claude-use 4.1.0 → 4.2.0

package/dist/cli.cjs

@@ -40,7 +40,7 @@ var require_resolve_from = __commonJS({
     "use strict";
     var path28 = require("path");
     var Module = require("module");
-    var fs13 = require("fs");
+    var fs14 = require("fs");
     var resolveFrom = (fromDir, moduleId, silent) => {
       if (typeof fromDir !== "string") {
         throw new TypeError(`Expected \`fromDir\` to be of type \`string\`, got \`${typeof fromDir}\``);
@@ -49,7 +49,7 @@ var require_resolve_from = __commonJS({
         throw new TypeError(`Expected \`moduleId\` to be of type \`string\`, got \`${typeof moduleId}\``);
       }
       try {
-        fromDir = fs13.realpathSync(fromDir);
+        fromDir = fs14.realpathSync(fromDir);
       } catch (err) {
         if (err.code === "ENOENT") {
           fromDir = path28.resolve(fromDir);
@@ -7676,10 +7676,10 @@ var require_typescript = __commonJS({
       function and(f, g) {
         return (arg) => f(arg) && g(arg);
       }
-      function or(...fs13) {
+      function or(...fs14) {
         return (...args) => {
           let lastResult;
-          for (const f of fs13) {
+          for (const f of fs14) {
             lastResult = f(...args);
             if (lastResult) {
               return lastResult;
@@ -9254,7 +9254,7 @@ ${lanes.join("\n")}
       var tracing;
       var tracingEnabled;
       ((tracingEnabled2) => {
-        let fs13;
+        let fs14;
         let traceCount = 0;
         let traceFd = 0;
         let mode;
@@ -9263,9 +9263,9 @@ ${lanes.join("\n")}
         const legend = [];
         function startTracing2(tracingMode, traceDir, configFilePath) {
           Debug.assert(!tracing, "Tracing already started");
-          if (fs13 === void 0) {
+          if (fs14 === void 0) {
             try {
-              fs13 = require("fs");
+              fs14 = require("fs");
             } catch (e) {
               throw new Error(`tracing requires having fs
 (original error: ${e.message || e})`);
@@ -9276,8 +9276,8 @@ ${lanes.join("\n")}
           if (legendPath === void 0) {
             legendPath = combinePaths(traceDir, "legend.json");
           }
-          if (!fs13.existsSync(traceDir)) {
-            fs13.mkdirSync(traceDir, { recursive: true });
+          if (!fs14.existsSync(traceDir)) {
+            fs14.mkdirSync(traceDir, { recursive: true });
           }
           const countPart = mode === "build" ? `.${process.pid}-${++traceCount}` : mode === "server" ? `.${process.pid}` : ``;
           const tracePath = combinePaths(traceDir, `trace${countPart}.json`);
@@ -9287,10 +9287,10 @@ ${lanes.join("\n")}
             tracePath,
             typesPath
           });
-          traceFd = fs13.openSync(tracePath, "w");
+          traceFd = fs14.openSync(tracePath, "w");
           tracing = tracingEnabled2;
           const meta3 = { cat: "__metadata", ph: "M", ts: 1e3 * timestamp(), pid: 1, tid: 1 };
-          fs13.writeSync(
+          fs14.writeSync(
             traceFd,
             "[\n" + [{ name: "process_name", args: { name: "tsc" }, ...meta3 }, { name: "thread_name", args: { name: "Main" }, ...meta3 }, { name: "TracingStartedInBrowser", ...meta3, cat: "disabled-by-default-devtools.timeline" }].map((v) => JSON.stringify(v)).join(",\n")
           );
@@ -9299,10 +9299,10 @@ ${lanes.join("\n")}
         function stopTracing() {
           Debug.assert(tracing, "Tracing is not in progress");
           Debug.assert(!!typeCatalog.length === (mode !== "server"));
-          fs13.writeSync(traceFd, `
+          fs14.writeSync(traceFd, `
 ]
 `);
-          fs13.closeSync(traceFd);
+          fs14.closeSync(traceFd);
           tracing = void 0;
           if (typeCatalog.length) {
             dumpTypes(typeCatalog);
@@ -9374,11 +9374,11 @@ ${lanes.join("\n")}
         function writeEvent(eventType, phase, name, args, extras, time3 = 1e3 * timestamp()) {
           if (mode === "server" && phase === "checkTypes") return;
           mark("beginTracing");
-          fs13.writeSync(traceFd, `,
+          fs14.writeSync(traceFd, `,
 {"pid":1,"tid":1,"ph":"${eventType}","cat":"${phase}","ts":${time3},"name":"${name}"`);
-          if (extras) fs13.writeSync(traceFd, `,${extras}`);
-          if (args) fs13.writeSync(traceFd, `,"args":${JSON.stringify(args)}`);
-          fs13.writeSync(traceFd, `}`);
+          if (extras) fs14.writeSync(traceFd, `,${extras}`);
+          if (args) fs14.writeSync(traceFd, `,"args":${JSON.stringify(args)}`);
+          fs14.writeSync(traceFd, `}`);
           mark("endTracing");
           measure("Tracing", "beginTracing", "endTracing");
         }
@@ -9400,9 +9400,9 @@ ${lanes.join("\n")}
           var _a3, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q, _r, _s;
           mark("beginDumpTypes");
           const typesPath = legend[legend.length - 1].typesPath;
-          const typesFd = fs13.openSync(typesPath, "w");
+          const typesFd = fs14.openSync(typesPath, "w");
           const recursionIdentityMap = /* @__PURE__ */ new Map();
-          fs13.writeSync(typesFd, "[");
+          fs14.writeSync(typesFd, "[");
           const numTypes = types.length;
           for (let i2 = 0; i2 < numTypes; i2++) {
             const type = types[i2];
@@ -9498,13 +9498,13 @@ ${lanes.join("\n")}
               flags: Debug.formatTypeFlags(type.flags).split("|"),
               display
             };
-            fs13.writeSync(typesFd, JSON.stringify(descriptor));
+            fs14.writeSync(typesFd, JSON.stringify(descriptor));
             if (i2 < numTypes - 1) {
-              fs13.writeSync(typesFd, ",\n");
+              fs14.writeSync(typesFd, ",\n");
             }
           }
-          fs13.writeSync(typesFd, "]\n");
-          fs13.closeSync(typesFd);
+          fs14.writeSync(typesFd, "]\n");
+          fs14.closeSync(typesFd);
           mark("endDumpTypes");
           measure("Dump types", "beginDumpTypes", "endDumpTypes");
         }
@@ -9512,7 +9512,7 @@ ${lanes.join("\n")}
           if (!legendPath) {
             return;
           }
-          fs13.writeFileSync(legendPath, JSON.stringify(legend));
+          fs14.writeFileSync(legendPath, JSON.stringify(legend));
         }
         tracingEnabled2.dumpLegend = dumpLegend;
       })(tracingEnabled || (tracingEnabled = {}));
@@ -219444,7 +219444,7 @@ var require_util2 = __commonJS({
     var { kDestroyed, kBodyUsed, kListeners, kBody } = require_symbols();
     var { IncomingMessage } = require("node:http");
     var stream = require("node:stream");
-    var net5 = require("node:net");
+    var net4 = require("node:net");
     var { stringify } = require("node:querystring");
     var { EventEmitter: EE } = require("node:events");
     var timers = require_timers();
@@ -219593,7 +219593,7 @@ var require_util2 = __commonJS({
       }
       assert2(typeof host === "string");
       const servername = getHostname(host);
-      if (net5.isIP(servername)) {
+      if (net4.isIP(servername)) {
         return "";
       }
       return servername;
@@ -221256,7 +221256,7 @@ var require_dispatcher_base = __commonJS({
 var require_connect = __commonJS({
   "node_modules/.pnpm/undici@7.29.1/node_modules/undici/lib/core/connect.js"(exports2, module2) {
     "use strict";
-    var net5 = require("node:net");
+    var net4 = require("node:net");
     var assert2 = require("node:assert");
     var util = require_util2();
     var { InvalidArgumentError: InvalidArgumentError2 } = require_errors();
@@ -221339,7 +221339,7 @@ var require_connect = __commonJS({
         } else {
           assert2(!httpSocket, "httpSocket can only be sent on TLS update");
           port = port || 80;
-          socket = net5.connect({
+          socket = net4.connect({
             highWaterMark: 64 * 1024,
             // Same as nodejs fs streams.
             ...options,
@@ -227016,7 +227016,7 @@ var require_client = __commonJS({
   "node_modules/.pnpm/undici@7.29.1/node_modules/undici/lib/dispatcher/client.js"(exports2, module2) {
     "use strict";
     var assert2 = require("node:assert");
-    var net5 = require("node:net");
+    var net4 = require("node:net");
     var http3 = require("node:http");
     var util = require_util2();
     var { ClientStats } = require_stats();
@@ -227171,7 +227171,7 @@ var require_client = __commonJS({
         if (maxRequestsPerClient != null && (!Number.isInteger(maxRequestsPerClient) || maxRequestsPerClient < 0)) {
           throw new InvalidArgumentError2("maxRequestsPerClient must be a positive number");
         }
-        if (localAddress != null && (typeof localAddress !== "string" || net5.isIP(localAddress) === 0)) {
+        if (localAddress != null && (typeof localAddress !== "string" || net4.isIP(localAddress) === 0)) {
           throw new InvalidArgumentError2("localAddress must be valid string IP address");
         }
         if (maxResponseSize != null && (!Number.isInteger(maxResponseSize) || maxResponseSize < -1)) {
@@ -227351,7 +227351,7 @@ var require_client = __commonJS({
         const idx = hostname3.indexOf("]");
         assert2(idx !== -1);
         const ip = hostname3.substring(1, idx);
-        assert2(net5.isIPv6(ip));
+        assert2(net4.isIPv6(ip));
         hostname3 = ip;
       }
       client[kConnecting] = true;
@@ -228296,10 +228296,10 @@ var require_socks5_utils = __commonJS({
   "node_modules/.pnpm/undici@7.29.1/node_modules/undici/lib/core/socks5-utils.js"(exports2, module2) {
     "use strict";
     var { Buffer: Buffer2 } = require("node:buffer");
-    var net5 = require("node:net");
+    var net4 = require("node:net");
     var { InvalidArgumentError: InvalidArgumentError2 } = require_errors();
     function parseAddress(address) {
-      if (net5.isIPv4(address)) {
+      if (net4.isIPv4(address)) {
         const parts = address.split(".").map(Number);
         return {
           type: 1,
@@ -228307,7 +228307,7 @@ var require_socks5_utils = __commonJS({
           buffer: Buffer2.from(parts)
         };
       }
-      if (net5.isIPv6(address)) {
+      if (net4.isIPv6(address)) {
         return {
           type: 4,
           // IPv6
@@ -228330,7 +228330,7 @@ var require_socks5_utils = __commonJS({
       if (address.includes(".")) {
         const lastColonIndex = address.lastIndexOf(":");
         const ipv4Part = address.slice(lastColonIndex + 1);
-        if (net5.isIPv4(ipv4Part)) {
+        if (net4.isIPv4(ipv4Part)) {
           const octets = ipv4Part.split(".").map(Number);
           const high = (octets[0] << 8 | octets[1]).toString(16);
           const low = (octets[2] << 8 | octets[3]).toString(16);
@@ -285659,9 +285659,9 @@ var HeadroomGlobalConfigSchema = external_exports.strictObject({
 });
 var HEADROOM_DEFAULT_SOURCE = "headroom-ai[proxy] @ git+https://github.com/ExaDev/headroom@feat/per-session-savings";
 var HEADROOM_DEFAULT_IDLE_SHUTDOWN_MINUTES = 15;
-var CODEX_DEFAULT_IDLE_SHUTDOWN_MINUTES = 15;
-var CodexGlobalConfigSchema = external_exports.strictObject({
-  /** How long the daemon may sit with no registered sessions before it exits. Defaults to CODEX_DEFAULT_IDLE_SHUTDOWN_MINUTES. */
+var FRONTDOOR_DEFAULT_IDLE_SHUTDOWN_MINUTES = 15;
+var FrontDoorGlobalConfigSchema = external_exports.strictObject({
+  /** How long the front door may sit with no registered sessions before it closes and exits. Defaults to FRONTDOOR_DEFAULT_IDLE_SHUTDOWN_MINUTES. */
   idleShutdownMinutes: external_exports.number().int().positive().optional()
 });
 var GlobalConfigSchema = external_exports.strictObject({
@@ -285672,7 +285672,7 @@ var GlobalConfigSchema = external_exports.strictObject({
   entries: EntriesSchema.optional(),
   launch: LaunchSchema.optional(),
   headroom: HeadroomGlobalConfigSchema.optional(),
-  codex: CodexGlobalConfigSchema.optional()
+  frontdoor: FrontDoorGlobalConfigSchema.optional()
 });
 var IdentitySchema = external_exports.strictObject({
   $schema: external_exports.string().optional(),
@@ -285744,16 +285744,16 @@ function parseJson(raw, schema) {
   const parsed = schema.safeParse(JSON.parse(raw));
   return parsed.success ? parsed.data : void 0;
 }
-function readHeadroomState(fs13, stateFile) {
+function readHeadroomState(fs14, stateFile) {
   try {
-    return parseJson(fs13.readFileUtf8(stateFile), HeadroomStateSchema);
+    return parseJson(fs14.readFileUtf8(stateFile), HeadroomStateSchema);
   } catch {
     return void 0;
   }
 }
-function writeHeadroomState(fs13, stateFile, state) {
-  fs13.mkdirp(import_node_path5.default.dirname(stateFile));
-  fs13.writeFileUtf8(stateFile, `${JSON.stringify(state, null, 2)}
+function writeHeadroomState(fs14, stateFile, state) {
+  fs14.mkdirp(import_node_path5.default.dirname(stateFile));
+  fs14.writeFileUtf8(stateFile, `${JSON.stringify(state, null, 2)}
 `);
 }
 function headroomAllowlist(providers) {
@@ -285763,7 +285763,7 @@ function headroomAllowlist(providers) {
   }
   return [...urls].sort();
 }
-function headroomUpstreams(providers, codexOrigin) {
+function headroomUpstreams(providers, frontDoorOrigin2) {
   const upstreams = [];
   let hasCodex = false;
   for (const provider of providers) {
@@ -285773,22 +285773,22 @@ function headroomUpstreams(providers, codexOrigin) {
       upstreams.push({ baseUrl: provider.baseUrl });
     }
   }
-  if (hasCodex && codexOrigin !== void 0) {
-    upstreams.push({ baseUrl: codexOrigin });
+  if (hasCodex && frontDoorOrigin2 !== void 0) {
+    upstreams.push({ baseUrl: frontDoorOrigin2 });
   }
   return upstreams;
 }
 function hashAllowlist(allowlist) {
   return (0, import_node_crypto2.createHash)("sha256").update(allowlist.join("\n")).digest("hex");
 }
-function readAllProviders(fs13, providersDir) {
+function readAllProviders(fs14, providersDir) {
   const result = [];
-  for (const name of fs13.readdir(providersDir)) {
+  for (const name of fs14.readdir(providersDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = parseJson(fs13.readFileUtf8(import_node_path5.default.join(providersDir, name)), ProviderSchema);
+      const parsed = parseJson(fs14.readFileUtf8(import_node_path5.default.join(providersDir, name)), ProviderSchema);
       if (parsed !== void 0) {
         result.push({ name: name.slice(0, -".json".length), provider: parsed });
       }
@@ -285798,22 +285798,22 @@ function readAllProviders(fs13, providersDir) {
   }
   return result;
 }
-function writeSession(fs13, sessionsDir, session) {
-  fs13.mkdirp(sessionsDir);
-  fs13.writeFileUtf8(import_node_path5.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
+function writeSession(fs14, sessionsDir, session) {
+  fs14.mkdirp(sessionsDir);
+  fs14.writeFileUtf8(import_node_path5.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
 `);
 }
-function removeSession(fs13, sessionsDir, pid) {
-  fs13.removeRecursive(import_node_path5.default.join(sessionsDir, `${String(pid)}.json`));
+function removeSession(fs14, sessionsDir, pid) {
+  fs14.removeRecursive(import_node_path5.default.join(sessionsDir, `${String(pid)}.json`));
 }
-function listSessions(fs13, sessionsDir) {
+function listSessions(fs14, sessionsDir) {
   const sessions = [];
-  for (const name of fs13.readdir(sessionsDir)) {
+  for (const name of fs14.readdir(sessionsDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = parseJson(fs13.readFileUtf8(import_node_path5.default.join(sessionsDir, name)), HeadroomSessionSchema);
+      const parsed = parseJson(fs14.readFileUtf8(import_node_path5.default.join(sessionsDir, name)), HeadroomSessionSchema);
       if (parsed !== void 0) {
         sessions.push(parsed);
       }
@@ -285823,19 +285823,19 @@ function listSessions(fs13, sessionsDir) {
   }
   return sessions.sort((a2, b) => a2.pid - b.pid);
 }
-function pruneDeadSessions(fs13, sessionsDir, isRunning) {
+function pruneDeadSessions(fs14, sessionsDir, isRunning) {
   const removed = [];
-  for (const session of listSessions(fs13, sessionsDir)) {
+  for (const session of listSessions(fs14, sessionsDir)) {
     if (!isRunning(session.pid)) {
-      removeSession(fs13, sessionsDir, session.pid);
+      removeSession(fs14, sessionsDir, session.pid);
       removed.push(session.pid);
     }
   }
   return removed;
 }
-function readStartLock(fs13, lockFile) {
+function readStartLock(fs14, lockFile) {
   try {
-    return parseJson(fs13.readFileUtf8(lockFile), HeadroomLockSchema);
+    return parseJson(fs14.readFileUtf8(lockFile), HeadroomLockSchema);
   } catch {
     return void 0;
   }
@@ -289000,8 +289000,8 @@ var FarmManifestSchema = external_exports.strictObject({
   materialised: external_exports.array(external_exports.string()),
   links: external_exports.array(external_exports.strictObject({ rel: external_exports.string(), target: external_exports.string() }))
 });
-function readFarmManifest(fs13, farmRoot) {
-  const raw = fs13.readFileUtf8(import_node_path11.default.join(farmRoot, FARM_MANIFEST_FILENAME));
+function readFarmManifest(fs14, farmRoot) {
+  const raw = fs14.readFileUtf8(import_node_path11.default.join(farmRoot, FARM_MANIFEST_FILENAME));
   if (raw === void 0) {
     return void 0;
   }
@@ -289059,9 +289059,9 @@ function buildEntryFacts(params) {
     entries
   };
 }
-function listSubtree(fs13, root, rel) {
+function listSubtree(fs14, root, rel) {
   const absolute = import_node_path11.default.join(root, rel);
-  const stat = fs13.lstat(absolute);
+  const stat = fs14.lstat(absolute);
   if (stat === void 0) {
     return [];
   }
@@ -289069,10 +289069,10 @@ function listSubtree(fs13, root, rel) {
     return [{ rel, kind: "symlink" }];
   }
   if (stat.kind === "dir") {
-    const children = [...fs13.readdir(absolute)].sort().flatMap((name) => listSubtree(fs13, root, `${rel}/${name}`));
+    const children = [...fs14.readdir(absolute)].sort().flatMap((name) => listSubtree(fs14, root, `${rel}/${name}`));
     return [{ rel, kind: "dir" }, ...children];
   }
-  const contentHash = fs13.hashFile(absolute);
+  const contentHash = fs14.hashFile(absolute);
   return [{ rel, kind: "file", ...contentHash === void 0 ? {} : { contentHash } }];
 }
 function topLevelScopeRoots(roots) {
@@ -289086,25 +289086,25 @@ function topLevelScopeRoots(roots) {
   }
   return kept;
 }
-function reconciliationScope(fs13, farmRoot, manifest) {
+function reconciliationScope(fs14, farmRoot, manifest) {
   if (manifest !== void 0) {
     return topLevelScopeRoots(manifest.materialised);
   }
-  return [...fs13.readdir(farmRoot)].filter((name) => name !== FARM_MANIFEST_FILENAME && fs13.lstat(import_node_path11.default.join(farmRoot, name))?.kind === "dir").sort();
+  return [...fs14.readdir(farmRoot)].filter((name) => name !== FARM_MANIFEST_FILENAME && fs14.lstat(import_node_path11.default.join(farmRoot, name))?.kind === "dir").sort();
 }
-function collectFarmListing(fs13, farmRoot, scopeRoots) {
-  return scopeRoots.flatMap((root) => listSubtree(fs13, farmRoot, root));
+function collectFarmListing(fs14, farmRoot, scopeRoots) {
+  return scopeRoots.flatMap((root) => listSubtree(fs14, farmRoot, root));
 }
-function collectCanonicalCounterparts(fs13, claudeHome, farmListing) {
+function collectCanonicalCounterparts(fs14, claudeHome, farmListing) {
   const out = [];
   for (const entry of farmListing) {
     const absolute = import_node_path11.default.join(claudeHome, entry.rel);
-    const stat = fs13.lstat(absolute);
+    const stat = fs14.lstat(absolute);
     if (stat === void 0) {
       continue;
     }
     if (stat.kind === "file") {
-      const contentHash = fs13.hashFile(absolute);
+      const contentHash = fs14.hashFile(absolute);
       out.push({ rel: entry.rel, kind: "file", ...contentHash === void 0 ? {} : { contentHash } });
       continue;
     }
@@ -290592,8 +290592,8 @@ function decideConfigProfile(params) {
   }
   return { source: "none" };
 }
-function loadIdentity(identitiesDir, name, fs13) {
-  return loadConfigFile(import_node_path17.default.join(identitiesDir, name, "identity.json"), IdentitySchema, fs13.readConfigFile);
+function loadIdentity(identitiesDir, name, fs14) {
+  return loadConfigFile(import_node_path17.default.join(identitiesDir, name, "identity.json"), IdentitySchema, fs14.readConfigFile);
 }
 
 // src/paths.ts
@@ -290633,11 +290633,11 @@ function buildLayoutPaths(root) {
     headroomSessionsDir: import_node_path18.default.join(root, "headroom", "sessions"),
     logsDir: import_node_path18.default.join(root, "logs"),
     headroomLogPath: import_node_path18.default.join(root, "logs", "headroom.log"),
-    codexDir: import_node_path18.default.join(root, "codex"),
-    codexStateFile: import_node_path18.default.join(root, "codex", "state.json"),
-    codexLockFile: import_node_path18.default.join(root, "codex", "start.lock"),
-    codexSessionsDir: import_node_path18.default.join(root, "codex", "sessions"),
-    codexLogPath: import_node_path18.default.join(root, "logs", "codex.log")
+    frontdoorDir: import_node_path18.default.join(root, "frontdoor"),
+    frontdoorStateFile: import_node_path18.default.join(root, "frontdoor", "state.json"),
+    frontdoorLockFile: import_node_path18.default.join(root, "frontdoor", "start.lock"),
+    frontdoorSessionsDir: import_node_path18.default.join(root, "frontdoor", "sessions"),
+    frontdoorLogPath: import_node_path18.default.join(root, "logs", "frontdoor.log")
   };
 }
 function resolveLayoutPaths() {
@@ -291151,7 +291151,7 @@ function resolveLaunchIdentity(paths, cwd) {
 // package.json
 var package_default = {
   name: "claude-use",
-  version: "4.1.0",
+  version: "4.2.0",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "Apache-2.0",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -292300,29 +292300,27 @@ function registerCheckCommand(program2, deps) {
 // src/codex/commands.ts
 var import_node_crypto7 = require("node:crypto");
 var import_node_fs9 = __toESM(require("node:fs"), 1);
-var import_node_net2 = __toESM(require("node:net"), 1);
 var import_node_os6 = __toESM(require("node:os"), 1);
 var import_node_path23 = __toESM(require("node:path"), 1);
-var import_node_child_process3 = require("node:child_process");
 
-// src/codex/state.ts
+// src/frontdoor/state.ts
 var import_node_path22 = __toESM(require("node:path"), 1);
-var CodexStateSchema = external_exports.strictObject({
-  /** The supervisor process keeping the translation worker alive. */
+var FrontDoorStateSchema = external_exports.strictObject({
+  /** The supervisor process serving the front door. Alive means the listener is up in that process. */
   supervisorPid: external_exports.number().int().positive().optional(),
-  /** The worker process serving the translation listener. Absent while the supervisor is between restarts. */
-  workerPid: external_exports.number().int().positive().optional(),
-  /** The loopback port the worker listens on. Absent until the worker has answered its health check, so "port is set" is the ready signal a launcher polls for. */
+  /** The loopback port the front-door listener serves on. Absent until the listener has bound and answered its health probe, so "port is set" is itself the ready signal a launcher polls for. */
   port: external_exports.number().int().positive().optional(),
-  /** The sticky port preference: kept across crashes, restarts and idle shutdowns so every session, whose base URL was frozen at launch, keeps finding the daemon at the same address. */
+  /**
+   * The sticky port preference: kept across crashes, restarts and idle shutdowns so every session, whose base URL was frozen at launch, keeps finding the front door at the same address.
+   */
   lastPort: external_exports.number().int().positive().optional(),
-  /** The last fatal error, kept across shutdowns so `codex status` can explain a daemon that is not running. */
+  /** The last fatal error, kept across shutdowns so `frontdoor status` can explain a front door that is not running. */
   lastError: external_exports.string().optional()
 });
-function readCodexState(fs13, stateFile) {
+function readFrontDoorState(fs14, stateFile) {
   let raw;
   try {
-    raw = fs13.readFileUtf8(stateFile);
+    raw = fs14.readFileUtf8(stateFile);
   } catch {
     return void 0;
   }
@@ -292330,303 +292328,22 @@ function readCodexState(fs13, stateFile) {
     return void 0;
   }
   try {
-    const parsed = CodexStateSchema.safeParse(JSON.parse(raw));
+    const parsed = FrontDoorStateSchema.safeParse(JSON.parse(raw));
     return parsed.success ? parsed.data : void 0;
   } catch {
     return void 0;
   }
 }
-function writeCodexState(fs13, stateFile, state) {
-  fs13.mkdirp(import_node_path22.default.dirname(stateFile));
-  fs13.writeFileUtf8(stateFile, `${JSON.stringify(state, null, 2)}
+function writeFrontDoorState(fs14, stateFile, state) {
+  fs14.mkdirp(import_node_path22.default.dirname(stateFile));
+  fs14.writeFileUtf8(stateFile, `${JSON.stringify(state, null, 2)}
 `);
 }
-function codexDaemonOrigin(state) {
+function frontDoorOrigin(state) {
   const port = state?.port ?? state?.lastPort;
   return port === void 0 ? void 0 : `http://127.0.0.1:${String(port)}`;
 }
 
-// src/headroom/supervisor.ts
-function resolveSupervisorConfig(configured) {
-  return {
-    source: configured.source ?? HEADROOM_DEFAULT_SOURCE,
-    idleShutdownMinutes: configured.idleShutdownMinutes ?? HEADROOM_DEFAULT_IDLE_SHUTDOWN_MINUTES
-  };
-}
-var HEADROOM_BACKOFF_BASE_MS = 500;
-var HEADROOM_BACKOFF_CAP_MS = 3e4;
-var HEADROOM_START_RETRY_BUDGET = 5;
-var HEADROOM_READY_TIMEOUT_MS = 15e3;
-var HEADROOM_POLL_MS = 1e3;
-var MS_PER_MINUTE = 6e4;
-var STOP_POLL_MS = 100;
-var TERM_GRACE_MS = 1500;
-var KILL_GRACE_MS = 1500;
-function stopSupervisedProcess(pid, primitives) {
-  const send = (signal) => {
-    try {
-      primitives.signal(pid, signal);
-    } catch {
-    }
-  };
-  send("SIGTERM");
-  if (awaitExit(pid, primitives, TERM_GRACE_MS)) {
-    return "exited-on-term";
-  }
-  send("SIGKILL");
-  if (awaitExit(pid, primitives, KILL_GRACE_MS)) {
-    return "killed";
-  }
-  return "still-running";
-}
-function awaitExit(pid, primitives, budgetMs) {
-  const deadline = primitives.now() + budgetMs;
-  while (primitives.isRunning(pid)) {
-    if (primitives.now() >= deadline) {
-      return false;
-    }
-    primitives.waitMs(STOP_POLL_MS);
-  }
-  return true;
-}
-function backoffForAttempt(attempt) {
-  return Math.min(HEADROOM_BACKOFF_CAP_MS, HEADROOM_BACKOFF_BASE_MS * 2 ** (attempt - 1));
-}
-function versionSatisfies(version2, source) {
-  if (version2 === void 0) {
-    return false;
-  }
-  const specifier = /==|>=|<=|!=|>|<|~=/.exec(source);
-  if (specifier === null) {
-    return true;
-  }
-  const installed = parseVersion(version2);
-  const wanted = parseVersion(source.slice(specifier.index + specifier[0].length));
-  if (installed === void 0 || wanted === void 0) {
-    return true;
-  }
-  const cmp = compareVersions2(installed, wanted);
-  switch (specifier[0]) {
-    case "==":
-      return cmp === 0;
-    case "!=":
-      return cmp !== 0;
-    case ">=":
-      return cmp >= 0;
-    case "<=":
-      return cmp <= 0;
-    case ">":
-      return cmp > 0;
-    case "<":
-      return cmp < 0;
-    case "~=":
-      return compareVersions2(installed.slice(0, Math.max(0, wanted.length - 1)), wanted.slice(0, Math.max(0, wanted.length - 1))) === 0 && cmp >= 0;
-    default:
-      return true;
-  }
-}
-function parseVersion(input2) {
-  const match = /(\d+)(\.\d+)*/.exec(input2);
-  if (match === null) {
-    return void 0;
-  }
-  return match[0].split(".").map((part) => Number.parseInt(part, 10));
-}
-function compareVersions2(a2, b) {
-  for (let index = 0; index < Math.max(a2.length, b.length); index += 1) {
-    const left = a2[index] ?? 0;
-    const right = b[index] ?? 0;
-    if (left !== right) {
-      return left - right;
-    }
-  }
-  return 0;
-}
-var HEADROOM_SUPERVISOR_STILL_RUNNING = -1;
-async function runSupervisor(config2, ports, options = {}) {
-  const { fs: fs13, paths } = ports;
-  const previousState = readHeadroomState(fs13, paths.headroomStateFile);
-  let installedSource = previousState?.installedSource;
-  let lastPort = previousState?.lastPort;
-  let lastMitmPort = previousState?.lastMitmPort;
-  let daemonPort;
-  const sticky = () => ({
-    ...lastPort === void 0 ? {} : { lastPort },
-    ...lastMitmPort === void 0 ? {} : { lastMitmPort }
-  });
-  let mitm;
-  const fail = (message) => {
-    writeHeadroomState(fs13, paths.headroomStateFile, {
-      lastError: message,
-      ...sticky()
-    });
-    fs13.removeRecursive(paths.headroomLockFile);
-    ports.log(`claude-use headroom supervisor: ${message}`);
-    return 1;
-  };
-  const ensureInstalled = () => {
-    const version3 = ports.headroomVersion();
-    const versionOk = version3 !== void 0 && versionSatisfies(version3, config2.source);
-    if (versionOk && (installedSource === void 0 || installedSource === config2.source)) {
-      installedSource = config2.source;
-      return true;
-    }
-    ports.log(`claude-use headroom supervisor: installing headroom from ${config2.source}`);
-    const result = ports.install(config2.source);
-    if (!result.ok) {
-      return false;
-    }
-    installedSource = config2.source;
-    return true;
-  };
-  if (!ensureInstalled()) {
-    return fail(`could not install headroom from ${config2.source}: install failed (is uv installed and on PATH?)`);
-  }
-  const version2 = ports.headroomVersion() ?? "unknown";
-  try {
-    mitm = await ports.startMitm(lastMitmPort, () => daemonPort);
-  } catch (error62) {
-    return fail(`could not start the MITM proxy: ${error62 instanceof Error ? error62.message : String(error62)}`);
-  }
-  lastMitmPort = mitm.port;
-  if (previousState?.lastMitmPort !== void 0 && mitm.port !== previousState.lastMitmPort) {
-    ports.log(
-      `claude-use headroom supervisor: sticky MITM port ${String(previousState.lastMitmPort)} was occupied; moving to ${String(mitm.port)} (OAuth sessions launched against the old port are stale until they relaunch)`
-    );
-  }
-  writeHeadroomState(fs13, paths.headroomStateFile, { supervisorPid: ports.ownPid, version: version2, installedSource, mitmPort: mitm.port, ...sticky() });
-  ports.log(`claude-use headroom supervisor ${String(ports.ownPid)}: managing headroom on allowlist [${allowlistOf(ports).join(", ")}]`);
-  const orphanPid = previousState?.headroomPid;
-  if (orphanPid !== void 0 && ports.isRunning(orphanPid)) {
-    ports.log(`claude-use headroom supervisor: stopping daemon pid ${String(orphanPid)} left behind by the previous supervisor`);
-    ports.stopProcess(orphanPid);
-  }
-  let headroomPid;
-  let runningHash;
-  let consecutiveFailures = 0;
-  let idleSince;
-  let ticks = 0;
-  for (; ; ) {
-    if (options.tickLimit !== void 0 && ticks >= options.tickLimit) {
-      return HEADROOM_SUPERVISOR_STILL_RUNNING;
-    }
-    ticks += 1;
-    const allowlist = allowlistOf(ports);
-    const allowlistHash = hashAllowlist(allowlist);
-    pruneDeadSessions(fs13, paths.headroomSessionsDir, ports.isRunning);
-    const crashed = headroomPid !== void 0 && !ports.isRunning(headroomPid);
-    if (headroomPid === void 0 || crashed) {
-      if (crashed) {
-        ports.log(`claude-use headroom supervisor: headroom pid ${String(headroomPid)} died`);
-        headroomPid = void 0;
-        daemonPort = void 0;
-        runningHash = void 0;
-        writeHeadroomState(fs13, paths.headroomStateFile, {
-          supervisorPid: ports.ownPid,
-          version: version2,
-          installedSource,
-          mitmPort: mitm.port,
-          ...sticky()
-        });
-      }
-      if (consecutiveFailures >= HEADROOM_START_RETRY_BUDGET) {
-        return fail(`headroom failed to become ready ${String(consecutiveFailures)} times in a row; giving up`);
-      }
-      if (installedSource !== config2.source && !ensureInstalled()) {
-        return fail(`could not install headroom from ${config2.source}: install failed (is uv installed and on PATH?)`);
-      }
-      const previousSticky = lastPort;
-      const port = lastPort !== void 0 && await ports.isPortFree(lastPort) ? lastPort : await ports.freePort();
-      const pid = ports.spawnHeadroom(port, allowlist);
-      const ready = await waitUntilReady(ports, port);
-      if (ready) {
-        consecutiveFailures = 0;
-        headroomPid = pid;
-        daemonPort = port;
-        runningHash = allowlistHash;
-        lastPort = port;
-        if (previousSticky !== void 0 && port !== previousSticky) {
-          ports.log(
-            `claude-use headroom supervisor: sticky port ${String(previousSticky)} was occupied; moving to ${String(port)} (sessions launched against the old port are stale until they relaunch)`
-          );
-        }
-        writeHeadroomState(fs13, paths.headroomStateFile, {
-          supervisorPid: ports.ownPid,
-          headroomPid: pid,
-          port,
-          mitmPort: mitm.port,
-          version: version2,
-          allowlistHash,
-          installedSource: config2.source,
-          ...sticky()
-        });
-        fs13.removeRecursive(paths.headroomLockFile);
-        idleSince = void 0;
-        ports.log(`claude-use headroom supervisor: headroom pid ${String(pid)} ready on 127.0.0.1:${String(port)}`);
-      } else {
-        ports.stopProcess(pid);
-        consecutiveFailures += 1;
-        ports.log(
-          `claude-use headroom supervisor: headroom did not become ready on port ${String(port)} (attempt ${String(consecutiveFailures)} of ${String(HEADROOM_START_RETRY_BUDGET)})`
-        );
-        await ports.sleep(backoffForAttempt(consecutiveFailures));
-        continue;
-      }
-    } else {
-      if (runningHash !== allowlistHash || installedSource !== config2.source) {
-        if (listSessions(fs13, paths.headroomSessionsDir).length === 0) {
-          ports.log("claude-use headroom supervisor: configuration drifted and no sessions are live; restarting headroom");
-          ports.stopProcess(headroomPid);
-          headroomPid = void 0;
-          daemonPort = void 0;
-          runningHash = void 0;
-          continue;
-        }
-      }
-      const sessions = listSessions(fs13, paths.headroomSessionsDir);
-      if (sessions.length === 0) {
-        idleSince ??= ports.now();
-        const idleMs = ports.now() - idleSince;
-        if (idleMs >= config2.idleShutdownMinutes * MS_PER_MINUTE) {
-          ports.log(
-            `claude-use headroom supervisor: no sessions for ${String(config2.idleShutdownMinutes)} minute(s); stopping headroom and the MITM proxy, and exiting`
-          );
-          ports.stopProcess(headroomPid);
-          daemonPort = void 0;
-          await mitm.close();
-          writeHeadroomState(fs13, paths.headroomStateFile, {
-            version: version2,
-            ...sticky()
-          });
-          return 0;
-        }
-      } else {
-        idleSince = void 0;
-      }
-    }
-    await ports.sleep(HEADROOM_POLL_MS);
-  }
-}
-function currentHeadroomAllowlist(fs13, paths) {
-  const providers = readAllProviders(fs13, paths.providersDir).map((entry) => entry.provider);
-  return headroomAllowlist(headroomUpstreams(providers, codexDaemonOrigin(readCodexState(fs13, paths.codexStateFile))));
-}
-function allowlistOf(ports) {
-  return currentHeadroomAllowlist(ports.fs, ports.paths);
-}
-async function waitUntilReady(ports, port) {
-  const deadline = ports.now() + HEADROOM_READY_TIMEOUT_MS;
-  for (; ; ) {
-    if (await ports.ready(port)) {
-      return true;
-    }
-    if (ports.now() >= deadline) {
-      return false;
-    }
-    await ports.sleep(HEADROOM_POLL_MS);
-  }
-}
-
 // src/codex/agent.ts
 var import_undici = __toESM(require_undici(), 1);
 var CODEX_KEEP_ALIVE_CEILING_MS = 1e4;
@@ -292773,69 +292490,419 @@ function createCodexAuthStore(authPath, ports) {
   };
 }
 
-// src/codex/ensure.ts
-var CODEX_START_TIMEOUT_MS = 3e4;
-var CODEX_LAUNCHER_POLL_MS = 100;
-var CodexStartError = class extends CliError {
+// src/codex/upstream.ts
+var import_node_crypto6 = require("node:crypto");
+
+// src/codex/http.ts
+var HTTP_STATUS = {
+  ok: 200,
+  badRequest: 400,
+  unauthorized: 401,
+  forbidden: 403,
+  notFound: 404,
+  methodNotAllowed: 405,
+  payloadTooLarge: 413,
+  tooManyRequests: 429,
+  /** Not sent to anyone: the client is gone. Recorded for a response abandoned because the client disconnected, following the convention nginx uses for the same case. */
+  clientClosedRequest: 499,
+  internalServerError: 500,
+  badGateway: 502
+};
+
+// src/codex/upstream.ts
+var CODEX_RESPONSES_URL = "https://chatgpt.com/backend-api/codex/responses";
+var CODEX_UPSTREAM_TIMEOUT_MS = 3e5;
+var CODEX_HEADERS_TIMEOUT_MS = 15e3;
+var realTimers = {
+  after: (ms, callback) => {
+    const handle = setTimeout(callback, ms);
+    return () => {
+      clearTimeout(handle);
+    };
+  }
+};
+async function fetchUntilHeaders(fetch3, timers, url2, init) {
+  for (let attempt = 1; ; attempt += 1) {
+    init.signal.throwIfAborted();
+    const deadline = new AbortController();
+    const cancel2 = timers.after(CODEX_HEADERS_TIMEOUT_MS, () => {
+      deadline.abort();
+    });
+    try {
+      return await fetch3(url2, { ...init, signal: AbortSignal.any([init.signal, deadline.signal]) });
+    } catch (error62) {
+      if (deadline.signal.aborted && !init.signal.aborted && attempt === 1) {
+        continue;
+      }
+      throw error62;
+    } finally {
+      cancel2();
+    }
+  }
+}
+var UUID_TEMPLATE = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx";
+function sessionIdFor(userId, randomId) {
+  if (userId === void 0 || userId === "") {
+    return randomId();
+  }
+  const hex3 = (0, import_node_crypto6.createHash)("sha256").update(`claude-use codex session
+${userId}`).digest("hex");
+  let next = 0;
+  return UUID_TEMPLATE.replace(/x/g, () => hex3.charAt(next++));
+}
+function headersFor(credentials, sessionId) {
+  return {
+    "Content-Type": "application/json",
+    Accept: "text/event-stream",
+    Authorization: `Bearer ${credentials.accessToken}`,
+    ...credentials.accountId === void 0 ? {} : { "chatgpt-account-id": credentials.accountId },
+    "OpenAI-Beta": "responses=experimental",
+    originator: "codex_cli_rs",
+    session_id: sessionId
+  };
+}
+async function callCodex(ports, request3, sessionId, signal) {
+  const url2 = ports.url ?? CODEX_RESPONSES_URL;
+  const body = JSON.stringify(request3);
+  const send = async (credentials2) => await fetchUntilHeaders(ports.fetch, ports.timers, url2, {
+    method: "POST",
+    headers: headersFor(credentials2, sessionId),
+    body,
+    signal: AbortSignal.any([signal, AbortSignal.timeout(CODEX_UPSTREAM_TIMEOUT_MS)])
+  });
+  const credentials = await ports.auth.current();
+  const first = await send(credentials);
+  if (first.status !== HTTP_STATUS.unauthorized) {
+    return first;
+  }
+  return await send(await ports.auth.refresh(credentials.accessToken));
+}
+
+// src/codex/commands.ts
+function codexHome(env, home) {
+  const fromEnv = env.CODEX_HOME;
+  return fromEnv !== void 0 && fromEnv !== "" ? fromEnv : import_node_path23.default.join(home, ".codex");
+}
+function codexUsageSnapshotPath() {
+  return import_node_path23.default.join(resolveClaudeHome(), "codex-quota.json");
+}
+function isEnoent4(error62) {
+  return typeof error62 === "object" && error62 !== null && "code" in error62 && error62.code === "ENOENT";
+}
+var PRIVATE_FILE_MODE = 384;
+var realCodexAuthFs = {
+  read: (filePath) => {
+    try {
+      return import_node_fs9.default.readFileSync(filePath, "utf8");
+    } catch (error62) {
+      if (isEnoent4(error62)) {
+        return void 0;
+      }
+      throw error62;
+    }
+  },
+  writePrivate: (filePath, contents) => {
+    import_node_fs9.default.writeFileSync(filePath, contents, { encoding: "utf8", mode: PRIVATE_FILE_MODE });
+    import_node_fs9.default.chmodSync(filePath, PRIVATE_FILE_MODE);
+  },
+  rename: (from, to) => {
+    import_node_fs9.default.renameSync(from, to);
+  }
+};
+function writeUsageSnapshot(log, snapshot) {
+  const target = codexUsageSnapshotPath();
+  const temp = `${target}.${String(process.pid)}.tmp`;
+  try {
+    import_node_fs9.default.mkdirSync(import_node_path23.default.dirname(target), { recursive: true });
+    import_node_fs9.default.writeFileSync(temp, `${JSON.stringify(snapshot, null, 2)}
+`);
+    import_node_fs9.default.renameSync(temp, target);
+  } catch (error62) {
+    log(`usage snapshot write failed: ${error62 instanceof Error ? error62.message : String(error62)}`);
+  }
+}
+function createCodexRoutePorts(log) {
+  const agent = createUpstreamAgent();
+  const upstreamFetch = createUpstreamFetch(agent);
+  const auth = createCodexAuthStore(import_node_path23.default.join(codexHome(process.env, import_node_os6.default.homedir()), "auth.json"), {
+    fs: realCodexAuthFs,
+    fetch: upstreamFetch,
+    now: () => /* @__PURE__ */ new Date(),
+    tempSuffix: `${String(process.pid)}.${(0, import_node_crypto7.randomUUID)()}`
+  });
+  return {
+    upstream: { fetch: upstreamFetch, auth, timers: realTimers, randomId: import_node_crypto7.randomUUID },
+    writeUsageSnapshot: (snapshot) => {
+      writeUsageSnapshot(log, snapshot);
+    },
+    now: () => Date.now(),
+    log
+  };
+}
+function codexProviderNames(fsPort, providersDir) {
+  return readAllProviders(fsPort, providersDir).filter((entry) => isCodexProvider(entry.provider)).map((entry) => entry.name).sort();
+}
+function collectCodexStatus(fsPort, paths, isRunning) {
+  const state = readFrontDoorState(fsPort, paths.frontdoorStateFile) ?? {};
+  return {
+    frontDoor: state,
+    supervisorAlive: state.supervisorPid !== void 0 && isRunning(state.supervisorPid),
+    sessions: listSessions(fsPort, paths.frontdoorSessionsDir).map((session) => ({ ...session, alive: isRunning(session.pid) })),
+    codexProviders: codexProviderNames(fsPort, paths.providersDir),
+    usageSnapshotPath: codexUsageSnapshotPath(),
+    usageSnapshotExists: fsPort.readFileUtf8(codexUsageSnapshotPath()) !== void 0,
+    logPath: paths.frontdoorLogPath,
+    logExists: fsPort.readFileUtf8(paths.frontdoorLogPath) !== void 0
+  };
+}
+function formatCodexStatus(status) {
+  const lines = [];
+  lines.push(
+    status.frontDoor.supervisorPid === void 0 ? "front door: not running" : `front door: supervisor pid ${String(status.frontDoor.supervisorPid)} (${status.supervisorAlive ? "alive" : "NOT running"})`
+  );
+  if (status.frontDoor.port === void 0) {
+    lines.push(`listener: not running${status.frontDoor.lastPort === void 0 ? "" : ` (next start on 127.0.0.1:${String(status.frontDoor.lastPort)})`}`);
+  } else {
+    lines.push(`listener: front door on 127.0.0.1:${String(status.frontDoor.port)}, serving codex providers under /providers/<name>`);
+  }
+  lines.push(status.codexProviders.length === 0 ? "codex providers: none defined" : `codex providers: ${status.codexProviders.join(", ")}`);
+  if (status.sessions.length === 0) {
+    lines.push("sessions: none");
+  } else {
+    const pids = status.sessions.map((session) => `${String(session.pid)}${session.alive ? "" : " (dead)"}`);
+    lines.push(`sessions: ${String(status.sessions.length)} registered (${pids.join(", ")})`);
+  }
+  if (status.frontDoor.lastError !== void 0) {
+    lines.push(`last error: ${status.frontDoor.lastError}`);
+  }
+  lines.push(`usage snapshot: ${status.usageSnapshotPath}${status.usageSnapshotExists ? "" : " (not created yet)"}`);
+  lines.push(`daemon log: ${status.logPath}${status.logExists ? "" : " (not created yet)"}`);
+  return lines;
+}
+function registerCodexCommand(program2, deps) {
+  const { paths } = deps;
+  const codex = withExamples(program2.command("codex").description("Inspect the codex translation the front-door daemon serves for codex providers."), ["claude-use codex status"]);
+  withExamples(
+    codex.command("status").description("Report the front door serving codex providers, its sessions, and the usage snapshot. Read-only.").option("--json", "Print the status as JSON.").action((options) => {
+      const status = collectCodexStatus(realFarmFs, paths, realIsProcessRunning);
+      if (options.json === true) {
+        printJson(status);
+        return;
+      }
+      for (const line of formatCodexStatus(status)) {
+        console.log(line);
+      }
+    }),
+    ["claude-use codex status", "claude-use codex status --json"]
+  );
+}
+
+// src/frontdoor/commands.ts
+var import_node_fs10 = __toESM(require("node:fs"), 1);
+
+// src/frontdoor/ensure.ts
+var FRONTDOOR_START_TIMEOUT_MS = 3e4;
+var FRONTDOOR_LAUNCHER_POLL_MS = 100;
+var FrontDoorStartError = class extends CliError {
   constructor(message) {
     super(message);
-    this.name = "CodexStartError";
+    this.name = "FrontDoorStartError";
   }
 };
-function ensureCodex(params) {
+function ensureFrontDoor(params) {
   const { paths, ports } = params;
-  const deadline = ports.now() + CODEX_START_TIMEOUT_MS;
+  const deadline = ports.now() + FRONTDOOR_START_TIMEOUT_MS;
   let spawned = false;
   for (; ; ) {
-    const state = readCodexState(ports.fs, paths.codexStateFile);
+    const state = readFrontDoorState(ports.fs, paths.frontdoorStateFile);
     if (state?.supervisorPid !== void 0 && ports.isRunning(state.supervisorPid)) {
-      if (state.port !== void 0 && state.workerPid !== void 0 && ports.isRunning(state.workerPid)) {
-        writeSession(ports.fs, paths.codexSessionsDir, { pid: params.launcherPid, startedAt: ports.now() });
+      if (state.port !== void 0) {
+        writeSession(ports.fs, paths.frontdoorSessionsDir, { pid: params.launcherPid, startedAt: ports.now() });
         return { port: state.port };
       }
       if (state.lastError !== void 0) {
-        throw new CodexStartError(`claude-use: the codex daemon reported a fatal error and is not serving: ${state.lastError} (daemon log: ${paths.codexLogPath})`);
+        throw new FrontDoorStartError(`claude-use: the front door reported a fatal error and is not serving: ${state.lastError} (daemon log: ${paths.frontdoorLogPath})`);
       }
     } else if (!spawned) {
-      ports.fs.mkdirp(paths.codexDir);
-      const created = ports.fs.writeFileExclusive(paths.codexLockFile, `${JSON.stringify({ pid: params.launcherPid, at: ports.now() })}
+      ports.fs.mkdirp(paths.frontdoorDir);
+      const created = ports.fs.writeFileExclusive(paths.frontdoorLockFile, `${JSON.stringify({ pid: params.launcherPid, at: ports.now() })}
 `);
       if (created) {
         ports.spawnSupervisor(paths);
         spawned = true;
       } else {
-        const lock = readStartLock(ports.fs, paths.codexLockFile);
+        const lock = readStartLock(ports.fs, paths.frontdoorLockFile);
         if (lock === void 0 || !ports.isRunning(lock.pid)) {
-          ports.fs.removeRecursive(paths.codexLockFile);
+          ports.fs.removeRecursive(paths.frontdoorLockFile);
           continue;
         }
       }
     }
     if (ports.now() >= deadline) {
       const lastError = state?.lastError;
-      throw new CodexStartError(
-        `claude-use: the codex daemon did not become ready within ${String(CODEX_START_TIMEOUT_MS)}ms` + (lastError === void 0 ? "" : ` (last error: ${lastError})`) + `. Daemon log: ${paths.codexLogPath}`
+      throw new FrontDoorStartError(
+        `claude-use: the front door did not become ready within ${String(FRONTDOOR_START_TIMEOUT_MS)}ms` + (lastError === void 0 ? "" : ` (last error: ${lastError})`) + `. Daemon log: ${paths.frontdoorLogPath}`
       );
     }
-    ports.sleep(CODEX_LAUNCHER_POLL_MS);
+    ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
   }
 }
 
-// src/codex/http.ts
-var HTTP_STATUS = {
-  ok: 200,
-  badRequest: 400,
-  unauthorized: 401,
-  forbidden: 403,
-  notFound: 404,
-  methodNotAllowed: 405,
-  payloadTooLarge: 413,
-  tooManyRequests: 429,
-  /** Not sent to anyone: the client is gone. Recorded for a response abandoned because the client disconnected, following the convention nginx uses for the same case. */
-  clientClosedRequest: 499,
-  internalServerError: 500,
-  badGateway: 502
-};
+// src/frontdoor/route.ts
+var INTERNAL_HEADER_NAMES = ["x-claude-use-identity", "x-claude-use-session", "x-claude-use-headroom"];
+var IDENTITY_HEADER = "x-claude-use-identity";
+var SESSION_HEADER = "x-claude-use-session";
+var HEADROOM_FLAG_HEADER = "x-claude-use-headroom";
+function singleHeaderValue(value) {
+  if (typeof value === "string") {
+    return value;
+  }
+  if (Array.isArray(value)) {
+    return value.join(", ");
+  }
+  return void 0;
+}
+function internalHeaderValue(headers, name) {
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() === name) {
+      return singleHeaderValue(value);
+    }
+  }
+  return void 0;
+}
+function identifyRequest(headers) {
+  const internal = new Set(INTERNAL_HEADER_NAMES);
+  const forwardable = {};
+  for (const [name, value] of Object.entries(headers)) {
+    if (value !== void 0 && !internal.has(name.toLowerCase())) {
+      forwardable[name] = value;
+    }
+  }
+  return {
+    session: {
+      identity: internalHeaderValue(headers, IDENTITY_HEADER),
+      sessionId: internalHeaderValue(headers, SESSION_HEADER),
+      headroom: internalHeaderValue(headers, HEADROOM_FLAG_HEADER) === "1"
+    },
+    forwardableHeaders: forwardable
+  };
+}
+var PROVIDER_PATH_PREFIX = "/providers/";
+function providerBaseUrl(port, provider) {
+  return `http://127.0.0.1:${String(port)}${PROVIDER_PATH_PREFIX}${encodeURIComponent(provider)}`;
+}
+function parseProviderPath(path28) {
+  if (!path28.startsWith(PROVIDER_PATH_PREFIX)) {
+    return void 0;
+  }
+  const tail = path28.slice(PROVIDER_PATH_PREFIX.length);
+  const slash = tail.indexOf("/");
+  if (slash <= 0) {
+    return void 0;
+  }
+  return { provider: decodeURIComponent(tail.slice(0, slash)), rest: tail.slice(slash) };
+}
+
+// src/frontdoor/pipeline.ts
+function errorTypeFor(status) {
+  switch (status) {
+    case HTTP_STATUS.badRequest:
+      return "invalid_request_error";
+    case HTTP_STATUS.unauthorized:
+      return "authentication_error";
+    case HTTP_STATUS.forbidden:
+      return "permission_error";
+    case HTTP_STATUS.notFound:
+      return "not_found_error";
+    case HTTP_STATUS.tooManyRequests:
+      return "rate_limit_error";
+    default:
+      return "api_error";
+  }
+}
+function errorBody(status, message) {
+  return JSON.stringify({ type: "error", error: { type: errorTypeFor(status), message } });
+}
+function createRoutedResponse(response, context) {
+  const { deps, session, route } = context;
+  let headersSent = false;
+  const settle2 = async () => {
+    await new Promise((resolve) => {
+      const done = () => {
+        response.off("drain", done);
+        response.off("close", done);
+        resolve();
+      };
+      response.once("drain", done);
+      response.once("close", done);
+    });
+  };
+  return {
+    get headersSent() {
+      return headersSent;
+    },
+    start: (status, headers) => {
+      for (const observe of deps.responseObservers) {
+        try {
+          observe({ session, route, status, headers });
+        } catch (error62) {
+          deps.log(`front door: response observer threw for ${route}: ${error62 instanceof Error ? error62.message : String(error62)}`);
+        }
+      }
+      response.writeHead(status, headers);
+      headersSent = true;
+    },
+    write: async (chunk) => {
+      if (response.destroyed || response.writableEnded) {
+        return;
+      }
+      if (!response.write(chunk)) {
+        await settle2();
+      }
+    },
+    end: () => {
+      response.end();
+    },
+    destroy: () => {
+      response.destroy();
+    }
+  };
+}
+async function serveRouted(request3, deps) {
+  const identified = identifyRequest(request3.headers);
+  const routed = {
+    method: request3.method,
+    url: request3.url,
+    headers: identified.forwardableHeaders,
+    body: request3.body,
+    signal: request3.signal,
+    session: identified.session
+  };
+  const resolution = await deps.resolveRoute(routed);
+  if (!resolution.ok) {
+    const response2 = createRoutedResponse(request3.response, { deps, session: identified.session, route: "(unrouted)" });
+    response2.start(resolution.status, { "Content-Type": "application/json" });
+    await response2.write(errorBody(resolution.status, resolution.message));
+    response2.end();
+    return;
+  }
+  const response = createRoutedResponse(request3.response, { deps, session: identified.session, route: resolution.route.name });
+  try {
+    await resolution.route.serve(routed, response);
+  } catch (error62) {
+    if (request3.signal.aborted) {
+      return;
+    }
+    deps.log(`front door: route ${resolution.route.name} failed: ${error62 instanceof Error ? `${error62.name}: ${error62.message}` : String(error62)}`);
+    if (!response.headersSent) {
+      response.start(HTTP_STATUS.internalServerError, { "Content-Type": "application/json" });
+      await response.write(errorBody(HTTP_STATUS.internalServerError, "internal error in the claude-use front door"));
+      response.end();
+      return;
+    }
+    response.destroy();
+  }
+}
 
 // src/codex/events.ts
 var ResponsesUsageSchema = external_exports.looseObject({
@@ -293165,82 +293232,8 @@ function createRelay(params) {
   return { push };
 }
 
-// src/codex/upstream.ts
-var import_node_crypto6 = require("node:crypto");
-var CODEX_RESPONSES_URL = "https://chatgpt.com/backend-api/codex/responses";
-var CODEX_UPSTREAM_TIMEOUT_MS = 3e5;
-var CODEX_HEADERS_TIMEOUT_MS = 15e3;
-var realTimers = {
-  after: (ms, callback) => {
-    const handle = setTimeout(callback, ms);
-    return () => {
-      clearTimeout(handle);
-    };
-  }
-};
-async function fetchUntilHeaders(fetch3, timers, url2, init) {
-  for (let attempt = 1; ; attempt += 1) {
-    init.signal.throwIfAborted();
-    const deadline = new AbortController();
-    const cancel2 = timers.after(CODEX_HEADERS_TIMEOUT_MS, () => {
-      deadline.abort();
-    });
-    try {
-      return await fetch3(url2, { ...init, signal: AbortSignal.any([init.signal, deadline.signal]) });
-    } catch (error62) {
-      if (deadline.signal.aborted && !init.signal.aborted && attempt === 1) {
-        continue;
-      }
-      throw error62;
-    } finally {
-      cancel2();
-    }
-  }
-}
-var UUID_TEMPLATE = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx";
-function sessionIdFor(userId, randomId) {
-  if (userId === void 0 || userId === "") {
-    return randomId();
-  }
-  const hex3 = (0, import_node_crypto6.createHash)("sha256").update(`claude-use codex session
-${userId}`).digest("hex");
-  let next = 0;
-  return UUID_TEMPLATE.replace(/x/g, () => hex3.charAt(next++));
-}
-function headersFor(credentials, sessionId) {
-  return {
-    "Content-Type": "application/json",
-    Accept: "text/event-stream",
-    Authorization: `Bearer ${credentials.accessToken}`,
-    ...credentials.accountId === void 0 ? {} : { "chatgpt-account-id": credentials.accountId },
-    "OpenAI-Beta": "responses=experimental",
-    originator: "codex_cli_rs",
-    session_id: sessionId
-  };
-}
-async function callCodex(ports, request3, sessionId, signal) {
-  const url2 = ports.url ?? CODEX_RESPONSES_URL;
-  const body = JSON.stringify(request3);
-  const send = async (credentials2) => await fetchUntilHeaders(ports.fetch, ports.timers, url2, {
-    method: "POST",
-    headers: headersFor(credentials2, sessionId),
-    body,
-    signal: AbortSignal.any([signal, AbortSignal.timeout(CODEX_UPSTREAM_TIMEOUT_MS)])
-  });
-  const credentials = await ports.auth.current();
-  const first = await send(credentials);
-  if (first.status !== HTTP_STATUS.unauthorized) {
-    return first;
-  }
-  return await send(await ports.auth.refresh(credentials.accessToken));
-}
-
 // src/codex/route.ts
-var CODEX_PROVIDER_PATH_PREFIX = "/providers/";
-function codexProviderBaseUrl(port, provider) {
-  return `http://127.0.0.1:${String(port)}${CODEX_PROVIDER_PATH_PREFIX}${encodeURIComponent(provider)}`;
-}
-function errorTypeFor(status) {
+function errorTypeFor2(status) {
   switch (status) {
     case HTTP_STATUS.badRequest:
       return "invalid_request_error";
@@ -293256,32 +293249,21 @@ function errorTypeFor(status) {
       return "api_error";
   }
 }
-function errorBody(status, message) {
-  return JSON.stringify({ type: "error", error: { type: errorTypeFor(status), message } });
+function errorBody2(status, message) {
+  return JSON.stringify({ type: "error", error: { type: errorTypeFor2(status), message } });
 }
 function errorResponse(status, message, headers = {}) {
-  return { status, headers: { "Content-Type": "application/json", ...headers }, body: errorBody(status, message) };
+  return { status, headers: { "Content-Type": "application/json", ...headers }, body: errorBody2(status, message) };
 }
 function errorFrame(status, message) {
   return `event: error
-data: ${errorBody(status, message)}
+data: ${errorBody2(status, message)}
 
 `;
 }
 var UPSTREAM_DETAIL_CHARS = 2e3;
 var UPSTREAM_LOG_DETAIL_CHARS = 300;
 var CHARS_PER_TOKEN = 4;
-function providerPath(path28) {
-  if (!path28.startsWith(CODEX_PROVIDER_PATH_PREFIX)) {
-    return void 0;
-  }
-  const tail = path28.slice(CODEX_PROVIDER_PATH_PREFIX.length);
-  const slash = tail.indexOf("/");
-  if (slash <= 0) {
-    return void 0;
-  }
-  return { provider: decodeURIComponent(tail.slice(0, slash)), rest: tail.slice(slash) };
-}
 function parseJson2(body) {
   try {
     const value = JSON.parse(body);
@@ -293418,7 +293400,7 @@ function createCodexRoute(ports) {
     if (request3.method !== "POST") {
       return errorResponse(HTTP_STATUS.methodNotAllowed, `unsupported ${request3.method} ${request3.path}`);
     }
-    const scoped = providerPath(request3.path);
+    const scoped = parseProviderPath(request3.path);
     if (scoped === void 0 || scoped.rest !== "/v1/messages" && scoped.rest !== "/v1/messages/count_tokens") {
       return errorResponse(HTTP_STATUS.notFound, `no such endpoint: ${request3.path}`);
     }
@@ -293434,8 +293416,7 @@ function createCodexRoute(ports) {
   };
 }
 
-// src/codex/server.ts
-var import_node_http = __toESM(require("node:http"), 1);
+// src/frontdoor/codexMount.ts
 var CODEX_MAX_BODY_BYTES = 67108864;
 var BodyTooLargeError = class extends Error {
   constructor() {
@@ -293446,7 +293427,7 @@ var BodyTooLargeError = class extends Error {
 async function readBody(request3) {
   const chunks = [];
   let size = 0;
-  for await (const chunk of request3) {
+  for await (const chunk of request3.body) {
     if (!Buffer.isBuffer(chunk)) {
       throw new TypeError("request body chunk was not a Buffer");
     }
@@ -293458,291 +293439,245 @@ async function readBody(request3) {
   }
   return Buffer.concat(chunks).toString("utf8");
 }
-async function writeResponse(response, routed) {
-  response.writeHead(routed.status, routed.headers);
+async function writeRouteResponse(routed, response, signal) {
+  response.start(routed.status, routed.headers);
   if (typeof routed.body === "string") {
-    response.end(routed.body);
+    await response.write(routed.body);
+    response.end();
     return;
   }
   for await (const chunk of routed.body) {
-    if (response.destroyed) {
+    if (signal.aborted) {
       return;
     }
-    if (!response.write(chunk)) {
-      await new Promise((resolve) => {
-        const settle2 = () => {
-          response.off("drain", settle2);
-          response.off("close", settle2);
-          resolve();
-        };
-        response.once("drain", settle2);
-        response.once("close", settle2);
-      });
-    }
+    await response.write(chunk);
   }
   response.end();
 }
-function createCodexServer(route, log) {
-  return import_node_http.default.createServer((request3, response) => {
-    const abort = new AbortController();
-    response.on("close", () => {
-      if (!response.writableFinished) {
-        abort.abort();
-      }
-    });
-    const path28 = new URL(request3.url ?? "/", "http://127.0.0.1").pathname;
-    const handle = async () => {
+function createCodexRouteMount(ports, upstreamBase, provider) {
+  const route = createCodexRoute(ports);
+  return {
+    name: `codex:${provider}`,
+    headroomEligible: true,
+    headroomUpstream: upstreamBase,
+    serve: async (request3, response) => {
       let body;
       try {
         body = await readBody(request3);
       } catch (error62) {
         const tooLarge = error62 instanceof BodyTooLargeError;
-        response.writeHead(tooLarge ? HTTP_STATUS.payloadTooLarge : HTTP_STATUS.badRequest, { "Content-Type": "application/json" });
-        response.end(JSON.stringify({ type: "error", error: { type: "invalid_request_error", message: error62 instanceof Error ? error62.message : String(error62) } }));
-        request3.destroy();
+        response.start(tooLarge ? HTTP_STATUS.payloadTooLarge : HTTP_STATUS.badRequest, { "Content-Type": "application/json" });
+        await response.write(
+          JSON.stringify({ type: "error", error: { type: "invalid_request_error", message: error62 instanceof Error ? error62.message : String(error62) } })
+        );
+        response.end();
+        request3.body.resume();
         return;
       }
-      const routed = await route({ method: request3.method ?? "GET", path: path28, body, signal: abort.signal });
-      if (abort.signal.aborted) {
+      const path28 = new URL(request3.url, "http://127.0.0.1").pathname;
+      const translated = { method: request3.method, path: path28, body, signal: request3.signal };
+      const routed = await route(translated);
+      if (request3.signal.aborted) {
         return;
       }
-      await writeResponse(response, routed);
+      await writeRouteResponse(routed, response, request3.signal);
+    }
+  };
+}
+
+// src/frontdoor/providerRoute.ts
+function createProviderRouteResolver(deps) {
+  const resolve = (request3) => {
+    const path28 = new URL(request3.url, "http://127.0.0.1").pathname;
+    const scoped = parseProviderPath(path28);
+    if (scoped === void 0) {
+      return { ok: false, status: HTTP_STATUS.notFound, message: `no such endpoint: ${path28}` };
+    }
+    const { provider } = scoped;
+    let definition;
+    try {
+      definition = loadProvider(deps.providersDir, provider, deps.fs);
+    } catch (error62) {
+      if (error62 instanceof ConfigValidationError || error62 instanceof LegacyProviderFileError) {
+        return { ok: false, status: HTTP_STATUS.internalServerError, message: `provider ${provider} is invalid: ${error62 instanceof Error ? error62.message : String(error62)}` };
+      }
+      throw error62;
+    }
+    if (definition === void 0) {
+      return { ok: false, status: HTTP_STATUS.notFound, message: `no provider named "${provider}"` };
+    }
+    if (!isCodexProvider(definition)) {
+      return { ok: false, status: HTTP_STATUS.notFound, message: `provider ${provider} is an http provider, which the front door does not route directly yet` };
+    }
+    const codexProvider = definition;
+    return {
+      ok: true,
+      route: createCodexRouteMount(
+        { ...deps.codexPorts, loadProvider: () => ({ ok: true, config: resolveCodexConfig(codexProvider.codex) }) },
+        providerBaseUrl(deps.ownPort(), provider),
+        provider
+      )
+    };
+  };
+  return async (request3) => await Promise.resolve(resolve(request3));
+}
+
+// src/frontdoor/server.ts
+var import_node_http = __toESM(require("node:http"), 1);
+var HEALTH_TIMEOUT_MS = 2e3;
+var HEALTH_START_BUDGET_MS = 5e3;
+var HEALTH_RETRY_MS = 50;
+function createFrontDoorServer(pipeline, log) {
+  return import_node_http.default.createServer((request3, response) => {
+    if (request3.method === "GET" && request3.url === "/healthz") {
+      response.writeHead(HTTP_STATUS.ok, { "Content-Type": "text/plain" });
+      response.end("ok");
+      return;
+    }
+    const abort = new AbortController();
+    response.on("close", () => {
+      if (!response.writableFinished) {
+        abort.abort();
+      }
+    });
+    const handle = async () => {
+      await pipeline({ method: request3.method ?? "GET", url: request3.url ?? "/", headers: request3.headers, body: request3, signal: abort.signal, response });
+      if (!request3.readableEnded) {
+        request3.resume();
+      }
     };
     handle().catch((error62) => {
-      log(`request ${request3.method ?? "?"} ${path28} failed: ${error62 instanceof Error ? `${error62.name}: ${error62.message}` : String(error62)}`);
+      log(`request ${request3.method ?? "?"} ${request3.url ?? "?"} failed: ${error62 instanceof Error ? `${error62.name}: ${error62.message}` : String(error62)}`);
       if (!response.headersSent) {
         response.writeHead(HTTP_STATUS.internalServerError, { "Content-Type": "application/json" });
-        response.end(JSON.stringify({ type: "error", error: { type: "api_error", message: "internal error in the codex translation daemon" } }));
+        response.end(JSON.stringify({ type: "error", error: { type: "api_error", message: "internal error in the claude-use front door" } }));
       } else {
         response.destroy();
       }
     });
   });
 }
+async function frontDoorHealthy(port) {
+  try {
+    const response = await fetch(`http://127.0.0.1:${String(port)}/healthz`, { signal: AbortSignal.timeout(HEALTH_TIMEOUT_MS) });
+    return response.ok;
+  } catch {
+    return false;
+  }
+}
+async function listenFrontDoor(server2, preferredPort, onBound) {
+  const tryListen = async (port) => await new Promise((resolve, reject) => {
+    const onError = (error62) => {
+      server2.off("error", onError);
+      reject(error62);
+    };
+    server2.once("error", onError);
+    server2.listen(port, "127.0.0.1", () => {
+      server2.off("error", onError);
+      const address = server2.address();
+      const bound2 = typeof address === "object" && address !== null ? address.port : 0;
+      if (bound2 === 0) {
+        reject(new Error("could not bind a loopback port"));
+        return;
+      }
+      resolve(bound2);
+    });
+  });
+  let bound;
+  if (preferredPort !== void 0) {
+    try {
+      bound = await tryListen(preferredPort);
+    } catch {
+      bound = await tryListen(0);
+    }
+  } else {
+    bound = await tryListen(0);
+  }
+  onBound(bound);
+  const deadline = Date.now() + HEALTH_START_BUDGET_MS;
+  for (; ; ) {
+    if (await frontDoorHealthy(bound)) {
+      return {
+        port: bound,
+        close: async () => {
+          await new Promise((resolve) => {
+            server2.close(() => {
+              resolve(void 0);
+            });
+            server2.closeAllConnections();
+          });
+        }
+      };
+    }
+    if (Date.now() >= deadline) {
+      throw new Error(`the front door listener on 127.0.0.1:${String(bound)} did not answer its health probe`);
+    }
+    await new Promise((resolve) => {
+      setTimeout(resolve, HEALTH_RETRY_MS);
+    });
+  }
+}
 
-// src/codex/supervisor.ts
-var CODEX_SUPERVISOR_STILL_RUNNING = -1;
-var CODEX_POLL_MS = 1e3;
-var CODEX_READY_TIMEOUT_MS = 1e4;
-var MS_PER_MINUTE2 = 6e4;
-async function runCodexSupervisor(idleShutdownMinutes, ports, options = {}) {
-  const { fs: fs13, paths } = ports;
-  const previous = readCodexState(fs13, paths.codexStateFile);
+// src/frontdoor/supervisor.ts
+var FRONTDOOR_SUPERVISOR_STILL_RUNNING = -1;
+var FRONTDOOR_POLL_MS = 1e3;
+var MS_PER_MINUTE = 6e4;
+async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {}) {
+  const { fs: fs14, paths } = ports;
+  const previous = readFrontDoorState(fs14, paths.frontdoorStateFile);
   let lastPort = previous?.lastPort;
   const sticky = () => lastPort === void 0 ? {} : { lastPort };
   const fail = (message) => {
-    writeCodexState(fs13, paths.codexStateFile, { lastError: message, ...sticky() });
-    fs13.removeRecursive(paths.codexLockFile);
-    ports.log(`claude-use codex supervisor: ${message}`);
+    writeFrontDoorState(fs14, paths.frontdoorStateFile, { lastError: message, ...sticky() });
+    fs14.removeRecursive(paths.frontdoorLockFile);
+    ports.log(`claude-use frontdoor supervisor: ${message}`);
     return 1;
   };
-  writeCodexState(fs13, paths.codexStateFile, { supervisorPid: ports.ownPid, ...sticky() });
-  const orphan = previous?.workerPid;
-  if (orphan !== void 0 && ports.isRunning(orphan)) {
-    ports.log(`claude-use codex supervisor: stopping worker pid ${String(orphan)} left behind by the previous supervisor`);
-    ports.stopProcess(orphan);
-  }
-  let workerPid;
-  let failures = 0;
+  writeFrontDoorState(fs14, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, ...sticky() });
+  const previousSticky = lastPort;
+  let listener;
+  try {
+    listener = await ports.startListener(lastPort);
+  } catch (error62) {
+    return fail(`could not start the front-door listener: ${error62 instanceof Error ? error62.message : String(error62)}`);
+  }
+  if (previousSticky !== void 0 && listener.port !== previousSticky) {
+    ports.log(`claude-use frontdoor supervisor: sticky port ${String(previousSticky)} was occupied; moving to ${String(listener.port)} (sessions launched against the old port are stale until they relaunch)`);
+  }
+  lastPort = listener.port;
+  writeFrontDoorState(fs14, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, port: listener.port, ...sticky() });
+  fs14.removeRecursive(paths.frontdoorLockFile);
+  ports.log(`claude-use frontdoor supervisor ${String(ports.ownPid)}: front door listening on 127.0.0.1:${String(listener.port)}`);
   let idleSince;
   let ticks = 0;
   for (; ; ) {
     if (options.tickLimit !== void 0 && ticks >= options.tickLimit) {
-      return CODEX_SUPERVISOR_STILL_RUNNING;
+      return FRONTDOOR_SUPERVISOR_STILL_RUNNING;
     }
     ticks += 1;
-    pruneDeadSessions(fs13, paths.codexSessionsDir, ports.isRunning);
-    const crashed = workerPid !== void 0 && !ports.isRunning(workerPid);
-    if (workerPid === void 0 || crashed) {
-      if (crashed) {
-        ports.log(`claude-use codex supervisor: worker pid ${String(workerPid)} died`);
-        workerPid = void 0;
-        writeCodexState(fs13, paths.codexStateFile, { supervisorPid: ports.ownPid, ...sticky() });
-      }
-      if (failures >= HEADROOM_START_RETRY_BUDGET) {
-        return fail(`the codex worker failed to become ready ${String(failures)} times in a row; giving up`);
-      }
-      const previousSticky = lastPort;
-      const port = lastPort !== void 0 && await ports.isPortFree(lastPort) ? lastPort : await ports.freePort();
-      const pid = ports.spawnWorker(port);
-      if (await waitUntilReady2(ports, port)) {
-        failures = 0;
-        workerPid = pid;
-        lastPort = port;
-        if (previousSticky !== void 0 && port !== previousSticky) {
-          ports.log(
-            `claude-use codex supervisor: sticky port ${String(previousSticky)} was occupied; moving to ${String(port)} (sessions launched against the old port are stale until they relaunch)`
-          );
-        }
-        writeCodexState(fs13, paths.codexStateFile, { supervisorPid: ports.ownPid, workerPid: pid, port, ...sticky() });
-        fs13.removeRecursive(paths.codexLockFile);
-        idleSince = void 0;
-        ports.log(`claude-use codex supervisor: worker pid ${String(pid)} ready on 127.0.0.1:${String(port)}`);
-      } else {
-        ports.stopProcess(pid);
-        failures += 1;
-        ports.log(`claude-use codex supervisor: worker did not become ready on port ${String(port)} (attempt ${String(failures)} of ${String(HEADROOM_START_RETRY_BUDGET)})`);
-        await ports.sleep(backoffForAttempt(failures));
-        continue;
-      }
-    } else if (listSessions(fs13, paths.codexSessionsDir).length === 0) {
+    pruneDeadSessions(fs14, paths.frontdoorSessionsDir, ports.isRunning);
+    if (listSessions(fs14, paths.frontdoorSessionsDir).length === 0) {
       idleSince ??= ports.now();
-      if (ports.now() - idleSince >= idleShutdownMinutes * MS_PER_MINUTE2) {
-        ports.log(`claude-use codex supervisor: no sessions for ${String(idleShutdownMinutes)} minute(s); stopping the worker and exiting`);
-        ports.stopProcess(workerPid);
-        writeCodexState(fs13, paths.codexStateFile, sticky());
+      if (ports.now() - idleSince >= idleShutdownMinutes * MS_PER_MINUTE) {
+        ports.log(`claude-use frontdoor supervisor: no sessions for ${String(idleShutdownMinutes)} minute(s); closing the front door and exiting`);
+        await listener.close();
+        writeFrontDoorState(fs14, paths.frontdoorStateFile, sticky());
         return 0;
       }
     } else {
       idleSince = void 0;
     }
-    await ports.sleep(CODEX_POLL_MS);
-  }
-}
-async function waitUntilReady2(ports, port) {
-  const deadline = ports.now() + CODEX_READY_TIMEOUT_MS;
-  for (; ; ) {
-    if (await ports.ready(port)) {
-      return true;
-    }
-    if (ports.now() >= deadline) {
-      return false;
-    }
-    await ports.sleep(CODEX_POLL_MS);
+    await ports.sleep(FRONTDOOR_POLL_MS);
   }
 }
 
-// src/codex/commands.ts
-function codexHome(env, home) {
-  const fromEnv = env.CODEX_HOME;
-  return fromEnv !== void 0 && fromEnv !== "" ? fromEnv : import_node_path23.default.join(home, ".codex");
-}
-function usageSnapshotPath() {
-  return import_node_path23.default.join(resolveClaudeHome(), "codex-quota.json");
-}
+// src/frontdoor/commands.ts
 function appendLog(paths, line) {
-  import_node_fs9.default.mkdirSync(paths.logsDir, { recursive: true });
-  import_node_fs9.default.appendFileSync(paths.codexLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
-`);
-}
-function isEnoent4(error62) {
-  return typeof error62 === "object" && error62 !== null && "code" in error62 && error62.code === "ENOENT";
-}
-var PRIVATE_FILE_MODE = 384;
-var realCodexAuthFs = {
-  read: (filePath) => {
-    try {
-      return import_node_fs9.default.readFileSync(filePath, "utf8");
-    } catch (error62) {
-      if (isEnoent4(error62)) {
-        return void 0;
-      }
-      throw error62;
-    }
-  },
-  writePrivate: (filePath, contents) => {
-    import_node_fs9.default.writeFileSync(filePath, contents, { encoding: "utf8", mode: PRIVATE_FILE_MODE });
-    import_node_fs9.default.chmodSync(filePath, PRIVATE_FILE_MODE);
-  },
-  rename: (from, to) => {
-    import_node_fs9.default.renameSync(from, to);
-  }
-};
-function lookupCodexProvider(paths, name) {
-  let provider;
-  try {
-    provider = loadProvider(paths.providersDir, name, realFsPort);
-  } catch (error62) {
-    if (error62 instanceof ConfigValidationError || error62 instanceof LegacyProviderFileError) {
-      return { ok: false, status: 500, message: `provider ${name} is invalid: ${error62.message}` };
-    }
-    throw error62;
-  }
-  if (provider === void 0) {
-    return { ok: false, status: 404, message: `no provider named "${name}"` };
-  }
-  if (!isCodexProvider(provider)) {
-    return { ok: false, status: 404, message: `provider ${name} is not a codex provider` };
-  }
-  return { ok: true, config: resolveCodexConfig(provider.codex) };
-}
-function writeUsageSnapshot(paths, snapshot) {
-  const target = usageSnapshotPath();
-  const temp = `${target}.${String(process.pid)}.tmp`;
-  try {
-    import_node_fs9.default.mkdirSync(import_node_path23.default.dirname(target), { recursive: true });
-    import_node_fs9.default.writeFileSync(temp, `${JSON.stringify(snapshot, null, 2)}
+  import_node_fs10.default.mkdirSync(paths.logsDir, { recursive: true });
+  import_node_fs10.default.appendFileSync(paths.frontdoorLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
 `);
-    import_node_fs9.default.renameSync(temp, target);
-  } catch (error62) {
-    appendLog(paths, `codex worker: usage snapshot write failed: ${error62 instanceof Error ? error62.message : String(error62)}`);
-  }
 }
-var WORKER_PARENT_POLL_MS = 1e3;
-async function runWorker(paths, port, supervisorPid) {
-  const log = (line) => {
-    appendLog(paths, `codex worker ${String(process.pid)}: ${line}`);
-  };
-  const agent = createUpstreamAgent();
-  const upstreamFetch = createUpstreamFetch(agent);
-  const auth = createCodexAuthStore(import_node_path23.default.join(codexHome(process.env, import_node_os6.default.homedir()), "auth.json"), {
-    fs: realCodexAuthFs,
-    fetch: upstreamFetch,
-    now: () => /* @__PURE__ */ new Date(),
-    tempSuffix: `${String(process.pid)}.${(0, import_node_crypto7.randomUUID)()}`
-  });
-  const route = createCodexRoute({
-    upstream: { fetch: upstreamFetch, auth, timers: realTimers, randomId: import_node_crypto7.randomUUID },
-    loadProvider: (name) => lookupCodexProvider(paths, name),
-    writeUsageSnapshot: (snapshot) => {
-      writeUsageSnapshot(paths, snapshot);
-    },
-    now: () => Date.now(),
-    log
-  });
-  const server2 = createCodexServer(route, log);
-  await new Promise((resolve, reject) => {
-    server2.once("error", reject);
-    server2.listen(port, "127.0.0.1", () => {
-      server2.off("error", reject);
-      resolve();
-    });
-  });
-  log(`listening on 127.0.0.1:${String(port)}`);
-  const watch = setInterval(() => {
-    if (!realIsProcessRunning(supervisorPid)) {
-      log(`supervisor pid ${String(supervisorPid)} is gone; exiting`);
-      clearInterval(watch);
-      server2.close();
-      void agent.close();
-    }
-  }, WORKER_PARENT_POLL_MS);
-}
-async function realFreePort() {
-  return await new Promise((resolve, reject) => {
-    const server2 = import_node_net2.default.createServer();
-    server2.unref();
-    server2.on("error", reject);
-    server2.listen(0, "127.0.0.1", () => {
-      const address = server2.address();
-      const port = typeof address === "object" && address !== null ? address.port : 0;
-      server2.close(() => {
-        if (port === 0) {
-          reject(new Error("could not reserve a loopback port"));
-          return;
-        }
-        resolve(port);
-      });
-    });
-  });
-}
-var ownedWorkers = /* @__PURE__ */ new Map();
-var exitedWorkers = /* @__PURE__ */ new Set();
-function workerRunning(pid) {
-  return !exitedWorkers.has(pid) && realIsProcessRunning(pid);
-}
-var READY_FETCH_TIMEOUT_MS = 2e3;
-function realCodexSupervisorPorts(paths) {
+function realFrontDoorSupervisorPorts(paths) {
   return {
     fs: realFarmFs,
     paths,
@@ -293753,59 +293688,38 @@ function realCodexSupervisorPorts(paths) {
         setTimeout(resolve, ms);
       });
     },
-    isRunning: workerRunning,
-    freePort: realFreePort,
-    isPortFree: realIsPortFree,
-    spawnWorker: (port) => {
-      import_node_fs9.default.mkdirSync(paths.logsDir, { recursive: true });
-      const logFd = import_node_fs9.default.openSync(paths.codexLogPath, "a");
-      try {
-        const invocation = selfInvocation(["__codex-worker", "--port", String(port), "--supervisor", String(process.pid)]);
-        const child = (0, import_node_child_process3.spawn)(invocation.command, invocation.args, detachedDaemonSpawnOptions(logFd, { ...process.env, CLAUDE_USE_HOME: paths.root }));
-        if (child.pid === void 0) {
-          throw new Error("spawning the codex worker returned no pid");
-        }
-        const pid = child.pid;
-        ownedWorkers.set(pid, child);
-        child.once("exit", (code, signal) => {
-          ownedWorkers.delete(pid);
-          exitedWorkers.add(pid);
-          appendLog(paths, `claude-use codex supervisor: worker ${String(pid)} exited (${signal ?? `code ${String(code)}`})`);
-        });
-        return pid;
-      } finally {
-        import_node_fs9.default.closeSync(logFd);
-      }
-    },
-    stopProcess: (pid) => {
-      const outcome = stopSupervisedProcess(pid, {
-        signal: (target, signal) => {
-          process.kill(target, signal);
-        },
-        isRunning: workerRunning,
-        waitMs: realSleepSync,
-        now: () => Date.now()
+    isRunning: realIsProcessRunning,
+    startListener: async (preferredPort) => {
+      const log = (line) => {
+        appendLog(paths, `frontdoor ${String(process.pid)}: ${line}`);
+      };
+      let ownPort = 0;
+      const codexPorts = createCodexRoutePorts(log);
+      const resolveRoute = createProviderRouteResolver({ fs: realFsPort, providersDir: paths.providersDir, codexPorts, ownPort: () => ownPort });
+      const deps = {
+        resolveRoute,
+        responseObservers: [],
+        log
+      };
+      const server2 = createFrontDoorServer(async (request3) => {
+        await serveRouted(request3, deps);
+      }, log);
+      server2.on("error", (error62) => {
+        appendLog(paths, `frontdoor ${String(process.pid)}: listener failed: ${error62.message}; exiting`);
+        process.exit(1);
+      });
+      return await listenFrontDoor(server2, preferredPort, (port) => {
+        ownPort = port;
       });
-      if (outcome === "still-running") {
-        appendLog(paths, `claude-use codex supervisor: pid ${String(pid)} survived SIGKILL within its grace; it is stuck uninterruptibly`);
-      }
-    },
-    ready: async (port) => {
-      try {
-        const response = await fetch(`http://127.0.0.1:${String(port)}/healthz`, { signal: AbortSignal.timeout(READY_FETCH_TIMEOUT_MS) });
-        return response.ok;
-      } catch {
-        return false;
-      }
     },
     log: (line) => {
       appendLog(paths, line);
     }
   };
 }
-function realCodexPort(paths) {
+function realFrontDoorPort(paths) {
   return {
-    ensure: () => ensureCodex({
+    ensure: () => ensureFrontDoor({
       paths,
       launcherPid: process.pid,
       ports: {
@@ -293813,33 +293727,36 @@ function realCodexPort(paths) {
         isRunning: realIsProcessRunning,
         now: () => Date.now(),
         sleep: realSleepSync,
-        spawnSupervisor: (layout) => spawnDetachedSupervisor(layout, "__codex-supervisor", layout.codexLogPath)
+        spawnSupervisor: (layout) => spawnDetachedSupervisor(layout, "__frontdoor-supervisor", layout.frontdoorLogPath)
       }
     }),
     release: () => {
-      removeSession(realFarmFs, paths.codexSessionsDir, process.pid);
+      removeSession(realFarmFs, paths.frontdoorSessionsDir, process.pid);
     }
   };
 }
-function collectCodexStatus(fsPort, paths, isRunning) {
-  const state = readCodexState(fsPort, paths.codexStateFile) ?? {};
+function collectFrontDoorStatus(fsPort, paths, isRunning) {
+  const state = readFrontDoorState(fsPort, paths.frontdoorStateFile) ?? {};
   return {
     state,
     supervisorAlive: state.supervisorPid !== void 0 && isRunning(state.supervisorPid),
-    workerAlive: state.workerPid !== void 0 && isRunning(state.workerPid),
-    sessions: listSessions(fsPort, paths.codexSessionsDir).map((session) => ({ ...session, alive: isRunning(session.pid) })),
-    logPath: paths.codexLogPath,
-    logExists: fsPort.readFileUtf8(paths.codexLogPath) !== void 0
+    sessions: listSessions(fsPort, paths.frontdoorSessionsDir).map((session) => ({ ...session, alive: isRunning(session.pid) })),
+    logPath: paths.frontdoorLogPath,
+    logExists: fsPort.readFileUtf8(paths.frontdoorLogPath) !== void 0
   };
 }
-function formatCodexStatus(status) {
+function formatFrontDoorStatus(status) {
   const lines = [];
-  lines.push(
-    status.state.supervisorPid === void 0 ? "supervisor: not running (no state recorded)" : `supervisor: pid ${String(status.state.supervisorPid)} (${status.supervisorAlive ? "alive" : "NOT running"})`
-  );
-  lines.push(
-    status.state.workerPid === void 0 || status.state.port === void 0 ? `worker: not running${status.state.lastPort === void 0 ? "" : ` (next start on 127.0.0.1:${String(status.state.lastPort)})`}` : `worker: pid ${String(status.state.workerPid)} (${status.workerAlive ? "alive" : "NOT running"}), listening on 127.0.0.1:${String(status.state.port)}`
-  );
+  if (status.state.supervisorPid === void 0) {
+    lines.push("supervisor: not running");
+  } else {
+    lines.push(`supervisor: pid ${String(status.state.supervisorPid)} (${status.supervisorAlive ? "alive" : "NOT running"})`);
+  }
+  if (status.state.port === void 0) {
+    lines.push(`front door: not listening${status.state.lastPort === void 0 ? "" : ` (next start on 127.0.0.1:${String(status.state.lastPort)})`}`);
+  } else {
+    lines.push(`front door: listening on 127.0.0.1:${String(status.state.port)}, routing /providers/<name> requests`);
+  }
   if (status.sessions.length === 0) {
     lines.push("sessions: none");
   } else {
@@ -293852,49 +293769,33 @@ function formatCodexStatus(status) {
   lines.push(`daemon log: ${status.logPath}${status.logExists ? "" : " (not created yet)"}`);
   return lines;
 }
-function parsePositiveInt(value) {
-  const parsed = Number(value);
-  if (!Number.isInteger(parsed) || parsed <= 0) {
-    throw new InvalidArgumentError(`expected a positive integer, got "${value}"`);
-  }
-  return parsed;
-}
-function registerCodexCommand(program2, deps) {
+function registerFrontDoorCommand(program2, deps) {
   const { paths } = deps;
-  const codex = withExamples(program2.command("codex").description("Inspect the codex translation daemon that serves codex providers."), ["claude-use codex status"]);
+  const frontdoor = withExamples(program2.command("frontdoor").description("Inspect the front-door daemon that routes every claude-use session."), [
+    "claude-use frontdoor status"
+  ]);
   withExamples(
-    codex.command("status").description("Report the codex daemon's supervisor, worker, port, sessions, and last error. Read-only.").option("--json", "Print the status as JSON.").action((options) => {
-      const status = collectCodexStatus(realFarmFs, paths, realIsProcessRunning);
+    frontdoor.command("status").description("Report the front door's supervisor, listener, sessions, and last error. Read-only.").option("--json", "Print the status as JSON.").action((options) => {
+      const status = collectFrontDoorStatus(realFarmFs, paths, realIsProcessRunning);
       if (options.json === true) {
         printJson(status);
         return;
       }
-      for (const line of formatCodexStatus(status)) {
+      for (const line of formatFrontDoorStatus(status)) {
         console.log(line);
       }
     }),
-    ["claude-use codex status", "claude-use codex status --json"]
+    ["claude-use frontdoor status", "claude-use frontdoor status --json"]
   );
-  program2.command("__codex-supervisor", { hidden: true }).description("Internal: supervise the codex translation worker. Started by the launcher; never run by hand.").allowUnknownOption().action(async () => {
-    const idleShutdownMinutes = readGlobalConfig(paths)?.codex?.idleShutdownMinutes ?? CODEX_DEFAULT_IDLE_SHUTDOWN_MINUTES;
-    process.on("exit", () => {
-      for (const pid of ownedWorkers.keys()) {
-        try {
-          process.kill(pid, "SIGKILL");
-        } catch {
-        }
-      }
-    });
+  program2.command("__frontdoor-supervisor", { hidden: true }).description("Internal: serve the front-door routing listener. Started by the launcher; never run by hand.").allowUnknownOption().action(async () => {
+    const idleShutdownMinutes = readGlobalConfig(paths)?.frontdoor?.idleShutdownMinutes ?? FRONTDOOR_DEFAULT_IDLE_SHUTDOWN_MINUTES;
     process.on("SIGTERM", () => {
       deps.exit(0);
     });
     process.on("SIGINT", () => {
       deps.exit(0);
     });
-    deps.exit(await runCodexSupervisor(idleShutdownMinutes, realCodexSupervisorPorts(paths)));
-  });
-  program2.command("__codex-worker", { hidden: true }).description("Internal: serve the codex translation listener. Started by the codex supervisor; never run by hand.").requiredOption("--port <port>", "Loopback port to listen on.", parsePositiveInt).requiredOption("--supervisor <pid>", "The supervising process; the worker exits once it is gone.", parsePositiveInt).action(async (options) => {
-    await runWorker(paths, options.port, options.supervisor);
+    deps.exit(await runFrontDoorSupervisor(idleShutdownMinutes, realFrontDoorSupervisorPorts(paths)));
   });
 }
 
@@ -294171,7 +294072,7 @@ function registerCompletionCommand(program2) {
 }
 
 // src/doctor.ts
-var import_node_fs10 = __toESM(require("node:fs"), 1);
+var import_node_fs11 = __toESM(require("node:fs"), 1);
 var import_node_path24 = __toESM(require("node:path"), 1);
 function refinePathShadow(status, ownExecutablePath, realpath) {
   if (status.status !== "shadowed") {
@@ -294536,7 +294437,7 @@ function formatDoctorReport(report) {
 }
 function realpathOrSelf(target) {
   try {
-    return import_node_fs10.default.realpathSync(target);
+    return import_node_fs11.default.realpathSync(target);
   } catch {
     return target;
   }
@@ -294546,21 +294447,21 @@ function registerDoctorCommand(program2, deps) {
   const command = program2.command("doctor").description(
     "Audit the whole ~/.claude-use config graph: every identity, every configuration profile's extends chain, every provider, directory-rules.json, config.json, categories.local.json, active-identity, and real Claude Code binary discoverability. Identity/directory-agnostic, unlike `check`. Exits 1 when any check fails."
   ).option("--json", "Print the report as JSON.").action((options) => {
-    const identityNames = import_node_fs10.default.existsSync(paths.identitiesDir) ? import_node_fs10.default.readdirSync(paths.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && isIdentityDirectoryName(entry.name)).map((entry) => entry.name).sort() : [];
+    const identityNames = import_node_fs11.default.existsSync(paths.identitiesDir) ? import_node_fs11.default.readdirSync(paths.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && isIdentityDirectoryName(entry.name)).map((entry) => entry.name).sort() : [];
     const identities = identityNames.map((name) => {
       const farmRoot = import_node_path24.default.join(paths.identitiesDir, name);
       const identityPath = import_node_path24.default.join(farmRoot, "identity.json");
       return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot };
     });
-    const profileNames = import_node_fs10.default.existsSync(paths.configProfilesDir) ? import_node_fs10.default.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
+    const profileNames = import_node_fs11.default.existsSync(paths.configProfilesDir) ? import_node_fs11.default.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
     const configProfiles = profileNames.map((name) => {
       const profilePath = import_node_path24.default.join(paths.configProfilesDir, `${name}.json`);
       return { name, path: profilePath, raw: realFsPort.readFileUtf8(profilePath) };
     });
-    const providerNames = import_node_fs10.default.existsSync(paths.providersDir) ? import_node_fs10.default.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
+    const providerNames = import_node_fs11.default.existsSync(paths.providersDir) ? import_node_fs11.default.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
     const providers = providerNames.map((name) => {
-      const providerPath2 = import_node_path24.default.join(paths.providersDir, `${name}.json`);
-      return { name, path: providerPath2, raw: realFsPort.readFileUtf8(providerPath2) };
+      const providerPath = import_node_path24.default.join(paths.providersDir, `${name}.json`);
+      return { name, path: providerPath, raw: realFsPort.readFileUtf8(providerPath) };
     });
     const ownExecutablePath = realOwnExecutablePath();
     let binaryDiscovery;
@@ -294592,7 +294493,7 @@ function registerDoctorCommand(program2, deps) {
       categoriesLocal: { path: paths.categoriesLocalFile, raw: realFsPort.readFileUtf8(paths.categoriesLocalFile) },
       activeIdentity: { path: paths.activeIdentityFile, raw: realFsPort.readFileUtf8(paths.activeIdentityFile) },
       binaryDiscovery,
-      claudeShim: { state: shimState, targetExists: shimState !== void 0 && import_node_fs10.default.existsSync(shimState.targetPath) },
+      claudeShim: { state: shimState, targetExists: shimState !== void 0 && import_node_fs11.default.existsSync(shimState.targetPath) },
       pathResolution: {
         ownExecutablePath,
         claudeUse: refinePathShadow(
@@ -294630,15 +294531,15 @@ function registerDoctorCommand(program2, deps) {
 }
 
 // src/headroom/commands.ts
-var import_node_fs11 = __toESM(require("node:fs"), 1);
-var import_node_net3 = __toESM(require("node:net"), 1);
-var import_node_child_process4 = require("node:child_process");
+var import_node_fs12 = __toESM(require("node:fs"), 1);
+var import_node_net2 = __toESM(require("node:net"), 1);
+var import_node_child_process3 = require("node:child_process");
 
 // src/headroom/mitm.ts
-var fs11 = __toESM(require("node:fs"), 1);
+var fs12 = __toESM(require("node:fs"), 1);
 var http2 = __toESM(require("node:http"), 1);
 var https = __toESM(require("node:https"), 1);
-var net3 = __toESM(require("node:net"), 1);
+var net2 = __toESM(require("node:net"), 1);
 var tls = __toESM(require("node:tls"), 1);
 var import_node_forge = __toESM(require_lib3(), 1);
 var MITM_INTERCEPT_HOST = "api.anthropic.com";
@@ -294873,7 +294774,7 @@ function realMitmEffects() {
   const tlsAgent = new https.Agent({ keepAlive: true });
   const listenOnce = async (port, onSocket) => await new Promise((resolve, reject) => {
     const accepted = /* @__PURE__ */ new Set();
-    const server2 = net3.createServer((socket) => {
+    const server2 = net2.createServer((socket) => {
       accepted.add(socket);
       socket.on("close", () => {
         accepted.delete(socket);
@@ -294946,7 +294847,7 @@ function realMitmEffects() {
       };
     },
     connectTcp: async (host, port) => await new Promise((resolve, reject) => {
-      const socket = net3.connect({ host, port });
+      const socket = net2.connect({ host, port });
       socket.once("connect", () => {
         resolve(socket);
       });
@@ -295000,7 +294901,7 @@ function isEnoent5(error62) {
 function realMitmCertStore(paths) {
   const read = (file2) => {
     try {
-      return fs11.readFileSync(file2, "utf8");
+      return fs12.readFileSync(file2, "utf8");
     } catch (error62) {
       if (isEnoent5(error62)) {
         return void 0;
@@ -295015,12 +294916,293 @@ function realMitmCertStore(paths) {
       return certPem === void 0 || keyPem === void 0 ? void 0 : { certPem, keyPem };
     },
     writeCa: (ca) => {
-      fs11.mkdirSync(paths.headroomCaDir, { recursive: true });
-      fs11.writeFileSync(paths.headroomCaCertFile, ca.certPem, "utf8");
-      fs11.writeFileSync(paths.headroomCaKeyFile, ca.keyPem, { encoding: "utf8", mode: CA_KEY_FILE_MODE });
-      fs11.chmodSync(paths.headroomCaKeyFile, CA_KEY_FILE_MODE);
+      fs12.mkdirSync(paths.headroomCaDir, { recursive: true });
+      fs12.writeFileSync(paths.headroomCaCertFile, ca.certPem, "utf8");
+      fs12.writeFileSync(paths.headroomCaKeyFile, ca.keyPem, { encoding: "utf8", mode: CA_KEY_FILE_MODE });
+      fs12.chmodSync(paths.headroomCaKeyFile, CA_KEY_FILE_MODE);
+    }
+  };
+}
+
+// src/headroom/supervisor.ts
+function resolveSupervisorConfig(configured) {
+  return {
+    source: configured.source ?? HEADROOM_DEFAULT_SOURCE,
+    idleShutdownMinutes: configured.idleShutdownMinutes ?? HEADROOM_DEFAULT_IDLE_SHUTDOWN_MINUTES
+  };
+}
+var HEADROOM_BACKOFF_BASE_MS = 500;
+var HEADROOM_BACKOFF_CAP_MS = 3e4;
+var HEADROOM_START_RETRY_BUDGET = 5;
+var HEADROOM_READY_TIMEOUT_MS = 15e3;
+var HEADROOM_POLL_MS = 1e3;
+var MS_PER_MINUTE2 = 6e4;
+var STOP_POLL_MS = 100;
+var TERM_GRACE_MS = 1500;
+var KILL_GRACE_MS = 1500;
+function stopSupervisedProcess(pid, primitives) {
+  const send = (signal) => {
+    try {
+      primitives.signal(pid, signal);
+    } catch {
+    }
+  };
+  send("SIGTERM");
+  if (awaitExit(pid, primitives, TERM_GRACE_MS)) {
+    return "exited-on-term";
+  }
+  send("SIGKILL");
+  if (awaitExit(pid, primitives, KILL_GRACE_MS)) {
+    return "killed";
+  }
+  return "still-running";
+}
+function awaitExit(pid, primitives, budgetMs) {
+  const deadline = primitives.now() + budgetMs;
+  while (primitives.isRunning(pid)) {
+    if (primitives.now() >= deadline) {
+      return false;
+    }
+    primitives.waitMs(STOP_POLL_MS);
+  }
+  return true;
+}
+function backoffForAttempt(attempt) {
+  return Math.min(HEADROOM_BACKOFF_CAP_MS, HEADROOM_BACKOFF_BASE_MS * 2 ** (attempt - 1));
+}
+function versionSatisfies(version2, source) {
+  if (version2 === void 0) {
+    return false;
+  }
+  const specifier = /==|>=|<=|!=|>|<|~=/.exec(source);
+  if (specifier === null) {
+    return true;
+  }
+  const installed = parseVersion(version2);
+  const wanted = parseVersion(source.slice(specifier.index + specifier[0].length));
+  if (installed === void 0 || wanted === void 0) {
+    return true;
+  }
+  const cmp = compareVersions2(installed, wanted);
+  switch (specifier[0]) {
+    case "==":
+      return cmp === 0;
+    case "!=":
+      return cmp !== 0;
+    case ">=":
+      return cmp >= 0;
+    case "<=":
+      return cmp <= 0;
+    case ">":
+      return cmp > 0;
+    case "<":
+      return cmp < 0;
+    case "~=":
+      return compareVersions2(installed.slice(0, Math.max(0, wanted.length - 1)), wanted.slice(0, Math.max(0, wanted.length - 1))) === 0 && cmp >= 0;
+    default:
+      return true;
+  }
+}
+function parseVersion(input2) {
+  const match = /(\d+)(\.\d+)*/.exec(input2);
+  if (match === null) {
+    return void 0;
+  }
+  return match[0].split(".").map((part) => Number.parseInt(part, 10));
+}
+function compareVersions2(a2, b) {
+  for (let index = 0; index < Math.max(a2.length, b.length); index += 1) {
+    const left = a2[index] ?? 0;
+    const right = b[index] ?? 0;
+    if (left !== right) {
+      return left - right;
+    }
+  }
+  return 0;
+}
+var HEADROOM_SUPERVISOR_STILL_RUNNING = -1;
+async function runSupervisor(config2, ports, options = {}) {
+  const { fs: fs14, paths } = ports;
+  const previousState = readHeadroomState(fs14, paths.headroomStateFile);
+  let installedSource = previousState?.installedSource;
+  let lastPort = previousState?.lastPort;
+  let lastMitmPort = previousState?.lastMitmPort;
+  let daemonPort;
+  const sticky = () => ({
+    ...lastPort === void 0 ? {} : { lastPort },
+    ...lastMitmPort === void 0 ? {} : { lastMitmPort }
+  });
+  let mitm;
+  const fail = (message) => {
+    writeHeadroomState(fs14, paths.headroomStateFile, {
+      lastError: message,
+      ...sticky()
+    });
+    fs14.removeRecursive(paths.headroomLockFile);
+    ports.log(`claude-use headroom supervisor: ${message}`);
+    return 1;
+  };
+  const ensureInstalled = () => {
+    const version3 = ports.headroomVersion();
+    const versionOk = version3 !== void 0 && versionSatisfies(version3, config2.source);
+    if (versionOk && (installedSource === void 0 || installedSource === config2.source)) {
+      installedSource = config2.source;
+      return true;
     }
+    ports.log(`claude-use headroom supervisor: installing headroom from ${config2.source}`);
+    const result = ports.install(config2.source);
+    if (!result.ok) {
+      return false;
+    }
+    installedSource = config2.source;
+    return true;
   };
+  if (!ensureInstalled()) {
+    return fail(`could not install headroom from ${config2.source}: install failed (is uv installed and on PATH?)`);
+  }
+  const version2 = ports.headroomVersion() ?? "unknown";
+  try {
+    mitm = await ports.startMitm(lastMitmPort, () => daemonPort);
+  } catch (error62) {
+    return fail(`could not start the MITM proxy: ${error62 instanceof Error ? error62.message : String(error62)}`);
+  }
+  lastMitmPort = mitm.port;
+  if (previousState?.lastMitmPort !== void 0 && mitm.port !== previousState.lastMitmPort) {
+    ports.log(
+      `claude-use headroom supervisor: sticky MITM port ${String(previousState.lastMitmPort)} was occupied; moving to ${String(mitm.port)} (OAuth sessions launched against the old port are stale until they relaunch)`
+    );
+  }
+  writeHeadroomState(fs14, paths.headroomStateFile, { supervisorPid: ports.ownPid, version: version2, installedSource, mitmPort: mitm.port, ...sticky() });
+  ports.log(`claude-use headroom supervisor ${String(ports.ownPid)}: managing headroom on allowlist [${allowlistOf(ports).join(", ")}]`);
+  const orphanPid = previousState?.headroomPid;
+  if (orphanPid !== void 0 && ports.isRunning(orphanPid)) {
+    ports.log(`claude-use headroom supervisor: stopping daemon pid ${String(orphanPid)} left behind by the previous supervisor`);
+    ports.stopProcess(orphanPid);
+  }
+  let headroomPid;
+  let runningHash;
+  let consecutiveFailures = 0;
+  let idleSince;
+  let ticks = 0;
+  for (; ; ) {
+    if (options.tickLimit !== void 0 && ticks >= options.tickLimit) {
+      return HEADROOM_SUPERVISOR_STILL_RUNNING;
+    }
+    ticks += 1;
+    const allowlist = allowlistOf(ports);
+    const allowlistHash = hashAllowlist(allowlist);
+    pruneDeadSessions(fs14, paths.headroomSessionsDir, ports.isRunning);
+    const crashed = headroomPid !== void 0 && !ports.isRunning(headroomPid);
+    if (headroomPid === void 0 || crashed) {
+      if (crashed) {
+        ports.log(`claude-use headroom supervisor: headroom pid ${String(headroomPid)} died`);
+        headroomPid = void 0;
+        daemonPort = void 0;
+        runningHash = void 0;
+        writeHeadroomState(fs14, paths.headroomStateFile, {
+          supervisorPid: ports.ownPid,
+          version: version2,
+          installedSource,
+          mitmPort: mitm.port,
+          ...sticky()
+        });
+      }
+      if (consecutiveFailures >= HEADROOM_START_RETRY_BUDGET) {
+        return fail(`headroom failed to become ready ${String(consecutiveFailures)} times in a row; giving up`);
+      }
+      if (installedSource !== config2.source && !ensureInstalled()) {
+        return fail(`could not install headroom from ${config2.source}: install failed (is uv installed and on PATH?)`);
+      }
+      const previousSticky = lastPort;
+      const port = lastPort !== void 0 && await ports.isPortFree(lastPort) ? lastPort : await ports.freePort();
+      const pid = ports.spawnHeadroom(port, allowlist);
+      const ready = await waitUntilReady(ports, port);
+      if (ready) {
+        consecutiveFailures = 0;
+        headroomPid = pid;
+        daemonPort = port;
+        runningHash = allowlistHash;
+        lastPort = port;
+        if (previousSticky !== void 0 && port !== previousSticky) {
+          ports.log(
+            `claude-use headroom supervisor: sticky port ${String(previousSticky)} was occupied; moving to ${String(port)} (sessions launched against the old port are stale until they relaunch)`
+          );
+        }
+        writeHeadroomState(fs14, paths.headroomStateFile, {
+          supervisorPid: ports.ownPid,
+          headroomPid: pid,
+          port,
+          mitmPort: mitm.port,
+          version: version2,
+          allowlistHash,
+          installedSource: config2.source,
+          ...sticky()
+        });
+        fs14.removeRecursive(paths.headroomLockFile);
+        idleSince = void 0;
+        ports.log(`claude-use headroom supervisor: headroom pid ${String(pid)} ready on 127.0.0.1:${String(port)}`);
+      } else {
+        ports.stopProcess(pid);
+        consecutiveFailures += 1;
+        ports.log(
+          `claude-use headroom supervisor: headroom did not become ready on port ${String(port)} (attempt ${String(consecutiveFailures)} of ${String(HEADROOM_START_RETRY_BUDGET)})`
+        );
+        await ports.sleep(backoffForAttempt(consecutiveFailures));
+        continue;
+      }
+    } else {
+      if (runningHash !== allowlistHash || installedSource !== config2.source) {
+        if (listSessions(fs14, paths.headroomSessionsDir).length === 0) {
+          ports.log("claude-use headroom supervisor: configuration drifted and no sessions are live; restarting headroom");
+          ports.stopProcess(headroomPid);
+          headroomPid = void 0;
+          daemonPort = void 0;
+          runningHash = void 0;
+          continue;
+        }
+      }
+      const sessions = listSessions(fs14, paths.headroomSessionsDir);
+      if (sessions.length === 0) {
+        idleSince ??= ports.now();
+        const idleMs = ports.now() - idleSince;
+        if (idleMs >= config2.idleShutdownMinutes * MS_PER_MINUTE2) {
+          ports.log(
+            `claude-use headroom supervisor: no sessions for ${String(config2.idleShutdownMinutes)} minute(s); stopping headroom and the MITM proxy, and exiting`
+          );
+          ports.stopProcess(headroomPid);
+          daemonPort = void 0;
+          await mitm.close();
+          writeHeadroomState(fs14, paths.headroomStateFile, {
+            version: version2,
+            ...sticky()
+          });
+          return 0;
+        }
+      } else {
+        idleSince = void 0;
+      }
+    }
+    await ports.sleep(HEADROOM_POLL_MS);
+  }
+}
+function currentHeadroomAllowlist(fs14, paths) {
+  const providers = readAllProviders(fs14, paths.providersDir).map((entry) => entry.provider);
+  return headroomAllowlist(headroomUpstreams(providers, frontDoorOrigin(readFrontDoorState(fs14, paths.frontdoorStateFile))));
+}
+function allowlistOf(ports) {
+  return currentHeadroomAllowlist(ports.fs, ports.paths);
+}
+async function waitUntilReady(ports, port) {
+  const deadline = ports.now() + HEADROOM_READY_TIMEOUT_MS;
+  for (; ; ) {
+    if (await ports.ready(port)) {
+      return true;
+    }
+    if (ports.now() >= deadline) {
+      return false;
+    }
+    await ports.sleep(HEADROOM_POLL_MS);
+  }
 }
 
 // src/headroom/commands.ts
@@ -295077,9 +295259,9 @@ function formatHeadroomStatus(status) {
   lines.push(`daemon log: ${status.logPath}${status.logExists ? "" : " (not created yet)"}`);
   return lines;
 }
-async function realFreePort2() {
+async function realFreePort() {
   return await new Promise((resolve, reject) => {
-    const server2 = import_node_net3.default.createServer();
+    const server2 = import_node_net2.default.createServer();
     server2.unref();
     server2.on("error", reject);
     server2.listen(0, "127.0.0.1", () => {
@@ -295097,7 +295279,7 @@ async function realFreePort2() {
 }
 var ownedHeadroom = /* @__PURE__ */ new Map();
 var exitedHeadroom = /* @__PURE__ */ new Set();
-var READY_FETCH_TIMEOUT_MS2 = 2e3;
+var READY_FETCH_TIMEOUT_MS = 2e3;
 function headroomPidRunning(pid) {
   return !exitedHeadroom.has(pid) && realIsProcessRunning(pid);
 }
@@ -295121,13 +295303,13 @@ function realSupervisorPorts(paths) {
       });
     },
     isRunning: headroomPidRunning,
-    freePort: realFreePort2,
+    freePort: realFreePort,
     isPortFree: realIsPortFree,
     spawnHeadroom: (port, allowlist) => {
-      import_node_fs11.default.mkdirSync(paths.logsDir, { recursive: true });
-      const logFd = import_node_fs11.default.openSync(paths.headroomLogPath, "a");
+      import_node_fs12.default.mkdirSync(paths.logsDir, { recursive: true });
+      const logFd = import_node_fs12.default.openSync(paths.headroomLogPath, "a");
       try {
-        const child = (0, import_node_child_process4.spawn)("headroom", ["proxy", "--host", "127.0.0.1", "--port", String(port)], {
+        const child = (0, import_node_child_process3.spawn)("headroom", ["proxy", "--host", "127.0.0.1", "--port", String(port)], {
           detached: true,
           stdio: ["ignore", logFd, logFd],
           env: headroomSpawnEnv(process.env, allowlist)
@@ -295140,12 +295322,12 @@ function realSupervisorPorts(paths) {
         child.once("exit", (code, signal) => {
           ownedHeadroom.delete(pid);
           exitedHeadroom.add(pid);
-          import_node_fs11.default.appendFileSync(paths.headroomLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} claude-use headroom supervisor: headroom exited (${signal ?? `code ${String(code)}`})
+          import_node_fs12.default.appendFileSync(paths.headroomLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} claude-use headroom supervisor: headroom exited (${signal ?? `code ${String(code)}`})
 `);
         });
         return pid;
       } finally {
-        import_node_fs11.default.closeSync(logFd);
+        import_node_fs12.default.closeSync(logFd);
       }
     },
     stopProcess: (pid) => {
@@ -295158,7 +295340,7 @@ function realSupervisorPorts(paths) {
         now: () => Date.now()
       });
       if (outcome === "still-running") {
-        import_node_fs11.default.appendFileSync(
+        import_node_fs12.default.appendFileSync(
           paths.headroomLogPath,
           `${(/* @__PURE__ */ new Date()).toISOString()} claude-use headroom supervisor: pid ${String(pid)} survived SIGKILL within its grace; it is stuck uninterruptibly
 `
@@ -295167,27 +295349,27 @@ function realSupervisorPorts(paths) {
     },
     ready: async (port) => {
       try {
-        const response = await fetch(`http://127.0.0.1:${String(port)}/readyz`, { signal: AbortSignal.timeout(READY_FETCH_TIMEOUT_MS2) });
+        const response = await fetch(`http://127.0.0.1:${String(port)}/readyz`, { signal: AbortSignal.timeout(READY_FETCH_TIMEOUT_MS) });
         return response.ok;
       } catch {
         return false;
       }
     },
     install: (spec) => {
-      const result = (0, import_node_child_process4.spawnSync)("uv", ["tool", "install", spec], { encoding: "utf8" });
+      const result = (0, import_node_child_process3.spawnSync)("uv", ["tool", "install", spec], { encoding: "utf8" });
       if (result.error !== void 0) {
         return { ok: false, error: `uv is not installed or not on PATH (${result.error.message})` };
       }
       if (result.stdout !== "") {
-        import_node_fs11.default.appendFileSync(paths.headroomLogPath, result.stdout);
+        import_node_fs12.default.appendFileSync(paths.headroomLogPath, result.stdout);
       }
       if (result.stderr !== "") {
-        import_node_fs11.default.appendFileSync(paths.headroomLogPath, result.stderr);
+        import_node_fs12.default.appendFileSync(paths.headroomLogPath, result.stderr);
       }
       return result.status === 0 ? { ok: true } : { ok: false, error: `uv tool install exited ${String(result.status)}` };
     },
     headroomVersion: () => {
-      const result = (0, import_node_child_process4.spawnSync)("headroom", ["--version"], { encoding: "utf8" });
+      const result = (0, import_node_child_process3.spawnSync)("headroom", ["--version"], { encoding: "utf8" });
       return result.status === 0 ? result.stdout.trim() : void 0;
     },
     startMitm: async (preferredPort, headroomPort) => {
@@ -295205,8 +295387,8 @@ function realSupervisorPorts(paths) {
       );
     },
     log: (line) => {
-      import_node_fs11.default.mkdirSync(paths.logsDir, { recursive: true });
-      import_node_fs11.default.appendFileSync(paths.headroomLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+      import_node_fs12.default.mkdirSync(paths.logsDir, { recursive: true });
+      import_node_fs12.default.appendFileSync(paths.headroomLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
 `);
     }
   };
@@ -295305,6 +295487,7 @@ function buildProgram(deps) {
   registerShimCommand(program2, deps);
   registerHeadroomCommand(program2, deps);
   registerCodexCommand(program2, deps);
+  registerFrontDoorCommand(program2, deps);
   registerRunCommand(program2, deps.runClaude);
   registerCompletionCommand(program2);
   return program2;
@@ -295542,7 +295725,7 @@ function resolveIdentityCredential(identity, credential, env, port) {
   return resolution.ok ? resolution : { ok: false, status: CREDENTIAL_UNAVAILABLE_EXIT, message: resolution.message };
 }
 function runLauncher(params) {
-  const { paths, fs: fs13, spawn: spawn4, proc, log } = params;
+  const { paths, fs: fs14, spawn: spawn3, proc, log } = params;
   const { env, argv } = proc;
   const parsedArgv = parseLauncherArgv(argv);
   const cliOverride = buildCliOverride({
@@ -295557,7 +295740,7 @@ function runLauncher(params) {
     argv0Identity: parsedArgv.identity,
     directoryPinnedIdentity: params.directoryPinnedIdentity,
     readActiveIdentityFile: () => {
-      const raw = fs13.readFileUtf8(paths.activeIdentityFile);
+      const raw = fs14.readFileUtf8(paths.activeIdentityFile);
       if (raw === void 0) {
         return void 0;
       }
@@ -295591,7 +295774,7 @@ function runLauncher(params) {
   }
   let loadedIdentity;
   if (identityDecision.name !== void 0) {
-    loadedIdentity = loadIdentity(paths.identitiesDir, identityDecision.name, fs13);
+    loadedIdentity = loadIdentity(paths.identitiesDir, identityDecision.name, fs14);
     if (loadedIdentity === void 0) {
       log.error(
         `claude-use: no identity named "${identityDecision.name}" (selected via ${identityDecision.source}). Run \`claude-use identity add ${identityDecision.name}\` first.`
@@ -295606,7 +295789,7 @@ function runLauncher(params) {
     identityDefaultConfigProfile: loadedIdentity?.config.defaultConfigProfile,
     globalDefaultConfigProfile: params.globalDefaultConfigProfile
   });
-  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs13.readConfigFile(import_node_path26.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
+  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs14.readConfigFile(import_node_path26.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
     log.error(
       `claude-use: no configuration profile named "${configProfileDecision.name}" (selected via ${configProfileDecision.source}). Run \`claude-use profile add ${configProfileDecision.name}\` first.`
     );
@@ -295615,7 +295798,7 @@ function runLauncher(params) {
   const farmContext = farm !== void 0 && farmIdentity !== void 0 ? { farm, identity: farmIdentity, cascade: farm.loadCascade(configProfileDecision.name, cliOverride) } : void 0;
   const provider = parsedArgv.provider === false ? void 0 : resolveProvider({
     paths,
-    port: fs13,
+    port: fs14,
     env,
     ...params.credentials === void 0 ? {} : { credentials: params.credentials },
     ...parsedArgv.provider === void 0 ? {} : { cliProvider: parsedArgv.provider },
@@ -295708,20 +295891,20 @@ function runLauncher(params) {
     }
   });
   let routedProvider;
-  const codexPort = params.codex;
+  const frontDoorPort = params.frontdoor;
   if (resolvedProvider !== void 0 && isCodexProvider(resolvedProvider.definition)) {
-    if (codexPort === void 0) {
-      log.error(`claude-use: provider ${resolvedProvider.name} is a codex provider, but this launcher has no codex daemon port wired; refusing to launch without it.`);
+    if (frontDoorPort === void 0) {
+      log.error(`claude-use: provider ${resolvedProvider.name} is a codex provider, but this launcher has no front-door daemon port wired; refusing to launch without it.`);
       proc.exit(1);
     } else {
-      const codex = codexPort.ensure();
-      routedProvider = { ...resolvedProvider, baseUrl: codexProviderBaseUrl(codex.port, resolvedProvider.name) };
-      log.info(`claude-use: provider ${resolvedProvider.name} served by the codex daemon on 127.0.0.1:${String(codex.port)}`);
+      const frontDoor = frontDoorPort.ensure();
+      routedProvider = { ...resolvedProvider, baseUrl: providerBaseUrl(frontDoor.port, resolvedProvider.name) };
+      log.info(`claude-use: provider ${resolvedProvider.name} served by the front door on 127.0.0.1:${String(frontDoor.port)}`);
     }
   } else if (resolvedProvider !== void 0 && !isCodexProvider(resolvedProvider.definition)) {
     routedProvider = { ...resolvedProvider, baseUrl: resolvedProvider.definition.baseUrl };
   }
-  const codexRelease = routedProvider !== void 0 && isCodexProvider(routedProvider.definition) ? codexPort?.release : void 0;
+  const frontDoorRelease = routedProvider !== void 0 && isCodexProvider(routedProvider.definition) ? frontDoorPort?.release : void 0;
   let headroom;
   const headroomPort = params.headroom;
   if (resolvedFlags.headroom && headroomPort !== void 0) {
@@ -295746,9 +295929,9 @@ function runLauncher(params) {
     ...identityCredential === void 0 ? {} : { identityCredential },
     ...headroom === void 0 ? {} : { headroom }
   });
-  const releases = [...headroom === void 0 || headroomPort === void 0 ? [] : [headroomPort.release], ...codexRelease === void 0 ? [] : [codexRelease]];
+  const releases = [...headroom === void 0 || headroomPort === void 0 ? [] : [headroomPort.release], ...frontDoorRelease === void 0 ? [] : [frontDoorRelease]];
   if (releases.length === 0) {
-    spawnClaude({ bin: discovered.path, args: finalArgv, env: finalEnv, spawn: spawn4, proc });
+    spawnClaude({ bin: discovered.path, args: finalArgv, env: finalEnv, spawn: spawn3, proc });
   }
   const releaseAll = () => {
     for (const release of releases) {
@@ -295760,7 +295943,7 @@ function runLauncher(params) {
       bin: discovered.path,
       args: finalArgv,
       env: finalEnv,
-      spawn: spawn4,
+      spawn: spawn3,
       proc,
       beforeExit: releaseAll
     });
@@ -295865,7 +296048,7 @@ async function runClaude(argvOverride) {
     resolveClaudeBinary: realResolveClaudeBinary(resolveOwnInstallDirs(paths, realOwnExecutablePath())),
     farm: farm.runtime,
     headroom: realHeadroomPort(paths),
-    codex: realCodexPort(paths),
+    frontdoor: realFrontDoorPort(paths),
     credentials: realCredentialPort,
     ...farm.directoryIdentity === void 0 ? {} : { directoryPinnedIdentity: farm.directoryIdentity },
     ...farm.directoryConfigProfile === void 0 ? {} : { directoryRuleConfigProfile: farm.directoryConfigProfile },