@hermespilot/link 0.5.2 → 0.5.4

package/dist/{chunk-DZMN5RIV.js → chunk-KFEEZ4LM.js}

@@ -4425,7 +4425,7 @@ async function listCronOutputFiles(profileName, jobId) {
       mtimeMs: fileStat.mtimeMs
     });
   }
-  return files.sort((left, right) => left.mtimeMs - right.mtimeMs).map(({ path: path26, mtime }) => ({ path: path26, mtime }));
+  return files.sort((left, right) => left.mtimeMs - right.mtimeMs).map(({ path: path27, mtime }) => ({ path: path27, mtime }));
 }
 async function readCronOutput(outputPath) {
   const content = await readFile3(outputPath, "utf8");
@@ -4502,7 +4502,7 @@ import os2 from "os";
 import path5 from "path";
 
 // src/constants.ts
-var LINK_VERSION = "0.5.2";
+var LINK_VERSION = "0.5.4";
 var LINK_COMMAND = "hermeslink";
 var LINK_DEFAULT_PORT = 52379;
 var LINK_RUNTIME_DIR_NAME = ".hermeslink";
@@ -12995,10 +12995,10 @@ function parseHermesApiCapabilities(payload) {
     sessionKeyHeader: readString10(features, "session_key_header")
   };
 }
-async function callHermesApi(path26, init, options) {
+async function callHermesApi(path27, init, options) {
   const method = init.method ?? "GET";
   const startedAt = Date.now();
-  void options.logger?.debug("hermes_api_request_started", { method, path: path26 });
+  void options.logger?.debug("hermes_api_request_started", { method, path: path27 });
   const availability = await ensureHermesApiServerAvailable({
     fetchImpl: options.fetchImpl,
     logger: options.logger,
@@ -13006,7 +13006,7 @@ async function callHermesApi(path26, init, options) {
   });
   let config = availability.configResult.apiServer;
   const fetcher = options.fetchImpl ?? fetch;
-  const request = () => fetchHermesApi(fetcher, config, path26, init, options);
+  const request = () => fetchHermesApi(fetcher, config, path27, init, options);
   let response;
   try {
     response = await request();
@@ -13014,7 +13014,7 @@ async function callHermesApi(path26, init, options) {
     logHermesApiError(
       options.logger,
       method,
-      path26,
+      path27,
       options.profileName,
       startedAt,
       error
@@ -13025,7 +13025,7 @@ async function callHermesApi(path26, init, options) {
     logHermesApiResponse(
       options.logger,
       method,
-      path26,
+      path27,
       options.profileName,
       startedAt,
       response
@@ -13034,7 +13034,7 @@ async function callHermesApi(path26, init, options) {
   }
   void options.logger?.warn("hermes_api_request_retrying_after_401", {
     method,
-    path: path26,
+    path: path27,
     profile: options.profileName ?? "default",
     port: config.port ?? null,
     duration_ms: Date.now() - startedAt
@@ -13052,7 +13052,7 @@ async function callHermesApi(path26, init, options) {
     logHermesApiError(
       options.logger,
       method,
-      path26,
+      path27,
       options.profileName,
       startedAt,
       error
@@ -13062,7 +13062,7 @@ async function callHermesApi(path26, init, options) {
   logHermesApiResponse(
     options.logger,
     method,
-    path26,
+    path27,
     options.profileName,
     startedAt,
     response
@@ -13072,7 +13072,7 @@ async function callHermesApi(path26, init, options) {
   }
   void options.logger?.warn("hermes_api_request_repairing_after_401", {
     method,
-    path: path26,
+    path: path27,
     profile: options.profileName ?? "default",
     port: config.port ?? null,
     duration_ms: Date.now() - startedAt
@@ -13092,7 +13092,7 @@ async function callHermesApi(path26, init, options) {
     logHermesApiError(
       options.logger,
       method,
-      path26,
+      path27,
       options.profileName,
       startedAt,
       error
@@ -13102,21 +13102,21 @@ async function callHermesApi(path26, init, options) {
   logHermesApiResponse(
     options.logger,
     method,
-    path26,
+    path27,
     options.profileName,
     startedAt,
     response
   );
   return response;
 }
-async function fetchHermesApi(fetcher, config, path26, init, options) {
+async function fetchHermesApi(fetcher, config, path27, init, options) {
   const headers = new Headers(init.headers);
   headers.set("accept", headers.get("accept") ?? "application/json");
   if (config.key) {
     headers.set("x-api-key", config.key);
     headers.set("authorization", `Bearer ${config.key}`);
   }
-  return await fetcher(`http://127.0.0.1:${config.port}${path26}`, {
+  return await fetcher(`http://127.0.0.1:${config.port}${path27}`, {
     ...init,
     headers
   }).catch((error) => {
@@ -13125,10 +13125,10 @@ async function fetchHermesApi(fetcher, config, path26, init, options) {
     }
     void options.logger?.warn("hermes_api_server_connect_failed", {
       method: String(init.method ?? "GET").toUpperCase(),
-      path: path26,
+      path: path27,
       profile: options.profileName ?? "default",
       port: config.port ?? null,
-      url: `http://127.0.0.1:${config.port}${path26}`,
+      url: `http://127.0.0.1:${config.port}${path27}`,
       error: error instanceof Error ? error.message : String(error)
     });
     throw new LinkHttpError(
@@ -13138,10 +13138,10 @@ async function fetchHermesApi(fetcher, config, path26, init, options) {
     );
   });
 }
-function logHermesApiResponse(logger, method, path26, profileName, startedAt, response) {
+function logHermesApiResponse(logger, method, path27, profileName, startedAt, response) {
   const fields = {
     method,
-    path: path26,
+    path: path27,
     profile: profileName ?? "default",
     status: response.status,
     duration_ms: Date.now() - startedAt
@@ -13162,10 +13162,10 @@ async function logHermesApiFailureResponse(logger, fields, response) {
     ...upstreamError ? { upstream_error: upstreamError } : {}
   });
 }
-function logHermesApiError(logger, method, path26, profileName, startedAt, error) {
+function logHermesApiError(logger, method, path27, profileName, startedAt, error) {
   void logger?.warn("hermes_api_request_failed", {
     method,
-    path: path26,
+    path: path27,
     profile: profileName ?? "default",
     duration_ms: Date.now() - startedAt,
     ...error instanceof LinkHttpError ? { status: error.status, code: error.code } : {},
@@ -22949,929 +22949,2431 @@ function readString17(payload, key) {
 }
 
 // src/link/updates.ts
-import { spawn as spawn4 } from "child_process";
+import { spawn as spawn5 } from "child_process";
 import { EventEmitter as EventEmitter4 } from "events";
-import { mkdir as mkdir13, readFile as readFile17, rm as rm8 } from "fs/promises";
+import { mkdir as mkdir15, readFile as readFile18, rm as rm10 } from "fs/promises";
+import path25 from "path";
+
+// src/daemon/process.ts
+import { spawn as spawn4 } from "child_process";
+import { mkdir as mkdir14, readFile as readFile17, rm as rm9 } from "fs/promises";
 import path24 from "path";
-var SERVER_LINK_CURRENT_RELEASE_PATH = "/api/v1/link/releases/current";
-var LINK_NPM_PACKAGE = "@hermespilot/link";
-var OFFICIAL_INSTALLER_BASE_URL = "https://raw.githubusercontent.com/HangbinYang/hermespilot-install/main";
-var OFFICIAL_UNIX_INSTALLER_URL = `${OFFICIAL_INSTALLER_BASE_URL}/install.sh`;
-var OFFICIAL_WINDOWS_INSTALLER_URL = `${OFFICIAL_INSTALLER_BASE_URL}/install.ps1`;
-var UPDATE_LOG_FILE2 = "link-update.log";
-var UPDATE_LOG_MAX_FILES2 = 3;
-var UPDATE_FETCH_TIMEOUT_MS = 5e3;
-var MAX_UPDATE_LOG_LINES2 = 240;
-var MAX_OUTPUT_LINE_LENGTH3 = 1200;
-var updateEvents2 = new EventEmitter4();
-var runningUpdate2 = null;
-async function readLinkUpdateCheck(options) {
-  const remoteResult = await readRemoteLinkPolicy(options);
-  const remote = remoteResult.remote;
-  const state = computeLinkUpdateState(LINK_VERSION, remote);
-  const targetVersion = remote?.target_version ?? null;
-  return {
-    ok: true,
-    local: {
-      version: LINK_VERSION,
-      raw: LINK_VERSION
-    },
-    remote,
-    state,
-    update_available: state === "update_available" || state === "unsafe" || state === "blocked",
-    unsafe: state === "unsafe",
-    blocked: state === "blocked",
-    check_state: remoteResult.state,
-    issue: remoteResult.issue,
-    manual: {
-      command: targetVersion ? manualInstallCommand(targetVersion) : null,
-      package: LINK_NPM_PACKAGE,
-      version: targetVersion
-    }
-  };
-}
-async function startLinkUpdate(options) {
-  const current = await readLinkUpdateStatus(options.paths);
-  if (runningUpdate2 || current.state === "running") {
-    return current;
-  }
-  const check = await readLinkUpdateCheck(options);
-  const targetVersion = check.remote?.target_version ?? null;
-  if (!targetVersion) {
-    return writeFailedStartState(
-      options,
-      "HermesPilot Server has no Link target version."
-    );
+
+// src/daemon/service.ts
+import { createServer } from "http";
+import { mkdir as mkdir13, rm as rm8, writeFile as writeFile3 } from "fs/promises";
+
+// src/relay/control-client.ts
+import WebSocket from "ws";
+
+// src/relay/stream-policy.ts
+var DEFAULT_RELAY_STREAM_BATCH_POLICY = {
+  flushIntervalMs: 50,
+  flushBytes: 2 * 1024
+};
+var RELAY_STREAM_POLICY_CONSTRAINTS = {
+  flushIntervalMs: {
+    min: 50,
+    max: 1e3
+  },
+  flushBytes: {
+    min: 1024,
+    max: 64 * 1024
   }
-  if (!isValidReleaseVersion(targetVersion)) {
-    return writeFailedStartState(
-      options,
-      `HermesPilot Server returned invalid Link target version: ${targetVersion}.`,
-      targetVersion
-    );
+};
+async function fetchRelayStreamBatchPolicy(serverBaseUrl, options = {}) {
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), options.timeoutMs ?? 3e3);
+  timeout.unref?.();
+  try {
+    const response = await fetchImpl(`${serverBaseUrl.replace(/\/+$/u, "")}/api/v1/relay/stream-policy`, {
+      headers: {
+        accept: "application/json"
+      },
+      signal: controller.signal
+    });
+    if (!response.ok) {
+      return null;
+    }
+    const payload = await response.json().catch(() => null);
+    return readRelayStreamBatchPolicy(payload);
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timeout);
   }
-  if (options.targetVersion && options.targetVersion !== targetVersion) {
-    return writeFailedStartState(
-      options,
-      `Requested target ${options.targetVersion} does not match current Link target ${targetVersion}.`,
-      targetVersion
-    );
+}
+function readRelayStreamBatchPolicy(input) {
+  const record = readRecord(input);
+  const body = readRecord(record?.policy) ?? readRecord(record?.stream_batching) ?? record;
+  return normalizeRelayStreamBatchPolicy(body);
+}
+function normalizeRelayStreamBatchPolicy(input) {
+  const record = readRecord(input);
+  if (!record) {
+    return null;
   }
-  if (check.state === "current") {
-    return writeFailedStartState(
-      options,
-      "Hermes Link is already on the current version.",
-      targetVersion
-    );
+  const flushIntervalMs = readInteger4(record.flushIntervalMs ?? record.flush_interval_ms);
+  const flushBytes = readInteger4(record.flushBytes ?? record.flush_bytes);
+  if (flushIntervalMs === null || flushBytes === null || flushIntervalMs < RELAY_STREAM_POLICY_CONSTRAINTS.flushIntervalMs.min || flushIntervalMs > RELAY_STREAM_POLICY_CONSTRAINTS.flushIntervalMs.max || flushBytes < RELAY_STREAM_POLICY_CONSTRAINTS.flushBytes.min || flushBytes > RELAY_STREAM_POLICY_CONSTRAINTS.flushBytes.max) {
+    return null;
   }
-  const now = options.now ?? (() => /* @__PURE__ */ new Date());
-  const jobId = `link_update_${now().getTime().toString(36)}`;
-  await clearUpdateLogFiles2(options.paths);
-  const writer = createRotatingTextLogWriter({
-    paths: options.paths,
-    fileName: UPDATE_LOG_FILE2,
-    maxFileBytes: 512 * 1024,
-    maxFiles: UPDATE_LOG_MAX_FILES2
-  });
-  const startedAt = now().toISOString();
-  const installCommand = buildOfficialInstallCommand(targetVersion);
-  const manualCommand = installCommand.displayCommand;
-  const started = {
-    state: "running",
-    job_id: jobId,
-    pid: null,
-    target_version: targetVersion,
-    started_at: startedAt,
-    finished_at: null,
-    exit_code: null,
-    signal: null,
-    error: null,
-    manual_command: manualCommand
+  return {
+    flushIntervalMs,
+    flushBytes
   };
-  await mkdir13(options.paths.runDir, { recursive: true, mode: 448 });
-  await writer.write(
-    `
-=== link update started ${startedAt} target=${targetVersion} ===
-`
-  );
-  await writer.write(`$ ${manualCommand}
-`);
-  await writeUpdateState2(options.paths, started);
-  const child = spawnInstallCommand(installCommand);
-  started.pid = child.pid ?? null;
-  await writeUpdateState2(options.paths, started);
-  const appendChunk = async (chunk) => {
-    await writer.write(chunk);
-    await emitUpdateStatus2(options.paths);
+}
+function readRecord(value) {
+  return value && typeof value === "object" ? value : null;
+}
+function readInteger4(value) {
+  return typeof value === "number" && Number.isInteger(value) ? value : null;
+}
+
+// src/relay/control-client.ts
+function connectRelayControl(options) {
+  const wsUrl = new URL(`${options.relayBaseUrl.replace(/\/+$/u, "")}/api/v1/relay/link/connect`);
+  wsUrl.protocol = wsUrl.protocol === "https:" ? "wss:" : "ws:";
+  wsUrl.searchParams.set("link_id", options.linkId);
+  const maxReconnectAttempts = options.maxReconnectAttempts ?? 5;
+  const backoffBaseMs = options.backoffBaseMs ?? 1e3;
+  const backoffMaxMs = options.backoffMaxMs ?? 3e4;
+  let reconnectAttempts = 0;
+  let closedByUser = false;
+  let socket = null;
+  let retryTimer = null;
+  let abortControllers = /* @__PURE__ */ new Map();
+  let fatalRelayRejection = null;
+  let latestNetworkRoutes = null;
+  const streamBatchPolicy = {
+    current: options.initialStreamBatchPolicy ?? DEFAULT_RELAY_STREAM_BATCH_POLICY,
+    onUpdate: options.onStreamBatchPolicy
   };
-  child.stdout?.on("data", (chunk) => {
-    void appendChunk(chunk);
-  });
-  child.stderr?.on("data", (chunk) => {
-    void appendChunk(chunk);
-  });
-  runningUpdate2 = new Promise((resolve) => {
-    child.on("error", (error) => {
-      void (async () => {
-        const failed = {
-          ...started,
+  const connect = () => {
+    options.onStatus?.({ state: "connecting", attempt: reconnectAttempts });
+    fatalRelayRejection = null;
+    socket = new WebSocket(wsUrl, {
+      headers: {
+        "x-hermes-link-version": LINK_VERSION
+      }
+    });
+    socket.on("open", () => {
+      reconnectAttempts = 0;
+      options.onStatus?.({ state: "connected", attempt: reconnectAttempts });
+      const currentSocket = socket;
+      if (currentSocket && latestNetworkRoutes) {
+        sendNetworkRoutes(currentSocket, options.linkId, latestNetworkRoutes);
+      }
+    });
+    socket.on("message", (raw) => {
+      if (!socket || typeof raw !== "string" && !Buffer.isBuffer(raw)) {
+        return;
+      }
+      void handleFrame(socket, String(raw), options.localPort, abortControllers, streamBatchPolicy).catch((error) => {
+        const message = error instanceof Error ? error.message : "Relay request failed";
+        socket?.send(JSON.stringify({ type: "http.error", id: "unknown", status: 502, message }));
+      });
+    });
+    socket.on("error", (error) => {
+      const message = error instanceof Error ? error.message : "Relay websocket error";
+      fatalRelayRejection = resolveFatalRelayRejection(message);
+      options.onStatus?.({
+        state: "disconnected",
+        attempt: reconnectAttempts,
+        message: fatalRelayRejection ?? message
+      });
+    });
+    socket.on("close", () => {
+      abortAll(abortControllers);
+      abortControllers = /* @__PURE__ */ new Map();
+      if (fatalRelayRejection) {
+        options.onStatus?.({
           state: "failed",
-          finished_at: now().toISOString(),
-          error: error.message
-        };
-        await writer.write(
-          `
-[failed] link update failed to start: ${error.message}
-`
-        );
-        await writeUpdateState2(options.paths, failed);
-        await emitUpdateStatus2(options.paths);
-        void options.logger?.error("link_update_spawn_failed", {
-          job_id: jobId,
-          target_version: targetVersion,
-          error: error.message
+          attempt: reconnectAttempts,
+          message: fatalRelayRejection
         });
-        resolve(await readLinkUpdateStatus(options.paths));
-      })();
-    });
-    child.on("close", (code, signal) => {
-      void (async () => {
-        const succeeded = code === 0;
-        const state = {
-          ...started,
-          state: succeeded ? "restart_required" : "failed",
-          finished_at: now().toISOString(),
-          exit_code: code,
-          signal,
-          error: succeeded ? null : `install script exited with code ${code ?? "unknown"}`
-        };
-        await writer.write(
-          `
-=== link update finished ${state.finished_at} exit=${code ?? "null"} signal=${signal ?? "null"} ===
-`
-        );
-        if (succeeded) {
-          await writer.write(
-            `
-[restart-requested] The install script should restart Hermes Link and verify the running version. If it does not reconnect, run \`${LINK_COMMAND} restart\` on this computer.
-`
-          );
-        }
-        if (succeeded) {
-          await writer.flush();
-          setTimeout(() => {
-            void (async () => {
-              await writeUpdateState2(options.paths, state);
-              await emitUpdateStatus2(options.paths);
-            })();
-          }, 1e3).unref();
-        } else {
-          await writeUpdateState2(options.paths, state);
-          await emitUpdateStatus2(options.paths);
-        }
-        void options.logger?.info(
-          succeeded ? "link_update_restart_required" : "link_update_failed",
-          {
-            job_id: jobId,
-            target_version: targetVersion,
-            exit_code: code,
-            signal: signal ?? null
-          }
-        );
-        resolve(await readLinkUpdateStatus(options.paths));
-      })();
+        return;
+      }
+      if (closedByUser) {
+        options.onStatus?.({ state: "disconnected", attempt: reconnectAttempts });
+        return;
+      }
+      if (reconnectAttempts >= maxReconnectAttempts) {
+        options.onStatus?.({ state: "failed", attempt: reconnectAttempts, message: "Relay reconnect attempts exhausted" });
+        return;
+      }
+      reconnectAttempts += 1;
+      const delay3 = computeBackoffMs(reconnectAttempts, backoffBaseMs, backoffMaxMs);
+      options.onStatus?.({ state: "retrying", attempt: reconnectAttempts, message: `Retrying in ${delay3}ms` });
+      retryTimer = setTimeout(connect, delay3);
+      retryTimer.unref?.();
     });
-  }).finally(() => {
-    runningUpdate2 = null;
-  });
-  await emitUpdateStatus2(options.paths);
-  void options.logger?.info("link_update_started", {
-    job_id: jobId,
-    pid: child.pid ?? null,
-    target_version: targetVersion,
-    log_path: writer.filePath
-  });
-  return readLinkUpdateStatus(options.paths);
+  };
+  connect();
+  return {
+    publishNetworkRoutes(routes) {
+      latestNetworkRoutes = routes;
+      if (socket?.readyState === WebSocket.OPEN) {
+        sendNetworkRoutes(socket, options.linkId, routes);
+      }
+    },
+    updateStreamBatchPolicy(policy) {
+      streamBatchPolicy.current = policy;
+      streamBatchPolicy.onUpdate?.(policy);
+    },
+    close() {
+      closedByUser = true;
+      if (retryTimer) {
+        clearTimeout(retryTimer);
+        retryTimer = null;
+      }
+      abortAll(abortControllers);
+      socket?.terminate();
+    }
+  };
 }
-async function readLinkUpdateStatus(paths) {
-  let state = await readJsonFile(updateStatePath2(paths));
-  if (state?.state === "restart_required" && state.target_version) {
-    if (compareSemver3(LINK_VERSION, state.target_version) >= 0) {
-      state = {
-        ...state,
-        state: "succeeded",
-        finished_at: state.finished_at ?? (/* @__PURE__ */ new Date()).toISOString()
-      };
-      await writeUpdateState2(paths, state);
+function sendNetworkRoutes(socket, linkId, routes) {
+  socket.send(JSON.stringify({
+    type: "network.routes",
+    id: `routes_${Date.now().toString(36)}`,
+    payload: {
+      link_id: linkId,
+      lan_ips: routes.lanIps,
+      public_ipv4s: routes.publicIpv4s,
+      public_ipv6s: routes.publicIpv6s,
+      observed_at: (/* @__PURE__ */ new Date()).toISOString()
     }
+  }));
+}
+function resolveFatalRelayRejection(message) {
+  if (!/Unexpected server response:\s*(400|401|403|426)\b/u.test(message)) {
+    return null;
   }
-  if (state?.state === "running" && !runningUpdate2 && !isRecentRunningState3(state) && !isProcessAlive3(state.pid)) {
-    const reachedTarget = state.target_version && compareSemver3(LINK_VERSION, state.target_version) >= 0;
-    state = reachedTarget ? {
-      ...state,
-      state: "succeeded",
-      finished_at: (/* @__PURE__ */ new Date()).toISOString(),
-      error: null
-    } : {
-      ...state,
-      state: "failed",
-      finished_at: (/* @__PURE__ */ new Date()).toISOString(),
-      error: state.error ?? "Link update was interrupted before Hermes Link could observe completion."
-    };
-    await writeUpdateState2(paths, state);
+  return "Relay refused the Hermes Link connection. Check Link version and pairing state before retrying.";
+}
+function abortAll(abortControllers) {
+  for (const controller of abortControllers.values()) {
+    controller.abort();
   }
-  return {
-    ok: true,
-    state: state?.state ?? "idle",
-    job_id: state?.job_id ?? null,
-    pid: state?.pid ?? null,
-    target_version: state?.target_version ?? null,
-    started_at: state?.started_at ?? null,
-    finished_at: state?.finished_at ?? null,
-    exit_code: state?.exit_code ?? null,
-    signal: state?.signal ?? null,
-    log_path: updateLogPath2(paths),
-    lines: await readUpdateLogLines2(paths),
-    error: state?.error ?? null,
-    manual_command: state?.manual_command ?? null
-  };
-}
-function subscribeLinkUpdateStatus(listener) {
-  updateEvents2.on("status", listener);
-  return () => updateEvents2.off("status", listener);
+  abortControllers.clear();
 }
-async function writeFailedStartState(options, error, targetVersion = null) {
-  const now = options.now ?? (() => /* @__PURE__ */ new Date());
-  const state = {
-    state: "failed",
-    job_id: `link_update_${now().getTime().toString(36)}`,
-    pid: null,
-    target_version: targetVersion,
-    started_at: now().toISOString(),
-    finished_at: now().toISOString(),
-    exit_code: null,
-    signal: null,
-    error,
-    manual_command: targetVersion ? manualInstallCommand(targetVersion) : null
-  };
-  await writeUpdateState2(options.paths, state);
-  await emitUpdateStatus2(options.paths);
-  return readLinkUpdateStatus(options.paths);
+function computeBackoffMs(attempt, baseMs, maxMs) {
+  const exponential = Math.min(maxMs, baseMs * 2 ** Math.max(0, attempt - 1));
+  const jitter = Math.floor(Math.random() * Math.min(1e3, exponential * 0.2));
+  return exponential + jitter;
 }
-async function readRemoteLinkPolicy(options) {
-  const context = await readLinkReleaseCheckContext(options.paths).catch(
-    () => null
-  );
-  try {
-    const response = await fetchCurrentLinkReleaseFromServer(
-      options,
-      options.fetchImpl ?? fetch
-    );
-    if (!response.ok) {
-      throw new Error(`HermesPilot Server returned HTTP ${response.status}`);
-    }
-    const snapshot = normalizeServerSnapshot(await response.json());
-    if (!snapshot.remote) {
-      return {
-        remote: null,
-        state: "unavailable",
-        issue: snapshot.issue ?? "HermesPilot Server has no Link release policy"
-      };
+async function handleFrame(socket, raw, localPort, abortControllers, streamBatchPolicy) {
+  const frame = JSON.parse(raw);
+  if (frame.type === "relay.config.update") {
+    const nextPolicy = readRelayStreamBatchPolicy(frame.payload);
+    if (nextPolicy) {
+      streamBatchPolicy.current = nextPolicy;
+      streamBatchPolicy.onUpdate?.(nextPolicy);
     }
-    return {
-      remote: snapshot.remote,
-      state: "fresh",
-      issue: snapshot.issue
-    };
-  } catch (error) {
-    const issue = error instanceof Error ? error.message : String(error);
-    void options.logger?.warn("link_release_server_check_failed", {
-      server_base_url: context?.serverBaseUrl ?? null,
-      release_check_url: context?.releaseCheckUrl ?? null,
-      error: issue
-    });
-    return { remote: null, state: "unavailable", issue };
+    return;
   }
-}
-function normalizeServerSnapshot(payload) {
-  const snapshot = toRecord17(payload);
-  const policy = toNullableRecord2(snapshot.policy);
-  if (!policy) {
-    return {
-      remote: null,
-      issue: readString18(snapshot, "issue")
-    };
+  if (frame.type === "http.cancel") {
+    abortControllers.get(frame.id)?.abort();
+    abortControllers.delete(frame.id);
+    return;
   }
-  const release = toNullableRecord2(snapshot.release);
-  const currentVersion = readString18(policy, "current_version") ?? readString18(policy, "currentVersion");
-  const minSafeVersion = readString18(policy, "min_safe_version") ?? readString18(policy, "minSafeVersion");
-  if (!currentVersion) {
-    return {
-      remote: null,
-      issue: readString18(snapshot, "issue")
-    };
+  if (frame.type !== "http.request") {
+    return;
   }
-  return {
-    remote: {
-      current_version: currentVersion,
-      min_safe_version: minSafeVersion,
-      target_version: currentVersion,
-      release_url: release ? readString18(release, "release_url") ?? readString18(release, "releaseUrl") : null,
-      published_at: release ? readString18(release, "published_at") ?? readString18(release, "publishedAt") : null
-    },
-    issue: readString18(snapshot, "issue")
-  };
-}
-async function fetchCurrentLinkReleaseFromServer(options, fetcher) {
-  const config = await loadConfig(options.paths);
-  const url = new URL(SERVER_LINK_CURRENT_RELEASE_PATH, config.serverBaseUrl);
-  url.searchParams.set("channel", "stable");
-  url.searchParams.set("lang", "en");
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), UPDATE_FETCH_TIMEOUT_MS);
+  const abortController = new AbortController();
+  abortControllers.set(frame.id, abortController);
+  let sseBatcher = null;
   try {
-    return await fetcher(url, {
-      headers: {
-        accept: "application/json",
-        "user-agent": `HermesPilot-Link/${LINK_VERSION}`
-      },
-      signal: controller.signal
+    const response = await fetch(`http://127.0.0.1:${localPort}${frame.path}`, {
+      method: frame.method,
+      headers: frame.headers ?? {},
+      body: frame.bodyBase64 ? Buffer.from(frame.bodyBase64, "base64") : void 0,
+      signal: abortController.signal
     });
+    const headers = Object.fromEntries(response.headers.entries());
+    const contentType = response.headers.get("content-type") ?? "";
+    if (response.body && contentType.includes("text/event-stream")) {
+      socket.send(JSON.stringify({ type: "http.stream.start", id: frame.id, status: response.status, headers }));
+      sseBatcher = createRelayStreamChunkBatcher(socket, frame.id, streamBatchPolicy);
+      const reader = response.body.getReader();
+      while (true) {
+        const next = await reader.read();
+        if (next.done) {
+          break;
+        }
+        sseBatcher.push(next.value);
+      }
+      sseBatcher.flush();
+      socket.send(JSON.stringify({ type: "http.stream.end", id: frame.id }));
+      return;
+    }
+    const body = Buffer.from(await response.arrayBuffer()).toString("base64");
+    socket.send(JSON.stringify({ type: "http.response", id: frame.id, status: response.status, headers, bodyBase64: body }));
   } catch (error) {
-    if (error instanceof Error && error.name === "AbortError") {
-      throw new Error("HermesPilot Server Link release check timed out");
+    if (abortController.signal.aborted || isAbortError2(error)) {
+      return;
     }
-    throw error;
+    sseBatcher?.flush();
+    const message = error instanceof Error ? error.message : "Relay request failed";
+    socket.send(JSON.stringify({ type: "http.error", id: frame.id, status: 502, message }));
   } finally {
-    clearTimeout(timer);
+    sseBatcher?.dispose();
+    abortControllers.delete(frame.id);
   }
 }
-function buildOfficialInstallCommand(targetVersion) {
-  const env = {
-    HERMESLINK_VERSION: targetVersion,
-    HERMESLINK_YES: "1",
-    HERMESLINK_REQUIRE_RESTART_VERIFY: "1"
+function isAbortError2(error) {
+  return typeof error === "object" && error !== null && "name" in error && error.name === "AbortError";
+}
+function createRelayStreamChunkBatcher(socket, id, streamBatchPolicy) {
+  let chunks = [];
+  let totalBytes = 0;
+  let flushTimer = null;
+  const clearFlushTimer = () => {
+    if (flushTimer == null) {
+      return;
+    }
+    clearTimeout(flushTimer);
+    flushTimer = null;
   };
-  if (process.platform === "win32") {
-    return {
-      command: `Invoke-RestMethod ${OFFICIAL_WINDOWS_INSTALLER_URL} | Invoke-Expression`,
-      displayCommand: `$env:HERMESLINK_VERSION="${targetVersion}"; $env:HERMESLINK_YES="1"; $env:HERMESLINK_REQUIRE_RESTART_VERIFY="1"; Invoke-RestMethod ${OFFICIAL_WINDOWS_INSTALLER_URL} | Invoke-Expression`,
-      env,
-      source: "official-installer"
-    };
-  }
-  return {
-    command: `curl -fsSL ${OFFICIAL_UNIX_INSTALLER_URL} | bash`,
-    displayCommand: `HERMESLINK_VERSION=${targetVersion} HERMESLINK_YES=1 HERMESLINK_REQUIRE_RESTART_VERIFY=1 sh -c 'curl -fsSL ${OFFICIAL_UNIX_INSTALLER_URL} | bash'`,
-    env,
-    source: "official-installer"
+  const flush = () => {
+    clearFlushTimer();
+    if (totalBytes <= 0) {
+      return;
+    }
+    const bodyBase64 = Buffer.concat(chunks, totalBytes).toString("base64");
+    chunks = [];
+    totalBytes = 0;
+    if (socket.readyState !== WebSocket.OPEN) {
+      return;
+    }
+    socket.send(JSON.stringify({ type: "http.stream.chunk", id, bodyBase64 }));
   };
-}
-function spawnInstallCommand(input) {
-  const env = {
-    ...process.env,
-    ...input.env
+  const scheduleFlush = () => {
+    if (flushTimer != null) {
+      return;
+    }
+    flushTimer = setTimeout(() => {
+      flushTimer = null;
+      flush();
+    }, streamBatchPolicy.current.flushIntervalMs);
+    flushTimer.unref?.();
   };
-  if (process.platform === "win32") {
-    return spawn4(
-      "powershell.exe",
-      ["-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", input.command],
-      {
-        env,
-        stdio: ["ignore", "pipe", "pipe"],
-        windowsHide: true,
-        detached: false,
-        shell: false
+  return {
+    push(chunk) {
+      if (chunk.byteLength <= 0) {
+        return;
       }
-    );
-  }
-  return spawn4("/bin/sh", ["-lc", input.command], {
-    env,
-    stdio: ["ignore", "pipe", "pipe"],
-    windowsHide: true,
-    detached: false,
-    shell: false
-  });
+      const buffer = Buffer.from(chunk);
+      chunks.push(buffer);
+      totalBytes += buffer.byteLength;
+      if (totalBytes >= streamBatchPolicy.current.flushBytes) {
+        flush();
+        return;
+      }
+      scheduleFlush();
+    },
+    flush,
+    dispose() {
+      clearFlushTimer();
+      chunks = [];
+      totalBytes = 0;
+    }
+  };
 }
-async function readLinkReleaseCheckContext(paths) {
-  const config = await loadConfig(paths);
-  const url = new URL(SERVER_LINK_CURRENT_RELEASE_PATH, config.serverBaseUrl);
-  url.searchParams.set("channel", "stable");
-  url.searchParams.set("lang", "en");
+
+// src/runtime/system-info.ts
+import { execFileSync } from "child_process";
+import { readFileSync } from "fs";
+import os4 from "os";
+function readLinkSystemInfo() {
+  const platform = process.platform;
+  const hostname = readHostname(platform);
+  const osLabel = readOsLabel(platform);
+  const defaultDisplayName = buildDefaultDisplayName({ hostname, osLabel, platform });
   return {
-    serverBaseUrl: config.serverBaseUrl,
-    releaseCheckUrl: url.toString()
+    platform,
+    hostname,
+    osLabel,
+    defaultDisplayName
   };
 }
-function computeLinkUpdateState(localVersion, remote) {
-  if (!remote?.current_version) {
-    return "unknown";
-  }
-  if (remote.min_safe_version && compareSemver3(localVersion, remote.min_safe_version) < 0) {
-    return "unsafe";
-  }
-  const diff = compareSemver3(localVersion, remote.current_version);
-  if (diff < 0) {
-    return "update_available";
-  }
-  if (diff > 0) {
-    return "ahead_of_current";
+function buildDefaultDisplayName(input) {
+  const hostname = normalizeText(input.hostname);
+  const osLabel = normalizeText(input.osLabel);
+  if (hostname) {
+    return truncateText(hostname, 128);
   }
-  return "current";
-}
-async function emitUpdateStatus2(paths) {
-  updateEvents2.emit("status", await readLinkUpdateStatus(paths));
-}
-async function writeUpdateState2(paths, state) {
-  await writeJsonFile(updateStatePath2(paths), state);
+  return truncateText(hostname ?? osLabel ?? `Hermes Link ${input.platform}`, 128);
 }
-async function readUpdateLogLines2(paths) {
-  const raw = await readFile17(updateLogPath2(paths), "utf8").catch(() => "");
-  if (!raw.trim()) {
-    return [];
+function parseLinuxOsRelease(content) {
+  const values = /* @__PURE__ */ new Map();
+  for (const line of content.split(/\r?\n/u)) {
+    const match = /^([A-Z0-9_]+)=(.*)$/u.exec(line.trim());
+    if (!match) {
+      continue;
+    }
+    values.set(match[1], unquoteOsReleaseValue(match[2]));
   }
-  return raw.split(/\r?\n/u).map((line) => line.trimEnd()).filter(Boolean).slice(-MAX_UPDATE_LOG_LINES2).map(
-    (line) => line.length > MAX_OUTPUT_LINE_LENGTH3 ? `${line.slice(0, MAX_OUTPUT_LINE_LENGTH3)}...` : line
-  );
+  return normalizeText(values.get("PRETTY_NAME")) ?? buildLinuxName(values);
 }
-function updateStatePath2(paths) {
-  return path24.join(paths.runDir, "link-update-state.json");
+function readHostname(platform) {
+  if (platform === "darwin") {
+    const computerName = readCommandOutput("scutil", ["--get", "ComputerName"]);
+    if (computerName) {
+      return computerName;
+    }
+  }
+  return normalizeText(os4.hostname());
 }
-function updateLogPath2(paths) {
-  return path24.join(paths.logsDir, UPDATE_LOG_FILE2);
+function readOsLabel(platform) {
+  if (platform === "darwin") {
+    const version = readCommandOutput("sw_vers", ["-productVersion"]);
+    return version ? `macOS ${version}` : "macOS";
+  }
+  if (platform === "linux") {
+    return readLinuxOsRelease() ?? `Linux ${os4.release()}`;
+  }
+  if (platform === "win32") {
+    return `Windows ${os4.release()}`;
+  }
+  return `${os4.type()} ${os4.release()}`.trim();
 }
-async function clearUpdateLogFiles2(paths) {
-  const primary = updateLogPath2(paths);
-  await Promise.all([
-    rm8(primary, { force: true }).catch(() => void 0),
-    ...Array.from(
-      { length: UPDATE_LOG_MAX_FILES2 },
-      (_, index) => rm8(`${primary}.${index + 1}`, { force: true }).catch(() => void 0)
-    )
-  ]);
-}
-function manualInstallCommand(version) {
-  return `npm install -g ${LINK_NPM_PACKAGE}@${version}`;
-}
-function isValidReleaseVersion(version) {
-  return /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u.test(
-    version
-  );
-}
-function compareSemver3(left, right) {
-  const leftParts = parseSemver(left);
-  const rightParts = parseSemver(right);
-  for (let index = 0; index < 3; index += 1) {
-    const diff = leftParts[index] - rightParts[index];
-    if (diff !== 0) {
-      return diff;
+function readLinuxOsRelease() {
+  for (const file of ["/etc/os-release", "/usr/lib/os-release"]) {
+    try {
+      return parseLinuxOsRelease(readFileSync(file, "utf8"));
+    } catch {
     }
   }
-  return 0;
-}
-function parseSemver(value) {
-  const match = /^v?(\d+)\.(\d+)\.(\d+)/u.exec(value.trim());
-  return [
-    Number.parseInt(match?.[1] ?? "0", 10),
-    Number.parseInt(match?.[2] ?? "0", 10),
-    Number.parseInt(match?.[3] ?? "0", 10)
-  ];
-}
-function isRecentRunningState3(state, now = Date.now()) {
-  const startedAt = state.started_at ? Date.parse(state.started_at) : Number.NaN;
-  return Number.isFinite(startedAt) && now - startedAt < 1e4;
+  return null;
 }
-function isProcessAlive3(pid) {
-  if (!pid || pid <= 0) {
-    return false;
-  }
+function readCommandOutput(command, args) {
   try {
-    process.kill(pid, 0);
-    return true;
+    const output = execFileSync(command, args, {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 1e3
+    });
+    return normalizeText(output);
   } catch {
-    return false;
+    return null;
   }
 }
-function toRecord17(value) {
-  return typeof value === "object" && value !== null ? value : {};
+function buildLinuxName(values) {
+  const name = normalizeText(values.get("NAME"));
+  const version = normalizeText(values.get("VERSION_ID")) ?? normalizeText(values.get("VERSION"));
+  if (name && version) {
+    return `${name} ${version}`;
+  }
+  return name ?? version;
 }
-function toNullableRecord2(value) {
-  return typeof value === "object" && value !== null ? value : null;
+function unquoteOsReleaseValue(value) {
+  const trimmed = value.trim();
+  if (trimmed.length >= 2 && (trimmed.startsWith('"') && trimmed.endsWith('"') || trimmed.startsWith("'") && trimmed.endsWith("'"))) {
+    return trimmed.slice(1, -1).replace(/\\(["'`$\\])/gu, "$1");
+  }
+  return trimmed;
 }
-function readString18(payload, key) {
-  const value = payload[key];
-  return typeof value === "string" && value.trim() ? value.trim() : null;
+function normalizeText(value) {
+  const normalized = value?.replace(/\s+/gu, " ").trim();
+  return normalized ? normalized : null;
+}
+function truncateText(value, maxLength) {
+  return value.length > maxLength ? value.slice(0, maxLength).trimEnd() : value;
 }
 
-// src/pairing/pairing.ts
-import path25 from "path";
-import { rm as rm9 } from "fs/promises";
+// src/topology/network.ts
+import os6 from "os";
 
-// src/relay/bootstrap.ts
-var RelayNetworkError = class extends Error {
-  constructor(relayBaseUrl, causeMessage) {
-    super(
-      `Cannot reach Hermes Relay at ${relayBaseUrl}. Please check your network connection, VPN, or proxy settings, then try again.`
-    );
-    this.relayBaseUrl = relayBaseUrl;
-    this.causeMessage = causeMessage;
-  }
-  relayBaseUrl;
-  causeMessage;
-};
-async function bootstrapRelayLink(options) {
-  const fetcher = options.fetchImpl ?? fetch;
-  const baseUrl = options.relayBaseUrl.replace(/\/+$/u, "");
-  const commonPayload = {
-    install_id: options.identity.install_id,
-    link_id: options.identity.link_id ?? void 0,
-    public_key_pem: options.identity.public_key_pem
-  };
-  const challenge = await postJson(
-    fetcher,
-    `${baseUrl}/api/v1/relay/link/challenge`,
-    options.relayBootstrapToken,
-    commonPayload
-  );
-  if (challenge.ok !== true || typeof challenge.nonce !== "string") {
-    throw new Error("Relay did not return a valid install challenge");
+// src/topology/environment.ts
+import { existsSync, readFileSync as readFileSync2 } from "fs";
+import os5 from "os";
+function detectRuntimeEnvironment(env = process.env) {
+  if (isWsl(env)) {
+    return {
+      kind: "wsl",
+      lanAutoDiscoveryUsable: false,
+      warning: "Detected WSL. The LAN IP found inside WSL is usually a private VM address and is not reachable from your phone. Use Relay or set `hermeslink config set lan-host <Windows LAN IP>`."
+    };
   }
-  const proof = {
-    nonce: challenge.nonce,
-    signature: signRelayNonce(options.identity, challenge.nonce)
-  };
-  const assigned = await postJson(
-    fetcher,
-    `${baseUrl}/api/v1/relay/link/bootstrap`,
-    options.relayBootstrapToken,
-    {
-      ...commonPayload,
-      proof
-    }
-  );
-  if (assigned.ok !== true || typeof assigned.link_id !== "string") {
-    throw new Error("Relay did not return a valid link_id");
+  if (isContainer(env)) {
+    return {
+      kind: "container",
+      lanAutoDiscoveryUsable: false,
+      warning: "Detected a container environment. Container LAN IPs are usually not reachable from your phone. Use Relay or set `hermeslink config set lan-host <host LAN IP>`."
+    };
   }
-  await saveAssignedLinkId(assigned.link_id, options.paths ?? resolveRuntimePaths());
   return {
-    linkId: assigned.link_id,
-    reused: assigned.reused === true
+    kind: "native",
+    lanAutoDiscoveryUsable: true,
+    warning: null
   };
 }
-async function postJson(fetcher, url, token, body) {
-  let response;
-  try {
-    response = await fetcher(url, {
-      method: "POST",
-      headers: {
-        authorization: `Bearer ${token}`,
-        "content-type": "application/json"
-      },
-      body: JSON.stringify(body)
-    });
-  } catch (error) {
-    const baseUrl = new URL(url).origin;
-    throw new RelayNetworkError(
-      baseUrl,
-      error instanceof Error ? error.message : String(error)
-    );
-  }
-  const payload = await response.json().catch(() => null);
-  if (!response.ok) {
-    const message = readErrorMessage3(payload) ?? `Relay request failed with HTTP ${response.status}`;
-    throw new Error(message);
+function isWsl(env) {
+  if (process.platform !== "linux") {
+    return false;
   }
-  if (!payload) {
-    throw new Error("Relay returned an empty response");
+  if (env.WSL_DISTRO_NAME || env.WSL_INTEROP) {
+    return true;
   }
-  return payload;
+  const release = os5.release().toLowerCase();
+  return release.includes("microsoft") || release.includes("wsl");
 }
-function readErrorMessage3(payload) {
-  if (typeof payload !== "object" || payload === null) {
-    return null;
+function isContainer(env) {
+  if (env.container || env.CONTAINER || env.KUBERNETES_SERVICE_HOST) {
+    return true;
   }
-  const error = payload.error;
-  if (typeof error !== "object" || error === null) {
-    return null;
+  if (existsSync("/.dockerenv")) {
+    return true;
+  }
+  try {
+    const cgroup = readFileSync2("/proc/1/cgroup", "utf8").toLowerCase();
+    return /docker|containerd|kubepods|libpod|podman/u.test(cgroup);
+  } catch {
+    return false;
   }
-  const message = error.message;
-  return typeof message === "string" ? message : null;
 }
 
-// src/runtime/system-info.ts
-import { execFileSync } from "child_process";
-import { readFileSync } from "fs";
-import os4 from "os";
-function readLinkSystemInfo() {
-  const platform = process.platform;
-  const hostname = readHostname(platform);
-  const osLabel = readOsLabel(platform);
-  const defaultDisplayName = buildDefaultDisplayName({ hostname, osLabel, platform });
+// src/topology/network.ts
+var VIRTUAL_INTERFACE_NAME_PATTERN = /(docker|veth|vmnet|vmenet|vbox|virtualbox|vmware|tailscale|zerotier|wireguard|utun|virbr|hyper-v|vethernet|loopback|\blo\b|^lo\d*$|^br-|^bridge\d+$|^zt|^tun|^tap|awdl|llw|anpi|gif|stf|ipsec|ppp)/iu;
+var MAX_LAN_IPS = 4;
+var MAX_PUBLIC_IPV4S = 2;
+var MAX_PUBLIC_IPV6S = 2;
+async function discoverRouteCandidates(options) {
+  const environment = detectRuntimeEnvironment();
+  const configuredLanHost = normalizeLanHost(options.configuredLanHost);
+  const lanIps = configuredLanHost ? [configuredLanHost] : environment.lanAutoDiscoveryUsable ? discoverLanIps() : [];
+  const publicIps = options.relayBootstrapToken || options.observePublicRoute ? await observePublicRoute(options).catch(() => ({ publicIpv4s: [], publicIpv6s: [] })) : { publicIpv4s: [], publicIpv6s: [] };
+  const publicIpv4s = unique(publicIps.publicIpv4s.filter(isUsablePublicIpv4)).slice(0, MAX_PUBLIC_IPV4S);
+  const publicIpv6s = unique(publicIps.publicIpv6s.filter(isUsablePublicIpv6)).slice(0, MAX_PUBLIC_IPV6S);
+  const preferredUrls = [
+    ...lanIps.map((ip) => buildDirectUrl(ip, options.port)),
+    ...publicIpv4s.map((ip) => buildDirectUrl(ip, options.port)),
+    ...publicIpv6s.map((ip) => buildDirectUrl(ip, options.port)),
+    `${options.relayBaseUrl.replace(/\/+$/u, "")}/api/v1/relay/links/${options.linkId}`
+  ];
   return {
-    platform,
-    hostname,
-    osLabel,
-    defaultDisplayName
+    lanIps,
+    publicIpv4s,
+    publicIpv6s,
+    preferredUrls,
+    environment
   };
 }
-function buildDefaultDisplayName(input) {
-  const hostname = normalizeText(input.hostname);
-  const osLabel = normalizeText(input.osLabel);
-  if (hostname) {
-    return truncateText(hostname, 128);
-  }
-  return truncateText(hostname ?? osLabel ?? `Hermes Link ${input.platform}`, 128);
+function discoverLanIps() {
+  return discoverLanIpsFromInterfaces(os6.networkInterfaces());
 }
-function parseLinuxOsRelease(content) {
-  const values = /* @__PURE__ */ new Map();
-  for (const line of content.split(/\r?\n/u)) {
-    const match = /^([A-Z0-9_]+)=(.*)$/u.exec(line.trim());
-    if (!match) {
+function discoverLanIpsFromInterfaces(interfaces) {
+  const result = /* @__PURE__ */ new Set();
+  const candidates = [];
+  for (const [name, items] of Object.entries(interfaces)) {
+    if (shouldIgnoreInterface(name)) {
       continue;
     }
-    values.set(match[1], unquoteOsReleaseValue(match[2]));
-  }
-  return normalizeText(values.get("PRETTY_NAME")) ?? buildLinuxName(values);
+    for (const item of items ?? []) {
+      if (!item.internal && item.address && item.family === "IPv4" && isUsableLanIpv42(item.address, item.netmask)) {
+        candidates.push({ name, address: item.address });
+      }
+    }
+  }
+  for (const candidate of candidates.sort(compareLanCandidate)) {
+    result.add(candidate.address);
+  }
+  return [...result].slice(0, MAX_LAN_IPS);
 }
-function readHostname(platform) {
-  if (platform === "darwin") {
-    const computerName = readCommandOutput("scutil", ["--get", "ComputerName"]);
-    if (computerName) {
-      return computerName;
+async function observePublicRoute(options) {
+  const fetcher = options.fetchImpl ?? fetch;
+  const response = await fetcher(`${options.relayBaseUrl.replace(/\/+$/u, "")}/api/v1/relay/public-route/observe`, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      ...options.relayBootstrapToken ? { authorization: `Bearer ${options.relayBootstrapToken}` } : {}
+    },
+    body: JSON.stringify({
+      install_id: options.installId,
+      link_id: options.linkId,
+      public_key_pem: options.publicKeyPem
+    })
+  });
+  const payload = await response.json().catch(() => null);
+  const record = typeof payload?.record === "object" && payload.record !== null ? payload.record : null;
+  const observed = typeof payload?.observed === "object" && payload.observed !== null ? payload.observed : null;
+  const values = [
+    readIpRecord(record?.ipv4),
+    readIpRecord(record?.ipv6),
+    typeof observed?.ip === "string" ? observed.ip : null
+  ].filter((value) => Boolean(value));
+  return {
+    publicIpv4s: unique(values.filter(isUsablePublicIpv4)),
+    publicIpv6s: unique(values.filter(isUsablePublicIpv6))
+  };
+}
+function readIpRecord(value) {
+  if (typeof value !== "object" || value === null) {
+    return null;
+  }
+  const ip = value.ip;
+  return typeof ip === "string" && ip.trim() ? ip.trim() : null;
+}
+function buildDirectUrl(ip, port) {
+  return `http://${ip.includes(":") ? `[${ip}]` : ip}:${port}`;
+}
+function shouldIgnoreInterface(name) {
+  return !name.trim() || VIRTUAL_INTERFACE_NAME_PATTERN.test(name);
+}
+function compareLanCandidate(left, right) {
+  const priority = interfacePriority(left.name) - interfacePriority(right.name);
+  return priority || left.name.localeCompare(right.name) || left.address.localeCompare(right.address);
+}
+function interfacePriority(name) {
+  if (/^(en|eth|wlan|wi-fi|wifi)/iu.test(name)) {
+    return 0;
+  }
+  return 1;
+}
+function isUsableLanIpv42(address, netmask) {
+  return isPrivateIpv4(address) && !isNetworkOrBroadcastIpv4Address(address, netmask);
+}
+function isUsablePublicIpv4(address) {
+  return isValidIpv4(address) && !isSpecialIpv4(address);
+}
+function isUsablePublicIpv6(address) {
+  const normalized = address.toLowerCase();
+  return normalized.includes(":") && !normalized.startsWith("fe80:") && !normalized.startsWith("fc") && !normalized.startsWith("fd") && !normalized.startsWith("ff") && normalized !== "::" && normalized !== "::1";
+}
+function isPrivateIpv4(address) {
+  const parts = parseIpv4Segments(address);
+  if (!parts) {
+    return false;
+  }
+  const [first, second] = parts;
+  return first === 10 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168;
+}
+function isSpecialIpv4(address) {
+  const parts = parseIpv4Segments(address);
+  if (!parts) {
+    return true;
+  }
+  const [first, second, third, fourth] = parts;
+  return first === 0 || first === 10 || first === 127 || first >= 224 || first === 100 && second >= 64 && second <= 127 || first === 169 && second === 254 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168 || first === 192 && second === 0 && third === 2 || first === 198 && (second === 18 || second === 19) || first === 198 && second === 51 && third === 100 || first === 203 && second === 0 && third === 113 || first === 255 && second === 255 && third === 255 && fourth === 255;
+}
+function isNetworkOrBroadcastIpv4Address(address, netmask) {
+  const addressParts = parseIpv4Segments(address);
+  const netmaskParts = netmask ? parseIpv4Segments(netmask) : null;
+  if (!addressParts) {
+    return true;
+  }
+  if (!netmaskParts) {
+    const last = addressParts[3];
+    return last === 0 || last === 255;
+  }
+  const addressInt = ipv4SegmentsToInt(addressParts);
+  const netmaskInt = ipv4SegmentsToInt(netmaskParts);
+  const hostMask = ~netmaskInt >>> 0;
+  if (hostMask === 0) {
+    return false;
+  }
+  const networkInt = addressInt & netmaskInt;
+  const broadcastInt = (networkInt | hostMask) >>> 0;
+  return addressInt === networkInt || addressInt === broadcastInt;
+}
+function isValidIpv4(address) {
+  return Boolean(parseIpv4Segments(address));
+}
+function parseIpv4Segments(address) {
+  if (!/^\d{1,3}(?:\.\d{1,3}){3}$/u.test(address)) {
+    return null;
+  }
+  const parts = address.split(".").map((part) => Number.parseInt(part, 10));
+  if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {
+    return null;
+  }
+  return parts;
+}
+function ipv4SegmentsToInt(parts) {
+  return (parts[0] << 24 >>> 0 | parts[1] << 16 | parts[2] << 8 | parts[3]) >>> 0;
+}
+function unique(values) {
+  return [...new Set(values)];
+}
+
+// src/link/network-report-state.ts
+var DEFAULT_AUTO_DAILY_LIMIT = 20;
+async function readNetworkReportState(paths) {
+  const state = await readLinkState(paths);
+  return normalizeNetworkReportState(state.networkReport);
+}
+async function markNetworkStatusReported(paths, snapshotInput, reportedAt = /* @__PURE__ */ new Date()) {
+  const snapshot = normalizeNetworkSnapshot(snapshotInput);
+  await updateNetworkReportState(paths, (current) => ({
+    ...current,
+    lastReportedLanIps: snapshot.lanIps,
+    lastReportedPublicIpv4s: snapshot.publicIpv4s,
+    lastReportedPublicIpv6s: snapshot.publicIpv6s,
+    lastReportedAt: reportedAt.toISOString(),
+    lastAutoAttempt: current.lastAutoAttempt ? { ...current.lastAutoAttempt, ...snapshot, success: true } : null
+  }));
+}
+async function reserveAutomaticNetworkReport(paths, snapshotInput, options = {}) {
+  const snapshot = normalizeNetworkSnapshot(snapshotInput);
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const dailyLimit = Math.max(0, Math.floor(options.dailyLimit ?? DEFAULT_AUTO_DAILY_LIMIT));
+  let reservation = { allowed: false, reason: "unchanged" };
+  await updateNetworkReportState(paths, (current) => {
+    if (sameNetworkSnapshot(readReportedSnapshot(current), snapshot)) {
+      const lastReportedAt = current.lastReportedAt ? Date.parse(current.lastReportedAt) : Number.NaN;
+      const unchangedMinIntervalMs = Math.max(0, Math.floor(options.unchangedMinIntervalMs ?? 0));
+      if (!options.force || Number.isFinite(lastReportedAt) && now.getTime() - lastReportedAt < unchangedMinIntervalMs) {
+        reservation = { allowed: false, reason: "unchanged" };
+        return current;
+      }
+    }
+    if (current.lastAutoAttempt && !current.lastAutoAttempt.success && sameNetworkSnapshot(readAttemptSnapshot(current.lastAutoAttempt), snapshot)) {
+      reservation = { allowed: false, reason: "failed_snapshot_not_retried" };
+      return current;
     }
+    const quotaDay = formatUtcDay(now);
+    const reportsToday = current.autoQuotaDay === quotaDay ? current.autoReportsToday : 0;
+    if (reportsToday >= dailyLimit) {
+      reservation = { allowed: false, reason: "daily_limit_reached" };
+      return current;
+    }
+    reservation = { allowed: true };
+    return {
+      ...current,
+      autoQuotaDay: quotaDay,
+      autoReportsToday: reportsToday + 1,
+      lastAutoAttempt: {
+        ...snapshot,
+        attemptedAt: now.toISOString(),
+        success: false
+      }
+    };
+  });
+  return reservation;
+}
+async function mergeLastReportedPublicRoutes(paths, snapshotInput) {
+  const state = await readNetworkReportState(paths);
+  return {
+    ...snapshotInput,
+    publicIpv4s: uniqueStrings([
+      ...snapshotInput.publicIpv4s,
+      ...state.lastReportedPublicIpv4s
+    ]).slice(0, 2),
+    publicIpv6s: uniqueStrings([
+      ...snapshotInput.publicIpv6s,
+      ...state.lastReportedPublicIpv6s
+    ]).slice(0, 2)
+  };
+}
+async function updateNetworkReportState(paths, update) {
+  const state = await readLinkState(paths);
+  const next = {
+    ...state,
+    networkReport: update(normalizeNetworkReportState(state.networkReport))
+  };
+  await writeJsonFile(paths.stateFile, next);
+}
+async function readLinkState(paths) {
+  const state = await readJsonFile(paths.stateFile);
+  return state && typeof state === "object" ? state : {};
+}
+function normalizeNetworkReportState(value) {
+  const record = value && typeof value === "object" ? value : {};
+  return {
+    lastReportedLanIps: normalizeLanIps(record.lastReportedLanIps),
+    lastReportedPublicIpv4s: normalizeLanIps(record.lastReportedPublicIpv4s),
+    lastReportedPublicIpv6s: normalizeLanIps(record.lastReportedPublicIpv6s),
+    lastReportedAt: typeof record.lastReportedAt === "string" ? record.lastReportedAt : null,
+    autoQuotaDay: typeof record.autoQuotaDay === "string" ? record.autoQuotaDay : null,
+    autoReportsToday: Number.isFinite(record.autoReportsToday) ? Math.max(0, Math.floor(record.autoReportsToday ?? 0)) : 0,
+    lastAutoAttempt: normalizeAttempt(record.lastAutoAttempt)
+  };
+}
+function normalizeAttempt(value) {
+  if (!value || typeof value !== "object") {
+    return null;
   }
-  return normalizeText(os4.hostname());
+  const record = value;
+  if (typeof record.attemptedAt !== "string") {
+    return null;
+  }
+  return {
+    lanIps: normalizeLanIps(record.lanIps),
+    publicIpv4s: normalizeLanIps(record.publicIpv4s),
+    publicIpv6s: normalizeLanIps(record.publicIpv6s),
+    attemptedAt: record.attemptedAt,
+    success: record.success === true
+  };
 }
-function readOsLabel(platform) {
-  if (platform === "darwin") {
-    const version = readCommandOutput("sw_vers", ["-productVersion"]);
-    return version ? `macOS ${version}` : "macOS";
+function normalizeNetworkSnapshot(value) {
+  if (Array.isArray(value)) {
+    return {
+      lanIps: normalizeLanIps(value),
+      publicIpv4s: [],
+      publicIpv6s: []
+    };
   }
-  if (platform === "linux") {
-    return readLinuxOsRelease() ?? `Linux ${os4.release()}`;
+  const record = value && typeof value === "object" ? value : {};
+  return {
+    lanIps: normalizeLanIps(record.lanIps),
+    publicIpv4s: normalizeLanIps(record.publicIpv4s),
+    publicIpv6s: normalizeLanIps(record.publicIpv6s)
+  };
+}
+function readReportedSnapshot(state) {
+  return {
+    lanIps: state.lastReportedLanIps,
+    publicIpv4s: state.lastReportedPublicIpv4s,
+    publicIpv6s: state.lastReportedPublicIpv6s
+  };
+}
+function readAttemptSnapshot(attempt) {
+  return {
+    lanIps: attempt.lanIps,
+    publicIpv4s: attempt.publicIpv4s,
+    publicIpv6s: attempt.publicIpv6s
+  };
+}
+function normalizeLanIps(value) {
+  if (!Array.isArray(value)) {
+    return [];
   }
-  if (platform === "win32") {
-    return `Windows ${os4.release()}`;
+  return [
+    ...new Set(
+      value.filter((item) => typeof item === "string" && item.trim().length > 0).map((item) => item.trim())
+    )
+  ];
+}
+function sameNetworkSnapshot(left, right) {
+  return sameStringList(left.lanIps, right.lanIps) && sameStringList(left.publicIpv4s, right.publicIpv4s) && sameStringList(left.publicIpv6s, right.publicIpv6s);
+}
+function sameStringList(left, right) {
+  if (left.length !== right.length) {
+    return false;
+  }
+  return left.every((value, index) => value === right[index]);
+}
+function uniqueStrings(values) {
+  return [...new Set(values)];
+}
+function formatUtcDay(date) {
+  return date.toISOString().slice(0, 10);
+}
+
+// src/link/server-report.ts
+async function reportLinkStatusToServer(options = {}) {
+  const paths = options.paths ?? resolveRuntimePaths();
+  const [identity, config] = await Promise.all([loadIdentity(paths), loadConfig(paths)]);
+  if (!identity?.link_id) {
+    return null;
+  }
+  const discoveredRoutes = options.routes ?? await discoverRouteCandidates({
+    port: config.port,
+    relayBaseUrl: config.relayBaseUrl,
+    linkId: identity.link_id,
+    installId: identity.install_id,
+    publicKeyPem: identity.public_key_pem,
+    observePublicRoute: true,
+    configuredLanHost: config.lanHost,
+    fetchImpl: options.fetchImpl
+  });
+  const routes = await mergeLastReportedPublicRoutes(paths, discoveredRoutes);
+  const systemInfo = readLinkSystemInfo();
+  const payload = {
+    type: "hermes_link_status_report",
+    link_id: identity.link_id,
+    install_id: identity.install_id,
+    link_version: LINK_VERSION,
+    display_name: systemInfo.defaultDisplayName,
+    platform: systemInfo.platform,
+    hostname: systemInfo.hostname ?? void 0,
+    lan_ips: routes.lanIps,
+    public_ipv4s: routes.publicIpv4s,
+    public_ipv6s: routes.publicIpv6s,
+    reported_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const signature = signIdentityPayload(identity, canonicalJson(payload));
+  const fetcher = options.fetchImpl ?? fetch;
+  const response = await fetcher(
+    `${config.serverBaseUrl.replace(/\/+$/u, "")}/api/v1/links/${encodeURIComponent(identity.link_id)}/report`,
+    {
+      method: "POST",
+      headers: {
+        accept: "application/json",
+        "content-type": "application/json"
+      },
+      body: JSON.stringify({
+        ...payload,
+        public_key_pem: identity.public_key_pem,
+        signature
+      })
+    }
+  );
+  const body = await response.json().catch(() => null);
+  if (!response.ok || !body) {
+    const message = readErrorMessage3(body) ?? `HermesPilot Server request failed with HTTP ${response.status}`;
+    throw new LinkHttpError(response.status, "server_request_failed", message);
+  }
+  await markNetworkStatusReported(paths, routes);
+  return body;
+}
+function canonicalJson(value) {
+  return JSON.stringify(sortJsonValue(value));
+}
+function sortJsonValue(value) {
+  if (Array.isArray(value)) {
+    return value.map(sortJsonValue);
+  }
+  if (value && typeof value === "object") {
+    const record = value;
+    const sorted = {};
+    for (const key of Object.keys(record).sort()) {
+      sorted[key] = sortJsonValue(record[key]);
+    }
+    return sorted;
+  }
+  return value;
+}
+function readErrorMessage3(payload) {
+  if (typeof payload !== "object" || payload === null) {
+    return null;
+  }
+  const error = payload.error;
+  if (typeof error !== "object" || error === null) {
+    return null;
+  }
+  const message = error.message;
+  return typeof message === "string" ? message : null;
+}
+
+// src/daemon/lan-ip-monitor.ts
+var DEFAULT_INTERVAL_MS = 5 * 6e4;
+var DEFAULT_DAILY_REPORT_LIMIT = 20;
+var DEFAULT_STARTUP_REPORT_MIN_INTERVAL_MS = 15 * 6e4;
+function startLanIpMonitor(options) {
+  let running = false;
+  let closed = false;
+  let current = Promise.resolve();
+  const check = async (context = {}) => {
+    if (running || closed) {
+      return;
+    }
+    running = true;
+    try {
+      await checkLanIpChange(options, context);
+    } catch (error) {
+      void options.logger.warn("lan_ip_monitor_failed", {
+        error: error instanceof Error ? error.message : String(error)
+      });
+    } finally {
+      running = false;
+    }
+  };
+  current = check({ forceReport: true, publishToRelay: true, observePublicRoute: true });
+  const timer = setInterval(() => {
+    current = check({ observePublicRoute: false });
+  }, options.intervalMs ?? DEFAULT_INTERVAL_MS);
+  timer.unref?.();
+  return {
+    async refreshPublicRoutes() {
+      current = check({ forceReport: true, publishToRelay: true, observePublicRoute: true });
+      await current;
+    },
+    async close() {
+      closed = true;
+      clearInterval(timer);
+      await current.catch(() => void 0);
+    }
+  };
+}
+async function checkLanIpChange(options, context = {}) {
+  const [identity, config] = await Promise.all([
+    loadIdentity(options.paths),
+    loadConfig(options.paths)
+  ]);
+  if (!identity?.link_id) {
+    return;
+  }
+  const discoveredRoutes = await discoverRouteCandidates({
+    port: config.port,
+    relayBaseUrl: config.relayBaseUrl,
+    linkId: identity.link_id,
+    installId: identity.install_id,
+    publicKeyPem: identity.public_key_pem,
+    observePublicRoute: context.observePublicRoute === true,
+    configuredLanHost: config.lanHost,
+    fetchImpl: options.fetchImpl
+  });
+  const routes = await mergeLastReportedPublicRoutes(options.paths, discoveredRoutes);
+  if (context.publishToRelay) {
+    options.onNetworkRoutes?.(routes);
+  }
+  const reservation = await reserveAutomaticNetworkReport(options.paths, routes, {
+    dailyLimit: options.dailyReportLimit ?? DEFAULT_DAILY_REPORT_LIMIT,
+    force: context.forceReport === true,
+    unchangedMinIntervalMs: options.startupReportMinIntervalMs ?? DEFAULT_STARTUP_REPORT_MIN_INTERVAL_MS
+  });
+  if (!reservation.allowed) {
+    const logFields = {
+      lan_ips: routes.lanIps,
+      public_ipv4s: routes.publicIpv4s,
+      public_ipv6s: routes.publicIpv6s,
+      reason: reservation.reason
+    };
+    void options.logger.debug("lan_ip_report_skipped", logFields);
+    return;
+  }
+  try {
+    const result = await reportLinkStatusToServer({
+      paths: options.paths,
+      fetchImpl: options.fetchImpl,
+      routes
+    });
+    if (result) {
+      options.onNetworkRoutes?.(routes);
+      void options.logger.info("lan_ip_change_reported", {
+        link_id: result.linkId,
+        lan_ips: routes.lanIps,
+        public_ipv4s: routes.publicIpv4s,
+        public_ipv6s: routes.publicIpv6s
+      });
+    }
+  } catch (error) {
+    void options.logger.warn("lan_ip_change_report_failed", {
+      lan_ips: routes.lanIps,
+      error: error instanceof Error ? error.message : String(error)
+    });
+  }
+}
+
+// src/daemon/scheduler.ts
+function startCronDeliveryScheduler(options) {
+  let running = false;
+  let current = Promise.resolve();
+  const syncCronDeliveries = async () => {
+    if (running) {
+      return;
+    }
+    running = true;
+    try {
+      await syncHermesLinkCronDeliveries(
+        options.paths,
+        options.conversations,
+        options.logger
+      );
+    } catch (error) {
+      void options.logger.warn("cron_link_delivery_sync_failed", {
+        source: "daemon_scheduler",
+        error: error instanceof Error ? error.message : String(error)
+      });
+    } finally {
+      running = false;
+    }
+  };
+  const timer = setInterval(() => {
+    current = syncCronDeliveries();
+  }, options.intervalMs ?? 3e4);
+  timer.unref?.();
+  return {
+    async close() {
+      clearInterval(timer);
+      await current.catch(() => void 0);
+    }
+  };
+}
+function startHermesSessionSyncScheduler(options) {
+  let running = false;
+  let current = Promise.resolve();
+  const syncSessions = async () => {
+    if (running) {
+      return;
+    }
+    running = true;
+    try {
+      await options.conversations.syncHermesSessions();
+    } catch (error) {
+      void options.logger.warn("hermes_session_sync_failed", {
+        source: "daemon_scheduler",
+        error: error instanceof Error ? error.message : String(error)
+      });
+    } finally {
+      running = false;
+    }
+  };
+  const timer = setInterval(() => {
+    current = syncSessions();
+  }, options.intervalMs ?? 10 * 60 * 1e3);
+  timer.unref?.();
+  return {
+    async close() {
+      clearInterval(timer);
+      await current.catch(() => void 0);
+    }
+  };
+}
+
+// src/daemon/service.ts
+var DEFAULT_RELAY_READY_TIMEOUT_MS = 2e3;
+var RELAY_RECONNECT_PUBLIC_ROUTE_REFRESH_MIN_INTERVAL_MS = 15 * 6e4;
+async function startLinkService(options = {}) {
+  const paths = options.paths ?? resolveRuntimePaths();
+  const [identity, config] = await Promise.all([loadIdentity(paths), loadConfig(paths)]);
+  const logger = createFileLogger({ paths, minLevel: config.logLevel });
+  await logger.info("service_starting", {
+    port: config.port,
+    mode: identity?.link_id ? "paired" : "local-only"
+  });
+  const migration = await migrateLinkDatabase(paths);
+  if (migration.appliedVersions.length > 0) {
+    await logger.info("database_migrated", {
+      database_file: migration.databaseFile,
+      applied_versions: migration.appliedVersions,
+      current_version: migration.currentVersion
+    });
+  }
+  const conversations = new ConversationService(paths, logger);
+  await conversations.rebuildStatisticsIndex();
+  let relay = null;
+  let lanIpMonitor = null;
+  const loadRelayStreamBatchPolicy = async (source) => {
+    const streamBatchPolicy = await fetchRelayStreamBatchPolicy(config.serverBaseUrl);
+    if (!streamBatchPolicy) {
+      return null;
+    }
+    relay?.updateStreamBatchPolicy(streamBatchPolicy);
+    void logger.info("relay_stream_policy_loaded", {
+      source,
+      flushIntervalMs: streamBatchPolicy.flushIntervalMs,
+      flushBytes: streamBatchPolicy.flushBytes
+    });
+    return streamBatchPolicy;
+  };
+  let hermesSessionSync = Promise.resolve();
+  const triggerHermesSessionSync = () => {
+    hermesSessionSync = Promise.resolve().then(() => conversations.syncHermesSessions()).then(() => void 0).catch((error) => {
+      void logger.warn("hermes_session_sync_failed", {
+        source: "service_startup",
+        error: error instanceof Error ? error.message : String(error)
+      });
+    });
+  };
+  const app = await createApp({
+    paths,
+    logger,
+    conversations,
+    onPairingClaimed: async () => {
+      triggerHermesSessionSync();
+      void loadRelayStreamBatchPolicy("pairing_claimed");
+      await options.onPairingClaimed?.();
+    }
+  });
+  const server = createServer(app.callback());
+  try {
+    await listenServer(server, config.port);
+  } catch (error) {
+    await logger.error("service_start_failed", {
+      port: config.port,
+      link_id: identity?.link_id ?? null,
+      error: error instanceof Error ? error.message : String(error)
+    });
+    await logger.flush();
+    throw error;
+  }
+  server.on("error", (error) => {
+    void logger.error("service_error", {
+      port: config.port,
+      link_id: identity?.link_id ?? null,
+      error: error.message
+    });
+  });
+  void logger.info("service_started", {
+    port: config.port,
+    link_id: identity?.link_id ?? null
+  });
+  triggerHermesSessionSync();
+  const scheduler = startCronDeliveryScheduler({
+    paths,
+    conversations,
+    logger
+  });
+  const hermesSessionSyncScheduler = startHermesSessionSyncScheduler({
+    conversations,
+    logger
+  });
+  let hasSeenRelayConnected = false;
+  let lastRelayReconnectPublicRouteRefreshAt = 0;
+  if (identity?.link_id) {
+    let resolveRelayReady = null;
+    const relayReady = new Promise((resolve) => {
+      resolveRelayReady = resolve;
+    });
+    relay = connectRelayControl({
+      relayBaseUrl: config.relayBaseUrl,
+      linkId: identity.link_id,
+      localPort: config.port,
+      maxReconnectAttempts: options.relayMaxReconnectAttempts ?? 5,
+      backoffBaseMs: 1e3,
+      backoffMaxMs: 3e4,
+      onStreamBatchPolicy: (policy) => {
+        void logger.info("relay_stream_policy_updated", {
+          flushIntervalMs: policy.flushIntervalMs,
+          flushBytes: policy.flushBytes
+        });
+      },
+      onStatus: (status) => {
+        void logger.info("relay_status", status);
+        if (status.state === "connected") {
+          const now = Date.now();
+          if (hasSeenRelayConnected && lanIpMonitor && now - lastRelayReconnectPublicRouteRefreshAt >= RELAY_RECONNECT_PUBLIC_ROUTE_REFRESH_MIN_INTERVAL_MS) {
+            lastRelayReconnectPublicRouteRefreshAt = now;
+            void lanIpMonitor.refreshPublicRoutes();
+          }
+          hasSeenRelayConnected = true;
+          resolveRelayReady?.(true);
+          resolveRelayReady = null;
+        } else if (status.state === "failed") {
+          resolveRelayReady?.(false);
+          resolveRelayReady = null;
+        }
+      }
+    });
+    void loadRelayStreamBatchPolicy("service_startup");
+    if (options.waitForRelayReady) {
+      await Promise.race([
+        relayReady,
+        waitForRelayReadyTimeout(options.relayReadyTimeoutMs)
+      ]);
+      resolveRelayReady = null;
+    }
+  } else {
+    void logger.info("relay_skipped", { reason: "link_not_paired" });
+  }
+  lanIpMonitor = startLanIpMonitor({
+    paths,
+    logger,
+    intervalMs: options.lanIpMonitorIntervalMs,
+    dailyReportLimit: options.lanIpMonitorDailyReportLimit,
+    fetchImpl: options.lanIpMonitorFetchImpl,
+    onNetworkRoutes: (routes) => {
+      relay?.publishNetworkRoutes(routes);
+    }
+  });
+  if (options.writePidFile) {
+    await writePidFile(paths);
+  }
+  return {
+    async close() {
+      relay?.close();
+      await closeServer(server);
+      await Promise.all([
+        scheduler.close(),
+        hermesSessionSyncScheduler.close(),
+        lanIpMonitor?.close(),
+        hermesSessionSync.catch(() => void 0)
+      ]);
+      await logger.info("service_stopped");
+      await logger.flush();
+      if (options.writePidFile) {
+        await rm8(pidFilePath(paths), { force: true }).catch(() => void 0);
+      }
+    }
+  };
+}
+function waitForRelayReadyTimeout(timeoutMs) {
+  return new Promise((resolve) => {
+    const timer = setTimeout(
+      () => resolve(false),
+      timeoutMs ?? DEFAULT_RELAY_READY_TIMEOUT_MS
+    );
+    timer.unref?.();
+  });
+}
+function pidFilePath(paths = resolveRuntimePaths()) {
+  return `${paths.runDir}/hermeslink.pid`;
+}
+async function writePidFile(paths) {
+  await mkdir13(paths.runDir, { recursive: true, mode: 448 });
+  await writeFile3(pidFilePath(paths), `${process.pid}
+`, { mode: 384 });
+}
+async function closeServer(server) {
+  await new Promise((resolve, reject) => {
+    let settled = false;
+    let forceCloseTimer;
+    let timeoutTimer;
+    const settle = (error) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      clearTimeout(forceCloseTimer);
+      clearTimeout(timeoutTimer);
+      if (error) {
+        reject(error);
+        return;
+      }
+      resolve();
+    };
+    forceCloseTimer = setTimeout(() => {
+      server.closeIdleConnections?.();
+      server.closeAllConnections?.();
+    }, 250);
+    timeoutTimer = setTimeout(() => {
+      server.closeAllConnections?.();
+      settle();
+    }, 5e3);
+    server.close((error) => {
+      if (error) {
+        settle(error);
+        return;
+      }
+      settle();
+    });
+    server.closeIdleConnections?.();
+  });
+}
+async function listenServer(server, port) {
+  await new Promise((resolve, reject) => {
+    const cleanup = () => {
+      server.off("error", onError);
+      server.off("listening", onListening);
+    };
+    const onError = (error) => {
+      cleanup();
+      reject(error);
+    };
+    const onListening = () => {
+      cleanup();
+      resolve();
+    };
+    server.once("error", onError);
+    server.once("listening", onListening);
+    server.listen(port);
+  });
+}
+
+// src/daemon/process.ts
+async function startDaemonProcess(paths = resolveRuntimePaths()) {
+  const config = await loadConfig(paths);
+  let status = await getDaemonStatus(paths);
+  if (status.running) {
+    const probe = await probeLocalLinkService({ port: config.port, timeoutMs: 500 });
+    if (probe.reachable) {
+      return status;
+    }
+    await stopDaemonProcess(paths);
+    status = await getDaemonStatus(paths);
+    if (status.running) {
+      return status;
+    }
+  }
+  await mkdir14(paths.logsDir, { recursive: true, mode: 448 });
+  await mkdir14(paths.runDir, { recursive: true, mode: 448 });
+  const scriptPath = currentCliScriptPath();
+  const child = spawn4(process.execPath, [scriptPath, "daemon-supervisor"], {
+    detached: true,
+    stdio: "ignore",
+    env: process.env
+  });
+  child.unref();
+  for (let index = 0; index < 12; index += 1) {
+    await wait(250);
+    const next = await getDaemonStatus(paths);
+    if (next.running && (await probeLocalLinkService({ port: config.port, timeoutMs: 500 })).reachable) {
+      return next;
+    }
+  }
+  return await getDaemonStatus(paths);
+}
+async function runDaemonSupervisor(paths = resolveRuntimePaths()) {
+  await mkdir14(paths.logsDir, { recursive: true, mode: 448 });
+  const log = createRotatingTextLogWriter({
+    paths,
+    fileName: path24.basename(daemonLogFile(paths))
+  });
+  const scriptPath = currentCliScriptPath();
+  const child = spawn4(process.execPath, [scriptPath, "daemon", "--foreground"], {
+    stdio: ["ignore", "pipe", "pipe"],
+    env: process.env
+  });
+  const write = (chunk) => {
+    void log.write(chunk);
+  };
+  write(`[${(/* @__PURE__ */ new Date()).toISOString()}] daemon supervisor started
+`);
+  child.stdout?.on("data", write);
+  child.stderr?.on("data", write);
+  const forwardStop = () => {
+    if (child.pid && isProcessAlive3(child.pid)) {
+      child.kill("SIGTERM");
+    }
+  };
+  process.once("SIGINT", forwardStop);
+  process.once("SIGTERM", forwardStop);
+  const result = await new Promise((resolve, reject) => {
+    child.once("error", reject);
+    child.once("exit", (code, signal) => resolve({ code, signal }));
+  }).catch((error) => {
+    write(`[${(/* @__PURE__ */ new Date()).toISOString()}] daemon supervisor failed: ${error instanceof Error ? error.message : String(error)}
+`);
+    return { code: 1, signal: null };
+  });
+  process.off("SIGINT", forwardStop);
+  process.off("SIGTERM", forwardStop);
+  write(
+    `[${(/* @__PURE__ */ new Date()).toISOString()}] daemon supervisor stopped code=${result.code ?? "null"} signal=${result.signal ?? "null"}
+`
+  );
+  await log.flush();
+  return result.code ?? (result.signal ? 0 : 1);
+}
+async function probeLocalLinkService(options) {
+  const unreachable = {
+    reachable: false,
+    reusable: false,
+    linkId: null,
+    version: null
+  };
+  let response;
+  try {
+    response = await fetch(`http://127.0.0.1:${options.port}/api/v1/bootstrap`, {
+      headers: { accept: "application/json" },
+      signal: AbortSignal.timeout(options.timeoutMs ?? 1e3)
+    });
+  } catch {
+    return unreachable;
+  }
+  if (!response.ok) {
+    return unreachable;
+  }
+  const payload = await response.json().catch(() => null);
+  if (!payload || payload.api_version !== 1) {
+    return unreachable;
+  }
+  const linkId = typeof payload.link_id === "string" ? payload.link_id : null;
+  return {
+    reachable: true,
+    reusable: options.linkId ? linkId === options.linkId : true,
+    linkId,
+    version: typeof payload.version === "string" ? payload.version : null
+  };
+}
+async function stopDaemonProcess(paths = resolveRuntimePaths()) {
+  const status = await getDaemonStatus(paths);
+  if (!status.running || !status.pid) {
+    return status;
+  }
+  try {
+    process.kill(status.pid, "SIGTERM");
+  } catch {
+    await rm9(pidFilePath(paths), { force: true }).catch(() => void 0);
+    return await getDaemonStatus(paths);
+  }
+  for (let index = 0; index < 20; index += 1) {
+    await wait(250);
+    if (!isProcessAlive3(status.pid)) {
+      break;
+    }
+  }
+  if (isProcessAlive3(status.pid)) {
+    try {
+      process.kill(status.pid, "SIGKILL");
+    } catch {
+    }
+    for (let index = 0; index < 10; index += 1) {
+      await wait(250);
+      if (!isProcessAlive3(status.pid)) {
+        break;
+      }
+    }
+  }
+  if (!isProcessAlive3(status.pid) || !await pidBackedServiceIsReachable(paths)) {
+    await rm9(pidFilePath(paths), { force: true }).catch(() => void 0);
+  }
+  return await getDaemonStatus(paths);
+}
+async function getDaemonStatus(paths = resolveRuntimePaths()) {
+  const pidFile = pidFilePath(paths);
+  const pid = await readPid(pidFile);
+  if (pid && !isProcessAlive3(pid)) {
+    await rm9(pidFile, { force: true }).catch(() => void 0);
+    return {
+      running: false,
+      pid: null,
+      pidFile,
+      logFile: daemonLogFile(paths)
+    };
+  }
+  return {
+    running: Boolean(pid),
+    pid,
+    pidFile,
+    logFile: daemonLogFile(paths)
+  };
+}
+function daemonLogFile(paths = resolveRuntimePaths()) {
+  return getDaemonLogFile(paths);
+}
+function currentCliScriptPath() {
+  return process.argv[1];
+}
+async function readPid(filePath) {
+  const raw = await readFile17(filePath, "utf8").catch(() => null);
+  if (!raw) {
+    return null;
+  }
+  const pid = Number.parseInt(raw.trim(), 10);
+  return Number.isInteger(pid) && pid > 0 ? pid : null;
+}
+function isProcessAlive3(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function pidBackedServiceIsReachable(paths) {
+  const config = await loadConfig(paths).catch(() => null);
+  if (!config) {
+    return false;
+  }
+  return (await probeLocalLinkService({ port: config.port, timeoutMs: 500 })).reachable;
+}
+function wait(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// src/link/updates.ts
+var SERVER_LINK_CURRENT_RELEASE_PATH = "/api/v1/link/releases/current";
+var SERVER_LINK_INSTALL_SCRIPTS_PATH = "/api/v1/link/install-scripts";
+var LINK_NPM_PACKAGE = "@hermespilot/link";
+var OFFICIAL_INSTALLER_BASE_URL = "https://hs.clawpilot.me/install";
+var OFFICIAL_UNIX_INSTALLER_URL = `${OFFICIAL_INSTALLER_BASE_URL}/install.sh`;
+var OFFICIAL_WINDOWS_INSTALLER_URL = `${OFFICIAL_INSTALLER_BASE_URL}/install.ps1`;
+var UPDATE_LOG_FILE2 = "link-update.log";
+var UPDATE_LOG_MAX_FILES2 = 3;
+var UPDATE_FETCH_TIMEOUT_MS = 5e3;
+var MAX_UPDATE_LOG_LINES2 = 240;
+var MAX_OUTPUT_LINE_LENGTH3 = 1200;
+var AUTO_RESTART_DELAY_MS = 1500;
+var RUNNING_STATE_GRACE_MS = 1e4;
+var LINK_UPDATE_TIMEOUT_MS = 15 * 60 * 1e3;
+var updateEvents2 = new EventEmitter4();
+var runningUpdate2 = null;
+async function readLinkUpdateCheck(options) {
+  const remoteResult = await readRemoteLinkPolicy(options);
+  const remote = remoteResult.remote;
+  const state = computeLinkUpdateState(LINK_VERSION, remote);
+  const targetVersion = remote?.target_version ?? null;
+  return {
+    ok: true,
+    local: {
+      version: LINK_VERSION,
+      raw: LINK_VERSION
+    },
+    remote,
+    state,
+    update_available: state === "update_available" || state === "unsafe" || state === "blocked",
+    unsafe: state === "unsafe",
+    blocked: state === "blocked",
+    check_state: remoteResult.state,
+    issue: remoteResult.issue,
+    manual: {
+      command: targetVersion ? manualInstallCommand(targetVersion) : null,
+      package: LINK_NPM_PACKAGE,
+      version: targetVersion
+    }
+  };
+}
+async function startLinkUpdate(options) {
+  const current = await readLinkUpdateStatus(options.paths);
+  if (runningUpdate2 || current.state === "running") {
+    return current;
+  }
+  const check = await readLinkUpdateCheck(options);
+  const targetVersion = check.remote?.target_version ?? null;
+  if (!targetVersion) {
+    return writeFailedStartState(
+      options,
+      "HermesPilot Server has no Link target version."
+    );
+  }
+  if (!isValidReleaseVersion(targetVersion)) {
+    return writeFailedStartState(
+      options,
+      `HermesPilot Server returned invalid Link target version: ${targetVersion}.`,
+      targetVersion
+    );
+  }
+  if (options.targetVersion && options.targetVersion !== targetVersion) {
+    return writeFailedStartState(
+      options,
+      `Requested target ${options.targetVersion} does not match current Link target ${targetVersion}.`,
+      targetVersion
+    );
+  }
+  if (check.state === "current") {
+    return writeFailedStartState(
+      options,
+      "Hermes Link is already on the current version.",
+      targetVersion
+    );
+  }
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  const jobId = `link_update_${now().getTime().toString(36)}`;
+  await clearUpdateLogFiles2(options.paths);
+  const writer = createRotatingTextLogWriter({
+    paths: options.paths,
+    fileName: UPDATE_LOG_FILE2,
+    maxFileBytes: 512 * 1024,
+    maxFiles: UPDATE_LOG_MAX_FILES2
+  });
+  const startedAt = now().toISOString();
+  const installCommand = await buildOfficialInstallCommand(options, targetVersion);
+  const manualCommand = installCommand.displayCommand;
+  const started = {
+    state: "running",
+    job_id: jobId,
+    pid: null,
+    target_version: targetVersion,
+    started_at: startedAt,
+    finished_at: null,
+    exit_code: null,
+    signal: null,
+    error: null,
+    manual_command: manualCommand
+  };
+  await mkdir15(options.paths.runDir, { recursive: true, mode: 448 });
+  await writer.write(
+    `
+=== link update started ${startedAt} target=${targetVersion} ===
+`
+  );
+  await writer.write(`$ ${manualCommand}
+`);
+  await writeUpdateState2(options.paths, started);
+  if (process.platform === "win32") {
+    await writer.write(
+      "[windows-updater] A detached updater will stop Hermes Link before replacing the npm package, then start it again.\n"
+    );
+    await writer.flush();
+    const child2 = spawnWindowsDetachedUpdater({
+      installCommand,
+      statePath: updateStatePath2(options.paths),
+      logPath: writer.filePath,
+      jobId,
+      targetVersion,
+      startedAt,
+      manualCommand
+    });
+    started.pid = child2.pid ?? null;
+    await writeUpdateState2(options.paths, started);
+    child2.on("error", (error) => {
+      void (async () => {
+        const failed = {
+          ...started,
+          state: "failed",
+          finished_at: now().toISOString(),
+          error: error.message
+        };
+        await writer.write(
+          `
+[failed] Windows detached updater failed to start: ${error.message}
+`
+        );
+        await writeUpdateState2(options.paths, failed);
+        await emitUpdateStatus2(options.paths);
+      })();
+    });
+    await emitUpdateStatus2(options.paths);
+    void options.logger?.info("link_update_started", {
+      job_id: jobId,
+      pid: child2.pid ?? null,
+      target_version: targetVersion,
+      log_path: writer.filePath,
+      strategy: "windows_detached_updater"
+    });
+    return readLinkUpdateStatus(options.paths);
+  }
+  const child = spawnInstallCommand(installCommand);
+  started.pid = child.pid ?? null;
+  await writeUpdateState2(options.paths, started);
+  const appendChunk = async (chunk) => {
+    await writer.write(chunk);
+    await emitUpdateStatus2(options.paths);
+  };
+  child.stdout?.on("data", (chunk) => {
+    void appendChunk(chunk);
+  });
+  child.stderr?.on("data", (chunk) => {
+    void appendChunk(chunk);
+  });
+  let timedOut = false;
+  const timeoutTimer = setTimeout(() => {
+    timedOut = true;
+    void (async () => {
+      const failed = {
+        ...started,
+        state: "failed",
+        finished_at: now().toISOString(),
+        error: linkUpdateTimeoutError()
+      };
+      await writer.write(`
+[failed] ${failed.error}
+`);
+      await writeUpdateState2(options.paths, failed);
+      await emitUpdateStatus2(options.paths);
+      if (!child.killed) {
+        child.kill("SIGTERM");
+      }
+      void options.logger?.error("link_update_timed_out", {
+        job_id: jobId,
+        target_version: targetVersion,
+        timeout_ms: LINK_UPDATE_TIMEOUT_MS
+      });
+    })();
+  }, LINK_UPDATE_TIMEOUT_MS);
+  timeoutTimer.unref();
+  runningUpdate2 = new Promise((resolve) => {
+    child.on("error", (error) => {
+      void (async () => {
+        clearTimeout(timeoutTimer);
+        const failed = {
+          ...started,
+          state: "failed",
+          finished_at: now().toISOString(),
+          error: error.message
+        };
+        await writer.write(
+          `
+[failed] link update failed to start: ${error.message}
+`
+        );
+        await writeUpdateState2(options.paths, failed);
+        await emitUpdateStatus2(options.paths);
+        void options.logger?.error("link_update_spawn_failed", {
+          job_id: jobId,
+          target_version: targetVersion,
+          error: error.message
+        });
+        resolve(await readLinkUpdateStatus(options.paths));
+      })();
+    });
+    child.on("close", (code, signal) => {
+      void (async () => {
+        clearTimeout(timeoutTimer);
+        const succeeded = code === 0;
+        const state = {
+          ...started,
+          state: succeeded ? "restart_required" : "failed",
+          finished_at: now().toISOString(),
+          exit_code: code,
+          signal,
+          error: succeeded ? null : timedOut ? linkUpdateTimeoutError() : `install script exited with code ${code ?? "unknown"}`
+        };
+        await writer.write(
+          `
+=== link update finished ${state.finished_at} exit=${code ?? "null"} signal=${signal ?? "null"} ===
+`
+        );
+        if (succeeded) {
+          await writer.write(
+            `
+[restart-scheduled] Hermes Link will restart automatically. If it does not reconnect, run \`${LINK_COMMAND} restart\` on this computer.
+`
+          );
+        }
+        await writeUpdateState2(options.paths, state);
+        await emitUpdateStatus2(options.paths);
+        if (succeeded) {
+          await writer.flush();
+          scheduleAutomaticRestart(options);
+        }
+        void options.logger?.info(
+          succeeded ? "link_update_restart_required" : "link_update_failed",
+          {
+            job_id: jobId,
+            target_version: targetVersion,
+            exit_code: code,
+            signal: signal ?? null
+          }
+        );
+        resolve(await readLinkUpdateStatus(options.paths));
+      })();
+    });
+  }).finally(() => {
+    runningUpdate2 = null;
+  });
+  await emitUpdateStatus2(options.paths);
+  void options.logger?.info("link_update_started", {
+    job_id: jobId,
+    pid: child.pid ?? null,
+    target_version: targetVersion,
+    log_path: writer.filePath
+  });
+  return readLinkUpdateStatus(options.paths);
+}
+function scheduleAutomaticRestart(options) {
+  const scriptPath = currentCliScriptPath();
+  setTimeout(() => {
+    const child = spawn5(process.execPath, [scriptPath, "restart"], {
+      detached: true,
+      stdio: "ignore",
+      env: process.env,
+      windowsHide: true
+    });
+    child.unref();
+    void options.logger?.info("link_update_restart_scheduled", {
+      delay_ms: AUTO_RESTART_DELAY_MS,
+      command: `${LINK_COMMAND} restart`
+    });
+  }, AUTO_RESTART_DELAY_MS).unref();
+}
+async function readLinkUpdateStatus(paths) {
+  let state = await readJsonFile(updateStatePath2(paths));
+  if ((state?.state === "running" || state?.state === "restart_required") && state.target_version && compareSemver3(LINK_VERSION, state.target_version) >= 0) {
+    state = {
+      ...state,
+      state: "succeeded",
+      finished_at: state.finished_at ?? (/* @__PURE__ */ new Date()).toISOString(),
+      error: null
+    };
+    await writeUpdateState2(paths, state);
+  }
+  if (state?.state === "running" && isRunningStateTimedOut(state)) {
+    const reachedTarget = state.target_version && compareSemver3(LINK_VERSION, state.target_version) >= 0;
+    state = reachedTarget ? {
+      ...state,
+      state: "succeeded",
+      finished_at: (/* @__PURE__ */ new Date()).toISOString(),
+      error: null
+    } : {
+      ...state,
+      state: "failed",
+      finished_at: (/* @__PURE__ */ new Date()).toISOString(),
+      error: state.error ?? linkUpdateTimeoutError()
+    };
+    await writeUpdateState2(paths, state);
+  }
+  if (state?.state === "running" && !runningUpdate2 && !isRecentRunningState3(state) && !isProcessAlive4(state.pid)) {
+    const reachedTarget = state.target_version && compareSemver3(LINK_VERSION, state.target_version) >= 0;
+    state = reachedTarget ? {
+      ...state,
+      state: "succeeded",
+      finished_at: (/* @__PURE__ */ new Date()).toISOString(),
+      error: null
+    } : {
+      ...state,
+      state: "failed",
+      finished_at: (/* @__PURE__ */ new Date()).toISOString(),
+      error: state.error ?? "Link update was interrupted before Hermes Link could observe completion."
+    };
+    await writeUpdateState2(paths, state);
+  }
+  return {
+    ok: true,
+    state: state?.state ?? "idle",
+    job_id: state?.job_id ?? null,
+    pid: state?.pid ?? null,
+    target_version: state?.target_version ?? null,
+    started_at: state?.started_at ?? null,
+    finished_at: state?.finished_at ?? null,
+    exit_code: state?.exit_code ?? null,
+    signal: state?.signal ?? null,
+    log_path: updateLogPath2(paths),
+    lines: await readUpdateLogLines2(paths),
+    error: state?.error ?? null,
+    manual_command: state?.manual_command ?? null
+  };
+}
+function subscribeLinkUpdateStatus(listener) {
+  updateEvents2.on("status", listener);
+  return () => updateEvents2.off("status", listener);
+}
+async function writeFailedStartState(options, error, targetVersion = null) {
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  const state = {
+    state: "failed",
+    job_id: `link_update_${now().getTime().toString(36)}`,
+    pid: null,
+    target_version: targetVersion,
+    started_at: now().toISOString(),
+    finished_at: now().toISOString(),
+    exit_code: null,
+    signal: null,
+    error,
+    manual_command: targetVersion ? manualInstallCommand(targetVersion) : null
+  };
+  await writeUpdateState2(options.paths, state);
+  await emitUpdateStatus2(options.paths);
+  return readLinkUpdateStatus(options.paths);
+}
+async function readRemoteLinkPolicy(options) {
+  const context = await readLinkReleaseCheckContext(options.paths).catch(
+    () => null
+  );
+  try {
+    const response = await fetchCurrentLinkReleaseFromServer(
+      options,
+      options.fetchImpl ?? fetch
+    );
+    if (!response.ok) {
+      throw new Error(`HermesPilot Server returned HTTP ${response.status}`);
+    }
+    const snapshot = normalizeServerSnapshot(await response.json());
+    if (!snapshot.remote) {
+      return {
+        remote: null,
+        state: "unavailable",
+        issue: snapshot.issue ?? "HermesPilot Server has no Link release policy"
+      };
+    }
+    return {
+      remote: snapshot.remote,
+      state: "fresh",
+      issue: snapshot.issue
+    };
+  } catch (error) {
+    const issue = error instanceof Error ? error.message : String(error);
+    void options.logger?.warn("link_release_server_check_failed", {
+      server_base_url: context?.serverBaseUrl ?? null,
+      release_check_url: context?.releaseCheckUrl ?? null,
+      error: issue
+    });
+    return { remote: null, state: "unavailable", issue };
   }
-  return `${os4.type()} ${os4.release()}`.trim();
 }
-function readLinuxOsRelease() {
-  for (const file of ["/etc/os-release", "/usr/lib/os-release"]) {
-    try {
-      return parseLinuxOsRelease(readFileSync(file, "utf8"));
-    } catch {
-    }
+function normalizeServerSnapshot(payload) {
+  const snapshot = toRecord17(payload);
+  const policy = toNullableRecord2(snapshot.policy);
+  if (!policy) {
+    return {
+      remote: null,
+      issue: readString18(snapshot, "issue")
+    };
   }
-  return null;
+  const release = toNullableRecord2(snapshot.release);
+  const currentVersion = readString18(policy, "current_version") ?? readString18(policy, "currentVersion");
+  const minSafeVersion = readString18(policy, "min_safe_version") ?? readString18(policy, "minSafeVersion");
+  if (!currentVersion) {
+    return {
+      remote: null,
+      issue: readString18(snapshot, "issue")
+    };
+  }
+  return {
+    remote: {
+      current_version: currentVersion,
+      min_safe_version: minSafeVersion,
+      target_version: currentVersion,
+      release_url: release ? readString18(release, "release_url") ?? readString18(release, "releaseUrl") : null,
+      published_at: release ? readString18(release, "published_at") ?? readString18(release, "publishedAt") : null
+    },
+    issue: readString18(snapshot, "issue")
+  };
 }
-function readCommandOutput(command, args) {
+async function fetchCurrentLinkReleaseFromServer(options, fetcher) {
+  const config = await loadConfig(options.paths);
+  const url = new URL(SERVER_LINK_CURRENT_RELEASE_PATH, config.serverBaseUrl);
+  url.searchParams.set("channel", "stable");
+  url.searchParams.set("lang", "en");
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), UPDATE_FETCH_TIMEOUT_MS);
   try {
-    const output = execFileSync(command, args, {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"],
-      timeout: 1e3
+    return await fetcher(url, {
+      headers: {
+        accept: "application/json",
+        "user-agent": `HermesPilot-Link/${LINK_VERSION}`
+      },
+      signal: controller.signal
     });
-    return normalizeText(output);
-  } catch {
-    return null;
-  }
-}
-function buildLinuxName(values) {
-  const name = normalizeText(values.get("NAME"));
-  const version = normalizeText(values.get("VERSION_ID")) ?? normalizeText(values.get("VERSION"));
-  if (name && version) {
-    return `${name} ${version}`;
-  }
-  return name ?? version;
-}
-function unquoteOsReleaseValue(value) {
-  const trimmed = value.trim();
-  if (trimmed.length >= 2 && (trimmed.startsWith('"') && trimmed.endsWith('"') || trimmed.startsWith("'") && trimmed.endsWith("'"))) {
-    return trimmed.slice(1, -1).replace(/\\(["'`$\\])/gu, "$1");
+  } catch (error) {
+    if (error instanceof Error && error.name === "AbortError") {
+      throw new Error("HermesPilot Server Link release check timed out");
+    }
+    throw error;
+  } finally {
+    clearTimeout(timer);
   }
-  return trimmed;
-}
-function normalizeText(value) {
-  const normalized = value?.replace(/\s+/gu, " ").trim();
-  return normalized ? normalized : null;
-}
-function truncateText(value, maxLength) {
-  return value.length > maxLength ? value.slice(0, maxLength).trimEnd() : value;
 }
-
-// src/topology/network.ts
-import os6 from "os";
-
-// src/topology/environment.ts
-import { existsSync, readFileSync as readFileSync2 } from "fs";
-import os5 from "os";
-function detectRuntimeEnvironment(env = process.env) {
-  if (isWsl(env)) {
-    return {
-      kind: "wsl",
-      lanAutoDiscoveryUsable: false,
-      warning: "Detected WSL. The LAN IP found inside WSL is usually a private VM address and is not reachable from your phone. Use Relay or set `hermeslink config set lan-host <Windows LAN IP>`."
-    };
-  }
-  if (isContainer(env)) {
+async function buildOfficialInstallCommand(options, targetVersion) {
+  const installer = await readOfficialInstallerUrls(options).catch((error) => {
+    options.logger?.warn?.(
+      `[link-update] failed to read installer config from server: ${error instanceof Error ? error.message : String(error)}`
+    );
+    return defaultInstallerUrls();
+  });
+  const env = {
+    HERMESLINK_VERSION: targetVersion,
+    HERMESLINK_YES: "1",
+    HERMESLINK_NO_PROFILE_EDIT: "1",
+    HERMESLINK_NO_PATH_PROMPT: "1",
+    HERMESLINK_SKIP_RESTART: "1"
+  };
+  if (process.platform === "win32") {
+    const windowsCommand = `& { $ErrorActionPreference = "Stop"; Invoke-RestMethod ${quotePowerShellString(installer.windowsUrl)} | Invoke-Expression }`;
     return {
-      kind: "container",
-      lanAutoDiscoveryUsable: false,
-      warning: "Detected a container environment. Container LAN IPs are usually not reachable from your phone. Use Relay or set `hermeslink config set lan-host <host LAN IP>`."
+      command: windowsCommand,
+      displayCommand: `$env:HERMESLINK_VERSION="${targetVersion}"; $env:HERMESLINK_YES="1"; $env:HERMESLINK_NO_PATH_PROMPT="1"; $env:HERMESLINK_SKIP_RESTART="1"; ${windowsCommand}; hermeslink restart`,
+      env,
+      source: "official-installer",
+      installerUrl: installer.windowsUrl
     };
   }
+  const unixCommand = buildUnixInstallCommand(installer.unixUrl);
   return {
-    kind: "native",
-    lanAutoDiscoveryUsable: true,
-    warning: null
+    command: unixCommand,
+    displayCommand: `HERMESLINK_VERSION=${targetVersion} HERMESLINK_YES=1 HERMESLINK_NO_PROFILE_EDIT=1 HERMESLINK_NO_PATH_PROMPT=1 HERMESLINK_SKIP_RESTART=1 sh -c ${quoteShellToken(unixCommand)} && hermeslink restart`,
+    env,
+    source: "official-installer",
+    installerUrl: installer.unixUrl
   };
 }
-function isWsl(env) {
-  if (process.platform !== "linux") {
-    return false;
+function buildUnixInstallCommand(installerUrl) {
+  const fetchScript = [
+    quoteShellToken(process.execPath),
+    "--input-type=module",
+    "-e",
+    quoteShellToken(
+      "const url = process.env.HERMESLINK_INSTALLER_URL; const response = await fetch(url); if (!response.ok) throw new Error(`HTTP ${response.status}`); process.stdout.write(await response.text());"
+    )
+  ].join(" ");
+  return [
+    "set -e;",
+    'tmp="${TMPDIR:-/tmp}/hermespilot-link-install.$$.sh";',
+    `trap 'rm -f "$tmp"' EXIT;`,
+    "umask 077;",
+    "if command -v curl >/dev/null 2>&1; then",
+    `curl -fsSL ${quoteShellToken(installerUrl)} -o "$tmp";`,
+    "else",
+    `HERMESLINK_INSTALLER_URL=${quoteShellToken(installerUrl)} ${fetchScript} > "$tmp";`,
+    "fi",
+    'bash "$tmp"'
+  ].join(" ");
+}
+async function readOfficialInstallerUrls(options) {
+  const config = await loadConfig(options.paths);
+  const url = new URL(SERVER_LINK_INSTALL_SCRIPTS_PATH, config.serverBaseUrl);
+  const response = await fetchInstallScriptsFromServer(
+    options.fetchImpl ?? fetch,
+    url
+  );
+  if (!response.ok) {
+    throw new Error(`HermesPilot Server returned HTTP ${response.status}`);
   }
-  if (env.WSL_DISTRO_NAME || env.WSL_INTEROP) {
-    return true;
+  const snapshot = await response.json();
+  const commands = snapshot.commands;
+  const unixUrl = readInstallerUrl(commands?.unix, "install.sh");
+  const windowsUrl = readInstallerUrl(commands?.windows, "install.ps1");
+  if (!unixUrl || !windowsUrl) {
+    throw new Error("HermesPilot Server did not return official installer URLs");
   }
-  const release = os5.release().toLowerCase();
-  return release.includes("microsoft") || release.includes("wsl");
+  return {
+    unixUrl,
+    windowsUrl
+  };
 }
-function isContainer(env) {
-  if (env.container || env.CONTAINER || env.KUBERNETES_SERVICE_HOST) {
-    return true;
+function defaultInstallerUrls() {
+  return {
+    unixUrl: OFFICIAL_UNIX_INSTALLER_URL,
+    windowsUrl: OFFICIAL_WINDOWS_INSTALLER_URL
+  };
+}
+function readInstallerUrl(value, expectedFileName) {
+  if (typeof value !== "string") {
+    return null;
   }
-  if (existsSync("/.dockerenv")) {
-    return true;
+  const match = /https:\/\/[^\s'"|]+/u.exec(value);
+  if (!match) {
+    return null;
+  }
+  const url = match[0];
+  if (!isOfficialInstallerUrl(url, expectedFileName)) {
+    return null;
   }
+  return url;
+}
+function isOfficialInstallerUrl(url, expectedFileName) {
   try {
-    const cgroup = readFileSync2("/proc/1/cgroup", "utf8").toLowerCase();
-    return /docker|containerd|kubepods|libpod|podman/u.test(cgroup);
+    const parsed = new URL(url);
+    if (parsed.protocol !== "https:") {
+      return false;
+    }
+    return parsed.hostname === "hs.clawpilot.me" && parsed.pathname === `/install/${expectedFileName}`;
   } catch {
     return false;
   }
 }
-
-// src/topology/network.ts
-var VIRTUAL_INTERFACE_NAME_PATTERN = /(docker|veth|vmnet|vmenet|vbox|virtualbox|vmware|tailscale|zerotier|wireguard|utun|virbr|hyper-v|vethernet|loopback|\blo\b|^lo\d*$|^br-|^bridge\d+$|^zt|^tun|^tap|awdl|llw|anpi|gif|stf|ipsec|ppp)/iu;
-var MAX_LAN_IPS = 4;
-var MAX_PUBLIC_IPV4S = 2;
-var MAX_PUBLIC_IPV6S = 2;
-async function discoverRouteCandidates(options) {
-  const environment = detectRuntimeEnvironment();
-  const configuredLanHost = normalizeLanHost(options.configuredLanHost);
-  const lanIps = configuredLanHost ? [configuredLanHost] : environment.lanAutoDiscoveryUsable ? discoverLanIps() : [];
-  const publicIps = options.relayBootstrapToken || options.observePublicRoute ? await observePublicRoute(options).catch(() => ({ publicIpv4s: [], publicIpv6s: [] })) : { publicIpv4s: [], publicIpv6s: [] };
-  const publicIpv4s = unique(publicIps.publicIpv4s.filter(isUsablePublicIpv4)).slice(0, MAX_PUBLIC_IPV4S);
-  const publicIpv6s = unique(publicIps.publicIpv6s.filter(isUsablePublicIpv6)).slice(0, MAX_PUBLIC_IPV6S);
-  const preferredUrls = [
-    ...lanIps.map((ip) => buildDirectUrl(ip, options.port)),
-    ...publicIpv4s.map((ip) => buildDirectUrl(ip, options.port)),
-    ...publicIpv6s.map((ip) => buildDirectUrl(ip, options.port)),
-    `${options.relayBaseUrl.replace(/\/+$/u, "")}/api/v1/relay/links/${options.linkId}`
-  ];
-  return {
-    lanIps,
-    publicIpv4s,
-    publicIpv6s,
-    preferredUrls,
-    environment
-  };
-}
-function discoverLanIps() {
-  return discoverLanIpsFromInterfaces(os6.networkInterfaces());
-}
-function discoverLanIpsFromInterfaces(interfaces) {
-  const result = /* @__PURE__ */ new Set();
-  const candidates = [];
-  for (const [name, items] of Object.entries(interfaces)) {
-    if (shouldIgnoreInterface(name)) {
-      continue;
-    }
-    for (const item of items ?? []) {
-      if (!item.internal && item.address && item.family === "IPv4" && isUsableLanIpv42(item.address, item.netmask)) {
-        candidates.push({ name, address: item.address });
-      }
+async function fetchInstallScriptsFromServer(fetcher, url) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), UPDATE_FETCH_TIMEOUT_MS);
+  try {
+    return await fetcher(url, {
+      headers: {
+        accept: "application/json",
+        "user-agent": `HermesPilot-Link/${LINK_VERSION}`
+      },
+      signal: controller.signal
+    });
+  } catch (error) {
+    if (error instanceof Error && error.name === "AbortError") {
+      throw new Error("HermesPilot Server installer config check timed out");
     }
+    throw error;
+  } finally {
+    clearTimeout(timer);
   }
-  for (const candidate of candidates.sort(compareLanCandidate)) {
-    result.add(candidate.address);
-  }
-  return [...result].slice(0, MAX_LAN_IPS);
 }
-async function observePublicRoute(options) {
-  const fetcher = options.fetchImpl ?? fetch;
-  const response = await fetcher(`${options.relayBaseUrl.replace(/\/+$/u, "")}/api/v1/relay/public-route/observe`, {
-    method: "POST",
-    headers: {
-      "content-type": "application/json",
-      ...options.relayBootstrapToken ? { authorization: `Bearer ${options.relayBootstrapToken}` } : {}
-    },
-    body: JSON.stringify({
-      install_id: options.installId,
-      link_id: options.linkId,
-      public_key_pem: options.publicKeyPem
-    })
+function spawnWindowsDetachedUpdater(input) {
+  const child = spawn5(
+    "powershell.exe",
+    [
+      "-NoProfile",
+      "-ExecutionPolicy",
+      "Bypass",
+      "-Command",
+      buildWindowsDetachedUpdaterScript(input)
+    ],
+    {
+      detached: true,
+      stdio: "ignore",
+      cwd: process.env.SystemRoot ?? process.env.TEMP ?? process.cwd(),
+      env: {
+        ...process.env,
+        ...input.installCommand.env
+      },
+      windowsHide: true,
+      shell: false
+    }
+  );
+  child.unref();
+  return child;
+}
+function buildWindowsDetachedUpdaterScript(input) {
+  return [
+    '$ErrorActionPreference = "Stop"',
+    "$Utf8NoBom = New-Object System.Text.UTF8Encoding -ArgumentList $false",
+    `$NodePath = ${quotePowerShellString(process.execPath)}`,
+    `$CliScriptPath = ${quotePowerShellString(currentCliScriptPath())}`,
+    `$InstallerUrl = ${quotePowerShellString(input.installCommand.installerUrl)}`,
+    `$StatePath = ${quotePowerShellString(input.statePath)}`,
+    `$LogPath = ${quotePowerShellString(input.logPath)}`,
+    `$JobId = ${quotePowerShellString(input.jobId)}`,
+    `$TargetVersion = ${quotePowerShellString(input.targetVersion)}`,
+    `$StartedAt = ${quotePowerShellString(input.startedAt)}`,
+    `$ManualCommand = ${quotePowerShellString(input.manualCommand)}`,
+    "$InstallerPath = $null",
+    "function Ensure-ParentDirectory { param([string]$PathValue) $parent = Split-Path -Parent $PathValue; if ($parent) { New-Item -ItemType Directory -Force -Path $parent | Out-Null } }",
+    "function Add-UpdateLog { param([string]$Message) Ensure-ParentDirectory $LogPath; [System.IO.File]::AppendAllText($LogPath, $Message + [Environment]::NewLine, $Utf8NoBom) }",
+    "function Write-UpdateState {",
+    "  param([string]$State, $ExitCode, $ErrorText)",
+    "  Ensure-ParentDirectory $StatePath",
+    "  $finishedAt = $null",
+    '  if ($State -ne "running") { $finishedAt = (Get-Date).ToUniversalTime().ToString("o") }',
+    "  $payload = [ordered]@{",
+    "    state = $State",
+    "    job_id = $JobId",
+    "    pid = $PID",
+    "    target_version = $TargetVersion",
+    "    started_at = $StartedAt",
+    "    finished_at = $finishedAt",
+    "    exit_code = $ExitCode",
+    "    signal = $null",
+    "    error = $ErrorText",
+    "    manual_command = $ManualCommand",
+    "  }",
+    "  $json = $payload | ConvertTo-Json -Compress",
+    "  [System.IO.File]::WriteAllText($StatePath, $json, $Utf8NoBom)",
+    "}",
+    "function Invoke-Step {",
+    "  param([string]$Label, [scriptblock]$Block, [switch]$AllowFailure)",
+    '  Add-UpdateLog ""',
+    '  Add-UpdateLog "=> $Label"',
+    "  & $Block *>> $LogPath",
+    "  $code = if ($null -eq $LASTEXITCODE) { 0 } else { [int]$LASTEXITCODE }",
+    '  if ($code -ne 0 -and -not $AllowFailure) { throw "$Label exited with code $code" }',
+    "  return $code",
+    "}",
+    "try {",
+    '  Write-UpdateState "running" $null $null',
+    "  Start-Sleep -Milliseconds 1500",
+    '  Invoke-Step "Stopping Hermes Link before Windows package replacement" { & $NodePath $CliScriptPath stop } -AllowFailure | Out-Null',
+    '  $InstallerPath = Join-Path ([System.IO.Path]::GetTempPath()) ("hermespilot-link-install-" + [Guid]::NewGuid().ToString("N") + ".ps1")',
+    '  Add-UpdateLog ""',
+    '  Add-UpdateLog "=> Downloading official installer"',
+    '  Invoke-RestMethod -Uri $InstallerUrl -Headers @{ "User-Agent" = "HermesPilot-Link-Updater" } -OutFile $InstallerPath',
+    "  $env:HERMESLINK_VERSION = $TargetVersion",
+    '  $env:HERMESLINK_YES = "1"',
+    '  $env:HERMESLINK_NO_PATH_PROMPT = "1"',
+    '  $env:HERMESLINK_SKIP_RESTART = "1"',
+    '  Invoke-Step "Installing Hermes Link $TargetVersion" { & powershell.exe -NoProfile -ExecutionPolicy Bypass -File $InstallerPath -Version $TargetVersion -NoPathPrompt -SkipRestart } | Out-Null',
+    '  Invoke-Step "Starting Hermes Link after update" { & $NodePath $CliScriptPath start } | Out-Null',
+    '  Add-UpdateLog ""',
+    '  Add-UpdateLog ("=== link update finished " + (Get-Date).ToUniversalTime().ToString("o") + " exit=0 signal=null ===")',
+    '  Write-UpdateState "restart_required" 0 $null',
+    "  exit 0",
+    "} catch {",
+    "  $message = if ($_.Exception) { $_.Exception.Message } else { [string]$_ }",
+    '  Add-UpdateLog ""',
+    '  Add-UpdateLog "[failed] $message"',
+    "  try { & $NodePath $CliScriptPath start *>> $LogPath } catch {}",
+    '  Write-UpdateState "failed" 1 $message',
+    "  exit 1",
+    "} finally {",
+    "  if ($InstallerPath -and (Test-Path -LiteralPath $InstallerPath)) { Remove-Item -LiteralPath $InstallerPath -Force -ErrorAction SilentlyContinue }",
+    "}"
+  ].join("\n");
+}
+function spawnInstallCommand(input) {
+  const env = {
+    ...process.env,
+    ...input.env
+  };
+  if (process.platform === "win32") {
+    return spawn5(
+      "powershell.exe",
+      ["-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", input.command],
+      {
+        env,
+        stdio: ["ignore", "pipe", "pipe"],
+        windowsHide: true,
+        detached: false,
+        shell: false
+      }
+    );
+  }
+  return spawn5("/bin/sh", ["-lc", input.command], {
+    env,
+    stdio: ["ignore", "pipe", "pipe"],
+    windowsHide: true,
+    detached: false,
+    shell: false
   });
-  const payload = await response.json().catch(() => null);
-  const record = typeof payload?.record === "object" && payload.record !== null ? payload.record : null;
-  const observed = typeof payload?.observed === "object" && payload.observed !== null ? payload.observed : null;
-  const values = [
-    readIpRecord(record?.ipv4),
-    readIpRecord(record?.ipv6),
-    typeof observed?.ip === "string" ? observed.ip : null
-  ].filter((value) => Boolean(value));
+}
+async function readLinkReleaseCheckContext(paths) {
+  const config = await loadConfig(paths);
+  const url = new URL(SERVER_LINK_CURRENT_RELEASE_PATH, config.serverBaseUrl);
+  url.searchParams.set("channel", "stable");
+  url.searchParams.set("lang", "en");
   return {
-    publicIpv4s: unique(values.filter(isUsablePublicIpv4)),
-    publicIpv6s: unique(values.filter(isUsablePublicIpv6))
+    serverBaseUrl: config.serverBaseUrl,
+    releaseCheckUrl: url.toString()
   };
 }
-function readIpRecord(value) {
-  if (typeof value !== "object" || value === null) {
-    return null;
+function computeLinkUpdateState(localVersion, remote) {
+  if (!remote?.current_version) {
+    return "unknown";
   }
-  const ip = value.ip;
-  return typeof ip === "string" && ip.trim() ? ip.trim() : null;
+  if (remote.min_safe_version && compareSemver3(localVersion, remote.min_safe_version) < 0) {
+    return "unsafe";
+  }
+  const diff = compareSemver3(localVersion, remote.current_version);
+  if (diff < 0) {
+    return "update_available";
+  }
+  if (diff > 0) {
+    return "ahead_of_current";
+  }
+  return "current";
 }
-function buildDirectUrl(ip, port) {
-  return `http://${ip.includes(":") ? `[${ip}]` : ip}:${port}`;
+async function emitUpdateStatus2(paths) {
+  updateEvents2.emit("status", await readLinkUpdateStatus(paths));
 }
-function shouldIgnoreInterface(name) {
-  return !name.trim() || VIRTUAL_INTERFACE_NAME_PATTERN.test(name);
+async function writeUpdateState2(paths, state) {
+  await writeJsonFile(updateStatePath2(paths), state);
 }
-function compareLanCandidate(left, right) {
-  const priority = interfacePriority(left.name) - interfacePriority(right.name);
-  return priority || left.name.localeCompare(right.name) || left.address.localeCompare(right.address);
+async function readUpdateLogLines2(paths) {
+  const raw = await readFile18(updateLogPath2(paths), "utf8").catch(() => "");
+  if (!raw.trim()) {
+    return [];
+  }
+  return raw.split(/\r?\n/u).map((line) => line.trimEnd()).filter(Boolean).slice(-MAX_UPDATE_LOG_LINES2).map(
+    (line) => line.length > MAX_OUTPUT_LINE_LENGTH3 ? `${line.slice(0, MAX_OUTPUT_LINE_LENGTH3)}...` : line
+  );
 }
-function interfacePriority(name) {
-  if (/^(en|eth|wlan|wi-fi|wifi)/iu.test(name)) {
-    return 0;
+function updateStatePath2(paths) {
+  return path25.join(paths.runDir, "link-update-state.json");
+}
+function updateLogPath2(paths) {
+  return path25.join(paths.logsDir, UPDATE_LOG_FILE2);
+}
+async function clearUpdateLogFiles2(paths) {
+  const primary = updateLogPath2(paths);
+  await Promise.all([
+    rm10(primary, { force: true }).catch(() => void 0),
+    ...Array.from(
+      { length: UPDATE_LOG_MAX_FILES2 },
+      (_, index) => rm10(`${primary}.${index + 1}`, { force: true }).catch(() => void 0)
+    )
+  ]);
+}
+function manualInstallCommand(version) {
+  return `npm install -g ${LINK_NPM_PACKAGE}@${version}`;
+}
+function isValidReleaseVersion(version) {
+  return /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u.test(
+    version
+  );
+}
+function compareSemver3(left, right) {
+  const leftParts = parseSemver(left);
+  const rightParts = parseSemver(right);
+  for (let index = 0; index < 3; index += 1) {
+    const diff = leftParts[index] - rightParts[index];
+    if (diff !== 0) {
+      return diff;
+    }
   }
-  return 1;
+  return 0;
 }
-function isUsableLanIpv42(address, netmask) {
-  return isPrivateIpv4(address) && !isNetworkOrBroadcastIpv4Address(address, netmask);
+function parseSemver(value) {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)/u.exec(value.trim());
+  return [
+    Number.parseInt(match?.[1] ?? "0", 10),
+    Number.parseInt(match?.[2] ?? "0", 10),
+    Number.parseInt(match?.[3] ?? "0", 10)
+  ];
 }
-function isUsablePublicIpv4(address) {
-  return isValidIpv4(address) && !isSpecialIpv4(address);
+function quoteShellToken(value) {
+  if (/^[A-Za-z0-9_./:@%+=,-]+$/u.test(value)) {
+    return value;
+  }
+  return `'${value.replaceAll("'", "'\\''")}'`;
 }
-function isUsablePublicIpv6(address) {
-  const normalized = address.toLowerCase();
-  return normalized.includes(":") && !normalized.startsWith("fe80:") && !normalized.startsWith("fc") && !normalized.startsWith("fd") && !normalized.startsWith("ff") && normalized !== "::" && normalized !== "::1";
+function quotePowerShellString(value) {
+  return `'${value.replaceAll("'", "''")}'`;
 }
-function isPrivateIpv4(address) {
-  const parts = parseIpv4Segments(address);
-  if (!parts) {
+function isRecentRunningState3(state, now = Date.now()) {
+  const startedAt = state.started_at ? Date.parse(state.started_at) : Number.NaN;
+  return Number.isFinite(startedAt) && now - startedAt < RUNNING_STATE_GRACE_MS;
+}
+function isRunningStateTimedOut(state, now = Date.now()) {
+  const startedAt = state.started_at ? Date.parse(state.started_at) : Number.NaN;
+  return Number.isFinite(startedAt) && now - startedAt >= LINK_UPDATE_TIMEOUT_MS;
+}
+function linkUpdateTimeoutError() {
+  return `Link update timed out after ${Math.round(
+    LINK_UPDATE_TIMEOUT_MS / 6e4
+  )} minutes.`;
+}
+function isProcessAlive4(pid) {
+  if (!pid || pid <= 0) {
     return false;
   }
-  const [first, second] = parts;
-  return first === 10 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168;
-}
-function isSpecialIpv4(address) {
-  const parts = parseIpv4Segments(address);
-  if (!parts) {
+  try {
+    process.kill(pid, 0);
     return true;
+  } catch {
+    return false;
   }
-  const [first, second, third, fourth] = parts;
-  return first === 0 || first === 10 || first === 127 || first >= 224 || first === 100 && second >= 64 && second <= 127 || first === 169 && second === 254 || first === 172 && second >= 16 && second <= 31 || first === 192 && second === 168 || first === 192 && second === 0 && third === 2 || first === 198 && (second === 18 || second === 19) || first === 198 && second === 51 && third === 100 || first === 203 && second === 0 && third === 113 || first === 255 && second === 255 && third === 255 && fourth === 255;
 }
-function isNetworkOrBroadcastIpv4Address(address, netmask) {
-  const addressParts = parseIpv4Segments(address);
-  const netmaskParts = netmask ? parseIpv4Segments(netmask) : null;
-  if (!addressParts) {
-    return true;
+function toRecord17(value) {
+  return typeof value === "object" && value !== null ? value : {};
+}
+function toNullableRecord2(value) {
+  return typeof value === "object" && value !== null ? value : null;
+}
+function readString18(payload, key) {
+  const value = payload[key];
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+
+// src/pairing/pairing.ts
+import path26 from "path";
+import { rm as rm11 } from "fs/promises";
+
+// src/relay/bootstrap.ts
+var RelayNetworkError = class extends Error {
+  constructor(relayBaseUrl, causeMessage) {
+    super(
+      `Cannot reach Hermes Relay at ${relayBaseUrl}. Please check your network connection, VPN, or proxy settings, then try again.`
+    );
+    this.relayBaseUrl = relayBaseUrl;
+    this.causeMessage = causeMessage;
   }
-  if (!netmaskParts) {
-    const last = addressParts[3];
-    return last === 0 || last === 255;
+  relayBaseUrl;
+  causeMessage;
+};
+async function bootstrapRelayLink(options) {
+  const fetcher = options.fetchImpl ?? fetch;
+  const baseUrl = options.relayBaseUrl.replace(/\/+$/u, "");
+  const commonPayload = {
+    install_id: options.identity.install_id,
+    link_id: options.identity.link_id ?? void 0,
+    public_key_pem: options.identity.public_key_pem
+  };
+  const challenge = await postJson(
+    fetcher,
+    `${baseUrl}/api/v1/relay/link/challenge`,
+    options.relayBootstrapToken,
+    commonPayload
+  );
+  if (challenge.ok !== true || typeof challenge.nonce !== "string") {
+    throw new Error("Relay did not return a valid install challenge");
   }
-  const addressInt = ipv4SegmentsToInt(addressParts);
-  const netmaskInt = ipv4SegmentsToInt(netmaskParts);
-  const hostMask = ~netmaskInt >>> 0;
-  if (hostMask === 0) {
-    return false;
+  const proof = {
+    nonce: challenge.nonce,
+    signature: signRelayNonce(options.identity, challenge.nonce)
+  };
+  const assigned = await postJson(
+    fetcher,
+    `${baseUrl}/api/v1/relay/link/bootstrap`,
+    options.relayBootstrapToken,
+    {
+      ...commonPayload,
+      proof
+    }
+  );
+  if (assigned.ok !== true || typeof assigned.link_id !== "string") {
+    throw new Error("Relay did not return a valid link_id");
   }
-  const networkInt = addressInt & netmaskInt;
-  const broadcastInt = (networkInt | hostMask) >>> 0;
-  return addressInt === networkInt || addressInt === broadcastInt;
+  await saveAssignedLinkId(assigned.link_id, options.paths ?? resolveRuntimePaths());
+  return {
+    linkId: assigned.link_id,
+    reused: assigned.reused === true
+  };
 }
-function isValidIpv4(address) {
-  return Boolean(parseIpv4Segments(address));
+async function postJson(fetcher, url, token, body) {
+  let response;
+  try {
+    response = await fetcher(url, {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${token}`,
+        "content-type": "application/json"
+      },
+      body: JSON.stringify(body)
+    });
+  } catch (error) {
+    const baseUrl = new URL(url).origin;
+    throw new RelayNetworkError(
+      baseUrl,
+      error instanceof Error ? error.message : String(error)
+    );
+  }
+  const payload = await response.json().catch(() => null);
+  if (!response.ok) {
+    const message = readErrorMessage4(payload) ?? `Relay request failed with HTTP ${response.status}`;
+    throw new Error(message);
+  }
+  if (!payload) {
+    throw new Error("Relay returned an empty response");
+  }
+  return payload;
 }
-function parseIpv4Segments(address) {
-  if (!/^\d{1,3}(?:\.\d{1,3}){3}$/u.test(address)) {
+function readErrorMessage4(payload) {
+  if (typeof payload !== "object" || payload === null) {
     return null;
   }
-  const parts = address.split(".").map((part) => Number.parseInt(part, 10));
-  if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {
+  const error = payload.error;
+  if (typeof error !== "object" || error === null) {
     return null;
   }
-  return parts;
-}
-function ipv4SegmentsToInt(parts) {
-  return (parts[0] << 24 >>> 0 | parts[1] << 16 | parts[2] << 8 | parts[3]) >>> 0;
-}
-function unique(values) {
-  return [...new Set(values)];
+  const message = error.message;
+  return typeof message === "string" ? message : null;
 }
 
 // src/pairing/pairing.ts
@@ -24043,7 +25545,7 @@ async function readPairingClaim(sessionId, paths = resolveRuntimePaths()) {
   };
 }
 async function clearPairingClaim(sessionId, paths = resolveRuntimePaths()) {
-  await rm9(pairingClaimPath(sessionId, paths), { force: true }).catch(() => void 0);
+  await rm11(pairingClaimPath(sessionId, paths), { force: true }).catch(() => void 0);
 }
 async function claimPairing(input) {
   const paths = input.paths ?? resolveRuntimePaths();
@@ -24120,10 +25622,10 @@ async function loadRequiredIdentity2(paths) {
   }
   return identity;
 }
-async function postServerJson(serverBaseUrl, path26, body, options) {
+async function postServerJson(serverBaseUrl, path27, body, options) {
   let response;
   try {
-    response = await fetch(`${serverBaseUrl.replace(/\/+$/u, "")}${path26}`, {
+    response = await fetch(`${serverBaseUrl.replace(/\/+$/u, "")}${path27}`, {
       method: "POST",
       headers: {
         accept: "application/json",
@@ -24171,10 +25673,10 @@ function pairingErrorSnapshot(stage, error) {
     occurred_at: (/* @__PURE__ */ new Date()).toISOString()
   };
 }
-async function patchServerJson(serverBaseUrl, path26, token, body, options) {
+async function patchServerJson(serverBaseUrl, path27, token, body, options) {
   let response;
   try {
-    response = await fetch(`${serverBaseUrl.replace(/\/+$/u, "")}${path26}`, {
+    response = await fetch(`${serverBaseUrl.replace(/\/+$/u, "")}${path27}`, {
       method: "PATCH",
       headers: {
         accept: "application/json",
@@ -24196,12 +25698,12 @@ async function patchServerJson(serverBaseUrl, path26, token, body, options) {
 async function readJsonResponse2(response) {
   const payload = await response.json().catch(() => null);
   if (!response.ok || !payload) {
-    const message = readErrorMessage4(payload) ?? `HermesPilot Server request failed with HTTP ${response.status}`;
+    const message = readErrorMessage5(payload) ?? `HermesPilot Server request failed with HTTP ${response.status}`;
     throw new LinkHttpError(response.status, "server_request_failed", message);
   }
   return payload;
 }
-function readErrorMessage4(payload) {
+function readErrorMessage5(payload) {
   if (typeof payload !== "object" || payload === null) {
     return null;
   }
@@ -24222,10 +25724,10 @@ function createPairingNetworkError(input) {
   );
 }
 function pairingClaimPath(sessionId, paths) {
-  return path25.join(paths.pairingDir, `${Buffer.from(sessionId).toString("base64url")}.claimed.json`);
+  return path26.join(paths.pairingDir, `${Buffer.from(sessionId).toString("base64url")}.claimed.json`);
 }
 function pairingSessionPath(sessionId, paths) {
-  return path25.join(paths.pairingDir, `${Buffer.from(sessionId).toString("base64url")}.json`);
+  return path26.join(paths.pairingDir, `${Buffer.from(sessionId).toString("base64url")}.json`);
 }
 function qrPreferredUrls(routes) {
   return routes.preferredUrls.filter((url) => !url.includes("/api/v1/relay/links/")).slice(0, 1);
@@ -25399,20 +26901,14 @@ async function createApp(options = {}) {
 export {
   LINK_VERSION,
   LINK_COMMAND,
-  migrateLinkDatabase,
   LinkHttpError,
-  readJsonFile,
-  writeJsonFile,
   resolveHermesProfileDir,
   resolveHermesConfigPath,
   readHermesApiServerConfig,
   ensureHermesApiServerConfig,
-  syncHermesLinkCronDeliveries,
   resolveRuntimePaths,
   createFileLogger,
   getLinkLogFile,
-  getDaemonLogFile,
-  createRotatingTextLogWriter,
   ensureHermesApiServerAvailable,
   readHermesVersion,
   defaultLinkConfig,
@@ -25422,15 +26918,23 @@ export {
   normalizeLanHost,
   loadIdentity,
   ensureIdentity,
-  signIdentityPayload,
   getIdentityStatus,
   ConversationService,
   hasActiveDevices,
-  readLinkSystemInfo,
   detectRuntimeEnvironment,
-  discoverRouteCandidates,
   preparePairing,
   readPairingClaim,
   clearPairingClaim,
-  createApp
+  createApp,
+  fetchRelayStreamBatchPolicy,
+  connectRelayControl,
+  reportLinkStatusToServer,
+  startLinkService,
+  startDaemonProcess,
+  runDaemonSupervisor,
+  probeLocalLinkService,
+  stopDaemonProcess,
+  getDaemonStatus,
+  daemonLogFile,
+  currentCliScriptPath
 };