@openscout/scout 0.2.86 → 0.2.90

package/dist/pairing-runtime-controller.mjs

@@ -123,236 +123,28 @@ function ensureOpenScoutCleanSlateSync() {
 var OPENSCOUT_RPC_CUTOVER_MARKER = "rpc-runtime-cutover-v1";
 var init_support_paths = () => {};
 
-// ../runtime/src/node-identity.ts
-import {
-  createHash,
-  createPrivateKey,
-  createPublicKey,
-  generateKeyPairSync,
-  randomBytes,
-  sign,
-  verify
-} from "crypto";
+// ../runtime/src/local-config.ts
 import {
-  chmodSync,
   existsSync as existsSync2,
   mkdirSync as mkdirSync2,
   readFileSync,
   renameSync,
-  rmSync as rmSync2,
   writeFileSync as writeFileSync2
 } from "fs";
-import { dirname, join as join2 } from "path";
-function stripBonjourCollisionSuffix(value) {
-  if (!value || typeof value !== "string")
-    return "";
-  let trimmed = value.trim();
-  const isDotLocal = /\.local\.?$/i.test(trimmed);
-  if (isDotLocal) {
-    trimmed = trimmed.replace(/\.local\.?$/i, "");
-  }
-  const isHyphenLocalOpenscout = /-local-openscout$/i.test(trimmed);
-  const isHyphenLocal = !isHyphenLocalOpenscout && /-local$/i.test(trimmed);
-  if (isHyphenLocalOpenscout) {
-    trimmed = trimmed.replace(/-local-openscout$/i, "");
-  } else if (isHyphenLocal) {
-    trimmed = trimmed.replace(/-local$/i, "");
-  }
-  if (!isDotLocal && !isHyphenLocalOpenscout && !isHyphenLocal) {
-    return trimmed;
-  }
-  trimmed = trimmed.replace(/(?<=[a-zA-Z].*?)(?:-\d+)+$/, "");
-  if (isDotLocal)
-    return `${trimmed}.local`;
-  if (isHyphenLocalOpenscout)
-    return `${trimmed}-local-openscout`;
-  if (isHyphenLocal)
-    return `${trimmed}-local`;
-  return trimmed;
-}
-function nodeIdentityPath(supportDirectory) {
-  const dir = supportDirectory ?? resolveOpenScoutSupportPaths().supportDirectory;
-  return join2(dir, NODE_IDENTITY_FILE);
-}
-function loadOrCreateNodeIdentity(supportDirectory) {
-  const path = nodeIdentityPath(supportDirectory);
-  if (existsSync2(path)) {
-    return readAndValidateNodeIdentity(path);
-  }
-  return createNodeIdentity(supportDirectory);
-}
-function readStableNodeQualifier(supportDirectory) {
-  const path = nodeIdentityPath(supportDirectory);
-  const cached = stableNodeQualifierCache.get(path);
-  if (cached) {
-    return cached;
-  }
-  if (!existsSync2(path)) {
-    return null;
-  }
-  const nodeQualifier = normalizeNodeQualifier(readAndValidateNodeIdentity(path).nodeQualifier);
-  if (nodeQualifier) {
-    stableNodeQualifierCache.set(path, nodeQualifier);
-  }
-  return nodeQualifier || null;
-}
-function readAndValidateNodeIdentity(path) {
-  let parsed;
-  try {
-    parsed = JSON.parse(readFileSync(path, "utf8"));
-  } catch {
-    throw new Error(`Corrupt node identity at ${path}; remove it to generate a fresh one.`);
-  }
-  if (parsed.version !== 1 || !parsed.publicKey || !parsed.privateKey) {
-    throw new Error(`Corrupt node identity at ${path}; remove it to generate a fresh one.`);
-  }
-  if (parsed.nodeQualifier !== undefined && normalizePersistedNodeQualifier(parsed.nodeQualifier) !== parsed.nodeQualifier) {
-    throw new Error(`Corrupt node identity at ${path}; remove it to generate a fresh one.`);
-  }
-  try {
-    const derived = createPublicKey(importPrivateKey(parsed.privateKey)).export({ type: "spki", format: "der" }).toString("base64");
-    if (derived !== parsed.publicKey) {
-      throw new Error("mismatch");
-    }
-  } catch {
-    throw new Error(`Node identity at ${path} has mismatched or invalid keys; remove it to generate a fresh one.`);
-  }
-  return parsed;
-}
-function normalizePersistedNodeQualifier(value) {
-  return typeof value === "string" ? value.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "") : "";
-}
-function normalizeNodeQualifier(value) {
-  return stripBonjourCollisionSuffix(normalizePersistedNodeQualifier(value));
-}
-function createNodeIdentity(supportDirectory) {
-  if (!supportDirectory) {
-    assertTestIsolatedUserData("write the node identity", "OPENSCOUT_SUPPORT_DIRECTORY");
-  }
-  const path = nodeIdentityPath(supportDirectory);
-  const { publicKey, privateKey } = generateKeyPairSync("ed25519");
-  const identity = {
-    version: 1,
-    publicKey: publicKey.export({ type: "spki", format: "der" }).toString("base64"),
-    privateKey: privateKey.export({ type: "pkcs8", format: "der" }).toString("base64"),
-    createdAt: Date.now()
-  };
-  mkdirSync2(dirname(path), { recursive: true });
-  try {
-    writeFileSync2(path, `${JSON.stringify(identity, null, 2)}
-`, { encoding: "utf8", mode: 384, flag: "wx" });
-  } catch (error) {
-    if (error.code === "EEXIST") {
-      return readAndValidateNodeIdentity(path);
-    }
-    throw error;
-  }
-  try {
-    chmodSync(path, 384);
-  } catch {}
-  return identity;
-}
-function nodeKeyId(publicKeyBase64) {
-  return createHash("sha256").update(Buffer.from(publicKeyBase64, "base64")).digest("hex");
-}
-function nodeFingerprint(publicKeyBase64) {
-  const digest = createHash("sha256").update(Buffer.from(publicKeyBase64, "base64")).digest();
-  const encoded = base32Encode(digest.subarray(0, 10)).toLowerCase();
-  return `${NODE_FINGERPRINT_PREFIX}:${encoded.slice(0, 4)}-${encoded.slice(4, 8)}`;
-}
-function signNodePayload(identity, payload) {
-  const key = importPrivateKey(identity.privateKey);
-  return sign(null, typeof payload === "string" ? Buffer.from(payload, "utf8") : payload, key).toString("base64");
-}
-function verifyNodeSignature(publicKeyBase64, payload, signatureBase64) {
-  try {
-    const key = importPublicKey(publicKeyBase64);
-    return verify(null, typeof payload === "string" ? Buffer.from(payload, "utf8") : payload, key, Buffer.from(signatureBase64, "base64"));
-  } catch {
-    return false;
-  }
-}
-function canonicalJson(value) {
-  if (value === null || typeof value !== "object") {
-    return JSON.stringify(value);
-  }
-  if (Array.isArray(value)) {
-    return `[${value.map(canonicalJson).join(",")}]`;
-  }
-  const record = value;
-  const keys = Object.keys(record).sort();
-  return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(",")}}`;
-}
-function verifySignedNodeCard(card, now = Date.now()) {
-  if (nodeKeyId(card.publicKey) !== card.keyId) {
-    return false;
-  }
-  if (nodeFingerprint(card.publicKey) !== card.fingerprint) {
-    return false;
-  }
-  if (!Number.isFinite(card.expiresAt) || card.expiresAt <= now) {
-    return false;
-  }
-  if (card.tls !== undefined) {
-    if (typeof card.tls !== "object" || card.tls === null || typeof card.tls.spkiFingerprint !== "string" || !/^[0-9a-f]{64}$/.test(card.tls.spkiFingerprint)) {
-      return false;
-    }
-  }
-  const { signature, ...unsigned } = card;
-  return verifyNodeSignature(card.publicKey, canonicalJson(unsigned), signature);
-}
-function base32Encode(input) {
-  let bits = 0;
-  let value = 0;
-  let output = "";
-  for (const byte of input) {
-    value = value << 8 | byte;
-    bits += 8;
-    while (bits >= 5) {
-      output += BASE32_ALPHABET[value >>> bits - 5 & 31];
-      bits -= 5;
-    }
-  }
-  if (bits > 0) {
-    output += BASE32_ALPHABET[value << 5 - bits & 31];
-  }
-  return output;
-}
-function importPrivateKey(privateKeyBase64) {
-  return createPrivateKey({ key: Buffer.from(privateKeyBase64, "base64"), format: "der", type: "pkcs8" });
-}
-function importPublicKey(publicKeyBase64) {
-  return createPublicKey({ key: Buffer.from(publicKeyBase64, "base64"), format: "der", type: "spki" });
-}
-var NODE_IDENTITY_FILE = "node-identity.json", NODE_FINGERPRINT_PREFIX = "osc1", NODE_CARD_TTL_MS, stableNodeQualifierCache, BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
-var init_node_identity = __esm(() => {
-  init_support_paths();
-  NODE_CARD_TTL_MS = 24 * 60 * 60 * 1000;
-  stableNodeQualifierCache = new Map;
-});
-
-// ../runtime/src/local-config.ts
-import {
-  existsSync as existsSync3,
-  mkdirSync as mkdirSync3,
-  readFileSync as readFileSync2,
-  renameSync as renameSync2,
-  writeFileSync as writeFileSync3
-} from "fs";
 import { homedir as homedir2, hostname as osHostname } from "os";
-import { dirname as dirname2, join as join3 } from "path";
+import { dirname, join as join2 } from "path";
 function localConfigHome() {
-  return process.env.OPENSCOUT_HOME ?? join3(homedir2(), ".openscout");
+  return process.env.OPENSCOUT_HOME ?? join2(homedir2(), ".openscout");
 }
 function localConfigPath() {
-  return join3(localConfigHome(), "config.json");
+  return join2(localConfigHome(), "config.json");
 }
 function loadLocalConfig() {
   const configPath = localConfigPath();
-  if (!existsSync3(configPath))
+  if (!existsSync2(configPath))
     return { version: LOCAL_CONFIG_VERSION };
   try {
-    return validateLocalConfig(JSON.parse(readFileSync2(configPath, "utf8")));
+    return validateLocalConfig(JSON.parse(readFileSync(configPath, "utf8")));
   } catch {
     return { version: LOCAL_CONFIG_VERSION };
   }
@@ -436,7 +228,6 @@ function resolveHost() {
 var LOCAL_CONFIG_VERSION = 1, DEFAULT_SCOUT_WEB_PORTAL_HOST = "scout.local", DEFAULT_SCOUT_WEB_DEV_HOST, OPENSCOUT_PORTS, DEFAULT_LOCAL_CONFIG;
 var init_local_config = __esm(() => {
   init_support_paths();
-  init_node_identity();
   DEFAULT_SCOUT_WEB_DEV_HOST = `dev.${DEFAULT_SCOUT_WEB_PORTAL_HOST}`;
   OPENSCOUT_PORTS = {
     broker: 43110,
@@ -461,7 +252,7 @@ var init_local_config = __esm(() => {
 });
 
 // ../runtime/src/open-scout-network.ts
-import { readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync2 } from "fs";
 function defaultOpenScoutNetworkSettings() {
   return {
     discoveryEnabled: false,
@@ -482,7 +273,7 @@ function normalizeOpenScoutNetworkSettings(input) {
 }
 function readOpenScoutNetworkSettingsSync() {
   try {
-    const raw = readFileSync3(resolveOpenScoutSupportPaths().settingsPath, "utf8");
+    const raw = readFileSync2(resolveOpenScoutSupportPaths().settingsPath, "utf8");
     const parsed = JSON.parse(raw);
     const network = isRecord(parsed) && isRecord(parsed.network) ? parsed.network : {};
     return normalizeOpenScoutNetworkSettings(isRecord(network.openScoutNetwork) ? network.openScoutNetwork : {});
@@ -525,7 +316,7 @@ var init_open_scout_network = __esm(() => {
 // ../agent-sessions/src/codex-executable.ts
 import { execFileSync } from "child_process";
 import { accessSync, constants } from "fs";
-import { delimiter, join as join4 } from "path";
+import { delimiter, join as join3 } from "path";
 function isExecutable(filePath) {
   if (!filePath)
     return false;
@@ -569,11 +360,11 @@ function codexAppBundleCandidates(env) {
   const appNames = ["Codex.app", "ChatGPT.app"];
   const candidates = appNames.flatMap((appName) => [
     {
-      path: join4("/Applications", appName, "Contents", "Resources", "codex"),
+      path: join3("/Applications", appName, "Contents", "Resources", "codex"),
       source: "codex_app_bundle"
     },
     {
-      path: join4(env.HOME ?? "", "Applications", appName, "Contents", "Resources", "codex"),
+      path: join3(env.HOME ?? "", "Applications", appName, "Contents", "Resources", "codex"),
       source: "codex_app_bundle"
     }
   ]);
@@ -581,7 +372,7 @@ function codexAppBundleCandidates(env) {
 }
 function pathCandidates(env) {
   return (env.PATH ?? "").split(delimiter).filter(Boolean).map((directory) => ({
-    path: join4(directory, "codex"),
+    path: join3(directory, "codex"),
     source: "path"
   }));
 }
@@ -592,7 +383,7 @@ function commonCandidates(env) {
     "/opt/homebrew/bin",
     "/usr/local/bin"
   ].filter(Boolean).map((directory) => ({
-    path: join4(directory, "codex"),
+    path: join3(directory, "codex"),
     source: "common"
   }));
 }
@@ -876,10 +667,10 @@ var init_auth = __esm(() => {
 
 // ../runtime/src/harness-catalog.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync5, statSync } from "fs";
+import { existsSync as existsSync4, statSync } from "fs";
 import { mkdir, readFile, writeFile } from "fs/promises";
 import { homedir as homedir4 } from "os";
-import { dirname as dirname3, join as join5 } from "path";
+import { dirname as dirname2, join as join4 } from "path";
 function readinessFromAuthModel(harness) {
   const model = harnessAuthModel(harness);
   if (!model)
@@ -912,7 +703,7 @@ function expandHomePath(value) {
   if (value === "~")
     return home;
   if (value.startsWith("~/"))
-    return join5(home, value.slice(2));
+    return join4(home, value.slice(2));
   return value;
 }
 function defaultWhichBinary(binary, platform) {
@@ -946,7 +737,7 @@ function defaultRunCommand(command, platform) {
 }
 function defaultRequirementExists(requirement) {
   const expanded = expandHomePath(requirement.path);
-  if (!existsSync5(expanded))
+  if (!existsSync4(expanded))
     return false;
   if (requirement.fileType === "any" || !requirement.fileType)
     return true;
@@ -1175,7 +966,7 @@ async function readHarnessCatalogOverrides(overridePath = resolveOpenScoutSuppor
   }
 }
 async function writeHarnessCatalogOverrides(overrides, overridePath = resolveOpenScoutSupportPaths().harnessCatalogPath) {
-  await mkdir(dirname3(overridePath), { recursive: true });
+  await mkdir(dirname2(overridePath), { recursive: true });
   const payload = {
     version: HARNESS_CATALOG_VERSION,
     entries: overrides,
@@ -1185,7 +976,7 @@ async function writeHarnessCatalogOverrides(overrides, overridePath = resolveOpe
 `, "utf8");
 }
 async function ensureHarnessCatalogOverrideFile(overridePath = resolveOpenScoutSupportPaths().harnessCatalogPath) {
-  if (existsSync5(overridePath))
+  if (existsSync4(overridePath))
     return;
   await writeHarnessCatalogOverrides({}, overridePath);
 }
@@ -4940,7 +4731,7 @@ var init_model_window_registry = __esm(() => {
 });
 
 // ../agent-sessions/src/history.ts
-import { basename, dirname as dirname4 } from "path";
+import { basename, dirname as dirname3 } from "path";
 function decodeClaudeProjectsSlug(name) {
   if (!name || !name.startsWith("-")) {
     return null;
@@ -4952,7 +4743,7 @@ function decodeClaudeProjectsSlug(name) {
   return `/${tail.replace(/-/g, "/")}`;
 }
 function inferClaudeHistoryCwd(path2) {
-  const parent = basename(dirname4(path2));
+  const parent = basename(dirname3(path2));
   return decodeClaudeProjectsSlug(parent);
 }
 function deriveHistoryName(path2) {
@@ -4960,7 +4751,7 @@ function deriveHistoryName(path2) {
   if (claudeCwd) {
     return basename(claudeCwd) || claudeCwd;
   }
-  const parent = basename(dirname4(path2));
+  const parent = basename(dirname3(path2));
   return parent || basename(path2) || "History Session";
 }
 function normalizeTimestamp(value) {
@@ -6862,9 +6653,9 @@ function createLiveNormalizerContext(sessionId) {
 }
 
 // ../agent-sessions/src/adapters/claude-code/team-topology.ts
-import { existsSync as existsSync6, readdirSync, readFileSync as readFileSync5, statSync as statSync2 } from "fs";
+import { existsSync as existsSync5, readdirSync, readFileSync as readFileSync4, statSync as statSync2 } from "fs";
 import { homedir as homedir5 } from "os";
-import { basename as basename2, dirname as dirname5, join as join6, relative } from "path";
+import { basename as basename2, dirname as dirname4, join as join5, relative } from "path";
 function isObject(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
@@ -6887,7 +6678,7 @@ function sourceRefId(kind, value) {
 }
 function readJsonObject(path2) {
   try {
-    const parsed = JSON.parse(readFileSync5(path2, "utf8"));
+    const parsed = JSON.parse(readFileSync4(path2, "utf8"));
     return isObject(parsed) ? parsed : null;
   } catch {
     return null;
@@ -6908,17 +6699,17 @@ function statIsFile(path2) {
   }
 }
 function readTeamConfigs(homeDir) {
-  const teamsRoot = join6(homeDir, ".claude", "teams");
-  if (!existsSync6(teamsRoot) || !statIsDirectory(teamsRoot)) {
+  const teamsRoot = join5(homeDir, ".claude", "teams");
+  if (!existsSync5(teamsRoot) || !statIsDirectory(teamsRoot)) {
     return [];
   }
   const teams = [];
   for (const entry of readdirSync(teamsRoot)) {
-    const teamDir = join6(teamsRoot, entry);
+    const teamDir = join5(teamsRoot, entry);
     if (!statIsDirectory(teamDir)) {
       continue;
     }
-    const configPath = join6(teamDir, "config.json");
+    const configPath = join5(teamDir, "config.json");
     const config = readJsonObject(configPath);
     if (!config) {
       continue;
@@ -7056,8 +6847,8 @@ function membersFromConfig(team, groupId, configRefId) {
   return { agents, relationships, agentByExternal };
 }
 function readTaskFiles(tasksRoot, teamName) {
-  const teamTasksRoot = join6(tasksRoot, teamName);
-  if (!existsSync6(teamTasksRoot) || !statIsDirectory(teamTasksRoot)) {
+  const teamTasksRoot = join5(tasksRoot, teamName);
+  if (!existsSync5(teamTasksRoot) || !statIsDirectory(teamTasksRoot)) {
     return [];
   }
   const result = [];
@@ -7067,7 +6858,7 @@ function readTaskFiles(tasksRoot, teamName) {
     if (!current)
       continue;
     for (const entry of readdirSync(current)) {
-      const path2 = join6(current, entry);
+      const path2 = join5(current, entry);
       if (statIsDirectory(path2)) {
         stack.push(path2);
       } else if (statIsFile(path2)) {
@@ -7098,14 +6889,14 @@ function firstMarkdownTitle(raw) {
 function parseTaskFile(taskPath, teamName, tasksRoot, sourceRef) {
   let raw;
   try {
-    raw = readFileSync5(taskPath, "utf8");
+    raw = readFileSync4(taskPath, "utf8");
   } catch {
     return null;
   }
-  const relativePath = relative(join6(tasksRoot, teamName), taskPath);
+  const relativePath = relative(join5(tasksRoot, teamName), taskPath);
   const fallbackId = relativePath.replace(/\.[^.]+$/u, "");
   const fallbackTitle = firstMarkdownTitle(raw) ?? basename2(fallbackId);
-  const inferredState = inferTaskStateFromPath(dirname5(relativePath));
+  const inferredState = inferTaskStateFromPath(dirname4(relativePath));
   let parsed = null;
   try {
     const json = JSON.parse(raw);
@@ -7136,7 +6927,7 @@ function parseTaskFile(taskPath, teamName, tasksRoot, sourceRef) {
   };
 }
 function tasksFromFiles(homeDir, teamName, agentByExternal) {
-  const tasksRoot = join6(homeDir, ".claude", "tasks");
+  const tasksRoot = join5(homeDir, ".claude", "tasks");
   const taskFiles = readTaskFiles(tasksRoot, teamName);
   const sourceRefs = [];
   const parsedTasks = [];
@@ -8350,9 +8141,9 @@ function flushLine(line, onLine) {
 }
 
 // ../agent-sessions/src/adapters/claude-code/adapter.ts
-import { existsSync as existsSync7, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
+import { existsSync as existsSync6, readdirSync as readdirSync2, statSync as statSync3 } from "fs";
 import { homedir as homedir6 } from "os";
-import { delimiter as delimiter2, join as join7 } from "path";
+import { delimiter as delimiter2, join as join6 } from "path";
 function asRecord2(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
@@ -8365,8 +8156,8 @@ function resolveClaudeResumeContext(config) {
   if (!resumeId) {
     return null;
   }
-  const projectsRoot = join7(homedir6(), ".claude", "projects");
-  if (!existsSync7(projectsRoot)) {
+  const projectsRoot = join6(homedir6(), ".claude", "projects");
+  if (!existsSync6(projectsRoot)) {
     return null;
   }
   let projectSlugs;
@@ -8376,8 +8167,8 @@ function resolveClaudeResumeContext(config) {
     return null;
   }
   for (const slug of projectSlugs) {
-    const sessionPath = join7(projectsRoot, slug, `${resumeId}.jsonl`);
-    if (!existsSync7(sessionPath)) {
+    const sessionPath = join6(projectsRoot, slug, `${resumeId}.jsonl`);
+    if (!existsSync6(sessionPath)) {
       continue;
     }
     const cwd = decodeClaudeProjectsSlug2(slug);
@@ -8417,7 +8208,7 @@ function resolveExecutableFromPath(command, env) {
   for (const directory of pathValue.split(delimiter2)) {
     if (!directory)
       continue;
-    const candidate = join7(directory, command);
+    const candidate = join6(directory, command);
     try {
       if (statSync3(candidate).isFile()) {
         return candidate;
@@ -8724,9 +8515,9 @@ var init_claude_code = __esm(() => {
 });
 
 // ../agent-sessions/src/codex-launch-config.ts
-import { accessSync as accessSync2, constants as constants2, existsSync as existsSync8 } from "fs";
+import { accessSync as accessSync2, constants as constants2, existsSync as existsSync7 } from "fs";
 import { homedir as homedir7 } from "os";
-import { basename as basename3, delimiter as delimiter3, dirname as dirname6, join as join8, resolve } from "path";
+import { basename as basename3, delimiter as delimiter3, dirname as dirname5, join as join7, resolve } from "path";
 import { fileURLToPath } from "url";
 function isExecutable2(filePath) {
   if (!filePath) {
@@ -8747,7 +8538,7 @@ function ancestorChain(start) {
   let current = resolve(start);
   while (true) {
     chain.push(current);
-    const parent = dirname6(current);
+    const parent = dirname5(current);
     if (parent === current) {
       return chain;
     }
@@ -8757,14 +8548,14 @@ function ancestorChain(start) {
 function resolveExecutableFromSearchPath(names, env) {
   const pathEntries = (env.PATH ?? "").split(delimiter3).filter(Boolean);
   const commonDirectories = [
-    join8(homedir7(), ".local", "bin"),
-    join8(homedir7(), ".bun", "bin"),
+    join7(homedir7(), ".local", "bin"),
+    join7(homedir7(), ".bun", "bin"),
     "/opt/homebrew/bin",
     "/usr/local/bin"
   ];
   for (const directory of [...pathEntries, ...commonDirectories]) {
     for (const name of names) {
-      const candidate = join8(directory, name);
+      const candidate = join7(directory, name);
       if (isExecutable2(candidate)) {
         return candidate;
       }
@@ -8803,12 +8594,12 @@ function resolveScoutExecutable(env) {
   return resolveExecutableFromSearchPath(["scout"], env);
 }
 function resolveRepoScoutScript(currentDirectory) {
-  const moduleDirectory = dirname6(fileURLToPath(import.meta.url));
+  const moduleDirectory = dirname5(fileURLToPath(import.meta.url));
   const starts = uniquePaths([currentDirectory, moduleDirectory]);
   for (const start of starts) {
     for (const candidate of ancestorChain(start)) {
-      const scriptPath = join8(candidate, "apps", "desktop", "bin", "scout.ts");
-      if (existsSync8(scriptPath)) {
+      const scriptPath = join7(candidate, "apps", "desktop", "bin", "scout.ts");
+      if (existsSync7(scriptPath)) {
         return scriptPath;
       }
     }
@@ -8898,7 +8689,7 @@ var init_secret_redaction = __esm(() => {
 // ../agent-sessions/src/local/transports/codex-app-server.ts
 import { spawn } from "child_process";
 import { appendFile, mkdir as mkdir2, readFile as readFile2, rm, stat, writeFile as writeFile2 } from "fs/promises";
-import { join as join9 } from "path";
+import { join as join8 } from "path";
 function codexAppServerExitMessage(input) {
   if (input.exitKind === "proactive_shutdown") {
     return `Codex app-server session for ${input.agentName} was stopped by OpenScout` + (input.reason ? `: ${input.reason}` : "") + ".";
@@ -9213,7 +9004,7 @@ function parseCodexMaybeJson(value) {
   }
 }
 async function readCodexSessionCatalog(runtimeDirectory) {
-  const raw = await readOptionalFile(join9(runtimeDirectory, SESSION_CATALOG_FILENAME));
+  const raw = await readOptionalFile(join8(runtimeDirectory, SESSION_CATALOG_FILENAME));
   if (!raw) {
     return { activeSessionId: null, sessions: [] };
   }
@@ -9228,7 +9019,7 @@ async function readCodexSessionCatalog(runtimeDirectory) {
 }
 async function writeCodexSessionCatalog(runtimeDirectory, catalog) {
   await mkdir2(runtimeDirectory, { recursive: true });
-  await writeFile2(join9(runtimeDirectory, SESSION_CATALOG_FILENAME), JSON.stringify(catalog, null, 2) + `
+  await writeFile2(join8(runtimeDirectory, SESSION_CATALOG_FILENAME), JSON.stringify(catalog, null, 2) + `
 `);
 }
 async function recordCodexSessionCatalog(runtimeDirectory, threadId, input) {
@@ -9297,10 +9088,10 @@ class CodexAppServerTransport {
   errorListeners = new Set;
   constructor(options) {
     this.options = options;
-    this.threadIdPath = join9(options.runtimeDirectory, "codex-thread-id.txt");
-    this.statePath = join9(options.runtimeDirectory, "state.json");
-    this.stdoutLogPath = join9(options.logsDirectory, "stdout.log");
-    this.stderrLogPath = join9(options.logsDirectory, "stderr.log");
+    this.threadIdPath = join8(options.runtimeDirectory, "codex-thread-id.txt");
+    this.statePath = join8(options.runtimeDirectory, "state.json");
+    this.stdoutLogPath = join8(options.logsDirectory, "stdout.log");
+    this.stderrLogPath = join8(options.logsDirectory, "stderr.log");
     this.lastConfigSignature = this.configSignature(options);
   }
   get currentThreadId() {
@@ -9457,7 +9248,7 @@ class CodexAppServerTransport {
   async startSession() {
     await mkdir2(this.options.runtimeDirectory, { recursive: true });
     await mkdir2(this.options.logsDirectory, { recursive: true });
-    await writeFile2(join9(this.options.runtimeDirectory, "prompt.txt"), this.options.systemPrompt);
+    await writeFile2(join8(this.options.runtimeDirectory, "prompt.txt"), this.options.systemPrompt);
     this.proactiveShutdown = null;
     try {
       await assertCodexWorkingDirectory(this.options.cwd, this.options.agentName);
@@ -10202,9 +9993,9 @@ async function shutdownCodexAppServerLocalAgent(options, shutdownOptions = {}) {
   const session = codexAppServerClients.get(key);
   if (!session) {
     if (shutdownOptions.resetThread) {
-      const threadId = await readOptionalFile(join9(options.runtimeDirectory, "codex-thread-id.txt"));
+      const threadId = await readOptionalFile(join8(options.runtimeDirectory, "codex-thread-id.txt"));
       await closeCodexSessionCatalog(options.runtimeDirectory, threadId);
-      await rm(join9(options.runtimeDirectory, "codex-thread-id.txt"), { force: true });
+      await rm(join8(options.runtimeDirectory, "codex-thread-id.txt"), { force: true });
     }
     return;
   }
@@ -11079,9 +10870,9 @@ var init_normalizer3 = __esm(() => {
 });
 
 // ../agent-sessions/src/adapters/codex/topology.ts
-import { existsSync as existsSync9, readdirSync as readdirSync3, readFileSync as readFileSync6, statSync as statSync4 } from "fs";
+import { existsSync as existsSync8, readdirSync as readdirSync3, readFileSync as readFileSync5, statSync as statSync4 } from "fs";
 import { homedir as homedir8 } from "os";
-import { basename as basename4, join as join10 } from "path";
+import { basename as basename4, join as join9 } from "path";
 function isObject2(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
@@ -11198,7 +10989,7 @@ function parseTomlKeyValues(raw) {
 }
 function readTomlKeyValues(path2) {
   try {
-    return parseTomlKeyValues(readFileSync6(path2, "utf8"));
+    return parseTomlKeyValues(readFileSync5(path2, "utf8"));
   } catch {
     return null;
   }
@@ -11212,8 +11003,8 @@ function firstString2(record2, keys) {
   return;
 }
 function readAgentDefinitions(root, scope) {
-  const agentsDir = join10(root, ".codex", "agents");
-  if (!existsSync9(agentsDir) || !statIsDirectory2(agentsDir)) {
+  const agentsDir = join9(root, ".codex", "agents");
+  if (!existsSync8(agentsDir) || !statIsDirectory2(agentsDir)) {
     return { agents: [], sourceRefs: [] };
   }
   const agents = [];
@@ -11221,7 +11012,7 @@ function readAgentDefinitions(root, scope) {
   for (const entry of readdirSync3(agentsDir).sort()) {
     if (!entry.endsWith(".toml"))
       continue;
-    const path2 = join10(agentsDir, entry);
+    const path2 = join9(agentsDir, entry);
     if (!statIsFile2(path2))
       continue;
     const parsed = readTomlKeyValues(path2);
@@ -11260,8 +11051,8 @@ function readAgentDefinitions(root, scope) {
 function readProjectAgentsConfig(cwd) {
   if (!cwd)
     return {};
-  const configPath = join10(cwd, ".codex", "config.toml");
-  if (!existsSync9(configPath) || !statIsFile2(configPath)) {
+  const configPath = join9(cwd, ".codex", "config.toml");
+  if (!existsSync8(configPath) || !statIsFile2(configPath)) {
     return {};
   }
   const parsed = readTomlKeyValues(configPath);
@@ -11524,7 +11315,7 @@ var init_topology = () => {};
 
 // ../agent-sessions/src/adapters/codex/adapter.ts
 import { homedir as homedir9 } from "os";
-import { join as join11 } from "path";
+import { join as join10 } from "path";
 function errorMessage2(error) {
   if (error instanceof Error) {
     return error.message;
@@ -11551,7 +11342,7 @@ var init_adapter2 = __esm(() => {
     sequence = 0;
     constructor(config) {
       super(config);
-      const runtimeRoot = join11(homedir9(), ".scout/pairing", "codex", this.session.id);
+      const runtimeRoot = join10(homedir9(), ".scout/pairing", "codex", this.session.id);
       this.observedTopology = new CodexObservedTopologyTracker({
         cwd: config.cwd ?? process.cwd(),
         homeDir: config.env?.HOME,
@@ -11563,8 +11354,8 @@ var init_adapter2 = __esm(() => {
         model: this.session.model,
         providerMeta: {
           ...this.session.providerMeta ?? {},
-          stdoutLogFile: join11(runtimeRoot, "logs/stdout.log"),
-          stderrLogFile: join11(runtimeRoot, "logs/stderr.log")
+          stdoutLogFile: join10(runtimeRoot, "logs/stdout.log"),
+          stderrLogFile: join10(runtimeRoot, "logs/stderr.log")
         }
       });
     }
@@ -11623,7 +11414,7 @@ var init_adapter2 = __esm(() => {
       this.setStatus("closed");
     }
     get codexOptions() {
-      const runtimeRoot = join11(homedir9(), ".scout/pairing", "codex", this.session.id);
+      const runtimeRoot = join10(homedir9(), ".scout/pairing", "codex", this.session.id);
       const configuredThreadId = this.config.options?.["threadId"];
       const requireExistingThread = this.config.options?.["requireExistingThread"];
       const rawLaunchArgs = this.config.options?.["launchArgs"];
@@ -11635,8 +11426,8 @@ var init_adapter2 = __esm(() => {
         sessionId: this.session.id,
         cwd: this.config.cwd ?? process.cwd(),
         systemPrompt: this.systemPrompt,
-        runtimeDirectory: join11(runtimeRoot, "runtime"),
-        logsDirectory: join11(runtimeRoot, "logs"),
+        runtimeDirectory: join10(runtimeRoot, "runtime"),
+        logsDirectory: join10(runtimeRoot, "logs"),
         env: this.config.env,
         launchArgs,
         threadId: typeof configuredThreadId === "string" && configuredThreadId.trim().length > 0 ? configuredThreadId.trim() : undefined,
@@ -11655,10 +11446,10 @@ var init_adapter2 = __esm(() => {
       return typeof raw === "string" && raw.trim().length > 0 ? raw : "You are a helpful agent working through Pairing.";
     }
     get stdoutLogPath() {
-      return this.transport?.stdoutLogFile ?? join11(this.codexOptions.logsDirectory, "stdout.log");
+      return this.transport?.stdoutLogFile ?? join10(this.codexOptions.logsDirectory, "stdout.log");
     }
     get stderrLogPath() {
-      return this.transport?.stderrLogFile ?? join11(this.codexOptions.logsDirectory, "stderr.log");
+      return this.transport?.stderrLogFile ?? join10(this.codexOptions.logsDirectory, "stderr.log");
     }
     enqueue(task) {
       const next = this.serialized.then(task, task);
@@ -11826,9 +11617,9 @@ var init_codex = __esm(() => {
 
 // ../agent-sessions/src/adapters/acp/adapter.ts
 import { spawn as spawn2 } from "child_process";
-import { existsSync as existsSync10 } from "fs";
+import { existsSync as existsSync9 } from "fs";
 import { mkdir as mkdir3, readFile as readFile3, writeFile as writeFile3 } from "fs/promises";
-import { dirname as dirname7, isAbsolute, relative as relative2, resolve as resolve2 } from "path";
+import { dirname as dirname6, isAbsolute, relative as relative2, resolve as resolve2 } from "path";
 import { pathToFileURL } from "url";
 function isRecord3(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
@@ -12207,7 +11998,7 @@ var init_adapter3 = __esm(() => {
         return;
       }
       const options = this.acpOptions;
-      if (!existsSync10(options.cwd)) {
+      if (!existsSync9(options.cwd)) {
         const failure = new Error(`ACP agent working directory does not exist: ${options.cwd}` + ` (harness command: ${options.command})`);
         this.failSession(failure);
         throw failure;
@@ -12867,7 +12658,7 @@ ${plan}`,
         return;
       }
       const filePath = this.resolveAllowedPath(requestedPath);
-      await mkdir3(dirname7(filePath), { recursive: true });
+      await mkdir3(dirname6(filePath), { recursive: true });
       await writeFile3(filePath, params.content, "utf8");
       this.writeResult(message.id, {});
     }
@@ -13067,16 +12858,16 @@ var init_acp = __esm(() => {
 });
 
 // ../agent-sessions/src/adapters/grok-acp/adapter.ts
-import { existsSync as existsSync11 } from "fs";
+import { existsSync as existsSync10 } from "fs";
 import { homedir as homedir10 } from "os";
-import { join as join12 } from "path";
+import { join as join11 } from "path";
 function defaultGrokCommand(env) {
   const override = firstNonEmptyString(env?.GROK_CLI_BIN, process.env.GROK_CLI_BIN);
   if (override) {
     return override;
   }
-  const installed = join12(homedir10(), ".grok", "bin", "grok");
-  return existsSync11(installed) ? installed : "grok";
+  const installed = join11(homedir10(), ".grok", "bin", "grok");
+  return existsSync10(installed) ? installed : "grok";
 }
 function isRecord4(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
@@ -13151,9 +12942,9 @@ var init_grok_acp = __esm(() => {
 });
 
 // ../agent-sessions/src/adapters/kimi-acp/adapter.ts
-import { existsSync as existsSync12 } from "fs";
+import { existsSync as existsSync11 } from "fs";
 import { homedir as homedir11 } from "os";
-import { join as join13 } from "path";
+import { join as join12 } from "path";
 function isRecord5(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
@@ -13182,10 +12973,10 @@ function defaultKimiCommand(env) {
     return override;
   }
   const installedCandidates = [
-    join13(homedir11(), ".kimi-code", "bin", "kimi"),
-    join13(homedir11(), ".local", "bin", "kimi")
+    join12(homedir11(), ".kimi-code", "bin", "kimi"),
+    join12(homedir11(), ".local", "bin", "kimi")
   ];
-  return installedCandidates.find((candidate) => existsSync12(candidate)) ?? "kimi";
+  return installedCandidates.find((candidate) => existsSync11(candidate)) ?? "kimi";
 }
 var DEFAULT_KIMI_ARGS, DEFAULT_KIMI_STARTUP_TIMEOUT_MS = 60000, KIMI_ACP_ADAPTER_TYPE = "kimi-acp", createAdapter5 = (config) => {
   const rawOptions = isRecord5(config.options) ? config.options : {};
@@ -15356,7 +15147,7 @@ var init_service = () => {};
 import { readFile as readFile4 } from "fs/promises";
 import { spawn as spawn3 } from "child_process";
 import { homedir as homedir12 } from "os";
-import { join as join14 } from "path";
+import { join as join13 } from "path";
 async function discover(options = {}) {
   return (await discoverLocal(options))?.endpoint;
 }
@@ -15468,7 +15259,7 @@ async function stop(options = {}) {
     await kill(existing, options);
 }
 function fallback() {
-  return join14(process.env["XDG_STATE_HOME"] ?? join14(homedir12(), ".local", "state"), "opencode", "service.json");
+  return join13(process.env["XDG_STATE_HOME"] ?? join13(homedir12(), ".local", "state"), "opencode", "service.json");
 }
 function headers(endpoint) {
   if (endpoint.auth === undefined)
@@ -16317,9 +16108,9 @@ var init_normalizer4 = __esm(() => {
 });
 
 // ../agent-sessions/src/adapters/opencode-v2/adapter.ts
-import { existsSync as existsSync13 } from "fs";
+import { existsSync as existsSync12 } from "fs";
 import { homedir as homedir13 } from "os";
-import { basename as basename5, isAbsolute as isAbsolute2, join as join15, resolve as resolve3 } from "path";
+import { basename as basename5, isAbsolute as isAbsolute2, join as join14, resolve as resolve3 } from "path";
 import { pathToFileURL as pathToFileURL2 } from "url";
 function deferred() {
   let resolvePromise;
@@ -16353,10 +16144,10 @@ function defaultOpenCodeV2Binary(env) {
   const candidates = [
     "/opt/homebrew/bin/opencode2",
     "/usr/local/bin/opencode2",
-    join15(home, ".opencode", "bin", "opencode2"),
-    join15(home, ".local", "bin", "opencode2")
+    join14(home, ".opencode", "bin", "opencode2"),
+    join14(home, ".local", "bin", "opencode2")
   ];
-  return candidates.find((candidate) => existsSync13(candidate)) ?? "opencode2";
+  return candidates.find((candidate) => existsSync12(candidate)) ?? "opencode2";
 }
 function modelRef(value, variantValue) {
   const raw = stringValue8(value);
@@ -17386,9 +17177,9 @@ var init_opencode_v2 = __esm(() => {
 
 // ../agent-sessions/src/adapters/opencode-acp/adapter.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync14 } from "fs";
+import { existsSync as existsSync13 } from "fs";
 import { homedir as homedir14 } from "os";
-import { join as join16 } from "path";
+import { join as join15 } from "path";
 function isRecord8(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
@@ -17419,10 +17210,10 @@ function defaultOpenCodeCommand(env) {
   const installedCandidates = [
     "/opt/homebrew/bin/opencode",
     "/usr/local/bin/opencode",
-    join16(homedir14(), ".opencode", "bin", "opencode"),
-    join16(homedir14(), ".local", "bin", "opencode")
+    join15(homedir14(), ".opencode", "bin", "opencode"),
+    join15(homedir14(), ".local", "bin", "opencode")
   ];
-  return installedCandidates.find((candidate) => existsSync14(candidate)) ?? "opencode";
+  return installedCandidates.find((candidate) => existsSync13(candidate)) ?? "opencode";
 }
 function configContentEnv(rawOptions, env) {
   const model = stringValue9(rawOptions.model);
@@ -17439,7 +17230,7 @@ function configContentEnv(rawOptions, env) {
   return { [OPENCODE_CONFIG_CONTENT_ENV]: JSON.stringify(overlay) };
 }
 function keychainSecret(name, commandOverride) {
-  const candidates = commandOverride ? [commandOverride] : ["secret", join16(homedir14(), ".local", "bin", "secret")];
+  const candidates = commandOverride ? [commandOverride] : ["secret", join15(homedir14(), ".local", "bin", "secret")];
   for (const command of candidates) {
     try {
       const result = spawnSync2(command, ["get", name], { encoding: "utf8", timeout: 5000 });
@@ -18505,6 +18296,184 @@ var init_src2 = __esm(() => {
   init_cost();
 });
 
+// ../runtime/src/node-identity.ts
+import {
+  createHash,
+  createPrivateKey,
+  createPublicKey,
+  generateKeyPairSync,
+  randomBytes,
+  sign,
+  verify
+} from "crypto";
+import {
+  chmodSync,
+  existsSync as existsSync14,
+  mkdirSync as mkdirSync4,
+  readFileSync as readFileSync6,
+  renameSync as renameSync2,
+  rmSync as rmSync2,
+  writeFileSync as writeFileSync4
+} from "fs";
+import { dirname as dirname7, join as join16 } from "path";
+function nodeIdentityPath(supportDirectory) {
+  const dir = supportDirectory ?? resolveOpenScoutSupportPaths().supportDirectory;
+  return join16(dir, NODE_IDENTITY_FILE);
+}
+function loadOrCreateNodeIdentity(supportDirectory) {
+  const path2 = nodeIdentityPath(supportDirectory);
+  if (existsSync14(path2)) {
+    return readAndValidateNodeIdentity(path2);
+  }
+  return createNodeIdentity(supportDirectory);
+}
+function readStableNodeQualifier(supportDirectory) {
+  const path2 = nodeIdentityPath(supportDirectory);
+  const cached = stableNodeQualifierCache.get(path2);
+  if (cached) {
+    return cached;
+  }
+  if (!existsSync14(path2)) {
+    return null;
+  }
+  const nodeQualifier = normalizeNodeQualifier(readAndValidateNodeIdentity(path2).nodeQualifier);
+  if (nodeQualifier) {
+    stableNodeQualifierCache.set(path2, nodeQualifier);
+  }
+  return nodeQualifier || null;
+}
+function readAndValidateNodeIdentity(path2) {
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync6(path2, "utf8"));
+  } catch {
+    throw new Error(`Corrupt node identity at ${path2}; remove it to generate a fresh one.`);
+  }
+  if (parsed.version !== 1 || !parsed.publicKey || !parsed.privateKey) {
+    throw new Error(`Corrupt node identity at ${path2}; remove it to generate a fresh one.`);
+  }
+  if (parsed.nodeQualifier !== undefined && normalizeNodeQualifier(parsed.nodeQualifier) !== parsed.nodeQualifier) {
+    throw new Error(`Corrupt node identity at ${path2}; remove it to generate a fresh one.`);
+  }
+  try {
+    const derived = createPublicKey(importPrivateKey(parsed.privateKey)).export({ type: "spki", format: "der" }).toString("base64");
+    if (derived !== parsed.publicKey) {
+      throw new Error("mismatch");
+    }
+  } catch {
+    throw new Error(`Node identity at ${path2} has mismatched or invalid keys; remove it to generate a fresh one.`);
+  }
+  return parsed;
+}
+function normalizeNodeQualifier(value) {
+  return typeof value === "string" ? value.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "") : "";
+}
+function createNodeIdentity(supportDirectory) {
+  if (!supportDirectory) {
+    assertTestIsolatedUserData("write the node identity", "OPENSCOUT_SUPPORT_DIRECTORY");
+  }
+  const path2 = nodeIdentityPath(supportDirectory);
+  const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+  const identity = {
+    version: 1,
+    publicKey: publicKey.export({ type: "spki", format: "der" }).toString("base64"),
+    privateKey: privateKey.export({ type: "pkcs8", format: "der" }).toString("base64"),
+    createdAt: Date.now()
+  };
+  mkdirSync4(dirname7(path2), { recursive: true });
+  try {
+    writeFileSync4(path2, `${JSON.stringify(identity, null, 2)}
+`, { encoding: "utf8", mode: 384, flag: "wx" });
+  } catch (error) {
+    if (error.code === "EEXIST") {
+      return readAndValidateNodeIdentity(path2);
+    }
+    throw error;
+  }
+  try {
+    chmodSync(path2, 384);
+  } catch {}
+  return identity;
+}
+function nodeKeyId(publicKeyBase64) {
+  return createHash("sha256").update(Buffer.from(publicKeyBase64, "base64")).digest("hex");
+}
+function nodeFingerprint(publicKeyBase64) {
+  const digest = createHash("sha256").update(Buffer.from(publicKeyBase64, "base64")).digest();
+  const encoded = base32Encode(digest.subarray(0, 10)).toLowerCase();
+  return `${NODE_FINGERPRINT_PREFIX}:${encoded.slice(0, 4)}-${encoded.slice(4, 8)}`;
+}
+function signNodePayload(identity, payload) {
+  const key = importPrivateKey(identity.privateKey);
+  return sign(null, typeof payload === "string" ? Buffer.from(payload, "utf8") : payload, key).toString("base64");
+}
+function verifyNodeSignature(publicKeyBase64, payload, signatureBase64) {
+  try {
+    const key = importPublicKey(publicKeyBase64);
+    return verify(null, typeof payload === "string" ? Buffer.from(payload, "utf8") : payload, key, Buffer.from(signatureBase64, "base64"));
+  } catch {
+    return false;
+  }
+}
+function canonicalJson(value) {
+  if (value === null || typeof value !== "object") {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map(canonicalJson).join(",")}]`;
+  }
+  const record2 = value;
+  const keys = Object.keys(record2).sort();
+  return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalJson(record2[key])}`).join(",")}}`;
+}
+function verifySignedNodeCard(card, now = Date.now()) {
+  if (nodeKeyId(card.publicKey) !== card.keyId) {
+    return false;
+  }
+  if (nodeFingerprint(card.publicKey) !== card.fingerprint) {
+    return false;
+  }
+  if (!Number.isFinite(card.expiresAt) || card.expiresAt <= now) {
+    return false;
+  }
+  if (card.tls !== undefined) {
+    if (typeof card.tls !== "object" || card.tls === null || typeof card.tls.spkiFingerprint !== "string" || !/^[0-9a-f]{64}$/.test(card.tls.spkiFingerprint)) {
+      return false;
+    }
+  }
+  const { signature, ...unsigned } = card;
+  return verifyNodeSignature(card.publicKey, canonicalJson(unsigned), signature);
+}
+function base32Encode(input) {
+  let bits = 0;
+  let value = 0;
+  let output = "";
+  for (const byte of input) {
+    value = value << 8 | byte;
+    bits += 8;
+    while (bits >= 5) {
+      output += BASE32_ALPHABET[value >>> bits - 5 & 31];
+      bits -= 5;
+    }
+  }
+  if (bits > 0) {
+    output += BASE32_ALPHABET[value << 5 - bits & 31];
+  }
+  return output;
+}
+function importPrivateKey(privateKeyBase64) {
+  return createPrivateKey({ key: Buffer.from(privateKeyBase64, "base64"), format: "der", type: "pkcs8" });
+}
+function importPublicKey(publicKeyBase64) {
+  return createPublicKey({ key: Buffer.from(publicKeyBase64, "base64"), format: "der", type: "spki" });
+}
+var NODE_IDENTITY_FILE = "node-identity.json", NODE_FINGERPRINT_PREFIX = "osc1", NODE_CARD_TTL_MS, stableNodeQualifierCache, BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+var init_node_identity = __esm(() => {
+  init_support_paths();
+  NODE_CARD_TTL_MS = 24 * 60 * 60 * 1000;
+  stableNodeQualifierCache = new Map;
+});
+
 // ../../node_modules/.bun/reflect-metadata@0.2.2/node_modules/reflect-metadata/Reflect.js
 var require_Reflect = __commonJS(() => {
   /*! *****************************************************************************
@@ -33121,7 +33090,7 @@ var init_local_agents = __esm(() => {
 // ../web/server/core/pairing/runtime/config.ts
 init_local_config();
 init_open_scout_network();
-import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
 import { homedir as homedir3 } from "os";
 import path from "path";
 var PAIRING_QR_TTL_MS = 5 * 60 * 1000;
@@ -33139,11 +33108,11 @@ function pairingPaths() {
 }
 function loadPairingConfig() {
   const { configPath } = pairingPaths();
-  if (!existsSync4(configPath)) {
+  if (!existsSync3(configPath)) {
     return {};
   }
   try {
-    const payload = JSON.parse(readFileSync4(configPath, "utf8"));
+    const payload = JSON.parse(readFileSync3(configPath, "utf8"));
     return typeof payload === "object" && payload ? payload : {};
   } catch {
     return {};
@@ -34507,7 +34476,7 @@ function sql(strings, ...params) {
     return new SQL([new StringChunk(str)]);
   }
   sql2.raw = raw;
-  function join6(chunks, separator) {
+  function join5(chunks, separator) {
     const result = [];
     for (const [i, chunk] of chunks.entries()) {
       if (i > 0 && separator !== undefined) {
@@ -34517,7 +34486,7 @@ function sql(strings, ...params) {
     }
     return new SQL(result);
   }
-  sql2.join = join6;
+  sql2.join = join5;
   function identifier(value) {
     return new Name(value);
   }
@@ -37459,12 +37428,10 @@ class InMemoryControlRuntime {
   }
 }
 // ../runtime/src/sqlite-store.ts
-init_node_identity();
 init_sqlite_adapter();
 
 // ../runtime/src/control-plane-migrations.ts
 init_support_paths();
-init_node_identity();
 
 // ../runtime/src/budget-observations.ts
 var QUOTA_HISTORY_BUCKET_MS = 60 * 60 * 1000;
@@ -57346,7 +57313,7 @@ function writeJsonAtomically(filePath, value) {
 
 // ../web/server/core/pairing/runtime/runtime.ts
 init_src2();
-import { homedir as homedir40 } from "os";
+import { homedir as homedir41 } from "os";
 
 // ../web/server/core/pairing/runtime/bridge/bridge.ts
 init_src2();
@@ -58604,9 +58571,9 @@ function formatTimestamp(value) {
 // ../web/server/core/pairing/runtime/bridge/server.ts
 init_system_probes();
 init_src2();
-import { readdirSync as readdirSync6, readFileSync as readFileSync24, realpathSync as realpathSync5, statSync as statSync12 } from "fs";
-import { basename as basename13, isAbsolute as isAbsolute7, join as join46, relative as relative6, resolve as resolve18 } from "path";
-import { homedir as homedir37 } from "os";
+import { readdirSync as readdirSync6, readFileSync as readFileSync25, realpathSync as realpathSync5, statSync as statSync12 } from "fs";
+import { basename as basename13, isAbsolute as isAbsolute7, join as join47, relative as relative6, resolve as resolve18 } from "path";
+import { homedir as homedir38 } from "os";
 
 // ../web/server/core/mobile/service.ts
 init_src();
@@ -62984,17 +62951,122 @@ function describeError(cause) {
 }
 
 // ../web/server/pairing.ts
+import {
+  existsSync as existsSync37,
+  mkdirSync as mkdirSync18,
+  readFileSync as readFileSync23,
+  statSync as statSync10,
+  unlinkSync as unlinkSync3,
+  writeFileSync as writeFileSync14
+} from "fs";
+import { homedir as homedir35 } from "os";
+import { dirname as dirname23, join as join44, resolve as resolve15 } from "path";
+init_setup();
+
+// ../runtime/src/pairing-supervisor.ts
+import { execFileSync as execFileSync6 } from "child_process";
+import { randomUUID as randomUUID6 } from "crypto";
 import {
   existsSync as existsSync36,
   mkdirSync as mkdirSync17,
   readFileSync as readFileSync22,
-  statSync as statSync10,
-  unlinkSync as unlinkSync3,
+  renameSync as renameSync6,
+  rmSync as rmSync4,
   writeFileSync as writeFileSync13
 } from "fs";
 import { homedir as homedir34 } from "os";
-import { dirname as dirname22, join as join43, resolve as resolve15 } from "path";
-init_setup();
+import { dirname as dirname22, join as join43 } from "path";
+var SCOUT_PAIRING_SUPERVISOR_INTENT_FILE = "supervisor.json";
+var SCOUT_PAIRING_RUNTIME_PID_FILE = "runtime.pid";
+var SCOUT_PAIRING_RUNTIME_OWNER_FILE = "runtime-owner.json";
+var SCOUT_PAIRING_SUPERVISOR_PID_FILE = "supervisor.pid";
+var SCOUT_PAIRING_RUNTIME_PROCESS_MARKER = "pairing-runtime-controller";
+function resolveScoutPairingSupervisorPaths(env = process.env) {
+  const configuredRoot = env.OPENSCOUT_PAIRING_HOME?.trim() || env.SCOUT_PAIRING_HOME?.trim();
+  const rootDir = configuredRoot || join43(homedir34(), ".scout", "pairing");
+  return {
+    rootDir,
+    intentPath: join43(rootDir, SCOUT_PAIRING_SUPERVISOR_INTENT_FILE),
+    runtimePidPath: join43(rootDir, SCOUT_PAIRING_RUNTIME_PID_FILE),
+    runtimeOwnerPath: join43(rootDir, SCOUT_PAIRING_RUNTIME_OWNER_FILE),
+    supervisorPidPath: join43(rootDir, SCOUT_PAIRING_SUPERVISOR_PID_FILE)
+  };
+}
+function inspectScoutPairingProcess(pid) {
+  if (!Number.isInteger(pid) || pid <= 0)
+    return null;
+  try {
+    const output = execFileSync6("ps", ["-p", String(pid), "-o", "lstart=", "-o", "command="], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    const startedAt = output.slice(0, 24).trim().replace(/\s+/g, " ");
+    const command = output.slice(24).trim();
+    return startedAt && command ? { pid, startedAt, command } : null;
+  } catch {
+    return null;
+  }
+}
+function readScoutPairingRuntimeOwner(ownerPath = resolveScoutPairingSupervisorPaths().runtimeOwnerPath) {
+  if (!existsSync36(ownerPath))
+    return null;
+  try {
+    const value = JSON.parse(readFileSync22(ownerPath, "utf8"));
+    return value.version === 1 && Number.isInteger(value.pid) && (value.pid ?? 0) > 0 && typeof value.token === "string" && value.token.length >= 16 && typeof value.startedAt === "string" && value.startedAt.length > 0 && typeof value.command === "string" && value.command.includes(SCOUT_PAIRING_RUNTIME_PROCESS_MARKER) && typeof value.claimedAt === "number" && Number.isFinite(value.claimedAt) ? value : null;
+  } catch {
+    return null;
+  }
+}
+function isScoutPairingRuntimeOwnerLive(owner, options = {}) {
+  if (!owner || options.expectedToken && owner.token !== options.expectedToken)
+    return false;
+  const current = (options.inspect ?? inspectScoutPairingProcess)(owner.pid);
+  return current !== null && current.startedAt === owner.startedAt && current.command === owner.command && current.command.includes(SCOUT_PAIRING_RUNTIME_PROCESS_MARKER);
+}
+function readLiveScoutPairingRuntimeOwner(ownerPath = resolveScoutPairingSupervisorPaths().runtimeOwnerPath, options = {}) {
+  const owner = readScoutPairingRuntimeOwner(ownerPath);
+  return isScoutPairingRuntimeOwnerLive(owner, options) ? owner : null;
+}
+function claimScoutPairingRuntimeOwnership(options = {}) {
+  const pid = options.pid ?? process.pid;
+  const ownerPath = options.ownerPath ?? resolveScoutPairingSupervisorPaths().runtimeOwnerPath;
+  const inspect = options.inspect ?? inspectScoutPairingProcess;
+  const existing = readLiveScoutPairingRuntimeOwner(ownerPath, { inspect });
+  if (existing && existing.pid !== pid) {
+    throw new Error(`Scout pairing runtime is already owned by pid ${existing.pid}.`);
+  }
+  const identity = inspect(pid);
+  if (!identity || !identity.command.includes(SCOUT_PAIRING_RUNTIME_PROCESS_MARKER)) {
+    throw new Error(`Cannot prove Scout pairing runtime ownership for pid ${pid}.`);
+  }
+  const owner = {
+    version: 1,
+    ...identity,
+    token: options.token?.trim() || randomUUID6(),
+    claimedAt: options.now ?? Date.now()
+  };
+  mkdirSync17(dirname22(ownerPath), { recursive: true });
+  writeFileAtomically(ownerPath, `${JSON.stringify(owner, null, 2)}
+`);
+  return owner;
+}
+function releaseScoutPairingRuntimeOwnership(owner, ownerPath = resolveScoutPairingSupervisorPaths().runtimeOwnerPath) {
+  const current = readScoutPairingRuntimeOwner(ownerPath);
+  if (!current || current.pid !== owner.pid || current.token !== owner.token)
+    return;
+  rmSync4(ownerPath, { force: true });
+}
+function writeFileAtomically(path2, contents) {
+  const temporaryPath = `${path2}.${process.pid}.${Date.now()}.tmp`;
+  try {
+    writeFileSync13(temporaryPath, contents);
+    renameSync6(temporaryPath, path2);
+  } finally {
+    rmSync4(temporaryPath, { force: true });
+  }
+}
+
+// ../web/server/pairing.ts
 init_local_config();
 init_tool_resolution();
 var SCOUT_PAIRING_HOME_DIRECTORY = ".scout/pairing";
@@ -63003,25 +63075,25 @@ var SCOUT_PAIRING_IDENTITY_FILE = "identity.json";
 var SCOUT_PAIRING_TRUSTED_PEERS_FILE = "trusted-peers.json";
 var SCOUT_PAIRING_LOG_FILE = "bridge.log";
 var SCOUT_PAIRING_RUNTIME_STATE_FILE = "runtime.json";
-var SCOUT_PAIRING_RUNTIME_PID_FILE = "runtime.pid";
+var SCOUT_PAIRING_RUNTIME_PID_FILE2 = "runtime.pid";
 var SCOUT_PAIRING_DEFAULT_PORT = 7888;
 var SCOUT_PAIRING_RUNTIME_VERSION = 1;
 var SCOUT_PAIRING_BRIDGE_CONNECT_TIMEOUT_MS = 1500;
 var SCOUT_PAIRING_BRIDGE_REQUEST_TIMEOUT_MS = 2500;
 function resolveScoutPairingHomeDirectory() {
   const configured = process.env.OPENSCOUT_PAIRING_HOME?.trim() || process.env.SCOUT_PAIRING_HOME?.trim();
-  return configured || join43(homedir34(), SCOUT_PAIRING_HOME_DIRECTORY);
+  return configured || join44(homedir35(), SCOUT_PAIRING_HOME_DIRECTORY);
 }
 function resolveScoutPairingPaths() {
   const rootDir = resolveScoutPairingHomeDirectory();
   return {
     rootDir,
-    configPath: join43(rootDir, SCOUT_PAIRING_CONFIG_FILE),
-    identityPath: join43(rootDir, SCOUT_PAIRING_IDENTITY_FILE),
-    trustedPeersPath: join43(rootDir, SCOUT_PAIRING_TRUSTED_PEERS_FILE),
-    logPath: join43(rootDir, SCOUT_PAIRING_LOG_FILE),
-    runtimeStatePath: join43(rootDir, SCOUT_PAIRING_RUNTIME_STATE_FILE),
-    runtimePidPath: join43(rootDir, SCOUT_PAIRING_RUNTIME_PID_FILE)
+    configPath: join44(rootDir, SCOUT_PAIRING_CONFIG_FILE),
+    identityPath: join44(rootDir, SCOUT_PAIRING_IDENTITY_FILE),
+    trustedPeersPath: join44(rootDir, SCOUT_PAIRING_TRUSTED_PEERS_FILE),
+    logPath: join44(rootDir, SCOUT_PAIRING_LOG_FILE),
+    runtimeStatePath: join44(rootDir, SCOUT_PAIRING_RUNTIME_STATE_FILE),
+    runtimePidPath: join44(rootDir, SCOUT_PAIRING_RUNTIME_PID_FILE2)
   };
 }
 function createScoutPairingBridgeUrl(port) {
@@ -63162,11 +63234,11 @@ async function loadScoutPairingSessionSnapshots(port) {
 }
 function loadScoutPairingConfig() {
   const { configPath } = resolveScoutPairingPaths();
-  if (!existsSync36(configPath)) {
+  if (!existsSync37(configPath)) {
     return {};
   }
   try {
-    const payload = JSON.parse(readFileSync22(configPath, "utf8"));
+    const payload = JSON.parse(readFileSync23(configPath, "utf8"));
     return typeof payload === "object" && payload ? payload : {};
   } catch {
     return {};
@@ -63187,11 +63259,11 @@ function resolveScoutPairingConfig() {
 }
 function readScoutPairingRuntimeSnapshot() {
   const { runtimeStatePath } = resolveScoutPairingPaths();
-  if (!existsSync36(runtimeStatePath)) {
+  if (!existsSync37(runtimeStatePath)) {
     return null;
   }
   try {
-    const parsed = JSON.parse(readFileSync22(runtimeStatePath, "utf8"));
+    const parsed = JSON.parse(readFileSync23(runtimeStatePath, "utf8"));
     return parsed?.version === SCOUT_PAIRING_RUNTIME_VERSION ? parsed : null;
   } catch {
     return null;
@@ -63199,18 +63271,18 @@ function readScoutPairingRuntimeSnapshot() {
 }
 function readScoutPairingRuntimePid() {
   const { runtimePidPath } = resolveScoutPairingPaths();
-  if (!existsSync36(runtimePidPath)) {
+  if (!existsSync37(runtimePidPath)) {
     return null;
   }
   try {
-    const raw = readFileSync22(runtimePidPath, "utf8").trim();
+    const raw = readFileSync23(runtimePidPath, "utf8").trim();
     const pid = Number(raw);
     return Number.isInteger(pid) && pid > 0 ? pid : null;
   } catch {
     return null;
   }
 }
-function isScoutPairingProcessRunning2(pid) {
+function isScoutPairingProcessRunning(pid) {
   if (!pid || !Number.isInteger(pid) || pid <= 0) {
     return false;
   }
@@ -63223,11 +63295,11 @@ function isScoutPairingProcessRunning2(pid) {
 }
 function isScoutPairingRuntimeRunning() {
   const pid = readScoutPairingRuntimePid();
-  if (isScoutPairingProcessRunning2(pid)) {
+  if (isScoutPairingProcessRunning(pid)) {
     return true;
   }
   const snapshot = readScoutPairingRuntimeSnapshot();
-  return Boolean(snapshot && isScoutPairingProcessRunning2(snapshot.childPid ?? snapshot.pid));
+  return Boolean(snapshot && isScoutPairingProcessRunning(snapshot.childPid ?? snapshot.pid));
 }
 var pairingMutationChain = Promise.resolve();
 async function getScoutWebPairingSessionSnapshots() {
@@ -63240,8 +63312,8 @@ async function getScoutWebPairingSessionSnapshots() {
 
 // ../web/server/core/agent-endpoints.ts
 init_src();
-import { homedir as homedir35 } from "os";
-import { join as join44, resolve as resolve16 } from "path";
+import { homedir as homedir36 } from "os";
+import { join as join45, resolve as resolve16 } from "path";
 function endpointMetadataRecord(endpoint) {
   return endpoint?.metadata && typeof endpoint.metadata === "object" && !Array.isArray(endpoint.metadata) ? endpoint.metadata : {};
 }
@@ -63275,10 +63347,10 @@ function endpointSessionAliases(endpoint) {
 }
 function expandHomePath5(value) {
   if (value === "~") {
-    return homedir35();
+    return homedir36();
   }
   if (value.startsWith("~/")) {
-    return join44(homedir35(), value.slice(2));
+    return join45(homedir36(), value.slice(2));
   }
   return value;
 }
@@ -64585,16 +64657,16 @@ import { createHash as createHash9 } from "crypto";
 import {
   chmodSync as chmodSync2,
   closeSync,
-  existsSync as existsSync37,
-  mkdirSync as mkdirSync18,
+  existsSync as existsSync38,
+  mkdirSync as mkdirSync19,
   openSync,
-  readFileSync as readFileSync23,
-  renameSync as renameSync6,
+  readFileSync as readFileSync24,
+  renameSync as renameSync7,
   unlinkSync as unlinkSync4,
-  writeFileSync as writeFileSync14
+  writeFileSync as writeFileSync15
 } from "fs";
-import { homedir as homedir36, hostname as hostname3, userInfo as userInfo2 } from "os";
-import { join as join45 } from "path";
+import { homedir as homedir37, hostname as hostname3, userInfo as userInfo2 } from "os";
+import { join as join46 } from "path";
 
 // ../web/server/core/pairing/runtime/bridge/ssh-terminal-access.ts
 import { createHash as createHash7 } from "crypto";
@@ -64821,8 +64893,8 @@ function authorizedMobileTerminalSessionName(requestedSessionName, provisionedSe
 
 // ../web/server/core/pairing/runtime/bridge/mobile-terminal-provision.ts
 async function readMobileTerminalStatus(requestedSessionName, deviceId) {
-  const authorizedKeysPath = join45(homedir36(), ".ssh", "authorized_keys");
-  const authorizedKeys = existsSync37(authorizedKeysPath) ? readFileSync23(authorizedKeysPath, "utf8") : "";
+  const authorizedKeysPath = join46(homedir37(), ".ssh", "authorized_keys");
+  const authorizedKeys = existsSync38(authorizedKeysPath) ? readFileSync24(authorizedKeysPath, "utf8") : "";
   const provisionedSessionName = findSshTerminalSessionForDevice(authorizedKeys, deviceId);
   const sessionName = authorizedMobileTerminalSessionName(requestedSessionName, provisionedSessionName);
   const base = {
@@ -64894,17 +64966,17 @@ async function readMobileTerminalStatus(requestedSessionName, deviceId) {
 async function provisionMobileTerminalAccess(sshPublicKey, deviceId, deviceClass = undefined) {
   const id = deviceId?.trim() || "scout-ios-device";
   const sessionName = provisionedMobileTerminalSessionName(sshPublicKey, deviceClass);
-  const sshDir = join45(homedir36(), ".ssh");
-  const authorizedKeysPath = join45(sshDir, "authorized_keys");
+  const sshDir = join46(homedir37(), ".ssh");
+  const authorizedKeysPath = join46(sshDir, "authorized_keys");
   const hostKeyFingerprint = readRequiredHostKeyFingerprint();
   const result = withAuthorizedKeysLock(sshDir, () => {
-    if (!existsSync37(sshDir)) {
-      mkdirSync18(sshDir, { recursive: true, mode: 448 });
+    if (!existsSync38(sshDir)) {
+      mkdirSync19(sshDir, { recursive: true, mode: 448 });
     }
     try {
       chmodSync2(sshDir, 448);
     } catch {}
-    const existing = existsSync37(authorizedKeysPath) ? readFileSync23(authorizedKeysPath, "utf8") : "";
+    const existing = existsSync38(authorizedKeysPath) ? readFileSync24(authorizedKeysPath, "utf8") : "";
     const result2 = provisionSshTerminalAccess({
       authorizedKeys: existing,
       deviceId: id,
@@ -64952,7 +65024,7 @@ function resolveReachableHost() {
 }
 function readRequiredHostKeyFingerprint() {
   try {
-    const pub = readFileSync23("/etc/ssh/ssh_host_ed25519_key.pub", "utf8");
+    const pub = readFileSync24("/etc/ssh/ssh_host_ed25519_key.pub", "utf8");
     const keyData = pub.trim().split(/\s+/)[1];
     if (!keyData)
       throw new Error("missing key data");
@@ -64966,8 +65038,8 @@ function readRequiredHostKeyFingerprint() {
 function writeAuthorizedKeysAtomically(path2, contents) {
   const tmpPath = `${path2}.scout-${process.pid}-${Date.now()}.tmp`;
   try {
-    writeFileSync14(tmpPath, contents, { mode: 384, flag: "wx" });
-    renameSync6(tmpPath, path2);
+    writeFileSync15(tmpPath, contents, { mode: 384, flag: "wx" });
+    renameSync7(tmpPath, path2);
   } catch (error) {
     try {
       unlinkSync4(tmpPath);
@@ -64976,10 +65048,10 @@ function writeAuthorizedKeysAtomically(path2, contents) {
   }
 }
 function withAuthorizedKeysLock(sshDir, action) {
-  if (!existsSync37(sshDir)) {
-    mkdirSync18(sshDir, { recursive: true, mode: 448 });
+  if (!existsSync38(sshDir)) {
+    mkdirSync19(sshDir, { recursive: true, mode: 448 });
   }
-  const lockPath = join45(sshDir, ".scout-authorized-keys.lock");
+  const lockPath = join46(sshDir, ".scout-authorized-keys.lock");
   const deadline = Date.now() + 5000;
   let fd = null;
   while (fd === null) {
@@ -65572,7 +65644,7 @@ async function handleRPCInner(bridge, req, rpcContext = {}) {
         const config = resolveConfig();
         const workspaceRoot = config.workspace?.root ? resolveWorkspaceRoot(config.workspace.root) : null;
         const matches = await readSessionSearch({
-          home: homedir37(),
+          home: homedir38(),
           workspaceRoot,
           maxAgeDays: maxAge,
           limit,
@@ -65587,7 +65659,7 @@ async function handleRPCInner(bridge, req, rpcContext = {}) {
           return { id: req.id, error: { code: -32000, message: "Only .jsonl files can be read" } };
         }
         try {
-          const content = readFileSync24(p.path, "utf-8");
+          const content = readFileSync25(p.path, "utf-8");
           const lines = content.split(`
 `).filter((l) => l.trim().length > 0);
           const trimmed = lines.length > 500 ? lines.slice(-500) : lines;
@@ -65708,13 +65780,13 @@ function resolveMobileCurrentDirectory() {
   }
 }
 function resolveWorkspaceRoot(root) {
-  const expandedRoot = root.replace(/^~/, homedir37());
+  const expandedRoot = root.replace(/^~/, homedir38());
   return realpathSync5(expandedRoot);
 }
 function resolveWorkspacePath(root, requestedPath) {
   const normalizedRoot = resolveWorkspaceRoot(root);
-  const expandedPath = requestedPath?.replace(/^~/, homedir37());
-  const candidate = expandedPath ? isAbsolute7(expandedPath) ? expandedPath : join46(normalizedRoot, expandedPath) : normalizedRoot;
+  const expandedPath = requestedPath?.replace(/^~/, homedir38());
+  const candidate = expandedPath ? isAbsolute7(expandedPath) ? expandedPath : join47(normalizedRoot, expandedPath) : normalizedRoot;
   const resolvedCandidate = realpathSync5(candidate);
   const rel = relative6(normalizedRoot, resolvedCandidate);
   if (rel === "" || !rel.startsWith("..") && !isAbsolute7(rel)) {
@@ -65744,7 +65816,7 @@ function listDirectories(dirPath) {
       continue;
     if (name2 === "node_modules" || name2 === ".build" || name2 === "target")
       continue;
-    const fullPath = join46(dirPath, name2);
+    const fullPath = join47(dirPath, name2);
     try {
       const stat6 = statSync12(fullPath);
       if (!stat6.isDirectory())
@@ -65770,7 +65842,7 @@ async function discoverSessionFiles(maxAgeDays, limit) {
   const config = resolveConfig();
   const workspaceRoot = config.workspace?.root ? resolveWorkspaceRoot(config.workspace.root) : null;
   const sessions4 = await readSessionFileScan({
-    home: homedir37(),
+    home: homedir38(),
     workspaceRoot,
     maxAgeDays,
     limit
@@ -77578,7 +77650,7 @@ function finalize(ctx, schema2) {
     result.$schema = "http://json-schema.org/draft-07/schema#";
   } else if (ctx.target === "draft-04") {
     result.$schema = "http://json-schema.org/draft-04/schema#";
-  } else if (ctx.target === "openapi-3.0") {}
+  } else if (ctx.target === "openapi-3.0") {} else {}
   if (ctx.external?.uri) {
     const id = ctx.external.registry.get(schema2)?.id;
     if (!id)
@@ -77826,7 +77898,7 @@ var literalProcessor = (schema2, ctx, json2, _params) => {
     if (val === undefined) {
       if (ctx.unrepresentable === "throw") {
         throw new Error("Literal `undefined` cannot be represented in JSON Schema");
-      }
+      } else {}
     } else if (typeof val === "bigint") {
       if (ctx.unrepresentable === "throw") {
         throw new Error("BigInt literals cannot be represented in JSON Schema");
@@ -80176,9 +80248,9 @@ init_src2();
 init_system_probes();
 init_local_config();
 init_local_agents();
-import { readFileSync as readFileSync25, readdirSync as readdirSync7, realpathSync as realpathSync6, statSync as statSync13 } from "fs";
-import { basename as basename14, isAbsolute as isAbsolute8, join as join47, relative as relative7, resolve as resolve19 } from "path";
-import { homedir as homedir38 } from "os";
+import { readFileSync as readFileSync26, readdirSync as readdirSync7, realpathSync as realpathSync6, statSync as statSync13 } from "fs";
+import { basename as basename14, isAbsolute as isAbsolute8, join as join48, relative as relative7, resolve as resolve19 } from "path";
+import { homedir as homedir39 } from "os";
 var t = initTRPC.context().create();
 var logged = t.middleware(async ({ path: path2, type, next }) => {
   const start = Date.now();
@@ -80344,13 +80416,13 @@ function resolveMobileCurrentDirectory2() {
   }
 }
 function resolveWorkspaceRoot2(root) {
-  const expandedRoot = root.replace(/^~/, homedir38());
+  const expandedRoot = root.replace(/^~/, homedir39());
   return realpathSync6(expandedRoot);
 }
 function resolveWorkspacePath2(root, requestedPath) {
   const normalizedRoot = resolveWorkspaceRoot2(root);
-  const expandedPath = requestedPath?.replace(/^~/, homedir38());
-  const candidate = expandedPath ? isAbsolute8(expandedPath) ? expandedPath : join47(normalizedRoot, expandedPath) : normalizedRoot;
+  const expandedPath = requestedPath?.replace(/^~/, homedir39());
+  const candidate = expandedPath ? isAbsolute8(expandedPath) ? expandedPath : join48(normalizedRoot, expandedPath) : normalizedRoot;
   const resolvedCandidate = realpathSync6(candidate);
   const rel = relative7(normalizedRoot, resolvedCandidate);
   if (rel === "" || !rel.startsWith("..") && !isAbsolute8(rel)) {
@@ -80380,7 +80452,7 @@ function listDirectories2(dirPath) {
       continue;
     if (name2 === "node_modules" || name2 === ".build" || name2 === "target")
       continue;
-    const fullPath = join47(dirPath, name2);
+    const fullPath = join48(dirPath, name2);
     try {
       const stat6 = statSync13(fullPath);
       if (!stat6.isDirectory())
@@ -80413,7 +80485,7 @@ async function discoverSessionFiles2(maxAgeDays, limit) {
   const config2 = resolveConfig();
   const workspaceRoot = config2.workspace?.root ? resolveWorkspaceRoot2(config2.workspace.root) : null;
   const sessions4 = await readSessionFileScan({
-    home: homedir38(),
+    home: homedir39(),
     workspaceRoot,
     maxAgeDays,
     limit
@@ -81102,7 +81174,7 @@ var historyRouter = t.router({
     const config2 = resolveConfig();
     const workspaceRoot = config2.workspace?.root ? resolveWorkspaceRoot2(config2.workspace.root) : null;
     const matches = await readSessionSearch({
-      home: homedir38(),
+      home: homedir39(),
       workspaceRoot,
       maxAgeDays: maxAge,
       limit,
@@ -81119,7 +81191,7 @@ var historyRouter = t.router({
       });
     }
     try {
-      const content = readFileSync25(input.path, "utf-8");
+      const content = readFileSync26(input.path, "utf-8");
       const lines = content.split(`
 `).filter((l) => l.trim().length > 0);
       const trimmed = lines.length > 500 ? lines.slice(-500) : lines;
@@ -81152,7 +81224,7 @@ var historyRouter = t.router({
     }
     try {
       const fileStat = statSync13(input.path);
-      const content = readFileSync25(input.path, "utf-8");
+      const content = readFileSync26(input.path, "utf-8");
       const replay = createHistorySessionSnapshot({
         path: input.path,
         content,
@@ -83516,14 +83588,14 @@ function observableToAsyncIterable(observable$1, signal2) {
 }
 // ../web/server/core/pairing/runtime/bridge/server-trpc.ts
 import { realpathSync as realpathSync7 } from "fs";
-import { homedir as homedir39 } from "os";
+import { homedir as homedir40 } from "os";
 function resolveCurrentDirectory() {
   try {
     const config2 = resolveConfig();
     const configuredRoot = config2.workspace?.root;
     if (!configuredRoot)
       return process.cwd();
-    const expanded = configuredRoot.replace(/^~/, homedir39());
+    const expanded = configuredRoot.replace(/^~/, homedir40());
     return realpathSync7(expanded);
   } catch {
     return process.cwd();
@@ -84178,7 +84250,7 @@ async function autoStartConfiguredSessions(bridge, sessions4) {
     try {
       const session = await bridge.createSession(entry.adapter, {
         name: entry.name,
-        cwd: entry.cwd?.replace(/^~/, homedir40()),
+        cwd: entry.cwd?.replace(/^~/, homedir41()),
         options: entry.options
       });
       console.log(`[bridge] session started: ${session.name} (${entry.adapter})`);
@@ -84197,10 +84269,19 @@ var BONJOUR_SERVICE_TYPE = "_oscout-pair._tcp";
 async function runPairingRuntimeController() {
   clearStalePairingRuntimeFiles();
   const existingPid = readPairingRuntimePid();
-  if (existingPid && existingPid !== process.pid && isProcessRunning(existingPid)) {
+  let existingOwner = readLiveScoutPairingRuntimeOwner();
+  if (!existingOwner && existingPid && existingPid !== process.pid) {
+    try {
+      existingOwner = claimScoutPairingRuntimeOwnership({ pid: existingPid });
+    } catch {
+      existingOwner = null;
+    }
+  }
+  if (existingPid && existingPid !== process.pid && existingOwner?.pid === existingPid) {
     console.error(`Scout pairing runtime controller is already running (pid ${existingPid}).`);
     process.exit(1);
   }
+  const runtimeOwner = claimScoutPairingRuntimeOwnership();
   writePairingRuntimePid(process.pid);
   const state = {
     current: writePairingRuntimeSnapshot(createPairingRuntimeSnapshot({ pid: process.pid }, {
@@ -84240,6 +84321,7 @@ async function runPairingRuntimeController() {
       childPid: null
     });
     clearPairingRuntimePid();
+    releaseScoutPairingRuntimeOwnership(runtimeOwner);
     process.exit(0);
   };
   process.on("SIGINT", () => void shutdown());