@creatornader/agent-bridge 0.7.2 → 0.7.4

package/dist/chunk-JKKIGIO5.js

@@ -0,0 +1,2044 @@
+#!/usr/bin/env node
+import {
+  readClientConfigFile,
+  resolveClientConfig
+} from "./chunk-UKFRCP6X.js";
+import {
+  securePrivatePath,
+  verifyPrivatePathAccess
+} from "./chunk-GTK4KOED.js";
+
+// src/client-installer.ts
+import {
+  accessSync,
+  closeSync as closeSync2,
+  constants as constants2,
+  existsSync as existsSync2,
+  fsyncSync as fsyncSync2,
+  mkdirSync as mkdirSync2,
+  openSync as openSync2,
+  readFileSync as readFileSync2,
+  renameSync as renameSync2,
+  rmSync as rmSync2,
+  statSync,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
+import { homedir as homedir2 } from "os";
+import { delimiter, dirname as dirname2, extname, isAbsolute, join as join2, resolve as resolve2 } from "path";
+import { spawnSync } from "child_process";
+import { fileURLToPath } from "url";
+
+// src/enrollment-file.ts
+import {
+  closeSync,
+  constants,
+  existsSync,
+  fstatSync,
+  fsyncSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  realpathSync,
+  renameSync,
+  rmSync,
+  writeFileSync
+} from "fs";
+import { createHash, randomUUID } from "crypto";
+import { homedir, hostname } from "os";
+import { dirname, join, parse, relative, resolve, sep } from "path";
+var ENROLLMENT_SCHEMA = "agent-bridge.enrollment";
+var ENROLLMENT_VERSION = 1;
+function object(value, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(label + " must be an object");
+  }
+  return value;
+}
+function text(value, label, maximum = 128) {
+  if (typeof value !== "string" || !value || value !== value.trim() || value.length > maximum || /[\u0000-\u001f\u007f]/.test(value)) {
+    throw new Error(label + " is invalid");
+  }
+  return value;
+}
+function nullableText(value, label) {
+  return value === null ? null : text(value, label);
+}
+var RFC3339 = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,3}))?(Z|([+-])(\d{2}):(\d{2}))$/;
+function canonicalTimestamp(value, label) {
+  if (value === null) return null;
+  const selected = text(value, label, 64);
+  const match = RFC3339.exec(selected);
+  if (!match) throw new Error(label + " must be RFC3339 with a timezone");
+  const [
+    ,
+    yearText,
+    monthText,
+    dayText,
+    hourText,
+    minuteText,
+    secondText,
+    fraction = "",
+    zone,
+    sign,
+    offsetHourText = "0",
+    offsetMinuteText = "0"
+  ] = match;
+  const year = Number(yearText);
+  const month = Number(monthText);
+  const day = Number(dayText);
+  const hour = Number(hourText);
+  const minute = Number(minuteText);
+  const second = Number(secondText);
+  const millisecond = Number(fraction.padEnd(3, "0"));
+  const offsetHour = Number(offsetHourText);
+  const offsetMinute = Number(offsetMinuteText);
+  if (hour > 23 || minute > 59 || second > 59 || offsetHour > 23 || offsetMinute > 59) {
+    throw new Error(label + " is invalid");
+  }
+  const wall = /* @__PURE__ */ new Date(0);
+  wall.setUTCFullYear(year, month - 1, day);
+  wall.setUTCHours(hour, minute, second, millisecond);
+  if (wall.getUTCFullYear() !== year || wall.getUTCMonth() !== month - 1 || wall.getUTCDate() !== day || wall.getUTCHours() !== hour || wall.getUTCMinutes() !== minute || wall.getUTCSeconds() !== second || wall.getUTCMilliseconds() !== millisecond) {
+    throw new Error(label + " is invalid");
+  }
+  const direction = zone === "Z" ? 0 : sign === "+" ? 1 : -1;
+  const instant = new Date(wall.getTime() - direction * (offsetHour * 60 + offsetMinute) * 6e4);
+  if (!Number.isFinite(instant.getTime())) throw new Error(label + " is invalid");
+  return instant.toISOString();
+}
+function canonicalGatewayUrl(value, label) {
+  const selected = text(value, label, 2048);
+  let parsed;
+  try {
+    parsed = new URL(selected);
+  } catch {
+    throw new Error(label + " is invalid");
+  }
+  if (parsed.username || parsed.password) throw new Error(label + " cannot contain credentials");
+  if (parsed.hash) throw new Error(label + " cannot contain a fragment");
+  const loopback = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || parsed.hostname === "[::1]";
+  if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && loopback)) {
+    throw new Error(label + " must use HTTPS, or HTTP on an explicit loopback host");
+  }
+  return parsed.toString();
+}
+function uuid(value, label) {
+  const selected = text(value, label, 36);
+  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(selected)) {
+    throw new Error(label + " is invalid");
+  }
+  return selected;
+}
+function runtime(value) {
+  if (value !== "codex" && value !== "claude-code" && value !== "claude-desktop") {
+    throw new Error("enrollment runtime is invalid");
+  }
+  return value;
+}
+function validateInput(value, operation) {
+  const input = object(value, "enrollment input");
+  const gatewayUrl = canonicalGatewayUrl(input.gatewayUrl, "enrollment gatewayUrl");
+  const credentialId = input.credentialId === null ? null : uuid(input.credentialId, "enrollment credentialId");
+  const workspaceName = nullableText(input.workspaceName, "enrollment workspaceName");
+  const graceUntil = canonicalTimestamp(input.graceUntil, "enrollment graceUntil");
+  const invalidateImmediately = input.invalidateImmediately;
+  if (typeof invalidateImmediately !== "boolean") throw new Error("enrollment invalidateImmediately is invalid");
+  if (operation === "provision" && (credentialId !== null || workspaceName === null || graceUntil !== null || invalidateImmediately)) {
+    throw new Error("provision enrollment input is invalid");
+  }
+  if (operation === "rotate" && (credentialId === null || workspaceName !== null || graceUntil === null === !invalidateImmediately)) {
+    throw new Error("rotation must choose graceUntil or invalidateImmediately");
+  }
+  return {
+    gatewayUrl,
+    workspaceId: text(input.workspaceId, "enrollment workspaceId"),
+    principal: text(input.principal, "enrollment principal"),
+    runtime: runtime(input.runtime),
+    instance: text(input.instance, "enrollment instance"),
+    credentialId,
+    workspaceName,
+    displayName: nullableText(input.displayName, "enrollment displayName"),
+    runtimeType: text(input.runtimeType, "enrollment runtimeType"),
+    label: nullableText(input.label, "enrollment label"),
+    scopeSetName: text(input.scopeSetName, "enrollment scopeSetName"),
+    expiresAt: canonicalTimestamp(input.expiresAt, "enrollment expiresAt"),
+    graceUntil,
+    invalidateImmediately
+  };
+}
+function validateResult(value, input) {
+  if (value === null) return null;
+  const result = object(value, "enrollment result");
+  if (typeof result.replayed !== "boolean") throw new Error("enrollment result replayed is invalid");
+  const validated = {
+    workspaceId: text(result.workspaceId, "enrollment result workspaceId"),
+    principal: text(result.principal, "enrollment result principal"),
+    agentId: result.agentId === null ? null : uuid(result.agentId, "enrollment result agentId"),
+    credentialId: uuid(result.credentialId, "enrollment result credentialId"),
+    replayed: result.replayed
+  };
+  if (validated.workspaceId !== input.workspaceId || validated.principal !== input.principal) {
+    throw new Error("enrollment result does not match its workspace and principal");
+  }
+  return validated;
+}
+function enrollmentTokenHash(enrollment) {
+  if (!enrollment.token) throw new Error("enrollment no longer contains a credential");
+  return createHash("sha256").update(enrollment.token, "utf8").digest("hex");
+}
+function validateEnrollmentFile(value) {
+  const file = object(value, "enrollment file");
+  if (file.schema !== ENROLLMENT_SCHEMA || file.version !== ENROLLMENT_VERSION) {
+    throw new Error("unsupported enrollment schema or version");
+  }
+  if (file.provider !== "gateway") throw new Error("enrollment provider must be gateway");
+  if (!["pending", "ready", "consuming", "consumed"].includes(String(file.state))) {
+    throw new Error("enrollment state is invalid");
+  }
+  if (file.operation !== "provision" && file.operation !== "rotate") {
+    throw new Error("enrollment operation is invalid");
+  }
+  const state = file.state;
+  if (!Number.isSafeInteger(file.revision) || Number(file.revision) < 0) {
+    throw new Error("enrollment revision is invalid");
+  }
+  const input = validateInput(file.input, file.operation);
+  const token = file.token === null ? null : text(file.token, "enrollment token", 4096);
+  const result = validateResult(file.result, input);
+  const completedAt = canonicalTimestamp(file.completedAt, "enrollment completedAt");
+  if (state === "pending" && (result !== null || completedAt !== null || token === null)) {
+    throw new Error("pending enrollment state is invalid");
+  }
+  if ((state === "ready" || state === "consuming") && (result === null || completedAt === null || token === null)) {
+    throw new Error(state + " enrollment state is invalid");
+  }
+  if (state === "consumed" && (result === null || completedAt === null || token !== null)) {
+    throw new Error("consumed enrollment state is invalid");
+  }
+  return {
+    schema: ENROLLMENT_SCHEMA,
+    version: ENROLLMENT_VERSION,
+    provider: "gateway",
+    revision: Number(file.revision),
+    state,
+    operation: file.operation,
+    requestId: uuid(file.requestId, "enrollment requestId"),
+    createdAt: (() => {
+      const createdAt = canonicalTimestamp(file.createdAt, "enrollment createdAt");
+      if (createdAt === null) throw new Error("enrollment createdAt is invalid");
+      return createdAt;
+    })(),
+    completedAt,
+    input,
+    token,
+    result
+  };
+}
+function syncDirectory(path) {
+  if (process.platform === "win32") return;
+  const descriptor = openSync(path, "r");
+  try {
+    fsyncSync(descriptor);
+  } finally {
+    closeSync(descriptor);
+  }
+}
+var durabilityDefaults = { syncDirectory };
+function prepareDirectory(path) {
+  mkdirSync(path, { recursive: true, mode: 448 });
+  securePrivatePath(path, "directory");
+}
+function enrollmentRoot(env = process.env) {
+  if (env.AGENT_BRIDGE_ENROLLMENT_DIR) return resolve(env.AGENT_BRIDGE_ENROLLMENT_DIR);
+  const home = realpathSync(env.HOME ?? homedir());
+  return join(home, ".agent-bridge", "enrollments");
+}
+function rejectSymlinkComponents(path) {
+  const root = parse(path).root;
+  let current = root;
+  for (const component of path.slice(root.length).split(sep).filter(Boolean)) {
+    current = join(current, component);
+    if (!existsSync(current)) break;
+    if (lstatSync(current).isSymbolicLink()) {
+      throw new Error("enrollment paths cannot contain symbolic links");
+    }
+  }
+}
+function verifyPrivateDirectory(path) {
+  rejectSymlinkComponents(path);
+  const details = lstatSync(path);
+  if (!details.isDirectory() || details.isSymbolicLink()) {
+    throw new Error("enrollment directory must be a real directory");
+  }
+  verifyPrivatePathAccess(path, "directory");
+  return { device: details.dev, inode: details.ino };
+}
+function sameDirectory(path, expected) {
+  const actual = verifyPrivateDirectory(path);
+  if (actual.device !== expected.device || actual.inode !== expected.inode) {
+    throw new Error("enrollment directory changed during the operation");
+  }
+}
+function verifyPrivatePath(root, directory) {
+  verifyPrivateDirectory(root);
+  const inside = relative(root, directory);
+  if (!inside) return;
+  let current = root;
+  for (const component of inside.split(sep).filter(Boolean)) {
+    current = join(current, component);
+    verifyPrivateDirectory(current);
+  }
+}
+function prepareEnrollmentRoot(env) {
+  const root = enrollmentRoot(env);
+  rejectSymlinkComponents(dirname(root));
+  prepareDirectory(root);
+  verifyPrivateDirectory(root);
+  return root;
+}
+function assertEnrollmentPath(path, env = process.env) {
+  const root = enrollmentRoot(env);
+  const selected = resolve(path);
+  const inside = relative(root, selected);
+  if (!inside || inside.startsWith(".." + sep) || inside === ".." || inside.includes(sep + ".." + sep)) {
+    throw new Error("enrollment file must be inside the configured enrollment directory");
+  }
+  rejectSymlinkComponents(root);
+  rejectSymlinkComponents(dirname(selected));
+  if (existsSync(root) && existsSync(dirname(selected))) {
+    verifyPrivatePath(root, dirname(selected));
+  }
+  return selected;
+}
+function serialized(value) {
+  return JSON.stringify(validateEnrollmentFile(value), null, 2) + "\n";
+}
+function defaultEnrollmentPath(requestId, env = process.env) {
+  return join(enrollmentRoot(env), requestId + ".json");
+}
+function createPendingEnrollment(path, enrollment, env = process.env) {
+  if (enrollment.state !== "pending") throw new Error("new enrollment must be pending");
+  if (enrollment.revision !== 0) throw new Error("new enrollment revision must be zero");
+  path = assertEnrollmentPath(path, env);
+  prepareEnrollmentRoot(env);
+  path = assertEnrollmentPath(path, env);
+  const directory = dirname(path);
+  prepareDirectory(directory);
+  verifyPrivatePath(enrollmentRoot(env), directory);
+  const directoryIdentity = verifyPrivateDirectory(directory);
+  const descriptor = openSync(path, "wx", 384);
+  try {
+    writeFileSync(descriptor, serialized(enrollment), "utf8");
+    fsyncSync(descriptor);
+    closeSync(descriptor);
+    securePrivatePath(path, "file");
+    sameDirectory(directory, directoryIdentity);
+    syncDirectory(directory);
+  } catch (error) {
+    try {
+      closeSync(descriptor);
+    } catch {
+    }
+    rmSync(path, { force: true });
+    throw error;
+  }
+}
+function readEnrollmentUnlocked(path, env) {
+  path = assertEnrollmentPath(path, env);
+  const directory = dirname(path);
+  verifyPrivatePath(enrollmentRoot(env), directory);
+  const directoryIdentity = verifyPrivateDirectory(directory);
+  verifyPrivatePathAccess(path, "file");
+  const descriptor = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+  try {
+    const details = fstatSync(descriptor);
+    if (!details.isFile()) throw new Error("enrollment path must be a regular file, not a symbolic link");
+    if (process.platform !== "win32") {
+      if ((details.mode & 63) !== 0) throw new Error("enrollment file permissions must be 0600");
+      if (typeof process.getuid === "function" && details.uid !== process.getuid()) {
+        throw new Error("enrollment file must be owned by the current user");
+      }
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(readFileSync(descriptor, "utf8"));
+    } catch {
+      throw new Error("enrollment file is not valid JSON");
+    }
+    sameDirectory(directory, directoryIdentity);
+    return validateEnrollmentFile(parsed);
+  } finally {
+    closeSync(descriptor);
+  }
+}
+function readEnrollment(path, env = process.env) {
+  return readEnrollmentUnlocked(path, env);
+}
+function assertActiveLock(lock, enrollmentPath) {
+  if (lock.released || lock.enrollmentPath !== enrollmentPath) {
+    throw new Error("enrollment lock does not cover this file");
+  }
+  const open = fstatSync(lock.descriptor);
+  const current = lstatSync(lock.lockPath);
+  if (open.dev !== lock.device || open.ino !== lock.inode || current.dev !== lock.device || current.ino !== lock.inode || current.isSymbolicLink()) {
+    throw new Error("enrollment lock changed during the operation");
+  }
+}
+function acquireEnrollmentLock(path, env = process.env) {
+  prepareEnrollmentRoot(env);
+  path = assertEnrollmentPath(path, env);
+  const directory = dirname(path);
+  prepareDirectory(directory);
+  verifyPrivatePath(enrollmentRoot(env), directory);
+  const directoryIdentity = verifyPrivateDirectory(directory);
+  const lockPath = path + ".lock";
+  const descriptor = openSync(lockPath, "wx", 384);
+  const nonce = randomUUID();
+  try {
+    writeFileSync(descriptor, JSON.stringify({
+      schema: "agent-bridge.enrollment-lock",
+      version: 1,
+      enrollmentPath: path,
+      pid: process.pid,
+      host: hostname(),
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      nonce
+    }) + "\n", "utf8");
+    fsyncSync(descriptor);
+    securePrivatePath(lockPath, "file");
+    sameDirectory(directory, directoryIdentity);
+    syncDirectory(directory);
+    const details = fstatSync(descriptor);
+    return {
+      enrollmentPath: path,
+      lockPath,
+      descriptor,
+      device: details.dev,
+      inode: details.ino,
+      nonce,
+      released: false
+    };
+  } catch (error) {
+    try {
+      closeSync(descriptor);
+    } catch {
+    }
+    rmSync(lockPath, { force: true });
+    throw error;
+  }
+}
+function releaseEnrollmentLock(lock, dependencies = durabilityDefaults) {
+  assertActiveLock(lock, lock.enrollmentPath);
+  const directory = dirname(lock.lockPath);
+  const directoryIdentity = verifyPrivateDirectory(directory);
+  closeSync(lock.descriptor);
+  const current = lstatSync(lock.lockPath);
+  if (current.dev !== lock.device || current.ino !== lock.inode) {
+    throw new Error("enrollment lock changed before release");
+  }
+  rmSync(lock.lockPath);
+  lock.released = true;
+  try {
+    sameDirectory(directory, directoryIdentity);
+    dependencies.syncDirectory(directory);
+  } catch {
+    return "durability-unknown";
+  }
+  return "released";
+}
+function recoverEnrollmentLock(path, env = process.env, now = Date.now()) {
+  path = assertEnrollmentPath(path, env);
+  const lockPath = path + ".lock";
+  verifyPrivatePathAccess(lockPath, "file");
+  const descriptor = openSync(lockPath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+  try {
+    const details = fstatSync(descriptor);
+    if (!details.isFile()) throw new Error("enrollment lock is not a regular file");
+    if (process.platform !== "win32") {
+      if ((details.mode & 63) !== 0) throw new Error("enrollment lock permissions must be 0600");
+      if (typeof process.getuid === "function" && details.uid !== process.getuid()) {
+        throw new Error("enrollment lock must be owned by the current user");
+      }
+    }
+    let metadata;
+    try {
+      metadata = object(JSON.parse(readFileSync(descriptor, "utf8")), "enrollment lock");
+    } catch {
+      throw new Error("enrollment lock metadata is invalid");
+    }
+    if (metadata.schema !== "agent-bridge.enrollment-lock" || metadata.version !== 1 || metadata.enrollmentPath !== path || metadata.host !== hostname() || typeof metadata.pid !== "number" || !Number.isSafeInteger(metadata.pid) || typeof metadata.createdAt !== "string" || !RFC3339.test(metadata.createdAt)) {
+      throw new Error("enrollment lock metadata is invalid");
+    }
+    const age = now - new Date(metadata.createdAt).getTime();
+    if (age < 6e4) throw new Error("enrollment lock is too recent to recover");
+    try {
+      process.kill(metadata.pid, 0);
+      throw new Error("enrollment lock owner is still running");
+    } catch (error) {
+      if (error instanceof Error && error.message === "enrollment lock owner is still running") throw error;
+      if (!error || typeof error !== "object" || !("code" in error) || error.code !== "ESRCH") {
+        throw new Error("cannot prove that the enrollment lock owner has stopped");
+      }
+    }
+    const current = lstatSync(lockPath);
+    if (current.dev !== details.dev || current.ino !== details.ino) {
+      throw new Error("enrollment lock changed during recovery");
+    }
+  } finally {
+    closeSync(descriptor);
+  }
+  rmSync(lockPath);
+  syncDirectory(dirname(lockPath));
+}
+function deleteEnrollmentFile(path, lock, env = process.env, dependencies = durabilityDefaults) {
+  path = assertEnrollmentPath(path, env);
+  assertActiveLock(lock, path);
+  let current;
+  try {
+    current = readEnrollmentUnlocked(path, env);
+  } catch (error) {
+    if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
+      return "missing";
+    }
+    throw error;
+  }
+  if (current.state !== "consumed" || current.token !== null) {
+    throw new Error("only a consumed enrollment can be deleted");
+  }
+  const directory = dirname(path);
+  const directoryIdentity = verifyPrivateDirectory(directory);
+  try {
+    rmSync(path);
+  } catch (error) {
+    if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
+      return "missing";
+    }
+    throw error;
+  }
+  try {
+    sameDirectory(directory, directoryIdentity);
+    dependencies.syncDirectory(directory);
+  } catch {
+    return "deleted-durability-unknown";
+  }
+  return "deleted-and-durable";
+}
+function transitionEnrollment(path, current, state, changes = {}, env = process.env, heldLock) {
+  path = assertEnrollmentPath(path, env);
+  const lock = heldLock ?? acquireEnrollmentLock(path, env);
+  try {
+    assertActiveLock(lock, path);
+    const onDisk = readEnrollmentUnlocked(path, env);
+    if (onDisk.revision !== current.revision || onDisk.state !== current.state || onDisk.requestId !== current.requestId || onDisk.operation !== current.operation || onDisk.token !== current.token) {
+      throw new Error("stale enrollment transition refused");
+    }
+    const transition = current.state + "->" + state;
+    if (!(/* @__PURE__ */ new Set([
+      "pending->ready",
+      "ready->consuming",
+      "consuming->ready",
+      "consuming->consumed"
+    ])).has(transition)) {
+      throw new Error("illegal enrollment state transition: " + transition);
+    }
+    const next = validateEnrollmentFile({
+      ...onDisk,
+      ...changes,
+      state,
+      revision: onDisk.revision + 1
+    });
+    const directory = dirname(path);
+    const directoryIdentity = verifyPrivateDirectory(directory);
+    const temporary = path + "." + process.pid + "." + randomUUID() + ".tmp";
+    const descriptor = openSync(temporary, "wx", 384);
+    try {
+      writeFileSync(descriptor, serialized(next), "utf8");
+      fsyncSync(descriptor);
+      closeSync(descriptor);
+      securePrivatePath(temporary, "file");
+      sameDirectory(directory, directoryIdentity);
+      renameSync(temporary, path);
+      verifyPrivatePathAccess(path, "file");
+      sameDirectory(directory, directoryIdentity);
+      syncDirectory(directory);
+      return next;
+    } catch (error) {
+      try {
+        closeSync(descriptor);
+      } catch {
+      }
+      rmSync(temporary, { force: true });
+      throw error;
+    }
+  } finally {
+    if (!heldLock) releaseEnrollmentLock(lock);
+  }
+}
+
+// src/client-installer.ts
+function assertExecutable(path) {
+  if (!existsSync2(path)) {
+    throw new Error(`Claude Desktop MCP executable does not exist: ${path}`);
+  }
+  if (!statSync(path).isFile()) {
+    throw new Error(`Claude Desktop MCP executable is not a file: ${path}`);
+  }
+  try {
+    accessSync(path, process.platform === "win32" ? constants2.F_OK : constants2.X_OK);
+  } catch {
+    throw new Error(`Claude Desktop MCP executable is not executable: ${path}`);
+  }
+  return path;
+}
+function resolveExecutable(command, env) {
+  if (isAbsolute(command) || command.includes("/") || command.includes("\\")) {
+    return assertExecutable(resolve2(command));
+  }
+  const searchPath = env.PATH ?? process.env.PATH ?? "";
+  const extensions = process.platform === "win32" && !extname(command) ? (env.PATHEXT ?? process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
+  for (const directory of searchPath.split(delimiter).filter(Boolean)) {
+    for (const extension of extensions) {
+      const candidate = join2(directory, command + extension);
+      if (!existsSync2(candidate)) continue;
+      return assertExecutable(resolve2(candidate));
+    }
+  }
+  throw new Error(`Claude Desktop MCP executable was not found on PATH: ${command}`);
+}
+function defaultServerEntry() {
+  const moduleDirectory = dirname2(fileURLToPath(import.meta.url));
+  const candidates = [
+    join2(moduleDirectory, "index.js"),
+    join2(moduleDirectory, "..", "dist", "index.js")
+  ];
+  const entry = candidates.find((candidate) => existsSync2(candidate) && statSync(candidate).isFile());
+  if (!entry) {
+    throw new Error(`Claude Desktop MCP server entry does not exist: ${candidates[0]}`);
+  }
+  return resolve2(entry);
+}
+function resolveDesktopLaunchContract(requestedCommand, env) {
+  const command = requestedCommand?.trim();
+  if (command) return { command: resolveExecutable(command, env), args: [] };
+  return {
+    command: assertExecutable(resolve2(process.execPath)),
+    args: [defaultServerEntry()]
+  };
+}
+function desktopConfigPath(env) {
+  if (process.platform === "win32") {
+    const appData = env.APPDATA;
+    if (!appData) throw new Error("APPDATA is required for Claude Desktop installation");
+    return join2(appData, "Claude", "claude_desktop_config.json");
+  }
+  const home = env.HOME ?? homedir2();
+  return process.platform === "darwin" ? join2(home, "Library", "Application Support", "Claude", "claude_desktop_config.json") : join2(home, ".config", "Claude", "claude_desktop_config.json");
+}
+function safeComponent(value) {
+  const readable = value.replace(/[^A-Za-z0-9._-]+/g, "_").slice(0, 48) || "client";
+  const suffix = createHash2("sha256").update(value).digest("hex").slice(0, 12);
+  return `${readable}-${suffix}`;
+}
+function clientBackendConfigPath(runtime2, instance, env) {
+  const home = env.HOME ?? homedir2();
+  return join2(
+    home,
+    ".agent-bridge",
+    "clients",
+    `${runtime2}-${safeComponent(instance)}.config`
+  );
+}
+function replacePrivateFile(path, content) {
+  const directory = dirname2(path);
+  const privateRoot = dirname2(directory);
+  mkdirSync2(privateRoot, { recursive: true, mode: 448 });
+  securePrivatePath(privateRoot, "directory");
+  mkdirSync2(directory, { recursive: true, mode: 448 });
+  securePrivatePath(directory, "directory");
+  if (existsSync2(path)) verifyPrivatePathAccess(path, "file");
+  const temporary = `${path}.${process.pid}.${randomUUID2()}.tmp`;
+  const descriptor = openSync2(temporary, "wx", 384);
+  try {
+    writeFileSync2(descriptor, content);
+    fsyncSync2(descriptor);
+  } finally {
+    closeSync2(descriptor);
+  }
+  securePrivatePath(temporary, "file");
+  renameSync2(temporary, path);
+  verifyPrivatePathAccess(path, "file");
+  if (process.platform !== "win32") {
+    const descriptor2 = openSync2(directory, "r");
+    try {
+      fsyncSync2(descriptor2);
+    } finally {
+      closeSync2(descriptor2);
+    }
+  }
+}
+function writeClientBackendConfig(runtime2, identity, instance, options) {
+  const env = options.env;
+  const home = env.HOME ?? homedir2();
+  const sharedPath = env.AGENT_BRIDGE_CONFIG ?? join2(home, ".agent-bridge", "config");
+  const shared = readClientConfigFile(sharedPath);
+  const stagedGateway = options.gatewayUrl !== void 0 || options.workspace !== void 0 || options.edgeDatabasePath !== void 0;
+  if (stagedGateway && (!options.gatewayUrl || !options.workspace || !options.edgeDatabasePath)) {
+    throw new Error("staged gateway backend requires URL, workspace, and edge database path");
+  }
+  const configuredProvider = stagedGateway ? "gateway" : env.AGENT_BRIDGE_PROVIDER?.trim() || shared.AGENT_BRIDGE_PROVIDER?.trim();
+  const inferredGateway = !configuredProvider && Boolean(
+    env.AGENT_BRIDGE_TOKEN?.trim() || shared.AGENT_BRIDGE_TOKEN?.trim()
+  );
+  const provider = configuredProvider ?? (inferredGateway ? "gateway" : void 0);
+  const clientToken = options.token?.trim() || env.AGENT_BRIDGE_CLIENT_TOKEN?.trim();
+  if (provider === "gateway" && !clientToken) {
+    throw new Error(
+      "gateway client installation requires --token or AGENT_BRIDGE_CLIENT_TOKEN"
+    );
+  }
+  const resolved = resolveClientConfig(stagedGateway ? {
+    ...env,
+    AGENT_BRIDGE_CONFIG: void 0,
+    AGENT_BRIDGE_PROVIDER: "gateway",
+    AGENT_BRIDGE_URL: options.gatewayUrl,
+    AGENT_BRIDGE_WORKSPACE: options.workspace,
+    AGENT_BRIDGE_EDGE_DB: options.edgeDatabasePath,
+    AGENT_BRIDGE_AGENT: void 0,
+    AGENT_BRIDGE_INSTANCE: void 0,
+    AGENT_BRIDGE_TOKEN: clientToken
+  } : {
+    ...env,
+    AGENT_BRIDGE_AGENT: void 0,
+    AGENT_BRIDGE_INSTANCE: void 0,
+    AGENT_BRIDGE_TOKEN: clientToken ?? env.AGENT_BRIDGE_TOKEN
+  }, identity);
+  const values = {
+    AGENT_BRIDGE_PROVIDER: resolved.provider,
+    AGENT_BRIDGE_WORKSPACE: resolved.principal.workspace,
+    AGENT_BRIDGE_URL: resolved.url,
+    AGENT_BRIDGE_TOKEN: resolved.provider === "gateway" ? resolved.credential : void 0,
+    AGENT_BRIDGE_DB: resolved.provider === "local" ? resolved.databasePath : void 0,
+    AGENT_BRIDGE_EDGE_DB: resolved.provider === "gateway" ? resolved.edgeDatabasePath : void 0,
+    AGENT_BRIDGE_CREDENTIAL_ID: options.binding?.credentialId,
+    AGENT_BRIDGE_PRINCIPAL: options.binding?.principal,
+    AGENT_BRIDGE_CLIENT_INSTANCE: options.binding?.instance
+  };
+  for (const value of Object.values(values)) {
+    if (value?.includes("\n") || value?.includes("\r")) {
+      throw new Error("client backend config values cannot contain newlines");
+    }
+  }
+  const path = options.destinationPath ?? clientBackendConfigPath(runtime2, instance, env);
+  replacePrivateFile(
+    path,
+    `${Object.entries(values).filter((entry) => Boolean(entry[1])).map(([key, value]) => `${key}=${value}`).join("\n")}
+`
+  );
+  return path;
+}
+function migrationOperationId(value) {
+  if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value)) {
+    throw new Error("client migration operation ID is invalid");
+  }
+  return value.toLowerCase();
+}
+function stagedGatewayBackendPaths(operationId, env = process.env) {
+  const home = env.HOME ?? homedir2();
+  const directory = join2(home, ".agent-bridge", "client-migrations", migrationOperationId(operationId));
+  return {
+    directory,
+    backendConfigPath: join2(directory, "target.config"),
+    edgeDatabasePath: join2(directory, "target.edge.sqlite3")
+  };
+}
+function writeStagedGatewayBackendConfig(runtime2, identity, instance, operationId, options) {
+  const env = options.env ?? process.env;
+  const paths = stagedGatewayBackendPaths(operationId, env);
+  writeClientBackendConfig(runtime2, identity, instance, {
+    token: options.token,
+    env,
+    binding: {
+      credentialId: options.credentialId,
+      principal: options.principal,
+      instance
+    },
+    destinationPath: paths.backendConfigPath,
+    gatewayUrl: options.gatewayUrl,
+    workspace: options.workspace,
+    edgeDatabasePath: paths.edgeDatabasePath
+  });
+  return paths;
+}
+function writeBackendConfig(runtime2, identity, instance, options) {
+  return writeClientBackendConfig(runtime2, identity, instance, options);
+}
+function writeJsonConfig(path, identity, instance, backendConfigPath, launch) {
+  let config = {};
+  if (existsSync2(path)) {
+    try {
+      const parsed = JSON.parse(readFileSync2(path, "utf8"));
+      if (!parsed || Array.isArray(parsed) || typeof parsed !== "object") throw new Error();
+      config = parsed;
+    } catch {
+      throw new Error(`Claude Desktop config is not valid JSON: ${path}`);
+    }
+  }
+  const currentServers = config.mcpServers;
+  const mcpServers = currentServers && !Array.isArray(currentServers) && typeof currentServers === "object" ? currentServers : {};
+  const next = {
+    ...config,
+    mcpServers: {
+      ...mcpServers,
+      "agent-bridge": {
+        command: launch.command,
+        args: launch.args,
+        env: {
+          AGENT_BRIDGE_AGENT: identity,
+          AGENT_BRIDGE_INSTANCE: instance,
+          AGENT_BRIDGE_CONFIG: backendConfigPath
+        }
+      }
+    }
+  };
+  mkdirSync2(dirname2(path), { recursive: true, mode: 448 });
+  const temporary = `${path}.${process.pid}.tmp`;
+  writeFileSync2(temporary, `${JSON.stringify(next, null, 2)}
+`, { mode: 384 });
+  renameSync2(temporary, path);
+}
+function assertEnrollmentConfiguration(enrollment, assertions) {
+  const input = enrollment.input;
+  const env = assertions.env;
+  const home = env.HOME ?? homedir2();
+  const shared = readClientConfigFile(
+    env.AGENT_BRIDGE_CONFIG ?? join2(home, ".agent-bridge", "config")
+  );
+  const conflicts = [
+    ["runtime", assertions.runtime, input.runtime],
+    ["identity", assertions.identity?.trim() || void 0, input.principal],
+    ["instance", assertions.instance?.trim() || void 0, input.instance],
+    ["AGENT_BRIDGE_AGENT", env.AGENT_BRIDGE_AGENT?.trim(), input.principal],
+    ["AGENT_BRIDGE_INSTANCE", env.AGENT_BRIDGE_INSTANCE?.trim(), input.instance],
+    ["AGENT_BRIDGE_URL", env.AGENT_BRIDGE_URL?.trim(), input.gatewayUrl],
+    ["AGENT_BRIDGE_WORKSPACE", env.AGENT_BRIDGE_WORKSPACE?.trim(), input.workspaceId],
+    ["shared AGENT_BRIDGE_URL", shared.AGENT_BRIDGE_URL?.trim(), input.gatewayUrl],
+    ["shared AGENT_BRIDGE_WORKSPACE", shared.AGENT_BRIDGE_WORKSPACE?.trim(), input.workspaceId]
+  ];
+  for (const [name, actual, expected] of conflicts) {
+    if (actual && actual !== expected) throw new Error(name + " conflicts with the enrollment file");
+  }
+  for (const [name, provider] of [
+    ["AGENT_BRIDGE_PROVIDER", env.AGENT_BRIDGE_PROVIDER?.trim()],
+    ["shared AGENT_BRIDGE_PROVIDER", shared.AGENT_BRIDGE_PROVIDER?.trim()]
+  ]) {
+    if (provider && provider !== "gateway") throw new Error(name + " conflicts with the enrollment file");
+  }
+  if (assertions.token) throw new Error("--token cannot be used with --enrollment-file");
+  if (env.AGENT_BRIDGE_CLIENT_TOKEN || env.AGENT_BRIDGE_TOKEN) {
+    throw new Error("token environment variables cannot be used with --enrollment-file");
+  }
+}
+function removeConsumedEnrollment(path, result, lock, env) {
+  try {
+    const deletion = deleteEnrollmentFile(path, lock, env);
+    if (deletion === "missing") {
+      return {
+        ...result,
+        installed: true,
+        enrollmentDeleted: false,
+        enrollmentFile: path,
+        enrollmentStatus: "consumed-file-missing"
+      };
+    }
+    if (deletion === "deleted-durability-unknown") {
+      return {
+        ...result,
+        installed: true,
+        enrollmentDeleted: true,
+        enrollmentStatus: "consumed-deletion-durability-unknown"
+      };
+    }
+    return {
+      ...result,
+      installed: true,
+      enrollmentDeleted: true,
+      enrollmentStatus: "consumed"
+    };
+  } catch {
+    return {
+      ...result,
+      installed: true,
+      enrollmentDeleted: false,
+      enrollmentFile: path,
+      enrollmentStatus: "consumed-file-retained"
+    };
+  }
+}
+function backendMatches(path, enrollment, credentialId, requireToken) {
+  if (!existsSync2(path)) return false;
+  const config = readClientConfigFile(path);
+  return config.AGENT_BRIDGE_PROVIDER === "gateway" && config.AGENT_BRIDGE_URL === enrollment.input.gatewayUrl && config.AGENT_BRIDGE_WORKSPACE === enrollment.input.workspaceId && config.AGENT_BRIDGE_CREDENTIAL_ID === credentialId && config.AGENT_BRIDGE_PRINCIPAL === enrollment.input.principal && config.AGENT_BRIDGE_CLIENT_INSTANCE === enrollment.input.instance && (!requireToken || config.AGENT_BRIDGE_TOKEN === enrollment.token);
+}
+function desktopRegistrationState(enrollment, backendConfigPath, launch, env) {
+  const path = desktopConfigPath(env);
+  if (!existsSync2(path)) return "absent";
+  try {
+    const config = JSON.parse(readFileSync2(path, "utf8"));
+    const server = config?.mcpServers?.["agent-bridge"];
+    if (!server) return "absent";
+    const environment = server?.env;
+    const exactEnvironment = environment && typeof environment === "object" && !Array.isArray(environment) && Object.keys(environment).sort().join(",") === "AGENT_BRIDGE_AGENT,AGENT_BRIDGE_CONFIG,AGENT_BRIDGE_INSTANCE" && environment.AGENT_BRIDGE_AGENT === enrollment.input.principal && environment.AGENT_BRIDGE_INSTANCE === enrollment.input.instance && environment.AGENT_BRIDGE_CONFIG === backendConfigPath;
+    if (server?.command === "agent-bridge-mcp" && (server?.args === void 0 || Array.isArray(server.args) && server.args.length === 0) && exactEnvironment) return "legacy";
+    return server?.command === launch.command && Array.isArray(server?.args) && server.args.length === launch.args.length && server.args.every((arg, index) => arg === launch.args[index]) && exactEnvironment ? "matching" : "conflict";
+  } catch {
+    return "conflict";
+  }
+}
+function repairLegacyDesktopRegistration(state, enrollment, backendConfigPath, launch, env) {
+  if (state !== "legacy") return state;
+  writeJsonConfig(
+    desktopConfigPath(env),
+    enrollment.input.principal,
+    enrollment.input.instance,
+    backendConfigPath,
+    launch
+  );
+  const repaired = desktopRegistrationState(enrollment, backendConfigPath, launch, env);
+  return repaired === "legacy" ? "conflict" : repaired;
+}
+function nativeRegistrationState(enrollment, backendConfigPath, command, scope, execute) {
+  const executable = enrollment.input.runtime === "codex" ? "codex" : "claude";
+  const args = enrollment.input.runtime === "codex" ? ["mcp", "get", "agent-bridge", "--json"] : ["mcp", "get", "agent-bridge"];
+  const result = execute(executable, args);
+  if (result.error) throw new Error(enrollment.input.runtime + " MCP inspection failed");
+  if (result.status !== 0) {
+    const output = (result.stdout + "\n" + result.stderr).trim();
+    const notFound = enrollment.input.runtime === "codex" ? output === "Error: No MCP server named 'agent-bridge' found." : output === 'No MCP server named "agent-bridge".' || /^No MCP server named "agent-bridge"\. Configured servers: [^\r\n]+$/.test(output);
+    if (notFound) return "absent";
+    throw new Error(enrollment.input.runtime + " MCP inspection failed");
+  }
+  if (enrollment.input.runtime === "codex") {
+    try {
+      const server = JSON.parse(result.stdout);
+      const transport = server?.transport;
+      const environment = transport?.env;
+      const exactEnvironment = environment && typeof environment === "object" && !Array.isArray(environment) && Object.keys(environment).sort().join(",") === "AGENT_BRIDGE_AGENT,AGENT_BRIDGE_CONFIG,AGENT_BRIDGE_INSTANCE";
+      return server?.name === "agent-bridge" && server?.enabled === true && transport?.type === "stdio" && transport?.command === command && Array.isArray(transport?.args) && transport.args.length === 0 && exactEnvironment && transport?.env?.AGENT_BRIDGE_AGENT === enrollment.input.principal && transport?.env?.AGENT_BRIDGE_INSTANCE === enrollment.input.instance && transport?.env?.AGENT_BRIDGE_CONFIG === backendConfigPath ? "matching" : "conflict";
+    } catch {
+      return "conflict";
+    }
+  }
+  const lines = result.stdout.replace(/\r\n/g, "\n").split("\n");
+  const scopeLine = {
+    local: "  Scope: Local config (private to you in this project)",
+    user: "  Scope: User config (available in all your projects)",
+    project: "  Scope: Project config (shared via .mcp.json)"
+  }[scope];
+  const expectedPrefix = [
+    "agent-bridge:",
+    scopeLine
+  ];
+  if (lines[0] !== expectedPrefix[0] || lines[1] !== expectedPrefix[1] || lines[3] !== "  Type: stdio" || lines[4] !== "  Command: " + command || lines[5] !== "  Args:" || lines[6] !== "  Environment:") return "conflict";
+  const environmentLines = [];
+  let index = 7;
+  while (index < lines.length && lines[index]?.startsWith("    ")) {
+    environmentLines.push(lines[index]);
+    index += 1;
+  }
+  const expectedEnvironment = [
+    "    AGENT_BRIDGE_AGENT=" + enrollment.input.principal,
+    "    AGENT_BRIDGE_INSTANCE=" + enrollment.input.instance,
+    "    AGENT_BRIDGE_CONFIG=" + backendConfigPath
+  ].sort();
+  if (environmentLines.sort().join("\n") !== expectedEnvironment.join("\n")) return "conflict";
+  while (lines[index] === "") index += 1;
+  if (lines[index] !== "To remove this server, run: claude mcp remove agent-bridge -s " + scope) {
+    return "conflict";
+  }
+  if (lines.slice(index + 1).some((line) => line !== "")) return "conflict";
+  return "matching";
+}
+function enrolledInstallLocked(runtimeAssertion, identityAssertion, options, execute, lock) {
+  const env = options.env ?? process.env;
+  let enrollment = readEnrollment(options.enrollmentFile, env);
+  assertEnrollmentConfiguration(enrollment, {
+    runtime: runtimeAssertion,
+    identity: identityAssertion,
+    instance: options.instance,
+    token: options.token,
+    env
+  });
+  const runtime2 = enrollment.input.runtime;
+  const identity = enrollment.input.principal;
+  const expectedPath = clientBackendConfigPath(runtime2, enrollment.input.instance, env);
+  const command = options.command?.trim() || "agent-bridge-mcp";
+  const desktopLaunch = runtime2 === "claude-desktop" ? resolveDesktopLaunchContract(options.command, env) : void 0;
+  const scope = options.scope ?? "user";
+  const baseResult = {
+    runtime: runtime2,
+    identity,
+    instance: enrollment.input.instance,
+    method: runtime2 === "claude-desktop" ? "json-config" : "native-cli",
+    configPath: runtime2 === "claude-desktop" ? desktopConfigPath(env) : void 0,
+    backendConfigPath: expectedPath,
+    restartRequired: true
+  };
+  if (enrollment.state === "consumed") {
+    if (!enrollment.result || !backendMatches(expectedPath, enrollment, enrollment.result.credentialId, false)) {
+      throw new Error("consumed enrollment no longer matches its client backend");
+    }
+    const inspected = runtime2 === "claude-desktop" ? desktopRegistrationState(enrollment, expectedPath, desktopLaunch, env) : nativeRegistrationState(enrollment, expectedPath, command, scope, execute);
+    const registration = runtime2 === "claude-desktop" ? repairLegacyDesktopRegistration(
+      inspected,
+      enrollment,
+      expectedPath,
+      desktopLaunch,
+      env
+    ) : inspected;
+    if (registration !== "matching") {
+      throw new Error("consumed enrollment no longer matches its MCP registration");
+    }
+    return removeConsumedEnrollment(options.enrollmentFile, baseResult, lock, env);
+  }
+  if (enrollment.state === "pending") {
+    throw new Error("enrollment is pending; resume the owner command first");
+  }
+  const recovering = enrollment.state === "consuming";
+  if (!recovering && enrollment.operation === "provision" && existsSync2(expectedPath)) {
+    throw new Error("provision enrollment would replace an existing client backend file");
+  }
+  if (!recovering && enrollment.operation === "provision") {
+    const registration = runtime2 === "claude-desktop" ? desktopRegistrationState(enrollment, expectedPath, desktopLaunch, env) : nativeRegistrationState(enrollment, expectedPath, command, scope, execute);
+    if (registration !== "absent") {
+      throw new Error("provision enrollment would replace an existing MCP registration");
+    }
+  }
+  if (enrollment.state === "ready") {
+    enrollment = transitionEnrollment(options.enrollmentFile, enrollment, "consuming", {}, env, lock);
+  }
+  if (enrollment.state !== "consuming" || !enrollment.token) {
+    throw new Error("enrollment is not ready for installation");
+  }
+  const derivedEnv = {
+    ...env,
+    AGENT_BRIDGE_PROVIDER: "gateway",
+    AGENT_BRIDGE_URL: enrollment.input.gatewayUrl,
+    AGENT_BRIDGE_WORKSPACE: enrollment.input.workspaceId,
+    AGENT_BRIDGE_AGENT: void 0,
+    AGENT_BRIDGE_INSTANCE: void 0,
+    AGENT_BRIDGE_CLIENT_TOKEN: void 0
+  };
+  let result;
+  let sideEffectsCompleted = false;
+  try {
+    if (enrollment.operation === "rotate") {
+      if (!enrollment.input.credentialId || !enrollment.result) {
+        throw new Error("rotation enrollment lacks credential lineage");
+      }
+      const predecessorMatches = backendMatches(
+        expectedPath,
+        enrollment,
+        enrollment.input.credentialId,
+        false
+      );
+      const successorMatches = recovering && backendMatches(
+        expectedPath,
+        enrollment,
+        enrollment.result.credentialId,
+        true
+      );
+      if (!predecessorMatches && !successorMatches) {
+        throw new Error("rotation requires an exactly bound predecessor or successor backend");
+      }
+      const inspected = runtime2 === "claude-desktop" ? desktopRegistrationState(enrollment, expectedPath, desktopLaunch, env) : nativeRegistrationState(enrollment, expectedPath, command, scope, execute);
+      const registration = runtime2 === "claude-desktop" ? repairLegacyDesktopRegistration(
+        inspected,
+        enrollment,
+        expectedPath,
+        desktopLaunch,
+        env
+      ) : inspected;
+      if (registration !== "matching") {
+        throw new Error("rotation requires the exact existing MCP registration");
+      }
+      if (predecessorMatches) {
+        const previous = readFileSync2(expectedPath);
+        try {
+          writeBackendConfig(runtime2, identity, enrollment.input.instance, {
+            token: enrollment.token,
+            env: derivedEnv,
+            binding: {
+              credentialId: enrollment.result.credentialId,
+              principal: identity,
+              instance: enrollment.input.instance
+            }
+          });
+        } catch (error) {
+          replacePrivateFile(expectedPath, previous);
+          throw error;
+        }
+      }
+      result = baseResult;
+      sideEffectsCompleted = true;
+    } else {
+      if (recovering && existsSync2(expectedPath) && !backendMatches(
+        expectedPath,
+        enrollment,
+        enrollment.result.credentialId,
+        true
+      )) {
+        throw new Error("consuming enrollment conflicts with its client backend file");
+      }
+      const inspected = recovering ? runtime2 === "claude-desktop" ? desktopRegistrationState(enrollment, expectedPath, desktopLaunch, env) : nativeRegistrationState(enrollment, expectedPath, command, scope, execute) : "absent";
+      const registration = recovering && runtime2 === "claude-desktop" ? repairLegacyDesktopRegistration(
+        inspected,
+        enrollment,
+        expectedPath,
+        desktopLaunch,
+        env
+      ) : inspected;
+      if (recovering && registration === "conflict") {
+        throw new Error("consuming enrollment conflicts with the registered MCP server");
+      }
+      if (recovering && backendMatches(
+        expectedPath,
+        enrollment,
+        enrollment.result.credentialId,
+        true
+      ) && registration === "matching") {
+        result = baseResult;
+      } else {
+        result = installClient(runtime2, identity, {
+          command: runtime2 === "claude-desktop" ? options.command : command,
+          scope: options.scope,
+          instance: enrollment.input.instance,
+          token: enrollment.token,
+          backendBinding: {
+            credentialId: enrollment.result.credentialId,
+            principal: identity,
+            instance: enrollment.input.instance
+          },
+          env: derivedEnv
+        }, execute);
+        sideEffectsCompleted = true;
+        const verified = runtime2 === "claude-desktop" ? desktopRegistrationState(enrollment, expectedPath, desktopLaunch, env) : nativeRegistrationState(enrollment, expectedPath, command, scope, execute);
+        if (verified !== "matching") throw new Error("MCP registration verification failed");
+      }
+    }
+  } catch (error) {
+    if (!recovering && !sideEffectsCompleted) {
+      transitionEnrollment(options.enrollmentFile, enrollment, "ready", {}, env, lock);
+    }
+    throw error;
+  }
+  enrollment = transitionEnrollment(
+    options.enrollmentFile,
+    enrollment,
+    "consumed",
+    { token: null },
+    env,
+    lock
+  );
+  return removeConsumedEnrollment(options.enrollmentFile, result, lock, env);
+}
+function enrolledInstall(runtime2, identity, options, execute) {
+  const env = options.env ?? process.env;
+  if (options.recoverLock) recoverEnrollmentLock(options.enrollmentFile, env);
+  const lock = acquireEnrollmentLock(options.enrollmentFile, env);
+  let result;
+  try {
+    result = enrolledInstallLocked(runtime2, identity, options, execute, lock);
+  } catch (error) {
+    if (!lock.released) {
+      try {
+        releaseEnrollmentLock(lock);
+      } catch {
+      }
+    }
+    throw error;
+  }
+  let lockReleaseStatus;
+  try {
+    const release = releaseEnrollmentLock(lock);
+    lockReleaseStatus = release === "released" ? "released" : "durability-unknown";
+  } catch {
+    lockReleaseStatus = existsSync2(lock.lockPath) ? "retained" : "durability-unknown";
+  }
+  return { ...result, lockReleaseStatus };
+}
+function installClient(runtime2, identity, options = {}, execute = (command, args) => spawnSync(command, args, { encoding: "utf8" })) {
+  if (options.enrollmentFile) {
+    return enrolledInstall(runtime2, identity, {
+      ...options,
+      enrollmentFile: options.enrollmentFile
+    }, execute);
+  }
+  if (!runtime2) throw new Error("install runtime is required");
+  const normalizedIdentity = identity.trim();
+  if (!normalizedIdentity || normalizedIdentity.length > 128) throw new Error("--identity is required");
+  const instance = options.instance?.trim() || `${runtime2}-${randomUUID2()}`;
+  if (instance.length > 128) throw new Error("--instance exceeds 128 characters");
+  if (options.scope && !["local", "user", "project"].includes(options.scope)) {
+    throw new Error("scope must be local, user, or project");
+  }
+  const command = options.command?.trim() || "agent-bridge-mcp";
+  const env = options.env ?? process.env;
+  const desktopLaunch = runtime2 === "claude-desktop" ? resolveDesktopLaunchContract(options.command, env) : void 0;
+  const expectedPath = clientBackendConfigPath(runtime2, instance, env);
+  const previous = existsSync2(expectedPath) ? readFileSync2(expectedPath) : void 0;
+  try {
+    const backendConfigPath = writeBackendConfig(runtime2, normalizedIdentity, instance, {
+      token: options.token,
+      env,
+      binding: options.backendBinding
+    });
+    if (runtime2 === "claude-desktop") {
+      const path = desktopConfigPath(env);
+      writeJsonConfig(path, normalizedIdentity, instance, backendConfigPath, desktopLaunch);
+      return { runtime: runtime2, identity: normalizedIdentity, instance, method: "json-config", configPath: path, backendConfigPath, restartRequired: true };
+    }
+    const executable = runtime2 === "codex" ? "codex" : "claude";
+    const args = runtime2 === "codex" ? [
+      "mcp",
+      "add",
+      "agent-bridge",
+      "--env",
+      `AGENT_BRIDGE_AGENT=${normalizedIdentity}`,
+      "--env",
+      `AGENT_BRIDGE_INSTANCE=${instance}`,
+      "--env",
+      `AGENT_BRIDGE_CONFIG=${backendConfigPath}`,
+      "--",
+      command
+    ] : [
+      "mcp",
+      "add",
+      "--scope",
+      options.scope ?? "user",
+      "agent-bridge",
+      "-e",
+      `AGENT_BRIDGE_AGENT=${normalizedIdentity}`,
+      "-e",
+      `AGENT_BRIDGE_INSTANCE=${instance}`,
+      "-e",
+      `AGENT_BRIDGE_CONFIG=${backendConfigPath}`,
+      "--",
+      command
+    ];
+    const result = execute(executable, args);
+    if (result.error || result.status !== 0) {
+      const detail = result.stderr?.trim() || result.error?.message || `exit ${result.status}`;
+      throw new Error(`${runtime2} MCP installation failed: ${detail}`);
+    }
+    return { runtime: runtime2, identity: normalizedIdentity, instance, method: "native-cli", backendConfigPath, restartRequired: true };
+  } catch (error) {
+    try {
+      if (previous) replacePrivateFile(expectedPath, previous);
+      else rmSync2(expectedPath, { force: true });
+    } catch (rollbackError) {
+      const detail = rollbackError instanceof Error ? rollbackError.message : String(rollbackError);
+      throw new Error(`${error instanceof Error ? error.message : String(error)}; client config rollback failed: ${detail}`);
+    }
+    throw error;
+  }
+}
+
+// src/client-lifecycle.ts
+import {
+  accessSync as accessSync2,
+  closeSync as closeSync3,
+  constants as constants3,
+  existsSync as existsSync3,
+  fstatSync as fstatSync2,
+  fsyncSync as fsyncSync3,
+  lstatSync as lstatSync2,
+  mkdirSync as mkdirSync3,
+  openSync as openSync3,
+  readFileSync as readFileSync3,
+  renameSync as renameSync3,
+  statSync as statSync2,
+  writeFileSync as writeFileSync3
+} from "fs";
+import { createHash as createHash3, randomUUID as randomUUID3 } from "crypto";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname3, isAbsolute as isAbsolute2, join as join3, parse as parse2, resolve as resolve3, sep as sep2 } from "path";
+import { spawnSync as spawnSync2 } from "child_process";
+import { isDeepStrictEqual } from "util";
+var defaultExecutor = (command, args, context) => spawnSync2(command, args, {
+  encoding: "utf8",
+  cwd: context?.cwd,
+  env: context?.env
+});
+function validateLoopbackMcpUrl(value, field = "--mcp-url") {
+  const text2 = strictText(value, field, 2048);
+  let parsed;
+  try {
+    parsed = new URL(text2);
+  } catch {
+    throw new Error(`${field} must be a loopback HTTP MCP URL`);
+  }
+  if (parsed.protocol !== "http:" || parsed.username || parsed.password || parsed.search || parsed.hash || !["127.0.0.1", "localhost", "[::1]"].includes(parsed.hostname) || !parsed.port || parsed.pathname !== "/mcp") {
+    throw new Error(`${field} must be a loopback HTTP MCP URL ending in /mcp`);
+  }
+  return parsed.toString();
+}
+function managedClientTarget(metadata) {
+  return metadata.version === 2 ? metadata.target : {
+    version: 1,
+    transport: "stdio",
+    command: metadata.launch.command,
+    args: [...metadata.launch.args],
+    scope: metadata.launch.scope
+  };
+}
+function targetLaunchProjection(target) {
+  return target.transport === "stdio" ? { command: target.command, args: [...target.args], scope: target.scope } : { command: target.url, args: [], scope: target.scope };
+}
+function safeComponent2(value) {
+  const readable = value.replace(/[^A-Za-z0-9._-]+/g, "_").slice(0, 48) || "client";
+  const suffix = createHash3("sha256").update(value).digest("hex").slice(0, 12);
+  return `${readable}-${suffix}`;
+}
+function managedClientMetadataPath(runtime2, instance, env = process.env) {
+  return join3(env.HOME ?? homedir3(), ".agent-bridge", "clients", `${runtime2}-${safeComponent2(instance)}.managed.json`);
+}
+function desktopConfigPath2(env) {
+  if (process.platform === "win32") {
+    if (!env.APPDATA) throw new Error("APPDATA is required for Claude Desktop inspection");
+    return join3(env.APPDATA, "Claude", "claude_desktop_config.json");
+  }
+  const home = env.HOME ?? homedir3();
+  return process.platform === "darwin" ? join3(home, "Library", "Application Support", "Claude", "claude_desktop_config.json") : join3(home, ".config", "Claude", "claude_desktop_config.json");
+}
+function inspectedDesktopConfigPath(options, env) {
+  return resolve3(options.configPath?.trim() || desktopConfigPath2(env));
+}
+function clientRegistrationLocator(runtime2, scope, options, env) {
+  if (runtime2 === "claude-desktop") {
+    return { kind: "claude-desktop-config", configPath: inspectedDesktopConfigPath(options, env) };
+  }
+  if (runtime2 === "claude-code") {
+    const claudeScope = scope;
+    return {
+      kind: "claude-code-scope",
+      scope: claudeScope,
+      contextPath: claudeScope === "user" ? null : resolve3(process.cwd())
+    };
+  }
+  const codexHome = env.CODEX_HOME?.trim() || join3(env.HOME ?? homedir3(), ".codex");
+  return { kind: "codex-profile", configPath: resolve3(codexHome, "config.toml") };
+}
+function expectedManagedClientMetadata(runtime2, identity, options, env) {
+  const scope = runtime2 === "claude-code" ? options.scope ?? "user" : null;
+  const launch = runtime2 === "claude-desktop" ? resolveDesktopLaunchContract(options.command, env) : { command: safeNativeExecutableContract(options.command === void 0 ? "agent-bridge-mcp" : options.command, "--command"), args: [] };
+  return {
+    schema: "agent-bridge.client-management",
+    version: 1,
+    runtime: runtime2,
+    identity,
+    instance: options.instance.trim(),
+    backendConfigPath: resolve3(options.backendConfigPath.trim()),
+    launch: { ...launch, scope },
+    locator: clientRegistrationLocator(runtime2, scope, options, env)
+  };
+}
+function exactManagedTarget(actual, expected) {
+  return actual != null && actual.schema === expected.schema && actual.runtime === expected.runtime && actual.identity === expected.identity && actual.instance === expected.instance && actual.backendConfigPath === expected.backendConfigPath && isDeepStrictEqual(actual.locator, expected.locator);
+}
+var REGISTRATION_ENV_KEYS = [
+  "AGENT_BRIDGE_AGENT",
+  "AGENT_BRIDGE_CONFIG",
+  "AGENT_BRIDGE_INSTANCE"
+];
+function registrationTarget(metadata) {
+  return {
+    runtime: metadata.runtime,
+    identity: metadata.identity,
+    instance: metadata.instance,
+    backendConfigPath: metadata.backendConfigPath,
+    launch: { command: metadata.launch.command, args: [...metadata.launch.args], scope: metadata.launch.scope },
+    locator: metadata.locator
+  };
+}
+function safeNativeExecutableContract(value, field) {
+  const command = strictText(value, field, 4096);
+  if (/[?=#]/.test(command) || /:\/\//.test(command) || !isAbsolute2(command) && /\s/.test(command)) {
+    throw new Error(`${field} is invalid`);
+  }
+  return command;
+}
+function newNativeExecutableContract(value, field) {
+  const command = safeNativeExecutableContract(value, field);
+  if (!isAbsolute2(command)) return command;
+  if (resolve3(command) !== command || !existsSync3(command) || !statSync2(command).isFile()) {
+    throw new Error(`${field} is not an existing executable`);
+  }
+  try {
+    accessSync2(command, process.platform === "win32" ? constants3.F_OK : constants3.X_OK);
+  } catch {
+    throw new Error(`${field} is not an existing executable`);
+  }
+  return command;
+}
+function safeEnvironment(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("managed registration environment is invalid");
+  }
+  const environment = {};
+  for (const [key, item] of Object.entries(value)) {
+    if (!REGISTRATION_ENV_KEYS.includes(key)) {
+      throw new Error("managed registration contains an unsupported environment key");
+    }
+    if (key === "AGENT_BRIDGE_CONFIG") environment.AGENT_BRIDGE_CONFIG = strictAbsolutePath(item, "registration config");
+    else environment[key] = strictText(item, `registration ${key}`, 128);
+  }
+  return environment;
+}
+function exactRegistration(expected, command, args, environment) {
+  const target = managedClientTarget(expected);
+  if (target.transport === "streamable-http") {
+    return command === target.url && args.length === 0 && Object.keys(environment).length === 0;
+  }
+  return command === expected.launch.command && isDeepStrictEqual(args, expected.launch.args) && isDeepStrictEqual(environment, {
+    AGENT_BRIDGE_AGENT: expected.identity,
+    AGENT_BRIDGE_INSTANCE: expected.instance,
+    AGENT_BRIDGE_CONFIG: expected.backendConfigPath
+  });
+}
+function safeArgs(value, expected, alternate = []) {
+  if (!Array.isArray(value) || value.length > 16) throw new Error("managed registration arguments are invalid");
+  const args = value.map((item) => strictText(item, "registration argument", 1024));
+  if (!isDeepStrictEqual(args, expected) && !isDeepStrictEqual(args, alternate)) {
+    throw new Error("managed registration arguments cannot be represented safely");
+  }
+  return args;
+}
+function sensitiveArgument(args, index) {
+  const arg = args[index];
+  const previous = index > 0 ? args[index - 1] : "";
+  const sensitiveFlag = /^--?(?:token|key|secret|password|authorization|credential)(?:=.*)?$/i;
+  return sensitiveFlag.test(arg) || sensitiveFlag.test(previous) || /\bBearer\s+\S+/i.test(arg) || /^https?:\/\/\S*[?#]\S+/i.test(arg);
+}
+function safeDesktopArgs(value, expected, alternate = []) {
+  if (!Array.isArray(value) || value.length > 16) throw new Error("managed registration arguments are invalid");
+  const args = value.map((item) => strictText(item, "registration argument", 1024));
+  if (isDeepStrictEqual(args, expected) || isDeepStrictEqual(args, alternate)) return args;
+  if (args.some((_, index) => sensitiveArgument(args, index))) {
+    throw new Error("managed registration arguments cannot be represented safely");
+  }
+  return args;
+}
+function sensitiveEnvironmentEntry(key, value) {
+  return /(?:TOKEN|KEY|SECRET|PASSWORD|AUTHORIZATION|CREDENTIAL)/i.test(key) || /\bBearer\s+\S+/i.test(value) || /^https?:\/\/\S*[?#]\S+/i.test(value);
+}
+function safeDesktopEnvironment(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("managed registration environment is invalid");
+  }
+  const environment = {};
+  const extraEntries = [];
+  for (const [key, item] of Object.entries(value)) {
+    const text2 = strictText(item, `registration ${key}`, 4096);
+    if (!REGISTRATION_ENV_KEYS.includes(key)) {
+      if (sensitiveEnvironmentEntry(key, text2)) {
+        throw new Error("managed registration contains an unsupported environment key");
+      }
+      extraEntries.push(`${JSON.stringify(key)}=${JSON.stringify(text2)}`);
+      continue;
+    }
+    if (key === "AGENT_BRIDGE_CONFIG") environment.AGENT_BRIDGE_CONFIG = strictAbsolutePath(text2, "registration config");
+    else environment[key] = strictText(text2, `registration ${key}`, 128);
+  }
+  return {
+    environment,
+    extra: extraEntries.length > 0,
+    extraSha256: extraEntries.length ? createHash3("sha256").update(extraEntries.sort().join("\n")).digest("hex") : void 0
+  };
+}
+function commandContext(metadata, env) {
+  if (metadata.runtime === "codex") {
+    const locator2 = metadata.locator;
+    return { env: { ...env, CODEX_HOME: dirname3(locator2.configPath) } };
+  }
+  const locator = metadata.locator;
+  return { cwd: locator.contextPath ?? void 0, env: { ...env } };
+}
+function observeCodex(expected, execute, env, alternateArgs) {
+  const result = execute("codex", ["mcp", "get", "agent-bridge", "--json"], {
+    ...commandContext(expected, env)
+  });
+  if (result.error) throw new Error("codex MCP inspection failed");
+  if (result.status !== 0) {
+    const output = `${result.stdout}
+${result.stderr}`.trim();
+    if (output === "Error: No MCP server named 'agent-bridge' found.") {
+      return { state: "absent", target: registrationTarget(expected), observed: { state: "absent" } };
+    }
+    throw new Error("codex MCP inspection failed");
+  }
+  try {
+    const server = JSON.parse(result.stdout);
+    const transport = server?.transport;
+    const serverFields = /* @__PURE__ */ new Set([
+      "name",
+      "enabled",
+      "disabled_reason",
+      "transport",
+      "enabled_tools",
+      "disabled_tools",
+      "startup_timeout_sec",
+      "tool_timeout_sec",
+      "status"
+    ]);
+    const target = managedClientTarget(expected);
+    const transportFields = transport?.type === "streamable_http" ? /* @__PURE__ */ new Set(["type", "url", "bearer_token_env_var", "http_headers", "env_http_headers"]) : /* @__PURE__ */ new Set(["type", "command", "args", "env", "env_vars", "cwd"]);
+    const hasNonNullSetting = (field) => field in server && server[field] !== null;
+    if (!server || typeof server !== "object" || Array.isArray(server) || server.name !== "agent-bridge" || server.enabled !== true || !transport || typeof transport !== "object" || Array.isArray(transport)) {
+      throw new Error("Codex MCP registration is not a supported contract");
+    }
+    if (Object.keys(server).some((field) => !serverFields.has(field)) || Object.keys(transport).some((field) => !transportFields.has(field)) || hasNonNullSetting("enabled_tools") || hasNonNullSetting("disabled_tools")) {
+      throw new Error("Codex MCP registration contains an unsupported execution setting");
+    }
+    if (transport.type === "streamable_http") {
+      if (transport.type !== "streamable_http" || transport.bearer_token_env_var !== null || transport.http_headers !== null || transport.env_http_headers !== null) {
+        throw new Error("Codex MCP registration contains an unsupported HTTP setting");
+      }
+      const url = validateLoopbackMcpUrl(transport.url, "Codex MCP URL");
+      return {
+        state: exactRegistration(expected, url, [], {}) ? "exact" : "inexact",
+        target: registrationTarget(expected),
+        observed: { state: "present", command: url, args: [], env: {} }
+      };
+    }
+    if (transport.type !== "stdio") {
+      throw new Error("Codex MCP registration is not a supported stdio contract");
+    }
+    if ("cwd" in transport && transport.cwd !== null || "env_vars" in transport && (!Array.isArray(transport.env_vars) || transport.env_vars.length !== 0)) {
+      throw new Error("Codex MCP registration contains an unsupported execution setting");
+    }
+    const command = safeNativeExecutableContract(transport.command, "Codex MCP command");
+    const args = safeArgs(transport.args, expected.launch.args, alternateArgs);
+    const environment = safeEnvironment(transport.env);
+    return {
+      state: exactRegistration(expected, command, args, environment) ? "exact" : "inexact",
+      target: registrationTarget(expected),
+      observed: { state: "present", command, args, env: environment }
+    };
+  } catch {
+    throw new Error("Codex MCP registration cannot be represented safely");
+  }
+}
+function observeClaudeCode(expected, execute, env, alternateArgs) {
+  const locator = expected.locator;
+  const result = execute("claude", ["mcp", "get", "agent-bridge"], {
+    ...commandContext(expected, env)
+  });
+  if (result.error) throw new Error("claude-code MCP inspection failed");
+  if (result.status !== 0) {
+    const output = `${result.stdout}
+${result.stderr}`.trim();
+    if (output === 'No MCP server named "agent-bridge".' || /^No MCP server named "agent-bridge"\. Configured servers: [^\r\n]+$/.test(output)) {
+      return { state: "absent", target: registrationTarget(expected), observed: { state: "absent" } };
+    }
+    throw new Error("claude-code MCP inspection failed");
+  }
+  const scope = {
+    local: "  Scope: Local config (private to you in this project)",
+    user: "  Scope: User config (available in all your projects)",
+    project: "  Scope: Project config (shared via .mcp.json)"
+  }[expected.launch.scope];
+  const lines = result.stdout.replace(/\r\n/g, "\n").trimEnd().split("\n");
+  if (lines[0] !== "agent-bridge:" || lines[1] !== scope) {
+    throw new Error("Claude Code MCP registration scope is not the recorded scope");
+  }
+  const target = managedClientTarget(expected);
+  const httpTypeIndex = lines.indexOf("  Type: http", 2);
+  if (httpTypeIndex >= 0) {
+    const urlLine = lines[httpTypeIndex + 1];
+    if (!urlLine?.startsWith("  URL: ")) {
+      throw new Error("Claude Code MCP registration cannot be represented safely");
+    }
+    const url = validateLoopbackMcpUrl(urlLine.slice("  URL: ".length), "Claude Code MCP URL");
+    let index2 = httpTypeIndex + 2;
+    while (lines[index2] === "") index2 += 1;
+    if (lines[index2] !== `To remove this server, run: claude mcp remove agent-bridge -s ${expected.launch.scope}`) {
+      throw new Error("Claude Code MCP registration cannot be represented safely");
+    }
+    if (lines.slice(index2 + 1).some((line) => line !== "")) {
+      throw new Error("Claude Code MCP registration cannot be represented safely");
+    }
+    return {
+      state: target.transport === "streamable-http" && target.url === url ? "exact" : "inexact",
+      target: registrationTarget(expected),
+      observed: { state: "present", command: url, args: [], env: {} }
+    };
+  }
+  const typeIndex = lines.indexOf("  Type: stdio", 2);
+  if (typeIndex < 0 || lines[typeIndex + 1] !== `  Command: ${expected.launch.command}` || lines[typeIndex + 2] !== "  Args:" || lines[typeIndex + 3] !== "  Environment:") {
+    if (typeIndex < 0 || lines[typeIndex + 2] !== "  Args:" || lines[typeIndex + 3] !== "  Environment:") {
+      throw new Error("Claude Code MCP registration cannot be represented safely");
+    }
+  }
+  const commandLine = lines[typeIndex + 1];
+  if (!commandLine?.startsWith("  Command: ")) throw new Error("Claude Code MCP registration cannot be represented safely");
+  const command = safeNativeExecutableContract(commandLine.slice("  Command: ".length), "Claude Code MCP command");
+  const environmentLines = [];
+  let index = typeIndex + 4;
+  while (index < lines.length && lines[index]?.startsWith("    ")) {
+    environmentLines.push(lines[index]);
+    index += 1;
+  }
+  const values = {};
+  for (const line of environmentLines) {
+    const match = /^    ([A-Z0-9_]+)=(.*)$/.exec(line);
+    if (!match || Object.prototype.hasOwnProperty.call(values, match[1])) {
+      throw new Error("Claude Code MCP environment is invalid");
+    }
+    values[match[1]] = match[2];
+  }
+  const environment = safeEnvironment(values);
+  while (lines[index] === "") index += 1;
+  if (lines[index] !== `To remove this server, run: claude mcp remove agent-bridge -s ${expected.launch.scope}`) {
+    throw new Error("Claude Code MCP registration cannot be represented safely");
+  }
+  if (lines.slice(index + 1).some((line) => line !== "")) {
+    throw new Error("Claude Code MCP registration cannot be represented safely");
+  }
+  const args = safeArgs([], expected.launch.args, alternateArgs);
+  return {
+    state: exactRegistration(expected, command, args, environment) ? "exact" : "inexact",
+    target: registrationTarget(expected),
+    observed: { state: "present", command, args, env: environment }
+  };
+}
+function assertNoLinkedPathAncestors(path) {
+  const root = parse2(path).root;
+  let current = root;
+  for (const part of path.slice(root.length).split(sep2).filter(Boolean)) {
+    current = join3(current, part);
+    try {
+      if (lstatSync2(current).isSymbolicLink()) throw new Error("Claude Desktop config path contains a link");
+    } catch (error) {
+      if (error instanceof Error && error.message === "Claude Desktop config path contains a link") throw error;
+      if (error.code === "ENOENT") break;
+      throw new Error("Claude Desktop config path is unavailable");
+    }
+  }
+}
+function observeDesktop(expected, path, alternateArgs) {
+  assertNoLinkedPathAncestors(path);
+  if (!existsSync3(path)) return { state: "absent", target: registrationTarget(expected), observed: { state: "absent" } };
+  try {
+    const before = lstatSync2(path);
+    if (before.isSymbolicLink() || !before.isFile() || before.size > 4 * 1024 * 1024) {
+      throw new Error("Claude Desktop config is not a safe regular JSON file");
+    }
+    const descriptor = openSync3(path, constants3.O_RDONLY | (constants3.O_NOFOLLOW ?? 0));
+    let parsed;
+    try {
+      const opened = fstatSync2(descriptor);
+      if (!opened.isFile() || opened.size > 4 * 1024 * 1024 || opened.dev !== before.dev || opened.ino !== before.ino) {
+        throw new Error("Claude Desktop config changed during access");
+      }
+      parsed = JSON.parse(readFileSync3(descriptor, "utf8"));
+      const after = lstatSync2(path);
+      if (after.isSymbolicLink() || after.dev !== opened.dev || after.ino !== opened.ino) {
+        throw new Error("Claude Desktop config changed during access");
+      }
+    } finally {
+      closeSync3(descriptor);
+    }
+    const servers = parsed?.mcpServers;
+    if (servers === void 0) return { state: "absent", target: registrationTarget(expected), observed: { state: "absent" } };
+    if (!servers || typeof servers !== "object" || Array.isArray(servers)) {
+      throw new Error("Claude Desktop mcpServers is invalid");
+    }
+    const server = servers["agent-bridge"];
+    if (server === void 0) return { state: "absent", target: registrationTarget(expected), observed: { state: "absent" } };
+    if (!server || typeof server !== "object" || Array.isArray(server) || Object.keys(server).sort().join(",") !== "args,command,env") {
+      throw new Error("Claude Desktop MCP registration cannot be represented safely");
+    }
+    const entry = server;
+    const command = safeNativeExecutableContract(entry.command, "Claude Desktop MCP command");
+    const args = safeDesktopArgs(entry.args, expected.launch.args, alternateArgs);
+    const { environment, extra, extraSha256 } = safeDesktopEnvironment(entry.env);
+    return {
+      state: !extra && exactRegistration(expected, command, args, environment) ? "exact" : "inexact",
+      target: registrationTarget(expected),
+      observed: { state: "present", command, args, env: environment, ...extraSha256 ? { extraSha256 } : {} }
+    };
+  } catch {
+    throw new Error("Claude Desktop MCP registration cannot be represented safely");
+  }
+}
+function observeManagedRegistration(metadata, execute = (command, args, context) => spawnSync2(command, args, {
+  encoding: "utf8",
+  cwd: context?.cwd,
+  env: context?.env
+}), env = process.env, alternateArgs = []) {
+  return metadata.runtime === "codex" ? observeCodex(metadata, execute, env, alternateArgs) : metadata.runtime === "claude-code" ? observeClaudeCode(metadata, execute, env, alternateArgs) : observeDesktop(
+    metadata,
+    metadata.locator.configPath,
+    alternateArgs
+  );
+}
+function inspectManagedRegistration(metadata, execute = (command, args, context) => spawnSync2(command, args, {
+  encoding: "utf8",
+  cwd: context?.cwd,
+  env: context?.env
+}), env = process.env) {
+  try {
+    return observeManagedRegistration(metadata, execute, env).state;
+  } catch {
+    return "inexact";
+  }
+}
+var MAX_MANAGED_METADATA_BYTES = 64 * 1024;
+function strictText(value, field, maximum = 1024) {
+  if (typeof value !== "string" || !value || value.length > maximum || value.trim() !== value || /[\u0000-\u001f\u007f]/.test(value)) {
+    throw new Error(`managed metadata ${field} is invalid`);
+  }
+  return value;
+}
+function strictAbsolutePath(value, field) {
+  const path = strictText(value, field, 4096);
+  if (!isAbsolute2(path) || resolve3(path) !== path) throw new Error(`managed metadata ${field} is invalid`);
+  return path;
+}
+function strictLocator(runtime2, value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("managed metadata locator is invalid");
+  }
+  const locator = value;
+  if (runtime2 === "codex") {
+    if (Object.keys(locator).sort().join(",") !== "configPath,kind" || locator.kind !== "codex-profile") throw new Error("managed metadata locator is invalid");
+    const configPath = strictAbsolutePath(locator.configPath, "locator configPath");
+    if (!configPath.endsWith("/config.toml") && !configPath.endsWith("\\config.toml")) {
+      throw new Error("managed metadata locator is invalid");
+    }
+    return { kind: "codex-profile", configPath };
+  }
+  if (runtime2 === "claude-code") {
+    if (Object.keys(locator).sort().join(",") !== "contextPath,kind,scope" || locator.kind !== "claude-code-scope" || !["local", "user", "project"].includes(locator.scope)) {
+      throw new Error("managed metadata locator is invalid");
+    }
+    const scope = locator.scope;
+    if (scope === "user" && locator.contextPath !== null || scope !== "user" && typeof locator.contextPath !== "string") {
+      throw new Error("managed metadata locator is invalid");
+    }
+    return {
+      kind: "claude-code-scope",
+      scope,
+      contextPath: scope === "user" ? null : strictAbsolutePath(locator.contextPath, "locator contextPath")
+    };
+  }
+  if (Object.keys(locator).sort().join(",") !== "configPath,kind" || locator.kind !== "claude-desktop-config") throw new Error("managed metadata locator is invalid");
+  return { kind: "claude-desktop-config", configPath: strictAbsolutePath(locator.configPath, "locator configPath") };
+}
+function strictManagedMetadata(value, runtime2, instance) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("managed metadata is invalid");
+  const metadata = value;
+  const version = metadata.version;
+  const expectedKeys = version === 2 ? "backendConfigPath,identity,instance,launch,locator,runtime,schema,target,version" : "backendConfigPath,identity,instance,launch,locator,runtime,schema,version";
+  if (Object.keys(metadata).sort().join(",") !== expectedKeys || metadata.schema !== "agent-bridge.client-management" || version !== 1 && version !== 2 || metadata.runtime !== runtime2) throw new Error("managed metadata is invalid");
+  const identity = strictText(metadata.identity, "identity", 128);
+  const recordedInstance = strictText(metadata.instance, "instance", 128);
+  if (recordedInstance !== instance) throw new Error("managed metadata instance does not match its locator");
+  const backendConfigPath = strictAbsolutePath(metadata.backendConfigPath, "backendConfigPath");
+  if (!metadata.launch || typeof metadata.launch !== "object" || Array.isArray(metadata.launch)) {
+    throw new Error("managed metadata launch is invalid");
+  }
+  const launch = metadata.launch;
+  if (Object.keys(launch).sort().join(",") !== "args,command,scope" || !Array.isArray(launch.args) || launch.args.length > 16 || launch.args.some((arg) => {
+    try {
+      strictText(arg, "launch argument", 1024);
+      return false;
+    } catch {
+      return true;
+    }
+  }) || ![null, "local", "user", "project"].includes(launch.scope)) {
+    throw new Error("managed metadata launch is invalid");
+  }
+  const locator = strictLocator(runtime2, metadata.locator);
+  const scope = launch.scope;
+  if (runtime2 !== "claude-code" && scope !== null || runtime2 === "claude-code" && scope !== locator.scope || (runtime2 === "codex" || runtime2 === "claude-code") && launch.args.length !== 0 || runtime2 === "claude-desktop" && !isAbsolute2(strictText(launch.command, "launch command", 4096)) || (runtime2 === "codex" || runtime2 === "claude-code") && !(version === 2 && metadata.target?.transport === "streamable-http") && (() => {
+    try {
+      safeNativeExecutableContract(launch.command, "launch command");
+      return false;
+    } catch {
+      return true;
+    }
+  })()) {
+    throw new Error("managed metadata launch is invalid");
+  }
+  let target;
+  if (version === 2) {
+    if (!metadata.target || typeof metadata.target !== "object" || Array.isArray(metadata.target)) {
+      throw new Error("managed metadata target is invalid");
+    }
+    const candidate = metadata.target;
+    const targetScope = candidate.scope;
+    if (candidate.version !== 1 || ![null, "local", "user", "project"].includes(targetScope)) {
+      throw new Error("managed metadata target is invalid");
+    }
+    if (candidate.transport === "streamable-http") {
+      if (Object.keys(candidate).sort().join(",") !== "scope,transport,url,version" || runtime2 === "claude-desktop" || targetScope !== scope) {
+        throw new Error("managed metadata target is invalid");
+      }
+      target = {
+        version: 1,
+        transport: "streamable-http",
+        url: validateLoopbackMcpUrl(candidate.url, "managed metadata target URL"),
+        scope: targetScope
+      };
+    } else if (candidate.transport === "stdio") {
+      if (Object.keys(candidate).sort().join(",") !== "args,command,scope,transport,version" || !Array.isArray(candidate.args) || candidate.args.length > 16 || candidate.args.some((arg) => {
+        try {
+          strictText(arg, "target argument", 1024);
+          return false;
+        } catch {
+          return true;
+        }
+      })) {
+        throw new Error("managed metadata target is invalid");
+      }
+      target = {
+        version: 1,
+        transport: "stdio",
+        command: strictText(candidate.command, "target command", 4096),
+        args: [...candidate.args],
+        scope: targetScope
+      };
+      if (runtime2 === "claude-desktop") {
+        if (!isAbsolute2(target.command)) throw new Error("managed metadata target is invalid");
+      } else {
+        safeNativeExecutableContract(target.command, "managed metadata target command");
+      }
+    } else {
+      throw new Error("managed metadata target is invalid");
+    }
+    if (!isDeepStrictEqual(targetLaunchProjection(target), {
+      command: strictText(launch.command, "launch command", 4096),
+      args: [...launch.args],
+      scope
+    })) {
+      throw new Error("managed metadata target does not match its launch projection");
+    }
+  }
+  return {
+    schema: "agent-bridge.client-management",
+    version,
+    runtime: runtime2,
+    identity,
+    instance: recordedInstance,
+    backendConfigPath,
+    launch: { command: strictText(launch.command, "launch command", 4096), args: [...launch.args], scope },
+    ...target ? { target } : {},
+    locator
+  };
+}
+function loadManagedClientMetadata(runtime2, instance, env = process.env) {
+  const normalizedInstance = strictText(instance, "instance", 128);
+  const path = managedClientMetadataPath(runtime2, normalizedInstance, env);
+  verifyPrivatePathAccess(dirname3(dirname3(path)), "directory");
+  verifyPrivatePathAccess(dirname3(path), "directory");
+  const before = lstatSync2(path);
+  if (before.isSymbolicLink() || !before.isFile() || before.size > MAX_MANAGED_METADATA_BYTES) {
+    throw new Error("managed metadata is invalid");
+  }
+  verifyPrivatePathAccess(path, "file");
+  const descriptor = openSync3(path, constants3.O_RDONLY | (constants3.O_NOFOLLOW ?? 0));
+  try {
+    const opened = fstatSync2(descriptor);
+    if (!opened.isFile() || opened.size > MAX_MANAGED_METADATA_BYTES || opened.dev !== before.dev || opened.ino !== before.ino) {
+      throw new Error("managed metadata changed during access");
+    }
+    const parsed = JSON.parse(readFileSync3(descriptor, "utf8"));
+    const after = lstatSync2(path);
+    if (after.isSymbolicLink() || after.dev !== opened.dev || after.ino !== opened.ino) {
+      throw new Error("managed metadata changed during access");
+    }
+    return strictManagedMetadata(parsed, runtime2, normalizedInstance);
+  } finally {
+    closeSync3(descriptor);
+  }
+}
+function readMetadata(path, runtime2, instance) {
+  if (!existsSync3(path)) return void 0;
+  try {
+    return loadManagedClientMetadata(runtime2, instance, { HOME: dirname3(dirname3(dirname3(path))) });
+  } catch {
+    return null;
+  }
+}
+function writeManagedClientMetadata(path, metadata) {
+  const directory = dirname3(path);
+  const privateRoot = dirname3(directory);
+  mkdirSync3(privateRoot, { recursive: true, mode: 448 });
+  securePrivatePath(privateRoot, "directory");
+  mkdirSync3(directory, { recursive: true, mode: 448 });
+  securePrivatePath(directory, "directory");
+  const directoryBefore = lstatSync2(directory);
+  if (directoryBefore.isSymbolicLink() || !directoryBefore.isDirectory()) {
+    throw new Error("managed metadata directory is invalid");
+  }
+  const temporary = `${path}.${process.pid}.${randomUUID3()}.tmp`;
+  const descriptor = openSync3(temporary, "wx", 384);
+  try {
+    const opened = fstatSync2(descriptor);
+    securePrivatePath(temporary, "file");
+    const secured = lstatSync2(temporary);
+    if (!opened.isFile() || secured.isSymbolicLink() || !secured.isFile() || secured.dev !== opened.dev || secured.ino !== opened.ino) {
+      throw new Error("managed metadata temporary file changed during access");
+    }
+    writeFileSync3(descriptor, `${JSON.stringify(metadata, null, 2)}
+`);
+    fsyncSync3(descriptor);
+  } finally {
+    closeSync3(descriptor);
+  }
+  const beforeRename = lstatSync2(directory);
+  const temporaryBeforeRename = lstatSync2(temporary);
+  if (beforeRename.isSymbolicLink() || beforeRename.dev !== directoryBefore.dev || beforeRename.ino !== directoryBefore.ino || temporaryBeforeRename.isSymbolicLink() || !temporaryBeforeRename.isFile()) {
+    throw new Error("managed metadata directory changed before publication");
+  }
+  verifyPrivatePathAccess(temporary, "file");
+  renameSync3(temporary, path);
+  const afterRename = lstatSync2(directory);
+  if (afterRename.isSymbolicLink() || afterRename.dev !== directoryBefore.dev || afterRename.ino !== directoryBefore.ino) {
+    throw new Error("managed metadata directory changed during publication");
+  }
+  verifyPrivatePathAccess(path, "file");
+  if (process.platform !== "win32") {
+    const directoryDescriptor = openSync3(directory, "r");
+    try {
+      fsyncSync3(directoryDescriptor);
+    } finally {
+      closeSync3(directoryDescriptor);
+    }
+  }
+}
+function validate(runtime2, identity, options) {
+  if (!identity.trim() || identity.trim().length > 128) throw new Error("--identity is required");
+  if (!options.instance.trim() || options.instance.trim().length > 128) throw new Error("--instance is required");
+  if (!options.backendConfigPath.trim()) throw new Error("--backend-config is required");
+  if (runtime2 === "claude-code" && options.scope && !["local", "user", "project"].includes(options.scope)) {
+    throw new Error("scope must be local, user, or project");
+  }
+}
+function backendState(path) {
+  if (!existsSync3(path)) return "absent";
+  try {
+    verifyPrivatePathAccess(dirname3(path), "directory");
+    verifyPrivatePathAccess(path, "file");
+    return statSync2(path).isFile() ? "private-file" : "invalid";
+  } catch {
+    return "invalid";
+  }
+}
+function inspectClient(runtime2, identity, options, execute = defaultExecutor) {
+  validate(runtime2, identity, options);
+  const env = options.env ?? process.env;
+  const normalizedIdentity = identity.trim();
+  const expected = expectedManagedClientMetadata(runtime2, normalizedIdentity, options, env);
+  const path = managedClientMetadataPath(runtime2, expected.instance, env);
+  const metadata = readMetadata(path, runtime2, expected.instance);
+  const registration = inspectManagedRegistration(metadata ?? expected, execute, env);
+  const backend = backendState(expected.backendConfigPath);
+  let state;
+  let reason;
+  if (registration === "absent" && metadata === void 0 && backend === "absent") {
+    state = "absent";
+    reason = "registration is absent";
+  } else if (registration === "exact" && backend === "private-file" && metadata === void 0) {
+    state = "unmanaged";
+    reason = "exact registration has no managed metadata";
+  } else if (registration === "exact" && backend === "private-file" && exactManagedTarget(metadata, expected)) {
+    state = "managed";
+    reason = "registration and managed metadata are exact";
+  } else {
+    state = "drifted";
+    reason = backend !== "private-file" ? "backend path or its immediate parent is absent or not owner-private" : "registration or managed metadata differs from the requested contract";
+  }
+  return {
+    schemaVersion: 1,
+    runtime: runtime2,
+    identity: normalizedIdentity,
+    instance: expected.instance,
+    backendConfigPath: expected.backendConfigPath,
+    registrationLocator: expected.locator,
+    metadataPath: path,
+    state,
+    managed: state === "managed",
+    exact: registration === "exact" && backend === "private-file",
+    reason
+  };
+}
+function adoptClient(runtime2, identity, options, execute = defaultExecutor) {
+  const inspection = inspectClient(runtime2, identity, options, execute);
+  if (inspection.state === "managed") {
+    return { schemaVersion: 1, action: "none", applied: false, before: "managed", after: "managed", metadataPath: inspection.metadataPath, inspection };
+  }
+  if (inspection.state !== "unmanaged") {
+    throw new Error("only an exact unmanaged registration can be adopted");
+  }
+  if (options.apply) {
+    writeManagedClientMetadata(
+      inspection.metadataPath,
+      expectedManagedClientMetadata(runtime2, inspection.identity, options, options.env ?? process.env)
+    );
+    const postcondition = inspectClient(runtime2, identity, options, execute);
+    if (postcondition.state !== "managed") {
+      throw new Error("client registration changed while adoption was applied");
+    }
+    return {
+      schemaVersion: 1,
+      action: "adopt",
+      applied: true,
+      before: "unmanaged",
+      after: "managed",
+      metadataPath: inspection.metadataPath,
+      inspection: postcondition
+    };
+  }
+  return {
+    schemaVersion: 1,
+    action: "adopt",
+    applied: false,
+    before: "unmanaged",
+    after: "managed",
+    metadataPath: inspection.metadataPath,
+    inspection
+  };
+}
+
+export {
+  canonicalTimestamp,
+  canonicalGatewayUrl,
+  enrollmentTokenHash,
+  defaultEnrollmentPath,
+  createPendingEnrollment,
+  readEnrollment,
+  acquireEnrollmentLock,
+  releaseEnrollmentLock,
+  recoverEnrollmentLock,
+  deleteEnrollmentFile,
+  transitionEnrollment,
+  resolveDesktopLaunchContract,
+  stagedGatewayBackendPaths,
+  writeStagedGatewayBackendConfig,
+  installClient,
+  validateLoopbackMcpUrl,
+  managedClientTarget,
+  managedClientMetadataPath,
+  newNativeExecutableContract,
+  assertNoLinkedPathAncestors,
+  observeManagedRegistration,
+  loadManagedClientMetadata,
+  writeManagedClientMetadata,
+  inspectClient,
+  adoptClient
+};
+//# sourceMappingURL=chunk-JKKIGIO5.js.map