@openscout/scout 0.2.79 → 0.2.80

package/dist/runtime/broker-daemon.mjs

@@ -23925,7 +23925,7 @@ var init_chunk_PEYQIXJW = __esm(() => {
 });
 
 // node_modules/.bun/varlock@1.16.0/node_modules/varlock/dist/chunk-QUJCQE4P.js
-import fs9, { readFileSync as readFileSync18, existsSync as existsSync37 } from "fs";
+import fs9, { readFileSync as readFileSync19, existsSync as existsSync37 } from "fs";
 import crypto3, { createHash as createHash9 } from "crypto";
 import net2 from "net";
 import { mkdir as mkdir10, writeFile as writeFile8, rename as rename2, readdir as readdir4, readFile as readFile10, rm as rm5 } from "fs/promises";
@@ -23960,7 +23960,7 @@ function writeBackValue(itemKey, newValueStr, sourceFilePath) {
 }
 function getParentPidViaProc(pid) {
   try {
-    const stat7 = readFileSync18(`/proc/${pid}/stat`, "utf8");
+    const stat7 = readFileSync19(`/proc/${pid}/stat`, "utf8");
     const after = stat7.slice(stat7.lastIndexOf(")") + 2);
     const fields = after.split(" ");
     const ppid = Number(fields[1]);
@@ -46088,6 +46088,9 @@ var METADATA_CACHE_LIMIT4 = 512;
 var TOOL_CALL_STATE_KEY2 = "kimiToolCallSummaries";
 var TOOL_CALL_STATE_LIMIT2 = 512;
 var metadataCache4 = new Map;
+function trimmedString(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
 function recordValue(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
@@ -46186,19 +46189,27 @@ function walkRecentKimiWireFiles(root, scope) {
   return found.sort((left, right) => right.mtimeMs - left.mtimeMs).slice(0, discoveryLimit5(scope));
 }
 function readKimiTranscriptMetadata(file2) {
+  const agentId = basename5(dirname3(file2.path));
+  const sessionDirectory = dirname3(dirname3(dirname3(file2.path)));
+  const statePath = join8(sessionDirectory, "state.json");
+  let stateMtimeMs = null;
+  let stateSize = null;
+  try {
+    const stateStat = statSync5(statePath);
+    stateMtimeMs = stateStat.mtimeMs;
+    stateSize = stateStat.size;
+  } catch {}
   const cached2 = metadataCache4.get(file2.path);
-  if (cached2 && cached2.mtimeMs === file2.mtimeMs && cached2.size === file2.size) {
+  if (cached2 && cached2.mtimeMs === file2.mtimeMs && cached2.size === file2.size && cached2.stateMtimeMs === stateMtimeMs && cached2.stateSize === stateSize) {
     return cached2;
   }
-  const agentId = basename5(dirname3(file2.path));
-  const sessionDirectory = dirname3(dirname3(dirname3(file2.path)));
   const parentSessionId = basename5(sessionDirectory);
   let cwd = null;
   let title = null;
   try {
-    const state = recordValue(JSON.parse(readFileSync3(join8(sessionDirectory, "state.json"), "utf8")));
-    cwd = typeof state?.workDir === "string" && state.workDir.trim() ? state.workDir.trim() : null;
-    title = typeof state?.title === "string" && state.title.trim() ? state.title.trim() : null;
+    const state = recordValue(JSON.parse(readFileSync3(statePath, "utf8")));
+    cwd = trimmedString(state?.cwd) ?? trimmedString(state?.workDir);
+    title = trimmedString(state?.title);
   } catch {}
   const metadata = {
     cwd,
@@ -46208,7 +46219,7 @@ function readKimiTranscriptMetadata(file2) {
     title
   };
   metadataCache4.delete(file2.path);
-  metadataCache4.set(file2.path, { ...file2, ...metadata });
+  metadataCache4.set(file2.path, { ...file2, stateMtimeMs, stateSize, ...metadata });
   while (metadataCache4.size > METADATA_CACHE_LIMIT4) {
     const oldest = metadataCache4.keys().next().value;
     if (!oldest)
@@ -46217,6 +46228,10 @@ function readKimiTranscriptMetadata(file2) {
   }
   return metadata;
 }
+function workspaceProject(wirePath) {
+  const workspaceDirectory = basename5(dirname3(dirname3(dirname3(dirname3(wirePath)))));
+  return trimmedString(/^wd_(.+)_[0-9a-f]{6,}$/u.exec(workspaceDirectory)?.[1]);
+}
 function discoverKimiTranscripts(scope) {
   return walkRecentKimiWireFiles(kimiSessionsRoot(), scope).map((file2) => {
     const metadata = readKimiTranscriptMetadata(file2);
@@ -46225,7 +46240,7 @@ function discoverKimiTranscripts(scope) {
       transcriptPath: file2.path,
       sessionId: metadata.sessionId,
       cwd: metadata.cwd,
-      project: metadata.cwd ? basename5(metadata.cwd) : "(unknown)",
+      project: (metadata.cwd ? basename5(metadata.cwd) : workspaceProject(file2.path)) ?? "(unknown)",
       harness: "unattributed",
       mtimeMs: file2.mtimeMs,
       size: file2.size
@@ -50871,10 +50886,26 @@ function candidateAliases(candidate) {
   ];
   return Array.from(new Set(aliases.map((alias) => trimIdentityPrefix(alias)).filter(Boolean)));
 }
+var explicitAliasesCache = new WeakMap;
+var aliasKeysCache = new WeakMap;
+var canonicalIdentityCache = new WeakMap;
 function explicitCandidateAliases(candidate) {
+  const cached2 = explicitAliasesCache.get(candidate);
+  if (cached2)
+    return cached2;
   const canonical = candidateCanonicalIdentity(candidate);
   const implicitAliases = canonical?.definitionId === OPENSCOUT_COORDINATOR_AGENT_ID ? [SCOUT_DISPATCHER_AGENT_ID] : [];
-  return Array.from(new Set([...candidate.aliases ?? [], ...implicitAliases].map((alias) => normalizeAgentIdentitySegment(trimIdentityPrefix(alias))).filter(Boolean)));
+  const aliases = Array.from(new Set([...candidate.aliases ?? [], ...implicitAliases].map((alias) => normalizeAgentIdentitySegment(trimIdentityPrefix(alias))).filter(Boolean)));
+  explicitAliasesCache.set(candidate, aliases);
+  return aliases;
+}
+function candidateAliasKeys(candidate) {
+  const cached2 = aliasKeysCache.get(candidate);
+  if (cached2)
+    return cached2;
+  const keys = explicitCandidateAliases(candidate).map(canonicalizeAliasValue);
+  aliasKeysCache.set(candidate, keys);
+  return keys;
 }
 function canonicalizeAliasValue(value) {
   const parsed = parseAgentIdentity(value.startsWith("@") ? value : `@${value}`);
@@ -50891,7 +50922,10 @@ function identityAliasKeys(identity2) {
   ].filter(Boolean)));
 }
 function candidateCanonicalIdentity(candidate) {
-  return constructAgentIdentity({
+  if (canonicalIdentityCache.has(candidate)) {
+    return canonicalIdentityCache.get(candidate) ?? null;
+  }
+  const canonical = constructAgentIdentity({
     definitionId: candidate.definitionId || candidate.agentId,
     nodeQualifier: candidate.nodeQualifier,
     workspaceQualifier: candidate.workspaceQualifier,
@@ -50899,6 +50933,8 @@ function candidateCanonicalIdentity(candidate) {
     harness: candidate.harness,
     model: candidate.model
   });
+  canonicalIdentityCache.set(candidate, canonical);
+  return canonical;
 }
 function candidateDimensionValue(candidate, dimension) {
   const canonical = candidateCanonicalIdentity(candidate);
@@ -50948,8 +50984,8 @@ function definitionMatchesIdentity(identityDefinitionId, candidateDefinitionId)
 }
 function agentIdentityMatches(identity2, candidate) {
   const aliasKeys = identityAliasKeys(identity2);
-  const candidateAliasKeys = explicitCandidateAliases(candidate).map(canonicalizeAliasValue);
-  if (aliasKeys.some((key) => candidateAliasKeys.includes(key))) {
+  const candidateAliasKeys2 = explicitCandidateAliases(candidate).map(canonicalizeAliasValue);
+  if (aliasKeys.some((key) => candidateAliasKeys2.includes(key))) {
     return true;
   }
   const canonical = canonicalizeIdentity({
@@ -50987,8 +51023,8 @@ function resolveAgentIdentity(identity2, candidates) {
 function diagnoseAgentIdentity(identity2, candidates) {
   const aliasKeys = identityAliasKeys(identity2);
   const exactAliasMatches = candidates.filter((candidate) => {
-    const candidateAliasKeys = explicitCandidateAliases(candidate).map(canonicalizeAliasValue);
-    return aliasKeys.some((key) => candidateAliasKeys.includes(key));
+    const keys = candidateAliasKeys(candidate);
+    return keys.length > 0 && aliasKeys.some((key) => keys.includes(key));
   });
   if (exactAliasMatches.length === 1) {
     return { kind: "resolved", match: exactAliasMatches[0] };
@@ -51029,15 +51065,32 @@ function buildIdentitySubset(candidate, dimensions) {
     ...dimensions.includes("node") && canonical.nodeQualifier ? { nodeQualifier: canonical.nodeQualifier } : {}
   });
 }
+var peersByDefinitionCache = new WeakMap;
+function peersByDefinitionId(candidates) {
+  const cached2 = peersByDefinitionCache.get(candidates);
+  if (cached2)
+    return cached2;
+  const groups = new Map;
+  for (const candidate of candidates) {
+    const canonical = candidateCanonicalIdentity(candidate);
+    if (!canonical)
+      continue;
+    const group = groups.get(canonical.definitionId);
+    if (group) {
+      group.push(candidate);
+    } else {
+      groups.set(canonical.definitionId, [candidate]);
+    }
+  }
+  peersByDefinitionCache.set(candidates, groups);
+  return groups;
+}
 function formatMinimalAgentIdentity(candidate, candidates, options = {}) {
   const canonical = candidateCanonicalIdentity(candidate);
   if (!canonical) {
     return options.includeSigil === false ? "" : "@";
   }
-  const peers = candidates.filter((peer) => {
-    const peerCanonical = candidateCanonicalIdentity(peer);
-    return peerCanonical && peerCanonical.definitionId === canonical.definitionId;
-  });
+  const peers = peersByDefinitionId(candidates).get(canonical.definitionId) ?? [];
   const aliasMatches = explicitCandidateAliases(candidate).map((alias) => ({ alias, identity: parseAgentIdentity(`@${alias}`) })).filter((entry) => Boolean(entry.identity)).filter((entry) => resolveAgentIdentity(entry.identity, candidates) === candidate).sort((left, right) => left.alias.length - right.alias.length || left.alias.localeCompare(right.alias));
   if (aliasMatches.length > 0) {
     return formatAgentIdentity({ definitionId: aliasMatches[0].alias }, options);
@@ -52353,7 +52406,7 @@ function inferMcpIdempotence(annotations) {
 // packages/protocol/src/runtime-catalog.generated.ts
 var SCOUT_RUNTIME_CATALOG_DATA = {
   schemaVersion: "openscout.runtime-catalog.v1",
-  revision: "2026-08-12.1",
+  revision: "2026-08-18.1",
   harnesses: [
     {
       id: "claude",
@@ -52482,6 +52535,7 @@ var SCOUT_RUNTIME_CATALOG_DATA = {
       id: "grok",
       label: "Grok CLI",
       enabled: true,
+      listed: false,
       reasoningEfforts: [
         "low",
         "medium",
@@ -52517,7 +52571,7 @@ var SCOUT_RUNTIME_CATALOG_DATA = {
     },
     {
       id: "grok-acp",
-      label: "Grok ACP",
+      label: "Grok",
       enabled: true,
       reasoningEfforts: null,
       models: [
@@ -53011,6 +53065,9 @@ function harness(value, path, errors3) {
     errors3.push(`${path}.label is required`);
   if (typeof input.enabled !== "boolean")
     errors3.push(`${path}.enabled must be boolean`);
+  if (input.listed !== undefined && typeof input.listed !== "boolean") {
+    errors3.push(`${path}.listed must be boolean when provided`);
+  }
   if (input.default === true && input.enabled !== true)
     errors3.push(`${path} cannot be default while disabled`);
   const efforts = effortList(input.reasoningEfforts, `${path}.reasoningEfforts`, errors3);
@@ -53049,6 +53106,7 @@ function harness(value, path, errors3) {
     id,
     label,
     enabled: input.enabled,
+    ...typeof input.listed === "boolean" ? { listed: input.listed } : {},
     ...input.default === true ? { default: true } : {},
     reasoningEfforts: efforts,
     ...defaultEffort && reasoningEfforts.has(defaultEffort) ? { defaultReasoningEffort: defaultEffort } : {},
@@ -53337,7 +53395,7 @@ function normalizeTerminalWorkspaceColumns(value) {
 // packages/protocol/src/rendezvous.ts
 var SCOUT_RENDEZVOUS_GENERATED_CODENAME_LENGTH = 6;
 var SCOUT_RENDEZVOUS_CODENAME_MAX_LENGTH = 32;
-var SCOUT_RENDEZVOUS_INVITE_TTL_MS = 10 * 60000;
+var SCOUT_RENDEZVOUS_INVITE_TTL_MS = 4 * 60 * 60000;
 var SCOUT_RENDEZVOUS_MAX_WAIT_MS = 10 * 60000;
 function normalizeScoutRendezvousCodename(codename) {
   return codename.normalize("NFKC").trim().toLocaleUpperCase("en-US");
@@ -55465,7 +55523,7 @@ class BrokerWorkItemStore {
 
 // packages/runtime/src/local-agents.ts
 import { randomUUID as randomUUID3 } from "crypto";
-import { existsSync as existsSync34, readFileSync as readFileSync17 } from "fs";
+import { existsSync as existsSync34, readFileSync as readFileSync18 } from "fs";
 import { mkdir as mkdir9, readFile as readFile9, rm as rm4, stat as stat6, writeFile as writeFile7 } from "fs/promises";
 import { basename as basename16, dirname as dirname20, join as join37, resolve as resolve11 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
@@ -57022,14 +57080,20 @@ function herdrProbeTarget(env) {
   return {
     bin: herdrBin(env),
     path: env.PATH ?? "",
-    home: env.XDG_CONFIG_HOME?.trim() || env.HOME?.trim() || homedir17()
+    home: env.HOME?.trim() || homedir17(),
+    xdgConfigHome: env.XDG_CONFIG_HOME?.trim() || null
   };
 }
 function parseHerdrProbeKey(key) {
   try {
     const parsed = JSON.parse(key);
     if (typeof parsed?.bin === "string" && typeof parsed.path === "string" && typeof parsed.home === "string") {
-      return { bin: parsed.bin, path: parsed.path, home: parsed.home };
+      return {
+        bin: parsed.bin,
+        path: parsed.path,
+        home: parsed.home,
+        xdgConfigHome: typeof parsed.xdgConfigHome === "string" && parsed.xdgConfigHome.trim() ? parsed.xdgConfigHome.trim() : null
+      };
     }
   } catch {}
   return herdrProbeTarget(process.env);
@@ -57071,8 +57135,13 @@ function parseHerdrSessionListJson(output) {
 async function readHerdrSessionsLocal(key, ctx) {
   const target = parseHerdrProbeKey(key);
   try {
+    const env = { ...process.env, PATH: target.path, HOME: target.home };
+    if (target.xdgConfigHome)
+      env.XDG_CONFIG_HOME = target.xdgConfigHome;
+    else
+      delete env.XDG_CONFIG_HOME;
     const { stdout } = await execProbeFile(ctx, target.bin, ["session", "list", "--json"], {
-      env: { ...process.env, PATH: target.path, HOME: target.home, XDG_CONFIG_HOME: target.home },
+      env,
       maxStdoutBytes: 512 * 1024,
       maxStderrBytes: 64 * 1024
     });
@@ -57103,6 +57172,7 @@ var herdrSessionsProbe = defineProbeFamily({
     });
   }
 });
+var herdrTopologyCache = new Map;
 // packages/runtime/src/system-probes/sessions.ts
 import { createReadStream as createReadStream2 } from "fs";
 import { readdir, stat as stat2 } from "fs/promises";
@@ -65729,7 +65799,7 @@ function buildInvocationCollaborationContextPrompt(invocation) {
 }
 
 // packages/runtime/src/pi-rpc.ts
-import { existsSync as existsSync26 } from "fs";
+import { existsSync as existsSync26, readFileSync as readFileSync10, statSync as statSync13 } from "fs";
 import { mkdir as mkdir6, writeFile as writeFile4 } from "fs/promises";
 import { execFileSync as execFileSync2 } from "child_process";
 import { homedir as homedir26 } from "os";
@@ -65825,7 +65895,37 @@ function inferPiProvider(launch) {
   }
   return;
 }
-function readSecretValue(name, commandOverride) {
+function readPiRpcCredentialFile(name, options = {}) {
+  if (!/^[A-Z0-9_]+$/.test(name)) {
+    return;
+  }
+  const env = options.env ?? process.env;
+  const platform = options.platform ?? process.platform;
+  const directory = normalizeOptionalString(env.CREDENTIALS_DIRECTORY) ?? normalizeOptionalString(env.OPENSCOUT_CREDENTIALS_DIRECTORY) ?? (platform === "linux" ? join28(normalizeOptionalString(env.XDG_CONFIG_HOME) ?? join28(options.homedir ?? homedir26(), ".config"), "openscout", "credentials") : undefined);
+  if (!directory) {
+    return;
+  }
+  try {
+    const directoryStat = statSync13(directory);
+    if (!directoryStat.isDirectory() || (directoryStat.mode & 63) !== 0) {
+      return;
+    }
+    const path = join28(directory, name);
+    const stat4 = statSync13(path);
+    if (!stat4.isFile() || (stat4.mode & 63) !== 0 || stat4.size > 16 * 1024) {
+      return;
+    }
+    const value = readFileSync10(path, "utf8").trim();
+    return value || undefined;
+  } catch {
+    return;
+  }
+}
+function readSecretValue(name, commandOverride, env = process.env) {
+  const credentialFile = readPiRpcCredentialFile(name, { env });
+  if (credentialFile) {
+    return credentialFile;
+  }
   try {
     const output = execFileSync2(commandOverride || "secret", ["get", name], {
       encoding: "utf8",
@@ -65859,7 +65959,7 @@ function buildPiRpcCredentialEnv(launch, sources2 = {}) {
   }
   const env = {};
   const sourceEnv = sources2.env ?? process.env;
-  const readSecret = sources2.readSecret ?? ((name) => readSecretValue(name, sources2.secretCommand));
+  const readSecret = sources2.readSecret ?? ((name) => readSecretValue(name, sources2.secretCommand, sourceEnv));
   for (const mapping of mappings) {
     const value = readMappedCredentialValue(mapping, sourceEnv, readSecret);
     if (value) {
@@ -66162,7 +66262,7 @@ async function shutdownPiRpcAgent(options) {
 
 // packages/runtime/src/setup.ts
 import { execFileSync as execFileSync4 } from "child_process";
-import { existsSync as existsSync29, readFileSync as readFileSync12 } from "fs";
+import { existsSync as existsSync29, readFileSync as readFileSync13 } from "fs";
 import { access, chmod, mkdir as mkdir8, readdir as readdir3, readFile as readFile8, realpath, rm as rm3, stat as stat5, writeFile as writeFile6 } from "fs/promises";
 import { homedir as homedir29, hostname as hostname3, userInfo } from "os";
 import { basename as basename15, dirname as dirname16, isAbsolute as isAbsolute2, join as join32, relative as relative6, resolve as resolve9 } from "path";
@@ -67116,7 +67216,7 @@ function parse5(toml, { maxDepth = 1000, integersAsBigInt } = {}) {
 
 // packages/runtime/src/harness-catalog.ts
 import { execFileSync as execFileSync3 } from "child_process";
-import { existsSync as existsSync27, statSync as statSync13 } from "fs";
+import { existsSync as existsSync27, statSync as statSync14 } from "fs";
 import { mkdir as mkdir7, readFile as readFile6, writeFile as writeFile5 } from "fs/promises";
 import { homedir as homedir27 } from "os";
 import { dirname as dirname13, join as join29 } from "path";
@@ -67701,7 +67801,7 @@ function defaultRequirementExists(requirement) {
   if (requirement.fileType === "any" || !requirement.fileType)
     return true;
   try {
-    const fileStat = statSync13(expanded);
+    const fileStat = statSync14(expanded);
     return requirement.fileType === "directory" ? fileStat.isDirectory() : fileStat.isFile();
   } catch {
     return false;
@@ -67990,7 +68090,7 @@ import {
   chmodSync,
   existsSync as existsSync28,
   mkdirSync as mkdirSync3,
-  readFileSync as readFileSync10,
+  readFileSync as readFileSync11,
   renameSync,
   rmSync as rmSync2,
   writeFileSync as writeFileSync3
@@ -68058,7 +68158,7 @@ function resolveStableLocalNodeId(input) {
 function readAndValidateNodeIdentity(path) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync10(path, "utf8"));
+    parsed = JSON.parse(readFileSync11(path, "utf8"));
   } catch {
     throw new Error(`Corrupt node identity at ${path}; remove it to generate a fresh one.`);
   }
@@ -68219,7 +68319,7 @@ function importPublicKey(publicKeyBase64) {
 }
 
 // packages/runtime/src/open-scout-network.ts
-import { readFileSync as readFileSync11 } from "fs";
+import { readFileSync as readFileSync12 } from "fs";
 var DEFAULT_OPENSCOUT_NETWORK_RENDEZVOUS_URL = "https://mesh.oscout.net";
 var DEFAULT_OPENSCOUT_NETWORK_PAIRING_RELAY_URL = "wss://mesh.oscout.net/v1/relay";
 function defaultOpenScoutNetworkSettings() {
@@ -68242,7 +68342,7 @@ function normalizeOpenScoutNetworkSettings(input) {
 }
 function readOpenScoutNetworkSettingsSync() {
   try {
-    const raw = readFileSync11(resolveOpenScoutSupportPaths().settingsPath, "utf8");
+    const raw = readFileSync12(resolveOpenScoutSupportPaths().settingsPath, "utf8");
     const parsed = JSON.parse(raw);
     const network = isRecord9(parsed) && isRecord9(parsed.network) ? parsed.network : {};
     return normalizeOpenScoutNetworkSettings(isRecord9(network.openScoutNetwork) ? network.openScoutNetwork : {});
@@ -68926,7 +69026,7 @@ function resolveNodeQualifier() {
 function readNodeAliasSync() {
   try {
     const settingsPath = resolveOpenScoutSupportPaths().settingsPath;
-    const raw = readFileSync12(settingsPath, "utf8");
+    const raw = readFileSync13(settingsPath, "utf8");
     const settings = JSON.parse(raw);
     return settings.node?.alias?.trim() || null;
   } catch {
@@ -68937,14 +69037,14 @@ function readGitHeadBranch(projectRoot) {
   const dotGitPath = join32(projectRoot, ".git");
   let gitDirectory = dotGitPath;
   try {
-    const marker = readFileSync12(dotGitPath, "utf8");
+    const marker = readFileSync13(dotGitPath, "utf8");
     const match = /^gitdir:\s*(.+)\s*$/imu.exec(marker);
     if (!match?.[1])
       return { found: false, branch: null };
     gitDirectory = isAbsolute2(match[1]) ? match[1] : resolve9(projectRoot, match[1]);
   } catch {}
   try {
-    const head = readFileSync12(join32(gitDirectory, "HEAD"), "utf8").trim();
+    const head = readFileSync13(join32(gitDirectory, "HEAD"), "utf8").trim();
     const match = /^ref:\s*refs\/heads\/(.+)$/u.exec(head);
     return { found: true, branch: match?.[1]?.trim() || null };
   } catch {
@@ -70581,7 +70681,7 @@ function buildInteractiveTerminalShellDirectives() {
 
 // packages/runtime/src/broker-process-manager.ts
 import { spawn as spawn6, spawnSync as spawnSync3 } from "child_process";
-import { existsSync as existsSync32, mkdirSync as mkdirSync5, readFileSync as readFileSync15, renameSync as renameSync3, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync32, mkdirSync as mkdirSync5, readFileSync as readFileSync16, renameSync as renameSync3, writeFileSync as writeFileSync5 } from "fs";
 import { homedir as homedir31, networkInterfaces } from "os";
 import { dirname as dirname18, join as join34, resolve as resolve10 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
@@ -70974,13 +71074,13 @@ class NodeSqliteDatabaseAdapter {
 }
 
 // packages/runtime/src/tailscale.ts
-import { readFileSync as readFileSync13 } from "fs";
+import { readFileSync as readFileSync14 } from "fs";
 import { execFileSync as execFileSync5 } from "child_process";
 var DEFAULT_TAILSCALE_STATUS_TIMEOUT_MS2 = 1500;
 var SYNC_TAILSCALE_STATUS_CACHE_MS = 30000;
 var syncStatusCache = null;
 function readStatusJsonFromFileSync(filePath) {
-  const raw = readFileSync13(filePath, "utf8");
+  const raw = readFileSync14(filePath, "utf8");
   return parseTailscaleStatusJson(raw);
 }
 function statusTimeoutMs2(env) {
@@ -71052,7 +71152,7 @@ function readTailscaleSelfWebHostsSync(env = process.env) {
 import {
   existsSync as existsSync31,
   mkdirSync as mkdirSync4,
-  readFileSync as readFileSync14,
+  readFileSync as readFileSync15,
   renameSync as renameSync2,
   writeFileSync as writeFileSync4
 } from "fs";
@@ -71092,7 +71192,7 @@ function loadLocalConfig() {
   if (!existsSync31(configPath))
     return { version: LOCAL_CONFIG_VERSION };
   try {
-    return validateLocalConfig(JSON.parse(readFileSync14(configPath, "utf8")));
+    return validateLocalConfig(JSON.parse(readFileSync15(configPath, "utf8")));
   } catch {
     return { version: LOCAL_CONFIG_VERSION };
   }
@@ -71188,7 +71288,7 @@ function readPersistedAdvertiseScope(supportDirectory) {
   if (!existsSync32(path))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync15(path, "utf8"));
+    const parsed = JSON.parse(readFileSync16(path, "utf8"));
     if (parsed.version !== 1)
       return null;
     if (parsed.advertiseScope === "mesh" || parsed.advertiseScope === "local") {
@@ -71814,7 +71914,7 @@ async function runScoutdServiceCommand(command, config2, timeoutMs = SCOUTD_DEFA
 function readCoreAgentsSync() {
   try {
     const settingsPath = resolveOpenScoutSupportPaths().settingsPath;
-    const raw = readFileSync15(settingsPath, "utf8");
+    const raw = readFileSync16(settingsPath, "utf8");
     const settings = JSON.parse(raw);
     const raw_agents = settings?.agents?.coreAgents;
     if (Array.isArray(raw_agents)) {
@@ -71830,7 +71930,7 @@ function readLogLines(path) {
   if (!existsSync32(path)) {
     return [];
   }
-  return readFileSync15(path, "utf8").split(`
+  return readFileSync16(path, "utf8").split(`
 `).map((line) => line.trim()).filter(Boolean);
 }
 function isPackageScriptBanner(line) {
@@ -72060,7 +72160,7 @@ var LOCAL_AGENT_SYSTEM_PROMPT_TEMPLATE_HINT = [
 ].join("");
 
 // packages/runtime/src/relay-agent-process-leases.ts
-import { existsSync as existsSync33, mkdirSync as mkdirSync6, readdirSync as readdirSync12, readFileSync as readFileSync16, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync33, mkdirSync as mkdirSync6, readdirSync as readdirSync12, readFileSync as readFileSync17, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "fs";
 import { join as join35 } from "path";
 var RELAY_AGENT_PROCESS_LEASE_PREFIX = "relay-agent-";
 function processLeasesDirectory() {
@@ -72101,7 +72201,7 @@ function readRelayAgentProcessLeases() {
       continue;
     }
     try {
-      const parsed = JSON.parse(readFileSync16(join35(directory, entry), "utf8"));
+      const parsed = JSON.parse(readFileSync17(join35(directory, entry), "utf8"));
       if (parsed?.kind === "relay_agent" && parsed.sessionName?.trim() && parsed.agentId?.trim()) {
         leases.push(parsed);
       }
@@ -72298,7 +72398,7 @@ function resolveProjectsRoot(projectPath) {
     if (!existsSync34(supportPaths.settingsPath)) {
       return dirname20(projectPath);
     }
-    const raw = JSON.parse(readFileSync17(supportPaths.settingsPath, "utf8"));
+    const raw = JSON.parse(readFileSync18(supportPaths.settingsPath, "utf8"));
     const workspaceRoot = raw.discovery?.workspaceRoots?.find((entry) => typeof entry === "string" && entry.trim().length > 0);
     return workspaceRoot ? resolve11(workspaceRoot) : dirname20(projectPath);
   } catch {
@@ -74547,7 +74647,7 @@ async function ensureLocalAgentOnlineOnce(agentName, record3) {
     }
   }
   if (!sessionOnline) {
-    const stderrTail = existsSync34(stderrLogFile) ? readFileSync17(stderrLogFile, "utf8").trim().split(/\r?\n/).slice(-10).join(`
+    const stderrTail = existsSync34(stderrLogFile) ? readFileSync18(stderrLogFile, "utf8").trim().split(/\r?\n/).slice(-10).join(`
 `).trim() : "";
     throw new Error(stderrTail ? `Relay agent ${agentName} failed to stay online:
 ${redactSecrets(stderrTail)}` : `Relay agent ${agentName} failed to stay online.`);
@@ -74571,7 +74671,7 @@ function readPersistedSessionCatalogId(runtimeDir) {
   try {
     const catalogPath = join37(runtimeDir, "session-catalog.json");
     if (existsSync34(catalogPath)) {
-      const raw = readFileSync17(catalogPath, "utf8").trim();
+      const raw = readFileSync18(catalogPath, "utf8").trim();
       if (raw) {
         const catalog = JSON.parse(raw);
         if (typeof catalog.activeSessionId === "string" && catalog.activeSessionId.trim()) {
@@ -74588,7 +74688,7 @@ function readPersistedLegacySessionId(runtimeDir, filename) {
   try {
     const legacyPath = join37(runtimeDir, filename);
     if (existsSync34(legacyPath)) {
-      const value = readFileSync17(legacyPath, "utf8").trim();
+      const value = readFileSync18(legacyPath, "utf8").trim();
       return value || null;
     }
     return null;
@@ -74684,6 +74784,7 @@ function buildLocalAgentBinding(agentId, record3, alive, nodeId, source) {
       labels: ["relay", "project", "agent", "local-agent"],
       metadata: {
         source,
+        brokerRegistered: true,
         ...normalizedRecord.registrationSource ? { registrationSource: normalizedRecord.registrationSource } : {},
         project: normalizedRecord.project,
         projectRoot,
@@ -79583,10 +79684,7 @@ class BrokerRendezvousService {
           suggestion: "choose_another_codename"
         };
       }
-      const expiredInvite = this.expiredInvites.get(key);
-      if (expiredInvite) {
-        return expiredResponse(expiredInvite, participantId);
-      }
+      this.expiredInvites.delete(key);
       return this.createPresence(projectRoot, participantId, requestedCodename, normalizedCodename, now);
     }
     for (let attempt = 0;attempt < MAX_CODENAME_GENERATION_ATTEMPTS; attempt += 1) {
@@ -80965,7 +81063,7 @@ import {
   generateKeyPairSync as generateKeyPairSync2,
   randomBytes as randomBytes6
 } from "crypto";
-import { chmodSync as chmodSync2, existsSync as existsSync39, mkdirSync as mkdirSync8, readFileSync as readFileSync19, renameSync as renameSync4, writeFileSync as writeFileSync8 } from "fs";
+import { chmodSync as chmodSync2, existsSync as existsSync39, mkdirSync as mkdirSync8, readFileSync as readFileSync20, renameSync as renameSync4, writeFileSync as writeFileSync8 } from "fs";
 import { dirname as dirname24, join as join43 } from "path";
 
 // node_modules/.bun/@peculiar+x509@1.12.3/node_modules/@peculiar/x509/build/x509.es.js
@@ -93254,7 +93352,7 @@ async function createTlsIdentity(supportDirectory, options) {
 function readAndValidateTlsIdentity(path7) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync19(path7, "utf8"));
+    parsed = JSON.parse(readFileSync20(path7, "utf8"));
   } catch {
     throw new Error(`Corrupt node TLS identity at ${path7}; remove it to generate a fresh one.`);
   }
@@ -93998,7 +94096,7 @@ async function postJson(brokerUrl, path7, payload, options) {
   const url2 = `${brokerUrl.replace(/\/$/, "")}${path7}`;
   let response;
   try {
-    response = await meshPeerFetch(brokerUrl, path7, {
+    response = await (options?.peerFetch ?? meshPeerFetch)(brokerUrl, path7, {
       method: "POST",
       headers: {
         "content-type": "application/json",
@@ -94079,13 +94177,13 @@ async function forwardMeshCollaborationRecord(target2, bundle, options) {
 async function forwardMeshCollaborationEvent(target2, bundle, options) {
   return forwardMeshEnvelope(target2, "collaboration/events", "/v1/mesh/collaboration/events", bundle, options);
 }
-async function fetchPeerAgents(brokerUrl) {
-  let response = await meshPeerFetch(brokerUrl, "/v1/mesh/snapshot", {
+async function fetchPeerAgents(brokerUrl, peerFetch = meshPeerFetch) {
+  let response = await peerFetch(brokerUrl, "/v1/mesh/snapshot", {
     headers: { accept: "application/json" },
     signal: AbortSignal.timeout(5000)
   });
   if (response.status === 404) {
-    response = await meshPeerFetch(brokerUrl, "/v1/snapshot", {
+    response = await peerFetch(brokerUrl, "/v1/snapshot", {
       headers: { accept: "application/json" },
       signal: AbortSignal.timeout(5000)
     });
@@ -94619,7 +94717,7 @@ class RelayAgentSessionReaper {
 }
 
 // packages/runtime/src/pairing-session-agents.ts
-import { existsSync as existsSync40, readFileSync as readFileSync20 } from "fs";
+import { existsSync as existsSync40, readFileSync as readFileSync21 } from "fs";
 import { basename as basename20, join as join44 } from "path";
 import { homedir as homedir34 } from "os";
 var DEFAULT_PAIRING_PORT = 43130;
@@ -94641,7 +94739,7 @@ function readJsonFile4(filePath) {
     return null;
   }
   try {
-    return JSON.parse(readFileSync20(filePath, "utf8"));
+    return JSON.parse(readFileSync21(filePath, "utf8"));
   } catch {
     return null;
   }
@@ -104741,7 +104839,7 @@ class ThreadEventPlane {
 }
 
 // packages/runtime/src/build-info.ts
-import { readFileSync as readFileSync21 } from "fs";
+import { readFileSync as readFileSync22 } from "fs";
 import { dirname as dirname26, join as join46 } from "path";
 import { fileURLToPath as fileURLToPath9 } from "url";
 var cachedBuildIdentity = null;
@@ -104757,7 +104855,7 @@ function envString(...names2) {
 function readRuntimePackageJson() {
   try {
     const packagePath = join46(dirname26(fileURLToPath9(import.meta.url)), "..", "package.json");
-    const parsed = JSON.parse(readFileSync21(packagePath, "utf8"));
+    const parsed = JSON.parse(readFileSync22(packagePath, "utf8"));
     return {
       name: typeof parsed.name === "string" && parsed.name.trim() ? parsed.name.trim() : null,
       version: typeof parsed.version === "string" && parsed.version.trim() ? parsed.version.trim() : null
@@ -105438,7 +105536,7 @@ function createBrokerCoreService(deps) {
 }
 
 // packages/runtime/src/mesh-rendezvous.ts
-import { existsSync as existsSync42, readFileSync as readFileSync22 } from "fs";
+import { existsSync as existsSync42, readFileSync as readFileSync23 } from "fs";
 import { homedir as homedir35 } from "os";
 import { join as join47 } from "path";
 var DEFAULT_RENDEZVOUS_TTL_MS = 60000;
@@ -105545,7 +105643,7 @@ function readMobilePairingMeshEntrypoint(env = process.env, now = Date.now()) {
     return;
   }
   try {
-    return mobilePairingMeshEntrypointFromSnapshot(JSON.parse(readFileSync22(runtimeStatePath, "utf8")), now);
+    return mobilePairingMeshEntrypointFromSnapshot(JSON.parse(readFileSync23(runtimeStatePath, "utf8")), now);
   } catch {
     return;
   }
@@ -105650,7 +105748,7 @@ function isPublicKeyHex(value) {
 
 // packages/runtime/src/mobile-push.ts
 import { Database as Database2 } from "bun:sqlite";
-import { mkdirSync as mkdirSync10, readFileSync as readFileSync23 } from "fs";
+import { mkdirSync as mkdirSync10, readFileSync as readFileSync24 } from "fs";
 import { connect as connectHttp2 } from "http2";
 import { createPrivateKey as createPrivateKey3, sign as signWithKey } from "crypto";
 import { dirname as dirname27, join as join48 } from "path";
@@ -105908,7 +106006,7 @@ function loadApnsCredentials() {
     privateKeyPem = Buffer.from(inlineBase64, "base64").toString("utf8");
   }
   if (!privateKeyPem && path7) {
-    privateKeyPem = readFileSync23(path7, "utf8");
+    privateKeyPem = readFileSync24(path7, "utf8");
   }
   if (!teamId || !keyId || !privateKeyPem) {
     return null;
@@ -110473,7 +110571,7 @@ function localInvocationTargetIdentity(targetId, agent, actor) {
 }
 
 // packages/runtime/src/provisional-agent-names-config.ts
-import { existsSync as existsSync44, readFileSync as readFileSync24, writeFileSync as writeFileSync9, mkdirSync as mkdirSync12 } from "fs";
+import { existsSync as existsSync44, readFileSync as readFileSync25, writeFileSync as writeFileSync9, mkdirSync as mkdirSync12 } from "fs";
 import { homedir as homedir37 } from "os";
 import { isAbsolute as isAbsolute4, join as join54, resolve as resolve20 } from "path";
 function openScoutHome() {
@@ -110509,7 +110607,7 @@ function resolvePoolFilePath(filePath) {
   return isAbsolute4(trimmed) ? trimmed : resolve20(openScoutHome(), trimmed);
 }
 function readProvisionalAgentNamesJsonFile(filePath) {
-  return parseProvisionalAgentNamesJson(readFileSync24(filePath, "utf8"));
+  return parseProvisionalAgentNamesJson(readFileSync25(filePath, "utf8"));
 }
 function loadInlineProvisionalAgentNames(config2) {
   const customNames = normalizeProvisionalAgentNamesSetting(config2.provisionalAgentNames);
@@ -110654,7 +110752,7 @@ function resolveProjectProvisionalAgentName(input) {
 }
 
 // packages/runtime/src/session-locator.ts
-import { existsSync as existsSync45, readdirSync as readdirSync14, readFileSync as readFileSync25, statSync as statSync14 } from "fs";
+import { existsSync as existsSync45, readdirSync as readdirSync14, readFileSync as readFileSync26, statSync as statSync15 } from "fs";
 import { homedir as homedir38 } from "os";
 import { basename as basename23, join as join55, resolve as resolve21 } from "path";
 var CODEX_HARNESS = "codex";
@@ -110671,7 +110769,7 @@ function pathExists4(path7) {
 }
 function safeStatMtimeMs(path7) {
   try {
-    return statSync14(path7).mtimeMs;
+    return statSync15(path7).mtimeMs;
   } catch {
     return 0;
   }
@@ -110691,7 +110789,7 @@ function walkFiles(root, predicate, into = [], depth = 0) {
     const full = join55(root, name2);
     let isDir = false;
     try {
-      isDir = statSync14(full).isDirectory();
+      isDir = statSync15(full).isDirectory();
     } catch {
       continue;
     }
@@ -110706,7 +110804,7 @@ function walkFiles(root, predicate, into = [], depth = 0) {
 function readFirstJsonlRecords(path7, maxLines = 8) {
   let text3;
   try {
-    const fdChunk = readFileSync25(path7, { encoding: "utf8" });
+    const fdChunk = readFileSync26(path7, { encoding: "utf8" });
     text3 = fdChunk.length > 256000 ? fdChunk.slice(0, 256000) : fdChunk;
   } catch {
     return [];
@@ -111494,7 +111592,7 @@ async function handleBrokerHttpEntityWriteRoute(input) {
     }
     return true;
   }
-  if (method === "POST" && url2.pathname === "/v1/flights") {
+  if (method === "POST" && (url2.pathname === "/v1/flights" || url2.pathname === "/v1/mesh/flights")) {
     try {
       const flight = await readRequestBody(request);
       await recordFlight(flight);
@@ -114650,8 +114748,16 @@ class BrokerMeshBundleService {
     this.deps = deps;
   }
   applyBundle = async (bundle, options = {}) => {
-    this.validateBundle(bundle);
-    const entries = buildMeshBundleEntries(bundle);
+    const existingOriginNode = this.deps.runtime.node(bundle.originNode.id);
+    const routedBundle = existingOriginNode?.brokerUrl ? {
+      ...bundle,
+      originNode: {
+        ...bundle.originNode,
+        brokerUrl: existingOriginNode.brokerUrl
+      }
+    } : bundle;
+    this.validateBundle(routedBundle);
+    const entries = buildMeshBundleEntries(routedBundle);
     return this.deps.commitEntries(entries, async (retainedEntries) => {
       await this.applyRetainedEntries(retainedEntries);
     }, options);
@@ -114783,8 +114889,8 @@ function actorIdsForCollaboration2(record3, conversation) {
   }
   return [...ids];
 }
-async function brokerPostJson(brokerBaseUrl, path7, payload) {
-  const response = await meshPeerFetch(brokerBaseUrl, path7, {
+async function postMeshPeerJson(brokerBaseUrl, path7, payload, peerFetch = meshPeerFetch) {
+  const response = await peerFetch(brokerBaseUrl, path7, {
     method: "POST",
     headers: {
       "content-type": "application/json",
@@ -114807,10 +114913,19 @@ class BrokerMeshForwardingService {
   postJson;
   constructor(deps) {
     this.deps = deps;
-    this.forwardMessage = deps.forwardMessage ?? forwardMeshMessage;
-    this.forwardCollaborationRecord = deps.forwardCollaborationRecord ?? forwardMeshCollaborationRecord;
-    this.forwardCollaborationEvent = deps.forwardCollaborationEvent ?? forwardMeshCollaborationEvent;
-    this.postJson = deps.postJson ?? brokerPostJson;
+    this.forwardMessage = deps.forwardMessage ?? ((target2, bundle, options) => forwardMeshMessage(target2, bundle, {
+      ...options,
+      peerFetch: deps.peerFetch
+    }));
+    this.forwardCollaborationRecord = deps.forwardCollaborationRecord ?? ((target2, bundle, options) => forwardMeshCollaborationRecord(target2, bundle, {
+      ...options,
+      peerFetch: deps.peerFetch
+    }));
+    this.forwardCollaborationEvent = deps.forwardCollaborationEvent ?? ((target2, bundle, options) => forwardMeshCollaborationEvent(target2, bundle, {
+      ...options,
+      peerFetch: deps.peerFetch
+    }));
+    this.postJson = deps.postJson ?? ((brokerBaseUrl, path7, payload) => postMeshPeerJson(brokerBaseUrl, path7, payload, deps.peerFetch));
   }
   describeRemoteAuthorityIssue(agent, authorityNode) {
     const displayName = agent.displayName ?? agent.id;
@@ -114911,7 +115026,7 @@ class BrokerMeshForwardingService {
     if (!isReachableRemoteBrokerUrl(brokerUrl)) {
       return;
     }
-    await this.postJson(brokerUrl, "/v1/flights", flight);
+    await this.postJson(brokerUrl, "/v1/mesh/flights", flight);
   }
   async forwardPeerBrokerDeliveries(message, deliveries) {
     return { forwarded: [], failed: [] };
@@ -114981,9 +115096,9 @@ class BrokerMeshForwardingService {
 function unique4(values) {
   return [...new Set(values.filter(Boolean))];
 }
-function normalizeSeedUrl(seed, defaultPort2) {
+function normalizeSeedUrl(seed, defaultPort2, scheme = "http") {
   try {
-    const url2 = new URL(seed.includes("://") ? seed : `http://${seed}`);
+    const url2 = new URL(seed.includes("://") ? seed : `${scheme}://${seed}`);
     if (!url2.port) {
       url2.port = String(defaultPort2);
     }
@@ -114992,26 +115107,21 @@ function normalizeSeedUrl(seed, defaultPort2) {
     return "";
   }
 }
-function resolveDiscoveredBrokerUrl(advertisedBrokerUrl, observedBrokerUrl) {
-  const observed = observedBrokerUrl.replace(/\/$/, "");
-  if (!advertisedBrokerUrl) {
-    return observed;
-  }
-  if (!isReachableRemoteBrokerUrl(advertisedBrokerUrl)) {
-    return observed;
-  }
-  return new URL(advertisedBrokerUrl).toString().replace(/\/$/, "");
+function resolveDiscoveredBrokerUrl(_advertisedBrokerUrl, observedBrokerUrl) {
+  return observedBrokerUrl.replace(/\/$/, "");
 }
 function buildPeerSeeds(peerName, addresses, dnsName, defaultPort2) {
-  const names2 = [dnsName, peerName].filter((value) => Boolean(value)).map((value) => normalizeSeedUrl(value, defaultPort2));
-  const ips = addresses.map((address) => normalizeSeedUrl(address, defaultPort2));
-  return unique4([...names2, ...ips]);
+  const hosts = [dnsName, peerName, ...addresses].filter((value) => Boolean(value));
+  return unique4([
+    ...hosts.map((value) => normalizeSeedUrl(value, defaultPort2, "https")),
+    ...hosts.map((value) => normalizeSeedUrl(value, defaultPort2, "http"))
+  ]);
 }
-async function probeNode(baseUrl, timeoutMs) {
+async function probeNode(baseUrl, timeoutMs, peerFetch) {
   const controller = new AbortController;
   const timeout = setTimeout(() => controller.abort(), timeoutMs);
   try {
-    const response = await fetch(`${baseUrl}/v1/node`, {
+    const response = await peerFetch(baseUrl, "/v1/node", {
       signal: controller.signal,
       headers: {
         accept: "application/json"
@@ -115033,13 +115143,14 @@ async function probeNode(baseUrl, timeoutMs) {
 }
 async function discoverMeshNodes(options) {
   const peerSeeds = options.seeds ? options.seeds.map((seed) => normalizeSeedUrl(seed, options.defaultPort)) : [];
-  const tailscalePeers = await readTailscalePeers();
+  const tailscalePeers = await (options.readTailscalePeers ?? readTailscalePeers)();
   const tailscaleSeeds = tailscalePeers.filter((peer) => peer.online).flatMap((peer) => buildPeerSeeds(peer.name, peer.addresses, peer.dnsName, options.defaultPort));
   const candidates = unique4([...peerSeeds, ...tailscaleSeeds]).filter((seed) => seed && seed !== options.localBrokerUrl);
   const discovered = [];
   const seen = new Set;
+  const peerFetch = options.peerFetch ?? meshPeerFetch;
   for (const seed of candidates) {
-    const node = await probeNode(seed, options.timeoutMs ?? 1500);
+    const node = await probeNode(seed, options.timeoutMs ?? 1500, peerFetch);
     if (!node)
       continue;
     if (node.id === options.localNodeId)
@@ -115085,7 +115196,8 @@ function remotePeerAgentForNode(input) {
   return {
     ...input.agent,
     homeNodeId: agentHome,
-    authorityNodeId: input.agent.authorityNodeId || input.node.id
+    authorityNodeId: input.agent.authorityNodeId || input.node.id,
+    advertiseScope: "mesh"
   };
 }
 
@@ -116648,13 +116760,105 @@ import { createServer as createHttpsServer } from "https";
 
 // packages/runtime/src/mesh-mdns-service.ts
 import { createRequire as createRequire3 } from "module";
+import { spawn as spawn12 } from "child_process";
 var MESH_MDNS_SERVICE_TYPE = "openscout";
 var MESH_MDNS_PROTOCOL_VERSION = 1;
 var MESH_MDNS_KEY_ID_DIGEST_HEX_CHARS = 32;
 var require3 = createRequire3(import.meta.url);
-function defaultResponderFactory() {
+function buildDarwinDnsSdRegisterArgs(options) {
+  return [
+    "-R",
+    options.name,
+    `_${options.type}._${options.protocol}`,
+    "local.",
+    String(options.port),
+    ...Object.entries(options.txt).map(([key, value]) => `${key}=${value}`)
+  ];
+}
+function createDarwinMdnsResponder(browserResponder, spawnProcess3 = spawn12, logger = console, processEvents = process) {
+  const registrations = new Set;
+  const stopRegistration = (child) => {
+    registrations.delete(child);
+    if (child.killed)
+      return;
+    try {
+      child.kill("SIGTERM");
+    } catch {}
+  };
+  const stopAll = () => {
+    for (const child of registrations)
+      stopRegistration(child);
+  };
+  processEvents.once("exit", stopAll);
+  return {
+    publish(options) {
+      let diagnosticOutput = "";
+      let failure = null;
+      const failureListeners = new Set;
+      const child = spawnProcess3("/usr/bin/dns-sd", buildDarwinDnsSdRegisterArgs(options), {
+        argv0: "openscout-mesh-mdns",
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      registrations.add(child);
+      const appendDiagnostic = (chunk) => {
+        diagnosticOutput = `${diagnosticOutput}${String(chunk)}`.slice(-4096);
+      };
+      child.stdout?.on("data", appendDiagnostic);
+      child.stderr?.on("data", appendDiagnostic);
+      const reportFailure = (error48) => {
+        if (failure)
+          return;
+        failure = error48;
+        registrations.delete(child);
+        logger.warn(`[mesh-mdns] native registration failed: ${error48.message}`);
+        for (const listener of failureListeners)
+          listener(error48);
+        failureListeners.clear();
+      };
+      child.once("exit", (code, signal) => {
+        if (!registrations.has(child))
+          return;
+        const detail = code === null ? `signal ${signal ?? "unknown"}` : `exit ${code}`;
+        const diagnostic = diagnosticOutput.trim();
+        reportFailure(new Error(`${detail}${diagnostic ? `: ${diagnostic}` : ""}`));
+      });
+      child.once("error", reportFailure);
+      return {
+        stop(callback) {
+          failureListeners.clear();
+          stopRegistration(child);
+          callback?.();
+        },
+        onFailure(listener) {
+          if (failure) {
+            listener(failure);
+          } else {
+            failureListeners.add(listener);
+          }
+        }
+      };
+    },
+    unpublishAll(callback) {
+      stopAll();
+      callback?.();
+    },
+    find(options, onup) {
+      return browserResponder.find(options, onup);
+    },
+    destroy(callback) {
+      stopAll();
+      processEvents.off("exit", stopAll);
+      browserResponder.destroy(callback);
+    }
+  };
+}
+function selectMdnsResponderForPlatform(browserResponder, platform = process.platform, spawnProcess3 = spawn12, logger = console, processEvents = process) {
+  return platform === "darwin" ? createDarwinMdnsResponder(browserResponder, spawnProcess3, logger, processEvents) : browserResponder;
+}
+function defaultResponderFactory(logger = console) {
   const Bonjour = require3("bonjour-service");
-  return new Bonjour;
+  const responder = new Bonjour;
+  return selectMdnsResponderForPlatform(responder, process.platform, spawn12, logger, process);
 }
 function meshMdnsKeyIdDigest(keyId) {
   const normalized = keyId.trim().toLowerCase();
@@ -116696,13 +116900,19 @@ class MeshMdnsService {
       return;
     }
     const responder = this.ensureResponder();
-    this.published = responder.publish({
+    const published = responder.publish({
       name: options.name ?? `OpenScout Node ${this.ownKidDigest.slice(0, 8)}`,
+      host: `openscout-${this.ownKidDigest}.local`,
       type: MESH_MDNS_SERVICE_TYPE,
       protocol: "tcp",
       port: options.port,
       txt: buildMeshMdnsTxt(options)
     });
+    this.published = published;
+    published.onFailure?.(() => {
+      if (this.published === published)
+        this.published = null;
+    });
   }
   startBrowse(options = {}) {
     if (this.browser) {
@@ -116745,7 +116955,7 @@ class MeshMdnsService {
   }
   ensureResponder() {
     if (!this.responder) {
-      this.responder = (this.options.responderFactory ?? defaultResponderFactory)();
+      this.responder = this.options.responderFactory ? this.options.responderFactory() : defaultResponderFactory(this.options.logger);
     }
     return this.responder;
   }
@@ -116853,16 +117063,23 @@ function createMeshBindController(deps) {
       responderFactory: deps.mdnsResponderFactory,
       logger
     });
-    service.start({
-      port: deps.port,
-      keyId: deps.keyId,
-      tls: true
-    });
-    service.startBrowse({
-      onPeerFound: deps.onPeerFound,
-      onPeerLost: deps.onPeerLost
-    });
     mdns = service;
+    try {
+      service.start({
+        port: deps.port,
+        keyId: deps.keyId,
+        tls: true
+      });
+      service.startBrowse({
+        onPeerFound: deps.onPeerFound,
+        onPeerLost: deps.onPeerLost
+      });
+    } catch (error48) {
+      service.stop();
+      if (mdns === service)
+        mdns = null;
+      throw error48;
+    }
     logger?.log(`[openscout-runtime] mesh mDNS advertising _openscout._tcp on port ${deps.port} (tls=1)`);
   }
   async function openTlsListeners(addresses, identity2) {
@@ -117017,6 +117234,7 @@ var MESH_ROUTE_MATRIX = {
   "POST /v1/mesh/collaboration/events": "control",
   "POST /v1/mesh/collaboration/records": "control",
   "POST /v1/mesh/discover": "control",
+  "POST /v1/mesh/flights": "control",
   "POST /v1/mesh/invocations": "control",
   "POST /v1/mesh/messages": "control",
   [TRPC_UPGRADE_ROUTE]: "control",
@@ -117509,16 +117727,18 @@ function currentSignedNodeCard() {
 function effectiveGateMode() {
   return meshBindController?.hasNonLoopbackListener() ? "enforce" : meshGateMode;
 }
+function trustedPeerForBrokerBaseUrl(baseUrl) {
+  const normalized = baseUrl.replace(/\/$/, "");
+  const node = Object.values(runtime.snapshot().nodes).find((candidate) => candidate.brokerUrl?.replace(/\/$/, "") === normalized);
+  if (!node || !trustedPeerStore) {
+    return;
+  }
+  return trustedPeerStore.listTrustedPeers().find((peer) => peer.nodeId === node.id);
+}
 var daemonMeshPeerFetch = createMeshPeerFetch({
   loadIdentity: () => nodeIdentity,
-  expectedPeerKeyId: (baseUrl) => {
-    const normalized = baseUrl.replace(/\/$/, "");
-    const node = Object.values(runtime.snapshot().nodes).find((candidate) => candidate.brokerUrl?.replace(/\/$/, "") === normalized);
-    if (!node || !trustedPeerStore) {
-      return;
-    }
-    return trustedPeerStore.listTrustedPeers().find((peer) => peer.nodeId === node.id)?.keyId;
-  }
+  expectedPeerKeyId: (baseUrl) => trustedPeerForBrokerBaseUrl(baseUrl)?.keyId,
+  expectedPeerTlsPin: (baseUrl) => trustedPeerForBrokerBaseUrl(baseUrl)?.tlsSpkiFingerprint
 });
 var threadEvents = new ThreadEventPlane({
   nodeId,
@@ -117560,7 +117780,8 @@ var meshForwardingService = new BrokerMeshForwardingService({
   currentLocalNode,
   invocationFor: (invocationId) => knownInvocations.get(invocationId),
   endpointForAgent: (agentId) => homeEndpointForAgent(runtime.snapshot(), agentId),
-  projectRootForTarget: brokerTargetProjectRoot
+  projectRootForTarget: brokerTargetProjectRoot,
+  peerFetch: daemonMeshPeerFetch
 });
 var controlStreams = new BrokerControlStreamService({
   enqueueEvent: (event) => projection.enqueueEvent(event),
@@ -117608,6 +117829,7 @@ var meshDiscoveryService = new BrokerMeshDiscoveryService({
   upsertNode: upsertNodeDurably,
   upsertAgent: upsertAgentDurably,
   notifyPeerOnline: (peerNodeId) => peerDelivery.notifyPeerOnline(peerNodeId),
+  fetchPeerAgents: (peerBrokerUrl) => fetchPeerAgents(peerBrokerUrl, daemonMeshPeerFetch),
   log: (message) => console.log(message)
 });
 var deliveryStore = new BrokerDeliveryStore({
@@ -117689,9 +117911,9 @@ var deliveryRouter = new BrokerDeliveryRouter({
         remediation: `bring a ${session.harness} worker online first, or use a resumable harness`
       };
     }
-    let spawn12;
+    let spawn13;
     try {
-      spawn12 = resolveCardlessSessionSpawnTarget(session.harness);
+      spawn13 = resolveCardlessSessionSpawnTarget(session.harness);
     } catch (error48) {
       return {
         ok: false,
@@ -117730,8 +117952,8 @@ var deliveryRouter = new BrokerDeliveryRouter({
       }, {
         sessionId: scoutSessionId,
         handle: scoutSessionId,
-        transport: spawn12.transport,
-        harness: spawn12.harness,
+        transport: spawn13.transport,
+        harness: spawn13.harness,
         cwd,
         projectRoot: cwd,
         nodeId,
@@ -117740,7 +117962,7 @@ var deliveryRouter = new BrokerDeliveryRouter({
         flatDispatch: true,
         displayName: `${basename24(cwd)}:${session.nativeSessionId.slice(0, 8)}`
       });
-      console.log(`[openscout-runtime] flat-dispatch wake ${session.harness}:${session.nativeSessionId} via ${spawn12.transport} cwd=${cwd}`);
+      console.log(`[openscout-runtime] flat-dispatch wake ${session.harness}:${session.nativeSessionId} via ${spawn13.transport} cwd=${cwd}`);
       return { ok: true };
     } catch (error48) {
       return {