claude-use 9.8.0 → 9.10.0

package/dist/cli.cjs

@@ -318,10 +318,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path50) {
-  if (!path50)
+function getElementAtPath(obj, path51) {
+  if (!path51)
     return obj;
-  return path50.reduce((acc, key) => acc?.[key], obj);
+  return path51.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -580,11 +580,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path50, issues) {
+function prefixIssues(path51, issues) {
   return issues.map((iss) => {
     var _a4;
     (_a4 = iss).path ?? (_a4.path = []);
-    iss.path.unshift(path50);
+    iss.path.unshift(path51);
     return iss;
   });
 }
@@ -1105,16 +1105,16 @@ function flattenError(error63, mapper = (issue2) => issue2.message) {
 }
 function formatError(error63, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error64, path50 = []) => {
+  const processError = (error64, path51 = []) => {
     for (const issue2 of error64.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path50, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path51, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path50, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path51, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path50, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path51, ...issue2.path]);
       } else {
-        const fullpath = [...path50, ...issue2.path];
+        const fullpath = [...path51, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -1153,17 +1153,17 @@ function formatError(error63, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error63, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error64, path50 = []) => {
+  const processError = (error64, path51 = []) => {
     var _a4;
     for (const issue2 of error64.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path50, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path51, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path50, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path51, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path50, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path51, ...issue2.path]);
       } else {
-        const fullpath = [...path50, ...issue2.path];
+        const fullpath = [...path51, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -1202,8 +1202,8 @@ function treeifyError(error63, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path50 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path50) {
+  const path51 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path51) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -19199,13 +19199,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path50 = ref.slice(1).split("/").filter(Boolean);
-  if (path50.length === 0) {
+  const path51 = ref.slice(1).split("/").filter(Boolean);
+  if (path51.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path50[0] === defsKey) {
-    const key = path50[1] === void 0 ? void 0 : decodeJSONPointerSegment(path50[1]);
+  if (path51[0] === defsKey) {
+    const key = path51[1] === void 0 ? void 0 : decodeJSONPointerSegment(path51[1]);
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -23712,42 +23712,42 @@ var require_defaults = __commonJS({
 var require_env_paths = __commonJS({
   "node_modules/.pnpm/env-paths@2.2.1/node_modules/env-paths/index.js"(exports2, module2) {
     "use strict";
-    var path50 = require("path");
+    var path51 = require("path");
     var os12 = require("os");
     var homedir = os12.homedir();
     var tmpdir = os12.tmpdir();
     var { env } = process;
     var macos = (name) => {
-      const library = path50.join(homedir, "Library");
+      const library = path51.join(homedir, "Library");
       return {
-        data: path50.join(library, "Application Support", name),
-        config: path50.join(library, "Preferences", name),
-        cache: path50.join(library, "Caches", name),
-        log: path50.join(library, "Logs", name),
-        temp: path50.join(tmpdir, name)
+        data: path51.join(library, "Application Support", name),
+        config: path51.join(library, "Preferences", name),
+        cache: path51.join(library, "Caches", name),
+        log: path51.join(library, "Logs", name),
+        temp: path51.join(tmpdir, name)
       };
     };
     var windows = (name) => {
-      const appData = env.APPDATA || path50.join(homedir, "AppData", "Roaming");
-      const localAppData = env.LOCALAPPDATA || path50.join(homedir, "AppData", "Local");
+      const appData = env.APPDATA || path51.join(homedir, "AppData", "Roaming");
+      const localAppData = env.LOCALAPPDATA || path51.join(homedir, "AppData", "Local");
       return {
         // Data/config/cache/log are invented by me as Windows isn't opinionated about this
-        data: path50.join(localAppData, name, "Data"),
-        config: path50.join(appData, name, "Config"),
-        cache: path50.join(localAppData, name, "Cache"),
-        log: path50.join(localAppData, name, "Log"),
-        temp: path50.join(tmpdir, name)
+        data: path51.join(localAppData, name, "Data"),
+        config: path51.join(appData, name, "Config"),
+        cache: path51.join(localAppData, name, "Cache"),
+        log: path51.join(localAppData, name, "Log"),
+        temp: path51.join(tmpdir, name)
       };
     };
     var linux = (name) => {
-      const username = path50.basename(homedir);
+      const username = path51.basename(homedir);
       return {
-        data: path50.join(env.XDG_DATA_HOME || path50.join(homedir, ".local", "share"), name),
-        config: path50.join(env.XDG_CONFIG_HOME || path50.join(homedir, ".config"), name),
-        cache: path50.join(env.XDG_CACHE_HOME || path50.join(homedir, ".cache"), name),
+        data: path51.join(env.XDG_DATA_HOME || path51.join(homedir, ".local", "share"), name),
+        config: path51.join(env.XDG_CONFIG_HOME || path51.join(homedir, ".config"), name),
+        cache: path51.join(env.XDG_CACHE_HOME || path51.join(homedir, ".cache"), name),
         // https://wiki.debian.org/XDGBaseDirectorySpecification#state
-        log: path50.join(env.XDG_STATE_HOME || path50.join(homedir, ".local", "state"), name),
-        temp: path50.join(tmpdir, username, name)
+        log: path51.join(env.XDG_STATE_HOME || path51.join(homedir, ".local", "state"), name),
+        temp: path51.join(tmpdir, username, name)
       };
     };
     var envPaths = (name, options) => {
@@ -23815,11 +23815,11 @@ var require_util = __commonJS({
       return result;
     }
     exports2.emplace = emplace;
-    function getPropertyByPath(source, path50) {
-      if (typeof path50 === "string" && Object.prototype.hasOwnProperty.call(source, path50)) {
-        return source[path50];
+    function getPropertyByPath(source, path51) {
+      if (typeof path51 === "string" && Object.prototype.hasOwnProperty.call(source, path51)) {
+        return source[path51];
       }
-      const parsedPath = typeof path50 === "string" ? path50.split(".") : path50;
+      const parsedPath = typeof path51 === "string" ? path51.split(".") : path51;
       return parsedPath.reduce((previous, key) => {
         if (previous === void 0) {
           return previous;
@@ -23842,9 +23842,9 @@ var require_util = __commonJS({
       return Object.fromEntries(Object.entries(options).filter(([, value2]) => value2 !== void 0));
     }
     exports2.removeUndefinedValuesFromObject = removeUndefinedValuesFromObject;
-    async function isDirectory(path50) {
+    async function isDirectory(path51) {
       try {
-        const stat = await fs_1.promises.stat(path50);
+        const stat = await fs_1.promises.stat(path51);
         return stat.isDirectory();
       } catch (e14) {
         if (e14.code === "ENOENT") {
@@ -23854,9 +23854,9 @@ var require_util = __commonJS({
       }
     }
     exports2.isDirectory = isDirectory;
-    function isDirectorySync(path50) {
+    function isDirectorySync(path51) {
       try {
-        const stat = fs_1.default.statSync(path50);
+        const stat = fs_1.default.statSync(path51);
         return stat.isDirectory();
       } catch (e14) {
         if (e14.code === "ENOENT") {
@@ -23954,7 +23954,7 @@ var require_ExplorerBase = __commonJS({
           const idx = importStack.indexOf(fullPath);
           if (idx !== -1) {
             throw new Error(`Circular import detected:
-${[...importStack, fullPath].map((path50, i10) => `${i10 + 1}. ${path50}`).join("\n")} (same as ${idx + 1}.)`);
+${[...importStack, fullPath].map((path51, i10) => `${i10 + 1}. ${path51}`).join("\n")} (same as ${idx + 1}.)`);
           }
         }
       }
@@ -24142,9 +24142,9 @@ var require_Explorer = __commonJS({
           throw error63;
         }
       }
-      async #fileExists(path50) {
+      async #fileExists(path51) {
         try {
-          await promises_1.default.stat(path50);
+          await promises_1.default.stat(path51);
           return true;
         } catch (e14) {
           return false;
@@ -24304,9 +24304,9 @@ var require_ExplorerSync = __commonJS({
           throw error63;
         }
       }
-      #fileExists(path50) {
+      #fileExists(path51) {
         try {
-          fs_1.default.statSync(path50);
+          fs_1.default.statSync(path51);
           return true;
         } catch (e14) {
           return false;
@@ -24430,7 +24430,7 @@ var require_dist = __commonJS({
       };
     }
     function getResolvedSearchPlaces(moduleName, toolDefinedSearchPlaces, userConfiguredOptions) {
-      const userConfiguredSearchPlaces = userConfiguredOptions.searchPlaces?.map((path50) => path50.replace("{name}", moduleName));
+      const userConfiguredSearchPlaces = userConfiguredOptions.searchPlaces?.map((path51) => path51.replace("{name}", moduleName));
       if (userConfiguredOptions.mergeSearchPlaces) {
         return [...userConfiguredSearchPlaces ?? [], ...toolDefinedSearchPlaces];
       }
@@ -27055,43 +27055,43 @@ function parseJson(raw, schema) {
   const parsed = schema.safeParse(JSON.parse(raw));
   return parsed.success ? parsed.data : void 0;
 }
-function readHeadroomState(fs21, stateFile) {
+function readHeadroomState(fs22, stateFile) {
   try {
-    return parseJson(fs21.readFileUtf8(stateFile), HeadroomStateSchema);
+    return parseJson(fs22.readFileUtf8(stateFile), HeadroomStateSchema);
   } catch {
     return void 0;
   }
 }
-function writeHeadroomState(fs21, stateFile, state) {
-  fs21.mkdirp(import_node_path5.default.dirname(stateFile));
-  fs21.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
+function writeHeadroomState(fs22, stateFile, state) {
+  fs22.mkdirp(import_node_path5.default.dirname(stateFile));
+  fs22.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
 `);
 }
-function resolveServingHeadroomState(fs21, files, isRunning) {
-  const current = readHeadroomState(fs21, files.stateFile);
+function resolveServingHeadroomState(fs22, files, isRunning) {
+  const current = readHeadroomState(fs22, files.stateFile);
   if (current !== void 0) {
     return { path: files.stateFile, state: current };
   }
-  const legacy = readHeadroomState(fs21, files.legacyStateFile);
+  const legacy = readHeadroomState(fs22, files.legacyStateFile);
   if (legacy?.supervisorPid !== void 0 && isRunning(legacy.supervisorPid)) {
     return { path: files.legacyStateFile, state: legacy };
   }
   return void 0;
 }
-function migrateHeadroomState(fs21, files, isRunning) {
-  const legacy = readHeadroomState(fs21, files.legacyStateFile);
+function migrateHeadroomState(fs22, files, isRunning) {
+  const legacy = readHeadroomState(fs22, files.legacyStateFile);
   const legacyLive = legacy?.supervisorPid !== void 0 && isRunning(legacy.supervisorPid);
-  const current = readHeadroomState(fs21, files.stateFile);
+  const current = readHeadroomState(fs22, files.stateFile);
   if (current !== void 0 || legacyLive) {
-    if (!legacyLive && fs21.readFileUtf8(files.legacyStateFile) !== void 0) {
-      fs21.removeRecursive(files.legacyStateFile);
+    if (!legacyLive && fs22.readFileUtf8(files.legacyStateFile) !== void 0) {
+      fs22.removeRecursive(files.legacyStateFile);
     }
     return;
   }
   if (legacy !== void 0) {
-    writeHeadroomState(fs21, files.stateFile, legacy);
+    writeHeadroomState(fs22, files.stateFile, legacy);
   }
-  fs21.removeRecursive(files.legacyStateFile);
+  fs22.removeRecursive(files.legacyStateFile);
 }
 function headroomAllowlist(providers) {
   const urls = /* @__PURE__ */ new Set([HEADROOM_ANTHROPIC_UPSTREAM]);
@@ -27110,14 +27110,14 @@ function headroomUpstreams(providers, frontDoorOrigin2) {
 function hashAllowlist(allowlist) {
   return (0, import_node_crypto2.createHash)("sha256").update(allowlist.join("\n")).digest("hex");
 }
-function readAllProviders(fs21, providersDir) {
+function readAllProviders(fs22, providersDir) {
   const result = [];
-  for (const name of fs21.readdir(providersDir)) {
+  for (const name of fs22.readdir(providersDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = parseJson(fs21.readFileUtf8(import_node_path5.default.join(providersDir, name)), ProviderSchema);
+      const parsed = parseJson(fs22.readFileUtf8(import_node_path5.default.join(providersDir, name)), ProviderSchema);
       if (parsed !== void 0) {
         result.push({ name: name.slice(0, -".json".length), provider: parsed });
       }
@@ -27127,22 +27127,22 @@ function readAllProviders(fs21, providersDir) {
   }
   return result;
 }
-function writeSession(fs21, sessionsDir, session) {
-  fs21.mkdirp(sessionsDir);
-  fs21.writeFileUtf8(import_node_path5.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
+function writeSession(fs22, sessionsDir, session) {
+  fs22.mkdirp(sessionsDir);
+  fs22.writeFileUtf8(import_node_path5.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
 `);
 }
-function removeSession(fs21, sessionsDir, pid) {
-  fs21.removeRecursive(import_node_path5.default.join(sessionsDir, `${String(pid)}.json`));
+function removeSession(fs22, sessionsDir, pid) {
+  fs22.removeRecursive(import_node_path5.default.join(sessionsDir, `${String(pid)}.json`));
 }
-function listSessions(fs21, sessionsDir) {
+function listSessions(fs22, sessionsDir) {
   const sessions = [];
-  for (const name of fs21.readdir(sessionsDir)) {
+  for (const name of fs22.readdir(sessionsDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = parseJson(fs21.readFileUtf8(import_node_path5.default.join(sessionsDir, name)), HeadroomSessionSchema);
+      const parsed = parseJson(fs22.readFileUtf8(import_node_path5.default.join(sessionsDir, name)), HeadroomSessionSchema);
       if (parsed !== void 0) {
         sessions.push(parsed);
       }
@@ -27152,22 +27152,22 @@ function listSessions(fs21, sessionsDir) {
   }
   return sessions.sort((a10, b) => a10.pid - b.pid);
 }
-function sessionsForSupervisor(fs21, sessionsDir, supervisorPid) {
-  return listSessions(fs21, sessionsDir).filter((session) => session.supervisorPid === supervisorPid);
+function sessionsForSupervisor(fs22, sessionsDir, supervisorPid) {
+  return listSessions(fs22, sessionsDir).filter((session) => session.supervisorPid === supervisorPid);
 }
-function pruneDeadSessions(fs21, sessionsDir, isRunning) {
+function pruneDeadSessions(fs22, sessionsDir, isRunning) {
   const removed = [];
-  for (const session of listSessions(fs21, sessionsDir)) {
+  for (const session of listSessions(fs22, sessionsDir)) {
     if (!isRunning(session.pid)) {
-      removeSession(fs21, sessionsDir, session.pid);
+      removeSession(fs22, sessionsDir, session.pid);
       removed.push(session.pid);
     }
   }
   return removed;
 }
-function readStartLock(fs21, lockFile) {
+function readStartLock(fs22, lockFile) {
   try {
-    return parseJson(fs21.readFileUtf8(lockFile), HeadroomLockSchema);
+    return parseJson(fs22.readFileUtf8(lockFile), HeadroomLockSchema);
   } catch {
     return void 0;
   }
@@ -27281,10 +27281,10 @@ var init_ensure = __esm({
 });
 
 // src/frontdoor/state.ts
-function readFrontDoorState(fs21, stateFile) {
+function readFrontDoorState(fs22, stateFile) {
   let raw;
   try {
-    raw = fs21.readFileUtf8(stateFile);
+    raw = fs22.readFileUtf8(stateFile);
   } catch {
     return void 0;
   }
@@ -27298,28 +27298,28 @@ function readFrontDoorState(fs21, stateFile) {
     return void 0;
   }
 }
-function writeFrontDoorState(fs21, stateFile, state) {
-  fs21.mkdirp(import_node_path6.default.dirname(stateFile));
-  fs21.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
+function writeFrontDoorState(fs22, stateFile, state) {
+  fs22.mkdirp(import_node_path6.default.dirname(stateFile));
+  fs22.writeFilePrivate(stateFile, `${JSON.stringify(state, null, 2)}
 `);
 }
 function frontDoorOrigin(state) {
   const port = state?.directPort ?? state?.lastDirectPort;
   return port === void 0 ? void 0 : `http://127.0.0.1:${String(port)}`;
 }
-function writeFrontDoorSession(fs21, sessionsDir, session) {
-  fs21.mkdirPrivate(sessionsDir);
-  fs21.writeFilePrivate(import_node_path6.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
+function writeFrontDoorSession(fs22, sessionsDir, session) {
+  fs22.mkdirPrivate(sessionsDir);
+  fs22.writeFilePrivate(import_node_path6.default.join(sessionsDir, `${String(session.pid)}.json`), `${JSON.stringify(session, null, 2)}
 `);
 }
-function listFrontDoorSessions(fs21, sessionsDir) {
+function listFrontDoorSessions(fs22, sessionsDir) {
   const sessions = [];
-  for (const name of fs21.readdir(sessionsDir)) {
+  for (const name of fs22.readdir(sessionsDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs21.readFileUtf8(import_node_path6.default.join(sessionsDir, name)) ?? ""));
+      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs22.readFileUtf8(import_node_path6.default.join(sessionsDir, name)) ?? ""));
       if (parsed.success) {
         sessions.push({ pid: parsed.data.pid, startedAt: parsed.data.startedAt });
       }
@@ -27329,27 +27329,27 @@ function listFrontDoorSessions(fs21, sessionsDir) {
   }
   return sessions.sort((a10, b) => a10.pid - b.pid);
 }
-function removeFrontDoorSession(fs21, sessionsDir, pid) {
-  fs21.removeRecursive(import_node_path6.default.join(sessionsDir, `${String(pid)}.json`));
+function removeFrontDoorSession(fs22, sessionsDir, pid) {
+  fs22.removeRecursive(import_node_path6.default.join(sessionsDir, `${String(pid)}.json`));
 }
-function pruneDeadFrontDoorSessions(fs21, sessionsDir, isRunning) {
+function pruneDeadFrontDoorSessions(fs22, sessionsDir, isRunning) {
   const removed = [];
-  for (const session of listFrontDoorSessions(fs21, sessionsDir)) {
+  for (const session of listFrontDoorSessions(fs22, sessionsDir)) {
     if (!isRunning(session.pid)) {
-      removeFrontDoorSession(fs21, sessionsDir, session.pid);
+      removeFrontDoorSession(fs22, sessionsDir, session.pid);
       removed.push(session.pid);
     }
   }
   return removed;
 }
-function liveSessionTokens(fs21, sessionsDir) {
+function liveSessionTokens(fs22, sessionsDir) {
   const tokens = /* @__PURE__ */ new Set();
-  for (const name of fs21.readdir(sessionsDir)) {
+  for (const name of fs22.readdir(sessionsDir)) {
     if (!name.endsWith(".json")) {
       continue;
     }
     try {
-      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs21.readFileUtf8(import_node_path6.default.join(sessionsDir, name)) ?? ""));
+      const parsed = FrontDoorSessionSchema.safeParse(JSON.parse(fs22.readFileUtf8(import_node_path6.default.join(sessionsDir, name)) ?? ""));
       if (parsed.success) {
         tokens.add(parsed.data.token);
       }
@@ -27470,7 +27470,7 @@ function verifyHeadroomSocket(socketPath, ports) {
   const refusal2 = ownerOnlyRefusal("socket directory", directory, ports.lstat(directory), "dir", uid) ?? ownerOnlyRefusal("socket", socketPath, ports.lstat(socketPath), "socket", uid);
   return refusal2 === void 0 ? { socketPath } : { refused: refusal2 };
 }
-function prepareHeadroomSocket(fs21, ports, paths, supervisorPid) {
+function prepareHeadroomSocket(fs22, ports, paths, supervisorPid) {
   const unsupported = platformRefusal(ports.platform);
   if (unsupported !== void 0) {
     return { refused: unsupported };
@@ -27485,18 +27485,18 @@ function prepareHeadroomSocket(fs21, ports, paths, supervisorPid) {
   if (ports.lstat(paths.headroomSocketDir)?.kind === "symlink") {
     return { refused: `the headroom socket directory ${paths.headroomSocketDir} is a symlink; it must be the real directory` };
   }
-  fs21.mkdirPrivate(paths.headroomSocketDir);
+  fs22.mkdirPrivate(paths.headroomSocketDir);
   const refusal2 = ownerOnlyRefusal("socket directory", paths.headroomSocketDir, ports.lstat(paths.headroomSocketDir), "dir", ports.currentUid());
   return refusal2 === void 0 ? { socketPath } : { refused: refusal2 };
 }
-function pruneStaleHeadroomSockets(fs21, paths, isRunning) {
+function pruneStaleHeadroomSockets(fs22, paths, isRunning) {
   const removed = [];
-  for (const name of fs21.readdir(paths.headroomSocketDir)) {
+  for (const name of fs22.readdir(paths.headroomSocketDir)) {
     const pid = HEADROOM_SOCKET_NAME.exec(name)?.[1];
     if (pid === void 0 || isRunning(Number.parseInt(pid, 10))) {
       continue;
     }
-    fs21.removeRecursive(import_node_path7.default.join(paths.headroomSocketDir, name));
+    fs22.removeRecursive(import_node_path7.default.join(paths.headroomSocketDir, name));
     removed.push(name);
   }
   return removed;
@@ -27637,29 +27637,29 @@ function compareVersions2(a10, b) {
   return 0;
 }
 async function runSupervisor(initialConfig, ports, options = {}) {
-  const { fs: fs21, paths } = ports;
+  const { fs: fs22, paths } = ports;
   let config2 = initialConfig;
-  migrateHeadroomState(fs21, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, ports.isRunning);
-  const previousState = resolveServingHeadroomState(fs21, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, ports.isRunning)?.state;
+  migrateHeadroomState(fs22, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, ports.isRunning);
+  const previousState = resolveServingHeadroomState(fs22, { stateFile: paths.headroomStateFile, legacyStateFile: paths.headroomLegacyStateFile }, ports.isRunning)?.state;
   if (previousState?.supervisorPid !== void 0 && previousState.supervisorPid !== ports.ownPid && ports.isRunning(previousState.supervisorPid)) {
     ports.log(`agent-shim headroom supervisor ${String(ports.ownPid)}: supervisor ${String(previousState.supervisorPid)} already owns the daemon; exiting`);
     return 0;
   }
   let installedSource = previousState?.installedSource;
   const ownsState = () => {
-    const owner = readHeadroomState(fs21, paths.headroomStateFile)?.supervisorPid;
+    const owner = readHeadroomState(fs22, paths.headroomStateFile)?.supervisorPid;
     return owner === void 0 || owner === ports.ownPid || !ports.isRunning(owner);
   };
   const writeOwnState = (state) => {
     if (!ownsState()) {
       return false;
     }
-    writeHeadroomState(fs21, paths.headroomStateFile, state);
+    writeHeadroomState(fs22, paths.headroomStateFile, state);
     return true;
   };
   const fail = (message) => {
     if (writeOwnState({ lastError: message })) {
-      fs21.removeRecursive(paths.headroomLockFile);
+      fs22.removeRecursive(paths.headroomLockFile);
     }
     ports.log(`agent-shim headroom supervisor: ${message}`);
     return 1;
@@ -27681,12 +27681,12 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     installedSource = config2.source;
     return true;
   };
-  const socket = prepareHeadroomSocket(fs21, ports.socketTrust, paths, ports.ownPid);
+  const socket = prepareHeadroomSocket(fs22, ports.socketTrust, paths, ports.ownPid);
   if (socket.refused !== void 0) {
     return fail(socket.refused);
   }
   const { socketPath } = socket;
-  pruneStaleHeadroomSockets(fs21, paths, ports.isRunning);
+  pruneStaleHeadroomSockets(fs22, paths, ports.isRunning);
   if (!ensureInstalled()) {
     return fail(`could not install headroom from ${config2.source}: install failed (is uv installed and on PATH?)`);
   }
@@ -27714,7 +27714,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     const settingsHash = hashSettings(config2.settings);
     const allowlist = allowlistOf(ports);
     const allowlistHash = hashAllowlist(allowlist);
-    pruneDeadSessions(fs21, paths.headroomSessionsDir, ports.isRunning);
+    pruneDeadSessions(fs22, paths.headroomSessionsDir, ports.isRunning);
     const ownsNow = ownsState();
     if (!ownsNow && !superseded) {
       ports.log("agent-shim headroom supervisor: another supervisor now owns the state file; serving this daemon's own sessions until they end");
@@ -27756,7 +27756,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
           installedSource: config2.source
         });
         if (recorded) {
-          fs21.removeRecursive(paths.headroomLockFile);
+          fs22.removeRecursive(paths.headroomLockFile);
         }
         idleSince = void 0;
         ports.log(`agent-shim headroom supervisor: headroom pid ${String(pid)} ready on unix socket ${socketPath}`);
@@ -27771,7 +27771,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
       }
     } else {
       if (runningHash !== allowlistHash || runningSettingsHash !== settingsHash || installedSource !== config2.source) {
-        if (sessionsForSupervisor(fs21, paths.headroomSessionsDir, ports.ownPid).length === 0) {
+        if (sessionsForSupervisor(fs22, paths.headroomSessionsDir, ports.ownPid).length === 0) {
           ports.log("agent-shim headroom supervisor: configuration drifted and no sessions are live; restarting headroom");
           ports.stopProcess(headroomPid);
           headroomPid = void 0;
@@ -27780,7 +27780,7 @@ async function runSupervisor(initialConfig, ports, options = {}) {
           continue;
         }
       }
-      const sessions = sessionsForSupervisor(fs21, paths.headroomSessionsDir, ports.ownPid);
+      const sessions = sessionsForSupervisor(fs22, paths.headroomSessionsDir, ports.ownPid);
       if (sessions.length === 0) {
         idleSince ??= ports.now();
         const idleMs = ports.now() - idleSince;
@@ -27799,9 +27799,9 @@ async function runSupervisor(initialConfig, ports, options = {}) {
     await ports.sleep(HEADROOM_POLL_MS);
   }
 }
-function currentHeadroomAllowlist(fs21, paths) {
-  const providers = readAllProviders(fs21, paths.providersDir).map((entry) => entry.provider);
-  return headroomAllowlist(headroomUpstreams(providers, frontDoorOrigin(readFrontDoorState(fs21, paths.frontdoorStateFile))));
+function currentHeadroomAllowlist(fs22, paths) {
+  const providers = readAllProviders(fs22, paths.providersDir).map((entry) => entry.provider);
+  return headroomAllowlist(headroomUpstreams(providers, frontDoorOrigin(readFrontDoorState(fs22, paths.frontdoorStateFile))));
 }
 function allowlistOf(ports) {
   return currentHeadroomAllowlist(ports.fs, ports.paths);
@@ -28870,8 +28870,8 @@ var require_utils = __commonJS({
       }
       return output2;
     };
-    exports2.basename = (path50, { windows } = {}) => {
-      const segs = path50.split(windows ? /[\\/]/ : "/");
+    exports2.basename = (path51, { windows } = {}) => {
+      const segs = path51.split(windows ? /[\\/]/ : "/");
       const last = segs[segs.length - 1];
       if (last === "") {
         return segs[segs.length - 2];
@@ -30543,8 +30543,8 @@ var init_classify = __esm({
 function poolNameOf(selector) {
   return selector.startsWith(POOL_SELECTOR_PREFIX) ? selector.slice(POOL_SELECTOR_PREFIX.length) : void 0;
 }
-function readActiveIdentity(fs21, activeIdentityFile) {
-  const trimmed = fs21.readFileUtf8(activeIdentityFile)?.trim();
+function readActiveIdentity(fs22, activeIdentityFile) {
+  const trimmed = fs22.readFileUtf8(activeIdentityFile)?.trim();
   return trimmed === void 0 || trimmed === "" ? void 0 : trimmed;
 }
 function isNonEmpty(value2) {
@@ -30591,8 +30591,8 @@ function decideConfigProfile(params) {
   }
   return { source: "none" };
 }
-function loadIdentity(identitiesDir, name, fs21) {
-  return loadConfigFile(import_node_path10.default.join(identitiesDir, name, "identity.json"), IdentitySchema, fs21.readConfigFile);
+function loadIdentity(identitiesDir, name, fs22) {
+  return loadConfigFile(import_node_path10.default.join(identitiesDir, name, "identity.json"), IdentitySchema, fs22.readConfigFile);
 }
 var import_node_path10, IDENTITY_DECISION_SOURCES, CONFIG_PROFILE_DECISION_SOURCES;
 var init_identity = __esm({
@@ -31996,8 +31996,8 @@ var init_pipeline = __esm({
 });
 
 // src/launcher/farm.ts
-function readFarmManifest(fs21, farmRoot) {
-  const raw = fs21.readFileUtf8(import_node_path18.default.join(farmRoot, FARM_MANIFEST_FILENAME)) ?? fs21.readFileUtf8(import_node_path18.default.join(farmRoot, LEGACY_FARM_MANIFEST_FILENAME));
+function readFarmManifest(fs22, farmRoot) {
+  const raw = fs22.readFileUtf8(import_node_path18.default.join(farmRoot, FARM_MANIFEST_FILENAME)) ?? fs22.readFileUtf8(import_node_path18.default.join(farmRoot, LEGACY_FARM_MANIFEST_FILENAME));
   if (raw === void 0) {
     return void 0;
   }
@@ -32055,9 +32055,9 @@ function buildEntryFacts(params) {
     entries
   };
 }
-function listSubtree(fs21, root, rel) {
+function listSubtree(fs22, root, rel) {
   const absolute = import_node_path18.default.join(root, rel);
-  const stat = fs21.lstat(absolute);
+  const stat = fs22.lstat(absolute);
   if (stat === void 0) {
     return [];
   }
@@ -32065,10 +32065,10 @@ function listSubtree(fs21, root, rel) {
     return [{ rel, kind: "symlink" }];
   }
   if (stat.kind === "dir") {
-    const children = [...fs21.readdir(absolute)].sort().flatMap((name) => listSubtree(fs21, root, `${rel}/${name}`));
+    const children = [...fs22.readdir(absolute)].sort().flatMap((name) => listSubtree(fs22, root, `${rel}/${name}`));
     return [{ rel, kind: "dir" }, ...children];
   }
-  const contentHash = fs21.hashFile(absolute);
+  const contentHash = fs22.hashFile(absolute);
   return [{ rel, kind: "file", ...contentHash === void 0 ? {} : { contentHash } }];
 }
 function topLevelScopeRoots(roots) {
@@ -32082,25 +32082,25 @@ function topLevelScopeRoots(roots) {
   }
   return kept;
 }
-function reconciliationScope(fs21, farmRoot, manifest) {
+function reconciliationScope(fs22, farmRoot, manifest) {
   if (manifest !== void 0) {
     return topLevelScopeRoots(manifest.materialised);
   }
-  return [...fs21.readdir(farmRoot)].filter((name) => name !== FARM_MANIFEST_FILENAME && name !== LEGACY_FARM_MANIFEST_FILENAME && fs21.lstat(import_node_path18.default.join(farmRoot, name))?.kind === "dir").sort();
+  return [...fs22.readdir(farmRoot)].filter((name) => name !== FARM_MANIFEST_FILENAME && name !== LEGACY_FARM_MANIFEST_FILENAME && fs22.lstat(import_node_path18.default.join(farmRoot, name))?.kind === "dir").sort();
 }
-function collectFarmListing(fs21, farmRoot, scopeRoots) {
-  return scopeRoots.flatMap((root) => listSubtree(fs21, farmRoot, root));
+function collectFarmListing(fs22, farmRoot, scopeRoots) {
+  return scopeRoots.flatMap((root) => listSubtree(fs22, farmRoot, root));
 }
-function collectCanonicalCounterparts(fs21, claudeHome, farmListing) {
+function collectCanonicalCounterparts(fs22, claudeHome, farmListing) {
   const out = [];
   for (const entry of farmListing) {
     const absolute = import_node_path18.default.join(claudeHome, entry.rel);
-    const stat = fs21.lstat(absolute);
+    const stat = fs22.lstat(absolute);
     if (stat === void 0) {
       continue;
     }
     if (stat.kind === "file") {
-      const contentHash = fs21.hashFile(absolute);
+      const contentHash = fs22.hashFile(absolute);
       out.push({ rel: entry.rel, kind: "file", ...contentHash === void 0 ? {} : { contentHash } });
       continue;
     }
@@ -32536,7 +32536,8 @@ function buildLayoutPaths(root) {
     usageDir: import_node_path19.default.join(root, "usage"),
     usageLogDir: import_node_path19.default.join(root, "usage", "log"),
     usageSnapshotsDir: import_node_path19.default.join(root, "usage", "snapshots"),
-    usagePicksFile: import_node_path19.default.join(root, "usage", "picks.json")
+    usagePicksFile: import_node_path19.default.join(root, "usage", "picks.json"),
+    mcpPermissionsFile: import_node_path19.default.join(root, "mcp", "permissions.json")
   };
 }
 function resolveLayoutPaths() {
@@ -33242,7 +33243,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "claude-use",
-      version: "9.8.0",
+      version: "9.10.0",
       description: "A profile manager and launcher for Claude Code that lets one person run multiple logins from one machine while controlling what gets shared between them.",
       license: "MIT",
       author: "Joseph Mearman <joseph@mearman.co.uk>",
@@ -33355,12 +33356,12 @@ function isIdentityName(name) {
 function claudeJsonPath(identitiesDir, identity) {
   return import_node_path23.default.join(identitiesDir, identity, CLAUDE_JSON);
 }
-function readAccountMetadata(fs21, identitiesDir, identity) {
+function readAccountMetadata(fs22, identitiesDir, identity) {
   if (!isIdentityName(identity)) {
     throw new Error(`"${identity}" is not a valid identity name.`);
   }
   const file2 = claudeJsonPath(identitiesDir, identity);
-  const raw = fs21.readFileUtf8(file2);
+  const raw = fs22.readFileUtf8(file2);
   if (raw === void 0) {
     return void 0;
   }
@@ -33390,19 +33391,19 @@ function readAccountMetadata(fs21, identitiesDir, identity) {
   }
   return account.data;
 }
-function createAccountReader(fs21, identitiesDir) {
+function createAccountReader(fs22, identitiesDir) {
   const cache = /* @__PURE__ */ new Map();
   return (identity) => {
     if (!isIdentityName(identity)) {
       throw new Error(`"${identity}" is not a valid identity name.`);
     }
-    const stat = fs21.lstat(claudeJsonPath(identitiesDir, identity));
+    const stat = fs22.lstat(claudeJsonPath(identitiesDir, identity));
     const stamp = stat === void 0 ? "absent" : `${String(stat.mtimeMs)}:${String(stat.sizeBytes)}`;
     const cached2 = cache.get(identity);
     if (cached2?.stamp === stamp) {
       return cached2.account;
     }
-    const account = readAccountMetadata(fs21, identitiesDir, identity);
+    const account = readAccountMetadata(fs22, identitiesDir, identity);
     cache.set(identity, { stamp, account });
     return account;
   };
@@ -33513,11 +33514,11 @@ function identifyRequest(headers) {
 function directOrigin(port) {
   return `http://127.0.0.1:${String(port)}`;
 }
-function parseProviderPath(path50) {
-  if (!path50.startsWith(PROVIDER_PATH_PREFIX)) {
+function parseProviderPath(path51) {
+  if (!path51.startsWith(PROVIDER_PATH_PREFIX)) {
     return void 0;
   }
-  const tail = path50.slice(PROVIDER_PATH_PREFIX.length);
+  const tail = path51.slice(PROVIDER_PATH_PREFIX.length);
   const slash = tail.indexOf("/");
   if (slash <= 0) {
     return void 0;
@@ -33843,9 +33844,9 @@ function decoderFor(encoding) {
       return void 0;
   }
 }
-function destinationOf(path50) {
-  const scoped = parseProviderPath(path50);
-  return scoped === void 0 ? { provider: ANTHROPIC_PROVIDER, endpoint: path50 } : { provider: scoped.provider, endpoint: scoped.rest };
+function destinationOf(path51) {
+  const scoped = parseProviderPath(path51);
+  return scoped === void 0 ? { provider: ANTHROPIC_PROVIDER, endpoint: path51 } : { provider: scoped.provider, endpoint: scoped.rest };
 }
 function buildRecord(event, context) {
   const { scan } = context;
@@ -34236,8 +34237,8 @@ function segmentDay(epochMs) {
 function segmentName(day, pid) {
   return `${day}.${String(pid)}.jsonl`;
 }
-function listLogSegments(fs21, logDir) {
-  return fs21.readdir(logDir).flatMap((name) => {
+function listLogSegments(fs22, logDir) {
+  return fs22.readdir(logDir).flatMap((name) => {
     const match = SEGMENT_RE.exec(name);
     const day = match?.[1];
     if (day === void 0) {
@@ -34246,15 +34247,15 @@ function listLogSegments(fs21, logDir) {
     return [{ name, day, endsAt: Date.parse(`${day}T00:00:00.000Z`) + DAY_MS }];
   }).sort((left, right) => left.day.localeCompare(right.day) || left.name.localeCompare(right.name));
 }
-function readUsageLog(fs21, logDir, options = {}) {
+function readUsageLog(fs22, logDir, options = {}) {
   const { sinceMs } = options;
   const records = [];
   let invalidLines = 0;
-  for (const segment of listLogSegments(fs21, logDir)) {
+  for (const segment of listLogSegments(fs22, logDir)) {
     if (sinceMs !== void 0 && segment.endsAt <= sinceMs) {
       continue;
     }
-    const contents = fs21.readFileUtf8(import_node_path24.default.join(logDir, segment.name));
+    const contents = fs22.readFileUtf8(import_node_path24.default.join(logDir, segment.name));
     if (contents === void 0) {
       continue;
     }
@@ -34290,9 +34291,9 @@ function snapshotPath(snapshotsDir, identity) {
   }
   return import_node_path24.default.join(snapshotsDir, `${identity}.json`);
 }
-function readUsageSnapshot(fs21, snapshotsDir, identity) {
+function readUsageSnapshot(fs22, snapshotsDir, identity) {
   const file2 = snapshotPath(snapshotsDir, identity);
-  const raw = fs21.readFileUtf8(file2);
+  const raw = fs22.readFileUtf8(file2);
   if (raw === void 0) {
     return void 0;
   }
@@ -34308,8 +34309,8 @@ function readUsageSnapshot(fs21, snapshotsDir, identity) {
   }
   return snapshot.data;
 }
-function listUsageSnapshots(fs21, snapshotsDir) {
-  return fs21.readdir(snapshotsDir).flatMap((name) => {
+function listUsageSnapshots(fs22, snapshotsDir) {
+  return fs22.readdir(snapshotsDir).flatMap((name) => {
     if (!name.endsWith(".json")) {
       return [];
     }
@@ -34317,7 +34318,7 @@ function listUsageSnapshots(fs21, snapshotsDir) {
     if (!isIdentityName(identity)) {
       return [];
     }
-    const snapshot = readUsageSnapshot(fs21, snapshotsDir, identity);
+    const snapshot = readUsageSnapshot(fs22, snapshotsDir, identity);
     return snapshot === void 0 ? [] : [snapshot];
   }).sort((left, right) => left.identity.localeCompare(right.identity));
 }
@@ -34391,11 +34392,11 @@ var init_read = __esm({
 });
 
 // src/usage/store.ts
-function pruneUsageLog(fs21, logDir, nowMs) {
+function pruneUsageLog(fs22, logDir, nowMs) {
   const cutoff = nowMs - USAGE_RETENTION_MS;
-  for (const segment of listLogSegments(fs21, logDir)) {
+  for (const segment of listLogSegments(fs22, logDir)) {
     if (segment.endsAt <= cutoff) {
-      fs21.removeRecursive(import_node_path25.default.join(logDir, segment.name));
+      fs22.removeRecursive(import_node_path25.default.join(logDir, segment.name));
     }
   }
 }
@@ -34424,7 +34425,7 @@ function foldProviderState(current, record2) {
   };
 }
 function createUsageStore(deps) {
-  const { fs: fs21, paths } = deps;
+  const { fs: fs22, paths } = deps;
   let prunedDay;
   const rewriteSnapshot = (identity, fold) => {
     if (!isIdentityName(identity)) {
@@ -34433,7 +34434,7 @@ function createUsageStore(deps) {
     }
     let current;
     try {
-      current = readUsageSnapshot(fs21, paths.usageSnapshotsDir, identity);
+      current = readUsageSnapshot(fs22, paths.usageSnapshotsDir, identity);
     } catch (error63) {
       if (!(error63 instanceof UsageSnapshotError)) {
         throw error63;
@@ -34460,8 +34461,8 @@ function createUsageStore(deps) {
       ...account === void 0 ? {} : { account },
       providers
     });
-    fs21.mkdirPrivate(paths.usageSnapshotsDir);
-    fs21.writeFilePrivate(snapshotPath(paths.usageSnapshotsDir, identity), `${JSON.stringify(snapshot, null, 2)}
+    fs22.mkdirPrivate(paths.usageSnapshotsDir);
+    fs22.writeFilePrivate(snapshotPath(paths.usageSnapshotsDir, identity), `${JSON.stringify(snapshot, null, 2)}
 `);
     deps.publish?.(snapshot);
     return true;
@@ -34470,14 +34471,14 @@ function createUsageStore(deps) {
     record: (input2) => {
       const record2 = UsageRecordSchema.parse(input2);
       const nowMs = deps.now();
-      fs21.mkdirPrivate(paths.usageDir);
-      fs21.mkdirPrivate(paths.usageLogDir);
+      fs22.mkdirPrivate(paths.usageDir);
+      fs22.mkdirPrivate(paths.usageLogDir);
       const day = segmentDay(nowMs);
       if (prunedDay !== day) {
-        pruneUsageLog(fs21, paths.usageLogDir, nowMs);
+        pruneUsageLog(fs22, paths.usageLogDir, nowMs);
         prunedDay = day;
       }
-      fs21.appendFilePrivate(import_node_path25.default.join(paths.usageLogDir, segmentName(day, deps.pid)), `${JSON.stringify(record2)}
+      fs22.appendFilePrivate(import_node_path25.default.join(paths.usageLogDir, segmentName(day, deps.pid)), `${JSON.stringify(record2)}
 `);
       if (record2.identity !== void 0) {
         rewriteSnapshot(record2.identity, (current) => ({ ...current?.providers, [record2.provider]: foldProviderState(current?.providers[record2.provider], record2) }));
@@ -34519,14 +34520,14 @@ var init_store2 = __esm({
 function errorMessage(error63) {
   return error63 instanceof Error ? error63.message : String(error63);
 }
-function loadPoolMembers(fs21, paths, identities, nowMs) {
+function loadPoolMembers(fs22, paths, identities, nowMs) {
   const windowStartMs = nowMs - FIVE_HOUR_WINDOW_MS;
-  const log = readUsageLog(fs21, paths.usageLogDir, { sinceMs: windowStartMs });
+  const log = readUsageLog(fs22, paths.usageLogDir, { sinceMs: windowStartMs });
   return identities.map((identity) => {
     const records = log.records.filter((record2) => record2.identity === identity && record2.provider === ANTHROPIC_PROVIDER && Date.parse(record2.at) >= windowStartMs);
     try {
-      const snapshot = readUsageSnapshot(fs21, paths.usageSnapshotsDir, identity);
-      const account = readAccountMetadata(fs21, paths.identitiesDir, identity) ?? snapshot?.account;
+      const snapshot = readUsageSnapshot(fs22, paths.usageSnapshotsDir, identity);
+      const account = readAccountMetadata(fs22, paths.identitiesDir, identity) ?? snapshot?.account;
       return { identity, records, ...snapshot === void 0 ? {} : { snapshot }, ...account === void 0 ? {} : { account } };
     } catch (error63) {
       if (error63 instanceof UsageSnapshotError || error63 instanceof AccountMetadataError) {
@@ -34597,9 +34598,9 @@ function nestedMember(input2, nestedName, childStack, sticky) {
     missing: nested.missing
   };
 }
-function readPicksFile(fs21, file2) {
+function readPicksFile(fs22, file2) {
   const empty = { schemaVersion: SCHEMA_VERSION, picks: {} };
-  const raw = fs21.readFileUtf8(file2);
+  const raw = fs22.readFileUtf8(file2);
   if (raw === void 0) {
     return { file: empty };
   }
@@ -34612,17 +34613,17 @@ function readPicksFile(fs21, file2) {
   const result = PicksFileSchema.safeParse(parsed);
   return result.success ? { file: result.data } : { file: empty, problem: `${file2} is not a picks file this agent-shim can read` };
 }
-function readStickyPick(fs21, picksFile, directory) {
-  const read = readPicksFile(fs21, picksFile);
+function readStickyPick(fs22, picksFile, directory) {
+  const read = readPicksFile(fs22, picksFile);
   const entry = read.file.picks[directory];
   return { ...entry === void 0 ? {} : { sticky: entry }, ...read.problem === void 0 ? {} : { problem: read.problem } };
 }
-function recordStickyPick(fs21, picksFile, directory, identity, nowMs) {
-  const current = readPicksFile(fs21, picksFile).file.picks;
+function recordStickyPick(fs22, picksFile, directory, identity, nowMs) {
+  const current = readPicksFile(fs22, picksFile).file.picks;
   const kept = Object.entries(current).filter(([, entry]) => nowMs - Date.parse(entry.at) <= USAGE_RETENTION_MS);
   const next = { schemaVersion: SCHEMA_VERSION, picks: { ...Object.fromEntries(kept), [directory]: { identity, at: new Date(nowMs).toISOString() } } };
-  fs21.mkdirPrivate(import_node_path26.default.dirname(picksFile));
-  fs21.writeFilePrivate(picksFile, `${JSON.stringify(next, null, 2)}
+  fs22.mkdirPrivate(import_node_path26.default.dirname(picksFile));
+  fs22.writeFilePrivate(picksFile, `${JSON.stringify(next, null, 2)}
 `);
 }
 var import_node_path26, PoolGraphError, SCHEMA_VERSION, PickEntrySchema, PicksFileSchema;
@@ -36255,14 +36256,14 @@ var require_util2 = __commonJS({
         }
         const port = url2.port != null ? url2.port : url2.protocol === "https:" ? 443 : 80;
         let origin = url2.origin != null ? url2.origin : `${url2.protocol || ""}//${url2.hostname || ""}:${port}`;
-        let path50 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`;
+        let path51 = url2.path != null ? url2.path : `${url2.pathname || ""}${url2.search || ""}`;
         if (origin[origin.length - 1] === "/") {
           origin = origin.slice(0, origin.length - 1);
         }
-        if (path50 && path50[0] !== "/") {
-          path50 = `/${path50}`;
+        if (path51 && path51[0] !== "/") {
+          path51 = `/${path51}`;
         }
-        return new URL(`${origin}${path50}`);
+        return new URL(`${origin}${path51}`);
       }
       if (!isHttpOrHttpsPrefixed(url2.origin || url2.protocol)) {
         throw new InvalidArgumentError2("Invalid URL protocol: the URL must start with `http:` or `https:`.");
@@ -37083,9 +37084,9 @@ var require_diagnostics = __commonJS({
         "undici:client:sendHeaders",
         (evt) => {
           const {
-            request: { method, path: path50, origin }
+            request: { method, path: path51, origin }
           } = evt;
-          debugLog("sending request to %s %s%s", method, origin, path50);
+          debugLog("sending request to %s %s%s", method, origin, path51);
         }
       );
     }
@@ -37103,14 +37104,14 @@ var require_diagnostics = __commonJS({
         "undici:request:headers",
         (evt) => {
           const {
-            request: { method, path: path50, origin },
+            request: { method, path: path51, origin },
             response: { statusCode }
           } = evt;
           debugLog(
             "received response to %s %s%s - HTTP %d",
             method,
             origin,
-            path50,
+            path51,
             statusCode
           );
         }
@@ -37119,23 +37120,23 @@ var require_diagnostics = __commonJS({
         "undici:request:trailers",
         (evt) => {
           const {
-            request: { method, path: path50, origin }
+            request: { method, path: path51, origin }
           } = evt;
-          debugLog("trailers received from %s %s%s", method, origin, path50);
+          debugLog("trailers received from %s %s%s", method, origin, path51);
         }
       );
       diagnosticsChannel.subscribe(
         "undici:request:error",
         (evt) => {
           const {
-            request: { method, path: path50, origin },
+            request: { method, path: path51, origin },
             error: error63
           } = evt;
           debugLog(
             "request to %s %s%s errored - %s",
             method,
             origin,
-            path50,
+            path51,
             error63.message
           );
         }
@@ -37250,7 +37251,7 @@ var require_request = __commonJS({
     var kHandler = /* @__PURE__ */ Symbol("handler");
     var Request2 = class {
       constructor(origin, {
-        path: path50,
+        path: path51,
         method,
         body,
         headers,
@@ -37267,11 +37268,11 @@ var require_request = __commonJS({
         maxRedirections,
         typeOfService
       }, handler) {
-        if (typeof path50 !== "string") {
+        if (typeof path51 !== "string") {
           throw new InvalidArgumentError2("path must be a string");
-        } else if (path50[0] !== "/" && !(path50.startsWith("http://") || path50.startsWith("https://")) && method !== "CONNECT") {
+        } else if (path51[0] !== "/" && !(path51.startsWith("http://") || path51.startsWith("https://")) && method !== "CONNECT") {
           throw new InvalidArgumentError2("path must be an absolute URL or start with a slash");
-        } else if (invalidPathRegex.test(path50)) {
+        } else if (invalidPathRegex.test(path51)) {
           throw new InvalidArgumentError2("invalid request path");
         }
         if (typeof method !== "string") {
@@ -37346,7 +37347,7 @@ var require_request = __commonJS({
         this.completed = false;
         this.aborted = false;
         this.upgrade = upgrade || null;
-        this.path = query ? serializePathWithQuery(path50, query) : path50;
+        this.path = query ? serializePathWithQuery(path51, query) : path51;
         this.origin = origin;
         this.protocol = getProtocolFromUrlString(origin);
         this.idempotent = idempotent == null ? method === "HEAD" || method === "GET" : idempotent;
@@ -42528,7 +42529,7 @@ var require_client_h1 = __commonJS({
       return method !== "GET" && method !== "HEAD" && method !== "OPTIONS" && method !== "TRACE" && method !== "CONNECT";
     }
     function writeH1(client, request7) {
-      const { method, path: path50, host, upgrade, blocking, reset } = request7;
+      const { method, path: path51, host, upgrade, blocking, reset } = request7;
       let { body, headers, contentLength } = request7;
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH" || method === "QUERY" || method === "PROPFIND" || method === "PROPPATCH";
       if (util2.isFormDataLike(body)) {
@@ -42606,7 +42607,7 @@ var require_client_h1 = __commonJS({
       if (socket.setTypeOfService) {
         socket.setTypeOfService(request7.typeOfService);
       }
-      let header = `${method} ${path50} HTTP/1.1\r
+      let header = `${method} ${path51} HTTP/1.1\r
 `;
       if (typeof host === "string") {
         header += `host: ${host}\r
@@ -43285,7 +43286,7 @@ var require_client_h2 = __commonJS({
       const headersTimeout = request7.headersTimeout ?? client[kHeadersTimeout];
       const bodyTimeout = request7.bodyTimeout ?? client[kBodyTimeout];
       const session = client[kHTTP2Session];
-      const { method, path: path50, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request7;
+      const { method, path: path51, host, upgrade, expectContinue, signal, protocol, headers: reqHeaders } = request7;
       let { body } = request7;
       if (upgrade != null && upgrade !== "websocket") {
         util2.errorRequest(client, request7, new InvalidArgumentError2(`Custom upgrade "${upgrade}" not supported over HTTP/2`));
@@ -43354,7 +43355,7 @@ var require_client_h2 = __commonJS({
           }
           headers[HTTP2_HEADER_METHOD] = "CONNECT";
           headers[HTTP2_HEADER_PROTOCOL] = "websocket";
-          headers[HTTP2_HEADER_PATH] = path50;
+          headers[HTTP2_HEADER_PATH] = path51;
           if (protocol === "ws:" || protocol === "wss:") {
             headers[HTTP2_HEADER_SCHEME] = protocol === "ws:" ? "http" : "https";
           } else {
@@ -43396,7 +43397,7 @@ var require_client_h2 = __commonJS({
         stream.setTimeout(headersTimeout);
         return true;
       }
-      headers[HTTP2_HEADER_PATH] = path50;
+      headers[HTTP2_HEADER_PATH] = path51;
       headers[HTTP2_HEADER_SCHEME] = protocol === "http:" ? "http" : "https";
       const expectsPayload = method === "PUT" || method === "POST" || method === "PATCH";
       if (body && typeof body.read === "function") {
@@ -45748,10 +45749,10 @@ var require_proxy_agent = __commonJS({
         };
         const {
           origin,
-          path: path50 = "/",
+          path: path51 = "/",
           headers = {}
         } = opts;
-        opts.path = origin + path50;
+        opts.path = origin + path51;
         if (!("host" in headers) && !("Host" in headers)) {
           const { host } = new URL(origin);
           headers.host = host;
@@ -47860,20 +47861,20 @@ var require_mock_utils = __commonJS({
       }
       return normalizedQp;
     }
-    function safeUrl(path50) {
-      if (typeof path50 !== "string") {
-        return path50;
+    function safeUrl(path51) {
+      if (typeof path51 !== "string") {
+        return path51;
       }
-      const pathSegments = path50.split("?", 3);
+      const pathSegments = path51.split("?", 3);
       if (pathSegments.length !== 2) {
-        return path50;
+        return path51;
       }
       const qp2 = new URLSearchParams(pathSegments.pop());
       qp2.sort();
       return [...pathSegments, qp2.toString()].join("?");
     }
-    function matchKey(mockDispatch2, { path: path50, method, body, headers }) {
-      const pathMatch = matchValue(mockDispatch2.path, path50);
+    function matchKey(mockDispatch2, { path: path51, method, body, headers }) {
+      const pathMatch = matchValue(mockDispatch2.path, path51);
       const methodMatch = matchValue(mockDispatch2.method, method);
       const bodyMatch = typeof mockDispatch2.body !== "undefined" ? matchValue(mockDispatch2.body, body) : true;
       const headersMatch = matchHeaders(mockDispatch2, headers);
@@ -47898,8 +47899,8 @@ var require_mock_utils = __commonJS({
       const basePath = key.query ? serializePathWithQuery(key.path, key.query) : key.path;
       const resolvedPath = typeof basePath === "string" ? safeUrl(basePath) : basePath;
       const resolvedPathWithoutTrailingSlash = removeTrailingSlash(resolvedPath);
-      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path50, ignoreTrailingSlash }) => {
-        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path50)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path50), resolvedPath);
+      let matchedMockDispatches = mockDispatches.filter(({ consumed }) => !consumed).filter(({ path: path51, ignoreTrailingSlash }) => {
+        return ignoreTrailingSlash ? matchValue(removeTrailingSlash(safeUrl(path51)), resolvedPathWithoutTrailingSlash) : matchValue(safeUrl(path51), resolvedPath);
       });
       if (matchedMockDispatches.length === 0) {
         throw new MockNotMatchedError(`Mock dispatch not matched for path '${resolvedPath}'`);
@@ -47938,19 +47939,19 @@ var require_mock_utils = __commonJS({
         mockDispatches.splice(index, 1);
       }
     }
-    function removeTrailingSlash(path50) {
-      while (path50.endsWith("/")) {
-        path50 = path50.slice(0, -1);
+    function removeTrailingSlash(path51) {
+      while (path51.endsWith("/")) {
+        path51 = path51.slice(0, -1);
       }
-      if (path50.length === 0) {
-        path50 = "/";
+      if (path51.length === 0) {
+        path51 = "/";
       }
-      return path50;
+      return path51;
     }
     function buildKey(opts) {
-      const { path: path50, method, body, headers, query } = opts;
+      const { path: path51, method, body, headers, query } = opts;
       return {
-        path: path50,
+        path: path51,
         method,
         body,
         headers,
@@ -48640,10 +48641,10 @@ var require_pending_interceptors_formatter = __commonJS({
       }
       format(pendingInterceptors) {
         const withPrettyHeaders = pendingInterceptors.map(
-          ({ method, path: path50, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
+          ({ method, path: path51, data: { statusCode }, persist, times, timesInvoked, origin }) => ({
             Method: method,
             Origin: origin,
-            Path: path50,
+            Path: path51,
             "Status code": statusCode,
             Persistent: persist ? PERSISTENT : NOT_PERSISTENT,
             Invocations: timesInvoked,
@@ -48725,9 +48726,9 @@ var require_mock_agent = __commonJS({
         const acceptNonStandardSearchParameters = this[kMockAgentAcceptsNonStandardSearchParameters];
         const dispatchOpts = { ...opts };
         if (acceptNonStandardSearchParameters && dispatchOpts.path) {
-          const [path50, searchParams] = dispatchOpts.path.split("?");
+          const [path51, searchParams] = dispatchOpts.path.split("?");
           const normalizedSearchParams = normalizeSearchParams(searchParams, acceptNonStandardSearchParameters);
-          dispatchOpts.path = `${path50}?${normalizedSearchParams}`;
+          dispatchOpts.path = `${path51}?${normalizedSearchParams}`;
         }
         return this[kAgent].dispatch(dispatchOpts, handler);
       }
@@ -49128,12 +49129,12 @@ var require_snapshot_recorder = __commonJS({
        * @return {Promise<void>} - Resolves when snapshots are loaded
        */
       async loadSnapshots(filePath) {
-        const path50 = filePath || this.#snapshotPath;
-        if (!path50) {
+        const path51 = filePath || this.#snapshotPath;
+        if (!path51) {
           throw new InvalidArgumentError2("Snapshot path is required");
         }
         try {
-          const data = await readFile(resolve2(path50), "utf8");
+          const data = await readFile(resolve2(path51), "utf8");
           const parsed = JSON.parse(data);
           if (Array.isArray(parsed)) {
             this.#snapshots.clear();
@@ -49147,7 +49148,7 @@ var require_snapshot_recorder = __commonJS({
           if (error63.code === "ENOENT") {
             this.#snapshots.clear();
           } else {
-            throw new UndiciError(`Failed to load snapshots from ${path50}`, { cause: error63 });
+            throw new UndiciError(`Failed to load snapshots from ${path51}`, { cause: error63 });
           }
         }
       }
@@ -49158,11 +49159,11 @@ var require_snapshot_recorder = __commonJS({
        * @returns {Promise<void>} - Resolves when snapshots are saved
        */
       async saveSnapshots(filePath) {
-        const path50 = filePath || this.#snapshotPath;
-        if (!path50) {
+        const path51 = filePath || this.#snapshotPath;
+        if (!path51) {
           throw new InvalidArgumentError2("Snapshot path is required");
         }
-        const resolvedPath = resolve2(path50);
+        const resolvedPath = resolve2(path51);
         await mkdir(dirname3(resolvedPath), { recursive: true });
         const data = Array.from(this.#snapshots.entries()).map(([hash2, snapshot]) => ({
           hash: hash2,
@@ -49794,15 +49795,15 @@ var require_redirect_handler = __commonJS({
           return;
         }
         const { origin, pathname, search } = util2.parseURL(new URL(this.location, this.opts.origin && new URL(this.opts.path, this.opts.origin)));
-        const path50 = search ? `${pathname}${search}` : pathname;
-        const redirectUrlString = `${origin}${path50}`;
+        const path51 = search ? `${pathname}${search}` : pathname;
+        const redirectUrlString = `${origin}${path51}`;
         for (const historyUrl of this.history) {
           if (historyUrl.toString() === redirectUrlString) {
             throw new InvalidArgumentError2(`Redirect loop detected. Cannot redirect to ${origin}. This typically happens when using a Client or Pool with cross-origin redirects. Use an Agent for cross-origin redirects.`);
           }
         }
         this.opts.headers = cleanRequestHeaders(this.opts.headers, statusCode === 303, this.opts.origin !== origin);
-        this.opts.path = path50;
+        this.opts.path = path51;
         this.opts.origin = origin;
         this.opts.query = null;
       }
@@ -51562,10 +51563,10 @@ var require_cache_handler = __commonJS({
       }
       return locationUrl.pathname + locationUrl.search;
     }
-    function deleteCachedUri(store, cacheKey, path50) {
+    function deleteCachedUri(store, cacheKey, path51) {
       deleteCachedValue(store, {
         ...cacheKey,
-        path: path50
+        path: path51
       });
       for (let i10 = 0; i10 < util2.safeHTTPMethods.length; i10++) {
         const method = util2.safeHTTPMethods[i10];
@@ -51573,7 +51574,7 @@ var require_cache_handler = __commonJS({
           deleteCachedValue(store, {
             ...cacheKey,
             method,
-            path: path50
+            path: path51
           });
         }
       }
@@ -51584,9 +51585,9 @@ var require_cache_handler = __commonJS({
       }
       const values = Array.isArray(headerValue2) ? headerValue2 : [headerValue2];
       for (let i10 = 0; i10 < values.length; i10++) {
-        const path50 = getSameOriginPath(cacheKey, values[i10]);
-        if (path50 !== void 0) {
-          deleteCachedUri(store, cacheKey, path50);
+        const path51 = getSameOriginPath(cacheKey, values[i10]);
+        if (path51 !== void 0) {
+          deleteCachedUri(store, cacheKey, path51);
         }
       }
     }
@@ -56586,11 +56587,11 @@ var require_fetch = __commonJS({
       function dispatch({ body }) {
         const url2 = requestCurrentURL(request7);
         const agent = fetchParams.controller.dispatcher;
-        const path50 = url2.pathname + url2.search;
+        const path51 = url2.pathname + url2.search;
         const hasTrailingQuestionMark = url2.search.length === 0 && url2.href[url2.href.length - url2.hash.length - 1] === "?";
         return new Promise((resolve2, reject) => agent.dispatch(
           {
-            path: hasTrailingQuestionMark ? `${path50}?` : path50,
+            path: hasTrailingQuestionMark ? `${path51}?` : path51,
             origin: url2.origin,
             method: request7.method,
             body: agent.isMockActive ? request7.body && (request7.body.source || request7.body.stream) : body,
@@ -57537,9 +57538,9 @@ var require_util5 = __commonJS({
         }
       }
     }
-    function validateCookiePath(path50) {
-      for (let i10 = 0; i10 < path50.length; ++i10) {
-        const code = path50.charCodeAt(i10);
+    function validateCookiePath(path51) {
+      for (let i10 = 0; i10 < path51.length; ++i10) {
+        const code = path51.charCodeAt(i10);
         if (code < 32 || // exclude CTLs (0-31)
         code > 126 || // exclude DEL and non-ascii
         code === 59) {
@@ -60887,11 +60888,11 @@ var require_undici = __commonJS({
           if (typeof opts.path !== "string") {
             throw new InvalidArgumentError2("invalid opts.path");
           }
-          let path50 = opts.path;
+          let path51 = opts.path;
           if (!opts.path.startsWith("/")) {
-            path50 = `/${path50}`;
+            path51 = `/${path51}`;
           }
-          url2 = new URL(util2.parseOrigin(url2).origin + path50);
+          url2 = new URL(util2.parseOrigin(url2).origin + path51);
         } else {
           if (!opts) {
             opts = typeof url2 === "object" ? url2 : {};
@@ -61172,14 +61173,14 @@ request.on("error", (error) => finish(failed, (error.code ? error.code + ": " :
 
 // src/frontdoor/trust.ts
 function resolveTrustBundle(params) {
-  const { caCertFile, bundlesDir, variable, inherited, fs: fs21 } = params;
+  const { caCertFile, bundlesDir, variable, inherited, fs: fs22 } = params;
   if (inherited === void 0 || inherited === "" || import_node_path32.default.resolve(inherited) === import_node_path32.default.resolve(caCertFile)) {
     return { path: caCertFile };
   }
-  const caPem = fs21.readFileUtf8(caCertFile);
+  const caPem = fs22.readFileUtf8(caCertFile);
   let inheritedPem;
   try {
-    inheritedPem = fs21.readFileUtf8(inherited);
+    inheritedPem = fs22.readFileUtf8(inherited);
   } catch (error63) {
     return {
       path: caCertFile,
@@ -61192,9 +61193,9 @@ function resolveTrustBundle(params) {
   const combined = `${inheritedPem.trimEnd()}
 ${caPem}`;
   const bundle = import_node_path32.default.join(bundlesDir, `${(0, import_node_crypto11.createHash)("sha256").update(combined).digest("hex").slice(0, BUNDLE_NAME_HEX_DIGITS)}.pem`);
-  if (!fs21.exists(bundle)) {
-    fs21.mkdirp(bundlesDir);
-    fs21.writeFileAtomic(bundle, combined);
+  if (!fs22.exists(bundle)) {
+    fs22.mkdirp(bundlesDir);
+    fs22.writeFileAtomic(bundle, combined);
   }
   return { path: bundle };
 }
@@ -61356,20 +61357,20 @@ function lockHolder(contents) {
   const pid = Number((contents ?? "").trim());
   return Number.isInteger(pid) && pid > 0 ? pid : void 0;
 }
-function acquireUpdateLock(fs21, isProcessAlive, pid, lockPath) {
-  const take = () => fs21.writeFileExclusive(lockPath, `${String(pid)}
+function acquireUpdateLock(fs22, isProcessAlive, pid, lockPath) {
+  const take = () => fs22.writeFileExclusive(lockPath, `${String(pid)}
 `);
   const release = () => {
-    fs21.unlink(lockPath);
+    fs22.unlink(lockPath);
   };
   if (take()) {
     return release;
   }
-  const holder = lockHolder(fs21.readFileUtf8(lockPath));
+  const holder = lockHolder(fs22.readFileUtf8(lockPath));
   if (holder !== void 0 && holder !== pid && isProcessAlive(holder)) {
     throw new UpdateConflictError(`another agent-shim update (pid ${String(holder)}) is already running`);
   }
-  fs21.unlink(lockPath);
+  fs22.unlink(lockPath);
   if (!take()) {
     throw new UpdateConflictError("another agent-shim update took the lock while it was being replaced");
   }
@@ -62250,7 +62251,7 @@ function resolveIdentityCredential(identity, credential, env, port) {
   return resolution.ok ? resolution : { ok: false, status: CREDENTIAL_UNAVAILABLE_EXIT, message: resolution.message };
 }
 function pickFromPool(decided, params, parsedArgv, readOnly) {
-  const { paths, fs: fs21, proc, log } = params;
+  const { paths, fs: fs22, proc, log } = params;
   if (decided.pool === void 0) {
     return { identityDecision: decided };
   }
@@ -62264,7 +62265,7 @@ function pickFromPool(decided, params, parsedArgv, readOnly) {
     selectedVia: decided.source,
     pools: params.pools,
     paths,
-    fs: fs21,
+    fs: fs22,
     usageFs: farmRuntime.fs,
     cwd: farmRuntime.cwd,
     now: farmRuntime.now,
@@ -62286,7 +62287,7 @@ function pickFromPool(decided, params, parsedArgv, readOnly) {
   };
 }
 function decideLaunch(params, readOnly) {
-  const { paths, fs: fs21, proc, log } = params;
+  const { paths, fs: fs22, proc, log } = params;
   const { env, argv } = proc;
   const parsedArgv = parseLauncherArgv(argv);
   const cliOverride = buildCliOverride({
@@ -62301,7 +62302,7 @@ function decideLaunch(params, readOnly) {
     argv0Identity: parsedArgv.identity,
     directoryPinnedIdentity: params.directoryPinnedIdentity,
     readActiveIdentityFile: () => {
-      const raw = fs21.readFileUtf8(paths.activeIdentityFile);
+      const raw = fs22.readFileUtf8(paths.activeIdentityFile);
       if (raw === void 0) {
         return void 0;
       }
@@ -62336,7 +62337,7 @@ function decideLaunch(params, readOnly) {
   }
   let loadedIdentity;
   if (identityDecision.name !== void 0) {
-    loadedIdentity = loadIdentity(paths.identitiesDir, identityDecision.name, fs21);
+    loadedIdentity = loadIdentity(paths.identitiesDir, identityDecision.name, fs22);
     if (loadedIdentity === void 0) {
       log.error(
         `agent-shim: no identity named "${identityDecision.name}" (selected via ${identityDecision.source}). Run \`agent-shim identity add ${identityDecision.name}\` first.`
@@ -62351,7 +62352,7 @@ function decideLaunch(params, readOnly) {
     identityDefaultConfigProfile: loadedIdentity?.config.defaultConfigProfile,
     globalDefaultConfigProfile: params.globalDefaultConfigProfile
   });
-  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs21.readConfigFile(import_node_path36.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
+  if (configProfileDecision.name !== void 0 && params.allowMissingConfigProfile !== true && fs22.readConfigFile(import_node_path36.default.join(paths.configProfilesDir, `${configProfileDecision.name}.json`)) === void 0) {
     log.error(
       `agent-shim: no configuration profile named "${configProfileDecision.name}" (selected via ${configProfileDecision.source}). Run \`agent-shim profile add ${configProfileDecision.name}\` first.`
     );
@@ -62360,7 +62361,7 @@ function decideLaunch(params, readOnly) {
   const farmContext = farm !== void 0 && farmIdentity !== void 0 ? { farm, identity: farmIdentity, cascade: farm.loadCascade(configProfileDecision.name, cliOverride) } : void 0;
   const providerParams = {
     paths,
-    port: fs21,
+    port: fs22,
     ...parsedArgv.provider === void 0 || parsedArgv.provider === false ? {} : { cliProvider: parsedArgv.provider },
     ...farmContext === void 0 ? {} : { cascade: farmContext.cascade }
   };
@@ -99847,8 +99848,8 @@ var require_utils3 = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path50) {
-      let input2 = path50;
+    function removeDotSegments(path51) {
+      let input2 = path51;
       const output2 = [];
       let nextSlash = -1;
       let len = 0;
@@ -100257,8 +100258,8 @@ var require_schemes = __commonJS({
       }
       if (wsComponent.resourceName) {
         const queryIndex = wsComponent.resourceName.indexOf("?");
-        const path50 = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
-        wsComponent.path = path50 && path50 !== "/" ? path50 : void 0;
+        const path51 = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
+        wsComponent.path = path51 && path51 !== "/" ? path51 : void 0;
         wsComponent.query = queryIndex === -1 ? void 0 : wsComponent.resourceName.slice(queryIndex + 1);
         wsComponent.resourceName = void 0;
       }
@@ -103771,12 +103772,12 @@ var require_dist2 = __commonJS({
         throw new Error(`Unknown format "${name}"`);
       return f;
     };
-    function addFormats(ajv, list, fs21, exportName) {
+    function addFormats(ajv, list, fs22, exportName) {
       var _a4;
       var _b2;
       (_a4 = (_b2 = ajv.opts.code).formats) !== null && _a4 !== void 0 ? _a4 : _b2.formats = (0, codegen_1._)`require("ajv-formats/dist/formats").${exportName}`;
       for (const f of list)
-        ajv.addFormat(f, fs21[f]);
+        ajv.addFormat(f, fs22[f]);
     }
     module2.exports = exports2 = formatsPlugin;
     Object.defineProperty(exports2, "__esModule", { value: true });
@@ -103785,7 +103786,7 @@ var require_dist2 = __commonJS({
 });
 
 // src/cli.ts
-var import_node_path49 = __toESM(require("node:path"), 1);
+var import_node_path50 = __toESM(require("node:path"), 1);
 
 // node_modules/.pnpm/commander@15.0.0/node_modules/commander/lib/error.js
 var CommanderError = class extends Error {
@@ -106898,9 +106899,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
    * @param {string} [path]
    * @return {(string|null|Command)}
    */
-  executableDir(path50) {
-    if (path50 === void 0) return this._executableDir;
-    this._executableDir = path50;
+  executableDir(path51) {
+    if (path51 === void 0) return this._executableDir;
+    this._executableDir = path51;
     return this;
   }
   /**
@@ -108549,19 +108550,19 @@ function writePools(paths, pools) {
   applyPatch(paths.globalConfigFile, GlobalConfigSchema, { pools }, { defaults: {} });
 }
 function poolCycleOf(pools, name) {
-  const walk = (current, path50) => {
+  const walk = (current, path51) => {
     for (const entry of pools[current]?.identities ?? []) {
       const nested = poolNameOf(poolMemberIdentity(entry));
       if (nested === void 0) {
         continue;
       }
       if (nested === name) {
-        return [...path50, nested];
+        return [...path51, nested];
       }
-      if (path50.includes(nested)) {
+      if (path51.includes(nested)) {
         continue;
       }
-      const found = walk(nested, [...path50, nested]);
+      const found = walk(nested, [...path51, nested]);
       if (found !== void 0) {
         return found;
       }
@@ -112181,9 +112182,9 @@ var FRONTDOOR_SUPERVISOR_STILL_RUNNING = -1;
 var FRONTDOOR_POLL_MS = 1e3;
 var MS_PER_MINUTE2 = 6e4;
 async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {}) {
-  const { fs: fs21, paths } = ports;
+  const { fs: fs22, paths } = ports;
   const servingBinary = ports.statOwnExecutable();
-  const previous = readFrontDoorState(fs21, paths.frontdoorStateFile);
+  const previous = readFrontDoorState(fs22, paths.frontdoorStateFile);
   let lastPort = previous?.lastPort;
   let lastConnectPort = previous?.lastConnectPort;
   let lastDirectPort = previous?.lastDirectPort;
@@ -112194,12 +112195,12 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
   });
   const fail = (message) => {
     ports.closeRcStreamHub();
-    writeFrontDoorState(fs21, paths.frontdoorStateFile, { lastError: message, ...sticky() });
-    fs21.removeRecursive(paths.frontdoorLockFile);
+    writeFrontDoorState(fs22, paths.frontdoorStateFile, { lastError: message, ...sticky() });
+    fs22.removeRecursive(paths.frontdoorLockFile);
     ports.log(`agent-shim frontdoor supervisor: ${message}`);
     return 1;
   };
-  writeFrontDoorState(fs21, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, ...sticky() });
+  writeFrontDoorState(fs22, paths.frontdoorStateFile, { supervisorPid: ports.ownPid, ...sticky() });
   const previousSticky = lastPort;
   let http8;
   try {
@@ -112239,9 +112240,9 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     ports.log(`agent-shim frontdoor supervisor: sticky direct port ${String(previousStickyDirect)} was occupied; moving to ${String(direct.port)} (headroom must be restarted to admit the new address)`);
   }
   lastDirectPort = direct.port;
-  writeFrontDoorState(fs21, paths.frontdoorStateFile, { protocol: FRONT_DOOR_PROTOCOL, supervisorPid: ports.ownPid, port: http8.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
+  writeFrontDoorState(fs22, paths.frontdoorStateFile, { protocol: FRONT_DOOR_PROTOCOL, supervisorPid: ports.ownPid, port: http8.port, connectPort: connect3.port, directPort: direct.port, ...sticky() });
   ports.doorHealth.generation({ providerPort: http8.port, connectPort: connect3.port, directPort: direct.port });
-  fs21.removeRecursive(paths.frontdoorLockFile);
+  fs22.removeRecursive(paths.frontdoorLockFile);
   ports.log(`agent-shim frontdoor supervisor ${String(ports.ownPid)}: front door on 127.0.0.1:${String(http8.port)}, CONNECT surface on 127.0.0.1:${String(connect3.port)}`);
   let idleSince;
   let ticks = 0;
@@ -112254,7 +112255,7 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
     await connect3.close();
     await http8.close();
     ports.closeRcStreamHub();
-    writeFrontDoorState(fs21, paths.frontdoorStateFile, sticky());
+    writeFrontDoorState(fs22, paths.frontdoorStateFile, sticky());
     return 0;
   };
   for (; ; ) {
@@ -112262,8 +112263,8 @@ async function runFrontDoorSupervisor(idleShutdownMinutes, ports, options = {})
       return FRONTDOOR_SUPERVISOR_STILL_RUNNING;
     }
     ticks += 1;
-    const listed = listFrontDoorSessions(fs21, paths.frontdoorSessionsDir);
-    const pruned = pruneDeadFrontDoorSessions(fs21, paths.frontdoorSessionsDir, ports.isRunning);
+    const listed = listFrontDoorSessions(fs22, paths.frontdoorSessionsDir);
+    const pruned = pruneDeadFrontDoorSessions(fs22, paths.frontdoorSessionsDir, ports.isRunning);
     ports.observeLaunchRegistry(listed, pruned);
     ports.checkQuotaExpiry();
     const prunedPids = new Set(pruned);
@@ -112329,8 +112330,8 @@ function parseConnectTarget(authority) {
   }
   return { host, port };
 }
-function servedByPipeline(path50) {
-  return path50?.startsWith(ROUTED_PATH_PREFIX) === true;
+function servedByPipeline(path51) {
+  return path51?.startsWith(ROUTED_PATH_PREFIX) === true;
 }
 var HOP_BY_HOP_HEADERS = /* @__PURE__ */ new Set([
   "connection",
@@ -112849,11 +112850,11 @@ function createRcSessionTracker(deps) {
   };
   const observeExchange = (request7) => {
     const method = (request7.method ?? "").toUpperCase();
-    const path50 = new URL(request7.url ?? "/", "http://127.0.0.1").pathname;
-    if (!path50.startsWith(RC_SESSIONS_PATH_PREFIX)) {
+    const path51 = new URL(request7.url ?? "/", "http://127.0.0.1").pathname;
+    if (!path51.startsWith(RC_SESSIONS_PATH_PREFIX)) {
       return void 0;
     }
-    const tail = path50.slice(RC_SESSIONS_PATH_PREFIX.length);
+    const tail = path51.slice(RC_SESSIONS_PATH_PREFIX.length);
     const facts = {
       oauthAuthorization: oauthAuthorizationOf(request7.headers),
       anthropicVersion: singleHeader(request7.headers, "anthropic-version"),
@@ -113214,8 +113215,8 @@ var RC_READ_FILE_ENCODINGS = ["utf-8", "base64"];
 function isRcReadFileEncoding(value2) {
   return RC_READ_FILE_ENCODINGS.some((encoding) => encoding === value2);
 }
-function buildRcReadFilePayload(requestId, path50, options) {
-  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path50, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
+function buildRcReadFilePayload(requestId, path51, options) {
+  return buildRcControlRequestPayload(requestId, { subtype: "read_file", path: path51, ...options?.maxBytes === void 0 ? {} : { max_bytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } });
 }
 function buildRcFileSuggestionsPayload(requestId, query) {
   return buildRcControlRequestPayload(requestId, { subtype: "file_suggestions", query });
@@ -113317,15 +113318,15 @@ async function getRcSessionContextUsage(deps, sessionId, detail) {
   const result = await deliverRcClientPayload(deps, sessionId, buildRcGetContextUsagePayload(requestId, detail), `request the context usage of session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
-async function readRcSessionFile(deps, sessionId, path50, options) {
-  if (path50 === "") {
+async function readRcSessionFile(deps, sessionId, path51, options) {
+  if (path51 === "") {
     return { ok: false, message: "a read-file write needs a non-empty path: the SDK's own field names the file the worker resolves against the session's cwd, and an empty string names none" };
   }
   if (options?.maxBytes !== void 0 && (!Number.isInteger(options.maxBytes) || options.maxBytes <= 0)) {
     return { ok: false, message: "a read-file write's max-bytes is a positive whole number of bytes: the SDK's own field caps the read, and a zero or negative cap reads nothing" };
   }
   const requestId = deps.newUuid();
-  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path50, options), `read ${path50} from session ${sessionId}`);
+  const result = await deliverRcClientPayload(deps, sessionId, buildRcReadFilePayload(requestId, path51, options), `read ${path51} from session ${sessionId}`);
   return result.ok ? { ...result, requestId } : result;
 }
 async function suggestRcSessionFiles(deps, sessionId, query) {
@@ -113496,11 +113497,11 @@ function createRcControlHandler(deps) {
       path: "read-file",
       read: (body) => {
         const session = bodyString(body, "session");
-        const path50 = bodyString(body, "path");
+        const path51 = bodyString(body, "path");
         const maxBytes = "maxBytes" in body ? bodyPositiveInteger(body, "maxBytes") : void 0;
         const encoding = "encoding" in body && isRcReadFileEncoding(body.encoding) ? body.encoding : void 0;
-        const refused2 = session === void 0 || path50 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
-        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path50, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
+        const refused2 = session === void 0 || path51 === void 0 || "maxBytes" in body && maxBytes === void 0 || "encoding" in body && encoding === void 0;
+        return refused2 ? { error: `the read-file body must be JSON naming a non-empty session id and path, maxBytes only as a positive whole number or absent, and an encoding the SDK's own type permits (${RC_READ_FILE_ENCODINGS.join(", ")}) or none` } : { session, run: async () => await deps.readFile(session, path51, { ...maxBytes === void 0 ? {} : { maxBytes }, ...encoding === void 0 ? {} : { encoding } }) };
       }
     },
     {
@@ -113810,9 +113811,9 @@ function requestIdOfBody(body) {
 }
 function frontDoorRcControl(transport, token) {
   const headers = { authorization: `Bearer ${token}` };
-  const listAnswerOf = async (path50, what) => {
+  const listAnswerOf = async (path51, what) => {
     try {
-      return await transport.request({ method: "GET", path: path50, headers });
+      return await transport.request({ method: "GET", path: path51, headers });
     } catch (error63) {
       throw new Error(`${what}: could not reach the front door's control listener: ${error63 instanceof Error ? error63.message : String(error63)}`, { cause: error63 });
     }
@@ -113884,10 +113885,10 @@ function frontDoorRcControl(transport, token) {
     }
     return pending;
   };
-  const writeOf = async (path50, body, describeFailure) => {
+  const writeOf = async (path51, body, describeFailure) => {
     let answer;
     try {
-      answer = await transport.request({ method: "POST", path: path50, headers: { ...headers, "content-type": "application/json" }, body });
+      answer = await transport.request({ method: "POST", path: path51, headers: { ...headers, "content-type": "application/json" }, body });
     } catch (error63) {
       return { ok: false, message: `could not reach the front door's control listener: ${error63 instanceof Error ? error63.message : String(error63)}` };
     }
@@ -113918,10 +113919,10 @@ function frontDoorRcControl(transport, token) {
     endSession: async (sessionId, reason) => await writeOf(`${CONTROL_PATH_PREFIX}/end-session`, JSON.stringify({ session: sessionId, ...reason === void 0 ? {} : { reason } }), (status, message) => `ending ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getUsage: async (sessionId, skipBehaviors) => await writeOf(`${CONTROL_PATH_PREFIX}/get-usage`, JSON.stringify({ session: sessionId, ...skipBehaviors === void 0 ? {} : { skipBehaviors } }), (status, message) => `requesting the usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     getContextUsage: async (sessionId, detail) => await writeOf(`${CONTROL_PATH_PREFIX}/get-context-usage`, JSON.stringify({ session: sessionId, ...detail === void 0 ? {} : { detail } }), (status, message) => `requesting the context usage of ${sessionId} failed (HTTP ${String(status)}): ${message}`),
-    readFile: async (sessionId, path50, options) => await writeOf(
+    readFile: async (sessionId, path51, options) => await writeOf(
       `${CONTROL_PATH_PREFIX}/read-file`,
-      JSON.stringify({ session: sessionId, path: path50, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
-      (status, message) => `reading ${path50} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
+      JSON.stringify({ session: sessionId, path: path51, ...options?.maxBytes === void 0 ? {} : { maxBytes: options.maxBytes }, ...options?.encoding === void 0 ? {} : { encoding: options.encoding } }),
+      (status, message) => `reading ${path51} from ${sessionId} failed (HTTP ${String(status)}): ${message}`
     ),
     fileSuggestions: async (sessionId, query) => await writeOf(`${CONTROL_PATH_PREFIX}/file-suggestions`, JSON.stringify({ session: sessionId, query }), (status, message) => `requesting file suggestions from ${sessionId} failed (HTTP ${String(status)}): ${message}`),
     keepAlive: async (sessionId) => await writeOf(`${CONTROL_PATH_PREFIX}/keep-alive`, JSON.stringify({ session: sessionId }), (status, message) => `keeping ${sessionId} alive failed (HTTP ${String(status)}): ${message}`),
@@ -114215,12 +114216,12 @@ function tlsFacts(options) {
 }
 function realRcEventDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const post = async (path50, headers, body) => await new Promise((resolve2, reject) => {
+  const post = async (path51, headers, body) => await new Promise((resolve2, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method: "POST",
-      path: path50,
+      path: path51,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, "content-length": String(Buffer.byteLength(body, "utf8")) },
       agent
@@ -114285,12 +114286,12 @@ function lateRcStreamDial(resolve2) {
 }
 function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_PORT }) {
   const agent = new ExemptTlsAgent();
-  const request7 = async (method, path50, headers, body, signal) => await new Promise((resolve2, reject) => {
+  const request7 = async (method, path51, headers, body, signal) => await new Promise((resolve2, reject) => {
     const options = {
       host: target.host,
       port: target.port,
       method,
-      path: path50,
+      path: path51,
       // The Host header names the host whose API this is, not the address dialled: a redirected test dials a loopback stand-in while still speaking to the API host by name, exactly as the forwarded paths present their SNI.
       headers: { ...headers, host: target.servername ?? target.host, ...body === void 0 ? {} : { "content-length": String(Buffer.byteLength(body, "utf8")) } },
       agent,
@@ -114332,9 +114333,9 @@ function realRcStreamDial(target = { host: CONNECT_INTERCEPT_HOST, port: HTTPS_P
       return { status, body: await readAll(response) };
     },
     openStream: async (sessionId, headers, resume, signal) => {
-      const path50 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
+      const path51 = resume === void 0 ? `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream` : `/v1/code/sessions/${encodeURIComponent(sessionId)}/events/stream?from_sequence_num=${String(resume.fromSequenceNum)}`;
       const streamHeaders = resume === void 0 ? headers : { ...headers, "last-event-id": String(resume.fromSequenceNum) };
-      const { status, response } = await request7("GET", path50, streamHeaders, void 0, signal);
+      const { status, response } = await request7("GET", path51, streamHeaders, void 0, signal);
       if (!isSuccessful2(status)) {
         await readAll(response);
         return { status, chunks: NO_CHUNKS };
@@ -114573,12 +114574,12 @@ function decideSignIn(facts) {
 function credentialsFilePath(farmRoot) {
   return import_node_path39.default.join(farmRoot, CREDENTIALS_FILE);
 }
-function identitySignIn(fs21, probe, identity) {
+function identitySignIn(fs22, probe, identity) {
   const probing = !identity.hasCredentialBlock;
   return decideSignIn({
     hasCredentialBlock: identity.hasCredentialBlock,
     keychainItem: probing && probe.platform === "darwin" && probe.run !== void 0 ? keychainHasItem(probe.run, identity.farmRoot) : void 0,
-    credentialsFile: probing && fs21.lstat(credentialsFilePath(identity.farmRoot)) !== void 0,
+    credentialsFile: probing && fs22.lstat(credentialsFilePath(identity.farmRoot)) !== void 0,
     platform: probe.platform
   });
 }
@@ -115422,11 +115423,11 @@ function tryOrUndefined(fn2) {
     return void 0;
   }
 }
-function pathToHttpPath(path50) {
-  return `/${path50.map(safeEncodeURIComponent).join("/")}`;
+function pathToHttpPath(path51) {
+  return `/${path51.map(safeEncodeURIComponent).join("/")}`;
 }
-function normalizeHttpPath(path50) {
-  const paths = path50.split("/");
+function normalizeHttpPath(path51) {
+  const paths = path51.split("/");
   if (paths.at(0) === "") {
     paths.shift();
   }
@@ -115611,9 +115612,9 @@ function isPlainObject2(value2) {
 function getOwn(object3, key) {
   return Object.hasOwn(object3, key) ? object3[key] : void 0;
 }
-function get(object3, path50) {
+function get(object3, path51) {
   let current = object3;
-  for (const key of path50) {
+  for (const key of path51) {
     if (!isTypescriptObject(current)) {
       return void 0;
     }
@@ -116836,7 +116837,7 @@ function resolveClientRest(rest) {
     // rest[1] can be undefined if all fields of FriendlyClientOptions are optional
   ];
 }
-function createORPCClient(link, { path: path50 = [], ...options } = {}) {
+function createORPCClient(link, { path: path51 = [], ...options } = {}) {
   const procedureClient = (...rest) => {
     const [input2, callOptions] = resolveClientRest(rest);
     const interceptors = [
@@ -116845,7 +116846,7 @@ function createORPCClient(link, { path: path50 = [], ...options } = {}) {
     ];
     return intercept(
       interceptors,
-      { ...callOptions, input: input2, path: path50 },
+      { ...callOptions, input: input2, path: path51 },
       ({ path: path210, input: input22, ...callOptions2 }) => link.call(path210, input22, callOptions2)
     );
   };
@@ -116859,7 +116860,7 @@ function createORPCClient(link, { path: path50 = [], ...options } = {}) {
       if (client === void 0) {
         client = createORPCClient(link, {
           ...options,
-          path: [...path50, key],
+          path: [...path51, key],
           scoped: options.scoped?.[key]
         });
         cache.set(key, client);
@@ -116881,24 +116882,24 @@ var BracketNotationSerializer = class {
     this.internalSerialize(data, "", true, result);
     return result;
   }
-  internalSerialize(data, path50, isRoot, result) {
+  internalSerialize(data, path51, isRoot, result) {
     if (Array.isArray(data)) {
       data.forEach((item, i10) => {
-        this.internalSerialize(item, isRoot ? i10.toString() : `${path50}[${i10}]`, false, result);
+        this.internalSerialize(item, isRoot ? i10.toString() : `${path51}[${i10}]`, false, result);
       });
     } else if (isPlainObject2(data)) {
       for (const key of Object.keys(data)) {
-        this.internalSerialize(data[key], isRoot ? key : `${path50}[${key}]`, false, result);
+        this.internalSerialize(data[key], isRoot ? key : `${path51}[${key}]`, false, result);
       }
     } else {
-      result.push([path50, data]);
+      result.push([path51, data]);
     }
   }
   deserialize(serialized) {
     const arrayPushStyles = /* @__PURE__ */ new WeakSet();
     const root = new NullProtoObj();
-    for (const [path50, value2] of serialized) {
-      const segments = this.parsePath(path50);
+    for (const [path51, value2] of serialized) {
+      const segments = this.parsePath(path51);
       let currentRef = root;
       let nextSegment = segments[0];
       for (let i10 = 1; i10 < segments.length; i10++) {
@@ -116949,13 +116950,13 @@ var BracketNotationSerializer = class {
     }
     return result;
   }
-  parsePath(path50) {
+  parsePath(path51) {
     const segments = [];
     let inBrackets = false;
     let currentSegment = "";
-    for (let i10 = 0; i10 < path50.length; i10++) {
-      const char = path50[i10];
-      const nextChar = path50[i10 + 1];
+    for (let i10 = 0; i10 < path51.length; i10++) {
+      const char = path51[i10];
+      const nextChar = path51[i10 + 1];
       if (inBrackets && char === "]" && (nextChar === void 0 || nextChar === "[")) {
         if (nextChar === void 0) {
           inBrackets = false;
@@ -116971,7 +116972,7 @@ var BracketNotationSerializer = class {
         currentSegment += char;
       }
     }
-    return inBrackets || segments.length === 0 ? [path50] : segments;
+    return inBrackets || segments.length === 0 ? [path51] : segments;
   }
 };
 var INTEGER_PATTERN = /^0$|^[1-9]\d*$/;
@@ -117544,11 +117545,11 @@ var OpenAPISerializer = class {
       return json2;
     }
     const form = new FormData();
-    for (const [path50, value22] of this.bracketNotation.serialize(json2)) {
+    for (const [path51, value22] of this.bracketNotation.serialize(json2)) {
       if (value22 instanceof Blob) {
-        form.append(path50, value22);
+        form.append(path51, value22);
       } else if (value22 !== void 0 && value22 !== null) {
-        form.append(path50, String(value22));
+        form.append(path51, String(value22));
       }
     }
     return form;
@@ -117586,30 +117587,30 @@ function isBodylessMethod(method) {
   return method === "GET" || method === "HEAD";
 }
 var PARAMETER_NAME_REGEX = /^[\w-]+$/;
-function getDynamicPathParams(path50) {
-  if (!path50.includes("{")) {
+function getDynamicPathParams(path51) {
+  if (!path51.includes("{")) {
     return void 0;
   }
-  const len = path50.length;
+  const len = path51.length;
   let params;
   let index = 1;
   while (index < len) {
     const segmentStart = index;
-    const slashPos = path50.indexOf("/", index);
+    const slashPos = path51.indexOf("/", index);
     const segmentEnd = slashPos === -1 ? len : slashPos;
-    if (segmentEnd > segmentStart && path50.charCodeAt(segmentStart) === 123 && path50.charCodeAt(segmentEnd - 1) === 125) {
+    if (segmentEnd > segmentStart && path51.charCodeAt(segmentStart) === 123 && path51.charCodeAt(segmentEnd - 1) === 125) {
       let parameterStart = segmentStart + 1;
       let allowsSlash = false;
-      const operator = path50.charCodeAt(parameterStart);
+      const operator = path51.charCodeAt(parameterStart);
       if (operator === 43) {
         allowsSlash = true;
         parameterStart++;
       }
-      const parameterName = path50.slice(parameterStart, segmentEnd - 1);
+      const parameterName = path51.slice(parameterStart, segmentEnd - 1);
       if (PARAMETER_NAME_REGEX.test(parameterName)) {
         params ??= [];
         params.push({
-          segment: path50.slice(segmentStart, segmentEnd),
+          segment: path51.slice(segmentStart, segmentEnd),
           startIndex: segmentStart,
           parameterName,
           allowsSlash
@@ -117652,8 +117653,8 @@ openapi.method = (method) => ({
   ...openapi({ method }),
   name: "~openapi/method"
 });
-openapi.path = (path50) => ({
-  ...openapi({ path: path50 }),
+openapi.path = (path51) => ({
+  ...openapi({ path: path51 }),
   name: "~openapi/path"
 });
 openapi.spec = (spec) => ({
@@ -118514,22 +118515,22 @@ function visitJsonSchemaRefs(value2, visit2, schemaLevel = true, seen = /* @__PU
     }
   }
 }
-function mapJsonSchemaRefs(value2, map2, schemaLevel = true, path50 = []) {
+function mapJsonSchemaRefs(value2, map2, schemaLevel = true, path51 = []) {
   if (!value2 || typeof value2 !== "object") {
     return value2;
   }
   if (Array.isArray(value2)) {
-    return value2.map((item, index) => mapJsonSchemaRefs(item, map2, schemaLevel, [...path50, index]));
+    return value2.map((item, index) => mapJsonSchemaRefs(item, map2, schemaLevel, [...path51, index]));
   }
   const result = {};
   for (const key of Object.keys(value2)) {
     const val = value2[key];
     if (key === "$ref" && typeof val === "string") {
-      setOwn(result, key, map2(val, [...path50, key]));
+      setOwn(result, key, map2(val, [...path51, key]));
     } else if (!schemaLevel) {
-      setOwn(result, key, mapJsonSchemaRefs(val, map2, true, [...path50, key]));
+      setOwn(result, key, mapJsonSchemaRefs(val, map2, true, [...path51, key]));
     } else if (JSON_SCHEMA_LOGIC_KEYWORDS.has(key) || JSON_SCHEMA_RECORD_KEYWORDS.has(key)) {
-      setOwn(result, key, mapJsonSchemaRefs(val, map2, !JSON_SCHEMA_RECORD_KEYWORDS.has(key), [...path50, key]));
+      setOwn(result, key, mapJsonSchemaRefs(val, map2, !JSON_SCHEMA_RECORD_KEYWORDS.has(key), [...path51, key]));
     } else {
       setOwn(result, key, val);
     }
@@ -119059,7 +119060,7 @@ function unlazy(maybeLazy) {
 function createProcedureClient(lazyableProcedure, ...rest) {
   const options = resolveMaybeOptionalOptions(rest);
   return async (...[input2, callerOptions]) => {
-    const path50 = toArray(options.path);
+    const path51 = toArray(options.path);
     const { default: procedure } = await unlazy(lazyableProcedure);
     const clientContext = callerOptions?.context ?? {};
     const context = await value(options.context, clientContext) ?? {};
@@ -119072,7 +119073,7 @@ function createProcedureClient(lazyableProcedure, ...rest) {
     };
     try {
       const output2 = await runWithSpan("call_procedure", (span) => {
-        span?.setAttribute("procedure.path", path50);
+        span?.setAttribute("procedure.path", path51);
         return intercept(
           options.interceptors,
           {
@@ -119080,7 +119081,7 @@ function createProcedureClient(lazyableProcedure, ...rest) {
             // input can be optional if it is undefinable
             input: input2,
             errors,
-            path: path50,
+            path: path51,
             procedure,
             signal: callerOptions?.signal,
             lastEventId: callerOptions?.lastEventId
@@ -119331,10 +119332,10 @@ function augmentRouter(router, options) {
   }
   return enhanced;
 }
-function getRouter(router, path50) {
+function getRouter(router, path51) {
   let current = router;
-  for (let i10 = 0; i10 < path50.length; i10++) {
-    const segment = path50[i10];
+  for (let i10 = 0; i10 < path51.length; i10++) {
+    const segment = path51[i10];
     if (!isTypescriptObject(current)) {
       return void 0;
     }
@@ -119346,7 +119347,7 @@ function getRouter(router, path50) {
       continue;
     }
     const lazied = current;
-    const rest = path50.slice(i10);
+    const rest = path51.slice(i10);
     return new Lazy({
       ...lazied["~orpc"],
       async loader() {
@@ -119361,40 +119362,40 @@ function getRouter(router, path50) {
   }
   return current;
 }
-function walkProcedureContractsSync(router, callback, path50 = []) {
+function walkProcedureContractsSync(router, callback, path51 = []) {
   const lazyResults = [];
-  walkProcedureContractsSyncInternal(router, callback, path50.slice(), lazyResults);
+  walkProcedureContractsSyncInternal(router, callback, path51.slice(), lazyResults);
   return lazyResults;
 }
-function walkProcedureContractsSyncInternal(router, callback, path50, lazyResults) {
+function walkProcedureContractsSyncInternal(router, callback, path51, lazyResults) {
   const hiddenContract = getHiddenRouterContract(router);
   if (hiddenContract !== void 0) {
     router = hiddenContract;
   }
   if (router instanceof ProcedureContract) {
-    callback(router, path50.slice());
+    callback(router, path51.slice());
     return;
   }
   if (!isTypescriptObject(router)) {
     return;
   }
   for (const [key, value2] of Object.entries(router)) {
-    path50.push(key);
+    path51.push(key);
     if (value2 instanceof Lazy) {
-      lazyResults.push({ router: value2, path: path50.slice() });
+      lazyResults.push({ router: value2, path: path51.slice() });
     } else {
-      walkProcedureContractsSyncInternal(value2, callback, path50, lazyResults);
+      walkProcedureContractsSyncInternal(value2, callback, path51, lazyResults);
     }
-    path50.pop();
+    path51.pop();
   }
 }
-async function walkProcedureContractsAsync(router, callback, path50 = []) {
+async function walkProcedureContractsAsync(router, callback, path51 = []) {
   const hiddenContract = getHiddenRouterContract(router);
   if (hiddenContract !== void 0) {
     router = hiddenContract;
   }
   if (router instanceof ProcedureContract) {
-    await callback(router, path50);
+    await callback(router, path51);
     return;
   }
   if (!isTypescriptObject(router)) {
@@ -119403,9 +119404,9 @@ async function walkProcedureContractsAsync(router, callback, path50 = []) {
   for (const [key, value2] of Object.entries(router)) {
     if (value2 instanceof Lazy) {
       const { default: router2 } = await unlazy(value2);
-      await walkProcedureContractsAsync(router2, callback, [...path50, key]);
+      await walkProcedureContractsAsync(router2, callback, [...path51, key]);
     } else {
-      await walkProcedureContractsAsync(value2, callback, [...path50, key]);
+      await walkProcedureContractsAsync(value2, callback, [...path51, key]);
     }
   }
 }
@@ -119891,18 +119892,18 @@ function rewriteComponentSchemaRefs(schema, renameMap) {
 }
 var OpenAPIGeneratorError = class extends TypeError {
 };
-function toOpenAPIPath(path50, dynamicPathParams) {
+function toOpenAPIPath(path51, dynamicPathParams) {
   if (!dynamicPathParams?.length) {
-    return path50;
+    return path51;
   }
   let normalized = "";
   let currentIndex = 0;
   for (const param of dynamicPathParams) {
-    normalized += path50.slice(currentIndex, param.startIndex);
+    normalized += path51.slice(currentIndex, param.startIndex);
     normalized += `{${param.parameterName}}`;
     currentIndex = param.startIndex + param.segment.length;
   }
-  normalized += path50.slice(currentIndex);
+  normalized += path51.slice(currentIndex);
   return normalized;
 }
 function buildRequest(ctx, operation, def, meta3, dynamicPathParams) {
@@ -120336,8 +120337,8 @@ var OpenAPIGenerator = class {
       customErrorResponseBodySchema: options.customErrorResponseBodySchema
     };
     const errors = [];
-    await walkProcedureContractsAsync(router, (contract, path50) => {
-      if (value(options.filter, contract, path50) === false) {
+    await walkProcedureContractsAsync(router, (contract, path51) => {
+      if (value(options.filter, contract, path51) === false) {
         return;
       }
       try {
@@ -120349,7 +120350,7 @@ var OpenAPIGenerator = class {
             `QUERY operations require OpenAPI 3.2, but version "${version2}" was requested.`
           );
         }
-        const postPath = meta3?.path ?? pathToHttpPath(path50);
+        const postPath = meta3?.path ?? pathToHttpPath(path51);
         const httpPath = meta3?.prefix ? mergeHttpPath(meta3.prefix, postPath) : postPath;
         const dynamicPathParams = getDynamicPathParams(httpPath);
         const openApiPath = toOpenAPIPath(httpPath, dynamicPathParams);
@@ -120358,7 +120359,7 @@ var OpenAPIGenerator = class {
           operation = meta3.spec;
         } else {
           operation = {
-            operationId: meta3?.operationId ?? path50.join("."),
+            operationId: meta3?.operationId ?? path51.join("."),
             summary: meta3?.summary,
             description: meta3?.description,
             deprecated: meta3?.deprecated,
@@ -120378,7 +120379,7 @@ var OpenAPIGenerator = class {
         if (!(e14 instanceof OpenAPIGeneratorError)) {
           throw e14;
         }
-        errors.push(`Procedure at ${path50.join(".") || "(root)"}: ${e14.message}`);
+        errors.push(`Procedure at ${path51.join(".") || "(root)"}: ${e14.message}`);
       }
     });
     if (errors.length) {
@@ -121147,16 +121148,16 @@ var StandardLink = class {
   /**
    * @throws ORPCError, transport-level errors (network failures, timeouts, etc.)
    */
-  call(path50, input2, options) {
-    return runWithSpan(`${ORPC_NAME}.${path50.join("/")}`, (span) => {
+  call(path51, input2, options) {
+    return runWithSpan(`${ORPC_NAME}.${path51.join("/")}`, (span) => {
       span?.setAttribute("rpc.system", ORPC_NAME);
-      span?.setAttribute("rpc.method", path50.join("."));
+      span?.setAttribute("rpc.method", path51.join("."));
       if (getTracer() && isAsyncIteratorObject(input2)) {
         input2 = override(input2, traceAsyncIterator("consume_async_iterator_object_input", input2));
       } else if (getTracer() && input2 instanceof ReadableStream) {
         input2 = override(input2, traceReadableStream("consume_octet_stream_input", input2));
       }
-      return intercept(this.interceptors, { ...options, path: path50, input: input2 }, async ({ path: path210, input: input22, ...options2 }) => {
+      return intercept(this.interceptors, { ...options, path: path51, input: input2 }, async ({ path: path210, input: input22, ...options2 }) => {
         const tracer = getTracer();
         const activeSpan = tracer?.getActiveSpan() ?? span;
         let request7 = await runWithSpan(
@@ -121213,18 +121214,18 @@ var RPCLinkCodec = class {
     this.headers = options.headers ?? {};
     this.serializer = options.serializer ?? new RPCSerializer();
   }
-  async encodeInput(input2, path50, options) {
-    let headers = toResolvedStandardHeaders(await value(this.headers, options, path50, input2));
+  async encodeInput(input2, path51, options) {
+    let headers = toResolvedStandardHeaders(await value(this.headers, options, path51, input2));
     if (options.lastEventId !== void 0) {
       headers = mergeStandardHeaders(headers, { "last-event-id": options.lastEventId });
     }
-    const expectedMethod = await value(this.expectedMethod, options, path50, input2);
-    const baseUrl = await value(this.baseUrl, options, path50, input2);
+    const expectedMethod = await value(this.expectedMethod, options, path51, input2);
+    const baseUrl = await value(this.baseUrl, options, path51, input2);
     const [pathname, search, hash2] = parseStandardUrl(baseUrl);
-    const newPathname = `${pathname.replace(END_SLASH_REGEX, "")}${pathToHttpPath(path50)}`;
+    const newPathname = `${pathname.replace(END_SLASH_REGEX, "")}${pathToHttpPath(path51)}`;
     const serialized = this.serializer.serialize(input2);
     if (expectedMethod === "GET" && !(serialized instanceof Blob) && !(serialized instanceof ReadableStream) && !(serialized instanceof FormData) && !isAsyncIteratorObject(serialized)) {
-      const maxUrlLength = await value(this.maxUrlLength, options, path50, input2);
+      const maxUrlLength = await value(this.maxUrlLength, options, path51, input2);
       const mergedSearch = new URLSearchParams(search);
       mergedSearch.append("data", stringifyJSON(serialized) ?? "");
       const url22 = `${newPathname}?${mergedSearch}${hash2 ?? ""}`;
@@ -121309,8 +121310,8 @@ var FetchLinkTransport = class {
     this.fetch = options.fetch ?? ((url2, init) => globalThis.fetch(url2, init));
     this.toFetchRequestOptions = options.toFetchRequest;
   }
-  async send(standardRequest, path50, options) {
-    let origin = await value(this.origin, options, path50);
+  async send(standardRequest, path51, options) {
+    let origin = await value(this.origin, options, path51);
     if (origin?.endsWith("/")) {
       origin = origin.slice(0, -1);
     }
@@ -121330,7 +121331,7 @@ var FetchLinkTransport = class {
       }
     }
     const fetch3 = this.fetch;
-    const response = await fetch3(url2, init, options, path50);
+    const response = await fetch3(url2, init, options, path51);
     const standardResponse = toStandardLazyResponse(response);
     return standardResponse;
   }
@@ -121721,14 +121722,14 @@ var StandardHandler = class {
           span?.setAttribute("url.path", request22.url);
           return { matched: false };
         }
-        const { path: path50, procedure, decodeInput } = matchedOrNot;
-        span?.updateName(`${ORPC_NAME}.${path50.join("/")}`);
+        const { path: path51, procedure, decodeInput } = matchedOrNot;
+        span?.updateName(`${ORPC_NAME}.${path51.join("/")}`);
         span?.setAttribute("rpc.system", ORPC_NAME);
-        span?.setAttribute("rpc.method", path50.join("."));
+        span?.setAttribute("rpc.method", path51.join("."));
         try {
           const response = await intercept(
             this.interceptors,
-            { context: context2, prefix: prefix2, request: request22, path: path50, procedure, decodeInput },
+            { context: context2, prefix: prefix2, request: request22, path: path51, procedure, decodeInput },
             async ({ context: context3, prefix: prefix3, request: request32, path: path210, procedure: procedure2, decodeInput: decodeInput2 }) => {
               step2 = "decode_input";
               let input2 = await runWithSpan("decode_input", decodeInput2);
@@ -121762,7 +121763,7 @@ var StandardHandler = class {
             message: `Malformed request. Ensure the request body is properly formatted and the 'Content-Type' header is set correctly.`,
             cause: e14
           }) : toORPCError(e14);
-          const response = await this.codec.encodeError(error63, procedure, path50, { context: context2, prefix: prefix2 });
+          const response = await this.codec.encodeError(error63, procedure, path51, { context: context2, prefix: prefix2 });
           return { matched: true, response };
         }
       }
@@ -121868,7 +121869,7 @@ var RPCMatcher = class {
     this.rootRouter = router;
     this.index(router);
   }
-  index(router, path50 = []) {
+  index(router, path51 = []) {
     const lazyResults = walkProcedureContractsSync(router, (procedure, procedurePath) => {
       if (!value(this.filter, procedure, procedurePath)) {
         return;
@@ -121879,7 +121880,7 @@ var RPCMatcher = class {
         // contract-first entries have no implementation yet, resolveProcedure fills it in on demand
         procedure: procedure instanceof Procedure ? procedure : void 0
       });
-    }, path50);
+    }, path51);
     for (const result of lazyResults) {
       this.pendingLazyRouters.set(pathToHttpPath(result.path), result);
     }
@@ -122011,10 +122012,10 @@ var RPCHandlerCodec = class {
       }
     };
   }
-  encodeOutput(output2, procedure, path50, options) {
+  encodeOutput(output2, procedure, path51, options) {
     return {
       headers: {},
-      status: value(this.outputStatus, output2, procedure, path50, options) ?? DEFAULT_SUCCESS_STATUS,
+      status: value(this.outputStatus, output2, procedure, path51, options) ?? DEFAULT_SUCCESS_STATUS,
       body: this.serializer.serialize(output2)
     };
   }
@@ -122068,39 +122069,39 @@ function createRouter() {
     static: new NullProtoObj2()
   };
 }
-function scanFirstGroup(path50) {
+function scanFirstGroup(path51) {
   let i10 = 0;
   let depth = 0;
-  for (; i10 < path50.length; i10++) {
-    const c10 = path50.charCodeAt(i10);
+  for (; i10 < path51.length; i10++) {
+    const c10 = path51.charCodeAt(i10);
     if (c10 === 92) i10++;
     else if (c10 === 40) depth++;
     else if (c10 === 41 && depth > 0) depth--;
     else if (c10 === 123 && depth === 0) break;
   }
-  if (i10 >= path50.length) return;
+  if (i10 >= path51.length) return;
   let j10 = i10 + 1;
   depth = 0;
-  for (; j10 < path50.length; j10++) {
-    const c10 = path50.charCodeAt(j10);
+  for (; j10 < path51.length; j10++) {
+    const c10 = path51.charCodeAt(j10);
     if (c10 === 92) j10++;
     else if (c10 === 40) depth++;
     else if (c10 === 41 && depth > 0) depth--;
     else if (c10 === 125 && depth === 0) break;
   }
-  if (j10 >= path50.length) return;
-  const mod = path50[j10 + 1];
+  if (j10 >= path51.length) return;
+  const mod = path51[j10 + 1];
   const hasMod = mod === "?" || mod === "+" || mod === "*";
   return [
-    path50.slice(0, i10),
-    path50.slice(i10 + 1, j10),
-    path50.slice(j10 + (hasMod ? 2 : 1)),
+    path51.slice(0, i10),
+    path51.slice(i10 + 1, j10),
+    path51.slice(j10 + (hasMod ? 2 : 1)),
     hasMod ? mod : void 0
   ];
 }
-function expandGroupDelimiters(path50) {
-  if (!path50.includes("{")) return;
-  const group = scanFirstGroup(path50);
+function expandGroupDelimiters(path51) {
+  if (!path51.includes("{")) return;
+  const group = scanFirstGroup(path51);
   if (!group) return;
   const [pre2, body, suf, mod] = group;
   if (!mod) return [pre2 + body + suf];
@@ -122170,9 +122171,9 @@ function replaceSegmentWildcards(segment, unnamedStart, toGroupKey = toUnnamedGr
   }
   return [replaced, nextIndex];
 }
-function encodeEscapes(path50) {
-  if (!path50.includes("\\")) return path50;
-  return path50.replace(/\\([:(){}])/g, (_, c10) => "\uFFFD" + "ABCDE"[":(){}".indexOf(c10)]);
+function encodeEscapes(path51) {
+  if (!path51.includes("\\")) return path51;
+  return path51.replace(/\\([:(){}])/g, (_, c10) => "\uFFFD" + "ABCDE"[":(){}".indexOf(c10)]);
 }
 function segmentKey(segment) {
   if (segment.startsWith("**")) return 2;
@@ -122201,22 +122202,22 @@ function expandModifiers(segments) {
     return m10[2] === "+" ? [wc2] : [wc2, without];
   }
 }
-function normalizePath(path50) {
-  if (!path50.includes("/.")) return path50;
+function normalizePath(path51) {
+  if (!path51.includes("/.")) return path51;
   const r10 = [];
-  for (const s of path50.split("/")) if (s === ".") continue;
+  for (const s of path51.split("/")) if (s === ".") continue;
   else if (s === ".." && r10.length > 1) r10.pop();
   else r10.push(s);
   return r10.join("/") || "/";
 }
-function splitPath(path50) {
-  const s = path50.split("/");
+function splitPath(path51) {
+  const s = path51.split("/");
   s.shift();
   if (s[s.length - 1] === "") s.pop();
   return s;
 }
-function splitRoute(path50) {
-  const s = splitPath(path50);
+function splitRoute(path51) {
+  const s = splitPath(path51);
   while (s[s.length - 1] === "") s.pop();
   return s;
 }
@@ -122232,16 +122233,16 @@ function getMatchParams(segments, paramsMap) {
   }
   return params;
 }
-function addRoute(ctx, method = "", path50, data) {
+function addRoute(ctx, method = "", path51, data) {
   method = method.toUpperCase();
-  if (path50.charCodeAt(0) !== 47) path50 = `/${path50}`;
-  const groupExpanded = expandGroupDelimiters(path50);
+  if (path51.charCodeAt(0) !== 47) path51 = `/${path51}`;
+  const groupExpanded = expandGroupDelimiters(path51);
   if (groupExpanded) {
     for (const expandedPath of groupExpanded) addRoute(ctx, method, expandedPath, data);
     return;
   }
-  path50 = encodeEscapes(path50);
-  const segments = splitRoute(path50);
+  path51 = encodeEscapes(path51);
+  const segments = splitRoute(path51);
   const expanded = expandModifiers(segments);
   if (expanded) {
     for (const p of expanded) addRoute(ctx, method, p, data);
@@ -122332,15 +122333,15 @@ function getParamRegexp(segment, unnamedStart = 0) {
   const regex = _s2.replace(/:([\w-]+)(?:\(([^)]*)\))?/g, (_, id2, p) => `(?<${toGroupName(id2)}>${p || "[^/]+"})`).replace(/\((?![?<])/g, () => `(?<${toUnnamedGroupKey(_i2++)}>`).replace(/\uFFFE(.)/g, (_, c10) => /[.*+?^${}()|[\]\\]/.test(c10) ? `\\${c10}` : c10);
   return [new RegExp(`^${regex}$`), _i2];
 }
-function findRoute(ctx, method = "", path50, opts) {
-  if (opts?.normalize) path50 = normalizePath(path50);
-  if (path50.charCodeAt(path50.length - 1) === 47) path50 = path50.slice(0, -1);
-  const staticNode = ctx.static[path50];
+function findRoute(ctx, method = "", path51, opts) {
+  if (opts?.normalize) path51 = normalizePath(path51);
+  if (path51.charCodeAt(path51.length - 1) === 47) path51 = path51.slice(0, -1);
+  const staticNode = ctx.static[path51];
   if (staticNode && staticNode.methods) {
     const staticMatch = staticNode.methods[method] || staticNode.methods[""];
     if (staticMatch !== void 0) return staticMatch[0];
   }
-  const segments = splitPath(path50);
+  const segments = splitPath(path51);
   const match = _lookupTree(ctx.root, method, segments, 0);
   if (match === void 0) return;
   if (opts?.params === false) return match;
@@ -122540,7 +122541,7 @@ var OpenAPIMatcher = class {
     this.rootRouter = router;
     this.index(router);
   }
-  index(router, path50 = []) {
+  index(router, path51 = []) {
     const lazyResults = walkProcedureContractsSync(router, (contract, path210) => {
       if (!value(this.filter, contract, path210)) {
         return;
@@ -122555,7 +122556,7 @@ var OpenAPIMatcher = class {
         contract,
         procedure: contract instanceof Procedure ? contract : void 0
       });
-    }, path50);
+    }, path51);
     for (const result of lazyResults) {
       const prefix = getOpenAPIMeta(result.router)?.prefix;
       this.pendingLazyRouters.add({
@@ -122642,20 +122643,20 @@ var OpenAPIMatcher = class {
     return entry.procedure;
   }
 };
-function toRou3Pattern(path50) {
-  const params = getDynamicPathParams(path50);
+function toRou3Pattern(path51) {
+  const params = getDynamicPathParams(path51);
   if (!params?.length) {
-    return path50;
+    return path51;
   }
   for (let i10 = params.length - 1; i10 >= 0; i10--) {
     const param = params[i10];
     const pattern = param.allowsSlash ? `**:${param.parameterName}` : `:${param.parameterName}`;
-    path50 = path50.slice(0, param.startIndex) + pattern + path50.slice(param.startIndex + param.segment.length);
+    path51 = path51.slice(0, param.startIndex) + pattern + path51.slice(param.startIndex + param.segment.length);
   }
-  return path50;
+  return path51;
 }
-function toRou3PrefixMatcher(path50) {
-  const pattern = toRou3Pattern(path50);
+function toRou3PrefixMatcher(path51) {
+  const pattern = toRou3Pattern(path51);
   return routeToRegExp(pattern === "/" ? "/**" : `${pattern}/**`);
 }
 function decodeParams(params) {
@@ -122734,7 +122735,7 @@ var OpenAPIHandlerCodecCore = class {
   /**
    * @throws {TypeError} If `outputStructure` is "detailed" and the output doesn't match the expected structure.
    */
-  encodeOutput(output2, procedure, path50) {
+  encodeOutput(output2, procedure, path51) {
     const meta3 = getOpenAPIMeta(procedure);
     const successStatus = meta3?.successStatus ?? DEFAULT_SUCCESS_STATUS;
     const outputStructure = meta3?.outputStructure ?? DEFAULT_OPENAPI_OUTPUT_STRUCTURE;
@@ -122747,7 +122748,7 @@ var OpenAPIHandlerCodecCore = class {
     }
     if (!isValidDetailedOutput(output2)) {
       throw new TypeError(`
-        Invalid "detailed" output structure returned by procedure (${path50.join(".")}):
+        Invalid "detailed" output structure returned by procedure (${path51.join(".")}):
         \u2022 Expected an object with optional properties:
           - status (number <400)
           - headers (object)
@@ -123295,7 +123296,7 @@ function profileValue(name, paths) {
 function createConfigApiRouter(deps) {
   const authed = doorApiAuth(deps.expectedToken);
   const { paths } = deps;
-  const route = (path50, summary) => authed.meta(openapi({ method: "POST", path: path50, summary, tags: [CONFIG_API_TAG] }));
+  const route = (path51, summary) => authed.meta(openapi({ method: "POST", path: path51, summary, tags: [CONFIG_API_TAG] }));
   return {
     config: {
       identity: {
@@ -125145,8 +125146,8 @@ function createCodexRouteMount(ports, upstreamBase, provider) {
         request7.body.resume();
         return;
       }
-      const path50 = new URL(request7.url, "http://127.0.0.1").pathname;
-      const translated = { method: request7.method, path: path50, body, signal: request7.signal };
+      const path51 = new URL(request7.url, "http://127.0.0.1").pathname;
+      const translated = { method: request7.method, path: path51, body, signal: request7.signal };
       const routed = await route(translated);
       if (request7.signal.aborted) {
         return;
@@ -125180,7 +125181,7 @@ function createPassthroughRoute(name, target) {
     headroomUpstream: target.headroomUpstream,
     serve: async (request7, response) => {
       const incoming = new URL(request7.url, "http://127.0.0.1");
-      const path50 = target.stripPrefix !== void 0 && incoming.pathname.startsWith(target.stripPrefix) ? incoming.pathname.slice(target.stripPrefix.length) : incoming.pathname;
+      const path51 = target.stripPrefix !== void 0 && incoming.pathname.startsWith(target.stripPrefix) ? incoming.pathname.slice(target.stripPrefix.length) : incoming.pathname;
       const headers = forwardableHeaders(request7.headers);
       delete headers.host;
       await new Promise((resolve2) => {
@@ -125188,7 +125189,7 @@ function createPassthroughRoute(name, target) {
           host: base.hostname,
           port: base.port === "" ? void 0 : Number(base.port),
           method: request7.method,
-          path: `${basePath}${path50}${incoming.search}`,
+          path: `${basePath}${path51}${incoming.search}`,
           headers,
           agent
         };
@@ -125321,7 +125322,7 @@ async function scanRequestHead(request7, wholeBody = false) {
 
 // src/frontdoor/providerRoute.ts
 function createProviderRouteResolver(deps) {
-  const isRcSelfHostPath = (path50) => path50 === "/v1/code/sessions" || path50.startsWith("/v1/code/sessions/") || path50 === "/v1/sessions" || path50.startsWith("/v1/sessions/");
+  const isRcSelfHostPath = (path51) => path51 === "/v1/code/sessions" || path51.startsWith("/v1/code/sessions/") || path51 === "/v1/sessions" || path51.startsWith("/v1/sessions/");
   const oauthRoute = createPassthroughRoute("anthropic", { baseUrl: `https://${CONNECT_INTERCEPT_HOST}:${String(HTTPS_PORT)}`, stripPrefix: void 0, headroomUpstream: void 0 });
   const passthroughByTarget = /* @__PURE__ */ new Map();
   const passthroughFor = (name, target) => {
@@ -125335,16 +125336,16 @@ function createProviderRouteResolver(deps) {
     return route;
   };
   const resolve2 = (request7) => {
-    const path50 = new URL(request7.url, "http://127.0.0.1").pathname;
-    const scoped = parseProviderPath(path50);
+    const path51 = new URL(request7.url, "http://127.0.0.1").pathname;
+    const scoped = parseProviderPath(path51);
     if (scoped === void 0) {
-      if (deps.rcSelfHostRoute !== void 0 && isRcSelfHostPath(path50)) {
+      if (deps.rcSelfHostRoute !== void 0 && isRcSelfHostPath(path51)) {
         return { ok: true, route: deps.rcSelfHostRoute };
       }
-      if (request7.session.provider !== void 0 && path50.startsWith("/v1/") && !isRcSelfHostPath(path50)) {
+      if (request7.session.provider !== void 0 && path51.startsWith("/v1/") && !isRcSelfHostPath(path51)) {
         return resolve2({ ...request7, url: `${PROVIDER_PATH_PREFIX}${encodeURIComponent(request7.session.provider)}${request7.url}` });
       }
-      return path50.startsWith("/v1/") ? { ok: true, route: oauthRoute } : { ok: false, status: HTTP_STATUS.notFound, message: `no such endpoint: ${path50}` };
+      return path51.startsWith("/v1/") ? { ok: true, route: oauthRoute } : { ok: false, status: HTTP_STATUS.notFound, message: `no such endpoint: ${path51}` };
     }
     const { provider } = scoped;
     let definition;
@@ -125397,8 +125398,8 @@ function createProviderRouteResolver(deps) {
     let replay;
     const visited = /* @__PURE__ */ new Set();
     for (; ; ) {
-      const path50 = new URL(current.url, "http://127.0.0.1").pathname;
-      const scoped = parseProviderPath(path50);
+      const path51 = new URL(current.url, "http://127.0.0.1").pathname;
+      const scoped = parseProviderPath(path51);
       const providerName = scoped?.provider ?? current.session.provider;
       if (providerName !== void 0 && visited.has(providerName)) {
         return { ok: false, status: HTTP_STATUS.internalServerError, message: `provider routing cycle: ${[...visited, providerName].join(" -> ")}` };
@@ -125456,7 +125457,7 @@ function createProviderRouteResolver(deps) {
         const headers = Object.fromEntries(Object.entries(replay.headers).filter(([name]) => name.toLowerCase() !== "content-length"));
         replay = { ...replay, headers, body: import_node_stream3.Readable.from([Buffer.from(rewritten, "utf8")]) };
       }
-      const rest = scoped === void 0 ? path50 : path50.slice(`${PROVIDER_PATH_PREFIX}${encodeURIComponent(scoped.provider)}`.length);
+      const rest = scoped === void 0 ? path51 : path51.slice(`${PROVIDER_PATH_PREFIX}${encodeURIComponent(scoped.provider)}`.length);
       const query = current.url.includes("?") ? current.url.slice(current.url.indexOf("?")) : "";
       current = { ...current, url: `${PROVIDER_PATH_PREFIX}${encodeURIComponent(matched.provider)}${rest}${query}`, body: replay.body, headers: replay.headers };
     }
@@ -125679,8 +125680,8 @@ var SELF_HOST_SUBSCRIPTION_TYPE = "max";
 function isRecord7(value2) {
   return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
 }
-function readJsonObject(fs21, file2) {
-  const raw = fs21.readFileUtf8(file2);
+function readJsonObject(fs22, file2) {
+  const raw = fs22.readFileUtf8(file2);
   if (raw === void 0) {
     return void 0;
   }
@@ -125692,8 +125693,8 @@ function readJsonObject(fs21, file2) {
   }
   return isRecord7(parsed) ? parsed : void 0;
 }
-function readRcSelfHostRecord(fs21, frontdoorDir) {
-  const parsed = readJsonObject(fs21, import_node_path43.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
+function readRcSelfHostRecord(fs22, frontdoorDir) {
+  const parsed = readJsonObject(fs22, import_node_path43.default.join(frontdoorDir, RC_SELF_HOST_RECORD_DIR, RC_SELF_HOST_RECORD_FILE));
   if (parsed === void 0) {
     return void 0;
   }
@@ -126138,11 +126139,11 @@ function credentialOfJson(parsed) {
 function sequenceNumOfJson(value2) {
   return typeof value2 === "number" && Number.isInteger(value2) && value2 >= 0 ? value2 : void 0;
 }
-function createRcCredentialStore(fs21, dir) {
-  fs21.mkdirPrivate(dir);
+function createRcCredentialStore(fs22, dir) {
+  fs22.mkdirPrivate(dir);
   const fileFor = (sessionId) => import_node_path44.default.join(dir, `${sessionId}.json`);
   const readParsed = (sessionId) => {
-    const raw = fs21.readFileUtf8(fileFor(sessionId));
+    const raw = fs22.readFileUtf8(fileFor(sessionId));
     if (raw === void 0) {
       return void 0;
     }
@@ -126167,7 +126168,7 @@ function createRcCredentialStore(fs21, dir) {
       }
       const cursor3 = sequenceNumOfJson(readParsed(sessionId)?.highestSequenceNum);
       const record2 = { ...credential, ...cursor3 === void 0 ? {} : { highestSequenceNum: cursor3 } };
-      fs21.writeFilePrivate(fileFor(sessionId), `${JSON.stringify(record2, null, 2)}
+      fs22.writeFilePrivate(fileFor(sessionId), `${JSON.stringify(record2, null, 2)}
 `);
     },
     readCursor: (sessionId) => {
@@ -126182,14 +126183,14 @@ function createRcCredentialStore(fs21, dir) {
       }
       const credential = credentialOfJson(readParsed(sessionId));
       const record2 = credential === void 0 ? { highestSequenceNum } : { ...credential, highestSequenceNum };
-      fs21.writeFilePrivate(fileFor(sessionId), `${JSON.stringify(record2, null, 2)}
+      fs22.writeFilePrivate(fileFor(sessionId), `${JSON.stringify(record2, null, 2)}
 `);
     },
     remove: (sessionId) => {
       if (!isSafeSessionId(sessionId)) {
         return;
       }
-      fs21.removeRecursive(fileFor(sessionId));
+      fs22.removeRecursive(fileFor(sessionId));
     }
   };
 }
@@ -130322,6 +130323,7 @@ var StdioServerTransport = class {
 };
 
 // src/mcp/command.ts
+init_cliError();
 init_commandDeps();
 init_package();
 init_realPorts();
@@ -130700,8 +130702,8 @@ function getErrorMap2() {
 
 // node_modules/.pnpm/zod@4.6.5/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data, path: path50, errorMaps, issueData } = params;
-  const fullPath = [...path50, ...issueData.path || []];
+  const { data, path: path51, errorMaps, issueData } = params;
+  const fullPath = [...path51, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -130816,11 +130818,11 @@ var errorUtil;
 
 // node_modules/.pnpm/zod@4.6.5/node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value2, path50, key) {
+  constructor(parent, value2, path51, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value2;
-    this._path = path50;
+    this._path = path51;
     this._key = key;
   }
   get path() {
@@ -134383,11 +134385,11 @@ function normalizeObjectSchema(schema) {
   }
   return void 0;
 }
-function getDotPath(path50) {
-  if (path50.length === 0) {
+function getDotPath(path51) {
+  if (path51.length === 0) {
     return "object root";
   }
-  return path50.reduce((acc, seg, index) => {
+  return path51.reduce((acc, seg, index) => {
     if (index === 0) {
       return String(seg);
     }
@@ -138384,7 +138386,7 @@ function failureText(error63) {
   return error63 instanceof Error ? error63.message : String(error63);
 }
 function createMcpServer(identity, ports) {
-  const mcp = new McpServer(identity, { capabilities: { tools: {} } });
+  const mcp = new McpServer(identity, { capabilities: { tools: { listChanged: true } } });
   const { server } = mcp;
   server.setRequestHandler(ListToolsRequestSchema, async () => {
     const tools = await ports.listTools();
@@ -138413,12 +138415,50 @@ function createMcpServer(identity, ports) {
   });
   return mcp;
 }
-async function serveMcp(mcp, transport) {
+async function serveMcp(mcp, transport, whileConnected) {
   const closed = new Promise((resolve2) => {
     mcp.server.onclose = resolve2;
   });
   await mcp.connect(transport);
+  const stop = whileConnected?.(() => {
+    void mcp.server.sendToolListChanged();
+  });
   await closed;
+  stop?.();
+}
+
+// src/mcp/permissions.ts
+var import_node_fs17 = __toESM(require("node:fs"), 1);
+var import_node_path46 = __toESM(require("node:path"), 1);
+init_zod();
+init_store();
+var StoredMcpPermissionsSchema = external_exports.strictObject({
+  writes: external_exports.boolean(),
+  remoteControl: external_exports.boolean()
+});
+var OWNER_ONLY_MODE = 384;
+var NONE2 = { writes: false, remoteControl: false };
+function readStoredMcpPermissions(paths) {
+  return readJson(paths.mcpPermissionsFile, StoredMcpPermissionsSchema) ?? NONE2;
+}
+function writeStoredMcpPermissions(paths, permissions) {
+  writeJsonAtomic(paths.mcpPermissionsFile, { writes: permissions.writes, remoteControl: permissions.remoteControl });
+  import_node_fs17.default.chmodSync(paths.mcpPermissionsFile, OWNER_ONLY_MODE);
+}
+function effectiveMcpPermissions(flags, stored) {
+  return { writes: flags.writes || stored.writes, remoteControl: flags.remoteControl || stored.remoteControl };
+}
+function watchMcpPermissions(paths, onChange) {
+  const directory = import_node_path46.default.dirname(paths.mcpPermissionsFile);
+  import_node_fs17.default.mkdirSync(directory, { recursive: true });
+  const watcher = import_node_fs17.default.watch(directory, (_event, filename) => {
+    if (filename === null || filename === import_node_path46.default.basename(paths.mcpPermissionsFile)) {
+      onChange();
+    }
+  });
+  return () => {
+    watcher.close();
+  };
 }
 
 // src/mcp/tools.ts
@@ -138508,7 +138548,7 @@ function doorMcpPorts(paths, permissions) {
   return {
     listTools: async () => {
       const { port, ca: ca2, token } = material();
-      return toolsFromOpenApiDocument(await fetchFrontDoorOpenApiDocument(port, ca2, token), permissions);
+      return toolsFromOpenApiDocument(await fetchFrontDoorOpenApiDocument(port, ca2, token), permissions());
     },
     callProcedure: async (procedure, input2) => {
       const { port, ca: ca2, token } = material();
@@ -138520,15 +138560,47 @@ function doorMcpPorts(paths, permissions) {
     }
   };
 }
+var PERMISSION_FIELDS = { writes: "writes", "remote-control": "remoteControl" };
+function permissionName(value2) {
+  if (value2 !== "writes" && value2 !== "remote-control") {
+    throw new UsageError(`unknown permission "${value2}": expected writes or remote-control`);
+  }
+  return value2;
+}
 function registerMcpCommand(program2, deps) {
+  const mcp = program2.command("mcp").description("Serve the front door's typed API as MCP tools on standard input and output, so an agent can read quota and door state and, when allowed, act on it.").option("--allow-writes", "Also expose the operations that change the door's configuration and lifecycle, whatever `mcp permissions` says. Read-only without it or a stored permission.").option("--allow-remote-control", "Also expose the Remote Control operations that send into, answer for and end other sessions, whatever `mcp permissions` says.").action(async (options) => {
+    const flags = { writes: options.allowWrites === true, remoteControl: options.allowRemoteControl === true };
+    const inForce = () => effectiveMcpPermissions(flags, readStoredMcpPermissions(deps.paths));
+    const server = createMcpServer({ name: "agent-shim", version: package_default.version }, doorMcpPorts(deps.paths, inForce));
+    await serveMcp(server, new StdioServerTransport(), (announce) => watchMcpPermissions(deps.paths, announce));
+  });
+  withExamples(mcp, ["agent-shim mcp", "agent-shim mcp --allow-writes"]);
+  const permissions = withExamples(
+    mcp.command("permissions").description("Show or change what the MCP server's agents may do. A running server picks a change up on its next request, with no restart."),
+    ["agent-shim mcp permissions show", "agent-shim mcp permissions allow writes"]
+  );
   withExamples(
-    program2.command("mcp").description("Serve the front door's typed API as MCP tools on standard input and output, so an agent can read quota and door state and, when allowed, act on it.").option("--allow-writes", "Also expose the operations that change the door's configuration and lifecycle. Read-only without it.").option("--allow-remote-control", "Also expose the Remote Control operations that send into, answer for and end other sessions.").action(async (options) => {
-      const permissions = { writes: options.allowWrites === true, remoteControl: options.allowRemoteControl === true };
-      const server = createMcpServer({ name: "agent-shim", version: package_default.version }, doorMcpPorts(deps.paths, permissions));
-      await serveMcp(server, new StdioServerTransport());
+    permissions.command("show").description("Print the permissions the stored file grants.").option("--json", "Print them as JSON.").action((options) => {
+      const stored = readStoredMcpPermissions(deps.paths);
+      if (options.json === true) {
+        printJson(stored);
+        return;
+      }
+      console.log(`writes: ${stored.writes ? "allowed" : "not allowed"}`);
+      console.log(`remote-control: ${stored.remoteControl ? "allowed" : "not allowed"}`);
     }),
-    ["agent-shim mcp", "agent-shim mcp --allow-writes"]
+    ["agent-shim mcp permissions show"]
   );
+  for (const [verb, granted] of [["allow", true], ["deny", false]]) {
+    withExamples(
+      permissions.command(`${verb} <permission>`).description(`${verb === "allow" ? "Allow" : "Stop allowing"} \`writes\` (configuration and lifecycle operations) or \`remote-control\` (operations on other sessions) for the MCP server's agents.`).action((permission) => {
+        const field = PERMISSION_FIELDS[permissionName(permission)];
+        writeStoredMcpPermissions(deps.paths, { ...readStoredMcpPermissions(deps.paths), [field]: granted });
+        console.log(`${permission}: ${granted ? "allowed" : "not allowed"}`);
+      }),
+      [`agent-shim mcp permissions ${verb} writes`]
+    );
+  }
 }
 
 // src/completion.ts
@@ -138683,17 +138755,17 @@ init_credential();
 init_credentialCache();
 
 // src/identityToken.ts
-var import_node_fs17 = __toESM(require("node:fs"), 1);
-var import_node_path46 = __toESM(require("node:path"), 1);
+var import_node_fs18 = __toESM(require("node:fs"), 1);
+var import_node_path47 = __toESM(require("node:path"), 1);
 init_cliError();
 var TOKEN_FILE_MODE = 384;
 var TOKEN_DIR_MODE = 448;
 var OAUTH_TOKEN_RE = /^sk-ant-oat\d+-[A-Za-z0-9_-]+$/;
 function identityTokenDir(paths) {
-  return import_node_path46.default.join(paths.root, "credentials");
+  return import_node_path47.default.join(paths.root, "credentials");
 }
 function identityTokenPath(paths, identityName) {
-  return import_node_path46.default.join(identityTokenDir(paths), `${identityName}.token`);
+  return import_node_path47.default.join(identityTokenDir(paths), `${identityName}.token`);
 }
 function storeIdentityToken(paths, identityName, raw) {
   const token = raw.trim();
@@ -138701,13 +138773,13 @@ function storeIdentityToken(paths, identityName, raw) {
     throw new UsageError("That is not a claude setup-token token (expected it to start with sk-ant-oat). Run `claude setup-token` and pass its token on standard input.");
   }
   const dir = identityTokenDir(paths);
-  import_node_fs17.default.mkdirSync(dir, { recursive: true, mode: TOKEN_DIR_MODE });
-  import_node_fs17.default.chmodSync(dir, TOKEN_DIR_MODE);
+  import_node_fs18.default.mkdirSync(dir, { recursive: true, mode: TOKEN_DIR_MODE });
+  import_node_fs18.default.chmodSync(dir, TOKEN_DIR_MODE);
   const target = identityTokenPath(paths, identityName);
-  const temp = import_node_path46.default.join(dir, `.${identityName}.${String(process.pid)}.tmp`);
-  import_node_fs17.default.writeFileSync(temp, `${token}
+  const temp = import_node_path47.default.join(dir, `.${identityName}.${String(process.pid)}.tmp`);
+  import_node_fs18.default.writeFileSync(temp, `${token}
 `, { mode: TOKEN_FILE_MODE });
-  import_node_fs17.default.renameSync(temp, target);
+  import_node_fs18.default.renameSync(temp, target);
   return target;
 }
 
@@ -138870,9 +138942,9 @@ function registerDoctorCommand(program2, deps) {
 }
 
 // src/headroom/commands.ts
-var import_node_fs18 = __toESM(require("node:fs"), 1);
+var import_node_fs19 = __toESM(require("node:fs"), 1);
 var import_node_http4 = __toESM(require("node:http"), 1);
-var import_node_path47 = __toESM(require("node:path"), 1);
+var import_node_path48 = __toESM(require("node:path"), 1);
 var import_node_child_process6 = require("node:child_process");
 init_commandDeps();
 init_realFrontDoorPort();
@@ -138986,12 +139058,12 @@ function readInstalledHeadroomCommit() {
   if (toolDir.status !== 0) {
     return void 0;
   }
-  const libDir = import_node_path47.default.join(toolDir.stdout.trim(), HEADROOM_TOOL_NAME, "lib");
+  const libDir = import_node_path48.default.join(toolDir.stdout.trim(), HEADROOM_TOOL_NAME, "lib");
   for (const python of realFarmFs.readdir(libDir)) {
-    const sitePackages = import_node_path47.default.join(libDir, python, "site-packages");
+    const sitePackages = import_node_path48.default.join(libDir, python, "site-packages");
     for (const entry of realFarmFs.readdir(sitePackages)) {
       if (entry.startsWith("headroom_ai-") && entry.endsWith(".dist-info")) {
-        const directUrl = realFarmFs.readFileUtf8(import_node_path47.default.join(sitePackages, entry, "direct_url.json"));
+        const directUrl = realFarmFs.readFileUtf8(import_node_path48.default.join(sitePackages, entry, "direct_url.json"));
         return directUrl === void 0 ? void 0 : parseInstalledCommit(directUrl);
       }
     }
@@ -139015,12 +139087,12 @@ function realSupervisorPorts(paths) {
     readConfig: () => resolveSupervisorConfig(readGlobalConfig(paths)?.headroom ?? {}),
     spawnHeadroom: (socketPath, allowlist, settings2) => {
       const trust = resolveHeadroomTrustBundle({ caCertFile: paths.frontdoorCaCertFile, bundlesDir: paths.frontdoorCaBundlesDir, inherited: process.env[HEADROOM_CA_BUNDLE], fs: realTrustBundleFs });
-      import_node_fs18.default.mkdirSync(paths.logsDir, { recursive: true });
+      import_node_fs19.default.mkdirSync(paths.logsDir, { recursive: true });
       if (trust?.warning !== void 0) {
-        import_node_fs18.default.appendFileSync(paths.headroomLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${trust.warning}
+        import_node_fs19.default.appendFileSync(paths.headroomLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${trust.warning}
 `);
       }
-      const logFd = import_node_fs18.default.openSync(paths.headroomLogPath, "a");
+      const logFd = import_node_fs19.default.openSync(paths.headroomLogPath, "a");
       try {
         const child = (0, import_node_child_process6.spawn)("headroom", headroomProxyArgs(socketPath, settings2), {
           detached: true,
@@ -139035,12 +139107,12 @@ function realSupervisorPorts(paths) {
         child.once("exit", (code, signal) => {
           ownedHeadroom.delete(pid);
           exitedHeadroom.add(pid);
-          import_node_fs18.default.appendFileSync(paths.headroomLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} agent-shim headroom supervisor: headroom exited (${signal ?? `code ${String(code)}`})
+          import_node_fs19.default.appendFileSync(paths.headroomLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} agent-shim headroom supervisor: headroom exited (${signal ?? `code ${String(code)}`})
 `);
         });
         return pid;
       } finally {
-        import_node_fs18.default.closeSync(logFd);
+        import_node_fs19.default.closeSync(logFd);
       }
     },
     stopProcess: (pid) => {
@@ -139053,7 +139125,7 @@ function realSupervisorPorts(paths) {
         now: () => Date.now()
       });
       if (outcome === "still-running") {
-        import_node_fs18.default.appendFileSync(
+        import_node_fs19.default.appendFileSync(
           paths.headroomLogPath,
           `${(/* @__PURE__ */ new Date()).toISOString()} agent-shim headroom supervisor: pid ${String(pid)} survived SIGKILL within its grace; it is stuck uninterruptibly
 `
@@ -139067,10 +139139,10 @@ function realSupervisorPorts(paths) {
         return { ok: false, error: `uv is not installed or not on PATH (${result.error.message})` };
       }
       if (result.stdout !== "") {
-        import_node_fs18.default.appendFileSync(paths.headroomLogPath, result.stdout);
+        import_node_fs19.default.appendFileSync(paths.headroomLogPath, result.stdout);
       }
       if (result.stderr !== "") {
-        import_node_fs18.default.appendFileSync(paths.headroomLogPath, result.stderr);
+        import_node_fs19.default.appendFileSync(paths.headroomLogPath, result.stderr);
       }
       return result.status === 0 ? { ok: true } : { ok: false, error: `uv tool install exited ${String(result.status)}` };
     },
@@ -139080,8 +139152,8 @@ function realSupervisorPorts(paths) {
     },
     installedCommit: readInstalledHeadroomCommit,
     log: (line) => {
-      import_node_fs18.default.mkdirSync(paths.logsDir, { recursive: true });
-      import_node_fs18.default.appendFileSync(paths.headroomLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
+      import_node_fs19.default.mkdirSync(paths.logsDir, { recursive: true });
+      import_node_fs19.default.appendFileSync(paths.headroomLogPath, `${(/* @__PURE__ */ new Date()).toISOString()} ${line}
 `);
     }
   };
@@ -139531,7 +139603,7 @@ function registerRunCommand(program2, handler) {
 }
 
 // src/usage/commands.ts
-var import_node_path48 = __toESM(require("node:path"), 1);
+var import_node_path49 = __toESM(require("node:path"), 1);
 init_commandDeps();
 init_realPorts();
 init_account();
@@ -139547,14 +139619,14 @@ function requireIdentity(paths, name) {
     throw new IdentityNotFoundError(name);
   }
 }
-function collectUsageReport(fs21, paths, filters) {
+function collectUsageReport(fs22, paths, filters) {
   const { identity, provider, sinceMs } = filters;
   if (identity !== void 0) {
     requireIdentity(paths, identity);
   }
-  const log = readUsageLog(fs21, paths.usageLogDir, sinceMs === void 0 ? {} : { sinceMs });
+  const log = readUsageLog(fs22, paths.usageLogDir, sinceMs === void 0 ? {} : { sinceMs });
   const records = log.records.filter((record2) => (identity === void 0 || record2.identity === identity) && (provider === void 0 || record2.provider === provider));
-  const snapshots = (identity === void 0 ? listUsageSnapshots(fs21, paths.usageSnapshotsDir) : [readUsageSnapshot(fs21, paths.usageSnapshotsDir, identity)].flatMap((snapshot) => snapshot === void 0 ? [] : [snapshot])).map((snapshot) => provider === void 0 ? snapshot : { ...snapshot, providers: Object.fromEntries(Object.entries(snapshot.providers).filter(([name]) => name === provider)) }).filter((snapshot) => Object.keys(snapshot.providers).length > 0);
+  const snapshots = (identity === void 0 ? listUsageSnapshots(fs22, paths.usageSnapshotsDir) : [readUsageSnapshot(fs22, paths.usageSnapshotsDir, identity)].flatMap((snapshot) => snapshot === void 0 ? [] : [snapshot])).map((snapshot) => provider === void 0 ? snapshot : { ...snapshot, providers: Object.fromEntries(Object.entries(snapshot.providers).filter(([name]) => name === provider)) }).filter((snapshot) => Object.keys(snapshot.providers).length > 0);
   return {
     since: sinceMs === void 0 ? void 0 : new Date(sinceMs).toISOString(),
     logDir: paths.usageLogDir,
@@ -139670,16 +139742,16 @@ function formatUsageReport(report) {
   }
   return lines;
 }
-function collectAccounts(fs21, paths, identity, probe) {
+function collectAccounts(fs22, paths, identity, probe) {
   if (identity !== void 0) {
     requireIdentity(paths, identity);
   }
   const names = identity === void 0 ? listIdentities(paths).map((entry) => entry.name) : [identity];
   return names.map((name) => ({
     identity: name,
-    account: readAccountMetadata(fs21, paths.identitiesDir, name),
-    signIn: identitySignIn(fs21, probe, { farmRoot: import_node_path48.default.join(paths.identitiesDir, name), hasCredentialBlock: readIdentity(paths, name)?.credential !== void 0 }),
-    usage: readUsageSnapshot(fs21, paths.usageSnapshotsDir, name)
+    account: readAccountMetadata(fs22, paths.identitiesDir, name),
+    signIn: identitySignIn(fs22, probe, { farmRoot: import_node_path49.default.join(paths.identitiesDir, name), hasCredentialBlock: readIdentity(paths, name)?.credential !== void 0 }),
+    usage: readUsageSnapshot(fs22, paths.usageSnapshotsDir, name)
   }));
 }
 function formatAccounts(views) {
@@ -140011,7 +140083,7 @@ async function runClaude(argvOverride) {
 // src/cli.ts
 async function main() {
   aliasLegacyEnv(process.env);
-  const invokedName = import_node_path49.default.basename(process.argv[1] ?? "agent-shim");
+  const invokedName = import_node_path50.default.basename(process.argv[1] ?? "agent-shim");
   if (isInvokedAsClaude(invokedName)) {
     await runClaude();
     return;