claude-use 11.7.0 → 11.8.1

package/dist/cli.cjs

@@ -27201,10 +27201,10 @@ var init_schema = __esm({
 });
 
 // src/frontdoor/state.ts
-function readFrontDoorState(fs23, stateFile) {
+function readFrontDoorState(fs24, stateFile) {
   let raw;
   try {
-    raw = fs23.readFileUtf8(stateFile);
+    raw = fs24.readFileUtf8(stateFile);
   } catch {
     return void 0;
   }
@@ -27218,9 +27218,9 @@ function readFrontDoorState(fs23, stateFile) {
     return void 0;
   }
 }
-function writeFrontDoorState(fs23, stateFile, state) {
-  fs23.mkdirp(import_node_path5.default.dirname(stateFile));
-  fs23.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
+function writeFrontDoorState(fs24, stateFile, state) {
+  fs24.mkdirp(import_node_path5.default.dirname(stateFile));
+  fs24.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
 `);
 }
 function directOrigin(port) {
@@ -27230,27 +27230,27 @@ function frontDoorOrigin(state) {
   const port = state?.directPort ?? state?.lastDirectPort;
   return port === void 0 ? void 0 : directOrigin(port);
 }
-function writeFrontDoorDirectRecord(fs23, recordsDir, record2) {
-  fs23.mkdirp(recordsDir);
-  fs23.writeFilePrivate(import_node_path5.default.join(recordsDir, `${String(record2.pid)}.json`), `${JSON.stringify({ directPort: record2.directPort })}
+function writeFrontDoorDirectRecord(fs24, recordsDir, record2) {
+  fs24.mkdirp(recordsDir);
+  fs24.writeFilePrivate(import_node_path5.default.join(recordsDir, `${String(record2.pid)}.json`), `${JSON.stringify({ directPort: record2.directPort })}
 `);
 }
-function removeFrontDoorDirectRecord(fs23, recordsDir, pid) {
-  fs23.removeRecursive(import_node_path5.default.join(recordsDir, `${String(pid)}.json`));
+function removeFrontDoorDirectRecord(fs24, recordsDir, pid) {
+  fs24.removeRecursive(import_node_path5.default.join(recordsDir, `${String(pid)}.json`));
 }
 function recordPid(file2) {
   const pidText = /^([1-9]\d*)\.json$/.exec(file2)?.[1];
   const pid = pidText === void 0 ? void 0 : Number(pidText);
   return pid !== void 0 && Number.isSafeInteger(pid) ? pid : void 0;
 }
-function readDirectRecordEntry(fs23, recordsDir, file2) {
+function readDirectRecordEntry(fs24, recordsDir, file2) {
   const pid = recordPid(file2);
   if (pid === void 0) {
     return void 0;
   }
   let raw;
   try {
-    raw = fs23.readFileUtf8(import_node_path5.default.join(recordsDir, file2));
+    raw = fs24.readFileUtf8(import_node_path5.default.join(recordsDir, file2));
   } catch {
     return void 0;
   }
@@ -27264,44 +27264,44 @@ function readDirectRecordEntry(fs23, recordsDir, file2) {
     return { malformed: true };
   }
 }
-function listFrontDoorDirectRecords(fs23, recordsDir) {
-  return fs23.readdir(recordsDir).flatMap((file2) => {
-    const entry = readDirectRecordEntry(fs23, recordsDir, file2);
+function listFrontDoorDirectRecords(fs24, recordsDir) {
+  return fs24.readdir(recordsDir).flatMap((file2) => {
+    const entry = readDirectRecordEntry(fs24, recordsDir, file2);
     return entry?.record === void 0 ? [] : [entry.record];
   }).sort((a10, b) => a10.pid - b.pid);
 }
-function pruneMalformedFrontDoorDirectFiles(fs23, recordsDir, isRunning) {
-  for (const file2 of fs23.readdir(recordsDir)) {
+function pruneMalformedFrontDoorDirectFiles(fs24, recordsDir, isRunning) {
+  for (const file2 of fs24.readdir(recordsDir)) {
     const writer = RECORD_TEMPORARY_FILE.exec(file2)?.[1];
     const stale = writer !== void 0 && !isRunning(Number(writer));
-    if (stale || readDirectRecordEntry(fs23, recordsDir, file2)?.malformed === true) {
-      fs23.removeRecursive(import_node_path5.default.join(recordsDir, file2));
+    if (stale || readDirectRecordEntry(fs24, recordsDir, file2)?.malformed === true) {
+      fs24.removeRecursive(import_node_path5.default.join(recordsDir, file2));
     }
   }
 }
 function liveFrontDoorDirectRecords(records, liveness) {
   return records.filter((record2) => liveness.doors.has(record2.pid) || liveness.unknown.has(record2.pid));
 }
-function pruneDeadFrontDoorDirectRecords(fs23, recordsDir, records, liveness) {
+function pruneDeadFrontDoorDirectRecords(fs24, recordsDir, records, liveness) {
   for (const record2 of records) {
     if (!liveness.doors.has(record2.pid) && !liveness.unknown.has(record2.pid)) {
-      removeFrontDoorDirectRecord(fs23, recordsDir, record2.pid);
+      removeFrontDoorDirectRecord(fs24, recordsDir, record2.pid);
     }
   }
 }
-function writeFrontDoorSession(fs23, sessionsDir, session) {
-  fs23.mkdirPrivate(sessionsDir);
-  fs23.writeFilePrivate(import_node_path5.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
+function writeFrontDoorSession(fs24, sessionsDir, session) {
+  fs24.mkdirPrivate(sessionsDir);
+  fs24.writeFilePrivate(import_node_path5.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
 `);
 }
-function listFrontDoorSessions(fs23, sessionsDir) {
+function listFrontDoorSessions(fs24, sessionsDir) {
   const sessions = [];
-  for (const name of fs23.readdir(sessionsDir)) {
+  for (const name of fs24.readdir(sessionsDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs23.readFileUtf8(import_node_path5.default.join(sessionsDir, name)) ?? ""));
+      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs24.readFileUtf8(import_node_path5.default.join(sessionsDir, name)) ?? ""));
       if (parsed.success) {
         sessions.push({ pid: parsed.data.pid, startedAt: parsed.data.startedAt, ...parsed.data.supervisorPid === void 0 ? {} : { supervisorPid: parsed.data.supervisorPid } });
       }
@@ -27311,27 +27311,27 @@ function listFrontDoorSessions(fs23, sessionsDir) {
   }
   return sessions.sort((a10, b) => a10.pid - b.pid);
 }
-function removeFrontDoorSession(fs23, sessionsDir, pid) {
-  fs23.removeRecursive(import_node_path5.default.join(sessionsDir, `${String(pid)}.json`));
+function removeFrontDoorSession(fs24, sessionsDir, pid) {
+  fs24.removeRecursive(import_node_path5.default.join(sessionsDir, `${String(pid)}.json`));
 }
-function pruneDeadFrontDoorSessions(fs23, sessionsDir, isRunning) {
+function pruneDeadFrontDoorSessions(fs24, sessionsDir, isRunning) {
   const removed = [];
-  for (const session of listFrontDoorSessions(fs23, sessionsDir)) {
+  for (const session of listFrontDoorSessions(fs24, sessionsDir)) {
     if (!isRunning(session.pid)) {
-      removeFrontDoorSession(fs23, sessionsDir, session.pid);
+      removeFrontDoorSession(fs24, sessionsDir, session.pid);
       removed.push(session.pid);
     }
   }
   return removed;
 }
-function liveSessionTokens(fs23, sessionsDir) {
+function liveSessionTokens(fs24, sessionsDir) {
   const tokens = /* @__PURE__ */ new Set();
-  for (const name of fs23.readdir(sessionsDir)) {
+  for (const name of fs24.readdir(sessionsDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs23.readFileUtf8(import_node_path5.default.join(sessionsDir, name)) ?? ""));
+      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs24.readFileUtf8(import_node_path5.default.join(sessionsDir, name)) ?? ""));
       if (parsed.success) {
         tokens.add(parsed.data.token);
       }
@@ -27393,43 +27393,43 @@ function parseJson(raw, schema) {
   const parsed = schema.safeParse(JSON.parse(raw));
   return parsed.success ? parsed.data : void 0;
 }
-function readHeadroomState(fs23, stateFile) {
+function readHeadroomState(fs24, stateFile) {
   try {
-    return parseJson(fs23.readFileUtf8(stateFile), HeadroomStateSchema);
+    return parseJson(fs24.readFileUtf8(stateFile), HeadroomStateSchema);
   } catch {
     return void 0;
   }
 }
-function writeHeadroomState(fs23, stateFile, state) {
-  fs23.mkdirp(import_node_path6.default.dirname(stateFile));
-  fs23.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
+function writeHeadroomState(fs24, stateFile, state) {
+  fs24.mkdirp(import_node_path6.default.dirname(stateFile));
+  fs24.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
 `);
 }
-function resolveServingHeadroomState(fs23, files, isRunning) {
-  const current = readHeadroomState(fs23, files.stateFile);
+function resolveServingHeadroomState(fs24, files, isRunning) {
+  const current = readHeadroomState(fs24, files.stateFile);
   if (current !== void 0) {
     return { path: files.stateFile, state: current };
   }
-  const legacy = readHeadroomState(fs23, files.legacyStateFile);
+  const legacy = readHeadroomState(fs24, files.legacyStateFile);
   if (legacy?.supervisorPid !== void 0 && isRunning(legacy.supervisorPid)) {
     return { path: files.legacyStateFile, state: legacy };
   }
   return void 0;
 }
-function migrateHeadroomState(fs23, files, isRunning) {
-  const legacy = readHeadroomState(fs23, files.legacyStateFile);
+function migrateHeadroomState(fs24, files, isRunning) {
+  const legacy = readHeadroomState(fs24, files.legacyStateFile);
   const legacyLive = legacy?.supervisorPid !== void 0 && isRunning(legacy.supervisorPid);
-  const current = readHeadroomState(fs23, files.stateFile);
+  const current = readHeadroomState(fs24, files.stateFile);
   if (current !== void 0 || legacyLive) {
-    if (!legacyLive && fs23.readFileUtf8(files.legacyStateFile) !== void 0) {
-      fs23.removeRecursive(files.legacyStateFile);
+    if (!legacyLive && fs24.readFileUtf8(files.legacyStateFile) !== void 0) {
+      fs24.removeRecursive(files.legacyStateFile);
     }
     return;
   }
   if (legacy !== void 0) {
-    writeHeadroomState(fs23, files.stateFile, legacy);
+    writeHeadroomState(fs24, files.stateFile, legacy);
   }
-  fs23.removeRecursive(files.legacyStateFile);
+  fs24.removeRecursive(files.legacyStateFile);
 }
 function hashAllowlist(allowlist) {
   return (0, import_node_crypto2.createHash)("sha256").update(allowlist.join("\n")).digest("hex");
@@ -27462,27 +27462,27 @@ function isAdmissibleUrl(entry) {
 function parseAllowlistFile(content) {
   return content.replace(/^\uFEFF/, "").replace(ALLOWLIST_FILE_COMMENT, "").split(ALLOWLIST_FILE_SEPARATORS).map((entry) => entry.replace(ALLOWLIST_SURROUNDING_WHITESPACE, "")).filter((entry) => entry !== "" && !ALLOWLIST_ENTRY_WHITESPACE.test(entry) && (entry.includes("://") ? isAdmissibleUrl(entry) : isBareHost(entry)));
 }
-function writeAllowlistFile(fs23, allowlistFile, allowlist) {
-  fs23.mkdirPrivate(import_node_path6.default.dirname(allowlistFile));
-  fs23.writeFilePrivate(allowlistFile, formatAllowlistFile(allowlist));
+function writeAllowlistFile(fs24, allowlistFile, allowlist) {
+  fs24.mkdirPrivate(import_node_path6.default.dirname(allowlistFile));
+  fs24.writeFilePrivate(allowlistFile, formatAllowlistFile(allowlist));
 }
-function pruneStaleAllowlistTemporaries(fs23, allowlistFile, isRunning) {
+function pruneStaleAllowlistTemporaries(fs24, allowlistFile, isRunning) {
   const prefix = `${import_node_path6.default.basename(allowlistFile)}.`;
-  for (const name of fs23.readdir(import_node_path6.default.dirname(allowlistFile))) {
+  for (const name of fs24.readdir(import_node_path6.default.dirname(allowlistFile))) {
     const writer = name.startsWith(prefix) ? /^([1-9]\d*)\.tmp$/.exec(name.slice(prefix.length))?.[1] : void 0;
     if (writer !== void 0 && !isRunning(Number(writer))) {
-      fs23.removeRecursive(import_node_path6.default.join(import_node_path6.default.dirname(allowlistFile), name));
+      fs24.removeRecursive(import_node_path6.default.join(import_node_path6.default.dirname(allowlistFile), name));
     }
   }
 }
-function readAllProviders(fs23, providersDir) {
+function readAllProviders(fs24, providersDir) {
   const result = [];
-  for (const name of fs23.readdir(providersDir)) {
+  for (const name of fs24.readdir(providersDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = parseJson(fs23.readFileUtf8(import_node_path6.default.join(providersDir, name)), ProviderSchema);
+      const parsed = parseJson(fs24.readFileUtf8(import_node_path6.default.join(providersDir, name)), ProviderSchema);
       if (parsed !== void 0) {
         result.push({ name: name.slice(0, -".json".length), provider: parsed });
       }
@@ -27492,22 +27492,22 @@ function readAllProviders(fs23, providersDir) {
   }
   return result;
 }
-function writeSession(fs23, sessionsDir, session) {
-  fs23.mkdirp(sessionsDir);
-  fs23.writeFileUtf8(import_node_path6.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
+function writeSession(fs24, sessionsDir, session) {
+  fs24.mkdirp(sessionsDir);
+  fs24.writeFileUtf8(import_node_path6.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
 `);
 }
-function removeSession(fs23, sessionsDir, pid) {
-  fs23.removeRecursive(import_node_path6.default.join(sessionsDir, `${String(pid)}.json`));
+function removeSession(fs24, sessionsDir, pid) {
+  fs24.removeRecursive(import_node_path6.default.join(sessionsDir, `${String(pid)}.json`));
 }
-function listSessions(fs23, sessionsDir) {
+function listSessions(fs24, sessionsDir) {
   const sessions = [];
-  for (const name of fs23.readdir(sessionsDir)) {
+  for (const name of fs24.readdir(sessionsDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = parseJson(fs23.readFileUtf8(import_node_path6.default.join(sessionsDir, name)), HeadroomSessionSchema);
+      const parsed = parseJson(fs24.readFileUtf8(import_node_path6.default.join(sessionsDir, name)), HeadroomSessionSchema);
       if (parsed !== void 0) {
         sessions.push(parsed);
       }
@@ -27517,22 +27517,22 @@ function listSessions(fs23, sessionsDir) {
   }
   return sessions.sort((a10, b) => a10.pid - b.pid);
 }
-function sessionsForSupervisor(fs23, sessionsDir, supervisorPid) {
-  return listSessions(fs23, sessionsDir).filter((session) => session.supervisorPid === supervisorPid);
+function sessionsForSupervisor(fs24, sessionsDir, supervisorPid) {
+  return listSessions(fs24, sessionsDir).filter((session) => session.supervisorPid === supervisorPid);
 }
-function pruneDeadSessions(fs23, sessionsDir, isRunning) {
+function pruneDeadSessions(fs24, sessionsDir, isRunning) {
   const removed = [];
-  for (const session of listSessions(fs23, sessionsDir)) {
+  for (const session of listSessions(fs24, sessionsDir)) {
     if (!isRunning(session.pid)) {
-      removeSession(fs23, sessionsDir, session.pid);
+      removeSession(fs24, sessionsDir, session.pid);
       removed.push(session.pid);
     }
   }
   return removed;
 }
-function readStartLock(fs23, lockFile) {
+function readStartLock(fs24, lockFile) {
   try {
-    return parseJson(fs23.readFileUtf8(lockFile), HeadroomLockSchema);
+    return parseJson(fs24.readFileUtf8(lockFile), HeadroomLockSchema);
   } catch {
     return void 0;
   }
@@ -27625,12 +27625,12 @@ function earlierReleaseAllowlistHash(providers, doorOrigin) {
   }
   return hashAllowlist([...entries].sort());
 }
-function earlierReleaseDaemon(fs23, paths, daemon) {
+function earlierReleaseDaemon(fs24, paths, daemon) {
   if (daemonIdentity(daemon.commandLine, daemon.socketPath) !== "earlier-release") {
     return void 0;
   }
-  const providers = readAllProviders(fs23, paths.providersDir).map((entry) => entry.provider);
-  const expected = earlierReleaseAllowlistHash(providers, frontDoorOrigin(readFrontDoorState(fs23, paths.frontdoorStateFile)));
+  const providers = readAllProviders(fs24, paths.providersDir).map((entry) => entry.provider);
+  const expected = earlierReleaseAllowlistHash(providers, frontDoorOrigin(readFrontDoorState(fs24, paths.frontdoorStateFile)));
   return { admitsServingDoor: daemon.recordedHash === expected };
 }
 var EARLIER_RELEASE_ALLOWLIST, EARLIER_RELEASE_ANTHROPIC_UPSTREAM;
@@ -27655,8 +27655,8 @@ function awaitingCause(daemonPid, identity, allowlistFile) {
   }
   return `the headroom supervisor has not written an allowlist admitting this launch's upstreams to ${allowlistFile} within ${String(HEADROOM_START_TIMEOUT_MS)}ms`;
 }
-function daemonAdmits(fs23, allowlistFile, recordedHash, required2) {
-  const content = fs23.readFileUtf8(allowlistFile);
+function daemonAdmits(fs24, allowlistFile, recordedHash, required2) {
+  const content = fs24.readFileUtf8(allowlistFile);
   if (content === void 0 || recordedHash === void 0) {
     return false;
   }
@@ -28046,7 +28046,7 @@ function verifyAllowlistFile(allowlistFile, ports) {
   const replaceable = fileStat === void 0 || fileStat.kind === "file" || fileStat.kind === "symlink";
   return { message: refusal2, repairable: replaceable };
 }
-function prepareHeadroomSocket(fs23, ports, paths, supervisorPid) {
+function prepareHeadroomSocket(fs24, ports, paths, supervisorPid) {
   const unsupported = platformRefusal(ports.platform);
   if (unsupported !== void 0) {
     return { refused: unsupported };
@@ -28061,18 +28061,18 @@ function prepareHeadroomSocket(fs23, ports, paths, supervisorPid) {
   if (ports.lstat(paths.headroomSocketDir)?.kind === "symlink") {
     return { refused: `the headroom socket directory ${paths.headroomSocketDir} is a symlink; it must be the real directory` };
   }
-  fs23.mkdirPrivate(paths.headroomSocketDir);
+  fs24.mkdirPrivate(paths.headroomSocketDir);
   const refusal2 = ownerOnlyRefusal("socket directory", paths.headroomSocketDir, ports.lstat(paths.headroomSocketDir), "dir", ports.currentUid());
   return refusal2 === void 0 ? { socketPath } : { refused: refusal2 };
 }
-function pruneStaleHeadroomSockets(fs23, paths, isRunning) {
+function pruneStaleHeadroomSockets(fs24, paths, isRunning) {
   const removed = [];
-  for (const name of fs23.readdir(paths.headroomSocketDir)) {
+  for (const name of fs24.readdir(paths.headroomSocketDir)) {
     const pid = HEADROOM_SOCKET_NAME.exec(name)?.[1];
     if (pid === void 0 || isRunning(Number.parseInt(pid, 10))) {
       continue;
     }
-    fs23.removeRecursive(import_node_path7.default.join(paths.headroomSocketDir, name));
+    fs24.removeRecursive(import_node_path7.default.join(paths.headroomSocketDir, name));
     removed.push(name);
   }
   return removed;
@@ -28219,37 +28219,37 @@ function compareVersions2(a10, b) {
   return 0;
 }
 async function runSupervisor(initialConfig, ports, options = {}) {
-  const { fs: fs23, paths } = ports;
+  const { fs: fs24, paths } = ports;
   let config2 = initialConfig;
-  migrateHeadroomState(fs23, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, ports.isRunning);
-  const previousState = resolveServingHeadroomState(fs23, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, ports.isRunning)?.state;
+  migrateHeadroomState(fs24, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, ports.isRunning);
+  const previousState = resolveServingHeadroomState(fs24, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, ports.isRunning)?.state;
   if (previousState?.supervisorPid !== void 0 && previousState.supervisorPid !== ports.ownPid && ports.isRunning(previousState.supervisorPid)) {
     ports.log(`agent-shim headroom supervisor ${String(ports.ownPid)}: supervisor ${String(previousState.supervisorPid)} already owns the daemon; exiting`);
     return 0;
   }
   let installedSource = previousState?.installedSource;
   const ownsState = () => {
-    const owner = readHeadroomState(fs23, paths.headroomStateFile)?.supervisorPid;
+    const owner = readHeadroomState(fs24, paths.headroomStateFile)?.supervisorPid;
     return owner === void 0 || owner === ports.ownPid || !ports.isRunning(owner);
   };
   const writeOwnState = (state) => {
     if (!ownsState()) {
       return false;
     }
-    writeHeadroomState(fs23, paths.headroomStateFile, state);
+    writeHeadroomState(fs24, paths.headroomStateFile, state);
     return true;
   };
   const fail = (message) => {
     if (writeOwnState({ lastError: message })) {
-      fs23.removeRecursive(paths.headroomLockFile);
+      fs24.removeRecursive(paths.headroomLockFile);
     }
     ports.log(`agent-shim headroom supervisor: ${message}`);
     return 1;
   };
   const syncAllowlistFile = (allowlist) => {
     try {
-      if (fs23.readFileUtf8(paths.headroomAllowlistFile) !== formatAllowlistFile(allowlist)) {
-        writeAllowlistFile(fs23, paths.headroomAllowlistFile, allowlist);
+      if (fs24.readFileUtf8(paths.headroomAllowlistFile) !== formatAllowlistFile(allowlist)) {
+        writeAllowlistFile(fs24, paths.headroomAllowlistFile, allowlist);
         ports.log(`agent-shim headroom supervisor: wrote allowlist [${allowlist.join(", ")}] to ${paths.headroomAllowlistFile}`);
       }
       return void 0;
@@ -28267,9 +28267,9 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     }
     ports.log(`agent-shim headroom supervisor: repairing the allowlist file: ${problem.message}`);
     try {
-      fs23.mkdirPrivate(paths.headroomDir);
-      fs23.mkdirPrivate(import_node_path8.default.dirname(paths.headroomAllowlistFile));
-      writeAllowlistFile(fs23, paths.headroomAllowlistFile, allowlist);
+      fs24.mkdirPrivate(paths.headroomDir);
+      fs24.mkdirPrivate(import_node_path8.default.dirname(paths.headroomAllowlistFile));
+      writeAllowlistFile(fs24, paths.headroomAllowlistFile, allowlist);
     } catch (error63) {
       return `could not write the headroom allowlist file ${paths.headroomAllowlistFile}: ${error63 instanceof Error ? error63.message : String(error63)}`;
     }
@@ -28294,20 +28294,20 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     installedSource = config2.source;
     return void 0;
   };
-  const socket = prepareHeadroomSocket(fs23, ports.socketTrust, paths, ports.ownPid);
+  const socket = prepareHeadroomSocket(fs24, ports.socketTrust, paths, ports.ownPid);
   if (socket.refused !== void 0) {
     return fail(socket.refused);
   }
   const { socketPath } = socket;
-  pruneStaleHeadroomSockets(fs23, paths, ports.isRunning);
-  pruneStaleAllowlistTemporaries(fs23, paths.headroomAllowlistFile, ports.isRunning);
+  pruneStaleHeadroomSockets(fs24, paths, ports.isRunning);
+  pruneStaleAllowlistTemporaries(fs24, paths.headroomAllowlistFile, ports.isRunning);
   const installFailure = ensureInstalled();
   if (installFailure !== void 0) {
     return fail(installFailure);
   }
   const version2 = ports.headroomVersion() ?? "unknown";
   writeOwnState({ supervisorPid: ports.ownPid, version: version2, installedSource });
-  ports.log(`agent-shim headroom supervisor ${String(ports.ownPid)}: managing headroom on allowlist [${currentHeadroomAllowlistInputs(fs23, paths, ports.frontDoorLiveness).frontDoorOrigins.join(", ")}]`);
+  ports.log(`agent-shim headroom supervisor ${String(ports.ownPid)}: managing headroom on allowlist [${currentHeadroomAllowlistInputs(fs24, paths, ports.frontDoorLiveness).frontDoorOrigins.join(", ")}]`);
   const orphanPid = previousState?.headroomPid;
   const orphanSocket = previousState?.socketPath ?? (previousState?.supervisorPid === void 0 ? void 0 : headroomSocketPath(paths, previousState.supervisorPid));
   const orphanIdentity = orphanPid === void 0 || orphanSocket === void 0 || !ports.isRunning(orphanPid) ? void 0 : daemonIdentity(ports.daemonCommandLine(orphanPid), orphanSocket);
@@ -28342,12 +28342,12 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     ticks += 1;
     config2 = ports.readConfig();
     const settingsHash = hashSettings(config2.settings);
-    const inputs = currentHeadroomAllowlistInputs(fs23, paths, ports.frontDoorLiveness);
-    pruneDeadFrontDoorDirectRecords(fs23, paths.frontdoorDirectRecordsDir, inputs.frontDoorRecords, inputs.frontDoorLiveness);
-    pruneMalformedFrontDoorDirectFiles(fs23, paths.frontdoorDirectRecordsDir, ports.isRunning);
+    const inputs = currentHeadroomAllowlistInputs(fs24, paths, ports.frontDoorLiveness);
+    pruneDeadFrontDoorDirectRecords(fs24, paths.frontdoorDirectRecordsDir, inputs.frontDoorRecords, inputs.frontDoorLiveness);
+    pruneMalformedFrontDoorDirectFiles(fs24, paths.frontdoorDirectRecordsDir, ports.isRunning);
     const allowlist = inputs.frontDoorOrigins;
     const allowlistHash = hashAllowlist(allowlist);
-    pruneDeadSessions(fs23, paths.headroomSessionsDir, ports.isRunning);
+    pruneDeadSessions(fs24, paths.headroomSessionsDir, ports.isRunning);
     const ownsNow = ownsState();
     if (!ownsNow && !superseded) {
       ports.log("agent-shim headroom supervisor: another supervisor now owns the state file; serving this daemon's own sessions until they end");
@@ -28394,7 +28394,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
         runningSettingsHash = settingsHash;
         const recorded = writeOwnState(servingState(pid));
         if (recorded) {
-          fs23.removeRecursive(paths.headroomLockFile);
+          fs24.removeRecursive(paths.headroomLockFile);
         }
         idleSince = void 0;
         ports.log(`agent-shim headroom supervisor: headroom pid ${String(pid)} ready on unix socket ${socketPath}`);
@@ -28422,7 +28422,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
         ports.log(`agent-shim headroom supervisor: headroom pid ${String(headroomPid)} now serves allowlist [${allowlist.join(", ")}]`);
       }
       if (runningSettingsHash !== settingsHash || installedSource !== config2.source) {
-        if (sessionsForSupervisor(fs23, paths.headroomSessionsDir, ports.ownPid).length === 0) {
+        if (sessionsForSupervisor(fs24, paths.headroomSessionsDir, ports.ownPid).length === 0) {
           ports.log("agent-shim headroom supervisor: configuration drifted and no sessions are live; restarting headroom");
           ports.stopProcess(headroomPid);
           headroomPid = void 0;
@@ -28431,7 +28431,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
           continue;
         }
       }
-      const sessions = sessionsForSupervisor(fs23, paths.headroomSessionsDir, ports.ownPid);
+      const sessions = sessionsForSupervisor(fs24, paths.headroomSessionsDir, ports.ownPid);
       if (sessions.length === 0) {
         idleSince ??= ports.now();
         const idleMs = ports.now() - idleSince;
@@ -28456,9 +28456,9 @@ function undeterminedFrontDoors(inputs) {
     return reason === void 0 ? [] : [{ pid: record2.pid, origin: directOrigin(record2.directPort), reason }];
   });
 }
-function currentHeadroomAllowlistInputs(fs23, paths, frontDoorLiveness) {
-  const named = frontDoorOrigin(readFrontDoorState(fs23, paths.frontdoorStateFile));
-  const records = listFrontDoorDirectRecords(fs23, paths.frontdoorDirectRecordsDir);
+function currentHeadroomAllowlistInputs(fs24, paths, frontDoorLiveness) {
+  const named = frontDoorOrigin(readFrontDoorState(fs24, paths.frontdoorStateFile));
+  const records = listFrontDoorDirectRecords(fs24, paths.frontdoorDirectRecordsDir);
   const liveness = frontDoorLiveness(records.map((record2) => record2.pid));
   const live = liveFrontDoorDirectRecords(records, liveness).map((record2) => directOrigin(record2.directPort));
   return {
@@ -28467,8 +28467,8 @@ function currentHeadroomAllowlistInputs(fs23, paths, frontDoorLiveness) {
     frontDoorOrigins: [.../* @__PURE__ */ new Set([...named === void 0 ? [] : [named], ...live])].sort()
   };
 }
-function launchRequiredUpstreams(fs23, paths) {
-  const door = frontDoorOrigin(readFrontDoorState(fs23, paths.frontdoorStateFile));
+function launchRequiredUpstreams(fs24, paths) {
+  const door = frontDoorOrigin(readFrontDoorState(fs24, paths.frontdoorStateFile));
   return door === void 0 ? [] : [door];
 }
 async function waitUntilReady(ports, socketPath, pid) {
@@ -31299,8 +31299,8 @@ var init_classify = __esm({
 function poolNameOf(selector) {
   return selector.startsWith(POOL_SELECTOR_PREFIX) ? selector.slice(POOL_SELECTOR_PREFIX.length) : void 0;
 }
-function readActiveIdentity(fs23, activeIdentityFile) {
-  const trimmed = fs23.readFileUtf8(activeIdentityFile)?.trim();
+function readActiveIdentity(fs24, activeIdentityFile) {
+  const trimmed = fs24.readFileUtf8(activeIdentityFile)?.trim();
   return trimmed === void 0 || trimmed === "" ? void 0 : trimmed;
 }
 function isNonEmpty(value2) {
@@ -31347,8 +31347,8 @@ function decideConfigProfile(params) {
   }
   return { source: "none" };
 }
-function loadIdentity(identitiesDir, name, fs23) {
-  return loadConfigFile(import_node_path11.default.join(identitiesDir, name, "identity.json"), IdentitySchema, fs23.readConfigFile);
+function loadIdentity(identitiesDir, name, fs24) {
+  return loadConfigFile(import_node_path11.default.join(identitiesDir, name, "identity.json"), IdentitySchema, fs24.readConfigFile);
 }
 var import_node_path11, IDENTITY_DECISION_SOURCES, CONFIG_PROFILE_DECISION_SOURCES;
 var init_identity = __esm({
@@ -32752,8 +32752,8 @@ var init_pipeline = __esm({
 });
 
 // src/launcher/farm.ts
-function readFarmManifest(fs23, farmRoot) {
-  const raw = fs23.readFileUtf8(import_node_path19.default.join(farmRoot, FARM_MANIFEST_FILENAME)) ?? fs23.readFileUtf8(import_node_path19.default.join(farmRoot, LEGACY_FARM_MANIFEST_FILENAME));
+function readFarmManifest(fs24, farmRoot) {
+  const raw = fs24.readFileUtf8(import_node_path19.default.join(farmRoot, FARM_MANIFEST_FILENAME)) ?? fs24.readFileUtf8(import_node_path19.default.join(farmRoot, LEGACY_FARM_MANIFEST_FILENAME));
   if (raw === void 0) {
     return void 0;
   }
@@ -32811,9 +32811,9 @@ function buildEntryFacts(params) {
     entries
   };
 }
-function listSubtree(fs23, root, rel) {
+function listSubtree(fs24, root, rel) {
   const absolute = import_node_path19.default.join(root, rel);
-  const stat = fs23.lstat(absolute);
+  const stat = fs24.lstat(absolute);
   if (stat === void 0) {
     return [];
   }
@@ -32821,10 +32821,10 @@ function listSubtree(fs23, root, rel) {
     return [{ rel, kind: "symlink" }];
   }
   if (stat.kind === "dir") {
-    const children = [...fs23.readdir(absolute)].sort().flatMap((name) => listSubtree(fs23, root, `${rel}/${name}`));
+    const children = [...fs24.readdir(absolute)].sort().flatMap((name) => listSubtree(fs24, root, `${rel}/${name}`));
     return [{ rel, kind: "dir" }, ...children];
   }
-  const contentHash = fs23.hashFile(absolute);
+  const contentHash = fs24.hashFile(absolute);
   return [{ rel, kind: "file", ...contentHash === void 0 ? {} : { contentHash } }];
 }
 function topLevelScopeRoots(roots) {
@@ -32838,25 +32838,25 @@ function topLevelScopeRoots(roots) {
   }
   return kept;
 }
-function reconciliationScope(fs23, farmRoot, manifest) {
+function reconciliationScope(fs24, farmRoot, manifest) {
   if (manifest !== void 0) {
     return topLevelScopeRoots(manifest.materialised);
   }
-  return [...fs23.readdir(farmRoot)].filter((name) => name !== FARM_MANIFEST_FILENAME && name !== LEGACY_FARM_MANIFEST_FILENAME && fs23.lstat(import_node_path19.default.join(farmRoot, name))?.kind === "dir").sort();
+  return [...fs24.readdir(farmRoot)].filter((name) => name !== FARM_MANIFEST_FILENAME && name !== LEGACY_FARM_MANIFEST_FILENAME && fs24.lstat(import_node_path19.default.join(farmRoot, name))?.kind === "dir").sort();
 }
-function collectFarmListing(fs23, farmRoot, scopeRoots) {
-  return scopeRoots.flatMap((root) => listSubtree(fs23, farmRoot, root));
+function collectFarmListing(fs24, farmRoot, scopeRoots) {
+  return scopeRoots.flatMap((root) => listSubtree(fs24, farmRoot, root));
 }
-function collectCanonicalCounterparts(fs23, claudeHome, farmListing) {
+function collectCanonicalCounterparts(fs24, claudeHome, farmListing) {
   const out = [];
   for (const entry of farmListing) {
     const absolute = import_node_path19.default.join(claudeHome, entry.rel);
-    const stat = fs23.lstat(absolute);
+    const stat = fs24.lstat(absolute);
     if (stat === void 0) {
       continue;
     }
     if (stat.kind === "file") {
-      const contentHash = fs23.hashFile(absolute);
+      const contentHash = fs24.hashFile(absolute);
       out.push({ rel: entry.rel, kind: "file", ...contentHash === void 0 ? {} : { contentHash } });
       continue;
     }
@@ -34007,7 +34007,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "claude-use",
-      version: "11.7.0",
+      version: "11.8.1",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -34120,12 +34120,12 @@ function isIdentityName(name) {
 function claudeJsonPath(identitiesDir, identity) {
   return import_node_path24.default.join(identitiesDir, identity, CLAUDE_JSON);
 }
-function readAccountMetadata(fs23, identitiesDir, identity) {
+function readAccountMetadata(fs24, identitiesDir, identity) {
   if (!isIdentityName(identity)) {
     throw new Error(`"${identity}" is not a valid identity name.`);
   }
   const file2 = claudeJsonPath(identitiesDir, identity);
-  const raw = fs23.readFileUtf8(file2);
+  const raw = fs24.readFileUtf8(file2);
   if (raw === void 0) {
     return void 0;
   }
@@ -34155,19 +34155,19 @@ function readAccountMetadata(fs23, identitiesDir, identity) {
   }
   return account.data;
 }
-function createAccountReader(fs23, identitiesDir) {
+function createAccountReader(fs24, identitiesDir) {
   const cache = /* @__PURE__ */ new Map();
   return (identity) => {
     if (!isIdentityName(identity)) {
       throw new Error(`"${identity}" is not a valid identity name.`);
     }
-    const stat = fs23.lstat(claudeJsonPath(identitiesDir, identity));
+    const stat = fs24.lstat(claudeJsonPath(identitiesDir, identity));
     const stamp = stat === void 0 ? "absent" : `${String(stat.mtimeMs)}:${String(stat.sizeBytes)}`;
     const cached2 = cache.get(identity);
     if (cached2?.stamp === stamp) {
       return cached2.account;
     }
-    const account = readAccountMetadata(fs23, identitiesDir, identity);
+    const account = readAccountMetadata(fs24, identitiesDir, identity);
     cache.set(identity, { stamp, account });
     return account;
   };
@@ -34289,10 +34289,11 @@ function parseProviderPath(path59) {
   }
   return { provider: decodeURIComponent(tail.slice(0, slash)), rest: tail.slice(slash) };
 }
-var INTERNAL_HEADER_NAMES, IDENTITY_HEADER, SESSION_HEADER, PROVIDER_HEADER, HEADROOM_FLAG_HEADER, PROJECT_ID_HEADER, SESSION_ATTRIBUTION_HEADER, HEADROOM_BASE_URL_HEADER, AUTH_HEADER, HOP_SECRET_HEADER, HOP_ID_HEADER, PROVIDER_PATH_PREFIX;
+var HEADROOM_SESSION_HEADER, INTERNAL_HEADER_NAMES, IDENTITY_HEADER, SESSION_HEADER, PROVIDER_HEADER, HEADROOM_FLAG_HEADER, PROJECT_ID_HEADER, CLIENT_SESSION_HEADER, HEADROOM_BASE_URL_HEADER, AUTH_HEADER, HOP_SECRET_HEADER, HOP_ID_HEADER, PROVIDER_PATH_PREFIX;
 var init_route = __esm({
   "src/frontdoor/route.ts"() {
     "use strict";
+    HEADROOM_SESSION_HEADER = "x-headroom-session-id";
     INTERNAL_HEADER_NAMES = [
       "x-agent-shim-identity",
       "x-agent-shim-session",
@@ -34302,7 +34303,7 @@ var init_route = __esm({
       "x-agent-shim-hop",
       "x-agent-shim-hop-id",
       "x-headroom-project-id",
-      "x-headroom-session-id",
+      HEADROOM_SESSION_HEADER,
       "x-headroom-base-url"
     ];
     IDENTITY_HEADER = "x-agent-shim-identity";
@@ -34310,7 +34311,7 @@ var init_route = __esm({
     PROVIDER_HEADER = "x-agent-shim-provider";
     HEADROOM_FLAG_HEADER = "x-agent-shim-headroom";
     PROJECT_ID_HEADER = "x-headroom-project-id";
-    SESSION_ATTRIBUTION_HEADER = "x-headroom-session-id";
+    CLIENT_SESSION_HEADER = "x-claude-code-session-id";
     HEADROOM_BASE_URL_HEADER = "x-headroom-base-url";
     AUTH_HEADER = "x-agent-shim-auth";
     HOP_SECRET_HEADER = "x-agent-shim-hop";
@@ -35065,8 +35066,8 @@ function segmentDay(epochMs) {
 function segmentName(day, pid) {
   return `${day}.${String(pid)}.jsonl`;
 }
-function listLogSegments(fs23, logDir) {
-  return fs23.readdir(logDir).flatMap((name) => {
+function listLogSegments(fs24, logDir) {
+  return fs24.readdir(logDir).flatMap((name) => {
     const match = SEGMENT_RE.exec(name);
     const day = match?.[1];
     if (day === void 0) {
@@ -35075,15 +35076,15 @@ function listLogSegments(fs23, logDir) {
     return [{ name, day, endsAt: Date.parse(`${day}T00:00:00.000Z`) + DAY_MS }];
   }).sort((left, right) => left.day.localeCompare(right.day) || left.name.localeCompare(right.name));
 }
-function readUsageLog(fs23, logDir, options = {}) {
+function readUsageLog(fs24, logDir, options = {}) {
   const { sinceMs } = options;
   const records = [];
   let invalidLines = 0;
-  for (const segment of listLogSegments(fs23, logDir)) {
+  for (const segment of listLogSegments(fs24, logDir)) {
     if (sinceMs !== void 0 && segment.endsAt <= sinceMs) {
       continue;
     }
-    const contents = fs23.readFileUtf8(import_node_path25.default.join(logDir, segment.name));
+    const contents = fs24.readFileUtf8(import_node_path25.default.join(logDir, segment.name));
     if (contents === void 0) {
       continue;
     }
@@ -35119,9 +35120,9 @@ function snapshotPath(snapshotsDir, identity) {
   }
   return import_node_path25.default.join(snapshotsDir, `${identity}.json`);
 }
-function readUsageSnapshot(fs23, snapshotsDir, identity) {
+function readUsageSnapshot(fs24, snapshotsDir, identity) {
   const file2 = snapshotPath(snapshotsDir, identity);
-  const raw = fs23.readFileUtf8(file2);
+  const raw = fs24.readFileUtf8(file2);
   if (raw === void 0) {
     return void 0;
   }
@@ -35137,8 +35138,8 @@ function readUsageSnapshot(fs23, snapshotsDir, identity) {
   }
   return snapshot.data;
 }
-function listUsageSnapshots(fs23, snapshotsDir) {
-  return fs23.readdir(snapshotsDir).flatMap((name) => {
+function listUsageSnapshots(fs24, snapshotsDir) {
+  return fs24.readdir(snapshotsDir).flatMap((name) => {
     if (!name.endsWith(".json")) {
       return [];
     }
@@ -35146,7 +35147,7 @@ function listUsageSnapshots(fs23, snapshotsDir) {
     if (!isIdentityName(identity)) {
       return [];
     }
-    const snapshot = readUsageSnapshot(fs23, snapshotsDir, identity);
+    const snapshot = readUsageSnapshot(fs24, snapshotsDir, identity);
     return snapshot === void 0 ? [] : [snapshot];
   }).sort((left, right) => left.identity.localeCompare(right.identity));
 }
@@ -35220,11 +35221,11 @@ var init_read = __esm({
 });
 
 // src/usage/store.ts
-function pruneUsageLog(fs23, logDir, nowMs) {
+function pruneUsageLog(fs24, logDir, nowMs) {
   const cutoff = nowMs - USAGE_RETENTION_MS;
-  for (const segment of listLogSegments(fs23, logDir)) {
+  for (const segment of listLogSegments(fs24, logDir)) {
     if (segment.endsAt <= cutoff) {
-      fs23.removeRecursive(import_node_path26.default.join(logDir, segment.name));
+      fs24.removeRecursive(import_node_path26.default.join(logDir, segment.name));
     }
   }
 }
@@ -35253,7 +35254,7 @@ function foldProviderState(current, record2) {
   };
 }
 function createUsageStore(deps) {
-  const { fs: fs23, paths } = deps;
+  const { fs: fs24, paths } = deps;
   let prunedDay;
   const rewriteSnapshot = (identity, fold) => {
     if (!isIdentityName(identity)) {
@@ -35262,7 +35263,7 @@ function createUsageStore(deps) {
     }
     let current;
     try {
-      current = readUsageSnapshot(fs23, paths.usageSnapshotsDir, identity);
+      current = readUsageSnapshot(fs24, paths.usageSnapshotsDir, identity);
     } catch (error63) {
       if (!(error63 instanceof UsageSnapshotError)) {
         throw error63;
@@ -35289,8 +35290,8 @@ function createUsageStore(deps) {
       ...account === void 0 ? {} : { account },
       providers
     });
-    fs23.mkdirPrivate(paths.usageSnapshotsDir);
-    fs23.writeFilePrivate(snapshotPath(paths.usageSnapshotsDir, identity), `${JSON.stringify(snapshot, null, 2)}
+    fs24.mkdirPrivate(paths.usageSnapshotsDir);
+    fs24.writeFilePrivate(snapshotPath(paths.usageSnapshotsDir, identity), `${JSON.stringify(snapshot, null, 2)}
 `);
     deps.publish?.(snapshot);
     return true;
@@ -35299,14 +35300,14 @@ function createUsageStore(deps) {
     record: (input2) => {
       const record2 = UsageRecordSchema.parse(input2);
       const nowMs = deps.now();
-      fs23.mkdirPrivate(paths.usageDir);
-      fs23.mkdirPrivate(paths.usageLogDir);
+      fs24.mkdirPrivate(paths.usageDir);
+      fs24.mkdirPrivate(paths.usageLogDir);
       const day = segmentDay(nowMs);
       if (prunedDay !== day) {
-        pruneUsageLog(fs23, paths.usageLogDir, nowMs);
+        pruneUsageLog(fs24, paths.usageLogDir, nowMs);
         prunedDay = day;
       }
-      fs23.appendFilePrivate(import_node_path26.default.join(paths.usageLogDir, segmentName(day, deps.pid)), `${JSON.stringify(record2)}
+      fs24.appendFilePrivate(import_node_path26.default.join(paths.usageLogDir, segmentName(day, deps.pid)), `${JSON.stringify(record2)}
 `);
       if (record2.identity !== void 0) {
         rewriteSnapshot(record2.identity, (current) => ({ ...current?.providers, [record2.provider]: foldProviderState(current?.providers[record2.provider], record2) }));
@@ -35348,14 +35349,14 @@ var init_store2 = __esm({
 function errorMessage(error63) {
   return error63 instanceof Error ? error63.message : String(error63);
 }
-function loadPoolMembers(fs23, paths, identities, nowMs) {
+function loadPoolMembers(fs24, paths, identities, nowMs) {
   const windowStartMs = nowMs - FIVE_HOUR_WINDOW_MS;
-  const log = readUsageLog(fs23, paths.usageLogDir, { sinceMs: windowStartMs });
+  const log = readUsageLog(fs24, paths.usageLogDir, { sinceMs: windowStartMs });
   return identities.map((identity) => {
     const records = log.records.filter((record2) => record2.identity === identity && record2.provider === ANTHROPIC_PROVIDER && Date.parse(record2.at) >= windowStartMs);
     try {
-      const snapshot = readUsageSnapshot(fs23, paths.usageSnapshotsDir, identity);
-      const account = readAccountMetadata(fs23, paths.identitiesDir, identity) ?? snapshot?.account;
+      const snapshot = readUsageSnapshot(fs24, paths.usageSnapshotsDir, identity);
+      const account = readAccountMetadata(fs24, paths.identitiesDir, identity) ?? snapshot?.account;
       return { identity, records, ...snapshot === void 0 ? {} : { snapshot }, ...account === void 0 ? {} : { account } };
     } catch (error63) {
       if (error63 instanceof UsageSnapshotError || error63 instanceof AccountMetadataError) {
@@ -35427,9 +35428,9 @@ function nestedMember(input2, nestedName, childStack, sticky) {
     missing: nested.missing
   };
 }
-function readPicksFile(fs23, file2) {
+function readPicksFile(fs24, file2) {
   const empty = { schemaVersion: SCHEMA_VERSION, picks: {} };
-  const raw = fs23.readFileUtf8(file2);
+  const raw = fs24.readFileUtf8(file2);
   if (raw === void 0) {
     return { file: empty };
   }
@@ -35442,17 +35443,17 @@ function readPicksFile(fs23, file2) {
   const result = PicksFileSchema.safeParse(parsed);
   return result.success ? { file: result.data } : { file: empty, problem: `${file2} is not a picks file this agent-shim can read` };
 }
-function readStickyPick(fs23, picksFile, directory) {
-  const read = readPicksFile(fs23, picksFile);
+function readStickyPick(fs24, picksFile, directory) {
+  const read = readPicksFile(fs24, picksFile);
   const entry = read.file.picks[directory];
   return { ...entry === void 0 ? {} : { sticky: entry }, ...read.problem === void 0 ? {} : { problem: read.problem } };
 }
-function recordStickyPick(fs23, picksFile, directory, identity, nowMs) {
-  const current = readPicksFile(fs23, picksFile).file.picks;
+function recordStickyPick(fs24, picksFile, directory, identity, nowMs) {
+  const current = readPicksFile(fs24, picksFile).file.picks;
   const kept = Object.entries(current).filter(([, entry]) => nowMs - Date.parse(entry.at) <= USAGE_RETENTION_MS);
   const next = { schemaVersion: SCHEMA_VERSION, picks: { ...Object.fromEntries(kept), [directory]: { identity, at: new Date(nowMs).toISOString() } } };
-  fs23.mkdirPrivate(import_node_path27.default.dirname(picksFile));
-  fs23.writeFilePrivate(picksFile, `${JSON.stringify(next, null, 2)}
+  fs24.mkdirPrivate(import_node_path27.default.dirname(picksFile));
+  fs24.writeFilePrivate(picksFile, `${JSON.stringify(next, null, 2)}
 `);
 }
 var import_node_path27, PoolGraphError, SCHEMA_VERSION, PickEntrySchema, PicksFileSchema;
@@ -61979,11 +61980,18 @@ var init_ensure2 = __esm({
 // src/frontdoor/probe.ts
 function probeFrontDoorSync(port, caPem) {
   refuseToBlockInRole("a synchronous probe of the front door");
+  return runProbeWorker(PROBE_SOURCE, { port, ca: caPem });
+}
+function probeListenerAcceptSync(port) {
+  refuseToBlockInRole("a synchronous probe of a front door listener");
+  return runProbeWorker(ACCEPT_PROBE_SOURCE, { port });
+}
+function runProbeWorker(source, data) {
   const shared = new SharedArrayBuffer(HEADER_SLOTS * INT32_BYTES + REASON_BYTES);
   const header = new Int32Array(shared, 0, HEADER_SLOTS);
-  const worker = new import_node_worker_threads.Worker(PROBE_SOURCE, {
+  const worker = new import_node_worker_threads.Worker(source, {
     eval: true,
-    workerData: { port, ca: caPem, timeoutMs: PROBE_TIMEOUT_MS, shared, ok: VERDICT_OK, failed: VERDICT_FAILED, headerSlots: HEADER_SLOTS }
+    workerData: { ...data, timeoutMs: PROBE_TIMEOUT_MS, shared, ok: VERDICT_OK, failed: VERDICT_FAILED, headerSlots: HEADER_SLOTS }
   });
   worker.unref();
   try {
@@ -62001,7 +62009,7 @@ function probeFrontDoorSync(port, caPem) {
     void worker.terminate();
   }
 }
-var import_node_worker_threads, PROBE_TIMEOUT_MS, PROBE_WAIT_MARGIN_MS, REASON_BYTES, HEADER_SLOTS, INT32_BYTES, VERDICT_PENDING, VERDICT_OK, VERDICT_FAILED, PROBE_SOURCE;
+var import_node_worker_threads, PROBE_TIMEOUT_MS, PROBE_WAIT_MARGIN_MS, REASON_BYTES, HEADER_SLOTS, INT32_BYTES, VERDICT_PENDING, VERDICT_OK, VERDICT_FAILED, PROBE_SOURCE, ACCEPT_PROBE_SOURCE;
 var init_probe = __esm({
   "src/frontdoor/probe.ts"() {
     "use strict";
@@ -62044,6 +62052,27 @@ const request = https.get({ host: "127.0.0.1", port, path: "/healthz", ca: [ca],
 // A hard deadline over the whole exchange, handshake included: a listener that accepts the connection and then says nothing must still fail the probe.
 setTimeout(() => { request.destroy(new Error("no answer within " + String(timeoutMs) + "ms")); }, timeoutMs);
 request.on("error", (error) => finish(failed, (error.code ? error.code + ": " : "") + error.message));
+`;
+    ACCEPT_PROBE_SOURCE = `
+const { workerData } = require("node:worker_threads");
+const net = require("node:net");
+const { port, timeoutMs, shared, ok, failed, headerSlots } = workerData;
+const header = new Int32Array(shared, 0, headerSlots);
+const reason = new Uint8Array(shared, headerSlots * 4);
+let done = false;
+const finish = (verdict, message) => {
+  if (done) return;
+  done = true;
+  const bytes = Buffer.from(String(message), "utf8").subarray(0, reason.length);
+  reason.set(bytes);
+  Atomics.store(header, 1, bytes.length);
+  Atomics.store(header, 0, verdict);
+  Atomics.notify(header, 0);
+};
+const socket = net.connect({ host: "127.0.0.1", port });
+socket.once("connect", () => { socket.destroy(); finish(ok, ""); });
+socket.once("error", (error) => finish(failed, (error.code ? error.code + ": " : "") + error.message));
+setTimeout(() => { socket.destroy(); finish(failed, "no connection accepted within " + String(timeoutMs) + "ms"); }, timeoutMs);
 `;
   }
 });
@@ -62064,14 +62093,14 @@ var init_selfIdentity = __esm({
 
 // src/frontdoor/trust.ts
 function resolveTrustBundle(params) {
-  const { caCertFile, bundlesDir, variable, inherited, fs: fs23 } = params;
+  const { caCertFile, bundlesDir, variable, inherited, fs: fs24 } = params;
   if (inherited === void 0 || inherited === "" || import_node_path35.default.resolve(inherited) === import_node_path35.default.resolve(caCertFile)) {
     return { path: caCertFile };
   }
-  const caPem = fs23.readFileUtf8(caCertFile);
+  const caPem = fs24.readFileUtf8(caCertFile);
   let inheritedPem;
   try {
-    inheritedPem = fs23.readFileUtf8(inherited);
+    inheritedPem = fs24.readFileUtf8(inherited);
   } catch (error63) {
     return {
       path: caCertFile,
@@ -62084,9 +62113,9 @@ function resolveTrustBundle(params) {
   const combined = `${inheritedPem.trimEnd()}
 ${caPem}`;
   const bundle = import_node_path35.default.join(bundlesDir, `${(0, import_node_crypto11.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
-  if (!fs23.exists(bundle)) {
-    fs23.mkdirp(bundlesDir);
-    fs23.writeFileAtomic(bundle, combined);
+  if (!fs24.exists(bundle)) {
+    fs24.mkdirp(bundlesDir);
+    fs24.writeFileAtomic(bundle, combined);
   }
   return { path: bundle };
 }
@@ -62253,20 +62282,20 @@ function lockHolder(contents) {
   const pid = Number((contents ?? "").trim());
   return Number.isInteger(pid) && pid > 0 ? pid : void 0;
 }
-function acquireUpdateLock(fs23, isProcessAlive, pid, lockPath) {
-  const take = () => fs23.writeFileExclusive(lockPath, `${String(pid)}
+function acquireUpdateLock(fs24, isProcessAlive, pid, lockPath) {
+  const take = () => fs24.writeFileExclusive(lockPath, `${String(pid)}
 `);
   const release = () => {
-    fs23.unlink(lockPath);
+    fs24.unlink(lockPath);
   };
   if (take()) {
     return release;
   }
-  const holder = lockHolder(fs23.readFileUtf8(lockPath));
+  const holder = lockHolder(fs24.readFileUtf8(lockPath));
   if (holder !== void 0 && holder !== pid && isProcessAlive(holder)) {
     throw new UpdateConflictError(`another agent-shim update (pid ${String(holder)}) is already running`);
   }
-  fs23.unlink(lockPath);
+  fs24.unlink(lockPath);
   if (!take()) {
     throw new UpdateConflictError("another agent-shim update took the lock while it was being replaced");
   }
@@ -63117,7 +63146,7 @@ function contextTokensOfTranscript(text2) {
   }
   return void 0;
 }
-function resumedContextTokens(fs23, params) {
+function resumedContextTokens(fs24, params) {
   const target = resumeTargetOf(params.passthrough);
   if (target === void 0) {
     return void 0;
@@ -63128,19 +63157,19 @@ function resumedContextTokens(fs23, params) {
     file2 = import_node_path40.default.join(projectDir, `${target.id}.jsonl`);
   } else {
     let newestMs = -Infinity;
-    for (const name of fs23.readdir(projectDir)) {
+    for (const name of fs24.readdir(projectDir)) {
       if (!name.endsWith(".jsonl")) {
         continue;
       }
       const candidate = import_node_path40.default.join(projectDir, name);
-      const stat = fs23.lstat(candidate);
+      const stat = fs24.lstat(candidate);
       if (stat?.kind === "file" && stat.mtimeMs > newestMs) {
         newestMs = stat.mtimeMs;
         file2 = candidate;
       }
     }
   }
-  const text2 = file2 === void 0 ? void 0 : fs23.readFileUtf8(file2);
+  const text2 = file2 === void 0 ? void 0 : fs24.readFileUtf8(file2);
   return text2 === void 0 ? void 0 : contextTokensOfTranscript(text2);
 }
 var import_node_path40;
@@ -63258,7 +63287,7 @@ function resolveIdentityCredential(identity, credential, env, port) {
   return resolution.ok ? resolution : { ok: false, status: CREDENTIAL_UNAVAILABLE_EXIT, message: resolution.message };
 }
 function pickFromPool(decided, params, parsedArgv, readOnly) {
-  const { paths, fs: fs23, proc, log } = params;
+  const { paths, fs: fs24, proc, log } = params;
   if (decided.pool === void 0) {
     return { identityDecision: decided };
   }
@@ -63273,7 +63302,7 @@ function pickFromPool(decided, params, parsedArgv, readOnly) {
     selectedVia: decided.source,
     pools: params.pools,
     paths,
-    fs: fs23,
+    fs: fs24,
     usageFs: farmRuntime.fs,
     cwd: farmRuntime.cwd,
     now: farmRuntime.now,
@@ -63296,7 +63325,7 @@ function pickFromPool(decided, params, parsedArgv, readOnly) {
   };
 }
 function decideLaunch(params, readOnly) {
-  const { paths, fs: fs23, proc, log } = params;
+  const { paths, fs: fs24, proc, log } = params;
   const { env, argv } = proc;
   const parsedArgv = parseLauncherArgv(argv);
   const cliOverride = buildCliOverride({
@@ -63311,7 +63340,7 @@ function decideLaunch(params, readOnly) {
     argv0Identity: parsedArgv.identity,
     directoryPinnedIdentity: params.directoryPinnedIdentity,
     readActiveIdentityFile: () => {
-      const raw = fs23.readFileUtf8(paths.activeIdentityFile);
+      const raw = fs24.readFileUtf8(paths.activeIdentityFile);
       if (raw === void 0) {
         return void 0;
       }
@@ -63346,7 +63375,7 @@ function decideLaunch(params, readOnly) {
   }
   let loadedIdentity;
   if (identityDecision.name !== void 0) {
-    loadedIdentity = loadIdentity(paths.identitiesDir, identityDecision.name, fs23);
+    loadedIdentity = loadIdentity(paths.identitiesDir, identityDecision.name, fs24);
     if (loadedIdentity === void 0) {
       log.error(
         `agent-shim: no identity named "${identityDecision.name}" (selected via ${identityDecision.source}). Run \`agent-shim identity add ${identityDecision.name}\` first.`
@@ -63361,7 +63390,7 @@ function decideLaunch(params, readOnly) {
     identityDefaultConfigProfile: loadedIdentity?.config.defaultConfigProfile,
     globalDefaultConfigProfile: params.globalDefaultConfigProfile
   });
-  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs23.readConfigFile(import_node_path41.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
+  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs24.readConfigFile(import_node_path41.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
     log.error(
       `agent-shim: no configuration profile named "${configProfileDecision.name}" (selected via ${configProfileDecision.source}). Run \`agent-shim profile add ${configProfileDecision.name}\` first.`
     );
@@ -63370,7 +63399,7 @@ function decideLaunch(params, readOnly) {
   const farmContext = farm !== void 0 && farmIdentity !== void 0 ? { farm, identity: farmIdentity, cascade: farm.loadCascade(configProfileDecision.name, cliOverride) } : void 0;
   const providerParams = {
     paths,
-    port: fs23,
+    port: fs24,
     ...parsedArgv.provider === void 0 || parsedArgv.provider === false ? {} : { cliProvider: parsedArgv.provider },
     ...farmContext === void 0 ? {} : { cascade: farmContext.cascade }
   };
@@ -104799,12 +104828,12 @@ var require_dist2 = __commonJS({
         throw new Error(`Unknown format "${name}"`);
       return f;
     };
-    function addFormats(ajv, list, fs23, exportName) {
+    function addFormats(ajv, list, fs24, exportName) {
       var _a4;
       var _b2;
       (_a4 = (_b2 = ajv.opts.code).formats) !== null && _a4 !== void 0 ? _a4 : _b2.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f of list)
-        ajv.addFormat(f, fs23[f]);
+        ajv.addFormat(f, fs24[f]);
     }
     module2.exports = exports2 = formatsPlugin;
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -112532,7 +112561,7 @@ function registerCodexCommand(program2, deps) {
 // src/frontdoor/commands.ts
 var import_node_crypto21 = require("node:crypto");
 var import_node_path51 = __toESM(require("node:path"), 1);
-var import_node_fs18 = __toESM(require("node:fs"), 1);
+var import_node_fs19 = __toESM(require("node:fs"), 1);
 init_commandDeps();
 init_schema();
 init_conditions();
@@ -112673,17 +112702,17 @@ function parseEntry2(project, entry) {
   const base = match?.[1];
   return base === void 0 ? { project, sessionId: entry, superseded: false, entry } : { project, sessionId: base, superseded: true, entry };
 }
-function listSessions2(fs23, configDir) {
+function listSessions2(fs24, configDir) {
   const found = [];
-  for (const project of fs23.readdir(import_node_path33.default.join(configDir, PROJECTS_DIR))) {
+  for (const project of fs24.readdir(import_node_path33.default.join(configDir, PROJECTS_DIR))) {
     const projectDir = import_node_path33.default.join(configDir, PROJECTS_DIR, project);
     const entries = /* @__PURE__ */ new Set();
-    for (const name of fs23.readdir(projectDir)) {
+    for (const name of fs24.readdir(projectDir)) {
       if (name.endsWith(TRANSCRIPT_SUFFIX)) {
         entries.add(name.slice(0, -TRANSCRIPT_SUFFIX.length));
         continue;
       }
-      const children = fs23.readdir(import_node_path33.default.join(projectDir, name));
+      const children = fs24.readdir(import_node_path33.default.join(projectDir, name));
       if (children.includes(SUBAGENTS_DIR) || children.includes(WORKFLOWS_DIR)) {
         entries.add(name);
       }
@@ -112694,9 +112723,9 @@ function listSessions2(fs23, configDir) {
   }
   return found.sort((left, right) => left.project.localeCompare(right.project) || left.entry.localeCompare(right.entry));
 }
-function locateAgents(fs23, configDir, relativeDir, workflowRunId, report) {
+function locateAgents(fs24, configDir, relativeDir, workflowRunId, report) {
   const located = [];
-  for (const name of listDirOrReport(fs23, configDir, relativeDir, report)) {
+  for (const name of listDirOrReport(fs24, configDir, relativeDir, report)) {
     if (!name.startsWith(AGENT_FILE_PREFIX) || !name.endsWith(META_SUFFIX)) {
       continue;
     }
@@ -112745,17 +112774,17 @@ function toNode(read, children) {
 function describeFailure(error63) {
   return error63 instanceof Error ? error63.message : String(error63);
 }
-function readFileOrReport(fs23, configDir, relative, report) {
+function readFileOrReport(fs24, configDir, relative, report) {
   try {
-    return fs23.readFileUtf8(import_node_path33.default.join(configDir, relative));
+    return fs24.readFileUtf8(import_node_path33.default.join(configDir, relative));
   } catch (error63) {
     report({ path: relative, reason: `could not be read: ${describeFailure(error63)}` });
     return void 0;
   }
 }
-function listDirOrReport(fs23, configDir, relative, report) {
+function listDirOrReport(fs24, configDir, relative, report) {
   try {
-    return fs23.readdir(import_node_path33.default.join(configDir, relative));
+    return fs24.readdir(import_node_path33.default.join(configDir, relative));
   } catch (error63) {
     report({ path: relative, reason: `could not be listed: ${describeFailure(error63)}` });
     return [];
@@ -112778,22 +112807,22 @@ var WorkflowRunFileSchema = external_exports.object({
   phases: external_exports.array(external_exports.object({ title: external_exports.string() })).default([]),
   summary: external_exports.string().optional()
 });
-function summariseSession(fs23, configDir, ref) {
+function summariseSession(fs24, configDir, ref) {
   const sessionRelative = import_node_path33.default.join(PROJECTS_DIR, ref.project, ref.entry);
   const subagentsRelative = import_node_path33.default.join(sessionRelative, SUBAGENTS_DIR);
   const workflowsUnderSubagents = import_node_path33.default.join(subagentsRelative, WORKFLOWS_DIR);
   const isMeta = (name) => name.startsWith(AGENT_FILE_PREFIX) && name.endsWith(META_SUFFIX);
-  let agentCount = fs23.readdir(import_node_path33.default.join(configDir, subagentsRelative)).filter(isMeta).length;
-  for (const runDir of fs23.readdir(import_node_path33.default.join(configDir, workflowsUnderSubagents))) {
+  let agentCount = fs24.readdir(import_node_path33.default.join(configDir, subagentsRelative)).filter(isMeta).length;
+  for (const runDir of fs24.readdir(import_node_path33.default.join(configDir, workflowsUnderSubagents))) {
     if (runDir.startsWith(WORKFLOW_RUN_PREFIX)) {
-      agentCount += fs23.readdir(import_node_path33.default.join(configDir, workflowsUnderSubagents, runDir)).filter(isMeta).length;
+      agentCount += fs24.readdir(import_node_path33.default.join(configDir, workflowsUnderSubagents, runDir)).filter(isMeta).length;
     }
   }
-  const workflowRunCount = fs23.readdir(import_node_path33.default.join(configDir, sessionRelative, WORKFLOWS_DIR)).filter((name) => name.startsWith(WORKFLOW_RUN_PREFIX) && name.endsWith(JSON_SUFFIX)).length;
-  const transcript = fs23.lstat(import_node_path33.default.join(configDir, PROJECTS_DIR, ref.project, `${ref.entry}${TRANSCRIPT_SUFFIX}`));
+  const workflowRunCount = fs24.readdir(import_node_path33.default.join(configDir, sessionRelative, WORKFLOWS_DIR)).filter((name) => name.startsWith(WORKFLOW_RUN_PREFIX) && name.endsWith(JSON_SUFFIX)).length;
+  const transcript = fs24.lstat(import_node_path33.default.join(configDir, PROJECTS_DIR, ref.project, `${ref.entry}${TRANSCRIPT_SUFFIX}`));
   return { ...ref, agentCount, workflowRunCount, ...transcript === void 0 ? {} : { updatedAt: new Date(transcript.mtimeMs).toISOString() } };
 }
-function readSessionAgentTree(fs23, configDir, ref, options = {}) {
+function readSessionAgentTree(fs24, configDir, ref, options = {}) {
   const problems = [];
   const report = (problem) => {
     problems.push(problem);
@@ -112801,15 +112830,15 @@ function readSessionAgentTree(fs23, configDir, ref, options = {}) {
   const sessionRelative = import_node_path33.default.join(PROJECTS_DIR, ref.project, ref.entry);
   const subagentsRelative = import_node_path33.default.join(sessionRelative, SUBAGENTS_DIR);
   const workflowsUnderSubagents = import_node_path33.default.join(subagentsRelative, WORKFLOWS_DIR);
-  const located = locateAgents(fs23, configDir, subagentsRelative, void 0, report);
-  for (const runDir of listDirOrReport(fs23, configDir, workflowsUnderSubagents, report)) {
+  const located = locateAgents(fs24, configDir, subagentsRelative, void 0, report);
+  for (const runDir of listDirOrReport(fs24, configDir, workflowsUnderSubagents, report)) {
     if (runDir.startsWith(WORKFLOW_RUN_PREFIX)) {
-      located.push(...locateAgents(fs23, configDir, import_node_path33.default.join(workflowsUnderSubagents, runDir), runDir, report));
+      located.push(...locateAgents(fs24, configDir, import_node_path33.default.join(workflowsUnderSubagents, runDir), runDir, report));
     }
   }
   const agents = /* @__PURE__ */ new Map();
   for (const candidate of located) {
-    const text2 = readFileOrReport(fs23, configDir, candidate.metaPath, report);
+    const text2 = readFileOrReport(fs24, configDir, candidate.metaPath, report);
     if (text2 === void 0) {
       continue;
     }
@@ -112821,7 +112850,7 @@ function readSessionAgentTree(fs23, configDir, ref, options = {}) {
     agents.set(candidate.id, { located: candidate, meta: parsed.data });
   }
   const teamNames = [...new Set([...agents.values()].flatMap((agent) => agent.meta.teamName === void 0 ? [] : [agent.meta.teamName]))].sort();
-  const parentOf4 = resolveParents(fs23, configDir, agents, report);
+  const parentOf4 = resolveParents(fs24, configDir, agents, report);
   const childrenOf = /* @__PURE__ */ new Map();
   const roots = [];
   for (const id2 of agents.keys()) {
@@ -112844,12 +112873,12 @@ function readSessionAgentTree(fs23, configDir, ref, options = {}) {
     sessionId: ref.sessionId,
     superseded: ref.superseded,
     agents: roots.sort().map(build),
-    tasks: readTasks(fs23, configDir, ownTaskLists(ref.sessionId), [.../* @__PURE__ */ new Set([...teamNames, ...options.taskListIds ?? []])].filter((id2) => !ownTaskLists(ref.sessionId).includes(id2)), report),
-    workflowRuns: readWorkflowRuns(fs23, configDir, import_node_path33.default.join(sessionRelative, WORKFLOWS_DIR), report),
+    tasks: readTasks(fs24, configDir, ownTaskLists(ref.sessionId), [.../* @__PURE__ */ new Set([...teamNames, ...options.taskListIds ?? []])].filter((id2) => !ownTaskLists(ref.sessionId).includes(id2)), report),
+    workflowRuns: readWorkflowRuns(fs24, configDir, import_node_path33.default.join(sessionRelative, WORKFLOWS_DIR), report),
     problems
   };
 }
-function resolveParents(fs23, configDir, agents, report) {
+function resolveParents(fs24, configDir, agents, report) {
   const parentOf4 = /* @__PURE__ */ new Map();
   const transcriptCache = /* @__PURE__ */ new Map();
   const transcriptOf = (agent) => {
@@ -112857,7 +112886,7 @@ function resolveParents(fs23, configDir, agents, report) {
     if (cached2 !== void 0) {
       return cached2;
     }
-    const text2 = readFileOrReport(fs23, configDir, agent.located.transcriptPath, report) ?? "";
+    const text2 = readFileOrReport(fs24, configDir, agent.located.transcriptPath, report) ?? "";
     transcriptCache.set(agent.located.id, text2);
     return text2;
   };
@@ -112907,16 +112936,16 @@ function resolveParents(fs23, configDir, agents, report) {
 function ownTaskLists(sessionId) {
   return [sessionId, `${SHORT_SESSION_LIST_PREFIX}${sessionId.slice(0, SHORT_SESSION_ID_LENGTH)}`];
 }
-function readTasks(fs23, configDir, ownLists, sharedLists, report) {
+function readTasks(fs24, configDir, ownLists, sharedLists, report) {
   const tasks = [];
   [...ownLists, ...sharedLists].forEach((scope, index) => {
     const relativeDir = import_node_path33.default.join(TASKS_DIR, scope);
-    for (const name of [...listDirOrReport(fs23, configDir, relativeDir, report)].sort()) {
+    for (const name of [...listDirOrReport(fs24, configDir, relativeDir, report)].sort()) {
       if (name.startsWith(".") || !name.endsWith(JSON_SUFFIX)) {
         continue;
       }
       const relative = import_node_path33.default.join(relativeDir, name);
-      const text2 = readFileOrReport(fs23, configDir, relative, report);
+      const text2 = readFileOrReport(fs24, configDir, relative, report);
       const parsed = TaskFileSchema.safeParse(text2 === void 0 ? void 0 : parseJson3(text2));
       if (parsed.success) {
         tasks.push(index < ownLists.length ? parsed.data : { ...parsed.data, taskList: scope });
@@ -112927,14 +112956,14 @@ function readTasks(fs23, configDir, ownLists, sharedLists, report) {
   });
   return tasks;
 }
-function readWorkflowRuns(fs23, configDir, relativeDir, report) {
+function readWorkflowRuns(fs24, configDir, relativeDir, report) {
   const runs = [];
-  for (const name of [...listDirOrReport(fs23, configDir, relativeDir, report)].sort()) {
+  for (const name of [...listDirOrReport(fs24, configDir, relativeDir, report)].sort()) {
     if (!name.startsWith(WORKFLOW_RUN_PREFIX) || !name.endsWith(JSON_SUFFIX)) {
       continue;
     }
     const relative = import_node_path33.default.join(relativeDir, name);
-    const text2 = readFileOrReport(fs23, configDir, relative, report);
+    const text2 = readFileOrReport(fs24, configDir, relative, report);
     const parsed = WorkflowRunFileSchema.safeParse(text2 === void 0 ? void 0 : parseJson3(text2));
     if (!parsed.success) {
       if (text2 !== void 0) {
@@ -112958,11 +112987,11 @@ var SessionLookupError = class extends CliError {
 function identityConfigDir(identitiesDir, identity) {
   return import_node_path34.default.join(identitiesDir, identity);
 }
-function historyStores(fs23, identitiesDir, identities) {
+function historyStores(fs24, identitiesDir, identities) {
   const byRealPath = /* @__PURE__ */ new Map();
   for (const identity of identities) {
     const configDir = identityConfigDir(identitiesDir, identity);
-    const real = fs23.realpath(import_node_path34.default.join(configDir, "projects"));
+    const real = fs24.realpath(import_node_path34.default.join(configDir, "projects"));
     if (real === void 0) {
       continue;
     }
@@ -112975,15 +113004,15 @@ function historyStores(fs23, identitiesDir, identities) {
   }
   return [...byRealPath.values()];
 }
-function collectSessionList(fs23, identitiesDir, identities, filters) {
+function collectSessionList(fs24, identitiesDir, identities, filters) {
   const names = filters.identity === void 0 ? identities : identities.filter((name) => name === filters.identity);
   if (filters.identity !== void 0 && names.length === 0) {
     throw new SessionLookupError(`no identity named "${filters.identity}"`);
   }
   const sessions = [];
-  for (const store of historyStores(fs23, identitiesDir, names)) {
-    for (const ref of listSessions2(fs23, store.configDir)) {
-      const summary = summariseSession(fs23, store.configDir, ref);
+  for (const store of historyStores(fs24, identitiesDir, names)) {
+    for (const ref of listSessions2(fs24, store.configDir)) {
+      const summary = summariseSession(fs24, store.configDir, ref);
       if (filters.all === true || summary.agentCount > 0 || summary.workflowRunCount > 0) {
         sessions.push({ ...summary, identities: store.identities });
       }
@@ -112991,14 +113020,14 @@ function collectSessionList(fs23, identitiesDir, identities, filters) {
   }
   return sessions.sort((left, right) => (right.updatedAt ?? "").localeCompare(left.updatedAt ?? "") || left.sessionId.localeCompare(right.sessionId));
 }
-function locateSession(fs23, identitiesDir, identities, query, onlyIdentity) {
+function locateSession(fs24, identitiesDir, identities, query, onlyIdentity) {
   const names = onlyIdentity === void 0 ? identities : identities.filter((name) => name === onlyIdentity);
   if (onlyIdentity !== void 0 && names.length === 0) {
     throw new SessionLookupError(`no identity named "${onlyIdentity}"`);
   }
   const matches = [];
-  for (const store of historyStores(fs23, identitiesDir, names)) {
-    for (const ref of listSessions2(fs23, store.configDir)) {
+  for (const store of historyStores(fs24, identitiesDir, names)) {
+    for (const ref of listSessions2(fs24, store.configDir)) {
       if (ref.sessionId.startsWith(query)) {
         matches.push({ identities: store.identities, configDir: store.configDir, ref });
       }
@@ -113015,9 +113044,9 @@ function locateSession(fs23, identitiesDir, identities, query, onlyIdentity) {
   }
   throw new SessionLookupError(`"${query}" matches ${String(candidates.length)} sessions: ${candidates.map((match) => `${match.ref.sessionId} (${match.identities.join(", ")})`).join("; ")}; give more of the id or pass --identity`);
 }
-function showSession(fs23, identitiesDir, identities, query, onlyIdentity) {
-  const located = locateSession(fs23, identitiesDir, identities, query, onlyIdentity);
-  return { identities: located.identities, tree: readSessionAgentTree(fs23, located.configDir, located.ref) };
+function showSession(fs24, identitiesDir, identities, query, onlyIdentity) {
+  const located = locateSession(fs24, identitiesDir, identities, query, onlyIdentity);
+  return { identities: located.identities, tree: readSessionAgentTree(fs24, located.configDir, located.ref) };
 }
 
 // src/frontdoor/commands.ts
@@ -113389,8 +113418,8 @@ var StampsFileSchema = external_exports.strictObject({
   schemaVersion: external_exports.literal(STAMPS_SCHEMA_VERSION),
   handled: external_exports.record(external_exports.string().min(1), external_exports.iso.datetime())
 });
-function readHandled(fs23, file2) {
-  const raw = fs23.readFileUtf8(file2);
+function readHandled(fs24, file2) {
+  const raw = fs24.readFileUtf8(file2);
   if (raw === void 0) {
     return {};
   }
@@ -113403,10 +113432,10 @@ function readHandled(fs23, file2) {
   const result = StampsFileSchema.safeParse(parsed);
   return result.success ? Object.fromEntries(Object.entries(result.data.handled).map(([key, at2]) => [key, Date.parse(at2)])) : {};
 }
-function writeHandled(fs23, file2, handled) {
+function writeHandled(fs24, file2, handled) {
   const next = { schemaVersion: STAMPS_SCHEMA_VERSION, handled: Object.fromEntries(Object.entries(handled).map(([key, at2]) => [key, new Date(at2).toISOString()])) };
-  fs23.mkdirPrivate(import_node_path43.default.dirname(file2));
-  fs23.writeFilePrivate(file2, `${JSON.stringify(next, null, 2)}
+  fs24.mkdirPrivate(import_node_path43.default.dirname(file2));
+  fs24.writeFilePrivate(file2, `${JSON.stringify(next, null, 2)}
 `);
 }
 
@@ -114167,9 +114196,9 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
   }
 }
 async function serveFrontDoor(idleShutdownMinutes, ports, options) {
-  const { fs: fs23, paths } = ports;
+  const { fs: fs24, paths } = ports;
   const servingBinary = ports.statOwnExecutable();
-  const previous = readFrontDoorState(fs23, paths.frontdoorStateFile);
+  const previous = readFrontDoorState(fs24, paths.frontdoorStateFile);
   let lastPort = previous?.lastPort;
   let lastConnectPort = previous?.lastConnectPort;
   let lastDirectPort = previous?.lastDirectPort;
@@ -114180,12 +114209,12 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
   });
   const fail = (message) => {
     ports.closeRcStreamHub();
-    writeFrontDoorState(fs23, paths.frontdoorStateFile, { lastError: message, ...sticky() });
-    fs23.removeRecursive(paths.frontdoorLockFile);
+    writeFrontDoorState(fs24, paths.frontdoorStateFile, { lastError: message, ...sticky() });
+    fs24.removeRecursive(paths.frontdoorLockFile);
     ports.log(`agent-shim frontdoor supervisor: ${message}`);
     return 1;
   };
-  writeFrontDoorState(fs23, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, ...sticky() });
+  writeFrontDoorState(fs24, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, ...sticky() });
   const previousSticky = lastPort;
   let http8;
   try {
@@ -114225,16 +114254,16 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
     ports.log(`agent-shim frontdoor supervisor: sticky direct port ${String(previousStickyDirect)} was occupied; moving to ${String(direct.port)} (headroom admits the new address once its supervisor rewrites the allowlist file)`);
   }
   lastDirectPort = direct.port;
-  writeFrontDoorDirectRecord(fs23, paths.frontdoorDirectRecordsDir, { pid: ports.ownPid, directPort: direct.port });
-  writeFrontDoorState(fs23, paths.frontdoorStateFile, { protocol: FRONT_DOOR_PROTOCOL, supervisorPid: ports.ownPid, port: http8.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
+  writeFrontDoorDirectRecord(fs24, paths.frontdoorDirectRecordsDir, { pid: ports.ownPid, directPort: direct.port });
+  writeFrontDoorState(fs24, paths.frontdoorStateFile, { protocol: FRONT_DOOR_PROTOCOL, supervisorPid: ports.ownPid, port: http8.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
   ports.doorHealth.generation({ providerPort: http8.port, connectPort: connect3.port, directPort: direct.port });
-  fs23.removeRecursive(paths.frontdoorLockFile);
+  fs24.removeRecursive(paths.frontdoorLockFile);
   ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http8.port)}, CONNECT surface on 127.0.0.1:${String(connect3.port)}`);
   const watchdog = ports.startWatchdog?.();
   let idleSince;
   let ticks = 0;
   const supersedingOwner = () => {
-    const owner = readFrontDoorState(fs23, paths.frontdoorStateFile)?.supervisorPid;
+    const owner = readFrontDoorState(fs24, paths.frontdoorStateFile)?.supervisorPid;
     return owner !== void 0 && owner !== ports.ownPid && ports.isRunning(owner) ? owner : void 0;
   };
   let supersededBy;
@@ -114249,12 +114278,12 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
     await connect3.close();
     await http8.close();
     ports.closeRcStreamHub();
-    removeFrontDoorDirectRecord(fs23, paths.frontdoorDirectRecordsDir, ports.ownPid);
+    removeFrontDoorDirectRecord(fs24, paths.frontdoorDirectRecordsDir, ports.ownPid);
   };
   const shutdown = async () => {
     await closeServing();
     if (supersedingOwner() === void 0) {
-      writeFrontDoorState(fs23, paths.frontdoorStateFile, sticky());
+      writeFrontDoorState(fs24, paths.frontdoorStateFile, sticky());
     }
     return 0;
   };
@@ -114265,8 +114294,8 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
       return FRONTDOOR_SUPERVISOR_STILL_RUNNING;
     }
     ticks += 1;
-    const listed = listFrontDoorSessions(fs23, paths.frontdoorSessionsDir);
-    const pruned = pruneDeadFrontDoorSessions(fs23, paths.frontdoorSessionsDir, ports.isRunning);
+    const listed = listFrontDoorSessions(fs24, paths.frontdoorSessionsDir);
+    const pruned = pruneDeadFrontDoorSessions(fs24, paths.frontdoorSessionsDir, ports.isRunning);
     ports.observeLaunchRegistry(listed, pruned);
     ports.checkQuotaExpiry();
     const prunedPids = new Set(pruned);
@@ -116746,7 +116775,7 @@ function realConnectEffects(ports = DOOR_SOURCE_PORTS) {
 init_claudeShim();
 init_store();
 init_realPorts();
-var import_node_fs17 = __toESM(require("node:fs"), 1);
+var import_node_fs18 = __toESM(require("node:fs"), 1);
 var import_node_path46 = __toESM(require("node:path"), 1);
 
 // src/usage/signIn.ts
@@ -116770,12 +116799,12 @@ function decideSignIn(facts) {
 function credentialsFilePath(farmRoot) {
   return import_node_path45.default.join(farmRoot, CREDENTIALS_FILE);
 }
-function identitySignIn(fs23, probe, identity) {
+function identitySignIn(fs24, probe, identity) {
   const probing = !identity.hasCredentialBlock;
   return decideSignIn({
     hasCredentialBlock: identity.hasCredentialBlock,
     keychainItem: probing && probe.platform === "darwin" && probe.run !== void 0 ? keychainHasItem(probe.run, identity.farmRoot) : void 0,
-    credentialsFile: probing && fs23.lstat(credentialsFilePath(identity.farmRoot)) !== void 0,
+    credentialsFile: probing && fs24.lstat(credentialsFilePath(identity.farmRoot)) !== void 0,
     platform: probe.platform
   });
 }
@@ -116901,6 +116930,53 @@ function pushFrontDoor(push, supervisors, registeredPid, liveSessions) {
     );
   }
 }
+var LISTENER_ROUTES = {
+  provider: "provider sessions (`z`, `m` and the like)",
+  connect: "every plain OAuth session, which reaches Anthropic through it"
+};
+function pushFrontDoorListeners(push, readings) {
+  for (const reading of readings) {
+    const where = `127.0.0.1:${String(reading.port)}`;
+    if (reading.ok) {
+      push("frontdoor", "pass", `The front door's ${reading.listener} listener on ${where} accepted a probe in ${String(Math.round(reading.elapsedMs))} ms.`, reading.listener);
+      continue;
+    }
+    push(
+      "frontdoor",
+      "fail",
+      `The front door's ${reading.listener} listener on ${where} did not accept a probe${reading.reason === void 0 ? "" : ` (${reading.reason})`}, so ${LISTENER_ROUTES[reading.listener]} cannot get through while it stays like this. The supervisor is alive but is not serving: \`agent-shim frontdoor restart\` replaces it.`,
+      reading.listener
+    );
+  }
+}
+
+// src/frontdoor/listenerReadings.ts
+var import_node_fs17 = __toESM(require("node:fs"), 1);
+init_probe();
+function readFrontDoorListeners(state, supervisorAlive, probes) {
+  if (!supervisorAlive) {
+    return [];
+  }
+  const readings = [];
+  const take = (listener, port, probe) => {
+    if (port === void 0) {
+      return;
+    }
+    const started = probes.now();
+    const verdict = probe(port);
+    readings.push({ listener, port, ok: verdict.ok, ...verdict.ok ? {} : { reason: verdict.reason }, elapsedMs: Math.max(0, probes.now() - started) });
+  };
+  take("provider", state.port, probes.authenticateProvider);
+  take("connect", state.connectPort, probes.connect);
+  return readings;
+}
+function realFrontDoorListenerProbes(paths) {
+  return {
+    authenticateProvider: (port) => probeFrontDoorSync(port, import_node_fs17.default.readFileSync(paths.frontdoorCaCertFile, "utf8")),
+    connect: probeListenerAcceptSync,
+    now: () => performance.now()
+  };
+}
 
 // src/doctorReport.ts
 init_supervisorProcesses();
@@ -117345,6 +117421,9 @@ function runDoctor(params) {
   if (params.frontDoor !== void 0) {
     const validated2 = params.frontDoor.state.raw === void 0 ? void 0 : validateJson(FrontDoorStateSchema, params.frontDoor.state);
     pushFrontDoor(push, params.frontDoor.supervisors, validated2?.ok === true ? validated2.data.supervisorPid : void 0, params.frontDoor.liveSessions);
+    if (params.frontDoor.listeners !== void 0) {
+      pushFrontDoorListeners(push, params.frontDoor.listeners);
+    }
   }
   if (params.activeIdentity.raw === void 0) {
     push("active-identity", "pass", "No active identity set.");
@@ -117428,25 +117507,30 @@ function formatDoctorReport(report) {
 }
 function realpathOrSelf(target) {
   try {
-    return import_node_fs17.default.realpathSync(target);
+    return import_node_fs18.default.realpathSync(target);
   } catch {
     return target;
   }
 }
+function servingDoorListeners(paths) {
+  const state = readFrontDoorState(realFarmFs, paths.frontdoorStateFile) ?? {};
+  const alive = state.supervisorPid !== void 0 && realIsProcessRunning(state.supervisorPid);
+  return readFrontDoorListeners(state, alive, realFrontDoorListenerProbes(paths));
+}
 function collectDoctorReport(params) {
   const { paths } = params;
-  const identityNames = import_node_fs17.default.existsSync(paths.identitiesDir) ? import_node_fs17.default.readdirSync(paths.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && isIdentityDirectoryName(entry.name)).map((entry) => entry.name).sort() : [];
+  const identityNames = import_node_fs18.default.existsSync(paths.identitiesDir) ? import_node_fs18.default.readdirSync(paths.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && isIdentityDirectoryName(entry.name)).map((entry) => entry.name).sort() : [];
   const identities = identityNames.map((name) => {
     const farmRoot = import_node_path46.default.join(paths.identitiesDir, name);
     const identityPath = import_node_path46.default.join(farmRoot, "identity.json");
-    return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot, credentialsFilePresent: import_node_fs17.default.existsSync(credentialsFilePath(farmRoot)) };
+    return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot, credentialsFilePresent: import_node_fs18.default.existsSync(credentialsFilePath(farmRoot)) };
   });
-  const profileNames = import_node_fs17.default.existsSync(paths.configProfilesDir) ? import_node_fs17.default.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
+  const profileNames = import_node_fs18.default.existsSync(paths.configProfilesDir) ? import_node_fs18.default.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const configProfiles = profileNames.map((name) => {
     const profilePath = import_node_path46.default.join(paths.configProfilesDir, `${name}.json`);
     return { name, path: profilePath, raw: realFsPort.readFileUtf8(profilePath) };
   });
-  const providerNames = import_node_fs17.default.existsSync(paths.providersDir) ? import_node_fs17.default.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
+  const providerNames = import_node_fs18.default.existsSync(paths.providersDir) ? import_node_fs18.default.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const providers = providerNames.map((name) => {
     const providerPath = import_node_path46.default.join(paths.providersDir, `${name}.json`);
     return { name, path: providerPath, raw: realFsPort.readFileUtf8(providerPath) };
@@ -117491,7 +117575,7 @@ function collectDoctorReport(params) {
     categoriesLocal: { path: paths.categoriesLocalFile, raw: realFsPort.readFileUtf8(paths.categoriesLocalFile) },
     activeIdentity: { path: paths.activeIdentityFile, raw: realFsPort.readFileUtf8(paths.activeIdentityFile) },
     binaryDiscovery,
-    claudeShim: { state: shimState, targetExists: shimState !== void 0 && import_node_fs17.default.existsSync(shimState.targetPath) },
+    claudeShim: { state: shimState, targetExists: shimState !== void 0 && import_node_fs18.default.existsSync(shimState.targetPath) },
     rootPath: paths.root,
     pathResolution: {
       ownExecutablePath,
@@ -117531,7 +117615,7 @@ function collectDoctorReport(params) {
         logPath: paths.headroomLogPath
       }
     },
-    ...uid === void 0 ? {} : { frontDoor: { state: { path: paths.frontdoorStateFile, raw: realFsPort.readFileUtf8(paths.frontdoorStateFile) }, supervisors: listFrontDoorSupervisors(realRunPort, uid), liveSessions: listFrontDoorSessions(realFarmFs, paths.frontdoorSessionsDir).filter((session) => realIsProcessRunning(session.pid)) } }
+    ...uid === void 0 ? {} : { frontDoor: { state: { path: paths.frontdoorStateFile, raw: realFsPort.readFileUtf8(paths.frontdoorStateFile) }, supervisors: listFrontDoorSupervisors(realRunPort, uid), liveSessions: listFrontDoorSessions(realFarmFs, paths.frontdoorSessionsDir).filter((session) => realIsProcessRunning(session.pid)), listeners: servingDoorListeners(paths) } }
   });
   return report;
 }
@@ -126773,8 +126857,8 @@ async function applyHeadroomHop(request7, response, upstream, deps, onThread) {
   if (request7.session.projectId !== void 0) {
     headers[PROJECT_ID_HEADER] = request7.session.projectId;
   }
-  if (request7.session.sessionId !== void 0) {
-    headers[SESSION_ATTRIBUTION_HEADER] = request7.session.sessionId;
+  if (request7.session.sessionId !== void 0 && !Object.keys(headers).some((name) => name.toLowerCase() === CLIENT_SESSION_HEADER)) {
+    headers[CLIENT_SESSION_HEADER] = request7.session.sessionId;
   }
   headers[HOP_SECRET_HEADER] = deps.hopSecret;
   try {
@@ -128463,8 +128547,8 @@ var SELF_HOST_SUBSCRIPTION_TYPE = "max";
 function isRecord8(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 }
-function readJsonObject(fs23, file2) {
-  const raw = fs23.readFileUtf8(file2);
+function readJsonObject(fs24, file2) {
+  const raw = fs24.readFileUtf8(file2);
   if (raw === void 0) {
     return void 0;
   }
@@ -128476,8 +128560,8 @@ function readJsonObject(fs23, file2) {
   }
   return isRecord8(parsed) ? parsed : void 0;
 }
-function readRcSelfHostRecord(fs23, frontdoorDir) {
-  const parsed = readJsonObject(fs23, import_node_path49.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
+function readRcSelfHostRecord(fs24, frontdoorDir) {
+  const parsed = readJsonObject(fs24, import_node_path49.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
   if (parsed === void 0) {
     return void 0;
   }
@@ -128922,11 +129006,11 @@ function credentialOfJson(parsed) {
 function sequenceNumOfJson(value2) {
   return typeof value2 === "number" && Number.isInteger(value2) && value2 >= 0 ? value2 : void 0;
 }
-function createRcCredentialStore(fs23, dir) {
-  fs23.mkdirPrivate(dir);
+function createRcCredentialStore(fs24, dir) {
+  fs24.mkdirPrivate(dir);
   const fileFor = (sessionId) => import_node_path50.default.join(dir, `${sessionId}.json`);
   const readParsed = (sessionId) => {
-    const raw = fs23.readFileUtf8(fileFor(sessionId));
+    const raw = fs24.readFileUtf8(fileFor(sessionId));
     if (raw === void 0) {
       return void 0;
     }
@@ -128951,7 +129035,7 @@ function createRcCredentialStore(fs23, dir) {
       }
       const cursor3 = sequenceNumOfJson(readParsed(sessionId)?.highestSequenceNum);
       const record2 = { ...credential, ...cursor3 === void 0 ? {} : { highestSequenceNum: cursor3 } };
-      fs23.writeFilePrivate(fileFor(sessionId), `${JSON.stringify(record2, null, 2)}
+      fs24.writeFilePrivate(fileFor(sessionId), `${JSON.stringify(record2, null, 2)}
 `);
     },
     readCursor: (sessionId) => {
@@ -128966,14 +129050,14 @@ function createRcCredentialStore(fs23, dir) {
       }
       const credential = credentialOfJson(readParsed(sessionId));
       const record2 = credential === void 0 ? { highestSequenceNum } : { ...credential, highestSequenceNum };
-      fs23.writeFilePrivate(fileFor(sessionId), `${JSON.stringify(record2, null, 2)}
+      fs24.writeFilePrivate(fileFor(sessionId), `${JSON.stringify(record2, null, 2)}
 `);
     },
     remove: (sessionId) => {
       if (!isSafeSessionId(sessionId)) {
         return;
       }
-      fs23.removeRecursive(fileFor(sessionId));
+      fs24.removeRecursive(fileFor(sessionId));
     }
   };
 }
@@ -131137,6 +131221,12 @@ function formatFrontDoorStatus(status, caCertPath) {
   lines.push(`daemon log: ${status.logPath}${status.logExists ? "" : " (not created yet)"}`);
   return lines;
 }
+function formatFrontDoorListeners(readings) {
+  return readings.map((reading) => {
+    const what = reading.listener === "provider" ? "provider listener" : "connect surface";
+    return reading.ok ? `${what}: accepting on 127.0.0.1:${String(reading.port)} (probe took ${String(Math.round(reading.elapsedMs))} ms)` : `${what}: NOT accepting on 127.0.0.1:${String(reading.port)}${reading.reason === void 0 ? "" : ` (${reading.reason})`}`;
+  });
+}
 
 // src/frontdoor/commands.ts
 init_state();
@@ -131181,8 +131271,8 @@ function createRealQuotaRefresher(params) {
 // src/frontdoor/commands.ts
 init_store2();
 function appendLog(paths, line) {
-  import_node_fs18.default.mkdirSync(paths.logsDir, { recursive: true });
-  import_node_fs18.default.appendFileSync(paths.frontdoorLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+  import_node_fs19.default.mkdirSync(paths.logsDir, { recursive: true });
+  import_node_fs19.default.appendFileSync(paths.frontdoorLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
 `);
 }
 function rcObservingResolver(resolve2, tracker, hub) {
@@ -131195,7 +131285,7 @@ function rcObservingResolver(resolve2, tracker, hub) {
 }
 function realStatOwnExecutable(watchPath) {
   return () => {
-    const st2 = import_node_fs18.default.statSync(watchPath, { throwIfNoEntry: false });
+    const st2 = import_node_fs19.default.statSync(watchPath, { throwIfNoEntry: false });
     return st2?.isFile() !== true ? void 0 : { dev: st2.dev, ino: st2.ino, size: st2.size, mtimeMs: st2.mtimeMs };
   };
 }
@@ -131395,7 +131485,7 @@ function realFrontDoorSupervisorPorts(paths) {
     },
     isRunning: realIsProcessRunning,
     // The turnover check's file identity, over the installed entry resolved once at door start: re-resolving per tick would re-run the PATH scan every second and could theoretically flip between two files, while the entry itself is fixed for as long as this door lives. The existence check prefers the agent-shim sibling only when it is really there (see watchedInstallEntry).
-    statOwnExecutable: realStatOwnExecutable(watchedInstallEntry(realOwnExecutablePath(), (candidate) => import_node_fs18.default.existsSync(candidate))),
+    statOwnExecutable: realStatOwnExecutable(watchedInstallEntry(realOwnExecutablePath(), (candidate) => import_node_fs19.default.existsSync(candidate))),
     startProviderListener: async (preferredPort) => {
       const authority = loadCa();
       const rcDial = rcSelfHost ? lateRcEventDial(rcSelfHostDialTarget) : realRcEventDial();
@@ -131591,11 +131681,12 @@ function registerFrontDoorCommand(program2, deps) {
   withExamples(
     frontdoor.command("status").description("Report the front door's supervisor, listeners, sessions, and last error. Read-only.").option("--json", "Print the status as JSON.").action((options) => {
       const status = collectFrontDoorStatus(realFarmFs, realHeadroomSocketTrust, paths, realIsProcessRunning);
+      const listeners = readFrontDoorListeners(status.state, status.supervisorAlive, realFrontDoorListenerProbes(paths));
       if (options.json === true) {
-        printJson(status);
+        printJson({ ...status, listeners });
         return;
       }
-      for (const line of formatFrontDoorStatus(status, paths.frontdoorCaCertFile)) {
+      for (const line of [...formatFrontDoorStatus(status, paths.frontdoorCaCertFile), ...formatFrontDoorListeners(listeners)]) {
         console.log(line);
       }
     }),
@@ -141375,7 +141466,7 @@ async function serveMcp(mcp, transport, options = {}) {
 }
 
 // src/mcp/permissions.ts
-var import_node_fs19 = __toESM(require("node:fs"), 1);
+var import_node_fs20 = __toESM(require("node:fs"), 1);
 var import_node_path52 = __toESM(require("node:path"), 1);
 init_zod();
 init_store();
@@ -141392,15 +141483,15 @@ function readStoredMcpPermissions(paths) {
 }
 function writeStoredMcpPermissions(paths, permissions) {
   writeJsonAtomic(paths.mcpPermissionsFile, { writes: permissions.writes, remoteControl: permissions.remoteControl, history: permissions.history });
-  import_node_fs19.default.chmodSync(paths.mcpPermissionsFile, OWNER_ONLY_MODE);
+  import_node_fs20.default.chmodSync(paths.mcpPermissionsFile, OWNER_ONLY_MODE);
 }
 function effectiveMcpPermissions(flags, stored) {
   return { writes: flags.writes || stored.writes, remoteControl: flags.remoteControl || stored.remoteControl, history: flags.history || stored.history };
 }
 function watchMcpPermissions(paths, onChange) {
   const directory = import_node_path52.default.dirname(paths.mcpPermissionsFile);
-  import_node_fs19.default.mkdirSync(directory, { recursive: true });
-  const watcher = import_node_fs19.default.watch(directory, (_event, filename) => {
+  import_node_fs20.default.mkdirSync(directory, { recursive: true });
+  const watcher = import_node_fs20.default.watch(directory, (_event, filename) => {
     if (filename === null || filename === import_node_path52.default.basename(paths.mcpPermissionsFile)) {
       onChange();
     }
@@ -141713,7 +141804,7 @@ init_credential();
 init_credentialCache();
 
 // src/identityToken.ts
-var import_node_fs20 = __toESM(require("node:fs"), 1);
+var import_node_fs21 = __toESM(require("node:fs"), 1);
 var import_node_path53 = __toESM(require("node:path"), 1);
 init_cliError();
 var TOKEN_FILE_MODE = 384;
@@ -141731,13 +141822,13 @@ function storeIdentityToken(paths, identityName, raw) {
     throw new UsageError("That is not a claude setup-token token (expected it to start with sk-ant-oat). Run `claude setup-token` and pass its token on standard input.");
   }
   const dir = identityTokenDir(paths);
-  import_node_fs20.default.mkdirSync(dir, { recursive: true, mode: TOKEN_DIR_MODE });
-  import_node_fs20.default.chmodSync(dir, TOKEN_DIR_MODE);
+  import_node_fs21.default.mkdirSync(dir, { recursive: true, mode: TOKEN_DIR_MODE });
+  import_node_fs21.default.chmodSync(dir, TOKEN_DIR_MODE);
   const target = identityTokenPath(paths, identityName);
   const temp = import_node_path53.default.join(dir, `.${identityName}.${String(process.pid)}.tmp`);
-  import_node_fs20.default.writeFileSync(temp, `${token}
+  import_node_fs21.default.writeFileSync(temp, `${token}
 `, { mode: TOKEN_FILE_MODE });
-  import_node_fs20.default.renameSync(temp, target);
+  import_node_fs21.default.renameSync(temp, target);
   return target;
 }
 
@@ -141900,7 +141991,7 @@ function registerDoctorCommand(program2, deps) {
 }
 
 // src/headroom/commands.ts
-var import_node_fs21 = __toESM(require("node:fs"), 1);
+var import_node_fs22 = __toESM(require("node:fs"), 1);
 var import_node_http4 = __toESM(require("node:http"), 1);
 var import_node_path54 = __toESM(require("node:path"), 1);
 var import_node_child_process7 = require("node:child_process");
@@ -142124,12 +142215,12 @@ function realSupervisorPorts(paths) {
     readConfig: () => resolveSupervisorConfig(readGlobalConfig(paths)?.headroom ?? {}),
     spawnHeadroom: (socketPath, allowlistFile, settings2) => {
       const trust = resolveHeadroomTrustBundle({ caCertFile: paths.frontdoorCaCertFile, bundlesDir: paths.frontdoorCaBundlesDir, inherited: process.env[HEADROOM_CA_BUNDLE], fs: realTrustBundleFs });
-      import_node_fs21.default.mkdirSync(paths.logsDir, { recursive: true });
+      import_node_fs22.default.mkdirSync(paths.logsDir, { recursive: true });
       if (trust?.warning !== void 0) {
-        import_node_fs21.default.appendFileSync(paths.headroomLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${trust.warning}
+        import_node_fs22.default.appendFileSync(paths.headroomLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${trust.warning}
 `);
       }
-      const logFd = import_node_fs21.default.openSync(paths.headroomLogPath, "a");
+      const logFd = import_node_fs22.default.openSync(paths.headroomLogPath, "a");
       try {
         const child = (0, import_node_child_process7.spawn)("headroom", headroomProxyArgs(socketPath, allowlistFile, settings2), {
           detached: true,
@@ -142144,12 +142235,12 @@ function realSupervisorPorts(paths) {
         child.once("exit", (code, signal) => {
           ownedHeadroom.delete(pid);
           exitedHeadroom.add(pid);
-          import_node_fs21.default.appendFileSync(paths.headroomLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} agent-shim headroom supervisor: headroom exited (${signal ?? `code ${String(code)}`})
+          import_node_fs22.default.appendFileSync(paths.headroomLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} agent-shim headroom supervisor: headroom exited (${signal ?? `code ${String(code)}`})
 `);
         });
         return pid;
       } finally {
-        import_node_fs21.default.closeSync(logFd);
+        import_node_fs22.default.closeSync(logFd);
       }
     },
     stopProcess: (pid) => {
@@ -142162,7 +142253,7 @@ function realSupervisorPorts(paths) {
         now: () => Date.now()
       });
       if (outcome === "still-running") {
-        import_node_fs21.default.appendFileSync(
+        import_node_fs22.default.appendFileSync(
           paths.headroomLogPath,
           `${(/* @__PURE__ */ new Date()).toISOString()} agent-shim headroom supervisor: pid ${String(pid)} survived SIGKILL within its grace; it is stuck uninterruptibly
 `
@@ -142180,10 +142271,10 @@ function realSupervisorPorts(paths) {
         };
       }
       if (result.stdout !== "") {
-        import_node_fs21.default.appendFileSync(paths.headroomLogPath, result.stdout);
+        import_node_fs22.default.appendFileSync(paths.headroomLogPath, result.stdout);
       }
       if (result.stderr !== "") {
-        import_node_fs21.default.appendFileSync(paths.headroomLogPath, result.stderr);
+        import_node_fs22.default.appendFileSync(paths.headroomLogPath, result.stderr);
       }
       return result.status === 0 ? { ok: true } : { ok: false, error: `uv tool install exited ${String(result.status)}` };
     },
@@ -142193,8 +142284,8 @@ function realSupervisorPorts(paths) {
     },
     installedCommit: readInstalledHeadroomCommit,
     log: (line) => {
-      import_node_fs21.default.mkdirSync(paths.logsDir, { recursive: true });
-      import_node_fs21.default.appendFileSync(paths.headroomLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+      import_node_fs22.default.mkdirSync(paths.logsDir, { recursive: true });
+      import_node_fs22.default.appendFileSync(paths.headroomLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
 `);
     }
   };
@@ -142935,14 +143026,14 @@ function requireIdentity(paths, name) {
     throw new IdentityNotFoundError(name);
   }
 }
-function collectUsageReport(fs23, paths, filters) {
+function collectUsageReport(fs24, paths, filters) {
   const { identity, provider, sinceMs } = filters;
   if (identity !== void 0) {
     requireIdentity(paths, identity);
   }
-  const log = readUsageLog(fs23, paths.usageLogDir, sinceMs === void 0 ? {} : { sinceMs });
+  const log = readUsageLog(fs24, paths.usageLogDir, sinceMs === void 0 ? {} : { sinceMs });
   const records = log.records.filter((record2) => (identity === void 0 || record2.identity === identity) && (provider === void 0 || record2.provider === provider));
-  const snapshots = (identity === void 0 ? listUsageSnapshots(fs23, paths.usageSnapshotsDir) : [readUsageSnapshot(fs23, paths.usageSnapshotsDir, identity)].flatMap((snapshot) => snapshot === void 0 ? [] : [snapshot])).map((snapshot) => provider === void 0 ? snapshot : { ...snapshot, providers: Object.fromEntries(Object.entries(snapshot.providers).filter(([name]) => name === provider)) }).filter((snapshot) => Object.keys(snapshot.providers).length > 0);
+  const snapshots = (identity === void 0 ? listUsageSnapshots(fs24, paths.usageSnapshotsDir) : [readUsageSnapshot(fs24, paths.usageSnapshotsDir, identity)].flatMap((snapshot) => snapshot === void 0 ? [] : [snapshot])).map((snapshot) => provider === void 0 ? snapshot : { ...snapshot, providers: Object.fromEntries(Object.entries(snapshot.providers).filter(([name]) => name === provider)) }).filter((snapshot) => Object.keys(snapshot.providers).length > 0);
   return {
     since: sinceMs === void 0 ? void 0 : new Date(sinceMs).toISOString(),
     logDir: paths.usageLogDir,
@@ -143049,16 +143140,16 @@ function formatUsageReport(report) {
   }
   return lines;
 }
-function collectAccounts(fs23, paths, identity, probe) {
+function collectAccounts(fs24, paths, identity, probe) {
   if (identity !== void 0) {
     requireIdentity(paths, identity);
   }
   const names = identity === void 0 ? listIdentities(paths).map((entry) => entry.name) : [identity];
   return names.map((name) => ({
     identity: name,
-    account: readAccountMetadata(fs23, paths.identitiesDir, name),
-    signIn: identitySignIn(fs23, probe, { farmRoot: import_node_path57.default.join(paths.identitiesDir, name), hasCredentialBlock: readIdentity(paths, name)?.credential !== void 0 }),
-    usage: readUsageSnapshot(fs23, paths.usageSnapshotsDir, name)
+    account: readAccountMetadata(fs24, paths.identitiesDir, name),
+    signIn: identitySignIn(fs24, probe, { farmRoot: import_node_path57.default.join(paths.identitiesDir, name), hasCredentialBlock: readIdentity(paths, name)?.credential !== void 0 }),
+    usage: readUsageSnapshot(fs24, paths.usageSnapshotsDir, name)
   }));
 }
 function formatAccounts(views) {