claude-use 9.12.0 → 9.13.0

package/dist/cli.cjs

@@ -24790,6 +24790,36 @@ var init_versionDiscovery = __esm({
   }
 });
 
+// src/frontdoor/supervisorProcesses.ts
+function parseFrontDoorSupervisorPids(psOutput) {
+  const pids = [];
+  for (const line of psOutput.split("\n")) {
+    const [pidText, ...argumentsList] = line.trim().split(/\s+/);
+    const pid = Number(pidText);
+    if (Number.isInteger(pid) && pid > 0 && argumentsList.includes(FRONT_DOOR_SUPERVISOR_ARGUMENT)) {
+      pids.push(pid);
+    }
+  }
+  return pids.sort((a10, b) => a10 - b);
+}
+function listFrontDoorSupervisors(run, uid) {
+  const result = run.run("ps", ["-U", String(uid), "-o", "pid=,command="]);
+  if (result.status === null) {
+    return { ok: false, message: "ps could not be run" };
+  }
+  if (result.status !== 0) {
+    return { ok: false, message: `ps exited ${String(result.status)}${result.stderr.trim() === "" ? "" : `: ${result.stderr.trim()}`}` };
+  }
+  return { ok: true, pids: parseFrontDoorSupervisorPids(result.stdout) };
+}
+var FRONT_DOOR_SUPERVISOR_ARGUMENT;
+var init_supervisorProcesses = __esm({
+  "src/frontdoor/supervisorProcesses.ts"() {
+    "use strict";
+    FRONT_DOOR_SUPERVISOR_ARGUMENT = "__frontdoor-supervisor";
+  }
+});
+
 // node_modules/.pnpm/trilean@1.7.1/node_modules/trilean/dist/complex.js
 var complexFromPolar;
 var init_complex = __esm({
@@ -27321,7 +27351,7 @@ function listFrontDoorSessions(fs22, sessionsDir) {
     try {
       const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs22.readFileUtf8(import_node_path6.default.join(sessionsDir, name)) ?? ""));
       if (parsed.success) {
-        sessions.push({ pid: parsed.data.pid, startedAt: parsed.data.startedAt });
+        sessions.push({ pid: parsed.data.pid, startedAt: parsed.data.startedAt, ...parsed.data.supervisorPid === void 0 ? {} : { supervisorPid: parsed.data.supervisorPid } });
       }
     } catch {
       continue;
@@ -27366,7 +27396,7 @@ var init_state2 = __esm({
     import_node_path6 = __toESM(require("node:path"), 1);
     init_zod();
     FRONT_DOOR_PROTOCOL = 3;
-    FrontDoorSessionSchema = external_exports.strictObject({ pid: external_exports.number().int().positive(), startedAt: external_exports.number(), token: external_exports.string().min(1) });
+    FrontDoorSessionSchema = external_exports.strictObject({ pid: external_exports.number().int().positive(), startedAt: external_exports.number(), token: external_exports.string().min(1), supervisorPid: external_exports.number().int().positive().optional() });
     FrontDoorStateSchema = external_exports.strictObject({
       /**
        * The launcher-to-door wire protocol this supervisor speaks, written once it is serving; absent in state written by a release that predates the field, which `ensureFrontDoor` reads as protocol 0. A launcher replaces a door whose protocol is lower than its own (see `FRONT_DOOR_PROTOCOL`).
@@ -27799,9 +27829,15 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     await ports.sleep(HEADROOM_POLL_MS);
   }
 }
+function currentHeadroomAllowlistInputs(fs22, paths) {
+  return {
+    providers: readAllProviders(fs22, paths.providersDir).map((entry) => entry.provider),
+    frontDoorOrigin: frontDoorOrigin(readFrontDoorState(fs22, paths.frontdoorStateFile))
+  };
+}
 function currentHeadroomAllowlist(fs22, paths) {
-  const providers = readAllProviders(fs22, paths.providersDir).map((entry) => entry.provider);
-  return headroomAllowlist(headroomUpstreams(providers, frontDoorOrigin(readFrontDoorState(fs22, paths.frontdoorStateFile))));
+  const inputs = currentHeadroomAllowlistInputs(fs22, paths);
+  return headroomAllowlist(headroomUpstreams(inputs.providers, inputs.frontDoorOrigin));
 }
 function allowlistOf(ports) {
   return currentHeadroomAllowlist(ports.fs, ports.paths);
@@ -27866,6 +27902,10 @@ function realIsProcessZombie(pid) {
 function realIsProcessRunning(pid) {
   return realIsProcessAlive(pid) && !realIsProcessZombie(pid);
 }
+function realIsFrontDoorSupervisor(pid) {
+  const result = (0, import_node_child_process2.spawnSync)("ps", ["-o", "pid=,command=", "-p", String(pid)], { encoding: "utf8" });
+  return result.status === 0 && parseFrontDoorSupervisorPids(result.stdout).includes(pid);
+}
 function expandHome(filePath) {
   return filePath.startsWith("~/") ? import_node_path8.default.join(import_node_os2.default.homedir(), filePath.slice(1)) : filePath;
 }
@@ -28080,6 +28120,7 @@ var init_realPorts = __esm({
     import_node_sea = require("node:sea");
     init_load();
     init_versionDiscovery();
+    init_supervisorProcesses();
     init_ensure();
     init_supervisor();
     init_state();
@@ -33243,7 +33284,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "claude-use",
-      version: "9.12.0",
+      version: "9.13.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -34113,7 +34154,7 @@ function assessIdentity(member, nowMs) {
   );
   if (blockedUntil > nowMs) {
     if (unified.overageStatus === "allowed") {
-      return { candidate: { ...base, class: "pay-per-use", reasons: [`plan exhausted until ${new Date(blockedUntil).toISOString()}, continues as extra usage`, ...windowReasons, ...planReasons] } };
+      return { candidate: { ...base, class: "pay-per-use", planReturnsAtMs: blockedUntil, reasons: [`plan exhausted until ${new Date(blockedUntil).toISOString()} (in ${formatAge(blockedUntil - nowMs)}), continues as extra usage`, ...windowReasons, ...planReasons] } };
     }
     return { candidate: { ...base, class: "ineligible", blockedUntilMs: blockedUntil, reasons: [`refused until ${new Date(blockedUntil).toISOString()} (in ${formatAge(blockedUntil - nowMs)})`, ...unified.fallbackAvailable === true ? ["a fallback is on offer, so requests for some models may still be served"] : [], ...windowReasons, ...overageReasons, ...planReasons] } };
   }
@@ -34228,7 +34269,8 @@ function rankPool(input2) {
   return {
     candidates: ordered,
     ...pick2 === void 0 ? { ...earliestReturn === void 0 ? {} : { earliestReturn } } : { pick: pick2 },
-    ...movedOff === void 0 || pick2 === void 0 ? {} : { movedOff }
+    ...movedOff === void 0 || pick2 === void 0 ? {} : { movedOff },
+    ...pick2?.planReturnsAtMs === void 0 ? {} : { planReturn: { identity: pick2.identity, atMs: pick2.planReturnsAtMs } }
   };
 }
 var MS_PER_SECOND3, MS_PER_HOUR2, HOURS_PER_DAY2, FIVE_HOURS, PROMPT_CACHE_TTL_HOURS, PERCENT, SEVEN_DAYS, FIVE_HOUR_WINDOW_MS, SEVEN_DAY_WINDOW_MS, PROMPT_CACHE_TTL_MS, CLASS_ORDER;
@@ -61034,32 +61076,50 @@ function ensureFrontDoor(params) {
   let replaced = false;
   const distrusted = /* @__PURE__ */ new Set();
   let lastRejection;
+  const verifyWithRetry = (port) => {
+    let verdict = ports.verifyListener(port);
+    for (let attempt = 1; !verdict.ok && attempt < FRONTDOOR_PROBE_ATTEMPTS; attempt += 1) {
+      ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
+      verdict = ports.verifyListener(port);
+    }
+    return verdict;
+  };
+  const stopAndAwaitExit = (supervisorPid, failure2) => {
+    ports.stopSupervisor(supervisorPid);
+    while (ports.isRunning(supervisorPid)) {
+      if (ports.now() >= deadline) {
+        throw new FrontDoorStartError(`${failure2}. Daemon log: ${paths.frontdoorLogPath}`);
+      }
+      ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
+    }
+  };
   for (; ; ) {
     const state = readFrontDoorState(ports.fs, paths.frontdoorStateFile);
     const supervisorPid = state?.supervisorPid;
     if (supervisorPid !== void 0 && !distrusted.has(supervisorPid) && ports.isRunning(supervisorPid)) {
       if (state?.port !== void 0 && state.connectPort !== void 0) {
-        const verdict = ports.verifyListener(state.port);
+        const verdict = verifyWithRetry(state.port);
         if (verdict.ok && !replaced && !spawned && (params.replace === true || (state.protocol ?? 0) < FRONT_DOOR_PROTOCOL)) {
-          ports.stopSupervisor(supervisorPid);
-          while (ports.isRunning(supervisorPid)) {
-            if (ports.now() >= deadline) {
-              throw new FrontDoorStartError(`the front door (pid ${String(supervisorPid)}, protocol ${String(state.protocol ?? 0)}; this launcher speaks protocol ${String(FRONT_DOOR_PROTOCOL)}) was asked to be replaced and did not exit. Daemon log: ${paths.frontdoorLogPath}`);
-            }
-            ports.sleep(FRONTDOOR_LAUNCHER_POLL_MS);
-          }
+          stopAndAwaitExit(
+            supervisorPid,
+            `the front door (pid ${String(supervisorPid)}, protocol ${String(state.protocol ?? 0)}; this launcher speaks protocol ${String(FRONT_DOOR_PROTOCOL)}) was asked to be replaced and did not exit`
+          );
           replaced = true;
           continue;
         }
         if (verdict.ok) {
           const token = (0, import_node_crypto10.randomUUID)();
-          writeFrontDoorSession(ports.fs, paths.frontdoorSessionsDir, { pid: params.launcherPid, startedAt: ports.now(), token });
+          writeFrontDoorSession(ports.fs, paths.frontdoorSessionsDir, { pid: params.launcherPid, startedAt: ports.now(), token, supervisorPid });
           return { port: state.port, connectPort: state.connectPort, token };
         }
         lastRejection = `the listener on 127.0.0.1:${String(state.port)} (recorded for pid ${String(supervisorPid)}) failed authentication: ${verdict.reason}`;
         if (spawned) {
           throw new FrontDoorStartError(`${lastRejection}; refusing to send this session's credentials to it. Daemon log: ${paths.frontdoorLogPath}`);
         }
+        if (ports.isFrontDoorSupervisor(supervisorPid)) {
+          stopAndAwaitExit(supervisorPid, `the front door (pid ${String(supervisorPid)}) stopped answering and did not exit when asked to`);
+          continue;
+        }
         distrusted.add(supervisorPid);
         continue;
       }
@@ -61107,7 +61167,7 @@ function restartFrontDoor(params) {
   }
   return { action: "restarted", previousPid, pid };
 }
-var import_node_crypto10, FRONTDOOR_START_TIMEOUT_MS, FRONTDOOR_LAUNCHER_POLL_MS, FrontDoorStartError;
+var import_node_crypto10, FRONTDOOR_START_TIMEOUT_MS, FRONTDOOR_LAUNCHER_POLL_MS, FRONTDOOR_PROBE_ATTEMPTS, FrontDoorStartError;
 var init_ensure2 = __esm({
   "src/frontdoor/ensure.ts"() {
     "use strict";
@@ -61117,6 +61177,7 @@ var init_ensure2 = __esm({
     init_state2();
     FRONTDOOR_START_TIMEOUT_MS = 3e4;
     FRONTDOOR_LAUNCHER_POLL_MS = 100;
+    FRONTDOOR_PROBE_ATTEMPTS = 3;
     FrontDoorStartError = class extends CliError {
       constructor(message) {
         super(message);
@@ -61242,6 +61303,7 @@ function realEnsurePorts(paths, spawnDaemon) {
     now: () => Date.now(),
     sleep: realSleepSync,
     spawnSupervisor: (layout) => spawnDaemon(layout, "__frontdoor-supervisor", layout.frontdoorLogPath),
+    isFrontDoorSupervisor: realIsFrontDoorSupervisor,
     stopSupervisor: (pid) => {
       process.kill(pid, "SIGTERM");
     },
@@ -62128,7 +62190,12 @@ function resolvePoolLaunch(params) {
     if (graph.ranking.candidates.length === 0) {
       return { ok: false, message: `agent-shim: no member of pool "${poolName}" is an existing identity.` };
     }
-    const { pick: pick2, earliestReturn, movedOff } = graph.ranking;
+    const { pick: pick2, earliestReturn, movedOff, planReturn } = graph.ranking;
+    if (pick2 !== void 0 && params.wait && planReturn !== void 0) {
+      log.info(`agent-shim: pool "${poolName}" would continue ${planReturn.identity} on extra usage; waiting until ${new Date(planReturn.atMs).toISOString()} for its plan window`);
+      params.sleep(Math.max(planReturn.atMs - nowMs, 0));
+      continue;
+    }
     if (pick2 !== void 0) {
       if (params.recordPick) {
         recordStickyPick(params.usageFs, params.paths.usagePicksFile, params.cwd, pick2.identity, nowMs);
@@ -112271,16 +112338,27 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
   ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http8.port)}, CONNECT surface on 127.0.0.1:${String(connect3.port)}`);
   let idleSince;
   let ticks = 0;
+  const supersedingOwner = () => {
+    const owner = readFrontDoorState(fs22, paths.frontdoorStateFile)?.supervisorPid;
+    return owner !== void 0 && owner !== ports.ownPid && ports.isRunning(owner) ? owner : void 0;
+  };
+  let supersededBy;
+  let served;
   const binaryReplaced = () => {
     const current = ports.statOwnExecutable();
     return current !== void 0 && servingBinary !== void 0 && (current.dev !== servingBinary.dev || current.ino !== servingBinary.ino || current.size !== servingBinary.size || current.mtimeMs !== servingBinary.mtimeMs);
   };
-  const shutdown = async () => {
+  const closeServing = async () => {
     await direct.close();
     await connect3.close();
     await http8.close();
     ports.closeRcStreamHub();
-    writeFrontDoorState(fs22, paths.frontdoorStateFile, sticky());
+  };
+  const shutdown = async () => {
+    await closeServing();
+    if (supersedingOwner() === void 0) {
+      writeFrontDoorState(fs22, paths.frontdoorStateFile, sticky());
+    }
     return 0;
   };
   for (; ; ) {
@@ -112293,7 +112371,28 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     ports.observeLaunchRegistry(listed, pruned);
     ports.checkQuotaExpiry();
     const prunedPids = new Set(pruned);
-    if (listed.filter((session) => !prunedPids.has(session.pid)).length === 0) {
+    const live = listed.filter((session) => !prunedPids.has(session.pid));
+    if (supersededBy === void 0) {
+      supersededBy = supersedingOwner();
+      if (supersededBy !== void 0) {
+        ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: supervisor ${String(supersededBy)} now owns the front door; taking no new sessions and exiting once the sessions this door serves have ended`);
+        ports.doorHealth.superseded(supersededBy);
+        await ports.sleep(FRONTDOOR_POLL_MS);
+        continue;
+      }
+    } else {
+      const owner = supersededBy;
+      served = (served ?? live.filter((session) => session.pid !== ports.ownPid && session.pid !== owner && (session.supervisorPid === void 0 || session.supervisorPid === ports.ownPid))).filter((own2) => live.some((session) => session.pid === own2.pid && session.startedAt === own2.startedAt));
+      if (served.length === 0) {
+        ports.log("agent-shim frontdoor supervisor: the sessions this superseded door served have ended; closing the front door and exiting");
+        ports.doorHealth.drained();
+        await closeServing();
+        return 0;
+      }
+      await ports.sleep(FRONTDOOR_POLL_MS);
+      continue;
+    }
+    if (live.length === 0) {
       if (ticks > 1 && binaryReplaced()) {
         ports.log("agent-shim frontdoor supervisor: the installed binary changed and no sessions are live; turning the door over for the next launch");
         ports.doorHealth.binaryTurnover();
@@ -114616,7 +114715,55 @@ init_credential();
 init_credentialCache();
 init_realCredentialCache();
 init_source();
+
+// src/headroom/allowlistDrift.ts
+init_state();
+function diagnoseAllowlistDrift(params) {
+  const { recordedHash, providers, frontDoorOrigin: frontDoorOrigin2 } = params;
+  if (recordedHash === void 0 || recordedHash === hashAllowlist(headroomAllowlist(headroomUpstreams(providers, frontDoorOrigin2)))) {
+    return void 0;
+  }
+  const originIsInput = providers.length > 0 && frontDoorOrigin2 !== void 0;
+  if (!originIsInput) {
+    return ["provider-files"];
+  }
+  return recordedHash === hashAllowlist(headroomAllowlist(headroomUpstreams(providers, void 0))) ? ["front-door-origin"] : ["provider-files", "front-door-origin"];
+}
+
+// src/doctorReport.ts
 init_state();
+init_supervisor();
+init_state2();
+
+// src/doctorFrontDoor.ts
+function pushFrontDoor(push, supervisors, registeredPid) {
+  if (!supervisors.ok) {
+    push("frontdoor", "warn", `Could not list processes to look for duplicate front door supervisors: ${supervisors.message}.`);
+    return;
+  }
+  const { pids } = supervisors;
+  if (pids.length === 0) {
+    push("frontdoor", "pass", "No front door supervisor is running.");
+    return;
+  }
+  const [only, ...rest] = pids;
+  if (only !== void 0 && rest.length === 0) {
+    push("frontdoor", "pass", `One front door supervisor is running (pid ${String(only)}).`);
+    return;
+  }
+  const serving = registeredPid !== void 0 && pids.includes(registeredPid) ? `The front door state file names pid ${String(registeredPid)} as the serving supervisor.` : "The front door state file names no running supervisor.";
+  for (const pid of pids.filter((candidate) => candidate !== registeredPid)) {
+    push(
+      "frontdoor",
+      "fail",
+      `Front door supervisor pid ${String(pid)} is running beside ${String(pids.length - 1)} other(s). ${serving} Stop it with \`kill ${String(pid)}\`; launches still connected to it lose their door.`,
+      String(pid)
+    );
+  }
+}
+
+// src/doctorReport.ts
+init_supervisorProcesses();
 init_legacy();
 init_providersStore();
 init_guard();
@@ -114639,7 +114786,8 @@ var DOCTOR_SECTIONS = [
   "global-config",
   "categories-local",
   "active-identity",
-  "headroom"
+  "headroom",
+  "frontdoor"
 ];
 function refinePathShadow(status, ownExecutablePath, realpath) {
   if (status.status !== "shadowed") {
@@ -115035,6 +115183,17 @@ function runDoctor(params) {
           `Headroom daemon is up on unix socket ${state.socketPath} (supervisor ${String(state.supervisorPid)}, daemon ${String(state.headroomPid)}).`
         );
       }
+      const allowlist = params.headroom.allowlist;
+      if (supervisorAlive && headroomAlive && state.socketPath !== void 0 && allowlist?.driftInputs?.includes("front-door-origin") === true) {
+        const origin = allowlist.frontDoorOrigin ?? "";
+        const certainty = allowlist.driftInputs.includes("provider-files") ? "may exclude" : "excludes";
+        push(
+          "headroom",
+          "fail",
+          `Headroom daemon ${String(state.headroomPid)} was started with an allowlist that ${certainty} the serving front door's direct origin ${origin}, so it refuses every request a provider launch sends back through the door. Its supervisor restarts it once no launch is registered against it; \`agent-shim headroom status\` lists the registered launches, and \`--no-headroom\` launches are unaffected.`,
+          String(state.headroomPid)
+        );
+      }
       if (state.lastError !== void 0 && supervisorAlive) {
         push("headroom", "warn", `Headroom recorded a previous error: ${state.lastError}`);
       }
@@ -115047,6 +115206,10 @@ function runDoctor(params) {
       }
     }
   }
+  if (params.frontDoor !== void 0) {
+    const validated2 = params.frontDoor.state.raw === void 0 ? void 0 : validateJson(FrontDoorStateSchema, params.frontDoor.state);
+    pushFrontDoor(push, params.frontDoor.supervisors, validated2?.ok === true ? validated2.data.supervisorPid : void 0);
+  }
   if (params.activeIdentity.raw === void 0) {
     push("active-identity", "pass", "No active identity set.");
   } else {
@@ -115076,6 +115239,7 @@ var SECTION_TITLES = {
   "directory-rules": "Directory rules",
   "global-config": "Global config",
   headroom: "Headroom daemon",
+  frontdoor: "Front door",
   "categories-local": "categories.local.json",
   "active-identity": "Active identity"
 };
@@ -115093,6 +115257,7 @@ var SECTION_ORDER = [
   "directory-rules",
   "global-config",
   "headroom",
+  "frontdoor",
   "categories-local",
   "active-identity"
 ];
@@ -115170,6 +115335,9 @@ function collectDoctorReport(params) {
     shimState.targetPath,
     realpathOrSelf
   );
+  const uid = process.getuid?.();
+  const allowlistInputs = currentHeadroomAllowlistInputs(realFarmFs, paths);
+  const servingHeadroom = resolveServingHeadroomState(realFarmFs, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, realIsProcessRunning);
   const report = runDoctor({
     env: params.env,
     credentialCache: realCredentialCacheEnv(paths),
@@ -115208,8 +115376,13 @@ function collectDoctorReport(params) {
         const statePath = resolved?.path ?? paths.headroomStateFile;
         return { path: statePath, raw: realFarmFs.readFileUtf8(statePath) };
       })(),
-      isRunning: realIsProcessRunning
-    }
+      isRunning: realIsProcessRunning,
+      allowlist: {
+        driftInputs: diagnoseAllowlistDrift({ recordedHash: servingHeadroom?.state.allowlistHash, ...allowlistInputs }),
+        frontDoorOrigin: allowlistInputs.frontDoorOrigin
+      }
+    },
+    ...uid === void 0 ? {} : { frontDoor: { state: { path: paths.frontdoorStateFile, raw: realFsPort.readFileUtf8(paths.frontdoorStateFile) }, supervisors: listFrontDoorSupervisors(realRunPort, uid) } }
   });
   return report;
 }
@@ -123659,7 +123832,9 @@ var DoorHealthEventSchema = external_exports.discriminatedUnion("kind", [
   external_exports.strictObject({ kind: external_exports.literal("generation"), pid: external_exports.number().int().positive(), providerPort: external_exports.number().int().positive(), connectPort: external_exports.number().int().positive(), directPort: external_exports.number().int().positive(), observedAt: external_exports.number() }),
   external_exports.strictObject({ kind: external_exports.literal("listenerFailed"), pid: external_exports.number().int().positive(), listener: external_exports.enum(["provider", "connect", "direct"]), message: external_exports.string(), observedAt: external_exports.number() }),
   external_exports.strictObject({ kind: external_exports.literal("binaryTurnover"), pid: external_exports.number().int().positive(), observedAt: external_exports.number() }),
-  external_exports.strictObject({ kind: external_exports.literal("idleShutdown"), pid: external_exports.number().int().positive(), observedAt: external_exports.number() })
+  external_exports.strictObject({ kind: external_exports.literal("idleShutdown"), pid: external_exports.number().int().positive(), observedAt: external_exports.number() }),
+  external_exports.strictObject({ kind: external_exports.literal("superseded"), pid: external_exports.number().int().positive(), ownerPid: external_exports.number().int().positive(), observedAt: external_exports.number() }),
+  external_exports.strictObject({ kind: external_exports.literal("drained"), pid: external_exports.number().int().positive(), observedAt: external_exports.number() })
 ]);
 var QuotaExpiringEventSchema = external_exports.strictObject({
   identity: external_exports.string().min(1),
@@ -123914,6 +124089,12 @@ function createDoorHealthPublisher(hub, now, pid) {
     },
     binaryTurnover: () => {
       publisher.publish({ kind: "binaryTurnover", pid, observedAt: now() });
+    },
+    superseded: (ownerPid) => {
+      publisher.publish({ kind: "superseded", pid, ownerPid, observedAt: now() });
+    },
+    drained: () => {
+      publisher.publish({ kind: "drained", pid, observedAt: now() });
     }
   };
 }
@@ -139066,7 +139247,9 @@ init_state();
 init_supervisor();
 function collectHeadroomStatus(fsPort, paths, isRunning) {
   const state = resolveServingHeadroomState(fsPort, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, isRunning)?.state ?? {};
-  const allowlist = currentHeadroomAllowlist(fsPort, paths);
+  const inputs = currentHeadroomAllowlistInputs(fsPort, paths);
+  const allowlist = headroomAllowlist(headroomUpstreams(inputs.providers, inputs.frontDoorOrigin));
+  const allowlistDriftInputs = diagnoseAllowlistDrift({ recordedHash: state.allowlistHash, providers: inputs.providers, frontDoorOrigin: inputs.frontDoorOrigin });
   const settings2 = settingsOf(readGlobalConfig(paths)?.headroom ?? {});
   return {
     state,
@@ -139077,13 +139260,27 @@ function collectHeadroomStatus(fsPort, paths, isRunning) {
       alive: isRunning(session.pid)
     })),
     allowlist,
-    allowlistDrifted: state.allowlistHash !== void 0 && state.allowlistHash !== hashAllowlist(allowlist),
+    allowlistDrifted: allowlistDriftInputs !== void 0,
+    frontDoorOrigin: inputs.frontDoorOrigin,
+    allowlistDriftInputs,
     settings: settings2,
     settingsDrifted: state.settingsHash !== void 0 && state.settingsHash !== hashSettings(settings2),
     logPath: paths.headroomLogPath,
     logExists: fsPort.readFileUtf8(paths.headroomLogPath) !== void 0
   };
 }
+function describeAllowlistDrift(status) {
+  const inputs = status.allowlistDriftInputs ?? [];
+  if (!inputs.includes("front-door-origin")) {
+    return "DRIFTED: current provider files differ from the running daemon's allowlist; a restart is pending";
+  }
+  const origin = status.frontDoorOrigin ?? "";
+  const consequence = "provider launches through headroom are refused until the daemon restarts, which waits for the launches registered against it to end";
+  if (!inputs.includes("provider-files")) {
+    return `DRIFTED: the daemon was started before the serving front door's direct origin ${origin} existed, so its allowlist excludes it; ${consequence}`;
+  }
+  return `DRIFTED: the provider files or the serving front door's direct origin ${origin} changed since the daemon started, so its allowlist may exclude the door; ${consequence}`;
+}
 function formatHeadroomStatus(status) {
   const lines = [];
   if (status.state.supervisorPid === void 0) {
@@ -139100,7 +139297,7 @@ function formatHeadroomStatus(status) {
       `headroom: pid ${String(status.state.headroomPid)} (${status.headroomAlive ? "alive" : "NOT running"}), listening on unix socket ${status.state.socketPath}` + (status.state.version === void 0 ? "" : `, ${status.state.version}`)
     );
   }
-  const drift = status.allowlistDrifted ? " (DRIFTED: current provider files differ from the running daemon's allowlist; a restart is pending)" : "";
+  const drift = status.allowlistDrifted ? ` (${describeAllowlistDrift(status)})` : "";
   lines.push(`allowlist: ${status.allowlist.join(", ")}${drift}`);
   const configured = Object.entries(status.settings).map(([name, value2]) => `${name} ${String(value2)}`);
   const settingsDrift = status.settingsDrifted ? " (DRIFTED: the configured settings differ from the running daemon's; a restart is pending)" : "";