contentHash === void 0 ? {} : { contentHash } });
       continue;
     }
@@ -33999,6 +34009,7 @@ function buildLayoutPaths(root) {
     frontdoorControlTokenFile: import_node_path20.default.join(root, "frontdoor", "control-token"),
     frontdoorSessionsDir: import_node_path20.default.join(root, "frontdoor", "sessions"),
     frontdoorDirectRecordsDir: import_node_path20.default.join(root, "frontdoor", "direct"),
+    frontdoorDrainingDir: import_node_path20.default.join(root, "frontdoor", "draining"),
     frontdoorRcCredentialsDir: import_node_path20.default.join(root, "frontdoor", "rc-credentials"),
     frontdoorLogPath: import_node_path20.default.join(root, "logs", "frontdoor.log"),
     usageDir: import_node_path20.default.join(root, "usage"),
@@ -35236,9 +35247,9 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
   }
 }
 async function serveFrontDoor(idleShutdownMinutes, ports, options) {
-  const { fs: fs28, paths } = ports;
+  const { fs: fs29, paths } = ports;
   const servingBinary = ports.statOwnExecutable();
-  const previous = readFrontDoorState(fs28, paths.frontdoorStateFile);
+  const previous = readFrontDoorState(fs29, paths.frontdoorStateFile);
   let lastPort = previous?.lastPort;
   let lastConnectPort = previous?.lastConnectPort;
   let lastDirectPort = previous?.lastDirectPort;
@@ -35249,12 +35260,12 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
   });
   const fail = (message) => {
     ports.closeRcStreamHub();
-    writeFrontDoorState(fs28, paths.frontdoorStateFile, { lastError: message, ...sticky() });
-    fs28.removeRecursive(paths.frontdoorLockFile);
+    writeFrontDoorState(fs29, paths.frontdoorStateFile, { lastError: message, ...sticky() });
+    fs29.removeRecursive(paths.frontdoorLockFile);
     ports.log(`agent-shim frontdoor supervisor: ${message}`);
     return 1;
   };
-  writeFrontDoorState(fs28, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, ...sticky() });
+  writeFrontDoorState(fs29, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, ...sticky() });
   const previousSticky = lastPort;
   let http9;
   try {
@@ -35294,16 +35305,16 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
     ports.log(`agent-shim frontdoor supervisor: sticky direct port ${String(previousStickyDirect)} was occupied; moving to ${String(direct.port)} (headroom admits the new address once its supervisor rewrites the allowlist file)`);
   }
   lastDirectPort = direct.port;
-  writeFrontDoorDirectRecord(fs28, paths.frontdoorDirectRecordsDir, { pid: ports.ownPid, directPort: direct.port });
-  writeFrontDoorState(fs28, paths.frontdoorStateFile, { protocol: FRONT_DOOR_PROTOCOL, supervisorPid: ports.ownPid, port: http9.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
+  writeFrontDoorDirectRecord(fs29, paths.frontdoorDirectRecordsDir, { pid: ports.ownPid, directPort: direct.port });
+  writeFrontDoorState(fs29, paths.frontdoorStateFile, { protocol: FRONT_DOOR_PROTOCOL, supervisorPid: ports.ownPid, port: http9.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
   ports.doorHealth.generation({ providerPort: http9.port, connectPort: connect3.port, directPort: direct.port });
-  fs28.removeRecursive(paths.frontdoorLockFile);
+  fs29.removeRecursive(paths.frontdoorLockFile);
   ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http9.port)}, CONNECT surface on 127.0.0.1:${String(connect3.port)}`);
   const watchdog = ports.startWatchdog?.();
   let idleSince;
   let ticks = 0;
   const supersedingOwner = () => {
-    const owner = readFrontDoorState(fs28, paths.frontdoorStateFile)?.supervisorPid;
+    const owner = readFrontDoorState(fs29, paths.frontdoorStateFile)?.supervisorPid;
     return owner !== void 0 && owner !== ports.ownPid && ports.isRunning(owner) ? owner : void 0;
   };
   let supersededBy;
@@ -35312,30 +35323,61 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
     const current = ports.statOwnExecutable();
     return current !== void 0 && servingBinary !== void 0 && (current.dev !== servingBinary.dev || current.ino !== servingBinary.ino || current.size !== servingBinary.size || current.mtimeMs !== servingBinary.mtimeMs);
   };
+  const pause = async () => {
+    await new Promise((resolve2) => {
+      const wake = () => {
+        resolve2();
+      };
+      ports.retire?.addEventListener("abort", wake, { once: true });
+      void ports.sleep(FRONTDOOR_POLL_MS).then(() => {
+        ports.retire?.removeEventListener("abort", wake);
+        resolve2();
+      });
+    });
+  };
+  const retireByDrain = async () => {
+    ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: asked to exit; releasing the front door's addresses and finishing the connections it carries`);
+    watchdog?.stop();
+    ports.stopBackgroundWork?.();
+    const drained = [direct.drain(), connect3.drain(), http9.drain()];
+    if (supersedingOwner() === void 0) {
+      writeFrontDoorState(fs29, paths.frontdoorStateFile, sticky());
+    }
+    markFrontDoorDraining(fs29, paths.frontdoorDrainingDir, ports.ownPid);
+    ports.closeRcStreamHub();
+    await Promise.all(drained);
+    unmarkFrontDoorDraining(fs29, paths.frontdoorDrainingDir, ports.ownPid);
+    removeFrontDoorDirectRecord(fs29, paths.frontdoorDirectRecordsDir, ports.ownPid);
+    ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: the connections this door carried have ended; exiting`);
+    return 0;
+  };
   const closeServing = async () => {
     watchdog?.stop();
     await direct.close();
     await connect3.close();
     await http9.close();
     ports.closeRcStreamHub();
-    removeFrontDoorDirectRecord(fs28, paths.frontdoorDirectRecordsDir, ports.ownPid);
+    removeFrontDoorDirectRecord(fs29, paths.frontdoorDirectRecordsDir, ports.ownPid);
   };
   const shutdown = async () => {
     await closeServing();
     if (supersedingOwner() === void 0) {
-      writeFrontDoorState(fs28, paths.frontdoorStateFile, sticky());
+      writeFrontDoorState(fs29, paths.frontdoorStateFile, sticky());
     }
     return 0;
   };
   for (; ; ) {
     watchdog?.beat();
+    if (ports.retire?.aborted === true) {
+      return await retireByDrain();
+    }
     if (options.tickLimit !== void 0 && ticks >= options.tickLimit) {
       watchdog?.stop();
       return FRONTDOOR_SUPERVISOR_STILL_RUNNING;
     }
     ticks += 1;
-    const listed = listFrontDoorSessions(fs28, paths.frontdoorSessionsDir);
-    const pruned = pruneDeadFrontDoorSessions(fs28, paths.frontdoorSessionsDir, ports.isRunning);
+    const listed = listFrontDoorSessions(fs29, paths.frontdoorSessionsDir);
+    const pruned = pruneDeadFrontDoorSessions(fs29, paths.frontdoorSessionsDir, ports.isRunning);
     ports.observeLaunchRegistry(listed, pruned);
     ports.checkQuotaExpiry();
     const prunedPids = new Set(pruned);
@@ -35345,7 +35387,7 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
       if (supersededBy !== void 0) {
         ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: supervisor ${String(supersededBy)} now owns the front door; taking no new sessions and exiting once the sessions this door serves have ended`);
         ports.doorHealth.superseded(supersededBy);
-        await ports.sleep(FRONTDOOR_POLL_MS);
+        await pause();
         continue;
       }
     } else {
@@ -35357,7 +35399,7 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
         await closeServing();
         return 0;
       }
-      await ports.sleep(FRONTDOOR_POLL_MS);
+      await pause();
       continue;
     }
     if (live.length === 0) {
@@ -35375,7 +35417,7 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
     } else {
       idleSince = void 0;
     }
-    await ports.sleep(FRONTDOOR_POLL_MS);
+    await pause();
   }
 }
 var import_node_path23, AWAIT_PID_POLL_MS, FRONTDOOR_SUPERVISOR_STILL_RUNNING, FRONTDOOR_POLL_MS, MS_PER_MINUTE3;
@@ -35526,25 +35568,35 @@ ${request7.rawHeaders.reduce((accumulated, value2, index) => index % 2 === 0 ? `
   const transparent = config2.transparentPort === void 0 || apiSession === void 0 ? void 0 : await effects.listenLoopback(config2.transparentPort, (socket) => {
     sniAcceptor.accept(socket);
   });
+  const closeSurface = async () => {
+    ledger.close();
+    await listener.close();
+    await transparent?.close();
+    sniAcceptor.close();
+    for (const { httpSession, tlsAcceptor } of sessions) {
+      tlsAcceptor.close();
+      httpSession?.close();
+    }
+  };
   return {
     port: listener.port,
     ...transparent === void 0 ? {} : { transparentPort: transparent.port },
-    close: async () => {
-      ledger.close();
-      await listener.close();
+    openTunnels: ledger.openTunnels,
+    drain: async () => {
+      listener.stopAccepting();
       await transparent?.close();
-      sniAcceptor.close();
-      for (const { httpSession, tlsAcceptor } of sessions) {
-        tlsAcceptor.close();
-        httpSession?.close();
-      }
-    }
+      await ledger.retire();
+      await closeSurface();
+    },
+    close: closeSurface
   };
 }
 function createConnectionLedger(limits, isLiveCapability2) {
   const pending = /* @__PURE__ */ new Map();
   const authenticated = /* @__PURE__ */ new Map();
   let tunnels = 0;
+  const blind = /* @__PURE__ */ new Set();
+  let onNoBlindTunnels;
   const leavePending = (socket) => {
     const deadline = pending.get(socket);
     if (deadline !== void 0) {
@@ -35581,16 +35633,45 @@ function createConnectionLedger(limits, isLiveCapability2) {
       });
     },
     headReceived: leavePending,
-    establish: (socket, capability) => {
+    openTunnels: () => tunnels,
+    retire: async () => {
+      for (const socket of pending.keys()) {
+        socket.destroy();
+      }
+      for (const deadline of pending.values()) {
+        clearTimeout(deadline);
+      }
+      pending.clear();
+      for (const sockets of authenticated.values()) {
+        for (const socket of sockets) {
+          if (!blind.has(socket)) {
+            socket.destroy();
+          }
+        }
+      }
+      if (blind.size > 0) {
+        await new Promise((resolve2) => {
+          onNoBlindTunnels = resolve2;
+        });
+      }
+    },
+    establish: (socket, capability, kind) => {
       if (tunnels >= limits.maxTunnels) {
         return false;
       }
       tunnels += 1;
+      if (kind === "blind") {
+        blind.add(socket);
+      }
       const sockets = authenticated.get(capability) ?? /* @__PURE__ */ new Set();
       sockets.add(socket);
       authenticated.set(capability, sockets);
       socket.once("close", () => {
         tunnels -= 1;
+        blind.delete(socket);
+        if (blind.size === 0) {
+          onNoBlindTunnels?.();
+        }
         sockets.delete(socket);
         if (sockets.size === 0 && authenticated.get(capability) === sockets) {
           authenticated.delete(capability);
@@ -35672,11 +35753,11 @@ function routeConnect(socket, head, context) {
     refuse(socket, REFUSAL.badRequest);
     return;
   }
-  if (!ledger.establish(socket, capability)) {
+  const session = sessions.find((entry) => entry.host === target.host);
+  if (!ledger.establish(socket, capability, session === void 0 ? "blind" : "terminated")) {
     refuse(socket, REFUSAL.serviceUnavailable);
     return;
   }
-  const session = sessions.find((entry) => entry.host === target.host);
   config2.capture?.connect(target, session !== void 0);
   socket.write(CONNECT_ESTABLISHED);
   if (session !== void 0) {
@@ -35846,7 +35927,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "claude-use",
-      version: "11.48.0",
+      version: "11.49.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -35959,14 +36040,14 @@ function isIdentityName(name) {
 function claudeJsonPath(identitiesDir, identity) {
   return import_node_path25.default.join(identitiesDir, identity, CLAUDE_JSON);
 }
-function readAccountMetadata(fs28, identitiesDir, identity) {
+function readAccountMetadata(fs29, identitiesDir, identity) {
   if (!isIdentityName(identity)) {
     throw new Error(`"${identity}" is not a valid identity name.`);
   }
-  return readAccountMetadataFile(fs28, claudeJsonPath(identitiesDir, identity));
+  return readAccountMetadataFile(fs29, claudeJsonPath(identitiesDir, identity));
 }
-function readAccountMetadataFile(fs28, file2) {
-  const raw = fs28.readFileUtf8(file2);
+function readAccountMetadataFile(fs29, file2) {
+  const raw = fs29.readFileUtf8(file2);
   if (raw === void 0) {
     return void 0;
   }
@@ -35996,19 +36077,19 @@ function readAccountMetadataFile(fs28, file2) {
   }
   return account.data;
 }
-function createAccountReader(fs28, identitiesDir) {
+function createAccountReader(fs29, identitiesDir) {
   const cache = /* @__PURE__ */ new Map();
   return (identity) => {
     if (!isIdentityName(identity)) {
       throw new Error(`"${identity}" is not a valid identity name.`);
     }
-    const stat = fs28.lstat(claudeJsonPath(identitiesDir, identity));
+    const stat = fs29.lstat(claudeJsonPath(identitiesDir, identity));
     const stamp = stat === void 0 ? "absent" : `${String(stat.mtimeMs)}:${String(stat.sizeBytes)}`;
     const cached2 = cache.get(identity);
     if (cached2?.stamp === stamp) {
       return cached2.account;
     }
-    const account = readAccountMetadata(fs28, identitiesDir, identity);
+    const account = readAccountMetadata(fs29, identitiesDir, identity);
     cache.set(identity, { stamp, account });
     return account;
   };
@@ -36838,8 +36919,8 @@ function segmentDay(epochMs) {
 function segmentName(day, pid) {
   return `${day}.${String(pid)}.jsonl`;
 }
-function listLogSegments(fs28, logDir) {
-  return fs28.readdir(logDir).flatMap((name) => {
+function listLogSegments(fs29, logDir) {
+  return fs29.readdir(logDir).flatMap((name) => {
     const match = SEGMENT_RE.exec(name);
     const day = match?.[1];
     if (day === void 0) {
@@ -36848,15 +36929,15 @@ function listLogSegments(fs28, logDir) {
     return [{ name, day, endsAt: Date.parse(`${day}T00:00:00.000Z`) + DAY_MS }];
   }).sort((left, right) => left.day.localeCompare(right.day) || left.name.localeCompare(right.name));
 }
-function readUsageLog(fs28, logDir, options = {}) {
+function readUsageLog(fs29, logDir, options = {}) {
   const { sinceMs } = options;
   const records = [];
   let invalidLines = 0;
-  for (const segment of listLogSegments(fs28, logDir)) {
+  for (const segment of listLogSegments(fs29, logDir)) {
     if (sinceMs !== void 0 && segment.endsAt <= sinceMs) {
       continue;
     }
-    const contents = fs28.readFileUtf8(import_node_path26.default.join(logDir, segment.name));
+    const contents = fs29.readFileUtf8(import_node_path26.default.join(logDir, segment.name));
     if (contents === void 0) {
       continue;
     }
@@ -36892,9 +36973,9 @@ function snapshotPath(snapshotsDir, identity) {
   }
   return import_node_path26.default.join(snapshotsDir, `${identity}.json`);
 }
-function readUsageSnapshot(fs28, snapshotsDir, identity) {
+function readUsageSnapshot(fs29, snapshotsDir, identity) {
   const file2 = snapshotPath(snapshotsDir, identity);
-  const raw = fs28.readFileUtf8(file2);
+  const raw = fs29.readFileUtf8(file2);
   if (raw === void 0) {
     return void 0;
   }
@@ -36910,8 +36991,8 @@ function readUsageSnapshot(fs28, snapshotsDir, identity) {
   }
   return snapshot.data;
 }
-function listUsageSnapshots(fs28, snapshotsDir) {
-  return fs28.readdir(snapshotsDir).flatMap((name) => {
+function listUsageSnapshots(fs29, snapshotsDir) {
+  return fs29.readdir(snapshotsDir).flatMap((name) => {
     if (!name.endsWith(".json")) {
       return [];
     }
@@ -36919,7 +37000,7 @@ function listUsageSnapshots(fs28, snapshotsDir) {
     if (!isIdentityName(identity)) {
       return [];
     }
-    const snapshot = readUsageSnapshot(fs28, snapshotsDir, identity);
+    const snapshot = readUsageSnapshot(fs29, snapshotsDir, identity);
     return snapshot === void 0 ? [] : [snapshot];
   }).sort((left, right) => left.identity.localeCompare(right.identity));
 }
@@ -36993,11 +37074,11 @@ var init_read = __esm({
 });
 
 // src/usage/store.ts
-function pruneUsageLog(fs28, logDir, nowMs) {
+function pruneUsageLog(fs29, logDir, nowMs) {
   const cutoff = nowMs - USAGE_RETENTION_MS;
-  for (const segment of listLogSegments(fs28, logDir)) {
+  for (const segment of listLogSegments(fs29, logDir)) {
     if (segment.endsAt <= cutoff) {
-      fs28.removeRecursive(import_node_path27.default.join(logDir, segment.name));
+      fs29.removeRecursive(import_node_path27.default.join(logDir, segment.name));
     }
   }
 }
@@ -37026,7 +37107,7 @@ function foldProviderState(current, record2) {
   };
 }
 function createUsageStore(deps) {
-  const { fs: fs28, paths } = deps;
+  const { fs: fs29, paths } = deps;
   let prunedDay;
   const rewriteSnapshot = (identity, fold) => {
     if (!isIdentityName(identity)) {
@@ -37035,7 +37116,7 @@ function createUsageStore(deps) {
     }
     let current;
     try {
-      current = readUsageSnapshot(fs28, paths.usageSnapshotsDir, identity);
+      current = readUsageSnapshot(fs29, paths.usageSnapshotsDir, identity);
     } catch (error63) {
       if (!(error63 instanceof UsageSnapshotError)) {
         throw error63;
@@ -37062,8 +37143,8 @@ function createUsageStore(deps) {
       ...account === void 0 ? {} : { account },
       providers
     });
-    fs28.mkdirPrivate(paths.usageSnapshotsDir);
-    fs28.writeFilePrivate(snapshotPath(paths.usageSnapshotsDir, identity), `${JSON.stringify(snapshot, null, 2)}
+    fs29.mkdirPrivate(paths.usageSnapshotsDir);
+    fs29.writeFilePrivate(snapshotPath(paths.usageSnapshotsDir, identity), `${JSON.stringify(snapshot, null, 2)}
 `);
     deps.publish?.(snapshot);
     return true;
@@ -37072,14 +37153,14 @@ function createUsageStore(deps) {
     record: (input2) => {
       const record2 = UsageRecordSchema.parse(input2);
       const nowMs = deps.now();
-      fs28.mkdirPrivate(paths.usageDir);
-      fs28.mkdirPrivate(paths.usageLogDir);
+      fs29.mkdirPrivate(paths.usageDir);
+      fs29.mkdirPrivate(paths.usageLogDir);
       const day = segmentDay(nowMs);
       if (prunedDay !== day) {
-        pruneUsageLog(fs28, paths.usageLogDir, nowMs);
+        pruneUsageLog(fs29, paths.usageLogDir, nowMs);
         prunedDay = day;
       }
-      fs28.appendFilePrivate(import_node_path27.default.join(paths.usageLogDir, segmentName(day, deps.pid)), `${JSON.stringify(record2)}
+      fs29.appendFilePrivate(import_node_path27.default.join(paths.usageLogDir, segmentName(day, deps.pid)), `${JSON.stringify(record2)}
 `);
       deps.onRecord?.(record2);
       if (record2.identity !== void 0) {
@@ -37122,14 +37203,14 @@ var init_store2 = __esm({
 function errorMessage(error63) {
   return error63 instanceof Error ? error63.message : String(error63);
 }
-function loadPoolMembers(fs28, paths, identities, nowMs) {
+function loadPoolMembers(fs29, paths, identities, nowMs) {
   const windowStartMs = nowMs - FIVE_HOUR_WINDOW_MS;
-  const log = readUsageLog(fs28, paths.usageLogDir, { sinceMs: windowStartMs });
+  const log = readUsageLog(fs29, paths.usageLogDir, { sinceMs: windowStartMs });
   return identities.map((identity) => {
     const records = log.records.filter((record2) => record2.identity === identity && record2.provider === ANTHROPIC_PROVIDER && Date.parse(record2.at) >= windowStartMs);
     try {
-      const snapshot = readUsageSnapshot(fs28, paths.usageSnapshotsDir, identity);
-      const account = readAccountMetadata(fs28, paths.identitiesDir, identity) ?? snapshot?.account;
+      const snapshot = readUsageSnapshot(fs29, paths.usageSnapshotsDir, identity);
+      const account = readAccountMetadata(fs29, paths.identitiesDir, identity) ?? snapshot?.account;
       return { identity, records, ...snapshot === void 0 ? {} : { snapshot }, ...account === void 0 ? {} : { account } };
     } catch (error63) {
       if (error63 instanceof UsageSnapshotError || error63 instanceof AccountMetadataError) {
@@ -37202,9 +37283,9 @@ function nestedMember(input2, nestedName, childStack, sticky) {
     missing: nested.missing
   };
 }
-function readPicksFile(fs28, file2) {
+function readPicksFile(fs29, file2) {
   const empty = { schemaVersion: SCHEMA_VERSION, picks: {} };
-  const raw = fs28.readFileUtf8(file2);
+  const raw = fs29.readFileUtf8(file2);
   if (raw === void 0) {
     return { file: empty };
   }
@@ -37217,17 +37298,17 @@ function readPicksFile(fs28, file2) {
   const result = PicksFileSchema.safeParse(parsed);
   return result.success ? { file: result.data } : { file: empty, problem: `${file2} is not a picks file this agent-shim can read` };
 }
-function readStickyPick(fs28, picksFile, directory) {
-  const read = readPicksFile(fs28, picksFile);
+function readStickyPick(fs29, picksFile, directory) {
+  const read = readPicksFile(fs29, picksFile);
   const entry = read.file.picks[directory];
   return { ...entry === void 0 ? {} : { sticky: entry }, ...read.problem === void 0 ? {} : { problem: read.problem } };
 }
-function recordStickyPick(fs28, picksFile, directory, identity, nowMs) {
-  const current = readPicksFile(fs28, picksFile).file.picks;
+function recordStickyPick(fs29, picksFile, directory, identity, nowMs) {
+  const current = readPicksFile(fs29, picksFile).file.picks;
   const kept = Object.entries(current).filter(([, entry]) => nowMs - Date.parse(entry.at) <= USAGE_RETENTION_MS);
   const next = { schemaVersion: SCHEMA_VERSION, picks: { ...Object.fromEntries(kept), [directory]: { identity, at: new Date(nowMs).toISOString() } } };
-  fs28.mkdirPrivate(import_node_path28.default.dirname(picksFile));
-  fs28.writeFilePrivate(picksFile, `${JSON.stringify(next, null, 2)}
+  fs29.mkdirPrivate(import_node_path28.default.dirname(picksFile));
+  fs29.writeFilePrivate(picksFile, `${JSON.stringify(next, null, 2)}
 `);
 }
 var import_node_path28, PoolGraphError, SCHEMA_VERSION, PickEntrySchema, PicksFileSchema;
@@ -38094,12 +38175,12 @@ function decideSignIn(facts) {
 function credentialsFilePath(farmRoot) {
   return import_node_path31.default.join(farmRoot, CREDENTIALS_FILE);
 }
-function identitySignIn(fs28, probe, identity) {
+function identitySignIn(fs29, probe, identity) {
   const probing = !identity.hasCredentialBlock;
   return decideSignIn({
     hasCredentialBlock: identity.hasCredentialBlock,
     keychainItem: probing && probe.platform === "darwin" && probe.run !== void 0 ? keychainHasItem(probe.run, identity.farmRoot) : void 0,
-    credentialsFile: probing && fs28.lstat(credentialsFilePath(identity.farmRoot)) !== void 0,
+    credentialsFile: probing && fs29.lstat(credentialsFilePath(identity.farmRoot)) !== void 0,
     platform: probe.platform
   });
 }
@@ -64088,6 +64169,58 @@ ${captureLines}` : capture.stack;
   }
 });
 
+// src/frontdoor/doorLog.ts
+function appendDoorLog(paths, line) {
+  import_node_fs14.default.mkdirSync(paths.logsDir, { recursive: true });
+  import_node_fs14.default.appendFileSync(paths.frontdoorLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+`);
+}
+var import_node_fs14;
+var init_doorLog = __esm({
+  "src/frontdoor/doorLog.ts"() {
+    "use strict";
+    import_node_fs14 = __toESM(require("node:fs"), 1);
+  }
+});
+
+// src/frontdoor/replacement.ts
+function replacementLine(facts) {
+  return `launcher ${String(facts.launcherPid)}: replacing front door; reason=${facts.reason} signal=${facts.signal} door=${String(facts.doorPid)} doorProtocol=${String(facts.doorProtocol)} launcherProtocol=${String(facts.launcherProtocol)} liveSessions=${String(facts.liveSessions)}`;
+}
+function retireLine(doorPid, signal, facts) {
+  return `frontdoor ${String(doorPid)}: received ${signal}; retiring; tunnelsOpen=${String(facts.tunnels)} liveSessions=${String(facts.liveSessions)} protocol=${String(facts.protocol)} uptimeSeconds=${String(facts.uptimeSeconds)}`;
+}
+function exitNowLine(doorPid, facts) {
+  return `frontdoor ${String(doorPid)}: received SIGINT again; exiting now; tunnelsDropped=${String(facts.tunnels)} liveSessions=${String(facts.liveSessions)}`;
+}
+function alreadyRetiringLine(doorPid) {
+  return `frontdoor ${String(doorPid)}: received SIGTERM again; already retiring`;
+}
+function retireOnSignals(source, params) {
+  let retiring = false;
+  for (const signal of ["SIGTERM", "SIGINT"]) {
+    source.on(signal, () => {
+      if (retiring && signal === "SIGTERM") {
+        params.log(alreadyRetiringLine(params.doorPid));
+        return;
+      }
+      if (retiring) {
+        params.log(exitNowLine(params.doorPid, params.facts()));
+        params.exit(0);
+        return;
+      }
+      retiring = true;
+      params.log(retireLine(params.doorPid, signal, params.facts()));
+      params.retire();
+    });
+  }
+}
+var init_replacement = __esm({
+  "src/frontdoor/replacement.ts"() {
+    "use strict";
+  }
+});
+
 // src/frontdoor/ensure.ts
 function ensureFrontDoor(params) {
   const { paths, ports } = params;
@@ -64098,7 +64231,7 @@ function ensureFrontDoor(params) {
   let lastRejection;
   let busyDoor;
   const liveSessionsOn = (doorPid) => listFrontDoorSessions(ports.fs, paths.frontdoorSessionsDir).filter(
-    (session) => session.pid !== params.launcherPid && ports.isRunning(session.pid) && (session.supervisorPid === void 0 || session.supervisorPid === doorPid)
+    (session) => session.pid !== params.launcherPid && ports.isRunning(session.pid) && (session.supervisorPid === void 0 || session.supervisorPid === doorPid || !ports.isRunning(session.supervisorPid))
   ).length;
   const verifyWithRetry = (port) => {
     let verdict = ports.verifyListener(port);
@@ -64108,12 +64241,20 @@ function ensureFrontDoor(params) {
     }
     return verdict;
   };
-  const stopAndAwaitExit = (supervisorPid, failure2) => {
+  const recordReplacement = (doorPid, doorProtocol, reason, signal) => {
+    ports.recordReplacement(
+      replacementLine({ reason, signal, launcherPid: params.launcherPid, launcherProtocol: FRONT_DOOR_PROTOCOL, doorPid, doorProtocol, liveSessions: liveSessionsOn(doorPid) })
+    );
+  };
+  const stopAndAwaitExit = (supervisorPid, doorProtocol, reason, failure2) => {
+    recordReplacement(supervisorPid, doorProtocol, reason, "SIGTERM");
     ports.stopSupervisor(supervisorPid);
     const graceEnds = ports.now() + FRONTDOOR_EXIT_GRACE_MS;
     let killed = false;
-    while (ports.isRunning(supervisorPid)) {
+    const holdsAddresses = () => ports.isRunning(supervisorPid) && readFrontDoorState(ports.fs, paths.frontdoorStateFile)?.supervisorPid === supervisorPid;
+    while (holdsAddresses()) {
       if (!killed && ports.now() >= graceEnds) {
+        recordReplacement(supervisorPid, doorProtocol, reason, "SIGKILL");
         ports.killSupervisor(supervisorPid);
         killed = true;
       }
@@ -64128,16 +64269,19 @@ function ensureFrontDoor(params) {
     const supervisorPid = state?.supervisorPid;
     if (supervisorPid !== void 0 && !distrusted.has(supervisorPid) && ports.isRunning(supervisorPid)) {
       if (state?.port !== void 0 && state.connectPort !== void 0) {
-        if (supervisorPid === params.launcherPid && params.replace !== true && ports.isFrontDoorSupervisor(supervisorPid)) {
+        if (supervisorPid === params.launcherPid && params.replace === void 0 && ports.isFrontDoorSupervisor(supervisorPid)) {
           const token = (0, import_node_crypto14.randomUUID)();
           writeFrontDoorSession(ports.fs, paths.frontdoorSessionsDir, { pid: params.launcherPid, startedAt: ports.now(), token, supervisorPid, ...recordOf(params.session) });
           return { port: state.port, connectPort: state.connectPort, token };
         }
         const verdict = verifyWithRetry(state.port);
-        if (verdict.ok && !replaced && !spawned && (params.replace === true || (state.protocol ?? 0) < FRONT_DOOR_PROTOCOL)) {
+        const doorProtocol = state.protocol ?? 0;
+        if (verdict.ok && !replaced && !spawned && (params.replace !== void 0 || doorProtocol < FRONT_DOOR_PROTOCOL)) {
           stopAndAwaitExit(
             supervisorPid,
-            `the front door (pid ${String(supervisorPid)}, protocol ${String(state.protocol ?? 0)}; this launcher speaks protocol ${String(FRONT_DOOR_PROTOCOL)}) was asked to be replaced and did not exit`
+            doorProtocol,
+            params.replace ?? "protocol-older",
+            `the front door (pid ${String(supervisorPid)}, protocol ${String(doorProtocol)}; this launcher speaks protocol ${String(FRONT_DOOR_PROTOCOL)}) was asked to be replaced and did not exit`
           );
           replaced = true;
           continue;
@@ -64153,15 +64297,15 @@ function ensureFrontDoor(params) {
         }
         if (ports.isFrontDoorSupervisor(supervisorPid)) {
           const stranded = liveSessionsOn(supervisorPid);
-          if (params.replace === true && !replaced) {
-            stopAndAwaitExit(supervisorPid, `the front door (pid ${String(supervisorPid)}) stopped answering and did not exit when asked to`);
+          if (params.replace !== void 0 && !replaced) {
+            stopAndAwaitExit(supervisorPid, doorProtocol, "probe-failed-restart", `the front door (pid ${String(supervisorPid)}) stopped answering and did not exit when asked to`);
             replaced = true;
             continue;
           }
           if (stranded > 0) {
             busyDoor = { pid: supervisorPid, sessions: stranded };
           } else {
-            stopAndAwaitExit(supervisorPid, `the front door (pid ${String(supervisorPid)}) stopped answering and did not exit when asked to`);
+            stopAndAwaitExit(supervisorPid, doorProtocol, "probe-failed-idle", `the front door (pid ${String(supervisorPid)}) stopped answering and did not exit when asked to`);
             continue;
           }
         } else {
@@ -64203,7 +64347,7 @@ function restartFrontDoor(params) {
     return { action: "not-running" };
   }
   try {
-    ensureFrontDoor({ paths, launcherPid: params.pid, replace: true, ports });
+    ensureFrontDoor({ paths, launcherPid: params.pid, replace: params.reason, ports });
   } finally {
     removeFrontDoorSession(ports.fs, paths.frontdoorSessionsDir, params.pid);
   }
@@ -64220,6 +64364,7 @@ var init_ensure2 = __esm({
     import_node_crypto14 = require("node:crypto");
     init_cliError();
     init_state2();
+    init_replacement();
     init_state();
     FRONTDOOR_START_TIMEOUT_MS = 3e4;
     FRONTDOOR_LAUNCHER_POLL_MS = 100;
@@ -64350,14 +64495,14 @@ var init_selfIdentity = __esm({
 
 // src/frontdoor/trust.ts
 function resolveTrustBundle(params) {
-  const { caCertFile, bundlesDir, variable, inherited, fs: fs28 } = params;
+  const { caCertFile, bundlesDir, variable, inherited, fs: fs29 } = params;
   if (inherited === void 0 || inherited === "" || import_node_path38.default.resolve(inherited) === import_node_path38.default.resolve(caCertFile)) {
     return { path: caCertFile };
   }
-  const caPem = fs28.readFileUtf8(caCertFile);
+  const caPem = fs29.readFileUtf8(caCertFile);
   let inheritedPem;
   try {
-    inheritedPem = fs28.readFileUtf8(inherited);
+    inheritedPem = fs29.readFileUtf8(inherited);
   } catch (error63) {
     return {
       path: caCertFile,
@@ -64370,9 +64515,9 @@ function resolveTrustBundle(params) {
   const combined = `${inheritedPem.trimEnd()}
 ${caPem}`;
   const bundle = import_node_path38.default.join(bundlesDir, `${(0, import_node_crypto15.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
-  if (!fs28.exists(bundle)) {
-    fs28.mkdirp(bundlesDir);
-    fs28.writeFileAtomic(bundle, combined);
+  if (!fs29.exists(bundle)) {
+    fs29.mkdirp(bundlesDir);
+    fs29.writeFileAtomic(bundle, combined);
   }
   return { path: bundle };
 }
@@ -64395,6 +64540,9 @@ function realEnsurePorts(paths, spawnDaemon) {
     sleep: realSleepSync,
     spawnSupervisor: (layout) => spawnDaemon(layout, "__frontdoor-supervisor", layout.frontdoorLogPath),
     isFrontDoorSupervisor: (pid) => isFrontDoorSupervisorPid(pid, realIsFrontDoorSupervisor),
+    recordReplacement: (line) => {
+      appendDoorLog(paths, line);
+    },
     stopSupervisor: (pid) => {
       process.kill(pid, "SIGTERM");
     },
@@ -64402,11 +64550,11 @@ function realEnsurePorts(paths, spawnDaemon) {
       process.kill(pid, "SIGKILL");
     },
     // Read fresh for each probe: a replacement supervisor may have regenerated an unparseable CA, and the probe must trust exactly what the serving door's leaf chains to.
-    verifyListener: (port) => probeFrontDoorSync(port, import_node_fs14.default.readFileSync(paths.frontdoorCaCertFile, "utf8"))
+    verifyListener: (port) => probeFrontDoorSync(port, import_node_fs15.default.readFileSync(paths.frontdoorCaCertFile, "utf8"))
   };
 }
-function realRestartFrontDoor(paths, spawnDaemon) {
-  return restartFrontDoor({ paths, pid: process.pid, ports: realEnsurePorts(paths, spawnDaemon) });
+function realRestartFrontDoor(paths, spawnDaemon, reason) {
+  return restartFrontDoor({ paths, pid: process.pid, reason, ports: realEnsurePorts(paths, spawnDaemon) });
 }
 function realFrontDoorPort(paths, spawnDaemon) {
   return {
@@ -64426,22 +64574,23 @@ function realFrontDoorPort(paths, spawnDaemon) {
     }
   };
 }
-var import_node_fs14, realTrustBundleFs;
+var import_node_fs15, realTrustBundleFs;
 var init_realFrontDoorPort = __esm({
   "src/frontdoor/realFrontDoorPort.ts"() {
     "use strict";
-    import_node_fs14 = __toESM(require("node:fs"), 1);
+    import_node_fs15 = __toESM(require("node:fs"), 1);
     init_realPorts();
+    init_doorLog();
     init_ensure2();
     init_state();
     init_probe();
     init_selfIdentity();
     init_trust();
     realTrustBundleFs = {
-      readFileUtf8: (file2) => import_node_fs14.default.readFileSync(file2, "utf8"),
-      exists: (file2) => import_node_fs14.default.existsSync(file2),
+      readFileUtf8: (file2) => import_node_fs15.default.readFileSync(file2, "utf8"),
+      exists: (file2) => import_node_fs15.default.existsSync(file2),
       mkdirp: (dir) => {
-        import_node_fs14.default.mkdirSync(dir, { recursive: true });
+        import_node_fs15.default.mkdirSync(dir, { recursive: true });
       },
       writeFileAtomic: (file2, contents) => {
         realFarmFs.writeFilePrivate(file2, contents);
@@ -64539,20 +64688,20 @@ function lockHolder(contents) {
   const pid = Number((contents ?? "").trim());
   return Number.isInteger(pid) && pid > 0 ? pid : void 0;
 }
-function acquireUpdateLock(fs28, isProcessAlive, pid, lockPath) {
-  const take = () => fs28.writeFileExclusive(lockPath, `${String(pid)}
+function acquireUpdateLock(fs29, isProcessAlive, pid, lockPath) {
+  const take = () => fs29.writeFileExclusive(lockPath, `${String(pid)}
 `);
   const release = () => {
-    fs28.unlink(lockPath);
+    fs29.unlink(lockPath);
   };
   if (take()) {
     return release;
   }
-  const holder = lockHolder(fs28.readFileUtf8(lockPath));
+  const holder = lockHolder(fs29.readFileUtf8(lockPath));
   if (holder !== void 0 && holder !== pid && isProcessAlive(holder)) {
     throw new UpdateConflictError(`another agent-shim update (pid ${String(holder)}) is already running`);
   }
-  fs28.unlink(lockPath);
+  fs29.unlink(lockPath);
   if (!take()) {
     throw new UpdateConflictError("another agent-shim update took the lock while it was being replaced");
   }
@@ -65298,15 +65447,15 @@ function contextTokensOfTranscript(text2) {
   }
   return void 0;
 }
-function newestTranscript(fs28, projectDir) {
+function newestTranscript(fs29, projectDir) {
   let newest;
   let newestMs = -Infinity;
-  for (const name of fs28.readdir(projectDir)) {
+  for (const name of fs29.readdir(projectDir)) {
     if (!name.endsWith(".jsonl")) {
       continue;
     }
     const candidate = import_node_path43.default.join(projectDir, name);
-    const stat = fs28.lstat(candidate);
+    const stat = fs29.lstat(candidate);
     if (stat?.kind === "file" && stat.mtimeMs > newestMs) {
       newestMs = stat.mtimeMs;
       newest = candidate;
@@ -65314,18 +65463,18 @@ function newestTranscript(fs28, projectDir) {
   }
   return newest;
 }
-function latestConversationId(fs28, params) {
-  const file2 = newestTranscript(fs28, import_node_path43.default.join(params.claudeHome, "projects", projectDirNameOf(params.cwd)));
+function latestConversationId(fs29, params) {
+  const file2 = newestTranscript(fs29, import_node_path43.default.join(params.claudeHome, "projects", projectDirNameOf(params.cwd)));
   return file2 === void 0 ? void 0 : import_node_path43.default.basename(file2, ".jsonl");
 }
-function resumedContextTokens(fs28, params) {
+function resumedContextTokens(fs29, params) {
   const target = resumeTargetOf(params.passthrough);
   if (target === void 0) {
     return void 0;
   }
   const projectDir = import_node_path43.default.join(params.claudeHome, "projects", projectDirNameOf(params.cwd));
-  const file2 = target.kind === "id" ? import_node_path43.default.join(projectDir, `${target.id}.jsonl`) : newestTranscript(fs28, projectDir);
-  const text2 = file2 === void 0 ? void 0 : fs28.readFileUtf8(file2);
+  const file2 = target.kind === "id" ? import_node_path43.default.join(projectDir, `${target.id}.jsonl`) : newestTranscript(fs29, projectDir);
+  const text2 = file2 === void 0 ? void 0 : fs29.readFileUtf8(file2);
   return text2 === void 0 ? void 0 : contextTokensOfTranscript(text2);
 }
 var import_node_path43;
@@ -67355,7 +67504,7 @@ function resolveIdentityCredential(identity, credential, env, port) {
   return resolution.ok ? resolution : { ok: false, status: CREDENTIAL_UNAVAILABLE_EXIT, message: resolution.message };
 }
 function pickFromPool(decided, params, parsedArgv, readOnly) {
-  const { paths, fs: fs28, proc, log } = params;
+  const { paths, fs: fs29, proc, log } = params;
   if (decided.pool === void 0) {
     return { identityDecision: decided };
   }
@@ -67374,7 +67523,7 @@ function pickFromPool(decided, params, parsedArgv, readOnly) {
     selectedVia: decided.source,
     pools: params.pools,
     paths,
-    fs: fs28,
+    fs: fs29,
     usageFs: farmRuntime.fs,
     cwd: farmRuntime.cwd,
     now: farmRuntime.now,
@@ -67397,7 +67546,7 @@ function pickFromPool(decided, params, parsedArgv, readOnly) {
   };
 }
 function decideLaunch(params, readOnly) {
-  const { paths, fs: fs28, proc, log } = params;
+  const { paths, fs: fs29, proc, log } = params;
   const { env, argv } = proc;
   const parsedArgv = parseLauncherArgv(argv);
   const cliOverride = buildCliOverride({
@@ -67412,7 +67561,7 @@ function decideLaunch(params, readOnly) {
     argv0Identity: parsedArgv.identity,
     directoryPinnedIdentity: params.directoryPinnedIdentity,
     readActiveIdentityFile: () => {
-      const raw = fs28.readFileUtf8(paths.activeIdentityFile);
+      const raw = fs29.readFileUtf8(paths.activeIdentityFile);
       if (raw === void 0) {
         return void 0;
       }
@@ -67447,7 +67596,7 @@ function decideLaunch(params, readOnly) {
   }
   let loadedIdentity;
   if (identityDecision.name !== void 0) {
-    loadedIdentity = loadIdentity(paths.identitiesDir, identityDecision.name, fs28);
+    loadedIdentity = loadIdentity(paths.identitiesDir, identityDecision.name, fs29);
     if (loadedIdentity === void 0) {
       log.error(
         `agent-shim: no identity named "${identityDecision.name}" (selected via ${identityDecision.source}). Run \`agent-shim identity add ${identityDecision.name}\` first.`
@@ -67462,7 +67611,7 @@ function decideLaunch(params, readOnly) {
     identityDefaultConfigProfile: loadedIdentity?.config.defaultConfigProfile,
     globalDefaultConfigProfile: params.globalDefaultConfigProfile
   });
-  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs28.readConfigFile(import_node_path45.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
+  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs29.readConfigFile(import_node_path45.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
     log.error(
       `agent-shim: no configuration profile named "${configProfileDecision.name}" (selected via ${configProfileDecision.source}). Run \`agent-shim profile add ${configProfileDecision.name}\` first.`
     );
@@ -67471,7 +67620,7 @@ function decideLaunch(params, readOnly) {
   const farmContext = farm !== void 0 && farmIdentity !== void 0 ? { farm, identity: farmIdentity, cascade: farm.loadCascade(configProfileDecision.name, cliOverride) } : void 0;
   const providerParams = {
     paths,
-    port: fs28,
+    port: fs29,
     ...parsedArgv.provider === void 0 || parsedArgv.provider === false ? {} : { cliProvider: parsedArgv.provider },
     ...farmContext === void 0 ? {} : { cascade: farmContext.cascade }
   };
@@ -67570,9 +67719,9 @@ function decideLaunch(params, readOnly) {
   const flags = loginlessProvider === void 0 ? requestedFlags : { ...requestedFlags, remoteControl: false };
   const globalModels = loadConfigFile(paths.globalConfigFile, GlobalConfigSchema, params.fs.readConfigFile)?.config.models;
   const models = launchCascade !== void 0 && params.farm !== void 0 ? cascadeModels : globalModels;
-  const listedProviders = listProviderNames(fs28.readdir, paths.providersDir).flatMap((name) => {
+  const listedProviders = listProviderNames(fs29.readdir, paths.providersDir).flatMap((name) => {
     try {
-      const definition = loadProvider(paths.providersDir, name, fs28);
+      const definition = loadProvider(paths.providersDir, name, fs29);
       return definition === void 0 ? [] : [[name, definition, parseCatalogueCache(params.fs.readFileUtf8(catalogueCachePath(paths, name)))?.models ?? []]];
     } catch {
       return [];
@@ -68912,10 +69061,10 @@ function Ww(e14) {
 }
 function M_() {
   let e14 = "";
-  if (typeof process < "u" && typeof process.cwd === "function" && typeof import_node_fs16.realpathSync === "function") try {
+  if (typeof process < "u" && typeof process.cwd === "function" && typeof import_node_fs17.realpathSync === "function") try {
     let t10 = (0, import_node_process4.cwd)();
     try {
-      e14 = Ww((0, import_node_fs16.realpathSync)(t10));
+      e14 = Ww((0, import_node_fs17.realpathSync)(t10));
     } catch {
       e14 = Ww(t10);
     }
@@ -75539,11 +75688,11 @@ function hm(e14, t10, n10, r10) {
 function EU(e14, t10) {
   let n10 = e14.data;
   if (n10.isSidechain === true) return null;
-  let r10 = fs17(n10.firstPromptLocked === true ? n10.firstPrompt : n10.commandFallback) || void 0, o = fs17(n10.customTitle) || fs17(n10.aiTitle) || void 0, s = o || fs17(n10.lastPrompt) || fs17(n10.summaryHint) || r10;
+  let r10 = fs18(n10.firstPromptLocked === true ? n10.firstPrompt : n10.commandFallback) || void 0, o = fs18(n10.customTitle) || fs18(n10.aiTitle) || void 0, s = o || fs18(n10.lastPrompt) || fs18(n10.summaryHint) || r10;
   if (!s) return null;
-  return { sessionId: e14.sessionId, summary: s, lastModified: e14.mtime, fileSize: void 0, customTitle: o, firstPrompt: r10, gitBranch: fs17(n10.gitBranch) || void 0, cwd: fs17(n10.cwd) || t10 || void 0, tag: fs17(n10.tag) || void 0, createdAt: uAe(n10.createdAt) };
+  return { sessionId: e14.sessionId, summary: s, lastModified: e14.mtime, fileSize: void 0, customTitle: o, firstPrompt: r10, gitBranch: fs18(n10.gitBranch) || void 0, cwd: fs18(n10.cwd) || t10 || void 0, tag: fs18(n10.tag) || void 0, createdAt: uAe(n10.createdAt) };
 }
-function fs17(e14) {
+function fs18(e14) {
   return typeof e14 === "string" ? e14 : void 0;
 }
 function uAe(e14) {
@@ -82579,14 +82728,14 @@ async function jGe(e14, t10, n10, r10) {
   if (d.length === 0) return [];
   return iv(Buffer.from(gZ(d)), { limit: r10.limit, offset: r10.offset }, l, c10);
 }
-var import_node_module, import_crypto, import_crypto2, import_path, import_node_fs16, import_node_process4, import_fs, import_os, import_path2, yy, import_fs2, import_promises, import_path3, import_readline, import_promises2, import_path4, import_os2, import_path5, Se, import_promises3, xe, import_promises4, import_fs3, import_promises5, import_os3, import_path6, import_promises6, import_os4, import_node_path47, import_node_os10, import_node_process5, import_path7, import_events, import_fs4, import_promises7, import_path8, import_child_process, import_util9, import_child_process2, import_fs5, import_path9, import_path10, import_crypto3, import_fs6, import_path11, import_promises8, import_path12, import_path13, import_promises9, import_path14, import_path15, import_fs7, import_promises10, import_path16, import_crypto4, import_path17, import_async_hooks, import_fs8, import_promises11, import_crypto5, import_fs9, import_promises12, import_path18, import_promises13, import_path19, import_crypto6, import_path20, import_path21, import_path22, import_path23, import_promises14, import_fs10, import_promises15, import_path24, import_util10, import_path25, import_os5, import_path26, import_path27, import_path28, import_path29, import_path30, import_net, import_os6, import_child_process3, import_fs11, import_child_process4, import_crypto7, import_promises16, import_module, import_os7, import_path31, import_url, import_events2, import_child_process5, import_fs12, import_readline2, import_string_decoder, import_fs13, import_promises17, import_os8, import_path32, import_crypto8, import_os9, import_fs14, import_path33, import_crypto9, import_fs15, import_promises18, import_path34, IZ, DZ, v_, LZ, OT, NZ, UZ, kT, X, FZ, dr, HZ, jZ, BZ, ot, st, ed, Kv, Te, Me, Oo, nd, hF, Xv, Qv, rd, LF, or, WF, ZF, sA, XF, od, sd, hg, id, Sg, Oz, fA, $z, Wz, Zz, s$, a$, d$, f$, g$, _$, E$, v$, T$, O$, I$, L$, wg, z$, j$, G$, V$, yA, SA, rH, lH, uH, _H, EH, EA, RH, TH, kH, DH, NH, zH, jH, GH, VH, ZH, JH, ej, nj, ij, cj, uj, CA, bj, Aj, wj, PT, KZ, GZ, VGe, VZ, MT, wr, jo, JZ, XZ, NT, UT, FT, zT, Bo, $T, HT, jT, BT, a4, sp, l4, c4, vt, u4, Nt, KT, d4, p4, uc, GT, m4, g4, WT, _4, y4, VT, Dn, Et, b4, C4, v4, A4, ra, x4, ip, qT, ZT, w4, O4, ro, P4, I4, D4, L4, M4, N4, U4, YT, JT, Sn, H4, Ko, j4, oo, XT, QT, G4, W4, V4, ew, Z4, Y4, tw, X4, nw, R_, rw, ow, Go, sw, iw, aw, lw, ei, aY, cw, Or, cY, uw, dw, lp, pw, cp, mY, gY, up, _Y, aa, fw, la, EY, bY, CY, vY, AY, RY, xY, TY, wY, OY, kY, PY, IY, mw, x_, gw, ca, MY, et, dp, hw, pp, zY, $Y, _w, HY, ua, yw, wt, KY, T_, Sw, WY, VY, qY, so, mp, Ew, vw, bw, YY, Cw, JY, XY, kr, QY, e9, Wo, n9, da, o9, s9, i9, a9, l9, c9, u9, d9, p9, f9, m9, g9, h9, _9, y9, S9, E9, b9, C9, v9, A9, R9, x9, T9, Qe, Aw, pa, hp, Rw, dc, k9, w_, P9, Pr, xw, I9, fa, D9, L9, _p, N9, ma, yp, z9, Tw, $9, H9, ww, Vo, Ir, pc, W9, V9, q9, Ow, Y9, Sp, J9, Ep, X9, qo, Q9, bp, kw, eJ, Pw, Iw, Dw, Lw, tJ, nJ, rJ, oJ, sJ, ti, io, iJ, Mw, Nw, Cp, aJ, Uw, Fw, ga, pr, uJ, Fe, $w, O_, k_, I_, ha, Bw, D_, qw, Vw, N_, U_, yJ, _a3, Yo, Zw, bJ, Rp, Yw, vJ, AJ, Jw, xp, Xw, Tp, Qw, kJ, ya, IJ, DJ, Sa, MJ, fc, NJ, eO, FJ, zJ, $J, tO, Ea, jJ, nO, rO, sO, iO, Vn, GJ, Ln, Jo, aO, lO, cO, wp, XJ, QJ, uO, ba, dO, pO, fO, Dr, ao, mO, Ca, gO, z_, $_, H_, j_, B_, K_, G_, W_, V_, q_, Z_, _O, Y_, J_, yO, X_, c3, Q_, ey, ty, ny, ry, oy, sy, iy, ay, ly, cy, we, SO, en, d3, Pp, vO, g3, gy, wO, S3, BO, KO, Ip, Dp, v3, GO, WO, F9e, IO, A3, hy, x3, NO, I3, Ay, Ry, D3, xy, L3, bc, xa, Ty, wy, Oy, ky, XO, Py, Iy, Dy, Ly, My, Ny, Uy, Fy, zy, nk, rk, d3e, p3e, f3e, m3e, g3e, U3, jp, jy, ik, By, Ky, lk, $3, uk, ck, G3, W3, V3, it, Y3, J3, hk, tXe, Q3, kt, We, gX, Ta, SX, mr, Yp, Jp, eS, nS, yXe, IX, DX, rS, ka, oS, Ok, kk, HX, jX, ef, bXe, Uk, Mr, wc, Fk, Pa, OXe, kXe, iS, PXe, IXe, DXe, GX, YX, JX, XX, QX, e6, t6, Yk, n6, r6, o6, s6, i6, a6, l6, c6, Vk, uS, lf, dS, Qk, eP, uf, os10, qXe, ZXe, h6, tP, df, _6, y6, S6, E6, b6, Jn, gr, nP, rP, Dc, pS, oP, gS, lP, C6, mS, lS, sP, w6, O6, dP, k6, YXe, JXe, P6, I6, pf, L6, fP, XXe, QXe, M6, SS, z6, $6, j6, bP, CP, G6, Lc, si, Z6, ES, bS, X6, Q6, e5, t5, n5, u5, r5, o5, s5, i5, a5, l5, c5, u52, d5, p5, f5, m5, g5, h5, _5, y5, S5, E5, b5, C5, v5, A5, R5, x5, T5, w5, O5, k5, P5, I5, D5, L5, M5, N5, U5, F5, z5, $5, H5, j5, B5, K5, G5, W5, V5, q5, Z5, Y5, J5, X5, Q5, e8, t8, n8, r8, o8, s8, i8, a8, l8, c8, u8, d8, CS, p8, f8, m8, g8, h8, _8, y8, S8, E8, b8, C8, v8, A8, R8, x8, T8, w8, O8, k8, P8, I8, D8, L8, M8, N8, U8, F8, z8, $8, H8, j8, B8, K8, G8, W8, V8, q8, Z8, Y8, J8, X8, Q8, e7, t7, n7, r7, o7, s7, i7, a7, l7, c7, u7, d7, p7, f7, m7, g7, h7, _7, y7, S7, E7, b7, C7, TP, v7, L6e, RP, A7, x7, kP, ff, U6e, F6e, Ua, z6e, $6e, H6e, j6e, PP, IP, vS, DP, w7, LP, O7, k7, P7, AS, RS, xS, I7, MP, NP, D7, G6e, L7, W6e, M7, N7, UP, V6e, U7, F7, z7, $7, H7, j7, B7, q6e, is, wS, Fa, K7, G7, W7, i5e, X7, Q7, HP, $P, BP, tQ, WP, VP, JP, _Q, QP, eI, xQ, Uc, DS, $a, wQ, OQ, kQ, PQ, IQ, DQ, LQ, MQ, NQ, UQ, FQ, zQ, $Q, HQ, jQ, BQ, KQ, GQ, WQ, VQ, qQ, ZQ, YQ, JQ, XQ, QQ, eee, tee, nee, ree, oee, see, iee, aee, lee, cee, uee, dee, pee, fee, mee, gee, hee, _ee, yee, See, Eee, bee, Cee, vee, Aee, Ree, xee, Tee, wee, Oee, kee, Pee, Iee, Dee, Lee, Mee, Nee, Uee, Fee, zee, $ee, Hee, jee, Bee, Kee, Gee, Wee, Vee, qee, Zee, Yee, Jee, Xee, Qee, ete, tte, nte, rte, ote, ste, ite, ate, lte, cte, ute, dte, pte, fte, mte, gte, hte, _te, yte, Ste, Ete, bte, Cte, vte, Ate, Rte, xte, Tte, wte, Ote, kte, Pte, Ite, Dte, Lte, Mte, Nte, Ute, Fte, zte, $te, Hte, jte, Bte, Kte, Gte, Wte, Vte, qte, Zte, Yte, Jte, Xte, Qte, ene, tne, nne, rne, one, sne, ine, ane, lne, cne, une, dne, pne, fne, mne, gne, hne, _ne, yne, Sne, Ene, bne, Cne, vne, Ane, Rne, xne, Tne, wne, One, kne, Pne, Ine, Dne, Lne, Mne, Nne, Une, Fne, zne, $ne, Hne, jne, Bne, Kne, Gne, Wne, Vne, qne, Zne, Yne, Jne, Xne, Qne, ere, tre, nre, rre, ore, sre, ire, are, lre, cre, ure, dre, pre, fre, mre, gre, hre, _re, yre, Sre, Ere, bre, Cre, vre, Are, Rre, xre, Tre, wre, Ore, kre, Pre, Ire, Dre, Lre, Mre, Nre, Ure, Fre, zre, $re, Hre, jre, Bre, Kre, Gre, Wre, Vre, qre, Zre, Yre, Jre, Xre, Qre, eoe, toe, noe, roe, ooe, soe, ioe, aoe, loe, coe, uoe, doe, poe, foe, moe, goe, hoe, _oe, yoe, Soe, Eoe, boe, Coe, voe, Aoe, Roe, xoe, Toe, woe, Ooe, koe, Poe, Ioe, Doe, Loe, Moe, Noe, Uoe, Foe, zoe, $oe, Hoe, joe, Boe, Koe, Goe, Woe, Voe, qoe, Zoe, Yoe, Joe, Xoe, Qoe, ese, tse, nse, rse, ose, sse, ise, ase, lse, cse, use, dse, pse, fse, mse, gse, hse, _se, yse, Sse, Ese, LS, bse, Cse, vse, Ase, Rse, xse, Tse, wse, Ose, kse, Pse, Ise, Dse, Lse, Mse, Nse, Use, Fse, zse, $se, Hse, jse, Bse, Kse, Gse, Wse, Vse, qse, Zse, Yse, Jse, Xse, Qse, eie, tie, nie, rie, oie, sie, iie, aie, lie, cie, uie, die, pie, fie, mie, gie, hie, _ie, yie, Sie, Eie, bie, Cie, vie, Aie, Rie, xie, Tie, wie, Oie, kie, Pie, Iie, Die, Lie, Mie, Nie, Uie, Fie, zie, $ie, Hie, jie, Bie, Kie, Gie, Wie, Vie, qie, Zie, Yie, Jie, Xie, Qie, eae, tae, nae, rae, oae, sae, iae, aae, lae, cae, uae, dae, pae, fae, mae, gae, hae, _ae, yae, Sae, Eae, bae, Cae, vae, Aae, Rae, xae, Tae, wae, Oae, kae, Pae, Iae, Dae, Lae, Mae, Nae, Uae, Fae, zae, $ae, Hae, jae, Bae, Kae, Gae, Wae, Vae, qae, Zae, Yae, Jae, Xae, Qae, ele, tle, nle, rle, ole, sle, ile, ale, lle, cle, ule, dle, ple, fle, mle, gle, hle, _le, yle, Sle, Ele, ble, Cle, vle, Ale, Rle, xle, Tle, wle, Ole, kle, Ple, Ile, Dle, Lle, Mle, Nle, Ule, Fle, zle, $le, Hle, jle, Ble, Kle, Gle, Wle, Vle, qle, Zle, Yle, Jle, MS, Xle, Qle, ece, tce, nce, rce, oce, sce, ice, ace, lce, cce, uce, dce, pce, fce, mce, gce, hce, _ce, yce, Sce, Ece, bce, Cce, vce, Ace, Rce, xce, Tce, wce, Oce, kce, Pce, Ice, Dce, Lce, Mce, Nce, Uce, Fce, zce, $ce, Hce, jce, Bce, Kce, Gce, Wce, Vce, qce, Zce, Yce, Jce, Xce, Qce, eue, tue, nue, rue, oue, sue, iue, aue, lue, cue, uue, due, pue, fue, mue, gue, hue, _ue, yue, Sue, Eue, bue, Cue, vue, Aue, Rue, xue, Tue, wue, Oue, kue, Pue, Iue, Due, Lue, Mue, Nue, Uue, Fue, zue, $ue, Hue, jue, Bue, Kue, Gue, Wue, Vue, que, Zue, Yue, Jue, Xue, Que, ede, tde, nde, rde, ode, sde, ide, ade, lde, cde, ude, dde, pde, fde, mde, gde, hde, _de, yde, Sde, Ede, bde, Cde, vde, Ade, Rde, xde, Tde, wde, Ode, kde, Pde, Ide, Dde, Lde, Mde, Nde, Ude, Fde, zde, $de, Hde, jde, Bde, Kde, Gde, Wde, Vde, qde, Zde, Yde, Jde, Xde, Qde, epe, tpe, npe, rpe, ope, spe, ipe, ape, lpe, cpe, upe, dpe, ppe, fpe, mpe, gpe, hpe, _pe, ype, Spe, Epe, bpe, Cpe, vpe, Ape, Rpe, xpe, Tpe, wpe, Ope, kpe, Ppe, Ipe, Dpe, Lpe, Mpe, Npe, Upe, Fpe, zpe, $pe, Hpe, jpe, Bpe, Kpe, Gpe, Wpe, Vpe, qpe, Zpe, Ype, Jpe, Xpe, Qpe, efe, tfe, nfe, rfe, ofe, sfe, ife, afe, lfe, cfe, ufe, dfe, pfe, ffe, mfe, gfe, hfe, _fe, yfe, Sfe, Efe, bfe, Cfe, vfe, Afe, Rfe, xfe, Tfe, wfe, Ofe, kfe, Pfe, Ife, Dfe, Lfe, Mfe, Nfe, Ufe, Ffe, zfe, $fe, Hfe, jfe, Bfe, Kfe, Gfe, Wfe, Vfe, qfe, Zfe, Yfe, Jfe, Xfe, Qfe, eme, tme, nme, rme, ome, sme, ime, ame, lme, cme, ume, dme, pme, fme, mme, gme, hme, _me, yme, Sme, Eme, bme, Cme, vme, Ame, Rme, xme, Tme, wme, Ome, kme, Pme, Ime, Dme, Lme, Mme, Nme, Ume, Fme, zme, $me, Hme, jme, Bme, Kme, Gme, Wme, Vme, qme, Zme, Yme, Jme, NS, Xme, Qme, ege, tge, nge, rge, oge, sge, ige, age, lge, cge, uge, dge, pge, fge, mge, gge, hge, _ge, yge, Sge, Ege, bge, Cge, vge, Age, Rge, xge, Tge, wge, Oge, kge, Pge, Ige, Dge, Lge, Mge, Nge, Uge, Fge, zge, $ge, Hge, US, jge, Bge, Kge, Gge, Wge, Vge, qge, Zge, Yge, Jge, Xge, Qge, ehe, the, nhe, rhe, ohe, she, ihe, ahe, lhe, che, uhe, dhe, phe, fhe, mhe, ghe, hhe, _he, yhe, She, Ehe, bhe, Che, vhe, Ahe, Rhe, xhe, The, whe, Ohe, khe, Phe, Ihe, Dhe, Lhe, Mhe, Nhe, FS, rI, oI, Uhe, Fhe, zhe, $he, Hhe, jhe, Bhe, Khe, Ghe, Whe, Vhe, qhe, Zhe, Yhe, Jhe, Xhe, Qhe, e_e, t_e, n_e, r_e, o_e, s_e, i_e, a_e, l_e, c_e, u_e, d_e, p_e, f_e, m_e, g_e, h_e, __e, y_e, S_e, E_e, b_e, C_e, v_e, A_e, R_e, x_e, T_e, w_e, O_e, k_e, P_e, I_e, D_e, L_e, M_e, N_e, U_e, F_e, z_e, $_e, H_e, j_e, B_e, K_e, G_e, W_e, V_e, q_e, Z_e, Y_e, J_e, Q_e, Xn, eye, F8e, tye, z8e, nye, iI, rye, oye, lI, cye, uye, dye, _ye, on, vye, Aye, dI, C7e, v7e, ho, kI, PI, Dye, Sf, Lye, jc, Mye, Nye, LI, NI, Fye, VS, zye, $ye, x7e, zI, YS, KI, GI, VI, Hye, qS, ls, Kye, Gye, oD, nE, sD, So, Yc, vn, Zye, oE, sE, iD, aD, wf, Jc, Xc, kf, Qc, Pf, eu, fi, tu, mi, lD, cD, uD, dD, pD, fD, mD, gD, hD, _D, yD, SD, ED, bD, vD, AD, cE, RD, Xye, TD, wD, OD, kD, PD, uE, ID, DD, LD, MD, FD, If, nu, zD, $D, HD, jD, BD, zt, dE, Df, pE, fE, KD, GD, WD, VD, qD, ru, ZD, YD, JD, XD, QD, eL, tL, mE, yr, He, rL, ou, Je, yE, SE, EE, fL, mL, tSe, bE, CE, vE, AE, RE, xE, TE, wE, gL, hL, _L, yL, OE, sSe, kE, PE, IE, DE, LE, ME, NE, Nf, UE, FE, zE, $E, HE, jE, BE, cSe, gE, KE, vL, Uf, GE, WE, VE, qE, ZE, YE, Ff, JE, XE, QE, eb, tb, nb, zf, AL, rb, ob, sb, TL, ab, RL, xL, $f, Hf, dSe, fSe, OL, kL, Sr, FL, ML, zL, lu, hSe, iC, aC, lC, HL, jL, cC, uC, BL, dC, KL, pC, GL, fC, mC, WL, VL, qL, ZL, gC, YL, hC, JL, XL, _C, yC, SC, EC, QL, sC, bC, CC, vC, AC, RC, xC, TC, wC, OC, tM, qf, kC, $L, rM, ASe, Fn, oM, sM, iM, aM, lM, cM, uM, dM, pM, fM, mM, gM, Be, SM, LC, ct, MC, EM, bM, CM, pEe, fEe, Yf, mEe, gEe, hEe, _Ee, yEe, SEe, EEe, bEe, CEe, vEe, AEe, REe, xEe, TEe, wEe, OEe, NC, kEe, vM, PEe, IEe, DEe, LEe, MEe, fu, AM, NEe, UEe, IC, DC, FEe, zEe, qa, TM, HEe, jEe, KEe, wM, em, mu, qEe, ZEe, JEe, OM, Qn, kM, LM, nbe, rbe, abe, lbe, cbe, rm, pbe, At, hbe, BC, BM, Zet, WM, VM, qM, ZM, Cbe, vbe, YM, Abe, Rbe, JM, xbe, Tbe, QM, Ibe, eN, Lbe, nN, Mbe, Nbe, sm, rN, iN, Fbe, aN, $be, jbe, Kbe, Gbe, yu, lN, uN, dN, Xbe, KM, Qbe, eCe, tCe, oCe, iCe, _N, yN, wN, Ytt, ON, OCe, DCe, LN, $Ce, HCe, Cu, BCe, MN, VCe, QCe, ive, uve, VN, pve, fve, _rt, gve, Sve, nv, tv, GN, tU, Fve, Hve, iU, tAe, sAe, iAe, aAe, cAe, Ie, bU, Q, vo, F, zn, fAe, ms, mAe, _m, nn, he, Xa, an, lv, cv, Si, wu, se, br, CU, Oe, gAe, hAe, _Ae, yAe, SAe, EAe, bAe, CAe, vAe, uv, AAe, RAe, xAe, TAe, wAe, OAe, vU, kAe, Ro, el, tl, ym, ku, Sm, Pu, Iu, Em, Ei, xo, bm, Fr, ft, Du, Ao, pv, Lu, To, Cm, vm, nl, Ou, Mu, Nu, bi, Uu, rl, $r, zr, gs, Fu, zu, Am, fv, Rm, $u, wot, H, Oot, kot, Pot, Iot, Dot, Lot, Mot, Not, Uot, Fot, zot, $ot, Hot, jot, xU, Bot, Kot, Got, Wot, Vot, qot, Zot, Yot, Jot, Xot, Qot, est, tst, nst, rst, ost, sst, ist, ast, FAe, zAe, gv, OU, Ss, km, Mt, kU, PU, kst, HAe, jAe, hv, $n, Hu, IU, Yt, tr, nr, Jt, Pm, DU, _v, LU, MU, yv, ju, le, Sv, NU, Pst, Ist, Im, BAe, Dm, KAe, Bu, ol, UU, GAe, WAe, VAe, qAe, ZAe, YAe, Ev, JAe, XAe, bv, Lm, QAe, eRe, Mm, tRe, Ku, Gu, nRe, Wu, sl, rRe, Vu, Nm, Um, Fm, Dst, zm, $m, Hm, FU, zU, $U, Cv, HU, qu, il, jU, oRe, jm, sRe, Bm, iRe, vv, aRe, Km, lRe, cRe, uRe, dRe, pRe, fRe, mRe, gRe, hRe, _Re, Gm, yRe, SRe, Wm, Av, Rv, xv, ERe, bRe, CRe, Tv, vRe, ARe, RRe, xRe, TRe, BU, Vm, wRe, qm, Lst, ORe, al, kRe, Mst, Zu, PRe, wv, IRe, DRe, LRe, MRe, NRe, URe, FRe, Om, zRe, $Re, HRe, Yu, Ov, jRe, BRe, KRe, GRe, WRe, VRe, qRe, ZRe, YRe, JRe, XRe, QRe, exe, txe, nxe, rxe, oxe, sxe, ll, ixe, axe, lxe, Zm, cxe, uxe, dxe, kv, pxe, Nst, Ust, Fst, zst, $st, Hst, ae, WU, qU, VU, ZU, YU, Ym, e0, fxe, mxe, Dv, Cr, gxe, Ju, d0, h0, _0, v0, A0, Sxe, Exe, Mv, Cxe, Fv, Oj, kj, PA, IA, DA, Lj, Dj, aLe, NA, FA, uLe, dd, fLe, Po, SLe, ELe, zA, bLe, xLe, TLe, wLe, OLe, kLe, $j, qj, ILe, DLe, LLe, MLe, Ce, NLe, Wg, Oi, VA, Do, Jj, Xj, Qj, eB, tB, nB, qA, ZA, jA, Bj, jLe, BLe, GLe, rB, BA, Gg, GA, WA, VLe, qLe, Kj, Hs, sB, QLe, YA, iB, uB, eMe, dB, pB, fB, mB, tMe, XA, aB, QA, gB, hB, _B, yB, jn, lMe, SB, dMe, bB, mMe, fd, RB, hMe, Rr, TB, SMe, EMe, Pl, wB, Vg, AMe, Il, RMe, xMe, qg, OB, wMe, OMe, kB, eo, Dl, Zg, DB, NMe, FB, WMe, VMe, $B, HB, jB, BB, Ml, GB, nR, WB, Jg, KB, eNe, Bs, VB, gd, Nl, Xg, tNe, YB, qB, Pi, rK, iK, pNe, hd, _d, to, yd, nh, uK, aK, _Ne, lK, cK, Sd, Ul, rh, oh, dK, CNe, pK, sh, fK, RNe, xNe, TNe, mK, wNe, ONe, ih, Ed, lr, gK, hK, yK, SK, EK, ah, bK, FNe, CK, zNe, $Ne, HNe, vK, BNe, lh, AK, RK, xK, VNe, dn, TK, wK, OK, kK, PK, QNe, eUe, IK, DK, rUe, LK, MK, NK, UK, iUe, aUe, lUe, cUe, uUe, dUe, pUe, fUe, mUe, gUe, hUe, _Ue, yUe, SUe, EUe, bUe, CUe, vUe, AUe, FK, xUe, zK, $K, wUe, HK, OUe, jK, BK, PUe, KK, IUe, DUe, LUe, GK, MUe, NUe, UUe, FUe, WK, zUe, $Ue, HUe, VK, jUe, BUe, KUe, GUe, WUe, VUe, qUe, ZUe, YUe, JUe, XUe, QUe, e0e, t0e, n0e, r0e, Xe, qK, ZK, YK, JK, a0e, l0e, uh, XK, QK, e1, n1, r1, dh, m0e, g0e, h0e, _0e, bd, o1, S0e, Fl, s1, b0e, i1, Di, a1, l1, c1, u1, d1, p1, f1, P0e, I0e, m1, D0e, g1, h1, _1, vyt, U0e, y1, Ayt, iR, F0e, z0e, $0e, Gs, zl, fh, E1, b1, H0e, j0e, B0e, K0e, mh, $l, gh, Ws, aR, hh, _h, G0e, W0e, lR, R1, x1, V0e, uR, k1, P1, I1, D1, L1, Y0e, dR, J0e, Fyt, pR, X0e, fR, mR, Q0e, zyt, eFe, gR, hR, _R, $yt, M1, yR, N1, U1, tFe, nFe, rFe, oFe, iFe, Mi, cFe, $1, Wyt, Vyt, H1, j1, B1, K1, uFe, G1, W1, V1, q1, dFe, pFe, SR, fFe, eSt, tSt, mFe, jl, Vs, gFe, Y1, hFe, _Fe, X1, Q1, eG, yFe, SFe, tG, EFe, bFe, CFe, vFe, bR, CR, RFe, xFe, vR, TFe, Eh, nSt, Cd, wFe, OFe, aSt, rG, PFe, IFe, _St, oG, sG, bSt, CSt, HFe, jFe, $St, BFe, KFe, HSt, JSt, XSt, lG, OR, VFe, YFe, uG, eze, nze, gG, vd, vh, kR, zi, sze, yG, ize, yEt, Ad, $i, bG, Kn, AEt, REt, xEt, aze, AG, wG, $R, dze, $G, pze, fze, mze, gze, hze, BR, HG, jG, fbt, yze, Sze, Eze, Gn, ji, kG, PG, NR, UR, KR, GG, Cze, vze, Rze, GR, xze, Tze, xh, WR, Oze, kze, mbt, Pze, Ize, Dze, Lze, Mze, Nze, qG, Uze, Fze, zze, $ze, ZG, Hze, IG, jze, Bze, YG, Kze, Gze, DG, Wze, Vze, JG, qze, Zze, Yze, Jze, QG, Xze, Qze, e$e, t$e, r$e, o$e, s$e, i$e, a$e, eW, nW, c$e, m$e, xd, VR, gbt, hbt, _bt, h$e, qR, Th, MR, aW, _$e, S$e, lW, E$e, b$e, C$e, v$e, A$e, x$e, w$e, O$e, k$e, P$e, I$e, N$e, ybt, FR, Sbt, U$e, MG, Td, Ebt, bbt, uW, z$e, $$e, H$e, Cbt, j$e, B$e, vbt, Abt, K$e, Rbt, Oh, kh, G$e, YR, Ph, W$e, Ih, Mbt, Nbt, Ubt, Dh, V$e, Z$e, tx, EW, Id, Fh, X$e, xCt, Q$e, eHe, ix, ax, lx, cx, zh, $h, MW, tHe, nHe, aHe, uHe, dHe, Zs, pHe, CW, vW, AW, Nh, UW, fHe, mHe, gHe, hHe, _He, yHe, SHe, EHe, pn, dx, nx, Mh, Bi, AHe, TCt, xHe, Pd, RW, THe, xW, wHe, OHe, Hh, kHe, TW, fx, Bh, Ki, KW, Gl, PHe, Kh, kW, Wl, NHe, Ld, UHe, tV, rV, jHe, XHe, cvt, tje, fV, mV, sje, aje, _V, yV, pje, zvt, $vt, gje, yje, Sje, Kvt, Gvt, eAt, RV, Eje, bje, mAt, Cje, gAt, xV, wV, OV, Js, Lje, FV, Yh, Jh, Md, Tx, zV, $V, HV, Xh, jV, cr, KV, Mo, Fje, zje, yRt, jje, Gje, Vje, sBe, YV, e22, o_, gBe, t2, s_, kx, o2, LBe, UBe, $x, Vi, R2, KBe, GBe, Dx, ZBe, k2, n_, l2, sKe, lKe, z2, bKe, RKe, ec, W2, H2, xKe, wKe, PKe, IKe, $Ke, X2, HKe, jKe, BKe, KKe, VKe, eTt, qKe, tTt, nTt, ZKe, rTt, YKe, oTt, JKe, Wx, XKe, iTt, eq, tq, QKe, nq, rq, e1e, t1e, oq, sq, n1e, r1e, aTt, lTt, c1e, Zx, cq, u1e, uq, a_, d1e, Xx, nc, S1e, c_, mq, gq, Qx, hq, _q, E1e, Sq, u_, rc, d_, b1e, bq, Uo, Cq, vq, A1e, Yd, Jd, R1e, x1e, Aq, gn, T1e, w1e, O1e, Xs, k1e, P1e, xq, Pwt, I1e, Oq, kq, Pq, D1e, L1e, Iq, M1e, N1e, nT, U1e, p_, rT, Dq, oT, iT, F1e, Uq, aT, jq, K1e, Gq, yOt, sGe, cGe, uGe, yGe;
+var import_node_module, import_crypto, import_crypto2, import_path, import_node_fs17, import_node_process4, import_fs, import_os, import_path2, yy, import_fs2, import_promises, import_path3, import_readline, import_promises2, import_path4, import_os2, import_path5, Se, import_promises3, xe, import_promises4, import_fs3, import_promises5, import_os3, import_path6, import_promises6, import_os4, import_node_path47, import_node_os10, import_node_process5, import_path7, import_events, import_fs4, import_promises7, import_path8, import_child_process, import_util9, import_child_process2, import_fs5, import_path9, import_path10, import_crypto3, import_fs6, import_path11, import_promises8, import_path12, import_path13, import_promises9, import_path14, import_path15, import_fs7, import_promises10, import_path16, import_crypto4, import_path17, import_async_hooks, import_fs8, import_promises11, import_crypto5, import_fs9, import_promises12, import_path18, import_promises13, import_path19, import_crypto6, import_path20, import_path21, import_path22, import_path23, import_promises14, import_fs10, import_promises15, import_path24, import_util10, import_path25, import_os5, import_path26, import_path27, import_path28, import_path29, import_path30, import_net, import_os6, import_child_process3, import_fs11, import_child_process4, import_crypto7, import_promises16, import_module, import_os7, import_path31, import_url, import_events2, import_child_process5, import_fs12, import_readline2, import_string_decoder, import_fs13, import_promises17, import_os8, import_path32, import_crypto8, import_os9, import_fs14, import_path33, import_crypto9, import_fs15, import_promises18, import_path34, IZ, DZ, v_, LZ, OT, NZ, UZ, kT, X, FZ, dr, HZ, jZ, BZ, ot, st, ed, Kv, Te, Me, Oo, nd, hF, Xv, Qv, rd, LF, or, WF, ZF, sA, XF, od, sd, hg, id, Sg, Oz, fA, $z, Wz, Zz, s$, a$, d$, f$, g$, _$, E$, v$, T$, O$, I$, L$, wg, z$, j$, G$, V$, yA, SA, rH, lH, uH, _H, EH, EA, RH, TH, kH, DH, NH, zH, jH, GH, VH, ZH, JH, ej, nj, ij, cj, uj, CA, bj, Aj, wj, PT, KZ, GZ, VGe, VZ, MT, wr, jo, JZ, XZ, NT, UT, FT, zT, Bo, $T, HT, jT, BT, a4, sp, l4, c4, vt, u4, Nt, KT, d4, p4, uc, GT, m4, g4, WT, _4, y4, VT, Dn, Et, b4, C4, v4, A4, ra, x4, ip, qT, ZT, w4, O4, ro, P4, I4, D4, L4, M4, N4, U4, YT, JT, Sn, H4, Ko, j4, oo, XT, QT, G4, W4, V4, ew, Z4, Y4, tw, X4, nw, R_, rw, ow, Go, sw, iw, aw, lw, ei, aY, cw, Or, cY, uw, dw, lp, pw, cp, mY, gY, up, _Y, aa, fw, la, EY, bY, CY, vY, AY, RY, xY, TY, wY, OY, kY, PY, IY, mw, x_, gw, ca, MY, et, dp, hw, pp, zY, $Y, _w, HY, ua, yw, wt, KY, T_, Sw, WY, VY, qY, so, mp, Ew, vw, bw, YY, Cw, JY, XY, kr, QY, e9, Wo, n9, da, o9, s9, i9, a9, l9, c9, u9, d9, p9, f9, m9, g9, h9, _9, y9, S9, E9, b9, C9, v9, A9, R9, x9, T9, Qe, Aw, pa, hp, Rw, dc, k9, w_, P9, Pr, xw, I9, fa, D9, L9, _p, N9, ma, yp, z9, Tw, $9, H9, ww, Vo, Ir, pc, W9, V9, q9, Ow, Y9, Sp, J9, Ep, X9, qo, Q9, bp, kw, eJ, Pw, Iw, Dw, Lw, tJ, nJ, rJ, oJ, sJ, ti, io, iJ, Mw, Nw, Cp, aJ, Uw, Fw, ga, pr, uJ, Fe, $w, O_, k_, I_, ha, Bw, D_, qw, Vw, N_, U_, yJ, _a3, Yo, Zw, bJ, Rp, Yw, vJ, AJ, Jw, xp, Xw, Tp, Qw, kJ, ya, IJ, DJ, Sa, MJ, fc, NJ, eO, FJ, zJ, $J, tO, Ea, jJ, nO, rO, sO, iO, Vn, GJ, Ln, Jo, aO, lO, cO, wp, XJ, QJ, uO, ba, dO, pO, fO, Dr, ao, mO, Ca, gO, z_, $_, H_, j_, B_, K_, G_, W_, V_, q_, Z_, _O, Y_, J_, yO, X_, c3, Q_, ey, ty, ny, ry, oy, sy, iy, ay, ly, cy, we, SO, en, d3, Pp, vO, g3, gy, wO, S3, BO, KO, Ip, Dp, v3, GO, WO, F9e, IO, A3, hy, x3, NO, I3, Ay, Ry, D3, xy, L3, bc, xa, Ty, wy, Oy, ky, XO, Py, Iy, Dy, Ly, My, Ny, Uy, Fy, zy, nk, rk, d3e, p3e, f3e, m3e, g3e, U3, jp, jy, ik, By, Ky, lk, $3, uk, ck, G3, W3, V3, it, Y3, J3, hk, tXe, Q3, kt, We, gX, Ta, SX, mr, Yp, Jp, eS, nS, yXe, IX, DX, rS, ka, oS, Ok, kk, HX, jX, ef, bXe, Uk, Mr, wc, Fk, Pa, OXe, kXe, iS, PXe, IXe, DXe, GX, YX, JX, XX, QX, e6, t6, Yk, n6, r6, o6, s6, i6, a6, l6, c6, Vk, uS, lf, dS, Qk, eP, uf, os10, qXe, ZXe, h6, tP, df, _6, y6, S6, E6, b6, Jn, gr, nP, rP, Dc, pS, oP, gS, lP, C6, mS, lS, sP, w6, O6, dP, k6, YXe, JXe, P6, I6, pf, L6, fP, XXe, QXe, M6, SS, z6, $6, j6, bP, CP, G6, Lc, si, Z6, ES, bS, X6, Q6, e5, t5, n5, u5, r5, o5, s5, i5, a5, l5, c5, u52, d5, p5, f5, m5, g5, h5, _5, y5, S5, E5, b5, C5, v5, A5, R5, x5, T5, w5, O5, k5, P5, I5, D5, L5, M5, N5, U5, F5, z5, $5, H5, j5, B5, K5, G5, W5, V5, q5, Z5, Y5, J5, X5, Q5, e8, t8, n8, r8, o8, s8, i8, a8, l8, c8, u8, d8, CS, p8, f8, m8, g8, h8, _8, y8, S8, E8, b8, C8, v8, A8, R8, x8, T8, w8, O8, k8, P8, I8, D8, L8, M8, N8, U8, F8, z8, $8, H8, j8, B8, K8, G8, W8, V8, q8, Z8, Y8, J8, X8, Q8, e7, t7, n7, r7, o7, s7, i7, a7, l7, c7, u7, d7, p7, f7, m7, g7, h7, _7, y7, S7, E7, b7, C7, TP, v7, L6e, RP, A7, x7, kP, ff, U6e, F6e, Ua, z6e, $6e, H6e, j6e, PP, IP, vS, DP, w7, LP, O7, k7, P7, AS, RS, xS, I7, MP, NP, D7, G6e, L7, W6e, M7, N7, UP, V6e, U7, F7, z7, $7, H7, j7, B7, q6e, is, wS, Fa, K7, G7, W7, i5e, X7, Q7, HP, $P, BP, tQ, WP, VP, JP, _Q, QP, eI, xQ, Uc, DS, $a, wQ, OQ, kQ, PQ, IQ, DQ, LQ, MQ, NQ, UQ, FQ, zQ, $Q, HQ, jQ, BQ, KQ, GQ, WQ, VQ, qQ, ZQ, YQ, JQ, XQ, QQ, eee, tee, nee, ree, oee, see, iee, aee, lee, cee, uee, dee, pee, fee, mee, gee, hee, _ee, yee, See, Eee, bee, Cee, vee, Aee, Ree, xee, Tee, wee, Oee, kee, Pee, Iee, Dee, Lee, Mee, Nee, Uee, Fee, zee, $ee, Hee, jee, Bee, Kee, Gee, Wee, Vee, qee, Zee, Yee, Jee, Xee, Qee, ete, tte, nte, rte, ote, ste, ite, ate, lte, cte, ute, dte, pte, fte, mte, gte, hte, _te, yte, Ste, Ete, bte, Cte, vte, Ate, Rte, xte, Tte, wte, Ote, kte, Pte, Ite, Dte, Lte, Mte, Nte, Ute, Fte, zte, $te, Hte, jte, Bte, Kte, Gte, Wte, Vte, qte, Zte, Yte, Jte, Xte, Qte, ene, tne, nne, rne, one, sne, ine, ane, lne, cne, une, dne, pne, fne, mne, gne, hne, _ne, yne, Sne, Ene, bne, Cne, vne, Ane, Rne, xne, Tne, wne, One, kne, Pne, Ine, Dne, Lne, Mne, Nne, Une, Fne, zne, $ne, Hne, jne, Bne, Kne, Gne, Wne, Vne, qne, Zne, Yne, Jne, Xne, Qne, ere, tre, nre, rre, ore, sre, ire, are, lre, cre, ure, dre, pre, fre, mre, gre, hre, _re, yre, Sre, Ere, bre, Cre, vre, Are, Rre, xre, Tre, wre, Ore, kre, Pre, Ire, Dre, Lre, Mre, Nre, Ure, Fre, zre, $re, Hre, jre, Bre, Kre, Gre, Wre, Vre, qre, Zre, Yre, Jre, Xre, Qre, eoe, toe, noe, roe, ooe, soe, ioe, aoe, loe, coe, uoe, doe, poe, foe, moe, goe, hoe, _oe, yoe, Soe, Eoe, boe, Coe, voe, Aoe, Roe, xoe, Toe, woe, Ooe, koe, Poe, Ioe, Doe, Loe, Moe, Noe, Uoe, Foe, zoe, $oe, Hoe, joe, Boe, Koe, Goe, Woe, Voe, qoe, Zoe, Yoe, Joe, Xoe, Qoe, ese, tse, nse, rse, ose, sse, ise, ase, lse, cse, use, dse, pse, fse, mse, gse, hse, _se, yse, Sse, Ese, LS, bse, Cse, vse, Ase, Rse, xse, Tse, wse, Ose, kse, Pse, Ise, Dse, Lse, Mse, Nse, Use, Fse, zse, $se, Hse, jse, Bse, Kse, Gse, Wse, Vse, qse, Zse, Yse, Jse, Xse, Qse, eie, tie, nie, rie, oie, sie, iie, aie, lie, cie, uie, die, pie, fie, mie, gie, hie, _ie, yie, Sie, Eie, bie, Cie, vie, Aie, Rie, xie, Tie, wie, Oie, kie, Pie, Iie, Die, Lie, Mie, Nie, Uie, Fie, zie, $ie, Hie, jie, Bie, Kie, Gie, Wie, Vie, qie, Zie, Yie, Jie, Xie, Qie, eae, tae, nae, rae, oae, sae, iae, aae, lae, cae, uae, dae, pae, fae, mae, gae, hae, _ae, yae, Sae, Eae, bae, Cae, vae, Aae, Rae, xae, Tae, wae, Oae, kae, Pae, Iae, Dae, Lae, Mae, Nae, Uae, Fae, zae, $ae, Hae, jae, Bae, Kae, Gae, Wae, Vae, qae, Zae, Yae, Jae, Xae, Qae, ele, tle, nle, rle, ole, sle, ile, ale, lle, cle, ule, dle, ple, fle, mle, gle, hle, _le, yle, Sle, Ele, ble, Cle, vle, Ale, Rle, xle, Tle, wle, Ole, kle, Ple, Ile, Dle, Lle, Mle, Nle, Ule, Fle, zle, $le, Hle, jle, Ble, Kle, Gle, Wle, Vle, qle, Zle, Yle, Jle, MS, Xle, Qle, ece, tce, nce, rce, oce, sce, ice, ace, lce, cce, uce, dce, pce, fce, mce, gce, hce, _ce, yce, Sce, Ece, bce, Cce, vce, Ace, Rce, xce, Tce, wce, Oce, kce, Pce, Ice, Dce, Lce, Mce, Nce, Uce, Fce, zce, $ce, Hce, jce, Bce, Kce, Gce, Wce, Vce, qce, Zce, Yce, Jce, Xce, Qce, eue, tue, nue, rue, oue, sue, iue, aue, lue, cue, uue, due, pue, fue, mue, gue, hue, _ue, yue, Sue, Eue, bue, Cue, vue, Aue, Rue, xue, Tue, wue, Oue, kue, Pue, Iue, Due, Lue, Mue, Nue, Uue, Fue, zue, $ue, Hue, jue, Bue, Kue, Gue, Wue, Vue, que, Zue, Yue, Jue, Xue, Que, ede, tde, nde, rde, ode, sde, ide, ade, lde, cde, ude, dde, pde, fde, mde, gde, hde, _de, yde, Sde, Ede, bde, Cde, vde, Ade, Rde, xde, Tde, wde, Ode, kde, Pde, Ide, Dde, Lde, Mde, Nde, Ude, Fde, zde, $de, Hde, jde, Bde, Kde, Gde, Wde, Vde, qde, Zde, Yde, Jde, Xde, Qde, epe, tpe, npe, rpe, ope, spe, ipe, ape, lpe, cpe, upe, dpe, ppe, fpe, mpe, gpe, hpe, _pe, ype, Spe, Epe, bpe, Cpe, vpe, Ape, Rpe, xpe, Tpe, wpe, Ope, kpe, Ppe, Ipe, Dpe, Lpe, Mpe, Npe, Upe, Fpe, zpe, $pe, Hpe, jpe, Bpe, Kpe, Gpe, Wpe, Vpe, qpe, Zpe, Ype, Jpe, Xpe, Qpe, efe, tfe, nfe, rfe, ofe, sfe, ife, afe, lfe, cfe, ufe, dfe, pfe, ffe, mfe, gfe, hfe, _fe, yfe, Sfe, Efe, bfe, Cfe, vfe, Afe, Rfe, xfe, Tfe, wfe, Ofe, kfe, Pfe, Ife, Dfe, Lfe, Mfe, Nfe, Ufe, Ffe, zfe, $fe, Hfe, jfe, Bfe, Kfe, Gfe, Wfe, Vfe, qfe, Zfe, Yfe, Jfe, Xfe, Qfe, eme, tme, nme, rme, ome, sme, ime, ame, lme, cme, ume, dme, pme, fme, mme, gme, hme, _me, yme, Sme, Eme, bme, Cme, vme, Ame, Rme, xme, Tme, wme, Ome, kme, Pme, Ime, Dme, Lme, Mme, Nme, Ume, Fme, zme, $me, Hme, jme, Bme, Kme, Gme, Wme, Vme, qme, Zme, Yme, Jme, NS, Xme, Qme, ege, tge, nge, rge, oge, sge, ige, age, lge, cge, uge, dge, pge, fge, mge, gge, hge, _ge, yge, Sge, Ege, bge, Cge, vge, Age, Rge, xge, Tge, wge, Oge, kge, Pge, Ige, Dge, Lge, Mge, Nge, Uge, Fge, zge, $ge, Hge, US, jge, Bge, Kge, Gge, Wge, Vge, qge, Zge, Yge, Jge, Xge, Qge, ehe, the, nhe, rhe, ohe, she, ihe, ahe, lhe, che, uhe, dhe, phe, fhe, mhe, ghe, hhe, _he, yhe, She, Ehe, bhe, Che, vhe, Ahe, Rhe, xhe, The, whe, Ohe, khe, Phe, Ihe, Dhe, Lhe, Mhe, Nhe, FS, rI, oI, Uhe, Fhe, zhe, $he, Hhe, jhe, Bhe, Khe, Ghe, Whe, Vhe, qhe, Zhe, Yhe, Jhe, Xhe, Qhe, e_e, t_e, n_e, r_e, o_e, s_e, i_e, a_e, l_e, c_e, u_e, d_e, p_e, f_e, m_e, g_e, h_e, __e, y_e, S_e, E_e, b_e, C_e, v_e, A_e, R_e, x_e, T_e, w_e, O_e, k_e, P_e, I_e, D_e, L_e, M_e, N_e, U_e, F_e, z_e, $_e, H_e, j_e, B_e, K_e, G_e, W_e, V_e, q_e, Z_e, Y_e, J_e, Q_e, Xn, eye, F8e, tye, z8e, nye, iI, rye, oye, lI, cye, uye, dye, _ye, on, vye, Aye, dI, C7e, v7e, ho, kI, PI, Dye, Sf, Lye, jc, Mye, Nye, LI, NI, Fye, VS, zye, $ye, x7e, zI, YS, KI, GI, VI, Hye, qS, ls, Kye, Gye, oD, nE, sD, So, Yc, vn, Zye, oE, sE, iD, aD, wf, Jc, Xc, kf, Qc, Pf, eu, fi, tu, mi, lD, cD, uD, dD, pD, fD, mD, gD, hD, _D, yD, SD, ED, bD, vD, AD, cE, RD, Xye, TD, wD, OD, kD, PD, uE, ID, DD, LD, MD, FD, If, nu, zD, $D, HD, jD, BD, zt, dE, Df, pE, fE, KD, GD, WD, VD, qD, ru, ZD, YD, JD, XD, QD, eL, tL, mE, yr, He, rL, ou, Je, yE, SE, EE, fL, mL, tSe, bE, CE, vE, AE, RE, xE, TE, wE, gL, hL, _L, yL, OE, sSe, kE, PE, IE, DE, LE, ME, NE, Nf, UE, FE, zE, $E, HE, jE, BE, cSe, gE, KE, vL, Uf, GE, WE, VE, qE, ZE, YE, Ff, JE, XE, QE, eb, tb, nb, zf, AL, rb, ob, sb, TL, ab, RL, xL, $f, Hf, dSe, fSe, OL, kL, Sr, FL, ML, zL, lu, hSe, iC, aC, lC, HL, jL, cC, uC, BL, dC, KL, pC, GL, fC, mC, WL, VL, qL, ZL, gC, YL, hC, JL, XL, _C, yC, SC, EC, QL, sC, bC, CC, vC, AC, RC, xC, TC, wC, OC, tM, qf, kC, $L, rM, ASe, Fn, oM, sM, iM, aM, lM, cM, uM, dM, pM, fM, mM, gM, Be, SM, LC, ct, MC, EM, bM, CM, pEe, fEe, Yf, mEe, gEe, hEe, _Ee, yEe, SEe, EEe, bEe, CEe, vEe, AEe, REe, xEe, TEe, wEe, OEe, NC, kEe, vM, PEe, IEe, DEe, LEe, MEe, fu, AM, NEe, UEe, IC, DC, FEe, zEe, qa, TM, HEe, jEe, KEe, wM, em, mu, qEe, ZEe, JEe, OM, Qn, kM, LM, nbe, rbe, abe, lbe, cbe, rm, pbe, At, hbe, BC, BM, Zet, WM, VM, qM, ZM, Cbe, vbe, YM, Abe, Rbe, JM, xbe, Tbe, QM, Ibe, eN, Lbe, nN, Mbe, Nbe, sm, rN, iN, Fbe, aN, $be, jbe, Kbe, Gbe, yu, lN, uN, dN, Xbe, KM, Qbe, eCe, tCe, oCe, iCe, _N, yN, wN, Ytt, ON, OCe, DCe, LN, $Ce, HCe, Cu, BCe, MN, VCe, QCe, ive, uve, VN, pve, fve, _rt, gve, Sve, nv, tv, GN, tU, Fve, Hve, iU, tAe, sAe, iAe, aAe, cAe, Ie, bU, Q, vo, F, zn, fAe, ms, mAe, _m, nn, he, Xa, an, lv, cv, Si, wu, se, br, CU, Oe, gAe, hAe, _Ae, yAe, SAe, EAe, bAe, CAe, vAe, uv, AAe, RAe, xAe, TAe, wAe, OAe, vU, kAe, Ro, el, tl, ym, ku, Sm, Pu, Iu, Em, Ei, xo, bm, Fr, ft, Du, Ao, pv, Lu, To, Cm, vm, nl, Ou, Mu, Nu, bi, Uu, rl, $r, zr, gs, Fu, zu, Am, fv, Rm, $u, wot, H, Oot, kot, Pot, Iot, Dot, Lot, Mot, Not, Uot, Fot, zot, $ot, Hot, jot, xU, Bot, Kot, Got, Wot, Vot, qot, Zot, Yot, Jot, Xot, Qot, est, tst, nst, rst, ost, sst, ist, ast, FAe, zAe, gv, OU, Ss, km, Mt, kU, PU, kst, HAe, jAe, hv, $n, Hu, IU, Yt, tr, nr, Jt, Pm, DU, _v, LU, MU, yv, ju, le, Sv, NU, Pst, Ist, Im, BAe, Dm, KAe, Bu, ol, UU, GAe, WAe, VAe, qAe, ZAe, YAe, Ev, JAe, XAe, bv, Lm, QAe, eRe, Mm, tRe, Ku, Gu, nRe, Wu, sl, rRe, Vu, Nm, Um, Fm, Dst, zm, $m, Hm, FU, zU, $U, Cv, HU, qu, il, jU, oRe, jm, sRe, Bm, iRe, vv, aRe, Km, lRe, cRe, uRe, dRe, pRe, fRe, mRe, gRe, hRe, _Re, Gm, yRe, SRe, Wm, Av, Rv, xv, ERe, bRe, CRe, Tv, vRe, ARe, RRe, xRe, TRe, BU, Vm, wRe, qm, Lst, ORe, al, kRe, Mst, Zu, PRe, wv, IRe, DRe, LRe, MRe, NRe, URe, FRe, Om, zRe, $Re, HRe, Yu, Ov, jRe, BRe, KRe, GRe, WRe, VRe, qRe, ZRe, YRe, JRe, XRe, QRe, exe, txe, nxe, rxe, oxe, sxe, ll, ixe, axe, lxe, Zm, cxe, uxe, dxe, kv, pxe, Nst, Ust, Fst, zst, $st, Hst, ae, WU, qU, VU, ZU, YU, Ym, e0, fxe, mxe, Dv, Cr, gxe, Ju, d0, h0, _0, v0, A0, Sxe, Exe, Mv, Cxe, Fv, Oj, kj, PA, IA, DA, Lj, Dj, aLe, NA, FA, uLe, dd, fLe, Po, SLe, ELe, zA, bLe, xLe, TLe, wLe, OLe, kLe, $j, qj, ILe, DLe, LLe, MLe, Ce, NLe, Wg, Oi, VA, Do, Jj, Xj, Qj, eB, tB, nB, qA, ZA, jA, Bj, jLe, BLe, GLe, rB, BA, Gg, GA, WA, VLe, qLe, Kj, Hs, sB, QLe, YA, iB, uB, eMe, dB, pB, fB, mB, tMe, XA, aB, QA, gB, hB, _B, yB, jn, lMe, SB, dMe, bB, mMe, fd, RB, hMe, Rr, TB, SMe, EMe, Pl, wB, Vg, AMe, Il, RMe, xMe, qg, OB, wMe, OMe, kB, eo, Dl, Zg, DB, NMe, FB, WMe, VMe, $B, HB, jB, BB, Ml, GB, nR, WB, Jg, KB, eNe, Bs, VB, gd, Nl, Xg, tNe, YB, qB, Pi, rK, iK, pNe, hd, _d, to, yd, nh, uK, aK, _Ne, lK, cK, Sd, Ul, rh, oh, dK, CNe, pK, sh, fK, RNe, xNe, TNe, mK, wNe, ONe, ih, Ed, lr, gK, hK, yK, SK, EK, ah, bK, FNe, CK, zNe, $Ne, HNe, vK, BNe, lh, AK, RK, xK, VNe, dn, TK, wK, OK, kK, PK, QNe, eUe, IK, DK, rUe, LK, MK, NK, UK, iUe, aUe, lUe, cUe, uUe, dUe, pUe, fUe, mUe, gUe, hUe, _Ue, yUe, SUe, EUe, bUe, CUe, vUe, AUe, FK, xUe, zK, $K, wUe, HK, OUe, jK, BK, PUe, KK, IUe, DUe, LUe, GK, MUe, NUe, UUe, FUe, WK, zUe, $Ue, HUe, VK, jUe, BUe, KUe, GUe, WUe, VUe, qUe, ZUe, YUe, JUe, XUe, QUe, e0e, t0e, n0e, r0e, Xe, qK, ZK, YK, JK, a0e, l0e, uh, XK, QK, e1, n1, r1, dh, m0e, g0e, h0e, _0e, bd, o1, S0e, Fl, s1, b0e, i1, Di, a1, l1, c1, u1, d1, p1, f1, P0e, I0e, m1, D0e, g1, h1, _1, vyt, U0e, y1, Ayt, iR, F0e, z0e, $0e, Gs, zl, fh, E1, b1, H0e, j0e, B0e, K0e, mh, $l, gh, Ws, aR, hh, _h, G0e, W0e, lR, R1, x1, V0e, uR, k1, P1, I1, D1, L1, Y0e, dR, J0e, Fyt, pR, X0e, fR, mR, Q0e, zyt, eFe, gR, hR, _R, $yt, M1, yR, N1, U1, tFe, nFe, rFe, oFe, iFe, Mi, cFe, $1, Wyt, Vyt, H1, j1, B1, K1, uFe, G1, W1, V1, q1, dFe, pFe, SR, fFe, eSt, tSt, mFe, jl, Vs, gFe, Y1, hFe, _Fe, X1, Q1, eG, yFe, SFe, tG, EFe, bFe, CFe, vFe, bR, CR, RFe, xFe, vR, TFe, Eh, nSt, Cd, wFe, OFe, aSt, rG, PFe, IFe, _St, oG, sG, bSt, CSt, HFe, jFe, $St, BFe, KFe, HSt, JSt, XSt, lG, OR, VFe, YFe, uG, eze, nze, gG, vd, vh, kR, zi, sze, yG, ize, yEt, Ad, $i, bG, Kn, AEt, REt, xEt, aze, AG, wG, $R, dze, $G, pze, fze, mze, gze, hze, BR, HG, jG, fbt, yze, Sze, Eze, Gn, ji, kG, PG, NR, UR, KR, GG, Cze, vze, Rze, GR, xze, Tze, xh, WR, Oze, kze, mbt, Pze, Ize, Dze, Lze, Mze, Nze, qG, Uze, Fze, zze, $ze, ZG, Hze, IG, jze, Bze, YG, Kze, Gze, DG, Wze, Vze, JG, qze, Zze, Yze, Jze, QG, Xze, Qze, e$e, t$e, r$e, o$e, s$e, i$e, a$e, eW, nW, c$e, m$e, xd, VR, gbt, hbt, _bt, h$e, qR, Th, MR, aW, _$e, S$e, lW, E$e, b$e, C$e, v$e, A$e, x$e, w$e, O$e, k$e, P$e, I$e, N$e, ybt, FR, Sbt, U$e, MG, Td, Ebt, bbt, uW, z$e, $$e, H$e, Cbt, j$e, B$e, vbt, Abt, K$e, Rbt, Oh, kh, G$e, YR, Ph, W$e, Ih, Mbt, Nbt, Ubt, Dh, V$e, Z$e, tx, EW, Id, Fh, X$e, xCt, Q$e, eHe, ix, ax, lx, cx, zh, $h, MW, tHe, nHe, aHe, uHe, dHe, Zs, pHe, CW, vW, AW, Nh, UW, fHe, mHe, gHe, hHe, _He, yHe, SHe, EHe, pn, dx, nx, Mh, Bi, AHe, TCt, xHe, Pd, RW, THe, xW, wHe, OHe, Hh, kHe, TW, fx, Bh, Ki, KW, Gl, PHe, Kh, kW, Wl, NHe, Ld, UHe, tV, rV, jHe, XHe, cvt, tje, fV, mV, sje, aje, _V, yV, pje, zvt, $vt, gje, yje, Sje, Kvt, Gvt, eAt, RV, Eje, bje, mAt, Cje, gAt, xV, wV, OV, Js, Lje, FV, Yh, Jh, Md, Tx, zV, $V, HV, Xh, jV, cr, KV, Mo, Fje, zje, yRt, jje, Gje, Vje, sBe, YV, e22, o_, gBe, t2, s_, kx, o2, LBe, UBe, $x, Vi, R2, KBe, GBe, Dx, ZBe, k2, n_, l2, sKe, lKe, z2, bKe, RKe, ec, W2, H2, xKe, wKe, PKe, IKe, $Ke, X2, HKe, jKe, BKe, KKe, VKe, eTt, qKe, tTt, nTt, ZKe, rTt, YKe, oTt, JKe, Wx, XKe, iTt, eq, tq, QKe, nq, rq, e1e, t1e, oq, sq, n1e, r1e, aTt, lTt, c1e, Zx, cq, u1e, uq, a_, d1e, Xx, nc, S1e, c_, mq, gq, Qx, hq, _q, E1e, Sq, u_, rc, d_, b1e, bq, Uo, Cq, vq, A1e, Yd, Jd, R1e, x1e, Aq, gn, T1e, w1e, O1e, Xs, k1e, P1e, xq, Pwt, I1e, Oq, kq, Pq, D1e, L1e, Iq, M1e, N1e, nT, U1e, p_, rT, Dq, oT, iT, F1e, Uq, aT, jq, K1e, Gq, yOt, sGe, cGe, uGe, yGe;
 var init_sdk = __esm({
   "node_modules/.pnpm/@anthropic-ai+claude-agent-sdk@0.3.292_@anthropic-ai+sdk@0.131.0_zod@4.6.5__@modelconte_9caa915130557974815a7ac66b010e49/node_modules/@anthropic-ai/claude-agent-sdk/sdk.mjs"() {
     import_node_module = require("node:module");
     import_crypto = require("crypto");
     import_crypto2 = require("crypto");
     import_path = require("path");
-    import_node_fs16 = require("node:fs");
+    import_node_fs17 = require("node:fs");
     import_node_process4 = require("node:process");
     import_fs = require("fs");
     import_os = require("os");
@@ -109047,12 +109196,12 @@ var require_dist2 = __commonJS({
         throw new Error(`Unknown format "${name}"`);
       return f;
     };
-    function addFormats(ajv, list, fs28, exportName) {
+    function addFormats(ajv, list, fs29, exportName) {
       var _a4;
       var _b2;
       (_a4 = (_b2 = ajv.opts.code).formats) !== null && _a4 !== void 0 ? _a4 : _b2.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f of list)
-        ajv.addFormat(f, fs28[f]);
+        ajv.addFormat(f, fs29[f]);
     }
     module2.exports = exports2 = formatsPlugin;
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -116647,7 +116796,7 @@ function registerCodexCommand(program2, deps) {
 // src/frontdoor/commands.ts
 var import_node_crypto25 = require("node:crypto");
 var import_node_path54 = __toESM(require("node:path"), 1);
-var import_node_fs20 = __toESM(require("node:fs"), 1);
+var import_node_fs21 = __toESM(require("node:fs"), 1);
 init_commandDeps();
 init_configProfilesStore();
 init_schema();
@@ -116789,17 +116938,17 @@ function parseEntry2(project, entry) {
   const base = match?.[1];
   return base === void 0 ? { project, sessionId: entry, superseded: false, entry } : { project, sessionId: base, superseded: true, entry };
 }
-function listSessions2(fs28, configDir) {
+function listSessions2(fs29, configDir) {
   const found = [];
-  for (const project of fs28.readdir(import_node_path35.default.join(configDir, PROJECTS_DIR))) {
+  for (const project of fs29.readdir(import_node_path35.default.join(configDir, PROJECTS_DIR))) {
     const projectDir = import_node_path35.default.join(configDir, PROJECTS_DIR, project);
     const entries = /* @__PURE__ */ new Set();
-    for (const name of fs28.readdir(projectDir)) {
+    for (const name of fs29.readdir(projectDir)) {
       if (name.endsWith(TRANSCRIPT_SUFFIX)) {
         entries.add(name.slice(0, -TRANSCRIPT_SUFFIX.length));
         continue;
       }
-      const children = fs28.readdir(import_node_path35.default.join(projectDir, name));
+      const children = fs29.readdir(import_node_path35.default.join(projectDir, name));
       if (children.includes(SUBAGENTS_DIR) || children.includes(WORKFLOWS_DIR)) {
         entries.add(name);
       }
@@ -116810,9 +116959,9 @@ function listSessions2(fs28, configDir) {
   }
   return found.sort((left, right) => left.project.localeCompare(right.project) || left.entry.localeCompare(right.entry));
 }
-function locateAgents(fs28, configDir, relativeDir, workflowRunId, report) {
+function locateAgents(fs29, configDir, relativeDir, workflowRunId, report) {
   const located = [];
-  for (const name of listDirOrReport(fs28, configDir, relativeDir, report)) {
+  for (const name of listDirOrReport(fs29, configDir, relativeDir, report)) {
     if (!name.startsWith(AGENT_FILE_PREFIX) || !name.endsWith(META_SUFFIX)) {
       continue;
     }
@@ -116861,17 +117010,17 @@ function toNode(read, children) {
 function describeFailure(error63) {
   return error63 instanceof Error ? error63.message : String(error63);
 }
-function readFileOrReport(fs28, configDir, relative, report) {
+function readFileOrReport(fs29, configDir, relative, report) {
   try {
-    return fs28.readFileUtf8(import_node_path35.default.join(configDir, relative));
+    return fs29.readFileUtf8(import_node_path35.default.join(configDir, relative));
   } catch (error63) {
     report({ path: relative, reason: `could not be read: ${describeFailure(error63)}` });
     return void 0;
   }
 }
-function listDirOrReport(fs28, configDir, relative, report) {
+function listDirOrReport(fs29, configDir, relative, report) {
   try {
-    return fs28.readdir(import_node_path35.default.join(configDir, relative));
+    return fs29.readdir(import_node_path35.default.join(configDir, relative));
   } catch (error63) {
     report({ path: relative, reason: `could not be listed: ${describeFailure(error63)}` });
     return [];
@@ -116894,22 +117043,22 @@ var WorkflowRunFileSchema = external_exports.object({
   phases: external_exports.array(external_exports.object({ title: external_exports.string() })).default([]),
   summary: external_exports.string().optional()
 });
-function summariseSession(fs28, configDir, ref) {
+function summariseSession(fs29, configDir, ref) {
   const sessionRelative = import_node_path35.default.join(PROJECTS_DIR, ref.project, ref.entry);
   const subagentsRelative = import_node_path35.default.join(sessionRelative, SUBAGENTS_DIR);
   const workflowsUnderSubagents = import_node_path35.default.join(subagentsRelative, WORKFLOWS_DIR);
   const isMeta = (name) => name.startsWith(AGENT_FILE_PREFIX) && name.endsWith(META_SUFFIX);
-  let agentCount = fs28.readdir(import_node_path35.default.join(configDir, subagentsRelative)).filter(isMeta).length;
-  for (const runDir of fs28.readdir(import_node_path35.default.join(configDir, workflowsUnderSubagents))) {
+  let agentCount = fs29.readdir(import_node_path35.default.join(configDir, subagentsRelative)).filter(isMeta).length;
+  for (const runDir of fs29.readdir(import_node_path35.default.join(configDir, workflowsUnderSubagents))) {
     if (runDir.startsWith(WORKFLOW_RUN_PREFIX)) {
-      agentCount += fs28.readdir(import_node_path35.default.join(configDir, workflowsUnderSubagents, runDir)).filter(isMeta).length;
+      agentCount += fs29.readdir(import_node_path35.default.join(configDir, workflowsUnderSubagents, runDir)).filter(isMeta).length;
     }
   }
-  const workflowRunCount = fs28.readdir(import_node_path35.default.join(configDir, sessionRelative, WORKFLOWS_DIR)).filter((name) => name.startsWith(WORKFLOW_RUN_PREFIX) && name.endsWith(JSON_SUFFIX)).length;
-  const transcript = fs28.lstat(import_node_path35.default.join(configDir, PROJECTS_DIR, ref.project, `${ref.entry}${TRANSCRIPT_SUFFIX}`));
+  const workflowRunCount = fs29.readdir(import_node_path35.default.join(configDir, sessionRelative, WORKFLOWS_DIR)).filter((name) => name.startsWith(WORKFLOW_RUN_PREFIX) && name.endsWith(JSON_SUFFIX)).length;
+  const transcript = fs29.lstat(import_node_path35.default.join(configDir, PROJECTS_DIR, ref.project, `${ref.entry}${TRANSCRIPT_SUFFIX}`));
   return { ...ref, agentCount, workflowRunCount, ...transcript === void 0 ? {} : { updatedAt: new Date(transcript.mtimeMs).toISOString() } };
 }
-function readSessionAgentTree(fs28, configDir, ref, options = {}) {
+function readSessionAgentTree(fs29, configDir, ref, options = {}) {
   const problems = [];
   const report = (problem) => {
     problems.push(problem);
@@ -116917,15 +117066,15 @@ function readSessionAgentTree(fs28, configDir, ref, options = {}) {
   const sessionRelative = import_node_path35.default.join(PROJECTS_DIR, ref.project, ref.entry);
   const subagentsRelative = import_node_path35.default.join(sessionRelative, SUBAGENTS_DIR);
   const workflowsUnderSubagents = import_node_path35.default.join(subagentsRelative, WORKFLOWS_DIR);
-  const located = locateAgents(fs28, configDir, subagentsRelative, void 0, report);
-  for (const runDir of listDirOrReport(fs28, configDir, workflowsUnderSubagents, report)) {
+  const located = locateAgents(fs29, configDir, subagentsRelative, void 0, report);
+  for (const runDir of listDirOrReport(fs29, configDir, workflowsUnderSubagents, report)) {
     if (runDir.startsWith(WORKFLOW_RUN_PREFIX)) {
-      located.push(...locateAgents(fs28, configDir, import_node_path35.default.join(workflowsUnderSubagents, runDir), runDir, report));
+      located.push(...locateAgents(fs29, configDir, import_node_path35.default.join(workflowsUnderSubagents, runDir), runDir, report));
     }
   }
   const agents = /* @__PURE__ */ new Map();
   for (const candidate of located) {
-    const text2 = readFileOrReport(fs28, configDir, candidate.metaPath, report);
+    const text2 = readFileOrReport(fs29, configDir, candidate.metaPath, report);
     if (text2 === void 0) {
       continue;
     }
@@ -116937,7 +117086,7 @@ function readSessionAgentTree(fs28, configDir, ref, options = {}) {
     agents.set(candidate.id, { located: candidate, meta: parsed.data });
   }
   const teamNames = [...new Set([...agents.values()].flatMap((agent) => agent.meta.teamName === void 0 ? [] : [agent.meta.teamName]))].sort();
-  const parentOf4 = resolveParents(fs28, configDir, agents, report);
+  const parentOf4 = resolveParents(fs29, configDir, agents, report);
   const childrenOf = /* @__PURE__ */ new Map();
   const roots = [];
   for (const id2 of agents.keys()) {
@@ -116960,12 +117109,12 @@ function readSessionAgentTree(fs28, configDir, ref, options = {}) {
     sessionId: ref.sessionId,
     superseded: ref.superseded,
     agents: roots.sort().map(build),
-    tasks: readTasks(fs28, configDir, ownTaskLists(ref.sessionId), [.../* @__PURE__ */ new Set([...teamNames, ...options.taskListIds ?? []])].filter((id2) => !ownTaskLists(ref.sessionId).includes(id2)), report),
-    workflowRuns: readWorkflowRuns(fs28, configDir, import_node_path35.default.join(sessionRelative, WORKFLOWS_DIR), report),
+    tasks: readTasks(fs29, configDir, ownTaskLists(ref.sessionId), [.../* @__PURE__ */ new Set([...teamNames, ...options.taskListIds ?? []])].filter((id2) => !ownTaskLists(ref.sessionId).includes(id2)), report),
+    workflowRuns: readWorkflowRuns(fs29, configDir, import_node_path35.default.join(sessionRelative, WORKFLOWS_DIR), report),
     problems
   };
 }
-function resolveParents(fs28, configDir, agents, report) {
+function resolveParents(fs29, configDir, agents, report) {
   const parentOf4 = /* @__PURE__ */ new Map();
   const transcriptCache = /* @__PURE__ */ new Map();
   const transcriptOf = (agent) => {
@@ -116973,7 +117122,7 @@ function resolveParents(fs28, configDir, agents, report) {
     if (cached2 !== void 0) {
       return cached2;
     }
-    const text2 = readFileOrReport(fs28, configDir, agent.located.transcriptPath, report) ?? "";
+    const text2 = readFileOrReport(fs29, configDir, agent.located.transcriptPath, report) ?? "";
     transcriptCache.set(agent.located.id, text2);
     return text2;
   };
@@ -117023,16 +117172,16 @@ function resolveParents(fs28, configDir, agents, report) {
 function ownTaskLists(sessionId) {
   return [sessionId, `${SHORT_SESSION_LIST_PREFIX}${sessionId.slice(0, SHORT_SESSION_ID_LENGTH)}`];
 }
-function readTasks(fs28, configDir, ownLists, sharedLists, report) {
+function readTasks(fs29, configDir, ownLists, sharedLists, report) {
   const tasks = [];
   [...ownLists, ...sharedLists].forEach((scope, index) => {
     const relativeDir = import_node_path35.default.join(TASKS_DIR, scope);
-    for (const name of [...listDirOrReport(fs28, configDir, relativeDir, report)].sort()) {
+    for (const name of [...listDirOrReport(fs29, configDir, relativeDir, report)].sort()) {
       if (name.startsWith(".") || !name.endsWith(JSON_SUFFIX)) {
         continue;
       }
       const relative = import_node_path35.default.join(relativeDir, name);
-      const text2 = readFileOrReport(fs28, configDir, relative, report);
+      const text2 = readFileOrReport(fs29, configDir, relative, report);
       const parsed = TaskFileSchema.safeParse(text2 === void 0 ? void 0 : parseJson3(text2));
       if (parsed.success) {
         tasks.push(index < ownLists.length ? parsed.data : { ...parsed.data, taskList: scope });
@@ -117043,14 +117192,14 @@ function readTasks(fs28, configDir, ownLists, sharedLists, report) {
   });
   return tasks;
 }
-function readWorkflowRuns(fs28, configDir, relativeDir, report) {
+function readWorkflowRuns(fs29, configDir, relativeDir, report) {
   const runs = [];
-  for (const name of [...listDirOrReport(fs28, configDir, relativeDir, report)].sort()) {
+  for (const name of [...listDirOrReport(fs29, configDir, relativeDir, report)].sort()) {
     if (!name.startsWith(WORKFLOW_RUN_PREFIX) || !name.endsWith(JSON_SUFFIX)) {
       continue;
     }
     const relative = import_node_path35.default.join(relativeDir, name);
-    const text2 = readFileOrReport(fs28, configDir, relative, report);
+    const text2 = readFileOrReport(fs29, configDir, relative, report);
     const parsed = WorkflowRunFileSchema.safeParse(text2 === void 0 ? void 0 : parseJson3(text2));
     if (!parsed.success) {
       if (text2 !== void 0) {
@@ -117074,11 +117223,11 @@ var SessionLookupError = class extends CliError {
 function identityConfigDir(identitiesDir, identity) {
   return import_node_path36.default.join(identitiesDir, identity);
 }
-function historyStores(fs28, identitiesDir, identities) {
+function historyStores(fs29, identitiesDir, identities) {
   const byRealPath = /* @__PURE__ */ new Map();
   for (const identity of identities) {
     const configDir = identityConfigDir(identitiesDir, identity);
-    const real = fs28.realpath(import_node_path36.default.join(configDir, "projects"));
+    const real = fs29.realpath(import_node_path36.default.join(configDir, "projects"));
     if (real === void 0) {
       continue;
     }
@@ -117091,15 +117240,15 @@ function historyStores(fs28, identitiesDir, identities) {
   }
   return [...byRealPath.values()];
 }
-function collectSessionList(fs28, identitiesDir, identities, filters) {
+function collectSessionList(fs29, identitiesDir, identities, filters) {
   const names = filters.identity === void 0 ? identities : identities.filter((name) => name === filters.identity);
   if (filters.identity !== void 0 && names.length === 0) {
     throw new SessionLookupError(`no identity named "${filters.identity}"`);
   }
   const sessions = [];
-  for (const store of historyStores(fs28, identitiesDir, names)) {
-    for (const ref of listSessions2(fs28, store.configDir)) {
-      const summary = summariseSession(fs28, store.configDir, ref);
+  for (const store of historyStores(fs29, identitiesDir, names)) {
+    for (const ref of listSessions2(fs29, store.configDir)) {
+      const summary = summariseSession(fs29, store.configDir, ref);
       if (filters.all === true || summary.agentCount > 0 || summary.workflowRunCount > 0) {
         sessions.push({ ...summary, identities: store.identities });
       }
@@ -117107,14 +117256,14 @@ function collectSessionList(fs28, identitiesDir, identities, filters) {
   }
   return sessions.sort((left, right) => (right.updatedAt ?? "").localeCompare(left.updatedAt ?? "") || left.sessionId.localeCompare(right.sessionId));
 }
-function locateSession(fs28, identitiesDir, identities, query, onlyIdentity) {
+function locateSession(fs29, identitiesDir, identities, query, onlyIdentity) {
   const names = onlyIdentity === void 0 ? identities : identities.filter((name) => name === onlyIdentity);
   if (onlyIdentity !== void 0 && names.length === 0) {
     throw new SessionLookupError(`no identity named "${onlyIdentity}"`);
   }
   const matches = [];
-  for (const store of historyStores(fs28, identitiesDir, names)) {
-    for (const ref of listSessions2(fs28, store.configDir)) {
+  for (const store of historyStores(fs29, identitiesDir, names)) {
+    for (const ref of listSessions2(fs29, store.configDir)) {
       if (ref.sessionId.startsWith(query)) {
         matches.push({ identities: store.identities, configDir: store.configDir, ref });
       }
@@ -117131,9 +117280,9 @@ function locateSession(fs28, identitiesDir, identities, query, onlyIdentity) {
   }
   throw new SessionLookupError(`"${query}" matches ${String(candidates.length)} sessions: ${candidates.map((match) => `${match.ref.sessionId} (${match.identities.join(", ")})`).join("; ")}; give more of the id or pass --identity`);
 }
-function showSession(fs28, identitiesDir, identities, query, onlyIdentity) {
-  const located = locateSession(fs28, identitiesDir, identities, query, onlyIdentity);
-  return { identities: located.identities, tree: readSessionAgentTree(fs28, located.configDir, located.ref) };
+function showSession(fs29, identitiesDir, identities, query, onlyIdentity) {
+  const located = locateSession(fs29, identitiesDir, identities, query, onlyIdentity);
+  return { identities: located.identities, tree: readSessionAgentTree(fs29, located.configDir, located.ref) };
 }
 
 // src/frontdoor/commands.ts
@@ -117179,13 +117328,13 @@ function stateDirOf(paths, pool) {
 function sessionStatePath(paths, pool, sessionId) {
   return import_node_path37.default.join(stateDirOf(paths, pool), `${sessionId}.json`);
 }
-function writeSessionState(fs28, paths, pool, sessionId, state) {
-  fs28.mkdirPrivate(stateDirOf(paths, pool));
-  fs28.writeFilePrivate(sessionStatePath(paths, pool, sessionId), `${JSON.stringify(SessionStateSchema.parse(state))}
+function writeSessionState(fs29, paths, pool, sessionId, state) {
+  fs29.mkdirPrivate(stateDirOf(paths, pool));
+  fs29.writeFilePrivate(sessionStatePath(paths, pool, sessionId), `${JSON.stringify(SessionStateSchema.parse(state))}
 `);
 }
-function readSessionState(fs28, paths, pool, sessionId) {
-  const raw = fs28.readFileUtf8(sessionStatePath(paths, pool, sessionId));
+function readSessionState(fs29, paths, pool, sessionId) {
+  const raw = fs29.readFileUtf8(sessionStatePath(paths, pool, sessionId));
   if (raw === void 0) {
     return void 0;
   }
@@ -117196,20 +117345,20 @@ function readSessionState(fs28, paths, pool, sessionId) {
     return void 0;
   }
 }
-function registerSupervised(fs28, paths, session) {
-  fs28.mkdirPrivate(sessionsDirOf(paths, session.pool));
-  fs28.writeFilePrivate(sessionFileOf(paths, session.pool, session.sessionId), `${JSON.stringify(SupervisedSessionSchema.parse(session))}
+function registerSupervised(fs29, paths, session) {
+  fs29.mkdirPrivate(sessionsDirOf(paths, session.pool));
+  fs29.writeFilePrivate(sessionFileOf(paths, session.pool, session.sessionId), `${JSON.stringify(SupervisedSessionSchema.parse(session))}
 `);
 }
-function unregisterSupervised(fs28, paths, pool, sessionId) {
-  fs28.removeRecursive(sessionFileOf(paths, pool, sessionId));
-  fs28.removeRecursive(sessionStatePath(paths, pool, sessionId));
+function unregisterSupervised(fs29, paths, pool, sessionId) {
+  fs29.removeRecursive(sessionFileOf(paths, pool, sessionId));
+  fs29.removeRecursive(sessionStatePath(paths, pool, sessionId));
 }
-function liveSupervised(fs28, paths, pool, isRunning) {
+function liveSupervised(fs29, paths, pool, isRunning) {
   const live = [];
-  for (const name of fs28.readdir(sessionsDirOf(paths, pool))) {
+  for (const name of fs29.readdir(sessionsDirOf(paths, pool))) {
     const file2 = import_node_path37.default.join(sessionsDirOf(paths, pool), name);
-    const raw = fs28.readFileUtf8(file2);
+    const raw = fs29.readFileUtf8(file2);
     if (raw === void 0) {
       continue;
     }
@@ -117217,13 +117366,13 @@ function liveSupervised(fs28, paths, pool, isRunning) {
     try {
       parsed = SupervisedSessionSchema.safeParse(JSON.parse(raw));
     } catch {
-      fs28.removeRecursive(file2);
+      fs29.removeRecursive(file2);
       continue;
     }
     if (parsed.success && isRunning(parsed.data.pid)) {
       live.push(parsed.data);
     } else {
-      fs28.removeRecursive(file2);
+      fs29.removeRecursive(file2);
     }
   }
   return live;
@@ -117252,13 +117401,13 @@ var ModelMoveRequestSchema = external_exports.strictObject({
   /** When the door wrote the request, so a supervisor can tell a fresh request from one left behind. */
   at: external_exports.iso.datetime()
 });
-function writeModelMove(fs28, paths, request7) {
-  fs28.mkdirPrivate(paths.modelMovesDir);
-  fs28.writeFilePrivate(import_node_path37.default.join(paths.modelMovesDir, `${request7.sessionId}.json`), `${JSON.stringify(ModelMoveRequestSchema.parse(request7))}
+function writeModelMove(fs29, paths, request7) {
+  fs29.mkdirPrivate(paths.modelMovesDir);
+  fs29.writeFilePrivate(import_node_path37.default.join(paths.modelMovesDir, `${request7.sessionId}.json`), `${JSON.stringify(ModelMoveRequestSchema.parse(request7))}
 `);
 }
-function readModelMove(fs28, paths, sessionId) {
-  const raw = fs28.readFileUtf8(import_node_path37.default.join(paths.modelMovesDir, `${sessionId}.json`));
+function readModelMove(fs29, paths, sessionId) {
+  const raw = fs29.readFileUtf8(import_node_path37.default.join(paths.modelMovesDir, `${sessionId}.json`));
   if (raw === void 0) {
     return void 0;
   }
@@ -117268,12 +117417,12 @@ function readModelMove(fs28, paths, sessionId) {
     return void 0;
   }
 }
-function removeModelMove(fs28, paths, sessionId) {
-  fs28.removeRecursive(import_node_path37.default.join(paths.modelMovesDir, `${sessionId}.json`));
+function removeModelMove(fs29, paths, sessionId) {
+  fs29.removeRecursive(import_node_path37.default.join(paths.modelMovesDir, `${sessionId}.json`));
 }
-function supervisedSessionOf(fs28, paths, sessionId, isRunning) {
-  for (const pool of fs28.readdir(paths.superviseDir)) {
-    const sessions = liveSupervised(fs28, paths, pool, isRunning);
+function supervisedSessionOf(fs29, paths, sessionId, isRunning) {
+  for (const pool of fs29.readdir(paths.superviseDir)) {
+    const sessions = liveSupervised(fs29, paths, pool, isRunning);
     const found = sessions.find((session) => session.sessionId === sessionId);
     if (found !== void 0) {
       return found;
@@ -117331,9 +117480,9 @@ function blendedPricePerMTok(prices, mix) {
 
 // src/selection/targetStore.ts
 var SEED_LOOKBACK_RECORDS = 500;
-function createTargetObservationStore(fs28, paths) {
+function createTargetObservationStore(fs29, paths) {
   let observations = /* @__PURE__ */ new Map();
-  const seeded = readUsageLog(fs28, paths.usageLogDir, {}).records.slice(-SEED_LOOKBACK_RECORDS);
+  const seeded = readUsageLog(fs29, paths.usageLogDir, {}).records.slice(-SEED_LOOKBACK_RECORDS);
   for (const record2 of seeded) {
     observations = observeRecord(observations, record2);
   }
@@ -117349,7 +117498,7 @@ function createTargetObservationStore(fs28, paths) {
 }
 
 // src/update/commands.ts
-var import_node_fs15 = __toESM(require("node:fs"), 1);
+var import_node_fs16 = __toESM(require("node:fs"), 1);
 var import_node_os7 = __toESM(require("node:os"), 1);
 var import_node_path40 = __toESM(require("node:path"), 1);
 init_package();
@@ -117384,10 +117533,10 @@ var realUpdatePorts = {
     }
   },
   fs: {
-    realpath: (target) => import_node_fs15.default.realpathSync(target),
+    realpath: (target) => import_node_fs16.default.realpathSync(target),
     readFileUtf8: (filePath) => {
       try {
-        return import_node_fs15.default.readFileSync(filePath, "utf8");
+        return import_node_fs16.default.readFileSync(filePath, "utf8");
       } catch (error63) {
         if (isEnoent6(error63)) {
           return void 0;
@@ -117397,7 +117546,7 @@ var realUpdatePorts = {
     },
     readFileBytes: (filePath) => {
       try {
-        return new Uint8Array(import_node_fs15.default.readFileSync(filePath));
+        return new Uint8Array(import_node_fs16.default.readFileSync(filePath));
       } catch (error63) {
         if (isEnoent6(error63)) {
           return void 0;
@@ -117408,7 +117557,7 @@ var realUpdatePorts = {
     readFileHead: (filePath, length) => {
       let descriptor;
       try {
-        descriptor = import_node_fs15.default.openSync(filePath, "r");
+        descriptor = import_node_fs16.default.openSync(filePath, "r");
       } catch (error63) {
         if (isEnoent6(error63)) {
           return void 0;
@@ -117417,21 +117566,21 @@ var realUpdatePorts = {
       }
       try {
         const buffer2 = Buffer.alloc(length);
-        const read = import_node_fs15.default.readSync(descriptor, buffer2, 0, length, 0);
+        const read = import_node_fs16.default.readSync(descriptor, buffer2, 0, length, 0);
         return read === 0 ? "" : buffer2.toString("latin1", 0, read);
       } finally {
-        import_node_fs15.default.closeSync(descriptor);
+        import_node_fs16.default.closeSync(descriptor);
       }
     },
     writeFileUtf8: (filePath, contents) => {
-      import_node_fs15.default.writeFileSync(filePath, contents, "utf8");
+      import_node_fs16.default.writeFileSync(filePath, contents, "utf8");
     },
     writeFileBytes: (filePath, contents) => {
-      import_node_fs15.default.writeFileSync(filePath, contents);
+      import_node_fs16.default.writeFileSync(filePath, contents);
     },
     writeFileExclusive: (filePath, contents) => {
       try {
-        import_node_fs15.default.writeFileSync(filePath, contents, { encoding: "utf8", flag: "wx" });
+        import_node_fs16.default.writeFileSync(filePath, contents, { encoding: "utf8", flag: "wx" });
         return true;
       } catch (error63) {
         if (isErrorWithCode2(error63, "EEXIST")) {
@@ -117442,7 +117591,7 @@ var realUpdatePorts = {
     },
     unlink: (filePath) => {
       try {
-        import_node_fs15.default.unlinkSync(filePath);
+        import_node_fs16.default.unlinkSync(filePath);
       } catch (error63) {
         if (!isEnoent6(error63)) {
           throw error63;
@@ -117450,14 +117599,14 @@ var realUpdatePorts = {
       }
     },
     rename: (from, to2) => {
-      import_node_fs15.default.renameSync(from, to2);
+      import_node_fs16.default.renameSync(from, to2);
     },
     chmod: (filePath, mode) => {
-      import_node_fs15.default.chmodSync(filePath, mode);
+      import_node_fs16.default.chmodSync(filePath, mode);
     },
-    mkdtemp: () => import_node_fs15.default.mkdtempSync(import_node_path40.default.join(import_node_os7.default.tmpdir(), "agent-shim-update-")),
+    mkdtemp: () => import_node_fs16.default.mkdtempSync(import_node_path40.default.join(import_node_os7.default.tmpdir(), "agent-shim-update-")),
     rmRecursive: (targetPath) => {
-      import_node_fs15.default.rmSync(targetPath, { recursive: true, force: true });
+      import_node_fs16.default.rmSync(targetPath, { recursive: true, force: true });
     }
   },
   // Signal 0 performs the permission and existence checks without delivering anything; EPERM means the process exists but belongs to another user.
@@ -117530,7 +117679,7 @@ function registerUpdateCommand(program2, deps, ports = realUpdatePorts) {
         return;
       }
       const report = await runSelfUpdate(ports, selfUpdateOptions(deps.paths, options.check === true));
-      const doorRestart = options.restartDoor === true && report.action === "updated" ? realRestartFrontDoor(deps.paths, spawnDetachedSupervisor) : void 0;
+      const doorRestart = options.restartDoor === true && report.action === "updated" ? realRestartFrontDoor(deps.paths, spawnDetachedSupervisor, "update-restart") : void 0;
       if (options.json === true) {
         printJson(doorRestart === void 0 ? report : { ...report, frontdoor: doorRestart });
         return;
@@ -117753,8 +117902,8 @@ var StampsFileSchema = external_exports.strictObject({
   schemaVersion: external_exports.literal(STAMPS_SCHEMA_VERSION),
   handled: external_exports.record(external_exports.string().min(1), external_exports.iso.datetime())
 });
-function readHandled(fs28, file2) {
-  const raw = fs28.readFileUtf8(file2);
+function readHandled(fs29, file2) {
+  const raw = fs29.readFileUtf8(file2);
   if (raw === void 0) {
     return {};
   }
@@ -117767,10 +117916,10 @@ function readHandled(fs28, file2) {
   const result = StampsFileSchema.safeParse(parsed);
   return result.success ? Object.fromEntries(Object.entries(result.data.handled).map(([key, at2]) => [key, Date.parse(at2)])) : {};
 }
-function writeHandled(fs28, file2, handled) {
+function writeHandled(fs29, file2, handled) {
   const next = { schemaVersion: STAMPS_SCHEMA_VERSION, handled: Object.fromEntries(Object.entries(handled).map(([key, at2]) => [key, new Date(at2).toISOString()])) };
-  fs28.mkdirPrivate(import_node_path48.default.dirname(file2));
-  fs28.writeFilePrivate(file2, `${JSON.stringify(next, null, 2)}
+  fs29.mkdirPrivate(import_node_path48.default.dirname(file2));
+  fs29.writeFilePrivate(file2, `${JSON.stringify(next, null, 2)}
 `);
 }
 
@@ -118059,8 +118208,12 @@ function createDoorPipelines(deps) {
   };
 }
 
+// src/frontdoor/commands.ts
+init_doorLog();
+init_replacement();
+
 // src/headroom/routingSetting.ts
-var import_node_fs17 = __toESM(require("node:fs"), 1);
+var import_node_fs18 = __toESM(require("node:fs"), 1);
 init_zod();
 init_store();
 var RoutingChoiceSchema = external_exports.strictObject({
@@ -118098,7 +118251,7 @@ function createRoutingSettingReader(paths) {
   return () => {
     let key;
     try {
-      const stat = import_node_fs17.default.statSync(paths.headroomRoutingFile);
+      const stat = import_node_fs18.default.statSync(paths.headroomRoutingFile);
       key = `${String(stat.mtimeMs)}:${String(stat.size)}`;
     } catch {
       cachedKey = void 0;
@@ -119746,6 +119899,14 @@ async function listenFrontDoor(server, options = {}) {
             });
             server.closeAllConnections();
           });
+        },
+        // The port is released as `server.close` runs, before the first await. From Node 19 `close` also ends the connections that are idle, and a connection that finishes its last response while the server is closing is ended with it, so a request already being served finishes and its client then reconnects to whatever now holds the port.
+        drain: async () => {
+          await new Promise((resolve2) => {
+            server.close(() => {
+              resolve2(void 0);
+            });
+          });
         }
       };
     }
@@ -120053,6 +120214,10 @@ function realConnectEffects(ports = DOOR_SOURCE_PORTS) {
       }
       resolve2({
         port: bound,
+        // The listening socket is released by `close` at once; the connections already accepted are untouched and keep the server's `close` callback pending until they end.
+        stopAccepting: () => {
+          server.close();
+        },
         close: async () => {
           await new Promise((closeResolve) => {
             server.close(() => {
@@ -120237,7 +120402,7 @@ function realConnectEffects(ports = DOOR_SOURCE_PORTS) {
 init_claudeShim();
 init_store();
 init_realPorts();
-var import_node_fs19 = __toESM(require("node:fs"), 1);
+var import_node_fs20 = __toESM(require("node:fs"), 1);
 var import_node_path49 = __toESM(require("node:path"), 1);
 init_signIn();
 init_load();
@@ -120420,14 +120585,18 @@ init_supervisor();
 init_state();
 
 // src/doctorFrontDoor.ts
-function pushFrontDoor(push, supervisors, registeredPid, liveSessions) {
+function pushFrontDoor(push, supervisors, registeredPid, liveSessions, draining) {
   if (!supervisors.ok) {
     push("frontdoor", "warn", `Could not list processes to look for duplicate front door supervisors: ${supervisors.message}.`);
     return;
   }
-  const { pids } = supervisors;
+  const drainingPids = supervisors.pids.filter((pid) => draining.includes(pid));
+  for (const pid of drainingPids) {
+    push("frontdoor", "warn", `Front door supervisor pid ${String(pid)} is draining: it has released its addresses and exits once the connections it carried have ended.`, String(pid));
+  }
+  const pids = supervisors.pids.filter((pid) => !draining.includes(pid));
   if (pids.length === 0) {
-    push("frontdoor", "pass", "No front door supervisor is running.");
+    push("frontdoor", "pass", drainingPids.length === 0 ? "No front door supervisor is running." : "No front door supervisor is serving.");
     return;
   }
   const [only, ...rest] = pids;
@@ -120476,7 +120645,7 @@ function pushFrontDoorListeners(push, readings) {
 }
 
 // src/frontdoor/listenerReadings.ts
-var import_node_fs18 = __toESM(require("node:fs"), 1);
+var import_node_fs19 = __toESM(require("node:fs"), 1);
 init_probe();
 function readFrontDoorListeners(state, supervisorAlive, probes) {
   if (!supervisorAlive) {
@@ -120497,7 +120666,7 @@ function readFrontDoorListeners(state, supervisorAlive, probes) {
 }
 function realFrontDoorListenerProbes(paths) {
   return {
-    authenticateProvider: (port) => probeFrontDoorSync(port, import_node_fs18.default.readFileSync(paths.frontdoorCaCertFile, "utf8")),
+    authenticateProvider: (port) => probeFrontDoorSync(port, import_node_fs19.default.readFileSync(paths.frontdoorCaCertFile, "utf8")),
     connect: probeListenerAcceptSync,
     now: () => performance.now()
   };
@@ -120977,7 +121146,7 @@ function runDoctor(params) {
   }
   if (params.frontDoor !== void 0) {
     const validated2 = params.frontDoor.state.raw === void 0 ? void 0 : validateJson(FrontDoorStateSchema, params.frontDoor.state);
-    pushFrontDoor(push, params.frontDoor.supervisors, validated2?.ok === true ? validated2.data.supervisorPid : void 0, params.frontDoor.liveSessions);
+    pushFrontDoor(push, params.frontDoor.supervisors, validated2?.ok === true ? validated2.data.supervisorPid : void 0, params.frontDoor.liveSessions, params.frontDoor.draining ?? []);
     if (params.frontDoor.listeners !== void 0) {
       pushFrontDoorListeners(push, params.frontDoor.listeners);
     }
@@ -121065,7 +121234,7 @@ function formatDoctorReport(report) {
 }
 function realpathOrSelf(target) {
   try {
-    return import_node_fs19.default.realpathSync(target);
+    return import_node_fs20.default.realpathSync(target);
   } catch {
     return target;
   }
@@ -121077,18 +121246,18 @@ function servingDoorListeners(paths) {
 }
 function collectDoctorReport(params) {
   const { paths } = params;
-  const identityNames = import_node_fs19.default.existsSync(paths.identitiesDir) ? import_node_fs19.default.readdirSync(paths.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && isIdentityDirectoryName(entry.name)).map((entry) => entry.name).sort() : [];
+  const identityNames = import_node_fs20.default.existsSync(paths.identitiesDir) ? import_node_fs20.default.readdirSync(paths.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && isIdentityDirectoryName(entry.name)).map((entry) => entry.name).sort() : [];
   const identities = identityNames.map((name) => {
     const farmRoot = import_node_path49.default.join(paths.identitiesDir, name);
     const identityPath = import_node_path49.default.join(farmRoot, "identity.json");
-    return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot, credentialsFilePresent: import_node_fs19.default.existsSync(credentialsFilePath(farmRoot)) };
+    return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot, credentialsFilePresent: import_node_fs20.default.existsSync(credentialsFilePath(farmRoot)) };
   });
-  const profileNames = import_node_fs19.default.existsSync(paths.configProfilesDir) ? import_node_fs19.default.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
+  const profileNames = import_node_fs20.default.existsSync(paths.configProfilesDir) ? import_node_fs20.default.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const configProfiles = profileNames.map((name) => {
     const profilePath = import_node_path49.default.join(paths.configProfilesDir, `${name}.json`);
     return { name, path: profilePath, raw: realFsPort.readFileUtf8(profilePath) };
   });
-  const providerNames = import_node_fs19.default.existsSync(paths.providersDir) ? import_node_fs19.default.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
+  const providerNames = import_node_fs20.default.existsSync(paths.providersDir) ? import_node_fs20.default.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const providers = providerNames.map((name) => {
     const providerPath = import_node_path49.default.join(paths.providersDir, `${name}.json`);
     return { name, path: providerPath, raw: realFsPort.readFileUtf8(providerPath) };
@@ -121136,7 +121305,7 @@ function collectDoctorReport(params) {
     categoriesLocal: { path: paths.categoriesLocalFile, raw: realFsPort.readFileUtf8(paths.categoriesLocalFile) },
     activeIdentity: { path: paths.activeIdentityFile, raw: realFsPort.readFileUtf8(paths.activeIdentityFile) },
     binaryDiscovery,
-    claudeShim: { state: shimState, targetExists: shimState !== void 0 && import_node_fs19.default.existsSync(shimState.targetPath) },
+    claudeShim: { state: shimState, targetExists: shimState !== void 0 && import_node_fs20.default.existsSync(shimState.targetPath) },
     rootPath: paths.root,
     pathResolution: {
       ownExecutablePath,
@@ -121176,7 +121345,7 @@ function collectDoctorReport(params) {
         logPath: paths.headroomLogPath
       }
     },
-    ...uid === void 0 ? {} : { frontDoor: { state: { path: paths.frontdoorStateFile, raw: realFsPort.readFileUtf8(paths.frontdoorStateFile) }, supervisors: listFrontDoorSupervisors(realRunPort, uid), liveSessions: listFrontDoorSessions(realFarmFs, paths.frontdoorSessionsDir).filter((session) => realIsProcessRunning(session.pid)), listeners: servingDoorListeners(paths) } }
+    ...uid === void 0 ? {} : { frontDoor: { state: { path: paths.frontdoorStateFile, raw: realFsPort.readFileUtf8(paths.frontdoorStateFile) }, supervisors: listFrontDoorSupervisors(realRunPort, uid), liveSessions: listFrontDoorSessions(realFarmFs, paths.frontdoorSessionsDir).filter((session) => realIsProcessRunning(session.pid)), draining: listDrainingFrontDoors(realFarmFs, paths.frontdoorDrainingDir, realIsProcessRunning), listeners: servingDoorListeners(paths) } }
   });
   return report;
 }
@@ -126882,6 +127051,8 @@ var HeadroomSocketTargetSchema = external_exports.union([external_exports.strict
 var FrontDoorStatusOutputSchema = external_exports.strictObject({
   state: FrontDoorStateSchema,
   supervisorAlive: external_exports.boolean(),
+  /** The pids of earlier doors that released their addresses and are finishing the connections they carried: running, but not serving anything new. */
+  draining: external_exports.readonly(external_exports.array(external_exports.number().int().positive())),
   sessions: external_exports.readonly(external_exports.array(FrontDoorSessionStatusSchema)),
   headroomSocket: HeadroomSocketTargetSchema.optional(),
   logPath: external_exports.string(),
@@ -132785,8 +132956,8 @@ var SELF_HOST_SUBSCRIPTION_TYPE = "max";
 function isRecord16(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 }
-function readJsonObject(fs28, file2) {
-  const raw = fs28.readFileUtf8(file2);
+function readJsonObject(fs29, file2) {
+  const raw = fs29.readFileUtf8(file2);
   if (raw === void 0) {
     return void 0;
   }
@@ -132798,8 +132969,8 @@ function readJsonObject(fs28, file2) {
   }
   return isRecord16(parsed) ? parsed : void 0;
 }
-function readRcSelfHostRecord(fs28, frontdoorDir) {
-  const parsed = readJsonObject(fs28, import_node_path52.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
+function readRcSelfHostRecord(fs29, frontdoorDir) {
+  const parsed = readJsonObject(fs29, import_node_path52.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
   if (parsed === void 0) {
     return void 0;
   }
@@ -133244,11 +133415,11 @@ function credentialOfJson(parsed) {
 function sequenceNumOfJson(value2) {
   return typeof value2 === "number" && Number.isInteger(value2) && value2 >= 0 ? value2 : void 0;
 }
-function createRcCredentialStore(fs28, dir) {
-  fs28.mkdirPrivate(dir);
+function createRcCredentialStore(fs29, dir) {
+  fs29.mkdirPrivate(dir);
   const fileFor = (sessionId) => import_node_path53.default.join(dir, `${sessionId}.json`);
   const readParsed = (sessionId) => {
-    const raw = fs28.readFileUtf8(fileFor(sessionId));
+    const raw = fs29.readFileUtf8(fileFor(sessionId));
     if (raw === void 0) {
       return void 0;
     }
@@ -133273,7 +133444,7 @@ function createRcCredentialStore(fs28, dir) {
       }
       const cursor3 = sequenceNumOfJson(readParsed(sessionId)?.highestSequenceNum);
       const record2 = { ...credential, ...cursor3 === void 0 ? {} : { highestSequenceNum: cursor3 } };
-      fs28.writeFilePrivate(fileFor(sessionId), `${JSON.stringify(record2, null, 2)}
+      fs29.writeFilePrivate(fileFor(sessionId), `${JSON.stringify(record2, null, 2)}
 `);
     },
     readCursor: (sessionId) => {
@@ -133288,14 +133459,14 @@ function createRcCredentialStore(fs28, dir) {
       }
       const credential = credentialOfJson(readParsed(sessionId));
       const record2 = credential === void 0 ? { highestSequenceNum } : { ...credential, highestSequenceNum };
-      fs28.writeFilePrivate(fileFor(sessionId), `${JSON.stringify(record2, null, 2)}
+      fs29.writeFilePrivate(fileFor(sessionId), `${JSON.stringify(record2, null, 2)}
 `);
     },
     remove: (sessionId) => {
       if (!isSafeSessionId(sessionId)) {
         return;
       }
-      fs28.removeRecursive(fileFor(sessionId));
+      fs29.removeRecursive(fileFor(sessionId));
     }
   };
 }
@@ -135129,6 +135300,7 @@ function createRcEventFanout() {
 }
 function createRcStreamHub(deps) {
   const attachments = /* @__PURE__ */ new Map();
+  let closed = false;
   const lastSavedSequenceNums = /* @__PURE__ */ new Map();
   const persistCursor = (sessionId) => {
     if (deps.saveSequenceNum === void 0) {
@@ -135287,6 +135459,9 @@ function createRcStreamHub(deps) {
   };
   return {
     reconcile: () => {
+      if (closed) {
+        return;
+      }
       const live = new Set(deps.trackedSessions());
       for (const [sessionId, attachment] of attachments) {
         if (!live.has(sessionId)) {
@@ -135309,6 +135484,7 @@ function createRcStreamHub(deps) {
       }
     },
     close: () => {
+      closed = true;
       for (const attachment of attachments.values()) {
         persistCursor(attachment.sessionId);
         const credential = deps.credentialOf(attachment.sessionId);
@@ -135537,6 +135713,7 @@ function collectFrontDoorStatus(fsPort, socketTrust, paths, isRunning) {
   return {
     state,
     supervisorAlive: state.supervisorPid !== void 0 && isRunning(state.supervisorPid),
+    draining: listDrainingFrontDoors(fsPort, paths.frontdoorDrainingDir, isRunning),
     sessions: listFrontDoorSessions(fsPort, paths.frontdoorSessionsDir).map((session) => ({ ...session, alive: isRunning(session.pid) })),
     headroomSocket: headroomSocketTarget(fsPort, socketTrust, paths),
     logPath: paths.frontdoorLogPath,
@@ -135560,6 +135737,9 @@ function formatFrontDoorStatus(status, caCertPath) {
   } else {
     lines.push(`connect surface: listening on 127.0.0.1:${String(status.state.connectPort)}, CA ${caCertPath}`);
   }
+  if (status.draining.length > 0) {
+    lines.push(`draining: ${status.draining.map(String).join(", ")} (finishing connections opened before the last restart; each exits when they have ended)`);
+  }
   if (status.headroomSocket === void 0) {
     lines.push("headroom hop: the daemon is not serving (sessions asking for headroom fail until it is up)");
   } else if (status.headroomSocket.refused === void 0) {
@@ -135640,11 +135820,6 @@ function respawnInvocation(paths) {
   }
   return { ...selfInvocation(["__frontdoor-supervisor"]), env };
 }
-function appendLog(paths, line) {
-  import_node_fs20.default.mkdirSync(paths.logsDir, { recursive: true });
-  import_node_fs20.default.appendFileSync(paths.frontdoorLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
-`);
-}
 function rcObservingResolver(resolve2, tracker, hub) {
   return async (request7) => {
     const resolution = await resolve2(request7);
@@ -135655,13 +135830,13 @@ function rcObservingResolver(resolve2, tracker, hub) {
 }
 function realStatOwnExecutable(watchPath) {
   return () => {
-    const st2 = import_node_fs20.default.statSync(watchPath, { throwIfNoEntry: false });
+    const st2 = import_node_fs21.default.statSync(watchPath, { throwIfNoEntry: false });
     return st2?.isFile() !== true ? void 0 : { dev: st2.dev, ino: st2.ino, size: st2.size, mtimeMs: st2.mtimeMs };
   };
 }
-function realFrontDoorSupervisorPorts(paths, respawnGeneration) {
+function realFrontDoorSupervisorPorts(paths, respawnGeneration, retire, trackTunnels) {
   const log = (line) => {
-    appendLog(paths, `frontdoor ${String(process.pid)}: ${line}`);
+    appendDoorLog(paths, `frontdoor ${String(process.pid)}: ${line}`);
   };
   let directPort = 0;
   const rcSelfHost = rcSelfHostFromEnv(process.env);
@@ -135714,7 +135889,7 @@ function realFrontDoorSupervisorPorts(paths, respawnGeneration) {
       });
     },
     log: (line) => {
-      appendLog(paths, `frontdoor ${String(process.pid)}: ${line}`);
+      appendDoorLog(paths, `frontdoor ${String(process.pid)}: ${line}`);
     }
   });
   const observations = createTargetObservationStore(realFarmFs, paths);
@@ -135766,7 +135941,13 @@ function realFrontDoorSupervisorPorts(paths, respawnGeneration) {
   });
   const quotaRefresher = createRealQuotaRefresher({ paths, store: usageStore, log });
   const anthropicRefresher = createRealAnthropicUsageRefresher({ paths, store: usageStore, cwd: process.cwd(), spawnDaemon: spawnDetachedSupervisor, log });
-  setInterval(() => {
+  const keeperTimers = [];
+  const everyFreshnessInterval = (tick) => {
+    const timer = setInterval(tick, ANTHROPIC_USAGE_FRESHNESS_MS);
+    timer.unref();
+    keeperTimers.push(timer);
+  };
+  everyFreshnessInterval(() => {
     try {
       const pools = readPools(paths);
       refreshStalePoolMembers({ poolNames: Object.keys(pools), pools, loadMembers: (identities) => loadPoolMembers(realFarmFs, paths, identities, Date.now()), refresher: anthropicRefresher }).catch((error63) => {
@@ -135775,12 +135956,12 @@ function realFrontDoorSupervisorPorts(paths, respawnGeneration) {
     } catch (error63) {
       log(`pool usage refresh failed: ${error63 instanceof Error ? error63.message : String(error63)}`);
     }
-  }, ANTHROPIC_USAGE_FRESHNESS_MS).unref();
+  });
   const windowOpener = async (identity) => {
     await runChild({ paths, args: ["__open-window", identity], timeoutMs: WINDOW_OPEN_TIMEOUT_MS });
   };
   let keeperRunning = false;
-  setInterval(() => {
+  everyFreshnessInterval(() => {
     if (keeperRunning) {
       return;
     }
@@ -135799,12 +135980,12 @@ function realFrontDoorSupervisorPorts(paths, respawnGeneration) {
     }).finally(() => {
       keeperRunning = false;
     });
-  }, ANTHROPIC_USAGE_FRESHNESS_MS).unref();
+  });
   const jobRunner = async (name, identity, job) => {
     await runChild({ paths, args: ["__run-job", name, identity], timeoutMs: parseDuration(job.timeout) });
   };
   const runningJobs = /* @__PURE__ */ new Set();
-  setInterval(() => {
+  everyFreshnessInterval(() => {
     try {
       runJobs({
         fs: realFarmFs,
@@ -135821,7 +136002,7 @@ function realFrontDoorSupervisorPorts(paths, respawnGeneration) {
     } catch (error63) {
       log(`job keeper failed: ${error63 instanceof Error ? error63.message : String(error63)}`);
     }
-  }, ANTHROPIC_USAGE_FRESHNESS_MS).unref();
+  });
   const catalogueKeeper = createCatalogueKeeper({
     providers: () => listProviders(paths, (name, message) => {
       log(`catalogue keeper skipped provider ${name}: ${message}`);
@@ -135834,7 +136015,7 @@ function realFrontDoorSupervisorPorts(paths, respawnGeneration) {
     log
   });
   catalogueKeeper.tick();
-  setInterval(catalogueKeeper.tick, ANTHROPIC_USAGE_FRESHNESS_MS).unref();
+  everyFreshnessInterval(catalogueKeeper.tick);
   const headroomDecision = createHeadroomDecision(createRoutingSettingReader(paths));
   const targetObservations = createTargetObservationStore(realFarmFs, paths);
   const recordUsage = (record2) => {
@@ -135880,7 +136061,7 @@ function realFrontDoorSupervisorPorts(paths, respawnGeneration) {
     log
   });
   const onListenerError = (name) => (error63) => {
-    appendLog(paths, `frontdoor ${String(process.pid)}: ${name} listener failed: ${error63.message}; exiting`);
+    appendDoorLog(paths, `frontdoor ${String(process.pid)}: ${name} listener failed: ${error63.message}; exiting`);
     process.exit(1);
   };
   return {
@@ -135895,7 +136076,7 @@ function realFrontDoorSupervisorPorts(paths, respawnGeneration) {
     },
     isRunning: realIsProcessRunning,
     // The turnover check's file identity, over the installed entry resolved once at door start: re-resolving per tick would re-run the PATH scan every second and could theoretically flip between two files, while the entry itself is fixed for as long as this door lives. The existence check prefers the agent-shim sibling only when it is really there (see watchedInstallEntry).
-    statOwnExecutable: realStatOwnExecutable(watchedInstallEntry(realOwnExecutablePath(), (candidate) => import_node_fs20.default.existsSync(candidate))),
+    statOwnExecutable: realStatOwnExecutable(watchedInstallEntry(realOwnExecutablePath(), (candidate) => import_node_fs21.default.existsSync(candidate))),
     startProviderListener: async (preferredPort) => {
       const authority = loadCa();
       const rcDial = rcSelfHost ? lateRcEventDial(rcSelfHostDialTarget) : realRcEventDial();
@@ -135995,7 +136176,9 @@ function realFrontDoorSupervisorPorts(paths, respawnGeneration) {
         close: async () => {
           realFarmFs.removeRecursive(paths.frontdoorControlTokenFile);
           await handle.close();
-        }
+        },
+        // The control token is left in place: a successor writes its own over it as it starts, and this door no longer serves the routes that check it.
+        drain: handle.drain
       };
     },
     startConnectListener: async (preferredPort) => {
@@ -136051,11 +136234,19 @@ function realFrontDoorSupervisorPorts(paths, respawnGeneration) {
         preferredPort
       );
       transparentPort = server.transparentPort;
+      trackTunnels(server.openTunnels);
       return {
         port: server.port,
         close: async () => {
           rcSelfHostSurface?.close();
           await server.close();
+        },
+        drain: async () => {
+          if (transparentCapability !== void 0) {
+            removeFrontDoorSession(realFarmFs, paths.frontdoorSessionsDir, process.pid);
+          }
+          await server.drain();
+          rcSelfHostSurface?.close();
         }
       };
     },
@@ -136070,7 +136261,7 @@ function realFrontDoorSupervisorPorts(paths, respawnGeneration) {
         },
         onError: onListenerError("direct")
       });
-      return { port: handle.port, close: handle.close };
+      return { port: handle.port, close: handle.close, drain: handle.drain };
     },
     closeRcStreamHub: rcHub.close,
     startWatchdog: () => startThreadWatchdog({
@@ -136089,9 +136280,15 @@ function realFrontDoorSupervisorPorts(paths, respawnGeneration) {
     // The launch lifecycle publisher over the same backbone the typed API serves: the tick's registry facts go in here, and the door's own register, prune and end moments come out as source-tagged events.
     observeLaunchRegistry: createLaunchEventPublisher(doorEvents, () => Date.now()).observe,
     doorHealth,
+    retire,
+    stopBackgroundWork: () => {
+      for (const timer of keeperTimers) {
+        clearInterval(timer);
+      }
+    },
     checkQuotaExpiry: quotaExpiring.check,
     log: (line) => {
-      appendLog(paths, line);
+      appendDoorLog(paths, line);
     }
   };
 }
@@ -136116,9 +136313,9 @@ function registerFrontDoorCommand(program2, deps) {
   );
   withExamples(
     frontdoor.command("restart").description(
-      "Replace the serving front door with one started from the installed binary, in place: it binds the same ports, so running sessions reach it on their next request. A request in flight when the old door exits fails once. Does nothing when no door is serving."
+      "Replace the serving front door with one started from the installed binary, in place: it binds the same ports, so running sessions reach it on their next request. The old door releases its addresses and keeps carrying the tunnels and responses already open until they end; the sessions it terminates reconnect to the new one. Does nothing when no door is serving."
     ).option("--json", "Print the result as JSON.").action((options) => {
-      const result = realRestartFrontDoor(paths, spawnDetachedSupervisor);
+      const result = realRestartFrontDoor(paths, spawnDetachedSupervisor, "restart-command");
       if (options.json === true) {
         printJson(result);
         return;
@@ -136134,17 +136331,29 @@ function registerFrontDoorCommand(program2, deps) {
     const respawnGeneration = readRespawnGeneration();
     Reflect.deleteProperty(process.env, DOOR_AWAIT_PID_ENV);
     Reflect.deleteProperty(process.env, DOOR_RESPAWN_GENERATION_ENV);
-    const supervisorPorts = realFrontDoorSupervisorPorts(paths, respawnGeneration);
+    const retire = new AbortController();
+    let openTunnels = () => 0;
+    const supervisorPorts = realFrontDoorSupervisorPorts(paths, respawnGeneration, retire.signal, (count) => {
+      openTunnels = count;
+    });
     const ownPid = process.pid;
     process.on("exit", (code) => {
       supervisorPorts.log(`frontdoor ${String(ownPid)}: exiting with code ${String(code)}`);
     });
-    for (const signal of ["SIGTERM", "SIGINT"]) {
-      process.on(signal, () => {
-        supervisorPorts.log(`frontdoor ${String(ownPid)}: received ${signal}; exiting`);
-        deps.exit(0);
-      });
-    }
+    retireOnSignals(process, {
+      doorPid: ownPid,
+      log: supervisorPorts.log,
+      retire: () => {
+        retire.abort();
+      },
+      exit: deps.exit,
+      facts: () => ({
+        tunnels: openTunnels(),
+        liveSessions: listFrontDoorSessions(realFarmFs, paths.frontdoorSessionsDir).filter((session) => session.pid !== ownPid && realIsProcessRunning(session.pid)).length,
+        protocol: FRONT_DOOR_PROTOCOL,
+        uptimeSeconds: Math.round(process.uptime())
+      })
+    });
     if (Number.isInteger(awaited) && awaited > 0) {
       const waitedMs = await awaitPidExit(awaited, supervisorPorts);
       supervisorPorts.log(`frontdoor ${String(ownPid)}: stalled door ${String(awaited)} released the sticky ports after ${String(waitedMs)}ms`);
@@ -136170,8 +136379,8 @@ function isAntigravityPayload(payload) {
   return typeof payload === "object" && payload !== null && "product" in payload && payload.product === "antigravity";
 }
 var ANTIGRAVITY_SETTINGS_SEGMENTS = [".gemini", "antigravity-cli", "settings.json"];
-function antigravityStacksWithDefault(fs28, homeDir) {
-  const raw = fs28.readFileUtf8(import_node_path55.default.join(homeDir, ...ANTIGRAVITY_SETTINGS_SEGMENTS));
+function antigravityStacksWithDefault(fs29, homeDir) {
+  const raw = fs29.readFileUtf8(import_node_path55.default.join(homeDir, ...ANTIGRAVITY_SETTINGS_SEGMENTS));
   if (raw === void 0) {
     return false;
   }
@@ -146705,7 +146914,7 @@ async function serveMcp(mcp, transport, options = {}) {
 }
 
 // src/mcp/permissions.ts
-var import_node_fs21 = __toESM(require("node:fs"), 1);
+var import_node_fs22 = __toESM(require("node:fs"), 1);
 var import_node_path57 = __toESM(require("node:path"), 1);
 init_zod();
 init_store();
@@ -146722,15 +146931,15 @@ function readStoredMcpPermissions(paths) {
 }
 function writeStoredMcpPermissions(paths, permissions) {
   writeJsonAtomic(paths.mcpPermissionsFile, { writes: permissions.writes, remoteControl: permissions.remoteControl, history: permissions.history });
-  import_node_fs21.default.chmodSync(paths.mcpPermissionsFile, OWNER_ONLY_MODE);
+  import_node_fs22.default.chmodSync(paths.mcpPermissionsFile, OWNER_ONLY_MODE);
 }
 function effectiveMcpPermissions(flags, stored) {
   return { writes: flags.writes || stored.writes, remoteControl: flags.remoteControl || stored.remoteControl, history: flags.history || stored.history };
 }
 function watchMcpPermissions(paths, onChange) {
   const directory = import_node_path57.default.dirname(paths.mcpPermissionsFile);
-  import_node_fs21.default.mkdirSync(directory, { recursive: true });
-  const watcher = import_node_fs21.default.watch(directory, (_event, filename) => {
+  import_node_fs22.default.mkdirSync(directory, { recursive: true });
+  const watcher = import_node_fs22.default.watch(directory, (_event, filename) => {
     if (filename === null || filename === import_node_path57.default.basename(paths.mcpPermissionsFile)) {
       onChange();
     }
@@ -147044,7 +147253,7 @@ init_credential();
 init_credentialCache();
 
 // src/identityToken.ts
-var import_node_fs22 = __toESM(require("node:fs"), 1);
+var import_node_fs23 = __toESM(require("node:fs"), 1);
 var import_node_path58 = __toESM(require("node:path"), 1);
 init_cliError();
 var TOKEN_FILE_MODE = 384;
@@ -147062,13 +147271,13 @@ function storeIdentityToken(paths, identityName, raw) {
     throw new UsageError("That is not a claude setup-token token (expected it to start with sk-ant-oat). Run `claude setup-token` and pass its token on standard input.");
   }
   const dir = identityTokenDir(paths);
-  import_node_fs22.default.mkdirSync(dir, { recursive: true, mode: TOKEN_DIR_MODE });
-  import_node_fs22.default.chmodSync(dir, TOKEN_DIR_MODE);
+  import_node_fs23.default.mkdirSync(dir, { recursive: true, mode: TOKEN_DIR_MODE });
+  import_node_fs23.default.chmodSync(dir, TOKEN_DIR_MODE);
   const target = identityTokenPath(paths, identityName);
   const temp = import_node_path58.default.join(dir, `.${identityName}.${String(process.pid)}.tmp`);
-  import_node_fs22.default.writeFileSync(temp, `${token}
+  import_node_fs23.default.writeFileSync(temp, `${token}
 `, { mode: TOKEN_FILE_MODE });
-  import_node_fs22.default.renameSync(temp, target);
+  import_node_fs23.default.renameSync(temp, target);
   return target;
 }
 
@@ -147234,7 +147443,7 @@ function registerDoctorCommand(program2, deps) {
 }
 
 // src/headroom/commands.ts
-var import_node_fs23 = __toESM(require("node:fs"), 1);
+var import_node_fs24 = __toESM(require("node:fs"), 1);
 var import_node_http5 = __toESM(require("node:http"), 1);
 var import_node_path59 = __toESM(require("node:path"), 1);
 var import_node_child_process9 = require("node:child_process");
@@ -147459,12 +147668,12 @@ function realSupervisorPorts(paths) {
     readConfig: () => resolveSupervisorConfig(readGlobalConfig(paths)?.headroom ?? {}),
     spawnHeadroom: (socketPath, allowlistFile, settings2) => {
       const trust = resolveHeadroomTrustBundle({ caCertFile: paths.frontdoorCaCertFile, bundlesDir: paths.frontdoorCaBundlesDir, inherited: process.env[HEADROOM_CA_BUNDLE], fs: realTrustBundleFs });
-      import_node_fs23.default.mkdirSync(paths.logsDir, { recursive: true });
+      import_node_fs24.default.mkdirSync(paths.logsDir, { recursive: true });
       if (trust?.warning !== void 0) {
-        import_node_fs23.default.appendFileSync(paths.headroomLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${trust.warning}
+        import_node_fs24.default.appendFileSync(paths.headroomLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${trust.warning}
 `);
       }
-      const logFd = import_node_fs23.default.openSync(paths.headroomLogPath, "a");
+      const logFd = import_node_fs24.default.openSync(paths.headroomLogPath, "a");
       try {
         const child = (0, import_node_child_process9.spawn)("headroom", headroomProxyArgs(socketPath, allowlistFile, settings2), {
           detached: true,
@@ -147479,12 +147688,12 @@ function realSupervisorPorts(paths) {
         child.once("exit", (code, signal) => {
           ownedHeadroom.delete(pid);
           exitedHeadroom.add(pid);
-          import_node_fs23.default.appendFileSync(paths.headroomLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} agent-shim headroom supervisor: headroom exited (${signal ?? `code ${String(code)}`})
+          import_node_fs24.default.appendFileSync(paths.headroomLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} agent-shim headroom supervisor: headroom exited (${signal ?? `code ${String(code)}`})
 `);
         });
         return pid;
       } finally {
-        import_node_fs23.default.closeSync(logFd);
+        import_node_fs24.default.closeSync(logFd);
       }
     },
     stopProcess: (pid) => {
@@ -147497,7 +147706,7 @@ function realSupervisorPorts(paths) {
         now: () => Date.now()
       });
       if (outcome === "still-running") {
-        import_node_fs23.default.appendFileSync(
+        import_node_fs24.default.appendFileSync(
           paths.headroomLogPath,
           `${(/* @__PURE__ */ new Date()).toISOString()} agent-shim headroom supervisor: pid ${String(pid)} survived SIGKILL within its grace; it is stuck uninterruptibly
 `
@@ -147515,10 +147724,10 @@ function realSupervisorPorts(paths) {
         };
       }
       if (result.stdout !== "") {
-        import_node_fs23.default.appendFileSync(paths.headroomLogPath, result.stdout);
+        import_node_fs24.default.appendFileSync(paths.headroomLogPath, result.stdout);
       }
       if (result.stderr !== "") {
-        import_node_fs23.default.appendFileSync(paths.headroomLogPath, result.stderr);
+        import_node_fs24.default.appendFileSync(paths.headroomLogPath, result.stderr);
       }
       return result.status === 0 ? { ok: true } : { ok: false, error: `uv tool install exited ${String(result.status)}` };
     },
@@ -147528,8 +147737,8 @@ function realSupervisorPorts(paths) {
     },
     installedCommit: readInstalledHeadroomCommit,
     log: (line) => {
-      import_node_fs23.default.mkdirSync(paths.logsDir, { recursive: true });
-      import_node_fs23.default.appendFileSync(paths.headroomLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+      import_node_fs24.default.mkdirSync(paths.logsDir, { recursive: true });
+      import_node_fs24.default.appendFileSync(paths.headroomLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
 `);
     }
   };
@@ -148036,12 +148245,12 @@ init_translate();
 init_schema();
 init_cliError();
 init_providerCatalogue();
-var import_node_fs25 = __toESM(require("node:fs"), 1);
+var import_node_fs26 = __toESM(require("node:fs"), 1);
 init_credential();
 init_providerAliases();
 
 // src/providerRename.ts
-var import_node_fs24 = __toESM(require("node:fs"), 1);
+var import_node_fs25 = __toESM(require("node:fs"), 1);
 var import_node_path62 = __toESM(require("node:path"), 1);
 init_schema();
 init_store();
@@ -148107,7 +148316,7 @@ function renameProvider(paths, from, to2, ports) {
   const previousAliases = readProviderAliases(paths);
   writeProviderAliases(paths, aliasesAfterRename(previousAliases, from, to2));
   try {
-    import_node_fs24.default.renameSync(providerJsonPath(paths, from), providerJsonPath(paths, to2));
+    import_node_fs25.default.renameSync(providerJsonPath(paths, from), providerJsonPath(paths, to2));
   } catch (error63) {
     writeProviderAliases(paths, previousAliases);
     throw error63;
@@ -148127,8 +148336,8 @@ function moveState(paths, from, to2, ports) {
 `);
     moved.push(`usage ${snapshot.identity}`);
   }
-  if (import_node_fs24.default.existsSync(catalogueCachePath(paths, from))) {
-    import_node_fs24.default.renameSync(catalogueCachePath(paths, from), catalogueCachePath(paths, to2));
+  if (import_node_fs25.default.existsSync(catalogueCachePath(paths, from))) {
+    import_node_fs25.default.renameSync(catalogueCachePath(paths, from), catalogueCachePath(paths, to2));
     moved.push("catalogue");
   }
   const renamed = readProvider(paths, to2);
@@ -148459,7 +148668,7 @@ function registerProviderCommand(program2, deps) {
         throw new UsageError(`Provider "${name}" has no catalogue setting. Set one with \`agent-shim provider set ${name} --catalogue-tier <tier>\`.`);
       }
       const catalogueSetting = found.catalogue;
-      const cache = options.refresh === true ? await refreshCatalogueForReal(paths, name, process.env) : parseCatalogueCache(import_node_fs25.default.existsSync(catalogueCachePath(paths, name)) ? import_node_fs25.default.readFileSync(catalogueCachePath(paths, name), "utf8") : void 0);
+      const cache = options.refresh === true ? await refreshCatalogueForReal(paths, name, process.env) : parseCatalogueCache(import_node_fs26.default.existsSync(catalogueCachePath(paths, name)) ? import_node_fs26.default.readFileSync(catalogueCachePath(paths, name), "utf8") : void 0);
       if (cache === void 0) {
         throw new UsageError(`No catalogue has been fetched for "${name}" yet: the front door fetches it shortly after it starts, or run \`agent-shim provider models ${name} --refresh\`.`);
       }
@@ -149003,14 +149212,14 @@ function requireIdentity(paths, name) {
     throw new IdentityNotFoundError(name);
   }
 }
-function collectUsageReport(fs28, paths, filters) {
+function collectUsageReport(fs29, paths, filters) {
   const { identity, provider, sinceMs } = filters;
   if (identity !== void 0) {
     requireIdentity(paths, identity);
   }
-  const log = readUsageLog(fs28, paths.usageLogDir, sinceMs === void 0 ? {} : { sinceMs });
+  const log = readUsageLog(fs29, paths.usageLogDir, sinceMs === void 0 ? {} : { sinceMs });
   const records = log.records.filter((record2) => (identity === void 0 || record2.identity === identity) && (provider === void 0 || record2.provider === provider));
-  const snapshots = (identity === void 0 ? listUsageSnapshots(fs28, paths.usageSnapshotsDir) : [readUsageSnapshot(fs28, paths.usageSnapshotsDir, identity)].flatMap((snapshot) => snapshot === void 0 ? [] : [snapshot])).map((snapshot) => provider === void 0 ? snapshot : { ...snapshot, providers: Object.fromEntries(Object.entries(snapshot.providers).filter(([name]) => name === provider)) }).filter((snapshot) => Object.keys(snapshot.providers).length > 0);
+  const snapshots = (identity === void 0 ? listUsageSnapshots(fs29, paths.usageSnapshotsDir) : [readUsageSnapshot(fs29, paths.usageSnapshotsDir, identity)].flatMap((snapshot) => snapshot === void 0 ? [] : [snapshot])).map((snapshot) => provider === void 0 ? snapshot : { ...snapshot, providers: Object.fromEntries(Object.entries(snapshot.providers).filter(([name]) => name === provider)) }).filter((snapshot) => Object.keys(snapshot.providers).length > 0);
   return {
     since: sinceMs === void 0 ? void 0 : new Date(sinceMs).toISOString(),
     logDir: paths.usageLogDir,
@@ -149117,16 +149326,16 @@ function formatUsageReport(report) {
   }
   return lines;
 }
-function collectAccounts(fs28, paths, identity, probe) {
+function collectAccounts(fs29, paths, identity, probe) {
   if (identity !== void 0) {
     requireIdentity(paths, identity);
   }
   const names = identity === void 0 ? listIdentities(paths).map((entry) => entry.name) : [identity];
   return names.map((name) => ({
     identity: name,
-    account: readAccountMetadata(fs28, paths.identitiesDir, name),
-    signIn: identitySignIn(fs28, probe, { farmRoot: import_node_path63.default.join(paths.identitiesDir, name), hasCredentialBlock: readIdentity(paths, name)?.credential !== void 0 }),
-    usage: readUsageSnapshot(fs28, paths.usageSnapshotsDir, name)
+    account: readAccountMetadata(fs29, paths.identitiesDir, name),
+    signIn: identitySignIn(fs29, probe, { farmRoot: import_node_path63.default.join(paths.identitiesDir, name), hasCredentialBlock: readIdentity(paths, name)?.credential !== void 0 }),
+    usage: readUsageSnapshot(fs29, paths.usageSnapshotsDir, name)
   }));
 }
 function formatAccounts(views) {
@@ -149476,15 +149685,15 @@ function createRealCompactor(params) {
 // src/supervise/compactionDeps.ts
 var COMPACT_SLOT_STALE_MS = COMPACT_TIMEOUT_MS * 2;
 function createCompactionDeps(wiring) {
-  const { paths, fs: fs28, pool } = wiring;
+  const { paths, fs: fs29, pool } = wiring;
   return {
     shouldCompact: (identity, sessionId) => {
       const nowMs = wiring.now();
-      const sessions = liveSupervised(fs28, paths, pool, wiring.isRunning).filter((session) => session.identity === identity).map((session) => ({ sessionId: session.sessionId, state: readSessionState(fs28, paths, pool, session.sessionId) }));
+      const sessions = liveSupervised(fs29, paths, pool, wiring.isRunning).filter((session) => session.identity === identity).map((session) => ({ sessionId: session.sessionId, state: readSessionState(fs29, paths, pool, session.sessionId) }));
       return decideCompaction({
         atUtilisation: wiring.policy.compactAtUtilisation,
-        snapshot: readUsageSnapshot(fs28, paths.usageSnapshotsDir, identity),
-        records: () => readUsageLog(fs28, paths.usageLogDir, { sinceMs: nowMs - FIVE_HOUR_WINDOW_MS }).records.filter((record2) => record2.identity === identity),
+        snapshot: readUsageSnapshot(fs29, paths.usageSnapshotsDir, identity),
+        records: () => readUsageLog(fs29, paths.usageLogDir, { sinceMs: nowMs - FIVE_HOUR_WINDOW_MS }).records.filter((record2) => record2.identity === identity),
         sessions,
         sessionId,
         nowMs
@@ -149492,7 +149701,7 @@ function createCompactionDeps(wiring) {
     },
     acquire: (identity) => {
       try {
-        const lock = acquireIdentityLock({ identity: `compact-${identity}`, dir: superviseDirOf(paths, pool), fs: fs28, nowMs: wiring.now, pid: wiring.pid, isRunning: wiring.isRunning, sleep: wiring.sleep, maxAttempts: 1, staleAfterMs: COMPACT_SLOT_STALE_MS });
+        const lock = acquireIdentityLock({ identity: `compact-${identity}`, dir: superviseDirOf(paths, pool), fs: fs29, nowMs: wiring.now, pid: wiring.pid, isRunning: wiring.isRunning, sleep: wiring.sleep, maxAttempts: 1, staleAfterMs: COMPACT_SLOT_STALE_MS });
         return { release: lock.release };
       } catch (error63) {
         if (error63 instanceof IdentityLockBusyError) {
@@ -149503,8 +149712,8 @@ function createCompactionDeps(wiring) {
     },
     compact: wiring.compact,
     markCompacted: (sessionId, compacted) => {
-      const previous = readSessionState(fs28, paths, pool, sessionId);
-      writeSessionState(fs28, paths, pool, sessionId, {
+      const previous = readSessionState(fs29, paths, pool, sessionId);
+      writeSessionState(fs29, paths, pool, sessionId, {
         mark: previous?.mark ?? "idle",
         ...previous?.contextTokens === void 0 ? {} : { contextTokens: previous.contextTokens },
         ...compacted ? { compacted: true } : {},
@@ -149516,12 +149725,12 @@ function createCompactionDeps(wiring) {
 
 // src/supervise/limit.ts
 init_read();
-function quotaHitOf(fs28, paths, identity, sessionId, sinceMs, nowMs) {
-  const reason = refusalReason(identity, readUsageSnapshot(fs28, paths.usageSnapshotsDir, identity), nowMs);
+function quotaHitOf(fs29, paths, identity, sessionId, sinceMs, nowMs) {
+  const reason = refusalReason(identity, readUsageSnapshot(fs29, paths.usageSnapshotsDir, identity), nowMs);
   if (reason === void 0) {
     return void 0;
   }
-  const { records } = readUsageLog(fs28, paths.usageLogDir, { sinceMs });
+  const { records } = readUsageLog(fs29, paths.usageLogDir, { sinceMs });
   for (let index = records.length - 1; index >= 0; index -= 1) {
     const record2 = records[index];
     if (record2?.sessionId === sessionId && record2.identity === identity && record2.limit?.kind === "quota-exhausted") {
@@ -149641,7 +149850,7 @@ function createIdentityMover(deps) {
 
 // src/supervise/realPorts.ts
 var import_node_child_process10 = require("node:child_process");
-var import_node_fs26 = __toESM(require("node:fs"), 1);
+var import_node_fs27 = __toESM(require("node:fs"), 1);
 init_realPorts();
 var realSupervisedSpawnPort = {
   spawn(command, args, options) {
@@ -149687,7 +149896,7 @@ var realTimerPort = {
 function realWatchDirectory(directory, accepts, what, log) {
   return (onChange) => {
     realFarmFs.mkdirPrivate(directory);
-    const watcher = import_node_fs26.default.watch(directory, { persistent: false }, (_event, filename) => {
+    const watcher = import_node_fs27.default.watch(directory, { persistent: false }, (_event, filename) => {
       if (filename === null || accepts(filename)) {
         onChange();
       }