@adhdev/daemon-core 0.9.82-rc.47 → 0.9.82-rc.49

package/dist/index.js

@@ -662,17 +662,91 @@ var init_config = __esm({
   }
 });
 
+// src/mesh/mesh-host-ownership.ts
+function readObject(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function readString(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function normalizeMeshDaemonRole(value) {
+  return value === "host" || value === "member" ? value : void 0;
+}
+function resolveMeshHostStatus(mesh) {
+  const meshRecord = readObject(mesh);
+  const raw = readObject(meshRecord?.meshHost);
+  const role = normalizeMeshDaemonRole(raw?.role) ?? "host";
+  const pairing = readObject(raw?.pairing);
+  const normalized = {
+    role,
+    canOwnCoordinator: role === "host",
+    canOwnQueue: role === "host",
+    defaulted: !raw
+  };
+  const hostDaemonId = readString(raw?.hostDaemonId);
+  const hostNodeId = readString(raw?.hostNodeId);
+  const hostAddress = readString(raw?.hostAddress);
+  if (hostDaemonId) normalized.hostDaemonId = hostDaemonId;
+  if (hostNodeId) normalized.hostNodeId = hostNodeId;
+  if (hostAddress) normalized.hostAddress = hostAddress;
+  if (pairing) {
+    const status = pairing.status === "pairing" || pairing.status === "paired" || pairing.status === "rejected" || pairing.status === "revoked" ? pairing.status : "not_configured";
+    normalized.pairing = {
+      status,
+      ...readString(pairing.tokenId) ? { tokenId: readString(pairing.tokenId) } : {},
+      ...readString(pairing.joinedAt) ? { joinedAt: readString(pairing.joinedAt) } : {},
+      ...readString(pairing.lastPairedAt) ? { lastPairedAt: readString(pairing.lastPairedAt) } : {},
+      ...readString(pairing.lastRejectedAt) ? { lastRejectedAt: readString(pairing.lastRejectedAt) } : {},
+      ...readString(pairing.expiresAt) ? { expiresAt: readString(pairing.expiresAt) } : {}
+    };
+  }
+  return normalized;
+}
+function isMeshHostOwner(mesh) {
+  return resolveMeshHostStatus(mesh).role === "host";
+}
+function buildMeshHostRequiredFailure(mesh, operation) {
+  const meshHost = resolveMeshHostStatus(mesh);
+  return {
+    success: false,
+    code: "mesh_host_required",
+    error: `Mesh Host daemon required for ${operation}; member daemons must pair with the host and cannot own coordinator/queue mutations.`,
+    meshHost
+  };
+}
+function requireMeshHostQueueOwner(opts) {
+  if (opts?.ownerRole === "member") {
+    throw new Error("Mesh Host daemon required to mutate mesh queue; member daemons must use the host-owned queue.");
+  }
+}
+function createDefaultMeshHostMetadata() {
+  return {
+    role: "host",
+    pairing: { status: "not_configured" }
+  };
+}
+var init_mesh_host_ownership = __esm({
+  "src/mesh/mesh-host-ownership.ts"() {
+    "use strict";
+  }
+});
+
 // src/config/mesh-config.ts
 var mesh_config_exports = {};
 __export(mesh_config_exports, {
   addNode: () => addNode,
+  applyMeshHostJoinRequest: () => applyMeshHostJoinRequest,
+  configureMeshHostPairing: () => configureMeshHostPairing,
   createMesh: () => createMesh,
+  createMeshHostPairingToken: () => createMeshHostPairingToken,
   deleteMesh: () => deleteMesh,
   getMesh: () => getMesh,
   getMeshByRepo: () => getMeshByRepo,
   listMeshes: () => listMeshes,
+  markMeshHostPairingJoined: () => markMeshHostPairingJoined,
   normalizeRepoIdentity: () => normalizeRepoIdentity,
   removeNode: () => removeNode,
+  tokenIdForManualPairing: () => tokenIdForManualPairing,
   updateMesh: () => updateMesh,
   updateNode: () => updateNode
 });
@@ -748,6 +822,7 @@ function createMesh(opts) {
     defaultBranch: opts.defaultBranch,
     policy: mergeMeshPolicy(void 0, opts.policy),
     coordinator: opts.coordinator || {},
+    meshHost: opts.meshHost || createDefaultMeshHostMetadata(),
     nodes: [],
     createdAt: now,
     updatedAt: now
@@ -764,6 +839,7 @@ function updateMesh(meshId, opts) {
   if (opts.defaultBranch !== void 0) mesh.defaultBranch = opts.defaultBranch;
   if (opts.policy) mesh.policy = mergeMeshPolicy(mesh.policy, opts.policy);
   if (opts.coordinator) mesh.coordinator = opts.coordinator;
+  if (opts.meshHost) mesh.meshHost = opts.meshHost;
   mesh.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
   saveMeshConfig(config);
   return mesh;
@@ -776,6 +852,186 @@ function deleteMesh(meshId) {
   saveMeshConfig(config);
   return true;
 }
+function normalizeManualHostAddress(hostAddress) {
+  const normalized = hostAddress.trim().replace(/\/+$/, "");
+  if (!normalized) throw new Error("hostAddress required");
+  let parsed;
+  try {
+    parsed = new URL(normalized);
+  } catch {
+    throw new Error("hostAddress must be a valid http(s) or ws(s) URL");
+  }
+  if (!["http:", "https:", "ws:", "wss:"].includes(parsed.protocol)) {
+    throw new Error("hostAddress must use http, https, ws, or wss");
+  }
+  return normalized;
+}
+function tokenIdForManualPairing(token) {
+  return `tok_${(0, import_crypto3.createHash)("sha256").update(token).digest("hex").slice(0, 16)}`;
+}
+function normalizeTokenExpiry(value) {
+  if (typeof value !== "string" || !value.trim()) return void 0;
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) throw new Error("expiresAt must be a valid ISO date");
+  return date.toISOString();
+}
+function assertPairingTokenValid(pairing, rawToken, nowIso) {
+  const token = rawToken.trim();
+  if (!token) return { ok: false, reason: "token required" };
+  const presentedTokenId = tokenIdForManualPairing(token);
+  const expectedTokenId = pairing?.tokenId;
+  if (!expectedTokenId || pairing?.status === "not_configured" || pairing?.status === "revoked") {
+    return { ok: false, reason: "host pairing token is not configured", presentedTokenId };
+  }
+  if (pairing.expiresAt && new Date(pairing.expiresAt).getTime() <= new Date(nowIso).getTime()) {
+    return { ok: false, reason: "host pairing token expired", expectedTokenId, presentedTokenId };
+  }
+  if (presentedTokenId !== expectedTokenId) {
+    return { ok: false, reason: "invalid pairing token", expectedTokenId, presentedTokenId };
+  }
+  return { ok: true, tokenId: presentedTokenId };
+}
+function configureMeshHostPairing(meshId, opts) {
+  const hostAddress = normalizeManualHostAddress(opts.hostAddress);
+  const token = opts.token.trim();
+  if (!token) throw new Error("token required");
+  const config = loadMeshConfig();
+  const mesh = config.meshes.find((m) => m.id === meshId);
+  if (!mesh) return void 0;
+  const now = opts.now || (/* @__PURE__ */ new Date()).toISOString();
+  const previous = mesh.meshHost || createDefaultMeshHostMetadata();
+  const meshHost = {
+    ...previous,
+    role: "member",
+    hostAddress,
+    pairing: {
+      status: "pairing",
+      tokenId: tokenIdForManualPairing(token),
+      lastPairedAt: now
+    }
+  };
+  mesh.meshHost = meshHost;
+  mesh.updatedAt = now;
+  saveMeshConfig(config);
+  return { mesh, meshHost, hostAddress };
+}
+function createMeshHostPairingToken(meshId, opts = {}) {
+  const config = loadMeshConfig();
+  const mesh = config.meshes.find((m) => m.id === meshId);
+  if (!mesh) return void 0;
+  const now = opts.now || (/* @__PURE__ */ new Date()).toISOString();
+  const token = (opts.token || `mhj_${(0, import_crypto3.randomBytes)(24).toString("base64url")}`).trim();
+  if (!token) throw new Error("token required");
+  const tokenId = tokenIdForManualPairing(token);
+  const expiresAt = normalizeTokenExpiry(opts.expiresAt);
+  const previous = mesh.meshHost || createDefaultMeshHostMetadata();
+  if (previous.role === "member") {
+    throw new Error("Mesh Host daemon required to create host pairing tokens; member daemons cannot mint host join tokens.");
+  }
+  const meshHost = {
+    ...previous,
+    role: "host",
+    pairing: {
+      status: "pairing",
+      tokenId,
+      lastPairedAt: now,
+      ...expiresAt ? { expiresAt } : {}
+    }
+  };
+  mesh.meshHost = meshHost;
+  mesh.updatedAt = now;
+  saveMeshConfig(config);
+  return { mesh, meshHost, token, tokenId, ...expiresAt ? { expiresAt } : {} };
+}
+function applyMeshHostJoinRequest(meshId, opts) {
+  const config = loadMeshConfig();
+  const mesh = config.meshes.find((m) => m.id === meshId);
+  if (!mesh) return void 0;
+  const now = opts.now || (/* @__PURE__ */ new Date()).toISOString();
+  const previous = mesh.meshHost || createDefaultMeshHostMetadata();
+  if (previous.role === "member") {
+    return { accepted: false, mesh, meshHost: previous, reason: "Mesh Host daemon required to accept join requests" };
+  }
+  const meshHost = { ...previous, role: "host" };
+  const validation = assertPairingTokenValid(meshHost.pairing, opts.token, now);
+  if (!validation.ok) {
+    mesh.meshHost = {
+      ...meshHost,
+      pairing: {
+        ...meshHost.pairing || { status: "not_configured" },
+        status: "rejected",
+        lastRejectedAt: now
+      }
+    };
+    mesh.updatedAt = now;
+    saveMeshConfig(config);
+    return { accepted: false, mesh, meshHost: mesh.meshHost, tokenId: validation.presentedTokenId, reason: validation.reason };
+  }
+  const workspace = opts.memberNode.workspace.trim();
+  if (!workspace) throw new Error("memberNode.workspace required");
+  const memberId = opts.memberNode.id?.trim();
+  let node = mesh.nodes.find((n) => memberId && n.id === memberId || n.workspace === workspace);
+  if (node) {
+    node.workspace = workspace;
+    node.repoRoot = opts.memberNode.repoRoot;
+    node.daemonId = opts.memberNode.daemonId;
+    node.machineId = opts.memberNode.machineId;
+    node.userOverrides = opts.memberNode.userOverrides || node.userOverrides || {};
+    node.policy = { ...node.policy || {}, ...opts.memberNode.policy || {} };
+    node.role = "member";
+  } else {
+    if (mesh.nodes.length >= 10) throw new Error("Maximum 10 nodes per mesh");
+    node = {
+      id: memberId || `node_${(0, import_crypto3.randomUUID)().replace(/-/g, "")}`,
+      workspace,
+      repoRoot: opts.memberNode.repoRoot,
+      daemonId: opts.memberNode.daemonId,
+      machineId: opts.memberNode.machineId,
+      userOverrides: opts.memberNode.userOverrides || {},
+      policy: opts.memberNode.policy || {},
+      role: "member"
+    };
+    mesh.nodes.push(node);
+  }
+  mesh.meshHost = {
+    ...meshHost,
+    pairing: {
+      ...meshHost.pairing || {},
+      status: "paired",
+      tokenId: validation.tokenId,
+      joinedAt: now,
+      lastPairedAt: meshHost.pairing?.lastPairedAt || now,
+      ...meshHost.pairing?.expiresAt ? { expiresAt: meshHost.pairing.expiresAt } : {}
+    }
+  };
+  mesh.updatedAt = now;
+  saveMeshConfig(config);
+  return { accepted: true, mesh, meshHost: mesh.meshHost, node, tokenId: validation.tokenId };
+}
+function markMeshHostPairingJoined(meshId, opts) {
+  const config = loadMeshConfig();
+  const mesh = config.meshes.find((m) => m.id === meshId);
+  if (!mesh) return void 0;
+  const now = opts.joinedAt || (/* @__PURE__ */ new Date()).toISOString();
+  const previous = mesh.meshHost || createDefaultMeshHostMetadata();
+  const tokenId = opts.tokenId || (opts.token ? tokenIdForManualPairing(opts.token) : previous.pairing?.tokenId);
+  mesh.meshHost = {
+    ...previous,
+    role: "member",
+    ...opts.hostDaemonId ? { hostDaemonId: opts.hostDaemonId } : {},
+    ...opts.hostNodeId ? { hostNodeId: opts.hostNodeId } : {},
+    pairing: {
+      ...previous.pairing || {},
+      status: "paired",
+      ...tokenId ? { tokenId } : {},
+      joinedAt: now,
+      lastPairedAt: previous.pairing?.lastPairedAt || now
+    }
+  };
+  mesh.updatedAt = now;
+  saveMeshConfig(config);
+  return { mesh, meshHost: mesh.meshHost };
+}
 function addNode(meshId, opts) {
   const config = loadMeshConfig();
   const mesh = config.meshes.find((m) => m.id === meshId);
@@ -796,7 +1052,8 @@ function addNode(meshId, opts) {
     policy: opts.policy || {},
     isLocalWorktree: opts.isLocalWorktree,
     worktreeBranch: opts.worktreeBranch,
-    clonedFromNodeId: opts.clonedFromNodeId
+    clonedFromNodeId: opts.clonedFromNodeId,
+    role: opts.role
   };
   mesh.nodes.push(node);
   mesh.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -835,6 +1092,7 @@ var init_mesh_config = __esm({
     import_crypto3 = require("crypto");
     init_config();
     init_repo_mesh_types();
+    init_mesh_host_ownership();
     SESSION_CLEANUP_MODES = /* @__PURE__ */ new Set(["preserve", "stop", "delete_stopped", "stop_and_delete"]);
     SPAWNED_SESSION_VISIBILITY_MODES = /* @__PURE__ */ new Set(["visible", "hidden"]);
   }
@@ -1018,19 +1276,19 @@ function isIntentionalCleanupStopEntry(entry) {
   return payload.intentional === true && (payload.reason === "operator_cleanup" || payload.intentionalStopReason === "operator_cleanup" || payload.source === "mesh_cleanup_sessions" || payload.source === "mesh_remove_node");
 }
 function getLedgerDir() {
-  const dir = (0, import_path3.join)(getConfigDir(), LEDGER_DIR_NAME);
-  if (!(0, import_fs3.existsSync)(dir)) {
-    (0, import_fs3.mkdirSync)(dir, { recursive: true, mode: 448 });
+  const dir = (0, import_path4.join)(getConfigDir(), LEDGER_DIR_NAME);
+  if (!(0, import_fs4.existsSync)(dir)) {
+    (0, import_fs4.mkdirSync)(dir, { recursive: true, mode: 448 });
   }
   return dir;
 }
 function getLedgerPath(meshId) {
   const safe = meshId.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return (0, import_path3.join)(getLedgerDir(), `${safe}.jsonl`);
+  return (0, import_path4.join)(getLedgerDir(), `${safe}.jsonl`);
 }
 function getRotatedPath(meshId, index) {
   const safe = meshId.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return (0, import_path3.join)(getLedgerDir(), `${safe}.${index}.jsonl`);
+  return (0, import_path4.join)(getLedgerDir(), `${safe}.${index}.jsonl`);
 }
 function buildTaskCompletionEvidence(opts) {
   const providerSessionId = opts.providerSessionId?.trim() || void 0;
@@ -1071,9 +1329,9 @@ function appendLedgerEntry(meshId, partial) {
     ...partial
   };
   const filePath = getLedgerPath(meshId);
-  if ((0, import_fs3.existsSync)(filePath)) {
+  if ((0, import_fs4.existsSync)(filePath)) {
     try {
-      const stat2 = (0, import_fs3.statSync)(filePath);
+      const stat2 = (0, import_fs4.statSync)(filePath);
       if (stat2.size >= MAX_FILE_SIZE_BYTES) {
         rotateLedgerFile(meshId, filePath);
       }
@@ -1082,7 +1340,7 @@ function appendLedgerEntry(meshId, partial) {
   }
   try {
     const line = JSON.stringify(entry) + "\n";
-    (0, import_fs3.appendFileSync)(filePath, line, { encoding: "utf-8", mode: 384 });
+    (0, import_fs4.appendFileSync)(filePath, line, { encoding: "utf-8", mode: 384 });
     meshLedgerEvents.emit("append", meshId, entry);
     return entry;
   } catch (e) {
@@ -1127,7 +1385,7 @@ function appendRemoteLedgerEntries(meshId, entries) {
   }
   try {
     const lines = validEntries.map((e) => JSON.stringify(e)).join("\n") + "\n";
-    (0, import_fs3.appendFileSync)(ledgerPath, lines, { encoding: "utf-8", mode: 384 });
+    (0, import_fs4.appendFileSync)(ledgerPath, lines, { encoding: "utf-8", mode: 384 });
     for (const entry of validEntries) {
       meshLedgerEvents.emit("append", meshId, entry);
     }
@@ -1138,10 +1396,10 @@ function appendRemoteLedgerEntries(meshId, entries) {
 }
 function readLedgerEntries(meshId, opts) {
   const filePath = getLedgerPath(meshId);
-  if (!(0, import_fs3.existsSync)(filePath)) return [];
+  if (!(0, import_fs4.existsSync)(filePath)) return [];
   let content;
   try {
-    content = (0, import_fs3.readFileSync)(filePath, "utf-8");
+    content = (0, import_fs4.readFileSync)(filePath, "utf-8");
   } catch {
     return [];
   }
@@ -1313,22 +1571,22 @@ function getSessionRecoveryContext(meshId, opts) {
 }
 function rotateLedgerFile(meshId, currentPath) {
   let index = 1;
-  while ((0, import_fs3.existsSync)(getRotatedPath(meshId, index))) {
+  while ((0, import_fs4.existsSync)(getRotatedPath(meshId, index))) {
     index++;
     if (index > 10) break;
   }
   if (index > 10) index = 10;
   try {
-    (0, import_fs3.renameSync)(currentPath, getRotatedPath(meshId, index));
+    (0, import_fs4.renameSync)(currentPath, getRotatedPath(meshId, index));
   } catch {
   }
 }
-var import_fs3, import_path3, import_crypto4, import_events, LEDGER_DIR_NAME, MAX_FILE_SIZE_BYTES, RECENT_FAILURE_WINDOW_MS, DEFAULT_LEDGER_SLICE_LIMIT, MAX_LEDGER_SLICE_LIMIT, meshLedgerEvents;
+var import_fs4, import_path4, import_crypto4, import_events, LEDGER_DIR_NAME, MAX_FILE_SIZE_BYTES, RECENT_FAILURE_WINDOW_MS, DEFAULT_LEDGER_SLICE_LIMIT, MAX_LEDGER_SLICE_LIMIT, meshLedgerEvents;
 var init_mesh_ledger = __esm({
   "src/mesh/mesh-ledger.ts"() {
     "use strict";
-    import_fs3 = require("fs");
-    import_path3 = require("path");
+    import_fs4 = require("fs");
+    import_path4 = require("path");
     import_crypto4 = require("crypto");
     init_config();
     import_events = require("events");
@@ -1358,18 +1616,18 @@ __export(mesh_work_queue_exports, {
 });
 function getQueuePath(meshId) {
   const safe = meshId.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return (0, import_path4.join)(getLedgerDir(), `${safe}.queue.json`);
+  return (0, import_path5.join)(getLedgerDir(), `${safe}.queue.json`);
 }
 function getLockPath(meshId) {
   const safe = meshId.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return (0, import_path4.join)(getLedgerDir(), `${safe}.queue.lock`);
+  return (0, import_path5.join)(getLedgerDir(), `${safe}.queue.lock`);
 }
 function withQueueLock(meshId, fn) {
   const lockPath = getLockPath(meshId);
   let fd = -1;
   for (let i = 0; i < 10; i++) {
     try {
-      fd = (0, import_fs4.openSync)(lockPath, "wx");
+      fd = (0, import_fs5.openSync)(lockPath, "wx");
       break;
     } catch {
       const deadline = Date.now() + 30;
@@ -1381,20 +1639,20 @@ function withQueueLock(meshId, fn) {
     return fn();
   } finally {
     if (fd !== -1) try {
-      (0, import_fs4.closeSync)(fd);
+      (0, import_fs5.closeSync)(fd);
     } catch {
     }
     try {
-      (0, import_fs4.unlinkSync)(lockPath);
+      (0, import_fs5.unlinkSync)(lockPath);
     } catch {
     }
   }
 }
 function readQueue(meshId) {
   const path28 = getQueuePath(meshId);
-  if (!(0, import_fs4.existsSync)(path28)) return [];
+  if (!(0, import_fs5.existsSync)(path28)) return [];
   try {
-    const content = (0, import_fs4.readFileSync)(path28, "utf-8");
+    const content = (0, import_fs5.readFileSync)(path28, "utf-8");
     return JSON.parse(content);
   } catch {
     return [];
@@ -1402,9 +1660,10 @@ function readQueue(meshId) {
 }
 function writeQueue(meshId, queue) {
   const path28 = getQueuePath(meshId);
-  (0, import_fs4.writeFileSync)(path28, JSON.stringify(queue, null, 2), "utf-8");
+  (0, import_fs5.writeFileSync)(path28, JSON.stringify(queue, null, 2), "utf-8");
 }
 function enqueueTask(meshId, message, opts) {
+  requireMeshHostQueueOwner(opts);
   return withQueueLock(meshId, () => {
     const queue = readQueue(meshId);
     const entry = {
@@ -1453,7 +1712,8 @@ function claimNextTask(meshId, nodeId, sessionId) {
     return entry;
   });
 }
-function updateTaskStatus(meshId, taskId, status) {
+function updateTaskStatus(meshId, taskId, status, opts) {
+  requireMeshHostQueueOwner(opts);
   return withQueueLock(meshId, () => {
     const queue = readQueue(meshId);
     const idx = queue.findIndex((q) => q.id === taskId);
@@ -1477,6 +1737,7 @@ function recordTaskAutoLaunch(meshId, taskId, autoLaunch) {
   });
 }
 function cancelTask(meshId, taskId, opts) {
+  requireMeshHostQueueOwner(opts);
   return withQueueLock(meshId, () => {
     const queue = readQueue(meshId);
     const idx = queue.findIndex((q) => q.id === taskId);
@@ -1491,6 +1752,7 @@ function cancelTask(meshId, taskId, opts) {
   });
 }
 function requeueTask(meshId, taskId, opts) {
+  requireMeshHostQueueOwner(opts);
   return withQueueLock(meshId, () => {
     const queue = readQueue(meshId);
     const idx = queue.findIndex((q) => q.id === taskId);
@@ -1570,14 +1832,15 @@ function getMeshQueueStats(meshId) {
     }))
   };
 }
-var import_fs4, import_path4, import_crypto5, ACTIVE_MESH_QUEUE_STATUSES, HISTORICAL_MESH_QUEUE_STATUSES;
+var import_fs5, import_path5, import_crypto5, ACTIVE_MESH_QUEUE_STATUSES, HISTORICAL_MESH_QUEUE_STATUSES;
 var init_mesh_work_queue = __esm({
   "src/mesh/mesh-work-queue.ts"() {
     "use strict";
-    import_fs4 = require("fs");
-    import_path4 = require("path");
+    import_fs5 = require("fs");
+    import_path5 = require("path");
     import_crypto5 = require("crypto");
     init_mesh_ledger();
+    init_mesh_host_ownership();
     ACTIVE_MESH_QUEUE_STATUSES = ["pending", "assigned"];
     HISTORICAL_MESH_QUEUE_STATUSES = ["completed", "failed", "cancelled"];
   }
@@ -1607,7 +1870,7 @@ function resolveCommandPath(command) {
   if (isExplicitCommandPath(trimmed)) {
     const expanded = expandHome(trimmed);
     const candidate = path8.isAbsolute(expanded) ? expanded : path8.resolve(expanded);
-    return (0, import_fs5.existsSync)(candidate) ? candidate : null;
+    return (0, import_fs6.existsSync)(candidate) ? candidate : null;
   }
   return null;
 }
@@ -1707,14 +1970,14 @@ async function detectCLI(cliId, providerLoader, options) {
   const all = await detectCLIs(providerLoader, options);
   return all.find((c) => c.id === resolvedId && c.installed) || null;
 }
-var import_child_process, os2, path8, import_fs5;
+var import_child_process, os2, path8, import_fs6;
 var init_cli_detector = __esm({
   "src/detection/cli-detector.ts"() {
     "use strict";
     import_child_process = require("child_process");
     os2 = __toESM(require("os"));
     path8 = __toESM(require("path"));
-    import_fs5 = require("fs");
+    import_fs6 = require("fs");
   }
 });
 
@@ -1952,11 +2215,11 @@ function sweepExpiredRemoteIdleSessions() {
 }
 function getPendingEventsPath(meshId) {
   const safe = meshId.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return (0, import_path5.join)(getLedgerDir(), `${safe}.pending-events.jsonl`);
+  return (0, import_path6.join)(getLedgerDir(), `${safe}.pending-events.jsonl`);
 }
 function queuePendingMeshCoordinatorEvent(event) {
   try {
-    (0, import_fs6.appendFileSync)(getPendingEventsPath(event.meshId), JSON.stringify(event) + "\n", "utf-8");
+    (0, import_fs7.appendFileSync)(getPendingEventsPath(event.meshId), JSON.stringify(event) + "\n", "utf-8");
     return true;
   } catch (e) {
     LOG.warn("MeshEvents", `Failed to persist pending coordinator event: ${e?.message || e}`);
@@ -1966,11 +2229,11 @@ function queuePendingMeshCoordinatorEvent(event) {
 function drainPendingMeshCoordinatorEvents(meshId) {
   if (!meshId) return [];
   const path28 = getPendingEventsPath(meshId);
-  if (!(0, import_fs6.existsSync)(path28)) return [];
+  if (!(0, import_fs7.existsSync)(path28)) return [];
   try {
-    const raw = (0, import_fs6.readFileSync)(path28, "utf-8");
+    const raw = (0, import_fs7.readFileSync)(path28, "utf-8");
     try {
-      (0, import_fs6.unlinkSync)(path28);
+      (0, import_fs7.unlinkSync)(path28);
     } catch {
     }
     return raw.split("\n").filter(Boolean).flatMap((line) => {
@@ -1987,9 +2250,9 @@ function drainPendingMeshCoordinatorEvents(meshId) {
 function getPendingMeshCoordinatorEvents(meshId) {
   if (!meshId) return [];
   const path28 = getPendingEventsPath(meshId);
-  if (!(0, import_fs6.existsSync)(path28)) return [];
+  if (!(0, import_fs7.existsSync)(path28)) return [];
   try {
-    const raw = (0, import_fs6.readFileSync)(path28, "utf-8");
+    const raw = (0, import_fs7.readFileSync)(path28, "utf-8");
     return raw.split("\n").filter(Boolean).flatMap((line) => {
       try {
         return [JSON.parse(line)];
@@ -2004,8 +2267,8 @@ function getPendingMeshCoordinatorEvents(meshId) {
 function clearPendingMeshCoordinatorEvents(meshId) {
   if (!meshId) return;
   const path28 = getPendingEventsPath(meshId);
-  if ((0, import_fs6.existsSync)(path28)) try {
-    (0, import_fs6.unlinkSync)(path28);
+  if ((0, import_fs7.existsSync)(path28)) try {
+    (0, import_fs7.unlinkSync)(path28);
   } catch {
   }
 }
@@ -2727,12 +2990,12 @@ function setupMeshEventForwarding(components) {
     });
   });
 }
-var import_fs6, import_path5, REMOTE_IDLE_SESSION_TTL_MS, remoteIdleSessions, MESH_COORDINATOR_EVENTS, EVENT_TO_LEDGER_KIND, INTENTIONAL_CLEANUP_STOP_SUPPRESSION_MS, RECENT_COMPLETION_FINGERPRINT_TTL_MS, recentCompletionFingerprints, autoLaunchInProgress, autoLaunchCooldownUntil, AUTO_LAUNCH_COOLDOWN_MS;
+var import_fs7, import_path6, REMOTE_IDLE_SESSION_TTL_MS, remoteIdleSessions, MESH_COORDINATOR_EVENTS, EVENT_TO_LEDGER_KIND, INTENTIONAL_CLEANUP_STOP_SUPPRESSION_MS, RECENT_COMPLETION_FINGERPRINT_TTL_MS, recentCompletionFingerprints, autoLaunchInProgress, autoLaunchCooldownUntil, AUTO_LAUNCH_COOLDOWN_MS;
 var init_mesh_events = __esm({
   "src/mesh/mesh-events.ts"() {
     "use strict";
-    import_fs6 = require("fs");
-    import_path5 = require("path");
+    import_fs7 = require("fs");
+    import_path6 = require("path");
     init_config();
     init_mesh_config();
     init_cli_detector();
@@ -5881,6 +6144,8 @@ __export(index_exports, {
   InMemoryGitSnapshotStore: () => InMemoryGitSnapshotStore,
   LOG: () => LOG,
   MAX_LEDGER_SLICE_LIMIT: () => MAX_LEDGER_SLICE_LIMIT,
+  MESH_REFINE_CONFIG_LOCATIONS: () => MESH_REFINE_CONFIG_LOCATIONS,
+  MESH_REFINE_CONFIG_SCHEMA: () => MESH_REFINE_CONFIG_SCHEMA,
   MIN_GIT_WORKSPACE_POLL_INTERVAL_MS: () => MIN_GIT_WORKSPACE_POLL_INTERVAL_MS,
   MIN_MACHINE_RUNTIME_SUBSCRIPTION_INTERVAL_MS: () => MIN_MACHINE_RUNTIME_SUBSCRIPTION_INTERVAL_MS,
   MIN_SESSION_HOST_DIAGNOSTICS_SUBSCRIPTION_INTERVAL_MS: () => MIN_SESSION_HOST_DIAGNOSTICS_SUBSCRIPTION_INTERVAL_MS,
@@ -5903,6 +6168,7 @@ __export(index_exports, {
   buildChatTailDeliverySignature: () => buildChatTailDeliverySignature,
   buildCoordinatorSystemPrompt: () => buildCoordinatorSystemPrompt,
   buildMachineInfo: () => buildMachineInfo,
+  buildMeshHostRequiredFailure: () => buildMeshHostRequiredFailure,
   buildMeshLedgerReconciliationEvidence: () => buildMeshLedgerReconciliationEvidence,
   buildMeshLedgerReplicaEvidence: () => buildMeshLedgerReplicaEvidence,
   buildP2pRelayFailurePayload: () => buildP2pRelayFailurePayload,
@@ -5928,6 +6194,7 @@ __export(index_exports, {
   connectCdpManager: () => connectCdpManager,
   createDebugTraceStore: () => createDebugTraceStore,
   createDefaultGitCommandServices: () => createDefaultGitCommandServices,
+  createDefaultMeshHostMetadata: () => createDefaultMeshHostMetadata,
   createGitCompactSummary: () => createGitCompactSummary,
   createGitSnapshotStore: () => createGitSnapshotStore,
   createGitWorkspaceMonitor: () => createGitWorkspaceMonitor,
@@ -5991,6 +6258,7 @@ __export(index_exports, {
   isInternalChatMessage: () => isInternalChatMessage,
   isManagedStatusWaiting: () => isManagedStatusWaiting,
   isManagedStatusWorking: () => isManagedStatusWorking,
+  isMeshHostOwner: () => isMeshHostOwner,
   isP2pRelayTransportFailure: () => isP2pRelayTransportFailure,
   isPathInside: () => isPathInside,
   isSessionHostLiveRuntime: () => isSessionHostLiveRuntime,
@@ -6004,6 +6272,7 @@ __export(index_exports, {
   listMeshes: () => listMeshes,
   listWorktrees: () => listWorktrees,
   loadConfig: () => loadConfig,
+  loadMeshRefineConfig: () => loadMeshRefineConfig,
   loadState: () => loadState,
   logCommand: () => logCommand,
   markSetupComplete: () => markSetupComplete,
@@ -6017,6 +6286,7 @@ __export(index_exports, {
   normalizeGitWorkspaceSubscriptionParams: () => normalizeGitWorkspaceSubscriptionParams,
   normalizeInputEnvelope: () => normalizeInputEnvelope,
   normalizeManagedStatus: () => normalizeManagedStatus,
+  normalizeMeshDaemonRole: () => normalizeMeshDaemonRole,
   normalizeMessageParts: () => normalizeMessageParts,
   normalizeRepoIdentity: () => normalizeRepoIdentity,
   normalizeSessionModalFields: () => normalizeSessionModalFields,
@@ -6037,6 +6307,7 @@ __export(index_exports, {
   removeNode: () => removeNode,
   removeWorktree: () => removeWorktree,
   requeueTask: () => requeueTask,
+  requireMeshHostQueueOwner: () => requireMeshHostQueueOwner,
   resetConfig: () => resetConfig,
   resetDebugRuntimeConfig: () => resetDebugRuntimeConfig,
   resetState: () => resetState,
@@ -6044,6 +6315,8 @@ __export(index_exports, {
   resolveCurrentGlobalInstallSurface: () => resolveCurrentGlobalInstallSurface,
   resolveDebugRuntimeConfig: () => resolveDebugRuntimeConfig,
   resolveGitRepository: () => resolveGitRepository,
+  resolveMeshHostStatus: () => resolveMeshHostStatus,
+  resolveMeshRefineValidationPlan: () => resolveMeshRefineValidationPlan,
   resolveSessionHostAppName: () => resolveSessionHostAppName,
   resolveSessionHostAppNameResolution: () => resolveSessionHostAppNameResolution,
   resolveWorktreePath: () => resolveWorktreePath,
@@ -6059,6 +6332,7 @@ __export(index_exports, {
   shutdownDaemonComponents: () => shutdownDaemonComponents,
   spawnDetachedDaemonUpgradeHelper: () => spawnDetachedDaemonUpgradeHelper,
   startDaemonDevSupport: () => startDaemonDevSupport,
+  suggestMeshRefineConfig: () => suggestMeshRefineConfig,
   summarizeGitStatus: () => summarizeGitStatus,
   syncMeshes: () => syncMeshes,
   triggerMeshQueue: () => triggerMeshQueue,
@@ -6067,7 +6341,8 @@ __export(index_exports, {
   updateNode: () => updateNode,
   updateSessionTaskStatus: () => updateSessionTaskStatus,
   updateTaskStatus: () => updateTaskStatus,
-  upsertSavedProviderSession: () => upsertSavedProviderSession
+  upsertSavedProviderSession: () => upsertSavedProviderSession,
+  validateMeshRefineConfig: () => validateMeshRefineConfig
 });
 module.exports = __toCommonJS(index_exports);
 init_repo_mesh_types();
@@ -7799,6 +8074,238 @@ function getSavedProviderSessions(state, filters) {
 init_mesh_config();
 init_coordinator_prompt();
 
+// src/mesh/refine-config.ts
+var import_fs3 = require("fs");
+var import_path3 = require("path");
+var yaml = __toESM(require("js-yaml"));
+var MESH_REFINE_VALIDATION_CATEGORIES = ["typecheck", "test", "lint", "build"];
+var MESH_REFINE_CONFIG_LOCATIONS = [
+  ".adhdev/refine.json",
+  ".adhdev/refine.yaml",
+  ".adhdev/refine.yml",
+  ".adhdev/repo-mesh-refine.json",
+  ".adhdev/repo-mesh-refine.yaml",
+  ".adhdev/repo-mesh-refine.yml",
+  "repo-mesh.refine.json",
+  "repo-mesh.refine.yaml",
+  "repo-mesh.refine.yml"
+];
+var MESH_REFINE_CONFIG_SCHEMA = {
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  title: "ADHDev Repo Mesh Refinery Config",
+  type: "object",
+  additionalProperties: false,
+  required: ["version"],
+  properties: {
+    version: { const: 1 },
+    validation: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        required: { type: "boolean", default: true },
+        commands: {
+          type: "array",
+          minItems: 1,
+          maxItems: 8,
+          items: {
+            type: "object",
+            additionalProperties: false,
+            required: ["command"],
+            properties: {
+              command: { type: "string", minLength: 1 },
+              args: { type: "array", items: { type: "string" } },
+              category: { enum: [...MESH_REFINE_VALIDATION_CATEGORIES, "custom"] },
+              cwd: { type: "string" },
+              timeoutMs: { type: "number", minimum: 1e3, maximum: 6e5 },
+              env: { type: "object", additionalProperties: { type: "string" } }
+            }
+          }
+        }
+      }
+    }
+  }
+};
+function isRecord(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function tokenizeCommandString(command) {
+  const trimmed = command.trim();
+  if (!trimmed) return null;
+  if (/[;&|<>`$\\\n\r'\"]/.test(trimmed)) return null;
+  const tokens = trimmed.split(/\s+/).filter(Boolean);
+  if (!tokens.length) return null;
+  if (tokens.some((token) => !/^[A-Za-z0-9_@./:=+-]+$/.test(token))) return null;
+  return tokens;
+}
+function validateCategory(value) {
+  return typeof value === "string" && [...MESH_REFINE_VALIDATION_CATEGORIES, "custom"].includes(value) ? value : "custom";
+}
+function normalizeCommandConfig(entry, source) {
+  if (!isRecord(entry) || typeof entry.command !== "string") {
+    return { rejected: { source, reason: "validation command must be an object with a command string" } };
+  }
+  const commandText = entry.command.trim();
+  const explicitArgs = Array.isArray(entry.args) ? entry.args : void 0;
+  if (explicitArgs && !explicitArgs.every((arg) => typeof arg === "string")) {
+    return { rejected: { source, command: commandText, reason: "args must be an array of strings" } };
+  }
+  let command = commandText;
+  let args = explicitArgs ? [...explicitArgs] : [];
+  if (!explicitArgs) {
+    const tokens = tokenizeCommandString(commandText);
+    if (!tokens) return { rejected: { source, command: commandText, reason: "unsafe command string is not allowlisted" } };
+    command = tokens[0];
+    args = tokens.slice(1);
+  } else if (!tokenizeCommandString(command)) {
+    return { rejected: { source, command: commandText, reason: "unsafe executable name is not allowlisted" } };
+  }
+  if (args.some((arg) => /[\n\r\0]/.test(arg))) {
+    return { rejected: { source, command: commandText, reason: "args cannot contain control characters" } };
+  }
+  if (entry.cwd !== void 0 && typeof entry.cwd !== "string") {
+    return { rejected: { source, command: commandText, reason: "cwd must be a string when provided" } };
+  }
+  if (entry.timeoutMs !== void 0 && (typeof entry.timeoutMs !== "number" || !Number.isFinite(entry.timeoutMs) || entry.timeoutMs < 1e3 || entry.timeoutMs > 6e5)) {
+    return { rejected: { source, command: commandText, reason: "timeoutMs must be between 1000 and 600000" } };
+  }
+  if (entry.env !== void 0 && (!isRecord(entry.env) || !Object.values(entry.env).every((value) => typeof value === "string"))) {
+    return { rejected: { source, command: commandText, reason: "env must be an object of string values" } };
+  }
+  return {
+    command: {
+      command,
+      args,
+      displayCommand: [command, ...args].join(" "),
+      category: validateCategory(entry.category),
+      source,
+      ...typeof entry.cwd === "string" && entry.cwd.trim() ? { cwd: entry.cwd.trim() } : {},
+      ...typeof entry.timeoutMs === "number" ? { timeoutMs: entry.timeoutMs } : {},
+      ...isRecord(entry.env) ? { env: entry.env } : {}
+    }
+  };
+}
+function validateMeshRefineConfig(config, source = "inline") {
+  const errors = [];
+  const commands = [];
+  const rejectedCommands = [];
+  if (!isRecord(config)) return { valid: false, errors: ["config must be an object"], commands, rejectedCommands };
+  if (config.version !== 1) errors.push("version must be 1");
+  const validation = config.validation;
+  if (validation !== void 0 && !isRecord(validation)) errors.push("validation must be an object");
+  const rawCommands = isRecord(validation) ? validation.commands : void 0;
+  if (rawCommands !== void 0 && !Array.isArray(rawCommands)) errors.push("validation.commands must be an array");
+  if (Array.isArray(rawCommands)) {
+    rawCommands.forEach((entry, index) => {
+      const normalized = normalizeCommandConfig(entry, `${source}:validation.commands[${index}]`);
+      if (normalized.command) commands.push(normalized.command);
+      if (normalized.rejected) rejectedCommands.push(normalized.rejected);
+    });
+  }
+  if (rejectedCommands.length) errors.push("one or more validation commands are invalid");
+  return { valid: errors.length === 0, errors, commands, rejectedCommands };
+}
+function parseConfigText(path28, text) {
+  if (/\.json$/i.test(path28)) return JSON.parse(text);
+  return yaml.load(text);
+}
+function loadMeshRefineConfig(mesh, workspace) {
+  const policy = mesh?.policy && typeof mesh.policy === "object" && !Array.isArray(mesh.policy) ? mesh.policy : {};
+  const inline = mesh?.refineConfig || policy.refineConfig || policy.refine;
+  if (inline !== void 0) {
+    const validation = validateMeshRefineConfig(inline, "mesh.policy.refineConfig");
+    if (!validation.valid) return { source: "mesh.policy.refineConfig", sourceType: "invalid", error: String(validation.rejectedCommands[0]?.reason || validation.errors.join("; ")) };
+    return { config: inline, source: "mesh.policy.refineConfig", sourceType: "mesh_policy" };
+  }
+  for (const relative3 of MESH_REFINE_CONFIG_LOCATIONS) {
+    const configPath = (0, import_path3.join)(workspace, relative3);
+    if (!(0, import_fs3.existsSync)(configPath)) continue;
+    try {
+      const parsed = parseConfigText(configPath, (0, import_fs3.readFileSync)(configPath, "utf-8"));
+      const validation = validateMeshRefineConfig(parsed, relative3);
+      if (!validation.valid) return { source: relative3, sourceType: "invalid", path: configPath, error: String(validation.rejectedCommands[0]?.reason || validation.errors.join("; ")) };
+      return { config: parsed, source: relative3, sourceType: "repo_file", path: configPath };
+    } catch (error) {
+      return { source: relative3, sourceType: "invalid", path: configPath, error: error?.message || String(error) };
+    }
+  }
+  return {
+    source: "unavailable",
+    sourceType: "unavailable",
+    error: `No repo mesh/refine config found. Checked: ${MESH_REFINE_CONFIG_LOCATIONS.join(", ")}`
+  };
+}
+function readPackageScripts(workspace) {
+  try {
+    const parsed = JSON.parse((0, import_fs3.readFileSync)((0, import_path3.join)(workspace, "package.json"), "utf-8"));
+    return isRecord(parsed?.scripts) ? parsed.scripts : {};
+  } catch {
+    return {};
+  }
+}
+function collectProjectContextSuggestions(mesh) {
+  const commands = mesh?.projectContext?.commands;
+  if (!isRecord(commands)) return [];
+  const suggestions = [];
+  for (const category of MESH_REFINE_VALIDATION_CATEGORIES) {
+    const entries = Array.isArray(commands[category]) ? commands[category] : [];
+    for (const entry of entries) {
+      if (isRecord(entry) && typeof entry.command === "string") suggestions.push({ command: entry.command, category });
+    }
+  }
+  return suggestions;
+}
+function collectPackageScriptSuggestions(workspace) {
+  const scripts = readPackageScripts(workspace);
+  const suggestions = [];
+  for (const category of MESH_REFINE_VALIDATION_CATEGORIES) {
+    for (const scriptName of Object.keys(scripts)) {
+      if (scriptName === category || scriptName.startsWith(`${category}:`)) {
+        suggestions.push({ command: "npm", args: ["run", scriptName], category });
+      }
+    }
+  }
+  return suggestions;
+}
+function suggestMeshRefineConfig(mesh, workspace) {
+  const seen = /* @__PURE__ */ new Set();
+  const suggestions = [];
+  for (const entry of [...collectProjectContextSuggestions(mesh), ...collectPackageScriptSuggestions(workspace)]) {
+    const key = `${entry.command} ${(entry.args || []).join(" ")}`.trim();
+    if (seen.has(key)) continue;
+    seen.add(key);
+    suggestions.push(entry);
+  }
+  return {
+    suggestions,
+    suggestedConfig: suggestions.length ? { version: 1, validation: { required: true, commands: suggestions.slice(0, 4) } } : void 0
+  };
+}
+function resolveMeshRefineValidationPlan(mesh, workspace) {
+  const loaded = loadMeshRefineConfig(mesh, workspace);
+  const suggestion = suggestMeshRefineConfig(mesh, workspace);
+  if (!loaded.config) {
+    return {
+      source: loaded.source,
+      sourceType: loaded.sourceType,
+      commands: [],
+      rejectedCommands: loaded.error ? [{ source: loaded.source, reason: loaded.error }] : [],
+      suggestions: suggestion.suggestions,
+      suggestedConfig: suggestion.suggestedConfig,
+      unavailableReason: loaded.error || "validation_unavailable: repo mesh/refine config missing"
+    };
+  }
+  const validation = validateMeshRefineConfig(loaded.config, loaded.source);
+  return {
+    source: loaded.path || loaded.source,
+    sourceType: loaded.sourceType,
+    commands: validation.commands,
+    rejectedCommands: validation.rejectedCommands,
+    suggestions: suggestion.suggestions,
+    suggestedConfig: suggestion.suggestedConfig,
+    unavailableReason: validation.commands.length ? void 0 : "validation_unavailable: repo mesh/refine config has no validation.commands"
+  };
+}
+
 // src/mesh/mesh-sync.ts
 init_mesh_config();
 async function syncMeshes(transport) {
@@ -7918,6 +8425,7 @@ function buildMeshLedgerReconciliationEvidence(meshId, replicas) {
 
 // src/index.ts
 init_mesh_work_queue();
+init_mesh_host_ownership();
 init_mesh_events();
 
 // src/mesh/p2p-relay-failure.ts
@@ -8031,8 +8539,8 @@ var P2pRelayFailureError = class extends Error {
 };
 
 // src/config/state-store.ts
-var import_fs7 = require("fs");
-var import_path6 = require("path");
+var import_fs8 = require("fs");
+var import_path7 = require("path");
 init_config();
 var DEFAULT_STATE = {
   recentActivity: [],
@@ -8046,7 +8554,7 @@ function isPlainObject2(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function getStatePath() {
-  return (0, import_path6.join)(getConfigDir(), "state.json");
+  return (0, import_path7.join)(getConfigDir(), "state.json");
 }
 function normalizeState(raw) {
   const parsed = isPlainObject2(raw) ? raw : {};
@@ -8082,11 +8590,11 @@ function normalizeState(raw) {
 }
 function loadState() {
   const statePath = getStatePath();
-  if (!(0, import_fs7.existsSync)(statePath)) {
+  if (!(0, import_fs8.existsSync)(statePath)) {
     return { ...DEFAULT_STATE };
   }
   try {
-    const raw = (0, import_fs7.readFileSync)(statePath, "utf-8");
+    const raw = (0, import_fs8.readFileSync)(statePath, "utf-8");
     return normalizeState(JSON.parse(raw));
   } catch {
     return { ...DEFAULT_STATE };
@@ -8095,7 +8603,7 @@ function loadState() {
 function saveState(state) {
   const statePath = getStatePath();
   const normalized = normalizeState(state);
-  (0, import_fs7.writeFileSync)(statePath, JSON.stringify(normalized, null, 2), { encoding: "utf-8", mode: 384 });
+  (0, import_fs8.writeFileSync)(statePath, JSON.stringify(normalized, null, 2), { encoding: "utf-8", mode: 384 });
 }
 function resetState() {
   saveState({ ...DEFAULT_STATE });
@@ -8103,7 +8611,7 @@ function resetState() {
 
 // src/detection/ide-detector.ts
 var import_child_process2 = require("child_process");
-var import_fs8 = require("fs");
+var import_fs9 = require("fs");
 var import_os2 = require("os");
 var path10 = __toESM(require("path"));
 var BUILTIN_IDE_DEFINITIONS = [];
@@ -8127,7 +8635,7 @@ function findCliCommand(command) {
   if (path10.isAbsolute(trimmed) || trimmed.includes("/") || trimmed.includes("\\") || trimmed.startsWith("~")) {
     const candidate = trimmed.startsWith("~") ? path10.join((0, import_os2.homedir)(), trimmed.slice(1)) : trimmed;
     const resolved = path10.isAbsolute(candidate) ? candidate : path10.resolve(candidate);
-    return (0, import_fs8.existsSync)(resolved) ? resolved : null;
+    return (0, import_fs9.existsSync)(resolved) ? resolved : null;
   }
   try {
     const result = (0, import_child_process2.execSync)(
@@ -8158,9 +8666,9 @@ function checkPathExists(paths) {
     if (normalized.includes("*")) {
       const username = home.split(/[\\/]/).pop() || "";
       const resolved = normalized.replace("*", username);
-      if ((0, import_fs8.existsSync)(resolved)) return resolved;
+      if ((0, import_fs9.existsSync)(resolved)) return resolved;
     } else {
-      if ((0, import_fs8.existsSync)(normalized)) return normalized;
+      if ((0, import_fs9.existsSync)(normalized)) return normalized;
     }
   }
   return null;
@@ -8174,7 +8682,7 @@ async function detectIDEs(providerLoader) {
     let resolvedCli = cliPath;
     if (!resolvedCli && appPath && os22 === "darwin") {
       const bundledCli = `${appPath}/Contents/Resources/app/bin/${def.cli}`;
-      if ((0, import_fs8.existsSync)(bundledCli)) resolvedCli = bundledCli;
+      if ((0, import_fs9.existsSync)(bundledCli)) resolvedCli = bundledCli;
     }
     if (!resolvedCli && appPath && os22 === "win32") {
       const { dirname: dirname9 } = await import("path");
@@ -8187,7 +8695,7 @@ async function detectIDEs(providerLoader) {
         `${appDir}\\\\resources\\\\app\\\\bin\\\\${def.cli}.cmd`
       ];
       for (const c of candidates) {
-        if ((0, import_fs8.existsSync)(c)) {
+        if ((0, import_fs9.existsSync)(c)) {
           resolvedCli = c;
           break;
         }
@@ -17340,7 +17848,7 @@ var DaemonCommandHandler = class {
 var os13 = __toESM(require("os"));
 var path18 = __toESM(require("path"));
 var crypto4 = __toESM(require("crypto"));
-var import_fs9 = require("fs");
+var import_fs10 = require("fs");
 var import_child_process6 = require("child_process");
 var import_chalk = __toESM(require("chalk"));
 init_provider_cli_adapter();
@@ -19812,7 +20320,7 @@ function commandExists(command) {
   const trimmed = command.trim();
   if (!trimmed) return false;
   if (isExplicitCommand(trimmed)) {
-    return (0, import_fs9.existsSync)(expandExecutable(trimmed));
+    return (0, import_fs10.existsSync)(expandExecutable(trimmed));
   }
   try {
     (0, import_child_process6.execFileSync)(process.platform === "win32" ? "where" : "which", [trimmed], {
@@ -19841,10 +20349,10 @@ function hasCliArg(args, flag) {
 }
 function ensureEmptyDelegatedMcpConfig(workspace) {
   const baseDir = path18.join(os13.tmpdir(), "adhdev-delegated-agent-empty-mcp");
-  (0, import_fs9.mkdirSync)(baseDir, { recursive: true });
+  (0, import_fs10.mkdirSync)(baseDir, { recursive: true });
   const workspaceHash = crypto4.createHash("sha256").update(path18.resolve(workspace || os13.tmpdir())).digest("hex").slice(0, 16);
   const filePath = path18.join(baseDir, `${workspaceHash}.json`);
-  (0, import_fs9.writeFileSync)(filePath, JSON.stringify({ mcpServers: {} }, null, 2), "utf-8");
+  (0, import_fs10.writeFileSync)(filePath, JSON.stringify({ mcpServers: {} }, null, 2), "utf-8");
   return filePath;
 }
 function buildCoordinatorDelegatedCliLaunchOptions(input) {
@@ -23075,7 +23583,7 @@ function getRecentCommands(count = 50) {
 cleanOldFiles();
 
 // src/commands/router.ts
-var yaml = __toESM(require("js-yaml"));
+var yaml2 = __toESM(require("js-yaml"));
 init_logger();
 
 // src/commands/mesh-coordinator.ts
@@ -23369,6 +23877,7 @@ function normalizeExistingPath(filePath) {
 
 // src/commands/router.ts
 init_mesh_events();
+init_mesh_host_ownership();
 
 // src/status/snapshot.ts
 var os18 = __toESM(require("os"));
@@ -24023,7 +24532,7 @@ async function maybeRunDaemonUpgradeHelperFromEnv() {
 
 // src/commands/router.ts
 var import_os3 = require("os");
-var import_path7 = require("path");
+var import_path8 = require("path");
 var fs10 = __toESM(require("fs"));
 var CHANNEL_NPM_TAG = { stable: "latest", preview: "next" };
 var CHANNEL_SERVER_URL = {
@@ -24664,11 +25173,9 @@ async function resolveProviderTypeFromPriority(args) {
   }
   return { error: `No usable provider detected for node '${args.nodeId}' from providerPriority: ${failed.join("; ")}` };
 }
-var REFINE_VALIDATION_CATEGORIES = ["typecheck", "test", "lint", "build"];
 var REFINE_VALIDATION_TIMEOUT_MS = 12e4;
 var REFINE_VALIDATION_OUTPUT_LIMIT_BYTES = 128 * 1024;
 var REFINE_VALIDATION_SUMMARY_CHARS = 2e3;
-var REFINE_VALIDATION_MAX_COMMANDS = 4;
 var REFINE_PATCH_EQUIVALENCE_OUTPUT_LIMIT_BYTES = 4 * 1024 * 1024;
 function truncateValidationOutput(value) {
   const text = typeof value === "string" ? value : value == null ? "" : String(value);
@@ -24752,141 +25259,30 @@ async function runMeshRefinePatchEquivalenceGate(repoRoot, baseHead, branchHead)
     };
   }
 }
-function readPackageScripts(workspace) {
-  try {
-    const packageJsonPath = (0, import_path7.join)(workspace, "package.json");
-    const parsed = JSON.parse(fs10.readFileSync(packageJsonPath, "utf-8"));
-    return parsed?.scripts && typeof parsed.scripts === "object" && !Array.isArray(parsed.scripts) ? parsed.scripts : {};
-  } catch {
-    return {};
-  }
-}
-function tokenizeValidationCommand(command) {
-  const trimmed = command.trim();
-  if (!trimmed) return null;
-  if (/[;&|<>`$\\\n\r'\"]/.test(trimmed)) return null;
-  const tokens = trimmed.split(/\s+/).filter(Boolean);
-  if (!tokens.length) return null;
-  if (tokens.some((token) => !/^[A-Za-z0-9_@./:=+-]+$/.test(token))) return null;
-  return tokens;
-}
-function scriptMatchesValidationCategory(scriptName, category) {
-  return scriptName === category || scriptName.startsWith(`${category}:`);
-}
-function parsePackageManagerValidationCommand(rawCommand, category, scripts, source) {
-  const tokens = tokenizeValidationCommand(rawCommand);
-  if (!tokens) {
-    return { rejected: { command: rawCommand, category, source, reason: "unsafe command string is not allowlisted" } };
-  }
-  const [binary, second, third, ...rest] = tokens;
-  let scriptName = "";
-  let command = binary;
-  let args = [];
-  if ((binary === "npm" || binary === "pnpm" || binary === "bun") && second === "run" && third) {
-    scriptName = third;
-    args = ["run", scriptName, ...rest];
-  } else if (binary === "npm" && second === "test" && !third) {
-    scriptName = "test";
-    args = ["test"];
-  } else if (binary === "yarn" && second === "run" && third) {
-    scriptName = third;
-    args = ["run", scriptName, ...rest];
-  } else if (binary === "yarn" && second && !third) {
-    scriptName = second;
-    args = [scriptName];
-  } else {
-    return { rejected: { command: rawCommand, category, source, reason: "command is not a supported package-manager script invocation" } };
-  }
-  if (!scriptName || !Object.prototype.hasOwnProperty.call(scripts, scriptName)) {
-    return { rejected: { command: rawCommand, category, source, script: scriptName, reason: "script is not declared in package.json" } };
-  }
-  if (!scriptMatchesValidationCategory(scriptName, category)) {
-    return { rejected: { command: rawCommand, category, source, script: scriptName, reason: "script name is outside the validation category allowlist" } };
-  }
-  return {
-    command: {
-      command,
-      args,
-      displayCommand: [command, ...args].join(" "),
-      category,
-      source
-    }
-  };
-}
-function collectProjectContextValidationCandidates(mesh) {
-  const commands = mesh?.projectContext?.commands;
-  if (!commands || typeof commands !== "object" || Array.isArray(commands)) return [];
-  const candidates = [];
-  for (const category of REFINE_VALIDATION_CATEGORIES) {
-    const entries = Array.isArray(commands[category]) ? commands[category] : [];
-    for (const entry of entries) {
-      if (typeof entry?.command !== "string") continue;
-      candidates.push({
-        command: entry.command,
-        category,
-        source: typeof entry.sourcePath === "string" ? entry.sourcePath : "projectContext.commands",
-        confidence: typeof entry.confidence === "string" ? entry.confidence : void 0
-      });
-    }
-  }
-  return candidates.sort((a, b) => {
-    const rank = (value) => value === "high" ? 0 : value === "medium" ? 1 : 2;
-    return rank(a.confidence) - rank(b.confidence);
-  });
-}
-function collectPolicyValidationCandidates(mesh) {
-  const policy = mesh?.policy && typeof mesh.policy === "object" && !Array.isArray(mesh.policy) ? mesh.policy : {};
-  const configured = Array.isArray(policy.validationCommands) ? policy.validationCommands : Array.isArray(policy.validationGate?.commands) ? policy.validationGate.commands : [];
-  return configured.map((entry) => typeof entry === "string" ? { command: entry, category: "", source: "mesh.policy.validationCommands" } : entry).filter((entry) => entry && typeof entry.command === "string").map((entry) => {
-    const commandText = entry.command.trim();
-    const category = REFINE_VALIDATION_CATEGORIES.find((cat) => commandText.includes(` ${cat}`)) ?? "";
-    return { command: commandText, category, source: "mesh.policy.validationCommands" };
-  }).filter((entry) => !!entry.category);
-}
-function selectMeshRefineValidationCommands(mesh, workspace) {
-  const scripts = readPackageScripts(workspace);
-  const rejectedCommands = [];
-  const selected = [];
-  const seen = /* @__PURE__ */ new Set();
-  const candidates = [
-    ...collectPolicyValidationCandidates(mesh),
-    ...collectProjectContextValidationCandidates(mesh)
-  ];
-  for (const candidate of candidates) {
-    const parsed = parsePackageManagerValidationCommand(candidate.command, candidate.category, scripts, candidate.source);
-    if (parsed.rejected) {
-      rejectedCommands.push(parsed.rejected);
-      continue;
-    }
-    if (!parsed.command || seen.has(parsed.command.displayCommand)) continue;
-    selected.push(parsed.command);
-    seen.add(parsed.command.displayCommand);
-    if (selected.length >= REFINE_VALIDATION_MAX_COMMANDS) break;
-  }
-  if (!selected.length && candidates.length === 0) {
-    for (const category of REFINE_VALIDATION_CATEGORIES) {
-      if (!Object.prototype.hasOwnProperty.call(scripts, category)) continue;
-      const fallback = parsePackageManagerValidationCommand(`npm run ${category}`, category, scripts, "package.json:scripts");
-      if (fallback.command && !seen.has(fallback.command.displayCommand)) {
-        selected.push(fallback.command);
-        seen.add(fallback.command.displayCommand);
-      } else if (fallback.rejected) {
-        rejectedCommands.push(fallback.rejected);
-      }
-      if (selected.length >= 2) break;
-    }
-  }
+function buildMeshRefineValidationPlan(mesh, workspace) {
+  const plan = resolveMeshRefineValidationPlan(mesh, workspace);
   return {
-    commands: selected,
-    rejectedCommands,
-    source: selected.some((command) => command.source === "mesh.policy.validationCommands") ? "mesh_policy" : selected.some((command) => command.source !== "package.json:scripts") ? "project_context" : selected.length ? "package_json_scripts" : "unavailable"
+    source: plan.source,
+    sourceType: plan.sourceType,
+    commands: plan.commands.map((command) => ({
+      displayCommand: command.displayCommand,
+      category: command.category,
+      source: command.source,
+      cwd: command.cwd,
+      timeoutMs: command.timeoutMs
+    })),
+    unavailableReason: plan.unavailableReason,
+    rejectedCommands: plan.rejectedCommands,
+    suggestions: plan.suggestions,
+    suggestedConfig: plan.suggestedConfig,
+    note: plan.sourceType === "unavailable" ? "No validation command will be executed until a repo mesh/refine config is provided. Heuristics are suggestions only." : "Validation commands are resolved from repo mesh/refine config; heuristics are suggestions only."
   };
 }
 async function runMeshRefineValidationGate(mesh, workspace) {
   const { execFile: execFile3 } = await import("child_process");
   const { promisify: promisify3 } = await import("util");
   const execFileAsync3 = promisify3(execFile3);
-  const selection = selectMeshRefineValidationCommands(mesh, workspace);
+  const selection = resolveMeshRefineValidationPlan(mesh, workspace);
   const summary = {
     status: "skipped",
     required: true,
@@ -24894,21 +25290,27 @@ async function runMeshRefineValidationGate(mesh, workspace) {
     rejectedCommands: selection.rejectedCommands,
     skippedReason: void 0,
     timeoutMs: REFINE_VALIDATION_TIMEOUT_MS,
-    outputLimitBytes: REFINE_VALIDATION_OUTPUT_LIMIT_BYTES
+    outputLimitBytes: REFINE_VALIDATION_OUTPUT_LIMIT_BYTES,
+    configSource: selection.source,
+    configSourceType: selection.sourceType,
+    suggestions: selection.suggestions,
+    suggestedConfig: selection.suggestedConfig
   };
   if (!selection.commands.length) {
-    summary.skippedReason = "validation_unavailable: no allowlisted projectContext, mesh policy, or package.json build/test/typecheck/lint command was available";
+    summary.skippedReason = selection.unavailableReason || "validation_unavailable: repo mesh/refine config did not provide executable validation.commands";
     return summary;
   }
   for (const candidate of selection.commands) {
     const startedAt = Date.now();
+    const cwd = candidate.cwd ? (0, import_path8.resolve)(workspace, candidate.cwd) : workspace;
+    const timeout = candidate.timeoutMs || REFINE_VALIDATION_TIMEOUT_MS;
     try {
       const result = await execFileAsync3(candidate.command, candidate.args, {
-        cwd: workspace,
+        cwd,
         encoding: "utf8",
-        timeout: REFINE_VALIDATION_TIMEOUT_MS,
+        timeout,
         maxBuffer: REFINE_VALIDATION_OUTPUT_LIMIT_BYTES,
-        env: { ...process.env, CI: process.env.CI || "1" }
+        env: { ...process.env, CI: process.env.CI || "1", ...candidate.env || {} }
       });
       summary.commandsRun.push({
         command: candidate.command,
@@ -24916,6 +25318,7 @@ async function runMeshRefineValidationGate(mesh, workspace) {
         displayCommand: candidate.displayCommand,
         category: candidate.category,
         source: candidate.source,
+        cwd,
         passed: true,
         exitCode: 0,
         durationMs: Date.now() - startedAt,
@@ -24929,6 +25332,7 @@ async function runMeshRefineValidationGate(mesh, workspace) {
         displayCommand: candidate.displayCommand,
         category: candidate.category,
         source: candidate.source,
+        cwd,
         passed: false,
         exitCode: typeof error?.code === "number" ? error.code : null,
         signal: typeof error?.signal === "string" ? error.signal : null,
@@ -24945,7 +25349,7 @@ async function runMeshRefineValidationGate(mesh, workspace) {
   return summary;
 }
 function loadYamlModule() {
-  return yaml;
+  return yaml2;
 }
 function getMcpServersKey(format) {
   return format === "hermes_config_yaml" ? "mcp_servers" : "mcpServers";
@@ -24962,13 +25366,13 @@ function serializeMeshCoordinatorMcpConfig(config, format) {
 }
 function resolveHermesUserHome() {
   const explicitHome = process.env.HERMES_HOME?.trim();
-  return explicitHome || (0, import_path7.join)((0, import_os3.homedir)(), ".hermes");
+  return explicitHome || (0, import_path8.join)((0, import_os3.homedir)(), ".hermes");
 }
 function loadHermesCoordinatorBaseConfig(targetConfigPath) {
   const sourceHome = resolveHermesUserHome();
-  const sourceConfigPath = (0, import_path7.join)(sourceHome, "config.yaml");
+  const sourceConfigPath = (0, import_path8.join)(sourceHome, "config.yaml");
   if (!fs10.existsSync(sourceConfigPath)) return { config: {}, sourceHome, sourceConfigPath };
-  if ((0, import_path7.resolve)(sourceConfigPath) === (0, import_path7.resolve)(targetConfigPath)) return { config: {}, sourceHome, sourceConfigPath };
+  if ((0, import_path8.resolve)(sourceConfigPath) === (0, import_path8.resolve)(targetConfigPath)) return { config: {}, sourceHome, sourceConfigPath };
   const parsed = parseMeshCoordinatorMcpConfig(fs10.readFileSync(sourceConfigPath, "utf-8"), "hermes_config_yaml");
   const { mcp_servers: _mcpServers, ...baseConfig } = parsed;
   return { config: baseConfig, sourceHome, sourceConfigPath };
@@ -25002,10 +25406,10 @@ function stripHermesCoordinatorTempModelProviderOverrides(config) {
   return sanitized;
 }
 function copyHermesCoordinatorCredentialFiles(sourceHome, targetHome) {
-  if ((0, import_path7.resolve)(sourceHome) === (0, import_path7.resolve)(targetHome)) return;
+  if ((0, import_path8.resolve)(sourceHome) === (0, import_path8.resolve)(targetHome)) return;
   for (const fileName of [".env", "auth.json"]) {
-    const sourcePath = (0, import_path7.join)(sourceHome, fileName);
-    const targetPath = (0, import_path7.join)(targetHome, fileName);
+    const sourcePath = (0, import_path8.join)(sourceHome, fileName);
+    const targetPath = (0, import_path8.join)(targetHome, fileName);
     if (!fs10.existsSync(sourcePath)) continue;
     try {
       fs10.copyFileSync(sourcePath, targetPath);
@@ -25103,6 +25507,34 @@ function summarizeSessionHostPruneResult(result) {
     keptCount: Array.isArray(value.keptSessionIds) ? value.keptSessionIds.length : void 0
   };
 }
+function normalizeStandaloneHostCommandUrl(hostAddress) {
+  const raw = hostAddress.trim();
+  if (!raw) throw new Error("hostAddress required");
+  const url = new URL(raw.replace(/^ws:/, "http:").replace(/^wss:/, "https:"));
+  url.pathname = "/api/v1/command";
+  url.search = "";
+  url.hash = "";
+  return url.toString();
+}
+function buildMemberJoinNode(mesh, args, fallbackDaemonId) {
+  const requestedNodeId = typeof args?.memberNodeId === "string" ? args.memberNodeId.trim() : "";
+  const explicit = args?.memberNode && typeof args.memberNode === "object" && !Array.isArray(args.memberNode) ? args.memberNode : null;
+  const configured = Array.isArray(mesh?.nodes) ? requestedNodeId ? mesh.nodes.find((node) => node?.id === requestedNodeId || node?.nodeId === requestedNodeId) : mesh.nodes[0] : null;
+  const source = explicit || configured;
+  const workspace = typeof source?.workspace === "string" && source.workspace.trim() ? source.workspace.trim() : typeof args?.workspace === "string" && args.workspace.trim() ? args.workspace.trim() : process.cwd();
+  if (!workspace) return null;
+  const nodeId = typeof source?.id === "string" && source.id.trim() ? source.id.trim() : typeof source?.nodeId === "string" && source.nodeId.trim() ? source.nodeId.trim() : void 0;
+  return {
+    ...nodeId ? { id: nodeId } : {},
+    workspace,
+    ...typeof source?.repoRoot === "string" && source.repoRoot.trim() ? { repoRoot: source.repoRoot.trim() } : {},
+    ...typeof source?.daemonId === "string" && source.daemonId.trim() ? { daemonId: source.daemonId.trim() } : fallbackDaemonId ? { daemonId: fallbackDaemonId } : {},
+    ...typeof source?.machineId === "string" && source.machineId.trim() ? { machineId: source.machineId.trim() } : {},
+    userOverrides: source?.userOverrides && typeof source.userOverrides === "object" && !Array.isArray(source.userOverrides) ? source.userOverrides : {},
+    policy: source?.policy && typeof source.policy === "object" && !Array.isArray(source.policy) ? source.policy : {},
+    role: "member"
+  };
+}
 var DaemonCommandRouter = class {
   deps;
   /** In-memory cache for cloud-originating meshes passed via inlineMesh.
@@ -25276,6 +25708,16 @@ var DaemonCommandRouter = class {
   invalidateAggregateMeshStatus(meshId) {
     this.aggregateMeshStatusCache.delete(meshId);
   }
+  async requireMeshHostMutationOwner(meshId, inlineMesh, operation) {
+    const meshRecord = await this.getMeshForCommand(meshId, inlineMesh, { preferInline: true });
+    const mesh = meshRecord?.mesh;
+    if (!mesh) return { success: false, error: "Mesh not found" };
+    const meshHost = resolveMeshHostStatus(mesh);
+    if (!meshHost.canOwnCoordinator || !meshHost.canOwnQueue) {
+      return { ...buildMeshHostRequiredFailure(mesh, operation), success: false, meshId };
+    }
+    return null;
+  }
   updateInlineMeshNode(meshId, mesh, node) {
     if (!mesh || !Array.isArray(mesh.nodes) || !node?.id) return;
     const idx = mesh.nodes.findIndex((entry) => entry?.id === node.id || entry?.nodeId === node.id);
@@ -25341,7 +25783,7 @@ var DaemonCommandRouter = class {
     }
     const { resolveWorktreePath: resolveWorktreePath2, listWorktrees: listWorktrees2, removeWorktree: removeWorktree2 } = await Promise.resolve().then(() => (init_git_worktree(), git_worktree_exports));
     const normalizePath = (value) => {
-      const resolved = (0, import_path7.resolve)(value);
+      const resolved = (0, import_path8.resolve)(value);
       try {
         return fs10.realpathSync(resolved);
       } catch {
@@ -26314,7 +26756,8 @@ var DaemonCommandRouter = class {
         if (!name) return { success: false, error: "name required" };
         try {
           const { createMesh: createMesh2 } = await Promise.resolve().then(() => (init_mesh_config(), mesh_config_exports));
-          const mesh = createMesh2({ name, repoIdentity, repoRemoteUrl, defaultBranch, policy: args?.policy });
+          const meshHost = args?.meshHost && typeof args.meshHost === "object" && !Array.isArray(args.meshHost) ? args.meshHost : void 0;
+          const mesh = createMesh2({ name, repoIdentity, repoRemoteUrl, defaultBranch, policy: args?.policy, meshHost });
           return { success: true, mesh };
         } catch (e) {
           return { success: false, error: e.message };
@@ -26330,6 +26773,7 @@ var DaemonCommandRouter = class {
           if (typeof args?.defaultBranch === "string") patch.defaultBranch = args.defaultBranch;
           if (args?.policy && typeof args.policy === "object" && !Array.isArray(args.policy)) patch.policy = args.policy;
           if (args?.coordinator && typeof args.coordinator === "object" && !Array.isArray(args.coordinator)) patch.coordinator = args.coordinator;
+          if (args?.meshHost && typeof args.meshHost === "object" && !Array.isArray(args.meshHost)) patch.meshHost = args.meshHost;
           if (!Object.keys(patch).length) return { success: false, error: "No updates provided" };
           const mesh = updateMesh2(meshId, patch);
           if (!mesh) return { success: false, error: "Mesh not found" };
@@ -26340,6 +26784,215 @@ var DaemonCommandRouter = class {
           return { success: false, error: e.message };
         }
       }
+      case "get_mesh_host_pairing": {
+        const meshId = typeof args?.meshId === "string" ? args.meshId.trim() : "";
+        if (!meshId) return { success: false, error: "meshId required" };
+        const meshRecord = await this.getMeshForCommand(meshId, args?.inlineMesh, { preferInline: true });
+        const mesh = meshRecord?.mesh;
+        if (!mesh) return { success: false, error: "Mesh not found" };
+        const meshHost = resolveMeshHostStatus(mesh);
+        const pairingStatus = meshHost.pairing?.status || "not_configured";
+        return {
+          success: true,
+          code: pairingStatus === "not_configured" ? "mesh_host_pairing_not_configured" : "mesh_host_pairing_pending",
+          meshId,
+          hostAddress: meshHost.hostAddress,
+          meshHost,
+          manualPairing: {
+            status: pairingStatus,
+            joinImplemented: true,
+            protocol: "standalone_command_direct_v1",
+            description: "Standalone manual pairing can save address/token metadata, apply a host join over direct standalone command HTTP or injected mesh command dispatch, and check persisted status. P2P signaling remains outside this slice."
+          }
+        };
+      }
+      case "configure_mesh_host_pairing": {
+        const meshId = typeof args?.meshId === "string" ? args.meshId.trim() : "";
+        const hostAddress = typeof args?.hostAddress === "string" ? args.hostAddress.trim() : "";
+        const token = typeof args?.token === "string" ? args.token.trim() : "";
+        if (!meshId) return { success: false, error: "meshId required" };
+        if (!hostAddress || !token) return { success: false, error: "hostAddress and token required" };
+        try {
+          const { configureMeshHostPairing: configureMeshHostPairing2 } = await Promise.resolve().then(() => (init_mesh_config(), mesh_config_exports));
+          const configured = configureMeshHostPairing2(meshId, { hostAddress, token });
+          if (!configured) return { success: false, error: "Mesh not found" };
+          this.inlineMeshCache.set(meshId, configured.mesh);
+          const meshHost = resolveMeshHostStatus(configured.mesh);
+          return {
+            success: true,
+            code: "mesh_host_pairing_pending",
+            meshId,
+            hostAddress: configured.hostAddress,
+            meshHost,
+            manualPairing: {
+              status: meshHost.pairing?.status || "pairing",
+              joinImplemented: true,
+              protocol: "standalone_command_direct_v1",
+              description: "Manual Mesh Host pairing config was saved locally. Use join_mesh_host_pairing to apply it to the host. Raw token was not persisted."
+            }
+          };
+        } catch (e) {
+          return { success: false, code: "mesh_host_pairing_invalid", meshId, hostAddress, error: e.message };
+        }
+      }
+      case "create_mesh_host_pairing_token": {
+        const meshId = typeof args?.meshId === "string" ? args.meshId.trim() : "";
+        if (!meshId) return { success: false, error: "meshId required" };
+        try {
+          const { createMeshHostPairingToken: createMeshHostPairingToken2 } = await Promise.resolve().then(() => (init_mesh_config(), mesh_config_exports));
+          const created = createMeshHostPairingToken2(meshId, {
+            token: typeof args?.token === "string" ? args.token : void 0,
+            expiresAt: typeof args?.expiresAt === "string" ? args.expiresAt : void 0
+          });
+          if (!created) return { success: false, error: "Mesh not found" };
+          this.inlineMeshCache.set(meshId, created.mesh);
+          this.invalidateAggregateMeshStatus(meshId);
+          return {
+            success: true,
+            code: "mesh_host_pairing_token_created",
+            meshId,
+            token: created.token,
+            tokenId: created.tokenId,
+            expiresAt: created.expiresAt,
+            meshHost: resolveMeshHostStatus(created.mesh),
+            warning: "Raw token is returned once and is not persisted; share it with member daemons over a trusted channel."
+          };
+        } catch (e) {
+          return { success: false, code: "mesh_host_pairing_token_invalid", meshId, error: e.message };
+        }
+      }
+      case "apply_mesh_host_join": {
+        const meshId = typeof args?.meshId === "string" ? args.meshId.trim() : "";
+        const token = typeof args?.token === "string" ? args.token.trim() : "";
+        const memberNode = args?.memberNode && typeof args.memberNode === "object" && !Array.isArray(args.memberNode) ? args.memberNode : null;
+        if (!meshId) return { success: false, error: "meshId required" };
+        if (!token || !memberNode) return { success: false, error: "token and memberNode required" };
+        try {
+          const { applyMeshHostJoinRequest: applyMeshHostJoinRequest2 } = await Promise.resolve().then(() => (init_mesh_config(), mesh_config_exports));
+          const applied = applyMeshHostJoinRequest2(meshId, {
+            token,
+            memberNode,
+            memberMeshId: typeof args?.memberMeshId === "string" ? args.memberMeshId : void 0
+          });
+          if (!applied) return { success: false, error: "Mesh not found" };
+          if (!applied.accepted) {
+            return {
+              success: false,
+              code: "mesh_host_join_rejected",
+              meshId,
+              tokenId: applied.tokenId,
+              meshHost: applied.meshHost ? resolveMeshHostStatus({ meshHost: applied.meshHost }) : void 0,
+              error: applied.reason
+            };
+          }
+          this.inlineMeshCache.set(meshId, applied.mesh);
+          this.invalidateAggregateMeshStatus(meshId);
+          try {
+            const { appendLedgerEntry: appendLedgerEntry2 } = await Promise.resolve().then(() => (init_mesh_ledger(), mesh_ledger_exports));
+            appendLedgerEntry2(meshId, {
+              kind: "node_joined",
+              nodeId: applied.node.id,
+              payload: { role: "member", tokenId: applied.tokenId, workspace: applied.node.workspace }
+            });
+          } catch {
+          }
+          return {
+            success: true,
+            code: "mesh_host_join_accepted",
+            meshId,
+            node: applied.node,
+            tokenId: applied.tokenId,
+            meshHost: resolveMeshHostStatus(applied.mesh)
+          };
+        } catch (e) {
+          return { success: false, code: "mesh_host_join_failed", meshId, error: e.message };
+        }
+      }
+      case "join_mesh_host_pairing": {
+        const meshId = typeof args?.meshId === "string" ? args.meshId.trim() : "";
+        const token = typeof args?.token === "string" ? args.token.trim() : "";
+        if (!meshId) return { success: false, error: "meshId required" };
+        if (!token) return { success: false, error: "token required because raw pairing tokens are not persisted" };
+        const meshRecord = await this.getMeshForCommand(meshId, args?.inlineMesh, { preferInline: true });
+        const mesh = meshRecord?.mesh;
+        if (!mesh) return { success: false, error: "Mesh not found" };
+        const meshHost = resolveMeshHostStatus(mesh);
+        if (meshHost.role !== "member") {
+          return { success: false, code: "mesh_host_join_not_member", meshId, meshHost, error: "join_mesh_host_pairing must run from a member daemon configured with a Mesh Host address/token." };
+        }
+        try {
+          const { tokenIdForManualPairing: tokenIdForManualPairing2, markMeshHostPairingJoined: markMeshHostPairingJoined2 } = await Promise.resolve().then(() => (init_mesh_config(), mesh_config_exports));
+          const tokenId = tokenIdForManualPairing2(token);
+          if (meshHost.pairing?.tokenId && meshHost.pairing.tokenId !== tokenId) {
+            return { success: false, code: "mesh_host_join_rejected", meshId, tokenId, meshHost, error: "invalid pairing token" };
+          }
+          const memberNode = buildMemberJoinNode(mesh, args, this.deps.statusInstanceId);
+          if (!memberNode) return { success: false, error: "member node metadata unavailable" };
+          const hostMeshId = typeof args?.hostMeshId === "string" && args.hostMeshId.trim() ? args.hostMeshId.trim() : meshId;
+          const hostDaemonId = typeof args?.hostDaemonId === "string" && args.hostDaemonId.trim() ? args.hostDaemonId.trim() : meshHost.hostDaemonId;
+          let hostResult;
+          let transport;
+          if (hostDaemonId && this.deps.dispatchMeshCommand) {
+            transport = "mesh_command_dispatch";
+            hostResult = await this.deps.dispatchMeshCommand(hostDaemonId, "apply_mesh_host_join", {
+              meshId: hostMeshId,
+              token,
+              memberMeshId: meshId,
+              memberNode
+            });
+          } else if (meshHost.hostAddress) {
+            transport = "standalone_http_command";
+            const commandUrl = normalizeStandaloneHostCommandUrl(meshHost.hostAddress);
+            const response = await fetch(commandUrl, {
+              method: "POST",
+              headers: { "Content-Type": "application/json" },
+              body: JSON.stringify({ type: "apply_mesh_host_join", payload: { meshId: hostMeshId, token, memberMeshId: meshId, memberNode } })
+            });
+            hostResult = await response.json().catch(() => ({ success: false, error: `Host returned HTTP ${response.status}` }));
+            if (!response.ok && hostResult?.success !== false) hostResult = { success: false, error: `Host returned HTTP ${response.status}` };
+          } else {
+            return {
+              success: false,
+              code: "mesh_host_join_transport_unavailable",
+              meshId,
+              meshHost,
+              error: "No hostDaemonId dispatch path or hostAddress HTTP command path is available. P2P signaling join is not implemented in this slice."
+            };
+          }
+          if (!hostResult?.success) {
+            return { success: false, code: hostResult?.code || "mesh_host_join_rejected", meshId, meshHost, transport, error: hostResult?.error || "Mesh Host rejected join request", hostResult };
+          }
+          const joined = meshRecord.inline ? null : markMeshHostPairingJoined2(meshId, {
+            tokenId: hostResult.tokenId || tokenId,
+            hostDaemonId: hostResult.meshHost?.hostDaemonId || hostDaemonId,
+            hostNodeId: hostResult.meshHost?.hostNodeId,
+            joinedAt: hostResult.meshHost?.pairing?.joinedAt
+          });
+          if (joined) {
+            this.inlineMeshCache.set(meshId, joined.mesh);
+            this.invalidateAggregateMeshStatus(meshId);
+          }
+          return {
+            success: true,
+            code: "mesh_host_join_applied",
+            meshId,
+            hostMeshId,
+            transport,
+            node: hostResult.node,
+            tokenId: hostResult.tokenId || tokenId,
+            meshHost: joined ? resolveMeshHostStatus(joined.mesh) : { ...meshHost, pairing: { ...meshHost.pairing || {}, status: "paired", tokenId: hostResult.tokenId || tokenId } },
+            hostResult,
+            manualPairing: {
+              status: "paired",
+              joinImplemented: true,
+              protocol: "standalone_command_direct_v1",
+              description: "Mesh Host accepted the join and local member pairing status was marked paired. P2P runtime signaling remains outside this slice."
+            }
+          };
+        } catch (e) {
+          return { success: false, code: "mesh_host_join_failed", meshId, meshHost, error: e.message };
+        }
+      }
       case "delete_mesh": {
         const meshId = typeof args?.meshId === "string" ? args.meshId.trim() : "";
         if (!meshId) return { success: false, error: "meshId required" };
@@ -26422,6 +27075,8 @@ var DaemonCommandRouter = class {
         const meshId = typeof args?.meshId === "string" ? args.meshId.trim() : "";
         const taskId = typeof args?.taskId === "string" ? args.taskId.trim() : "";
         if (!meshId || !taskId) return { success: false, error: "meshId and taskId required" };
+        const ownerFailure = await this.requireMeshHostMutationOwner(meshId, args?.inlineMesh, "queue cancellation");
+        if (ownerFailure) return ownerFailure;
         try {
           const { cancelTask: cancelTask2 } = await Promise.resolve().then(() => (init_mesh_work_queue(), mesh_work_queue_exports));
           const reason = typeof args?.reason === "string" ? args.reason : void 0;
@@ -26436,6 +27091,8 @@ var DaemonCommandRouter = class {
         const meshId = typeof args?.meshId === "string" ? args.meshId.trim() : "";
         const taskId = typeof args?.taskId === "string" ? args.taskId.trim() : "";
         if (!meshId || !taskId) return { success: false, error: "meshId and taskId required" };
+        const ownerFailure = await this.requireMeshHostMutationOwner(meshId, args?.inlineMesh, "queue requeue");
+        if (ownerFailure) return ownerFailure;
         try {
           const { requeueTask: requeueTask2 } = await Promise.resolve().then(() => (init_mesh_work_queue(), mesh_work_queue_exports));
           const task = requeueTask2(meshId, taskId, {
@@ -26456,6 +27113,8 @@ var DaemonCommandRouter = class {
         const workspace = typeof args?.workspace === "string" ? args.workspace.trim() : "";
         if (!meshId) return { success: false, error: "meshId required" };
         if (!workspace) return { success: false, error: "workspace required" };
+        const ownerFailure = await this.requireMeshHostMutationOwner(meshId, args?.inlineMesh, "node addition");
+        if (ownerFailure) return ownerFailure;
         try {
           const { addNode: addNode3 } = await Promise.resolve().then(() => (init_mesh_config(), mesh_config_exports));
           const providerPriority = Array.isArray(args?.providerPriority) ? args.providerPriority.map((type) => typeof type === "string" ? type.trim() : "").filter(Boolean) : [];
@@ -26464,7 +27123,8 @@ var DaemonCommandRouter = class {
             ...readOnly ? { readOnly: true } : {},
             ...providerPriority.length ? { providerPriority } : {}
           };
-          const node = addNode3(meshId, { workspace, ...policy ? { policy } : {} });
+          const role = normalizeMeshDaemonRole(args?.role);
+          const node = addNode3(meshId, { workspace, ...policy ? { policy } : {}, ...role ? { role } : {} });
           if (!node) return { success: false, error: "Mesh not found" };
           return { success: true, node };
         } catch (e) {
@@ -26475,6 +27135,8 @@ var DaemonCommandRouter = class {
         const meshId = typeof args?.meshId === "string" ? args.meshId.trim() : "";
         const nodeId = typeof args?.nodeId === "string" ? args.nodeId.trim() : "";
         if (!meshId || !nodeId) return { success: false, error: "meshId and nodeId required" };
+        const ownerFailure = await this.requireMeshHostMutationOwner(meshId, args?.inlineMesh, "node update");
+        if (ownerFailure) return ownerFailure;
         try {
           const { updateNode: updateNode2 } = await Promise.resolve().then(() => (init_mesh_config(), mesh_config_exports));
           const policy = args?.policy && typeof args.policy === "object" && !Array.isArray(args.policy) ? { ...args.policy } : {};
@@ -26498,6 +27160,8 @@ var DaemonCommandRouter = class {
         const meshId = typeof args?.meshId === "string" ? args.meshId.trim() : "";
         const nodeId = typeof args?.nodeId === "string" ? args.nodeId.trim() : "";
         if (!meshId || !nodeId) return { success: false, error: "meshId and nodeId required" };
+        const ownerFailure = await this.requireMeshHostMutationOwner(meshId, args?.inlineMesh, "node removal");
+        if (ownerFailure) return ownerFailure;
         try {
           const meshRecord = await this.getMeshForCommand(meshId, args?.inlineMesh);
           const mesh = meshRecord?.mesh;
@@ -26520,6 +27184,49 @@ var DaemonCommandRouter = class {
           return { success: false, error: e.message };
         }
       }
+      case "get_mesh_refine_config_schema": {
+        return {
+          success: true,
+          schema: MESH_REFINE_CONFIG_SCHEMA,
+          locations: MESH_REFINE_CONFIG_LOCATIONS,
+          sourceOfTruth: "repo mesh/refine config",
+          heuristicRole: "suggestions_only_not_execution_path"
+        };
+      }
+      case "validate_mesh_refine_config": {
+        const workspace = typeof args?.workspace === "string" ? args.workspace : process.cwd();
+        const mesh = args?.inlineMesh || {};
+        const loaded = args?.config !== void 0 ? { config: args.config, source: "inline", sourceType: "mesh_policy" } : loadMeshRefineConfig(mesh, workspace);
+        const validation = loaded.config ? validateMeshRefineConfig(loaded.config, loaded.source) : { valid: false, errors: [loaded.error || "repo mesh/refine config unavailable"], commands: [], rejectedCommands: [] };
+        return { success: validation.valid, ...loaded, ...validation };
+      }
+      case "suggest_mesh_refine_config": {
+        const workspace = typeof args?.workspace === "string" ? args.workspace : process.cwd();
+        const mesh = args?.inlineMesh || {};
+        return {
+          success: true,
+          ...suggestMeshRefineConfig(mesh, workspace),
+          note: "Suggestions are heuristic scaffold only; Refinery will not execute them until saved into repo mesh/refine config."
+        };
+      }
+      case "plan_mesh_refine_node": {
+        const meshId = typeof args?.meshId === "string" ? args.meshId.trim() : "";
+        const nodeId = typeof args?.nodeId === "string" ? args.nodeId.trim() : "";
+        if (!meshId || !nodeId) return { success: false, error: "meshId and nodeId required" };
+        const meshRecord = await this.getMeshForCommand(meshId, args?.inlineMesh);
+        const mesh = meshRecord?.mesh;
+        const node = mesh?.nodes?.find((n) => n.id === nodeId || n.nodeId === nodeId);
+        if (!node?.workspace) return { success: false, error: `Node '${nodeId}' workspace not found` };
+        return {
+          success: true,
+          dryRun: true,
+          nodeId,
+          workspace: node.workspace,
+          validationPlan: buildMeshRefineValidationPlan(mesh, node.workspace),
+          mergeWillRun: false,
+          cleanupWillRun: false
+        };
+      }
       case "refine_mesh_node": {
         const meshId = typeof args?.meshId === "string" ? args.meshId.trim() : "";
         const nodeId = typeof args?.nodeId === "string" ? args.nodeId.trim() : "";
@@ -26805,6 +27512,8 @@ var DaemonCommandRouter = class {
         if (!meshId) return { success: false, error: "meshId required" };
         if (!sourceNodeId) return { success: false, error: "sourceNodeId required" };
         if (!branch) return { success: false, error: "branch required" };
+        const ownerFailure = await this.requireMeshHostMutationOwner(meshId, args?.inlineMesh, "worktree clone");
+        if (ownerFailure) return ownerFailure;
         try {
           const meshRecord = await this.getMeshForCommand(meshId, args?.inlineMesh);
           const mesh = meshRecord?.mesh;
@@ -26886,6 +27595,8 @@ var DaemonCommandRouter = class {
       case "trigger_mesh_queue": {
         const meshId = typeof args?.meshId === "string" ? args.meshId.trim() : "";
         if (!meshId) return { success: false, error: "meshId required" };
+        const ownerFailure = await this.requireMeshHostMutationOwner(meshId, args?.inlineMesh, "queue trigger");
+        if (ownerFailure) return ownerFailure;
         try {
           const { triggerMeshQueue: triggerMeshQueue2 } = await Promise.resolve().then(() => (init_mesh_events(), mesh_events_exports));
           if (meshId) {
@@ -26912,6 +27623,15 @@ var DaemonCommandRouter = class {
             mesh = getMesh3(meshId);
           }
           if (!mesh) return { success: false, error: "Mesh not found" };
+          const meshHost = resolveMeshHostStatus(mesh);
+          if (!meshHost.canOwnCoordinator) {
+            return {
+              success: false,
+              ...buildMeshHostRequiredFailure(mesh, "coordinator launch"),
+              meshId,
+              cliType
+            };
+          }
           if (!Array.isArray(mesh.nodes) || mesh.nodes.length === 0) return { success: false, error: "No nodes in mesh" };
           const requestedCoordinatorNodeId = typeof args?.coordinatorNodeId === "string" ? args.coordinatorNodeId.trim() : "";
           const preferredCoordinatorNodeId = requestedCoordinatorNodeId || (typeof mesh.coordinator?.preferredNodeId === "string" ? mesh.coordinator.preferredNodeId.trim() : "");
@@ -27094,7 +27814,7 @@ ${block}`);
               workspace
             };
           }
-          const { existsSync: existsSync26, readFileSync: readFileSync18, writeFileSync: writeFileSync15, copyFileSync: copyFileSync4, mkdirSync: mkdirSync17 } = await import("fs");
+          const { existsSync: existsSync27, readFileSync: readFileSync19, writeFileSync: writeFileSync15, copyFileSync: copyFileSync4, mkdirSync: mkdirSync17 } = await import("fs");
           const { dirname: dirname9 } = await import("path");
           const mcpConfigPath = coordinatorSetup.configPath;
           const hermesManualFallback = cliType === "hermes-cli" && configFormat === "hermes_config_yaml" ? createHermesManualMeshCoordinatorSetup(meshId, workspace) : null;
@@ -27137,14 +27857,14 @@ ${block}`);
             if (hermesManualFallback) return returnManualFallback(message);
             return { success: false, code: "mesh_coordinator_config_write_failed", error: message, meshId, cliType, workspace };
           }
-          const hadExistingMcpConfig = existsSync26(mcpConfigPath);
+          const hadExistingMcpConfig = existsSync27(mcpConfigPath);
           let existingMcpConfig = hermesBaseConfig?.config || {};
           if (hermesBaseConfig) {
             copyHermesCoordinatorCredentialFiles(hermesBaseConfig.sourceHome, dirname9(mcpConfigPath));
           }
           if (hadExistingMcpConfig) {
             try {
-              const parsedExistingMcpConfig = parseMeshCoordinatorMcpConfig(readFileSync18(mcpConfigPath, "utf-8"), configFormat);
+              const parsedExistingMcpConfig = parseMeshCoordinatorMcpConfig(readFileSync19(mcpConfigPath, "utf-8"), configFormat);
               const existingCoordinatorConfig = hermesManualFallback ? stripHermesCoordinatorTempModelProviderOverrides(parsedExistingMcpConfig) : parsedExistingMcpConfig;
               existingMcpConfig = { ...existingMcpConfig, ...existingCoordinatorConfig };
               copyFileSync4(mcpConfigPath, mcpConfigPath + ".backup");
@@ -27234,6 +27954,7 @@ ${block}`);
           const meshRecord = await this.getMeshForCommand(meshId, args?.inlineMesh, { preferInline: true });
           const mesh = meshRecord?.mesh;
           if (!mesh) return { success: false, error: "Mesh not found" };
+          const meshHost = resolveMeshHostStatus(mesh);
           const refreshRequested = args?.refresh === true || args?.forceRefresh === true;
           const hadAggregateCache = this.aggregateMeshStatusCache.has(meshId);
           if (!refreshRequested) {
@@ -27329,6 +28050,7 @@ ${block}`);
               repoRoot: node.repoRoot,
               isLocalWorktree: node.isLocalWorktree,
               worktreeBranch: node.worktreeBranch,
+              role: normalizeMeshDaemonRole(node.role) || (meshHost.hostNodeId && nodeId === meshHost.hostNodeId ? "host" : void 0),
               daemonId,
               machineId: node.machineId,
               machineStatus: node.machineStatus,
@@ -27507,9 +28229,17 @@ ${block}`);
             repoIdentity: mesh.repoIdentity,
             defaultBranch: mesh.defaultBranch,
             refreshedAt,
+            meshHost,
             sourceOfTruth: {
               membership: meshRecord?.source === "inline_cache" ? "coordinator_inline_mesh_cache" : meshRecord?.source === "local_config" ? "local_mesh_config" : "inline_bootstrap_snapshot",
               coordinatorOwnsLiveTruth: directTruthSatisfied,
+              meshHost: {
+                owner: "mesh_host_daemon",
+                localRole: meshHost.role,
+                hostDaemonId: meshHost.hostDaemonId,
+                hostNodeId: meshHost.hostNodeId,
+                hostAddress: meshHost.hostAddress
+              },
               ...requireDirectPeerTruth ? {
                 currentStatus: directTruthSatisfied ? "live_git_and_session_probes" : "direct_peer_truth_unavailable",
                 directPeerTruth: {
@@ -35593,6 +36323,8 @@ async function shutdownDaemonComponents(components) {
   InMemoryGitSnapshotStore,
   LOG,
   MAX_LEDGER_SLICE_LIMIT,
+  MESH_REFINE_CONFIG_LOCATIONS,
+  MESH_REFINE_CONFIG_SCHEMA,
   MIN_GIT_WORKSPACE_POLL_INTERVAL_MS,
   MIN_MACHINE_RUNTIME_SUBSCRIPTION_INTERVAL_MS,
   MIN_SESSION_HOST_DIAGNOSTICS_SUBSCRIPTION_INTERVAL_MS,
@@ -35615,6 +36347,7 @@ async function shutdownDaemonComponents(components) {
   buildChatTailDeliverySignature,
   buildCoordinatorSystemPrompt,
   buildMachineInfo,
+  buildMeshHostRequiredFailure,
   buildMeshLedgerReconciliationEvidence,
   buildMeshLedgerReplicaEvidence,
   buildP2pRelayFailurePayload,
@@ -35640,6 +36373,7 @@ async function shutdownDaemonComponents(components) {
   connectCdpManager,
   createDebugTraceStore,
   createDefaultGitCommandServices,
+  createDefaultMeshHostMetadata,
   createGitCompactSummary,
   createGitSnapshotStore,
   createGitWorkspaceMonitor,
@@ -35703,6 +36437,7 @@ async function shutdownDaemonComponents(components) {
   isInternalChatMessage,
   isManagedStatusWaiting,
   isManagedStatusWorking,
+  isMeshHostOwner,
   isP2pRelayTransportFailure,
   isPathInside,
   isSessionHostLiveRuntime,
@@ -35716,6 +36451,7 @@ async function shutdownDaemonComponents(components) {
   listMeshes,
   listWorktrees,
   loadConfig,
+  loadMeshRefineConfig,
   loadState,
   logCommand,
   markSetupComplete,
@@ -35729,6 +36465,7 @@ async function shutdownDaemonComponents(components) {
   normalizeGitWorkspaceSubscriptionParams,
   normalizeInputEnvelope,
   normalizeManagedStatus,
+  normalizeMeshDaemonRole,
   normalizeMessageParts,
   normalizeRepoIdentity,
   normalizeSessionModalFields,
@@ -35749,6 +36486,7 @@ async function shutdownDaemonComponents(components) {
   removeNode,
   removeWorktree,
   requeueTask,
+  requireMeshHostQueueOwner,
   resetConfig,
   resetDebugRuntimeConfig,
   resetState,
@@ -35756,6 +36494,8 @@ async function shutdownDaemonComponents(components) {
   resolveCurrentGlobalInstallSurface,
   resolveDebugRuntimeConfig,
   resolveGitRepository,
+  resolveMeshHostStatus,
+  resolveMeshRefineValidationPlan,
   resolveSessionHostAppName,
   resolveSessionHostAppNameResolution,
   resolveWorktreePath,
@@ -35771,6 +36511,7 @@ async function shutdownDaemonComponents(components) {
   shutdownDaemonComponents,
   spawnDetachedDaemonUpgradeHelper,
   startDaemonDevSupport,
+  suggestMeshRefineConfig,
   summarizeGitStatus,
   syncMeshes,
   triggerMeshQueue,
@@ -35779,6 +36520,7 @@ async function shutdownDaemonComponents(components) {
   updateNode,
   updateSessionTaskStatus,
   updateTaskStatus,
-  upsertSavedProviderSession
+  upsertSavedProviderSession,
+  validateMeshRefineConfig
 });
 //# sourceMappingURL=index.js.map