claude-use 11.62.3 → 11.64.0

package/dist/index.mjs

@@ -306,7 +306,7 @@ var init_statusline = __esm({
     init_graphemes();
     init_languages();
     STATUSLINE_HEADER_SEGMENTS = ["model", "provider", "route", "account", "identity", "headroom", "project", "vcs", "effort", "advisor", "version", "outputStyle", "cost", "dailyCost", "sessionName", "duration", "speed"];
-    STATUSLINE_ROWS = ["context", "quota", "addedDirs", "gitFiles", "memory", "environment", "sessionTime", "promptCache", "compactions", "tokens"];
+    STATUSLINE_ROWS = ["context", "quota", "addedDirs", "gitFiles", "memory", "environment", "sessionTime", "promptCache", "compactions", "tokens", "tools", "skills", "mcp", "agents", "todos"];
     STATUSLINE_SESSION_TIME_PARTS = ["started", "lastReply"];
     PROMPT_CACHE_TTL_SECONDS = { fiveMinutes: 300, oneHour: 3600 };
     STATUSLINE_COLOUR_NAMES = [
@@ -337,13 +337,13 @@ var init_statusline = __esm({
     PRESET_BUNDLES = {
       standard: { layout: { header: DEFAULT_HEADER_SEGMENTS, rows: DEFAULT_ROWS }, git: GIT_WITH_DIRTY_MARKER, jj: JJ_OFF, usage: { resetLabel: false }, context: { breakdown: "never" } },
       full: {
-        layout: { header: ["model", "project", "vcs", "effort", "advisor", "version", "outputStyle", "cost", "sessionName", "duration"], rows: ["context", "quota", "addedDirs", "memory", "environment", "promptCache", "compactions", "tokens"] },
+        layout: { header: ["model", "project", "vcs", "effort", "advisor", "version", "outputStyle", "cost", "sessionName", "duration"], rows: ["context", "quota", "addedDirs", "memory", "environment", "tools", "skills", "mcp", "agents", "todos", "promptCache", "compactions", "tokens"] },
         git: GIT_WITH_DIRTY_MARKER,
         jj: { enabled: true, showDirty: true, showConflicts: true },
         usage: { resetLabel: true },
         context: { breakdown: "critical" }
       },
-      essential: { layout: { header: ["model", "project", "vcs", "duration"], rows: ["context", "addedDirs"] }, git: GIT_WITH_DIRTY_MARKER, jj: JJ_OFF, usage: { resetLabel: true }, context: { breakdown: "never" } },
+      essential: { layout: { header: ["model", "project", "vcs", "duration"], rows: ["context", "addedDirs", "tools", "agents", "todos"] }, git: GIT_WITH_DIRTY_MARKER, jj: JJ_OFF, usage: { resetLabel: true }, context: { breakdown: "never" } },
       minimal: { layout: { header: ["model", "project", "vcs"], rows: ["context", "addedDirs"] }, git: GIT_WITH_DIRTY_MARKER, jj: JJ_OFF, usage: { resetLabel: true }, context: { breakdown: "never" } }
     };
     STATUSLINE_PATH_LEVELS = ["1", "2", "3", "full"];
@@ -459,6 +459,10 @@ var init_statusline = __esm({
       promptCache: {
         ttlSeconds: z2.number().int().min(1).describe("How long the prompt cache lives, in seconds, when the transcript has not yet shown which tier the session writes (five minutes or one hour); the tier the transcript shows takes over once it does.")
       },
+      tools: {
+        nameMaxLength: z2.number().int().min(0).describe("The most terminal columns of a tool's name the tools row draws, cut with an ellipsis. With a limit set, a tool of an MCP server is shown by its own name, without the server's, whether or not it needs cutting. 0 draws every name whole, an MCP tool's with its server."),
+        maxVisible: z2.number().int().min(0).describe("The most kinds of finished tool call the tools row names, the most-used first, with the rest counted as +N more. 0 names every kind.")
+      },
       colours: {
         context: colourValue.describe("The colour of the context bar and its figures below the warning threshold."),
         usage: colourValue.describe("The colour of the quota bars and their figures below the warning threshold."),
@@ -470,7 +474,9 @@ var init_statusline = __esm({
         empty: colourValue.describe("The colour of the unused part of a bar."),
         project: colourValue.describe("The colour of the project path segment."),
         git: colourValue.describe("The colour of the version control segment's wrapper text (`git:(` and `)`)."),
-        gitBranch: colourValue.describe("The colour of the branch or bookmark and its ahead, behind and dirty markers.")
+        gitBranch: colourValue.describe("The colour of the branch or bookmark and its ahead, behind and dirty markers."),
+        activity: colourValue.describe("The colour of the names of the tools, skills and MCP servers the tools, skills and mcp rows draw. Their running markers take colours.warning and their finished markers colours.context."),
+        agent: colourValue.describe("The colour of an agent's type in the agents row.")
       },
       project: {
         pathLevels: z2.enum(STATUSLINE_PATH_LEVELS).describe("How many trailing directories of the working directory the project segment shows: 1, 2 or 3, or full for the whole absolute path."),
@@ -497,7 +503,7 @@ var init_statusline = __esm({
     LANGUAGE_ALIASES = { zh: "zh-Hans", "zh-TW": "zh-Hant" };
     TOP_LEVEL = {
       language: z2.enum(STATUSLINE_LANGUAGES).describe(LANGUAGE_DESCRIPTION),
-      preset: z2.enum(STATUSLINE_PRESETS).describe("A named bundle of settings (layout.header, layout.rows, git.enabled, git.showDirty, git.showAheadBehind, git.showLineDiff, jj.enabled, jj.showDirty, jj.showConflicts, usage.resetLabel and context.breakdown) that this layer sets beneath the keys it names itself and above everything the shallower layers set: standard is the statusline's own; full, essential and minimal are claude-hud's presets. Each draws the model, project and version control segments and the context row; full adds the effort, advisor, version, output style, cost, session name and duration segments and the quota, added directories, memory, environment, prompt cache, compactions and session tokens rows, with the token breakdown at high use, essential adds the duration and the added directories row, and minimal adds the added directories row alone.")
+      preset: z2.enum(STATUSLINE_PRESETS).describe("A named bundle of settings (layout.header, layout.rows, git.enabled, git.showDirty, git.showAheadBehind, git.showLineDiff, jj.enabled, jj.showDirty, jj.showConflicts, usage.resetLabel and context.breakdown) that this layer sets beneath the keys it names itself and above everything the shallower layers set: standard is the statusline's own; full, essential and minimal are claude-hud's presets. Each draws the model, project and version control segments and the context row; full adds the effort, advisor, version, output style, cost, session name and duration segments and the quota, added directories, memory, environment, tools, skills, mcp, agents, todos, prompt cache, compactions and session tokens rows, with the token breakdown at high use, essential adds the duration, the added directories row and the tools, agents and todos rows, and minimal adds the added directories row alone.")
     };
     StatuslineSchema = z2.strictObject({
       language: z2.enum(LANGUAGE_TAGS).transform(canonicalLanguage).describe(LANGUAGE_DESCRIPTION).optional(),
@@ -518,6 +524,7 @@ var init_statusline = __esm({
       environment: z2.strictObject(SHAPES.environment).partial().optional(),
       sessionTime: z2.strictObject(SHAPES.sessionTime).partial().optional(),
       promptCache: z2.strictObject(SHAPES.promptCache).partial().optional(),
+      tools: z2.strictObject(SHAPES.tools).partial().optional(),
       colours: z2.strictObject(SHAPES.colours).partial().optional(),
       project: z2.strictObject(SHAPES.project).partial().optional(),
       git: z2.strictObject(SHAPES.git).partial().optional(),
@@ -542,6 +549,7 @@ var init_statusline = __esm({
       environment: z2.strictObject(SHAPES.environment),
       sessionTime: z2.strictObject(SHAPES.sessionTime),
       promptCache: z2.strictObject(SHAPES.promptCache),
+      tools: z2.strictObject(SHAPES.tools),
       colours: z2.strictObject(SHAPES.colours),
       project: z2.strictObject(SHAPES.project),
       git: z2.strictObject(SHAPES.git),
@@ -566,6 +574,7 @@ var init_statusline = __esm({
       environment: { threshold: 0 },
       sessionTime: { parts: [...STATUSLINE_SESSION_TIME_PARTS] },
       promptCache: { ttlSeconds: PROMPT_CACHE_TTL_SECONDS.fiveMinutes },
+      tools: { nameMaxLength: 0, maxVisible: 4 },
       colours: {
         context: "green",
         usage: "green",
@@ -577,7 +586,9 @@ var init_statusline = __esm({
         empty: "brightBlack",
         project: "yellow",
         git: "magenta",
-        gitBranch: "cyan"
+        gitBranch: "cyan",
+        activity: "cyan",
+        agent: "magenta"
       },
       project: { pathLevels: "1", addedDirsLayout: "inline" },
       git: { enabled: true, showDirty: true, showAheadBehind: false, showLineDiff: false, branchOverflow: "truncate", pushWarnAt: 0, pushCriticalAt: 0 },
@@ -3901,12 +3912,13 @@ function pruneDeadFrontDoorSessions(fs14, sessionsDir, listed, isRunning) {
   }
   return removed;
 }
-var FRONT_DOOR_PROTOCOL, FrontDoorSessionSchema, FrontDoorStateSchema, MAX_TCP_PORT, FrontDoorDirectRecordSchema, RECORD_TEMPORARY_FILE;
+var FRONT_DOOR_PROTOCOL, FRONT_DOOR_HANDOVER_PROTOCOL, FrontDoorSessionSchema, FrontDoorStateSchema, MAX_TCP_PORT, FrontDoorDirectRecordSchema, RECORD_TEMPORARY_FILE;
 var init_state = __esm({
   "src/frontdoor/state.ts"() {
     "use strict";
     init_schema();
-    FRONT_DOOR_PROTOCOL = 5;
+    FRONT_DOOR_PROTOCOL = 6;
+    FRONT_DOOR_HANDOVER_PROTOCOL = 6;
     FrontDoorSessionSchema = z5.strictObject({ pid: z5.number().int().positive(), startedAt: z5.number(), token: z5.string().min(1), supervisorPid: z5.number().int().positive().optional(), sessionId: z5.string().min(1).optional(), models: ModelsConfigSchema.optional() });
     FrontDoorStateSchema = z5.strictObject({
       /**
@@ -4003,18 +4015,24 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
     ...lastConnectPort === void 0 ? {} : { lastConnectPort },
     ...lastDirectPort === void 0 ? {} : { lastDirectPort }
   });
+  const { predecessor } = ports;
+  const sourceOf = (listener, preferredPort) => predecessor === void 0 ? { preferredPort } : { inherit: async () => await predecessor.take(listener) };
   const fail = (message) => {
     ports.closeRcStreamHub();
-    writeFrontDoorState(fs14, paths.frontdoorStateFile, { lastError: message, ...sticky() });
-    fs14.removeRecursive(paths.frontdoorLockFile);
+    if (predecessor === void 0) {
+      writeFrontDoorState(fs14, paths.frontdoorStateFile, { lastError: message, ...sticky() });
+      fs14.removeRecursive(paths.frontdoorLockFile);
+    }
     ports.log(`agent-shim frontdoor supervisor: ${message}`);
     return 1;
   };
-  writeFrontDoorState(fs14, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, ...sticky() });
+  if (predecessor === void 0) {
+    writeFrontDoorState(fs14, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, ...sticky() });
+  }
   const previousSticky = lastPort;
   let http3;
   try {
-    http3 = await ports.startProviderListener(lastPort);
+    http3 = await ports.startProviderListener(sourceOf("provider", lastPort));
   } catch (error) {
     ports.doorHealth.listenerFailed("provider", error instanceof Error ? error.message : String(error));
     return fail(`could not start the provider listener: ${error instanceof Error ? error.message : String(error)}`);
@@ -4026,7 +4044,7 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
   const previousStickyConnect = lastConnectPort;
   let connect3;
   try {
-    connect3 = await ports.startConnectListener(lastConnectPort);
+    connect3 = await ports.startConnectListener(sourceOf("connect", lastConnectPort));
   } catch (error) {
     await http3.close();
     ports.doorHealth.listenerFailed("connect", error instanceof Error ? error.message : String(error));
@@ -4039,7 +4057,7 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
   const previousStickyDirect = lastDirectPort;
   let direct;
   try {
-    direct = await ports.startDirectListener(lastDirectPort);
+    direct = await ports.startDirectListener(sourceOf("direct", lastDirectPort));
   } catch (error) {
     await connect3.close();
     await http3.close();
@@ -4053,8 +4071,12 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
   writeFrontDoorDirectRecord(fs14, paths.frontdoorDirectRecordsDir, { pid: ports.ownPid, directPort: direct.port });
   writeFrontDoorState(fs14, paths.frontdoorStateFile, { protocol: FRONT_DOOR_PROTOCOL, supervisorPid: ports.ownPid, port: http3.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
   ports.doorHealth.generation({ providerPort: http3.port, connectPort: connect3.port, directPort: direct.port });
-  fs14.removeRecursive(paths.frontdoorLockFile);
-  ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http3.port)}, CONNECT surface on 127.0.0.1:${String(connect3.port)}`);
+  if (predecessor === void 0) {
+    fs14.removeRecursive(paths.frontdoorLockFile);
+  } else {
+    predecessor.serving();
+  }
+  ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http3.port)}, CONNECT surface on 127.0.0.1:${String(connect3.port)}${predecessor === void 0 ? "" : ", taken over from the door it replaced"}`);
   const watchdog = ports.startWatchdog?.();
   let idleSince;
   let ticks = 0;
@@ -4074,14 +4096,16 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
         resolve();
       };
       ports.retire?.addEventListener("abort", wake, { once: true });
+      ports.handover?.requested.addEventListener("abort", wake, { once: true });
       void ports.sleep(FRONTDOOR_POLL_MS).then(() => {
         ports.retire?.removeEventListener("abort", wake);
+        ports.handover?.requested.removeEventListener("abort", wake);
         resolve();
       });
     });
   };
   const retireByDrain = async () => {
-    ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: asked to exit; releasing the front door's addresses and finishing the connections it carries`);
+    ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: releasing the front door's addresses and finishing the connections it carries`);
     watchdog?.stop();
     ports.stopBackgroundWork?.();
     const drained = [direct.drain(), connect3.drain(), http3.drain()];
@@ -4096,6 +4120,17 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
     ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: the connections this door carried have ended; exiting`);
     return 0;
   };
+  const handOverThenDrain = async (run) => {
+    ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: asked to hand the front door's listeners to a successor; accepting on them until it serves`);
+    const outcome = await run({ provider: http3.listening, connect: connect3.listening, direct: direct.listening });
+    if (outcome.ok) {
+      ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: successor ${String(outcome.successorPid)} serves the front door's listeners`);
+      ports.doorHealth.superseded(outcome.successorPid);
+    } else {
+      ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: the handover failed (${outcome.reason}); retiring by drain so a successor is started on the released addresses`);
+    }
+    return await retireByDrain();
+  };
   const closeServing = async () => {
     watchdog?.stop();
     await direct.close();
@@ -4113,8 +4148,12 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
   };
   for (; ; ) {
     if (ports.retire?.aborted === true) {
+      ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: asked to exit`);
       return await retireByDrain();
     }
+    if (ports.handover?.requested.aborted === true && supersededBy === void 0) {
+      return await handOverThenDrain(ports.handover.run);
+    }
     if (options.tickLimit !== void 0 && ticks >= options.tickLimit) {
       watchdog?.stop();
       return FRONTDOOR_SUPERVISOR_STILL_RUNNING;
@@ -4252,8 +4291,10 @@ function caParses(ca) {
     return false;
   }
 }
-async function startConnectServer(config, effects, preferredPort) {
+async function startConnectServer(config, effects, source) {
   const tunnelTokens = /* @__PURE__ */ new WeakMap();
+  const ledger = createConnectionLedger(config.limits, config.isLiveCapability);
+  const lateSessionDeadlines = /* @__PURE__ */ new WeakMap();
   const onUpgrade = (host) => (request4, socket, head) => {
     config.capture?.upgrade(request4);
     if (head.length > 0) {
@@ -4275,6 +4316,12 @@ ${request4.rawHeaders.reduce((accumulated, value, index) => index % 2 === 0 ? `$
       return { host, serveSecure: serveSecure2, tlsAcceptor: tlsAcceptor2 };
     }
     const handleHostRequest = async (request4, response) => {
+      if (ledger.retiring()) {
+        clearTimeout(lateSessionDeadlines.get(request4.socket));
+        response.once("close", () => {
+          request4.socket.end();
+        });
+      }
       if (config.localSurface !== void 0 && await config.localSurface.serve(host, request4, response)) {
         return;
       }
@@ -4294,13 +4341,19 @@ ${request4.rawHeaders.reduce((accumulated, value, index) => index % 2 === 0 ? `$
     const httpSession = effects.createHttpSession(handler, onUpgrade(host));
     const serveSecure = (secure, capability) => {
       tunnelTokens.set(secure, capability);
+      if (ledger.retiring()) {
+        const deadline = setTimeout(() => {
+          secure.destroy();
+        }, config.limits.headDeadlineMs);
+        deadline.unref();
+        lateSessionDeadlines.set(secure, deadline);
+      }
       httpSession.serve(secure);
     };
     const tlsAcceptor = effects.createTlsAcceptor(config.leafFor(host), serveSecure);
     return { host, serveSecure, httpSession, tlsAcceptor };
   });
-  const ledger = createConnectionLedger(config.limits, config.isLiveCapability);
-  const listener = await effects.listenLoopback(preferredPort, (socket) => {
+  const listener = await effects.listenLoopback(source, (socket) => {
     handleConnect(socket, { config, effects, sessions, ledger });
   });
   const apiSession = sessions.find((session) => session.host === config.routedHost);
@@ -4313,7 +4366,7 @@ ${request4.rawHeaders.reduce((accumulated, value, index) => index % 2 === 0 ? `$
     }
     session.serveSecure(secure, config.transparentCapability ?? "");
   });
-  const transparent = config.transparentPort === void 0 || apiSession === void 0 ? void 0 : await effects.listenLoopback(config.transparentPort, (socket) => {
+  const transparent = config.transparentPort === void 0 || apiSession === void 0 ? void 0 : await effects.listenLoopback({ preferredPort: config.transparentPort }, (socket) => {
     sniAcceptor.accept(socket);
   });
   const closeSurface = async () => {
@@ -4328,6 +4381,7 @@ ${request4.rawHeaders.reduce((accumulated, value, index) => index % 2 === 0 ? `$
   };
   return {
     port: listener.port,
+    listening: listener.listening,
     ...transparent === void 0 ? {} : { transparentPort: transparent.port },
     openTunnels: ledger.openTunnels,
     drain: async () => {
@@ -4344,7 +4398,9 @@ function createConnectionLedger(limits, isLiveCapability2) {
   const authenticated = /* @__PURE__ */ new Map();
   let tunnels = 0;
   const blind = /* @__PURE__ */ new Set();
-  let onNoBlindTunnels;
+  const live = /* @__PURE__ */ new Set();
+  let retiring = false;
+  let onNoConnections;
   const leavePending = (socket) => {
     const deadline = pending.get(socket);
     if (deadline !== void 0) {
@@ -4376,20 +4432,19 @@ function createConnectionLedger(limits, isLiveCapability2) {
           refuse(socket, REFUSAL.requestTimeout);
         }, limits.headDeadlineMs)
       );
+      live.add(socket);
       socket.once("close", () => {
         leavePending(socket);
+        live.delete(socket);
+        if (live.size === 0) {
+          onNoConnections?.();
+        }
       });
     },
     headReceived: leavePending,
     openTunnels: () => tunnels,
     retire: async () => {
-      for (const socket of pending.keys()) {
-        socket.destroy();
-      }
-      for (const deadline of pending.values()) {
-        clearTimeout(deadline);
-      }
-      pending.clear();
+      retiring = true;
       for (const sockets of authenticated.values()) {
         for (const socket of sockets) {
           if (!blind.has(socket)) {
@@ -4397,12 +4452,13 @@ function createConnectionLedger(limits, isLiveCapability2) {
           }
         }
       }
-      if (blind.size > 0) {
+      if (live.size > 0) {
         await new Promise((resolve) => {
-          onNoBlindTunnels = resolve;
+          onNoConnections = resolve;
         });
       }
     },
+    retiring: () => retiring,
     establish: (socket, capability, kind) => {
       if (tunnels >= limits.maxTunnels) {
         return false;
@@ -4417,9 +4473,6 @@ function createConnectionLedger(limits, isLiveCapability2) {
       socket.once("close", () => {
         tunnels -= 1;
         blind.delete(socket);
-        if (blind.size === 0) {
-          onNoBlindTunnels?.();
-        }
         sockets.delete(socket);
         if (sockets.size === 0 && authenticated.get(capability) === sockets) {
           authenticated.delete(capability);
@@ -4627,7 +4680,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "claude-use",
-      version: "11.62.3",
+      version: "11.64.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -10154,7 +10207,8 @@ var init_replacement = __esm({
 import { randomUUID as randomUUID3 } from "node:crypto";
 function ensureFrontDoor(params) {
   const { paths, ports } = params;
-  const deadline = ports.now() + FRONTDOOR_START_TIMEOUT_MS;
+  const startedAt = ports.now();
+  let deadline = startedAt + FRONTDOOR_START_TIMEOUT_MS;
   let spawned = false;
   let replaced = false;
   const distrusted = /* @__PURE__ */ new Set();
@@ -10194,6 +10248,19 @@ function ensureFrontDoor(params) {
       ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
     }
   };
+  const handOverAndAwait = (supervisorPid, doorProtocol, reason, request4) => {
+    recordReplacement(supervisorPid, doorProtocol, reason, "SIGUSR2");
+    request4(supervisorPid);
+    const waitEnds = ports.now() + FRONTDOOR_START_TIMEOUT_MS + FRONTDOOR_EXIT_GRACE_MS;
+    deadline += FRONTDOOR_START_TIMEOUT_MS + FRONTDOOR_EXIT_GRACE_MS;
+    while (ports.isRunning(supervisorPid) && readFrontDoorState(ports.fs, paths.frontdoorStateFile)?.supervisorPid === supervisorPid) {
+      if (ports.now() >= waitEnds) {
+        stopAndAwaitExit(supervisorPid, doorProtocol, reason, `the front door (pid ${String(supervisorPid)}) did not act on a request to hand its listeners over, and did not exit when asked to`);
+        return;
+      }
+      ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
+    }
+  };
   for (; ; ) {
     const state = readFrontDoorState(ports.fs, paths.frontdoorStateFile);
     const supervisorPid = state?.supervisorPid;
@@ -10207,12 +10274,16 @@ function ensureFrontDoor(params) {
         const verdict = verifyWithRetry(state.port);
         const doorProtocol = state.protocol ?? 0;
         if (verdict.ok && !replaced && !spawned && (params.replace !== void 0 || doorProtocol < FRONT_DOOR_PROTOCOL)) {
-          stopAndAwaitExit(
-            supervisorPid,
-            doorProtocol,
-            params.replace ?? "protocol-older",
-            `the front door (pid ${String(supervisorPid)}, protocol ${String(doorProtocol)}; this launcher speaks protocol ${String(FRONT_DOOR_PROTOCOL)}) was asked to be replaced and did not exit`
-          );
+          if (params.replace !== void 0 && doorProtocol >= FRONT_DOOR_HANDOVER_PROTOCOL && ports.requestHandover !== void 0 && ports.isFrontDoorSupervisor(supervisorPid)) {
+            handOverAndAwait(supervisorPid, doorProtocol, params.replace, ports.requestHandover);
+          } else {
+            stopAndAwaitExit(
+              supervisorPid,
+              doorProtocol,
+              params.replace ?? "protocol-older",
+              `the front door (pid ${String(supervisorPid)}, protocol ${String(doorProtocol)}; this launcher speaks protocol ${String(FRONT_DOOR_PROTOCOL)}) was asked to be replaced and did not exit`
+            );
+          }
           replaced = true;
           continue;
         }
@@ -10264,7 +10335,7 @@ function ensureFrontDoor(params) {
     if (ports.now() >= deadline) {
       const lastError = state?.lastError;
       throw new FrontDoorStartError(
-        `the front door did not become ready within ${String(FRONTDOOR_START_TIMEOUT_MS)}ms` + (lastError === void 0 ? "" : ` (last error: ${lastError})`) + (lastRejection === void 0 ? "" : ` (${lastRejection})`) + (busyDoor === void 0 ? "" : `. It was not replaced because ${String(busyDoor.sessions)} live session(s) are using it and would lose their connections; run \`agent-shim frontdoor restart\` to replace it deliberately`) + `. Daemon log: ${paths.frontdoorLogPath}`
+        `the front door did not become ready within ${String(deadline - startedAt)}ms` + (lastError === void 0 ? "" : ` (last error: ${lastError})`) + (lastRejection === void 0 ? "" : ` (${lastRejection})`) + (busyDoor === void 0 ? "" : `. It was not replaced because ${String(busyDoor.sessions)} live session(s) are using it and would lose their connections; run \`agent-shim frontdoor restart\` to replace it deliberately`) + `. Daemon log: ${paths.frontdoorLogPath}`
       );
     }
     ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
@@ -11907,6 +11978,12 @@ function realEnsurePorts(paths, spawnDaemon) {
     killSupervisor: (pid) => {
       process.kill(pid, "SIGKILL");
     },
+    // Windows has no user signals (Node refuses to send one), so a replacement there keeps the stop-and-start path.
+    ...process.platform === "win32" ? {} : {
+      requestHandover: (pid) => {
+        process.kill(pid, "SIGUSR2");
+      }
+    },
     // Read fresh for each probe: a replacement supervisor may have regenerated an unparseable CA, and the probe must trust exactly what the serving door's leaf chains to.
     verifyListener: (port) => probeFrontDoorSync(port, fs13.readFileSync(paths.frontdoorCaCertFile, "utf8"))
   };
@@ -14336,7 +14413,7 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
 function realConnectEffects(ports = DOOR_SOURCE_PORTS) {
   const plainAgent = new ExemptHttpAgent(ports);
   const tlsAgent = new ExemptTlsAgent(ports);
-  const listenOnce = async (port, onSocket) => await new Promise((resolve, reject) => {
+  const listenOnce = async (target, onSocket) => await new Promise((resolve, reject) => {
     const accepted = /* @__PURE__ */ new Set();
     const server = net2.createServer((socket) => {
       accepted.add(socket);
@@ -14346,7 +14423,7 @@ function realConnectEffects(ports = DOOR_SOURCE_PORTS) {
       onSocket(socket);
     });
     server.once("error", reject);
-    server.listen(port, "127.0.0.1", () => {
+    const onListening = () => {
       const address = server.address();
       const bound = typeof address === "object" && address !== null ? address.port : 0;
       if (bound === 0) {
@@ -14355,6 +14432,7 @@ function realConnectEffects(ports = DOOR_SOURCE_PORTS) {
       }
       resolve({
         port: bound,
+        listening: server,
         // The listening socket is released by `close` at once; the connections already accepted are untouched and keep the server's `close` callback pending until they end.
         stopAccepting: () => {
           server.close();
@@ -14370,10 +14448,19 @@ function realConnectEffects(ports = DOOR_SOURCE_PORTS) {
           });
         }
       });
-    });
+    };
+    if (typeof target === "number") {
+      server.listen(target, "127.0.0.1", onListening);
+    } else {
+      server.listen(target, onListening);
+    }
   });
   return {
-    listenLoopback: async (preferredPort, onSocket) => {
+    listenLoopback: async (source, onSocket) => {
+      if ("inherit" in source) {
+        return await listenOnce(await source.inherit(), onSocket);
+      }
+      const { preferredPort } = source;
       if (preferredPort !== void 0) {
         try {
           return await listenOnce(preferredPort, onSocket);