@mu-cabin/muc-cli 0.5.3 → 0.5.5

package/README.md

@@ -141,7 +141,7 @@ npx skills add <everything-cli 仓库地址>/packages/muc/skills -y -g
 
 ### Skill 的行为规则
 
-- **首次 TCP 命令前**：Skill 会弹 `AskUserQuestion` 提示槽位风险，等你确认后再执行。
+- **首次直连 TCP 命令前**：Skill 只提醒“同账号 iPad 可能被踢”，不再等待槽位确认，随后直接执行。
 - **不确定发给谁**：先用 `muc search` 缩小候选名单，通过 `AskUserQuestion` 让你选，不会猜。
 - **非自身目标**：必须经过你显式确认，不会偷偷给真实联系人发消息。
 - **token 过期**：自动用 `--token-pwd` 静默续登，续登失败才要求你手动 `muc login`。
@@ -232,25 +232,23 @@ muc withdraw --mid <mid> --to-self                   # 撤回自己发出的消
 
 ---
 
-## 和桌面端 / 手机端共存
+## 和桌面端 / 手机端 / iPad 共存
 
 REST 命令（`search`、`history`、`whois`、`groups` 等）**永远可以共存**，与桌面端、手机端同时在线互不影响。
 
-聊天通道命令（`send*`、`withdraw`、`sync`、`search-team`、`team-members`）受 MUC **单点登录**规则约束：每个账号在 **PC 端**和**移动端**各只允许**一个**在线设备，同一端登第二个会把第一个挤下线（和"在另一台 Mac 上登 MUC 就把当前这台顶掉"是一回事）。CLI 通过 `--os` 决定自己算哪一端：
+聊天通道命令（`send*`、`withdraw`、`sync`、`search-team`、`team-members`）进入 MUC 实时通道。每个账号有 **PC、Mobile、iPad 三个独立槽位**；同槽后登录会把前一个挤下线。CLI 继续沿用 `--os` 选槽位，其中 `iPad` 是逻辑值：线上报文实际发送 `os:"iOS"` 和 `browser:"iPad"`。
 
 | 算作哪端 | 对应的 `--os` 取值 |
 |---|---|
 | PC 端 | `Windows` / `OS X` / `Mac`（Mac 桌面端登录时上报的是 `OS X`） |
-| 移动端 | `iOS`（CLI 默认）/ `Android` |
+| 移动端 | `iOS` / `Android` |
+| iPad 端 | `iPad`（CLI 默认；线上报文为 `os:iOS + browser:iPad`） |
 
-> ⚠️ **默认发送消息会使移动端下线，谨慎使用。** CLI 默认 `--os iOS`，算"移动端"。
-> 只要跑了 `send` / `withdraw` 等聊天通道命令，**正在登录 MUC 的 iPhone 会被立刻挤下线**
-> （`accessToken` 不失效，但要重新打开 App 才能继续收实时消息）。
+> ⚠️ CLI 默认使用 **iPad 槽位**。PC 桌面端和手机端可以继续在线；如果同账号正登录 iPad，iPad 可能被挤下线，重新打开 App 即可恢复，`accessToken` 不失效。
 >
 > - 测试或跑通流程时，先用 `muc send --to-self ...` 发给自己。
-> - 真要 `--peer` / `--team` 发出去之前，确认**没人在等 iPhone 上 MUC 的实时消息**。
-> - 如果手机 MUC 必须保持在线，**整段流程改用 REST 命令**（`history`、`search`、`groups`…），别碰聊天通道。
-> - **不要**显式传 `--os Windows / OS X / Mac`——那会把 Mac 桌面端 MUC 也顶下去。
+> - `--os iOS/Android` 会改占 Mobile 槽位，可能踢手机；`--os Windows/OS X/Mac` 会改占 PC 槽位，可能踢桌面端。
+> - Skill 对默认 iPad 风险只做非阻塞提醒，不再要求预先确认槽位；发送给真实联系人、撤回等业务确认仍保留。
 
 `muc tcp-ping` 只做 TCP 连接和 NEGOTIATE，**不发登录帧**，不占任何在线名额，纯连通性测试，可以随时跑。
 
@@ -312,7 +310,7 @@ python3 analyze_api.py flows.ndjson --host muc.example.com
 ### 改动后测试流程
 
 1. `pnpm run typecheck`（在 `packages/muc` 下）— 先过类型检查。
-2. 按内部 `TEST_CASES.md` 从头到尾跑一遍（§1 REST 读 + §2 `tcp-ping` 无条件跑；Mac 桌面 + iPhone 同时在线时跳过 §3 §4）。
+2. 按内部 `TEST_CASES.md` 从头到尾跑一遍；实时命令默认走 iPad 槽位，实机验证前确认没有需要保持在线的同账号 iPad。
 3. 任何一项失败：把 `--json` 原始信封贴给用户，停下来，不要"修一修再跑"。
 
 ### 协议层参考（内部文档）
@@ -324,6 +322,6 @@ python3 analyze_api.py flows.ndjson --host muc.example.com
 ### 红线
 
 - **绝不入库** `accessToken`、`tokenPwd`、明文密码、`clientSecret`、`pfxPass`、`bsSecretKey`、`encrypt_key`，以及租户密钥（`APP_KEY` / `sign secrets`）。
-- **CLI 默认会顶掉同账号的 iPhone 端 MUC**（默认 `--os iOS`，单点登录规则）；显式传 PC 类 `--os` 会顶 Mac 桌面端；桌面 + 手机都需要保持在线时，整段流程退到 REST 命令。
+- **CLI 默认占用同账号的 iPad 槽位**（`--os iPad` → `os:iOS + browser:iPad`），可能顶掉真实 iPad；显式传 Mobile/PC 类 `--os` 才会影响手机/桌面端。
 - **CLI 发的消息所有参与方都可见。** 非自身目标必须带 `--yes-not-self`，先用 `--to-self` 测。
 - **不要擅自改 Surge 配置文件**（`~/Library/Application Support/Surge/Profiles/*.conf`）。要加 MITM hostname 让用户在 Surge UI 里加。

package/REFERENCE.md

@@ -252,14 +252,10 @@ muc history --team 9009876543210000 --before 2026-04-20 --json | jq .
 | `muc listen [--from-uid UID] [--team TEAM] [--peer UID] [--contains TEXT] [--regex …] [--at-me] [--max N]` | Long-lived TCP tap that emits one **NDJSON line per matching inbound message** (in `--json` mode each line is the standard envelope; in human mode it's a one-line summary). Supports repeatable filters (OR semantics within each kind, AND across kinds), `--at-me` to restrict to group messages where another user @-mentions you (implies excluding self), `--include-self` to include your own sends, `--include-reactions` to also surface type=3 sub=300/301 frames, `--max N` to exit after N matches. Stop with `^C`. |
 
 `--os` resolves as **per-call `--os` → `defaultChatOs` in `~/.muc/config.json`
-→ built-in `iOS`**. Valid values: `Windows`, `OS X`, `Mac`, `iOS`, `Android`.
-Set the per-machine default once with `muc init --default-os <os>` (or the
-`MUC_DEFAULT_OS` env var, or the interactive prompt during `muc init`). Useful
-if your real device is an iPhone — flip the CLI default to `windows` so
-chat-channel commands park on the PC slot instead of kicking your phone.
-**`--os` / `defaultChatOs` does not provide coexistence — read the section
-below before using any chat-channel command if you have a real device
-logged in.**
+→ built-in `iPad`**. Valid values: `Windows`, `OS X`, `Mac`, `iOS`, `Android`,
+and `iPad`. The existing option name is retained for compatibility: logical
+`iPad` serializes as `os:"iOS", browser:"iPad"` and selects the third slot.
+Set an override with `muc init --default-os <os>` or `MUC_DEFAULT_OS`.
 
 Sending to anyone other than yourself requires the explicit `--yes-not-self`
 flag — a guard against accidentally messaging real humans during testing.
@@ -325,7 +321,7 @@ through `muc daemon-start`, not through a dedicated assistant account.
 
 | Command | What it does |
 |---|---|
-| `muc assistantd-start [--os OS] [--on-kicked POLICY] [--debug]` | Start the assistant daemon in the foreground. Holds the chat slot for the chosen `--os` (priority: `--os` → the active profile's `defaultChatOs` → built-in `iOS`). `POLICY` is shared with the personal daemon and defaults to `3m`. With a [dedicated account](#dedicated-account-for-the-daemon) provisioned, that profile defaults `defaultChatOs` to `Windows` (PC slot). Without a dedicated profile it now fails unless `muc init --allow-assistant-shared-profile` explicitly opted into shared-profile mode. v1 has no launchd integration — wrap it in `tmux` / `screen` / `nohup` if you want it persistent. |
+| `muc assistantd-start [--os OS] [--on-kicked POLICY] [--debug]` | Start the assistant daemon in the foreground. Holds the chosen slot (priority: `--os` → active profile `defaultChatOs` → built-in `iPad`). Personal and dedicated-assistant behavior share this default. `POLICY` defaults to `3m`. Without a dedicated profile it fails unless `muc init --allow-assistant-shared-profile` explicitly opted into shared-profile mode. |
 | `muc assistantd-status` | Probe the daemon: running? slot? attached assistants? last paused-state message? |
 | `muc assistantd-stop` | Send `SIGTERM` to the daemon (graceful shutdown). |
 | `muc assistantd-resume` | Manual resume for `--on-kicked pause`, auth expiry, or exhausted network retries is reserved for v1.1. Today: `assistantd-stop` then `assistantd-start` again. |
@@ -352,13 +348,14 @@ Shared-profile assistant mode is an explicit advanced opt-in:
 as the personal `~/.muc` account and is mutually exclusive with
 `muc daemon-start` for that uid.
 
-- **Chat slot.** A daemon and a real device on the **same** slot kick
-  each other (`auth/kicked`, "same account login"). The CLI's built-in
-  default slot is `iOS` (Mobile) — so an iPhone login knocks a shared daemon
-  offline.
+- **Chat slot.** A daemon and a real device on the **same** slot kick each
+  other (`auth/kicked`, "same account login"). The built-in default is the
+  separate iPad slot, so desktop and phone coexist; a real iPad may conflict.
 - **REST `tokenPwd`.** A fresh `muc login` rotates the account's refresh
   token; other devices on that account get logged out when their token
-  next refreshes.
+  next refreshes. Remembered-password daemon recovery is different: it uses
+  `createTokenPwd=false`, refreshing only accessToken and preserving the
+  phone's auto-login credential.
 
 The fix is to give the daemon its **own account**, stored under
 `~/.muc/assistant/` (next to its pid / socket / logs) and completely
@@ -367,7 +364,7 @@ separate from your personal `~/.muc/`:
 ```bash
 muc assistant-init        # tenant config → ~/.muc/assistant/config.json
                           # (tenant secrets/hosts default to whatever your
-                          #  personal `muc init` saved; defaultChatOs → Windows)
+                          #  personal `muc init` saved; defaultChatOs → iPad)
 muc assistant-login --account <BOT_UID>   # → ~/.muc/assistant/credentials.json
                                           # (--platform defaults to mac)
 muc assistantd-start                      # picks up the dedicated profile
@@ -376,10 +373,9 @@ muc whoami --assistant                    # confirm which account it's on
 
 Once provisioned, `muc assistantd-start` reads the dedicated profile
 automatically (every REST call the daemon makes follows it too). The
-daemon parks on the **PC slot** (`Windows`), so it coexists with your
-personal account on a real iPhone (Mobile slot) on the same machine — at
-the cost of conflicting with the MUC **desktop app** (also PC slot; don't
-run it). Remove the profile (`rm -rf ~/.muc/assistant/config.json
+daemon defaults to the **iPad slot**, so the account's desktop and phone
+slots remain independent. A real iPad logged into that same assistant
+account may be kicked. Remove the profile (`rm -rf ~/.muc/assistant/config.json
 ~/.muc/assistant/credentials.json`) only if you intend to use the explicit
 shared-profile mode.
 
@@ -463,7 +459,7 @@ Hand-edit, or seeded by `assistant-new`:
 
 ```bash
 # v1: foreground only; wrap in tmux/screen for persistence.
-muc assistantd-start --os iOS                      # default Mobile slot
+muc assistantd-start                               # default iPad slot
 muc assistant-new desk-bot --description "out-of-hours triage in IT 值班群"
 $EDITOR ~/.muc/assistants/desk-bot/config.json     # add scope.tids etc.
 muc assistant-edit desk-bot                        # tune the persona
@@ -526,23 +522,22 @@ run anytime.
 
 **Chat-channel commands** (`sync`, `search-team`, `team-members`, `send`, `send-file`,
 `send-image`, `send-voice`, `withdraw`, `clear-session`, `pin`, `unpin`, `pinned`) open a TCP-8101
-session and share a per-user **two-slot** model with real devices:
+session and share a per-user **three-slot** model with real devices:
 
 | Slot | `--os` values |
 |---|---|
 | PC | `Windows`, `"OS X"`, `Mac` |
-| Mobile | `iOS` (default), `Android` |
+| Mobile | `iOS`, `Android` |
+| iPad | `iPad` (default; wire `os:"iOS", browser:"iPad"`) |
 
 A second login in the same slot kicks the previous client off the realtime
 channel — the IM panel goes offline, but tokens stay valid (reopen to
-recover). The Mac desktop signs in as `"OS X"` (PC slot); the iPhone signs
-in as `iOS` (Mobile slot).
+recover). The Mac desktop signs in as `"OS X"` (PC); the iPhone signs in as
+`iOS` (Mobile); the iPad app adds `browser:"iPad"` (iPad).
 
-The CLI defaults to `--os iOS` so it coexists with a Mac desktop. If your
-iPhone is also signed in, both slots are taken and any TCP command will
-kick one of them — fall back to REST-only commands, or run
-`muc init --default-os windows` to flip the per-machine default to the PC
-slot (which kicks the desktop instead of the phone).
+The CLI defaults to `--os iPad`, so desktop and phone can remain online.
+Only a real iPad on the same account may be kicked by the default. Explicit
+PC or Mobile values intentionally target those older slots.
 
 `tcp-ping` only does TCP connect + NEGOTIATE (no `auth/login`), so it can't
 kick anything. Run it first to confirm the wire protocol is happy on your
@@ -636,13 +631,15 @@ files by hand.
 ## Changelog
 
 #### Unreleased
+- Add the third iPad chat slot. Logical `--os iPad` serializes as `os:"iOS", browser:"iPad"` and is now the built-in default for personal commands, the personal daemon, and assistantd. Existing explicit `defaultChatOs` values remain authoritative.
+- Slot safety guidance is now non-blocking: skills remind that a real iPad may be kicked and continue without asking for slot confirmation. Recipient, content, and destructive-action confirmations are unchanged.
 - Add the personal daemon command family: `muc daemon-start`, `daemon-status`, `daemon-stop`, and `daemon-events`. Ordinary chat-channel commands now route only through the personal daemon and report `daemon_kind:"personal"` when routed.
 - Dedicated `assistantd` is no longer borrowed by ordinary commands. Without a dedicated assistant profile, `assistantd-start` now requires explicit `muc init --allow-assistant-shared-profile`; same-uid shared-profile assistantd conflicts with the personal daemon / direct ordinary TCP via `DAEMON_CONFLICT`.
 - Add raw event cursors (`<epoch_ms>-<sequence>`), 90-day personal daemon event retention, and `CURSOR_NOT_FOUND` handling for missing retained cursors.
 
 #### `0.5.0`
 `2026.05.11`
-- Add `muc assistant-init` / `muc assistant-login` and `muc whoami --assistant`: the assistant daemon can now authenticate as a **dedicated account** stored under `~/.muc/assistant/` (config.json, credentials.json, device-id, refresh logs), fully separate from the personal `~/.muc/` account every other command uses. `muc assistantd-start` picks it up automatically when present; the dedicated profile defaults `defaultChatOs` to `Windows` (PC slot) so the daemon coexists with a personal account on a real iPhone (Mobile slot). `assistant-init` seeds tenant secrets/hosts from your personal `muc init`; `assistant-login` defaults `--platform` to `mac`. Older builds kept shared-profile behavior when no profile existed; current builds require explicit opt-in.
+- Add `muc assistant-init` / `muc assistant-login` and `muc whoami --assistant`: the assistant daemon can authenticate as a **dedicated account** under `~/.muc/assistant/`, fully separate from the personal profile. At this release it defaulted to the PC slot; the current Unreleased behavior supersedes that with the iPad default. `assistant-login` still defaults REST `--platform` to `mac`.
 - Internals: `config.json` / `credentials.json` / `device-id` / `remember.salt` / `runtime/refresh-log.ndjson` paths now resolve through a process-wide *profile root* (default `~/.muc`) instead of being hardcoded. `configPath` / `credentialsPath` / `configDir` are now functions.
 
 #### `0.4.1`
@@ -661,7 +658,7 @@ files by hand.
 
 #### `0.3.1`
 `2026.04.29`
-- Add `defaultChatOs` to `~/.muc/config.json`: per-machine fallback for the chat-channel `--os` slot. Configure via `muc init --default-os <windows|osx|mac|ios|android>`, the `MUC_DEFAULT_OS` env var, or the interactive prompt during `muc init`. Resolution order: per-call `--os` → `defaultChatOs` → built-in `iOS`. Use this when your real device is on the Mobile slot (e.g. iPhone) so chat-channel commands park on PC instead of kicking your phone.
+- Add `defaultChatOs` to `~/.muc/config.json`. At this release the accepted values stopped at Android and the built-in fallback was `iOS`; current Unreleased behavior also accepts `ipad` and defaults to `iPad`.
 
 #### `0.3.0`
 `2026.04.29`
@@ -724,11 +721,9 @@ files by hand.
 - `EPROTO` / TLS errors — corporate proxy or VPN intercepting traffic.
   `muc-cli` does not pin certificates, so adding the proxy CA to your Node
   trust store should suffice (`NODE_EXTRA_CA_CERTS=/path/to/ca.pem`).
-- A TCP send kicks your desktop off the IM panel — the CLI's `--os` value
-  collided with the desktop's slot. See [Coexistence](#coexistence) above:
-  default `--os iOS` only risks the Mobile slot (your iPhone), not the
-  desktop. If both desktop and phone are online, drop to REST-only
-  commands.
+- A TCP command kicks a client off the IM panel — the CLI's `--os` value
+  collided with that client's slot. The default `--os iPad` only risks a
+  real iPad; explicit PC or Mobile values risk the matching client.
 
 ### 5.9 Gemini CLI headless timeout
 
@@ -779,9 +774,8 @@ works interactively.
   leak through shell history and `/proc/<pid>/environ` to other processes
   on the same machine. Use the interactive prompt or one-shot flags pulled
   from a secret manager rather than persistent `MUC_*` exports.
-- TCP login over 8101 registers a device session in one of two slots per
-  user (PC or Mobile). A second login in the same slot kicks the first.
-  Default `--os iOS` keeps the CLI on the Mobile slot; only your iPhone is
-  ever at risk.
+- TCP login over 8101 registers a device session in one of three slots per
+  user (PC, Mobile, or iPad). A second login in the same slot kicks the first.
+  Default `--os iPad` only risks a real iPad on the same account.
 - `tcp-ping` is the only chat-channel command that cannot kick anything —
   use it as a network smoke-test before trying TCP sends.

package/dist/muc.mjs

@@ -21479,7 +21479,7 @@ function file() {
   return join2(dir(), "config.json");
 }
 var CONFIG_SCHEMA_VERSION = 1;
-var CHAT_OS_VALUES = ["Windows", "OS X", "Mac", "iOS", "Android"];
+var CHAT_OS_VALUES = ["Windows", "OS X", "Mac", "iOS", "Android", "iPad"];
 var MucConfigSchema = external_exports.object({
   appKey: external_exports.string().regex(/^[0-9a-f]{8}$/, "appKey must be 8 lowercase hex chars"),
   appId: external_exports.string().regex(/^[0-9a-f]{24}$/, "appId must be 24 lowercase hex chars"),
@@ -21499,9 +21499,9 @@ var MucConfigSchema = external_exports.object({
   //   any other → that literal string (e.g. "\n— bot")
   // Per-call `--tail` / `--no-tail` flags on `muc send` override this.
   messageTail: external_exports.string().max(200).optional(),
-  // Default chat-channel `os` slot for TCP commands when --os is not passed.
-  // PC ({Windows, OS X, Mac}) vs Mobile ({iOS, Android}); same slot as the
-  // running desktop will kick it. Built-in fallback is 'iOS' (Mobile).
+  // Default logical chat slot for TCP commands when --os is not passed.
+  // PC: Windows/OS X/Mac; Mobile: iOS/Android; iPad: iPad. The iPad value is
+  // serialized on the wire as os=iOS + browser=iPad. Built-in fallback: iPad.
   defaultChatOs: external_exports.enum(CHAT_OS_VALUES).optional(),
   // Opt-in: when true, the assistant daemon writes a live status headline
   // to your profile signature (`ext.sign`, visible to anyone who hovers
@@ -21652,7 +21652,7 @@ var PLATFORM_WIN = 4;
 var PLATFORM_MAC = 5;
 var SECURE_SYS_KEY = "mx_app_key";
 var PWD_DES_IV = Buffer.from([1, 2, 3, 4, 5, 6, 7, 8]);
-var DEFAULT_CHAT_OS = "iOS";
+var DEFAULT_CHAT_OS = "iPad";
 var DEFAULT_REST_PLATFORM = PLATFORM_IOS;
 function defaultMessageTail(userName) {
   const name = userName.trim() || "unknown";
@@ -21855,7 +21855,8 @@ var CHAT_OS_MAP = {
   mac: "Mac",
   macos: "Mac",
   ios: "iOS",
-  android: "Android"
+  android: "Android",
+  ipad: "iPad"
 };
 function parseChatOs(raw) {
   const k = raw.trim().toLowerCase();
@@ -21863,7 +21864,7 @@ function parseChatOs(raw) {
   throw new CliError(
     "USAGE",
     `invalid --os: ${raw}`,
-    "expected windows|osx|mac|ios|android"
+    "expected windows|osx|mac|ios|android|ipad"
   );
 }
 function resolveChatOs(optsOs, cfg) {
@@ -22295,8 +22296,8 @@ async function doRefreshViaRememberedPwd() {
     deviceName: cred.deviceName || getDeviceName(),
     passwordType: 0,
     // plaintext password (DES-encoded), not tokenPwd
-    createTokenPwd: true,
-    // mint a fresh refresh token while we're here
+    createTokenPwd: false,
+    // accessToken only; do not rotate phone auto-login
     encrypt: true
   };
   form.sign = signRest(form, cfg.signSecretRest);
@@ -22494,7 +22495,7 @@ function register(program3, variant) {
   const isAssistant = variant?.kind === "assistant";
   define2(program3, {
     name: isAssistant ? "assistant-login" : "login",
-    description: isAssistant ? "Authenticate the assistant daemon's DEDICATED account and persist its tokens to ~/.muc/assistant/credentials.json (separate from your personal ~/.muc/credentials.json \u2014 the two never rotate each other's tokenPwd). Requires `muc assistant-init` first. Defaults --platform to mac (the daemon parks on the PC chat slot via cfg.defaultChatOs). Run interactively: `muc assistant-login --account <UID>` prompts for the password with echo off." : "Authenticate against MUC and persist accessToken + tokenPwd. Run interactively in your own terminal: `muc login --account <UID>` prompts for the password with echo off. `--token-pwd` reuses the saved refresh token and needs no password (this is the only form an agent should run silently). Avoid `--password` / `--password-stdin` / `$MUC_PASSWORD` \u2014 they leak the password into shell history, process lists, and agent chat scrollback.",
+    description: isAssistant ? "Authenticate the assistant daemon's DEDICATED account and persist its tokens to ~/.muc/assistant/credentials.json (separate from your personal ~/.muc/credentials.json \u2014 the two never rotate each other's tokenPwd). Requires `muc assistant-init` first. REST login still defaults --platform to mac; the daemon chat connection separately defaults to the iPad slot via cfg.defaultChatOs. Run interactively: `muc assistant-login --account <UID>` prompts for the password with echo off." : "Authenticate against MUC and persist accessToken + tokenPwd. Run interactively in your own terminal: `muc login --account <UID>` prompts for the password with echo off. `--token-pwd` reuses the saved refresh token and needs no password (this is the only form an agent should run silently). Avoid `--password` / `--password-stdin` / `$MUC_PASSWORD` \u2014 they leak the password into shell history, process lists, and agent chat scrollback.",
     output: Output,
     configure: (cmd) => {
       cmd.option("-a, --account <uid>", "MUC account uid (uppercase, e.g. WANGLULU8)").option("-p, --password <pwd>", "plaintext password (avoid; ends up in shell history)").option("--password-stdin", "read password from stdin (no trailing newline)").option("--token-pwd", "reuse the saved tokenPwd (skips password)").option("--platform <p>", "ios|android|win|mac or numeric code", (v) => parsePlatform(v)).option("--app-version <v>", "override appVersion sent in the login form").option("--remember", "persist an encrypted copy of the password for unattended re-login").option("--no-remember", "wipe any previously --remember'ed password");
@@ -22714,7 +22715,7 @@ var FingerprintShape = external_exports.object({
   messageTail: external_exports.string(),
   // summary: "default" / "none" / "custom (N chars)"
   defaultChatOs: external_exports.string(),
-  // summary: explicit value or "default (iOS)"
+  // summary: explicit value or "default (iPad)"
   exposeStatusInSignature: external_exports.boolean(),
   noRouteHint: external_exports.boolean(),
   allowAssistantSharedProfile: external_exports.boolean(),
@@ -22911,10 +22912,10 @@ function register2(program3, variant) {
   const isAssistant = variant?.kind === "assistant";
   define2(program3, {
     name: isAssistant ? "assistant-init" : "init",
-    description: isAssistant ? "Bootstrap or update the assistant daemon's DEDICATED-account tenant config at ~/.muc/assistant/config.json (separate from your personal ~/.muc/config.json). Provisioning this makes `muc assistantd-start` authenticate as that account on its own chat slot (defaults defaultChatOs=Windows \u2192 PC slot, so it coexists with a real iPhone on the Mobile slot). Tenant secrets default to whatever your personal `muc init` saved \u2014 pass --app-key/--app-id/--sign-secret-* to override. Then run `muc assistant-login`." : "Bootstrap or update ~/.muc/config.json (tenant config: APP_KEY, APP_ID, signing secrets, hosts/ports). Interactive prompts by default; non-interactive via flags or MUC_* env vars. WARNING: env vars are visible to other processes via /proc/<pid>/environ and shell history \u2014 prefer interactive or flag-based for production.",
+    description: isAssistant ? "Bootstrap or update the assistant daemon's DEDICATED-account tenant config at ~/.muc/assistant/config.json (separate from your personal ~/.muc/config.json). Provisioning this makes `muc assistantd-start` authenticate as that account on its own chat slot (defaults defaultChatOs=iPad, separate from PC and Mobile; a real iPad on the same account may be kicked). Tenant secrets default to whatever your personal `muc init` saved \u2014 pass --app-key/--app-id/--sign-secret-* to override. Then run `muc assistant-login`." : "Bootstrap or update ~/.muc/config.json (tenant config: APP_KEY, APP_ID, signing secrets, hosts/ports). Interactive prompts by default; non-interactive via flags or MUC_* env vars. WARNING: env vars are visible to other processes via /proc/<pid>/environ and shell history \u2014 prefer interactive or flag-based for production.",
     output: Output2,
     configure: (cmd) => {
-      cmd.option("--check", "verify config presence and validity (exit 0 ok / 6 missing / 7 invalid); does not modify").option("--show", "print the saved config (secrets are always redacted in both human and JSON output; cat ~/.muc/config.json for raw values)").option("--reset", "delete ~/.muc/config.json (requires --yes)").option("--yes", "confirm a destructive action like --reset").option("--no-interactive", "fail rather than prompt for missing fields").option("--app-key <hex>", "tenant APP_KEY (8 lowercase hex)").option("--app-id <hex>", "tenant APP_ID (24 lowercase hex)").option("--sign-secret-rest <s>", "REST signing secret").option("--sign-secret-secure <s>", "secure-API signing secret").option("--pwd-des-key <s>", "password DES key (defaults to APP_KEY)").option("--rest-host <url>", "REST host URL").option("--sso-host <url>", "SSO host URL (optional)").option("--im-host <h>", "IM TCP host").option("--im-port <n>", "IM TCP port").option("--file-host <h>", "file-channel TCP host").option("--file-port <n>", "file-channel TCP port").option("--message-tail <text>", "custom signature appended to outbound `muc send` text (max 200 chars)").option("--no-message-tail", "explicitly disable the message tail (no signature appended)").option("--default-os <os>", "default chat-channel os slot for TCP commands when --os is not passed (windows|osx|mac|ios|android); built-in fallback is iOS").option("--expose-status-in-signature", "opt in: assistant daemon writes a live status headline to your MUC profile signature (visible to anyone who hovers your name). Daemon reads this flag at start; restart `muc assistantd-start` after toggling for the change to take effect.").option("--no-expose-status-in-signature", "opt out (default) of profile-signature status updates; /status chat command stays available regardless. Daemon reads this flag at start; restart needed for the change to take effect.").option("--allow-assistant-shared-profile", "advanced opt-in: allow assistantd to use this personal profile when no dedicated assistant profile exists").option("--no-allow-assistant-shared-profile", "opt out (default): assistantd must use its dedicated ~/.muc/assistant profile");
+      cmd.option("--check", "verify config presence and validity (exit 0 ok / 6 missing / 7 invalid); does not modify").option("--show", "print the saved config (secrets are always redacted in both human and JSON output; cat ~/.muc/config.json for raw values)").option("--reset", "delete ~/.muc/config.json (requires --yes)").option("--yes", "confirm a destructive action like --reset").option("--no-interactive", "fail rather than prompt for missing fields").option("--app-key <hex>", "tenant APP_KEY (8 lowercase hex)").option("--app-id <hex>", "tenant APP_ID (24 lowercase hex)").option("--sign-secret-rest <s>", "REST signing secret").option("--sign-secret-secure <s>", "secure-API signing secret").option("--pwd-des-key <s>", "password DES key (defaults to APP_KEY)").option("--rest-host <url>", "REST host URL").option("--sso-host <url>", "SSO host URL (optional)").option("--im-host <h>", "IM TCP host").option("--im-port <n>", "IM TCP port").option("--file-host <h>", "file-channel TCP host").option("--file-port <n>", "file-channel TCP port").option("--message-tail <text>", "custom signature appended to outbound `muc send` text (max 200 chars)").option("--no-message-tail", "explicitly disable the message tail (no signature appended)").option("--default-os <os>", "default chat-channel slot for TCP commands when --os is not passed (windows|osx|mac|ios|android|ipad); built-in fallback is iPad").option("--expose-status-in-signature", "opt in: assistant daemon writes a live status headline to your MUC profile signature (visible to anyone who hovers your name). Daemon reads this flag at start; restart `muc assistantd-start` after toggling for the change to take effect.").option("--no-expose-status-in-signature", "opt out (default) of profile-signature status updates; /status chat command stays available regardless. Daemon reads this flag at start; restart needed for the change to take effect.").option("--allow-assistant-shared-profile", "advanced opt-in: allow assistantd to use this personal profile when no dedicated assistant profile exists").option("--no-allow-assistant-shared-profile", "opt out (default): assistantd must use its dedicated ~/.muc/assistant profile");
     },
     run: async (cmd) => {
       const opts = cmd.opts();
@@ -23056,7 +23057,7 @@ function register2(program3, variant) {
           }
         }
       }
-      const chatOsDefault = isAssistant ? "windows" : DEFAULT_CHAT_OS.toLowerCase();
+      const chatOsDefault = DEFAULT_CHAT_OS.toLowerCase();
       let defaultChatOs;
       let dcoRaw;
       const dcoFlag = opts.defaultOs;
@@ -23069,7 +23070,7 @@ function register2(program3, variant) {
         defaultChatOs = existing.defaultChatOs;
       } else if (interactive) {
         const answer = await readLine(
-          "Default chat OS slot (windows|osx|mac|ios|android)",
+          "Default chat slot (windows|osx|mac|ios|android|ipad)",
           chatOsDefault
         );
         if (answer.length > 0) dcoRaw = answer;
@@ -23078,7 +23079,7 @@ function register2(program3, variant) {
         defaultChatOs = parseChatOs(dcoRaw);
       }
       if (defaultChatOs === void 0 && isAssistant) {
-        defaultChatOs = "Windows";
+        defaultChatOs = DEFAULT_CHAT_OS;
       }
       const noRouteHint = existing?.noRouteHint;
       const sharedConflict = detectFlagConflict(process.argv.slice(2), "allow-assistant-shared-profile");
@@ -23913,12 +23914,15 @@ var MucChatSocket = class extends EventEmitter {
 
 // src/lib/chat.ts
 init_profile();
+function chatLoginIdentity(chatOs) {
+  return chatOs === "iPad" ? { os: "iOS", browser: "iPad" } : { os: chatOs };
+}
 function buildLoginPayload(cred, chatOs, cfg) {
   return {
     login: {
       account: cred.uid,
       accessToken: cred.accessToken,
-      os: chatOs,
+      ...chatLoginIdentity(chatOs),
       osVersion: release3(),
       sdkVersion: 21,
       deviceId: cred.deviceId,
@@ -24048,13 +24052,15 @@ async function tryRefreshViaEmpGet2(cred, cfg) {
   }
 }
 async function refreshAccessTokenViaTokenPwd(cred, cfg) {
+  const platform3 = DEFAULT_REST_PLATFORM;
+  const appVersion = platform3 === PLATFORM_IOS ? APP_VERSION_IOS : APP_VERSION;
   const form = {
     account: cred.uid,
     password: encryptPassword(cred.tokenPwd, pwdDesKeyOf(cfg)),
     appName: APP_NAME,
     appKey: cfg.appKey,
-    appVersion: APP_VERSION,
-    platform: PLATFORM_MAC,
+    appVersion,
+    platform: platform3,
     osVersion: release3(),
     deviceId: cred.deviceId,
     deviceName: cred.deviceName,
@@ -25080,7 +25086,7 @@ function register10(program3) {
     description: 'Search groups the current user belongs to (TCP chat channel sid="team", cid="search_own_teams"). Pass --enrich for names + member counts. Will kick a session in the same online-slot.',
     output: Output10,
     configure: (cmd) => {
-      cmd.argument("<keyword>", "team name fragment").option("--enrich", "follow up with team/get_team per id").option("--os <os>", "chat-channel os slot (default: cfg.defaultChatOs ?? iOS)", parseChatOs).option("--no-daemon", "bypass any running personal daemon and use a direct connection on your own slot (also: MUC_NO_DAEMON=1)").option("--debug", "forward wire-level debug events to stderr");
+      cmd.argument("<keyword>", "team name fragment").option("--enrich", "follow up with team/get_team per id").option("--os <os>", "chat-channel slot (default: cfg.defaultChatOs ?? iPad)", parseChatOs).option("--no-daemon", "bypass any running personal daemon and use a direct connection on your own slot (also: MUC_NO_DAEMON=1)").option("--debug", "forward wire-level debug events to stderr");
     },
     run: async (cmd) => {
       const [kw] = cmd.args;
@@ -25205,7 +25211,7 @@ function register11(program3) {
     description: "List members of a joined group by TEAM_ID via TCP team/get_team_members. Pass --profiles to enrich department/title via organization search. Will kick a session in the same online-slot.",
     output: Output11,
     configure: (cmd) => {
-      cmd.argument("<teamId>", "team/group id from search-team").option("--profiles", "enrich each member with org directory fields via REST organization/search").option("--os <os>", "chat-channel os slot (default: cfg.defaultChatOs ?? iOS)", parseChatOs).option("--no-daemon", "bypass any running personal daemon and use a direct connection on your own slot (also: MUC_NO_DAEMON=1)").option("--debug", "forward wire-level debug events to stderr");
+      cmd.argument("<teamId>", "team/group id from search-team").option("--profiles", "enrich each member with org directory fields via REST organization/search").option("--os <os>", "chat-channel slot (default: cfg.defaultChatOs ?? iPad)", parseChatOs).option("--no-daemon", "bypass any running personal daemon and use a direct connection on your own slot (also: MUC_NO_DAEMON=1)").option("--debug", "forward wire-level debug events to stderr");
     },
     run: async (cmd) => {
       const [id] = cmd.args;
@@ -25500,7 +25506,7 @@ function register15(program3) {
     description: "After chat-login, run sync/syncDone, sync/syncSession, sync/syncWithdraws and return the raw responses.",
     output: Output15,
     configure: (cmd) => {
-      cmd.option("--os <os>", "chat-channel os slot (default: cfg.defaultChatOs ?? iOS)", parseChatOs).option("--no-daemon", "bypass any running personal daemon and use a direct connection on your own slot (also: MUC_NO_DAEMON=1)").option("--debug", "forward wire-level debug events to stderr");
+      cmd.option("--os <os>", "chat-channel slot (default: cfg.defaultChatOs ?? iPad)", parseChatOs).option("--no-daemon", "bypass any running personal daemon and use a direct connection on your own slot (also: MUC_NO_DAEMON=1)").option("--debug", "forward wire-level debug events to stderr");
     },
     run: async (cmd) => {
       const { os: optsOs, debug, daemon } = cmd.opts();
@@ -25825,7 +25831,7 @@ function register17(program3) {
     description: "Send a plain-text chat message via the TCP chat channel. VISIBLE TO THE RECIPIENT \u2014 non-self targets require --yes-not-self.",
     output: Output17,
     configure: (cmd) => {
-      cmd.argument("<text...>", "message text (variadic; words rejoined with spaces)").option("--peer <uid>", "1:1 chat with a peer uid").option("--team <id>", "group chat with a team id").option("--to-self", "send to your own uid (default if no target given)").option("--yes-not-self", "required to confirm sending to anyone other than yourself").option("--dry-run", "build the frame but do not connect").option("--os <os>", "chat-channel os slot (default: cfg.defaultChatOs ?? iOS)", parseChatOs).option("--no-daemon", "bypass any running personal daemon and use a direct connection on your own slot (also: MUC_NO_DAEMON=1)").option("--tail <text>", "override message tail for this call only").option("--no-tail", "do not append a message tail for this call").option(
+      cmd.argument("<text...>", "message text (variadic; words rejoined with spaces)").option("--peer <uid>", "1:1 chat with a peer uid").option("--team <id>", "group chat with a team id").option("--to-self", "send to your own uid (default if no target given)").option("--yes-not-self", "required to confirm sending to anyone other than yourself").option("--dry-run", "build the frame but do not connect").option("--os <os>", "chat-channel slot (default: cfg.defaultChatOs ?? iPad)", parseChatOs).option("--no-daemon", "bypass any running personal daemon and use a direct connection on your own slot (also: MUC_NO_DAEMON=1)").option("--tail <text>", "override message tail for this call only").option("--no-tail", "do not append a message tail for this call").option(
         "--at <uid[:name][,uid[:name]...]>",
         '@-mention one or more uids in a group (use "uid:name" to control the rendered display name; group target only)'
       ).option("--debug", "forward wire-level debug events to stderr");
@@ -26689,7 +26695,7 @@ function register18(program3) {
     description: "Upload a local file (TCP 6101) and broadcast as MESSAGE_CHAT_FILE (subType=7). VISIBLE \u2014 non-self targets require --yes-not-self.",
     output: Output18,
     configure: (cmd) => {
-      cmd.argument("<file>", "absolute or relative path to a local file").option("--peer <uid>", "1:1 chat with a peer uid").option("--team <id>", "group chat with a team id").option("--to-self", "send to your own uid (default if no target given)").option("--yes-not-self", "required to confirm sending to anyone other than yourself").option("--dry-run", "resolve target + sanity-check the local file but do not upload or send").option("--os <os>", "chat-channel os slot for the talk/sendMsg (default: cfg.defaultChatOs ?? iOS)", parseChatOs).option("--no-daemon", "bypass any running personal daemon and use a direct connection on your own slot (also: MUC_NO_DAEMON=1)").option("--debug", "forward wire-level debug events to stderr");
+      cmd.argument("<file>", "absolute or relative path to a local file").option("--peer <uid>", "1:1 chat with a peer uid").option("--team <id>", "group chat with a team id").option("--to-self", "send to your own uid (default if no target given)").option("--yes-not-self", "required to confirm sending to anyone other than yourself").option("--dry-run", "resolve target + sanity-check the local file but do not upload or send").option("--os <os>", "chat-channel slot for talk/sendMsg (default: cfg.defaultChatOs ?? iPad)", parseChatOs).option("--no-daemon", "bypass any running personal daemon and use a direct connection on your own slot (also: MUC_NO_DAEMON=1)").option("--debug", "forward wire-level debug events to stderr");
     },
     run: async (cmd) => {
       const filePath = path2.resolve(String(cmd.args[0] ?? ""));
@@ -26887,7 +26893,7 @@ function register19(program3) {
     description: "Upload an image (TCP 6101) and broadcast as MESSAGE_CHAT_IMAGE (subType=8). VISIBLE \u2014 non-self targets require --yes-not-self.",
     output: Output19,
     configure: (cmd) => {
-      cmd.argument("<file>", "PNG/JPEG/GIF/BMP image path").option("--peer <uid>", "1:1 chat with a peer uid").option("--team <id>", "group chat with a team id").option("--to-self", "send to your own uid (default)").option("--yes-not-self", "required for non-self targets").option("--width <px>", "override probed image width", parsePosInt("--width")).option("--height <px>", "override probed image height", parsePosInt("--height")).option("--dry-run", "sanity-check the local file (probe + stat) but do not upload or send").option("--os <os>", "chat-channel os slot (default: cfg.defaultChatOs ?? iOS)", parseChatOs).option("--no-daemon", "bypass any running personal daemon and use a direct connection on your own slot (also: MUC_NO_DAEMON=1)").option("--debug", "forward wire-level debug events to stderr");
+      cmd.argument("<file>", "PNG/JPEG/GIF/BMP image path").option("--peer <uid>", "1:1 chat with a peer uid").option("--team <id>", "group chat with a team id").option("--to-self", "send to your own uid (default)").option("--yes-not-self", "required for non-self targets").option("--width <px>", "override probed image width", parsePosInt("--width")).option("--height <px>", "override probed image height", parsePosInt("--height")).option("--dry-run", "sanity-check the local file (probe + stat) but do not upload or send").option("--os <os>", "chat-channel slot (default: cfg.defaultChatOs ?? iPad)", parseChatOs).option("--no-daemon", "bypass any running personal daemon and use a direct connection on your own slot (also: MUC_NO_DAEMON=1)").option("--debug", "forward wire-level debug events to stderr");
     },
     run: async (cmd) => {
       const filePath = path3.resolve(String(cmd.args[0] ?? ""));
@@ -27065,7 +27071,7 @@ function register20(program3) {
     description: "Upload an audio clip (TCP 6101) and broadcast as MESSAGE_CHAT_AUDIO (subType=9). VISIBLE \u2014 non-self targets require --yes-not-self.",
     output: Output20,
     configure: (cmd) => {
-      cmd.argument("<file>", "audio file path (typically .amr)").requiredOption("--duration <ms>", "clip duration in milliseconds", parsePosInt("--duration")).option("--peer <uid>", "1:1 chat with a peer uid").option("--team <id>", "group chat with a team id").option("--to-self", "send to your own uid (default)").option("--yes-not-self", "required for non-self targets").option("--dry-run", "sanity-check the local file but do not upload or send").option("--os <os>", "chat-channel os slot (default: cfg.defaultChatOs ?? iOS)", parseChatOs).option("--no-daemon", "bypass any running personal daemon and use a direct connection on your own slot (also: MUC_NO_DAEMON=1)").option("--debug", "forward wire-level debug events to stderr");
+      cmd.argument("<file>", "audio file path (typically .amr)").requiredOption("--duration <ms>", "clip duration in milliseconds", parsePosInt("--duration")).option("--peer <uid>", "1:1 chat with a peer uid").option("--team <id>", "group chat with a team id").option("--to-self", "send to your own uid (default)").option("--yes-not-self", "required for non-self targets").option("--dry-run", "sanity-check the local file but do not upload or send").option("--os <os>", "chat-channel slot (default: cfg.defaultChatOs ?? iPad)", parseChatOs).option("--no-daemon", "bypass any running personal daemon and use a direct connection on your own slot (also: MUC_NO_DAEMON=1)").option("--debug", "forward wire-level debug events to stderr");
     },
     run: async (cmd) => {
       const filePath = path4.resolve(String(cmd.args[0] ?? ""));
@@ -27326,7 +27332,7 @@ function register22(program3) {
     description: "Withdraw a previously-sent message (P2P_MSG_CANCEL). VISIBLE TO THE RECIPIENT \u2014 non-self targets require --yes-not-self.",
     output: Output22,
     configure: (cmd) => {
-      cmd.requiredOption("--mid <mid>", "message id to withdraw").option("--peer <uid>", "1:1 chat with a peer uid").option("--team <id>", "group chat with a team id").option("--to-self", "withdraw in your self-chat (default if no target)").option("--yes-not-self", "required to confirm withdrawing in a non-self conversation").option("--dry-run", "build the frame but do not connect").option("--os <os>", "chat-channel os slot (default: cfg.defaultChatOs ?? iOS)", parseChatOs).option("--no-daemon", "bypass any running personal daemon and use a direct connection on your own slot (also: MUC_NO_DAEMON=1)").option("--debug", "forward wire-level debug events to stderr");
+      cmd.requiredOption("--mid <mid>", "message id to withdraw").option("--peer <uid>", "1:1 chat with a peer uid").option("--team <id>", "group chat with a team id").option("--to-self", "withdraw in your self-chat (default if no target)").option("--yes-not-self", "required to confirm withdrawing in a non-self conversation").option("--dry-run", "build the frame but do not connect").option("--os <os>", "chat-channel slot (default: cfg.defaultChatOs ?? iPad)", parseChatOs).option("--no-daemon", "bypass any running personal daemon and use a direct connection on your own slot (also: MUC_NO_DAEMON=1)").option("--debug", "forward wire-level debug events to stderr");
     },
     run: async (cmd) => {
       const opts = cmd.opts();
@@ -27440,7 +27446,7 @@ function register23(program3) {
     description: "Send user/delSession to drop the local session record on all of the user's devices.",
     output: Output23,
     configure: (cmd) => {
-      cmd.option("--peer <uid>", "session with a peer uid").option("--team <id>", "session with a team id").option("--to-self", "self-chat session (default if no target)").option("--yes-not-self", "required to confirm clearing a non-self session").option("--dry-run", "build the frame but do not connect").option("--os <os>", "chat-channel os slot (default: cfg.defaultChatOs ?? iOS)", parseChatOs).option("--no-daemon", "bypass any running personal daemon and use a direct connection on your own slot (also: MUC_NO_DAEMON=1)").option("--debug", "forward wire-level debug events to stderr");
+      cmd.option("--peer <uid>", "session with a peer uid").option("--team <id>", "session with a team id").option("--to-self", "self-chat session (default if no target)").option("--yes-not-self", "required to confirm clearing a non-self session").option("--dry-run", "build the frame but do not connect").option("--os <os>", "chat-channel slot (default: cfg.defaultChatOs ?? iPad)", parseChatOs).option("--no-daemon", "bypass any running personal daemon and use a direct connection on your own slot (also: MUC_NO_DAEMON=1)").option("--debug", "forward wire-level debug events to stderr");
     },
     run: async (cmd) => {
       const opts = cmd.opts();
@@ -27642,7 +27648,7 @@ function registerPin(program3) {
     description: "Pin a chat session to the top of the conversation list (TCP user/setCacheField sticky_on_top_id, op=1). Multi-device via user cache. Will kick a session in the same online-slot.",
     output: MutateOutput,
     configure: (cmd) => {
-      cmd.option("--peer <uid>", "1:1 session with this uid").option("--team <id>", "group session (team id)").option("--to-self", "self-chat session (default if no target)").option("--sid <sId>", "raw session id (teamId or UID|UID); overrides --peer/--team/--to-self").option("--dry-run", "build the frame but do not connect").option("--os <os>", "chat-channel os slot (default: cfg.defaultChatOs ?? iOS)", parseChatOs).option("--no-daemon", "bypass any running personal daemon (also: MUC_NO_DAEMON=1)").option("--debug", "forward wire-level debug events to stderr");
+      cmd.option("--peer <uid>", "1:1 session with this uid").option("--team <id>", "group session (team id)").option("--to-self", "self-chat session (default if no target)").option("--sid <sId>", "raw session id (teamId or UID|UID); overrides --peer/--team/--to-self").option("--dry-run", "build the frame but do not connect").option("--os <os>", "chat-channel slot (default: cfg.defaultChatOs ?? iPad)", parseChatOs).option("--no-daemon", "bypass any running personal daemon (also: MUC_NO_DAEMON=1)").option("--debug", "forward wire-level debug events to stderr");
     },
     run: async (cmd) => mutateSticky(cmd, "pin")
   });
@@ -27653,7 +27659,7 @@ function registerUnpin(program3) {
     description: "Remove a session from the pin list (TCP user/setCacheField sticky_on_top_id, op=2). Will kick a session in the same online-slot.",
     output: MutateOutput,
     configure: (cmd) => {
-      cmd.option("--peer <uid>", "1:1 session with this uid").option("--team <id>", "group session (team id)").option("--to-self", "self-chat session (default if no target)").option("--sid <sId>", "raw session id (teamId or UID|UID); overrides --peer/--team/--to-self").option("--dry-run", "build the frame but do not connect").option("--os <os>", "chat-channel os slot (default: cfg.defaultChatOs ?? iOS)", parseChatOs).option("--no-daemon", "bypass any running personal daemon (also: MUC_NO_DAEMON=1)").option("--debug", "forward wire-level debug events to stderr");
+      cmd.option("--peer <uid>", "1:1 session with this uid").option("--team <id>", "group session (team id)").option("--to-self", "self-chat session (default if no target)").option("--sid <sId>", "raw session id (teamId or UID|UID); overrides --peer/--team/--to-self").option("--dry-run", "build the frame but do not connect").option("--os <os>", "chat-channel slot (default: cfg.defaultChatOs ?? iPad)", parseChatOs).option("--no-daemon", "bypass any running personal daemon (also: MUC_NO_DAEMON=1)").option("--debug", "forward wire-level debug events to stderr");
     },
     run: async (cmd) => mutateSticky(cmd, "unpin")
   });
@@ -27711,7 +27717,7 @@ function registerPinned(program3) {
     description: "List pinned session sIds from user cache (TCP user/setCacheField no-op delete probe \u2192 sticky_on_top_id). Will kick a session in the same online-slot.",
     output: ListOutput,
     configure: (cmd) => {
-      cmd.option("--dry-run", "build the probe frame but do not connect").option("--os <os>", "chat-channel os slot (default: cfg.defaultChatOs ?? iOS)", parseChatOs).option("--no-daemon", "bypass any running personal daemon (also: MUC_NO_DAEMON=1)").option("--debug", "forward wire-level debug events to stderr");
+      cmd.option("--dry-run", "build the probe frame but do not connect").option("--os <os>", "chat-channel slot (default: cfg.defaultChatOs ?? iPad)", parseChatOs).option("--no-daemon", "bypass any running personal daemon (also: MUC_NO_DAEMON=1)").option("--debug", "forward wire-level debug events to stderr");
     },
     run: async (cmd) => {
       const opts = cmd.opts();
@@ -28036,10 +28042,10 @@ var Output27 = external_exports.object({
 function register28(program3) {
   define2(program3, {
     name: "wait-react",
-    description: "Block until someone adds a default emoji reaction (subType=300) to --mid. Consumes a TCP slot \u2014 defaults to --os iOS (Mobile slot).",
+    description: "Block until someone adds a default emoji reaction (subType=300) to --mid. Consumes a TCP slot \u2014 defaults to the iPad slot.",
     output: Output27,
     configure: (cmd) => {
-      cmd.requiredOption("--mid <mid>", "message id to wait for a reaction on").option("--from-uid <uid>", "only consider reactions from this UID (case-insensitive match against fId of the type=3 notification)").option("--emoji <name>", "only consider this default reaction emoji name, e.g. [\u70B9\u8D5E] or \u70B9\u8D5E").option("--sticker-id <name>", "deprecated alias for --emoji").option("--timeout <seconds>", "give up after this many seconds (default 300)", parsePosInt("--timeout"), 300).option("--os <os>", "chat-channel os slot (default: cfg.defaultChatOs ?? iOS)", parseChatOs).option("--no-daemon", "bypass any running personal daemon and wait on a direct connection on your own slot (also: MUC_NO_DAEMON=1)").option("--debug", "forward wire-level debug events to stderr");
+      cmd.requiredOption("--mid <mid>", "message id to wait for a reaction on").option("--from-uid <uid>", "only consider reactions from this UID (case-insensitive match against fId of the type=3 notification)").option("--emoji <name>", "only consider this default reaction emoji name, e.g. [\u70B9\u8D5E] or \u70B9\u8D5E").option("--sticker-id <name>", "deprecated alias for --emoji").option("--timeout <seconds>", "give up after this many seconds (default 300)", parsePosInt("--timeout"), 300).option("--os <os>", "chat-channel slot (default: cfg.defaultChatOs ?? iPad)", parseChatOs).option("--no-daemon", "bypass any running personal daemon and wait on a direct connection on your own slot (also: MUC_NO_DAEMON=1)").option("--debug", "forward wire-level debug events to stderr");
     },
     run: async (cmd) => {
       const opts = cmd.opts();
@@ -28252,7 +28258,7 @@ function register29(program3) {
     description: "Tail incoming chat messages, filtered by sender / team / peer / keyword / regex / @-mention. Emit one line per match \u2014 NDJSON envelope under `--json`, human summary otherwise. Consumes a TCP slot.",
     streamSchema: STREAM_SCHEMA,
     configure: (cmd) => {
-      cmd.option("--from-uid <uid>", "only emit messages from this UID (repeat for OR; matched against fId, case-insensitive)", collect, []).option("--team <id>", "only emit messages in this team (repeat for OR)", collect, []).option("--peer <uid>", "only emit p2p messages with this peer UID (repeat for OR)", collect, []).option("--contains <text>", "only emit messages whose text contains this substring, case-insensitive (repeat for OR)", collect, []).option("--regex <pattern>", "only emit messages whose text matches this RE2-flavoured regex (repeat for OR)", collect, []).option("--type <n>", "only emit messages of this `type` field (default 1; repeat for OR)", collectInt("--type"), []).option("--subtype <n>", "only emit messages of this `subType` field (repeat for OR; default = any)", collectInt("--subtype"), []).option("--max <n>", "exit after emitting this many matching lines", parsePosInt("--max")).option("--at-me", "only emit group messages that @-mention you (mirrors the desktop SDK isAtMe: scene=team_g, fId\u2260self, atIds includes self uid). Implies excluding self.").option("--include-self", "do not filter out messages whose fId is your own UID").option("--include-reactions", "also emit type=3 sub=300/301 (reaction add/remove) frames").option("--include-offline", "also emit messages flushed via cid=offMsg on connect (default: only post-connect msg)").option("--os <os>", "chat-channel os slot (default: cfg.defaultChatOs ?? iOS)", parseChatOs).option("--no-daemon", "bypass any running personal daemon and listen on a direct connection on your own slot (also: MUC_NO_DAEMON=1)").option("--debug", "forward wire-level debug events to stderr");
+      cmd.option("--from-uid <uid>", "only emit messages from this UID (repeat for OR; matched against fId, case-insensitive)", collect, []).option("--team <id>", "only emit messages in this team (repeat for OR)", collect, []).option("--peer <uid>", "only emit p2p messages with this peer UID (repeat for OR)", collect, []).option("--contains <text>", "only emit messages whose text contains this substring, case-insensitive (repeat for OR)", collect, []).option("--regex <pattern>", "only emit messages whose text matches this RE2-flavoured regex (repeat for OR)", collect, []).option("--type <n>", "only emit messages of this `type` field (default 1; repeat for OR)", collectInt("--type"), []).option("--subtype <n>", "only emit messages of this `subType` field (repeat for OR; default = any)", collectInt("--subtype"), []).option("--max <n>", "exit after emitting this many matching lines", parsePosInt("--max")).option("--at-me", "only emit group messages that @-mention you (mirrors the desktop SDK isAtMe: scene=team_g, fId\u2260self, atIds includes self uid). Implies excluding self.").option("--include-self", "do not filter out messages whose fId is your own UID").option("--include-reactions", "also emit type=3 sub=300/301 (reaction add/remove) frames").option("--include-offline", "also emit messages flushed via cid=offMsg on connect (default: only post-connect msg)").option("--os <os>", "chat-channel slot (default: cfg.defaultChatOs ?? iPad)", parseChatOs).option("--no-daemon", "bypass any running personal daemon and listen on a direct connection on your own slot (also: MUC_NO_DAEMON=1)").option("--debug", "forward wire-level debug events to stderr");
     },
     run: async (cmd) => {
       const opts = cmd.opts();
@@ -28642,7 +28648,7 @@ var ChatBroker = class {
       );
     }
     this.cred = cred;
-    this.os = this.opts.os ?? this.cfg.defaultChatOs ?? "iOS";
+    this.os = this.opts.os ?? this.cfg.defaultChatOs ?? DEFAULT_CHAT_OS;
     this.startedAt = Date.now();
     ensureRuntimeDir(this.paths);
     writePid(this.paths, process.pid);
@@ -29220,7 +29226,7 @@ function register30(program3) {
     description: "Start the personal-account daemon in the foreground. Holds the chat socket for ordinary commands and writes raw daemon events.",
     output: StartOutput,
     configure: (cmd) => {
-      cmd.option("--os <os>", "chat-channel os slot (default: cfg.defaultChatOs ?? iOS)", parseChatOs).option("--on-kicked <policy>", "when another device takes the slot: pause, immediate, or a delay such as 30s/5m/2h/1d (default: 3m)", parseKickedRecoveryPolicy).option("--debug", "forward wire-level debug events to stderr");
+      cmd.option("--os <os>", "chat-channel slot (default: cfg.defaultChatOs ?? iPad)", parseChatOs).option("--on-kicked <policy>", "when another device takes the slot: pause, immediate, or a delay such as 30s/5m/2h/1d (default: 3m)", parseKickedRecoveryPolicy).option("--debug", "forward wire-level debug events to stderr");
     },
     run: async (cmd) => {
       const opts = cmd.opts();
@@ -33500,7 +33506,7 @@ return the JSON envelope and let the daemon send.
 Every TCP verb above rides the assistant daemon's existing socket \u2014 no
 slot taken, no device kicked. This exception applies only inside
 assistant backend turns. Ordinary Codex/MUC skills use personal daemon
-routing (\`muc daemon-start\`) and must follow their own warn-once rules.
+routing (\`muc daemon-start\`) and must follow the non-blocking iPad notice rules.
 
 ## Attachments and quotes
 
@@ -33957,7 +33963,7 @@ var AssistantDaemon = class {
     if (!usingAssistantProfile) {
       await assertNoPersonalDaemonConflict(this.cred.uid);
     }
-    this.os = this.opts.os ?? this.cfg.defaultChatOs ?? "iOS";
+    this.os = this.opts.os ?? this.cfg.defaultChatOs ?? DEFAULT_CHAT_OS;
     ensureRuntimeDir2();
     writePid2(process.pid);
     this.startedAt = Date.now();
@@ -36040,7 +36046,7 @@ function register32(program3) {
     description: "Start the assistant daemon in the foreground. Holds the chat socket on the chosen --os slot. v1 has no launchd integration; rerun under tmux/screen if you want it persistent.",
     output: StartOutput2,
     configure: (cmd) => {
-      cmd.option("--os <os>", "chat-channel os slot (default: cfg.defaultChatOs ?? iOS)", parseChatOs).option("--on-kicked <policy>", "when another device takes the slot: pause, immediate, or a delay such as 30s/5m/2h/1d (default: 3m)", parseKickedRecoveryPolicy).option("--debug", "forward wire-level debug events to stderr");
+      cmd.option("--os <os>", "chat-channel slot (default: cfg.defaultChatOs ?? iPad)", parseChatOs).option("--on-kicked <policy>", "when another device takes the slot: pause, immediate, or a delay such as 30s/5m/2h/1d (default: 3m)", parseKickedRecoveryPolicy).option("--debug", "forward wire-level debug events to stderr");
     },
     run: async (cmd) => {
       const opts = cmd.opts();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mu-cabin/muc-cli",
-  "version": "0.5.3",
+  "version": "0.5.5",
   "description": "Terminal client for MUC IM (com.meicloud.im.dh).",
   "license": "MIT",
   "type": "module",