@macintacos/caret 1.1.1 → 1.2.0

package/dist/cli.js

@@ -2748,6 +2748,43 @@ var init_edit = __esm(() => {
 });
 
 // node_modules/jsonc-parser/lib/esm/main.js
+function printParseErrorCode(code) {
+  switch (code) {
+    case 1:
+      return "InvalidSymbol";
+    case 2:
+      return "InvalidNumberFormat";
+    case 3:
+      return "PropertyNameExpected";
+    case 4:
+      return "ValueExpected";
+    case 5:
+      return "ColonExpected";
+    case 6:
+      return "CommaExpected";
+    case 7:
+      return "CloseBraceExpected";
+    case 8:
+      return "CloseBracketExpected";
+    case 9:
+      return "EndOfFileExpected";
+    case 10:
+      return "InvalidCommentToken";
+    case 11:
+      return "UnexpectedEndOfComment";
+    case 12:
+      return "UnexpectedEndOfString";
+    case 13:
+      return "UnexpectedEndOfNumber";
+    case 14:
+      return "InvalidUnicode";
+    case 15:
+      return "InvalidEscapeCharacter";
+    case 16:
+      return "InvalidCharacter";
+  }
+  return "<unknown ParseErrorCode>";
+}
 function modify(text, path, value, options) {
   return setProperty(text, path, value, options);
 }
@@ -2771,12 +2808,13 @@ function applyEdits(text, edits) {
   }
   return text;
 }
-var ScanError, SyntaxKind, parse3, ParseErrorCode;
+var createScanner2, ScanError, SyntaxKind, parse3, parseTree2, findNodeAtLocation2, ParseErrorCode;
 var init_main = __esm(() => {
   init_format();
   init_edit();
   init_scanner();
   init_parser();
+  createScanner2 = createScanner;
   (function(ScanError) {
     ScanError[ScanError["None"] = 0] = "None";
     ScanError[ScanError["UnexpectedEndOfComment"] = 1] = "UnexpectedEndOfComment";
@@ -2806,6 +2844,8 @@ var init_main = __esm(() => {
     SyntaxKind[SyntaxKind["EOF"] = 17] = "EOF";
   })(SyntaxKind || (SyntaxKind = {}));
   parse3 = parse2;
+  parseTree2 = parseTree;
+  findNodeAtLocation2 = findNodeAtLocation;
   (function(ParseErrorCode) {
     ParseErrorCode[ParseErrorCode["InvalidSymbol"] = 1] = "InvalidSymbol";
     ParseErrorCode[ParseErrorCode["InvalidNumberFormat"] = 2] = "InvalidNumberFormat";
@@ -2827,7 +2867,7 @@ var init_main = __esm(() => {
 });
 
 // src/adapters/opencode/paths.ts
-import { existsSync, readdirSync } from "fs";
+import { existsSync, readdirSync, realpathSync } from "fs";
 import { homedir as homedir3 } from "os";
 import { basename, dirname, join as join5 } from "path";
 function localPluginSpecifier(repoDir) {
@@ -2849,14 +2889,24 @@ function opencodeConfigDir() {
   const xdg = process.env.XDG_CONFIG_HOME?.trim();
   return join5(xdg || join5(homedir3(), ".config"), "opencode");
 }
-function resolveConfigFile(configDir) {
-  for (const name of CONFIG_FILENAMES) {
+function resolveConfigFile(configDir, names) {
+  for (const name of names) {
     const p = join5(configDir, name);
     if (existsSync(p))
       return p;
   }
   return join5(configDir, "opencode.json");
 }
+function existingConfigFiles(configDir) {
+  const seen = new Set;
+  return CONFIG_FILENAMES.map((name) => join5(configDir, name)).filter((p) => existsSync(p)).filter((p) => {
+    const real = realpathSync(p);
+    if (seen.has(real))
+      return false;
+    seen.add(real);
+    return true;
+  });
+}
 function commandDir(configDir) {
   return join5(configDir, COMMAND_DIRNAME);
 }
@@ -2874,15 +2924,48 @@ function existingLegacyInstallFiles(configDir) {
   const commands = entries.filter((e) => !e.isDirectory() && e.name.startsWith(COMMAND_NAMESPACE)).filter((e) => e.name.endsWith(".md")).map((e) => join5(configDir, LEGACY_COMMAND_DIRNAME, e.name)).sort();
   return [...plugins, ...commands].filter((p) => existsSync(p));
 }
-function opencodeCachePackagesDir() {
+function opencodeCacheRoot() {
   const xdg = process.env.XDG_CACHE_HOME?.trim();
-  return join5(xdg || join5(homedir3(), ".cache"), "opencode", "packages");
+  return join5(xdg || join5(homedir3(), ".cache"), "opencode");
+}
+function opencodeCachePackagesDir() {
+  return join5(opencodeCacheRoot(), "packages");
+}
+function opencodeNpmDir() {
+  return join5(opencodeCacheRoot(), "npm");
+}
+function opencodeNpmCacheDir(pkg, version) {
+  return join5(opencodeNpmDir(), `${pkg}@${version ?? "latest"}`);
+}
+function opencodeNpmLocalCacheDir(spec) {
+  return join5(opencodeNpmDir(), spec);
+}
+function liveGenerationDir(dir) {
+  let names;
+  try {
+    names = readdirSync(dir);
+  } catch {
+    return null;
+  }
+  const generations = names.filter((n) => /^\d+$/.test(n));
+  if (generations.length === 0)
+    return null;
+  return join5(dir, generations.reduce((newest, name) => Number(name) > Number(newest) ? name : newest));
 }
 function opencodeCachePackageDir(specifier = CARET_PACKAGE) {
   return join5(opencodeCachePackagesDir(), specifier);
 }
 function existingOpencodeCachePackageDirs(pkg = CARET_PACKAGE) {
-  const bare = opencodeCachePackageDir(pkg);
+  return [
+    ...listCacheDirs(opencodeCachePackageDir(pkg)),
+    ...listCacheDirs(join5(opencodeNpmDir(), pkg))
+  ];
+}
+function opencodeRootPaths(pkg = CARET_PACKAGE) {
+  const liveGenerations = listCacheDirs(join5(opencodeNpmDir(), pkg)).map(liveGenerationDir).filter((d) => d !== null);
+  return [...listCacheDirs(opencodeCachePackageDir(pkg)), ...liveGenerations].map((d) => join5(d, "node_modules", pkg));
+}
+function listCacheDirs(bare) {
   const parent = dirname(bare);
   const leaf = basename(bare);
   let names;
@@ -2901,9 +2984,53 @@ var init_paths2 = __esm(() => {
 });
 
 // src/adapters/opencode/config-plugin.ts
-function pluginArray(text) {
+import { isDeepStrictEqual } from "util";
+function formattingOf(text) {
+  const firstProperty = parseTree2(text)?.children?.[0];
+  const indent = firstProperty ? text.slice(text.lastIndexOf(`
+`, firstProperty.offset) + 1, firstProperty.offset) : "";
+  if (indent.startsWith("\t"))
+    return { insertSpaces: false, tabSize: 1 };
+  return { insertSpaces: true, tabSize: /^ +$/.test(indent) ? indent.length : 2 };
+}
+function configParseError(text) {
+  const { root, errors } = lenientParse(text);
+  const [first] = errors;
+  if (first !== undefined)
+    return `${printParseErrorCode(first.error)} at offset ${first.offset}`;
+  const isObject = typeof root === "object" && root !== null && !Array.isArray(root);
+  return root === undefined || isObject ? null : "not a JSON object";
+}
+function lenientParse(text) {
+  const errors = [];
+  const root = parse3(text.replace(/^\uFEFF/, ""), errors, {
+    allowTrailingComma: true,
+    allowEmptyContent: true
+  });
+  return { root, errors };
+}
+function checked(existing, edited, intent) {
+  const { key, value } = intent;
+  const { [key]: _, ...rest } = lenientParse(existing).root ?? {};
+  const intended = value === undefined ? rest : { ...rest, [key]: value };
+  const { root, errors } = lenientParse(edited);
+  if (errors.length > 0 || !isDeepStrictEqual(root ?? {}, intended)) {
+    throw new Error(`editing "${key}" would not give the intended config; is "${key}" listed more than once?`);
+  }
+  return edited;
+}
+function pluginArray(text, key) {
   const cfg = parse3(text);
-  return Array.isArray(cfg?.plugin) ? cfg.plugin : [];
+  const arr = cfg?.[key];
+  return Array.isArray(arr) ? arr : [];
+}
+function itemSpec(item) {
+  if (typeof item === "string")
+    return item;
+  if (typeof item === "object" && item !== null && "package" in item && typeof item.package === "string") {
+    return item.package;
+  }
+  return null;
 }
 function splitPluginSpecifier(spec) {
   if (isLocalPluginSpecifier(spec))
@@ -2918,82 +3045,157 @@ function packageName(spec) {
   return splitPluginSpecifier(spec).pkg;
 }
 function entryNames(entry, pkg) {
-  return typeof entry === "string" && packageName(entry) === packageName(pkg);
+  const spec = itemSpec(entry);
+  return spec !== null && packageName(spec) === packageName(pkg);
 }
-function addPluginToConfigText(existing, pkg) {
+function addPluginToConfigText(existing, pkg, key) {
   const text = existing ?? `{}
 `;
-  const current = parse3(text)?.plugin;
+  const current = parse3(text)?.[key];
   if (Array.isArray(current)) {
     if (current.some((e) => entryNames(e, pkg)))
       return text;
-    const path = ["plugin", current.length];
+    const path = [key, current.length];
     const edits = modify(text, path, pkg, {
       isArrayInsertion: true,
-      formattingOptions: FORMATTING
+      formattingOptions: formattingOf(text)
     });
-    return applyEdits(text, edits);
+    return checked(text, applyEdits(text, edits), { key, value: [...current, pkg] });
   }
-  const edits = modify(text, ["plugin"], [pkg], { formattingOptions: FORMATTING });
-  return applyEdits(text, edits);
-}
-function findPluginEntry(existing, pkg) {
-  if (existing === null)
-    return null;
-  const entry = pluginArray(existing).find((e) => entryNames(e, pkg));
-  return typeof entry === "string" ? entry : null;
+  const edits = modify(text, [key], [pkg], { formattingOptions: formattingOf(text) });
+  return checked(text, applyEdits(text, edits), { key, value: [pkg] });
 }
-function pluginEntries(existing) {
-  return existing === null ? [] : pluginArray(existing).filter((e) => typeof e === "string");
+function pluginItemSpecs(existing, key) {
+  return pluginArray(existing, key).map(itemSpec);
 }
-function setPluginVersionInConfigText(existing, pkg, version) {
-  const arr = pluginArray(existing);
-  const i = arr.findIndex((e) => entryNames(e, pkg));
-  if (i === -1)
+function setPluginVersionInConfigText(existing, target) {
+  const { pkg, version, key } = target;
+  const arr = pluginArray(existing, key);
+  const index = arr.findIndex((e) => entryNames(e, pkg));
+  if (index === -1)
     return existing;
-  const next = `${packageName(arr[i])}@${version}`;
-  const edits = modify(existing, ["plugin", i], next, { formattingOptions: FORMATTING });
-  return applyEdits(existing, edits);
-}
-function removePluginFromConfigText(existing, pkg) {
-  const arr = pluginArray(existing);
-  if (!arr.some((e) => entryNames(e, pkg)))
+  const spec = `${packageName(itemSpec(arr[index]) ?? pkg)}@${version}`;
+  return setPluginItemSpec(existing, { key, index, spec });
+}
+function setPluginItemSpec(existing, target) {
+  const { key, index, spec } = target;
+  const arr = pluginArray(existing, key);
+  const item = arr[index];
+  const isObject = typeof item === "object" && item !== null;
+  const path = isObject ? [key, index, "package"] : [key, index];
+  const edits = modify(existing, path, spec, { formattingOptions: formattingOf(existing) });
+  const swapped = isObject ? { ...item, package: spec } : spec;
+  const next = arr.map((e, i) => i === index ? swapped : e);
+  return checked(existing, applyEdits(existing, edits), { key, value: next });
+}
+function rewritePluginArray(existing, key, keep) {
+  const arr = pluginArray(existing, key);
+  const dropped = arr.flatMap((item, i) => keep(item, i) ? [] : [i]);
+  if (dropped.length === 0)
     return existing;
-  const next = arr.filter((e) => !entryNames(e, pkg));
-  const edits = modify(existing, ["plugin"], next, { formattingOptions: FORMATTING });
-  return applyEdits(existing, edits);
+  const next = arr.filter((_, i) => !dropped.includes(i));
+  if (key === "plugins" && next.length === 0) {
+    return checked(existing, deleteNode(existing, [key]), { key, value: undefined });
+  }
+  const edited = dropped.reduceRight((text, i) => deleteNode(text, [key, i]), existing);
+  return checked(existing, edited, { key, value: next });
+}
+function commaAfter(text, from) {
+  const scanner = createScanner2(text, true);
+  scanner.setPosition(from);
+  scanner.scan();
+  return text[scanner.getTokenOffset()] === "," ? scanner.getTokenOffset() : null;
+}
+function wholeLine(text, start, end) {
+  let lineStart = start;
+  let lineEnd = end;
+  while (lineStart > 0 && (text[lineStart - 1] === " " || text[lineStart - 1] === "\t"))
+    lineStart--;
+  while (lineEnd < text.length && (text[lineEnd] === " " || text[lineEnd] === "\t"))
+    lineEnd++;
+  const eol = text.startsWith(`\r
+`, lineEnd) ? 2 : text[lineEnd] === `
+` ? 1 : 0;
+  const aloneOnLine = (lineStart === 0 || text[lineStart - 1] === `
+`) && (lineEnd === text.length || eol > 0);
+  return aloneOnLine ? { offset: lineStart, length: lineEnd + eol - lineStart, content: "" } : { offset: start, length: end - start, content: "" };
+}
+function deleteNode(text, path) {
+  const root = parseTree2(text);
+  const found = root && findNodeAtLocation2(root, path);
+  const node = typeof path.at(-1) === "number" ? found : found?.parent;
+  const siblings = node?.parent?.children;
+  if (!node || !siblings)
+    return text;
+  const i = siblings.indexOf(node);
+  const end = node.offset + node.length;
+  const edits = [];
+  const trailingComma = commaAfter(text, end);
+  if (trailingComma !== null && text.slice(end, trailingComma).trim() === "") {
+    edits.push(wholeLine(text, node.offset, trailingComma + 1));
+  } else {
+    edits.push(wholeLine(text, node.offset, end));
+    const previousSibling = siblings[i - 1];
+    const comma = trailingComma ?? (previousSibling ? commaAfter(text, previousSibling.offset + previousSibling.length) : null);
+    if (comma !== null)
+      edits.push({ offset: comma, length: 1, content: "" });
+  }
+  return applyEdits(text, edits);
 }
-var FORMATTING;
+var PLUGIN_KEYS;
 var init_config_plugin = __esm(() => {
   init_main();
   init_paths2();
-  FORMATTING = { insertSpaces: true, tabSize: 2 };
+  PLUGIN_KEYS = ["plugin", "plugins"];
 });
 
 // src/adapters/opencode/entries.ts
 import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
-import { join as join6 } from "path";
+import { basename as basename2, join as join6 } from "path";
 function isCaretCheckout(dir) {
   return existsSync2(join6(dir, "opencode", "caret.plugin.ts"));
 }
 function caretEntries(text, isCheckout) {
-  return pluginEntries(text).filter((entry) => {
-    const path = localSpecifierPath(entry);
-    return path === undefined ? splitPluginSpecifier(entry).pkg === CARET_PACKAGE : isCheckout(path);
-  });
+  if (text === null)
+    return [];
+  return PLUGIN_KEYS.flatMap((key) => pluginItemSpecs(text, key).flatMap((spec, index) => spec !== null && isCaretSpec(spec, isCheckout) ? [{ key, index, spec }] : []));
+}
+function isCaretSpec(spec, isCheckout) {
+  const path = localSpecifierPath(spec);
+  if (path === undefined)
+    return splitPluginSpecifier(spec).pkg === CARET_PACKAGE;
+  return isCaretTarball(path) || isCheckout(path);
+}
+function isCaretTarball(path) {
+  const filename = basename2(path);
+  return filename.startsWith(CARET_TARBALL_PREFIX) && filename.endsWith(".tgz");
 }
-function readCaretEntry(configFile) {
-  return findPluginEntry(readConfigText(configFile), CARET_PACKAGE);
+function dropEntries(text, drop) {
+  return PLUGIN_KEYS.reduce((acc, key) => {
+    const droppedIndices = new Set(drop.filter((e) => e.key === key).map((e) => e.index));
+    return droppedIndices.size === 0 ? acc : rewritePluginArray(acc, key, (_, i) => !droppedIndices.has(i));
+  }, text);
 }
-function readLoadedCaretEntry(configFile) {
-  return caretEntries(readConfigText(configFile), isCaretCheckout)[0] ?? null;
+function caretPackageEntry(text) {
+  return caretEntries(text, () => false).find((e) => !isLocalPluginSpecifier(e.spec)) ?? null;
+}
+function readCaretEntries(configFiles, isCheckout) {
+  return configFiles.flatMap((f) => caretEntries(readConfigText(f), isCheckout));
+}
+function readCaretEntry(configFiles) {
+  return configFiles.map((f) => caretPackageEntry(readConfigText(f))).find((e) => e !== null) ?? null;
+}
+function readLoadedCaretEntry(configFiles) {
+  return readCaretEntries(configFiles, isCaretCheckout)[0] ?? null;
 }
 function readConfigText(path) {
   return existsSync2(path) ? readFileSync3(path, "utf-8") : null;
 }
+var CARET_TARBALL_PREFIX;
 var init_entries = __esm(() => {
   init_config_plugin();
   init_paths2();
+  CARET_TARBALL_PREFIX = `${CARET_PACKAGE.slice(1).replace("/", "-")}-`;
 });
 
 // src/lib/semver.ts
@@ -3015,6 +3217,126 @@ function isNewer(latest, current) {
   return a2 > b2;
 }
 
+// src/adapters/opencode/host.ts
+import { accessSync, constants, realpathSync as realpathSync2, statSync } from "fs";
+import { basename as basename3, delimiter, isAbsolute, join as join7 } from "path";
+function parseOpencodeVersion(stdout) {
+  return parseVersionTriple(stdout.trim().replace(/^opencode /, ""));
+}
+function readOpencodeVersion({
+  bin,
+  timeoutMs = OPENCODE_VERSION_TIMEOUT_MS
+}) {
+  try {
+    const res = Bun.spawnSync([bin, "--version"], {
+      timeout: timeoutMs,
+      stdin: "ignore",
+      stderr: "ignore"
+    });
+    return res.exitCode === 0 ? parseOpencodeVersion(res.stdout.toString()) : null;
+  } catch {
+    return null;
+  }
+}
+function opencodeBinsOnPath(path) {
+  const seen = new Set;
+  return path.split(delimiter).filter((dir) => isAbsolute(dir)).map((dir) => join7(dir, "opencode")).filter((bin) => {
+    const real = executableRealpath(bin);
+    if (real === null || seen.has(real))
+      return false;
+    seen.add(real);
+    return true;
+  });
+}
+function executableRealpath(bin) {
+  try {
+    if (!statSync(bin).isFile())
+      return null;
+    accessSync(bin, constants.X_OK);
+    return realpathSync2(bin);
+  } catch {
+    return null;
+  }
+}
+function readOpencodeHosts(path = process.env.PATH ?? "", timeoutMs) {
+  return opencodeBinsOnPath(path).map((bin) => ({
+    bin,
+    version: readOpencodeVersion({ bin, timeoutMs })
+  }));
+}
+function sharedHost(hosts) {
+  const firstVersion = hosts[0]?.version ?? null;
+  if (firstVersion === null)
+    return null;
+  return hosts.every((h) => h.version !== null && isV2Host(h.version) === isV2Host(firstVersion)) ? firstVersion : null;
+}
+function describeHosts(hosts) {
+  if (hosts.length === 0)
+    return "no `opencode` on PATH";
+  return hosts.map(({ bin, version }) => version === null ? `couldn't read \`${bin} --version\`` : `OpenCode ${version.join(".")} at ${bin}`).join(", ");
+}
+function isV2Host(version) {
+  return version !== null && version[0] >= 2;
+}
+function pluginKeyFor(version) {
+  return isV2Host(version) ? "plugins" : "plugin";
+}
+function hostConfigFilenames(host) {
+  return host !== null && !isV2Host(host) ? CONFIG_FILENAMES : CONFIG_FILENAMES.filter((name) => name !== "config.json");
+}
+function loadedConfigFiles(configFiles, host) {
+  const names = hostConfigFilenames(host);
+  return configFiles.filter((p) => names.includes(basename3(p)));
+}
+function hostCheck(hosts, keys, ignoredFiles) {
+  const base = { id: "opencode-host", title: "OpenCode host" };
+  const found = describeHosts(hosts);
+  if (hosts.every((h) => h.version === null)) {
+    return { ...base, status: "unknown", detail: "", reason: found };
+  }
+  const faults = [];
+  const remedies = [];
+  for (const { bin, version } of hosts) {
+    if (version === null || isV2Host(version))
+      continue;
+    const shown = version.join(".");
+    if (isNewer(V1_FLOOR, shown)) {
+      faults.push(`OpenCode ${shown} at ${bin} is older than ${V1_FLOOR}, the first that loads caret`);
+      remedies.push(`upgrade OpenCode to ${V1_FLOOR} or later`);
+    }
+  }
+  const wrongKey = keys.find((k) => k !== pluginKeyFor(sharedHost(hosts)));
+  if (wrongKey === "plugins") {
+    faults.push("caret is in `plugins`, which only OpenCode v2 loads, and not every `opencode` on PATH reads as v2 (v1 before 1.18.16 refuses to start with the key)");
+    remedies.push("run `caret install`");
+  } else if (wrongKey === "plugin") {
+    faults.push("caret is in the legacy `plugin` key on OpenCode v2");
+    remedies.push("run `caret install`");
+  }
+  if (ignoredFiles.length > 0) {
+    const names = ignoredFiles.map((p) => basename3(p)).join(", ");
+    faults.push(`caret is in ${names}, which OpenCode v2 doesn't load`);
+    remedies.push("run `caret install`");
+  }
+  if (faults.length === 0) {
+    return {
+      ...base,
+      status: "pass",
+      detail: `${found} \u2014 loads caret from \`${keys.join("`, `")}\``
+    };
+  }
+  return {
+    ...base,
+    status: "fail",
+    detail: `${found} \u2014 ${faults.join("; ")}`,
+    remedy: [...new Set(remedies)].join("; ")
+  };
+}
+var OPENCODE_VERSION_TIMEOUT_MS = 5000, V1_FLOOR = "1.3.4";
+var init_host = __esm(() => {
+  init_paths2();
+});
+
 // node_modules/zod/v4/core/util.js
 function getEnumValues(entries) {
   const numericValues = Object.values(entries).filter((v) => typeof v === "number");
@@ -3656,9 +3978,12 @@ function config(newConfig) {
     Object.assign(globalConfig, newConfig);
   return globalConfig;
 }
-var _a, _zodDesc, _E, $ZodAsyncError, $ZodEncodeError, globalConfig;
+var _a, NEVER, _zodDesc, _E, $ZodAsyncError, $ZodEncodeError, globalConfig;
 var init_core = __esm(() => {
   init_util2();
+  NEVER = /* @__PURE__ */ Object.freeze({
+    status: "aborted"
+  });
   _zodDesc = { value: undefined, enumerable: false };
   _E = "captureStackTrace" in Error ? Error : null;
   $ZodAsyncError = class $ZodAsyncError extends Error {
@@ -9260,6 +9585,7 @@ var init_coerce = __esm(() => {
 
 // node_modules/zod/v4/classic/external.js
 var init_external = __esm(() => {
+  init_core2();
   init_core2();
   init_locales();
   init_iso();
@@ -9282,7 +9608,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@macintacos/caret",
-    version: "1.1.1",
+    version: "1.2.0",
     license: "MIT",
     type: "module",
     description: "A Claude Code plugin that replaces the terminal plan-approval prompt with a local web UI for inline review, annotation, and approval.",
@@ -9333,6 +9659,7 @@ var init_package = __esm(() => {
       "@laststance/tailwind-suggest-canonical-classes": "^0.1.1",
       "@lezer/highlight": "^1.2.3",
       "@modelcontextprotocol/sdk": "^1.30.0",
+      "@opencode/plugin": "^2.0.18",
       "@pierre/diffs": "1.3.6",
       "@pierre/trees": "1.0.0-beta.6",
       "@playwright/test": "^1.62.1",
@@ -9445,7 +9772,7 @@ var init_upstream = __esm(() => {
 
 // src/adapters/opencode/upgrade.ts
 import { existsSync as existsSync3, rmSync } from "fs";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 function upgradeVerdict(input) {
   const { entry, cached, published } = input;
   if (published === null) {
@@ -9504,25 +9831,34 @@ function upgradeCheck(verdict) {
   }
 }
 async function readUpgradeVerdict(deps) {
-  const entry = readCaretEntry(deps.configFile);
+  const entry = readCaretEntry(deps.configFiles);
+  const cacheDir = deps.cacheDir ?? ((e) => caretCacheDir(e, deps.host));
   return upgradeVerdict({
-    entry,
-    cached: readEntryCachedVersion(entry, deps.cacheDir),
+    entry: entry?.spec ?? null,
+    cached: readEntryCachedVersion(entry, cacheDir),
     published: await (deps.published ?? publishedCaretVersion)()
   });
 }
-function hasCaretPluginEntry(configFile) {
-  return readCaretEntry(configFile) !== null;
+function caretCacheDir(entry, host) {
+  if (entry.key === "plugin" && !isV2Host(host ?? null)) {
+    return opencodeCachePackageDir(entry.spec);
+  }
+  if (isLocalPluginSpecifier(entry.spec)) {
+    return liveGenerationDir(opencodeNpmLocalCacheDir(entry.spec));
+  }
+  const { pkg, version } = splitPluginSpecifier(entry.spec);
+  return liveGenerationDir(opencodeNpmCacheDir(pkg, version));
 }
-function readEntryCachedVersion(entry, cacheDir = opencodeCachePackageDir) {
-  return entry === null ? null : readCachedCaretVersion(cacheDir(entry));
+function readEntryCachedVersion(entry, cacheDir = caretCacheDir) {
+  const dir = entry === null ? null : cacheDir(entry);
+  return dir === null ? null : readCachedCaretVersion(dir);
 }
 function readCachedCaretVersion(dir) {
-  const installed = readJsonFileSync(join7(dir, "node_modules", CARET_PACKAGE, "package.json"));
+  const installed = readJsonFileSync(join8(dir, "node_modules", CARET_PACKAGE, "package.json"));
   if (typeof installed?.version === "string" && installed.version.length > 0) {
     return installed.version;
   }
-  const shim = readJsonFileSync(join7(dir, "package.json"));
+  const shim = readJsonFileSync(join8(dir, "package.json"));
   const requested = shim?.dependencies?.[CARET_PACKAGE];
   return typeof requested === "string" && requested.length > 0 ? requested : null;
 }
@@ -9539,6 +9875,7 @@ function clearCachedCaret(dirs = existingOpencodeCachePackageDirs()) {
 var init_upgrade = __esm(() => {
   init_config_plugin();
   init_entries();
+  init_host();
   init_paths2();
   init_json_file();
   init_upstream();
@@ -9546,7 +9883,7 @@ var init_upgrade = __esm(() => {
 
 // src/adapters/opencode/install.ts
 import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 function readOpencodeInstallState() {
   const dir = opencodeConfigDir();
   if (!existsSync4(dir)) {
@@ -9554,12 +9891,12 @@ function readOpencodeInstallState() {
   }
   let entry;
   try {
-    entry = readLoadedCaretEntry(resolveConfigFile(dir));
+    entry = readLoadedCaretEntry(existingConfigFiles(dir));
   } catch {
     return {
       pluginVersion: "unknown",
       pluginEnabled: "unknown",
-      hookInUserSettings: readCaretInPluginArray(dir)
+      hookInUserSettings: readCaretInPluginLists(dir)
     };
   }
   const cached = readEntryCachedVersion(entry);
@@ -9567,13 +9904,13 @@ function readOpencodeInstallState() {
   return {
     pluginVersion: version,
     pluginEnabled: version !== "unknown",
-    hookInUserSettings: readCaretInPluginArray(dir)
+    hookInUserSettings: readCaretInPluginLists(dir)
   };
 }
-function readCaretInPluginArray(dir) {
+function readCaretInPluginLists(dir) {
   let sawConfig = false;
   for (const name of CONFIG_FILENAMES) {
-    const path = join8(dir, name);
+    const path = join9(dir, name);
     if (!existsSync4(path))
       continue;
     let text;
@@ -9851,6 +10188,9 @@ function daemonStderrLogFile() {
 function daemonLock() {
   return `${stateDir()}/daemon.lock`;
 }
+function daemonTokenFile() {
+  return `${stateDir()}/daemon.token`;
+}
 function daemonBootMarker() {
   return `${stateDir()}/daemon.boot`;
 }
@@ -9880,7 +10220,7 @@ var init_paths3 = () => {};
 
 // src/ui/assets.ts
 import { readdirSync as readdirSync2 } from "fs";
-import { dirname as dirname2, join as join9, relative } from "path";
+import { dirname as dirname2, join as join10, relative } from "path";
 import { fileURLToPath } from "url";
 function fromPathMap(map) {
   const paths = Object.keys(map).sort();
@@ -9896,7 +10236,7 @@ function walkDist(distDir) {
   const found = [];
   const walk = (dir) => {
     for (const ent of readdirSync2(dir, { withFileTypes: true })) {
-      const full = join9(dir, ent.name);
+      const full = join10(dir, ent.name);
       if (ent.isDirectory())
         walk(full);
       else if (ent.isFile())
@@ -9934,7 +10274,7 @@ async function loadUiAssets() {
     if (fromDist)
       return fromDist;
   }
-  const besideDist = join9(dirname2(process.execPath), "ui");
+  const besideDist = join10(dirname2(process.execPath), "ui");
   return assetsFromDist(besideDist);
 }
 var init_assets = () => {};
@@ -14434,18 +14774,18 @@ import {
   openSync,
   readdirSync as readdirSync3,
   readFileSync as readFileSync5,
-  statSync,
+  statSync as statSync2,
   truncateSync,
   unlinkSync,
   writeFileSync
 } from "fs";
-import { basename as basename2 } from "path";
+import { basename as basename4 } from "path";
 function stamp() {
   return new Date().toISOString().replace(/[-:.]/g, "");
 }
 function sizeOf(path) {
   try {
-    return statSync(path).size;
+    return statSync2(path).size;
   } catch {
     return -1;
   }
@@ -14457,7 +14797,7 @@ function claimLock(lock) {
   } catch (e) {
     if (e.code !== "EEXIST")
       return false;
-    if (Date.now() - statSync(lock).mtimeMs >= STALE_LOCK_MS)
+    if (Date.now() - statSync2(lock).mtimeMs >= STALE_LOCK_MS)
       unlinkSync(lock);
     return false;
   }
@@ -14476,7 +14816,7 @@ function rotateIfOversized(path, maxSize, keep) {
   try {
     if (sizeOf(path) <= maxSize)
       return;
-    const name = basename2(path, ".log");
+    const name = basename4(path, ".log");
     const lock = `${logsDir()}/.rotate-${name}.lock`;
     if (!claimLock(lock))
       return;
@@ -14569,7 +14909,7 @@ function shortId(id) {
 }
 var CENSOR = "<redacted>", DENY_KEYS, MAX_DEPTH = 6;
 var init_core3 = __esm(() => {
-  DENY_KEYS = new Set(["plan", "prompt", "feedback"]);
+  DENY_KEYS = new Set(["plan", "prompt", "feedback", "hostnames"]);
 });
 
 // src/redact/node.ts
@@ -14769,9 +15109,11 @@ var init_log = __esm(() => {
 });
 
 // src/config/settings.ts
-import { readFileSync as readFileSync7, statSync as statSync2 } from "fs";
+import { readFileSync as readFileSync7, statSync as statSync3 } from "fs";
+import { isIP } from "net";
 function freeze(s) {
   Object.freeze(s.logging);
+  Object.freeze(s.daemon.hostnames);
   Object.freeze(s.daemon);
   Object.freeze(s.review);
   Object.freeze(s.opencode);
@@ -14807,7 +15149,7 @@ function loadSettings(file = configFile(), isCompiled = isCompiledBinary()) {
   } catch {
     return DEFAULTS;
   }
-  return parseAndValidate(text, isCompiled) ?? DEFAULTS;
+  return parseAndValidate(text, isCompiled) ?? FAIL_CLOSED_DEFAULTS;
 }
 function createSettings(file = configFile(), isCompiled = isCompiledBinary()) {
   let lastGood = DEFAULTS;
@@ -14816,7 +15158,7 @@ function createSettings(file = configFile(), isCompiled = isCompiledBinary()) {
     current() {
       let st;
       try {
-        st = statSync2(file);
+        st = statSync3(file);
       } catch {
         return lastGood;
       }
@@ -14833,6 +15175,8 @@ function createSettings(file = configFile(), isCompiled = isCompiledBinary()) {
       lastSig = { mtimeMs: st.mtimeMs, size: st.size };
       if (next !== null)
         lastGood = next;
+      else if (lastGood === DEFAULTS)
+        lastGood = FAIL_CLOSED_DEFAULTS;
       return lastGood;
     }
   };
@@ -14842,15 +15186,24 @@ function diffSettings(prev, next) {
   for (const table of SETTINGS_TABLES) {
     const prevTable = prev[table];
     const nextTable = next[table];
-    for (const key of Object.keys(nextTable)) {
+    const keys = new Set([...Object.keys(prevTable), ...Object.keys(nextTable)]);
+    for (const key of keys) {
       const before = prevTable[key];
       const after = nextTable[key];
-      if (before !== after)
-        changes.push(`${table}.${key}: ${before} \u2192 ${after}`);
+      const [beforeJson, afterJson] = [JSON.stringify(before), JSON.stringify(after)];
+      if (beforeJson === afterJson)
+        continue;
+      if (DENY_KEYS.has(key))
+        changes.push(`${table}.${key}: changed`);
+      else
+        changes.push(`${table}.${key}: ${shown(before, beforeJson)} \u2192 ${shown(after, afterJson)}`);
     }
   }
   return changes;
 }
+function shown(value, json) {
+  return typeof value === "object" && value !== null ? String(json) : String(value);
+}
 function watchSettings(inner, onChange) {
   let prev = null;
   return {
@@ -14918,7 +15271,7 @@ function logMaxSize(s = settings().current()) {
 function logKeep(s = settings().current()) {
   return envValue("CARET_LOG_KEEP", LogKeep) ?? s.logging.keep;
 }
-var Port, TimeoutS, IdleMs, HeartbeatMs, LogMaxSize, LogKeep, DevIntervalMs, Dev, SettingsSchema, DEFAULTS, SETTINGS_TABLES, singleton, ENV_VARS, envCache;
+var Port, TimeoutS, IdleMs, HeartbeatMs, LogMaxSize, LogKeep, Host, Hostname, DevIntervalMs, Dev, SettingsSchema, DEFAULTS, FAIL_CLOSED_DEFAULTS, SETTINGS_TABLES, singleton, ENV_VARS, envCache;
 var init_settings = __esm(() => {
   init_dist();
   init_zod();
@@ -14926,12 +15279,23 @@ var init_settings = __esm(() => {
   init_paths3();
   init_build_id();
   init_log();
+  init_core3();
   Port = number2().int().positive();
   TimeoutS = number2().positive().lt(HOOK_TIMEOUT_S);
   IdleMs = number2().int().nonnegative();
   HeartbeatMs = number2().int().positive().lt(MAX_HEARTBEAT_MS);
   LogMaxSize = number2().int().min(MIN_LOG_MAX_SIZE).max(MAX_LOG_MAX_SIZE);
   LogKeep = number2().int().nonnegative();
+  Host = string2().refine((h) => h === "localhost" || isIP(h) !== 0 && !h.includes("%"), "an IP address or localhost").transform((h) => h === "localhost" ? "127.0.0.1" : h);
+  Hostname = string2().transform((raw, ctx) => {
+    const lower = raw.toLowerCase();
+    try {
+      if (lower !== "" && new URL(`http://${raw}`).hostname === lower)
+        return lower;
+    } catch {}
+    ctx.addIssue({ code: "custom", message: "a bare hostname or IP address" });
+    return NEVER;
+  });
   DevIntervalMs = number2().int().positive();
   Dev = object({
     port: Port.optional(),
@@ -14952,7 +15316,10 @@ var init_settings = __esm(() => {
     daemon: object({
       port: Port.default(DEFAULT_PORT),
       idle_ms: IdleMs.default(60000),
-      heartbeat_ms: HeartbeatMs.default(8000)
+      heartbeat_ms: HeartbeatMs.default(8000),
+      host: Host.default("127.0.0.1"),
+      hostnames: array(Hostname).default([]),
+      auth: _enum(["token", "none"]).optional()
     }).prefault({}),
     review: object({
       timeout_s: TimeoutS.default(3600)
@@ -14966,6 +15333,10 @@ var init_settings = __esm(() => {
     dev: Dev
   });
   DEFAULTS = freeze(SettingsSchema.parse({}));
+  FAIL_CLOSED_DEFAULTS = freeze({
+    ...DEFAULTS,
+    daemon: { ...DEFAULTS.daemon, auth: "token" }
+  });
   SETTINGS_TABLES = ["logging", "daemon", "review", "updates"];
   ENV_VARS = [
     ["CARET_PORT", Port],
@@ -14994,21 +15365,170 @@ var init_boot = __esm(() => {
   init_log();
 });
 
+// src/daemon/address.ts
+function isExposed(host) {
+  return !(host === "localhost" || host === "::1" || /^127\.\d+\.\d+\.\d+$/.test(host));
+}
+function authEnabled(daemon) {
+  return daemon.auth === undefined ? isExposed(daemon.host) : daemon.auth === "token";
+}
+function connectHostname(host) {
+  if (host === "0.0.0.0")
+    return "127.0.0.1";
+  if (host === "::")
+    return "[::1]";
+  return new URL(`http://${host.includes(":") ? `[${host}]` : host}`).hostname;
+}
+function baseUrlFor(host, port) {
+  return `http://${connectHostname(host)}:${port}`;
+}
+function daemonBaseUrl(s) {
+  return baseUrlFor(s.daemon.host, getPort(s));
+}
+function localHostname(host) {
+  const name = connectHostname(host);
+  return name === "127.0.0.1" || name === "localhost" ? VANITY_HOST : name;
+}
+function publicHostname(daemon) {
+  return daemon.hostnames[0] ?? localHostname(daemon.host);
+}
+function publicUrl(daemon, port) {
+  return `http://${publicHostname(daemon)}:${port}`;
+}
+function loginLink(url, token) {
+  const u = new URL(url);
+  u.searchParams.set("token", token);
+  return u.href;
+}
+var init_address = __esm(() => {
+  init_constants();
+  init_settings();
+});
+
+// src/daemon/auth.ts
+import { timingSafeEqual } from "crypto";
+function authCookieName(port) {
+  return `caret-auth-${port}`;
+}
+function matches(candidate, token) {
+  if (!candidate)
+    return false;
+  const a = Buffer.from(candidate);
+  const b = Buffer.from(token);
+  return a.length === b.length && timingSafeEqual(a, b);
+}
+function bearerToken(req) {
+  const header = req.headers.get("authorization");
+  return header?.startsWith("Bearer ") ? header.slice(7) : null;
+}
+function reject(url, extra) {
+  const headers = new Headers(extra);
+  headers.set("WWW-Authenticate", AUTH_CHALLENGE);
+  if (url.pathname.startsWith("/api/")) {
+    return Response.json({ error: "caret daemon token required" }, { status: 401, headers });
+  }
+  headers.set("Content-Type", "text/html; charset=utf-8");
+  return new Response(REJECTION_PAGE, { status: 401, headers });
+}
+function login(url, presented, auth) {
+  const noReferrer = { "Referrer-Policy": "no-referrer" };
+  if (!matches(presented, auth.token))
+    return reject(url, noReferrer);
+  const params = new URLSearchParams(url.search);
+  params.delete("token");
+  const query = params.size > 0 ? `?${params}` : "";
+  const location = `/${url.pathname.replace(/^\/+/, "")}${query}`;
+  const cookie = new Bun.Cookie(authCookieName(auth.port), auth.token, {
+    httpOnly: true,
+    sameSite: "lax",
+    secure: auth.secure,
+    path: "/",
+    maxAge: COOKIE_MAX_AGE_S
+  });
+  return new Response(null, {
+    status: 303,
+    headers: { ...noReferrer, Location: location, "Set-Cookie": cookie.serialize() }
+  });
+}
+function authGate(req, url, auth) {
+  const presented = url.searchParams.get("token");
+  if (req.method === "GET" && presented !== null)
+    return login(url, presented, auth);
+  const cookieToken = new Bun.CookieMap(req.headers.get("cookie") ?? "").get(authCookieName(auth.port));
+  if (matches(bearerToken(req), auth.token) || matches(cookieToken, auth.token))
+    return null;
+  return reject(url);
+}
+var COOKIE_MAX_AGE_S = 34560000, REJECTION_PAGE, AUTH_CHALLENGE = 'Bearer realm="caret"';
+var init_auth = __esm(() => {
+  REJECTION_PAGE = "<!doctype html><title>caret</title><p>This caret daemon requires sign-in. " + "Open caret's login link to continue.</p>";
+});
+
+// src/daemon/token.ts
+import { randomBytes } from "crypto";
+import { linkSync, readFileSync as readFileSync8, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname5 } from "path";
+function readToken(file) {
+  try {
+    return readFileSync8(file, "utf8").trim() || null;
+  } catch {
+    return null;
+  }
+}
+function loadOrMintToken(file) {
+  const existing = readToken(file);
+  if (existing !== null)
+    return existing;
+  const token = randomBytes(32).toString("base64url");
+  ensureStateDir(dirname5(file));
+  const tmp = `${file}.${process.pid}.tmp`;
+  writeFileSync3(tmp, token, { mode: 384 });
+  try {
+    linkSync(tmp, file);
+    return token;
+  } catch (e) {
+    if (e.code !== "EEXIST")
+      throw e;
+    const winner = readToken(file);
+    if (winner === null)
+      throw new Error(`caret daemon token file ${file} exists but holds no readable token`);
+    return winner;
+  } finally {
+    rmSync2(tmp, { force: true });
+  }
+}
+var init_token = __esm(() => {
+  init_paths3();
+});
+
 // src/daemon/client.ts
+async function daemonFetch(url, init = {}) {
+  const tokenFile = daemonTokenFile();
+  const token = readToken(tokenFile);
+  const headers = new Headers(init.headers);
+  if (token !== null)
+    headers.set("Authorization", `Bearer ${token}`);
+  const res = await fetch(url, { ...init, headers });
+  if (res.status !== 401 || res.headers.get("www-authenticate") !== AUTH_CHALLENGE)
+    return res;
+  throw new DaemonAuthError(token === null ? `the daemon requires a token, but ${tokenFile} does not exist or cannot be read; restart the caret daemon to mint one, or check that XDG_STATE_HOME matches the caret service's` : `the daemon rejected the token in ${tokenFile}; check that XDG_STATE_HOME matches the caret service's`);
+}
 async function httpHealth(baseUrl) {
   try {
-    const res = await fetch(`${baseUrl}/api/health`, {
+    const res = await daemonFetch(`${baseUrl}/api/health`, {
       signal: AbortSignal.timeout(500)
     });
     if (!res.ok)
       return null;
     return await res.json();
-  } catch {
+  } catch (e) {
+    if (e instanceof DaemonAuthError)
+      throw e;
     return null;
   }
 }
 async function postReview(baseUrl, input) {
-  const res = await fetch(`${baseUrl}/api/reviews`, {
+  const res = await daemonFetch(`${baseUrl}/api/reviews`, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify(input)
@@ -15023,7 +15543,7 @@ function versionSearch(version) {
   return version === undefined ? "" : `?version=${version}`;
 }
 async function expireReview(baseUrl, id, version) {
-  const res = await fetch(`${baseUrl}/api/reviews/${id}/expire${versionSearch(version)}`, {
+  const res = await daemonFetch(`${baseUrl}/api/reviews/${id}/expire${versionSearch(version)}`, {
     method: "POST",
     signal: AbortSignal.timeout(1000)
   });
@@ -15032,7 +15552,7 @@ async function expireReview(baseUrl, id, version) {
   }
 }
 async function longPoll(baseUrl, id, version) {
-  const res = await fetch(`${baseUrl}/api/reviews/${id}/decision${versionSearch(version)}`);
+  const res = await daemonFetch(`${baseUrl}/api/reviews/${id}/decision${versionSearch(version)}`);
   if (res.status === 204)
     return null;
   if (res.status === 409)
@@ -15042,13 +15562,13 @@ async function longPoll(baseUrl, id, version) {
   return await res.json();
 }
 async function listReviews(baseUrl) {
-  const res = await fetch(`${baseUrl}/api/reviews`, { signal: AbortSignal.timeout(1000) });
+  const res = await daemonFetch(`${baseUrl}/api/reviews`, { signal: AbortSignal.timeout(1000) });
   if (!res.ok)
     throw new Error(`GET /api/reviews failed: ${res.status}`);
   return await res.json();
 }
 async function resolveReview(baseUrl, id, body) {
-  const res = await fetch(`${baseUrl}/api/reviews/${id}/resolve`, {
+  const res = await daemonFetch(`${baseUrl}/api/reviews/${id}/resolve`, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify(body),
@@ -15057,28 +15577,44 @@ async function resolveReview(baseUrl, id, body) {
   if (!res.ok)
     throw new Error(`POST /resolve failed: ${res.status}`);
 }
+var DaemonAuthError;
+var init_client = __esm(() => {
+  init_paths3();
+  init_auth();
+  init_token();
+  DaemonAuthError = class DaemonAuthError extends Error {
+  };
+});
 
 // src/daemon/lifecycle.ts
 import {
-  accessSync,
+  accessSync as accessSync2,
   chmodSync as chmodSync2,
-  constants,
+  constants as constants2,
   existsSync as existsSync7,
-  linkSync,
+  linkSync as linkSync2,
   openSync as openSync2,
-  readFileSync as readFileSync8,
+  readFileSync as readFileSync9,
   renameSync as renameSync2,
-  statSync as statSync3,
+  statSync as statSync4,
   unlinkSync as unlinkSync2,
-  writeFileSync as writeFileSync3
+  writeFileSync as writeFileSync4
 } from "fs";
-import { join as join10, normalize } from "path";
+import { createServer as createNetServer } from "net";
+import { join as join11, normalize } from "path";
 function isAddrInUse(e) {
   if (e && typeof e === "object" && "code" in e) {
     return e.code === "EADDRINUSE";
   }
   return e instanceof Error && /EADDRINUSE/.test(e.message);
 }
+function isAddrNotAvail(host) {
+  return new Promise((resolve) => {
+    const probe = createNetServer();
+    probe.once("error", (e) => resolve(e.code === "EADDRNOTAVAIL"));
+    probe.listen({ host, port: 0 }, () => probe.close(() => resolve(false)));
+  });
+}
 function sameWorldPath(a, b) {
   return normalize(a) === normalize(b);
 }
@@ -15089,7 +15625,7 @@ async function ensureDaemon(deps, mode = "takeover") {
   const { timing } = deps;
   const windowEnd = timing.now() + timing.windowMs;
   const deadline = windowEnd + timing.reserveMs;
-  let windowSpent = mode === "successor" ? await awaitDrained(deps, windowEnd) : false;
+  let windowSpent = mode === "successor" ? await awaitDrained(deps, windowEnd) : mode === "takeover" && await moveStray(deps, windowEnd);
   let supervised;
   let spawnedPid;
   let waitingOn;
@@ -15110,7 +15646,7 @@ async function ensureDaemon(deps, mode = "takeover") {
         if (deps.pinned || isNewer(h.version ?? "", deps.currentVersion))
           return deps.baseUrl;
         windowSpent = true;
-        if (await restartService(deps.service, h)) {
+        if (await restartService(deps.service, h, "stale daemon build")) {
           await awaitSuccessor(deps, { prev: h, step: "service", until: windowEnd });
         }
         continue;
@@ -15125,6 +15661,11 @@ async function ensureDaemon(deps, mode = "takeover") {
     if (h && h.service !== "caret") {
       throw new Error(`port is held by a non-caret process \u2014 set CARET_PORT to a free port`);
     }
+    if (mode !== "takeover") {
+      const stray = await strayDaemon(deps.readLock(), deps.baseUrl, deps.health);
+      if (stray)
+        return stray.url;
+    }
     if (!windowSpent && deps.service) {
       supervised ??= await supervisorExpected(deps.service);
       if (supervised) {
@@ -15206,9 +15747,9 @@ async function awaitSuccessor(deps, { prev, step, until }) {
   logWarn(step, "no daemon took the port in time", { instanceId: prev?.instanceId });
   return false;
 }
-async function restartService(service, stale) {
+async function restartService(service, stale, reason) {
   const ctx = { instanceId: stale.instanceId, build: stale.build };
-  logInfo("service", "restarting service: stale daemon build", ctx);
+  logInfo("service", `restarting service: ${reason}`, ctx);
   try {
     await service.restart();
     return true;
@@ -15217,27 +15758,74 @@ async function restartService(service, stale) {
     return false;
   }
 }
+async function strayDaemon(lock, baseUrl, health) {
+  if (typeof lock?.host !== "string" || lock.instanceId === undefined)
+    return null;
+  let lockUrl;
+  try {
+    lockUrl = baseUrlFor(lock.host, lock.port);
+  } catch {
+    return null;
+  }
+  if (lockUrl === baseUrl)
+    return null;
+  const h = await health(lockUrl);
+  if (h?.service !== "caret" || h.instanceId !== lock.instanceId)
+    return null;
+  if ((await health(baseUrl))?.instanceId === lock.instanceId)
+    return null;
+  return { url: lockUrl, health: h };
+}
+async function moveStray(deps, windowEnd) {
+  const lock = deps.readLock();
+  const stray = await strayDaemon(lock, deps.baseUrl, deps.health);
+  if (!stray)
+    return false;
+  if (deps.service && (stray.health.supervised ?? stray.health.resident) === true) {
+    if (await restartService(deps.service, stray.health, "daemon on a stale address")) {
+      await awaitSuccessor(deps, { prev: null, step: "service", until: windowEnd });
+    }
+    return true;
+  }
+  const ctx = { instanceId: stray.health.instanceId };
+  if (await deps.retire(stray.url, lock)) {
+    logInfo("retire", "daemon on a stale address retiring", ctx);
+  } else {
+    logWarn("retire", "daemon on a stale address not retired", ctx);
+  }
+  return false;
+}
 async function supervisorExpected(service) {
   const status = await service.status().catch(() => null);
   return status?.keepsAlive === true;
 }
 async function vacatePort(deps) {
+  try {
+    return await vacate(deps);
+  } catch (e) {
+    if (e instanceof DaemonAuthError)
+      return e.message;
+    throw e;
+  }
+}
+async function vacate(deps) {
   const deadline = deps.now() + deps.deadlineMs;
   let retired;
+  const url = (await strayDaemon(deps.readLock(), deps.baseUrl, deps.health))?.url ?? deps.baseUrl;
   for (;; ) {
-    const h = await deps.health(deps.baseUrl);
+    const h = await deps.health(url);
     if (h?.service !== "caret")
       return null;
     if (isForeignWorld(h, deps.currentStateDir))
       return FOREIGN_WORLD_ERROR;
     if ((h.supervised ?? h.resident) === true) {
-      return "caret's service already serves the review UI on this port \u2014 run `caret install` and answer \"I'll run it myself\" to serve it from a terminal instead";
+      return "caret's service already serves the review UI \u2014 run `caret install` and answer \"I'll run it myself\" to serve it from a terminal instead";
     }
     if (deps.now() >= deadline)
-      return "the caret daemon on this port did not stop in time";
+      return "the caret daemon did not stop in time";
     if (h.instanceId === undefined || h.instanceId !== retired) {
-      if (!await deps.retire(deps.baseUrl)) {
-        return "the caret daemon on this port could not be asked to stop";
+      if (!await deps.retire(url)) {
+        return "the caret daemon could not be asked to stop";
       }
       retired = h.instanceId;
     }
@@ -15260,7 +15848,7 @@ function fileBootMarker() {
   const write = (marker, place) => {
     const path = daemonBootMarker();
     const tmp = `${path}.${process.pid}.tmp`;
-    writeFileSync3(tmp, JSON.stringify(marker), { mode: 384 });
+    writeFileSync4(tmp, JSON.stringify(marker), { mode: 384 });
     try {
       place(tmp, path);
     } finally {
@@ -15271,7 +15859,7 @@ function fileBootMarker() {
     claim: (marker) => {
       try {
         ensureStateDir();
-        write(marker, linkSync);
+        write(marker, linkSync2);
         return true;
       } catch (e) {
         return e.code !== "EEXIST";
@@ -15312,13 +15900,16 @@ function removeOwnDaemonLock() {
 }
 async function retireDaemon(baseUrl, lock, currentStateDir, kill = (pid, sig) => process.kill(pid, sig)) {
   try {
-    const res = await fetch(`${baseUrl}/api/retire`, {
+    const res = await daemonFetch(`${baseUrl}/api/retire`, {
       method: "POST",
       signal: AbortSignal.timeout(1000)
     });
     if (res.ok)
       return true;
-  } catch {}
+  } catch (e) {
+    if (e instanceof DaemonAuthError)
+      throw e;
+  }
   const sameWorld = lock?.stateDir === undefined || sameWorldPath(lock.stateDir, currentStateDir);
   if (lock && sameWorld && isPidAlive(lock.pid)) {
     try {
@@ -15372,7 +15963,7 @@ function isLauncherPinned() {
 }
 function readPinnedRoot() {
   try {
-    const text = readFileSync8(launcherPinnedRootFile(), "utf8");
+    const text = readFileSync9(launcherPinnedRootFile(), "utf8");
     const nl = text.indexOf(`
 `);
     if (nl < 0)
@@ -15384,12 +15975,12 @@ function readPinnedRoot() {
 }
 function isRunnableRoot(root) {
   try {
-    accessSync(join10(root, "bin", "caret"), constants.X_OK);
+    accessSync2(join11(root, "bin", "caret"), constants2.X_OK);
     try {
-      accessSync(join10(root, "bin", "caret-native"), constants.X_OK);
+      accessSync2(join11(root, "bin", "caret-native"), constants2.X_OK);
       return true;
     } catch {
-      return statSync3(join10(root, "ui", "dist", "index.html")).isFile();
+      return statSync4(join11(root, "ui", "dist", "index.html")).isFile();
     }
   } catch {
     return false;
@@ -15400,7 +15991,7 @@ async function prodEnsureDeps(s, service, reserveMs) {
   return {
     service: existsSync7(launcherServiceFile()) ? service() : undefined,
     pinned: isLauncherPinned(),
-    baseUrl: `http://localhost:${getPort(s)}`,
+    baseUrl: daemonBaseUrl(s),
     currentBuild: await currentBuildId(),
     currentVersion: VERSION,
     currentStateDir: world,
@@ -15425,6 +16016,8 @@ var BOOT_MARKER_TTL_MS = 30000, FOREIGN_WORLD_ERROR = "port serves a different c
 var init_lifecycle = __esm(() => {
   init_paths3();
   init_settings();
+  init_address();
+  init_client();
   init_build_id();
   init_json_file();
   init_log();
@@ -16816,7 +17409,7 @@ __export(exports_dist, {
 import { styleText as styleText2, stripVTControlCharacters } from "util";
 import process$1 from "process";
 import { existsSync as existsSync11, lstatSync, readdirSync as readdirSync4 } from "fs";
-import { dirname as dirname8, join as join16 } from "path";
+import { dirname as dirname9, join as join17 } from "path";
 function isUnicodeSupported() {
   if (process$1.platform !== "win32") {
     return process$1.env.TERM !== "linux";
@@ -17527,10 +18120,10 @@ ${n}
         return [];
       try {
         let i;
-        existsSync11(t) ? lstatSync(t).isDirectory() && (!e.directory || t.endsWith("/")) ? i = t : i = dirname8(t) : i = dirname8(t);
+        existsSync11(t) ? lstatSync(t).isDirectory() && (!e.directory || t.endsWith("/")) ? i = t : i = dirname9(t) : i = dirname9(t);
         const c = t.length > 1 && t.endsWith("/") ? t.slice(0, -1) : t;
         return readdirSync4(i).map((r) => {
-          const n = join16(i, r), m = lstatSync(n);
+          const n = join17(i, r), m = lstatSync(n);
           return {
             name: r,
             path: n,
@@ -33764,7 +34357,7 @@ init_dist();
 init_paths3();
 import { mkdir, readFile as readFile3, stat as stat2 } from "fs/promises";
 import { dirname as dirname4 } from "path";
-import { isDeepStrictEqual } from "util";
+import { isDeepStrictEqual as isDeepStrictEqual2 } from "util";
 
 // src/lib/atomic-write.ts
 import { realpath as realpath2, rename, rm, writeFile } from "fs/promises";
@@ -33858,7 +34451,7 @@ function withUpdatesCheck(text, check) {
     return null;
   if (after.updates?.check !== check)
     return null;
-  if (!isDeepStrictEqual(withoutUpdatesCheck(before), withoutUpdatesCheck(after)))
+  if (!isDeepStrictEqual2(withoutUpdatesCheck(before), withoutUpdatesCheck(after)))
     return null;
   return next;
 }
@@ -33933,6 +34526,7 @@ function optedOut(text) {
 
 // src/commands/daemon.ts
 init_settings();
+init_address();
 
 // src/daemon/update-changes.ts
 var COMMIT_CAP = 50;
@@ -34056,14 +34650,17 @@ function buildDiagnostics(deps) {
 init_lifecycle();
 
 // src/daemon/server.ts
-import { renameSync as renameSync4, unlinkSync as unlinkSync3, writeFileSync as writeFileSync6 } from "fs";
-import { dirname as dirname6 } from "path";
+import { renameSync as renameSync4, unlinkSync as unlinkSync3, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname7 } from "path";
 init_constants();
 init_paths3();
 init_settings();
+init_address();
+init_auth();
 
 // src/daemon/guards.ts
 init_constants();
+init_address();
 var LIVE_CLIENT_WINDOW_MS = 120000;
 function isClientLive(lastPollAt, now, windowMs) {
   return lastPollAt !== 0 && now - lastPollAt < windowMs;
@@ -34071,38 +34668,53 @@ function isClientLive(lastPollAt, now, windowMs) {
 function isSafeMethod(method) {
   return method === "GET" || method === "HEAD";
 }
-var OWN_HOSTNAMES = new Set(["127.0.0.1", "localhost", VANITY_HOST]);
-function isOwnAuthority(authority, port) {
+var BUILT_IN_NAMES = ["127.0.0.1", "localhost", VANITY_HOST];
+var LOOPBACK_NAMES = ownNames("127.0.0.1", []);
+function ownNames(connectHostname, hostnames) {
+  const anyPortSafe = (h) => !BUILT_IN_NAMES.includes(h) && isExposed(h.replace(/^\[(.*)\]$/, "$1"));
+  return {
+    exact: new Set([...BUILT_IN_NAMES, connectHostname]),
+    anyPort: new Set(hostnames.filter(anyPortSafe))
+  };
+}
+function isOwnAuthority(authority, port, names) {
   try {
     const u = new URL(`http://${authority}`);
     if (u.href !== `http://${u.host}/`)
       return false;
-    return OWN_HOSTNAMES.has(u.hostname) && (u.port || "80") === String(port);
+    if (names.anyPort.has(u.hostname))
+      return true;
+    return names.exact.has(u.hostname) && (u.port || "80") === String(port);
   } catch {
     return false;
   }
 }
-function isForeignHost(req, port) {
+function isForeignHost(req, port, names = LOOPBACK_NAMES) {
   const host = req.headers.get("host");
-  return host === null || !isOwnAuthority(host, port);
+  return host === null || !isOwnAuthority(host, port, names);
 }
-function isOwnOrigin(origin, port) {
+function isOwnOrigin(origin, port, names) {
   try {
     const u = new URL(origin);
-    return u.protocol === "http:" && isOwnAuthority(u.host, port);
+    if (u.protocol === "https:")
+      return names.anyPort.has(u.hostname);
+    return u.protocol === "http:" && isOwnAuthority(u.host, port, names);
   } catch {
     return false;
   }
 }
-function isCrossOrigin(req, port) {
+function isCrossOrigin(req, port, names = LOOPBACK_NAMES) {
   const origin = req.headers.get("origin");
-  if (origin && !isOwnOrigin(origin, port))
+  if (origin && !isOwnOrigin(origin, port, names))
     return true;
   const site = req.headers.get("sec-fetch-site");
   if (site && site !== "same-origin" && site !== "none")
     return true;
   return false;
 }
+function isForwardedHttps(req, bindHost) {
+  return !isExposed(bindHost) && req.headers.get("x-forwarded-proto") === "https";
+}
 
 // src/daemon/liveness.ts
 function createLiveness(deps) {
@@ -34271,6 +34883,7 @@ async function parseBody(req, schema) {
 }
 
 // src/daemon/server.ts
+init_token();
 init_build_id();
 
 // src/lib/cmux.ts
@@ -34304,13 +34917,13 @@ init_log();
 
 // src/plan/directory.ts
 import { readdir as readdir4 } from "fs/promises";
-import { join as join12, relative as relative3, sep as sep4 } from "path";
+import { join as join13, relative as relative3, sep as sep4 } from "path";
 
 // src/plan/excerpt.ts
 init_constants();
-import { readFileSync as readFileSync9 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
 import { readdir as readdir3, realpath as realpath3, stat as stat3 } from "fs/promises";
-import { extname, isAbsolute, join as join11, relative as relative2, resolve, sep as sep3 } from "path";
+import { extname, isAbsolute as isAbsolute2, join as join12, relative as relative2, resolve, sep as sep3 } from "path";
 var EXCERPT_HEAD_LINES = 60;
 var MAX_EXCERPT_BYTES = 10 * 1024 * 1024;
 var MAX_SCAN_ENTRIES = 5000;
@@ -34401,16 +35014,16 @@ async function basenameSearch(cwdReal, name) {
         return null;
       if (entry.isFile()) {
         if (entry.name === name)
-          return join11(currentDir, entry.name);
+          return join12(currentDir, entry.name);
       } else if (entry.isDirectory() && !SKIP_DIRS.has(entry.name) && !entry.name.startsWith(".")) {
-        queue.push(join11(currentDir, entry.name));
+        queue.push(join12(currentDir, entry.name));
       }
     }
   }
   return null;
 }
 async function resolveInCwd(cwd, candidate) {
-  if (cwd === "" || !isAbsolute(cwd))
+  if (cwd === "" || !isAbsolute2(cwd))
     return null;
   const cwdReal = await safeRealpath(cwd);
   if (cwdReal === null)
@@ -34450,7 +35063,7 @@ function readLines(abs, stats) {
     return memo2.lines;
   let content;
   try {
-    content = readFileSync9(abs, "utf-8");
+    content = readFileSync10(abs, "utf-8");
   } catch {
     return null;
   }
@@ -34535,7 +35148,7 @@ async function listDirectory(cwd, root, path) {
     else if (d.isSymbolicLink())
       links.push(d);
   }
-  const targets = await Promise.all(links.map((d) => resolveInCwd(cwd, join12(target.path, d.name))));
+  const targets = await Promise.all(links.map((d) => resolveInCwd(cwd, join13(target.path, d.name))));
   targets.forEach((hit, i) => {
     const link = links[i];
     if (hit !== null && link !== undefined)
@@ -34552,7 +35165,7 @@ async function listDirectory(cwd, root, path) {
 
 // src/plan/file-search.ts
 import { readdir as readdir5 } from "fs/promises";
-import { isAbsolute as isAbsolute2, join as join13 } from "path";
+import { isAbsolute as isAbsolute3, join as join14 } from "path";
 var SEARCH_BUDGET = { dirents: 20000, results: 50 };
 var MAX_SEARCH_QUERY_CHARS = 128;
 function subsequence(haystack, needle) {
@@ -34587,7 +35200,7 @@ function partition(dirents, allowance) {
   return { files, dirs, scanned, cut: false };
 }
 async function searchFiles(cwd, query, budget = SEARCH_BUDGET) {
-  if (cwd === "" || !isAbsolute2(cwd))
+  if (cwd === "" || !isAbsolute3(cwd))
     return null;
   const cwdReal = await safeRealpath(cwd);
   if (cwdReal === null)
@@ -34600,7 +35213,7 @@ async function searchFiles(cwd, query, budget = SEARCH_BUDGET) {
     const rel = queue.shift();
     let dirents;
     try {
-      dirents = await readdir5(join13(cwdReal, rel), { withFileTypes: true });
+      dirents = await readdir5(join14(cwdReal, rel), { withFileTypes: true });
     } catch {
       continue;
     }
@@ -34673,7 +35286,7 @@ function createDecisions(log = noopLogger) {
 }
 
 // src/review/threading.ts
-import { randomBytes } from "crypto";
+import { randomBytes as randomBytes2 } from "crypto";
 
 // node_modules/marked/lib/marked.esm.js
 function A() {
@@ -36055,13 +36668,13 @@ var un = x.lex;
 init_log();
 
 // src/plan/canonical-file.ts
-import { appendFileSync, existsSync as existsSync8, readFileSync as readFileSync10, statSync as statSync4, writeFileSync as writeFileSync4 } from "fs";
+import { appendFileSync, existsSync as existsSync8, readFileSync as readFileSync11, statSync as statSync5, writeFileSync as writeFileSync5 } from "fs";
 function isPlanFile(path) {
-  return path.endsWith(".md") && existsSync8(path) && statSync4(path).isFile();
+  return path.endsWith(".md") && existsSync8(path) && statSync5(path).isFile();
 }
 function readPlanFile(path) {
   try {
-    return isPlanFile(path) ? readFileSync10(path, "utf8") : undefined;
+    return isPlanFile(path) ? readFileSync11(path, "utf8") : undefined;
   } catch {
     return;
   }
@@ -36079,11 +36692,11 @@ function guardedPlanFileWrite(planFilePath, log, failMsg, write) {
 }
 function writeCanonicalPlanFile(input, canonical, log) {
   return guardedPlanFileWrite(input.planFilePath, log, "plan file canonicalize failed", (p) => {
-    if (readFileSync10(p, "utf8") !== (input.plan ?? "")) {
+    if (readFileSync11(p, "utf8") !== (input.plan ?? "")) {
       log.info("review", "plan file changed; rewrite skipped");
       return "changed";
     }
-    writeFileSync4(p, canonical);
+    writeFileSync5(p, canonical);
     return "written";
   }) ?? "skipped";
 }
@@ -36100,10 +36713,10 @@ init_log();
 // src/plan/rumdl.ts
 init_paths3();
 import { createHash as createHash2 } from "crypto";
-import { chmodSync as chmodSync3, existsSync as existsSync9, mkdirSync as mkdirSync2, renameSync as renameSync3, writeFileSync as writeFileSync5 } from "fs";
+import { chmodSync as chmodSync3, existsSync as existsSync9, mkdirSync as mkdirSync2, renameSync as renameSync3, writeFileSync as writeFileSync6 } from "fs";
 import { mkdtemp, rm as rm3 } from "fs/promises";
 import { tmpdir } from "os";
-import { dirname as dirname5, join as join14 } from "path";
+import { dirname as dirname6, join as join15 } from "path";
 var RUMDL_VERSION = "0.2.73";
 var ASSETS = {
   "darwin-arm64": {
@@ -36146,17 +36759,17 @@ async function downloadRumdl(binPath, asset, fetchImpl = fetch) {
   if (actual !== asset.sha256) {
     throw new Error(`rumdl: checksum mismatch for ${asset.url} (expected ${asset.sha256}, got ${actual})`);
   }
-  const work = await mkdtemp(join14(tmpdir(), "caret-rumdl-"));
+  const work = await mkdtemp(join15(tmpdir(), "caret-rumdl-"));
   try {
-    const archive = join14(work, "rumdl.tar.gz");
+    const archive = join15(work, "rumdl.tar.gz");
     await Bun.write(archive, bytes);
     const tar = Bun.spawn(["tar", "-xzf", archive, "-C", work], { stderr: "pipe" });
     if (await tar.exited !== 0)
       throw new Error(`rumdl: failed to extract ${asset.url}`);
-    const extracted = join14(work, "rumdl");
+    const extracted = join15(work, "rumdl");
     if (!existsSync9(extracted))
       throw new Error(`rumdl: binary not found in ${asset.url}`);
-    mkdirSync2(dirname5(binPath), { recursive: true });
+    mkdirSync2(dirname6(binPath), { recursive: true });
     const tmp = `${binPath}.${process.pid}.tmp`;
     await Bun.write(tmp, Bun.file(extracted));
     chmodSync3(tmp, 493);
@@ -36185,7 +36798,7 @@ var acquisition = { cooldownUntil: 0 };
 async function ensureRumdl(install = installPinnedRumdl, now = Date.now, state = acquisition) {
   ensureStateDir(rumdlDir());
   const config = rumdlConfig();
-  writeFileSync5(config, RUMDL_CONFIG);
+  writeFileSync6(config, RUMDL_CONFIG);
   const override = process.env.CARET_RUMDL_BIN?.trim();
   if (override && await installedVersion(override) === RUMDL_VERSION) {
     return { bin: override, config, installed: false };
@@ -36255,7 +36868,7 @@ async function formatPlanMarkdown(plan, log = noopLogger, doFormat = rumdlFormat
 
 // src/review/threading.ts
 function newReviewId() {
-  return randomBytes(8).toString("base64url");
+  return randomBytes2(8).toString("base64url");
 }
 function deriveTitle(plan) {
   const tokens = new x({ gfm: true }).blockTokens(plan.replace(/\r\n?/g, `
@@ -36441,6 +37054,9 @@ function resolveOptions(opts) {
     routePlan: opts.routePlan ?? routeIncomingPlan,
     configPath: opts.configPath ?? configFile(),
     lockPath: opts.lockPath,
+    tokenFile: opts.tokenFile,
+    hostname: opts.hostname ?? "127.0.0.1",
+    hostnames: opts.hostnames ?? [],
     buildId: opts.buildId,
     assetDigest: opts.assetDigest,
     commit: opts.commit,
@@ -36496,6 +37112,8 @@ function createServer(opts) {
   const { approveVariants, source, lockPath } = cfg;
   const { awaitDecision, resolveDecision, clearDecision, openDecisionCount, unreadDecisionCount } = createDecisions(log);
   const configWriter = createConfigWriter(configPath);
+  const token = cfg.tokenFile === undefined ? null : loadOrMintToken(cfg.tokenFile);
+  const names = ownNames(connectHostname(cfg.hostname), cfg.hostnames);
   function raceDecision(id, ms) {
     return new Promise((resolve) => {
       const t = setTimeout(() => resolve(null), ms);
@@ -36962,19 +37580,29 @@ function createServer(opts) {
     return notFound();
   }
   async function handle(req, self) {
-    const end = liveness.begin(req.method);
+    let end;
     let failureLog = log;
     try {
       const port = self.port ?? -1;
-      if (isForeignHost(req, port)) {
+      if (isForeignHost(req, port, names)) {
         return new Response("host not recognized", { status: 403 });
       }
       const url = new URL(req.url);
       const path = url.pathname;
       const method = req.method;
-      if (!isSafeMethod(method) && isCrossOrigin(req, port)) {
+      if (token !== null) {
+        const denied = authGate(req, url, {
+          token,
+          port,
+          secure: isForwardedHttps(req, cfg.hostname)
+        });
+        if (denied)
+          return denied;
+      }
+      if (!isSafeMethod(method) && isCrossOrigin(req, port, names)) {
         return new Response("cross-origin request blocked", { status: 403 });
       }
+      end = liveness.begin(method);
       const idRoute = matchIdRoute(path);
       const route = idRoute && { ...idRoute, log: log.child({ reviewId: idRoute.id }) };
       if (route)
@@ -36988,16 +37616,16 @@ function createServer(opts) {
       } catch {}
       return new Response("internal error", { status: 500 });
     } finally {
-      end();
+      end?.();
     }
   }
   const server = Bun.serve({
     port: opts.port ?? 0,
-    hostname: "127.0.0.1",
+    hostname: cfg.hostname,
     idleTimeout: deriveIdleTimeoutSec(heartbeat),
     fetch: handle
   });
-  log.info("listen", `listening on 127.0.0.1:${server.port}`, {
+  log.info("listen", `listening on ${cfg.hostname}:${server.port}`, {
     build: buildId,
     version: IDENTITY.version,
     commit,
@@ -37007,10 +37635,11 @@ function createServer(opts) {
     if (!lockPath)
       return;
     try {
-      ensureStateDir(dirname6(lockPath));
+      ensureStateDir(dirname7(lockPath));
       const lock = {
         pid: process.pid,
         port: server.port ?? 0,
+        host: cfg.hostname,
         build: buildId,
         version: IDENTITY.version,
         startedAt: Date.now(),
@@ -37018,7 +37647,7 @@ function createServer(opts) {
         instanceId
       };
       const tmp = `${lockPath}.tmp.${process.pid}`;
-      writeFileSync6(tmp, JSON.stringify(lock));
+      writeFileSync7(tmp, JSON.stringify(lock));
       renameSync4(tmp, lockPath);
     } catch {}
   }
@@ -37042,11 +37671,14 @@ function createServer(opts) {
   return { port: server.port ?? 0, stop, drain: () => liveness.drain() };
 }
 
+// src/commands/daemon.ts
+init_token();
+
 // src/daemon/update-check.ts
 init_paths3();
 init_json_file();
-import { writeFileSync as writeFileSync7 } from "fs";
-import { dirname as dirname7 } from "path";
+import { writeFileSync as writeFileSync8 } from "fs";
+import { dirname as dirname8 } from "path";
 var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
 var REFRESH_COMMAND = "bunx --no-cache @macintacos/caret@latest install --refresh";
 var REBUILD_COMMAND = "mise run build --install";
@@ -37114,8 +37746,8 @@ function fileUpdateCache(path) {
     read: () => asRecord(readJsonFileSync(path)),
     write: (entry) => {
       try {
-        ensureStateDir(dirname7(path));
-        writeFileSync7(path, JSON.stringify(entry, null, 2), { mode: 384 });
+        ensureStateDir(dirname8(path));
+        writeFileSync8(path, JSON.stringify(entry, null, 2), { mode: 384 });
       } catch {}
     }
   };
@@ -37182,7 +37814,7 @@ init_upstream();
 // src/review/store.ts
 init_paths3();
 import { readdir as readdir6, readFile as readFile5, stat as stat4 } from "fs/promises";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 init_json_file();
 init_log();
 var STALE_AFTER_MS = 7 * 24 * 60 * 60 * 1000;
@@ -37192,7 +37824,7 @@ function createStore(dir, log = noopLogger) {
   function persist(review) {
     return writes.run(review.id, async () => {
       ensureStateDir(dir);
-      await writeFileAtomic(join15(dir, `${review.id}.json`), JSON.stringify(review, null, 2), {
+      await writeFileAtomic(join16(dir, `${review.id}.json`), JSON.stringify(review, null, 2), {
         mode: 384
       });
       log.debug("store", `review persisted: ${shortId(review.id)}`, { reviewId: review.id });
@@ -37240,7 +37872,7 @@ function createStore(dir, log = noopLogger) {
       return review;
     },
     async persisted(id) {
-      return await readJsonFile(join15(dir, `${id}.json`)) ?? undefined;
+      return await readJsonFile(join16(dir, `${id}.json`)) ?? undefined;
     },
     size() {
       return reviews.size;
@@ -37273,7 +37905,7 @@ function createStore(dir, log = noopLogger) {
       for (const file of files) {
         if (!file.endsWith(".json"))
           continue;
-        const path = join15(dir, file);
+        const path = join16(dir, file);
         try {
           if ((await stat4(path)).mtimeMs < now - STALE_AFTER_MS)
             continue;
@@ -37372,6 +38004,14 @@ async function runDaemon(opts) {
   const buildId = await currentBuildId();
   const assetDigest = await buildHash(assets);
   let armedUpkeep = [];
+  const tokenFile = authEnabled(boot.daemon) ? daemonTokenFile() : undefined;
+  if (tokenFile !== undefined) {
+    try {
+      loadOrMintToken(tokenFile);
+    } catch (e) {
+      exitTerminal(`cannot use the daemon token file ${tokenFile}`, "daemon-token-unusable", e);
+    }
+  }
   try {
     server = createServer({
       store,
@@ -37381,6 +38021,9 @@ async function runDaemon(opts) {
       resident,
       assets,
       lockPath: daemonLock(),
+      tokenFile,
+      hostname: boot.daemon.host,
+      hostnames: boot.daemon.hostnames,
       buildId,
       assetDigest,
       commit: built.commit,
@@ -37412,12 +38055,12 @@ async function runDaemon(opts) {
       log
     });
   } catch (e) {
-    if (isAddrInUse(e)) {
+    if (isAddrInUse(e) && !await isAddrNotAvail(boot.daemon.host)) {
       process.stderr.write(`caret: another daemon won the port; exiting.
 `);
       process.exit(0);
     }
-    exitTerminal("cannot bind the daemon port", "daemon-bind-failed", e);
+    exitTerminal(`cannot bind the daemon to ${boot.daemon.host}:${getPort(boot)}`, "daemon-bind-failed", e);
   }
   removeOwnBootMarker();
   const onFatal = (label) => (err) => {
@@ -37437,16 +38080,43 @@ async function runDaemon(opts) {
     upkeep.push({ name: "stderr-rotate", run: () => rotateDaemonStderr(svc.current()) });
   }
   armedUpkeep = startUpkeep({ tasks: upkeep, log });
-  return server.port;
+  return { port: server.port, settings: boot };
 }
 
 // src/commands/doctor.ts
 init_adapters();
-init_paths2();
-init_upgrade();
 import { existsSync as existsSync12 } from "fs";
 import { release } from "os";
 
+// src/adapters/opencode/checks.ts
+init_entries();
+init_host();
+init_paths2();
+init_upgrade();
+async function readOpencodeChecks(deps) {
+  if (readCaretEntries(deps.configFiles, isCaretCheckout).length === 0)
+    return [];
+  const hosts = deps.opencodeHosts();
+  const v2Host = hosts.find((h) => isV2Host(h.version));
+  const loadedFiles = v2Host === undefined ? deps.configFiles : loadedConfigFiles(deps.configFiles, v2Host.version);
+  const ignored = deps.configFiles.filter((f) => !loadedFiles.includes(f) && readCaretEntries([f], isCaretCheckout).length > 0);
+  const entries = readCaretEntries(loadedFiles, isCaretCheckout);
+  const hostResult = hostCheck(hosts, [...new Set(entries.map((e) => e.key))], ignored);
+  if (entries.length === 0 || entries.every((e) => isLocalPluginSpecifier(e.spec)))
+    return [hostResult];
+  const verdict = await readUpgradeVerdict({
+    configFiles: loadedFiles,
+    host: sharedHost(hosts),
+    published: deps.published
+  });
+  return [hostResult, upgradeCheck(verdict)];
+}
+
+// src/commands/doctor.ts
+init_host();
+init_paths2();
+init_upgrade();
+
 // src/commands/install/ui.ts
 function isTerminal() {
   return process.stdin.isTTY === true && process.stdout.isTTY === true;
@@ -37530,9 +38200,9 @@ function servicePlatform(platform = process.platform) {
 
 // src/service/launchd-manager.ts
 init_log();
-import { mkdirSync as mkdirSync3, rmSync as rmSync2, writeFileSync as writeFileSync8 } from "fs";
+import { mkdirSync as mkdirSync3, rmSync as rmSync3, writeFileSync as writeFileSync9 } from "fs";
 import { homedir as homedir6 } from "os";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 
 // src/service/launchd.ts
 var EXIT_TIMEOUT_SEC = 20;
@@ -37593,10 +38263,10 @@ function commandError(tool, verb, result) {
 }
 
 // src/service/unit-file.ts
-import { readFileSync as readFileSync11 } from "fs";
+import { readFileSync as readFileSync12 } from "fs";
 function unitUnchanged(path, text) {
   try {
-    return readFileSync11(path, "utf-8") === text;
+    return readFileSync12(path, "utf-8") === text;
   } catch {
     return false;
   }
@@ -37608,14 +38278,14 @@ var RUNNING = [/^\s*state\s*=\s*running\b/m, /^\s*pid\s*=\s*\d+/m];
 var DISABLED2 = new RegExp(`"${LAUNCHD_LABEL.replace(/\./g, "\\.")}"\\s*=>\\s*(?:true|disabled)\\b`);
 var launchctlError = (action, result) => commandError("launchctl", action, result);
 function createLaunchdManager(deps = {}) {
-  const launchAgentsDir = deps.launchAgentsDir ?? join17(homedir6(), "Library", "LaunchAgents");
+  const launchAgentsDir = deps.launchAgentsDir ?? join18(homedir6(), "Library", "LaunchAgents");
   const launchctl = deps.launchctl ?? spawnLaunchctl;
   const uid = deps.uid ?? process.getuid?.();
   if (uid === undefined)
     throw new Error("caret service: launchd needs a POSIX uid");
   const domain = `gui/${uid}`;
   const target = `${domain}/${LAUNCHD_LABEL}`;
-  const plistPath = join17(launchAgentsDir, `${LAUNCHD_LABEL}.plist`);
+  const plistPath = join18(launchAgentsDir, `${LAUNCHD_LABEL}.plist`);
   async function readStatus() {
     const [printed, printDisabled] = await Promise.all([
       launchctl(["print", target]),
@@ -37644,7 +38314,7 @@ function createLaunchdManager(deps = {}) {
         }
       }
       mkdirSync3(launchAgentsDir, { recursive: true });
-      writeFileSync8(plistPath, text);
+      writeFileSync9(plistPath, text);
       await launchctl(["bootout", target]);
       const bootstrapped = await launchctl(["bootstrap", domain, plistPath]);
       if (bootstrapped.code !== 0)
@@ -37652,7 +38322,7 @@ function createLaunchdManager(deps = {}) {
     },
     async uninstall() {
       await launchctl(["bootout", target]);
-      rmSync2(plistPath, { force: true });
+      rmSync3(plistPath, { force: true });
     },
     status: readStatus,
     async restart() {
@@ -37665,9 +38335,9 @@ function createLaunchdManager(deps = {}) {
 
 // src/service/systemd-manager.ts
 init_log();
-import { mkdirSync as mkdirSync4, rmSync as rmSync3, writeFileSync as writeFileSync9 } from "fs";
+import { mkdirSync as mkdirSync4, rmSync as rmSync4, writeFileSync as writeFileSync10 } from "fs";
 import { homedir as homedir7 } from "os";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 
 // src/service/systemd.ts
 var START_LIMIT_INTERVAL_SEC = 60;
@@ -37709,10 +38379,10 @@ WantedBy=default.target
 
 // src/service/systemd-manager.ts
 function createSystemdManager(deps = {}) {
-  const configHome = process.env.XDG_CONFIG_HOME || join18(homedir7(), ".config");
-  const unitDir = deps.unitDir ?? join18(configHome, "systemd", "user");
+  const configHome = process.env.XDG_CONFIG_HOME || join19(homedir7(), ".config");
+  const unitDir = deps.unitDir ?? join19(configHome, "systemd", "user");
   const run = deps.run ?? runCommand;
-  const unitPath = join18(unitDir, SYSTEMD_UNIT);
+  const unitPath = join19(unitDir, SYSTEMD_UNIT);
   const systemctl = (...args) => run(["systemctl", "--user", ...args]);
   async function probeSystemd() {
     const shown = await systemctl("show-environment");
@@ -37771,7 +38441,7 @@ function createSystemdManager(deps = {}) {
       }
       mkdirSync4(unitDir, { recursive: true });
       try {
-        writeFileSync9(unitPath, text);
+        writeFileSync10(unitPath, text);
         const reloaded = await systemctl("daemon-reload");
         if (reloaded.code !== 0)
           throw commandError("systemctl", "daemon-reload", reloaded);
@@ -37783,14 +38453,14 @@ function createSystemdManager(deps = {}) {
         if (restarted.code !== 0)
           throw commandError("systemctl", "restart", restarted);
       } catch (err) {
-        rmSync3(unitPath, { force: true });
+        rmSync4(unitPath, { force: true });
         throw err;
       }
       await enableLinger();
     },
     async uninstall() {
       await systemctl("disable", "--now", SYSTEMD_UNIT);
-      rmSync3(unitPath, { force: true });
+      rmSync4(unitPath, { force: true });
       await systemctl("daemon-reload");
     },
     status: readStatus,
@@ -37826,34 +38496,36 @@ function prodService() {
 // src/commands/doctor.ts
 init_paths3();
 init_settings();
+init_address();
+init_client();
 init_lifecycle();
 
 // src/doctor/bundle.ts
-import { readdirSync as readdirSync5, readFileSync as readFileSync12 } from "fs";
-import { basename as basename3, join as join19 } from "path";
+import { readdirSync as readdirSync5, readFileSync as readFileSync13 } from "fs";
+import { basename as basename5, join as join20 } from "path";
 function stamp2(now) {
   return now.toISOString().replace(/[-:.]/g, "");
 }
 function bundlePath(stateDir, now) {
-  return join19(stateDir, `doctor-${stamp2(now)}.zip`);
+  return join20(stateDir, `doctor-${stamp2(now)}.zip`);
 }
 function member(path, name) {
   try {
-    return { name, data: readFileSync12(path) };
+    return { name, data: readFileSync13(path) };
   } catch {
     return null;
   }
 }
 var MAX_REVIEW_MEMBERS = 5000;
 function entriesFor(deps) {
-  const logs = deps.logPaths.map((p) => member(p, `logs/${basename3(p)}`));
+  const logs = deps.logPaths.map((p) => member(p, `logs/${basename5(p)}`));
   let reviews;
   try {
     reviews = readdirSync5(deps.reviewsDir).filter((f) => f.endsWith(".json"));
   } catch {
     reviews = [];
   }
-  const records = reviews.slice(0, MAX_REVIEW_MEMBERS).map((f) => member(join19(deps.reviewsDir, f), `reviews/${f}`));
+  const records = reviews.slice(0, MAX_REVIEW_MEMBERS).map((f) => member(join20(deps.reviewsDir, f), `reviews/${f}`));
   return [...logs, ...records].filter((e) => e !== null);
 }
 async function runBundle(opts, deps) {
@@ -37878,8 +38550,8 @@ init_paths3();
 init_json_file();
 init_log();
 init_node();
-import { readdirSync as readdirSync6, statSync as statSync5 } from "fs";
-import { basename as basename4, join as join20 } from "path";
+import { readdirSync as readdirSync6, statSync as statSync6 } from "fs";
+import { basename as basename6, join as join21 } from "path";
 var CARET_BIN = "caret-native";
 var ERROR_RECORD_FIELDS = ["time", "source", "step", "code", "reviewId", "sessionId"];
 async function safe(build) {
@@ -38161,7 +38833,7 @@ function parsePsLines(text) {
     const [, pidStr, comm] = m ?? [];
     if (pidStr === undefined || comm === undefined)
       continue;
-    const name = basename4(comm.trim());
+    const name = basename6(comm.trim());
     if (name === CARET_BIN)
       out.push({ pid: Number(pidStr), name });
   }
@@ -38191,7 +38863,7 @@ function listReviewFiles() {
       continue;
     if (out.length >= 5000)
       break;
-    const raw = readJsonFileSync(join20(dir, file));
+    const raw = readJsonFileSync(join21(dir, file));
     if (raw && typeof raw.id === "string" && typeof raw.status === "string") {
       out.push({ id: raw.id, status: raw.status });
     }
@@ -38202,7 +38874,7 @@ var TAIL_BYTES = 256 * 1024;
 async function logStats(path) {
   let size;
   try {
-    size = statSync5(path).size;
+    size = statSync6(path).size;
   } catch {
     return { path, exists: false, size: 0, errors: 0, warns: 0 };
   }
@@ -38221,7 +38893,7 @@ async function readTail(path, size) {
 async function logErrorRecords(path) {
   let size;
   try {
-    size = statSync5(path).size;
+    size = statSync6(path).size;
   } catch {
     return [];
   }
@@ -38467,7 +39139,7 @@ function runChecks(report, adapterChecks = []) {
 }
 
 // src/doctor/zip.ts
-import { closeSync as closeSync2, openSync as openSync3, rmSync as rmSync4, writeSync } from "fs";
+import { closeSync as closeSync2, openSync as openSync3, rmSync as rmSync5, writeSync } from "fs";
 import { crc32 } from "zlib";
 var LOCAL_SIG = 67324752;
 var CENTRAL_SIG = 33639248;
@@ -38565,7 +39237,7 @@ function writeZip(path, entries, now) {
     }
     put(eocd(records.length, offset - directoryStart, directoryStart));
   } catch (e) {
-    rmSync4(path, { force: true });
+    rmSync5(path, { force: true });
     throw e;
   } finally {
     closeSync2(fd);
@@ -38594,7 +39266,7 @@ function prodDoctorDeps(s) {
       reviewTimeoutMs: reviewTimeoutMs(s),
       heartbeatMs: heartbeatMs(s)
     }),
-    baseUrl: `http://localhost:${getPort(s)}`,
+    baseUrl: daemonBaseUrl(s),
     health: httpHealth,
     serviceInstalled: () => existsSync12(launcherServiceFile()),
     serviceStatus: async () => prodService().manager.status(),
@@ -38619,10 +39291,10 @@ function prodDoctorDeps(s) {
 }
 async function readAdapterChecks() {
   try {
-    const config = resolveConfigFile(opencodeConfigDir());
-    if (!hasCaretPluginEntry(config))
-      return [];
-    return [upgradeCheck(await readUpgradeVerdict({ configFile: config }))];
+    return await readOpencodeChecks({
+      configFiles: existingConfigFiles(opencodeConfigDir()),
+      opencodeHosts: readOpencodeHosts
+    });
   } catch (e) {
     return [upgradeCheck({ kind: "unknown", reason: errorMessage(e) })];
   }
@@ -38685,27 +39357,27 @@ import { resolve as resolve3 } from "path";
 
 // src/commands/install/local.ts
 import {
-  accessSync as accessSync2,
-  constants as constants2,
+  accessSync as accessSync3,
+  constants as constants3,
   existsSync as existsSync13,
   mkdirSync as mkdirSync5,
-  rmSync as rmSync5,
-  statSync as statSync6,
+  rmSync as rmSync6,
+  statSync as statSync7,
   symlinkSync,
-  writeFileSync as writeFileSync10
+  writeFileSync as writeFileSync11
 } from "fs";
-import { join as join22, resolve as resolve2 } from "path";
+import { join as join23, resolve as resolve2 } from "path";
 
 // src/adapters/opencode/packaging.ts
 init_entries();
-import { readdirSync as readdirSync7, readFileSync as readFileSync13 } from "fs";
-import { dirname as dirname9, join as join21 } from "path";
+import { readdirSync as readdirSync7, readFileSync as readFileSync14 } from "fs";
+import { dirname as dirname10, join as join22 } from "path";
 function resolveCaretRoot() {
   const candidates = [];
   const script = process.argv[1];
   if (script)
-    candidates.push(join21(dirname9(script), ".."));
-  candidates.push(join21(dirname9(process.execPath), ".."));
+    candidates.push(join22(dirname10(script), ".."));
+  candidates.push(join22(dirname10(process.execPath), ".."));
   for (const root of candidates) {
     if (isCaretCheckout(root))
       return root;
@@ -38714,12 +39386,12 @@ function resolveCaretRoot() {
 }
 var DEMO_TEMPLATE = "templates/demo.md";
 function loadOpencodePackaging(root = resolveCaretRoot()) {
-  const binPath = join21(root, "bin", "caret");
-  const demoTemplate = readFileSync13(join21(root, DEMO_TEMPLATE), "utf-8");
-  const commandsDir = join21(root, "opencode", "commands");
+  const binPath = join22(root, "bin", "caret");
+  const demoTemplate = readFileSync14(join22(root, DEMO_TEMPLATE), "utf-8");
+  const commandsDir = join22(root, "opencode", "commands");
   let commands = [];
   try {
-    commands = readdirSync7(commandsDir).filter((f) => f.endsWith(".md")).sort().map((f) => ({ name: f, contents: readFileSync13(join21(commandsDir, f), "utf-8") }));
+    commands = readdirSync7(commandsDir).filter((f) => f.endsWith(".md")).sort().map((f) => ({ name: f, contents: readFileSync14(join22(commandsDir, f), "utf-8") }));
   } catch {
     commands = [];
   }
@@ -38729,17 +39401,17 @@ function loadOpencodePackaging(root = resolveCaretRoot()) {
 // src/commands/install/local.ts
 init_paths3();
 function devMarketplaceDir() {
-  return join22(stateDir(), "dev-marketplace");
+  return join23(stateDir(), "dev-marketplace");
 }
 function resolveLocalCheckout(opts = {}, deps = {}) {
   const repoDir = resolve2(caretRoot(deps));
-  if (!existsSync13(join22(repoDir, ".claude-plugin", "marketplace.json"))) {
+  if (!existsSync13(join23(repoDir, ".claude-plugin", "marketplace.json"))) {
     throw new Error(`--from-local must run from a caret checkout (no .claude-plugin/marketplace.json at ${repoDir}). A published caret installs with a plain \`caret install\`.`);
   }
   if (opts.requireArtifacts !== false) {
     const missing = [
-      isExecutable(join22(repoDir, "bin", "caret-native")) ? null : "bin/caret-native",
-      isDirectory(join22(repoDir, "bin", "ui")) ? null : "bin/ui"
+      isExecutable(join23(repoDir, "bin", "caret-native")) ? null : "bin/caret-native",
+      isDirectory(join23(repoDir, "bin", "ui")) ? null : "bin/ui"
     ].filter((m) => m !== null);
     if (missing.length > 0) {
       throw new Error(`--from-local reuses the build artifacts bin/caret-native + bin/ui, and ${repoDir} is missing ${missing.join(" + ")} \u2014 run \`mise run build\` first.`);
@@ -38757,10 +39429,10 @@ function caretRoot(deps) {
   }
 }
 function writeDevMarketplace(repoDir, outDir) {
-  rmSync5(outDir, { recursive: true, force: true });
-  mkdirSync5(join22(outDir, ".claude-plugin"), { recursive: true });
-  symlinkSync(resolve2(repoDir), join22(outDir, "caret"));
-  writeFileSync10(join22(outDir, ".claude-plugin", "marketplace.json"), `${JSON.stringify({
+  rmSync6(outDir, { recursive: true, force: true });
+  mkdirSync5(join23(outDir, ".claude-plugin"), { recursive: true });
+  symlinkSync(resolve2(repoDir), join23(outDir, "caret"));
+  writeFileSync11(join23(outDir, ".claude-plugin", "marketplace.json"), `${JSON.stringify({
     name: "caret",
     description: "Local caret dev build (generated by caret install --from-local).",
     owner: { name: "macintacos" },
@@ -38771,20 +39443,20 @@ function writeDevMarketplace(repoDir, outDir) {
 async function prewarmLocalBuild(repoDir, deps = {}) {
   const spawn = deps.spawn ?? runCaptured;
   try {
-    await spawn([join22(repoDir, "bin", "caret-native"), "prewarm"]);
+    await spawn([join23(repoDir, "bin", "caret-native"), "prewarm"]);
   } catch {}
 }
 function isExecutable(path) {
   try {
-    accessSync2(path, constants2.X_OK);
-    return statSync6(path).isFile();
+    accessSync3(path, constants3.X_OK);
+    return statSync7(path).isFile();
   } catch {
     return false;
   }
 }
 function isDirectory(path) {
   try {
-    return statSync6(path).isDirectory();
+    return statSync7(path).isDirectory();
   } catch {
     return false;
   }
@@ -39050,12 +39722,12 @@ async function runInstallClaudeTarget(opts, deps = {}) {
 
 // src/commands/install/opencode.ts
 init_config_plugin();
-import { writeFileSync as writeFileSync12 } from "fs";
-import { basename as basename5, join as join23 } from "path";
+import { writeFileSync as writeFileSync13 } from "fs";
+import { basename as basename7, join as join24 } from "path";
 
 // src/adapters/opencode/deploy.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync6, rmSync as rmSync6, writeFileSync as writeFileSync11 } from "fs";
-import { dirname as dirname10 } from "path";
+import { existsSync as existsSync14, mkdirSync as mkdirSync6, rmSync as rmSync7, writeFileSync as writeFileSync12 } from "fs";
+import { dirname as dirname11 } from "path";
 function renderPlugin(source, opts) {
   return source.replaceAll("__CARET_VERSION__", () => opts.version).replaceAll("__CARET_BIN__", () => opts.binPath).replaceAll("__CARET_DEMO_TEMPLATE__", () => opts.demoTemplate);
 }
@@ -39063,8 +39735,8 @@ function deployFiles(files, opts) {
   const paths = [];
   for (const f of files) {
     if (!opts.dryRun) {
-      mkdirSync6(dirname10(f.path), { recursive: true });
-      writeFileSync11(f.path, f.contents);
+      mkdirSync6(dirname11(f.path), { recursive: true });
+      writeFileSync12(f.path, f.contents);
     }
     paths.push(f.path);
   }
@@ -39076,7 +39748,7 @@ function removeFiles(targets, opts) {
     if (!existsSync14(p))
       continue;
     if (!opts.dryRun)
-      rmSync6(p, { force: true });
+      rmSync7(p, { force: true });
     paths.push(p);
   }
   return { paths, dryRun: opts.dryRun };
@@ -39084,6 +39756,7 @@ function removeFiles(targets, opts) {
 
 // src/commands/install/opencode.ts
 init_entries();
+init_host();
 init_paths2();
 init_upgrade();
 
@@ -39104,7 +39777,7 @@ var INSTALL_TARGETS = [
   {
     id: "opencode",
     label: "OpenCode",
-    hint: "add caret to the plugin array + deploy /caret:* commands",
+    hint: "add caret to OpenCode's plugin list + deploy /caret:* commands",
     detect: (probe) => probe.hasCommand("opencode") || probe.hasPath(opencodeConfigDir())
   }
 ];
@@ -39166,42 +39839,146 @@ function sameEntryForm(entry, specifier) {
     return false;
   return entryIsLocal ? entry === specifier : true;
 }
-function setCaretPluginEntry(text, specifier, isCheckout) {
+function keptEntry(entries, specifier) {
+  const sameForm = entries.filter((e) => sameEntryForm(e.spec, specifier));
+  return sameForm.find((e) => splitPluginSpecifier(e.spec).version !== null) ?? sameForm[0];
+}
+function setCaretPluginEntry(text, target) {
+  const { spec, key, isCheckout } = target;
   if (text === null)
-    return addPluginToConfigText(null, specifier);
-  const pruned = caretEntries(text, isCheckout).filter((entry) => !sameEntryForm(entry, specifier)).reduce((acc, entry) => removePluginFromConfigText(acc, entry), text);
-  return addPluginToConfigText(pruned, specifier);
+    return addPluginToConfigText(null, spec, key);
+  const entries = caretEntries(text, isCheckout);
+  const kept = entries.find((e) => e.key === key && e.spec === spec) ?? entries.find((e) => e.key === key);
+  const others = entries.filter((e) => e !== kept);
+  if (kept === undefined)
+    return addPluginToConfigText(dropEntries(text, others), spec, key);
+  const placed = kept.spec === spec ? text : setPluginItemSpec(text, { key, index: kept.index, spec });
+  return dropEntries(placed, others);
+}
+function stripCaret(isCheckout) {
+  return (text) => text === null ? null : dropEntries(text, caretEntries(text, isCheckout));
+}
+function bumpPin(version) {
+  return (text) => {
+    const entry = caretPackageEntry(text);
+    return text === null || entry === null ? null : setPluginVersionInConfigText(text, { pkg: CARET_PACKAGE, version, key: entry.key });
+  };
+}
+function hostLine({
+  hosts,
+  version,
+  key,
+  movedFrom
+}) {
+  const loadedByAll = version === null ? ", which every OpenCode loads" : "";
+  const found = `${describeHosts(hosts)} \u2014 writing caret to ${key}${loadedByAll}`;
+  return movedFrom === null ? found : `${found} (moved from ${movedFrom})`;
 }
 async function runInstallOpencodeTarget(opts, deps = {}) {
   const dir = deps.configDir ?? opencodeConfigDir();
-  const pkg = deps.packaging ?? loadOpencodePackaging();
-  const ui = deps.ui ?? silentUI;
-  const isCheckout = deps.isCheckout ?? isCaretCheckout;
-  const configFile = resolveConfigFile(dir);
-  const commandPaths = pkg.commands.map((c) => join23(commandDir(dir), namespacedCommandFilename(c.name)));
-  const legacy = existingLegacyInstallFiles(dir);
-  const specifier = opts.local ? localPluginSpecifier(opts.local.repoDir) : CARET_PACKAGE;
-  if (opts.dryRun) {
-    const verb = opts.uninstall ? "remove" : "write";
-    const found = checks3(opts) ? ["", previewLine(await readVerdict(configFile, deps))] : [];
-    const entry = opts.uninstall ? [] : ["", `plugin entry: ${specifier}`];
-    const sweep = legacy.length === 0 ? [] : ["", "pre-array-install files to remove:", ...legacy];
-    ui.note([configFile, ...commandPaths, ...entry, ...sweep, ...found].join(`
+  const setup = {
+    dir,
+    pkg: deps.packaging ?? loadOpencodePackaging(),
+    ui: deps.ui ?? silentUI,
+    isCheckout: deps.isCheckout ?? isCaretCheckout,
+    configFiles: existingConfigFiles(dir),
+    legacy: existingLegacyInstallFiles(dir)
+  };
+  if (opts.uninstall)
+    return opts.dryRun ? previewUninstall(setup) : uninstallOpencode(setup);
+  return opts.dryRun ? previewInstall(setup, opts, deps) : installOpencode(setup, opts, deps);
+}
+function readPlacement(setup, local, probe) {
+  const specifier = local ? localPluginSpecifier(local.repoDir) : CARET_PACKAGE;
+  const hosts = probe();
+  const version = sharedHost(hosts);
+  const key = pluginKeyFor(version);
+  const allEntries = readCaretEntries(setup.configFiles, setup.isCheckout);
+  const loadedFiles = loadedConfigFiles(setup.configFiles, version);
+  const loadedEntries = readCaretEntries(loadedFiles, setup.isCheckout);
+  const otherKey = key === "plugin" ? "plugins" : "plugin";
+  const movedFrom = allEntries.some((e) => e.key === otherKey) ? otherKey : null;
+  const writtenSpec = (keptEntry(loadedEntries, specifier) ?? keptEntry(allEntries, specifier))?.spec ?? specifier;
+  const target = resolveConfigFile(setup.dir, hostConfigFilenames(version));
+  return { specifier, hosts, version, key, movedFrom, writtenSpec, target, loadedFiles };
+}
+function installEdits({ configFiles, isCheckout }, { target, writtenSpec, key }) {
+  return [
+    ...configFiles.filter((path) => path !== target).map((path) => ({ path, transform: stripCaret(isCheckout) })),
+    {
+      path: target,
+      transform: (text) => setCaretPluginEntry(text, { spec: writtenSpec, key, isCheckout })
+    }
+  ];
+}
+function uninstallEdits({
+  configFiles,
+  isCheckout
+}) {
+  return configFiles.map((path) => ({ path, transform: stripCaret(isCheckout) }));
+}
+function ignoredConfigNote({ configFiles }, { version, target, loadedFiles }, changed) {
+  const ignored = configFiles.filter((p) => !loadedFiles.includes(p));
+  if (ignored.length === 0)
+    return null;
+  if (!ignored.some((p) => changed.includes(p)) && configFiles.includes(target))
+    return null;
+  const host = version === null ? "OpenCode" : `OpenCode v${version[0]}`;
+  const names = ignored.map((p) => basename7(p)).join(", ");
+  return `${host} ignores ${names} \u2014 caret goes in ${basename7(target)}`;
+}
+function commandPaths({ dir, pkg }) {
+  return pkg.commands.map((c) => join24(commandDir(dir), namespacedCommandFilename(c.name)));
+}
+function previewNote(setup, verb, parts) {
+  const { legacy, ui } = setup;
+  const sweep = legacy.length === 0 ? [] : ["", "pre-array-install files to remove:", ...legacy];
+  ui.note([...parts.configs, ...commandPaths(setup), ...parts.entry, ...sweep, ...parts.found].join(`
 `), `OpenCode \u2014 would ${verb}`);
-    return;
-  }
-  if (opts.uninstall) {
-    await ui.step("Removing caret from OpenCode's plugin array", async () => editConfig(configFile, (text) => text === null ? null : caretEntries(text, isCheckout).reduce((acc, entry) => removePluginFromConfigText(acc, entry), text)), (changed) => changed.length > 0 ? `Removed caret from ${basename5(configFile)}` : `caret was not in ${basename5(configFile)}`);
-    await ui.step("Removing the /caret:* command files", async () => removeFiles(commandPaths, { dryRun: false }), (removed) => `Removed ${removed.paths.length} command file(s) from ${dir}`);
-    await sweepLegacy(legacy, dir, ui);
-    return;
-  }
-  await ui.step(`Adding ${specifier} to OpenCode's plugin array`, async () => editConfig(configFile, (text) => setCaretPluginEntry(text, specifier, isCheckout)), (changed) => changed.length > 0 ? `Added ${specifier} to ${basename5(configFile)}` : `${specifier} was already in ${basename5(configFile)}`);
-  if (checks3(opts))
-    await upgradeStep(configFile, opts, deps, ui);
+}
+async function previewInstall(setup, opts, deps) {
+  const placed = readPlacement(setup, opts.local, deps.opencodeHosts ?? readOpencodeHosts);
+  const found = checksPublished(opts.local) ? [
+    "",
+    previewLine(await readVerdict({ configFiles: setup.configFiles, host: placed.version }, deps))
+  ] : [];
+  const entry = ["", `plugin entry: ${placed.specifier} \u2192 ${placed.key}`, hostLine(placed)];
+  const changed = strictPlan(installEdits(setup, placed)).map((e) => e.path);
+  const note = ignoredConfigNote(setup, placed, changed);
+  if (note !== null)
+    entry.push(note);
+  const configs = [placed.target, ...changed.filter((p) => p !== placed.target)];
+  previewNote(setup, "write", { configs, entry, found });
+}
+function previewUninstall(setup) {
+  const configs = lenientPlan(uninstallEdits(setup), setup.ui).planned.map((e) => e.path);
+  previewNote(setup, "remove", { configs, entry: [], found: [] });
+}
+async function uninstallOpencode(setup) {
+  const { ui, dir, legacy } = setup;
+  const { planned, uneditable } = lenientPlan(uninstallEdits(setup), ui);
+  await ui.step("Removing caret from OpenCode's plugin and plugins keys", async () => writeConfigEdits(planned), (changed) => {
+    if (changed.length > 0)
+      return `Removed caret from ${changed.map((p) => basename7(p)).join(", ")}`;
+    return uneditable.length > 0 ? "caret was not in any editable OpenCode config" : "caret was not in any OpenCode config";
+  });
+  await ui.step("Removing the /caret:* command files", async () => removeFiles(commandPaths(setup), { dryRun: false }), (removed) => `Removed ${removed.paths.length} command file(s) from ${dir}`);
+  await sweepLegacy(legacy, dir, ui);
+}
+async function installOpencode(setup, opts, deps) {
+  const { dir, pkg, ui, legacy } = setup;
+  const placed = readPlacement(setup, opts.local, deps.opencodeHosts ?? readOpencodeHosts);
+  const { specifier, key, writtenSpec, target } = placed;
+  ui.info(hostLine(placed));
+  const changed = await ui.step(`Adding ${specifier} to OpenCode's ${key} array`, async () => writeConfigEdits(strictPlan(installEdits(setup, placed))), (written) => installedLine(writtenSpec, target, written));
+  const note = ignoredConfigNote(setup, placed, changed);
+  if (note !== null)
+    ui.info(note);
+  if (checksPublished(opts.local))
+    await upgradeStep(target, opts, deps, ui);
   await sweepLegacy(legacy, dir, ui);
   const files = pkg.commands.map((c) => ({
-    path: join23(commandDir(dir), namespacedCommandFilename(c.name)),
+    path: join24(commandDir(dir), namespacedCommandFilename(c.name)),
     contents: renderPlugin(c.contents, {
       version: VERSION,
       binPath: pkg.binPath,
@@ -39215,18 +39992,18 @@ async function sweepLegacy(legacy, dir, ui) {
     return;
   await ui.step("Removing the pre-array-install files", async () => removeFiles(legacy, { dryRun: false }), (removed) => `Removed ${removed.paths.length} pre-array-install file(s) from ${dir}`);
 }
-function checks3(opts) {
-  return !opts.uninstall && opts.local === undefined;
+function checksPublished(local) {
+  return local === undefined;
 }
 function previewLine(verdict) {
   const line = upgradeVerdictLine(verdict);
   return verdict.kind === "unknown" ? `${line} (${verdict.reason})` : line;
 }
-async function readVerdict(configFile, deps) {
-  return readUpgradeVerdict({ configFile, cacheDir: deps.cacheDir, published: deps.published });
+async function readVerdict(at, deps) {
+  return readUpgradeVerdict({ ...at, cacheDir: deps.cacheDir, published: deps.published });
 }
-async function upgradeStep(configFile, opts, deps, ui) {
-  const verdict = await ui.step("Checking OpenCode's caret version", () => readVerdict(configFile, deps), upgradeVerdictLine);
+async function upgradeStep(target, opts, deps, ui) {
+  const verdict = await ui.step("Checking OpenCode's caret version", () => readVerdict({ configFiles: [target] }, deps), upgradeVerdictLine);
   if (verdict.kind === "unknown") {
     ui.warn(`Could not check OpenCode's caret version (${verdict.reason}) \u2014 nothing changed.`);
     return;
@@ -39247,15 +40024,69 @@ async function upgradeStep(configFile, opts, deps, ui) {
     await ui.step("Clearing OpenCode's cached caret", async () => (deps.clearCache ?? clearCachedCaret)(dirs), (cleared) => `Cleared ${cleared.length} cached ${cleared.length === 1 ? "copy" : "copies"} \u2014 OpenCode re-resolves on next start`);
     return;
   }
-  await ui.step(`Bumping ${CARET_PACKAGE} to ${verdict.published}`, async () => editConfig(configFile, (text) => text === null ? null : setPluginVersionInConfigText(text, CARET_PACKAGE, verdict.published)), (changed) => changed.length > 0 ? `Bumped the pin to ${CARET_PACKAGE}@${verdict.published}` : `Left ${basename5(configFile)} unchanged`);
+  await ui.step(`Bumping ${CARET_PACKAGE} to ${verdict.published}`, async () => writeConfigEdits(strictPlan([{ path: target, transform: bumpPin(verdict.published) }])), (changed) => changed.length > 0 ? `Bumped the pin to ${CARET_PACKAGE}@${verdict.published}` : `Left ${basename7(target)} unchanged`);
 }
-function editConfig(path, transform) {
-  const existing = readConfigText(path);
-  const next = transform(existing);
-  if (next === null || next === existing)
-    return [];
-  writeFileSync12(path, next);
-  return [path];
+function installedLine(spec, target, written) {
+  const name = basename7(target);
+  const line = written.includes(target) ? `Added ${spec} to ${name}` : `${spec} was already in ${name}`;
+  const stripped = written.filter((p) => p !== target).map((p) => basename7(p));
+  return stripped.length === 0 ? line : `${line} (removed it from ${stripped.join(", ")})`;
+}
+function planConfigEdits(edits) {
+  const plan = { planned: [], uneditable: [] };
+  for (const { path, transform } of edits) {
+    let existing;
+    try {
+      existing = readConfigText(path);
+    } catch (e) {
+      plan.uneditable.push({ path, reason: errorMessage(e) });
+      continue;
+    }
+    const parseError = existing === null ? null : configParseError(existing);
+    if (parseError !== null) {
+      plan.uneditable.push({ path, reason: parseError });
+      continue;
+    }
+    let text;
+    try {
+      text = transform(existing);
+    } catch (e) {
+      plan.uneditable.push({ path, reason: errorMessage(e) });
+      continue;
+    }
+    if (text !== null && text !== existing)
+      plan.planned.push({ path, text });
+  }
+  return plan;
+}
+function strictPlan(edits) {
+  const { planned, uneditable } = planConfigEdits(edits);
+  if (uneditable.length > 0) {
+    const files = uneditable.map(({ path, reason }) => `${path} (${reason})`).join(", ");
+    throw new Error(`can't edit ${files} \u2014 caret changed nothing`);
+  }
+  return planned;
+}
+function lenientPlan(edits, ui) {
+  const plan = planConfigEdits(edits);
+  for (const { path, reason } of plan.uneditable) {
+    ui.warn(`${path} can't be edited (${reason}) \u2014 caret leaves it alone`);
+  }
+  return plan;
+}
+function writeConfigEdits(planned) {
+  const written = [];
+  for (const { path, text } of planned) {
+    try {
+      writeFileSync13(path, text);
+    } catch (e) {
+      if (written.length === 0)
+        throw e;
+      throw new Error(`${errorMessage(e)} \u2014 already changed: ${written.join(", ")}`, { cause: e });
+    }
+    written.push(path);
+  }
+  return written;
 }
 
 // src/commands/install/launcher.ts
@@ -39269,13 +40100,13 @@ import {
   mkdirSync as mkdirSync7,
   mkdtempSync,
   readdirSync as readdirSync8,
-  readFileSync as readFileSync14,
+  readFileSync as readFileSync15,
   renameSync as renameSync5,
-  rmSync as rmSync7,
-  statSync as statSync7,
-  writeFileSync as writeFileSync13
+  rmSync as rmSync8,
+  statSync as statSync8,
+  writeFileSync as writeFileSync14
 } from "fs";
-import { basename as basename6, dirname as dirname11, join as join24 } from "path";
+import { dirname as dirname12, join as join25 } from "path";
 init_paths2();
 init_paths3();
 init_lifecycle();
@@ -39286,34 +40117,34 @@ function publishedRoot(kind = buildKind(), root = resolveCaretRoot) {
   if (kind !== "bundle")
     return;
   const dir = root();
-  return existsSync16(join24(dir, "src", "cli.ts")) ? undefined : { root: dir, version: VERSION };
+  return existsSync16(join25(dir, "src", "cli.ts")) ? undefined : { root: dir, version: VERSION };
 }
 function stageOwnedRoot(from) {
   if (!isRunnableRoot(from.root))
     return;
-  const dest = join24(ownedRootsDir(), from.version);
+  const dest = join25(ownedRootsDir(), from.version);
   if (isRunnableRoot(dest))
     return;
-  const parsed = PackageFiles.safeParse(readJsonFileSync(join24(from.root, "package.json")));
+  const parsed = PackageFiles.safeParse(readJsonFileSync(join25(from.root, "package.json")));
   if (!parsed.success)
     return;
   ensureStateDir(ownedRootsDir());
-  const tmp = mkdtempSync(join24(ownedRootsDir(), `.${from.version}.`));
+  const tmp = mkdtempSync(join25(ownedRootsDir(), `.${from.version}.`));
   try {
     for (const entry of [...parsed.data.files, "package.json"]) {
-      const src = join24(from.root, entry);
+      const src = join25(from.root, entry);
       if (!existsSync16(src))
         continue;
-      const target = join24(tmp, entry);
-      mkdirSync7(dirname11(target), { recursive: true });
+      const target = join25(tmp, entry);
+      mkdirSync7(dirname12(target), { recursive: true });
       cpSync(src, target, { recursive: true });
     }
     if (!isRunnableRoot(tmp))
       return;
-    rmSync7(dest, { recursive: true, force: true });
+    rmSync8(dest, { recursive: true, force: true });
     renameSync5(tmp, dest);
   } finally {
-    rmSync7(tmp, { recursive: true, force: true });
+    rmSync8(tmp, { recursive: true, force: true });
   }
 }
 function pruneOwnedRoots() {
@@ -39325,22 +40156,22 @@ function pruneOwnedRoots() {
   }
   const keep = pickLauncherRoot(null, listDirs(ownedRootsDir()).map((dir) => ({ dir, owned: true })))?.root;
   for (const name of entries) {
-    const path = join24(ownedRootsDir(), name);
+    const path = join25(ownedRootsDir(), name);
     if (path === keep)
       continue;
     try {
-      rmSync7(path, { recursive: true, force: true });
+      rmSync8(path, { recursive: true, force: true });
     } catch {}
   }
 }
 function installLauncher(deps = {}) {
-  const source = (deps.source ?? (() => join24(resolveCaretRoot(), "bin", "caret-launcher")))();
+  const source = (deps.source ?? (() => join25(resolveCaretRoot(), "bin", "caret-launcher")))();
   if (deps.pinnedRoot === undefined) {
     const owned = (deps.ownedRoot ?? publishedRoot)();
     if (owned)
       stageOwnedRoot(owned);
   }
-  ensureStateDir(dirname11(launcherPath()));
+  ensureStateDir(dirname12(launcherPath()));
   const tmp = `${launcherPath()}.${process.pid}.tmp`;
   copyFileSync(source, tmp);
   chmodSync4(tmp, 493);
@@ -39348,7 +40179,7 @@ function installLauncher(deps = {}) {
   const bunPath = deps.bunPath ?? (buildKind() === "binary" ? undefined : process.execPath);
   const unpinned = deps.pinnedRoot === undefined && existsSync16(launcherPinnedRootFile());
   if (unpinned)
-    rmSync7(launcherPinnedRootFile(), { force: true });
+    rmSync8(launcherPinnedRootFile(), { force: true });
   if (bunPath === undefined && deps.serviceLabel === undefined && deps.pinnedRoot === undefined) {
     return { unpinned };
   }
@@ -39362,13 +40193,13 @@ function installLauncher(deps = {}) {
   return { unpinned };
 }
 function writeRecord(path, value) {
-  writeFileSync13(path, `${value}
+  writeFileSync14(path, `${value}
 `, { mode: 384 });
 }
 function uninstallLauncher() {
-  rmSync7(dirname11(launcherPath()), { recursive: true, force: true });
-  rmSync7(launcherRecordDir(), { recursive: true, force: true });
-  rmSync7(ownedRootsDir(), { recursive: true, force: true });
+  rmSync8(dirname12(launcherPath()), { recursive: true, force: true });
+  rmSync8(launcherRecordDir(), { recursive: true, force: true });
+  rmSync8(ownedRootsDir(), { recursive: true, force: true });
 }
 function listDirs(dir) {
   let names;
@@ -39377,28 +40208,28 @@ function listDirs(dir) {
   } catch {
     return [];
   }
-  return names.filter((n) => !n.startsWith(".")).sort().map((n) => join24(dir, n)).filter(isDir);
+  return names.filter((n) => !n.startsWith(".")).sort().map((n) => join25(dir, n)).filter(isDir);
 }
 function isDir(path) {
   try {
-    return statSync7(path).isDirectory();
+    return statSync8(path).isDirectory();
   } catch {
     return false;
   }
 }
 function launcherCandidateDirs() {
-  const opencode = listDirs(dirname11(opencodeCachePackageDir())).filter((d) => basename6(d).startsWith("caret")).map((d) => join24(d, "node_modules", "@macintacos", "caret")).filter(isDir);
+  const opencodeRoots = opencodeRootPaths().filter(isDir);
   return [
     ...[
-      ...listDirs(join24(claudeConfigDir(), "plugins", "cache", "caret", "caret")),
-      ...opencode
+      ...listDirs(join25(claudeConfigDir(), "plugins", "cache", "caret", "caret")),
+      ...opencodeRoots
     ].map((dir) => ({ dir, owned: false })),
     ...listDirs(ownedRootsDir()).map((dir) => ({ dir, owned: true }))
   ];
 }
 function manifestVersion(root) {
   try {
-    const text = readFileSync14(join24(root, "package.json"), "utf8");
+    const text = readFileSync15(join25(root, "package.json"), "utf8");
     return text.match(/^[^\S\n]*"version"[^\S\n]*:[^\S\n]*"([^"\n]*)"/m)?.[1];
   } catch {
     return;
@@ -39433,9 +40264,10 @@ function prodLauncherRoot() {
 }
 
 // src/commands/install/service.ts
-init_constants();
 init_paths3();
 init_settings();
+init_address();
+init_client();
 init_lifecycle();
 init_build_id();
 function prodServiceWatch() {
@@ -39445,6 +40277,8 @@ var SETTLE_POLL_MS = 500;
 var SETTLE_WINDOW_MS = 30000;
 var SETTLE_ATTEMPTS = SETTLE_WINDOW_MS / SETTLE_POLL_MS;
 function classify(health, installerVersion, replaced) {
+  if (health instanceof DaemonAuthError)
+    return { kind: "unauthorized", message: health.message };
   if (health?.service !== "caret")
     return { kind: "silent" };
   const answeringVersion = health.version;
@@ -39457,10 +40291,19 @@ function classify(health, installerVersion, replaced) {
     return { kind: "silent" };
   return isNewer(installerVersion, answeringVersion) ? { kind: "stale", version: answeringVersion } : { kind: "ready", version: answeringVersion };
 }
+async function probe(baseUrl, watch) {
+  try {
+    return await watch.health(baseUrl);
+  } catch (e) {
+    if (e instanceof DaemonAuthError)
+      return e;
+    throw e;
+  }
+}
 async function awaitServed(baseUrl, watch, replaced) {
   let served = { kind: "silent" };
   for (let attempt = 0;attempt < SETTLE_ATTEMPTS; attempt++) {
-    served = classify(await watch.health(baseUrl), watch.version, replaced);
+    served = classify(await probe(baseUrl, watch), watch.version, replaced);
     if (served.kind === "ready")
       return served;
     await watch.sleep(SETTLE_POLL_MS);
@@ -39486,6 +40329,8 @@ ${log}`;
     case "unsupervised":
       return `A caret the service did not start${at(served.version)} holds the port.
 The service takes over once it exits.`;
+    case "unauthorized":
+      return `${served.message.charAt(0).toUpperCase()}${served.message.slice(1)}.`;
     case "silent":
       return `No caret daemon answered within ${SETTLE_WINDOW_MS / 1000} seconds.
 ${log}`;
@@ -39521,9 +40366,9 @@ async function uninstallService(opts, deps, ui) {
 }
 var SERVE_COMMAND = "bunx --no-cache @macintacos/caret@latest serve";
 async function reconcileService(opts, deps, ui) {
-  const port = getPort(loadSettings());
-  const reviewUrl = `http://${VANITY_HOST}:${port}`;
-  const baseUrl = `http://localhost:${port}`;
+  const s = loadSettings();
+  const reviewUrl = publicUrl(s.daemon, getPort(s));
+  const baseUrl = daemonBaseUrl(s);
   if (opts.choice === "run-yourself")
     return runYourself({ ...opts, reviewUrl }, deps, ui);
   await withService(deps, ui, async (target) => {
@@ -39563,7 +40408,7 @@ async function reconcileService(opts, deps, ui) {
     }
     const cycles = opts.refresh || opts.pinnedRoot !== undefined || unpinned;
     const { watch } = deps;
-    const replaced = cycles && watch ? (await watch.health(baseUrl))?.instanceId : undefined;
+    const replaced = cycles && watch ? await probe(baseUrl, watch).then((h) => h instanceof DaemonAuthError ? undefined : h?.instanceId) : undefined;
     if (cycles)
       await manager.restart();
     const settled = !watch || await settleService(baseUrl, watch, replaced, cycles, ui);
@@ -39745,6 +40590,52 @@ async function selectServiceChoice(opts, deps, ui) {
   return choice;
 }
 
+// src/commands/login-link.ts
+init_paths3();
+init_settings();
+init_address();
+init_token();
+function exposureWarning(daemon, port) {
+  if (!isExposed(daemon.host) || authEnabled(daemon))
+    return null;
+  return `caret: warning: daemon.auth = "none" on an exposed daemon (daemon.host = ${daemon.host}) \u2014 anyone on the network who can reach port ${port} can read plans, read files under a review's working directory, and approve a plan.`;
+}
+function loginLinkOutcome(daemon, port, token, tokenFile) {
+  const url = publicUrl(daemon, port);
+  if (!authEnabled(daemon)) {
+    const warning = exposureWarning(daemon, port);
+    return {
+      stderr: [
+        `caret: daemon auth is off, so there is no login link \u2014 open ${url} instead.`,
+        ...warning === null ? [] : [warning]
+      ],
+      code: 1
+    };
+  }
+  if (token === null) {
+    return {
+      stderr: [
+        `caret: no daemon token at ${tokenFile} yet \u2014 start the daemon (caret serve, or the caret service) to mint one.`
+      ],
+      code: 1
+    };
+  }
+  return { stdout: loginLink(url, token), stderr: [], code: 0 };
+}
+function runLoginLink() {
+  const s = loadSettings();
+  const tokenFile = daemonTokenFile();
+  const token = authEnabled(s.daemon) ? readToken(tokenFile) : null;
+  const outcome = loginLinkOutcome(s.daemon, getPort(s), token, tokenFile);
+  for (const line of outcome.stderr)
+    process.stderr.write(`${line}
+`);
+  if (outcome.stdout !== undefined)
+    process.stdout.write(`${outcome.stdout}
+`);
+  process.exitCode = outcome.code;
+}
+
 // src/commands/prewarm.ts
 init_settings();
 init_lifecycle();
@@ -39768,11 +40659,14 @@ async function runPrewarm() {
 init_adapters();
 init_boot();
 init_settings();
+init_address();
+init_client();
 init_log();
 
 // src/review/orchestrate.ts
-init_constants();
 init_paths3();
+init_address();
+init_client();
 init_log();
 
 // src/plan/format.ts
@@ -39813,7 +40707,11 @@ var REVIEW_FAILURE_CODES = {
   longPoll: "unexpected"
 };
 function reviewFailureCode(step, err) {
-  return err instanceof TimeoutError ? "review-timeout" : REVIEW_FAILURE_CODES[step];
+  if (err instanceof TimeoutError)
+    return "review-timeout";
+  if (err instanceof DaemonAuthError)
+    return "daemon-unauthorized";
+  return REVIEW_FAILURE_CODES[step];
 }
 function withTimeout(p, ms, message) {
   return new Promise((resolve, reject) => {
@@ -39834,6 +40732,11 @@ async function expireAbandoned(expire, handle) {
     await expire(handle.baseUrl, handle.id, handle.version);
   } catch {}
 }
+function reviewUrl(baseUrl, hostname, id) {
+  const u = new URL(baseUrl);
+  u.hostname = hostname;
+  return `${u.origin}/?review=${id}`;
+}
 async function runReview(parsed, deps) {
   let step = "parse";
   setLogContext({});
@@ -39876,12 +40779,12 @@ async function runReview(parsed, deps) {
     setLogContext({ ...ids, reviewId });
     deps.onPosted?.({ baseUrl, id, version, planFileCurrent });
     logDebug("review", `review created: ${shortId(id)}`);
-    const open = new URL(baseUrl);
-    open.hostname = VANITY_HOST;
-    const url = `${open.origin}/?review=${id}`;
-    if (!hasLiveClient)
-      deps.openBrowser(url);
-    deps.announceUrl(url);
+    if (!hasLiveClient) {
+      const localUrl = reviewUrl(baseUrl, deps.localHostname, id);
+      const token = deps.loginToken();
+      deps.openBrowser(token === null ? localUrl : loginLink(localUrl, token));
+    }
+    deps.announceUrl(reviewUrl(baseUrl, deps.publicHostname, id));
     step = "longPoll";
     const deadline = Date.now() + deps.timeoutMs;
     let decision;
@@ -39961,7 +40864,7 @@ async function runReconcileSubcommand() {
     const loaded = loadSettings();
     bootHookLogging(loaded);
     const adapter = selectAdapter();
-    const baseUrl = `http://localhost:${getPort(loaded)}`;
+    const baseUrl = daemonBaseUrl(loaded);
     const stdin = await Bun.stdin.text();
     await runReconcile(parseHook(adapter.parseHookInput, stdin), prodReconcileDeps(baseUrl));
   } catch (err) {
@@ -39996,7 +40899,10 @@ init_adapters();
 init_boot();
 init_paths3();
 init_settings();
+init_address();
+init_client();
 init_lifecycle();
+init_token();
 init_log();
 function browserOpenCmd(platform, url) {
   return platform === "darwin" ? ["open", url] : platform === "win32" ? ["cmd", "/c", "start", "", url] : ["xdg-open", url];
@@ -40029,6 +40935,9 @@ function prodReviewDeps(settings) {
     announceUrl: (url) => {
       process.stderr.write(reviewUrlLine(url));
     },
+    localHostname: localHostname(settings.daemon.host),
+    publicHostname: publicHostname(settings.daemon),
+    loginToken: () => authEnabled(settings.daemon) && process.platform !== "win32" ? readToken(daemonTokenFile()) : null,
     readPane: readCmuxPane,
     timeoutMs: reviewTimeoutMs(settings),
     expire: expireReview
@@ -40083,18 +40992,21 @@ async function runReviewSubcommand() {
 }
 
 // src/commands/serve.ts
-init_constants();
 init_paths3();
 init_settings();
+init_address();
+init_client();
 init_lifecycle();
+init_token();
 async function runServe() {
   const world = stateDir();
   const refusal = await vacatePort({
-    baseUrl: `http://localhost:${getPort()}`,
+    baseUrl: daemonBaseUrl(settings().current()),
     currentStateDir: world,
     deadlineMs: DRAIN_DEADLINE_MS + 5000,
     health: httpHealth,
     retire: (baseUrl) => retireDaemon(baseUrl, readDaemonLock(), world),
+    readLock: readDaemonLock,
     now: Date.now,
     sleep: Bun.sleep
   });
@@ -40104,8 +41016,18 @@ async function runServe() {
     process.exitCode = 1;
     return;
   }
-  const port = await runDaemon({ ephemeral: false, resident: true });
-  process.stdout.write(`caret is serving the review UI at http://${VANITY_HOST}:${port} \u2014 Ctrl+C stops it.
+  const { port, settings: booted } = await runDaemon({ ephemeral: false, resident: true });
+  const url = publicUrl(booted.daemon, port);
+  process.stdout.write(`caret is serving the review UI at ${url} \u2014 Ctrl+C stops it.
+`);
+  const token = authEnabled(booted.daemon) ? readToken(daemonTokenFile()) : null;
+  if (token !== null) {
+    process.stdout.write(`Open this link once on each device to log it in: ${loginLink(url, token)}
+`);
+  }
+  const warning = exposureWarning(booted.daemon, port);
+  if (warning !== null)
+    process.stderr.write(`${warning}
 `);
 }
 
@@ -42199,6 +43121,7 @@ function buildProgram() {
     await runDaemon({ ephemeral: opts.ephemeral ?? false, resident: isSupervised() });
   });
   program.command("serve").description("keep the review UI up in this terminal until Ctrl+C").action(() => runServe());
+  program.command("login-link").description("print the link that logs a browser into the review UI").action(() => runLoginLink());
   program.command("prewarm").description("warm-start the daemon").action(() => runPrewarm());
   program.command("review").description("review a plan from stdin (ExitPlanMode hook)").action(() => runReviewSubcommand());
   program.command("mcp").description("serve caret's plan-review tool over MCP stdio (Claude Code plugin)").action(async () => (await Promise.resolve().then(() => (init_mcp2(), exports_mcp))).runMcpSubcommand());