claude-use 7.12.1 → 7.13.1

package/dist/cli.cjs

@@ -55406,16 +55406,16 @@ function parseJson(raw, schema) {
   const parsed = schema.safeParse(JSON.parse(raw));
   return parsed.success ? parsed.data : void 0;
 }
-function readHeadroomState(fs18, stateFile) {
+function readHeadroomState(fs19, stateFile) {
   try {
-    return parseJson(fs18.readFileUtf8(stateFile), HeadroomStateSchema);
+    return parseJson(fs19.readFileUtf8(stateFile), HeadroomStateSchema);
   } catch {
     return void 0;
   }
 }
-function writeHeadroomState(fs18, stateFile, state) {
-  fs18.mkdirp(import_node_path5.default.dirname(stateFile));
-  fs18.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
+function writeHeadroomState(fs19, stateFile, state) {
+  fs19.mkdirp(import_node_path5.default.dirname(stateFile));
+  fs19.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
 `);
 }
 function headroomAllowlist(providers) {
@@ -55435,14 +55435,14 @@ function headroomUpstreams(providers, frontDoorOrigin2) {
 function hashAllowlist(allowlist) {
   return (0, import_node_crypto2.createHash)("sha256").update(allowlist.join("\n")).digest("hex");
 }
-function readAllProviders(fs18, providersDir) {
+function readAllProviders(fs19, providersDir) {
   const result = [];
-  for (const name of fs18.readdir(providersDir)) {
+  for (const name of fs19.readdir(providersDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = parseJson(fs18.readFileUtf8(import_node_path5.default.join(providersDir, name)), ProviderSchema);
+      const parsed = parseJson(fs19.readFileUtf8(import_node_path5.default.join(providersDir, name)), ProviderSchema);
       if (parsed !== void 0) {
         result.push({ name: name.slice(0, -".json".length), provider: parsed });
       }
@@ -55452,22 +55452,22 @@ function readAllProviders(fs18, providersDir) {
   }
   return result;
 }
-function writeSession(fs18, sessionsDir, session) {
-  fs18.mkdirp(sessionsDir);
-  fs18.writeFileUtf8(import_node_path5.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
+function writeSession(fs19, sessionsDir, session) {
+  fs19.mkdirp(sessionsDir);
+  fs19.writeFileUtf8(import_node_path5.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
 `);
 }
-function removeSession(fs18, sessionsDir, pid) {
-  fs18.removeRecursive(import_node_path5.default.join(sessionsDir, `${String(pid)}.json`));
+function removeSession(fs19, sessionsDir, pid) {
+  fs19.removeRecursive(import_node_path5.default.join(sessionsDir, `${String(pid)}.json`));
 }
-function listSessions(fs18, sessionsDir) {
+function listSessions(fs19, sessionsDir) {
   const sessions = [];
-  for (const name of fs18.readdir(sessionsDir)) {
+  for (const name of fs19.readdir(sessionsDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = parseJson(fs18.readFileUtf8(import_node_path5.default.join(sessionsDir, name)), HeadroomSessionSchema);
+      const parsed = parseJson(fs19.readFileUtf8(import_node_path5.default.join(sessionsDir, name)), HeadroomSessionSchema);
       if (parsed !== void 0) {
         sessions.push(parsed);
       }
@@ -55477,22 +55477,22 @@ function listSessions(fs18, sessionsDir) {
   }
   return sessions.sort((a2, b) => a2.pid - b.pid);
 }
-function sessionsForSupervisor(fs18, sessionsDir, supervisorPid) {
-  return listSessions(fs18, sessionsDir).filter((session) => session.supervisorPid === supervisorPid);
+function sessionsForSupervisor(fs19, sessionsDir, supervisorPid) {
+  return listSessions(fs19, sessionsDir).filter((session) => session.supervisorPid === supervisorPid);
 }
-function pruneDeadSessions(fs18, sessionsDir, isRunning) {
+function pruneDeadSessions(fs19, sessionsDir, isRunning) {
   const removed = [];
-  for (const session of listSessions(fs18, sessionsDir)) {
+  for (const session of listSessions(fs19, sessionsDir)) {
     if (!isRunning(session.pid)) {
-      removeSession(fs18, sessionsDir, session.pid);
+      removeSession(fs19, sessionsDir, session.pid);
       removed.push(session.pid);
     }
   }
   return removed;
 }
-function readStartLock(fs18, lockFile) {
+function readStartLock(fs19, lockFile) {
   try {
-    return parseJson(fs18.readFileUtf8(lockFile), HeadroomLockSchema);
+    return parseJson(fs19.readFileUtf8(lockFile), HeadroomLockSchema);
   } catch {
     return void 0;
   }
@@ -55783,10 +55783,12 @@ function detachedDaemonSpawnOptions(logFd, env) {
   return { detached: true, stdio: ["ignore", logFd, logFd], env };
 }
 function spawnDetachedSupervisor(paths, subcommand, logPath) {
+  return spawnDetachedDaemon(selfInvocation([subcommand]), paths, subcommand, logPath);
+}
+function spawnDetachedDaemon(invocation, paths, subcommand, logPath) {
   import_node_fs3.default.mkdirSync(import_node_path6.default.dirname(logPath), { recursive: true });
   const logFd = import_node_fs3.default.openSync(logPath, "a");
   try {
-    const invocation = selfInvocation([subcommand]);
     const child = (0, import_node_child_process2.spawn)(invocation.command, invocation.args, detachedDaemonSpawnOptions(logFd, { ...process.env, AGENT_SHIM_HOME: paths.root }));
     child.unref();
     if (child.pid === void 0) {
@@ -55797,8 +55799,8 @@ function spawnDetachedSupervisor(paths, subcommand, logPath) {
     import_node_fs3.default.closeSync(logFd);
   }
 }
-function spawnHeadroomSupervisor(paths) {
-  return spawnDetachedSupervisor(paths, "__headroom-supervisor", paths.headroomLogPath);
+function spawnHeadroomSupervisor(paths, spawnDaemon) {
+  return spawnDaemon(paths, "__headroom-supervisor", paths.headroomLogPath);
 }
 async function realIsPortFree(port) {
   return await new Promise((resolve) => {
@@ -55815,7 +55817,7 @@ async function realIsPortFree(port) {
     });
   });
 }
-function realHeadroomPort(paths) {
+function realHeadroomPort(paths, options) {
   return {
     ensure: () => {
       const up = ensureHeadroom({
@@ -55827,12 +55829,12 @@ function realHeadroomPort(paths) {
           isRunning: realIsProcessRunning,
           now: () => Date.now(),
           sleep: realSleepSync,
-          spawnSupervisor: spawnHeadroomSupervisor
+          spawnSupervisor: (layout) => spawnHeadroomSupervisor(layout, options.spawnDaemon)
         }
       });
       return {
         port: up.port,
-        projectId: resolveGitRoot(realRunPort, process.cwd()) ?? process.cwd()
+        projectId: resolveGitRoot(realRunPort, options.cwd) ?? options.cwd
       };
     },
     release: () => {
@@ -57521,8 +57523,8 @@ function decideConfigProfile(params) {
   }
   return { source: "none" };
 }
-function loadIdentity(identitiesDir, name, fs18) {
-  return loadConfigFile(import_node_path8.default.join(identitiesDir, name, "identity.json"), IdentitySchema, fs18.readConfigFile);
+function loadIdentity(identitiesDir, name, fs19) {
+  return loadConfigFile(import_node_path8.default.join(identitiesDir, name, "identity.json"), IdentitySchema, fs19.readConfigFile);
 }
 
 // src/configProfilesStore.ts
@@ -59063,6 +59065,43 @@ function planFarm(params) {
   return { entries, materialised, links };
 }
 
+// src/resolve/walkPolicy.ts
+var ENTER_EVERYTHING = () => true;
+function readsSubtreeAggregates(rule) {
+  const when = rule.when;
+  return when !== void 0 && (when.newerThan !== void 0 || when.olderThan !== void 0 || when.maxSizeBytes !== void 0);
+}
+function hasUnboundedDepth(pattern) {
+  return pattern.includes("**") || /[{(]/.test(pattern);
+}
+function couldMatchBeneath(rule, dirRel) {
+  if (rule.matches(dirRel)) {
+    return rule.when !== void 0;
+  }
+  if (rule.isExact) {
+    return rule.canonicalPattern.startsWith(`${dirRel}/`);
+  }
+  const depth = dirRel.split("/").length;
+  if (!hasUnboundedDepth(rule.canonicalPattern) && rule.segmentCount <= depth) {
+    return false;
+  }
+  const prefix = rule.literalPrefix;
+  return prefix === "" || prefix.startsWith(`${dirRel}/`) || dirRel.startsWith(prefix);
+}
+function descendPolicy(rules) {
+  const all = [...rules];
+  if (all.some(readsSubtreeAggregates)) {
+    return ENTER_EVERYTHING;
+  }
+  return (dirRel) => all.some((rule) => couldMatchBeneath(rule, dirRel));
+}
+function enterRulesAnd(policy, target) {
+  if (target === void 0 || target === "") {
+    return policy;
+  }
+  return (dirRel) => dirRel === target || target.startsWith(`${dirRel}/`) || policy(dirRel);
+}
+
 // src/resolve/pipeline.ts
 function topLevelNames(facts) {
   const names = /* @__PURE__ */ new Set();
@@ -59074,6 +59113,9 @@ function topLevelNames(facts) {
   }
   return [...names].sort();
 }
+function descendPolicyFor(cascade, home) {
+  return descendPolicy(flattenLayers(assembleCascade(cascade).layers, { home }).rules.values());
+}
 function resolveDecisions(input2) {
   const assembled = assembleCascade(input2.cascade);
   const flattened = flattenLayers(assembled.layers, { home: input2.facts.home });
@@ -59109,8 +59151,8 @@ var FarmManifestSchema = external_exports.strictObject({
   materialised: external_exports.array(external_exports.string()),
   links: external_exports.array(external_exports.strictObject({ rel: external_exports.string(), target: external_exports.string() }))
 });
-function readFarmManifest(fs18, farmRoot) {
-  const raw = fs18.readFileUtf8(import_node_path16.default.join(farmRoot, FARM_MANIFEST_FILENAME)) ?? fs18.readFileUtf8(import_node_path16.default.join(farmRoot, LEGACY_FARM_MANIFEST_FILENAME));
+function readFarmManifest(fs19, farmRoot) {
+  const raw = fs19.readFileUtf8(import_node_path16.default.join(farmRoot, FARM_MANIFEST_FILENAME)) ?? fs19.readFileUtf8(import_node_path16.default.join(farmRoot, LEGACY_FARM_MANIFEST_FILENAME));
   if (raw === void 0) {
     return void 0;
   }
@@ -59134,7 +59176,7 @@ function buildEntryFacts(params) {
     const isDirectory = stat.kind === "dir";
     let latestMtimeMs = stat.mtimeMs;
     let totalSizeBytes = stat.sizeBytes;
-    if (isDirectory) {
+    if (isDirectory && params.descend(rel)) {
       for (const name of [...params.fs.readdir(absolute)].sort()) {
         const child = visit2(`${rel}/${name}`);
         if (child !== void 0) {
@@ -59168,9 +59210,9 @@ function buildEntryFacts(params) {
     entries
   };
 }
-function listSubtree(fs18, root, rel) {
+function listSubtree(fs19, root, rel) {
   const absolute = import_node_path16.default.join(root, rel);
-  const stat = fs18.lstat(absolute);
+  const stat = fs19.lstat(absolute);
   if (stat === void 0) {
     return [];
   }
@@ -59178,10 +59220,10 @@ function listSubtree(fs18, root, rel) {
     return [{ rel, kind: "symlink" }];
   }
   if (stat.kind === "dir") {
-    const children = [...fs18.readdir(absolute)].sort().flatMap((name) => listSubtree(fs18, root, `${rel}/${name}`));
+    const children = [...fs19.readdir(absolute)].sort().flatMap((name) => listSubtree(fs19, root, `${rel}/${name}`));
     return [{ rel, kind: "dir" }, ...children];
   }
-  const contentHash = fs18.hashFile(absolute);
+  const contentHash = fs19.hashFile(absolute);
   return [{ rel, kind: "file", ...contentHash === void 0 ? {} : { contentHash } }];
 }
 function topLevelScopeRoots(roots) {
@@ -59195,25 +59237,25 @@ function topLevelScopeRoots(roots) {
   }
   return kept;
 }
-function reconciliationScope(fs18, farmRoot, manifest) {
+function reconciliationScope(fs19, farmRoot, manifest) {
   if (manifest !== void 0) {
     return topLevelScopeRoots(manifest.materialised);
   }
-  return [...fs18.readdir(farmRoot)].filter((name) => name !== FARM_MANIFEST_FILENAME && name !== LEGACY_FARM_MANIFEST_FILENAME && fs18.lstat(import_node_path16.default.join(farmRoot, name))?.kind === "dir").sort();
+  return [...fs19.readdir(farmRoot)].filter((name) => name !== FARM_MANIFEST_FILENAME && name !== LEGACY_FARM_MANIFEST_FILENAME && fs19.lstat(import_node_path16.default.join(farmRoot, name))?.kind === "dir").sort();
 }
-function collectFarmListing(fs18, farmRoot, scopeRoots) {
-  return scopeRoots.flatMap((root) => listSubtree(fs18, farmRoot, root));
+function collectFarmListing(fs19, farmRoot, scopeRoots) {
+  return scopeRoots.flatMap((root) => listSubtree(fs19, farmRoot, root));
 }
-function collectCanonicalCounterparts(fs18, claudeHome, farmListing) {
+function collectCanonicalCounterparts(fs19, claudeHome, farmListing) {
   const out = [];
   for (const entry of farmListing) {
     const absolute = import_node_path16.default.join(claudeHome, entry.rel);
-    const stat = fs18.lstat(absolute);
+    const stat = fs19.lstat(absolute);
     if (stat === void 0) {
       continue;
     }
     if (stat.kind === "file") {
-      const contentHash = fs18.hashFile(absolute);
+      const contentHash = fs19.hashFile(absolute);
       out.push({ rel: entry.rel, kind: "file", ...contentHash === void 0 ? {} : { contentHash } });
       continue;
     }
@@ -59481,7 +59523,8 @@ function resyncFarm(params) {
       nowMs,
       env: params.env,
       ...params.branch === void 0 ? {} : { branch: params.branch },
-      ...params.branchDetached === void 0 ? {} : { branchDetached: params.branchDetached }
+      ...params.branchDetached === void 0 ? {} : { branchDetached: params.branchDetached },
+      descend: descendPolicyFor(params.cascade, params.home)
     });
     const resolved = resolveDecisions({ facts, cascade: params.cascade, classification: params.classification });
     const manifest = {
@@ -59863,7 +59906,9 @@ function buildConfigureContext(deps, params) {
     nowMs: Date.now(),
     env: process.env,
     ...git.branch === void 0 ? {} : { branch: git.branch },
-    ...git.branchDetached === void 0 ? {} : { branchDetached: git.branchDetached }
+    ...git.branchDetached === void 0 ? {} : { branchDetached: git.branchDetached },
+    // The picker lists the direct children of the path it was asked about, so the walk also enters that path and the directories on the way to it.
+    descend: enterRulesAnd(descendPolicyFor(cascade, params.home), params.path)
   });
   const resolved = resolveDecisions({ facts, cascade, classification });
   const levels = buildWriteTargetLevels(params.cwd, params.home, globalConfig2?.walkUpLimit);
@@ -60455,7 +60500,7 @@ async function resolveFarmConflicts(params) {
   return { resolved, autoResolved, removed, retained };
 }
 
-// src/cli/parsers.ts
+// src/cli/pairs.ts
 function splitCommas(input2) {
   if (input2 === "") {
     return [];
@@ -60489,6 +60534,8 @@ function parseBoolPairList(input2) {
   }
   return result;
 }
+
+// src/cli/parsers.ts
 function asInvalidArgument(parse3) {
   try {
     return parse3();
@@ -60985,7 +61032,7 @@ function registerIdentityCommand(program2, deps) {
 // package.json
 var package_default = {
   name: "claude-use",
-  version: "7.12.1",
+  version: "7.13.1",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -61307,12 +61354,12 @@ function isIdentityName(name) {
 function claudeJsonPath(identitiesDir, identity) {
   return import_node_path21.default.join(identitiesDir, identity, CLAUDE_JSON);
 }
-function readAccountMetadata(fs18, identitiesDir, identity) {
+function readAccountMetadata(fs19, identitiesDir, identity) {
   if (!isIdentityName(identity)) {
     throw new Error(`"${identity}" is not a valid identity name.`);
   }
   const file2 = claudeJsonPath(identitiesDir, identity);
-  const raw = fs18.readFileUtf8(file2);
+  const raw = fs19.readFileUtf8(file2);
   if (raw === void 0) {
     return void 0;
   }
@@ -61342,19 +61389,19 @@ function readAccountMetadata(fs18, identitiesDir, identity) {
   }
   return account.data;
 }
-function createAccountReader(fs18, identitiesDir) {
+function createAccountReader(fs19, identitiesDir) {
   const cache = /* @__PURE__ */ new Map();
   return (identity) => {
     if (!isIdentityName(identity)) {
       throw new Error(`"${identity}" is not a valid identity name.`);
     }
-    const stat = fs18.lstat(claudeJsonPath(identitiesDir, identity));
+    const stat = fs19.lstat(claudeJsonPath(identitiesDir, identity));
     const stamp = stat === void 0 ? "absent" : `${String(stat.mtimeMs)}:${String(stat.sizeBytes)}`;
     const cached2 = cache.get(identity);
     if (cached2?.stamp === stamp) {
       return cached2.account;
     }
-    const account = readAccountMetadata(fs18, identitiesDir, identity);
+    const account = readAccountMetadata(fs19, identitiesDir, identity);
     cache.set(identity, { stamp, account });
     return account;
   };
@@ -62122,8 +62169,8 @@ function segmentDay(epochMs) {
 function segmentName(day, pid) {
   return `${day}.${String(pid)}.jsonl`;
 }
-function listLogSegments(fs18, logDir) {
-  return fs18.readdir(logDir).flatMap((name) => {
+function listLogSegments(fs19, logDir) {
+  return fs19.readdir(logDir).flatMap((name) => {
     const match = SEGMENT_RE.exec(name);
     const day = match?.[1];
     if (day === void 0) {
@@ -62132,15 +62179,15 @@ function listLogSegments(fs18, logDir) {
     return [{ name, day, endsAt: Date.parse(`${day}T00:00:00.000Z`) + DAY_MS }];
   }).sort((left, right) => left.day.localeCompare(right.day) || left.name.localeCompare(right.name));
 }
-function readUsageLog(fs18, logDir, options = {}) {
+function readUsageLog(fs19, logDir, options = {}) {
   const { sinceMs } = options;
   const records = [];
   let invalidLines = 0;
-  for (const segment of listLogSegments(fs18, logDir)) {
+  for (const segment of listLogSegments(fs19, logDir)) {
     if (sinceMs !== void 0 && segment.endsAt <= sinceMs) {
       continue;
     }
-    const contents = fs18.readFileUtf8(import_node_path22.default.join(logDir, segment.name));
+    const contents = fs19.readFileUtf8(import_node_path22.default.join(logDir, segment.name));
     if (contents === void 0) {
       continue;
     }
@@ -62184,9 +62231,9 @@ function snapshotPath(snapshotsDir, identity) {
   }
   return import_node_path22.default.join(snapshotsDir, `${identity}.json`);
 }
-function readUsageSnapshot(fs18, snapshotsDir, identity) {
+function readUsageSnapshot(fs19, snapshotsDir, identity) {
   const file2 = snapshotPath(snapshotsDir, identity);
-  const raw = fs18.readFileUtf8(file2);
+  const raw = fs19.readFileUtf8(file2);
   if (raw === void 0) {
     return void 0;
   }
@@ -62202,8 +62249,8 @@ function readUsageSnapshot(fs18, snapshotsDir, identity) {
   }
   return snapshot.data;
 }
-function listUsageSnapshots(fs18, snapshotsDir) {
-  return fs18.readdir(snapshotsDir).flatMap((name) => {
+function listUsageSnapshots(fs19, snapshotsDir) {
+  return fs19.readdir(snapshotsDir).flatMap((name) => {
     if (!name.endsWith(".json")) {
       return [];
     }
@@ -62211,7 +62258,7 @@ function listUsageSnapshots(fs18, snapshotsDir) {
     if (!isIdentityName(identity)) {
       return [];
     }
-    const snapshot = readUsageSnapshot(fs18, snapshotsDir, identity);
+    const snapshot = readUsageSnapshot(fs19, snapshotsDir, identity);
     return snapshot === void 0 ? [] : [snapshot];
   }).sort((left, right) => left.identity.localeCompare(right.identity));
 }
@@ -62270,11 +62317,11 @@ var import_node_path23 = __toESM(require("node:path"), 1);
 var DAY_MS2 = 864e5;
 var DAYS_IN_WEEK = 7;
 var USAGE_RETENTION_MS = DAYS_IN_WEEK * DAY_MS2;
-function pruneUsageLog(fs18, logDir, nowMs) {
+function pruneUsageLog(fs19, logDir, nowMs) {
   const cutoff = nowMs - USAGE_RETENTION_MS;
-  for (const segment of listLogSegments(fs18, logDir)) {
+  for (const segment of listLogSegments(fs19, logDir)) {
     if (segment.endsAt <= cutoff) {
-      fs18.removeRecursive(import_node_path23.default.join(logDir, segment.name));
+      fs19.removeRecursive(import_node_path23.default.join(logDir, segment.name));
     }
   }
 }
@@ -62303,7 +62350,7 @@ function foldProviderState(current, record2) {
   };
 }
 function createUsageStore(deps) {
-  const { fs: fs18, paths } = deps;
+  const { fs: fs19, paths } = deps;
   let prunedDay;
   const rewriteSnapshot = (identity, fold) => {
     if (!isIdentityName(identity)) {
@@ -62312,7 +62359,7 @@ function createUsageStore(deps) {
     }
     let current;
     try {
-      current = readUsageSnapshot(fs18, paths.usageSnapshotsDir, identity);
+      current = readUsageSnapshot(fs19, paths.usageSnapshotsDir, identity);
     } catch (error62) {
       if (!(error62 instanceof UsageSnapshotError)) {
         throw error62;
@@ -62339,8 +62386,8 @@ function createUsageStore(deps) {
       ...account === void 0 ? {} : { account },
       providers
     });
-    fs18.mkdirPrivate(paths.usageSnapshotsDir);
-    fs18.writeFilePrivate(snapshotPath(paths.usageSnapshotsDir, identity), `${JSON.stringify(snapshot, null, 2)}
+    fs19.mkdirPrivate(paths.usageSnapshotsDir);
+    fs19.writeFilePrivate(snapshotPath(paths.usageSnapshotsDir, identity), `${JSON.stringify(snapshot, null, 2)}
 `);
     return true;
   };
@@ -62348,14 +62395,14 @@ function createUsageStore(deps) {
     record: (input2) => {
       const record2 = UsageRecordSchema.parse(input2);
       const nowMs = deps.now();
-      fs18.mkdirPrivate(paths.usageDir);
-      fs18.mkdirPrivate(paths.usageLogDir);
+      fs19.mkdirPrivate(paths.usageDir);
+      fs19.mkdirPrivate(paths.usageLogDir);
       const day = segmentDay(nowMs);
       if (prunedDay !== day) {
-        pruneUsageLog(fs18, paths.usageLogDir, nowMs);
+        pruneUsageLog(fs19, paths.usageLogDir, nowMs);
         prunedDay = day;
       }
-      fs18.appendFilePrivate(import_node_path23.default.join(paths.usageLogDir, segmentName(day, deps.pid)), `${JSON.stringify(record2)}
+      fs19.appendFilePrivate(import_node_path23.default.join(paths.usageLogDir, segmentName(day, deps.pid)), `${JSON.stringify(record2)}
 `);
       if (record2.identity !== void 0) {
         rewriteSnapshot(record2.identity, (current) => ({ ...current?.providers, [record2.provider]: foldProviderState(current?.providers[record2.provider], record2) }));
@@ -62382,14 +62429,14 @@ var PicksFileSchema = external_exports.strictObject({
 function errorMessage(error62) {
   return error62 instanceof Error ? error62.message : String(error62);
 }
-function loadPoolMembers(fs18, paths, identities, nowMs) {
+function loadPoolMembers(fs19, paths, identities, nowMs) {
   const windowStartMs = nowMs - FIVE_HOUR_WINDOW_MS;
-  const log = readUsageLog(fs18, paths.usageLogDir, { sinceMs: windowStartMs });
+  const log = readUsageLog(fs19, paths.usageLogDir, { sinceMs: windowStartMs });
   return identities.map((identity) => {
     const records = log.records.filter((record2) => record2.identity === identity && record2.provider === ANTHROPIC_PROVIDER && Date.parse(record2.at) >= windowStartMs);
     try {
-      const snapshot = readUsageSnapshot(fs18, paths.usageSnapshotsDir, identity);
-      const account = readAccountMetadata(fs18, paths.identitiesDir, identity) ?? snapshot?.account;
+      const snapshot = readUsageSnapshot(fs19, paths.usageSnapshotsDir, identity);
+      const account = readAccountMetadata(fs19, paths.identitiesDir, identity) ?? snapshot?.account;
       return { identity, records, ...snapshot === void 0 ? {} : { snapshot }, ...account === void 0 ? {} : { account } };
     } catch (error62) {
       if (error62 instanceof UsageSnapshotError || error62 instanceof AccountMetadataError) {
@@ -62407,9 +62454,9 @@ function rankPoolFromStore(params) {
     ...params.sticky === void 0 ? {} : { sticky: params.sticky }
   });
 }
-function readPicksFile(fs18, file2) {
+function readPicksFile(fs19, file2) {
   const empty = { schemaVersion: SCHEMA_VERSION, picks: {} };
-  const raw = fs18.readFileUtf8(file2);
+  const raw = fs19.readFileUtf8(file2);
   if (raw === void 0) {
     return { file: empty };
   }
@@ -62422,17 +62469,17 @@ function readPicksFile(fs18, file2) {
   const result = PicksFileSchema.safeParse(parsed);
   return result.success ? { file: result.data } : { file: empty, problem: `${file2} is not a picks file this agent-shim can read` };
 }
-function readStickyPick(fs18, picksFile, directory) {
-  const read = readPicksFile(fs18, picksFile);
+function readStickyPick(fs19, picksFile, directory) {
+  const read = readPicksFile(fs19, picksFile);
   const entry = read.file.picks[directory];
   return { ...entry === void 0 ? {} : { sticky: entry }, ...read.problem === void 0 ? {} : { problem: read.problem } };
 }
-function recordStickyPick(fs18, picksFile, directory, identity, nowMs) {
-  const current = readPicksFile(fs18, picksFile).file.picks;
+function recordStickyPick(fs19, picksFile, directory, identity, nowMs) {
+  const current = readPicksFile(fs19, picksFile).file.picks;
   const kept = Object.entries(current).filter(([, entry]) => nowMs - Date.parse(entry.at) <= USAGE_RETENTION_MS);
   const next = { schemaVersion: SCHEMA_VERSION, picks: { ...Object.fromEntries(kept), [directory]: { identity, at: new Date(nowMs).toISOString() } } };
-  fs18.mkdirPrivate(import_node_path24.default.dirname(picksFile));
-  fs18.writeFilePrivate(picksFile, `${JSON.stringify(next, null, 2)}
+  fs19.mkdirPrivate(import_node_path24.default.dirname(picksFile));
+  fs19.writeFilePrivate(picksFile, `${JSON.stringify(next, null, 2)}
 `);
 }
 
@@ -62440,8 +62487,8 @@ function recordStickyPick(fs18, picksFile, directory, identity, nowMs) {
 var RESUME_FLAGS = /* @__PURE__ */ new Set(["--continue", "-c", "--resume", "-r"]);
 var TERMINATOR = "--";
 var REASONS_LOGGED = 3;
-function splitMembers(pool, paths, fs18) {
-  const exists = (name) => loadIdentity(paths.identitiesDir, name, fs18) !== void 0;
+function splitMembers(pool, paths, fs19) {
+  const exists = (name) => loadIdentity(paths.identitiesDir, name, fs19) !== void 0;
   return { present: pool.identities.filter(exists), missing: pool.identities.filter((name) => !exists(name)) };
 }
 function isResuming(passthrough) {
@@ -63013,7 +63060,8 @@ function runCheck(params) {
     nowMs: params.nowMs,
     env: params.env,
     ...params.branch === void 0 ? {} : { branch: params.branch },
-    ...params.branchDetached === void 0 ? {} : { branchDetached: params.branchDetached }
+    ...params.branchDetached === void 0 ? {} : { branchDetached: params.branchDetached },
+    descend: descendPolicyFor(params.cascade, params.home)
   });
   const resolved = resolveDecisions({ facts, cascade: params.cascade, classification: params.classification });
   const decisionLines = [...resolved.decisions.values()].slice().sort((a2, b) => a2.relPath < b.relPath ? -1 : a2.relPath > b.relPath ? 1 : 0).map(formatDecision);
@@ -63284,10 +63332,10 @@ var FrontDoorStateSchema = external_exports.strictObject({
   /** The last fatal error, kept across shutdowns so `frontdoor status` can explain a front door that is not running. */
   lastError: external_exports.string().optional()
 });
-function readFrontDoorState(fs18, stateFile) {
+function readFrontDoorState(fs19, stateFile) {
   let raw;
   try {
-    raw = fs18.readFileUtf8(stateFile);
+    raw = fs19.readFileUtf8(stateFile);
   } catch {
     return void 0;
   }
@@ -63301,28 +63349,28 @@ function readFrontDoorState(fs18, stateFile) {
     return void 0;
   }
 }
-function writeFrontDoorState(fs18, stateFile, state) {
-  fs18.mkdirp(import_node_path28.default.dirname(stateFile));
-  fs18.writeFileUtf8(stateFile, `${JSON.stringify(state, null, 2)}
+function writeFrontDoorState(fs19, stateFile, state) {
+  fs19.mkdirp(import_node_path28.default.dirname(stateFile));
+  fs19.writeFileUtf8(stateFile, `${JSON.stringify(state, null, 2)}
 `);
 }
 function frontDoorOrigin(state) {
   const port = state?.directPort ?? state?.lastDirectPort;
   return port === void 0 ? void 0 : `http://127.0.0.1:${String(port)}`;
 }
-function writeFrontDoorSession(fs18, sessionsDir, session) {
-  fs18.mkdirPrivate(sessionsDir);
-  fs18.writeFilePrivate(import_node_path28.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
+function writeFrontDoorSession(fs19, sessionsDir, session) {
+  fs19.mkdirPrivate(sessionsDir);
+  fs19.writeFilePrivate(import_node_path28.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
 `);
 }
-function listFrontDoorSessions(fs18, sessionsDir) {
+function listFrontDoorSessions(fs19, sessionsDir) {
   const sessions = [];
-  for (const name of fs18.readdir(sessionsDir)) {
+  for (const name of fs19.readdir(sessionsDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs18.readFileUtf8(import_node_path28.default.join(sessionsDir, name)) ?? ""));
+      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs19.readFileUtf8(import_node_path28.default.join(sessionsDir, name)) ?? ""));
       if (parsed.success) {
         sessions.push({ pid: parsed.data.pid, startedAt: parsed.data.startedAt });
       }
@@ -63332,27 +63380,27 @@ function listFrontDoorSessions(fs18, sessionsDir) {
   }
   return sessions.sort((a2, b) => a2.pid - b.pid);
 }
-function removeFrontDoorSession(fs18, sessionsDir, pid) {
-  fs18.removeRecursive(import_node_path28.default.join(sessionsDir, `${String(pid)}.json`));
+function removeFrontDoorSession(fs19, sessionsDir, pid) {
+  fs19.removeRecursive(import_node_path28.default.join(sessionsDir, `${String(pid)}.json`));
 }
-function pruneDeadFrontDoorSessions(fs18, sessionsDir, isRunning) {
+function pruneDeadFrontDoorSessions(fs19, sessionsDir, isRunning) {
   const removed = [];
-  for (const session of listFrontDoorSessions(fs18, sessionsDir)) {
+  for (const session of listFrontDoorSessions(fs19, sessionsDir)) {
     if (!isRunning(session.pid)) {
-      removeFrontDoorSession(fs18, sessionsDir, session.pid);
+      removeFrontDoorSession(fs19, sessionsDir, session.pid);
       removed.push(session.pid);
     }
   }
   return removed;
 }
-function liveSessionTokens(fs18, sessionsDir) {
+function liveSessionTokens(fs19, sessionsDir) {
   const tokens = /* @__PURE__ */ new Set();
-  for (const name of fs18.readdir(sessionsDir)) {
+  for (const name of fs19.readdir(sessionsDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs18.readFileUtf8(import_node_path28.default.join(sessionsDir, name)) ?? ""));
+      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs19.readFileUtf8(import_node_path28.default.join(sessionsDir, name)) ?? ""));
       if (parsed.success) {
         tokens.add(parsed.data.token);
       }
@@ -63717,8 +63765,8 @@ function registerCodexCommand(program2, deps) {
 }
 
 // src/frontdoor/commands.ts
-var import_node_crypto13 = require("node:crypto");
-var import_node_path31 = __toESM(require("node:path"), 1);
+var import_node_crypto11 = require("node:crypto");
+var import_node_path30 = __toESM(require("node:path"), 1);
 var import_node_fs11 = __toESM(require("node:fs"), 1);
 
 // src/frontdoor/custody.ts
@@ -64324,8 +64372,8 @@ var FRONTDOOR_SUPERVISOR_STILL_RUNNING = -1;
 var FRONTDOOR_POLL_MS = 1e3;
 var MS_PER_MINUTE = 6e4;
 async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {}) {
-  const { fs: fs18, paths } = ports;
-  const previous = readFrontDoorState(fs18, paths.frontdoorStateFile);
+  const { fs: fs19, paths } = ports;
+  const previous = readFrontDoorState(fs19, paths.frontdoorStateFile);
   let lastPort = previous?.lastPort;
   let lastConnectPort = previous?.lastConnectPort;
   let lastDirectPort = previous?.lastDirectPort;
@@ -64335,12 +64383,12 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     ...lastDirectPort === void 0 ? {} : { lastDirectPort }
   });
   const fail = (message) => {
-    writeFrontDoorState(fs18, paths.frontdoorStateFile, { lastError: message, ...sticky() });
-    fs18.removeRecursive(paths.frontdoorLockFile);
+    writeFrontDoorState(fs19, paths.frontdoorStateFile, { lastError: message, ...sticky() });
+    fs19.removeRecursive(paths.frontdoorLockFile);
     ports.log(`agent-shim frontdoor supervisor: ${message}`);
     return 1;
   };
-  writeFrontDoorState(fs18, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, ...sticky() });
+  writeFrontDoorState(fs19, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, ...sticky() });
   const previousSticky = lastPort;
   let http5;
   try {
@@ -64377,8 +64425,8 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     ports.log(`agent-shim frontdoor supervisor: sticky direct port ${String(previousStickyDirect)} was occupied; moving to ${String(direct.port)} (headroom must be restarted to admit the new address)`);
   }
   lastDirectPort = direct.port;
-  writeFrontDoorState(fs18, paths.frontdoorStateFile, { protocol: FRONT_DOOR_PROTOCOL, supervisorPid: ports.ownPid, port: http5.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
-  fs18.removeRecursive(paths.frontdoorLockFile);
+  writeFrontDoorState(fs19, paths.frontdoorStateFile, { protocol: FRONT_DOOR_PROTOCOL, supervisorPid: ports.ownPid, port: http5.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
+  fs19.removeRecursive(paths.frontdoorLockFile);
   ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http5.port)}, CONNECT surface on 127.0.0.1:${String(connect3.port)}`);
   let idleSince;
   let ticks = 0;
@@ -64387,15 +64435,15 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
       return FRONTDOOR_SUPERVISOR_STILL_RUNNING;
     }
     ticks += 1;
-    pruneDeadFrontDoorSessions(fs18, paths.frontdoorSessionsDir, ports.isRunning);
-    if (listFrontDoorSessions(fs18, paths.frontdoorSessionsDir).length === 0) {
+    pruneDeadFrontDoorSessions(fs19, paths.frontdoorSessionsDir, ports.isRunning);
+    if (listFrontDoorSessions(fs19, paths.frontdoorSessionsDir).length === 0) {
       idleSince ??= ports.now();
       if (ports.now() - idleSince >= idleShutdownMinutes * MS_PER_MINUTE) {
         ports.log(`agent-shim frontdoor supervisor: no sessions for ${String(idleShutdownMinutes)} minute(s); closing the front door and exiting`);
         await direct.close();
         await connect3.close();
         await http5.close();
-        writeFrontDoorState(fs18, paths.frontdoorStateFile, sticky());
+        writeFrontDoorState(fs19, paths.frontdoorStateFile, sticky());
         return 0;
       }
     } else {
@@ -64945,80 +64993,6 @@ function realConnectEffects() {
   };
 }
 
-// src/frontdoor/ensure.ts
-var import_node_crypto10 = require("node:crypto");
-var FRONTDOOR_START_TIMEOUT_MS = 3e4;
-var FRONTDOOR_LAUNCHER_POLL_MS = 100;
-var FrontDoorStartError = class extends CliError {
-  constructor(message) {
-    super(message);
-    this.name = "FrontDoorStartError";
-  }
-};
-function ensureFrontDoor(params) {
-  const { paths, ports } = params;
-  const deadline = ports.now() + FRONTDOOR_START_TIMEOUT_MS;
-  let spawned = false;
-  let replaced = false;
-  const distrusted = /* @__PURE__ */ new Set();
-  let lastRejection;
-  for (; ; ) {
-    const state = readFrontDoorState(ports.fs, paths.frontdoorStateFile);
-    const supervisorPid = state?.supervisorPid;
-    if (supervisorPid !== void 0 && !distrusted.has(supervisorPid) && ports.isRunning(supervisorPid)) {
-      if (state?.port !== void 0 && state.connectPort !== void 0) {
-        const verdict = ports.verifyListener(state.port);
-        if (verdict.ok && (state.protocol ?? 0) < FRONT_DOOR_PROTOCOL && !replaced) {
-          ports.stopSupervisor(supervisorPid);
-          while (ports.isRunning(supervisorPid)) {
-            if (ports.now() >= deadline) {
-              throw new FrontDoorStartError(`agent-shim: the front door (pid ${String(supervisorPid)}, protocol ${String(state.protocol ?? 0)}) is older than this launcher (protocol ${String(FRONT_DOOR_PROTOCOL)}) and did not exit when asked. Daemon log: ${paths.frontdoorLogPath}`);
-            }
-            ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
-          }
-          replaced = true;
-          continue;
-        }
-        if (verdict.ok) {
-          const token = (0, import_node_crypto10.randomUUID)();
-          writeFrontDoorSession(ports.fs, paths.frontdoorSessionsDir, { pid: params.launcherPid, startedAt: ports.now(), token });
-          return { port: state.port, connectPort: state.connectPort, token };
-        }
-        lastRejection = `the listener on 127.0.0.1:${String(state.port)} (recorded for pid ${String(supervisorPid)}) failed authentication: ${verdict.reason}`;
-        if (spawned) {
-          throw new FrontDoorStartError(`agent-shim: ${lastRejection}; refusing to send this session's credentials to it. Daemon log: ${paths.frontdoorLogPath}`);
-        }
-        distrusted.add(supervisorPid);
-        continue;
-      }
-      if (state?.lastError !== void 0) {
-        throw new FrontDoorStartError(`agent-shim: the front door reported a fatal error and is not serving: ${state.lastError} (daemon log: ${paths.frontdoorLogPath})`);
-      }
-    } else if (!spawned) {
-      ports.fs.mkdirp(paths.frontdoorDir);
-      const created = ports.fs.writeFileExclusive(paths.frontdoorLockFile, `${JSON.stringify({ pid: params.launcherPid, at: ports.now() })}
-`);
-      if (created) {
-        ports.spawnSupervisor(paths);
-        spawned = true;
-      } else {
-        const lock = readStartLock(ports.fs, paths.frontdoorLockFile);
-        if (lock === void 0 || !ports.isRunning(lock.pid)) {
-          ports.fs.removeRecursive(paths.frontdoorLockFile);
-          continue;
-        }
-      }
-    }
-    if (ports.now() >= deadline) {
-      const lastError = state?.lastError;
-      throw new FrontDoorStartError(
-        `agent-shim: the front door did not become ready within ${String(FRONTDOOR_START_TIMEOUT_MS)}ms` + (lastError === void 0 ? "" : ` (last error: ${lastError})`) + (lastRejection === void 0 ? "" : ` (${lastRejection})`) + `. Daemon log: ${paths.frontdoorLogPath}`
-      );
-    }
-    ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
-  }
-}
-
 // src/frontdoor/headroomHop.ts
 var http3 = __toESM(require("node:http"), 1);
 
@@ -65411,72 +65385,8 @@ async function serveRouted(request6, deps) {
   }
 }
 
-// src/frontdoor/probe.ts
-var import_node_worker_threads = require("node:worker_threads");
-var PROBE_TIMEOUT_MS = 2e3;
-var PROBE_WAIT_MARGIN_MS = 1e3;
-var REASON_BYTES = 1024;
-var HEADER_SLOTS = 2;
-var INT32_BYTES = 4;
-var VERDICT_PENDING = 0;
-var VERDICT_OK = 1;
-var VERDICT_FAILED = 2;
-var PROBE_SOURCE = `
-const { workerData } = require("node:worker_threads");
-const https = require("node:https");
-const { port, ca, timeoutMs, shared, ok, failed, headerSlots } = workerData;
-const header = new Int32Array(shared, 0, headerSlots);
-const reason = new Uint8Array(shared, headerSlots * 4);
-let done = false;
-const finish = (verdict, message) => {
-  if (done) return;
-  done = true;
-  const bytes = Buffer.from(String(message), "utf8").subarray(0, reason.length);
-  reason.set(bytes);
-  Atomics.store(header, 1, bytes.length);
-  Atomics.store(header, 0, verdict);
-  Atomics.notify(header, 0);
-};
-const request = https.get({ host: "127.0.0.1", port, path: "/healthz", ca: [ca], agent: false }, (response) => {
-  let body = "";
-  response.setEncoding("utf8");
-  response.on("data", (chunk) => { body += chunk; });
-  response.on("end", () => {
-    if (response.statusCode === 200 && body === "ok") finish(ok, "");
-    else finish(failed, "the listener answered its health probe with HTTP " + String(response.statusCode));
-  });
-  response.on("error", (error) => finish(failed, error.message));
-});
-// A hard deadline over the whole exchange, handshake included: a listener that accepts the connection and then says nothing must still fail the probe.
-setTimeout(() => { request.destroy(new Error("no answer within " + String(timeoutMs) + "ms")); }, timeoutMs);
-request.on("error", (error) => finish(failed, (error.code ? error.code + ": " : "") + error.message));
-`;
-function probeFrontDoorSync(port, caPem) {
-  const shared = new SharedArrayBuffer(HEADER_SLOTS * INT32_BYTES + REASON_BYTES);
-  const header = new Int32Array(shared, 0, HEADER_SLOTS);
-  const worker = new import_node_worker_threads.Worker(PROBE_SOURCE, {
-    eval: true,
-    workerData: { port, ca: caPem, timeoutMs: PROBE_TIMEOUT_MS, shared, ok: VERDICT_OK, failed: VERDICT_FAILED, headerSlots: HEADER_SLOTS }
-  });
-  worker.unref();
-  try {
-    const waited = Atomics.wait(header, 0, VERDICT_PENDING, PROBE_TIMEOUT_MS + PROBE_WAIT_MARGIN_MS);
-    const verdict = Atomics.load(header, 0);
-    if (waited === "timed-out" || verdict === VERDICT_PENDING) {
-      return { ok: false, reason: `the probe did not finish within ${String(PROBE_TIMEOUT_MS + PROBE_WAIT_MARGIN_MS)}ms` };
-    }
-    if (verdict === VERDICT_OK) {
-      return { ok: true };
-    }
-    const length = Atomics.load(header, 1);
-    return { ok: false, reason: Buffer.from(new Uint8Array(shared, HEADER_SLOTS * INT32_BYTES, length)).toString("utf8") };
-  } finally {
-    void worker.terminate();
-  }
-}
-
 // src/codex/translate.ts
-var import_node_crypto11 = require("node:crypto");
+var import_node_crypto10 = require("node:crypto");
 
 // src/codex/anthropic.ts
 var TextBlockSchema = external_exports.looseObject({ type: external_exports.literal("text"), text: external_exports.string() });
@@ -65588,7 +65498,7 @@ function shortToolName(name, names) {
   if (name.length <= CODEX_TOOL_NAME_LIMIT) {
     return name;
   }
-  const hash2 = (0, import_node_crypto11.createHash)("sha256").update(name).digest("hex").slice(0, TOOL_NAME_HASH_CHARS);
+  const hash2 = (0, import_node_crypto10.createHash)("sha256").update(name).digest("hex").slice(0, TOOL_NAME_HASH_CHARS);
   const shortened = `${name.slice(0, CODEX_TOOL_NAME_LIMIT - TOOL_NAME_HASH_CHARS - 1)}_${hash2}`;
   names.set(shortened, name);
   return shortened;
@@ -66429,38 +66339,6 @@ function createProviderRouteResolver(deps) {
   return async (request6) => await Promise.resolve(resolve(request6));
 }
 
-// src/frontdoor/trust.ts
-var import_node_crypto12 = require("node:crypto");
-var import_node_path30 = __toESM(require("node:path"), 1);
-var BUNDLE_NAME_HEX_DIGITS = 16;
-function resolveTrustBundle(params) {
-  const { caCertFile, bundlesDir, inherited, fs: fs18 } = params;
-  if (inherited === void 0 || inherited === "" || import_node_path30.default.resolve(inherited) === import_node_path30.default.resolve(caCertFile)) {
-    return { path: caCertFile };
-  }
-  const caPem = fs18.readFileUtf8(caCertFile);
-  let inheritedPem;
-  try {
-    inheritedPem = fs18.readFileUtf8(inherited);
-  } catch (error62) {
-    return {
-      path: caCertFile,
-      warning: `agent-shim: NODE_EXTRA_CA_CERTS names ${inherited}, which could not be read (${error62 instanceof Error ? error62.message : String(error62)}); the child trusts agent-shim's front-door CA on top of the system store, and nothing from that file`
-    };
-  }
-  if (inheritedPem.includes(caPem.trim())) {
-    return { path: inherited };
-  }
-  const combined = `${inheritedPem.trimEnd()}
-${caPem}`;
-  const bundle = import_node_path30.default.join(bundlesDir, `${(0, import_node_crypto12.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
-  if (!fs18.exists(bundle)) {
-    fs18.mkdirp(bundlesDir);
-    fs18.writeFileAtomic(bundle, combined);
-  }
-  return { path: bundle };
-}
-
 // src/usage/providerQuota.ts
 var ProviderQuotaError = class extends Error {
   constructor(source, detail) {
@@ -66783,8 +66661,8 @@ function realFrontDoorSupervisorPorts(paths) {
     now: () => Date.now(),
     headroomPort: () => liveHeadroomPort(paths),
     // The per-generation capability the direct listener demands: held only in this process's memory, so a loopback process that discovers the direct port still cannot use it.
-    hopSecret: (0, import_node_crypto13.randomUUID)(),
-    custody: createCredentialCustody(() => (0, import_node_crypto13.randomUUID)()),
+    hopSecret: (0, import_node_crypto11.randomUUID)(),
+    custody: createCredentialCustody(() => (0, import_node_crypto11.randomUUID)()),
     log
   });
   let ca;
@@ -66821,14 +66699,14 @@ function realFrontDoorSupervisorPorts(paths) {
     },
     startConnectListener: async (preferredPort) => {
       const transparentPort = process.env.AGENT_SHIM_TRANSPARENT_SURFACE === void 0 ? void 0 : Number(process.env.AGENT_SHIM_TRANSPARENT_SURFACE);
-      const transparentCapability = transparentPort === void 0 || Number.isNaN(transparentPort) ? void 0 : (0, import_node_crypto13.randomUUID)();
+      const transparentCapability = transparentPort === void 0 || Number.isNaN(transparentPort) ? void 0 : (0, import_node_crypto11.randomUUID)();
       if (transparentCapability !== void 0) {
         writeFrontDoorSession(realFarmFs, paths.frontdoorSessionsDir, { pid: process.pid, startedAt: Date.now(), token: transparentCapability });
       }
       const leafFor = createLeafCache(loadCa(), () => /* @__PURE__ */ new Date());
       const capture = captureFromEnv(process.env, paths.logsDir);
       if (capture !== void 0) {
-        log(`capture enabled, recording CONNECT targets and piped exchanges to ${import_node_path31.default.join(paths.logsDir, "frontdoor-capture.jsonl")}`);
+        log(`capture enabled, recording CONNECT targets and piped exchanges to ${import_node_path30.default.join(paths.logsDir, "frontdoor-capture.jsonl")}`);
       }
       const server = await startConnectServer(
         {
@@ -66884,49 +66762,6 @@ function realFrontDoorSupervisorPorts(paths) {
     }
   };
 }
-var realTrustBundleFs = {
-  readFileUtf8: (file2) => import_node_fs11.default.readFileSync(file2, "utf8"),
-  exists: (file2) => import_node_fs11.default.existsSync(file2),
-  mkdirp: (dir) => {
-    import_node_fs11.default.mkdirSync(dir, { recursive: true });
-  },
-  writeFileAtomic: (file2, contents) => {
-    realFarmFs.writeFilePrivate(file2, contents);
-  }
-};
-function realFrontDoorPort(paths) {
-  return {
-    ensure: (inheritedExtraCaCerts) => {
-      const up = ensureFrontDoor({
-        paths,
-        launcherPid: process.pid,
-        ports: {
-          fs: realFarmFs,
-          isRunning: realIsProcessRunning,
-          now: () => Date.now(),
-          sleep: realSleepSync,
-          spawnSupervisor: (layout) => spawnDetachedSupervisor(layout, "__frontdoor-supervisor", layout.frontdoorLogPath),
-          stopSupervisor: (pid) => {
-            process.kill(pid, "SIGTERM");
-          },
-          // Read fresh for each probe: a replacement supervisor may have regenerated an unparseable CA, and the probe must trust exactly what the serving door's leaf chains to.
-          verifyListener: (port) => probeFrontDoorSync(port, import_node_fs11.default.readFileSync(paths.frontdoorCaCertFile, "utf8"))
-        }
-      });
-      const trust = resolveTrustBundle({ caCertFile: paths.frontdoorCaCertFile, bundlesDir: paths.frontdoorCaBundlesDir, inherited: inheritedExtraCaCerts, fs: realTrustBundleFs });
-      return {
-        port: up.port,
-        connectPort: up.connectPort,
-        trustBundlePath: trust.path,
-        ...trust.warning === void 0 ? {} : { trustWarning: trust.warning },
-        sessionToken: up.token
-      };
-    },
-    release: () => {
-      removeFrontDoorSession(realFarmFs, paths.frontdoorSessionsDir, process.pid);
-    }
-  };
-}
 function collectFrontDoorStatus(fsPort, paths, isRunning) {
   const state = readFrontDoorState(fsPort, paths.frontdoorStateFile) ?? {};
   return {
@@ -67279,15 +67114,15 @@ var import_node_child_process4 = require("node:child_process");
 
 // src/identityToken.ts
 var import_node_fs12 = __toESM(require("node:fs"), 1);
-var import_node_path32 = __toESM(require("node:path"), 1);
+var import_node_path31 = __toESM(require("node:path"), 1);
 var TOKEN_FILE_MODE = 384;
 var TOKEN_DIR_MODE = 448;
 var OAUTH_TOKEN_RE = /^sk-ant-oat\d+-[A-Za-z0-9_-]+$/;
 function identityTokenDir(paths) {
-  return import_node_path32.default.join(paths.root, "credentials");
+  return import_node_path31.default.join(paths.root, "credentials");
 }
 function identityTokenPath(paths, identityName) {
-  return import_node_path32.default.join(identityTokenDir(paths), `${identityName}.token`);
+  return import_node_path31.default.join(identityTokenDir(paths), `${identityName}.token`);
 }
 function storeIdentityToken(paths, identityName, raw) {
   const token = raw.trim();
@@ -67298,7 +67133,7 @@ function storeIdentityToken(paths, identityName, raw) {
   import_node_fs12.default.mkdirSync(dir, { recursive: true, mode: TOKEN_DIR_MODE });
   import_node_fs12.default.chmodSync(dir, TOKEN_DIR_MODE);
   const target = identityTokenPath(paths, identityName);
-  const temp = import_node_path32.default.join(dir, `.${identityName}.${String(process.pid)}.tmp`);
+  const temp = import_node_path31.default.join(dir, `.${identityName}.${String(process.pid)}.tmp`);
   import_node_fs12.default.writeFileSync(temp, `${token}
 `, { mode: TOKEN_FILE_MODE });
   import_node_fs12.default.renameSync(temp, target);
@@ -67308,7 +67143,7 @@ function storeIdentityToken(paths, identityName, raw) {
 // src/realCredentialCache.ts
 var import_node_child_process3 = require("node:child_process");
 var import_node_fs13 = __toESM(require("node:fs"), 1);
-var import_node_path33 = __toESM(require("node:path"), 1);
+var import_node_path32 = __toESM(require("node:path"), 1);
 var KEYCHAIN_CACHE_SERVICE = "agent-shim-credential-cache";
 var CACHE_DIR_MODE = 448;
 var CACHE_FILE_MODE = 384;
@@ -67335,8 +67170,8 @@ function security(args, stdin2) {
   return { status: result.status, stdout: result.stdout };
 }
 function createRealCredentialCache(root) {
-  const dir = import_node_path33.default.join(root, "credential-cache");
-  const filePath = (owner) => import_node_path33.default.join(dir, cacheFileNameFor(owner));
+  const dir = import_node_path32.default.join(root, "credential-cache");
+  const filePath = (owner) => import_node_path32.default.join(dir, cacheFileNameFor(owner));
   return {
     read(store, owner) {
       if (store === "file") {
@@ -67515,7 +67350,7 @@ function subjectName(positional, provider) {
 
 // src/doctorReport.ts
 var import_node_fs14 = __toESM(require("node:fs"), 1);
-var import_node_path34 = __toESM(require("node:path"), 1);
+var import_node_path33 = __toESM(require("node:path"), 1);
 
 // src/headroom/source.ts
 var GIT_SPEC_RE = /git\+[^@\s]+(?:@([^\s#]+))?/;
@@ -67566,7 +67401,7 @@ function validateJson(schema, input2) {
   return { ok: true, data: result.data };
 }
 function pushPathResolution(push, resolution) {
-  const ownDir = import_node_path34.default.dirname(resolution.ownExecutablePath);
+  const ownDir = import_node_path33.default.dirname(resolution.ownExecutablePath);
   switch (resolution.agentShim.status) {
     case "ok":
       push("path-resolution", "pass", `\`agent-shim\` on PATH resolves to this running executable, ${resolution.ownExecutablePath}.`, "agent-shim");
@@ -67634,14 +67469,14 @@ function pushProvider(push, entry) {
 }
 function pushLegacyName(push, params) {
   const legacyVariables = Object.keys(params.env).filter((name) => name.startsWith(LEGACY_ENV_PREFIX) && params.env[name] !== void 0).sort();
-  if (legacyVariables.length === 0 && import_node_path34.default.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
+  if (legacyVariables.length === 0 && import_node_path33.default.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
     push("legacy-name", "pass", "Nothing here still uses the former `claude-use` name.");
     return;
   }
   for (const name of legacyVariables) {
     push("legacy-name", "warn", `${name} is the former name of ${name.replace(LEGACY_ENV_PREFIX, ENV_PREFIX)}. Rename it; the old name still works but is only a fallback.`, name);
   }
-  if (import_node_path34.default.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
+  if (import_node_path33.default.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
     push(
       "legacy-name",
       "warn",
@@ -67949,18 +67784,18 @@ function collectDoctorReport(params) {
   const { paths } = params;
   const identityNames = import_node_fs14.default.existsSync(paths.identitiesDir) ? import_node_fs14.default.readdirSync(paths.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && isIdentityDirectoryName(entry.name)).map((entry) => entry.name).sort() : [];
   const identities = identityNames.map((name) => {
-    const farmRoot = import_node_path34.default.join(paths.identitiesDir, name);
-    const identityPath = import_node_path34.default.join(farmRoot, "identity.json");
+    const farmRoot = import_node_path33.default.join(paths.identitiesDir, name);
+    const identityPath = import_node_path33.default.join(farmRoot, "identity.json");
     return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot };
   });
   const profileNames = import_node_fs14.default.existsSync(paths.configProfilesDir) ? import_node_fs14.default.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const configProfiles = profileNames.map((name) => {
-    const profilePath = import_node_path34.default.join(paths.configProfilesDir, `${name}.json`);
+    const profilePath = import_node_path33.default.join(paths.configProfilesDir, `${name}.json`);
     return { name, path: profilePath, raw: realFsPort.readFileUtf8(profilePath) };
   });
   const providerNames = import_node_fs14.default.existsSync(paths.providersDir) ? import_node_fs14.default.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const providers = providerNames.map((name) => {
-    const providerPath = import_node_path34.default.join(paths.providersDir, `${name}.json`);
+    const providerPath = import_node_path33.default.join(paths.providersDir, `${name}.json`);
     return { name, path: providerPath, raw: realFsPort.readFileUtf8(providerPath) };
   });
   const ownExecutablePath = realOwnExecutablePath();
@@ -67972,12 +67807,12 @@ function collectDoctorReport(params) {
     binaryDiscovery = { ok: false, message: error62 instanceof Error ? error62.message : String(error62) };
   }
   const shimState = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-  const pathDirs = (params.env.PATH ?? "").split(import_node_path34.default.delimiter).filter((dir) => dir !== "");
+  const pathDirs = (params.env.PATH ?? "").split(import_node_path33.default.delimiter).filter((dir) => dir !== "");
   const claudeShimShadow = shimState === void 0 ? void 0 : refinePathShadow(
     findPathShadow({
       pathDirs,
-      targetDir: import_node_path34.default.dirname(shimState.targetPath),
-      targetFilename: import_node_path34.default.basename(shimState.targetPath),
+      targetDir: import_node_path33.default.dirname(shimState.targetPath),
+      targetFilename: import_node_path33.default.basename(shimState.targetPath),
       findExecutableInDir
     }),
     shimState.targetPath,
@@ -68000,7 +67835,7 @@ function collectDoctorReport(params) {
       agentShim: refinePathShadow(
         findPathShadow({
           pathDirs,
-          targetDir: import_node_path34.default.dirname(ownExecutablePath),
+          targetDir: import_node_path33.default.dirname(ownExecutablePath),
           targetFilename: commandFilename(ownExecutablePath, "agent-shim"),
           findExecutableInDir
         }),
@@ -68043,11 +67878,11 @@ function registerDoctorCommand(program2, deps) {
 // src/headroom/commands.ts
 var import_node_fs15 = __toESM(require("node:fs"), 1);
 var import_node_net3 = __toESM(require("node:net"), 1);
-var import_node_path35 = __toESM(require("node:path"), 1);
+var import_node_path34 = __toESM(require("node:path"), 1);
 var import_node_child_process5 = require("node:child_process");
 
 // src/headroom/settings.ts
-var import_node_crypto14 = require("node:crypto");
+var import_node_crypto12 = require("node:crypto");
 function settingsOf(config2) {
   return {
     ...config2.mode === void 0 ? {} : { mode: config2.mode },
@@ -68072,7 +67907,7 @@ function settingsEnv(settings2) {
   return settings2.rolloutChannel === void 0 ? {} : { HEADROOM_ROLLOUT_CHANNEL: settings2.rolloutChannel };
 }
 function hashSettings(settings2) {
-  return (0, import_node_crypto14.createHash)("sha256").update(JSON.stringify([...settingsArgs(settings2), JSON.stringify(settingsEnv(settings2))])).digest("hex");
+  return (0, import_node_crypto12.createHash)("sha256").update(JSON.stringify([...settingsArgs(settings2), JSON.stringify(settingsEnv(settings2))])).digest("hex");
 }
 
 // src/headroom/supervisor.ts
@@ -68174,9 +68009,9 @@ function compareVersions2(a2, b) {
 }
 var HEADROOM_SUPERVISOR_STILL_RUNNING = -1;
 async function runSupervisor(initialConfig, ports, options = {}) {
-  const { fs: fs18, paths } = ports;
+  const { fs: fs19, paths } = ports;
   let config2 = initialConfig;
-  const previousState = readHeadroomState(fs18, paths.headroomStateFile);
+  const previousState = readHeadroomState(fs19, paths.headroomStateFile);
   if (previousState?.supervisorPid !== void 0 && previousState.supervisorPid !== ports.ownPid && ports.isRunning(previousState.supervisorPid)) {
     ports.log(`agent-shim headroom supervisor ${String(ports.ownPid)}: supervisor ${String(previousState.supervisorPid)} already owns the daemon; exiting`);
     return 0;
@@ -68185,19 +68020,19 @@ async function runSupervisor(initialConfig, ports, options = {}) {
   let lastPort = previousState?.lastPort;
   const sticky = () => lastPort === void 0 ? {} : { lastPort };
   const ownsState = () => {
-    const owner = readHeadroomState(fs18, paths.headroomStateFile)?.supervisorPid;
+    const owner = readHeadroomState(fs19, paths.headroomStateFile)?.supervisorPid;
     return owner === void 0 || owner === ports.ownPid || !ports.isRunning(owner);
   };
   const writeOwnState = (state) => {
     if (!ownsState()) {
       return false;
     }
-    writeHeadroomState(fs18, paths.headroomStateFile, state);
+    writeHeadroomState(fs19, paths.headroomStateFile, state);
     return true;
   };
   const fail = (message) => {
     if (writeOwnState({ lastError: message, ...sticky() })) {
-      fs18.removeRecursive(paths.headroomLockFile);
+      fs19.removeRecursive(paths.headroomLockFile);
     }
     ports.log(`agent-shim headroom supervisor: ${message}`);
     return 1;
@@ -68246,7 +68081,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     const settingsHash = hashSettings(config2.settings);
     const allowlist = allowlistOf(ports);
     const allowlistHash = hashAllowlist(allowlist);
-    pruneDeadSessions(fs18, paths.headroomSessionsDir, ports.isRunning);
+    pruneDeadSessions(fs19, paths.headroomSessionsDir, ports.isRunning);
     const ownsNow = ownsState();
     if (!ownsNow && !superseded) {
       ports.log("agent-shim headroom supervisor: another supervisor now owns state.json; serving this daemon's own sessions until they end");
@@ -68298,7 +68133,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
           ...sticky()
         });
         if (recorded) {
-          fs18.removeRecursive(paths.headroomLockFile);
+          fs19.removeRecursive(paths.headroomLockFile);
         }
         idleSince = void 0;
         ports.log(`agent-shim headroom supervisor: headroom pid ${String(pid)} ready on 127.0.0.1:${String(port)}`);
@@ -68313,7 +68148,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
       }
     } else {
       if (runningHash !== allowlistHash || runningSettingsHash !== settingsHash || installedSource !== config2.source) {
-        if (sessionsForSupervisor(fs18, paths.headroomSessionsDir, ports.ownPid).length === 0) {
+        if (sessionsForSupervisor(fs19, paths.headroomSessionsDir, ports.ownPid).length === 0) {
           ports.log("agent-shim headroom supervisor: configuration drifted and no sessions are live; restarting headroom");
           ports.stopProcess(headroomPid);
           headroomPid = void 0;
@@ -68322,7 +68157,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
           continue;
         }
       }
-      const sessions = sessionsForSupervisor(fs18, paths.headroomSessionsDir, ports.ownPid);
+      const sessions = sessionsForSupervisor(fs19, paths.headroomSessionsDir, ports.ownPid);
       if (sessions.length === 0) {
         idleSince ??= ports.now();
         const idleMs = ports.now() - idleSince;
@@ -68344,9 +68179,9 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     await ports.sleep(HEADROOM_POLL_MS);
   }
 }
-function currentHeadroomAllowlist(fs18, paths) {
-  const providers = readAllProviders(fs18, paths.providersDir).map((entry) => entry.provider);
-  return headroomAllowlist(headroomUpstreams(providers, frontDoorOrigin(readFrontDoorState(fs18, paths.frontdoorStateFile))));
+function currentHeadroomAllowlist(fs19, paths) {
+  const providers = readAllProviders(fs19, paths.providersDir).map((entry) => entry.provider);
+  return headroomAllowlist(headroomUpstreams(providers, frontDoorOrigin(readFrontDoorState(fs19, paths.frontdoorStateFile))));
 }
 function allowlistOf(ports) {
   return currentHeadroomAllowlist(ports.fs, ports.paths);
@@ -68458,12 +68293,12 @@ function readInstalledHeadroomCommit() {
   if (toolDir.status !== 0) {
     return void 0;
   }
-  const libDir = import_node_path35.default.join(toolDir.stdout.trim(), HEADROOM_TOOL_NAME, "lib");
+  const libDir = import_node_path34.default.join(toolDir.stdout.trim(), HEADROOM_TOOL_NAME, "lib");
   for (const python of realFarmFs.readdir(libDir)) {
-    const sitePackages = import_node_path35.default.join(libDir, python, "site-packages");
+    const sitePackages = import_node_path34.default.join(libDir, python, "site-packages");
     for (const entry of realFarmFs.readdir(sitePackages)) {
       if (entry.startsWith("headroom_ai-") && entry.endsWith(".dist-info")) {
-        const directUrl = realFarmFs.readFileUtf8(import_node_path35.default.join(sitePackages, entry, "direct_url.json"));
+        const directUrl = realFarmFs.readFileUtf8(import_node_path34.default.join(sitePackages, entry, "direct_url.json"));
         return directUrl === void 0 ? void 0 : parseInstalledCommit(directUrl);
       }
     }
@@ -68993,14 +68828,14 @@ function requireIdentity(paths, name) {
     throw new IdentityNotFoundError(name);
   }
 }
-function collectUsageReport(fs18, paths, filters) {
+function collectUsageReport(fs19, paths, filters) {
   const { identity, provider, sinceMs } = filters;
   if (identity !== void 0) {
     requireIdentity(paths, identity);
   }
-  const log = readUsageLog(fs18, paths.usageLogDir, sinceMs === void 0 ? {} : { sinceMs });
+  const log = readUsageLog(fs19, paths.usageLogDir, sinceMs === void 0 ? {} : { sinceMs });
   const records = log.records.filter((record2) => (identity === void 0 || record2.identity === identity) && (provider === void 0 || record2.provider === provider));
-  const snapshots = (identity === void 0 ? listUsageSnapshots(fs18, paths.usageSnapshotsDir) : [readUsageSnapshot(fs18, paths.usageSnapshotsDir, identity)].flatMap((snapshot) => snapshot === void 0 ? [] : [snapshot])).map((snapshot) => provider === void 0 ? snapshot : { ...snapshot, providers: Object.fromEntries(Object.entries(snapshot.providers).filter(([name]) => name === provider)) }).filter((snapshot) => Object.keys(snapshot.providers).length > 0);
+  const snapshots = (identity === void 0 ? listUsageSnapshots(fs19, paths.usageSnapshotsDir) : [readUsageSnapshot(fs19, paths.usageSnapshotsDir, identity)].flatMap((snapshot) => snapshot === void 0 ? [] : [snapshot])).map((snapshot) => provider === void 0 ? snapshot : { ...snapshot, providers: Object.fromEntries(Object.entries(snapshot.providers).filter(([name]) => name === provider)) }).filter((snapshot) => Object.keys(snapshot.providers).length > 0);
   return {
     since: sinceMs === void 0 ? void 0 : new Date(sinceMs).toISOString(),
     logDir: paths.usageLogDir,
@@ -69096,15 +68931,15 @@ function formatUsageReport(report) {
   }
   return lines;
 }
-function collectAccounts(fs18, paths, identity) {
+function collectAccounts(fs19, paths, identity) {
   if (identity !== void 0) {
     requireIdentity(paths, identity);
   }
   const names = identity === void 0 ? listIdentities(paths).map((entry) => entry.name) : [identity];
   return names.map((name) => ({
     identity: name,
-    account: readAccountMetadata(fs18, paths.identitiesDir, name),
-    usage: readUsageSnapshot(fs18, paths.usageSnapshotsDir, name)
+    account: readAccountMetadata(fs19, paths.identitiesDir, name),
+    usage: readUsageSnapshot(fs19, paths.usageSnapshotsDir, name)
   }));
 }
 function formatAccounts(views) {
@@ -69265,10 +69100,228 @@ function buildProgram(deps) {
   return program2;
 }
 
-// src/runClaude.ts
+// src/launchWiring.ts
 var import_node_os8 = __toESM(require("node:os"), 1);
 var import_node_crypto16 = require("node:crypto");
 
+// src/frontdoor/realFrontDoorPort.ts
+var import_node_fs16 = __toESM(require("node:fs"), 1);
+
+// src/frontdoor/ensure.ts
+var import_node_crypto13 = require("node:crypto");
+var FRONTDOOR_START_TIMEOUT_MS = 3e4;
+var FRONTDOOR_LAUNCHER_POLL_MS = 100;
+var FrontDoorStartError = class extends CliError {
+  constructor(message) {
+    super(message);
+    this.name = "FrontDoorStartError";
+  }
+};
+function ensureFrontDoor(params) {
+  const { paths, ports } = params;
+  const deadline = ports.now() + FRONTDOOR_START_TIMEOUT_MS;
+  let spawned = false;
+  let replaced = false;
+  const distrusted = /* @__PURE__ */ new Set();
+  let lastRejection;
+  for (; ; ) {
+    const state = readFrontDoorState(ports.fs, paths.frontdoorStateFile);
+    const supervisorPid = state?.supervisorPid;
+    if (supervisorPid !== void 0 && !distrusted.has(supervisorPid) && ports.isRunning(supervisorPid)) {
+      if (state?.port !== void 0 && state.connectPort !== void 0) {
+        const verdict = ports.verifyListener(state.port);
+        if (verdict.ok && (state.protocol ?? 0) < FRONT_DOOR_PROTOCOL && !replaced) {
+          ports.stopSupervisor(supervisorPid);
+          while (ports.isRunning(supervisorPid)) {
+            if (ports.now() >= deadline) {
+              throw new FrontDoorStartError(`agent-shim: the front door (pid ${String(supervisorPid)}, protocol ${String(state.protocol ?? 0)}) is older than this launcher (protocol ${String(FRONT_DOOR_PROTOCOL)}) and did not exit when asked. Daemon log: ${paths.frontdoorLogPath}`);
+            }
+            ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
+          }
+          replaced = true;
+          continue;
+        }
+        if (verdict.ok) {
+          const token = (0, import_node_crypto13.randomUUID)();
+          writeFrontDoorSession(ports.fs, paths.frontdoorSessionsDir, { pid: params.launcherPid, startedAt: ports.now(), token });
+          return { port: state.port, connectPort: state.connectPort, token };
+        }
+        lastRejection = `the listener on 127.0.0.1:${String(state.port)} (recorded for pid ${String(supervisorPid)}) failed authentication: ${verdict.reason}`;
+        if (spawned) {
+          throw new FrontDoorStartError(`agent-shim: ${lastRejection}; refusing to send this session's credentials to it. Daemon log: ${paths.frontdoorLogPath}`);
+        }
+        distrusted.add(supervisorPid);
+        continue;
+      }
+      if (state?.lastError !== void 0) {
+        throw new FrontDoorStartError(`agent-shim: the front door reported a fatal error and is not serving: ${state.lastError} (daemon log: ${paths.frontdoorLogPath})`);
+      }
+    } else if (!spawned) {
+      ports.fs.mkdirp(paths.frontdoorDir);
+      const created = ports.fs.writeFileExclusive(paths.frontdoorLockFile, `${JSON.stringify({ pid: params.launcherPid, at: ports.now() })}
+`);
+      if (created) {
+        ports.spawnSupervisor(paths);
+        spawned = true;
+      } else {
+        const lock = readStartLock(ports.fs, paths.frontdoorLockFile);
+        if (lock === void 0 || !ports.isRunning(lock.pid)) {
+          ports.fs.removeRecursive(paths.frontdoorLockFile);
+          continue;
+        }
+      }
+    }
+    if (ports.now() >= deadline) {
+      const lastError = state?.lastError;
+      throw new FrontDoorStartError(
+        `agent-shim: the front door did not become ready within ${String(FRONTDOOR_START_TIMEOUT_MS)}ms` + (lastError === void 0 ? "" : ` (last error: ${lastError})`) + (lastRejection === void 0 ? "" : ` (${lastRejection})`) + `. Daemon log: ${paths.frontdoorLogPath}`
+      );
+    }
+    ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
+  }
+}
+
+// src/frontdoor/probe.ts
+var import_node_worker_threads = require("node:worker_threads");
+var PROBE_TIMEOUT_MS = 2e3;
+var PROBE_WAIT_MARGIN_MS = 1e3;
+var REASON_BYTES = 1024;
+var HEADER_SLOTS = 2;
+var INT32_BYTES = 4;
+var VERDICT_PENDING = 0;
+var VERDICT_OK = 1;
+var VERDICT_FAILED = 2;
+var PROBE_SOURCE = `
+const { workerData } = require("node:worker_threads");
+const https = require("node:https");
+const { port, ca, timeoutMs, shared, ok, failed, headerSlots } = workerData;
+const header = new Int32Array(shared, 0, headerSlots);
+const reason = new Uint8Array(shared, headerSlots * 4);
+let done = false;
+const finish = (verdict, message) => {
+  if (done) return;
+  done = true;
+  const bytes = Buffer.from(String(message), "utf8").subarray(0, reason.length);
+  reason.set(bytes);
+  Atomics.store(header, 1, bytes.length);
+  Atomics.store(header, 0, verdict);
+  Atomics.notify(header, 0);
+};
+const request = https.get({ host: "127.0.0.1", port, path: "/healthz", ca: [ca], agent: false }, (response) => {
+  let body = "";
+  response.setEncoding("utf8");
+  response.on("data", (chunk) => { body += chunk; });
+  response.on("end", () => {
+    if (response.statusCode === 200 && body === "ok") finish(ok, "");
+    else finish(failed, "the listener answered its health probe with HTTP " + String(response.statusCode));
+  });
+  response.on("error", (error) => finish(failed, error.message));
+});
+// A hard deadline over the whole exchange, handshake included: a listener that accepts the connection and then says nothing must still fail the probe.
+setTimeout(() => { request.destroy(new Error("no answer within " + String(timeoutMs) + "ms")); }, timeoutMs);
+request.on("error", (error) => finish(failed, (error.code ? error.code + ": " : "") + error.message));
+`;
+function probeFrontDoorSync(port, caPem) {
+  const shared = new SharedArrayBuffer(HEADER_SLOTS * INT32_BYTES + REASON_BYTES);
+  const header = new Int32Array(shared, 0, HEADER_SLOTS);
+  const worker = new import_node_worker_threads.Worker(PROBE_SOURCE, {
+    eval: true,
+    workerData: { port, ca: caPem, timeoutMs: PROBE_TIMEOUT_MS, shared, ok: VERDICT_OK, failed: VERDICT_FAILED, headerSlots: HEADER_SLOTS }
+  });
+  worker.unref();
+  try {
+    const waited = Atomics.wait(header, 0, VERDICT_PENDING, PROBE_TIMEOUT_MS + PROBE_WAIT_MARGIN_MS);
+    const verdict = Atomics.load(header, 0);
+    if (waited === "timed-out" || verdict === VERDICT_PENDING) {
+      return { ok: false, reason: `the probe did not finish within ${String(PROBE_TIMEOUT_MS + PROBE_WAIT_MARGIN_MS)}ms` };
+    }
+    if (verdict === VERDICT_OK) {
+      return { ok: true };
+    }
+    const length = Atomics.load(header, 1);
+    return { ok: false, reason: Buffer.from(new Uint8Array(shared, HEADER_SLOTS * INT32_BYTES, length)).toString("utf8") };
+  } finally {
+    void worker.terminate();
+  }
+}
+
+// src/frontdoor/trust.ts
+var import_node_crypto14 = require("node:crypto");
+var import_node_path35 = __toESM(require("node:path"), 1);
+var BUNDLE_NAME_HEX_DIGITS = 16;
+function resolveTrustBundle(params) {
+  const { caCertFile, bundlesDir, inherited, fs: fs19 } = params;
+  if (inherited === void 0 || inherited === "" || import_node_path35.default.resolve(inherited) === import_node_path35.default.resolve(caCertFile)) {
+    return { path: caCertFile };
+  }
+  const caPem = fs19.readFileUtf8(caCertFile);
+  let inheritedPem;
+  try {
+    inheritedPem = fs19.readFileUtf8(inherited);
+  } catch (error62) {
+    return {
+      path: caCertFile,
+      warning: `agent-shim: NODE_EXTRA_CA_CERTS names ${inherited}, which could not be read (${error62 instanceof Error ? error62.message : String(error62)}); the child trusts agent-shim's front-door CA on top of the system store, and nothing from that file`
+    };
+  }
+  if (inheritedPem.includes(caPem.trim())) {
+    return { path: inherited };
+  }
+  const combined = `${inheritedPem.trimEnd()}
+${caPem}`;
+  const bundle = import_node_path35.default.join(bundlesDir, `${(0, import_node_crypto14.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
+  if (!fs19.exists(bundle)) {
+    fs19.mkdirp(bundlesDir);
+    fs19.writeFileAtomic(bundle, combined);
+  }
+  return { path: bundle };
+}
+
+// src/frontdoor/realFrontDoorPort.ts
+var realTrustBundleFs = {
+  readFileUtf8: (file2) => import_node_fs16.default.readFileSync(file2, "utf8"),
+  exists: (file2) => import_node_fs16.default.existsSync(file2),
+  mkdirp: (dir) => {
+    import_node_fs16.default.mkdirSync(dir, { recursive: true });
+  },
+  writeFileAtomic: (file2, contents) => {
+    realFarmFs.writeFilePrivate(file2, contents);
+  }
+};
+function realFrontDoorPort(paths, spawnDaemon) {
+  return {
+    ensure: (inheritedExtraCaCerts) => {
+      const up = ensureFrontDoor({
+        paths,
+        launcherPid: process.pid,
+        ports: {
+          fs: realFarmFs,
+          isRunning: realIsProcessRunning,
+          now: () => Date.now(),
+          sleep: realSleepSync,
+          spawnSupervisor: (layout) => spawnDaemon(layout, "__frontdoor-supervisor", layout.frontdoorLogPath),
+          stopSupervisor: (pid) => {
+            process.kill(pid, "SIGTERM");
+          },
+          // Read fresh for each probe: a replacement supervisor may have regenerated an unparseable CA, and the probe must trust exactly what the serving door's leaf chains to.
+          verifyListener: (port) => probeFrontDoorSync(port, import_node_fs16.default.readFileSync(paths.frontdoorCaCertFile, "utf8"))
+        }
+      });
+      const trust = resolveTrustBundle({ caCertFile: paths.frontdoorCaCertFile, bundlesDir: paths.frontdoorCaBundlesDir, inherited: inheritedExtraCaCerts, fs: realTrustBundleFs });
+      return {
+        port: up.port,
+        connectPort: up.connectPort,
+        trustBundlePath: trust.path,
+        ...trust.warning === void 0 ? {} : { trustWarning: trust.warning },
+        sessionToken: up.token
+      };
+    },
+    release: () => {
+      removeFrontDoorSession(realFarmFs, paths.frontdoorSessionsDir, process.pid);
+    }
+  };
+}
+
 // src/launcher.ts
 var import_node_crypto15 = require("node:crypto");
 var import_node_path37 = __toESM(require("node:path"), 1);
@@ -69517,7 +69570,7 @@ function resolveIdentityCredential(identity, credential, env, port) {
   return resolution.ok ? resolution : { ok: false, status: CREDENTIAL_UNAVAILABLE_EXIT, message: resolution.message };
 }
 function pickFromPool(decided, params, parsedArgv) {
-  const { paths, fs: fs18, proc, log } = params;
+  const { paths, fs: fs19, proc, log } = params;
   if (decided.pool === void 0) {
     return { identityDecision: decided };
   }
@@ -69531,7 +69584,7 @@ function pickFromPool(decided, params, parsedArgv) {
     selectedVia: decided.source,
     pools: params.pools,
     paths,
-    fs: fs18,
+    fs: fs19,
     usageFs: farmRuntime.fs,
     cwd: farmRuntime.cwd,
     now: farmRuntime.now,
@@ -69546,8 +69599,8 @@ function pickFromPool(decided, params, parsedArgv) {
   }
   return { identityDecision: { ...decided, name: resolution.identity }, poolExplanation: resolution.explanation };
 }
-function runLauncher(params) {
-  const { paths, fs: fs18, spawn: spawn3, proc, log } = params;
+function prepareLaunch(params) {
+  const { paths, fs: fs19, proc, log } = params;
   const { env, argv } = proc;
   const parsedArgv = parseLauncherArgv(argv);
   const cliOverride = buildCliOverride({
@@ -69562,7 +69615,7 @@ function runLauncher(params) {
     argv0Identity: parsedArgv.identity,
     directoryPinnedIdentity: params.directoryPinnedIdentity,
     readActiveIdentityFile: () => {
-      const raw = fs18.readFileUtf8(paths.activeIdentityFile);
+      const raw = fs19.readFileUtf8(paths.activeIdentityFile);
       if (raw === void 0) {
         return void 0;
       }
@@ -69597,7 +69650,7 @@ function runLauncher(params) {
   }
   let loadedIdentity;
   if (identityDecision.name !== void 0) {
-    loadedIdentity = loadIdentity(paths.identitiesDir, identityDecision.name, fs18);
+    loadedIdentity = loadIdentity(paths.identitiesDir, identityDecision.name, fs19);
     if (loadedIdentity === void 0) {
       log.error(
         `agent-shim: no identity named "${identityDecision.name}" (selected via ${identityDecision.source}). Run \`agent-shim identity add ${identityDecision.name}\` first.`
@@ -69612,7 +69665,7 @@ function runLauncher(params) {
     identityDefaultConfigProfile: loadedIdentity?.config.defaultConfigProfile,
     globalDefaultConfigProfile: params.globalDefaultConfigProfile
   });
-  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs18.readConfigFile(import_node_path37.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
+  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs19.readConfigFile(import_node_path37.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
     log.error(
       `agent-shim: no configuration profile named "${configProfileDecision.name}" (selected via ${configProfileDecision.source}). Run \`agent-shim profile add ${configProfileDecision.name}\` first.`
     );
@@ -69621,7 +69674,7 @@ function runLauncher(params) {
   const farmContext = farm !== void 0 && farmIdentity !== void 0 ? { farm, identity: farmIdentity, cascade: farm.loadCascade(configProfileDecision.name, cliOverride) } : void 0;
   const provider = parsedArgv.provider === false ? void 0 : resolveProvider({
     paths,
-    port: fs18,
+    port: fs19,
     env,
     ...params.credentials === void 0 ? {} : { credentials: params.credentials },
     ...parsedArgv.provider === void 0 ? {} : { cliProvider: parsedArgv.provider },
@@ -69773,32 +69826,25 @@ function runLauncher(params) {
     sessionId: (0, import_node_crypto15.randomUUID)()
   });
   const releases = [...headroom === void 0 || headroomPort === void 0 ? [] : [headroomPort.release], ...frontDoorRelease === void 0 ? [] : [frontDoorRelease]];
-  if (releases.length === 0) {
-    spawnClaude({ bin: discovered.path, args: finalArgv, env: finalEnv, spawn: spawn3, proc });
-  }
-  const releaseAll = () => {
-    for (const release of releases) {
-      release();
+  const release = () => {
+    for (const registered of releases) {
+      registered();
     }
   };
+  return { bin: discovered.path, args: finalArgv, env: finalEnv, release };
+}
+function runLauncher(params) {
+  const plan = prepareLaunch(params);
   try {
-    spawnClaude({
-      bin: discovered.path,
-      args: finalArgv,
-      env: finalEnv,
-      spawn: spawn3,
-      proc,
-      beforeExit: releaseAll
-    });
+    spawnClaude({ bin: plan.bin, args: plan.args, env: plan.env, spawn: params.spawn, proc: params.proc, beforeExit: plan.release });
   } finally {
-    releaseAll();
+    plan.release();
   }
 }
 
-// src/runClaude.ts
-function buildFarmRuntime(paths) {
+// src/launchWiring.ts
+function buildFarmRuntime(paths, cwd) {
   const home = import_node_os8.default.homedir();
-  const cwd = process.cwd();
   const read = cosmiconfigReader();
   const classification = loadClassification(paths);
   const loaded = loadCascadeInput({ paths, home, cwd, read });
@@ -69832,9 +69878,30 @@ function buildFarmRuntime(paths) {
     ...loaded.globalConfig?.pools === void 0 ? {} : { pools: loaded.globalConfig.pools }
   };
 }
+function realPrepareLaunchParams(paths, options) {
+  const { farm } = options;
+  return {
+    paths,
+    fs: realFsPort,
+    proc: options.proc,
+    log: options.log,
+    resolveClaudeBinary: realResolveClaudeBinary(resolveOwnInstallDirs(paths, realOwnExecutablePath())),
+    farm: farm.runtime,
+    headroom: realHeadroomPort(paths, { spawnDaemon: options.spawnDaemon, cwd: farm.runtime.cwd }),
+    frontdoor: realFrontDoorPort(paths, options.spawnDaemon),
+    credentials: { ...realCredentialPort, cache: realCredentialCacheEnv(paths) },
+    ...farm.directoryIdentity === void 0 ? {} : { directoryPinnedIdentity: farm.directoryIdentity },
+    ...farm.directoryConfigProfile === void 0 ? {} : { directoryRuleConfigProfile: farm.directoryConfigProfile },
+    ...farm.globalDefaultConfigProfile === void 0 ? {} : { globalDefaultConfigProfile: farm.globalDefaultConfigProfile },
+    ...farm.pools === void 0 ? {} : { pools: farm.pools },
+    ...options.allowMissingConfigProfile === void 0 ? {} : { allowMissingConfigProfile: options.allowMissingConfigProfile }
+  };
+}
+
+// src/runClaude.ts
 async function runClaude(argvOverride) {
   const paths = resolveLayoutPaths();
-  const farm = buildFarmRuntime(paths);
+  const farm = buildFarmRuntime(paths, process.cwd());
   let allowMissingConfigProfile = false;
   if (process.stdin.isTTY) {
     const procForDecision = argvOverride === void 0 ? realProcPort : { ...realProcPort, argv: argvOverride };
@@ -69884,21 +69951,14 @@ async function runClaude(argvOverride) {
     }
   }
   runLauncher({
-    paths,
-    fs: realFsPort,
-    spawn: realSpawnPort,
-    proc: argvOverride === void 0 ? realProcPort : { ...realProcPort, argv: argvOverride },
-    log: realLogPort,
-    resolveClaudeBinary: realResolveClaudeBinary(resolveOwnInstallDirs(paths, realOwnExecutablePath())),
-    farm: farm.runtime,
-    headroom: realHeadroomPort(paths),
-    frontdoor: realFrontDoorPort(paths),
-    credentials: { ...realCredentialPort, cache: realCredentialCacheEnv(paths) },
-    ...farm.directoryIdentity === void 0 ? {} : { directoryPinnedIdentity: farm.directoryIdentity },
-    ...farm.directoryConfigProfile === void 0 ? {} : { directoryRuleConfigProfile: farm.directoryConfigProfile },
-    ...farm.globalDefaultConfigProfile === void 0 ? {} : { globalDefaultConfigProfile: farm.globalDefaultConfigProfile },
-    ...farm.pools === void 0 ? {} : { pools: farm.pools },
-    allowMissingConfigProfile
+    ...realPrepareLaunchParams(paths, {
+      proc: argvOverride === void 0 ? realProcPort : { ...realProcPort, argv: argvOverride },
+      log: realLogPort,
+      spawnDaemon: spawnDetachedSupervisor,
+      farm,
+      allowMissingConfigProfile
+    }),
+    spawn: realSpawnPort
   });
 }