npm - claude-use - Versions diffs - 7.13.2 → 8.0.0 - Mend

claude-use 7.13.2 → 8.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/dist/cli.cjs CHANGED Viewed

@@ -3248,42 +3248,42 @@ var require_defaults = __commonJS({
 var require_env_paths = __commonJS({
   "node_modules/.pnpm/env-paths@2.2.1/node_modules/env-paths/index.js"(exports2, module2) {
     "use strict";
-    var path40 = require("path");
+    var path41 = require("path");
     var os9 = require("os");
     var homedir = os9.homedir();
     var tmpdir = os9.tmpdir();
     var { env } = process;
     var macos = (name) => {
-      const library = path40.join(homedir, "Library");
+      const library = path41.join(homedir, "Library");
       return {
-        data: path40.join(library, "Application Support", name),
-        config: path40.join(library, "Preferences", name),
-        cache: path40.join(library, "Caches", name),
-        log: path40.join(library, "Logs", name),
-        temp: path40.join(tmpdir, name)
+        data: path41.join(library, "Application Support", name),
+        config: path41.join(library, "Preferences", name),
+        cache: path41.join(library, "Caches", name),
+        log: path41.join(library, "Logs", name),
+        temp: path41.join(tmpdir, name)
       };
     };
     var windows = (name) => {
-      const appData = env.APPDATA || path40.join(homedir, "AppData", "Roaming");
-      const localAppData = env.LOCALAPPDATA || path40.join(homedir, "AppData", "Local");
+      const appData = env.APPDATA || path41.join(homedir, "AppData", "Roaming");
+      const localAppData = env.LOCALAPPDATA || path41.join(homedir, "AppData", "Local");
       return {
         // Data/config/cache/log are invented by me as Windows isn't opinionated about this
-        data: path40.join(localAppData, name, "Data"),
-        config: path40.join(appData, name, "Config"),
-        cache: path40.join(localAppData, name, "Cache"),
-        log: path40.join(localAppData, name, "Log"),
-        temp: path40.join(tmpdir, name)
+        data: path41.join(localAppData, name, "Data"),
+        config: path41.join(appData, name, "Config"),
+        cache: path41.join(localAppData, name, "Cache"),
+        log: path41.join(localAppData, name, "Log"),
+        temp: path41.join(tmpdir, name)
       };
     };
     var linux = (name) => {
-      const username = path40.basename(homedir);
+      const username = path41.basename(homedir);
       return {
-        data: path40.join(env.XDG_DATA_HOME || path40.join(homedir, ".local", "share"), name),
-        config: path40.join(env.XDG_CONFIG_HOME || path40.join(homedir, ".config"), name),
-        cache: path40.join(env.XDG_CACHE_HOME || path40.join(homedir, ".cache"), name),
+        data: path41.join(env.XDG_DATA_HOME || path41.join(homedir, ".local", "share"), name),
+        config: path41.join(env.XDG_CONFIG_HOME || path41.join(homedir, ".config"), name),
+        cache: path41.join(env.XDG_CACHE_HOME || path41.join(homedir, ".cache"), name),
         // https://wiki.debian.org/XDGBaseDirectorySpecification#state
-        log: path40.join(env.XDG_STATE_HOME || path40.join(homedir, ".local", "state"), name),
-        temp: path40.join(tmpdir, username, name)
+        log: path41.join(env.XDG_STATE_HOME || path41.join(homedir, ".local", "state"), name),
+        temp: path41.join(tmpdir, username, name)
       };
     };
     var envPaths = (name, options) => {
@@ -3351,11 +3351,11 @@ var require_util = __commonJS({
       return result;
     }
     exports2.emplace = emplace;
-    function getPropertyByPath(source, path40) {
-      if (typeof path40 === "string" && Object.prototype.hasOwnProperty.call(source, path40)) {
-        return source[path40];
+    function getPropertyByPath(source, path41) {
+      if (typeof path41 === "string" && Object.prototype.hasOwnProperty.call(source, path41)) {
+        return source[path41];
       }
-      const parsedPath = typeof path40 === "string" ? path40.split(".") : path40;
+      const parsedPath = typeof path41 === "string" ? path41.split(".") : path41;
       return parsedPath.reduce((previous, key) => {
         if (previous === void 0) {
           return previous;
@@ -3378,9 +3378,9 @@ var require_util = __commonJS({
       return Object.fromEntries(Object.entries(options).filter(([, value]) => value !== void 0));
     }
     exports2.removeUndefinedValuesFromObject = removeUndefinedValuesFromObject;
-    async function isDirectory(path40) {
+    async function isDirectory(path41) {
       try {
-        const stat = await fs_1.promises.stat(path40);
+        const stat = await fs_1.promises.stat(path41);
         return stat.isDirectory();
       } catch (e) {
         if (e.code === "ENOENT") {
@@ -3390,9 +3390,9 @@ var require_util = __commonJS({
       }
     }
     exports2.isDirectory = isDirectory;
-    function isDirectorySync(path40) {
+    function isDirectorySync(path41) {
       try {
-        const stat = fs_1.default.statSync(path40);
+        const stat = fs_1.default.statSync(path41);
         return stat.isDirectory();
       } catch (e) {
         if (e.code === "ENOENT") {
@@ -3490,7 +3490,7 @@ var require_ExplorerBase = __commonJS({
           const idx = importStack.indexOf(fullPath);
           if (idx !== -1) {
             throw new Error(`Circular import detected:
-${[...importStack, fullPath].map((path40, i2) => `${i2 + 1}. ${path40}`).join("\n")} (same as ${idx + 1}.)`);
+${[...importStack, fullPath].map((path41, i2) => `${i2 + 1}. ${path41}`).join("\n")} (same as ${idx + 1}.)`);
           }
         }
       }
@@ -3678,9 +3678,9 @@ var require_Explorer = __commonJS({
           throw error62;
         }
       }
-      async #fileExists(path40) {
+      async #fileExists(path41) {
         try {
-          await promises_1.default.stat(path40);
+          await promises_1.default.stat(path41);
           return true;
         } catch (e) {
           return false;
@@ -3840,9 +3840,9 @@ var require_ExplorerSync = __commonJS({
           throw error62;
         }
       }
-      #fileExists(path40) {
+      #fileExists(path41) {
         try {
-          fs_1.default.statSync(path40);
+          fs_1.default.statSync(path41);
           return true;
         } catch (e) {
           return false;
@@ -3966,7 +3966,7 @@ var require_dist = __commonJS({
       };
     }
     function getResolvedSearchPlaces(moduleName, toolDefinedSearchPlaces, userConfiguredOptions) {
-      const userConfiguredSearchPlaces = userConfiguredOptions.searchPlaces?.map((path40) => path40.replace("{name}", moduleName));
+      const userConfiguredSearchPlaces = userConfiguredOptions.searchPlaces?.map((path41) => path41.replace("{name}", moduleName));
       if (userConfiguredOptions.mergeSearchPlaces) {
         return [...userConfiguredSearchPlaces ?? [], ...toolDefinedSearchPlaces];
       }
@@ -4374,8 +4374,8 @@ var require_utils = __commonJS({
       }
       return output2;
     };
-    exports2.basename = (path40, { windows } = {}) => {
-      const segs = path40.split(windows ? /[\\/]/ : "/");
+    exports2.basename = (path41, { windows } = {}) => {
+      const segs = path41.split(windows ? /[\\/]/ : "/");
       const last = segs[segs.length - 1];
       if (last === "") {
         return segs[segs.length - 2];
@@ -6891,7 +6891,7 @@ var require_util2 = __commonJS({
     var { kDestroyed, kBodyUsed, kListeners, kBody } = require_symbols();
     var { IncomingMessage } = require("node:http");
     var stream = require("node:stream");
-    var net5 = require("node:net");
+    var net3 = require("node:net");
     var { stringify } = require("node:querystring");
     var { EventEmitter: EE } = require("node:events");
     var timers = require_timers();
@@ -7003,14 +7003,14 @@ var require_util2 = __commonJS({
         }
         const port = url2.port != null ? url2.port : url2.protocol === "https:" ? 443 : 80;
         let origin = url2.origin != null ? url2.origin : `${url2.protocol || ""}//${url2.hostname || ""}:${port}`;
-        let path40 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`;
+        let path41 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`;
         if (origin[origin.length - 1] === "/") {
           origin = origin.slice(0, origin.length - 1);
         }
-        if (path40 && path40[0] !== "/") {
-          path40 = `/${path40}`;
+        if (path41 && path41[0] !== "/") {
+          path41 = `/${path41}`;
         }
-        return new URL(`${origin}${path40}`);
+        return new URL(`${origin}${path41}`);
       }
       if (!isHttpOrHttpsPrefixed(url2.origin || url2.protocol)) {
         throw new InvalidArgumentError2("Invalid URL protocol: the URL must start with `http:` or `https:`.");
@@ -7040,7 +7040,7 @@ var require_util2 = __commonJS({
       }
       assert2(typeof host === "string");
       const servername = getHostname(host);
-      if (net5.isIP(servername)) {
+      if (net3.isIP(servername)) {
         return "";
       }
       return servername;
@@ -7831,9 +7831,9 @@ var require_diagnostics = __commonJS({
         "undici:client:sendHeaders",
         (evt) => {
           const {
-            request: { method, path: path40, origin }
+            request: { method, path: path41, origin }
           } = evt;
-          debugLog("sending request to %s %s%s", method, origin, path40);
+          debugLog("sending request to %s %s%s", method, origin, path41);
         }
       );
     }
@@ -7851,14 +7851,14 @@ var require_diagnostics = __commonJS({
         "undici:request:headers",
         (evt) => {
           const {
-            request: { method, path: path40, origin },
+            request: { method, path: path41, origin },
             response: { statusCode }
           } = evt;
           debugLog(
             "received response to %s %s%s - HTTP %d",
             method,
             origin,
-            path40,
+            path41,
             statusCode
           );
         }
@@ -7867,23 +7867,23 @@ var require_diagnostics = __commonJS({
         "undici:request:trailers",
         (evt) => {
           const {
-            request: { method, path: path40, origin }
+            request: { method, path: path41, origin }
           } = evt;
-          debugLog("trailers received from %s %s%s", method, origin, path40);
+          debugLog("trailers received from %s %s%s", method, origin, path41);
         }
       );
       diagnosticsChannel.subscribe(
         "undici:request:error",
         (evt) => {
           const {
-            request: { method, path: path40, origin },
+            request: { method, path: path41, origin },
             error: error62
           } = evt;
           debugLog(
             "request to %s %s%s errored - %s",
             method,
             origin,
-            path40,
+            path41,
             error62.message
           );
         }
@@ -7998,7 +7998,7 @@ var require_request = __commonJS({
     var kHandler = /* @__PURE__ */ Symbol("handler");
     var Request = class {
       constructor(origin, {
-        path: path40,
+        path: path41,
         method,
         body,
         headers,
@@ -8015,11 +8015,11 @@ var require_request = __commonJS({
         maxRedirections,
         typeOfService
       }, handler) {
-        if (typeof path40 !== "string") {
+        if (typeof path41 !== "string") {
           throw new InvalidArgumentError2("path must be a string");
-        } else if (path40[0] !== "/" && !(path40.startsWith("http://") || path40.startsWith("https://")) && method !== "CONNECT") {
+        } else if (path41[0] !== "/" && !(path41.startsWith("http://") || path41.startsWith("https://")) && method !== "CONNECT") {
           throw new InvalidArgumentError2("path must be an absolute URL or start with a slash");
-        } else if (invalidPathRegex.test(path40)) {
+        } else if (invalidPathRegex.test(path41)) {
           throw new InvalidArgumentError2("invalid request path");
         }
         if (typeof method !== "string") {
@@ -8094,7 +8094,7 @@ var require_request = __commonJS({
         this.completed = false;
         this.aborted = false;
         this.upgrade = upgrade || null;
-        this.path = query ? serializePathWithQuery(path40, query) : path40;
+        this.path = query ? serializePathWithQuery(path41, query) : path41;
         this.origin = origin;
         this.protocol = getProtocolFromUrlString(origin);
         this.idempotent = idempotent == null ? method === "HEAD" || method === "GET" : idempotent;
@@ -8703,7 +8703,7 @@ var require_dispatcher_base = __commonJS({
 var require_connect = __commonJS({
   "node_modules/.pnpm/undici@7.29.1/node_modules/undici/lib/core/connect.js"(exports2, module2) {
     "use strict";
-    var net5 = require("node:net");
+    var net3 = require("node:net");
     var assert2 = require("node:assert");
     var util = require_util2();
     var { InvalidArgumentError: InvalidArgumentError2 } = require_errors();
@@ -8786,7 +8786,7 @@ var require_connect = __commonJS({
         } else {
           assert2(!httpSocket, "httpSocket can only be sent on TLS update");
           port = port || 80;
-          socket = net5.connect({
+          socket = net3.connect({
             highWaterMark: 64 * 1024,
             // Same as nodejs fs streams.
             ...options,
@@ -13276,7 +13276,7 @@ var require_client_h1 = __commonJS({
       return method !== "GET" && method !== "HEAD" && method !== "OPTIONS" && method !== "TRACE" && method !== "CONNECT";
     }
     function writeH1(client, request6) {
-      const { method, path: path40, host, upgrade, blocking, reset } = request6;
+      const { method, path: path41, host, upgrade, blocking, reset } = request6;
       let { body, headers, contentLength } = request6;
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH" || method === "QUERY" || method === "PROPFIND" || method === "PROPPATCH";
       if (util.isFormDataLike(body)) {
@@ -13354,7 +13354,7 @@ var require_client_h1 = __commonJS({
       if (socket.setTypeOfService) {
         socket.setTypeOfService(request6.typeOfService);
       }
-      let header = `${method} ${path40} HTTP/1.1\r
+      let header = `${method} ${path41} HTTP/1.1\r
 `;
       if (typeof host === "string") {
         header += `host: ${host}\r
@@ -14033,7 +14033,7 @@ var require_client_h2 = __commonJS({
       const headersTimeout = request6.headersTimeout ?? client[kHeadersTimeout];
       const bodyTimeout = request6.bodyTimeout ?? client[kBodyTimeout];
       const session = client[kHTTP2Session];
-      const { method, path: path40, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request6;
+      const { method, path: path41, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request6;
       let { body } = request6;
       if (upgrade != null && upgrade !== "websocket") {
         util.errorRequest(client, request6, new InvalidArgumentError2(`Custom upgrade "${upgrade}" not supported over HTTP/2`));
@@ -14102,7 +14102,7 @@ var require_client_h2 = __commonJS({
           }
           headers[HTTP2_HEADER_METHOD] = "CONNECT";
           headers[HTTP2_HEADER_PROTOCOL] = "websocket";
-          headers[HTTP2_HEADER_PATH] = path40;
+          headers[HTTP2_HEADER_PATH] = path41;
           if (protocol === "ws:" || protocol === "wss:") {
             headers[HTTP2_HEADER_SCHEME] = protocol === "ws:" ? "http" : "https";
           } else {
@@ -14144,7 +14144,7 @@ var require_client_h2 = __commonJS({
         stream.setTimeout(headersTimeout);
         return true;
       }
-      headers[HTTP2_HEADER_PATH] = path40;
+      headers[HTTP2_HEADER_PATH] = path41;
       headers[HTTP2_HEADER_SCHEME] = protocol === "http:" ? "http" : "https";
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH";
       if (body && typeof body.read === "function") {
@@ -14463,8 +14463,8 @@ var require_client = __commonJS({
   "node_modules/.pnpm/undici@7.29.1/node_modules/undici/lib/dispatcher/client.js"(exports2, module2) {
     "use strict";
     var assert2 = require("node:assert");
-    var net5 = require("node:net");
-    var http5 = require("node:http");
+    var net3 = require("node:net");
+    var http6 = require("node:http");
     var util = require_util2();
     var { ClientStats } = require_stats();
     var { channels } = require_diagnostics();
@@ -14522,7 +14522,7 @@ var require_client = __commonJS({
     var connectH1 = require_client_h1();
     var connectH2 = require_client_h2();
     var kClosedResolve = /* @__PURE__ */ Symbol("kClosedResolve");
-    var getDefaultNodeMaxHeaderSize = http5 && http5.maxHeaderSize && Number.isInteger(http5.maxHeaderSize) && http5.maxHeaderSize > 0 ? () => http5.maxHeaderSize : () => {
+    var getDefaultNodeMaxHeaderSize = http6 && http6.maxHeaderSize && Number.isInteger(http6.maxHeaderSize) && http6.maxHeaderSize > 0 ? () => http6.maxHeaderSize : () => {
       throw new InvalidArgumentError2("http module not available or http.maxHeaderSize invalid");
     };
     var noop = () => {
@@ -14618,7 +14618,7 @@ var require_client = __commonJS({
         if (maxRequestsPerClient != null && (!Number.isInteger(maxRequestsPerClient) || maxRequestsPerClient < 0)) {
           throw new InvalidArgumentError2("maxRequestsPerClient must be a positive number");
         }
-        if (localAddress != null && (typeof localAddress !== "string" || net5.isIP(localAddress) === 0)) {
+        if (localAddress != null && (typeof localAddress !== "string" || net3.isIP(localAddress) === 0)) {
           throw new InvalidArgumentError2("localAddress must be valid string IP address");
         }
         if (maxResponseSize != null && (!Number.isInteger(maxResponseSize) || maxResponseSize < -1)) {
@@ -14798,7 +14798,7 @@ var require_client = __commonJS({
         const idx = hostname3.indexOf("]");
         assert2(idx !== -1);
         const ip = hostname3.substring(1, idx);
-        assert2(net5.isIPv6(ip));
+        assert2(net3.isIPv6(ip));
         hostname3 = ip;
       }
       client[kConnecting] = true;
@@ -15625,7 +15625,7 @@ var require_agent = __commonJS({
     function defaultFactory(origin, opts) {
       return opts && opts.connections === 1 ? new Client(origin, opts) : new Pool(origin, opts);
     }
-    var Agent7 = class extends DispatcherBase {
+    var Agent5 = class extends DispatcherBase {
       constructor({ factory = defaultFactory, maxOrigins = Infinity, connect: connect3, ...options } = {}) {
         if (typeof factory !== "function") {
           throw new InvalidArgumentError2("factory must be a function.");
@@ -15734,7 +15734,7 @@ var require_agent = __commonJS({
         return allClientStats;
       }
     };
-    module2.exports = Agent7;
+    module2.exports = Agent5;
   }
 });
@@ -15743,10 +15743,10 @@ var require_socks5_utils = __commonJS({
   "node_modules/.pnpm/undici@7.29.1/node_modules/undici/lib/core/socks5-utils.js"(exports2, module2) {
     "use strict";
     var { Buffer: Buffer2 } = require("node:buffer");
-    var net5 = require("node:net");
+    var net3 = require("node:net");
     var { InvalidArgumentError: InvalidArgumentError2 } = require_errors();
     function parseAddress(address) {
-      if (net5.isIPv4(address)) {
+      if (net3.isIPv4(address)) {
         const parts = address.split(".").map(Number);
         return {
           type: 1,
@@ -15754,7 +15754,7 @@ var require_socks5_utils = __commonJS({
           buffer: Buffer2.from(parts)
         };
       }
-      if (net5.isIPv6(address)) {
+      if (net3.isIPv6(address)) {
         return {
           type: 4,
           // IPv6
@@ -15777,7 +15777,7 @@ var require_socks5_utils = __commonJS({
       if (address.includes(".")) {
         const lastColonIndex = address.lastIndexOf(":");
         const ipv4Part = address.slice(lastColonIndex + 1);
-        if (net5.isIPv4(ipv4Part)) {
+        if (net3.isIPv4(ipv4Part)) {
           const octets = ipv4Part.split(".").map(Number);
           const high = (octets[0] << 8 | octets[1]).toString(16);
           const low = (octets[2] << 8 | octets[3]).toString(16);
@@ -16440,7 +16440,7 @@ var require_proxy_agent = __commonJS({
   "node_modules/.pnpm/undici@7.29.1/node_modules/undici/lib/dispatcher/proxy-agent.js"(exports2, module2) {
     "use strict";
     var { kProxy, kClose, kDestroy, kDispatch } = require_symbols();
-    var Agent7 = require_agent();
+    var Agent5 = require_agent();
     var Pool = require_pool();
     var DispatcherBase = require_dispatcher_base();
     var { InvalidArgumentError: InvalidArgumentError2, RequestAbortedError, SecureProxyConnectionError } = require_errors();
@@ -16496,10 +16496,10 @@ var require_proxy_agent = __commonJS({
         };
         const {
           origin,
-          path: path40 = "/",
+          path: path41 = "/",
           headers = {}
         } = opts;
-        opts.path = origin + path40;
+        opts.path = origin + path41;
         if (!("host" in headers) && !("Host" in headers)) {
           const { host } = new URL(origin);
           headers.host = host;
@@ -16571,7 +16571,7 @@ var require_proxy_agent = __commonJS({
         } else {
           this[kClient] = clientFactory(url2, { connect: connect3 });
         }
-        this[kAgent] = new Agent7({
+        this[kAgent] = new Agent5({
           ...opts,
           factory,
           connect: async (opts2, callback) => {
@@ -16699,7 +16699,7 @@ var require_env_http_proxy_agent = __commonJS({
     var DispatcherBase = require_dispatcher_base();
     var { kClose, kDestroy, kClosed, kDestroyed, kDispatch, kNoProxyAgent, kHttpProxyAgent, kHttpsProxyAgent } = require_symbols();
     var ProxyAgent = require_proxy_agent();
-    var Agent7 = require_agent();
+    var Agent5 = require_agent();
     var DEFAULT_PORTS = {
       "http:": 80,
       "https:": 443
@@ -16712,7 +16712,7 @@ var require_env_http_proxy_agent = __commonJS({
         super();
         this.#opts = opts;
         const { httpProxy, httpsProxy, noProxy, ...agentOpts } = opts;
-        this[kNoProxyAgent] = new Agent7(agentOpts);
+        this[kNoProxyAgent] = new Agent5(agentOpts);
         const HTTP_PROXY = httpProxy ?? process.env.http_proxy ?? process.env.HTTP_PROXY;
         if (HTTP_PROXY) {
           this[kHttpProxyAgent] = new ProxyAgent({ ...agentOpts, uri: HTTP_PROXY });
@@ -18608,20 +18608,20 @@ var require_mock_utils = __commonJS({
       }
       return normalizedQp;
     }
-    function safeUrl(path40) {
-      if (typeof path40 !== "string") {
-        return path40;
+    function safeUrl(path41) {
+      if (typeof path41 !== "string") {
+        return path41;
       }
-      const pathSegments = path40.split("?", 3);
+      const pathSegments = path41.split("?", 3);
       if (pathSegments.length !== 2) {
-        return path40;
+        return path41;
       }
       const qp = new URLSearchParams(pathSegments.pop());
       qp.sort();
       return [...pathSegments, qp.toString()].join("?");
     }
-    function matchKey(mockDispatch2, { path: path40, method, body, headers }) {
-      const pathMatch = matchValue(mockDispatch2.path, path40);
+    function matchKey(mockDispatch2, { path: path41, method, body, headers }) {
+      const pathMatch = matchValue(mockDispatch2.path, path41);
       const methodMatch = matchValue(mockDispatch2.method, method);
       const bodyMatch = typeof mockDispatch2.body !== "undefined" ? matchValue(mockDispatch2.body, body) : true;
       const headersMatch = matchHeaders(mockDispatch2, headers);
@@ -18646,8 +18646,8 @@ var require_mock_utils = __commonJS({
       const basePath = key.query ? serializePathWithQuery(key.path, key.query) : key.path;
       const resolvedPath = typeof basePath === "string" ? safeUrl(basePath) : basePath;
       const resolvedPathWithoutTrailingSlash = removeTrailingSlash(resolvedPath);
-      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path40, ignoreTrailingSlash }) => {
-        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path40)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path40), resolvedPath);
+      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path41, ignoreTrailingSlash }) => {
+        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path41)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path41), resolvedPath);
       });
       if (matchedMockDispatches.length === 0) {
         throw new MockNotMatchedError(`Mock dispatch not matched for path '${resolvedPath}'`);
@@ -18686,19 +18686,19 @@ var require_mock_utils = __commonJS({
         mockDispatches.splice(index, 1);
       }
     }
-    function removeTrailingSlash(path40) {
-      while (path40.endsWith("/")) {
-        path40 = path40.slice(0, -1);
+    function removeTrailingSlash(path41) {
+      while (path41.endsWith("/")) {
+        path41 = path41.slice(0, -1);
       }
-      if (path40.length === 0) {
-        path40 = "/";
+      if (path41.length === 0) {
+        path41 = "/";
       }
-      return path40;
+      return path41;
     }
     function buildKey(opts) {
-      const { path: path40, method, body, headers, query } = opts;
+      const { path: path41, method, body, headers, query } = opts;
       return {
-        path: path40,
+        path: path41,
         method,
         body,
         headers,
@@ -19388,10 +19388,10 @@ var require_pending_interceptors_formatter = __commonJS({
       }
       format(pendingInterceptors) {
         const withPrettyHeaders = pendingInterceptors.map(
-          ({ method, path: path40, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
+          ({ method, path: path41, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
             Method: method,
             Origin: origin,
-            Path: path40,
+            Path: path41,
             "Status code": statusCode,
             Persistent: persist ? PERSISTENT : NOT_PERSISTENT,
             Invocations: timesInvoked,
@@ -19410,7 +19410,7 @@ var require_mock_agent = __commonJS({
   "node_modules/.pnpm/undici@7.29.1/node_modules/undici/lib/mock/mock-agent.js"(exports2, module2) {
     "use strict";
     var { kClients } = require_symbols();
-    var Agent7 = require_agent();
+    var Agent5 = require_agent();
     var {
       kAgent,
       kMockAgentSet,
@@ -19448,7 +19448,7 @@ var require_mock_agent = __commonJS({
         if (opts?.agent && typeof opts.agent.dispatch !== "function") {
           throw new InvalidArgumentError2("Argument opts.agent must implement Agent");
         }
-        const agent = opts?.agent ? opts.agent : new Agent7(opts);
+        const agent = opts?.agent ? opts.agent : new Agent5(opts);
         this[kAgent] = agent;
         this[kClients] = agent[kClients];
         this[kOptions] = mockOptions;
@@ -19473,9 +19473,9 @@ var require_mock_agent = __commonJS({
         const acceptNonStandardSearchParameters = this[kMockAgentAcceptsNonStandardSearchParameters];
         const dispatchOpts = { ...opts };
         if (acceptNonStandardSearchParameters && dispatchOpts.path) {
-          const [path40, searchParams] = dispatchOpts.path.split("?");
+          const [path41, searchParams] = dispatchOpts.path.split("?");
           const normalizedSearchParams = normalizeSearchParams(searchParams, acceptNonStandardSearchParameters);
-          dispatchOpts.path = `${path40}?${normalizedSearchParams}`;
+          dispatchOpts.path = `${path41}?${normalizedSearchParams}`;
         }
         return this[kAgent].dispatch(dispatchOpts, handler);
       }
@@ -19876,12 +19876,12 @@ var require_snapshot_recorder = __commonJS({
        * @return {Promise<void>} - Resolves when snapshots are loaded
        */
       async loadSnapshots(filePath) {
-        const path40 = filePath || this.#snapshotPath;
-        if (!path40) {
+        const path41 = filePath || this.#snapshotPath;
+        if (!path41) {
           throw new InvalidArgumentError2("Snapshot path is required");
         }
         try {
-          const data = await readFile(resolve(path40), "utf8");
+          const data = await readFile(resolve(path41), "utf8");
           const parsed = JSON.parse(data);
           if (Array.isArray(parsed)) {
             this.#snapshots.clear();
@@ -19895,7 +19895,7 @@ var require_snapshot_recorder = __commonJS({
           if (error62.code === "ENOENT") {
             this.#snapshots.clear();
           } else {
-            throw new UndiciError(`Failed to load snapshots from ${path40}`, { cause: error62 });
+            throw new UndiciError(`Failed to load snapshots from ${path41}`, { cause: error62 });
           }
         }
       }
@@ -19906,11 +19906,11 @@ var require_snapshot_recorder = __commonJS({
        * @returns {Promise<void>} - Resolves when snapshots are saved
        */
       async saveSnapshots(filePath) {
-        const path40 = filePath || this.#snapshotPath;
-        if (!path40) {
+        const path41 = filePath || this.#snapshotPath;
+        if (!path41) {
           throw new InvalidArgumentError2("Snapshot path is required");
         }
-        const resolvedPath = resolve(path40);
+        const resolvedPath = resolve(path41);
         await mkdir(dirname2(resolvedPath), { recursive: true });
         const data = Array.from(this.#snapshots.entries()).map(([hash2, snapshot]) => ({
           hash: hash2,
@@ -20055,7 +20055,7 @@ var require_snapshot_recorder = __commonJS({
 var require_snapshot_agent = __commonJS({
   "node_modules/.pnpm/undici@7.29.1/node_modules/undici/lib/mock/snapshot-agent.js"(exports2, module2) {
     "use strict";
-    var Agent7 = require_agent();
+    var Agent5 = require_agent();
     var MockAgent = require_mock_agent();
     var { SnapshotRecorder } = require_snapshot_recorder();
     var WrapHandler = require_wrap_handler();
@@ -20106,7 +20106,7 @@ var require_snapshot_agent = __commonJS({
         });
         this[kSnapshotLoaded] = false;
         if (this[kSnapshotMode] === "record" || this[kSnapshotMode] === "update" || this[kSnapshotMode] === "playback" && opts.excludeUrls && opts.excludeUrls.length > 0) {
-          this[kRealAgent] = new Agent7(opts);
+          this[kRealAgent] = new Agent5(opts);
         }
         if ((this[kSnapshotMode] === "playback" || this[kSnapshotMode] === "update") && this[kSnapshotPath]) {
           this.loadSnapshots().catch(() => {
@@ -20345,9 +20345,9 @@ var require_global2 = __commonJS({
     var globalDispatcher = /* @__PURE__ */ Symbol.for("undici.globalDispatcher.2");
     var legacyGlobalDispatcher = /* @__PURE__ */ Symbol.for("undici.globalDispatcher.1");
     var { InvalidArgumentError: InvalidArgumentError2 } = require_errors();
-    var Agent7 = require_agent();
+    var Agent5 = require_agent();
     if (getGlobalDispatcher() === void 0) {
-      setGlobalDispatcher(new Agent7());
+      setGlobalDispatcher(new Agent5());
     }
     function setGlobalDispatcher(agent) {
       if (!agent || typeof agent.dispatch !== "function") {
@@ -20542,15 +20542,15 @@ var require_redirect_handler = __commonJS({
           return;
         }
         const { origin, pathname, search } = util.parseURL(new URL(this.location, this.opts.origin && new URL(this.opts.path, this.opts.origin)));
-        const path40 = search ? `${pathname}${search}` : pathname;
-        const redirectUrlString = `${origin}${path40}`;
+        const path41 = search ? `${pathname}${search}` : pathname;
+        const redirectUrlString = `${origin}${path41}`;
         for (const historyUrl of this.history) {
           if (historyUrl.toString() === redirectUrlString) {
             throw new InvalidArgumentError2(`Redirect loop detected. Cannot redirect to ${origin}. This typically happens when using a Client or Pool with cross-origin redirects. Use an Agent for cross-origin redirects.`);
           }
         }
         this.opts.headers = cleanRequestHeaders(this.opts.headers, statusCode === 303, this.opts.origin !== origin);
-        this.opts.path = path40;
+        this.opts.path = path41;
         this.opts.origin = origin;
         this.opts.query = null;
       }
@@ -20817,7 +20817,7 @@ var require_dump = __commonJS({
 var require_dns = __commonJS({
   "node_modules/.pnpm/undici@7.29.1/node_modules/undici/lib/interceptor/dns.js"(exports2, module2) {
     "use strict";
-    var { isIP } = require("node:net");
+    var { isIP: isIP2 } = require("node:net");
     var { lookup } = require("node:dns");
     var DecoratorHandler = require_decorator_handler();
     var { InvalidArgumentError: InvalidArgumentError2, InformationalError } = require_errors();
@@ -21223,7 +21223,7 @@ var require_dns = __commonJS({
       return (dispatch) => {
         return function dnsInterceptor(origDispatchOpts, handler) {
           const origin = origDispatchOpts.origin.constructor === URL ? origDispatchOpts.origin : new URL(origDispatchOpts.origin);
-          if (isIP(origin.hostname) !== 0) {
+          if (isIP2(origin.hostname) !== 0) {
             return dispatch(origDispatchOpts, handler);
           }
           instance.runLookup(origin, origDispatchOpts, (err, newOrigin) => {
@@ -22310,10 +22310,10 @@ var require_cache_handler = __commonJS({
       }
       return locationUrl.pathname + locationUrl.search;
     }
-    function deleteCachedUri(store, cacheKey, path40) {
+    function deleteCachedUri(store, cacheKey, path41) {
       deleteCachedValue(store, {
         ...cacheKey,
-        path: path40
+        path: path41
       });
       for (let i2 = 0; i2 < util.safeHTTPMethods.length; i2++) {
         const method = util.safeHTTPMethods[i2];
@@ -22321,7 +22321,7 @@ var require_cache_handler = __commonJS({
           deleteCachedValue(store, {
             ...cacheKey,
             method,
-            path: path40
+            path: path41
           });
         }
       }
@@ -22332,9 +22332,9 @@ var require_cache_handler = __commonJS({
       }
       const values = Array.isArray(headerValue2) ? headerValue2 : [headerValue2];
       for (let i2 = 0; i2 < values.length; i2++) {
-        const path40 = getSameOriginPath(cacheKey, values[i2]);
-        if (path40 !== void 0) {
-          deleteCachedUri(store, cacheKey, path40);
+        const path41 = getSameOriginPath(cacheKey, values[i2]);
+        if (path41 !== void 0) {
+          deleteCachedUri(store, cacheKey, path41);
         }
       }
     }
@@ -27334,11 +27334,11 @@ var require_fetch = __commonJS({
       function dispatch({ body }) {
         const url2 = requestCurrentURL(request6);
         const agent = fetchParams.controller.dispatcher;
-        const path40 = url2.pathname + url2.search;
+        const path41 = url2.pathname + url2.search;
         const hasTrailingQuestionMark = url2.search.length === 0 && url2.href[url2.href.length - url2.hash.length - 1] === "?";
         return new Promise((resolve, reject) => agent.dispatch(
           {
-            path: hasTrailingQuestionMark ? `${path40}?` : path40,
+            path: hasTrailingQuestionMark ? `${path41}?` : path41,
             origin: url2.origin,
             method: request6.method,
             body: agent.isMockActive ? request6.body && (request6.body.source || request6.body.stream) : body,
@@ -28285,9 +28285,9 @@ var require_util5 = __commonJS({
         }
       }
     }
-    function validateCookiePath(path40) {
-      for (let i2 = 0; i2 < path40.length; ++i2) {
-        const code = path40.charCodeAt(i2);
+    function validateCookiePath(path41) {
+      for (let i2 = 0; i2 < path41.length; ++i2) {
+        const code = path41.charCodeAt(i2);
         if (code < 32 || // exclude CTLs (0-31)
         code > 126 || // exclude DEL and non-ascii
         code === 59) {
@@ -31562,7 +31562,7 @@ var require_undici = __commonJS({
     var Pool = require_pool();
     var BalancedPool = require_balanced_pool();
     var RoundRobinPool = require_round_robin_pool();
-    var Agent7 = require_agent();
+    var Agent5 = require_agent();
     var ProxyAgent = require_proxy_agent();
     var Socks5ProxyAgent = require_socks5_proxy_agent();
     var EnvHttpProxyAgent = require_env_http_proxy_agent();
@@ -31589,7 +31589,7 @@ var require_undici = __commonJS({
     module2.exports.Pool = Pool;
     module2.exports.BalancedPool = BalancedPool;
     module2.exports.RoundRobinPool = RoundRobinPool;
-    module2.exports.Agent = Agent7;
+    module2.exports.Agent = Agent5;
     module2.exports.ProxyAgent = ProxyAgent;
     module2.exports.Socks5ProxyAgent = Socks5ProxyAgent;
     module2.exports.EnvHttpProxyAgent = EnvHttpProxyAgent;
@@ -31635,11 +31635,11 @@ var require_undici = __commonJS({
           if (typeof opts.path !== "string") {
             throw new InvalidArgumentError2("invalid opts.path");
           }
-          let path40 = opts.path;
+          let path41 = opts.path;
           if (!opts.path.startsWith("/")) {
-            path40 = `/${path40}`;
+            path41 = `/${path41}`;
           }
-          url2 = new URL(util.parseOrigin(url2).origin + path40);
+          url2 = new URL(util.parseOrigin(url2).origin + path41);
         } else {
           if (!opts) {
             opts = typeof url2 === "object" ? url2 : {};
@@ -31749,7 +31749,7 @@ ${captureLines}` : capture.stack;
 });
 // src/cli.ts
-var import_node_path38 = __toESM(require("node:path"), 1);
+var import_node_path39 = __toESM(require("node:path"), 1);
 // node_modules/.pnpm/commander@15.0.0/node_modules/commander/lib/error.js
 var CommanderError = class extends Error {
@@ -34862,9 +34862,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
    * @param {string} [path]
    * @return {(string|null|Command)}
    */
-  executableDir(path40) {
-    if (path40 === void 0) return this._executableDir;
-    this._executableDir = path40;
+  executableDir(path41) {
+    if (path41 === void 0) return this._executableDir;
+    this._executableDir = path41;
     return this;
   }
   /**
@@ -36002,10 +36002,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path40) {
-  if (!path40)
+function getElementAtPath(obj, path41) {
+  if (!path41)
     return obj;
-  return path40.reduce((acc, key) => acc?.[key], obj);
+  return path41.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -36345,11 +36345,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path40, issues) {
+function prefixIssues(path41, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path40);
+    iss.path.unshift(path41);
     return iss;
   });
 }
@@ -36799,16 +36799,16 @@ function flattenError(error62, mapper = (issue2) => issue2.message) {
 }
 function formatError(error62, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error63, path40 = []) => {
+  const processError = (error63, path41 = []) => {
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path40, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path41, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path40, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path41, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path40, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path41, ...issue2.path]);
       } else {
-        const fullpath = [...path40, ...issue2.path];
+        const fullpath = [...path41, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -36847,17 +36847,17 @@ function formatError(error62, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error62, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error63, path40 = []) => {
+  const processError = (error63, path41 = []) => {
     var _a3;
     for (const issue2 of error63.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path40, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path41, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path40, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path41, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path40, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path41, ...issue2.path]);
       } else {
-        const fullpath = [...path40, ...issue2.path];
+        const fullpath = [...path41, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -36896,8 +36896,8 @@ function treeifyError(error62, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path40 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path40) {
+  const path41 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path41) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -53999,13 +53999,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path40 = ref.slice(1).split("/").filter(Boolean);
-  if (path40.length === 0) {
+  const path41 = ref.slice(1).split("/").filter(Boolean);
+  if (path41.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path40[0] === defsKey) {
-    const key = path40[1] === void 0 ? void 0 : decodeJSONPointerSegment(path40[1]);
+  if (path41[0] === defsKey) {
+    const key = path41[1] === void 0 ? void 0 : decodeJSONPointerSegment(path41[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -55052,7 +55052,6 @@ function applyPatch(filePath, schema, patch, options = {}) {
 var import_node_child_process2 = require("node:child_process");
 var import_node_crypto3 = require("node:crypto");
 var import_node_fs3 = __toESM(require("node:fs"), 1);
-var import_node_net = __toESM(require("node:net"), 1);
 var import_node_os2 = __toESM(require("node:os"), 1);
 var import_node_path6 = __toESM(require("node:path"), 1);
 var import_node_sea = require("node:sea");
@@ -55324,7 +55323,7 @@ var HeadroomGlobalConfigSchema = HeadroomGlobalConfigObjectSchema.superRefine((c
     context.addIssue({ code: "custom", path: ["readMaturation"], message: "readMaturation needs rolloutChannel beta or dev" });
   }
 });
-var HEADROOM_DEFAULT_SOURCE = "headroom-ai[proxy] @ git+https://github.com/ExaDev/headroom@ecd1c351fcfed97499721e86852e148436ff2ee6";
+var HEADROOM_DEFAULT_SOURCE = "headroom-ai[proxy] @ git+https://github.com/ExaDev/headroom@53525f479f2f48e8ef6b08cf729601feab7d2382";
 var HEADROOM_DEFAULT_IDLE_SHUTDOWN_MINUTES = 15;
 var FRONTDOOR_DEFAULT_IDLE_SHUTDOWN_MINUTES = 15;
 var FrontDoorGlobalConfigSchema = external_exports.strictObject({
@@ -55375,17 +55374,16 @@ var SHIPPED_CATEGORY_DEFAULTS = Object.freeze({
 // src/headroom/state.ts
 var HEADROOM_ANTHROPIC_UPSTREAM = "https://api.anthropic.com";
+var HEADROOM_STATE_SCHEMA_VERSION = 2;
 var HeadroomStateSchema = external_exports.strictObject({
   /** The supervisor process owning the daemon. Alive means someone is keeping headroom running. */
   supervisorPid: external_exports.number().int().positive().optional(),
   /** The headroom proxy process itself. Absent while the supervisor is between restarts. */
   headroomPid: external_exports.number().int().positive().optional(),
-  /** The loopback port the proxy listens on. Absent until the proxy has passed its readiness check, so "port is set" is itself the ready signal a launcher polls for. */
-  port: external_exports.number().int().positive().optional(),
   /**
-   * The sticky port preference: the address the daemon last served on, kept across crashes, restarts, and idle shutdowns so the next start reuses it. Distinct from `port` on purpose: `port` is the ready signal (absent whenever nothing is serving), while `lastPort` survives every shutdown, because the front door (which routes sessions through this daemon) reads it live and follows a restart to whichever address it lands on.
+   * The unix socket the proxy serves on, inside the owner-only socket directory. Absent until the proxy has passed its readiness check, so "socketPath is set" is itself the ready signal a launcher polls for. The front door reads it on every hop, so a restart (which keeps the generation's path) is followed without anything being relaunched.
    */
-  lastPort: external_exports.number().int().positive().optional(),
+  socketPath: external_exports.string().min(1).optional(),
   /** The `headroom --version` output of the running install. */
   version: external_exports.string().optional(),
   /** Hash of the allowlist the running proxy was started with, so a provider-file change is detected as drift. */
@@ -55514,10 +55512,10 @@ function ensureHeadroom(params) {
   for (; ; ) {
     const state = readHeadroomState(ports.fs, paths.headroomStateFile);
     if (state?.supervisorPid !== void 0 && ports.isRunning(state.supervisorPid)) {
-      const daemonUp = state.port !== void 0 && state.headroomPid !== void 0 && ports.isRunning(state.headroomPid);
-      if (daemonUp && state.port !== void 0) {
+      const daemonUp = state.socketPath !== void 0 && state.headroomPid !== void 0 && ports.isRunning(state.headroomPid);
+      if (daemonUp && state.socketPath !== void 0) {
         writeSession(ports.fs, paths.headroomSessionsDir, { pid: params.launcherPid, startedAt: ports.now(), supervisorPid: state.supervisorPid });
-        return { port: state.port };
+        return { socketPath: state.socketPath };
       }
       if (state.lastError !== void 0) {
         throw new HeadroomStartError(
@@ -55802,21 +55800,29 @@ function spawnDetachedDaemon(invocation, paths, subcommand, logPath) {
 function spawnHeadroomSupervisor(paths, spawnDaemon) {
   return spawnDaemon(paths, "__headroom-supervisor", paths.headroomLogPath);
 }
-async function realIsPortFree(port) {
-  return await new Promise((resolve) => {
-    const server = import_node_net.default.createServer();
-    server.unref();
-    server.once("error", () => {
-      resolve(false);
-    });
-    server.once("close", () => {
-      resolve(true);
-    });
-    server.listen(port, "127.0.0.1", () => {
-      server.close();
-    });
-  });
-}
+var SOCKET_PERMISSION_BITS = 511;
+var realHeadroomSocketTrust = {
+  platform: process.platform,
+  currentUid: () => {
+    if (process.getuid === void 0) {
+      throw new Error(`no POSIX user id on ${process.platform}`);
+    }
+    return process.getuid();
+  },
+  lstat: (target) => {
+    let stat;
+    try {
+      stat = import_node_fs3.default.lstatSync(target);
+    } catch (error62) {
+      if (isEnoent2(error62)) {
+        return void 0;
+      }
+      throw error62;
+    }
+    const kind = stat.isSymbolicLink() ? "symlink" : stat.isDirectory() ? "dir" : stat.isSocket() ? "socket" : "other";
+    return { kind, uid: stat.uid, mode: stat.mode & SOCKET_PERMISSION_BITS };
+  }
+};
 function realHeadroomPort(paths, options) {
   return {
     ensure: () => {
@@ -55833,7 +55839,7 @@ function realHeadroomPort(paths, options) {
         }
       });
       return {
-        port: up.port,
+        socketPath: up.socketPath,
         projectId: resolveGitRoot(realRunPort, options.cwd) ?? options.cwd
       };
     },
@@ -59648,7 +59654,8 @@ function buildLayoutPaths(root) {
     categoriesLocalFile: import_node_path17.default.join(root, "categories.local.json"),
     claudeShimFile: import_node_path17.default.join(root, "claude-shim.json"),
     headroomDir: import_node_path17.default.join(root, "headroom"),
-    headroomStateFile: import_node_path17.default.join(root, "headroom", "state.json"),
+    headroomStateFile: import_node_path17.default.join(root, "headroom", `state.v${String(HEADROOM_STATE_SCHEMA_VERSION)}.json`),
+    headroomSocketDir: import_node_path17.default.join(root, "headroom", "run"),
     headroomLockFile: import_node_path17.default.join(root, "headroom", "start.lock"),
     headroomSessionsDir: import_node_path17.default.join(root, "headroom", "sessions"),
     logsDir: import_node_path17.default.join(root, "logs"),
@@ -61032,7 +61039,7 @@ function registerIdentityCommand(program2, deps) {
 // package.json
 var package_default = {
   name: "claude-use",
-  version: "7.13.2",
+  version: "8.0.0",
   description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
   license: "MIT",
   author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -61493,11 +61500,11 @@ function providerBaseUrl(port, provider) {
 function directOrigin(port) {
   return `http://127.0.0.1:${String(port)}`;
 }
-function parseProviderPath(path40) {
-  if (!path40.startsWith(PROVIDER_PATH_PREFIX)) {
+function parseProviderPath(path41) {
+  if (!path41.startsWith(PROVIDER_PATH_PREFIX)) {
     return void 0;
   }
-  const tail = path40.slice(PROVIDER_PATH_PREFIX.length);
+  const tail = path41.slice(PROVIDER_PATH_PREFIX.length);
   const slash = tail.indexOf("/");
   if (slash <= 0) {
     return void 0;
@@ -61897,9 +61904,9 @@ function decoderFor(encoding) {
       return void 0;
   }
 }
-function destinationOf(path40) {
-  const scoped = parseProviderPath(path40);
-  return scoped === void 0 ? { provider: ANTHROPIC_PROVIDER, endpoint: path40 } : { provider: scoped.provider, endpoint: scoped.rest };
+function destinationOf(path41) {
+  const scoped = parseProviderPath(path41);
+  return scoped === void 0 ? { provider: ANTHROPIC_PROVIDER, endpoint: path41 } : { provider: scoped.provider, endpoint: scoped.rest };
 }
 function buildRecord(event, context) {
   const { scan } = context;
@@ -63302,7 +63309,7 @@ var import_node_path29 = __toESM(require("node:path"), 1);
 // src/frontdoor/state.ts
 var import_node_path28 = __toESM(require("node:path"), 1);
-var FRONT_DOOR_PROTOCOL = 1;
+var FRONT_DOOR_PROTOCOL = 2;
 var FrontDoorSessionSchema = external_exports.strictObject({ pid: external_exports.number().int().positive(), startedAt: external_exports.number(), token: external_exports.string().min(1) });
 var FrontDoorStateSchema = external_exports.strictObject({
   /**
@@ -63768,9 +63775,84 @@ function registerCodexCommand(program2, deps) {
 // src/frontdoor/commands.ts
 var import_node_crypto11 = require("node:crypto");
-var import_node_path30 = __toESM(require("node:path"), 1);
+var import_node_path31 = __toESM(require("node:path"), 1);
 var import_node_fs11 = __toESM(require("node:fs"), 1);
+// src/headroom/socket.ts
+var import_node_path30 = __toESM(require("node:path"), 1);
+var GROUP_OR_OTHER_BITS = 63;
+var OCTAL_RADIX2 = 8;
+var MODE_DIGITS = 4;
+var HEADROOM_SOCKET_SUFFIX = ".sock";
+var HEADROOM_SOCKET_NAME = /^(\d+)\.sock$/;
+var UNIX_SOCKET_PATH_MAX_BYTES = 103;
+var PLATFORMS_WITHOUT_UNIX_SOCKETS = ["win32"];
+function headroomSocketPath(paths, supervisorPid) {
+  return import_node_path30.default.join(paths.headroomSocketDir, `${String(supervisorPid)}${HEADROOM_SOCKET_SUFFIX}`);
+}
+function platformRefusal(platform) {
+  return PLATFORMS_WITHOUT_UNIX_SOCKETS.includes(platform) ? `headroom routing needs a unix domain socket, which headroom cannot serve on ${platform}; agent-shim never falls back to a TCP port for this hop` : void 0;
+}
+function ownerOnlyRefusal(label, target, stat, expected, uid) {
+  if (stat === void 0) {
+    return `the headroom ${label} ${target} does not exist`;
+  }
+  if (stat.kind === "symlink") {
+    return `the headroom ${label} ${target} is a symlink; it must be the real ${expected === "dir" ? "directory" : "socket"}`;
+  }
+  if (stat.kind !== expected) {
+    return `the headroom ${label} ${target} is not a ${expected === "dir" ? "directory" : "socket"}`;
+  }
+  if (stat.uid !== uid) {
+    return `the headroom ${label} ${target} is owned by uid ${String(stat.uid)}, not by this user (uid ${String(uid)})`;
+  }
+  if ((stat.mode & GROUP_OR_OTHER_BITS) !== 0) {
+    return `the headroom ${label} ${target} has mode ${stat.mode.toString(OCTAL_RADIX2).padStart(MODE_DIGITS, "0")}, which lets other users reach it; it must be accessible to its owner only`;
+  }
+  return void 0;
+}
+function verifyHeadroomSocket(socketPath, ports) {
+  const unsupported = platformRefusal(ports.platform);
+  if (unsupported !== void 0) {
+    return { refused: unsupported };
+  }
+  const uid = ports.currentUid();
+  const directory = import_node_path30.default.dirname(socketPath);
+  const refusal = ownerOnlyRefusal("socket directory", directory, ports.lstat(directory), "dir", uid) ?? ownerOnlyRefusal("socket", socketPath, ports.lstat(socketPath), "socket", uid);
+  return refusal === void 0 ? { socketPath } : { refused: refusal };
+}
+function prepareHeadroomSocket(fs19, ports, paths, supervisorPid) {
+  const unsupported = platformRefusal(ports.platform);
+  if (unsupported !== void 0) {
+    return { refused: unsupported };
+  }
+  const socketPath = headroomSocketPath(paths, supervisorPid);
+  const length = Buffer.byteLength(socketPath, "utf8");
+  if (length > UNIX_SOCKET_PATH_MAX_BYTES) {
+    return {
+      refused: `the headroom socket path ${socketPath} is ${String(length)} bytes, longer than the ${String(UNIX_SOCKET_PATH_MAX_BYTES)} a unix socket path can hold; set AGENT_SHIM_HOME to a shorter directory`
+    };
+  }
+  if (ports.lstat(paths.headroomSocketDir)?.kind === "symlink") {
+    return { refused: `the headroom socket directory ${paths.headroomSocketDir} is a symlink; it must be the real directory` };
+  }
+  fs19.mkdirPrivate(paths.headroomSocketDir);
+  const refusal = ownerOnlyRefusal("socket directory", paths.headroomSocketDir, ports.lstat(paths.headroomSocketDir), "dir", ports.currentUid());
+  return refusal === void 0 ? { socketPath } : { refused: refusal };
+}
+function pruneStaleHeadroomSockets(fs19, paths, isRunning) {
+  const removed = [];
+  for (const name of fs19.readdir(paths.headroomSocketDir)) {
+    const pid = HEADROOM_SOCKET_NAME.exec(name)?.[1];
+    if (pid === void 0 || isRunning(Number.parseInt(pid, 10))) {
+      continue;
+    }
+    fs19.removeRecursive(import_node_path30.default.join(paths.headroomSocketDir, name));
+    removed.push(name);
+  }
+  return removed;
+}
 // src/frontdoor/custody.ts
 var CREDENTIAL_HEADERS = ["authorization", "x-api-key"];
 var SEQUESTERED_CREDENTIAL = "agent-shim-sequestered";
@@ -63857,7 +63939,7 @@ function createDoorPipelines(deps) {
       // The response middleware hook point, where usage tracking registers. The direct listener registers none, because its responses are consumed by headroom, not by the client: the entry the client sees is where observation belongs, and observing both would record every hopped request twice.
       responseObservers: deps.responseObservers,
       admit: admitLaunch(deps.isLiveToken),
-      headroom: { headroomPort: deps.headroomPort, hopSecret: deps.hopSecret, custody: deps.custody, log: deps.log },
+      headroom: { headroomSocket: deps.headroomSocket, hopSecret: deps.hopSecret, custody: deps.custody, log: deps.log },
       now: deps.now,
       log: deps.log
     },
@@ -63908,7 +63990,7 @@ function isLiveCapability(presented, live) {
 // src/frontdoor/capture.ts
 var fs11 = __toESM(require("node:fs"), 1);
-var path30 = __toESM(require("node:path"), 1);
+var path31 = __toESM(require("node:path"), 1);
 var SECRET_HEADER_NAME = /authorization|cookie|token|secret|credential|api[-_]key/i;
 var SECRET_JSON_KEY = /token|secret|password|credential|authorization|api[-_]key/i;
 var SECRET_BODY_PATTERNS = [
@@ -63952,10 +64034,10 @@ function redactBody(chunk) {
 }
 var CAPTURE_ENV = "AGENT_SHIM_FRONTDOOR_CAPTURE";
 function captureFromEnv(env, logsDir) {
-  return env[CAPTURE_ENV] === "1" ? createFileCapture(path30.join(logsDir, "frontdoor-capture.jsonl")) : void 0;
+  return env[CAPTURE_ENV] === "1" ? createFileCapture(path31.join(logsDir, "frontdoor-capture.jsonl")) : void 0;
 }
 function createFileCapture(file2, now = () => /* @__PURE__ */ new Date()) {
-  fs11.mkdirSync(path30.dirname(file2), { recursive: true });
+  fs11.mkdirSync(path31.dirname(file2), { recursive: true });
   let nextId = 0;
   const append = (record2) => {
     fs11.appendFileSync(file2, `${JSON.stringify({ ts: now().toISOString(), ...record2 })}
@@ -64049,7 +64131,7 @@ var fs12 = __toESM(require("node:fs"), 1);
 // src/frontdoor/x509.ts
 var import_node_crypto8 = require("node:crypto");
-var import_node_net2 = __toESM(require("node:net"), 1);
+var import_node_net = __toESM(require("node:net"), 1);
 var TAG_BOOLEAN = 1;
 var TAG_INTEGER = 2;
 var TAG_BIT_STRING = 3;
@@ -64175,7 +64257,7 @@ function ipv6Groups(address) {
   const [head = "", tail] = address.split("::");
   const split = (text2) => text2 === "" ? [] : text2.split(":");
   const expand = (groups) => groups.flatMap((group) => {
-    if (!import_node_net2.default.isIPv4(group)) {
+    if (!import_node_net.default.isIPv4(group)) {
       return [Number.parseInt(group, HEX_RADIX)];
     }
     const [a2 = 0, b = 0, c2 = 0, d = 0] = group.split(".").map(Number);
@@ -64187,10 +64269,10 @@ function ipv6Groups(address) {
   return [...before, ...filler, ...after];
 }
 function ipBytes(address) {
-  if (import_node_net2.default.isIPv4(address)) {
+  if (import_node_net.default.isIPv4(address)) {
     return Buffer.from(address.split(".").map(Number));
   }
-  if (!import_node_net2.default.isIPv6(address)) {
+  if (!import_node_net.default.isIPv6(address)) {
     throw new Error(`${address} is not an IP address`);
   }
   const bytes = Buffer.alloc(IPV6_GROUPS * BYTES_PER_IPV6_GROUP);
@@ -64298,7 +64380,7 @@ function issueLeafCertificate(ca, names, notBefore, notAfter) {
   const caCertificate = new import_node_crypto8.X509Certificate(ca.certPem);
   const caPrivateKey = (0, import_node_crypto8.createPrivateKey)(ca.keyPem);
   const { publicKey, privateKey } = rsaKeyPair();
-  const generalNames = names.map((name) => import_node_net2.default.isIP(name) === 0 ? tlv(TAG_GENERAL_NAME_DNS, Buffer.from(name, "ascii")) : tlv(TAG_GENERAL_NAME_IP, ipBytes(name)));
+  const generalNames = names.map((name) => import_node_net.default.isIP(name) === 0 ? tlv(TAG_GENERAL_NAME_DNS, Buffer.from(name, "ascii")) : tlv(TAG_GENERAL_NAME_IP, ipBytes(name)));
   const der = assemble({
     subjectPublicKey: publicKey,
     subjectName: commonNameOnly(commonName),
@@ -64392,22 +64474,22 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
   };
   writeFrontDoorState(fs19, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, ...sticky() });
   const previousSticky = lastPort;
-  let http5;
+  let http6;
   try {
-    http5 = await ports.startProviderListener(lastPort);
+    http6 = await ports.startProviderListener(lastPort);
   } catch (error62) {
     return fail(`could not start the provider listener: ${error62 instanceof Error ? error62.message : String(error62)}`);
   }
-  if (previousSticky !== void 0 && http5.port !== previousSticky) {
-    ports.log(`agent-shim frontdoor supervisor: sticky port ${String(previousSticky)} was occupied; moving to ${String(http5.port)} (sessions launched against the old port are stale until they relaunch)`);
+  if (previousSticky !== void 0 && http6.port !== previousSticky) {
+    ports.log(`agent-shim frontdoor supervisor: sticky port ${String(previousSticky)} was occupied; moving to ${String(http6.port)} (sessions launched against the old port are stale until they relaunch)`);
   }
-  lastPort = http5.port;
+  lastPort = http6.port;
   const previousStickyConnect = lastConnectPort;
   let connect3;
   try {
     connect3 = await ports.startConnectListener(lastConnectPort);
   } catch (error62) {
-    await http5.close();
+    await http6.close();
     return fail(`could not start the CONNECT surface: ${error62 instanceof Error ? error62.message : String(error62)}`);
   }
   if (previousStickyConnect !== void 0 && connect3.port !== previousStickyConnect) {
@@ -64420,16 +64502,16 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     direct = await ports.startDirectListener(lastDirectPort);
   } catch (error62) {
     await connect3.close();
-    await http5.close();
+    await http6.close();
     return fail(`could not start the direct listener: ${error62 instanceof Error ? error62.message : String(error62)}`);
   }
   if (previousStickyDirect !== void 0 && direct.port !== previousStickyDirect) {
     ports.log(`agent-shim frontdoor supervisor: sticky direct port ${String(previousStickyDirect)} was occupied; moving to ${String(direct.port)} (headroom must be restarted to admit the new address)`);
   }
   lastDirectPort = direct.port;
-  writeFrontDoorState(fs19, paths.frontdoorStateFile, { protocol: FRONT_DOOR_PROTOCOL, supervisorPid: ports.ownPid, port: http5.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
+  writeFrontDoorState(fs19, paths.frontdoorStateFile, { protocol: FRONT_DOOR_PROTOCOL, supervisorPid: ports.ownPid, port: http6.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
   fs19.removeRecursive(paths.frontdoorLockFile);
-  ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http5.port)}, CONNECT surface on 127.0.0.1:${String(connect3.port)}`);
+  ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http6.port)}, CONNECT surface on 127.0.0.1:${String(connect3.port)}`);
   let idleSince;
   let ticks = 0;
   for (; ; ) {
@@ -64444,7 +64526,7 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
         ports.log(`agent-shim frontdoor supervisor: no sessions for ${String(idleShutdownMinutes)} minute(s); closing the front door and exiting`);
         await direct.close();
         await connect3.close();
-        await http5.close();
+        await http6.close();
         writeFrontDoorState(fs19, paths.frontdoorStateFile, sticky());
         return 0;
       }
@@ -64498,8 +64580,8 @@ function parseConnectTarget(authority) {
   }
   return { host, port };
 }
-function servedByPipeline(path40) {
-  return path40?.startsWith(ROUTED_PATH_PREFIX) === true;
+function servedByPipeline(path41) {
+  return path41?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
   "connection",
@@ -64833,16 +64915,66 @@ function realConnectCertStore(paths) {
 }
 // src/frontdoor/connectEffects.ts
+var dns = __toESM(require("node:dns"), 1);
 var http = __toESM(require("node:http"), 1);
 var https = __toESM(require("node:https"), 1);
-var net3 = __toESM(require("node:net"), 1);
+var net2 = __toESM(require("node:net"), 1);
 var tls = __toESM(require("node:tls"), 1);
+var UPSTREAM_LOCAL_PORT_START = 47900;
+var UPSTREAM_LOCAL_PORT_END = 47919;
+var nextUpstreamLocalPort = UPSTREAM_LOCAL_PORT_START;
+function upstreamLocalPort() {
+  const port = nextUpstreamLocalPort;
+  nextUpstreamLocalPort = nextUpstreamLocalPort === UPSTREAM_LOCAL_PORT_END ? UPSTREAM_LOCAL_PORT_START : nextUpstreamLocalPort + 1;
+  return port;
+}
+var realAddressLookup = (host, _options, callback) => {
+  if (net2.isIP(host) !== 0) {
+    callback(null, [{ address: host, family: net2.isIP(host) }]);
+    return;
+  }
+  dns.resolve4(host, (error62, addresses) => {
+    const first = addresses[0];
+    if (error62 !== null || first === void 0) {
+      callback(error62 ?? new Error(`no A record for ${host}`), [{ address: "", family: 4 }]);
+      return;
+    }
+    callback(null, [{ address: first, family: 4 }]);
+  });
+};
+var HTTP_PORT = 80;
+function exemptDial(options, defaultPort) {
+  const host = typeof options.host === "string" ? options.host : "";
+  const port = typeof options.port === "number" ? options.port : defaultPort;
+  return net2.connect(net2.isIP(host) === 0 ? { host, port, localPort: upstreamLocalPort(), lookup: realAddressLookup } : { host, port });
+}
+function requestServername(options, fallback) {
+  return "servername" in options && typeof options.servername === "string" && options.servername !== "" ? options.servername : fallback;
+}
+var ExemptHttpAgent = class extends http.Agent {
+  createConnection(options) {
+    return exemptDial(options, HTTP_PORT);
+  }
+};
+var ExemptTlsAgent = class extends https.Agent {
+  createConnection(options) {
+    const host = typeof options.host === "string" ? options.host : "";
+    const tlsOptions = { socket: exemptDial(options, HTTPS_PORT), servername: requestServername(options, host) };
+    if ("ca" in options && Array.isArray(options.ca)) {
+      tlsOptions.ca = options.ca;
+    }
+    if ("rejectUnauthorized" in options && typeof options.rejectUnauthorized === "boolean") {
+      tlsOptions.rejectUnauthorized = options.rejectUnauthorized;
+    }
+    return tls.connect(tlsOptions);
+  }
+};
 function realConnectEffects() {
-  const plainAgent = new http.Agent({ keepAlive: true });
-  const tlsAgent = new https.Agent({ keepAlive: true });
+  const plainAgent = new ExemptHttpAgent();
+  const tlsAgent = new ExemptTlsAgent();
   const listenOnce = async (port, onSocket) => await new Promise((resolve, reject) => {
     const accepted = /* @__PURE__ */ new Set();
-    const server = net3.createServer((socket) => {
+    const server = net2.createServer((socket) => {
       accepted.add(socket);
       socket.on("close", () => {
         accepted.delete(socket);
@@ -64925,14 +65057,26 @@ function realConnectEffects() {
       };
     },
     connectTlsUpstream: async (host, port, clientAlpn) => await new Promise((resolve, reject) => {
-      const socket = tls.connect({ host, port, servername: host, ...clientAlpn === void 0 ? {} : { ALPNProtocols: [clientAlpn] } });
-      socket.once("secureConnect", () => {
-        resolve(socket);
-      });
-      socket.once("error", reject);
+      const dial = (localPort) => {
+        const raw = net2.connect({ host, port, localPort, lookup: realAddressLookup });
+        return tls.connect({ socket: raw, servername: host, ...clientAlpn === void 0 ? {} : { ALPNProtocols: [clientAlpn] } });
+      };
+      const settle2 = (candidate) => {
+        candidate.once("secureConnect", () => {
+          resolve(candidate);
+        });
+        candidate.once("error", (error62) => {
+          if ("code" in error62 && error62.code === "EADDRINUSE") {
+            settle2(dial(upstreamLocalPort()));
+            return;
+          }
+          reject(error62);
+        });
+      };
+      settle2(dial(upstreamLocalPort()));
     }),
     connectTcp: async (host, port) => await new Promise((resolve, reject) => {
-      const socket = net3.connect({ host, port });
+      const socket = net2.connect({ host, port });
       socket.once("connect", () => {
         resolve(socket);
       });
@@ -64943,6 +65087,7 @@ function realConnectEffects() {
       const options = {
         host: target.host,
         port: target.port,
+        lookup: realAddressLookup,
         method: request6.method,
         path: request6.url,
         headers,
@@ -65139,13 +65284,17 @@ function responseHeaders(headers) {
   return result;
 }
 async function applyHeadroomHop(request6, response, upstream, deps) {
-  const port = deps.headroomPort();
-  if (port === void 0) {
-    response.start(HTTP_BAD_GATEWAY2, { "Content-Type": "application/json" });
-    await response.write(JSON.stringify({ type: "error", error: { type: "api_error", message: "agent-shim front door: the headroom daemon is restarting" } }));
-    response.end();
+  const target = deps.headroomSocket();
+  if (target === void 0) {
+    await answerBadGateway(response, "agent-shim front door: the headroom daemon is restarting");
+    return;
+  }
+  if (target.refused !== void 0) {
+    deps.log(`front door: refusing the headroom hop (${request6.method} ${new URL(request6.url, "http://127.0.0.1").pathname}): ${target.refused}`);
+    await answerBadGateway(response, `agent-shim front door: refusing to send this request to headroom: ${target.refused}`);
     return;
   }
+  const { socketPath } = target;
   let headers = forwardableHeaders(request6.headers);
   let hopId;
   if (upstream !== void 0) {
@@ -65164,16 +65313,21 @@ async function applyHeadroomHop(request6, response, upstream, deps) {
   }
   headers[HOP_SECRET_HEADER] = deps.hopSecret;
   try {
-    await forwardThroughHeadroom(request6, response, { port, headers, log: deps.log });
+    await forwardThroughHeadroom(request6, response, { socketPath, headers, log: deps.log });
   } finally {
     if (hopId !== void 0) {
       deps.custody.release(hopId);
     }
   }
 }
+async function answerBadGateway(response, message) {
+  response.start(HTTP_BAD_GATEWAY2, { "Content-Type": "application/json" });
+  await response.write(JSON.stringify({ type: "error", error: { type: "api_error", message } }));
+  response.end();
+}
 var HOP_AGENT = new http3.Agent({ keepAlive: false });
 async function forwardThroughHeadroom(request6, response, target) {
-  const { port, headers } = target;
+  const { socketPath, headers } = target;
   await new Promise((resolve) => {
     const onUpstreamResponse = (upstreamResponse) => {
       response.start(upstreamResponse.statusCode ?? HTTP_BAD_GATEWAY2, responseHeaders(upstreamResponse.headers));
@@ -65191,7 +65345,7 @@ async function forwardThroughHeadroom(request6, response, target) {
           }
         } catch (error62) {
           if (!request6.signal.aborted) {
-            target.log(`front door: headroom hop to 127.0.0.1:${String(port)} ended mid-stream (${request6.method} ${new URL(request6.url, "http://127.0.0.1").pathname}): ${error62 instanceof Error ? error62.message : String(error62)}`);
+            target.log(`front door: headroom hop to ${socketPath} ended mid-stream (${request6.method} ${new URL(request6.url, "http://127.0.0.1").pathname}): ${error62 instanceof Error ? error62.message : String(error62)}`);
           }
           response.destroy();
         }
@@ -65199,11 +65353,11 @@ async function forwardThroughHeadroom(request6, response, target) {
       };
       void stream();
     };
-    const hop = http3.request({ host: "127.0.0.1", port, method: request6.method, path: request6.url, headers, agent: HOP_AGENT }, onUpstreamResponse);
+    const hop = http3.request({ socketPath, method: request6.method, path: request6.url, headers, agent: HOP_AGENT }, onUpstreamResponse);
     hop.on("error", (error62) => {
       const phase = response.headersSent ? "mid-stream" : "before the response started";
       const code = "code" in error62 && typeof error62.code === "string" ? ` ${error62.code}` : "";
-      target.log(`front door: headroom hop to 127.0.0.1:${String(port)} failed (${request6.method} ${new URL(request6.url, "http://127.0.0.1").pathname}, ${phase}): ${error62.message}${code}`);
+      target.log(`front door: headroom hop to ${socketPath} failed (${request6.method} ${new URL(request6.url, "http://127.0.0.1").pathname}, ${phase}): ${error62.message}${code}`);
       if (!response.headersSent) {
         response.start(HTTP_BAD_GATEWAY2, { "Content-Type": "application/json" });
         void response.write(JSON.stringify({ type: "error", error: { type: "api_error", message: `agent-shim front door: the headroom daemon is unreachable (${error62.message})` } })).then(() => {
@@ -66194,8 +66348,8 @@ function createCodexRouteMount(ports, upstreamBase, provider) {
         request6.body.resume();
         return;
       }
-      const path40 = new URL(request6.url, "http://127.0.0.1").pathname;
-      const translated = { method: request6.method, path: path40, body, signal: request6.signal };
+      const path41 = new URL(request6.url, "http://127.0.0.1").pathname;
+      const translated = { method: request6.method, path: path41, body, signal: request6.signal };
       const routed = await route(translated);
       if (request6.signal.aborted) {
         return;
@@ -66222,14 +66376,14 @@ function createPassthroughRoute(name, target) {
   const base = new URL(target.baseUrl);
   const tls2 = base.protocol === "https:";
   const basePath = base.pathname.replace(/\/+$/, "");
-  const agent = tls2 ? new https3.Agent({ keepAlive: true }) : new http4.Agent({ keepAlive: true });
+  const agent = tls2 ? new ExemptTlsAgent() : new ExemptHttpAgent();
   return {
     name,
     headroomEligible: true,
     headroomUpstream: target.headroomUpstream,
     serve: async (request6, response) => {
       const incoming = new URL(request6.url, "http://127.0.0.1");
-      const path40 = target.stripPrefix !== void 0 && incoming.pathname.startsWith(target.stripPrefix) ? incoming.pathname.slice(target.stripPrefix.length) : incoming.pathname;
+      const path41 = target.stripPrefix !== void 0 && incoming.pathname.startsWith(target.stripPrefix) ? incoming.pathname.slice(target.stripPrefix.length) : incoming.pathname;
       const headers = forwardableHeaders(request6.headers);
       delete headers.host;
       await new Promise((resolve) => {
@@ -66237,7 +66391,7 @@ function createPassthroughRoute(name, target) {
           host: base.hostname,
           port: base.port === "" ? void 0 : Number(base.port),
           method: request6.method,
-          path: `${basePath}${path40}${incoming.search}`,
+          path: `${basePath}${path41}${incoming.search}`,
           headers,
           agent
         };
@@ -66299,10 +66453,10 @@ function createProviderRouteResolver(deps) {
     return route;
   };
   const resolve = (request6) => {
-    const path40 = new URL(request6.url, "http://127.0.0.1").pathname;
-    const scoped = parseProviderPath(path40);
+    const path41 = new URL(request6.url, "http://127.0.0.1").pathname;
+    const scoped = parseProviderPath(path41);
     if (scoped === void 0) {
-      return path40.startsWith("/v1/") ? { ok: true, route: oauthRoute } : { ok: false, status: HTTP_STATUS.notFound, message: `no such endpoint: ${path40}` };
+      return path41.startsWith("/v1/") ? { ok: true, route: oauthRoute } : { ok: false, status: HTTP_STATUS.notFound, message: `no such endpoint: ${path41}` };
     }
     const { provider } = scoped;
     let definition;
@@ -66394,8 +66548,8 @@ function zaiWindow(limit) {
 var zaiQuotaAdapter = {
   source: ZAI_SOURCE,
   matches: (baseUrl) => URL.canParse(baseUrl) && new URL(baseUrl).hostname === ZAI_HOST,
-  fetch: async (apiKey, http5, signal, nowMs) => {
-    const response = await http5(ZAI_QUOTA_URL, { authorization: apiKey, accept: "application/json" }, signal);
+  fetch: async (apiKey, http6, signal, nowMs) => {
+    const response = await http6(ZAI_QUOTA_URL, { authorization: apiKey, accept: "application/json" }, signal);
     if (response.status !== HTTP_OK) {
       throw new ProviderQuotaError(ZAI_SOURCE, `answered HTTP ${String(response.status)}`);
     }
@@ -66436,8 +66590,8 @@ var OpenRouterKeySchema = external_exports.object({
   })
 });
 var OpenRouterCreditsSchema = external_exports.object({ data: external_exports.object({ total_credits: external_exports.number().nonnegative(), total_usage: external_exports.number().nonnegative() }) });
-async function openRouterGet(url2, schema, apiKey, http5, signal) {
-  const response = await http5(url2, { authorization: `Bearer ${apiKey}`, accept: "application/json" }, signal);
+async function openRouterGet(url2, schema, apiKey, http6, signal) {
+  const response = await http6(url2, { authorization: `Bearer ${apiKey}`, accept: "application/json" }, signal);
   if (response.status === HTTP_FORBIDDEN) {
     return "forbidden";
   }
@@ -66462,12 +66616,12 @@ function nextUtcMidnight(nowMs) {
 var openRouterQuotaAdapter = {
   source: OPENROUTER_SOURCE,
   matches: (baseUrl) => URL.canParse(baseUrl) && new URL(baseUrl).hostname === OPENROUTER_HOST,
-  fetch: async (apiKey, http5, signal, nowMs) => {
-    const key = await openRouterGet(OPENROUTER_KEY_URL, OpenRouterKeySchema, apiKey, http5, signal);
+  fetch: async (apiKey, http6, signal, nowMs) => {
+    const key = await openRouterGet(OPENROUTER_KEY_URL, OpenRouterKeySchema, apiKey, http6, signal);
     if (key === "forbidden") {
       throw new ProviderQuotaError(OPENROUTER_SOURCE, "/api/v1/key refused the key (HTTP 403)");
     }
-    const credits = await openRouterGet(OPENROUTER_CREDITS_URL, OpenRouterCreditsSchema, apiKey, http5, signal);
+    const credits = await openRouterGet(OPENROUTER_CREDITS_URL, OpenRouterCreditsSchema, apiKey, http6, signal);
     const { limit, limit_remaining: limitRemaining, limit_reset: limitReset, free_model_daily_requests: free, is_free_tier: isFreeTier } = key.data;
     const windows = [];
     if (limit !== null && limit > 0) {
@@ -66628,8 +66782,9 @@ function appendLog(paths, line) {
   import_node_fs11.default.appendFileSync(paths.frontdoorLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
 `);
 }
-function liveHeadroomPort(paths) {
-  return readHeadroomState(realFarmFs, paths.headroomStateFile)?.port;
+function headroomSocketTarget(fsPort, trust, paths) {
+  const socketPath = readHeadroomState(fsPort, paths.headroomStateFile)?.socketPath;
+  return socketPath === void 0 ? void 0 : verifyHeadroomSocket(socketPath, trust);
 }
 function realFrontDoorSupervisorPorts(paths) {
   const log = (line) => {
@@ -66661,7 +66816,7 @@ function realFrontDoorSupervisorPorts(paths) {
     isLiveToken,
     responseObservers: [usageMiddleware],
     now: () => Date.now(),
-    headroomPort: () => liveHeadroomPort(paths),
+    headroomSocket: () => headroomSocketTarget(realFarmFs, realHeadroomSocketTrust, paths),
     // The per-generation capability the direct listener demands: held only in this process's memory, so a loopback process that discovers the direct port still cannot use it.
     hopSecret: (0, import_node_crypto11.randomUUID)(),
     custody: createCredentialCustody(() => (0, import_node_crypto11.randomUUID)()),
@@ -66708,7 +66863,7 @@ function realFrontDoorSupervisorPorts(paths) {
       const leafFor = createLeafCache(loadCa(), () => /* @__PURE__ */ new Date());
       const capture = captureFromEnv(process.env, paths.logsDir);
       if (capture !== void 0) {
-        log(`capture enabled, recording CONNECT targets and piped exchanges to ${import_node_path30.default.join(paths.logsDir, "frontdoor-capture.jsonl")}`);
+        log(`capture enabled, recording CONNECT targets and piped exchanges to ${import_node_path31.default.join(paths.logsDir, "frontdoor-capture.jsonl")}`);
       }
       const server = await startConnectServer(
         {
@@ -66764,13 +66919,13 @@ function realFrontDoorSupervisorPorts(paths) {
     }
   };
 }
-function collectFrontDoorStatus(fsPort, paths, isRunning) {
+function collectFrontDoorStatus(fsPort, socketTrust, paths, isRunning) {
   const state = readFrontDoorState(fsPort, paths.frontdoorStateFile) ?? {};
   return {
     state,
     supervisorAlive: state.supervisorPid !== void 0 && isRunning(state.supervisorPid),
     sessions: listFrontDoorSessions(fsPort, paths.frontdoorSessionsDir).map((session) => ({ ...session, alive: isRunning(session.pid) })),
-    headroomPort: readHeadroomState(fsPort, paths.headroomStateFile)?.port,
+    headroomSocket: headroomSocketTarget(fsPort, socketTrust, paths),
     logPath: paths.frontdoorLogPath,
     logExists: fsPort.readFileUtf8(paths.frontdoorLogPath) !== void 0
   };
@@ -66792,9 +66947,13 @@ function formatFrontDoorStatus(status, caCertPath) {
   } else {
     lines.push(`connect surface: listening on 127.0.0.1:${String(status.state.connectPort)}, CA ${caCertPath}`);
   }
-  lines.push(
-    status.headroomPort === void 0 ? "headroom hop: the daemon is not serving (sessions asking for headroom fail until it is up)" : `headroom hop: daemon on 127.0.0.1:${String(status.headroomPort)}`
-  );
+  if (status.headroomSocket === void 0) {
+    lines.push("headroom hop: the daemon is not serving (sessions asking for headroom fail until it is up)");
+  } else if (status.headroomSocket.refused === void 0) {
+    lines.push(`headroom hop: daemon on unix socket ${status.headroomSocket.socketPath}`);
+  } else {
+    lines.push(`headroom hop: REFUSING the daemon's socket (sessions asking for headroom fail until it is fixed): ${status.headroomSocket.refused}`);
+  }
   if (status.sessions.length === 0) {
     lines.push("sessions: none");
   } else {
@@ -66814,7 +66973,7 @@ function registerFrontDoorCommand(program2, deps) {
   ]);
   withExamples(
     frontdoor.command("status").description("Report the front door's supervisor, listeners, sessions, and last error. Read-only.").option("--json", "Print the status as JSON.").action((options) => {
-      const status = collectFrontDoorStatus(realFarmFs, paths, realIsProcessRunning);
+      const status = collectFrontDoorStatus(realFarmFs, realHeadroomSocketTrust, paths, realIsProcessRunning);
       if (options.json === true) {
         printJson(status);
         return;
@@ -67116,15 +67275,15 @@ var import_node_child_process4 = require("node:child_process");
 // src/identityToken.ts
 var import_node_fs12 = __toESM(require("node:fs"), 1);
-var import_node_path31 = __toESM(require("node:path"), 1);
+var import_node_path32 = __toESM(require("node:path"), 1);
 var TOKEN_FILE_MODE = 384;
 var TOKEN_DIR_MODE = 448;
 var OAUTH_TOKEN_RE = /^sk-ant-oat\d+-[A-Za-z0-9_-]+$/;
 function identityTokenDir(paths) {
-  return import_node_path31.default.join(paths.root, "credentials");
+  return import_node_path32.default.join(paths.root, "credentials");
 }
 function identityTokenPath(paths, identityName) {
-  return import_node_path31.default.join(identityTokenDir(paths), `${identityName}.token`);
+  return import_node_path32.default.join(identityTokenDir(paths), `${identityName}.token`);
 }
 function storeIdentityToken(paths, identityName, raw) {
   const token = raw.trim();
@@ -67135,7 +67294,7 @@ function storeIdentityToken(paths, identityName, raw) {
   import_node_fs12.default.mkdirSync(dir, { recursive: true, mode: TOKEN_DIR_MODE });
   import_node_fs12.default.chmodSync(dir, TOKEN_DIR_MODE);
   const target = identityTokenPath(paths, identityName);
-  const temp = import_node_path31.default.join(dir, `.${identityName}.${String(process.pid)}.tmp`);
+  const temp = import_node_path32.default.join(dir, `.${identityName}.${String(process.pid)}.tmp`);
   import_node_fs12.default.writeFileSync(temp, `${token}
 `, { mode: TOKEN_FILE_MODE });
   import_node_fs12.default.renameSync(temp, target);
@@ -67145,7 +67304,7 @@ function storeIdentityToken(paths, identityName, raw) {
 // src/realCredentialCache.ts
 var import_node_child_process3 = require("node:child_process");
 var import_node_fs13 = __toESM(require("node:fs"), 1);
-var import_node_path32 = __toESM(require("node:path"), 1);
+var import_node_path33 = __toESM(require("node:path"), 1);
 var KEYCHAIN_CACHE_SERVICE = "agent-shim-credential-cache";
 var CACHE_DIR_MODE = 448;
 var CACHE_FILE_MODE = 384;
@@ -67172,8 +67331,8 @@ function security(args, stdin2) {
   return { status: result.status, stdout: result.stdout };
 }
 function createRealCredentialCache(root) {
-  const dir = import_node_path32.default.join(root, "credential-cache");
-  const filePath = (owner) => import_node_path32.default.join(dir, cacheFileNameFor(owner));
+  const dir = import_node_path33.default.join(root, "credential-cache");
+  const filePath = (owner) => import_node_path33.default.join(dir, cacheFileNameFor(owner));
   return {
     read(store, owner) {
       if (store === "file") {
@@ -67352,7 +67511,7 @@ function subjectName(positional, provider) {
 // src/doctorReport.ts
 var import_node_fs14 = __toESM(require("node:fs"), 1);
-var import_node_path33 = __toESM(require("node:path"), 1);
+var import_node_path34 = __toESM(require("node:path"), 1);
 // src/headroom/source.ts
 var GIT_SPEC_RE = /git\+[^@\s]+(?:@([^\s#]+))?/;
@@ -67403,7 +67562,7 @@ function validateJson(schema, input2) {
   return { ok: true, data: result.data };
 }
 function pushPathResolution(push, resolution) {
-  const ownDir = import_node_path33.default.dirname(resolution.ownExecutablePath);
+  const ownDir = import_node_path34.default.dirname(resolution.ownExecutablePath);
   switch (resolution.agentShim.status) {
     case "ok":
       push("path-resolution", "pass", `\`agent-shim\` on PATH resolves to this running executable, ${resolution.ownExecutablePath}.`, "agent-shim");
@@ -67471,14 +67630,14 @@ function pushProvider(push, entry) {
 }
 function pushLegacyName(push, params) {
   const legacyVariables = Object.keys(params.env).filter((name) => name.startsWith(LEGACY_ENV_PREFIX) && params.env[name] !== void 0).sort();
-  if (legacyVariables.length === 0 && import_node_path33.default.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
+  if (legacyVariables.length === 0 && import_node_path34.default.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
     push("legacy-name", "pass", "Nothing here still uses the former `claude-use` name.");
     return;
   }
   for (const name of legacyVariables) {
     push("legacy-name", "warn", `${name} is the former name of ${name.replace(LEGACY_ENV_PREFIX, ENV_PREFIX)}. Rename it; the old name still works but is only a fallback.`, name);
   }
-  if (import_node_path33.default.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
+  if (import_node_path34.default.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
     push(
       "legacy-name",
       "warn",
@@ -67668,7 +67827,7 @@ function runDoctor(params) {
           "warn",
           `Headroom state names supervisor pid ${String(state.supervisorPid)}, which is not running; the next launch through headroom will start a replacement.`
         );
-      } else if (state.headroomPid === void 0 || state.port === void 0) {
+      } else if (state.headroomPid === void 0 || state.socketPath === void 0) {
         push(
           "headroom",
           "warn",
@@ -67684,7 +67843,7 @@ function runDoctor(params) {
         push(
           "headroom",
           "pass",
-          `Headroom daemon is up on 127.0.0.1:${String(state.port)} (supervisor ${String(state.supervisorPid)}, daemon ${String(state.headroomPid)}).`
+          `Headroom daemon is up on unix socket ${state.socketPath} (supervisor ${String(state.supervisorPid)}, daemon ${String(state.headroomPid)}).`
         );
       }
       if (state.lastError !== void 0 && supervisorAlive) {
@@ -67786,18 +67945,18 @@ function collectDoctorReport(params) {
   const { paths } = params;
   const identityNames = import_node_fs14.default.existsSync(paths.identitiesDir) ? import_node_fs14.default.readdirSync(paths.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && isIdentityDirectoryName(entry.name)).map((entry) => entry.name).sort() : [];
   const identities = identityNames.map((name) => {
-    const farmRoot = import_node_path33.default.join(paths.identitiesDir, name);
-    const identityPath = import_node_path33.default.join(farmRoot, "identity.json");
+    const farmRoot = import_node_path34.default.join(paths.identitiesDir, name);
+    const identityPath = import_node_path34.default.join(farmRoot, "identity.json");
     return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot };
   });
   const profileNames = import_node_fs14.default.existsSync(paths.configProfilesDir) ? import_node_fs14.default.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const configProfiles = profileNames.map((name) => {
-    const profilePath = import_node_path33.default.join(paths.configProfilesDir, `${name}.json`);
+    const profilePath = import_node_path34.default.join(paths.configProfilesDir, `${name}.json`);
     return { name, path: profilePath, raw: realFsPort.readFileUtf8(profilePath) };
   });
   const providerNames = import_node_fs14.default.existsSync(paths.providersDir) ? import_node_fs14.default.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const providers = providerNames.map((name) => {
-    const providerPath = import_node_path33.default.join(paths.providersDir, `${name}.json`);
+    const providerPath = import_node_path34.default.join(paths.providersDir, `${name}.json`);
     return { name, path: providerPath, raw: realFsPort.readFileUtf8(providerPath) };
   });
   const ownExecutablePath = realOwnExecutablePath();
@@ -67809,12 +67968,12 @@ function collectDoctorReport(params) {
     binaryDiscovery = { ok: false, message: error62 instanceof Error ? error62.message : String(error62) };
   }
   const shimState = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-  const pathDirs = (params.env.PATH ?? "").split(import_node_path33.default.delimiter).filter((dir) => dir !== "");
+  const pathDirs = (params.env.PATH ?? "").split(import_node_path34.default.delimiter).filter((dir) => dir !== "");
   const claudeShimShadow = shimState === void 0 ? void 0 : refinePathShadow(
     findPathShadow({
       pathDirs,
-      targetDir: import_node_path33.default.dirname(shimState.targetPath),
-      targetFilename: import_node_path33.default.basename(shimState.targetPath),
+      targetDir: import_node_path34.default.dirname(shimState.targetPath),
+      targetFilename: import_node_path34.default.basename(shimState.targetPath),
       findExecutableInDir
     }),
     shimState.targetPath,
@@ -67837,7 +67996,7 @@ function collectDoctorReport(params) {
       agentShim: refinePathShadow(
         findPathShadow({
           pathDirs,
-          targetDir: import_node_path33.default.dirname(ownExecutablePath),
+          targetDir: import_node_path34.default.dirname(ownExecutablePath),
           targetFilename: commandFilename(ownExecutablePath, "agent-shim"),
           findExecutableInDir
         }),
@@ -67879,8 +68038,8 @@ function registerDoctorCommand(program2, deps) {
 // src/headroom/commands.ts
 var import_node_fs15 = __toESM(require("node:fs"), 1);
-var import_node_net3 = __toESM(require("node:net"), 1);
-var import_node_path34 = __toESM(require("node:path"), 1);
+var import_node_http2 = __toESM(require("node:http"), 1);
+var import_node_path35 = __toESM(require("node:path"), 1);
 var import_node_child_process5 = require("node:child_process");
 // src/headroom/settings.ts
@@ -68019,8 +68178,6 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     return 0;
   }
   let installedSource = previousState?.installedSource;
-  let lastPort = previousState?.lastPort;
-  const sticky = () => lastPort === void 0 ? {} : { lastPort };
   const ownsState = () => {
     const owner = readHeadroomState(fs19, paths.headroomStateFile)?.supervisorPid;
     return owner === void 0 || owner === ports.ownPid || !ports.isRunning(owner);
@@ -68033,7 +68190,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     return true;
   };
   const fail = (message) => {
-    if (writeOwnState({ lastError: message, ...sticky() })) {
+    if (writeOwnState({ lastError: message })) {
       fs19.removeRecursive(paths.headroomLockFile);
     }
     ports.log(`agent-shim headroom supervisor: ${message}`);
@@ -68056,11 +68213,17 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     installedSource = config2.source;
     return true;
   };
+  const socket = prepareHeadroomSocket(fs19, ports.socketTrust, paths, ports.ownPid);
+  if (socket.refused !== void 0) {
+    return fail(socket.refused);
+  }
+  const { socketPath } = socket;
+  pruneStaleHeadroomSockets(fs19, paths, ports.isRunning);
   if (!ensureInstalled()) {
     return fail(`could not install headroom from ${config2.source}: install failed (is uv installed and on PATH?)`);
   }
   const version2 = ports.headroomVersion() ?? "unknown";
-  writeOwnState({ supervisorPid: ports.ownPid, version: version2, installedSource, ...sticky() });
+  writeOwnState({ supervisorPid: ports.ownPid, version: version2, installedSource });
   ports.log(`agent-shim headroom supervisor ${String(ports.ownPid)}: managing headroom on allowlist [${allowlistOf(ports).join(", ")}]`);
   const orphanPid = previousState?.headroomPid;
   if (orphanPid !== void 0 && ports.isRunning(orphanPid)) {
@@ -68086,7 +68249,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     pruneDeadSessions(fs19, paths.headroomSessionsDir, ports.isRunning);
     const ownsNow = ownsState();
     if (!ownsNow && !superseded) {
-      ports.log("agent-shim headroom supervisor: another supervisor now owns state.json; serving this daemon's own sessions until they end");
+      ports.log("agent-shim headroom supervisor: another supervisor now owns the state file; serving this daemon's own sessions until they end");
     }
     superseded = !ownsNow;
     const crashed = headroomPid !== void 0 && !ports.isRunning(headroomPid);
@@ -68099,8 +68262,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
         writeOwnState({
           supervisorPid: ports.ownPid,
           version: version2,
-          installedSource,
-          ...sticky()
+          installedSource
         });
       }
       if (consecutiveFailures >= HEADROOM_START_RETRY_BUDGET) {
@@ -68109,41 +68271,32 @@ async function runSupervisor(initialConfig, ports, options = {}) {
       if (installedSource !== config2.source && !ensureInstalled()) {
         return fail(`could not install headroom from ${config2.source}: install failed (is uv installed and on PATH?)`);
       }
-      const previousSticky = lastPort;
-      const port = lastPort !== void 0 && await ports.isPortFree(lastPort) ? lastPort : await ports.freePort();
-      const pid = ports.spawnHeadroom(port, allowlist, config2.settings);
-      const ready = await waitUntilReady(ports, port);
+      const pid = ports.spawnHeadroom(socketPath, allowlist, config2.settings);
+      const ready = await waitUntilReady(ports, socketPath);
       if (ready) {
         consecutiveFailures = 0;
         headroomPid = pid;
         runningHash = allowlistHash;
         runningSettingsHash = settingsHash;
-        lastPort = port;
-        if (previousSticky !== void 0 && port !== previousSticky) {
-          ports.log(
-            `agent-shim headroom supervisor: sticky port ${String(previousSticky)} was occupied; moving to ${String(port)} (sessions launched against the old port are stale until they relaunch)`
-          );
-        }
         const recorded = writeOwnState({
           supervisorPid: ports.ownPid,
           headroomPid: pid,
-          port,
+          socketPath,
           version: version2,
           allowlistHash,
           settingsHash,
-          installedSource: config2.source,
-          ...sticky()
+          installedSource: config2.source
         });
         if (recorded) {
           fs19.removeRecursive(paths.headroomLockFile);
         }
         idleSince = void 0;
-        ports.log(`agent-shim headroom supervisor: headroom pid ${String(pid)} ready on 127.0.0.1:${String(port)}`);
+        ports.log(`agent-shim headroom supervisor: headroom pid ${String(pid)} ready on unix socket ${socketPath}`);
       } else {
         ports.stopProcess(pid);
         consecutiveFailures += 1;
         ports.log(
-          `agent-shim headroom supervisor: headroom did not become ready on port ${String(port)} (attempt ${String(consecutiveFailures)} of ${String(HEADROOM_START_RETRY_BUDGET)})`
+          `agent-shim headroom supervisor: headroom did not become ready on unix socket ${socketPath} (attempt ${String(consecutiveFailures)} of ${String(HEADROOM_START_RETRY_BUDGET)})`
         );
         await ports.sleep(backoffForAttempt(consecutiveFailures));
         continue;
@@ -68168,10 +68321,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
             `agent-shim headroom supervisor: no sessions for ${String(config2.idleShutdownMinutes)} minute(s); stopping headroom and exiting`
           );
           ports.stopProcess(headroomPid);
-          writeOwnState({
-            version: version2,
-            ...sticky()
-          });
+          writeOwnState({ version: version2 });
           return 0;
         }
       } else {
@@ -68188,10 +68338,10 @@ function currentHeadroomAllowlist(fs19, paths) {
 function allowlistOf(ports) {
   return currentHeadroomAllowlist(ports.fs, ports.paths);
 }
-async function waitUntilReady(ports, port) {
+async function waitUntilReady(ports, socketPath) {
   const deadline = ports.now() + HEADROOM_READY_TIMEOUT_MS;
   for (; ; ) {
-    if (await ports.ready(port)) {
+    if (await ports.ready(socketPath)) {
       return true;
     }
     if (ports.now() >= deadline) {
@@ -68231,11 +68381,11 @@ function formatHeadroomStatus(status) {
       `supervisor: pid ${String(status.state.supervisorPid)} (${status.supervisorAlive ? "alive" : "NOT running"})`
     );
   }
-  if (status.state.headroomPid === void 0 || status.state.port === void 0) {
+  if (status.state.headroomPid === void 0 || status.state.socketPath === void 0) {
     lines.push("headroom: not running");
   } else {
     lines.push(
-      `headroom: pid ${String(status.state.headroomPid)} (${status.headroomAlive ? "alive" : "NOT running"}), listening on 127.0.0.1:${String(status.state.port)}` + (status.state.version === void 0 ? "" : `, ${status.state.version}`)
+      `headroom: pid ${String(status.state.headroomPid)} (${status.headroomAlive ? "alive" : "NOT running"}), listening on unix socket ${status.state.socketPath}` + (status.state.version === void 0 ? "" : `, ${status.state.version}`)
     );
   }
   const drift = status.allowlistDrifted ? " (DRIFTED: current provider files differ from the running daemon's allowlist; a restart is pending)" : "";
@@ -68257,50 +68407,54 @@ function formatHeadroomStatus(status) {
   lines.push(`daemon log: ${status.logPath}${status.logExists ? "" : " (not created yet)"}`);
   return lines;
 }
-async function realFreePort() {
-  return await new Promise((resolve, reject) => {
-    const server = import_node_net3.default.createServer();
-    server.unref();
-    server.on("error", reject);
-    server.listen(0, "127.0.0.1", () => {
-      const address = server.address();
-      const port = typeof address === "object" && address !== null ? address.port : 0;
-      server.close(() => {
-        if (port === 0) {
-          reject(new Error("could not reserve a loopback port"));
-          return;
-        }
-        resolve(port);
-      });
-    });
-  });
-}
 var ownedHeadroom = /* @__PURE__ */ new Map();
 var exitedHeadroom = /* @__PURE__ */ new Set();
 var READY_FETCH_TIMEOUT_MS = 2e3;
 function headroomPidRunning(pid) {
   return !exitedHeadroom.has(pid) && realIsProcessRunning(pid);
 }
-function headroomSpawnEnv(parentEnv, allowlist, settings2) {
+function headroomSpawnEnv(parentEnv, allowlist, settings2, caBundle) {
+  const inherited = { ...parentEnv };
+  delete inherited.HEADROOM_HOST;
+  delete inherited.HEADROOM_PORT;
   return {
-    ...parentEnv,
+    ...inherited,
     HEADROOM_ALLOWED_BASE_URLS: allowlist.join(","),
     HEADROOM_HTTP2: parentEnv.HEADROOM_HTTP2 ?? "0",
+    // A transparent-interception deployment redirects the API host's address machine-wide, so headroom's own Python dials reach the front door's leaf instead of the origin's public certificate, and Python trusts only the system store: point its two trust variables (urllib3/httpx read both) at the door's combined bundle, which carries the system-equivalent anchors alongside the door's CA. An explicit value in the parent environment always wins, exactly like HEADROOM_HTTP2.
+    ...caBundle === void 0 || parentEnv.REQUESTS_CA_BUNDLE !== void 0 || parentEnv.SSL_CERT_FILE !== void 0 ? {} : { REQUESTS_CA_BUNDLE: caBundle, SSL_CERT_FILE: caBundle },
     ...settingsEnv(settings2)
   };
 }
+function headroomProxyArgs(socketPath, settings2) {
+  return ["proxy", "--uds", socketPath, ...settingsArgs(settings2)];
+}
+async function readyOverSocket(socketPath) {
+  return await new Promise((resolve) => {
+    const probe = import_node_http2.default.get({ socketPath, path: "/readyz", timeout: READY_FETCH_TIMEOUT_MS }, (response) => {
+      response.resume();
+      resolve(response.statusCode === HTTP_STATUS.ok);
+    });
+    probe.on("timeout", () => {
+      probe.destroy();
+    });
+    probe.on("error", () => {
+      resolve(false);
+    });
+  });
+}
 var HEADROOM_TOOL_NAME = "headroom-ai";
 function readInstalledHeadroomCommit() {
   const toolDir = (0, import_node_child_process5.spawnSync)("uv", ["tool", "dir"], { encoding: "utf8" });
   if (toolDir.status !== 0) {
     return void 0;
   }
-  const libDir = import_node_path34.default.join(toolDir.stdout.trim(), HEADROOM_TOOL_NAME, "lib");
+  const libDir = import_node_path35.default.join(toolDir.stdout.trim(), HEADROOM_TOOL_NAME, "lib");
   for (const python of realFarmFs.readdir(libDir)) {
-    const sitePackages = import_node_path34.default.join(libDir, python, "site-packages");
+    const sitePackages = import_node_path35.default.join(libDir, python, "site-packages");
     for (const entry of realFarmFs.readdir(sitePackages)) {
       if (entry.startsWith("headroom_ai-") && entry.endsWith(".dist-info")) {
-        const directUrl = realFarmFs.readFileUtf8(import_node_path34.default.join(sitePackages, entry, "direct_url.json"));
+        const directUrl = realFarmFs.readFileUtf8(import_node_path35.default.join(sitePackages, entry, "direct_url.json"));
         return directUrl === void 0 ? void 0 : parseInstalledCommit(directUrl);
       }
     }
@@ -68320,17 +68474,17 @@ function realSupervisorPorts(paths) {
       });
     },
     isRunning: headroomPidRunning,
-    freePort: realFreePort,
-    isPortFree: realIsPortFree,
+    socketTrust: realHeadroomSocketTrust,
     readConfig: () => resolveSupervisorConfig(readGlobalConfig(paths)?.headroom ?? {}),
-    spawnHeadroom: (port, allowlist, settings2) => {
+    spawnHeadroom: (socketPath, allowlist, settings2) => {
+      const caBundle = import_node_fs15.default.existsSync(paths.frontdoorCaCertFile) ? import_node_fs15.default.readFileSync(paths.frontdoorCaCertFile, "utf8") : void 0;
       import_node_fs15.default.mkdirSync(paths.logsDir, { recursive: true });
       const logFd = import_node_fs15.default.openSync(paths.headroomLogPath, "a");
       try {
-        const child = (0, import_node_child_process5.spawn)("headroom", ["proxy", "--host", "127.0.0.1", "--port", String(port), ...settingsArgs(settings2)], {
+        const child = (0, import_node_child_process5.spawn)("headroom", headroomProxyArgs(socketPath, settings2), {
           detached: true,
           stdio: ["ignore", logFd, logFd],
-          env: headroomSpawnEnv(process.env, allowlist, settings2)
+          env: headroomSpawnEnv(process.env, allowlist, settings2, caBundle)
         });
         if (child.pid === void 0) {
           throw new Error("spawning headroom returned no pid");
@@ -68365,14 +68519,7 @@ function realSupervisorPorts(paths) {
         );
       }
     },
-    ready: async (port) => {
-      try {
-        const response = await fetch(`http://127.0.0.1:${String(port)}/readyz`, { signal: AbortSignal.timeout(READY_FETCH_TIMEOUT_MS) });
-        return response.ok;
-      } catch {
-        return false;
-      }
-    },
+    ready: readyOverSocket,
     install: (spec) => {
       const result = (0, import_node_child_process5.spawnSync)("uv", ["tool", "install", spec], { encoding: "utf8" });
       if (result.error !== void 0) {
@@ -68404,7 +68551,7 @@ function registerHeadroomCommand(program2, deps) {
     "agent-shim headroom status"
   ]);
   withExamples(
-    headroom.command("status").description("Report the headroom daemon's supervisor, process, port, sessions, and last error. Read-only.").option("--json", "Print the status as JSON.").action((options) => {
+    headroom.command("status").description("Report the headroom daemon's supervisor, process, socket, sessions, and last error. Read-only.").option("--json", "Print the status as JSON.").action((options) => {
       const status = collectHeadroomStatus(realFarmFs, paths, realIsProcessRunning);
       if (options.json === true) {
         printJson(status);
@@ -69249,11 +69396,11 @@ function probeFrontDoorSync(port, caPem) {
 // src/frontdoor/trust.ts
 var import_node_crypto14 = require("node:crypto");
-var import_node_path35 = __toESM(require("node:path"), 1);
+var import_node_path36 = __toESM(require("node:path"), 1);
 var BUNDLE_NAME_HEX_DIGITS = 16;
 function resolveTrustBundle(params) {
   const { caCertFile, bundlesDir, inherited, fs: fs19 } = params;
-  if (inherited === void 0 || inherited === "" || import_node_path35.default.resolve(inherited) === import_node_path35.default.resolve(caCertFile)) {
+  if (inherited === void 0 || inherited === "" || import_node_path36.default.resolve(inherited) === import_node_path36.default.resolve(caCertFile)) {
     return { path: caCertFile };
   }
   const caPem = fs19.readFileUtf8(caCertFile);
@@ -69271,7 +69418,7 @@ function resolveTrustBundle(params) {
   }
   const combined = `${inheritedPem.trimEnd()}
 ${caPem}`;
-  const bundle = import_node_path35.default.join(bundlesDir, `${(0, import_node_crypto14.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
+  const bundle = import_node_path36.default.join(bundlesDir, `${(0, import_node_crypto14.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
   if (!fs19.exists(bundle)) {
     fs19.mkdirp(bundlesDir);
     fs19.writeFileAtomic(bundle, combined);
@@ -69326,7 +69473,7 @@ function realFrontDoorPort(paths, spawnDaemon) {
 // src/launcher.ts
 var import_node_crypto15 = require("node:crypto");
-var import_node_path37 = __toESM(require("node:path"), 1);
+var import_node_path38 = __toESM(require("node:path"), 1);
 // src/launcher/cliOverride.ts
 var InvalidCliCategoryError = class extends CliError {
@@ -69410,7 +69557,7 @@ function buildCliOverride(params) {
 }
 // src/launcher/flags.ts
-var import_node_path36 = __toESM(require("node:path"), 1);
+var import_node_path37 = __toESM(require("node:path"), 1);
 // src/headroom/headers.ts
 function mergeAnthropicCustomHeaders(existing, additions) {
@@ -69480,7 +69627,7 @@ function buildEnv(params) {
   const parentCustomHeaders = params.baseEnv.ANTHROPIC_CUSTOM_HEADERS;
   let providerCustomHeaders;
   if (!params.configDirEscapeHatch && params.resolvedIdentityName !== void 0) {
-    env.CLAUDE_CONFIG_DIR = import_node_path36.default.join(params.identitiesDir, params.resolvedIdentityName);
+    env.CLAUDE_CONFIG_DIR = import_node_path37.default.join(params.identitiesDir, params.resolvedIdentityName);
   }
   if (params.provider !== void 0) {
     const providerEnv = params.provider.definition.env ?? {};
@@ -69501,9 +69648,6 @@ function buildEnv(params) {
       env[variable] = value;
     }
   }
-  if (params.headroom !== void 0) {
-    env.HEADROOM_PROXY_URL = `http://127.0.0.1:${String(params.headroom.port)}`;
-  }
   if (params.frontdoor !== void 0) {
     env.ANTHROPIC_CUSTOM_HEADERS = mergeAnthropicCustomHeaders(
       [
@@ -69667,7 +69811,7 @@ function prepareLaunch(params) {
     identityDefaultConfigProfile: loadedIdentity?.config.defaultConfigProfile,
     globalDefaultConfigProfile: params.globalDefaultConfigProfile
   });
-  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs19.readConfigFile(import_node_path37.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
+  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs19.readConfigFile(import_node_path38.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
     log.error(
       `agent-shim: no configuration profile named "${configProfileDecision.name}" (selected via ${configProfileDecision.source}). Run \`agent-shim profile add ${configProfileDecision.name}\` first.`
     );
@@ -69803,7 +69947,7 @@ function prepareLaunch(params) {
   if (resolvedFlags.headroom && headroomPort !== void 0) {
     headroom = headroomPort.ensure();
     const via = resolvedProvider === void 0 ? `OAuth via the door's CONNECT surface on 127.0.0.1:${String(frontDoor?.connectPort ?? 0)}` : `provider ${resolvedProvider.name}`;
-    log.info(`agent-shim: routing through the front door on 127.0.0.1:${String(frontDoor?.port ?? 0)} with headroom on 127.0.0.1:${String(headroom.port)} (${via}, project ${headroom.projectId})`);
+    log.info(`agent-shim: routing through the front door on 127.0.0.1:${String(frontDoor?.port ?? 0)} with headroom on unix socket ${headroom.socketPath} (${via}, project ${headroom.projectId})`);
   } else if (resolvedFlags.headroom) {
     log.error("agent-shim: headroom routing was requested but this launcher has no headroom port wired; refusing to launch without it.");
     proc.exit(1);
@@ -69967,7 +70111,7 @@ async function runClaude(argvOverride) {
 // src/cli.ts
 async function main() {
   aliasLegacyEnv(process.env);
-  const invokedName = import_node_path38.default.basename(process.argv[1] ?? "agent-shim");
+  const invokedName = import_node_path39.default.basename(process.argv[1] ?? "agent-shim");
   if (isInvokedAsClaude(invokedName)) {
     await runClaude();
     return;