claude-use 9.13.0 → 9.15.0

package/dist/cli.cjs

@@ -318,10 +318,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path51) {
-  if (!path51)
+function getElementAtPath(obj, path54) {
+  if (!path54)
     return obj;
-  return path51.reduce((acc, key) => acc?.[key], obj);
+  return path54.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -580,11 +580,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path51, issues) {
+function prefixIssues(path54, issues) {
   return issues.map((iss) => {
     var _a4;
     (_a4 = iss).path ?? (_a4.path = []);
-    iss.path.unshift(path51);
+    iss.path.unshift(path54);
     return iss;
   });
 }
@@ -1105,16 +1105,16 @@ function flattenError(error63, mapper = (issue2) => issue2.message) {
 }
 function formatError(error63, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error64, path51 = []) => {
+  const processError = (error64, path54 = []) => {
     for (const issue2 of error64.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path51, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path54, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path51, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path54, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path51, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path54, ...issue2.path]);
       } else {
-        const fullpath = [...path51, ...issue2.path];
+        const fullpath = [...path54, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -1153,17 +1153,17 @@ function formatError(error63, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error63, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error64, path51 = []) => {
+  const processError = (error64, path54 = []) => {
     var _a4;
     for (const issue2 of error64.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path51, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path54, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path51, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path54, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path51, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path54, ...issue2.path]);
       } else {
-        const fullpath = [...path51, ...issue2.path];
+        const fullpath = [...path54, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -1202,8 +1202,8 @@ function treeifyError(error63, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path51 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path51) {
+  const path54 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path54) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -19199,13 +19199,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path51 = ref.slice(1).split("/").filter(Boolean);
-  if (path51.length === 0) {
+  const path54 = ref.slice(1).split("/").filter(Boolean);
+  if (path54.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path51[0] === defsKey) {
-    const key = path51[1] === void 0 ? void 0 : decodeJSONPointerSegment(path51[1]);
+  if (path54[0] === defsKey) {
+    const key = path54[1] === void 0 ? void 0 : decodeJSONPointerSegment(path54[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -23712,42 +23712,42 @@ var require_defaults = __commonJS({
 var require_env_paths = __commonJS({
   "node_modules/.pnpm/env-paths@2.2.1/node_modules/env-paths/index.js"(exports2, module2) {
     "use strict";
-    var path51 = require("path");
+    var path54 = require("path");
     var os12 = require("os");
     var homedir = os12.homedir();
     var tmpdir = os12.tmpdir();
     var { env } = process;
     var macos = (name) => {
-      const library = path51.join(homedir, "Library");
+      const library = path54.join(homedir, "Library");
       return {
-        data: path51.join(library, "Application Support", name),
-        config: path51.join(library, "Preferences", name),
-        cache: path51.join(library, "Caches", name),
-        log: path51.join(library, "Logs", name),
-        temp: path51.join(tmpdir, name)
+        data: path54.join(library, "Application Support", name),
+        config: path54.join(library, "Preferences", name),
+        cache: path54.join(library, "Caches", name),
+        log: path54.join(library, "Logs", name),
+        temp: path54.join(tmpdir, name)
       };
     };
     var windows = (name) => {
-      const appData = env.APPDATA || path51.join(homedir, "AppData", "Roaming");
-      const localAppData = env.LOCALAPPDATA || path51.join(homedir, "AppData", "Local");
+      const appData = env.APPDATA || path54.join(homedir, "AppData", "Roaming");
+      const localAppData = env.LOCALAPPDATA || path54.join(homedir, "AppData", "Local");
       return {
         // Data/config/cache/log are invented by me as Windows isn't opinionated about this
-        data: path51.join(localAppData, name, "Data"),
-        config: path51.join(appData, name, "Config"),
-        cache: path51.join(localAppData, name, "Cache"),
-        log: path51.join(localAppData, name, "Log"),
-        temp: path51.join(tmpdir, name)
+        data: path54.join(localAppData, name, "Data"),
+        config: path54.join(appData, name, "Config"),
+        cache: path54.join(localAppData, name, "Cache"),
+        log: path54.join(localAppData, name, "Log"),
+        temp: path54.join(tmpdir, name)
       };
     };
     var linux = (name) => {
-      const username = path51.basename(homedir);
+      const username = path54.basename(homedir);
       return {
-        data: path51.join(env.XDG_DATA_HOME || path51.join(homedir, ".local", "share"), name),
-        config: path51.join(env.XDG_CONFIG_HOME || path51.join(homedir, ".config"), name),
-        cache: path51.join(env.XDG_CACHE_HOME || path51.join(homedir, ".cache"), name),
+        data: path54.join(env.XDG_DATA_HOME || path54.join(homedir, ".local", "share"), name),
+        config: path54.join(env.XDG_CONFIG_HOME || path54.join(homedir, ".config"), name),
+        cache: path54.join(env.XDG_CACHE_HOME || path54.join(homedir, ".cache"), name),
         // https://wiki.debian.org/XDGBaseDirectorySpecification#state
-        log: path51.join(env.XDG_STATE_HOME || path51.join(homedir, ".local", "state"), name),
-        temp: path51.join(tmpdir, username, name)
+        log: path54.join(env.XDG_STATE_HOME || path54.join(homedir, ".local", "state"), name),
+        temp: path54.join(tmpdir, username, name)
       };
     };
     var envPaths = (name, options) => {
@@ -23815,11 +23815,11 @@ var require_util = __commonJS({
       return result;
     }
     exports2.emplace = emplace;
-    function getPropertyByPath(source, path51) {
-      if (typeof path51 === "string" && Object.prototype.hasOwnProperty.call(source, path51)) {
-        return source[path51];
+    function getPropertyByPath(source, path54) {
+      if (typeof path54 === "string" && Object.prototype.hasOwnProperty.call(source, path54)) {
+        return source[path54];
       }
-      const parsedPath = typeof path51 === "string" ? path51.split(".") : path51;
+      const parsedPath = typeof path54 === "string" ? path54.split(".") : path54;
       return parsedPath.reduce((previous, key) => {
         if (previous === void 0) {
           return previous;
@@ -23842,9 +23842,9 @@ var require_util = __commonJS({
       return Object.fromEntries(Object.entries(options).filter(([, value2]) => value2 !== void 0));
     }
     exports2.removeUndefinedValuesFromObject = removeUndefinedValuesFromObject;
-    async function isDirectory(path51) {
+    async function isDirectory(path54) {
       try {
-        const stat = await fs_1.promises.stat(path51);
+        const stat = await fs_1.promises.stat(path54);
         return stat.isDirectory();
       } catch (e14) {
         if (e14.code === "ENOENT") {
@@ -23854,9 +23854,9 @@ var require_util = __commonJS({
       }
     }
     exports2.isDirectory = isDirectory;
-    function isDirectorySync(path51) {
+    function isDirectorySync(path54) {
       try {
-        const stat = fs_1.default.statSync(path51);
+        const stat = fs_1.default.statSync(path54);
         return stat.isDirectory();
       } catch (e14) {
         if (e14.code === "ENOENT") {
@@ -23954,7 +23954,7 @@ var require_ExplorerBase = __commonJS({
           const idx = importStack.indexOf(fullPath);
           if (idx !== -1) {
             throw new Error(`Circular import detected:
-${[...importStack, fullPath].map((path51, i10) => `${i10 + 1}. ${path51}`).join("\n")} (same as ${idx + 1}.)`);
+${[...importStack, fullPath].map((path54, i10) => `${i10 + 1}. ${path54}`).join("\n")} (same as ${idx + 1}.)`);
           }
         }
       }
@@ -24142,9 +24142,9 @@ var require_Explorer = __commonJS({
           throw error63;
         }
       }
-      async #fileExists(path51) {
+      async #fileExists(path54) {
         try {
-          await promises_1.default.stat(path51);
+          await promises_1.default.stat(path54);
           return true;
         } catch (e14) {
           return false;
@@ -24304,9 +24304,9 @@ var require_ExplorerSync = __commonJS({
           throw error63;
         }
       }
-      #fileExists(path51) {
+      #fileExists(path54) {
         try {
-          fs_1.default.statSync(path51);
+          fs_1.default.statSync(path54);
           return true;
         } catch (e14) {
           return false;
@@ -24430,7 +24430,7 @@ var require_dist = __commonJS({
       };
     }
     function getResolvedSearchPlaces(moduleName, toolDefinedSearchPlaces, userConfiguredOptions) {
-      const userConfiguredSearchPlaces = userConfiguredOptions.searchPlaces?.map((path51) => path51.replace("{name}", moduleName));
+      const userConfiguredSearchPlaces = userConfiguredOptions.searchPlaces?.map((path54) => path54.replace("{name}", moduleName));
       if (userConfiguredOptions.mergeSearchPlaces) {
         return [...userConfiguredSearchPlaces ?? [], ...toolDefinedSearchPlaces];
       }
@@ -26799,7 +26799,15 @@ function isCodexProvider(provider) {
 function poolMemberIdentity(member) {
   return typeof member === "string" ? member : member.identity;
 }
-var import_node_path4, CATEGORY_NAMES, OVERRIDABLE_CATEGORIES, CategoryMapSchema, DURATION_RE, DurationSchema, WhenConditionObjectSchema, WhenSchema, EntryValueSchema, ENTRY_KEY_RE, EntriesSchema, LaunchSchema, CREDENTIAL_TARGETS, PROVIDER_CREDENTIAL_TARGETS, CREDENTIAL_TARGET_VARS, ArgvSchema, CommandSourceOptions, EnvCredentialSourceSchema, FileCredentialSourceSchema, CommandCredentialSourceSchema, OpCredentialSourceSchema, KeychainCredentialSourceSchema, LiteralCredentialSourceSchema, CredentialSourceSchema, RemoteCredentialSourceSchema, CREDENTIAL_CACHE_STORES, CredentialCacheSchema, CredentialSchema, ProviderCredentialSchema, RESERVED_PROVIDER_ENV_KEYS, ProviderEnvSchema, PROVIDER_KINDS, CODEX_TIERS, CODEX_EFFORTS, CODEX_LOGINS, CODEX_DEFAULT_LOGIN, CODEX_DEFAULT_MODEL, CODEX_DEFAULT_TIER_MODELS, CODEX_DEFAULT_EFFORT, CodexProviderConfigSchema, ProviderRouteSchema, HttpProviderSchema, CodexProviderSchema, ProviderSchema, ConfigProfileSchema, POOL_SELECTOR_PREFIX, POOL_NAME_PATTERN, IDENTITY_NAME_PATTERN, PoolNameSchema, SELECTOR_RE, IdentitySelectorSchema, PoolMemberSchema, POOL_PREFERENCES, PoolPreferenceSchema, PoolSchema, DirectoryRuleSchema, DirectoryRulesSchema, PortableConfigSchema, HEADROOM_MODES, HEADROOM_CCR_MODES, HEADROOM_ROLLOUT_CHANNELS, INTERCEPT_CHANNELS, READ_MATURATION_CHANNELS, HeadroomGlobalConfigObjectSchema, HeadroomGlobalConfigSchema, HEADROOM_DEFAULT_SOURCE, HEADROOM_DEFAULT_IDLE_SHUTDOWN_MINUTES, FRONTDOOR_DEFAULT_IDLE_SHUTDOWN_MINUTES, FrontDoorGlobalConfigSchema, UPDATE_MODES, UpdateGlobalConfigSchema, GlobalConfigSchema, IdentitySchema, CategoryClassificationSchema, CategoryClassificationOverlaySchema, SHIPPED_CATEGORY_DEFAULTS;
+function isTimeZone(name) {
+  try {
+    new Intl.DateTimeFormat("en", { timeZone: name });
+    return true;
+  } catch {
+    return false;
+  }
+}
+var import_node_path4, CATEGORY_NAMES, OVERRIDABLE_CATEGORIES, CategoryMapSchema, DURATION_RE, DurationSchema, WhenConditionObjectSchema, WhenSchema, EntryValueSchema, ENTRY_KEY_RE, EntriesSchema, LaunchSchema, CREDENTIAL_TARGETS, PROVIDER_CREDENTIAL_TARGETS, CREDENTIAL_TARGET_VARS, ArgvSchema, CommandSourceOptions, EnvCredentialSourceSchema, FileCredentialSourceSchema, CommandCredentialSourceSchema, OpCredentialSourceSchema, KeychainCredentialSourceSchema, LiteralCredentialSourceSchema, CredentialSourceSchema, RemoteCredentialSourceSchema, CREDENTIAL_CACHE_STORES, CredentialCacheSchema, CredentialSchema, ProviderCredentialSchema, RESERVED_PROVIDER_ENV_KEYS, ProviderEnvSchema, PROVIDER_KINDS, CODEX_TIERS, CODEX_EFFORTS, CODEX_LOGINS, CODEX_DEFAULT_LOGIN, CODEX_DEFAULT_MODEL, CODEX_DEFAULT_TIER_MODELS, CODEX_DEFAULT_EFFORT, CodexProviderConfigSchema, ProviderRouteSchema, HttpProviderSchema, CodexProviderSchema, ProviderSchema, ConfigProfileSchema, POOL_SELECTOR_PREFIX, POOL_NAME_PATTERN, IDENTITY_NAME_PATTERN, PoolNameSchema, SELECTOR_RE, IdentitySelectorSchema, PoolMemberSchema, POOL_PREFERENCES, PoolPreferenceSchema, PoolSchema, WEEKDAYS, AnchorSchema, JOB_WINDOWS, JobTriggerSchema, JobTargetSchema, JobSchema, DirectoryRuleSchema, DirectoryRulesSchema, PortableConfigSchema, HEADROOM_MODES, HEADROOM_CCR_MODES, HEADROOM_ROLLOUT_CHANNELS, INTERCEPT_CHANNELS, READ_MATURATION_CHANNELS, HeadroomGlobalConfigObjectSchema, HeadroomGlobalConfigSchema, HEADROOM_DEFAULT_SOURCE, HEADROOM_DEFAULT_IDLE_SHUTDOWN_MINUTES, FRONTDOOR_DEFAULT_IDLE_SHUTDOWN_MINUTES, FrontDoorGlobalConfigSchema, UPDATE_MODES, UpdateGlobalConfigSchema, GlobalConfigSchema, IdentitySchema, CategoryClassificationSchema, CategoryClassificationOverlaySchema, SHIPPED_CATEGORY_DEFAULTS;
 var init_schema = __esm({
   "src/config/schema.ts"() {
     "use strict";
@@ -26974,6 +26982,25 @@ var init_schema = __esm({
       identities: external_exports.array(PoolMemberSchema).min(1).refine((members2) => new Set(members2.map(poolMemberIdentity)).size === members2.length, { message: "pool members must be unique" }),
       preference: PoolPreferenceSchema.optional()
     });
+    WEEKDAYS = ["mon", "tue", "wed", "thu", "fri", "sat", "sun"];
+    AnchorSchema = external_exports.strictObject({
+      days: external_exports.array(external_exports.enum(WEEKDAYS)).min(1).refine((days) => new Set(days).size === days.length, "an anchor names each weekday at most once"),
+      time: external_exports.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/, "a 24-hour time such as 06:00"),
+      timeZone: external_exports.string().refine(isTimeZone, "an IANA time zone such as Europe/London").optional()
+    });
+    JOB_WINDOWS = ["fiveHour", "sevenDay"];
+    JobTriggerSchema = external_exports.union([external_exports.strictObject({ at: external_exports.array(AnchorSchema).min(1) }), external_exports.strictObject({ beforeReset: external_exports.enum(JOB_WINDOWS), lead: external_exports.string().regex(DURATION_RE) })]);
+    JobTargetSchema = external_exports.union([external_exports.strictObject({ identity: IdentitySelectorSchema }), external_exports.strictObject({ pool: PoolNameSchema })]);
+    JobSchema = external_exports.strictObject({
+      target: JobTargetSchema,
+      trigger: JobTriggerSchema,
+      prompt: external_exports.string().min(1),
+      /** The absolute directory the run works in. */
+      cwd: external_exports.string().min(1),
+      timeout: external_exports.string().regex(DURATION_RE),
+      model: external_exports.string().min(1).optional(),
+      allowedTools: external_exports.array(external_exports.string().min(1)).min(1).optional()
+    });
     DirectoryRuleSchema = ConfigProfileSchema.omit({ description: true }).extend({
       path: external_exports.string().min(1),
       configProfile: external_exports.string().min(1).optional(),
@@ -27042,14 +27069,17 @@ var init_schema = __esm({
       headroom: HeadroomGlobalConfigSchema.optional(),
       frontdoor: FrontDoorGlobalConfigSchema.optional(),
       update: UpdateGlobalConfigSchema.optional(),
-      pools: external_exports.record(PoolNameSchema, PoolSchema).optional()
+      pools: external_exports.record(PoolNameSchema, PoolSchema).optional(),
+      jobs: external_exports.record(PoolNameSchema, JobSchema).optional()
     });
     IdentitySchema = external_exports.strictObject({
       $schema: external_exports.string().optional(),
       name: external_exports.string().min(1).regex(/^[A-Za-z0-9][A-Za-z0-9._@-]*$/),
       defaultConfigProfile: external_exports.string().min(1).optional(),
       allowAmbientCredential: external_exports.boolean().default(false),
-      credential: CredentialSchema.optional()
+      credential: CredentialSchema.optional(),
+      /** When this identity's five-hour window should be open: the front door opens one at each anchor if none is. Absent, nothing is opened on a schedule. */
+      anchors: external_exports.array(AnchorSchema).min(1).optional()
     });
     CategoryClassificationSchema = external_exports.strictObject({
       $schema: external_exports.string().optional(),
@@ -28911,8 +28941,8 @@ var require_utils = __commonJS({
       }
       return output2;
     };
-    exports2.basename = (path51, { windows } = {}) => {
-      const segs = path51.split(windows ? /[\\/]/ : "/");
+    exports2.basename = (path54, { windows } = {}) => {
+      const segs = path54.split(windows ? /[\\/]/ : "/");
       const last = segs[segs.length - 1];
       if (last === "") {
         return segs[segs.length - 2];
@@ -32578,6 +32608,9 @@ function buildLayoutPaths(root) {
     usageLogDir: import_node_path19.default.join(root, "usage", "log"),
     usageSnapshotsDir: import_node_path19.default.join(root, "usage", "snapshots"),
     usagePicksFile: import_node_path19.default.join(root, "usage", "picks.json"),
+    usageAnchorsFile: import_node_path19.default.join(root, "usage", "anchors.json"),
+    usageJobsFile: import_node_path19.default.join(root, "usage", "jobs.json"),
+    jobLogsDir: import_node_path19.default.join(root, "logs", "jobs"),
     mcpPermissionsFile: import_node_path19.default.join(root, "mcp", "permissions.json")
   };
 }
@@ -32595,6 +32628,47 @@ var init_paths = __esm({
   }
 });
 
+// src/cli/pairs.ts
+function splitCommas(input2) {
+  if (input2 === "") {
+    return [];
+  }
+  return input2.split(",");
+}
+function parsePair(input2) {
+  const eqIndex = input2.indexOf("=");
+  if (eqIndex === -1) {
+    throw new Error(`Expected "<key>=<value>", got "${input2}" (no "=" found)`);
+  }
+  const key = input2.slice(0, eqIndex);
+  const value2 = input2.slice(eqIndex + 1);
+  if (key === "") {
+    throw new Error(`Expected a non-empty key before "=" in "${input2}"`);
+  }
+  return { key, value: value2 };
+}
+function parseBool(input2) {
+  const parsed = parseBoolWord(input2);
+  if (parsed === void 0) {
+    throw new Error(`Expected "true", "false", "1" or "0", got "${input2}"`);
+  }
+  return parsed;
+}
+function parseBoolPairList(input2) {
+  const result = {};
+  for (const piece of splitCommas(input2)) {
+    const { key, value: value2 } = parsePair(piece);
+    result[key] = parseBool(value2);
+  }
+  return result;
+}
+var init_pairs = __esm({
+  "src/cli/pairs.ts"() {
+    "use strict";
+    init_bool();
+  }
+});
+
 // src/usage/schema.ts
 function isRateLimitHeader(name) {
   const lower = name.toLowerCase();
@@ -32794,7 +32868,7 @@ function epochSecondsToIso(value2) {
     return void 0;
   }
   const seconds = Number(value2);
-  return Number.isFinite(seconds) && seconds > 0 ? new Date(seconds * MS_PER_SECOND).toISOString() : void 0;
+  return Number.isFinite(seconds) && seconds > 0 ? new Date(seconds * MS_PER_SECOND2).toISOString() : void 0;
 }
 function nonNegativeNumber(value2) {
   if (value2 === void 0 || value2.trim() === "") {
@@ -32878,7 +32952,7 @@ function retryAfterSeconds(value2, nowMs) {
     return seconds;
   }
   const date5 = Date.parse(value2);
-  return Number.isNaN(date5) ? void 0 : Math.max(0, Math.ceil((date5 - nowMs) / MS_PER_SECOND));
+  return Number.isNaN(date5) ? void 0 : Math.max(0, Math.ceil((date5 - nowMs) / MS_PER_SECOND2));
 }
 function classifyLimit(params) {
   const { status, headers, error: error63 } = params;
@@ -32917,14 +32991,14 @@ function classifyLimit(params) {
     evidence
   };
 }
-var TOO_MANY_REQUESTS, PAYMENT_REQUIRED, MS_PER_SECOND, UNIFIED_PREFIX, QUOTA_EXHAUSTED_ERRORS, QUOTA_EXHAUSTED_MESSAGE, EVIDENCE_TOKEN;
+var TOO_MANY_REQUESTS, PAYMENT_REQUIRED, MS_PER_SECOND2, UNIFIED_PREFIX, QUOTA_EXHAUSTED_ERRORS, QUOTA_EXHAUSTED_MESSAGE, EVIDENCE_TOKEN;
 var init_rateLimit = __esm({
   "src/usage/rateLimit.ts"() {
     "use strict";
     init_schema2();
     TOO_MANY_REQUESTS = 429;
     PAYMENT_REQUIRED = 402;
-    MS_PER_SECOND = 1e3;
+    MS_PER_SECOND2 = 1e3;
     UNIFIED_PREFIX = "anthropic-ratelimit-unified-";
     QUOTA_EXHAUSTED_ERRORS = /* @__PURE__ */ new Set(["usage_limit_reached", "insufficient_quota", "1308", "1309", "1310", "1316", "1317", "1318", "1319", "1320", "1321"]);
     QUOTA_EXHAUSTED_MESSAGE = /usage limit|quota (?:exceeded|exhausted)|limit exhausted|insufficient (?:balance|credits|quota)/i;
@@ -32934,11 +33008,11 @@ var init_rateLimit = __esm({
 
 // src/usage/preflight.ts
 function formatAge(ms2) {
-  const minutes = Math.floor(ms2 / (MS_PER_SECOND2 * SECONDS_PER_MINUTE));
-  if (minutes < MINUTES_PER_HOUR) {
+  const minutes = Math.floor(ms2 / (MS_PER_SECOND3 * SECONDS_PER_MINUTE));
+  if (minutes < MINUTES_PER_HOUR2) {
     return `${String(Math.max(minutes, 0))}m`;
   }
-  const hours = Math.floor(minutes / MINUTES_PER_HOUR);
+  const hours = Math.floor(minutes / MINUTES_PER_HOUR2);
   return hours < HOURS_PER_DAY ? `${String(hours)}h` : `${String(Math.floor(hours / HOURS_PER_DAY))}d`;
 }
 function effectiveWindow(window, nowMs) {
@@ -32975,14 +33049,14 @@ function quotaWarnings(snapshot, provider, nowMs) {
     return [`agent-shim: identity ${snapshot.identity}: the ${name} quota is ${verdict}${reset} (last seen ${age2} ago)`];
   });
 }
-var MS_PER_SECOND2, SECONDS_PER_MINUTE, MINUTES_PER_HOUR, HOURS_PER_DAY, WARNING_STATUSES;
+var MS_PER_SECOND3, SECONDS_PER_MINUTE, MINUTES_PER_HOUR2, HOURS_PER_DAY, WARNING_STATUSES;
 var init_preflight = __esm({
   "src/usage/preflight.ts"() {
     "use strict";
     init_rateLimit();
-    MS_PER_SECOND2 = 1e3;
+    MS_PER_SECOND3 = 1e3;
     SECONDS_PER_MINUTE = 60;
-    MINUTES_PER_HOUR = 60;
+    MINUTES_PER_HOUR2 = 60;
     HOURS_PER_DAY = 24;
     WARNING_STATUSES = /* @__PURE__ */ new Set(["allowed_warning", "rejected"]);
   }
@@ -33237,54 +33311,13 @@ var init_credential = __esm({
   }
 });
 
-// src/cli/pairs.ts
-function splitCommas(input2) {
-  if (input2 === "") {
-    return [];
-  }
-  return input2.split(",");
-}
-function parsePair(input2) {
-  const eqIndex = input2.indexOf("=");
-  if (eqIndex === -1) {
-    throw new Error(`Expected "<key>=<value>", got "${input2}" (no "=" found)`);
-  }
-  const key = input2.slice(0, eqIndex);
-  const value2 = input2.slice(eqIndex + 1);
-  if (key === "") {
-    throw new Error(`Expected a non-empty key before "=" in "${input2}"`);
-  }
-  return { key, value: value2 };
-}
-function parseBool(input2) {
-  const parsed = parseBoolWord(input2);
-  if (parsed === void 0) {
-    throw new Error(`Expected "true", "false", "1" or "0", got "${input2}"`);
-  }
-  return parsed;
-}
-function parseBoolPairList(input2) {
-  const result = {};
-  for (const piece of splitCommas(input2)) {
-    const { key, value: value2 } = parsePair(piece);
-    result[key] = parseBool(value2);
-  }
-  return result;
-}
-var init_pairs = __esm({
-  "src/cli/pairs.ts"() {
-    "use strict";
-    init_bool();
-  }
-});
-
 // package.json
 var package_default;
 var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "claude-use",
-      version: "9.13.0",
+      version: "9.15.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -33555,11 +33588,11 @@ function identifyRequest(headers) {
 function directOrigin(port) {
   return `http://127.0.0.1:${String(port)}`;
 }
-function parseProviderPath(path51) {
-  if (!path51.startsWith(PROVIDER_PATH_PREFIX)) {
+function parseProviderPath(path54) {
+  if (!path54.startsWith(PROVIDER_PATH_PREFIX)) {
     return void 0;
   }
-  const tail = path51.slice(PROVIDER_PATH_PREFIX.length);
+  const tail = path54.slice(PROVIDER_PATH_PREFIX.length);
   const slash = tail.indexOf("/");
   if (slash <= 0) {
     return void 0;
@@ -33885,9 +33918,9 @@ function decoderFor(encoding) {
       return void 0;
   }
 }
-function destinationOf(path51) {
-  const scoped = parseProviderPath(path51);
-  return scoped === void 0 ? { provider: ANTHROPIC_PROVIDER, endpoint: path51 } : { provider: scoped.provider, endpoint: scoped.rest };
+function destinationOf(path54) {
+  const scoped = parseProviderPath(path54);
+  return scoped === void 0 ? { provider: ANTHROPIC_PROVIDER, endpoint: path54 } : { provider: scoped.provider, endpoint: scoped.rest };
 }
 function buildRecord(event, context) {
   const { scan } = context;
@@ -34044,7 +34077,7 @@ function limitBlockedUntil(state, nowMs) {
   if (state.lastRequestAt !== void 0 && Date.parse(state.lastRequestAt) > Date.parse(limit.observedAt)) {
     return void 0;
   }
-  const until = limit.resetAt === void 0 ? limit.retryAfterSeconds === void 0 ? void 0 : Date.parse(limit.observedAt) + limit.retryAfterSeconds * MS_PER_SECOND3 : Date.parse(limit.resetAt);
+  const until = limit.resetAt === void 0 ? limit.retryAfterSeconds === void 0 ? void 0 : Date.parse(limit.observedAt) + limit.retryAfterSeconds * MS_PER_SECOND4 : Date.parse(limit.resetAt);
   return until !== void 0 && until > nowMs ? until : void 0;
 }
 function windowBlockedUntil(windows) {
@@ -34167,10 +34200,10 @@ function assessIdentity(member, nowMs) {
     return { candidate: { ...base, class: "unknown", reasons: ["quota windows reported no utilisation", ...windowReasons, ...planReasons] } };
   }
   const remaining = Math.max(0, 1 - basis.window.utilization);
-  const untilResetMs = basis.window.resetsAtMs === void 0 ? basis.windowMs : Math.max(basis.window.resetsAtMs - nowMs, MS_PER_SECOND3);
+  const untilResetMs = basis.window.resetsAtMs === void 0 ? basis.windowMs : Math.max(basis.window.resetsAtMs - nowMs, MS_PER_SECOND4);
   const weeklyScore = remaining * plan.capacity / (untilResetMs / MS_PER_HOUR2);
   const fiveRemaining = five?.utilization === void 0 ? void 0 : Math.max(0, 1 - five.utilization);
-  const fiveUntil = five?.resetsAtMs === void 0 ? FIVE_HOUR_WINDOW_MS : Math.max(five.resetsAtMs - nowMs, MS_PER_SECOND3);
+  const fiveUntil = five?.resetsAtMs === void 0 ? FIVE_HOUR_WINDOW_MS : Math.max(five.resetsAtMs - nowMs, MS_PER_SECOND4);
   const ratio = windowRatio(member.records);
   const fiveHourScore = basis.name === "sevenDay" && fiveRemaining !== void 0 && ratio !== void 0 ? Math.min(fiveRemaining * ratio, remaining) * plan.capacity / (fiveUntil / MS_PER_HOUR2) : void 0;
   const fiveHourLeads = fiveHourScore !== void 0 && fiveHourScore > weeklyScore;
@@ -34179,7 +34212,7 @@ function assessIdentity(member, nowMs) {
   const fiveHourTermReasons = basis.name !== "sevenDay" || fiveRemaining === void 0 ? [] : ratio === void 0 ? ["5h reset not scored: no measured 5h to 7d ratio yet"] : fiveHourLeads ? [`5h term leads: ${percent(fiveRemaining)} of 5h unused is about ${percent(Math.min(fiveRemaining * ratio, remaining))} of the week at the measured ratio, resets in ${formatAge(fiveUntil)}`] : [];
   const burn = windowBurn(member.records, "fiveHour");
   const sevenRemaining = seven?.utilization === void 0 ? void 0 : Math.max(0, 1 - seven.utilization);
-  const sevenUntil = seven?.resetsAtMs === void 0 ? SEVEN_DAY_WINDOW_MS : Math.max(seven.resetsAtMs - nowMs, MS_PER_SECOND3);
+  const sevenUntil = seven?.resetsAtMs === void 0 ? SEVEN_DAY_WINDOW_MS : Math.max(seven.resetsAtMs - nowMs, MS_PER_SECOND4);
   const sevenDayBurn = windowBurn(member.records, "sevenDay");
   return {
     candidate: { ...base, class: "scored", score, scoreWindow, reasons: [...fiveHourTermReasons, ...windowReasons.map((reason, index) => index === windowReasons.length - 1 ? `${reason}${observedAgo}` : reason), ...planReasons] },
@@ -34273,7 +34306,7 @@ function rankPool(input2) {
     ...pick2?.planReturnsAtMs === void 0 ? {} : { planReturn: { identity: pick2.identity, atMs: pick2.planReturnsAtMs } }
   };
 }
-var MS_PER_SECOND3, MS_PER_HOUR2, HOURS_PER_DAY2, FIVE_HOURS, PROMPT_CACHE_TTL_HOURS, PERCENT, SEVEN_DAYS, FIVE_HOUR_WINDOW_MS, SEVEN_DAY_WINDOW_MS, PROMPT_CACHE_TTL_MS, CLASS_ORDER;
+var MS_PER_SECOND4, MS_PER_HOUR2, HOURS_PER_DAY2, FIVE_HOURS, PROMPT_CACHE_TTL_HOURS, PERCENT, SEVEN_DAYS, FIVE_HOUR_WINDOW_MS, SEVEN_DAY_WINDOW_MS, PROMPT_CACHE_TTL_MS, CLASS_ORDER;
 var init_pick = __esm({
   "src/usage/pick.ts"() {
     "use strict";
@@ -34283,7 +34316,7 @@ var init_pick = __esm({
     init_preflight();
     init_quotaFacts();
     init_rateLimit();
-    MS_PER_SECOND3 = 1e3;
+    MS_PER_SECOND4 = 1e3;
     MS_PER_HOUR2 = 36e5;
     HOURS_PER_DAY2 = 24;
     FIVE_HOURS = 5;
@@ -34568,7 +34601,7 @@ function createUsageStore(deps) {
     })
   };
 }
-var import_node_path25, DAY_MS2, DAYS_IN_WEEK, USAGE_RETENTION_MS;
+var import_node_path25, DAY_MS2, DAYS_IN_WEEK2, USAGE_RETENTION_MS;
 var init_store2 = __esm({
   "src/usage/store.ts"() {
     "use strict";
@@ -34578,8 +34611,8 @@ var init_store2 = __esm({
     init_read();
     init_schema2();
     DAY_MS2 = 864e5;
-    DAYS_IN_WEEK = 7;
-    USAGE_RETENTION_MS = DAYS_IN_WEEK * DAY_MS2;
+    DAYS_IN_WEEK2 = 7;
+    USAGE_RETENTION_MS = DAYS_IN_WEEK2 * DAY_MS2;
   }
 });
 
@@ -36323,14 +36356,14 @@ var require_util2 = __commonJS({
         }
         const port = url2.port != null ? url2.port : url2.protocol === "https:" ? 443 : 80;
         let origin = url2.origin != null ? url2.origin : `${url2.protocol || ""}//${url2.hostname || ""}:${port}`;
-        let path51 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`;
+        let path54 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`;
         if (origin[origin.length - 1] === "/") {
           origin = origin.slice(0, origin.length - 1);
         }
-        if (path51 && path51[0] !== "/") {
-          path51 = `/${path51}`;
+        if (path54 && path54[0] !== "/") {
+          path54 = `/${path54}`;
         }
-        return new URL(`${origin}${path51}`);
+        return new URL(`${origin}${path54}`);
       }
       if (!isHttpOrHttpsPrefixed(url2.origin || url2.protocol)) {
         throw new InvalidArgumentError2("Invalid URL protocol: the URL must start with `http:` or `https:`.");
@@ -37151,9 +37184,9 @@ var require_diagnostics = __commonJS({
         "undici:client:sendHeaders",
         (evt) => {
           const {
-            request: { method, path: path51, origin }
+            request: { method, path: path54, origin }
           } = evt;
-          debugLog("sending request to %s %s%s", method, origin, path51);
+          debugLog("sending request to %s %s%s", method, origin, path54);
         }
       );
     }
@@ -37171,14 +37204,14 @@ var require_diagnostics = __commonJS({
         "undici:request:headers",
         (evt) => {
           const {
-            request: { method, path: path51, origin },
+            request: { method, path: path54, origin },
             response: { statusCode }
           } = evt;
           debugLog(
             "received response to %s %s%s - HTTP %d",
             method,
             origin,
-            path51,
+            path54,
             statusCode
           );
         }
@@ -37187,23 +37220,23 @@ var require_diagnostics = __commonJS({
         "undici:request:trailers",
         (evt) => {
           const {
-            request: { method, path: path51, origin }
+            request: { method, path: path54, origin }
           } = evt;
-          debugLog("trailers received from %s %s%s", method, origin, path51);
+          debugLog("trailers received from %s %s%s", method, origin, path54);
         }
       );
       diagnosticsChannel.subscribe(
         "undici:request:error",
         (evt) => {
           const {
-            request: { method, path: path51, origin },
+            request: { method, path: path54, origin },
             error: error63
           } = evt;
           debugLog(
             "request to %s %s%s errored - %s",
             method,
             origin,
-            path51,
+            path54,
             error63.message
           );
         }
@@ -37318,7 +37351,7 @@ var require_request = __commonJS({
     var kHandler = /* @__PURE__ */ Symbol("handler");
     var Request2 = class {
       constructor(origin, {
-        path: path51,
+        path: path54,
         method,
         body,
         headers,
@@ -37335,11 +37368,11 @@ var require_request = __commonJS({
         maxRedirections,
         typeOfService
       }, handler) {
-        if (typeof path51 !== "string") {
+        if (typeof path54 !== "string") {
           throw new InvalidArgumentError2("path must be a string");
-        } else if (path51[0] !== "/" && !(path51.startsWith("http://") || path51.startsWith("https://")) && method !== "CONNECT") {
+        } else if (path54[0] !== "/" && !(path54.startsWith("http://") || path54.startsWith("https://")) && method !== "CONNECT") {
           throw new InvalidArgumentError2("path must be an absolute URL or start with a slash");
-        } else if (invalidPathRegex.test(path51)) {
+        } else if (invalidPathRegex.test(path54)) {
           throw new InvalidArgumentError2("invalid request path");
         }
         if (typeof method !== "string") {
@@ -37414,7 +37447,7 @@ var require_request = __commonJS({
         this.completed = false;
         this.aborted = false;
         this.upgrade = upgrade || null;
-        this.path = query ? serializePathWithQuery(path51, query) : path51;
+        this.path = query ? serializePathWithQuery(path54, query) : path54;
         this.origin = origin;
         this.protocol = getProtocolFromUrlString(origin);
         this.idempotent = idempotent == null ? method === "HEAD" || method === "GET" : idempotent;
@@ -42596,7 +42629,7 @@ var require_client_h1 = __commonJS({
       return method !== "GET" && method !== "HEAD" && method !== "OPTIONS" && method !== "TRACE" && method !== "CONNECT";
     }
     function writeH1(client, request7) {
-      const { method, path: path51, host, upgrade, blocking, reset } = request7;
+      const { method, path: path54, host, upgrade, blocking, reset } = request7;
       let { body, headers, contentLength } = request7;
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH" || method === "QUERY" || method === "PROPFIND" || method === "PROPPATCH";
       if (util2.isFormDataLike(body)) {
@@ -42674,7 +42707,7 @@ var require_client_h1 = __commonJS({
       if (socket.setTypeOfService) {
         socket.setTypeOfService(request7.typeOfService);
       }
-      let header = `${method} ${path51} HTTP/1.1\r
+      let header = `${method} ${path54} HTTP/1.1\r
 `;
       if (typeof host === "string") {
         header += `host: ${host}\r
@@ -43353,7 +43386,7 @@ var require_client_h2 = __commonJS({
       const headersTimeout = request7.headersTimeout ?? client[kHeadersTimeout];
       const bodyTimeout = request7.bodyTimeout ?? client[kBodyTimeout];
       const session = client[kHTTP2Session];
-      const { method, path: path51, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request7;
+      const { method, path: path54, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request7;
       let { body } = request7;
       if (upgrade != null && upgrade !== "websocket") {
         util2.errorRequest(client, request7, new InvalidArgumentError2(`Custom upgrade "${upgrade}" not supported over HTTP/2`));
@@ -43422,7 +43455,7 @@ var require_client_h2 = __commonJS({
           }
           headers[HTTP2_HEADER_METHOD] = "CONNECT";
           headers[HTTP2_HEADER_PROTOCOL] = "websocket";
-          headers[HTTP2_HEADER_PATH] = path51;
+          headers[HTTP2_HEADER_PATH] = path54;
           if (protocol === "ws:" || protocol === "wss:") {
             headers[HTTP2_HEADER_SCHEME] = protocol === "ws:" ? "http" : "https";
           } else {
@@ -43464,7 +43497,7 @@ var require_client_h2 = __commonJS({
         stream.setTimeout(headersTimeout);
         return true;
       }
-      headers[HTTP2_HEADER_PATH] = path51;
+      headers[HTTP2_HEADER_PATH] = path54;
       headers[HTTP2_HEADER_SCHEME] = protocol === "http:" ? "http" : "https";
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH";
       if (body && typeof body.read === "function") {
@@ -45816,10 +45849,10 @@ var require_proxy_agent = __commonJS({
         };
         const {
           origin,
-          path: path51 = "/",
+          path: path54 = "/",
           headers = {}
         } = opts;
-        opts.path = origin + path51;
+        opts.path = origin + path54;
         if (!("host" in headers) && !("Host" in headers)) {
           const { host } = new URL(origin);
           headers.host = host;
@@ -47928,20 +47961,20 @@ var require_mock_utils = __commonJS({
       }
       return normalizedQp;
     }
-    function safeUrl(path51) {
-      if (typeof path51 !== "string") {
-        return path51;
+    function safeUrl(path54) {
+      if (typeof path54 !== "string") {
+        return path54;
       }
-      const pathSegments = path51.split("?", 3);
+      const pathSegments = path54.split("?", 3);
       if (pathSegments.length !== 2) {
-        return path51;
+        return path54;
       }
       const qp2 = new URLSearchParams(pathSegments.pop());
       qp2.sort();
       return [...pathSegments, qp2.toString()].join("?");
     }
-    function matchKey(mockDispatch2, { path: path51, method, body, headers }) {
-      const pathMatch = matchValue(mockDispatch2.path, path51);
+    function matchKey(mockDispatch2, { path: path54, method, body, headers }) {
+      const pathMatch = matchValue(mockDispatch2.path, path54);
       const methodMatch = matchValue(mockDispatch2.method, method);
       const bodyMatch = typeof mockDispatch2.body !== "undefined" ? matchValue(mockDispatch2.body, body) : true;
       const headersMatch = matchHeaders(mockDispatch2, headers);
@@ -47966,8 +47999,8 @@ var require_mock_utils = __commonJS({
       const basePath = key.query ? serializePathWithQuery(key.path, key.query) : key.path;
       const resolvedPath = typeof basePath === "string" ? safeUrl(basePath) : basePath;
       const resolvedPathWithoutTrailingSlash = removeTrailingSlash(resolvedPath);
-      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path51, ignoreTrailingSlash }) => {
-        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path51)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path51), resolvedPath);
+      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path54, ignoreTrailingSlash }) => {
+        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path54)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path54), resolvedPath);
       });
       if (matchedMockDispatches.length === 0) {
         throw new MockNotMatchedError(`Mock dispatch not matched for path '${resolvedPath}'`);
@@ -48006,19 +48039,19 @@ var require_mock_utils = __commonJS({
         mockDispatches.splice(index, 1);
       }
     }
-    function removeTrailingSlash(path51) {
-      while (path51.endsWith("/")) {
-        path51 = path51.slice(0, -1);
+    function removeTrailingSlash(path54) {
+      while (path54.endsWith("/")) {
+        path54 = path54.slice(0, -1);
       }
-      if (path51.length === 0) {
-        path51 = "/";
+      if (path54.length === 0) {
+        path54 = "/";
       }
-      return path51;
+      return path54;
     }
     function buildKey(opts) {
-      const { path: path51, method, body, headers, query } = opts;
+      const { path: path54, method, body, headers, query } = opts;
       return {
-        path: path51,
+        path: path54,
         method,
         body,
         headers,
@@ -48708,10 +48741,10 @@ var require_pending_interceptors_formatter = __commonJS({
       }
       format(pendingInterceptors) {
         const withPrettyHeaders = pendingInterceptors.map(
-          ({ method, path: path51, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
+          ({ method, path: path54, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
             Method: method,
             Origin: origin,
-            Path: path51,
+            Path: path54,
             "Status code": statusCode,
             Persistent: persist ? PERSISTENT : NOT_PERSISTENT,
             Invocations: timesInvoked,
@@ -48793,9 +48826,9 @@ var require_mock_agent = __commonJS({
         const acceptNonStandardSearchParameters = this[kMockAgentAcceptsNonStandardSearchParameters];
         const dispatchOpts = { ...opts };
         if (acceptNonStandardSearchParameters && dispatchOpts.path) {
-          const [path51, searchParams] = dispatchOpts.path.split("?");
+          const [path54, searchParams] = dispatchOpts.path.split("?");
           const normalizedSearchParams = normalizeSearchParams(searchParams, acceptNonStandardSearchParameters);
-          dispatchOpts.path = `${path51}?${normalizedSearchParams}`;
+          dispatchOpts.path = `${path54}?${normalizedSearchParams}`;
         }
         return this[kAgent].dispatch(dispatchOpts, handler);
       }
@@ -49196,12 +49229,12 @@ var require_snapshot_recorder = __commonJS({
        * @return {Promise<void>} - Resolves when snapshots are loaded
        */
       async loadSnapshots(filePath) {
-        const path51 = filePath || this.#snapshotPath;
-        if (!path51) {
+        const path54 = filePath || this.#snapshotPath;
+        if (!path54) {
           throw new InvalidArgumentError2("Snapshot path is required");
         }
         try {
-          const data = await readFile(resolve2(path51), "utf8");
+          const data = await readFile(resolve2(path54), "utf8");
           const parsed = JSON.parse(data);
           if (Array.isArray(parsed)) {
             this.#snapshots.clear();
@@ -49215,7 +49248,7 @@ var require_snapshot_recorder = __commonJS({
           if (error63.code === "ENOENT") {
             this.#snapshots.clear();
           } else {
-            throw new UndiciError(`Failed to load snapshots from ${path51}`, { cause: error63 });
+            throw new UndiciError(`Failed to load snapshots from ${path54}`, { cause: error63 });
           }
         }
       }
@@ -49226,11 +49259,11 @@ var require_snapshot_recorder = __commonJS({
        * @returns {Promise<void>} - Resolves when snapshots are saved
        */
       async saveSnapshots(filePath) {
-        const path51 = filePath || this.#snapshotPath;
-        if (!path51) {
+        const path54 = filePath || this.#snapshotPath;
+        if (!path54) {
           throw new InvalidArgumentError2("Snapshot path is required");
         }
-        const resolvedPath = resolve2(path51);
+        const resolvedPath = resolve2(path54);
         await mkdir(dirname3(resolvedPath), { recursive: true });
         const data = Array.from(this.#snapshots.entries()).map(([hash2, snapshot]) => ({
           hash: hash2,
@@ -49862,15 +49895,15 @@ var require_redirect_handler = __commonJS({
           return;
         }
         const { origin, pathname, search } = util2.parseURL(new URL(this.location, this.opts.origin && new URL(this.opts.path, this.opts.origin)));
-        const path51 = search ? `${pathname}${search}` : pathname;
-        const redirectUrlString = `${origin}${path51}`;
+        const path54 = search ? `${pathname}${search}` : pathname;
+        const redirectUrlString = `${origin}${path54}`;
         for (const historyUrl of this.history) {
           if (historyUrl.toString() === redirectUrlString) {
             throw new InvalidArgumentError2(`Redirect loop detected. Cannot redirect to ${origin}. This typically happens when using a Client or Pool with cross-origin redirects. Use an Agent for cross-origin redirects.`);
           }
         }
         this.opts.headers = cleanRequestHeaders(this.opts.headers, statusCode === 303, this.opts.origin !== origin);
-        this.opts.path = path51;
+        this.opts.path = path54;
         this.opts.origin = origin;
         this.opts.query = null;
       }
@@ -51630,10 +51663,10 @@ var require_cache_handler = __commonJS({
       }
       return locationUrl.pathname + locationUrl.search;
     }
-    function deleteCachedUri(store, cacheKey, path51) {
+    function deleteCachedUri(store, cacheKey, path54) {
       deleteCachedValue(store, {
         ...cacheKey,
-        path: path51
+        path: path54
       });
       for (let i10 = 0; i10 < util2.safeHTTPMethods.length; i10++) {
         const method = util2.safeHTTPMethods[i10];
@@ -51641,7 +51674,7 @@ var require_cache_handler = __commonJS({
           deleteCachedValue(store, {
             ...cacheKey,
             method,
-            path: path51
+            path: path54
           });
         }
       }
@@ -51652,9 +51685,9 @@ var require_cache_handler = __commonJS({
       }
       const values = Array.isArray(headerValue2) ? headerValue2 : [headerValue2];
       for (let i10 = 0; i10 < values.length; i10++) {
-        const path51 = getSameOriginPath(cacheKey, values[i10]);
-        if (path51 !== void 0) {
-          deleteCachedUri(store, cacheKey, path51);
+        const path54 = getSameOriginPath(cacheKey, values[i10]);
+        if (path54 !== void 0) {
+          deleteCachedUri(store, cacheKey, path54);
         }
       }
     }
@@ -56654,11 +56687,11 @@ var require_fetch = __commonJS({
       function dispatch({ body }) {
         const url2 = requestCurrentURL(request7);
         const agent = fetchParams.controller.dispatcher;
-        const path51 = url2.pathname + url2.search;
+        const path54 = url2.pathname + url2.search;
         const hasTrailingQuestionMark = url2.search.length === 0 && url2.href[url2.href.length - url2.hash.length - 1] === "?";
         return new Promise((resolve2, reject) => agent.dispatch(
           {
-            path: hasTrailingQuestionMark ? `${path51}?` : path51,
+            path: hasTrailingQuestionMark ? `${path54}?` : path54,
             origin: url2.origin,
             method: request7.method,
             body: agent.isMockActive ? request7.body && (request7.body.source || request7.body.stream) : body,
@@ -57605,9 +57638,9 @@ var require_util5 = __commonJS({
         }
       }
     }
-    function validateCookiePath(path51) {
-      for (let i10 = 0; i10 < path51.length; ++i10) {
-        const code = path51.charCodeAt(i10);
+    function validateCookiePath(path54) {
+      for (let i10 = 0; i10 < path54.length; ++i10) {
+        const code = path54.charCodeAt(i10);
         if (code < 32 || // exclude CTLs (0-31)
         code > 126 || // exclude DEL and non-ascii
         code === 59) {
@@ -60955,11 +60988,11 @@ var require_undici = __commonJS({
           if (typeof opts.path !== "string") {
             throw new InvalidArgumentError2("invalid opts.path");
           }
-          let path51 = opts.path;
+          let path54 = opts.path;
           if (!opts.path.startsWith("/")) {
-            path51 = `/${path51}`;
+            path54 = `/${path54}`;
           }
-          url2 = new URL(util2.parseOrigin(url2).origin + path51);
+          url2 = new URL(util2.parseOrigin(url2).origin + path54);
         } else {
           if (!opts) {
             opts = typeof url2 === "object" ? url2 : {};
@@ -62874,6 +62907,57 @@ var init_launchWiring = __esm({
   }
 });
 
+// src/usage/identityClaude.ts
+function definedEnvironment(env) {
+  return Object.fromEntries(Object.entries(env).flatMap(([name, value2]) => value2 === void 0 ? [] : [[name, value2]]));
+}
+function identityLaunchArgv(identity, flags) {
+  return [`@${identity}`, IDENTITY_ONLY_FLAG, ...flags];
+}
+async function withIdentityClaude(params, identity, flags, use2) {
+  const refusals = [];
+  const plan = prepareLaunch(
+    realPrepareLaunchParams(params.paths, {
+      proc: {
+        env: Object.fromEntries(Object.entries(process.env).filter(([name]) => name !== CONFIG_DIR_VARIABLE)),
+        argv: [...identityLaunchArgv(identity, flags)],
+        exit: (code) => {
+          throw new LaunchRefusedError(refusals.join("\n") || `the launch was refused (exit ${String(code)})`, code);
+        }
+      },
+      log: {
+        info: () => void 0,
+        warn: () => void 0,
+        error: (message) => {
+          refusals.push(message);
+        }
+      },
+      spawnDaemon: params.spawnDaemon,
+      farm: buildFarmRuntime(params.paths, params.cwd)
+    })
+  );
+  const abort = new AbortController();
+  const timer = setTimeout(() => {
+    abort.abort();
+  }, params.timeoutMs);
+  try {
+    return await use2({ bin: plan.bin, env: definedEnvironment(plan.env), cwd: params.cwd, abort });
+  } finally {
+    clearTimeout(timer);
+    plan.release();
+  }
+}
+var CONFIG_DIR_VARIABLE, IDENTITY_ONLY_FLAG;
+var init_identityClaude = __esm({
+  "src/usage/identityClaude.ts"() {
+    "use strict";
+    init_launchWiring();
+    init_launcher();
+    CONFIG_DIR_VARIABLE = "CLAUDE_CONFIG_DIR";
+    IDENTITY_ONLY_FLAG = "--no-provider";
+  }
+});
+
 // src/usage/providerQuota.ts
 function zaiWindow(limit) {
   const unitMs = ZAI_UNIT_MS.get(limit.unit);
@@ -62908,7 +62992,7 @@ async function openRouterGet(url2, schema, apiKey, http8, signal) {
   return parsed.data;
 }
 function nextUtcMidnight(nowMs) {
-  return new Date((Math.floor(nowMs / MS_PER_DAY) + 1) * MS_PER_DAY).toISOString();
+  return new Date((Math.floor(nowMs / MS_PER_DAY2) + 1) * MS_PER_DAY2).toISOString();
 }
 function adapterFor(baseUrl) {
   return PROVIDER_QUOTA_ADAPTERS.find((adapter) => adapter.matches(baseUrl));
@@ -62917,7 +63001,7 @@ function quotaFreshnessMs(quota) {
   const lengths = quota.windows.flatMap((window) => window.periodMs === void 0 ? [] : [window.periodMs]);
   return lengths.length === 0 ? Number.POSITIVE_INFINITY : Math.min(...lengths) / PERCENT3;
 }
-var ProviderQuotaError, MS_PER_SECOND5, SECONDS_PER_HOUR, HOURS_PER_DAY3, DAYS_PER_MONTH, PERCENT3, HTTP_OK, ZAI_SOURCE, ZAI_HOST, ZAI_QUOTA_URL, ZAI_UNIT_HOURS, ZAI_UNIT_MONTHS, ZAI_UNIT_MS, ZAI_MEASURES, ZaiLimitSchema, ZaiResponseSchema, zaiQuotaAdapter, OPENROUTER_SOURCE, OPENROUTER_HOST, OPENROUTER_KEY_URL, OPENROUTER_CREDITS_URL, HTTP_FORBIDDEN, MS_PER_DAY, OpenRouterKeySchema, OpenRouterCreditsSchema, openRouterQuotaAdapter, PROVIDER_QUOTA_ADAPTERS;
+var ProviderQuotaError, MS_PER_SECOND6, SECONDS_PER_HOUR, HOURS_PER_DAY3, DAYS_PER_MONTH, PERCENT3, HTTP_OK, ZAI_SOURCE, ZAI_HOST, ZAI_QUOTA_URL, ZAI_UNIT_HOURS, ZAI_UNIT_MONTHS, ZAI_UNIT_MS, ZAI_MEASURES, ZaiLimitSchema, ZaiResponseSchema, zaiQuotaAdapter, OPENROUTER_SOURCE, OPENROUTER_HOST, OPENROUTER_KEY_URL, OPENROUTER_CREDITS_URL, HTTP_FORBIDDEN, MS_PER_DAY2, OpenRouterKeySchema, OpenRouterCreditsSchema, openRouterQuotaAdapter, PROVIDER_QUOTA_ADAPTERS;
 var init_providerQuota = __esm({
   "src/usage/providerQuota.ts"() {
     "use strict";
@@ -62929,7 +63013,7 @@ var init_providerQuota = __esm({
         this.name = "ProviderQuotaError";
       }
     };
-    MS_PER_SECOND5 = 1e3;
+    MS_PER_SECOND6 = 1e3;
     SECONDS_PER_HOUR = 3600;
     HOURS_PER_DAY3 = 24;
     DAYS_PER_MONTH = 30;
@@ -62941,8 +63025,8 @@ var init_providerQuota = __esm({
     ZAI_UNIT_HOURS = 3;
     ZAI_UNIT_MONTHS = 5;
     ZAI_UNIT_MS = /* @__PURE__ */ new Map([
-      [ZAI_UNIT_HOURS, SECONDS_PER_HOUR * MS_PER_SECOND5],
-      [ZAI_UNIT_MONTHS, DAYS_PER_MONTH * HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND5]
+      [ZAI_UNIT_HOURS, SECONDS_PER_HOUR * MS_PER_SECOND6],
+      [ZAI_UNIT_MONTHS, DAYS_PER_MONTH * HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND6]
     ]);
     ZAI_MEASURES = { TOKENS_LIMIT: "tokens", TIME_LIMIT: "tool-calls" };
     ZaiLimitSchema = external_exports.object({
@@ -62994,7 +63078,7 @@ var init_providerQuota = __esm({
     OPENROUTER_KEY_URL = `https://${OPENROUTER_HOST}/api/v1/key`;
     OPENROUTER_CREDITS_URL = `https://${OPENROUTER_HOST}/api/v1/credits`;
     HTTP_FORBIDDEN = 403;
-    MS_PER_DAY = HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND5;
+    MS_PER_DAY2 = HOURS_PER_DAY3 * SECONDS_PER_HOUR * MS_PER_SECOND6;
     OpenRouterKeySchema = external_exports.object({
       data: external_exports.object({
         limit: external_exports.number().nonnegative().nullable(),
@@ -63025,7 +63109,7 @@ var init_providerQuota = __esm({
           windows.push({ measures: "account-credits", period: "prepaid", utilization: used / total, limit: total, used, remaining: Math.max(total - used, 0) });
         }
         if (free !== void 0 && free.limit > 0) {
-          windows.push({ measures: "free-model-requests", periodMs: MS_PER_DAY, utilization: free.used / free.limit, resetsAt: nextUtcMidnight(nowMs), limit: free.limit, used: free.used, remaining: Math.max(free.remaining, 0) });
+          windows.push({ measures: "free-model-requests", periodMs: MS_PER_DAY2, utilization: free.used / free.limit, resetsAt: nextUtcMidnight(nowMs), limit: free.limit, used: free.used, remaining: Math.max(free.remaining, 0) });
         }
         return ProviderQuotaSchema.parse({
           observedAt: new Date(nowMs).toISOString(),
@@ -96617,9 +96701,6 @@ var realAnthropicUsageProbe_exports = {};
 __export(realAnthropicUsageProbe_exports, {
   createRealAnthropicUsageRefresher: () => createRealAnthropicUsageRefresher
 });
-function definedEnvironment(env) {
-  return Object.fromEntries(Object.entries(env).flatMap(([name, value2]) => value2 === void 0 ? [] : [[name, value2]]));
-}
 function idlePrompt(signal) {
   return {
     [Symbol.asyncIterator]: () => ({
@@ -96632,58 +96713,28 @@ function idlePrompt(signal) {
   };
 }
 function createRealAnthropicUsageProbe(params) {
-  return async (identity) => {
-    const refusals = [];
-    const plan = prepareLaunch(
-      realPrepareLaunchParams(params.paths, {
-        proc: {
-          env: Object.fromEntries(Object.entries(process.env).filter(([name]) => name !== CONFIG_DIR_VARIABLE)),
-          argv: [`@${identity}`, ...PROBE_LAUNCH_FLAGS],
-          exit: (code) => {
-            throw new LaunchRefusedError(refusals.join("\n") || `the launch was refused (exit ${String(code)})`, code);
-          }
-        },
-        log: {
-          info: () => void 0,
-          warn: () => void 0,
-          error: (message) => {
-            refusals.push(message);
-          }
-        },
-        spawnDaemon: params.spawnDaemon,
-        farm: buildFarmRuntime(params.paths, params.cwd)
-      })
-    );
+  return async (identity) => await withIdentityClaude(params, identity, PROBE_LAUNCH_FLAGS, async ({ bin, env, cwd, abort }) => {
     const { query } = await Promise.resolve().then(() => (init_sdk(), sdk_exports));
-    const abort = new AbortController();
-    const timer = setTimeout(() => {
-      abort.abort();
-    }, params.timeoutMs);
-    try {
-      const session = query({
-        prompt: idlePrompt(abort.signal),
-        options: {
-          pathToClaudeCodeExecutable: plan.bin,
-          env: definedEnvironment(plan.env),
-          cwd: params.cwd,
-          abortController: abort,
-          settingSources: [],
-          mcpServers: {},
-          strictMcpConfig: true,
-          persistSession: false
-        }
-      });
-      try {
-        const report = await session.usage_EXPERIMENTAL_MAY_CHANGE_DO_NOT_RELY_ON_THIS_API_YET({ skipBehaviors: true });
-        return unifiedFromReportedLimits(report.rate_limits_available ? report.rate_limits : null);
-      } finally {
-        session.close();
+    const session = query({
+      prompt: idlePrompt(abort.signal),
+      options: {
+        pathToClaudeCodeExecutable: bin,
+        env,
+        cwd,
+        abortController: abort,
+        settingSources: [],
+        mcpServers: {},
+        strictMcpConfig: true,
+        persistSession: false
       }
+    });
+    try {
+      const report = await session.usage_EXPERIMENTAL_MAY_CHANGE_DO_NOT_RELY_ON_THIS_API_YET({ skipBehaviors: true });
+      return unifiedFromReportedLimits(report.rate_limits_available ? report.rate_limits : null);
     } finally {
-      clearTimeout(timer);
-      plan.release();
+      session.close();
     }
-  };
+  });
 }
 function createRealAnthropicUsageRefresher(params) {
   return createAnthropicUsageRefresher({
@@ -96696,18 +96747,16 @@ function createRealAnthropicUsageRefresher(params) {
     concurrency: (0, import_node_os11.availableParallelism)()
   });
 }
-var import_node_os11, PROBE_LAUNCH_FLAGS, CONFIG_DIR_VARIABLE;
+var import_node_os11, PROBE_LAUNCH_FLAGS;
 var init_realAnthropicUsageProbe = __esm({
   "src/usage/realAnthropicUsageProbe.ts"() {
     "use strict";
     import_node_os11 = require("node:os");
-    init_launchWiring();
-    init_launcher();
     init_anthropicUsageRefresh();
+    init_identityClaude();
     init_middleware();
     init_quotaRefresh();
     PROBE_LAUNCH_FLAGS = ["--no-headroom", "--no-remote-control"];
-    CONFIG_DIR_VARIABLE = "CLAUDE_CONFIG_DIR";
   }
 });
 
@@ -99940,8 +99989,8 @@ var require_utils3 = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path51) {
-      let input2 = path51;
+    function removeDotSegments(path54) {
+      let input2 = path54;
       const output2 = [];
       let nextSlash = -1;
       let len = 0;
@@ -100350,8 +100399,8 @@ var require_schemes = __commonJS({
       }
       if (wsComponent.resourceName) {
         const queryIndex = wsComponent.resourceName.indexOf("?");
-        const path51 = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
-        wsComponent.path = path51 && path51 !== "/" ? path51 : void 0;
+        const path54 = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
+        wsComponent.path = path54 && path54 !== "/" ? path54 : void 0;
         wsComponent.query = queryIndex === -1 ? void 0 : wsComponent.resourceName.slice(queryIndex + 1);
         wsComponent.resourceName = void 0;
       }
@@ -103878,7 +103927,7 @@ var require_dist2 = __commonJS({
 });
 
 // src/cli.ts
-var import_node_path50 = __toESM(require("node:path"), 1);
+var import_node_path53 = __toESM(require("node:path"), 1);
 
 // node_modules/.pnpm/commander@15.0.0/node_modules/commander/lib/error.js
 var CommanderError = class extends Error {
@@ -106991,9 +107040,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
    * @param {string} [path]
    * @return {(string|null|Command)}
    */
-  executableDir(path51) {
-    if (path51 === void 0) return this._executableDir;
-    this._executableDir = path51;
+  executableDir(path54) {
+    if (path54 === void 0) return this._executableDir;
+    this._executableDir = path54;
     return this;
   }
   /**
@@ -108642,19 +108691,19 @@ function writePools(paths, pools) {
   applyPatch(paths.globalConfigFile, GlobalConfigSchema, { pools }, { defaults: {} });
 }
 function poolCycleOf(pools, name) {
-  const walk = (current, path51) => {
+  const walk = (current, path54) => {
     for (const entry of pools[current]?.identities ?? []) {
       const nested = poolNameOf(poolMemberIdentity(entry));
       if (nested === void 0) {
         continue;
       }
       if (nested === name) {
-        return [...path51, nested];
+        return [...path54, nested];
       }
-      if (path51.includes(nested)) {
+      if (path54.includes(nested)) {
         continue;
       }
-      const found = walk(nested, [...path51, nested]);
+      const found = walk(nested, [...path54, nested]);
       if (found !== void 0) {
         return found;
       }
@@ -108805,6 +108854,18 @@ function listIdentities(paths) {
   }
   return result;
 }
+function listAnchoredIdentities(paths) {
+  return listIdentities(paths).flatMap(({ name }) => {
+    const anchors = readIdentity(paths, name)?.anchors;
+    return anchors === void 0 ? [] : [{ identity: name, anchors }];
+  });
+}
+function setIdentityAnchors(paths, identityName, anchors) {
+  if (!identityExists(paths, identityName)) {
+    throw new IdentityNotFoundError(identityName);
+  }
+  return applyPatch(identityJsonPath(paths, identityName), IdentitySchema, { anchors: anchors === void 0 ? void 0 : [...anchors] });
+}
 function setDefaultConfigProfile(paths, identityName, profileName) {
   if (!identityExists(paths, identityName)) {
     throw new IdentityNotFoundError(identityName);
@@ -109583,6 +109644,141 @@ function cacheChange(options, existing) {
   }
 }
 
+// src/usage/anchor.ts
+init_schema();
+var MS_PER_SECOND = 1e3;
+var MS_PER_MINUTE2 = 6e4;
+var MINUTES_PER_HOUR = 60;
+var DAYS_IN_WEEK = 7;
+var MS_PER_DAY = 864e5;
+var SEARCH_MARGIN_DAYS = 1;
+var WORKING_DAYS = 5;
+var WEEKDAY_SHORTHANDS = { daily: WEEKDAYS, weekdays: WEEKDAYS.slice(0, WORKING_DAYS) };
+function zoneOffsetMs(utcMs, timeZone) {
+  const wholeSecondMs = Math.floor(utcMs / MS_PER_SECOND) * MS_PER_SECOND;
+  const parts = new Intl.DateTimeFormat("en-GB", { timeZone, hourCycle: "h23", year: "numeric", month: "2-digit", day: "2-digit", hour: "2-digit", minute: "2-digit", second: "2-digit" }).formatToParts(new Date(wholeSecondMs));
+  const field = (type2) => Number(parts.find((part) => part.type === type2)?.value);
+  return Date.UTC(field("year"), field("month") - 1, field("day"), field("hour"), field("minute"), field("second")) - wholeSecondMs;
+}
+function wallTimeToUtcMs(date5, minutesOfDay, timeZone) {
+  const asUtc = Date.UTC(date5.year, date5.month - 1, date5.day) + minutesOfDay * MS_PER_MINUTE2;
+  const candidates = [zoneOffsetMs(asUtc - MS_PER_DAY, timeZone), zoneOffsetMs(asUtc + MS_PER_DAY, timeZone)].map((offset) => ({ offset, instant: asUtc - offset }));
+  const valid = candidates.filter(({ offset, instant }) => zoneOffsetMs(instant, timeZone) === offset).map(({ instant }) => instant);
+  return valid.length === 0 ? asUtc - (candidates[0]?.offset ?? 0) : Math.min(...valid);
+}
+function localDate(utcMs, timeZone) {
+  const local = new Date(utcMs + zoneOffsetMs(utcMs, timeZone));
+  return { year: local.getUTCFullYear(), month: local.getUTCMonth() + 1, day: local.getUTCDate() };
+}
+function weekdayOf(date5) {
+  const sundayFirst = new Date(Date.UTC(date5.year, date5.month - 1, date5.day)).getUTCDay();
+  const day = WEEKDAYS[(sundayFirst + DAYS_IN_WEEK - 1) % DAYS_IN_WEEK];
+  if (day === void 0) {
+    throw new RangeError(`no weekday for day number ${String(sundayFirst)}`);
+  }
+  return day;
+}
+function minutesOfDayOf(time4) {
+  const [hours, minutes] = time4.split(":").map(Number);
+  return (hours ?? 0) * MINUTES_PER_HOUR + (minutes ?? 0);
+}
+function anchorInstants(anchors, afterMs, uptoMs, defaultTimeZone) {
+  const instants = anchors.flatMap((anchor2) => {
+    const timeZone = anchor2.timeZone ?? defaultTimeZone;
+    const minutesOfDay = minutesOfDayOf(anchor2.time);
+    const first = localDate(afterMs - SEARCH_MARGIN_DAYS * MS_PER_DAY, timeZone);
+    const found = [];
+    for (let offset = 0; ; offset += 1) {
+      const date5 = localDate(Date.UTC(first.year, first.month - 1, first.day + offset) + MS_PER_DAY / 2, "UTC");
+      const instant = wallTimeToUtcMs(date5, minutesOfDay, timeZone);
+      if (instant > uptoMs + SEARCH_MARGIN_DAYS * MS_PER_DAY) {
+        return found;
+      }
+      if (instant > afterMs && instant <= uptoMs && anchor2.days.includes(weekdayOf(date5))) {
+        found.push(instant);
+      }
+    }
+  });
+  return instants.sort((left, right) => left - right);
+}
+function dueAnchor(anchors, nowMs, handledMs, defaultTimeZone) {
+  const since = Math.max(handledMs, nowMs - DAYS_IN_WEEK * MS_PER_DAY);
+  return anchorInstants(anchors, since, nowMs, defaultTimeZone).at(-1);
+}
+function parseDayItem(item) {
+  const [from, to2, ...extra] = item.split("-");
+  const index = (name) => WEEKDAYS.findIndex((day) => day === name);
+  if (from === void 0 || extra.length > 0 || index(from) === -1 || to2 !== void 0 && index(to2) === -1) {
+    throw new Error(`"${item}" is not a weekday (${WEEKDAYS.join(", ")}) or a range such as mon-fri`);
+  }
+  if (to2 === void 0) {
+    return [WEEKDAYS[index(from)] ?? "mon"];
+  }
+  const length = (index(to2) - index(from) + DAYS_IN_WEEK) % DAYS_IN_WEEK + 1;
+  return Array.from({ length }, (_, step2) => WEEKDAYS[(index(from) + step2) % DAYS_IN_WEEK] ?? "mon");
+}
+function parseAnchor(spec) {
+  const match = /^(?<days>[^@]+)@(?<time>[^/]+)(?:\/(?<zone>.+))?$/.exec(spec);
+  const { days, time: time4, zone } = match?.groups ?? {};
+  if (days === void 0 || time4 === void 0) {
+    throw new Error(`"${spec}" is not an anchor: write <days>@<HH:MM>[/<time zone>], such as mon-fri@06:00 or sat,sun@08:30/Europe/London`);
+  }
+  const named = WEEKDAY_SHORTHANDS[days] ?? days.split(",").flatMap(parseDayItem);
+  const parsed = AnchorSchema.safeParse({ days: [...new Set(named)], time: time4, ...zone === void 0 ? {} : { timeZone: zone } });
+  if (!parsed.success) {
+    throw new Error(`"${spec}" is not an anchor: ${parsed.error.issues.map((issue2) => issue2.message).join("; ")}`);
+  }
+  return parsed.data;
+}
+var ANCHOR_SYNTAX = "<days>@<HH:MM>[/<time zone>], where days are daily, weekdays, or weekday names and ranges such as mon,wed or mon-fri, and the zone defaults to the machine's own";
+function formatAnchor(anchor2) {
+  return `${anchor2.days.join(",")}@${anchor2.time}${anchor2.timeZone === void 0 ? "" : `/${anchor2.timeZone}`}`;
+}
+function machineTimeZone() {
+  return new Intl.DateTimeFormat().resolvedOptions().timeZone;
+}
+
+// src/cli/parsers.ts
+init_conditions();
+init_pairs();
+function asInvalidArgument(parse4) {
+  try {
+    return parse4();
+  } catch (error63) {
+    if (error63 instanceof Error && !(error63 instanceof InvalidArgumentError)) {
+      throw new InvalidArgumentError(error63.message);
+    }
+    throw error63;
+  }
+}
+function collectBoolPair(value2, previous = {}) {
+  return asInvalidArgument(() => {
+    const { key, value: raw } = parsePair(value2);
+    return { ...previous, [key]: parseBool(raw) };
+  });
+}
+function collectStringPair(value2, previous = {}) {
+  return asInvalidArgument(() => {
+    const { key, value: raw } = parsePair(value2);
+    return { ...previous, [key]: raw };
+  });
+}
+function collectRepeated(value2, previous = []) {
+  return [...previous, value2];
+}
+function collectAnchor(value2, previous = []) {
+  return [...previous, asInvalidArgument(() => parseAnchor(value2))];
+}
+function parseDurationLiteral(value2) {
+  return asInvalidArgument(() => {
+    parseDuration(value2);
+    return value2;
+  });
+}
+function parseDurationOption(value2) {
+  return asInvalidArgument(() => parseDuration(value2));
+}
+
 // src/identityManager.ts
 init_classify();
 init_schema();
@@ -109636,40 +109832,6 @@ async function resolveFarmConflicts(params) {
 
 // src/configProfiles.ts
 init_commandDeps();
-
-// src/cli/parsers.ts
-init_conditions();
-init_pairs();
-function asInvalidArgument(parse4) {
-  try {
-    return parse4();
-  } catch (error63) {
-    if (error63 instanceof Error && !(error63 instanceof InvalidArgumentError)) {
-      throw new InvalidArgumentError(error63.message);
-    }
-    throw error63;
-  }
-}
-function collectBoolPair(value2, previous = {}) {
-  return asInvalidArgument(() => {
-    const { key, value: raw } = parsePair(value2);
-    return { ...previous, [key]: parseBool(raw) };
-  });
-}
-function collectStringPair(value2, previous = {}) {
-  return asInvalidArgument(() => {
-    const { key, value: raw } = parsePair(value2);
-    return { ...previous, [key]: raw };
-  });
-}
-function collectRepeated(value2, previous = []) {
-  return [...previous, value2];
-}
-function parseDurationOption(value2) {
-  return asInvalidArgument(() => parseDuration(value2));
-}
-
-// src/configProfiles.ts
 init_cliError();
 async function ensureProfileExists(deps, name) {
   if (profileExists(deps.paths, name)) {
@@ -109899,7 +110061,8 @@ function toIdentityView(paths, entry) {
     ...entry.problem === void 0 ? {
       ...entry.identity.defaultConfigProfile === void 0 ? {} : { defaultConfigProfile: entry.identity.defaultConfigProfile },
       allowAmbientCredential: entry.identity.allowAmbientCredential,
-      ...entry.identity.credential === void 0 ? {} : { credential: summariseCredential(entry.identity.credential) }
+      ...entry.identity.credential === void 0 ? {} : { credential: summariseCredential(entry.identity.credential) },
+      ...entry.identity.anchors === void 0 ? {} : { anchors: entry.identity.anchors }
     } : { problem: entry.problem }
   };
 }
@@ -109968,6 +110131,7 @@ function registerIdentityCommand(program2, deps) {
       console.log(`Default configuration profile: ${view.defaultConfigProfile ?? "(none)"}`);
       console.log(`Allows ambient credential: ${view.allowAmbientCredential === true ? "yes" : "no"}`);
       console.log(`Credential: ${entry.identity?.credential === void 0 ? "(none; uses its stored login)" : describeCredential(entry.identity.credential)}`);
+      console.log(`Anchors: ${view.anchors === void 0 ? "(none)" : view.anchors.map(formatAnchor).join(" ")}`);
     }),
     ["agent-shim identity show work", "agent-shim identity show work --json"]
   );
@@ -109975,7 +110139,11 @@ function registerIdentityCommand(program2, deps) {
     "--credential <source>",
     `Authenticate this identity from a token instead of its stored login, replacing any existing sources (repeatable, in the order tried): ${CREDENTIAL_SOURCE_SYNTAX}.`,
     collectCredentialSource
-  ).option("--no-credential", "Remove this identity's credential, returning it to its stored login.").addOption(
+  ).option("--no-credential", "Remove this identity's credential, returning it to its stored login.").option(
+    "--anchor <spec>",
+    `Have the front door open a five-hour window for this identity at these times when none is open, so its window resets when you want (repeatable, replacing any existing anchors): ${ANCHOR_SYNTAX}.`,
+    collectAnchor
+  ).option("--no-anchor", "Remove this identity's anchors.").addOption(
     new Option(
       "--credential-target <target>",
       "Where the token goes: oauthToken sets CLAUDE_CODE_OAUTH_TOKEN (a `claude setup-token` token), bearer sets ANTHROPIC_AUTH_TOKEN (the default), apiKey sets ANTHROPIC_API_KEY."
@@ -109987,7 +110155,7 @@ function registerIdentityCommand(program2, deps) {
       const { json: json2, ...options } = allOptions;
       if (Object.entries(allOptions).every(([key, value2]) => key === "json" || value2 === void 0)) {
         throw new UsageError(
-          "Nothing to change: pass --default-profile, --no-default-profile, --allow-ambient-credential, --no-allow-ambient-credential, --credential, --no-credential, --credential-target or a --credential-cache option."
+          "Nothing to change: pass --default-profile, --no-default-profile, --allow-ambient-credential, --no-allow-ambient-credential, --credential, --no-credential, --credential-target, --anchor, --no-anchor or a --credential-cache option."
         );
       }
       if (!identityExists(paths, name)) {
@@ -110022,6 +110190,10 @@ function registerIdentityCommand(program2, deps) {
           messages.push(`Identity "${name}" now authenticates with credential ${describeCredential(updated.credential)}.`);
         }
       }
+      if (options.anchor !== void 0) {
+        const updated = setIdentityAnchors(paths, name, options.anchor === false ? void 0 : options.anchor);
+        messages.push(updated.anchors === void 0 ? `Identity "${name}" no longer has anchors.` : `Identity "${name}" now has anchors ${updated.anchors.map(formatAnchor).join(" ")}.`);
+      }
       reportMutation(json2, { action: "updated", kind: "identity", name, value: readIdentity(paths, name) }, () => {
         for (const message of messages) {
           console.log(message);
@@ -110032,7 +110204,9 @@ function registerIdentityCommand(program2, deps) {
       "agent-shim identity set work --default-profile client-acme",
       "agent-shim identity set work --allow-ambient-credential",
       "agent-shim identity set work --credential-target oauthToken --credential op:op://vault/claude-work/token",
-      "agent-shim identity set work --no-credential"
+      "agent-shim identity set work --no-credential",
+      "agent-shim identity set work --anchor mon-fri@06:00",
+      "agent-shim identity set work --no-anchor"
     ]
   );
   withExamples(
@@ -110782,7 +110956,7 @@ var SIWC_PLAN_SCOPE = "chatgpt.tokens.use.direct";
 var SIWC_CALLBACK_PORT = 1455;
 var SIWC_CALLBACK_PATH = "/auth/callback";
 var SIWC_RANDOM_BYTES = 32;
-var MS_PER_SECOND4 = 1e3;
+var MS_PER_SECOND5 = 1e3;
 var ID_TOKEN_ALGORITHM = "RS256";
 var SiwcError = class extends Error {
   constructor(message) {
@@ -110878,7 +111052,7 @@ function grantTokens(ports, answer) {
     refreshToken: answer.refresh_token,
     idToken: answer.id_token,
     scopes: answer.scope === void 0 ? void 0 : answer.scope.split(" ").filter((part) => part !== ""),
-    expiresAt: ports.now().getTime() + answer.expires_in * MS_PER_SECOND4
+    expiresAt: ports.now().getTime() + answer.expires_in * MS_PER_SECOND5
   };
 }
 async function exchangeCode(ports, request7) {
@@ -110939,7 +111113,7 @@ async function verifyIdToken(ports, idToken, expected) {
   if (!(Array.isArray(claims.aud) ? claims.aud : [claims.aud]).includes(expected.clientId)) {
     throw new SiwcError("the ID token was issued for a different client");
   }
-  if (claims.exp * MS_PER_SECOND4 <= ports.now().getTime()) {
+  if (claims.exp * MS_PER_SECOND5 <= ports.now().getTime()) {
     throw new SiwcError("the ID token has already expired");
   }
   if (expected.nonce !== void 0 && claims.nonce !== expected.nonce) {
@@ -111471,7 +111645,7 @@ function registerCodexCommand(program2, deps) {
 
 // src/frontdoor/commands.ts
 var import_node_crypto20 = require("node:crypto");
-var import_node_path45 = __toESM(require("node:path"), 1);
+var import_node_path47 = __toESM(require("node:path"), 1);
 var import_node_fs16 = __toESM(require("node:fs"), 1);
 init_commandDeps();
 init_schema();
@@ -111672,6 +111846,63 @@ function registerUpdateCommand(program2, deps, ports = realUpdatePorts) {
   );
 }
 
+// src/jobStore.ts
+init_cliError();
+init_store();
+init_schema();
+var JobNotFoundError = class extends CliError {
+  constructor(jobName) {
+    super(`No job named "${jobName}". Run \`agent-shim job add ${jobName} ...\` first.`);
+    this.jobName = jobName;
+    this.name = "JobNotFoundError";
+  }
+  jobName;
+};
+var JobAlreadyExistsError = class extends CliError {
+  constructor(jobName) {
+    super(`A job named "${jobName}" already exists. Remove it with \`agent-shim job remove ${jobName}\` to define it again.`);
+    this.jobName = jobName;
+    this.name = "JobAlreadyExistsError";
+  }
+  jobName;
+};
+var InvalidJobNameError = class extends CliError {
+  constructor(attemptedName) {
+    super(`"${attemptedName}" is not a valid job name: it must start with a letter or number and may then contain letters, numbers, dots, hyphens and underscores.`);
+    this.attemptedName = attemptedName;
+    this.name = "InvalidJobNameError";
+  }
+  attemptedName;
+};
+function readJobs(paths) {
+  return readGlobalConfig(paths)?.jobs ?? {};
+}
+function requireJob(paths, name) {
+  const job = readJobs(paths)[name];
+  if (job === void 0) {
+    throw new JobNotFoundError(name);
+  }
+  return job;
+}
+function writeJobs(paths, jobs) {
+  applyPatch(paths.globalConfigFile, GlobalConfigSchema, { jobs }, { defaults: {} });
+}
+function addJob(paths, name, job) {
+  if (!PoolNameSchema.safeParse(name).success) {
+    throw new InvalidJobNameError(name);
+  }
+  const jobs = readJobs(paths);
+  if (jobs[name] !== void 0) {
+    throw new JobAlreadyExistsError(name);
+  }
+  writeJobs(paths, { ...jobs, [name]: job });
+  return job;
+}
+function removeJob(paths, name) {
+  requireJob(paths, name);
+  writeJobs(paths, Object.fromEntries(Object.entries(readJobs(paths)).filter(([existing]) => existing !== name)));
+}
+
 // src/launcher/poolRefresh.ts
 init_anthropicUsageRefresh();
 async function refreshStalePoolMembers(params) {
@@ -111686,6 +111917,317 @@ async function refreshStalePoolMembers(params) {
 init_anthropicUsageRefresh();
 init_poolPick();
 init_realAnthropicUsageProbe();
+
+// src/usage/realJobRunner.ts
+var import_node_path38 = __toESM(require("node:path"), 1);
+init_conditions();
+init_identityClaude();
+var JOB_LAUNCH_FLAGS = ["--no-headroom", "--no-remote-control", "--track-usage"];
+var JOB_ISOLATION_OPTIONS = { settingSources: ["user"], mcpServers: {}, strictMcpConfig: true };
+function logEntry(name, identity, endedAt, outcome) {
+  return `${endedAt.toISOString()} job ${name} as ${identity}
+${outcome.trimEnd()}
+
+`;
+}
+function createRealJobRunner(params) {
+  return async (name, identity, job) => {
+    const logFile = import_node_path38.default.join(params.paths.jobLogsDir, `${name}.log`);
+    const append = (outcome) => {
+      params.fs.mkdirPrivate(params.paths.jobLogsDir);
+      params.fs.appendFilePrivate(logFile, logEntry(name, identity, params.now(), outcome));
+    };
+    try {
+      const result = await withIdentityClaude({ paths: params.paths, spawnDaemon: params.spawnDaemon, cwd: job.cwd, timeoutMs: parseDuration(job.timeout) }, identity, JOB_LAUNCH_FLAGS, async ({ bin, env, cwd, abort }) => {
+        const { query } = await Promise.resolve().then(() => (init_sdk(), sdk_exports));
+        const session = query({
+          prompt: job.prompt,
+          options: {
+            pathToClaudeCodeExecutable: bin,
+            env,
+            cwd,
+            abortController: abort,
+            settingSources: [...JOB_ISOLATION_OPTIONS.settingSources],
+            mcpServers: JOB_ISOLATION_OPTIONS.mcpServers,
+            strictMcpConfig: JOB_ISOLATION_OPTIONS.strictMcpConfig,
+            permissionMode: "dontAsk",
+            ...job.model === void 0 ? {} : { model: job.model },
+            ...job.allowedTools === void 0 ? {} : { allowedTools: [...job.allowedTools] }
+          }
+        });
+        try {
+          for await (const message of session) {
+            if (message.type === "result") {
+              if (message.subtype !== "success") {
+                throw new Error(`the run ended as ${message.subtype}`);
+              }
+              return message.result;
+            }
+          }
+          throw new Error("the run ended without a result");
+        } finally {
+          session.close();
+        }
+      });
+      append(result);
+    } catch (error63) {
+      append(`FAILED: ${error63 instanceof Error ? error63.message : String(error63)}`);
+      throw error63;
+    }
+  };
+}
+
+// src/usage/realWindowOpener.ts
+init_identityClaude();
+var OPENER_LAUNCH_FLAGS = ["--no-headroom", "--no-remote-control", "--track-usage"];
+var WINDOW_OPENING_MODEL = "haiku";
+var WINDOW_OPENING_PROMPT = "ok";
+var WINDOW_OPENING_SYSTEM_PROMPT = "Reply with one word.";
+var WINDOW_OPEN_TIMEOUT_MS = 6e4;
+function createRealWindowOpener(params) {
+  return async (identity) => {
+    await withIdentityClaude({ ...params, timeoutMs: WINDOW_OPEN_TIMEOUT_MS }, identity, OPENER_LAUNCH_FLAGS, async ({ bin, env, cwd, abort }) => {
+      const { query } = await Promise.resolve().then(() => (init_sdk(), sdk_exports));
+      const session = query({
+        prompt: WINDOW_OPENING_PROMPT,
+        options: {
+          pathToClaudeCodeExecutable: bin,
+          env,
+          cwd,
+          abortController: abort,
+          settingSources: [],
+          mcpServers: {},
+          strictMcpConfig: true,
+          persistSession: false,
+          model: WINDOW_OPENING_MODEL,
+          maxTurns: 1,
+          tools: [],
+          systemPrompt: WINDOW_OPENING_SYSTEM_PROMPT,
+          thinking: { type: "disabled" }
+        }
+      });
+      try {
+        for await (const message of session) {
+          if (message.type === "result") {
+            if (message.subtype !== "success") {
+              throw new Error(`the opening request ended as ${message.subtype}`);
+            }
+            return;
+          }
+        }
+        throw new Error("the opening request ended without a result");
+      } finally {
+        session.close();
+      }
+    });
+  };
+}
+
+// src/usage/jobKeeper.ts
+init_conditions();
+
+// src/usage/handledStamps.ts
+var import_node_path39 = __toESM(require("node:path"), 1);
+init_zod();
+var STAMPS_SCHEMA_VERSION = 1;
+var StampsFileSchema = external_exports.strictObject({
+  schemaVersion: external_exports.literal(STAMPS_SCHEMA_VERSION),
+  handled: external_exports.record(external_exports.string().min(1), external_exports.iso.datetime())
+});
+function readHandled(fs22, file2) {
+  const raw = fs22.readFileUtf8(file2);
+  if (raw === void 0) {
+    return {};
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    parsed = void 0;
+  }
+  const result = StampsFileSchema.safeParse(parsed);
+  return result.success ? Object.fromEntries(Object.entries(result.data.handled).map(([key, at2]) => [key, Date.parse(at2)])) : {};
+}
+function writeHandled(fs22, file2, handled) {
+  const next = { schemaVersion: STAMPS_SCHEMA_VERSION, handled: Object.fromEntries(Object.entries(handled).map(([key, at2]) => [key, new Date(at2).toISOString()])) };
+  fs22.mkdirPrivate(import_node_path39.default.dirname(file2));
+  fs22.writeFilePrivate(file2, `${JSON.stringify(next, null, 2)}
+`);
+}
+
+// src/usage/jobKeeper.ts
+init_middleware();
+init_preflight();
+
+// src/usage/windowKeeper.ts
+init_preflight();
+init_pick();
+init_middleware();
+function refusalReason(identity, snapshot, nowMs) {
+  if (snapshot === void 0) {
+    return void 0;
+  }
+  const candidate = rankPool({ members: [{ identity, snapshot, records: [] }], nowMs, resuming: false }).candidates[0];
+  return candidate?.class === "ineligible" ? `it is refused right now (${candidate.reasons[0] ?? "no reason recorded"})` : void 0;
+}
+function reasonNotToOpen(identity, snapshot, nowMs) {
+  if (snapshot === void 0) {
+    return void 0;
+  }
+  const unified = snapshot.providers[ANTHROPIC_PROVIDER]?.rateLimit?.unified;
+  if (unified !== void 0 && unified.fiveHour === void 0 && unified.sevenDay === void 0) {
+    return "it reports no plan windows, so there is no five-hour window to anchor";
+  }
+  const five = unified?.fiveHour === void 0 ? void 0 : effectiveWindow(unified.fiveHour, nowMs);
+  if (five?.resetsAtMs !== void 0) {
+    return `a five-hour window is already open, resetting in ${formatAge(five.resetsAtMs - nowMs)}`;
+  }
+  return refusalReason(identity, snapshot, nowMs);
+}
+async function runWindowKeeper(ports) {
+  const nowMs = ports.nowMs();
+  const anchored = ports.anchored();
+  const previous = readHandled(ports.fs, ports.stampsFile);
+  const handled = Object.fromEntries(anchored.flatMap(({ identity }) => previous[identity] === void 0 ? [] : [[identity, previous[identity]]]));
+  const outcomes = [];
+  for (const { identity, anchors } of anchored) {
+    const last = handled[identity];
+    if (last === void 0) {
+      handled[identity] = nowMs;
+      outcomes.push({ identity, status: "armed", detail: "anchors noted; the next anchor to fall is the first acted on" });
+      continue;
+    }
+    const due2 = dueAnchor(anchors, nowMs, last, ports.timeZone);
+    if (due2 === void 0) {
+      outcomes.push({ identity, status: "waiting", detail: "no anchor has fallen since the last handled" });
+      continue;
+    }
+    handled[identity] = nowMs;
+    const reason = reasonNotToOpen(identity, ports.snapshot(identity), nowMs);
+    if (reason !== void 0) {
+      outcomes.push({ identity, status: "skipped", detail: `anchor ${new Date(due2).toISOString()}: ${reason}` });
+      continue;
+    }
+    try {
+      await ports.open(identity);
+      outcomes.push({ identity, status: "opened", detail: `anchor ${new Date(due2).toISOString()}: opened a five-hour window` });
+    } catch (error63) {
+      outcomes.push({ identity, status: "failed", detail: `anchor ${new Date(due2).toISOString()}: could not open a window: ${error63 instanceof Error ? error63.message : String(error63)}` });
+    }
+  }
+  writeHandled(ports.fs, ports.stampsFile, handled);
+  for (const outcome of outcomes) {
+    if (outcome.status === "opened" || outcome.status === "skipped" || outcome.status === "failed") {
+      ports.log(`window keeper: ${outcome.identity}: ${outcome.detail}`);
+    }
+  }
+  return outcomes;
+}
+
+// src/usage/jobKeeper.ts
+function pendingReset(snapshot, window, nowMs) {
+  const recorded = snapshot?.providers[ANTHROPIC_PROVIDER]?.rateLimit?.unified?.[window];
+  return recorded === void 0 ? void 0 : effectiveWindow(recorded, nowMs).resetsAtMs;
+}
+function runJobs(ports) {
+  const nowMs = ports.nowMs();
+  const jobs = ports.jobs();
+  const previous = readHandled(ports.fs, ports.stampsFile);
+  const handled = Object.fromEntries(jobs.flatMap(({ name }) => previous[name] === void 0 ? [] : [[name, previous[name]]]));
+  const outcomes = [];
+  const runs = [];
+  const start = (name, identity, job, stamp, detail) => {
+    handled[name] = stamp;
+    ports.running.add(name);
+    outcomes.push({ name, status: "started", detail });
+    runs.push(
+      ports.run(name, identity, job).catch((error63) => {
+        ports.log(`job ${name}: failed as ${identity}: ${error63 instanceof Error ? error63.message : String(error63)}`);
+      }).finally(() => {
+        ports.running.delete(name);
+      })
+    );
+  };
+  const resolve2 = (target) => {
+    try {
+      const identity = ports.resolveIdentity(target);
+      return identity === void 0 ? { problem: "no member of its pool can be picked" } : { identity };
+    } catch (error63) {
+      return { problem: error63 instanceof Error ? error63.message : String(error63) };
+    }
+  };
+  const startIfServable = (name, identity, job, stamp, firedFor) => {
+    const refusal2 = refusalReason(identity, ports.snapshot(identity), nowMs);
+    if (refusal2 === void 0) {
+      start(name, identity, job, stamp, `${firedFor}: running as ${identity}`);
+      return;
+    }
+    handled[name] = stamp;
+    outcomes.push({ name, status: "skipped", detail: `${firedFor}: ${identity}: ${refusal2}` });
+  };
+  for (const { name, job } of jobs) {
+    if (ports.running.has(name)) {
+      outcomes.push({ name, status: "running", detail: "a previous run is still going" });
+      continue;
+    }
+    const { trigger } = job;
+    if ("at" in trigger) {
+      const last = handled[name];
+      if (last === void 0) {
+        handled[name] = nowMs;
+        outcomes.push({ name, status: "armed", detail: "schedule noted; the next anchor to fall is the first acted on" });
+        continue;
+      }
+      const due2 = dueAnchor(trigger.at, nowMs, last, ports.timeZone);
+      if (due2 === void 0) {
+        outcomes.push({ name, status: "waiting", detail: "no anchor has fallen since the last handled" });
+        continue;
+      }
+      const firedFor = `anchor ${new Date(due2).toISOString()}`;
+      const { identity: identity2, problem: problem2 } = resolve2(job.target);
+      if (identity2 === void 0) {
+        handled[name] = nowMs;
+        outcomes.push({ name, status: "skipped", detail: `${firedFor}: ${problem2 ?? "no identity"}` });
+        continue;
+      }
+      startIfServable(name, identity2, job, nowMs, firedFor);
+      continue;
+    }
+    const { identity, problem } = resolve2(job.target);
+    if (identity === void 0) {
+      outcomes.push({ name, status: "skipped", detail: problem ?? "no identity" });
+      continue;
+    }
+    const resetsAtMs = pendingReset(ports.snapshot(identity), trigger.beforeReset, nowMs);
+    if (resetsAtMs === void 0) {
+      outcomes.push({ name, status: "skipped", detail: `${identity} has no ${trigger.beforeReset} window to run before` });
+      continue;
+    }
+    if (resetsAtMs - parseDuration(trigger.lead) > nowMs || handled[name] === resetsAtMs) {
+      outcomes.push({ name, status: "waiting", detail: `${trigger.beforeReset} window resets in ${formatAge(resetsAtMs - nowMs)}` });
+      continue;
+    }
+    startIfServable(name, identity, job, resetsAtMs, `${trigger.beforeReset} window resetting in ${formatAge(resetsAtMs - nowMs)}`);
+  }
+  writeHandled(ports.fs, ports.stampsFile, handled);
+  for (const outcome of outcomes) {
+    if ((outcome.status === "started" || outcome.status === "skipped") && handled[outcome.name] !== previous[outcome.name]) {
+      ports.log(`job ${outcome.name}: ${outcome.detail}`);
+    }
+  }
+  return { outcomes, settled: Promise.all(runs).then(() => void 0) };
+}
+
+// src/usage/jobTarget.ts
+init_poolPick();
+function resolveJobIdentity(deps, target) {
+  if ("identity" in target) {
+    return target.identity;
+  }
+  return rankPoolGraph({ fs: deps.fs, paths: deps.paths, pools: deps.pools, poolName: target.pool, nowMs: deps.nowMs, resuming: false, identityExists: deps.identityExists }).ranking.pick?.identity;
+}
+
+// src/frontdoor/commands.ts
 init_realCredentialCache();
 
 // src/frontdoor/custody.ts
@@ -111794,7 +112336,7 @@ init_capability();
 
 // src/frontdoor/capture.ts
 var fs15 = __toESM(require("node:fs"), 1);
-var path37 = __toESM(require("node:path"), 1);
+var path39 = __toESM(require("node:path"), 1);
 var SECRET_HEADER_NAME = /authorization|cookie|token|secret|credential|api[-_]key/i;
 var SECRET_JSON_KEY = /token|secret|password|credential|authorization|api[-_]key/i;
 var SECRET_BODY_PATTERNS = [
@@ -111838,10 +112380,10 @@ function redactBody(chunk) {
 }
 var CAPTURE_ENV = "AGENT_SHIM_FRONTDOOR_CAPTURE";
 function captureFromEnv(env, logsDir) {
-  return env[CAPTURE_ENV] === "1" ? createFileCapture(path37.join(logsDir, "frontdoor-capture.jsonl")) : void 0;
+  return env[CAPTURE_ENV] === "1" ? createFileCapture(path39.join(logsDir, "frontdoor-capture.jsonl")) : void 0;
 }
 function createFileCapture(file2, now = () => /* @__PURE__ */ new Date()) {
-  fs15.mkdirSync(path37.dirname(file2), { recursive: true });
+  fs15.mkdirSync(path39.dirname(file2), { recursive: true });
   let nextId = 0;
   const append = (record2) => {
     fs15.appendFileSync(file2, `${JSON.stringify({ ts: now().toISOString(), ...record2 })}
@@ -111970,7 +112512,7 @@ var HIGH_BIT = 128;
 var BASE_128_PAYLOAD_MASK = 127;
 var FIRST_ARC_WEIGHT = 40;
 var SHORT_FORM_MAX_LENGTH = 127;
-var MS_PER_SECOND6 = 1e3;
+var MS_PER_SECOND7 = 1e3;
 var UTC_TIME_LAST_YEAR = 2049;
 var YEAR_DIGITS = 4;
 var TWO_DIGIT_YEAR_DIGITS = 2;
@@ -112029,7 +112571,7 @@ function wholeBitString(content) {
   return tlv(TAG_BIT_STRING, Buffer.concat([Buffer.from([0]), content]));
 }
 function time3(instant) {
-  const iso = new Date(Math.floor(instant.getTime() / MS_PER_SECOND6) * MS_PER_SECOND6).toISOString();
+  const iso = new Date(Math.floor(instant.getTime() / MS_PER_SECOND7) * MS_PER_SECOND7).toISOString();
   const compact = `${iso.replace(/[-:T]/g, "").slice(0, COMPACT_TIME_DIGITS)}Z`;
   if (instant.getUTCFullYear() > UTC_TIME_LAST_YEAR) {
     return tlv(TAG_GENERALIZED_TIME, Buffer.from(compact, "ascii"));
@@ -112260,19 +112802,19 @@ init_capability();
 init_route();
 
 // src/frontdoor/supervisor.ts
-var import_node_path38 = __toESM(require("node:path"), 1);
+var import_node_path40 = __toESM(require("node:path"), 1);
 init_state2();
 function watchedInstallEntry(resolvedOwnExecutablePath, siblingExists) {
-  const parsed = import_node_path38.default.parse(resolvedOwnExecutablePath);
+  const parsed = import_node_path40.default.parse(resolvedOwnExecutablePath);
   if (parsed.name === "agent-shim") {
     return resolvedOwnExecutablePath;
   }
-  const sibling = import_node_path38.default.join(parsed.dir, `agent-shim${parsed.ext}`);
+  const sibling = import_node_path40.default.join(parsed.dir, `agent-shim${parsed.ext}`);
   return siblingExists(sibling) ? sibling : resolvedOwnExecutablePath;
 }
 var FRONTDOOR_SUPERVISOR_STILL_RUNNING = -1;
 var FRONTDOOR_POLL_MS = 1e3;
-var MS_PER_MINUTE2 = 6e4;
+var MS_PER_MINUTE3 = 6e4;
 async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {}) {
   const { fs: fs22, paths } = ports;
   const servingBinary = ports.statOwnExecutable();
@@ -112399,7 +112941,7 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
         return await shutdown();
       }
       idleSince ??= ports.now();
-      if (ports.now() - idleSince >= idleShutdownMinutes * MS_PER_MINUTE2) {
+      if (ports.now() - idleSince >= idleShutdownMinutes * MS_PER_MINUTE3) {
         ports.log(`agent-shim frontdoor supervisor: no sessions for ${String(idleShutdownMinutes)} minute(s); closing the front door and exiting`);
         ports.doorHealth.idleShutdown();
         return await shutdown();
@@ -112440,7 +112982,7 @@ var CONNECT_LIMITS = {
 var CA_VALIDITY_DAYS = 3650;
 var LEAF_VALIDITY_DAYS = 397;
 var CA_SUBJECT_COMMON_NAME = "agent-shim front door CA";
-var MS_PER_DAY2 = 864e5;
+var MS_PER_DAY3 = 864e5;
 function parseConnectTarget(authority) {
   const colon = authority.lastIndexOf(":");
   if (colon === -1) {
@@ -112454,8 +112996,8 @@ function parseConnectTarget(authority) {
   }
   return { host, port };
 }
-function servedByPipeline(path51) {
-  return path51?.startsWith(ROUTED_PATH_PREFIX) === true;
+function servedByPipeline(path54) {
+  return path54?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
   "connection",
@@ -112486,11 +113028,11 @@ function forwardableHeaders(headers) {
   return result;
 }
 function generateCa(now) {
-  return issueCaCertificate(CA_SUBJECT_COMMON_NAME, new Date(now.getTime() - MS_PER_DAY2), new Date(now.getTime() + CA_VALIDITY_DAYS * MS_PER_DAY2));
+  return issueCaCertificate(CA_SUBJECT_COMMON_NAME, new Date(now.getTime() - MS_PER_DAY3), new Date(now.getTime() + CA_VALIDITY_DAYS * MS_PER_DAY3));
 }
 var LOOPBACK_LEAF_NAMES = ["127.0.0.1", "localhost"];
 function mintLeaf(ca2, names, now) {
-  return issueLeafCertificate(ca2, names, new Date(now.getTime() - MS_PER_DAY2), new Date(now.getTime() + LEAF_VALIDITY_DAYS * MS_PER_DAY2));
+  return issueLeafCertificate(ca2, names, new Date(now.getTime() - MS_PER_DAY3), new Date(now.getTime() + LEAF_VALIDITY_DAYS * MS_PER_DAY3));
 }
 function createLeafCache(ca2, now) {
   const cache = /* @__PURE__ */ new Map();
@@ -112974,11 +113516,11 @@ function createRcSessionTracker(deps) {
   };
   const observeExchange = (request7) => {
     const method = (request7.method ?? "").toUpperCase();
-    const path51 = new URL(request7.url ?? "/", "http://127.0.0.1").pathname;
-    if (!path51.startsWith(RC_SESSIONS_PATH_PREFIX)) {
+    const path54 = new URL(request7.url ?? "/", "http://127.0.0.1").pathname;
+    if (!path54.startsWith(RC_SESSIONS_PATH_PREFIX)) {
       return void 0;
     }
-    const tail = path51.slice(RC_SESSIONS_PATH_PREFIX.length);
+    const tail = path54.slice(RC_SESSIONS_PATH_PREFIX.length);
     const facts = {
       oauthAuthorization: oauthAuthorizationOf(request7.headers),
       anthropicVersion: singleHeader(request7.headers, "anthropic-version"),
@@ -113339,8 +113881,8 @@ var RC_READ_FILE_ENCODINGS = ["utf-8", "base64"];
 function isRcReadFileEncoding(value2) {
   return RC_READ_FILE_ENCODINGS.some((encoding) => encoding === value2);
 }
-function buildRcReadFilePayload(requestId, path51, options) {
-  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path51, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
+function buildRcReadFilePayload(requestId, path54, options) {
+  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path54, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
 }
 function buildRcFileSuggestionsPayload(requestId, query) {
   return buildRcControlRequestPayload(requestId, { subtype: "file_suggestions", query });
@@ -113442,15 +113984,15 @@ async function getRcSessionContextUsage(deps, sessionId, detail) {
   const result = await deliverRcClientPayload(deps, sessionId, buildRcGetContextUsagePayload(requestId, detail), `request the context usage of session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
-async function readRcSessionFile(deps, sessionId, path51, options) {
-  if (path51 === "") {
+async function readRcSessionFile(deps, sessionId, path54, options) {
+  if (path54 === "") {
     return { ok: false, message: "a read-file write needs a non-empty path: the SDK's own field names the file the worker resolves against the session's cwd, and an empty string names none" };
   }
   if (options?.maxBytes !== void 0 && (!Number.isInteger(options.maxBytes) || options.maxBytes <= 0)) {
     return { ok: false, message: "a read-file write's max-bytes is a positive whole number of bytes: the SDK's own field caps the read, and a zero or negative cap reads nothing" };
   }
   const requestId = deps.newUuid();
-  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path51, options), `read ${path51} from session ${sessionId}`);
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path54, options), `read ${path54} from session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
 async function suggestRcSessionFiles(deps, sessionId, query) {
@@ -113621,11 +114163,11 @@ function createRcControlHandler(deps) {
       path: "read-file",
       read: (body) => {
         const session = bodyString(body, "session");
-        const path51 = bodyString(body, "path");
+        const path54 = bodyString(body, "path");
         const maxBytes = "maxBytes" in body ? bodyPositiveInteger(body, "maxBytes") : void 0;
         const encoding = "encoding" in body && isRcReadFileEncoding(body.encoding) ? body.encoding : void 0;
-        const refused2 = session === void 0 || path51 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
-        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path51, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
+        const refused2 = session === void 0 || path54 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
+        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path54, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
       }
     },
     {
@@ -113935,9 +114477,9 @@ function requestIdOfBody(body) {
 }
 function frontDoorRcControl(transport, token) {
   const headers = { authorization: `Bearer ${token}` };
-  const listAnswerOf = async (path51, what) => {
+  const listAnswerOf = async (path54, what) => {
     try {
-      return await transport.request({ method: "GET", path: path51, headers });
+      return await transport.request({ method: "GET", path: path54, headers });
     } catch (error63) {
       throw new Error(`${what}: could not reach the front door's control listener: ${error63 instanceof Error ? error63.message : String(error63)}`, { cause: error63 });
     }
@@ -114009,10 +114551,10 @@ function frontDoorRcControl(transport, token) {
     }
     return pending;
   };
-  const writeOf = async (path51, body, describeFailure) => {
+  const writeOf = async (path54, body, describeFailure) => {
     let answer;
     try {
-      answer = await transport.request({ method: "POST", path: path51, headers: { ...headers, "content-type": "application/json" }, body });
+      answer = await transport.request({ method: "POST", path: path54, headers: { ...headers, "content-type": "application/json" }, body });
     } catch (error63) {
       return { ok: false, message: `could not reach the front door's control listener: ${error63 instanceof Error ? error63.message : String(error63)}` };
     }
@@ -114043,10 +114585,10 @@ function frontDoorRcControl(transport, token) {
     endSession: async (sessionId, reason) => await writeOf(`${CONTROL_PATH_PREFIX}/end-session`, JSON.stringify({ session: sessionId, ...reason === void 0 ? {} : { reason } }), (status, message) => `ending ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getUsage: async (sessionId, skipBehaviors) => await writeOf(`${CONTROL_PATH_PREFIX}/get-usage`, JSON.stringify({ session: sessionId, ...skipBehaviors === void 0 ? {} : { skipBehaviors } }), (status, message) => `requesting the usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getContextUsage: async (sessionId, detail) => await writeOf(`${CONTROL_PATH_PREFIX}/get-context-usage`, JSON.stringify({ session: sessionId, ...detail === void 0 ? {} : { detail } }), (status, message) => `requesting the context usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
-    readFile: async (sessionId, path51, options) => await writeOf(
+    readFile: async (sessionId, path54, options) => await writeOf(
       `${CONTROL_PATH_PREFIX}/read-file`,
-      JSON.stringify({ session: sessionId, path: path51, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
-      (status, message) => `reading ${path51} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
+      JSON.stringify({ session: sessionId, path: path54, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
+      (status, message) => `reading ${path54} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
     ),
     fileSuggestions: async (sessionId, query) => await writeOf(`${CONTROL_PATH_PREFIX}/file-suggestions`, JSON.stringify({ session: sessionId, query }), (status, message) => `requesting file suggestions from ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     keepAlive: async (sessionId) => await writeOf(`${CONTROL_PATH_PREFIX}/keep-alive`, JSON.stringify({ session: sessionId }), (status, message) => `keeping ${sessionId} alive failed (HTTP ${String(status)}): ${message}`),
@@ -114340,12 +114882,12 @@ function tlsFacts(options) {
 }
 function realRcEventDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const post = async (path51, headers, body) => await new Promise((resolve2, reject) => {
+  const post = async (path54, headers, body) => await new Promise((resolve2, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method: "POST",
-      path: path51,
+      path: path54,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, "content-length": String(Buffer.byteLength(body, "utf8")) },
       agent
@@ -114410,12 +114952,12 @@ function lateRcStreamDial(resolve2) {
 }
 function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const request7 = async (method, path51, headers, body, signal) => await new Promise((resolve2, reject) => {
+  const request7 = async (method, path54, headers, body, signal) => await new Promise((resolve2, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method,
-      path: path51,
+      path: path54,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, ...body === void 0 ? {} : { "content-length": String(Buffer.byteLength(body, "utf8")) } },
       agent,
@@ -114457,9 +114999,9 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
       return { status, body: await readAll(response) };
     },
     openStream: async (sessionId, headers, resume, signal) => {
-      const path51 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
+      const path54 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
       const streamHeaders = resume === void 0 ? headers : { ...headers, "last-event-id": String(resume.fromSequenceNum) };
-      const { status, response } = await request7("GET", path51, streamHeaders, void 0, signal);
+      const { status, response } = await request7("GET", path54, streamHeaders, void 0, signal);
       if (!isSuccessful2(status)) {
         await readAll(response);
         return { status, chunks: NO_CHUNKS };
@@ -114675,10 +115217,10 @@ init_claudeShim();
 init_store();
 init_realPorts();
 var import_node_fs15 = __toESM(require("node:fs"), 1);
-var import_node_path40 = __toESM(require("node:path"), 1);
+var import_node_path42 = __toESM(require("node:path"), 1);
 
 // src/usage/signIn.ts
-var import_node_path39 = __toESM(require("node:path"), 1);
+var import_node_path41 = __toESM(require("node:path"), 1);
 var CREDENTIALS_FILE = ".credentials.json";
 function keychainHasItem(run, account) {
   return run.run("security", ["find-generic-password", "-a", account]).status === 0;
@@ -114696,7 +115238,7 @@ function decideSignIn(facts) {
   return { state: "signed-out", detail: facts.platform === "darwin" ? `no Keychain item and no ${CREDENTIALS_FILE}` : `no ${CREDENTIALS_FILE}` };
 }
 function credentialsFilePath(farmRoot) {
-  return import_node_path39.default.join(farmRoot, CREDENTIALS_FILE);
+  return import_node_path41.default.join(farmRoot, CREDENTIALS_FILE);
 }
 function identitySignIn(fs22, probe, identity) {
   const probing = !identity.hasCredentialBlock;
@@ -114822,7 +115364,7 @@ function tcpPortEraRecord(raw) {
   return (has("port") || has("lastPort")) && !has("socketPath");
 }
 function pushPathResolution(push, resolution) {
-  const ownDir = import_node_path40.default.dirname(resolution.ownExecutablePath);
+  const ownDir = import_node_path42.default.dirname(resolution.ownExecutablePath);
   switch (resolution.agentShim.status) {
     case "ok":
       push("path-resolution", "pass", `\`agent-shim\` on PATH resolves to this running executable, ${resolution.ownExecutablePath}.`, "agent-shim");
@@ -114921,14 +115463,14 @@ function pushProvider(push, entry, cacheEnv, signIn) {
 }
 function pushLegacyName(push, params) {
   const legacyVariables = Object.keys(params.env).filter((name) => name.startsWith(LEGACY_ENV_PREFIX) && params.env[name] !== void 0).sort();
-  if (legacyVariables.length === 0 && import_node_path40.default.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
+  if (legacyVariables.length === 0 && import_node_path42.default.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
     push("legacy-name", "pass", "Nothing here still uses the former `claude-use` name.");
     return;
   }
   for (const name of legacyVariables) {
     push("legacy-name", "warn", `${name} is the former name of ${name.replace(LEGACY_ENV_PREFIX, ENV_PREFIX)}. Rename it; the old name still works but is only a fallback.`, name);
   }
-  if (import_node_path40.default.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
+  if (import_node_path42.default.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
     push(
       "legacy-name",
       "warn",
@@ -115301,18 +115843,18 @@ function collectDoctorReport(params) {
   const { paths } = params;
   const identityNames = import_node_fs15.default.existsSync(paths.identitiesDir) ? import_node_fs15.default.readdirSync(paths.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && isIdentityDirectoryName(entry.name)).map((entry) => entry.name).sort() : [];
   const identities = identityNames.map((name) => {
-    const farmRoot = import_node_path40.default.join(paths.identitiesDir, name);
-    const identityPath = import_node_path40.default.join(farmRoot, "identity.json");
+    const farmRoot = import_node_path42.default.join(paths.identitiesDir, name);
+    const identityPath = import_node_path42.default.join(farmRoot, "identity.json");
     return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot, credentialsFilePresent: import_node_fs15.default.existsSync(credentialsFilePath(farmRoot)) };
   });
   const profileNames = import_node_fs15.default.existsSync(paths.configProfilesDir) ? import_node_fs15.default.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const configProfiles = profileNames.map((name) => {
-    const profilePath = import_node_path40.default.join(paths.configProfilesDir, `${name}.json`);
+    const profilePath = import_node_path42.default.join(paths.configProfilesDir, `${name}.json`);
     return { name, path: profilePath, raw: realFsPort.readFileUtf8(profilePath) };
   });
   const providerNames = import_node_fs15.default.existsSync(paths.providersDir) ? import_node_fs15.default.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const providers = providerNames.map((name) => {
-    const providerPath = import_node_path40.default.join(paths.providersDir, `${name}.json`);
+    const providerPath = import_node_path42.default.join(paths.providersDir, `${name}.json`);
     return { name, path: providerPath, raw: realFsPort.readFileUtf8(providerPath) };
   });
   const ownExecutablePath = realOwnExecutablePath();
@@ -115324,12 +115866,12 @@ function collectDoctorReport(params) {
     binaryDiscovery = { ok: false, message: error63 instanceof Error ? error63.message : String(error63) };
   }
   const shimState = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-  const pathDirs = (params.env.PATH ?? "").split(import_node_path40.default.delimiter).filter((dir) => dir !== "");
+  const pathDirs = (params.env.PATH ?? "").split(import_node_path42.default.delimiter).filter((dir) => dir !== "");
   const claudeShimShadow = shimState === void 0 ? void 0 : refinePathShadow(
     findPathShadow({
       pathDirs,
-      targetDir: import_node_path40.default.dirname(shimState.targetPath),
-      targetFilename: import_node_path40.default.basename(shimState.targetPath),
+      targetDir: import_node_path42.default.dirname(shimState.targetPath),
+      targetFilename: import_node_path42.default.basename(shimState.targetPath),
       findExecutableInDir
     }),
     shimState.targetPath,
@@ -115358,7 +115900,7 @@ function collectDoctorReport(params) {
       agentShim: refinePathShadow(
         findPathShadow({
           pathDirs,
-          targetDir: import_node_path40.default.dirname(ownExecutablePath),
+          targetDir: import_node_path42.default.dirname(ownExecutablePath),
           targetFilename: commandFilename(ownExecutablePath, "agent-shim"),
           findExecutableInDir
         }),
@@ -115621,11 +116163,11 @@ function tryOrUndefined(fn2) {
     return void 0;
   }
 }
-function pathToHttpPath(path51) {
-  return `/${path51.map(safeEncodeURIComponent).join("/")}`;
+function pathToHttpPath(path54) {
+  return `/${path54.map(safeEncodeURIComponent).join("/")}`;
 }
-function normalizeHttpPath(path51) {
-  const paths = path51.split("/");
+function normalizeHttpPath(path54) {
+  const paths = path54.split("/");
   if (paths.at(0) === "") {
     paths.shift();
   }
@@ -115810,9 +116352,9 @@ function isPlainObject2(value2) {
 function getOwn(object3, key) {
   return Object.hasOwn(object3, key) ? object3[key] : void 0;
 }
-function get(object3, path51) {
+function get(object3, path54) {
   let current = object3;
-  for (const key of path51) {
+  for (const key of path54) {
     if (!isTypescriptObject(current)) {
       return void 0;
     }
@@ -117035,7 +117577,7 @@ function resolveClientRest(rest) {
     // rest[1] can be undefined if all fields of FriendlyClientOptions are optional
   ];
 }
-function createORPCClient(link, { path: path51 = [], ...options } = {}) {
+function createORPCClient(link, { path: path54 = [], ...options } = {}) {
   const procedureClient = (...rest) => {
     const [input2, callOptions] = resolveClientRest(rest);
     const interceptors = [
@@ -117044,7 +117586,7 @@ function createORPCClient(link, { path: path51 = [], ...options } = {}) {
     ];
     return intercept(
       interceptors,
-      { ...callOptions, input: input2, path: path51 },
+      { ...callOptions, input: input2, path: path54 },
       ({ path: path210, input: input22, ...callOptions2 }) => link.call(path210, input22, callOptions2)
     );
   };
@@ -117058,7 +117600,7 @@ function createORPCClient(link, { path: path51 = [], ...options } = {}) {
       if (client === void 0) {
         client = createORPCClient(link, {
           ...options,
-          path: [...path51, key],
+          path: [...path54, key],
           scoped: options.scoped?.[key]
         });
         cache.set(key, client);
@@ -117080,24 +117622,24 @@ var BracketNotationSerializer = class {
     this.internalSerialize(data, "", true, result);
     return result;
   }
-  internalSerialize(data, path51, isRoot, result) {
+  internalSerialize(data, path54, isRoot, result) {
     if (Array.isArray(data)) {
       data.forEach((item, i10) => {
-        this.internalSerialize(item, isRoot ? i10.toString() : `${path51}[${i10}]`, false, result);
+        this.internalSerialize(item, isRoot ? i10.toString() : `${path54}[${i10}]`, false, result);
       });
     } else if (isPlainObject2(data)) {
       for (const key of Object.keys(data)) {
-        this.internalSerialize(data[key], isRoot ? key : `${path51}[${key}]`, false, result);
+        this.internalSerialize(data[key], isRoot ? key : `${path54}[${key}]`, false, result);
       }
     } else {
-      result.push([path51, data]);
+      result.push([path54, data]);
     }
   }
   deserialize(serialized) {
     const arrayPushStyles = /* @__PURE__ */ new WeakSet();
     const root = new NullProtoObj();
-    for (const [path51, value2] of serialized) {
-      const segments = this.parsePath(path51);
+    for (const [path54, value2] of serialized) {
+      const segments = this.parsePath(path54);
       let currentRef = root;
       let nextSegment = segments[0];
       for (let i10 = 1; i10 < segments.length; i10++) {
@@ -117148,13 +117690,13 @@ var BracketNotationSerializer = class {
     }
     return result;
   }
-  parsePath(path51) {
+  parsePath(path54) {
     const segments = [];
     let inBrackets = false;
     let currentSegment = "";
-    for (let i10 = 0; i10 < path51.length; i10++) {
-      const char = path51[i10];
-      const nextChar = path51[i10 + 1];
+    for (let i10 = 0; i10 < path54.length; i10++) {
+      const char = path54[i10];
+      const nextChar = path54[i10 + 1];
       if (inBrackets && char === "]" && (nextChar === void 0 || nextChar === "[")) {
         if (nextChar === void 0) {
           inBrackets = false;
@@ -117170,7 +117712,7 @@ var BracketNotationSerializer = class {
         currentSegment += char;
       }
     }
-    return inBrackets || segments.length === 0 ? [path51] : segments;
+    return inBrackets || segments.length === 0 ? [path54] : segments;
   }
 };
 var INTEGER_PATTERN = /^0$|^[1-9]\d*$/;
@@ -117743,11 +118285,11 @@ var OpenAPISerializer = class {
       return json2;
     }
     const form = new FormData();
-    for (const [path51, value22] of this.bracketNotation.serialize(json2)) {
+    for (const [path54, value22] of this.bracketNotation.serialize(json2)) {
       if (value22 instanceof Blob) {
-        form.append(path51, value22);
+        form.append(path54, value22);
       } else if (value22 !== void 0 && value22 !== null) {
-        form.append(path51, String(value22));
+        form.append(path54, String(value22));
       }
     }
     return form;
@@ -117785,30 +118327,30 @@ function isBodylessMethod(method) {
   return method === "GET" || method === "HEAD";
 }
 var PARAMETER_NAME_REGEX = /^[\w-]+$/;
-function getDynamicPathParams(path51) {
-  if (!path51.includes("{")) {
+function getDynamicPathParams(path54) {
+  if (!path54.includes("{")) {
     return void 0;
   }
-  const len = path51.length;
+  const len = path54.length;
   let params;
   let index = 1;
   while (index < len) {
     const segmentStart = index;
-    const slashPos = path51.indexOf("/", index);
+    const slashPos = path54.indexOf("/", index);
     const segmentEnd = slashPos === -1 ? len : slashPos;
-    if (segmentEnd > segmentStart && path51.charCodeAt(segmentStart) === 123 && path51.charCodeAt(segmentEnd - 1) === 125) {
+    if (segmentEnd > segmentStart && path54.charCodeAt(segmentStart) === 123 && path54.charCodeAt(segmentEnd - 1) === 125) {
       let parameterStart = segmentStart + 1;
       let allowsSlash = false;
-      const operator = path51.charCodeAt(parameterStart);
+      const operator = path54.charCodeAt(parameterStart);
       if (operator === 43) {
         allowsSlash = true;
         parameterStart++;
       }
-      const parameterName = path51.slice(parameterStart, segmentEnd - 1);
+      const parameterName = path54.slice(parameterStart, segmentEnd - 1);
       if (PARAMETER_NAME_REGEX.test(parameterName)) {
         params ??= [];
         params.push({
-          segment: path51.slice(segmentStart, segmentEnd),
+          segment: path54.slice(segmentStart, segmentEnd),
           startIndex: segmentStart,
           parameterName,
           allowsSlash
@@ -117851,8 +118393,8 @@ openapi.method = (method) => ({
   ...openapi({ method }),
   name: "~openapi/method"
 });
-openapi.path = (path51) => ({
-  ...openapi({ path: path51 }),
+openapi.path = (path54) => ({
+  ...openapi({ path: path54 }),
   name: "~openapi/path"
 });
 openapi.spec = (spec) => ({
@@ -118713,22 +119255,22 @@ function visitJsonSchemaRefs(value2, visit2, schemaLevel = true, seen = /* @__PU
     }
   }
 }
-function mapJsonSchemaRefs(value2, map2, schemaLevel = true, path51 = []) {
+function mapJsonSchemaRefs(value2, map2, schemaLevel = true, path54 = []) {
   if (!value2 || typeof value2 !== "object") {
     return value2;
   }
   if (Array.isArray(value2)) {
-    return value2.map((item, index) => mapJsonSchemaRefs(item, map2, schemaLevel, [...path51, index]));
+    return value2.map((item, index) => mapJsonSchemaRefs(item, map2, schemaLevel, [...path54, index]));
   }
   const result = {};
   for (const key of Object.keys(value2)) {
     const val = value2[key];
     if (key === "$ref" && typeof val === "string") {
-      setOwn(result, key, map2(val, [...path51, key]));
+      setOwn(result, key, map2(val, [...path54, key]));
     } else if (!schemaLevel) {
-      setOwn(result, key, mapJsonSchemaRefs(val, map2, true, [...path51, key]));
+      setOwn(result, key, mapJsonSchemaRefs(val, map2, true, [...path54, key]));
     } else if (JSON_SCHEMA_LOGIC_KEYWORDS.has(key) || JSON_SCHEMA_RECORD_KEYWORDS.has(key)) {
-      setOwn(result, key, mapJsonSchemaRefs(val, map2, !JSON_SCHEMA_RECORD_KEYWORDS.has(key), [...path51, key]));
+      setOwn(result, key, mapJsonSchemaRefs(val, map2, !JSON_SCHEMA_RECORD_KEYWORDS.has(key), [...path54, key]));
     } else {
       setOwn(result, key, val);
     }
@@ -119258,7 +119800,7 @@ function unlazy(maybeLazy) {
 function createProcedureClient(lazyableProcedure, ...rest) {
   const options = resolveMaybeOptionalOptions(rest);
   return async (...[input2, callerOptions]) => {
-    const path51 = toArray(options.path);
+    const path54 = toArray(options.path);
     const { default: procedure } = await unlazy(lazyableProcedure);
     const clientContext = callerOptions?.context ?? {};
     const context = await value(options.context, clientContext) ?? {};
@@ -119271,7 +119813,7 @@ function createProcedureClient(lazyableProcedure, ...rest) {
     };
     try {
       const output2 = await runWithSpan("call_procedure", (span) => {
-        span?.setAttribute("procedure.path", path51);
+        span?.setAttribute("procedure.path", path54);
         return intercept(
           options.interceptors,
           {
@@ -119279,7 +119821,7 @@ function createProcedureClient(lazyableProcedure, ...rest) {
             // input can be optional if it is undefinable
             input: input2,
             errors,
-            path: path51,
+            path: path54,
             procedure,
             signal: callerOptions?.signal,
             lastEventId: callerOptions?.lastEventId
@@ -119530,10 +120072,10 @@ function augmentRouter(router, options) {
   }
   return enhanced;
 }
-function getRouter(router, path51) {
+function getRouter(router, path54) {
   let current = router;
-  for (let i10 = 0; i10 < path51.length; i10++) {
-    const segment = path51[i10];
+  for (let i10 = 0; i10 < path54.length; i10++) {
+    const segment = path54[i10];
     if (!isTypescriptObject(current)) {
       return void 0;
     }
@@ -119545,7 +120087,7 @@ function getRouter(router, path51) {
       continue;
     }
     const lazied = current;
-    const rest = path51.slice(i10);
+    const rest = path54.slice(i10);
     return new Lazy({
       ...lazied["~orpc"],
       async loader() {
@@ -119560,40 +120102,40 @@ function getRouter(router, path51) {
   }
   return current;
 }
-function walkProcedureContractsSync(router, callback, path51 = []) {
+function walkProcedureContractsSync(router, callback, path54 = []) {
   const lazyResults = [];
-  walkProcedureContractsSyncInternal(router, callback, path51.slice(), lazyResults);
+  walkProcedureContractsSyncInternal(router, callback, path54.slice(), lazyResults);
   return lazyResults;
 }
-function walkProcedureContractsSyncInternal(router, callback, path51, lazyResults) {
+function walkProcedureContractsSyncInternal(router, callback, path54, lazyResults) {
   const hiddenContract = getHiddenRouterContract(router);
   if (hiddenContract !== void 0) {
     router = hiddenContract;
   }
   if (router instanceof ProcedureContract) {
-    callback(router, path51.slice());
+    callback(router, path54.slice());
     return;
   }
   if (!isTypescriptObject(router)) {
     return;
   }
   for (const [key, value2] of Object.entries(router)) {
-    path51.push(key);
+    path54.push(key);
     if (value2 instanceof Lazy) {
-      lazyResults.push({ router: value2, path: path51.slice() });
+      lazyResults.push({ router: value2, path: path54.slice() });
     } else {
-      walkProcedureContractsSyncInternal(value2, callback, path51, lazyResults);
+      walkProcedureContractsSyncInternal(value2, callback, path54, lazyResults);
     }
-    path51.pop();
+    path54.pop();
   }
 }
-async function walkProcedureContractsAsync(router, callback, path51 = []) {
+async function walkProcedureContractsAsync(router, callback, path54 = []) {
   const hiddenContract = getHiddenRouterContract(router);
   if (hiddenContract !== void 0) {
     router = hiddenContract;
   }
   if (router instanceof ProcedureContract) {
-    await callback(router, path51);
+    await callback(router, path54);
     return;
   }
   if (!isTypescriptObject(router)) {
@@ -119602,9 +120144,9 @@ async function walkProcedureContractsAsync(router, callback, path51 = []) {
   for (const [key, value2] of Object.entries(router)) {
     if (value2 instanceof Lazy) {
       const { default: router2 } = await unlazy(value2);
-      await walkProcedureContractsAsync(router2, callback, [...path51, key]);
+      await walkProcedureContractsAsync(router2, callback, [...path54, key]);
     } else {
-      await walkProcedureContractsAsync(value2, callback, [...path51, key]);
+      await walkProcedureContractsAsync(value2, callback, [...path54, key]);
     }
   }
 }
@@ -120090,18 +120632,18 @@ function rewriteComponentSchemaRefs(schema, renameMap) {
 }
 var OpenAPIGeneratorError = class extends TypeError {
 };
-function toOpenAPIPath(path51, dynamicPathParams) {
+function toOpenAPIPath(path54, dynamicPathParams) {
   if (!dynamicPathParams?.length) {
-    return path51;
+    return path54;
   }
   let normalized = "";
   let currentIndex = 0;
   for (const param of dynamicPathParams) {
-    normalized += path51.slice(currentIndex, param.startIndex);
+    normalized += path54.slice(currentIndex, param.startIndex);
     normalized += `{${param.parameterName}}`;
     currentIndex = param.startIndex + param.segment.length;
   }
-  normalized += path51.slice(currentIndex);
+  normalized += path54.slice(currentIndex);
   return normalized;
 }
 function buildRequest(ctx, operation, def, meta3, dynamicPathParams) {
@@ -120535,8 +121077,8 @@ var OpenAPIGenerator = class {
       customErrorResponseBodySchema: options.customErrorResponseBodySchema
     };
     const errors = [];
-    await walkProcedureContractsAsync(router, (contract, path51) => {
-      if (value(options.filter, contract, path51) === false) {
+    await walkProcedureContractsAsync(router, (contract, path54) => {
+      if (value(options.filter, contract, path54) === false) {
         return;
       }
       try {
@@ -120548,7 +121090,7 @@ var OpenAPIGenerator = class {
             `QUERY operations require OpenAPI 3.2, but version "${version2}" was requested.`
           );
         }
-        const postPath = meta3?.path ?? pathToHttpPath(path51);
+        const postPath = meta3?.path ?? pathToHttpPath(path54);
         const httpPath = meta3?.prefix ? mergeHttpPath(meta3.prefix, postPath) : postPath;
         const dynamicPathParams = getDynamicPathParams(httpPath);
         const openApiPath = toOpenAPIPath(httpPath, dynamicPathParams);
@@ -120557,7 +121099,7 @@ var OpenAPIGenerator = class {
           operation = meta3.spec;
         } else {
           operation = {
-            operationId: meta3?.operationId ?? path51.join("."),
+            operationId: meta3?.operationId ?? path54.join("."),
             summary: meta3?.summary,
             description: meta3?.description,
             deprecated: meta3?.deprecated,
@@ -120577,7 +121119,7 @@ var OpenAPIGenerator = class {
         if (!(e14 instanceof OpenAPIGeneratorError)) {
           throw e14;
         }
-        errors.push(`Procedure at ${path51.join(".") || "(root)"}: ${e14.message}`);
+        errors.push(`Procedure at ${path54.join(".") || "(root)"}: ${e14.message}`);
       }
     });
     if (errors.length) {
@@ -120885,7 +121427,7 @@ var ResetRowSchema = external_exports.strictObject({
 var ResetScheduleSchema = external_exports.strictObject({ resets: external_exports.readonly(external_exports.array(ResetRowSchema)) });
 
 // src/frontdoor/controlSchemas.ts
-var import_node_path41 = __toESM(require("node:path"), 1);
+var import_node_path43 = __toESM(require("node:path"), 1);
 init_zod();
 init_schema2();
 
@@ -121097,11 +121639,11 @@ var FrontDoorSessionsOutputSchema = external_exports.strictObject({ sessions: ex
 var CheckRunInputSchema = external_exports.strictObject({
   path: external_exports.string().min(1),
   identity: external_exports.string().min(1).optional()
-}).refine((input2) => import_node_path41.default.isAbsolute(input2.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+}).refine((input2) => import_node_path43.default.isAbsolute(input2.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
 var PoolPickInputSchema = external_exports.strictObject({
   pool: external_exports.string().min(1),
   path: external_exports.string().min(1)
-}).refine((input2) => import_node_path41.default.isAbsolute(input2.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+}).refine((input2) => import_node_path43.default.isAbsolute(input2.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
 var DoctorFindingSchema = external_exports.strictObject({
   section: external_exports.enum(DOCTOR_SECTIONS),
   subject: external_exports.string().optional(),
@@ -121422,16 +121964,16 @@ var StandardLink = class {
   /**
    * @throws ORPCError, transport-level errors (network failures, timeouts, etc.)
    */
-  call(path51, input2, options) {
-    return runWithSpan(`${ORPC_NAME}.${path51.join("/")}`, (span) => {
+  call(path54, input2, options) {
+    return runWithSpan(`${ORPC_NAME}.${path54.join("/")}`, (span) => {
       span?.setAttribute("rpc.system", ORPC_NAME);
-      span?.setAttribute("rpc.method", path51.join("."));
+      span?.setAttribute("rpc.method", path54.join("."));
       if (getTracer() && isAsyncIteratorObject(input2)) {
         input2 = override(input2, traceAsyncIterator("consume_async_iterator_object_input", input2));
       } else if (getTracer() && input2 instanceof ReadableStream) {
         input2 = override(input2, traceReadableStream("consume_octet_stream_input", input2));
       }
-      return intercept(this.interceptors, { ...options, path: path51, input: input2 }, async ({ path: path210, input: input22, ...options2 }) => {
+      return intercept(this.interceptors, { ...options, path: path54, input: input2 }, async ({ path: path210, input: input22, ...options2 }) => {
         const tracer = getTracer();
         const activeSpan = tracer?.getActiveSpan() ?? span;
         let request7 = await runWithSpan(
@@ -121488,18 +122030,18 @@ var RPCLinkCodec = class {
     this.headers = options.headers ?? {};
     this.serializer = options.serializer ?? new RPCSerializer();
   }
-  async encodeInput(input2, path51, options) {
-    let headers = toResolvedStandardHeaders(await value(this.headers, options, path51, input2));
+  async encodeInput(input2, path54, options) {
+    let headers = toResolvedStandardHeaders(await value(this.headers, options, path54, input2));
     if (options.lastEventId !== void 0) {
       headers = mergeStandardHeaders(headers, { "last-event-id": options.lastEventId });
     }
-    const expectedMethod = await value(this.expectedMethod, options, path51, input2);
-    const baseUrl = await value(this.baseUrl, options, path51, input2);
+    const expectedMethod = await value(this.expectedMethod, options, path54, input2);
+    const baseUrl = await value(this.baseUrl, options, path54, input2);
     const [pathname, search, hash2] = parseStandardUrl(baseUrl);
-    const newPathname = `${pathname.replace(END_SLASH_REGEX, "")}${pathToHttpPath(path51)}`;
+    const newPathname = `${pathname.replace(END_SLASH_REGEX, "")}${pathToHttpPath(path54)}`;
     const serialized = this.serializer.serialize(input2);
     if (expectedMethod === "GET" && !(serialized instanceof Blob) && !(serialized instanceof ReadableStream) && !(serialized instanceof FormData) && !isAsyncIteratorObject(serialized)) {
-      const maxUrlLength = await value(this.maxUrlLength, options, path51, input2);
+      const maxUrlLength = await value(this.maxUrlLength, options, path54, input2);
       const mergedSearch = new URLSearchParams(search);
       mergedSearch.append("data", stringifyJSON(serialized) ?? "");
       const url22 = `${newPathname}?${mergedSearch}${hash2 ?? ""}`;
@@ -121584,8 +122126,8 @@ var FetchLinkTransport = class {
     this.fetch = options.fetch ?? ((url2, init) => globalThis.fetch(url2, init));
     this.toFetchRequestOptions = options.toFetchRequest;
   }
-  async send(standardRequest, path51, options) {
-    let origin = await value(this.origin, options, path51);
+  async send(standardRequest, path54, options) {
+    let origin = await value(this.origin, options, path54);
     if (origin?.endsWith("/")) {
       origin = origin.slice(0, -1);
     }
@@ -121605,7 +122147,7 @@ var FetchLinkTransport = class {
       }
     }
     const fetch3 = this.fetch;
-    const response = await fetch3(url2, init, options, path51);
+    const response = await fetch3(url2, init, options, path54);
     const standardResponse = toStandardLazyResponse(response);
     return standardResponse;
   }
@@ -121996,14 +122538,14 @@ var StandardHandler = class {
           span?.setAttribute("url.path", request22.url);
           return { matched: false };
         }
-        const { path: path51, procedure, decodeInput } = matchedOrNot;
-        span?.updateName(`${ORPC_NAME}.${path51.join("/")}`);
+        const { path: path54, procedure, decodeInput } = matchedOrNot;
+        span?.updateName(`${ORPC_NAME}.${path54.join("/")}`);
         span?.setAttribute("rpc.system", ORPC_NAME);
-        span?.setAttribute("rpc.method", path51.join("."));
+        span?.setAttribute("rpc.method", path54.join("."));
         try {
           const response = await intercept(
             this.interceptors,
-            { context: context2, prefix: prefix2, request: request22, path: path51, procedure, decodeInput },
+            { context: context2, prefix: prefix2, request: request22, path: path54, procedure, decodeInput },
             async ({ context: context3, prefix: prefix3, request: request32, path: path210, procedure: procedure2, decodeInput: decodeInput2 }) => {
               step2 = "decode_input";
               let input2 = await runWithSpan("decode_input", decodeInput2);
@@ -122037,7 +122579,7 @@ var StandardHandler = class {
             message: `Malformed request. Ensure the request body is properly formatted and the 'Content-Type' header is set correctly.`,
             cause: e14
           }) : toORPCError(e14);
-          const response = await this.codec.encodeError(error63, procedure, path51, { context: context2, prefix: prefix2 });
+          const response = await this.codec.encodeError(error63, procedure, path54, { context: context2, prefix: prefix2 });
           return { matched: true, response };
         }
       }
@@ -122143,7 +122685,7 @@ var RPCMatcher = class {
     this.rootRouter = router;
     this.index(router);
   }
-  index(router, path51 = []) {
+  index(router, path54 = []) {
     const lazyResults = walkProcedureContractsSync(router, (procedure, procedurePath) => {
       if (!value(this.filter, procedure, procedurePath)) {
         return;
@@ -122154,7 +122696,7 @@ var RPCMatcher = class {
         // contract-first entries have no implementation yet, resolveProcedure fills it in on demand
         procedure: procedure instanceof Procedure ? procedure : void 0
       });
-    }, path51);
+    }, path54);
     for (const result of lazyResults) {
       this.pendingLazyRouters.set(pathToHttpPath(result.path), result);
     }
@@ -122286,10 +122828,10 @@ var RPCHandlerCodec = class {
       }
     };
   }
-  encodeOutput(output2, procedure, path51, options) {
+  encodeOutput(output2, procedure, path54, options) {
     return {
       headers: {},
-      status: value(this.outputStatus, output2, procedure, path51, options) ?? DEFAULT_SUCCESS_STATUS,
+      status: value(this.outputStatus, output2, procedure, path54, options) ?? DEFAULT_SUCCESS_STATUS,
       body: this.serializer.serialize(output2)
     };
   }
@@ -122343,39 +122885,39 @@ function createRouter() {
     static: new NullProtoObj2()
   };
 }
-function scanFirstGroup(path51) {
+function scanFirstGroup(path54) {
   let i10 = 0;
   let depth = 0;
-  for (; i10 < path51.length; i10++) {
-    const c10 = path51.charCodeAt(i10);
+  for (; i10 < path54.length; i10++) {
+    const c10 = path54.charCodeAt(i10);
     if (c10 === 92) i10++;
     else if (c10 === 40) depth++;
     else if (c10 === 41 && depth > 0) depth--;
     else if (c10 === 123 && depth === 0) break;
   }
-  if (i10 >= path51.length) return;
+  if (i10 >= path54.length) return;
   let j10 = i10 + 1;
   depth = 0;
-  for (; j10 < path51.length; j10++) {
-    const c10 = path51.charCodeAt(j10);
+  for (; j10 < path54.length; j10++) {
+    const c10 = path54.charCodeAt(j10);
     if (c10 === 92) j10++;
     else if (c10 === 40) depth++;
     else if (c10 === 41 && depth > 0) depth--;
     else if (c10 === 125 && depth === 0) break;
   }
-  if (j10 >= path51.length) return;
-  const mod = path51[j10 + 1];
+  if (j10 >= path54.length) return;
+  const mod = path54[j10 + 1];
   const hasMod = mod === "?" || mod === "+" || mod === "*";
   return [
-    path51.slice(0, i10),
-    path51.slice(i10 + 1, j10),
-    path51.slice(j10 + (hasMod ? 2 : 1)),
+    path54.slice(0, i10),
+    path54.slice(i10 + 1, j10),
+    path54.slice(j10 + (hasMod ? 2 : 1)),
     hasMod ? mod : void 0
   ];
 }
-function expandGroupDelimiters(path51) {
-  if (!path51.includes("{")) return;
-  const group = scanFirstGroup(path51);
+function expandGroupDelimiters(path54) {
+  if (!path54.includes("{")) return;
+  const group = scanFirstGroup(path54);
   if (!group) return;
   const [pre2, body, suf, mod] = group;
   if (!mod) return [pre2 + body + suf];
@@ -122445,9 +122987,9 @@ function replaceSegmentWildcards(segment, unnamedStart, toGroupKey = toUnnamedGr
   }
   return [replaced, nextIndex];
 }
-function encodeEscapes(path51) {
-  if (!path51.includes("\\")) return path51;
-  return path51.replace(/\\([:(){}])/g, (_, c10) => "\uFFFD" + "ABCDE"[":(){}".indexOf(c10)]);
+function encodeEscapes(path54) {
+  if (!path54.includes("\\")) return path54;
+  return path54.replace(/\\([:(){}])/g, (_, c10) => "\uFFFD" + "ABCDE"[":(){}".indexOf(c10)]);
 }
 function segmentKey(segment) {
   if (segment.startsWith("**")) return 2;
@@ -122476,22 +123018,22 @@ function expandModifiers(segments) {
     return m10[2] === "+" ? [wc2] : [wc2, without];
   }
 }
-function normalizePath(path51) {
-  if (!path51.includes("/.")) return path51;
+function normalizePath(path54) {
+  if (!path54.includes("/.")) return path54;
   const r10 = [];
-  for (const s of path51.split("/")) if (s === ".") continue;
+  for (const s of path54.split("/")) if (s === ".") continue;
   else if (s === ".." && r10.length > 1) r10.pop();
   else r10.push(s);
   return r10.join("/") || "/";
 }
-function splitPath(path51) {
-  const s = path51.split("/");
+function splitPath(path54) {
+  const s = path54.split("/");
   s.shift();
   if (s[s.length - 1] === "") s.pop();
   return s;
 }
-function splitRoute(path51) {
-  const s = splitPath(path51);
+function splitRoute(path54) {
+  const s = splitPath(path54);
   while (s[s.length - 1] === "") s.pop();
   return s;
 }
@@ -122507,16 +123049,16 @@ function getMatchParams(segments, paramsMap) {
   }
   return params;
 }
-function addRoute(ctx, method = "", path51, data) {
+function addRoute(ctx, method = "", path54, data) {
   method = method.toUpperCase();
-  if (path51.charCodeAt(0) !== 47) path51 = `/${path51}`;
-  const groupExpanded = expandGroupDelimiters(path51);
+  if (path54.charCodeAt(0) !== 47) path54 = `/${path54}`;
+  const groupExpanded = expandGroupDelimiters(path54);
   if (groupExpanded) {
     for (const expandedPath of groupExpanded) addRoute(ctx, method, expandedPath, data);
     return;
   }
-  path51 = encodeEscapes(path51);
-  const segments = splitRoute(path51);
+  path54 = encodeEscapes(path54);
+  const segments = splitRoute(path54);
   const expanded = expandModifiers(segments);
   if (expanded) {
     for (const p of expanded) addRoute(ctx, method, p, data);
@@ -122607,15 +123149,15 @@ function getParamRegexp(segment, unnamedStart = 0) {
   const regex = _s2.replace(/:([\w-]+)(?:\(([^)]*)\))?/g, (_, id2, p) => `(?<${toGroupName(id2)}>${p || "[^/]+"})`).replace(/\((?![?<])/g, () => `(?<${toUnnamedGroupKey(_i2++)}>`).replace(/\uFFFE(.)/g, (_, c10) => /[.*+?^${}()|[\]\\]/.test(c10) ? `\\${c10}` : c10);
   return [new RegExp(`^${regex}$`), _i2];
 }
-function findRoute(ctx, method = "", path51, opts) {
-  if (opts?.normalize) path51 = normalizePath(path51);
-  if (path51.charCodeAt(path51.length - 1) === 47) path51 = path51.slice(0, -1);
-  const staticNode = ctx.static[path51];
+function findRoute(ctx, method = "", path54, opts) {
+  if (opts?.normalize) path54 = normalizePath(path54);
+  if (path54.charCodeAt(path54.length - 1) === 47) path54 = path54.slice(0, -1);
+  const staticNode = ctx.static[path54];
   if (staticNode && staticNode.methods) {
     const staticMatch = staticNode.methods[method] || staticNode.methods[""];
     if (staticMatch !== void 0) return staticMatch[0];
   }
-  const segments = splitPath(path51);
+  const segments = splitPath(path54);
   const match = _lookupTree(ctx.root, method, segments, 0);
   if (match === void 0) return;
   if (opts?.params === false) return match;
@@ -122815,7 +123357,7 @@ var OpenAPIMatcher = class {
     this.rootRouter = router;
     this.index(router);
   }
-  index(router, path51 = []) {
+  index(router, path54 = []) {
     const lazyResults = walkProcedureContractsSync(router, (contract, path210) => {
       if (!value(this.filter, contract, path210)) {
         return;
@@ -122830,7 +123372,7 @@ var OpenAPIMatcher = class {
         contract,
         procedure: contract instanceof Procedure ? contract : void 0
       });
-    }, path51);
+    }, path54);
     for (const result of lazyResults) {
       const prefix = getOpenAPIMeta(result.router)?.prefix;
       this.pendingLazyRouters.add({
@@ -122917,20 +123459,20 @@ var OpenAPIMatcher = class {
     return entry.procedure;
   }
 };
-function toRou3Pattern(path51) {
-  const params = getDynamicPathParams(path51);
+function toRou3Pattern(path54) {
+  const params = getDynamicPathParams(path54);
   if (!params?.length) {
-    return path51;
+    return path54;
   }
   for (let i10 = params.length - 1; i10 >= 0; i10--) {
     const param = params[i10];
     const pattern = param.allowsSlash ? `**:${param.parameterName}` : `:${param.parameterName}`;
-    path51 = path51.slice(0, param.startIndex) + pattern + path51.slice(param.startIndex + param.segment.length);
+    path54 = path54.slice(0, param.startIndex) + pattern + path54.slice(param.startIndex + param.segment.length);
   }
-  return path51;
+  return path54;
 }
-function toRou3PrefixMatcher(path51) {
-  const pattern = toRou3Pattern(path51);
+function toRou3PrefixMatcher(path54) {
+  const pattern = toRou3Pattern(path54);
   return routeToRegExp(pattern === "/" ? "/**" : `${pattern}/**`);
 }
 function decodeParams(params) {
@@ -123009,7 +123551,7 @@ var OpenAPIHandlerCodecCore = class {
   /**
    * @throws {TypeError} If `outputStructure` is "detailed" and the output doesn't match the expected structure.
    */
-  encodeOutput(output2, procedure, path51) {
+  encodeOutput(output2, procedure, path54) {
     const meta3 = getOpenAPIMeta(procedure);
     const successStatus = meta3?.successStatus ?? DEFAULT_SUCCESS_STATUS;
     const outputStructure = meta3?.outputStructure ?? DEFAULT_OPENAPI_OUTPUT_STRUCTURE;
@@ -123022,7 +123564,7 @@ var OpenAPIHandlerCodecCore = class {
     }
     if (!isValidDetailedOutput(output2)) {
       throw new TypeError(`
-        Invalid "detailed" output structure returned by procedure (${path51.join(".")}):
+        Invalid "detailed" output structure returned by procedure (${path54.join(".")}):
         \u2022 Expected an object with optional properties:
           - status (number <400)
           - headers (object)
@@ -123410,7 +123952,8 @@ var IdentityValueSchema = external_exports.strictObject({
   name: external_exports.string(),
   defaultConfigProfile: external_exports.string().optional(),
   allowAmbientCredential: external_exports.boolean(),
-  credential: CredentialSummarySchema2.optional()
+  credential: CredentialSummarySchema2.optional(),
+  anchors: external_exports.array(AnchorSchema).optional()
 });
 var ProfileValueSchema = ConfigProfileSchema.omit({ $schema: true });
 var ProviderValueSchema = external_exports.strictObject({
@@ -123428,7 +123971,9 @@ var ConfigIdentitySetInputSchema = external_exports.strictObject({
   name: external_exports.string().min(1),
   defaultConfigProfile: external_exports.union([external_exports.string().min(1), external_exports.literal(false)]).optional(),
   allowAmbientCredential: external_exports.boolean().optional(),
-  credential: external_exports.union([external_exports.literal(false), CredentialWriteSchema(CREDENTIAL_TARGETS)]).optional()
+  credential: external_exports.union([external_exports.literal(false), CredentialWriteSchema(CREDENTIAL_TARGETS)]).optional(),
+  /** `false` removes the anchors; a list replaces them. */
+  anchors: external_exports.union([external_exports.literal(false), external_exports.array(AnchorSchema).min(1)]).optional()
 });
 var ConfigIdentitySetOutputSchema = storedMutationOutput("identity", "updated", IdentityValueSchema);
 var ConfigIdentityRemoveInputSchema = external_exports.strictObject({ name: external_exports.string().min(1), confirm: RemovalConfirmationSchema });
@@ -123549,7 +124094,8 @@ function identityValue(name, paths) {
     name: identity.name,
     ...identity.defaultConfigProfile === void 0 ? {} : { defaultConfigProfile: identity.defaultConfigProfile },
     allowAmbientCredential: identity.allowAmbientCredential,
-    ...identity.credential === void 0 ? {} : { credential: summariseCredential(identity.credential) }
+    ...identity.credential === void 0 ? {} : { credential: summariseCredential(identity.credential) },
+    ...identity.anchors === void 0 ? {} : { anchors: identity.anchors }
   };
 }
 function providerValue(name, provider) {
@@ -123570,7 +124116,7 @@ function profileValue(name, paths) {
 function createConfigApiRouter(deps) {
   const authed = doorApiAuth(deps.expectedToken);
   const { paths } = deps;
-  const route = (path51, summary) => authed.meta(openapi({ method: "POST", path: path51, summary, tags: [CONFIG_API_TAG] }));
+  const route = (path54, summary) => authed.meta(openapi({ method: "POST", path: path54, summary, tags: [CONFIG_API_TAG] }));
   return {
     config: {
       identity: {
@@ -123580,9 +124126,9 @@ function createConfigApiRouter(deps) {
             return { action: "created", kind: "identity", name: input2.name, value: identityValue(input2.name, paths) };
           })
         ),
-        set: route("/rest/config/identity/set", "Update an identity's default profile, ambient-credential setting or credential").input(ConfigIdentitySetInputSchema).output(ConfigIdentitySetOutputSchema).handler(
+        set: route("/rest/config/identity/set", "Update an identity's default profile, ambient-credential setting, credential or anchors").input(ConfigIdentitySetInputSchema).output(ConfigIdentitySetOutputSchema).handler(
           ({ input: input2 }) => guarded(() => {
-            requireChange(input2.defaultConfigProfile !== void 0 || input2.allowAmbientCredential !== void 0 || input2.credential !== void 0, "defaultConfigProfile, allowAmbientCredential or credential");
+            requireChange(input2.defaultConfigProfile !== void 0 || input2.allowAmbientCredential !== void 0 || input2.credential !== void 0 || input2.anchors !== void 0, "defaultConfigProfile, allowAmbientCredential, credential or anchors");
             if (!identityExists(paths, input2.name)) {
               throw new IdentityNotFoundError(input2.name);
             }
@@ -123607,6 +124153,9 @@ function createConfigApiRouter(deps) {
               };
               setIdentityCredential(paths, input2.name, change);
             }
+            if (input2.anchors !== void 0) {
+              setIdentityAnchors(paths, input2.name, input2.anchors === false ? void 0 : input2.anchors);
+            }
             return { action: "updated", kind: "identity", name: input2.name, value: identityValue(input2.name, paths) };
           })
         ),
@@ -123922,7 +124471,7 @@ function createLifecycleApiRouter(deps) {
 init_cliError();
 
 // src/frontdoor/launchSchemas.ts
-var import_node_path42 = __toESM(require("node:path"), 1);
+var import_node_path44 = __toESM(require("node:path"), 1);
 init_zod();
 init_claudeVersion();
 init_identity();
@@ -123932,7 +124481,7 @@ var LaunchResolveInputSchema = external_exports.strictObject({
   argv: external_exports.readonly(external_exports.array(external_exports.string())).optional(),
   /** The launch's inherited environment. Absent means an empty one: the door's own environment is never a substitute for the caller's, so a caller that wants `AGENT_SHIM_*` switches or a `CLAUDE_CONFIG_DIR` considered names them here. Values are read, never reported. */
   env: external_exports.record(external_exports.string(), external_exports.string()).optional()
-}).refine((input2) => import_node_path42.default.isAbsolute(input2.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+}).refine((input2) => import_node_path44.default.isAbsolute(input2.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
 var LaunchPoolDecisionSchema = external_exports.strictObject({
   name: external_exports.string(),
   reasons: external_exports.readonly(external_exports.array(external_exports.string())),
@@ -124208,11 +124757,11 @@ function rcFanoutOnDoorHub(fanout, hub) {
 // src/frontdoor/quotaExpiringEvents.ts
 init_schema2();
 var MS_PER_HOUR4 = 36e5;
-var MS_PER_DAY3 = 864e5;
+var MS_PER_DAY4 = 864e5;
 var FIVE_HOUR_WINDOW_HOURS = 5;
 var SEVEN_DAY_WINDOW_DAYS = 7;
 var FIVE_HOUR_WINDOW_MS2 = FIVE_HOUR_WINDOW_HOURS * MS_PER_HOUR4;
-var SEVEN_DAY_WINDOW_MS2 = SEVEN_DAY_WINDOW_DAYS * MS_PER_DAY3;
+var SEVEN_DAY_WINDOW_MS2 = SEVEN_DAY_WINDOW_DAYS * MS_PER_DAY4;
 var FINAL_SPAN_DENOMINATOR = 30;
 var QUOTA_EXPIRING_WINDOW_FRACTION = 1 / FINAL_SPAN_DENOMINATOR;
 function createQuotaExpiringPublisher(hub, deps) {
@@ -125010,17 +125559,17 @@ function unifiedQuotaHeaders(upstream, rejected, quotaError) {
   }
   return headers;
 }
-var MS_PER_SECOND7 = 1e3;
+var MS_PER_SECOND8 = 1e3;
 function buildUsageSnapshot(upstream, quotaError, nowMs) {
   const used7 = upstream.get("x-codex-primary-used-percent") ?? (quotaError === void 0 ? null : EXHAUSTED_PERCENT);
   const reset7 = upstream.get("x-codex-primary-reset-at") ?? (quotaError?.resets_at === void 0 ? null : String(quotaError.resets_at));
-  const sevenDay = used7 !== null && reset7 !== null ? { used_percentage: Number(used7), resets_at: new Date(Number(reset7) * MS_PER_SECOND7).toISOString() } : void 0;
+  const sevenDay = used7 !== null && reset7 !== null ? { used_percentage: Number(used7), resets_at: new Date(Number(reset7) * MS_PER_SECOND8).toISOString() } : void 0;
   let fiveHour;
   if (Number(upstream.get("x-codex-secondary-window-minutes")) > 0) {
     const used5 = upstream.get("x-codex-secondary-used-percent");
     const reset5 = upstream.get("x-codex-secondary-reset-at");
     if (used5 !== null && reset5 !== null) {
-      fiveHour = { used_percentage: Number(used5), resets_at: new Date(Number(reset5) * MS_PER_SECOND7).toISOString() };
+      fiveHour = { used_percentage: Number(used5), resets_at: new Date(Number(reset5) * MS_PER_SECOND8).toISOString() };
     }
   }
   if (sevenDay === void 0 && fiveHour === void 0) {
@@ -125429,8 +125978,8 @@ function createCodexRouteMount(ports, upstreamBase, provider) {
         request7.body.resume();
         return;
       }
-      const path51 = new URL(request7.url, "http://127.0.0.1").pathname;
-      const translated = { method: request7.method, path: path51, body, signal: request7.signal };
+      const path54 = new URL(request7.url, "http://127.0.0.1").pathname;
+      const translated = { method: request7.method, path: path54, body, signal: request7.signal };
       const routed = await route(translated);
       if (request7.signal.aborted) {
         return;
@@ -125464,7 +126013,7 @@ function createPassthroughRoute(name, target) {
     headroomUpstream: target.headroomUpstream,
     serve: async (request7, response) => {
       const incoming = new URL(request7.url, "http://127.0.0.1");
-      const path51 = target.stripPrefix !== void 0 && incoming.pathname.startsWith(target.stripPrefix) ? incoming.pathname.slice(target.stripPrefix.length) : incoming.pathname;
+      const path54 = target.stripPrefix !== void 0 && incoming.pathname.startsWith(target.stripPrefix) ? incoming.pathname.slice(target.stripPrefix.length) : incoming.pathname;
       const headers = forwardableHeaders(request7.headers);
       delete headers.host;
       await new Promise((resolve2) => {
@@ -125472,7 +126021,7 @@ function createPassthroughRoute(name, target) {
           host: base.hostname,
           port: base.port === "" ? void 0 : Number(base.port),
           method: request7.method,
-          path: `${basePath}${path51}${incoming.search}`,
+          path: `${basePath}${path54}${incoming.search}`,
           headers,
           agent
         };
@@ -125605,7 +126154,7 @@ async function scanRequestHead(request7, wholeBody = false) {
 
 // src/frontdoor/providerRoute.ts
 function createProviderRouteResolver(deps) {
-  const isRcSelfHostPath = (path51) => path51 === "/v1/code/sessions" || path51.startsWith("/v1/code/sessions/") || path51 === "/v1/sessions" || path51.startsWith("/v1/sessions/");
+  const isRcSelfHostPath = (path54) => path54 === "/v1/code/sessions" || path54.startsWith("/v1/code/sessions/") || path54 === "/v1/sessions" || path54.startsWith("/v1/sessions/");
   const oauthRoute = createPassthroughRoute("anthropic", { baseUrl: `https://${CONNECT_INTERCEPT_HOST}:${String(HTTPS_PORT)}`, stripPrefix: void 0, headroomUpstream: void 0 });
   const passthroughByTarget = /* @__PURE__ */ new Map();
   const passthroughFor = (name, target) => {
@@ -125619,16 +126168,16 @@ function createProviderRouteResolver(deps) {
     return route;
   };
   const resolve2 = (request7) => {
-    const path51 = new URL(request7.url, "http://127.0.0.1").pathname;
-    const scoped = parseProviderPath(path51);
+    const path54 = new URL(request7.url, "http://127.0.0.1").pathname;
+    const scoped = parseProviderPath(path54);
     if (scoped === void 0) {
-      if (deps.rcSelfHostRoute !== void 0 && isRcSelfHostPath(path51)) {
+      if (deps.rcSelfHostRoute !== void 0 && isRcSelfHostPath(path54)) {
         return { ok: true, route: deps.rcSelfHostRoute };
       }
-      if (request7.session.provider !== void 0 && path51.startsWith("/v1/") && !isRcSelfHostPath(path51)) {
+      if (request7.session.provider !== void 0 && path54.startsWith("/v1/") && !isRcSelfHostPath(path54)) {
         return resolve2({ ...request7, url: `${PROVIDER_PATH_PREFIX}${encodeURIComponent(request7.session.provider)}${request7.url}` });
       }
-      return path51.startsWith("/v1/") ? { ok: true, route: oauthRoute } : { ok: false, status: HTTP_STATUS.notFound, message: `no such endpoint: ${path51}` };
+      return path54.startsWith("/v1/") ? { ok: true, route: oauthRoute } : { ok: false, status: HTTP_STATUS.notFound, message: `no such endpoint: ${path54}` };
     }
     const { provider } = scoped;
     let definition;
@@ -125681,8 +126230,8 @@ function createProviderRouteResolver(deps) {
     let replay;
     const visited = /* @__PURE__ */ new Set();
     for (; ; ) {
-      const path51 = new URL(current.url, "http://127.0.0.1").pathname;
-      const scoped = parseProviderPath(path51);
+      const path54 = new URL(current.url, "http://127.0.0.1").pathname;
+      const scoped = parseProviderPath(path54);
       const providerName = scoped?.provider ?? current.session.provider;
       if (providerName !== void 0 && visited.has(providerName)) {
         return { ok: false, status: HTTP_STATUS.internalServerError, message: `provider routing cycle: ${[...visited, providerName].join(" -> ")}` };
@@ -125740,7 +126289,7 @@ function createProviderRouteResolver(deps) {
         const headers = Object.fromEntries(Object.entries(replay.headers).filter(([name]) => name.toLowerCase() !== "content-length"));
         replay = { ...replay, headers, body: import_node_stream3.Readable.from([Buffer.from(rewritten, "utf8")]) };
       }
-      const rest = scoped === void 0 ? path51 : path51.slice(`${PROVIDER_PATH_PREFIX}${encodeURIComponent(scoped.provider)}`.length);
+      const rest = scoped === void 0 ? path54 : path54.slice(`${PROVIDER_PATH_PREFIX}${encodeURIComponent(scoped.provider)}`.length);
       const query = current.url.includes("?") ? current.url.slice(current.url.indexOf("?")) : "";
       current = { ...current, url: `${PROVIDER_PATH_PREFIX}${encodeURIComponent(matched.provider)}${rest}${query}`, body: replay.body, headers: replay.headers };
     }
@@ -125847,14 +126396,14 @@ function createRcLiveUsage(deps) {
 }
 
 // src/frontdoor/rcSelfHostMint.ts
-var import_node_path43 = __toESM(require("node:path"), 1);
+var import_node_path45 = __toESM(require("node:path"), 1);
 init_account();
 
 // src/frontdoor/rcSelfHostLocal.ts
 var RC_SELF_HOST_OAUTH_HOST = "platform.claude.com";
 var RC_SELF_HOST_SCOPE_LIST = ["user:profile", "user:inference", "user:sessions:claude_code", "user:mcp_servers", "user:file_upload"];
 var RC_SELF_HOST_OAUTH_TOKEN_TTL_SECONDS = 3600;
-var MS_PER_SECOND8 = 1e3;
+var MS_PER_SECOND9 = 1e3;
 var HTTP_SERVICE_UNAVAILABLE = 503;
 function isRecord6(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
@@ -125910,7 +126459,7 @@ function createRcSelfHostLocal(deps) {
       }
       if (method === "POST" && pathname.startsWith("/api/eval/")) {
         await deps.readBody(request7, CONTROL_BODY_CAP_BYTES);
-        answerServerJson(response, HTTP_STATUS.ok, { features: growthBookFeatures(), dateUpdated: Math.floor(deps.now() / MS_PER_SECOND8) });
+        answerServerJson(response, HTTP_STATUS.ok, { features: growthBookFeatures(), dateUpdated: Math.floor(deps.now() / MS_PER_SECOND9) });
         return true;
       }
       if (method === "GET" && pathname === "/api/oauth/profile") {
@@ -125977,7 +126526,7 @@ function readJsonObject(fs22, file2) {
   return isRecord7(parsed) ? parsed : void 0;
 }
 function readRcSelfHostRecord(fs22, frontdoorDir) {
-  const parsed = readJsonObject(fs22, import_node_path43.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
+  const parsed = readJsonObject(fs22, import_node_path45.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
   if (parsed === void 0) {
     return void 0;
   }
@@ -125991,11 +126540,11 @@ function mintRcSelfHostCredential(deps) {
   if (!isIdentityName(deps.identity)) {
     throw new Error(`"${deps.identity}" is not a valid identity name.`);
   }
-  const identityDir = import_node_path43.default.join(deps.identitiesDir, deps.identity);
-  const credentialsFile = import_node_path43.default.join(identityDir, CREDENTIALS_FILE2);
-  const claudeJsonFile = import_node_path43.default.join(identityDir, CLAUDE_JSON2);
-  const recordDir = import_node_path43.default.join(deps.frontdoorDir, RC_SELF_HOST_RECORD_DIR);
-  const recordFile = import_node_path43.default.join(recordDir, RC_SELF_HOST_RECORD_FILE);
+  const identityDir = import_node_path45.default.join(deps.identitiesDir, deps.identity);
+  const credentialsFile = import_node_path45.default.join(identityDir, CREDENTIALS_FILE2);
+  const claudeJsonFile = import_node_path45.default.join(identityDir, CLAUDE_JSON2);
+  const recordDir = import_node_path45.default.join(deps.frontdoorDir, RC_SELF_HOST_RECORD_DIR);
+  const recordFile = import_node_path45.default.join(recordDir, RC_SELF_HOST_RECORD_FILE);
   const previousRecord = readRcSelfHostRecord(deps.fs, deps.frontdoorDir);
   const existingCredentials = readJsonObject(deps.fs, credentialsFile);
   const existingOauth = isRecord7(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
@@ -126011,7 +126560,7 @@ function mintRcSelfHostCredential(deps) {
   const organizationUuid = deps.newUuid();
   const accountUuid = deps.newUuid();
   const mintedAt = new Date(deps.now()).toISOString();
-  deps.fs.mkdirPrivate(import_node_path43.default.dirname(credentialsFile));
+  deps.fs.mkdirPrivate(import_node_path45.default.dirname(credentialsFile));
   deps.fs.writeFilePrivate(credentialsFile, `${JSON.stringify({ ...existingCredentials, claudeAiOauth: { accessToken, refreshToken, expiresAt: null, scopes: [...RC_SELF_HOST_SCOPE_LIST], subscriptionType: SELF_HOST_SUBSCRIPTION_TYPE, rateLimitTier: null } }, null, 2)}
 `);
   const claudeJson = readJsonObject(deps.fs, claudeJsonFile) ?? {};
@@ -126094,12 +126643,12 @@ function eventExcerpt(text2) {
   return text2.length <= RC_PENDING_SUMMARY_EXCERPT_CHARS ? text2 : `${text2.slice(0, RC_PENDING_SUMMARY_EXCERPT_CHARS)}...`;
 }
 var PERCENT_SCALE = 100;
-var MS_PER_SECOND9 = 1e3;
+var MS_PER_SECOND10 = 1e3;
 function percentOf(fraction) {
   return `${String(Math.round(fraction * PERCENT_SCALE))}%`;
 }
 function resetInstantOf(epochSeconds) {
-  return new Date(epochSeconds * MS_PER_SECOND9).toISOString();
+  return new Date(epochSeconds * MS_PER_SECOND10).toISOString();
 }
 function formatRcRateLimitInfo(info) {
   const parts = [info.status];
@@ -126398,7 +126947,7 @@ function registerRcCommand(frontdoor, paths) {
 }
 
 // src/frontdoor/rcCredentialStore.ts
-var import_node_path44 = __toESM(require("node:path"), 1);
+var import_node_path46 = __toESM(require("node:path"), 1);
 function isSafeSessionId(sessionId) {
   return /^[A-Za-z0-9_-]+$/.test(sessionId);
 }
@@ -126424,7 +126973,7 @@ function sequenceNumOfJson(value2) {
 }
 function createRcCredentialStore(fs22, dir) {
   fs22.mkdirPrivate(dir);
-  const fileFor = (sessionId) => import_node_path44.default.join(dir, `${sessionId}.json`);
+  const fileFor = (sessionId) => import_node_path46.default.join(dir, `${sessionId}.json`);
   const readParsed = (sessionId) => {
     const raw = fs22.readFileUtf8(fileFor(sessionId));
     if (raw === void 0) {
@@ -127534,7 +128083,7 @@ var RC_COMPAT_SESSIONS_PATH = "/v1/sessions";
 var RC_SESSION_ID_PREFIX2 = "cse_";
 var RC_SELF_HOST_API_BASE_URL = "https://api.anthropic.com";
 var HTTP_CONFLICT = 409;
-var MS_PER_SECOND10 = 1e3;
+var MS_PER_SECOND11 = 1e3;
 var HTTP_SERVICE_UNAVAILABLE2 = 503;
 var RC_SELF_HOST_WORKER_JWT_TTL_SECONDS = 46800;
 var RC_SELF_HOST_KEEPALIVE_MS = 15e3;
@@ -127634,7 +128183,7 @@ function parseJsonObject5(body) {
 function mintWorkerJwt(randomToken, issuedAt) {
   const encode3 = (value2) => Buffer.from(JSON.stringify(value2), "utf8").toString("base64url");
   const header = encode3({ alg: "HS256", typ: "JWT" });
-  const payload = encode3({ exp: Math.floor((issuedAt + RC_SELF_HOST_WORKER_JWT_TTL_SECONDS * MS_PER_SECOND10) / MS_PER_SECOND10), iat: Math.floor(issuedAt / MS_PER_SECOND10) });
+  const payload = encode3({ exp: Math.floor((issuedAt + RC_SELF_HOST_WORKER_JWT_TTL_SECONDS * MS_PER_SECOND11) / MS_PER_SECOND11), iat: Math.floor(issuedAt / MS_PER_SECOND11) });
   return `${header}.${payload}.${Buffer.from(randomToken(), "utf8").toString("base64url")}`;
 }
 function createRcSelfHostSurface(deps) {
@@ -128705,6 +129254,48 @@ function realFrontDoorSupervisorPorts(paths) {
     const pools = readPools(paths);
     void refreshStalePoolMembers({ poolNames: Object.keys(pools), pools, loadMembers: (identities) => loadPoolMembers(realFarmFs, paths, identities, Date.now()), refresher: anthropicRefresher });
   }, ANTHROPIC_USAGE_FRESHNESS_MS).unref();
+  const windowOpener = createRealWindowOpener({ paths, cwd: process.cwd(), spawnDaemon: spawnDetachedSupervisor });
+  let keeperRunning = false;
+  setInterval(() => {
+    if (keeperRunning) {
+      return;
+    }
+    keeperRunning = true;
+    void runWindowKeeper({
+      fs: realFarmFs,
+      stampsFile: paths.usageAnchorsFile,
+      nowMs: () => Date.now(),
+      timeZone: machineTimeZone(),
+      anchored: () => listAnchoredIdentities(paths),
+      snapshot: (identity) => readUsageSnapshot(realFarmFs, paths.usageSnapshotsDir, identity),
+      open: windowOpener,
+      log
+    }).catch((error63) => {
+      log(`window keeper failed: ${error63 instanceof Error ? error63.message : String(error63)}`);
+    }).finally(() => {
+      keeperRunning = false;
+    });
+  }, ANTHROPIC_USAGE_FRESHNESS_MS).unref();
+  const jobRunner = createRealJobRunner({ paths, spawnDaemon: spawnDetachedSupervisor, fs: realFarmFs, now: () => /* @__PURE__ */ new Date() });
+  const runningJobs = /* @__PURE__ */ new Set();
+  setInterval(() => {
+    try {
+      runJobs({
+        fs: realFarmFs,
+        stampsFile: paths.usageJobsFile,
+        nowMs: () => Date.now(),
+        timeZone: machineTimeZone(),
+        jobs: () => Object.entries(readJobs(paths)).map(([name, job]) => ({ name, job })),
+        resolveIdentity: (target) => resolveJobIdentity({ paths, fs: realFarmFs, pools: readPools(paths), nowMs: Date.now(), identityExists: (name) => identityExists(paths, name) }, target),
+        snapshot: (identity) => readUsageSnapshot(realFarmFs, paths.usageSnapshotsDir, identity),
+        run: jobRunner,
+        running: runningJobs,
+        log
+      });
+    } catch (error63) {
+      log(`job keeper failed: ${error63 instanceof Error ? error63.message : String(error63)}`);
+    }
+  }, ANTHROPIC_USAGE_FRESHNESS_MS).unref();
   const usageMiddleware = createUsageMiddleware({
     record: withQuotaRefresh(usageStore.record, quotaRefresher),
     defer: (task) => {
@@ -128848,7 +129439,7 @@ function realFrontDoorSupervisorPorts(paths) {
       const leafFor = createLeafCache(loadCa(), () => /* @__PURE__ */ new Date());
       const capture = captureFromEnv(process.env, paths.logsDir);
       if (capture !== void 0) {
-        log(`capture enabled, recording CONNECT targets and piped exchanges to ${import_node_path45.default.join(paths.logsDir, "frontdoor-capture.jsonl")}`);
+        log(`capture enabled, recording CONNECT targets and piped exchanges to ${import_node_path47.default.join(paths.logsDir, "frontdoor-capture.jsonl")}`);
       }
       if (rcSelfHostSurface !== void 0) {
         log("self-hosted Remote Control surface on: the door serves the CCR session family itself, and its own client-half dials its own transparent surface");
@@ -130985,8 +131576,8 @@ function getErrorMap2() {
 
 // node_modules/.pnpm/zod@4.6.5/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path51, errorMaps, issueData } = params;
-  const fullPath = [...path51, ...issueData.path || []];
+  const { data, path: path54, errorMaps, issueData } = params;
+  const fullPath = [...path54, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -131101,11 +131692,11 @@ var errorUtil;
 
 // node_modules/.pnpm/zod@4.6.5/node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value2, path51, key) {
+  constructor(parent, value2, path54, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value2;
-    this._path = path51;
+    this._path = path54;
     this._key = key;
   }
   get path() {
@@ -134668,11 +135259,11 @@ function normalizeObjectSchema(schema) {
   }
   return void 0;
 }
-function getDotPath(path51) {
-  if (path51.length === 0) {
+function getDotPath(path54) {
+  if (path54.length === 0) {
     return "object root";
   }
-  return path51.reduce((acc, seg, index) => {
+  return path54.reduce((acc, seg, index) => {
     if (index === 0) {
       return String(seg);
     }
@@ -138715,7 +139306,7 @@ async function serveMcp(mcp, transport, options = {}) {
 
 // src/mcp/permissions.ts
 var import_node_fs17 = __toESM(require("node:fs"), 1);
-var import_node_path46 = __toESM(require("node:path"), 1);
+var import_node_path48 = __toESM(require("node:path"), 1);
 init_zod();
 init_store();
 var StoredMcpPermissionsSchema = external_exports.strictObject({
@@ -138735,10 +139326,10 @@ function effectiveMcpPermissions(flags, stored) {
   return { writes: flags.writes || stored.writes, remoteControl: flags.remoteControl || stored.remoteControl };
 }
 function watchMcpPermissions(paths, onChange) {
-  const directory = import_node_path46.default.dirname(paths.mcpPermissionsFile);
+  const directory = import_node_path48.default.dirname(paths.mcpPermissionsFile);
   import_node_fs17.default.mkdirSync(directory, { recursive: true });
   const watcher = import_node_fs17.default.watch(directory, (_event, filename) => {
-    if (filename === null || filename === import_node_path46.default.basename(paths.mcpPermissionsFile)) {
+    if (filename === null || filename === import_node_path48.default.basename(paths.mcpPermissionsFile)) {
       onChange();
     }
   });
@@ -139047,16 +139638,16 @@ init_credentialCache();
 
 // src/identityToken.ts
 var import_node_fs18 = __toESM(require("node:fs"), 1);
-var import_node_path47 = __toESM(require("node:path"), 1);
+var import_node_path49 = __toESM(require("node:path"), 1);
 init_cliError();
 var TOKEN_FILE_MODE = 384;
 var TOKEN_DIR_MODE = 448;
 var OAUTH_TOKEN_RE = /^sk-ant-oat\d+-[A-Za-z0-9_-]+$/;
 function identityTokenDir(paths) {
-  return import_node_path47.default.join(paths.root, "credentials");
+  return import_node_path49.default.join(paths.root, "credentials");
 }
 function identityTokenPath(paths, identityName) {
-  return import_node_path47.default.join(identityTokenDir(paths), `${identityName}.token`);
+  return import_node_path49.default.join(identityTokenDir(paths), `${identityName}.token`);
 }
 function storeIdentityToken(paths, identityName, raw) {
   const token = raw.trim();
@@ -139067,7 +139658,7 @@ function storeIdentityToken(paths, identityName, raw) {
   import_node_fs18.default.mkdirSync(dir, { recursive: true, mode: TOKEN_DIR_MODE });
   import_node_fs18.default.chmodSync(dir, TOKEN_DIR_MODE);
   const target = identityTokenPath(paths, identityName);
-  const temp = import_node_path47.default.join(dir, `.${identityName}.${String(process.pid)}.tmp`);
+  const temp = import_node_path49.default.join(dir, `.${identityName}.${String(process.pid)}.tmp`);
   import_node_fs18.default.writeFileSync(temp, `${token}
 `, { mode: TOKEN_FILE_MODE });
   import_node_fs18.default.renameSync(temp, target);
@@ -139235,7 +139826,7 @@ function registerDoctorCommand(program2, deps) {
 // src/headroom/commands.ts
 var import_node_fs19 = __toESM(require("node:fs"), 1);
 var import_node_http4 = __toESM(require("node:http"), 1);
-var import_node_path48 = __toESM(require("node:path"), 1);
+var import_node_path50 = __toESM(require("node:path"), 1);
 var import_node_child_process6 = require("node:child_process");
 init_commandDeps();
 init_realFrontDoorPort();
@@ -139365,12 +139956,12 @@ function readInstalledHeadroomCommit() {
   if (toolDir.status !== 0) {
     return void 0;
   }
-  const libDir = import_node_path48.default.join(toolDir.stdout.trim(), HEADROOM_TOOL_NAME, "lib");
+  const libDir = import_node_path50.default.join(toolDir.stdout.trim(), HEADROOM_TOOL_NAME, "lib");
   for (const python of realFarmFs.readdir(libDir)) {
-    const sitePackages = import_node_path48.default.join(libDir, python, "site-packages");
+    const sitePackages = import_node_path50.default.join(libDir, python, "site-packages");
     for (const entry of realFarmFs.readdir(sitePackages)) {
       if (entry.startsWith("headroom_ai-") && entry.endsWith(".dist-info")) {
-        const directUrl = realFarmFs.readFileUtf8(import_node_path48.default.join(sitePackages, entry, "direct_url.json"));
+        const directUrl = realFarmFs.readFileUtf8(import_node_path50.default.join(sitePackages, entry, "direct_url.json"));
         return directUrl === void 0 ? void 0 : parseInstalledCommit(directUrl);
       }
     }
@@ -139505,6 +140096,134 @@ function registerHeadroomCommand(program2, deps) {
   });
 }
 
+// src/jobs.ts
+var import_node_path51 = __toESM(require("node:path"), 1);
+init_commandDeps();
+init_cliError();
+init_schema();
+init_realPorts();
+function jobOf(options) {
+  if (options.identity === void 0 === (options.pool === void 0)) {
+    throw new UsageError("A job runs as one identity or one pool's pick: pass exactly one of --identity or --pool.");
+  }
+  if (options.at === void 0 === (options.beforeReset === void 0)) {
+    throw new UsageError("A job needs exactly one trigger: pass --at (repeatable) or --before-reset with --lead.");
+  }
+  if (options.beforeReset !== void 0 && options.lead === void 0) {
+    throw new UsageError("--before-reset needs --lead, how long before the window resets the job runs.");
+  }
+  if (options.at !== void 0 && options.lead !== void 0) {
+    throw new UsageError("--lead only goes with --before-reset.");
+  }
+  if (options.prompt === void 0 || options.timeout === void 0) {
+    throw new UsageError("A job needs --prompt, what to run, and --timeout, how long one run may take.");
+  }
+  return {
+    target: options.identity === void 0 ? { pool: options.pool ?? "" } : { identity: options.identity },
+    trigger: options.at === void 0 ? { beforeReset: options.beforeReset ?? "fiveHour", lead: options.lead ?? "" } : { at: options.at },
+    prompt: options.prompt,
+    cwd: import_node_path51.default.resolve(options.cwd ?? process.cwd()),
+    timeout: options.timeout,
+    ...options.model === void 0 ? {} : { model: options.model },
+    ...options.allowedTool === void 0 ? {} : { allowedTools: options.allowedTool }
+  };
+}
+function describeTrigger(job) {
+  return "at" in job.trigger ? `at ${job.trigger.at.map(formatAnchor).join(" ")}` : `${job.trigger.lead} before the ${job.trigger.beforeReset} window resets`;
+}
+function describeTarget(job) {
+  return "identity" in job.target ? `identity ${job.target.identity}` : `the pick of pool ${job.target.pool}`;
+}
+function registerJobCommand(program2, deps) {
+  const { paths } = deps;
+  const job = withExamples(
+    program2.command("job").description("Manage jobs: prompts the front door runs unattended as an identity, on a schedule or shortly before a quota window resets to use quota that would expire."),
+    ["agent-shim job add digest --identity work --before-reset sevenDay --lead 6h --prompt 'summarise open PRs' --timeout 30m", "agent-shim job list"]
+  );
+  withExamples(
+    job.command("add <name>").description("Define a job. Fails if one with this name already exists.").option("--identity <name>", "Run as this identity.").option("--pool <name>", "Run as whichever member of this pool the ranking picks when the job fires.").option("--at <spec>", `Run at these times (repeatable): ${ANCHOR_SYNTAX}.`, collectAnchor).addOption(new Option("--before-reset <window>", "Run once per instance of this quota window, when it has --lead or less left.").choices(JOB_WINDOWS)).option("--lead <duration>", "With --before-reset: how long before the window resets the job runs, a count followed by m, h, d or w, such as 6h.", parseDurationLiteral).option("--prompt <text>", "What to run.").option("--cwd <dir>", "The directory the run works in. Defaults to the current directory.").option("--timeout <duration>", "How long one run may take, such as 30m. A run that goes on longer is stopped.", parseDurationLiteral).option("--model <model>", "The model to run with. Defaults to the settings' own.").option("--allowed-tool <tool>", "A tool the run may use without asking, beyond what its settings allow (repeatable). An unattended run cannot answer a permission prompt, so any other tool is refused.", collectRepeated).option("--json", "Print the result as JSON.").action((name, options) => {
+      const defined = jobOf(options);
+      if ("identity" in defined.target) {
+        requireIdentityNames(paths, [defined.target.identity]);
+      } else {
+        requirePool(paths, defined.target.pool);
+      }
+      const created = addJob(paths, name, defined);
+      reportMutation(options.json, { action: "created", kind: "job", name, value: created }, () => {
+        console.log(`Created job "${name}": runs as ${describeTarget(created)}, ${describeTrigger(created)}.`);
+      });
+    }),
+    ["agent-shim job add digest --identity work --at mon-fri@06:00 --prompt 'summarise open PRs' --timeout 30m --cwd ~/work/app", "agent-shim job add burn --pool subs --before-reset fiveHour --lead 20m --prompt 'continue the migration plan' --timeout 20m --allowed-tool Read --allowed-tool Edit"]
+  );
+  withExamples(
+    job.command("list").description("List every job.").option("--json", "Print the jobs as JSON.").action((options) => {
+      const jobs = readJobs(paths);
+      if (options.json === true) {
+        printJson(Object.entries(jobs).map(([name, entry]) => ({ name, ...entry })));
+        return;
+      }
+      const names = Object.keys(jobs).sort();
+      if (names.length === 0) {
+        console.log("No jobs yet. Run `agent-shim job add <name> ...` to create one.");
+        return;
+      }
+      for (const name of names) {
+        const entry = jobs[name];
+        if (entry !== void 0) {
+          console.log(`${name}: ${describeTarget(entry)}, ${describeTrigger(entry)}`);
+        }
+      }
+    }),
+    ["agent-shim job list", "agent-shim job list --json"]
+  );
+  withExamples(
+    job.command("show <name>").description("Show one job.").option("--json", "Print the job as JSON.").action((name, options) => {
+      const entry = requireJob(paths, name);
+      if (options.json === true) {
+        printJson({ name, ...entry });
+        return;
+      }
+      console.log(`Job: ${name}`);
+      console.log(`Runs as: ${describeTarget(entry)}`);
+      console.log(`Trigger: ${describeTrigger(entry)}`);
+      console.log(`Directory: ${entry.cwd}`);
+      console.log(`Timeout: ${entry.timeout}`);
+      if (entry.model !== void 0) {
+        console.log(`Model: ${entry.model}`);
+      }
+      if (entry.allowedTools !== void 0) {
+        console.log(`Allowed tools: ${entry.allowedTools.join(", ")}`);
+      }
+      console.log(`Prompt: ${entry.prompt}`);
+      console.log(`Results: ${import_node_path51.default.join(paths.jobLogsDir, `${name}.log`)}`);
+    }),
+    ["agent-shim job show digest"]
+  );
+  withExamples(
+    job.command("remove <name>").description("Delete a job.").option("--yes", "Skip the confirmation prompt.").option("--json", "Print the result as JSON.").action(async (name, options) => {
+      requireJob(paths, name);
+      await confirmRemoval(deps, options.yes, `job "${name}"`);
+      removeJob(paths, name);
+      reportMutation(options.json, { action: "removed", kind: "job", name }, () => {
+        console.log(`Removed job "${name}".`);
+      });
+    }),
+    ["agent-shim job remove digest --yes"]
+  );
+  withExamples(
+    job.command("run <name>").description("Run a job now, in this terminal, as its trigger would: for a pool the member is picked at this moment. The result is appended to the job's log, and a failure exits non-zero.").action(async (name) => {
+      const entry = requireJob(paths, name);
+      const identity = resolveJobIdentity({ paths, fs: realFarmFs, pools: readPools(paths), nowMs: Date.now(), identityExists: (candidate) => identityExists(paths, candidate) }, entry.target);
+      if (identity === void 0) {
+        throw new UsageError(`No member of the job's pool can be picked right now.`);
+      }
+      await createRealJobRunner({ paths, spawnDaemon: spawnDetachedSupervisor, fs: realFarmFs, now: () => /* @__PURE__ */ new Date() })(name, identity, entry);
+      console.log(`Ran job "${name}" as ${identity}; the result is in ${import_node_path51.default.join(paths.jobLogsDir, `${name}.log`)}.`);
+    }),
+    ["agent-shim job run digest"]
+  );
+}
+
 // src/pools.ts
 init_commandDeps();
 init_cliError();
@@ -139910,7 +140629,7 @@ function registerRunCommand(program2, handler) {
 }
 
 // src/usage/commands.ts
-var import_node_path49 = __toESM(require("node:path"), 1);
+var import_node_path52 = __toESM(require("node:path"), 1);
 init_commandDeps();
 init_realPorts();
 init_account();
@@ -140048,7 +140767,7 @@ function collectAccounts(fs22, paths, identity, probe) {
   return names.map((name) => ({
     identity: name,
     account: readAccountMetadata(fs22, paths.identitiesDir, name),
-    signIn: identitySignIn(fs22, probe, { farmRoot: import_node_path49.default.join(paths.identitiesDir, name), hasCredentialBlock: readIdentity(paths, name)?.credential !== void 0 }),
+    signIn: identitySignIn(fs22, probe, { farmRoot: import_node_path52.default.join(paths.identitiesDir, name), hasCredentialBlock: readIdentity(paths, name)?.credential !== void 0 }),
     usage: readUsageSnapshot(fs22, paths.usageSnapshotsDir, name)
   }));
 }
@@ -140219,6 +140938,7 @@ function buildProgram(deps) {
   registerIdentityCommand(program2, deps);
   registerProfileCommand(program2, deps);
   registerPoolCommand(program2, deps);
+  registerJobCommand(program2, deps);
   registerProviderCommand(program2, deps);
   registerRuleCommand(program2, deps);
   registerCredentialCommand(program2, deps, deps.credentialPorts);
@@ -140393,7 +141113,7 @@ async function runClaude(argvOverride) {
 // src/cli.ts
 async function main() {
   aliasLegacyEnv(process.env);
-  const invokedName = import_node_path50.default.basename(process.argv[1] ?? "agent-shim");
+  const invokedName = import_node_path53.default.basename(process.argv[1] ?? "agent-shim");
   if (isInvokedAsClaude(invokedName)) {
     await runClaude();
     return;