@keysync/cli 0.1.132 → 0.1.134

package/dist/keysync-cli.mjs

@@ -16924,6 +16924,191 @@ var require_zod = __commonJS({
   }
 });
 
+// apps/client-ui/electron/install-identity.cjs
+var require_install_identity = __commonJS({
+  "apps/client-ui/electron/install-identity.cjs"(exports, module) {
+    "use strict";
+    var fs = __require("node:fs");
+    var path = __require("node:path");
+    var { randomBytes: randomBytes4 } = __require("node:crypto");
+    function readInstall(pathname) {
+      try {
+        const parsed = JSON.parse(fs.readFileSync(pathname, "utf8"));
+        return typeof parsed.install_id === "string" && parsed.install_id && typeof parsed.created_at === "string" && parsed.created_at ? { install_id: parsed.install_id, created_at: parsed.created_at } : null;
+      } catch {
+        return null;
+      }
+    }
+    function publishCompleteFileIfAbsent(pathname, install) {
+      fs.mkdirSync(path.dirname(pathname), { recursive: true, mode: 448 });
+      const temporary = `${pathname}.${process.pid}.${randomBytes4(8).toString("hex")}.tmp`;
+      const fd = fs.openSync(temporary, "wx", 384);
+      try {
+        fs.writeFileSync(fd, `${JSON.stringify(install, null, 2)}
+`);
+        fs.fsyncSync(fd);
+      } finally {
+        fs.closeSync(fd);
+      }
+      try {
+        fs.linkSync(temporary, pathname);
+        let directoryFd = null;
+        try {
+          directoryFd = fs.openSync(path.dirname(pathname), "r");
+          fs.fsyncSync(directoryFd);
+        } catch {
+        } finally {
+          if (directoryFd !== null) try {
+            fs.closeSync(directoryFd);
+          } catch {
+          }
+        }
+      } catch (error) {
+        if (error?.code !== "EEXIST") throw error;
+      } finally {
+        try {
+          fs.rmSync(temporary, { force: true });
+        } catch {
+        }
+      }
+      const winner = readInstall(pathname);
+      if (!winner) throw Object.assign(new Error("INSTALL_STATE_UNREADABLE"), { code: "INSTALL_STATE_UNREADABLE" });
+      return winner;
+    }
+    function ensureInstallIdentitySync2(installStateDir, options = {}) {
+      const pathname = path.join(installStateDir, "install.json");
+      const existing = readInstall(pathname);
+      if (existing) return existing;
+      for (const legacyDir of options.legacyStateDirs || []) {
+        const legacy = readInstall(path.join(legacyDir, "install.json"));
+        if (legacy) return publishCompleteFileIfAbsent(pathname, legacy);
+      }
+      if (options.legacyInstallationPath) {
+        try {
+          const legacy = JSON.parse(fs.readFileSync(options.legacyInstallationPath, "utf8"));
+          if (typeof legacy.installation_id === "string" && legacy.installation_id) {
+            return publishCompleteFileIfAbsent(pathname, { install_id: legacy.installation_id, created_at: legacy.created_at || (/* @__PURE__ */ new Date()).toISOString() });
+          }
+        } catch {
+        }
+      }
+      return publishCompleteFileIfAbsent(pathname, { install_id: randomBytes4(32).toString("base64url"), created_at: (/* @__PURE__ */ new Date()).toISOString() });
+    }
+    module.exports = { ensureInstallIdentitySync: ensureInstallIdentitySync2, readInstall };
+  }
+});
+
+// apps/client-ui/electron/diagnostic-sanitize.cjs
+var require_diagnostic_sanitize = __commonJS({
+  "apps/client-ui/electron/diagnostic-sanitize.cjs"(exports, module) {
+    "use strict";
+    var SECRET_KEY = /(?:password|token|secret|api[_-]?key|authorization|cookie|private[_-]?key|recovery[_-]?key)/i;
+    var USER_PATH = /(?:[A-Za-z]:\\Users\\[^\\\s"'`]+|\/Users\/[^/\s"'`]+|\/home\/[^/\s"'`]+)/gi;
+    var MAX_COLLECTION_ITEMS = 50;
+    var MAX_DEPTH = 8;
+    var MAX_NODES = 256;
+    var MAX_ENTRIES = 256;
+    var MAX_TOTAL_TEXT_BYTES = 24 * 1024;
+    var MAX_KEY_LENGTH = 64;
+    var MAX_PAYLOAD_BYTES = 48 * 1024;
+    function sanitizeDiagnosticText2(value) {
+      return String(value ?? "").replace(/\bBearer\s+[A-Za-z0-9._~+/=-]+/gi, "Bearer [REDACTED]").replace(/\bsk-[A-Za-z0-9_-]{4,}\b/gi, "[REDACTED]").replace(/((?:password|token|secret|api[_-]?key|authorization|cookie|private[_-]?key|recovery[_-]?key)\s*[:=]\s*)[^,\s}]+/gi, "$1[REDACTED]").replace(USER_PATH, "[REDACTED_USER_DIR]").slice(0, 4096);
+    }
+    function boundedUtf8(value, state) {
+      const text = sanitizeDiagnosticText2(value);
+      const remaining = Math.max(0, (state.maxTextBytes ?? MAX_TOTAL_TEXT_BYTES) - state.textBytes);
+      if (Buffer.byteLength(text, "utf8") <= remaining) {
+        state.textBytes += Buffer.byteLength(text, "utf8");
+        return text;
+      }
+      state.truncated = true;
+      let low = 0;
+      let high = text.length;
+      while (low < high) {
+        const middle = Math.ceil((low + high) / 2);
+        if (Buffer.byteLength(text.slice(0, middle), "utf8") <= remaining) low = middle;
+        else high = middle - 1;
+      }
+      const bounded = text.slice(0, low);
+      state.textBytes += Buffer.byteLength(bounded, "utf8");
+      return bounded;
+    }
+    function safeDiagnosticKey(value, index) {
+      const key = String(value ?? "");
+      return /^[A-Za-z][A-Za-z0-9_.-]{0,63}$/.test(key) ? key.slice(0, MAX_KEY_LENGTH) : `diagnostic_field_${index}`;
+    }
+    function sanitizeDiagnosticValue(value, key = "", seen = /* @__PURE__ */ new WeakSet(), depth = 0, state = { nodes: 0, entries: 0, textBytes: 0, truncated: false }) {
+      if (SECRET_KEY.test(key)) return "[REDACTED]";
+      if (typeof value === "string") return boundedUtf8(value, state);
+      if (typeof value === "number" || typeof value === "boolean" || value === null) return value;
+      if (!value || typeof value !== "object") return void 0;
+      state.nodes += 1;
+      if (state.nodes > MAX_NODES || depth >= MAX_DEPTH || seen.has(value)) {
+        state.truncated = true;
+        return "[REDACTED_COMPLEX_VALUE]";
+      }
+      seen.add(value);
+      if (Array.isArray(value)) {
+        if (value.length > MAX_COLLECTION_ITEMS) state.truncated = true;
+        const result2 = [];
+        for (const item of value.slice(0, MAX_COLLECTION_ITEMS)) {
+          if (state.entries >= MAX_ENTRIES) {
+            state.truncated = true;
+            break;
+          }
+          state.entries += 1;
+          result2.push(sanitizeDiagnosticValue(item, "", seen, depth + 1, state));
+        }
+        return result2;
+      }
+      const priority = new Map(["client_event_id", "installation_id", "identity_epoch", "identity_proof", "domain", "action", "status", "error_code", "message", "occurred_at", "client_version", "platform", "arch", "details", "failure_stage"].map((name, index) => [name, index]));
+      const entries = Object.entries(value).sort(([left], [right]) => (priority.get(left) ?? 100) - (priority.get(right) ?? 100));
+      if (entries.length > MAX_COLLECTION_ITEMS) state.truncated = true;
+      const result = {};
+      entries.slice(0, MAX_COLLECTION_ITEMS).forEach(([childKey, childValue], index) => {
+        if (state.entries >= MAX_ENTRIES) {
+          state.truncated = true;
+          return;
+        }
+        state.entries += 1;
+        const safeKey = safeDiagnosticKey(childKey, index);
+        if (Object.prototype.hasOwnProperty.call(result, safeKey)) state.truncated = true;
+        else result[safeKey] = sanitizeDiagnosticValue(childValue, childKey, seen, depth + 1, state);
+      });
+      return result;
+    }
+    function sanitizeDiagnosticPayload2(value) {
+      const state = { nodes: 0, entries: 0, textBytes: 0, truncated: false };
+      const sanitized = sanitizeDiagnosticValue(value, "", /* @__PURE__ */ new WeakSet(), 0, state);
+      if (state.truncated && sanitized && typeof sanitized === "object" && !Array.isArray(sanitized)) {
+        if (sanitized.details && typeof sanitized.details === "object" && !Array.isArray(sanitized.details)) sanitized.details.diagnostic_payload_truncated = true;
+        else sanitized.diagnostic_payload_truncated = true;
+      }
+      if (Buffer.byteLength(JSON.stringify(sanitized), "utf8") >= MAX_PAYLOAD_BYTES) return compactDiagnosticPayload2(sanitized);
+      return sanitized;
+    }
+    function compactDiagnosticPayload2(value) {
+      if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+      const rootKeys = ["client_event_id", "installation_id", "identity_epoch", "identity_proof", "device_id", "domain", "action", "status", "error_code", "message", "occurred_at", "client_version", "platform", "arch", "failure_stage"];
+      const detailKeys = ["failure_stage", "operation_id", "caused_by_operation_id", "control_id", "label_key", "context_id", "view_id", "field_id", "interaction", "outcome", "state", "decision", "validation", "phase", "reason", "os_error_code", "error_name", "prompt_state", "client_event_seq", "session_id", "run_id", "test_run_id", "provider_type", "endpoint_protocol", "device_filter", "desktop_app", "selected_locale", "import_change", "identity_quarantined", "delivery_quarantined", "diagnostic_ipc_fallback", "diagnostic_payload_truncated"];
+      const state = { nodes: 0, entries: 0, textBytes: 0, maxTextBytes: 8 * 1024, truncated: true };
+      const compacted = {};
+      for (const key of rootKeys) {
+        if (!Object.prototype.hasOwnProperty.call(value, key)) continue;
+        compacted[key] = sanitizeDiagnosticValue(value[key], key, /* @__PURE__ */ new WeakSet(), 0, state);
+      }
+      const sourceDetails = value.details && typeof value.details === "object" && !Array.isArray(value.details) ? value.details : {};
+      compacted.details = { payload_compacted: true };
+      for (const key of detailKeys) {
+        if (!Object.prototype.hasOwnProperty.call(sourceDetails, key)) continue;
+        compacted.details[key] = sanitizeDiagnosticValue(sourceDetails[key], key, /* @__PURE__ */ new WeakSet(), 0, state);
+      }
+      return compacted;
+    }
+    module.exports = { sanitizeDiagnosticText: sanitizeDiagnosticText2, sanitizeDiagnosticValue, sanitizeDiagnosticPayload: sanitizeDiagnosticPayload2, compactDiagnosticPayload: compactDiagnosticPayload2 };
+  }
+});
+
 // apps/client-ui/electron/dsh-plugin-manager-release.cjs
 var require_dsh_plugin_manager_release = __commonJS({
   "apps/client-ui/electron/dsh-plugin-manager-release.cjs"(exports, module) {
@@ -17210,8 +17395,8 @@ var require_managed_dsh = __commonJS({
     }
     function readBoundedJson(filePath, maxBytes, fallback = null) {
       try {
-        const stat6 = fs.statSync(filePath);
-        if (!stat6.isFile() || stat6.size > maxBytes) return fallback;
+        const stat7 = fs.statSync(filePath);
+        if (!stat7.isFile() || stat7.size > maxBytes) return fallback;
         return JSON.parse(fs.readFileSync(filePath, "utf8"));
       } catch {
         return fallback;
@@ -17263,8 +17448,8 @@ var require_managed_dsh = __commonJS({
       };
     }
     function assertManagedChild(root, target) {
-      const relative2 = path.relative(path.resolve(root), path.resolve(target));
-      if (!relative2 || relative2.startsWith("..") || path.isAbsolute(relative2)) {
+      const relative = path.relative(path.resolve(root), path.resolve(target));
+      if (!relative || relative.startsWith("..") || path.isAbsolute(relative)) {
         throw new ManagedDshError("unsafe_path", "Managed DSH operation resolved outside its owned directory.");
       }
     }
@@ -17355,7 +17540,7 @@ var require_managed_dsh = __commonJS({
       return edition.runtime.artifacts[`${platform3}-${arch2}`] ?? null;
     }
     function wait(ms) {
-      return new Promise((resolve2) => setTimeout(resolve2, ms));
+      return new Promise((resolve3) => setTimeout(resolve3, ms));
     }
     function createManagedDshManager(options) {
       const bundledEdition = options.edition ?? OFFICIAL_DSH_EDITION;
@@ -17715,15 +17900,15 @@ var require_managed_dsh = __commonJS({
       }
       async function waitForAuthenticatedUrl(timeoutMs) {
         if (runningAuthenticatedUrl) return runningAuthenticatedUrl;
-        return new Promise((resolve2) => {
+        return new Promise((resolve3) => {
           const timer = setTimeout(() => {
             if (authenticatedUrlWaiter === finish) authenticatedUrlWaiter = null;
-            resolve2(null);
+            resolve3(null);
           }, timeoutMs);
           timer.unref?.();
           const finish = (url) => {
             clearTimeout(timer);
-            resolve2(url);
+            resolve3(url);
           };
           authenticatedUrlWaiter = finish;
         });
@@ -18008,7 +18193,7 @@ var require_managed_dsh = __commonJS({
         if (testHooks.runProcess) {
           return testHooks.runProcess(command, args, { ...runOptions, signal: activeOperation?.controller.signal ?? null });
         }
-        return new Promise((resolve2, reject) => {
+        return new Promise((resolve3, reject) => {
           let stdout = "";
           let stderr = "";
           let settled = false;
@@ -18045,7 +18230,7 @@ var require_managed_dsh = __commonJS({
                 boundedCommandFailureDetail(stderr, code)
               ));
             }
-            resolve2({ stdout, stderr, code });
+            resolve3({ stdout, stderr, code });
           });
         });
       }
@@ -18574,11 +18759,11 @@ var require_managed_dsh = __commonJS({
       async function findAvailablePort() {
         if (testHooks.findAvailablePort) return testHooks.findAvailablePort();
         for (let port = 3080; port <= 3180; port += 1) {
-          const available = await new Promise((resolve2) => {
+          const available = await new Promise((resolve3) => {
             const server = net.createServer();
             server.unref();
-            server.once("error", () => resolve2(false));
-            server.listen({ host: "127.0.0.1", port, exclusive: true }, () => server.close(() => resolve2(true)));
+            server.once("error", () => resolve3(false));
+            server.listen({ host: "127.0.0.1", port, exclusive: true }, () => server.close(() => resolve3(true)));
           });
           if (available) return port;
         }
@@ -19006,7 +19191,7 @@ var require_managed_dsh = __commonJS({
       function windowIsUsable() {
         return dshWindow && !(typeof dshWindow.isDestroyed === "function" && dshWindow.isDestroyed());
       }
-      async function open() {
+      async function open2() {
         const status = await start();
         if (windowIsUsable()) {
           if (typeof dshWindow.show === "function") dshWindow.show();
@@ -19111,7 +19296,7 @@ var require_managed_dsh = __commonJS({
         cancelInstall,
         start,
         stop,
-        open,
+        open: open2,
         openDataDirectory,
         removeAllPlugins,
         uninstall,
@@ -24207,11 +24392,11 @@ function __metadata(metadataKey, metadataValue) {
 }
 function __awaiter(thisArg, _arguments, P, generator) {
   function adopt(value) {
-    return value instanceof P ? value : new P(function(resolve2) {
-      resolve2(value);
+    return value instanceof P ? value : new P(function(resolve3) {
+      resolve3(value);
     });
   }
-  return new (P || (P = Promise))(function(resolve2, reject) {
+  return new (P || (P = Promise))(function(resolve3, reject) {
     function fulfilled(value) {
       try {
         step(generator.next(value));
@@ -24227,7 +24412,7 @@ function __awaiter(thisArg, _arguments, P, generator) {
       }
     }
     function step(result) {
-      result.done ? resolve2(result.value) : adopt(result.value).then(fulfilled, rejected);
+      result.done ? resolve3(result.value) : adopt(result.value).then(fulfilled, rejected);
     }
     step((generator = generator.apply(thisArg, _arguments || [])).next());
   });
@@ -24418,14 +24603,14 @@ function __asyncValues(o) {
   }, i);
   function verb(n) {
     i[n] = o[n] && function(v) {
-      return new Promise(function(resolve2, reject) {
-        v = o[n](v), settle(resolve2, reject, v.done, v.value);
+      return new Promise(function(resolve3, reject) {
+        v = o[n](v), settle(resolve3, reject, v.done, v.value);
       });
     };
   }
-  function settle(resolve2, reject, d, v) {
+  function settle(resolve3, reject, d, v) {
     Promise.resolve(v).then(function(v2) {
-      resolve2({ value: v2, done: d });
+      resolve3({ value: v2, done: d });
     }, reject);
   }
 }
@@ -31594,11 +31779,11 @@ function __metadata2(metadataKey, metadataValue) {
 }
 function __awaiter2(thisArg, _arguments, P, generator) {
   function adopt(value) {
-    return value instanceof P ? value : new P(function(resolve2) {
-      resolve2(value);
+    return value instanceof P ? value : new P(function(resolve3) {
+      resolve3(value);
     });
   }
-  return new (P || (P = Promise))(function(resolve2, reject) {
+  return new (P || (P = Promise))(function(resolve3, reject) {
     function fulfilled(value) {
       try {
         step(generator.next(value));
@@ -31614,7 +31799,7 @@ function __awaiter2(thisArg, _arguments, P, generator) {
       }
     }
     function step(result) {
-      result.done ? resolve2(result.value) : adopt(result.value).then(fulfilled, rejected);
+      result.done ? resolve3(result.value) : adopt(result.value).then(fulfilled, rejected);
     }
     step((generator = generator.apply(thisArg, _arguments || [])).next());
   });
@@ -31792,14 +31977,14 @@ function __asyncValues2(o) {
   }, i);
   function verb(n) {
     i[n] = o[n] && function(v) {
-      return new Promise(function(resolve2, reject) {
-        v = o[n](v), settle(resolve2, reject, v.done, v.value);
+      return new Promise(function(resolve3, reject) {
+        v = o[n](v), settle(resolve3, reject, v.done, v.value);
       });
     };
   }
-  function settle(resolve2, reject, d, v) {
+  function settle(resolve3, reject, d, v) {
     Promise.resolve(v).then(function(v2) {
-      resolve2({ value: v2, done: d });
+      resolve3({ value: v2, done: d });
     }, reject);
   }
 }
@@ -48184,12 +48369,12 @@ var require_form_data = __commonJS({
         if (value.end != void 0 && value.end != Infinity && value.start != void 0) {
           callback(null, value.end + 1 - (value.start ? value.start : 0));
         } else {
-          fs.stat(value.path, function(err, stat6) {
+          fs.stat(value.path, function(err, stat7) {
             if (err) {
               callback(err);
               return;
             }
-            var fileSize = stat6.size - (value.start ? value.start : 0);
+            var fileSize = stat7.size - (value.start ? value.start : 0);
             callback(null, fileSize);
           });
         }
@@ -48433,12 +48618,12 @@ var require_promisify = __commonJS({
     Object.defineProperty(exports, "__esModule", { value: true });
     function promisify4(fn) {
       return function(req, opts) {
-        return new Promise((resolve2, reject) => {
+        return new Promise((resolve3, reject) => {
           fn.call(this, req, opts, (err, rtn) => {
             if (err) {
               reject(err);
             } else {
-              resolve2(rtn);
+              resolve3(rtn);
             }
           });
         });
@@ -48642,7 +48827,7 @@ var require_parse_proxy_response = __commonJS({
     var debug_1 = __importDefault3(require_src());
     var debug = debug_1.default("https-proxy-agent:parse-proxy-response");
     function parseProxyResponse(socket) {
-      return new Promise((resolve2, reject) => {
+      return new Promise((resolve3, reject) => {
         let buffersLength = 0;
         const buffers = [];
         function read() {
@@ -48682,7 +48867,7 @@ var require_parse_proxy_response = __commonJS({
           const firstLine = buffered.toString("ascii", 0, buffered.indexOf("\r\n"));
           const statusCode = +firstLine.split(" ")[1];
           debug("got proxy server response: %o", firstLine);
-          resolve2({
+          resolve3({
             statusCode,
             buffered
           });
@@ -48703,11 +48888,11 @@ var require_agent = __commonJS({
     "use strict";
     var __awaiter3 = exports && exports.__awaiter || function(thisArg, _arguments, P, generator) {
       function adopt(value) {
-        return value instanceof P ? value : new P(function(resolve2) {
-          resolve2(value);
+        return value instanceof P ? value : new P(function(resolve3) {
+          resolve3(value);
         });
       }
-      return new (P || (P = Promise))(function(resolve2, reject) {
+      return new (P || (P = Promise))(function(resolve3, reject) {
         function fulfilled(value) {
           try {
             step(generator.next(value));
@@ -48723,7 +48908,7 @@ var require_agent = __commonJS({
           }
         }
         function step(result) {
-          result.done ? resolve2(result.value) : adopt(result.value).then(fulfilled, rejected);
+          result.done ? resolve3(result.value) : adopt(result.value).then(fulfilled, rejected);
         }
         step((generator = generator.apply(thisArg, _arguments || [])).next());
       });
@@ -49314,8 +49499,8 @@ var require_follow_redirects = __commonJS({
       }
       return parsed;
     }
-    function resolveUrl(relative2, base) {
-      return useNativeURL ? new URL2(relative2, base) : parseUrl(url.resolve(base, relative2));
+    function resolveUrl(relative, base) {
+      return useNativeURL ? new URL2(relative, base) : parseUrl(url.resolve(base, relative));
     }
     function validateUrl(input) {
       if (/^\[/.test(input.hostname) && !/^\[[:0-9a-f]+\]$/i.test(input.hostname)) {
@@ -50870,10 +51055,10 @@ var require_axios = __commonJS({
         this.__CANCEL__ = true;
       }
     };
-    function settle(resolve2, reject, response) {
+    function settle(resolve3, reject, response) {
       const validateStatus = response.config.validateStatus;
       if (!response.status || !validateStatus || validateStatus(response.status)) {
-        resolve2(response);
+        resolve3(response);
       } else {
         reject(new AxiosError("Request failed with status code " + response.status, response.status >= 400 && response.status < 500 ? AxiosError.ERR_BAD_REQUEST : AxiosError.ERR_BAD_RESPONSE, response.config, response.request, response));
       }
@@ -51501,12 +51686,12 @@ var require_axios = __commonJS({
       };
     }
     function throttle(fn, freq) {
-      let timestamp3 = 0;
+      let timestamp2 = 0;
       let threshold = 1e3 / freq;
       let lastArgs;
       let timer;
       const invoke = (args, now = Date.now()) => {
-        timestamp3 = now;
+        timestamp2 = now;
         lastArgs = null;
         if (timer) {
           clearTimeout(timer);
@@ -51516,7 +51701,7 @@ var require_axios = __commonJS({
       };
       const throttled = (...args) => {
         const now = Date.now();
-        const passed = now - timestamp3;
+        const passed = now - timestamp2;
         if (passed >= threshold) {
           invoke(args, now);
         } else {
@@ -51855,7 +52040,7 @@ var require_axios = __commonJS({
     }
     var isHttpAdapterSupported = typeof process !== "undefined" && utils$1.kindOf(process) === "process";
     var wrapAsync = (asyncExecutor) => {
-      return new Promise((resolve2, reject) => {
+      return new Promise((resolve3, reject) => {
         let onDone;
         let isDone;
         const done = (value, isRejected) => {
@@ -51865,7 +52050,7 @@ var require_axios = __commonJS({
         };
         const _resolve = (value) => {
           done(value);
-          resolve2(value);
+          resolve3(value);
         };
         const _reject = (reason) => {
           done(reason, true);
@@ -51926,7 +52111,7 @@ var require_axios = __commonJS({
       }
     };
     var httpAdapter = isHttpAdapterSupported && function httpAdapter2(config) {
-      return wrapAsync(async function dispatchHttpRequest(resolve2, reject, onDone) {
+      return wrapAsync(async function dispatchHttpRequest(resolve3, reject, onDone) {
         const own2 = (key) => utils$1.getSafeProp(config, key);
         const transitional = own2("transitional") || transitionalDefaults;
         let data = own2("data");
@@ -52040,7 +52225,7 @@ var require_axios = __commonJS({
           }
           let convertedData;
           if (method !== "GET") {
-            return settle(resolve2, reject, {
+            return settle(resolve3, reject, {
               status: 405,
               statusText: "method not allowed",
               headers: {},
@@ -52062,7 +52247,7 @@ var require_axios = __commonJS({
           } else if (responseType === "stream") {
             convertedData = stream.Readable.from(convertedData);
           }
-          return settle(resolve2, reject, {
+          return settle(resolve3, reject, {
             data: convertedData,
             status: 200,
             statusText: "OK",
@@ -52336,7 +52521,7 @@ var require_axios = __commonJS({
               });
             }
             response.data = responseStream;
-            settle(resolve2, reject, response);
+            settle(resolve3, reject, response);
           } else {
             const responseBuffer = [];
             let totalResponseBytes = 0;
@@ -52374,7 +52559,7 @@ var require_axios = __commonJS({
               } catch (err) {
                 return reject(AxiosError.from(err, null, config, response.request, response));
               }
-              settle(resolve2, reject, response);
+              settle(resolve3, reject, response);
             });
           }
           abortEmitter.once("abort", (err) => {
@@ -52706,7 +52891,7 @@ var require_axios = __commonJS({
     }
     var isXHRAdapterSupported = typeof XMLHttpRequest !== "undefined";
     var xhrAdapter = isXHRAdapterSupported && function(config) {
-      return new Promise(function dispatchXhrRequest(resolve2, reject) {
+      return new Promise(function dispatchXhrRequest(resolve3, reject) {
         const _config = resolveConfig(config);
         let requestData = _config.data;
         const requestHeaders = AxiosHeaders.from(_config.headers).normalize();
@@ -52742,7 +52927,7 @@ var require_axios = __commonJS({
             request
           };
           settle(function _resolve(value) {
-            resolve2(value);
+            resolve3(value);
             done();
           }, function _reject(err) {
             reject(err);
@@ -53240,8 +53425,8 @@ var require_axios = __commonJS({
             }
           }
           !isStreamResponse && unsubscribe && unsubscribe();
-          return await new Promise((resolve2, reject) => {
-            settle(resolve2, reject, {
+          return await new Promise((resolve3, reject) => {
+            settle(resolve3, reject, {
               data: responseData,
               headers: AxiosHeaders.from(response.headers),
               status: response.status,
@@ -53652,8 +53837,8 @@ var require_axios = __commonJS({
           throw new TypeError("executor must be a function.");
         }
         let resolvePromise;
-        this.promise = new Promise(function promiseExecutor(resolve2) {
-          resolvePromise = resolve2;
+        this.promise = new Promise(function promiseExecutor(resolve3) {
+          resolvePromise = resolve3;
         });
         const token = this;
         this.promise.then((cancel) => {
@@ -53666,9 +53851,9 @@ var require_axios = __commonJS({
         });
         this.promise.then = (onfulfilled) => {
           let _resolve;
-          const promise = new Promise((resolve2) => {
-            token.subscribe(resolve2);
-            _resolve = resolve2;
+          const promise = new Promise((resolve3) => {
+            token.subscribe(resolve3);
+            _resolve = resolve3;
           }).then(onfulfilled);
           promise.cancel = function reject() {
             token.unsubscribe(_resolve);
@@ -53898,8 +54083,8 @@ var require_util2 = __commonJS({
         }
         const duration = backoff.duration();
         log(`Promise rejected attempt #${backoff.attempts}, retrying in ${duration}ms: ${e.message}`);
-        await new Promise((resolve2) => {
-          setTimeout(resolve2, duration);
+        await new Promise((resolve3) => {
+          setTimeout(resolve3, duration);
         });
         return retryPromise(fn, attempts, backoff);
       }
@@ -54004,7 +54189,7 @@ var require_util2 = __commonJS({
       return resolver;
     }
     async function retrieveTlsAlpnCertificate(host, port, timeout = 3e4) {
-      return new Promise((resolve2, reject) => {
+      return new Promise((resolve3, reject) => {
         let result;
         const socket = tls.connect({
           host,
@@ -54027,7 +54212,7 @@ var require_util2 = __commonJS({
         });
         socket.on("end", () => {
           if (result) {
-            return resolve2(result.toString());
+            return resolve3(result.toString());
           }
           return reject(new Error("TLS ALPN lookup failed to retrieve certificate"));
         });
@@ -54168,8 +54353,8 @@ var require_axios2 = __commonJS({
             retryAfter = retryDefaultDelay * config.retryAttempt;
             log(`Unable to locate or parse retry-after response header, waiting ${retryAfter} seconds`);
           }
-          await new Promise((resolve2) => {
-            setTimeout(resolve2, retryAfter * 1e3);
+          await new Promise((resolve3) => {
+            setTimeout(resolve3, retryAfter * 1e3);
           });
           return instance(config);
         }
@@ -72851,9 +73036,9 @@ var require_pkcs7 = __commonJS({
         var jan_1_2050 = /* @__PURE__ */ new Date("2050-01-01T00:00:00Z");
         var date = attr.value;
         if (typeof date === "string") {
-          var timestamp3 = Date.parse(date);
-          if (!isNaN(timestamp3)) {
-            date = new Date(timestamp3);
+          var timestamp2 = Date.parse(date);
+          if (!isNaN(timestamp2)) {
+            date = new Date(timestamp2);
           } else if (date.length === 13) {
             date = asn1.utcTimeToDate(date);
           } else {
@@ -73934,7 +74119,7 @@ var require_remote_dsh = __commonJS({
       return claims;
     }
     function readJsonBody(request, maxBytes = 64 * 1024) {
-      return new Promise((resolve2, reject) => {
+      return new Promise((resolve3, reject) => {
         const chunks = [];
         let size = 0;
         request.on("data", (chunk) => {
@@ -73948,7 +74133,7 @@ var require_remote_dsh = __commonJS({
         });
         request.once("end", () => {
           try {
-            resolve2(JSON.parse(Buffer.concat(chunks).toString("utf8")));
+            resolve3(JSON.parse(Buffer.concat(chunks).toString("utf8")));
           } catch {
             reject(new Error("invalid_json"));
           }
@@ -74202,7 +74387,7 @@ var require_remote_dsh = __commonJS({
         usedGrants,
         async start() {
           if (address) return address;
-          await new Promise((resolve2, reject) => server.once("error", reject).listen({ host: "127.0.0.1", port: 0, exclusive: true }, resolve2));
+          await new Promise((resolve3, reject) => server.once("error", reject).listen({ host: "127.0.0.1", port: 0, exclusive: true }, resolve3));
           address = server.address();
           return address;
         },
@@ -74210,7 +74395,7 @@ var require_remote_dsh = __commonJS({
           sessions.clear();
           usedGrants.clear();
           if (!address) return;
-          await new Promise((resolve2) => server.close(resolve2));
+          await new Promise((resolve3) => server.close(resolve3));
           address = null;
         }
       };
@@ -74789,13 +74974,13 @@ ${registrationNonce}`);
         const socket = tunnel;
         tunnel = null;
         if (socket && !socket.destroyed) {
-          await new Promise((resolve2) => {
+          await new Promise((resolve3) => {
             let settled = false;
             const finish = () => {
               if (settled) return;
               settled = true;
               clearTimeout(timer);
-              resolve2();
+              resolve3();
             };
             const timer = setTimeout(() => {
               socket.destroy();
@@ -74854,11 +75039,11 @@ ${registrationNonce}`);
 
 // apps/cli/src/index.ts
 import { execFile as execFile4, spawn as spawn3 } from "node:child_process";
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash7, randomBytes as randomBytes3 } from "node:crypto";
 import { closeSync as closeSync2, existsSync as existsSync4, openSync as openSync2, readFileSync as readFileSync2 } from "node:fs";
 import { arch, hostname as hostname2, platform as platform2, tmpdir } from "node:os";
-import { appendFile as appendFile3, chmod as chmod5, copyFile as copyFile3, cp as cp2, link, mkdir as mkdir6, mkdtemp, readdir as readdir3, readFile as readFile9, rm as rm6, stat as stat5, writeFile as writeFile6 } from "node:fs/promises";
-import { basename as basename3, dirname as dirname6, join as join9 } from "node:path";
+import { appendFile as appendFile3, chmod as chmod5, copyFile as copyFile2, cp as cp2, link, mkdir as mkdir6, mkdtemp, readdir as readdir3, readFile as readFile10, rm as rm6, stat as stat6, writeFile as writeFile6 } from "node:fs/promises";
+import { basename as basename2, dirname as dirname6, join as join10 } from "node:path";
 import { createInterface } from "node:readline/promises";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { promisify as promisify3 } from "node:util";
@@ -74875,6 +75060,21 @@ var ApiError = class extends Error {
   code;
   details;
 };
+var apiFailureObserver = null;
+function notifyApiFailure(event) {
+  try {
+    void Promise.resolve(apiFailureObserver?.(event)).catch(() => void 0);
+  } catch {
+  }
+}
+function diagnosticPath(path) {
+  try {
+    const parsed = /^https?:\/\//i.test(path) ? new URL(path) : new URL(path.replace(/^\/+/, ""), "http://keysync.local/");
+    return parsed.pathname;
+  } catch {
+    return "invalid-path";
+  }
+}
 var KEYSYNC_CLIENT_CAPABILITIES = "deepseek_harness_managed_agent_v1,deepseek_harness_dynamic_release_v1,remote_dsh_tls_tunnel_v1,default_provider_credit_v1";
 var KeySyncApiClient = class {
   constructor(options) {
@@ -74917,15 +75117,34 @@ var KeySyncApiClient = class {
         signal: controller?.signal
       });
     } catch (error) {
-      if (controller?.signal.aborted) throw new ApiError(0, "REQUEST_TIMEOUT", `Request timed out after ${timeoutMs}ms`);
-      throw new ApiError(0, "NETWORK_ERROR", "Cannot reach the backend server");
+      const apiError = controller?.signal.aborted ? new ApiError(0, "REQUEST_TIMEOUT", `Request timed out after ${timeoutMs}ms`) : new ApiError(0, "NETWORK_ERROR", "Cannot reach the backend server");
+      notifyApiFailure({ method, path: diagnosticPath(path), status: apiError.status, code: apiError.code, message: apiError.message, failure_stage: "request" });
+      throw apiError;
     } finally {
       if (timeout) clearTimeout(timeout);
     }
-    const payload = await response.json().catch(() => ({}));
+    const rawResponse = await response.text();
+    let payload = {};
+    if (rawResponse.trim()) {
+      try {
+        payload = JSON.parse(rawResponse);
+      } catch {
+        if (response.ok) {
+          const apiError = new ApiError(response.status, "RESPONSE_PARSE_ERROR", "Backend returned an invalid JSON response");
+          notifyApiFailure({ method, path: diagnosticPath(path), status: apiError.status, code: apiError.code, message: apiError.message, failure_stage: "response_parse" });
+          throw apiError;
+        }
+      }
+    } else if (response.ok && response.status !== 204) {
+      const apiError = new ApiError(response.status, "RESPONSE_PARSE_ERROR", "Backend returned an empty response");
+      notifyApiFailure({ method, path: diagnosticPath(path), status: apiError.status, code: apiError.code, message: apiError.message, failure_stage: "response_parse" });
+      throw apiError;
+    }
     if (!response.ok) {
       const message = payload.error?.message?.trim() || payload.message?.trim() || response.statusText.trim() || `HTTP ${response.status}`;
-      throw new ApiError(response.status, payload.error?.code ?? "HTTP_ERROR", message, payload.error?.details);
+      const apiError = new ApiError(response.status, payload.error?.code ?? "HTTP_ERROR", message, payload.error?.details);
+      notifyApiFailure({ method, path: diagnosticPath(path), status: apiError.status, code: apiError.code, message: apiError.message, failure_stage: "response" });
+      throw apiError;
     }
     return payload.data;
   }
@@ -74947,13 +75166,13 @@ var KeySyncApiClient = class {
 };
 
 // packages/client-core/src/index.ts
-import { appendFile, chmod as chmod2, mkdir as mkdir3, readFile as readFile6, rename as rename2, rm as rm3, stat as stat3, writeFile as writeFile3 } from "node:fs/promises";
+import { appendFile, chmod as chmod2, mkdir as mkdir3, readFile as readFile7, rename as rename3, rm as rm3, stat as stat4, writeFile as writeFile3 } from "node:fs/promises";
 import { closeSync, existsSync as existsSync3, openSync } from "node:fs";
 import { execFile as execFile2, spawn } from "node:child_process";
 import { createServer } from "node:net";
-import { delimiter as delimiter2, dirname as dirname3, join as join6, posix as posixPath, win32 as win32Path2 } from "node:path";
+import { delimiter as delimiter2, dirname as dirname3, join as join7, resolve as resolve2, posix as posixPath, win32 as win32Path2 } from "node:path";
 import { homedir as homedir6, platform } from "node:os";
-import { createCipheriv, createDecipheriv, createHash as createHash5, createHmac, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, pbkdf2Sync, randomBytes } from "node:crypto";
+import { createCipheriv, createDecipheriv, createHash as createHash5, createHmac, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, pbkdf2Sync, randomBytes as randomBytes2 } from "node:crypto";
 
 // packages/app-adapters/src/index.ts
 import { access, chmod, constants, copyFile, mkdir, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
@@ -84371,7 +84590,7 @@ var apiProtocols = [
 var agentAppNames = ["ClaudeCode", "Claude", "Codex", "OpenClaw", "Hermes", "DeepSeekHarness"];
 var appSourceTypes = ["provider", "runtime_config"];
 var deviceLifecycleStatuses = ["active", "removed"];
-var applyStatuses = ["success", "failed"];
+var applyStatuses = ["success", "failed", "conflict"];
 var protocolBridgeModes = ["always", "when_needed", "off"];
 var bindingCompatibilityStatuses = ["direct", "bridge_required", "bridge_optional", "unavailable", "conflict"];
 var bindingCompatibilityReasonCodes = [
@@ -84510,7 +84729,7 @@ var rawProviderTemplates = {
       sort_order: 30
     },
     endpoints: [
-      { name: "GLM Coding OpenAI Chat", protocol: "openai_chat_completions", base_url: "https://api.z.ai/api/coding/paas/v4", sort_order: 0 },
+      { name: "GLM Coding OpenAI Chat", protocol: "openai_chat_completions", base_url: "https://open.bigmodel.cn/api/coding/paas/v4", sort_order: 0 },
       { name: "GLM Anthropic", protocol: "anthropic_messages", base_url: "https://api.z.ai/api/anthropic", sort_order: 1 }
     ]
   },
@@ -84568,8 +84787,8 @@ var rawProviderTemplates = {
       description: "\u544A\u8BC9\u5BA2\u670D\u8981\u5F00 GPT \u4F1A\u5458\uFF1B\u5BA2\u670D\u534F\u52A9\u8D2D\u4E70\u4F1A\u5458\u8D26\u53F7\uFF0C\u4E70\u5B8C\u540E\u5728\u672C\u673A\u767B\u5F55 Codex\uFF0C\u518D\u56DE\u6765\u5BFC\u5165\u3002",
       steps: [
         "\u5BA2\u670D\u534F\u52A9\u8D2D\u4E70 GPT \u4F1A\u5458\u8D26\u53F7",
-        "\u5728\u5F53\u524D\u7535\u8111\u5B8C\u6210 Codex \u5B98\u65B9\u767B\u5F55",
-        "\u56DE\u5230\u8FD9\u91CC\u9009\u62E9\u201C\u6211\u5DF2\u7ECF\u6709\u201D\uFF0C\u4ECE\u672C\u5730 Codex \u5BFC\u5165"
+        "\u5728\u5F53\u524D\u8BBE\u5907\u5B8C\u6210 Codex \u5B98\u65B9\u767B\u5F55",
+        "\u56DE\u5230\u8FD9\u91CC\u9009\u62E9\u201C\u6211\u5DF2\u7ECF\u6709\u201D\uFF0C\u4ECE\u672C\u673A Codex \u5BFC\u5165"
       ],
       sort_order: 10
     },
@@ -84776,8 +84995,8 @@ var ccSwitchCoreProviderTemplatesV2 = [
       description: "\u544A\u8BC9\u5BA2\u670D\u8981\u5F00 Claude \u4F1A\u5458\uFF1B\u5BA2\u670D\u534F\u52A9\u8D2D\u4E70\u4F1A\u5458\u8D26\u53F7\uFF0C\u4E70\u5B8C\u540E\u5728\u672C\u673A\u767B\u5F55 Claude Code\uFF0C\u518D\u56DE\u6765\u5BFC\u5165\u3002",
       steps: [
         "\u5BA2\u670D\u534F\u52A9\u8D2D\u4E70 Claude \u4F1A\u5458\u8D26\u53F7",
-        "\u5728\u5F53\u524D\u7535\u8111\u5B8C\u6210 Claude Code \u5B98\u65B9\u767B\u5F55",
-        "\u56DE\u5230\u8FD9\u91CC\u9009\u62E9\u201C\u6211\u5DF2\u7ECF\u6709\u201D\uFF0C\u4ECE\u672C\u5730 Claude Code \u5BFC\u5165"
+        "\u5728\u5F53\u524D\u8BBE\u5907\u5B8C\u6210 Claude Code \u5B98\u65B9\u767B\u5F55",
+        "\u56DE\u5230\u8FD9\u91CC\u9009\u62E9\u201C\u6211\u5DF2\u7ECF\u6709\u201D\uFF0C\u4ECE\u672C\u673A Claude Code \u5BFC\u5165"
       ],
       sort_order: 15
     },
@@ -84801,8 +85020,8 @@ var ccSwitchCoreProviderTemplatesV2 = [
       description: "\u544A\u8BC9\u5BA2\u670D\u8981\u5F00 GPT \u4F1A\u5458\uFF1B\u5BA2\u670D\u534F\u52A9\u8D2D\u4E70\u4F1A\u5458\u8D26\u53F7\uFF0C\u4E70\u5B8C\u540E\u5728\u672C\u673A\u767B\u5F55 Codex\uFF0C\u518D\u56DE\u6765\u5BFC\u5165\u3002",
       steps: [
         "\u5BA2\u670D\u534F\u52A9\u8D2D\u4E70 GPT \u4F1A\u5458\u8D26\u53F7",
-        "\u5728\u5F53\u524D\u7535\u8111\u5B8C\u6210 Codex \u5B98\u65B9\u767B\u5F55",
-        "\u56DE\u5230\u8FD9\u91CC\u9009\u62E9\u201C\u6211\u5DF2\u7ECF\u6709\u201D\uFF0C\u4ECE\u672C\u5730 Codex \u5BFC\u5165"
+        "\u5728\u5F53\u524D\u8BBE\u5907\u5B8C\u6210 Codex \u5B98\u65B9\u767B\u5F55",
+        "\u56DE\u5230\u8FD9\u91CC\u9009\u62E9\u201C\u6211\u5DF2\u7ECF\u6709\u201D\uFF0C\u4ECE\u672C\u673A Codex \u5BFC\u5165"
       ],
       sort_order: 10
     },
@@ -84865,6 +85084,78 @@ var ccSwitchCoreProviderTemplatesV2 = [
       cc_switch_family: "cloud_provider"
     },
     sort_order: 250
+  },
+  {
+    type: "ant_ling",
+    display_name: "Ant Ling",
+    description: "Ant Ling OpenAI-compatible API.",
+    template_group: "official",
+    fields: [apiKeyField, defaultModelField("Ling-2.6-flash")],
+    defaults: { default_model: "Ling-2.6-flash", endpoints: [{ protocol: "openai_chat_completions", base_url: "https://api.ant-ling.com/v1" }], cc_switch_family: "official_api" },
+    sort_order: 260
+  },
+  {
+    type: "groq",
+    display_name: "Groq",
+    description: "Groq OpenAI-compatible API.",
+    template_group: "official",
+    fields: [apiKeyField, defaultModelField("llama-3.3-70b-versatile")],
+    defaults: { default_model: "llama-3.3-70b-versatile", endpoints: [{ protocol: "openai_chat_completions", base_url: "https://api.groq.com/openai/v1" }], cc_switch_family: "official_api" },
+    sort_order: 261
+  },
+  {
+    type: "moonshotai",
+    display_name: "Moonshot AI",
+    description: "Moonshot AI international OpenAI-compatible API.",
+    template_group: "official",
+    fields: [apiKeyField, defaultModelField("kimi-k2.6")],
+    defaults: { default_model: "kimi-k2.6", endpoints: [{ protocol: "openai_chat_completions", base_url: "https://api.moonshot.ai/v1" }], cc_switch_family: "official_api" },
+    sort_order: 262
+  },
+  {
+    type: "qwen_token_plan",
+    display_name: "Qwen Token Plan",
+    description: "Qwen Token Plan OpenAI-compatible API.",
+    template_group: "official",
+    fields: [apiKeyField, defaultModelField("qwen3.6-plus")],
+    defaults: { default_model: "qwen3.6-plus", endpoints: [{ protocol: "openai_chat_completions", base_url: "https://token-plan.ap-southeast-1.maas.aliyuncs.com/compatible-mode/v1" }], cc_switch_family: "official_api" },
+    sort_order: 263
+  },
+  {
+    type: "qwen_token_plan_cn",
+    display_name: "Qwen Token Plan CN",
+    description: "Qwen Token Plan China OpenAI-compatible API.",
+    template_group: "official",
+    fields: [apiKeyField, defaultModelField("qwen3.6-plus")],
+    defaults: { default_model: "qwen3.6-plus", endpoints: [{ protocol: "openai_chat_completions", base_url: "https://token-plan.cn-beijing.maas.aliyuncs.com/compatible-mode/v1" }], cc_switch_family: "official_api" },
+    sort_order: 264
+  },
+  {
+    type: "xiaomi_token_plan_ams",
+    display_name: "Xiaomi Token Plan AMS",
+    description: "Xiaomi MiMo Token Plan international API.",
+    template_group: "official",
+    fields: [apiKeyField, defaultModelField("mimo-v2.5-pro")],
+    defaults: { default_model: "mimo-v2.5-pro", endpoints: [{ protocol: "openai_chat_completions", base_url: "https://token-plan-ams.xiaomimimo.com/v1" }], cc_switch_family: "official_api" },
+    sort_order: 265
+  },
+  {
+    type: "xiaomi_token_plan_cn",
+    display_name: "Xiaomi Token Plan CN",
+    description: "Xiaomi MiMo Token Plan China API.",
+    template_group: "official",
+    fields: [apiKeyField, defaultModelField("mimo-v2.5-pro")],
+    defaults: { default_model: "mimo-v2.5-pro", endpoints: [{ protocol: "openai_chat_completions", base_url: "https://token-plan-cn.xiaomimimo.com/v1" }], cc_switch_family: "official_api" },
+    sort_order: 266
+  },
+  {
+    type: "xiaomi_token_plan_sgp",
+    display_name: "Xiaomi Token Plan SGP",
+    description: "Xiaomi MiMo Token Plan Singapore API.",
+    template_group: "official",
+    fields: [apiKeyField, defaultModelField("mimo-v2.5-pro")],
+    defaults: { default_model: "mimo-v2.5-pro", endpoints: [{ protocol: "openai_chat_completions", base_url: "https://token-plan-sgp.xiaomimimo.com/v1" }], cc_switch_family: "official_api" },
+    sort_order: 267
   }
 ];
 var ccSwitchProviderTemplatesV2 = [
@@ -86118,7 +86409,7 @@ async function commandSearchPathEntries() {
 }
 var execFileAsync = promisify(execFile);
 function sleep(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 function restartableAppName(appName) {
   return appName === "Codex" || appName === "Claude" ? appName : null;
@@ -87736,20 +88027,29 @@ async function applyDeepSeekHarnessConfig(input, endpoint) {
   if (typeof apiKey !== "string" || !apiKey) throw new Error("Missing provider secret: api_key");
   const context = contextFor(input, endpoint);
   const model = providerDefaultModel(context);
-  const existingAdapter = scalarRecord(settings["llm-deepseek"]);
-  const existingDefault = scalarRecord(settings["agent-default-model"]);
-  settings["llm-deepseek"] = {
-    ...existingAdapter,
-    apiKeyEnv: "DEEPSEEK_API_KEY",
-    baseURL: endpoint.base_url,
-    models: [{ id: model, name: model }]
-  };
-  settings["agent-default-model"] = {
-    ...existingDefault,
-    provider: "deepseek-official",
-    model
-  };
-  credentialStore.refs.DEEPSEEK_API_KEY = apiKey;
+  const native = input.provider.type ? dshNativeBindingFor(input.provider.type) : null;
+  if (native?.adapter === "deepseek") {
+    settings["agent-default-model"] = { provider: native.provider, model, reasoningEffort: "high" };
+    credentialStore.refs[native.credentialRef] = apiKey;
+  } else {
+    const piAi = scalarRecord(settings["llm-pi-ai"]);
+    const profiles = scalarRecord(piAi.providers);
+    const binding = native ?? dshCustomBinding(input.provider.type, input.provider.name);
+    const profile = scalarRecord(profiles[binding.provider]);
+    if (native) {
+      const nativeProfile = { ...profile, apiKeyEnv: binding.credentialRef };
+      delete nativeProfile.api;
+      delete nativeProfile.baseURL;
+      delete nativeProfile.models;
+      delete nativeProfile.displayName;
+      profiles[binding.provider] = nativeProfile;
+    } else {
+      profiles[binding.provider] = { ...profile, displayName: input.provider.name, apiKeyEnv: binding.credentialRef, api: "openai-completions", baseURL: endpoint.base_url, models: [{ id: model, name: model }] };
+    }
+    settings["llm-pi-ai"] = { ...piAi, providers: profiles };
+    settings["agent-default-model"] = { provider: binding.provider, model };
+    credentialStore.refs[binding.credentialRef] = apiKey;
+  }
   const credentials = renderDshCredentials(credentialStore, await dshCredentialsLayout(credentialStore, input.runtimePathOptions));
   const writes = [
     { path: settingsPath, content: yamlDocument(settings) },
@@ -87784,6 +88084,44 @@ async function applyDeepSeekHarnessConfig(input, endpoint) {
     config_changed: configChanged
   };
 }
+var DSH_NATIVE_BINDINGS = {
+  ant_ling: { provider: "ant-ling", credentialRef: "ANT_LING_API_KEY", adapter: "pi-ai" },
+  cerebras: { provider: "cerebras", credentialRef: "CEREBRAS_API_KEY", adapter: "pi-ai" },
+  deepseek: { provider: "deepseek-official", credentialRef: "DEEPSEEK_API_KEY", adapter: "deepseek" },
+  fireworks_ai: { provider: "fireworks", credentialRef: "FIREWORKS_API_KEY", adapter: "pi-ai" },
+  groq: { provider: "groq", credentialRef: "GROQ_API_KEY", adapter: "pi-ai" },
+  huggingface_inference: { provider: "huggingface", credentialRef: "HUGGINGFACE_API_KEY", adapter: "pi-ai" },
+  kimi: { provider: "moonshotai-cn", credentialRef: "MOONSHOTAI_CN_API_KEY", adapter: "pi-ai" },
+  kimi_k26: { provider: "moonshotai-cn", credentialRef: "MOONSHOTAI_CN_API_KEY", adapter: "pi-ai" },
+  mistral_ai: { provider: "mistral", credentialRef: "MISTRAL_API_KEY", adapter: "pi-ai" },
+  moonshotai: { provider: "moonshotai", credentialRef: "MOONSHOTAI_API_KEY", adapter: "pi-ai" },
+  nvidia: { provider: "nvidia", credentialRef: "NVIDIA_API_KEY", adapter: "pi-ai" },
+  nvidia_nim: { provider: "nvidia", credentialRef: "NVIDIA_API_KEY", adapter: "pi-ai" },
+  openai_api: { provider: "openai", credentialRef: "OPENAI_API_KEY", adapter: "pi-ai" },
+  openrouter: { provider: "openrouter", credentialRef: "OPENROUTER_API_KEY", adapter: "pi-ai" },
+  opencode_go_deepseek_v4_flash: { provider: "opencode-go", credentialRef: "OPENCODE_GO_API_KEY", adapter: "pi-ai" },
+  qwen_token_plan: { provider: "qwen-token-plan", credentialRef: "QWEN_TOKEN_PLAN_API_KEY", adapter: "pi-ai" },
+  qwen_token_plan_cn: { provider: "qwen-token-plan-cn", credentialRef: "QWEN_TOKEN_PLAN_CN_API_KEY", adapter: "pi-ai" },
+  together_ai: { provider: "together", credentialRef: "TOGETHER_API_KEY", adapter: "pi-ai" },
+  vercel_ai_gateway: { provider: "vercel-ai-gateway", credentialRef: "VERCEL_AI_GATEWAY_API_KEY", adapter: "pi-ai" },
+  xai_grok: { provider: "xai", credentialRef: "XAI_API_KEY", adapter: "pi-ai" },
+  xiaomi_mimo: { provider: "xiaomi", credentialRef: "XIAOMI_API_KEY", adapter: "pi-ai" },
+  xiaomi_mimo_token_plan_cn: { provider: "xiaomi-token-plan-cn", credentialRef: "XIAOMI_TOKEN_PLAN_CN_API_KEY", adapter: "pi-ai" },
+  xiaomi_token_plan_ams: { provider: "xiaomi-token-plan-ams", credentialRef: "XIAOMI_TOKEN_PLAN_AMS_API_KEY", adapter: "pi-ai" },
+  xiaomi_token_plan_cn: { provider: "xiaomi-token-plan-cn", credentialRef: "XIAOMI_TOKEN_PLAN_CN_API_KEY", adapter: "pi-ai" },
+  xiaomi_token_plan_sgp: { provider: "xiaomi-token-plan-sgp", credentialRef: "XIAOMI_TOKEN_PLAN_SGP_API_KEY", adapter: "pi-ai" },
+  glm_coding_plan: { provider: "zai-coding-cn", credentialRef: "ZAI_CODING_CN_API_KEY", adapter: "pi-ai" },
+  zhipu_glm: { provider: "zai", credentialRef: "ZAI_API_KEY", adapter: "pi-ai" },
+  zhipu_glm_en: { provider: "zai", credentialRef: "ZAI_API_KEY", adapter: "pi-ai" }
+};
+function dshNativeBindingFor(providerType) {
+  return DSH_NATIVE_BINDINGS[providerType.replace(/^ccswitch_/, "")] ?? null;
+}
+function dshCustomBinding(providerType, providerName) {
+  const route = `keysync-${(providerType ?? providerName).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "provider"}`;
+  const credentialRef = `KEYSYNC_${route.replace(/[^A-Z0-9]+/gi, "_").toUpperCase()}_API_KEY`;
+  return { provider: route, credentialRef, adapter: "pi-ai" };
+}
 async function applyAppConfig(input) {
   const endpoint = preferredEndpointFor(input) ?? selectEndpoint(input.appName, input.provider.endpoints, input.supportedProtocols);
   if (!endpoint) {
@@ -87846,22 +88184,16 @@ function resolveProviderForApp(snapshot, appId) {
 }
 
 // packages/client-core/src/codex-session-migration.ts
-import { copyFile as copyFile2, mkdir as mkdir2, readFile as readFile2, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
+import { readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
 import { existsSync, readdirSync } from "node:fs";
 import { homedir as homedir2 } from "node:os";
-import { basename as basename2, dirname as dirname2, join as join2, relative, resolve } from "node:path";
+import { join as join2, resolve } from "node:path";
 import { DatabaseSync } from "node:sqlite";
-function timestamp2(date = /* @__PURE__ */ new Date()) {
-  return date.toISOString().replace(/[-:]/g, "").replace(".", "-").replace("Z", "").replace("T", "-");
-}
 function expandHome(path) {
   if (path === "~") return homedir2();
   if (path.startsWith("~/")) return join2(homedir2(), path.slice(2));
   return path;
 }
-function sqlString(value) {
-  return `'${value.replace(/'/g, "''")}'`;
-}
 async function readCodexEffectiveSessionProvider(configPath) {
   let text = "";
   try {
@@ -87914,31 +88246,6 @@ function discoverCodexStateDatabases(codexHome) {
   walk(codexHome);
   return candidates;
 }
-function backupPathFor(sourcePath, codexHome, backupRoot) {
-  const source = resolve(sourcePath);
-  const home = resolve(codexHome);
-  const relativePath = source.startsWith(`${home}/`) ? relative(home, source) : basename2(source);
-  return join2(backupRoot, relativePath);
-}
-function uniqueBackupPath(path) {
-  if (!existsSync(path)) return path;
-  for (let index = 1; ; index += 1) {
-    const candidate = `${path}.${index}`;
-    if (!existsSync(candidate)) return candidate;
-  }
-}
-async function createSqliteBackup(db, dbPath, codexHome, backupRoot) {
-  const backupPath = uniqueBackupPath(`${backupPathFor(dbPath, codexHome, backupRoot)}.bak`);
-  await mkdir2(dirname2(backupPath), { recursive: true });
-  db.exec(`VACUUM INTO ${sqlString(backupPath)}`);
-  return backupPath;
-}
-async function backupRolloutFile(rolloutPath, codexHome, backupRoot) {
-  const backupPath = uniqueBackupPath(backupPathFor(rolloutPath, codexHome, backupRoot));
-  await mkdir2(dirname2(backupPath), { recursive: true });
-  await copyFile2(rolloutPath, backupPath);
-  return backupPath;
-}
 function hasThreadsTable(db) {
   const row = db.prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'threads'").get();
   return row?.name === "threads";
@@ -87950,7 +88257,7 @@ function updateThreadProviders(db, targetProvider) {
   const result = db.prepare("UPDATE threads SET model_provider = ? WHERE model_provider <> ?").run(targetProvider, targetProvider);
   return Number(result.changes ?? 0);
 }
-async function updateRolloutProvider(rolloutPath, targetProvider, codexHome, backupRoot, warnings) {
+async function updateRolloutProvider(rolloutPath, targetProvider, warnings) {
   if (!existsSync(rolloutPath)) {
     warnings.push({ path: rolloutPath, code: "ROLLOUT_NOT_FOUND", message: "Rollout file was not found." });
     return { status: "skipped" };
@@ -87987,54 +88294,18 @@ async function updateRolloutProvider(rolloutPath, targetProvider, codexHome, bac
     return { status: "skipped" };
   }
   if (payload.model_provider === targetProvider) return { status: "skipped" };
-  let backupPath;
-  try {
-    backupPath = await backupRolloutFile(rolloutPath, codexHome, backupRoot);
-  } catch (error) {
-    warnings.push({ path: rolloutPath, code: "ROLLOUT_BACKUP_FAILED", message: error instanceof Error ? error.message : "Rollout file could not be backed up." });
-    return { status: "skipped" };
-  }
   payload.model_provider = targetProvider;
   lines[0] = `${JSON.stringify(firstEvent)}${newline}`;
   try {
     await writeFile2(rolloutPath, lines.join(""), "utf8");
-    return { status: "changed", backupPath };
+    return { status: "changed" };
   } catch (error) {
     warnings.push({ path: rolloutPath, code: "ROLLOUT_WRITE_FAILED", message: error instanceof Error ? error.message : "Rollout file could not be written." });
-    return { status: "skipped", backupPath };
-  }
-}
-function countFilesRecursively(root) {
-  if (!existsSync(root)) return 0;
-  let count = 0;
-  let entries;
-  try {
-    entries = readdirSync(root, { withFileTypes: true });
-  } catch {
-    return 0;
-  }
-  for (const entry of entries) {
-    const path = join2(root, entry.name);
-    if (entry.isDirectory()) count += countFilesRecursively(path);
-    else count += 1;
-  }
-  return count;
-}
-async function cleanupSuccessfulMigrationBackups(backupBaseDir, warnings) {
-  const fileCount = countFilesRecursively(backupBaseDir);
-  if (fileCount === 0) return 0;
-  try {
-    await rm2(backupBaseDir, { recursive: true, force: true });
-    return fileCount;
-  } catch (error) {
-    warnings.push({ path: backupBaseDir, code: "BACKUP_CLEANUP_FAILED", message: error instanceof Error ? error.message : "Migration backups could not be cleaned up." });
-    return 0;
+    return { status: "skipped" };
   }
 }
 async function migrateCodexSessionsToProvider(targetProvider, options) {
   const codexHome = resolve(expandHome(options.codexHome));
-  const backupBaseDir = options.backupDir ?? join2(codexHome, "backups", "session_convert");
-  const backupRoot = join2(backupBaseDir, `migration.${timestamp2(options.now)}`);
   const warnings = [];
   const result = {
     target_provider: targetProvider,
@@ -88043,12 +88314,9 @@ async function migrateCodexSessionsToProvider(targetProvider, options) {
     sqlite_rows_changed: 0,
     rollout_files_changed: 0,
     rollout_files_skipped: 0,
-    backups_created: 0,
-    backups_cleaned: 0,
     warnings
   };
   const processedRollouts = /* @__PURE__ */ new Set();
-  const createdBackups = [];
   for (const dbPath of discoverCodexStateDatabases(codexHome)) {
     result.databases_found += 1;
     let db = null;
@@ -88062,13 +88330,10 @@ async function migrateCodexSessionsToProvider(targetProvider, options) {
       let sqliteUpdated = true;
       if (threads.some((thread) => thread.model_provider !== targetProvider)) {
         try {
-          const backupPath = await createSqliteBackup(db, dbPath, codexHome, backupRoot);
-          createdBackups.push(backupPath);
-          result.backups_created += 1;
           result.sqlite_rows_changed += updateThreadProviders(db, targetProvider);
         } catch (error) {
           sqliteUpdated = false;
-          warnings.push({ path: dbPath, code: "SQLITE_BACKUP_OR_UPDATE_FAILED", message: error instanceof Error ? error.message : "Codex state database could not be backed up or updated." });
+          warnings.push({ path: dbPath, code: "SQLITE_UPDATE_FAILED", message: error instanceof Error ? error.message : "Codex state database could not be updated." });
         }
       }
       if (!sqliteUpdated) {
@@ -88083,11 +88348,7 @@ async function migrateCodexSessionsToProvider(targetProvider, options) {
         const rolloutPath = resolve(expandHome(thread.rollout_path));
         if (processedRollouts.has(rolloutPath)) continue;
         processedRollouts.add(rolloutPath);
-        const rolloutResult = await updateRolloutProvider(rolloutPath, targetProvider, codexHome, backupRoot, warnings);
-        if (rolloutResult.backupPath) {
-          createdBackups.push(rolloutResult.backupPath);
-          result.backups_created += 1;
-        }
+        const rolloutResult = await updateRolloutProvider(rolloutPath, targetProvider, warnings);
         if (rolloutResult.status === "changed") {
           result.rollout_files_changed += 1;
         } else {
@@ -88100,9 +88361,6 @@ async function migrateCodexSessionsToProvider(targetProvider, options) {
       db?.close();
     }
   }
-  if (warnings.length === 0 && createdBackups.length > 0) {
-    result.backups_cleaned = await cleanupSuccessfulMigrationBackups(backupBaseDir, warnings);
-  }
   return result;
 }
 
@@ -88345,6 +88603,33 @@ async function probeLocalModelConfigs(options = {}) {
   return probes;
 }
 
+// packages/client-core/src/index.ts
+var import_install_identity = __toESM(require_install_identity(), 1);
+
+// packages/client-core/src/codex-login-import.ts
+import { createHash as createHash3 } from "node:crypto";
+import { readFile as readFile5 } from "node:fs/promises";
+import { homedir as homedir5 } from "node:os";
+import { join as join5 } from "node:path";
+
+// packages/client-core/src/provider-import-name.ts
+import { hostname } from "node:os";
+function uniqueProviderImportName(base, takenNames, deviceLabel = hostname()) {
+  const taken = new Set([...takenNames].map((name) => name.trim()).filter(Boolean));
+  if (!taken.has(base)) return base;
+  const label = deviceLabel.trim().replace(/\.local$/i, "");
+  const withDevice = label ? `${base} \xB7 ${label}` : base;
+  if (!taken.has(withDevice)) return withDevice;
+  for (let ordinal = 2; ordinal <= 99; ordinal += 1) {
+    const candidate = `${withDevice} ${ordinal}`;
+    if (!taken.has(candidate)) return candidate;
+  }
+  return `${withDevice} ${taken.size + 1}`;
+}
+function providerDisplayNames(providers) {
+  return providers.map((provider) => provider.name ?? "").filter(Boolean);
+}
+
 // packages/client-core/src/ccswitch-import.ts
 import { createHash as createHash2 } from "node:crypto";
 import { existsSync as existsSync2 } from "node:fs";
@@ -88798,29 +89083,7 @@ async function executeCcswitchProviderImport(client, options) {
   return { plan, created, updated, skipped };
 }
 
-// packages/client-core/src/provider-import-name.ts
-import { hostname } from "node:os";
-function uniqueProviderImportName(base, takenNames, deviceLabel = hostname()) {
-  const taken = new Set([...takenNames].map((name) => name.trim()).filter(Boolean));
-  if (!taken.has(base)) return base;
-  const label = deviceLabel.trim().replace(/\.local$/i, "");
-  const withDevice = label ? `${base} \xB7 ${label}` : base;
-  if (!taken.has(withDevice)) return withDevice;
-  for (let ordinal = 2; ordinal <= 99; ordinal += 1) {
-    const candidate = `${withDevice} ${ordinal}`;
-    if (!taken.has(candidate)) return candidate;
-  }
-  return `${withDevice} ${taken.size + 1}`;
-}
-function providerDisplayNames(providers) {
-  return providers.map((provider) => provider.name ?? "").filter(Boolean);
-}
-
 // packages/client-core/src/codex-login-import.ts
-import { createHash as createHash3 } from "node:crypto";
-import { readFile as readFile5 } from "node:fs/promises";
-import { homedir as homedir5 } from "node:os";
-import { join as join5 } from "node:path";
 var codexLoginImportSource = "codex";
 var codexLoginTemplateType = "codex_official_login";
 function defaultCodexConfigDir() {
@@ -89126,6 +89389,550 @@ async function executeCodexLoginProviderImport(client, options) {
 // packages/client-core/src/claude-login-import.ts
 import { createHash as createHash4 } from "node:crypto";
 
+// packages/client-core/src/diagnostic-reporter.ts
+import { randomBytes } from "node:crypto";
+import { mkdir as mkdir2, open, readFile as readFile6, rename as rename2, rm as rm2, stat as stat3 } from "node:fs/promises";
+import { dirname as dirname2, join as join6 } from "node:path";
+var import_diagnostic_sanitize = __toESM(require_diagnostic_sanitize(), 1);
+var LOCK_STALE_MS = 3e4;
+var UPLOAD_LEASE_MS = 45e3;
+var IDENTITY_EPOCH_PATTERN = /^epoch_[a-f0-9]{32}$/;
+var IDENTITY_PROOF_PATTERN = /^proof_[a-f0-9]{64}$/;
+var OWNER_USER_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,191}$/;
+function newIdentityEpoch() {
+  return `epoch_${randomBytes(16).toString("hex")}`;
+}
+function newIdentityProof() {
+  return `proof_${randomBytes(32).toString("hex")}`;
+}
+function normalizedOwnerUserId(value) {
+  if (value === null || value === void 0 || value === "") return null;
+  const normalized = String(value).trim();
+  if (!OWNER_USER_ID_PATTERN.test(normalized)) throw Object.assign(new Error("DIAGNOSTIC_IDENTITY_INVALID"), { code: "DIAGNOSTIC_IDENTITY_INVALID" });
+  return normalized;
+}
+function ensureIdentityEpochs(outbox) {
+  let legacyEpoch = null;
+  for (const event of outbox.events) {
+    if (!IDENTITY_EPOCH_PATTERN.test(event.identity_epoch || "")) {
+      legacyEpoch ??= newIdentityEpoch();
+      event.identity_epoch = legacyEpoch;
+      event.owner_user_id = null;
+    }
+    event.body.identity_epoch = event.identity_epoch;
+    if (typeof event.device_id === "string" && event.device_id) event.body.device_id = event.device_id;
+    if (!OWNER_USER_ID_PATTERN.test(event.owner_user_id || "")) event.owner_user_id = null;
+    delete event.body.user_id;
+  }
+  if (!outbox.identity || !IDENTITY_EPOCH_PATTERN.test(outbox.identity.current_epoch || "")) {
+    outbox.identity = { current_epoch: newIdentityEpoch(), current_owner_user_id: null, current_proof: newIdentityProof() };
+  } else {
+    outbox.identity.current_owner_user_id = OWNER_USER_ID_PATTERN.test(outbox.identity.current_owner_user_id || "") ? outbox.identity.current_owner_user_id : null;
+    if (!IDENTITY_PROOF_PATTERN.test(outbox.identity.current_proof || "")) {
+      outbox.identity.current_proof = outbox.events.find((event) => event.identity_epoch === outbox.identity?.current_epoch && IDENTITY_PROOF_PATTERN.test(event.identity_proof || ""))?.identity_proof ?? newIdentityProof();
+    }
+  }
+  outbox.owned_epochs ??= [];
+  for (const item of outbox.retired_pending_claims || []) {
+    if (!item.owner_user_id || !IDENTITY_EPOCH_PATTERN.test(item.identity_epoch) || typeof item.installation_id !== "string") continue;
+    if (!outbox.owned_epochs.some((owned) => owned.installation_id === item.installation_id && owned.identity_epoch === item.identity_epoch && owned.owner_user_id === item.owner_user_id)) {
+      outbox.owned_epochs.push({ installation_id: item.installation_id, identity_epoch: item.identity_epoch, identity_proof: IDENTITY_PROOF_PATTERN.test(item.identity_proof || "") ? item.identity_proof : newIdentityProof(), owner_user_id: item.owner_user_id, needs_reclaim: true });
+    }
+  }
+  for (const item of outbox.owned_epochs) {
+    if (!IDENTITY_PROOF_PATTERN.test(item.identity_proof || "")) {
+      item.identity_proof = outbox.events.find((event) => event.identity_epoch === item.identity_epoch && event.owner_user_id === item.owner_user_id && IDENTITY_PROOF_PATTERN.test(event.identity_proof || ""))?.identity_proof ?? newIdentityProof();
+    }
+  }
+  for (const event of outbox.events) {
+    const historical = outbox.owned_epochs.find((item) => item.identity_epoch === event.identity_epoch && item.owner_user_id === event.owner_user_id && item.installation_id === event.body.installation_id);
+    const proof = event.identity_epoch === outbox.identity.current_epoch ? outbox.identity.current_proof : historical?.identity_proof ?? event.identity_proof;
+    if (proof && IDENTITY_PROOF_PATTERN.test(proof)) {
+      event.identity_proof = proof;
+      event.body.identity_proof = proof;
+    } else {
+      delete event.identity_proof;
+      delete event.body.identity_proof;
+    }
+  }
+  return outbox.identity;
+}
+function stableErrorCode(value) {
+  const normalized = String(value ?? "").trim().toUpperCase().replace(/[^A-Z0-9_]/g, "_").slice(0, 80);
+  return /^[A-Z][A-Z0-9_]{1,80}$/.test(normalized) ? normalized : "CLIENT_OPERATION_FAILED";
+}
+async function readOutbox(filePath) {
+  try {
+    const parsed = JSON.parse(await readFile6(filePath, "utf8"));
+    if (parsed.version !== 1 || !Array.isArray(parsed.events)) throw new Error("DIAGNOSTIC_OUTBOX_CORRUPT");
+    const events = parsed.events.map((event) => {
+      if (!("body" in event)) {
+        const { queued_at, attempts, last_attempt_at, last_error_code, next_attempt_at, rejected_at, rejection_status, rejection_code, ...body } = event;
+        return { version: 1, client_event_id: body.client_event_id, device_id: body.device_id ?? null, body, queued_at, attempts, last_attempt_at, last_error_code, next_attempt_at, rejected_at, rejection_status, rejection_code };
+      }
+      return event;
+    });
+    if (events.some((event) => !event || typeof event.client_event_id !== "string" || !event.body || typeof event.body.installation_id !== "string" || typeof event.body.domain !== "string" || typeof event.body.action !== "string" || typeof event.body.message !== "string" || typeof event.attempts !== "number")) {
+      throw new Error("DIAGNOSTIC_OUTBOX_CORRUPT");
+    }
+    const outbox = { version: 1, events, rejected_evicted: Number(parsed.rejected_evicted ?? 0), dropped_capacity: Number(parsed.dropped_capacity ?? 0), pending_claim: parsed.pending_claim ?? null, retired_pending_claims: parsed.retired_pending_claims ?? [], owned_epochs: parsed.owned_epochs ?? [], identity: parsed.identity ?? null };
+    ensureIdentityEpochs(outbox);
+    return outbox;
+  } catch (error) {
+    if (error?.code === "ENOENT") {
+      const outbox = { version: 1, events: [], rejected_evicted: 0, dropped_capacity: 0, pending_claim: null, retired_pending_claims: [], owned_epochs: [], identity: null };
+      ensureIdentityEpochs(outbox);
+      return outbox;
+    }
+    throw Object.assign(new Error("DIAGNOSTIC_OUTBOX_CORRUPT"), { code: "DIAGNOSTIC_OUTBOX_CORRUPT", cause: error });
+  }
+}
+async function withOutboxLock(filePath, operation, staleMs = LOCK_STALE_MS) {
+  const lockPath = `${filePath}.lock`;
+  await mkdir2(dirname2(filePath), { recursive: true, mode: 448 });
+  const deadline = Date.now() + Math.max(3e4, staleMs + 5e3);
+  let attempt = 0;
+  while (Date.now() < deadline) {
+    let handle;
+    try {
+      handle = await open(lockPath, "wx", 384);
+      await handle.writeFile(`${process.pid} ${Date.now()} ${randomBytes(12).toString("hex")}
+`);
+      try {
+        return await operation();
+      } finally {
+        await handle.close();
+        await rm2(lockPath, { force: true });
+      }
+    } catch (error) {
+      await handle?.close().catch(() => void 0);
+      if (error?.code !== "EEXIST") throw error;
+      const age = Date.now() - (await stat3(lockPath).catch(() => ({ mtimeMs: Date.now() }))).mtimeMs;
+      if (age > staleMs) {
+        const owner = await readFile6(lockPath, "utf8").catch(() => "");
+        const pid = Number(owner.trim().split(/\s+/)[0]);
+        let ownerAlive = Number.isInteger(pid) && pid > 0;
+        if (ownerAlive) {
+          try {
+            process.kill(pid, 0);
+          } catch (ownerError) {
+            ownerAlive = ownerError?.code === "EPERM";
+          }
+        }
+        if (!ownerAlive && owner && await readFile6(lockPath, "utf8").catch(() => "") === owner) {
+          await rm2(lockPath, { force: true });
+          continue;
+        }
+      }
+      attempt += 1;
+      await new Promise((resolve3) => setTimeout(resolve3, Math.min(50, 5 + Math.floor(Math.random() * (attempt + 5)))));
+    }
+  }
+  throw Object.assign(new Error("DIAGNOSTIC_OUTBOX_LOCK_TIMEOUT"), { code: "DIAGNOSTIC_OUTBOX_LOCK_TIMEOUT" });
+}
+async function writeOutbox(filePath, outbox) {
+  await mkdir2(dirname2(filePath), { recursive: true, mode: 448 });
+  const temporaryPath = `${filePath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+  try {
+    const handle = await open(temporaryPath, "w", 384);
+    try {
+      await handle.writeFile(`${JSON.stringify({ version: 1, events: outbox.events, rejected_evicted: Number(outbox.rejected_evicted ?? 0), dropped_capacity: Number(outbox.dropped_capacity ?? 0), pending_claim: outbox.pending_claim ?? null, retired_pending_claims: outbox.retired_pending_claims ?? [], owned_epochs: outbox.owned_epochs ?? [], identity: outbox.identity })}
+`);
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    await rename2(temporaryPath, filePath);
+    const directory = await open(dirname2(filePath), "r").catch(() => null);
+    if (directory) {
+      try {
+        await directory.sync();
+      } finally {
+        await directory.close();
+      }
+    }
+  } catch (error) {
+    await rm2(temporaryPath, { force: true }).catch(() => void 0);
+    throw Object.assign(new Error("DIAGNOSTIC_OUTBOX_WRITE_FAILED"), { code: "DIAGNOSTIC_OUTBOX_WRITE_FAILED", cause: error });
+  }
+}
+function permanent(error) {
+  return error instanceof ApiError && error.status >= 400 && error.status < 500 && ![401, 408, 409, 425, 429].includes(error.status);
+}
+function nextAttemptAt(attempts) {
+  const base = Math.min(3e5, 1e3 * 2 ** Math.max(0, attempts - 1));
+  const jitter = 0.8 + Math.random() * 0.4;
+  return new Date(Date.now() + Math.round(base * jitter)).toISOString();
+}
+function uploadLeaseAvailable(event, now = Date.now()) {
+  if (!event.upload_lease_owner || !event.upload_lease_expires_at || Date.parse(event.upload_lease_expires_at) <= now) return true;
+  const ownerPid = Number(/^uploader_(\d+)_/.exec(event.upload_lease_owner)?.[1]);
+  if (!Number.isInteger(ownerPid) || ownerPid <= 0) return false;
+  try {
+    process.kill(ownerPid, 0);
+    return false;
+  } catch (error) {
+    return error?.code === "ESRCH";
+  }
+}
+var DiagnosticReporter = class {
+  constructor(options) {
+    this.options = options;
+    this.filePath = join6(options.stateDir, "client-diagnostic-outbox.json");
+    this.installStateDir = options.installStateDir ?? options.stateDir;
+  }
+  options;
+  filePath;
+  installStateDir;
+  deliveredEventIds = /* @__PURE__ */ new Set();
+  flushPromise = null;
+  writeChain = Promise.resolve();
+  installationId = null;
+  context = {};
+  identityEpoch = null;
+  identityProof = null;
+  uploadLeaseOwner = `uploader_${process.pid}_${randomBytes(12).toString("hex")}`;
+  notifyHealth(error, fallbackCode) {
+    try {
+      this.options.onHealthError?.({
+        code: error?.code ?? fallbackCode,
+        message: error instanceof Error ? error.message : String(error ?? fallbackCode)
+      });
+    } catch {
+    }
+  }
+  async serializeWrite(operation) {
+    const queued = this.writeChain.then(operation, operation);
+    this.writeChain = queued.catch(() => void 0);
+    return queued;
+  }
+  setContext(context) {
+    const previousUserId = normalizedOwnerUserId(this.context.user_id);
+    const nextUserId = Object.prototype.hasOwnProperty.call(context, "user_id") ? normalizedOwnerUserId(context.user_id) : previousUserId;
+    if (previousUserId !== nextUserId && !(previousUserId === null && nextUserId !== null)) {
+      this.identityEpoch = null;
+      this.identityProof = null;
+    }
+    this.context = { ...this.context, ...context };
+  }
+  resolveReporterIdentity(outbox) {
+    const ownerUserId = normalizedOwnerUserId(this.context.user_id);
+    const sharedIdentity = ensureIdentityEpochs(outbox);
+    const resolved = (epoch) => {
+      let proof = epoch === sharedIdentity.current_epoch ? sharedIdentity.current_proof : outbox.owned_epochs?.find((item) => item.identity_epoch === epoch && item.owner_user_id === ownerUserId)?.identity_proof;
+      if (!proof && outbox.pending_claim?.identity_epoch === epoch) proof = outbox.pending_claim.identity_proof;
+      const localProof = outbox.events.find((event) => event.identity_epoch === epoch && event.owner_user_id === ownerUserId && IDENTITY_PROOF_PATTERN.test(event.identity_proof || ""))?.identity_proof;
+      const identityProof = [proof, localProof, this.identityEpoch === epoch ? this.identityProof : null].find((value) => IDENTITY_PROOF_PATTERN.test(value || "")) ?? newIdentityProof();
+      this.identityProof = identityProof;
+      return { identity_epoch: epoch, identity_proof: identityProof, owner_user_id: ownerUserId };
+    };
+    if (this.identityEpoch && IDENTITY_EPOCH_PATTERN.test(this.identityEpoch)) {
+      const localEvents = outbox.events.filter((event) => event.identity_epoch === this.identityEpoch);
+      const localOwner = localEvents.find((event) => event.owner_user_id !== null)?.owner_user_id ?? null;
+      if (localOwner === ownerUserId) return resolved(this.identityEpoch);
+      if (localOwner === null && ownerUserId !== null) {
+        for (const event of localEvents) event.owner_user_id = ownerUserId;
+        if (sharedIdentity.current_epoch === this.identityEpoch && sharedIdentity.current_owner_user_id === null) sharedIdentity.current_owner_user_id = ownerUserId;
+        return resolved(this.identityEpoch);
+      }
+    }
+    if (ownerUserId && outbox.pending_claim?.owner_user_id === ownerUserId && IDENTITY_EPOCH_PATTERN.test(outbox.pending_claim.identity_epoch)) {
+      this.identityEpoch = outbox.pending_claim.identity_epoch;
+      return resolved(this.identityEpoch);
+    }
+    if (sharedIdentity.current_owner_user_id === ownerUserId) {
+      this.identityEpoch = sharedIdentity.current_epoch;
+    } else {
+      const owned = ownerUserId && this.installationId ? [...outbox.owned_epochs || []].reverse().find((item) => item.installation_id === this.installationId && item.owner_user_id === ownerUserId && IDENTITY_EPOCH_PATTERN.test(item.identity_epoch)) : null;
+      this.identityEpoch = owned?.identity_epoch ?? newIdentityEpoch();
+      this.identityProof = null;
+    }
+    return resolved(this.identityEpoch);
+  }
+  rememberOwnedEpoch(outbox, identity, installationId) {
+    if (!identity.owner_user_id || identity.identity_epoch === outbox.identity?.current_epoch) return;
+    outbox.owned_epochs ??= [];
+    if (!outbox.owned_epochs.some((item) => item.installation_id === installationId && item.identity_epoch === identity.identity_epoch && item.owner_user_id === identity.owner_user_id)) {
+      outbox.owned_epochs.push({ installation_id: installationId, identity_epoch: identity.identity_epoch, identity_proof: identity.identity_proof, owner_user_id: identity.owner_user_id, needs_reclaim: true });
+    }
+  }
+  async claimContext() {
+    const requestedUserId = normalizedOwnerUserId(this.context.user_id);
+    if (!requestedUserId) return null;
+    const claimHolder = {};
+    try {
+      await this.serializeWrite(() => withOutboxLock(this.filePath, async () => {
+        const outbox = await this.readOutboxRecovering();
+        const installationId = await this.installId();
+        if (normalizedOwnerUserId(this.context.user_id) !== requestedUserId) return;
+        const identity = this.resolveReporterIdentity(outbox);
+        if (identity.owner_user_id !== requestedUserId) return;
+        const claim = { installation_id: installationId, device_id: this.context.device_id ?? null, identity_epoch: identity.identity_epoch, identity_proof: identity.identity_proof };
+        this.rememberOwnedEpoch(outbox, identity, claim.installation_id);
+        const acknowledged = outbox.identity?.current_claimed;
+        const ownedAcknowledged = outbox.owned_epochs?.find((item) => item.installation_id === claim.installation_id && item.identity_epoch === claim.identity_epoch && item.owner_user_id === requestedUserId);
+        const alreadyClaimed = !outbox.pending_claim && (acknowledged?.installation_id === claim.installation_id && acknowledged.device_id === claim.device_id && acknowledged.identity_epoch === claim.identity_epoch && acknowledged.identity_proof === claim.identity_proof && acknowledged.owner_user_id === requestedUserId || ownedAcknowledged?.needs_reclaim === false && Boolean(ownedAcknowledged.last_claimed_at) && ownedAcknowledged.claimed_device_id === claim.device_id && ownedAcknowledged.identity_proof === claim.identity_proof);
+        if (alreadyClaimed) return;
+        claimHolder.value = { ...claim, owner_user_id: requestedUserId };
+        const previous = outbox.pending_claim;
+        outbox.pending_claim = previous?.installation_id === claim.installation_id && previous.device_id === claim.device_id && previous.identity_epoch === claim.identity_epoch ? previous : { ...claim, owner_user_id: requestedUserId, attempts: 0 };
+        await writeOutbox(this.filePath, outbox);
+      }, this.options.lockStaleMs));
+    } catch (error) {
+      this.notifyHealth(error, "DIAGNOSTIC_OUTBOX_WRITE_FAILED");
+      throw error;
+    }
+    const resolvedClaim = claimHolder.value;
+    if (!resolvedClaim) return null;
+    if (normalizedOwnerUserId(this.context.user_id) !== requestedUserId) return null;
+    const client = this.options.getClient?.() ?? null;
+    if (!client) return null;
+    try {
+      const result = await client.post("/client-diagnostic-events/claim", {
+        installation_id: resolvedClaim.installation_id,
+        device_id: resolvedClaim.device_id,
+        identity_epoch: resolvedClaim.identity_epoch,
+        identity_proof: resolvedClaim.identity_proof
+      });
+      await withOutboxLock(this.filePath, async () => {
+        const outbox = await this.readOutboxRecovering();
+        const pendingClaim = outbox.pending_claim;
+        if (pendingClaim?.installation_id === resolvedClaim.installation_id && pendingClaim.device_id === resolvedClaim.device_id && pendingClaim.identity_epoch === resolvedClaim.identity_epoch && pendingClaim.identity_proof === resolvedClaim.identity_proof && pendingClaim.owner_user_id === requestedUserId) {
+          outbox.pending_claim = null;
+        }
+        if (outbox.identity?.current_epoch === resolvedClaim.identity_epoch && outbox.identity.current_owner_user_id === requestedUserId && outbox.identity.current_proof === resolvedClaim.identity_proof) {
+          outbox.identity.current_claimed = { ...resolvedClaim, claimed_at: (/* @__PURE__ */ new Date()).toISOString() };
+        }
+        const owned = outbox.owned_epochs?.find((item) => item.installation_id === resolvedClaim.installation_id && item.identity_epoch === resolvedClaim.identity_epoch && item.owner_user_id === requestedUserId && item.identity_proof === resolvedClaim.identity_proof);
+        if (owned) {
+          owned.needs_reclaim = false;
+          owned.last_claimed_at = (/* @__PURE__ */ new Date()).toISOString();
+          owned.claimed_device_id = resolvedClaim.device_id;
+          delete owned.last_error_code;
+        }
+        await writeOutbox(this.filePath, outbox);
+      }, this.options.lockStaleMs);
+      return result;
+    } catch (error) {
+      this.notifyHealth(error, "DIAGNOSTIC_CLAIM_FAILED");
+      await withOutboxLock(this.filePath, async () => {
+        const outbox = await this.readOutboxRecovering();
+        const pendingClaim = outbox.pending_claim;
+        if (pendingClaim?.installation_id === resolvedClaim.installation_id && pendingClaim.device_id === resolvedClaim.device_id && pendingClaim.identity_epoch === resolvedClaim.identity_epoch && pendingClaim.identity_proof === resolvedClaim.identity_proof && pendingClaim.owner_user_id === requestedUserId) {
+          pendingClaim.attempts += 1;
+          pendingClaim.last_attempt_at = (/* @__PURE__ */ new Date()).toISOString();
+          pendingClaim.last_error_code = error instanceof ApiError ? error.code : error?.code ?? "DIAGNOSTIC_CLAIM_FAILED";
+        }
+        await writeOutbox(this.filePath, outbox);
+      }, this.options.lockStaleMs);
+      throw error;
+    }
+  }
+  async installId() {
+    if (this.options.getInstallationId) return this.options.getInstallationId();
+    if (this.installationId) return this.installationId;
+    const state = await ensureInstallState(this.installStateDir);
+    this.installationId = state.install_id;
+    return this.installationId;
+  }
+  async readOutboxRecovering() {
+    try {
+      return await readOutbox(this.filePath);
+    } catch (error) {
+      this.notifyHealth(error, "DIAGNOSTIC_OUTBOX_UNREADABLE");
+      const quarantinePath = `${this.filePath}.corrupt.${Date.now()}`;
+      try {
+        await rename2(this.filePath, quarantinePath);
+      } catch {
+        throw error;
+      }
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      const eventId = `evt_${randomBytes(16).toString("hex")}`;
+      const outbox = {
+        version: 1,
+        events: [{ version: 1, client_event_id: eventId, device_id: null, body: {
+          client_event_id: eventId,
+          installation_id: await this.installId(),
+          domain: "diagnostics",
+          action: "outbox_recovered",
+          status: "failure",
+          error_code: "DIAGNOSTIC_OUTBOX_CORRUPT",
+          message: "The diagnostic outbox was corrupt and was quarantined.",
+          details: { quarantine_file: quarantinePath.split(/[\\/]/).pop() },
+          occurred_at: now,
+          identity_epoch: ""
+        }, identity_epoch: "", owner_user_id: null, queued_at: now, attempts: 0 }],
+        rejected_evicted: 0,
+        dropped_capacity: 0,
+        pending_claim: null,
+        identity: null
+      };
+      ensureIdentityEpochs(outbox);
+      this.identityEpoch = outbox.identity.current_epoch;
+      const identity = this.resolveReporterIdentity(outbox);
+      const recoveryEvent = outbox.events[0];
+      recoveryEvent.identity_epoch = identity.identity_epoch;
+      recoveryEvent.owner_user_id = identity.owner_user_id;
+      recoveryEvent.body.identity_epoch = identity.identity_epoch;
+      await writeOutbox(this.filePath, outbox);
+      return outbox;
+    }
+  }
+  async report(input) {
+    const installationId = await this.installId();
+    const eventId = input.client_event_id || `evt_${randomBytes(16).toString("hex")}`;
+    if (this.deliveredEventIds.has(eventId)) return this.flush();
+    try {
+      await this.serializeWrite(() => withOutboxLock(this.filePath, async () => {
+        const outbox = await this.readOutboxRecovering();
+        const identity = this.resolveReporterIdentity(outbox);
+        this.rememberOwnedEpoch(outbox, identity, installationId);
+        if (outbox.events.some((event) => event.client_event_id === eventId)) return;
+        const body = (0, import_diagnostic_sanitize.sanitizeDiagnosticPayload)({
+          ...input,
+          device_id: input.device_id ?? this.context.device_id ?? null,
+          status: input.status ?? "failure",
+          error_code: stableErrorCode(input.error_code),
+          client_event_id: eventId,
+          installation_id: installationId,
+          identity_epoch: identity.identity_epoch,
+          identity_proof: identity.identity_proof,
+          occurred_at: input.occurred_at ?? (/* @__PURE__ */ new Date()).toISOString(),
+          message: (0, import_diagnostic_sanitize.sanitizeDiagnosticText)(input.message),
+          details: input.details === void 0 ? void 0 : (0, import_diagnostic_sanitize.sanitizeDiagnosticValue)(input.details)
+        });
+        delete body.user_id;
+        outbox.events.push({ version: 1, client_event_id: eventId, device_id: body.device_id ?? null, body, identity_epoch: identity.identity_epoch, identity_proof: identity.identity_proof, owner_user_id: identity.owner_user_id, queued_at: (/* @__PURE__ */ new Date()).toISOString(), attempts: 0 });
+        await writeOutbox(this.filePath, outbox);
+      }, this.options.lockStaleMs));
+    } catch (error) {
+      this.notifyHealth(error, "DIAGNOSTIC_OUTBOX_WRITE_FAILED");
+      throw error;
+    }
+    return this.flush();
+  }
+  async status() {
+    try {
+      return await withOutboxLock(this.filePath, async () => {
+        const outbox = await this.readOutboxRecovering();
+        const events = outbox.events;
+        const latestError = [...events].filter((event) => !event.rejected_at && event.last_error_code).sort((left, right) => String(right.last_attempt_at).localeCompare(String(left.last_attempt_at)))[0];
+        const next = events.filter((event) => !event.rejected_at && event.next_attempt_at).map((event) => event.next_attempt_at).sort()[0] ?? null;
+        return {
+          pending: events.filter((event) => !event.rejected_at).length,
+          rejected: events.filter((event) => event.rejected_at).length,
+          rejected_evicted: Number(outbox.rejected_evicted ?? 0),
+          dropped_capacity: Number(outbox.dropped_capacity ?? 0),
+          claim_pending: Boolean(outbox.pending_claim),
+          claim_attempts: Number(outbox.pending_claim?.attempts ?? 0),
+          health: Number(outbox.dropped_capacity ?? 0) > 0 || Boolean(latestError) || Boolean(outbox.pending_claim?.last_error_code) ? "degraded" : "healthy",
+          oldest_queued_at: events.map((event) => event.queued_at).sort()[0] ?? null,
+          last_error_code: latestError?.last_error_code ?? null,
+          next_attempt_at: next
+        };
+      }, this.options.lockStaleMs);
+    } catch (error) {
+      this.notifyHealth(error, "DIAGNOSTIC_OUTBOX_UNREADABLE");
+      return {
+        pending: null,
+        rejected: null,
+        rejected_evicted: null,
+        dropped_capacity: null,
+        claim_pending: null,
+        claim_attempts: null,
+        health: "degraded",
+        oldest_queued_at: null,
+        last_error_code: error?.code ?? "DIAGNOSTIC_OUTBOX_UNREADABLE",
+        next_attempt_at: null
+      };
+    }
+  }
+  async flush(options = {}) {
+    if (this.flushPromise) return this.flushPromise;
+    this.flushPromise = (async () => {
+      let delivered = 0;
+      while (true) {
+        const authenticatedClient = this.options.getClient?.() ?? null;
+        const explicitAnonymousClient = this.options.getAnonymousClient?.() ?? null;
+        if (!authenticatedClient && !explicitAnonymousClient) break;
+        const selected = await withOutboxLock(this.filePath, async () => {
+          const outbox = await this.readOutboxRecovering();
+          ensureIdentityEpochs(outbox);
+          const authenticatedUserId = normalizedOwnerUserId(this.context.user_id);
+          const now = Date.now();
+          const candidate = outbox.events.find((item) => !item.rejected_at && uploadLeaseAvailable(item, now) && (options.force || !item.next_attempt_at || Date.parse(item.next_attempt_at) <= now));
+          if (!candidate) return null;
+          const proofFallback = candidate.authentication_required === true && IDENTITY_PROOF_PATTERN.test(candidate.identity_proof || "");
+          const authenticated = Boolean(!proofFallback && authenticatedClient && candidate.owner_user_id && candidate.owner_user_id === authenticatedUserId);
+          candidate.upload_lease_owner = this.uploadLeaseOwner;
+          candidate.upload_lease_expires_at = new Date(now + UPLOAD_LEASE_MS).toISOString();
+          await writeOutbox(this.filePath, outbox);
+          return { event: candidate, authenticated, proofFallback };
+        }, this.options.lockStaleMs);
+        if (!selected) break;
+        const { event } = selected;
+        const client = selected.authenticated ? authenticatedClient : explicitAnonymousClient ?? (selected.proofFallback || normalizedOwnerUserId(this.context.user_id) !== null ? new KeySyncApiClient({ baseUrl: this.options.baseUrl }) : authenticatedClient);
+        if (!client) break;
+        try {
+          await client.post("/client-diagnostic-events", event.body);
+          this.deliveredEventIds.add(event.client_event_id);
+          delivered += 1;
+          await withOutboxLock(this.filePath, async () => {
+            const outbox = await this.readOutboxRecovering();
+            outbox.events = outbox.events.filter((item) => item.client_event_id !== event.client_event_id || item.upload_lease_owner !== this.uploadLeaseOwner);
+            await writeOutbox(this.filePath, outbox);
+          }, this.options.lockStaleMs);
+        } catch (error) {
+          const compactable = error instanceof ApiError && error.status === 413 && !(event.body?.details && typeof event.body.details === "object" && event.body.details.payload_compacted === true || event.body.payload_compacted === true);
+          if (compactable) {
+            await withOutboxLock(this.filePath, async () => {
+              const outbox = await this.readOutboxRecovering();
+              const current = outbox.events.find((item) => item.client_event_id === event.client_event_id);
+              if (!current || current.upload_lease_owner !== this.uploadLeaseOwner) return;
+              delete current.upload_lease_owner;
+              delete current.upload_lease_expires_at;
+              current.body = (0, import_diagnostic_sanitize.compactDiagnosticPayload)(current.body);
+              current.body.identity_epoch = current.identity_epoch;
+              if (current.device_id) current.body.device_id = current.device_id;
+              current.attempts += 1;
+              current.last_attempt_at = (/* @__PURE__ */ new Date()).toISOString();
+              current.last_error_code = error.code || "PAYLOAD_TOO_LARGE";
+              delete current.next_attempt_at;
+              await writeOutbox(this.filePath, outbox);
+            }, this.options.lockStaleMs);
+            continue;
+          }
+          this.notifyHealth(error, "DIAGNOSTIC_UPLOAD_FAILED");
+          const rejected = permanent(error);
+          await withOutboxLock(this.filePath, async () => {
+            const outbox = await this.readOutboxRecovering();
+            const current = outbox.events.find((item) => item.client_event_id === event.client_event_id);
+            if (current?.upload_lease_owner === this.uploadLeaseOwner) {
+              delete current.upload_lease_owner;
+              delete current.upload_lease_expires_at;
+              current.attempts += 1;
+              current.last_attempt_at = (/* @__PURE__ */ new Date()).toISOString();
+              current.last_error_code = error instanceof ApiError ? error.code : error?.code ?? "DIAGNOSTIC_UPLOAD_FAILED";
+              if (error instanceof ApiError && error.status === 401) current.authentication_required = true;
+              if (rejected) {
+                current.rejected_at = current.last_attempt_at;
+                current.rejection_status = error instanceof ApiError ? error.status : void 0;
+                current.rejection_code = error instanceof ApiError ? error.code : null;
+              } else current.next_attempt_at = nextAttemptAt(current.attempts);
+              await writeOutbox(this.filePath, outbox);
+            }
+          }, this.options.lockStaleMs);
+          if (!rejected) break;
+        }
+      }
+      return { delivered, pending: (await this.readOutboxRecovering()).events.length };
+    })().finally(() => {
+      this.flushPromise = null;
+    });
+    return this.flushPromise;
+  }
+};
+
 // packages/client-core/src/index.ts
 var BridgeConfigWriteError = class extends Error {
   code;
@@ -89167,16 +89974,15 @@ function serverKeyFromBaseUrl(baseUrl) {
   }
 }
 function stateDirForBaseUrl(baseUrl) {
-  return join6(defaultStateRoot(), "hosts", sanitizeHostForPath(hostFromBaseUrl(baseUrl)));
+  return join7(defaultStateRoot(), "hosts", sanitizeHostForPath(hostFromBaseUrl(baseUrl)));
 }
 function defaultStateDir(baseUrl) {
   if (process.env.KEYSYNC_STATE_DIR) return process.env.KEYSYNC_STATE_DIR;
-  return baseUrl ? stateDirForBaseUrl(baseUrl) : join6(defaultStateRoot(), "hosts", "default");
+  return baseUrl ? stateDirForBaseUrl(baseUrl) : join7(defaultStateRoot(), "hosts", "default");
 }
 function defaultInstallStateDir(baseUrl, stateDir = defaultStateDir(baseUrl)) {
   if (process.env.KEYSYNC_INSTALL_STATE_DIR) return process.env.KEYSYNC_INSTALL_STATE_DIR;
-  if (process.env.KEYSYNC_STATE_DIR && !process.env.KEYSYNC_STATE_ROOT) return stateDir;
-  return defaultStateRoot();
+  return stateDir;
 }
 function uniquePaths2(paths) {
   return [...new Set(paths.filter((item) => item.trim()))];
@@ -89218,7 +90024,7 @@ function legacyStateDirs(baseUrl) {
 }
 async function readSession(stateDir = defaultStateDir()) {
   try {
-    return JSON.parse(await readFile6(join6(stateDir, "session.json"), "utf8"));
+    return JSON.parse(await readFile7(join7(stateDir, "session.json"), "utf8"));
   } catch {
     return null;
   }
@@ -89226,13 +90032,13 @@ async function readSession(stateDir = defaultStateDir()) {
 async function writeSession(session, stateDir = defaultStateDir()) {
   await mkdir3(stateDir, { recursive: true, mode: 448 });
   if (platform() !== "win32") await chmod2(stateDir, 448);
-  const sessionPath = join6(stateDir, "session.json");
-  const temporaryPath = `${sessionPath}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+  const sessionPath = join7(stateDir, "session.json");
+  const temporaryPath = `${sessionPath}.${process.pid}.${randomBytes2(4).toString("hex")}.tmp`;
   try {
     await writeFile3(temporaryPath, `${JSON.stringify(session, null, 2)}
 `, { mode: 384 });
     if (platform() !== "win32") await chmod2(temporaryPath, 384);
-    await rename2(temporaryPath, sessionPath);
+    await rename3(temporaryPath, sessionPath);
     if (platform() !== "win32") await chmod2(sessionPath, 384);
   } catch (error) {
     await rm3(temporaryPath, { force: true }).catch(() => void 0);
@@ -89241,12 +90047,13 @@ async function writeSession(session, stateDir = defaultStateDir()) {
 }
 async function readDeviceStateFromDir(stateDir) {
   try {
-    const parsed = JSON.parse(await readFile6(join6(stateDir, "device.json"), "utf8"));
+    const parsed = JSON.parse(await readFile7(join7(stateDir, "device.json"), "utf8"));
     if (typeof parsed.device_id !== "string" || !parsed.device_id.trim()) return null;
     return {
       device_id: parsed.device_id,
       ...typeof parsed.user_id === "string" && parsed.user_id.trim() ? { user_id: parsed.user_id } : {},
-      ...typeof parsed.claim_ticket === "string" && parsed.claim_ticket.trim() ? { claim_ticket: parsed.claim_ticket } : {}
+      ...typeof parsed.claim_ticket === "string" && parsed.claim_ticket.trim() ? { claim_ticket: parsed.claim_ticket } : {},
+      ...typeof parsed.install_id_hash === "string" && /^sha256:[a-f0-9]{64}$/.test(parsed.install_id_hash) ? { install_id_hash: parsed.install_id_hash } : {}
     };
   } catch {
     return null;
@@ -89264,17 +90071,17 @@ async function readDeviceState(stateDir = defaultStateDir(), options = {}) {
 }
 async function writeDeviceState(device, stateDir = defaultStateDir()) {
   await mkdir3(stateDir, { recursive: true });
-  await writeFile3(join6(stateDir, "device.json"), JSON.stringify(device, null, 2));
+  await writeFile3(join7(stateDir, "device.json"), JSON.stringify(device, null, 2));
 }
 async function clearDeviceState(stateDir = defaultStateDir()) {
-  await rm3(join6(stateDir, "device.json"), { force: true });
+  await rm3(join7(stateDir, "device.json"), { force: true });
 }
 function localDeviceSettingsPath(stateDir = defaultStateDir()) {
-  return join6(stateDir, "device-settings.json");
+  return join7(stateDir, "device-settings.json");
 }
 async function readLocalDeviceSettings(stateDir = defaultStateDir()) {
   try {
-    const parsed = JSON.parse(await readFile6(localDeviceSettingsPath(stateDir), "utf8"));
+    const parsed = JSON.parse(await readFile7(localDeviceSettingsPath(stateDir), "utf8"));
     return {
       version: 1,
       ...typeof parsed.device_id === "string" && parsed.device_id.trim() ? { device_id: parsed.device_id } : {},
@@ -89291,7 +90098,7 @@ async function readLocalDeviceSettings(stateDir = defaultStateDir()) {
 }
 async function readInstallStateFromDir(installStateDir) {
   try {
-    const parsed = JSON.parse(await readFile6(join6(installStateDir, "install.json"), "utf8"));
+    const parsed = JSON.parse(await readFile7(join7(installStateDir, "install.json"), "utf8"));
     if (typeof parsed.install_id !== "string" || !parsed.install_id.trim()) return null;
     if (typeof parsed.created_at !== "string" || !parsed.created_at.trim()) return null;
     return { install_id: parsed.install_id, created_at: parsed.created_at };
@@ -89309,25 +90116,32 @@ async function readInstallState(installStateDir = defaultInstallStateDir(), opti
   }
   return null;
 }
-async function writeInstallState(install, installStateDir = defaultInstallStateDir()) {
-  await mkdir3(installStateDir, { recursive: true });
-  await writeFile3(join6(installStateDir, "install.json"), JSON.stringify(install, null, 2), { mode: 384 });
-}
 async function ensureInstallState(installStateDir = defaultInstallStateDir(), options = {}) {
-  const existing = await readInstallStateFromDir(installStateDir);
-  if (existing) return existing;
-  const legacy = await readInstallState(installStateDir, options);
-  if (legacy) {
-    await writeInstallState(legacy, installStateDir);
-    return legacy;
-  }
-  const install = { install_id: randomBytes(32).toString("base64url"), created_at: (/* @__PURE__ */ new Date()).toISOString() };
-  await writeInstallState(install, installStateDir);
-  return install;
+  return (0, import_install_identity.ensureInstallIdentitySync)(installStateDir, { legacyStateDirs: options.legacyStateDirs });
 }
 function installIdHashFor(installId) {
   return `sha256:${createHash5("sha256").update(`keysync-install-id:${installId}`).digest("hex")}`;
 }
+async function installCandidatesForServer(baseUrl, stateDir = defaultStateDir(baseUrl)) {
+  const hostDirectory = defaultInstallStateDir(baseUrl, stateDir);
+  const directories = [hostDirectory];
+  if (resolve2(stateDir) === resolve2(stateDirForBaseUrl(baseUrl)) && resolve2(defaultStateRoot()) !== resolve2(hostDirectory)) {
+    directories.push(defaultStateRoot());
+  }
+  const candidates = [];
+  for (const directory of directories) {
+    const install = await readInstallState(directory);
+    if (install) candidates.push({ install, directory });
+  }
+  return candidates;
+}
+async function installForServerDevice(baseUrl, stateDir = defaultStateDir(baseUrl), verifiedHash) {
+  if (verifiedHash) {
+    const matching = (await installCandidatesForServer(baseUrl, stateDir)).find(({ install }) => installIdHashFor(install.install_id) === verifiedHash);
+    if (matching) return matching.install;
+  }
+  return ensureInstallState(defaultInstallStateDir(baseUrl, stateDir), { legacyStateDirs: legacyStateDirs(baseUrl) });
+}
 function clientFromSession(session, options = {}) {
   return new KeySyncApiClient({ ...options, baseUrl: session.baseUrl, accessToken: session.access_token });
 }
@@ -89366,8 +90180,6 @@ async function maybeMigrateCodexSessionsAfterApply(input) {
       sqlite_rows_changed: 0,
       rollout_files_changed: 0,
       rollout_files_skipped: 0,
-      backups_created: 0,
-      backups_cleaned: 0,
       warnings: [{
         code: "MIGRATION_FAILED",
         message: error instanceof Error ? error.message : "Codex session migration failed."
@@ -89424,10 +90236,10 @@ function canonicalJson(value) {
   return JSON.stringify(canonicalize(value));
 }
 function localApplyDir(stateDir) {
-  return join6(stateDir, "local-apply");
+  return join7(stateDir, "local-apply");
 }
 function localApplyEventPath(stateDir) {
-  return join6(stateDir, "local-apply-events.jsonl");
+  return join7(stateDir, "local-apply-events.jsonl");
 }
 var REPORT_OUTBOX_MAX_EVENTS = 200;
 var ReportOutboxError = class extends Error {
@@ -89536,7 +90348,7 @@ var reportOutboxDetailKeys = /* @__PURE__ */ new Set([
   "ownership_attempts"
 ]);
 function reportOutboxPath(stateDir) {
-  return join6(stateDir, "report-outbox.json");
+  return join7(stateDir, "report-outbox.json");
 }
 function reportOutboxKind(path) {
   if (/^\/devices\/[^/]+\/apps\/[^/]+\/apply-report$/.test(path)) return "apply";
@@ -89579,7 +90391,7 @@ function sanitizeReportOutboxBody(path, body) {
       throw new ReportOutboxError("REPORT_OUTBOX_CORRUPT");
     })
   );
-  if (kind === "apply" && (typeof sanitized.snapshot_id !== "string" || !["success", "failed"].includes(String(sanitized.status))) || kind === "actual" && (typeof sanitized.local_app_detected !== "boolean" || typeof sanitized.config_applied !== "boolean") || kind === "error" && (typeof sanitized.error_type !== "string" || typeof sanitized.message !== "string")) {
+  if (kind === "apply" && (typeof sanitized.snapshot_id !== "string" || !["success", "failed", "conflict"].includes(String(sanitized.status))) || kind === "actual" && (typeof sanitized.local_app_detected !== "boolean" || typeof sanitized.config_applied !== "boolean") || kind === "error" && (typeof sanitized.error_type !== "string" || typeof sanitized.message !== "string")) {
     throw new ReportOutboxError("REPORT_OUTBOX_CORRUPT");
   }
   return sanitized;
@@ -89593,7 +90405,7 @@ function compactReportOutbox(outbox) {
 async function readReportOutbox(stateDir) {
   let content;
   try {
-    content = await readFile6(reportOutboxPath(stateDir), "utf8");
+    content = await readFile7(reportOutboxPath(stateDir), "utf8");
   } catch (error) {
     if (errnoCode(error) === "ENOENT") return { version: 1, events: [] };
     throw new ReportOutboxError("REPORT_OUTBOX_UNREADABLE", error);
@@ -89687,7 +90499,7 @@ async function flushPendingReports(session, stateDir = defaultStateDir()) {
   );
 }
 async function postReportDurably(client, stateDir, path, body) {
-  const clientEventId = typeof body.client_event_id === "string" && body.client_event_id ? body.client_event_id : `evt_${randomBytes(16).toString("hex")}`;
+  const clientEventId = typeof body.client_event_id === "string" && body.client_event_id ? body.client_event_id : `evt_${randomBytes2(16).toString("hex")}`;
   const outbox = await readReportOutbox(stateDir);
   if (!outbox.events.some((event) => event.client_event_id === clientEventId)) {
     if (outbox.events.length >= REPORT_OUTBOX_MAX_EVENTS) {
@@ -89722,17 +90534,17 @@ async function postReportGroupDurably(client, stateDir, reports) {
   if (rejection) throw rejection;
 }
 function localApplyKeyPath(stateDir) {
-  return join6(localApplyDir(stateDir), "fingerprint.key");
+  return join7(localApplyDir(stateDir), "fingerprint.key");
 }
 function localApplyRecordPath(stateDir, deviceId, appId, mode) {
-  return join6(localApplyDir(stateDir), mode, `${sanitizeHostForPath(`${deviceId}-${appId}`)}.json`);
+  return join7(localApplyDir(stateDir), mode, `${sanitizeHostForPath(`${deviceId}-${appId}`)}.json`);
 }
 async function localApplyFingerprintKey(stateDir) {
   const path = localApplyKeyPath(stateDir);
   try {
-    return Buffer.from((await readFile6(path, "utf8")).trim(), "base64");
+    return Buffer.from((await readFile7(path, "utf8")).trim(), "base64");
   } catch {
-    const key = randomBytes(32);
+    const key = randomBytes2(32);
     await mkdir3(localApplyDir(stateDir), { recursive: true });
     await writeFile3(path, `${key.toString("base64")}
 `, { mode: 384 });
@@ -89841,20 +90653,40 @@ function buildSourceFingerprintInput(appName, appId, source, provider, selectedE
 }
 async function readLocalApplyRecord(stateDir, deviceId, appId, mode) {
   try {
-    return JSON.parse(await readFile6(localApplyRecordPath(stateDir, deviceId, appId, mode), "utf8"));
+    return JSON.parse(await readFile7(localApplyRecordPath(stateDir, deviceId, appId, mode), "utf8"));
   } catch {
     return null;
   }
 }
 async function writeLocalApplyRecord(stateDir, record) {
   const path = localApplyRecordPath(stateDir, record.device_id, record.app_id, record.apply_mode);
-  await mkdir3(join6(localApplyDir(stateDir), record.apply_mode), { recursive: true });
+  await mkdir3(join7(localApplyDir(stateDir), record.apply_mode), { recursive: true });
   await writeFile3(path, `${JSON.stringify(record, null, 2)}
 `, { mode: 384 });
 }
 async function clearLocalApplyRecord(stateDir, deviceId, appId, mode) {
   await rm3(localApplyRecordPath(stateDir, deviceId, appId, mode), { force: true });
 }
+function writtenAccountKeyFor(provider) {
+  return typeof provider.values?._import_source_key === "string" ? provider.values._import_source_key.trim() || null : null;
+}
+async function heldWriteReason(input) {
+  const expectedProviderType = input.app.app_name === "Codex" ? "codex_official_login" : input.app.app_name === "ClaudeCode" ? "claude_official_login" : null;
+  if (!expectedProviderType || input.provider.type !== expectedProviderType) return null;
+  const previousProviderId = input.previousRecord?.resolved_provider_id?.trim() || null;
+  if (previousProviderId && previousProviderId !== input.provider.id) return null;
+  if (!input.probe) clearLocalModelConfigProbeCache();
+  const probe = await (input.probe ?? probeLocalModelConfig)(input.app.app_name);
+  if (probe.state === "unreadable" || probe.state === "unknown") return "retry";
+  if (probe.state === "unconfigured") return null;
+  if (probe.state === "local_apikey") return "LOCAL_KIND_MISMATCH";
+  const localAccount = probe.credentials.find((credential) => credential.kind === "oauth")?.import_source_key?.trim() || null;
+  if (!localAccount) return "retry";
+  const storedAccount = writtenAccountKeyFor(input.provider);
+  if (!storedAccount) return null;
+  const writtenAccount = input.previousRecord?.written_account_key?.trim() || storedAccount;
+  return localAccount === writtenAccount ? null : "LOCAL_ACCOUNT_MISMATCH";
+}
 async function recordApplyAttempt(input) {
   await writeLocalApplyRecord(input.stateDir, {
     version: 2,
@@ -89877,7 +90709,8 @@ async function recordApplyAttempt(input) {
     bridge_generation: input.bridgeGeneration ?? null,
     failure_code: input.failureCode,
     failure_message: input.failureMessage,
-    adopted_local: input.adoptedLocal
+    adopted_local: input.adoptedLocal,
+    written_account_key: input.writtenAccountKey
   });
 }
 async function appendLocalApplyEvent(stateDir, event) {
@@ -89888,14 +90721,16 @@ async function appendLocalApplyEvent(stateDir, event) {
 function localApplyEventMessage(status, message) {
   if (status === "success") return "APPLIED";
   const candidate = message?.trim() ?? "";
+  if (status === "conflict") return /^[A-Z0-9_ -]{1,80}$/.test(candidate) ? candidate : "LOCAL_ACCOUNT_MISMATCH";
   return /^[A-Z0-9_ -]{1,80}$/.test(candidate) ? candidate : "APPLY_FAILED";
 }
-async function recordDaemonAutoApplyEvent(input) {
-  if (input.trigger !== "daemon_auto") return;
+async function recordLocalApplyEvent(input) {
+  const trigger = input.trigger ?? "daemon_auto";
+  if (trigger !== "daemon_auto" && input.status !== "conflict") return;
   const event = {
     version: 2,
     id: [
-      "daemon_auto",
+      trigger,
       input.session.user_id ?? "unknown_user",
       input.deviceId,
       input.app.id,
@@ -89904,7 +90739,7 @@ async function recordDaemonAutoApplyEvent(input) {
       input.status,
       input.reportedAt
     ].map((part) => sanitizeHostForPath(part)).join(":"),
-    trigger: "daemon_auto",
+    trigger,
     server_key: serverKeyFromBaseUrl(input.session.baseUrl),
     user_id: input.session.user_id ?? null,
     device_id: input.deviceId,
@@ -89980,12 +90815,12 @@ async function enrichApplyFailureMessage(stateDir, failureCode, message) {
   };
 }
 function randomBase64(byteLength = 32) {
-  return randomBytes(byteLength).toString("base64");
+  return randomBytes2(byteLength).toString("base64");
 }
 function encryptWithAesGcm(rawKey, plaintext) {
   const key = Buffer.from(rawKey);
   if (key.length !== 32) throw new Error("AES-256-GCM key must be 32 bytes");
-  const iv = randomBytes(12);
+  const iv = randomBytes2(12);
   const cipher = createCipheriv("aes-256-gcm", key, iv);
   const body = Buffer.concat([cipher.update(typeof plaintext === "string" ? Buffer.from(plaintext, "utf8") : Buffer.from(plaintext)), cipher.final()]);
   return {
@@ -90011,7 +90846,7 @@ function deriveVaultKek(vaultPassword, kdf) {
   return pbkdf2Sync(vaultPassword, Buffer.from(kdf.salt, "base64"), iterations, 32, "sha256");
 }
 async function createVaultBootstrapInput(vaultPassword, name = "Personal") {
-  const vaultKey = randomBytes(32);
+  const vaultKey = randomBytes2(32);
   const keyPair = generateKeyPairSync("ec", {
     namedCurve: "prime256v1",
     publicKeyEncoding: { type: "spki", format: "der" },
@@ -90051,7 +90886,7 @@ function wrapSecretDataKeyForUser(recipientPublicKeyBase64, secretDataKey) {
   };
 }
 function createProviderSecretEnvelopeV2WithGrants(vaultId, vaultKey, secrets, preservedUserGrants) {
-  const secretDataKey = randomBytes(32);
+  const secretDataKey = randomBytes2(32);
   return {
     encrypted_secrets: Object.fromEntries(Object.entries(secrets).map(([key, value]) => [key, encryptWithAesGcm(secretDataKey, value)])),
     grants: [
@@ -90091,6 +90926,15 @@ async function buildProviderSecretEnvelopeForImport(client, providerId, vaultId,
   const preserved = providerId ? await fetchPreservedProviderUserGrants(client, providerId) : [];
   return createProviderSecretEnvelopeV2WithGrants(vaultId, vaultKey, secrets, preserved);
 }
+async function setupVaultMaterial(client, vaultPassword) {
+  if (!vaultPassword) throw new Error("Vault Password is required");
+  const { body, vaultKey } = await createVaultBootstrapInput(vaultPassword);
+  const bootstrap = await client.post("/vault/bootstrap", body);
+  return { vaultKeys: /* @__PURE__ */ new Map([[bootstrap.vault_id, vaultKey]]), privateKey: null };
+}
+function accessVaultMaterial(client, vaultPassword, mode) {
+  return mode === "setup" ? setupVaultMaterial(client, vaultPassword) : unlockVaultMaterial(client, vaultPassword);
+}
 async function unlockOrBootstrapVault(client, vaultPassword) {
   if (!vaultPassword) throw new Error("Vault Password is required");
   try {
@@ -90100,17 +90944,14 @@ async function unlockOrBootstrapVault(client, vaultPassword) {
     const message = error instanceof Error ? error.message : "";
     if (!isUninitialized && !message.includes("Vault is not initialized")) throw error;
   }
-  const { body, vaultKey } = await createVaultBootstrapInput(vaultPassword);
-  let bootstrap;
   try {
-    bootstrap = await client.post("/vault/bootstrap", body);
+    return await setupVaultMaterial(client, vaultPassword);
   } catch (error) {
     if (error instanceof ApiError && error.code === "VAULT_ALREADY_INITIALIZED") {
       return unlockVaultMaterial(client, vaultPassword);
     }
     throw error;
   }
-  return { vaultKeys: /* @__PURE__ */ new Map([[bootstrap.vault_id, vaultKey]]), privateKey: null };
 }
 async function unlockOrBootstrapVaultKeys(client, vaultPassword) {
   return (await unlockOrBootstrapVault(client, vaultPassword)).vaultKeys;
@@ -90180,28 +91021,28 @@ function snapshotProviderStrategyMap(snapshot) {
   return result;
 }
 function bridgeDir(stateDir) {
-  return join6(stateDir, "bridge", "bifrost");
+  return join7(stateDir, "bridge", "bifrost");
 }
 function bridgeBifrostConfigPath(stateDir) {
-  return join6(bridgeDir(stateDir), "config.json");
+  return join7(bridgeDir(stateDir), "config.json");
 }
 function bridgeRouteManifestPath(stateDir) {
-  return join6(bridgeDir(stateDir), "keysync-routes.json");
+  return join7(bridgeDir(stateDir), "keysync-routes.json");
 }
 function bridgeRuntimePath(stateDir) {
-  return join6(bridgeDir(stateDir), "runtime.json");
+  return join7(bridgeDir(stateDir), "runtime.json");
 }
 function bridgeStartupStdoutPath(stateDir) {
-  return join6(bridgeDir(stateDir), "bridge-startup.stdout.log");
+  return join7(bridgeDir(stateDir), "bridge-startup.stdout.log");
 }
 function bridgeStartupStderrPath(stateDir) {
-  return join6(bridgeDir(stateDir), "bridge-startup.stderr.log");
+  return join7(bridgeDir(stateDir), "bridge-startup.stderr.log");
 }
 function bridgeTokenPath(stateDir) {
-  return join6(bridgeDir(stateDir), "token.json");
+  return join7(bridgeDir(stateDir), "token.json");
 }
 function bridgeGenerationPath(stateDir) {
-  return join6(bridgeDir(stateDir), "generation.json");
+  return join7(bridgeDir(stateDir), "generation.json");
 }
 var bridgeWriteFailureCounts = /* @__PURE__ */ new Map();
 function errnoCode(error) {
@@ -90226,7 +91067,7 @@ function classifyBridgeConfigWriteError(path, code, metadata) {
 }
 async function bridgeFileMetadata(path) {
   try {
-    const item = await stat3(path);
+    const item = await stat4(path);
     const windowsReadonly = runtimePlatform() === "win32" ? await windowsReadonlyAttribute(path) : null;
     return {
       exists: true,
@@ -90303,7 +91144,7 @@ function maybeInjectBridgeWriteFailure(path, stage = "before_write") {
 async function writePrivateBridgeFile(path, content, stateDirForDiagnostics) {
   await mkdir3(dirname3(path), { recursive: true });
   const maxAttempts = bridgeWriteRetryAttempts();
-  const tmpPath = `${path}.${process.pid}.${Date.now()}.${randomBytes(4).toString("hex")}.tmp`;
+  const tmpPath = `${path}.${process.pid}.${Date.now()}.${randomBytes2(4).toString("hex")}.tmp`;
   let lastError = null;
   let observedReadonly = false;
   const pathKind = stateDirForDiagnostics ? bridgePathKind(path, stateDirForDiagnostics) : "bridge_private_file";
@@ -90317,7 +91158,7 @@ async function writePrivateBridgeFile(path, content, stateDirForDiagnostics) {
       await writeFile3(tmpPath, content, { mode: 384 });
       await chmod2(tmpPath, 384).catch(() => void 0);
       maybeInjectBridgeWriteFailure(path, "before_rename");
-      await rename2(tmpPath, path);
+      await rename3(tmpPath, path);
       await chmod2(path, 384).catch(() => void 0);
       if (stateDirForDiagnostics && (attempt > 1 || before.readonly === true || clearReadonlyResult)) {
         await appendBridgeDiagnostic(stateDirForDiagnostics, "bridge_private_file_write.success", {
@@ -90372,7 +91213,7 @@ function bridgeVirtualKeyId(bridgeProviderKey2) {
 async function readBridgeTokenStore(stateDir) {
   const path = bridgeTokenPath(stateDir);
   try {
-    const parsed = JSON.parse(await readFile6(path, "utf8"));
+    const parsed = JSON.parse(await readFile7(path, "utf8"));
     if (parsed.tokens && typeof parsed.tokens === "object" && !Array.isArray(parsed.tokens)) {
       const tokens = {};
       for (const [appId, value] of Object.entries(parsed.tokens)) {
@@ -90413,7 +91254,7 @@ async function bridgeVirtualKey(stateDir, appId) {
     }
     return existing.token;
   }
-  const token = `sk-bf-${randomBytes(32).toString("base64url")}`;
+  const token = `sk-bf-${randomBytes2(32).toString("base64url")}`;
   store.tokens[appId] = { token, created_at: (/* @__PURE__ */ new Date()).toISOString() };
   delete store.tokens.legacy;
   await writeBridgeTokenStore(stateDir, store);
@@ -90454,7 +91295,7 @@ async function appendBridgeDiagnostic(stateDir, event, details = {}) {
   try {
     const dir = bridgeDir(stateDir);
     await mkdir3(dir, { recursive: true });
-    await appendFile(join6(dir, "bridge-diagnostics.jsonl"), `${JSON.stringify({
+    await appendFile(join7(dir, "bridge-diagnostics.jsonl"), `${JSON.stringify({
       ts: (/* @__PURE__ */ new Date()).toISOString(),
       pid: process.pid,
       platform: runtimePlatform(),
@@ -90576,11 +91417,11 @@ var DEFAULT_SYNC_APPLY_LOCK_OWNER_GRACE_MS = 5e3;
 var DEFAULT_SYNC_APPLY_MANUAL_REAPPLY_WAIT_MS = 5e3;
 var DEFAULT_SYNC_APPLY_LOCK_HEARTBEAT_MS = 3e4;
 function syncApplyLockDir(stateDir) {
-  return join6(stateDir, "sync-apply.lock");
+  return join7(stateDir, "sync-apply.lock");
 }
 async function readSyncApplyLockOwner(lockDir) {
   try {
-    const parsed = JSON.parse(await readFile6(join6(lockDir, "owner.json"), "utf8"));
+    const parsed = JSON.parse(await readFile7(join7(lockDir, "owner.json"), "utf8"));
     if (!parsed || typeof parsed !== "object") return null;
     const owner = parsed;
     return {
@@ -90608,7 +91449,7 @@ function syncApplyLockHeartbeatMs() {
   return Math.min(DEFAULT_SYNC_APPLY_LOCK_HEARTBEAT_MS, Math.max(1e3, Math.floor(staleMs / 3)));
 }
 async function writeSyncApplyLockOwner(handle, updatedAt = (/* @__PURE__ */ new Date()).toISOString()) {
-  await writeFile3(join6(handle.lockDir, "owner.json"), `${JSON.stringify({
+  await writeFile3(join7(handle.lockDir, "owner.json"), `${JSON.stringify({
     version: 1,
     token: handle.token,
     pid: handle.pid,
@@ -90627,7 +91468,7 @@ async function acquireSyncApplyLock(stateDir, deviceId, trigger) {
   const deadline = Date.now() + waitMs;
   await mkdir3(stateDir, { recursive: true });
   for (; ; ) {
-    const token = randomBytes(16).toString("hex");
+    const token = randomBytes2(16).toString("hex");
     try {
       await mkdir3(lockDir, { recursive: false });
       const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -90639,7 +91480,7 @@ async function acquireSyncApplyLock(stateDir, deviceId, trigger) {
       if (code !== "EEXIST") throw error;
       try {
         const owner = await readSyncApplyLockOwner(lockDir);
-        const lockStat = await stat3(lockDir);
+        const lockStat = await stat4(lockDir);
         const ownerUpdatedAtMs = owner?.updated_at ? Date.parse(owner.updated_at) : Number.NaN;
         const lockAgeMs = Date.now() - lockStat.mtimeMs;
         const heartbeatAgeMs = Number.isFinite(ownerUpdatedAtMs) ? Date.now() - ownerUpdatedAtMs : lockAgeMs;
@@ -90678,7 +91519,7 @@ async function appendSyncApplyLockDiagnostic(stateDir, event, details = {}) {
   if (process.env.KEYSYNC_SYNC_APPLY_LOCK_DIAGNOSTICS !== "1") return;
   try {
     await mkdir3(stateDir, { recursive: true });
-    await appendFile(join6(stateDir, "sync-apply-lock-diagnostics.jsonl"), `${JSON.stringify({
+    await appendFile(join7(stateDir, "sync-apply-lock-diagnostics.jsonl"), `${JSON.stringify({
       ts: (/* @__PURE__ */ new Date()).toISOString(),
       pid: process.pid,
       event,
@@ -90721,7 +91562,7 @@ async function recordBridgeLifecycleEvent(event) {
 }
 async function readBridgeLifecycleLockOwner(lockDir) {
   try {
-    const parsed = JSON.parse(await readFile6(join6(lockDir, "owner.json"), "utf8"));
+    const parsed = JSON.parse(await readFile7(join7(lockDir, "owner.json"), "utf8"));
     if (!parsed || typeof parsed !== "object") return null;
     const owner = parsed;
     return {
@@ -90733,7 +91574,7 @@ async function readBridgeLifecycleLockOwner(lockDir) {
   }
 }
 async function withBridgeLifecycleLock(stateDir, fn) {
-  const lockDir = join6(bridgeDir(stateDir), ".lifecycle.lock");
+  const lockDir = join7(bridgeDir(stateDir), ".lifecycle.lock");
   await mkdir3(bridgeDir(stateDir), { recursive: true });
   const timeoutMs = Number(process.env.KEYSYNC_BIFROST_LOCK_TIMEOUT_MS ?? 3e4);
   const staleMs = Number(process.env.KEYSYNC_BIFROST_LOCK_STALE_MS ?? DEFAULT_BIFROST_LOCK_STALE_MS);
@@ -90741,7 +91582,7 @@ async function withBridgeLifecycleLock(stateDir, fn) {
   for (; ; ) {
     try {
       await mkdir3(lockDir, { recursive: false });
-      await writeFile3(join6(lockDir, "owner.json"), `${JSON.stringify({ pid: process.pid, created_at: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)}
+      await writeFile3(join7(lockDir, "owner.json"), `${JSON.stringify({ pid: process.pid, created_at: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)}
 `);
       await recordBridgeLifecycleEvent("acquire_lock");
       break;
@@ -90759,7 +91600,7 @@ async function withBridgeLifecycleLock(stateDir, fn) {
           await rm3(lockDir, { recursive: true, force: true });
           continue;
         }
-        const lockStat = await stat3(lockDir);
+        const lockStat = await stat4(lockDir);
         if (Date.now() - lockStat.mtimeMs > staleMs) {
           await appendBridgeDiagnostic(stateDir, "bridge_lifecycle_lock.reclaim_stale_mtime", {
             lockDir,
@@ -90860,7 +91701,7 @@ function buildBifrostProviderConfig(plan) {
 }
 async function readBridgeRouteManifest(stateDir) {
   try {
-    const parsed = JSON.parse(await readFile6(bridgeRouteManifestPath(stateDir), "utf8"));
+    const parsed = JSON.parse(await readFile7(bridgeRouteManifestPath(stateDir), "utf8"));
     const routes = Array.isArray(parsed.routes) ? parsed.routes.filter((item) => Boolean(item && typeof item === "object" && typeof item.app_id === "string")).map((item) => ({
       ...item,
       app_name: typeof item.app_name === "string" ? item.app_name : "Codex"
@@ -90877,7 +91718,7 @@ async function readBridgeRouteManifest(stateDir) {
 }
 async function readBifrostProviders(stateDir) {
   try {
-    const parsed = JSON.parse(await readFile6(bridgeBifrostConfigPath(stateDir), "utf8"));
+    const parsed = JSON.parse(await readFile7(bridgeBifrostConfigPath(stateDir), "utf8"));
     return parsed.providers && typeof parsed.providers === "object" && !Array.isArray(parsed.providers) ? parsed.providers : {};
   } catch {
     return {};
@@ -90922,7 +91763,7 @@ function buildBifrostConfig(stateDir, providers, virtualKeys) {
       enabled: true,
       type: "sqlite",
       config: {
-        path: join6(dir, "config.db")
+        path: join7(dir, "config.db")
       }
     },
     logs_store: {
@@ -90930,7 +91771,7 @@ function buildBifrostConfig(stateDir, providers, virtualKeys) {
       type: "sqlite",
       retention_days: 30,
       config: {
-        path: join6(dir, "logs.db")
+        path: join7(dir, "logs.db")
       }
     },
     governance: {
@@ -91007,7 +91848,7 @@ function bridgeManifestMatchesActiveAppIds(manifest, activeBridgeAppIds) {
 }
 async function readBridgeRuntimeState(stateDir) {
   try {
-    const parsed = JSON.parse(await readFile6(bridgeRuntimePath(stateDir), "utf8"));
+    const parsed = JSON.parse(await readFile7(bridgeRuntimePath(stateDir), "utf8"));
     if (typeof parsed.listen_url !== "string" || !parsed.listen_url.trim()) return null;
     return {
       version: 1,
@@ -91053,14 +91894,14 @@ function bridgeRuntimeBaseState(stateDir, listenUrl, status, current) {
   };
 }
 async function bridgeConfigHash(stateDir) {
-  return createHash5("sha256").update(await readFile6(bridgeBifrostConfigPath(stateDir))).digest("hex");
+  return createHash5("sha256").update(await readFile7(bridgeBifrostConfigPath(stateDir))).digest("hex");
 }
 async function readCommittedBridgeGeneration(stateDir) {
   try {
-    const parsed = JSON.parse(await readFile6(bridgeGenerationPath(stateDir), "utf8"));
+    const parsed = JSON.parse(await readFile7(bridgeGenerationPath(stateDir), "utf8"));
     if (parsed.version !== 1 || parsed.status !== "committed" || typeof parsed.config_hash !== "string" || typeof parsed.route_count !== "number" || typeof parsed.listen_url !== "string" || typeof parsed.committed_at !== "string") return null;
     if (await bridgeConfigHash(stateDir) !== parsed.config_hash) return null;
-    const config = JSON.parse(await readFile6(bridgeBifrostConfigPath(stateDir), "utf8"));
+    const config = JSON.parse(await readFile7(bridgeBifrostConfigPath(stateDir), "utf8"));
     const virtualKeys = Array.isArray(config.governance?.virtual_keys) ? config.governance.virtual_keys : [];
     const providers = config.providers && typeof config.providers === "object" && !Array.isArray(config.providers) ? config.providers : {};
     if (virtualKeys.length !== parsed.route_count) return null;
@@ -91294,7 +92135,7 @@ async function applyBridgeConfigPlan(stateDir, baseUrl, prepared) {
   });
 }
 function sleep2(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 function truncateText(value, maxLength) {
   if (value.length <= maxLength) return value;
@@ -91305,7 +92146,7 @@ function redactDiagnosticText(value) {
 }
 async function readTextTail(filePath, maxLength = 12e3) {
   try {
-    return redactDiagnosticText(truncateText(await readFile6(filePath, "utf8"), maxLength));
+    return redactDiagnosticText(truncateText(await readFile7(filePath, "utf8"), maxLength));
   } catch {
     return null;
   }
@@ -91349,9 +92190,9 @@ function bifrostBinaryPath() {
   const processWithResources = process;
   const resourceBinaryName = runtimePlatform() === "win32" ? "bifrost-http.exe" : "bifrost-http";
   const candidates = [
-    processWithResources.resourcesPath ? join6(processWithResources.resourcesPath, "bridge", resourceBinaryName) : null,
-    join6(process.cwd(), "resources", "bridge", runtimePlatform(), process.arch, resourceBinaryName),
-    join6(process.cwd(), "keysync-client", "resources", "bridge", `${runtimePlatform()}-${process.arch}`, resourceBinaryName)
+    processWithResources.resourcesPath ? join7(processWithResources.resourcesPath, "bridge", resourceBinaryName) : null,
+    join7(process.cwd(), "resources", "bridge", runtimePlatform(), process.arch, resourceBinaryName),
+    join7(process.cwd(), "keysync-client", "resources", "bridge", `${runtimePlatform()}-${process.arch}`, resourceBinaryName)
   ].filter((item) => Boolean(item));
   return candidates.find((candidate) => existsSync3(candidate)) ?? null;
 }
@@ -91582,7 +92423,7 @@ function bridgeHostAndPort(baseUrl) {
   return { host, port };
 }
 function execFileText(command, args, timeout = 2e3) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     execFile2(command, args, { timeout }, (error, stdout, stderr) => {
       if (error) {
         const enriched = error;
@@ -91590,7 +92431,7 @@ function execFileText(command, args, timeout = 2e3) {
         enriched.stderr = stderr.toString();
         reject(enriched);
       } else {
-        resolve2(stdout.toString());
+        resolve3(stdout.toString());
       }
     });
   });
@@ -91996,7 +92837,7 @@ async function stopBridgeProcessesOnPort(stateDir, baseUrl, timeoutMs, knownMana
 async function tcpPortIsBindable(host, port) {
   const portNumber = Number(port);
   if (!Number.isInteger(portNumber) || portNumber <= 0) return false;
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const server = createServer();
     let settled = false;
     const finish = (result) => {
@@ -92004,8 +92845,8 @@ async function tcpPortIsBindable(host, port) {
       settled = true;
       clearTimeout(timer);
       server.removeAllListeners();
-      if (server.listening) server.close(() => resolve2(result));
-      else resolve2(result);
+      if (server.listening) server.close(() => resolve3(result));
+      else resolve3(result);
     };
     const timer = setTimeout(() => finish(false), 1e3);
     server.once("error", () => finish(false));
@@ -92050,7 +92891,7 @@ async function resetBridgeConfigStore(stateDir) {
   });
   const deadline = Date.now() + Number(process.env.KEYSYNC_BIFROST_CONFIG_STORE_UNLOCK_TIMEOUT_MS ?? DEFAULT_BIFROST_CONFIG_STORE_UNLOCK_TIMEOUT_MS);
   for (const file of BRIDGE_SQLITE_CONFIG_FILES) {
-    const filePath = join6(dir, file);
+    const filePath = join7(dir, file);
     let attempts = 0;
     for (; ; ) {
       try {
@@ -92557,11 +93398,11 @@ function isManuallyMarkedUninstalled(discovery) {
   return discovery?.detection_mode === "manual" && discovery.detected === false;
 }
 function discoveryStabilityPath(stateDir) {
-  return join6(stateDir, "app-discovery-state.json");
+  return join7(stateDir, "app-discovery-state.json");
 }
 async function readDiscoveryStability(stateDir) {
   try {
-    const parsed = JSON.parse(await readFile6(discoveryStabilityPath(stateDir), "utf8"));
+    const parsed = JSON.parse(await readFile7(discoveryStabilityPath(stateDir), "utf8"));
     return { version: 1, apps: parsed.apps && typeof parsed.apps === "object" ? parsed.apps : {} };
   } catch {
     return { version: 1, apps: {} };
@@ -92570,10 +93411,10 @@ async function readDiscoveryStability(stateDir) {
 async function writeDiscoveryStability(stateDir, state) {
   await mkdir3(stateDir, { recursive: true });
   const path = discoveryStabilityPath(stateDir);
-  const tmpPath = `${path}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+  const tmpPath = `${path}.${process.pid}.${randomBytes2(4).toString("hex")}.tmp`;
   await writeFile3(tmpPath, `${JSON.stringify(state, null, 2)}
 `, { mode: 384 });
-  await rename2(tmpPath, path);
+  await rename3(tmpPath, path);
   await chmod2(path, 384).catch(() => void 0);
 }
 function stabilizedAutomaticDetection(app, current, state) {
@@ -92608,8 +93449,8 @@ var appDiscoveryQueues = /* @__PURE__ */ new Map();
 async function withAppDiscoveryQueue(key, task) {
   const previous = appDiscoveryQueues.get(key) ?? Promise.resolve();
   let release;
-  const current = new Promise((resolve2) => {
-    release = resolve2;
+  const current = new Promise((resolve3) => {
+    release = resolve3;
   });
   const tail = previous.catch(() => void 0).then(() => current);
   appDiscoveryQueues.set(key, tail);
@@ -92749,7 +93590,7 @@ async function syncAndApply(session, deviceId, stateDir = defaultStateDir(), opt
             vaultUnlockError = error;
           }
         }
-        const outputDir = join6(stateDir, "applied-configs");
+        const outputDir = join7(stateDir, "applied-configs");
         const mode = applyModeFromEnv();
         const localKey = await localApplyFingerprintKey(stateDir);
         const writeStrategies = snapshotWriteStrategies(snapshot);
@@ -92803,6 +93644,7 @@ async function syncAndApply(session, deviceId, stateDir = defaultStateDir(), opt
           return leftRank - rightRank;
         });
         for (const app of orderedApps) {
+          const forceThisApp = Boolean(options.force) || (options.forceAppNames?.includes(app.app_name) ?? false);
           if (!app.source) {
             await clearLocalApplyRecord(stateDir, deviceId, app.id, mode);
             appResults.push({ app_name: app.app_name, status: "skipped", message: "APP_NOT_CONFIGURED" });
@@ -92810,13 +93652,13 @@ async function syncAndApply(session, deviceId, stateDir = defaultStateDir(), opt
           }
           const provider = resolveProviderForApp(snapshot, app.id);
           const sourceIdentityFingerprint = hmacHex(localKey, sourceIdentityInput(snapshot, app, provider));
-          const attemptId = `att_${randomBytes(8).toString("hex")}`;
+          const attemptId = `att_${randomBytes2(8).toString("hex")}`;
           const previousRecord = await readLocalApplyRecord(stateDir, deviceId, app.id, mode);
           const currentInstallationStateFingerprint = installationStateFingerprint(app);
           const installationStateChanged = previousRecord?.installation_state_fingerprint !== void 0 && previousRecord.installation_state_fingerprint !== currentInstallationStateFingerprint;
           const adoptionSource = app.source.source_type === "provider" ? app.source : null;
           const adoptionAppliesToCurrentRevision = adoptionSource?.initial_apply_mode === "preserve_local_once" && Boolean(adoptionSource.binding_revision && app.desired_state_revision) && (adoptionSource.adoption_status === "pending" || adoptionSource.adoption_status === "failed" || adoptionSource.adoption_status === "confirmed" && adoptionSource.adopted_desired_state_revision === (app.desired_state_revision ?? null));
-          if (!options.force && adoptionAppliesToCurrentRevision) {
+          if (!forceThisApp && adoptionAppliesToCurrentRevision) {
             if (adoptionSource.adoption_status === "failed") {
               appResults.push({ app_name: app.app_name, status: "skipped", message: "LOCAL_ADOPTION_FAILED_REQUIRES_RETRY" });
               continue;
@@ -92868,56 +93710,59 @@ async function syncAndApply(session, deviceId, stateDir = defaultStateDir(), opt
               await reportAdoptionFailure("LOCAL_ADOPTION_IDENTITY_MISMATCH");
               continue;
             }
-            let adoptionBaselineRecorded = false;
-            try {
-              const decryptedProvider = await resolveLocalDecryptedProvider(provider, vaultMaterial);
-              const routePlan = await buildAppRoutePlan({ app, provider: decryptedProvider, snapshot, stateDir, bridgeBaseUrl: bridgeRuntimeBaseUrl, providerStrategyMap, writeStrategies });
-              if (routePlan.route_kind !== "direct") throw new Error("LOCAL_ADOPTION_BRIDGE_UNSUPPORTED");
-              const sourceFingerprint = hmacHex(
-                localKey,
-                buildSourceFingerprintInput(
-                  app.app_name,
-                  app.id,
-                  stableAppSourceForFingerprint(app.source),
-                  decryptedProvider,
-                  routePlan.endpoint,
-                  localKey
-                )
-              );
-              if (!options.localModelConfigProbe) clearLocalModelConfigProbeCache();
-              const finalProbe = await adoptionProbe(app.app_name);
-              const finalOauth = finalProbe.credentials.find((credential) => credential.kind === "oauth");
-              if (finalProbe.state !== "local_oauth" || finalProbe.in_effect !== "oauth" || finalOauth?.import_source_key !== providerSourceKey) {
-                await reportAdoptionFailure("LOCAL_ADOPTION_LOCAL_STATE_CHANGED");
-                continue;
+            const providerExpiresAt = typeof provider.values?._import_expires_at === "string" ? provider.values._import_expires_at : void 0;
+            if (!staleAgainstStored(localOauth.expires_at ?? void 0, providerExpiresAt)) {
+              let adoptionBaselineRecorded = false;
+              try {
+                const decryptedProvider = await resolveLocalDecryptedProvider(provider, vaultMaterial);
+                const routePlan = await buildAppRoutePlan({ app, provider: decryptedProvider, snapshot, stateDir, bridgeBaseUrl: bridgeRuntimeBaseUrl, providerStrategyMap, writeStrategies });
+                if (routePlan.route_kind !== "direct") throw new Error("LOCAL_ADOPTION_BRIDGE_UNSUPPORTED");
+                const sourceFingerprint = hmacHex(
+                  localKey,
+                  buildSourceFingerprintInput(
+                    app.app_name,
+                    app.id,
+                    stableAppSourceForFingerprint(app.source),
+                    decryptedProvider,
+                    routePlan.endpoint,
+                    localKey
+                  )
+                );
+                if (!options.localModelConfigProbe) clearLocalModelConfigProbeCache();
+                const finalProbe = await adoptionProbe(app.app_name);
+                const finalOauth = finalProbe.credentials.find((credential) => credential.kind === "oauth");
+                if (finalProbe.state !== "local_oauth" || finalProbe.in_effect !== "oauth" || finalOauth?.import_source_key !== providerSourceKey) {
+                  await reportAdoptionFailure("LOCAL_ADOPTION_LOCAL_STATE_CHANGED");
+                  continue;
+                }
+                await recordApplyAttempt({
+                  stateDir,
+                  deviceId,
+                  app,
+                  mode,
+                  snapshotId: snapshot.snapshot_id,
+                  sourceIdentityFingerprint,
+                  attemptFingerprint: sourceFingerprint,
+                  sourceFingerprint,
+                  status: "success",
+                  providerId: provider.id,
+                  selectedEndpoint: routePlan.endpoint,
+                  adoptedLocal: true
+                });
+                adoptionBaselineRecorded = true;
+                await client.post(`/devices/${deviceId}/apps/${app.id}/adoption-report`, {
+                  binding_revision: adoptionSource.binding_revision,
+                  desired_state_revision: app.desired_state_revision,
+                  status: "confirmed"
+                });
+                appResults.push({ app_name: app.app_name, status: "success", message: "ADOPTED_LOCAL_CONFIG" });
+              } catch (error) {
+                if (adoptionBaselineRecorded) throw error;
+                const errorCode = error instanceof Error && /^LOCAL_ADOPTION_[A-Z0-9_]+$/.test(error.message) ? error.message : "LOCAL_ADOPTION_ROUTE_INVALID";
+                await reportAdoptionFailure(errorCode);
               }
-              await recordApplyAttempt({
-                stateDir,
-                deviceId,
-                app,
-                mode,
-                snapshotId: snapshot.snapshot_id,
-                sourceIdentityFingerprint,
-                attemptFingerprint: sourceFingerprint,
-                sourceFingerprint,
-                status: "success",
-                providerId: provider.id,
-                selectedEndpoint: routePlan.endpoint,
-                adoptedLocal: true
-              });
-              adoptionBaselineRecorded = true;
-              await client.post(`/devices/${deviceId}/apps/${app.id}/adoption-report`, {
-                binding_revision: adoptionSource.binding_revision,
-                desired_state_revision: app.desired_state_revision,
-                status: "confirmed"
-              });
-              appResults.push({ app_name: app.app_name, status: "success", message: "ADOPTED_LOCAL_CONFIG" });
-            } catch (error) {
-              if (adoptionBaselineRecorded) throw error;
-              const errorCode = error instanceof Error && /^LOCAL_ADOPTION_[A-Z0-9_]+$/.test(error.message) ? error.message : "LOCAL_ADOPTION_ROUTE_INVALID";
-              await reportAdoptionFailure(errorCode);
+              continue;
             }
-            continue;
           }
           if (app.latest_discovery?.detection_mode === "manual" && app.latest_discovery.detected === false) {
             retainedBridgeAppIds.delete(app.id);
@@ -92925,11 +93770,11 @@ async function syncAndApply(session, deviceId, stateDir = defaultStateDir(), opt
             continue;
           }
           const previousFailureWasRecoverableBridge = activeBridgeAppIds.has(app.id) && (isRecoverableBridgeFailureCode(previousRecord?.failure_code) || previousRecord?.version !== 2 || previousRecord.desired_state_revision !== (app.desired_state_revision ?? null));
-          if (!options.force && previousRecord?.last_attempt_status === "failed" && previousRecord.source_identity_fingerprint === sourceIdentityFingerprint && !previousFailureWasRecoverableBridge) {
+          if (!forceThisApp && previousRecord?.last_attempt_status === "failed" && previousRecord.source_identity_fingerprint === sourceIdentityFingerprint && !previousFailureWasRecoverableBridge) {
             appResults.push({ app_name: app.app_name, status: "skipped", message: "SKIPPED_FAILED_FINGERPRINT" });
             continue;
           }
-          if (!options.force && previousRecord?.last_attempt_status === "success" && previousRecord.source_identity_fingerprint === sourceIdentityFingerprint && (!activeBridgeAppIds.has(app.id) || existingBridgeRuntimeReady && previousRecord.version === 2 && previousRecord.desired_state_revision === (app.desired_state_revision ?? null) && previousRecord.bridge_generation === existingBridgeGenerationHash)) {
+          if (!forceThisApp && previousRecord?.last_attempt_status === "success" && previousRecord.source_identity_fingerprint === sourceIdentityFingerprint && (!activeBridgeAppIds.has(app.id) || existingBridgeRuntimeReady && previousRecord.version === 2 && previousRecord.desired_state_revision === (app.desired_state_revision ?? null) && previousRecord.bridge_generation === existingBridgeGenerationHash)) {
             if (!activeBridgeAppIds.has(app.id)) retainedBridgeAppIds.delete(app.id);
             appResults.push({ app_name: app.app_name, status: "skipped", message: "SKIPPED_SAME_FINGERPRINT" });
             continue;
@@ -92995,7 +93840,7 @@ async function syncAndApply(session, deviceId, stateDir = defaultStateDir(), opt
                 }
               }
             ]);
-            await recordDaemonAutoApplyEvent({
+            await recordLocalApplyEvent({
               stateDir,
               trigger: options.trigger,
               session: activeSession,
@@ -93074,7 +93919,7 @@ async function syncAndApply(session, deviceId, stateDir = defaultStateDir(), opt
                 }
               }
             ]);
-            await recordDaemonAutoApplyEvent({
+            await recordLocalApplyEvent({
               stateDir,
               trigger: options.trigger,
               session: activeSession,
@@ -93153,7 +93998,7 @@ async function syncAndApply(session, deviceId, stateDir = defaultStateDir(), opt
                 }
               }
             ]);
-            await recordDaemonAutoApplyEvent({
+            await recordLocalApplyEvent({
               stateDir,
               trigger: options.trigger,
               session: activeSession,
@@ -93204,7 +94049,7 @@ async function syncAndApply(session, deviceId, stateDir = defaultStateDir(), opt
               route_kind: routePlan.route_kind,
               strategy_id: routePlan.strategy_id
             };
-            if (!options.force && previousRecord?.last_attempt_status === "success" && previousRecord.source_fingerprint === sourceFingerprint && (routePlan.route_kind === "bridge" || !installationStateChanged)) {
+            if (!forceThisApp && previousRecord?.last_attempt_status === "success" && previousRecord.source_fingerprint === sourceFingerprint && (routePlan.route_kind === "bridge" || !installationStateChanged)) {
               const sourceIdentityChanged = previousRecord.source_identity_fingerprint !== sourceIdentityFingerprint;
               const desiredStateRevisionChanged = previousRecord.desired_state_revision !== (app.desired_state_revision ?? null);
               if (routePlan.route_kind === "bridge" && sourceIdentityChanged || desiredStateRevisionChanged) {
@@ -93230,7 +94075,8 @@ async function syncAndApply(session, deviceId, stateDir = defaultStateDir(), opt
                   status: "success",
                   providerId: provider.id,
                   selectedEndpoint: fingerprintEndpoint,
-                  bridgeGeneration: routePlan.route_kind === "bridge" ? existingBridgeGenerationHash : null
+                  bridgeGeneration: routePlan.route_kind === "bridge" ? existingBridgeGenerationHash : null,
+                  writtenAccountKey: writtenAccountKeyFor(provider)
                 });
                 await postReportDurably(client, stateDir, `/devices/${deviceId}/apps/${app.id}/apply-report`, {
                   snapshot_id: snapshot.snapshot_id,
@@ -93253,7 +94099,7 @@ async function syncAndApply(session, deviceId, stateDir = defaultStateDir(), opt
                   selected_model: providerSelectedModel(applyProvider, fingerprintEndpoint),
                   reported_at: (/* @__PURE__ */ new Date()).toISOString()
                 });
-                await recordDaemonAutoApplyEvent({
+                await recordLocalApplyEvent({
                   stateDir,
                   trigger: options.trigger,
                   session: activeSession,
@@ -93275,6 +94121,55 @@ async function syncAndApply(session, deviceId, stateDir = defaultStateDir(), opt
                 continue;
               }
             }
+            const holdReason = forceThisApp ? null : await heldWriteReason({ app, provider, previousRecord, probe: options.localModelConfigProbe });
+            if (holdReason === "retry") {
+              appResults.push({ app_name: app.app_name, status: "skipped", message: "LOCAL_STATE_UNREADABLE" });
+              continue;
+            }
+            if (holdReason) {
+              const reportedAt2 = (/* @__PURE__ */ new Date()).toISOString();
+              const attemptFingerprint = hmacHex(localKey, { source_identity_fingerprint: sourceIdentityFingerprint, conflict_code: holdReason });
+              const alreadyReported = previousRecord?.last_attempt_status === "conflict" && previousRecord.source_identity_fingerprint === sourceIdentityFingerprint && previousRecord.failure_code === holdReason;
+              await recordApplyAttempt({
+                stateDir,
+                deviceId,
+                app,
+                mode,
+                snapshotId: snapshot.snapshot_id,
+                sourceIdentityFingerprint,
+                attemptFingerprint,
+                status: "conflict",
+                providerId: provider.id,
+                failureCode: holdReason,
+                failureMessage: holdReason,
+                writtenAccountKey: previousRecord?.written_account_key ?? null
+              });
+              if (!alreadyReported) {
+                await postReportDurably(client, stateDir, `/devices/${deviceId}/apps/${app.id}/apply-report`, {
+                  snapshot_id: snapshot.snapshot_id,
+                  desired_state_revision: app.desired_state_revision ?? null,
+                  status: "conflict",
+                  message: holdReason,
+                  error_code: holdReason,
+                  ...applyReportContext,
+                  reported_at: reportedAt2
+                });
+                await recordLocalApplyEvent({
+                  stateDir,
+                  trigger: options.trigger,
+                  session: activeSession,
+                  deviceId,
+                  app,
+                  status: "conflict",
+                  errorCode: holdReason,
+                  snapshotId: snapshot.snapshot_id,
+                  message: holdReason,
+                  reportedAt: reportedAt2
+                });
+              }
+              appResults.push({ app_name: app.app_name, status: "skipped", message: holdReason });
+              continue;
+            }
             if (routePlan.route_kind === "bridge") {
               retainedBridgeAppIds.add(app.id);
               const preparedBridgeConfig = await buildBridgeConfigForPlan(stateDir, routePlan, localKey, retainedBridgeAppIds);
@@ -93310,7 +94205,8 @@ async function syncAndApply(session, deviceId, stateDir = defaultStateDir(), opt
               status: "success",
               providerId: provider.id,
               selectedEndpoint: fingerprintEndpoint,
-              bridgeGeneration: routePlan.route_kind === "bridge" ? existingBridgeGenerationHash : null
+              bridgeGeneration: routePlan.route_kind === "bridge" ? existingBridgeGenerationHash : null,
+              writtenAccountKey: writtenAccountKeyFor(provider)
             });
             await postReportDurably(client, stateDir, `/devices/${deviceId}/apps/${app.id}/apply-report`, {
               snapshot_id: snapshot.snapshot_id,
@@ -93333,7 +94229,7 @@ async function syncAndApply(session, deviceId, stateDir = defaultStateDir(), opt
               selected_model: result.selected_model,
               reported_at: (/* @__PURE__ */ new Date()).toISOString()
             });
-            await recordDaemonAutoApplyEvent({
+            await recordLocalApplyEvent({
               stateDir,
               trigger: options.trigger,
               session: activeSession,
@@ -93428,7 +94324,7 @@ async function syncAndApply(session, deviceId, stateDir = defaultStateDir(), opt
                 }
               }
             ]);
-            await recordDaemonAutoApplyEvent({
+            await recordLocalApplyEvent({
               stateDir,
               trigger: options.trigger,
               session: activeSession,
@@ -93452,7 +94348,7 @@ async function syncAndApply(session, deviceId, stateDir = defaultStateDir(), opt
           const removedAppIds = [...new Set(
             (manifestBeforeFinalReconcile?.routes ?? []).map((route) => route.app_id).filter((appId) => !retainedBridgeAppIds.has(appId))
           )].sort();
-          const reconciliationAttemptId = `att_${randomBytes(8).toString("hex")}`;
+          const reconciliationAttemptId = `att_${randomBytes2(8).toString("hex")}`;
           try {
             const reconciliation = await buildBridgeReconciliationPlan(stateDir, retainedBridgeAppIds, bridgeRuntimeBaseUrl);
             await applyBridgeConfigPlan(stateDir, bridgeRuntimeBaseUrl, reconciliation);
@@ -93588,44 +94484,19 @@ async function syncAndApply(session, deviceId, stateDir = defaultStateDir(), opt
   };
 }
 
-// apps/cli/package.json
-var package_default = {
-  name: "@keysync/cli",
-  version: "0.1.132",
-  license: "MIT",
-  private: true,
-  type: "module",
-  bin: {
-    keysync: "./src/index.ts"
-  },
-  scripts: {
-    cli: "tsx src/index.ts",
-    build: "tsc -p tsconfig.json",
-    typecheck: "tsc -p tsconfig.json --noEmit",
-    test: "vitest run --exclude=dist/** --passWithNoTests"
-  },
-  dependencies: {
-    "@keysync/api-client": "workspace:*",
-    "@keysync/client-core": "workspace:*"
-  },
-  devDependencies: {
-    "@types/node": "^24.10.1",
-    tsx: "^4.20.6",
-    typescript: "^5.9.3",
-    vitest: "^4.1.11"
-  }
-};
+// keysync-cli-version:keysync-cli-package.json
+var keysync_cli_package_default = { name: "@keysync/cli", version: "0.1.134" };
 
 // apps/cli/src/version.ts
 var overrideVersion = process.env.KEYSYNC_ALLOW_CLIENT_VERSION_OVERRIDE === "1" ? process.env.KEYSYNC_CLIENT_VERSION_OVERRIDE?.trim() : "";
-var version = overrideVersion || package_default.version;
+var version = overrideVersion || keysync_cli_package_default.version;
 
 // apps/cli/src/dsh-host.ts
 import { createServer as createServer2, createConnection } from "node:net";
 import { createHash as createHash6, randomUUID } from "node:crypto";
 import { spawn as spawn2 } from "node:child_process";
-import { appendFile as appendFile2, chmod as chmod3, cp, mkdir as mkdir4, readFile as readFile7, readdir as readdir2, rename as rename3, rm as rm4, stat as stat4, writeFile as writeFile4 } from "node:fs/promises";
-import { dirname as dirname4, join as join7 } from "node:path";
+import { appendFile as appendFile2, chmod as chmod3, cp, mkdir as mkdir4, readFile as readFile8, readdir as readdir2, rename as rename4, rm as rm4, stat as stat5, writeFile as writeFile4 } from "node:fs/promises";
+import { dirname as dirname4, join as join8 } from "node:path";
 import { fileURLToPath } from "node:url";
 var import_managed_dsh = __toESM(require_managed_dsh(), 1);
 var import_remote_dsh = __toESM(require_remote_dsh(), 1);
@@ -93681,7 +94552,7 @@ function safeUserId(userId) {
   return sanitizeHostForPath(userId);
 }
 function dshAccountRoot(session, stateRoot = defaultStateRoot()) {
-  return join7(
+  return join8(
     stateRoot,
     "managed-agents",
     "deepseek-harness",
@@ -93702,7 +94573,7 @@ function dshDiscoveryHintsJson(accountRoot, input = process.env.KEYSYNC_DISCOVER
     ...hints,
     DeepSeekHarness: {
       ...existingDsh && typeof existingDsh === "object" && !Array.isArray(existingDsh) ? existingDsh : {},
-      marker_path: join7(accountRoot, "state.json")
+      marker_path: join8(accountRoot, "state.json")
     }
   });
 }
@@ -93711,10 +94582,10 @@ function dshHostSocketPath(stateRoot = defaultStateRoot()) {
     const suffix2 = createHash6("sha256").update(stateRoot).digest("hex").slice(0, 20);
     return `\\\\.\\pipe\\keysync-dsh-host-${suffix2}`;
   }
-  const localPath = join7(stateRoot, "dsh-host.sock");
+  const localPath = join8(stateRoot, "dsh-host.sock");
   if (Buffer.byteLength(localPath) <= 96) return localPath;
   const suffix = createHash6("sha256").update(stateRoot).digest("hex").slice(0, 20);
-  return join7("/tmp", `ksdh-${process.getuid?.() ?? "user"}-${suffix}`, "s");
+  return join8("/tmp", `ksdh-${process.getuid?.() ?? "user"}-${suffix}`, "s");
 }
 function bundledAssetDir() {
   if (process.env.KEYSYNC_DSH_ASSET_DIR?.trim()) return process.env.KEYSYNC_DSH_ASSET_DIR;
@@ -93730,7 +94601,7 @@ async function atomicPrivateWrite(filePath, contents) {
   try {
     await writeFile4(temporary, contents, { mode: 384 });
     if (process.platform !== "win32") await chmod3(temporary, 384);
-    await rename3(temporary, filePath);
+    await rename4(temporary, filePath);
   } catch (error) {
     await rm4(temporary, { force: true }).catch(() => void 0);
     throw error;
@@ -93753,7 +94624,7 @@ function validLegacyOwner(value) {
 }
 async function pathExists(filePath) {
   try {
-    await stat4(filePath);
+    await stat5(filePath);
     return true;
   } catch (error) {
     if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") return false;
@@ -93761,8 +94632,8 @@ async function pathExists(filePath) {
   }
 }
 async function claimLegacyDshRoot(session, stateRoot, accountRoot) {
-  const legacyRoot = join7(stateRoot, "managed-agents", "deepseek-harness");
-  const ownerPath = join7(legacyRoot, ".legacy-owner.json");
+  const legacyRoot = join8(stateRoot, "managed-agents", "deepseek-harness");
+  const ownerPath = join8(legacyRoot, ".legacy-owner.json");
   const completionName = ".legacy-migration-complete.json";
   const excluded = /* @__PURE__ */ new Set(["accounts", ".legacy-owner.json"]);
   let entries;
@@ -93779,7 +94650,7 @@ async function claimLegacyDshRoot(session, stateRoot, accountRoot) {
   await ensurePrivateDirectory(legacyRoot);
   let recordedOwner = null;
   try {
-    const parsed = JSON.parse(await readFile7(ownerPath, "utf8"));
+    const parsed = JSON.parse(await readFile8(ownerPath, "utf8"));
     if (!validLegacyOwner(parsed)) throw new Error("invalid owner");
     recordedOwner = parsed;
   } catch (error) {
@@ -93789,11 +94660,11 @@ async function claimLegacyDshRoot(session, stateRoot, accountRoot) {
   }
   if (!recordedOwner && preferredServerKey && !currentServerIsPreferred) return;
   if (recordedOwner && !sameLegacyOwner(recordedOwner, expectedOwner)) {
-    const recordedAccountRoot = join7(legacyRoot, "accounts", recordedOwner.server_key, recordedOwner.user_id);
-    const recordedMigrationComplete = await pathExists(join7(recordedAccountRoot, completionName));
+    const recordedAccountRoot = join8(legacyRoot, "accounts", recordedOwner.server_key, recordedOwner.user_id);
+    const recordedMigrationComplete = await pathExists(join8(recordedAccountRoot, completionName));
     const preferredServerCorrectingNonPreferredClaim = currentServerIsPreferred && recordedOwner.server_key !== preferredServerKey;
     if (recordedMigrationComplete && !preferredServerCorrectingNonPreferredClaim) return;
-    const ownerMetadata = await stat4(ownerPath);
+    const ownerMetadata = await stat5(ownerPath);
     if (!preferredServerCorrectingNonPreferredClaim && Date.now() - ownerMetadata.mtimeMs < LEGACY_DSH_CLAIM_STALE_MS) return;
     await rm4(ownerPath, { force: true });
     recordedOwner = null;
@@ -93810,13 +94681,13 @@ async function claimLegacyDshRoot(session, stateRoot, accountRoot) {
   }
   if (process.platform !== "win32") await chmod3(ownerPath, 384);
   try {
-    await stat4(join7(accountRoot, completionName));
+    await stat5(join8(accountRoot, completionName));
     return;
   } catch (error) {
     if (!(error && typeof error === "object" && "code" in error && error.code === "ENOENT")) throw error;
   }
-  if (await pathExists(join7(accountRoot, "state.json"))) {
-    await atomicPrivateWrite(join7(accountRoot, completionName), `${JSON.stringify({ ...expectedOwner, adopted_existing_at: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)}
+  if (await pathExists(join8(accountRoot, "state.json"))) {
+    await atomicPrivateWrite(join8(accountRoot, completionName), `${JSON.stringify({ ...expectedOwner, adopted_existing_at: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)}
 `);
     return;
   }
@@ -93826,7 +94697,7 @@ async function claimLegacyDshRoot(session, stateRoot, accountRoot) {
   await ensurePrivateDirectory(stagingRoot);
   try {
     for (const entry of entries) {
-      await cp(join7(legacyRoot, entry.name), join7(stagingRoot, entry.name), {
+      await cp(join8(legacyRoot, entry.name), join8(stagingRoot, entry.name), {
         recursive: true,
         errorOnExist: true,
         force: false,
@@ -93834,23 +94705,23 @@ async function claimLegacyDshRoot(session, stateRoot, accountRoot) {
       });
     }
     for (const retainedName of ["host-desired.json", "remote-dsh.sealed"]) {
-      const retainedPath = join7(accountRoot, retainedName);
+      const retainedPath = join8(accountRoot, retainedName);
       if (await pathExists(retainedPath)) {
-        await cp(retainedPath, join7(stagingRoot, retainedName), { force: true, preserveTimestamps: true });
+        await cp(retainedPath, join8(stagingRoot, retainedName), { force: true, preserveTimestamps: true });
       }
     }
-    await atomicPrivateWrite(join7(stagingRoot, completionName), `${JSON.stringify({ ...expectedOwner, migrated_at: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)}
+    await atomicPrivateWrite(join8(stagingRoot, completionName), `${JSON.stringify({ ...expectedOwner, migrated_at: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)}
 `);
-    if (await pathExists(accountRoot)) await rename3(accountRoot, displacedRoot);
-    await rename3(stagingRoot, accountRoot);
+    if (await pathExists(accountRoot)) await rename4(accountRoot, displacedRoot);
+    await rename4(stagingRoot, accountRoot);
   } catch (error) {
     await rm4(stagingRoot, { recursive: true, force: true }).catch(() => void 0);
     if (!await pathExists(accountRoot) && await pathExists(displacedRoot)) {
-      await rename3(displacedRoot, accountRoot).catch(() => void 0);
+      await rename4(displacedRoot, accountRoot).catch(() => void 0);
     }
     if (claim.claim_id) {
       try {
-        const currentOwner = JSON.parse(await readFile7(ownerPath, "utf8"));
+        const currentOwner = JSON.parse(await readFile8(ownerPath, "utf8"));
         if (currentOwner.claim_id === claim.claim_id) await rm4(ownerPath, { force: true });
       } catch {
       }
@@ -93869,7 +94740,7 @@ function normalizeDesiredState(value) {
 }
 async function readDesiredState(filePath) {
   try {
-    return normalizeDesiredState(JSON.parse(await readFile7(filePath, "utf8")));
+    return normalizeDesiredState(JSON.parse(await readFile8(filePath, "utf8")));
   } catch {
     return normalizeDesiredState(null);
   }
@@ -93891,10 +94762,10 @@ function publicRpcError(error) {
 async function createDshHostController(options) {
   const stateRoot = options.stateRoot ?? defaultStateRoot();
   const accountRoot = dshAccountRoot(options.session, stateRoot);
-  const dshHome = join7(accountRoot, "instances", "default", "home");
-  const desiredPath = join7(accountRoot, "host-desired.json");
-  const secretPath = join7(accountRoot, "remote-dsh.sealed");
-  const hostLogPath = join7(accountRoot, "logs", "host.log");
+  const dshHome = join8(accountRoot, "instances", "default", "home");
+  const desiredPath = join8(accountRoot, "host-desired.json");
+  const secretPath = join8(accountRoot, "remote-dsh.sealed");
+  const hostLogPath = join8(accountRoot, "logs", "host.log");
   const assetDir = options.assetDir ?? bundledAssetDir();
   await ensurePrivateDirectory(stateRoot);
   await claimLegacyDshRoot(options.session, stateRoot, accountRoot);
@@ -93917,8 +94788,8 @@ async function createDshHostController(options) {
     spawn: spawn2,
     fetchImpl: globalThis.fetch,
     windowsZipExtractor: process.env.KEYSYNC_DSH_WINDOWS_ZIP_EXTRACTOR === "tar" ? "tar" : void 0,
-    packageLockPath: join7(assetDir, "managed-dsh-official-0.1.2-alpha.2-package-lock.json"),
-    pnpmLockPath: join7(assetDir, "managed-dsh-pnpm-10.32.1-package-lock.json")
+    packageLockPath: join8(assetDir, "managed-dsh-official-0.1.2-alpha.2-package-lock.json"),
+    pnpmLockPath: join8(assetDir, "managed-dsh-pnpm-10.32.1-package-lock.json")
   });
   let releaseCatalog = releaseCatalogFromStatus(managed.status(), true);
   const apiRequest = options.apiRequest ?? (async (method, pathname, body, requestOptions) => withSessionRefresh(
@@ -93926,6 +94797,31 @@ async function createDshHostController(options) {
     (activeSession) => clientFromSession(activeSession).request(method, pathname, body, { timeoutMs: requestOptions?.timeoutMs }),
     options.stateDir
   ));
+  const diagnosticReporter2 = new DiagnosticReporter({
+    baseUrl: options.session.baseUrl,
+    stateDir: options.stateDir,
+    installStateDir: defaultInstallStateDir(options.session.baseUrl, options.stateDir),
+    getInstallationId: async () => {
+      const device = await readDeviceState(options.stateDir);
+      return (await installForServerDevice(
+        options.session.baseUrl,
+        options.stateDir,
+        device?.user_id === options.session.user_id ? device?.install_id_hash : null
+      )).install_id;
+    },
+    getClient: () => ({ post: (pathname, body) => apiRequest("POST", pathname, body) })
+  });
+  diagnosticReporter2.setContext({ user_id: options.session.user_id ?? null });
+  const reportHostFailure = async (action, error, failureStage) => {
+    const value = publicRpcError(error);
+    await diagnosticReporter2.report({
+      domain: "dsh_host",
+      action,
+      error_code: typeof value.code === "string" ? value.code : "DSH_HOST_BACKGROUND_FAILED",
+      message: typeof value.message === "string" ? value.message : "DeepSeek Harness background operation failed.",
+      details: { failure_stage: failureStage }
+    }).catch((reportError) => appendHostLog({ source: "diagnostics", event: "report_failed", error: publicRpcError(reportError) }));
+  };
   const remoteFactory = options.remoteFactory ?? import_remote_dsh.default.createRemoteDshTunnelManager;
   const remote = remoteFactory({
     secretPath,
@@ -93986,6 +94882,7 @@ async function createDshHostController(options) {
         event: "release_refresh_failed",
         code: error instanceof ApiError ? error.code : "UNKNOWN_ERROR"
       }).catch(() => void 0);
+      await reportHostFailure("release_refresh", error, "release_refresh");
     }
   };
   const refreshReleaseCatalog = async () => {
@@ -94042,7 +94939,7 @@ async function createDshHostController(options) {
           return { opened: false, error: { code: "data_directory_not_installed", message: "Install DeepSeek Harness before opening its data directory." } };
         }
         try {
-          await stat4(dshHome);
+          await stat5(dshHome);
         } catch (error) {
           if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") {
             return { opened: false, error: { code: "data_directory_missing", message: "The DeepSeek Harness data directory does not exist." } };
@@ -94124,6 +95021,7 @@ async function createDshHostController(options) {
           } catch (error) {
             nextRecoveryAt = now + recoveryDelayMs;
             await appendHostLog({ source: "managed_dsh", event: "recovery_failed", retry_in_ms: recoveryDelayMs, error: publicRpcError(error) });
+            await reportHostFailure("managed_recovery", error, "background_recovery");
             recoveryDelayMs = Math.min(3e4, recoveryDelayMs * 2);
           }
         }
@@ -94138,6 +95036,7 @@ async function createDshHostController(options) {
           } catch (error) {
             nextRemoteRecoveryAt = now + remoteRecoveryDelayMs;
             await appendHostLog({ source: "remote_dsh", event: "recovery_failed", retry_in_ms: remoteRecoveryDelayMs, error: publicRpcError(error) });
+            await reportHostFailure("remote_recovery", error, "background_recovery");
             remoteRecoveryDelayMs = Math.min(3e4, remoteRecoveryDelayMs * 2);
           }
         }
@@ -94151,6 +95050,7 @@ async function createDshHostController(options) {
             await managed.start();
           } catch (error) {
             await appendHostLog({ source: "managed_dsh", event: "restore_failed", error: publicRpcError(error) });
+            await reportHostFailure("managed_restore", error, "startup_restore");
           }
         }
         if (desired.remote === "enabled") {
@@ -94158,6 +95058,7 @@ async function createDshHostController(options) {
             await remote.start(await resolveDeviceId());
           } catch (error) {
             await appendHostLog({ source: "remote_dsh", event: "restore_failed", error: publicRpcError(error) });
+            await reportHostFailure("remote_restore", error, "startup_restore");
           }
         }
       });
@@ -94237,18 +95138,18 @@ async function startDshHostRpcServer(socketPath, dispatch, requestTimeoutMs = RP
     });
     socket.on("error", () => void 0);
   });
-  await new Promise((resolve2, reject) => {
+  await new Promise((resolve3, reject) => {
     server.once("error", reject);
     server.listen(socketPath, () => {
       server.off("error", reject);
-      resolve2();
+      resolve3();
     });
   });
   if (process.platform !== "win32") await chmod3(socketPath, 384);
   return {
     server,
     async close() {
-      const closed = new Promise((resolve2) => server.close(() => resolve2()));
+      const closed = new Promise((resolve3) => server.close(() => resolve3()));
       await closed;
       if (process.platform !== "win32") await rm4(socketPath, { force: true });
     }
@@ -94256,7 +95157,7 @@ async function startDshHostRpcServer(socketPath, dispatch, requestTimeoutMs = RP
 }
 async function callDshHostRpc(socketPath, method, params, timeoutMs = RPC_TIMEOUT_MS) {
   const id = `rpc_${process.pid}_${Date.now()}_${Math.random().toString(36).slice(2)}`;
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const socket = createConnection(socketPath);
     socket.setEncoding("utf8");
     let input = "";
@@ -94267,7 +95168,7 @@ async function callDshHostRpc(socketPath, method, params, timeoutMs = RPC_TIMEOU
       settled = true;
       clearTimeout(timer);
       if (error) reject(error);
-      else resolve2(result);
+      else resolve3(result);
     };
     socket.once("connect", () => socket.write(`${JSON.stringify({ version: HOST_PROTOCOL_VERSION, id, method, params })}
 `));
@@ -94353,13 +95254,13 @@ function isProcessRunning(pid, options = {}) {
 
 // apps/cli/src/systemd-service.ts
 import { execFile as execFile3 } from "node:child_process";
-import { chmod as chmod4, mkdir as mkdir5, readFile as readFile8, rm as rm5, writeFile as writeFile5 } from "node:fs/promises";
+import { chmod as chmod4, mkdir as mkdir5, readFile as readFile9, rm as rm5, writeFile as writeFile5 } from "node:fs/promises";
 import { homedir as homedir7 } from "node:os";
-import { dirname as dirname5, join as join8 } from "node:path";
+import { dirname as dirname5, join as join9 } from "node:path";
 import { promisify as promisify2 } from "node:util";
 var execFileAsync2 = promisify2(execFile3);
 function systemdUserUnitPath(home = homedir7()) {
-  return join8(home, ".config", "systemd", "user", "keysync.service");
+  return join9(home, ".config", "systemd", "user", "keysync.service");
 }
 function systemdArgument(value) {
   if (!value || /[\r\n\0]/.test(value)) throw new Error("Invalid systemd command path.");
@@ -94412,7 +95313,7 @@ async function uninstallSystemdUserService(home = homedir7()) {
   await execFileAsync2("systemctl", ["--user", "disable", "--now", "keysync.service"]).catch(() => void 0);
   let removed = false;
   try {
-    await readFile8(unitPath);
+    await readFile9(unitPath);
     await rm5(unitPath, { force: true });
     removed = true;
   } catch {
@@ -94429,9 +95330,9 @@ async function systemdUserServiceStatus() {
 // apps/cli/src/index.ts
 function loadEnvFile() {
   const clientRoot = fileURLToPath2(new URL("../../..", import.meta.url));
-  const parentRoot = join9(clientRoot, "..");
-  const envPaths = [join9(clientRoot, ".env")];
-  if (process.env.KEYSYNC_UNIFIED_WORKSPACE === "1") envPaths.push(join9(parentRoot, ".env"));
+  const parentRoot = join10(clientRoot, "..");
+  const envPaths = [join10(clientRoot, ".env")];
+  if (process.env.KEYSYNC_UNIFIED_WORKSPACE === "1") envPaths.push(join10(parentRoot, ".env"));
   for (const envPath2 of envPaths) {
     if (!existsSync4(envPath2)) continue;
     for (const rawLine of readFileSync2(envPath2, "utf8").split(/\r?\n/)) {
@@ -94449,6 +95350,25 @@ function loadEnvFile() {
 loadEnvFile();
 var defaultBaseUrl = process.env.KEYSYNC_API_URL || process.env.KEYSYNC_DEFAULT_API_URL || "";
 var defaultUpdateUrl = process.env.KEYSYNC_UPDATE_URL || process.env.KEYSYNC_DEFAULT_UPDATE_URL || "";
+var diagnosticBaseUrl = defaultBaseUrl || "http://127.0.0.1:1";
+var diagnosticAccessToken = "";
+var diagnosticReporter = new DiagnosticReporter({
+  baseUrl: diagnosticBaseUrl,
+  stateDir: defaultStateDir(diagnosticBaseUrl),
+  installStateDir: defaultInstallStateDir(diagnosticBaseUrl),
+  getInstallationId: async () => {
+    const stateDir = defaultStateDir(diagnosticBaseUrl);
+    const session = await readSession(stateDir);
+    const device = await readDeviceState(stateDir);
+    return (await installForServerDevice(
+      session?.baseUrl ?? diagnosticBaseUrl,
+      stateDir,
+      session?.user_id && device?.user_id === session.user_id ? device.install_id_hash : null
+    )).install_id;
+  },
+  getClient: () => new KeySyncApiClient({ baseUrl: diagnosticBaseUrl, accessToken: diagnosticAccessToken || void 0, timeoutMs: 1e4 })
+});
+var cliFailureEventIds = /* @__PURE__ */ new WeakMap();
 var heartbeatTimeoutMs = Number(process.env.KEYSYNC_HEARTBEAT_TIMEOUT_MS ?? "5000");
 var execFileAsync3 = promisify3(execFile4);
 function warnIfPasswordCouldBeStronger(password) {
@@ -94513,6 +95433,7 @@ Options:
   --install-dir DIR  Override Linux CLI install directory for update testing or custom installs
   --vault-password PASSWORD  Unlock Provider secrets for sync/daemon. Can also use KEYSYNC_VAULT_PASSWORD
   --force  Re-apply the current server snapshot even when the local apply fingerprint is unchanged
+  --app    With --force, aim it at one app (e.g. --app Codex) and leave every other app alone
   --no-start-daemon  Login/register without automatically starting the background daemon
   --daemon-interval-seconds N  Background daemon interval after login/register. Defaults to 30
   --json  Print machine-readable DSH status
@@ -94577,6 +95498,32 @@ async function promptForMissingRegisterInput(input) {
 function printJson(value) {
   console.log(JSON.stringify(value, null, 2));
 }
+async function reportCliFailure(error, details = {}) {
+  const message = error instanceof Error ? error.message : String(error);
+  const errorObject = error && typeof error === "object" ? error : null;
+  const clientEventId = errorObject ? cliFailureEventIds.get(errorObject) ?? `evt_${randomBytes3(16).toString("hex")}` : `evt_${randomBytes3(16).toString("hex")}`;
+  if (errorObject) cliFailureEventIds.set(errorObject, clientEventId);
+  try {
+    await diagnosticReporter.report({
+      client_event_id: clientEventId,
+      domain: "cli",
+      action: process.argv[2] || "startup",
+      error_code: error instanceof ApiError ? error.code : error?.code || "CLI_COMMAND_FAILED",
+      message,
+      details: {
+        ...details,
+        error_name: error instanceof Error ? error.name : typeof error,
+        http_status: error instanceof ApiError ? error.status : null,
+        argv: redactedProcessCommand(process.argv.slice(2))
+      },
+      client_version: version,
+      platform: platform2(),
+      arch: arch()
+    });
+  } catch (reportError) {
+    console.error(`Unable to persist client diagnostic: ${reportError instanceof Error ? reportError.message : String(reportError)}`);
+  }
+}
 function summarizeImportPlan(plan) {
   console.log(`CC Switch config: ${plan.config_dir}`);
   console.log(`Database: ${plan.db_path}`);
@@ -94696,11 +95643,11 @@ function selectCliArchive(feed) {
 }
 function safeArchiveFileName(fileUrl) {
   const parsed = new URL(fileUrl, "https://updates.local/");
-  const name = decodeURIComponent(basename3(parsed.pathname));
+  const name = decodeURIComponent(basename2(parsed.pathname));
   return name.replace(/[^a-zA-Z0-9._ -]/g, "_") || `keysync-cli-linux-${cliUpdateArch()}.tar.gz`;
 }
 async function sha512Base64(filePath) {
-  return createHash7("sha512").update(await readFile9(filePath)).digest("base64");
+  return createHash7("sha512").update(await readFile10(filePath)).digest("base64");
 }
 async function downloadUpdateFile(url, destination) {
   const response = await fetch(url, { cache: "no-store" });
@@ -94709,7 +95656,7 @@ async function downloadUpdateFile(url, destination) {
   await writeFile6(destination, Buffer.from(await response.arrayBuffer()));
 }
 async function runLocalCommand(command, args) {
-  await new Promise((resolve2, reject) => {
+  await new Promise((resolve3, reject) => {
     const child = spawn3(command, args, { stdio: ["ignore", "pipe", "pipe"] });
     let stderr = "";
     child.stderr?.on("data", (chunk) => {
@@ -94717,7 +95664,7 @@ async function runLocalCommand(command, args) {
     });
     child.once("error", reject);
     child.once("exit", (code, signal) => {
-      if (code === 0) resolve2();
+      if (code === 0) resolve3();
       else reject(new Error(`${command} exited with code=${code ?? "null"} signal=${signal ?? "null"}${stderr ? `: ${stderr.trim()}` : ""}`));
     });
   });
@@ -94729,25 +95676,25 @@ async function findExtractedCliDir(extractDir) {
   const entries = await readdir3(extractDir, { withFileTypes: true });
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const candidate = join9(extractDir, entry.name);
-    if (existsSync4(join9(candidate, "keysync-cli.mjs")) && existsSync4(join9(candidate, "keysync")) && existsSync4(join9(candidate, "bridge", "bifrost-http"))) return candidate;
+    const candidate = join10(extractDir, entry.name);
+    if (existsSync4(join10(candidate, "keysync-cli.mjs")) && existsSync4(join10(candidate, "keysync")) && existsSync4(join10(candidate, "bridge", "bifrost-http"))) return candidate;
   }
   throw new Error("CLI archive did not contain keysync-cli.mjs, keysync, and bridge/bifrost-http");
 }
 async function installCliArchive(archivePath, installDir) {
-  const extractDir = await mkdtemp(join9(tmpdir(), "keysync-cli-update-extract-"));
+  const extractDir = await mkdtemp(join10(tmpdir(), "keysync-cli-update-extract-"));
   try {
     await runLocalCommand("tar", ["-xzf", archivePath, "-C", extractDir]);
     const sourceDir = await findExtractedCliDir(extractDir);
     await mkdir6(installDir, { recursive: true });
-    await copyFile3(join9(sourceDir, "keysync-cli.mjs"), join9(installDir, "keysync-cli.mjs"));
-    await copyFile3(join9(sourceDir, "keysync"), join9(installDir, "keysync"));
-    await rm6(join9(installDir, "bridge"), { recursive: true, force: true });
-    await cp2(join9(sourceDir, "bridge"), join9(installDir, "bridge"), { recursive: true });
-    if (existsSync4(join9(sourceDir, "README.txt"))) await copyFile3(join9(sourceDir, "README.txt"), join9(installDir, "README.txt"));
-    await chmod5(join9(installDir, "keysync-cli.mjs"), 493);
-    await chmod5(join9(installDir, "keysync"), 493);
-    await chmod5(join9(installDir, "bridge", "bifrost-http"), 493);
+    await copyFile2(join10(sourceDir, "keysync-cli.mjs"), join10(installDir, "keysync-cli.mjs"));
+    await copyFile2(join10(sourceDir, "keysync"), join10(installDir, "keysync"));
+    await rm6(join10(installDir, "bridge"), { recursive: true, force: true });
+    await cp2(join10(sourceDir, "bridge"), join10(installDir, "bridge"), { recursive: true });
+    if (existsSync4(join10(sourceDir, "README.txt"))) await copyFile2(join10(sourceDir, "README.txt"), join10(installDir, "README.txt"));
+    await chmod5(join10(installDir, "keysync-cli.mjs"), 493);
+    await chmod5(join10(installDir, "keysync"), 493);
+    await chmod5(join10(installDir, "bridge", "bifrost-http"), 493);
   } finally {
     await rm6(extractDir, { recursive: true, force: true });
   }
@@ -94774,14 +95721,14 @@ async function updateLinuxCli() {
   }
   console.log(`KeySync CLI ${feed.version} is available (current ${version}).`);
   if (process.argv.includes("--check")) return;
-  const workDir = await mkdtemp(join9(tmpdir(), "keysync-cli-update-"));
-  const archivePath = join9(workDir, safeArchiveFileName(archive.url));
+  const workDir = await mkdtemp(join10(tmpdir(), "keysync-cli-update-"));
+  const archivePath = join10(workDir, safeArchiveFileName(archive.url));
   try {
     await downloadUpdateFile(resolveUpdateArtifactUrl(feedBaseUrl, archive.url), archivePath);
     const checksum = await sha512Base64(archivePath);
     if (checksum !== archive.sha512) throw new Error("Downloaded CLI package checksum did not match update feed");
     const installDir = cliInstallDir();
-    const before = existsSync4(installDir) ? await stat5(installDir) : null;
+    const before = existsSync4(installDir) ? await stat6(installDir) : null;
     if (before && !before.isDirectory()) throw new Error(`Install target is not a directory: ${installDir}`);
     await installCliArchive(archivePath, installDir);
     console.log(`Installed KeySync CLI ${feed.version} to ${installDir}.`);
@@ -94815,11 +95762,25 @@ async function requireSession(stateDir) {
   if (device?.device_id && !device.user_id) {
     await writeDeviceState({ ...device, user_id: session.user_id }, stateDir);
   }
+  diagnosticAccessToken = session.access_token;
+  diagnosticReporter.setContext({ user_id: session.user_id ?? null, device_id: await verifiedDiagnosticDeviceId(session, stateDir) });
+  await diagnosticReporter.claimContext().catch(() => void 0);
+  await diagnosticReporter.flush({ force: true }).catch(() => void 0);
   const accountRoot = dshAccountRoot(session, defaultStateRoot());
-  process.env.KEYSYNC_DSH_HOME = join9(accountRoot, "instances", "default", "home");
+  process.env.KEYSYNC_DSH_HOME = join10(accountRoot, "instances", "default", "home");
   process.env.KEYSYNC_DISCOVERY_HINTS_JSON = dshDiscoveryHintsJson(accountRoot);
   return session;
 }
+async function verifiedDiagnosticDeviceId(session, stateDir) {
+  const device = await readDeviceState(stateDir);
+  if (!device?.device_id || !device.install_id_hash || device.user_id !== session.user_id) return null;
+  try {
+    const candidates = await installCandidatesForServer(session.baseUrl, stateDir);
+    return candidates.some(({ install }) => installIdHashFor(install.install_id) === device.install_id_hash) ? device.device_id : null;
+  } catch {
+    return null;
+  }
+}
 async function requireDeviceId(stateDir) {
   const device = await readDeviceState(stateDir);
   if (!device?.device_id) throw new Error("Device is not bound.");
@@ -94831,16 +95792,18 @@ async function installIdHashForSession(session, stateDir) {
 }
 async function ensureDaemonDeviceId(session, stateDir) {
   const registration = await detectDeviceRegistrationInfo();
-  const install_id_hash = await installIdHashForSession(session, stateDir);
   const device = await readDeviceState(stateDir, { legacyStateDirs: legacyStateDirs(session.baseUrl) });
   if (device?.device_id) {
     try {
       const current = await withSessionRefresh(session, async (activeSession) => {
         const activeClient = clientFromSession(activeSession);
         const current2 = await activeClient.get(`/devices/${device.device_id}`);
-        if (current2.install_id_hash && current2.install_id_hash !== install_id_hash) {
-          throw new Error("Local device is linked to a different install identity.");
+        const candidates2 = await installCandidatesForServer(session.baseUrl, stateDir);
+        const match = current2.install_id_hash ? candidates2.find(({ install }) => installIdHashFor(install.install_id) === current2.install_id_hash) : null;
+        if (current2.install_id_hash && !match) {
+          return { id: current2.id, install_id_hash: current2.install_id_hash, claim_ticket: null, unmatched: true };
         }
+        const install_id_hash2 = match ? installIdHashFor(match.install.install_id) : await installIdHashForSession(session, stateDir);
         const payload = current2.install_id_hash ? {
           name: current2.name,
           hostname: current2.hostname ?? null
@@ -94848,21 +95811,34 @@ async function ensureDaemonDeviceId(session, stateDir) {
           name: registration.name,
           hostname: registration.hostname
         };
-        return activeClient.post("/devices/register", {
+        const result2 = await activeClient.post("/devices/register", {
           ...payload,
           platform: registration.platform,
           client_version: version,
-          install_id_hash,
+          install_id_hash: install_id_hash2,
           ...current2.install_id_hash ? {} : { existing_device_id: device.device_id }
         });
+        return { ...result2, install_id_hash: install_id_hash2, unmatched: false };
+      }, stateDir);
+      await writeDeviceState({
+        device_id: current.id,
+        user_id: session.user_id,
+        install_id_hash: current.install_id_hash,
+        ...!current.unmatched && current.claim_ticket ? { claim_ticket: current.claim_ticket } : {}
       }, stateDir);
-      await writeDeviceState({ device_id: current.id, user_id: session.user_id, ...current.claim_ticket ? { claim_ticket: current.claim_ticket } : {} }, stateDir);
       return current.id;
     } catch (error) {
       if (!(error instanceof ApiError) || error.status !== 404 && error.status !== 410) throw error;
       await clearDeviceState(stateDir);
     }
   }
+  const candidates = await installCandidatesForServer(session.baseUrl, stateDir);
+  const needsLegacyLookup = candidates.some(({ directory }) => directory !== defaultInstallStateDir(session.baseUrl, stateDir));
+  const existing = needsLegacyLookup ? await withSessionRefresh(session, async (activeSession) => {
+    const devices = await clientFromSession(activeSession).get("/devices");
+    return candidates.find(({ install }) => devices.some((item) => item.status !== "removed" && item.install_id_hash === installIdHashFor(install.install_id)));
+  }, stateDir) : null;
+  const install_id_hash = existing ? installIdHashFor(existing.install.install_id) : await installIdHashForSession(session, stateDir);
   const result = await withSessionRefresh(
     session,
     async (activeSession) => clientFromSession(activeSession).post("/devices/register", {
@@ -94874,7 +95850,7 @@ async function ensureDaemonDeviceId(session, stateDir) {
     }),
     stateDir
   );
-  await writeDeviceState({ device_id: result.id, user_id: session.user_id, ...result.claim_ticket ? { claim_ticket: result.claim_ticket } : {} }, stateDir);
+  await writeDeviceState({ device_id: result.id, user_id: session.user_id, install_id_hash, ...result.claim_ticket ? { claim_ticket: result.claim_ticket } : {} }, stateDir);
   return result.id;
 }
 function parseDaemonLock(raw) {
@@ -94886,6 +95862,8 @@ function parseDaemonLock(raw) {
     if (typeof parsed.pid !== "number" || !Number.isInteger(parsed.pid) || parsed.pid <= 0) return null;
     return {
       pid: parsed.pid,
+      ...typeof parsed.run_id === "string" ? { run_id: parsed.run_id } : {},
+      ...typeof parsed.started_at === "string" ? { started_at: parsed.started_at } : {},
       ...typeof parsed.version === "string" ? { version: parsed.version } : {},
       ...typeof parsed.command === "string" ? { command: parsed.command } : {},
       ...typeof parsed.process_identity === "string" ? { process_identity: parsed.process_identity } : {},
@@ -94896,19 +95874,20 @@ function parseDaemonLock(raw) {
   }
 }
 async function acquireDaemonLock(stateDir) {
-  const lockPath = join9(stateDir, "daemon.pid");
-  const reclaimPath = join9(stateDir, "daemon.pid.reclaim");
+  const lockPath = join10(stateDir, "daemon.pid");
+  const reclaimPath = join10(stateDir, "daemon.pid.reclaim");
   await mkdir6(stateDir, { recursive: true, mode: 448 });
   if (process.platform !== "win32") await chmod5(stateDir, 448);
   const contents = JSON.stringify({
     pid: process.pid,
+    run_id: `run_${randomBytes3(16).toString("hex")}`,
     version,
     started_at: (/* @__PURE__ */ new Date()).toISOString(),
     command: redactedProcessCommand(process.argv),
     process_identity: processIdentity(process.pid),
     vault_unlocked: Boolean(vaultPasswordFromInput())
   }, null, 2);
-  const candidatePath = join9(stateDir, `.daemon.pid.${process.pid}.${Date.now()}`);
+  const candidatePath = join10(stateDir, `.daemon.pid.${process.pid}.${Date.now()}`);
   await writeFile6(candidatePath, contents, { mode: 384, flag: "wx" });
   if (process.platform !== "win32") await chmod5(candidatePath, 384);
   try {
@@ -94916,7 +95895,7 @@ async function acquireDaemonLock(stateDir) {
       let reclaimOwner = null;
       let reclaimPresent = false;
       try {
-        reclaimOwner = parseDaemonLock(await readFile9(reclaimPath, "utf8"));
+        reclaimOwner = parseDaemonLock(await readFile10(reclaimPath, "utf8"));
         reclaimPresent = true;
       } catch {
       }
@@ -94935,7 +95914,7 @@ async function acquireDaemonLock(stateDir) {
       }
       let existingLock = null;
       try {
-        existingLock = parseDaemonLock(await readFile9(lockPath, "utf8"));
+        existingLock = parseDaemonLock(await readFile10(lockPath, "utf8"));
       } catch {
       }
       const identityMatches = !existingLock?.process_identity || processIdentity(existingLock.pid) === existingLock.process_identity;
@@ -94968,32 +95947,42 @@ async function acquireDaemonLock(stateDir) {
 async function releaseDaemonLock(stateDir, expectedPid) {
   if (expectedPid !== void 0) {
     try {
-      const current = parseDaemonLock(await readFile9(join9(stateDir, "daemon.pid"), "utf8"));
+      const current = parseDaemonLock(await readFile10(join10(stateDir, "daemon.pid"), "utf8"));
       if (current?.pid !== expectedPid) return;
     } catch {
       return;
     }
   }
-  await rm6(join9(stateDir, "daemon.pid"), { force: true });
-  if (expectedPid === void 0) await rm6(join9(stateDir, "daemon.pid.reclaim"), { force: true });
+  await rm6(join10(stateDir, "daemon.pid"), { force: true });
+  if (expectedPid === void 0) await rm6(join10(stateDir, "daemon.pid.reclaim"), { force: true });
 }
 function daemonLogPath(stateDir) {
-  return join9(stateDir, "daemon.log");
+  return join10(stateDir, "daemon.log");
 }
 async function activeDaemonLock(stateDir) {
   try {
-    const lock = parseDaemonLock(await readFile9(join9(stateDir, "daemon.pid"), "utf8"));
+    const lock = parseDaemonLock(await readFile10(join10(stateDir, "daemon.pid"), "utf8"));
     const identityMatches = !lock?.process_identity || processIdentity(lock.pid) === lock.process_identity;
     if (lock && isProcessRunning(lock.pid) && identityMatches) return lock;
   } catch {
   }
   return null;
 }
+async function interruptedDaemonRun(stateDir) {
+  try {
+    const lock = parseDaemonLock(await readFile10(join10(stateDir, "daemon.pid"), "utf8"));
+    if (!lock) return null;
+    const identityMatches = !lock.process_identity || processIdentity(lock.pid) === lock.process_identity;
+    return isProcessRunning(lock.pid) && identityMatches ? null : lock;
+  } catch {
+    return null;
+  }
+}
 async function writeDaemonStatus(stateDir, patch) {
-  const statusPath = join9(stateDir, "daemon-status.json");
+  const statusPath = join10(stateDir, "daemon-status.json");
   let current = { running: false };
   try {
-    current = JSON.parse(await readFile9(statusPath, "utf8"));
+    current = JSON.parse(await readFile10(statusPath, "utf8"));
   } catch {
   }
   await mkdir6(stateDir, { recursive: true, mode: 448 });
@@ -95005,12 +95994,20 @@ function formatError(error) {
   if (error instanceof ApiError) return `${error.code} (${error.status}): ${error.message}`;
   return error instanceof Error ? error.message : String(error);
 }
+function daemonFailureMessage(error) {
+  const raw = formatError(error).trim();
+  const code = error && typeof error === "object" && "code" in error ? String(error.code ?? "") : "";
+  if (code === "ENOSPC" || /\bENOSPC\b|no space left on device/i.test(raw)) {
+    return "DAEMON_STORAGE_FULL: The daemon could not start because the disk is full. Free disk space and retry.";
+  }
+  return raw || "DAEMON_START_FAILED: The daemon stopped unexpectedly.";
+}
 function isFatalDaemonError(error) {
   if (!(error instanceof ApiError)) return false;
   return error.status === 401 || error.status === 403 || error.status === 410 || error.code === "DEVICE_REMOVED";
 }
 function sleep3(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 async function stopDaemon(stateDir) {
   const lock = await activeDaemonLock(stateDir);
@@ -95088,12 +96085,15 @@ async function startDetachedDaemon(stateDir, intervalSeconds, vaultPassword) {
 }
 async function startDaemonAfterAuth(session, stateDir, vaultPassword) {
   const deviceId = await ensureDaemonDeviceId(session, stateDir);
+  diagnosticReporter.setContext({ user_id: session.user_id ?? null, device_id: await verifiedDiagnosticDeviceId(session, stateDir) });
+  await diagnosticReporter.claimContext().catch(() => void 0);
+  await diagnosticReporter.flush({ force: true }).catch(() => void 0);
   console.log(`Device ready: ${deviceId}`);
   const intervalSeconds = Number(arg("--daemon-interval-seconds", "30"));
   const result = await startDetachedDaemon(stateDir, Number.isFinite(intervalSeconds) ? intervalSeconds : 30, vaultPassword);
   console.log(result === "started" ? "Daemon started" : "Daemon already running");
 }
-async function waitForDshHost(socketPath, timeoutMs = 8e3) {
+async function waitForDshHost(socketPath, timeoutMs = 3e4) {
   const deadline = Date.now() + timeoutMs;
   let lastError = null;
   while (Date.now() < deadline) {
@@ -95133,7 +96133,7 @@ async function ensureDshHostForCommand(stateDir, session) {
   const socketPath = dshHostSocketPath(defaultStateRoot());
   const matchesSession = (status) => {
     const expectedRoot = dshAccountRoot(session, defaultStateRoot());
-    return status.account.server_key === basename3(dirname6(expectedRoot)) && status.account.user_id === session.user_id;
+    return status.account.server_key === basename2(dirname6(expectedRoot)) && status.account.user_id === session.user_id;
   };
   let active = null;
   try {
@@ -95292,8 +96292,14 @@ async function main() {
     const client = new KeySyncApiClient({ baseUrl });
     const previousSession = await readSession(stateDir);
     const result = await client.post("/auth/login", { email, password });
+    diagnosticAccessToken = result.access_token;
+    diagnosticReporter.setContext({ user_id: result.user.id });
+    await diagnosticReporter.claimContext().catch(() => void 0);
+    await diagnosticReporter.flush({ force: true }).catch(() => void 0);
     const session = { baseUrl, access_token: result.access_token, refresh_token: result.refresh_token, user_id: result.user.id };
-    await unlockOrBootstrapVault(clientFromSession(session), vaultPassword);
+    const vaultClient = clientFromSession(session);
+    const vaultStatus = await vaultClient.get("/vault/initialized");
+    await accessVaultMaterial(vaultClient, vaultPassword, vaultStatus.initialized ? "unlock" : "setup");
     await stopActiveDshHost();
     await stopDaemon(stateDir);
     if (previousSession?.user_id && previousSession.user_id !== result.user.id) await clearDeviceState(stateDir);
@@ -95326,7 +96332,11 @@ async function main() {
       const previousSession = await readSession(stateDir);
       if (previousSession?.user_id && result.user?.id && previousSession.user_id !== result.user.id) await clearDeviceState(stateDir);
       const session = { baseUrl, access_token: result.access_token, refresh_token: result.refresh_token, user_id: result.user?.id };
-      await unlockOrBootstrapVault(clientFromSession(session), vaultPassword);
+      diagnosticAccessToken = result.access_token;
+      diagnosticReporter.setContext({ user_id: result.user?.id ?? null });
+      await diagnosticReporter.claimContext().catch(() => void 0);
+      await diagnosticReporter.flush({ force: true }).catch(() => void 0);
+      await accessVaultMaterial(clientFromSession(session), vaultPassword, "setup");
       await stopActiveDshHost();
       await stopDaemon(stateDir);
       await writeSession(session, stateDir);
@@ -95334,7 +96344,7 @@ async function main() {
       if (!process.argv.includes("--no-start-daemon")) await startDaemonAfterAuth(session, stateDir, vaultPassword);
       return;
     }
-    await rm6(join9(stateDir, "session.json"), { force: true });
+    await rm6(join10(stateDir, "session.json"), { force: true });
     await clearDeviceState(stateDir);
     console.log(`Account created. Check ${result.email} for a verification code, then run keysync login after verifying your email.`);
     return;
@@ -95371,7 +96381,7 @@ async function main() {
       } catch {
       }
     }
-    await rm6(join9(stateDir, "session.json"), { force: true });
+    await rm6(join10(stateDir, "session.json"), { force: true });
     if (daemonWasRunning) console.log("Daemon stopped");
     console.log("Logged out");
     return;
@@ -95388,24 +96398,27 @@ async function main() {
     const stateDir = commandStateDir();
     const session = await requireSession(stateDir);
     const client = clientFromSession(session);
-    const install_id_hash = await installIdHashForSession(session, stateDir);
     const existingDeviceId = arg("--device-id");
     if (existingDeviceId) {
       const current = await client.get(`/devices/${existingDeviceId}`);
+      const match = current.install_id_hash ? (await installCandidatesForServer(session.baseUrl, stateDir)).find(({ install }) => installIdHashFor(install.install_id) === current.install_id_hash) : null;
+      if (current.install_id_hash && !match) throw new Error("This device's previous installation identity is unavailable locally.");
+      const install_id_hash2 = match ? installIdHashFor(match.install.install_id) : await installIdHashForSession(session, stateDir);
       const result2 = await client.post("/devices/register", {
         name: current.name,
         platform: current.platform,
         hostname: current.hostname ?? null,
         client_version: version,
-        install_id_hash,
+        install_id_hash: install_id_hash2,
         existing_device_id: existingDeviceId
       });
-      await writeDeviceState({ device_id: result2.id, user_id: session.user_id, ...result2.claim_ticket ? { claim_ticket: result2.claim_ticket } : {} }, stateDir);
+      await writeDeviceState({ device_id: result2.id, user_id: session.user_id, install_id_hash: install_id_hash2, ...result2.claim_ticket ? { claim_ticket: result2.claim_ticket } : {} }, stateDir);
       console.log(`Device bound: ${result2.id}`);
       return;
     }
     const registration = await detectDeviceRegistrationInfo();
     const name = arg("--name", registration.name);
+    const install_id_hash = await installIdHashForSession(session, stateDir);
     const result = await client.post("/devices/register", {
       name,
       platform: registration.platform,
@@ -95413,11 +96426,15 @@ async function main() {
       client_version: version,
       install_id_hash
     });
-    await writeDeviceState({ device_id: result.id, user_id: session.user_id, ...result.claim_ticket ? { claim_ticket: result.claim_ticket } : {} }, stateDir);
+    await writeDeviceState({ device_id: result.id, user_id: session.user_id, install_id_hash, ...result.claim_ticket ? { claim_ticket: result.claim_ticket } : {} }, stateDir);
     console.log(`Device bound: ${result.id}`);
     return;
   }
   if (command === "sync") {
+    const forceApp = arg("--app");
+    if (forceApp && !agentAppNames.includes(forceApp)) {
+      throw new Error(`Unknown app: ${forceApp}. Expected one of ${agentAppNames.join(", ")}.`);
+    }
     const stateDir = commandStateDir();
     const vaultPassword = requiredVaultPassword("sync");
     const session = await requireSession(stateDir);
@@ -95425,7 +96442,12 @@ async function main() {
     const asJson = hasFlag2("--json");
     const envTrigger = process.env.KEYSYNC_APPLY_TRIGGER;
     const trigger = envTrigger === "manual_sync" || envTrigger === "manual_reapply" || envTrigger === "daemon_auto" || envTrigger === "cli_sync" ? envTrigger : "cli_sync";
-    const result = await syncAndApply(session, deviceId, stateDir, { vaultPassword, force: hasFlag2("--force"), trigger });
+    const result = await syncAndApply(session, deviceId, stateDir, {
+      vaultPassword,
+      force: hasFlag2("--force") && !forceApp,
+      forceAppNames: forceApp ? [forceApp] : void 0,
+      trigger
+    });
     if (asJson) {
       printJson({
         device_id: deviceId,
@@ -95511,8 +96533,8 @@ async function main() {
     const baseUrl = session?.baseUrl ?? selectedBaseUrl;
     if (!baseUrl) throw new Error("Missing server URL. Set KEYSYNC_API_URL or KEYSYNC_DEFAULT_API_URL in environment.");
     const client = new KeySyncApiClient({ baseUrl, accessToken: session?.access_token });
-    const [health, server_version] = await Promise.all([client.get("/health"), client.get("/version")]);
-    console.log(JSON.stringify({ server_url: baseUrl, state_dir: stateDir, health, server_version }, null, 2));
+    const [health, server_version, diagnostics] = await Promise.all([client.get("/health"), client.get("/version"), diagnosticReporter.status()]);
+    console.log(JSON.stringify({ server_url: baseUrl, state_dir: stateDir, health, server_version, diagnostics }, null, 2));
     return;
   }
   if (command === "self-update" || command === "update") {
@@ -95597,6 +96619,15 @@ async function main() {
   if (command === "daemon") {
     const stateDir = commandStateDir();
     const session = await requireSession(stateDir);
+    const interruptedRun = await interruptedDaemonRun(stateDir);
+    if (interruptedRun) {
+      await reportCliFailure(Object.assign(new Error("The previous daemon run ended without a clean shutdown."), { code: "PREVIOUS_RUN_INTERRUPTED" }), {
+        failure_stage: "startup_sentinel",
+        previous_pid: interruptedRun.pid,
+        previous_started_at: interruptedRun.started_at ?? null,
+        previous_run_id: interruptedRun.run_id ?? null
+      });
+    }
     if (!await acquireDaemonLock(stateDir)) {
       console.log("Daemon already running");
       return;
@@ -95610,6 +96641,9 @@ async function main() {
       try {
         const result = await runDaemonTick(session, stateDir, currentDeviceId);
         currentDeviceId = result.deviceId;
+        diagnosticReporter.setContext({ user_id: session.user_id ?? null, device_id: await verifiedDiagnosticDeviceId(session, stateDir) });
+        await diagnosticReporter.claimContext().catch(() => void 0);
+        await diagnosticReporter.flush({ force: true }).catch(() => void 0);
         await writeDaemonStatus(stateDir, { running: true, last_tick_completed_at: (/* @__PURE__ */ new Date()).toISOString(), last_error: null });
         if (result.mode === "discovery") console.log("Daemon tick complete. Discovery updated.");
         else console.log(`Daemon tick complete. Snapshot: ${result.snapshotId}`);
@@ -95620,6 +96654,7 @@ async function main() {
           await clearDeviceState(stateDir);
         }
         await writeDaemonStatus(stateDir, { running: true, last_error: message });
+        await reportCliFailure(error, { failure_stage: "daemon_tick", device_id: currentDeviceId, retryable: !isFatalDaemonError(error) });
         console.error(`Daemon tick failed: ${message}`);
         if (isFatalDaemonError(error)) throw error;
       }
@@ -95645,8 +96680,8 @@ async function main() {
     let dshRpc = null;
     let stopped = false;
     let stopNow = () => void 0;
-    const stopPromise = new Promise((resolve2) => {
-      stopNow = resolve2;
+    const stopPromise = new Promise((resolve3) => {
+      stopNow = resolve3;
     });
     process.once("SIGINT", () => {
       stopped = true;
@@ -95684,6 +96719,7 @@ async function main() {
             await activeHost.reconcile();
           } catch (error) {
             await writeDaemonStatus(stateDir, { running: true, last_error: `DSH recovery check failed: ${formatError(error)}` });
+            await reportCliFailure(error, { failure_stage: "dsh_recovery", retryable: true });
           }
         }
       })();
@@ -95694,27 +96730,33 @@ async function main() {
     } finally {
       stopped = true;
       stopNow();
-      await dshHost?.dispatch("dsh.cancel-install").catch(() => void 0);
+      await dshHost?.dispatch("dsh.cancel-install").catch(async (error) => {
+        await reportCliFailure(error, { failure_stage: "daemon_cancel_install" });
+      });
       await dshRecoveryLoop;
       let cleanupError;
       try {
         await dshHost?.shutdown();
       } catch (error) {
+        await reportCliFailure(error, { failure_stage: "daemon_shutdown_dsh" });
         cleanupError = error;
       }
       try {
         await dshRpc?.close();
       } catch (error) {
+        await reportCliFailure(error, { failure_stage: "daemon_shutdown_rpc" });
         cleanupError ??= error;
       }
       try {
         await writeDaemonStatus(stateDir, { running: false, stopped_at: (/* @__PURE__ */ new Date()).toISOString() });
       } catch (error) {
+        await reportCliFailure(error, { failure_stage: "daemon_shutdown_status_write" });
         cleanupError ??= error;
       }
       try {
         await releaseDaemonLock(stateDir, process.pid);
       } catch (error) {
+        await reportCliFailure(error, { failure_stage: "daemon_shutdown_lock_release" });
         cleanupError ??= error;
       }
       if (cleanupError) throw cleanupError;
@@ -95724,7 +96766,27 @@ async function main() {
   }
   throw new Error(`Unknown command: ${command}`);
 }
-main().catch((error) => {
+process.on("uncaughtException", (error) => {
+  void reportCliFailure(error, { failure_stage: "uncaught_exception" }).finally(() => {
+    process.exitCode = 1;
+  });
+});
+process.on("unhandledRejection", (reason) => {
+  void reportCliFailure(reason, { failure_stage: "unhandled_rejection" }).finally(() => {
+    process.exitCode = 1;
+  });
+});
+main().catch(async (error) => {
+  if (process.argv[2] === "daemon") {
+    const message = daemonFailureMessage(error);
+    try {
+      const stateDir = commandStateDir();
+      await writeDaemonStatus(stateDir, { running: false, stopped_at: (/* @__PURE__ */ new Date()).toISOString(), last_error: message });
+      await releaseDaemonLock(stateDir, process.pid);
+    } catch {
+    }
+  }
+  await reportCliFailure(error, { failure_stage: "command" });
   console.error(error instanceof ApiError ? formatError(error) : error instanceof Error ? error.message : error);
   process.exitCode = 1;
 });