@hermespilot/link 0.5.1 → 0.5.2

package/dist/{chunk-PULX22HX.js → chunk-DZMN5RIV.js}

@@ -1649,6 +1649,185 @@ async function listHermesModelConfigs(profileName = "default", configPath = reso
     models
   };
 }
+async function listHermesModelConfigCatalog(input) {
+  const targetProfileName = input.targetProfileName?.trim() || null;
+  const targetModels = targetProfileName ? await listHermesModelConfigs(targetProfileName).then((result) => result.models).catch(() => []) : [];
+  const targetKeys = new Set(
+    targetModels.map(
+      (model) => modelConfigKey(model.provider, model.baseUrl, model.id)
+    )
+  );
+  const items = /* @__PURE__ */ new Map();
+  for (const profile of input.profiles) {
+    const profileName = profile.name.trim();
+    if (!profileName) {
+      continue;
+    }
+    const listed = await listHermesModelConfigs(profileName).catch(() => null);
+    if (!listed) {
+      continue;
+    }
+    for (const model of listed.models) {
+      const key = modelConfigKey(model.provider, model.baseUrl, model.id);
+      const existing = items.get(key);
+      if (existing) {
+        if (!existing.sourceProfiles.some(
+          (source) => source.name === profileName
+        )) {
+          existing.sourceProfiles.push({
+            name: profileName,
+            displayName: profile.displayName
+          });
+        }
+        existing.alreadyAdded = existing.alreadyAdded || targetKeys.has(key);
+        existing.isDefault = existing.isDefault || model.isDefault;
+        if (existing.credentialState !== "configured" && model.credentialState === "configured") {
+          existing.credentialState = "configured";
+        }
+        continue;
+      }
+      items.set(key, {
+        id: model.id,
+        provider: model.provider,
+        providerName: model.providerName,
+        baseUrl: model.baseUrl,
+        apiMode: model.apiMode,
+        ...model.contextLength ? { contextLength: model.contextLength } : {},
+        ...model.keyEnv ? { keyEnv: model.keyEnv } : {},
+        credentialState: model.credentialState,
+        isDefault: model.isDefault,
+        ...model.reasoningEffort ? { reasoningEffort: model.reasoningEffort } : {},
+        reasoningSupport: model.reasoningSupport,
+        supportedReasoningEfforts: model.supportedReasoningEfforts,
+        sourceProfiles: [
+          {
+            name: profileName,
+            displayName: profile.displayName
+          }
+        ],
+        alreadyAdded: targetKeys.has(key)
+      });
+    }
+  }
+  return {
+    ok: true,
+    targetProfileName,
+    models: [...items.values()].sort(compareCatalogItems)
+  };
+}
+async function importHermesModelConfig(input, targetProfileName = "default", targetConfigPath = resolveHermesConfigPath(targetProfileName)) {
+  const sourceProfileName = input.sourceProfileName.trim();
+  const modelId = input.modelId.trim();
+  if (!sourceProfileName || !modelId) {
+    throw new Error("sourceProfileName and modelId are required");
+  }
+  const source = await readHermesModelConfigForImport({
+    profileName: sourceProfileName,
+    modelId,
+    provider: input.provider?.trim(),
+    baseUrl: input.baseUrl?.trim(),
+    apiMode: input.apiMode?.trim()
+  });
+  const { document, config, existingRaw } = await readHermesConfigDocument(targetConfigPath);
+  const targetEnv = await readHermesEnvFile(targetProfileName);
+  const customProviders = ensureCustomProvidersList(config);
+  const targetEntryIndex = findCustomProviderIndexByEndpoint(customProviders, {
+    provider: source.model.provider,
+    baseUrl: source.model.baseUrl
+  });
+  const entry = targetEntryIndex >= 0 ? toRecord(customProviders[targetEntryIndex]) : {};
+  const entryHadModels = readEntryModelIds(entry).length > 0;
+  const existingKeyEnv = readString2(entry.key_env) ?? parseEnvReference(readString2(entry.api_key));
+  const existingInlineApiKey = readInlineApiKey(readString2(entry.api_key));
+  const sourceKeyEnv = source.model.keyEnv;
+  const sourceApiKey = sourceKeyEnv ? source.env[sourceKeyEnv]?.trim() : source.inlineApiKey;
+  let keyEnv = existingKeyEnv;
+  if (!keyEnv && !existingInlineApiKey) {
+    keyEnv = sourceKeyEnv ?? (sourceApiKey ? buildApiKeyEnvName(source.model.providerName, source.model.id) : void 0);
+  }
+  if (sourceApiKey && keyEnv && !existingInlineApiKey && (!existingKeyEnv || !targetEnv[keyEnv]?.trim())) {
+    await writeHermesEnvValue(targetProfileName, keyEnv, sourceApiKey);
+  }
+  entry.name = readString2(entry.name) ?? readString2(entry.provider_name) ?? source.model.providerName;
+  entry.provider_key = source.model.provider;
+  entry.base_url = source.model.baseUrl;
+  if (!entryHadModels) {
+    entry.model = source.model.id;
+  }
+  entry.api_mode = source.model.apiMode;
+  addEntryModel(entry, source.model.id);
+  if (source.model.contextLength) {
+    writeEntryModelContextLength(
+      entry,
+      source.model.id,
+      source.model.contextLength
+    );
+  } else if (!entryHadModels) {
+    delete entry.context_length;
+  }
+  if (keyEnv) {
+    entry.key_env = keyEnv;
+    delete entry.api_key;
+  } else {
+    delete entry.key_env;
+    if (!existingInlineApiKey) {
+      delete entry.api_key;
+    }
+  }
+  writeEntryModelReasoningEffort(
+    entry,
+    source.model.id,
+    source.model.reasoningEffort
+  );
+  if (targetEntryIndex >= 0) {
+    customProviders[targetEntryIndex] = entry;
+  } else {
+    customProviders.push(entry);
+  }
+  const modelConfig = ensureRecord(config, "model");
+  const currentDefaultConfig = readModelConfig(modelConfig);
+  const currentDefaultReasoningEffort = readProfileReasoningEffort(config);
+  if (input.setDefault || !currentDefaultConfig.model) {
+    if (input.setDefault && currentDefaultConfig.model && currentDefaultConfig.model !== source.model.id) {
+      retainModelDefaultAsCustomProvider(customProviders, {
+        ...currentDefaultConfig,
+        ...currentDefaultReasoningEffort ? { reasoningEffort: currentDefaultReasoningEffort } : {}
+      });
+    }
+    writeDefaultModelConfig(modelConfig, {
+      id: source.model.id,
+      provider: source.model.provider,
+      baseUrl: source.model.baseUrl,
+      apiMode: source.model.apiMode,
+      contextLength: source.model.contextLength,
+      keyEnv
+    });
+    if (source.model.reasoningEffort) {
+      writeProfileReasoningEffort(config, source.model.reasoningEffort);
+    }
+  }
+  const backupPath = await writeHermesConfigDocument({
+    configPath: targetConfigPath,
+    document,
+    config,
+    existingRaw
+  });
+  const listed = await listHermesModelConfigs(targetProfileName, targetConfigPath);
+  const importedModel = listed.models.find(
+    (model) => model.id === source.model.id && model.provider === source.model.provider && model.baseUrl === source.model.baseUrl
+  ) ?? listed.models.find((model) => model.id === source.model.id);
+  if (!importedModel) {
+    throw new Error("imported model is missing from config");
+  }
+  return {
+    ...listed,
+    model: importedModel,
+    sourceProfileName,
+    backupPath,
+    requiresGatewayReload: true,
+    restartHint: MODEL_CONFIG_RESTART_HINT
+  };
+}
 async function saveHermesModelConfig(input, profileName = "default", configPath = resolveHermesConfigPath(profileName)) {
   const normalized = normalizeModelConfigInput(input);
   const shouldUpdateReasoningEffort = input.reasoningEffort !== void 0;
@@ -2620,6 +2799,14 @@ function findCustomProviderIndex(entries, modelId) {
     (entry) => readEntryModelIds(toRecord(entry)).includes(modelId)
   );
 }
+function findCustomProviderIndexByEndpoint(entries, endpoint) {
+  return entries.findIndex((entry) => {
+    const record = toRecord(entry);
+    const provider = readString2(record.provider_key) ?? readString2(record.provider) ?? "custom";
+    const baseUrl = readString2(record.base_url) ?? readString2(record.url) ?? readString2(record.api) ?? "";
+    return provider.trim().toLowerCase() === endpoint.provider.trim().toLowerCase() && normalizeBaseUrl(baseUrl) === normalizeBaseUrl(endpoint.baseUrl);
+  });
+}
 function updateEntryModels(entry, originalModelId, nextModelId) {
   const models = entry.models;
   if (Array.isArray(models)) {
@@ -2638,6 +2825,39 @@ function updateEntryModels(entry, originalModelId, nextModelId) {
     delete record[originalModelId];
   }
 }
+function addEntryModel(entry, modelId) {
+  const id = modelId.trim();
+  if (!id) {
+    return;
+  }
+  const models = entry.models;
+  if (Array.isArray(models)) {
+    entry.models = Object.fromEntries(
+      Array.from(
+        /* @__PURE__ */ new Set([
+          ...models.filter(
+            (value) => typeof value === "string" && value.trim().length > 0
+          ),
+          id
+        ])
+      ).map((model) => [model, {}])
+    );
+    return;
+  }
+  if (typeof models === "object" && models !== null) {
+    const record = models;
+    record[id] = toRecord(record[id]);
+    return;
+  }
+  if (readString2(entry.model) !== id && readString2(entry.default_model) !== id) {
+    entry.models = Object.fromEntries(
+      Array.from(/* @__PURE__ */ new Set([...readEntryModelIds(entry), id])).map((model) => [
+        model,
+        {}
+      ])
+    );
+  }
+}
 function removeModelFromCustomProvider(entry, modelId) {
   if (readString2(entry.model) === modelId || readString2(entry.default_model) === modelId) {
     delete entry.model;
@@ -2687,6 +2907,27 @@ function readEntryModelContextLength(entry, modelId) {
     modelConfig.context_length ?? modelConfig.contextLength
   );
 }
+function writeEntryModelContextLength(entry, modelId, contextLength) {
+  const models = entry.models;
+  if (typeof models === "object" && models !== null && !Array.isArray(models)) {
+    const modelMap = models;
+    const modelConfig = toRecord(modelMap[modelId]);
+    if (contextLength) {
+      modelConfig.context_length = contextLength;
+    } else {
+      delete modelConfig.context_length;
+      delete modelConfig.contextLength;
+    }
+    modelMap[modelId] = modelConfig;
+    return;
+  }
+  if (contextLength) {
+    entry.context_length = contextLength;
+  } else {
+    delete entry.context_length;
+    delete entry.contextLength;
+  }
+}
 function readEntryModelReasoningEffort(entry, modelId) {
   const models = entry.models;
   if (typeof models === "object" && models !== null && !Array.isArray(models)) {
@@ -2723,6 +2964,80 @@ function writeEntryModelReasoningEffort(entry, modelId, reasoningEffort) {
     delete entry.reasoningEffort;
   }
 }
+async function readHermesModelConfigForImport(input) {
+  const { config } = await readHermesConfigDocument(
+    resolveHermesConfigPath(input.profileName)
+  );
+  const env = await readHermesEnvFile(input.profileName);
+  const models = readManagedModelConfigs(
+    config,
+    env,
+    readModelConfig(config.model).model ?? null,
+    readProfileReasoningEffort(config)
+  );
+  const model = models.find((candidate) => {
+    if (candidate.id !== input.modelId) {
+      return false;
+    }
+    if (input.provider && candidate.provider !== input.provider) {
+      return false;
+    }
+    if (input.baseUrl !== void 0 && normalizeBaseUrl(candidate.baseUrl) !== normalizeBaseUrl(input.baseUrl)) {
+      return false;
+    }
+    if (input.apiMode && candidate.apiMode !== input.apiMode) {
+      return false;
+    }
+    return true;
+  });
+  if (!model) {
+    throw new Error(`model "${input.modelId}" is not configured`);
+  }
+  return {
+    model,
+    env,
+    inlineApiKey: readInlineApiKeyForModel(config, model)
+  };
+}
+function readInlineApiKeyForModel(config, model) {
+  const defaultConfig = readModelConfig(config.model);
+  if (defaultConfig.model === model.id && (defaultConfig.provider ?? "default") === model.provider && normalizeBaseUrl(defaultConfig.baseUrl ?? "") === normalizeBaseUrl(model.baseUrl)) {
+    const key = readInlineApiKey(defaultConfig.apiKey);
+    if (key) {
+      return key;
+    }
+  }
+  const customProviders = Array.isArray(config.custom_providers) ? config.custom_providers : [];
+  for (const rawEntry of customProviders) {
+    const entry = toRecord(rawEntry);
+    const provider = readString2(entry.provider_key) ?? readString2(entry.provider) ?? "custom";
+    const baseUrl = readString2(entry.base_url) ?? readString2(entry.url) ?? readString2(entry.api) ?? "";
+    if (provider === model.provider && normalizeBaseUrl(baseUrl) === normalizeBaseUrl(model.baseUrl) && readEntryModelIds(entry).includes(model.id)) {
+      const key = readInlineApiKey(readString2(entry.api_key));
+      if (key) {
+        return key;
+      }
+    }
+  }
+  return void 0;
+}
+function readInlineApiKey(value) {
+  if (!value || parseEnvReference(value)) {
+    return void 0;
+  }
+  return value.trim() || void 0;
+}
+function compareCatalogItems(left, right) {
+  const provider = left.providerName.localeCompare(right.providerName);
+  if (provider !== 0) {
+    return provider;
+  }
+  const baseUrl = left.baseUrl.localeCompare(right.baseUrl);
+  if (baseUrl !== 0) {
+    return baseUrl;
+  }
+  return left.id.localeCompare(right.id);
+}
 function readCredentialState(entry, env) {
   const apiKey = readString2(entry.api_key);
   const keyEnv = readString2(entry.key_env) ?? parseEnvReference(apiKey);
@@ -2744,10 +3059,13 @@ function readModelCredentialState(model, env) {
   return env[model.keyEnv]?.trim() ? "configured" : "missing";
 }
 function modelConfigKey(provider, baseUrl, modelId) {
-  return [provider, baseUrl.replace(/\/+$/u, ""), modelId].join("\n").toLowerCase();
+  return [provider, normalizeBaseUrl(baseUrl), modelId].join("\n").toLowerCase();
 }
 function modelEndpointKey(baseUrl, modelId) {
-  return [baseUrl.replace(/\/+$/u, ""), modelId].join("\n").toLowerCase();
+  return [normalizeBaseUrl(baseUrl), modelId].join("\n").toLowerCase();
+}
+function normalizeBaseUrl(baseUrl) {
+  return baseUrl.trim().replace(/\/+$/u, "");
 }
 function inferApiMode(provider, baseUrl, explicit) {
   const normalizedExplicit = explicit?.trim();
@@ -4107,7 +4425,7 @@ async function listCronOutputFiles(profileName, jobId) {
       mtimeMs: fileStat.mtimeMs
     });
   }
-  return files.sort((left, right) => left.mtimeMs - right.mtimeMs).map(({ path: path27, mtime }) => ({ path: path27, mtime }));
+  return files.sort((left, right) => left.mtimeMs - right.mtimeMs).map(({ path: path26, mtime }) => ({ path: path26, mtime }));
 }
 async function readCronOutput(outputPath) {
   const content = await readFile3(outputPath, "utf8");
@@ -4184,7 +4502,7 @@ import os2 from "os";
 import path5 from "path";
 
 // src/constants.ts
-var LINK_VERSION = "0.5.1";
+var LINK_VERSION = "0.5.2";
 var LINK_COMMAND = "hermeslink";
 var LINK_DEFAULT_PORT = 52379;
 var LINK_RUNTIME_DIR_NAME = ".hermeslink";
@@ -12677,10 +12995,10 @@ function parseHermesApiCapabilities(payload) {
     sessionKeyHeader: readString10(features, "session_key_header")
   };
 }
-async function callHermesApi(path27, init, options) {
+async function callHermesApi(path26, init, options) {
   const method = init.method ?? "GET";
   const startedAt = Date.now();
-  void options.logger?.debug("hermes_api_request_started", { method, path: path27 });
+  void options.logger?.debug("hermes_api_request_started", { method, path: path26 });
   const availability = await ensureHermesApiServerAvailable({
     fetchImpl: options.fetchImpl,
     logger: options.logger,
@@ -12688,7 +13006,7 @@ async function callHermesApi(path27, init, options) {
   });
   let config = availability.configResult.apiServer;
   const fetcher = options.fetchImpl ?? fetch;
-  const request = () => fetchHermesApi(fetcher, config, path27, init, options);
+  const request = () => fetchHermesApi(fetcher, config, path26, init, options);
   let response;
   try {
     response = await request();
@@ -12696,7 +13014,7 @@ async function callHermesApi(path27, init, options) {
     logHermesApiError(
       options.logger,
       method,
-      path27,
+      path26,
       options.profileName,
       startedAt,
       error
@@ -12707,7 +13025,7 @@ async function callHermesApi(path27, init, options) {
     logHermesApiResponse(
       options.logger,
       method,
-      path27,
+      path26,
       options.profileName,
       startedAt,
       response
@@ -12716,7 +13034,7 @@ async function callHermesApi(path27, init, options) {
   }
   void options.logger?.warn("hermes_api_request_retrying_after_401", {
     method,
-    path: path27,
+    path: path26,
     profile: options.profileName ?? "default",
     port: config.port ?? null,
     duration_ms: Date.now() - startedAt
@@ -12734,7 +13052,7 @@ async function callHermesApi(path27, init, options) {
     logHermesApiError(
       options.logger,
       method,
-      path27,
+      path26,
       options.profileName,
       startedAt,
       error
@@ -12744,7 +13062,7 @@ async function callHermesApi(path27, init, options) {
   logHermesApiResponse(
     options.logger,
     method,
-    path27,
+    path26,
     options.profileName,
     startedAt,
     response
@@ -12754,7 +13072,7 @@ async function callHermesApi(path27, init, options) {
   }
   void options.logger?.warn("hermes_api_request_repairing_after_401", {
     method,
-    path: path27,
+    path: path26,
     profile: options.profileName ?? "default",
     port: config.port ?? null,
     duration_ms: Date.now() - startedAt
@@ -12774,7 +13092,7 @@ async function callHermesApi(path27, init, options) {
     logHermesApiError(
       options.logger,
       method,
-      path27,
+      path26,
       options.profileName,
       startedAt,
       error
@@ -12784,21 +13102,21 @@ async function callHermesApi(path27, init, options) {
   logHermesApiResponse(
     options.logger,
     method,
-    path27,
+    path26,
     options.profileName,
     startedAt,
     response
   );
   return response;
 }
-async function fetchHermesApi(fetcher, config, path27, init, options) {
+async function fetchHermesApi(fetcher, config, path26, init, options) {
   const headers = new Headers(init.headers);
   headers.set("accept", headers.get("accept") ?? "application/json");
   if (config.key) {
     headers.set("x-api-key", config.key);
     headers.set("authorization", `Bearer ${config.key}`);
   }
-  return await fetcher(`http://127.0.0.1:${config.port}${path27}`, {
+  return await fetcher(`http://127.0.0.1:${config.port}${path26}`, {
     ...init,
     headers
   }).catch((error) => {
@@ -12807,10 +13125,10 @@ async function fetchHermesApi(fetcher, config, path27, init, options) {
     }
     void options.logger?.warn("hermes_api_server_connect_failed", {
       method: String(init.method ?? "GET").toUpperCase(),
-      path: path27,
+      path: path26,
       profile: options.profileName ?? "default",
       port: config.port ?? null,
-      url: `http://127.0.0.1:${config.port}${path27}`,
+      url: `http://127.0.0.1:${config.port}${path26}`,
       error: error instanceof Error ? error.message : String(error)
     });
     throw new LinkHttpError(
@@ -12820,10 +13138,10 @@ async function fetchHermesApi(fetcher, config, path27, init, options) {
     );
   });
 }
-function logHermesApiResponse(logger, method, path27, profileName, startedAt, response) {
+function logHermesApiResponse(logger, method, path26, profileName, startedAt, response) {
   const fields = {
     method,
-    path: path27,
+    path: path26,
     profile: profileName ?? "default",
     status: response.status,
     duration_ms: Date.now() - startedAt
@@ -12844,10 +13162,10 @@ async function logHermesApiFailureResponse(logger, fields, response) {
     ...upstreamError ? { upstream_error: upstreamError } : {}
   });
 }
-function logHermesApiError(logger, method, path27, profileName, startedAt, error) {
+function logHermesApiError(logger, method, path26, profileName, startedAt, error) {
   void logger?.warn("hermes_api_request_failed", {
     method,
-    path: path27,
+    path: path26,
     profile: profileName ?? "default",
     duration_ms: Date.now() - startedAt,
     ...error instanceof LinkHttpError ? { status: error.status, code: error.code } : {},
@@ -18228,6 +18546,22 @@ function registerModelConfigRoutes(router, options) {
     ctx.set("cache-control", "no-store");
     ctx.body = await listHermesModelConfigs();
   });
+  router.get("/api/v1/model-configs/catalog", async (ctx) => {
+    await authenticateRequest(ctx, paths);
+    const targetProfileName = readQueryString(ctx.query.target_profile);
+    if (targetProfileName) {
+      await getHermesProfileStatus(targetProfileName, paths);
+    }
+    ctx.set("cache-control", "no-store");
+    const profiles = await listHermesProfiles(paths);
+    ctx.body = await listHermesModelConfigCatalog({
+      targetProfileName,
+      profiles: profiles.map((profile) => ({
+        name: profile.name,
+        displayName: profile.displayName
+      }))
+    });
+  });
   router.post("/api/v1/model-configs", async (ctx) => {
     await authenticateRequest(ctx, paths);
     const body = await readJsonBody(ctx.req);
@@ -18291,6 +18625,23 @@ function registerModelConfigRoutes(router, options) {
       throw toModelConfigHttpError(error);
     }
   });
+  router.post("/api/v1/profiles/:name/model-configs/import", async (ctx) => {
+    await authenticateRequest(ctx, paths);
+    await getHermesProfileStatus(ctx.params.name, paths);
+    const body = await readJsonBody(ctx.req);
+    const input = readModelConfigImportInput(body);
+    await getHermesProfileStatus(input.sourceProfileName, paths);
+    try {
+      const result = await importHermesModelConfig(input, ctx.params.name);
+      ctx.body = shouldReloadGatewayAfterModelConfigChange(body) ? await reloadGatewayAfterProfileModelConfigChange(result, {
+        paths,
+        logger,
+        profileName: ctx.params.name
+      }) : markModelConfigAppliedWithoutGatewayReload(result);
+    } catch (error) {
+      throw toModelConfigHttpError(error);
+    }
+  });
   router.patch("/api/v1/profiles/:name/model-configs/defaults", async (ctx) => {
     await authenticateRequest(ctx, paths);
     await getHermesProfileStatus(ctx.params.name, paths);
@@ -18357,6 +18708,25 @@ function readModelDefaultsInput(body) {
     compressionModelId: readString14(body, "compression_model_id") ?? readString14(body, "compressionModelId") ?? void 0
   };
 }
+function readModelConfigImportInput(body) {
+  const sourceProfileName = readString14(body, "source_profile") ?? readString14(body, "sourceProfile") ?? readString14(body, "source_profile_name") ?? readString14(body, "sourceProfileName");
+  const modelId = readString14(body, "model_id") ?? readString14(body, "modelId") ?? readString14(body, "id");
+  if (!sourceProfileName || !modelId) {
+    throw new LinkHttpError(
+      400,
+      "model_import_invalid",
+      "source_profile and model_id are required"
+    );
+  }
+  return {
+    sourceProfileName,
+    modelId,
+    provider: readString14(body, "provider") ?? readString14(body, "provider_key") ?? readString14(body, "providerKey") ?? void 0,
+    baseUrl: readString14(body, "base_url") ?? readString14(body, "baseUrl") ?? void 0,
+    apiMode: readString14(body, "api_mode") ?? readString14(body, "apiMode") ?? void 0,
+    setDefault: readBoolean3(body.set_default ?? body.setDefault)
+  };
+}
 function shouldReloadGatewayAfterModelConfigChange(body) {
   const explicit = readBoolean3(body.reload_gateway ?? body.reloadGateway) ?? (readBoolean3(body.skip_gateway_reload ?? body.skipGatewayReload) === true ? false : void 0);
   return explicit ?? true;
@@ -19312,6 +19682,7 @@ var CUSTOM_PROVIDER_CARD_ID = "__custom__";
 var CUSTOM_PROVIDER_REGISTRY_FILE = "memory-providers.json";
 var HINDSIGHT_DEFAULT_API_URL = "https://api.hindsight.vectorize.io";
 var HINDSIGHT_DEFAULT_LOCAL_URL = "http://localhost:8888";
+var MEMORY_PROVIDER_TEST_TIMEOUT_MS = 4e3;
 var OPENVIKING_DEFAULT_ENDPOINT = "http://127.0.0.1:1933";
 var RETAINDB_DEFAULT_BASE_URL = "https://api.retaindb.com";
 var HINDSIGHT_LLM_PROVIDERS = [
@@ -19335,25 +19706,25 @@ var MEMORY_PROVIDER_CATALOG = [
   {
     id: "honcho",
     label: "Honcho",
-    description: "AI-native cross-session user modeling provider\uFF1B\u8FD9\u91CC\u53EF\u7F16\u8F91 workspace\u3001peer \u4E0E\u53EC\u56DE\u7B56\u7565\u3002",
+    description: "AI-native cross-session user modeling provider\uFF1B\u8FD9\u91CC\u53EF\u586B\u5199 API Key\uFF0C\u5E76\u7F16\u8F91 workspace\u3001peer \u4E0E\u53EC\u56DE\u7B56\u7565\u3002",
     configurable: true
   },
   {
     id: "openviking",
     label: "OpenViking",
-    description: "\u4E0A\u4E0B\u6587\u6570\u636E\u5E93\u4E0E\u5C42\u7EA7\u77E5\u8BC6\u5E93 provider\uFF1B\u8FD9\u91CC\u53EF\u7F16\u8F91\u975E\u654F\u611F endpoint\u3001account \u4E0E agent \u6807\u8BC6\u3002",
+    description: "\u4E0A\u4E0B\u6587\u6570\u636E\u5E93\u4E0E\u5C42\u7EA7\u77E5\u8BC6\u5E93 provider\uFF1B\u8FD9\u91CC\u53EF\u7F16\u8F91 endpoint\u3001account\u3001agent \u6807\u8BC6\u4E0E\u53EF\u9009 API Key\u3002",
     configurable: true
   },
   {
     id: "mem0",
     label: "Mem0",
-    description: "\u8BED\u4E49\u641C\u7D22\u4E0E\u4E8B\u5B9E\u62BD\u53D6 provider\uFF1B\u8FD9\u91CC\u53EF\u7F16\u8F91 user\u3001agent \u4E0E rerank \u7B56\u7565\u3002",
+    description: "\u8BED\u4E49\u641C\u7D22\u4E0E\u4E8B\u5B9E\u62BD\u53D6 provider\uFF1B\u8FD9\u91CC\u53EF\u586B\u5199 API Key\uFF0C\u5E76\u7F16\u8F91 user\u3001agent \u4E0E rerank \u7B56\u7565\u3002",
     configurable: true
   },
   {
     id: "hindsight",
     label: "Hindsight",
-    description: "\u77E5\u8BC6\u56FE\u8C31\u4E0E\u591A\u7B56\u7565\u68C0\u7D22 provider\uFF1B\u8FD9\u91CC\u53EF\u7F16\u8F91\u975E\u654F\u611F\u8FDE\u63A5\u3001bank \u4E0E\u53EC\u56DE\u7B56\u7565\u3002",
+    description: "\u77E5\u8BC6\u56FE\u8C31\u4E0E\u591A\u7B56\u7565\u68C0\u7D22 provider\uFF1B\u8FD9\u91CC\u53EF\u6309\u8FDE\u63A5\u6A21\u5F0F\u586B\u5199 API Key\u3001LLM Key\u3001URL\u3001bank \u4E0E\u53EC\u56DE\u7B56\u7565\u3002",
     configurable: true
   },
   {
@@ -19365,19 +19736,19 @@ var MEMORY_PROVIDER_CATALOG = [
   {
     id: "retaindb",
     label: "RetainDB",
-    description: "Cloud memory API provider\uFF1B\u8FD9\u91CC\u53EF\u7F16\u8F91\u975E\u654F\u611F endpoint \u4E0E project\u3002",
+    description: "Cloud memory API provider\uFF1B\u8FD9\u91CC\u53EF\u586B\u5199 API Key\uFF0C\u5E76\u7F16\u8F91 endpoint \u4E0E project\u3002",
     configurable: true
   },
   {
     id: "byterover",
     label: "ByteRover",
-    description: "\u57FA\u4E8E brv CLI \u7684\u672C\u5730\u4F18\u5148\u77E5\u8BC6\u6811 provider\uFF1B\u4E91\u540C\u6B65 API key \u9700\u5728\u672C\u673A\u914D\u7F6E\u3002",
-    configurable: false
+    description: "\u57FA\u4E8E brv CLI \u7684\u672C\u5730\u4F18\u5148\u77E5\u8BC6\u6811 provider\uFF1B\u8FD9\u91CC\u53EF\u586B\u5199\u53EF\u9009\u4E91\u540C\u6B65 API Key\uFF0C\u4ECD\u9700\u672C\u673A\u5B89\u88C5 brv CLI\u3002",
+    configurable: true
   },
   {
     id: "supermemory",
     label: "Supermemory",
-    description: "\u8BED\u4E49\u957F\u671F\u8BB0\u5FC6 provider\uFF1B\u8FD9\u91CC\u53EF\u7F16\u8F91\u5BB9\u5668\u3001\u81EA\u52A8\u6355\u83B7\u4E0E\u53EC\u56DE\u7B56\u7565\u3002",
+    description: "\u8BED\u4E49\u957F\u671F\u8BB0\u5FC6 provider\uFF1B\u8FD9\u91CC\u53EF\u586B\u5199 API Key\uFF0C\u5E76\u7F16\u8F91\u5BB9\u5668\u3001\u81EA\u52A8\u6355\u83B7\u4E0E\u53EC\u56DE\u7B56\u7565\u3002",
     configurable: true
   }
 ];
@@ -19464,14 +19835,107 @@ async function saveHermesMemoryProviderSettings(profileName, provider, patch) {
   );
   return readHermesProfileMemory(profileName);
 }
+async function testHermesMemoryProviderSettings(profileName, provider, patch) {
+  const providerId = normalizeConfigurableProvider(provider, patch);
+  if (providerId === "hindsight") {
+    return testHindsightProviderSettings(profileName, patch);
+  }
+  return {
+    ok: false,
+    provider: providerId,
+    message: "\u8FD9\u4E2A memory provider \u6682\u65F6\u8FD8\u6CA1\u6709 App \u5185\u8FDE\u63A5\u6D4B\u8BD5\u3002",
+    checks: []
+  };
+}
 async function setHermesMemoryProvider(profileName, provider) {
   const providerId = normalizeSelectableProvider(provider);
   await assertProviderCanBeActivated(profileName, providerId);
   await patchHermesMemoryProvider(profileName, providerId);
   return readHermesProfileMemory(profileName);
 }
+async function testHindsightProviderSettings(profileName, patch) {
+  const config = await readJsonObject(
+    memoryProviderConfigPath(profileName, "hindsight") ?? ""
+  );
+  const env = await readHermesMemoryEnv(profileName);
+  const mode = normalizeHindsightMode(
+    patch.mode ?? config.mode ?? env.HINDSIGHT_MODE
+  );
+  const apiUrl = readString15(patch.apiUrl) ?? readString15(config.api_url) ?? env.HINDSIGHT_API_URL ?? (mode === "cloud" ? HINDSIGHT_DEFAULT_API_URL : HINDSIGHT_DEFAULT_LOCAL_URL);
+  const bankId = readString15(patch.bankId) ?? readString15(config.bank_id) ?? "hermes";
+  const apiKey = readString15(patch.apiKey) ?? env.HINDSIGHT_API_KEY ?? readString15(config.apiKey) ?? readString15(config.api_key);
+  const baseUrl = normalizeHttpUrl(apiUrl);
+  if (!baseUrl) {
+    return {
+      ok: false,
+      provider: "hindsight",
+      message: "Hindsight API URL \u4E0D\u662F\u6709\u6548\u7684 http/https \u5730\u5740\u3002",
+      checks: [
+        {
+          id: "api_url",
+          label: "API URL",
+          ok: false,
+          detail: "\u8BF7\u8F93\u5165\u6709\u6548\u7684 Hindsight API URL\u3002"
+        }
+      ]
+    };
+  }
+  if (mode === "cloud" && !isConfiguredEnvValue(apiKey)) {
+    return {
+      ok: false,
+      provider: "hindsight",
+      message: "Hindsight Cloud \u9700\u8981\u5148\u586B\u5199 API key \u624D\u80FD\u6D4B\u8BD5\u3002",
+      checks: [
+        {
+          id: "api_key",
+          label: "API key",
+          ok: false,
+          detail: "Cloud \u6A21\u5F0F\u7F3A\u5C11 Hindsight API key\u3002"
+        }
+      ]
+    };
+  }
+  const headers = hindsightRequestHeaders(apiKey);
+  const health = await probeHindsightJson(baseUrl, "/health", headers);
+  const version = await probeHindsightJson(baseUrl, "/version", headers);
+  const bankConfig = await probeHindsightJson(
+    baseUrl,
+    `/v1/default/banks/${encodeURIComponent(bankId)}/config`,
+    headers
+  );
+  const checks = [
+    {
+      id: "health",
+      label: "Hindsight API",
+      ok: health.ok,
+      detail: health.detail
+    },
+    {
+      id: "version",
+      label: "Hindsight version",
+      ok: version.ok,
+      detail: version.detail
+    },
+    {
+      id: "bank",
+      label: `Memory bank "${bankId}"`,
+      ok: bankConfig.ok,
+      detail: bankConfig.detail
+    }
+  ];
+  const ok = checks.every((check) => check.ok);
+  return {
+    ok,
+    provider: "hindsight",
+    message: ok ? "Hindsight \u8FDE\u63A5\u6D4B\u8BD5\u901A\u8FC7\u3002" : "Hindsight \u8FDE\u63A5\u6D4B\u8BD5\u672A\u901A\u8FC7\uFF0C\u8BF7\u68C0\u67E5 API URL\u3001API key \u6216\u670D\u52A1\u72B6\u6001\u3002",
+    checks
+  };
+}
 async function saveProviderSettings(profileName, provider, patch) {
   if (provider === "honcho") {
+    await patchHermesMemoryEnv(profileName, {
+      HONCHO_API_KEY: patch.apiKey
+    });
     await patchJsonProviderConfig(profileName, "honcho.json", {
       baseUrl: patch.baseUrl,
       workspace: patch.workspace,
@@ -19489,6 +19953,9 @@ async function saveProviderSettings(profileName, provider, patch) {
     return;
   }
   if (provider === "mem0") {
+    await patchHermesMemoryEnv(profileName, {
+      MEM0_API_KEY: patch.apiKey
+    });
     await patchJsonProviderConfig(profileName, "mem0.json", {
       user_id: patch.userId,
       agent_id: patch.agentId,
@@ -19499,6 +19966,7 @@ async function saveProviderSettings(profileName, provider, patch) {
   if (provider === "openviking") {
     await patchHermesMemoryEnv(profileName, {
       OPENVIKING_ENDPOINT: patch.endpoint,
+      OPENVIKING_API_KEY: patch.apiKey,
       OPENVIKING_ACCOUNT: patch.account,
       OPENVIKING_USER: patch.user,
       OPENVIKING_AGENT: patch.agent
@@ -19506,6 +19974,9 @@ async function saveProviderSettings(profileName, provider, patch) {
     return;
   }
   if (provider === "supermemory") {
+    await patchHermesMemoryEnv(profileName, {
+      SUPERMEMORY_API_KEY: patch.apiKey
+    });
     await patchJsonProviderConfig(profileName, "supermemory.json", {
       container_tag: patch.containerTag,
       auto_recall: patch.autoRecall,
@@ -19518,6 +19989,10 @@ async function saveProviderSettings(profileName, provider, patch) {
     return;
   }
   if (provider === "hindsight") {
+    await patchHermesMemoryEnv(profileName, {
+      HINDSIGHT_API_KEY: patch.apiKey,
+      HINDSIGHT_LLM_API_KEY: patch.llmApiKey
+    });
     await patchJsonProviderConfig(
       profileName,
       path21.join("hindsight", "config.json"),
@@ -19547,12 +20022,16 @@ async function saveProviderSettings(profileName, provider, patch) {
   }
   if (provider === "retaindb") {
     await patchHermesMemoryEnv(profileName, {
+      RETAINDB_API_KEY: patch.apiKey,
       RETAINDB_BASE_URL: patch.baseUrl,
       RETAINDB_PROJECT: patch.project
     });
     return;
   }
   if (provider === "byterover") {
+    await patchHermesMemoryEnv(profileName, {
+      BRV_API_KEY: patch.apiKey
+    });
     return;
   }
   await patchCustomProviderConfig(profileName, provider, patch);
@@ -19888,7 +20367,7 @@ async function readProviderConfigurationStatus(profileName, provider) {
     );
     return isConfiguredEnvValue(env.HONCHO_API_KEY) || isConfiguredEnvValue(readString15(config2.apiKey)) || isConfiguredEnvValue(readString15(config2.api_key)) || isConfiguredEnvValue(readString15(config2.baseUrl)) ? { configured: true, issue: null } : {
       configured: false,
-      issue: "Honcho \u9700\u8981\u5148\u914D\u7F6E HONCHO_API_KEY\uFF0C\u6216\u5728 honcho.json \u914D\u7F6E self-hosted baseUrl\u3002"
+      issue: "Honcho \u9700\u8981\u5148\u586B\u5199 API Key\uFF0C\u6216\u5728 honcho.json \u914D\u7F6E self-hosted baseUrl\u3002"
     };
   }
   if (provider === "mem0") {
@@ -19897,7 +20376,7 @@ async function readProviderConfigurationStatus(profileName, provider) {
     );
     return isConfiguredEnvValue(env.MEM0_API_KEY) || isConfiguredEnvValue(readString15(config2.api_key)) ? { configured: true, issue: null } : {
       configured: false,
-      issue: "Mem0 \u9700\u8981\u5148\u5728\u672C\u673A Hermes .env \u914D\u7F6E MEM0_API_KEY\u3002"
+      issue: "Mem0 \u9700\u8981\u5148\u5728\u672C\u9875\u586B\u5199 API Key\uFF0CLink \u4F1A\u5199\u5165\u5F53\u524D Profile \u7684 .env\u3002"
     };
   }
   if (provider === "openviking") {
@@ -19909,7 +20388,7 @@ async function readProviderConfigurationStatus(profileName, provider) {
   if (provider === "supermemory") {
     return isConfiguredEnvValue(env.SUPERMEMORY_API_KEY) ? { configured: true, issue: null } : {
       configured: false,
-      issue: "Supermemory \u9700\u8981\u5148\u5728\u672C\u673A Hermes .env \u914D\u7F6E SUPERMEMORY_API_KEY\u3002"
+      issue: "Supermemory \u9700\u8981\u5148\u5728\u672C\u9875\u586B\u5199 API Key\uFF0CLink \u4F1A\u5199\u5165\u5F53\u524D Profile \u7684 .env\u3002"
     };
   }
   if (provider === "holographic") {
@@ -19918,7 +20397,7 @@ async function readProviderConfigurationStatus(profileName, provider) {
   if (provider === "retaindb") {
     return isConfiguredEnvValue(env.RETAINDB_API_KEY) ? { configured: true, issue: null } : {
       configured: false,
-      issue: "RetainDB \u9700\u8981\u5148\u5728\u672C\u673A Hermes .env \u914D\u7F6E RETAINDB_API_KEY\u3002"
+      issue: "RetainDB \u9700\u8981\u5148\u5728\u672C\u9875\u586B\u5199 API Key\uFF0CLink \u4F1A\u5199\u5165\u5F53\u524D Profile \u7684 .env\u3002"
     };
   }
   if (provider === "byterover") {
@@ -19941,7 +20420,7 @@ async function readProviderConfigurationStatus(profileName, provider) {
   if (mode === "cloud") {
     return isConfiguredEnvValue(apiKey) ? { configured: true, issue: null } : {
       configured: false,
-      issue: "Hindsight Cloud \u9700\u8981\u5148\u5728\u672C\u673A Hermes .env \u914D\u7F6E HINDSIGHT_API_KEY\u3002"
+      issue: "Hindsight Cloud \u9700\u8981\u5148\u5728\u672C\u9875\u586B\u5199 API Key\uFF0CLink \u4F1A\u5199\u5165\u5F53\u524D Profile \u7684 .env\u3002"
     };
   }
   if (mode === "local_external") {
@@ -19957,7 +20436,7 @@ async function readProviderConfigurationStatus(profileName, provider) {
     if (!llmModel) {
       return {
         configured: false,
-        issue: "Hindsight local_embedded \u9700\u8981\u5148\u914D\u7F6E LLM \u6A21\u578B\u3002"
+        issue: "Hindsight local_embedded \u9700\u8981\u5148\u586B\u5199 LLM \u6A21\u578B\u3002"
       };
     }
     if (llmProvider === "openai_compatible" && !isConfiguredEnvValue(
@@ -19965,7 +20444,7 @@ async function readProviderConfigurationStatus(profileName, provider) {
     )) {
       return {
         configured: false,
-        issue: "Hindsight openai_compatible \u9700\u8981\u5148\u914D\u7F6E LLM Base URL\u3002"
+        issue: "Hindsight openai_compatible \u9700\u8981\u5148\u586B\u5199 LLM Base URL\u3002"
       };
     }
     if (!["ollama", "lmstudio", "openai_compatible"].includes(llmProvider) && !isConfiguredEnvValue(
@@ -19973,7 +20452,7 @@ async function readProviderConfigurationStatus(profileName, provider) {
     )) {
       return {
         configured: false,
-        issue: "Hindsight local_embedded \u9700\u8981\u5148\u5728\u672C\u673A Hermes .env \u914D\u7F6E HINDSIGHT_LLM_API_KEY\u3002"
+        issue: "Hindsight local_embedded \u9700\u8981\u5148\u586B\u5199 LLM API Key\uFF0CLink \u4F1A\u5199\u5165\u5F53\u524D Profile \u7684 .env\u3002"
       };
     }
     return { configured: true, issue: null };
@@ -20019,8 +20498,15 @@ async function readProviderSettings(profileName, provider) {
     const config = await readJsonObject(
       memoryProviderConfigPath(profileName, provider) ?? ""
     );
+    const env = await readHermesMemoryEnv(profileName);
     return [
       stringSetting("baseUrl", "Base URL", config.baseUrl ?? ""),
+      secretSetting(
+        "apiKey",
+        "API Key",
+        env.HONCHO_API_KEY ?? readString15(config.apiKey) ?? readString15(config.api_key),
+        isConfiguredEnvValue(env.HONCHO_API_KEY) || isConfiguredEnvValue(readString15(config.apiKey)) || isConfiguredEnvValue(readString15(config.api_key))
+      ),
       stringSetting("workspace", "Workspace", config.workspace ?? "hermes"),
       stringSetting("peerName", "\u7528\u6237 Peer", config.peerName ?? ""),
       stringSetting("aiPeer", "AI Peer", config.aiPeer ?? "hermes"),
@@ -20056,7 +20542,14 @@ async function readProviderSettings(profileName, provider) {
     const config = await readJsonObject(
       memoryProviderConfigPath(profileName, provider) ?? ""
     );
+    const env = await readHermesMemoryEnv(profileName);
     return [
+      secretSetting(
+        "apiKey",
+        "API Key",
+        env.MEM0_API_KEY ?? readString15(config.apiKey) ?? readString15(config.api_key),
+        isConfiguredEnvValue(env.MEM0_API_KEY) || isConfiguredEnvValue(readString15(config.apiKey)) || isConfiguredEnvValue(readString15(config.api_key))
+      ),
       stringSetting("userId", "User ID", config.user_id ?? "hermes-user"),
       stringSetting("agentId", "Agent ID", config.agent_id ?? "hermes"),
       booleanSetting("rerank", "\u542F\u7528 rerank", config.rerank ?? true)
@@ -20070,6 +20563,12 @@ async function readProviderSettings(profileName, provider) {
         "Endpoint",
         env.OPENVIKING_ENDPOINT ?? OPENVIKING_DEFAULT_ENDPOINT
       ),
+      secretSetting(
+        "apiKey",
+        "API Key (optional)",
+        env.OPENVIKING_API_KEY,
+        isConfiguredEnvValue(env.OPENVIKING_API_KEY)
+      ),
       stringSetting("account", "Account", env.OPENVIKING_ACCOUNT ?? "default"),
       stringSetting("user", "User", env.OPENVIKING_USER ?? "default"),
       stringSetting("agent", "Agent", env.OPENVIKING_AGENT ?? "hermes")
@@ -20079,7 +20578,14 @@ async function readProviderSettings(profileName, provider) {
     const config = await readJsonObject(
       memoryProviderConfigPath(profileName, provider) ?? ""
     );
+    const env = await readHermesMemoryEnv(profileName);
     return [
+      secretSetting(
+        "apiKey",
+        "API Key",
+        env.SUPERMEMORY_API_KEY,
+        isConfiguredEnvValue(env.SUPERMEMORY_API_KEY)
+      ),
       stringSetting("containerTag", "\u5BB9\u5668\u6807\u7B7E", config.container_tag ?? "hermes"),
       booleanSetting("autoRecall", "\u81EA\u52A8\u56DE\u5FC6", config.auto_recall ?? true),
       booleanSetting("autoCapture", "\u81EA\u52A8\u6355\u83B7", config.auto_capture ?? true),
@@ -20109,6 +20615,7 @@ async function readProviderSettings(profileName, provider) {
     const config = await readJsonObject(
       memoryProviderConfigPath(profileName, provider) ?? ""
     );
+    const env = await readHermesMemoryEnv(profileName);
     const banks = toRecord14(config.banks);
     const hermesBank = toRecord14(banks.hermes);
     const mode = normalizeHindsightMode(config.mode);
@@ -20123,6 +20630,12 @@ async function readProviderSettings(profileName, provider) {
         "API URL",
         config.api_url ?? (mode === "cloud" ? HINDSIGHT_DEFAULT_API_URL : HINDSIGHT_DEFAULT_LOCAL_URL)
       ),
+      secretSetting(
+        "apiKey",
+        "Hindsight API Key",
+        env.HINDSIGHT_API_KEY ?? readString15(config.apiKey) ?? readString15(config.api_key),
+        isConfiguredEnvValue(env.HINDSIGHT_API_KEY) || isConfiguredEnvValue(readString15(config.apiKey)) || isConfiguredEnvValue(readString15(config.api_key))
+      ),
       stringSetting(
         "bankId",
         "Memory Bank",
@@ -20140,6 +20653,12 @@ async function readProviderSettings(profileName, provider) {
         "\u672C\u5730 LLM Base URL",
         config.llm_base_url ?? ""
       ),
+      secretSetting(
+        "llmApiKey",
+        "LLM API Key",
+        env.HINDSIGHT_LLM_API_KEY ?? readString15(config.llmApiKey) ?? readString15(config.llm_api_key),
+        isConfiguredEnvValue(env.HINDSIGHT_LLM_API_KEY) || isConfiguredEnvValue(readString15(config.llmApiKey)) || isConfiguredEnvValue(readString15(config.llm_api_key))
+      ),
       booleanSetting("autoRecall", "\u81EA\u52A8\u56DE\u5FC6", config.auto_recall ?? true),
       booleanSetting("autoRetain", "\u81EA\u52A8\u6C89\u6DC0", config.auto_retain ?? true),
       selectSetting(
@@ -20172,6 +20691,12 @@ async function readProviderSettings(profileName, provider) {
   if (provider === "retaindb") {
     const env = await readHermesMemoryEnv(profileName);
     return [
+      secretSetting(
+        "apiKey",
+        "API Key",
+        env.RETAINDB_API_KEY,
+        isConfiguredEnvValue(env.RETAINDB_API_KEY)
+      ),
       stringSetting(
         "baseUrl",
         "Base URL",
@@ -20181,7 +20706,14 @@ async function readProviderSettings(profileName, provider) {
     ];
   }
   if (provider === "byterover") {
+    const env = await readHermesMemoryEnv(profileName);
     return [
+      secretSetting(
+        "apiKey",
+        "Cloud Sync API Key (optional)",
+        env.BRV_API_KEY,
+        isConfiguredEnvValue(env.BRV_API_KEY)
+      ),
       stringSetting(
         "workingDirectory",
         "\u5DE5\u4F5C\u76EE\u5F55",
@@ -20443,10 +20975,18 @@ async function patchHermesMemoryEnv(profileName, patch) {
 }
 function isMemoryEnvKeyWritable(key) {
   return [
+    "HONCHO_API_KEY",
+    "MEM0_API_KEY",
+    "HINDSIGHT_API_KEY",
+    "HINDSIGHT_LLM_API_KEY",
     "OPENVIKING_ENDPOINT",
+    "OPENVIKING_API_KEY",
     "OPENVIKING_ACCOUNT",
     "OPENVIKING_USER",
     "OPENVIKING_AGENT",
+    "SUPERMEMORY_API_KEY",
+    "BRV_API_KEY",
+    "RETAINDB_API_KEY",
     "RETAINDB_BASE_URL",
     "RETAINDB_PROJECT"
   ].includes(key);
@@ -20455,30 +20995,119 @@ function normalizeHindsightMode(value) {
   const mode = readString15(value) ?? "cloud";
   return mode === "local" ? "local_embedded" : mode;
 }
-async function readActiveMemoryProvider(profileName) {
-  const raw = await readFile14(
-    resolveHermesConfigPath(profileName),
-    "utf8"
-  ).catch((error) => {
-    if (isNodeError16(error, "ENOENT")) {
-      return "";
-    }
-    throw error;
-  });
-  const config = raw ? toRecord14(YAML4.parse(raw)) : {};
-  const memory = toRecord14(config.memory);
-  const provider = readString15(memory.provider);
-  if (!provider || provider === "built-in" || provider === "builtin" || provider === "built_in") {
+function normalizeHttpUrl(value) {
+  try {
+    const url = new URL(value);
+    return url.protocol === "http:" || url.protocol === "https:" ? url : null;
+  } catch {
     return null;
   }
-  return provider;
 }
-async function patchJsonProviderConfig(profileName, relativePath, patch) {
-  const configPath = path21.join(
-    resolveHermesProfileDir(profileName),
-    relativePath
-  );
-  const current = await readJsonObject(configPath);
+function hindsightRequestHeaders(apiKey) {
+  const headers = { accept: "application/json" };
+  if (isConfiguredEnvValue(apiKey)) {
+    const secret = String(apiKey).trim();
+    headers.authorization = `Bearer ${secret}`;
+    headers["x-api-key"] = secret;
+  }
+  return headers;
+}
+async function probeHindsightJson(baseUrl, pathName, headers) {
+  const url = joinHindsightUrl(baseUrl, pathName);
+  const controller = new AbortController();
+  const timer = setTimeout(
+    () => controller.abort(),
+    MEMORY_PROVIDER_TEST_TIMEOUT_MS
+  );
+  try {
+    const response = await fetch(url, {
+      headers,
+      signal: controller.signal
+    });
+    const text = await response.text();
+    const json = parseJsonObject2(text);
+    if (!response.ok) {
+      return {
+        ok: false,
+        detail: `HTTP ${response.status}${readHindsightError(json)}`
+      };
+    }
+    const semanticIssue = hindsightSemanticIssue(pathName, json);
+    if (semanticIssue) {
+      return { ok: false, detail: semanticIssue };
+    }
+    return { ok: true, detail: summarizeHindsightProbe(pathName, json) };
+  } catch (error) {
+    return {
+      ok: false,
+      detail: error instanceof Error && error.name === "AbortError" ? "\u8BF7\u6C42\u8D85\u65F6" : error instanceof Error ? error.message : "\u8BF7\u6C42\u5931\u8D25"
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function joinHindsightUrl(baseUrl, pathName) {
+  const base = new URL(baseUrl.toString());
+  if (!base.pathname.endsWith("/")) {
+    base.pathname = `${base.pathname}/`;
+  }
+  return new URL(pathName.replace(/^\/+/u, ""), base);
+}
+function parseJsonObject2(text) {
+  try {
+    return toRecord14(JSON.parse(text));
+  } catch {
+    return {};
+  }
+}
+function readHindsightError(json) {
+  const detail = readString15(json.detail) ?? readString15(json.error);
+  return detail ? `\uFF1A${detail}` : "";
+}
+function hindsightSemanticIssue(pathName, json) {
+  if (pathName === "/health") {
+    const status = readString15(json.status);
+    return status && ["healthy", "ok"].includes(status.toLowerCase()) ? null : `\u5065\u5EB7\u72B6\u6001\u5F02\u5E38\uFF1A${status ?? "unknown"}`;
+  }
+  return null;
+}
+function summarizeHindsightProbe(pathName, json) {
+  if (pathName === "/health") {
+    const status = readString15(json.status) ?? "ok";
+    const database = readString15(json.database);
+    return database ? `${status}, database ${database}` : status;
+  }
+  if (pathName === "/version") {
+    const version = readString15(json.api_version);
+    return version ? `API ${version}` : "version endpoint reachable";
+  }
+  const bankId = readString15(json.bank_id);
+  return bankId ? `bank ${bankId} reachable` : "bank config reachable";
+}
+async function readActiveMemoryProvider(profileName) {
+  const raw = await readFile14(
+    resolveHermesConfigPath(profileName),
+    "utf8"
+  ).catch((error) => {
+    if (isNodeError16(error, "ENOENT")) {
+      return "";
+    }
+    throw error;
+  });
+  const config = raw ? toRecord14(YAML4.parse(raw)) : {};
+  const memory = toRecord14(config.memory);
+  const provider = readString15(memory.provider);
+  if (!provider || provider === "built-in" || provider === "builtin" || provider === "built_in") {
+    return null;
+  }
+  return provider;
+}
+async function patchJsonProviderConfig(profileName, relativePath, patch) {
+  const configPath = path21.join(
+    resolveHermesProfileDir(profileName),
+    relativePath
+  );
+  const current = await readJsonObject(configPath);
   const next = { ...current };
   for (const [key, value] of Object.entries(patch)) {
     if (value !== void 0) {
@@ -20529,6 +21158,16 @@ function stringSetting(key, label, value, editable = true) {
     kind: "string"
   };
 }
+function secretSetting(key, label, value, configured) {
+  return {
+    key,
+    label,
+    value: "",
+    editable: true,
+    kind: "secret",
+    configured: configured || isConfiguredEnvValue(readString15(value))
+  };
+}
 function textSetting(key, label, value, editable = true) {
   return {
     key,
@@ -20752,6 +21391,23 @@ function registerProfileMemoryRoutes(router, options) {
       }
     }
   );
+  router.post(
+    "/api/v1/profiles/:name/memory/providers/:provider/test",
+    async (ctx) => {
+      await authenticateRequest(ctx, paths);
+      const body = await readJsonBody(ctx.req);
+      await getHermesProfileStatus(ctx.params.name, paths);
+      try {
+        ctx.body = await testHermesMemoryProviderSettings(
+          ctx.params.name,
+          ctx.params.provider,
+          readMemorySettingsPatch(body)
+        );
+      } catch (error) {
+        throw toMemoryHttpError(error);
+      }
+    }
+  );
 }
 function readMemoryTarget(body) {
   const raw = readString14(body, "target");
@@ -20818,6 +21474,10 @@ function readMemorySettingsPatch(body) {
   if (apiUrl !== void 0) {
     input.apiUrl = apiUrl;
   }
+  const apiKey = readOptionalSecretString(body, "api_key", "apiKey");
+  if (apiKey !== void 0) {
+    input.apiKey = apiKey;
+  }
   const bankId = readOptionalString(body, "bank_id", "bankId");
   if (bankId !== void 0) {
     input.bankId = bankId;
@@ -20834,6 +21494,14 @@ function readMemorySettingsPatch(body) {
   if (llmBaseUrl !== void 0) {
     input.llmBaseUrl = llmBaseUrl;
   }
+  const llmApiKey = readOptionalSecretString(
+    body,
+    "llm_api_key",
+    "llmApiKey"
+  );
+  if (llmApiKey !== void 0) {
+    input.llmApiKey = llmApiKey;
+  }
   const containerTag = readOptionalString(body, "container_tag", "containerTag");
   if (containerTag !== void 0) {
     input.containerTag = containerTag;
@@ -21034,6 +21702,10 @@ function readOptionalString(body, ...keys) {
   }
   return void 0;
 }
+function readOptionalSecretString(body, ...keys) {
+  const value = readOptionalString(body, ...keys);
+  return value && value.trim().length > 0 ? value : void 0;
+}
 function toMemoryHttpError(error) {
   if (error instanceof HermesMemoryError) {
     return new LinkHttpError(400, error.code, error.message);
@@ -22277,1959 +22949,929 @@ function readString17(payload, key) {
 }
 
 // src/link/updates.ts
-import { spawn as spawn5 } from "child_process";
-import { EventEmitter as EventEmitter4 } from "events";
-import { mkdir as mkdir15, readFile as readFile18, rm as rm10 } from "fs/promises";
-import path25 from "path";
-
-// src/daemon/process.ts
 import { spawn as spawn4 } from "child_process";
-import { mkdir as mkdir14, readFile as readFile17, rm as rm9 } from "fs/promises";
+import { EventEmitter as EventEmitter4 } from "events";
+import { mkdir as mkdir13, readFile as readFile17, rm as rm8 } from "fs/promises";
 import path24 from "path";
-
-// src/daemon/service.ts
-import { createServer } from "http";
-import { mkdir as mkdir13, rm as rm8, writeFile as writeFile3 } from "fs/promises";
-
-// src/relay/control-client.ts
-import WebSocket from "ws";
-var RELAY_SSE_BATCH_FLUSH_INTERVAL_MS = 50;
-var RELAY_SSE_BATCH_FLUSH_BYTES = 2 * 1024;
-function connectRelayControl(options) {
-  const wsUrl = new URL(`${options.relayBaseUrl.replace(/\/+$/u, "")}/api/v1/relay/link/connect`);
-  wsUrl.protocol = wsUrl.protocol === "https:" ? "wss:" : "ws:";
-  wsUrl.searchParams.set("link_id", options.linkId);
-  const maxReconnectAttempts = options.maxReconnectAttempts ?? 5;
-  const backoffBaseMs = options.backoffBaseMs ?? 1e3;
-  const backoffMaxMs = options.backoffMaxMs ?? 3e4;
-  let reconnectAttempts = 0;
-  let closedByUser = false;
-  let socket = null;
-  let retryTimer = null;
-  let abortControllers = /* @__PURE__ */ new Map();
-  let fatalRelayRejection = null;
-  let latestNetworkRoutes = null;
-  const connect = () => {
-    options.onStatus?.({ state: "connecting", attempt: reconnectAttempts });
-    fatalRelayRejection = null;
-    socket = new WebSocket(wsUrl, {
-      headers: {
-        "x-hermes-link-version": LINK_VERSION
-      }
-    });
-    socket.on("open", () => {
-      reconnectAttempts = 0;
-      options.onStatus?.({ state: "connected", attempt: reconnectAttempts });
-      const currentSocket = socket;
-      if (currentSocket && latestNetworkRoutes) {
-        sendNetworkRoutes(currentSocket, options.linkId, latestNetworkRoutes);
-      }
-    });
-    socket.on("message", (raw) => {
-      if (!socket || typeof raw !== "string" && !Buffer.isBuffer(raw)) {
-        return;
-      }
-      void handleFrame(socket, String(raw), options.localPort, abortControllers).catch((error) => {
-        const message = error instanceof Error ? error.message : "Relay request failed";
-        socket?.send(JSON.stringify({ type: "http.error", id: "unknown", status: 502, message }));
-      });
-    });
-    socket.on("error", (error) => {
-      const message = error instanceof Error ? error.message : "Relay websocket error";
-      fatalRelayRejection = resolveFatalRelayRejection(message);
-      options.onStatus?.({
-        state: "disconnected",
-        attempt: reconnectAttempts,
-        message: fatalRelayRejection ?? message
-      });
-    });
-    socket.on("close", () => {
-      abortAll(abortControllers);
-      abortControllers = /* @__PURE__ */ new Map();
-      if (fatalRelayRejection) {
-        options.onStatus?.({
-          state: "failed",
-          attempt: reconnectAttempts,
-          message: fatalRelayRejection
-        });
-        return;
-      }
-      if (closedByUser) {
-        options.onStatus?.({ state: "disconnected", attempt: reconnectAttempts });
-        return;
-      }
-      if (reconnectAttempts >= maxReconnectAttempts) {
-        options.onStatus?.({ state: "failed", attempt: reconnectAttempts, message: "Relay reconnect attempts exhausted" });
-        return;
-      }
-      reconnectAttempts += 1;
-      const delay3 = computeBackoffMs(reconnectAttempts, backoffBaseMs, backoffMaxMs);
-      options.onStatus?.({ state: "retrying", attempt: reconnectAttempts, message: `Retrying in ${delay3}ms` });
-      retryTimer = setTimeout(connect, delay3);
-      retryTimer.unref?.();
-    });
-  };
-  connect();
+var SERVER_LINK_CURRENT_RELEASE_PATH = "/api/v1/link/releases/current";
+var LINK_NPM_PACKAGE = "@hermespilot/link";
+var OFFICIAL_INSTALLER_BASE_URL = "https://raw.githubusercontent.com/HangbinYang/hermespilot-install/main";
+var OFFICIAL_UNIX_INSTALLER_URL = `${OFFICIAL_INSTALLER_BASE_URL}/install.sh`;
+var OFFICIAL_WINDOWS_INSTALLER_URL = `${OFFICIAL_INSTALLER_BASE_URL}/install.ps1`;
+var UPDATE_LOG_FILE2 = "link-update.log";
+var UPDATE_LOG_MAX_FILES2 = 3;
+var UPDATE_FETCH_TIMEOUT_MS = 5e3;
+var MAX_UPDATE_LOG_LINES2 = 240;
+var MAX_OUTPUT_LINE_LENGTH3 = 1200;
+var updateEvents2 = new EventEmitter4();
+var runningUpdate2 = null;
+async function readLinkUpdateCheck(options) {
+  const remoteResult = await readRemoteLinkPolicy(options);
+  const remote = remoteResult.remote;
+  const state = computeLinkUpdateState(LINK_VERSION, remote);
+  const targetVersion = remote?.target_version ?? null;
   return {
-    publishNetworkRoutes(routes) {
-      latestNetworkRoutes = routes;
-      if (socket?.readyState === WebSocket.OPEN) {
-        sendNetworkRoutes(socket, options.linkId, routes);
-      }
+    ok: true,
+    local: {
+      version: LINK_VERSION,
+      raw: LINK_VERSION
     },
-    close() {
-      closedByUser = true;
-      if (retryTimer) {
-        clearTimeout(retryTimer);
-        retryTimer = null;
-      }
-      abortAll(abortControllers);
-      socket?.terminate();
+    remote,
+    state,
+    update_available: state === "update_available" || state === "unsafe" || state === "blocked",
+    unsafe: state === "unsafe",
+    blocked: state === "blocked",
+    check_state: remoteResult.state,
+    issue: remoteResult.issue,
+    manual: {
+      command: targetVersion ? manualInstallCommand(targetVersion) : null,
+      package: LINK_NPM_PACKAGE,
+      version: targetVersion
     }
   };
 }
-function sendNetworkRoutes(socket, linkId, routes) {
-  socket.send(JSON.stringify({
-    type: "network.routes",
-    id: `routes_${Date.now().toString(36)}`,
-    payload: {
-      link_id: linkId,
-      lan_ips: routes.lanIps,
-      public_ipv4s: routes.publicIpv4s,
-      public_ipv6s: routes.publicIpv6s,
-      observed_at: (/* @__PURE__ */ new Date()).toISOString()
-    }
-  }));
-}
-function resolveFatalRelayRejection(message) {
-  if (!/Unexpected server response:\s*(400|401|403|426)\b/u.test(message)) {
-    return null;
+async function startLinkUpdate(options) {
+  const current = await readLinkUpdateStatus(options.paths);
+  if (runningUpdate2 || current.state === "running") {
+    return current;
   }
-  return "Relay refused the Hermes Link connection. Check Link version and pairing state before retrying.";
-}
-function abortAll(abortControllers) {
-  for (const controller of abortControllers.values()) {
-    controller.abort();
+  const check = await readLinkUpdateCheck(options);
+  const targetVersion = check.remote?.target_version ?? null;
+  if (!targetVersion) {
+    return writeFailedStartState(
+      options,
+      "HermesPilot Server has no Link target version."
+    );
   }
-  abortControllers.clear();
-}
-function computeBackoffMs(attempt, baseMs, maxMs) {
-  const exponential = Math.min(maxMs, baseMs * 2 ** Math.max(0, attempt - 1));
-  const jitter = Math.floor(Math.random() * Math.min(1e3, exponential * 0.2));
-  return exponential + jitter;
-}
-async function handleFrame(socket, raw, localPort, abortControllers) {
-  const frame = JSON.parse(raw);
-  if (frame.type === "http.cancel") {
-    abortControllers.get(frame.id)?.abort();
-    abortControllers.delete(frame.id);
-    return;
+  if (!isValidReleaseVersion(targetVersion)) {
+    return writeFailedStartState(
+      options,
+      `HermesPilot Server returned invalid Link target version: ${targetVersion}.`,
+      targetVersion
+    );
   }
-  if (frame.type !== "http.request") {
-    return;
+  if (options.targetVersion && options.targetVersion !== targetVersion) {
+    return writeFailedStartState(
+      options,
+      `Requested target ${options.targetVersion} does not match current Link target ${targetVersion}.`,
+      targetVersion
+    );
   }
-  const abortController = new AbortController();
-  abortControllers.set(frame.id, abortController);
-  let sseBatcher = null;
-  try {
-    const response = await fetch(`http://127.0.0.1:${localPort}${frame.path}`, {
-      method: frame.method,
-      headers: frame.headers ?? {},
-      body: frame.bodyBase64 ? Buffer.from(frame.bodyBase64, "base64") : void 0,
-      signal: abortController.signal
-    });
-    const headers = Object.fromEntries(response.headers.entries());
-    const contentType = response.headers.get("content-type") ?? "";
-    if (response.body && contentType.includes("text/event-stream")) {
-      socket.send(JSON.stringify({ type: "http.stream.start", id: frame.id, status: response.status, headers }));
-      sseBatcher = createRelayStreamChunkBatcher(socket, frame.id);
-      const reader = response.body.getReader();
-      while (true) {
-        const next = await reader.read();
-        if (next.done) {
-          break;
-        }
-        sseBatcher.push(next.value);
-      }
-      sseBatcher.flush();
-      socket.send(JSON.stringify({ type: "http.stream.end", id: frame.id }));
-      return;
-    }
-    const body = Buffer.from(await response.arrayBuffer()).toString("base64");
-    socket.send(JSON.stringify({ type: "http.response", id: frame.id, status: response.status, headers, bodyBase64: body }));
-  } catch (error) {
-    if (abortController.signal.aborted || isAbortError2(error)) {
-      return;
-    }
-    sseBatcher?.flush();
-    const message = error instanceof Error ? error.message : "Relay request failed";
-    socket.send(JSON.stringify({ type: "http.error", id: frame.id, status: 502, message }));
-  } finally {
-    sseBatcher?.dispose();
-    abortControllers.delete(frame.id);
+  if (check.state === "current") {
+    return writeFailedStartState(
+      options,
+      "Hermes Link is already on the current version.",
+      targetVersion
+    );
   }
-}
-function isAbortError2(error) {
-  return typeof error === "object" && error !== null && "name" in error && error.name === "AbortError";
-}
-function createRelayStreamChunkBatcher(socket, id) {
-  let chunks = [];
-  let totalBytes = 0;
-  let flushTimer = null;
-  const clearFlushTimer = () => {
-    if (flushTimer == null) {
-      return;
-    }
-    clearTimeout(flushTimer);
-    flushTimer = null;
-  };
-  const flush = () => {
-    clearFlushTimer();
-    if (totalBytes <= 0) {
-      return;
-    }
-    const bodyBase64 = Buffer.concat(chunks, totalBytes).toString("base64");
-    chunks = [];
-    totalBytes = 0;
-    if (socket.readyState !== WebSocket.OPEN) {
-      return;
-    }
-    socket.send(JSON.stringify({ type: "http.stream.chunk", id, bodyBase64 }));
-  };
-  const scheduleFlush = () => {
-    if (flushTimer != null) {
-      return;
-    }
-    flushTimer = setTimeout(() => {
-      flushTimer = null;
-      flush();
-    }, RELAY_SSE_BATCH_FLUSH_INTERVAL_MS);
-    flushTimer.unref?.();
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  const jobId = `link_update_${now().getTime().toString(36)}`;
+  await clearUpdateLogFiles2(options.paths);
+  const writer = createRotatingTextLogWriter({
+    paths: options.paths,
+    fileName: UPDATE_LOG_FILE2,
+    maxFileBytes: 512 * 1024,
+    maxFiles: UPDATE_LOG_MAX_FILES2
+  });
+  const startedAt = now().toISOString();
+  const installCommand = buildOfficialInstallCommand(targetVersion);
+  const manualCommand = installCommand.displayCommand;
+  const started = {
+    state: "running",
+    job_id: jobId,
+    pid: null,
+    target_version: targetVersion,
+    started_at: startedAt,
+    finished_at: null,
+    exit_code: null,
+    signal: null,
+    error: null,
+    manual_command: manualCommand
   };
-  return {
-    push(chunk) {
-      if (chunk.byteLength <= 0) {
-        return;
-      }
-      const buffer = Buffer.from(chunk);
-      chunks.push(buffer);
-      totalBytes += buffer.byteLength;
-      if (totalBytes >= RELAY_SSE_BATCH_FLUSH_BYTES) {
-        flush();
-        return;
-      }
-      scheduleFlush();
-    },
-    flush,
-    dispose() {
-      clearFlushTimer();
-      chunks = [];
-      totalBytes = 0;
-    }
+  await mkdir13(options.paths.runDir, { recursive: true, mode: 448 });
+  await writer.write(
+    `
+=== link update started ${startedAt} target=${targetVersion} ===
+`
+  );
+  await writer.write(`$ ${manualCommand}
+`);
+  await writeUpdateState2(options.paths, started);
+  const child = spawnInstallCommand(installCommand);
+  started.pid = child.pid ?? null;
+  await writeUpdateState2(options.paths, started);
+  const appendChunk = async (chunk) => {
+    await writer.write(chunk);
+    await emitUpdateStatus2(options.paths);
   };
-}
-
-// src/runtime/system-info.ts
-import { execFileSync } from "child_process";
-import { readFileSync } from "fs";
-import os4 from "os";
-function readLinkSystemInfo() {
-  const platform = process.platform;
-  const hostname = readHostname(platform);
-  const osLabel = readOsLabel(platform);
-  const defaultDisplayName = buildDefaultDisplayName({ hostname, osLabel, platform });
-  return {
-    platform,
-    hostname,
-    osLabel,
-    defaultDisplayName
-  };
-}
-function buildDefaultDisplayName(input) {
-  const hostname = normalizeText(input.hostname);
-  const osLabel = normalizeText(input.osLabel);
-  if (hostname) {
-    return truncateText(hostname, 128);
-  }
-  return truncateText(hostname ?? osLabel ?? `Hermes Link ${input.platform}`, 128);
-}
-function parseLinuxOsRelease(content) {
-  const values = /* @__PURE__ */ new Map();
-  for (const line of content.split(/\r?\n/u)) {
-    const match = /^([A-Z0-9_]+)=(.*)$/u.exec(line.trim());
-    if (!match) {
-      continue;
-    }
-    values.set(match[1], unquoteOsReleaseValue(match[2]));
-  }
-  return normalizeText(values.get("PRETTY_NAME")) ?? buildLinuxName(values);
-}
-function readHostname(platform) {
-  if (platform === "darwin") {
-    const computerName = readCommandOutput("scutil", ["--get", "ComputerName"]);
-    if (computerName) {
-      return computerName;
-    }
-  }
-  return normalizeText(os4.hostname());
-}
-function readOsLabel(platform) {
-  if (platform === "darwin") {
-    const version = readCommandOutput("sw_vers", ["-productVersion"]);
-    return version ? `macOS ${version}` : "macOS";
-  }
-  if (platform === "linux") {
-    return readLinuxOsRelease() ?? `Linux ${os4.release()}`;
-  }
-  if (platform === "win32") {
-    return `Windows ${os4.release()}`;
-  }
-  return `${os4.type()} ${os4.release()}`.trim();
-}
-function readLinuxOsRelease() {
-  for (const file of ["/etc/os-release", "/usr/lib/os-release"]) {
-    try {
-      return parseLinuxOsRelease(readFileSync(file, "utf8"));
-    } catch {
-    }
-  }
-  return null;
-}
-function readCommandOutput(command, args) {
-  try {
-    const output = execFileSync(command, args, {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"],
-      timeout: 1e3
-    });
-    return normalizeText(output);
-  } catch {
-    return null;
-  }
-}
-function buildLinuxName(values) {
-  const name = normalizeText(values.get("NAME"));
-  const version = normalizeText(values.get("VERSION_ID")) ?? normalizeText(values.get("VERSION"));
-  if (name && version) {
-    return `${name} ${version}`;
-  }
-  return name ?? version;
-}
-function unquoteOsReleaseValue(value) {
-  const trimmed = value.trim();
-  if (trimmed.length >= 2 && (trimmed.startsWith('"') && trimmed.endsWith('"') || trimmed.startsWith("'") && trimmed.endsWith("'"))) {
-    return trimmed.slice(1, -1).replace(/\\(["'`$\\])/gu, "$1");
-  }
-  return trimmed;
-}
-function normalizeText(value) {
-  const normalized = value?.replace(/\s+/gu, " ").trim();
-  return normalized ? normalized : null;
-}
-function truncateText(value, maxLength) {
-  return value.length > maxLength ? value.slice(0, maxLength).trimEnd() : value;
-}
-
-// src/topology/network.ts
-import os6 from "os";
-
-// src/topology/environment.ts
-import { existsSync, readFileSync as readFileSync2 } from "fs";
-import os5 from "os";
-function detectRuntimeEnvironment(env = process.env) {
-  if (isWsl(env)) {
-    return {
-      kind: "wsl",
-      lanAutoDiscoveryUsable: false,
-      warning: "Detected WSL. The LAN IP found inside WSL is usually a private VM address and is not reachable from your phone. Use Relay or set `hermeslink config set lan-host <Windows LAN IP>`."
-    };
-  }
-  if (isContainer(env)) {
-    return {
-      kind: "container",
-      lanAutoDiscoveryUsable: false,
-      warning: "Detected a container environment. Container LAN IPs are usually not reachable from your phone. Use Relay or set `hermeslink config set lan-host <host LAN IP>`."
-    };
-  }
-  return {
-    kind: "native",
-    lanAutoDiscoveryUsable: true,
-    warning: null
-  };
-}
-function isWsl(env) {
-  if (process.platform !== "linux") {
-    return false;
-  }
-  if (env.WSL_DISTRO_NAME || env.WSL_INTEROP) {
-    return true;
-  }
-  const release = os5.release().toLowerCase();
-  return release.includes("microsoft") || release.includes("wsl");
-}
-function isContainer(env) {
-  if (env.container || env.CONTAINER || env.KUBERNETES_SERVICE_HOST) {
-    return true;
-  }
-  if (existsSync("/.dockerenv")) {
-    return true;
-  }
-  try {
-    const cgroup = readFileSync2("/proc/1/cgroup", "utf8").toLowerCase();
-    return /docker|containerd|kubepods|libpod|podman/u.test(cgroup);
-  } catch {
-    return false;
-  }
-}
-
-// src/topology/network.ts
-var VIRTUAL_INTERFACE_NAME_PATTERN = /(docker|veth|vmnet|vmenet|vbox|virtualbox|vmware|tailscale|zerotier|wireguard|utun|virbr|hyper-v|vethernet|loopback|\blo\b|^lo\d*$|^br-|^bridge\d+$|^zt|^tun|^tap|awdl|llw|anpi|gif|stf|ipsec|ppp)/iu;
-var MAX_LAN_IPS = 4;
-var MAX_PUBLIC_IPV4S = 2;
-var MAX_PUBLIC_IPV6S = 2;
-async function discoverRouteCandidates(options) {
-  const environment = detectRuntimeEnvironment();
-  const configuredLanHost = normalizeLanHost(options.configuredLanHost);
-  const lanIps = configuredLanHost ? [configuredLanHost] : environment.lanAutoDiscoveryUsable ? discoverLanIps() : [];
-  const publicIps = options.relayBootstrapToken || options.observePublicRoute ? await observePublicRoute(options).catch(() => ({ publicIpv4s: [], publicIpv6s: [] })) : { publicIpv4s: [], publicIpv6s: [] };
-  const publicIpv4s = unique(publicIps.publicIpv4s.filter(isUsablePublicIpv4)).slice(0, MAX_PUBLIC_IPV4S);
-  const publicIpv6s = unique(publicIps.publicIpv6s.filter(isUsablePublicIpv6)).slice(0, MAX_PUBLIC_IPV6S);
-  const preferredUrls = [
-    ...lanIps.map((ip) => buildDirectUrl(ip, options.port)),
-    ...publicIpv4s.map((ip) => buildDirectUrl(ip, options.port)),
-    ...publicIpv6s.map((ip) => buildDirectUrl(ip, options.port)),
-    `${options.relayBaseUrl.replace(/\/+$/u, "")}/api/v1/relay/links/${options.linkId}`
-  ];
-  return {
-    lanIps,
-    publicIpv4s,
-    publicIpv6s,
-    preferredUrls,
-    environment
-  };
-}
-function discoverLanIps() {
-  return discoverLanIpsFromInterfaces(os6.networkInterfaces());
-}
-function discoverLanIpsFromInterfaces(interfaces) {
-  const result = /* @__PURE__ */ new Set();
-  const candidates = [];
-  for (const [name, items] of Object.entries(interfaces)) {
-    if (shouldIgnoreInterface(name)) {
-      continue;
-    }
-    for (const item of items ?? []) {
-      if (!item.internal && item.address && item.family === "IPv4" && isUsableLanIpv42(item.address, item.netmask)) {
-        candidates.push({ name, address: item.address });
-      }
-    }
-  }
-  for (const candidate of candidates.sort(compareLanCandidate)) {
-    result.add(candidate.address);
-  }
-  return [...result].slice(0, MAX_LAN_IPS);
-}
-async function observePublicRoute(options) {
-  const fetcher = options.fetchImpl ?? fetch;
-  const response = await fetcher(`${options.relayBaseUrl.replace(/\/+$/u, "")}/api/v1/relay/public-route/observe`, {
-    method: "POST",
-    headers: {
-      "content-type": "application/json",
-      ...options.relayBootstrapToken ? { authorization: `Bearer ${options.relayBootstrapToken}` } : {}
-    },
-    body: JSON.stringify({
-      install_id: options.installId,
-      link_id: options.linkId,
-      public_key_pem: options.publicKeyPem
-    })
-  });
-  const payload = await response.json().catch(() => null);
-  const record = typeof payload?.record === "object" && payload.record !== null ? payload.record : null;
-  const observed = typeof payload?.observed === "object" && payload.observed !== null ? payload.observed : null;
-  const values = [
-    readIpRecord(record?.ipv4),
-    readIpRecord(record?.ipv6),
-    typeof observed?.ip === "string" ? observed.ip : null
-  ].filter((value) => Boolean(value));
-  return {
-    publicIpv4s: unique(values.filter(isUsablePublicIpv4)),
-    publicIpv6s: unique(values.filter(isUsablePublicIpv6))
-  };
-}
-function readIpRecord(value) {
-  if (typeof value !== "object" || value === null) {
-    return null;
-  }
-  const ip = value.ip;
-  return typeof ip === "string" && ip.trim() ? ip.trim() : null;
-}
-function buildDirectUrl(ip, port) {
-  return `http://${ip.includes(":") ? `[${ip}]` : ip}:${port}`;
-}
-function shouldIgnoreInterface(name) {
-  return !name.trim() || VIRTUAL_INTERFACE_NAME_PATTERN.test(name);
-}
-function compareLanCandidate(left, right) {
-  const priority = interfacePriority(left.name) - interfacePriority(right.name);
-  return priority || left.name.localeCompare(right.name) || left.address.localeCompare(right.address);
-}
-function interfacePriority(name) {
-  if (/^(en|eth|wlan|wi-fi|wifi)/iu.test(name)) {
-    return 0;
-  }
-  return 1;
-}
-function isUsableLanIpv42(address, netmask) {
-  return isPrivateIpv4(address) && !isNetworkOrBroadcastIpv4Address(address, netmask);
-}
-function isUsablePublicIpv4(address) {
-  return isValidIpv4(address) && !isSpecialIpv4(address);
-}
-function isUsablePublicIpv6(address) {
-  const normalized = address.toLowerCase();
-  return normalized.includes(":") && !normalized.startsWith("fe80:") && !normalized.startsWith("fc") && !normalized.startsWith("fd") && !normalized.startsWith("ff") && normalized !== "::" && normalized !== "::1";
-}
-function isPrivateIpv4(address) {
-  const parts = parseIpv4Segments(address);
-  if (!parts) {
-    return false;
-  }
-  const [first, second] = parts;
-  return first === 10 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168;
-}
-function isSpecialIpv4(address) {
-  const parts = parseIpv4Segments(address);
-  if (!parts) {
-    return true;
-  }
-  const [first, second, third, fourth] = parts;
-  return first === 0 || first === 10 || first === 127 || first >= 224 || first === 100 && second >= 64 && second <= 127 || first === 169 && second === 254 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168 || first === 192 && second === 0 && third === 2 || first === 198 && (second === 18 || second === 19) || first === 198 && second === 51 && third === 100 || first === 203 && second === 0 && third === 113 || first === 255 && second === 255 && third === 255 && fourth === 255;
-}
-function isNetworkOrBroadcastIpv4Address(address, netmask) {
-  const addressParts = parseIpv4Segments(address);
-  const netmaskParts = netmask ? parseIpv4Segments(netmask) : null;
-  if (!addressParts) {
-    return true;
-  }
-  if (!netmaskParts) {
-    const last = addressParts[3];
-    return last === 0 || last === 255;
-  }
-  const addressInt = ipv4SegmentsToInt(addressParts);
-  const netmaskInt = ipv4SegmentsToInt(netmaskParts);
-  const hostMask = ~netmaskInt >>> 0;
-  if (hostMask === 0) {
-    return false;
-  }
-  const networkInt = addressInt & netmaskInt;
-  const broadcastInt = (networkInt | hostMask) >>> 0;
-  return addressInt === networkInt || addressInt === broadcastInt;
-}
-function isValidIpv4(address) {
-  return Boolean(parseIpv4Segments(address));
-}
-function parseIpv4Segments(address) {
-  if (!/^\d{1,3}(?:\.\d{1,3}){3}$/u.test(address)) {
-    return null;
-  }
-  const parts = address.split(".").map((part) => Number.parseInt(part, 10));
-  if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {
-    return null;
-  }
-  return parts;
-}
-function ipv4SegmentsToInt(parts) {
-  return (parts[0] << 24 >>> 0 | parts[1] << 16 | parts[2] << 8 | parts[3]) >>> 0;
-}
-function unique(values) {
-  return [...new Set(values)];
-}
-
-// src/link/network-report-state.ts
-var DEFAULT_AUTO_DAILY_LIMIT = 20;
-async function readNetworkReportState(paths) {
-  const state = await readLinkState(paths);
-  return normalizeNetworkReportState(state.networkReport);
-}
-async function markNetworkStatusReported(paths, snapshotInput, reportedAt = /* @__PURE__ */ new Date()) {
-  const snapshot = normalizeNetworkSnapshot(snapshotInput);
-  await updateNetworkReportState(paths, (current) => ({
-    ...current,
-    lastReportedLanIps: snapshot.lanIps,
-    lastReportedPublicIpv4s: snapshot.publicIpv4s,
-    lastReportedPublicIpv6s: snapshot.publicIpv6s,
-    lastReportedAt: reportedAt.toISOString(),
-    lastAutoAttempt: current.lastAutoAttempt ? { ...current.lastAutoAttempt, ...snapshot, success: true } : null
-  }));
-}
-async function reserveAutomaticNetworkReport(paths, snapshotInput, options = {}) {
-  const snapshot = normalizeNetworkSnapshot(snapshotInput);
-  const now = options.now ?? /* @__PURE__ */ new Date();
-  const dailyLimit = Math.max(0, Math.floor(options.dailyLimit ?? DEFAULT_AUTO_DAILY_LIMIT));
-  let reservation = { allowed: false, reason: "unchanged" };
-  await updateNetworkReportState(paths, (current) => {
-    if (sameNetworkSnapshot(readReportedSnapshot(current), snapshot)) {
-      const lastReportedAt = current.lastReportedAt ? Date.parse(current.lastReportedAt) : Number.NaN;
-      const unchangedMinIntervalMs = Math.max(0, Math.floor(options.unchangedMinIntervalMs ?? 0));
-      if (!options.force || Number.isFinite(lastReportedAt) && now.getTime() - lastReportedAt < unchangedMinIntervalMs) {
-        reservation = { allowed: false, reason: "unchanged" };
-        return current;
-      }
-    }
-    if (current.lastAutoAttempt && !current.lastAutoAttempt.success && sameNetworkSnapshot(readAttemptSnapshot(current.lastAutoAttempt), snapshot)) {
-      reservation = { allowed: false, reason: "failed_snapshot_not_retried" };
-      return current;
-    }
-    const quotaDay = formatUtcDay(now);
-    const reportsToday = current.autoQuotaDay === quotaDay ? current.autoReportsToday : 0;
-    if (reportsToday >= dailyLimit) {
-      reservation = { allowed: false, reason: "daily_limit_reached" };
-      return current;
-    }
-    reservation = { allowed: true };
-    return {
-      ...current,
-      autoQuotaDay: quotaDay,
-      autoReportsToday: reportsToday + 1,
-      lastAutoAttempt: {
-        ...snapshot,
-        attemptedAt: now.toISOString(),
-        success: false
-      }
-    };
-  });
-  return reservation;
-}
-async function mergeLastReportedPublicRoutes(paths, snapshotInput) {
-  const state = await readNetworkReportState(paths);
-  return {
-    ...snapshotInput,
-    publicIpv4s: uniqueStrings([
-      ...snapshotInput.publicIpv4s,
-      ...state.lastReportedPublicIpv4s
-    ]).slice(0, 2),
-    publicIpv6s: uniqueStrings([
-      ...snapshotInput.publicIpv6s,
-      ...state.lastReportedPublicIpv6s
-    ]).slice(0, 2)
-  };
-}
-async function updateNetworkReportState(paths, update) {
-  const state = await readLinkState(paths);
-  const next = {
-    ...state,
-    networkReport: update(normalizeNetworkReportState(state.networkReport))
-  };
-  await writeJsonFile(paths.stateFile, next);
-}
-async function readLinkState(paths) {
-  const state = await readJsonFile(paths.stateFile);
-  return state && typeof state === "object" ? state : {};
-}
-function normalizeNetworkReportState(value) {
-  const record = value && typeof value === "object" ? value : {};
-  return {
-    lastReportedLanIps: normalizeLanIps(record.lastReportedLanIps),
-    lastReportedPublicIpv4s: normalizeLanIps(record.lastReportedPublicIpv4s),
-    lastReportedPublicIpv6s: normalizeLanIps(record.lastReportedPublicIpv6s),
-    lastReportedAt: typeof record.lastReportedAt === "string" ? record.lastReportedAt : null,
-    autoQuotaDay: typeof record.autoQuotaDay === "string" ? record.autoQuotaDay : null,
-    autoReportsToday: Number.isFinite(record.autoReportsToday) ? Math.max(0, Math.floor(record.autoReportsToday ?? 0)) : 0,
-    lastAutoAttempt: normalizeAttempt(record.lastAutoAttempt)
-  };
-}
-function normalizeAttempt(value) {
-  if (!value || typeof value !== "object") {
-    return null;
-  }
-  const record = value;
-  if (typeof record.attemptedAt !== "string") {
-    return null;
-  }
-  return {
-    lanIps: normalizeLanIps(record.lanIps),
-    publicIpv4s: normalizeLanIps(record.publicIpv4s),
-    publicIpv6s: normalizeLanIps(record.publicIpv6s),
-    attemptedAt: record.attemptedAt,
-    success: record.success === true
-  };
-}
-function normalizeNetworkSnapshot(value) {
-  if (Array.isArray(value)) {
-    return {
-      lanIps: normalizeLanIps(value),
-      publicIpv4s: [],
-      publicIpv6s: []
-    };
-  }
-  const record = value && typeof value === "object" ? value : {};
-  return {
-    lanIps: normalizeLanIps(record.lanIps),
-    publicIpv4s: normalizeLanIps(record.publicIpv4s),
-    publicIpv6s: normalizeLanIps(record.publicIpv6s)
-  };
-}
-function readReportedSnapshot(state) {
-  return {
-    lanIps: state.lastReportedLanIps,
-    publicIpv4s: state.lastReportedPublicIpv4s,
-    publicIpv6s: state.lastReportedPublicIpv6s
-  };
-}
-function readAttemptSnapshot(attempt) {
-  return {
-    lanIps: attempt.lanIps,
-    publicIpv4s: attempt.publicIpv4s,
-    publicIpv6s: attempt.publicIpv6s
-  };
-}
-function normalizeLanIps(value) {
-  if (!Array.isArray(value)) {
-    return [];
-  }
-  return [
-    ...new Set(
-      value.filter((item) => typeof item === "string" && item.trim().length > 0).map((item) => item.trim())
-    )
-  ];
-}
-function sameNetworkSnapshot(left, right) {
-  return sameStringList(left.lanIps, right.lanIps) && sameStringList(left.publicIpv4s, right.publicIpv4s) && sameStringList(left.publicIpv6s, right.publicIpv6s);
-}
-function sameStringList(left, right) {
-  if (left.length !== right.length) {
-    return false;
-  }
-  return left.every((value, index) => value === right[index]);
-}
-function uniqueStrings(values) {
-  return [...new Set(values)];
-}
-function formatUtcDay(date) {
-  return date.toISOString().slice(0, 10);
-}
-
-// src/link/server-report.ts
-async function reportLinkStatusToServer(options = {}) {
-  const paths = options.paths ?? resolveRuntimePaths();
-  const [identity, config] = await Promise.all([loadIdentity(paths), loadConfig(paths)]);
-  if (!identity?.link_id) {
-    return null;
-  }
-  const discoveredRoutes = options.routes ?? await discoverRouteCandidates({
-    port: config.port,
-    relayBaseUrl: config.relayBaseUrl,
-    linkId: identity.link_id,
-    installId: identity.install_id,
-    publicKeyPem: identity.public_key_pem,
-    observePublicRoute: true,
-    configuredLanHost: config.lanHost,
-    fetchImpl: options.fetchImpl
-  });
-  const routes = await mergeLastReportedPublicRoutes(paths, discoveredRoutes);
-  const systemInfo = readLinkSystemInfo();
-  const payload = {
-    type: "hermes_link_status_report",
-    link_id: identity.link_id,
-    install_id: identity.install_id,
-    link_version: LINK_VERSION,
-    display_name: systemInfo.defaultDisplayName,
-    platform: systemInfo.platform,
-    hostname: systemInfo.hostname ?? void 0,
-    lan_ips: routes.lanIps,
-    public_ipv4s: routes.publicIpv4s,
-    public_ipv6s: routes.publicIpv6s,
-    reported_at: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  const signature = signIdentityPayload(identity, canonicalJson(payload));
-  const fetcher = options.fetchImpl ?? fetch;
-  const response = await fetcher(
-    `${config.serverBaseUrl.replace(/\/+$/u, "")}/api/v1/links/${encodeURIComponent(identity.link_id)}/report`,
-    {
-      method: "POST",
-      headers: {
-        accept: "application/json",
-        "content-type": "application/json"
-      },
-      body: JSON.stringify({
-        ...payload,
-        public_key_pem: identity.public_key_pem,
-        signature
-      })
-    }
-  );
-  const body = await response.json().catch(() => null);
-  if (!response.ok || !body) {
-    const message = readErrorMessage3(body) ?? `HermesPilot Server request failed with HTTP ${response.status}`;
-    throw new LinkHttpError(response.status, "server_request_failed", message);
-  }
-  await markNetworkStatusReported(paths, routes);
-  return body;
-}
-function canonicalJson(value) {
-  return JSON.stringify(sortJsonValue(value));
-}
-function sortJsonValue(value) {
-  if (Array.isArray(value)) {
-    return value.map(sortJsonValue);
-  }
-  if (value && typeof value === "object") {
-    const record = value;
-    const sorted = {};
-    for (const key of Object.keys(record).sort()) {
-      sorted[key] = sortJsonValue(record[key]);
-    }
-    return sorted;
-  }
-  return value;
-}
-function readErrorMessage3(payload) {
-  if (typeof payload !== "object" || payload === null) {
-    return null;
-  }
-  const error = payload.error;
-  if (typeof error !== "object" || error === null) {
-    return null;
-  }
-  const message = error.message;
-  return typeof message === "string" ? message : null;
-}
-
-// src/daemon/lan-ip-monitor.ts
-var DEFAULT_INTERVAL_MS = 5 * 6e4;
-var DEFAULT_DAILY_REPORT_LIMIT = 20;
-var DEFAULT_STARTUP_REPORT_MIN_INTERVAL_MS = 15 * 6e4;
-function startLanIpMonitor(options) {
-  let running = false;
-  let closed = false;
-  let current = Promise.resolve();
-  const check = async (context = {}) => {
-    if (running || closed) {
-      return;
-    }
-    running = true;
-    try {
-      await checkLanIpChange(options, context);
-    } catch (error) {
-      void options.logger.warn("lan_ip_monitor_failed", {
-        error: error instanceof Error ? error.message : String(error)
-      });
-    } finally {
-      running = false;
-    }
-  };
-  current = check({ forceReport: true, publishToRelay: true, observePublicRoute: true });
-  const timer = setInterval(() => {
-    current = check({ observePublicRoute: false });
-  }, options.intervalMs ?? DEFAULT_INTERVAL_MS);
-  timer.unref?.();
-  return {
-    async refreshPublicRoutes() {
-      current = check({ forceReport: true, publishToRelay: true, observePublicRoute: true });
-      await current;
-    },
-    async close() {
-      closed = true;
-      clearInterval(timer);
-      await current.catch(() => void 0);
-    }
-  };
-}
-async function checkLanIpChange(options, context = {}) {
-  const [identity, config] = await Promise.all([
-    loadIdentity(options.paths),
-    loadConfig(options.paths)
-  ]);
-  if (!identity?.link_id) {
-    return;
-  }
-  const discoveredRoutes = await discoverRouteCandidates({
-    port: config.port,
-    relayBaseUrl: config.relayBaseUrl,
-    linkId: identity.link_id,
-    installId: identity.install_id,
-    publicKeyPem: identity.public_key_pem,
-    observePublicRoute: context.observePublicRoute === true,
-    configuredLanHost: config.lanHost,
-    fetchImpl: options.fetchImpl
-  });
-  const routes = await mergeLastReportedPublicRoutes(options.paths, discoveredRoutes);
-  if (context.publishToRelay) {
-    options.onNetworkRoutes?.(routes);
-  }
-  const reservation = await reserveAutomaticNetworkReport(options.paths, routes, {
-    dailyLimit: options.dailyReportLimit ?? DEFAULT_DAILY_REPORT_LIMIT,
-    force: context.forceReport === true,
-    unchangedMinIntervalMs: options.startupReportMinIntervalMs ?? DEFAULT_STARTUP_REPORT_MIN_INTERVAL_MS
-  });
-  if (!reservation.allowed) {
-    const logFields = {
-      lan_ips: routes.lanIps,
-      public_ipv4s: routes.publicIpv4s,
-      public_ipv6s: routes.publicIpv6s,
-      reason: reservation.reason
-    };
-    void options.logger.debug("lan_ip_report_skipped", logFields);
-    return;
-  }
-  try {
-    const result = await reportLinkStatusToServer({
-      paths: options.paths,
-      fetchImpl: options.fetchImpl,
-      routes
-    });
-    if (result) {
-      options.onNetworkRoutes?.(routes);
-      void options.logger.info("lan_ip_change_reported", {
-        link_id: result.linkId,
-        lan_ips: routes.lanIps,
-        public_ipv4s: routes.publicIpv4s,
-        public_ipv6s: routes.publicIpv6s
-      });
-    }
-  } catch (error) {
-    void options.logger.warn("lan_ip_change_report_failed", {
-      lan_ips: routes.lanIps,
-      error: error instanceof Error ? error.message : String(error)
-    });
-  }
-}
-
-// src/daemon/scheduler.ts
-function startCronDeliveryScheduler(options) {
-  let running = false;
-  let current = Promise.resolve();
-  const syncCronDeliveries = async () => {
-    if (running) {
-      return;
-    }
-    running = true;
-    try {
-      await syncHermesLinkCronDeliveries(
-        options.paths,
-        options.conversations,
-        options.logger
-      );
-    } catch (error) {
-      void options.logger.warn("cron_link_delivery_sync_failed", {
-        source: "daemon_scheduler",
-        error: error instanceof Error ? error.message : String(error)
-      });
-    } finally {
-      running = false;
-    }
-  };
-  const timer = setInterval(() => {
-    current = syncCronDeliveries();
-  }, options.intervalMs ?? 3e4);
-  timer.unref?.();
-  return {
-    async close() {
-      clearInterval(timer);
-      await current.catch(() => void 0);
-    }
-  };
-}
-function startHermesSessionSyncScheduler(options) {
-  let running = false;
-  let current = Promise.resolve();
-  const syncSessions = async () => {
-    if (running) {
-      return;
-    }
-    running = true;
-    try {
-      await options.conversations.syncHermesSessions();
-    } catch (error) {
-      void options.logger.warn("hermes_session_sync_failed", {
-        source: "daemon_scheduler",
-        error: error instanceof Error ? error.message : String(error)
-      });
-    } finally {
-      running = false;
-    }
-  };
-  const timer = setInterval(() => {
-    current = syncSessions();
-  }, options.intervalMs ?? 10 * 60 * 1e3);
-  timer.unref?.();
-  return {
-    async close() {
-      clearInterval(timer);
-      await current.catch(() => void 0);
-    }
-  };
-}
-
-// src/daemon/service.ts
-var DEFAULT_RELAY_READY_TIMEOUT_MS = 2e3;
-var RELAY_RECONNECT_PUBLIC_ROUTE_REFRESH_MIN_INTERVAL_MS = 15 * 6e4;
-async function startLinkService(options = {}) {
-  const paths = options.paths ?? resolveRuntimePaths();
-  const [identity, config] = await Promise.all([loadIdentity(paths), loadConfig(paths)]);
-  const logger = createFileLogger({ paths, minLevel: config.logLevel });
-  await logger.info("service_starting", {
-    port: config.port,
-    mode: identity?.link_id ? "paired" : "local-only"
+  child.stdout?.on("data", (chunk) => {
+    void appendChunk(chunk);
   });
-  const migration = await migrateLinkDatabase(paths);
-  if (migration.appliedVersions.length > 0) {
-    await logger.info("database_migrated", {
-      database_file: migration.databaseFile,
-      applied_versions: migration.appliedVersions,
-      current_version: migration.currentVersion
-    });
-  }
-  const conversations = new ConversationService(paths, logger);
-  await conversations.rebuildStatisticsIndex();
-  let hermesSessionSync = Promise.resolve();
-  const triggerHermesSessionSync = () => {
-    hermesSessionSync = Promise.resolve().then(() => conversations.syncHermesSessions()).then(() => void 0).catch((error) => {
-      void logger.warn("hermes_session_sync_failed", {
-        source: "service_startup",
-        error: error instanceof Error ? error.message : String(error)
-      });
-    });
-  };
-  const app = await createApp({
-    paths,
-    logger,
-    conversations,
-    onPairingClaimed: async () => {
-      triggerHermesSessionSync();
-      await options.onPairingClaimed?.();
-    }
+  child.stderr?.on("data", (chunk) => {
+    void appendChunk(chunk);
   });
-  const server = createServer(app.callback());
-  try {
-    await listenServer(server, config.port);
-  } catch (error) {
-    await logger.error("service_start_failed", {
-      port: config.port,
-      link_id: identity?.link_id ?? null,
-      error: error instanceof Error ? error.message : String(error)
+  runningUpdate2 = new Promise((resolve) => {
+    child.on("error", (error) => {
+      void (async () => {
+        const failed = {
+          ...started,
+          state: "failed",
+          finished_at: now().toISOString(),
+          error: error.message
+        };
+        await writer.write(
+          `
+[failed] link update failed to start: ${error.message}
+`
+        );
+        await writeUpdateState2(options.paths, failed);
+        await emitUpdateStatus2(options.paths);
+        void options.logger?.error("link_update_spawn_failed", {
+          job_id: jobId,
+          target_version: targetVersion,
+          error: error.message
+        });
+        resolve(await readLinkUpdateStatus(options.paths));
+      })();
     });
-    await logger.flush();
-    throw error;
-  }
-  server.on("error", (error) => {
-    void logger.error("service_error", {
-      port: config.port,
-      link_id: identity?.link_id ?? null,
-      error: error.message
+    child.on("close", (code, signal) => {
+      void (async () => {
+        const succeeded = code === 0;
+        const state = {
+          ...started,
+          state: succeeded ? "restart_required" : "failed",
+          finished_at: now().toISOString(),
+          exit_code: code,
+          signal,
+          error: succeeded ? null : `install script exited with code ${code ?? "unknown"}`
+        };
+        await writer.write(
+          `
+=== link update finished ${state.finished_at} exit=${code ?? "null"} signal=${signal ?? "null"} ===
+`
+        );
+        if (succeeded) {
+          await writer.write(
+            `
+[restart-requested] The install script should restart Hermes Link and verify the running version. If it does not reconnect, run \`${LINK_COMMAND} restart\` on this computer.
+`
+          );
+        }
+        if (succeeded) {
+          await writer.flush();
+          setTimeout(() => {
+            void (async () => {
+              await writeUpdateState2(options.paths, state);
+              await emitUpdateStatus2(options.paths);
+            })();
+          }, 1e3).unref();
+        } else {
+          await writeUpdateState2(options.paths, state);
+          await emitUpdateStatus2(options.paths);
+        }
+        void options.logger?.info(
+          succeeded ? "link_update_restart_required" : "link_update_failed",
+          {
+            job_id: jobId,
+            target_version: targetVersion,
+            exit_code: code,
+            signal: signal ?? null
+          }
+        );
+        resolve(await readLinkUpdateStatus(options.paths));
+      })();
     });
+  }).finally(() => {
+    runningUpdate2 = null;
   });
-  void logger.info("service_started", {
-    port: config.port,
-    link_id: identity?.link_id ?? null
-  });
-  triggerHermesSessionSync();
-  const scheduler = startCronDeliveryScheduler({
-    paths,
-    conversations,
-    logger
-  });
-  const hermesSessionSyncScheduler = startHermesSessionSyncScheduler({
-    conversations,
-    logger
+  await emitUpdateStatus2(options.paths);
+  void options.logger?.info("link_update_started", {
+    job_id: jobId,
+    pid: child.pid ?? null,
+    target_version: targetVersion,
+    log_path: writer.filePath
   });
-  let relay = null;
-  let lanIpMonitor = null;
-  let hasSeenRelayConnected = false;
-  let lastRelayReconnectPublicRouteRefreshAt = 0;
-  if (identity?.link_id) {
-    let resolveRelayReady = null;
-    const relayReady = new Promise((resolve) => {
-      resolveRelayReady = resolve;
-    });
-    relay = connectRelayControl({
-      relayBaseUrl: config.relayBaseUrl,
-      linkId: identity.link_id,
-      localPort: config.port,
-      maxReconnectAttempts: options.relayMaxReconnectAttempts ?? 5,
-      backoffBaseMs: 1e3,
-      backoffMaxMs: 3e4,
-      onStatus: (status) => {
-        void logger.info("relay_status", status);
-        if (status.state === "connected") {
-          const now = Date.now();
-          if (hasSeenRelayConnected && lanIpMonitor && now - lastRelayReconnectPublicRouteRefreshAt >= RELAY_RECONNECT_PUBLIC_ROUTE_REFRESH_MIN_INTERVAL_MS) {
-            lastRelayReconnectPublicRouteRefreshAt = now;
-            void lanIpMonitor.refreshPublicRoutes();
-          }
-          hasSeenRelayConnected = true;
-          resolveRelayReady?.(true);
-          resolveRelayReady = null;
-        } else if (status.state === "failed") {
-          resolveRelayReady?.(false);
-          resolveRelayReady = null;
-        }
-      }
-    });
-    if (options.waitForRelayReady) {
-      await Promise.race([
-        relayReady,
-        waitForRelayReadyTimeout(options.relayReadyTimeoutMs)
-      ]);
-      resolveRelayReady = null;
+  return readLinkUpdateStatus(options.paths);
+}
+async function readLinkUpdateStatus(paths) {
+  let state = await readJsonFile(updateStatePath2(paths));
+  if (state?.state === "restart_required" && state.target_version) {
+    if (compareSemver3(LINK_VERSION, state.target_version) >= 0) {
+      state = {
+        ...state,
+        state: "succeeded",
+        finished_at: state.finished_at ?? (/* @__PURE__ */ new Date()).toISOString()
+      };
+      await writeUpdateState2(paths, state);
     }
-  } else {
-    void logger.info("relay_skipped", { reason: "link_not_paired" });
   }
-  lanIpMonitor = startLanIpMonitor({
-    paths,
-    logger,
-    intervalMs: options.lanIpMonitorIntervalMs,
-    dailyReportLimit: options.lanIpMonitorDailyReportLimit,
-    fetchImpl: options.lanIpMonitorFetchImpl,
-    onNetworkRoutes: (routes) => {
-      relay?.publishNetworkRoutes(routes);
-    }
-  });
-  if (options.writePidFile) {
-    await writePidFile(paths);
+  if (state?.state === "running" && !runningUpdate2 && !isRecentRunningState3(state) && !isProcessAlive3(state.pid)) {
+    const reachedTarget = state.target_version && compareSemver3(LINK_VERSION, state.target_version) >= 0;
+    state = reachedTarget ? {
+      ...state,
+      state: "succeeded",
+      finished_at: (/* @__PURE__ */ new Date()).toISOString(),
+      error: null
+    } : {
+      ...state,
+      state: "failed",
+      finished_at: (/* @__PURE__ */ new Date()).toISOString(),
+      error: state.error ?? "Link update was interrupted before Hermes Link could observe completion."
+    };
+    await writeUpdateState2(paths, state);
   }
   return {
-    async close() {
-      relay?.close();
-      await closeServer(server);
-      await Promise.all([
-        scheduler.close(),
-        hermesSessionSyncScheduler.close(),
-        lanIpMonitor?.close(),
-        hermesSessionSync.catch(() => void 0)
-      ]);
-      await logger.info("service_stopped");
-      await logger.flush();
-      if (options.writePidFile) {
-        await rm8(pidFilePath(paths), { force: true }).catch(() => void 0);
-      }
-    }
+    ok: true,
+    state: state?.state ?? "idle",
+    job_id: state?.job_id ?? null,
+    pid: state?.pid ?? null,
+    target_version: state?.target_version ?? null,
+    started_at: state?.started_at ?? null,
+    finished_at: state?.finished_at ?? null,
+    exit_code: state?.exit_code ?? null,
+    signal: state?.signal ?? null,
+    log_path: updateLogPath2(paths),
+    lines: await readUpdateLogLines2(paths),
+    error: state?.error ?? null,
+    manual_command: state?.manual_command ?? null
   };
 }
-function waitForRelayReadyTimeout(timeoutMs) {
-  return new Promise((resolve) => {
-    const timer = setTimeout(
-      () => resolve(false),
-      timeoutMs ?? DEFAULT_RELAY_READY_TIMEOUT_MS
-    );
-    timer.unref?.();
-  });
-}
-function pidFilePath(paths = resolveRuntimePaths()) {
-  return `${paths.runDir}/hermeslink.pid`;
+function subscribeLinkUpdateStatus(listener) {
+  updateEvents2.on("status", listener);
+  return () => updateEvents2.off("status", listener);
 }
-async function writePidFile(paths) {
-  await mkdir13(paths.runDir, { recursive: true, mode: 448 });
-  await writeFile3(pidFilePath(paths), `${process.pid}
-`, { mode: 384 });
+async function writeFailedStartState(options, error, targetVersion = null) {
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  const state = {
+    state: "failed",
+    job_id: `link_update_${now().getTime().toString(36)}`,
+    pid: null,
+    target_version: targetVersion,
+    started_at: now().toISOString(),
+    finished_at: now().toISOString(),
+    exit_code: null,
+    signal: null,
+    error,
+    manual_command: targetVersion ? manualInstallCommand(targetVersion) : null
+  };
+  await writeUpdateState2(options.paths, state);
+  await emitUpdateStatus2(options.paths);
+  return readLinkUpdateStatus(options.paths);
 }
-async function closeServer(server) {
-  await new Promise((resolve, reject) => {
-    let settled = false;
-    let forceCloseTimer;
-    let timeoutTimer;
-    const settle = (error) => {
-      if (settled) {
-        return;
-      }
-      settled = true;
-      clearTimeout(forceCloseTimer);
-      clearTimeout(timeoutTimer);
-      if (error) {
-        reject(error);
-        return;
-      }
-      resolve();
-    };
-    forceCloseTimer = setTimeout(() => {
-      server.closeIdleConnections?.();
-      server.closeAllConnections?.();
-    }, 250);
-    timeoutTimer = setTimeout(() => {
-      server.closeAllConnections?.();
-      settle();
-    }, 5e3);
-    server.close((error) => {
-      if (error) {
-        settle(error);
-        return;
-      }
-      settle();
+async function readRemoteLinkPolicy(options) {
+  const context = await readLinkReleaseCheckContext(options.paths).catch(
+    () => null
+  );
+  try {
+    const response = await fetchCurrentLinkReleaseFromServer(
+      options,
+      options.fetchImpl ?? fetch
+    );
+    if (!response.ok) {
+      throw new Error(`HermesPilot Server returned HTTP ${response.status}`);
+    }
+    const snapshot = normalizeServerSnapshot(await response.json());
+    if (!snapshot.remote) {
+      return {
+        remote: null,
+        state: "unavailable",
+        issue: snapshot.issue ?? "HermesPilot Server has no Link release policy"
+      };
+    }
+    return {
+      remote: snapshot.remote,
+      state: "fresh",
+      issue: snapshot.issue
+    };
+  } catch (error) {
+    const issue = error instanceof Error ? error.message : String(error);
+    void options.logger?.warn("link_release_server_check_failed", {
+      server_base_url: context?.serverBaseUrl ?? null,
+      release_check_url: context?.releaseCheckUrl ?? null,
+      error: issue
     });
-    server.closeIdleConnections?.();
-  });
+    return { remote: null, state: "unavailable", issue };
+  }
 }
-async function listenServer(server, port) {
-  await new Promise((resolve, reject) => {
-    const cleanup = () => {
-      server.off("error", onError);
-      server.off("listening", onListening);
-    };
-    const onError = (error) => {
-      cleanup();
-      reject(error);
+function normalizeServerSnapshot(payload) {
+  const snapshot = toRecord17(payload);
+  const policy = toNullableRecord2(snapshot.policy);
+  if (!policy) {
+    return {
+      remote: null,
+      issue: readString18(snapshot, "issue")
     };
-    const onListening = () => {
-      cleanup();
-      resolve();
+  }
+  const release = toNullableRecord2(snapshot.release);
+  const currentVersion = readString18(policy, "current_version") ?? readString18(policy, "currentVersion");
+  const minSafeVersion = readString18(policy, "min_safe_version") ?? readString18(policy, "minSafeVersion");
+  if (!currentVersion) {
+    return {
+      remote: null,
+      issue: readString18(snapshot, "issue")
     };
-    server.once("error", onError);
-    server.once("listening", onListening);
-    server.listen(port);
-  });
+  }
+  return {
+    remote: {
+      current_version: currentVersion,
+      min_safe_version: minSafeVersion,
+      target_version: currentVersion,
+      release_url: release ? readString18(release, "release_url") ?? readString18(release, "releaseUrl") : null,
+      published_at: release ? readString18(release, "published_at") ?? readString18(release, "publishedAt") : null
+    },
+    issue: readString18(snapshot, "issue")
+  };
 }
-
-// src/daemon/process.ts
-async function startDaemonProcess(paths = resolveRuntimePaths()) {
-  const config = await loadConfig(paths);
-  let status = await getDaemonStatus(paths);
-  if (status.running) {
-    const probe = await probeLocalLinkService({ port: config.port, timeoutMs: 500 });
-    if (probe.reachable) {
-      return status;
-    }
-    await stopDaemonProcess(paths);
-    status = await getDaemonStatus(paths);
-    if (status.running) {
-      return status;
-    }
-  }
-  await mkdir14(paths.logsDir, { recursive: true, mode: 448 });
-  await mkdir14(paths.runDir, { recursive: true, mode: 448 });
-  const scriptPath = currentCliScriptPath();
-  const child = spawn4(process.execPath, [scriptPath, "daemon-supervisor"], {
-    detached: true,
-    stdio: "ignore",
-    env: process.env
-  });
-  child.unref();
-  for (let index = 0; index < 12; index += 1) {
-    await wait(250);
-    const next = await getDaemonStatus(paths);
-    if (next.running && (await probeLocalLinkService({ port: config.port, timeoutMs: 500 })).reachable) {
-      return next;
+async function fetchCurrentLinkReleaseFromServer(options, fetcher) {
+  const config = await loadConfig(options.paths);
+  const url = new URL(SERVER_LINK_CURRENT_RELEASE_PATH, config.serverBaseUrl);
+  url.searchParams.set("channel", "stable");
+  url.searchParams.set("lang", "en");
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), UPDATE_FETCH_TIMEOUT_MS);
+  try {
+    return await fetcher(url, {
+      headers: {
+        accept: "application/json",
+        "user-agent": `HermesPilot-Link/${LINK_VERSION}`
+      },
+      signal: controller.signal
+    });
+  } catch (error) {
+    if (error instanceof Error && error.name === "AbortError") {
+      throw new Error("HermesPilot Server Link release check timed out");
     }
+    throw error;
+  } finally {
+    clearTimeout(timer);
   }
-  return await getDaemonStatus(paths);
 }
-async function runDaemonSupervisor(paths = resolveRuntimePaths()) {
-  await mkdir14(paths.logsDir, { recursive: true, mode: 448 });
-  const log = createRotatingTextLogWriter({
-    paths,
-    fileName: path24.basename(daemonLogFile(paths))
-  });
-  const scriptPath = currentCliScriptPath();
-  const child = spawn4(process.execPath, [scriptPath, "daemon", "--foreground"], {
-    stdio: ["ignore", "pipe", "pipe"],
-    env: process.env
-  });
-  const write = (chunk) => {
-    void log.write(chunk);
+function buildOfficialInstallCommand(targetVersion) {
+  const env = {
+    HERMESLINK_VERSION: targetVersion,
+    HERMESLINK_YES: "1",
+    HERMESLINK_REQUIRE_RESTART_VERIFY: "1"
   };
-  write(`[${(/* @__PURE__ */ new Date()).toISOString()}] daemon supervisor started
-`);
-  child.stdout?.on("data", write);
-  child.stderr?.on("data", write);
-  const forwardStop = () => {
-    if (child.pid && isProcessAlive3(child.pid)) {
-      child.kill("SIGTERM");
-    }
+  if (process.platform === "win32") {
+    return {
+      command: `Invoke-RestMethod ${OFFICIAL_WINDOWS_INSTALLER_URL} | Invoke-Expression`,
+      displayCommand: `$env:HERMESLINK_VERSION="${targetVersion}"; $env:HERMESLINK_YES="1"; $env:HERMESLINK_REQUIRE_RESTART_VERIFY="1"; Invoke-RestMethod ${OFFICIAL_WINDOWS_INSTALLER_URL} | Invoke-Expression`,
+      env,
+      source: "official-installer"
+    };
+  }
+  return {
+    command: `curl -fsSL ${OFFICIAL_UNIX_INSTALLER_URL} | bash`,
+    displayCommand: `HERMESLINK_VERSION=${targetVersion} HERMESLINK_YES=1 HERMESLINK_REQUIRE_RESTART_VERIFY=1 sh -c 'curl -fsSL ${OFFICIAL_UNIX_INSTALLER_URL} | bash'`,
+    env,
+    source: "official-installer"
   };
-  process.once("SIGINT", forwardStop);
-  process.once("SIGTERM", forwardStop);
-  const result = await new Promise((resolve, reject) => {
-    child.once("error", reject);
-    child.once("exit", (code, signal) => resolve({ code, signal }));
-  }).catch((error) => {
-    write(`[${(/* @__PURE__ */ new Date()).toISOString()}] daemon supervisor failed: ${error instanceof Error ? error.message : String(error)}
-`);
-    return { code: 1, signal: null };
-  });
-  process.off("SIGINT", forwardStop);
-  process.off("SIGTERM", forwardStop);
-  write(
-    `[${(/* @__PURE__ */ new Date()).toISOString()}] daemon supervisor stopped code=${result.code ?? "null"} signal=${result.signal ?? "null"}
-`
-  );
-  await log.flush();
-  return result.code ?? (result.signal ? 0 : 1);
-}
-async function probeLocalLinkService(options) {
-  const unreachable = {
-    reachable: false,
-    reusable: false,
-    linkId: null,
-    version: null
+}
+function spawnInstallCommand(input) {
+  const env = {
+    ...process.env,
+    ...input.env
   };
-  let response;
-  try {
-    response = await fetch(`http://127.0.0.1:${options.port}/api/v1/bootstrap`, {
-      headers: { accept: "application/json" },
-      signal: AbortSignal.timeout(options.timeoutMs ?? 1e3)
-    });
-  } catch {
-    return unreachable;
-  }
-  if (!response.ok) {
-    return unreachable;
-  }
-  const payload = await response.json().catch(() => null);
-  if (!payload || payload.api_version !== 1) {
-    return unreachable;
+  if (process.platform === "win32") {
+    return spawn4(
+      "powershell.exe",
+      ["-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", input.command],
+      {
+        env,
+        stdio: ["ignore", "pipe", "pipe"],
+        windowsHide: true,
+        detached: false,
+        shell: false
+      }
+    );
   }
-  const linkId = typeof payload.link_id === "string" ? payload.link_id : null;
+  return spawn4("/bin/sh", ["-lc", input.command], {
+    env,
+    stdio: ["ignore", "pipe", "pipe"],
+    windowsHide: true,
+    detached: false,
+    shell: false
+  });
+}
+async function readLinkReleaseCheckContext(paths) {
+  const config = await loadConfig(paths);
+  const url = new URL(SERVER_LINK_CURRENT_RELEASE_PATH, config.serverBaseUrl);
+  url.searchParams.set("channel", "stable");
+  url.searchParams.set("lang", "en");
   return {
-    reachable: true,
-    reusable: options.linkId ? linkId === options.linkId : true,
-    linkId,
-    version: typeof payload.version === "string" ? payload.version : null
+    serverBaseUrl: config.serverBaseUrl,
+    releaseCheckUrl: url.toString()
   };
 }
-async function stopDaemonProcess(paths = resolveRuntimePaths()) {
-  const status = await getDaemonStatus(paths);
-  if (!status.running || !status.pid) {
-    return status;
-  }
-  try {
-    process.kill(status.pid, "SIGTERM");
-  } catch {
-    await rm9(pidFilePath(paths), { force: true }).catch(() => void 0);
-    return await getDaemonStatus(paths);
+function computeLinkUpdateState(localVersion, remote) {
+  if (!remote?.current_version) {
+    return "unknown";
   }
-  for (let index = 0; index < 20; index += 1) {
-    await wait(250);
-    if (!isProcessAlive3(status.pid)) {
-      break;
-    }
+  if (remote.min_safe_version && compareSemver3(localVersion, remote.min_safe_version) < 0) {
+    return "unsafe";
   }
-  if (isProcessAlive3(status.pid)) {
-    try {
-      process.kill(status.pid, "SIGKILL");
-    } catch {
-    }
-    for (let index = 0; index < 10; index += 1) {
-      await wait(250);
-      if (!isProcessAlive3(status.pid)) {
-        break;
-      }
-    }
+  const diff = compareSemver3(localVersion, remote.current_version);
+  if (diff < 0) {
+    return "update_available";
   }
-  if (!isProcessAlive3(status.pid) || !await pidBackedServiceIsReachable(paths)) {
-    await rm9(pidFilePath(paths), { force: true }).catch(() => void 0);
+  if (diff > 0) {
+    return "ahead_of_current";
   }
-  return await getDaemonStatus(paths);
+  return "current";
 }
-async function getDaemonStatus(paths = resolveRuntimePaths()) {
-  const pidFile = pidFilePath(paths);
-  const pid = await readPid(pidFile);
-  if (pid && !isProcessAlive3(pid)) {
-    await rm9(pidFile, { force: true }).catch(() => void 0);
-    return {
-      running: false,
-      pid: null,
-      pidFile,
-      logFile: daemonLogFile(paths)
-    };
+async function emitUpdateStatus2(paths) {
+  updateEvents2.emit("status", await readLinkUpdateStatus(paths));
+}
+async function writeUpdateState2(paths, state) {
+  await writeJsonFile(updateStatePath2(paths), state);
+}
+async function readUpdateLogLines2(paths) {
+  const raw = await readFile17(updateLogPath2(paths), "utf8").catch(() => "");
+  if (!raw.trim()) {
+    return [];
   }
-  return {
-    running: Boolean(pid),
-    pid,
-    pidFile,
-    logFile: daemonLogFile(paths)
-  };
+  return raw.split(/\r?\n/u).map((line) => line.trimEnd()).filter(Boolean).slice(-MAX_UPDATE_LOG_LINES2).map(
+    (line) => line.length > MAX_OUTPUT_LINE_LENGTH3 ? `${line.slice(0, MAX_OUTPUT_LINE_LENGTH3)}...` : line
+  );
 }
-function daemonLogFile(paths = resolveRuntimePaths()) {
-  return getDaemonLogFile(paths);
+function updateStatePath2(paths) {
+  return path24.join(paths.runDir, "link-update-state.json");
 }
-function currentCliScriptPath() {
-  return process.argv[1];
+function updateLogPath2(paths) {
+  return path24.join(paths.logsDir, UPDATE_LOG_FILE2);
 }
-async function readPid(filePath) {
-  const raw = await readFile17(filePath, "utf8").catch(() => null);
-  if (!raw) {
-    return null;
-  }
-  const pid = Number.parseInt(raw.trim(), 10);
-  return Number.isInteger(pid) && pid > 0 ? pid : null;
+async function clearUpdateLogFiles2(paths) {
+  const primary = updateLogPath2(paths);
+  await Promise.all([
+    rm8(primary, { force: true }).catch(() => void 0),
+    ...Array.from(
+      { length: UPDATE_LOG_MAX_FILES2 },
+      (_, index) => rm8(`${primary}.${index + 1}`, { force: true }).catch(() => void 0)
+    )
+  ]);
 }
-function isProcessAlive3(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch {
-    return false;
-  }
+function manualInstallCommand(version) {
+  return `npm install -g ${LINK_NPM_PACKAGE}@${version}`;
 }
-async function pidBackedServiceIsReachable(paths) {
-  const config = await loadConfig(paths).catch(() => null);
-  if (!config) {
-    return false;
+function isValidReleaseVersion(version) {
+  return /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u.test(
+    version
+  );
+}
+function compareSemver3(left, right) {
+  const leftParts = parseSemver(left);
+  const rightParts = parseSemver(right);
+  for (let index = 0; index < 3; index += 1) {
+    const diff = leftParts[index] - rightParts[index];
+    if (diff !== 0) {
+      return diff;
+    }
   }
-  return (await probeLocalLinkService({ port: config.port, timeoutMs: 500 })).reachable;
+  return 0;
 }
-function wait(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+function parseSemver(value) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)/u.exec(value.trim());
+  return [
+    Number.parseInt(match?.[1] ?? "0", 10),
+    Number.parseInt(match?.[2] ?? "0", 10),
+    Number.parseInt(match?.[3] ?? "0", 10)
+  ];
 }
-
-// src/link/updates.ts
-var SERVER_LINK_CURRENT_RELEASE_PATH = "/api/v1/link/releases/current";
-var LINK_NPM_PACKAGE = "@hermespilot/link";
-var UPDATE_LOG_FILE2 = "link-update.log";
-var UPDATE_LOG_MAX_FILES2 = 3;
-var UPDATE_FETCH_TIMEOUT_MS = 5e3;
-var MAX_UPDATE_LOG_LINES2 = 240;
-var MAX_OUTPUT_LINE_LENGTH3 = 1200;
-var AUTO_RESTART_DELAY_MS = 1500;
-var updateEvents2 = new EventEmitter4();
-var runningUpdate2 = null;
-async function readLinkUpdateCheck(options) {
-  const remoteResult = await readRemoteLinkPolicy(options);
-  const remote = remoteResult.remote;
-  const state = computeLinkUpdateState(LINK_VERSION, remote);
-  const targetVersion = remote?.target_version ?? null;
-  return {
-    ok: true,
-    local: {
-      version: LINK_VERSION,
-      raw: LINK_VERSION
-    },
-    remote,
-    state,
-    update_available: state === "update_available" || state === "unsafe" || state === "blocked",
-    unsafe: state === "unsafe",
-    blocked: state === "blocked",
-    check_state: remoteResult.state,
-    issue: remoteResult.issue,
-    manual: {
-      command: targetVersion ? manualInstallCommand(targetVersion) : null,
-      package: LINK_NPM_PACKAGE,
-      version: targetVersion
-    }
-  };
+function isRecentRunningState3(state, now = Date.now()) {
+  const startedAt = state.started_at ? Date.parse(state.started_at) : Number.NaN;
+  return Number.isFinite(startedAt) && now - startedAt < 1e4;
 }
-async function startLinkUpdate(options) {
-  const current = await readLinkUpdateStatus(options.paths);
-  if (runningUpdate2 || current.state === "running") {
-    return current;
-  }
-  const check = await readLinkUpdateCheck(options);
-  const targetVersion = check.remote?.target_version ?? null;
-  if (!targetVersion) {
-    return writeFailedStartState(
-      options,
-      "HermesPilot Server has no Link target version."
-    );
+function isProcessAlive3(pid) {
+  if (!pid || pid <= 0) {
+    return false;
   }
-  if (options.targetVersion && options.targetVersion !== targetVersion) {
-    return writeFailedStartState(
-      options,
-      `Requested target ${options.targetVersion} does not match current Link target ${targetVersion}.`,
-      targetVersion
-    );
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
   }
-  if (check.state === "current") {
-    return writeFailedStartState(
-      options,
-      "Hermes Link is already on the current version.",
-      targetVersion
+}
+function toRecord17(value) {
+  return typeof value === "object" && value !== null ? value : {};
+}
+function toNullableRecord2(value) {
+  return typeof value === "object" && value !== null ? value : null;
+}
+function readString18(payload, key) {
+  const value = payload[key];
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+
+// src/pairing/pairing.ts
+import path25 from "path";
+import { rm as rm9 } from "fs/promises";
+
+// src/relay/bootstrap.ts
+var RelayNetworkError = class extends Error {
+  constructor(relayBaseUrl, causeMessage) {
+    super(
+      `Cannot reach Hermes Relay at ${relayBaseUrl}. Please check your network connection, VPN, or proxy settings, then try again.`
     );
+    this.relayBaseUrl = relayBaseUrl;
+    this.causeMessage = causeMessage;
   }
-  const now = options.now ?? (() => /* @__PURE__ */ new Date());
-  const jobId = `link_update_${now().getTime().toString(36)}`;
-  await clearUpdateLogFiles2(options.paths);
-  const writer = createRotatingTextLogWriter({
-    paths: options.paths,
-    fileName: UPDATE_LOG_FILE2,
-    maxFileBytes: 512 * 1024,
-    maxFiles: UPDATE_LOG_MAX_FILES2
-  });
-  const startedAt = now().toISOString();
-  const manualCommand = manualInstallCommand(targetVersion);
-  const started = {
-    state: "running",
-    job_id: jobId,
-    pid: null,
-    target_version: targetVersion,
-    started_at: startedAt,
-    finished_at: null,
-    exit_code: null,
-    signal: null,
-    error: null,
-    manual_command: manualCommand
+  relayBaseUrl;
+  causeMessage;
+};
+async function bootstrapRelayLink(options) {
+  const fetcher = options.fetchImpl ?? fetch;
+  const baseUrl = options.relayBaseUrl.replace(/\/+$/u, "");
+  const commonPayload = {
+    install_id: options.identity.install_id,
+    link_id: options.identity.link_id ?? void 0,
+    public_key_pem: options.identity.public_key_pem
   };
-  await mkdir15(options.paths.runDir, { recursive: true, mode: 448 });
-  await writer.write(
-    `
-=== link update started ${startedAt} target=${targetVersion} ===
-`
+  const challenge = await postJson(
+    fetcher,
+    `${baseUrl}/api/v1/relay/link/challenge`,
+    options.relayBootstrapToken,
+    commonPayload
   );
-  await writer.write(`$ ${manualCommand}
-`);
-  await writeUpdateState2(options.paths, started);
-  const child = spawn5(
-    resolveNpmBin(),
-    ["install", "-g", `${LINK_NPM_PACKAGE}@${targetVersion}`],
+  if (challenge.ok !== true || typeof challenge.nonce !== "string") {
+    throw new Error("Relay did not return a valid install challenge");
+  }
+  const proof = {
+    nonce: challenge.nonce,
+    signature: signRelayNonce(options.identity, challenge.nonce)
+  };
+  const assigned = await postJson(
+    fetcher,
+    `${baseUrl}/api/v1/relay/link/bootstrap`,
+    options.relayBootstrapToken,
     {
-      stdio: ["ignore", "pipe", "pipe"],
-      windowsHide: true,
-      detached: false,
-      shell: false
+      ...commonPayload,
+      proof
     }
   );
-  started.pid = child.pid ?? null;
-  await writeUpdateState2(options.paths, started);
-  const appendChunk = async (chunk) => {
-    await writer.write(chunk);
-    await emitUpdateStatus2(options.paths);
+  if (assigned.ok !== true || typeof assigned.link_id !== "string") {
+    throw new Error("Relay did not return a valid link_id");
+  }
+  await saveAssignedLinkId(assigned.link_id, options.paths ?? resolveRuntimePaths());
+  return {
+    linkId: assigned.link_id,
+    reused: assigned.reused === true
   };
-  child.stdout?.on("data", (chunk) => {
-    void appendChunk(chunk);
-  });
-  child.stderr?.on("data", (chunk) => {
-    void appendChunk(chunk);
-  });
-  runningUpdate2 = new Promise((resolve) => {
-    child.on("error", (error) => {
-      void (async () => {
-        const failed = {
-          ...started,
-          state: "failed",
-          finished_at: now().toISOString(),
-          error: error.message
-        };
-        await writer.write(
-          `
-[failed] link update failed to start: ${error.message}
-`
-        );
-        await writeUpdateState2(options.paths, failed);
-        await emitUpdateStatus2(options.paths);
-        void options.logger?.error("link_update_spawn_failed", {
-          job_id: jobId,
-          target_version: targetVersion,
-          error: error.message
-        });
-        resolve(await readLinkUpdateStatus(options.paths));
-      })();
-    });
-    child.on("close", (code, signal) => {
-      void (async () => {
-        const succeeded = code === 0;
-        const state = {
-          ...started,
-          state: succeeded ? "restart_required" : "failed",
-          finished_at: now().toISOString(),
-          exit_code: code,
-          signal,
-          error: succeeded ? null : `npm install exited with code ${code ?? "unknown"}`
-        };
-        await writer.write(
-          `
-=== link update finished ${state.finished_at} exit=${code ?? "null"} signal=${signal ?? "null"} ===
-`
-        );
-        if (succeeded) {
-          await writer.write(
-            `
-[restart-scheduled] Hermes Link will restart automatically. If it does not reconnect, run \`${LINK_COMMAND} restart\` on this computer.
-`
-          );
-        }
-        await writeUpdateState2(options.paths, state);
-        await emitUpdateStatus2(options.paths);
-        if (succeeded) {
-          await writer.flush();
-          scheduleAutomaticRestart(options);
-        }
-        void options.logger?.info(
-          succeeded ? "link_update_restart_required" : "link_update_failed",
-          {
-            job_id: jobId,
-            target_version: targetVersion,
-            exit_code: code,
-            signal: signal ?? null
-          }
-        );
-        resolve(await readLinkUpdateStatus(options.paths));
-      })();
-    });
-  }).finally(() => {
-    runningUpdate2 = null;
-  });
-  await emitUpdateStatus2(options.paths);
-  void options.logger?.info("link_update_started", {
-    job_id: jobId,
-    pid: child.pid ?? null,
-    target_version: targetVersion,
-    log_path: writer.filePath
-  });
-  return readLinkUpdateStatus(options.paths);
 }
-function scheduleAutomaticRestart(options) {
-  const scriptPath = currentCliScriptPath();
-  setTimeout(() => {
-    const child = spawn5(process.execPath, [scriptPath, "restart"], {
-      detached: true,
-      stdio: "ignore",
-      env: process.env,
-      windowsHide: true
-    });
-    child.unref();
-    void options.logger?.info("link_update_restart_scheduled", {
-      delay_ms: AUTO_RESTART_DELAY_MS,
-      command: `${LINK_COMMAND} restart`
+async function postJson(fetcher, url, token, body) {
+  let response;
+  try {
+    response = await fetcher(url, {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${token}`,
+        "content-type": "application/json"
+      },
+      body: JSON.stringify(body)
     });
-  }, AUTO_RESTART_DELAY_MS).unref();
+  } catch (error) {
+    const baseUrl = new URL(url).origin;
+    throw new RelayNetworkError(
+      baseUrl,
+      error instanceof Error ? error.message : String(error)
+    );
+  }
+  const payload = await response.json().catch(() => null);
+  if (!response.ok) {
+    const message = readErrorMessage3(payload) ?? `Relay request failed with HTTP ${response.status}`;
+    throw new Error(message);
+  }
+  if (!payload) {
+    throw new Error("Relay returned an empty response");
+  }
+  return payload;
 }
-async function readLinkUpdateStatus(paths) {
-  let state = await readJsonFile(updateStatePath2(paths));
-  if (state?.state === "restart_required" && state.target_version) {
-    if (compareSemver3(LINK_VERSION, state.target_version) >= 0) {
-      state = {
-        ...state,
-        state: "succeeded",
-        finished_at: state.finished_at ?? (/* @__PURE__ */ new Date()).toISOString()
-      };
-      await writeUpdateState2(paths, state);
-    }
+function readErrorMessage3(payload) {
+  if (typeof payload !== "object" || payload === null) {
+    return null;
   }
-  if (state?.state === "running" && !runningUpdate2 && !isRecentRunningState3(state) && !isProcessAlive4(state.pid)) {
-    state = {
-      ...state,
-      state: "failed",
-      finished_at: (/* @__PURE__ */ new Date()).toISOString(),
-      error: state.error ?? "Link update was interrupted before Hermes Link could observe completion."
-    };
-    await writeUpdateState2(paths, state);
+  const error = payload.error;
+  if (typeof error !== "object" || error === null) {
+    return null;
   }
-  return {
-    ok: true,
-    state: state?.state ?? "idle",
-    job_id: state?.job_id ?? null,
-    pid: state?.pid ?? null,
-    target_version: state?.target_version ?? null,
-    started_at: state?.started_at ?? null,
-    finished_at: state?.finished_at ?? null,
-    exit_code: state?.exit_code ?? null,
-    signal: state?.signal ?? null,
-    log_path: updateLogPath2(paths),
-    lines: await readUpdateLogLines2(paths),
-    error: state?.error ?? null,
-    manual_command: state?.manual_command ?? null
+  const message = error.message;
+  return typeof message === "string" ? message : null;
+}
+
+// src/runtime/system-info.ts
+import { execFileSync } from "child_process";
+import { readFileSync } from "fs";
+import os4 from "os";
+function readLinkSystemInfo() {
+  const platform = process.platform;
+  const hostname = readHostname(platform);
+  const osLabel = readOsLabel(platform);
+  const defaultDisplayName = buildDefaultDisplayName({ hostname, osLabel, platform });
+  return {
+    platform,
+    hostname,
+    osLabel,
+    defaultDisplayName
   };
 }
-function subscribeLinkUpdateStatus(listener) {
-  updateEvents2.on("status", listener);
-  return () => updateEvents2.off("status", listener);
+function buildDefaultDisplayName(input) {
+  const hostname = normalizeText(input.hostname);
+  const osLabel = normalizeText(input.osLabel);
+  if (hostname) {
+    return truncateText(hostname, 128);
+  }
+  return truncateText(hostname ?? osLabel ?? `Hermes Link ${input.platform}`, 128);
 }
-async function writeFailedStartState(options, error, targetVersion = null) {
-  const now = options.now ?? (() => /* @__PURE__ */ new Date());
-  const state = {
-    state: "failed",
-    job_id: `link_update_${now().getTime().toString(36)}`,
-    pid: null,
-    target_version: targetVersion,
-    started_at: now().toISOString(),
-    finished_at: now().toISOString(),
-    exit_code: null,
-    signal: null,
-    error,
-    manual_command: targetVersion ? manualInstallCommand(targetVersion) : null
-  };
-  await writeUpdateState2(options.paths, state);
-  await emitUpdateStatus2(options.paths);
-  return readLinkUpdateStatus(options.paths);
+function parseLinuxOsRelease(content) {
+  const values = /* @__PURE__ */ new Map();
+  for (const line of content.split(/\r?\n/u)) {
+    const match = /^([A-Z0-9_]+)=(.*)$/u.exec(line.trim());
+    if (!match) {
+      continue;
+    }
+    values.set(match[1], unquoteOsReleaseValue(match[2]));
+  }
+  return normalizeText(values.get("PRETTY_NAME")) ?? buildLinuxName(values);
 }
-async function readRemoteLinkPolicy(options) {
-  const context = await readLinkReleaseCheckContext(options.paths).catch(
-    () => null
-  );
-  try {
-    const response = await fetchCurrentLinkReleaseFromServer(
-      options,
-      options.fetchImpl ?? fetch
-    );
-    if (!response.ok) {
-      throw new Error(`HermesPilot Server returned HTTP ${response.status}`);
+function readHostname(platform) {
+  if (platform === "darwin") {
+    const computerName = readCommandOutput("scutil", ["--get", "ComputerName"]);
+    if (computerName) {
+      return computerName;
     }
-    const snapshot = normalizeServerSnapshot(await response.json());
-    if (!snapshot.remote) {
-      return {
-        remote: null,
-        state: "unavailable",
-        issue: snapshot.issue ?? "HermesPilot Server has no Link release policy"
-      };
+  }
+  return normalizeText(os4.hostname());
+}
+function readOsLabel(platform) {
+  if (platform === "darwin") {
+    const version = readCommandOutput("sw_vers", ["-productVersion"]);
+    return version ? `macOS ${version}` : "macOS";
+  }
+  if (platform === "linux") {
+    return readLinuxOsRelease() ?? `Linux ${os4.release()}`;
+  }
+  if (platform === "win32") {
+    return `Windows ${os4.release()}`;
+  }
+  return `${os4.type()} ${os4.release()}`.trim();
+}
+function readLinuxOsRelease() {
+  for (const file of ["/etc/os-release", "/usr/lib/os-release"]) {
+    try {
+      return parseLinuxOsRelease(readFileSync(file, "utf8"));
+    } catch {
     }
-    return {
-      remote: snapshot.remote,
-      state: "fresh",
-      issue: snapshot.issue
-    };
-  } catch (error) {
-    const issue = error instanceof Error ? error.message : String(error);
-    void options.logger?.warn("link_release_server_check_failed", {
-      server_base_url: context?.serverBaseUrl ?? null,
-      release_check_url: context?.releaseCheckUrl ?? null,
-      error: issue
+  }
+  return null;
+}
+function readCommandOutput(command, args) {
+  try {
+    const output = execFileSync(command, args, {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 1e3
     });
-    return { remote: null, state: "unavailable", issue };
+    return normalizeText(output);
+  } catch {
+    return null;
   }
 }
-function normalizeServerSnapshot(payload) {
-  const snapshot = toRecord17(payload);
-  const policy = toNullableRecord2(snapshot.policy);
-  if (!policy) {
+function buildLinuxName(values) {
+  const name = normalizeText(values.get("NAME"));
+  const version = normalizeText(values.get("VERSION_ID")) ?? normalizeText(values.get("VERSION"));
+  if (name && version) {
+    return `${name} ${version}`;
+  }
+  return name ?? version;
+}
+function unquoteOsReleaseValue(value) {
+  const trimmed = value.trim();
+  if (trimmed.length >= 2 && (trimmed.startsWith('"') && trimmed.endsWith('"') || trimmed.startsWith("'") && trimmed.endsWith("'"))) {
+    return trimmed.slice(1, -1).replace(/\\(["'`$\\])/gu, "$1");
+  }
+  return trimmed;
+}
+function normalizeText(value) {
+  const normalized = value?.replace(/\s+/gu, " ").trim();
+  return normalized ? normalized : null;
+}
+function truncateText(value, maxLength) {
+  return value.length > maxLength ? value.slice(0, maxLength).trimEnd() : value;
+}
+
+// src/topology/network.ts
+import os6 from "os";
+
+// src/topology/environment.ts
+import { existsSync, readFileSync as readFileSync2 } from "fs";
+import os5 from "os";
+function detectRuntimeEnvironment(env = process.env) {
+  if (isWsl(env)) {
     return {
-      remote: null,
-      issue: readString18(snapshot, "issue")
+      kind: "wsl",
+      lanAutoDiscoveryUsable: false,
+      warning: "Detected WSL. The LAN IP found inside WSL is usually a private VM address and is not reachable from your phone. Use Relay or set `hermeslink config set lan-host <Windows LAN IP>`."
     };
   }
-  const release = toNullableRecord2(snapshot.release);
-  const currentVersion = readString18(policy, "current_version") ?? readString18(policy, "currentVersion");
-  const minSafeVersion = readString18(policy, "min_safe_version") ?? readString18(policy, "minSafeVersion");
-  if (!currentVersion) {
+  if (isContainer(env)) {
     return {
-      remote: null,
-      issue: readString18(snapshot, "issue")
+      kind: "container",
+      lanAutoDiscoveryUsable: false,
+      warning: "Detected a container environment. Container LAN IPs are usually not reachable from your phone. Use Relay or set `hermeslink config set lan-host <host LAN IP>`."
     };
   }
   return {
-    remote: {
-      current_version: currentVersion,
-      min_safe_version: minSafeVersion,
-      target_version: currentVersion,
-      release_url: release ? readString18(release, "release_url") ?? readString18(release, "releaseUrl") : null,
-      published_at: release ? readString18(release, "published_at") ?? readString18(release, "publishedAt") : null
-    },
-    issue: readString18(snapshot, "issue")
+    kind: "native",
+    lanAutoDiscoveryUsable: true,
+    warning: null
   };
 }
-async function fetchCurrentLinkReleaseFromServer(options, fetcher) {
-  const config = await loadConfig(options.paths);
-  const url = new URL(SERVER_LINK_CURRENT_RELEASE_PATH, config.serverBaseUrl);
-  url.searchParams.set("channel", "stable");
-  url.searchParams.set("lang", "en");
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), UPDATE_FETCH_TIMEOUT_MS);
+function isWsl(env) {
+  if (process.platform !== "linux") {
+    return false;
+  }
+  if (env.WSL_DISTRO_NAME || env.WSL_INTEROP) {
+    return true;
+  }
+  const release = os5.release().toLowerCase();
+  return release.includes("microsoft") || release.includes("wsl");
+}
+function isContainer(env) {
+  if (env.container || env.CONTAINER || env.KUBERNETES_SERVICE_HOST) {
+    return true;
+  }
+  if (existsSync("/.dockerenv")) {
+    return true;
+  }
   try {
-    return await fetcher(url, {
-      headers: {
-        accept: "application/json",
-        "user-agent": `HermesPilot-Link/${LINK_VERSION}`
-      },
-      signal: controller.signal
-    });
-  } catch (error) {
-    if (error instanceof Error && error.name === "AbortError") {
-      throw new Error("HermesPilot Server Link release check timed out");
+    const cgroup = readFileSync2("/proc/1/cgroup", "utf8").toLowerCase();
+    return /docker|containerd|kubepods|libpod|podman/u.test(cgroup);
+  } catch {
+    return false;
+  }
+}
+
+// src/topology/network.ts
+var VIRTUAL_INTERFACE_NAME_PATTERN = /(docker|veth|vmnet|vmenet|vbox|virtualbox|vmware|tailscale|zerotier|wireguard|utun|virbr|hyper-v|vethernet|loopback|\blo\b|^lo\d*$|^br-|^bridge\d+$|^zt|^tun|^tap|awdl|llw|anpi|gif|stf|ipsec|ppp)/iu;
+var MAX_LAN_IPS = 4;
+var MAX_PUBLIC_IPV4S = 2;
+var MAX_PUBLIC_IPV6S = 2;
+async function discoverRouteCandidates(options) {
+  const environment = detectRuntimeEnvironment();
+  const configuredLanHost = normalizeLanHost(options.configuredLanHost);
+  const lanIps = configuredLanHost ? [configuredLanHost] : environment.lanAutoDiscoveryUsable ? discoverLanIps() : [];
+  const publicIps = options.relayBootstrapToken || options.observePublicRoute ? await observePublicRoute(options).catch(() => ({ publicIpv4s: [], publicIpv6s: [] })) : { publicIpv4s: [], publicIpv6s: [] };
+  const publicIpv4s = unique(publicIps.publicIpv4s.filter(isUsablePublicIpv4)).slice(0, MAX_PUBLIC_IPV4S);
+  const publicIpv6s = unique(publicIps.publicIpv6s.filter(isUsablePublicIpv6)).slice(0, MAX_PUBLIC_IPV6S);
+  const preferredUrls = [
+    ...lanIps.map((ip) => buildDirectUrl(ip, options.port)),
+    ...publicIpv4s.map((ip) => buildDirectUrl(ip, options.port)),
+    ...publicIpv6s.map((ip) => buildDirectUrl(ip, options.port)),
+    `${options.relayBaseUrl.replace(/\/+$/u, "")}/api/v1/relay/links/${options.linkId}`
+  ];
+  return {
+    lanIps,
+    publicIpv4s,
+    publicIpv6s,
+    preferredUrls,
+    environment
+  };
+}
+function discoverLanIps() {
+  return discoverLanIpsFromInterfaces(os6.networkInterfaces());
+}
+function discoverLanIpsFromInterfaces(interfaces) {
+  const result = /* @__PURE__ */ new Set();
+  const candidates = [];
+  for (const [name, items] of Object.entries(interfaces)) {
+    if (shouldIgnoreInterface(name)) {
+      continue;
     }
-    throw error;
-  } finally {
-    clearTimeout(timer);
+    for (const item of items ?? []) {
+      if (!item.internal && item.address && item.family === "IPv4" && isUsableLanIpv42(item.address, item.netmask)) {
+        candidates.push({ name, address: item.address });
+      }
+    }
+  }
+  for (const candidate of candidates.sort(compareLanCandidate)) {
+    result.add(candidate.address);
   }
+  return [...result].slice(0, MAX_LAN_IPS);
 }
-async function readLinkReleaseCheckContext(paths) {
-  const config = await loadConfig(paths);
-  const url = new URL(SERVER_LINK_CURRENT_RELEASE_PATH, config.serverBaseUrl);
-  url.searchParams.set("channel", "stable");
-  url.searchParams.set("lang", "en");
+async function observePublicRoute(options) {
+  const fetcher = options.fetchImpl ?? fetch;
+  const response = await fetcher(`${options.relayBaseUrl.replace(/\/+$/u, "")}/api/v1/relay/public-route/observe`, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      ...options.relayBootstrapToken ? { authorization: `Bearer ${options.relayBootstrapToken}` } : {}
+    },
+    body: JSON.stringify({
+      install_id: options.installId,
+      link_id: options.linkId,
+      public_key_pem: options.publicKeyPem
+    })
+  });
+  const payload = await response.json().catch(() => null);
+  const record = typeof payload?.record === "object" && payload.record !== null ? payload.record : null;
+  const observed = typeof payload?.observed === "object" && payload.observed !== null ? payload.observed : null;
+  const values = [
+    readIpRecord(record?.ipv4),
+    readIpRecord(record?.ipv6),
+    typeof observed?.ip === "string" ? observed.ip : null
+  ].filter((value) => Boolean(value));
   return {
-    serverBaseUrl: config.serverBaseUrl,
-    releaseCheckUrl: url.toString()
+    publicIpv4s: unique(values.filter(isUsablePublicIpv4)),
+    publicIpv6s: unique(values.filter(isUsablePublicIpv6))
   };
 }
-function computeLinkUpdateState(localVersion, remote) {
-  if (!remote?.current_version) {
-    return "unknown";
-  }
-  if (remote.min_safe_version && compareSemver3(localVersion, remote.min_safe_version) < 0) {
-    return "unsafe";
-  }
-  const diff = compareSemver3(localVersion, remote.current_version);
-  if (diff < 0) {
-    return "update_available";
-  }
-  if (diff > 0) {
-    return "ahead_of_current";
-  }
-  return "current";
-}
-async function emitUpdateStatus2(paths) {
-  updateEvents2.emit("status", await readLinkUpdateStatus(paths));
-}
-async function writeUpdateState2(paths, state) {
-  await writeJsonFile(updateStatePath2(paths), state);
-}
-async function readUpdateLogLines2(paths) {
-  const raw = await readFile18(updateLogPath2(paths), "utf8").catch(() => "");
-  if (!raw.trim()) {
-    return [];
+function readIpRecord(value) {
+  if (typeof value !== "object" || value === null) {
+    return null;
   }
-  return raw.split(/\r?\n/u).map((line) => line.trimEnd()).filter(Boolean).slice(-MAX_UPDATE_LOG_LINES2).map(
-    (line) => line.length > MAX_OUTPUT_LINE_LENGTH3 ? `${line.slice(0, MAX_OUTPUT_LINE_LENGTH3)}...` : line
-  );
-}
-function updateStatePath2(paths) {
-  return path25.join(paths.runDir, "link-update-state.json");
-}
-function updateLogPath2(paths) {
-  return path25.join(paths.logsDir, UPDATE_LOG_FILE2);
+  const ip = value.ip;
+  return typeof ip === "string" && ip.trim() ? ip.trim() : null;
 }
-async function clearUpdateLogFiles2(paths) {
-  const primary = updateLogPath2(paths);
-  await Promise.all([
-    rm10(primary, { force: true }).catch(() => void 0),
-    ...Array.from(
-      { length: UPDATE_LOG_MAX_FILES2 },
-      (_, index) => rm10(`${primary}.${index + 1}`, { force: true }).catch(() => void 0)
-    )
-  ]);
+function buildDirectUrl(ip, port) {
+  return `http://${ip.includes(":") ? `[${ip}]` : ip}:${port}`;
 }
-function manualInstallCommand(version) {
-  return `npm install -g ${LINK_NPM_PACKAGE}@${version}`;
+function shouldIgnoreInterface(name) {
+  return !name.trim() || VIRTUAL_INTERFACE_NAME_PATTERN.test(name);
 }
-function resolveNpmBin() {
-  return process.platform === "win32" ? "npm.cmd" : "npm";
+function compareLanCandidate(left, right) {
+  const priority = interfacePriority(left.name) - interfacePriority(right.name);
+  return priority || left.name.localeCompare(right.name) || left.address.localeCompare(right.address);
 }
-function compareSemver3(left, right) {
-  const leftParts = parseSemver(left);
-  const rightParts = parseSemver(right);
-  for (let index = 0; index < 3; index += 1) {
-    const diff = leftParts[index] - rightParts[index];
-    if (diff !== 0) {
-      return diff;
-    }
+function interfacePriority(name) {
+  if (/^(en|eth|wlan|wi-fi|wifi)/iu.test(name)) {
+    return 0;
   }
-  return 0;
+  return 1;
 }
-function parseSemver(value) {
-  const match = /^v?(\d+)\.(\d+)\.(\d+)/u.exec(value.trim());
-  return [
-    Number.parseInt(match?.[1] ?? "0", 10),
-    Number.parseInt(match?.[2] ?? "0", 10),
-    Number.parseInt(match?.[3] ?? "0", 10)
-  ];
+function isUsableLanIpv42(address, netmask) {
+  return isPrivateIpv4(address) && !isNetworkOrBroadcastIpv4Address(address, netmask);
 }
-function isRecentRunningState3(state, now = Date.now()) {
-  const startedAt = state.started_at ? Date.parse(state.started_at) : Number.NaN;
-  return Number.isFinite(startedAt) && now - startedAt < 1e4;
+function isUsablePublicIpv4(address) {
+  return isValidIpv4(address) && !isSpecialIpv4(address);
 }
-function isProcessAlive4(pid) {
-  if (!pid || pid <= 0) {
+function isUsablePublicIpv6(address) {
+  const normalized = address.toLowerCase();
+  return normalized.includes(":") && !normalized.startsWith("fe80:") && !normalized.startsWith("fc") && !normalized.startsWith("fd") && !normalized.startsWith("ff") && normalized !== "::" && normalized !== "::1";
+}
+function isPrivateIpv4(address) {
+  const parts = parseIpv4Segments(address);
+  if (!parts) {
     return false;
   }
-  try {
-    process.kill(pid, 0);
+  const [first, second] = parts;
+  return first === 10 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168;
+}
+function isSpecialIpv4(address) {
+  const parts = parseIpv4Segments(address);
+  if (!parts) {
     return true;
-  } catch {
-    return false;
   }
+  const [first, second, third, fourth] = parts;
+  return first === 0 || first === 10 || first === 127 || first >= 224 || first === 100 && second >= 64 && second <= 127 || first === 169 && second === 254 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168 || first === 192 && second === 0 && third === 2 || first === 198 && (second === 18 || second === 19) || first === 198 && second === 51 && third === 100 || first === 203 && second === 0 && third === 113 || first === 255 && second === 255 && third === 255 && fourth === 255;
 }
-function toRecord17(value) {
-  return typeof value === "object" && value !== null ? value : {};
-}
-function toNullableRecord2(value) {
-  return typeof value === "object" && value !== null ? value : null;
-}
-function readString18(payload, key) {
-  const value = payload[key];
-  return typeof value === "string" && value.trim() ? value.trim() : null;
-}
-
-// src/pairing/pairing.ts
-import path26 from "path";
-import { rm as rm11 } from "fs/promises";
-
-// src/relay/bootstrap.ts
-var RelayNetworkError = class extends Error {
-  constructor(relayBaseUrl, causeMessage) {
-    super(
-      `Cannot reach Hermes Relay at ${relayBaseUrl}. Please check your network connection, VPN, or proxy settings, then try again.`
-    );
-    this.relayBaseUrl = relayBaseUrl;
-    this.causeMessage = causeMessage;
+function isNetworkOrBroadcastIpv4Address(address, netmask) {
+  const addressParts = parseIpv4Segments(address);
+  const netmaskParts = netmask ? parseIpv4Segments(netmask) : null;
+  if (!addressParts) {
+    return true;
   }
-  relayBaseUrl;
-  causeMessage;
-};
-async function bootstrapRelayLink(options) {
-  const fetcher = options.fetchImpl ?? fetch;
-  const baseUrl = options.relayBaseUrl.replace(/\/+$/u, "");
-  const commonPayload = {
-    install_id: options.identity.install_id,
-    link_id: options.identity.link_id ?? void 0,
-    public_key_pem: options.identity.public_key_pem
-  };
-  const challenge = await postJson(
-    fetcher,
-    `${baseUrl}/api/v1/relay/link/challenge`,
-    options.relayBootstrapToken,
-    commonPayload
-  );
-  if (challenge.ok !== true || typeof challenge.nonce !== "string") {
-    throw new Error("Relay did not return a valid install challenge");
+  if (!netmaskParts) {
+    const last = addressParts[3];
+    return last === 0 || last === 255;
   }
-  const proof = {
-    nonce: challenge.nonce,
-    signature: signRelayNonce(options.identity, challenge.nonce)
-  };
-  const assigned = await postJson(
-    fetcher,
-    `${baseUrl}/api/v1/relay/link/bootstrap`,
-    options.relayBootstrapToken,
-    {
-      ...commonPayload,
-      proof
-    }
-  );
-  if (assigned.ok !== true || typeof assigned.link_id !== "string") {
-    throw new Error("Relay did not return a valid link_id");
+  const addressInt = ipv4SegmentsToInt(addressParts);
+  const netmaskInt = ipv4SegmentsToInt(netmaskParts);
+  const hostMask = ~netmaskInt >>> 0;
+  if (hostMask === 0) {
+    return false;
   }
-  await saveAssignedLinkId(assigned.link_id, options.paths ?? resolveRuntimePaths());
-  return {
-    linkId: assigned.link_id,
-    reused: assigned.reused === true
-  };
+  const networkInt = addressInt & netmaskInt;
+  const broadcastInt = (networkInt | hostMask) >>> 0;
+  return addressInt === networkInt || addressInt === broadcastInt;
 }
-async function postJson(fetcher, url, token, body) {
-  let response;
-  try {
-    response = await fetcher(url, {
-      method: "POST",
-      headers: {
-        authorization: `Bearer ${token}`,
-        "content-type": "application/json"
-      },
-      body: JSON.stringify(body)
-    });
-  } catch (error) {
-    const baseUrl = new URL(url).origin;
-    throw new RelayNetworkError(
-      baseUrl,
-      error instanceof Error ? error.message : String(error)
-    );
-  }
-  const payload = await response.json().catch(() => null);
-  if (!response.ok) {
-    const message = readErrorMessage4(payload) ?? `Relay request failed with HTTP ${response.status}`;
-    throw new Error(message);
-  }
-  if (!payload) {
-    throw new Error("Relay returned an empty response");
-  }
-  return payload;
+function isValidIpv4(address) {
+  return Boolean(parseIpv4Segments(address));
 }
-function readErrorMessage4(payload) {
-  if (typeof payload !== "object" || payload === null) {
+function parseIpv4Segments(address) {
+  if (!/^\d{1,3}(?:\.\d{1,3}){3}$/u.test(address)) {
     return null;
   }
-  const error = payload.error;
-  if (typeof error !== "object" || error === null) {
+  const parts = address.split(".").map((part) => Number.parseInt(part, 10));
+  if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {
     return null;
   }
-  const message = error.message;
-  return typeof message === "string" ? message : null;
+  return parts;
+}
+function ipv4SegmentsToInt(parts) {
+  return (parts[0] << 24 >>> 0 | parts[1] << 16 | parts[2] << 8 | parts[3]) >>> 0;
+}
+function unique(values) {
+  return [...new Set(values)];
 }
 
 // src/pairing/pairing.ts
@@ -24401,7 +24043,7 @@ async function readPairingClaim(sessionId, paths = resolveRuntimePaths()) {
   };
 }
 async function clearPairingClaim(sessionId, paths = resolveRuntimePaths()) {
-  await rm11(pairingClaimPath(sessionId, paths), { force: true }).catch(() => void 0);
+  await rm9(pairingClaimPath(sessionId, paths), { force: true }).catch(() => void 0);
 }
 async function claimPairing(input) {
   const paths = input.paths ?? resolveRuntimePaths();
@@ -24478,10 +24120,10 @@ async function loadRequiredIdentity2(paths) {
   }
   return identity;
 }
-async function postServerJson(serverBaseUrl, path27, body, options) {
+async function postServerJson(serverBaseUrl, path26, body, options) {
   let response;
   try {
-    response = await fetch(`${serverBaseUrl.replace(/\/+$/u, "")}${path27}`, {
+    response = await fetch(`${serverBaseUrl.replace(/\/+$/u, "")}${path26}`, {
       method: "POST",
       headers: {
         accept: "application/json",
@@ -24529,10 +24171,10 @@ function pairingErrorSnapshot(stage, error) {
     occurred_at: (/* @__PURE__ */ new Date()).toISOString()
   };
 }
-async function patchServerJson(serverBaseUrl, path27, token, body, options) {
+async function patchServerJson(serverBaseUrl, path26, token, body, options) {
   let response;
   try {
-    response = await fetch(`${serverBaseUrl.replace(/\/+$/u, "")}${path27}`, {
+    response = await fetch(`${serverBaseUrl.replace(/\/+$/u, "")}${path26}`, {
       method: "PATCH",
       headers: {
         accept: "application/json",
@@ -24554,12 +24196,12 @@ async function patchServerJson(serverBaseUrl, path27, token, body, options) {
 async function readJsonResponse2(response) {
   const payload = await response.json().catch(() => null);
   if (!response.ok || !payload) {
-    const message = readErrorMessage5(payload) ?? `HermesPilot Server request failed with HTTP ${response.status}`;
+    const message = readErrorMessage4(payload) ?? `HermesPilot Server request failed with HTTP ${response.status}`;
     throw new LinkHttpError(response.status, "server_request_failed", message);
   }
   return payload;
 }
-function readErrorMessage5(payload) {
+function readErrorMessage4(payload) {
   if (typeof payload !== "object" || payload === null) {
     return null;
   }
@@ -24580,10 +24222,10 @@ function createPairingNetworkError(input) {
   );
 }
 function pairingClaimPath(sessionId, paths) {
-  return path26.join(paths.pairingDir, `${Buffer.from(sessionId).toString("base64url")}.claimed.json`);
+  return path25.join(paths.pairingDir, `${Buffer.from(sessionId).toString("base64url")}.claimed.json`);
 }
 function pairingSessionPath(sessionId, paths) {
-  return path26.join(paths.pairingDir, `${Buffer.from(sessionId).toString("base64url")}.json`);
+  return path25.join(paths.pairingDir, `${Buffer.from(sessionId).toString("base64url")}.json`);
 }
 function qrPreferredUrls(routes) {
   return routes.preferredUrls.filter((url) => !url.includes("/api/v1/relay/links/")).slice(0, 1);
@@ -25757,14 +25399,20 @@ async function createApp(options = {}) {
 export {
   LINK_VERSION,
   LINK_COMMAND,
+  migrateLinkDatabase,
   LinkHttpError,
+  readJsonFile,
+  writeJsonFile,
   resolveHermesProfileDir,
   resolveHermesConfigPath,
   readHermesApiServerConfig,
   ensureHermesApiServerConfig,
+  syncHermesLinkCronDeliveries,
   resolveRuntimePaths,
   createFileLogger,
   getLinkLogFile,
+  getDaemonLogFile,
+  createRotatingTextLogWriter,
   ensureHermesApiServerAvailable,
   readHermesVersion,
   defaultLinkConfig,
@@ -25774,22 +25422,15 @@ export {
   normalizeLanHost,
   loadIdentity,
   ensureIdentity,
+  signIdentityPayload,
   getIdentityStatus,
   ConversationService,
   hasActiveDevices,
+  readLinkSystemInfo,
   detectRuntimeEnvironment,
+  discoverRouteCandidates,
   preparePairing,
   readPairingClaim,
   clearPairingClaim,
-  createApp,
-  connectRelayControl,
-  reportLinkStatusToServer,
-  startLinkService,
-  startDaemonProcess,
-  runDaemonSupervisor,
-  probeLocalLinkService,
-  stopDaemonProcess,
-  getDaemonStatus,
-  daemonLogFile,
-  currentCliScriptPath
+  createApp
 };