@openscout/scout 0.2.108 → 0.2.110

package/dist/runtime/base-daemon.mjs

@@ -13324,16 +13324,16 @@ var require_mod5 = __commonJS((exports) => {
 
 // packages/runtime/src/base-daemon.ts
 import { spawn as spawn4 } from "child_process";
-import { existsSync as existsSync8, mkdirSync as mkdirSync6, openSync as openSync2, writeFileSync as writeFileSync5 } from "fs";
-import { homedir as homedir7, networkInterfaces as networkInterfaces2 } from "os";
-import { dirname as dirname7, join as join9, resolve as resolve3 } from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync6, openSync as openSync2, writeFileSync as writeFileSync5 } from "fs";
+import { homedir as homedir8, networkInterfaces as networkInterfaces2 } from "os";
+import { dirname as dirname8, join as join10, resolve as resolve4 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // packages/runtime/src/broker-process-manager.ts
 import { spawn as spawn2, spawnSync } from "child_process";
 import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync4, renameSync as renameSync2, writeFileSync as writeFileSync2 } from "fs";
 import { homedir as homedir5, networkInterfaces } from "os";
-import { basename as basename2, dirname as dirname3, join as join5, resolve as resolve2 } from "path";
+import { basename as basename2, dirname as dirname4, join as join5, resolve as resolve2 } from "path";
 import { fileURLToPath } from "url";
 
 // packages/runtime/src/broker-api.ts
@@ -13499,6 +13499,15 @@ async function requestBrokerWire(baseUrl, path, options) {
     }
   };
 }
+
+class ScoutBrokerHttpError extends Error {
+  status;
+  constructor(status, path, body) {
+    super(`${path} returned ${status}: ${body}`);
+    this.status = status;
+    this.name = "ScoutBrokerHttpError";
+  }
+}
 async function requestScoutBrokerJsonWithTrace(baseUrl, path, options = {}) {
   const { response, trace } = await requestBrokerWire(baseUrl, path, options);
   let parsed;
@@ -13515,7 +13524,7 @@ async function requestScoutBrokerJsonWithTrace(baseUrl, path, options = {}) {
     if (parsedJson && options.acceptErrorJson?.(parsed)) {
       return { value: parsed, trace };
     }
-    throw new Error(`${path} returned ${response.status}: ${response.text}`);
+    throw new ScoutBrokerHttpError(response.status, path, response.text);
   }
   if (parsedJson) {
     return { value: parsed, trace };
@@ -13787,11 +13796,18 @@ class NodeSqliteDatabaseAdapter {
 
 // packages/runtime/src/support-paths.ts
 import { homedir } from "os";
-import { join } from "path";
+import { dirname, join } from "path";
 var OPENSCOUT_RPC_CUTOVER_MARKER = "rpc-runtime-cutover-v1";
+function defaultOpenScoutSupportDirectory(home = homedir()) {
+  if (process.platform === "darwin") {
+    return join(home, "Library", "Application Support", "OpenScout");
+  }
+  const xdgDataHome = process.env.XDG_DATA_HOME?.trim();
+  return join(xdgDataHome || join(home, ".local", "share"), "openscout");
+}
 function resolveOpenScoutSupportPaths() {
   const home = homedir();
-  const supportDirectory = process.env.OPENSCOUT_SUPPORT_DIRECTORY ?? join(home, "Library", "Application Support", "OpenScout");
+  const supportDirectory = process.env.OPENSCOUT_SUPPORT_DIRECTORY ?? defaultOpenScoutSupportDirectory(home);
   const logsDirectory = join(supportDirectory, "logs");
   const runtimeDirectory = join(supportDirectory, "runtime");
   const catalogDirectory = join(supportDirectory, "catalog");
@@ -15242,7 +15258,7 @@ import {
   writeFileSync
 } from "fs";
 import { homedir as homedir3, hostname as osHostname } from "os";
-import { dirname, join as join3 } from "path";
+import { dirname as dirname2, join as join3 } from "path";
 
 // packages/runtime/src/node-identity.ts
 var NODE_CARD_TTL_MS = 24 * 60 * 60 * 1000;
@@ -15411,7 +15427,7 @@ function resolveWebPort() {
 // packages/runtime/src/tool-resolution.ts
 import { accessSync, constants, existsSync as existsSync4 } from "fs";
 import { homedir as homedir4 } from "os";
-import { basename, dirname as dirname2, join as join4, resolve } from "path";
+import { basename, dirname as dirname3, join as join4, resolve } from "path";
 var DEFAULT_COMMON_EXECUTABLE_DIRECTORIES = [
   join4(homedir4(), ".bun", "bin"),
   "/opt/homebrew/bin",
@@ -15511,7 +15527,7 @@ function resolveOpenScoutRepoRoot(options = {}) {
       if (existsSync4(scoutEntry) && existsSync4(runtimeEntry)) {
         return current;
       }
-      const parent = dirname2(current);
+      const parent = dirname3(current);
       if (parent === current) {
         break;
       }
@@ -15696,7 +15712,7 @@ function runtimePackageDir() {
   const fromGlobal = findGlobalRuntimeDir();
   if (fromGlobal)
     return fromGlobal;
-  const moduleDir = dirname3(fileURLToPath(import.meta.url));
+  const moduleDir = dirname4(fileURLToPath(import.meta.url));
   return resolve2(moduleDir, "..");
 }
 function isInstalledRuntimePackageDir(candidate) {
@@ -15730,7 +15746,7 @@ function findGlobalRuntimeDir() {
   return null;
 }
 function findBundledRuntimeDir() {
-  const moduleDir = dirname3(fileURLToPath(import.meta.url));
+  const moduleDir = dirname4(fileURLToPath(import.meta.url));
   return resolveBundledRuntimeDirFromModuleDir(moduleDir);
 }
 function resolveBundledRuntimeDirFromModuleDir(moduleDir) {
@@ -15749,7 +15765,7 @@ function resolveBundledRuntimeDirFromModuleDir(moduleDir) {
   return null;
 }
 function resolveSourceWorkspaceRuntimeDir(bundledPackageDir) {
-  const packagesDir = dirname3(bundledPackageDir);
+  const packagesDir = dirname4(bundledPackageDir);
   if (resolve2(packagesDir, "cli") !== resolve2(bundledPackageDir))
     return null;
   const runtimeDir = join5(packagesDir, "runtime");
@@ -15772,7 +15788,7 @@ function findWorkspaceRuntimeDir(startDir) {
     if (existsSync5(join5(candidate, "package.json")) && existsSync5(join5(candidate, "src"))) {
       return candidate;
     }
-    const parent = dirname3(current);
+    const parent = dirname4(current);
     if (parent === current)
       return null;
     current = parent;
@@ -15819,7 +15835,7 @@ function resolveBrokerServiceConfig() {
   const serviceAdapter = resolveBrokerServiceAdapter();
   const uid = typeof process.getuid === "function" ? process.getuid() : Number.parseInt(process.env.UID ?? "0", 10);
   const supportPaths = resolveOpenScoutSupportPaths();
-  const defaultSupportDir = join5(homedir5(), "Library", "Application Support", "OpenScout");
+  const defaultSupportDir = defaultOpenScoutSupportDirectory();
   const supportDirectory = isTmpPath(supportPaths.supportDirectory) ? defaultSupportDir : supportPaths.supportDirectory;
   const runtimeDirectory = join5(supportDirectory, "runtime");
   const logsDirectory = join5(supportDirectory, "logs", "broker");
@@ -15878,7 +15894,7 @@ function findWorkspaceRootFromRuntimeDir(runtimePackageDir2) {
     if (existsSync5(join5(current, "Cargo.toml")) && existsSync5(join5(current, "crates", "scoutd", "Cargo.toml"))) {
       return current;
     }
-    const parent = dirname3(current);
+    const parent = dirname4(current);
     if (parent === current)
       return null;
     current = parent;
@@ -15888,7 +15904,12 @@ function workspaceScoutdAllowed() {
   const raw = process.env.OPENSCOUT_ALLOW_WORKSPACE_SCOUTD?.trim().toLowerCase();
   return raw === "1" || raw === "true" || raw === "yes" || raw === "on";
 }
+function nativeSupervisorNotApplicableDetail(platform = process.platform) {
+  return platform === "linux" ? "native supervisor: not applicable on linux" : `native supervisor: not applicable on ${platform}`;
+}
 function resolveScoutdCommand(config = resolveBrokerServiceConfig()) {
+  if (process.platform !== "darwin")
+    return null;
   const explicit = resolveEnvExecutable(process.env.OPENSCOUT_SCOUTD_BIN);
   if (explicit) {
     return { path: explicit, source: "env" };
@@ -15901,7 +15922,7 @@ function resolveScoutdCommand(config = resolveBrokerServiceConfig()) {
     workspaceRoot ? join5(workspaceRoot, "packages", "cli", "bin", "scoutd") : null,
     workspaceRoot ? join5(workspaceRoot, "packages", "runtime", "bin", "scoutd") : null,
     join5(config.runtimeDirectory, "scoutd"),
-    join5(dirname3(config.runtimePackageDir), "scout", "bin", "scoutd")
+    join5(dirname4(config.runtimePackageDir), "scout", "bin", "scoutd")
   ];
   for (const candidate of packageCandidates) {
     const resolved = executableCandidate(candidate);
@@ -16031,6 +16052,8 @@ function normalizeNativeServiceStatus(input, config) {
       reachable: healthReachable,
       ok: healthOk,
       checkedAt: readNumber2(healthRecord.checkedAt) ?? Date.now(),
+      state: readString2(healthRecord.state),
+      durationMs: readNumber2(healthRecord.durationMs),
       transport: healthTransport,
       socketPath: config.brokerSocketPath,
       ...healthSocketFallbackError ? { socketFallbackError: healthSocketFallbackError } : {},
@@ -16142,6 +16165,9 @@ async function runScoutdServiceCommand(command, config, timeoutMs = SCOUTD_DEFAU
   }
   const scoutd = resolveScoutdCommand(config);
   if (!scoutd) {
+    if (process.platform !== "darwin") {
+      throw new Error(nativeSupervisorNotApplicableDetail());
+    }
     throw new Error("Unable to locate scoutd for broker service management. Build scoutd with `npm run scoutd:build`, install a package that includes scoutd, or set OPENSCOUT_SCOUTD_BIN.");
   }
   const stdout = await runScoutdJson(scoutd.path, command, nativeServiceEnvironment(config, scoutd.path), timeoutMs);
@@ -16410,7 +16436,7 @@ import {
   writeFileSync as writeFileSync3
 } from "fs";
 import { homedir as homedir6 } from "os";
-import { dirname as dirname4, join as join6 } from "path";
+import { dirname as dirname5, join as join6 } from "path";
 var SCOUT_PAIRING_SUPERVISOR_INTENT_FILE = "supervisor.json";
 var SCOUT_PAIRING_RUNTIME_PID_FILE = "runtime.pid";
 var SCOUT_PAIRING_SUPERVISOR_PID_FILE = "supervisor.pid";
@@ -16469,7 +16495,7 @@ function claimScoutPairingSupervision(pid = process.pid, supervisorPidPath = res
   if (currentPid && currentPid !== pid) {
     throw new Error(`Scout pairing is already supervised by pid ${currentPid}.`);
   }
-  mkdirSync3(dirname4(supervisorPidPath), { recursive: true });
+  mkdirSync3(dirname5(supervisorPidPath), { recursive: true });
   writeFileAtomically(supervisorPidPath, `${pid}
 `);
 }
@@ -16496,7 +16522,7 @@ function readPairingIntent(intentPath) {
   }
 }
 function writePairingIntent(intentPath, intent) {
-  mkdirSync3(dirname4(intentPath), { recursive: true });
+  mkdirSync3(dirname5(intentPath), { recursive: true });
   writeFileAtomically(intentPath, `${JSON.stringify(intent, null, 2)}
 `);
 }
@@ -16512,7 +16538,6 @@ function writeFileAtomically(path, contents) {
 function validRestartGeneration(value) {
   return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : 0;
 }
-
 // packages/runtime/src/scout-ascii-mark.ts
 var ORB_COLS = 60;
 var ORB_ROWS = 47;
@@ -17146,8 +17171,10 @@ function renderOpenScoutCaddyfile(config, siteImportsGlob) {
   const imports = siteImportsGlob ? `
 import ${JSON.stringify(siteImportsGlob)}
 ` : "";
+  const trust = config.scheme === "http" ? "" : `  skip_install_trust
+`;
   return `{
-  log {
+${trust}  log {
     level WARN
   }
 }
@@ -17292,7 +17319,7 @@ import {
   readFileSync as readFileSync6,
   rmSync as rmSync2
 } from "fs";
-import { delimiter, dirname as dirname5, isAbsolute, join as join8 } from "path";
+import { delimiter, dirname as dirname6, isAbsolute, join as join8 } from "path";
 class JetStreamBinaryMissingError extends Error {
   constructor(binary) {
     super(`nats-server binary "${binary}" was not found on PATH.
@@ -17418,7 +17445,7 @@ class NatsJetStreamSidecar {
       throw new JetStreamBinaryMissingError(this.config.serverBinary);
     }
     mkdirSync4(this.config.storeDirectory, { recursive: true });
-    mkdirSync4(dirname5(this.config.logPath), { recursive: true });
+    mkdirSync4(dirname6(this.config.logPath), { recursive: true });
     this.launch(binary);
     try {
       await this.waitUntilReady();
@@ -17565,7 +17592,25 @@ class NatsJetStreamSidecar {
 // packages/runtime/src/jetstream/publisher.ts
 import { randomUUID } from "crypto";
 import { mkdirSync as mkdirSync5, readFileSync as readFileSync7, renameSync as renameSync4, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname6 } from "path";
+import { dirname as dirname7 } from "path";
+
+// packages/protocol/src/chat-message-corrections.ts
+function readChatMessageCorrection(metadata) {
+  const value = metadata?.chatCorrection;
+  if (!value || typeof value !== "object")
+    return;
+  const item = value;
+  if (!Number.isSafeInteger(item.revision) || item.revision < 1 || typeof item.changedBy !== "string")
+    return;
+  return {
+    revision: item.revision,
+    changedBy: item.changedBy,
+    ...typeof item.editedAt === "number" && Number.isFinite(item.editedAt) ? { editedAt: item.editedAt } : {},
+    ...typeof item.deletedAt === "number" && Number.isFinite(item.deletedAt) ? { deletedAt: item.deletedAt } : {}
+  };
+}
+
+// packages/runtime/src/jetstream/publisher.ts
 var JETSTREAM_PUBLISHER_PROJECTION_ID = "jetstream-publisher";
 var JETSTREAM_PUBLISHER_PROJECTION_VERSION = 1;
 function readJetStreamPublisherProgress(path) {
@@ -17612,7 +17657,7 @@ function writeJetStreamPublisherProgress(path, barrierId, at) {
     barrierId,
     updatedAt: at
   };
-  mkdirSync5(dirname6(path), { recursive: true });
+  mkdirSync5(dirname7(path), { recursive: true });
   const temporary = `${path}.${process.pid}.tmp`;
   try {
     writeFileSync4(temporary, `${JSON.stringify(payload, null, 2)}
@@ -17879,7 +17924,7 @@ class JetStreamJournalPublisher {
   }
 }
 function isPublishableEntry(entry) {
-  return entry.kind === "message.record";
+  return entry.kind === "message.record" && !readChatMessageCorrection(entry.message.metadata);
 }
 function streamEventForEntry(entry, publisherNodeId) {
   if (!isPublishableEntry(entry))
@@ -17912,6 +17957,130 @@ class ScoutStreamDeduplicator {
     return this.seen.size;
   }
 }
+// packages/runtime/src/mesh-bridge-supervisor.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import { existsSync as existsSync8, readFileSync as readFileSync8, statSync } from "fs";
+import { homedir as homedir7 } from "os";
+import { join as join9, resolve as resolve3 } from "path";
+
+// packages/runtime/src/scout-bridge-command.ts
+var ENTRYPOINT = String.raw`(?:scout\.(?:mjs|ts|js)|\/bin\/scout|\/main\.mjs)`;
+var SUBCOMMAND = String.raw`\s+(mcp|channel|mesh\s+bridge)(?:\s|$)`;
+var RUNTIME = String.raw`(?:\S*\/)?(?:bun|node)(?:\s+(?!(?:-e|-p|--eval|--print)(?:[\s=]|$))-[\w-]+(?:=\S+)?)*`;
+var SCRIPT_PREFIX = String.raw`(?:[^-\s](?:(?!\s-|\.(?:[cm]?js|ts)\s).)*?)?`;
+var SCOUT_BRIDGE_COMMAND = new RegExp(String.raw`^(?:${RUNTIME}\s+${SCRIPT_PREFIX}|\S*?)${ENTRYPOINT}${SUBCOMMAND}`);
+var SCOUT_BRIDGE_BINARY = new RegExp(String.raw`^(?:${RUNTIME}\s+(?:${SCRIPT_PREFIX}\/)?|\S*\/)?scout-mcp(?:\s|$)`);
+function classifyScoutBridgeCommand(args) {
+  const lowered = args.trim().toLowerCase();
+  const match = SCOUT_BRIDGE_COMMAND.exec(lowered);
+  if (match)
+    return match[1].startsWith("mesh") ? "mesh" : match[1];
+  return SCOUT_BRIDGE_BINARY.test(lowered) ? "mcp" : null;
+}
+function isMeshBridgeCommand(args) {
+  return classifyScoutBridgeCommand(args) === "mesh";
+}
+
+// packages/runtime/src/mesh-bridge-supervisor.ts
+var MESH_BRIDGE_CONFIG_FILENAME = "mcp-bridge.json";
+var LEGACY_MESH_BRIDGE_LAUNCH_AGENT_LABEL = "app.openscout.mcp-bridge";
+var MESH_BRIDGE_EXIT_UNCONFIGURED = 78;
+function meshBridgeConfigPath(supportDirectory) {
+  return join9(supportDirectory, MESH_BRIDGE_CONFIG_FILENAME);
+}
+function legacyMeshBridgeLaunchAgentPath(home = homedir7()) {
+  return join9(home, "Library", "LaunchAgents", `${LEGACY_MESH_BRIDGE_LAUNCH_AGENT_LABEL}.plist`);
+}
+function resolveMeshBridgeDesiredState(input) {
+  if (input.env.OPENSCOUT_BASE_MESH_BRIDGE_ENABLED === "0") {
+    return { run: false, reason: "disabled-by-env" };
+  }
+  const configPath = meshBridgeConfigPath(input.supportDirectory);
+  if (!existsSync8(configPath)) {
+    return { run: false, reason: "no-config" };
+  }
+  let configMtimeMs;
+  let parsed;
+  try {
+    configMtimeMs = statSync(configPath).mtimeMs;
+    parsed = JSON.parse(readFileSync8(configPath, "utf8"));
+  } catch {
+    return { run: false, reason: "invalid-config" };
+  }
+  if (parsed && typeof parsed === "object" && parsed.enabled === false) {
+    return { run: false, reason: "disabled-in-config" };
+  }
+  if (existsSync8(legacyMeshBridgeLaunchAgentPath(input.home))) {
+    return { run: false, reason: "legacy-launch-agent" };
+  }
+  return { run: true, configPath, configMtimeMs };
+}
+function resolveMeshBridgeEntrypoint(input) {
+  const exists = input.exists ?? existsSync8;
+  const home = input.home ?? homedir7();
+  const repo = input.repoRoot;
+  const source = repo ? join9(repo, "apps", "desktop", "bin", "scout.ts") : null;
+  const candidates = [
+    input.env.OPENSCOUT_MESH_BRIDGE_BIN?.trim() || null,
+    input.serviceMode === "dev" ? source : null,
+    repo ? join9(repo, "packages", "cli", "dist", "main.mjs") : null,
+    resolve3(input.moduleDirectory, "..", "main.mjs"),
+    join9(home, ".bun", "install", "global", "node_modules", "@openscout", "scout", "dist", "main.mjs")
+  ].filter((candidate) => Boolean(candidate));
+  return candidates.find((candidate) => exists(candidate)) ?? null;
+}
+function meshBridgeArgs(entrypoint, configPath) {
+  return [entrypoint, "mesh", "bridge", "--config", configPath];
+}
+function meshBridgeStatePath(supportDirectory) {
+  return join9(supportDirectory, "runtime", "mesh-bridge.json");
+}
+function readProcessIdentity(pid) {
+  const result = spawnSync2("ps", ["-o", "lstart=,args=", "-p", String(pid)], { encoding: "utf8" });
+  if (result.status !== 0)
+    return null;
+  const match = /^\s*(\S+\s+\S+\s+\S+\s+\S+\s+\S+)\s+(.+)$/.exec(result.stdout.trim());
+  return match ? { startedAt: match[1], args: match[2] } : null;
+}
+function findRecordedLiveMeshBridgePid(supportDirectory, readIdentity = readProcessIdentity) {
+  let recorded;
+  try {
+    recorded = JSON.parse(readFileSync8(meshBridgeStatePath(supportDirectory), "utf8"));
+  } catch {
+    return null;
+  }
+  const { pid, processStartedAt } = recorded;
+  if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 1)
+    return null;
+  if (typeof processStartedAt !== "string" || !processStartedAt)
+    return null;
+  const identity = readIdentity(pid);
+  if (!identity || identity.startedAt !== processStartedAt)
+    return null;
+  return isMeshBridgeCommand(identity.args) ? pid : null;
+}
+function inspectLaunchdJob(target, run = runLaunchctl) {
+  const result = run(["print", target]);
+  if (result.status === 0)
+    return "loaded";
+  if (result.status === 113 || /could not find service/i.test(result.output))
+    return "absent";
+  return "unknown";
+}
+function legacyMeshBridgeLaunchdTarget(uid = process.getuid?.() ?? 501) {
+  return `gui/${uid}/${LEGACY_MESH_BRIDGE_LAUNCH_AGENT_LABEL}`;
+}
+function runLaunchctlProbe(args, spawn4) {
+  if (process.platform !== "darwin") {
+    return { status: 113, output: "Could not find service" };
+  }
+  const result = spawn4 ? spawn4("launchctl", args, { encoding: "utf8" }) : spawnSync2("launchctl", args, { encoding: "utf8" });
+  return { status: result.status, output: `${result.stdout ?? ""}${result.stderr ?? ""}` };
+}
+function runLaunchctl(args) {
+  return runLaunchctlProbe(args);
+}
+
 // packages/runtime/src/base-daemon.ts
 var RESTART_MIN_DELAY_MS = 1000;
 var RESTART_MAX_DELAY_MS = 30000;
@@ -17921,6 +18090,10 @@ var CHILD_SHUTDOWN_TIMEOUT_MS = 15000;
 var WEB_START_RETRY_MS = 5000;
 var PAIRING_RECONCILE_INTERVAL_MS = 500;
 var PAIRING_STOP_TIMEOUT_MS = 5000;
+var MESH_BRIDGE_RECONCILE_INTERVAL_MS = 5000;
+var MESH_BRIDGE_STOP_TIMEOUT_MS = 6000;
+var MESH_BRIDGE_UNCONFIGURED_RETRY_MS = 5 * 60000;
+var MESH_BRIDGE_STABLE_AFTER_MS = 60000;
 var MENU_BUNDLE_ID = "app.openscout.scout.menu";
 var PROCESS_NAME = "scout-base";
 var BROKER_PROCESS_NAME = "scout-broker";
@@ -17944,6 +18117,15 @@ var pairingRestartGeneration = null;
 var pairingRestartDelayMs = RESTART_MIN_DELAY_MS;
 var pairingNextStartAt = 0;
 var pairingSupervisionClaimed = false;
+var meshBridgeProcess = null;
+var meshBridgeConfigMtimeMs = 0;
+var meshBridgeRestartDelayMs = RESTART_MIN_DELAY_MS;
+var meshBridgeNextStartAt = 0;
+var meshBridgeReconcileTimer = null;
+var meshBridgeLastIdleReason = null;
+var meshBridgeReconcileInFlight = false;
+var meshBridgeStartedAt = 0;
+var meshBridgeUnconfiguredMtimeMs = null;
 var parentPid = Number.parseInt(process.env.OPENSCOUT_PARENT_PID ?? "0", 10);
 var config = resolveBrokerServiceConfig();
 var brokerControlUrl = buildLocalBrokerControlUrl(config.brokerHost, config.brokerPort);
@@ -17996,12 +18178,12 @@ function ensureDirectory(path) {
   mkdirSync6(path, { recursive: true });
 }
 function logFile(name) {
-  const dir = join9(config.supportDirectory, "logs", "base");
+  const dir = join10(config.supportDirectory, "logs", "base");
   ensureDirectory(dir);
-  return openSync2(join9(dir, name), "a");
+  return openSync2(join10(dir, name), "a");
 }
 function runtimeEntrypoint(config2) {
-  return join9(config2.runtimePackageDir, "bin", "openscout-runtime.mjs");
+  return join10(config2.runtimePackageDir, "bin", "openscout-runtime.mjs");
 }
 function spawnBroker() {
   if (shuttingDown || brokerProcess) {
@@ -18083,10 +18265,10 @@ function resolveEdgeScheme() {
   if (value === "http" || value === "https" || value === "both") {
     return value;
   }
-  return "http";
+  return "both";
 }
 function forwardedProtoForEdgeScheme(scheme) {
-  return scheme === "http" ? "http" : "https";
+  return scheme === "https" ? "https" : "http";
 }
 function resolveEdgeConfig() {
   const portalHost = process.env.OPENSCOUT_WEB_PORTAL_HOST?.trim() || DEFAULT_SCOUT_WEB_PORTAL_HOST;
@@ -18107,9 +18289,9 @@ function resolveEdgeConfig() {
   });
 }
 function resolveLocalEdgeCaddyfilePath() {
-  const dir = join9(homedir7(), ".scout", "local-edge");
+  const dir = join10(homedir8(), ".scout", "local-edge");
   ensureDirectory(dir);
-  return join9(dir, "Caddyfile");
+  return join10(dir, "Caddyfile");
 }
 function resolveCaddyExecutable() {
   return process.env.OPENSCOUT_CADDY_BIN?.trim() || "caddy";
@@ -18180,9 +18362,9 @@ function startLocalEdge() {
   const edgeConfig = resolveEdgeConfig();
   const schemes = edgeConfig.scheme === "both" ? ["http", "https"] : [edgeConfig.scheme];
   const caddyfilePath = resolveLocalEdgeCaddyfilePath();
-  const sitesDirectory = join9(dirname7(caddyfilePath), "sites");
+  const sitesDirectory = join10(dirname8(caddyfilePath), "sites");
   ensureDirectory(sitesDirectory);
-  writeFileSync5(caddyfilePath, renderOpenScoutCaddyfile(edgeConfig, join9(sitesDirectory, "*.caddy")), "utf8");
+  writeFileSync5(caddyfilePath, renderOpenScoutCaddyfile(edgeConfig, join10(sitesDirectory, "*.caddy")), "utf8");
   mdnsProcesses = schemes.flatMap((scheme) => {
     const edgePort = scheme === "https" ? 443 : 80;
     const suffix = scheme.toUpperCase();
@@ -18284,18 +18466,18 @@ function scheduleWebStartRetry() {
   webStartRetryTimer.unref();
 }
 function findRepoMenuBundle() {
-  let current = dirname7(fileURLToPath2(import.meta.url));
+  let current = dirname8(fileURLToPath2(import.meta.url));
   while (true) {
-    const distRoot = resolve3(current, "apps", "macos", "dist");
+    const distRoot = resolve4(current, "apps", "macos", "dist");
     const candidates = [
-      resolve3(distRoot, "Scout.app", "Contents", "Library", "LoginItems", "ScoutMenu.app"),
-      resolve3(distRoot, "ScoutMenu.app")
+      resolve4(distRoot, "Scout.app", "Contents", "Library", "LoginItems", "ScoutMenu.app"),
+      resolve4(distRoot, "ScoutMenu.app")
     ];
     for (const candidate of candidates) {
-      if (existsSync8(candidate))
+      if (existsSync9(candidate))
         return candidate;
     }
-    const parent = dirname7(current);
+    const parent = dirname8(current);
     if (parent === current) {
       return null;
     }
@@ -18307,7 +18489,7 @@ function startMenuBarApp() {
     return;
   }
   const explicitBundle = process.env.OPENSCOUT_MENU_BUNDLE_PATH?.trim();
-  const repoBundle = explicitBundle && existsSync8(explicitBundle) ? explicitBundle : findRepoMenuBundle();
+  const repoBundle = explicitBundle && existsSync9(explicitBundle) ? explicitBundle : findRepoMenuBundle();
   const args = repoBundle ? [repoBundle] : ["-b", MENU_BUNDLE_ID];
   const child = spawn4("open", args, {
     stdio: ["ignore", logFile("menu.stdout.log"), logFile("menu.stderr.log")]
@@ -18321,7 +18503,7 @@ function startMenuBarApp() {
   });
 }
 function resolvePairingControllerCommand() {
-  const moduleDirectory = dirname7(fileURLToPath2(import.meta.url));
+  const moduleDirectory = dirname8(fileURLToPath2(import.meta.url));
   const repoRoot = resolveOpenScoutRepoRoot({
     startDirectories: [
       process.env.OPENSCOUT_SETUP_CWD,
@@ -18333,14 +18515,14 @@ function resolvePairingControllerCommand() {
   const explicit = process.env.OPENSCOUT_PAIRING_RUNTIME_CONTROLLER_BIN?.trim();
   const candidates = [
     explicit,
-    repoRoot ? join9(repoRoot, "packages", "cli", "dist", "pairing-runtime-controller.mjs") : null,
-    repoRoot ? join9(repoRoot, "packages", "web", "dist", "pairing-runtime-controller.mjs") : null,
-    repoRoot ? join9(repoRoot, "packages", "web", "server", "pairing-runtime-controller.ts") : null,
-    resolve3(moduleDirectory, "..", "pairing-runtime-controller.mjs"),
-    join9(homedir7(), ".bun", "install", "global", "node_modules", "@openscout", "scout", "dist", "pairing-runtime-controller.mjs"),
-    join9(homedir7(), ".bun", "node_modules", "@openscout", "scout", "dist", "pairing-runtime-controller.mjs")
+    repoRoot ? join10(repoRoot, "packages", "cli", "dist", "pairing-runtime-controller.mjs") : null,
+    repoRoot ? join10(repoRoot, "packages", "web", "dist", "pairing-runtime-controller.mjs") : null,
+    repoRoot ? join10(repoRoot, "packages", "web", "server", "pairing-runtime-controller.ts") : null,
+    resolve4(moduleDirectory, "..", "pairing-runtime-controller.mjs"),
+    join10(homedir8(), ".bun", "install", "global", "node_modules", "@openscout", "scout", "dist", "pairing-runtime-controller.mjs"),
+    join10(homedir8(), ".bun", "node_modules", "@openscout", "scout", "dist", "pairing-runtime-controller.mjs")
   ].filter((candidate) => Boolean(candidate));
-  const entrypoint = candidates.find((candidate) => existsSync8(candidate));
+  const entrypoint = candidates.find((candidate) => existsSync9(candidate));
   if (!entrypoint)
     return null;
   if (explicit === entrypoint && !/\.(?:[cm]?js|ts)$/.test(entrypoint)) {
@@ -18491,6 +18673,174 @@ function startPairingSupervision() {
   pairingReconcileTimer.unref();
   reconcilePairingController();
 }
+function writeMeshBridgeState(state) {
+  try {
+    ensureDirectory(join10(config.supportDirectory, "runtime"));
+    writeFileSync5(meshBridgeStatePath(config.supportDirectory), `${JSON.stringify({ ...state, updatedAt: Date.now() }, null, 2)}
+`);
+  } catch (error) {
+    warn("could not record mesh bridge state", error instanceof Error ? error.message : String(error));
+  }
+}
+function spawnMeshBridge(desired) {
+  if (shuttingDown || meshBridgeProcess)
+    return;
+  const moduleDirectory = dirname8(fileURLToPath2(import.meta.url));
+  const repoRoot = resolveOpenScoutRepoRoot({
+    startDirectories: [process.env.OPENSCOUT_SETUP_CWD, process.cwd(), moduleDirectory]
+  });
+  const entrypoint = resolveMeshBridgeEntrypoint({
+    repoRoot,
+    moduleDirectory,
+    serviceMode: config.mode,
+    env: process.env
+  });
+  const bun = resolveBunExecutable();
+  if (!entrypoint || !bun) {
+    warn("mesh bridge entrypoint or Bun executable could not be resolved");
+    meshBridgeNextStartAt = Date.now() + meshBridgeRestartDelayMs;
+    meshBridgeRestartDelayMs = Math.min(meshBridgeRestartDelayMs * 2, RESTART_MAX_DELAY_MS);
+    return;
+  }
+  const child = spawn4(bun.path, meshBridgeArgs(entrypoint, desired.configPath), {
+    cwd: repoRoot ?? process.cwd(),
+    env: { ...process.env, OPENSCOUT_PARENT_PID: String(process.pid) },
+    stdio: ["ignore", logFile("mesh-bridge.stdout.log"), logFile("mesh-bridge.stderr.log")]
+  });
+  meshBridgeProcess = child;
+  meshBridgeStartedAt = Date.now();
+  meshBridgeUnconfiguredMtimeMs = null;
+  meshBridgeConfigMtimeMs = desired.configMtimeMs;
+  meshBridgeLastIdleReason = null;
+  log("mesh bridge started", { pid: child.pid, entrypoint });
+  const processStartedAt = child.pid ? readProcessIdentity(child.pid)?.startedAt ?? null : null;
+  writeMeshBridgeState({
+    state: "running",
+    pid: child.pid ?? null,
+    processStartedAt,
+    entrypoint,
+    configPath: desired.configPath,
+    startedAt: Date.now()
+  });
+  const settle = (code, signal, error) => {
+    if (meshBridgeProcess !== child)
+      return;
+    meshBridgeProcess = null;
+    if (shuttingDown)
+      return;
+    if (code === MESH_BRIDGE_EXIT_UNCONFIGURED) {
+      warn("mesh bridge has no relay token; retrying later", { retryInMs: MESH_BRIDGE_UNCONFIGURED_RETRY_MS });
+      meshBridgeNextStartAt = Date.now() + MESH_BRIDGE_UNCONFIGURED_RETRY_MS;
+      meshBridgeUnconfiguredMtimeMs = desired.configMtimeMs;
+      writeMeshBridgeState({ state: "unconfigured", pid: null, reason: "no relay token" });
+      return;
+    }
+    warn(error ? "mesh bridge failed to start" : "mesh bridge exited", error ?? { code, signal });
+    meshBridgeNextStartAt = Date.now() + meshBridgeRestartDelayMs;
+    meshBridgeRestartDelayMs = Math.min(meshBridgeRestartDelayMs * 2, RESTART_MAX_DELAY_MS);
+    writeMeshBridgeState({ state: "restarting", pid: null, lastExit: { code, signal }, nextStartAt: meshBridgeNextStartAt });
+  };
+  child.once("error", (error) => settle(null, null, error.message));
+  child.once("exit", (code, signal) => settle(code, signal));
+}
+async function reconcileMeshBridge() {
+  if (shuttingDown || meshBridgeReconcileInFlight)
+    return;
+  meshBridgeReconcileInFlight = true;
+  try {
+    await reconcileMeshBridgeOnce();
+  } catch (error) {
+    warn("mesh bridge reconciliation failed", error instanceof Error ? error.message : String(error));
+  } finally {
+    meshBridgeReconcileInFlight = false;
+  }
+}
+async function reconcileMeshBridgeOnce() {
+  const desired = resolveMeshBridgeDesiredState({ supportDirectory: config.supportDirectory, env: process.env });
+  const running = meshBridgeProcess && !isChildExited(meshBridgeProcess) ? meshBridgeProcess : null;
+  if (!desired.run) {
+    if (running) {
+      log("stopping mesh bridge", { reason: desired.reason });
+      meshBridgeProcess = null;
+      await terminateChildProcess(running, "mesh bridge", MESH_BRIDGE_STOP_TIMEOUT_MS);
+    }
+    if (meshBridgeLastIdleReason !== desired.reason) {
+      meshBridgeLastIdleReason = desired.reason;
+      if (desired.reason === "legacy-launch-agent") {
+        warn("mesh bridge is still installed as its own LaunchAgent; run `scout mesh bridge install` to hand it to scout-base");
+      }
+      writeMeshBridgeState({ state: "idle", pid: null, reason: desired.reason });
+    }
+    meshBridgeNextStartAt = 0;
+    meshBridgeRestartDelayMs = RESTART_MIN_DELAY_MS;
+    return;
+  }
+  if (running) {
+    if (desired.configMtimeMs !== meshBridgeConfigMtimeMs) {
+      log("mesh bridge config changed; restarting it");
+      meshBridgeProcess = null;
+      await terminateChildProcess(running, "mesh bridge", MESH_BRIDGE_STOP_TIMEOUT_MS);
+      meshBridgeNextStartAt = 0;
+    } else {
+      if (Date.now() - meshBridgeStartedAt >= MESH_BRIDGE_STABLE_AFTER_MS) {
+        meshBridgeRestartDelayMs = RESTART_MIN_DELAY_MS;
+      }
+      return;
+    }
+  }
+  if (meshBridgeUnconfiguredMtimeMs !== null && desired.configMtimeMs !== meshBridgeUnconfiguredMtimeMs) {
+    meshBridgeUnconfiguredMtimeMs = null;
+    meshBridgeNextStartAt = 0;
+  }
+  if (shuttingDown || Date.now() < meshBridgeNextStartAt)
+    return;
+  if (process.platform === "darwin") {
+    const legacyJob = inspectLaunchdJob(legacyMeshBridgeLaunchdTarget());
+    if (legacyJob !== "absent") {
+      const reason = `legacy-launchd-job-${legacyJob}`;
+      if (meshBridgeLastIdleReason !== reason) {
+        meshBridgeLastIdleReason = reason;
+        warn("mesh bridge deferred: the legacy launchd job is not confirmed absent", { state: legacyJob });
+        writeMeshBridgeState({ state: "idle", pid: null, reason });
+      }
+      return;
+    }
+  }
+  await fencePreviousMeshBridge();
+  if (shuttingDown)
+    return;
+  spawnMeshBridge(desired);
+}
+async function fencePreviousMeshBridge() {
+  const pid = findRecordedLiveMeshBridgePid(config.supportDirectory);
+  if (pid === null || pid === process.pid)
+    return;
+  warn("stopping a mesh bridge left by a previous scout-base", { pid });
+  try {
+    process.kill(pid, "SIGTERM");
+  } catch {
+    return;
+  }
+  const deadline = Date.now() + MESH_BRIDGE_STOP_TIMEOUT_MS;
+  while (Date.now() < deadline) {
+    try {
+      process.kill(pid, 0);
+    } catch {
+      return;
+    }
+    await sleep(100);
+  }
+  try {
+    process.kill(pid, "SIGKILL");
+  } catch {}
+}
+function startMeshBridgeSupervision() {
+  meshBridgeReconcileTimer = setInterval(() => {
+    reconcileMeshBridge();
+  }, MESH_BRIDGE_RECONCILE_INTERVAL_MS);
+  meshBridgeReconcileTimer.unref();
+  reconcileMeshBridge();
+}
 function isChildExited(child) {
   return child.exitCode !== null || child.signalCode !== null;
 }
@@ -18498,15 +18848,15 @@ function waitForChildExit(child, timeoutMs) {
   if (isChildExited(child)) {
     return Promise.resolve(true);
   }
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     const timeout = setTimeout(() => {
       child.off("exit", onExit);
-      resolve4(false);
+      resolve5(false);
     }, timeoutMs);
     timeout.unref();
     const onExit = () => {
       clearTimeout(timeout);
-      resolve4(true);
+      resolve5(true);
     };
     child.once("exit", onExit);
   });
@@ -18550,10 +18900,15 @@ async function shutdown(exitCode = 0) {
     clearInterval(pairingReconcileTimer);
     pairingReconcileTimer = null;
   }
+  if (meshBridgeReconcileTimer) {
+    clearInterval(meshBridgeReconcileTimer);
+    meshBridgeReconcileTimer = null;
+  }
   const activeCaddyProcess = caddyProcess;
   stopEdgeProcesses();
   await Promise.all([
     stopPairingController(),
+    terminateChildProcess(meshBridgeProcess, "mesh bridge", MESH_BRIDGE_STOP_TIMEOUT_MS),
     terminateChildProcess(brokerProcess, "broker"),
     terminateChildProcess(activeCaddyProcess, "local edge", 2000)
   ]);
@@ -18612,5 +18967,6 @@ await startJetStreamSidecar();
 spawnBroker();
 startLocalEdge();
 startPairingSupervision();
+startMeshBridgeSupervision();
 startMenuBarApp();
 startWebWhenBrokerIsReady();