claude-use 9.14.0 → 9.15.0

package/dist/cli.cjs

@@ -318,10 +318,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path52) {
-  if (!path52)
+function getElementAtPath(obj, path54) {
+  if (!path54)
     return obj;
-  return path52.reduce((acc, key) => acc?.[key], obj);
+  return path54.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -580,11 +580,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path52, issues) {
+function prefixIssues(path54, issues) {
   return issues.map((iss) => {
     var _a4;
     (_a4 = iss).path ?? (_a4.path = []);
-    iss.path.unshift(path52);
+    iss.path.unshift(path54);
     return iss;
   });
 }
@@ -1105,16 +1105,16 @@ function flattenError(error63, mapper = (issue2) => issue2.message) {
 }
 function formatError(error63, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error64, path52 = []) => {
+  const processError = (error64, path54 = []) => {
     for (const issue2 of error64.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path52, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path54, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path52, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path54, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path52, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path54, ...issue2.path]);
       } else {
-        const fullpath = [...path52, ...issue2.path];
+        const fullpath = [...path54, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -1153,17 +1153,17 @@ function formatError(error63, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error63, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error64, path52 = []) => {
+  const processError = (error64, path54 = []) => {
     var _a4;
     for (const issue2 of error64.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path52, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path54, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path52, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path54, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path52, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path54, ...issue2.path]);
       } else {
-        const fullpath = [...path52, ...issue2.path];
+        const fullpath = [...path54, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -1202,8 +1202,8 @@ function treeifyError(error63, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path52 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path52) {
+  const path54 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path54) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -19199,13 +19199,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path52 = ref.slice(1).split("/").filter(Boolean);
-  if (path52.length === 0) {
+  const path54 = ref.slice(1).split("/").filter(Boolean);
+  if (path54.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path52[0] === defsKey) {
-    const key = path52[1] === void 0 ? void 0 : decodeJSONPointerSegment(path52[1]);
+  if (path54[0] === defsKey) {
+    const key = path54[1] === void 0 ? void 0 : decodeJSONPointerSegment(path54[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -23712,42 +23712,42 @@ var require_defaults = __commonJS({
 var require_env_paths = __commonJS({
   "node_modules/.pnpm/env-paths@2.2.1/node_modules/env-paths/index.js"(exports2, module2) {
     "use strict";
-    var path52 = require("path");
+    var path54 = require("path");
     var os12 = require("os");
     var homedir = os12.homedir();
     var tmpdir = os12.tmpdir();
     var { env } = process;
     var macos = (name) => {
-      const library = path52.join(homedir, "Library");
+      const library = path54.join(homedir, "Library");
       return {
-        data: path52.join(library, "Application Support", name),
-        config: path52.join(library, "Preferences", name),
-        cache: path52.join(library, "Caches", name),
-        log: path52.join(library, "Logs", name),
-        temp: path52.join(tmpdir, name)
+        data: path54.join(library, "Application Support", name),
+        config: path54.join(library, "Preferences", name),
+        cache: path54.join(library, "Caches", name),
+        log: path54.join(library, "Logs", name),
+        temp: path54.join(tmpdir, name)
       };
     };
     var windows = (name) => {
-      const appData = env.APPDATA || path52.join(homedir, "AppData", "Roaming");
-      const localAppData = env.LOCALAPPDATA || path52.join(homedir, "AppData", "Local");
+      const appData = env.APPDATA || path54.join(homedir, "AppData", "Roaming");
+      const localAppData = env.LOCALAPPDATA || path54.join(homedir, "AppData", "Local");
       return {
         // Data/config/cache/log are invented by me as Windows isn't opinionated about this
-        data: path52.join(localAppData, name, "Data"),
-        config: path52.join(appData, name, "Config"),
-        cache: path52.join(localAppData, name, "Cache"),
-        log: path52.join(localAppData, name, "Log"),
-        temp: path52.join(tmpdir, name)
+        data: path54.join(localAppData, name, "Data"),
+        config: path54.join(appData, name, "Config"),
+        cache: path54.join(localAppData, name, "Cache"),
+        log: path54.join(localAppData, name, "Log"),
+        temp: path54.join(tmpdir, name)
       };
     };
     var linux = (name) => {
-      const username = path52.basename(homedir);
+      const username = path54.basename(homedir);
       return {
-        data: path52.join(env.XDG_DATA_HOME || path52.join(homedir, ".local", "share"), name),
-        config: path52.join(env.XDG_CONFIG_HOME || path52.join(homedir, ".config"), name),
-        cache: path52.join(env.XDG_CACHE_HOME || path52.join(homedir, ".cache"), name),
+        data: path54.join(env.XDG_DATA_HOME || path54.join(homedir, ".local", "share"), name),
+        config: path54.join(env.XDG_CONFIG_HOME || path54.join(homedir, ".config"), name),
+        cache: path54.join(env.XDG_CACHE_HOME || path54.join(homedir, ".cache"), name),
         // https://wiki.debian.org/XDGBaseDirectorySpecification#state
-        log: path52.join(env.XDG_STATE_HOME || path52.join(homedir, ".local", "state"), name),
-        temp: path52.join(tmpdir, username, name)
+        log: path54.join(env.XDG_STATE_HOME || path54.join(homedir, ".local", "state"), name),
+        temp: path54.join(tmpdir, username, name)
       };
     };
     var envPaths = (name, options) => {
@@ -23815,11 +23815,11 @@ var require_util = __commonJS({
       return result;
     }
     exports2.emplace = emplace;
-    function getPropertyByPath(source, path52) {
-      if (typeof path52 === "string" && Object.prototype.hasOwnProperty.call(source, path52)) {
-        return source[path52];
+    function getPropertyByPath(source, path54) {
+      if (typeof path54 === "string" && Object.prototype.hasOwnProperty.call(source, path54)) {
+        return source[path54];
       }
-      const parsedPath = typeof path52 === "string" ? path52.split(".") : path52;
+      const parsedPath = typeof path54 === "string" ? path54.split(".") : path54;
       return parsedPath.reduce((previous, key) => {
         if (previous === void 0) {
           return previous;
@@ -23842,9 +23842,9 @@ var require_util = __commonJS({
       return Object.fromEntries(Object.entries(options).filter(([, value2]) => value2 !== void 0));
     }
     exports2.removeUndefinedValuesFromObject = removeUndefinedValuesFromObject;
-    async function isDirectory(path52) {
+    async function isDirectory(path54) {
       try {
-        const stat = await fs_1.promises.stat(path52);
+        const stat = await fs_1.promises.stat(path54);
         return stat.isDirectory();
       } catch (e14) {
         if (e14.code === "ENOENT") {
@@ -23854,9 +23854,9 @@ var require_util = __commonJS({
       }
     }
     exports2.isDirectory = isDirectory;
-    function isDirectorySync(path52) {
+    function isDirectorySync(path54) {
       try {
-        const stat = fs_1.default.statSync(path52);
+        const stat = fs_1.default.statSync(path54);
         return stat.isDirectory();
       } catch (e14) {
         if (e14.code === "ENOENT") {
@@ -23954,7 +23954,7 @@ var require_ExplorerBase = __commonJS({
           const idx = importStack.indexOf(fullPath);
           if (idx !== -1) {
             throw new Error(`Circular import detected:
-${[...importStack, fullPath].map((path52, i10) => `${i10 + 1}. ${path52}`).join("\n")} (same as ${idx + 1}.)`);
+${[...importStack, fullPath].map((path54, i10) => `${i10 + 1}. ${path54}`).join("\n")} (same as ${idx + 1}.)`);
           }
         }
       }
@@ -24142,9 +24142,9 @@ var require_Explorer = __commonJS({
           throw error63;
         }
       }
-      async #fileExists(path52) {
+      async #fileExists(path54) {
         try {
-          await promises_1.default.stat(path52);
+          await promises_1.default.stat(path54);
           return true;
         } catch (e14) {
           return false;
@@ -24304,9 +24304,9 @@ var require_ExplorerSync = __commonJS({
           throw error63;
         }
       }
-      #fileExists(path52) {
+      #fileExists(path54) {
         try {
-          fs_1.default.statSync(path52);
+          fs_1.default.statSync(path54);
           return true;
         } catch (e14) {
           return false;
@@ -24430,7 +24430,7 @@ var require_dist = __commonJS({
       };
     }
     function getResolvedSearchPlaces(moduleName, toolDefinedSearchPlaces, userConfiguredOptions) {
-      const userConfiguredSearchPlaces = userConfiguredOptions.searchPlaces?.map((path52) => path52.replace("{name}", moduleName));
+      const userConfiguredSearchPlaces = userConfiguredOptions.searchPlaces?.map((path54) => path54.replace("{name}", moduleName));
       if (userConfiguredOptions.mergeSearchPlaces) {
         return [...userConfiguredSearchPlaces ?? [], ...toolDefinedSearchPlaces];
       }
@@ -26807,7 +26807,7 @@ function isTimeZone(name) {
     return false;
   }
 }
-var import_node_path4, CATEGORY_NAMES, OVERRIDABLE_CATEGORIES, CategoryMapSchema, DURATION_RE, DurationSchema, WhenConditionObjectSchema, WhenSchema, EntryValueSchema, ENTRY_KEY_RE, EntriesSchema, LaunchSchema, CREDENTIAL_TARGETS, PROVIDER_CREDENTIAL_TARGETS, CREDENTIAL_TARGET_VARS, ArgvSchema, CommandSourceOptions, EnvCredentialSourceSchema, FileCredentialSourceSchema, CommandCredentialSourceSchema, OpCredentialSourceSchema, KeychainCredentialSourceSchema, LiteralCredentialSourceSchema, CredentialSourceSchema, RemoteCredentialSourceSchema, CREDENTIAL_CACHE_STORES, CredentialCacheSchema, CredentialSchema, ProviderCredentialSchema, RESERVED_PROVIDER_ENV_KEYS, ProviderEnvSchema, PROVIDER_KINDS, CODEX_TIERS, CODEX_EFFORTS, CODEX_LOGINS, CODEX_DEFAULT_LOGIN, CODEX_DEFAULT_MODEL, CODEX_DEFAULT_TIER_MODELS, CODEX_DEFAULT_EFFORT, CodexProviderConfigSchema, ProviderRouteSchema, HttpProviderSchema, CodexProviderSchema, ProviderSchema, ConfigProfileSchema, POOL_SELECTOR_PREFIX, POOL_NAME_PATTERN, IDENTITY_NAME_PATTERN, PoolNameSchema, SELECTOR_RE, IdentitySelectorSchema, PoolMemberSchema, POOL_PREFERENCES, PoolPreferenceSchema, PoolSchema, DirectoryRuleSchema, DirectoryRulesSchema, PortableConfigSchema, HEADROOM_MODES, HEADROOM_CCR_MODES, HEADROOM_ROLLOUT_CHANNELS, INTERCEPT_CHANNELS, READ_MATURATION_CHANNELS, HeadroomGlobalConfigObjectSchema, HeadroomGlobalConfigSchema, HEADROOM_DEFAULT_SOURCE, HEADROOM_DEFAULT_IDLE_SHUTDOWN_MINUTES, FRONTDOOR_DEFAULT_IDLE_SHUTDOWN_MINUTES, FrontDoorGlobalConfigSchema, UPDATE_MODES, UpdateGlobalConfigSchema, GlobalConfigSchema, WEEKDAYS, AnchorSchema, IdentitySchema, CategoryClassificationSchema, CategoryClassificationOverlaySchema, SHIPPED_CATEGORY_DEFAULTS;
+var import_node_path4, CATEGORY_NAMES, OVERRIDABLE_CATEGORIES, CategoryMapSchema, DURATION_RE, DurationSchema, WhenConditionObjectSchema, WhenSchema, EntryValueSchema, ENTRY_KEY_RE, EntriesSchema, LaunchSchema, CREDENTIAL_TARGETS, PROVIDER_CREDENTIAL_TARGETS, CREDENTIAL_TARGET_VARS, ArgvSchema, CommandSourceOptions, EnvCredentialSourceSchema, FileCredentialSourceSchema, CommandCredentialSourceSchema, OpCredentialSourceSchema, KeychainCredentialSourceSchema, LiteralCredentialSourceSchema, CredentialSourceSchema, RemoteCredentialSourceSchema, CREDENTIAL_CACHE_STORES, CredentialCacheSchema, CredentialSchema, ProviderCredentialSchema, RESERVED_PROVIDER_ENV_KEYS, ProviderEnvSchema, PROVIDER_KINDS, CODEX_TIERS, CODEX_EFFORTS, CODEX_LOGINS, CODEX_DEFAULT_LOGIN, CODEX_DEFAULT_MODEL, CODEX_DEFAULT_TIER_MODELS, CODEX_DEFAULT_EFFORT, CodexProviderConfigSchema, ProviderRouteSchema, HttpProviderSchema, CodexProviderSchema, ProviderSchema, ConfigProfileSchema, POOL_SELECTOR_PREFIX, POOL_NAME_PATTERN, IDENTITY_NAME_PATTERN, PoolNameSchema, SELECTOR_RE, IdentitySelectorSchema, PoolMemberSchema, POOL_PREFERENCES, PoolPreferenceSchema, PoolSchema, WEEKDAYS, AnchorSchema, JOB_WINDOWS, JobTriggerSchema, JobTargetSchema, JobSchema, DirectoryRuleSchema, DirectoryRulesSchema, PortableConfigSchema, HEADROOM_MODES, HEADROOM_CCR_MODES, HEADROOM_ROLLOUT_CHANNELS, INTERCEPT_CHANNELS, READ_MATURATION_CHANNELS, HeadroomGlobalConfigObjectSchema, HeadroomGlobalConfigSchema, HEADROOM_DEFAULT_SOURCE, HEADROOM_DEFAULT_IDLE_SHUTDOWN_MINUTES, FRONTDOOR_DEFAULT_IDLE_SHUTDOWN_MINUTES, FrontDoorGlobalConfigSchema, UPDATE_MODES, UpdateGlobalConfigSchema, GlobalConfigSchema, IdentitySchema, CategoryClassificationSchema, CategoryClassificationOverlaySchema, SHIPPED_CATEGORY_DEFAULTS;
 var init_schema = __esm({
   "src/config/schema.ts"() {
     "use strict";
@@ -26982,6 +26982,25 @@ var init_schema = __esm({
       identities: external_exports.array(PoolMemberSchema).min(1).refine((members2) => new Set(members2.map(poolMemberIdentity)).size === members2.length, { message: "pool members must be unique" }),
       preference: PoolPreferenceSchema.optional()
     });
+    WEEKDAYS = ["mon", "tue", "wed", "thu", "fri", "sat", "sun"];
+    AnchorSchema = external_exports.strictObject({
+      days: external_exports.array(external_exports.enum(WEEKDAYS)).min(1).refine((days) => new Set(days).size === days.length, "an anchor names each weekday at most once"),
+      time: external_exports.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/, "a 24-hour time such as 06:00"),
+      timeZone: external_exports.string().refine(isTimeZone, "an IANA time zone such as Europe/London").optional()
+    });
+    JOB_WINDOWS = ["fiveHour", "sevenDay"];
+    JobTriggerSchema = external_exports.union([external_exports.strictObject({ at: external_exports.array(AnchorSchema).min(1) }), external_exports.strictObject({ beforeReset: external_exports.enum(JOB_WINDOWS), lead: external_exports.string().regex(DURATION_RE) })]);
+    JobTargetSchema = external_exports.union([external_exports.strictObject({ identity: IdentitySelectorSchema }), external_exports.strictObject({ pool: PoolNameSchema })]);
+    JobSchema = external_exports.strictObject({
+      target: JobTargetSchema,
+      trigger: JobTriggerSchema,
+      prompt: external_exports.string().min(1),
+      /** The absolute directory the run works in. */
+      cwd: external_exports.string().min(1),
+      timeout: external_exports.string().regex(DURATION_RE),
+      model: external_exports.string().min(1).optional(),
+      allowedTools: external_exports.array(external_exports.string().min(1)).min(1).optional()
+    });
     DirectoryRuleSchema = ConfigProfileSchema.omit({ description: true }).extend({
       path: external_exports.string().min(1),
       configProfile: external_exports.string().min(1).optional(),
@@ -27050,13 +27069,8 @@ var init_schema = __esm({
       headroom: HeadroomGlobalConfigSchema.optional(),
       frontdoor: FrontDoorGlobalConfigSchema.optional(),
       update: UpdateGlobalConfigSchema.optional(),
-      pools: external_exports.record(PoolNameSchema, PoolSchema).optional()
-    });
-    WEEKDAYS = ["mon", "tue", "wed", "thu", "fri", "sat", "sun"];
-    AnchorSchema = external_exports.strictObject({
-      days: external_exports.array(external_exports.enum(WEEKDAYS)).min(1).refine((days) => new Set(days).size === days.length, "an anchor names each weekday at most once"),
-      time: external_exports.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/, "a 24-hour time such as 06:00"),
-      timeZone: external_exports.string().refine(isTimeZone, "an IANA time zone such as Europe/London").optional()
+      pools: external_exports.record(PoolNameSchema, PoolSchema).optional(),
+      jobs: external_exports.record(PoolNameSchema, JobSchema).optional()
     });
     IdentitySchema = external_exports.strictObject({
       $schema: external_exports.string().optional(),
@@ -28927,8 +28941,8 @@ var require_utils = __commonJS({
       }
       return output2;
     };
-    exports2.basename = (path52, { windows } = {}) => {
-      const segs = path52.split(windows ? /[\\/]/ : "/");
+    exports2.basename = (path54, { windows } = {}) => {
+      const segs = path54.split(windows ? /[\\/]/ : "/");
       const last = segs[segs.length - 1];
       if (last === "") {
         return segs[segs.length - 2];
@@ -32595,6 +32609,8 @@ function buildLayoutPaths(root) {
     usageSnapshotsDir: import_node_path19.default.join(root, "usage", "snapshots"),
     usagePicksFile: import_node_path19.default.join(root, "usage", "picks.json"),
     usageAnchorsFile: import_node_path19.default.join(root, "usage", "anchors.json"),
+    usageJobsFile: import_node_path19.default.join(root, "usage", "jobs.json"),
+    jobLogsDir: import_node_path19.default.join(root, "logs", "jobs"),
     mcpPermissionsFile: import_node_path19.default.join(root, "mcp", "permissions.json")
   };
 }
@@ -33301,7 +33317,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "claude-use",
-      version: "9.14.0",
+      version: "9.15.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -33572,11 +33588,11 @@ function identifyRequest(headers) {
 function directOrigin(port) {
   return `http://127.0.0.1:${String(port)}`;
 }
-function parseProviderPath(path52) {
-  if (!path52.startsWith(PROVIDER_PATH_PREFIX)) {
+function parseProviderPath(path54) {
+  if (!path54.startsWith(PROVIDER_PATH_PREFIX)) {
     return void 0;
   }
-  const tail = path52.slice(PROVIDER_PATH_PREFIX.length);
+  const tail = path54.slice(PROVIDER_PATH_PREFIX.length);
   const slash = tail.indexOf("/");
   if (slash <= 0) {
     return void 0;
@@ -33902,9 +33918,9 @@ function decoderFor(encoding) {
       return void 0;
   }
 }
-function destinationOf(path52) {
-  const scoped = parseProviderPath(path52);
-  return scoped === void 0 ? { provider: ANTHROPIC_PROVIDER, endpoint: path52 } : { provider: scoped.provider, endpoint: scoped.rest };
+function destinationOf(path54) {
+  const scoped = parseProviderPath(path54);
+  return scoped === void 0 ? { provider: ANTHROPIC_PROVIDER, endpoint: path54 } : { provider: scoped.provider, endpoint: scoped.rest };
 }
 function buildRecord(event, context) {
   const { scan } = context;
@@ -36340,14 +36356,14 @@ var require_util2 = __commonJS({
         }
         const port = url2.port != null ? url2.port : url2.protocol === "https:" ? 443 : 80;
         let origin = url2.origin != null ? url2.origin : `${url2.protocol || ""}//${url2.hostname || ""}:${port}`;
-        let path52 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`;
+        let path54 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`;
         if (origin[origin.length - 1] === "/") {
           origin = origin.slice(0, origin.length - 1);
         }
-        if (path52 && path52[0] !== "/") {
-          path52 = `/${path52}`;
+        if (path54 && path54[0] !== "/") {
+          path54 = `/${path54}`;
         }
-        return new URL(`${origin}${path52}`);
+        return new URL(`${origin}${path54}`);
       }
       if (!isHttpOrHttpsPrefixed(url2.origin || url2.protocol)) {
         throw new InvalidArgumentError2("Invalid URL protocol: the URL must start with `http:` or `https:`.");
@@ -37168,9 +37184,9 @@ var require_diagnostics = __commonJS({
         "undici:client:sendHeaders",
         (evt) => {
           const {
-            request: { method, path: path52, origin }
+            request: { method, path: path54, origin }
           } = evt;
-          debugLog("sending request to %s %s%s", method, origin, path52);
+          debugLog("sending request to %s %s%s", method, origin, path54);
         }
       );
     }
@@ -37188,14 +37204,14 @@ var require_diagnostics = __commonJS({
         "undici:request:headers",
         (evt) => {
           const {
-            request: { method, path: path52, origin },
+            request: { method, path: path54, origin },
             response: { statusCode }
           } = evt;
           debugLog(
             "received response to %s %s%s - HTTP %d",
             method,
             origin,
-            path52,
+            path54,
             statusCode
           );
         }
@@ -37204,23 +37220,23 @@ var require_diagnostics = __commonJS({
         "undici:request:trailers",
         (evt) => {
           const {
-            request: { method, path: path52, origin }
+            request: { method, path: path54, origin }
           } = evt;
-          debugLog("trailers received from %s %s%s", method, origin, path52);
+          debugLog("trailers received from %s %s%s", method, origin, path54);
         }
       );
       diagnosticsChannel.subscribe(
         "undici:request:error",
         (evt) => {
           const {
-            request: { method, path: path52, origin },
+            request: { method, path: path54, origin },
             error: error63
           } = evt;
           debugLog(
             "request to %s %s%s errored - %s",
             method,
             origin,
-            path52,
+            path54,
             error63.message
           );
         }
@@ -37335,7 +37351,7 @@ var require_request = __commonJS({
     var kHandler = /* @__PURE__ */ Symbol("handler");
     var Request2 = class {
       constructor(origin, {
-        path: path52,
+        path: path54,
         method,
         body,
         headers,
@@ -37352,11 +37368,11 @@ var require_request = __commonJS({
         maxRedirections,
         typeOfService
       }, handler) {
-        if (typeof path52 !== "string") {
+        if (typeof path54 !== "string") {
           throw new InvalidArgumentError2("path must be a string");
-        } else if (path52[0] !== "/" && !(path52.startsWith("http://") || path52.startsWith("https://")) && method !== "CONNECT") {
+        } else if (path54[0] !== "/" && !(path54.startsWith("http://") || path54.startsWith("https://")) && method !== "CONNECT") {
           throw new InvalidArgumentError2("path must be an absolute URL or start with a slash");
-        } else if (invalidPathRegex.test(path52)) {
+        } else if (invalidPathRegex.test(path54)) {
           throw new InvalidArgumentError2("invalid request path");
         }
         if (typeof method !== "string") {
@@ -37431,7 +37447,7 @@ var require_request = __commonJS({
         this.completed = false;
         this.aborted = false;
         this.upgrade = upgrade || null;
-        this.path = query ? serializePathWithQuery(path52, query) : path52;
+        this.path = query ? serializePathWithQuery(path54, query) : path54;
         this.origin = origin;
         this.protocol = getProtocolFromUrlString(origin);
         this.idempotent = idempotent == null ? method === "HEAD" || method === "GET" : idempotent;
@@ -42613,7 +42629,7 @@ var require_client_h1 = __commonJS({
       return method !== "GET" && method !== "HEAD" && method !== "OPTIONS" && method !== "TRACE" && method !== "CONNECT";
     }
     function writeH1(client, request7) {
-      const { method, path: path52, host, upgrade, blocking, reset } = request7;
+      const { method, path: path54, host, upgrade, blocking, reset } = request7;
       let { body, headers, contentLength } = request7;
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH" || method === "QUERY" || method === "PROPFIND" || method === "PROPPATCH";
       if (util2.isFormDataLike(body)) {
@@ -42691,7 +42707,7 @@ var require_client_h1 = __commonJS({
       if (socket.setTypeOfService) {
         socket.setTypeOfService(request7.typeOfService);
       }
-      let header = `${method} ${path52} HTTP/1.1\r
+      let header = `${method} ${path54} HTTP/1.1\r
 `;
       if (typeof host === "string") {
         header += `host: ${host}\r
@@ -43370,7 +43386,7 @@ var require_client_h2 = __commonJS({
       const headersTimeout = request7.headersTimeout ?? client[kHeadersTimeout];
       const bodyTimeout = request7.bodyTimeout ?? client[kBodyTimeout];
       const session = client[kHTTP2Session];
-      const { method, path: path52, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request7;
+      const { method, path: path54, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request7;
       let { body } = request7;
       if (upgrade != null && upgrade !== "websocket") {
         util2.errorRequest(client, request7, new InvalidArgumentError2(`Custom upgrade "${upgrade}" not supported over HTTP/2`));
@@ -43439,7 +43455,7 @@ var require_client_h2 = __commonJS({
           }
           headers[HTTP2_HEADER_METHOD] = "CONNECT";
           headers[HTTP2_HEADER_PROTOCOL] = "websocket";
-          headers[HTTP2_HEADER_PATH] = path52;
+          headers[HTTP2_HEADER_PATH] = path54;
           if (protocol === "ws:" || protocol === "wss:") {
             headers[HTTP2_HEADER_SCHEME] = protocol === "ws:" ? "http" : "https";
           } else {
@@ -43481,7 +43497,7 @@ var require_client_h2 = __commonJS({
         stream.setTimeout(headersTimeout);
         return true;
       }
-      headers[HTTP2_HEADER_PATH] = path52;
+      headers[HTTP2_HEADER_PATH] = path54;
       headers[HTTP2_HEADER_SCHEME] = protocol === "http:" ? "http" : "https";
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH";
       if (body && typeof body.read === "function") {
@@ -45833,10 +45849,10 @@ var require_proxy_agent = __commonJS({
         };
         const {
           origin,
-          path: path52 = "/",
+          path: path54 = "/",
           headers = {}
         } = opts;
-        opts.path = origin + path52;
+        opts.path = origin + path54;
         if (!("host" in headers) && !("Host" in headers)) {
           const { host } = new URL(origin);
           headers.host = host;
@@ -47945,20 +47961,20 @@ var require_mock_utils = __commonJS({
       }
       return normalizedQp;
     }
-    function safeUrl(path52) {
-      if (typeof path52 !== "string") {
-        return path52;
+    function safeUrl(path54) {
+      if (typeof path54 !== "string") {
+        return path54;
       }
-      const pathSegments = path52.split("?", 3);
+      const pathSegments = path54.split("?", 3);
       if (pathSegments.length !== 2) {
-        return path52;
+        return path54;
       }
       const qp2 = new URLSearchParams(pathSegments.pop());
       qp2.sort();
       return [...pathSegments, qp2.toString()].join("?");
     }
-    function matchKey(mockDispatch2, { path: path52, method, body, headers }) {
-      const pathMatch = matchValue(mockDispatch2.path, path52);
+    function matchKey(mockDispatch2, { path: path54, method, body, headers }) {
+      const pathMatch = matchValue(mockDispatch2.path, path54);
       const methodMatch = matchValue(mockDispatch2.method, method);
       const bodyMatch = typeof mockDispatch2.body !== "undefined" ? matchValue(mockDispatch2.body, body) : true;
       const headersMatch = matchHeaders(mockDispatch2, headers);
@@ -47983,8 +47999,8 @@ var require_mock_utils = __commonJS({
       const basePath = key.query ? serializePathWithQuery(key.path, key.query) : key.path;
       const resolvedPath = typeof basePath === "string" ? safeUrl(basePath) : basePath;
       const resolvedPathWithoutTrailingSlash = removeTrailingSlash(resolvedPath);
-      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path52, ignoreTrailingSlash }) => {
-        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path52)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path52), resolvedPath);
+      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path54, ignoreTrailingSlash }) => {
+        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path54)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path54), resolvedPath);
       });
       if (matchedMockDispatches.length === 0) {
         throw new MockNotMatchedError(`Mock dispatch not matched for path '${resolvedPath}'`);
@@ -48023,19 +48039,19 @@ var require_mock_utils = __commonJS({
         mockDispatches.splice(index, 1);
       }
     }
-    function removeTrailingSlash(path52) {
-      while (path52.endsWith("/")) {
-        path52 = path52.slice(0, -1);
+    function removeTrailingSlash(path54) {
+      while (path54.endsWith("/")) {
+        path54 = path54.slice(0, -1);
       }
-      if (path52.length === 0) {
-        path52 = "/";
+      if (path54.length === 0) {
+        path54 = "/";
       }
-      return path52;
+      return path54;
     }
     function buildKey(opts) {
-      const { path: path52, method, body, headers, query } = opts;
+      const { path: path54, method, body, headers, query } = opts;
       return {
-        path: path52,
+        path: path54,
         method,
         body,
         headers,
@@ -48725,10 +48741,10 @@ var require_pending_interceptors_formatter = __commonJS({
       }
       format(pendingInterceptors) {
         const withPrettyHeaders = pendingInterceptors.map(
-          ({ method, path: path52, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
+          ({ method, path: path54, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
             Method: method,
             Origin: origin,
-            Path: path52,
+            Path: path54,
             "Status code": statusCode,
             Persistent: persist ? PERSISTENT : NOT_PERSISTENT,
             Invocations: timesInvoked,
@@ -48810,9 +48826,9 @@ var require_mock_agent = __commonJS({
         const acceptNonStandardSearchParameters = this[kMockAgentAcceptsNonStandardSearchParameters];
         const dispatchOpts = { ...opts };
         if (acceptNonStandardSearchParameters && dispatchOpts.path) {
-          const [path52, searchParams] = dispatchOpts.path.split("?");
+          const [path54, searchParams] = dispatchOpts.path.split("?");
           const normalizedSearchParams = normalizeSearchParams(searchParams, acceptNonStandardSearchParameters);
-          dispatchOpts.path = `${path52}?${normalizedSearchParams}`;
+          dispatchOpts.path = `${path54}?${normalizedSearchParams}`;
         }
         return this[kAgent].dispatch(dispatchOpts, handler);
       }
@@ -49213,12 +49229,12 @@ var require_snapshot_recorder = __commonJS({
        * @return {Promise<void>} - Resolves when snapshots are loaded
        */
       async loadSnapshots(filePath) {
-        const path52 = filePath || this.#snapshotPath;
-        if (!path52) {
+        const path54 = filePath || this.#snapshotPath;
+        if (!path54) {
           throw new InvalidArgumentError2("Snapshot path is required");
         }
         try {
-          const data = await readFile(resolve2(path52), "utf8");
+          const data = await readFile(resolve2(path54), "utf8");
           const parsed = JSON.parse(data);
           if (Array.isArray(parsed)) {
             this.#snapshots.clear();
@@ -49232,7 +49248,7 @@ var require_snapshot_recorder = __commonJS({
           if (error63.code === "ENOENT") {
             this.#snapshots.clear();
           } else {
-            throw new UndiciError(`Failed to load snapshots from ${path52}`, { cause: error63 });
+            throw new UndiciError(`Failed to load snapshots from ${path54}`, { cause: error63 });
           }
         }
       }
@@ -49243,11 +49259,11 @@ var require_snapshot_recorder = __commonJS({
        * @returns {Promise<void>} - Resolves when snapshots are saved
        */
       async saveSnapshots(filePath) {
-        const path52 = filePath || this.#snapshotPath;
-        if (!path52) {
+        const path54 = filePath || this.#snapshotPath;
+        if (!path54) {
           throw new InvalidArgumentError2("Snapshot path is required");
         }
-        const resolvedPath = resolve2(path52);
+        const resolvedPath = resolve2(path54);
         await mkdir(dirname3(resolvedPath), { recursive: true });
         const data = Array.from(this.#snapshots.entries()).map(([hash2, snapshot]) => ({
           hash: hash2,
@@ -49879,15 +49895,15 @@ var require_redirect_handler = __commonJS({
           return;
         }
         const { origin, pathname, search } = util2.parseURL(new URL(this.location, this.opts.origin && new URL(this.opts.path, this.opts.origin)));
-        const path52 = search ? `${pathname}${search}` : pathname;
-        const redirectUrlString = `${origin}${path52}`;
+        const path54 = search ? `${pathname}${search}` : pathname;
+        const redirectUrlString = `${origin}${path54}`;
         for (const historyUrl of this.history) {
           if (historyUrl.toString() === redirectUrlString) {
             throw new InvalidArgumentError2(`Redirect loop detected. Cannot redirect to ${origin}. This typically happens when using a Client or Pool with cross-origin redirects. Use an Agent for cross-origin redirects.`);
           }
         }
         this.opts.headers = cleanRequestHeaders(this.opts.headers, statusCode === 303, this.opts.origin !== origin);
-        this.opts.path = path52;
+        this.opts.path = path54;
         this.opts.origin = origin;
         this.opts.query = null;
       }
@@ -51647,10 +51663,10 @@ var require_cache_handler = __commonJS({
       }
       return locationUrl.pathname + locationUrl.search;
     }
-    function deleteCachedUri(store, cacheKey, path52) {
+    function deleteCachedUri(store, cacheKey, path54) {
       deleteCachedValue(store, {
         ...cacheKey,
-        path: path52
+        path: path54
       });
       for (let i10 = 0; i10 < util2.safeHTTPMethods.length; i10++) {
         const method = util2.safeHTTPMethods[i10];
@@ -51658,7 +51674,7 @@ var require_cache_handler = __commonJS({
           deleteCachedValue(store, {
             ...cacheKey,
             method,
-            path: path52
+            path: path54
           });
         }
       }
@@ -51669,9 +51685,9 @@ var require_cache_handler = __commonJS({
       }
       const values = Array.isArray(headerValue2) ? headerValue2 : [headerValue2];
       for (let i10 = 0; i10 < values.length; i10++) {
-        const path52 = getSameOriginPath(cacheKey, values[i10]);
-        if (path52 !== void 0) {
-          deleteCachedUri(store, cacheKey, path52);
+        const path54 = getSameOriginPath(cacheKey, values[i10]);
+        if (path54 !== void 0) {
+          deleteCachedUri(store, cacheKey, path54);
         }
       }
     }
@@ -56671,11 +56687,11 @@ var require_fetch = __commonJS({
       function dispatch({ body }) {
         const url2 = requestCurrentURL(request7);
         const agent = fetchParams.controller.dispatcher;
-        const path52 = url2.pathname + url2.search;
+        const path54 = url2.pathname + url2.search;
         const hasTrailingQuestionMark = url2.search.length === 0 && url2.href[url2.href.length - url2.hash.length - 1] === "?";
         return new Promise((resolve2, reject) => agent.dispatch(
           {
-            path: hasTrailingQuestionMark ? `${path52}?` : path52,
+            path: hasTrailingQuestionMark ? `${path54}?` : path54,
             origin: url2.origin,
             method: request7.method,
             body: agent.isMockActive ? request7.body && (request7.body.source || request7.body.stream) : body,
@@ -57622,9 +57638,9 @@ var require_util5 = __commonJS({
         }
       }
     }
-    function validateCookiePath(path52) {
-      for (let i10 = 0; i10 < path52.length; ++i10) {
-        const code = path52.charCodeAt(i10);
+    function validateCookiePath(path54) {
+      for (let i10 = 0; i10 < path54.length; ++i10) {
+        const code = path54.charCodeAt(i10);
         if (code < 32 || // exclude CTLs (0-31)
         code > 126 || // exclude DEL and non-ascii
         code === 59) {
@@ -60972,11 +60988,11 @@ var require_undici = __commonJS({
           if (typeof opts.path !== "string") {
             throw new InvalidArgumentError2("invalid opts.path");
           }
-          let path52 = opts.path;
+          let path54 = opts.path;
           if (!opts.path.startsWith("/")) {
-            path52 = `/${path52}`;
+            path54 = `/${path54}`;
           }
-          url2 = new URL(util2.parseOrigin(url2).origin + path52);
+          url2 = new URL(util2.parseOrigin(url2).origin + path54);
         } else {
           if (!opts) {
             opts = typeof url2 === "object" ? url2 : {};
@@ -99973,8 +99989,8 @@ var require_utils3 = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path52) {
-      let input2 = path52;
+    function removeDotSegments(path54) {
+      let input2 = path54;
       const output2 = [];
       let nextSlash = -1;
       let len = 0;
@@ -100383,8 +100399,8 @@ var require_schemes = __commonJS({
       }
       if (wsComponent.resourceName) {
         const queryIndex = wsComponent.resourceName.indexOf("?");
-        const path52 = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
-        wsComponent.path = path52 && path52 !== "/" ? path52 : void 0;
+        const path54 = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
+        wsComponent.path = path54 && path54 !== "/" ? path54 : void 0;
         wsComponent.query = queryIndex === -1 ? void 0 : wsComponent.resourceName.slice(queryIndex + 1);
         wsComponent.resourceName = void 0;
       }
@@ -103911,7 +103927,7 @@ var require_dist2 = __commonJS({
 });
 
 // src/cli.ts
-var import_node_path51 = __toESM(require("node:path"), 1);
+var import_node_path53 = __toESM(require("node:path"), 1);
 
 // node_modules/.pnpm/commander@15.0.0/node_modules/commander/lib/error.js
 var CommanderError = class extends Error {
@@ -107024,9 +107040,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
    * @param {string} [path]
    * @return {(string|null|Command)}
    */
-  executableDir(path52) {
-    if (path52 === void 0) return this._executableDir;
-    this._executableDir = path52;
+  executableDir(path54) {
+    if (path54 === void 0) return this._executableDir;
+    this._executableDir = path54;
     return this;
   }
   /**
@@ -108675,19 +108691,19 @@ function writePools(paths, pools) {
   applyPatch(paths.globalConfigFile, GlobalConfigSchema, { pools }, { defaults: {} });
 }
 function poolCycleOf(pools, name) {
-  const walk = (current, path52) => {
+  const walk = (current, path54) => {
     for (const entry of pools[current]?.identities ?? []) {
       const nested = poolNameOf(poolMemberIdentity(entry));
       if (nested === void 0) {
         continue;
       }
       if (nested === name) {
-        return [...path52, nested];
+        return [...path54, nested];
       }
-      if (path52.includes(nested)) {
+      if (path54.includes(nested)) {
         continue;
       }
-      const found = walk(nested, [...path52, nested]);
+      const found = walk(nested, [...path54, nested]);
       if (found !== void 0) {
         return found;
       }
@@ -109753,6 +109769,12 @@ function collectRepeated(value2, previous = []) {
 function collectAnchor(value2, previous = []) {
   return [...previous, asInvalidArgument(() => parseAnchor(value2))];
 }
+function parseDurationLiteral(value2) {
+  return asInvalidArgument(() => {
+    parseDuration(value2);
+    return value2;
+  });
+}
 function parseDurationOption(value2) {
   return asInvalidArgument(() => parseDuration(value2));
 }
@@ -111623,7 +111645,7 @@ function registerCodexCommand(program2, deps) {
 
 // src/frontdoor/commands.ts
 var import_node_crypto20 = require("node:crypto");
-var import_node_path46 = __toESM(require("node:path"), 1);
+var import_node_path47 = __toESM(require("node:path"), 1);
 var import_node_fs16 = __toESM(require("node:fs"), 1);
 init_commandDeps();
 init_schema();
@@ -111824,6 +111846,63 @@ function registerUpdateCommand(program2, deps, ports = realUpdatePorts) {
   );
 }
 
+// src/jobStore.ts
+init_cliError();
+init_store();
+init_schema();
+var JobNotFoundError = class extends CliError {
+  constructor(jobName) {
+    super(`No job named "${jobName}". Run \`agent-shim job add ${jobName} ...\` first.`);
+    this.jobName = jobName;
+    this.name = "JobNotFoundError";
+  }
+  jobName;
+};
+var JobAlreadyExistsError = class extends CliError {
+  constructor(jobName) {
+    super(`A job named "${jobName}" already exists. Remove it with \`agent-shim job remove ${jobName}\` to define it again.`);
+    this.jobName = jobName;
+    this.name = "JobAlreadyExistsError";
+  }
+  jobName;
+};
+var InvalidJobNameError = class extends CliError {
+  constructor(attemptedName) {
+    super(`"${attemptedName}" is not a valid job name: it must start with a letter or number and may then contain letters, numbers, dots, hyphens and underscores.`);
+    this.attemptedName = attemptedName;
+    this.name = "InvalidJobNameError";
+  }
+  attemptedName;
+};
+function readJobs(paths) {
+  return readGlobalConfig(paths)?.jobs ?? {};
+}
+function requireJob(paths, name) {
+  const job = readJobs(paths)[name];
+  if (job === void 0) {
+    throw new JobNotFoundError(name);
+  }
+  return job;
+}
+function writeJobs(paths, jobs) {
+  applyPatch(paths.globalConfigFile, GlobalConfigSchema, { jobs }, { defaults: {} });
+}
+function addJob(paths, name, job) {
+  if (!PoolNameSchema.safeParse(name).success) {
+    throw new InvalidJobNameError(name);
+  }
+  const jobs = readJobs(paths);
+  if (jobs[name] !== void 0) {
+    throw new JobAlreadyExistsError(name);
+  }
+  writeJobs(paths, { ...jobs, [name]: job });
+  return job;
+}
+function removeJob(paths, name) {
+  requireJob(paths, name);
+  writeJobs(paths, Object.fromEntries(Object.entries(readJobs(paths)).filter(([existing]) => existing !== name)));
+}
+
 // src/launcher/poolRefresh.ts
 init_anthropicUsageRefresh();
 async function refreshStalePoolMembers(params) {
@@ -111839,6 +111918,65 @@ init_anthropicUsageRefresh();
 init_poolPick();
 init_realAnthropicUsageProbe();
 
+// src/usage/realJobRunner.ts
+var import_node_path38 = __toESM(require("node:path"), 1);
+init_conditions();
+init_identityClaude();
+var JOB_LAUNCH_FLAGS = ["--no-headroom", "--no-remote-control", "--track-usage"];
+var JOB_ISOLATION_OPTIONS = { settingSources: ["user"], mcpServers: {}, strictMcpConfig: true };
+function logEntry(name, identity, endedAt, outcome) {
+  return `${endedAt.toISOString()} job ${name} as ${identity}
+${outcome.trimEnd()}
+
+`;
+}
+function createRealJobRunner(params) {
+  return async (name, identity, job) => {
+    const logFile = import_node_path38.default.join(params.paths.jobLogsDir, `${name}.log`);
+    const append = (outcome) => {
+      params.fs.mkdirPrivate(params.paths.jobLogsDir);
+      params.fs.appendFilePrivate(logFile, logEntry(name, identity, params.now(), outcome));
+    };
+    try {
+      const result = await withIdentityClaude({ paths: params.paths, spawnDaemon: params.spawnDaemon, cwd: job.cwd, timeoutMs: parseDuration(job.timeout) }, identity, JOB_LAUNCH_FLAGS, async ({ bin, env, cwd, abort }) => {
+        const { query } = await Promise.resolve().then(() => (init_sdk(), sdk_exports));
+        const session = query({
+          prompt: job.prompt,
+          options: {
+            pathToClaudeCodeExecutable: bin,
+            env,
+            cwd,
+            abortController: abort,
+            settingSources: [...JOB_ISOLATION_OPTIONS.settingSources],
+            mcpServers: JOB_ISOLATION_OPTIONS.mcpServers,
+            strictMcpConfig: JOB_ISOLATION_OPTIONS.strictMcpConfig,
+            permissionMode: "dontAsk",
+            ...job.model === void 0 ? {} : { model: job.model },
+            ...job.allowedTools === void 0 ? {} : { allowedTools: [...job.allowedTools] }
+          }
+        });
+        try {
+          for await (const message of session) {
+            if (message.type === "result") {
+              if (message.subtype !== "success") {
+                throw new Error(`the run ended as ${message.subtype}`);
+              }
+              return message.result;
+            }
+          }
+          throw new Error("the run ended without a result");
+        } finally {
+          session.close();
+        }
+      });
+      append(result);
+    } catch (error63) {
+      append(`FAILED: ${error63 instanceof Error ? error63.message : String(error63)}`);
+      throw error63;
+    }
+  };
+}
+
 // src/usage/realWindowOpener.ts
 init_identityClaude();
 var OPENER_LAUNCH_FLAGS = ["--no-headroom", "--no-remote-control", "--track-usage"];
@@ -111885,18 +112023,18 @@ function createRealWindowOpener(params) {
   };
 }
 
-// src/usage/windowKeeper.ts
-var import_node_path38 = __toESM(require("node:path"), 1);
+// src/usage/jobKeeper.ts
+init_conditions();
+
+// src/usage/handledStamps.ts
+var import_node_path39 = __toESM(require("node:path"), 1);
 init_zod();
-init_preflight();
-init_pick();
-init_middleware();
 var STAMPS_SCHEMA_VERSION = 1;
 var StampsFileSchema = external_exports.strictObject({
   schemaVersion: external_exports.literal(STAMPS_SCHEMA_VERSION),
   handled: external_exports.record(external_exports.string().min(1), external_exports.iso.datetime())
 });
-function readStamps(fs22, file2) {
+function readHandled(fs22, file2) {
   const raw = fs22.readFileUtf8(file2);
   if (raw === void 0) {
     return {};
@@ -111908,14 +112046,30 @@ function readStamps(fs22, file2) {
     parsed = void 0;
   }
   const result = StampsFileSchema.safeParse(parsed);
-  return result.success ? Object.fromEntries(Object.entries(result.data.handled).map(([identity, at2]) => [identity, Date.parse(at2)])) : {};
+  return result.success ? Object.fromEntries(Object.entries(result.data.handled).map(([key, at2]) => [key, Date.parse(at2)])) : {};
 }
-function writeStamps(fs22, file2, handled) {
-  const next = { schemaVersion: STAMPS_SCHEMA_VERSION, handled: Object.fromEntries(Object.entries(handled).map(([identity, at2]) => [identity, new Date(at2).toISOString()])) };
-  fs22.mkdirPrivate(import_node_path38.default.dirname(file2));
+function writeHandled(fs22, file2, handled) {
+  const next = { schemaVersion: STAMPS_SCHEMA_VERSION, handled: Object.fromEntries(Object.entries(handled).map(([key, at2]) => [key, new Date(at2).toISOString()])) };
+  fs22.mkdirPrivate(import_node_path39.default.dirname(file2));
   fs22.writeFilePrivate(file2, `${JSON.stringify(next, null, 2)}
 `);
 }
+
+// src/usage/jobKeeper.ts
+init_middleware();
+init_preflight();
+
+// src/usage/windowKeeper.ts
+init_preflight();
+init_pick();
+init_middleware();
+function refusalReason(identity, snapshot, nowMs) {
+  if (snapshot === void 0) {
+    return void 0;
+  }
+  const candidate = rankPool({ members: [{ identity, snapshot, records: [] }], nowMs, resuming: false }).candidates[0];
+  return candidate?.class === "ineligible" ? `it is refused right now (${candidate.reasons[0] ?? "no reason recorded"})` : void 0;
+}
 function reasonNotToOpen(identity, snapshot, nowMs) {
   if (snapshot === void 0) {
     return void 0;
@@ -111928,13 +112082,12 @@ function reasonNotToOpen(identity, snapshot, nowMs) {
   if (five?.resetsAtMs !== void 0) {
     return `a five-hour window is already open, resetting in ${formatAge(five.resetsAtMs - nowMs)}`;
   }
-  const candidate = rankPool({ members: [{ identity, snapshot, records: [] }], nowMs, resuming: false }).candidates[0];
-  return candidate?.class === "ineligible" ? `it is refused right now (${candidate.reasons[0] ?? "no reason recorded"})` : void 0;
+  return refusalReason(identity, snapshot, nowMs);
 }
 async function runWindowKeeper(ports) {
   const nowMs = ports.nowMs();
   const anchored = ports.anchored();
-  const previous = readStamps(ports.fs, ports.stampsFile);
+  const previous = readHandled(ports.fs, ports.stampsFile);
   const handled = Object.fromEntries(anchored.flatMap(({ identity }) => previous[identity] === void 0 ? [] : [[identity, previous[identity]]]));
   const outcomes = [];
   for (const { identity, anchors } of anchored) {
@@ -111962,7 +112115,7 @@ async function runWindowKeeper(ports) {
       outcomes.push({ identity, status: "failed", detail: `anchor ${new Date(due2).toISOString()}: could not open a window: ${error63 instanceof Error ? error63.message : String(error63)}` });
     }
   }
-  writeStamps(ports.fs, ports.stampsFile, handled);
+  writeHandled(ports.fs, ports.stampsFile, handled);
   for (const outcome of outcomes) {
     if (outcome.status === "opened" || outcome.status === "skipped" || outcome.status === "failed") {
       ports.log(`window keeper: ${outcome.identity}: ${outcome.detail}`);
@@ -111971,6 +112124,109 @@ async function runWindowKeeper(ports) {
   return outcomes;
 }
 
+// src/usage/jobKeeper.ts
+function pendingReset(snapshot, window, nowMs) {
+  const recorded = snapshot?.providers[ANTHROPIC_PROVIDER]?.rateLimit?.unified?.[window];
+  return recorded === void 0 ? void 0 : effectiveWindow(recorded, nowMs).resetsAtMs;
+}
+function runJobs(ports) {
+  const nowMs = ports.nowMs();
+  const jobs = ports.jobs();
+  const previous = readHandled(ports.fs, ports.stampsFile);
+  const handled = Object.fromEntries(jobs.flatMap(({ name }) => previous[name] === void 0 ? [] : [[name, previous[name]]]));
+  const outcomes = [];
+  const runs = [];
+  const start = (name, identity, job, stamp, detail) => {
+    handled[name] = stamp;
+    ports.running.add(name);
+    outcomes.push({ name, status: "started", detail });
+    runs.push(
+      ports.run(name, identity, job).catch((error63) => {
+        ports.log(`job ${name}: failed as ${identity}: ${error63 instanceof Error ? error63.message : String(error63)}`);
+      }).finally(() => {
+        ports.running.delete(name);
+      })
+    );
+  };
+  const resolve2 = (target) => {
+    try {
+      const identity = ports.resolveIdentity(target);
+      return identity === void 0 ? { problem: "no member of its pool can be picked" } : { identity };
+    } catch (error63) {
+      return { problem: error63 instanceof Error ? error63.message : String(error63) };
+    }
+  };
+  const startIfServable = (name, identity, job, stamp, firedFor) => {
+    const refusal2 = refusalReason(identity, ports.snapshot(identity), nowMs);
+    if (refusal2 === void 0) {
+      start(name, identity, job, stamp, `${firedFor}: running as ${identity}`);
+      return;
+    }
+    handled[name] = stamp;
+    outcomes.push({ name, status: "skipped", detail: `${firedFor}: ${identity}: ${refusal2}` });
+  };
+  for (const { name, job } of jobs) {
+    if (ports.running.has(name)) {
+      outcomes.push({ name, status: "running", detail: "a previous run is still going" });
+      continue;
+    }
+    const { trigger } = job;
+    if ("at" in trigger) {
+      const last = handled[name];
+      if (last === void 0) {
+        handled[name] = nowMs;
+        outcomes.push({ name, status: "armed", detail: "schedule noted; the next anchor to fall is the first acted on" });
+        continue;
+      }
+      const due2 = dueAnchor(trigger.at, nowMs, last, ports.timeZone);
+      if (due2 === void 0) {
+        outcomes.push({ name, status: "waiting", detail: "no anchor has fallen since the last handled" });
+        continue;
+      }
+      const firedFor = `anchor ${new Date(due2).toISOString()}`;
+      const { identity: identity2, problem: problem2 } = resolve2(job.target);
+      if (identity2 === void 0) {
+        handled[name] = nowMs;
+        outcomes.push({ name, status: "skipped", detail: `${firedFor}: ${problem2 ?? "no identity"}` });
+        continue;
+      }
+      startIfServable(name, identity2, job, nowMs, firedFor);
+      continue;
+    }
+    const { identity, problem } = resolve2(job.target);
+    if (identity === void 0) {
+      outcomes.push({ name, status: "skipped", detail: problem ?? "no identity" });
+      continue;
+    }
+    const resetsAtMs = pendingReset(ports.snapshot(identity), trigger.beforeReset, nowMs);
+    if (resetsAtMs === void 0) {
+      outcomes.push({ name, status: "skipped", detail: `${identity} has no ${trigger.beforeReset} window to run before` });
+      continue;
+    }
+    if (resetsAtMs - parseDuration(trigger.lead) > nowMs || handled[name] === resetsAtMs) {
+      outcomes.push({ name, status: "waiting", detail: `${trigger.beforeReset} window resets in ${formatAge(resetsAtMs - nowMs)}` });
+      continue;
+    }
+    startIfServable(name, identity, job, resetsAtMs, `${trigger.beforeReset} window resetting in ${formatAge(resetsAtMs - nowMs)}`);
+  }
+  writeHandled(ports.fs, ports.stampsFile, handled);
+  for (const outcome of outcomes) {
+    if ((outcome.status === "started" || outcome.status === "skipped") && handled[outcome.name] !== previous[outcome.name]) {
+      ports.log(`job ${outcome.name}: ${outcome.detail}`);
+    }
+  }
+  return { outcomes, settled: Promise.all(runs).then(() => void 0) };
+}
+
+// src/usage/jobTarget.ts
+init_poolPick();
+function resolveJobIdentity(deps, target) {
+  if ("identity" in target) {
+    return target.identity;
+  }
+  return rankPoolGraph({ fs: deps.fs, paths: deps.paths, pools: deps.pools, poolName: target.pool, nowMs: deps.nowMs, resuming: false, identityExists: deps.identityExists }).ranking.pick?.identity;
+}
+
 // src/frontdoor/commands.ts
 init_realCredentialCache();
 
@@ -112080,7 +112336,7 @@ init_capability();
 
 // src/frontdoor/capture.ts
 var fs15 = __toESM(require("node:fs"), 1);
-var path38 = __toESM(require("node:path"), 1);
+var path39 = __toESM(require("node:path"), 1);
 var SECRET_HEADER_NAME = /authorization|cookie|token|secret|credential|api[-_]key/i;
 var SECRET_JSON_KEY = /token|secret|password|credential|authorization|api[-_]key/i;
 var SECRET_BODY_PATTERNS = [
@@ -112124,10 +112380,10 @@ function redactBody(chunk) {
 }
 var CAPTURE_ENV = "AGENT_SHIM_FRONTDOOR_CAPTURE";
 function captureFromEnv(env, logsDir) {
-  return env[CAPTURE_ENV] === "1" ? createFileCapture(path38.join(logsDir, "frontdoor-capture.jsonl")) : void 0;
+  return env[CAPTURE_ENV] === "1" ? createFileCapture(path39.join(logsDir, "frontdoor-capture.jsonl")) : void 0;
 }
 function createFileCapture(file2, now = () => /* @__PURE__ */ new Date()) {
-  fs15.mkdirSync(path38.dirname(file2), { recursive: true });
+  fs15.mkdirSync(path39.dirname(file2), { recursive: true });
   let nextId = 0;
   const append = (record2) => {
     fs15.appendFileSync(file2, `${JSON.stringify({ ts: now().toISOString(), ...record2 })}
@@ -112546,14 +112802,14 @@ init_capability();
 init_route();
 
 // src/frontdoor/supervisor.ts
-var import_node_path39 = __toESM(require("node:path"), 1);
+var import_node_path40 = __toESM(require("node:path"), 1);
 init_state2();
 function watchedInstallEntry(resolvedOwnExecutablePath, siblingExists) {
-  const parsed = import_node_path39.default.parse(resolvedOwnExecutablePath);
+  const parsed = import_node_path40.default.parse(resolvedOwnExecutablePath);
   if (parsed.name === "agent-shim") {
     return resolvedOwnExecutablePath;
   }
-  const sibling = import_node_path39.default.join(parsed.dir, `agent-shim${parsed.ext}`);
+  const sibling = import_node_path40.default.join(parsed.dir, `agent-shim${parsed.ext}`);
   return siblingExists(sibling) ? sibling : resolvedOwnExecutablePath;
 }
 var FRONTDOOR_SUPERVISOR_STILL_RUNNING = -1;
@@ -112740,8 +112996,8 @@ function parseConnectTarget(authority) {
   }
   return { host, port };
 }
-function servedByPipeline(path52) {
-  return path52?.startsWith(ROUTED_PATH_PREFIX) === true;
+function servedByPipeline(path54) {
+  return path54?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
   "connection",
@@ -113260,11 +113516,11 @@ function createRcSessionTracker(deps) {
   };
   const observeExchange = (request7) => {
     const method = (request7.method ?? "").toUpperCase();
-    const path52 = new URL(request7.url ?? "/", "http://127.0.0.1").pathname;
-    if (!path52.startsWith(RC_SESSIONS_PATH_PREFIX)) {
+    const path54 = new URL(request7.url ?? "/", "http://127.0.0.1").pathname;
+    if (!path54.startsWith(RC_SESSIONS_PATH_PREFIX)) {
       return void 0;
     }
-    const tail = path52.slice(RC_SESSIONS_PATH_PREFIX.length);
+    const tail = path54.slice(RC_SESSIONS_PATH_PREFIX.length);
     const facts = {
       oauthAuthorization: oauthAuthorizationOf(request7.headers),
       anthropicVersion: singleHeader(request7.headers, "anthropic-version"),
@@ -113625,8 +113881,8 @@ var RC_READ_FILE_ENCODINGS = ["utf-8", "base64"];
 function isRcReadFileEncoding(value2) {
   return RC_READ_FILE_ENCODINGS.some((encoding) => encoding === value2);
 }
-function buildRcReadFilePayload(requestId, path52, options) {
-  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path52, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
+function buildRcReadFilePayload(requestId, path54, options) {
+  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path54, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
 }
 function buildRcFileSuggestionsPayload(requestId, query) {
   return buildRcControlRequestPayload(requestId, { subtype: "file_suggestions", query });
@@ -113728,15 +113984,15 @@ async function getRcSessionContextUsage(deps, sessionId, detail) {
   const result = await deliverRcClientPayload(deps, sessionId, buildRcGetContextUsagePayload(requestId, detail), `request the context usage of session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
-async function readRcSessionFile(deps, sessionId, path52, options) {
-  if (path52 === "") {
+async function readRcSessionFile(deps, sessionId, path54, options) {
+  if (path54 === "") {
     return { ok: false, message: "a read-file write needs a non-empty path: the SDK's own field names the file the worker resolves against the session's cwd, and an empty string names none" };
   }
   if (options?.maxBytes !== void 0 && (!Number.isInteger(options.maxBytes) || options.maxBytes <= 0)) {
     return { ok: false, message: "a read-file write's max-bytes is a positive whole number of bytes: the SDK's own field caps the read, and a zero or negative cap reads nothing" };
   }
   const requestId = deps.newUuid();
-  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path52, options), `read ${path52} from session ${sessionId}`);
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path54, options), `read ${path54} from session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
 async function suggestRcSessionFiles(deps, sessionId, query) {
@@ -113907,11 +114163,11 @@ function createRcControlHandler(deps) {
       path: "read-file",
       read: (body) => {
         const session = bodyString(body, "session");
-        const path52 = bodyString(body, "path");
+        const path54 = bodyString(body, "path");
         const maxBytes = "maxBytes" in body ? bodyPositiveInteger(body, "maxBytes") : void 0;
         const encoding = "encoding" in body && isRcReadFileEncoding(body.encoding) ? body.encoding : void 0;
-        const refused2 = session === void 0 || path52 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
-        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path52, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
+        const refused2 = session === void 0 || path54 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
+        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path54, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
       }
     },
     {
@@ -114221,9 +114477,9 @@ function requestIdOfBody(body) {
 }
 function frontDoorRcControl(transport, token) {
   const headers = { authorization: `Bearer ${token}` };
-  const listAnswerOf = async (path52, what) => {
+  const listAnswerOf = async (path54, what) => {
     try {
-      return await transport.request({ method: "GET", path: path52, headers });
+      return await transport.request({ method: "GET", path: path54, headers });
     } catch (error63) {
       throw new Error(`${what}: could not reach the front door's control listener: ${error63 instanceof Error ? error63.message : String(error63)}`, { cause: error63 });
     }
@@ -114295,10 +114551,10 @@ function frontDoorRcControl(transport, token) {
     }
     return pending;
   };
-  const writeOf = async (path52, body, describeFailure) => {
+  const writeOf = async (path54, body, describeFailure) => {
     let answer;
     try {
-      answer = await transport.request({ method: "POST", path: path52, headers: { ...headers, "content-type": "application/json" }, body });
+      answer = await transport.request({ method: "POST", path: path54, headers: { ...headers, "content-type": "application/json" }, body });
     } catch (error63) {
       return { ok: false, message: `could not reach the front door's control listener: ${error63 instanceof Error ? error63.message : String(error63)}` };
     }
@@ -114329,10 +114585,10 @@ function frontDoorRcControl(transport, token) {
     endSession: async (sessionId, reason) => await writeOf(`${CONTROL_PATH_PREFIX}/end-session`, JSON.stringify({ session: sessionId, ...reason === void 0 ? {} : { reason } }), (status, message) => `ending ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getUsage: async (sessionId, skipBehaviors) => await writeOf(`${CONTROL_PATH_PREFIX}/get-usage`, JSON.stringify({ session: sessionId, ...skipBehaviors === void 0 ? {} : { skipBehaviors } }), (status, message) => `requesting the usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getContextUsage: async (sessionId, detail) => await writeOf(`${CONTROL_PATH_PREFIX}/get-context-usage`, JSON.stringify({ session: sessionId, ...detail === void 0 ? {} : { detail } }), (status, message) => `requesting the context usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
-    readFile: async (sessionId, path52, options) => await writeOf(
+    readFile: async (sessionId, path54, options) => await writeOf(
       `${CONTROL_PATH_PREFIX}/read-file`,
-      JSON.stringify({ session: sessionId, path: path52, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
-      (status, message) => `reading ${path52} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
+      JSON.stringify({ session: sessionId, path: path54, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
+      (status, message) => `reading ${path54} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
     ),
     fileSuggestions: async (sessionId, query) => await writeOf(`${CONTROL_PATH_PREFIX}/file-suggestions`, JSON.stringify({ session: sessionId, query }), (status, message) => `requesting file suggestions from ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     keepAlive: async (sessionId) => await writeOf(`${CONTROL_PATH_PREFIX}/keep-alive`, JSON.stringify({ session: sessionId }), (status, message) => `keeping ${sessionId} alive failed (HTTP ${String(status)}): ${message}`),
@@ -114626,12 +114882,12 @@ function tlsFacts(options) {
 }
 function realRcEventDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const post = async (path52, headers, body) => await new Promise((resolve2, reject) => {
+  const post = async (path54, headers, body) => await new Promise((resolve2, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method: "POST",
-      path: path52,
+      path: path54,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, "content-length": String(Buffer.byteLength(body, "utf8")) },
       agent
@@ -114696,12 +114952,12 @@ function lateRcStreamDial(resolve2) {
 }
 function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const request7 = async (method, path52, headers, body, signal) => await new Promise((resolve2, reject) => {
+  const request7 = async (method, path54, headers, body, signal) => await new Promise((resolve2, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method,
-      path: path52,
+      path: path54,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, ...body === void 0 ? {} : { "content-length": String(Buffer.byteLength(body, "utf8")) } },
       agent,
@@ -114743,9 +114999,9 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
       return { status, body: await readAll(response) };
     },
     openStream: async (sessionId, headers, resume, signal) => {
-      const path52 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
+      const path54 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
       const streamHeaders = resume === void 0 ? headers : { ...headers, "last-event-id": String(resume.fromSequenceNum) };
-      const { status, response } = await request7("GET", path52, streamHeaders, void 0, signal);
+      const { status, response } = await request7("GET", path54, streamHeaders, void 0, signal);
       if (!isSuccessful2(status)) {
         await readAll(response);
         return { status, chunks: NO_CHUNKS };
@@ -114961,10 +115217,10 @@ init_claudeShim();
 init_store();
 init_realPorts();
 var import_node_fs15 = __toESM(require("node:fs"), 1);
-var import_node_path41 = __toESM(require("node:path"), 1);
+var import_node_path42 = __toESM(require("node:path"), 1);
 
 // src/usage/signIn.ts
-var import_node_path40 = __toESM(require("node:path"), 1);
+var import_node_path41 = __toESM(require("node:path"), 1);
 var CREDENTIALS_FILE = ".credentials.json";
 function keychainHasItem(run, account) {
   return run.run("security", ["find-generic-password", "-a", account]).status === 0;
@@ -114982,7 +115238,7 @@ function decideSignIn(facts) {
   return { state: "signed-out", detail: facts.platform === "darwin" ? `no Keychain item and no ${CREDENTIALS_FILE}` : `no ${CREDENTIALS_FILE}` };
 }
 function credentialsFilePath(farmRoot) {
-  return import_node_path40.default.join(farmRoot, CREDENTIALS_FILE);
+  return import_node_path41.default.join(farmRoot, CREDENTIALS_FILE);
 }
 function identitySignIn(fs22, probe, identity) {
   const probing = !identity.hasCredentialBlock;
@@ -115108,7 +115364,7 @@ function tcpPortEraRecord(raw) {
   return (has("port") || has("lastPort")) && !has("socketPath");
 }
 function pushPathResolution(push, resolution) {
-  const ownDir = import_node_path41.default.dirname(resolution.ownExecutablePath);
+  const ownDir = import_node_path42.default.dirname(resolution.ownExecutablePath);
   switch (resolution.agentShim.status) {
     case "ok":
       push("path-resolution", "pass", `\`agent-shim\` on PATH resolves to this running executable, ${resolution.ownExecutablePath}.`, "agent-shim");
@@ -115207,14 +115463,14 @@ function pushProvider(push, entry, cacheEnv, signIn) {
 }
 function pushLegacyName(push, params) {
   const legacyVariables = Object.keys(params.env).filter((name) => name.startsWith(LEGACY_ENV_PREFIX) && params.env[name] !== void 0).sort();
-  if (legacyVariables.length === 0 && import_node_path41.default.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
+  if (legacyVariables.length === 0 && import_node_path42.default.basename(params.rootPath) !== LEGACY_HOME_DIRNAME) {
     push("legacy-name", "pass", "Nothing here still uses the former `claude-use` name.");
     return;
   }
   for (const name of legacyVariables) {
     push("legacy-name", "warn", `${name} is the former name of ${name.replace(LEGACY_ENV_PREFIX, ENV_PREFIX)}. Rename it; the old name still works but is only a fallback.`, name);
   }
-  if (import_node_path41.default.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
+  if (import_node_path42.default.basename(params.rootPath) === LEGACY_HOME_DIRNAME) {
     push(
       "legacy-name",
       "warn",
@@ -115587,18 +115843,18 @@ function collectDoctorReport(params) {
   const { paths } = params;
   const identityNames = import_node_fs15.default.existsSync(paths.identitiesDir) ? import_node_fs15.default.readdirSync(paths.identitiesDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && isIdentityDirectoryName(entry.name)).map((entry) => entry.name).sort() : [];
   const identities = identityNames.map((name) => {
-    const farmRoot = import_node_path41.default.join(paths.identitiesDir, name);
-    const identityPath = import_node_path41.default.join(farmRoot, "identity.json");
+    const farmRoot = import_node_path42.default.join(paths.identitiesDir, name);
+    const identityPath = import_node_path42.default.join(farmRoot, "identity.json");
     return { name, path: identityPath, raw: realFsPort.readFileUtf8(identityPath), farmRoot, credentialsFilePresent: import_node_fs15.default.existsSync(credentialsFilePath(farmRoot)) };
   });
   const profileNames = import_node_fs15.default.existsSync(paths.configProfilesDir) ? import_node_fs15.default.readdirSync(paths.configProfilesDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const configProfiles = profileNames.map((name) => {
-    const profilePath = import_node_path41.default.join(paths.configProfilesDir, `${name}.json`);
+    const profilePath = import_node_path42.default.join(paths.configProfilesDir, `${name}.json`);
     return { name, path: profilePath, raw: realFsPort.readFileUtf8(profilePath) };
   });
   const providerNames = import_node_fs15.default.existsSync(paths.providersDir) ? import_node_fs15.default.readdirSync(paths.providersDir, { withFileTypes: true }).filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => entry.name.slice(0, -".json".length)).sort() : [];
   const providers = providerNames.map((name) => {
-    const providerPath = import_node_path41.default.join(paths.providersDir, `${name}.json`);
+    const providerPath = import_node_path42.default.join(paths.providersDir, `${name}.json`);
     return { name, path: providerPath, raw: realFsPort.readFileUtf8(providerPath) };
   });
   const ownExecutablePath = realOwnExecutablePath();
@@ -115610,12 +115866,12 @@ function collectDoctorReport(params) {
     binaryDiscovery = { ok: false, message: error63 instanceof Error ? error63.message : String(error63) };
   }
   const shimState = readJson(paths.claudeShimFile, ClaudeShimStateSchema);
-  const pathDirs = (params.env.PATH ?? "").split(import_node_path41.default.delimiter).filter((dir) => dir !== "");
+  const pathDirs = (params.env.PATH ?? "").split(import_node_path42.default.delimiter).filter((dir) => dir !== "");
   const claudeShimShadow = shimState === void 0 ? void 0 : refinePathShadow(
     findPathShadow({
       pathDirs,
-      targetDir: import_node_path41.default.dirname(shimState.targetPath),
-      targetFilename: import_node_path41.default.basename(shimState.targetPath),
+      targetDir: import_node_path42.default.dirname(shimState.targetPath),
+      targetFilename: import_node_path42.default.basename(shimState.targetPath),
       findExecutableInDir
     }),
     shimState.targetPath,
@@ -115644,7 +115900,7 @@ function collectDoctorReport(params) {
       agentShim: refinePathShadow(
         findPathShadow({
           pathDirs,
-          targetDir: import_node_path41.default.dirname(ownExecutablePath),
+          targetDir: import_node_path42.default.dirname(ownExecutablePath),
           targetFilename: commandFilename(ownExecutablePath, "agent-shim"),
           findExecutableInDir
         }),
@@ -115907,11 +116163,11 @@ function tryOrUndefined(fn2) {
     return void 0;
   }
 }
-function pathToHttpPath(path52) {
-  return `/${path52.map(safeEncodeURIComponent).join("/")}`;
+function pathToHttpPath(path54) {
+  return `/${path54.map(safeEncodeURIComponent).join("/")}`;
 }
-function normalizeHttpPath(path52) {
-  const paths = path52.split("/");
+function normalizeHttpPath(path54) {
+  const paths = path54.split("/");
   if (paths.at(0) === "") {
     paths.shift();
   }
@@ -116096,9 +116352,9 @@ function isPlainObject2(value2) {
 function getOwn(object3, key) {
   return Object.hasOwn(object3, key) ? object3[key] : void 0;
 }
-function get(object3, path52) {
+function get(object3, path54) {
   let current = object3;
-  for (const key of path52) {
+  for (const key of path54) {
     if (!isTypescriptObject(current)) {
       return void 0;
     }
@@ -117321,7 +117577,7 @@ function resolveClientRest(rest) {
     // rest[1] can be undefined if all fields of FriendlyClientOptions are optional
   ];
 }
-function createORPCClient(link, { path: path52 = [], ...options } = {}) {
+function createORPCClient(link, { path: path54 = [], ...options } = {}) {
   const procedureClient = (...rest) => {
     const [input2, callOptions] = resolveClientRest(rest);
     const interceptors = [
@@ -117330,7 +117586,7 @@ function createORPCClient(link, { path: path52 = [], ...options } = {}) {
     ];
     return intercept(
       interceptors,
-      { ...callOptions, input: input2, path: path52 },
+      { ...callOptions, input: input2, path: path54 },
       ({ path: path210, input: input22, ...callOptions2 }) => link.call(path210, input22, callOptions2)
     );
   };
@@ -117344,7 +117600,7 @@ function createORPCClient(link, { path: path52 = [], ...options } = {}) {
       if (client === void 0) {
         client = createORPCClient(link, {
           ...options,
-          path: [...path52, key],
+          path: [...path54, key],
           scoped: options.scoped?.[key]
         });
         cache.set(key, client);
@@ -117366,24 +117622,24 @@ var BracketNotationSerializer = class {
     this.internalSerialize(data, "", true, result);
     return result;
   }
-  internalSerialize(data, path52, isRoot, result) {
+  internalSerialize(data, path54, isRoot, result) {
     if (Array.isArray(data)) {
       data.forEach((item, i10) => {
-        this.internalSerialize(item, isRoot ? i10.toString() : `${path52}[${i10}]`, false, result);
+        this.internalSerialize(item, isRoot ? i10.toString() : `${path54}[${i10}]`, false, result);
       });
     } else if (isPlainObject2(data)) {
       for (const key of Object.keys(data)) {
-        this.internalSerialize(data[key], isRoot ? key : `${path52}[${key}]`, false, result);
+        this.internalSerialize(data[key], isRoot ? key : `${path54}[${key}]`, false, result);
       }
     } else {
-      result.push([path52, data]);
+      result.push([path54, data]);
     }
   }
   deserialize(serialized) {
     const arrayPushStyles = /* @__PURE__ */ new WeakSet();
     const root = new NullProtoObj();
-    for (const [path52, value2] of serialized) {
-      const segments = this.parsePath(path52);
+    for (const [path54, value2] of serialized) {
+      const segments = this.parsePath(path54);
       let currentRef = root;
       let nextSegment = segments[0];
       for (let i10 = 1; i10 < segments.length; i10++) {
@@ -117434,13 +117690,13 @@ var BracketNotationSerializer = class {
     }
     return result;
   }
-  parsePath(path52) {
+  parsePath(path54) {
     const segments = [];
     let inBrackets = false;
     let currentSegment = "";
-    for (let i10 = 0; i10 < path52.length; i10++) {
-      const char = path52[i10];
-      const nextChar = path52[i10 + 1];
+    for (let i10 = 0; i10 < path54.length; i10++) {
+      const char = path54[i10];
+      const nextChar = path54[i10 + 1];
       if (inBrackets && char === "]" && (nextChar === void 0 || nextChar === "[")) {
         if (nextChar === void 0) {
           inBrackets = false;
@@ -117456,7 +117712,7 @@ var BracketNotationSerializer = class {
         currentSegment += char;
       }
     }
-    return inBrackets || segments.length === 0 ? [path52] : segments;
+    return inBrackets || segments.length === 0 ? [path54] : segments;
   }
 };
 var INTEGER_PATTERN = /^0$|^[1-9]\d*$/;
@@ -118029,11 +118285,11 @@ var OpenAPISerializer = class {
       return json2;
     }
     const form = new FormData();
-    for (const [path52, value22] of this.bracketNotation.serialize(json2)) {
+    for (const [path54, value22] of this.bracketNotation.serialize(json2)) {
       if (value22 instanceof Blob) {
-        form.append(path52, value22);
+        form.append(path54, value22);
       } else if (value22 !== void 0 && value22 !== null) {
-        form.append(path52, String(value22));
+        form.append(path54, String(value22));
       }
     }
     return form;
@@ -118071,30 +118327,30 @@ function isBodylessMethod(method) {
   return method === "GET" || method === "HEAD";
 }
 var PARAMETER_NAME_REGEX = /^[\w-]+$/;
-function getDynamicPathParams(path52) {
-  if (!path52.includes("{")) {
+function getDynamicPathParams(path54) {
+  if (!path54.includes("{")) {
     return void 0;
   }
-  const len = path52.length;
+  const len = path54.length;
   let params;
   let index = 1;
   while (index < len) {
     const segmentStart = index;
-    const slashPos = path52.indexOf("/", index);
+    const slashPos = path54.indexOf("/", index);
     const segmentEnd = slashPos === -1 ? len : slashPos;
-    if (segmentEnd > segmentStart && path52.charCodeAt(segmentStart) === 123 && path52.charCodeAt(segmentEnd - 1) === 125) {
+    if (segmentEnd > segmentStart && path54.charCodeAt(segmentStart) === 123 && path54.charCodeAt(segmentEnd - 1) === 125) {
       let parameterStart = segmentStart + 1;
       let allowsSlash = false;
-      const operator = path52.charCodeAt(parameterStart);
+      const operator = path54.charCodeAt(parameterStart);
       if (operator === 43) {
         allowsSlash = true;
         parameterStart++;
       }
-      const parameterName = path52.slice(parameterStart, segmentEnd - 1);
+      const parameterName = path54.slice(parameterStart, segmentEnd - 1);
       if (PARAMETER_NAME_REGEX.test(parameterName)) {
         params ??= [];
         params.push({
-          segment: path52.slice(segmentStart, segmentEnd),
+          segment: path54.slice(segmentStart, segmentEnd),
           startIndex: segmentStart,
           parameterName,
           allowsSlash
@@ -118137,8 +118393,8 @@ openapi.method = (method) => ({
   ...openapi({ method }),
   name: "~openapi/method"
 });
-openapi.path = (path52) => ({
-  ...openapi({ path: path52 }),
+openapi.path = (path54) => ({
+  ...openapi({ path: path54 }),
   name: "~openapi/path"
 });
 openapi.spec = (spec) => ({
@@ -118999,22 +119255,22 @@ function visitJsonSchemaRefs(value2, visit2, schemaLevel = true, seen = /* @__PU
     }
   }
 }
-function mapJsonSchemaRefs(value2, map2, schemaLevel = true, path52 = []) {
+function mapJsonSchemaRefs(value2, map2, schemaLevel = true, path54 = []) {
   if (!value2 || typeof value2 !== "object") {
     return value2;
   }
   if (Array.isArray(value2)) {
-    return value2.map((item, index) => mapJsonSchemaRefs(item, map2, schemaLevel, [...path52, index]));
+    return value2.map((item, index) => mapJsonSchemaRefs(item, map2, schemaLevel, [...path54, index]));
   }
   const result = {};
   for (const key of Object.keys(value2)) {
     const val = value2[key];
     if (key === "$ref" && typeof val === "string") {
-      setOwn(result, key, map2(val, [...path52, key]));
+      setOwn(result, key, map2(val, [...path54, key]));
     } else if (!schemaLevel) {
-      setOwn(result, key, mapJsonSchemaRefs(val, map2, true, [...path52, key]));
+      setOwn(result, key, mapJsonSchemaRefs(val, map2, true, [...path54, key]));
     } else if (JSON_SCHEMA_LOGIC_KEYWORDS.has(key) || JSON_SCHEMA_RECORD_KEYWORDS.has(key)) {
-      setOwn(result, key, mapJsonSchemaRefs(val, map2, !JSON_SCHEMA_RECORD_KEYWORDS.has(key), [...path52, key]));
+      setOwn(result, key, mapJsonSchemaRefs(val, map2, !JSON_SCHEMA_RECORD_KEYWORDS.has(key), [...path54, key]));
     } else {
       setOwn(result, key, val);
     }
@@ -119544,7 +119800,7 @@ function unlazy(maybeLazy) {
 function createProcedureClient(lazyableProcedure, ...rest) {
   const options = resolveMaybeOptionalOptions(rest);
   return async (...[input2, callerOptions]) => {
-    const path52 = toArray(options.path);
+    const path54 = toArray(options.path);
     const { default: procedure } = await unlazy(lazyableProcedure);
     const clientContext = callerOptions?.context ?? {};
     const context = await value(options.context, clientContext) ?? {};
@@ -119557,7 +119813,7 @@ function createProcedureClient(lazyableProcedure, ...rest) {
     };
     try {
       const output2 = await runWithSpan("call_procedure", (span) => {
-        span?.setAttribute("procedure.path", path52);
+        span?.setAttribute("procedure.path", path54);
         return intercept(
           options.interceptors,
           {
@@ -119565,7 +119821,7 @@ function createProcedureClient(lazyableProcedure, ...rest) {
             // input can be optional if it is undefinable
             input: input2,
             errors,
-            path: path52,
+            path: path54,
             procedure,
             signal: callerOptions?.signal,
             lastEventId: callerOptions?.lastEventId
@@ -119816,10 +120072,10 @@ function augmentRouter(router, options) {
   }
   return enhanced;
 }
-function getRouter(router, path52) {
+function getRouter(router, path54) {
   let current = router;
-  for (let i10 = 0; i10 < path52.length; i10++) {
-    const segment = path52[i10];
+  for (let i10 = 0; i10 < path54.length; i10++) {
+    const segment = path54[i10];
     if (!isTypescriptObject(current)) {
       return void 0;
     }
@@ -119831,7 +120087,7 @@ function getRouter(router, path52) {
       continue;
     }
     const lazied = current;
-    const rest = path52.slice(i10);
+    const rest = path54.slice(i10);
     return new Lazy({
       ...lazied["~orpc"],
       async loader() {
@@ -119846,40 +120102,40 @@ function getRouter(router, path52) {
   }
   return current;
 }
-function walkProcedureContractsSync(router, callback, path52 = []) {
+function walkProcedureContractsSync(router, callback, path54 = []) {
   const lazyResults = [];
-  walkProcedureContractsSyncInternal(router, callback, path52.slice(), lazyResults);
+  walkProcedureContractsSyncInternal(router, callback, path54.slice(), lazyResults);
   return lazyResults;
 }
-function walkProcedureContractsSyncInternal(router, callback, path52, lazyResults) {
+function walkProcedureContractsSyncInternal(router, callback, path54, lazyResults) {
   const hiddenContract = getHiddenRouterContract(router);
   if (hiddenContract !== void 0) {
     router = hiddenContract;
   }
   if (router instanceof ProcedureContract) {
-    callback(router, path52.slice());
+    callback(router, path54.slice());
     return;
   }
   if (!isTypescriptObject(router)) {
     return;
   }
   for (const [key, value2] of Object.entries(router)) {
-    path52.push(key);
+    path54.push(key);
     if (value2 instanceof Lazy) {
-      lazyResults.push({ router: value2, path: path52.slice() });
+      lazyResults.push({ router: value2, path: path54.slice() });
     } else {
-      walkProcedureContractsSyncInternal(value2, callback, path52, lazyResults);
+      walkProcedureContractsSyncInternal(value2, callback, path54, lazyResults);
     }
-    path52.pop();
+    path54.pop();
   }
 }
-async function walkProcedureContractsAsync(router, callback, path52 = []) {
+async function walkProcedureContractsAsync(router, callback, path54 = []) {
   const hiddenContract = getHiddenRouterContract(router);
   if (hiddenContract !== void 0) {
     router = hiddenContract;
   }
   if (router instanceof ProcedureContract) {
-    await callback(router, path52);
+    await callback(router, path54);
     return;
   }
   if (!isTypescriptObject(router)) {
@@ -119888,9 +120144,9 @@ async function walkProcedureContractsAsync(router, callback, path52 = []) {
   for (const [key, value2] of Object.entries(router)) {
     if (value2 instanceof Lazy) {
       const { default: router2 } = await unlazy(value2);
-      await walkProcedureContractsAsync(router2, callback, [...path52, key]);
+      await walkProcedureContractsAsync(router2, callback, [...path54, key]);
     } else {
-      await walkProcedureContractsAsync(value2, callback, [...path52, key]);
+      await walkProcedureContractsAsync(value2, callback, [...path54, key]);
     }
   }
 }
@@ -120376,18 +120632,18 @@ function rewriteComponentSchemaRefs(schema, renameMap) {
 }
 var OpenAPIGeneratorError = class extends TypeError {
 };
-function toOpenAPIPath(path52, dynamicPathParams) {
+function toOpenAPIPath(path54, dynamicPathParams) {
   if (!dynamicPathParams?.length) {
-    return path52;
+    return path54;
   }
   let normalized = "";
   let currentIndex = 0;
   for (const param of dynamicPathParams) {
-    normalized += path52.slice(currentIndex, param.startIndex);
+    normalized += path54.slice(currentIndex, param.startIndex);
     normalized += `{${param.parameterName}}`;
     currentIndex = param.startIndex + param.segment.length;
   }
-  normalized += path52.slice(currentIndex);
+  normalized += path54.slice(currentIndex);
   return normalized;
 }
 function buildRequest(ctx, operation, def, meta3, dynamicPathParams) {
@@ -120821,8 +121077,8 @@ var OpenAPIGenerator = class {
       customErrorResponseBodySchema: options.customErrorResponseBodySchema
     };
     const errors = [];
-    await walkProcedureContractsAsync(router, (contract, path52) => {
-      if (value(options.filter, contract, path52) === false) {
+    await walkProcedureContractsAsync(router, (contract, path54) => {
+      if (value(options.filter, contract, path54) === false) {
         return;
       }
       try {
@@ -120834,7 +121090,7 @@ var OpenAPIGenerator = class {
             `QUERY operations require OpenAPI 3.2, but version "${version2}" was requested.`
           );
         }
-        const postPath = meta3?.path ?? pathToHttpPath(path52);
+        const postPath = meta3?.path ?? pathToHttpPath(path54);
         const httpPath = meta3?.prefix ? mergeHttpPath(meta3.prefix, postPath) : postPath;
         const dynamicPathParams = getDynamicPathParams(httpPath);
         const openApiPath = toOpenAPIPath(httpPath, dynamicPathParams);
@@ -120843,7 +121099,7 @@ var OpenAPIGenerator = class {
           operation = meta3.spec;
         } else {
           operation = {
-            operationId: meta3?.operationId ?? path52.join("."),
+            operationId: meta3?.operationId ?? path54.join("."),
             summary: meta3?.summary,
             description: meta3?.description,
             deprecated: meta3?.deprecated,
@@ -120863,7 +121119,7 @@ var OpenAPIGenerator = class {
         if (!(e14 instanceof OpenAPIGeneratorError)) {
           throw e14;
         }
-        errors.push(`Procedure at ${path52.join(".") || "(root)"}: ${e14.message}`);
+        errors.push(`Procedure at ${path54.join(".") || "(root)"}: ${e14.message}`);
       }
     });
     if (errors.length) {
@@ -121171,7 +121427,7 @@ var ResetRowSchema = external_exports.strictObject({
 var ResetScheduleSchema = external_exports.strictObject({ resets: external_exports.readonly(external_exports.array(ResetRowSchema)) });
 
 // src/frontdoor/controlSchemas.ts
-var import_node_path42 = __toESM(require("node:path"), 1);
+var import_node_path43 = __toESM(require("node:path"), 1);
 init_zod();
 init_schema2();
 
@@ -121383,11 +121639,11 @@ var FrontDoorSessionsOutputSchema = external_exports.strictObject({ sessions: ex
 var CheckRunInputSchema = external_exports.strictObject({
   path: external_exports.string().min(1),
   identity: external_exports.string().min(1).optional()
-}).refine((input2) => import_node_path42.default.isAbsolute(input2.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+}).refine((input2) => import_node_path43.default.isAbsolute(input2.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
 var PoolPickInputSchema = external_exports.strictObject({
   pool: external_exports.string().min(1),
   path: external_exports.string().min(1)
-}).refine((input2) => import_node_path42.default.isAbsolute(input2.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+}).refine((input2) => import_node_path43.default.isAbsolute(input2.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
 var DoctorFindingSchema = external_exports.strictObject({
   section: external_exports.enum(DOCTOR_SECTIONS),
   subject: external_exports.string().optional(),
@@ -121708,16 +121964,16 @@ var StandardLink = class {
   /**
    * @throws ORPCError, transport-level errors (network failures, timeouts, etc.)
    */
-  call(path52, input2, options) {
-    return runWithSpan(`${ORPC_NAME}.${path52.join("/")}`, (span) => {
+  call(path54, input2, options) {
+    return runWithSpan(`${ORPC_NAME}.${path54.join("/")}`, (span) => {
       span?.setAttribute("rpc.system", ORPC_NAME);
-      span?.setAttribute("rpc.method", path52.join("."));
+      span?.setAttribute("rpc.method", path54.join("."));
       if (getTracer() && isAsyncIteratorObject(input2)) {
         input2 = override(input2, traceAsyncIterator("consume_async_iterator_object_input", input2));
       } else if (getTracer() && input2 instanceof ReadableStream) {
         input2 = override(input2, traceReadableStream("consume_octet_stream_input", input2));
       }
-      return intercept(this.interceptors, { ...options, path: path52, input: input2 }, async ({ path: path210, input: input22, ...options2 }) => {
+      return intercept(this.interceptors, { ...options, path: path54, input: input2 }, async ({ path: path210, input: input22, ...options2 }) => {
         const tracer = getTracer();
         const activeSpan = tracer?.getActiveSpan() ?? span;
         let request7 = await runWithSpan(
@@ -121774,18 +122030,18 @@ var RPCLinkCodec = class {
     this.headers = options.headers ?? {};
     this.serializer = options.serializer ?? new RPCSerializer();
   }
-  async encodeInput(input2, path52, options) {
-    let headers = toResolvedStandardHeaders(await value(this.headers, options, path52, input2));
+  async encodeInput(input2, path54, options) {
+    let headers = toResolvedStandardHeaders(await value(this.headers, options, path54, input2));
     if (options.lastEventId !== void 0) {
       headers = mergeStandardHeaders(headers, { "last-event-id": options.lastEventId });
     }
-    const expectedMethod = await value(this.expectedMethod, options, path52, input2);
-    const baseUrl = await value(this.baseUrl, options, path52, input2);
+    const expectedMethod = await value(this.expectedMethod, options, path54, input2);
+    const baseUrl = await value(this.baseUrl, options, path54, input2);
     const [pathname, search, hash2] = parseStandardUrl(baseUrl);
-    const newPathname = `${pathname.replace(END_SLASH_REGEX, "")}${pathToHttpPath(path52)}`;
+    const newPathname = `${pathname.replace(END_SLASH_REGEX, "")}${pathToHttpPath(path54)}`;
     const serialized = this.serializer.serialize(input2);
     if (expectedMethod === "GET" && !(serialized instanceof Blob) && !(serialized instanceof ReadableStream) && !(serialized instanceof FormData) && !isAsyncIteratorObject(serialized)) {
-      const maxUrlLength = await value(this.maxUrlLength, options, path52, input2);
+      const maxUrlLength = await value(this.maxUrlLength, options, path54, input2);
       const mergedSearch = new URLSearchParams(search);
       mergedSearch.append("data", stringifyJSON(serialized) ?? "");
       const url22 = `${newPathname}?${mergedSearch}${hash2 ?? ""}`;
@@ -121870,8 +122126,8 @@ var FetchLinkTransport = class {
     this.fetch = options.fetch ?? ((url2, init) => globalThis.fetch(url2, init));
     this.toFetchRequestOptions = options.toFetchRequest;
   }
-  async send(standardRequest, path52, options) {
-    let origin = await value(this.origin, options, path52);
+  async send(standardRequest, path54, options) {
+    let origin = await value(this.origin, options, path54);
     if (origin?.endsWith("/")) {
       origin = origin.slice(0, -1);
     }
@@ -121891,7 +122147,7 @@ var FetchLinkTransport = class {
       }
     }
     const fetch3 = this.fetch;
-    const response = await fetch3(url2, init, options, path52);
+    const response = await fetch3(url2, init, options, path54);
     const standardResponse = toStandardLazyResponse(response);
     return standardResponse;
   }
@@ -122282,14 +122538,14 @@ var StandardHandler = class {
           span?.setAttribute("url.path", request22.url);
           return { matched: false };
         }
-        const { path: path52, procedure, decodeInput } = matchedOrNot;
-        span?.updateName(`${ORPC_NAME}.${path52.join("/")}`);
+        const { path: path54, procedure, decodeInput } = matchedOrNot;
+        span?.updateName(`${ORPC_NAME}.${path54.join("/")}`);
         span?.setAttribute("rpc.system", ORPC_NAME);
-        span?.setAttribute("rpc.method", path52.join("."));
+        span?.setAttribute("rpc.method", path54.join("."));
         try {
           const response = await intercept(
             this.interceptors,
-            { context: context2, prefix: prefix2, request: request22, path: path52, procedure, decodeInput },
+            { context: context2, prefix: prefix2, request: request22, path: path54, procedure, decodeInput },
             async ({ context: context3, prefix: prefix3, request: request32, path: path210, procedure: procedure2, decodeInput: decodeInput2 }) => {
               step2 = "decode_input";
               let input2 = await runWithSpan("decode_input", decodeInput2);
@@ -122323,7 +122579,7 @@ var StandardHandler = class {
             message: `Malformed request. Ensure the request body is properly formatted and the 'Content-Type' header is set correctly.`,
             cause: e14
           }) : toORPCError(e14);
-          const response = await this.codec.encodeError(error63, procedure, path52, { context: context2, prefix: prefix2 });
+          const response = await this.codec.encodeError(error63, procedure, path54, { context: context2, prefix: prefix2 });
           return { matched: true, response };
         }
       }
@@ -122429,7 +122685,7 @@ var RPCMatcher = class {
     this.rootRouter = router;
     this.index(router);
   }
-  index(router, path52 = []) {
+  index(router, path54 = []) {
     const lazyResults = walkProcedureContractsSync(router, (procedure, procedurePath) => {
       if (!value(this.filter, procedure, procedurePath)) {
         return;
@@ -122440,7 +122696,7 @@ var RPCMatcher = class {
         // contract-first entries have no implementation yet, resolveProcedure fills it in on demand
         procedure: procedure instanceof Procedure ? procedure : void 0
       });
-    }, path52);
+    }, path54);
     for (const result of lazyResults) {
       this.pendingLazyRouters.set(pathToHttpPath(result.path), result);
     }
@@ -122572,10 +122828,10 @@ var RPCHandlerCodec = class {
       }
     };
   }
-  encodeOutput(output2, procedure, path52, options) {
+  encodeOutput(output2, procedure, path54, options) {
     return {
       headers: {},
-      status: value(this.outputStatus, output2, procedure, path52, options) ?? DEFAULT_SUCCESS_STATUS,
+      status: value(this.outputStatus, output2, procedure, path54, options) ?? DEFAULT_SUCCESS_STATUS,
       body: this.serializer.serialize(output2)
     };
   }
@@ -122629,39 +122885,39 @@ function createRouter() {
     static: new NullProtoObj2()
   };
 }
-function scanFirstGroup(path52) {
+function scanFirstGroup(path54) {
   let i10 = 0;
   let depth = 0;
-  for (; i10 < path52.length; i10++) {
-    const c10 = path52.charCodeAt(i10);
+  for (; i10 < path54.length; i10++) {
+    const c10 = path54.charCodeAt(i10);
     if (c10 === 92) i10++;
     else if (c10 === 40) depth++;
     else if (c10 === 41 && depth > 0) depth--;
     else if (c10 === 123 && depth === 0) break;
   }
-  if (i10 >= path52.length) return;
+  if (i10 >= path54.length) return;
   let j10 = i10 + 1;
   depth = 0;
-  for (; j10 < path52.length; j10++) {
-    const c10 = path52.charCodeAt(j10);
+  for (; j10 < path54.length; j10++) {
+    const c10 = path54.charCodeAt(j10);
     if (c10 === 92) j10++;
     else if (c10 === 40) depth++;
     else if (c10 === 41 && depth > 0) depth--;
     else if (c10 === 125 && depth === 0) break;
   }
-  if (j10 >= path52.length) return;
-  const mod = path52[j10 + 1];
+  if (j10 >= path54.length) return;
+  const mod = path54[j10 + 1];
   const hasMod = mod === "?" || mod === "+" || mod === "*";
   return [
-    path52.slice(0, i10),
-    path52.slice(i10 + 1, j10),
-    path52.slice(j10 + (hasMod ? 2 : 1)),
+    path54.slice(0, i10),
+    path54.slice(i10 + 1, j10),
+    path54.slice(j10 + (hasMod ? 2 : 1)),
     hasMod ? mod : void 0
   ];
 }
-function expandGroupDelimiters(path52) {
-  if (!path52.includes("{")) return;
-  const group = scanFirstGroup(path52);
+function expandGroupDelimiters(path54) {
+  if (!path54.includes("{")) return;
+  const group = scanFirstGroup(path54);
   if (!group) return;
   const [pre2, body, suf, mod] = group;
   if (!mod) return [pre2 + body + suf];
@@ -122731,9 +122987,9 @@ function replaceSegmentWildcards(segment, unnamedStart, toGroupKey = toUnnamedGr
   }
   return [replaced, nextIndex];
 }
-function encodeEscapes(path52) {
-  if (!path52.includes("\\")) return path52;
-  return path52.replace(/\\([:(){}])/g, (_, c10) => "\uFFFD" + "ABCDE"[":(){}".indexOf(c10)]);
+function encodeEscapes(path54) {
+  if (!path54.includes("\\")) return path54;
+  return path54.replace(/\\([:(){}])/g, (_, c10) => "\uFFFD" + "ABCDE"[":(){}".indexOf(c10)]);
 }
 function segmentKey(segment) {
   if (segment.startsWith("**")) return 2;
@@ -122762,22 +123018,22 @@ function expandModifiers(segments) {
     return m10[2] === "+" ? [wc2] : [wc2, without];
   }
 }
-function normalizePath(path52) {
-  if (!path52.includes("/.")) return path52;
+function normalizePath(path54) {
+  if (!path54.includes("/.")) return path54;
   const r10 = [];
-  for (const s of path52.split("/")) if (s === ".") continue;
+  for (const s of path54.split("/")) if (s === ".") continue;
   else if (s === ".." && r10.length > 1) r10.pop();
   else r10.push(s);
   return r10.join("/") || "/";
 }
-function splitPath(path52) {
-  const s = path52.split("/");
+function splitPath(path54) {
+  const s = path54.split("/");
   s.shift();
   if (s[s.length - 1] === "") s.pop();
   return s;
 }
-function splitRoute(path52) {
-  const s = splitPath(path52);
+function splitRoute(path54) {
+  const s = splitPath(path54);
   while (s[s.length - 1] === "") s.pop();
   return s;
 }
@@ -122793,16 +123049,16 @@ function getMatchParams(segments, paramsMap) {
   }
   return params;
 }
-function addRoute(ctx, method = "", path52, data) {
+function addRoute(ctx, method = "", path54, data) {
   method = method.toUpperCase();
-  if (path52.charCodeAt(0) !== 47) path52 = `/${path52}`;
-  const groupExpanded = expandGroupDelimiters(path52);
+  if (path54.charCodeAt(0) !== 47) path54 = `/${path54}`;
+  const groupExpanded = expandGroupDelimiters(path54);
   if (groupExpanded) {
     for (const expandedPath of groupExpanded) addRoute(ctx, method, expandedPath, data);
     return;
   }
-  path52 = encodeEscapes(path52);
-  const segments = splitRoute(path52);
+  path54 = encodeEscapes(path54);
+  const segments = splitRoute(path54);
   const expanded = expandModifiers(segments);
   if (expanded) {
     for (const p of expanded) addRoute(ctx, method, p, data);
@@ -122893,15 +123149,15 @@ function getParamRegexp(segment, unnamedStart = 0) {
   const regex = _s2.replace(/:([\w-]+)(?:\(([^)]*)\))?/g, (_, id2, p) => `(?<${toGroupName(id2)}>${p || "[^/]+"})`).replace(/\((?![?<])/g, () => `(?<${toUnnamedGroupKey(_i2++)}>`).replace(/\uFFFE(.)/g, (_, c10) => /[.*+?^${}()|[\]\\]/.test(c10) ? `\\${c10}` : c10);
   return [new RegExp(`^${regex}$`), _i2];
 }
-function findRoute(ctx, method = "", path52, opts) {
-  if (opts?.normalize) path52 = normalizePath(path52);
-  if (path52.charCodeAt(path52.length - 1) === 47) path52 = path52.slice(0, -1);
-  const staticNode = ctx.static[path52];
+function findRoute(ctx, method = "", path54, opts) {
+  if (opts?.normalize) path54 = normalizePath(path54);
+  if (path54.charCodeAt(path54.length - 1) === 47) path54 = path54.slice(0, -1);
+  const staticNode = ctx.static[path54];
   if (staticNode && staticNode.methods) {
     const staticMatch = staticNode.methods[method] || staticNode.methods[""];
     if (staticMatch !== void 0) return staticMatch[0];
   }
-  const segments = splitPath(path52);
+  const segments = splitPath(path54);
   const match = _lookupTree(ctx.root, method, segments, 0);
   if (match === void 0) return;
   if (opts?.params === false) return match;
@@ -123101,7 +123357,7 @@ var OpenAPIMatcher = class {
     this.rootRouter = router;
     this.index(router);
   }
-  index(router, path52 = []) {
+  index(router, path54 = []) {
     const lazyResults = walkProcedureContractsSync(router, (contract, path210) => {
       if (!value(this.filter, contract, path210)) {
         return;
@@ -123116,7 +123372,7 @@ var OpenAPIMatcher = class {
         contract,
         procedure: contract instanceof Procedure ? contract : void 0
       });
-    }, path52);
+    }, path54);
     for (const result of lazyResults) {
       const prefix = getOpenAPIMeta(result.router)?.prefix;
       this.pendingLazyRouters.add({
@@ -123203,20 +123459,20 @@ var OpenAPIMatcher = class {
     return entry.procedure;
   }
 };
-function toRou3Pattern(path52) {
-  const params = getDynamicPathParams(path52);
+function toRou3Pattern(path54) {
+  const params = getDynamicPathParams(path54);
   if (!params?.length) {
-    return path52;
+    return path54;
   }
   for (let i10 = params.length - 1; i10 >= 0; i10--) {
     const param = params[i10];
     const pattern = param.allowsSlash ? `**:${param.parameterName}` : `:${param.parameterName}`;
-    path52 = path52.slice(0, param.startIndex) + pattern + path52.slice(param.startIndex + param.segment.length);
+    path54 = path54.slice(0, param.startIndex) + pattern + path54.slice(param.startIndex + param.segment.length);
   }
-  return path52;
+  return path54;
 }
-function toRou3PrefixMatcher(path52) {
-  const pattern = toRou3Pattern(path52);
+function toRou3PrefixMatcher(path54) {
+  const pattern = toRou3Pattern(path54);
   return routeToRegExp(pattern === "/" ? "/**" : `${pattern}/**`);
 }
 function decodeParams(params) {
@@ -123295,7 +123551,7 @@ var OpenAPIHandlerCodecCore = class {
   /**
    * @throws {TypeError} If `outputStructure` is "detailed" and the output doesn't match the expected structure.
    */
-  encodeOutput(output2, procedure, path52) {
+  encodeOutput(output2, procedure, path54) {
     const meta3 = getOpenAPIMeta(procedure);
     const successStatus = meta3?.successStatus ?? DEFAULT_SUCCESS_STATUS;
     const outputStructure = meta3?.outputStructure ?? DEFAULT_OPENAPI_OUTPUT_STRUCTURE;
@@ -123308,7 +123564,7 @@ var OpenAPIHandlerCodecCore = class {
     }
     if (!isValidDetailedOutput(output2)) {
       throw new TypeError(`
-        Invalid "detailed" output structure returned by procedure (${path52.join(".")}):
+        Invalid "detailed" output structure returned by procedure (${path54.join(".")}):
         \u2022 Expected an object with optional properties:
           - status (number <400)
           - headers (object)
@@ -123860,7 +124116,7 @@ function profileValue(name, paths) {
 function createConfigApiRouter(deps) {
   const authed = doorApiAuth(deps.expectedToken);
   const { paths } = deps;
-  const route = (path52, summary) => authed.meta(openapi({ method: "POST", path: path52, summary, tags: [CONFIG_API_TAG] }));
+  const route = (path54, summary) => authed.meta(openapi({ method: "POST", path: path54, summary, tags: [CONFIG_API_TAG] }));
   return {
     config: {
       identity: {
@@ -124215,7 +124471,7 @@ function createLifecycleApiRouter(deps) {
 init_cliError();
 
 // src/frontdoor/launchSchemas.ts
-var import_node_path43 = __toESM(require("node:path"), 1);
+var import_node_path44 = __toESM(require("node:path"), 1);
 init_zod();
 init_claudeVersion();
 init_identity();
@@ -124225,7 +124481,7 @@ var LaunchResolveInputSchema = external_exports.strictObject({
   argv: external_exports.readonly(external_exports.array(external_exports.string())).optional(),
   /** The launch's inherited environment. Absent means an empty one: the door's own environment is never a substitute for the caller's, so a caller that wants `AGENT_SHIM_*` switches or a `CLAUDE_CONFIG_DIR` considered names them here. Values are read, never reported. */
   env: external_exports.record(external_exports.string(), external_exports.string()).optional()
-}).refine((input2) => import_node_path43.default.isAbsolute(input2.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
+}).refine((input2) => import_node_path44.default.isAbsolute(input2.path), { message: "path must be absolute: the door cannot resolve a relative path against the caller's working directory" });
 var LaunchPoolDecisionSchema = external_exports.strictObject({
   name: external_exports.string(),
   reasons: external_exports.readonly(external_exports.array(external_exports.string())),
@@ -125722,8 +125978,8 @@ function createCodexRouteMount(ports, upstreamBase, provider) {
         request7.body.resume();
         return;
       }
-      const path52 = new URL(request7.url, "http://127.0.0.1").pathname;
-      const translated = { method: request7.method, path: path52, body, signal: request7.signal };
+      const path54 = new URL(request7.url, "http://127.0.0.1").pathname;
+      const translated = { method: request7.method, path: path54, body, signal: request7.signal };
       const routed = await route(translated);
       if (request7.signal.aborted) {
         return;
@@ -125757,7 +126013,7 @@ function createPassthroughRoute(name, target) {
     headroomUpstream: target.headroomUpstream,
     serve: async (request7, response) => {
       const incoming = new URL(request7.url, "http://127.0.0.1");
-      const path52 = target.stripPrefix !== void 0 && incoming.pathname.startsWith(target.stripPrefix) ? incoming.pathname.slice(target.stripPrefix.length) : incoming.pathname;
+      const path54 = target.stripPrefix !== void 0 && incoming.pathname.startsWith(target.stripPrefix) ? incoming.pathname.slice(target.stripPrefix.length) : incoming.pathname;
       const headers = forwardableHeaders(request7.headers);
       delete headers.host;
       await new Promise((resolve2) => {
@@ -125765,7 +126021,7 @@ function createPassthroughRoute(name, target) {
           host: base.hostname,
           port: base.port === "" ? void 0 : Number(base.port),
           method: request7.method,
-          path: `${basePath}${path52}${incoming.search}`,
+          path: `${basePath}${path54}${incoming.search}`,
           headers,
           agent
         };
@@ -125898,7 +126154,7 @@ async function scanRequestHead(request7, wholeBody = false) {
 
 // src/frontdoor/providerRoute.ts
 function createProviderRouteResolver(deps) {
-  const isRcSelfHostPath = (path52) => path52 === "/v1/code/sessions" || path52.startsWith("/v1/code/sessions/") || path52 === "/v1/sessions" || path52.startsWith("/v1/sessions/");
+  const isRcSelfHostPath = (path54) => path54 === "/v1/code/sessions" || path54.startsWith("/v1/code/sessions/") || path54 === "/v1/sessions" || path54.startsWith("/v1/sessions/");
   const oauthRoute = createPassthroughRoute("anthropic", { baseUrl: `https://${CONNECT_INTERCEPT_HOST}:${String(HTTPS_PORT)}`, stripPrefix: void 0, headroomUpstream: void 0 });
   const passthroughByTarget = /* @__PURE__ */ new Map();
   const passthroughFor = (name, target) => {
@@ -125912,16 +126168,16 @@ function createProviderRouteResolver(deps) {
     return route;
   };
   const resolve2 = (request7) => {
-    const path52 = new URL(request7.url, "http://127.0.0.1").pathname;
-    const scoped = parseProviderPath(path52);
+    const path54 = new URL(request7.url, "http://127.0.0.1").pathname;
+    const scoped = parseProviderPath(path54);
     if (scoped === void 0) {
-      if (deps.rcSelfHostRoute !== void 0 && isRcSelfHostPath(path52)) {
+      if (deps.rcSelfHostRoute !== void 0 && isRcSelfHostPath(path54)) {
         return { ok: true, route: deps.rcSelfHostRoute };
       }
-      if (request7.session.provider !== void 0 && path52.startsWith("/v1/") && !isRcSelfHostPath(path52)) {
+      if (request7.session.provider !== void 0 && path54.startsWith("/v1/") && !isRcSelfHostPath(path54)) {
         return resolve2({ ...request7, url: `${PROVIDER_PATH_PREFIX}${encodeURIComponent(request7.session.provider)}${request7.url}` });
       }
-      return path52.startsWith("/v1/") ? { ok: true, route: oauthRoute } : { ok: false, status: HTTP_STATUS.notFound, message: `no such endpoint: ${path52}` };
+      return path54.startsWith("/v1/") ? { ok: true, route: oauthRoute } : { ok: false, status: HTTP_STATUS.notFound, message: `no such endpoint: ${path54}` };
     }
     const { provider } = scoped;
     let definition;
@@ -125974,8 +126230,8 @@ function createProviderRouteResolver(deps) {
     let replay;
     const visited = /* @__PURE__ */ new Set();
     for (; ; ) {
-      const path52 = new URL(current.url, "http://127.0.0.1").pathname;
-      const scoped = parseProviderPath(path52);
+      const path54 = new URL(current.url, "http://127.0.0.1").pathname;
+      const scoped = parseProviderPath(path54);
       const providerName = scoped?.provider ?? current.session.provider;
       if (providerName !== void 0 && visited.has(providerName)) {
         return { ok: false, status: HTTP_STATUS.internalServerError, message: `provider routing cycle: ${[...visited, providerName].join(" -> ")}` };
@@ -126033,7 +126289,7 @@ function createProviderRouteResolver(deps) {
         const headers = Object.fromEntries(Object.entries(replay.headers).filter(([name]) => name.toLowerCase() !== "content-length"));
         replay = { ...replay, headers, body: import_node_stream3.Readable.from([Buffer.from(rewritten, "utf8")]) };
       }
-      const rest = scoped === void 0 ? path52 : path52.slice(`${PROVIDER_PATH_PREFIX}${encodeURIComponent(scoped.provider)}`.length);
+      const rest = scoped === void 0 ? path54 : path54.slice(`${PROVIDER_PATH_PREFIX}${encodeURIComponent(scoped.provider)}`.length);
       const query = current.url.includes("?") ? current.url.slice(current.url.indexOf("?")) : "";
       current = { ...current, url: `${PROVIDER_PATH_PREFIX}${encodeURIComponent(matched.provider)}${rest}${query}`, body: replay.body, headers: replay.headers };
     }
@@ -126140,7 +126396,7 @@ function createRcLiveUsage(deps) {
 }
 
 // src/frontdoor/rcSelfHostMint.ts
-var import_node_path44 = __toESM(require("node:path"), 1);
+var import_node_path45 = __toESM(require("node:path"), 1);
 init_account();
 
 // src/frontdoor/rcSelfHostLocal.ts
@@ -126270,7 +126526,7 @@ function readJsonObject(fs22, file2) {
   return isRecord7(parsed) ? parsed : void 0;
 }
 function readRcSelfHostRecord(fs22, frontdoorDir) {
-  const parsed = readJsonObject(fs22, import_node_path44.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
+  const parsed = readJsonObject(fs22, import_node_path45.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
   if (parsed === void 0) {
     return void 0;
   }
@@ -126284,11 +126540,11 @@ function mintRcSelfHostCredential(deps) {
   if (!isIdentityName(deps.identity)) {
     throw new Error(`"${deps.identity}" is not a valid identity name.`);
   }
-  const identityDir = import_node_path44.default.join(deps.identitiesDir, deps.identity);
-  const credentialsFile = import_node_path44.default.join(identityDir, CREDENTIALS_FILE2);
-  const claudeJsonFile = import_node_path44.default.join(identityDir, CLAUDE_JSON2);
-  const recordDir = import_node_path44.default.join(deps.frontdoorDir, RC_SELF_HOST_RECORD_DIR);
-  const recordFile = import_node_path44.default.join(recordDir, RC_SELF_HOST_RECORD_FILE);
+  const identityDir = import_node_path45.default.join(deps.identitiesDir, deps.identity);
+  const credentialsFile = import_node_path45.default.join(identityDir, CREDENTIALS_FILE2);
+  const claudeJsonFile = import_node_path45.default.join(identityDir, CLAUDE_JSON2);
+  const recordDir = import_node_path45.default.join(deps.frontdoorDir, RC_SELF_HOST_RECORD_DIR);
+  const recordFile = import_node_path45.default.join(recordDir, RC_SELF_HOST_RECORD_FILE);
   const previousRecord = readRcSelfHostRecord(deps.fs, deps.frontdoorDir);
   const existingCredentials = readJsonObject(deps.fs, credentialsFile);
   const existingOauth = isRecord7(existingCredentials?.claudeAiOauth) ? existingCredentials.claudeAiOauth : void 0;
@@ -126304,7 +126560,7 @@ function mintRcSelfHostCredential(deps) {
   const organizationUuid = deps.newUuid();
   const accountUuid = deps.newUuid();
   const mintedAt = new Date(deps.now()).toISOString();
-  deps.fs.mkdirPrivate(import_node_path44.default.dirname(credentialsFile));
+  deps.fs.mkdirPrivate(import_node_path45.default.dirname(credentialsFile));
   deps.fs.writeFilePrivate(credentialsFile, `${JSON.stringify({ ...existingCredentials, claudeAiOauth: { accessToken, refreshToken, expiresAt: null, scopes: [...RC_SELF_HOST_SCOPE_LIST], subscriptionType: SELF_HOST_SUBSCRIPTION_TYPE, rateLimitTier: null } }, null, 2)}
 `);
   const claudeJson = readJsonObject(deps.fs, claudeJsonFile) ?? {};
@@ -126691,7 +126947,7 @@ function registerRcCommand(frontdoor, paths) {
 }
 
 // src/frontdoor/rcCredentialStore.ts
-var import_node_path45 = __toESM(require("node:path"), 1);
+var import_node_path46 = __toESM(require("node:path"), 1);
 function isSafeSessionId(sessionId) {
   return /^[A-Za-z0-9_-]+$/.test(sessionId);
 }
@@ -126717,7 +126973,7 @@ function sequenceNumOfJson(value2) {
 }
 function createRcCredentialStore(fs22, dir) {
   fs22.mkdirPrivate(dir);
-  const fileFor = (sessionId) => import_node_path45.default.join(dir, `${sessionId}.json`);
+  const fileFor = (sessionId) => import_node_path46.default.join(dir, `${sessionId}.json`);
   const readParsed = (sessionId) => {
     const raw = fs22.readFileUtf8(fileFor(sessionId));
     if (raw === void 0) {
@@ -129020,6 +129276,26 @@ function realFrontDoorSupervisorPorts(paths) {
       keeperRunning = false;
     });
   }, ANTHROPIC_USAGE_FRESHNESS_MS).unref();
+  const jobRunner = createRealJobRunner({ paths, spawnDaemon: spawnDetachedSupervisor, fs: realFarmFs, now: () => /* @__PURE__ */ new Date() });
+  const runningJobs = /* @__PURE__ */ new Set();
+  setInterval(() => {
+    try {
+      runJobs({
+        fs: realFarmFs,
+        stampsFile: paths.usageJobsFile,
+        nowMs: () => Date.now(),
+        timeZone: machineTimeZone(),
+        jobs: () => Object.entries(readJobs(paths)).map(([name, job]) => ({ name, job })),
+        resolveIdentity: (target) => resolveJobIdentity({ paths, fs: realFarmFs, pools: readPools(paths), nowMs: Date.now(), identityExists: (name) => identityExists(paths, name) }, target),
+        snapshot: (identity) => readUsageSnapshot(realFarmFs, paths.usageSnapshotsDir, identity),
+        run: jobRunner,
+        running: runningJobs,
+        log
+      });
+    } catch (error63) {
+      log(`job keeper failed: ${error63 instanceof Error ? error63.message : String(error63)}`);
+    }
+  }, ANTHROPIC_USAGE_FRESHNESS_MS).unref();
   const usageMiddleware = createUsageMiddleware({
     record: withQuotaRefresh(usageStore.record, quotaRefresher),
     defer: (task) => {
@@ -129163,7 +129439,7 @@ function realFrontDoorSupervisorPorts(paths) {
       const leafFor = createLeafCache(loadCa(), () => /* @__PURE__ */ new Date());
       const capture = captureFromEnv(process.env, paths.logsDir);
       if (capture !== void 0) {
-        log(`capture enabled, recording CONNECT targets and piped exchanges to ${import_node_path46.default.join(paths.logsDir, "frontdoor-capture.jsonl")}`);
+        log(`capture enabled, recording CONNECT targets and piped exchanges to ${import_node_path47.default.join(paths.logsDir, "frontdoor-capture.jsonl")}`);
       }
       if (rcSelfHostSurface !== void 0) {
         log("self-hosted Remote Control surface on: the door serves the CCR session family itself, and its own client-half dials its own transparent surface");
@@ -131300,8 +131576,8 @@ function getErrorMap2() {
 
 // node_modules/.pnpm/zod@4.6.5/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path52, errorMaps, issueData } = params;
-  const fullPath = [...path52, ...issueData.path || []];
+  const { data, path: path54, errorMaps, issueData } = params;
+  const fullPath = [...path54, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -131416,11 +131692,11 @@ var errorUtil;
 
 // node_modules/.pnpm/zod@4.6.5/node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value2, path52, key) {
+  constructor(parent, value2, path54, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value2;
-    this._path = path52;
+    this._path = path54;
     this._key = key;
   }
   get path() {
@@ -134983,11 +135259,11 @@ function normalizeObjectSchema(schema) {
   }
   return void 0;
 }
-function getDotPath(path52) {
-  if (path52.length === 0) {
+function getDotPath(path54) {
+  if (path54.length === 0) {
     return "object root";
   }
-  return path52.reduce((acc, seg, index) => {
+  return path54.reduce((acc, seg, index) => {
     if (index === 0) {
       return String(seg);
     }
@@ -139030,7 +139306,7 @@ async function serveMcp(mcp, transport, options = {}) {
 
 // src/mcp/permissions.ts
 var import_node_fs17 = __toESM(require("node:fs"), 1);
-var import_node_path47 = __toESM(require("node:path"), 1);
+var import_node_path48 = __toESM(require("node:path"), 1);
 init_zod();
 init_store();
 var StoredMcpPermissionsSchema = external_exports.strictObject({
@@ -139050,10 +139326,10 @@ function effectiveMcpPermissions(flags, stored) {
   return { writes: flags.writes || stored.writes, remoteControl: flags.remoteControl || stored.remoteControl };
 }
 function watchMcpPermissions(paths, onChange) {
-  const directory = import_node_path47.default.dirname(paths.mcpPermissionsFile);
+  const directory = import_node_path48.default.dirname(paths.mcpPermissionsFile);
   import_node_fs17.default.mkdirSync(directory, { recursive: true });
   const watcher = import_node_fs17.default.watch(directory, (_event, filename) => {
-    if (filename === null || filename === import_node_path47.default.basename(paths.mcpPermissionsFile)) {
+    if (filename === null || filename === import_node_path48.default.basename(paths.mcpPermissionsFile)) {
       onChange();
     }
   });
@@ -139362,16 +139638,16 @@ init_credentialCache();
 
 // src/identityToken.ts
 var import_node_fs18 = __toESM(require("node:fs"), 1);
-var import_node_path48 = __toESM(require("node:path"), 1);
+var import_node_path49 = __toESM(require("node:path"), 1);
 init_cliError();
 var TOKEN_FILE_MODE = 384;
 var TOKEN_DIR_MODE = 448;
 var OAUTH_TOKEN_RE = /^sk-ant-oat\d+-[A-Za-z0-9_-]+$/;
 function identityTokenDir(paths) {
-  return import_node_path48.default.join(paths.root, "credentials");
+  return import_node_path49.default.join(paths.root, "credentials");
 }
 function identityTokenPath(paths, identityName) {
-  return import_node_path48.default.join(identityTokenDir(paths), `${identityName}.token`);
+  return import_node_path49.default.join(identityTokenDir(paths), `${identityName}.token`);
 }
 function storeIdentityToken(paths, identityName, raw) {
   const token = raw.trim();
@@ -139382,7 +139658,7 @@ function storeIdentityToken(paths, identityName, raw) {
   import_node_fs18.default.mkdirSync(dir, { recursive: true, mode: TOKEN_DIR_MODE });
   import_node_fs18.default.chmodSync(dir, TOKEN_DIR_MODE);
   const target = identityTokenPath(paths, identityName);
-  const temp = import_node_path48.default.join(dir, `.${identityName}.${String(process.pid)}.tmp`);
+  const temp = import_node_path49.default.join(dir, `.${identityName}.${String(process.pid)}.tmp`);
   import_node_fs18.default.writeFileSync(temp, `${token}
 `, { mode: TOKEN_FILE_MODE });
   import_node_fs18.default.renameSync(temp, target);
@@ -139550,7 +139826,7 @@ function registerDoctorCommand(program2, deps) {
 // src/headroom/commands.ts
 var import_node_fs19 = __toESM(require("node:fs"), 1);
 var import_node_http4 = __toESM(require("node:http"), 1);
-var import_node_path49 = __toESM(require("node:path"), 1);
+var import_node_path50 = __toESM(require("node:path"), 1);
 var import_node_child_process6 = require("node:child_process");
 init_commandDeps();
 init_realFrontDoorPort();
@@ -139680,12 +139956,12 @@ function readInstalledHeadroomCommit() {
   if (toolDir.status !== 0) {
     return void 0;
   }
-  const libDir = import_node_path49.default.join(toolDir.stdout.trim(), HEADROOM_TOOL_NAME, "lib");
+  const libDir = import_node_path50.default.join(toolDir.stdout.trim(), HEADROOM_TOOL_NAME, "lib");
   for (const python of realFarmFs.readdir(libDir)) {
-    const sitePackages = import_node_path49.default.join(libDir, python, "site-packages");
+    const sitePackages = import_node_path50.default.join(libDir, python, "site-packages");
     for (const entry of realFarmFs.readdir(sitePackages)) {
       if (entry.startsWith("headroom_ai-") && entry.endsWith(".dist-info")) {
-        const directUrl = realFarmFs.readFileUtf8(import_node_path49.default.join(sitePackages, entry, "direct_url.json"));
+        const directUrl = realFarmFs.readFileUtf8(import_node_path50.default.join(sitePackages, entry, "direct_url.json"));
         return directUrl === void 0 ? void 0 : parseInstalledCommit(directUrl);
       }
     }
@@ -139820,6 +140096,134 @@ function registerHeadroomCommand(program2, deps) {
   });
 }
 
+// src/jobs.ts
+var import_node_path51 = __toESM(require("node:path"), 1);
+init_commandDeps();
+init_cliError();
+init_schema();
+init_realPorts();
+function jobOf(options) {
+  if (options.identity === void 0 === (options.pool === void 0)) {
+    throw new UsageError("A job runs as one identity or one pool's pick: pass exactly one of --identity or --pool.");
+  }
+  if (options.at === void 0 === (options.beforeReset === void 0)) {
+    throw new UsageError("A job needs exactly one trigger: pass --at (repeatable) or --before-reset with --lead.");
+  }
+  if (options.beforeReset !== void 0 && options.lead === void 0) {
+    throw new UsageError("--before-reset needs --lead, how long before the window resets the job runs.");
+  }
+  if (options.at !== void 0 && options.lead !== void 0) {
+    throw new UsageError("--lead only goes with --before-reset.");
+  }
+  if (options.prompt === void 0 || options.timeout === void 0) {
+    throw new UsageError("A job needs --prompt, what to run, and --timeout, how long one run may take.");
+  }
+  return {
+    target: options.identity === void 0 ? { pool: options.pool ?? "" } : { identity: options.identity },
+    trigger: options.at === void 0 ? { beforeReset: options.beforeReset ?? "fiveHour", lead: options.lead ?? "" } : { at: options.at },
+    prompt: options.prompt,
+    cwd: import_node_path51.default.resolve(options.cwd ?? process.cwd()),
+    timeout: options.timeout,
+    ...options.model === void 0 ? {} : { model: options.model },
+    ...options.allowedTool === void 0 ? {} : { allowedTools: options.allowedTool }
+  };
+}
+function describeTrigger(job) {
+  return "at" in job.trigger ? `at ${job.trigger.at.map(formatAnchor).join(" ")}` : `${job.trigger.lead} before the ${job.trigger.beforeReset} window resets`;
+}
+function describeTarget(job) {
+  return "identity" in job.target ? `identity ${job.target.identity}` : `the pick of pool ${job.target.pool}`;
+}
+function registerJobCommand(program2, deps) {
+  const { paths } = deps;
+  const job = withExamples(
+    program2.command("job").description("Manage jobs: prompts the front door runs unattended as an identity, on a schedule or shortly before a quota window resets to use quota that would expire."),
+    ["agent-shim job add digest --identity work --before-reset sevenDay --lead 6h --prompt 'summarise open PRs' --timeout 30m", "agent-shim job list"]
+  );
+  withExamples(
+    job.command("add <name>").description("Define a job. Fails if one with this name already exists.").option("--identity <name>", "Run as this identity.").option("--pool <name>", "Run as whichever member of this pool the ranking picks when the job fires.").option("--at <spec>", `Run at these times (repeatable): ${ANCHOR_SYNTAX}.`, collectAnchor).addOption(new Option("--before-reset <window>", "Run once per instance of this quota window, when it has --lead or less left.").choices(JOB_WINDOWS)).option("--lead <duration>", "With --before-reset: how long before the window resets the job runs, a count followed by m, h, d or w, such as 6h.", parseDurationLiteral).option("--prompt <text>", "What to run.").option("--cwd <dir>", "The directory the run works in. Defaults to the current directory.").option("--timeout <duration>", "How long one run may take, such as 30m. A run that goes on longer is stopped.", parseDurationLiteral).option("--model <model>", "The model to run with. Defaults to the settings' own.").option("--allowed-tool <tool>", "A tool the run may use without asking, beyond what its settings allow (repeatable). An unattended run cannot answer a permission prompt, so any other tool is refused.", collectRepeated).option("--json", "Print the result as JSON.").action((name, options) => {
+      const defined = jobOf(options);
+      if ("identity" in defined.target) {
+        requireIdentityNames(paths, [defined.target.identity]);
+      } else {
+        requirePool(paths, defined.target.pool);
+      }
+      const created = addJob(paths, name, defined);
+      reportMutation(options.json, { action: "created", kind: "job", name, value: created }, () => {
+        console.log(`Created job "${name}": runs as ${describeTarget(created)}, ${describeTrigger(created)}.`);
+      });
+    }),
+    ["agent-shim job add digest --identity work --at mon-fri@06:00 --prompt 'summarise open PRs' --timeout 30m --cwd ~/work/app", "agent-shim job add burn --pool subs --before-reset fiveHour --lead 20m --prompt 'continue the migration plan' --timeout 20m --allowed-tool Read --allowed-tool Edit"]
+  );
+  withExamples(
+    job.command("list").description("List every job.").option("--json", "Print the jobs as JSON.").action((options) => {
+      const jobs = readJobs(paths);
+      if (options.json === true) {
+        printJson(Object.entries(jobs).map(([name, entry]) => ({ name, ...entry })));
+        return;
+      }
+      const names = Object.keys(jobs).sort();
+      if (names.length === 0) {
+        console.log("No jobs yet. Run `agent-shim job add <name> ...` to create one.");
+        return;
+      }
+      for (const name of names) {
+        const entry = jobs[name];
+        if (entry !== void 0) {
+          console.log(`${name}: ${describeTarget(entry)}, ${describeTrigger(entry)}`);
+        }
+      }
+    }),
+    ["agent-shim job list", "agent-shim job list --json"]
+  );
+  withExamples(
+    job.command("show <name>").description("Show one job.").option("--json", "Print the job as JSON.").action((name, options) => {
+      const entry = requireJob(paths, name);
+      if (options.json === true) {
+        printJson({ name, ...entry });
+        return;
+      }
+      console.log(`Job: ${name}`);
+      console.log(`Runs as: ${describeTarget(entry)}`);
+      console.log(`Trigger: ${describeTrigger(entry)}`);
+      console.log(`Directory: ${entry.cwd}`);
+      console.log(`Timeout: ${entry.timeout}`);
+      if (entry.model !== void 0) {
+        console.log(`Model: ${entry.model}`);
+      }
+      if (entry.allowedTools !== void 0) {
+        console.log(`Allowed tools: ${entry.allowedTools.join(", ")}`);
+      }
+      console.log(`Prompt: ${entry.prompt}`);
+      console.log(`Results: ${import_node_path51.default.join(paths.jobLogsDir, `${name}.log`)}`);
+    }),
+    ["agent-shim job show digest"]
+  );
+  withExamples(
+    job.command("remove <name>").description("Delete a job.").option("--yes", "Skip the confirmation prompt.").option("--json", "Print the result as JSON.").action(async (name, options) => {
+      requireJob(paths, name);
+      await confirmRemoval(deps, options.yes, `job "${name}"`);
+      removeJob(paths, name);
+      reportMutation(options.json, { action: "removed", kind: "job", name }, () => {
+        console.log(`Removed job "${name}".`);
+      });
+    }),
+    ["agent-shim job remove digest --yes"]
+  );
+  withExamples(
+    job.command("run <name>").description("Run a job now, in this terminal, as its trigger would: for a pool the member is picked at this moment. The result is appended to the job's log, and a failure exits non-zero.").action(async (name) => {
+      const entry = requireJob(paths, name);
+      const identity = resolveJobIdentity({ paths, fs: realFarmFs, pools: readPools(paths), nowMs: Date.now(), identityExists: (candidate) => identityExists(paths, candidate) }, entry.target);
+      if (identity === void 0) {
+        throw new UsageError(`No member of the job's pool can be picked right now.`);
+      }
+      await createRealJobRunner({ paths, spawnDaemon: spawnDetachedSupervisor, fs: realFarmFs, now: () => /* @__PURE__ */ new Date() })(name, identity, entry);
+      console.log(`Ran job "${name}" as ${identity}; the result is in ${import_node_path51.default.join(paths.jobLogsDir, `${name}.log`)}.`);
+    }),
+    ["agent-shim job run digest"]
+  );
+}
+
 // src/pools.ts
 init_commandDeps();
 init_cliError();
@@ -140225,7 +140629,7 @@ function registerRunCommand(program2, handler) {
 }
 
 // src/usage/commands.ts
-var import_node_path50 = __toESM(require("node:path"), 1);
+var import_node_path52 = __toESM(require("node:path"), 1);
 init_commandDeps();
 init_realPorts();
 init_account();
@@ -140363,7 +140767,7 @@ function collectAccounts(fs22, paths, identity, probe) {
   return names.map((name) => ({
     identity: name,
     account: readAccountMetadata(fs22, paths.identitiesDir, name),
-    signIn: identitySignIn(fs22, probe, { farmRoot: import_node_path50.default.join(paths.identitiesDir, name), hasCredentialBlock: readIdentity(paths, name)?.credential !== void 0 }),
+    signIn: identitySignIn(fs22, probe, { farmRoot: import_node_path52.default.join(paths.identitiesDir, name), hasCredentialBlock: readIdentity(paths, name)?.credential !== void 0 }),
     usage: readUsageSnapshot(fs22, paths.usageSnapshotsDir, name)
   }));
 }
@@ -140534,6 +140938,7 @@ function buildProgram(deps) {
   registerIdentityCommand(program2, deps);
   registerProfileCommand(program2, deps);
   registerPoolCommand(program2, deps);
+  registerJobCommand(program2, deps);
   registerProviderCommand(program2, deps);
   registerRuleCommand(program2, deps);
   registerCredentialCommand(program2, deps, deps.credentialPorts);
@@ -140708,7 +141113,7 @@ async function runClaude(argvOverride) {
 // src/cli.ts
 async function main() {
   aliasLegacyEnv(process.env);
-  const invokedName = import_node_path51.default.basename(process.argv[1] ?? "agent-shim");
+  const invokedName = import_node_path53.default.basename(process.argv[1] ?? "agent-shim");
   if (isInvokedAsClaude(invokedName)) {
     await runClaude();
     return;