claude-use 11.7.0 → 11.8.1

package/dist/index.cjs

@@ -2043,8 +2043,8 @@ var init_lock = __esm({
 });
 
 // src/launcher/farm.ts
-function readFarmManifest(fs12, farmRoot) {
-  const raw = fs12.readFileUtf8(import_node_path7.default.join(farmRoot, FARM_MANIFEST_FILENAME)) ?? fs12.readFileUtf8(import_node_path7.default.join(farmRoot, LEGACY_FARM_MANIFEST_FILENAME));
+function readFarmManifest(fs13, farmRoot) {
+  const raw = fs13.readFileUtf8(import_node_path7.default.join(farmRoot, FARM_MANIFEST_FILENAME)) ?? fs13.readFileUtf8(import_node_path7.default.join(farmRoot, LEGACY_FARM_MANIFEST_FILENAME));
   if (raw === void 0) {
     return void 0;
   }
@@ -2102,9 +2102,9 @@ function buildEntryFacts(params) {
     entries
   };
 }
-function listSubtree(fs12, root, rel) {
+function listSubtree(fs13, root, rel) {
   const absolute = import_node_path7.default.join(root, rel);
-  const stat = fs12.lstat(absolute);
+  const stat = fs13.lstat(absolute);
   if (stat === void 0) {
     return [];
   }
@@ -2112,10 +2112,10 @@ function listSubtree(fs12, root, rel) {
     return [{ rel, kind: "symlink" }];
   }
   if (stat.kind === "dir") {
-    const children = [...fs12.readdir(absolute)].sort().flatMap((name) => listSubtree(fs12, root, `${rel}/${name}`));
+    const children = [...fs13.readdir(absolute)].sort().flatMap((name) => listSubtree(fs13, root, `${rel}/${name}`));
     return [{ rel, kind: "dir" }, ...children];
   }
-  const contentHash = fs12.hashFile(absolute);
+  const contentHash = fs13.hashFile(absolute);
   return [{ rel, kind: "file", ...contentHash === void 0 ? {} : { contentHash } }];
 }
 function topLevelScopeRoots(roots) {
@@ -2129,25 +2129,25 @@ function topLevelScopeRoots(roots) {
   }
   return kept;
 }
-function reconciliationScope(fs12, farmRoot, manifest) {
+function reconciliationScope(fs13, farmRoot, manifest) {
   if (manifest !== void 0) {
     return topLevelScopeRoots(manifest.materialised);
   }
-  return [...fs12.readdir(farmRoot)].filter((name) => name !== FARM_MANIFEST_FILENAME && name !== LEGACY_FARM_MANIFEST_FILENAME && fs12.lstat(import_node_path7.default.join(farmRoot, name))?.kind === "dir").sort();
+  return [...fs13.readdir(farmRoot)].filter((name) => name !== FARM_MANIFEST_FILENAME && name !== LEGACY_FARM_MANIFEST_FILENAME && fs13.lstat(import_node_path7.default.join(farmRoot, name))?.kind === "dir").sort();
 }
-function collectFarmListing(fs12, farmRoot, scopeRoots) {
-  return scopeRoots.flatMap((root) => listSubtree(fs12, farmRoot, root));
+function collectFarmListing(fs13, farmRoot, scopeRoots) {
+  return scopeRoots.flatMap((root) => listSubtree(fs13, farmRoot, root));
 }
-function collectCanonicalCounterparts(fs12, claudeHome, farmListing) {
+function collectCanonicalCounterparts(fs13, claudeHome, farmListing) {
   const out = [];
   for (const entry of farmListing) {
     const absolute = import_node_path7.default.join(claudeHome, entry.rel);
-    const stat = fs12.lstat(absolute);
+    const stat = fs13.lstat(absolute);
     if (stat === void 0) {
       continue;
     }
     if (stat.kind === "file") {
-      const contentHash = fs12.hashFile(absolute);
+      const contentHash = fs13.hashFile(absolute);
       out.push({ rel: entry.rel, kind: "file", ...contentHash === void 0 ? {} : { contentHash } });
       continue;
     }
@@ -2585,10 +2585,10 @@ var init_route = __esm({
 });
 
 // src/frontdoor/state.ts
-function readFrontDoorState(fs12, stateFile) {
+function readFrontDoorState(fs13, stateFile) {
   let raw;
   try {
-    raw = fs12.readFileUtf8(stateFile);
+    raw = fs13.readFileUtf8(stateFile);
   } catch {
     return void 0;
   }
@@ -2602,9 +2602,9 @@ function readFrontDoorState(fs12, stateFile) {
     return void 0;
   }
 }
-function writeFrontDoorState(fs12, stateFile, state) {
-  fs12.mkdirp(import_node_path8.default.dirname(stateFile));
-  fs12.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
+function writeFrontDoorState(fs13, stateFile, state) {
+  fs13.mkdirp(import_node_path8.default.dirname(stateFile));
+  fs13.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
 `);
 }
 function directOrigin(port) {
@@ -2614,27 +2614,27 @@ function frontDoorOrigin(state) {
   const port = state?.directPort ?? state?.lastDirectPort;
   return port === void 0 ? void 0 : directOrigin(port);
 }
-function writeFrontDoorDirectRecord(fs12, recordsDir, record) {
-  fs12.mkdirp(recordsDir);
-  fs12.writeFilePrivate(import_node_path8.default.join(recordsDir, `${String(record.pid)}.json`), `${JSON.stringify({ directPort: record.directPort })}
+function writeFrontDoorDirectRecord(fs13, recordsDir, record) {
+  fs13.mkdirp(recordsDir);
+  fs13.writeFilePrivate(import_node_path8.default.join(recordsDir, `${String(record.pid)}.json`), `${JSON.stringify({ directPort: record.directPort })}
 `);
 }
-function removeFrontDoorDirectRecord(fs12, recordsDir, pid) {
-  fs12.removeRecursive(import_node_path8.default.join(recordsDir, `${String(pid)}.json`));
+function removeFrontDoorDirectRecord(fs13, recordsDir, pid) {
+  fs13.removeRecursive(import_node_path8.default.join(recordsDir, `${String(pid)}.json`));
 }
 function recordPid(file) {
   const pidText = /^([1-9]\d*)\.json$/.exec(file)?.[1];
   const pid = pidText === void 0 ? void 0 : Number(pidText);
   return pid !== void 0 && Number.isSafeInteger(pid) ? pid : void 0;
 }
-function readDirectRecordEntry(fs12, recordsDir, file) {
+function readDirectRecordEntry(fs13, recordsDir, file) {
   const pid = recordPid(file);
   if (pid === void 0) {
     return void 0;
   }
   let raw;
   try {
-    raw = fs12.readFileUtf8(import_node_path8.default.join(recordsDir, file));
+    raw = fs13.readFileUtf8(import_node_path8.default.join(recordsDir, file));
   } catch {
     return void 0;
   }
@@ -2648,44 +2648,44 @@ function readDirectRecordEntry(fs12, recordsDir, file) {
     return { malformed: true };
   }
 }
-function listFrontDoorDirectRecords(fs12, recordsDir) {
-  return fs12.readdir(recordsDir).flatMap((file) => {
-    const entry = readDirectRecordEntry(fs12, recordsDir, file);
+function listFrontDoorDirectRecords(fs13, recordsDir) {
+  return fs13.readdir(recordsDir).flatMap((file) => {
+    const entry = readDirectRecordEntry(fs13, recordsDir, file);
     return entry?.record === void 0 ? [] : [entry.record];
   }).sort((a, b) => a.pid - b.pid);
 }
-function pruneMalformedFrontDoorDirectFiles(fs12, recordsDir, isRunning) {
-  for (const file of fs12.readdir(recordsDir)) {
+function pruneMalformedFrontDoorDirectFiles(fs13, recordsDir, isRunning) {
+  for (const file of fs13.readdir(recordsDir)) {
     const writer = RECORD_TEMPORARY_FILE.exec(file)?.[1];
     const stale = writer !== void 0 && !isRunning(Number(writer));
-    if (stale || readDirectRecordEntry(fs12, recordsDir, file)?.malformed === true) {
-      fs12.removeRecursive(import_node_path8.default.join(recordsDir, file));
+    if (stale || readDirectRecordEntry(fs13, recordsDir, file)?.malformed === true) {
+      fs13.removeRecursive(import_node_path8.default.join(recordsDir, file));
     }
   }
 }
 function liveFrontDoorDirectRecords(records, liveness) {
   return records.filter((record) => liveness.doors.has(record.pid) || liveness.unknown.has(record.pid));
 }
-function pruneDeadFrontDoorDirectRecords(fs12, recordsDir, records, liveness) {
+function pruneDeadFrontDoorDirectRecords(fs13, recordsDir, records, liveness) {
   for (const record of records) {
     if (!liveness.doors.has(record.pid) && !liveness.unknown.has(record.pid)) {
-      removeFrontDoorDirectRecord(fs12, recordsDir, record.pid);
+      removeFrontDoorDirectRecord(fs13, recordsDir, record.pid);
     }
   }
 }
-function writeFrontDoorSession(fs12, sessionsDir, session) {
-  fs12.mkdirPrivate(sessionsDir);
-  fs12.writeFilePrivate(import_node_path8.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
+function writeFrontDoorSession(fs13, sessionsDir, session) {
+  fs13.mkdirPrivate(sessionsDir);
+  fs13.writeFilePrivate(import_node_path8.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
 `);
 }
-function listFrontDoorSessions(fs12, sessionsDir) {
+function listFrontDoorSessions(fs13, sessionsDir) {
   const sessions = [];
-  for (const name of fs12.readdir(sessionsDir)) {
+  for (const name of fs13.readdir(sessionsDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs12.readFileUtf8(import_node_path8.default.join(sessionsDir, name)) ?? ""));
+      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs13.readFileUtf8(import_node_path8.default.join(sessionsDir, name)) ?? ""));
       if (parsed.success) {
         sessions.push({ pid: parsed.data.pid, startedAt: parsed.data.startedAt, ...parsed.data.supervisorPid === void 0 ? {} : { supervisorPid: parsed.data.supervisorPid } });
       }
@@ -2695,14 +2695,14 @@ function listFrontDoorSessions(fs12, sessionsDir) {
   }
   return sessions.sort((a, b) => a.pid - b.pid);
 }
-function removeFrontDoorSession(fs12, sessionsDir, pid) {
-  fs12.removeRecursive(import_node_path8.default.join(sessionsDir, `${String(pid)}.json`));
+function removeFrontDoorSession(fs13, sessionsDir, pid) {
+  fs13.removeRecursive(import_node_path8.default.join(sessionsDir, `${String(pid)}.json`));
 }
-function pruneDeadFrontDoorSessions(fs12, sessionsDir, isRunning) {
+function pruneDeadFrontDoorSessions(fs13, sessionsDir, isRunning) {
   const removed = [];
-  for (const session of listFrontDoorSessions(fs12, sessionsDir)) {
+  for (const session of listFrontDoorSessions(fs13, sessionsDir)) {
     if (!isRunning(session.pid)) {
-      removeFrontDoorSession(fs12, sessionsDir, session.pid);
+      removeFrontDoorSession(fs13, sessionsDir, session.pid);
       removed.push(session.pid);
     }
   }
@@ -2787,7 +2787,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "claude-use",
-      version: "11.7.0",
+      version: "11.8.1",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -2992,43 +2992,43 @@ function parseJson(raw, schema) {
   const parsed = schema.safeParse(JSON.parse(raw));
   return parsed.success ? parsed.data : void 0;
 }
-function readHeadroomState(fs12, stateFile) {
+function readHeadroomState(fs13, stateFile) {
   try {
-    return parseJson(fs12.readFileUtf8(stateFile), HeadroomStateSchema);
+    return parseJson(fs13.readFileUtf8(stateFile), HeadroomStateSchema);
   } catch {
     return void 0;
   }
 }
-function writeHeadroomState(fs12, stateFile, state) {
-  fs12.mkdirp(import_node_path11.default.dirname(stateFile));
-  fs12.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
+function writeHeadroomState(fs13, stateFile, state) {
+  fs13.mkdirp(import_node_path11.default.dirname(stateFile));
+  fs13.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
 `);
 }
-function resolveServingHeadroomState(fs12, files, isRunning) {
-  const current = readHeadroomState(fs12, files.stateFile);
+function resolveServingHeadroomState(fs13, files, isRunning) {
+  const current = readHeadroomState(fs13, files.stateFile);
   if (current !== void 0) {
     return { path: files.stateFile, state: current };
   }
-  const legacy = readHeadroomState(fs12, files.legacyStateFile);
+  const legacy = readHeadroomState(fs13, files.legacyStateFile);
   if (legacy?.supervisorPid !== void 0 && isRunning(legacy.supervisorPid)) {
     return { path: files.legacyStateFile, state: legacy };
   }
   return void 0;
 }
-function migrateHeadroomState(fs12, files, isRunning) {
-  const legacy = readHeadroomState(fs12, files.legacyStateFile);
+function migrateHeadroomState(fs13, files, isRunning) {
+  const legacy = readHeadroomState(fs13, files.legacyStateFile);
   const legacyLive = legacy?.supervisorPid !== void 0 && isRunning(legacy.supervisorPid);
-  const current = readHeadroomState(fs12, files.stateFile);
+  const current = readHeadroomState(fs13, files.stateFile);
   if (current !== void 0 || legacyLive) {
-    if (!legacyLive && fs12.readFileUtf8(files.legacyStateFile) !== void 0) {
-      fs12.removeRecursive(files.legacyStateFile);
+    if (!legacyLive && fs13.readFileUtf8(files.legacyStateFile) !== void 0) {
+      fs13.removeRecursive(files.legacyStateFile);
     }
     return;
   }
   if (legacy !== void 0) {
-    writeHeadroomState(fs12, files.stateFile, legacy);
+    writeHeadroomState(fs13, files.stateFile, legacy);
   }
-  fs12.removeRecursive(files.legacyStateFile);
+  fs13.removeRecursive(files.legacyStateFile);
 }
 function hashAllowlist(allowlist) {
   return (0, import_node_crypto6.createHash)("sha256").update(allowlist.join("\n")).digest("hex");
@@ -3061,27 +3061,27 @@ function isAdmissibleUrl(entry) {
 function parseAllowlistFile(content) {
   return content.replace(/^\uFEFF/, "").replace(ALLOWLIST_FILE_COMMENT, "").split(ALLOWLIST_FILE_SEPARATORS).map((entry) => entry.replace(ALLOWLIST_SURROUNDING_WHITESPACE, "")).filter((entry) => entry !== "" && !ALLOWLIST_ENTRY_WHITESPACE.test(entry) && (entry.includes("://") ? isAdmissibleUrl(entry) : isBareHost(entry)));
 }
-function writeAllowlistFile(fs12, allowlistFile, allowlist) {
-  fs12.mkdirPrivate(import_node_path11.default.dirname(allowlistFile));
-  fs12.writeFilePrivate(allowlistFile, formatAllowlistFile(allowlist));
+function writeAllowlistFile(fs13, allowlistFile, allowlist) {
+  fs13.mkdirPrivate(import_node_path11.default.dirname(allowlistFile));
+  fs13.writeFilePrivate(allowlistFile, formatAllowlistFile(allowlist));
 }
-function pruneStaleAllowlistTemporaries(fs12, allowlistFile, isRunning) {
+function pruneStaleAllowlistTemporaries(fs13, allowlistFile, isRunning) {
   const prefix = `${import_node_path11.default.basename(allowlistFile)}.`;
-  for (const name of fs12.readdir(import_node_path11.default.dirname(allowlistFile))) {
+  for (const name of fs13.readdir(import_node_path11.default.dirname(allowlistFile))) {
     const writer = name.startsWith(prefix) ? /^([1-9]\d*)\.tmp$/.exec(name.slice(prefix.length))?.[1] : void 0;
     if (writer !== void 0 && !isRunning(Number(writer))) {
-      fs12.removeRecursive(import_node_path11.default.join(import_node_path11.default.dirname(allowlistFile), name));
+      fs13.removeRecursive(import_node_path11.default.join(import_node_path11.default.dirname(allowlistFile), name));
     }
   }
 }
-function readAllProviders(fs12, providersDir) {
+function readAllProviders(fs13, providersDir) {
   const result = [];
-  for (const name of fs12.readdir(providersDir)) {
+  for (const name of fs13.readdir(providersDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = parseJson(fs12.readFileUtf8(import_node_path11.default.join(providersDir, name)), ProviderSchema);
+      const parsed = parseJson(fs13.readFileUtf8(import_node_path11.default.join(providersDir, name)), ProviderSchema);
       if (parsed !== void 0) {
         result.push({ name: name.slice(0, -".json".length), provider: parsed });
       }
@@ -3091,22 +3091,22 @@ function readAllProviders(fs12, providersDir) {
   }
   return result;
 }
-function writeSession(fs12, sessionsDir, session) {
-  fs12.mkdirp(sessionsDir);
-  fs12.writeFileUtf8(import_node_path11.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
+function writeSession(fs13, sessionsDir, session) {
+  fs13.mkdirp(sessionsDir);
+  fs13.writeFileUtf8(import_node_path11.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
 `);
 }
-function removeSession(fs12, sessionsDir, pid) {
-  fs12.removeRecursive(import_node_path11.default.join(sessionsDir, `${String(pid)}.json`));
+function removeSession(fs13, sessionsDir, pid) {
+  fs13.removeRecursive(import_node_path11.default.join(sessionsDir, `${String(pid)}.json`));
 }
-function listSessions(fs12, sessionsDir) {
+function listSessions(fs13, sessionsDir) {
   const sessions = [];
-  for (const name of fs12.readdir(sessionsDir)) {
+  for (const name of fs13.readdir(sessionsDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = parseJson(fs12.readFileUtf8(import_node_path11.default.join(sessionsDir, name)), HeadroomSessionSchema);
+      const parsed = parseJson(fs13.readFileUtf8(import_node_path11.default.join(sessionsDir, name)), HeadroomSessionSchema);
       if (parsed !== void 0) {
         sessions.push(parsed);
       }
@@ -3116,22 +3116,22 @@ function listSessions(fs12, sessionsDir) {
   }
   return sessions.sort((a, b) => a.pid - b.pid);
 }
-function sessionsForSupervisor(fs12, sessionsDir, supervisorPid) {
-  return listSessions(fs12, sessionsDir).filter((session) => session.supervisorPid === supervisorPid);
+function sessionsForSupervisor(fs13, sessionsDir, supervisorPid) {
+  return listSessions(fs13, sessionsDir).filter((session) => session.supervisorPid === supervisorPid);
 }
-function pruneDeadSessions(fs12, sessionsDir, isRunning) {
+function pruneDeadSessions(fs13, sessionsDir, isRunning) {
   const removed = [];
-  for (const session of listSessions(fs12, sessionsDir)) {
+  for (const session of listSessions(fs13, sessionsDir)) {
     if (!isRunning(session.pid)) {
-      removeSession(fs12, sessionsDir, session.pid);
+      removeSession(fs13, sessionsDir, session.pid);
       removed.push(session.pid);
     }
   }
   return removed;
 }
-function readStartLock(fs12, lockFile) {
+function readStartLock(fs13, lockFile) {
   try {
-    return parseJson(fs12.readFileUtf8(lockFile), HeadroomLockSchema);
+    return parseJson(fs13.readFileUtf8(lockFile), HeadroomLockSchema);
   } catch {
     return void 0;
   }
@@ -3224,12 +3224,12 @@ function earlierReleaseAllowlistHash(providers, doorOrigin) {
   }
   return hashAllowlist([...entries].sort());
 }
-function earlierReleaseDaemon(fs12, paths, daemon) {
+function earlierReleaseDaemon(fs13, paths, daemon) {
   if (daemonIdentity(daemon.commandLine, daemon.socketPath) !== "earlier-release") {
     return void 0;
   }
-  const providers = readAllProviders(fs12, paths.providersDir).map((entry) => entry.provider);
-  const expected = earlierReleaseAllowlistHash(providers, frontDoorOrigin(readFrontDoorState(fs12, paths.frontdoorStateFile)));
+  const providers = readAllProviders(fs13, paths.providersDir).map((entry) => entry.provider);
+  const expected = earlierReleaseAllowlistHash(providers, frontDoorOrigin(readFrontDoorState(fs13, paths.frontdoorStateFile)));
   return { admitsServingDoor: daemon.recordedHash === expected };
 }
 var EARLIER_RELEASE_ALLOWLIST, EARLIER_RELEASE_ANTHROPIC_UPSTREAM;
@@ -3254,8 +3254,8 @@ function awaitingCause(daemonPid, identity, allowlistFile) {
   }
   return `the headroom supervisor has not written an allowlist admitting this launch's upstreams to ${allowlistFile} within ${String(HEADROOM_START_TIMEOUT_MS)}ms`;
 }
-function daemonAdmits(fs12, allowlistFile, recordedHash, required) {
-  const content = fs12.readFileUtf8(allowlistFile);
+function daemonAdmits(fs13, allowlistFile, recordedHash, required) {
+  const content = fs13.readFileUtf8(allowlistFile);
   if (content === void 0 || recordedHash === void 0) {
     return false;
   }
@@ -3518,7 +3518,7 @@ function verifyAllowlistFile(allowlistFile, ports) {
   const replaceable = fileStat === void 0 || fileStat.kind === "file" || fileStat.kind === "symlink";
   return { message: refusal2, repairable: replaceable };
 }
-function prepareHeadroomSocket(fs12, ports, paths, supervisorPid) {
+function prepareHeadroomSocket(fs13, ports, paths, supervisorPid) {
   const unsupported = platformRefusal(ports.platform);
   if (unsupported !== void 0) {
     return { refused: unsupported };
@@ -3533,18 +3533,18 @@ function prepareHeadroomSocket(fs12, ports, paths, supervisorPid) {
   if (ports.lstat(paths.headroomSocketDir)?.kind === "symlink") {
     return { refused: `the headroom socket directory ${paths.headroomSocketDir} is a symlink; it must be the real directory` };
   }
-  fs12.mkdirPrivate(paths.headroomSocketDir);
+  fs13.mkdirPrivate(paths.headroomSocketDir);
   const refusal2 = ownerOnlyRefusal("socket directory", paths.headroomSocketDir, ports.lstat(paths.headroomSocketDir), "dir", ports.currentUid());
   return refusal2 === void 0 ? { socketPath } : { refused: refusal2 };
 }
-function pruneStaleHeadroomSockets(fs12, paths, isRunning) {
+function pruneStaleHeadroomSockets(fs13, paths, isRunning) {
   const removed = [];
-  for (const name of fs12.readdir(paths.headroomSocketDir)) {
+  for (const name of fs13.readdir(paths.headroomSocketDir)) {
     const pid = HEADROOM_SOCKET_NAME.exec(name)?.[1];
     if (pid === void 0 || isRunning(Number.parseInt(pid, 10))) {
       continue;
     }
-    fs12.removeRecursive(import_node_path12.default.join(paths.headroomSocketDir, name));
+    fs13.removeRecursive(import_node_path12.default.join(paths.headroomSocketDir, name));
     removed.push(name);
   }
   return removed;
@@ -3656,37 +3656,37 @@ function compareVersions2(a, b) {
   return 0;
 }
 async function runSupervisor(initialConfig, ports, options = {}) {
-  const { fs: fs12, paths } = ports;
+  const { fs: fs13, paths } = ports;
   let config = initialConfig;
-  migrateHeadroomState(fs12, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, ports.isRunning);
-  const previousState = resolveServingHeadroomState(fs12, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, ports.isRunning)?.state;
+  migrateHeadroomState(fs13, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, ports.isRunning);
+  const previousState = resolveServingHeadroomState(fs13, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, ports.isRunning)?.state;
   if (previousState?.supervisorPid !== void 0 && previousState.supervisorPid !== ports.ownPid && ports.isRunning(previousState.supervisorPid)) {
     ports.log(`agent-shim headroom supervisor ${String(ports.ownPid)}: supervisor ${String(previousState.supervisorPid)} already owns the daemon; exiting`);
     return 0;
   }
   let installedSource = previousState?.installedSource;
   const ownsState = () => {
-    const owner = readHeadroomState(fs12, paths.headroomStateFile)?.supervisorPid;
+    const owner = readHeadroomState(fs13, paths.headroomStateFile)?.supervisorPid;
     return owner === void 0 || owner === ports.ownPid || !ports.isRunning(owner);
   };
   const writeOwnState = (state) => {
     if (!ownsState()) {
       return false;
     }
-    writeHeadroomState(fs12, paths.headroomStateFile, state);
+    writeHeadroomState(fs13, paths.headroomStateFile, state);
     return true;
   };
   const fail = (message) => {
     if (writeOwnState({ lastError: message })) {
-      fs12.removeRecursive(paths.headroomLockFile);
+      fs13.removeRecursive(paths.headroomLockFile);
     }
     ports.log(`agent-shim headroom supervisor: ${message}`);
     return 1;
   };
   const syncAllowlistFile = (allowlist) => {
     try {
-      if (fs12.readFileUtf8(paths.headroomAllowlistFile) !== formatAllowlistFile(allowlist)) {
-        writeAllowlistFile(fs12, paths.headroomAllowlistFile, allowlist);
+      if (fs13.readFileUtf8(paths.headroomAllowlistFile) !== formatAllowlistFile(allowlist)) {
+        writeAllowlistFile(fs13, paths.headroomAllowlistFile, allowlist);
         ports.log(`agent-shim headroom supervisor: wrote allowlist [${allowlist.join(", ")}] to ${paths.headroomAllowlistFile}`);
       }
       return void 0;
@@ -3704,9 +3704,9 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     }
     ports.log(`agent-shim headroom supervisor: repairing the allowlist file: ${problem.message}`);
     try {
-      fs12.mkdirPrivate(paths.headroomDir);
-      fs12.mkdirPrivate(import_node_path13.default.dirname(paths.headroomAllowlistFile));
-      writeAllowlistFile(fs12, paths.headroomAllowlistFile, allowlist);
+      fs13.mkdirPrivate(paths.headroomDir);
+      fs13.mkdirPrivate(import_node_path13.default.dirname(paths.headroomAllowlistFile));
+      writeAllowlistFile(fs13, paths.headroomAllowlistFile, allowlist);
     } catch (error) {
       return `could not write the headroom allowlist file ${paths.headroomAllowlistFile}: ${error instanceof Error ? error.message : String(error)}`;
     }
@@ -3731,20 +3731,20 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     installedSource = config.source;
     return void 0;
   };
-  const socket = prepareHeadroomSocket(fs12, ports.socketTrust, paths, ports.ownPid);
+  const socket = prepareHeadroomSocket(fs13, ports.socketTrust, paths, ports.ownPid);
   if (socket.refused !== void 0) {
     return fail(socket.refused);
   }
   const { socketPath } = socket;
-  pruneStaleHeadroomSockets(fs12, paths, ports.isRunning);
-  pruneStaleAllowlistTemporaries(fs12, paths.headroomAllowlistFile, ports.isRunning);
+  pruneStaleHeadroomSockets(fs13, paths, ports.isRunning);
+  pruneStaleAllowlistTemporaries(fs13, paths.headroomAllowlistFile, ports.isRunning);
   const installFailure = ensureInstalled();
   if (installFailure !== void 0) {
     return fail(installFailure);
   }
   const version = ports.headroomVersion() ?? "unknown";
   writeOwnState({ supervisorPid: ports.ownPid, version, installedSource });
-  ports.log(`agent-shim headroom supervisor ${String(ports.ownPid)}: managing headroom on allowlist [${currentHeadroomAllowlistInputs(fs12, paths, ports.frontDoorLiveness).frontDoorOrigins.join(", ")}]`);
+  ports.log(`agent-shim headroom supervisor ${String(ports.ownPid)}: managing headroom on allowlist [${currentHeadroomAllowlistInputs(fs13, paths, ports.frontDoorLiveness).frontDoorOrigins.join(", ")}]`);
   const orphanPid = previousState?.headroomPid;
   const orphanSocket = previousState?.socketPath ?? (previousState?.supervisorPid === void 0 ? void 0 : headroomSocketPath(paths, previousState.supervisorPid));
   const orphanIdentity = orphanPid === void 0 || orphanSocket === void 0 || !ports.isRunning(orphanPid) ? void 0 : daemonIdentity(ports.daemonCommandLine(orphanPid), orphanSocket);
@@ -3779,12 +3779,12 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     ticks += 1;
     config = ports.readConfig();
     const settingsHash = hashSettings(config.settings);
-    const inputs = currentHeadroomAllowlistInputs(fs12, paths, ports.frontDoorLiveness);
-    pruneDeadFrontDoorDirectRecords(fs12, paths.frontdoorDirectRecordsDir, inputs.frontDoorRecords, inputs.frontDoorLiveness);
-    pruneMalformedFrontDoorDirectFiles(fs12, paths.frontdoorDirectRecordsDir, ports.isRunning);
+    const inputs = currentHeadroomAllowlistInputs(fs13, paths, ports.frontDoorLiveness);
+    pruneDeadFrontDoorDirectRecords(fs13, paths.frontdoorDirectRecordsDir, inputs.frontDoorRecords, inputs.frontDoorLiveness);
+    pruneMalformedFrontDoorDirectFiles(fs13, paths.frontdoorDirectRecordsDir, ports.isRunning);
     const allowlist = inputs.frontDoorOrigins;
     const allowlistHash = hashAllowlist(allowlist);
-    pruneDeadSessions(fs12, paths.headroomSessionsDir, ports.isRunning);
+    pruneDeadSessions(fs13, paths.headroomSessionsDir, ports.isRunning);
     const ownsNow = ownsState();
     if (!ownsNow && !superseded) {
       ports.log("agent-shim headroom supervisor: another supervisor now owns the state file; serving this daemon's own sessions until they end");
@@ -3831,7 +3831,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
         runningSettingsHash = settingsHash;
         const recorded = writeOwnState(servingState(pid));
         if (recorded) {
-          fs12.removeRecursive(paths.headroomLockFile);
+          fs13.removeRecursive(paths.headroomLockFile);
         }
         idleSince = void 0;
         ports.log(`agent-shim headroom supervisor: headroom pid ${String(pid)} ready on unix socket ${socketPath}`);
@@ -3859,7 +3859,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
         ports.log(`agent-shim headroom supervisor: headroom pid ${String(headroomPid)} now serves allowlist [${allowlist.join(", ")}]`);
       }
       if (runningSettingsHash !== settingsHash || installedSource !== config.source) {
-        if (sessionsForSupervisor(fs12, paths.headroomSessionsDir, ports.ownPid).length === 0) {
+        if (sessionsForSupervisor(fs13, paths.headroomSessionsDir, ports.ownPid).length === 0) {
           ports.log("agent-shim headroom supervisor: configuration drifted and no sessions are live; restarting headroom");
           ports.stopProcess(headroomPid);
           headroomPid = void 0;
@@ -3868,7 +3868,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
           continue;
         }
       }
-      const sessions = sessionsForSupervisor(fs12, paths.headroomSessionsDir, ports.ownPid);
+      const sessions = sessionsForSupervisor(fs13, paths.headroomSessionsDir, ports.ownPid);
       if (sessions.length === 0) {
         idleSince ??= ports.now();
         const idleMs = ports.now() - idleSince;
@@ -3893,9 +3893,9 @@ function undeterminedFrontDoors(inputs) {
     return reason === void 0 ? [] : [{ pid: record.pid, origin: directOrigin(record.directPort), reason }];
   });
 }
-function currentHeadroomAllowlistInputs(fs12, paths, frontDoorLiveness) {
-  const named = frontDoorOrigin(readFrontDoorState(fs12, paths.frontdoorStateFile));
-  const records = listFrontDoorDirectRecords(fs12, paths.frontdoorDirectRecordsDir);
+function currentHeadroomAllowlistInputs(fs13, paths, frontDoorLiveness) {
+  const named = frontDoorOrigin(readFrontDoorState(fs13, paths.frontdoorStateFile));
+  const records = listFrontDoorDirectRecords(fs13, paths.frontdoorDirectRecordsDir);
   const liveness = frontDoorLiveness(records.map((record) => record.pid));
   const live = liveFrontDoorDirectRecords(records, liveness).map((record) => directOrigin(record.directPort));
   return {
@@ -3904,8 +3904,8 @@ function currentHeadroomAllowlistInputs(fs12, paths, frontDoorLiveness) {
     frontDoorOrigins: [.../* @__PURE__ */ new Set([...named === void 0 ? [] : [named], ...live])].sort()
   };
 }
-function launchRequiredUpstreams(fs12, paths) {
-  const door = frontDoorOrigin(readFrontDoorState(fs12, paths.frontdoorStateFile));
+function launchRequiredUpstreams(fs13, paths) {
+  const door = frontDoorOrigin(readFrontDoorState(fs13, paths.frontdoorStateFile));
   return door === void 0 ? [] : [door];
 }
 async function waitUntilReady(ports, socketPath, pid) {
@@ -4526,8 +4526,8 @@ var init_cascade = __esm({
 function poolNameOf(selector) {
   return selector.startsWith(POOL_SELECTOR_PREFIX) ? selector.slice(POOL_SELECTOR_PREFIX.length) : void 0;
 }
-function readActiveIdentity(fs12, activeIdentityFile) {
-  const trimmed = fs12.readFileUtf8(activeIdentityFile)?.trim();
+function readActiveIdentity(fs13, activeIdentityFile) {
+  const trimmed = fs13.readFileUtf8(activeIdentityFile)?.trim();
   return trimmed === void 0 || trimmed === "" ? void 0 : trimmed;
 }
 function isNonEmpty(value) {
@@ -4574,8 +4574,8 @@ function decideConfigProfile(params) {
   }
   return { source: "none" };
 }
-function loadIdentity(identitiesDir, name, fs12) {
-  return loadConfigFile(import_node_path17.default.join(identitiesDir, name, "identity.json"), IdentitySchema, fs12.readConfigFile);
+function loadIdentity(identitiesDir, name, fs13) {
+  return loadConfigFile(import_node_path17.default.join(identitiesDir, name, "identity.json"), IdentitySchema, fs13.readConfigFile);
 }
 var import_node_path17, IDENTITY_DECISION_SOURCES, CONFIG_PROFILE_DECISION_SOURCES;
 var init_identity = __esm({
@@ -4807,12 +4807,12 @@ function isIdentityName(name) {
 function claudeJsonPath(identitiesDir, identity) {
   return import_node_path18.default.join(identitiesDir, identity, CLAUDE_JSON);
 }
-function readAccountMetadata(fs12, identitiesDir, identity) {
+function readAccountMetadata(fs13, identitiesDir, identity) {
   if (!isIdentityName(identity)) {
     throw new Error(`"${identity}" is not a valid identity name.`);
   }
   const file = claudeJsonPath(identitiesDir, identity);
-  const raw = fs12.readFileUtf8(file);
+  const raw = fs13.readFileUtf8(file);
   if (raw === void 0) {
     return void 0;
   }
@@ -4842,19 +4842,19 @@ function readAccountMetadata(fs12, identitiesDir, identity) {
   }
   return account.data;
 }
-function createAccountReader(fs12, identitiesDir) {
+function createAccountReader(fs13, identitiesDir) {
   const cache = /* @__PURE__ */ new Map();
   return (identity) => {
     if (!isIdentityName(identity)) {
       throw new Error(`"${identity}" is not a valid identity name.`);
     }
-    const stat = fs12.lstat(claudeJsonPath(identitiesDir, identity));
+    const stat = fs13.lstat(claudeJsonPath(identitiesDir, identity));
     const stamp = stat === void 0 ? "absent" : `${String(stat.mtimeMs)}:${String(stat.sizeBytes)}`;
     const cached = cache.get(identity);
     if (cached?.stamp === stamp) {
       return cached.account;
     }
-    const account = readAccountMetadata(fs12, identitiesDir, identity);
+    const account = readAccountMetadata(fs13, identitiesDir, identity);
     cache.set(identity, { stamp, account });
     return account;
   };
@@ -5436,8 +5436,8 @@ function segmentDay(epochMs) {
 function segmentName(day, pid) {
   return `${day}.${String(pid)}.jsonl`;
 }
-function listLogSegments(fs12, logDir) {
-  return fs12.readdir(logDir).flatMap((name) => {
+function listLogSegments(fs13, logDir) {
+  return fs13.readdir(logDir).flatMap((name) => {
     const match = SEGMENT_RE.exec(name);
     const day = match?.[1];
     if (day === void 0) {
@@ -5446,15 +5446,15 @@ function listLogSegments(fs12, logDir) {
     return [{ name, day, endsAt: Date.parse(`${day}T00:00:00.000Z`) + DAY_MS }];
   }).sort((left, right) => left.day.localeCompare(right.day) || left.name.localeCompare(right.name));
 }
-function readUsageLog(fs12, logDir, options = {}) {
+function readUsageLog(fs13, logDir, options = {}) {
   const { sinceMs } = options;
   const records = [];
   let invalidLines = 0;
-  for (const segment of listLogSegments(fs12, logDir)) {
+  for (const segment of listLogSegments(fs13, logDir)) {
     if (sinceMs !== void 0 && segment.endsAt <= sinceMs) {
       continue;
     }
-    const contents = fs12.readFileUtf8(import_node_path19.default.join(logDir, segment.name));
+    const contents = fs13.readFileUtf8(import_node_path19.default.join(logDir, segment.name));
     if (contents === void 0) {
       continue;
     }
@@ -5490,9 +5490,9 @@ function snapshotPath(snapshotsDir, identity) {
   }
   return import_node_path19.default.join(snapshotsDir, `${identity}.json`);
 }
-function readUsageSnapshot(fs12, snapshotsDir, identity) {
+function readUsageSnapshot(fs13, snapshotsDir, identity) {
   const file = snapshotPath(snapshotsDir, identity);
-  const raw = fs12.readFileUtf8(file);
+  const raw = fs13.readFileUtf8(file);
   if (raw === void 0) {
     return void 0;
   }
@@ -5508,8 +5508,8 @@ function readUsageSnapshot(fs12, snapshotsDir, identity) {
   }
   return snapshot.data;
 }
-function listUsageSnapshots(fs12, snapshotsDir) {
-  return fs12.readdir(snapshotsDir).flatMap((name) => {
+function listUsageSnapshots(fs13, snapshotsDir) {
+  return fs13.readdir(snapshotsDir).flatMap((name) => {
     if (!name.endsWith(".json")) {
       return [];
     }
@@ -5517,7 +5517,7 @@ function listUsageSnapshots(fs12, snapshotsDir) {
     if (!isIdentityName(identity)) {
       return [];
     }
-    const snapshot = readUsageSnapshot(fs12, snapshotsDir, identity);
+    const snapshot = readUsageSnapshot(fs13, snapshotsDir, identity);
     return snapshot === void 0 ? [] : [snapshot];
   }).sort((left, right) => left.identity.localeCompare(right.identity));
 }
@@ -5542,11 +5542,11 @@ var init_read = __esm({
 });
 
 // src/usage/store.ts
-function pruneUsageLog(fs12, logDir, nowMs) {
+function pruneUsageLog(fs13, logDir, nowMs) {
   const cutoff = nowMs - USAGE_RETENTION_MS;
-  for (const segment of listLogSegments(fs12, logDir)) {
+  for (const segment of listLogSegments(fs13, logDir)) {
     if (segment.endsAt <= cutoff) {
-      fs12.removeRecursive(import_node_path20.default.join(logDir, segment.name));
+      fs13.removeRecursive(import_node_path20.default.join(logDir, segment.name));
     }
   }
 }
@@ -5575,7 +5575,7 @@ function foldProviderState(current, record) {
   };
 }
 function createUsageStore(deps) {
-  const { fs: fs12, paths } = deps;
+  const { fs: fs13, paths } = deps;
   let prunedDay;
   const rewriteSnapshot = (identity, fold) => {
     if (!isIdentityName(identity)) {
@@ -5584,7 +5584,7 @@ function createUsageStore(deps) {
     }
     let current;
     try {
-      current = readUsageSnapshot(fs12, paths.usageSnapshotsDir, identity);
+      current = readUsageSnapshot(fs13, paths.usageSnapshotsDir, identity);
     } catch (error) {
       if (!(error instanceof UsageSnapshotError)) {
         throw error;
@@ -5611,8 +5611,8 @@ function createUsageStore(deps) {
       ...account === void 0 ? {} : { account },
       providers
     });
-    fs12.mkdirPrivate(paths.usageSnapshotsDir);
-    fs12.writeFilePrivate(snapshotPath(paths.usageSnapshotsDir, identity), `${JSON.stringify(snapshot, null, 2)}
+    fs13.mkdirPrivate(paths.usageSnapshotsDir);
+    fs13.writeFilePrivate(snapshotPath(paths.usageSnapshotsDir, identity), `${JSON.stringify(snapshot, null, 2)}
 `);
     deps.publish?.(snapshot);
     return true;
@@ -5621,14 +5621,14 @@ function createUsageStore(deps) {
     record: (input) => {
       const record = UsageRecordSchema.parse(input);
       const nowMs = deps.now();
-      fs12.mkdirPrivate(paths.usageDir);
-      fs12.mkdirPrivate(paths.usageLogDir);
+      fs13.mkdirPrivate(paths.usageDir);
+      fs13.mkdirPrivate(paths.usageLogDir);
       const day = segmentDay(nowMs);
       if (prunedDay !== day) {
-        pruneUsageLog(fs12, paths.usageLogDir, nowMs);
+        pruneUsageLog(fs13, paths.usageLogDir, nowMs);
         prunedDay = day;
       }
-      fs12.appendFilePrivate(import_node_path20.default.join(paths.usageLogDir, segmentName(day, deps.pid)), `${JSON.stringify(record)}
+      fs13.appendFilePrivate(import_node_path20.default.join(paths.usageLogDir, segmentName(day, deps.pid)), `${JSON.stringify(record)}
 `);
       if (record.identity !== void 0) {
         rewriteSnapshot(record.identity, (current) => ({ ...current?.providers, [record.provider]: foldProviderState(current?.providers[record.provider], record) }));
@@ -5670,14 +5670,14 @@ var init_store2 = __esm({
 function errorMessage(error) {
   return error instanceof Error ? error.message : String(error);
 }
-function loadPoolMembers(fs12, paths, identities, nowMs) {
+function loadPoolMembers(fs13, paths, identities, nowMs) {
   const windowStartMs = nowMs - FIVE_HOUR_WINDOW_MS;
-  const log = readUsageLog(fs12, paths.usageLogDir, { sinceMs: windowStartMs });
+  const log = readUsageLog(fs13, paths.usageLogDir, { sinceMs: windowStartMs });
   return identities.map((identity) => {
     const records = log.records.filter((record) => record.identity === identity && record.provider === ANTHROPIC_PROVIDER && Date.parse(record.at) >= windowStartMs);
     try {
-      const snapshot = readUsageSnapshot(fs12, paths.usageSnapshotsDir, identity);
-      const account = readAccountMetadata(fs12, paths.identitiesDir, identity) ?? snapshot?.account;
+      const snapshot = readUsageSnapshot(fs13, paths.usageSnapshotsDir, identity);
+      const account = readAccountMetadata(fs13, paths.identitiesDir, identity) ?? snapshot?.account;
       return { identity, records, ...snapshot === void 0 ? {} : { snapshot }, ...account === void 0 ? {} : { account } };
     } catch (error) {
       if (error instanceof UsageSnapshotError || error instanceof AccountMetadataError) {
@@ -5770,9 +5770,9 @@ function collectPoolIdentities(pools, poolName, stack, found) {
     collectPoolIdentities(pools, nestedName, childStack, found);
   }
 }
-function readPicksFile(fs12, file) {
+function readPicksFile(fs13, file) {
   const empty = { schemaVersion: SCHEMA_VERSION, picks: {} };
-  const raw = fs12.readFileUtf8(file);
+  const raw = fs13.readFileUtf8(file);
   if (raw === void 0) {
     return { file: empty };
   }
@@ -5785,17 +5785,17 @@ function readPicksFile(fs12, file) {
   const result = PicksFileSchema.safeParse(parsed);
   return result.success ? { file: result.data } : { file: empty, problem: `${file} is not a picks file this agent-shim can read` };
 }
-function readStickyPick(fs12, picksFile, directory) {
-  const read = readPicksFile(fs12, picksFile);
+function readStickyPick(fs13, picksFile, directory) {
+  const read = readPicksFile(fs13, picksFile);
   const entry = read.file.picks[directory];
   return { ...entry === void 0 ? {} : { sticky: entry }, ...read.problem === void 0 ? {} : { problem: read.problem } };
 }
-function recordStickyPick(fs12, picksFile, directory, identity, nowMs) {
-  const current = readPicksFile(fs12, picksFile).file.picks;
+function recordStickyPick(fs13, picksFile, directory, identity, nowMs) {
+  const current = readPicksFile(fs13, picksFile).file.picks;
   const kept = Object.entries(current).filter(([, entry]) => nowMs - Date.parse(entry.at) <= USAGE_RETENTION_MS);
   const next = { schemaVersion: SCHEMA_VERSION, picks: { ...Object.fromEntries(kept), [directory]: { identity, at: new Date(nowMs).toISOString() } } };
-  fs12.mkdirPrivate(import_node_path21.default.dirname(picksFile));
-  fs12.writeFilePrivate(picksFile, `${JSON.stringify(next, null, 2)}
+  fs13.mkdirPrivate(import_node_path21.default.dirname(picksFile));
+  fs13.writeFilePrivate(picksFile, `${JSON.stringify(next, null, 2)}
 `);
 }
 var import_node_path21, import_zod13, PoolGraphError, SCHEMA_VERSION, PickEntrySchema, PicksFileSchema;
@@ -6736,6 +6736,106 @@ var init_claudeShim = __esm({
   }
 });
 
+// src/frontdoor/probe.ts
+function probeFrontDoorSync(port, caPem) {
+  refuseToBlockInRole("a synchronous probe of the front door");
+  return runProbeWorker(PROBE_SOURCE, { port, ca: caPem });
+}
+function probeListenerAcceptSync(port) {
+  refuseToBlockInRole("a synchronous probe of a front door listener");
+  return runProbeWorker(ACCEPT_PROBE_SOURCE, { port });
+}
+function runProbeWorker(source, data) {
+  const shared = new SharedArrayBuffer(HEADER_SLOTS * INT32_BYTES + REASON_BYTES);
+  const header = new Int32Array(shared, 0, HEADER_SLOTS);
+  const worker = new import_node_worker_threads.Worker(source, {
+    eval: true,
+    workerData: { ...data, timeoutMs: PROBE_TIMEOUT_MS, shared, ok: VERDICT_OK, failed: VERDICT_FAILED, headerSlots: HEADER_SLOTS }
+  });
+  worker.unref();
+  try {
+    const waited = Atomics.wait(header, 0, VERDICT_PENDING, PROBE_TIMEOUT_MS + PROBE_WAIT_MARGIN_MS);
+    const verdict = Atomics.load(header, 0);
+    if (waited === "timed-out" || verdict === VERDICT_PENDING) {
+      return { ok: false, reason: `the probe did not finish within ${String(PROBE_TIMEOUT_MS + PROBE_WAIT_MARGIN_MS)}ms` };
+    }
+    if (verdict === VERDICT_OK) {
+      return { ok: true };
+    }
+    const length = Atomics.load(header, 1);
+    return { ok: false, reason: Buffer.from(new Uint8Array(shared, HEADER_SLOTS * INT32_BYTES, length)).toString("utf8") };
+  } finally {
+    void worker.terminate();
+  }
+}
+var import_node_worker_threads, PROBE_TIMEOUT_MS, PROBE_WAIT_MARGIN_MS, REASON_BYTES, HEADER_SLOTS, INT32_BYTES, VERDICT_PENDING, VERDICT_OK, VERDICT_FAILED, PROBE_SOURCE, ACCEPT_PROBE_SOURCE;
+var init_probe = __esm({
+  "src/frontdoor/probe.ts"() {
+    "use strict";
+    init_processRole();
+    import_node_worker_threads = require("node:worker_threads");
+    PROBE_TIMEOUT_MS = 2e3;
+    PROBE_WAIT_MARGIN_MS = 1e3;
+    REASON_BYTES = 1024;
+    HEADER_SLOTS = 2;
+    INT32_BYTES = 4;
+    VERDICT_PENDING = 0;
+    VERDICT_OK = 1;
+    VERDICT_FAILED = 2;
+    PROBE_SOURCE = `
+const { workerData } = require("node:worker_threads");
+const https = require("node:https");
+const { port, ca, timeoutMs, shared, ok, failed, headerSlots } = workerData;
+const header = new Int32Array(shared, 0, headerSlots);
+const reason = new Uint8Array(shared, headerSlots * 4);
+let done = false;
+const finish = (verdict, message) => {
+  if (done) return;
+  done = true;
+  const bytes = Buffer.from(String(message), "utf8").subarray(0, reason.length);
+  reason.set(bytes);
+  Atomics.store(header, 1, bytes.length);
+  Atomics.store(header, 0, verdict);
+  Atomics.notify(header, 0);
+};
+const request = https.get({ host: "127.0.0.1", port, path: "/healthz", ca: [ca], agent: false }, (response) => {
+  let body = "";
+  response.setEncoding("utf8");
+  response.on("data", (chunk) => { body += chunk; });
+  response.on("end", () => {
+    if (response.statusCode === 200 && body === "ok") finish(ok, "");
+    else finish(failed, "the listener answered its health probe with HTTP " + String(response.statusCode));
+  });
+  response.on("error", (error) => finish(failed, error.message));
+});
+// A hard deadline over the whole exchange, handshake included: a listener that accepts the connection and then says nothing must still fail the probe.
+setTimeout(() => { request.destroy(new Error("no answer within " + String(timeoutMs) + "ms")); }, timeoutMs);
+request.on("error", (error) => finish(failed, (error.code ? error.code + ": " : "") + error.message));
+`;
+    ACCEPT_PROBE_SOURCE = `
+const { workerData } = require("node:worker_threads");
+const net = require("node:net");
+const { port, timeoutMs, shared, ok, failed, headerSlots } = workerData;
+const header = new Int32Array(shared, 0, headerSlots);
+const reason = new Uint8Array(shared, headerSlots * 4);
+let done = false;
+const finish = (verdict, message) => {
+  if (done) return;
+  done = true;
+  const bytes = Buffer.from(String(message), "utf8").subarray(0, reason.length);
+  reason.set(bytes);
+  Atomics.store(header, 1, bytes.length);
+  Atomics.store(header, 0, verdict);
+  Atomics.notify(header, 0);
+};
+const socket = net.connect({ host: "127.0.0.1", port });
+socket.once("connect", () => { socket.destroy(); finish(ok, ""); });
+socket.once("error", (error) => finish(failed, (error.code ? error.code + ": " : "") + error.message));
+setTimeout(() => { socket.destroy(); finish(failed, "no connection accepted within " + String(timeoutMs) + "ms"); }, timeoutMs);
+`;
+  }
+});
+
 // src/update/update.ts
 function compareVersions3(left, right) {
   const parse = (version) => {
@@ -7487,7 +7587,7 @@ function contextTokensOfTranscript(text) {
   }
   return void 0;
 }
-function resumedContextTokens(fs12, params) {
+function resumedContextTokens(fs13, params) {
   const target = resumeTargetOf(params.passthrough);
   if (target === void 0) {
     return void 0;
@@ -7498,19 +7598,19 @@ function resumedContextTokens(fs12, params) {
     file = import_node_path37.default.join(projectDir, `${target.id}.jsonl`);
   } else {
     let newestMs = -Infinity;
-    for (const name of fs12.readdir(projectDir)) {
+    for (const name of fs13.readdir(projectDir)) {
       if (!name.endsWith(".jsonl")) {
         continue;
       }
       const candidate = import_node_path37.default.join(projectDir, name);
-      const stat = fs12.lstat(candidate);
+      const stat = fs13.lstat(candidate);
       if (stat?.kind === "file" && stat.mtimeMs > newestMs) {
         newestMs = stat.mtimeMs;
         file = candidate;
       }
     }
   }
-  const text = file === void 0 ? void 0 : fs12.readFileUtf8(file);
+  const text = file === void 0 ? void 0 : fs13.readFileUtf8(file);
   return text === void 0 ? void 0 : contextTokensOfTranscript(text);
 }
 var import_node_path37;
@@ -7628,7 +7728,7 @@ function resolveIdentityCredential(identity, credential, env, port) {
   return resolution.ok ? resolution : { ok: false, status: CREDENTIAL_UNAVAILABLE_EXIT, message: resolution.message };
 }
 function pickFromPool(decided, params, parsedArgv, readOnly) {
-  const { paths, fs: fs12, proc, log } = params;
+  const { paths, fs: fs13, proc, log } = params;
   if (decided.pool === void 0) {
     return { identityDecision: decided };
   }
@@ -7643,7 +7743,7 @@ function pickFromPool(decided, params, parsedArgv, readOnly) {
     selectedVia: decided.source,
     pools: params.pools,
     paths,
-    fs: fs12,
+    fs: fs13,
     usageFs: farmRuntime.fs,
     cwd: farmRuntime.cwd,
     now: farmRuntime.now,
@@ -7666,7 +7766,7 @@ function pickFromPool(decided, params, parsedArgv, readOnly) {
   };
 }
 function decideLaunch(params, readOnly) {
-  const { paths, fs: fs12, proc, log } = params;
+  const { paths, fs: fs13, proc, log } = params;
   const { env, argv } = proc;
   const parsedArgv = parseLauncherArgv(argv);
   const cliOverride = buildCliOverride({
@@ -7681,7 +7781,7 @@ function decideLaunch(params, readOnly) {
     argv0Identity: parsedArgv.identity,
     directoryPinnedIdentity: params.directoryPinnedIdentity,
     readActiveIdentityFile: () => {
-      const raw = fs12.readFileUtf8(paths.activeIdentityFile);
+      const raw = fs13.readFileUtf8(paths.activeIdentityFile);
       if (raw === void 0) {
         return void 0;
       }
@@ -7716,7 +7816,7 @@ function decideLaunch(params, readOnly) {
   }
   let loadedIdentity;
   if (identityDecision.name !== void 0) {
-    loadedIdentity = loadIdentity(paths.identitiesDir, identityDecision.name, fs12);
+    loadedIdentity = loadIdentity(paths.identitiesDir, identityDecision.name, fs13);
     if (loadedIdentity === void 0) {
       log.error(
         `agent-shim: no identity named "${identityDecision.name}" (selected via ${identityDecision.source}). Run \`agent-shim identity add ${identityDecision.name}\` first.`
@@ -7731,7 +7831,7 @@ function decideLaunch(params, readOnly) {
     identityDefaultConfigProfile: loadedIdentity?.config.defaultConfigProfile,
     globalDefaultConfigProfile: params.globalDefaultConfigProfile
   });
-  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs12.readConfigFile(import_node_path38.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
+  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs13.readConfigFile(import_node_path38.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
     log.error(
       `agent-shim: no configuration profile named "${configProfileDecision.name}" (selected via ${configProfileDecision.source}). Run \`agent-shim profile add ${configProfileDecision.name}\` first.`
     );
@@ -7740,7 +7840,7 @@ function decideLaunch(params, readOnly) {
   const farmContext = farm !== void 0 && farmIdentity !== void 0 ? { farm, identity: farmIdentity, cascade: farm.loadCascade(configProfileDecision.name, cliOverride) } : void 0;
   const providerParams = {
     paths,
-    port: fs12,
+    port: fs13,
     ...parsedArgv.provider === void 0 || parsedArgv.provider === false ? {} : { cliProvider: parsedArgv.provider },
     ...farmContext === void 0 ? {} : { cascade: farmContext.cascade }
   };
@@ -8068,78 +8168,6 @@ var init_ownCli = __esm({
   }
 });
 
-// src/frontdoor/probe.ts
-function probeFrontDoorSync(port, caPem) {
-  refuseToBlockInRole("a synchronous probe of the front door");
-  const shared = new SharedArrayBuffer(HEADER_SLOTS * INT32_BYTES + REASON_BYTES);
-  const header = new Int32Array(shared, 0, HEADER_SLOTS);
-  const worker = new import_node_worker_threads.Worker(PROBE_SOURCE, {
-    eval: true,
-    workerData: { port, ca: caPem, timeoutMs: PROBE_TIMEOUT_MS, shared, ok: VERDICT_OK, failed: VERDICT_FAILED, headerSlots: HEADER_SLOTS }
-  });
-  worker.unref();
-  try {
-    const waited = Atomics.wait(header, 0, VERDICT_PENDING, PROBE_TIMEOUT_MS + PROBE_WAIT_MARGIN_MS);
-    const verdict = Atomics.load(header, 0);
-    if (waited === "timed-out" || verdict === VERDICT_PENDING) {
-      return { ok: false, reason: `the probe did not finish within ${String(PROBE_TIMEOUT_MS + PROBE_WAIT_MARGIN_MS)}ms` };
-    }
-    if (verdict === VERDICT_OK) {
-      return { ok: true };
-    }
-    const length = Atomics.load(header, 1);
-    return { ok: false, reason: Buffer.from(new Uint8Array(shared, HEADER_SLOTS * INT32_BYTES, length)).toString("utf8") };
-  } finally {
-    void worker.terminate();
-  }
-}
-var import_node_worker_threads, PROBE_TIMEOUT_MS, PROBE_WAIT_MARGIN_MS, REASON_BYTES, HEADER_SLOTS, INT32_BYTES, VERDICT_PENDING, VERDICT_OK, VERDICT_FAILED, PROBE_SOURCE;
-var init_probe = __esm({
-  "src/frontdoor/probe.ts"() {
-    "use strict";
-    init_processRole();
-    import_node_worker_threads = require("node:worker_threads");
-    PROBE_TIMEOUT_MS = 2e3;
-    PROBE_WAIT_MARGIN_MS = 1e3;
-    REASON_BYTES = 1024;
-    HEADER_SLOTS = 2;
-    INT32_BYTES = 4;
-    VERDICT_PENDING = 0;
-    VERDICT_OK = 1;
-    VERDICT_FAILED = 2;
-    PROBE_SOURCE = `
-const { workerData } = require("node:worker_threads");
-const https = require("node:https");
-const { port, ca, timeoutMs, shared, ok, failed, headerSlots } = workerData;
-const header = new Int32Array(shared, 0, headerSlots);
-const reason = new Uint8Array(shared, headerSlots * 4);
-let done = false;
-const finish = (verdict, message) => {
-  if (done) return;
-  done = true;
-  const bytes = Buffer.from(String(message), "utf8").subarray(0, reason.length);
-  reason.set(bytes);
-  Atomics.store(header, 1, bytes.length);
-  Atomics.store(header, 0, verdict);
-  Atomics.notify(header, 0);
-};
-const request = https.get({ host: "127.0.0.1", port, path: "/healthz", ca: [ca], agent: false }, (response) => {
-  let body = "";
-  response.setEncoding("utf8");
-  response.on("data", (chunk) => { body += chunk; });
-  response.on("end", () => {
-    if (response.statusCode === 200 && body === "ok") finish(ok, "");
-    else finish(failed, "the listener answered its health probe with HTTP " + String(response.statusCode));
-  });
-  response.on("error", (error) => finish(failed, error.message));
-});
-// A hard deadline over the whole exchange, handshake included: a listener that accepts the connection and then says nothing must still fail the probe.
-setTimeout(() => { request.destroy(new Error("no answer within " + String(timeoutMs) + "ms")); }, timeoutMs);
-request.on("error", (error) => finish(failed, (error.code ? error.code + ": " : "") + error.message));
-`;
-  }
-});
-
 // src/frontdoor/selfIdentity.ts
 function isFrontDoorSupervisorPid(pid, identify) {
   return declaredPid !== void 0 && pid === declaredPid && pid === process.pid || identify(pid);
@@ -8153,14 +8181,14 @@ var init_selfIdentity = __esm({
 
 // src/frontdoor/trust.ts
 function resolveTrustBundle(params) {
-  const { caCertFile, bundlesDir, variable, inherited, fs: fs12 } = params;
+  const { caCertFile, bundlesDir, variable, inherited, fs: fs13 } = params;
   if (inherited === void 0 || inherited === "" || import_node_path40.default.resolve(inherited) === import_node_path40.default.resolve(caCertFile)) {
     return { path: caCertFile };
   }
-  const caPem = fs12.readFileUtf8(caCertFile);
+  const caPem = fs13.readFileUtf8(caCertFile);
   let inheritedPem;
   try {
-    inheritedPem = fs12.readFileUtf8(inherited);
+    inheritedPem = fs13.readFileUtf8(inherited);
   } catch (error) {
     return {
       path: caCertFile,
@@ -8173,9 +8201,9 @@ function resolveTrustBundle(params) {
   const combined = `${inheritedPem.trimEnd()}
 ${caPem}`;
   const bundle = import_node_path40.default.join(bundlesDir, `${(0, import_node_crypto11.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
-  if (!fs12.exists(bundle)) {
-    fs12.mkdirp(bundlesDir);
-    fs12.writeFileAtomic(bundle, combined);
+  if (!fs13.exists(bundle)) {
+    fs13.mkdirp(bundlesDir);
+    fs13.writeFileAtomic(bundle, combined);
   }
   return { path: bundle };
 }
@@ -8205,7 +8233,7 @@ function realEnsurePorts(paths, spawnDaemon) {
       process.kill(pid, "SIGKILL");
     },
     // Read fresh for each probe: a replacement supervisor may have regenerated an unparseable CA, and the probe must trust exactly what the serving door's leaf chains to.
-    verifyListener: (port) => probeFrontDoorSync(port, import_node_fs11.default.readFileSync(paths.frontdoorCaCertFile, "utf8"))
+    verifyListener: (port) => probeFrontDoorSync(port, import_node_fs12.default.readFileSync(paths.frontdoorCaCertFile, "utf8"))
   };
 }
 function realFrontDoorPort(paths, spawnDaemon) {
@@ -8226,11 +8254,11 @@ function realFrontDoorPort(paths, spawnDaemon) {
     }
   };
 }
-var import_node_fs11, realTrustBundleFs;
+var import_node_fs12, realTrustBundleFs;
 var init_realFrontDoorPort = __esm({
   "src/frontdoor/realFrontDoorPort.ts"() {
     "use strict";
-    import_node_fs11 = __toESM(require("node:fs"), 1);
+    import_node_fs12 = __toESM(require("node:fs"), 1);
     init_realPorts();
     init_ensure2();
     init_state();
@@ -8238,10 +8266,10 @@ var init_realFrontDoorPort = __esm({
     init_selfIdentity();
     init_trust();
     realTrustBundleFs = {
-      readFileUtf8: (file) => import_node_fs11.default.readFileSync(file, "utf8"),
-      exists: (file) => import_node_fs11.default.existsSync(file),
+      readFileUtf8: (file) => import_node_fs12.default.readFileSync(file, "utf8"),
+      exists: (file) => import_node_fs12.default.existsSync(file),
       mkdirp: (dir) => {
-        import_node_fs11.default.mkdirSync(dir, { recursive: true });
+        import_node_fs12.default.mkdirSync(dir, { recursive: true });
       },
       writeFileAtomic: (file, contents) => {
         realFarmFs.writeFilePrivate(file, contents);
@@ -9449,9 +9477,9 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
   }
 }
 async function serveFrontDoor(idleShutdownMinutes, ports, options) {
-  const { fs: fs12, paths } = ports;
+  const { fs: fs13, paths } = ports;
   const servingBinary = ports.statOwnExecutable();
-  const previous = readFrontDoorState(fs12, paths.frontdoorStateFile);
+  const previous = readFrontDoorState(fs13, paths.frontdoorStateFile);
   let lastPort = previous?.lastPort;
   let lastConnectPort = previous?.lastConnectPort;
   let lastDirectPort = previous?.lastDirectPort;
@@ -9462,12 +9490,12 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
   });
   const fail = (message) => {
     ports.closeRcStreamHub();
-    writeFrontDoorState(fs12, paths.frontdoorStateFile, { lastError: message, ...sticky() });
-    fs12.removeRecursive(paths.frontdoorLockFile);
+    writeFrontDoorState(fs13, paths.frontdoorStateFile, { lastError: message, ...sticky() });
+    fs13.removeRecursive(paths.frontdoorLockFile);
     ports.log(`agent-shim frontdoor supervisor: ${message}`);
     return 1;
   };
-  writeFrontDoorState(fs12, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, ...sticky() });
+  writeFrontDoorState(fs13, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, ...sticky() });
   const previousSticky = lastPort;
   let http3;
   try {
@@ -9507,16 +9535,16 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
     ports.log(`agent-shim frontdoor supervisor: sticky direct port ${String(previousStickyDirect)} was occupied; moving to ${String(direct.port)} (headroom admits the new address once its supervisor rewrites the allowlist file)`);
   }
   lastDirectPort = direct.port;
-  writeFrontDoorDirectRecord(fs12, paths.frontdoorDirectRecordsDir, { pid: ports.ownPid, directPort: direct.port });
-  writeFrontDoorState(fs12, paths.frontdoorStateFile, { protocol: FRONT_DOOR_PROTOCOL, supervisorPid: ports.ownPid, port: http3.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
+  writeFrontDoorDirectRecord(fs13, paths.frontdoorDirectRecordsDir, { pid: ports.ownPid, directPort: direct.port });
+  writeFrontDoorState(fs13, paths.frontdoorStateFile, { protocol: FRONT_DOOR_PROTOCOL, supervisorPid: ports.ownPid, port: http3.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
   ports.doorHealth.generation({ providerPort: http3.port, connectPort: connect3.port, directPort: direct.port });
-  fs12.removeRecursive(paths.frontdoorLockFile);
+  fs13.removeRecursive(paths.frontdoorLockFile);
   ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http3.port)}, CONNECT surface on 127.0.0.1:${String(connect3.port)}`);
   const watchdog = ports.startWatchdog?.();
   let idleSince;
   let ticks = 0;
   const supersedingOwner = () => {
-    const owner = readFrontDoorState(fs12, paths.frontdoorStateFile)?.supervisorPid;
+    const owner = readFrontDoorState(fs13, paths.frontdoorStateFile)?.supervisorPid;
     return owner !== void 0 && owner !== ports.ownPid && ports.isRunning(owner) ? owner : void 0;
   };
   let supersededBy;
@@ -9531,12 +9559,12 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
     await connect3.close();
     await http3.close();
     ports.closeRcStreamHub();
-    removeFrontDoorDirectRecord(fs12, paths.frontdoorDirectRecordsDir, ports.ownPid);
+    removeFrontDoorDirectRecord(fs13, paths.frontdoorDirectRecordsDir, ports.ownPid);
   };
   const shutdown = async () => {
     await closeServing();
     if (supersedingOwner() === void 0) {
-      writeFrontDoorState(fs12, paths.frontdoorStateFile, sticky());
+      writeFrontDoorState(fs13, paths.frontdoorStateFile, sticky());
     }
     return 0;
   };
@@ -9547,8 +9575,8 @@ async function serveFrontDoor(idleShutdownMinutes, ports, options) {
       return FRONTDOOR_SUPERVISOR_STILL_RUNNING;
     }
     ticks += 1;
-    const listed = listFrontDoorSessions(fs12, paths.frontdoorSessionsDir);
-    const pruned = pruneDeadFrontDoorSessions(fs12, paths.frontdoorSessionsDir, ports.isRunning);
+    const listed = listFrontDoorSessions(fs13, paths.frontdoorSessionsDir);
+    const pruned = pruneDeadFrontDoorSessions(fs13, paths.frontdoorSessionsDir, ports.isRunning);
     ports.observeLaunchRegistry(listed, pruned);
     ports.checkQuotaExpiry();
     const prunedPids = new Set(pruned);
@@ -12044,11 +12072,11 @@ function credentialOfJson(parsed) {
 function sequenceNumOfJson(value) {
   return typeof value === "number" && Number.isInteger(value) && value >= 0 ? value : void 0;
 }
-function createRcCredentialStore(fs12, dir) {
-  fs12.mkdirPrivate(dir);
+function createRcCredentialStore(fs13, dir) {
+  fs13.mkdirPrivate(dir);
   const fileFor = (sessionId) => import_node_path10.default.join(dir, `${sessionId}.json`);
   const readParsed = (sessionId) => {
-    const raw = fs12.readFileUtf8(fileFor(sessionId));
+    const raw = fs13.readFileUtf8(fileFor(sessionId));
     if (raw === void 0) {
       return void 0;
     }
@@ -12073,7 +12101,7 @@ function createRcCredentialStore(fs12, dir) {
       }
       const cursor = sequenceNumOfJson(readParsed(sessionId)?.highestSequenceNum);
       const record = { ...credential, ...cursor === void 0 ? {} : { highestSequenceNum: cursor } };
-      fs12.writeFilePrivate(fileFor(sessionId), `${JSON.stringify(record, null, 2)}
+      fs13.writeFilePrivate(fileFor(sessionId), `${JSON.stringify(record, null, 2)}
 `);
     },
     readCursor: (sessionId) => {
@@ -12088,14 +12116,14 @@ function createRcCredentialStore(fs12, dir) {
       }
       const credential = credentialOfJson(readParsed(sessionId));
       const record = credential === void 0 ? { highestSequenceNum } : { ...credential, highestSequenceNum };
-      fs12.writeFilePrivate(fileFor(sessionId), `${JSON.stringify(record, null, 2)}
+      fs13.writeFilePrivate(fileFor(sessionId), `${JSON.stringify(record, null, 2)}
 `);
     },
     remove: (sessionId) => {
       if (!isSafeSessionId(sessionId)) {
         return;
       }
-      fs12.removeRecursive(fileFor(sessionId));
+      fs13.removeRecursive(fileFor(sessionId));
     }
   };
 }
@@ -13891,7 +13919,7 @@ function removeIdentity(paths, name) {
 
 // src/doctorReport.ts
 init_realPorts();
-var import_node_fs9 = __toESM(require("node:fs"), 1);
+var import_node_fs10 = __toESM(require("node:fs"), 1);
 var import_node_path30 = __toESM(require("node:path"), 1);
 
 // src/usage/signIn.ts
@@ -14114,6 +14142,53 @@ function pushFrontDoor(push, supervisors, registeredPid, liveSessions) {
     );
   }
 }
+var LISTENER_ROUTES = {
+  provider: "provider sessions (`z`, `m` and the like)",
+  connect: "every plain OAuth session, which reaches Anthropic through it"
+};
+function pushFrontDoorListeners(push, readings) {
+  for (const reading of readings) {
+    const where = `127.0.0.1:${String(reading.port)}`;
+    if (reading.ok) {
+      push("frontdoor", "pass", `The front door's ${reading.listener} listener on ${where} accepted a probe in ${String(Math.round(reading.elapsedMs))} ms.`, reading.listener);
+      continue;
+    }
+    push(
+      "frontdoor",
+      "fail",
+      `The front door's ${reading.listener} listener on ${where} did not accept a probe${reading.reason === void 0 ? "" : ` (${reading.reason})`}, so ${LISTENER_ROUTES[reading.listener]} cannot get through while it stays like this. The supervisor is alive but is not serving: \`agent-shim frontdoor restart\` replaces it.`,
+      reading.listener
+    );
+  }
+}
+
+// src/frontdoor/listenerReadings.ts
+var import_node_fs9 = __toESM(require("node:fs"), 1);
+init_probe();
+function readFrontDoorListeners(state, supervisorAlive, probes) {
+  if (!supervisorAlive) {
+    return [];
+  }
+  const readings = [];
+  const take = (listener, port, probe) => {
+    if (port === void 0) {
+      return;
+    }
+    const started = probes.now();
+    const verdict = probe(port);
+    readings.push({ listener, port, ok: verdict.ok, ...verdict.ok ? {} : { reason: verdict.reason }, elapsedMs: Math.max(0, probes.now() - started) });
+  };
+  take("provider", state.port, probes.authenticateProvider);
+  take("connect", state.connectPort, probes.connect);
+  return readings;
+}
+function realFrontDoorListenerProbes(paths) {
+  return {
+    authenticateProvider: (port) => probeFrontDoorSync(port, import_node_fs9.default.readFileSync(paths.frontdoorCaCertFile, "utf8")),
+    connect: probeListenerAcceptSync,
+    now: () => performance.now()
+  };
+}
 
 // src/doctorReport.ts
 init_supervisorProcesses();
@@ -14558,6 +14633,9 @@ function runDoctor(params) {
   if (params.frontDoor !== void 0) {
     const validated3 = params.frontDoor.state.raw === void 0 ? void 0 : validateJson(FrontDoorStateSchema, params.frontDoor.state);
     pushFrontDoor(push, params.frontDoor.supervisors, validated3?.ok === true ? validated3.data.supervisorPid : void 0, params.frontDoor.liveSessions);
+    if (params.frontDoor.listeners !== void 0) {
+      pushFrontDoorListeners(push, params.frontDoor.listeners);
+    }
   }
   if (params.activeIdentity.raw === void 0) {
     push("active-identity", "pass", "No active identity set.");
@@ -14641,25 +14719,30 @@ function formatDoctorReport(report) {
 }
 function realpathOrSelf(target) {
   try {
-    return import_node_fs9.default.realpathSync(target);
+    return import_node_fs10.default.realpathSync(target);
   } catch {
     return target;
   }
 }
+function servingDoorListeners(paths) {
+  const state = readFrontDoorState(realFarmFs, paths.frontdoorStateFile) ?? {};
+  const alive = state.supervisorPid !== void 0 && realIsProcessRunning(state.supervisorPid);
+  return readFrontDoorListeners(state, alive, realFrontDoorListenerProbes(paths));
+}
 function collectDoctorReport(params) {
   const { paths } = params;
-  const identityNames = import_node_fs9.default.existsSync(paths.identitiesDir) ? import_node_fs9.default.readdirSync(paths.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && isIdentityDirectoryName(entry.name)).map((entry) => entry.name).sort() : [];
+  const identityNames = import_node_fs10.default.existsSync(paths.identitiesDir) ? import_node_fs10.default.readdirSync(paths.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && isIdentityDirectoryName(entry.name)).map((entry) => entry.name).sort() : [];
   const identities = identityNames.map((name) => {
     const farmRoot = import_node_path30.default.join(paths.identitiesDir, name);
     const identityPath = import_node_path30.default.join(farmRoot, "identity.json");
-    return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot, credentialsFilePresent: import_node_fs9.default.existsSync(credentialsFilePath(farmRoot)) };
+    return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot, credentialsFilePresent: import_node_fs10.default.existsSync(credentialsFilePath(farmRoot)) };
   });
-  const profileNames = import_node_fs9.default.existsSync(paths.configProfilesDir) ? import_node_fs9.default.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
+  const profileNames = import_node_fs10.default.existsSync(paths.configProfilesDir) ? import_node_fs10.default.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const configProfiles = profileNames.map((name) => {
     const profilePath = import_node_path30.default.join(paths.configProfilesDir, `${name}.json`);
     return { name, path: profilePath, raw: realFsPort.readFileUtf8(profilePath) };
   });
-  const providerNames = import_node_fs9.default.existsSync(paths.providersDir) ? import_node_fs9.default.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
+  const providerNames = import_node_fs10.default.existsSync(paths.providersDir) ? import_node_fs10.default.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const providers = providerNames.map((name) => {
     const providerPath = import_node_path30.default.join(paths.providersDir, `${name}.json`);
     return { name, path: providerPath, raw: realFsPort.readFileUtf8(providerPath) };
@@ -14704,7 +14787,7 @@ function collectDoctorReport(params) {
     categoriesLocal: { path: paths.categoriesLocalFile, raw: realFsPort.readFileUtf8(paths.categoriesLocalFile) },
     activeIdentity: { path: paths.activeIdentityFile, raw: realFsPort.readFileUtf8(paths.activeIdentityFile) },
     binaryDiscovery,
-    claudeShim: { state: shimState, targetExists: shimState !== void 0 && import_node_fs9.default.existsSync(shimState.targetPath) },
+    claudeShim: { state: shimState, targetExists: shimState !== void 0 && import_node_fs10.default.existsSync(shimState.targetPath) },
     rootPath: paths.root,
     pathResolution: {
       ownExecutablePath,
@@ -14744,7 +14827,7 @@ function collectDoctorReport(params) {
         logPath: paths.headroomLogPath
       }
     },
-    ...uid === void 0 ? {} : { frontDoor: { state: { path: paths.frontdoorStateFile, raw: realFsPort.readFileUtf8(paths.frontdoorStateFile) }, supervisors: listFrontDoorSupervisors(realRunPort, uid), liveSessions: listFrontDoorSessions(realFarmFs, paths.frontdoorSessionsDir).filter((session) => realIsProcessRunning(session.pid)) } }
+    ...uid === void 0 ? {} : { frontDoor: { state: { path: paths.frontdoorStateFile, raw: realFsPort.readFileUtf8(paths.frontdoorStateFile) }, supervisors: listFrontDoorSupervisors(realRunPort, uid), liveSessions: listFrontDoorSessions(realFarmFs, paths.frontdoorSessionsDir).filter((session) => realIsProcessRunning(session.pid)), listeners: servingDoorListeners(paths) } }
   });
   return report;
 }
@@ -17735,8 +17818,8 @@ var SELF_HOST_SUBSCRIPTION_TYPE = "max";
 function isRecord12(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function readJsonObject(fs12, file) {
-  const raw = fs12.readFileUtf8(file);
+function readJsonObject(fs13, file) {
+  const raw = fs13.readFileUtf8(file);
   if (raw === void 0) {
     return void 0;
   }
@@ -17748,8 +17831,8 @@ function readJsonObject(fs12, file) {
   }
   return isRecord12(parsed) ? parsed : void 0;
 }
-function readRcSelfHostRecord(fs12, frontdoorDir) {
-  const parsed = readJsonObject(fs12, import_node_path33.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
+function readRcSelfHostRecord(fs13, frontdoorDir) {
+  const parsed = readJsonObject(fs13, import_node_path33.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
   if (parsed === void 0) {
     return void 0;
   }
@@ -17849,17 +17932,17 @@ function parseEntry2(project, entry) {
   const base = match?.[1];
   return base === void 0 ? { project, sessionId: entry, superseded: false, entry } : { project, sessionId: base, superseded: true, entry };
 }
-function listSessions2(fs12, configDir) {
+function listSessions2(fs13, configDir) {
   const found = [];
-  for (const project of fs12.readdir(import_node_path34.default.join(configDir, PROJECTS_DIR))) {
+  for (const project of fs13.readdir(import_node_path34.default.join(configDir, PROJECTS_DIR))) {
     const projectDir = import_node_path34.default.join(configDir, PROJECTS_DIR, project);
     const entries = /* @__PURE__ */ new Set();
-    for (const name of fs12.readdir(projectDir)) {
+    for (const name of fs13.readdir(projectDir)) {
       if (name.endsWith(TRANSCRIPT_SUFFIX)) {
         entries.add(name.slice(0, -TRANSCRIPT_SUFFIX.length));
         continue;
       }
-      const children = fs12.readdir(import_node_path34.default.join(projectDir, name));
+      const children = fs13.readdir(import_node_path34.default.join(projectDir, name));
       if (children.includes(SUBAGENTS_DIR) || children.includes(WORKFLOWS_DIR)) {
         entries.add(name);
       }
@@ -17870,9 +17953,9 @@ function listSessions2(fs12, configDir) {
   }
   return found.sort((left, right) => left.project.localeCompare(right.project) || left.entry.localeCompare(right.entry));
 }
-function locateAgents(fs12, configDir, relativeDir, workflowRunId, report) {
+function locateAgents(fs13, configDir, relativeDir, workflowRunId, report) {
   const located = [];
-  for (const name of listDirOrReport(fs12, configDir, relativeDir, report)) {
+  for (const name of listDirOrReport(fs13, configDir, relativeDir, report)) {
     if (!name.startsWith(AGENT_FILE_PREFIX) || !name.endsWith(META_SUFFIX)) {
       continue;
     }
@@ -17921,17 +18004,17 @@ function toNode(read, children) {
 function describeFailure(error) {
   return error instanceof Error ? error.message : String(error);
 }
-function readFileOrReport(fs12, configDir, relative, report) {
+function readFileOrReport(fs13, configDir, relative, report) {
   try {
-    return fs12.readFileUtf8(import_node_path34.default.join(configDir, relative));
+    return fs13.readFileUtf8(import_node_path34.default.join(configDir, relative));
   } catch (error) {
     report({ path: relative, reason: `could not be read: ${describeFailure(error)}` });
     return void 0;
   }
 }
-function listDirOrReport(fs12, configDir, relative, report) {
+function listDirOrReport(fs13, configDir, relative, report) {
   try {
-    return fs12.readdir(import_node_path34.default.join(configDir, relative));
+    return fs13.readdir(import_node_path34.default.join(configDir, relative));
   } catch (error) {
     report({ path: relative, reason: `could not be listed: ${describeFailure(error)}` });
     return [];
@@ -17954,22 +18037,22 @@ var WorkflowRunFileSchema = import_zod28.z.object({
   phases: import_zod28.z.array(import_zod28.z.object({ title: import_zod28.z.string() })).default([]),
   summary: import_zod28.z.string().optional()
 });
-function summariseSession(fs12, configDir, ref) {
+function summariseSession(fs13, configDir, ref) {
   const sessionRelative = import_node_path34.default.join(PROJECTS_DIR, ref.project, ref.entry);
   const subagentsRelative = import_node_path34.default.join(sessionRelative, SUBAGENTS_DIR);
   const workflowsUnderSubagents = import_node_path34.default.join(subagentsRelative, WORKFLOWS_DIR);
   const isMeta = (name) => name.startsWith(AGENT_FILE_PREFIX) && name.endsWith(META_SUFFIX);
-  let agentCount = fs12.readdir(import_node_path34.default.join(configDir, subagentsRelative)).filter(isMeta).length;
-  for (const runDir of fs12.readdir(import_node_path34.default.join(configDir, workflowsUnderSubagents))) {
+  let agentCount = fs13.readdir(import_node_path34.default.join(configDir, subagentsRelative)).filter(isMeta).length;
+  for (const runDir of fs13.readdir(import_node_path34.default.join(configDir, workflowsUnderSubagents))) {
     if (runDir.startsWith(WORKFLOW_RUN_PREFIX)) {
-      agentCount += fs12.readdir(import_node_path34.default.join(configDir, workflowsUnderSubagents, runDir)).filter(isMeta).length;
+      agentCount += fs13.readdir(import_node_path34.default.join(configDir, workflowsUnderSubagents, runDir)).filter(isMeta).length;
     }
   }
-  const workflowRunCount = fs12.readdir(import_node_path34.default.join(configDir, sessionRelative, WORKFLOWS_DIR)).filter((name) => name.startsWith(WORKFLOW_RUN_PREFIX) && name.endsWith(JSON_SUFFIX)).length;
-  const transcript = fs12.lstat(import_node_path34.default.join(configDir, PROJECTS_DIR, ref.project, `${ref.entry}${TRANSCRIPT_SUFFIX}`));
+  const workflowRunCount = fs13.readdir(import_node_path34.default.join(configDir, sessionRelative, WORKFLOWS_DIR)).filter((name) => name.startsWith(WORKFLOW_RUN_PREFIX) && name.endsWith(JSON_SUFFIX)).length;
+  const transcript = fs13.lstat(import_node_path34.default.join(configDir, PROJECTS_DIR, ref.project, `${ref.entry}${TRANSCRIPT_SUFFIX}`));
   return { ...ref, agentCount, workflowRunCount, ...transcript === void 0 ? {} : { updatedAt: new Date(transcript.mtimeMs).toISOString() } };
 }
-function readSessionAgentTree(fs12, configDir, ref, options = {}) {
+function readSessionAgentTree(fs13, configDir, ref, options = {}) {
   const problems = [];
   const report = (problem) => {
     problems.push(problem);
@@ -17977,15 +18060,15 @@ function readSessionAgentTree(fs12, configDir, ref, options = {}) {
   const sessionRelative = import_node_path34.default.join(PROJECTS_DIR, ref.project, ref.entry);
   const subagentsRelative = import_node_path34.default.join(sessionRelative, SUBAGENTS_DIR);
   const workflowsUnderSubagents = import_node_path34.default.join(subagentsRelative, WORKFLOWS_DIR);
-  const located = locateAgents(fs12, configDir, subagentsRelative, void 0, report);
-  for (const runDir of listDirOrReport(fs12, configDir, workflowsUnderSubagents, report)) {
+  const located = locateAgents(fs13, configDir, subagentsRelative, void 0, report);
+  for (const runDir of listDirOrReport(fs13, configDir, workflowsUnderSubagents, report)) {
     if (runDir.startsWith(WORKFLOW_RUN_PREFIX)) {
-      located.push(...locateAgents(fs12, configDir, import_node_path34.default.join(workflowsUnderSubagents, runDir), runDir, report));
+      located.push(...locateAgents(fs13, configDir, import_node_path34.default.join(workflowsUnderSubagents, runDir), runDir, report));
     }
   }
   const agents = /* @__PURE__ */ new Map();
   for (const candidate of located) {
-    const text = readFileOrReport(fs12, configDir, candidate.metaPath, report);
+    const text = readFileOrReport(fs13, configDir, candidate.metaPath, report);
     if (text === void 0) {
       continue;
     }
@@ -17997,7 +18080,7 @@ function readSessionAgentTree(fs12, configDir, ref, options = {}) {
     agents.set(candidate.id, { located: candidate, meta: parsed.data });
   }
   const teamNames = [...new Set([...agents.values()].flatMap((agent) => agent.meta.teamName === void 0 ? [] : [agent.meta.teamName]))].sort();
-  const parentOf3 = resolveParents(fs12, configDir, agents, report);
+  const parentOf3 = resolveParents(fs13, configDir, agents, report);
   const childrenOf = /* @__PURE__ */ new Map();
   const roots = [];
   for (const id of agents.keys()) {
@@ -18020,12 +18103,12 @@ function readSessionAgentTree(fs12, configDir, ref, options = {}) {
     sessionId: ref.sessionId,
     superseded: ref.superseded,
     agents: roots.sort().map(build),
-    tasks: readTasks(fs12, configDir, ownTaskLists(ref.sessionId), [.../* @__PURE__ */ new Set([...teamNames, ...options.taskListIds ?? []])].filter((id) => !ownTaskLists(ref.sessionId).includes(id)), report),
-    workflowRuns: readWorkflowRuns(fs12, configDir, import_node_path34.default.join(sessionRelative, WORKFLOWS_DIR), report),
+    tasks: readTasks(fs13, configDir, ownTaskLists(ref.sessionId), [.../* @__PURE__ */ new Set([...teamNames, ...options.taskListIds ?? []])].filter((id) => !ownTaskLists(ref.sessionId).includes(id)), report),
+    workflowRuns: readWorkflowRuns(fs13, configDir, import_node_path34.default.join(sessionRelative, WORKFLOWS_DIR), report),
     problems
   };
 }
-function resolveParents(fs12, configDir, agents, report) {
+function resolveParents(fs13, configDir, agents, report) {
   const parentOf3 = /* @__PURE__ */ new Map();
   const transcriptCache = /* @__PURE__ */ new Map();
   const transcriptOf = (agent) => {
@@ -18033,7 +18116,7 @@ function resolveParents(fs12, configDir, agents, report) {
     if (cached !== void 0) {
       return cached;
     }
-    const text = readFileOrReport(fs12, configDir, agent.located.transcriptPath, report) ?? "";
+    const text = readFileOrReport(fs13, configDir, agent.located.transcriptPath, report) ?? "";
     transcriptCache.set(agent.located.id, text);
     return text;
   };
@@ -18083,16 +18166,16 @@ function resolveParents(fs12, configDir, agents, report) {
 function ownTaskLists(sessionId) {
   return [sessionId, `${SHORT_SESSION_LIST_PREFIX}${sessionId.slice(0, SHORT_SESSION_ID_LENGTH)}`];
 }
-function readTasks(fs12, configDir, ownLists, sharedLists, report) {
+function readTasks(fs13, configDir, ownLists, sharedLists, report) {
   const tasks = [];
   [...ownLists, ...sharedLists].forEach((scope, index) => {
     const relativeDir = import_node_path34.default.join(TASKS_DIR, scope);
-    for (const name of [...listDirOrReport(fs12, configDir, relativeDir, report)].sort()) {
+    for (const name of [...listDirOrReport(fs13, configDir, relativeDir, report)].sort()) {
       if (name.startsWith(".") || !name.endsWith(JSON_SUFFIX)) {
         continue;
       }
       const relative = import_node_path34.default.join(relativeDir, name);
-      const text = readFileOrReport(fs12, configDir, relative, report);
+      const text = readFileOrReport(fs13, configDir, relative, report);
       const parsed = TaskFileSchema.safeParse(text === void 0 ? void 0 : parseJson2(text));
       if (parsed.success) {
         tasks.push(index < ownLists.length ? parsed.data : { ...parsed.data, taskList: scope });
@@ -18103,14 +18186,14 @@ function readTasks(fs12, configDir, ownLists, sharedLists, report) {
   });
   return tasks;
 }
-function readWorkflowRuns(fs12, configDir, relativeDir, report) {
+function readWorkflowRuns(fs13, configDir, relativeDir, report) {
   const runs = [];
-  for (const name of [...listDirOrReport(fs12, configDir, relativeDir, report)].sort()) {
+  for (const name of [...listDirOrReport(fs13, configDir, relativeDir, report)].sort()) {
     if (!name.startsWith(WORKFLOW_RUN_PREFIX) || !name.endsWith(JSON_SUFFIX)) {
       continue;
     }
     const relative = import_node_path34.default.join(relativeDir, name);
-    const text = readFileOrReport(fs12, configDir, relative, report);
+    const text = readFileOrReport(fs13, configDir, relative, report);
     const parsed = WorkflowRunFileSchema.safeParse(text === void 0 ? void 0 : parseJson2(text));
     if (!parsed.success) {
       if (text !== void 0) {
@@ -18136,11 +18219,11 @@ var SessionLookupError = class extends CliError {
 function identityConfigDir(identitiesDir, identity) {
   return import_node_path35.default.join(identitiesDir, identity);
 }
-function historyStores(fs12, identitiesDir, identities) {
+function historyStores(fs13, identitiesDir, identities) {
   const byRealPath = /* @__PURE__ */ new Map();
   for (const identity of identities) {
     const configDir = identityConfigDir(identitiesDir, identity);
-    const real = fs12.realpath(import_node_path35.default.join(configDir, "projects"));
+    const real = fs13.realpath(import_node_path35.default.join(configDir, "projects"));
     if (real === void 0) {
       continue;
     }
@@ -18153,15 +18236,15 @@ function historyStores(fs12, identitiesDir, identities) {
   }
   return [...byRealPath.values()];
 }
-function collectSessionList(fs12, identitiesDir, identities, filters) {
+function collectSessionList(fs13, identitiesDir, identities, filters) {
   const names = filters.identity === void 0 ? identities : identities.filter((name) => name === filters.identity);
   if (filters.identity !== void 0 && names.length === 0) {
     throw new SessionLookupError(`no identity named "${filters.identity}"`);
   }
   const sessions = [];
-  for (const store of historyStores(fs12, identitiesDir, names)) {
-    for (const ref of listSessions2(fs12, store.configDir)) {
-      const summary = summariseSession(fs12, store.configDir, ref);
+  for (const store of historyStores(fs13, identitiesDir, names)) {
+    for (const ref of listSessions2(fs13, store.configDir)) {
+      const summary = summariseSession(fs13, store.configDir, ref);
       if (filters.all === true || summary.agentCount > 0 || summary.workflowRunCount > 0) {
         sessions.push({ ...summary, identities: store.identities });
       }
@@ -18169,14 +18252,14 @@ function collectSessionList(fs12, identitiesDir, identities, filters) {
   }
   return sessions.sort((left, right) => (right.updatedAt ?? "").localeCompare(left.updatedAt ?? "") || left.sessionId.localeCompare(right.sessionId));
 }
-function locateSession(fs12, identitiesDir, identities, query, onlyIdentity) {
+function locateSession(fs13, identitiesDir, identities, query, onlyIdentity) {
   const names = onlyIdentity === void 0 ? identities : identities.filter((name) => name === onlyIdentity);
   if (onlyIdentity !== void 0 && names.length === 0) {
     throw new SessionLookupError(`no identity named "${onlyIdentity}"`);
   }
   const matches = [];
-  for (const store of historyStores(fs12, identitiesDir, names)) {
-    for (const ref of listSessions2(fs12, store.configDir)) {
+  for (const store of historyStores(fs13, identitiesDir, names)) {
+    for (const ref of listSessions2(fs13, store.configDir)) {
       if (ref.sessionId.startsWith(query)) {
         matches.push({ identities: store.identities, configDir: store.configDir, ref });
       }
@@ -18193,19 +18276,19 @@ function locateSession(fs12, identitiesDir, identities, query, onlyIdentity) {
   }
   throw new SessionLookupError(`"${query}" matches ${String(candidates.length)} sessions: ${candidates.map((match) => `${match.ref.sessionId} (${match.identities.join(", ")})`).join("; ")}; give more of the id or pass --identity`);
 }
-function showSession(fs12, identitiesDir, identities, query, onlyIdentity) {
-  const located = locateSession(fs12, identitiesDir, identities, query, onlyIdentity);
-  return { identities: located.identities, tree: readSessionAgentTree(fs12, located.configDir, located.ref) };
+function showSession(fs13, identitiesDir, identities, query, onlyIdentity) {
+  const located = locateSession(fs13, identitiesDir, identities, query, onlyIdentity);
+  return { identities: located.identities, tree: readSessionAgentTree(fs13, located.configDir, located.ref) };
 }
 
 // src/agents/realFs.ts
-var import_node_fs10 = __toESM(require("node:fs"), 1);
+var import_node_fs11 = __toESM(require("node:fs"), 1);
 init_realPorts();
 var realSessionFs = {
   ...realFarmFs,
   realpath: (candidate) => {
     try {
-      return import_node_fs10.default.realpathSync(candidate);
+      return import_node_fs11.default.realpathSync(candidate);
     } catch {
       return void 0;
     }