@beeos-ai/cli 1.1.1 → 1.1.2

package/dist/index.js

@@ -127,14 +127,14 @@ function projectSpawnEnv(cfg) {
 }
 async function saveSpawnEnvSnapshot(cfg) {
   const p = getPlatformAdapter();
-  const path10 = spawnEnvJsonPath();
+  const path12 = spawnEnvJsonPath();
   const snapshot = projectSpawnEnv(cfg);
   try {
-    await p.mkdir(p.dirname(path10));
-    await p.writeFile(path10, JSON.stringify(snapshot, null, 2) + "\n");
+    await p.mkdir(p.dirname(path12));
+    await p.writeFile(path12, JSON.stringify(snapshot, null, 2) + "\n");
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    console.error(`! warning: could not write ${path10}: ${message}
+    console.error(`! warning: could not write ${path12}: ${message}
   device-agent fleet will fall back to parsing config.toml directly.`);
   }
 }
@@ -208,17 +208,17 @@ function defaultState() {
 }
 async function loadState() {
   const p = getPlatformAdapter();
-  const path10 = statePath();
-  if (await p.exists(path10)) {
+  const path12 = statePath();
+  if (await p.exists(path12)) {
     let raw;
     try {
-      raw = await p.readFile(path10);
+      raw = await p.readFile(path12);
     } catch (e) {
       throw new BeeosError({
         code: "state_corrupted",
-        message: `failed to read ${path10}: ${describeError(e)}`,
+        message: `failed to read ${path12}: ${describeError(e)}`,
         hint: "Inspect the file or move it aside and re-run `beeos doctor` to regenerate from legacy state.",
-        details: { path: path10 },
+        details: { path: path12 },
         cause: e
       });
     }
@@ -228,23 +228,23 @@ async function loadState() {
     } catch (e) {
       throw new BeeosError({
         code: "state_corrupted",
-        message: `${path10} is not valid JSON: ${describeError(e)}`,
+        message: `${path12} is not valid JSON: ${describeError(e)}`,
         hint: "Move the file aside (e.g. `mv ~/.beeos/state.json ~/.beeos/state.json.broken`) and re-run `beeos doctor` to migrate from the legacy state files.",
-        details: { path: path10 }
+        details: { path: path12 }
       });
     }
-    return validateState(parsed, path10);
+    return validateState(parsed, path12);
   }
   return migrateLegacy();
 }
 async function saveState(state) {
   const p = getPlatformAdapter();
-  const path10 = statePath();
-  await p.mkdir(p.dirname(path10));
-  await p.writeFile(path10, JSON.stringify(state, null, 2) + "\n");
+  const path12 = statePath();
+  await p.mkdir(p.dirname(path12));
+  await p.writeFile(path12, JSON.stringify(state, null, 2) + "\n");
   if (p.platform() !== "win32") {
     try {
-      await p.chmod(path10, 384);
+      await p.chmod(path12, 384);
     } catch {
     }
   }
@@ -319,11 +319,11 @@ async function migrateLegacy() {
 }
 async function tryReadBinding() {
   const p = getPlatformAdapter();
-  const path10 = bindingPath();
-  if (!await p.exists(path10))
+  const path12 = bindingPath();
+  if (!await p.exists(path12))
     return null;
   try {
-    const raw = await p.readFile(path10);
+    const raw = await p.readFile(path12);
     return JSON.parse(raw);
   } catch {
     return null;
@@ -331,11 +331,11 @@ async function tryReadBinding() {
 }
 async function tryReadDevices() {
   const p = getPlatformAdapter();
-  const path10 = legacyDevicesPath();
-  if (!await p.exists(path10))
+  const path12 = legacyDevicesPath();
+  if (!await p.exists(path12))
     return [];
   try {
-    const raw = await p.readFile(path10);
+    const raw = await p.readFile(path12);
     const parsed = JSON.parse(raw);
     return Array.isArray(parsed?.devices) ? parsed.devices : [];
   } catch {
@@ -344,11 +344,11 @@ async function tryReadDevices() {
 }
 async function tryReadSpawnEnvIntoPlatform(state) {
   const p = getPlatformAdapter();
-  const path10 = spawnEnvJsonPath();
-  if (!await p.exists(path10))
+  const path12 = spawnEnvJsonPath();
+  if (!await p.exists(path12))
     return;
   try {
-    const raw = await p.readFile(path10);
+    const raw = await p.readFile(path12);
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed !== "object")
       return;
@@ -364,7 +364,7 @@ async function tryReadSpawnEnvIntoPlatform(state) {
 async function tryFoldVlmConfigs(state) {
   const p = getPlatformAdapter();
   const root = beeoHome();
-  let entries = [];
+  let entries;
   try {
     entries = await p.readdir(root);
   } catch {
@@ -391,13 +391,13 @@ async function tryFoldVlmConfigs(state) {
     }
   }
 }
-function validateState(parsed, path10) {
+function validateState(parsed, path12) {
   if (!parsed || typeof parsed !== "object") {
     throw new BeeosError({
       code: "state_corrupted",
-      message: `${path10} did not deserialise to a JSON object.`,
+      message: `${path12} did not deserialise to a JSON object.`,
       hint: "Move the file aside and re-run `beeos doctor` to regenerate.",
-      details: { path: path10 }
+      details: { path: path12 }
     });
   }
   const obj = parsed;
@@ -405,26 +405,26 @@ function validateState(parsed, path10) {
   if (version !== 2) {
     throw new BeeosError({
       code: "state_version_mismatch",
-      message: `${path10} declares version=${JSON.stringify(version)}; this CLI only understands version=2.`,
+      message: `${path12} declares version=${JSON.stringify(version)}; this CLI only understands version=2.`,
       hint: "Either upgrade the CLI (`beeos --version` to see what you have) or move the file aside and re-bind your agents with the older CLI's flow.",
-      details: { path: path10, observed: version, expected: 2 }
+      details: { path: path12, observed: version, expected: 2 }
     });
   }
   const platform = obj.platform;
   if (!platform || typeof platform !== "object") {
     throw new BeeosError({
       code: "state_corrupted",
-      message: `${path10} is missing a \`platform\` object.`,
+      message: `${path12} is missing a \`platform\` object.`,
       hint: "Move the file aside and re-run `beeos doctor`.",
-      details: { path: path10 }
+      details: { path: path12 }
     });
   }
   if (!Array.isArray(obj.agents)) {
     throw new BeeosError({
       code: "state_corrupted",
-      message: `${path10} \`agents\` is not an array.`,
+      message: `${path12} \`agents\` is not an array.`,
       hint: "Move the file aside and re-run `beeos doctor`.",
-      details: { path: path10 }
+      details: { path: path12 }
     });
   }
   return obj;
@@ -448,9 +448,9 @@ var init_state = __esm({
 import * as TOML from "smol-toml";
 async function loadOrCreateConfig() {
   const p = getPlatformAdapter();
-  const path10 = configPath();
-  if (await p.exists(path10)) {
-    const raw = await p.readFile(path10);
+  const path12 = configPath();
+  if (await p.exists(path12)) {
+    const raw = await p.readFile(path12);
     const parsed = TOML.parse(raw);
     const cfg2 = mergeWithDefaults(parsed);
     await saveSpawnEnvSnapshot(cfg2);
@@ -478,8 +478,8 @@ function applyEnvOverrides(cfg) {
 }
 async function saveConfig(cfg) {
   const p = getPlatformAdapter();
-  const path10 = configPath();
-  await p.mkdir(p.dirname(path10));
+  const path12 = configPath();
+  await p.mkdir(p.dirname(path12));
   const platformBlock = {
     api_url: cfg.platform.api_url,
     agent_gateway_url: cfg.platform.agent_gateway_url,
@@ -496,7 +496,7 @@ async function saveConfig(cfg) {
     }
   };
   const raw = TOML.stringify(serializable);
-  await p.writeFile(path10, raw);
+  await p.writeFile(path12, raw);
   await saveSpawnEnvSnapshot(cfg);
   await refreshStatePlatformBestEffort(cfg);
 }
@@ -570,22 +570,22 @@ var init_toml = __esm({
 // ../core/dist/config/binding.js
 async function loadBindingInfo() {
   const p = getPlatformAdapter();
-  const path10 = bindingPath();
-  if (!await p.exists(path10))
+  const path12 = bindingPath();
+  if (!await p.exists(path12))
     return null;
-  const raw = await p.readFile(path10);
+  const raw = await p.readFile(path12);
   return JSON.parse(raw);
 }
 async function saveBindingInfo(info) {
   const p = getPlatformAdapter();
-  const path10 = bindingPath();
-  await p.writeFile(path10, JSON.stringify(info, null, 2));
+  const path12 = bindingPath();
+  await p.writeFile(path12, JSON.stringify(info, null, 2));
 }
 async function removeBindingInfo() {
   const p = getPlatformAdapter();
-  const path10 = bindingPath();
-  if (await p.exists(path10)) {
-    await p.rm(path10);
+  const path12 = bindingPath();
+  if (await p.exists(path12)) {
+    await p.rm(path12);
   }
 }
 var init_binding = __esm({
@@ -599,17 +599,17 @@ var init_binding = __esm({
 // ../core/dist/config/gateway-token.js
 async function loadOrCreateGatewayToken() {
   const p = getPlatformAdapter();
-  const path10 = p.joinPath(beeoHome(), "gateway_token");
-  if (await p.exists(path10)) {
-    const token2 = (await p.readFile(path10)).trim();
+  const path12 = p.joinPath(beeoHome(), "gateway_token");
+  if (await p.exists(path12)) {
+    const token2 = (await p.readFile(path12)).trim();
     if (token2)
       return token2;
   }
   const token = crypto.randomUUID();
-  await p.mkdir(p.dirname(path10));
-  await p.writeFile(path10, token);
+  await p.mkdir(p.dirname(path12));
+  await p.writeFile(path12, token);
   if (p.platform() !== "win32") {
-    await p.chmod(path10, 384);
+    await p.chmod(path12, 384);
   }
   return token;
 }
@@ -650,9 +650,9 @@ function fingerprintFromB64(pubkeyB64) {
 }
 async function loadOrCreateIdentity() {
   const p = getPlatformAdapter();
-  const path10 = keypairPath();
-  if (await p.exists(path10)) {
-    return loadFromFile(path10);
+  const path12 = keypairPath();
+  if (await p.exists(path12)) {
+    return loadFromFile(path12);
   }
   const id = generate();
   await save(id);
@@ -684,10 +684,10 @@ async function readPubkeyFromKeyFile(keyPath) {
 async function loadIdentityFromKeyFile(keyPath) {
   return loadFromFile(keyPath);
 }
-async function signRequest(method, path10, id) {
+async function signRequest(method, path12, id) {
   const timestamp = Math.floor(Date.now() / 1e3).toString();
   const nonce = crypto.randomUUID();
-  const message = `${method.toUpperCase()}|${path10}|${timestamp}|${nonce}`;
+  const message = `${method.toUpperCase()}|${path12}|${timestamp}|${nonce}`;
   const msgBytes = new TextEncoder().encode(message);
   const sig = await ed.signAsync(msgBytes, id.privateKey);
   return {
@@ -705,9 +705,9 @@ function fingerprintFilePath() {
   const p = getPlatformAdapter();
   return p.joinPath(beeoHome(), "identity", "fingerprint");
 }
-async function loadFromFile(path10) {
+async function loadFromFile(path12) {
   const p = getPlatformAdapter();
-  const raw = await p.readFile(path10);
+  const raw = await p.readFile(path12);
   const stored = JSON.parse(raw);
   const privateKey = fromBase64(stored.privateKey);
   if (privateKey.length !== 32) {
@@ -745,6 +745,62 @@ var init_keypair = __esm({
   }
 });
 
+// ../core/dist/identity/qr.js
+import QRCode from "qrcode";
+async function qrModules(url) {
+  const segments = QRCode.create(url, { errorCorrectionLevel: "M" });
+  const size = segments.modules.size;
+  const modules = [];
+  for (let y = 0; y < size; y++) {
+    for (let x = 0; x < size; x++) {
+      modules.push(segments.modules.get(x, y) !== 0);
+    }
+  }
+  return { width: size, modules };
+}
+async function qrToTerminal(url) {
+  const { width, modules } = await qrModules(url);
+  const rows = [];
+  for (let i = 0; i < modules.length; i += width) {
+    rows.push(modules.slice(i, i + width));
+  }
+  const quiet = 2;
+  const fullWidth = width + quiet * 2;
+  const blankLine = " ".repeat(fullWidth);
+  const lines = [];
+  for (let i = 0; i < quiet; i++)
+    lines.push(blankLine);
+  let y = 0;
+  while (y < rows.length) {
+    const topRow = rows[y];
+    const botRow = y + 1 < rows.length ? rows[y + 1] : null;
+    let line = " ".repeat(quiet);
+    for (let x = 0; x < width; x++) {
+      const top = topRow[x];
+      const bot = botRow ? botRow[x] : false;
+      if (top && bot)
+        line += "\u2588";
+      else if (top && !bot)
+        line += "\u2580";
+      else if (!top && bot)
+        line += "\u2584";
+      else
+        line += " ";
+    }
+    line += " ".repeat(quiet);
+    lines.push(line);
+    y += 2;
+  }
+  for (let i = 0; i < quiet; i++)
+    lines.push(blankLine);
+  return lines.join("\n");
+}
+var init_qr = __esm({
+  "../core/dist/identity/qr.js"() {
+    "use strict";
+  }
+});
+
 // ../core/dist/platform/client.js
 async function bindHttpError(resp, op) {
   const body = await resp.text().catch(() => "");
@@ -870,62 +926,6 @@ var init_process = __esm({
   }
 });
 
-// ../core/dist/identity/qr.js
-import QRCode from "qrcode";
-async function qrModules(url) {
-  const segments = QRCode.create(url, { errorCorrectionLevel: "M" });
-  const size = segments.modules.size;
-  const modules = [];
-  for (let y = 0; y < size; y++) {
-    for (let x = 0; x < size; x++) {
-      modules.push(segments.modules.get(x, y) !== 0);
-    }
-  }
-  return { width: size, modules };
-}
-async function qrToTerminal(url) {
-  const { width, modules } = await qrModules(url);
-  const rows = [];
-  for (let i = 0; i < modules.length; i += width) {
-    rows.push(modules.slice(i, i + width));
-  }
-  const quiet = 2;
-  const fullWidth = width + quiet * 2;
-  const blankLine = " ".repeat(fullWidth);
-  const lines = [];
-  for (let i = 0; i < quiet; i++)
-    lines.push(blankLine);
-  let y = 0;
-  while (y < rows.length) {
-    const topRow = rows[y];
-    const botRow = y + 1 < rows.length ? rows[y + 1] : null;
-    let line = " ".repeat(quiet);
-    for (let x = 0; x < width; x++) {
-      const top = topRow[x];
-      const bot = botRow ? botRow[x] : false;
-      if (top && bot)
-        line += "\u2588";
-      else if (top && !bot)
-        line += "\u2580";
-      else if (!top && bot)
-        line += "\u2584";
-      else
-        line += " ";
-    }
-    line += " ".repeat(quiet);
-    lines.push(line);
-    y += 2;
-  }
-  for (let i = 0; i < quiet; i++)
-    lines.push(blankLine);
-  return lines.join("\n");
-}
-var init_qr = __esm({
-  "../core/dist/identity/qr.js"() {
-    "use strict";
-  }
-});
-
 // ../core/dist/bind/orchestrator.js
 async function bindAgent(opts) {
   const log = opts.log ?? ((m) => console.log(m));
@@ -1112,6 +1112,135 @@ var init_orchestrator = __esm({
   }
 });
 
+// ../core/dist/runtime/npm-prefix-self-heal.js
+function looksLikeEacces(stderr) {
+  const s = stderr.toLowerCase();
+  return s.includes("eacces") || s.includes("eperm") || s.includes("permission denied");
+}
+function looksLikeEnospc(stderr) {
+  const s = stderr.toLowerCase();
+  return s.includes("enospc") || s.includes("no space left");
+}
+async function trySwitchToUserPrefix(progress) {
+  const p = getPlatformAdapter();
+  const optOut = (p.env("BEEOS_NO_NPM_PREFIX_FIX") ?? "").trim();
+  if (optOut === "1" || optOut.toLowerCase() === "true") {
+    return {
+      success: false,
+      prefix: "",
+      persisted: false,
+      note: "BEEOS_NO_NPM_PREFIX_FIX=1 \u2014 refusing to auto-switch npm prefix."
+    };
+  }
+  const home = p.homeDir();
+  const newPrefix = p.joinPath(home, ".npm-global");
+  const current = await readCurrentPrefix();
+  if (current && current.startsWith(home)) {
+    return {
+      success: true,
+      prefix: current,
+      persisted: false,
+      note: `npm prefix already user-owned: ${current}`
+    };
+  }
+  progress.onStatus(`Switching npm global prefix to ${newPrefix} (user-owned).`);
+  await p.mkdir(newPrefix);
+  const setRes = await p.exec("npm", ["config", "set", "prefix", newPrefix]);
+  if (setRes.code !== 0) {
+    return {
+      success: false,
+      prefix: newPrefix,
+      persisted: false,
+      note: `npm config set prefix failed: ${(setRes.stderr || setRes.stdout).trim()}`
+    };
+  }
+  const binDir = p.platform() === "win32" ? newPrefix : p.joinPath(newPrefix, "bin");
+  const pathKey = p.platform() === "win32" ? "Path" : "PATH";
+  const sep = p.platform() === "win32" ? ";" : ":";
+  const existing = process.env[pathKey] ?? process.env.PATH ?? "";
+  if (!existing.split(sep).includes(binDir)) {
+    process.env[pathKey] = `${binDir}${sep}${existing}`;
+    if (pathKey !== "PATH")
+      process.env.PATH = process.env[pathKey];
+  }
+  let persisted = false;
+  if (p.platform() !== "win32") {
+    persisted = await persistShellRcBestEffort(binDir);
+  }
+  return {
+    success: true,
+    prefix: newPrefix,
+    persisted,
+    note: persisted ? `Persisted PATH to your shell rc.` : `PATH updated for this session; add '${binDir}' to your shell init to make it permanent.`
+  };
+}
+async function readCurrentPrefix() {
+  const p = getPlatformAdapter();
+  try {
+    const res = await p.exec("npm", ["prefix", "-g"], { timeout: 1e4 });
+    if (res.code !== 0)
+      return null;
+    const trimmed = res.stdout.trim();
+    return trimmed.length > 0 ? trimmed : null;
+  } catch {
+    return null;
+  }
+}
+async function persistShellRcBestEffort(binDir) {
+  const p = getPlatformAdapter();
+  const rc = pickRcPath();
+  if (!rc)
+    return false;
+  let existing = "";
+  try {
+    if (await p.exists(rc))
+      existing = await p.readFile(rc);
+  } catch {
+    return false;
+  }
+  if (existing.includes(SENTINEL_BEGIN)) {
+    return true;
+  }
+  const stamp = (/* @__PURE__ */ new Date()).toISOString();
+  const block = `
+${SENTINEL_BEGIN}
+# Added by @beeos/core npm-prefix-self-heal on ${stamp}
+# Reason: lazy install hit EACCES, switched npm prefix to a user-owned dir.
+# To revert: delete this block AND run \`npm config delete prefix\`.
+export PATH="${binDir}:$PATH"
+${SENTINEL_END}
+`;
+  try {
+    await p.writeFile(rc, existing + block);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function pickRcPath() {
+  const p = getPlatformAdapter();
+  const home = p.homeDir();
+  const shell = p.env("SHELL") ?? "";
+  const base = shell.split("/").pop() ?? "";
+  switch (base) {
+    case "zsh":
+      return p.joinPath(home, ".zshrc");
+    case "bash":
+      return p.platform() === "darwin" ? p.joinPath(home, ".bash_profile") : p.joinPath(home, ".bashrc");
+    default:
+      return null;
+  }
+}
+var SENTINEL_BEGIN, SENTINEL_END;
+var init_npm_prefix_self_heal = __esm({
+  "../core/dist/runtime/npm-prefix-self-heal.js"() {
+    "use strict";
+    init_platform_adapter();
+    SENTINEL_BEGIN = "# >>> beeos npm-prefix >>>";
+    SENTINEL_END = "# <<< beeos npm-prefix <<<";
+  }
+});
+
 // ../core/dist/upgrade.js
 function readPinSourcesFromEnv() {
   const env = globalThis.process?.env ?? {};
@@ -1183,13 +1312,23 @@ async function upgradeBeeosSuite(opts) {
   if (needsInstall) {
     const args = ["install", "-g", ...specs.map((s) => s.spec)];
     progress?.onStatus(`npm ${args.join(" ")}`);
-    try {
-      const result2 = await p.exec("npm", args, { timeout: 6e5 });
-      if (result2.code !== 0) {
-        installFailure = (result2.stderr || result2.stdout || `npm install -g exited ${result2.code}`).trim();
+    installFailure = await runNpmInstallOnce(args);
+    if (installFailure && looksLikeEacces(installFailure)) {
+      const reporter = progress ?? {
+        onStatus() {
+        },
+        onComplete() {
+        }
+      };
+      reporter.onStatus("npm install -g failed with EACCES \u2014 attempting prefix self-heal.");
+      const heal = await trySwitchToUserPrefix(reporter);
+      reporter.onStatus(heal.note);
+      if (heal.success) {
+        reporter.onStatus(`Retrying: npm ${args.join(" ")}`);
+        installFailure = await runNpmInstallOnce(args);
       }
-    } catch (e) {
-      installFailure = e instanceof Error ? e.message : String(e);
+    } else if (installFailure && looksLikeEnospc(installFailure)) {
+      installFailure = "npm install -g failed because the filesystem is out of space (typically /usr/local/lib/node_modules or %APPDATA%\\npm). Free disk space and retry. Original error:\n" + installFailure;
     }
   } else {
     progress?.onStatus("Already up to date \u2014 skipping npm install -g");
@@ -1220,6 +1359,58 @@ async function upgradeBeeosSuite(opts) {
   }
   return result;
 }
+async function runNpmInstallOnce(args) {
+  const p = getPlatformAdapter();
+  const useInherit = shouldInheritStdio();
+  try {
+    const result = await p.exec("npm", args, {
+      timeout: 6e5,
+      stdio: useInherit ? "inherit" : "pipe"
+    });
+    if (result.code !== 0) {
+      if (useInherit) {
+        const probe = await probeEaccesViaSet().catch(() => null);
+        if (probe)
+          return `npm install -g exited ${result.code}; ${probe}`;
+        return `npm install -g exited ${result.code}`;
+      }
+      return (result.stderr || result.stdout || `npm install -g exited ${result.code}`).trim();
+    }
+    return void 0;
+  } catch (e) {
+    return e instanceof Error ? e.message : String(e);
+  }
+}
+function shouldInheritStdio() {
+  const proc = globalThis.process;
+  if (!proc)
+    return false;
+  const isTty = Boolean(proc.stdout?.isTTY);
+  if (!isTty)
+    return false;
+  const env = proc.env ?? {};
+  if (env.BEEOS_NPM_QUIET === "1")
+    return false;
+  const argv = proc.argv ?? [];
+  if (argv.some((a) => a === "--json"))
+    return false;
+  return true;
+}
+async function probeEaccesViaSet() {
+  const p = getPlatformAdapter();
+  const res = await p.exec("npm", ["config", "get", "prefix"], {
+    timeout: 1e4
+  });
+  if (res.code !== 0)
+    return null;
+  const prefix = res.stdout.trim();
+  if (!prefix)
+    return null;
+  const home = p.homeDir();
+  if (prefix.startsWith(home))
+    return null;
+  return `EACCES likely (prefix ${prefix} outside $HOME)`;
+}
 function trimOrUndef(v) {
   if (v === void 0)
     return void 0;
@@ -1231,6 +1422,7 @@ var init_upgrade = __esm({
   "../core/dist/upgrade.js"() {
     "use strict";
     init_platform_adapter();
+    init_npm_prefix_self_heal();
     NPM_PKGS = {
       CLI: "@beeos-ai/cli",
       DEVICE_AGENT: "@beeos-ai/device-agent",
@@ -1371,6 +1563,75 @@ var init_device_setup = __esm({
   }
 });
 
+// ../core/dist/runtime/http-fetch-retry.js
+async function fetchWithRetry(url, opts) {
+  const p = getPlatformAdapter();
+  const max = opts.maxAttempts ?? 3;
+  let lastError = "";
+  let lastStatus = null;
+  for (let attempt = 1; attempt <= max; attempt++) {
+    let resp;
+    try {
+      resp = await p.fetch(url);
+    } catch (e) {
+      lastError = e instanceof Error ? e.message : String(e);
+      opts.progress.onStatus(`${opts.label} attempt ${attempt}/${max} failed: ${lastError}`);
+      if (attempt < max)
+        await sleepBackoff(attempt);
+      continue;
+    }
+    if (!resp.ok) {
+      lastStatus = resp.status;
+      opts.progress.onStatus(`${opts.label} attempt ${attempt}/${max}: HTTP ${resp.status} ${resp.statusText}`);
+      if (resp.status === 401 || resp.status === 403 || resp.status === 404) {
+        return {
+          ok: false,
+          status: resp.status,
+          lastError: `HTTP ${resp.status} ${resp.statusText}`
+        };
+      }
+      lastError = `HTTP ${resp.status} ${resp.statusText}`;
+      if (attempt < max)
+        await sleepBackoff(attempt);
+      continue;
+    }
+    try {
+      return { ok: true, bytes: new Uint8Array(await resp.arrayBuffer()) };
+    } catch (e) {
+      lastError = e instanceof Error ? e.message : String(e);
+      opts.progress.onStatus(`${opts.label} stream interrupted on attempt ${attempt}/${max}: ${lastError}`);
+      if (attempt < max)
+        await sleepBackoff(attempt);
+    }
+  }
+  opts.progress.onStatus(`${opts.label} gave up after ${max} attempts (last: ${lastError || "unknown"}).`);
+  return { ok: false, status: lastStatus, lastError };
+}
+async function fetchWithRetryOrNull(url, opts) {
+  const out = await fetchWithRetry(url, opts);
+  return out.ok ? out.bytes : null;
+}
+async function fetchTextWithRetryOrNull(url, opts) {
+  const bytes = await fetchWithRetryOrNull(url, opts);
+  if (!bytes)
+    return null;
+  try {
+    return new TextDecoder("utf-8").decode(bytes);
+  } catch {
+    return null;
+  }
+}
+function sleepBackoff(attempt) {
+  const ms = 1e3 * Math.pow(2, attempt - 1);
+  return new Promise((r) => setTimeout(r, ms));
+}
+var init_http_fetch_retry = __esm({
+  "../core/dist/runtime/http-fetch-retry.js"() {
+    "use strict";
+    init_platform_adapter();
+  }
+});
+
 // ../core/dist/adb-setup.js
 import { createHash } from "crypto";
 function managedAdbPath() {
@@ -1408,11 +1669,14 @@ async function installAdb(progress) {
   }
   const url = `${PLATFORM_TOOLS_BASE}/${zipName}`;
   progress.onStatus(`Downloading Android platform-tools (${zipName})...`);
-  const resp = await p.fetch(url);
-  if (!resp.ok) {
-    throw new Error(`platform-tools download failed: ${resp.status} ${resp.statusText}`);
+  const result = await fetchWithRetry(url, {
+    label: "platform-tools",
+    progress
+  });
+  if (!result.ok) {
+    throw new Error(`platform-tools download failed: ${result.lastError}` + (result.status ? ` (HTTP ${result.status})` : ""));
   }
-  const data = new Uint8Array(await resp.arrayBuffer());
+  const data = result.bytes;
   verifyPlatformToolsChecksum(zipName, data, progress);
   const binDir = p.joinPath(beeoHome(), "bin");
   await p.mkdir(binDir);
@@ -1511,6 +1775,7 @@ var init_adb_setup = __esm({
     init_platform_adapter();
     init_paths();
     init_errors();
+    init_http_fetch_retry();
     PLATFORM_TOOLS_BASE = "https://dl.google.com/android/repository";
     PLATFORM_TOOLS_REVISION = "r37.0.0";
     PLATFORM_TOOLS_ARCHIVE = {
@@ -1797,46 +2062,16 @@ function archiveName(cfg, target) {
   const suffix = target.includes("windows") ? "zip" : "tar.gz";
   return `${cfg.name}-${target}.${suffix}`;
 }
-async function fetchArchiveBuffer(cfg, url, progress, maxAttempts = 3) {
-  const p = getPlatformAdapter();
-  let lastError = null;
-  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
-    let resp;
-    try {
-      resp = await p.fetch(url);
-    } catch (e) {
-      lastError = String(e);
-      progress.onStatus(`${cfg.name} download attempt ${attempt}/${maxAttempts} failed: ${lastError}`);
-      if (attempt < maxAttempts) {
-        await new Promise((r) => setTimeout(r, 1e3 * 2 ** (attempt - 1)));
-      }
-      continue;
-    }
-    if (!resp.ok) {
-      progress.onStatus(`${cfg.name} download: ${resp.status} ${resp.statusText} (${url})`);
-      if (resp.status === 404) {
-        progress.onStatus(`Hint: the current release may not include the requested target. Try setting $${cfg.binaryEnv} to a locally built binary, ` + (cfg.releaseUrlEnv ? `or $${cfg.releaseUrlEnv} to a different release URL.` : `or check for a newer release.`));
-      }
-      if (resp.status === 404 || resp.status === 403 || resp.status === 401) {
-        return null;
-      }
-      lastError = `${resp.status} ${resp.statusText}`;
-      if (attempt < maxAttempts) {
-        await new Promise((r) => setTimeout(r, 1e3 * 2 ** (attempt - 1)));
-      }
-      continue;
-    }
-    try {
-      return new Uint8Array(await resp.arrayBuffer());
-    } catch (e) {
-      lastError = String(e);
-      progress.onStatus(`${cfg.name} stream interrupted on attempt ${attempt}/${maxAttempts}: ${lastError}`);
-      if (attempt < maxAttempts) {
-        await new Promise((r) => setTimeout(r, 1e3 * 2 ** (attempt - 1)));
-      }
-    }
+async function fetchArchiveBuffer(cfg, url, progress) {
+  const out = await fetchWithRetry(url, {
+    label: cfg.name,
+    progress
+  });
+  if (out.ok)
+    return out.bytes;
+  if (out.status === 404) {
+    progress.onStatus(`Hint: the current release may not include the requested target. Try setting $${cfg.binaryEnv} to a locally built binary, ` + (cfg.releaseUrlEnv ? `or $${cfg.releaseUrlEnv} to a different release URL.` : `or check for a newer release.`));
   }
-  progress.onStatus(`${cfg.name} download gave up after ${maxAttempts} attempts (last: ${lastError ?? "unknown"}).`);
   return null;
 }
 async function downloadManagedBinary(cfg, target, progress) {
@@ -1851,20 +2086,19 @@ async function downloadManagedBinary(cfg, target, progress) {
   const allowUnverified = (process.env?.BEEOS_ALLOW_UNVERIFIED_SIDECAR ?? "").toLowerCase() === "1" || (process.env?.BEEOS_ALLOW_UNVERIFIED_SIDECAR ?? "").toLowerCase() === "true";
   let expected = null;
   let digestFetchError = null;
-  try {
-    const digResp = await p.fetch(digestUrl);
-    if (digResp.ok) {
-      const text = (await digResp.text()).trim();
-      const first = text.split(/\s+/)[0] ?? "";
-      if (/^[a-f0-9]{64}$/i.test(first))
-        expected = first.toLowerCase();
-      else
-        digestFetchError = `malformed .sha256 body: ${text.slice(0, 80)}`;
-    } else {
-      digestFetchError = `HTTP ${digResp.status}`;
-    }
-  } catch (e) {
-    digestFetchError = e instanceof Error ? e.message : String(e);
+  const digestText = await fetchTextWithRetryOrNull(digestUrl, {
+    label: `${cfg.name}.sha256`,
+    progress
+  });
+  if (digestText !== null) {
+    const trimmed = digestText.trim();
+    const first = trimmed.split(/\s+/)[0] ?? "";
+    if (/^[a-f0-9]{64}$/i.test(first))
+      expected = first.toLowerCase();
+    else
+      digestFetchError = `malformed .sha256 body: ${trimmed.slice(0, 80)}`;
+  } else {
+    digestFetchError = "fetch failed (see attempts above)";
   }
   if (expected) {
     const actual = createHash2("sha256").update(data).digest("hex");
@@ -1955,6 +2189,7 @@ var init_cargo_dist = __esm({
     init_platform_adapter();
     init_paths();
     init_errors();
+    init_http_fetch_retry();
   }
 });
 
@@ -2301,8 +2536,8 @@ function normalizeOpenAiBaseUrl(input) {
   } catch {
     return input;
   }
-  const path10 = url.pathname.replace(/\/+$/, "");
-  if (path10 === "" || path10 === "/") {
+  const path12 = url.pathname.replace(/\/+$/, "");
+  if (path12 === "" || path12 === "/") {
     url.pathname = "/v1";
     return url.toString().replace(/\/+$/, "");
   }
@@ -2637,7 +2872,7 @@ async function identifyGateway(opts) {
   const url = `http://${host}:${port}/beeos/status`;
   const controller = globalThis.AbortController ? new AbortController() : null;
   const timer = controller ? setTimeout(() => controller.abort(), timeoutMs) : null;
-  let resp = null;
+  let resp;
   try {
     resp = await p.fetch(url, {
       method: "GET",
@@ -2799,12 +3034,12 @@ async function generateOpenclawConfig(ctx) {
     seedResult = await p.exec(ctx.agentBinary, ["setup", "--non-interactive", "--mode", "local"], { env });
   }
   if (seedResult.code === 0) {
-    for (const [path10, value] of [
+    for (const [path12, value] of [
       ["gateway.auth.token", ctx.gatewayToken],
       ["gateway.remote.token", ctx.gatewayToken],
       ["gateway.bind", "lan"]
     ]) {
-      await runConfigSet(ctx.agentBinary, ctx.agentHome, path10, value, false, false);
+      await runConfigSet(ctx.agentBinary, ctx.agentHome, path12, value, false, false);
     }
     await runConfigSet(ctx.agentBinary, ctx.agentHome, "gateway.controlUi.dangerouslyAllowHostHeaderOriginFallback", "true", true, false);
     await configurePluginViaCli(ctx);
@@ -2869,9 +3104,9 @@ async function writeConfigFallback(ctx) {
   await p.writeFile(configPath2, JSON.stringify(config, null, 2));
   await writePairedJson(ctx.agentHome, ctx.keyFile);
 }
-async function runConfigSet(bin, home, path10, value, json, isSystemHome) {
+async function runConfigSet(bin, home, path12, value, json, isSystemHome) {
   const p = getPlatformAdapter();
-  const args = ["config", "set", path10, value];
+  const args = ["config", "set", path12, value];
   if (json)
     args.push("--json");
   const env = {};
@@ -2879,7 +3114,7 @@ async function runConfigSet(bin, home, path10, value, json, isSystemHome) {
     env.OPENCLAW_STATE_DIR = home;
   const result = await p.exec(bin, args, { env });
   if (result.code !== 0) {
-    throw new Error(`\`openclaw config set ${path10}\` exited with ${result.code}`);
+    throw new Error(`\`openclaw config set ${path12}\` exited with ${result.code}`);
   }
 }
 async function writePairedJson(home, keyFile) {
@@ -3512,7 +3747,7 @@ async function detectColdStartState() {
   const p = getPlatformAdapter();
   const port5900Listening = await p.tcpProbe("127.0.0.1", 5900, PORT_5900_PROBE_TIMEOUT_MS).catch(() => false);
   const passwordFile = p.joinPath(beeoHome(), "vnc.password");
-  let vncPasswordFileExists = false;
+  let vncPasswordFileExists;
   try {
     const raw = await p.readFile(passwordFile);
     vncPasswordFileExists = raw.trim().length > 0;
@@ -3648,8 +3883,8 @@ launchctl kickstart -k system/com.apple.screensharing
 `;
   const aslEscaped = shellPayload.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n");
   const osascriptArg = `do shell script "${aslEscaped}" with administrator privileges`;
-  let stderr = "";
-  let code = 1;
+  let stderr;
+  let code;
   try {
     const result = await p.exec("osascript", ["-e", osascriptArg], {
       timeout: OSASCRIPT_TIMEOUT_MS
@@ -3782,7 +4017,7 @@ async function detectLinuxColdStartState() {
   const p = getPlatformAdapter();
   const port5901Listening = await p.tcpProbe("127.0.0.1", LINUX_VNC_PORT, PORT_PROBE_TIMEOUT_MS).catch(() => false);
   const beeoFile = p.joinPath(beeoHome(), "vnc.password");
-  let beeoPasswordFileExists = false;
+  let beeoPasswordFileExists;
   try {
     const raw = await p.readFile(beeoFile);
     beeoPasswordFileExists = raw.trim().length > 0;
@@ -3790,7 +4025,7 @@ async function detectLinuxColdStartState() {
     beeoPasswordFileExists = false;
   }
   const systemFile = p.joinPath(p.homeDir(), ".vnc", "passwd");
-  let systemPasswordFileExists = false;
+  let systemPasswordFileExists;
   try {
     const raw = await p.readFile(systemFile);
     systemPasswordFileExists = raw.length > 0;
@@ -4050,7 +4285,7 @@ async function detectWindowsColdStartState() {
   const p = getPlatformAdapter();
   const port5900Listening = await p.tcpProbe("127.0.0.1", WIN_VNC_PORT, PORT_PROBE_TIMEOUT_MS2).catch(() => false);
   const beeoFile = p.joinPath(beeoHome(), "vnc.password");
-  let beeoPasswordFileExists = false;
+  let beeoPasswordFileExists;
   try {
     const raw = await p.readFile(beeoFile);
     beeoPasswordFileExists = raw.trim().length > 0;
@@ -5923,7 +6158,7 @@ ${(/* @__PURE__ */ new Date()).toISOString()}
       return false;
     }
   }
-  let stale = false;
+  let stale;
   try {
     const stat = await fs5.stat(lockFile);
     stale = Date.now() - stat.mtimeMs > STALE_LOCK_AGE_MS;
@@ -6167,6 +6402,7 @@ var init_dist = __esm({
     init_gateway_token();
     init_state();
     init_keypair();
+    init_qr();
     init_client();
     init_orchestrator();
     init_process();
@@ -6185,6 +6421,10 @@ var init_dist = __esm({
     init_driver2();
     init_constants();
     init_agent_status();
+    init_config();
+    init_download();
+    init_plugin();
+    init_token();
     init_desktop_detect();
     init_macos_desktop_cold_start();
     init_desktop();
@@ -6197,6 +6437,8 @@ var init_dist = __esm({
     init_tail_logs();
     init_cli_version();
     init_upgrade();
+    init_npm_prefix_self_heal();
+    init_http_fetch_retry();
   }
 });
 
@@ -6630,10 +6872,10 @@ function devicesPath() {
 }
 async function loadDeviceState() {
   const p = getPlatformAdapter();
-  const path10 = devicesPath();
-  if (!await p.exists(path10)) return { devices: [] };
+  const path12 = devicesPath();
+  if (!await p.exists(path12)) return { devices: [] };
   try {
-    const raw = await p.readFile(path10);
+    const raw = await p.readFile(path12);
     return JSON.parse(raw);
   } catch {
     return { devices: [] };
@@ -6645,12 +6887,12 @@ async function saveDeviceState(state) {
 }
 async function withDeviceLock(fn) {
   const p = getPlatformAdapter();
-  const path10 = devicesPath();
-  await p.mkdir(p.dirname(path10));
-  if (!await p.exists(path10)) {
-    await p.writeFile(path10, JSON.stringify({ devices: [] }));
+  const path12 = devicesPath();
+  await p.mkdir(p.dirname(path12));
+  if (!await p.exists(path12)) {
+    await p.writeFile(path12, JSON.stringify({ devices: [] }));
   }
-  const release = await lockfile.lock(path10, { retries: 3 });
+  const release = await lockfile.lock(path12, { retries: 3 });
   try {
     return await fn();
   } finally {
@@ -7321,9 +7563,12 @@ var init_attach = __esm({
 });
 
 // src/commands/device/detach.ts
+import fs9 from "fs/promises";
+import path9 from "path";
 async function detach(options) {
   const cfg = await loadOrCreateConfig();
   const mgr = await getServiceManager();
+  const rotated = [];
   await withDeviceLock(async () => {
     const state = await loadDeviceState();
     if (options.all) {
@@ -7331,11 +7576,19 @@ async function detach(options) {
         await removeTargetsForSerial(mgr, entry2.serial);
         legacyKillDeviceEntry(entry2);
         await notifyOffline(cfg.platform.api_url, entry2.instance_id);
+        if (options.rotateIdentity) {
+          if (await tryRotateIdentity(entry2.serial)) rotated.push(entry2.serial);
+        }
       }
       const count = state.devices.length;
       state.devices = [];
       await saveDeviceState(state);
       console.log(`Detached ${count} device(s)`);
+      if (options.rotateIdentity) {
+        console.log(
+          `Rotated identity for ${rotated.length} device(s); next attach will re-bind from scratch.`
+        );
+      }
       return;
     }
     if (!options.serial) {
@@ -7348,10 +7601,35 @@ async function detach(options) {
     legacyKillDeviceEntry(entry);
     await notifyOffline(cfg.platform.api_url, entry.instance_id);
     await saveDeviceState(state);
+    if (options.rotateIdentity) {
+      if (await tryRotateIdentity(entry.serial)) rotated.push(entry.serial);
+    }
     console.log(`Detached device ${options.serial}`);
+    if (options.rotateIdentity) {
+      console.log(
+        rotated.length > 0 ? `Rotated local identity (~/.beeos/identity/device-${options.serial}.key.json removed). Next attach will re-bind from scratch.` : `No local identity file found for ${options.serial} \u2014 nothing to rotate.`
+      );
+    }
   });
   await notifyFleetReloadBestEffort();
 }
+async function tryRotateIdentity(serial) {
+  const keyPath = path9.join(
+    beeoHome(),
+    "identity",
+    `device-${serial}.key.json`
+  );
+  try {
+    await fs9.unlink(keyPath);
+    return true;
+  } catch (e) {
+    if (e.code === "ENOENT") return false;
+    console.error(
+      `  identity file ${keyPath} could not be removed: ${e.message}`
+    );
+    return false;
+  }
+}
 function legacyKillDeviceEntry(entry) {
   if (entry.pid && isProcessAlive(entry.pid)) killProcess(entry.pid);
   if (entry.bridge_pid && isProcessAlive(entry.bridge_pid)) killProcess(entry.bridge_pid);
@@ -7714,8 +7992,36 @@ var NodePlatformAdapter = class {
   }
   // ── Process execution ───────────────────────────────────
   exec(cmd, args, options) {
+    const env = options?.env ? { ...process.env, ...options.env } : process.env;
+    if (options?.stdio === "inherit") {
+      return new Promise((resolve) => {
+        const child = nodeSpawn(cmd, args, {
+          cwd: options?.cwd,
+          env,
+          shell: process.platform === "win32",
+          windowsHide: true,
+          stdio: "inherit"
+        });
+        let timer = null;
+        if (options?.timeout && options.timeout > 0) {
+          timer = setTimeout(() => {
+            try {
+              child.kill("SIGTERM");
+            } catch {
+            }
+          }, options.timeout);
+        }
+        child.on("error", () => {
+          if (timer) clearTimeout(timer);
+          resolve({ stdout: "", stderr: "", code: 1 });
+        });
+        child.on("exit", (code) => {
+          if (timer) clearTimeout(timer);
+          resolve({ stdout: "", stderr: "", code: code ?? 1 });
+        });
+      });
+    }
     return new Promise((resolve) => {
-      const env = options?.env ? { ...process.env, ...options.env } : process.env;
       execFile6(
         cmd,
         args,
@@ -7899,10 +8205,9 @@ async function run(agentFramework, options) {
   const ttyHints = !options.json && process.stdin.isTTY === true;
   const desktopCapable = hasDesktopCapability(driver);
   const desktopPipeline = desktopCapable ? getDesktopPipeline() : null;
-  let coldStart = null;
   if (desktopPipeline) {
     const interactive = !options.json && process.stdin.isTTY === true && process.stdout.isTTY === true;
-    coldStart = await desktopPipeline.coldStart({
+    const coldStart = await desktopPipeline.coldStart({
       prompt: interactive ? promptYesNo : void 0,
       log: options.json ? () => void 0 : (m) => console.log(m),
       yes: options.force === true
@@ -8638,8 +8943,8 @@ async function pickInstalledPackages() {
 // src/commands/doctor.ts
 init_dist();
 init_json_envelope();
-import fs9 from "fs/promises";
-import path9 from "path";
+import fs10 from "fs/promises";
+import path10 from "path";
 var LOG_SIZE_WARN_BYTES = 50 * 1024 * 1024;
 async function run8(options) {
   const state = await detectExistingInstall();
@@ -8656,8 +8961,13 @@ async function run8(options) {
   const resolvedAgentGatewayUrl = resolveAgentGatewayUrl(cfg);
   const agentGatewayHealth = await probeAgentGateway(resolvedAgentGatewayUrl);
   const tools = await collectToolStatus();
+  const adbDaemon = tools.adb.path ? await probeAdbDaemon(tools.adb.path) : { reachable: false, deviceCount: 0, detail: "adb not on PATH" };
+  const identityFile = await probeIdentityKeypair();
+  const ports = await probePorts();
+  const nodeEngines = await probeNodeEngines();
   const hasBoundDevices = state.devices.entries.length > 0;
   const shimReport = await collectShimReport(hasBoundDevices);
+  const npmPrefix = await readCurrentPrefix();
   const warnings = [];
   const hints = [];
   if (!state.hasIdentity) {
@@ -8731,6 +9041,42 @@ async function run8(options) {
     warnings.push(
       "adb not found \u2014 `beeos device attach` will download Android platform-tools on first use"
     );
+  } else if (!adbDaemon.reachable) {
+    warnings.push(`adb daemon unreachable: ${adbDaemon.detail}`);
+    hints.push(
+      "try `adb kill-server && adb start-server` to reset; on Linux check udev rules; on Windows reinstall Android USB drivers"
+    );
+  }
+  if (state.hasIdentity && !identityFile.parseable) {
+    warnings.push(
+      `identity keypair file present but unreadable/malformed (${identityFile.detail}). Binding will fail; backup and regenerate via \`beeos init\` (option [3] reset all).`
+    );
+  }
+  if (ports.port7900Occupied) {
+    warnings.push(
+      "port 7900 is in use \u2014 device-mcp-server may not start cleanly on the next attach."
+    );
+    hints.push(
+      "find the holder: `lsof -i :7900` (POSIX) or `netstat -ano | findstr :7900` (Windows)"
+    );
+  }
+  if (ports.port7950Occupied) {
+    warnings.push(
+      "port 7950 is in use \u2014 fleet IPC may not bind on the next attach."
+    );
+    hints.push(
+      "find the holder: `lsof -i :7950` (POSIX) or `netstat -ano | findstr :7950` (Windows)"
+    );
+  }
+  for (const e of nodeEngines.entries) {
+    if (e.satisfies === false) {
+      warnings.push(
+        `${e.pkg}@${e.installed} requires Node ${e.required} but you are on ${e.current}.`
+      );
+      hints.push(
+        `upgrade Node (e.g. 'nvm install --lts' / 'fnm install --lts') and re-run \`beeos device attach\``
+      );
+    }
   }
   for (const e of shimReport.entries) {
     if (e.outcome === "outdated") {
@@ -8750,7 +9096,7 @@ async function run8(options) {
   const bloatedLogs = await checkLogFileSizes();
   for (const l of bloatedLogs) {
     warnings.push(
-      `Service log large: ${path9.basename(l.path)} = ${formatBytes(l.size)}`
+      `Service log large: ${path10.basename(l.path)} = ${formatBytes(l.size)}`
     );
     hints.push(`truncate safely: : > ${l.path}`);
   }
@@ -8771,7 +9117,12 @@ async function run8(options) {
         },
         agentGateway: agentGatewayHealth,
         tools,
+        adbDaemon,
+        identityFile,
+        ports,
+        nodeEngines,
         npmShims: shimReport,
+        npmPrefix,
         warnings,
         hints
       })
@@ -8798,8 +9149,20 @@ async function run8(options) {
     console.log(`    - ${s.id.padEnd(28)} ${status2}${pid}`);
   }
   console.log(`  adb          : ${tools.adb.path ?? "not found"}`);
+  if (tools.adb.path) {
+    console.log(
+      `    daemon     : ${adbDaemon.reachable ? `reachable (${adbDaemon.deviceCount} device${adbDaemon.deviceCount === 1 ? "" : "s"})` : `unreachable \u2014 ${adbDaemon.detail}`}`
+    );
+  }
   console.log(`  scrcpy-bridge: ${tools.scrcpyBridge.path ?? "not installed (auto on attach)"}`);
   console.log(`  vnc-bridge   : ${tools.vncBridge.path ?? "not installed (auto on --vnc-host)"}`);
+  console.log(`  npm prefix   : ${npmPrefix ?? "(unknown \u2014 npm not on PATH?)"}`);
+  console.log(
+    `  identity     : ${identityFile.parseable ? "ok" : identityFile.exists ? `corrupt (${identityFile.detail})` : "not yet created"}`
+  );
+  console.log(
+    `  ports        : 7900 ${ports.port7900Occupied ? "in use" : "free"}, 7950 ${ports.port7950Occupied ? "in use" : "free"}`
+  );
   console.log("");
   console.log("  npm shims:");
   for (const e of shimReport.entries) {
@@ -8882,19 +9245,19 @@ function shimMarker(outcome) {
   }
 }
 async function checkLogFileSizes() {
-  const dir = path9.join(beeoHome(), "logs", "services");
+  const dir = path10.join(beeoHome(), "logs", "services");
   let entries;
   try {
-    entries = await fs9.readdir(dir);
+    entries = await fs10.readdir(dir);
   } catch {
     return [];
   }
   const bloated = [];
   for (const name of entries) {
     if (!name.endsWith(".log")) continue;
-    const full = path9.join(dir, name);
+    const full = path10.join(dir, name);
     try {
-      const st = await fs9.stat(full);
+      const st = await fs10.stat(full);
       if (st.isFile() && st.size >= LOG_SIZE_WARN_BYTES) {
         bloated.push({ path: full, size: st.size });
       }
@@ -8961,6 +9324,173 @@ function formatAgentGatewayStatus(h) {
   if (h.status === "unhealthy") return `HTTP ${h.httpStatus ?? "?"}`;
   return h.detail;
 }
+var ADB_PROBE_START_SERVER_TIMEOUT_MS = 3e3;
+var ADB_PROBE_DEVICES_TIMEOUT_MS = 1500;
+async function probeAdbDaemon(adbPath) {
+  const p = getPlatformAdapter();
+  try {
+    const start = await p.exec(adbPath, ["start-server"], {
+      timeout: ADB_PROBE_START_SERVER_TIMEOUT_MS
+    });
+    if (start.code !== 0) {
+      return {
+        reachable: false,
+        deviceCount: 0,
+        detail: `adb start-server exited ${start.code} (timeout ${ADB_PROBE_START_SERVER_TIMEOUT_MS}ms): ${(start.stderr || start.stdout).trim().slice(0, 120)}`
+      };
+    }
+  } catch (e) {
+    return {
+      reachable: false,
+      deviceCount: 0,
+      detail: `adb start-server failed (timeout ${ADB_PROBE_START_SERVER_TIMEOUT_MS}ms): ${e instanceof Error ? e.message : String(e)}`
+    };
+  }
+  try {
+    const list2 = await p.exec(adbPath, ["devices"], {
+      timeout: ADB_PROBE_DEVICES_TIMEOUT_MS
+    });
+    if (list2.code !== 0) {
+      return {
+        reachable: false,
+        deviceCount: 0,
+        detail: `adb devices exited ${list2.code} (timeout ${ADB_PROBE_DEVICES_TIMEOUT_MS}ms)`
+      };
+    }
+    const lines = list2.stdout.split("\n").slice(1).map((l) => l.trim());
+    const deviceCount = lines.filter((l) => l.endsWith("	device")).length;
+    return {
+      reachable: true,
+      deviceCount,
+      detail: `${deviceCount} device(s) authorized`
+    };
+  } catch (e) {
+    return {
+      reachable: false,
+      deviceCount: 0,
+      detail: `adb devices failed (timeout ${ADB_PROBE_DEVICES_TIMEOUT_MS}ms): ${e instanceof Error ? e.message : String(e)}`
+    };
+  }
+}
+async function probeIdentityKeypair() {
+  const p = getPlatformAdapter();
+  const kpPath = p.joinPath(beeoHome(), "identity", "keypair.json");
+  if (!await p.exists(kpPath)) {
+    return {
+      exists: false,
+      readable: false,
+      parseable: false,
+      detail: "not yet generated"
+    };
+  }
+  let raw;
+  try {
+    raw = await p.readFile(kpPath);
+  } catch (e) {
+    return {
+      exists: true,
+      readable: false,
+      parseable: false,
+      detail: `read failed: ${e instanceof Error ? e.message : String(e)}`
+    };
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.publicKey !== "string" || typeof parsed.privateKey !== "string") {
+      return {
+        exists: true,
+        readable: true,
+        parseable: false,
+        detail: "missing publicKey / privateKey fields"
+      };
+    }
+    return {
+      exists: true,
+      readable: true,
+      parseable: true,
+      detail: "ok"
+    };
+  } catch (e) {
+    return {
+      exists: true,
+      readable: true,
+      parseable: false,
+      detail: `JSON parse failed: ${e instanceof Error ? e.message : String(e)}`
+    };
+  }
+}
+async function probePorts() {
+  const p = getPlatformAdapter();
+  const [p7900, p7950] = await Promise.all([
+    p.tcpProbe("127.0.0.1", 7900, 500),
+    p.tcpProbe("127.0.0.1", 7950, 500)
+  ]);
+  return { port7900Occupied: p7900, port7950Occupied: p7950 };
+}
+async function probeNodeEngines() {
+  const targets = [NPM_PKGS.DEVICE_AGENT, NPM_PKGS.DEVICE_MCP_SERVER];
+  const current = process.version.replace(/^v/, "");
+  const entries = [];
+  for (const pkg of targets) {
+    const installed = await npmGlobalVersion(pkg).catch(() => null);
+    if (!installed) {
+      entries.push({
+        pkg,
+        installed: null,
+        required: null,
+        current,
+        satisfies: null
+      });
+      continue;
+    }
+    const required = await readPkgEnginesNode(pkg);
+    entries.push({
+      pkg,
+      installed,
+      required,
+      current,
+      satisfies: required ? satisfiesMinNode(current, required) : null
+    });
+  }
+  return { entries };
+}
+async function readPkgEnginesNode(pkg) {
+  const p = getPlatformAdapter();
+  const rootRes = await p.exec("npm", ["root", "-g"], { timeout: 5e3 });
+  if (rootRes.code !== 0) return null;
+  const root = rootRes.stdout.trim();
+  if (!root) return null;
+  const pkgJsonPath = path10.join(root, pkg, "package.json");
+  try {
+    const raw = await fs10.readFile(pkgJsonPath, "utf-8");
+    const parsed = JSON.parse(raw);
+    const node = parsed.engines?.node?.trim();
+    return node && node.length > 0 ? node : null;
+  } catch {
+    return null;
+  }
+}
+function satisfiesMinNode(current, spec) {
+  const m = /^>=\s*(\d+)(?:\.(\d+))?(?:\.(\d+))?$/.exec(spec.trim());
+  if (!m) return null;
+  const want = [
+    Number(m[1]),
+    Number(m[2] ?? 0),
+    Number(m[3] ?? 0)
+  ];
+  const have = parseSemver(current);
+  if (!have) return null;
+  for (let i = 0; i < 3; i++) {
+    if (have[i] > want[i]) return true;
+    if (have[i] < want[i]) return false;
+  }
+  return true;
+}
+function parseSemver(v) {
+  const m = /^(\d+)\.(\d+)\.(\d+)/.exec(v);
+  if (!m) return null;
+  return [Number(m[1]), Number(m[2]), Number(m[3])];
+}
 
 // src/commands/service.ts
 init_dist();
@@ -9178,6 +9708,194 @@ async function run10(idArg, options) {
   }
 }
 
+// src/commands/report.ts
+init_dist();
+init_json_envelope();
+import fs11 from "fs/promises";
+import { createReadStream, createWriteStream } from "fs";
+import path11 from "path";
+import { spawn as spawn3 } from "child_process";
+import { create as tarCreate } from "tar";
+var LOG_TAIL_BYTES = 1024 * 1024;
+async function run11(opts = {}) {
+  const home = beeoHome();
+  const reportsDir = path11.join(home, "reports");
+  await fs11.mkdir(reportsDir, { recursive: true });
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  const reportName = `beeos-report-${stamp}`;
+  const stagingDir = path11.join(reportsDir, reportName);
+  await fs11.mkdir(stagingDir, { recursive: true });
+  try {
+    if (!opts.skipDoctor) {
+      const doctorJson = await runDoctorJson();
+      await fs11.writeFile(
+        path11.join(stagingDir, "doctor.json"),
+        doctorJson,
+        "utf-8"
+      );
+    }
+    try {
+      const cfgRaw = await fs11.readFile(configPath(), "utf-8");
+      await fs11.writeFile(
+        path11.join(stagingDir, "config.toml"),
+        cfgRaw,
+        "utf-8"
+      );
+    } catch {
+      await fs11.writeFile(
+        path11.join(stagingDir, "config.toml"),
+        "# (no ~/.beeos/config.toml on this machine)\n",
+        "utf-8"
+      );
+    }
+    try {
+      const state = await loadState();
+      await fs11.writeFile(
+        path11.join(stagingDir, "state.json"),
+        JSON.stringify(redactSecrets(state), null, 2),
+        "utf-8"
+      );
+    } catch {
+      await fs11.writeFile(
+        path11.join(stagingDir, "state.json"),
+        "{}\n",
+        "utf-8"
+      );
+    }
+    const logsSrc = path11.join(home, "logs", "services");
+    const logsDst = path11.join(stagingDir, "services-logs");
+    await fs11.mkdir(logsDst, { recursive: true });
+    let logEntries = [];
+    try {
+      logEntries = await fs11.readdir(logsSrc);
+    } catch {
+    }
+    for (const name of logEntries) {
+      if (!name.endsWith(".log")) continue;
+      const src = path11.join(logsSrc, name);
+      const dst = path11.join(logsDst, name);
+      try {
+        await tailCopy(src, dst, LOG_TAIL_BYTES);
+      } catch {
+      }
+    }
+    const tarballPath = path11.join(reportsDir, `${reportName}.tar.gz`);
+    await tarCreate(
+      { gzip: true, file: tarballPath, cwd: reportsDir },
+      [reportName]
+    );
+    if (opts.json) {
+      emitJsonEnvelope(
+        jsonOk({
+          tarball: tarballPath,
+          included: [
+            "doctor.json",
+            "config.toml",
+            "state.json",
+            "services-logs/"
+          ],
+          excluded: [
+            "identity/keypair.json",
+            "identity/device-*.key.json"
+          ]
+        })
+      );
+    } else {
+      console.log("");
+      console.log(`  Report: ${tarballPath}`);
+      console.log("");
+      console.log("  Attach this file to your support ticket.");
+      console.log(
+        "  It contains: doctor.json, config.toml, state.json, last 1MiB of every service log."
+      );
+      console.log("  It does NOT contain: identity/keypair.json (private key).");
+      console.log("");
+    }
+  } finally {
+    await fs11.rm(stagingDir, { recursive: true, force: true }).catch(() => {
+    });
+  }
+}
+async function runDoctorJson() {
+  const cliEntry = process.argv[1];
+  if (!cliEntry) {
+    return JSON.stringify(
+      { ok: false, error: { code: "no_entry", message: "process.argv[1] missing" } },
+      null,
+      2
+    );
+  }
+  return new Promise((resolve) => {
+    let stdout = "";
+    let stderr = "";
+    const child = spawn3(process.execPath, [cliEntry, "doctor", "--json"], {
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    child.stdout?.on("data", (c) => {
+      stdout += c.toString();
+    });
+    child.stderr?.on("data", (c) => {
+      stderr += c.toString();
+    });
+    const timer = setTimeout(() => {
+      try {
+        child.kill("SIGTERM");
+      } catch {
+      }
+    }, 3e4);
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      if (code === 0 && stdout.trim().length > 0) {
+        resolve(stdout);
+      } else {
+        resolve(
+          JSON.stringify(
+            {
+              ok: false,
+              error: {
+                code: "doctor_failed",
+                exitCode: code,
+                stderr: stderr.trim()
+              }
+            },
+            null,
+            2
+          )
+        );
+      }
+    });
+  });
+}
+async function tailCopy(src, dst, tailBytes) {
+  const stat = await fs11.stat(src);
+  const start = stat.size > tailBytes ? stat.size - tailBytes : 0;
+  await new Promise((resolve, reject) => {
+    const rs = createReadStream(src, { start });
+    const ws = createWriteStream(dst);
+    rs.on("error", reject);
+    ws.on("error", reject);
+    ws.on("finish", () => resolve());
+    rs.pipe(ws);
+  });
+}
+function redactSecrets(state) {
+  const SECRET_KEY_RE = /(token|secret|password|api_?key|bearer|jwt|cookie)/i;
+  function walk(value) {
+    if (value === null || typeof value !== "object") return value;
+    if (Array.isArray(value)) return value.map(walk);
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      if (typeof v === "string" && SECRET_KEY_RE.test(k)) {
+        out[k] = `<redacted ${v.length}b>`;
+      } else {
+        out[k] = walk(v);
+      }
+    }
+    return out;
+  }
+  return walk(state);
+}
+
 // src/index.ts
 setPlatformAdapter(new NodePlatformAdapter());
 var program = new Command();
@@ -9185,6 +9903,9 @@ var cliVersion = getCliVersion(import.meta.url, resolveActiveDistTag());
 program.name("beeos").version(cliVersion.display).description("BeeOS \u2014 run AI agents from your desktop");
 program.command("init").description("One-shot install + bind flow (default entry from the curl installer)").option("--framework <name>", "Agent framework to install (default: openclaw)").option("--yes", "Non-interactive \u2014 accept the default action", false).option("--json", "Output machine-readable JSON (implies --yes)", false).option("--no-browser", "Don't auto-open a browser for bind confirmation").option("--headless", "Never open a browser (use terminal QR only)", false).option("--skip-service-prompt", "Skip the system-service install prompt", false).option("--device", "Jump straight into `beeos device attach` instead", false).action((opts) => run7(opts));
 program.command("doctor").description("Inspect local BeeOS state (install, binding, services, warnings)").option("--json", "Output machine-readable JSON", false).action((opts) => run8(opts));
+program.command("report").description(
+  "Bundle a diagnostic tarball (~/.beeos/reports/beeos-report-<ts>.tar.gz) for support tickets. Includes doctor.json + redacted config + last 1MiB of every service log. NEVER includes identity/keypair.json."
+).option("--json", "Output machine-readable JSON envelope ({ok,data})", false).option("--skip-doctor", "Skip running `beeos doctor` as a subprocess", false).action((opts) => run11(opts));
 program.command("migrate").description("Migrate legacy Node supervisor state to OS-native services (one-shot)").option("--json", "Output machine-readable JSON", false).action((opts) => run9(opts));
 program.command("logs").description(
   "Tail logs for a BeeOS service. Pass an ADB serial or service id; omit to list every registered service's log file path."
@@ -9212,7 +9933,11 @@ deviceCmd.command("attach").description("Attach an ADB-connected device as an AI
   "--agent-gateway-url <url>",
   "Override the Agent Gateway URL for THIS device only (advanced; multi-region staging). Persists to the device entry so the fleet supervisor reuses it on every restart. Falls back to the global config when omitted."
 ).action(attach);
-deviceCmd.command("detach").description("Detach a device agent").option("--serial <serial>", "ADB device serial number").option("--all", "Detach all devices", false).action(detach);
+deviceCmd.command("detach").description("Detach a device agent").option("--serial <serial>", "ADB device serial number").option("--all", "Detach all devices", false).option(
+  "--rotate-identity",
+  "Also delete ~/.beeos/identity/device-<serial>.key.json so the next `attach` re-binds from scratch (use this to switch the device to a different BeeOS account / org).",
+  false
+).action(detach);
 deviceCmd.command("list").description("List attached devices").option("--local", "Only show locally running device agents", false).action(list);
 deviceCmd.command("exec").description("Send a natural language command to a device").option("--serial <serial>", "ADB device serial number").argument("<prompt>", "The command/prompt to execute").action(exec);
 deviceCmd.command("upgrade").description("Upgrade the device-agent (and scrcpy/vnc bridges) to the latest version").option("--no-bridges", "Skip upgrading scrcpy-bridge / vnc-bridge binaries").action(upgrade);