claude-use 9.12.1 → 9.14.0

package/dist/cli.cjs

@@ -318,10 +318,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path51) {
-  if (!path51)
+function getElementAtPath(obj, path52) {
+  if (!path52)
     return obj;
-  return path51.reduce((acc, key) => acc?.[key], obj);
+  return path52.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -580,11 +580,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path51, issues) {
+function prefixIssues(path52, issues) {
   return issues.map((iss) => {
     var _a4;
     (_a4 = iss).path ?? (_a4.path = []);
-    iss.path.unshift(path51);
+    iss.path.unshift(path52);
     return iss;
   });
 }
@@ -1105,16 +1105,16 @@ function flattenError(error63, mapper = (issue2) => issue2.message) {
 }
 function formatError(error63, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error64, path51 = []) => {
+  const processError = (error64, path52 = []) => {
     for (const issue2 of error64.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path51, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path52, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path51, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path52, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path51, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path52, ...issue2.path]);
       } else {
-        const fullpath = [...path51, ...issue2.path];
+        const fullpath = [...path52, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -1153,17 +1153,17 @@ function formatError(error63, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error63, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error64, path51 = []) => {
+  const processError = (error64, path52 = []) => {
     var _a4;
     for (const issue2 of error64.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path51, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path52, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path51, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path52, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path51, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path52, ...issue2.path]);
       } else {
-        const fullpath = [...path51, ...issue2.path];
+        const fullpath = [...path52, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -1202,8 +1202,8 @@ function treeifyError(error63, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path51 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path51) {
+  const path52 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path52) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -19199,13 +19199,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path51 = ref.slice(1).split("/").filter(Boolean);
-  if (path51.length === 0) {
+  const path52 = ref.slice(1).split("/").filter(Boolean);
+  if (path52.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path51[0] === defsKey) {
-    const key = path51[1] === void 0 ? void 0 : decodeJSONPointerSegment(path51[1]);
+  if (path52[0] === defsKey) {
+    const key = path52[1] === void 0 ? void 0 : decodeJSONPointerSegment(path52[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -23712,42 +23712,42 @@ var require_defaults = __commonJS({
 var require_env_paths = __commonJS({
   "node_modules/.pnpm/env-paths@2.2.1/node_modules/env-paths/index.js"(exports2, module2) {
     "use strict";
-    var path51 = require("path");
+    var path52 = require("path");
     var os12 = require("os");
     var homedir = os12.homedir();
     var tmpdir = os12.tmpdir();
     var { env } = process;
     var macos = (name) => {
-      const library = path51.join(homedir, "Library");
+      const library = path52.join(homedir, "Library");
       return {
-        data: path51.join(library, "Application Support", name),
-        config: path51.join(library, "Preferences", name),
-        cache: path51.join(library, "Caches", name),
-        log: path51.join(library, "Logs", name),
-        temp: path51.join(tmpdir, name)
+        data: path52.join(library, "Application Support", name),
+        config: path52.join(library, "Preferences", name),
+        cache: path52.join(library, "Caches", name),
+        log: path52.join(library, "Logs", name),
+        temp: path52.join(tmpdir, name)
       };
     };
     var windows = (name) => {
-      const appData = env.APPDATA || path51.join(homedir, "AppData", "Roaming");
-      const localAppData = env.LOCALAPPDATA || path51.join(homedir, "AppData", "Local");
+      const appData = env.APPDATA || path52.join(homedir, "AppData", "Roaming");
+      const localAppData = env.LOCALAPPDATA || path52.join(homedir, "AppData", "Local");
       return {
         // Data/config/cache/log are invented by me as Windows isn't opinionated about this
-        data: path51.join(localAppData, name, "Data"),
-        config: path51.join(appData, name, "Config"),
-        cache: path51.join(localAppData, name, "Cache"),
-        log: path51.join(localAppData, name, "Log"),
-        temp: path51.join(tmpdir, name)
+        data: path52.join(localAppData, name, "Data"),
+        config: path52.join(appData, name, "Config"),
+        cache: path52.join(localAppData, name, "Cache"),
+        log: path52.join(localAppData, name, "Log"),
+        temp: path52.join(tmpdir, name)
       };
     };
     var linux = (name) => {
-      const username = path51.basename(homedir);
+      const username = path52.basename(homedir);
       return {
-        data: path51.join(env.XDG_DATA_HOME || path51.join(homedir, ".local", "share"), name),
-        config: path51.join(env.XDG_CONFIG_HOME || path51.join(homedir, ".config"), name),
-        cache: path51.join(env.XDG_CACHE_HOME || path51.join(homedir, ".cache"), name),
+        data: path52.join(env.XDG_DATA_HOME || path52.join(homedir, ".local", "share"), name),
+        config: path52.join(env.XDG_CONFIG_HOME || path52.join(homedir, ".config"), name),
+        cache: path52.join(env.XDG_CACHE_HOME || path52.join(homedir, ".cache"), name),
         // https://wiki.debian.org/XDGBaseDirectorySpecification#state
-        log: path51.join(env.XDG_STATE_HOME || path51.join(homedir, ".local", "state"), name),
-        temp: path51.join(tmpdir, username, name)
+        log: path52.join(env.XDG_STATE_HOME || path52.join(homedir, ".local", "state"), name),
+        temp: path52.join(tmpdir, username, name)
       };
     };
     var envPaths = (name, options) => {
@@ -23815,11 +23815,11 @@ var require_util = __commonJS({
       return result;
     }
     exports2.emplace = emplace;
-    function getPropertyByPath(source, path51) {
-      if (typeof path51 === "string" && Object.prototype.hasOwnProperty.call(source, path51)) {
-        return source[path51];
+    function getPropertyByPath(source, path52) {
+      if (typeof path52 === "string" && Object.prototype.hasOwnProperty.call(source, path52)) {
+        return source[path52];
       }
-      const parsedPath = typeof path51 === "string" ? path51.split(".") : path51;
+      const parsedPath = typeof path52 === "string" ? path52.split(".") : path52;
       return parsedPath.reduce((previous, key) => {
         if (previous === void 0) {
           return previous;
@@ -23842,9 +23842,9 @@ var require_util = __commonJS({
       return Object.fromEntries(Object.entries(options).filter(([, value2]) => value2 !== void 0));
     }
     exports2.removeUndefinedValuesFromObject = removeUndefinedValuesFromObject;
-    async function isDirectory(path51) {
+    async function isDirectory(path52) {
       try {
-        const stat = await fs_1.promises.stat(path51);
+        const stat = await fs_1.promises.stat(path52);
         return stat.isDirectory();
       } catch (e14) {
         if (e14.code === "ENOENT") {
@@ -23854,9 +23854,9 @@ var require_util = __commonJS({
       }
     }
     exports2.isDirectory = isDirectory;
-    function isDirectorySync(path51) {
+    function isDirectorySync(path52) {
       try {
-        const stat = fs_1.default.statSync(path51);
+        const stat = fs_1.default.statSync(path52);
         return stat.isDirectory();
       } catch (e14) {
         if (e14.code === "ENOENT") {
@@ -23954,7 +23954,7 @@ var require_ExplorerBase = __commonJS({
           const idx = importStack.indexOf(fullPath);
           if (idx !== -1) {
             throw new Error(`Circular import detected:
-${[...importStack, fullPath].map((path51, i10) => `${i10 + 1}. ${path51}`).join("\n")} (same as ${idx + 1}.)`);
+${[...importStack, fullPath].map((path52, i10) => `${i10 + 1}. ${path52}`).join("\n")} (same as ${idx + 1}.)`);
           }
         }
       }
@@ -24142,9 +24142,9 @@ var require_Explorer = __commonJS({
           throw error63;
         }
       }
-      async #fileExists(path51) {
+      async #fileExists(path52) {
         try {
-          await promises_1.default.stat(path51);
+          await promises_1.default.stat(path52);
           return true;
         } catch (e14) {
           return false;
@@ -24304,9 +24304,9 @@ var require_ExplorerSync = __commonJS({
           throw error63;
         }
       }
-      #fileExists(path51) {
+      #fileExists(path52) {
         try {
-          fs_1.default.statSync(path51);
+          fs_1.default.statSync(path52);
           return true;
         } catch (e14) {
           return false;
@@ -24430,7 +24430,7 @@ var require_dist = __commonJS({
       };
     }
     function getResolvedSearchPlaces(moduleName, toolDefinedSearchPlaces, userConfiguredOptions) {
-      const userConfiguredSearchPlaces = userConfiguredOptions.searchPlaces?.map((path51) => path51.replace("{name}", moduleName));
+      const userConfiguredSearchPlaces = userConfiguredOptions.searchPlaces?.map((path52) => path52.replace("{name}", moduleName));
       if (userConfiguredOptions.mergeSearchPlaces) {
         return [...userConfiguredSearchPlaces ?? [], ...toolDefinedSearchPlaces];
       }
@@ -24790,6 +24790,36 @@ var init_versionDiscovery = __esm({
   }
 });
 
+// src/frontdoor/supervisorProcesses.ts
+function parseFrontDoorSupervisorPids(psOutput) {
+  const pids = [];
+  for (const line of psOutput.split("\n")) {
+    const [pidText, ...argumentsList] = line.trim().split(/\s+/);
+    const pid = Number(pidText);
+    if (Number.isInteger(pid) && pid > 0 && argumentsList.includes(FRONT_DOOR_SUPERVISOR_ARGUMENT)) {
+      pids.push(pid);
+    }
+  }
+  return pids.sort((a10, b) => a10 - b);
+}
+function listFrontDoorSupervisors(run, uid) {
+  const result = run.run("ps", ["-U", String(uid), "-o", "pid=,command="]);
+  if (result.status === null) {
+    return { ok: false, message: "ps could not be run" };
+  }
+  if (result.status !== 0) {
+    return { ok: false, message: `ps exited ${String(result.status)}${result.stderr.trim() === "" ? "" : `: ${result.stderr.trim()}`}` };
+  }
+  return { ok: true, pids: parseFrontDoorSupervisorPids(result.stdout) };
+}
+var FRONT_DOOR_SUPERVISOR_ARGUMENT;
+var init_supervisorProcesses = __esm({
+  "src/frontdoor/supervisorProcesses.ts"() {
+    "use strict";
+    FRONT_DOOR_SUPERVISOR_ARGUMENT = "__frontdoor-supervisor";
+  }
+});
+
 // node_modules/.pnpm/trilean@1.7.1/node_modules/trilean/dist/complex.js
 var complexFromPolar;
 var init_complex = __esm({
@@ -26769,7 +26799,15 @@ function isCodexProvider(provider) {
 function poolMemberIdentity(member) {
   return typeof member === "string" ? member : member.identity;
 }
-var import_node_path4, CATEGORY_NAMES, OVERRIDABLE_CATEGORIES, CategoryMapSchema, DURATION_RE, DurationSchema, WhenConditionObjectSchema, WhenSchema, EntryValueSchema, ENTRY_KEY_RE, EntriesSchema, LaunchSchema, CREDENTIAL_TARGETS, PROVIDER_CREDENTIAL_TARGETS, CREDENTIAL_TARGET_VARS, ArgvSchema, CommandSourceOptions, EnvCredentialSourceSchema, FileCredentialSourceSchema, CommandCredentialSourceSchema, OpCredentialSourceSchema, KeychainCredentialSourceSchema, LiteralCredentialSourceSchema, CredentialSourceSchema, RemoteCredentialSourceSchema, CREDENTIAL_CACHE_STORES, CredentialCacheSchema, CredentialSchema, ProviderCredentialSchema, RESERVED_PROVIDER_ENV_KEYS, ProviderEnvSchema, PROVIDER_KINDS, CODEX_TIERS, CODEX_EFFORTS, CODEX_LOGINS, CODEX_DEFAULT_LOGIN, CODEX_DEFAULT_MODEL, CODEX_DEFAULT_TIER_MODELS, CODEX_DEFAULT_EFFORT, CodexProviderConfigSchema, ProviderRouteSchema, HttpProviderSchema, CodexProviderSchema, ProviderSchema, ConfigProfileSchema, POOL_SELECTOR_PREFIX, POOL_NAME_PATTERN, IDENTITY_NAME_PATTERN, PoolNameSchema, SELECTOR_RE, IdentitySelectorSchema, PoolMemberSchema, POOL_PREFERENCES, PoolPreferenceSchema, PoolSchema, DirectoryRuleSchema, DirectoryRulesSchema, PortableConfigSchema, HEADROOM_MODES, HEADROOM_CCR_MODES, HEADROOM_ROLLOUT_CHANNELS, INTERCEPT_CHANNELS, READ_MATURATION_CHANNELS, HeadroomGlobalConfigObjectSchema, HeadroomGlobalConfigSchema, HEADROOM_DEFAULT_SOURCE, HEADROOM_DEFAULT_IDLE_SHUTDOWN_MINUTES, FRONTDOOR_DEFAULT_IDLE_SHUTDOWN_MINUTES, FrontDoorGlobalConfigSchema, UPDATE_MODES, UpdateGlobalConfigSchema, GlobalConfigSchema, IdentitySchema, CategoryClassificationSchema, CategoryClassificationOverlaySchema, SHIPPED_CATEGORY_DEFAULTS;
+function isTimeZone(name) {
+  try {
+    new Intl.DateTimeFormat("en", { timeZone: name });
+    return true;
+  } catch {
+    return false;
+  }
+}
+var import_node_path4, CATEGORY_NAMES, OVERRIDABLE_CATEGORIES, CategoryMapSchema, DURATION_RE, DurationSchema, WhenConditionObjectSchema, WhenSchema, EntryValueSchema, ENTRY_KEY_RE, EntriesSchema, LaunchSchema, CREDENTIAL_TARGETS, PROVIDER_CREDENTIAL_TARGETS, CREDENTIAL_TARGET_VARS, ArgvSchema, CommandSourceOptions, EnvCredentialSourceSchema, FileCredentialSourceSchema, CommandCredentialSourceSchema, OpCredentialSourceSchema, KeychainCredentialSourceSchema, LiteralCredentialSourceSchema, CredentialSourceSchema, RemoteCredentialSourceSchema, CREDENTIAL_CACHE_STORES, CredentialCacheSchema, CredentialSchema, ProviderCredentialSchema, RESERVED_PROVIDER_ENV_KEYS, ProviderEnvSchema, PROVIDER_KINDS, CODEX_TIERS, CODEX_EFFORTS, CODEX_LOGINS, CODEX_DEFAULT_LOGIN, CODEX_DEFAULT_MODEL, CODEX_DEFAULT_TIER_MODELS, CODEX_DEFAULT_EFFORT, CodexProviderConfigSchema, ProviderRouteSchema, HttpProviderSchema, CodexProviderSchema, ProviderSchema, ConfigProfileSchema, POOL_SELECTOR_PREFIX, POOL_NAME_PATTERN, IDENTITY_NAME_PATTERN, PoolNameSchema, SELECTOR_RE, IdentitySelectorSchema, PoolMemberSchema, POOL_PREFERENCES, PoolPreferenceSchema, PoolSchema, DirectoryRuleSchema, DirectoryRulesSchema, PortableConfigSchema, HEADROOM_MODES, HEADROOM_CCR_MODES, HEADROOM_ROLLOUT_CHANNELS, INTERCEPT_CHANNELS, READ_MATURATION_CHANNELS, HeadroomGlobalConfigObjectSchema, HeadroomGlobalConfigSchema, HEADROOM_DEFAULT_SOURCE, HEADROOM_DEFAULT_IDLE_SHUTDOWN_MINUTES, FRONTDOOR_DEFAULT_IDLE_SHUTDOWN_MINUTES, FrontDoorGlobalConfigSchema, UPDATE_MODES, UpdateGlobalConfigSchema, GlobalConfigSchema, WEEKDAYS, AnchorSchema, IdentitySchema, CategoryClassificationSchema, CategoryClassificationOverlaySchema, SHIPPED_CATEGORY_DEFAULTS;
 var init_schema = __esm({
   "src/config/schema.ts"() {
     "use strict";
@@ -27014,12 +27052,20 @@ var init_schema = __esm({
       update: UpdateGlobalConfigSchema.optional(),
       pools: external_exports.record(PoolNameSchema, PoolSchema).optional()
     });
+    WEEKDAYS = ["mon", "tue", "wed", "thu", "fri", "sat", "sun"];
+    AnchorSchema = external_exports.strictObject({
+      days: external_exports.array(external_exports.enum(WEEKDAYS)).min(1).refine((days) => new Set(days).size === days.length, "an anchor names each weekday at most once"),
+      time: external_exports.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/, "a 24-hour time such as 06:00"),
+      timeZone: external_exports.string().refine(isTimeZone, "an IANA time zone such as Europe/London").optional()
+    });
     IdentitySchema = external_exports.strictObject({
       $schema: external_exports.string().optional(),
       name: external_exports.string().min(1).regex(/^[A-Za-z0-9][A-Za-z0-9._@-]*$/),
       defaultConfigProfile: external_exports.string().min(1).optional(),
       allowAmbientCredential: external_exports.boolean().default(false),
-      credential: CredentialSchema.optional()
+      credential: CredentialSchema.optional(),
+      /** When this identity's five-hour window should be open: the front door opens one at each anchor if none is. Absent, nothing is opened on a schedule. */
+      anchors: external_exports.array(AnchorSchema).min(1).optional()
     });
     CategoryClassificationSchema = external_exports.strictObject({
       $schema: external_exports.string().optional(),
@@ -27321,7 +27367,7 @@ function listFrontDoorSessions(fs22, sessionsDir) {
     try {
       const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs22.readFileUtf8(import_node_path6.default.join(sessionsDir, name)) ?? ""));
       if (parsed.success) {
-        sessions.push({ pid: parsed.data.pid, startedAt: parsed.data.startedAt });
+        sessions.push({ pid: parsed.data.pid, startedAt: parsed.data.startedAt, ...parsed.data.supervisorPid === void 0 ? {} : { supervisorPid: parsed.data.supervisorPid } });
       }
     } catch {
       continue;
@@ -27366,7 +27412,7 @@ var init_state2 = __esm({
     import_node_path6 = __toESM(require("node:path"), 1);
     init_zod();
     FRONT_DOOR_PROTOCOL = 3;
-    FrontDoorSessionSchema = external_exports.strictObject({ pid: external_exports.number().int().positive(), startedAt: external_exports.number(), token: external_exports.string().min(1) });
+    FrontDoorSessionSchema = external_exports.strictObject({ pid: external_exports.number().int().positive(), startedAt: external_exports.number(), token: external_exports.string().min(1), supervisorPid: external_exports.number().int().positive().optional() });
     FrontDoorStateSchema = external_exports.strictObject({
       /**
        * The launcher-to-door wire protocol this supervisor speaks, written once it is serving; absent in state written by a release that predates the field, which `ensureFrontDoor` reads as protocol 0. A launcher replaces a door whose protocol is lower than its own (see `FRONT_DOOR_PROTOCOL`).
@@ -27799,9 +27845,15 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     await ports.sleep(HEADROOM_POLL_MS);
   }
 }
+function currentHeadroomAllowlistInputs(fs22, paths) {
+  return {
+    providers: readAllProviders(fs22, paths.providersDir).map((entry) => entry.provider),
+    frontDoorOrigin: frontDoorOrigin(readFrontDoorState(fs22, paths.frontdoorStateFile))
+  };
+}
 function currentHeadroomAllowlist(fs22, paths) {
-  const providers = readAllProviders(fs22, paths.providersDir).map((entry) => entry.provider);
-  return headroomAllowlist(headroomUpstreams(providers, frontDoorOrigin(readFrontDoorState(fs22, paths.frontdoorStateFile))));
+  const inputs = currentHeadroomAllowlistInputs(fs22, paths);
+  return headroomAllowlist(headroomUpstreams(inputs.providers, inputs.frontDoorOrigin));
 }
 function allowlistOf(ports) {
   return currentHeadroomAllowlist(ports.fs, ports.paths);
@@ -27867,8 +27919,8 @@ function realIsProcessRunning(pid) {
   return realIsProcessAlive(pid) && !realIsProcessZombie(pid);
 }
 function realIsFrontDoorSupervisor(pid) {
-  const result = (0, import_node_child_process2.spawnSync)("ps", ["-o", "command=", "-p", String(pid)], { encoding: "utf8" });
-  return result.status === 0 && result.stdout.split(/\s+/).includes(FRONT_DOOR_SUPERVISOR_SUBCOMMAND);
+  const result = (0, import_node_child_process2.spawnSync)("ps", ["-o", "pid=,command=", "-p", String(pid)], { encoding: "utf8" });
+  return result.status === 0 && parseFrontDoorSupervisorPids(result.stdout).includes(pid);
 }
 function expandHome(filePath) {
   return filePath.startsWith("~/") ? import_node_path8.default.join(import_node_os2.default.homedir(), filePath.slice(1)) : filePath;
@@ -28072,7 +28124,7 @@ function realResolveClaudeBinary(isOwnBinary) {
 function realInstalledClaudeVersions() {
   return installedVersions(listVersionsDir(defaultVersionsDir()));
 }
-var import_node_child_process2, import_node_crypto4, import_node_fs3, import_node_os2, import_node_path8, import_node_sea, realFsPort, OWNER_ONLY_DIR_MODE, OWNER_ONLY_FILE_MODE, PERMISSION_BITS, realFarmFs, INT32_BYTE_LENGTH, FRONT_DOOR_SUPERVISOR_SUBCOMMAND, realRunPort, MACOS_GUI_SESSION_MANAGER, realCredentialPort, SOCKET_PERMISSION_BITS, realHeadroomSocketTrust, realSpawnPort, realProcPort, realLogPort, EXECUTE_BITS_MASK, WINDOWS_DEFAULT_PATHEXT;
+var import_node_child_process2, import_node_crypto4, import_node_fs3, import_node_os2, import_node_path8, import_node_sea, realFsPort, OWNER_ONLY_DIR_MODE, OWNER_ONLY_FILE_MODE, PERMISSION_BITS, realFarmFs, INT32_BYTE_LENGTH, realRunPort, MACOS_GUI_SESSION_MANAGER, realCredentialPort, SOCKET_PERMISSION_BITS, realHeadroomSocketTrust, realSpawnPort, realProcPort, realLogPort, EXECUTE_BITS_MASK, WINDOWS_DEFAULT_PATHEXT;
 var init_realPorts = __esm({
   "src/realPorts.ts"() {
     "use strict";
@@ -28084,6 +28136,7 @@ var init_realPorts = __esm({
     import_node_sea = require("node:sea");
     init_load();
     init_versionDiscovery();
+    init_supervisorProcesses();
     init_ensure();
     init_supervisor();
     init_state();
@@ -28213,7 +28266,6 @@ var init_realPorts = __esm({
       }
     };
     INT32_BYTE_LENGTH = 4;
-    FRONT_DOOR_SUPERVISOR_SUBCOMMAND = "__frontdoor-supervisor";
     realRunPort = {
       run(command, args) {
         const result = (0, import_node_child_process2.spawnSync)(command, [...args], { encoding: "utf8" });
@@ -28875,8 +28927,8 @@ var require_utils = __commonJS({
       }
       return output2;
     };
-    exports2.basename = (path51, { windows } = {}) => {
-      const segs = path51.split(windows ? /[\\/]/ : "/");
+    exports2.basename = (path52, { windows } = {}) => {
+      const segs = path52.split(windows ? /[\\/]/ : "/");
       const last = segs[segs.length - 1];
       if (last === "") {
         return segs[segs.length - 2];
@@ -32542,6 +32594,7 @@ function buildLayoutPaths(root) {
     usageLogDir: import_node_path19.default.join(root, "usage", "log"),
     usageSnapshotsDir: import_node_path19.default.join(root, "usage", "snapshots"),
     usagePicksFile: import_node_path19.default.join(root, "usage", "picks.json"),
+    usageAnchorsFile: import_node_path19.default.join(root, "usage", "anchors.json"),
     mcpPermissionsFile: import_node_path19.default.join(root, "mcp", "permissions.json")
   };
 }
@@ -32559,6 +32612,47 @@ var init_paths = __esm({
   }
 });
 
+// src/cli/pairs.ts
+function splitCommas(input2) {
+  if (input2 === "") {
+    return [];
+  }
+  return input2.split(",");
+}
+function parsePair(input2) {
+  const eqIndex = input2.indexOf("=");
+  if (eqIndex === -1) {
+    throw new Error(`Expected "<key>=<value>", got "${input2}" (no "=" found)`);
+  }
+  const key = input2.slice(0, eqIndex);
+  const value2 = input2.slice(eqIndex + 1);
+  if (key === "") {
+    throw new Error(`Expected a non-empty key before "=" in "${input2}"`);
+  }
+  return { key, value: value2 };
+}
+function parseBool(input2) {
+  const parsed = parseBoolWord(input2);
+  if (parsed === void 0) {
+    throw new Error(`Expected "true", "false", "1" or "0", got "${input2}"`);
+  }
+  return parsed;
+}
+function parseBoolPairList(input2) {
+  const result = {};
+  for (const piece of splitCommas(input2)) {
+    const { key, value: value2 } = parsePair(piece);
+    result[key] = parseBool(value2);
+  }
+  return result;
+}
+var init_pairs = __esm({
+  "src/cli/pairs.ts"() {
+    "use strict";
+    init_bool();
+  }
+});
+
 // src/usage/schema.ts
 function isRateLimitHeader(name) {
   const lower = name.toLowerCase();
@@ -32758,7 +32852,7 @@ function epochSecondsToIso(value2) {
     return void 0;
   }
   const seconds = Number(value2);
-  return Number.isFinite(seconds) && seconds > 0 ? new Date(seconds * MS_PER_SECOND).toISOString() : void 0;
+  return Number.isFinite(seconds) && seconds > 0 ? new Date(seconds * MS_PER_SECOND2).toISOString() : void 0;
 }
 function nonNegativeNumber(value2) {
   if (value2 === void 0 || value2.trim() === "") {
@@ -32842,7 +32936,7 @@ function retryAfterSeconds(value2, nowMs) {
     return seconds;
   }
   const date5 = Date.parse(value2);
-  return Number.isNaN(date5) ? void 0 : Math.max(0, Math.ceil((date5 - nowMs) / MS_PER_SECOND));
+  return Number.isNaN(date5) ? void 0 : Math.max(0, Math.ceil((date5 - nowMs) / MS_PER_SECOND2));
 }
 function classifyLimit(params) {
   const { status, headers, error: error63 } = params;
@@ -32881,14 +32975,14 @@ function classifyLimit(params) {
     evidence
   };
 }
-var TOO_MANY_REQUESTS, PAYMENT_REQUIRED, MS_PER_SECOND, UNIFIED_PREFIX, QUOTA_EXHAUSTED_ERRORS, QUOTA_EXHAUSTED_MESSAGE, EVIDENCE_TOKEN;
+var TOO_MANY_REQUESTS, PAYMENT_REQUIRED, MS_PER_SECOND2, UNIFIED_PREFIX, QUOTA_EXHAUSTED_ERRORS, QUOTA_EXHAUSTED_MESSAGE, EVIDENCE_TOKEN;
 var init_rateLimit = __esm({
   "src/usage/rateLimit.ts"() {
     "use strict";
     init_schema2();
     TOO_MANY_REQUESTS = 429;
     PAYMENT_REQUIRED = 402;
-    MS_PER_SECOND = 1e3;
+    MS_PER_SECOND2 = 1e3;
     UNIFIED_PREFIX = "anthropic-ratelimit-unified-";
     QUOTA_EXHAUSTED_ERRORS = /* @__PURE__ */ new Set(["usage_limit_reached", "insufficient_quota", "1308", "1309", "1310", "1316", "1317", "1318", "1319", "1320", "1321"]);
     QUOTA_EXHAUSTED_MESSAGE = /usage limit|quota (?:exceeded|exhausted)|limit exhausted|insufficient (?:balance|credits|quota)/i;
@@ -32898,11 +32992,11 @@ var init_rateLimit = __esm({
 
 // src/usage/preflight.ts
 function formatAge(ms2) {
-  const minutes = Math.floor(ms2 / (MS_PER_SECOND2 * SECONDS_PER_MINUTE));
-  if (minutes < MINUTES_PER_HOUR) {
+  const minutes = Math.floor(ms2 / (MS_PER_SECOND3 * SECONDS_PER_MINUTE));
+  if (minutes < MINUTES_PER_HOUR2) {
     return `${String(Math.max(minutes, 0))}m`;
   }
-  const hours = Math.floor(minutes / MINUTES_PER_HOUR);
+  const hours = Math.floor(minutes / MINUTES_PER_HOUR2);
   return hours < HOURS_PER_DAY ? `${String(hours)}h` : `${String(Math.floor(hours / HOURS_PER_DAY))}d`;
 }
 function effectiveWindow(window, nowMs) {
@@ -32939,14 +33033,14 @@ function quotaWarnings(snapshot, provider, nowMs) {
     return [`agent-shim: identity ${snapshot.identity}: the ${name} quota is ${verdict}${reset} (last seen ${age2} ago)`];
   });
 }
-var MS_PER_SECOND2, SECONDS_PER_MINUTE, MINUTES_PER_HOUR, HOURS_PER_DAY, WARNING_STATUSES;
+var MS_PER_SECOND3, SECONDS_PER_MINUTE, MINUTES_PER_HOUR2, HOURS_PER_DAY, WARNING_STATUSES;
 var init_preflight = __esm({
   "src/usage/preflight.ts"() {
     "use strict";
     init_rateLimit();
-    MS_PER_SECOND2 = 1e3;
+    MS_PER_SECOND3 = 1e3;
     SECONDS_PER_MINUTE = 60;
-    MINUTES_PER_HOUR = 60;
+    MINUTES_PER_HOUR2 = 60;
     HOURS_PER_DAY = 24;
     WARNING_STATUSES = /* @__PURE__ */ new Set(["allowed_warning", "rejected"]);
   }
@@ -33201,54 +33295,13 @@ var init_credential = __esm({
   }
 });
 
-// src/cli/pairs.ts
-function splitCommas(input2) {
-  if (input2 === "") {
-    return [];
-  }
-  return input2.split(",");
-}
-function parsePair(input2) {
-  const eqIndex = input2.indexOf("=");
-  if (eqIndex === -1) {
-    throw new Error(`Expected "<key>=<value>", got "${input2}" (no "=" found)`);
-  }
-  const key = input2.slice(0, eqIndex);
-  const value2 = input2.slice(eqIndex + 1);
-  if (key === "") {
-    throw new Error(`Expected a non-empty key before "=" in "${input2}"`);
-  }
-  return { key, value: value2 };
-}
-function parseBool(input2) {
-  const parsed = parseBoolWord(input2);
-  if (parsed === void 0) {
-    throw new Error(`Expected "true", "false", "1" or "0", got "${input2}"`);
-  }
-  return parsed;
-}
-function parseBoolPairList(input2) {
-  const result = {};
-  for (const piece of splitCommas(input2)) {
-    const { key, value: value2 } = parsePair(piece);
-    result[key] = parseBool(value2);
-  }
-  return result;
-}
-var init_pairs = __esm({
-  "src/cli/pairs.ts"() {
-    "use strict";
-    init_bool();
-  }
-});
-
 // package.json
 var package_default;
 var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "claude-use",
-      version: "9.12.1",
+      version: "9.14.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -33519,11 +33572,11 @@ function identifyRequest(headers) {
 function directOrigin(port) {
   return `http://127.0.0.1:${String(port)}`;
 }
-function parseProviderPath(path51) {
-  if (!path51.startsWith(PROVIDER_PATH_PREFIX)) {
+function parseProviderPath(path52) {
+  if (!path52.startsWith(PROVIDER_PATH_PREFIX)) {
     return void 0;
   }
-  const tail = path51.slice(PROVIDER_PATH_PREFIX.length);
+  const tail = path52.slice(PROVIDER_PATH_PREFIX.length);
   const slash = tail.indexOf("/");
   if (slash <= 0) {
     return void 0;
@@ -33849,9 +33902,9 @@ function decoderFor(encoding) {
       return void 0;
   }
 }
-function destinationOf(path51) {
-  const scoped = parseProviderPath(path51);
-  return scoped === void 0 ? { provider: ANTHROPIC_PROVIDER, endpoint: path51 } : { provider: scoped.provider, endpoint: scoped.rest };
+function destinationOf(path52) {
+  const scoped = parseProviderPath(path52);
+  return scoped === void 0 ? { provider: ANTHROPIC_PROVIDER, endpoint: path52 } : { provider: scoped.provider, endpoint: scoped.rest };
 }
 function buildRecord(event, context) {
   const { scan } = context;
@@ -34008,7 +34061,7 @@ function limitBlockedUntil(state, nowMs) {
   if (state.lastRequestAt !== void 0 && Date.parse(state.lastRequestAt) > Date.parse(limit.observedAt)) {
     return void 0;
   }
-  const until = limit.resetAt === void 0 ? limit.retryAfterSeconds === void 0 ? void 0 : Date.parse(limit.observedAt) + limit.retryAfterSeconds * MS_PER_SECOND3 : Date.parse(limit.resetAt);
+  const until = limit.resetAt === void 0 ? limit.retryAfterSeconds === void 0 ? void 0 : Date.parse(limit.observedAt) + limit.retryAfterSeconds * MS_PER_SECOND4 : Date.parse(limit.resetAt);
   return until !== void 0 && until > nowMs ? until : void 0;
 }
 function windowBlockedUntil(windows) {
@@ -34118,7 +34171,7 @@ function assessIdentity(member, nowMs) {
   );
   if (blockedUntil > nowMs) {
     if (unified.overageStatus === "allowed") {
-      return { candidate: { ...base, class: "pay-per-use", reasons: [`plan exhausted until ${new Date(blockedUntil).toISOString()}, continues as extra usage`, ...windowReasons, ...planReasons] } };
+      return { candidate: { ...base, class: "pay-per-use", planReturnsAtMs: blockedUntil, reasons: [`plan exhausted until ${new Date(blockedUntil).toISOString()} (in ${formatAge(blockedUntil - nowMs)}), continues as extra usage`, ...windowReasons, ...planReasons] } };
     }
     return { candidate: { ...base, class: "ineligible", blockedUntilMs: blockedUntil, reasons: [`refused until ${new Date(blockedUntil).toISOString()} (in ${formatAge(blockedUntil - nowMs)})`, ...unified.fallbackAvailable === true ? ["a fallback is on offer, so requests for some models may still be served"] : [], ...windowReasons, ...overageReasons, ...planReasons] } };
   }
@@ -34131,10 +34184,10 @@ function assessIdentity(member, nowMs) {
     return { candidate: { ...base, class: "unknown", reasons: ["quota windows reported no utilisation", ...windowReasons, ...planReasons] } };
   }
   const remaining = Math.max(0, 1 - basis.window.utilization);
-  const untilResetMs = basis.window.resetsAtMs === void 0 ? basis.windowMs : Math.max(basis.window.resetsAtMs - nowMs, MS_PER_SECOND3);
+  const untilResetMs = basis.window.resetsAtMs === void 0 ? basis.windowMs : Math.max(basis.window.resetsAtMs - nowMs, MS_PER_SECOND4);
   const weeklyScore = remaining * plan.capacity / (untilResetMs / MS_PER_HOUR2);
   const fiveRemaining = five?.utilization === void 0 ? void 0 : Math.max(0, 1 - five.utilization);
-  const fiveUntil = five?.resetsAtMs === void 0 ? FIVE_HOUR_WINDOW_MS : Math.max(five.resetsAtMs - nowMs, MS_PER_SECOND3);
+  const fiveUntil = five?.resetsAtMs === void 0 ? FIVE_HOUR_WINDOW_MS : Math.max(five.resetsAtMs - nowMs, MS_PER_SECOND4);
   const ratio = windowRatio(member.records);
   const fiveHourScore = basis.name === "sevenDay" && fiveRemaining !== void 0 && ratio !== void 0 ? Math.min(fiveRemaining * ratio, remaining) * plan.capacity / (fiveUntil / MS_PER_HOUR2) : void 0;
   const fiveHourLeads = fiveHourScore !== void 0 && fiveHourScore > weeklyScore;
@@ -34143,7 +34196,7 @@ function assessIdentity(member, nowMs) {
   const fiveHourTermReasons = basis.name !== "sevenDay" || fiveRemaining === void 0 ? [] : ratio === void 0 ? ["5h reset not scored: no measured 5h to 7d ratio yet"] : fiveHourLeads ? [`5h term leads: ${percent(fiveRemaining)} of 5h unused is about ${percent(Math.min(fiveRemaining * ratio, remaining))} of the week at the measured ratio, resets in ${formatAge(fiveUntil)}`] : [];
   const burn = windowBurn(member.records, "fiveHour");
   const sevenRemaining = seven?.utilization === void 0 ? void 0 : Math.max(0, 1 - seven.utilization);
-  const sevenUntil = seven?.resetsAtMs === void 0 ? SEVEN_DAY_WINDOW_MS : Math.max(seven.resetsAtMs - nowMs, MS_PER_SECOND3);
+  const sevenUntil = seven?.resetsAtMs === void 0 ? SEVEN_DAY_WINDOW_MS : Math.max(seven.resetsAtMs - nowMs, MS_PER_SECOND4);
   const sevenDayBurn = windowBurn(member.records, "sevenDay");
   return {
     candidate: { ...base, class: "scored", score, scoreWindow, reasons: [...fiveHourTermReasons, ...windowReasons.map((reason, index) => index === windowReasons.length - 1 ? `${reason}${observedAgo}` : reason), ...planReasons] },
@@ -34233,10 +34286,11 @@ function rankPool(input2) {
   return {
     candidates: ordered,
     ...pick2 === void 0 ? { ...earliestReturn === void 0 ? {} : { earliestReturn } } : { pick: pick2 },
-    ...movedOff === void 0 || pick2 === void 0 ? {} : { movedOff }
+    ...movedOff === void 0 || pick2 === void 0 ? {} : { movedOff },
+    ...pick2?.planReturnsAtMs === void 0 ? {} : { planReturn: { identity: pick2.identity, atMs: pick2.planReturnsAtMs } }
   };
 }
-var MS_PER_SECOND3, MS_PER_HOUR2, HOURS_PER_DAY2, FIVE_HOURS, PROMPT_CACHE_TTL_HOURS, PERCENT, SEVEN_DAYS, FIVE_HOUR_WINDOW_MS, SEVEN_DAY_WINDOW_MS, PROMPT_CACHE_TTL_MS, CLASS_ORDER;
+var MS_PER_SECOND4, MS_PER_HOUR2, HOURS_PER_DAY2, FIVE_HOURS, PROMPT_CACHE_TTL_HOURS, PERCENT, SEVEN_DAYS, FIVE_HOUR_WINDOW_MS, SEVEN_DAY_WINDOW_MS, PROMPT_CACHE_TTL_MS, CLASS_ORDER;
 var init_pick = __esm({
   "src/usage/pick.ts"() {
     "use strict";
@@ -34246,7 +34300,7 @@ var init_pick = __esm({
     init_preflight();
     init_quotaFacts();
     init_rateLimit();
-    MS_PER_SECOND3 = 1e3;
+    MS_PER_SECOND4 = 1e3;
     MS_PER_HOUR2 = 36e5;
     HOURS_PER_DAY2 = 24;
     FIVE_HOURS = 5;
@@ -34531,7 +34585,7 @@ function createUsageStore(deps) {
     })
   };
 }
-var import_node_path25, DAY_MS2, DAYS_IN_WEEK, USAGE_RETENTION_MS;
+var import_node_path25, DAY_MS2, DAYS_IN_WEEK2, USAGE_RETENTION_MS;
 var init_store2 = __esm({
   "src/usage/store.ts"() {
     "use strict";
@@ -34541,8 +34595,8 @@ var init_store2 = __esm({
     init_read();
     init_schema2();
     DAY_MS2 = 864e5;
-    DAYS_IN_WEEK = 7;
-    USAGE_RETENTION_MS = DAYS_IN_WEEK * DAY_MS2;
+    DAYS_IN_WEEK2 = 7;
+    USAGE_RETENTION_MS = DAYS_IN_WEEK2 * DAY_MS2;
   }
 });
 
@@ -36286,14 +36340,14 @@ var require_util2 = __commonJS({
         }
         const port = url2.port != null ? url2.port : url2.protocol === "https:" ? 443 : 80;
         let origin = url2.origin != null ? url2.origin : `${url2.protocol || ""}//${url2.hostname || ""}:${port}`;
-        let path51 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`;
+        let path52 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`;
         if (origin[origin.length - 1] === "/") {
           origin = origin.slice(0, origin.length - 1);
         }
-        if (path51 && path51[0] !== "/") {
-          path51 = `/${path51}`;
+        if (path52 && path52[0] !== "/") {
+          path52 = `/${path52}`;
         }
-        return new URL(`${origin}${path51}`);
+        return new URL(`${origin}${path52}`);
       }
       if (!isHttpOrHttpsPrefixed(url2.origin || url2.protocol)) {
         throw new InvalidArgumentError2("Invalid URL protocol: the URL must start with `http:` or `https:`.");
@@ -37114,9 +37168,9 @@ var require_diagnostics = __commonJS({
         "undici:client:sendHeaders",
         (evt) => {
           const {
-            request: { method, path: path51, origin }
+            request: { method, path: path52, origin }
           } = evt;
-          debugLog("sending request to %s %s%s", method, origin, path51);
+          debugLog("sending request to %s %s%s", method, origin, path52);
         }
       );
     }
@@ -37134,14 +37188,14 @@ var require_diagnostics = __commonJS({
         "undici:request:headers",
         (evt) => {
           const {
-            request: { method, path: path51, origin },
+            request: { method, path: path52, origin },
             response: { statusCode }
           } = evt;
           debugLog(
             "received response to %s %s%s - HTTP %d",
             method,
             origin,
-            path51,
+            path52,
             statusCode
           );
         }
@@ -37150,23 +37204,23 @@ var require_diagnostics = __commonJS({
         "undici:request:trailers",
         (evt) => {
           const {
-            request: { method, path: path51, origin }
+            request: { method, path: path52, origin }
           } = evt;
-          debugLog("trailers received from %s %s%s", method, origin, path51);
+          debugLog("trailers received from %s %s%s", method, origin, path52);
         }
       );
       diagnosticsChannel.subscribe(
         "undici:request:error",
         (evt) => {
           const {
-            request: { method, path: path51, origin },
+            request: { method, path: path52, origin },
             error: error63
           } = evt;
           debugLog(
             "request to %s %s%s errored - %s",
             method,
             origin,
-            path51,
+            path52,
             error63.message
           );
         }
@@ -37281,7 +37335,7 @@ var require_request = __commonJS({
     var kHandler = /* @__PURE__ */ Symbol("handler");
     var Request2 = class {
       constructor(origin, {
-        path: path51,
+        path: path52,
         method,
         body,
         headers,
@@ -37298,11 +37352,11 @@ var require_request = __commonJS({
         maxRedirections,
         typeOfService
       }, handler) {
-        if (typeof path51 !== "string") {
+        if (typeof path52 !== "string") {
           throw new InvalidArgumentError2("path must be a string");
-        } else if (path51[0] !== "/" && !(path51.startsWith("http://") || path51.startsWith("https://")) && method !== "CONNECT") {
+        } else if (path52[0] !== "/" && !(path52.startsWith("http://") || path52.startsWith("https://")) && method !== "CONNECT") {
           throw new InvalidArgumentError2("path must be an absolute URL or start with a slash");
-        } else if (invalidPathRegex.test(path51)) {
+        } else if (invalidPathRegex.test(path52)) {
           throw new InvalidArgumentError2("invalid request path");
         }
         if (typeof method !== "string") {
@@ -37377,7 +37431,7 @@ var require_request = __commonJS({
         this.completed = false;
         this.aborted = false;
         this.upgrade = upgrade || null;
-        this.path = query ? serializePathWithQuery(path51, query) : path51;
+        this.path = query ? serializePathWithQuery(path52, query) : path52;
         this.origin = origin;
         this.protocol = getProtocolFromUrlString(origin);
         this.idempotent = idempotent == null ? method === "HEAD" || method === "GET" : idempotent;
@@ -42559,7 +42613,7 @@ var require_client_h1 = __commonJS({
       return method !== "GET" && method !== "HEAD" && method !== "OPTIONS" && method !== "TRACE" && method !== "CONNECT";
     }
     function writeH1(client, request7) {
-      const { method, path: path51, host, upgrade, blocking, reset } = request7;
+      const { method, path: path52, host, upgrade, blocking, reset } = request7;
       let { body, headers, contentLength } = request7;
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH" || method === "QUERY" || method === "PROPFIND" || method === "PROPPATCH";
       if (util2.isFormDataLike(body)) {
@@ -42637,7 +42691,7 @@ var require_client_h1 = __commonJS({
       if (socket.setTypeOfService) {
         socket.setTypeOfService(request7.typeOfService);
       }
-      let header = `${method} ${path51} HTTP/1.1\r
+      let header = `${method} ${path52} HTTP/1.1\r
 `;
       if (typeof host === "string") {
         header += `host: ${host}\r
@@ -43316,7 +43370,7 @@ var require_client_h2 = __commonJS({
       const headersTimeout = request7.headersTimeout ?? client[kHeadersTimeout];
       const bodyTimeout = request7.bodyTimeout ?? client[kBodyTimeout];
       const session = client[kHTTP2Session];
-      const { method, path: path51, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request7;
+      const { method, path: path52, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request7;
       let { body } = request7;
       if (upgrade != null && upgrade !== "websocket") {
         util2.errorRequest(client, request7, new InvalidArgumentError2(`Custom upgrade "${upgrade}" not supported over HTTP/2`));
@@ -43385,7 +43439,7 @@ var require_client_h2 = __commonJS({
           }
           headers[HTTP2_HEADER_METHOD] = "CONNECT";
           headers[HTTP2_HEADER_PROTOCOL] = "websocket";
-          headers[HTTP2_HEADER_PATH] = path51;
+          headers[HTTP2_HEADER_PATH] = path52;
           if (protocol === "ws:" || protocol === "wss:") {
             headers[HTTP2_HEADER_SCHEME] = protocol === "ws:" ? "http" : "https";
           } else {
@@ -43427,7 +43481,7 @@ var require_client_h2 = __commonJS({
         stream.setTimeout(headersTimeout);
         return true;
       }
-      headers[HTTP2_HEADER_PATH] = path51;
+      headers[HTTP2_HEADER_PATH] = path52;
       headers[HTTP2_HEADER_SCHEME] = protocol === "http:" ? "http" : "https";
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH";
       if (body && typeof body.read === "function") {
@@ -45779,10 +45833,10 @@ var require_proxy_agent = __commonJS({
         };
         const {
           origin,
-          path: path51 = "/",
+          path: path52 = "/",
           headers = {}
         } = opts;
-        opts.path = origin + path51;
+        opts.path = origin + path52;
         if (!("host" in headers) && !("Host" in headers)) {
           const { host } = new URL(origin);
           headers.host = host;
@@ -47891,20 +47945,20 @@ var require_mock_utils = __commonJS({
       }
       return normalizedQp;
     }
-    function safeUrl(path51) {
-      if (typeof path51 !== "string") {
-        return path51;
+    function safeUrl(path52) {
+      if (typeof path52 !== "string") {
+        return path52;
       }
-      const pathSegments = path51.split("?", 3);
+      const pathSegments = path52.split("?", 3);
       if (pathSegments.length !== 2) {
-        return path51;
+        return path52;
       }
       const qp2 = new URLSearchParams(pathSegments.pop());
       qp2.sort();
       return [...pathSegments, qp2.toString()].join("?");
     }
-    function matchKey(mockDispatch2, { path: path51, method, body, headers }) {
-      const pathMatch = matchValue(mockDispatch2.path, path51);
+    function matchKey(mockDispatch2, { path: path52, method, body, headers }) {
+      const pathMatch = matchValue(mockDispatch2.path, path52);
       const methodMatch = matchValue(mockDispatch2.method, method);
       const bodyMatch = typeof mockDispatch2.body !== "undefined" ? matchValue(mockDispatch2.body, body) : true;
       const headersMatch = matchHeaders(mockDispatch2, headers);
@@ -47929,8 +47983,8 @@ var require_mock_utils = __commonJS({
       const basePath = key.query ? serializePathWithQuery(key.path, key.query) : key.path;
       const resolvedPath = typeof basePath === "string" ? safeUrl(basePath) : basePath;
       const resolvedPathWithoutTrailingSlash = removeTrailingSlash(resolvedPath);
-      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path51, ignoreTrailingSlash }) => {
-        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path51)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path51), resolvedPath);
+      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path52, ignoreTrailingSlash }) => {
+        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path52)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path52), resolvedPath);
       });
       if (matchedMockDispatches.length === 0) {
         throw new MockNotMatchedError(`Mock dispatch not matched for path '${resolvedPath}'`);
@@ -47969,19 +48023,19 @@ var require_mock_utils = __commonJS({
         mockDispatches.splice(index, 1);
       }
     }
-    function removeTrailingSlash(path51) {
-      while (path51.endsWith("/")) {
-        path51 = path51.slice(0, -1);
+    function removeTrailingSlash(path52) {
+      while (path52.endsWith("/")) {
+        path52 = path52.slice(0, -1);
       }
-      if (path51.length === 0) {
-        path51 = "/";
+      if (path52.length === 0) {
+        path52 = "/";
       }
-      return path51;
+      return path52;
     }
     function buildKey(opts) {
-      const { path: path51, method, body, headers, query } = opts;
+      const { path: path52, method, body, headers, query } = opts;
       return {
-        path: path51,
+        path: path52,
         method,
         body,
         headers,
@@ -48671,10 +48725,10 @@ var require_pending_interceptors_formatter = __commonJS({
       }
       format(pendingInterceptors) {
         const withPrettyHeaders = pendingInterceptors.map(
-          ({ method, path: path51, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
+          ({ method, path: path52, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
             Method: method,
             Origin: origin,
-            Path: path51,
+            Path: path52,
             "Status code": statusCode,
             Persistent: persist ? PERSISTENT : NOT_PERSISTENT,
             Invocations: timesInvoked,
@@ -48756,9 +48810,9 @@ var require_mock_agent = __commonJS({
         const acceptNonStandardSearchParameters = this[kMockAgentAcceptsNonStandardSearchParameters];
         const dispatchOpts = { ...opts };
         if (acceptNonStandardSearchParameters && dispatchOpts.path) {
-          const [path51, searchParams] = dispatchOpts.path.split("?");
+          const [path52, searchParams] = dispatchOpts.path.split("?");
           const normalizedSearchParams = normalizeSearchParams(searchParams, acceptNonStandardSearchParameters);
-          dispatchOpts.path = `${path51}?${normalizedSearchParams}`;
+          dispatchOpts.path = `${path52}?${normalizedSearchParams}`;
         }
         return this[kAgent].dispatch(dispatchOpts, handler);
       }
@@ -49159,12 +49213,12 @@ var require_snapshot_recorder = __commonJS({
        * @return {Promise<void>} - Resolves when snapshots are loaded
        */
       async loadSnapshots(filePath) {
-        const path51 = filePath || this.#snapshotPath;
-        if (!path51) {
+        const path52 = filePath || this.#snapshotPath;
+        if (!path52) {
           throw new InvalidArgumentError2("Snapshot path is required");
         }
         try {
-          const data = await readFile(resolve2(path51), "utf8");
+          const data = await readFile(resolve2(path52), "utf8");
           const parsed = JSON.parse(data);
           if (Array.isArray(parsed)) {
             this.#snapshots.clear();
@@ -49178,7 +49232,7 @@ var require_snapshot_recorder = __commonJS({
           if (error63.code === "ENOENT") {
             this.#snapshots.clear();
           } else {
-            throw new UndiciError(`Failed to load snapshots from ${path51}`, { cause: error63 });
+            throw new UndiciError(`Failed to load snapshots from ${path52}`, { cause: error63 });
           }
         }
       }
@@ -49189,11 +49243,11 @@ var require_snapshot_recorder = __commonJS({
        * @returns {Promise<void>} - Resolves when snapshots are saved
        */
       async saveSnapshots(filePath) {
-        const path51 = filePath || this.#snapshotPath;
-        if (!path51) {
+        const path52 = filePath || this.#snapshotPath;
+        if (!path52) {
           throw new InvalidArgumentError2("Snapshot path is required");
         }
-        const resolvedPath = resolve2(path51);
+        const resolvedPath = resolve2(path52);
         await mkdir(dirname3(resolvedPath), { recursive: true });
         const data = Array.from(this.#snapshots.entries()).map(([hash2, snapshot]) => ({
           hash: hash2,
@@ -49825,15 +49879,15 @@ var require_redirect_handler = __commonJS({
           return;
         }
         const { origin, pathname, search } = util2.parseURL(new URL(this.location, this.opts.origin && new URL(this.opts.path, this.opts.origin)));
-        const path51 = search ? `${pathname}${search}` : pathname;
-        const redirectUrlString = `${origin}${path51}`;
+        const path52 = search ? `${pathname}${search}` : pathname;
+        const redirectUrlString = `${origin}${path52}`;
         for (const historyUrl of this.history) {
           if (historyUrl.toString() === redirectUrlString) {
             throw new InvalidArgumentError2(`Redirect loop detected. Cannot redirect to ${origin}. This typically happens when using a Client or Pool with cross-origin redirects. Use an Agent for cross-origin redirects.`);
           }
         }
         this.opts.headers = cleanRequestHeaders(this.opts.headers, statusCode === 303, this.opts.origin !== origin);
-        this.opts.path = path51;
+        this.opts.path = path52;
         this.opts.origin = origin;
         this.opts.query = null;
       }
@@ -51593,10 +51647,10 @@ var require_cache_handler = __commonJS({
       }
       return locationUrl.pathname + locationUrl.search;
     }
-    function deleteCachedUri(store, cacheKey, path51) {
+    function deleteCachedUri(store, cacheKey, path52) {
       deleteCachedValue(store, {
         ...cacheKey,
-        path: path51
+        path: path52
       });
       for (let i10 = 0; i10 < util2.safeHTTPMethods.length; i10++) {
         const method = util2.safeHTTPMethods[i10];
@@ -51604,7 +51658,7 @@ var require_cache_handler = __commonJS({
           deleteCachedValue(store, {
             ...cacheKey,
             method,
-            path: path51
+            path: path52
           });
         }
       }
@@ -51615,9 +51669,9 @@ var require_cache_handler = __commonJS({
       }
       const values = Array.isArray(headerValue2) ? headerValue2 : [headerValue2];
       for (let i10 = 0; i10 < values.length; i10++) {
-        const path51 = getSameOriginPath(cacheKey, values[i10]);
-        if (path51 !== void 0) {
-          deleteCachedUri(store, cacheKey, path51);
+        const path52 = getSameOriginPath(cacheKey, values[i10]);
+        if (path52 !== void 0) {
+          deleteCachedUri(store, cacheKey, path52);
         }
       }
     }
@@ -56617,11 +56671,11 @@ var require_fetch = __commonJS({
       function dispatch({ body }) {
         const url2 = requestCurrentURL(request7);
         const agent = fetchParams.controller.dispatcher;
-        const path51 = url2.pathname + url2.search;
+        const path52 = url2.pathname + url2.search;
         const hasTrailingQuestionMark = url2.search.length === 0 && url2.href[url2.href.length - url2.hash.length - 1] === "?";
         return new Promise((resolve2, reject) => agent.dispatch(
           {
-            path: hasTrailingQuestionMark ? `${path51}?` : path51,
+            path: hasTrailingQuestionMark ? `${path52}?` : path52,
             origin: url2.origin,
             method: request7.method,
             body: agent.isMockActive ? request7.body && (request7.body.source || request7.body.stream) : body,
@@ -57568,9 +57622,9 @@ var require_util5 = __commonJS({
         }
       }
     }
-    function validateCookiePath(path51) {
-      for (let i10 = 0; i10 < path51.length; ++i10) {
-        const code = path51.charCodeAt(i10);
+    function validateCookiePath(path52) {
+      for (let i10 = 0; i10 < path52.length; ++i10) {
+        const code = path52.charCodeAt(i10);
         if (code < 32 || // exclude CTLs (0-31)
         code > 126 || // exclude DEL and non-ascii
         code === 59) {
@@ -60918,11 +60972,11 @@ var require_undici = __commonJS({
           if (typeof opts.path !== "string") {
             throw new InvalidArgumentError2("invalid opts.path");
           }
-          let path51 = opts.path;
+          let path52 = opts.path;
           if (!opts.path.startsWith("/")) {
-            path51 = `/${path51}`;
+            path52 = `/${path52}`;
           }
-          url2 = new URL(util2.parseOrigin(url2).origin + path51);
+          url2 = new URL(util2.parseOrigin(url2).origin + path52);
         } else {
           if (!opts) {
             opts = typeof url2 === "object" ? url2 : {};
@@ -61072,7 +61126,7 @@ function ensureFrontDoor(params) {
         }
         if (verdict.ok) {
           const token = (0, import_node_crypto10.randomUUID)();
-          writeFrontDoorSession(ports.fs, paths.frontdoorSessionsDir, { pid: params.launcherPid, startedAt: ports.now(), token });
+          writeFrontDoorSession(ports.fs, paths.frontdoorSessionsDir, { pid: params.launcherPid, startedAt: ports.now(), token, supervisorPid });
           return { port: state.port, connectPort: state.connectPort, token };
         }
         lastRejection = `the listener on 127.0.0.1:${String(state.port)} (recorded for pid ${String(supervisorPid)}) failed authentication: ${verdict.reason}`;
@@ -62153,7 +62207,12 @@ function resolvePoolLaunch(params) {
     if (graph.ranking.candidates.length === 0) {
       return { ok: false, message: `agent-shim: no member of pool "${poolName}" is an existing identity.` };
     }
-    const { pick: pick2, earliestReturn, movedOff } = graph.ranking;
+    const { pick: pick2, earliestReturn, movedOff, planReturn } = graph.ranking;
+    if (pick2 !== void 0 && params.wait && planReturn !== void 0) {
+      log.info(`agent-shim: pool "${poolName}" would continue ${planReturn.identity} on extra usage; waiting until ${new Date(planReturn.atMs).toISOString()} for its plan window`);
+      params.sleep(Math.max(planReturn.atMs - nowMs, 0));
+      continue;
+    }
     if (pick2 !== void 0) {
       if (params.recordPick) {
         recordStickyPick(params.usageFs, params.paths.usagePicksFile, params.cwd, pick2.identity, nowMs);
@@ -62832,6 +62891,57 @@ var init_launchWiring = __esm({
   }
 });
 
+// src/usage/identityClaude.ts
+function definedEnvironment(env) {
+  return Object.fromEntries(Object.entries(env).flatMap(([name, value2]) => value2 === void 0 ? [] : [[name, value2]]));
+}
+function identityLaunchArgv(identity, flags) {
+  return [`@${identity}`, IDENTITY_ONLY_FLAG, ...flags];
+}
+async function withIdentityClaude(params, identity, flags, use2) {
+  const refusals = [];
+  const plan = prepareLaunch(
+    realPrepareLaunchParams(params.paths, {
+      proc: {
+        env: Object.fromEntries(Object.entries(process.env).filter(([name]) => name !== CONFIG_DIR_VARIABLE)),
+        argv: [...identityLaunchArgv(identity, flags)],
+        exit: (code) => {
+          throw new LaunchRefusedError(refusals.join("\n") || `the launch was refused (exit ${String(code)})`, code);
+        }
+      },
+      log: {
+        info: () => void 0,
+        warn: () => void 0,
+        error: (message) => {
+          refusals.push(message);
+        }
+      },
+      spawnDaemon: params.spawnDaemon,
+      farm: buildFarmRuntime(params.paths, params.cwd)
+    })
+  );
+  const abort = new AbortController();
+  const timer = setTimeout(() => {
+    abort.abort();
+  }, params.timeoutMs);
+  try {
+    return await use2({ bin: plan.bin, env: definedEnvironment(plan.env), cwd: params.cwd, abort });
+  } finally {
+    clearTimeout(timer);
+    plan.release();
+  }
+}
+var CONFIG_DIR_VARIABLE, IDENTITY_ONLY_FLAG;
+var init_identityClaude = __esm({
+  "src/usage/identityClaude.ts"() {
+    "use strict";
+    init_launchWiring();
+    init_launcher();
+    CONFIG_DIR_VARIABLE = "CLAUDE_CONFIG_DIR";
+    IDENTITY_ONLY_FLAG = "--no-provider";
+  }
+});
+
 // src/usage/providerQuota.ts
 function zaiWindow(limit) {
   const unitMs = ZAI_UNIT_MS.get(limit.unit);
@@ -62866,7 +62976,7 @@ async function openRouterGet(url2, schema, apiKey, http8, signal) {
   return parsed.data;
 }
 function nextUtcMidnight(nowMs) {
-  return new Date((Math.floor(nowMs / MS_PER_DAY) + 1) * MS_PER_DAY).toISOString();
+  return new Date((Math.floor(nowMs / MS_PER_DAY2) + 1) * MS_PER_DAY2).toISOString();
 }
 function adapterFor(baseUrl) {
   return PROVIDER_QUOTA_ADAPTERS.find((adapter) => adapter.matches(baseUrl));
@@ -62875,7 +62985,7 @@ function quotaFreshnessMs(quota) {
   const lengths = quota.windows.flatMap((window) => window.periodMs === void 0 ? [] : [window.periodMs]);
   return lengths.length === 0 ? Number.POSITIVE_INFINITY : Math.min(...lengths) / PERCENT3;
 }
-var ProviderQuotaError, MS_PER_SECOND5, SECONDS_PER_HOUR, HOURS_PER_DAY3, DAYS_PER_MONTH, PERCENT3, HTTP_OK, ZAI_SOURCE, ZAI_HOST, ZAI_QUOTA_URL, ZAI_UNIT_HOURS, ZAI_UNIT_MONTHS, ZAI_UNIT_MS, ZAI_MEASURES, ZaiLimitSchema, ZaiResponseSchema, zaiQuotaAdapter, OPENROUTER_SOURCE, OPENROUTER_HOST, OPENROUTER_KEY_URL, OPENROUTER_CREDITS_URL, HTTP_FORBIDDEN, MS_PER_DAY, OpenRouterKeySchema, OpenRouterCreditsSchema, openRouterQuotaAdapter, PROVIDER_QUOTA_ADAPTERS;
+var ProviderQuotaError, MS_PER_SECOND6, SECONDS_PER_HOUR, HOURS_PER_DAY3, DAYS_PER_MONTH, PERCENT3, HTTP_OK, ZAI_SOURCE, ZAI_HOST, ZAI_QUOTA_URL, ZAI_UNIT_HOURS, ZAI_UNIT_MONTHS, ZAI_UNIT_MS, ZAI_MEASURES, ZaiLimitSchema, ZaiResponseSchema, zaiQuotaAdapter, OPENROUTER_SOURCE, OPENROUTER_HOST, OPENROUTER_KEY_URL, OPENROUTER_CREDITS_URL, HTTP_FORBIDDEN, MS_PER_DAY2, OpenRouterKeySchema, OpenRouterCreditsSchema, openRouterQuotaAdapter, PROVIDER_QUOTA_ADAPTERS;
 var init_providerQuota = __esm({
   "src/usage/providerQuota.ts"() {
     "use strict";
@@ -62887,7 +62997,7 @@ var init_providerQuota = __esm({
         this.name = "ProviderQuotaError";
       }
     };
-    MS_PER_SECOND5 = 1e3;
+    MS_PER_SECOND6 = 1e3;
     SECONDS_PER_HOUR = 3600;
     HOURS_PER_DAY3 = 24;
     DAYS_PER_MONTH = 30;
@@ -62899,8 +63009,8 @@ var init_providerQuota = __esm({
     ZAI_UNIT_HOURS = 3;
     ZAI_UNIT_MONTHS = 5;
     ZAI_UNIT_MS = /* @__PURE__ */ new Map([
-      [ZAI_UNIT_HOURS, SECONDS_PER_HOUR * MS_PER_SECOND5],
-      [ZAI_UNIT_MONTHS, DAYS_PER_MONTH * HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND5]
+      [ZAI_UNIT_HOURS, SECONDS_PER_HOUR * MS_PER_SECOND6],
+      [ZAI_UNIT_MONTHS, DAYS_PER_MONTH * HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND6]
     ]);
     ZAI_MEASURES = { TOKENS_LIMIT: "tokens", TIME_LIMIT: "tool-calls" };
     ZaiLimitSchema = external_exports.object({
@@ -62952,7 +63062,7 @@ var init_providerQuota = __esm({
     OPENROUTER_KEY_URL = `https://${OPENROUTER_HOST}/api/v1/key`;
     OPENROUTER_CREDITS_URL = `https://${OPENROUTER_HOST}/api/v1/credits`;
     HTTP_FORBIDDEN = 403;
-    MS_PER_DAY = HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND5;
+    MS_PER_DAY2 = HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND6;
     OpenRouterKeySchema = external_exports.object({
       data: external_exports.object({
         limit: external_exports.number().nonnegative().nullable(),
@@ -62983,7 +63093,7 @@ var init_providerQuota = __esm({
           windows.push({ measures: "account-credits", period: "prepaid", utilization: used / total, limit: total, used, remaining: Math.max(total - used, 0) });
         }
         if (free !== void 0 && free.limit > 0) {
-          windows.push({ measures: "free-model-requests", periodMs: MS_PER_DAY, utilization: free.used / free.limit, resetsAt: nextUtcMidnight(nowMs), limit: free.limit, used: free.used, remaining: Math.max(free.remaining, 0) });
+          windows.push({ measures: "free-model-requests", periodMs: MS_PER_DAY2, utilization: free.used / free.limit, resetsAt: nextUtcMidnight(nowMs), limit: free.limit, used: free.used, remaining: Math.max(free.remaining, 0) });
         }
         return ProviderQuotaSchema.parse({
           observedAt: new Date(nowMs).toISOString(),
@@ -96575,9 +96685,6 @@ var realAnthropicUsageProbe_exports = {};
 __export(realAnthropicUsageProbe_exports, {
   createRealAnthropicUsageRefresher: () => createRealAnthropicUsageRefresher
 });
-function definedEnvironment(env) {
-  return Object.fromEntries(Object.entries(env).flatMap(([name, value2]) => value2 === void 0 ? [] : [[name, value2]]));
-}
 function idlePrompt(signal) {
   return {
     [Symbol.asyncIterator]: () => ({
@@ -96590,58 +96697,28 @@ function idlePrompt(signal) {
   };
 }
 function createRealAnthropicUsageProbe(params) {
-  return async (identity) => {
-    const refusals = [];
-    const plan = prepareLaunch(
-      realPrepareLaunchParams(params.paths, {
-        proc: {
-          env: Object.fromEntries(Object.entries(process.env).filter(([name]) => name !== CONFIG_DIR_VARIABLE)),
-          argv: [`@${identity}`, ...PROBE_LAUNCH_FLAGS],
-          exit: (code) => {
-            throw new LaunchRefusedError(refusals.join("\n") || `the launch was refused (exit ${String(code)})`, code);
-          }
-        },
-        log: {
-          info: () => void 0,
-          warn: () => void 0,
-          error: (message) => {
-            refusals.push(message);
-          }
-        },
-        spawnDaemon: params.spawnDaemon,
-        farm: buildFarmRuntime(params.paths, params.cwd)
-      })
-    );
+  return async (identity) => await withIdentityClaude(params, identity, PROBE_LAUNCH_FLAGS, async ({ bin, env, cwd, abort }) => {
     const { query } = await Promise.resolve().then(() => (init_sdk(), sdk_exports));
-    const abort = new AbortController();
-    const timer = setTimeout(() => {
-      abort.abort();
-    }, params.timeoutMs);
-    try {
-      const session = query({
-        prompt: idlePrompt(abort.signal),
-        options: {
-          pathToClaudeCodeExecutable: plan.bin,
-          env: definedEnvironment(plan.env),
-          cwd: params.cwd,
-          abortController: abort,
-          settingSources: [],
-          mcpServers: {},
-          strictMcpConfig: true,
-          persistSession: false
-        }
-      });
-      try {
-        const report = await session.usage_EXPERIMENTAL_MAY_CHANGE_DO_NOT_RELY_ON_THIS_API_YET({ skipBehaviors: true });
-        return unifiedFromReportedLimits(report.rate_limits_available ? report.rate_limits : null);
-      } finally {
-        session.close();
+    const session = query({
+      prompt: idlePrompt(abort.signal),
+      options: {
+        pathToClaudeCodeExecutable: bin,
+        env,
+        cwd,
+        abortController: abort,
+        settingSources: [],
+        mcpServers: {},
+        strictMcpConfig: true,
+        persistSession: false
       }
+    });
+    try {
+      const report = await session.usage_EXPERIMENTAL_MAY_CHANGE_DO_NOT_RELY_ON_THIS_API_YET({ skipBehaviors: true });
+      return unifiedFromReportedLimits(report.rate_limits_available ? report.rate_limits : null);
     } finally {
-      clearTimeout(timer);
-      plan.release();
+      session.close();
     }
-  };
+  });
 }
 function createRealAnthropicUsageRefresher(params) {
   return createAnthropicUsageRefresher({
@@ -96654,18 +96731,16 @@ function createRealAnthropicUsageRefresher(params) {
     concurrency: (0, import_node_os11.availableParallelism)()
   });
 }
-var import_node_os11, PROBE_LAUNCH_FLAGS, CONFIG_DIR_VARIABLE;
+var import_node_os11, PROBE_LAUNCH_FLAGS;
 var init_realAnthropicUsageProbe = __esm({
   "src/usage/realAnthropicUsageProbe.ts"() {
     "use strict";
     import_node_os11 = require("node:os");
-    init_launchWiring();
-    init_launcher();
     init_anthropicUsageRefresh();
+    init_identityClaude();
     init_middleware();
     init_quotaRefresh();
     PROBE_LAUNCH_FLAGS = ["--no-headroom", "--no-remote-control"];
-    CONFIG_DIR_VARIABLE = "CLAUDE_CONFIG_DIR";
   }
 });
 
@@ -99898,8 +99973,8 @@ var require_utils3 = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path51) {
-      let input2 = path51;
+    function removeDotSegments(path52) {
+      let input2 = path52;
       const output2 = [];
       let nextSlash = -1;
       let len = 0;
@@ -100308,8 +100383,8 @@ var require_schemes = __commonJS({
       }
       if (wsComponent.resourceName) {
         const queryIndex = wsComponent.resourceName.indexOf("?");
-        const path51 = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
-        wsComponent.path = path51 && path51 !== "/" ? path51 : void 0;
+        const path52 = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
+        wsComponent.path = path52 && path52 !== "/" ? path52 : void 0;
         wsComponent.query = queryIndex === -1 ? void 0 : wsComponent.resourceName.slice(queryIndex + 1);
         wsComponent.resourceName = void 0;
       }
@@ -103836,7 +103911,7 @@ var require_dist2 = __commonJS({
 });
 
 // src/cli.ts
-var import_node_path50 = __toESM(require("node:path"), 1);
+var import_node_path51 = __toESM(require("node:path"), 1);
 
 // node_modules/.pnpm/commander@15.0.0/node_modules/commander/lib/error.js
 var CommanderError = class extends Error {
@@ -106949,9 +107024,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
    * @param {string} [path]
    * @return {(string|null|Command)}
    */
-  executableDir(path51) {
-    if (path51 === void 0) return this._executableDir;
-    this._executableDir = path51;
+  executableDir(path52) {
+    if (path52 === void 0) return this._executableDir;
+    this._executableDir = path52;
     return this;
   }
   /**
@@ -108600,19 +108675,19 @@ function writePools(paths, pools) {
   applyPatch(paths.globalConfigFile, GlobalConfigSchema, { pools }, { defaults: {} });
 }
 function poolCycleOf(pools, name) {
-  const walk = (current, path51) => {
+  const walk = (current, path52) => {
     for (const entry of pools[current]?.identities ?? []) {
       const nested = poolNameOf(poolMemberIdentity(entry));
       if (nested === void 0) {
         continue;
       }
       if (nested === name) {
-        return [...path51, nested];
+        return [...path52, nested];
       }
-      if (path51.includes(nested)) {
+      if (path52.includes(nested)) {
         continue;
       }
-      const found = walk(nested, [...path51, nested]);
+      const found = walk(nested, [...path52, nested]);
       if (found !== void 0) {
         return found;
       }
@@ -108763,6 +108838,18 @@ function listIdentities(paths) {
   }
   return result;
 }
+function listAnchoredIdentities(paths) {
+  return listIdentities(paths).flatMap(({ name }) => {
+    const anchors = readIdentity(paths, name)?.anchors;
+    return anchors === void 0 ? [] : [{ identity: name, anchors }];
+  });
+}
+function setIdentityAnchors(paths, identityName, anchors) {
+  if (!identityExists(paths, identityName)) {
+    throw new IdentityNotFoundError(identityName);
+  }
+  return applyPatch(identityJsonPath(paths, identityName), IdentitySchema, { anchors: anchors === void 0 ? void 0 : [...anchors] });
+}
 function setDefaultConfigProfile(paths, identityName, profileName) {
   if (!identityExists(paths, identityName)) {
     throw new IdentityNotFoundError(identityName);
@@ -109541,6 +109628,135 @@ function cacheChange(options, existing) {
   }
 }
 
+// src/usage/anchor.ts
+init_schema();
+var MS_PER_SECOND = 1e3;
+var MS_PER_MINUTE2 = 6e4;
+var MINUTES_PER_HOUR = 60;
+var DAYS_IN_WEEK = 7;
+var MS_PER_DAY = 864e5;
+var SEARCH_MARGIN_DAYS = 1;
+var WORKING_DAYS = 5;
+var WEEKDAY_SHORTHANDS = { daily: WEEKDAYS, weekdays: WEEKDAYS.slice(0, WORKING_DAYS) };
+function zoneOffsetMs(utcMs, timeZone) {
+  const wholeSecondMs = Math.floor(utcMs / MS_PER_SECOND) * MS_PER_SECOND;
+  const parts = new Intl.DateTimeFormat("en-GB", { timeZone, hourCycle: "h23", year: "numeric", month: "2-digit", day: "2-digit", hour: "2-digit", minute: "2-digit", second: "2-digit" }).formatToParts(new Date(wholeSecondMs));
+  const field = (type2) => Number(parts.find((part) => part.type === type2)?.value);
+  return Date.UTC(field("year"), field("month") - 1, field("day"), field("hour"), field("minute"), field("second")) - wholeSecondMs;
+}
+function wallTimeToUtcMs(date5, minutesOfDay, timeZone) {
+  const asUtc = Date.UTC(date5.year, date5.month - 1, date5.day) + minutesOfDay * MS_PER_MINUTE2;
+  const candidates = [zoneOffsetMs(asUtc - MS_PER_DAY, timeZone), zoneOffsetMs(asUtc + MS_PER_DAY, timeZone)].map((offset) => ({ offset, instant: asUtc - offset }));
+  const valid = candidates.filter(({ offset, instant }) => zoneOffsetMs(instant, timeZone) === offset).map(({ instant }) => instant);
+  return valid.length === 0 ? asUtc - (candidates[0]?.offset ?? 0) : Math.min(...valid);
+}
+function localDate(utcMs, timeZone) {
+  const local = new Date(utcMs + zoneOffsetMs(utcMs, timeZone));
+  return { year: local.getUTCFullYear(), month: local.getUTCMonth() + 1, day: local.getUTCDate() };
+}
+function weekdayOf(date5) {
+  const sundayFirst = new Date(Date.UTC(date5.year, date5.month - 1, date5.day)).getUTCDay();
+  const day = WEEKDAYS[(sundayFirst + DAYS_IN_WEEK - 1) % DAYS_IN_WEEK];
+  if (day === void 0) {
+    throw new RangeError(`no weekday for day number ${String(sundayFirst)}`);
+  }
+  return day;
+}
+function minutesOfDayOf(time4) {
+  const [hours, minutes] = time4.split(":").map(Number);
+  return (hours ?? 0) * MINUTES_PER_HOUR + (minutes ?? 0);
+}
+function anchorInstants(anchors, afterMs, uptoMs, defaultTimeZone) {
+  const instants = anchors.flatMap((anchor2) => {
+    const timeZone = anchor2.timeZone ?? defaultTimeZone;
+    const minutesOfDay = minutesOfDayOf(anchor2.time);
+    const first = localDate(afterMs - SEARCH_MARGIN_DAYS * MS_PER_DAY, timeZone);
+    const found = [];
+    for (let offset = 0; ; offset += 1) {
+      const date5 = localDate(Date.UTC(first.year, first.month - 1, first.day + offset) + MS_PER_DAY / 2, "UTC");
+      const instant = wallTimeToUtcMs(date5, minutesOfDay, timeZone);
+      if (instant > uptoMs + SEARCH_MARGIN_DAYS * MS_PER_DAY) {
+        return found;
+      }
+      if (instant > afterMs && instant <= uptoMs && anchor2.days.includes(weekdayOf(date5))) {
+        found.push(instant);
+      }
+    }
+  });
+  return instants.sort((left, right) => left - right);
+}
+function dueAnchor(anchors, nowMs, handledMs, defaultTimeZone) {
+  const since = Math.max(handledMs, nowMs - DAYS_IN_WEEK * MS_PER_DAY);
+  return anchorInstants(anchors, since, nowMs, defaultTimeZone).at(-1);
+}
+function parseDayItem(item) {
+  const [from, to2, ...extra] = item.split("-");
+  const index = (name) => WEEKDAYS.findIndex((day) => day === name);
+  if (from === void 0 || extra.length > 0 || index(from) === -1 || to2 !== void 0 && index(to2) === -1) {
+    throw new Error(`"${item}" is not a weekday (${WEEKDAYS.join(", ")}) or a range such as mon-fri`);
+  }
+  if (to2 === void 0) {
+    return [WEEKDAYS[index(from)] ?? "mon"];
+  }
+  const length = (index(to2) - index(from) + DAYS_IN_WEEK) % DAYS_IN_WEEK + 1;
+  return Array.from({ length }, (_, step2) => WEEKDAYS[(index(from) + step2) % DAYS_IN_WEEK] ?? "mon");
+}
+function parseAnchor(spec) {
+  const match = /^(?<days>[^@]+)@(?<time>[^/]+)(?:\/(?<zone>.+))?$/.exec(spec);
+  const { days, time: time4, zone } = match?.groups ?? {};
+  if (days === void 0 || time4 === void 0) {
+    throw new Error(`"${spec}" is not an anchor: write <days>@<HH:MM>[/<time zone>], such as mon-fri@06:00 or sat,sun@08:30/Europe/London`);
+  }
+  const named = WEEKDAY_SHORTHANDS[days] ?? days.split(",").flatMap(parseDayItem);
+  const parsed = AnchorSchema.safeParse({ days: [...new Set(named)], time: time4, ...zone === void 0 ? {} : { timeZone: zone } });
+  if (!parsed.success) {
+    throw new Error(`"${spec}" is not an anchor: ${parsed.error.issues.map((issue2) => issue2.message).join("; ")}`);
+  }
+  return parsed.data;
+}
+var ANCHOR_SYNTAX = "<days>@<HH:MM>[/<time zone>], where days are daily, weekdays, or weekday names and ranges such as mon,wed or mon-fri, and the zone defaults to the machine's own";
+function formatAnchor(anchor2) {
+  return `${anchor2.days.join(",")}@${anchor2.time}${anchor2.timeZone === void 0 ? "" : `/${anchor2.timeZone}`}`;
+}
+function machineTimeZone() {
+  return new Intl.DateTimeFormat().resolvedOptions().timeZone;
+}
+
+// src/cli/parsers.ts
+init_conditions();
+init_pairs();
+function asInvalidArgument(parse4) {
+  try {
+    return parse4();
+  } catch (error63) {
+    if (error63 instanceof Error && !(error63 instanceof InvalidArgumentError)) {
+      throw new InvalidArgumentError(error63.message);
+    }
+    throw error63;
+  }
+}
+function collectBoolPair(value2, previous = {}) {
+  return asInvalidArgument(() => {
+    const { key, value: raw } = parsePair(value2);
+    return { ...previous, [key]: parseBool(raw) };
+  });
+}
+function collectStringPair(value2, previous = {}) {
+  return asInvalidArgument(() => {
+    const { key, value: raw } = parsePair(value2);
+    return { ...previous, [key]: raw };
+  });
+}
+function collectRepeated(value2, previous = []) {
+  return [...previous, value2];
+}
+function collectAnchor(value2, previous = []) {
+  return [...previous, asInvalidArgument(() => parseAnchor(value2))];
+}
+function parseDurationOption(value2) {
+  return asInvalidArgument(() => parseDuration(value2));
+}
+
 // src/identityManager.ts
 init_classify();
 init_schema();
@@ -109594,40 +109810,6 @@ async function resolveFarmConflicts(params) {
 
 // src/configProfiles.ts
 init_commandDeps();
-
-// src/cli/parsers.ts
-init_conditions();
-init_pairs();
-function asInvalidArgument(parse4) {
-  try {
-    return parse4();
-  } catch (error63) {
-    if (error63 instanceof Error && !(error63 instanceof InvalidArgumentError)) {
-      throw new InvalidArgumentError(error63.message);
-    }
-    throw error63;
-  }
-}
-function collectBoolPair(value2, previous = {}) {
-  return asInvalidArgument(() => {
-    const { key, value: raw } = parsePair(value2);
-    return { ...previous, [key]: parseBool(raw) };
-  });
-}
-function collectStringPair(value2, previous = {}) {
-  return asInvalidArgument(() => {
-    const { key, value: raw } = parsePair(value2);
-    return { ...previous, [key]: raw };
-  });
-}
-function collectRepeated(value2, previous = []) {
-  return [...previous, value2];
-}
-function parseDurationOption(value2) {
-  return asInvalidArgument(() => parseDuration(value2));
-}
-
-// src/configProfiles.ts
 init_cliError();
 async function ensureProfileExists(deps, name) {
   if (profileExists(deps.paths, name)) {
@@ -109857,7 +110039,8 @@ function toIdentityView(paths, entry) {
     ...entry.problem === void 0 ? {
       ...entry.identity.defaultConfigProfile === void 0 ? {} : { defaultConfigProfile: entry.identity.defaultConfigProfile },
       allowAmbientCredential: entry.identity.allowAmbientCredential,
-      ...entry.identity.credential === void 0 ? {} : { credential: summariseCredential(entry.identity.credential) }
+      ...entry.identity.credential === void 0 ? {} : { credential: summariseCredential(entry.identity.credential) },
+      ...entry.identity.anchors === void 0 ? {} : { anchors: entry.identity.anchors }
     } : { problem: entry.problem }
   };
 }
@@ -109926,6 +110109,7 @@ function registerIdentityCommand(program2, deps) {
       console.log(`Default configuration profile: ${view.defaultConfigProfile ?? "(none)"}`);
       console.log(`Allows ambient credential: ${view.allowAmbientCredential === true ? "yes" : "no"}`);
       console.log(`Credential: ${entry.identity?.credential === void 0 ? "(none; uses its stored login)" : describeCredential(entry.identity.credential)}`);
+      console.log(`Anchors: ${view.anchors === void 0 ? "(none)" : view.anchors.map(formatAnchor).join(" ")}`);
     }),
     ["agent-shim identity show work", "agent-shim identity show work --json"]
   );
@@ -109933,7 +110117,11 @@ function registerIdentityCommand(program2, deps) {
     "--credential <source>",
     `Authenticate this identity from a token instead of its stored login, replacing any existing sources (repeatable, in the order tried): ${CREDENTIAL_SOURCE_SYNTAX}.`,
     collectCredentialSource
-  ).option("--no-credential", "Remove this identity's credential, returning it to its stored login.").addOption(
+  ).option("--no-credential", "Remove this identity's credential, returning it to its stored login.").option(
+    "--anchor <spec>",
+    `Have the front door open a five-hour window for this identity at these times when none is open, so its window resets when you want (repeatable, replacing any existing anchors): ${ANCHOR_SYNTAX}.`,
+    collectAnchor
+  ).option("--no-anchor", "Remove this identity's anchors.").addOption(
     new Option(
       "--credential-target <target>",
       "Where the token goes: oauthToken sets CLAUDE_CODE_OAUTH_TOKEN (a `claude setup-token` token), bearer sets ANTHROPIC_AUTH_TOKEN (the default), apiKey sets ANTHROPIC_API_KEY."
@@ -109945,7 +110133,7 @@ function registerIdentityCommand(program2, deps) {
       const { json: json2, ...options } = allOptions;
       if (Object.entries(allOptions).every(([key, value2]) => key === "json" || value2 === void 0)) {
         throw new UsageError(
-          "Nothing to change: pass --default-profile, --no-default-profile, --allow-ambient-credential, --no-allow-ambient-credential, --credential, --no-credential, --credential-target or a --credential-cache option."
+          "Nothing to change: pass --default-profile, --no-default-profile, --allow-ambient-credential, --no-allow-ambient-credential, --credential, --no-credential, --credential-target, --anchor, --no-anchor or a --credential-cache option."
         );
       }
       if (!identityExists(paths, name)) {
@@ -109980,6 +110168,10 @@ function registerIdentityCommand(program2, deps) {
           messages.push(`Identity "${name}" now authenticates with credential ${describeCredential(updated.credential)}.`);
         }
       }
+      if (options.anchor !== void 0) {
+        const updated = setIdentityAnchors(paths, name, options.anchor === false ? void 0 : options.anchor);
+        messages.push(updated.anchors === void 0 ? `Identity "${name}" no longer has anchors.` : `Identity "${name}" now has anchors ${updated.anchors.map(formatAnchor).join(" ")}.`);
+      }
       reportMutation(json2, { action: "updated", kind: "identity", name, value: readIdentity(paths, name) }, () => {
         for (const message of messages) {
           console.log(message);
@@ -109990,7 +110182,9 @@ function registerIdentityCommand(program2, deps) {
       "agent-shim identity set work --default-profile client-acme",
       "agent-shim identity set work --allow-ambient-credential",
       "agent-shim identity set work --credential-target oauthToken --credential op:op://vault/claude-work/token",
-      "agent-shim identity set work --no-credential"
+      "agent-shim identity set work --no-credential",
+      "agent-shim identity set work --anchor mon-fri@06:00",
+      "agent-shim identity set work --no-anchor"
     ]
   );
   withExamples(
@@ -110740,7 +110934,7 @@ var SIWC_PLAN_SCOPE = "chatgpt.tokens.use.direct";
 var SIWC_CALLBACK_PORT = 1455;
 var SIWC_CALLBACK_PATH = "/auth/callback";
 var SIWC_RANDOM_BYTES = 32;
-var MS_PER_SECOND4 = 1e3;
+var MS_PER_SECOND5 = 1e3;
 var ID_TOKEN_ALGORITHM = "RS256";
 var SiwcError = class extends Error {
   constructor(message) {
@@ -110836,7 +111030,7 @@ function grantTokens(ports, answer) {
     refreshToken: answer.refresh_token,
     idToken: answer.id_token,
     scopes: answer.scope === void 0 ? void 0 : answer.scope.split(" ").filter((part) => part !== ""),
-    expiresAt: ports.now().getTime() + answer.expires_in * MS_PER_SECOND4
+    expiresAt: ports.now().getTime() + answer.expires_in * MS_PER_SECOND5
   };
 }
 async function exchangeCode(ports, request7) {
@@ -110897,7 +111091,7 @@ async function verifyIdToken(ports, idToken, expected) {
   if (!(Array.isArray(claims.aud) ? claims.aud : [claims.aud]).includes(expected.clientId)) {
     throw new SiwcError("the ID token was issued for a different client");
   }
-  if (claims.exp * MS_PER_SECOND4 <= ports.now().getTime()) {
+  if (claims.exp * MS_PER_SECOND5 <= ports.now().getTime()) {
     throw new SiwcError("the ID token has already expired");
   }
   if (expected.nonce !== void 0 && claims.nonce !== expected.nonce) {
@@ -111429,7 +111623,7 @@ function registerCodexCommand(program2, deps) {
 
 // src/frontdoor/commands.ts
 var import_node_crypto20 = require("node:crypto");
-var import_node_path45 = __toESM(require("node:path"), 1);
+var import_node_path46 = __toESM(require("node:path"), 1);
 var import_node_fs16 = __toESM(require("node:fs"), 1);
 init_commandDeps();
 init_schema();
@@ -111644,6 +111838,140 @@ async function refreshStalePoolMembers(params) {
 init_anthropicUsageRefresh();
 init_poolPick();
 init_realAnthropicUsageProbe();
+
+// src/usage/realWindowOpener.ts
+init_identityClaude();
+var OPENER_LAUNCH_FLAGS = ["--no-headroom", "--no-remote-control", "--track-usage"];
+var WINDOW_OPENING_MODEL = "haiku";
+var WINDOW_OPENING_PROMPT = "ok";
+var WINDOW_OPENING_SYSTEM_PROMPT = "Reply with one word.";
+var WINDOW_OPEN_TIMEOUT_MS = 6e4;
+function createRealWindowOpener(params) {
+  return async (identity) => {
+    await withIdentityClaude({ ...params, timeoutMs: WINDOW_OPEN_TIMEOUT_MS }, identity, OPENER_LAUNCH_FLAGS, async ({ bin, env, cwd, abort }) => {
+      const { query } = await Promise.resolve().then(() => (init_sdk(), sdk_exports));
+      const session = query({
+        prompt: WINDOW_OPENING_PROMPT,
+        options: {
+          pathToClaudeCodeExecutable: bin,
+          env,
+          cwd,
+          abortController: abort,
+          settingSources: [],
+          mcpServers: {},
+          strictMcpConfig: true,
+          persistSession: false,
+          model: WINDOW_OPENING_MODEL,
+          maxTurns: 1,
+          tools: [],
+          systemPrompt: WINDOW_OPENING_SYSTEM_PROMPT,
+          thinking: { type: "disabled" }
+        }
+      });
+      try {
+        for await (const message of session) {
+          if (message.type === "result") {
+            if (message.subtype !== "success") {
+              throw new Error(`the opening request ended as ${message.subtype}`);
+            }
+            return;
+          }
+        }
+        throw new Error("the opening request ended without a result");
+      } finally {
+        session.close();
+      }
+    });
+  };
+}
+
+// src/usage/windowKeeper.ts
+var import_node_path38 = __toESM(require("node:path"), 1);
+init_zod();
+init_preflight();
+init_pick();
+init_middleware();
+var STAMPS_SCHEMA_VERSION = 1;
+var StampsFileSchema = external_exports.strictObject({
+  schemaVersion: external_exports.literal(STAMPS_SCHEMA_VERSION),
+  handled: external_exports.record(external_exports.string().min(1), external_exports.iso.datetime())
+});
+function readStamps(fs22, file2) {
+  const raw = fs22.readFileUtf8(file2);
+  if (raw === void 0) {
+    return {};
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    parsed = void 0;
+  }
+  const result = StampsFileSchema.safeParse(parsed);
+  return result.success ? Object.fromEntries(Object.entries(result.data.handled).map(([identity, at2]) => [identity, Date.parse(at2)])) : {};
+}
+function writeStamps(fs22, file2, handled) {
+  const next = { schemaVersion: STAMPS_SCHEMA_VERSION, handled: Object.fromEntries(Object.entries(handled).map(([identity, at2]) => [identity, new Date(at2).toISOString()])) };
+  fs22.mkdirPrivate(import_node_path38.default.dirname(file2));
+  fs22.writeFilePrivate(file2, `${JSON.stringify(next, null, 2)}
+`);
+}
+function reasonNotToOpen(identity, snapshot, nowMs) {
+  if (snapshot === void 0) {
+    return void 0;
+  }
+  const unified = snapshot.providers[ANTHROPIC_PROVIDER]?.rateLimit?.unified;
+  if (unified !== void 0 && unified.fiveHour === void 0 && unified.sevenDay === void 0) {
+    return "it reports no plan windows, so there is no five-hour window to anchor";
+  }
+  const five = unified?.fiveHour === void 0 ? void 0 : effectiveWindow(unified.fiveHour, nowMs);
+  if (five?.resetsAtMs !== void 0) {
+    return `a five-hour window is already open, resetting in ${formatAge(five.resetsAtMs - nowMs)}`;
+  }
+  const candidate = rankPool({ members: [{ identity, snapshot, records: [] }], nowMs, resuming: false }).candidates[0];
+  return candidate?.class === "ineligible" ? `it is refused right now (${candidate.reasons[0] ?? "no reason recorded"})` : void 0;
+}
+async function runWindowKeeper(ports) {
+  const nowMs = ports.nowMs();
+  const anchored = ports.anchored();
+  const previous = readStamps(ports.fs, ports.stampsFile);
+  const handled = Object.fromEntries(anchored.flatMap(({ identity }) => previous[identity] === void 0 ? [] : [[identity, previous[identity]]]));
+  const outcomes = [];
+  for (const { identity, anchors } of anchored) {
+    const last = handled[identity];
+    if (last === void 0) {
+      handled[identity] = nowMs;
+      outcomes.push({ identity, status: "armed", detail: "anchors noted; the next anchor to fall is the first acted on" });
+      continue;
+    }
+    const due2 = dueAnchor(anchors, nowMs, last, ports.timeZone);
+    if (due2 === void 0) {
+      outcomes.push({ identity, status: "waiting", detail: "no anchor has fallen since the last handled" });
+      continue;
+    }
+    handled[identity] = nowMs;
+    const reason = reasonNotToOpen(identity, ports.snapshot(identity), nowMs);
+    if (reason !== void 0) {
+      outcomes.push({ identity, status: "skipped", detail: `anchor ${new Date(due2).toISOString()}: ${reason}` });
+      continue;
+    }
+    try {
+      await ports.open(identity);
+      outcomes.push({ identity, status: "opened", detail: `anchor ${new Date(due2).toISOString()}: opened a five-hour window` });
+    } catch (error63) {
+      outcomes.push({ identity, status: "failed", detail: `anchor ${new Date(due2).toISOString()}: could not open a window: ${error63 instanceof Error ? error63.message : String(error63)}` });
+    }
+  }
+  writeStamps(ports.fs, ports.stampsFile, handled);
+  for (const outcome of outcomes) {
+    if (outcome.status === "opened" || outcome.status === "skipped" || outcome.status === "failed") {
+      ports.log(`window keeper: ${outcome.identity}: ${outcome.detail}`);
+    }
+  }
+  return outcomes;
+}
+
+// src/frontdoor/commands.ts
 init_realCredentialCache();
 
 // src/frontdoor/custody.ts
@@ -111752,7 +112080,7 @@ init_capability();
 
 // src/frontdoor/capture.ts
 var fs15 = __toESM(require("node:fs"), 1);
-var path37 = __toESM(require("node:path"), 1);
+var path38 = __toESM(require("node:path"), 1);
 var SECRET_HEADER_NAME = /authorization|cookie|token|secret|credential|api[-_]key/i;
 var SECRET_JSON_KEY = /token|secret|password|credential|authorization|api[-_]key/i;
 var SECRET_BODY_PATTERNS = [
@@ -111796,10 +112124,10 @@ function redactBody(chunk) {
 }
 var CAPTURE_ENV = "AGENT_SHIM_FRONTDOOR_CAPTURE";
 function captureFromEnv(env, logsDir) {
-  return env[CAPTURE_ENV] === "1" ? createFileCapture(path37.join(logsDir, "frontdoor-capture.jsonl")) : void 0;
+  return env[CAPTURE_ENV] === "1" ? createFileCapture(path38.join(logsDir, "frontdoor-capture.jsonl")) : void 0;
 }
 function createFileCapture(file2, now = () => /* @__PURE__ */ new Date()) {
-  fs15.mkdirSync(path37.dirname(file2), { recursive: true });
+  fs15.mkdirSync(path38.dirname(file2), { recursive: true });
   let nextId = 0;
   const append = (record2) => {
     fs15.appendFileSync(file2, `${JSON.stringify({ ts: now().toISOString(), ...record2 })}
@@ -111928,7 +112256,7 @@ var HIGH_BIT = 128;
 var BASE_128_PAYLOAD_MASK = 127;
 var FIRST_ARC_WEIGHT = 40;
 var SHORT_FORM_MAX_LENGTH = 127;
-var MS_PER_SECOND6 = 1e3;
+var MS_PER_SECOND7 = 1e3;
 var UTC_TIME_LAST_YEAR = 2049;
 var YEAR_DIGITS = 4;
 var TWO_DIGIT_YEAR_DIGITS = 2;
@@ -111987,7 +112315,7 @@ function wholeBitString(content) {
   return tlv(TAG_BIT_STRING, Buffer.concat([Buffer.from([0]), content]));
 }
 function time3(instant) {
-  const iso = new Date(Math.floor(instant.getTime() / MS_PER_SECOND6) * MS_PER_SECOND6).toISOString();
+  const iso = new Date(Math.floor(instant.getTime() / MS_PER_SECOND7) * MS_PER_SECOND7).toISOString();
   const compact = `${iso.replace(/[-:T]/g, "").slice(0, COMPACT_TIME_DIGITS)}Z`;
   if (instant.getUTCFullYear() > UTC_TIME_LAST_YEAR) {
     return tlv(TAG_GENERALIZED_TIME, Buffer.from(compact, "ascii"));
@@ -112218,19 +112546,19 @@ init_capability();
 init_route();
 
 // src/frontdoor/supervisor.ts
-var import_node_path38 = __toESM(require("node:path"), 1);
+var import_node_path39 = __toESM(require("node:path"), 1);
 init_state2();
 function watchedInstallEntry(resolvedOwnExecutablePath, siblingExists) {
-  const parsed = import_node_path38.default.parse(resolvedOwnExecutablePath);
+  const parsed = import_node_path39.default.parse(resolvedOwnExecutablePath);
   if (parsed.name === "agent-shim") {
     return resolvedOwnExecutablePath;
   }
-  const sibling = import_node_path38.default.join(parsed.dir, `agent-shim${parsed.ext}`);
+  const sibling = import_node_path39.default.join(parsed.dir, `agent-shim${parsed.ext}`);
   return siblingExists(sibling) ? sibling : resolvedOwnExecutablePath;
 }
 var FRONTDOOR_SUPERVISOR_STILL_RUNNING = -1;
 var FRONTDOOR_POLL_MS = 1e3;
-var MS_PER_MINUTE2 = 6e4;
+var MS_PER_MINUTE3 = 6e4;
 async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {}) {
   const { fs: fs22, paths } = ports;
   const servingBinary = ports.statOwnExecutable();
@@ -112296,16 +112624,27 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
   ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http8.port)}, CONNECT surface on 127.0.0.1:${String(connect3.port)}`);
   let idleSince;
   let ticks = 0;
+  const supersedingOwner = () => {
+    const owner = readFrontDoorState(fs22, paths.frontdoorStateFile)?.supervisorPid;
+    return owner !== void 0 && owner !== ports.ownPid && ports.isRunning(owner) ? owner : void 0;
+  };
+  let supersededBy;
+  let served;
   const binaryReplaced = () => {
     const current = ports.statOwnExecutable();
     return current !== void 0 && servingBinary !== void 0 && (current.dev !== servingBinary.dev || current.ino !== servingBinary.ino || current.size !== servingBinary.size || current.mtimeMs !== servingBinary.mtimeMs);
   };
-  const shutdown = async () => {
+  const closeServing = async () => {
     await direct.close();
     await connect3.close();
     await http8.close();
     ports.closeRcStreamHub();
-    writeFrontDoorState(fs22, paths.frontdoorStateFile, sticky());
+  };
+  const shutdown = async () => {
+    await closeServing();
+    if (supersedingOwner() === void 0) {
+      writeFrontDoorState(fs22, paths.frontdoorStateFile, sticky());
+    }
     return 0;
   };
   for (; ; ) {
@@ -112318,14 +112657,35 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     ports.observeLaunchRegistry(listed, pruned);
     ports.checkQuotaExpiry();
     const prunedPids = new Set(pruned);
-    if (listed.filter((session) => !prunedPids.has(session.pid)).length === 0) {
+    const live = listed.filter((session) => !prunedPids.has(session.pid));
+    if (supersededBy === void 0) {
+      supersededBy = supersedingOwner();
+      if (supersededBy !== void 0) {
+        ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: supervisor ${String(supersededBy)} now owns the front door; taking no new sessions and exiting once the sessions this door serves have ended`);
+        ports.doorHealth.superseded(supersededBy);
+        await ports.sleep(FRONTDOOR_POLL_MS);
+        continue;
+      }
+    } else {
+      const owner = supersededBy;
+      served = (served ?? live.filter((session) => session.pid !== ports.ownPid && session.pid !== owner && (session.supervisorPid === void 0 || session.supervisorPid === ports.ownPid))).filter((own2) => live.some((session) => session.pid === own2.pid && session.startedAt === own2.startedAt));
+      if (served.length === 0) {
+        ports.log("agent-shim frontdoor supervisor: the sessions this superseded door served have ended; closing the front door and exiting");
+        ports.doorHealth.drained();
+        await closeServing();
+        return 0;
+      }
+      await ports.sleep(FRONTDOOR_POLL_MS);
+      continue;
+    }
+    if (live.length === 0) {
       if (ticks > 1 && binaryReplaced()) {
         ports.log("agent-shim frontdoor supervisor: the installed binary changed and no sessions are live; turning the door over for the next launch");
         ports.doorHealth.binaryTurnover();
         return await shutdown();
       }
       idleSince ??= ports.now();
-      if (ports.now() - idleSince >= idleShutdownMinutes * MS_PER_MINUTE2) {
+      if (ports.now() - idleSince >= idleShutdownMinutes * MS_PER_MINUTE3) {
         ports.log(`agent-shim frontdoor supervisor: no sessions for ${String(idleShutdownMinutes)} minute(s); closing the front door and exiting`);
         ports.doorHealth.idleShutdown();
         return await shutdown();
@@ -112366,7 +112726,7 @@ var CONNECT_LIMITS = {
 var CA_VALIDITY_DAYS = 3650;
 var LEAF_VALIDITY_DAYS = 397;
 var CA_SUBJECT_COMMON_NAME = "agent-shim front door CA";
-var MS_PER_DAY2 = 864e5;
+var MS_PER_DAY3 = 864e5;
 function parseConnectTarget(authority) {
   const colon = authority.lastIndexOf(":");
   if (colon === -1) {
@@ -112380,8 +112740,8 @@ function parseConnectTarget(authority) {
   }
   return { host, port };
 }
-function servedByPipeline(path51) {
-  return path51?.startsWith(ROUTED_PATH_PREFIX) === true;
+function servedByPipeline(path52) {
+  return path52?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
   "connection",
@@ -112412,11 +112772,11 @@ function forwardableHeaders(headers) {
   return result;
 }
 function generateCa(now) {
-  return issueCaCertificate(CA_SUBJECT_COMMON_NAME, new Date(now.getTime() - MS_PER_DAY2), new Date(now.getTime() + CA_VALIDITY_DAYS * MS_PER_DAY2));
+  return issueCaCertificate(CA_SUBJECT_COMMON_NAME, new Date(now.getTime() - MS_PER_DAY3), new Date(now.getTime() + CA_VALIDITY_DAYS * MS_PER_DAY3));
 }
 var LOOPBACK_LEAF_NAMES = ["127.0.0.1", "localhost"];
 function mintLeaf(ca2, names, now) {
-  return issueLeafCertificate(ca2, names, new Date(now.getTime() - MS_PER_DAY2), new Date(now.getTime() + LEAF_VALIDITY_DAYS * MS_PER_DAY2));
+  return issueLeafCertificate(ca2, names, new Date(now.getTime() - MS_PER_DAY3), new Date(now.getTime() + LEAF_VALIDITY_DAYS * MS_PER_DAY3));
 }
 function createLeafCache(ca2, now) {
   const cache = /* @__PURE__ */ new Map();
@@ -112900,11 +113260,11 @@ function createRcSessionTracker(deps) {
   };
   const observeExchange = (request7) => {
     const method = (request7.method ?? "").toUpperCase();
-    const path51 = new URL(request7.url ?? "/", "http://127.0.0.1").pathname;
-    if (!path51.startsWith(RC_SESSIONS_PATH_PREFIX)) {
+    const path52 = new URL(request7.url ?? "/", "http://127.0.0.1").pathname;
+    if (!path52.startsWith(RC_SESSIONS_PATH_PREFIX)) {
       return void 0;
     }
-    const tail = path51.slice(RC_SESSIONS_PATH_PREFIX.length);
+    const tail = path52.slice(RC_SESSIONS_PATH_PREFIX.length);
     const facts = {
       oauthAuthorization: oauthAuthorizationOf(request7.headers),
       anthropicVersion: singleHeader(request7.headers, "anthropic-version"),
@@ -113265,8 +113625,8 @@ var RC_READ_FILE_ENCODINGS = ["utf-8", "base64"];
 function isRcReadFileEncoding(value2) {
   return RC_READ_FILE_ENCODINGS.some((encoding) => encoding === value2);
 }
-function buildRcReadFilePayload(requestId, path51, options) {
-  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path51, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
+function buildRcReadFilePayload(requestId, path52, options) {
+  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path52, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
 }
 function buildRcFileSuggestionsPayload(requestId, query) {
   return buildRcControlRequestPayload(requestId, { subtype: "file_suggestions", query });
@@ -113368,15 +113728,15 @@ async function getRcSessionContextUsage(deps, sessionId, detail) {
   const result = await deliverRcClientPayload(deps, sessionId, buildRcGetContextUsagePayload(requestId, detail), `request the context usage of session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
-async function readRcSessionFile(deps, sessionId, path51, options) {
-  if (path51 === "") {
+async function readRcSessionFile(deps, sessionId, path52, options) {
+  if (path52 === "") {
     return { ok: false, message: "a read-file write needs a non-empty path: the SDK's own field names the file the worker resolves against the session's cwd, and an empty string names none" };
   }
   if (options?.maxBytes !== void 0 && (!Number.isInteger(options.maxBytes) || options.maxBytes <= 0)) {
     return { ok: false, message: "a read-file write's max-bytes is a positive whole number of bytes: the SDK's own field caps the read, and a zero or negative cap reads nothing" };
   }
   const requestId = deps.newUuid();
-  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path51, options), `read ${path51} from session ${sessionId}`);
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path52, options), `read ${path52} from session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
 async function suggestRcSessionFiles(deps, sessionId, query) {
@@ -113547,11 +113907,11 @@ function createRcControlHandler(deps) {
       path: "read-file",
       read: (body) => {
         const session = bodyString(body, "session");
-        const path51 = bodyString(body, "path");
+        const path52 = bodyString(body, "path");
         const maxBytes = "maxBytes" in body ? bodyPositiveInteger(body, "maxBytes") : void 0;
         const encoding = "encoding" in body && isRcReadFileEncoding(body.encoding) ? body.encoding : void 0;
-        const refused2 = session === void 0 || path51 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
-        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path51, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
+        const refused2 = session === void 0 || path52 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
+        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path52, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
       }
     },
     {
@@ -113861,9 +114221,9 @@ function requestIdOfBody(body) {
 }
 function frontDoorRcControl(transport, token) {
   const headers = { authorization: `Bearer ${token}` };
-  const listAnswerOf = async (path51, what) => {
+  const listAnswerOf = async (path52, what) => {
     try {
-      return await transport.request({ method: "GET", path: path51, headers });
+      return await transport.request({ method: "GET", path: path52, headers });
     } catch (error63) {
       throw new Error(`${what}: could not reach the front door's control listener: ${error63 instanceof Error ? error63.message : String(error63)}`, { cause: error63 });
     }
@@ -113935,10 +114295,10 @@ function frontDoorRcControl(transport, token) {
     }
     return pending;
   };
-  const writeOf = async (path51, body, describeFailure) => {
+  const writeOf = async (path52, body, describeFailure) => {
     let answer;
     try {
-      answer = await transport.request({ method: "POST", path: path51, headers: { ...headers, "content-type": "application/json" }, body });
+      answer = await transport.request({ method: "POST", path: path52, headers: { ...headers, "content-type": "application/json" }, body });
     } catch (error63) {
       return { ok: false, message: `could not reach the front door's control listener: ${error63 instanceof Error ? error63.message : String(error63)}` };
     }
@@ -113969,10 +114329,10 @@ function frontDoorRcControl(transport, token) {
     endSession: async (sessionId, reason) => await writeOf(`${CONTROL_PATH_PREFIX}/end-session`, JSON.stringify({ session: sessionId, ...reason === void 0 ? {} : { reason } }), (status, message) => `ending ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getUsage: async (sessionId, skipBehaviors) => await writeOf(`${CONTROL_PATH_PREFIX}/get-usage`, JSON.stringify({ session: sessionId, ...skipBehaviors === void 0 ? {} : { skipBehaviors } }), (status, message) => `requesting the usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getContextUsage: async (sessionId, detail) => await writeOf(`${CONTROL_PATH_PREFIX}/get-context-usage`, JSON.stringify({ session: sessionId, ...detail === void 0 ? {} : { detail } }), (status, message) => `requesting the context usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
-    readFile: async (sessionId, path51, options) => await writeOf(
+    readFile: async (sessionId, path52, options) => await writeOf(
       `${CONTROL_PATH_PREFIX}/read-file`,
-      JSON.stringify({ session: sessionId, path: path51, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
-      (status, message) => `reading ${path51} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
+      JSON.stringify({ session: sessionId, path: path52, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
+      (status, message) => `reading ${path52} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
     ),
     fileSuggestions: async (sessionId, query) => await writeOf(`${CONTROL_PATH_PREFIX}/file-suggestions`, JSON.stringify({ session: sessionId, query }), (status, message) => `requesting file suggestions from ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     keepAlive: async (sessionId) => await writeOf(`${CONTROL_PATH_PREFIX}/keep-alive`, JSON.stringify({ session: sessionId }), (status, message) => `keeping ${sessionId} alive failed (HTTP ${String(status)}): ${message}`),
@@ -114266,12 +114626,12 @@ function tlsFacts(options) {
 }
 function realRcEventDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const post = async (path51, headers, body) => await new Promise((resolve2, reject) => {
+  const post = async (path52, headers, body) => await new Promise((resolve2, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method: "POST",
-      path: path51,
+      path: path52,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, "content-length": String(Buffer.byteLength(body, "utf8")) },
       agent
@@ -114336,12 +114696,12 @@ function lateRcStreamDial(resolve2) {
 }
 function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const request7 = async (method, path51, headers, body, signal) => await new Promise((resolve2, reject) => {
+  const request7 = async (method, path52, headers, body, signal) => await new Promise((resolve2, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method,
-      path: path51,
+      path: path52,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, ...body === void 0 ? {} : { "content-length": String(Buffer.byteLength(body, "utf8")) } },
       agent,
@@ -114383,9 +114743,9 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
       return { status, body: await readAll(response) };
     },
     openStream: async (sessionId, headers, resume, signal) => {
-      const path51 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
+      const path52 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
       const streamHeaders = resume === void 0 ? headers : { ...headers, "last-event-id": String(resume.fromSequenceNum) };
-      const { status, response } = await request7("GET", path51, streamHeaders, void 0, signal);
+      const { status, response } = await request7("GET", path52, streamHeaders, void 0, signal);
       if (!isSuccessful2(status)) {
         await readAll(response);
         return { status, chunks: NO_CHUNKS };
@@ -114601,10 +114961,10 @@ init_claudeShim();
 init_store();
 init_realPorts();
 var import_node_fs15 = __toESM(require("node:fs"), 1);
-var import_node_path40 = __toESM(require("node:path"), 1);
+var import_node_path41 = __toESM(require("node:path"), 1);
 
 // src/usage/signIn.ts
-var import_node_path39 = __toESM(require("node:path"), 1);
+var import_node_path40 = __toESM(require("node:path"), 1);
 var CREDENTIALS_FILE = ".credentials.json";
 function keychainHasItem(run, account) {
   return run.run("security", ["find-generic-password", "-a", account]).status === 0;
@@ -114622,7 +114982,7 @@ function decideSignIn(facts) {
   return { state: "signed-out", detail: facts.platform === "darwin" ? `no Keychain item and no ${CREDENTIALS_FILE}` : `no ${CREDENTIALS_FILE}` };
 }
 function credentialsFilePath(farmRoot) {
-  return import_node_path39.default.join(farmRoot, CREDENTIALS_FILE);
+  return import_node_path40.default.join(farmRoot, CREDENTIALS_FILE);
 }
 function identitySignIn(fs22, probe, identity) {
   const probing = !identity.hasCredentialBlock;
@@ -114641,7 +115001,55 @@ init_credential();
 init_credentialCache();
 init_realCredentialCache();
 init_source();
+
+// src/headroom/allowlistDrift.ts
+init_state();
+function diagnoseAllowlistDrift(params) {
+  const { recordedHash, providers, frontDoorOrigin: frontDoorOrigin2 } = params;
+  if (recordedHash === void 0 || recordedHash === hashAllowlist(headroomAllowlist(headroomUpstreams(providers, frontDoorOrigin2)))) {
+    return void 0;
+  }
+  const originIsInput = providers.length > 0 && frontDoorOrigin2 !== void 0;
+  if (!originIsInput) {
+    return ["provider-files"];
+  }
+  return recordedHash === hashAllowlist(headroomAllowlist(headroomUpstreams(providers, void 0))) ? ["front-door-origin"] : ["provider-files", "front-door-origin"];
+}
+
+// src/doctorReport.ts
 init_state();
+init_supervisor();
+init_state2();
+
+// src/doctorFrontDoor.ts
+function pushFrontDoor(push, supervisors, registeredPid) {
+  if (!supervisors.ok) {
+    push("frontdoor", "warn", `Could not list processes to look for duplicate front door supervisors: ${supervisors.message}.`);
+    return;
+  }
+  const { pids } = supervisors;
+  if (pids.length === 0) {
+    push("frontdoor", "pass", "No front door supervisor is running.");
+    return;
+  }
+  const [only, ...rest] = pids;
+  if (only !== void 0 && rest.length === 0) {
+    push("frontdoor", "pass", `One front door supervisor is running (pid ${String(only)}).`);
+    return;
+  }
+  const serving = registeredPid !== void 0 && pids.includes(registeredPid) ? `The front door state file names pid ${String(registeredPid)} as the serving supervisor.` : "The front door state file names no running supervisor.";
+  for (const pid of pids.filter((candidate) => candidate !== registeredPid)) {
+    push(
+      "frontdoor",
+      "fail",
+      `Front door supervisor pid ${String(pid)} is running beside ${String(pids.length - 1)} other(s). ${serving} Stop it with \`kill ${String(pid)}\`; launches still connected to it lose their door.`,
+      String(pid)
+    );
+  }
+}
+
+// src/doctorReport.ts
+init_supervisorProcesses();
 init_legacy();
 init_providersStore();
 init_guard();
@@ -114664,7 +115072,8 @@ var DOCTOR_SECTIONS = [
   "global-config",
   "categories-local",
   "active-identity",
-  "headroom"
+  "headroom",
+  "frontdoor"
 ];
 function refinePathShadow(status, ownExecutablePath, realpath) {
   if (status.status !== "shadowed") {
@@ -114699,7 +115108,7 @@ function tcpPortEraRecord(raw) {
   return (has("port") || has("lastPort")) && !has("socketPath");
 }
 function pushPathResolution(push, resolution) {
-  const ownDir = import_node_path40.default.dirname(resolution.ownExecutablePath);
+  const ownDir = import_node_path41.default.dirname(resolution.ownExecutablePath);
   switch (resolution.agentShim.status) {
     case "ok":
       push("path-resolution", "pass", `\`agent-shim\` on PATH resolves to this running executable, ${resolution.ownExecutablePath}.`, "agent-shim");
@@ -114798,14 +115207,14 @@ function pushProvider(push, entry, cacheEnv, signIn) {
 }
 function pushLegacyName(push, params) {
   const legacyVariables = Object.keys(params.env).filter((name) => name.startsWith(LEGACY_ENV_PREFIX) && params.env[name] !== void 0).sort();
-  if (legacyVariables.length === 0 && import_node_path40.default.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
+  if (legacyVariables.length === 0 && import_node_path41.default.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
     push("legacy-name", "pass", "Nothing here still uses the former `claude-use` name.");
     return;
   }
   for (const name of legacyVariables) {
     push("legacy-name", "warn", `${name} is the former name of ${name.replace(LEGACY_ENV_PREFIX, ENV_PREFIX)}. Rename it; the old name still works but is only a fallback.`, name);
   }
-  if (import_node_path40.default.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
+  if (import_node_path41.default.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
     push(
       "legacy-name",
       "warn",
@@ -115060,6 +115469,17 @@ function runDoctor(params) {
           `Headroom daemon is up on unix socket ${state.socketPath} (supervisor ${String(state.supervisorPid)}, daemon ${String(state.headroomPid)}).`
         );
       }
+      const allowlist = params.headroom.allowlist;
+      if (supervisorAlive && headroomAlive && state.socketPath !== void 0 && allowlist?.driftInputs?.includes("front-door-origin") === true) {
+        const origin = allowlist.frontDoorOrigin ?? "";
+        const certainty = allowlist.driftInputs.includes("provider-files") ? "may exclude" : "excludes";
+        push(
+          "headroom",
+          "fail",
+          `Headroom daemon ${String(state.headroomPid)} was started with an allowlist that ${certainty} the serving front door's direct origin ${origin}, so it refuses every request a provider launch sends back through the door. Its supervisor restarts it once no launch is registered against it; \`agent-shim headroom status\` lists the registered launches, and \`--no-headroom\` launches are unaffected.`,
+          String(state.headroomPid)
+        );
+      }
       if (state.lastError !== void 0 && supervisorAlive) {
         push("headroom", "warn", `Headroom recorded a previous error: ${state.lastError}`);
       }
@@ -115072,6 +115492,10 @@ function runDoctor(params) {
       }
     }
   }
+  if (params.frontDoor !== void 0) {
+    const validated2 = params.frontDoor.state.raw === void 0 ? void 0 : validateJson(FrontDoorStateSchema, params.frontDoor.state);
+    pushFrontDoor(push, params.frontDoor.supervisors, validated2?.ok === true ? validated2.data.supervisorPid : void 0);
+  }
   if (params.activeIdentity.raw === void 0) {
     push("active-identity", "pass", "No active identity set.");
   } else {
@@ -115101,6 +115525,7 @@ var SECTION_TITLES = {
   "directory-rules": "Directory rules",
   "global-config": "Global config",
   headroom: "Headroom daemon",
+  frontdoor: "Front door",
   "categories-local": "categories.local.json",
   "active-identity": "Active identity"
 };
@@ -115118,6 +115543,7 @@ var SECTION_ORDER = [
   "directory-rules",
   "global-config",
   "headroom",
+  "frontdoor",
   "categories-local",
   "active-identity"
 ];
@@ -115161,18 +115587,18 @@ function collectDoctorReport(params) {
   const { paths } = params;
   const identityNames = import_node_fs15.default.existsSync(paths.identitiesDir) ? import_node_fs15.default.readdirSync(paths.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && isIdentityDirectoryName(entry.name)).map((entry) => entry.name).sort() : [];
   const identities = identityNames.map((name) => {
-    const farmRoot = import_node_path40.default.join(paths.identitiesDir, name);
-    const identityPath = import_node_path40.default.join(farmRoot, "identity.json");
+    const farmRoot = import_node_path41.default.join(paths.identitiesDir, name);
+    const identityPath = import_node_path41.default.join(farmRoot, "identity.json");
     return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot, credentialsFilePresent: import_node_fs15.default.existsSync(credentialsFilePath(farmRoot)) };
   });
   const profileNames = import_node_fs15.default.existsSync(paths.configProfilesDir) ? import_node_fs15.default.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const configProfiles = profileNames.map((name) => {
-    const profilePath = import_node_path40.default.join(paths.configProfilesDir, `${name}.json`);
+    const profilePath = import_node_path41.default.join(paths.configProfilesDir, `${name}.json`);
     return { name, path: profilePath, raw: realFsPort.readFileUtf8(profilePath) };
   });
   const providerNames = import_node_fs15.default.existsSync(paths.providersDir) ? import_node_fs15.default.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const providers = providerNames.map((name) => {
-    const providerPath = import_node_path40.default.join(paths.providersDir, `${name}.json`);
+    const providerPath = import_node_path41.default.join(paths.providersDir, `${name}.json`);
     return { name, path: providerPath, raw: realFsPort.readFileUtf8(providerPath) };
   });
   const ownExecutablePath = realOwnExecutablePath();
@@ -115184,17 +115610,20 @@ function collectDoctorReport(params) {
     binaryDiscovery = { ok: false, message: error63 instanceof Error ? error63.message : String(error63) };
   }
   const shimState = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-  const pathDirs = (params.env.PATH ?? "").split(import_node_path40.default.delimiter).filter((dir) => dir !== "");
+  const pathDirs = (params.env.PATH ?? "").split(import_node_path41.default.delimiter).filter((dir) => dir !== "");
   const claudeShimShadow = shimState === void 0 ? void 0 : refinePathShadow(
     findPathShadow({
       pathDirs,
-      targetDir: import_node_path40.default.dirname(shimState.targetPath),
-      targetFilename: import_node_path40.default.basename(shimState.targetPath),
+      targetDir: import_node_path41.default.dirname(shimState.targetPath),
+      targetFilename: import_node_path41.default.basename(shimState.targetPath),
       findExecutableInDir
     }),
     shimState.targetPath,
     realpathOrSelf
   );
+  const uid = process.getuid?.();
+  const allowlistInputs = currentHeadroomAllowlistInputs(realFarmFs, paths);
+  const servingHeadroom = resolveServingHeadroomState(realFarmFs, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, realIsProcessRunning);
   const report = runDoctor({
     env: params.env,
     credentialCache: realCredentialCacheEnv(paths),
@@ -115215,7 +115644,7 @@ function collectDoctorReport(params) {
       agentShim: refinePathShadow(
         findPathShadow({
           pathDirs,
-          targetDir: import_node_path40.default.dirname(ownExecutablePath),
+          targetDir: import_node_path41.default.dirname(ownExecutablePath),
           targetFilename: commandFilename(ownExecutablePath, "agent-shim"),
           findExecutableInDir
         }),
@@ -115233,8 +115662,13 @@ function collectDoctorReport(params) {
         const statePath = resolved?.path ?? paths.headroomStateFile;
         return { path: statePath, raw: realFarmFs.readFileUtf8(statePath) };
       })(),
-      isRunning: realIsProcessRunning
-    }
+      isRunning: realIsProcessRunning,
+      allowlist: {
+        driftInputs: diagnoseAllowlistDrift({ recordedHash: servingHeadroom?.state.allowlistHash, ...allowlistInputs }),
+        frontDoorOrigin: allowlistInputs.frontDoorOrigin
+      }
+    },
+    ...uid === void 0 ? {} : { frontDoor: { state: { path: paths.frontdoorStateFile, raw: realFsPort.readFileUtf8(paths.frontdoorStateFile) }, supervisors: listFrontDoorSupervisors(realRunPort, uid) } }
   });
   return report;
 }
@@ -115473,11 +115907,11 @@ function tryOrUndefined(fn2) {
     return void 0;
   }
 }
-function pathToHttpPath(path51) {
-  return `/${path51.map(safeEncodeURIComponent).join("/")}`;
+function pathToHttpPath(path52) {
+  return `/${path52.map(safeEncodeURIComponent).join("/")}`;
 }
-function normalizeHttpPath(path51) {
-  const paths = path51.split("/");
+function normalizeHttpPath(path52) {
+  const paths = path52.split("/");
   if (paths.at(0) === "") {
     paths.shift();
   }
@@ -115662,9 +116096,9 @@ function isPlainObject2(value2) {
 function getOwn(object3, key) {
   return Object.hasOwn(object3, key) ? object3[key] : void 0;
 }
-function get(object3, path51) {
+function get(object3, path52) {
   let current = object3;
-  for (const key of path51) {
+  for (const key of path52) {
     if (!isTypescriptObject(current)) {
       return void 0;
     }
@@ -116887,7 +117321,7 @@ function resolveClientRest(rest) {
     // rest[1] can be undefined if all fields of FriendlyClientOptions are optional
   ];
 }
-function createORPCClient(link, { path: path51 = [], ...options } = {}) {
+function createORPCClient(link, { path: path52 = [], ...options } = {}) {
   const procedureClient = (...rest) => {
     const [input2, callOptions] = resolveClientRest(rest);
     const interceptors = [
@@ -116896,7 +117330,7 @@ function createORPCClient(link, { path: path51 = [], ...options } = {}) {
     ];
     return intercept(
       interceptors,
-      { ...callOptions, input: input2, path: path51 },
+      { ...callOptions, input: input2, path: path52 },
       ({ path: path210, input: input22, ...callOptions2 }) => link.call(path210, input22, callOptions2)
     );
   };
@@ -116910,7 +117344,7 @@ function createORPCClient(link, { path: path51 = [], ...options } = {}) {
       if (client === void 0) {
         client = createORPCClient(link, {
           ...options,
-          path: [...path51, key],
+          path: [...path52, key],
           scoped: options.scoped?.[key]
         });
         cache.set(key, client);
@@ -116932,24 +117366,24 @@ var BracketNotationSerializer = class {
     this.internalSerialize(data, "", true, result);
     return result;
   }
-  internalSerialize(data, path51, isRoot, result) {
+  internalSerialize(data, path52, isRoot, result) {
     if (Array.isArray(data)) {
       data.forEach((item, i10) => {
-        this.internalSerialize(item, isRoot ? i10.toString() : `${path51}[${i10}]`, false, result);
+        this.internalSerialize(item, isRoot ? i10.toString() : `${path52}[${i10}]`, false, result);
       });
     } else if (isPlainObject2(data)) {
       for (const key of Object.keys(data)) {
-        this.internalSerialize(data[key], isRoot ? key : `${path51}[${key}]`, false, result);
+        this.internalSerialize(data[key], isRoot ? key : `${path52}[${key}]`, false, result);
       }
     } else {
-      result.push([path51, data]);
+      result.push([path52, data]);
     }
   }
   deserialize(serialized) {
     const arrayPushStyles = /* @__PURE__ */ new WeakSet();
     const root = new NullProtoObj();
-    for (const [path51, value2] of serialized) {
-      const segments = this.parsePath(path51);
+    for (const [path52, value2] of serialized) {
+      const segments = this.parsePath(path52);
       let currentRef = root;
       let nextSegment = segments[0];
       for (let i10 = 1; i10 < segments.length; i10++) {
@@ -117000,13 +117434,13 @@ var BracketNotationSerializer = class {
     }
     return result;
   }
-  parsePath(path51) {
+  parsePath(path52) {
     const segments = [];
     let inBrackets = false;
     let currentSegment = "";
-    for (let i10 = 0; i10 < path51.length; i10++) {
-      const char = path51[i10];
-      const nextChar = path51[i10 + 1];
+    for (let i10 = 0; i10 < path52.length; i10++) {
+      const char = path52[i10];
+      const nextChar = path52[i10 + 1];
       if (inBrackets && char === "]" && (nextChar === void 0 || nextChar === "[")) {
         if (nextChar === void 0) {
           inBrackets = false;
@@ -117022,7 +117456,7 @@ var BracketNotationSerializer = class {
         currentSegment += char;
       }
     }
-    return inBrackets || segments.length === 0 ? [path51] : segments;
+    return inBrackets || segments.length === 0 ? [path52] : segments;
   }
 };
 var INTEGER_PATTERN = /^0$|^[1-9]\d*$/;
@@ -117595,11 +118029,11 @@ var OpenAPISerializer = class {
       return json2;
     }
     const form = new FormData();
-    for (const [path51, value22] of this.bracketNotation.serialize(json2)) {
+    for (const [path52, value22] of this.bracketNotation.serialize(json2)) {
       if (value22 instanceof Blob) {
-        form.append(path51, value22);
+        form.append(path52, value22);
       } else if (value22 !== void 0 && value22 !== null) {
-        form.append(path51, String(value22));
+        form.append(path52, String(value22));
       }
     }
     return form;
@@ -117637,30 +118071,30 @@ function isBodylessMethod(method) {
   return method === "GET" || method === "HEAD";
 }
 var PARAMETER_NAME_REGEX = /^[\w-]+$/;
-function getDynamicPathParams(path51) {
-  if (!path51.includes("{")) {
+function getDynamicPathParams(path52) {
+  if (!path52.includes("{")) {
     return void 0;
   }
-  const len = path51.length;
+  const len = path52.length;
   let params;
   let index = 1;
   while (index < len) {
     const segmentStart = index;
-    const slashPos = path51.indexOf("/", index);
+    const slashPos = path52.indexOf("/", index);
     const segmentEnd = slashPos === -1 ? len : slashPos;
-    if (segmentEnd > segmentStart && path51.charCodeAt(segmentStart) === 123 && path51.charCodeAt(segmentEnd - 1) === 125) {
+    if (segmentEnd > segmentStart && path52.charCodeAt(segmentStart) === 123 && path52.charCodeAt(segmentEnd - 1) === 125) {
       let parameterStart = segmentStart + 1;
       let allowsSlash = false;
-      const operator = path51.charCodeAt(parameterStart);
+      const operator = path52.charCodeAt(parameterStart);
       if (operator === 43) {
         allowsSlash = true;
         parameterStart++;
       }
-      const parameterName = path51.slice(parameterStart, segmentEnd - 1);
+      const parameterName = path52.slice(parameterStart, segmentEnd - 1);
       if (PARAMETER_NAME_REGEX.test(parameterName)) {
         params ??= [];
         params.push({
-          segment: path51.slice(segmentStart, segmentEnd),
+          segment: path52.slice(segmentStart, segmentEnd),
           startIndex: segmentStart,
           parameterName,
           allowsSlash
@@ -117703,8 +118137,8 @@ openapi.method = (method) => ({
   ...openapi({ method }),
   name: "~openapi/method"
 });
-openapi.path = (path51) => ({
-  ...openapi({ path: path51 }),
+openapi.path = (path52) => ({
+  ...openapi({ path: path52 }),
   name: "~openapi/path"
 });
 openapi.spec = (spec) => ({
@@ -118565,22 +118999,22 @@ function visitJsonSchemaRefs(value2, visit2, schemaLevel = true, seen = /* @__PU
     }
   }
 }
-function mapJsonSchemaRefs(value2, map2, schemaLevel = true, path51 = []) {
+function mapJsonSchemaRefs(value2, map2, schemaLevel = true, path52 = []) {
   if (!value2 || typeof value2 !== "object") {
     return value2;
   }
   if (Array.isArray(value2)) {
-    return value2.map((item, index) => mapJsonSchemaRefs(item, map2, schemaLevel, [...path51, index]));
+    return value2.map((item, index) => mapJsonSchemaRefs(item, map2, schemaLevel, [...path52, index]));
   }
   const result = {};
   for (const key of Object.keys(value2)) {
     const val = value2[key];
     if (key === "$ref" && typeof val === "string") {
-      setOwn(result, key, map2(val, [...path51, key]));
+      setOwn(result, key, map2(val, [...path52, key]));
     } else if (!schemaLevel) {
-      setOwn(result, key, mapJsonSchemaRefs(val, map2, true, [...path51, key]));
+      setOwn(result, key, mapJsonSchemaRefs(val, map2, true, [...path52, key]));
     } else if (JSON_SCHEMA_LOGIC_KEYWORDS.has(key) || JSON_SCHEMA_RECORD_KEYWORDS.has(key)) {
-      setOwn(result, key, mapJsonSchemaRefs(val, map2, !JSON_SCHEMA_RECORD_KEYWORDS.has(key), [...path51, key]));
+      setOwn(result, key, mapJsonSchemaRefs(val, map2, !JSON_SCHEMA_RECORD_KEYWORDS.has(key), [...path52, key]));
     } else {
       setOwn(result, key, val);
     }
@@ -119110,7 +119544,7 @@ function unlazy(maybeLazy) {
 function createProcedureClient(lazyableProcedure, ...rest) {
   const options = resolveMaybeOptionalOptions(rest);
   return async (...[input2, callerOptions]) => {
-    const path51 = toArray(options.path);
+    const path52 = toArray(options.path);
     const { default: procedure } = await unlazy(lazyableProcedure);
     const clientContext = callerOptions?.context ?? {};
     const context = await value(options.context, clientContext) ?? {};
@@ -119123,7 +119557,7 @@ function createProcedureClient(lazyableProcedure, ...rest) {
     };
     try {
       const output2 = await runWithSpan("call_procedure", (span) => {
-        span?.setAttribute("procedure.path", path51);
+        span?.setAttribute("procedure.path", path52);
         return intercept(
           options.interceptors,
           {
@@ -119131,7 +119565,7 @@ function createProcedureClient(lazyableProcedure, ...rest) {
             // input can be optional if it is undefinable
             input: input2,
             errors,
-            path: path51,
+            path: path52,
             procedure,
             signal: callerOptions?.signal,
             lastEventId: callerOptions?.lastEventId
@@ -119382,10 +119816,10 @@ function augmentRouter(router, options) {
   }
   return enhanced;
 }
-function getRouter(router, path51) {
+function getRouter(router, path52) {
   let current = router;
-  for (let i10 = 0; i10 < path51.length; i10++) {
-    const segment = path51[i10];
+  for (let i10 = 0; i10 < path52.length; i10++) {
+    const segment = path52[i10];
     if (!isTypescriptObject(current)) {
       return void 0;
     }
@@ -119397,7 +119831,7 @@ function getRouter(router, path51) {
       continue;
     }
     const lazied = current;
-    const rest = path51.slice(i10);
+    const rest = path52.slice(i10);
     return new Lazy({
       ...lazied["~orpc"],
       async loader() {
@@ -119412,40 +119846,40 @@ function getRouter(router, path51) {
   }
   return current;
 }
-function walkProcedureContractsSync(router, callback, path51 = []) {
+function walkProcedureContractsSync(router, callback, path52 = []) {
   const lazyResults = [];
-  walkProcedureContractsSyncInternal(router, callback, path51.slice(), lazyResults);
+  walkProcedureContractsSyncInternal(router, callback, path52.slice(), lazyResults);
   return lazyResults;
 }
-function walkProcedureContractsSyncInternal(router, callback, path51, lazyResults) {
+function walkProcedureContractsSyncInternal(router, callback, path52, lazyResults) {
   const hiddenContract = getHiddenRouterContract(router);
   if (hiddenContract !== void 0) {
     router = hiddenContract;
   }
   if (router instanceof ProcedureContract) {
-    callback(router, path51.slice());
+    callback(router, path52.slice());
     return;
   }
   if (!isTypescriptObject(router)) {
     return;
   }
   for (const [key, value2] of Object.entries(router)) {
-    path51.push(key);
+    path52.push(key);
     if (value2 instanceof Lazy) {
-      lazyResults.push({ router: value2, path: path51.slice() });
+      lazyResults.push({ router: value2, path: path52.slice() });
     } else {
-      walkProcedureContractsSyncInternal(value2, callback, path51, lazyResults);
+      walkProcedureContractsSyncInternal(value2, callback, path52, lazyResults);
     }
-    path51.pop();
+    path52.pop();
   }
 }
-async function walkProcedureContractsAsync(router, callback, path51 = []) {
+async function walkProcedureContractsAsync(router, callback, path52 = []) {
   const hiddenContract = getHiddenRouterContract(router);
   if (hiddenContract !== void 0) {
     router = hiddenContract;
   }
   if (router instanceof ProcedureContract) {
-    await callback(router, path51);
+    await callback(router, path52);
     return;
   }
   if (!isTypescriptObject(router)) {
@@ -119454,9 +119888,9 @@ async function walkProcedureContractsAsync(router, callback, path51 = []) {
   for (const [key, value2] of Object.entries(router)) {
     if (value2 instanceof Lazy) {
       const { default: router2 } = await unlazy(value2);
-      await walkProcedureContractsAsync(router2, callback, [...path51, key]);
+      await walkProcedureContractsAsync(router2, callback, [...path52, key]);
     } else {
-      await walkProcedureContractsAsync(value2, callback, [...path51, key]);
+      await walkProcedureContractsAsync(value2, callback, [...path52, key]);
     }
   }
 }
@@ -119942,18 +120376,18 @@ function rewriteComponentSchemaRefs(schema, renameMap) {
 }
 var OpenAPIGeneratorError = class extends TypeError {
 };
-function toOpenAPIPath(path51, dynamicPathParams) {
+function toOpenAPIPath(path52, dynamicPathParams) {
   if (!dynamicPathParams?.length) {
-    return path51;
+    return path52;
   }
   let normalized = "";
   let currentIndex = 0;
   for (const param of dynamicPathParams) {
-    normalized += path51.slice(currentIndex, param.startIndex);
+    normalized += path52.slice(currentIndex, param.startIndex);
     normalized += `{${param.parameterName}}`;
     currentIndex = param.startIndex + param.segment.length;
   }
-  normalized += path51.slice(currentIndex);
+  normalized += path52.slice(currentIndex);
   return normalized;
 }
 function buildRequest(ctx, operation, def, meta3, dynamicPathParams) {
@@ -120387,8 +120821,8 @@ var OpenAPIGenerator = class {
       customErrorResponseBodySchema: options.customErrorResponseBodySchema
     };
     const errors = [];
-    await walkProcedureContractsAsync(router, (contract, path51) => {
-      if (value(options.filter, contract, path51) === false) {
+    await walkProcedureContractsAsync(router, (contract, path52) => {
+      if (value(options.filter, contract, path52) === false) {
         return;
       }
       try {
@@ -120400,7 +120834,7 @@ var OpenAPIGenerator = class {
             `QUERY operations require OpenAPI 3.2, but version "${version2}" was requested.`
           );
         }
-        const postPath = meta3?.path ?? pathToHttpPath(path51);
+        const postPath = meta3?.path ?? pathToHttpPath(path52);
         const httpPath = meta3?.prefix ? mergeHttpPath(meta3.prefix, postPath) : postPath;
         const dynamicPathParams = getDynamicPathParams(httpPath);
         const openApiPath = toOpenAPIPath(httpPath, dynamicPathParams);
@@ -120409,7 +120843,7 @@ var OpenAPIGenerator = class {
           operation = meta3.spec;
         } else {
           operation = {
-            operationId: meta3?.operationId ?? path51.join("."),
+            operationId: meta3?.operationId ?? path52.join("."),
             summary: meta3?.summary,
             description: meta3?.description,
             deprecated: meta3?.deprecated,
@@ -120429,7 +120863,7 @@ var OpenAPIGenerator = class {
         if (!(e14 instanceof OpenAPIGeneratorError)) {
           throw e14;
         }
-        errors.push(`Procedure at ${path51.join(".") || "(root)"}: ${e14.message}`);
+        errors.push(`Procedure at ${path52.join(".") || "(root)"}: ${e14.message}`);
       }
     });
     if (errors.length) {
@@ -120737,7 +121171,7 @@ var ResetRowSchema = external_exports.strictObject({
 var ResetScheduleSchema = external_exports.strictObject({ resets: external_exports.readonly(external_exports.array(ResetRowSchema)) });
 
 // src/frontdoor/controlSchemas.ts
-var import_node_path41 = __toESM(require("node:path"), 1);
+var import_node_path42 = __toESM(require("node:path"), 1);
 init_zod();
 init_schema2();
 
@@ -120949,11 +121383,11 @@ var FrontDoorSessionsOutputSchema = external_exports.strictObject({ sessions: ex
 var CheckRunInputSchema = external_exports.strictObject({
   path: external_exports.string().min(1),
   identity: external_exports.string().min(1).optional()
-}).refine((input2) => import_node_path41.default.isAbsolute(input2.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+}).refine((input2) => import_node_path42.default.isAbsolute(input2.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
 var PoolPickInputSchema = external_exports.strictObject({
   pool: external_exports.string().min(1),
   path: external_exports.string().min(1)
-}).refine((input2) => import_node_path41.default.isAbsolute(input2.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+}).refine((input2) => import_node_path42.default.isAbsolute(input2.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
 var DoctorFindingSchema = external_exports.strictObject({
   section: external_exports.enum(DOCTOR_SECTIONS),
   subject: external_exports.string().optional(),
@@ -121274,16 +121708,16 @@ var StandardLink = class {
   /**
    * @throws ORPCError, transport-level errors (network failures, timeouts, etc.)
    */
-  call(path51, input2, options) {
-    return runWithSpan(`${ORPC_NAME}.${path51.join("/")}`, (span) => {
+  call(path52, input2, options) {
+    return runWithSpan(`${ORPC_NAME}.${path52.join("/")}`, (span) => {
       span?.setAttribute("rpc.system", ORPC_NAME);
-      span?.setAttribute("rpc.method", path51.join("."));
+      span?.setAttribute("rpc.method", path52.join("."));
       if (getTracer() && isAsyncIteratorObject(input2)) {
         input2 = override(input2, traceAsyncIterator("consume_async_iterator_object_input", input2));
       } else if (getTracer() && input2 instanceof ReadableStream) {
         input2 = override(input2, traceReadableStream("consume_octet_stream_input", input2));
       }
-      return intercept(this.interceptors, { ...options, path: path51, input: input2 }, async ({ path: path210, input: input22, ...options2 }) => {
+      return intercept(this.interceptors, { ...options, path: path52, input: input2 }, async ({ path: path210, input: input22, ...options2 }) => {
         const tracer = getTracer();
         const activeSpan = tracer?.getActiveSpan() ?? span;
         let request7 = await runWithSpan(
@@ -121340,18 +121774,18 @@ var RPCLinkCodec = class {
     this.headers = options.headers ?? {};
     this.serializer = options.serializer ?? new RPCSerializer();
   }
-  async encodeInput(input2, path51, options) {
-    let headers = toResolvedStandardHeaders(await value(this.headers, options, path51, input2));
+  async encodeInput(input2, path52, options) {
+    let headers = toResolvedStandardHeaders(await value(this.headers, options, path52, input2));
     if (options.lastEventId !== void 0) {
       headers = mergeStandardHeaders(headers, { "last-event-id": options.lastEventId });
     }
-    const expectedMethod = await value(this.expectedMethod, options, path51, input2);
-    const baseUrl = await value(this.baseUrl, options, path51, input2);
+    const expectedMethod = await value(this.expectedMethod, options, path52, input2);
+    const baseUrl = await value(this.baseUrl, options, path52, input2);
     const [pathname, search, hash2] = parseStandardUrl(baseUrl);
-    const newPathname = `${pathname.replace(END_SLASH_REGEX, "")}${pathToHttpPath(path51)}`;
+    const newPathname = `${pathname.replace(END_SLASH_REGEX, "")}${pathToHttpPath(path52)}`;
     const serialized = this.serializer.serialize(input2);
     if (expectedMethod === "GET" && !(serialized instanceof Blob) && !(serialized instanceof ReadableStream) && !(serialized instanceof FormData) && !isAsyncIteratorObject(serialized)) {
-      const maxUrlLength = await value(this.maxUrlLength, options, path51, input2);
+      const maxUrlLength = await value(this.maxUrlLength, options, path52, input2);
       const mergedSearch = new URLSearchParams(search);
       mergedSearch.append("data", stringifyJSON(serialized) ?? "");
       const url22 = `${newPathname}?${mergedSearch}${hash2 ?? ""}`;
@@ -121436,8 +121870,8 @@ var FetchLinkTransport = class {
     this.fetch = options.fetch ?? ((url2, init) => globalThis.fetch(url2, init));
     this.toFetchRequestOptions = options.toFetchRequest;
   }
-  async send(standardRequest, path51, options) {
-    let origin = await value(this.origin, options, path51);
+  async send(standardRequest, path52, options) {
+    let origin = await value(this.origin, options, path52);
     if (origin?.endsWith("/")) {
       origin = origin.slice(0, -1);
     }
@@ -121457,7 +121891,7 @@ var FetchLinkTransport = class {
       }
     }
     const fetch3 = this.fetch;
-    const response = await fetch3(url2, init, options, path51);
+    const response = await fetch3(url2, init, options, path52);
     const standardResponse = toStandardLazyResponse(response);
     return standardResponse;
   }
@@ -121848,14 +122282,14 @@ var StandardHandler = class {
           span?.setAttribute("url.path", request22.url);
           return { matched: false };
         }
-        const { path: path51, procedure, decodeInput } = matchedOrNot;
-        span?.updateName(`${ORPC_NAME}.${path51.join("/")}`);
+        const { path: path52, procedure, decodeInput } = matchedOrNot;
+        span?.updateName(`${ORPC_NAME}.${path52.join("/")}`);
         span?.setAttribute("rpc.system", ORPC_NAME);
-        span?.setAttribute("rpc.method", path51.join("."));
+        span?.setAttribute("rpc.method", path52.join("."));
         try {
           const response = await intercept(
             this.interceptors,
-            { context: context2, prefix: prefix2, request: request22, path: path51, procedure, decodeInput },
+            { context: context2, prefix: prefix2, request: request22, path: path52, procedure, decodeInput },
             async ({ context: context3, prefix: prefix3, request: request32, path: path210, procedure: procedure2, decodeInput: decodeInput2 }) => {
               step2 = "decode_input";
               let input2 = await runWithSpan("decode_input", decodeInput2);
@@ -121889,7 +122323,7 @@ var StandardHandler = class {
             message: `Malformed request. Ensure the request body is properly formatted and the 'Content-Type' header is set correctly.`,
             cause: e14
           }) : toORPCError(e14);
-          const response = await this.codec.encodeError(error63, procedure, path51, { context: context2, prefix: prefix2 });
+          const response = await this.codec.encodeError(error63, procedure, path52, { context: context2, prefix: prefix2 });
           return { matched: true, response };
         }
       }
@@ -121995,7 +122429,7 @@ var RPCMatcher = class {
     this.rootRouter = router;
     this.index(router);
   }
-  index(router, path51 = []) {
+  index(router, path52 = []) {
     const lazyResults = walkProcedureContractsSync(router, (procedure, procedurePath) => {
       if (!value(this.filter, procedure, procedurePath)) {
         return;
@@ -122006,7 +122440,7 @@ var RPCMatcher = class {
         // contract-first entries have no implementation yet, resolveProcedure fills it in on demand
         procedure: procedure instanceof Procedure ? procedure : void 0
       });
-    }, path51);
+    }, path52);
     for (const result of lazyResults) {
       this.pendingLazyRouters.set(pathToHttpPath(result.path), result);
     }
@@ -122138,10 +122572,10 @@ var RPCHandlerCodec = class {
       }
     };
   }
-  encodeOutput(output2, procedure, path51, options) {
+  encodeOutput(output2, procedure, path52, options) {
     return {
       headers: {},
-      status: value(this.outputStatus, output2, procedure, path51, options) ?? DEFAULT_SUCCESS_STATUS,
+      status: value(this.outputStatus, output2, procedure, path52, options) ?? DEFAULT_SUCCESS_STATUS,
       body: this.serializer.serialize(output2)
     };
   }
@@ -122195,39 +122629,39 @@ function createRouter() {
     static: new NullProtoObj2()
   };
 }
-function scanFirstGroup(path51) {
+function scanFirstGroup(path52) {
   let i10 = 0;
   let depth = 0;
-  for (; i10 < path51.length; i10++) {
-    const c10 = path51.charCodeAt(i10);
+  for (; i10 < path52.length; i10++) {
+    const c10 = path52.charCodeAt(i10);
     if (c10 === 92) i10++;
     else if (c10 === 40) depth++;
     else if (c10 === 41 && depth > 0) depth--;
     else if (c10 === 123 && depth === 0) break;
   }
-  if (i10 >= path51.length) return;
+  if (i10 >= path52.length) return;
   let j10 = i10 + 1;
   depth = 0;
-  for (; j10 < path51.length; j10++) {
-    const c10 = path51.charCodeAt(j10);
+  for (; j10 < path52.length; j10++) {
+    const c10 = path52.charCodeAt(j10);
     if (c10 === 92) j10++;
     else if (c10 === 40) depth++;
     else if (c10 === 41 && depth > 0) depth--;
     else if (c10 === 125 && depth === 0) break;
   }
-  if (j10 >= path51.length) return;
-  const mod = path51[j10 + 1];
+  if (j10 >= path52.length) return;
+  const mod = path52[j10 + 1];
   const hasMod = mod === "?" || mod === "+" || mod === "*";
   return [
-    path51.slice(0, i10),
-    path51.slice(i10 + 1, j10),
-    path51.slice(j10 + (hasMod ? 2 : 1)),
+    path52.slice(0, i10),
+    path52.slice(i10 + 1, j10),
+    path52.slice(j10 + (hasMod ? 2 : 1)),
     hasMod ? mod : void 0
   ];
 }
-function expandGroupDelimiters(path51) {
-  if (!path51.includes("{")) return;
-  const group = scanFirstGroup(path51);
+function expandGroupDelimiters(path52) {
+  if (!path52.includes("{")) return;
+  const group = scanFirstGroup(path52);
   if (!group) return;
   const [pre2, body, suf, mod] = group;
   if (!mod) return [pre2 + body + suf];
@@ -122297,9 +122731,9 @@ function replaceSegmentWildcards(segment, unnamedStart, toGroupKey = toUnnamedGr
   }
   return [replaced, nextIndex];
 }
-function encodeEscapes(path51) {
-  if (!path51.includes("\\")) return path51;
-  return path51.replace(/\\([:(){}])/g, (_, c10) => "\uFFFD" + "ABCDE"[":(){}".indexOf(c10)]);
+function encodeEscapes(path52) {
+  if (!path52.includes("\\")) return path52;
+  return path52.replace(/\\([:(){}])/g, (_, c10) => "\uFFFD" + "ABCDE"[":(){}".indexOf(c10)]);
 }
 function segmentKey(segment) {
   if (segment.startsWith("**")) return 2;
@@ -122328,22 +122762,22 @@ function expandModifiers(segments) {
     return m10[2] === "+" ? [wc2] : [wc2, without];
   }
 }
-function normalizePath(path51) {
-  if (!path51.includes("/.")) return path51;
+function normalizePath(path52) {
+  if (!path52.includes("/.")) return path52;
   const r10 = [];
-  for (const s of path51.split("/")) if (s === ".") continue;
+  for (const s of path52.split("/")) if (s === ".") continue;
   else if (s === ".." && r10.length > 1) r10.pop();
   else r10.push(s);
   return r10.join("/") || "/";
 }
-function splitPath(path51) {
-  const s = path51.split("/");
+function splitPath(path52) {
+  const s = path52.split("/");
   s.shift();
   if (s[s.length - 1] === "") s.pop();
   return s;
 }
-function splitRoute(path51) {
-  const s = splitPath(path51);
+function splitRoute(path52) {
+  const s = splitPath(path52);
   while (s[s.length - 1] === "") s.pop();
   return s;
 }
@@ -122359,16 +122793,16 @@ function getMatchParams(segments, paramsMap) {
   }
   return params;
 }
-function addRoute(ctx, method = "", path51, data) {
+function addRoute(ctx, method = "", path52, data) {
   method = method.toUpperCase();
-  if (path51.charCodeAt(0) !== 47) path51 = `/${path51}`;
-  const groupExpanded = expandGroupDelimiters(path51);
+  if (path52.charCodeAt(0) !== 47) path52 = `/${path52}`;
+  const groupExpanded = expandGroupDelimiters(path52);
   if (groupExpanded) {
     for (const expandedPath of groupExpanded) addRoute(ctx, method, expandedPath, data);
     return;
   }
-  path51 = encodeEscapes(path51);
-  const segments = splitRoute(path51);
+  path52 = encodeEscapes(path52);
+  const segments = splitRoute(path52);
   const expanded = expandModifiers(segments);
   if (expanded) {
     for (const p of expanded) addRoute(ctx, method, p, data);
@@ -122459,15 +122893,15 @@ function getParamRegexp(segment, unnamedStart = 0) {
   const regex = _s2.replace(/:([\w-]+)(?:\(([^)]*)\))?/g, (_, id2, p) => `(?<${toGroupName(id2)}>${p || "[^/]+"})`).replace(/\((?![?<])/g, () => `(?<${toUnnamedGroupKey(_i2++)}>`).replace(/\uFFFE(.)/g, (_, c10) => /[.*+?^${}()|[\]\\]/.test(c10) ? `\\${c10}` : c10);
   return [new RegExp(`^${regex}$`), _i2];
 }
-function findRoute(ctx, method = "", path51, opts) {
-  if (opts?.normalize) path51 = normalizePath(path51);
-  if (path51.charCodeAt(path51.length - 1) === 47) path51 = path51.slice(0, -1);
-  const staticNode = ctx.static[path51];
+function findRoute(ctx, method = "", path52, opts) {
+  if (opts?.normalize) path52 = normalizePath(path52);
+  if (path52.charCodeAt(path52.length - 1) === 47) path52 = path52.slice(0, -1);
+  const staticNode = ctx.static[path52];
   if (staticNode && staticNode.methods) {
     const staticMatch = staticNode.methods[method] || staticNode.methods[""];
     if (staticMatch !== void 0) return staticMatch[0];
   }
-  const segments = splitPath(path51);
+  const segments = splitPath(path52);
   const match = _lookupTree(ctx.root, method, segments, 0);
   if (match === void 0) return;
   if (opts?.params === false) return match;
@@ -122667,7 +123101,7 @@ var OpenAPIMatcher = class {
     this.rootRouter = router;
     this.index(router);
   }
-  index(router, path51 = []) {
+  index(router, path52 = []) {
     const lazyResults = walkProcedureContractsSync(router, (contract, path210) => {
       if (!value(this.filter, contract, path210)) {
         return;
@@ -122682,7 +123116,7 @@ var OpenAPIMatcher = class {
         contract,
         procedure: contract instanceof Procedure ? contract : void 0
       });
-    }, path51);
+    }, path52);
     for (const result of lazyResults) {
       const prefix = getOpenAPIMeta(result.router)?.prefix;
       this.pendingLazyRouters.add({
@@ -122769,20 +123203,20 @@ var OpenAPIMatcher = class {
     return entry.procedure;
   }
 };
-function toRou3Pattern(path51) {
-  const params = getDynamicPathParams(path51);
+function toRou3Pattern(path52) {
+  const params = getDynamicPathParams(path52);
   if (!params?.length) {
-    return path51;
+    return path52;
   }
   for (let i10 = params.length - 1; i10 >= 0; i10--) {
     const param = params[i10];
     const pattern = param.allowsSlash ? `**:${param.parameterName}` : `:${param.parameterName}`;
-    path51 = path51.slice(0, param.startIndex) + pattern + path51.slice(param.startIndex + param.segment.length);
+    path52 = path52.slice(0, param.startIndex) + pattern + path52.slice(param.startIndex + param.segment.length);
   }
-  return path51;
+  return path52;
 }
-function toRou3PrefixMatcher(path51) {
-  const pattern = toRou3Pattern(path51);
+function toRou3PrefixMatcher(path52) {
+  const pattern = toRou3Pattern(path52);
   return routeToRegExp(pattern === "/" ? "/**" : `${pattern}/**`);
 }
 function decodeParams(params) {
@@ -122861,7 +123295,7 @@ var OpenAPIHandlerCodecCore = class {
   /**
    * @throws {TypeError} If `outputStructure` is "detailed" and the output doesn't match the expected structure.
    */
-  encodeOutput(output2, procedure, path51) {
+  encodeOutput(output2, procedure, path52) {
     const meta3 = getOpenAPIMeta(procedure);
     const successStatus = meta3?.successStatus ?? DEFAULT_SUCCESS_STATUS;
     const outputStructure = meta3?.outputStructure ?? DEFAULT_OPENAPI_OUTPUT_STRUCTURE;
@@ -122874,7 +123308,7 @@ var OpenAPIHandlerCodecCore = class {
     }
     if (!isValidDetailedOutput(output2)) {
       throw new TypeError(`
-        Invalid "detailed" output structure returned by procedure (${path51.join(".")}):
+        Invalid "detailed" output structure returned by procedure (${path52.join(".")}):
         \u2022 Expected an object with optional properties:
           - status (number <400)
           - headers (object)
@@ -123262,7 +123696,8 @@ var IdentityValueSchema = external_exports.strictObject({
   name: external_exports.string(),
   defaultConfigProfile: external_exports.string().optional(),
   allowAmbientCredential: external_exports.boolean(),
-  credential: CredentialSummarySchema2.optional()
+  credential: CredentialSummarySchema2.optional(),
+  anchors: external_exports.array(AnchorSchema).optional()
 });
 var ProfileValueSchema = ConfigProfileSchema.omit({ $schema: true });
 var ProviderValueSchema = external_exports.strictObject({
@@ -123280,7 +123715,9 @@ var ConfigIdentitySetInputSchema = external_exports.strictObject({
   name: external_exports.string().min(1),
   defaultConfigProfile: external_exports.union([external_exports.string().min(1), external_exports.literal(false)]).optional(),
   allowAmbientCredential: external_exports.boolean().optional(),
-  credential: external_exports.union([external_exports.literal(false), CredentialWriteSchema(CREDENTIAL_TARGETS)]).optional()
+  credential: external_exports.union([external_exports.literal(false), CredentialWriteSchema(CREDENTIAL_TARGETS)]).optional(),
+  /** `false` removes the anchors; a list replaces them. */
+  anchors: external_exports.union([external_exports.literal(false), external_exports.array(AnchorSchema).min(1)]).optional()
 });
 var ConfigIdentitySetOutputSchema = storedMutationOutput("identity", "updated", IdentityValueSchema);
 var ConfigIdentityRemoveInputSchema = external_exports.strictObject({ name: external_exports.string().min(1), confirm: RemovalConfirmationSchema });
@@ -123401,7 +123838,8 @@ function identityValue(name, paths) {
     name: identity.name,
     ...identity.defaultConfigProfile === void 0 ? {} : { defaultConfigProfile: identity.defaultConfigProfile },
     allowAmbientCredential: identity.allowAmbientCredential,
-    ...identity.credential === void 0 ? {} : { credential: summariseCredential(identity.credential) }
+    ...identity.credential === void 0 ? {} : { credential: summariseCredential(identity.credential) },
+    ...identity.anchors === void 0 ? {} : { anchors: identity.anchors }
   };
 }
 function providerValue(name, provider) {
@@ -123422,7 +123860,7 @@ function profileValue(name, paths) {
 function createConfigApiRouter(deps) {
   const authed = doorApiAuth(deps.expectedToken);
   const { paths } = deps;
-  const route = (path51, summary) => authed.meta(openapi({ method: "POST", path: path51, summary, tags: [CONFIG_API_TAG] }));
+  const route = (path52, summary) => authed.meta(openapi({ method: "POST", path: path52, summary, tags: [CONFIG_API_TAG] }));
   return {
     config: {
       identity: {
@@ -123432,9 +123870,9 @@ function createConfigApiRouter(deps) {
             return { action: "created", kind: "identity", name: input2.name, value: identityValue(input2.name, paths) };
           })
         ),
-        set: route("/rest/config/identity/set", "Update an identity's default profile, ambient-credential setting or credential").input(ConfigIdentitySetInputSchema).output(ConfigIdentitySetOutputSchema).handler(
+        set: route("/rest/config/identity/set", "Update an identity's default profile, ambient-credential setting, credential or anchors").input(ConfigIdentitySetInputSchema).output(ConfigIdentitySetOutputSchema).handler(
           ({ input: input2 }) => guarded(() => {
-            requireChange(input2.defaultConfigProfile !== void 0 || input2.allowAmbientCredential !== void 0 || input2.credential !== void 0, "defaultConfigProfile, allowAmbientCredential or credential");
+            requireChange(input2.defaultConfigProfile !== void 0 || input2.allowAmbientCredential !== void 0 || input2.credential !== void 0 || input2.anchors !== void 0, "defaultConfigProfile, allowAmbientCredential, credential or anchors");
             if (!identityExists(paths, input2.name)) {
               throw new IdentityNotFoundError(input2.name);
             }
@@ -123459,6 +123897,9 @@ function createConfigApiRouter(deps) {
               };
               setIdentityCredential(paths, input2.name, change);
             }
+            if (input2.anchors !== void 0) {
+              setIdentityAnchors(paths, input2.name, input2.anchors === false ? void 0 : input2.anchors);
+            }
             return { action: "updated", kind: "identity", name: input2.name, value: identityValue(input2.name, paths) };
           })
         ),
@@ -123684,7 +124125,9 @@ var DoorHealthEventSchema = external_exports.discriminatedUnion("kind", [
   external_exports.strictObject({ kind: external_exports.literal("generation"), pid: external_exports.number().int().positive(), providerPort: external_exports.number().int().positive(), connectPort: external_exports.number().int().positive(), directPort: external_exports.number().int().positive(), observedAt: external_exports.number() }),
   external_exports.strictObject({ kind: external_exports.literal("listenerFailed"), pid: external_exports.number().int().positive(), listener: external_exports.enum(["provider", "connect", "direct"]), message: external_exports.string(), observedAt: external_exports.number() }),
   external_exports.strictObject({ kind: external_exports.literal("binaryTurnover"), pid: external_exports.number().int().positive(), observedAt: external_exports.number() }),
-  external_exports.strictObject({ kind: external_exports.literal("idleShutdown"), pid: external_exports.number().int().positive(), observedAt: external_exports.number() })
+  external_exports.strictObject({ kind: external_exports.literal("idleShutdown"), pid: external_exports.number().int().positive(), observedAt: external_exports.number() }),
+  external_exports.strictObject({ kind: external_exports.literal("superseded"), pid: external_exports.number().int().positive(), ownerPid: external_exports.number().int().positive(), observedAt: external_exports.number() }),
+  external_exports.strictObject({ kind: external_exports.literal("drained"), pid: external_exports.number().int().positive(), observedAt: external_exports.number() })
 ]);
 var QuotaExpiringEventSchema = external_exports.strictObject({
   identity: external_exports.string().min(1),
@@ -123772,7 +124215,7 @@ function createLifecycleApiRouter(deps) {
 init_cliError();
 
 // src/frontdoor/launchSchemas.ts
-var import_node_path42 = __toESM(require("node:path"), 1);
+var import_node_path43 = __toESM(require("node:path"), 1);
 init_zod();
 init_claudeVersion();
 init_identity();
@@ -123782,7 +124225,7 @@ var LaunchResolveInputSchema = external_exports.strictObject({
   argv: external_exports.readonly(external_exports.array(external_exports.string())).optional(),
   /** The launch's inherited environment. Absent means an empty one: the door's own environment is never a substitute for the caller's, so a caller that wants `AGENT_SHIM_*` switches or a `CLAUDE_CONFIG_DIR` considered names them here. Values are read, never reported. */
   env: external_exports.record(external_exports.string(), external_exports.string()).optional()
-}).refine((input2) => import_node_path42.default.isAbsolute(input2.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+}).refine((input2) => import_node_path43.default.isAbsolute(input2.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
 var LaunchPoolDecisionSchema = external_exports.strictObject({
   name: external_exports.string(),
   reasons: external_exports.readonly(external_exports.array(external_exports.string())),
@@ -123939,6 +124382,12 @@ function createDoorHealthPublisher(hub, now, pid) {
     },
     binaryTurnover: () => {
       publisher.publish({ kind: "binaryTurnover", pid, observedAt: now() });
+    },
+    superseded: (ownerPid) => {
+      publisher.publish({ kind: "superseded", pid, ownerPid, observedAt: now() });
+    },
+    drained: () => {
+      publisher.publish({ kind: "drained", pid, observedAt: now() });
     }
   };
 }
@@ -124052,11 +124501,11 @@ function rcFanoutOnDoorHub(fanout, hub) {
 // src/frontdoor/quotaExpiringEvents.ts
 init_schema2();
 var MS_PER_HOUR4 = 36e5;
-var MS_PER_DAY3 = 864e5;
+var MS_PER_DAY4 = 864e5;
 var FIVE_HOUR_WINDOW_HOURS = 5;
 var SEVEN_DAY_WINDOW_DAYS = 7;
 var FIVE_HOUR_WINDOW_MS2 = FIVE_HOUR_WINDOW_HOURS * MS_PER_HOUR4;
-var SEVEN_DAY_WINDOW_MS2 = SEVEN_DAY_WINDOW_DAYS * MS_PER_DAY3;
+var SEVEN_DAY_WINDOW_MS2 = SEVEN_DAY_WINDOW_DAYS * MS_PER_DAY4;
 var FINAL_SPAN_DENOMINATOR = 30;
 var QUOTA_EXPIRING_WINDOW_FRACTION = 1 / FINAL_SPAN_DENOMINATOR;
 function createQuotaExpiringPublisher(hub, deps) {
@@ -124854,17 +125303,17 @@ function unifiedQuotaHeaders(upstream, rejected, quotaError) {
   }
   return headers;
 }
-var MS_PER_SECOND7 = 1e3;
+var MS_PER_SECOND8 = 1e3;
 function buildUsageSnapshot(upstream, quotaError, nowMs) {
   const used7 = upstream.get("x-codex-primary-used-percent") ?? (quotaError === void 0 ? null : EXHAUSTED_PERCENT);
   const reset7 = upstream.get("x-codex-primary-reset-at") ?? (quotaError?.resets_at === void 0 ? null : String(quotaError.resets_at));
-  const sevenDay = used7 !== null && reset7 !== null ? { used_percentage: Number(used7), resets_at: new Date(Number(reset7) * MS_PER_SECOND7).toISOString() } : void 0;
+  const sevenDay = used7 !== null && reset7 !== null ? { used_percentage: Number(used7), resets_at: new Date(Number(reset7) * MS_PER_SECOND8).toISOString() } : void 0;
   let fiveHour;
   if (Number(upstream.get("x-codex-secondary-window-minutes")) > 0) {
     const used5 = upstream.get("x-codex-secondary-used-percent");
     const reset5 = upstream.get("x-codex-secondary-reset-at");
     if (used5 !== null && reset5 !== null) {
-      fiveHour = { used_percentage: Number(used5), resets_at: new Date(Number(reset5) * MS_PER_SECOND7).toISOString() };
+      fiveHour = { used_percentage: Number(used5), resets_at: new Date(Number(reset5) * MS_PER_SECOND8).toISOString() };
     }
   }
   if (sevenDay === void 0 && fiveHour === void 0) {
@@ -125273,8 +125722,8 @@ function createCodexRouteMount(ports, upstreamBase, provider) {
         request7.body.resume();
         return;
       }
-      const path51 = new URL(request7.url, "http://127.0.0.1").pathname;
-      const translated = { method: request7.method, path: path51, body, signal: request7.signal };
+      const path52 = new URL(request7.url, "http://127.0.0.1").pathname;
+      const translated = { method: request7.method, path: path52, body, signal: request7.signal };
       const routed = await route(translated);
       if (request7.signal.aborted) {
         return;
@@ -125308,7 +125757,7 @@ function createPassthroughRoute(name, target) {
     headroomUpstream: target.headroomUpstream,
     serve: async (request7, response) => {
       const incoming = new URL(request7.url, "http://127.0.0.1");
-      const path51 = target.stripPrefix !== void 0 && incoming.pathname.startsWith(target.stripPrefix) ? incoming.pathname.slice(target.stripPrefix.length) : incoming.pathname;
+      const path52 = target.stripPrefix !== void 0 && incoming.pathname.startsWith(target.stripPrefix) ? incoming.pathname.slice(target.stripPrefix.length) : incoming.pathname;
       const headers = forwardableHeaders(request7.headers);
       delete headers.host;
       await new Promise((resolve2) => {
@@ -125316,7 +125765,7 @@ function createPassthroughRoute(name, target) {
           host: base.hostname,
           port: base.port === "" ? void 0 : Number(base.port),
           method: request7.method,
-          path: `${basePath}${path51}${incoming.search}`,
+          path: `${basePath}${path52}${incoming.search}`,
           headers,
           agent
         };
@@ -125449,7 +125898,7 @@ async function scanRequestHead(request7, wholeBody = false) {
 
 // src/frontdoor/providerRoute.ts
 function createProviderRouteResolver(deps) {
-  const isRcSelfHostPath = (path51) => path51 === "/v1/code/sessions" || path51.startsWith("/v1/code/sessions/") || path51 === "/v1/sessions" || path51.startsWith("/v1/sessions/");
+  const isRcSelfHostPath = (path52) => path52 === "/v1/code/sessions" || path52.startsWith("/v1/code/sessions/") || path52 === "/v1/sessions" || path52.startsWith("/v1/sessions/");
   const oauthRoute = createPassthroughRoute("anthropic", { baseUrl: `https://${CONNECT_INTERCEPT_HOST}:${String(HTTPS_PORT)}`, stripPrefix: void 0, headroomUpstream: void 0 });
   const passthroughByTarget = /* @__PURE__ */ new Map();
   const passthroughFor = (name, target) => {
@@ -125463,16 +125912,16 @@ function createProviderRouteResolver(deps) {
     return route;
   };
   const resolve2 = (request7) => {
-    const path51 = new URL(request7.url, "http://127.0.0.1").pathname;
-    const scoped = parseProviderPath(path51);
+    const path52 = new URL(request7.url, "http://127.0.0.1").pathname;
+    const scoped = parseProviderPath(path52);
     if (scoped === void 0) {
-      if (deps.rcSelfHostRoute !== void 0 && isRcSelfHostPath(path51)) {
+      if (deps.rcSelfHostRoute !== void 0 && isRcSelfHostPath(path52)) {
         return { ok: true, route: deps.rcSelfHostRoute };
       }
-      if (request7.session.provider !== void 0 && path51.startsWith("/v1/") && !isRcSelfHostPath(path51)) {
+      if (request7.session.provider !== void 0 && path52.startsWith("/v1/") && !isRcSelfHostPath(path52)) {
         return resolve2({ ...request7, url: `${PROVIDER_PATH_PREFIX}${encodeURIComponent(request7.session.provider)}${request7.url}` });
       }
-      return path51.startsWith("/v1/") ? { ok: true, route: oauthRoute } : { ok: false, status: HTTP_STATUS.notFound, message: `no such endpoint: ${path51}` };
+      return path52.startsWith("/v1/") ? { ok: true, route: oauthRoute } : { ok: false, status: HTTP_STATUS.notFound, message: `no such endpoint: ${path52}` };
     }
     const { provider } = scoped;
     let definition;
@@ -125525,8 +125974,8 @@ function createProviderRouteResolver(deps) {
     let replay;
     const visited = /* @__PURE__ */ new Set();
     for (; ; ) {
-      const path51 = new URL(current.url, "http://127.0.0.1").pathname;
-      const scoped = parseProviderPath(path51);
+      const path52 = new URL(current.url, "http://127.0.0.1").pathname;
+      const scoped = parseProviderPath(path52);
       const providerName = scoped?.provider ?? current.session.provider;
       if (providerName !== void 0 && visited.has(providerName)) {
         return { ok: false, status: HTTP_STATUS.internalServerError, message: `provider routing cycle: ${[...visited, providerName].join(" -> ")}` };
@@ -125584,7 +126033,7 @@ function createProviderRouteResolver(deps) {
         const headers = Object.fromEntries(Object.entries(replay.headers).filter(([name]) => name.toLowerCase() !== "content-length"));
         replay = { ...replay, headers, body: import_node_stream3.Readable.from([Buffer.from(rewritten, "utf8")]) };
       }
-      const rest = scoped === void 0 ? path51 : path51.slice(`${PROVIDER_PATH_PREFIX}${encodeURIComponent(scoped.provider)}`.length);
+      const rest = scoped === void 0 ? path52 : path52.slice(`${PROVIDER_PATH_PREFIX}${encodeURIComponent(scoped.provider)}`.length);
       const query = current.url.includes("?") ? current.url.slice(current.url.indexOf("?")) : "";
       current = { ...current, url: `${PROVIDER_PATH_PREFIX}${encodeURIComponent(matched.provider)}${rest}${query}`, body: replay.body, headers: replay.headers };
     }
@@ -125691,14 +126140,14 @@ function createRcLiveUsage(deps) {
 }
 
 // src/frontdoor/rcSelfHostMint.ts
-var import_node_path43 = __toESM(require("node:path"), 1);
+var import_node_path44 = __toESM(require("node:path"), 1);
 init_account();
 
 // src/frontdoor/rcSelfHostLocal.ts
 var RC_SELF_HOST_OAUTH_HOST = "platform.claude.com";
 var RC_SELF_HOST_SCOPE_LIST = ["user:profile", "user:inference", "user:sessions:claude_code", "user:mcp_servers", "user:file_upload"];
 var RC_SELF_HOST_OAUTH_TOKEN_TTL_SECONDS = 3600;
-var MS_PER_SECOND8 = 1e3;
+var MS_PER_SECOND9 = 1e3;
 var HTTP_SERVICE_UNAVAILABLE = 503;
 function isRecord6(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
@@ -125754,7 +126203,7 @@ function createRcSelfHostLocal(deps) {
       }
       if (method === "POST" && pathname.startsWith("/api/eval/")) {
         await deps.readBody(request7, CONTROL_BODY_CAP_BYTES);
-        answerServerJson(response, HTTP_STATUS.ok, { features: growthBookFeatures(), dateUpdated: Math.floor(deps.now() / MS_PER_SECOND8) });
+        answerServerJson(response, HTTP_STATUS.ok, { features: growthBookFeatures(), dateUpdated: Math.floor(deps.now() / MS_PER_SECOND9) });
         return true;
       }
       if (method === "GET" && pathname === "/api/oauth/profile") {
@@ -125821,7 +126270,7 @@ function readJsonObject(fs22, file2) {
   return isRecord7(parsed) ? parsed : void 0;
 }
 function readRcSelfHostRecord(fs22, frontdoorDir) {
-  const parsed = readJsonObject(fs22, import_node_path43.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
+  const parsed = readJsonObject(fs22, import_node_path44.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
   if (parsed === void 0) {
     return void 0;
   }
@@ -125835,11 +126284,11 @@ function mintRcSelfHostCredential(deps) {
   if (!isIdentityName(deps.identity)) {
     throw new Error(`"${deps.identity}" is not a valid identity name.`);
   }
-  const identityDir = import_node_path43.default.join(deps.identitiesDir, deps.identity);
-  const credentialsFile = import_node_path43.default.join(identityDir, CREDENTIALS_FILE2);
-  const claudeJsonFile = import_node_path43.default.join(identityDir, CLAUDE_JSON2);
-  const recordDir = import_node_path43.default.join(deps.frontdoorDir, RC_SELF_HOST_RECORD_DIR);
-  const recordFile = import_node_path43.default.join(recordDir, RC_SELF_HOST_RECORD_FILE);
+  const identityDir = import_node_path44.default.join(deps.identitiesDir, deps.identity);
+  const credentialsFile = import_node_path44.default.join(identityDir, CREDENTIALS_FILE2);
+  const claudeJsonFile = import_node_path44.default.join(identityDir, CLAUDE_JSON2);
+  const recordDir = import_node_path44.default.join(deps.frontdoorDir, RC_SELF_HOST_RECORD_DIR);
+  const recordFile = import_node_path44.default.join(recordDir, RC_SELF_HOST_RECORD_FILE);
   const previousRecord = readRcSelfHostRecord(deps.fs, deps.frontdoorDir);
   const existingCredentials = readJsonObject(deps.fs, credentialsFile);
   const existingOauth = isRecord7(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
@@ -125855,7 +126304,7 @@ function mintRcSelfHostCredential(deps) {
   const organizationUuid = deps.newUuid();
   const accountUuid = deps.newUuid();
   const mintedAt = new Date(deps.now()).toISOString();
-  deps.fs.mkdirPrivate(import_node_path43.default.dirname(credentialsFile));
+  deps.fs.mkdirPrivate(import_node_path44.default.dirname(credentialsFile));
   deps.fs.writeFilePrivate(credentialsFile, `${JSON.stringify({ ...existingCredentials, claudeAiOauth: { accessToken, refreshToken, expiresAt: null, scopes: [...RC_SELF_HOST_SCOPE_LIST], subscriptionType: SELF_HOST_SUBSCRIPTION_TYPE, rateLimitTier: null } }, null, 2)}
 `);
   const claudeJson = readJsonObject(deps.fs, claudeJsonFile) ?? {};
@@ -125938,12 +126387,12 @@ function eventExcerpt(text2) {
   return text2.length <= RC_PENDING_SUMMARY_EXCERPT_CHARS ? text2 : `${text2.slice(0, RC_PENDING_SUMMARY_EXCERPT_CHARS)}...`;
 }
 var PERCENT_SCALE = 100;
-var MS_PER_SECOND9 = 1e3;
+var MS_PER_SECOND10 = 1e3;
 function percentOf(fraction) {
   return `${String(Math.round(fraction * PERCENT_SCALE))}%`;
 }
 function resetInstantOf(epochSeconds) {
-  return new Date(epochSeconds * MS_PER_SECOND9).toISOString();
+  return new Date(epochSeconds * MS_PER_SECOND10).toISOString();
 }
 function formatRcRateLimitInfo(info) {
   const parts = [info.status];
@@ -126242,7 +126691,7 @@ function registerRcCommand(frontdoor, paths) {
 }
 
 // src/frontdoor/rcCredentialStore.ts
-var import_node_path44 = __toESM(require("node:path"), 1);
+var import_node_path45 = __toESM(require("node:path"), 1);
 function isSafeSessionId(sessionId) {
   return /^[A-Za-z0-9_-]+$/.test(sessionId);
 }
@@ -126268,7 +126717,7 @@ function sequenceNumOfJson(value2) {
 }
 function createRcCredentialStore(fs22, dir) {
   fs22.mkdirPrivate(dir);
-  const fileFor = (sessionId) => import_node_path44.default.join(dir, `${sessionId}.json`);
+  const fileFor = (sessionId) => import_node_path45.default.join(dir, `${sessionId}.json`);
   const readParsed = (sessionId) => {
     const raw = fs22.readFileUtf8(fileFor(sessionId));
     if (raw === void 0) {
@@ -127378,7 +127827,7 @@ var RC_COMPAT_SESSIONS_PATH = "/v1/sessions";
 var RC_SESSION_ID_PREFIX2 = "cse_";
 var RC_SELF_HOST_API_BASE_URL = "https://api.anthropic.com";
 var HTTP_CONFLICT = 409;
-var MS_PER_SECOND10 = 1e3;
+var MS_PER_SECOND11 = 1e3;
 var HTTP_SERVICE_UNAVAILABLE2 = 503;
 var RC_SELF_HOST_WORKER_JWT_TTL_SECONDS = 46800;
 var RC_SELF_HOST_KEEPALIVE_MS = 15e3;
@@ -127478,7 +127927,7 @@ function parseJsonObject5(body) {
 function mintWorkerJwt(randomToken, issuedAt) {
   const encode3 = (value2) => Buffer.from(JSON.stringify(value2), "utf8").toString("base64url");
   const header = encode3({ alg: "HS256", typ: "JWT" });
-  const payload = encode3({ exp: Math.floor((issuedAt + RC_SELF_HOST_WORKER_JWT_TTL_SECONDS * MS_PER_SECOND10) / MS_PER_SECOND10), iat: Math.floor(issuedAt / MS_PER_SECOND10) });
+  const payload = encode3({ exp: Math.floor((issuedAt + RC_SELF_HOST_WORKER_JWT_TTL_SECONDS * MS_PER_SECOND11) / MS_PER_SECOND11), iat: Math.floor(issuedAt / MS_PER_SECOND11) });
   return `${header}.${payload}.${Buffer.from(randomToken(), "utf8").toString("base64url")}`;
 }
 function createRcSelfHostSurface(deps) {
@@ -128549,6 +128998,28 @@ function realFrontDoorSupervisorPorts(paths) {
     const pools = readPools(paths);
     void refreshStalePoolMembers({ poolNames: Object.keys(pools), pools, loadMembers: (identities) => loadPoolMembers(realFarmFs, paths, identities, Date.now()), refresher: anthropicRefresher });
   }, ANTHROPIC_USAGE_FRESHNESS_MS).unref();
+  const windowOpener = createRealWindowOpener({ paths, cwd: process.cwd(), spawnDaemon: spawnDetachedSupervisor });
+  let keeperRunning = false;
+  setInterval(() => {
+    if (keeperRunning) {
+      return;
+    }
+    keeperRunning = true;
+    void runWindowKeeper({
+      fs: realFarmFs,
+      stampsFile: paths.usageAnchorsFile,
+      nowMs: () => Date.now(),
+      timeZone: machineTimeZone(),
+      anchored: () => listAnchoredIdentities(paths),
+      snapshot: (identity) => readUsageSnapshot(realFarmFs, paths.usageSnapshotsDir, identity),
+      open: windowOpener,
+      log
+    }).catch((error63) => {
+      log(`window keeper failed: ${error63 instanceof Error ? error63.message : String(error63)}`);
+    }).finally(() => {
+      keeperRunning = false;
+    });
+  }, ANTHROPIC_USAGE_FRESHNESS_MS).unref();
   const usageMiddleware = createUsageMiddleware({
     record: withQuotaRefresh(usageStore.record, quotaRefresher),
     defer: (task) => {
@@ -128692,7 +129163,7 @@ function realFrontDoorSupervisorPorts(paths) {
       const leafFor = createLeafCache(loadCa(), () => /* @__PURE__ */ new Date());
       const capture = captureFromEnv(process.env, paths.logsDir);
       if (capture !== void 0) {
-        log(`capture enabled, recording CONNECT targets and piped exchanges to ${import_node_path45.default.join(paths.logsDir, "frontdoor-capture.jsonl")}`);
+        log(`capture enabled, recording CONNECT targets and piped exchanges to ${import_node_path46.default.join(paths.logsDir, "frontdoor-capture.jsonl")}`);
       }
       if (rcSelfHostSurface !== void 0) {
         log("self-hosted Remote Control surface on: the door serves the CCR session family itself, and its own client-half dials its own transparent surface");
@@ -130829,8 +131300,8 @@ function getErrorMap2() {
 
 // node_modules/.pnpm/zod@4.6.5/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path51, errorMaps, issueData } = params;
-  const fullPath = [...path51, ...issueData.path || []];
+  const { data, path: path52, errorMaps, issueData } = params;
+  const fullPath = [...path52, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -130945,11 +131416,11 @@ var errorUtil;
 
 // node_modules/.pnpm/zod@4.6.5/node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value2, path51, key) {
+  constructor(parent, value2, path52, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value2;
-    this._path = path51;
+    this._path = path52;
     this._key = key;
   }
   get path() {
@@ -134512,11 +134983,11 @@ function normalizeObjectSchema(schema) {
   }
   return void 0;
 }
-function getDotPath(path51) {
-  if (path51.length === 0) {
+function getDotPath(path52) {
+  if (path52.length === 0) {
     return "object root";
   }
-  return path51.reduce((acc, seg, index) => {
+  return path52.reduce((acc, seg, index) => {
     if (index === 0) {
       return String(seg);
     }
@@ -138559,7 +139030,7 @@ async function serveMcp(mcp, transport, options = {}) {
 
 // src/mcp/permissions.ts
 var import_node_fs17 = __toESM(require("node:fs"), 1);
-var import_node_path46 = __toESM(require("node:path"), 1);
+var import_node_path47 = __toESM(require("node:path"), 1);
 init_zod();
 init_store();
 var StoredMcpPermissionsSchema = external_exports.strictObject({
@@ -138579,10 +139050,10 @@ function effectiveMcpPermissions(flags, stored) {
   return { writes: flags.writes || stored.writes, remoteControl: flags.remoteControl || stored.remoteControl };
 }
 function watchMcpPermissions(paths, onChange) {
-  const directory = import_node_path46.default.dirname(paths.mcpPermissionsFile);
+  const directory = import_node_path47.default.dirname(paths.mcpPermissionsFile);
   import_node_fs17.default.mkdirSync(directory, { recursive: true });
   const watcher = import_node_fs17.default.watch(directory, (_event, filename) => {
-    if (filename === null || filename === import_node_path46.default.basename(paths.mcpPermissionsFile)) {
+    if (filename === null || filename === import_node_path47.default.basename(paths.mcpPermissionsFile)) {
       onChange();
     }
   });
@@ -138891,16 +139362,16 @@ init_credentialCache();
 
 // src/identityToken.ts
 var import_node_fs18 = __toESM(require("node:fs"), 1);
-var import_node_path47 = __toESM(require("node:path"), 1);
+var import_node_path48 = __toESM(require("node:path"), 1);
 init_cliError();
 var TOKEN_FILE_MODE = 384;
 var TOKEN_DIR_MODE = 448;
 var OAUTH_TOKEN_RE = /^sk-ant-oat\d+-[A-Za-z0-9_-]+$/;
 function identityTokenDir(paths) {
-  return import_node_path47.default.join(paths.root, "credentials");
+  return import_node_path48.default.join(paths.root, "credentials");
 }
 function identityTokenPath(paths, identityName) {
-  return import_node_path47.default.join(identityTokenDir(paths), `${identityName}.token`);
+  return import_node_path48.default.join(identityTokenDir(paths), `${identityName}.token`);
 }
 function storeIdentityToken(paths, identityName, raw) {
   const token = raw.trim();
@@ -138911,7 +139382,7 @@ function storeIdentityToken(paths, identityName, raw) {
   import_node_fs18.default.mkdirSync(dir, { recursive: true, mode: TOKEN_DIR_MODE });
   import_node_fs18.default.chmodSync(dir, TOKEN_DIR_MODE);
   const target = identityTokenPath(paths, identityName);
-  const temp = import_node_path47.default.join(dir, `.${identityName}.${String(process.pid)}.tmp`);
+  const temp = import_node_path48.default.join(dir, `.${identityName}.${String(process.pid)}.tmp`);
   import_node_fs18.default.writeFileSync(temp, `${token}
 `, { mode: TOKEN_FILE_MODE });
   import_node_fs18.default.renameSync(temp, target);
@@ -139079,7 +139550,7 @@ function registerDoctorCommand(program2, deps) {
 // src/headroom/commands.ts
 var import_node_fs19 = __toESM(require("node:fs"), 1);
 var import_node_http4 = __toESM(require("node:http"), 1);
-var import_node_path48 = __toESM(require("node:path"), 1);
+var import_node_path49 = __toESM(require("node:path"), 1);
 var import_node_child_process6 = require("node:child_process");
 init_commandDeps();
 init_realFrontDoorPort();
@@ -139091,7 +139562,9 @@ init_state();
 init_supervisor();
 function collectHeadroomStatus(fsPort, paths, isRunning) {
   const state = resolveServingHeadroomState(fsPort, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, isRunning)?.state ?? {};
-  const allowlist = currentHeadroomAllowlist(fsPort, paths);
+  const inputs = currentHeadroomAllowlistInputs(fsPort, paths);
+  const allowlist = headroomAllowlist(headroomUpstreams(inputs.providers, inputs.frontDoorOrigin));
+  const allowlistDriftInputs = diagnoseAllowlistDrift({ recordedHash: state.allowlistHash, providers: inputs.providers, frontDoorOrigin: inputs.frontDoorOrigin });
   const settings2 = settingsOf(readGlobalConfig(paths)?.headroom ?? {});
   return {
     state,
@@ -139102,13 +139575,27 @@ function collectHeadroomStatus(fsPort, paths, isRunning) {
       alive: isRunning(session.pid)
     })),
     allowlist,
-    allowlistDrifted: state.allowlistHash !== void 0 && state.allowlistHash !== hashAllowlist(allowlist),
+    allowlistDrifted: allowlistDriftInputs !== void 0,
+    frontDoorOrigin: inputs.frontDoorOrigin,
+    allowlistDriftInputs,
     settings: settings2,
     settingsDrifted: state.settingsHash !== void 0 && state.settingsHash !== hashSettings(settings2),
     logPath: paths.headroomLogPath,
     logExists: fsPort.readFileUtf8(paths.headroomLogPath) !== void 0
   };
 }
+function describeAllowlistDrift(status) {
+  const inputs = status.allowlistDriftInputs ?? [];
+  if (!inputs.includes("front-door-origin")) {
+    return "DRIFTED: current provider files differ from the running daemon's allowlist; a restart is pending";
+  }
+  const origin = status.frontDoorOrigin ?? "";
+  const consequence = "provider launches through headroom are refused until the daemon restarts, which waits for the launches registered against it to end";
+  if (!inputs.includes("provider-files")) {
+    return `DRIFTED: the daemon was started before the serving front door's direct origin ${origin} existed, so its allowlist excludes it; ${consequence}`;
+  }
+  return `DRIFTED: the provider files or the serving front door's direct origin ${origin} changed since the daemon started, so its allowlist may exclude the door; ${consequence}`;
+}
 function formatHeadroomStatus(status) {
   const lines = [];
   if (status.state.supervisorPid === void 0) {
@@ -139125,7 +139612,7 @@ function formatHeadroomStatus(status) {
       `headroom: pid ${String(status.state.headroomPid)} (${status.headroomAlive ? "alive" : "NOT running"}), listening on unix socket ${status.state.socketPath}` + (status.state.version === void 0 ? "" : `, ${status.state.version}`)
     );
   }
-  const drift = status.allowlistDrifted ? " (DRIFTED: current provider files differ from the running daemon's allowlist; a restart is pending)" : "";
+  const drift = status.allowlistDrifted ? ` (${describeAllowlistDrift(status)})` : "";
   lines.push(`allowlist: ${status.allowlist.join(", ")}${drift}`);
   const configured = Object.entries(status.settings).map(([name, value2]) => `${name} ${String(value2)}`);
   const settingsDrift = status.settingsDrifted ? " (DRIFTED: the configured settings differ from the running daemon's; a restart is pending)" : "";
@@ -139193,12 +139680,12 @@ function readInstalledHeadroomCommit() {
   if (toolDir.status !== 0) {
     return void 0;
   }
-  const libDir = import_node_path48.default.join(toolDir.stdout.trim(), HEADROOM_TOOL_NAME, "lib");
+  const libDir = import_node_path49.default.join(toolDir.stdout.trim(), HEADROOM_TOOL_NAME, "lib");
   for (const python of realFarmFs.readdir(libDir)) {
-    const sitePackages = import_node_path48.default.join(libDir, python, "site-packages");
+    const sitePackages = import_node_path49.default.join(libDir, python, "site-packages");
     for (const entry of realFarmFs.readdir(sitePackages)) {
       if (entry.startsWith("headroom_ai-") && entry.endsWith(".dist-info")) {
-        const directUrl = realFarmFs.readFileUtf8(import_node_path48.default.join(sitePackages, entry, "direct_url.json"));
+        const directUrl = realFarmFs.readFileUtf8(import_node_path49.default.join(sitePackages, entry, "direct_url.json"));
         return directUrl === void 0 ? void 0 : parseInstalledCommit(directUrl);
       }
     }
@@ -139738,7 +140225,7 @@ function registerRunCommand(program2, handler) {
 }
 
 // src/usage/commands.ts
-var import_node_path49 = __toESM(require("node:path"), 1);
+var import_node_path50 = __toESM(require("node:path"), 1);
 init_commandDeps();
 init_realPorts();
 init_account();
@@ -139876,7 +140363,7 @@ function collectAccounts(fs22, paths, identity, probe) {
   return names.map((name) => ({
     identity: name,
     account: readAccountMetadata(fs22, paths.identitiesDir, name),
-    signIn: identitySignIn(fs22, probe, { farmRoot: import_node_path49.default.join(paths.identitiesDir, name), hasCredentialBlock: readIdentity(paths, name)?.credential !== void 0 }),
+    signIn: identitySignIn(fs22, probe, { farmRoot: import_node_path50.default.join(paths.identitiesDir, name), hasCredentialBlock: readIdentity(paths, name)?.credential !== void 0 }),
     usage: readUsageSnapshot(fs22, paths.usageSnapshotsDir, name)
   }));
 }
@@ -140221,7 +140708,7 @@ async function runClaude(argvOverride) {
 // src/cli.ts
 async function main() {
   aliasLegacyEnv(process.env);
-  const invokedName = import_node_path50.default.basename(process.argv[1] ?? "agent-shim");
+  const invokedName = import_node_path51.default.basename(process.argv[1] ?? "agent-shim");
   if (isInvokedAsClaude(invokedName)) {
     await runClaude();
     return;