@openscout/scout 0.2.84 → 0.2.86

package/dist/node/main.mjs

@@ -14397,9 +14397,9 @@ var require_cjs11 = __commonJS((exports) => {
 
 // ../runtime/dist/broker-process-manager.js
 import { spawn as spawn2, spawnSync } from "node:child_process";
-import { existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync4, renameSync as renameSync2, writeFileSync as writeFileSync3 } from "node:fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync4, readFileSync as readFileSync5, renameSync as renameSync3, writeFileSync as writeFileSync4 } from "node:fs";
 import { homedir as homedir5, networkInterfaces } from "node:os";
-import { dirname as dirname3, join as join5, resolve as resolve2 } from "node:path";
+import { dirname as dirname4, join as join6, resolve as resolve2 } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // ../runtime/dist/broker-api.js
@@ -14763,12 +14763,18 @@ import { existsSync as existsSync2, mkdirSync, rmSync, writeFileSync } from "nod
 import { homedir } from "node:os";
 import { join } from "node:path";
 var OPENSCOUT_RPC_CUTOVER_MARKER = "rpc-runtime-cutover-v1";
+function isTestRunnerProcess() {
+  if (false)
+    ;
+  const entry = typeof Bun !== "undefined" ? Bun.main : process.argv[1] ?? "";
+  return /[._](test|spec)\.[cm]?[jt]sx?$/.test(entry);
+}
 function assertTestIsolatedUserData(operation, isolationEnvKey) {
-  if (true)
+  if (!isTestRunnerProcess())
     return;
   if (process.env[isolationEnvKey]?.trim())
     return;
-  throw new Error(`Refusing to ${operation} while NODE_ENV=test without ${isolationEnvKey} set. ` + "Tests must isolate OpenScout user data in a temp directory (see prepareHome in onboarding.test.ts).");
+  throw new Error(`Refusing to ${operation} under a test runner without ${isolationEnvKey} set. ` + "Tests must isolate OpenScout user data in a temp directory (see prepareHome in onboarding.test.ts).");
 }
 function resolveOpenScoutSupportPaths() {
   const home = homedir();
@@ -16218,9 +16224,202 @@ function readTailscaleSelfWebHostsSync(env = process.env) {
 }
 
 // ../runtime/dist/local-config.js
-import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync3, renameSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync4, renameSync as renameSync2, writeFileSync as writeFileSync3 } from "node:fs";
 import { homedir as homedir3, hostname as osHostname } from "node:os";
+import { dirname as dirname2, join as join4 } from "node:path";
+
+// ../runtime/dist/node-identity.js
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, randomBytes, sign, verify } from "node:crypto";
+import { chmodSync, existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync3, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname, join as join3 } from "node:path";
+var NODE_IDENTITY_FILE = "node-identity.json";
+var NODE_FINGERPRINT_PREFIX = "osc1";
+var NODE_CARD_TTL_MS = 24 * 60 * 60 * 1000;
+var stableNodeQualifierCache = new Map;
+function stripBonjourCollisionSuffix(value) {
+  if (!value || typeof value !== "string")
+    return "";
+  let trimmed = value.trim();
+  const isDotLocal = /\.local\.?$/i.test(trimmed);
+  if (isDotLocal) {
+    trimmed = trimmed.replace(/\.local\.?$/i, "");
+  }
+  const isHyphenLocalOpenscout = /-local-openscout$/i.test(trimmed);
+  const isHyphenLocal = !isHyphenLocalOpenscout && /-local$/i.test(trimmed);
+  if (isHyphenLocalOpenscout) {
+    trimmed = trimmed.replace(/-local-openscout$/i, "");
+  } else if (isHyphenLocal) {
+    trimmed = trimmed.replace(/-local$/i, "");
+  }
+  if (!isDotLocal && !isHyphenLocalOpenscout && !isHyphenLocal) {
+    return trimmed;
+  }
+  trimmed = trimmed.replace(/(?<=[a-zA-Z].*?)(?:-\d+)+$/, "");
+  if (isDotLocal)
+    return `${trimmed}.local`;
+  if (isHyphenLocalOpenscout)
+    return `${trimmed}-local-openscout`;
+  if (isHyphenLocal)
+    return `${trimmed}-local`;
+  return trimmed;
+}
+function nodeIdentityPath(supportDirectory) {
+  const dir = supportDirectory ?? resolveOpenScoutSupportPaths().supportDirectory;
+  return join3(dir, NODE_IDENTITY_FILE);
+}
+function loadOrCreateNodeIdentity(supportDirectory) {
+  const path = nodeIdentityPath(supportDirectory);
+  if (existsSync4(path)) {
+    return readAndValidateNodeIdentity(path);
+  }
+  return createNodeIdentity(supportDirectory);
+}
+function readStableNodeQualifier(supportDirectory) {
+  const path = nodeIdentityPath(supportDirectory);
+  const cached = stableNodeQualifierCache.get(path);
+  if (cached) {
+    return cached;
+  }
+  if (!existsSync4(path)) {
+    return null;
+  }
+  const nodeQualifier = normalizeNodeQualifier(readAndValidateNodeIdentity(path).nodeQualifier);
+  if (nodeQualifier) {
+    stableNodeQualifierCache.set(path, nodeQualifier);
+  }
+  return nodeQualifier || null;
+}
+function readAndValidateNodeIdentity(path) {
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync3(path, "utf8"));
+  } catch {
+    throw new Error(`Corrupt node identity at ${path}; remove it to generate a fresh one.`);
+  }
+  if (parsed.version !== 1 || !parsed.publicKey || !parsed.privateKey) {
+    throw new Error(`Corrupt node identity at ${path}; remove it to generate a fresh one.`);
+  }
+  if (parsed.nodeQualifier !== undefined && normalizePersistedNodeQualifier(parsed.nodeQualifier) !== parsed.nodeQualifier) {
+    throw new Error(`Corrupt node identity at ${path}; remove it to generate a fresh one.`);
+  }
+  try {
+    const derived = createPublicKey(importPrivateKey(parsed.privateKey)).export({ type: "spki", format: "der" }).toString("base64");
+    if (derived !== parsed.publicKey) {
+      throw new Error("mismatch");
+    }
+  } catch {
+    throw new Error(`Node identity at ${path} has mismatched or invalid keys; remove it to generate a fresh one.`);
+  }
+  return parsed;
+}
+function normalizePersistedNodeQualifier(value) {
+  return typeof value === "string" ? value.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "") : "";
+}
+function normalizeNodeQualifier(value) {
+  return stripBonjourCollisionSuffix(normalizePersistedNodeQualifier(value));
+}
+function createNodeIdentity(supportDirectory) {
+  if (!supportDirectory) {
+    assertTestIsolatedUserData("write the node identity", "OPENSCOUT_SUPPORT_DIRECTORY");
+  }
+  const path = nodeIdentityPath(supportDirectory);
+  const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+  const identity = {
+    version: 1,
+    publicKey: publicKey.export({ type: "spki", format: "der" }).toString("base64"),
+    privateKey: privateKey.export({ type: "pkcs8", format: "der" }).toString("base64"),
+    createdAt: Date.now()
+  };
+  mkdirSync2(dirname(path), { recursive: true });
+  try {
+    writeFileSync2(path, `${JSON.stringify(identity, null, 2)}
+`, { encoding: "utf8", mode: 384, flag: "wx" });
+  } catch (error) {
+    if (error.code === "EEXIST") {
+      return readAndValidateNodeIdentity(path);
+    }
+    throw error;
+  }
+  try {
+    chmodSync(path, 384);
+  } catch {}
+  return identity;
+}
+function nodeKeyId(publicKeyBase64) {
+  return createHash("sha256").update(Buffer.from(publicKeyBase64, "base64")).digest("hex");
+}
+function nodeFingerprint(publicKeyBase64) {
+  const digest = createHash("sha256").update(Buffer.from(publicKeyBase64, "base64")).digest();
+  const encoded = base32Encode(digest.subarray(0, 10)).toLowerCase();
+  return `${NODE_FINGERPRINT_PREFIX}:${encoded.slice(0, 4)}-${encoded.slice(4, 8)}`;
+}
+function signNodePayload(identity, payload) {
+  const key = importPrivateKey(identity.privateKey);
+  return sign(null, typeof payload === "string" ? Buffer.from(payload, "utf8") : payload, key).toString("base64");
+}
+function verifyNodeSignature(publicKeyBase64, payload, signatureBase64) {
+  try {
+    const key = importPublicKey(publicKeyBase64);
+    return verify(null, typeof payload === "string" ? Buffer.from(payload, "utf8") : payload, key, Buffer.from(signatureBase64, "base64"));
+  } catch {
+    return false;
+  }
+}
+function canonicalJson(value) {
+  if (value === null || typeof value !== "object") {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map(canonicalJson).join(",")}]`;
+  }
+  const record = value;
+  const keys = Object.keys(record).sort();
+  return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(",")}}`;
+}
+function verifySignedNodeCard(card, now = Date.now()) {
+  if (nodeKeyId(card.publicKey) !== card.keyId) {
+    return false;
+  }
+  if (nodeFingerprint(card.publicKey) !== card.fingerprint) {
+    return false;
+  }
+  if (!Number.isFinite(card.expiresAt) || card.expiresAt <= now) {
+    return false;
+  }
+  if (card.tls !== undefined) {
+    if (typeof card.tls !== "object" || card.tls === null || typeof card.tls.spkiFingerprint !== "string" || !/^[0-9a-f]{64}$/.test(card.tls.spkiFingerprint)) {
+      return false;
+    }
+  }
+  const { signature, ...unsigned } = card;
+  return verifyNodeSignature(card.publicKey, canonicalJson(unsigned), signature);
+}
+var BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+function base32Encode(input) {
+  let bits = 0;
+  let value = 0;
+  let output = "";
+  for (const byte of input) {
+    value = value << 8 | byte;
+    bits += 8;
+    while (bits >= 5) {
+      output += BASE32_ALPHABET[value >>> bits - 5 & 31];
+      bits -= 5;
+    }
+  }
+  if (bits > 0) {
+    output += BASE32_ALPHABET[value << 5 - bits & 31];
+  }
+  return output;
+}
+function importPrivateKey(privateKeyBase64) {
+  return createPrivateKey({ key: Buffer.from(privateKeyBase64, "base64"), format: "der", type: "pkcs8" });
+}
+function importPublicKey(publicKeyBase64) {
+  return createPublicKey({ key: Buffer.from(publicKeyBase64, "base64"), format: "der", type: "spki" });
+}
+
+// ../runtime/dist/local-config.js
 var LOCAL_CONFIG_VERSION = 1;
 var DEFAULT_SCOUT_WEB_PORTAL_HOST = "scout.local";
 var DEFAULT_SCOUT_WEB_DEV_HOST = `dev.${DEFAULT_SCOUT_WEB_PORTAL_HOST}`;
@@ -16245,17 +16444,17 @@ var DEFAULT_LOCAL_CONFIG = {
   }
 };
 function localConfigHome() {
-  return process.env.OPENSCOUT_HOME ?? join3(homedir3(), ".openscout");
+  return process.env.OPENSCOUT_HOME ?? join4(homedir3(), ".openscout");
 }
 function localConfigPath() {
-  return join3(localConfigHome(), "config.json");
+  return join4(localConfigHome(), "config.json");
 }
 function loadLocalConfig() {
   const configPath = localConfigPath();
-  if (!existsSync4(configPath))
+  if (!existsSync5(configPath))
     return { version: LOCAL_CONFIG_VERSION };
   try {
-    return validateLocalConfig(JSON.parse(readFileSync3(configPath, "utf8")));
+    return validateLocalConfig(JSON.parse(readFileSync4(configPath, "utf8")));
   } catch {
     return { version: LOCAL_CONFIG_VERSION };
   }
@@ -16333,34 +16532,34 @@ function resolveBrokerPort() {
 function writeLocalConfig(config) {
   assertTestIsolatedUserData("write the OpenScout local config", "OPENSCOUT_HOME");
   const configPath = localConfigPath();
-  mkdirSync2(dirname(configPath), { recursive: true });
+  mkdirSync3(dirname2(configPath), { recursive: true });
   const body = JSON.stringify({ ...config, version: LOCAL_CONFIG_VERSION }, null, 2) + `
 `;
   const tmp = `${configPath}.tmp`;
-  writeFileSync2(tmp, body, "utf8");
-  renameSync(tmp, configPath);
+  writeFileSync3(tmp, body, "utf8");
+  renameSync2(tmp, configPath);
 }
 function localConfigExists() {
-  return existsSync4(localConfigPath());
+  return existsSync5(localConfigPath());
 }
 
 // ../runtime/dist/tool-resolution.js
-import { accessSync, constants, existsSync as existsSync5 } from "node:fs";
+import { accessSync, constants, existsSync as existsSync6 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { basename, dirname as dirname2, join as join4, resolve } from "node:path";
+import { basename, dirname as dirname3, join as join5, resolve } from "node:path";
 var DEFAULT_COMMON_EXECUTABLE_DIRECTORIES = [
-  join4(homedir4(), ".bun", "bin"),
+  join5(homedir4(), ".bun", "bin"),
   "/opt/homebrew/bin",
   "/usr/local/bin"
 ];
 function commonClaudeExecutableDirectories(env) {
   const home = env.HOME ?? homedir4();
   return [
-    join4(home, ".local", "bin"),
-    join4(home, ".claude", "local"),
+    join5(home, ".local", "bin"),
+    join5(home, ".claude", "local"),
     "/opt/homebrew/bin",
     "/usr/local/bin",
-    join4(home, ".bun", "bin")
+    join5(home, ".bun", "bin")
   ];
 }
 function expandHomePath(value, env = process.env) {
@@ -16369,7 +16568,7 @@ function expandHomePath(value, env = process.env) {
     return home;
   }
   if (value.startsWith("~/")) {
-    return join4(home, value.slice(2));
+    return join5(home, value.slice(2));
   }
   return value;
 }
@@ -16426,7 +16625,7 @@ function resolveExecutableFromSearch(options) {
   ], env);
   for (const directory of searchDirectories) {
     for (const name of options.names) {
-      const candidate = join4(directory, name);
+      const candidate = join5(directory, name);
       if (isExecutablePath(candidate)) {
         return {
           path: candidate,
@@ -16440,7 +16639,7 @@ function resolveExecutableFromSearch(options) {
 function resolveExecutableFromDirectories(directories, names, env, source) {
   for (const directory of dedupeDirectories(directories, env)) {
     for (const name of names) {
-      const candidate = join4(directory, name);
+      const candidate = join5(directory, name);
       if (isExecutablePath(candidate)) {
         return { path: candidate, source };
       }
@@ -16478,7 +16677,7 @@ function findExecutableOnSearchPath(name, env) {
     ...DEFAULT_COMMON_EXECUTABLE_DIRECTORIES
   ], env);
   for (const directory of searchDirectories) {
-    const candidate = join4(directory, name);
+    const candidate = join5(directory, name);
     if (isExecutablePath(candidate)) {
       return { path: candidate, source: "path" };
     }
@@ -16496,14 +16695,14 @@ var DEFAULT_ADVERTISE_SCOPE = "local";
 var MESH_BIND_CONFIG_FILE = "mesh-bind.json";
 function meshBindConfigPath(supportDirectory) {
   const dir = supportDirectory ?? resolveOpenScoutSupportPaths().supportDirectory;
-  return join5(dir, MESH_BIND_CONFIG_FILE);
+  return join6(dir, MESH_BIND_CONFIG_FILE);
 }
 function readPersistedAdvertiseScope(supportDirectory) {
   const path = meshBindConfigPath(supportDirectory);
-  if (!existsSync6(path))
+  if (!existsSync7(path))
     return null;
   try {
-    const parsed = JSON.parse(readFileSync4(path, "utf8"));
+    const parsed = JSON.parse(readFileSync5(path, "utf8"));
     if (parsed.version !== 1)
       return null;
     if (parsed.advertiseScope === "mesh" || parsed.advertiseScope === "local") {
@@ -16549,13 +16748,13 @@ function resolveBrokerUrl(host, port, scope, env = process.env, lanHost = findLa
     return explicit;
   }
   if (scope === "mesh") {
+    if (lanHost) {
+      return buildDefaultBrokerHttpsUrl(lanHost, port);
+    }
     const tailnetHost = readTailscaleSelfWebHostsSync(env)[0];
     if (tailnetHost) {
       return buildDefaultBrokerHttpsUrl(tailnetHost, port);
     }
-    if (lanHost) {
-      return buildDefaultBrokerHttpsUrl(lanHost, port);
-    }
   }
   return buildDefaultBrokerUrl(host, port);
 }
@@ -16622,7 +16821,7 @@ function isWildcardHost(host) {
   return trimmed === "0.0.0.0" || trimmed === "::" || trimmed === "[::]";
 }
 function buildDefaultBrokerSocketPath(runtimeDirectory) {
-  return join5(runtimeDirectory, "broker.sock");
+  return join6(runtimeDirectory, "broker.sock");
 }
 var DEFAULT_BROKER_URL = buildDefaultBrokerUrl();
 function resolveScoutBrokerControlUrl(_config = resolveBrokerServiceConfig()) {
@@ -16641,17 +16840,17 @@ function runtimePackageDir() {
   const fromGlobal = findGlobalRuntimeDir();
   if (fromGlobal)
     return fromGlobal;
-  const moduleDir = dirname3(fileURLToPath(import.meta.url));
+  const moduleDir = dirname4(fileURLToPath(import.meta.url));
   return resolve2(moduleDir, "..");
 }
 function isInstalledRuntimePackageDir(candidate) {
-  return existsSync6(join5(candidate, "package.json")) && existsSync6(join5(candidate, "bin", "openscout-runtime.mjs"));
+  return existsSync7(join6(candidate, "package.json")) && existsSync7(join6(candidate, "bin", "openscout-runtime.mjs"));
 }
 function findGlobalRuntimeDir() {
   const candidates = [
-    join5(homedir5(), ".bun", "node_modules", "@openscout", "runtime"),
-    join5(homedir5(), ".bun", "install", "global", "node_modules", "@openscout", "runtime"),
-    join5(homedir5(), ".bun", "install", "global", "node_modules", "@openscout", "scout", "node_modules", "@openscout", "runtime")
+    join6(homedir5(), ".bun", "node_modules", "@openscout", "runtime"),
+    join6(homedir5(), ".bun", "install", "global", "node_modules", "@openscout", "runtime"),
+    join6(homedir5(), ".bun", "install", "global", "node_modules", "@openscout", "scout", "node_modules", "@openscout", "runtime")
   ];
   for (const c of candidates) {
     if (isInstalledRuntimePackageDir(c))
@@ -16664,7 +16863,7 @@ function findGlobalRuntimeDir() {
       const scoutPkg = resolve2(scoutBin, "..", "..");
       if (isInstalledRuntimePackageDir(scoutPkg))
         return scoutPkg;
-      const nested = join5(scoutPkg, "node_modules", "@openscout", "runtime");
+      const nested = join6(scoutPkg, "node_modules", "@openscout", "runtime");
       if (isInstalledRuntimePackageDir(nested))
         return nested;
       const sibling = resolve2(scoutPkg, "..", "runtime");
@@ -16675,7 +16874,7 @@ function findGlobalRuntimeDir() {
   return null;
 }
 function findBundledRuntimeDir() {
-  const moduleDir = dirname3(fileURLToPath(import.meta.url));
+  const moduleDir = dirname4(fileURLToPath(import.meta.url));
   return resolveBundledRuntimeDirFromModuleDir(moduleDir);
 }
 function resolveBundledRuntimeDirFromModuleDir(moduleDir) {
@@ -16692,11 +16891,11 @@ function resolveBundledRuntimeDirFromModuleDir(moduleDir) {
 function findWorkspaceRuntimeDir(startDir) {
   let current = resolve2(startDir);
   while (true) {
-    const candidate = join5(current, "packages", "runtime");
-    if (existsSync6(join5(candidate, "package.json")) && existsSync6(join5(candidate, "src"))) {
+    const candidate = join6(current, "packages", "runtime");
+    if (existsSync7(join6(candidate, "package.json")) && existsSync7(join6(candidate, "src"))) {
       return candidate;
     }
-    const parent = dirname3(current);
+    const parent = dirname4(current);
     if (parent === current)
       return null;
     current = parent;
@@ -16743,17 +16942,17 @@ function resolveBrokerServiceConfig() {
   const serviceAdapter = resolveBrokerServiceAdapter();
   const uid = typeof process.getuid === "function" ? process.getuid() : Number.parseInt(process.env.UID ?? "0", 10);
   const supportPaths = resolveOpenScoutSupportPaths();
-  const defaultSupportDir = join5(homedir5(), "Library", "Application Support", "OpenScout");
+  const defaultSupportDir = join6(homedir5(), "Library", "Application Support", "OpenScout");
   const supportDirectory = isTmpPath(supportPaths.supportDirectory) ? defaultSupportDir : supportPaths.supportDirectory;
-  const runtimeDirectory = join5(supportDirectory, "runtime");
-  const logsDirectory = join5(supportDirectory, "logs", "broker");
-  const controlHome = isTmpPath(supportPaths.controlHome) ? join5(homedir5(), ".openscout", "control-plane") : supportPaths.controlHome;
+  const runtimeDirectory = join6(supportDirectory, "runtime");
+  const logsDirectory = join6(supportDirectory, "logs", "broker");
+  const controlHome = isTmpPath(supportPaths.controlHome) ? join6(homedir5(), ".openscout", "control-plane") : supportPaths.controlHome;
   const advertiseScope = resolveAdvertiseScope(process.env, () => readPersistedAdvertiseScope(supportDirectory));
   const brokerHost = resolveBrokerHost(advertiseScope);
   const brokerPort = Number.parseInt(process.env.OPENSCOUT_BROKER_PORT ?? String(resolveBrokerPort()), 10);
   const brokerUrl = resolveBrokerUrl(brokerHost, brokerPort, advertiseScope);
   const brokerSocketPath = process.env.OPENSCOUT_BROKER_SOCKET_PATH ?? buildDefaultBrokerSocketPath(runtimeDirectory);
-  const launchAgentPath = join5(homedir5(), "Library", "LaunchAgents", `${label}.plist`);
+  const launchAgentPath = join6(homedir5(), "Library", "LaunchAgents", `${label}.plist`);
   return {
     label,
     mode,
@@ -16764,8 +16963,8 @@ function resolveBrokerServiceConfig() {
     supportDirectory,
     runtimeDirectory,
     logsDirectory,
-    stdoutLogPath: join5(logsDirectory, "stdout.log"),
-    stderrLogPath: join5(logsDirectory, "stderr.log"),
+    stdoutLogPath: join6(logsDirectory, "stdout.log"),
+    stderrLogPath: join6(logsDirectory, "stderr.log"),
     controlHome,
     runtimePackageDir: runtimePackageDir(),
     bunExecutable: serviceAdapter === "macos-scoutd" ? resolveBunExecutable2() : resolveOptionalBunExecutable(),
@@ -16799,10 +16998,10 @@ function resolveEnvExecutable(value) {
 function findWorkspaceRootFromRuntimeDir(runtimePackageDir2) {
   let current = resolve2(runtimePackageDir2);
   while (true) {
-    if (existsSync6(join5(current, "Cargo.toml")) && existsSync6(join5(current, "crates", "scoutd", "Cargo.toml"))) {
+    if (existsSync7(join6(current, "Cargo.toml")) && existsSync7(join6(current, "crates", "scoutd", "Cargo.toml"))) {
       return current;
     }
-    const parent = dirname3(current);
+    const parent = dirname4(current);
     if (parent === current)
       return null;
     current = parent;
@@ -16819,13 +17018,13 @@ function resolveScoutdCommand(config = resolveBrokerServiceConfig()) {
   }
   const workspaceRoot = findWorkspaceRootFromRuntimeDir(config.runtimePackageDir);
   const packageCandidates = [
-    join5(config.runtimePackageDir, "bin", "scoutd"),
-    join5(config.runtimePackageDir, "native", "scoutd"),
-    join5(config.runtimePackageDir, "scoutd"),
-    workspaceRoot ? join5(workspaceRoot, "packages", "cli", "bin", "scoutd") : null,
-    workspaceRoot ? join5(workspaceRoot, "packages", "runtime", "bin", "scoutd") : null,
-    join5(config.runtimeDirectory, "scoutd"),
-    join5(dirname3(config.runtimePackageDir), "scout", "bin", "scoutd")
+    join6(config.runtimePackageDir, "bin", "scoutd"),
+    join6(config.runtimePackageDir, "native", "scoutd"),
+    join6(config.runtimePackageDir, "scoutd"),
+    workspaceRoot ? join6(workspaceRoot, "packages", "cli", "bin", "scoutd") : null,
+    workspaceRoot ? join6(workspaceRoot, "packages", "runtime", "bin", "scoutd") : null,
+    join6(config.runtimeDirectory, "scoutd"),
+    join6(dirname4(config.runtimePackageDir), "scout", "bin", "scoutd")
   ];
   for (const candidate of packageCandidates) {
     const resolved = executableCandidate(candidate);
@@ -16839,8 +17038,8 @@ function resolveScoutdCommand(config = resolveBrokerServiceConfig()) {
   }
   if (workspaceRoot && workspaceScoutdAllowed()) {
     for (const candidate of [
-      join5(workspaceRoot, "target", "release", "scoutd"),
-      join5(workspaceRoot, "target", "debug", "scoutd")
+      join6(workspaceRoot, "target", "release", "scoutd"),
+      join6(workspaceRoot, "target", "debug", "scoutd")
     ]) {
       const resolved = executableCandidate(candidate);
       if (resolved) {
@@ -16925,7 +17124,7 @@ function normalizeNativeServiceStatus(input, config) {
   const healthMeshId = readString2(healthRecord.meshId);
   const healthSocketFallbackError = readString2(healthRecord.socketFallbackError);
   const healthCounts = isRecord3(healthRecord.counts) ? healthRecord.counts : undefined;
-  const installed = readBoolean(input.installed) ?? existsSync6(config.launchAgentPath);
+  const installed = readBoolean(input.installed) ?? existsSync7(config.launchAgentPath);
   const loaded = readBoolean(input.loaded) ?? false;
   const stdoutLogPath = readString2(input.stdoutLogPath) ?? config.stdoutLogPath;
   const stderrLogPath = readString2(input.stderrLogPath) ?? config.stderrLogPath;
@@ -17046,8 +17245,8 @@ var SCHEMA_GUARDED_SERVICE_COMMANDS = new Set([
   "restart"
 ]);
 function assertBrokerServiceSchemaCompatible(config) {
-  const databasePath = join5(config.controlHome, "control-plane.sqlite");
-  if (!existsSync6(databasePath))
+  const databasePath = join6(config.controlHome, "control-plane.sqlite");
+  if (!existsSync7(databasePath))
     return;
   const database = openControlPlaneSqliteDatabase(databasePath, { readonly: true });
   try {
@@ -17080,7 +17279,7 @@ async function runScoutdServiceCommand(command, config, timeoutMs = SCOUTD_DEFAU
 function readCoreAgentsSync() {
   try {
     const settingsPath = resolveOpenScoutSupportPaths().settingsPath;
-    const raw = readFileSync4(settingsPath, "utf8");
+    const raw = readFileSync5(settingsPath, "utf8");
     const settings = JSON.parse(raw);
     const raw_agents = settings?.agents?.coreAgents;
     if (Array.isArray(raw_agents)) {
@@ -17093,10 +17292,10 @@ function bootoutCommand(config) {
   return `/bin/launchctl bootout ${config.serviceTarget}`;
 }
 function readLogLines(path) {
-  if (!existsSync6(path)) {
+  if (!existsSync7(path)) {
     return [];
   }
-  return readFileSync4(path, "utf8").split(`
+  return readFileSync5(path, "utf8").split(`
 `).map((line) => line.trim()).filter(Boolean);
 }
 function isPackageScriptBanner(line) {
@@ -17320,15 +17519,15 @@ if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1] && !pr
 
 // ../runtime/dist/harness-catalog.js
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { existsSync as existsSync7, statSync } from "node:fs";
+import { existsSync as existsSync8, statSync } from "node:fs";
 import { mkdir, readFile as readFile2, writeFile } from "node:fs/promises";
 import { homedir as homedir6 } from "node:os";
-import { dirname as dirname4, join as join7 } from "node:path";
+import { dirname as dirname5, join as join8 } from "node:path";
 
 // ../agent-sessions/dist/codex-executable.js
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { accessSync as accessSync2, constants as constants2 } from "node:fs";
-import { delimiter, join as join6 } from "node:path";
+import { delimiter, join as join7 } from "node:path";
 function isExecutable(filePath) {
   if (!filePath)
     return false;
@@ -17372,11 +17571,11 @@ function codexAppBundleCandidates(env) {
   const appNames = ["Codex.app", "ChatGPT.app"];
   const candidates = appNames.flatMap((appName) => [
     {
-      path: join6("/Applications", appName, "Contents", "Resources", "codex"),
+      path: join7("/Applications", appName, "Contents", "Resources", "codex"),
       source: "codex_app_bundle"
     },
     {
-      path: join6(env.HOME ?? "", "Applications", appName, "Contents", "Resources", "codex"),
+      path: join7(env.HOME ?? "", "Applications", appName, "Contents", "Resources", "codex"),
       source: "codex_app_bundle"
     }
   ]);
@@ -17384,7 +17583,7 @@ function codexAppBundleCandidates(env) {
 }
 function pathCandidates(env) {
   return (env.PATH ?? "").split(delimiter).filter(Boolean).map((directory) => ({
-    path: join6(directory, "codex"),
+    path: join7(directory, "codex"),
     source: "path"
   }));
 }
@@ -17395,7 +17594,7 @@ function commonCandidates(env) {
     "/opt/homebrew/bin",
     "/usr/local/bin"
   ].filter(Boolean).map((directory) => ({
-    path: join6(directory, "codex"),
+    path: join7(directory, "codex"),
     source: "common"
   }));
 }
@@ -17880,6 +18079,7 @@ var BUILT_IN_HARNESS_CATALOG = [
   {
     name: "opencode",
     harness: "opencode",
+    aliases: ["oc", "opencode2"],
     label: "OpenCode",
     description: "OpenCode's coding agent over ACP, fronting many model vendors via OpenCode Zen",
     homepage: "https://opencode.ai/docs/",
@@ -18030,7 +18230,7 @@ function expandHomePath2(value) {
   if (value === "~")
     return home;
   if (value.startsWith("~/"))
-    return join7(home, value.slice(2));
+    return join8(home, value.slice(2));
   return value;
 }
 function defaultWhichBinary(binary, platform) {
@@ -18064,7 +18264,7 @@ function defaultRunCommand(command, platform) {
 }
 function defaultRequirementExists(requirement) {
   const expanded = expandHomePath2(requirement.path);
-  if (!existsSync7(expanded))
+  if (!existsSync8(expanded))
     return false;
   if (requirement.fileType === "any" || !requirement.fileType)
     return true;
@@ -18146,6 +18346,7 @@ function codexCandidateReport(candidate, selectedPath) {
 function createBuiltInHarnessCatalog() {
   return BUILT_IN_HARNESS_CATALOG.map((entry) => ({
     ...entry,
+    aliases: entry.aliases ? [...entry.aliases] : undefined,
     tags: [...entry.tags],
     support: { ...entry.support },
     install: entry.install ? { ...entry.install, requires: [...entry.install.requires ?? []] } : undefined,
@@ -18292,7 +18493,7 @@ async function readHarnessCatalogOverrides(overridePath = resolveOpenScoutSuppor
   }
 }
 async function writeHarnessCatalogOverrides(overrides, overridePath = resolveOpenScoutSupportPaths().harnessCatalogPath) {
-  await mkdir(dirname4(overridePath), { recursive: true });
+  await mkdir(dirname5(overridePath), { recursive: true });
   const payload = {
     version: HARNESS_CATALOG_VERSION,
     entries: overrides,
@@ -18302,7 +18503,7 @@ async function writeHarnessCatalogOverrides(overrides, overridePath = resolveOpe
 `, "utf8");
 }
 async function ensureHarnessCatalogOverrideFile(overridePath = resolveOpenScoutSupportPaths().harnessCatalogPath) {
-  if (existsSync7(overridePath))
+  if (existsSync8(overridePath))
     return;
   await writeHarnessCatalogOverrides({}, overridePath);
 }
@@ -19337,7 +19538,8 @@ function canonicalizeIdentity(input) {
   const definitionId = normalizeAgentIdentitySegment(input.definitionId);
   const workspaceQualifier = input.workspaceQualifier ? normalizeAgentIdentitySegment(input.workspaceQualifier) : undefined;
   const profile = input.profile ? normalizeAgentIdentitySegment(input.profile) : undefined;
-  const harness = input.harness ? normalizeAgentIdentitySegment(input.harness) : undefined;
+  const rawHarness = input.harness ? normalizeAgentIdentitySegment(input.harness) : undefined;
+  const harness = rawHarness === "oc" ? "opencode" : rawHarness;
   const model = input.model ? normalizeAgentIdentitySegment(input.model) : undefined;
   const nodeQualifier = input.nodeQualifier ? normalizeAgentIdentitySegment(input.nodeQualifier) : undefined;
   if (!definitionId) {
@@ -19764,6 +19966,21 @@ function normalizeScoutPermissionProfile(value) {
   return SCOUT_PERMISSION_PROFILES.find((profile) => profile === normalized);
 }
 
+// ../protocol/dist/presence.js
+var PRESENCE_STALE_AFTER_MS = 45000;
+var PRESENCE_GONE_AFTER_STALE_MS = 60000;
+function presenceLifecycle(beat, now, options = {}) {
+  if (now < beat.staleAt)
+    return "fresh";
+  const goneAfterStaleMs = options.goneAfterStaleMs ?? PRESENCE_GONE_AFTER_STALE_MS;
+  if (now < beat.staleAt + goneAfterStaleMs)
+    return "stale";
+  return "gone";
+}
+function isPresenceGone(beat, now, options = {}) {
+  return presenceLifecycle(beat, now, options) === "gone";
+}
+
 // ../protocol/dist/runtime-catalog.generated.js
 var SCOUT_RUNTIME_CATALOG_DATA = {
   schemaVersion: "openscout.runtime-catalog.v1",
@@ -20210,7 +20427,9 @@ var SCOUT_RESERVED_RUNTIME_PROFILE_IDS = [
   "fable",
   "kimi",
   "grok",
-  "opus"
+  "opus",
+  "oc",
+  "opencode"
 ];
 
 // ../protocol/dist/runtime-catalog.js
@@ -20608,22 +20827,22 @@ function validateScoutRendezvousCodename(codename) {
 
 // ../runtime/dist/claude-statusline.js
 import { appendFile, mkdir as mkdir2, readFile as readFile3, writeFile as writeFile2 } from "node:fs/promises";
-import { basename as basename2, dirname as dirname5, join as join8 } from "node:path";
+import { basename as basename2, dirname as dirname6, join as join9 } from "node:path";
 function resolveClaudeStatuslineDirectory() {
-  return join8(resolveOpenScoutSupportPaths().runtimeDirectory, "statusline");
+  return join9(resolveOpenScoutSupportPaths().runtimeDirectory, "statusline");
 }
 function resolveClaudeStatuslineDelegatePath() {
-  return join8(resolveClaudeStatuslineDirectory(), "claude-delegate.json");
+  return join9(resolveClaudeStatuslineDirectory(), "claude-delegate.json");
 }
 function resolveClaudeStatuslineWrapperPath() {
-  return join8(resolveClaudeStatuslineDirectory(), "claude-statusline.sh");
+  return join9(resolveClaudeStatuslineDirectory(), "claude-statusline.sh");
 }
 async function writeClaudeStatuslineDelegate(delegate, path = resolveClaudeStatuslineDelegatePath()) {
   const next = {
     version: 1,
     ...delegate
   };
-  await mkdir2(dirname5(path), { recursive: true });
+  await mkdir2(dirname6(path), { recursive: true });
   await writeFile2(path, JSON.stringify(next, null, 2) + `
 `, "utf8");
   return next;
@@ -20638,9 +20857,9 @@ function isOpenScoutClaudeStatuslineCommand(command, wrapperPath = resolveClaude
 }
 
 // ../runtime/dist/managed-installs.js
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 import { mkdir as mkdir3, readFile as readFile4, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname as dirname6 } from "node:path";
+import { dirname as dirname7 } from "node:path";
 function emptyManagedInstallsFile(now = Date.now()) {
   return {
     version: 1,
@@ -20657,7 +20876,7 @@ function stableInstallId(input) {
     input.provider ?? "",
     input.targetPath ?? ""
   ].join("\x00");
-  return `install.${createHash("sha256").update(key).digest("hex").slice(0, 18)}`;
+  return `install.${createHash2("sha256").update(key).digest("hex").slice(0, 18)}`;
 }
 function normalizeManagedInstallsFile(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
@@ -20679,7 +20898,8 @@ async function readManagedInstallsFile(path = resolveOpenScoutSupportPaths().man
   }
 }
 async function writeManagedInstallsFile(file, path = resolveOpenScoutSupportPaths().managedInstallsPath) {
-  await mkdir3(dirname6(path), { recursive: true });
+  assertTestIsolatedUserData("write the managed-installs registry", "OPENSCOUT_SUPPORT_DIRECTORY");
+  await mkdir3(dirname7(path), { recursive: true });
   await writeFile3(path, JSON.stringify(file, null, 2) + `
 `, "utf8");
 }
@@ -20705,167 +20925,6 @@ async function upsertManagedInstall(input, now = Date.now()) {
   return next;
 }
 
-// ../runtime/dist/node-identity.js
-import { createHash as createHash2, createPrivateKey, createPublicKey, generateKeyPairSync, randomBytes, sign, verify } from "node:crypto";
-import { chmodSync, existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync5, renameSync as renameSync3, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "node:fs";
-import { dirname as dirname7, join as join9 } from "node:path";
-var NODE_IDENTITY_FILE = "node-identity.json";
-var NODE_FINGERPRINT_PREFIX = "osc1";
-var NODE_CARD_TTL_MS = 24 * 60 * 60 * 1000;
-var stableNodeQualifierCache = new Map;
-function nodeIdentityPath(supportDirectory) {
-  const dir = supportDirectory ?? resolveOpenScoutSupportPaths().supportDirectory;
-  return join9(dir, NODE_IDENTITY_FILE);
-}
-function loadOrCreateNodeIdentity(supportDirectory) {
-  const path = nodeIdentityPath(supportDirectory);
-  if (existsSync8(path)) {
-    return readAndValidateNodeIdentity(path);
-  }
-  return createNodeIdentity(supportDirectory);
-}
-function readStableNodeQualifier(supportDirectory) {
-  const path = nodeIdentityPath(supportDirectory);
-  const cached = stableNodeQualifierCache.get(path);
-  if (cached) {
-    return cached;
-  }
-  if (!existsSync8(path)) {
-    return null;
-  }
-  const nodeQualifier = normalizeNodeQualifier(readAndValidateNodeIdentity(path).nodeQualifier);
-  if (nodeQualifier) {
-    stableNodeQualifierCache.set(path, nodeQualifier);
-  }
-  return nodeQualifier || null;
-}
-function readAndValidateNodeIdentity(path) {
-  let parsed;
-  try {
-    parsed = JSON.parse(readFileSync5(path, "utf8"));
-  } catch {
-    throw new Error(`Corrupt node identity at ${path}; remove it to generate a fresh one.`);
-  }
-  if (parsed.version !== 1 || !parsed.publicKey || !parsed.privateKey) {
-    throw new Error(`Corrupt node identity at ${path}; remove it to generate a fresh one.`);
-  }
-  if (parsed.nodeQualifier !== undefined && normalizeNodeQualifier(parsed.nodeQualifier) !== parsed.nodeQualifier) {
-    throw new Error(`Corrupt node identity at ${path}; remove it to generate a fresh one.`);
-  }
-  try {
-    const derived = createPublicKey(importPrivateKey(parsed.privateKey)).export({ type: "spki", format: "der" }).toString("base64");
-    if (derived !== parsed.publicKey) {
-      throw new Error("mismatch");
-    }
-  } catch {
-    throw new Error(`Node identity at ${path} has mismatched or invalid keys; remove it to generate a fresh one.`);
-  }
-  return parsed;
-}
-function normalizeNodeQualifier(value) {
-  return typeof value === "string" ? value.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "") : "";
-}
-function createNodeIdentity(supportDirectory) {
-  if (!supportDirectory) {
-    assertTestIsolatedUserData("write the node identity", "OPENSCOUT_SUPPORT_DIRECTORY");
-  }
-  const path = nodeIdentityPath(supportDirectory);
-  const { publicKey, privateKey } = generateKeyPairSync("ed25519");
-  const identity = {
-    version: 1,
-    publicKey: publicKey.export({ type: "spki", format: "der" }).toString("base64"),
-    privateKey: privateKey.export({ type: "pkcs8", format: "der" }).toString("base64"),
-    createdAt: Date.now()
-  };
-  mkdirSync4(dirname7(path), { recursive: true });
-  try {
-    writeFileSync4(path, `${JSON.stringify(identity, null, 2)}
-`, { encoding: "utf8", mode: 384, flag: "wx" });
-  } catch (error) {
-    if (error.code === "EEXIST") {
-      return readAndValidateNodeIdentity(path);
-    }
-    throw error;
-  }
-  try {
-    chmodSync(path, 384);
-  } catch {}
-  return identity;
-}
-function nodeKeyId(publicKeyBase64) {
-  return createHash2("sha256").update(Buffer.from(publicKeyBase64, "base64")).digest("hex");
-}
-function nodeFingerprint(publicKeyBase64) {
-  const digest = createHash2("sha256").update(Buffer.from(publicKeyBase64, "base64")).digest();
-  const encoded = base32Encode(digest.subarray(0, 10)).toLowerCase();
-  return `${NODE_FINGERPRINT_PREFIX}:${encoded.slice(0, 4)}-${encoded.slice(4, 8)}`;
-}
-function signNodePayload(identity, payload) {
-  const key = importPrivateKey(identity.privateKey);
-  return sign(null, typeof payload === "string" ? Buffer.from(payload, "utf8") : payload, key).toString("base64");
-}
-function verifyNodeSignature(publicKeyBase64, payload, signatureBase64) {
-  try {
-    const key = importPublicKey(publicKeyBase64);
-    return verify(null, typeof payload === "string" ? Buffer.from(payload, "utf8") : payload, key, Buffer.from(signatureBase64, "base64"));
-  } catch {
-    return false;
-  }
-}
-function canonicalJson(value) {
-  if (value === null || typeof value !== "object") {
-    return JSON.stringify(value);
-  }
-  if (Array.isArray(value)) {
-    return `[${value.map(canonicalJson).join(",")}]`;
-  }
-  const record2 = value;
-  const keys = Object.keys(record2).sort();
-  return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalJson(record2[key])}`).join(",")}}`;
-}
-function verifySignedNodeCard(card, now = Date.now()) {
-  if (nodeKeyId(card.publicKey) !== card.keyId) {
-    return false;
-  }
-  if (nodeFingerprint(card.publicKey) !== card.fingerprint) {
-    return false;
-  }
-  if (!Number.isFinite(card.expiresAt) || card.expiresAt <= now) {
-    return false;
-  }
-  if (card.tls !== undefined) {
-    if (typeof card.tls !== "object" || card.tls === null || typeof card.tls.spkiFingerprint !== "string" || !/^[0-9a-f]{64}$/.test(card.tls.spkiFingerprint)) {
-      return false;
-    }
-  }
-  const { signature, ...unsigned } = card;
-  return verifyNodeSignature(card.publicKey, canonicalJson(unsigned), signature);
-}
-var BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
-function base32Encode(input) {
-  let bits = 0;
-  let value = 0;
-  let output = "";
-  for (const byte of input) {
-    value = value << 8 | byte;
-    bits += 8;
-    while (bits >= 5) {
-      output += BASE32_ALPHABET[value >>> bits - 5 & 31];
-      bits -= 5;
-    }
-  }
-  if (bits > 0) {
-    output += BASE32_ALPHABET[value << 5 - bits & 31];
-  }
-  return output;
-}
-function importPrivateKey(privateKeyBase64) {
-  return createPrivateKey({ key: Buffer.from(privateKeyBase64, "base64"), format: "der", type: "pkcs8" });
-}
-function importPublicKey(publicKeyBase64) {
-  return createPublicKey({ key: Buffer.from(publicKeyBase64, "base64"), format: "der", type: "spki" });
-}
-
 // ../runtime/dist/user-project-hints.js
 import { readdir, readFile as readFile5, stat } from "node:fs/promises";
 import { homedir as homedir7 } from "node:os";
@@ -21189,7 +21248,7 @@ async function collectUserLevelProjectRootHints(options = {}) {
 }
 
 // ../runtime/dist/setup.js
-var MANAGED_AGENT_HARNESSES = ["claude", "codex", "cursor", "grok", "grok-acp", "kimi", "pi"];
+var MANAGED_AGENT_HARNESSES = ["claude", "codex", "cursor", "grok", "grok-acp", "kimi", "pi", "opencode"];
 function titleCaseWords(value) {
   return value.split(/[\s._-]+/).map((part) => part.trim()).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
 }
@@ -21326,6 +21385,10 @@ var PROJECT_HARNESS_MARKERS = {
   pi: [
     "PI.md",
     ".pi"
+  ],
+  opencode: [
+    "OPENCODE.md",
+    ".opencode"
   ]
 };
 function partitionFlatAndNestedMarkers(markers) {
@@ -21416,6 +21479,9 @@ function normalizeManagedHarness(value, fallback) {
   if (value === "pi") {
     return "pi";
   }
+  if (value === "opencode") {
+    return "opencode";
+  }
   return fallback;
 }
 function titleCase(value) {
@@ -22160,7 +22226,8 @@ async function detectHarnessMarkers(projectRoot) {
     grok: [],
     "grok-acp": [],
     kimi: [],
-    pi: []
+    pi: [],
+    opencode: []
   };
   for (const harness2 of MANAGED_AGENT_HARNESSES) {
     for (const marker of PROJECT_HARNESS_MARKERS[harness2]) {
@@ -22341,6 +22408,7 @@ async function readOpenScoutSettings(options = {}) {
 async function writeOpenScoutSettings(settings, options = {}) {
   assertTestIsolatedUserData("write OpenScout settings", "OPENSCOUT_SUPPORT_DIRECTORY");
   ensureOpenScoutCleanSlateSync();
+  const settingsPath = resolveOpenScoutSupportPaths().settingsPath;
   const current = await readOpenScoutSettings(options);
   const merged = {
     ...current,
@@ -22394,7 +22462,11 @@ async function writeOpenScoutSettings(settings, options = {}) {
   const normalized = await normalizeSettingsRecord(merged, {
     currentDirectory: options.currentDirectory
   });
-  await writeJsonFile(resolveOpenScoutSupportPaths().settingsPath, normalized);
+  const settingsPathNow = resolveOpenScoutSupportPaths().settingsPath;
+  if (settingsPathNow !== settingsPath) {
+    throw new Error(`Refusing to write OpenScout settings: target moved from ${settingsPath} to ${settingsPathNow} mid-write (test teardown?).`);
+  }
+  await writeJsonFile(settingsPath, normalized);
   return normalized;
 }
 var SCOUT_SKILL_FILE_NAME = "SKILL.md";
@@ -22650,6 +22722,8 @@ async function readRelayAgentOverrides() {
   }));
 }
 async function writeRelayAgentOverrides(overrides) {
+  assertTestIsolatedUserData("write the relay-agents registry", "OPENSCOUT_SUPPORT_DIRECTORY");
+  const registryPath = resolveOpenScoutSupportPaths().relayAgentsRegistryPath;
   const normalizedAgents = Object.fromEntries(Object.entries(overrides).map(([agentId, record2]) => {
     const definitionId = normalizeAgentId(record2.definitionId || record2.agentId || agentId);
     const projectRoot = normalizePath(record2.projectRoot);
@@ -22683,7 +22757,11 @@ async function writeRelayAgentOverrides(overrides) {
       }
     ];
   }));
-  await writeJsonFile(resolveOpenScoutSupportPaths().relayAgentsRegistryPath, {
+  const registryPathNow = resolveOpenScoutSupportPaths().relayAgentsRegistryPath;
+  if (registryPathNow !== registryPath) {
+    throw new Error(`Refusing to write the relay-agents registry: target moved from ${registryPath} to ${registryPathNow} mid-write (test teardown?).`);
+  }
+  await writeJsonFile(registryPath, {
     version: 1,
     agents: normalizedAgents
   });
@@ -23361,6 +23439,7 @@ function loadUserConfig() {
   }
 }
 function saveUserConfig(config) {
+  assertTestIsolatedUserData("write the OpenScout user config", "OPENSCOUT_HOME");
   const configPath = userConfigPath();
   mkdirSync5(dirname10(configPath), { recursive: true });
   writeFileSync5(configPath, JSON.stringify(config, null, 2) + `
@@ -23510,10 +23589,8 @@ async function loadOpenScoutOnboardingState(options = {}) {
   const operatorNameSource = explicitUserName ? "user-config" : envOperatorName ? "env" : settingsOperatorName || answeredSettingsOperatorName ? "settings" : "default";
   const contextRoot = settings.discovery.contextRoot ?? null;
   const project = await resolveProjectConfig({ currentDirectory, contextRoot });
-  const [broker, catalog] = await Promise.all([
-    options.broker ?? brokerServiceStatus().catch(() => null),
-    options.catalog ?? loadHarnessCatalogSnapshot().catch(() => null)
-  ]);
+  const broker = options.broker ?? await brokerServiceStatus().catch(() => null);
+  const catalog = options.catalog ?? await loadHarnessCatalogSnapshot().catch(() => null);
   const readyRuntimeCount = catalog?.entries.filter((entry) => entry.readinessReport.ready).length ?? 0;
   const hasReadyRuntime = readyRuntimeCount > 0;
   const hasLocalConfig = localConfigExists();
@@ -23580,11 +23657,7 @@ async function ensureOpenScoutOnboardingLocalConfig(options = {}) {
   }, {
     currentDirectory: options.currentDirectory
   });
-  return loadOpenScoutOnboardingState({
-    currentDirectory: options.currentDirectory,
-    broker: options.broker,
-    catalog: options.catalog
-  });
+  return loadOpenScoutOnboardingState({ currentDirectory: options.currentDirectory });
 }
 async function saveOpenScoutOnboardingIdentity(input) {
   const name = input.name.trim();
@@ -23604,11 +23677,7 @@ async function saveOpenScoutOnboardingIdentity(input) {
   }, {
     currentDirectory: input.currentDirectory
   });
-  return loadOpenScoutOnboardingState({
-    currentDirectory: input.currentDirectory,
-    broker: input.broker,
-    catalog: input.catalog
-  });
+  return loadOpenScoutOnboardingState({ currentDirectory: input.currentDirectory });
 }
 async function saveOpenScoutOnboardingProject(input) {
   const contextRoot = normalizePath2(input.contextRoot);
@@ -23636,11 +23705,7 @@ async function saveOpenScoutOnboardingProject(input) {
   }, {
     currentDirectory: input.currentDirectory ?? contextRoot
   });
-  return loadOpenScoutOnboardingState({
-    currentDirectory: contextRoot,
-    broker: input.broker,
-    catalog: input.catalog
-  });
+  return loadOpenScoutOnboardingState({ currentDirectory: contextRoot });
 }
 async function triggerMeshDiscovery(broker) {
   if (!broker.reachable || !broker.brokerUrl)
@@ -36975,6 +37040,125 @@ class ThreadEventPlane {
     watch.clients.clear();
   }
 }
+// ../runtime/dist/activity-transitions.js
+class ActivityTransitionTracker {
+  transitions = new Map;
+  record(agentId, activity, observedAt, now) {
+    const previous = this.transitions.get(agentId);
+    if (previous && previous.activity === activity) {
+      return previous.transitionAt;
+    }
+    const transitionAt = Number.isFinite(observedAt) ? Math.min(observedAt, now) : now;
+    this.transitions.set(agentId, { activity, transitionAt });
+    return transitionAt;
+  }
+  peek(agentId) {
+    const transition = this.transitions.get(agentId);
+    return transition ? { ...transition } : undefined;
+  }
+  forget(agentId) {
+    this.transitions.delete(agentId);
+  }
+  clear() {
+    this.transitions.clear();
+  }
+  size() {
+    return this.transitions.size;
+  }
+}
+// ../runtime/dist/presence-map.js
+var DEFAULT_DETAIL_DEBOUNCE_MS = 5000;
+
+class BrokerPresenceMap {
+  beats = new Map;
+  lastDetailChangeAt = new Map;
+  staleAfterMs;
+  goneAfterStaleMs;
+  detailDebounceMs;
+  transitions;
+  constructor(options = {}) {
+    this.staleAfterMs = options.staleAfterMs ?? PRESENCE_STALE_AFTER_MS;
+    this.goneAfterStaleMs = options.goneAfterStaleMs ?? PRESENCE_GONE_AFTER_STALE_MS;
+    this.detailDebounceMs = options.detailDebounceMs ?? DEFAULT_DETAIL_DEBOUNCE_MS;
+    this.transitions = options.transitions ?? new ActivityTransitionTracker;
+  }
+  observe(observation, now) {
+    const agentId = observation.agentId ?? observation.status.agentId ?? observation.status.subjectId;
+    if (!agentId)
+      return;
+    const status = observation.status;
+    if (isTransportInferredStall(status))
+      return;
+    const updatedAt = Math.min(status.updatedAt, now);
+    const staleAt = Math.max(status.staleAt ?? 0, updatedAt + this.staleAfterMs);
+    if (isPresenceGone({ staleAt }, now, { goneAfterStaleMs: this.goneAfterStaleMs })) {
+      this.forget(agentId);
+      return;
+    }
+    const previous = this.beats.get(agentId);
+    const detail = status.detail?.title ?? undefined;
+    const transitionAt = this.transitions.record(agentId, status.activity, status.transitionAt ?? status.updatedAt, now);
+    const activityChanged = previous?.activity !== status.activity;
+    const detailChanged = previous !== undefined && previous.detail !== detail;
+    const debounceElapsed = now - (this.lastDetailChangeAt.get(agentId) ?? 0) >= this.detailDebounceMs;
+    const transitioned = previous === undefined || activityChanged || detailChanged && debounceElapsed;
+    if (activityChanged || detailChanged && debounceElapsed) {
+      this.lastDetailChangeAt.set(agentId, now);
+    }
+    const beat = {
+      agentId,
+      displayName: observation.displayName ?? previous?.displayName,
+      activity: status.activity,
+      phase: status.phase,
+      detail,
+      transitionAt,
+      updatedAt,
+      staleAt,
+      confidence: status.confidence,
+      needRef: observation.needRef,
+      boundConversationId: observation.boundConversationId
+    };
+    this.beats.set(agentId, beat);
+    return { beat, transitioned, previousActivity: previous?.activity };
+  }
+  snapshot(now) {
+    this.prune(now);
+    return { at: now, beats: [...this.beats.values()] };
+  }
+  get(agentId) {
+    return this.beats.get(agentId);
+  }
+  prune(now) {
+    const dropped = [];
+    for (const [agentId, beat] of this.beats) {
+      if (!isPresenceGone(beat, now, { goneAfterStaleMs: this.goneAfterStaleMs }))
+        continue;
+      this.beats.delete(agentId);
+      this.lastDetailChangeAt.delete(agentId);
+      this.transitions.forget(agentId);
+      dropped.push(agentId);
+    }
+    return dropped;
+  }
+  forget(agentId) {
+    this.beats.delete(agentId);
+    this.lastDetailChangeAt.delete(agentId);
+    this.transitions.forget(agentId);
+  }
+  clear() {
+    this.beats.clear();
+    this.lastDetailChangeAt.clear();
+    this.transitions.clear();
+  }
+  size() {
+    return this.beats.size;
+  }
+}
+function isTransportInferredStall(status) {
+  if (status.activity !== "stalled")
+    return false;
+  return status.provenance.some((entry) => entry.source === "staleness_inference");
+}
 // ../runtime/dist/issue-runner.js
 var CLAIM_TERMINAL_STATES = new Set(["released", "expired", "cancelled"]);
 var ACTIVE_FLIGHT_STATES2 = new Set(["queued", "waking", "running", "waiting"]);