@adhdev/daemon-core 0.9.82-rc.48 → 0.9.82-rc.49

package/dist/index.mjs

@@ -657,23 +657,97 @@ var init_config = __esm({
   }
 });
 
+// src/mesh/mesh-host-ownership.ts
+function readObject(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function readString(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function normalizeMeshDaemonRole(value) {
+  return value === "host" || value === "member" ? value : void 0;
+}
+function resolveMeshHostStatus(mesh) {
+  const meshRecord = readObject(mesh);
+  const raw = readObject(meshRecord?.meshHost);
+  const role = normalizeMeshDaemonRole(raw?.role) ?? "host";
+  const pairing = readObject(raw?.pairing);
+  const normalized = {
+    role,
+    canOwnCoordinator: role === "host",
+    canOwnQueue: role === "host",
+    defaulted: !raw
+  };
+  const hostDaemonId = readString(raw?.hostDaemonId);
+  const hostNodeId = readString(raw?.hostNodeId);
+  const hostAddress = readString(raw?.hostAddress);
+  if (hostDaemonId) normalized.hostDaemonId = hostDaemonId;
+  if (hostNodeId) normalized.hostNodeId = hostNodeId;
+  if (hostAddress) normalized.hostAddress = hostAddress;
+  if (pairing) {
+    const status = pairing.status === "pairing" || pairing.status === "paired" || pairing.status === "rejected" || pairing.status === "revoked" ? pairing.status : "not_configured";
+    normalized.pairing = {
+      status,
+      ...readString(pairing.tokenId) ? { tokenId: readString(pairing.tokenId) } : {},
+      ...readString(pairing.joinedAt) ? { joinedAt: readString(pairing.joinedAt) } : {},
+      ...readString(pairing.lastPairedAt) ? { lastPairedAt: readString(pairing.lastPairedAt) } : {},
+      ...readString(pairing.lastRejectedAt) ? { lastRejectedAt: readString(pairing.lastRejectedAt) } : {},
+      ...readString(pairing.expiresAt) ? { expiresAt: readString(pairing.expiresAt) } : {}
+    };
+  }
+  return normalized;
+}
+function isMeshHostOwner(mesh) {
+  return resolveMeshHostStatus(mesh).role === "host";
+}
+function buildMeshHostRequiredFailure(mesh, operation) {
+  const meshHost = resolveMeshHostStatus(mesh);
+  return {
+    success: false,
+    code: "mesh_host_required",
+    error: `Mesh Host daemon required for ${operation}; member daemons must pair with the host and cannot own coordinator/queue mutations.`,
+    meshHost
+  };
+}
+function requireMeshHostQueueOwner(opts) {
+  if (opts?.ownerRole === "member") {
+    throw new Error("Mesh Host daemon required to mutate mesh queue; member daemons must use the host-owned queue.");
+  }
+}
+function createDefaultMeshHostMetadata() {
+  return {
+    role: "host",
+    pairing: { status: "not_configured" }
+  };
+}
+var init_mesh_host_ownership = __esm({
+  "src/mesh/mesh-host-ownership.ts"() {
+    "use strict";
+  }
+});
+
 // src/config/mesh-config.ts
 var mesh_config_exports = {};
 __export(mesh_config_exports, {
   addNode: () => addNode,
+  applyMeshHostJoinRequest: () => applyMeshHostJoinRequest,
+  configureMeshHostPairing: () => configureMeshHostPairing,
   createMesh: () => createMesh,
+  createMeshHostPairingToken: () => createMeshHostPairingToken,
   deleteMesh: () => deleteMesh,
   getMesh: () => getMesh,
   getMeshByRepo: () => getMeshByRepo,
   listMeshes: () => listMeshes,
+  markMeshHostPairingJoined: () => markMeshHostPairingJoined,
   normalizeRepoIdentity: () => normalizeRepoIdentity,
   removeNode: () => removeNode,
+  tokenIdForManualPairing: () => tokenIdForManualPairing,
   updateMesh: () => updateMesh,
   updateNode: () => updateNode
 });
 import { existsSync as existsSync4, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
 import { join as join4 } from "path";
-import { randomUUID as randomUUID3 } from "crypto";
+import { createHash, randomBytes, randomUUID as randomUUID3 } from "crypto";
 function getMeshConfigPath() {
   return join4(getConfigDir(), "meshes.json");
 }
@@ -746,6 +820,7 @@ function createMesh(opts) {
     defaultBranch: opts.defaultBranch,
     policy: mergeMeshPolicy(void 0, opts.policy),
     coordinator: opts.coordinator || {},
+    meshHost: opts.meshHost || createDefaultMeshHostMetadata(),
     nodes: [],
     createdAt: now,
     updatedAt: now
@@ -762,6 +837,7 @@ function updateMesh(meshId, opts) {
   if (opts.defaultBranch !== void 0) mesh.defaultBranch = opts.defaultBranch;
   if (opts.policy) mesh.policy = mergeMeshPolicy(mesh.policy, opts.policy);
   if (opts.coordinator) mesh.coordinator = opts.coordinator;
+  if (opts.meshHost) mesh.meshHost = opts.meshHost;
   mesh.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
   saveMeshConfig(config);
   return mesh;
@@ -774,6 +850,186 @@ function deleteMesh(meshId) {
   saveMeshConfig(config);
   return true;
 }
+function normalizeManualHostAddress(hostAddress) {
+  const normalized = hostAddress.trim().replace(/\/+$/, "");
+  if (!normalized) throw new Error("hostAddress required");
+  let parsed;
+  try {
+    parsed = new URL(normalized);
+  } catch {
+    throw new Error("hostAddress must be a valid http(s) or ws(s) URL");
+  }
+  if (!["http:", "https:", "ws:", "wss:"].includes(parsed.protocol)) {
+    throw new Error("hostAddress must use http, https, ws, or wss");
+  }
+  return normalized;
+}
+function tokenIdForManualPairing(token) {
+  return `tok_${createHash("sha256").update(token).digest("hex").slice(0, 16)}`;
+}
+function normalizeTokenExpiry(value) {
+  if (typeof value !== "string" || !value.trim()) return void 0;
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) throw new Error("expiresAt must be a valid ISO date");
+  return date.toISOString();
+}
+function assertPairingTokenValid(pairing, rawToken, nowIso) {
+  const token = rawToken.trim();
+  if (!token) return { ok: false, reason: "token required" };
+  const presentedTokenId = tokenIdForManualPairing(token);
+  const expectedTokenId = pairing?.tokenId;
+  if (!expectedTokenId || pairing?.status === "not_configured" || pairing?.status === "revoked") {
+    return { ok: false, reason: "host pairing token is not configured", presentedTokenId };
+  }
+  if (pairing.expiresAt && new Date(pairing.expiresAt).getTime() <= new Date(nowIso).getTime()) {
+    return { ok: false, reason: "host pairing token expired", expectedTokenId, presentedTokenId };
+  }
+  if (presentedTokenId !== expectedTokenId) {
+    return { ok: false, reason: "invalid pairing token", expectedTokenId, presentedTokenId };
+  }
+  return { ok: true, tokenId: presentedTokenId };
+}
+function configureMeshHostPairing(meshId, opts) {
+  const hostAddress = normalizeManualHostAddress(opts.hostAddress);
+  const token = opts.token.trim();
+  if (!token) throw new Error("token required");
+  const config = loadMeshConfig();
+  const mesh = config.meshes.find((m) => m.id === meshId);
+  if (!mesh) return void 0;
+  const now = opts.now || (/* @__PURE__ */ new Date()).toISOString();
+  const previous = mesh.meshHost || createDefaultMeshHostMetadata();
+  const meshHost = {
+    ...previous,
+    role: "member",
+    hostAddress,
+    pairing: {
+      status: "pairing",
+      tokenId: tokenIdForManualPairing(token),
+      lastPairedAt: now
+    }
+  };
+  mesh.meshHost = meshHost;
+  mesh.updatedAt = now;
+  saveMeshConfig(config);
+  return { mesh, meshHost, hostAddress };
+}
+function createMeshHostPairingToken(meshId, opts = {}) {
+  const config = loadMeshConfig();
+  const mesh = config.meshes.find((m) => m.id === meshId);
+  if (!mesh) return void 0;
+  const now = opts.now || (/* @__PURE__ */ new Date()).toISOString();
+  const token = (opts.token || `mhj_${randomBytes(24).toString("base64url")}`).trim();
+  if (!token) throw new Error("token required");
+  const tokenId = tokenIdForManualPairing(token);
+  const expiresAt = normalizeTokenExpiry(opts.expiresAt);
+  const previous = mesh.meshHost || createDefaultMeshHostMetadata();
+  if (previous.role === "member") {
+    throw new Error("Mesh Host daemon required to create host pairing tokens; member daemons cannot mint host join tokens.");
+  }
+  const meshHost = {
+    ...previous,
+    role: "host",
+    pairing: {
+      status: "pairing",
+      tokenId,
+      lastPairedAt: now,
+      ...expiresAt ? { expiresAt } : {}
+    }
+  };
+  mesh.meshHost = meshHost;
+  mesh.updatedAt = now;
+  saveMeshConfig(config);
+  return { mesh, meshHost, token, tokenId, ...expiresAt ? { expiresAt } : {} };
+}
+function applyMeshHostJoinRequest(meshId, opts) {
+  const config = loadMeshConfig();
+  const mesh = config.meshes.find((m) => m.id === meshId);
+  if (!mesh) return void 0;
+  const now = opts.now || (/* @__PURE__ */ new Date()).toISOString();
+  const previous = mesh.meshHost || createDefaultMeshHostMetadata();
+  if (previous.role === "member") {
+    return { accepted: false, mesh, meshHost: previous, reason: "Mesh Host daemon required to accept join requests" };
+  }
+  const meshHost = { ...previous, role: "host" };
+  const validation = assertPairingTokenValid(meshHost.pairing, opts.token, now);
+  if (!validation.ok) {
+    mesh.meshHost = {
+      ...meshHost,
+      pairing: {
+        ...meshHost.pairing || { status: "not_configured" },
+        status: "rejected",
+        lastRejectedAt: now
+      }
+    };
+    mesh.updatedAt = now;
+    saveMeshConfig(config);
+    return { accepted: false, mesh, meshHost: mesh.meshHost, tokenId: validation.presentedTokenId, reason: validation.reason };
+  }
+  const workspace = opts.memberNode.workspace.trim();
+  if (!workspace) throw new Error("memberNode.workspace required");
+  const memberId = opts.memberNode.id?.trim();
+  let node = mesh.nodes.find((n) => memberId && n.id === memberId || n.workspace === workspace);
+  if (node) {
+    node.workspace = workspace;
+    node.repoRoot = opts.memberNode.repoRoot;
+    node.daemonId = opts.memberNode.daemonId;
+    node.machineId = opts.memberNode.machineId;
+    node.userOverrides = opts.memberNode.userOverrides || node.userOverrides || {};
+    node.policy = { ...node.policy || {}, ...opts.memberNode.policy || {} };
+    node.role = "member";
+  } else {
+    if (mesh.nodes.length >= 10) throw new Error("Maximum 10 nodes per mesh");
+    node = {
+      id: memberId || `node_${randomUUID3().replace(/-/g, "")}`,
+      workspace,
+      repoRoot: opts.memberNode.repoRoot,
+      daemonId: opts.memberNode.daemonId,
+      machineId: opts.memberNode.machineId,
+      userOverrides: opts.memberNode.userOverrides || {},
+      policy: opts.memberNode.policy || {},
+      role: "member"
+    };
+    mesh.nodes.push(node);
+  }
+  mesh.meshHost = {
+    ...meshHost,
+    pairing: {
+      ...meshHost.pairing || {},
+      status: "paired",
+      tokenId: validation.tokenId,
+      joinedAt: now,
+      lastPairedAt: meshHost.pairing?.lastPairedAt || now,
+      ...meshHost.pairing?.expiresAt ? { expiresAt: meshHost.pairing.expiresAt } : {}
+    }
+  };
+  mesh.updatedAt = now;
+  saveMeshConfig(config);
+  return { accepted: true, mesh, meshHost: mesh.meshHost, node, tokenId: validation.tokenId };
+}
+function markMeshHostPairingJoined(meshId, opts) {
+  const config = loadMeshConfig();
+  const mesh = config.meshes.find((m) => m.id === meshId);
+  if (!mesh) return void 0;
+  const now = opts.joinedAt || (/* @__PURE__ */ new Date()).toISOString();
+  const previous = mesh.meshHost || createDefaultMeshHostMetadata();
+  const tokenId = opts.tokenId || (opts.token ? tokenIdForManualPairing(opts.token) : previous.pairing?.tokenId);
+  mesh.meshHost = {
+    ...previous,
+    role: "member",
+    ...opts.hostDaemonId ? { hostDaemonId: opts.hostDaemonId } : {},
+    ...opts.hostNodeId ? { hostNodeId: opts.hostNodeId } : {},
+    pairing: {
+      ...previous.pairing || {},
+      status: "paired",
+      ...tokenId ? { tokenId } : {},
+      joinedAt: now,
+      lastPairedAt: previous.pairing?.lastPairedAt || now
+    }
+  };
+  mesh.updatedAt = now;
+  saveMeshConfig(config);
+  return { mesh, meshHost: mesh.meshHost };
+}
 function addNode(meshId, opts) {
   const config = loadMeshConfig();
   const mesh = config.meshes.find((m) => m.id === meshId);
@@ -794,7 +1050,8 @@ function addNode(meshId, opts) {
     policy: opts.policy || {},
     isLocalWorktree: opts.isLocalWorktree,
     worktreeBranch: opts.worktreeBranch,
-    clonedFromNodeId: opts.clonedFromNodeId
+    clonedFromNodeId: opts.clonedFromNodeId,
+    role: opts.role
   };
   mesh.nodes.push(node);
   mesh.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -830,6 +1087,7 @@ var init_mesh_config = __esm({
     "use strict";
     init_config();
     init_repo_mesh_types();
+    init_mesh_host_ownership();
     SESSION_CLEANUP_MODES = /* @__PURE__ */ new Set(["preserve", "stop", "delete_stopped", "stop_and_delete"]);
     SPAWNED_SESSION_VISIBILITY_MODES = /* @__PURE__ */ new Set(["visible", "hidden"]);
   }
@@ -1007,8 +1265,8 @@ __export(mesh_ledger_exports, {
   readLedgerEntries: () => readLedgerEntries,
   readLedgerSlice: () => readLedgerSlice
 });
-import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync3, appendFileSync, statSync as statSync2, renameSync } from "fs";
-import { join as join5 } from "path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync4, appendFileSync, statSync as statSync2, renameSync } from "fs";
+import { join as join6 } from "path";
 import { randomUUID as randomUUID4 } from "crypto";
 import { EventEmitter } from "events";
 function isIntentionalCleanupStopEntry(entry) {
@@ -1017,19 +1275,19 @@ function isIntentionalCleanupStopEntry(entry) {
   return payload.intentional === true && (payload.reason === "operator_cleanup" || payload.intentionalStopReason === "operator_cleanup" || payload.source === "mesh_cleanup_sessions" || payload.source === "mesh_remove_node");
 }
 function getLedgerDir() {
-  const dir = join5(getConfigDir(), LEDGER_DIR_NAME);
-  if (!existsSync5(dir)) {
+  const dir = join6(getConfigDir(), LEDGER_DIR_NAME);
+  if (!existsSync6(dir)) {
     mkdirSync3(dir, { recursive: true, mode: 448 });
   }
   return dir;
 }
 function getLedgerPath(meshId) {
   const safe = meshId.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return join5(getLedgerDir(), `${safe}.jsonl`);
+  return join6(getLedgerDir(), `${safe}.jsonl`);
 }
 function getRotatedPath(meshId, index) {
   const safe = meshId.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return join5(getLedgerDir(), `${safe}.${index}.jsonl`);
+  return join6(getLedgerDir(), `${safe}.${index}.jsonl`);
 }
 function buildTaskCompletionEvidence(opts) {
   const providerSessionId = opts.providerSessionId?.trim() || void 0;
@@ -1070,7 +1328,7 @@ function appendLedgerEntry(meshId, partial) {
     ...partial
   };
   const filePath = getLedgerPath(meshId);
-  if (existsSync5(filePath)) {
+  if (existsSync6(filePath)) {
     try {
       const stat2 = statSync2(filePath);
       if (stat2.size >= MAX_FILE_SIZE_BYTES) {
@@ -1137,10 +1395,10 @@ function appendRemoteLedgerEntries(meshId, entries) {
 }
 function readLedgerEntries(meshId, opts) {
   const filePath = getLedgerPath(meshId);
-  if (!existsSync5(filePath)) return [];
+  if (!existsSync6(filePath)) return [];
   let content;
   try {
-    content = readFileSync3(filePath, "utf-8");
+    content = readFileSync4(filePath, "utf-8");
   } catch {
     return [];
   }
@@ -1312,7 +1570,7 @@ function getSessionRecoveryContext(meshId, opts) {
 }
 function rotateLedgerFile(meshId, currentPath) {
   let index = 1;
-  while (existsSync5(getRotatedPath(meshId, index))) {
+  while (existsSync6(getRotatedPath(meshId, index))) {
     index++;
     if (index > 10) break;
   }
@@ -1351,16 +1609,16 @@ __export(mesh_work_queue_exports, {
   updateSessionTaskStatus: () => updateSessionTaskStatus,
   updateTaskStatus: () => updateTaskStatus
 });
-import { existsSync as existsSync6, writeFileSync as writeFileSync3, readFileSync as readFileSync4, openSync, closeSync, unlinkSync } from "fs";
-import { join as join6 } from "path";
+import { existsSync as existsSync7, writeFileSync as writeFileSync3, readFileSync as readFileSync5, openSync, closeSync, unlinkSync } from "fs";
+import { join as join7 } from "path";
 import { randomUUID as randomUUID5 } from "crypto";
 function getQueuePath(meshId) {
   const safe = meshId.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return join6(getLedgerDir(), `${safe}.queue.json`);
+  return join7(getLedgerDir(), `${safe}.queue.json`);
 }
 function getLockPath(meshId) {
   const safe = meshId.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return join6(getLedgerDir(), `${safe}.queue.lock`);
+  return join7(getLedgerDir(), `${safe}.queue.lock`);
 }
 function withQueueLock(meshId, fn) {
   const lockPath = getLockPath(meshId);
@@ -1390,9 +1648,9 @@ function withQueueLock(meshId, fn) {
 }
 function readQueue(meshId) {
   const path28 = getQueuePath(meshId);
-  if (!existsSync6(path28)) return [];
+  if (!existsSync7(path28)) return [];
   try {
-    const content = readFileSync4(path28, "utf-8");
+    const content = readFileSync5(path28, "utf-8");
     return JSON.parse(content);
   } catch {
     return [];
@@ -1403,6 +1661,7 @@ function writeQueue(meshId, queue) {
   writeFileSync3(path28, JSON.stringify(queue, null, 2), "utf-8");
 }
 function enqueueTask(meshId, message, opts) {
+  requireMeshHostQueueOwner(opts);
   return withQueueLock(meshId, () => {
     const queue = readQueue(meshId);
     const entry = {
@@ -1451,7 +1710,8 @@ function claimNextTask(meshId, nodeId, sessionId) {
     return entry;
   });
 }
-function updateTaskStatus(meshId, taskId, status) {
+function updateTaskStatus(meshId, taskId, status, opts) {
+  requireMeshHostQueueOwner(opts);
   return withQueueLock(meshId, () => {
     const queue = readQueue(meshId);
     const idx = queue.findIndex((q) => q.id === taskId);
@@ -1475,6 +1735,7 @@ function recordTaskAutoLaunch(meshId, taskId, autoLaunch) {
   });
 }
 function cancelTask(meshId, taskId, opts) {
+  requireMeshHostQueueOwner(opts);
   return withQueueLock(meshId, () => {
     const queue = readQueue(meshId);
     const idx = queue.findIndex((q) => q.id === taskId);
@@ -1489,6 +1750,7 @@ function cancelTask(meshId, taskId, opts) {
   });
 }
 function requeueTask(meshId, taskId, opts) {
+  requireMeshHostQueueOwner(opts);
   return withQueueLock(meshId, () => {
     const queue = readQueue(meshId);
     const idx = queue.findIndex((q) => q.id === taskId);
@@ -1573,6 +1835,7 @@ var init_mesh_work_queue = __esm({
   "src/mesh/mesh-work-queue.ts"() {
     "use strict";
     init_mesh_ledger();
+    init_mesh_host_ownership();
     ACTIVE_MESH_QUEUE_STATUSES = ["pending", "assigned"];
     HISTORICAL_MESH_QUEUE_STATUSES = ["completed", "failed", "cancelled"];
   }
@@ -1582,7 +1845,7 @@ var init_mesh_work_queue = __esm({
 import { exec } from "child_process";
 import * as os2 from "os";
 import * as path8 from "path";
-import { existsSync as existsSync7 } from "fs";
+import { existsSync as existsSync8 } from "fs";
 function parseVersion(raw) {
   const match = raw.match(/v?(\d+\.\d+(?:\.\d+)?(?:-[a-zA-Z0-9.]+)?)/);
   return match ? match[1] : raw.split("\n")[0].slice(0, 100);
@@ -1606,7 +1869,7 @@ function resolveCommandPath(command) {
   if (isExplicitCommandPath(trimmed)) {
     const expanded = expandHome(trimmed);
     const candidate = path8.isAbsolute(expanded) ? expanded : path8.resolve(expanded);
-    return existsSync7(candidate) ? candidate : null;
+    return existsSync8(candidate) ? candidate : null;
   }
   return null;
 }
@@ -1938,8 +2201,8 @@ __export(mesh_events_exports, {
   triggerMeshQueue: () => triggerMeshQueue,
   tryAssignQueueTask: () => tryAssignQueueTask
 });
-import { appendFileSync as appendFileSync3, existsSync as existsSync9, readFileSync as readFileSync5, unlinkSync as unlinkSync3 } from "fs";
-import { join as join9 } from "path";
+import { appendFileSync as appendFileSync3, existsSync as existsSync10, readFileSync as readFileSync6, unlinkSync as unlinkSync3 } from "fs";
+import { join as join10 } from "path";
 function sweepExpiredRemoteIdleSessions() {
   const now = Date.now();
   for (const [key, session] of remoteIdleSessions) {
@@ -1948,7 +2211,7 @@ function sweepExpiredRemoteIdleSessions() {
 }
 function getPendingEventsPath(meshId) {
   const safe = meshId.replace(/[^a-zA-Z0-9_-]/g, "_");
-  return join9(getLedgerDir(), `${safe}.pending-events.jsonl`);
+  return join10(getLedgerDir(), `${safe}.pending-events.jsonl`);
 }
 function queuePendingMeshCoordinatorEvent(event) {
   try {
@@ -1962,9 +2225,9 @@ function queuePendingMeshCoordinatorEvent(event) {
 function drainPendingMeshCoordinatorEvents(meshId) {
   if (!meshId) return [];
   const path28 = getPendingEventsPath(meshId);
-  if (!existsSync9(path28)) return [];
+  if (!existsSync10(path28)) return [];
   try {
-    const raw = readFileSync5(path28, "utf-8");
+    const raw = readFileSync6(path28, "utf-8");
     try {
       unlinkSync3(path28);
     } catch {
@@ -1983,9 +2246,9 @@ function drainPendingMeshCoordinatorEvents(meshId) {
 function getPendingMeshCoordinatorEvents(meshId) {
   if (!meshId) return [];
   const path28 = getPendingEventsPath(meshId);
-  if (!existsSync9(path28)) return [];
+  if (!existsSync10(path28)) return [];
   try {
-    const raw = readFileSync5(path28, "utf-8");
+    const raw = readFileSync6(path28, "utf-8");
     return raw.split("\n").filter(Boolean).flatMap((line) => {
       try {
         return [JSON.parse(line)];
@@ -2000,7 +2263,7 @@ function getPendingMeshCoordinatorEvents(meshId) {
 function clearPendingMeshCoordinatorEvents(meshId) {
   if (!meshId) return;
   const path28 = getPendingEventsPath(meshId);
-  if (existsSync9(path28)) try {
+  if (existsSync10(path28)) try {
     unlinkSync3(path28);
   } catch {
   }
@@ -7561,6 +7824,238 @@ function getSavedProviderSessions(state, filters) {
 init_mesh_config();
 init_coordinator_prompt();
 
+// src/mesh/refine-config.ts
+import { existsSync as existsSync5, readFileSync as readFileSync3 } from "fs";
+import { join as join5 } from "path";
+import * as yaml from "js-yaml";
+var MESH_REFINE_VALIDATION_CATEGORIES = ["typecheck", "test", "lint", "build"];
+var MESH_REFINE_CONFIG_LOCATIONS = [
+  ".adhdev/refine.json",
+  ".adhdev/refine.yaml",
+  ".adhdev/refine.yml",
+  ".adhdev/repo-mesh-refine.json",
+  ".adhdev/repo-mesh-refine.yaml",
+  ".adhdev/repo-mesh-refine.yml",
+  "repo-mesh.refine.json",
+  "repo-mesh.refine.yaml",
+  "repo-mesh.refine.yml"
+];
+var MESH_REFINE_CONFIG_SCHEMA = {
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  title: "ADHDev Repo Mesh Refinery Config",
+  type: "object",
+  additionalProperties: false,
+  required: ["version"],
+  properties: {
+    version: { const: 1 },
+    validation: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        required: { type: "boolean", default: true },
+        commands: {
+          type: "array",
+          minItems: 1,
+          maxItems: 8,
+          items: {
+            type: "object",
+            additionalProperties: false,
+            required: ["command"],
+            properties: {
+              command: { type: "string", minLength: 1 },
+              args: { type: "array", items: { type: "string" } },
+              category: { enum: [...MESH_REFINE_VALIDATION_CATEGORIES, "custom"] },
+              cwd: { type: "string" },
+              timeoutMs: { type: "number", minimum: 1e3, maximum: 6e5 },
+              env: { type: "object", additionalProperties: { type: "string" } }
+            }
+          }
+        }
+      }
+    }
+  }
+};
+function isRecord(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function tokenizeCommandString(command) {
+  const trimmed = command.trim();
+  if (!trimmed) return null;
+  if (/[;&|<>`$\\\n\r'\"]/.test(trimmed)) return null;
+  const tokens = trimmed.split(/\s+/).filter(Boolean);
+  if (!tokens.length) return null;
+  if (tokens.some((token) => !/^[A-Za-z0-9_@./:=+-]+$/.test(token))) return null;
+  return tokens;
+}
+function validateCategory(value) {
+  return typeof value === "string" && [...MESH_REFINE_VALIDATION_CATEGORIES, "custom"].includes(value) ? value : "custom";
+}
+function normalizeCommandConfig(entry, source) {
+  if (!isRecord(entry) || typeof entry.command !== "string") {
+    return { rejected: { source, reason: "validation command must be an object with a command string" } };
+  }
+  const commandText = entry.command.trim();
+  const explicitArgs = Array.isArray(entry.args) ? entry.args : void 0;
+  if (explicitArgs && !explicitArgs.every((arg) => typeof arg === "string")) {
+    return { rejected: { source, command: commandText, reason: "args must be an array of strings" } };
+  }
+  let command = commandText;
+  let args = explicitArgs ? [...explicitArgs] : [];
+  if (!explicitArgs) {
+    const tokens = tokenizeCommandString(commandText);
+    if (!tokens) return { rejected: { source, command: commandText, reason: "unsafe command string is not allowlisted" } };
+    command = tokens[0];
+    args = tokens.slice(1);
+  } else if (!tokenizeCommandString(command)) {
+    return { rejected: { source, command: commandText, reason: "unsafe executable name is not allowlisted" } };
+  }
+  if (args.some((arg) => /[\n\r\0]/.test(arg))) {
+    return { rejected: { source, command: commandText, reason: "args cannot contain control characters" } };
+  }
+  if (entry.cwd !== void 0 && typeof entry.cwd !== "string") {
+    return { rejected: { source, command: commandText, reason: "cwd must be a string when provided" } };
+  }
+  if (entry.timeoutMs !== void 0 && (typeof entry.timeoutMs !== "number" || !Number.isFinite(entry.timeoutMs) || entry.timeoutMs < 1e3 || entry.timeoutMs > 6e5)) {
+    return { rejected: { source, command: commandText, reason: "timeoutMs must be between 1000 and 600000" } };
+  }
+  if (entry.env !== void 0 && (!isRecord(entry.env) || !Object.values(entry.env).every((value) => typeof value === "string"))) {
+    return { rejected: { source, command: commandText, reason: "env must be an object of string values" } };
+  }
+  return {
+    command: {
+      command,
+      args,
+      displayCommand: [command, ...args].join(" "),
+      category: validateCategory(entry.category),
+      source,
+      ...typeof entry.cwd === "string" && entry.cwd.trim() ? { cwd: entry.cwd.trim() } : {},
+      ...typeof entry.timeoutMs === "number" ? { timeoutMs: entry.timeoutMs } : {},
+      ...isRecord(entry.env) ? { env: entry.env } : {}
+    }
+  };
+}
+function validateMeshRefineConfig(config, source = "inline") {
+  const errors = [];
+  const commands = [];
+  const rejectedCommands = [];
+  if (!isRecord(config)) return { valid: false, errors: ["config must be an object"], commands, rejectedCommands };
+  if (config.version !== 1) errors.push("version must be 1");
+  const validation = config.validation;
+  if (validation !== void 0 && !isRecord(validation)) errors.push("validation must be an object");
+  const rawCommands = isRecord(validation) ? validation.commands : void 0;
+  if (rawCommands !== void 0 && !Array.isArray(rawCommands)) errors.push("validation.commands must be an array");
+  if (Array.isArray(rawCommands)) {
+    rawCommands.forEach((entry, index) => {
+      const normalized = normalizeCommandConfig(entry, `${source}:validation.commands[${index}]`);
+      if (normalized.command) commands.push(normalized.command);
+      if (normalized.rejected) rejectedCommands.push(normalized.rejected);
+    });
+  }
+  if (rejectedCommands.length) errors.push("one or more validation commands are invalid");
+  return { valid: errors.length === 0, errors, commands, rejectedCommands };
+}
+function parseConfigText(path28, text) {
+  if (/\.json$/i.test(path28)) return JSON.parse(text);
+  return yaml.load(text);
+}
+function loadMeshRefineConfig(mesh, workspace) {
+  const policy = mesh?.policy && typeof mesh.policy === "object" && !Array.isArray(mesh.policy) ? mesh.policy : {};
+  const inline = mesh?.refineConfig || policy.refineConfig || policy.refine;
+  if (inline !== void 0) {
+    const validation = validateMeshRefineConfig(inline, "mesh.policy.refineConfig");
+    if (!validation.valid) return { source: "mesh.policy.refineConfig", sourceType: "invalid", error: String(validation.rejectedCommands[0]?.reason || validation.errors.join("; ")) };
+    return { config: inline, source: "mesh.policy.refineConfig", sourceType: "mesh_policy" };
+  }
+  for (const relative3 of MESH_REFINE_CONFIG_LOCATIONS) {
+    const configPath = join5(workspace, relative3);
+    if (!existsSync5(configPath)) continue;
+    try {
+      const parsed = parseConfigText(configPath, readFileSync3(configPath, "utf-8"));
+      const validation = validateMeshRefineConfig(parsed, relative3);
+      if (!validation.valid) return { source: relative3, sourceType: "invalid", path: configPath, error: String(validation.rejectedCommands[0]?.reason || validation.errors.join("; ")) };
+      return { config: parsed, source: relative3, sourceType: "repo_file", path: configPath };
+    } catch (error) {
+      return { source: relative3, sourceType: "invalid", path: configPath, error: error?.message || String(error) };
+    }
+  }
+  return {
+    source: "unavailable",
+    sourceType: "unavailable",
+    error: `No repo mesh/refine config found. Checked: ${MESH_REFINE_CONFIG_LOCATIONS.join(", ")}`
+  };
+}
+function readPackageScripts(workspace) {
+  try {
+    const parsed = JSON.parse(readFileSync3(join5(workspace, "package.json"), "utf-8"));
+    return isRecord(parsed?.scripts) ? parsed.scripts : {};
+  } catch {
+    return {};
+  }
+}
+function collectProjectContextSuggestions(mesh) {
+  const commands = mesh?.projectContext?.commands;
+  if (!isRecord(commands)) return [];
+  const suggestions = [];
+  for (const category of MESH_REFINE_VALIDATION_CATEGORIES) {
+    const entries = Array.isArray(commands[category]) ? commands[category] : [];
+    for (const entry of entries) {
+      if (isRecord(entry) && typeof entry.command === "string") suggestions.push({ command: entry.command, category });
+    }
+  }
+  return suggestions;
+}
+function collectPackageScriptSuggestions(workspace) {
+  const scripts = readPackageScripts(workspace);
+  const suggestions = [];
+  for (const category of MESH_REFINE_VALIDATION_CATEGORIES) {
+    for (const scriptName of Object.keys(scripts)) {
+      if (scriptName === category || scriptName.startsWith(`${category}:`)) {
+        suggestions.push({ command: "npm", args: ["run", scriptName], category });
+      }
+    }
+  }
+  return suggestions;
+}
+function suggestMeshRefineConfig(mesh, workspace) {
+  const seen = /* @__PURE__ */ new Set();
+  const suggestions = [];
+  for (const entry of [...collectProjectContextSuggestions(mesh), ...collectPackageScriptSuggestions(workspace)]) {
+    const key = `${entry.command} ${(entry.args || []).join(" ")}`.trim();
+    if (seen.has(key)) continue;
+    seen.add(key);
+    suggestions.push(entry);
+  }
+  return {
+    suggestions,
+    suggestedConfig: suggestions.length ? { version: 1, validation: { required: true, commands: suggestions.slice(0, 4) } } : void 0
+  };
+}
+function resolveMeshRefineValidationPlan(mesh, workspace) {
+  const loaded = loadMeshRefineConfig(mesh, workspace);
+  const suggestion = suggestMeshRefineConfig(mesh, workspace);
+  if (!loaded.config) {
+    return {
+      source: loaded.source,
+      sourceType: loaded.sourceType,
+      commands: [],
+      rejectedCommands: loaded.error ? [{ source: loaded.source, reason: loaded.error }] : [],
+      suggestions: suggestion.suggestions,
+      suggestedConfig: suggestion.suggestedConfig,
+      unavailableReason: loaded.error || "validation_unavailable: repo mesh/refine config missing"
+    };
+  }
+  const validation = validateMeshRefineConfig(loaded.config, loaded.source);
+  return {
+    source: loaded.path || loaded.source,
+    sourceType: loaded.sourceType,
+    commands: validation.commands,
+    rejectedCommands: validation.rejectedCommands,
+    suggestions: suggestion.suggestions,
+    suggestedConfig: suggestion.suggestedConfig,
+    unavailableReason: validation.commands.length ? void 0 : "validation_unavailable: repo mesh/refine config has no validation.commands"
+  };
+}
+
 // src/mesh/mesh-sync.ts
 init_mesh_config();
 async function syncMeshes(transport) {
@@ -7680,6 +8175,7 @@ function buildMeshLedgerReconciliationEvidence(meshId, replicas) {
 
 // src/index.ts
 init_mesh_work_queue();
+init_mesh_host_ownership();
 init_mesh_events();
 
 // src/mesh/p2p-relay-failure.ts
@@ -7794,8 +8290,8 @@ var P2pRelayFailureError = class extends Error {
 
 // src/config/state-store.ts
 init_config();
-import { existsSync as existsSync10, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
-import { join as join10 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "fs";
+import { join as join11 } from "path";
 var DEFAULT_STATE = {
   recentActivity: [],
   savedProviderSessions: [],
@@ -7808,7 +8304,7 @@ function isPlainObject2(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
 }
 function getStatePath() {
-  return join10(getConfigDir(), "state.json");
+  return join11(getConfigDir(), "state.json");
 }
 function normalizeState(raw) {
   const parsed = isPlainObject2(raw) ? raw : {};
@@ -7844,11 +8340,11 @@ function normalizeState(raw) {
 }
 function loadState() {
   const statePath = getStatePath();
-  if (!existsSync10(statePath)) {
+  if (!existsSync11(statePath)) {
     return { ...DEFAULT_STATE };
   }
   try {
-    const raw = readFileSync6(statePath, "utf-8");
+    const raw = readFileSync7(statePath, "utf-8");
     return normalizeState(JSON.parse(raw));
   } catch {
     return { ...DEFAULT_STATE };
@@ -7865,7 +8361,7 @@ function resetState() {
 
 // src/detection/ide-detector.ts
 import { execSync } from "child_process";
-import { existsSync as existsSync11 } from "fs";
+import { existsSync as existsSync12 } from "fs";
 import { platform as platform2, homedir as homedir5 } from "os";
 import * as path10 from "path";
 var BUILTIN_IDE_DEFINITIONS = [];
@@ -7889,7 +8385,7 @@ function findCliCommand(command) {
   if (path10.isAbsolute(trimmed) || trimmed.includes("/") || trimmed.includes("\\") || trimmed.startsWith("~")) {
     const candidate = trimmed.startsWith("~") ? path10.join(homedir5(), trimmed.slice(1)) : trimmed;
     const resolved = path10.isAbsolute(candidate) ? candidate : path10.resolve(candidate);
-    return existsSync11(resolved) ? resolved : null;
+    return existsSync12(resolved) ? resolved : null;
   }
   try {
     const result = execSync(
@@ -7920,9 +8416,9 @@ function checkPathExists(paths) {
     if (normalized.includes("*")) {
       const username = home.split(/[\\/]/).pop() || "";
       const resolved = normalized.replace("*", username);
-      if (existsSync11(resolved)) return resolved;
+      if (existsSync12(resolved)) return resolved;
     } else {
-      if (existsSync11(normalized)) return normalized;
+      if (existsSync12(normalized)) return normalized;
     }
   }
   return null;
@@ -7936,7 +8432,7 @@ async function detectIDEs(providerLoader) {
     let resolvedCli = cliPath;
     if (!resolvedCli && appPath && os22 === "darwin") {
       const bundledCli = `${appPath}/Contents/Resources/app/bin/${def.cli}`;
-      if (existsSync11(bundledCli)) resolvedCli = bundledCli;
+      if (existsSync12(bundledCli)) resolvedCli = bundledCli;
     }
     if (!resolvedCli && appPath && os22 === "win32") {
       const { dirname: dirname9 } = await import("path");
@@ -7949,7 +8445,7 @@ async function detectIDEs(providerLoader) {
         `${appDir}\\\\resources\\\\app\\\\bin\\\\${def.cli}.cmd`
       ];
       for (const c of candidates) {
-        if (existsSync11(c)) {
+        if (existsSync12(c)) {
           resolvedCli = c;
           break;
         }
@@ -17105,7 +17601,7 @@ init_config();
 import * as os13 from "os";
 import * as path18 from "path";
 import * as crypto4 from "crypto";
-import { existsSync as existsSync15, mkdirSync as mkdirSync9, writeFileSync as writeFileSync9 } from "fs";
+import { existsSync as existsSync16, mkdirSync as mkdirSync9, writeFileSync as writeFileSync9 } from "fs";
 import { execFileSync } from "child_process";
 import chalk from "chalk";
 
@@ -19579,7 +20075,7 @@ function commandExists(command) {
   const trimmed = command.trim();
   if (!trimmed) return false;
   if (isExplicitCommand(trimmed)) {
-    return existsSync15(expandExecutable(trimmed));
+    return existsSync16(expandExecutable(trimmed));
   }
   try {
     execFileSync(process.platform === "win32" ? "where" : "which", [trimmed], {
@@ -22843,15 +23339,15 @@ cleanOldFiles();
 
 // src/commands/router.ts
 init_logger();
-import * as yaml from "js-yaml";
+import * as yaml2 from "js-yaml";
 
 // src/commands/mesh-coordinator.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync18, readdirSync as readdirSync7, realpathSync as realpathSync2 } from "fs";
+import { createHash as createHash3 } from "crypto";
+import { existsSync as existsSync19, readdirSync as readdirSync7, realpathSync as realpathSync2 } from "fs";
 import { createRequire as createRequire2 } from "module";
 import * as os17 from "os";
-import { dirname as dirname4, isAbsolute as isAbsolute11, join as join21, resolve as resolve13 } from "path";
+import { dirname as dirname4, isAbsolute as isAbsolute11, join as join22, resolve as resolve13 } from "path";
 var DEFAULT_SERVER_NAME = "adhdev-mesh";
 var DEFAULT_ADHDEV_MCP_COMMAND = "adhdev-mcp";
 var HERMES_CLI_TYPE = "hermes-cli";
@@ -22874,7 +23370,7 @@ function resolveHermesMeshCoordinatorSetup(options) {
       reason: "Could not resolve the ADHDev MCP server entrypoint and a Node runtime with WebSocket support for daemon IPC mode"
     };
   }
-  const configPath = join21(resolveHermesCoordinatorHome(options.meshId, options.workspace), "config.yaml");
+  const configPath = join22(resolveHermesCoordinatorHome(options.meshId, options.workspace), "config.yaml");
   if (!configPath.trim()) {
     return createHermesManualMeshCoordinatorSetup(options.meshId, options.workspace);
   }
@@ -22994,15 +23490,15 @@ function renderMeshCoordinatorTemplate(template, values) {
 function resolveHermesCoordinatorHome(meshId, workspace) {
   const key = `${meshId || "mesh"}
 ${resolve13(workspace || os17.tmpdir())}`;
-  const hash = createHash2("sha256").update(key).digest("hex").slice(0, 16);
-  return join21(os17.tmpdir(), `adhdev-hermes-mesh-coordinator-${hash}`);
+  const hash = createHash3("sha256").update(key).digest("hex").slice(0, 16);
+  return join22(os17.tmpdir(), `adhdev-hermes-mesh-coordinator-${hash}`);
 }
 function resolveMcpConfigPath(configPath, workspace) {
   const trimmed = configPath.trim();
   if (trimmed === "~") return os17.homedir();
-  if (trimmed.startsWith("~/")) return join21(os17.homedir(), trimmed.slice(2));
+  if (trimmed.startsWith("~/")) return join22(os17.homedir(), trimmed.slice(2));
   if (isAbsolute11(trimmed)) return trimmed;
-  return join21(workspace, trimmed);
+  return join22(workspace, trimmed);
 }
 function resolveAdhdevMcpServerLaunch(options) {
   const entryPath = resolveAdhdevMcpEntryPath(options.adhdevMcpEntryPath);
@@ -23058,15 +23554,15 @@ function addNodeCandidatesFromPath(pathValue, addCandidate) {
   for (const entry of (pathValue || "").split(":")) {
     const dir = entry.trim();
     if (!dir) continue;
-    addCandidate(join21(dir, "node"));
+    addCandidate(join22(dir, "node"));
   }
 }
 function addNodeCandidatesFromNvm(homeDir, addCandidate) {
-  const versionsDir = join21(homeDir, ".nvm", "versions", "node");
+  const versionsDir = join22(homeDir, ".nvm", "versions", "node");
   try {
     const versionDirs = readdirSync7(versionsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort(compareNodeVersionNamesDescending);
     for (const versionDir of versionDirs) {
-      addCandidate(join21(versionsDir, versionDir, "bin", "node"));
+      addCandidate(join22(versionsDir, versionDir, "bin", "node"));
     }
   } catch {
   }
@@ -23117,7 +23613,7 @@ function resolveAdhdevMcpEntryPath(explicitPath) {
     if (normalized) return normalized;
   }
   try {
-    const requireBase = process.argv[1] ? normalizeExistingPath(process.argv[1]) || process.argv[1] : join21(process.cwd(), "adhdev-daemon.js");
+    const requireBase = process.argv[1] ? normalizeExistingPath(process.argv[1]) || process.argv[1] : join22(process.cwd(), "adhdev-daemon.js");
     const req = createRequire2(requireBase);
     const resolvedModule = req.resolve("@adhdev/mcp-server");
     return normalizeExistingPath(resolvedModule) || resolvedModule;
@@ -23127,7 +23623,7 @@ function resolveAdhdevMcpEntryPath(explicitPath) {
 }
 function normalizeExistingPath(filePath) {
   try {
-    if (!existsSync18(filePath)) return null;
+    if (!existsSync19(filePath)) return null;
     return realpathSync2.native(filePath);
   } catch {
     return null;
@@ -23136,6 +23632,7 @@ function normalizeExistingPath(filePath) {
 
 // src/commands/router.ts
 init_mesh_events();
+init_mesh_host_ownership();
 
 // src/status/snapshot.ts
 init_config();
@@ -24431,11 +24928,9 @@ async function resolveProviderTypeFromPriority(args) {
   }
   return { error: `No usable provider detected for node '${args.nodeId}' from providerPriority: ${failed.join("; ")}` };
 }
-var REFINE_VALIDATION_CATEGORIES = ["typecheck", "test", "lint", "build"];
 var REFINE_VALIDATION_TIMEOUT_MS = 12e4;
 var REFINE_VALIDATION_OUTPUT_LIMIT_BYTES = 128 * 1024;
 var REFINE_VALIDATION_SUMMARY_CHARS = 2e3;
-var REFINE_VALIDATION_MAX_COMMANDS = 4;
 var REFINE_PATCH_EQUIVALENCE_OUTPUT_LIMIT_BYTES = 4 * 1024 * 1024;
 function truncateValidationOutput(value) {
   const text = typeof value === "string" ? value : value == null ? "" : String(value);
@@ -24519,141 +25014,30 @@ async function runMeshRefinePatchEquivalenceGate(repoRoot, baseHead, branchHead)
     };
   }
 }
-function readPackageScripts(workspace) {
-  try {
-    const packageJsonPath = pathJoin(workspace, "package.json");
-    const parsed = JSON.parse(fs10.readFileSync(packageJsonPath, "utf-8"));
-    return parsed?.scripts && typeof parsed.scripts === "object" && !Array.isArray(parsed.scripts) ? parsed.scripts : {};
-  } catch {
-    return {};
-  }
-}
-function tokenizeValidationCommand(command) {
-  const trimmed = command.trim();
-  if (!trimmed) return null;
-  if (/[;&|<>`$\\\n\r'\"]/.test(trimmed)) return null;
-  const tokens = trimmed.split(/\s+/).filter(Boolean);
-  if (!tokens.length) return null;
-  if (tokens.some((token) => !/^[A-Za-z0-9_@./:=+-]+$/.test(token))) return null;
-  return tokens;
-}
-function scriptMatchesValidationCategory(scriptName, category) {
-  return scriptName === category || scriptName.startsWith(`${category}:`);
-}
-function parsePackageManagerValidationCommand(rawCommand, category, scripts, source) {
-  const tokens = tokenizeValidationCommand(rawCommand);
-  if (!tokens) {
-    return { rejected: { command: rawCommand, category, source, reason: "unsafe command string is not allowlisted" } };
-  }
-  const [binary, second, third, ...rest] = tokens;
-  let scriptName = "";
-  let command = binary;
-  let args = [];
-  if ((binary === "npm" || binary === "pnpm" || binary === "bun") && second === "run" && third) {
-    scriptName = third;
-    args = ["run", scriptName, ...rest];
-  } else if (binary === "npm" && second === "test" && !third) {
-    scriptName = "test";
-    args = ["test"];
-  } else if (binary === "yarn" && second === "run" && third) {
-    scriptName = third;
-    args = ["run", scriptName, ...rest];
-  } else if (binary === "yarn" && second && !third) {
-    scriptName = second;
-    args = [scriptName];
-  } else {
-    return { rejected: { command: rawCommand, category, source, reason: "command is not a supported package-manager script invocation" } };
-  }
-  if (!scriptName || !Object.prototype.hasOwnProperty.call(scripts, scriptName)) {
-    return { rejected: { command: rawCommand, category, source, script: scriptName, reason: "script is not declared in package.json" } };
-  }
-  if (!scriptMatchesValidationCategory(scriptName, category)) {
-    return { rejected: { command: rawCommand, category, source, script: scriptName, reason: "script name is outside the validation category allowlist" } };
-  }
-  return {
-    command: {
-      command,
-      args,
-      displayCommand: [command, ...args].join(" "),
-      category,
-      source
-    }
-  };
-}
-function collectProjectContextValidationCandidates(mesh) {
-  const commands = mesh?.projectContext?.commands;
-  if (!commands || typeof commands !== "object" || Array.isArray(commands)) return [];
-  const candidates = [];
-  for (const category of REFINE_VALIDATION_CATEGORIES) {
-    const entries = Array.isArray(commands[category]) ? commands[category] : [];
-    for (const entry of entries) {
-      if (typeof entry?.command !== "string") continue;
-      candidates.push({
-        command: entry.command,
-        category,
-        source: typeof entry.sourcePath === "string" ? entry.sourcePath : "projectContext.commands",
-        confidence: typeof entry.confidence === "string" ? entry.confidence : void 0
-      });
-    }
-  }
-  return candidates.sort((a, b) => {
-    const rank = (value) => value === "high" ? 0 : value === "medium" ? 1 : 2;
-    return rank(a.confidence) - rank(b.confidence);
-  });
-}
-function collectPolicyValidationCandidates(mesh) {
-  const policy = mesh?.policy && typeof mesh.policy === "object" && !Array.isArray(mesh.policy) ? mesh.policy : {};
-  const configured = Array.isArray(policy.validationCommands) ? policy.validationCommands : Array.isArray(policy.validationGate?.commands) ? policy.validationGate.commands : [];
-  return configured.map((entry) => typeof entry === "string" ? { command: entry, category: "", source: "mesh.policy.validationCommands" } : entry).filter((entry) => entry && typeof entry.command === "string").map((entry) => {
-    const commandText = entry.command.trim();
-    const category = REFINE_VALIDATION_CATEGORIES.find((cat) => commandText.includes(` ${cat}`)) ?? "";
-    return { command: commandText, category, source: "mesh.policy.validationCommands" };
-  }).filter((entry) => !!entry.category);
-}
-function selectMeshRefineValidationCommands(mesh, workspace) {
-  const scripts = readPackageScripts(workspace);
-  const rejectedCommands = [];
-  const selected = [];
-  const seen = /* @__PURE__ */ new Set();
-  const candidates = [
-    ...collectPolicyValidationCandidates(mesh),
-    ...collectProjectContextValidationCandidates(mesh)
-  ];
-  for (const candidate of candidates) {
-    const parsed = parsePackageManagerValidationCommand(candidate.command, candidate.category, scripts, candidate.source);
-    if (parsed.rejected) {
-      rejectedCommands.push(parsed.rejected);
-      continue;
-    }
-    if (!parsed.command || seen.has(parsed.command.displayCommand)) continue;
-    selected.push(parsed.command);
-    seen.add(parsed.command.displayCommand);
-    if (selected.length >= REFINE_VALIDATION_MAX_COMMANDS) break;
-  }
-  if (!selected.length && candidates.length === 0) {
-    for (const category of REFINE_VALIDATION_CATEGORIES) {
-      if (!Object.prototype.hasOwnProperty.call(scripts, category)) continue;
-      const fallback = parsePackageManagerValidationCommand(`npm run ${category}`, category, scripts, "package.json:scripts");
-      if (fallback.command && !seen.has(fallback.command.displayCommand)) {
-        selected.push(fallback.command);
-        seen.add(fallback.command.displayCommand);
-      } else if (fallback.rejected) {
-        rejectedCommands.push(fallback.rejected);
-      }
-      if (selected.length >= 2) break;
-    }
-  }
+function buildMeshRefineValidationPlan(mesh, workspace) {
+  const plan = resolveMeshRefineValidationPlan(mesh, workspace);
   return {
-    commands: selected,
-    rejectedCommands,
-    source: selected.some((command) => command.source === "mesh.policy.validationCommands") ? "mesh_policy" : selected.some((command) => command.source !== "package.json:scripts") ? "project_context" : selected.length ? "package_json_scripts" : "unavailable"
+    source: plan.source,
+    sourceType: plan.sourceType,
+    commands: plan.commands.map((command) => ({
+      displayCommand: command.displayCommand,
+      category: command.category,
+      source: command.source,
+      cwd: command.cwd,
+      timeoutMs: command.timeoutMs
+    })),
+    unavailableReason: plan.unavailableReason,
+    rejectedCommands: plan.rejectedCommands,
+    suggestions: plan.suggestions,
+    suggestedConfig: plan.suggestedConfig,
+    note: plan.sourceType === "unavailable" ? "No validation command will be executed until a repo mesh/refine config is provided. Heuristics are suggestions only." : "Validation commands are resolved from repo mesh/refine config; heuristics are suggestions only."
   };
 }
 async function runMeshRefineValidationGate(mesh, workspace) {
   const { execFile: execFile3 } = await import("child_process");
   const { promisify: promisify3 } = await import("util");
   const execFileAsync3 = promisify3(execFile3);
-  const selection = selectMeshRefineValidationCommands(mesh, workspace);
+  const selection = resolveMeshRefineValidationPlan(mesh, workspace);
   const summary = {
     status: "skipped",
     required: true,
@@ -24661,21 +25045,27 @@ async function runMeshRefineValidationGate(mesh, workspace) {
     rejectedCommands: selection.rejectedCommands,
     skippedReason: void 0,
     timeoutMs: REFINE_VALIDATION_TIMEOUT_MS,
-    outputLimitBytes: REFINE_VALIDATION_OUTPUT_LIMIT_BYTES
+    outputLimitBytes: REFINE_VALIDATION_OUTPUT_LIMIT_BYTES,
+    configSource: selection.source,
+    configSourceType: selection.sourceType,
+    suggestions: selection.suggestions,
+    suggestedConfig: selection.suggestedConfig
   };
   if (!selection.commands.length) {
-    summary.skippedReason = "validation_unavailable: no allowlisted projectContext, mesh policy, or package.json build/test/typecheck/lint command was available";
+    summary.skippedReason = selection.unavailableReason || "validation_unavailable: repo mesh/refine config did not provide executable validation.commands";
     return summary;
   }
   for (const candidate of selection.commands) {
     const startedAt = Date.now();
+    const cwd = candidate.cwd ? pathResolve(workspace, candidate.cwd) : workspace;
+    const timeout = candidate.timeoutMs || REFINE_VALIDATION_TIMEOUT_MS;
     try {
       const result = await execFileAsync3(candidate.command, candidate.args, {
-        cwd: workspace,
+        cwd,
         encoding: "utf8",
-        timeout: REFINE_VALIDATION_TIMEOUT_MS,
+        timeout,
         maxBuffer: REFINE_VALIDATION_OUTPUT_LIMIT_BYTES,
-        env: { ...process.env, CI: process.env.CI || "1" }
+        env: { ...process.env, CI: process.env.CI || "1", ...candidate.env || {} }
       });
       summary.commandsRun.push({
         command: candidate.command,
@@ -24683,6 +25073,7 @@ async function runMeshRefineValidationGate(mesh, workspace) {
         displayCommand: candidate.displayCommand,
         category: candidate.category,
         source: candidate.source,
+        cwd,
         passed: true,
         exitCode: 0,
         durationMs: Date.now() - startedAt,
@@ -24696,6 +25087,7 @@ async function runMeshRefineValidationGate(mesh, workspace) {
         displayCommand: candidate.displayCommand,
         category: candidate.category,
         source: candidate.source,
+        cwd,
         passed: false,
         exitCode: typeof error?.code === "number" ? error.code : null,
         signal: typeof error?.signal === "string" ? error.signal : null,
@@ -24712,7 +25104,7 @@ async function runMeshRefineValidationGate(mesh, workspace) {
   return summary;
 }
 function loadYamlModule() {
-  return yaml;
+  return yaml2;
 }
 function getMcpServersKey(format) {
   return format === "hermes_config_yaml" ? "mcp_servers" : "mcpServers";
@@ -24870,6 +25262,34 @@ function summarizeSessionHostPruneResult(result) {
     keptCount: Array.isArray(value.keptSessionIds) ? value.keptSessionIds.length : void 0
   };
 }
+function normalizeStandaloneHostCommandUrl(hostAddress) {
+  const raw = hostAddress.trim();
+  if (!raw) throw new Error("hostAddress required");
+  const url = new URL(raw.replace(/^ws:/, "http:").replace(/^wss:/, "https:"));
+  url.pathname = "/api/v1/command";
+  url.search = "";
+  url.hash = "";
+  return url.toString();
+}
+function buildMemberJoinNode(mesh, args, fallbackDaemonId) {
+  const requestedNodeId = typeof args?.memberNodeId === "string" ? args.memberNodeId.trim() : "";
+  const explicit = args?.memberNode && typeof args.memberNode === "object" && !Array.isArray(args.memberNode) ? args.memberNode : null;
+  const configured = Array.isArray(mesh?.nodes) ? requestedNodeId ? mesh.nodes.find((node) => node?.id === requestedNodeId || node?.nodeId === requestedNodeId) : mesh.nodes[0] : null;
+  const source = explicit || configured;
+  const workspace = typeof source?.workspace === "string" && source.workspace.trim() ? source.workspace.trim() : typeof args?.workspace === "string" && args.workspace.trim() ? args.workspace.trim() : process.cwd();
+  if (!workspace) return null;
+  const nodeId = typeof source?.id === "string" && source.id.trim() ? source.id.trim() : typeof source?.nodeId === "string" && source.nodeId.trim() ? source.nodeId.trim() : void 0;
+  return {
+    ...nodeId ? { id: nodeId } : {},
+    workspace,
+    ...typeof source?.repoRoot === "string" && source.repoRoot.trim() ? { repoRoot: source.repoRoot.trim() } : {},
+    ...typeof source?.daemonId === "string" && source.daemonId.trim() ? { daemonId: source.daemonId.trim() } : fallbackDaemonId ? { daemonId: fallbackDaemonId } : {},
+    ...typeof source?.machineId === "string" && source.machineId.trim() ? { machineId: source.machineId.trim() } : {},
+    userOverrides: source?.userOverrides && typeof source.userOverrides === "object" && !Array.isArray(source.userOverrides) ? source.userOverrides : {},
+    policy: source?.policy && typeof source.policy === "object" && !Array.isArray(source.policy) ? source.policy : {},
+    role: "member"
+  };
+}
 var DaemonCommandRouter = class {
   deps;
   /** In-memory cache for cloud-originating meshes passed via inlineMesh.
@@ -25043,6 +25463,16 @@ var DaemonCommandRouter = class {
   invalidateAggregateMeshStatus(meshId) {
     this.aggregateMeshStatusCache.delete(meshId);
   }
+  async requireMeshHostMutationOwner(meshId, inlineMesh, operation) {
+    const meshRecord = await this.getMeshForCommand(meshId, inlineMesh, { preferInline: true });
+    const mesh = meshRecord?.mesh;
+    if (!mesh) return { success: false, error: "Mesh not found" };
+    const meshHost = resolveMeshHostStatus(mesh);
+    if (!meshHost.canOwnCoordinator || !meshHost.canOwnQueue) {
+      return { ...buildMeshHostRequiredFailure(mesh, operation), success: false, meshId };
+    }
+    return null;
+  }
   updateInlineMeshNode(meshId, mesh, node) {
     if (!mesh || !Array.isArray(mesh.nodes) || !node?.id) return;
     const idx = mesh.nodes.findIndex((entry) => entry?.id === node.id || entry?.nodeId === node.id);
@@ -26081,7 +26511,8 @@ var DaemonCommandRouter = class {
         if (!name) return { success: false, error: "name required" };
         try {
           const { createMesh: createMesh2 } = await Promise.resolve().then(() => (init_mesh_config(), mesh_config_exports));
-          const mesh = createMesh2({ name, repoIdentity, repoRemoteUrl, defaultBranch, policy: args?.policy });
+          const meshHost = args?.meshHost && typeof args.meshHost === "object" && !Array.isArray(args.meshHost) ? args.meshHost : void 0;
+          const mesh = createMesh2({ name, repoIdentity, repoRemoteUrl, defaultBranch, policy: args?.policy, meshHost });
           return { success: true, mesh };
         } catch (e) {
           return { success: false, error: e.message };
@@ -26097,6 +26528,7 @@ var DaemonCommandRouter = class {
           if (typeof args?.defaultBranch === "string") patch.defaultBranch = args.defaultBranch;
           if (args?.policy && typeof args.policy === "object" && !Array.isArray(args.policy)) patch.policy = args.policy;
           if (args?.coordinator && typeof args.coordinator === "object" && !Array.isArray(args.coordinator)) patch.coordinator = args.coordinator;
+          if (args?.meshHost && typeof args.meshHost === "object" && !Array.isArray(args.meshHost)) patch.meshHost = args.meshHost;
           if (!Object.keys(patch).length) return { success: false, error: "No updates provided" };
           const mesh = updateMesh2(meshId, patch);
           if (!mesh) return { success: false, error: "Mesh not found" };
@@ -26107,6 +26539,215 @@ var DaemonCommandRouter = class {
           return { success: false, error: e.message };
         }
       }
+      case "get_mesh_host_pairing": {
+        const meshId = typeof args?.meshId === "string" ? args.meshId.trim() : "";
+        if (!meshId) return { success: false, error: "meshId required" };
+        const meshRecord = await this.getMeshForCommand(meshId, args?.inlineMesh, { preferInline: true });
+        const mesh = meshRecord?.mesh;
+        if (!mesh) return { success: false, error: "Mesh not found" };
+        const meshHost = resolveMeshHostStatus(mesh);
+        const pairingStatus = meshHost.pairing?.status || "not_configured";
+        return {
+          success: true,
+          code: pairingStatus === "not_configured" ? "mesh_host_pairing_not_configured" : "mesh_host_pairing_pending",
+          meshId,
+          hostAddress: meshHost.hostAddress,
+          meshHost,
+          manualPairing: {
+            status: pairingStatus,
+            joinImplemented: true,
+            protocol: "standalone_command_direct_v1",
+            description: "Standalone manual pairing can save address/token metadata, apply a host join over direct standalone command HTTP or injected mesh command dispatch, and check persisted status. P2P signaling remains outside this slice."
+          }
+        };
+      }
+      case "configure_mesh_host_pairing": {
+        const meshId = typeof args?.meshId === "string" ? args.meshId.trim() : "";
+        const hostAddress = typeof args?.hostAddress === "string" ? args.hostAddress.trim() : "";
+        const token = typeof args?.token === "string" ? args.token.trim() : "";
+        if (!meshId) return { success: false, error: "meshId required" };
+        if (!hostAddress || !token) return { success: false, error: "hostAddress and token required" };
+        try {
+          const { configureMeshHostPairing: configureMeshHostPairing2 } = await Promise.resolve().then(() => (init_mesh_config(), mesh_config_exports));
+          const configured = configureMeshHostPairing2(meshId, { hostAddress, token });
+          if (!configured) return { success: false, error: "Mesh not found" };
+          this.inlineMeshCache.set(meshId, configured.mesh);
+          const meshHost = resolveMeshHostStatus(configured.mesh);
+          return {
+            success: true,
+            code: "mesh_host_pairing_pending",
+            meshId,
+            hostAddress: configured.hostAddress,
+            meshHost,
+            manualPairing: {
+              status: meshHost.pairing?.status || "pairing",
+              joinImplemented: true,
+              protocol: "standalone_command_direct_v1",
+              description: "Manual Mesh Host pairing config was saved locally. Use join_mesh_host_pairing to apply it to the host. Raw token was not persisted."
+            }
+          };
+        } catch (e) {
+          return { success: false, code: "mesh_host_pairing_invalid", meshId, hostAddress, error: e.message };
+        }
+      }
+      case "create_mesh_host_pairing_token": {
+        const meshId = typeof args?.meshId === "string" ? args.meshId.trim() : "";
+        if (!meshId) return { success: false, error: "meshId required" };
+        try {
+          const { createMeshHostPairingToken: createMeshHostPairingToken2 } = await Promise.resolve().then(() => (init_mesh_config(), mesh_config_exports));
+          const created = createMeshHostPairingToken2(meshId, {
+            token: typeof args?.token === "string" ? args.token : void 0,
+            expiresAt: typeof args?.expiresAt === "string" ? args.expiresAt : void 0
+          });
+          if (!created) return { success: false, error: "Mesh not found" };
+          this.inlineMeshCache.set(meshId, created.mesh);
+          this.invalidateAggregateMeshStatus(meshId);
+          return {
+            success: true,
+            code: "mesh_host_pairing_token_created",
+            meshId,
+            token: created.token,
+            tokenId: created.tokenId,
+            expiresAt: created.expiresAt,
+            meshHost: resolveMeshHostStatus(created.mesh),
+            warning: "Raw token is returned once and is not persisted; share it with member daemons over a trusted channel."
+          };
+        } catch (e) {
+          return { success: false, code: "mesh_host_pairing_token_invalid", meshId, error: e.message };
+        }
+      }
+      case "apply_mesh_host_join": {
+        const meshId = typeof args?.meshId === "string" ? args.meshId.trim() : "";
+        const token = typeof args?.token === "string" ? args.token.trim() : "";
+        const memberNode = args?.memberNode && typeof args.memberNode === "object" && !Array.isArray(args.memberNode) ? args.memberNode : null;
+        if (!meshId) return { success: false, error: "meshId required" };
+        if (!token || !memberNode) return { success: false, error: "token and memberNode required" };
+        try {
+          const { applyMeshHostJoinRequest: applyMeshHostJoinRequest2 } = await Promise.resolve().then(() => (init_mesh_config(), mesh_config_exports));
+          const applied = applyMeshHostJoinRequest2(meshId, {
+            token,
+            memberNode,
+            memberMeshId: typeof args?.memberMeshId === "string" ? args.memberMeshId : void 0
+          });
+          if (!applied) return { success: false, error: "Mesh not found" };
+          if (!applied.accepted) {
+            return {
+              success: false,
+              code: "mesh_host_join_rejected",
+              meshId,
+              tokenId: applied.tokenId,
+              meshHost: applied.meshHost ? resolveMeshHostStatus({ meshHost: applied.meshHost }) : void 0,
+              error: applied.reason
+            };
+          }
+          this.inlineMeshCache.set(meshId, applied.mesh);
+          this.invalidateAggregateMeshStatus(meshId);
+          try {
+            const { appendLedgerEntry: appendLedgerEntry2 } = await Promise.resolve().then(() => (init_mesh_ledger(), mesh_ledger_exports));
+            appendLedgerEntry2(meshId, {
+              kind: "node_joined",
+              nodeId: applied.node.id,
+              payload: { role: "member", tokenId: applied.tokenId, workspace: applied.node.workspace }
+            });
+          } catch {
+          }
+          return {
+            success: true,
+            code: "mesh_host_join_accepted",
+            meshId,
+            node: applied.node,
+            tokenId: applied.tokenId,
+            meshHost: resolveMeshHostStatus(applied.mesh)
+          };
+        } catch (e) {
+          return { success: false, code: "mesh_host_join_failed", meshId, error: e.message };
+        }
+      }
+      case "join_mesh_host_pairing": {
+        const meshId = typeof args?.meshId === "string" ? args.meshId.trim() : "";
+        const token = typeof args?.token === "string" ? args.token.trim() : "";
+        if (!meshId) return { success: false, error: "meshId required" };
+        if (!token) return { success: false, error: "token required because raw pairing tokens are not persisted" };
+        const meshRecord = await this.getMeshForCommand(meshId, args?.inlineMesh, { preferInline: true });
+        const mesh = meshRecord?.mesh;
+        if (!mesh) return { success: false, error: "Mesh not found" };
+        const meshHost = resolveMeshHostStatus(mesh);
+        if (meshHost.role !== "member") {
+          return { success: false, code: "mesh_host_join_not_member", meshId, meshHost, error: "join_mesh_host_pairing must run from a member daemon configured with a Mesh Host address/token." };
+        }
+        try {
+          const { tokenIdForManualPairing: tokenIdForManualPairing2, markMeshHostPairingJoined: markMeshHostPairingJoined2 } = await Promise.resolve().then(() => (init_mesh_config(), mesh_config_exports));
+          const tokenId = tokenIdForManualPairing2(token);
+          if (meshHost.pairing?.tokenId && meshHost.pairing.tokenId !== tokenId) {
+            return { success: false, code: "mesh_host_join_rejected", meshId, tokenId, meshHost, error: "invalid pairing token" };
+          }
+          const memberNode = buildMemberJoinNode(mesh, args, this.deps.statusInstanceId);
+          if (!memberNode) return { success: false, error: "member node metadata unavailable" };
+          const hostMeshId = typeof args?.hostMeshId === "string" && args.hostMeshId.trim() ? args.hostMeshId.trim() : meshId;
+          const hostDaemonId = typeof args?.hostDaemonId === "string" && args.hostDaemonId.trim() ? args.hostDaemonId.trim() : meshHost.hostDaemonId;
+          let hostResult;
+          let transport;
+          if (hostDaemonId && this.deps.dispatchMeshCommand) {
+            transport = "mesh_command_dispatch";
+            hostResult = await this.deps.dispatchMeshCommand(hostDaemonId, "apply_mesh_host_join", {
+              meshId: hostMeshId,
+              token,
+              memberMeshId: meshId,
+              memberNode
+            });
+          } else if (meshHost.hostAddress) {
+            transport = "standalone_http_command";
+            const commandUrl = normalizeStandaloneHostCommandUrl(meshHost.hostAddress);
+            const response = await fetch(commandUrl, {
+              method: "POST",
+              headers: { "Content-Type": "application/json" },
+              body: JSON.stringify({ type: "apply_mesh_host_join", payload: { meshId: hostMeshId, token, memberMeshId: meshId, memberNode } })
+            });
+            hostResult = await response.json().catch(() => ({ success: false, error: `Host returned HTTP ${response.status}` }));
+            if (!response.ok && hostResult?.success !== false) hostResult = { success: false, error: `Host returned HTTP ${response.status}` };
+          } else {
+            return {
+              success: false,
+              code: "mesh_host_join_transport_unavailable",
+              meshId,
+              meshHost,
+              error: "No hostDaemonId dispatch path or hostAddress HTTP command path is available. P2P signaling join is not implemented in this slice."
+            };
+          }
+          if (!hostResult?.success) {
+            return { success: false, code: hostResult?.code || "mesh_host_join_rejected", meshId, meshHost, transport, error: hostResult?.error || "Mesh Host rejected join request", hostResult };
+          }
+          const joined = meshRecord.inline ? null : markMeshHostPairingJoined2(meshId, {
+            tokenId: hostResult.tokenId || tokenId,
+            hostDaemonId: hostResult.meshHost?.hostDaemonId || hostDaemonId,
+            hostNodeId: hostResult.meshHost?.hostNodeId,
+            joinedAt: hostResult.meshHost?.pairing?.joinedAt
+          });
+          if (joined) {
+            this.inlineMeshCache.set(meshId, joined.mesh);
+            this.invalidateAggregateMeshStatus(meshId);
+          }
+          return {
+            success: true,
+            code: "mesh_host_join_applied",
+            meshId,
+            hostMeshId,
+            transport,
+            node: hostResult.node,
+            tokenId: hostResult.tokenId || tokenId,
+            meshHost: joined ? resolveMeshHostStatus(joined.mesh) : { ...meshHost, pairing: { ...meshHost.pairing || {}, status: "paired", tokenId: hostResult.tokenId || tokenId } },
+            hostResult,
+            manualPairing: {
+              status: "paired",
+              joinImplemented: true,
+              protocol: "standalone_command_direct_v1",
+              description: "Mesh Host accepted the join and local member pairing status was marked paired. P2P runtime signaling remains outside this slice."
+            }
+          };
+        } catch (e) {
+          return { success: false, code: "mesh_host_join_failed", meshId, meshHost, error: e.message };
+        }
+      }
       case "delete_mesh": {
         const meshId = typeof args?.meshId === "string" ? args.meshId.trim() : "";
         if (!meshId) return { success: false, error: "meshId required" };
@@ -26189,6 +26830,8 @@ var DaemonCommandRouter = class {
         const meshId = typeof args?.meshId === "string" ? args.meshId.trim() : "";
         const taskId = typeof args?.taskId === "string" ? args.taskId.trim() : "";
         if (!meshId || !taskId) return { success: false, error: "meshId and taskId required" };
+        const ownerFailure = await this.requireMeshHostMutationOwner(meshId, args?.inlineMesh, "queue cancellation");
+        if (ownerFailure) return ownerFailure;
         try {
           const { cancelTask: cancelTask2 } = await Promise.resolve().then(() => (init_mesh_work_queue(), mesh_work_queue_exports));
           const reason = typeof args?.reason === "string" ? args.reason : void 0;
@@ -26203,6 +26846,8 @@ var DaemonCommandRouter = class {
         const meshId = typeof args?.meshId === "string" ? args.meshId.trim() : "";
         const taskId = typeof args?.taskId === "string" ? args.taskId.trim() : "";
         if (!meshId || !taskId) return { success: false, error: "meshId and taskId required" };
+        const ownerFailure = await this.requireMeshHostMutationOwner(meshId, args?.inlineMesh, "queue requeue");
+        if (ownerFailure) return ownerFailure;
         try {
           const { requeueTask: requeueTask2 } = await Promise.resolve().then(() => (init_mesh_work_queue(), mesh_work_queue_exports));
           const task = requeueTask2(meshId, taskId, {
@@ -26223,6 +26868,8 @@ var DaemonCommandRouter = class {
         const workspace = typeof args?.workspace === "string" ? args.workspace.trim() : "";
         if (!meshId) return { success: false, error: "meshId required" };
         if (!workspace) return { success: false, error: "workspace required" };
+        const ownerFailure = await this.requireMeshHostMutationOwner(meshId, args?.inlineMesh, "node addition");
+        if (ownerFailure) return ownerFailure;
         try {
           const { addNode: addNode3 } = await Promise.resolve().then(() => (init_mesh_config(), mesh_config_exports));
           const providerPriority = Array.isArray(args?.providerPriority) ? args.providerPriority.map((type) => typeof type === "string" ? type.trim() : "").filter(Boolean) : [];
@@ -26231,7 +26878,8 @@ var DaemonCommandRouter = class {
             ...readOnly ? { readOnly: true } : {},
             ...providerPriority.length ? { providerPriority } : {}
           };
-          const node = addNode3(meshId, { workspace, ...policy ? { policy } : {} });
+          const role = normalizeMeshDaemonRole(args?.role);
+          const node = addNode3(meshId, { workspace, ...policy ? { policy } : {}, ...role ? { role } : {} });
           if (!node) return { success: false, error: "Mesh not found" };
           return { success: true, node };
         } catch (e) {
@@ -26242,6 +26890,8 @@ var DaemonCommandRouter = class {
         const meshId = typeof args?.meshId === "string" ? args.meshId.trim() : "";
         const nodeId = typeof args?.nodeId === "string" ? args.nodeId.trim() : "";
         if (!meshId || !nodeId) return { success: false, error: "meshId and nodeId required" };
+        const ownerFailure = await this.requireMeshHostMutationOwner(meshId, args?.inlineMesh, "node update");
+        if (ownerFailure) return ownerFailure;
         try {
           const { updateNode: updateNode2 } = await Promise.resolve().then(() => (init_mesh_config(), mesh_config_exports));
           const policy = args?.policy && typeof args.policy === "object" && !Array.isArray(args.policy) ? { ...args.policy } : {};
@@ -26265,6 +26915,8 @@ var DaemonCommandRouter = class {
         const meshId = typeof args?.meshId === "string" ? args.meshId.trim() : "";
         const nodeId = typeof args?.nodeId === "string" ? args.nodeId.trim() : "";
         if (!meshId || !nodeId) return { success: false, error: "meshId and nodeId required" };
+        const ownerFailure = await this.requireMeshHostMutationOwner(meshId, args?.inlineMesh, "node removal");
+        if (ownerFailure) return ownerFailure;
         try {
           const meshRecord = await this.getMeshForCommand(meshId, args?.inlineMesh);
           const mesh = meshRecord?.mesh;
@@ -26287,6 +26939,49 @@ var DaemonCommandRouter = class {
           return { success: false, error: e.message };
         }
       }
+      case "get_mesh_refine_config_schema": {
+        return {
+          success: true,
+          schema: MESH_REFINE_CONFIG_SCHEMA,
+          locations: MESH_REFINE_CONFIG_LOCATIONS,
+          sourceOfTruth: "repo mesh/refine config",
+          heuristicRole: "suggestions_only_not_execution_path"
+        };
+      }
+      case "validate_mesh_refine_config": {
+        const workspace = typeof args?.workspace === "string" ? args.workspace : process.cwd();
+        const mesh = args?.inlineMesh || {};
+        const loaded = args?.config !== void 0 ? { config: args.config, source: "inline", sourceType: "mesh_policy" } : loadMeshRefineConfig(mesh, workspace);
+        const validation = loaded.config ? validateMeshRefineConfig(loaded.config, loaded.source) : { valid: false, errors: [loaded.error || "repo mesh/refine config unavailable"], commands: [], rejectedCommands: [] };
+        return { success: validation.valid, ...loaded, ...validation };
+      }
+      case "suggest_mesh_refine_config": {
+        const workspace = typeof args?.workspace === "string" ? args.workspace : process.cwd();
+        const mesh = args?.inlineMesh || {};
+        return {
+          success: true,
+          ...suggestMeshRefineConfig(mesh, workspace),
+          note: "Suggestions are heuristic scaffold only; Refinery will not execute them until saved into repo mesh/refine config."
+        };
+      }
+      case "plan_mesh_refine_node": {
+        const meshId = typeof args?.meshId === "string" ? args.meshId.trim() : "";
+        const nodeId = typeof args?.nodeId === "string" ? args.nodeId.trim() : "";
+        if (!meshId || !nodeId) return { success: false, error: "meshId and nodeId required" };
+        const meshRecord = await this.getMeshForCommand(meshId, args?.inlineMesh);
+        const mesh = meshRecord?.mesh;
+        const node = mesh?.nodes?.find((n) => n.id === nodeId || n.nodeId === nodeId);
+        if (!node?.workspace) return { success: false, error: `Node '${nodeId}' workspace not found` };
+        return {
+          success: true,
+          dryRun: true,
+          nodeId,
+          workspace: node.workspace,
+          validationPlan: buildMeshRefineValidationPlan(mesh, node.workspace),
+          mergeWillRun: false,
+          cleanupWillRun: false
+        };
+      }
       case "refine_mesh_node": {
         const meshId = typeof args?.meshId === "string" ? args.meshId.trim() : "";
         const nodeId = typeof args?.nodeId === "string" ? args.nodeId.trim() : "";
@@ -26572,6 +27267,8 @@ var DaemonCommandRouter = class {
         if (!meshId) return { success: false, error: "meshId required" };
         if (!sourceNodeId) return { success: false, error: "sourceNodeId required" };
         if (!branch) return { success: false, error: "branch required" };
+        const ownerFailure = await this.requireMeshHostMutationOwner(meshId, args?.inlineMesh, "worktree clone");
+        if (ownerFailure) return ownerFailure;
         try {
           const meshRecord = await this.getMeshForCommand(meshId, args?.inlineMesh);
           const mesh = meshRecord?.mesh;
@@ -26653,6 +27350,8 @@ var DaemonCommandRouter = class {
       case "trigger_mesh_queue": {
         const meshId = typeof args?.meshId === "string" ? args.meshId.trim() : "";
         if (!meshId) return { success: false, error: "meshId required" };
+        const ownerFailure = await this.requireMeshHostMutationOwner(meshId, args?.inlineMesh, "queue trigger");
+        if (ownerFailure) return ownerFailure;
         try {
           const { triggerMeshQueue: triggerMeshQueue2 } = await Promise.resolve().then(() => (init_mesh_events(), mesh_events_exports));
           if (meshId) {
@@ -26679,6 +27378,15 @@ var DaemonCommandRouter = class {
             mesh = getMesh3(meshId);
           }
           if (!mesh) return { success: false, error: "Mesh not found" };
+          const meshHost = resolveMeshHostStatus(mesh);
+          if (!meshHost.canOwnCoordinator) {
+            return {
+              success: false,
+              ...buildMeshHostRequiredFailure(mesh, "coordinator launch"),
+              meshId,
+              cliType
+            };
+          }
           if (!Array.isArray(mesh.nodes) || mesh.nodes.length === 0) return { success: false, error: "No nodes in mesh" };
           const requestedCoordinatorNodeId = typeof args?.coordinatorNodeId === "string" ? args.coordinatorNodeId.trim() : "";
           const preferredCoordinatorNodeId = requestedCoordinatorNodeId || (typeof mesh.coordinator?.preferredNodeId === "string" ? mesh.coordinator.preferredNodeId.trim() : "");
@@ -26861,7 +27569,7 @@ ${block}`);
               workspace
             };
           }
-          const { existsSync: existsSync26, readFileSync: readFileSync18, writeFileSync: writeFileSync15, copyFileSync: copyFileSync4, mkdirSync: mkdirSync17 } = await import("fs");
+          const { existsSync: existsSync27, readFileSync: readFileSync19, writeFileSync: writeFileSync15, copyFileSync: copyFileSync4, mkdirSync: mkdirSync17 } = await import("fs");
           const { dirname: dirname9 } = await import("path");
           const mcpConfigPath = coordinatorSetup.configPath;
           const hermesManualFallback = cliType === "hermes-cli" && configFormat === "hermes_config_yaml" ? createHermesManualMeshCoordinatorSetup(meshId, workspace) : null;
@@ -26904,14 +27612,14 @@ ${block}`);
             if (hermesManualFallback) return returnManualFallback(message);
             return { success: false, code: "mesh_coordinator_config_write_failed", error: message, meshId, cliType, workspace };
           }
-          const hadExistingMcpConfig = existsSync26(mcpConfigPath);
+          const hadExistingMcpConfig = existsSync27(mcpConfigPath);
           let existingMcpConfig = hermesBaseConfig?.config || {};
           if (hermesBaseConfig) {
             copyHermesCoordinatorCredentialFiles(hermesBaseConfig.sourceHome, dirname9(mcpConfigPath));
           }
           if (hadExistingMcpConfig) {
             try {
-              const parsedExistingMcpConfig = parseMeshCoordinatorMcpConfig(readFileSync18(mcpConfigPath, "utf-8"), configFormat);
+              const parsedExistingMcpConfig = parseMeshCoordinatorMcpConfig(readFileSync19(mcpConfigPath, "utf-8"), configFormat);
               const existingCoordinatorConfig = hermesManualFallback ? stripHermesCoordinatorTempModelProviderOverrides(parsedExistingMcpConfig) : parsedExistingMcpConfig;
               existingMcpConfig = { ...existingMcpConfig, ...existingCoordinatorConfig };
               copyFileSync4(mcpConfigPath, mcpConfigPath + ".backup");
@@ -27001,6 +27709,7 @@ ${block}`);
           const meshRecord = await this.getMeshForCommand(meshId, args?.inlineMesh, { preferInline: true });
           const mesh = meshRecord?.mesh;
           if (!mesh) return { success: false, error: "Mesh not found" };
+          const meshHost = resolveMeshHostStatus(mesh);
           const refreshRequested = args?.refresh === true || args?.forceRefresh === true;
           const hadAggregateCache = this.aggregateMeshStatusCache.has(meshId);
           if (!refreshRequested) {
@@ -27096,6 +27805,7 @@ ${block}`);
               repoRoot: node.repoRoot,
               isLocalWorktree: node.isLocalWorktree,
               worktreeBranch: node.worktreeBranch,
+              role: normalizeMeshDaemonRole(node.role) || (meshHost.hostNodeId && nodeId === meshHost.hostNodeId ? "host" : void 0),
               daemonId,
               machineId: node.machineId,
               machineStatus: node.machineStatus,
@@ -27274,9 +27984,17 @@ ${block}`);
             repoIdentity: mesh.repoIdentity,
             defaultBranch: mesh.defaultBranch,
             refreshedAt,
+            meshHost,
             sourceOfTruth: {
               membership: meshRecord?.source === "inline_cache" ? "coordinator_inline_mesh_cache" : meshRecord?.source === "local_config" ? "local_mesh_config" : "inline_bootstrap_snapshot",
               coordinatorOwnsLiveTruth: directTruthSatisfied,
+              meshHost: {
+                owner: "mesh_host_daemon",
+                localRole: meshHost.role,
+                hostDaemonId: meshHost.hostDaemonId,
+                hostNodeId: meshHost.hostNodeId,
+                hostAddress: meshHost.hostAddress
+              },
               ...requireDirectPeerTruth ? {
                 currentStatus: directTruthSatisfied ? "live_git_and_session_probes" : "direct_peer_truth_unavailable",
                 directPeerTruth: {
@@ -35364,6 +36082,8 @@ export {
   InMemoryGitSnapshotStore,
   LOG,
   MAX_LEDGER_SLICE_LIMIT,
+  MESH_REFINE_CONFIG_LOCATIONS,
+  MESH_REFINE_CONFIG_SCHEMA,
   MIN_GIT_WORKSPACE_POLL_INTERVAL_MS,
   MIN_MACHINE_RUNTIME_SUBSCRIPTION_INTERVAL_MS,
   MIN_SESSION_HOST_DIAGNOSTICS_SUBSCRIPTION_INTERVAL_MS,
@@ -35386,6 +36106,7 @@ export {
   buildChatTailDeliverySignature,
   buildCoordinatorSystemPrompt,
   buildMachineInfo,
+  buildMeshHostRequiredFailure,
   buildMeshLedgerReconciliationEvidence,
   buildMeshLedgerReplicaEvidence,
   buildP2pRelayFailurePayload,
@@ -35411,6 +36132,7 @@ export {
   connectCdpManager,
   createDebugTraceStore,
   createDefaultGitCommandServices,
+  createDefaultMeshHostMetadata,
   createGitCompactSummary,
   createGitSnapshotStore,
   createGitWorkspaceMonitor,
@@ -35474,6 +36196,7 @@ export {
   isInternalChatMessage,
   isManagedStatusWaiting,
   isManagedStatusWorking,
+  isMeshHostOwner,
   isP2pRelayTransportFailure,
   isPathInside,
   isSessionHostLiveRuntime,
@@ -35487,6 +36210,7 @@ export {
   listMeshes,
   listWorktrees,
   loadConfig,
+  loadMeshRefineConfig,
   loadState,
   logCommand,
   markSetupComplete,
@@ -35500,6 +36224,7 @@ export {
   normalizeGitWorkspaceSubscriptionParams,
   normalizeInputEnvelope,
   normalizeManagedStatus,
+  normalizeMeshDaemonRole,
   normalizeMessageParts,
   normalizeRepoIdentity,
   normalizeSessionModalFields,
@@ -35520,6 +36245,7 @@ export {
   removeNode,
   removeWorktree,
   requeueTask,
+  requireMeshHostQueueOwner,
   resetConfig,
   resetDebugRuntimeConfig,
   resetState,
@@ -35527,6 +36253,8 @@ export {
   resolveCurrentGlobalInstallSurface,
   resolveDebugRuntimeConfig,
   resolveGitRepository,
+  resolveMeshHostStatus,
+  resolveMeshRefineValidationPlan,
   resolveSessionHostAppName,
   resolveSessionHostAppNameResolution,
   resolveWorktreePath,
@@ -35542,6 +36270,7 @@ export {
   shutdownDaemonComponents,
   spawnDetachedDaemonUpgradeHelper,
   startDaemonDevSupport,
+  suggestMeshRefineConfig,
   summarizeGitStatus,
   syncMeshes,
   triggerMeshQueue,
@@ -35550,6 +36279,7 @@ export {
   updateNode,
   updateSessionTaskStatus,
   updateTaskStatus,
-  upsertSavedProviderSession
+  upsertSavedProviderSession,
+  validateMeshRefineConfig
 };
 //# sourceMappingURL=index.mjs.map