@factiii/runner 0.12.0 → 0.12.2

package/dist/cli.js

@@ -3984,7 +3984,7 @@ var require_has_flag = __commonJS({
 var require_supports_color = __commonJS({
   "../../node_modules/debug/node_modules/supports-color/index.js"(exports2, module2) {
     "use strict";
-    var os7 = require("os");
+    var os8 = require("os");
     var hasFlag = require_has_flag();
     var env = process.env;
     var forceColor;
@@ -4022,7 +4022,7 @@ var require_supports_color = __commonJS({
       }
       const min = forceColor ? 1 : 0;
       if (process.platform === "win32") {
-        const osRelease = os7.release().split(".");
+        const osRelease = os8.release().split(".");
         if (Number(process.versions.node.split(".")[0]) >= 8 && Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) {
           return Number(osRelease[2]) >= 14931 ? 3 : 2;
         }
@@ -6499,7 +6499,7 @@ var require_websocket = __commonJS({
     var http = require("http");
     var net3 = require("net");
     var tls = require("tls");
-    var { randomBytes, createHash: createHash2 } = require("crypto");
+    var { randomBytes: randomBytes2, createHash: createHash2 } = require("crypto");
     var { Duplex, Readable } = require("stream");
     var { URL: URL2 } = require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -7037,7 +7037,7 @@ var require_websocket = __commonJS({
         }
       }
       const defaultPort = isSecure ? 443 : 80;
-      const key = randomBytes(16).toString("base64");
+      const key = randomBytes2(16).toString("base64");
       const request = isSecure ? https.request : http.request;
       const protocolSet = /* @__PURE__ */ new Set();
       let perMessageDeflate;
@@ -13805,6 +13805,7 @@ async function teardownSession(s, target) {
 
 // ../../shared/all/helpers/board-agent-core/exec.ts
 var import_child_process2 = require("child_process");
+var import_crypto = require("crypto");
 var import_fs2 = require("fs");
 var import_promises2 = __toESM(require("fs/promises"));
 var import_net = __toESM(require("net"));
@@ -13845,6 +13846,22 @@ async function allocateSpacePorts(spaceDir) {
   await import_promises2.default.writeFile(portsFilePath(spaceDir), ports.join(","), "utf-8");
   return ports;
 }
+var SECRET_FILE = ".secret";
+function spaceSecret(spaceDir) {
+  const file = import_path4.default.join(spaceDir, SECRET_FILE);
+  try {
+    const existing = (0, import_fs2.readFileSync)(file, "utf-8").trim();
+    if (existing) return existing;
+  } catch {
+  }
+  const secret = (0, import_crypto.randomBytes)(24).toString("hex");
+  try {
+    (0, import_fs2.mkdirSync)(spaceDir, { recursive: true });
+    (0, import_fs2.writeFileSync)(file, secret, { encoding: "utf-8", mode: 384 });
+  } catch {
+  }
+  return secret;
+}
 function readSpacePorts(spaceDir) {
   try {
     return (0, import_fs2.readFileSync)(portsFilePath(spaceDir), "utf-8").split(",").map((p) => Number(p.trim())).filter((p) => Number.isInteger(p) && p > 0);
@@ -14144,6 +14161,18 @@ var import_promises5 = __toESM(require("fs/promises"));
 var import_os2 = __toESM(require("os"));
 var import_path7 = __toESM(require("path"));
 
+// ../../shared/all/domains/products.ts
+var TRONS_PER_USD = 1e6;
+var TRONS_PER_CENT = TRONS_PER_USD / 100;
+var FOUNDERS_REFUND_WINDOW_DAYS = 60;
+var FOUNDERS_REFUND_POLICY = `Refundable within ${FOUNDERS_REFUND_WINDOW_DAYS} days of purchase \u2014 after that, all sales are final.`;
+
+// ../../shared/all/domains/autoTopUp.ts
+var DAY_MS = 24 * 60 * 60 * 1e3;
+var MONTH_MS = 30 * DAY_MS;
+var CLAIM_STALE_MS = 5 * 60 * 1e3;
+var MIN_THRESHOLD_TRONS = TRONS_PER_CENT;
+
 // ../../shared/all/domains/posts.ts
 var postDataSort = /* @__PURE__ */ ((postDataSort2) => {
   postDataSort2["DAILY"] = "DAILY";
@@ -14346,7 +14375,11 @@ var checkPurchaseSchema = external_exports.object({
   productId: external_exports.string(),
   type: external_exports.enum(["STRIPE", "GOOGLE", "APPLE"]),
   receivedPrice: external_exports.number().int().min(0, "Received price must be a positive integer in cents"),
-  currency: external_exports.string().length(3).default("USD")
+  currency: external_exports.string().length(3).default("USD"),
+  // Explicit consent to keep this card for auto top-up. Card-network rules
+  // require the buyer to agree before a card may be charged while they are not
+  // present, so this must come from a checkbox they ticked — never a default.
+  saveCardForAutoTopUp: external_exports.boolean().default(false)
 });
 var creditPurchaseSchema = external_exports.object({
   orderId: external_exports.string(),
@@ -14649,6 +14682,19 @@ var skillFrontmatterSchema = external_exports.object({
 }).strict();
 var skillAgentSchema = external_exports.enum(["claude", "codex"]);
 var skillScopeSchema = external_exports.enum(["global", "repo"]);
+var autoTopUpSchema = external_exports.object({
+  enabled: external_exports.boolean(),
+  productId: external_exports.number().int().positive(),
+  thresholdTrons: external_exports.number().int().min(MIN_THRESHOLD_TRONS),
+  dailyCapCents: external_exports.number().int().min(0),
+  monthlyCapCents: external_exports.number().int().min(0),
+  // Alerts. `alertBalanceTrons` is null when the low-balance warning is off;
+  // it works independently of `enabled`, since with auto top-up off it is the
+  // only safety net there is.
+  alertOnTopUp: external_exports.boolean(),
+  alertBalanceTrons: external_exports.number().int().min(MIN_THRESHOLD_TRONS).nullable(),
+  alertNearCap: external_exports.boolean()
+});
 
 // ../../shared/all/helpers/board-agent-core/host-deploy.ts
 var import_child_process3 = require("child_process");
@@ -16903,7 +16949,7 @@ ${buildPrompt(prompts_default.implement)}`;
 };
 
 // ../../shared/all/helpers/terminal-ai/terminal-mode.ts
-var import_crypto3 = require("crypto");
+var import_crypto4 = require("crypto");
 
 // ../../shared/all/helpers/board-agent-core/boardTerminal.ts
 function boardTerminalKey(spaceSlug) {
@@ -16959,12 +17005,12 @@ function drainStateMessages(buffer) {
 }
 
 // ../../shared/all/helpers/terminal-ai/digest.ts
-var import_crypto2 = __toESM(require("crypto"));
+var import_crypto3 = __toESM(require("crypto"));
 var import_promises8 = require("fs/promises");
 var import_path10 = __toESM(require("path"));
 
 // ../../shared/all/helpers/board-agent-core/plugin.ts
-var import_crypto = __toESM(require("crypto"));
+var import_crypto2 = __toESM(require("crypto"));
 var import_fs4 = require("fs");
 var import_promises7 = require("fs/promises");
 var import_os3 = __toESM(require("os"));
@@ -17013,7 +17059,7 @@ async function treeFiles(dir) {
   return files.sort();
 }
 async function fingerprint(source, url2, version = "") {
-  const hash = import_crypto.default.createHash("sha256").update(url2).update(version);
+  const hash = import_crypto2.default.createHash("sha256").update(url2).update(version);
   for (const file of await treeFiles(source)) {
     hash.update(import_path9.default.relative(source, file));
     hash.update(await (0, import_promises7.readFile)(file));
@@ -17131,7 +17177,7 @@ async function pluginContribution() {
   return value2;
 }
 async function terminalDigest(target) {
-  const hash = import_crypto2.default.createHash("sha256").update(TMUX_CONF).update(terminalPrelude(CWD_PLACEHOLDER, target.paths.bin));
+  const hash = import_crypto3.default.createHash("sha256").update(TMUX_CONF).update(terminalPrelude(CWD_PLACEHOLDER, target.paths.bin));
   const env = target.stateEnv();
   for (const key of Object.keys(env).sort()) {
     if (VOLATILE_ENV_KEYS.has(key)) continue;
@@ -18330,7 +18376,7 @@ var TerminalModeEngine = class {
     }
     const safeExt = (ext || "png").toLowerCase().replace(/[^a-z0-9]/g, "") || "png";
     const oneShot = !dropId;
-    const safeId2 = oneShot ? (0, import_crypto3.randomUUID)() : dropId.toLowerCase().replace(/[^a-z0-9-]/g, "");
+    const safeId2 = oneShot ? (0, import_crypto4.randomUUID)() : dropId.toLowerCase().replace(/[^a-z0-9-]/g, "");
     if (!safeId2) throw new Error("Invalid drop id.");
     const dropsDir = `${target.paths.root}/drops`;
     const abs = `${dropsDir}/${safeId2}.${safeExt}`;
@@ -18531,15 +18577,7 @@ var TerminalModeEngine = class {
         `${tmuxCli(target)} list-panes -a -F '${TAB_LIST_FORMAT}' 2>/dev/null || true`
       );
       const rows = parseTerminalTabs(stdout, prefix);
-      const current = await terminalDigest(target).catch(() => "");
-      return rows.map(({ id, name, fp, dead }) => ({
-        id,
-        name,
-        // No stamp means a session older than the stamp, as blind to the
-        // current build as a mismatched one.
-        stale: !!current && fp !== current,
-        dead
-      }));
+      return rows.map(({ id, name, dead }) => ({ id, name, dead }));
     } catch {
       return [];
     }
@@ -19195,7 +19233,7 @@ async function listGithubBranches(token, fullName) {
 var import_path13 = __toESM(require("path"));
 
 // ../../shared/all/helpers/board-agent-core/secrets-gate.ts
-var import_crypto4 = __toESM(require("crypto"));
+var import_crypto5 = __toESM(require("crypto"));
 var DEPLOY_ORIGIN = "Deploy run";
 var UNATTRIBUTED = "This runner did not start the session that asked, so the request was refused. `factiii-secrets` only works inside a session the runner spawned.";
 var SecretsGate = class {
@@ -19220,7 +19258,14 @@ var SecretsGate = class {
   /** Mint a token for one session, labelled with what the owner should see on
    *  the prompt - the label is most of the decision, so name the session. */
   issueToken(origin) {
-    const token = import_crypto4.default.randomBytes(24).toString("hex");
+    const token = import_crypto5.default.randomBytes(24).toString("hex");
+    this.tokens.set(token, origin);
+    return token;
+  }
+  /** Register a durable token the caller already holds, instead of minting a
+   *  fresh one. For the space token: terminals outlive this process, so a
+   *  minted one leaves them unattributed after a restart. Idempotent. */
+  adoptToken(token, origin) {
     this.tokens.set(token, origin);
     return token;
   }
@@ -19244,7 +19289,7 @@ var SecretsGate = class {
     return new Promise((resolve2) => {
       this.waiting = {
         request: {
-          id: import_crypto4.default.randomUUID(),
+          id: import_crypto5.default.randomUUID(),
           command: opts.command,
           keys: opts.keys,
           origin: opts.origin,
@@ -19288,7 +19333,7 @@ var import_path12 = __toESM(require("path"));
 
 // ../../shared/all/helpers/board-agent-core/host-secrets.ts
 var import_child_process4 = require("child_process");
-var import_crypto5 = __toESM(require("crypto"));
+var import_crypto6 = __toESM(require("crypto"));
 var import_promises9 = __toESM(require("fs/promises"));
 var import_path11 = __toESM(require("path"));
 var import_util6 = require("util");
@@ -19316,7 +19361,7 @@ async function assertBinaries() {
   }
 }
 function deriveKey(password, salt) {
-  return import_crypto5.default.scryptSync(password, salt, 32, {
+  return import_crypto6.default.scryptSync(password, salt, 32, {
     N: SCRYPT_N,
     maxmem: 64 * 1024 * 1024
   });
@@ -19345,9 +19390,9 @@ async function initSecrets(configDir, password) {
   if (!identity || !recipient) {
     throw new Error("age-keygen returned no usable keypair.");
   }
-  const salt = import_crypto5.default.randomBytes(16);
-  const iv = import_crypto5.default.randomBytes(12);
-  const cipher = import_crypto5.default.createCipheriv(
+  const salt = import_crypto6.default.randomBytes(16);
+  const iv = import_crypto6.default.randomBytes(12);
+  const cipher = import_crypto6.default.createCipheriv(
     "aes-256-gcm",
     deriveKey(password, salt),
     iv
@@ -19372,7 +19417,7 @@ async function initSecrets(configDir, password) {
   return { success: true };
 }
 function decryptIdentity(box, password) {
-  const decipher = import_crypto5.default.createDecipheriv(
+  const decipher = import_crypto6.default.createDecipheriv(
     "aes-256-gcm",
     deriveKey(password, Buffer.from(box.salt, "base64")),
     Buffer.from(box.iv, "base64")
@@ -20037,6 +20082,7 @@ var SpaceCore = class {
     this.runnerToken = options.runnerToken;
     this.serverUrl = options.serverUrl;
     this.mcp = options.mcp;
+    this.mcpToken = options.mcpToken;
     this.requestSudo = options.requestSudo;
     this.activity = new ActivityTracker(this.emitter);
     this.gate.subscribe(() => {
@@ -20131,7 +20177,11 @@ var SpaceCore = class {
    * that DOES know itself - the deploy run - mints its own and overrides this.
    */
   secretsToken() {
-    this.spaceSecretsToken ||= this.gate.issueToken("A session on this board");
+    if (this.spaceSecretsToken) return this.spaceSecretsToken;
+    this.spaceSecretsToken = this.gate.adoptToken(
+      spaceSecret(this.spaceDir()),
+      "A session on this board"
+    );
     return this.spaceSecretsToken;
   }
   readConfig() {
@@ -20142,7 +20192,8 @@ var SpaceCore = class {
   target() {
     this.execTarget ??= hostTarget(this.spaceDir(), () => {
       const env = {};
-      for (const lane of this.mcpLanes()) env[lane.tokenEnv] = lane.mcp.token;
+      const onedrive = this.mcpToken?.();
+      if (onedrive) env[MCP_TOKEN_ENV] = onedrive;
       const board = this.boardMcp();
       if (board) env[BOARD_MCP_TOKEN_ENV] = board.token;
       env.FACTIII_SECRETS_TOKEN = this.secretsToken();
@@ -22306,12 +22357,59 @@ ${c.content.trim() || "(no description)"}`
 
 // ../../shared/all/helpers/board-agent-core/index-service.ts
 var import_child_process5 = require("child_process");
-var import_crypto6 = require("crypto");
-var import_fs5 = require("fs");
+var import_crypto7 = require("crypto");
+var import_fs6 = require("fs");
 var import_promises11 = __toESM(require("fs/promises"));
 var import_net3 = require("net");
-var import_path16 = require("path");
+var import_path17 = require("path");
 var import_util7 = require("util");
+
+// ../../shared/all/helpers/board-agent-core/node-version.ts
+var import_fs5 = require("fs");
+var import_os4 = __toESM(require("os"));
+var import_path16 = require("path");
+var MIN_INDEX_NODE_MAJOR = 20;
+var MAX_INDEX_NODE_MAJOR = 24;
+var NODE_OVERRIDE_ENV = "FACTIII_INDEX_NODE";
+function nodeMajor(version) {
+  return Number(version.replace(/^v/, "").split(".")[0]);
+}
+function indexNodeSupported(version = process.versions.node) {
+  const major = nodeMajor(version);
+  return !Number.isNaN(major) && major >= MIN_INDEX_NODE_MAJOR && major <= MAX_INDEX_NODE_MAJOR;
+}
+function candidateNodes() {
+  const paths = [];
+  const home = import_os4.default.homedir();
+  const nvmRoot = (0, import_path16.join)(home, ".nvm", "versions", "node");
+  try {
+    const versions = (0, import_fs5.readdirSync)(nvmRoot).filter((v) => indexNodeSupported(v)).sort((a, b) => nodeMajor(b) - nodeMajor(a));
+    for (const v of versions) paths.push((0, import_path16.join)(nvmRoot, v, "bin", "node"));
+  } catch {
+  }
+  for (const prefix of ["/opt/homebrew/opt", "/usr/local/opt"]) {
+    for (let major = MAX_INDEX_NODE_MAJOR; major >= MIN_INDEX_NODE_MAJOR; major -= 1) {
+      paths.push((0, import_path16.join)(prefix, `node@${major}`, "bin", "node"));
+    }
+  }
+  return paths;
+}
+function findIndexNode() {
+  const override = process.env[NODE_OVERRIDE_ENV];
+  if (override && (0, import_fs5.existsSync)(override)) return override;
+  if (indexNodeSupported()) return process.execPath;
+  return candidateNodes().find((p) => (0, import_fs5.existsSync)(p)) ?? null;
+}
+function unsupportedNodeMessage() {
+  return `The OneDrive index needs Node ${MIN_INDEX_NODE_MAJOR}-${MAX_INDEX_NODE_MAJOR} (pinned 24.11.1); this host runs Node ${process.versions.node} and has no supported Node installed. It compiles better-sqlite3 from source, and that build fails on Node ${MAX_INDEX_NODE_MAJOR + 1}+.
+
+Install one:  nvm install 24.11.1
+or point the runner at an existing one:  export ${NODE_OVERRIDE_ENV}=/path/to/node
+
+Everything else on this runner works meanwhile \u2014 only OneDrive search is off.`;
+}
+
+// ../../shared/all/helpers/board-agent-core/index-service.ts
 var execFileAsync4 = (0, import_util7.promisify)(import_child_process5.execFile);
 var IndexService = class {
   constructor(opts) {
@@ -22324,7 +22422,7 @@ var IndexService = class {
   /** Per-space bearer for MCP + file, derived from the control token (the
    *  service computes the same). */
   bearerToken(spaceSlug) {
-    return (0, import_crypto6.createHmac)("sha256", this.opts.controlToken).update(`mcp:${spaceSlug}`).digest("hex");
+    return (0, import_crypto7.createHmac)("sha256", this.opts.controlToken).update(`mcp:${spaceSlug}`).digest("hex");
   }
   /** MCP bridge for a space. Null until the service is up (which it kicks
    *  off), so a bad :0 URL is never baked in; provisionMcpLane re-runs. */
@@ -22364,27 +22462,25 @@ var IndexService = class {
       await this.waitReady(this.port);
       return;
     }
-    await this.installDeps();
+    const nodeBin = findIndexNode();
+    if (!nodeBin) throw new Error(unsupportedNodeMessage());
+    await this.installDeps(nodeBin);
     const port = await this.stablePort();
     const log = await this.openLog();
-    this.proc = (0, import_child_process5.spawn)(
-      process.execPath,
-      [(0, import_path16.join)(this.opts.indexDir, "index.js")],
-      {
-        cwd: this.opts.indexDir,
-        env: {
-          ...process.env,
-          NODE_ENV: "production",
-          PORT: String(port),
-          CONTROL_TOKEN: this.opts.controlToken,
-          EMBED_URL: this.opts.embedUrl(),
-          INDEX_DATA_DIR: this.opts.dataDir
-        },
-        stdio: log ? ["ignore", log, log] : "ignore",
-        // Own process group so stop() reaps it; nothing else reaps orphans here.
-        detached: true
-      }
-    );
+    this.proc = (0, import_child_process5.spawn)(nodeBin, [(0, import_path17.join)(this.opts.indexDir, "index.js")], {
+      cwd: this.opts.indexDir,
+      env: {
+        ...process.env,
+        NODE_ENV: "production",
+        PORT: String(port),
+        CONTROL_TOKEN: this.opts.controlToken,
+        EMBED_URL: this.opts.embedUrl(),
+        INDEX_DATA_DIR: this.opts.dataDir
+      },
+      stdio: log ? ["ignore", log, log] : "ignore",
+      // Own process group so stop() reaps it; nothing else reaps orphans here.
+      detached: true
+    });
     this.proc.on("exit", () => {
       this.proc = null;
       this.ready = null;
@@ -22398,31 +22494,58 @@ var IndexService = class {
   async openLog() {
     try {
       await import_promises11.default.mkdir(this.opts.dataDir, { recursive: true });
-      return (0, import_fs5.openSync)((0, import_path16.join)(this.opts.dataDir, "index.log"), "a");
+      return (0, import_fs6.openSync)((0, import_path17.join)(this.opts.dataDir, "index.log"), "a");
     } catch {
       return null;
     }
   }
-  /** Install the index's native deps against THIS node on first start, so a
-   *  platform needing node-gyp fails here rather than at query time. */
-  async installDeps() {
+  /** Install the index's native deps against the node that will RUN it, so a
+   *  platform needing node-gyp fails here rather than at query time.
+   *
+   *  The deps are compiled per ABI, so they are only reusable under the node
+   *  that built them. The stamp records which ABI is on disk and forces a
+   *  rebuild when the interpreter changes — otherwise a host that switches
+   *  node versions loads a binding built for the old one and dies with
+   *  "compiled against a different Node.js version". */
+  async installDeps(nodeBin) {
     const dir = this.opts.indexDir;
-    if ((0, import_fs5.existsSync)((0, import_path16.join)(dir, "node_modules"))) return;
+    const { stdout } = await execFileAsync4(nodeBin, [
+      "-p",
+      "process.versions.modules"
+    ]);
+    const abi = stdout.trim();
+    const stamp = (0, import_path17.join)(dir, ".node-abi");
+    if ((0, import_fs6.existsSync)((0, import_path17.join)(dir, "node_modules"))) {
+      const built = await import_promises11.default.readFile(stamp, "utf-8").catch(() => "");
+      if (built.trim() === abi) return;
+      await import_promises11.default.rm((0, import_path17.join)(dir, "node_modules"), { recursive: true, force: true });
+    }
     await import_promises11.default.copyFile(
-      (0, import_path16.join)(dir, "image-package.json"),
-      (0, import_path16.join)(dir, "package.json")
+      (0, import_path17.join)(dir, "image-package.json"),
+      (0, import_path17.join)(dir, "package.json")
     );
     await execFileAsync4(
       "npm",
       ["install", "--omit=dev", "--no-audit", "--no-fund"],
-      { cwd: dir }
+      {
+        cwd: dir,
+        // npm resolves node-gyp's target from the node running it, so the
+        // chosen interpreter has to lead PATH or the build targets the wrong ABI.
+        env: {
+          ...process.env,
+          PATH: `${(0, import_path17.dirname)(nodeBin)}:${process.env.PATH ?? ""}`
+        }
+      }
     );
+    await import_promises11.default.writeFile(stamp, `${abi}
+`, "utf-8").catch(() => {
+    });
   }
   /** The port to listen on, kept stable across restarts. The URL goes into the
    *  CLIs' persistent MCP config, so a fresh port each start would leave every
    *  registration pointing at a dead one. */
   async stablePort() {
-    const file = (0, import_path16.join)(this.opts.dataDir, ".port");
+    const file = (0, import_path17.join)(this.opts.dataDir, ".port");
     const saved = Number(await import_promises11.default.readFile(file, "utf-8").catch(() => ""));
     if (Number.isInteger(saved) && saved > 0 && await isFree(saved)) {
       return saved;
@@ -22597,25 +22720,25 @@ async function pairWithBrowser(serverUrl) {
 }
 
 // src/config.ts
-var import_fs9 = __toESM(require("fs"));
-var import_os6 = __toESM(require("os"));
-var import_path21 = __toESM(require("path"));
+var import_fs10 = __toESM(require("fs"));
+var import_os7 = __toESM(require("os"));
+var import_path22 = __toESM(require("path"));
 
 // src/secureFile.ts
-var import_crypto9 = __toESM(require("crypto"));
-var import_fs8 = __toESM(require("fs"));
-var import_path20 = __toESM(require("path"));
+var import_crypto10 = __toESM(require("crypto"));
+var import_fs9 = __toESM(require("fs"));
+var import_path21 = __toESM(require("path"));
 
 // src/keychain.ts
 var import_child_process7 = require("child_process");
-var import_crypto7 = __toESM(require("crypto"));
-var import_fs6 = __toESM(require("fs"));
-var import_os4 = __toESM(require("os"));
-var import_path17 = __toESM(require("path"));
+var import_crypto8 = __toESM(require("crypto"));
+var import_fs7 = __toESM(require("fs"));
+var import_os5 = __toESM(require("os"));
+var import_path18 = __toESM(require("path"));
 var SERVICE = "factiii-runner";
 var ACCOUNT = "config-encryption-key";
-var DPAPI_KEY_FILE = import_path17.default.join(
-  import_os4.default.homedir(),
+var DPAPI_KEY_FILE = import_path18.default.join(
+  import_os5.default.homedir(),
   ".factiii-runner",
   "config-key.dpapi"
 );
@@ -22695,7 +22818,7 @@ function linuxWrite(key) {
 function winRead() {
   let wrapped;
   try {
-    wrapped = import_fs6.default.readFileSync(DPAPI_KEY_FILE, "utf-8").trim();
+    wrapped = import_fs7.default.readFileSync(DPAPI_KEY_FILE, "utf-8").trim();
   } catch {
     return { state: "missing" };
   }
@@ -22720,8 +22843,8 @@ function winWrite(key) {
     "-Command",
     `ConvertTo-SecureString -String '${key.toString("base64")}' -AsPlainText -Force | ConvertFrom-SecureString`
   ]);
-  import_fs6.default.mkdirSync(import_path17.default.dirname(DPAPI_KEY_FILE), { recursive: true });
-  import_fs6.default.writeFileSync(DPAPI_KEY_FILE, `${out.trim()}
+  import_fs7.default.mkdirSync(import_path18.default.dirname(DPAPI_KEY_FILE), { recursive: true });
+  import_fs7.default.writeFileSync(DPAPI_KEY_FILE, `${out.trim()}
 `, { mode: 384 });
 }
 function keychainBackend() {
@@ -22860,7 +22983,7 @@ function resolve() {
       cached = { key: null, status: diagnose() };
       return cached;
     }
-    const fresh = import_crypto7.default.randomBytes(32);
+    const fresh = import_crypto8.default.randomBytes(32);
     writeKey(fresh);
     const verify = readKey();
     if (verify.state !== "found" || !verify.key.equals(fresh)) {
@@ -22882,23 +23005,23 @@ function keychainStatus() {
 }
 
 // src/secureStore.ts
-var import_crypto8 = __toESM(require("crypto"));
-var import_fs7 = __toESM(require("fs"));
-var import_path19 = __toESM(require("path"));
+var import_crypto9 = __toESM(require("crypto"));
+var import_fs8 = __toESM(require("fs"));
+var import_path20 = __toESM(require("path"));
 
 // src/paths.ts
-var import_os5 = __toESM(require("os"));
-var import_path18 = __toESM(require("path"));
-var CONFIG_DIR = import_path18.default.join(import_os5.default.homedir(), ".factiii-runner");
+var import_os6 = __toESM(require("os"));
+var import_path19 = __toESM(require("path"));
+var CONFIG_DIR = import_path19.default.join(import_os6.default.homedir(), ".factiii-runner");
 function safeSlug(spaceSlug) {
   return spaceSlug.replace(/[^a-zA-Z0-9_.-]/g, "_");
 }
 function spaceDirPath(spaceSlug) {
-  return import_path18.default.join(CONFIG_DIR, safeSlug(spaceSlug));
+  return import_path19.default.join(CONFIG_DIR, safeSlug(spaceSlug));
 }
 
 // src/secureStore.ts
-var VAULT_KEY_FILE = import_path19.default.join(CONFIG_DIR, "vault-key.json");
+var VAULT_KEY_FILE = import_path20.default.join(CONFIG_DIR, "vault-key.json");
 var SCRYPT_N2 = 1 << 15;
 var MIN_PASSWORD_LENGTH = 8;
 var SecureStoreError = class extends Error {
@@ -22925,7 +23048,7 @@ function requireKeychainKey() {
   );
 }
 function passwordKey(password, salt) {
-  return import_crypto8.default.scryptSync(password, salt, 32, {
+  return import_crypto9.default.scryptSync(password, salt, 32, {
     N: SCRYPT_N2,
     maxmem: 64 * 1024 * 1024
   });
@@ -22933,7 +23056,7 @@ function passwordKey(password, salt) {
 function wrapKey(machineKey, pwKey) {
   const ikm = pwKey ? Buffer.concat([machineKey, pwKey]) : machineKey;
   return Buffer.from(
-    import_crypto8.default.hkdfSync(
+    import_crypto9.default.hkdfSync(
       "sha256",
       ikm,
       Buffer.alloc(0),
@@ -22943,8 +23066,8 @@ function wrapKey(machineKey, pwKey) {
   );
 }
 function seal(plaintext, key) {
-  const iv = import_crypto8.default.randomBytes(12);
-  const cipher = import_crypto8.default.createCipheriv("aes-256-gcm", key, iv);
+  const iv = import_crypto9.default.randomBytes(12);
+  const cipher = import_crypto9.default.createCipheriv("aes-256-gcm", key, iv);
   const data = Buffer.concat([cipher.update(plaintext), cipher.final()]);
   return {
     iv: iv.toString("base64"),
@@ -22954,7 +23077,7 @@ function seal(plaintext, key) {
 }
 function unseal(box, key) {
   try {
-    const decipher = import_crypto8.default.createDecipheriv(
+    const decipher = import_crypto9.default.createDecipheriv(
       "aes-256-gcm",
       key,
       Buffer.from(box.iv, "base64")
@@ -22971,7 +23094,7 @@ function unseal(box, key) {
 function readVaultFile() {
   try {
     const parsed = JSON.parse(
-      import_fs7.default.readFileSync(VAULT_KEY_FILE, "utf-8")
+      import_fs8.default.readFileSync(VAULT_KEY_FILE, "utf-8")
     );
     return parsed.v === 1 ? parsed : null;
   } catch {
@@ -22979,15 +23102,15 @@ function readVaultFile() {
   }
 }
 function writeVaultFile(file) {
-  import_fs7.default.mkdirSync(CONFIG_DIR, { recursive: true });
+  import_fs8.default.mkdirSync(CONFIG_DIR, { recursive: true });
   const tmp = `${VAULT_KEY_FILE}.${process.pid}.tmp`;
-  import_fs7.default.writeFileSync(tmp, `${JSON.stringify(file, null, 2)}
+  import_fs8.default.writeFileSync(tmp, `${JSON.stringify(file, null, 2)}
 `, { mode: 384 });
-  import_fs7.default.renameSync(tmp, VAULT_KEY_FILE);
+  import_fs8.default.renameSync(tmp, VAULT_KEY_FILE);
 }
 var unlockedDek = null;
 function createVault(machineKey) {
-  const dek = import_crypto8.default.randomBytes(32);
+  const dek = import_crypto9.default.randomBytes(32);
   writeVaultFile({
     v: 1,
     passwordEnabled: false,
@@ -23082,7 +23205,7 @@ function enablePassword(password) {
     );
   }
   const dek = dataKey();
-  const salt = import_crypto8.default.randomBytes(16);
+  const salt = import_crypto9.default.randomBytes(16);
   writeVaultFile({
     v: 1,
     passwordEnabled: true,
@@ -23110,7 +23233,7 @@ function changePassword(current, next) {
       "The current password is not correct."
     );
   }
-  const salt = import_crypto8.default.randomBytes(16);
+  const salt = import_crypto9.default.randomBytes(16);
   writeVaultFile({
     v: 1,
     passwordEnabled: true,
@@ -23187,8 +23310,8 @@ function storeStatus() {
 // src/secureFile.ts
 var MAGIC = "FACTIII1";
 function encrypt(plain, key, version) {
-  const iv = import_crypto9.default.randomBytes(12);
-  const cipher = import_crypto9.default.createCipheriv("aes-256-gcm", key, iv);
+  const iv = import_crypto10.default.randomBytes(12);
+  const cipher = import_crypto10.default.createCipheriv("aes-256-gcm", key, iv);
   const data = Buffer.concat([cipher.update(plain), cipher.final()]);
   const envelope = {
     v: version,
@@ -23199,7 +23322,7 @@ function encrypt(plain, key, version) {
   return `${MAGIC}${JSON.stringify(envelope)}`;
 }
 function decrypt(envelope, key) {
-  const decipher = import_crypto9.default.createDecipheriv(
+  const decipher = import_crypto10.default.createDecipheriv(
     "aes-256-gcm",
     key,
     Buffer.from(envelope.iv, "base64")
@@ -23220,15 +23343,15 @@ function parseEnvelope(raw) {
   }
 }
 function atomicWrite(filePath, body) {
-  import_fs8.default.mkdirSync(import_path20.default.dirname(filePath), { recursive: true });
+  import_fs9.default.mkdirSync(import_path21.default.dirname(filePath), { recursive: true });
   const tmp = `${filePath}.${process.pid}.tmp`;
-  import_fs8.default.writeFileSync(tmp, body, { mode: 384 });
-  import_fs8.default.renameSync(tmp, filePath);
+  import_fs9.default.writeFileSync(tmp, body, { mode: 384 });
+  import_fs9.default.renameSync(tmp, filePath);
 }
 function readSecureBuffer(filePath) {
   let raw;
   try {
-    raw = import_fs8.default.readFileSync(filePath, "utf-8");
+    raw = import_fs9.default.readFileSync(filePath, "utf-8");
   } catch {
     return null;
   }
@@ -23285,7 +23408,7 @@ function writeSecureJson(filePath, value2) {
 function readBootJson(filePath) {
   let raw;
   try {
-    raw = import_fs8.default.readFileSync(filePath, "utf-8");
+    raw = import_fs9.default.readFileSync(filePath, "utf-8");
   } catch {
     return null;
   }
@@ -23335,8 +23458,8 @@ function writeBootJson(filePath, value2) {
 }
 
 // src/config.ts
-var CONFIG_DIR2 = import_path21.default.join(import_os6.default.homedir(), ".factiii-runner");
-var CONFIG_FILE = import_path21.default.join(CONFIG_DIR2, "config.json");
+var CONFIG_DIR2 = import_path22.default.join(import_os7.default.homedir(), ".factiii-runner");
+var CONFIG_FILE = import_path22.default.join(CONFIG_DIR2, "config.json");
 function readRunnerConfig() {
   return readBootJson(CONFIG_FILE);
 }
@@ -23344,7 +23467,7 @@ function writeRunnerConfig(config) {
   writeBootJson(CONFIG_FILE, config);
 }
 function configExists() {
-  return import_fs9.default.existsSync(CONFIG_FILE);
+  return import_fs10.default.existsSync(CONFIG_FILE);
 }
 
 // src/promptPassword.ts
@@ -23437,7 +23560,54 @@ function currentVersion() {
     return "0.0.0";
   }
 }
+function hostSatisfiesTarget() {
+  let engines = "";
+  try {
+    const res = (0, import_node_child_process.spawnSync)(
+      "npm",
+      ["view", `${PACKAGE_NAME}@latest`, "engines.node"],
+      { encoding: "utf-8", shell: process.platform === "win32" }
+    );
+    if (res.status !== 0) return { ok: true, reason: "" };
+    engines = (res.stdout ?? "").trim();
+  } catch {
+    return { ok: true, reason: "" };
+  }
+  if (!engines) return { ok: true, reason: "" };
+  const major = Number(process.versions.node.split(".")[0]);
+  if (Number.isNaN(major)) return { ok: true, reason: "" };
+  const min = /(?:>=|\^|~)\s*v?(\d+)/.exec(engines);
+  if (min && major < Number(min[1])) {
+    return {
+      ok: false,
+      reason: `it needs Node ${engines} and this host runs Node ${process.versions.node}`
+    };
+  }
+  const lessThan = /<\s*v?(\d+)/.exec(engines);
+  if (lessThan && major >= Number(lessThan[1])) {
+    return {
+      ok: false,
+      reason: `it needs Node ${engines} and this host runs Node ${process.versions.node}`
+    };
+  }
+  const atMost = /<=\s*v?(\d+)/.exec(engines);
+  if (atMost && major > Number(atMost[1])) {
+    return {
+      ok: false,
+      reason: `it needs Node ${engines} and this host runs Node ${process.versions.node}`
+    };
+  }
+  return { ok: true, reason: "" };
+}
 function installLatest() {
+  const fit = hostSatisfiesTarget();
+  if (!fit.ok) {
+    console.error(
+      `[update] refusing to install ${PACKAGE_NAME}@latest: ${fit.reason}.
+[update] Staying on ${currentVersion()}. Install a supported Node (nvm install 24.11.1) and restart the runner to update.`
+    );
+    return false;
+  }
   console.log(`[update] installing ${PACKAGE_NAME}@latest...`);
   const res = (0, import_node_child_process.spawnSync)("npm", ["install", "-g", `${PACKAGE_NAME}@latest`], {
     stdio: "inherit",
@@ -23457,10 +23627,10 @@ function installLatest() {
 var import_node_child_process2 = require("node:child_process");
 
 // src/daemon.ts
-var import_crypto10 = require("crypto");
-var import_fs11 = __toESM(require("fs"));
+var import_crypto11 = require("crypto");
+var import_fs12 = __toESM(require("fs"));
 var import_node_datachannel = require("node-datachannel");
-var import_path23 = __toESM(require("path"));
+var import_path24 = __toESM(require("path"));
 
 // ../../node_modules/engine.io-client/build/esm-debug/transports/polling-xhr.node.js
 var XMLHttpRequestModule = __toESM(require_XMLHttpRequest(), 1);
@@ -26959,18 +27129,18 @@ Object.assign(lookup, {
 });
 
 // src/agent-adapter.ts
-var import_fs10 = __toESM(require("fs"));
-var import_path22 = __toESM(require("path"));
+var import_fs11 = __toESM(require("fs"));
+var import_path23 = __toESM(require("path"));
 function credsDir(spaceSlug) {
-  return import_path22.default.join(spaceDirPath(spaceSlug), ".creds");
+  return import_path23.default.join(spaceDirPath(spaceSlug), ".creds");
 }
 function githubPath(spaceSlug) {
-  return import_path22.default.join(credsDir(spaceSlug), "github.json");
+  return import_path23.default.join(credsDir(spaceSlug), "github.json");
 }
 function connectionPath(spaceSlug) {
-  return import_path22.default.join(credsDir(spaceSlug), "onedrive.json");
+  return import_path23.default.join(credsDir(spaceSlug), "onedrive.json");
 }
-var RUNNER_CONFIG_PATH = import_path22.default.join(CONFIG_DIR, "runner-config.json");
+var RUNNER_CONFIG_PATH = import_path23.default.join(CONFIG_DIR, "runner-config.json");
 function writeJson(filePath, value2) {
   writeSecureJson(filePath, value2);
 }
@@ -26986,14 +27156,14 @@ function fillDefaults(config) {
 }
 function configDirNames() {
   try {
-    return import_fs10.default.readdirSync(CONFIG_DIR, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+    return import_fs11.default.readdirSync(CONFIG_DIR, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   } catch {
     return [];
   }
 }
 function provisionedSpaceSlugs() {
   return configDirNames().filter(
-    (name) => import_fs10.default.existsSync(import_path22.default.join(CONFIG_DIR, name, "bin"))
+    (name) => import_fs11.default.existsSync(import_path23.default.join(CONFIG_DIR, name, "bin"))
   );
 }
 var migrated = false;
@@ -27007,7 +27177,7 @@ function migrateToSpaceFolders() {
   }
 }
 function readLegacy(filePath) {
-  if (!import_fs10.default.existsSync(filePath)) return { readable: true, value: null };
+  if (!import_fs11.default.existsSync(filePath)) return { readable: true, value: null };
   const value2 = readSecureJson(filePath);
   return { readable: value2 !== null, value: value2 };
 }
@@ -27025,14 +27195,14 @@ function migrateOnce() {
   const consumed = [];
   let strayFiles = [];
   try {
-    strayFiles = import_fs10.default.readdirSync(CONFIG_DIR).filter((f) => f.startsWith("space-") && f.endsWith(".json")).filter((f) => !f.endsWith(".onedrive.json"));
+    strayFiles = import_fs11.default.readdirSync(CONFIG_DIR).filter((f) => f.startsWith("space-") && f.endsWith(".json")).filter((f) => !f.endsWith(".onedrive.json"));
   } catch {
     strayFiles = [];
   }
   for (const name of strayFiles) {
     const slug = name.slice("space-".length, -".json".length);
     const parsed = readLegacy(
-      import_path22.default.join(CONFIG_DIR, name)
+      import_path23.default.join(CONFIG_DIR, name)
     );
     if (!parsed.readable) continue;
     if (parsed.value) strays[slug] = parsed.value;
@@ -27045,7 +27215,7 @@ function migrateOnce() {
     ...provisionedSpaceSlugs()
   ]);
   for (const slug of slugs) {
-    if (import_fs10.default.existsSync(githubPath(slug))) continue;
+    if (import_fs11.default.existsSync(githubPath(slug))) continue;
     const over = boards[slug] ?? strays[slug] ?? {};
     if (!Object.keys(over).length && !Object.keys(base).length) continue;
     const merged = fillDefaults({
@@ -27056,32 +27226,32 @@ function migrateOnce() {
       githubToken: over.githubToken || base.githubToken,
       provider: over.provider || base.provider
     });
-    import_fs10.default.mkdirSync(credsDir(slug), { recursive: true });
+    import_fs11.default.mkdirSync(credsDir(slug), { recursive: true });
     writeJson(githubPath(slug), merged);
   }
   let odFiles = [];
   try {
-    odFiles = import_fs10.default.readdirSync(CONFIG_DIR).filter((f) => f.startsWith("space-") && f.endsWith(".onedrive.json"));
+    odFiles = import_fs11.default.readdirSync(CONFIG_DIR).filter((f) => f.startsWith("space-") && f.endsWith(".onedrive.json"));
   } catch {
     odFiles = [];
   }
   for (const name of odFiles) {
     const slug = name.slice("space-".length, -".onedrive.json".length);
-    if (import_fs10.default.existsSync(connectionPath(slug))) {
+    if (import_fs11.default.existsSync(connectionPath(slug))) {
       consumed.push(name);
       continue;
     }
-    const conn = readLegacy(import_path22.default.join(CONFIG_DIR, name));
+    const conn = readLegacy(import_path23.default.join(CONFIG_DIR, name));
     if (!conn.readable) continue;
     if (conn.value) {
-      import_fs10.default.mkdirSync(credsDir(slug), { recursive: true });
+      import_fs11.default.mkdirSync(credsDir(slug), { recursive: true });
       writeJson(connectionPath(slug), conn.value);
     }
     consumed.push(name);
   }
   for (const name of [...consumed, "runner-config.json"]) {
     try {
-      import_fs10.default.rmSync(import_path22.default.join(CONFIG_DIR, name), { force: true });
+      import_fs11.default.rmSync(import_path23.default.join(CONFIG_DIR, name), { force: true });
     } catch {
     }
   }
@@ -27093,14 +27263,14 @@ function encryptStrayPlaintextConfigs() {
   const OURS = /^(config|runner-config|space-.*)\.json(\.bak-\d+)?$/;
   let names = [];
   try {
-    names = import_fs10.default.readdirSync(CONFIG_DIR).filter((f) => OURS.test(f));
+    names = import_fs11.default.readdirSync(CONFIG_DIR).filter((f) => OURS.test(f));
   } catch {
     return;
   }
   for (const name of names) {
-    const filePath = import_path22.default.join(CONFIG_DIR, name);
+    const filePath = import_path23.default.join(CONFIG_DIR, name);
     try {
-      const raw = import_fs10.default.readFileSync(filePath, "utf-8");
+      const raw = import_fs11.default.readFileSync(filePath, "utf-8");
       if (!raw.startsWith("{")) continue;
       writeSecureJson(filePath, JSON.parse(raw));
     } catch {
@@ -27123,7 +27293,7 @@ async function getConfiguredConnections() {
     for (const slug of listConfiguredSlugs()) {
       if (kinds.has("git") && kinds.has("onedrive")) break;
       if (readBoard(slug).githubToken) kinds.add("git");
-      if (import_fs10.default.existsSync(connectionPath(slug))) kinds.add("onedrive");
+      if (import_fs11.default.existsSync(connectionPath(slug))) kinds.add("onedrive");
     }
   } catch {
     return [];
@@ -27135,7 +27305,7 @@ function listConfiguredSlugs() {
   try {
     migrateToSpaceFolders();
     return configDirNames().filter(
-      (slug) => import_fs10.default.existsSync(githubPath(slug)) || import_fs10.default.existsSync(connectionPath(slug))
+      (slug) => import_fs11.default.existsSync(githubPath(slug)) || import_fs11.default.existsSync(connectionPath(slug))
     );
   } catch {
     return [];
@@ -27154,7 +27324,7 @@ var localConfigProvider = {
   // which is what makes disconnect stick.
   writeConfig(spaceSlug, config) {
     migrateToSpaceFolders();
-    import_fs10.default.mkdirSync(credsDir(spaceSlug), { recursive: true });
+    import_fs11.default.mkdirSync(credsDir(spaceSlug), { recursive: true });
     writeJson(githubPath(spaceSlug), config);
   },
   readOneDriveConnection(spaceSlug) {
@@ -27168,7 +27338,7 @@ var localConfigProvider = {
   writeOneDriveConnection(spaceSlug, connection) {
     const filePath = connectionPath(spaceSlug);
     if (!connection) {
-      import_fs10.default.rmSync(filePath, { force: true });
+      import_fs11.default.rmSync(filePath, { force: true });
       return;
     }
     writeJson(filePath, connection);
@@ -27193,7 +27363,7 @@ var localConfigProvider = {
       "claude",
       "codex"
     ]) {
-      import_fs10.default.mkdirSync(import_path22.default.join(dir, sub), { recursive: true });
+      import_fs11.default.mkdirSync(import_path23.default.join(dir, sub), { recursive: true });
     }
     return dir;
   }
@@ -27367,15 +27537,15 @@ async function startDaemon(config) {
     }
   );
   const indexCandidates = [
-    import_path23.default.join(__dirname, "..", "index"),
-    import_path23.default.join(__dirname, "..", "..", "index", "image")
+    import_path24.default.join(__dirname, "..", "index"),
+    import_path24.default.join(__dirname, "..", "..", "index", "image")
   ];
-  const indexDir = indexCandidates.find((p) => import_fs11.default.existsSync(p)) ?? indexCandidates[0];
+  const indexDir = indexCandidates.find((p) => import_fs12.default.existsSync(p)) ?? indexCandidates[0];
   const odIndex = new IndexService({
-    controlToken: (0, import_crypto10.createHash)("sha256").update(config.authToken).digest("hex"),
+    controlToken: (0, import_crypto11.createHash)("sha256").update(config.authToken).digest("hex"),
     embedUrl: () => config.serverUrl,
     indexDir,
-    dataDir: import_path23.default.join(CONFIG_DIR, "index-data")
+    dataDir: import_path24.default.join(CONFIG_DIR, "index-data")
   });
   void odIndex.ensureRunning().catch((err) => {
     console.error(
@@ -27472,7 +27642,9 @@ async function startDaemon(config) {
         // Board MCP is server-hosted, so the base URL is all it needs.
         serverUrl: config.serverUrl,
         // Point the agent at the index MCP endpoint (lazy for the port).
-        mcp: () => odIndex.mcpBridge(spaceSlug)
+        mcp: () => odIndex.mcpBridge(spaceSlug),
+        // The bearer alone, available before the service has a port for a URL.
+        mcpToken: () => odIndex.bearerToken(spaceSlug)
       });
       engines.set(spaceSlug, engine);
       void engine.reattachAndHydrate();
@@ -27989,27 +28161,24 @@ ${err.fix}`);
   console.error("");
   process.exit(1);
 }
-var MAX_SUPPORTED_NODE_MAJOR = 24;
-function assertSupportedNode() {
-  const major = Number(process.versions.node.split(".")[0]);
-  if (Number.isNaN(major) || major <= MAX_SUPPORTED_NODE_MAJOR) return;
-  console.error(
+function warnUnsupportedNode() {
+  if (indexNodeSupported()) return;
+  const alternative = findIndexNode();
+  console.warn(
     `
-factiii-runner needs Node 20\u2013${MAX_SUPPORTED_NODE_MAJOR} (pinned 24.11.1); you are on Node ${process.versions.node}.
-The bundled OneDrive index compiles better-sqlite3 from source, and that build fails on Node 25+.
-
-Switch with nvm:  nvm install 24.11.1 && nvm use 24.11.1
-then relaunch:    factiii-runner start
-`
+Node ${process.versions.node} is outside the range the OneDrive index supports (${MIN_INDEX_NODE_MAJOR}-${MAX_INDEX_NODE_MAJOR}, pinned 24.11.1).` + (alternative ? `
+The index will run under ${alternative}. Everything else is unaffected.
+` : `
+OneDrive search will be unavailable until a supported Node is installed (nvm install 24.11.1). Everything else works.
+`)
   );
-  process.exit(1);
 }
 import_node_dns.default.setDefaultResultOrder("ipv4first");
 var program2 = new Command();
 program2.name("factiii-runner").description("Factiii Runner - run Board AI agents on remote servers").version(currentVersion());
 program2.command("setup").description("Verify the host toolchain and pair this runner").option("-s, --server <url>", "API server URL", "https://api.factiii.com").action(async (opts) => {
   try {
-    assertSupportedNode();
+    warnUnsupportedNode();
     await setup(opts.server);
   } catch (err) {
     console.error(
@@ -28038,7 +28207,7 @@ program2.command("connect").description("Pair this runner with a Factiii account
   }
 });
 program2.command("start").description("Start the runner daemon").action(async () => {
-  assertSupportedNode();
+  warnUnsupportedNode();
   if (!configExists()) {
     console.error('No config found. Run "factiii-runner setup" first.');
     process.exit(1);
@@ -28084,8 +28253,7 @@ program2.command("status").description("Show current runner configuration").acti
   console.log(`Token:   \xB7\xB7\xB7\xB7${config.authToken.slice(-4)}`);
 });
 program2.command("doctor").description("Show where each host tool resolves, for a failed environment").action(async () => {
-  const nodeMajor = Number(process.versions.node.split(".")[0]);
-  const nodeNote = nodeMajor > MAX_SUPPORTED_NODE_MAJOR ? "  (UNSUPPORTED \u2014 use 24.11.1)" : "";
+  const nodeNote = indexNodeSupported() ? "" : `  (OneDrive index needs ${MIN_INDEX_NODE_MAJOR}-${MAX_INDEX_NODE_MAJOR}; ${findIndexNode() ?? "no supported node found"})`;
   console.log(`${"node".padEnd(14)} ${process.execPath} v${process.versions.node}${nodeNote}`);
   const report = await reportToolchain(hostTarget(CONFIG_DIR));
   for (const tool of report.tools) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@factiii/runner",
-  "version": "0.12.0",
+  "version": "0.12.2",
   "description": "Factiii Runner, run Board AI agents on a machine you control. Pairs with the Factiii web/mobile clients over WebRTC.",
   "license": "ISC",
   "keywords": [